hgame2023 week3 writeup
2024-05-09 05:37:53
WEEK3
文章目录
- WEEK3
- Reverse
- 1、kunmusic
- 2、patchme
- 3、cpp
- pwn
- 1、safe_note
- 2、large_note
- 3、note_context
- Crypto
- 1、ezDH
- 2、RSA 大冒险2
- misc
- 1、Tunnel
Reverse
1、kunmusic
小黑子，露出鸡脚了吧？
dnspy打开kmusic.dll
main中有一段：
// kmusic.Program
// Token: 0x06000016 RID: 22 RVA: 0x00002DB4 File Offset: 0x00000FB4
[STAThread]
private static void Main()
{ApplicationConfiguration.Initialize();byte[] data = Resources.data;for (int i = 0; i < data.Length; i++){byte[] array = data;int num = i;array[num] ^= 104;}Activator.CreateInstance(Assembly.Load(data).GetType("WinFormsLibrary1.Class1"), new object[]{Program.form1});Application.Run(Program.form1);
}
对资源进行了异或，将data异或处理后保存为data，同样用dnspy打开，可以看到music函数
// WinFormsLibrary1.Class1
// Token: 0x06000012 RID: 18 RVA: 0x0000218C File Offset: 0x0000038C
public void music(object sender, EventArgs e)
{if (this.num[0] + 52296 + this.num[1] - 26211 + this.num[2] - 11754 + (this.num[3] ^ 41236) + this.num[4] * 63747 + this.num[5] - 52714 + this.num[6] - 10512 + this.num[7] * 12972 + this.num[8] + 45505 + this.num[9] - 21713 + this.num[10] - 59122 + this.num[11] - 12840 + (this.num[12] ^ 21087) == 12702282 && this.num[0] - 25228 + (this.num[1] ^ 20699) + (this.num[2] ^ 8158) + this.num[3] - 65307 + this.num[4] * 30701 + this.num[5] * 47555 + this.num[6] - 2557 + (this.num[7] ^ 49055) + this.num[8] - 7992 + (this.num[9] ^ 57465) + (this.num[10] ^ 57426) + this.num[11] + 13299 + this.num[12] - 50966 == 9946829 && this.num[0] - 64801 + this.num[1] - 60698 + this.num[2] - 40853 + this.num[3] - 54907 + this.num[4] + 29882 + (this.num[5] ^ 13574) + (this.num[6] ^ 21310) + this.num[7] + 47366 + this.num[8] + 41784 + (this.num[9] ^ 53690) + this.num[10] * 58436 + this.num[11] * 15590 + this.num[12] + 58225 == 2372055 && this.num[0] + 61538 + this.num[1] - 17121 + this.num[2] - 58124 + this.num[3] + 8186 + this.num[4] + 21253 + this.num[5] - 38524 + this.num[6] - 48323 + this.num[7] - 20556 + this.num[8] * 56056 + this.num[9] + 18568 + this.num[10] + 12995 + (this.num[11] ^ 39260) + this.num[12] + 25329 == 6732474 && this.num[0] - 42567 + this.num[1] - 17743 + this.num[2] * 47827 + this.num[3] - 10246 + (this.num[4] ^ 16284) + this.num[5] + 39390 + this.num[6] * 11803 + this.num[7] * 60332 + (this.num[8] ^ 18491) + (this.num[9] ^ 4795) + this.num[10] - 25636 + this.num[11] - 16780 + this.num[12] - 62345 == 14020739 && this.num[0] - 10968 + this.num[1] - 31780 + (this.num[2] ^ 31857) + this.num[3] - 61983 + this.num[4] * 31048 + this.num[5] * 20189 + this.num[6] + 12337 + this.num[7] * 25945 + (this.num[8] ^ 7064) + this.num[9] - 25369 + this.num[10] - 54893 + this.num[11] * 59949 + (this.num[12] ^ 12441) == 14434062 && this.num[0] + 16689 + this.num[1] - 10279 + this.num[2] - 32918 + this.num[3] - 57155 + this.num[4] * 26571 + this.num[5] * 15086 + (this.num[6] ^ 22986) + (this.num[7] ^ 23349) + (this.num[8] ^ 16381) + (this.num[9] ^ 23173) + this.num[10] - 40224 + this.num[11] + 31751 + this.num[12] * 8421 == 7433598 && this.num[0] + 28740 + this.num[1] - 64696 + this.num[2] + 60470 + this.num[3] - 14752 + (this.num[4] ^ 1287) + (this.num[5] ^ 35272) + this.num[6] + 49467 + this.num[7] - 33788 + this.num[8] + 20606 + (this.num[9] ^ 44874) + this.num[10] * 19764 + this.num[11] + 48342 + this.num[12] * 56511 == 7989404 && (this.num[0] ^ 28978) + this.num[1] + 23120 + this.num[2] + 22802 + this.num[3] * 31533 + (this.num[4] ^ 39287) + this.num[5] - 48576 + (this.num[6] ^ 28542) + this.num[7] - 43265 + this.num[8] + 22365 + this.num[9] + 61108 + this.num[10] * 2823 + this.num[11] - 30343 + this.num[12] + 14780 == 3504803 && this.num[0] * 22466 + (this.num[1] ^ 55999) + this.num[2] - 53658 + (this.num[3] ^ 47160) + (this.num[4] ^ 12511) + this.num[5] * 59807 + this.num[6] + 46242 + this.num[7] + 3052 + (this.num[8] ^ 25279) + this.num[9] + 30202 + this.num[10] * 22698 + this.num[11] + 33480 + (this.num[12] ^ 16757) == 11003580 && this.num[0] * 57492 + (this.num[1] ^ 13421) + this.num[2] - 13941 + (this.num[3] ^ 48092) + this.num[4] * 38310 + this.num[5] + 9884 + this.num[6] - 45500 + this.num[7] - 19233 + this.num[8] + 58274 + this.num[9] + 36175 + (this.num[10] ^ 18568) + this.num[11] * 49694 + (this.num[12] ^ 9473) == 25546210 && this.num[0] - 23355 + this.num[1] * 50164 + (this.num[2] ^ 34618) + this.num[3] + 52703 + this.num[4] + 36245 + this.num[5] * 46648 + (this.num[6] ^ 4858) + (this.num[7] ^ 41846) + this.num[8] * 27122 + (this.num[9] ^ 42058) + this.num[10] * 15676 + this.num[11] - 31863 + this.num[12] + 62510 == 11333836 && this.num[0] * 30523 + (this.num[1] ^ 7990) + this.num[2] + 39058 + this.num[3] * 57549 + (this.num[4] ^ 53440) + this.num[5] * 4275 + this.num[6] - 48863 + (this.num[7] ^ 55436) + (this.num[8] ^ 2624) + (this.num[9] ^ 13652) + this.num[10] + 62231 + this.num[11] + 19456 + this.num[12] - 13195 == 13863722){int[] array = new int[]{132,47,180,7,216,45,68,6,39,246,124,2,243,137,58,172,53,200,99,91,83,13,171,80,108,235,179,58,176,28,216,36,11,80,39,162,97,58,236,130,123,176,24,212,56,89,72};string text = "";for (int i = 0; i < array.Length; i++){text += ((char)(array[i] ^ this.num[i % this.num.Length])).ToString();}new SoundPlayer(Resources.过年鸡).Play();MessageBox.Show(text);}
}结合程序，应该是每个按钮点击到一定次数，才会触发弹出flag
判断条件可以z3求解：
from z3 import *
num = [ BitVec(f'num[{i}]',32) for i in range(13)]s = Solver()s.add(num[0] + 52296 + num[1] - 26211 + num[2] - 11754 + (num[3] ^ 41236) + num[4] * 63747 + num[5] - 52714 + num[6] - 10512 + num[7] * 12972 + num[8] + 45505 + num[9] - 21713 + num[10] - 59122 + num[11] - 12840 + (num[12] ^ 21087) == 12702282 )
s.add(num[0] - 25228 + (num[1] ^ 20699) + (num[2] ^ 8158) + num[3] - 65307 + num[4] * 30701 + num[5] * 47555 + num[6] - 2557 + (num[7] ^ 49055) + num[8] - 7992 + (num[9] ^ 57465) + (num[10] ^ 57426) + num[11] + 13299 + num[12] - 50966 == 9946829 )
s.add(num[0] - 64801 + num[1] - 60698 + num[2] - 40853 + num[3] - 54907 + num[4] + 29882 + (num[5] ^ 13574) + (num[6] ^ 21310) + num[7] + 47366 + num[8] + 41784 + (num[9] ^ 53690) + num[10] * 58436 + num[11] * 15590 + num[12] + 58225 == 2372055 )
s.add(num[0] + 61538 + num[1] - 17121 + num[2] - 58124 + num[3] + 8186 + num[4] + 21253 + num[5] - 38524 + num[6] - 48323 + num[7] - 20556 + num[8] * 56056 + num[9] + 18568 + num[10] + 12995 + (num[11] ^ 39260) + num[12] + 25329 == 6732474 )
s.add(num[0] - 42567 + num[1] - 17743 + num[2] * 47827 + num[3] - 10246 + (num[4] ^ 16284) + num[5] + 39390 + num[6] * 11803 + num[7] * 60332 + (num[8] ^ 18491) + (num[9] ^ 4795) + num[10] - 25636 + num[11] - 16780 + num[12] - 62345 == 14020739 )
s.add(num[0] - 10968 + num[1] - 31780 + (num[2] ^ 31857) + num[3] - 61983 + num[4] * 31048 + num[5] * 20189 + num[6] + 12337 + num[7] * 25945 + (num[8] ^ 7064) + num[9] - 25369 + num[10] - 54893 + num[11] * 59949 + (num[12] ^ 12441) == 14434062 )
s.add(num[0] + 16689 + num[1] - 10279 + num[2] - 32918 + num[3] - 57155 + num[4] * 26571 + num[5] * 15086 + (num[6] ^ 22986) + (num[7] ^ 23349) + (num[8] ^ 16381) + (num[9] ^ 23173) + num[10] - 40224 + num[11] + 31751 + num[12] * 8421 == 7433598 )
s.add(num[0] + 28740 + num[1] - 64696 + num[2] + 60470 + num[3] - 14752 + (num[4] ^ 1287) + (num[5] ^ 35272) + num[6] + 49467 + num[7] - 33788 + num[8] + 20606 + (num[9] ^ 44874) + num[10] * 19764 + num[11] + 48342 + num[12] * 56511 == 7989404 )
s.add((num[0] ^ 28978) + num[1] + 23120 + num[2] + 22802 + num[3] * 31533 + (num[4] ^ 39287) + num[5] - 48576 + (num[6] ^ 28542) + num[7] - 43265 + num[8] + 22365 + num[9] + 61108 + num[10] * 2823 + num[11] - 30343 + num[12] + 14780 == 3504803 )
s.add(num[0] * 22466 + (num[1] ^ 55999) + num[2] - 53658 + (num[3] ^ 47160) + (num[4] ^ 12511) + num[5] * 59807 + num[6] + 46242 + num[7] + 3052 + (num[8] ^ 25279) + num[9] + 30202 + num[10] * 22698 + num[11] + 33480 + (num[12] ^ 16757) == 11003580 )
s.add(num[0] * 57492 + (num[1] ^ 13421) + num[2] - 13941 + (num[3] ^ 48092) + num[4] * 38310 + num[5] + 9884 + num[6] - 45500 + num[7] - 19233 + num[8] + 58274 + num[9] + 36175 + (num[10] ^ 18568) + num[11] * 49694 + (num[12] ^ 9473) == 25546210 )
s.add(num[0] - 23355 + num[1] * 50164 + (num[2] ^ 34618) + num[3] + 52703 + num[4] + 36245 + num[5] * 46648 + (num[6] ^ 4858) + (num[7] ^ 41846) + num[8] * 27122 + (num[9] ^ 42058) + num[10] * 15676 + num[11] - 31863 + num[12] + 62510 == 11333836 )
s.add(num[0] * 30523 + (num[1] ^ 7990) + num[2] + 39058 + num[3] * 57549 + (num[4] ^ 53440) + num[5] * 4275 + num[6] - 48863 + (num[7] ^ 55436) + (num[8] ^ 2624) + (num[9] ^ 13652) + num[10] + 62231 + num[11] + 19456 + num[12] - 13195 == 13863722 )
print(s.check())
m=s.model()
print(m)然后计算flag
num = [0]*13
num[12] = 3221225605
num[1] = 221970504
num[2] = 2480046293
num[4] = 189
num[0] = 2147483884
num[5] = 86
num[6] = 1282375742
num[7] = 53
num[8] = 120
num[9] = 3531800775
num[10] = 2147483663
num[11] = 2147483741
num[3] = 106c=[132, 47, 180, 7, 216, 45, 68, 6, 39, 246, 124, 2, 243, 137, 58, 172, 53, 200, 99, 91, 83, 13, 171, 80, 108, 235, 179, 58, 176, 28, 216, 36, 11, 80, 39, 162, 97, 58, 236, 130, 123, 176, 24, 212, 56, 89, 72]for i in range(len(c)):c[i] ^= num[i%13]c[i] &=0x7f
print(bytes(c))
2、patchme
不会pwn的re手不是一个好CTFer！游戏规则：修复程序中的二进制安全漏洞，要求能严格执行原程序的正常功能且不变动文件大小，如果修复成功，在运行后输入任何内容即可输出flag。附件更新，增加部分源码以作提示：https://share.weiyun.com/Kj85naWl
main函数
__int64 __fastcall main(int a1, char **a2, char **a3)
{char format[24]; // [rsp+10h] [rbp-20h] BYREFunsigned __int64 v5; // [rsp+28h] [rbp-8h]v5 = __readfsqword(0x28u);dword_4028 = a1;qword_4020 = (__int64)a2;gets(format);printf(format);return 0LL;
}
gets存在溢出，题目要求是修复程序，然后运行会打印flag，那程序中也不然有flag。。。main中没涉及，那只能是在main之前找找，init_array发现有函数先执行了sub_1887
.init_array:0000000000003D00 E0 13 00 00 00 00 00 00 off_3D00 dq offset sub_13E0 ; DATA XREF: LOAD:0000000000000168↑o
.init_array:0000000000003D00 ; LOAD:00000000000002F0↑o
.init_array:0000000000003D00 ; init+6↑o
.init_array:0000000000003D08 87 18 00 00 00 00 00 00 dq offset sub_1887
退出时fini_array，执行loc_14C6
.fini_array:0000000000003D10 assume cs:_fini_array
.fini_array:0000000000003D10 A0 13 00 00 00 00 00 00 off_3D10 dq offset sub_13A0 ; DATA XREF: init+1D↑o
.fini_array:0000000000003D18 C6 14 00 00 00 00 00 00 dq offset loc_14C6
.fini_array:0000000000003D18 _fini_array ends
进入到这里sub_1887，程序会修改loc_14C6函数的代码：
int sub_1887()
{_BYTE *v0; // raxint v2; // [rsp+Ch] [rbp-1B4h] BYREFint j; // [rsp+10h] [rbp-1B0h]int fd; // [rsp+14h] [rbp-1ACh]char *i; // [rsp+18h] [rbp-1A8h]char buf[408]; // [rsp+20h] [rbp-1A0h] BYREFunsigned __int64 v7; // [rsp+1B8h] [rbp-8h]v7 = __readfsqword(0x28u);fd = open("/proc/self/status", 0);read(fd, buf, 0x190uLL);for ( i = buf; *i != 84 || i[1] != 114 || i[2] != 97 || i[3] != 99 || i[4] != 101 || i[5] != 114; ++i );i += 11;__isoc99_sscanf(i, &unk_2008, &v2);if ( v2 )exit(0);LODWORD(v0) = mprotect((void *)((unsigned __int64)&loc_14C6 & 0xFFFFFFFFFFFFF000LL), 0x3000uLL, 7);for ( j = 0; j <= 960; ++j ){v0 = (char *)&loc_14C6 + j;*v0 ^= 0x66u;}return (int)v0;
}
取出loc_14C6中的数据进行异或处理后patch回去 这样就可以看到loc_14C6处的代码，同时sub_1887处把异或处理nop掉：
int sub_1887()
{_BYTE *v0; // raxint v2; // [rsp+Ch] [rbp-1B4h] BYREFint j; // [rsp+10h] [rbp-1B0h]int fd; // [rsp+14h] [rbp-1ACh]char *i; // [rsp+18h] [rbp-1A8h]char buf[408]; // [rsp+20h] [rbp-1A0h] BYREFunsigned __int64 v7; // [rsp+1B8h] [rbp-8h]v7 = __readfsqword(0x28u);fd = open("/proc/self/status", 0);read(fd, buf, 0x190uLL);for ( i = buf; *i != 84 || i[1] != 114 || i[2] != 97 || i[3] != 99 || i[4] != 101 || i[5] != 114; ++i );i += 11;__isoc99_sscanf(i, &unk_2008, &v2);LODWORD(v0) = mprotect((void *)((unsigned __int64)sub_14C6 & 0xFFFFFFFFFFFFF000LL), 0x3000uLL, 7);for ( j = 0; j <= 960; ++j ){v0 = (char *)sub_14C6 + j;*v0 = *v0;}return (int)v0;
}
再进入sub_14C6，里面有判断条件，写入数据再读出来，判断是不是一致，把判断分支也patch一下，直接进入到最后打印flag即可：
int sub_14C6()
{int result; // eax__WAIT_STATUS stat_loc; // [rsp+Ch] [rbp-2C4h] BYREFint i; // [rsp+14h] [rbp-2BCh]__off_t st_size; // [rsp+18h] [rbp-2B8h]int pipedes[2]; // [rsp+20h] [rbp-2B0h] BYREFint v5[2]; // [rsp+28h] [rbp-2A8h] BYREFchar *argv[4]; // [rsp+30h] [rbp-2A0h] BYREFstruct stat stat_buf; // [rsp+50h] [rbp-280h] BYREF__int64 v8[5]; // [rsp+E0h] [rbp-1F0h]int v9; // [rsp+108h] [rbp-1C8h]__int16 v10; // [rsp+10Ch] [rbp-1C4h]char v11; // [rsp+10Eh] [rbp-1C2h]__int64 v12[5]; // [rsp+110h] [rbp-1C0h]int v13; // [rsp+138h] [rbp-198h]__int16 v14; // [rsp+13Ch] [rbp-194h]char v15; // [rsp+13Eh] [rbp-192h]char buf[80]; // [rsp+140h] [rbp-190h] BYREFchar s1[8]; // [rsp+190h] [rbp-140h] BYREF__int64 v18; // [rsp+198h] [rbp-138h]char v19[280]; // [rsp+1A0h] [rbp-130h] BYREFint v20; // [rsp+2B8h] [rbp-18h]unsigned __int64 v21; // [rsp+2C8h] [rbp-8h]v21 = __readfsqword(0x28u);result = dword_4028;if ( dword_4028 <= 1 ){pipe(pipedes);pipe(v5);if ( fork() ){close(pipedes[0]);close(v5[1]);HIDWORD(stat_loc.__iptr) = 0;while ( SHIDWORD(stat_loc.__iptr) <= 35 ){buf[2 * HIDWORD(stat_loc.__iptr)] = 37;buf[2 * HIDWORD(stat_loc.__iptr)++ + 1] = 110;}buf[72] = 10;buf[73] = 0;write(pipedes[1], buf, 0x4AuLL);*(_QWORD *)s1 = 0LL;v18 = 0LL;memset(v19, 0, sizeof(v19));v20 = 0;read(v5[0], s1, 0x12CuLL);wait((__WAIT_STATUS)&stat_loc);strncmp(s1, buf, 0x14uLL);v8[0] = 0x5416D999808A28FALL;v8[1] = 0x588505094953B563LL;v8[2] = 0xCE8CF3A0DC669097LL;v8[3] = 0x4C5CF3E854F44CBDLL;v8[4] = 0xD144E49916678331LL;v9 = -631149652;v10 = -17456;v11 = 85;v12[0] = 0x3B4FA2FCEDEB4F92LL;v12[1] = 0x7E45A6C3B67EA16LL;v12[2] = 0xAFE1ACC8BF12D0E7LL;v12[3] = 0x132EC3B7269138CELL;v12[4] = 0x8E2197EB7311E643LL;v13 = -1370223935;v14 = -13899;v15 = 40;result = putchar(10);for ( i = 0; i <= 46; ++i )result = putchar((char)(*((_BYTE *)v8 + i) ^ *((_BYTE *)v12 + i)));}else{fflush(stdin);close(pipedes[1]);close(v5[0]);dup2(pipedes[0], 0);dup2(v5[1], 1);dup2(v5[1], 2);argv[0] = *(char **)qword_4020;argv[1] = "1";argv[2] = 0LL;sub_1AA0(*(char **)qword_4020, &stat_buf);st_size = stat_buf.st_size;if ( stat_buf.st_size == 14472 ){return execve(*(const char **)qword_4020, argv, 0LL);}else{puts("\nyou cannot modify the file size");return 0;}}}return result;
}
保存程序，运行，任意输入，打印flag
wz@u2204:/mnt/d/ctf/ti/hgame2023/week3/re-patchme$ ./patchme
123
123
hgame{You_4re_a_p@tch_master_0r_reverse_ma5ter}
3、cpp
C++是一门非常好的语言，他好就好在了逆向比较难
hgame2023 week3 writeup相关推荐
- hgame2023 week1 writeup
#WEEK1 文章目录 RE 1.re-test_your_IDA 2.re-easyasm 3.re-easyenc 4.re-a_cup_of_tea 5.re-encode pwn 1.test ...
- BUUCTF NewStarCTF 公开赛赛道Week3 Writeup
文章目录 WEEK3 MISC Whats HTTP WebShell! qsdz's girlfriend 3 Yesec no drumsticks 3 混沌的图像 WEB BabySSTI_On ...
- hgame2023 week2 writeup
WEEK2 文章目录 WEEK2 web 1.Git Leakage 2.v2board 3.Designer RE 1.before_main 2.stream 3.VidarCamera 4.ma ...
- HGame 2023 Week3 部分Writeup
文章同时发布于我的博客:https://blog.vvbbnn00.cn/archives/hgame2023week3-bu-fen-writeup 本周在迎新春,走亲戚(真的很忙),外加题目难度增 ...
- NewStarCTF 公开赛赛道week3 web writeup
BabySSTI_One 只有一点点过滤 直接附上payload: name={{lipsum.__globals__['__builtins__']['eval']("__import__ ...
- 2021年中国工业互联网安全大赛核能行业赛道writeup之usb流量分析
目录 一.USB协议 二.键盘流量 三.鼠标流量 四.writeup 附件题:usb流量分析 题目描述: 具体描述忘记了o(╯□╰)o 大概意思是有个U盘插到电脑上,然后经过一些操作导致该电脑重启了. ...
- 2021年中国工业互联网安全大赛核能行业赛道writeup之鱿鱼游戏
目录 一.尝试 二.Writeup 附加题 鱿鱼游戏(来自最近一部很火的韩剧) 题目描述: 小王由于操作不规范,误将不明U盘插入到上位机中,导致上位机中的某些关键文件被加密,但攻击者在U盘中还留下了一 ...
- 2018湖湘杯海选复赛Writeup
2018湖湘杯Writeup 0x01 签到题 0x02 MISC Flow 0x03 WEB Code Check 0x04 WEB Readflag 0x05 WEB XmeO 0x06 Reve ...
- php upload ctf,强网杯CTF防御赛ez_upload Writeup
这是强网杯拟态防御线下赛遇到的web题目,本来是不打算分享Writeup的,但是由于问的人很多,于是这里分享给大家. ez_upload这题算是非常经典的堆叠black trick的题目,算是比较典型 ...
最新文章
- sort,uniq,fmt,wc,提取开头和结尾的命令的使用
- Fetch API HTTP请求实用指南
- Machine Learning Yearning book draft - 读记（前14章）
- 20155230 2016-2017-2《Java程序设计》课程总结
- ActiveMQ实现负载均衡+高可用部署方案 -转载
- android无线投屏到win,无线投影仪怎么连接，看过教程，原来操作这么简单！
- sigmoid/softmax指数运算溢出问题的解决方法
- 华为华三学习工具模拟器安装教 程（ENSP与HCL）
- java基础总结(七十)--Java8中的parallelStream的坑
- 鼎捷E10视频教程合集19大模块
- Python3 获取法定节假日
- zyt-Linux云计算
- 高并发累加器 Striped64
- 高等数学（第七版）同济大学 习题1-3 个人解答
- 音频提取 4K YouTube to MP3
- 【建议收藏】一文了解FPC柔性电路板（5.29更新）
- 第三方支付-核心交易之商户结算设计
- python elementtree乱码_Python中使用ElementTree解析xml
- javaScript 美化radio
- (附源码)springboot图书管理系统 毕业设计 160934