• [b01lers2020]Welcome to Earth

    刚点进来会一直加载，然后跳转到了/die

    看一下刚进来页面的源代码

    1. html>
    2. <html>
    3.   <head>
    4.     <title>Welcome to Earthtitle>
    5.   head>
    6.   <body>
    7.     <h1>AMBUSH!h1>
    8.     <p>You've gotta escape!p>
    9.     <img src="/static/img/f18.png" alt="alien mothership" style="width:60vw;" />
    10.     <script>
    11.       document.onkeydown = function(event) {
    12.         event = event || window.event;
    13.         if (event.keyCode == 27) {
    14.           event.preventDefault();
    15.           window.location = "/chase/";
    16.         } else die();
    17.       };
    18.  
    19.       function sleep(ms) {
    20.         return new Promise(resolve => setTimeout(resolve, ms));
    21.       }
    22.  
    23.       async function dietimer() {
    24.         await sleep(10000);
    25.         die();
    26.       }
    27.  
    28.       function die() {
    29.         window.location = "/die/";
    30.       }
    31.  
    32.       dietimer();
    33.     script>
    34.   body>
    35. html>

    可以看到keycode == 27的时候会跳转到/chase/页面，27是键盘上的ESC键，当然我们也可以直接输入chase直接跳转到这个页面，然后查看chase页面的源码

    1. html>
    2. <html>
    3.   <head>
    4.     <title>Welcome to Earthtitle>
    5.   head>
    6.   <body>
    7.     <h1>CHASE!h1>
    8.     <p>
    9.       You managed to chase one of the enemy fighters, but there's a wall coming
    10.       up fast!
    11.     p>
    12.     <button onclick="left()">Leftbutton>
    13.     <button onclick="right()">Rightbutton>
    14.  
    15.     <img
    16.       src="/static/img/Canyon_Chase_16.png"
    17.       alt="canyon chase"
    18.       style="width:60vw;"
    19.     />
    20.     <script>
    21.       function sleep(ms) {
    22.         return new Promise(resolve => setTimeout(resolve, ms));
    23.       }
    24.  
    25.       async function dietimer() {
    26.         await sleep(1000);
    27.         die();
    28.       }
    29.  
    30.       function die() {
    31.         window.location = "/die/";
    32.       }
    33.  
    34.       function left() {
    35.         window.location = "/die/";
    36.       }
    37.  
    38.       function leftt() {
    39.         window.location = "/leftt/";
    40.       }
    41.  
    42.       function right() {
    43.         window.location = "/die/";
    44.       }
    45.  
    46.       dietimer();
    47.     script>
    48.   body>
    49. html>

    可以看到有个leftt，访问他

    页面源代码

    1. html>
    2. <html>
    3.   <head>
    4.     <title>Welcome to Earthtitle>
    5.   head>
    6.   <body>
    7.     <h1>SHOOT ITh1>
    8.     <p>You've got the bogey in your sights, take the shot!p>
    9.     <img
    10.       src="/static/img/locked.png"
    11.       alt="locked on"
    12.       style="width:60vw;"
    13.     />
    14.     br>
    15.     <button onClick="window.location='/die/'">Take the shotbutton>
    16.     
    17.   body>
    18. html>

    点Take the shot会跳转到die

    在注释里面可以看到shoot，访问

    点击Continue跳转到door

    页面源代码

    1. html>
    2. <html>
    3.   <head>
    4.     <title>Welcome to Earthtitle>
    5.     <script src="/static/js/door.js">script>
    6.   head>
    7.   <body>
    8.     <h1>YOU APPROACH THE ALIEN CRAFT!h1>
    9.     <p>How do you get inside?p>
    10.     <img src="/static/img/ship.png" alt="crashed ship" style="width:60vw;" />
    11.     <form id="door_form">
    12.       <input type="radio" name="side" value="0" />0
    13.       <input type="radio" name="side" value="1" />1
    14.       <input type="radio" name="side" value="2" />2
    15.       <input type="radio" name="side" value="3" />3
    16.       <input type="radio" name="side" value="4" />4
    17.       <input type="radio" name="side" value="5" />5
    18.       <input type="radio" name="side" value="6" />6
    19.       <input type="radio" name="side" value="7" />7
    20.       <input type="radio" name="side" value="8" />8
    21.       <input type="radio" name="side" value="9" />9
    22.       <input type="radio" name="side" value="10" />10
    23.       <input type="radio" name="side" value="11" />11
    24.       <input type="radio" name="side" value="12" />12
    25.       <input type="radio" name="side" value="13" />13
    26.       <input type="radio" name="side" value="14" />14
    27.       <input type="radio" name="side" value="15" />15
    28.       <input type="radio" name="side" value="16" />16
    29.       <input type="radio" name="side" value="17" />17
    30.       <input type="radio" name="side" value="18" />18
    31.       <input type="radio" name="side" value="19" />19
    32.       <input type="radio" name="side" value="20" />20
    33.       <input type="radio" name="side" value="21" />21
    34.       <input type="radio" name="side" value="22" />22
    35.       <input type="radio" name="side" value="23" />23
    36.       <input type="radio" name="side" value="24" />24
    37.       <input type="radio" name="side" value="25" />25
    38.       <input type="radio" name="side" value="26" />26
    39.       <input type="radio" name="side" value="27" />27
    40.       <input type="radio" name="side" value="28" />28
    41.       <input type="radio" name="side" value="29" />29
    42.       <input type="radio" name="side" value="30" />30
    43.       <input type="radio" name="side" value="31" />31
    44.       <input type="radio" name="side" value="32" />32
    45.       <input type="radio" name="side" value="33" />33
    46.       <input type="radio" name="side" value="34" />34
    47.       <input type="radio" name="side" value="35" />35
    48.       <input type="radio" name="side" value="36" />36
    49.       <input type="radio" name="side" value="37" />37
    50.       <input type="radio" name="side" value="38" />38
    51.       <input type="radio" name="side" value="39" />39
    52.       <input type="radio" name="side" value="40" />40
    53.       <input type="radio" name="side" value="41" />41
    54.       <input type="radio" name="side" value="42" />42
    55.       <input type="radio" name="side" value="43" />43
    56.       <input type="radio" name="side" value="44" />44
    57.       <input type="radio" name="side" value="45" />45
    58.       <input type="radio" name="side" value="46" />46
    59.       <input type="radio" name="side" value="47" />47
    60.       <input type="radio" name="side" value="48" />48
    61.       <input type="radio" name="side" value="49" />49
    62.       <input type="radio" name="side" value="50" />50
    63.       <input type="radio" name="side" value="51" />51
    64.       <input type="radio" name="side" value="52" />52
    65.       <input type="radio" name="side" value="53" />53
    66.       <input type="radio" name="side" value="54" />54
    67.       <input type="radio" name="side" value="55" />55
    68.       <input type="radio" name="side" value="56" />56
    69.       <input type="radio" name="side" value="57" />57
    70.       <input type="radio" name="side" value="58" />58
    71.       <input type="radio" name="side" value="59" />59
    72.       <input type="radio" name="side" value="60" />60
    73.       <input type="radio" name="side" value="61" />61
    74.       <input type="radio" name="side" value="62" />62
    75.       <input type="radio" name="side" value="63" />63
    76.       <input type="radio" name="side" value="64" />64
    77.       <input type="radio" name="side" value="65" />65
    78.       <input type="radio" name="side" value="66" />66
    79.       <input type="radio" name="side" value="67" />67
    80.       <input type="radio" name="side" value="68" />68
    81.       <input type="radio" name="side" value="69" />69
    82.       <input type="radio" name="side" value="70" />70
    83.       <input type="radio" name="side" value="71" />71
    84.       <input type="radio" name="side" value="72" />72
    85.       <input type="radio" name="side" value="73" />73
    86.       <input type="radio" name="side" value="74" />74
    87.       <input type="radio" name="side" value="75" />75
    88.       <input type="radio" name="side" value="76" />76
    89.       <input type="radio" name="side" value="77" />77
    90.       <input type="radio" name="side" value="78" />78
    91.       <input type="radio" name="side" value="79" />79
    92.       <input type="radio" name="side" value="80" />80
    93.       <input type="radio" name="side" value="81" />81
    94.       <input type="radio" name="side" value="82" />82
    95.       <input type="radio" name="side" value="83" />83
    96.       <input type="radio" name="side" value="84" />84
    97.       <input type="radio" name="side" value="85" />85
    98.       <input type="radio" name="side" value="86" />86
    99.       <input type="radio" name="side" value="87" />87
    100.       <input type="radio" name="side" value="88" />88
    101.       <input type="radio" name="side" value="89" />89
    102.       <input type="radio" name="side" value="90" />90
    103.       <input type="radio" name="side" value="91" />91
    104.       <input type="radio" name="side" value="92" />92
    105.       <input type="radio" name="side" value="93" />93
    106.       <input type="radio" name="side" value="94" />94
    107.       <input type="radio" name="side" value="95" />95
    108.       <input type="radio" name="side" value="96" />96
    109.       <input type="radio" name="side" value="97" />97
    110.       <input type="radio" name="side" value="98" />98
    111.       <input type="radio" name="side" value="99" />99
    112.       <input type="radio" name="side" value="100" />100
    113.       <input type="radio" name="side" value="101" />101
    114.       <input type="radio" name="side" value="102" />102
    115.       <input type="radio" name="side" value="103" />103
    116.       <input type="radio" name="side" value="104" />104
    117.       <input type="radio" name="side" value="105" />105
    118.       <input type="radio" name="side" value="106" />106
    119.       <input type="radio" name="side" value="107" />107
    120.       <input type="radio" name="side" value="108" />108
    121.       <input type="radio" name="side" value="109" />109
    122.       <input type="radio" name="side" value="110" />110
    123.       <input type="radio" name="side" value="111" />111
    124.       <input type="radio" name="side" value="112" />112
    125.       <input type="radio" name="side" value="113" />113
    126.       <input type="radio" name="side" value="114" />114
    127.       <input type="radio" name="side" value="115" />115
    128.       <input type="radio" name="side" value="116" />116
    129.       <input type="radio" name="side" value="117" />117
    130.       <input type="radio" name="side" value="118" />118
    131.       <input type="radio" name="side" value="119" />119
    132.       <input type="radio" name="side" value="120" />120
    133.       <input type="radio" name="side" value="121" />121
    134.       <input type="radio" name="side" value="122" />122
    135.       <input type="radio" name="side" value="123" />123
    136.       <input type="radio" name="side" value="124" />124
    137.       <input type="radio" name="side" value="125" />125
    138.       <input type="radio" name="side" value="126" />126
    139.       <input type="radio" name="side" value="127" />127
    140.       <input type="radio" name="side" value="128" />128
    141.       <input type="radio" name="side" value="129" />129
    142.       <input type="radio" name="side" value="130" />130
    143.       <input type="radio" name="side" value="131" />131
    144.       <input type="radio" name="side" value="132" />132
    145.       <input type="radio" name="side" value="133" />133
    146.       <input type="radio" name="side" value="134" />134
    147.       <input type="radio" name="side" value="135" />135
    148.       <input type="radio" name="side" value="136" />136
    149.       <input type="radio" name="side" value="137" />137
    150.       <input type="radio" name="side" value="138" />138
    151.       <input type="radio" name="side" value="139" />139
    152.       <input type="radio" name="side" value="140" />140
    153.       <input type="radio" name="side" value="141" />141
    154.       <input type="radio" name="side" value="142" />142
    155.       <input type="radio" name="side" value="143" />143
    156.       <input type="radio" name="side" value="144" />144
    157.       <input type="radio" name="side" value="145" />145
    158.       <input type="radio" name="side" value="146" />146
    159.       <input type="radio" name="side" value="147" />147
    160.       <input type="radio" name="side" value="148" />148
    161.       <input type="radio" name="side" value="149" />149
    162.       <input type="radio" name="side" value="150" />150
    163.       <input type="radio" name="side" value="151" />151
    164.       <input type="radio" name="side" value="152" />152
    165.       <input type="radio" name="side" value="153" />153
    166.       <input type="radio" name="side" value="154" />154
    167.       <input type="radio" name="side" value="155" />155
    168.       <input type="radio" name="side" value="156" />156
    169.       <input type="radio" name="side" value="157" />157
    170.       <input type="radio" name="side" value="158" />158
    171.       <input type="radio" name="side" value="159" />159
    172.       <input type="radio" name="side" value="160" />160
    173.       <input type="radio" name="side" value="161" />161
    174.       <input type="radio" name="side" value="162" />162
    175.       <input type="radio" name="side" value="163" />163
    176.       <input type="radio" name="side" value="164" />164
    177.       <input type="radio" name="side" value="165" />165
    178.       <input type="radio" name="side" value="166" />166
    179.       <input type="radio" name="side" value="167" />167
    180.       <input type="radio" name="side" value="168" />168
    181.       <input type="radio" name="side" value="169" />169
    182.       <input type="radio" name="side" value="170" />170
    183.       <input type="radio" name="side" value="171" />171
    184.       <input type="radio" name="side" value="172" />172
    185.       <input type="radio" name="side" value="173" />173
    186.       <input type="radio" name="side" value="174" />174
    187.       <input type="radio" name="side" value="175" />175
    188.       <input type="radio" name="side" value="176" />176
    189.       <input type="radio" name="side" value="177" />177
    190.       <input type="radio" name="side" value="178" />178
    191.       <input type="radio" name="side" value="179" />179
    192.       <input type="radio" name="side" value="180" />180
    193.       <input type="radio" name="side" value="181" />181
    194.       <input type="radio" name="side" value="182" />182
    195.       <input type="radio" name="side" value="183" />183
    196.       <input type="radio" name="side" value="184" />184
    197.       <input type="radio" name="side" value="185" />185
    198.       <input type="radio" name="side" value="186" />186
    199.       <input type="radio" name="side" value="187" />187
    200.       <input type="radio" name="side" value="188" />188
    201.       <input type="radio" name="side" value="189" />189
    202.       <input type="radio" name="side" value="190" />190
    203.       <input type="radio" name="side" value="191" />191
    204.       <input type="radio" name="side" value="192" />192
    205.       <input type="radio" name="side" value="193" />193
    206.       <input type="radio" name="side" value="194" />194
    207.       <input type="radio" name="side" value="195" />195
    208.       <input type="radio" name="side" value="196" />196
    209.       <input type="radio" name="side" value="197" />197
    210.       <input type="radio" name="side" value="198" />198
    211.       <input type="radio" name="side" value="199" />199
    212.       <input type="radio" name="side" value="200" />200
    213.       <input type="radio" name="side" value="201" />201
    214.       <input type="radio" name="side" value="202" />202
    215.       <input type="radio" name="side" value="203" />203
    216.       <input type="radio" name="side" value="204" />204
    217.       <input type="radio" name="side" value="205" />205
    218.       <input type="radio" name="side" value="206" />206
    219.       <input type="radio" name="side" value="207" />207
    220.       <input type="radio" name="side" value="208" />208
    221.       <input type="radio" name="side" value="209" />209
    222.       <input type="radio" name="side" value="210" />210
    223.       <input type="radio" name="side" value="211" />211
    224.       <input type="radio" name="side" value="212" />212
    225.       <input type="radio" name="side" value="213" />213
    226.       <input type="radio" name="side" value="214" />214
    227.       <input type="radio" name="side" value="215" />215
    228.       <input type="radio" name="side" value="216" />216
    229.       <input type="radio" name="side" value="217" />217
    230.       <input type="radio" name="side" value="218" />218
    231.       <input type="radio" name="side" value="219" />219
    232.       <input type="radio" name="side" value="220" />220
    233.       <input type="radio" name="side" value="221" />221
    234.       <input type="radio" name="side" value="222" />222
    235.       <input type="radio" name="side" value="223" />223
    236.       <input type="radio" name="side" value="224" />224
    237.       <input type="radio" name="side" value="225" />225
    238.       <input type="radio" name="side" value="226" />226
    239.       <input type="radio" name="side" value="227" />227
    240.       <input type="radio" name="side" value="228" />228
    241.       <input type="radio" name="side" value="229" />229
    242.       <input type="radio" name="side" value="230" />230
    243.       <input type="radio" name="side" value="231" />231
    244.       <input type="radio" name="side" value="232" />232
    245.       <input type="radio" name="side" value="233" />233
    246.       <input type="radio" name="side" value="234" />234
    247.       <input type="radio" name="side" value="235" />235
    248.       <input type="radio" name="side" value="236" />236
    249.       <input type="radio" name="side" value="237" />237
    250.       <input type="radio" name="side" value="238" />238
    251.       <input type="radio" name="side" value="239" />239
    252.       <input type="radio" name="side" value="240" />240
    253.       <input type="radio" name="side" value="241" />241
    254.       <input type="radio" name="side" value="242" />242
    255.       <input type="radio" name="side" value="243" />243
    256.       <input type="radio" name="side" value="244" />244
    257.       <input type="radio" name="side" value="245" />245
    258.       <input type="radio" name="side" value="246" />246
    259.       <input type="radio" name="side" value="247" />247
    260.       <input type="radio" name="side" value="248" />248
    261.       <input type="radio" name="side" value="249" />249
    262.       <input type="radio" name="side" value="250" />250
    263.       <input type="radio" name="side" value="251" />251
    264.       <input type="radio" name="side" value="252" />252
    265.       <input type="radio" name="side" value="253" />253
    266.       <input type="radio" name="side" value="254" />254
    267.       <input type="radio" name="side" value="255" />255
    268.       <input type="radio" name="side" value="256" />256
    269.       <input type="radio" name="side" value="257" />257
    270.       <input type="radio" name="side" value="258" />258
    271.       <input type="radio" name="side" value="259" />259
    272.       <input type="radio" name="side" value="260" />260
    273.       <input type="radio" name="side" value="261" />261
    274.       <input type="radio" name="side" value="262" />262
    275.       <input type="radio" name="side" value="263" />263
    276.       <input type="radio" name="side" value="264" />264
    277.       <input type="radio" name="side" value="265" />265
    278.       <input type="radio" name="side" value="266" />266
    279.       <input type="radio" name="side" value="267" />267
    280.       <input type="radio" name="side" value="268" />268
    281.       <input type="radio" name="side" value="269" />269
    282.       <input type="radio" name="side" value="270" />270
    283.       <input type="radio" name="side" value="271" />271
    284.       <input type="radio" name="side" value="272" />272
    285.       <input type="radio" name="side" value="273" />273
    286.       <input type="radio" name="side" value="274" />274
    287.       <input type="radio" name="side" value="275" />275
    288.       <input type="radio" name="side" value="276" />276
    289.       <input type="radio" name="side" value="277" />277
    290.       <input type="radio" name="side" value="278" />278
    291.       <input type="radio" name="side" value="279" />279
    292.       <input type="radio" name="side" value="280" />280
    293.       <input type="radio" name="side" value="281" />281
    294.       <input type="radio" name="side" value="282" />282
    295.       <input type="radio" name="side" value="283" />283
    296.       <input type="radio" name="side" value="284" />284
    297.       <input type="radio" name="side" value="285" />285
    298.       <input type="radio" name="side" value="286" />286
    299.       <input type="radio" name="side" value="287" />287
    300.       <input type="radio" name="side" value="288" />288
    301.       <input type="radio" name="side" value="289" />289
    302.       <input type="radio" name="side" value="290" />290
    303.       <input type="radio" name="side" value="291" />291
    304.       <input type="radio" name="side" value="292" />292
    305.       <input type="radio" name="side" value="293" />293
    306.       <input type="radio" name="side" value="294" />294
    307.       <input type="radio" name="side" value="295" />295
    308.       <input type="radio" name="side" value="296" />296
    309.       <input type="radio" name="side" value="297" />297
    310.       <input type="radio" name="side" value="298" />298
    311.       <input type="radio" name="side" value="299" />299
    312.       <input type="radio" name="side" value="300" />300
    313.       <input type="radio" name="side" value="301" />301
    314.       <input type="radio" name="side" value="302" />302
    315.       <input type="radio" name="side" value="303" />303
    316.       <input type="radio" name="side" value="304" />304
    317.       <input type="radio" name="side" value="305" />305
    318.       <input type="radio" name="side" value="306" />306
    319.       <input type="radio" name="side" value="307" />307
    320.       <input type="radio" name="side" value="308" />308
    321.       <input type="radio" name="side" value="309" />309
    322.       <input type="radio" name="side" value="310" />310
    323.       <input type="radio" name="side" value="311" />311
    324.       <input type="radio" name="side" value="312" />312
    325.       <input type="radio" name="side" value="313" />313
    326.       <input type="radio" name="side" value="314" />314
    327.       <input type="radio" name="side" value="315" />315
    328.       <input type="radio" name="side" value="316" />316
    329.       <input type="radio" name="side" value="317" />317
    330.       <input type="radio" name="side" value="318" />318
    331.       <input type="radio" name="side" value="319" />319
    332.       <input type="radio" name="side" value="320" />320
    333.       <input type="radio" name="side" value="321" />321
    334.       <input type="radio" name="side" value="322" />322
    335.       <input type="radio" name="side" value="323" />323
    336.       <input type="radio" name="side" value="324" />324
    337.       <input type="radio" name="side" value="325" />325
    338.       <input type="radio" name="side" value="326" />326
    339.       <input type="radio" name="side" value="327" />327
    340.       <input type="radio" name="side" value="328" />328
    341.       <input type="radio" name="side" value="329" />329
    342.       <input type="radio" name="side" value="330" />330
    343.       <input type="radio" name="side" value="331" />331
    344.       <input type="radio" name="side" value="332" />332
    345.       <input type="radio" name="side" value="333" />333
    346.       <input type="radio" name="side" value="334" />334
    347.       <input type="radio" name="side" value="335" />335
    348.       <input type="radio" name="side" value="336" />336
    349.       <input type="radio" name="side" value="337" />337
    350.       <input type="radio" name="side" value="338" />338
    351.       <input type="radio" name="side" value="339" />339
    352.       <input type="radio" name="side" value="340" />340
    353.       <input type="radio" name="side" value="341" />341
    354.       <input type="radio" name="side" value="342" />342
    355.       <input type="radio" name="side" value="343" />343
    356.       <input type="radio" name="side" value="344" />344
    357.       <input type="radio" name="side" value="345" />345
    358.       <input type="radio" name="side" value="346" />346
    359.       <input type="radio" name="side" value="347" />347
    360.       <input type="radio" name="side" value="348" />348
    361.       <input type="radio" name="side" value="349" />349
    362.       <input type="radio" name="side" value="350" />350
    363.       <input type="radio" name="side" value="351" />351
    364.       <input type="radio" name="side" value="352" />352
    365.       <input type="radio" name="side" value="353" />353
    366.       <input type="radio" name="side" value="354" />354
    367.       <input type="radio" name="side" value="355" />355
    368.       <input type="radio" name="side" value="356" />356
    369.       <input type="radio" name="side" value="357" />357
    370.       <input type="radio" name="side" value="358" />358
    371.       <input type="radio" name="side" value="359" />359
    372.     form>
    373.     <button onClick="check_door()">Checkbutton>
    374.   body>
    375. html>

    在最下面有个check_door函数，他是从上面的/static/js/door.js导入的

    1. function check_door() {j
    2.   var all_radio = document.getElementById("door_form").elements;
    3.   var guess = null;
    4.  
    5.   for (var i = 0; i < all_radio.length; i++)
    6.     if (all_radio[i].checked) guess = all_radio[i].value;
    7.  
    8.   rand = Math.floor(Math.random() * 360);
    9.   if (rand == guess) window.location = "/open/";
    10.   else window.location = "/die/";
    11. }

    直接访问open

    页面源代码

    1. html>
    2. <html>
    3.   <head>
    4.     <title>Welcome to Earthtitle>
    5.     <script src="/static/js/open_sesame.js">script>
    6.   head>
    7.   <body>
    8.     <h1>YOU FOUND THE DOOR!h1>
    9.     <p>How do you open it?p>
    10.     <img src="/static/img/door.jpg" alt="door" style="width:60vw;" />
    11.     <script>
    12.       open(0);
    13.     script>
    14.   body>
    15. html>

    查看/static/js/open_sesame.js

    1. function sleep(ms) {
    2.   return new Promise(resolve => setTimeout(resolve, ms));
    3. }
    4.  
    5. function open(i) {
    6.   sleep(1).then(() => {
    7.     open(i + 1);
    8.   });
    9.   if (i == 4000000000) window.location = "/fight/";
    10. }

    访问fight

    同样的，得到

    1. // Run to scramble original flag
    2. //console.log(scramble(flag, action));
    3. function scramble(flag, key) {
    4.   for (var i = 0; i < key.length; i++) {
    5.     let n = key.charCodeAt(i) % flag.length;
    6.     let temp = flag[i];
    7.     flag[i] = flag[n];
    8.     flag[n] = temp;
    9.   }
    10.   return flag;
    11. }
    12.  
    13. function check_action() {
    14.   var action = document.getElementById("action").value;
    15.   var flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"];
    16.  
    17.   // TODO: unscramble function
    18. }

    可以看到有flag，但是被打乱了

    这里就可以对这个存放flag的数组进行排列了，python中组合用的是itertolls中的combinations，而排列则是permutations

    脚本：

    1. from itertools import permutations
    2.  
    3. flag = ["{hey", "_boy", "aaaa", "s_im", "ck!}", "_baa", "aaaa", "pctf"]
    4.  
    5. item = permutations(flag)
    6. for i in item:
    7.     k = ''.join(list(i))
    8.     if k.startswith('pctf{hey_boys') and k[-1] == '}':
    9.         print(k)

    得到

    flag为pctf{hey_boys_im_baaaaaaaaaack!}

  • 相关阅读:
    Python 队里 list的常规操作 pop，insert，remove，index
    金融行业软文怎么写，如何让金融软文在发布上有好效果？
    数据仓库的实际应用示例-广告投放平台为例
    文化主题公园旅游景点3d全景VR交互体验加深了他们对历史文化的认知和印象
    python中random模块求随机数
    前端需要了解的linux命令
    什么是入侵检测系统？有哪些分类？
    如何系列 如何使用ff4j实现功能迭代
    [附源码]Python计算机毕业设计SSM健身房管理系统 （程序+LW)
    数字电路常用芯片合集
  • 原文地址：https://blog.csdn.net/Yb_140/article/details/128031425