lbr77

出题碎碎念：

嗯...题面没有骗人。

首先就是确实那天App1e_Tree打穿了全场。

然后空虚和寂寞嘛...这个大家可以去问问他（？。

确实也是在天津街头闲逛的时候拍到的东西。

lbr77

出题碎碎念：

想法来自群友的调侃：那是不是搞一个sqlmap risk3 level5然后抓包就能出题了？

嗯于是这道题出题时候的参数就是：python sqlmap.py -u "http://localhost:8080/login?usr=LiBr&pwd=11d188aa7daf1c0ef4744d33888fd0da" --risk 3 --level 5 --thread 8 --dump -T table（

出题人wp：

导出所有有用包之用python处理可以看到有效信息：

lbr77

想必做到这一步的你应该看得出来504b是什么东西了吧？

有没有想起comment里说的密码是什么？

lbr77

{
    "log": {
        "loglevel":"debug"
    },
    "inbounds": [
        {
            "protocol": "dokodemo-door",
            "port": 50005,
            "settings": {
              "address": "172.20.0.2",

lbr77

PyMd5 from https://github.com/Utkarsh87/md5-hashing/blob/master/md5.py

Usage:

from hash_ext_exp import HashExtensionExploit
import hashlib
key = b"test"
old_msg = b"1234555"
old_hash = hashlib.md5(key+old_msg).hexdigest()
nhash,nmsg = HashExtensionExploit(old_msg,old_hash,len(key),b"1234").run();

lbr77

import base64 as b64


def bintotext(ress, count=7):
    res = ""
    for i in range(0, len(ress), count):
        res += chr(int(ress[i : i + count], 2))
    return res

lbr77

git config --global https.proxy http://127.0.0.1:1080

git config --global https.proxy https://127.0.0.1:1080

git config --global --unset http.proxy

git config --global --unset https.proxy


npm config delete proxy

lbr77

#!/usr/bin/env bash

# Description: Install docker-aarch64 for ds120j
# System Required: Synology
# Author: lbr77
# some scrpts from github.com/P3TERX

#
# MIT License
#

lbr77

addEventListener("fetch", (event) => {
  event.respondWith(
    handleRequest(event)
  );
});
async function handleRequest(event){
  const url = new URL(event.request.url);
  const method = event.request.method;
  if(method === "GET"){
      let record = await JSON.parse(await KV.get("RECORD"))

lbr77

addEventListener("fetch", event => {
  event.respondWith(handleRequest(event))
})

const BUCKET_NAME = "lbr77/CDN@main"
const BUCKET_URL = `http://cdn.jsdelivr.net/gh/${BUCKET_NAME}`

async function serveAsset(event) {
  const url = new URL(event.request.url)
  const cache = caches.default