UNIQUE_CHAR = set()

with open("flag/flag.txt", "r", encoding="utf8") as f:
    flag = f.read().strip()
    
for char in flag:
    UNIQUE_CHAR.add(char)

print("Unique characters in the flag:", UNIQUE_CHAR)

UNIQUE_CHAR = set()

with open("flag/flag.txt", "r", encoding="utf8") as f:
    flag = f.read().strip()
    
for char in flag:
    UNIQUE_CHAR.add(char)

print("Unique characters in the flag:", UNIQUE_CHAR)

MAPPING = {
    "\u200b": 0,
    "\u200c": 1,
}

for char in flag:
    if char not in MAPPING: continue
    print(MAPPING[char], end="")

from tqdm import tqdm

carrige_mark = True
data = []
tmp = ""

with open("behinder.txt") as f:
    with open("behinder-output.txt", "w") as output:
        for line in tqdm(f.readlines()):
            if carrige_mark and not line.startswith("\n"):  # 开始读入数据
                carrige_mark = False
                tmp += line.strip()
            elif not carrige_mark and line.startswith("\n"):  # 结束读入数据
                carrige_mark = True
                if tmp:
                    data.append(bytes.fromhex("".join(tmp)))
                tmp = ""
            elif not carrige_mark and not line.startswith("\n"):  # 继续读入数据
                tmp += line.strip()
        output.write("\n".join([x.decode() for x in data]))

import base64
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad, pad

cipher = AES.new(b'1f2c8075acd3d118', AES.MODE_ECB)
count = 1

data = []


with open("behinder-output.txt") as f:
    for line in f:
        if (not line.startswith("\n")
            and not line.startswith("POST")
            and not line.startswith("Accept")
            and not line.startswith("Referer")
            and not line.startswith("User-Agent")
            and not line.startswith("Content")
            and not line.startswith("Host")
            and not line.startswith("Connection")
            and not line.startswith("Cookie")):
                try:
                    data = line.strip()
                    raw = base64.b64decode(data)
                    dec = cipher.decrypt(raw)
                    with open(f"bout/traffic{count}.class", "wb") as out:
                        out.write(dec)
                    count += 1
                except Exception as e:
                    print("Error processing line:", line[:100])
                    print(e)
            
with open("plaindata.txt", "w") as out:
    out.write("\n".join(data))

with open("plaindata.txt") as f:
    for line in f:
        with open(f"bout/traffic{count}.class", "wb") as out:
            try:
                data = line.strip()
                raw = base64.b64decode(data)
                dec = cipher.decrypt(raw)
                out.write(dec)
                count += 1
            except Exception as e:
                print("Error processing line:", line[:100])
                print(e)

import base64
from Crypto.Cipher import AES

AES_MODE = AES.MODE_GCM

key = base64.b64decode("IhbJfHI98nuSvs5JweD5qsNvSQ/HHcE/SNLyEBU9Phs=")
iv = key[:16]

raw = """1f000000
33740a2c22b1e703d2f1480b321f3e4cdc8eb50da84ca0a76543b6bbadf60a
24000000
5c8a2365d717d71114b7be5599d5cfff553f2f0b2251505c3f5ada10a77be1bf35852f9c
1e000000
e3ee79aaf91b813d407e18095278046d32c10567fe57d60459d32f6df234
1f000000
bd345efc1465b04f38a410a09ed999e9849a570c27dd75e8d6b8aac5a4f22f
30000000
be53ef2dc360548f22bd7145f4e1733ffeb228db69b28e76ccb65ea9d8e33a709cfae6579a795f4045dbc2f6300cd871
2b000000
2b7991ad1cfcb2c0b334f5ee5cfb1be844f232c5062190e5e7bfb2208ef40aec6cff1aa7df01285fd3a92a
6e000000
8ac33897541bf959bb223309ffa07a25c49245bb988404180f84d7baef2c2ca8dfd669d39d3fa9c9e66b3da81834c7121cad53ffb16b38dcb062b2b3ce1b634f3bac9ed6e161661efb67ab754eb078718c484cb1b9ec873a103035fdc0b28ed418aa11e68b561599b9685ae54b95
69000000
5fb656ee12487f33e75202b3bec1a6728977618d6b221fb887fa90d36cb5ff75949c1ae90608e22fc81a12fb2e576dd2df4330fcbf619b19455dcfe6c9ae2a8e730cf9010dcc3a15f04bec1fa70b051792d4e197cee0f075405b366472711d1d94f5bb349348bf05d5
24000000
410d930f46d9e71c2200eb1fc4ec9986fd2d72ab2c35aa85fe66fa664a3729e3e9a906b6
1f000000
7ccb9636b4b330000914519540b5a3b0bacb6f594c3b03ff582d62084c1af4"""

data = [bytes.fromhex(_) for _ in raw.split("\n")]
for _ in data:
    print(len(_))

for _ in data:
    if len(_) == 4:  # 认为是指令
        continue
    nonce = _[:12]
    tag = _[-16:]
    ciphertext = _[12:-16]
    cipher = AES.new(key, AES_MODE, nonce)
    result = cipher.decrypt_and_verify(ciphertext, tag)
    print(result.decode())

# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: 'Payload_To_PixelCode_video.py'
# Bytecode version: 3.7.0 (3394)
# Source timestamp: 2026-01-04 04:02:18 UTC (1767499338)

from PIL import Image
import math
import os
import sys
import numpy as np
import imageio
from tqdm import tqdm
def file_to_video(input_file, width=640, height=480, pixel_size=8, fps=10, output_file='video.mp4'):
    if not os.path.isfile(input_file):
        return None
    file_size = os.path.getsize(input_file)
    binary_string = ''
    with open(input_file, 'rb') as f:
        for chunk in tqdm(iterable=iter(lambda: f.read(1024), b''), total=math.ceil(file_size / 1024), unit='KB', desc='读取文件'):
            binary_string += ''.join((f'{byte:08b}' for byte in chunk))
    xor_key = '10101010'    # 异或密钥
    xor_binary_string = ''
    for i in range(0, len(binary_string), 8):
        chunk = binary_string[i:i + 8]  # 每8位为一个像素点
        if len(chunk) == 8:
            chunk_int = int(chunk, 2)   # 转为整数
            key_int = int(xor_key, 2)   # 转为整数
            xor_result = chunk_int ^ key_int    # 进行异或运算
            xor_binary_string += f'{xor_result:08b}'    # 转为二进制字符串并拼接
        else:
            xor_binary_string += chunk
    binary_string = xor_binary_string
    pixels_per_image = width // pixel_size * (height // pixel_size)     # 每一帧的大小
    num_images = math.ceil(len(binary_string) / pixels_per_image)   # 计算需要多少帧来存储所有数据
    frames = []
    for i in tqdm(range(num_images), desc='生成视频帧'):
        start = i * pixels_per_image
        bits = binary_string[start:start + pixels_per_image]
        if len(bits) < pixels_per_image:
            bits = bits + '0' * (pixels_per_image - len(bits))
        img = Image.new('RGB', (width, height), color='white')
        for r in range(height // pixel_size):
            row_start = r * (width // pixel_size)
            row_end = (r + 1) * (width // pixel_size)
            row = bits[row_start:row_end]
            for c, bit in enumerate(row):
                color = (0, 0, 0) if bit == '1' else (255, 255, 255)
                x1, y1 = (c * pixel_size, r * pixel_size)
                img.paste(color, (x1, y1, x1 + pixel_size, y1 + pixel_size))
        frames.append(np.array(img))
    with imageio.get_writer(output_file, fps=fps, codec='libx264') as writer:
        for frame in tqdm(frames, desc='写入视频帧'):
            writer.append_data(frame)
if __name__ == '__main__':
    input_path = 'payload'
    if os.path.exists(input_path):
        file_to_video(input_path)
    else:
        sys.exit(1)

import numpy as np
import imageio


def recover_file(
    video_path: str,
    output_path: str,
    width: int = 640,
    height: int = 480,
    pixel_size: int = 8,
):
    cols = width // pixel_size
    rows = height // pixel_size
    bits_per_frame = cols * rows

    video_processor = imageio.get_reader(video_path)

    metadata = video_processor.get_meta_data()
    frames_per_second = metadata.get("fps", 0)
    total_frames = (
        int(metadata.get("duration", 0) * frames_per_second)
        if frames_per_second > 0
        else None
    )
    print(
        f"Video information：{width}x{height}, {pixel_size}px/block, with {bits_per_frame} bit. Estimated {total_frames} frames."
    )

    bits_collected = []

    for frame in video_processor:  # type: ignore
        if frame.shape[0] != height or frame.shape[1] != width:
            return False

        for r in range(rows):
            for c in range(cols):
                y1 = r * pixel_size  # Block's top-left corner
                y2 = (r + 1) * pixel_size  # Block's bottom-right corner
                x1 = c * pixel_size  # Block's top-left corner
                x2 = (c + 1) * pixel_size  # Block's bottom-right corner
                block = frame[y1:y2, x1:x2]  # Extract the block
                avg_color = np.mean(block)
                bit = "1" if avg_color < 128 else "0"
                bits_collected.append(bit)

    full_bits = "".join(bits_collected)

    xor_key = 0xAA  # 0b10101010
    data = bytearray()
    for i in range(0, len(full_bits), 8):
        byte_str = full_bits[i : i + 8]
        if len(byte_str) < 8:
            break
        byte_val = int(byte_str, 2)
        decrypted = byte_val ^ xor_key
        data.append(decrypted)

    with open(output_path, "wb") as f:
        f.write(data)
    return True


if __name__ == "__main__":
    video = "video.mp4"
    output = "output.bin"
    if recover_file(video, output):
        print("[+] Successfully recovered the file.")
    else:
        print("[-] Failed to recover the file.")

import hashlib
from string import printable

HASH_MAP = {}

def get_hash_map():
    global HASH_MAP
    if not HASH_MAP:
        for i in printable:
            HASH_MAP[hashlib.md5(i.encode()).hexdigest()] = i

def get_flag():
    with open("hash.txt", "r") as f:
        for line in f:
            hash_value = line.split(";")[1].strip().replace('"', "")
            if hash_value in HASH_MAP:
                print(HASH_MAP[hash_value], end='')
            else:
                print(f"Hash {hash_value} not found in HASH_MAP", end='')
                
            
if __name__ == "__main__":
    get_hash_map()
    get_flag()

import json
import pymysql

# 数据库连接配置
db_config = {
    "host": "",
    "port": 4000,
    "user": "",
    "password": "",
    "database": "waline",
    "ssl_verify_cert": True,
    "ssl_verify_identity": True,
    "ssl_ca": ""
}

def parse_date(val):
    if not val:
        return None
    if isinstance(val, dict):
        if val.get('__type') == 'Date':
            val = val.get('iso')
        elif '$date' in val:
            val = val.get('$date')
    if not isinstance(val, str):
        return None
    return val.replace('T', ' ').replace('Z', '')[:19]

def migrate():
    conn = pymysql.connect(**db_config)
    cursor = conn.cursor()

    # 映射表
    email_to_userid = {"admin@bili33.top": 2} 
    old_cid_to_new_cid = {}

    try:
        # --- 第一步：迁移用户 ---
        print("正在同步用户数据...")
        with open('_User.0.jsonl', 'r', encoding='utf-8') as f:
            for line in f:
                if line.startswith('#') or not line.strip():
                    continue
                user = json.loads(line)
                email = user.get('email')
                
                if email and email not in email_to_userid:
                    # 检查数据库是否已存在该邮箱（防止重复运行脚本）
                    cursor.execute("SELECT id FROM wl_Users WHERE email = %s", (email,))
                    row = cursor.fetchone()
                    if row:
                        email_to_userid[email] = row[0]
                    else:
                        sql = "INSERT INTO wl_Users (display_name, email, password, type, createdAt, updatedAt) VALUES (%s, %s, %s, %s, %s, %s)"
                        cursor.execute(sql, (user.get('username'), email, '', 'guest', parse_date(user.get('createdAt')), parse_date(user.get('updatedAt'))))
                        email_to_userid[email] = cursor.lastrowid
        conn.commit()

        print("正在插入评论数据...")
        with open('Comment.0.jsonl', 'r', encoding='utf-8') as f: # 确保文件名正确
            for line in f:
                if line.startswith('#') or not line.strip():
                    continue
                
                cmt = json.loads(line)
                mail = cmt.get('mail')
                
                # 状态逻辑：处理 isSpam
                status = 'approved'
                if cmt.get('isSpam') is True:
                    status = 'spam'

                # 关联用户 ID
                user_id = None
                if cmt.get('nick') == 'GamerNoTitle' or mail == 'admin@bili33.top':
                    user_id = 2
                elif mail in email_to_userid:
                    user_id = email_to_userid[mail]

                sql = """INSERT INTO wl_Comment 
                         (user_id, comment, insertedAt, ip, link, mail, nick, ua, url, createdAt, updatedAt, status) 
                         VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)"""
                
                cursor.execute(sql, (
                    user_id,
                    cmt.get('comment'),
                    parse_date(cmt.get('insertedAt')),
                    cmt.get('ip'),
                    cmt.get('link'),
                    mail,
                    cmt.get('nick'),
                    cmt.get('ua'),
                    cmt.get('url'),
                    parse_date(cmt.get('createdAt')),
                    parse_date(cmt.get('updatedAt')),
                    status
                ))
                
                new_id = cursor.lastrowid
                old_id = cmt.get('objectId')
                old_cid_to_new_cid[old_id] = new_id

        conn.commit()

        print("正在修复 PID/RID 关系...")
        with open('Comment.0.jsonl', 'r', encoding='utf-8') as f:
            for line in f:
                if line.startswith('#') or not line.strip():
                    continue
                
                cmt = json.loads(line)
                old_id = cmt.get('objectId')
                old_pid = cmt.get('pid')
                old_rid = cmt.get('rid')

                new_id = old_cid_to_new_cid.get(old_id)
                new_pid = old_cid_to_new_cid.get(old_pid) if old_pid else None
                new_rid = old_cid_to_new_cid.get(old_rid) if old_rid else None

                if new_pid or new_rid:
                    cursor.execute("UPDATE wl_Comment SET pid = %s, rid = %s WHERE id = %s", (new_pid, new_rid, new_id))
        
        conn.commit()
        print("✅ 迁移成功！垃圾评论已标记为 spam。")

    except Exception as e:
        conn.rollback()
        print(f"❌ 错误: {e}")
    finally:
        cursor.close()
        conn.close()

if __name__ == "__main__":
    migrate()

from importlib.util import MAGIC_NUMBER
print(MAGIC_NUMBER)

# b'\xcb\r\r\n'

import base64
import sys
from pwn import remote, context
from zipfile import ZipFile
from hashlib import md5

# 计算 0 - 11 点的图片的 md5
hashmap = {}
for _ in range(12):
    with open(f"preset/{_}.png", "rb") as f:
        data = f.read()
        h = md5(data).hexdigest()
        hashmap[h] = _

context.log_level = "debug"
io = remote("192.168.18.31", 24001)

TIPSIG = b'):\n'

intro = io.recvline()
data = io.recvline()
carriage = io.recvline()
tip = io.recvline()
print(tip)
result = TIPSIG

while TIPSIG in result:
    zipstream = base64.b64decode(data)
    with open("tmp.zip", "wb") as f:
        f.write(zipstream)

    with ZipFile("tmp.zip", "r") as zip_ref:
        zip_ref.extractall(".")
        
    with open("0.png", "rb") as f:
        imgdata = f.read()
        h = md5(imgdata).hexdigest()
        if h in hashmap:
            hour = hashmap[h]
            minute = hour * 5
        else:
            hour, minute = 0, 0

    print(f"Send line: {hour}:{minute:02d}")

    # 发送结果
    io.sendline(f"{hour}:{minute:02d}".encode())
    result = io.recvuntil(TIPSIG)

print(result.decode())
io.interactive()

import base64
import io
import sys
from pwn import remote, context
from zipfile import ZipFile
from hashlib import md5

context.log_level = "debug"

hashmap = {}
print("[*] Loading presets...")
try:
    for _ in range(12):
        with open(f"preset/{_}.png", "rb") as f:
            data = f.read()
            h = md5(data).hexdigest()
            hashmap[h] = _
    print(f"[+] Loaded {len(hashmap)} presets.")
except Exception as e:
    print(f"[-] Error loading presets: {e}")
    sys.exit(1)

try:
    p = remote("192.168.18.31", 24001)
except:
    print("[-] Connection failed")
    sys.exit(1)

PROMPT = b'): ' 

for i in range(12):
    print(f"\n========== Round {i+1} / 12 ==========")

    try:
        raw_data = p.recvuntil(PROMPT)
    except EOFError:
        print("[-] Server disconnected prematurely.")
        break

    lines = raw_data.strip().split(b'\n')
    b64_data = b""
    for line in lines:
        if len(line) > 100:
            b64_data = line.strip()
            break
            
    if not b64_data:
        print("[-] Base64 data not found.")
        break

    target_idx = 0
    try:
        zip_bytes = base64.b64decode(b64_data)
        
        with ZipFile(io.BytesIO(zip_bytes), "r") as z:
            img_data = z.read("0.png")
            
        img_hash = md5(img_data).hexdigest()
        
        if img_hash in hashmap:
            target_idx = hashmap[img_hash]
            print(f"[+] Match! Index: {target_idx} (Hash: {img_hash[:6]}...)")
        else:
            print(f"[-] No match for hash: {img_hash[:6]}...")
            
    except Exception as e:
        print(f"[-] Error processing image: {e}")
        break

    payload = str(target_idx)
    
    print(f"[>] Sending: {payload}")
    p.sendline(payload.encode())

try:
    output = p.clean(timeout=0.1)
    print(output.decode(errors='ignore'))
except:
    pass

print("\n[+] Rounds finished. Getting shell...")
payload = b"/bin/sh"
print(f"[>] Sending payload: {payload}")
p.sendline(payload)

print("\n[+] Exfiltrating using socat...")
try:
    p.clean()
except:
    pass

cmd = b'socat -u FILE:"Bandizip(flag).zip" STDOUT'
print(f"[>] Sending: {cmd}")
p.sendline(cmd)

print("[*] Downloading raw data...")
try:
    p.recvline()
    
    data = p.recvall(timeout=5)
    
    with open("flag.zip", "wb") as f:
        f.write(data)
    
    print(f"[+] Download complete! Size: {len(data)} bytes")
    print("[*] Try to unzip flag.zip now.")

except Exception as e:
    print(f"[-] Error: {e}")
p.interactive()
p.close()