https://baozongwi.xyz/tags/cb%E9%93%BE/Currently exploring Java security and internal network penetration, with CTFs as a hobby.Hugozh-cnhttps://baozongwi.xyz/p/rwctf-2021/Thu, 30 Jul 2026 18:11:04 +0800https://baozongwi.xyz/p/rwctf-2021/TL;DR 接下来我会抽空复现一些 RWCTF 的题目，还是太想打 CTF 了，学习一些思路，也算是弥补没参加 过 RWCTF 的遗憾了 DBaaSadge 首先需要注意一点，我本地是 Mac，所以构建环境的 compose 需要换一下 services: web: build: . platform: …https://baozongwi.xyz/p/peak-geek-2024-ezjava/Sun, 30 Nov 2025 13:39:02 +0800https://baozongwi.xyz/p/peak-geek-2024-ezjava/黑盒打 Commons-Beanutils 1.9+ 自带 Commons-Collections3.2.1，高版本 jdk17，用sun.misc.Unsafe来反射。 pom.xml <?xml version="1.0" encoding="UTF-8"?> <project …https://baozongwi.xyz/p/shiro550-deserialization/Sat, 06 Sep 2025 17:07:54 +0800https://baozongwi.xyz/p/shiro550-deserialization/shiro550中CC6&&CB1&&无CC依赖的CB1https://baozongwi.xyz/p/ctfshow-king-of-involution-cup/Sat, 11 Jan 2025 10:44:54 +0000https://baozongwi.xyz/p/ctfshow-king-of-involution-cup/easy unserialize <?php include("./HappyYear.php"); class one { public $object; public function MeMeMe() { array_walk($this, function($fn, $prev){ if ($fn[0] === …