from pykeepass import PyKeePass

kp = PyKeePass('Database.kdbx', password='goblue1')

for entry in kp.entries:
    print(f"[{entry.title}]")
    print(f"  Username: {entry.username}")
    print(f"  Password: {entry.password}")
    print(f"  Notes: {entry.notes}")
    print()

[Sample Entry]
  Username: User Name
  Password: Password
  Notes: Notes

...

[flag]
  Username: the flag
  Password: wctf{1_th0ught_1t_w4s_s3cur3?}
  Notes: :3

import struct

# v4 데이터 (총 32바이트)
v4_bytes = (
    struct.pack("<Q", 0x90F2D1D01150F11) +       # v4[0]
    struct.pack("<Q", 0x1352353903521556) +      # v4[1]
    struct.pack("<Q", 4441) +                    # v4[2] (4B 유효)
    struct.pack("<Q", 0x0)                       # dummy for alignment
)

v5 = struct.pack("<I", 0x67616C66) 

password = b""

for i in range(18):
    expected = v4_bytes[i]
    mask = v5[i % 4]
    password += bytes([expected ^ mask])

print("Recovered password:", password.decode('latin1'))  

from idautils import *
from idc import *

def parse_func_offsets(ea):
    insts = list(FuncItems(ea))
    reg_map = {}      # 레지스터가 기준 주소를 가리키고 있는지 (e.g., a1)
    mem_reads = {}    # 레지스터가 메모리에서 어떤 오프셋을 읽었는지
    result = None

    for i in insts:
        mnem = print_insn_mnem(i)

        if mnem == "mov" and "[rbp+var_8]" in print_operand(i, 1):
            reg = print_operand(i, 0)
            reg_map[reg] = 0

        elif mnem == "add":
            reg = print_operand(i, 0)
            val = get_operand_value(i, 1)
            if reg in reg_map:
                reg_map[reg] += val
            elif reg in mem_reads:
                prev = mem_reads[reg]
                if isinstance(prev, tuple):
                    offset, const = prev
                else:
                    offset, const = prev, 0
                mem_reads[reg] = (offset, const + val)

        elif mnem == "sub":
            reg = print_operand(i, 0)
            val = get_operand_value(i, 1)
            if reg in mem_reads:
                prev = mem_reads[reg]
                if isinstance(prev, tuple):
                    offset, const = prev
                else:
                    offset, const = prev, 0
                mem_reads[reg] = (offset, const - val)

        elif mnem in ["movzx", "movsx"]:
            dst = print_operand(i, 0)
            src = print_operand(i, 1)
            if "byte ptr" in src:
                for reg, offset in reg_map.items():
                    if reg in src:
                        mem_reads[dst] = offset

        elif mnem == "cmp":
            op1 = print_operand(i, 0)
            op2 = print_operand(i, 1)

            def resolve(op):
                if op in mem_reads:
                    val = mem_reads[op]
                    if isinstance(val, tuple):
                        return val
                    else:
                        return (val, 0)
                return None

            val1 = resolve(op1)
            val2 = resolve(op2)

            if val1 and val2:
                offset1, const1 = val1
                offset2, const2 = val2
                result = (offset1, offset2, const2 - const1)
                break

    return result


def parse_all_funcs():
    results = []
    for i in range(240):
        name = f"func{i}"
        ea = get_name_ea_simple(name)
        if ea == BADADDR:
            print(f"[!] {name} not found.")
            continue

        res = parse_func_offsets(ea)
        if res:
            print(f"[+] {name}: {res}")
            results.append((name, *res))
        else:
            print(f"[-] {name}: no match")
    return results

parse_all_funcs()

from z3 import *

def parse_conditions_from_file(filename):
    conditions = []
    with open(filename, 'r') as f:
        for line in f:
            if line.startswith("[+]"):
                try:
                    parts = line.split(":")
                    values = parts[1].strip().strip("()").split(",")
                    a1, a2, a3 = map(int, values)
                    conditions.append((a1, a2, a3))
                except:
                    continue
    print(f"[+] Parsed {len(conditions)} conditions")
    return conditions

def solve_with_z3(conditions):
    max_index = max(max(a1, a2) for a1, a2, _ in conditions)
    max_index = max(max_index, 42) + 1

    array = [Int(f'array_{i}') for i in range(max_index)]
    s = Solver()

    # 바이트 범위 제한
    for b in array:
        s.add(b >= 0, b <= 255)

    # 조건들 추가
    for a1, a2, a3 in conditions:
        s.add(array[a1] == array[a2] + a3)

    # 초기 조건 (wctf, 마지막 문자 == 'w')
    s.add(array[0] == 119)  # 'w'
    s.add(array[1] == 99)   # 'c'
    s.add(array[2] == 116)  # 't'
    s.add(array[3] == 102)  # 'f'
    s.add(array[42] == array[0])  # array[42] == 'w'

    if s.check() == sat:
        model = s.model()
        flag_bytes = [
            model.evaluate(byte, model_completion=True).as_long()
            for byte in array
        ]

        print("[+] Flag bytes:")
        print(flag_bytes)

        print("[+] As characters:")
        flag_str = "".join(chr(b) if 32 <= b <= 126 else "." for b in flag_bytes)
        print(flag_str)

        return flag_str
    else:
        print("[-] No solution found.")
        return None

if __name__ == "__main__":
    conditions = parse_conditions_from_file("conditions.txt")
    solve_with_z3(conditions)

from pwn import *

def check_candidates(candidates,out):
    bitmask_table = {
        "cover sheet":     ("You forget to put the cover sheet", 0x0A),
        "consultant":      ("You have a meeting with a consultant", 0x16),
        "printer":         ("The printer jams", 0x18),
        "saturday":        ("Your boss tells you that you have to come in on Saturday", 0x28),
        "fire alarm":      ("The fire alarm goes off", 0xA8),
        "stapler":         ("Your cowworker asks if you have seen his stapler", 0x60),
        "quitting":        ("You think about quitting", 0x01),
    }
    
    for label, (msg, bit) in bitmask_table.items():
        if msg in out:
            candidates = [i for i in candidates if (i & bit) != 0]
        else:
            candidates = [i for i in candidates if (i & bit) == 0]
    
    return candidates

def xor_update(candidates,balance):
    candidates = [i^balance for i in candidates]
    return candidates

def calculate_goal(candidates, balance):
    candidate = candidates[0]
    while True:
        candidate ^=balance
        balance -=10
        if balance ==1337:
            break
    
    goal = 257 * candidate
    return goal

if __name__=='__main__':
    p = remote("office.kctf-453514-codelab.kctf.cloud", 1337)
    balance = 1337
    candidates = [i for i in range(256)]
    
    out = p.recvuntil(b"> ")
    print(out.decode(errors='ignore'))

    while True:
        print("-------------")
        print(candidates)
        if len(candidates)==1:
            break
        p.send(b"1\n")
        out = p.recvuntil(b"> ")
        print(out.decode(errors='ignore'))
        candidates = check_candidates(candidates,out.decode(errors='ignore'))
        balance += 10
        candidates = xor_update(candidates,balance)
        
    
    goal = calculate_goal(candidates,balance)
    print(balance)
    left = goal-balance
    
    print("[send 2]-----------------------")
    p.send(b"2\n")
    out = p.recvuntil(b"> ")
    print(out.decode(errors='ignore'))
    
    print(f"[send left {left}]-----------------------")
    p.sendline(bytes(str(left), "utf-8"))
    out = p.recvuntil(b"> ")
    print(out.decode(errors='ignore'))
    
    print("[send 1 again]-----------------------")
    p.send(b"1\n")
    out = p.recvuntil(b"> ")
    print(out.decode(errors='ignore'))
    
    print("[send 3]-----------------------")
    p.send(b"3\n")
    out = p.recvall(timeout=2)
    print(out.decode(errors='ignore'))