-
Notifications
You must be signed in to change notification settings - Fork 10
/
Copy pathmain.cpp
80 lines (74 loc) · 1.51 KB
/
main.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <syscall.h>
#include <unistd.h>
#include "obfuscate.h"
extern char **environ;
char flag[128];
char *cmd_argv[] = {
AY_OBFUSCATE("python3"), AY_OBFUSCATE("-c"),
AY_OBFUSCATE("__import__('pickle').loads(bytes.fromhex('PLACEHOLDER'))"),
flag + 5, 0};
char *py = AY_OBFUSCATE("/usr/bin/python3");
void gadgets() {
asm("syscall");
asm("pop %rax\nret");
asm("pop %rdi\nret");
asm("pop %rsi\nret");
asm("pop %rdx\nret");
}
long syc = (long)(gadgets) + 4;
long pop_rax = (long)(gadgets) + 6;
long pop_rdi = (long)(gadgets) + 8;
long pop_rsi = (long)(gadgets) + 10;
long pop_rdx = (long)(gadgets) + 12;
bool check_str(char *s) {
while (*s != 0) {
if ((*s < 20) || (*s > 127))
return false;
s++;
}
return true;
}
bool check() {
long val;
long *p = (long *)&val;
if (strncmp("AIS3{", flag, 5) != 0) {
return false;
} else if (check_str(flag)) {
p[3] = pop_rax;
p[4] = SYS_execve;
p[5] = pop_rdi;
p[6] = (long)py;
p[7] = pop_rsi;
p[8] = (long)cmd_argv;
p[9] = pop_rdx;
p[10] = (long)environ;
p[11] = syc;
return true;
}
return false;
}
__attribute__((constructor)) void before() {
struct stat sb;
if (stat(AY_OBFUSCATE("/usr/bin/python3"), &sb) != 0) {
puts("Bad OS");
exit(1);
}
if ((sb.st_mode & S_IXUSR) == 0) {
puts("Bad OS");
exit(1);
}
}
int main(int argc, char **argv) {
scanf("%s", flag);
if (!check()) {
puts("Bad");
} else {
puts("Good");
}
return 0;
}