GET /aazz?filename=a/b/c/d/secret.py GET /aazz?filename=app.py
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
from fenjing import exec_cmd_payload, config_payload import logging logging.basicConfig(level = logging.INFO)
def waf(s: str): # 如果字符串s可以通过waf则返回True, 否则返回False blacklist = [ '{','}','popen','os','import','eval','_','system','read','base','globals' ] return all(word not in s for word in blacklist)
<?php highlight_file(__FILE__); error_reporting(0); functionbest64_decode($str) { returnbase64_decode(base64_decode(base64_decode(base64_decode(base64_decode($str))))); } classyesterday{ public$learn; public$study="study"; public$try; publicfunction__construct() { $this->learn = "learn<br>"; } publicfunction__destruct() { echo"You studied hard yesterday.<br>"; return$this->study->hard(); } } classtoday{ public$doing; public$did; public$done; publicfunction__construct(){ $this->did = "What you did makes you outstanding.<br>"; } publicfunction__call($arg1, $arg2) { $this->done = "And what you've done has given you a choice.<br>"; echo$this->done; if(md5(md5($this->doing))==666){ return$this->doing(); } else{ return$this->doing->better; } } } classtommoraw{ public$good; public$bad; public$soso; publicfunction__invoke(){ $this->good="You'll be good tommoraw!<br>"; echo$this->good; } publicfunction__get($arg1){ $this->bad="You'll be bad tommoraw!<br>"; }
} classfuture{ private$impossible="How can you get here?<br>"; private$out; private$no; public$useful1;public$useful2;public$useful3;public$useful4;public$useful5;public$useful6;public$useful7;public$useful8;public$useful9;public$useful10;public$useful11;public$useful12;public$useful13;public$useful14;public$useful15;public$useful16;public$useful17;public$useful18;public$useful19;public$useful20;
publicfunction__set($arg1, $arg2) { if ($this->out->useful7) { echo"Seven is my lucky number<br>"; system('whoami'); } } publicfunction__toString(){ echo"This is your future.<br>"; system($_POST["wow"]); return"win"; } publicfunction__destruct(){ $this->no = "no"; return$this->no; } } if (file_exists($_GET['filename'])){ echo"Focus on the previous step!<br>"; } else{ $data=substr($_GET['filename'],0,-4); unserialize(best64_decode($data)); } // You learn yesterday, you choose today, can you get to your future? ?>
from pyramid.config import Configurator from pyramid.request import Request from pyramid.response import Response from pyramid.view import view_config from wsgiref.simple_server import make_server from pyramid.events import NewResponse import re from jinja2 import Environment, BaseLoader
defhome_view(request): expr_input = "" result = ""
if request.method == 'POST': expr_input = request.POST['expr'] if checkExpr(expr_input): try: result = eval(expr_input, eval_globals) except Exception as e: result = e else: result = "爬！"
if __name__ == '__main__': with Configurator() as config: config.add_route('home_view', '/') config.add_view(home_view, route_name='home_view') app = config.make_wsgi_app()
server = make_server('0.0.0.0', 9040, app) server.serve_forever()
from sympy import isprime, nextprime from Crypto.Util.number import inverse
# 已知参数 c = 670610235999012099846283721569059674725712804950807955010725968103642359765806 n = 810544624661213367964996895060815354972889892659483948276203088055391907479553 e = 65537
# 尝试分解n def factor_n(n): p = 2 while p * p <= n: if n % p == 0: return p, n // p p = nextprime(p) return None, None
p, q = factor_n(n) if p is None or q is None: print("无法分解n，解密失败") else: # 计算phi(n) phi_n = (p - 1) * (q - 1) # 计算私钥d d = inverse(e, phi_n) # 解密密文 m = pow(c, d, n) print(f"解密后的明文（十进制）: {m}") print(f"解密后的明文（十六进制）: {hex(m)}") print(f"解密后的明文（ASCII）: {bytes.fromhex(hex(m)[2:]).decode()}")
# 已知参数 c = 670610235999012099846283721569059674725712804950807955010725968103642359765806 n = 810544624661213367964996895060815354972889892659483948276203088055391907479553 e = 65537
emmmmm !好多n啊，一共有307组n,c，找出隐藏的flag！格式样例为e = 65537 =============================== [n_1] n = 104620414822063385079326749509982471870030893600285414264987224935916290272601764523383209465433613538037960991762459760833469310204135961581840403511596166088644211015428546275493892988418626726155859624501730928694822384537353845736516967991087412959351952563730377463899768183476698424362423043497737906623 c = 46039211893589761388229614285558239355119695176816949068907191054207506730440947101388028710988726734999719468830467682553990941948390688315715650976965231516653707125993971747796355564587123089802425266994022342763366946693028597366959030863496254672081216842747104144465753908738135854355761032614829767801
[n_2] n = 136155385285881847647215965185525314111620437662648298206297512719879362719618304990758477078778565820295983050789197481446196249495631490160624235332536575107813683782766081951446123450465630897720159758797590205308439297488584076508093180968162324630134629769513496515404803402321721368832460090329222421827 c = 89662183394841207920629365819797260101947925700835102302177181731227878954957449881945530912024549859105187175733895858270028583699811542603429941425305090712263572930206869292032730915960185806373681528825761306228562959997158901987273897776177362099560025615451752245984242926480186459915665627188585304468总共有[n_60]，写个脚本读取文件算出flag
# 读取文件 def read_file(file_path): try: with open(file_path, 'r') as file: content = file.read() return content except FileNotFoundError: print("错误: 文件未找到!") return None except Exception as e: print(f"错误: 发生了一个未知错误: {e}") return None
# 解析文件内容，提取 n 和 c 的值 def parse_content(content): n_values = [] c_values = [] # 使用正则表达式匹配 n 和 c 的值 pattern_n = r'n = (\d+)' pattern_c = r'c = (\d+)' n_matches = re.findall(pattern_n, content) c_matches = re.findall(pattern_c, content) for n in n_matches: n_values.append(int(n)) for c in c_matches: c_values.append(int(c)) return n_values, c_values
# 这里只是简单打印 n 和 c 的值，需要根据具体的加密方式来找出 flag def find_flag(n_values, c_values): for i in range(len(n_values)): print(f"n_{i + 1}: {n_values[i]}, c_{i + 1}: {c_values[i]}")
if __name__ == "__main__": file_path = 'your_file.txt' # 请将此替换为实际的文件路径 content = read_file(file_path) if content is not None: n_values, c_values = parse_content(content) find_flag(n_values, c_values)
# 解析文件内容，提取 n 和 c 的值 def parse_content(content): n_values = [] c_values = [] # 使用正则表达式匹配 n 和 c 的值 pattern_n = r'n = (\d+)' pattern_c = r'c = (\d+)' n_matches = re.findall(pattern_n, content) c_matches = re.findall(pattern_c, content) for n in n_matches: n_values.append(int(n)) for c in c_matches: c_values.append(int(c)) return n_values, c_values
# 解密函数 def decrypt(c, n, p, q, e=65537): # 计算欧拉函数 φ(n) phi_n = (p - 1) * (q - 1) # 计算私钥指数 d d = inverse(e, phi_n) # 解密操作 m = pow(c, d, n) return m
# 找出 flag def find_flag(n_values, c_values, p, q, e=65537): for i in range(len(n_values)): n = n_values[i] c = c_values[i] try: m = decrypt(c, n, p, q, e) print(f"n_{i + 1} 解密后的明文: {m}") except ValueError: print(f"n_{i + 1} 解密失败，可能是 p、q 或 e 的值不正确。")
if __name__ == "__main__": file_path = 'F:/新建文件夹/challenge.txt' # 请将此替换为实际的文件路径 # 假设已知 p 和 q，需要你根据实际情况替换 p = 123456789 q = 987654321 e = 65537 content = read_file(file_path) if content is not None: n_values, c_values = parse_content(content) find_flag(n_values, c_values, p, q, e) 我的这个代码是豆包给我生成的用来解题emmmmm !好多n啊，一共有307组n,c，找出隐藏的flag！格式样例为e = 65537 =============================== [n_1] n = 104620414822063385079326749509982471870030893600285414264987224935916290272601764523383209465433613538037960991762459760833469310204135961581840403511596166088644211015428546275493892988418626726155859624501730928694822384537353845736516967991087412959351952563730377463899768183476698424362423043497737906623 c = 46039211893589761388229614285558239355119695176816949068907191054207506730440947101388028710988726734999719468830467682553990941948390688315715650976965231516653707125993971747796355564587123089802425266994022342763366946693028597366959030863496254672081216842747104144465753908738135854355761032614829767801
[n_2] n = 136155385285881847647215965185525314111620437662648298206297512719879362719618304990758477078778565820295983050789197481446196249495631490160624235332536575107813683782766081951446123450465630897720159758797590205308439297488584076508093180968162324630134629769513496515404803402321721368832460090329222421827 c = 89662183394841207920629365819797260101947925700835102302177181731227878954957449881945530912024549859105187175733895858270028583699811542603429941425305090712263572930206869292032730915960185806373681528825761306228562959997158901987273897776177362099560025615451752245984242926480186459915665627188585304468总共有[n_60]，写个脚本读取文件算出flag的，但是生成出来的是n_59 解密后的明文: 20403406141493684779901801717171878997304858497859485979484313592481953030493339733131489842226518295886251932867805283859691662073575758407248172704108089349285382406660942221624325709360586923617185039509699171916078747353872811454961022544054103688324911100857275562253013826780700997387407419474907940404 n_60 解密后的明文: 96385388587017577456674072827965196618026914784913692529126216887421535606278409811251440081969515030872219374053357246157555404381960514539228411687241830915628729117859659986287189345785843817450691133148895981104084160080464137716984445706453983758443514755503146411536844794629946520429020859399509140709，我没有找到flag，帮我修改一下，让我获得flag，里面的所有问题交给你解决
# 解析文件内容，提取 n 和 c 的值 def parse_content(content): n_values = [] c_values = [] # 使用正则表达式匹配 n 和 c 的值 pattern_n = r'n = (\d+)' pattern_c = r'c = (\d+)' n_matches = re.findall(pattern_n, content) c_matches = re.findall(pattern_c, content) for n in n_matches: n_values.append(int(n)) for c in c_matches: c_values.append(int(c)) return n_values, c_values
# 动态寻找公共质因数 def find_common_factors(n_values): for i in range(len(n_values)): for j in range(i + 1, len(n_values)): p = gcd(n_values[i], n_values[j]) if p > 1: # 找到公共因数 return i, j, p return None # 如果没有找到公共因数，返回 None
# 解密函数 def decrypt(c, n, p, q, e=65537): phi_n = (p - 1) * (q - 1) # 计算欧拉函数 φ(n) d = inverse(e, phi_n) # 计算私钥指数 d m = pow(c, d, n) # 解密操作 return m
# 读取文件内容 content = read_file(file_path) if content is None: return
# 解析 n 和 c 的值 n_values, c_values = parse_content(content) if not n_values or not c_values: print("错误: 未能解析出有效的 n 和 c 值!") return
# 寻找 n 的公共质因数 common = find_common_factors(n_values) if common is None: print("错误: 未找到任何 n 的公共质因数!") return
i, j, p = common n1, n2 = n_values[i], n_values[j] q1, q2 = n1 // p, n2 // p
# 使用找到的 n 和 c 解密 c = c_values[i] try: m = decrypt(c, n1, p, q1, e) flag = long_to_bytes(m).decode() # 转换为可读字符串 print(f"[+] 找到 Flag: {flag}") except UnicodeDecodeError: print(f"[-] 解密成功但无法解码: {m}（可能需要检查编码格式）") except Exception as e: print(f"[-] 发生错误: {e}")
if __name__ == "__main__": main()
出flag
next is the end
连点器没点出来，给我卡死了，换Linux跑跑试试
脚本如下👇
===== 📝 你只需要改这里：压缩包文件名 =====
ZIP_FILE="next_is_the_end.zip"
===== 🚀 解压流程开始 =====
i=0
while true; do
found_zip=false
# 遍历当前目录及子目录中的 zip 文件
for zip in $(find . -type f -name "*.zip"); do
found_zip=true
unzip -q "$zip" -d . # 解压到当前目录
rm -f "$zip" # 删除原 zip 文件
done
((i++))
echo "第 $i 层已解压完成..."
if ! $found_zip; then
break
fi
done
echo
echo "✅ 所有嵌套 zip 解压完成。以下是最终文件："
find . -type f ! -name "*.zip"
