{"id":1059,"date":"2026-03-31T20:57:31","date_gmt":"2026-03-31T12:57:31","guid":{"rendered":"http:\/\/shr1mp.top\/?p=1059"},"modified":"2026-03-31T20:58:31","modified_gmt":"2026-03-31T12:58:31","slug":"polarisctf-curve-with-two%e5%a4%8d%e7%8e%b0%e5%9b%be%e5%83%8f%e9%9a%90%e5%86%99%e4%b9%8bhilbert-curve","status":"publish","type":"post","link":"http:\/\/shr1mp.top\/index.php\/2026\/03\/31\/polarisctf-curve-with-two%e5%a4%8d%e7%8e%b0%e5%9b%be%e5%83%8f%e9%9a%90%e5%86%99%e4%b9%8bhilbert-curve\/","title":{"rendered":"Polarisctf-curve with two\u590d\u73b0(\u56fe\u50cf\u9690\u5199\u4e4bhilbert curve)"},"content":{"rendered":"\n<p class=\"has-medium-font-size\">\u9898\u9762\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/origin.picgo.net\/2026\/03\/31\/8b8d7991d876783e38ac91393bf01138d0b797cc9291c59a.jpg\" alt=\"\"\/><\/figure>\n\n\n\n<p style=\"font-size:29px\">\u7ed9\u4e86\u5f20JPG\u6587\u4ef6<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/origin.picgo.net\/2026\/03\/31\/-2026-03-31-182635e16af631895306de.png\" alt=\"\"\/><\/figure>\n\n\n\n<p style=\"font-size:30px\">\u6211\u7684\u7b2c\u4e00\u76f4\u89c9\u662f\u8fd9\u662f\u4e2a\u4e8c\u7ef4\u7801\u88ab\u52a0\u5bc6\u4e86\u3002\u7136\u540e114514\u662f\u8fd9\u5f20\u56fe\u7684\u5173\u952e<\/p>\n\n\n\n<p style=\"font-size:30px\">\u7ed3\u5408\u9898\u76ee\"<strong>Curve with two<\/strong>\"\u548c\u9644\u4ef6\u91cc1024*1024\uff0c\u57fa\u672c\u5224\u65ad\u8fd9\u662f\u5e0c\u5c14\u4f2f\u7279\u66f2\u7ebf<\/p>\n\n\n\n<h2 class=\"wp-block-heading has-x-large-font-size\" id=\"\u5e0c\u5c14\u4f2f\u7279\u66f2\u7ebf\u6982\u8981\">\u5e0c\u5c14\u4f2f\u7279\u66f2\u7ebf\u6982\u8981<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/origin.picgo.net\/2026\/03\/31\/-2026-03-31-190430b30bf53fdd587556.png\" alt=\"\"\/><\/figure>\n\n\n\n<pre class=\"wp-block-code has-medium-font-size\"><code>\u77e5\u8bc6\u70b9\uff1a\n\n\n\u4ed6\u7684\u4e3b\u8981\u751f\u6210\u539f\u7406\n\u5df2\u7ecf\u751f\u6210\u4e86\u4e0a\u4e00\u9636 \u5e0c\u5c14\u4f2f\u7279\u66f2\u7ebf \u540e\u751f\u6210\u4e0b\u4e00\u9636\uff0c\u9700\u8981\uff1a\n\n    \u628a\u4e4b\u524d\u6bcf\u4e2a\u5b50\u6b63\u65b9\u5f62\u7ee7\u7eed\u56db\u7b49\u5206\uff0c\u6bcf4\u4e2a\u5c0f\u7684\u6b63\u65b9\u5f62\u5148\u751f\u6210\u4e0a\u4e00\u9636\u9636\u5e0c\u5c14\u4f2f\u7279\u66f2\u7ebf\uff1b\n    \u6bcf\u4e2a\u5c0f\u7684\u56db\u7b49\u5206\u4e2d\u7b2c\u4e09\u7b2c\u56db\u8c61\u9650\u7684\u66f2\u7ebf\u5206\u522b\u6cbf\u4e24\u4e2a\u5bf9\u89d2\u7ebf\u7ffb\u8f6c\uff1b\uff08\u751f\u6210\u6838\u5fc3\uff09\n    \u6dfb\u52a0\u4e09\u6761\u7ebf\u6bb5\u628a 4 \u4e2a\u4e0a\u4e00\u9636\u7684\u5e0c\u5c14\u4f2f\u7279\u66f2\u7ebf\u9996\u5c3e\u76f8\u8fde\u3002<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/origin.picgo.net\/2026\/03\/31\/-2026-03-31-191053c692f5aa49eb4e5c.png\" alt=\"\"\/><\/figure>\n\n\n\n<p style=\"font-size:30px\">\u7528AI\u751f\u6210\u7684\u7ed8\u5236\u4ee3\u7801\uff1b<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>import turtle\n\ndef hilbert_curve(turtle, level, angle, step):\n    if level == 0:\n        return\n    turtle.right(angle)\n    hilbert_curve(turtle, level - 1, -angle, step)\n    turtle.forward(step)\n    turtle.left(angle)\n    hilbert_curve(turtle, level - 1, angle, step)\n    turtle.forward(step)\n    hilbert_curve(turtle, level - 1, angle, step)\n    turtle.left(angle)\n    turtle.forward(step)\n    hilbert_curve(turtle, level - 1, -angle, step)\n    turtle.right(angle)\n\nturtle.setup(400, 400)\nturtle.penup()\nturtle.goto(-140, 140)\nturtle.pendown()\nhilbert_curve(turtle, 3, 90, 40)\nturtle.done()<\/code><\/pre>\n\n\n\n<p>\u7ed8\u56fe\u8fc7\u7a0b\u7684GIF\uff1a<\/p>\n\n\n\n<p class=\"has-small-font-size\"><a href=\"https:\/\/developer.qcloudimg.com\/http-save\/yehe-8585088\/fcd048bf2cda718475f85ec794a4338e.gif\" alt=\"Polarisctf-curve with two\u590d\u73b0(\u56fe\u50cf\u9690\u5199\u4e4bhilbert curve)\" title=\"Polarisctf-curve with two\u590d\u73b0(\u56fe\u50cf\u9690\u5199\u4e4bhilbert curve)\" target=\"_blank\"  rel=\"nofollow\" >https:\/\/developer.qcloudimg.com\/http-save\/yehe-8585088\/fcd048bf2cda718475f85ec794a4338e.gif<\/a><\/p>\n\n\n\n<p style=\"font-size:30px\">\u9488\u5bf9\u8fd9\u9053\u9898\uff0c\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code has-small-font-size\"><code>import math\nfrom pathlib import Path\n\nimport numpy as np\nfrom hilbertcurve.hilbertcurve import HilbertCurve\nfrom PIL import Image\nfrom skimage.filters import threshold_otsu\n\n# ============ \u914d\u7f6e\u533a\u57df ============\nSCRIPT_DIR = Path(__file__).resolve().parent\nIMAGE_PATH = SCRIPT_DIR \/ \"challenge.jpg\"\nOFFSET = 114514\nOUTPUT_IMAGE = SCRIPT_DIR \/ \"decrypted.png\"\nOUTPUT_BIN = SCRIPT_DIR \/ \"flag.bin\"\n# ==================================\n\n\ndef hilbert_raster_indices(w: int) -> np.ndarray:\n    \"\"\"\u751f\u6210\u5e0c\u5c14\u4f2f\u7279\u66f2\u7ebf\u6620\u5c04\uff1a\u8ddd\u79bb i -> \u6805\u683c\u7d22\u5f15 (y*w+x)\"\"\"\n    n = int(math.log2(w))\n    hc = HilbertCurve(n, 2)\n    total = w * w\n    \n    # \u5411\u91cf\u5316\u751f\u6210\u5750\u6807\uff0c\u907f\u514d Python \u5faa\u73af\n    distances = np.arange(total)\n    coords = np.array(&#91;hc.point_from_distance(d) for d in distances])\n    x, y = coords&#91;:, 0], coords&#91;:, 1]\n    \n    return y * w + x\n\n\ndef decrypt_hilbert_cipher(\n    encrypted_flat: np.ndarray, \n    hilbert_order: np.ndarray, \n    offset: int\n) -> np.ndarray:\n    \"\"\"\n    \u5e0c\u5c14\u4f2f\u7279\u66f2\u7ebf\u5faa\u73af\u79fb\u4f4d\u89e3\u5bc6\u3002\n    \n    \u52a0\u5bc6\u6d41\u7a0b\uff1aplain_hilbert -> roll(-offset) -> enc_hilbert -> scatter to raster\n    \u89e3\u5bc6\u6d41\u7a0b\uff1araster -> gather to enc_hilbert -> roll(+offset) -> plain_hilbert -> scatter to raster\n    \"\"\"\n    n = hilbert_order.shape&#91;0]\n    k = offset % n\n    \n    # \u6b65\u9aa41: \u6805\u683c\u5e8f \u2192 \u5e0c\u5c14\u4f2f\u7279\u5e8f (gather)\n    enc_hilbert = encrypted_flat&#91;hilbert_order]\n    \n    # \u6b65\u9aa42: \u5faa\u73af\u79fb\u4f4d\u6062\u590d (roll +offset)\n    plain_hilbert = np.roll(enc_hilbert, k, axis=0)\n    \n    # \u6b65\u9aa43: \u5e0c\u5c14\u4f2f\u7279\u5e8f \u2192 \u6805\u683c\u5e8f (scatter)\n    decrypted = np.empty_like(encrypted_flat)\n    decrypted&#91;hilbert_order] = plain_hilbert\n    \n    return decrypted\n\n\ndef pack_bits_to_bytes(bits: np.ndarray) -> bytes:\n    \"\"\"\u5c06\u6bd4\u7279\u6570\u7ec4\u6253\u5305\u4e3a\u5b57\u8282\uff0c\u8981\u6c42 bits \u957f\u5ea6\u4e3a 8 \u7684\u500d\u6570\"\"\"\n    # \u786e\u4fdd\u662f 1D \u4e14\u957f\u5ea6\u4e3a 8 \u7684\u500d\u6570\n    bits = bits.reshape(-1)\n    length = (len(bits) \/\/ 8) * 8\n    bits = bits&#91;:length]\n    \n    # \u91cd\u5851\u4e3a (N, 8) \u5e76\u8ba1\u7b97\u5b57\u8282\u503c\n    bit_groups = bits.reshape(-1, 8)\n    # MSB \u5728\u524d\uff1ab = b0<<7 | b1<<6 | ... | b7<<0\n    shifts = np.array(&#91;7, 6, 5, 4, 3, 2, 1, 0], dtype=np.uint8)\n    bytes_arr = np.packbits(bit_groups, axis=1, bitorder='big').flatten()\n    \n    return bytes_arr.tobytes()\n\n\ndef extract_flag_binary(\n    gray: np.ndarray, \n    hilbert_order: np.ndarray, \n    offset: int, \n    out_path: Path\n) -> None:\n    \"\"\"\u4ece\u7070\u5ea6\u56fe\u4e2d\u63d0\u53d6\u4e8c\u503c\u5316\u5e76\u89e3\u5bc6\u540e\u7684 flag \u6570\u636e\"\"\"\n    # Otsu \u81ea\u52a8\u9608\u503c\u4e8c\u503c\u5316\n    thresh = threshold_otsu(gray)\n    binary_flat = (gray > thresh).astype(np.uint8).ravel()\n    \n    # \u5e94\u7528\u76f8\u540c\u7684\u5e0c\u5c14\u4f2f\u7279\u89e3\u5bc6\n    decrypted_bits = decrypt_hilbert_cipher(binary_flat, hilbert_order, offset)\n    \n    # \u6253\u5305\u4e3a\u5b57\u8282\u5e76\u5199\u5165\n    byte_data = pack_bits_to_bytes(decrypted_bits)\n    out_path.write_bytes(byte_data)\n    \n    print(f\"&#91;+] Flag \u6570\u636e\u5df2\u5199\u5165: {out_path} ({len(byte_data)} \u5b57\u8282)\")\n\n\ndef validate_image(img: Image.Image) -> int:\n    \"\"\"\u9a8c\u8bc1\u56fe\u50cf\u5c3a\u5bf8\u8981\u6c42\uff0c\u8fd4\u56de\u8fb9\u957f\"\"\"\n    w, h = img.size\n    print(f\"&#91;+] \u56fe\u50cf\u5c3a\u5bf8: {w} x {h}\")\n    \n    if w != h:\n        raise ValueError(f\"\u56fe\u50cf\u5fc5\u987b\u662f\u6b63\u65b9\u5f62 (\u5f53\u524d: {w}x{h})\")\n    \n    # \u68c0\u67e5\u662f\u5426\u4e3a 2 \u7684\u5e42\n    if w & (w - 1) != 0:  # \u66f4\u5feb\u7684 2 \u7684\u5e42\u5224\u65ad\n        raise ValueError(f\"\u8fb9\u957f\u5fc5\u987b\u662f 2 \u7684\u5e42 (\u5f53\u524d: {w})\")\n    \n    return w\n\n\ndef main() -> None:\n    # \u68c0\u67e5\u6587\u4ef6\u5b58\u5728\n    if not IMAGE_PATH.is_file():\n        raise FileNotFoundError(f\"\u627e\u4e0d\u5230\u56fe\u50cf: {IMAGE_PATH}\")\n    \n    # \u52a0\u8f7d\u56fe\u50cf\n    with Image.open(IMAGE_PATH) as img:\n        side_length = validate_image(img)\n        \n        # \u9884\u8ba1\u7b97\u5e0c\u5c14\u4f2f\u7279\u6620\u5c04\uff08\u53ef\u7f13\u5b58\u4f18\u5316\uff09\n        hilbert_order = hilbert_raster_indices(side_length)\n        \n        # ========== \u89e3\u5bc6\u5f69\u8272\/\u7070\u5ea6\u56fe\u50cf ==========\n        img_array = np.array(img)\n        original_shape = img_array.shape\n        original_dtype = img_array.dtype\n        \n        # \u5c55\u5e73\u4e3a (N, C) \u6216 (N,)\n        flat = img_array.reshape(-1, original_shape&#91;-1]) if img_array.ndim == 3 else img_array.ravel()\n        \n        # \u89e3\u5bc6\n        decrypted_flat = decrypt_hilbert_cipher(flat, hilbert_order, OFFSET)\n        decrypted_img = decrypted_flat.reshape(original_shape).astype(original_dtype)\n        \n        # \u4fdd\u5b58\n        Image.fromarray(decrypted_img).save(OUTPUT_IMAGE)\n        print(f\"&#91;+] \u89e3\u5bc6\u56fe\u50cf\u5df2\u4fdd\u5b58: {OUTPUT_IMAGE}\")\n        \n        # ========== \u63d0\u53d6 Flag \u6570\u636e ==========\n        gray_array = np.array(img.convert(\"L\"))\n        extract_flag_binary(gray_array, hilbert_order, OFFSET, OUTPUT_BIN)\n\n\nif __name__ == \"__main__\":\n    main()<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading has-x-large-font-size\" id=\"\u4ee3\u7801\u6838\u5fc3\u903b\u8f91\u6982\u8ff0\">\u4ee3\u7801\u6838\u5fc3\u903b\u8f91\u6982\u8ff0\uff1a<\/h2>\n\n\n\n<pre class=\"wp-block-code\"><code>\u666e\u901a\u626b\u63cf (Z\u5e8f):  \u5e0c\u5c14\u4f2f\u7279\u66f2\u7ebf (H\u5e8f):\n 1  2  3  4        1  2 15 16\n 5  6  7  8       4  3 14 13\n 9 10 11 12        5  6 11 12\n13 14 15 16        8  7 10  9\n\n\n===================================================================\n\u52a0\u5bc6\u6838\u5fc3\u903b\u8f91\uff1a\n\n\u539f\u56fe\u50cf\u7d20: &#91;A]&#91;B]&#91;C]&#91;D]&#91;E]&#91;F]&#91;G]&#91;H]...  (\u6309H\u5e8f\u6392\u5217)\n           \u2193\n\u5faa\u73af\u5de6\u79fb3\u4f4d (offset=3)\n           \u2193\n\u52a0\u5bc6\u50cf\u7d20: &#91;D]&#91;E]&#91;F]&#91;G]&#91;H]...&#91;A]&#91;B]&#91;C]  (\u8fd8\u662fH\u5e8f)\n           \u2193\n\u6309\u6805\u683c\u4f4d\u7f6e\u5199\u56de\u56fe\u50cf \u2192 \u5f97\u5230\u52a0\u5bc6\u56fe\n\n\u76f4\u89c2\u7406\u89e3\uff1a\u628a\"\u86c7\u5f62\u6392\u5217\"\u7684\u50cf\u7d20\u4e32\u526a\u65ad\u3001\u5e73\u79fb\u3001\u518d\u63a5\u4e0a\uff0c\u7136\u540e\u6309\u6b63\u5e38\u7f51\u683c\u585e\u56de\u53bb\u3002\n\n====================================================================\n\u89e3\u5bc6\u6838\u5fc3\u903b\u8f91\uff1a\n\n\u52a0\u5bc6\u56fe \u2192 \u6309H\u5e8f\u8bfb\u51fa \u2192 &#91;D]&#91;E]&#91;F]&#91;G]&#91;H]...&#91;A]&#91;B]&#91;C]\n                         \u2193\n              \u5faa\u73af\u53f3\u79fb3\u4f4d (offset=3)\n                         \u2193\n                      &#91;A]&#91;B]&#91;C]&#91;D]&#91;E]&#91;F]&#91;G]&#91;H]...  \u6062\u590d\u539fH\u5e8f\n                         \u2193\n              \u6309\u6805\u683c\u5199\u56de \u2192 \u5f97\u5230\u539f\u56fe\n\n\u8fd9\u9053\u9898\u4ee3\u7801\u7528\u4e86python\u81ea\u5e26\u7684\u5e93\u5148\u8bfb\u53d6\u51fa\u6bcf\u4e2a\u50cf\u7d20\u70b9\uff0c\u518d\u8fdb\u884c\u79fb\u4f4d\u5904\u7406\uff0c\u6700\u540e\u6309\u7167\u5e0c\u5c14\u4f2f\u7279\u5e8f\u5217\u62fc\u63a5\u6210\u6b63\u5e38\u56fe\u7247<\/code><\/pre>\n\n\n\n<p style=\"font-size:30px\">\u89e3\u51fa\u6b63\u786e\u7684\u4e8c\u7ef4\u7801\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/origin.picgo.net\/2026\/03\/31\/decryptedc4e8f7c9e40f2316.png\" alt=\"\"\/><\/figure>\n\n\n\n<p style=\"font-size:30px\">\u653e\u968f\u6ce2\u9010\u6d41\u89e3\u7801\u540e\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code has-medium-font-size\"><code>Congratulations on finding the hidden clue; the clue is secret1sy0urh3rt ;use it to get the key and decipher the code.<\/code><\/pre>\n\n\n\n<p style=\"font-size:30px\">\u8fd9\u4e5f\u63d0\u793a\u6211\u4eec\u53ef\u80fd\u4f1a\u6709\u9690\u85cf\u7684\u6587\u4ef6\uff0c\u653e\u8fdb\u968f\u6ce2\u9010\u6d41\u91cc\u9762\u53d1\u73b0\u679c\u7136\u5b58\u5728\u9690\u85cf\u6587\u4ef6\uff0c\u6211\u4eec\u7528foremost\u63d0\u51fa\u9690\u85cf\u7684\u6587\u4ef6\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/origin.picgo.net\/2026\/03\/31\/-2026-03-31-195002aac61092785c3ea3.png\" alt=\"\"\/><\/figure>\n\n\n\n<p style=\"font-size:26px\">\u7528\u5f97\u5230\u7684 ' secret1sy0urh3rt ' \u53d1\u73b0\u5e76\u4e0d\u662fzip\u7684\u5bc6\u7801\uff0c\u505a\u5230\u8fd9\u7684\u65f6\u5019\u4ee5\u4e3a\u81ea\u5df1\u7535\u8111\u5361\u4e86\uff0c\u54ea\u4e2a\u5730\u65b9\u6709\u95ee\u9898\uff0c\u5176\u5b9e\u4e0d\u7136<\/p>\n\n\n\n<p style=\"font-size:28px\">\u8fd9\u91cc\u76f4\u63a5\u66b4\u529b\u7206\u7834<\/p>\n\n\n\n<p>                                 <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/origin.picgo.net\/2026\/03\/31\/-2026-03-31-205200d7b89bde012efc7a.png\" alt=\"\"\/><\/figure>\n\n\n\n<p class=\"has-medium-font-size\">\u5f97\u5230\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\" style=\"font-size:9px\"><code>01100110011100100110111101101101001000000100001101110010011110010111000001110100011011110010111001000011011010010111000001101000011001010111001000100000011010010110110101110000011011110111001001110100001000000100000101000101010100110000110100001010011001100111001001101111011011010010000001000011011100100111100101110000011101000110111100101110010101010111010001101001011011000010111001010000011000010110010001100100011010010110111001100111001000000110100101101101011100000110111101110010011101000010000001110101011011100111000001100001011001000000110100001010011010010110110101110000011011110111001001110100001000000110100001100001011100110110100001101100011010010110001000001101000010100110100101101101011100000110111101110010011101000010000001100010011010010110111001100001011100110110001101101001011010010000110100001010000011010000101001100011011010010111000001101000011001010111001001110100011001010111100001110100010111110110100001100101011110000010000000111101001000000010001001100001011000010011000100110110011000110011001101100011011001010011011101100100011000110011000100110110011001010011100101100100001101110011011000110110001100010011010101100010001101010110010101100110001100100011010100111000001110000011001001100101011001100110000101100011001100100011001001100011001110000110001000111001001100000011001101100110001100100110000101100110011001010011100001100110011001010110001001100011011000010011000100110111001101100011011100110010001110000110010001100110001110000011100100111001001110010011000000110010001110010110001001100011001110000011010000110001001110000011010001100110001101010011011000111001001100100011000000110010011000010110010100110101011001100011100100110010011000010011100100111001011001010110011000110010011000010110010100100010000011010000101001101011011001010111100100100000001111010010000000100010011110000111100001111000011110000111100001111000011110000111100001111000011110000111100001111000011110000111100001111000011110000010001000001101000010100000110100001010011010110110010101111001001000000011110100100000011010000110000101110011011010000110110001101001011000100010111001101101011001000011010100101000011010110110010101111001001011100110010101101110011000110110111101100100011001010010100000101001001010010010111001100100011010010110011101100101011100110111010000101000001010010000110100001010011010010111011000100000001111010010000001100010001001110101110001111000001100000011000000100111001000000010101000100000001100010011011000001101000010100000110100001010011000110110100101110000011010000110010101110010011101000110010101111000011101000010000000111101001000000110001001101001011011100110000101110011011000110110100101101001001011100111010101101110011010000110010101111000011011000110100101100110011110010010100001100011011010010111000001101000011001010111001001110100011001010111100001110100010111110110100001100101011110000010100100001101000010100000110100001010011000110110100101110000011010000110010101110010001000000011110100100000010000010100010101010011001011100110111001100101011101110010100001101011011001010111100100101100001000000100000101000101010100110010111001001101010011110100010001000101010111110100001101000010010000110010110000100000011010010111011000101001000011010000101001100100011001010110001101110010011110010111000001110100011001010110010000100000001111010010000001110101011011100111000001100001011001000010100001100011011010010111000001101000011001010111001000101110011001000110010101100011011100100111100101110000011101000010100001100011011010010111000001101000011001010111001001110100011001010111100001110100001010010010110000100000010000010100010101010011001011100110001001101100011011110110001101101011010111110111001101101001011110100110010100101001000011010000101000001101000010100111000001101100011000010110100101101110011101000110010101111000011101000010000000111101001000000110010001100101011000110111001001111001011100000111010001100101011001000010111001100100011001010110001101101111011001000110010100101000001001110111010101110100011001100010110100111000001001110010100100001101000010100111000001110010011010010110111001110100001010000110011000100010011100100110010101110011011101010110110001110100001110100010000001111011011100000110110001100001011010010110111001110100011001010111100001110100011111010010001000101001<\/code><\/pre>\n\n\n\n<p>\u76f4\u63a5\u4e22\u5728\u53a8\u5b50\u91cc<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/origin.picgo.net\/2026\/03\/31\/-2026-03-31-205536d23a8eab552429b3.png\" alt=\"\"\/><\/figure>\n\n\n\n<p style=\"font-size:30px\">\u63d0\u51fa\u8fd9\u6bb5\u4ee3\u7801\uff0c\u5728key\u5904\u8f93\u5165\u4e4b\u524d\u7684\u5bc6\u94a5\uff0c\u89e3\u5bc6\u5c31\u6b27\u514b\u4e86<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\n\"\"\"\nimport binascii\nimport hashlib\n\nfrom Crypto.Cipher import AES\nfrom Crypto.Util.Padding import unpad\n\n# \u7ebf\u7d22 QR\uff1asecret1sy0urh3rt \u2192 \u4f5c\u4e3a MD5 \u8f93\u5165\uff0816 \u5b57\u7b26\uff09\nKEY_PASSWORD = \"secret1sy0urh3rt\"\n# \u9898\u76ee enc.txt \/ \u4e8c\u8fdb\u5236\u89e3\u7801\u4e2d\u7684\u5bc6\u6587\nCIPHERTEXT_HEX = (\n\u00a0 \u00a0 \"aa16c3ce7dc16e9d76615b5ef25882efac22c8b903f2afe8febca176728df899\"\n\u00a0 \u00a0 \"9029bc84184f569202ae5f92a99ef2ae\"\n)\n\n\ndefdecrypt_hex(ciphertext_hex: str, password: str = KEY_PASSWORD) -> bytes:\n\u00a0 \u00a0 key = hashlib.md5(password.encode()).digest()\n\u00a0 \u00a0 iv = bytes(16)\n\u00a0 \u00a0 ciphertext = binascii.unhexlify(ciphertext_hex.replace(\" \", \"\").strip())\n\u00a0 \u00a0 cipher = AES.new(key, AES.MODE_CBC, iv)\n\u00a0 \u00a0 plaintext = cipher.decrypt(ciphertext)\n\u00a0 \u00a0 return unpad(plaintext, AES.block_size)\n\n\ndefmain() -> None:\n\u00a0 \u00a0 flag = decrypt_hex(CIPHERTEXT_HEX)\n\u00a0 \u00a0 print(flag.decode())\n\n\nif __name__ == \"__main__\":\n\u00a0 \u00a0 main()<\/code><\/pre>\n\n\n\n<p class=\"has-medium-font-size\">\u6700\u7ec8\u89e3\u7801\u51fa\u6700\u540e\u7684flag\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>xmctf{e47b4bca-edaf-4e81-9f35-4dd419e7b133}<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"\u5173\u4e8e\u8fd9\u9053\u9898\u7684\u788e\u788e\u5ff5\">\u5173\u4e8e\u8fd9\u9053\u9898\u7684\u788e\u788e\u5ff5\uff1a<\/h2>\n\n\n\n<p class=\"has-medium-font-size\">\u6211\u611f\u89c9\u8fd9\u662fpolarctf\u62db\u65b0\u8d5bmisc\u91cc\u4e3a\u6570\u4e0d\u591a\u7684\u4f20\u7edf\u9898\u4e4b\u4e00\u4e86\uff0c\u6d89\u53ca\u5230\u56fe\u50cf\u9690\u5199\u548c\u5bc6\u7801\u5b66\u4e00\u4e9b\u77e5\u8bc6\uff0c\u8fd9\u4e2a\u6bd4\u8d5b\uff0c\u6211\u82b1\u4e86\u5927\u628a\u65f6\u95f4\u5728\u8fd9\u4e2a\u9898\uff0c\u6bcf\u6b21\u90fd\u611f\u89c9\u4e34\u95e8\u4e00\u811a\uff08\u6bd4\u5982\u627e\u5230\u5bc6\u94a5\uff0c\u4f46\u5374\u4e0d\u662f\u6253\u5f00zip\u7684\u5bc6\u94a5\uff09\uff0c\u5e78\u597d\u6700\u540e\u89e3\u51fa\u6765\u4e86\u3002\u51fa\u9898\u8001\u5e08\u597d\u5389\u5bb3\uff0c\u633a\u559c\u6b22\u8fd9\u79cd\u9898\u578b\u7684\uff0c\u5728\u4f4d\u7f6e\u91cc\u9762\u63a2\u7d22\u65b0\u4e1c\u897f\uff0c\u5b66\u4e60\u5e76\u8fd0\u7528\u65b0\u4e1c\u897f\u6700\u7ec8\u89e3\u51fa\u6700\u540e\u7684flag\uff0c\u8fd9\u5c31\u662fMISC\u7684\u9b45\u529b\u5427~<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u9898\u9762\uff1a \u7ed9\u4e86\u5f20JPG\u6587\u4ef6 \u6211\u7684\u7b2c\u4e00\u76f4\u89c9\u662f\u8fd9\u662f\u4e2a\u4e8c\u7ef4\u7801\u88ab\u52a0\u5bc6\u4e86\u3002\u7136\u540e114514\u662f\u8fd9\u5f20\u56fe\u7684\u5173\u952e \u7ed3\u5408\u9898\u76ee&#8221;Curve with tw &#8230;<\/p>\n","protected":false},"author":1,"featured_media":588,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_gspb_post_css":"","emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[9],"tags":[],"class_list":["post-1059","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-misc"],"_links":{"self":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/1059","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/comments?post=1059"}],"version-history":[{"count":19,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/1059\/revisions"}],"predecessor-version":[{"id":1078,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/1059\/revisions\/1078"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/media\/588"}],"wp:attachment":[{"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/media?parent=1059"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/categories?post=1059"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/tags?post=1059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}