2025 NewStarCTF Week2
2026-08-22 20:05:38

Misc 城邦：NewKeyboard

欢迎挑战者们来到第二周的 Misc 考核，本关由手持 Keyboard 的侍卫看守能量核心，请挑战者们通过分析侍卫发出的流量获取最终的 FLAG 吧！

过滤器：usb.addr=="1.1.2"

分别导出字母表和flag的特定分组

1
"D:\Wireshark\tshark.exe" -r D:\usb\1.pcapng -Y "usb.capdata" -T fields -e usb.capdata > D:\usb\1.txt

名为abcdefghijklmnopqrstuvwxyz1234567890-_!{}.pcapng的文件的输出结果如下 研究了一段时间 我才发现 这是一个已知输入内容的USB键盘流量包 也就是字符对照表

有一个傻瓜方法就是把上面这个做成映射表然后运行python脚本 不去考虑编码逻辑

观察字母表的txt文件 解释一下字符映射规律

比如说“_”

1
[Modifier][保留][Key1][Key2][Key3]...（共 21 字节，42 个 hex 字符）

Modifier

Modifier四字节 0100是没有按shift 0102是按住了shift

从第五字节开始 如果全是00表示没有按键按下

1
01020000000000200000000000000000000000000000   → shift+"-"对应"_"
1
01020000000000000000000000000000000000000000   → shift仍然按着
1
01000000000000000000000000000000000000000000   → shift也松开了
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
01001000000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01002000000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01004000000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01008000000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000001000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000002000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000004000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000008000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000010000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000020000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000040000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000080000000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000010000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000020000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000040000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000080000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000100000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000200000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000400000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000800000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000100000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000200000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000400000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000800000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000001000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000002000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000004000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000008000000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000001000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000002000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000004000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000008000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000010000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000020000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000040000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000080000000000000000000000000000000
01000000000000000000000000000000000000000000

01000000000000200000000000000000000000000000   → "-"
01000000000000000000000000000000000000000000   → 没按shift

01020000000000000000000000000000000000000000   → shift按上去
01020000000000200000000000000000000000000000   → shift+"-"="_"
01020000000000000000000000000000000000000000   → shift还按着
01000000000000000000000000000000000000000000   → shift松开

01020000000000000000000000000000000000000000   → shift按上去
01020000004000000000000000000000000000000000   → shift+"1"="!"
01020000000000000000000000000000000000000000   → shift还按着
01000000000000000000000000000000000000000000   → shift松开

01020000000000000000000000000000000000000000   → shift按上去
01020000000000800000000000000000000000000000   → shift+"["="{"
01020000000000000000000000000000000000000000   → shift还按着
01000000000000000000000000000000000000000000   → shift松开

01020000000000000000000000000000000000000000   → shift按上去
01020000000000000100000000000000000000000000   → shift+"]"="}"
01020000000000000000000000000000000000000000   → shift还按着
01000000000000000000000000000000000000000000   → shift松开
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
normalKeys = {
    '01001000000000000000000000000000000000000000': 'a',
    '01002000000000000000000000000000000000000000': 'b',
    '01004000000000000000000000000000000000000000': 'c',
    '01008000000000000000000000000000000000000000': 'd',
    '01000001000000000000000000000000000000000000': 'e',
    '01000002000000000000000000000000000000000000': 'f',
    '01000004000000000000000000000000000000000000': 'g',
    '01000008000000000000000000000000000000000000': 'h',
    '01000010000000000000000000000000000000000000': 'i',
    '01000020000000000000000000000000000000000000': 'j',
    '01000040000000000000000000000000000000000000': 'k',
    '01000080000000000000000000000000000000000000': 'l',
    '01000000010000000000000000000000000000000000': 'm',
    '01000000020000000000000000000000000000000000': 'n',
    '01000000040000000000000000000000000000000000': 'o',
    '01000000080000000000000000000000000000000000': 'p',
    '01000000100000000000000000000000000000000000': 'q',
    '01000000200000000000000000000000000000000000': 'r',
    '01000000400000000000000000000000000000000000': 's',
    '01000000800000000000000000000000000000000000': 't',
    '01000000000100000000000000000000000000000000': 'u',
    '01000000000200000000000000000000000000000000': 'v',
    '01000000000400000000000000000000000000000000': 'w',
    '01000000000800000000000000000000000000000000': 'x',
    '01000000001000000000000000000000000000000000': 'y',
    '01000000002000000000000000000000000000000000': 'z',
    '01000000004000000000000000000000000000000000': '1',
    '01000000008000000000000000000000000000000000': '2',
    '01000000000001000000000000000000000000000000': '3',
    '01000000000002000000000000000000000000000000': '4',
    '01000000000004000000000000000000000000000000': '5',
    '01000000000008000000000000000000000000000000': '6',
    '01000000000010000000000000000000000000000000': '7',
    '01000000000020000000000000000000000000000000': '8',
    '01000000000040000000000000000000000000000000': '9',
    '01000000000080000000000000000000000000000000': '0',
    '01000000000000200000000000000000000000000000': '-',
    '01020000000000200000000000000000000000000000': '_',
    '01020000004000000000000000000000000000000000': '!',
    '01020000000000800000000000000000000000000000': '{',
    '01020000000000000100000000000000000000000000': '}'
}

nums = []
keys = open('2.txt', 'rt')  # 打开文件
for line in keys:
    line = line.strip()  # 去掉换行符
    # print(line)
    nums.append(line)
keys.close()

output = ""
for n in nums:
    if n in normalKeys:
        output += normalKeys[n]
        # 只有当某一行n出现在normalkeys的键中 才输出对应字符
        # 如果不在，就跳过
    # else:
    #     output += '[unknown]'

print('output :' + output)

事实证明 如果不把alphabet.txt看懂是无法写出脚本的

flag{th1s_is_newkeyboard_y0u_get_it!}

美妙的音乐

midi隐写 理论上要用miditrail查看 但是AU就可以了

flag{thi5_1S_m1Di_5tEG0}

Osint:威胁情报

城邦受到了未知 APT 组织的攻击，目前已解除威胁，但留下了恶意文件的 hash 值。

为了以后的安全，请 NewStar 们进行调查，帮助城邦们完善威胁情报吧！

FLAG 格式

**flag{APT组织名称_通信C2服务器域名_恶意文件编译时间(年-月-日)}**，所有字母全部小写

例：**flag{newstar_example.com_2025-09-29}**

查奇安信平台

https://ti.qianxin.com/

APT组织名称找那个出现最频繁的组织

网络行为→DNS

Exiftool元数据→TimeStamp

flag{kimsuky_alps.travelmountain.ml_2021-03-31}

日志分析：不敬者的闯入

在中国人民抗日战争暨世界反法西斯战争胜利 80 周年前夕，城邦的临时工搭建了一个纪念网站，帮助人们恢复记忆。

一些不法分子妄图破坏新世界的记忆，企图摧毁网站，幸好临时工及时止损关闭了该网站的服务，才保住了历史的记忆。

请挑战者们通过保留的网站日志，帮助临时工找到不敬者的木马威胁，让临时工能保住这份来之不易的工作吧！

搜索200攻击者上传了webshell文件/admin/Webshell.php

访问/admin/Webshell

星期四的狂想

怎么又是星期四，一到星期四群里就出现了各种稀奇古怪的星期四文案。

最近 KAMIYA 的服务器被人植入了星期四文案，让 KAMIYA 甚是苦恼。

好在他把流量截取下来了，你来帮他看看吧。

上一个流看到加密逻辑

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
import base64
from itertools import product

cookie_value = "R2FYdDNaaHhtWlMwS21TR0szRVZxSUF4QVV5c0hLVzlWZXN0MllwVmdDOUJUTlBaVlM9PQ=="

# Step 1: 先 base64 解码 cookie_value
decoded_bytes = base64.b64decode(cookie_value)
s = decoded_bytes.decode('utf-8')
print("s length:", len(s))
print("s:", s)

# Split s into groups of 10
groups = [s[i:i+10] for i in range(0, len(s), 10)]
print("Groups:", groups)

def str_rot13(s):
    result = []
    for c in s:
        if 'a' <= c <= 'z':
            result.append(chr((ord(c) - ord('a') + 13) % 26 + ord('a')))
        elif 'A' <= c <= 'Z':
            result.append(chr((ord(c) - ord('A') + 13) % 26 + ord('A')))
        else:
            result.append(c)
    return ''.join(result)

def str_rev(s):
    return s[::-1]

# Try all combinations
num_groups = len(groups)
for operations in product([str_rev, str_rot13], repeat=num_groups):
    candidate = ''
    for i in range(num_groups):
        candidate += operations[i](groups[i])
    try:
        # Ensure candidate is valid base64 (add padding if needed)
        padded = candidate + '=' * ((4 - len(candidate) % 4) % 4)
        decoded_flag = base64.b64decode(padded).decode('utf-8')
        if 'flag{' in decoded_flag:
            print("\n🎉 Found flag:", decoded_flag)
            print("Operations:", [op.__name__ for op in operations])
            break
    except Exception as e:
        continue
else:
    print("❌ No flag found.")
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
Cookie token
     │
     ▼
[Base64 解码] → 得到混淆字符串 s
     │
     ▼
按10字符分段 → [seg1, seg2, ..., segN]
     │
     ▼
对每段尝试两种操作（str_rev / str_rot13）
     │
     ▼
拼接 → 候选 Base64
     │
     ▼
[Base64 解码] → 是否包含 "flag{"？
     │
     ✅ 是 → 输出 flag！

flag{What_1S_tHuSd4y_Quickly_VIVO50}

上一页
2026-08-22 20:05:38
下一页