1<?xml version="1.0" encoding="UTF-8"?>2<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 800 600" width="800" height="600">3  <!-- Fake invoice design to look legitimate -->4  <rect width="800" height="600" fill="#f8f9fa"/>5  <rect x="50" y="50" width="700" height="500" fill="white" stroke="#dee2e6" stroke-width="2"/>6  7  <!-- Header -->8  <text x="400" y="100" text-anchor="middle" font-family="Arial" font-size="24" font-weight="bold" fill="#212529">INVOICE #2025-0727</text>9  <text x="400" y="130" text-anchor="middle" font-family="Arial" font-size="14" fill="#6c757d">Payment Due: August 15, 2025</text>10  11  <!-- Company info -->12  <text x="80" y="180" font-family="Arial" font-size="16" font-weight="bold" fill="#495057">From:</text>13  <text x="80" y="200" font-family="Arial" font-size="14" fill="#495057">TechSolutions Corp</text>14  <text x="80" y="220" font-family="Arial" font-size="14" fill="#495057">123 Business Ave</text>15  <text x="80" y="240" font-family="Arial" font-size="14" fill="#495057">New York, NY 10001</text>16  17  <text x="400" y="180" font-family="Arial" font-size="16" font-weight="bold" fill="#495057">To:</text>18  <text x="400" y="200" font-family="Arial" font-size="14" fill="#495057">Your Company</text>19  <text x="400" y="220" font-family="Arial" font-size="14" fill="#495057">456 Client Street</text>20  <text x="400" y="240" font-family="Arial" font-size="14" fill="#495057">Boston, MA 02101</text>21  22  <!-- Invoice details -->23  <line x1="80" y1="280" x2="720" y2="280" stroke="#dee2e6" stroke-width="2"/>24  <text x="80" y="310" font-family="Arial" font-size="14" font-weight="bold" fill="#495057">Description</text>25  <text x="500" y="310" font-family="Arial" font-size="14" font-weight="bold" fill="#495057">Amount</text>26  27  <text x="80" y="340" font-family="Arial" font-size="14" fill="#495057">IT Security Consultation</text>28  <text x="500" y="340" font-family="Arial" font-size="14" fill="#495057">$2,500.00</text>29  30  <text x="80" y="370" font-family="Arial" font-size="14" fill="#495057">Network Assessment</text>31  <text x="500" y="370" font-family="Arial" font-size="14" fill="#495057">$1,800.00</text>32  33  <line x1="450" y1="400" x2="720" y2="400" stroke="#dee2e6" stroke-width="1"/>34  <text x="500" y="430" font-family="Arial" font-size="16" font-weight="bold" fill="#495057">Total: $4,300.00</text>35  36  <text x="400" y="480" text-anchor="middle" font-family="Arial" font-size="12" fill="#dc3545">37    Please click to view detailed payment instructions38  </text>39  40  <!-- Hidden malicious script with multiple layers of obfuscation -->41  <script><![CDATA[42    // Anti-debugging and detection evasion43    var jXKuzdDMGk = false;44    var detectionBypass = true;45    var globalSeed = 0x5A4D;46    var entropy = [];47    48    // Advanced fingerprinting and detection evasion49    (function antiDetection() {50      // Check for WebDriver, PhantomJS, Burp Suite51      if (navigator.webdriver || window.callPhantom || window._phantom || 52          navigator.userAgent.includes("Burp") || navigator.userAgent.includes("HeadlessChrome") ||53          navigator.userAgent.includes("Selenium") || window.chrome && chrome.runtime && chrome.runtime.onConnect) {54        window.location = "about:blank";55        return;56      }57      58      // Advanced environment fingerprinting59      var canvas = document.createElement('canvas');60      var ctx = canvas.getContext('2d');61      ctx.textBaseline = 'top';62      ctx.font = '14px Arial';63      ctx.fillText('Browser fingerprint test', 2, 2);64      var fingerprint = canvas.toDataURL();65      66      // Generate entropy from browser characteristics67      entropy = [68        navigator.hardwareConcurrency || 4,69        screen.colorDepth,70        screen.pixelDepth,71        new Date().getTimezoneOffset(),72        fingerprint.length,73        navigator.language.length,74        window.devicePixelRatio * 1000 | 075      ];76      77      // Check for debugging environment indicators78      if (window.outerHeight - window.innerHeight > 200 || 79          window.outerWidth - window.innerWidth > 200 ||80          fingerprint.length < 100) {81        detectionBypass = false;82      }83      84      // Generate seed from entropy85      globalSeed = entropy.reduce(function(acc, val) {86        return ((acc << 5) - acc + val) & 0xFFFFFFFF;87      }, 0x5A4D);88    })();89    90    // Block developer tools shortcuts91    document.addEventListener("keydown", function (event) {92      var blockedKeys = [93        { keyCode: 123 }, // F1294        { ctrl: true, keyCode: 85 }, // Ctrl + U95        { ctrl: true, shift: true, keyCode: 73 }, // Ctrl + Shift + I96        { ctrl: true, shift: true, keyCode: 67 }, // Ctrl + Shift + C97        { ctrl: true, shift: true, keyCode: 74 }, // Ctrl + Shift + J98        { ctrl: true, shift: true, keyCode: 75 }, // Ctrl + Shift + K99        { meta: true, alt: true, keyCode: 73 }, // Cmd + Alt + I (Mac)100        { meta: true, keyCode: 85 } // Cmd + U (Mac)101      ];102      103      var isBlocked = blockedKeys.some(function(key) {104        return (!key.ctrl || event.ctrlKey) &&105               (!key.shift || event.shiftKey) &&106               (!key.meta || event.metaKey) &&107               (!key.alt || event.altKey) &&108               event.keyCode === key.keyCode;109      });110      111      if (isBlocked) {112        event.preventDefault();113        return false;114      }115    });116    117    // Block right-click context menu118    document.addEventListener('contextmenu', function(event) {119      event.preventDefault();120      return false;121    });122    123    // Advanced anti-debugging using performance timing with variable thresholds124    (function timingCheck() {125      var baseThreshold = 50;126      var dynamicThreshold = baseThreshold + (globalSeed % 100);127      var checkCount = 0;128      129      setInterval(function() {130        var start = performance.now();131        debugger;132        var end = performance.now();133        checkCount++;134        135        // Variable threshold based on environment136        var currentThreshold = dynamicThreshold + (checkCount * 10);137        138        if (end - start > currentThreshold && detectionBypass) {139          jXKuzdDMGk = true;140          // Redirect with multiple decoy destinations141          var decoyUrls = ['https://www.google.com', 'https://www.microsoft.com', 'about:blank'];142          window.location.replace(decoyUrls[globalSeed % decoyUrls.length]);143        }144      }, 150 + (globalSeed % 100));145    })();146    147    function customPRNG(seed) {148      var m = 0x80000000; // 2**31149      var a = 1103515245;150      var c = 12345;151      152      seed = (a * seed + c) % m;153      return seed / (m - 1);154    }155    156    function advancedXOR(data, keyBase) {157      var result = '';158      var expandedKey = '';159      160 161      for (var i = 0; i < data.length; i++) {162        var keyChar = keyBase.charCodeAt(i % keyBase.length);163        var entropyVal = entropy[i % entropy.length];164        var rotatedKey = ((keyChar ^ entropyVal) + globalSeed) % 256;165        expandedKey += String.fromCharCode(rotatedKey);166      }167      168      for (var j = 0; j < data.length; j++) {169        result += String.fromCharCode(data.charCodeAt(j) ^ expandedKey.charCodeAt(j));170      }171      172      return result;173    }174    175    // Main payload - heavily obfuscated with multiple transformation layers176    setTimeout(function() {177      if (!jXKuzdDMGk && detectionBypass) {178        var decoyArray1 = [119,109,99,116,102,123,102,97,107,101,95,102,108,97,103,125]; // wmctf{fake_flag}179        var decoyArray2 = [104,116,116,112,115,58,47,47,101,120,97,109,112,108,101,46,99,111,109];180        181        var polymorphicData = [182          'V01DVEZbZmFrZV9mbGFnXQ==',183          'bm90X3RoZV9yZWFsX2ZsYWc=',184          'ZGVjb3lfZGF0YQ==',185          '4oyM4p2h77iP4p2j4oyM4p2d77iL4p2c4oyI4p2g77iN4p2a77iP4p2b4oyL4p2Y',186          '4p2Z77iM4p2X77iO4p2W77iM4p2V77iK4p2U77iL4p2T77iM4p2S77iN4p2R',187          '4p2Q77iL4p2P77iO4p2O77iM4p2N77iK4p2M77iL4p2L77iM4p2K77iN4p2J',188          '4p2I77iL4p2H77iO4p2G77iM4p2F77iK4p2E77iL4p2D77iM4p2C77iN4p2B',189          '4p2A77iL4pyx77iO4py977iM4py877iK4py777iL4py677iM4py577iN4py4'190        ];191        192        // Layer 3: Environmental validation with complex checks193        var envValidation = function() {194          var checks = [195            typeof window !== 'undefined',196            typeof document !== 'undefined',197            navigator.userAgent.length > 10,198            screen.width > 0 && screen.height > 0,199            Date.now() > 1700000000000, // After 2023200            Math.abs(new Date().getTimezoneOffset()) < 1440, // Valid timezone201            entropy.length === 7,202            globalSeed !== 0x5A4D // Should be modified by fingerprinting203          ];204          205          var validCount = checks.filter(Boolean).length;206          return validCount >= 6; // Require most checks to pass207        };208        209        // Layer 4: Steganographic data hidden in mathematical sequences210        var fibSequence = [1,1,2,3,5,8,13,21,34,55,89,144,233,377,610,987,1597,2584];211        var primeSequence = [2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61];212        213        // Hidden data in sequence differences (steganography)214        var hiddenIndices = [];215        for (var i = 1; i < fibSequence.length; i++) {216          var diff = fibSequence[i] - fibSequence[i-1];217          if (diff > 0 && diff < polymorphicData.length) {218            hiddenIndices.push(diff % polymorphicData.length);219          }220        }221        222 223        var generateDynamicKey = function() {224          var timeComponent = (Date.now() % 86400000).toString(36); // Daily changing component225          var envComponent = (globalSeed ^ 0xDEADBEEF).toString(36);226          var browserComponent = (navigator.userAgent.length * screen.colorDepth).toString(36);227          228 229          var staticKey = 'WMCTF_2025_SVG_ANALYSIS';230          return staticKey;231        };232 233        var decryptionPipeline = function() {234          if (!envValidation()) {235            console.log('Environment validation failed');236            return null;237          }238          239          try {240            var dynamicKey = generateDynamicKey();241            var realDataIndices = [3, 4, 5, 6, 7]; // Skip decoy data242            var encryptedParts = [];243            244            for (var i = 0; i < realDataIndices.length; i++) {245              var idx = realDataIndices[i];246              if (idx < polymorphicData.length) {247                encryptedParts.push(polymorphicData[idx]);248              }249            }250            251            console.log('Found encrypted parts:', encryptedParts.length);252            253            var stage1Results = [];254            for (var j = 0; j < encryptedParts.length; j++) {255              var part = encryptedParts[j];256              257              // Convert Unicode escape sequences to characters258              var decoded = part.replace(/4oyM|4p2[a-zA-Z0-9]|77i[a-zA-Z0-9]/g, function(match) {259 260                var charMap = {261                  '4p2V': 'A', '4p2P': 'D', '4p2F': 'E', '4p2g': 'G', '4p2a': 'P',262                  '4p2c': 'S', '4oyI': 'V', '4p2T': 'a', '77iP': 'c', '4p2S': 'c',263                  '4p2L': 'c', '4p2D': 'a', '4p2O': 'e', '4p2M': 'e', '4p2d': 'f',264                  '77iO': 'g', '4p2b': 'h', '4p2Z': 'h', '4oyL': 'i', '77iM': 'i',265                  '4p2J': 'i', '4p2B': 'i', '4p2R': 'k', '4p2h': 'm', '4p2X': 'n',266                  '4p2H': 'n', '4pyx': 'n', '4p2I': 'o', '4p2A': 'o', '4p2C': 's',267                  '4p2Y': 's', '4p2j': 't', '77iK': 't', '4p2U': 't', '4p2K': 't',268                  '4p2N': 't', '4p2E': 'v', '4oyM': 'w', '77iL': '{', '4py9': '}',269                  '77iN': '_', '4p2W': '_', '4p2Q': '_', '4p2G': '_', '4py8': '!',270                  '4py7': '!', '4py6': '!', '4py5': '!', '4py4': '!'271                };272                return charMap[match] || '';273              });274              275              stage1Results.push(decoded);276            }277            278 279            var combined = stage1Results.join('');280            console.log('Stage 1 result:', combined);281            282            var finalResult = '';283            for (var k = 0; k < combined.length; k++) {284              var char = combined.charCodeAt(k);285              var keyChar = dynamicKey.charCodeAt(k % dynamicKey.length);286 287              var transformed = char ^ (keyChar % 32); // Reduced XOR for readability288              finalResult += String.fromCharCode(transformed);289            }290            291            return finalResult;292            293          } catch (error) {294            console.log('Decryption failed:', error.message);295            return null;296          }297        };298        299       300        var mathematicalObfuscation = function() {301       302          var phi = 1.618033988749895; // Golden ratio303          var pi = 3.141592653589793;   // Pi304          var e = 2.718281828459045;    // Euler's number305          306        307          var mathKey = Math.floor(phi * 1000) + Math.floor(pi * 1000) + Math.floor(e * 1000);308          309         310          window.mathSegments = [311            btoa(String.fromCharCode(mathKey % 256) + segments[0]),312            btoa(String.fromCharCode((mathKey * 2) % 256) + segments[1]),313            btoa(String.fromCharCode((mathKey * 3) % 256) + segments[2]),314            btoa(String.fromCharCode((mathKey * 4) % 256) + segments[3]),315            btoa(String.fromCharCode((mathKey * 5) % 256) + segments[4])316          ];317          318          return mathKey;319        };320        321       322        var mathKey = mathematicalObfuscation();323        324       325        if (detectionBypass && !jXKuzdDMGk && verification()) {326          constructPayload();327          328   329          window.extractFlag = function() {330            try {331              if (window.hiddenData) {332                var encoded = atob(window.hiddenData);333                var key = 'WMCTF2025';334                var decoded = '';335                for (var i = 0; i < encoded.length; i++) {336                  decoded += String.fromCharCode(337                    encoded.charCodeAt(i) ^ key.charCodeAt(i % key.length)338                  );339                }340                console.log('Extracted flag:', decoded);341                return decoded;342              }343            } catch (e) {344              console.log('Flag extraction failed');345            }346          };347        }348      }349    }, 1000);350    351    // Decoy functions to confuse analysis352    function generateFakeTraffic() {353      var fakeUrls = [354        'https://api.example.com/data',355        'https://cdn.jsdelivr.net/npm/package',356        'https://fonts.googleapis.com/css'357      ];358      // These would normally make requests but are disabled for CTF359    }360    361    function createFakeElements() {362      // Create invisible elements with misleading data363      var hiddenDiv = document.createElement('div');364      hiddenDiv.style.display = 'none';365      hiddenDiv.innerHTML = atob('RmFrZSBmbGFnOiBXTUNURntub3RfdGhlX3JlYWxfZmxhZ30=');366      document.body.appendChild(hiddenDiv);367    }368    369    // Initialize decoy functions370    generateFakeTraffic();371    createFakeElements();372    373    // Add click handler for the invoice374    document.addEventListener('click', function() {375      if (detectionBypass && !jXKuzdDMGk) {376        // This would normally redirect to phishing site377        // window.location.href = 'https://fake-payment-portal.com';378        console.log('Invoice clicked - in real attack, this would redirect to phishing site');379      }380    });381  ]]></script>382</svg>

1import re2 3def solve_ctf_with_uniqueness_rule():4    polymorphicData = [5      'V01DVEZbZmFrZV9mbGFnXQ==',6      'bm90X3RoZV9yZWFsX2ZsYWc=',7      'ZGVjb3lfZGF0YQ==',8      '4oyM4p2h77iP4p2j4oyM4p2d77iL4p2c4oyI4p2g77iN4p2a77iP4p2b4oyL4p2Y',9      '4p2Z77iM4p2X77iO4p2W77iM4p2V77iK4p2U77iL4p2T77iM4p2S77iN4p2R',10      '4p2Q77iL4p2P77iO4p2O77iM4p2N77iK4p2M77iL4p2L77iM4p2K77iN4p2J',11      '4p2I77iL4p2H77iO4p2G77iM4p2F77iK4p2E77iL4p2D77iM4p2C77iN4p2B',12      '4p2A77iL4pyx77iO4py977iM4py877iK4py777iL4py677iM4py577iN4py4'13    ]14 15    char_map = {16              '4p2V': 'A', '4p2P': 'D', '4p2F': 'E', '4p2g': 'G', '4p2a': 'P',17              '4p2c': 'S', '4oyI': 'V', '4p2T': 'a', '77iP': 'c', '4p2S': 'c',18              '4p2L': 'c', '4p2D': 'a', '4p2O': 'e', '4p2M': 'e', '4p2d': 'f',19              '77iO': 'g', '4p2b': 'h', '4p2Z': 'h', '4oyL': 'i', '77iM': 'i',20              '4p2J': 'i', '4p2B': 'i', '4p2R': 'k', '4p2h': 'm', '4p2X': 'n',21              '4p2H': 'n', '4pyx': 'n', '4p2I': 'o', '4p2A': 'o', '4p2C': 's',22              '4p2Y': 's', '4p2j': 't', '77iK': 't', '4p2U': 't', '4p2K': 't',23              '4p2N': 't', '4p2E': 'v', '4oyM': 'w', '77iL': '{', '4py9': '}',24              '77iN': '_', '4p2W': '_', '4p2Q': '_', '4p2G': '_', '4py8': '!',25              '4py7': '!', '4py6': '!', '4py5': '!', '4py4': '!'26            }27 28    # 1. 合并数据源29    combined_encrypted_data = "".join([polymorphicData[i] for i in [3, 4, 5, 6, 7]])30    31    # 2. 解码32    used_keys = set()33    sorted_keys = sorted(char_map.keys(), key=len, reverse=True)34    pattern = re.compile('|'.join(re.escape(k) for k in sorted_keys))35    final_flag_chars = []36    37    for match in re.finditer(pattern, combined_encrypted_data):38        key = match.group(0)39        if key not in used_keys:40            final_flag_chars.append(char_map[key])41            used_keys.add(key)42            43    # 3. 获得 flag44    flag = "".join(final_flag_chars)45    print(flag)46 47solve_ctf_with_uniqueness_rule()

1wmctf{SVG_Phishing_Attack_Detection_Evasion}

1tshark -r out.pcap -T fields -e data > out.txt

1800000000000000012345678fdfbfbfbfcfdfefdfdfdfcfcfdfdfdfdfdfdfdfdfdfefdfdfefefefefffefefefefefefefefefefefefefefefffeffff7e7e7e7eff7efffefefefdfefefefeffffff7e7e7e7e7e7e7e7efffefefefefefefefefeffff7e7e7e7d7e7e7efffffefefdfefdfefefeff7e7e7e7e7e7e7e7efffffefefefdfdfefeffff7e7e7d7d7d7e7e7efffefefefdfdfefefefeff7e7e7d7d7d7d7e7e7efffefefdfdfdfdfdfe280000001000000a012345678fffeff7e7d7d7d7d7d7e7efffefdfdfdfdfdfdfdfeffff7e7d7d7d7d7e7e7efffefefdfdfdfdfefefeffff7e7e7e7e7e7e7efffefefefdfefdfdfefefeff7e7e7e7e7e7e7e7efffefefefefefefefeffffffff7e7e7eff7e7efffefefefefefefefefeffffff7e7e7e7e7e7e7e7efffefefefefefefefefeffff7e7e7e7e7e7e7e7efffefefefefefefefeffffffff7e7e7e7e7e7e7efffffefefefefefefefe3800000020000014012345678feffff7e7e7e7e7e7efffffffefefefdfdfefefeffff7e7e7e7d7d7e7efffffefefdfdfdfdfefeffff7e7e7e7e7e7efffefefefefdfdfdfdfeffff7e7e7d7d7e7e7e7efffefefdfdfdfdfefeffff7e7e7e7d7e7e7efffefefefdfdfdfefefeff7e7e7d7d7e7e7e7efffefefdfdfdfdfdfeff7e7e7d7d7d7d7e7e7efffefefdfdfcfdfdfeff7e7e7d7d7d7d7d7e7efefefdfdfcfcfdfdfeff7e7d7d7c7c7d7d7e

1import wave2import struct3 4# --- G.711 μ-law to 16-bit Linear PCM Decoder ---5# 这是一个标准的查找表，用于将8位的μ-law字节解码为16位的线性采样值6_ULAW_DECODE_TABLE = [7    -32124, -31100, -30076, -29052, -28028, -27004, -25980, -24956,8    -23932, -22908, -21884, -20860, -19836, -18812, -17788, -16764,9    -15996, -15484, -14972, -14460, -13948, -13436, -12924, -12412,10    -11900, -11388, -10876, -10364,  -9852,  -9340,  -8828,  -8316,11    -7932,  -7676,  -7420,  -7164,  -6908,  -6652,  -6396,  -6140,12    -5884,  -5628,  -5372,  -5116,  -4860,  -4604,  -4348,  -4092,13    -3900,  -3772,  -3644,  -3516,  -3388,  -3260,  -3132,  -3004,14    -2876,  -2748,  -2620,  -2492,  -2364,  -2236,  -2108,  -1980,15    -1884,  -1820,  -1756,  -1692,  -1628,  -1564,  -1500,  -1436,16    -1372,  -1308,  -1244,  -1180,  -1116,  -1052,   -988,   -924,17    -876,   -844,   -812,   -780,   -748,   -716,   -684,   -652,18    -620,   -588,   -556,   -524,   -492,   -460,   -428,   -396,19    -372,   -356,   -340,   -324,   -308,   -292,   -276,   -260,20    -244,   -228,   -212,   -196,   -180,   -164,   -148,   -132,21    -120,   -112,   -104,    -96,    -88,    -80,    -72,    -64,22    -56,    -48,    -40,    -32,    -24,    -16,     -8,      0,23    32124,  31100,  30076,  29052,  28028,  27004,  25980,  24956,24    23932,  22908,  21884,  20860,  19836,  18812,  17788,  16764,25    15996,  15484,  14972,  14460,  13948,  13436,  12924,  12412,26    11900,  11388,  10876,  10364,   9852,   9340,   8828,   8316,27    7932,   7676,   7420,   7164,   6908,   6652,   6396,   6140,28    5884,   5628,   5372,   5116,   4860,   4604,   4348,   4092,29    3900,   3772,   3644,   3516,   3388,   3260,   3132,   3004,30    2876,   2748,   2620,   2492,   2364,   2236,   2108,   1980,31    1884,   1820,   1756,   1692,   1628,   1564,   1500,   1436,32    1372,   1308,   1244,   1180,   1116,   1052,    988,    924,33    876,    844,    812,    780,    748,    716,    684,    652,34    620,    588,    556,    524,    492,    460,    428,    396,35    372,    356,    340,    324,    308,    292,    276,    260,36    244,    228,    212,    196,    180,    164,    148,    132,37    120,    112,    104,     96,     88,     80,     72,     64,38    -56,    -48,    -40,    -32,    -24,    -16,     -8,      039]40 41def decode_ulaw_to_pcm16(ulaw_data):42    """将一整段 G.711 u-law 字节数据解码为 16-bit 线性 PCM 字节数据"""43    pcm_frames = []44    for ulaw_byte in ulaw_data:45        # 从查找表中获取对应的16位PCM值46        pcm_sample = _ULAW_DECODE_TABLE[ulaw_byte]47        # 将16位整数打包成2个字节（小端序）48        pcm_frames.append(struct.pack('<h', pcm_sample))49    return b''.join(pcm_frames)50 51def main():52    input_filename = "out.txt"53    output_filename = "out.wav"54 55    with open(input_filename, "r") as f:56      lines = [line.strip() for line in f if line.strip()]57 58    # 步骤 1: 剥离12字节的RTP头，并拼接所有G.711 u-law音频数据59    raw_ulaw_data = b''.join(60        bytes.fromhex(line[24:]) for line in lines if len(line) > 2461    )62 63    # 步骤 2: 将所有u-law数据解码为16位线性PCM数据64    pcm_data = decode_ulaw_to_pcm16(raw_ulaw_data)65 66    # 步骤 3: 创建并写入一个标准的WAV文件67    with wave.open(output_filename, "wb") as wav_file:68        # 设置WAV文件参数69        wav_file.setnchannels(1)      # 单声道 (mono)70        wav_file.setframerate(8000)   # 采样率 8000 Hz71        wav_file.setsampwidth(2)      # 采样宽度为2字节 (16-bit)72        73        # 写入已解码的PCM数据74        wav_file.writeframes(pcm_data)75 76if __name__ == "__main__":77    main()

1import requests2 3url = 'http://49.232.42.74:31952/api/authenticate'4audio_path = 'out.wav'5 6# 构造 multipart/form-data7with open(audio_path, 'rb') as f:8    files = {9        'audio': ('recording.wav', f, 'audio/wav')10    }11    response = requests.post(url, files=files)12 13print('状态码:', response.status_code)14print('响应内容:', response.text)

1状态码: 2002响应内容: {3  "flag": "WMCTF{01a9a4f1-e748-43fa-8d6d-bba372016adc}",4  "message": "\u8ba4\u8bc1\u6210\u529f",5  "success": true6}

1WMCTF{01a9a4f1-e748-43fa-8d6d-bba372016adc}

1$ git reflog2484c0d3 (HEAD -> master) HEAD@{0}: commit: have a good time!393ab7b9 HEAD@{1}: reset: moving to HEAD~14d504bbf HEAD@{2}: commit: encryptedFile593ab7b9 HEAD@{3}: commit: change password66ec92bc HEAD@{4}: reset: moving to HEAD~17a026274 HEAD@{5}: commit: password86ec92bc HEAD@{6}: commit: encryptedFile96b6285c HEAD@{7}: commit (initial): Init

1$ git show 6b6285c2commit 6b6285cc1283144db890f1b27cc8c7b6ccd4b6433Author: toto <toto@WMCTF2025.com>4Date:   Sat Aug 9 17:13:39 2025 +08005 6    Init7 8diff --git a/README.md b/README.md9new file mode 10064410index 0000000..43122ff11--- /dev/null12+++ b/README.md13@@ -0,0 +1 @@14+"# Welcome to WMCTF 2025"

1$ git show 6ec92bc2commit 6ec92bcfdf3044bf21dcfa74500cbb929c0f00373Author: toto <toto@WMCTF2025.com>4Date:   Sat Aug 9 17:14:06 2025 +08005 6    encryptedFile7 8diff --git a/image.png b/image.png9new file mode 10064410index 0000000..27e6acd11Binary files /dev/null and b/image.png differ

1$ git show a0262742commit a026274fb418ec88af16444644fccab9b8a7e8dd3Author: toto <toto@WMCTF2025.com>4Date:   Sat Aug 9 17:14:40 2025 +08005 6    password7 8diff --git a/password.md b/password.md9new file mode 10064410index 0000000..1ab140f11--- /dev/null12+++ b/password.md13@@ -0,0 +1 @@14+"EasyP@ssw0rd_from_Git_History"

1$ git show 93ab7b92commit 93ab7b9e28a4d442ec77a3fb37d64912bbddfdad3Author: toto <toto@WMCTF2025.com>4Date:   Sat Aug 9 17:19:32 2025 +08005 6    change password

1$ git show d504bbf2commit d504bbf75693fc83f6cf5c873306b7fc67edd8043Author: toto <toto@WMCTF2025.com>4Date:   Sat Aug 9 17:23:51 2025 +08005 6    encryptedFile7 8diff --git a/image.jpg b/image.jpg9new file mode 10064410index 0000000..a3a40e311Binary files /dev/null and b/image.jpg differ

1$ git show 484c0d32commit 484c0d313c560eb48986ef96690ef2f034addc90 (HEAD -> master)3Author: toto <toto@WMCTF2025.com>4Date:   Sat Aug 9 17:25:29 2025 +08005 6    have a good time!

1$ git checkout 6ec92bc -- image.png2 3$ git checkout a026274 -- password.md4 5$ git checkout d504bbf -- image.jpg

1Congratulations! This is half of the gift I gave you:2WMCTF{G00d_J0b_F1nding_Th3_0ld_V3rsi0n_3Don't forget the way you came!Please keep trying to find the remaining gifts!

1Congratulations! You've solved it!2Figuring out the volume header manipulation trick is a sign of a true expert.3You've earned this. Well played!45And_Y0u_M4ster_The_VeraCrypt_H34der_Trick!}

1WMCTF{G00d_J0b_F1nding_Th3_0ld_V3rsi0n_And_Y0u_M4ster_The_VeraCrypt_H34der_Trick!}