Zengan
这家伙很懒什么也没留下
30
积分79354
排名20
金币- 排 名：
- 79354
- 积 分：
- 30
- 所属战队：
- 暂无
- 注册时间：
- 2025-06-25 16:37
解题记录
| ID | 题目名称 | 类型 | 积分 | 金币 | 解题时间 |
|---|---|---|---|---|---|
| 1 | uploader | WEB | 0 | 0 | 2026-10-31 20:33:30 |
| 2 | zombie-201 | WEB | 0 | 0 | 2026-10-30 17:41:09 |
| 3 | simple web app | WEB | 0 | 0 | 2026-10-30 16:11:51 |
| 4 | Lock Out | WEB | 0 | 0 | 2026-10-22 09:20:13 |
| 5 | Password Extraction | WEB | 0 | 0 | 2026-10-22 01:13:54 |
| 6 | Rceme | WEB | 0 | 0 | 2026-10-22 00:23:36 |
| 7 | l33tSecurity | WEB | 0 | 0 | 2026-10-21 15:17:50 |
| 8 | superezpop | WEB | 0 | 0 | 2026-10-20 16:29:18 |
| 9 | zombie-301 | WEB | 0 | 0 | 2026-10-20 14:55:29 |
| 10 | NotAnotherSQLi | WEB | 0 | 0 | 2026-10-20 10:48:56 |
| 11 | 摆就完事了2 | WEB | 0 | 0 | 2026-10-19 17:40:25 |
| 12 | Science | WEB | 0 | 0 | 2026-10-19 16:49:56 |
| 13 | 逃逸 | WEB | 0 | 0 | 2026-10-19 15:59:24 |
| 14 | Sparta | WEB | 0 | 0 | 2026-10-19 15:48:23 |
| 15 | Upload 2 | WEB | 0 | 0 | 2026-10-19 14:52:19 |
| 16 | Upload 1 | WEB | 0 | 0 | 2026-10-19 14:44:04 |
| 17 | 签到题 | WEB | 0 | 0 | 2026-09-17 15:37:56 |
| 18 | Issues | WEB | 0 | 0 | 2026-09-17 14:00:40 |
| 19 | RIaaS | WEB | 0 | 0 | 2026-09-16 16:29:06 |
| 20 | 恋人? | Ai | 30 | 4 | 2026-09-16 10:49:52 |
| 21 | DootDoot | WEB | 0 | 0 | 2026-09-16 09:48:04 |
| 22 | template | WEB | 0 | 0 | 2026-09-15 17:03:30 |
| 23 | Bank of Knowhere | WEB | 0 | 0 | 2026-08-31 10:47:22 |
| 24 | unzip | WEB | 0 | 0 | 2026-08-28 16:00:50 |
| 25 | Personal_IP_Query | WEB | 0 | 0 | 2026-08-28 15:33:30 |
| 26 | 滴!晨跑打卡 | WEB | 0 | 0 | 2026-08-28 15:07:46 |
| 27 | API 2 : The SeQueL | WEB | 0 | 0 | 2026-08-28 14:18:39 |
| 28 | crator | WEB | 0 | 0 | 2026-08-25 11:28:53 |
| 29 | upload | WEB | 0 | 0 | 2026-08-24 17:28:12 |
| 30 | calc | WEB | 0 | 0 | 2026-08-24 17:18:23 |
| 31 | Flask PLUS | WEB | 0 | 0 | 2026-08-24 16:57:55 |
| 32 | ciruit map | Crypto | 0 | 0 | 2026-08-24 16:33:11 |
| 33 | fumo backdoor | WEB | 0 | 0 | 2026-08-21 15:50:54 |
| 34 | command-injection | WEB | 0 | 0 | 2026-08-19 17:33:17 |
| 35 | strpos and substr | WEB | 0 | 0 | 2026-08-19 16:14:25 |
| 36 | Virtual Shop | WEB | 0 | 0 | 2026-08-19 15:52:39 |
| 37 | lfi | WEB | 0 | 0 | 2026-08-19 15:33:52 |
| 38 | 强网先锋打野 | MISC | 0 | 0 | 2026-08-19 15:19:13 |
| 39 | just_sqli | WEB | 0 | 0 | 2026-08-19 14:53:32 |
| 40 | Robots Rule | WEB | 0 | 0 | 2026-03-13 14:32:30 |
| 41 | easy-pop | WEB | 0 | 0 | 2025-11-03 15:35:18 |
| 42 | Upload 0 | WEB | 0 | 0 | 2025-10-31 14:23:37 |
| 43 | just-work-type | WEB | 0 | 0 | 2025-10-31 11:48:37 |
| 44 | zombie-101 | WEB | 0 | 0 | 2025-10-31 11:40:33 |
| 45 | charlottesweb | WEB | 0 | 0 | 2025-10-31 11:31:20 |
| 46 | nextGen 2 | WEB | 0 | 0 | 2025-10-31 11:06:37 |
| 47 | nextGen 1 | WEB | 0 | 0 | 2025-10-31 11:02:58 |
| 48 | baby lfi 2 | WEB | 0 | 0 | 2025-10-30 17:57:07 |
| 49 | baby lfi | WEB | 0 | 0 | 2025-10-30 17:45:38 |
| 50 | inspect-me | WEB | 0 | 0 | 2025-10-28 13:46:14 |
| 51 | i-heart-wasm | WEB | 0 | 0 | 2025-09-18 10:07:37 |
| 52 | Bottle Poem | WEB | 0 | 0 | 2025-08-06 16:54:34 |
| 53 | filestorage | WEB | 0 | 0 | 2025-07-26 02:46:28 |
| 54 | filter-madness | WEB | 0 | 0 | 2025-07-26 02:31:29 |
暂无数据
-
UMDCTF 2023-i-heart-wasm
我们可以在wasm二进制文件中嵌入自定义部分，并从JavaScript中访问它们。控制台输入：WebAssembly.compileStreaming(fetch("./pkg/wasm_test_bg.wasm")).then(mod=>{letflag="";for(leti=42;i>=0;i--){constsections=WebAssembly.Module.customS...
- WEB
- 2025-09-18 10:10:37
-
fumo backdoor -WP
fumobackdoorSummary一个PHP后门题目：根路径直接通过highlight_file(__FILE__)泄露完整源码，源码中?cmd=unserialze（注意拼写少了个i）对用户输入直接unserialize()。利用fumo_backdoor类__wakeup()的"内部函数→无参call_user_func"分支调用phpinfo()，从环境变量中拿到FLAG。Solutio...
- WEB
- 2026-08-21 15:54:56
-
ciruit map-wp
ciruitmap题目构成block_cipher.py:24-bitSPN。encrypt_data=3轮(XORkey→S(6×4bit)→P(24bit))+末XORkey。encrypt(m,k1,k2)=Ed(Ed(m,k1),k2)（k1内层、k2外层）；decrypt相应。yao_circuit.py:每wire两个24-bitlabel；garble_label(k0,k1,k2)...
- Crypto
- 2026-08-24 16:39:45
-
unzip-wp
unzipSummary靶站提供一个zip上传解压功能，upload.php源码主动泄露，仅按MIME魔数校验后执行unzip-o到/tmp。利用zip内符号链接（symlink）跟随：先上传指向/var/www/html的symlink条目，再借链接把PHPwebshell写出到DocumentRoot，命令执行读取/flag。SolutionStep1:源码泄露→定位漏洞GET/upload....
- WEB
- 2026-08-28 16:19:00
-
template-wp
#template##SummaryFlask+Jinja2应用把用户输入直接作为模板渲染，构成SSTI。题目用两层黑名单增加趣味：前端JS拦截`{}%`，服务端拦截字符`'|.+`与子串`init/class/os/flag`。用`["key"]`下标代替点号、用`~`拼接字符串代替被禁词，经`lipsum.__globals__`到达`os.popen`实现RCE，读取`/flag`。##So...
- WEB
- 2026-09-15 17:05:48
-
DootDoot-wp
#DootDoot##SummaryFlask博客「PenguinBlog」把`GET/oot`的`oot`参数直接拼成`resources/<oot>.txt`后`open()`读取，**零过滤**，构成目录穿越（CWE-22）。题面说"能泄露服务器源码"指的是题目自带的`server.py`附件，不是靶机上的泄露点。利用`../flag`（拼上后缀正好变成`../flag.txt`...
- WEB
- 2026-09-16 09:54:42
-
RIaaS-wp
#RIaaS##SummaryFlask/Jinja2SSTI题。`username`参数被拼进真实模板，但`{{...}}`表达式被正则整体剥离、`_`字符被删除——两条最常见的SSTI路线全被堵死。突破口是：**`{%...%}`语句没被剥离且真实执行**，配合`{%setu='%c'|format(95)%}`手工拼出下划线构造dunder，用`cycler.__init__.__globa...
- WEB
- 2026-09-16 16:28:37
-
Issues-wp
#Issues>题面：Canyoubecomeanadminandgettheflag?>实例：`http://49.232.142.230:18220`（官方源码：[project-sekai-ctf/sekaictf-2022→web/issues](https://github.com/project-sekai-ctf/sekaictf-2022/tree/main/web/i...
- WEB
- 2026-09-17 13:59:23
暂无数据