题目附件前往 Releases 下载
事件响应助手会拒绝直接读取敏感文件。请通过正常业务流程触发被污染的检索链，并取得flag。 The event response assistant will refuse to directly read sensitive files. Please trigger the compromised search chain through normal business processes and obtain the flag.
根据附件中的 token 日志和加密结果，还原被加密的 flag。 Based on the token log and encryption results in the attachment, restore the encrypted flag.
服务会给出一个普通用户 token。请利用校验接口伪造管理员身份并读取 flag。（本题下发后，请通过http访问相应的ip和port，例如 nc ip port ，改为http://ip:port/） The service provides a regular user token. Use the verification endpoint to forge admin privileges and retrieve the flag.(After the challenge is deployed, access the assigned IP and port via HTTP. For example, instead of using nc ip port, use http://ip:port/)
附件给出了 RSA 公钥、密文以及素数 p 满足的二次关系，请恢复私钥并解密票据。 The attachment provides the RSA public key, ciphertext, and the quadratic relation satisfied by the prime number p. Please recover the private key and decrypt the ticket.
某归档站点的首页看起来只有公开信息，但上线包里似乎留下了镜像索引。请找到隐藏导出接口并取得 flag。 The homepage of an archive site appears to only contain public information, but the deployment package seems to contain a mirror index. Please locate the hidden export interface and retrieve its flag.
本题模拟内网设备上报流量取证场景，其中关键设备的本地时钟存在固定偏移，选手需要从抓包中提取同步信息并按校正后的时间线重组证据。 This question simulates a scenario of obtaining evidence from traffic reports from internal network devices. The local clock of the key device has a fixed offset. The contestant needs to extract synchronization information from the packet capture and reconstruct the evidence according to the corrected timeline.
本题模拟浏览器风控系统记录用户操作轨迹的场景。轨迹以delta坐标压缩保存，选手需要还原绝对坐标并将有效绘制点复现为Canvas图案。flag格式为flag{uuid小写}。 This question simulates a scenario where a browser's risk control system records user activity. The activity is saved in delta coordinates, and contestants need to restore the absolute coordinates and reproduce the valid drawing points as a Canvas pattern. The flag format is flag{lowercase UUID}.
账本系统仅允许导出当前租户的公开资产。请审核异步报表和旧版维护接口，以便在不直接执行 SQL 语句的情况下实现深度利用。 The ledger system only allows exporting publicly available assets of the current tenant. Please audit asynchronous reports and legacy maintenance interfaces to achieve in-depth utilization without direct SQL echo.
上传区域仅允许上传与历史记录兼容的图片和文件。请审核上传逻辑并读取上传目录中的隐藏服务器信息。 The upload area only allows images and files compatible with history. Please audit the upload logic and read hidden server information from the upload directory.
预览服务仅允许访问 safe.local 和 assets.local。请通过预览链接访问内部工作进程，并在不依赖外部网络回程的情况下读取标志。 The preview service only allows access to safe.local and assets.local. Please access the internal worker from the preview link and read the flag without relying on an external network backhaul.
远程服务提供笔记和操作管理功能。请分析对象生命周期缺陷，绕过对象验证，并读取标志。 The remote service provides note and action management functions. Please analyze object lifecycle flaws, bypass object validation, and read the flag.
附件是一个许可证验证程序。请分析自定义虚拟机并找到正确的输入。 The attachment is a license verification program. Please analyze the custom VM and find the correct input.