ctf-misc

CTF miscellaneous challenges

In-depth reference

The following reference materialsload on demand, and select the corresponding file according to the specific direction identified:

• Python sandbox escape (restricted characters/func_globals chain/class attribute persistence) → references/pyjails.md
• Bash sandbox/restricted shell escape → references/bashjails.md
• Encoding and decoding (QR/esolang/Verilog/BCD/Gray code/SMS PDU) → references/encodings.md
• RF/SDR signal processing (QAM-16/carrier recovery/timing synchronization) → references/rf-sdr.md
• DNS exploitation (ECS spoofing/NSEC traversal/IXFR/rebinding/tunneling) → references/dns.md
• Games and VM Part 1 (WASM/Roblox/PyInstaller/K8s/Z3/floating point) → references/games-and-vms.md
• Games and VM Part 2 (ML weights/WebSocket/Flask/LoRA/De Bruijn) → references/games-and-vms-2.md
• Games and VM Part 3 (memfd/game theory/ROM switching/Benford/BuildKit) → references/games-and-vms-3.md
• Linux privilege escalation (sudo wildcards/NFS/SSH tunneling/PostgreSQL RCE) → references/linux-privesc.md
• Advanced encoding (Verilog HDL/Gray code/Manchester encoding/BPF bytecode) → references/encodings-advanced.md

---

Classification decision tree

Misc 题目？
├─ 编码/解码谜题
│  ├─ Base64/Hex/ROT13 → CyberChef 自动检测
│  ├─ QR 码 → zbarimg / 碎片重组
│  ├─ 二进制/莫尔斯/BCD → [references/encodings.md](references/encodings.md)
│  └─ 多层嵌套 → 循环解码直到明文
├─ 沙箱逃逸
│  ├─ Python jail → [references/pyjails.md](references/pyjails.md)
│  │  ├─ 受限字符 → repunit分解 / chr()构造
│  │  ├─ 禁import → __builtins__.__import__
│  │  └─ 受限exec → func_globals链 / MRO遍历
│  └─ Bash jail → [references/bashjails.md](references/bashjails.md)
├─ 游戏/交互
│  ├─ WASM → 内存patch / wasm2wat 修改
│  ├─ WebSocket → 拦截修改消息
│  ├─ 博弈论 → Nim/承诺方案 → [references/games-and-vms-3.md](references/games-and-vms-3.md)
│  └─ ML/AI → 权重扰动 / 碰撞 → [references/games-and-vms-2.md](references/games-and-vms-2.md)
├─ DNS → [references/dns.md](references/dns.md)
├─ RF/SDR → [references/rf-sdr.md](references/rf-sdr.md)
└─ Linux 提权 → [references/linux-privesc.md](references/linux-privesc.md)

General techniques

# 文件识别
file mystery && xxd mystery | head
binwalk -e mystery

# 编码检测
echo "data" | base64 -d
python3 -c "import base64; print(base64.b85decode(b'...'))"

# Z3 约束求解
python3 -c "
from z3 import *
x = BitVec('x', 32)
s = Solver()
s.add(x * 0x1337 == 0xdeadbeef)
s.check(); print(s.model())
"

Python Jail quick reference

Technique	Scenario
__builtins__.__import__	import is banned
().__class__.__bases__[0].__subclasses__()	get all subclasses
chr() + eval() construct	characters are restricted
breakpoint() → os.system()	Python 3.7+

Encoding quick reference

Encoding	Feature
Base64	A-Za-z0-9+/= ends with
Base32	A-Z2-7= uppercase
Hex	0-9a-f even length
URL encoding	%XX form
Unicode steganography	zero-width characters U+200B/U+200C

Multi-layer encoding

• Write a script with a while loop to automate batch decoding, avoiding manual layer-by-layer decoding

QR code repair

• Pay attention to orientation: rotation, flipping, and alignment correction may be needed
• QR has error correction/fault tolerance mechanisms, so partially damaged codes can still be decoded