#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <signal.h>
#include <sys/stat.h>
#include <fcntl.h>

// gcc -o level2 level2.c -fno-stack-protector -z execstack -mpreferred-stack-boundary=2

unsigned int secret;
int sockfd;
int newsockfd;

void getFlag(int sock)
{
  char tmp[64];

  int fd = open("flag.txt", O_RDONLY);
  if (fd < 0)
    exit(EXIT_FAILURE);
  
  bzero(tmp, sizeof(tmp));
  read(fd, tmp, sizeof(tmp));
  
  write(sock, "Flag: ", 7);
  write(sock, tmp, strlen(tmp));

  close(fd);
}

int vuln(int sock)
{
  int ret = 0xdeadbeef;
  unsigned int cookie = secret;
  char tmp[32] = {'\0'};
  
  bzero(tmp, sizeof(tmp));
  read(sock, tmp, sizeof(tmp)+20);

  if(cookie!=secret)
  {
    write(sock, "It's not my cookie :(\n", 22);
    exit(EXIT_FAILURE);
  }

  return ret;
}

void sigintHandler(int sig)
{
  if (sig == SIGINT)
  {
    while (close(sockfd));

    printf("Closed server socket\n");
    exit(EXIT_FAILURE);
  }
}

void sigsegvHandler(int sig)
{
  if (sig == SIGSEGV)
  {
    write(newsockfd, "Server error\n", 13);
    close(newsockfd);
    
    exit(EXIT_FAILURE);
  }
}

void ERROR(char* err)
{
  perror(err);
  exit(EXIT_FAILURE);
}

int main(int argc, char *argv[])
{
  if(argc != 2) {
    printf("%s portno \n", argv[0]);
    exit(EXIT_FAILURE);
  }

  srand(time(NULL));
  secret = rand();
  
  int portno, clilen, n;
  int pid;
  char *clientIP;
  struct sockaddr_in serv_addr, cli_addr;

  sockfd = socket(AF_INET, SOCK_STREAM, 0);
  if (sockfd < 0)
    ERROR("socket");

  
  // server's listening port
  portno = atoi(argv[1]);  

  bzero((char *) &serv_addr, sizeof(serv_addr));
  serv_addr.sin_family = AF_INET;
  serv_addr.sin_port = htons(portno);
  serv_addr.sin_addr.s_addr = INADDR_ANY;

  if (bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0)
    ERROR("bind");

  listen(sockfd, 5);


  // kill all child processes that terminated
  signal(SIGCHLD, SIG_IGN);
  signal(SIGINT, (void*)sigintHandler);
  signal(SIGSEGV, (void*)sigsegvHandler);


  while (1)
  {
    clilen = sizeof(cli_addr);
    if ( (newsockfd = accept(sockfd, (struct sockaddr *) &cli_addr, &clilen)) > 0 )
    {
      pid = fork();

      if (pid == 0)
      {
        while(close(sockfd));

        void (*foo)(int);

        foo = vuln(newsockfd);
        
        // mistake here?
        foo(argc);

        close(newsockfd);
        exit(1);
      }
      else if ( pid > 0)
      {
        close(newsockfd);
      }
    }
  }
  return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <signal.h>
#include <sys/stat.h>
#include <fcntl.h>

// gcc -z execstack -o level3.hard level3.hard.c -fno-stack-protector

int sockfd;
int newsockfd;

char getFlag[] ="\xeb\x0a\x5b\x83\xc3\x0a\x31\xc9\xb1\x15\xeb\x05\xe8\xf1\xff
\xff\xff\x31\x3b\x49\x83\xc3\x04\x85\xc9\x75\xf6\x69\xe5\xa9\x7e\xd9\x94\x6b\xe0
\xdd\x46\x9c\xcb\x5a\x18\x9c\xc2\x27\x9d\x3e\x3a\x23\x2c\x6d\x88\x06\x3d\x24\x0
f\x66\x5c\x2e\xf2\xe2\x68\x5a\xbb\xe9\x94\x4c\x3a\x38\xaf\x82\xc6\x6a\x9e\x69\x2b
\x63\xee\x9c\xcb\x5a\x19\x60\x8b\xdb\xdd\x1d\x0a\xdb\xc6\x60\x8b\x02\xd9\x52\xf4
\x15\x7b\xc1\x6a\x8d\x30\xc5\x6a\x98\x79\x83\x7f\x92\x69\xad";

int sendFlag(int sock)
{
  char tmp[16];
  
  bzero(tmp, sizeof(tmp));
  read(sock, tmp, sizeof(tmp)+16);

  write(sock, tmp, strlen(tmp));

}

void sigintHandler(int sig)
{
  if (sig == SIGINT)
  {
    while (close(sockfd));

    printf("Closed server socket\n");
    exit(EXIT_FAILURE);
  }
}

void sigsegvHandler(int sig)
{
  if (sig == SIGSEGV)
  {
    write(newsockfd, "Server error\n", 13);
    close(newsockfd);
    
    exit(EXIT_FAILURE);
  }
}

void ERROR(char* err)
{
  perror(err);
  exit(EXIT_FAILURE);
}

int main(int argc, char *argv[])
{
  if(argc != 2) {
    printf("%s portno \n", argv[0]);
    exit(EXIT_FAILURE);
  }

  int portno, clilen, n;
  int pid;
  char *clientIP;
  struct sockaddr_in serv_addr, cli_addr;

  sockfd = socket(AF_INET, SOCK_STREAM, 0);
  if (sockfd < 0)
    ERROR("socket");

  
  // server's listening port
  portno = atoi(argv[1]);  

  bzero((char *) &serv_addr, sizeof(serv_addr));
  serv_addr.sin_family = AF_INET;
  serv_addr.sin_port = htons(portno);
  serv_addr.sin_addr.s_addr = INADDR_ANY;

  if (bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0)
    ERROR("bind");

  listen(sockfd, 5);


  // kill all child processes that terminated
  signal(SIGCHLD, SIG_IGN);
  signal(SIGINT, (void*)sigintHandler);
  signal(SIGSEGV, (void*)sigsegvHandler);


  while (1)
  {
    clilen = sizeof(cli_addr);
    if ( (newsockfd = accept(sockfd, (struct sockaddr *) &cli_addr, &clilen)) > 0 )
    {
      pid = fork();

      if (pid == 0)
      {
        while(close(sockfd));

        sendFlag(newsockfd);
        

        close(newsockfd);
        exit(1);
      }
      else if ( pid > 0)
      {
        close(newsockfd);
      }
    }
  }
  return 0;
}