#!/usr/bin/env python3 import flask import sqlite3 import requests import string import json app = flask.Flask(__name__) blacklist = string.ascii_letters#定义了黑名单变量 blacklist，包含所有的 ASCII 字母（A-Z, a-z）。 defbinary_to_string(binary_string):#将二进制字符串（8-bit格式）转换为普通字符串 iflen(binary_string) % 8 != 0: raise ValueError("Binary string length must be a multiple of 8") binary_chunks = [binary_string[i:i+8] for i inrange(0, len(binary_string), 8)] string_output = ''.join(chr(int(chunk, 2)) for chunk in binary_chunks) return string_output
@app.route('/proxy', methods=['GET']) defnolettersproxy(): url = flask.request.args.get('url') ifnot url: return flask.abort(400, 'No URL provided') target_url = "http://lamentxu.top" + url for i in blacklist: if i in url: return flask.abort(403, 'I blacklist the whole alphabet, hiahiahiahiahiahiahia~~~~~~') if"."in url: return flask.abort(403, 'No ssrf allowed') response = requests.get(target_url)
return flask.Response(response.content, response.status_code) defdb_search(code): with sqlite3.connect('database.db') as conn: cur = conn.cursor() cur.execute(f"SELECT FATE FROM FATETABLE WHERE NAME=UPPER(UPPER(UPPER(UPPER(UPPER(UPPER(UPPER('{code}')))))))") found = cur.fetchone() returnNoneif found isNoneelse found[0]
conn = sqlite3.connect("database.db") conn.execute("""CREATE TABLE FATETABLE ( NAME TEXT NOT NULL, FATE TEXT NOT NULL );""") Fate = [ ('JOHN', '1994-2030 Dead in a car accident'), ('JANE', '1990-2025 Lost in a fire'), ('SARAH', '1982-2017 Fired by a government official'), ('DANIEL', '1978-2013 Murdered by a police officer'), ('LUKE', '1974-2010 Assassinated by a military officer'), ('KAREN', '1970-2006 Fallen from a cliff'), ('BRIAN', '1966-2002 Drowned in a river'), ('ANNA', '1962-1998 Killed by a bomb'), ('JACOB', '1954-1990 Lost in a plane crash'), ('LAMENTXU', r'2024 Send you a flag flag{FAKE}') ] conn.executemany("INSERT INTO FATETABLE VALUES (?, ?)", Fate)
import json defjson_string_to_binary(input_string): binary_output = ''.join(format(ord(char), '08b') for char in input_string) return binary_output
defbinary_to_string(binary_string): # 将二进制字符串（8-bit格式）转换为普通字符串 iflen(binary_string) % 8 != 0: raise ValueError("Binary string length must be a multiple of 8") binary_chunks = [binary_string[i:i + 8] for i inrange(0, len(binary_string), 8)] string_output = ''.join(chr(int(chunk, 2)) for chunk in binary_chunks) return string_output
if __name__ == '__main__': a = '''{"name":{")))))))":"123"}}''' string = json_string_to_binary(a) print(string) try: req = binary_to_string(string) print(req) req = json.loads(req) # No one can hack it, right? Pickle unserialize is not secure, but json is ;) except: print(400, "Invalid JSON") name = req['name'] iflen(name) > 6: print(400, "Too long") if'\''in name: print(400, "NO '") if')'in name: print(400, "NO )")
import json defjson_string_to_binary(input_string): binary_output = ''.join(format(ord(char), '08b') for char in input_string) return binary_output
defbinary_to_string(binary_string): # 将二进制字符串（8-bit格式）转换为普通字符串 iflen(binary_string) % 8 != 0: raise ValueError("Binary string length must be a multiple of 8") binary_chunks = [binary_string[i:i + 8] for i inrange(0, len(binary_string), 8)] string_output = ''.join(chr(int(chunk, 2)) for chunk in binary_chunks) return string_output
if __name__ == '__main__': #select fate from fatetable where name=upper(upper(upper(upper(upper(upper(upper('{code}'))))))) a = '''{"name":{"))))))) union select FATETABLE where name=\"LAMENTXU\"--+":"123"}}''' string = json_string_to_binary(a) print(string) try: req = binary_to_string(string) req = json.loads(req)# No one can hack it, right? Pickle unserialize is not secure, but json is ;) print(req) except: print(400, "Invalid JSON") name = req['name'] iflen(name) > 6: print(400, "Too long") if'\''in name: print(400, "NO '") if')'in name: print(400, "NO )")
defget_cookie(self, key, default=None, secret=None, digestmod=hashlib.sha256): """ Return the content of a cookie. To read a `Signed Cookie`, the `secret` must match the one used to create the cookie (see :meth:`Response.set_cookie <BaseResponse.set_cookie>`). If anything goes wrong (missing cookie or wrong signature), return a default value. """ value = self.cookies.get(key) if secret: # See BaseResponse.set_cookie for details on signed cookies. if value and value.startswith('!') and'?'in value: sig, msg = map(tob, value[1:].split('?', 1)) hash = hmac.new(tob(secret), msg, digestmod=digestmod).digest() if _lscmp(sig, base64.b64encode(hash)): dst = pickle.loads(base64.b64decode(msg)) if dst and dst[0] == key: return dst[1] return default return value or default
# -*- encoding: utf-8 -*- ''' @File : main.py @Time : 2025/03/28 22:20:49 @Author : LamentXU ''' ''' flag in /flag_{uuid4} ''' from bottle import Bottle, request, response, redirect, static_file, run, route withopen('../../secret.txt', 'r') as f: secret = f.read()
app = Bottle() @route('/') defindex(): return'''HI''' @route('/download') defdownload(): name = request.query.filename if'../../'in name or name.startswith('/') or name.startswith('../') or'\\'in name: response.status = 403 return'Forbidden' withopen(name, 'rb') as f: data = f.read() return data
@route('/secret') defsecret_page(): try: session = request.get_cookie("name", secret=secret) ifnot session or session["name"] == "guest": session = {"name": "guest"} response.set_cookie("name", session, secret=secret) return'Forbidden!' if session["name"] == "admin": return'The secret has been deleted!' except: return"Error!" run(host='0.0.0.0', port=8080, debug=False)
# YOU FOUND ME ;) # -*- encoding: utf-8 -*- ''' @File : src.py @Time : 2025/03/29 01:10:37 @Author : LamentXU ''' import flask import sys enable_hook = False counter = 0 defaudit_checker(event,args): global counter if enable_hook: if event in ["exec", "compile"]: counter += 1 if counter > 4: raise RuntimeError(event)
lock_within = [ "debug", "form", "args", "values", "headers", "json", "stream", "environ", "files", "method", "cookies", "application", 'data', 'url' ,'\'', '"', "getattr", "_", "{{", "}}", "[", "]", "\\", "/","self", "lipsum", "cycler", "joiner", "namespace", "init", "dir", "join", "decode", "batch", "first", "last" , " ","dict","list","g.", "os", "subprocess", "g|a", "GLOBALS", "lower", "upper", "BUILTINS", "select", "WHOAMI", "path", "os", "popen", "cat", "nl", "app", "setattr", "translate", "sort", "base64", "encode", "\\u", "pop", "referer", "The closer you see, the lesser you find."] # I hate all these. app = flask.Flask(__name__) @app.route('/') defindex(): return'try /H3dden_route' @app.route('/H3dden_route') defr3al_ins1de_th0ught(): global enable_hook, counter name = flask.request.args.get('My_ins1de_w0r1d') if name: try: if name.startswith("Follow-your-heart-"): for i in lock_within: if i in name: return'NOPE.' enable_hook = True a = flask.render_template_string('{#'+f'{name}'+'#}') enable_hook = False counter = 0 return a else: return'My inside world is always hidden.' except RuntimeError as e: counter = 0 return'NO.' except Exception as e: return'Error' else: return'Welcome to Hidden_route!'
if __name__ == '__main__': import os try: import _posixsubprocess del _posixsubprocess.fork_exec except: pass import subprocess del os.popen del os.system del subprocess.Popen del subprocess.call del subprocess.run del subprocess.check_output del subprocess.getoutput del subprocess.check_call del subprocess.getstatusoutput del subprocess.PIPE del subprocess.STDOUT del subprocess.CalledProcessError del subprocess.TimeoutExpired del subprocess.SubprocessError sys.addaudithook(audit_checker) app.run(debug=False, host='0.0.0.0', port=5000)
