。
' Message box Script
Set objArgs = WScript.Arguments
For I = 0 to objArgs.Count - 1
msgbox objArgs(I)
Next
1195 找到 SSConstrainer，layoutpos=top -> layoutpos=none 主窗体广告消失。 1192 adbannercont, layout=FillLayout() -> layoutpos=none 聊天窗口动画广告还在，关掉动画后的文字广告已经不在了 找到 adbannerregiontrident，删除 layout=FillLayout()
getTrace());
}
function callback() {
call_user_func('test');
}
try {
callback();
} catch (Exception $e) {
var_dump($e->getTrace());
}
?>
G:\wwwroot\Test\Exception>php trace_func.php
#0 test() called at [G:\wwwroot\Test\Exception\trace_func.php:8]
array(1) {
[0]=>
array(4) {
["file"]=>
string(40) "G:\wwwroot\Test\Exception\trace_func.php"
["line"]=>
int(8)
["function"]=>
string(4) "test"
["args"]=>
array(0) {
}
}
}
#0 test()
#1 call_user_func(test) called at [G:\wwwroot\Test\Exception\trace_func.php:14]
#2 callback() called at [G:\wwwroot\Test\Exception\trace_func.php:18]
array(3) {
[0]=>
array(2) {
["function"]=>
string(4) "test"
["args"]=>
array(0) {
}
}
[1]=>
array(4) {
["file"]=>
string(40) "G:\wwwroot\Test\Exception\trace_func.php"
["line"]=>
int(14)
["function"]=>
string(14) "call_user_func"
["args"]=>
array(1) {
[0]=>
string(4) "test"
}
}
[2]=>
array(4) {
["file"]=>
string(40) "G:\wwwroot\Test\Exception\trace_func.php"
["line"]=>
int(18)
["function"]=>
string(8) "callback"
["args"]=>
array(0) {
}
}
}
Similar result given by debug_print_backtrace(), is this a bug or an unexpected feature ? XD
<?php
$values[0] = $info[0];
foreach ($info[1] as $k=>$v) {
$fields[] = "`{$k}`=?";
$values[] = & $v;
}
<?php
$array = array(
1,2,3,4,5
);
$to0 = array();
foreach ($array as $k=>$v) {
$to0[$k] = & $v;
}
var_dump($to0);
$to1 = array();
foreach ($array as $k=>$v) {
$to1[$k] = & $v;
unset($v);
}
var_dump($to1);
$to2 = array();
foreach ($array as $k=>&$v) {
$to2[$k] = & $v;
}
var_dump($to2);
/*
Output:
G:\wwwroot\Test>php reference3.php
array(5) {
[0]=>
&int(5)
[1]=>
&int(5)
[2]=>
&int(5)
[3]=>
&int(5)
[4]=>
&int(5)
}
array(5) {
[0]=>
&int(1)
[1]=>
int(2)
[2]=>
int(3)
[3]=>
int(4)
[4]=>
int(5)
}
array(5) {
[0]=>
&int(1)
[1]=>
&int(2)
[2]=>
&int(3)
[3]=>
&int(4)
[4]=>
&int(5)
}
*/
<?php
$values[0] = $info[0];
foreach ($info[1] as $k=>&$v) {
$fields[] = "`{$k}`=?";
$values[] = & $v;
}
unset($info);
$stmt = $db->prepare($query);
$ret = $stmt->execute($values);
array(5) {
[0]=>
&int(1)
[1]=>
&int(2)
[2]=>
&int(3)
[3]=>
&int(4)
[4]=>
&int(5)
}
而在execute()的时候，却变成了array(5) {
[0]=>
int(1)
[1]=>
int(2)
[2]=>
int(3)
[3]=>
int(4)
[4]=>
&int(5)
}
Aircrack-ng 1.1 r1738
[00:00:07] Tested 108182 keys (got 20290 IVs)
KB depth byte(vote)
0 1/ 33 13(25648) 4F(25392) 43(25280) 25(24912) D0(24836) 47(24800) AE(24696) 76(24544)
1 0/ 11 57(27220) C4(26432) F8(26416) E3(25616) FB(24620) F6(24588) 04(24472) AC(24292)
2 0/ 1 92(29236) B8(25916) 84(25172) 8D(25092) 4E(24980) E6(24684) B1(24476) 41(23960)
3 6/ 33 46(24548) 7C(24512) A6(24364) 72(24216) EA(24152) 14(23968) 27(23884) 64(23448)
4 8/ 10 08(24404) C2(24332) 1E(24284) 11(24256) A7(24176) 30(24108) FC(24072) 02(23888)
KEY FOUND! [ 13:57:92:46:80 ]
Decrypted correctly: 100%
Bypass the image captcha Bypass the image captcha This level is about OCR. Write a program which is able to read all the characters in a given image, and let it beat a captcha automatically. Difficulty rating: harder Take this challenge!
ssh: leviathan.intruded.net port: 10101 username: level1 password: leviathan
level1: leviathan level2: ******** level3: ******** level4: ******** level5: ******** level6: ******** level7: ******** level8: ********----------------------------------
cat .backup/bookmarks.html | grep --color pass <DT><A HREF="http://nahtaivel.intruded.net/passwordus.html" TEMP: "AFeSdWEf"ADD_DATE="1155384634" LAST_CHARSET="ISO-8859-1" ID="rdf:#$2wIU71">password to level2</A>直接访问
level2@leviathan:/wargame$ ./check password: sex secret god love sh-3.1$ id uid=1001(level2) gid=1001(level2) euid=1002(level3) groups=1001(level2)********
level3@leviathan:/wargame$ ln -s /home/level4/.passwd /tmp/file.log level3@leviathan:/wargame$ ./prog ********这个纯粹是猜出来的
int __cdecl do_stuff()
{
int v1; // [sp+11Dh] [bp-Bh]@1
int v2; // [sp+121h] [bp-7h]@1
__int16 v3; // [sp+125h] [bp-3h]@1
char v4; // [sp+127h] [bp-1h]@1
char v5; // [sp+1Dh] [bp-10Bh]@1
v1 = dword_8048737;
v2 = dword_804873B;
v3 = word_804873F;
v4 = byte_8048741;
fgets(&v5, 256, (FILE *)stdin);
if ( strcmp(&v5, (const char *)&v1) )
{
puts("bzzzzzzzzap. WRONG");
}
else
{
puts("[You've got shell]!");
seteuid(0x3ECu);
system("/bin/sh");
}
return 0;
}
.rodata:08048737 dword_8048737 dd 706C6E73h ; DATA XREF: do_stuff+9 r .rodata:0804873B dword_804873B dd 746E6972h ; DATA XREF: do_stuff+11 r .rodata:0804873F word_804873F dw 0A66h ; DATA XREF: do_stuff+19 rmysql出场了
mysql> select 0x706C6E73;
+------------+
| 0x706C6E73 |
+------------+
| plns |
+------------+
1 row in set (0.00 sec)
mysql> select 0x746E6972;
+------------+
| 0x746E6972 |
+------------+
| tnir |
+------------+
1 row in set (0.00 sec)
mysql> select 0x66;
+------+
| 0x66 |
+------+
| f |
+------+
1 row in set (0.00 sec)
mysql> select reverse('ftnirplns');
+----------------------+
| reverse('ftnirplns') |
+----------------------+
| snlprintf |
+----------------------+
1 row in set (0.00 sec)
密码是 ********int __cdecl main(char a1)
{
int result; // eax@2
FILE *v2; // eax@1
int r; // [sp+40h] [bp+0h]@1
int v4; // [sp+3Ch] [bp-4h]@1
char *v5; // [sp+30h] [bp-10h]@1
FILE *v6; // [sp+20h] [bp-20h]@1
unsigned int v7; // [sp+24h] [bp-1Ch]@3
char v8; // [sp+2Fh] [bp-11h]@4
signed int v9; // [sp+28h] [bp-18h]@4
char *v10; // [sp+18h] [bp-28h]@11
v4 = r;
v5 = &a1;
v2 = fopen("/home/level6/.passwd", (const char *)&unk_80485E8);
v6 = v2;
if ( v2 )
{
fgets(buf, 256, v6);
v7 = 0;
while ( 1 )
{
v10 = buf;
if ( v7 >= strlen(buf) - 1 )
break;
v8 = buf[v7];
v9 = 0;
while ( v9 <= 7 )
{
if ( v8 >= 0 )
putchar(48);
else
putchar(49);
v8 *= 2;
++v9;
}
putchar(32);
++v7;
}
result = putchar(10);
}
else
{
result = -1;
}
return result;
}
执行的结果是00110110 01101100 01111001 01110110 01001100 01011000 01000011 01000001 00001010
#include#include int main(char a1) { char *buf = "01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; int i=0; int t=0; char c; int j=0; for (; i<strlen(buf); i++, j++) { c = buf[i]; printf("%c : ", c); t = 0; while ( t <= 7 ) { if ( c >= 0) { putchar('0'); } else { putchar('1'); } c *= 2; t++; } if (j%4 == 3) { printf(" \n"); } else { printf(" \t"); } } }
/* 0 : 00110000 1 : 00110001 2 : 00110010 3 : 00110011 4 : 00110100 5 : 00110101 6 : 00110110 7 : 00110111 8 : 00111000 9 : 00111001 0 : 00110000 a : 01100001 b : 01100010 c : 01100011 d : 01100100 e : 01100101 f : 01100110 g : 01100111 h : 01101000 i : 01101001 j : 01101010 k : 01101011 l : 01101100 m : 01101101 n : 01101110 o : 01101111 p : 01110000 q : 01110001 r : 01110010 s : 01110011 t : 01110100 u : 01110101 v : 01110110 w : 01110111 x : 01111000 y : 01111001 z : 01111010 A : 01000001 B : 01000010 C : 01000011 D : 01000100 E : 01000101 F : 01000110 G : 01000111 H : 01001000 I : 01001001 J : 01001010 K : 01001011 L : 01001100 M : 01001101 N : 01001110 O : 01001111 P : 01010000 Q : 01010001 R : 01010010 S : 01010011 T : 01010100 U : 01010101 V : 01010110 W : 01010111 X : 01011000 Y : 01011001 Z : 01011010 */查表
00110110 01101100 01111001 01110110 01001100 01011000 01000011 01000001 00001010 ********----------------------------------
signed int __cdecl main(char a1)
{
int r; // [sp+230h] [bp+0h]@1
int v3; // [sp+22Ch] [bp-4h]@1
char *v4; // [sp+224h] [bp-Ch]@1
char *v5; // [sp+18h] [bp-218h]@1
int v7; // [sp+24h] [bp-20Ch]@5
int v8; // [sp+1Ch] [bp-214h]@6
v3 = r;
v4 = &a1;
v5 = &a1;
if ( a1 <= 1 )
{
puts("*** File Printer ***");
printf("Usage: %s filename\n", **((_DWORD **)v5 + 1));
return -1;
}
if ( access(*(const char **)(*((_DWORD *)v5 + 1) + 4), 0) )
{
puts("You cant have that file...");
return 1;
}
snprintf((char *)&v7, 0x1FFu, "/bin/cat %s", *(_DWORD *)(*((_DWORD *)v5 + 1) + 4));
system((const char *)&v7);
return v8;
}
/var/tmp下有几个symlink，但是直接读还是不行。看了看命令的构造，很显然，需要从文件名上动手。level6@leviathan:/var/tmp$ /wargame/printfile ./\|cat\ /home/level7/.passwd /bin/cat: ./: Is a directory ********
level7@leviathan:/wargame$ ./sphinx usage: ./sphinx <4 digit code> level7@leviathan:/wargame$ ./sphinx 1111 Wrong第一眼，想写个代码遍历 - -|||
int __cdecl main(char a1)
{
int result; // eax@5
int r; // [sp+30h] [bp+0h]@1
int v3; // [sp+2Ch] [bp-4h]@1
char *v4; // [sp+24h] [bp-Ch]@1
char *v5; // [sp+10h] [bp-20h]@1
int v6; // [sp+20h] [bp-10h]@1
v3 = r;
v4 = &a1;
v5 = &a1;
v6 = 7123;
if ( a1 != 2 )
{
printf("usage: %s<4 digit code>\n", **((_DWORD **)v5 + 1));
exit(-1);
}
if ( atoi(*(const char **)(*((_DWORD *)v5 + 1) + 4)) == v6 )
{
seteuid(0x3EFu);
result = system("/bin/sh");
}
else
{
result = puts("Wrong");
}
return result;
}
level7@leviathan:/$ /wargame/sphinx 7123 sh-3.1$ id uid=1006(level7) gid=1006(level7) euid=1007(level8) groups=1006(level7)脑残了，居然不相信7123是密码
level8@leviathan:~$ cat CONGRATULATIONS Well Done, you seem to have used *nix system before, now try something more serious. Your completion string is "Unix is easy!!!".
Creates a symbolic link.
MKLINK [[/D] | [/H] | [/J]] Link Target
/D Creates a directory symbolic link. Default is a file
symbolic link.
/H Creates a hard link instead of a symbolic link.
/J Creates a Directory Junction.
Link specifies the new symbolic link name.
Target specifies the path (relative or absolute) that the new link
refers to.
mklink /J Cache z:\Chrome\Cache
SET RAMDISKDRV=Z:
SET CHROME_CACHE_DIR="%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Cache"
SET CHROME_RAMDISK_DIR="%RAMDISKDRV%\Chrome\Cache"
rd /s /q %CHROME_CACHE_DIR%
mkdir %CHROME_RAMDISK_DIR%
mklink /J %CHROME_CACHE_DIR% %CHROME_RAMDISK_DIR%
#!/bin/sh export AUTOSSH_PATH=`which plink` `which autossh` -M 5122 -N -R 12345:127.0.0.1:22 -pw blahblah root@10.***.***.*** 2>&1 >/dev/null &
chattr +i /root/bin/plinkssh.sh/etc/rc.local:
/bin/sh /root/bin/plinkssh.sh
./configure --with-libevent-prefix=/usr/local/libevent --with-memcached --disable-64bit CFLAGS="-O3 -march=i686"
CCLD clients/memslap clients/ms_conn.o(.text+0x24b): In function `ms_conn_close': clients/ms_conn.c:685: undefined reference to `__sync_fetch_and_sub' clients/ms_conn.o(.text+0xc8e): In function `ms_setup_conn': clients/ms_conn.c:380: undefined reference to `__sync_fetch_and_add' clients/ms_conn.o(.text+0x11af): In function `ms_reconn_socks': clients/ms_conn.c:1051: undefined reference to `__sync_fetch_and_add' clients/ms_conn.o(.text+0x1351): In function `ms_verify_value': clients/ms_conn.c:1808: undefined reference to `__sync_fetch_and_add' clients/ms_conn.o(.text+0x13f8):clients/ms_conn.c:1767: undefined reference to `__sync_fetch_and_add' clients/ms_conn.o(.text+0x17f4): In function `ms_build_udp_headers': clients/ms_conn.c:194: undefined reference to `__sync_fetch_and_add' clients/ms_conn.o(.text+0x1d46):clients/ms_conn.c:919: more undefined references to `__sync_fetch_and_add' follow collect2: ld returned 1 exit status make[2]: *** [clients/memslap] Error 1 make[2]: Leaving directory `/data2/space/libmemcached-0.38' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/data2/space/libmemcached-0.38' make: *** [all] Error 2
autoconf aclocal.m4:20: warning: this file was generated for autoconf 2.63. You have another version of autoconf. It may work, but is not guaranteed to. If you have problems, you may need to regenerate the build system entirely. To do so, use the procedure documented by the package, typically `autoreconf'. configure.ac:16: error: Autoconf version 2.62 or higher is required aclocal.m4:530: AM_INIT_AUTOMAKE is expanded from... m4/pandora_canonical.m4:246: PANDORA_CANONICAL_TARGET is expanded from... configure.ac:16: the top level autom4te: /usr/bin/m4 failed with exit status: 63
include clients/include.am include tests/include.am include example/include.am include support/include.am
<?php
$array = array('1', '2', '3<? 1+1', '4>111?');
var_dump($array);
0> /data4/space/bin/php test.php
array(4) {
[0]=>
string(1) "1"
[1]=>
string(1) "2"
[2]=>
string(7) "3<? 1+1"
[3]=>
string(6) "4>111?"
}
array(4) {
[0]=>
string(1) "1"
[1]=>
string(1) "2"
[2]=>
string(7) "3111?"
}
<?php
class spdLibMemcached {
private $mc;
public function __construct($persistent_id=null) {
$this->mc = new Memcached($persistent_id);
}
public function addServer($host, $port, $weight=null) {
return $this->mc->addServer($host, $port, $weight);
}
public function getServerList() {
return $this->mc->getServerList();
}
}
$a = new memcached;
$b = new memcached;
$a->addServer('10.1.0.55', 22201);
$b->addServer('10.1.3.52', 11211);
$c = new spdlibmemcached;
$d = new spdlibmemcached;
$c->addServer('10.1.0.55', 22201);
$d->addServer('10.1.3.52', 11211);
var_dump(
$a->getServerList(),
$b->getServerList(),
$c->getServerList(),
$d->getServerList()
);
<?php
class spdLibMemcached {
private $mc;
public function __construct($persistent_id=null) {
if ($persistent_id === null) {
$this->mc = new Memcached;
} else {
$this->mc = new Memcached($persistent_id);
}
}
}