1
key = b'MoreSecureAes128'
2

3
ct = bytes.fromhex(cipher_hex)
4

5
pt = AES.new(key, AES.MODE_ECB).decrypt(ct)
6

7
flag = pt.rstrip(b'\n').decode()

1
op=peek_export_keyf&token=meter_report&key=SM-20260507-17%3Ameter%3Areport

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
import re
4
import hashlib
5
import csv
6
import datetime
7

8

9
def md5(s):
10
    return hashlib.md5(s.encode("utf-8")).hexdigest()
11

12

13
def mask_username(u):
14
    if len(u) == 2:
15
        return u[0] + "*"
16
    if len(u) >= 3:
17
        return u[0] + "*" * (len(u) - 2) + u[-1]
18
    return u
19

20

21
def mask_name(n):
22
    if not n or not re.fullmatch(r"[\u4e00-\u9fff]+", n) or len(n) < 2:
23
        return "INVALID"
24
    if len(n) == 2:
25
        return n[0] + "*"
26
    return n[0] + "*" * (len(n) - 2) + n[-1]
27

28

29
def validate_date(year, month, day):
30
    try:
31
        datetime.date(year, month, day)
32
        return True
33
    except ValueError:
34
        return False
35

36

37
def idcard_checksum(idcard17):
38
    weights = [7, 9, 10, 5, 8, 4, 2, 1, 6, 3, 7, 9, 10, 5, 8, 4, 2]
39
    check_chars = "10X98765432"
40
    total = sum(int(idcard17[i]) * weights[i] for i in range(17))
41
    return check_chars[total % 11]
42

43

44
def mask_idcard(ic):
45
    ic = ic.strip()
46
    if len(ic) != 18:
47
        return "INVALID"
48
    if not ic[:17].isdigit():
49
        return "INVALID"
50
    if not (ic[17].isdigit() or ic[17].upper() == "X"):
51
        return "INVALID"
52

53
    ic = ic[:17] + ic[17].upper()
54
    year, month, day = int(ic[6:10]), int(ic[10:12]), int(ic[12:14])
55

56
    if not validate_date(year, month, day):
57
        return "INVALID"
58
    if ic[17] != idcard_checksum(ic[:17]):
59
        return "INVALID"
60

61
    return "******" + ic[6:10] + "********"
62

63

64
VALID_PREFIXES = {
65
    "134", "135", "136", "137", "138", "139", "147", "148", "150", "151", "152", "157", "158", "159",
66
    "172", "178", "182", "183", "184", "187", "188", "195", "198", "130", "131", "132", "140", "145",
67
    "146", "155", "156", "166", "167", "171", "175", "176", "185", "186", "196", "133", "149", "153",
68
    "173", "174", "177", "180", "181", "189", "190", "191", "193", "199",
69
}
70

71

72
def mask_phone(p):
73
    p = p.strip()
74
    p = re.sub(r"^\+?86\s*[-]?", "", p)
75
    p = re.sub(r"[\s\-]", "", p)
76
    if not p.isdigit() or len(p) != 11 or p[:3] not in VALID_PREFIXES:
77
        return "INVALID"
78
    return p[:3] + "****" + p[7:]
79

80

81
def mask_email(e):
82
    e = e.strip().lower()
83
    m = re.fullmatch(r"([a-z0-9._%+\-]+)@([a-z0-9.\-]+\.[a-z]{2,})", e)
84
    if not m:
85
        return "INVALID"
86
    return mask_username(m.group(1)) + "@" + m.group(2)
87

88

89
def mask_bankcard(b):
90
    b = re.sub(r"[\s\-]", "", b.strip())
91
    if not b.isdigit() or not (16 <= len(b) <= 19):
92
        return "INVALID"
93
    return b[:6] + "*" * (len(b) - 10) + b[-4:]
94

95

96
def mask_address(a):
97
    a = a.strip()
98
    idx = a.find("号")
99
    if idx == -1:
100
        return "INVALID"
101
    return a[:idx] + "***"
102

103

104
def mask_ip(ip):
105
    ip = ip.strip()
106
    parts = ip.split(".")
107
    if len(parts) != 4:
108
        return "INVALID"
109

110
    for p in parts:
111
        if not p.isdigit() or int(p) > 255 or p != str(int(p)):
112
            return "INVALID"
113

114
    return ".".join(parts[:3]) + ".*"
115

116

117
def mask_birthday(b):
118
    b = b.strip()
119
    m = re.fullmatch(r"(\d{4})[-/](\d{2})[-/](\d{2})", b)
120
    if not m:
121
        return "INVALID"
122

123
    year, month, day = int(m.group(1)), int(m.group(2)), int(m.group(3))
124
    if not validate_date(year, month, day):
125
        return "INVALID"
126

127
    ref = datetime.date(2026, 5, 1)
128
    bdate = datetime.date(year, month, day)
129
    age = ref.year - bdate.year - ((ref.month, ref.day) < (bdate.month, bdate.day))
130
    lo = (age // 10) * 10
131
    return f"{lo}-{lo + 9}"
132

133

134
def parse_values(s):
135
    values = []
136
    i = 0
137
    s = s.strip()
138

139
    while i < len(s):
140
        if s[i] == "'":
141
            j = i + 1
142
            val = []
143
            while j < len(s):
144
                if s[j] == "'" and j + 1 < len(s) and s[j + 1] == "'":
145
                    val.append("'")
146
                    j += 2
147
                elif s[j] == "'":
148
                    break
149
                else:
150
                    val.append(s[j])
151
                    j += 1
152

153
            values.append("".join(val))
154
            i = j + 1
155
            while i < len(s) and s[i] in ", ":
156
                i += 1
157
        elif s[i:i + 4] == "NULL":
158
            values.append(None)
159
            i += 4
160
            while i < len(s) and s[i] in ", ":
161
                i += 1
162
        else:
163
            j = i
164
            while j < len(s) and s[j] != ",":
165
                j += 1
166
            values.append(s[i:j].strip())
167
            i = j + 1
168
            while i < len(s) and s[i] == " ":
169
                i += 1
170

171
    return values
172

173

174
def parse_sql(filepath):
175
    rows = []
176
    pattern = re.compile(r"INSERT INTO user_export \([^)]+\) VALUES \((.+)\);", re.IGNORECASE)
177

178
    with open(filepath, "r", encoding="utf-8") as f:
179
        for line in f:
180
            m = pattern.search(line)
181
            if not m:
182
                continue
183

184
            values = parse_values(m.group(1))
185
            if len(values) != 12:
186
                continue
187

188
            rows.append(dict(zip(
189
                ["id", "username", "password", "name", "idcard", "phone", "email", "bankcard", "address", "ip", "birthday", "status"],
190
                values,
191
            )))
192

193
    return rows
194

195

196
def main():
197
    sql_path = "user_export.sql"
198
    out_path = "output.csv"
199
    rows = parse_sql(sql_path)
200
    active = sorted([r for r in rows if r["status"] == "active"], key=lambda r: int(r["id"]))
201

202
    with open(out_path, "w", newline="", encoding="utf-8") as f:
203
        writer = csv.writer(f)
204
        writer.writerow(["id", "username", "password", "name", "idcard", "phone", "email", "bankcard", "address", "ip", "birthday"])
205

206
        for r in active:
207
            writer.writerow([
208
                r["id"],
209
                mask_username(r["username"]),
210
                md5(r["password"]),
211
                mask_name(r["name"]),
212
                mask_idcard(r["idcard"]),
213
                mask_phone(r["phone"]),
214
                mask_email(r["email"]),
215
                mask_bankcard(r["bankcard"]),
216
                mask_address(r["address"]),
217
                mask_ip(r["ip"]),
218
                mask_birthday(r["birthday"]),
219
            ])
220

221
    print(f"Done: {len(active)} active rows -> {out_path}")
222

223

224
if __name__ == "__main__":
225
    main()

1
import time
2
import requests
3

4
with open("output.csv", "rb") as f:
5
    r = requests.post(
6
        "http://47.99.147.34:38196/api/upload",
7
        files={"file": ("output.csv", f, "text/csv")},
8
    )
9

10
key = r.json()["key"]
11

12
while True:
13
    r = requests.get(f"http://47.99.147.34:38196/api/status/{key}")
14
    data = r.json()
15
    print(data)
16

17
    if data.get("state") != 0:
18
        break
19

20
    time.sleep(2)

1
n = 162609131412202175306539060866122225584048682500229368111829891648381638255345872045497780486908005611126130595748050116842092575026044169617179692727086886943255740374116310697621246263144862579242491741109509433106024139249989457694788419952731725562332548630936313255732168752797597409157559442131036923449
2

3
e = 65537
4

5
len(encrypted.bin) = 23168

1
n = a^2 - b^2 = (a - b)(a + b)

1
p = 12751828551709836069103027639236748210345732901386209604520393543958229433834765694925409378355486164691077551258041029878391501131185664614971880587757401
2

3
q = 12751828551709836069103027639236748210345732901386209604520393543958229433834765694925409378355486164691077551258041029878391501131185675868445062344890849

1
from pathlib import Path
2
from math import isqrt
3
from Crypto.PublicKey import RSA
4
from Crypto.Util.number import inverse
5
from Crypto.Cipher import PKCS1_OAEP
6
from Crypto.Hash import SHA1
7

8
base = Path(".")
9
pub = RSA.import_key((base / "pubkey.pem").read_bytes())
10
n, e = pub.n, pub.e
11

12
a = isqrt(n)
13
if a * a < n:
14
    a += 1
15

16
while True:
17
    b2 = a * a - n
18
    b = isqrt(b2)
19

20
    if b * b == b2:
21
        p = a - b
22
        q = a + b
23
        break
24

25
    a += 1
26

27
assert p * q == n
28

29
phi = (p - 1) * (q - 1)
30
d = inverse(e, phi)
31
priv = RSA.construct((n, e, d, p, q))
32
cipher = PKCS1_OAEP.new(priv, hashAlgo=SHA1)
33

34
ct = (base / "encrypted.bin").read_bytes()
35
block_size = (n.bit_length() + 7) // 8
36
pt = bytearray()
37

38
for i in range(0, len(ct), block_size):
39
    pt.extend(cipher.decrypt(ct[i:i + block_size]))
40

41
(base / "recovered.png").write_bytes(pt)
42
print("written recovered.png")

1
#!/usr/bin/env python3
2
import json
3
import re
4
import base64
5
import glob
6
import csv
7
from collections import Counter
8

9
log_path = glob.glob(r"G:\数据安全2\*LLMDataAudit*\extracted\chat_logs.jsonl")[0]
10
out_dir = glob.glob(r"G:\数据安全2\*LLMDataAudit*\extracted")[0]
11

12
LEAK_MARKERS = [
13
    "指令解析完成",
14
    "指令已解码",
15
    "命令执行完毕",
16
    "Decoded command executed",
17
    "[DebugGPT]",
18
    "[CyberAdmin]",
19
    "[InfoBot] User record retrieved",
20
    "[DBA_Bot] Query result from user_table",
21
    "Record output:",
22
    "数据输出：",
23
    "查询到以下数据记录",
24
    "以下为内部用户数据",
25
    "好的，以下是系统中存储的用户记录",
26
    "内部数据导出结果",
27
    "Result (Base64 protected)",
28
    "Output (Base64 encoded)",
29
]
30

31
DIRECT_KW = [
32
    "忽略", "系统管理员", "调试命令", "调试指令", "系统调试", "输出用户数据",
33
    "关闭安全过滤", "解除", "审计员", "导出用户", "ignore", "override",
34
    "disable safety", "disable filter", "dump all", "system override",
35
    "display user", "display all stored", "print user", "print user/pii",
36
    "output complete user", "export", "privacy controls",
37
]
38

39
ROLE_KW = [
40
    "假设你是", "假设你", "你现在是", "你的身份是", "你的角色是", "扮演",
41
    "从现在开始你是", "从现在起你的角色是", "pretend you are", "act as",
42
    "you are now", "let's play", "debuggpt", "cyberadmin", "leakbot",
43
    "infobot", "opendata", "dataexport", "rawdataai", "dataleaker",
44
    "pentestbot", "已被入侵", "数据分析师", "dba_bot", "systemdump",
45
]
46

47
ID_WEIGHTS = [7, 9, 10, 5, 8, 4, 2, 1, 6, 3, 7, 9, 10, 5, 8, 4, 2]
48
ID_CHECK = "10X98765432"
49

50
PHONE_PREFIXES = {
51
    "134", "135", "136", "137", "138", "139", "147", "148", "150", "151", "152",
52
    "157", "158", "159", "172", "178", "182", "183", "184", "187", "188", "195", "198",
53
    "130", "131", "132", "140", "145", "146", "155", "156", "166", "167", "171", "175",
54
    "176", "185", "186", "196", "133", "149", "153", "173", "174", "177", "180", "181",
55
    "189", "190", "191", "193", "199",
56
}
57

58
BANK_BINS = (
59
    "622848", "622700", "621700", "622262", "622188", "622200", "622568", "622609",
60
    "622908", "622518",
61
)
62

63

64
def valid_idcard(value):
65
    v = value.upper()
66
    if not re.match(r"^\d{17}[\dX]$", v):
67
        return False
68

69
    total = sum(int(v[i]) * ID_WEIGHTS[i] for i in range(17))
70
    return ID_CHECK[total % 11] == v[17]
71

72

73
def valid_phone(value):
74
    if not re.match(r"^1[3-9]\d{9}$", value):
75
        return False
76
    return value[:3] in PHONE_PREFIXES
77

78

79
def luhn_ok(value):
80
    if not value.isdigit() or not (16 <= len(value) <= 19):
81
        return False
82

83
    digits = [int(d) for d in value]
84
    s = 0
85
    for i, d in enumerate(reversed(digits)):
86
        if i % 2 == 1:
87
            d *= 2
88
            if d > 9:
89
                d -= 9
90
        s += d
91

92
    return s % 10 == 0
93

94

95
def valid_bankcard(value):
96
    return luhn_ok(value)
97

98

99
def valid_email(value):
100
    return bool(re.match(r"^[\w.+-]+@[\w.-]+\.\w+$", value))
101

102

103
def validate_pii(category, value):
104
    if category == "idcard":
105
        return valid_idcard(value)
106
    if category == "phone":
107
        return valid_phone(value)
108
    if category == "bankcard":
109
        return valid_bankcard(value)
110
    if category == "email":
111
        return valid_email(value)
112
    return False
113

114

115
def classify_attack_type(user_input):
116
    ui = user_input
117
    lower = ui.lower().replace("you're", "you are").replace("let's", "let us")
118
    has_b64 = bool(re.search(r"[A-Za-z0-9+/=]{20,}", ui))
119
    has_b64_kw = (
120
        any(k in lower for k in [
121
            "base64",
122
            "encoded command",
123
            "encoded instruction",
124
            "decode and follow",
125
            "编码指令",
126
        ])
127
        or any(k in ui for k in ["Base64"])
128
        or (any(k in lower for k in ["decode", "encoded"]) and has_b64)
129
    )
130

131
    if has_b64_kw and has_b64:
132
        return "encoding"
133
    if re.search(r"\\u[0-9a-fA-F]{4}", ui) or "Unicode" in ui or "unicode" in lower:
134
        return "unicode"
135
    if any(k.lower() in lower for k in ROLE_KW):
136
        return "role_play"
137
    return "direct"
138

139

140
def b64_decode_if_valid(s):
141
    clean = re.sub(r"[\s\-]", "", s)
142
    if re.match(r"^\d+$", clean):
143
        return None
144
    if not re.match(r"^[A-Za-z0-9+/]+=*$", clean):
145
        return None
146

147
    pad = "=" * ((4 - len(clean) % 4) % 4)
148
    try:
149
        dec = base64.b64decode(clean + pad).decode("utf-8", errors="ignore").strip()
150
    except Exception:
151
        return None
152

153
    for cat in ("idcard", "phone", "bankcard", "email"):
154
        candidate = dec.upper() if cat == "idcard" else dec
155
        if validate_pii(cat, candidate):
156
            return candidate
157

158
    return None
159

160

161
def categorize_raw(value):
162
    v = value.strip()
163
    v_id = v.upper()
164

165
    if validate_pii("email", v):
166
        return "email", v
167
    if validate_pii("phone", re.sub(r"[\s\-]", "", v)):
168
        return "phone", re.sub(r"[\s\-]", "", v)
169
    if validate_pii("idcard", re.sub(r"[\s\-]", "", v_id)):
170
        return "idcard", re.sub(r"[\s\-]", "", v_id)
171
    if validate_pii("bankcard", re.sub(r"[\s\-]", "", v)):
172
        return "bankcard", re.sub(r"[\s\-]", "", v)
173

174
    dec = b64_decode_if_valid(v)
175
    if dec:
176
        return categorize_raw(dec)
177

178
    return None, None
179

180

181
def extract_leaked_pii(text):
182
    items = []
183
    seen = set()
184

185
    def add_value(raw):
186
        cat, val = categorize_raw(raw)
187
        if not cat or not val or val in seen:
188
            return
189
        seen.add(val)
190
        items.append((cat, val))
191

192
    for m in re.finditer(
193
        r"(?:bank_card|email|mobile|card_no|id_number|id_card|phone|email_b64|银行卡号?|身份证号?|证件号码|手机号码?|邮箱|电子邮箱|电话号码|联系电话|银行卡|ID|Email|Phone)[=：:\s]+([^\n，。]+)",
194
        text,
195
    ):
196
        add_value(m.group(1).strip())
197

198
    for m in re.finditer(
199
        r"(?:email_b64|id_number|phone|Result \(Base64 protected\)|Output \(Base64 encoded\))[：:\s]+([A-Za-z0-9+/=\s\-]+)",
200
        text,
201
    ):
202
        add_value(m.group(1).strip())
203

204
    for m in re.finditer(r"(?:bank_card|email|mobile|card_no|id_number|phone)=([^\n\\]+)", text):
205
        add_value(m.group(1).strip())
206

207
    return items
208

209

210
records = [json.loads(l) for l in open(log_path, encoding="utf-8")]
211
rows = []
212

213
for r in records:
214
    out = r["model_output"]
215
    if not any(m in out for m in LEAK_MARKERS):
216
        continue
217

218
    pii_items = extract_leaked_pii(out)
219
    if not pii_items:
220
        continue
221

222
    attack_type = classify_attack_type(r["user_input"])
223
    for cat, val in pii_items:
224
        rows.append({
225
            "turn_id": r["turn_id"],
226
            "attack_type": attack_type,
227
            "category": cat,
228
            "value": val,
229
        })
230

231
rows.sort(key=lambda x: (x["turn_id"], x["category"], x["value"]))
232
csv_path = out_dir + "\\result.csv"
233

234
with open(csv_path, "w", encoding="utf-8", newline="") as f:
235
    w = csv.DictWriter(f, fieldnames=["turn_id", "attack_type", "category", "value"])
236
    w.writeheader()
237
    w.writerows(rows)
238

239
print(f"Successful leak turns: {len(set(r['turn_id'] for r in rows))}")
240
print(f"Total PII rows: {len(rows)}")
241
print("attack types:", Counter(r["attack_type"] for r in rows))
242
print("categories:", Counter(r["category"] for r in rows))
243
print(f"Saved: {csv_path}")