https://clairis.cn/tags/byuctf/ Recent content in BYUCTF on Clairis's Blog Hugo zh-cn Wed, 03 Jun 2026 00:00:00 +0000 https://clairis.cn/posts/14byuctf/ Mon, 01 Jun 2026 00:00:00 +0000 https://clairis.cn/posts/14byuctf/ <h1 id="misc"><code>Misc</code></h1> <h2 id="1inception"><code>1.Inception</code></h2> <h3 id="题目描述">题目描述</h3> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-txt" data-lang="txt"><span class="line"><span class="cl">I found this weird file on my computer. I tried opening it, but there were some problems. </span></span></code></pre></div><h3 id="解题思路">解题思路</h3> <p>1‍⃣首先对附件进行检查 附件为<code>png</code>图片，所以复制附件并添上后缀，得到第一部分的<code>flag</code></p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-txt" data-lang="txt"><span class="line"><span class="cl">byuctf{wh4t_ </span></span></code></pre></div><p>2‍⃣同时用<code>binwalk</code>检查并提取隐藏内容 提取出来的有：</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-txt" data-lang="txt"><span class="line"><span class="cl">4F3 4F3.zlib </span></span><span class="line"><span class="cl">29 29.zlib </span></span><span class="line"><span class="cl">337.zip data.bin </span></span></code></pre></div><p>分别读取各附件得到<code>flag</code></p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-txt" data-lang="txt"><span class="line"><span class="cl">从data.bin得到flag的第二部分 </span></span><span class="line"><span class="cl"> th3 </span></span><span class="line"><span class="cl">从4F3中得到第三部分 </span></span><span class="line"><span class="cl"> _fr3ak} </span></span></code></pre></div><p>最终<code>flag</code>为</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-txt" data-lang="txt"><span class="line"><span class="cl">byuctf{wh4t_th3_fr3ak} </span></span></code></pre></div><hr> <h2 id="2easy"><code>2.Easy</code></h2> <h3 id="题目描述-1">题目描述</h3> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-txt" data-lang="txt"><span class="line"><span class="cl">Okay, easy mode is turned on. You know how to use bash, right? </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl">chals.cyberjousting.com:1370 </span></span></code></pre></div><h3 id="解题思路-1">解题思路</h3> <p>1‍⃣首先使用<code>nc</code>连接题目服务 输入<code>pwd</code>测试当前目录 <img src="14byuctf/img-001.png" alt=""> 根据返回结果得知当前工作目录在<code>/app</code> 2‍⃣发现过滤规则 尝试查看当前目录文件，但根据返回的报错可以看出：题目服务会删除命令中的空格 <img src="14byuctf/img-002.png" alt=""> 3‍⃣绕过空格过滤 用<code>${IFS}</code>代替空格使用 <img src="14byuctf/img-003.png" alt=""> 但还是会报错：说明不能直接使用普通外部命令 4‍⃣使用 <code>bash</code> 内置功能列目录 <img src="14byuctf/img-004.png" alt=""> <img src="14byuctf/img-005.png" alt=""></p>