2026ctf新生赛出题笔记

Ghost Layer

Docker中导入镜像

1
docker load -i ctf_layer.tar

启动

1
docker run -it --rm ctf_layer /bin/bash

查找有没有藏东西

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
┌──(kali㉿kali)-[~/Desktop]
└─$ docker run -it --rm ctf_layer /bin/bash
root@94bc849594db:/# ls
bin  boot  dev  etc  hidden  home  lib  lib32  lib64  libx32  media  mnt  opt  proc  root  run  sbin  snap  srv  sys  tmp  usr  var
root@94bc849594db:/# cd hidden
root@94bc849594db:/hidden# ls -al
total 28
drwxr-xr-x 1 root root 4096 May  5 14:27 .
drwxr-xr-x 1 root root 4096 May  9 12:00 ..
-rw-r--r-- 1 root root   21 May  5 14:27 cache1.txt
-rw-r--r-- 1 root root   15 May  5 14:27 config1.cfg
-rw-r--r-- 1 root root   24 May  5 14:27 flag.txt
-rw-r--r-- 1 root root   37 May  5 14:27 log1.txt
-rw-r--r-- 1 root root   37 May  5 14:27 notes.txt
root@94bc849594db:/hidden# cat flag.txt
flag{there_is_not_flag}

怎么查找也只发现了flag.txt，但这个是错误的flag

exit退出，查看镜像历史

1
docker history ctf_layer

如下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
┌──(kali㉿kali)-[~/Desktop]
└─$ docker history ctf_layer
IMAGE          CREATED      CREATED BY                                      SIZE      COMMENT
f3629ae7d826   3 days ago   CMD ["sleep" "infinity"]                        0B        buildkit.dockerfile.v0
<missing>      3 days ago   RUN /bin/sh -c rm /hidden/flAg # buildkit       0B        buildkit.dockerfile.v0
<missing>      3 days ago   RUN /bin/sh -c echo "Random notes: nothing i…   37B       buildkit.dockerfile.v0
<missing>      3 days ago   RUN /bin/sh -c echo "ZmxhZ3tUaDNfRDBjazNyXzF…   42B       buildkit.dockerfile.v0
<missing>      3 days ago   RUN /bin/sh -c echo "CONFIG=enabled" > /hidd…   15B       buildkit.dockerfile.v0
<missing>      3 days ago   RUN /bin/sh -c echo "Temporary cache data" >…   21B       buildkit.dockerfile.v0
<missing>      3 days ago   RUN /bin/sh -c echo "DEBUG_LOG: startup sequ…   37B       buildkit.dockerfile.v0
<missing>      3 days ago   RUN /bin/sh -c echo "flag{there_is_not_flag}…   24B       buildkit.dockerfile.v0
<missing>      4 days ago   RUN /bin/sh -c mkdir -p /hidden # buildkit      0B        buildkit.dockerfile.v0
<missing>      4 days ago   RUN /bin/sh -c apt-get update && apt-get ins…   354MB     buildkit.dockerfile.v0
<missing>      4 days ago                                                   1.12GB    Imported from -

导出镜像

1
2
3
4
docker save ctf_layer -o layers.tar

mkdir extract && tar -xf layers.tar -C layers
cd layers

查看manifest.json文件

1
2
3
─$ cat manifest.json
[{"Config":"blobs/sha256/f3629ae7d8266417a3bc064b303231c518a95d8da0ebe39fa0d485d0321604c1","RepoTags":["ctf_layer:latest"],"Layers":["blobs/sha256/b8b9963949d9d477b6a8a1fc851b15979ce79ac4486c4ca76dec8d11b6085a9e","blobs/sha256/5a5f74c00b697fa282e8044b4aaec7caa6850a621917b92c0b070f2eedd79c46","blobs/sha256/b38459665f0fdc5ac653fe919a5ba03a3f837121760d73ae888c3edb61a798c8","blobs/sha256/a2f82e0ffa579ef4ef3d7c8d966c0873866d7a7007ecb651bf4f53f18b9d3478","blobs/sha256/45d95dbd7dbe8731e03adeac2e47fc1a078b99c5ef30fb61d01ab8130102780b","blobs/sha256/58efb026e4af70184dbaa353072b9d5e7de3e2634466f16663fd43fa05f479b1","blobs/sha256/3d0ce6e7ca6707e17bd59ba54fa8d31e8f9d66299e27dcc7f98618d51ea33418","blobs/sha256/1e3b7fb1201a6809b89e9f9989997bd802ba796af7fcdbada9f3491ed9394c75","blobs/sha256/bf100e31a014e3f868cc899a894188b6aa09ab3296d57fa310333fd6db0f79aa","blobs/sha256/05f35706c7695f835e9a0992eb6401889021e95a74d933bb9ce30bcf4b6b145f"],"LayerSources":{"sha256:05f35706c7695f835e9a0992eb6401889021e95a74d933bb9ce30bcf4b6b145f":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":2048,"digest":"sha256:05f35706c7695f835e9a0992eb6401889021e95a74d933bb9ce30bcf4b6b145f"},"sha256:1e3b7fb1201a6809b89e9f9989997bd802ba796af7fcdbada9f3491ed9394c75":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":2560,"digest":"sha256:1e3b7fb1201a6809b89e9f9989997bd802ba796af7fcdbada9f3491ed9394c75"},"sha256:3d0ce6e7ca6707e17bd59ba54fa8d31e8f9d66299e27dcc7f98618d51ea33418":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":2560,"digest":"sha256:3d0ce6e7ca6707e17bd59ba54fa8d31e8f9d66299e27dcc7f98618d51ea33418"},"sha256:45d95dbd7dbe8731e03adeac2e47fc1a078b99c5ef30fb61d01ab8130102780b":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":2560,"digest":"sha256:45d95dbd7dbe8731e03adeac2e47fc1a078b99c5ef30fb61d01ab8130102780b"},"sha256:58efb026e4af70184dbaa353072b9d5e7de3e2634466f16663fd43fa05f479b1":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":2560,"digest":"sha256:58efb026e4af70184dbaa353072b9d5e7de3e2634466f16663fd43fa05f479b1"},"sha256:5a5f74c00b697fa282e8044b4aaec7caa6850a621917b92c0b070f2eedd79c46":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":354249216,"digest":"sha256:5a5f74c00b697fa282e8044b4aaec7caa6850a621917b92c0b070f2eedd79c46"},"sha256:a2f82e0ffa579ef4ef3d7c8d966c0873866d7a7007ecb651bf4f53f18b9d3478":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":2560,"digest":"sha256:a2f82e0ffa579ef4ef3d7c8d966c0873866d7a7007ecb651bf4f53f18b9d3478"},"sha256:b38459665f0fdc5ac653fe919a5ba03a3f837121760d73ae888c3edb61a798c8":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":1536,"digest":"sha256:b38459665f0fdc5ac653fe919a5ba03a3f837121760d73ae888c3edb61a798c8"},"sha256:b8b9963949d9d477b6a8a1fc851b15979ce79ac4486c4ca76dec8d11b6085a9e":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":1205944320,"digest":"sha256:b8b9963949d9d477b6a8a1fc851b15979ce79ac4486c4ca76dec8d11b6085a9e"},"sha256:bf100e31a014e3f868cc899a894188b6aa09ab3296d57fa310333fd6db0f79aa":{"mediaType":"application/vnd.oci.image.layer.v1.tar","size":2560,"digest":"sha256:bf100e31a014e3f868cc899a894188b6aa09ab3296d57fa310333fd6db0f79aa"}}}]

Layers 列表按顺序就是 Docker build 的每一层，每个 layer 对应的文件在 blobs/sha256/

layer 文件是 tar 包，可以直接解压

1
2
3
4
5
6
7
8
for layer in $(jq -r '.[0].Layers[]' manifest.json); do
    echo "==== $layer ===="
    mkdir tmp
    tar -xf $layer -C tmp
    ls tmp/hidden 2>/dev/null
    cat tmp/hidden/flAg 2>/dev/null
    rm -rf tmp
done

得到ZmxhZ3tUaDNfRDBjazNyXzFTX1cwd193b1chfQ==
解码：得到flag flag{Th3_D0ck3r_1S_W0w_woW!}

真相守护者论坛

保存猫咪日常文章的图片，发现是1a2b3c4d.enc_-2.png

发现文件尾有添加的数据

U2FsdGVkX1/o+n+Uf81m8YCPYIGfVwVSYPm5WQFlO8fugvB39mMQ5AXTTCmRyBcQ

显然稍微有点经验的朋友可能会往加解密的方向上去靠，那么就是去找这个解密的key了

看代码之神的文章，发现了一个被定义但在代码中没被使用的变量——HIDDEN，尝试用它解密，得到明文

（然后查看嗨朋友那个文章，发现漏了微博的昵称，经常完微博的朋友应该知道，昵称唯一。那么可以指定Gamma发的最早的两篇文章，发现有个key:{12345}，和AES的内容掺杂在文字里。初步判定是AES加密，但测试key不是12345，这算是一个小小的引导点和误导项了，虽然好像并没人被误导到）

经过解密得到一半的flag C7y9t0_W3_G3t_1T!}

然后看到评论区有个人的头像是二维码，扫码得到flag{M7_

整合：flag{M7_C7y9t0_W3_G3t_1T!}

仿生内存会找到它的电子flag吗？

1
vol -f memdump.raw windows.info

发现是windows的内存镜像文件

查看进程列表

1
vol -f memdump.raw  windows.pslist

发现有两个可疑的进程： expl0re.exe 、loader.exe，找到对应的pid是3020和952

dump下进行分析，

1
vol -f memdump.raw windows.memmap --pid  --dump

发现两个dump下的进程都strings搜索不到flag，考虑到是不是被编码了，直接strings搜索ZmxhZ3

发现了 ZmxhZ3tUaDNfUzNjcjN0X0szeV9sMXYzXzFuX20zbTByeX0=

1
2
3
4
5
6
┌──(kali㉿kali)-[~/Desktop]
└─$ strings pid.952.dmp  | grep "ZmxhZ3"
ZmxhZ3tUaDNfUzNjcjN0X0szeV9sMXYzXzFuX20zbTByeX0=
ZmxhZ3tUH
ZmxhZ3tUH
ZmxhZ3tUH

解码得到flag：flag{Th3_S3cr3t_K3y_l1v3_1n_m3m0ry}