L3HCTF 2025 Official Writeup
输入“/”快速插入内容
L3HCTF 2025 Official Writeup
L3HCTF 2025 Official Writeup
用户9760用户9760
用户5667用户5667
用户4878用户4878用户6987用户6987用户2279用户2279+4
2025年12月25日修改
Web
赛博侦探
先给各位磕了，这题确实应该放在 Misc，因为带点 Web 元素归到 Web 了。
根据贴文：
代码块
说句八阿哥不爱听的，四阿哥真王朝了
【九子夺嫡MVP结算】王上加白，加冕の小曲，七分钟完整版
/go/CB6R8pq
跳转到->
https://www.bilibili.com/video/BV1tT421e7r3?from_url=http://127.0.0.1:7000/secret/find_my_password&buvid=XU729158D436618067C9318686801E96CB45D&from_spmid=tm.recommend.0.0&is_story_h5=false&plat_id=116&share_from=ugc&share_medium=android&share_plat=android&share_session_id=422b97e2-06ad-4b22-a034-6f23ac237e51&share_source=COPY&share_tag=s_i&spmid=united.player-video-detail.0.0×tamp=1751785740&unique_k=CB6R8pq&up_id=552601798&vd_source=9bf39d738136404baadb2ae2ab47a100
获取到隐藏路由：/secret/find_my_password
可见需要获取该用户的邮箱、店铺经纬度、老家城市、英文姓名
1.
邮箱
下载小说文稿，查看作者可以得到
2.
店铺经纬度
代码块
import math
from scipy.optimize import least_squares
EARTH_RADIUS_KM = 6371.0
def haversine(lat1, lon1, lat2, lon2, r=EARTH_RADIUS_KM):
φ1, φ2 = math.radians(lat1), math.radians(lat2)
Δφ, Δλ = math.radians(lat2 - lat1), math.radians(lon2 - lon1)
a = math.sin(Δφ / 2) ** 2 + math.cos(φ1) * math.cos(φ2) * math.sin(Δλ / 2) ** 2
c = 2 * math.atan2(math.sqrt(a), math.sqrt(1 - a))
return r * c
def _residuals(x, anchors):
lat, lon = x
return [
haversine(lat, lon, lat_i, lon_i) - d_i
for (lat_i, lon_i, d_i) in anchors
]
def trilaterate(anchors, guess=None):
if guess is None:
lats, lons = zip(*[(a[0], a[1]) for a in anchors])
guess = (sum(lats) / len(lats), sum(lons) / len(lons))
res = least_squares(_residuals, guess, args=(anchors,), method="lm")
lat_est, lon_est = res.x
rms_err = (2 * res.cost / len(anchors)) ** 0.5
return lat_est, lon_est, rms_err
if __name__ == "__main__":
anchors = [
(30.611436, 114.195324, 2.3),
(30.634363, 114.202718, 2.8),
(30.643873, 114.162743, 2.5),
]
lat, lon, err = trilaterate(anchors)
print(f"Estimated location: {lat:.6f}, {lon:.6f} (±{err:.2f} km RMS)")
# Estimated location: 30.624245, 114.176051 (±0.02 km RMS)