frankli0324

<template>
    <DatePicker
        class="date-range" ref="picker"
        v-model="date" required
        range auto-apply close-on-scroll
        time-picker-inline hide-input-icon
        text-input :text-input-options="{ openMenu: false}"
        @focus="picker?.openMenu()"
        :clearable="false"
        :close-on-auto-apply="false"

frankli0324

<template>
    <div class="terminal">
        <div>$ Rankings</div>
        {{ border }}
        <br />
        {{ header.replaceAll(" ", "&nbsp;") }}
        <br />
        {{ border }}
        <br />
        <template v-for="(line, idx) in raw_data.items" :key="idx">

frankli0324

# pip3 install pwntools-tube-websocket
from pwn import *
from wstube import websocket

a = websocket('wss://echo.websocket.events')
print(a.recv())
for i in range(3):
    a.send(b'test')
    print(a.recv(2))
    print(a.recv(2))

frankli0324

from phpserialize import serialize
from requests import session

from phply import phplex
from phply.phpast import *
from phply.phpparse import make_parser

ses = session()
classes = {}
func2class = {}

frankli0324

from requests import session
import base64
import json
from collections import OrderedDict
from multiprocessing import Pool

ses = session()
token = '阿巴阿巴阿巴'

frankli0324

scripts behind d3ctf_shellgen

frankli0324

requirements

• single include file from https://github.com/nlohmann/json
• PHP source code
• python3.8
• g++ --std=c++11

php function prototypes?

http://www.hackingwithphp.com/4/2/0/how-to-read-function-prototypes

frankli0324

#!/sbin/openrc-run

# If you want to run separate master process per pool, then create a symlink
# to this runscript for each pool. In that mode, the php-fpm daemon is started
# as nobody by default. You can override the user (and group) by declaring
# variable "user" and optionally "group" in conf.d file, or in the $fpm_config
# file (the former has precedence).

: ${name:="PHP FastCGI Process Manager"}

frankli0324

from base64 import b64encode, b64decode
from hashlib import md5
from phpserialize import namespace, serialize
from requests import session

ses = session()

'''
Arbitrary file write on think php 5.0.24
implemented by Frank

frankli0324

import hmac
import json
from base64 import b64encode, b64decode

from Crypto import Random
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from phpserialize import *
from requests import session