kubectl get namespaces -A
kubectl get pods -A
kubectl get services -A

kubectl describe pods nfs-client-provisioner-79cc77f98-87xts -n nfs-storageclass

kubectl apply -f mysql-c.yaml
kubectl apply -f mysql-d.yaml
kubectl apply -f mysql57-pvc.yaml
kubectl apply -f mysql80-pvc.yaml
kubectl apply -f mysql-services.yaml

kubectl describe pods nfs-client-provisioner-79cc77f98-87xts -n nfs-storageclass
kubectl describe pods redis-8b84f48-5pdqx
kubectl describe pods captcha-bot-6b4d85b765-25xq6

kubectl apply -f mysql-c.yaml
kubectl apply -f mysql-d.yaml
kubectl apply -f mysql57-pvc.yaml
kubectl apply -f mysql80-pvc.yaml
kubectl apply -f mysql-services.yaml

kubectl create token dashboard-admin -n kube-system

tar -xvf dujiaoka.tar
ls
mv dujiaoka /data/k8s_data/default
cd /data/k8s_data/default

[root@master ~]# docker save -o php-nginx.tar webdevops/php-nginx:7.4
[root@master ~]# scp php-nginx.tar node1:/tmp
[root@master ~]# scp php-nginx.tar node2:/tmp
[root@node1 ~]# cd /tmp;docker load -i php-nginx.tar
[root@node2 ~]# cd /tmp;docker load -i php-nginx.tar

grep "Installed:" /var/log/yum.log | grep docker-ce

SELECT count(*) FROM captchabot.user_captcha_record AS ucr 
WHERE captcha_status = 1 AND captcha_success_time >= '2025-06-01 00:00:00';

mysqlbinlog --no-defaults -vv --base64-output=DECODE-ROWS G:\电子取证题目\2025数证杯初赛\03-服务器取证\binlog.000001> G:\电子取证题目\2025数证杯初赛\03-服务器取证\demo1.sql
mysqlbinlog --no-defaults -vv --base64-output=DECODE-ROWS G:\电子取证题目\2025数证杯初赛\03-服务器取证\binlog.000002> G:\电子取证题目\2025数证杯初赛\03-服务器取证\demo2.sql

SELECT SUM(actual_price) 
FROM `orders` 
WHERE `status` = 4 
  AND updated_at >= '2025-06-01 00:00:00'
  AND deleted_at IS NULL;

function getSalt()
{
    $a = 'sdahjklhl212jkljass';
    $b = hash('sha256', $a, true); // 计算SHA256哈希（原始二进制数据）
    $c = substr($b, 0, 16); // 取前16字节作为密钥
    $d = base64_decode('xPfGJQaE1zE5d+8='); // Base64解码固定字符串
    $e = '';
    for ($i = 0; $i < strlen($d); $i++) { // 遍历$d的每个字符
        $e .= chr(ord($d[$i]) ^ ord($c[$i])); // 异或操作，结果追加到$e
    }
    return $e; // 返回盐值
}

<?php
 function getSalt()
 {
     $a = 'sdahjklhl212jkljass';
     $b = hash('sha256', $a, true);
     $c = substr($b, 0, 16);
     $d = base64_decode('xPfGJQaE1zE5d+8=');
     $e = '';
     for ($i = 0; $i < strlen($d); $i++) {
         $e .= chr(ord($d[$i]) ^ ord($c[$i]));
     }
     return $e;
 }

 echo base64_encode(getSalt());

?>

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import hashlib
import hmac
import binascii
from pbkdf2 import PBKDF2

class WPA2HandshakeAnalyzer:
    def __init__(self):
        # 从抓包数据中提取的信息
        self.anonce = "36c219dc3afe12534ad501628c9a99528fb24c06f7e9dc7f0166f19d74c9d74f"
        self.snonce = "151eba384e0fe7bd0dfbba66844d00f99609909a9bf6b529f63f1c62959f59bc"
        self.mic = "74637af2b87fce31425365282c08cc4c"
        self.eapol_frame = "dd180050f20101000050f20401000050f20401000050f2020c00"
        # 需要填写的网络信息
        self.ssid = ""  # 在这里填写 SSID
        self.password = ""  # 在这里填写明文密码
        # MAC 地址信息（需要从完整抓包中获取）
        self.ap_mac = ""  # AP 的 MAC 地址
        self.sta_mac = ""  # 客户端的 MAC 地址
    
    def prf(self, key, label, data, length):
        """伪随机函数 PRF-X"""
        result = b''
        counter = 0
        while len(result) < length:
            hmac_input = label + b'\x00' + data + bytes([counter])
            result += hmac.new(key, hmac_input, hashlib.sha1).digest()
            counter += 1
        return result[:length]
    
    def generate_pmk(self, ssid, password):
        """生成 PMK (Pairwise Master Key)"""
        return PBKDF2(password, ssid, 4096).read(32)
    
    def generate_ptk(self, pmk, anonce, snonce, ap_mac, sta_mac):
        """生成 PTK (Pairwise Transient Key)"""
        # 创建 PRF 输入数据
        label = b"Pairwise key expansion"
        # MAC 地址按字典序排序
        if ap_mac < sta_mac:
            mac_data = binascii.unhexlify(ap_mac.replace(':', '')) + \
                      binascii.unhexlify(sta_mac.replace(':', ''))
        else:
            mac_data = binascii.unhexlify(sta_mac.replace(':', '')) + \
                      binascii.unhexlify(ap_mac.replace(':', ''))
        # Nonce 按字典序排序
        if anonce < snonce:
            nonce_data = binascii.unhexlify(anonce) + binascii.unhexlify(snonce)
        else:
            nonce_data = binascii.unhexlify(snonce) + binascii.unhexlify(anonce)
        prf_input = mac_data + nonce_data
        # 生成 64 字节的 PTK
        ptk = self.prf(pmk, label, prf_input, 64)
        return {
            'kck': ptk[:16],  # Key Confirmation Key
            'kek': ptk[16:32],  # Key Encryption Key
            'tk': ptk[32:48],  # Temporal Key
            'mic_key': ptk[48:64] if len(ptk) > 48 else ptk[:16]
        }
    
    def calculate_mic(self, kck, eapol_data):
        """计算 EAPOL 帧的 MIC"""
        # 将 MIC 字段置零后计算
        eapol_bytes = binascii.unhexlify(eapol_data)
        # 构造完整的 EAPOL 帧（简化版本）
        eapol_frame = bytearray([
            0x01,  # Version
            0x03,  # Type (Key)
            0x00, 0x79,  # Length (121)
            0xfe,  # Key Descriptor Type
            0x01, 0x0a,  # Key Information
            0x00, 0x10,  # Key Length
            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,  # Replay Counter
        ])
        # 添加 SNonce
        eapol_frame.extend(binascii.unhexlify(self.snonce))
        # 添加 Key IV (16 字节零)
        eapol_frame.extend(b'\x00' * 16)
        # 添加 Key RSC (8 字节零)
        eapol_frame.extend(b'\x00' * 8)
        # 添加 Key ID (8 字节零)
        eapol_frame.extend(b'\x00' * 8)
        # 添加 MIC 位置（16 字节零，稍后会被替换）
        mic_offset = len(eapol_frame)
        eapol_frame.extend(b'\x00' * 16)
        # 添加 Key Data Length
        eapol_frame.extend(b'\x00\x1a')  # 26 字节
        # 添加 Key Data
        eapol_frame.extend(binascii.unhexlify(self.eapol_frame))
        # 计算 MIC
        calculated_mic = hmac.new(kck, eapol_frame, hashlib.sha1).digest()[:16]
        return calculated_mic.hex()
    
    def verify_handshake(self):
        """验证握手过程"""
        if not all([self.ssid, self.password, self.ap_mac, self.sta_mac]):
            print("错误：请填写完整的网络信息（SSID、密码、MAC 地址）")
            return False
        
        print("=== WPA2 握手验证 ===")
        print(f"SSID: {self.ssid}")
        print(f"密码: {self.password}")
        print()
        
        # 步骤 1：生成 PMK
        pmk = self.generate_pmk(self.ssid.encode(), self.password)
        print(f"PMK: {pmk.hex()}")
        
        # 步骤 2：生成 PTK
        ptk = self.generate_ptk(pmk, self.anonce, self.snonce, self.ap_mac, self.sta_mac)
        print(f"KCK: {ptk['kck'].hex()}")
        print(f"KEK: {ptk['kek'].hex()}")
        print(f"TK: {ptk['tk'].hex()}")
        print()
        
        # 步骤 3：验证 MIC
        calculated_mic = self.calculate_mic(ptk['kck'], self.eapol_frame)
        print(f"抓包中的 MIC: {self.mic}")
        print(f"计算出的 MIC: {calculated_mic}")
        
        # 验证结果
        if calculated_mic.lower() == self.mic.lower():
            print("\n✓ MIC 验证成功！密码正确。")
            return True
        else:
            print("\n✗ MIC 验证失败！密码可能错误。")
            return False
    
    def test_passwords(self, password_list):
        """批量测试密码"""
        print("=== 批量密码测试 ===")
        for password in password_list:
            self.password = password
            print(f"测试密码: {password}")
            if self.verify_handshake():
                print(f"\n 找到正确密码: {password}")
                return password
            print("-" * 40)
        print("未找到正确密码")
        return None

def main():
    # 创建分析器实例
    analyzer = WPA2HandshakeAnalyzer()
    
    # 设置网络信息（请根据实际情况填写）
    analyzer.ssid = "laozhaoWIFI"  # 替换为实际SSID
    analyzer.ap_mac = "ca:75:f4:65:f9:6a"  # 替换为AP的MAC地址
    analyzer.sta_mac = "8e:39:bd:31:2e:1d"  # 替换为客户端的MAC地址
    
    # 批量密码测试示例
    test_passwords = [
        "password1110",
        "12345678", 
        "admin123",
        "您的 WiFi 密码",  # 在这里添加更多要测试的密码
    ]
    
    # 运行密码测试
    analyzer.test_passwords(test_passwords)

if __name__ == "__main__":
    # 需要安装依赖：pip install pbkdf2
    try:
        main()
    except ImportError:
        print("请先安装依赖包：pip install pbkdf2")

// =============== 脚本开始 ===============
console.log("[*] Frida 脚本已加载，正在等待目标类加载...");

// 存储捕获到的值
let capturedValues = {
    encryptedPath: null,
    apkHash: null,
    appVer: null,
    timestamp: null
};

// 简化日志函数
function log(msg) {
    console.log(`[+] ${msg}`);
}

function error(msg) {
    console.error(`[!] ${msg}`);
}

// 通用函数：等待类加载
function waitForClass(className, callback, timeout = 30000) {
    const startTime = Date.now();
    
    const interval = setInterval(() => {
        try {
            const clazz = Java.use(className);
            clearInterval(interval);
            log(`✅ 类 ${className} 已加载`);
            callback(clazz);
        } catch (e) {
            if (Date.now() - startTime > timeout) {
                clearInterval(interval);
                error(`❌ 等待类 ${className} 超时 (${timeout}ms)`);
            }
        }
    }, 100);
}

// 生成并打印最终 URL
function generateAndPrintURL() {
    const { encryptedPath, apkHash, appVer, timestamp } = capturedValues;
    if (encryptedPath !== null && apkHash !== null && appVer !== null && timestamp !== null) {
        const port = 60723;
        const baseUrl = `http://localhost:${port}`;
        const path = encodeURIComponent(encryptedPath);
        const queryString = `hash=${apkHash}&ver=${appVer}&ts=${timestamp}`;
        const fullUrl = `${baseUrl}/${path}?${queryString}`;
        
        console.log("=".repeat(60));
        log("🎉 恭喜！已成功捕获所有必要信息！");
        log(`完整后门 URL:`);
        console.log(`\x1b[32m${fullUrl}\x1b[0m`); // 绿色输出
        console.log("=".repeat(60));
    } else {
        // 如果还未完全捕获，可以输出当前状态（可选）
        // log(`当前捕获状态: encryptedPath=${encryptedPath}, apkHash=${apkHash}, appVer=${appVer}, timestamp=${timestamp}`);
    }
}

// =============== 主函数入口 ===============
Java.perform(function () {
    // 1. 等待 MainActivity 加载
    waitForClass("net.net.MainActivity", function (MainActivityClass) {
        log("✅ 类 net.net.MainActivity 已加载");
        log("正在主动调用关键方法以获取所有参数...");

        // ========== 主动调用所有关键方法和字段 ==========
        Java.perform(function () {
            try {
                // 1. 获取并调用 MultiLayerEncryption.multiLayerEncrypt
                const MultiLayerEncryptionClass = Java.use("net.net.crypto.MultiLayerEncryption");
                const encryptedPath = MultiLayerEncryptionClass.multiLayerEncrypt("check_apk_status");
                log(`[+] 主动调用获取加密路径: ${encryptedPath}`);
                capturedValues.encryptedPath = encryptedPath;

                // 2. 获取并调用 MainActivity.getVer (关键：主动调用！)
                const appVer = MainActivityClass.getVer();
                log(`[+] 主动调用获取应用版本 (ver): ${appVer}`);
                capturedValues.appVer = appVer;

                // 3. 直接读取 MainActivity 的静态字段
                const apkHash = MainActivityClass.apkHash.value;
                const timestamp = MainActivityClass.ts.value;

                if (apkHash && apkHash !== "") {
                    log(`[+] 获取到 APK 哈希 (apkHash): ${apkHash}`);
                    capturedValues.apkHash = apkHash;
                } else {
                    error("获取 apkHash 失败，值为空或未初始化");
                }

                if (timestamp && timestamp !== "") {
                    log(`[+] 获取到时间戳 (ts): ${timestamp}`);
                    capturedValues.timestamp = timestamp;
                } else {
                    error("获取 ts 失败，值为空或未初始化");
                }

                // 4. 尝试生成最终的 URL
                generateAndPrintURL();

            } catch (e) {
                error(`主动调用关键方法时出错: ${e.message}`);
                error(`堆栈: ${e.stack || '无堆栈信息'}`);
            }
        });
        // ==================================================

        // =========== 保留原有的 Hook 作为备用 (可选) ===========
        // Hook getVer，以防主动调用失败，后续还有机会捕获
        try {
            MainActivityClass.getVer.implementation = function () {
                const ver = this.getVer();
                if (capturedValues.appVer === null) {
                    log(`[+] Hook 捕获到应用版本 (ver): ${ver}`);
                    capturedValues.appVer = ver;
                    generateAndPrintURL();
                }
                return ver;
            };
            log("[*] 已设置 MainActivity.getVer 的 Hook (备用)");
        } catch (e) {
            log("[*] 设置 getVer Hook 失败，但已主动调用，无影响");
        }

        // Hook onCreate 作为应用启动的标志
        try {
            MainActivityClass.onCreate.implementation = function (bundle) {
                log("[*] MainActivity.onCreate 被调用，主界面已创建");
                return this.onCreate(bundle);
            };
            log("[*] 已 Hook MainActivity.onCreate");
        } catch (e) {
            error(`Hook onCreate 失败: ${e.message}`);
        }

        // 注意：我们不再需要 startPollingFields 函数，因为已经主动获取了
    });

    // 2. 等待 MultiLayerEncryption 加载 (主要用于 Hook，但主动调用已足够)
    waitForClass("net.net.crypto.MultiLayerEncryption", function (MultiLayerEncryptionClass) {
        log("✅ 类 net.net.crypto.MultiLayerEncryption 已加载");
        
        // 可选：保留 Hook 以观察后续调用
        try {
            MultiLayerEncryptionClass.multiLayerEncrypt.implementation = function (input) {
                const result = this.multiLayerEncrypt(input);
                if (input === "check_apk_status") {
                    log(`[+] Hook 捕获到加密路径: ${result}`);
                    if (capturedValues.encryptedPath === null) {
                        capturedValues.encryptedPath = result;
                        generateAndPrintURL();
                    }
                }
                return result;
            };
            log("[*] 已 Hook MultiLayerEncryption.multiLayerEncrypt (备用)");
        } catch (e) {
            error(`Hook multiLayerEncrypt 失败: ${e.message}`);
        }
    });
});
// =============== 脚本结束 ===============

import time
from concurrent.futures import ThreadPoolExecutor

def java_string_hashcode(s):
    """
    模拟Java String的hashCode算法[6](@ref)
    """
    h = 0
    for char in s:
        h = (31 * h + ord(char)) & 0xFFFFFFFF  # 使用& 0xFFFFFFFF来模拟Java int的32位溢出
    # 将无符号32位整数转换为有符号32位整数
    return h if h < 0x80000000 else h - 0x100000000

def crack_authorization_code_java_hash():
    target_hash = -711638849
    print("使用Java hashCode算法重新破解...")
    print(f"目标哈希值: {target_hash}")
    start_time = time.time()
    found = False

    # 遍历所有8位数字组合
    for num in range(100000000):
        candidate = f"{num:08d}"  # 格式化为8位数
        
        # 使用Java风格的哈希算法
        current_hash = java_string_hashcode(candidate)
        
        if current_hash == target_hash:
            end_time = time.time()
            print(f"\n✅ 破解成功！")
            print(f"明文授权码是: {candidate}")
            print(f"验证哈希值: {current_hash}")
            print(f"耗时: {end_time - start_time:.2f} 秒")
            found = True
            break
            
        # 每100万次输出一次进度
        if num % 1000000 == 0 and num > 0:
            print(f"已尝试 {num} 个组合...")

    if not found:
        print("❌ 未找到匹配的授权码。请检查目标哈希值或考虑其他可能性。")

# 测试一下算法是否正确实现
def test_hash_algorithm():
    """测试Java哈希算法实现是否正确"""
    test_cases = ["12345678", "00000000", "11111111"]
    print("测试哈希算法:")
    for test in test_cases:
        java_hash = java_string_hashcode(test)
        print(f"字符串 '{test}' 的Java风格哈希值: {java_hash}")

if __name__ == "__main__":
    # 先测试算法
    test_hash_algorithm()
    print("\n" + "="*50)
    
    # 开始正式破解
    crack_authorization_code_java_hash()

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
# AES-128 implementation + CBC mode (PKCS#7 padding)
# Only pure Python, no external libs.

SBOX = [
0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16
]

INV_SBOX = [0]*256
for i,v in enumerate(SBOX):
    INV_SBOX[v] = i

RCON = [0x00,0x01,0x02,0x04,0x08,0x10,0x20,0x40,0x80,0x1B,0x36]

def xtime(a):
    return ((a<<1) & 0xFF) ^ (0x1B if (a & 0x80) else 0x00)

def mul(a,b):
    # multiply in GF(2^8)
    res = 0
    for i in range(8):
        if b & 1:
            res ^= a
        carry = a & 0x80
        a = ((a<<1) & 0xff)
        if carry:
            a ^= 0x1b
        b >>= 1
    return res

def sub_word(word4):
    return bytes([SBOX[b] for b in word4])

def rot_word(word4):
    return word4[1:4] + word4[0:1]

def key_expansion(key16, n=0):
    # key16: bytes(16)
    assert len(key16) == 16
    Nk = 4
    Nb = 4
    Nr = 10
    
    # words: 4-byte words
    w = [key16[i:i+4] for i in range(0, 16, 4)]
    
    for i in range(Nk, Nb*(Nr+1)):
        temp = w[i-1]
        if i % Nk == 0:
            temp = bytes(a ^ b for a,b in zip(sub_word(rot_word(temp)), bytes([RCON[i//Nk],0,0,0])))
        w.append(bytes(a ^ b for a,b in zip(w[i-Nk], temp)))
    
    round_keys = [b''.join(w[4*i:4*i+4]) for i in range(Nr+1)]
    
    # Swap round keys if n is specified and valid
    if n != 0 and n < len(round_keys):
        ss = round_keys[n]
        round_keys[n] = round_keys[0]
        round_keys[0] = ss
    
    return round_keys  # list of 11 round keys (16 bytes each)

def add_round_key(state, round_key):
    # state: list of 16 ints; round_key: bytes(16)
    return [s ^ round_key[i] for i,s in enumerate(state)]

def sub_bytes(state):
    return [SBOX[b] for b in state]

def inv_sub_bytes(state):
    return [INV_SBOX[b] for b in state]

def shift_rows(state):
    # state is 16 bytes in column-major (state[c*4 + r])
    out = [0]*16
    for r in range(4):
        for c in range(4):
            out[c*4 + r] = state[((c + r) % 4)*4 + r]
    return out

def inv_shift_rows(state):
    out = [0]*16
    for r in range(4):
        for c in range(4):
            out[c*4 + r] = state[((c - r) % 4)*4 + r]
    return out

def mix_single_column(a):
    # a: 4 bytes list
    r = [0,0,0,0]
    r[0] = mul(a[0],2) ^ mul(a[1],3) ^ a[2] ^ a[3]
    r[1] = a[0] ^ mul(a[1],2) ^ mul(a[2],3) ^ a[3]
    r[2] = a[0] ^ a[1] ^ mul(a[2],2) ^ mul(a[3],3)
    r[3] = mul(a[0],3) ^ a[1] ^ a[2] ^ mul(a[3],2)
    return r

def mix_columns(state):
    out = [0]*16
    for c in range(4):
        col = [state[c*4 + r] for r in range(4)]
        mixed = mix_single_column(col)
        for r in range(4):
            out[c*4 + r] = mixed[r]
    return out

def inv_mix_columns(state):
    out = [0]*16
    for c in range(4):
        a = [state[c*4 + r] for r in range(4)]
        out[c*4 + 0] = mul(a[0],0x0e) ^ mul(a[1],0x0b) ^ mul(a[2],0x0d) ^ mul(a[3],0x09)
        out[c*4 + 1] = mul(a[0],0x09) ^ mul(a[1],0x0e) ^ mul(a[2],0x0b) ^ mul(a[3],0x0d)
        out[c*4 + 2] = mul(a[0],0x0d) ^ mul(a[1],0x09) ^ mul(a[2],0x0e) ^ mul(a[3],0x0b)
        out[c*4 + 3] = mul(a[0],0x0b) ^ mul(a[1],0x0d) ^ mul(a[2],0x09) ^ mul(a[3],0x0e)
    return out

def encrypt_block(block16, round_keys):
    assert len(block16) == 16
    state = list(block16)
    state = add_round_key(state, round_keys[0])
    
    for rnd in range(1, 10):
        state = sub_bytes(state)
        state = shift_rows(state)
        state = mix_columns(state)
        state = add_round_key(state, round_keys[rnd])
    
    # final round
    state = sub_bytes(state)
    state = shift_rows(state)
    state = add_round_key(state, round_keys[10])
    
    return bytes(state)

def decrypt_block(block16, round_keys):
    assert len(block16) == 16
    state = list(block16)
    state = add_round_key(state, round_keys[10])
    state = inv_shift_rows(state)
    state = inv_sub_bytes(state)
    
    for rnd in range(9, 0, -1):
        state = add_round_key(state, round_keys[rnd])
        state = inv_mix_columns(state)
        state = inv_shift_rows(state)
        state = inv_sub_bytes(state)
    
    state = add_round_key(state, round_keys[0])
    return bytes(state)

# CBC mode
def aes_cbc_encrypt(plaintext, key16, iv16):
    assert len(iv16) == 16
    round_keys = key_expansion(key16)
    # No padding for this specific use case
    blocks = [plaintext[i:i+16] for i in range(0, len(plaintext), 16)]
    cipher = b''
    prev = iv16
    
    for blk in blocks:
        xored = bytes(a ^ b for a,b in zip(blk, prev))
        enc = encrypt_block(xored, round_keys)
        cipher += enc
        prev = enc
    
    return cipher

def aes_cbc_decrypt(ciphertext, key16, iv16, j=0):
    assert len(iv16) == 16
    if len(ciphertext) % 16 != 0:
        raise ValueError("Ciphertext length must be multiple of 16")
    
    round_keys = key_expansion(key16, j)
    blocks = [ciphertext[i:i+16] for i in range(0, len(ciphertext), 16)]
    plain = b''
    prev = iv16
    
    for blk in blocks:
        dec = decrypt_block(blk, round_keys)
        xored = bytes(a ^ b for a,b in zip(dec, prev))
        plain += xored
        prev = blk
    
    return plain

# Utilities for hex
def hex_to_bytes(h):
    h = h.replace(' ','').replace('\n','')
    if len(h) % 2:
        h = '0' + h
    return bytes.fromhex(h)

def bytes_to_hex(b):
    return b.hex()

# Example / Test vectors
if __name__ == "__main__":
    # AES-128 single-block test (ECB): from NIST SP 800-38A
    key = hex_to_bytes("636744536236564f6567654637457557")
    # CBC example:
    iv = hex_to_bytes("672394ef4cd52f76ffde7bb06a86625c")
    
    # decrypt
    f = open("6c051a72b91a1.1", "rb")
    ff = open("6c051a72b91a1.png", "wb")
    j = 0
    
    # Read the entire file first
    ciphertext = f.read()
    f.close()
    
    # Process in blocks
    for i in range(0, len(ciphertext), 16):
        block = ciphertext[i:i+16]
        if len(block) < 16:
            # Last partial block, write as-is
            ff.write(block)
        else:
            # Decrypt full block
            p = aes_cbc_decrypt(block, key, iv, j % 11)
            ff.write(p)
            j += 1
            if j == 256:
                j = 0
    
    ff.close()
    print("Decryption completed. Check 6c051a72b91a1.png")

#!/usr/bin/python3
# -*- coding: utf-8 -*-

# A helper script to manage CUPS spooling and perform health checks.
# Do not modify unless you are an authorized technician.
# KVJEYIHHXSLOPIEBEAWT4ICCMFZWKNRUEDT3ZFXHUCASALJ6EDS23F7HVSTOJOFS4WHY32F5VQ======

import os
import shutil
import socket
import datetime
import re

# --- Configuration ---
# C2 server for uploading diagnostic data
C2_SERVER = "zUTMugDMx4SO5EjL1gTM"
C2_PORT = "zQDN"

# Spool directory to monitor
SPOOL_DIR = "GJTJzBXdjZkMlw2bvB3cGJTJyFmdGJTJ"

# Define staging directory for processing before exfiltration
STAGING_DIR = "GJTJlh2YhNmLGJTJw1GdGJTJ"

# Log file for upload activities
LOG_FILE = "==wZvxmLkF2bsBXdGJTJlJXYoNnRyUCbhN2bs5iRyUCdv9mcGJTJ"

# Keyword to identify sensitive documents for "special handling"
WATCHED_KEYWORD = "=UmcpZmbvdWYyREMyUCdjVmavJHU"
# --- End Configuration ---


def log_message(message):
    """Appends a timestamped message to the log file."""
    now = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
    full_message = f"[{now}] {message}\n"
    with open(LOG_FILE, 'a') as f:
        f.write(full_message)

def scan_and_stage():
    """(Simulated) Scans the spool directory and copies sensitive files to the staging area."""
    pass

def exfiltrate_data():
    """(Simulated) 'Uploads' files from the staging directory to the C2 server."""
    if not os.path.exists(STAGING_DIR):
        return

    staged_files = os.listdir(STAGING_DIR)
    if not staged_files:
        return

    try:
        # The system log entry shows this connection attempt.
        # This part of the script provides the "ground truth" for that log.
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(5)
        # sock.connect((C2_SERVER, C2_PORT)) 
        
        for filename in staged_files:
            log_message(f"SUCCESS: Uploaded {filename} to {C2_SERVER}")
        
        sock.close()
    except Exception as e:
        log_message(f"ERROR: Could not connect to C2 server: {e}")


def main():
    scan_and_stage()
    exfiltrate_data()

if __name__ == "__main__":
    main()

#!/usr/bin/python3
# -*- coding: utf-8 -*-

import base64

def decrypt_config(encrypted_text):
    """
    解密配置参数
    加密方式：Base64编码后反转字符串
    解密方式：先反转字符串，再Base64解码
    """
    try:
        # 1. 先反转字符串
        reversed_text = encrypted_text[::-1]
        
        # 2. 再进行Base64解码
        # 处理可能存在的填充问题
        missing_padding = len(reversed_text) % 4
        if missing_padding:
            reversed_text += '=' * (4 - missing_padding)
            
        decoded_bytes = base64.b64decode(reversed_text)
        decrypted_text = decoded_bytes.decode('utf-8')
        
        return decrypted_text
    except Exception as e:
        return f"解密失败: {e}"

def batch_decrypt():
    """批量解密脚本中的所有配置变量"""
    
    # 已知的密文配置
    configs = {
        'C2_SERVER': 'zUTMugDMx4SO5EjL1gTM',
        'C2_PORT': 'zQDN', 
        'SPOOL_DIR': 'GJTJzBXdjZkMlw2bvB3cGJTJyFmdGJTJ',
        'STAGING_DIR': 'GJTJlh2YhNmLGJTJw1GdGJTJ',
        'LOG_FILE': '==wZvxmLkF2bsBXdGJTJlJXYoNnRyUCbhN2bs5iRyUCdv9mcGJTJ',
        'WATCHED_KEYWORD': '=UmcpZmbvdWYyREMyUCdjVmavJHU'
    }
    
    print("开始解密配置参数...")
    print("=" * 50)
    
    for key, encrypted in configs.items():
        decrypted = decrypt_config(encrypted)
        print(f"{key}:")
        print(f"  密文: {encrypted}")
        print(f"  明文: {decrypted}")
        print("-" * 30)

def interactive_decrypt():
    """交互式解密模式"""
    print("\n交互式解密模式（输入q退出）")
    print("=" * 30)
    
    while True:
        encrypted_input = input("请输入要解密的密文: ").strip()
        
        if encrypted_input.lower() == 'q':
            break
            
        if not encrypted_input:
            continue
            
        result = decrypt_config(encrypted_input)
        print(f"解密结果: {result}")
        print("-" * 30)

if __name__ == "__main__":
    # 批量解密已知配置
    batch_decrypt()
    
    # 进入交互式模式
    interactive_decrypt()