uni-ctf-2023 - 2023年CTF大学正式报告：大脑

项目说明

<p align='center'>
<img src='assets/htb.png' alt="HTB">
</p>

__Challenges__

| Category | Name | Objective | Difficulty [⭐⭐⭐⭐⭐] |
|---------------|-------------------------------------------------------------------------|--------------------------------------------------|-------------------------|
| Web | GateCrash | SQL injection via CRLF injection | ⭐ |
| Web | Nexus Void | Dotnet deserialisaiton via SQL injection | ⭐⭐ |
| Web | PhantomFeed | Race condition , open-redirect in Nuxt.js to perofrm CSRF and leak OAuth 2 access token, RCE in Reportlab | ⭐⭐⭐ |
| Pwn | Great Old Talisman | O exit@GOT with the address of the function that reads the flag | ⭐ |
| Pwn | Zombienator | Make 9 allocations and 8 frees to leak a libc address, abuse scanf("ld") to bypass the canary check, use pwntools struct to pack doubles, and perform a ret2libc attack with one gadget | ⭐⭐ |
| Pwn | Zombiedote | Le a single malloc call, an out of bounds read and two out of bounds writes in order into code execution in glibc 2.34 | ⭐⭐⭐ |
| Re | WindowOfOpportunity | Re simple flag checker algorithm | ⭐ |
| Re | BioBundle | Re a flag checker embedded in a library encrypted and loaded with memfd_create | ⭐⭐ |
| Re | RiseFromTheDead | Re a flag encoder then reco a core dump to retrieve the flagg | ⭐⭐⭐ |
| Forensics | One Step Closer | Windows JScript deobfuscation - Malware delivery - | ⭐ |
| Forensics | ZombieNet | OpenWrt firwmare analysis - MIPS binary emulation using QEMU | ⭐⭐ |
| Forensics | Shadow of the Undead | Meterpreter parsing/decryption - custom windows shellcode emulation | ⭐⭐⭐ |
| Crypto | MSS| Use CRT to get the entire secret on a Mignotte Secret Sharing scheme | ⭐|
| Crypto | Mayday Mayday | Factor N by exploiting the partial leakage of the CRT components | ⭐⭐ |
| Crypto | Zombie Rolled | Solve a diophantine equation to get the private key and apply LLL to recover the flag from the signature | ⭐⭐⭐ |

项目信息

开发语言：VBScript

Star 数：106

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Official writeups for University CTF 2023: Brains & Bytes展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。