├── 0cms_server ├── utils │ ├── __init__.py │ └── function.py ├── action │ ├── __init__.py │ ├── rss.py │ ├── upload.py │ ├── flag.py │ ├── admin.py │ ├── comment.py │ ├── install.py │ ├── cms.py │ ├── index.py │ └── base.py ├── model │ ├── db │ │ ├── __init__.py │ │ ├── database.py │ │ └── sqlite.py │ ├── __init__.py │ ├── flag.py │ ├── cms.py │ ├── comment.py │ └── base.py ├── restart.sh ├── templates │ ├── admin │ │ ├── footer.htm │ │ ├── index.htm │ │ ├── login.htm │ │ ├── uploadFile.htm │ │ ├── rss.htm │ │ ├── header.htm │ │ ├── commentList.htm │ │ ├── cmsList.htm │ │ ├── error.htm │ │ ├── copyText.htm │ │ ├── success.htm │ │ ├── cmsAdd.htm │ │ └── cmsEdit.htm │ └── default │ │ ├── footer.htm │ │ ├── show.htm │ │ ├── error.htm │ │ ├── success.htm │ │ ├── index.htm │ │ ├── comments.htm │ │ └── header.htm ├── data │ ├── 0ctf.db │ └── public.pem ├── static │ ├── admin │ │ ├── copy.swf │ │ ├── mainnavbg.gif │ │ ├── sub_arrow.gif │ │ ├── editor │ │ │ ├── icons.png │ │ │ ├── resize.gif │ │ │ ├── header-bg.gif │ │ │ ├── style.css │ │ │ └── tinyeditor.js │ │ └── common.css │ └── default │ │ ├── 404.png │ │ ├── bg.png │ │ ├── rss.png │ │ ├── favicon.ico │ │ ├── mainbg.jpg │ │ ├── search.png │ │ ├── default_user.jpg │ │ ├── search_hover.png │ │ ├── comment-reply.min.js │ │ ├── html5.js │ │ ├── bin.js │ │ └── style.css ├── settings.py └── app.py ├── 0cms_checker ├── private.pem ├── 0cms_normal_check.py └── 0cms_full_check.py └── README.md /0cms_server/utils/__init__.py: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /0cms_server/action/__init__.py: -------------------------------------------------------------------------------- 1 | __author__ = 'md5_salt' 2 | -------------------------------------------------------------------------------- /0cms_server/model/db/__init__.py: -------------------------------------------------------------------------------- 1 | __author__ = 'md5_salt' -------------------------------------------------------------------------------- /0cms_server/restart.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | find . -name "*.pyc" | xargs rm -f 3 | python app.py 4 | -------------------------------------------------------------------------------- /0cms_server/templates/admin/footer.htm: -------------------------------------------------------------------------------- 1 |
2 | 3 | -------------------------------------------------------------------------------- /0cms_server/data/0ctf.db: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/data/0ctf.db -------------------------------------------------------------------------------- /0cms_server/static/admin/copy.swf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/admin/copy.swf -------------------------------------------------------------------------------- /0cms_server/static/default/404.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/default/404.png -------------------------------------------------------------------------------- /0cms_server/static/default/bg.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/default/bg.png -------------------------------------------------------------------------------- /0cms_server/static/default/rss.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/default/rss.png -------------------------------------------------------------------------------- /0cms_server/static/admin/mainnavbg.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/admin/mainnavbg.gif -------------------------------------------------------------------------------- /0cms_server/static/admin/sub_arrow.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/admin/sub_arrow.gif -------------------------------------------------------------------------------- /0cms_server/static/default/favicon.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/default/favicon.ico -------------------------------------------------------------------------------- /0cms_server/static/default/mainbg.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/default/mainbg.jpg -------------------------------------------------------------------------------- /0cms_server/static/default/search.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/default/search.png -------------------------------------------------------------------------------- /0cms_server/static/admin/editor/icons.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/admin/editor/icons.png -------------------------------------------------------------------------------- /0cms_server/model/__init__.py: -------------------------------------------------------------------------------- 1 | __author__ = 'md5_salt' 2 | from cms import * 3 | from base import * 4 | from comment import * 5 | from flag import * -------------------------------------------------------------------------------- /0cms_server/static/admin/editor/resize.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/admin/editor/resize.gif -------------------------------------------------------------------------------- /0cms_server/static/default/default_user.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/default/default_user.jpg -------------------------------------------------------------------------------- /0cms_server/static/default/search_hover.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/default/search_hover.png -------------------------------------------------------------------------------- /0cms_server/static/admin/editor/header-bg.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/5alt/0CTF2015Final0cms/master/0cms_server/static/admin/editor/header-bg.gif -------------------------------------------------------------------------------- /0cms_server/templates/default/footer.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | 3 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /0cms_server/model/flag.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | #!/usr/bin/env python 3 | import web, time 4 | import settings 5 | from model.base import base as BaseModel 6 | from utils.function import * 7 | @singleton 8 | class flag(BaseModel): 9 | def __init__(self): 10 | pass -------------------------------------------------------------------------------- /0cms_server/utils/function.py: -------------------------------------------------------------------------------- 1 | def singleton(className): 2 | def wrapped(): 3 | it = className.__dict__.get('__it__') 4 | if it is not None: 5 | return it 6 | 7 | className.__it__=className() 8 | return className.__it__ 9 | return wrapped -------------------------------------------------------------------------------- /0cms_server/data/public.pem: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PUBLIC KEY----- 2 | MIGJAoGBAIDvfXgMHxgyRDb+1f8PKlru63FVE/K0wUZnrvpbUd8mnGiJWHkhgO2q 3 | jMDA0dy30mvup9JMs89y0Tylx9EOVGF92Tcs120h7OH0C/OJe/ru4lUYMy/8jusb 4 | n/P5ZUSe/3/4NUFY+0Z/uYamNDA4u8Bq0dIKLRlOy0/+9d79dID1AgMBAAE= 5 | -----END RSA PUBLIC KEY----- 6 | -------------------------------------------------------------------------------- /0cms_server/model/cms.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | #!/usr/bin/env python 3 | import web, time 4 | 5 | import settings 6 | from model.base import base as BaseModel 7 | from utils.function import * 8 | @singleton 9 | class cms(BaseModel): 10 | def __init__(self): 11 | pass -------------------------------------------------------------------------------- /0cms_server/model/comment.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | #!/usr/bin/env python 3 | import web, time 4 | import settings 5 | from model.base import base as BaseModel 6 | from utils.function import * 7 | @singleton 8 | class comment(BaseModel): 9 | def __init__(self): 10 | pass -------------------------------------------------------------------------------- /0cms_server/templates/admin/index.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | $:tplData['render'].header() 3 | Welcome
4 | IP:$:tplData['info']['clientIp']
5 | Server IP:$:tplData['info']['serverIp']
6 | UA:$:tplData['info']['ua']
7 | Time:$:tplData['info']['date']
8 | $:tplData['render'].footer() -------------------------------------------------------------------------------- /0cms_server/action/rss.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | #coding=utf-8 3 | import web,time,settings 4 | from action.base import base as baseAction 5 | import model 6 | class rss(baseAction): 7 | def __init__(self): 8 | baseAction.__init__(self) 9 | settings = self.getSettings() 10 | self.assignTplDir(settings.ADMIN_TPL_DIR) 11 | def index(self): 12 | cmsList = model.cms().getList('*',{},'id desc') 13 | self.assign('cmsList',cmsList) 14 | return self.display('rss') -------------------------------------------------------------------------------- /0cms_server/templates/admin/login.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | 3 | 4 | 5 | Login 6 | 7 | 8 | 9 | 10 | 11 |
12 | 账号：
13 | 密码：
14 | 15 |
16 | 17 | -------------------------------------------------------------------------------- /0cms_server/templates/default/show.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | $:tplData['render'].header(tplData) 3 | 4 |
5 |
6 | 7 |

$:tplData['atl']['name']

8 | $:tplData['atl']['createTime'] 9 | $:tplData['atl']['content'] 10 | 11 | view:$:tplData['atl']['views'] 12 |
13 | 14 | $:tplData['render'].comments(tplData) 15 |
16 | $:tplData['render'].footer(tplData) -------------------------------------------------------------------------------- /0cms_server/templates/admin/uploadFile.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | 3 | 4 | 5 | 6 | upload 7 | 8 | 9 |
10 | 11 | 12 |
13 | 14 | -------------------------------------------------------------------------------- /0cms_server/templates/default/error.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | $:tplData['render'].header(tplData) 3 |
4 | $:tplData['jump']['msg'] (jump after $:tplData['jump']['timeout'] seconds）
5 | 6 | 19 | $:tplData['render'].footer(tplData) -------------------------------------------------------------------------------- /0cms_server/templates/default/success.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | $:tplData['render'].header(tplData) 3 |
4 | $:tplData['jump']['msg'] (jump after $:tplData['jump']['timeout']seconds）
5 | 6 | 19 | $:tplData['render'].footer(tplData) -------------------------------------------------------------------------------- /0cms_server/templates/admin/rss.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | 3 | 4 | 5 | $:tplData['webTitle'] 6 | $:tplData['webUrl'] 7 | $:tplData['webDescription'] 8 | $for i in tplData['cmsList']: 9 | 10 | $:i['name'] 11 | 12 | 13 | 14 | $:i['createTime'] 15 | $makeUrl('index','show',{'id':i['id']}) 16 | 17 | 18 | -------------------------------------------------------------------------------- /0cms_server/static/default/comment-reply.min.js: -------------------------------------------------------------------------------- 1 | addComment={moveForm:function(d,f,i,c){var m=this,a,h=m.I(d),b=m.I(i),l=m.I("cancel-comment-reply-link"),j=m.I("comment_parent"),k=m.I("comment_post_ID");if(!h||!b||!l||!j){return}m.respondId=i;c=c||false;if(!m.I("wp-temp-form-div")){a=document.createElement("div");a.id="wp-temp-form-div";a.style.display="none";b.parentNode.insertBefore(a,b)}h.parentNode.insertBefore(b,h.nextSibling);if(k&&c){k.value=c}j.value=f;l.style.display="";l.onclick=function(){var n=addComment,e=n.I("wp-temp-form-div"),o=n.I(n.respondId);if(!e||!o){return}n.I("comment_parent").value="0";e.parentNode.insertBefore(o,e);e.parentNode.removeChild(e);this.style.display="none";this.onclick=null;return false};try{m.I("comment").focus()}catch(g){}return false},I:function(a){return document.getElementById(a)}}; 2 | -------------------------------------------------------------------------------- /0cms_server/templates/admin/header.htm: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Manage 6 | 7 | 8 | 9 |
10 | -------------------------------------------------------------------------------- /0cms_server/model/base.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | #!/usr/bin/env python 3 | #coding=utf-8 4 | from model.db.database import * 5 | class base: 6 | def getTable(self): 7 | return self.__class__.__name__ 8 | 9 | def getDb(self): 10 | return database() 11 | 12 | def insert(self,data): 13 | return self.getDb().insert(self.getTable(),data) 14 | 15 | def delete(self,condition): 16 | return self.getDb().delete(self.getTable(), condition) 17 | 18 | def getList(self,colums,condition,orders='',limits=''): 19 | return self.getDb().getList(self.getTable(),colums,condition,orders,limits) 20 | 21 | def getOne(self,colums,condition,orders='',limits=''): 22 | return self.getDb().getOne(self.getTable(),colums,condition,orders,limits) 23 | 24 | def update(self, data,condition): 25 | return self.getDb().update(self.getTable(),data,condition) 26 | -------------------------------------------------------------------------------- /0cms_server/templates/default/index.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | $:tplData['render'].header(tplData) 3 |
4 | 13 | 16 |
17 | 18 | $:tplData['render'].footer(tplData) -------------------------------------------------------------------------------- /0cms_checker/private.pem: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | MIICYAIBAAKBgQCA7314DB8YMkQ2/tX/Dypa7utxVRPytMFGZ676W1HfJpxoiVh5 3 | IYDtqozAwNHct9Jr7qfSTLPPctE8pcfRDlRhfdk3LNdtIezh9AvziXv67uJVGDMv 4 | /I7rG5/z+WVEnv9/+DVBWPtGf7mGpjQwOLvAatHSCi0ZTstP/vXe/XSA9QIDAQAB 5 | AoGAesgVWmFopvkPPrPUg0wk0G1ephEXqvN4bhxEY8Lcpz00itPn/YnrJehYmyHD 6 | d4VRi1i8VaaXQICdQjy4Df87e5Z3UTj/Y9Tir51Hue5w7f7dK16Y6H570ZPzwszU 7 | ZW94GOJ94vHagb+qwv+rDxbFuM3nP9HMTdQMg1V6ZU3ZuCECRQCRjmdN0Ix7L2pN 8 | vH1K/IBwAkNIa1boLnnTdKo9JnC7mJr0NAZacPGo9+47oJkPs8Wjy8KKCtvPVQ7D 9 | cV4WYC/vhQl4XQI9AOLElexWO9/N6aYcjgZFNgDSUDIGrAt+OVty8/K98WUzbj20 10 | rzBm9KvYZiT8fUYBGGClNC+i8Ub682dBeQJEaOmQUgkASIXLhE5YrKTE2nb3Egq0 11 | MFPXYW9UiRDc7oo3Hc8lyShhNp3Fa9r8l9HGoaHrDV54Qr+XDY339/7KbkSgp80C 12 | PQCuBz4jZL6IcCcqoulf6IecM8r1yWcJXvI3u0158ckq6EBnPJ3h4HFO3EDvi5G8 13 | QqTprn8RO9Q8q+RWTskCRBIEohqPwrP/O1pH109MYdQQRCHQvIhPLc8GWl/rXZrY 14 | EGWhwU9HNhfKdZmLSWUdaV5+EaZAE7Wmj1d1vCQqATG3y0wB 15 | -----END RSA PRIVATE KEY----- 16 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # 0CTF2015Final_0cms 2 | 3 | This program is used for 0CTF 2015 Final named 0cms. 4 | Use this only for code auditing practice and avoid being accessed by other people. 5 | 6 | ## installation 7 | 8 | ``` 9 | sudo pip install rsa 10 | sudo pip install web.py 11 | ``` 12 | 13 | ## ussage 14 | 15 | If you are using ubuntu, just run: 16 | 17 | `sh restart.sh` 18 | 19 | For mac or other platform, you need to modify `settings.py` and set `WEB_URL` based on your own ip address instead of using `get_local_ip()` function. 20 | 21 | For cheker, you need to modify `0cms_full_check.py` and set variable `flag` base your own flag.(I just use an api to get real flag.) 22 | 23 | ## acknowledgement 24 | 25 | 0cms is based on `webpyCMS0.1` 26 | https://github.com/taogogo/webpyCMS 27 | 28 | Thanks taogogo for developing such good blog management system! 29 | 30 | ## contact 31 | 32 | http://5alt.me 33 | 34 | md5_salt [AT] qq.com 35 | 36 | Hope you enjoy this! :) 37 | -------------------------------------------------------------------------------- /0cms_server/templates/admin/commentList.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | $:tplData['render'].header() 3 |

Manage Comments

4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | $for i in tplData['commentList']: 15 | 16 | 17 | 18 | 19 | 20 | 21 |
IDNameContentIPEmailPostManage
$:i['id'] $:i['name']$:i['content']$:i['ip']$:i['email']$:i['atl']['name']delete
22 | 25 | $:tplData['render'].footer() -------------------------------------------------------------------------------- /0cms_server/settings.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | #coding=utf-8 3 | import os 4 | 5 | def get_local_ip(ifname): 6 | import socket, fcntl, struct 7 | s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) 8 | inet = fcntl.ioctl(s.fileno(), 0x8915, struct.pack('256s', ifname[:15])) 9 | ret = socket.inet_ntoa(inet[20:24]) 10 | return ret 11 | 12 | WEB_URL='http://'+get_local_ip('eth0')+':8080/' 13 | WEB_TITLE='0CMS' 14 | WEB_DESCRIPTION='0CMS Written By md5_salt' 15 | TEMPLATE_THEME='default' 16 | PER_PAGE_COUNT = 10 17 | 18 | ADMIN_USERNAME = 'admin' 19 | ADMIN_PASSWORD='salt' 20 | 21 | DEFAULT_PATH='/index/index' 22 | DEBUG_SWITCH=True 23 | STATUS_LIST = {1:'publish',0:'private'} 24 | 25 | ROOT_PATH=os.getcwd()+'/' 26 | DATA_DIR_PATH=ROOT_PATH+'data/' 27 | TMP_DIR_PATH=ROOT_PATH+'data/cache/' 28 | 29 | UPLOAD_DIR='uploads/' 30 | TPL_DIR = 'templates' 31 | ADMIN_TPL_DIR='admin' 32 | 33 | #cannot change 34 | DB_TYPE='sqlite' 35 | DB_STRING=DATA_DIR_PATH+'0ctf.db' 36 | 37 | PUB_KEY=DATA_DIR_PATH+'public.pem' 38 | -------------------------------------------------------------------------------- /0cms_server/action/upload.py: -------------------------------------------------------------------------------- 1 | # -*- coding: utf-8 -*- 2 | #!/usr/bin/env python 3 | #coding=utf-8 4 | import web,time 5 | from action.base import base as baseAction 6 | import model 7 | class upload(baseAction): 8 | def __init__(self): 9 | baseAction.__init__(self) 10 | if self.isLogin() != True: 11 | raise web.seeother('/') 12 | settings = self.getSettings() 13 | self.assignTplDir(settings.ADMIN_TPL_DIR) 14 | def index(self): 15 | return self.display('uploadFile') 16 | def upload(self): 17 | inputParams = web.input(uploadFile={}) 18 | settings = self.getSettings() 19 | filedir = settings.ROOT_PATH+settings.UPLOAD_DIR 20 | if 'uploadFile' in inputParams: 21 | fout = open(filedir +'/'+ inputParams.uploadFile.filename,'w') 22 | fout.write(inputParams.uploadFile.file.read()) 23 | fout.close() 24 | self.assign('text',settings.WEB_URL+settings.UPLOAD_DIR+inputParams.uploadFile.filename) 25 | return self.display('copyText') -------------------------------------------------------------------------------- /0cms_server/templates/admin/cmsList.htm: -------------------------------------------------------------------------------- 1 | $def with (tplData) 2 | $:tplData['render'].header() 3 |

Manage Posts Add

4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | $for i in tplData['cmsList']: 13 | 14 | 15 | 21 | 22 |
IDTitleStatusOrderManage
$:i['id'] $:i['name']$:tplData['statusList'][i['status']]$:i['orders'] 16 | View 17 | | 18 | Edit 19 | | Delete 20 |
23 |