Move CTF 基础
详细的环境配置教程可以看探姬师傅的教程
从0开始的签到题 - Hello CTF
我想记录一些常用命令，和报错的解决
用于测试的是Move CTF 2024的例题check in
1. 添加与切换试题网络（注意网址中不要有多余的空格，不然会报错）：
第一次进入：sui client
具体参数参考
> sui client
Config file ["/home/tj/.sui/sui_config/client.yaml"] doesn't exist, do you want to connect to a Sui Full node server [y/N]?y
Sui Full node server URL (Defaults to Sui Devnet if not specified) : https://fullnode.devnet.sui.io:443
Environment alias for [https://fullnode.devnet.sui.io:443] : moveCTF2024
Select key scheme to generate keypair (0 for ed25519, 1 for secp256k1, 2: for secp256r1):
0
Generated new keypair for address with scheme "ed25519" [0xcef64a585358ba722e0e1b860f11eb7e05eaf9347162ac6743c15cc0b60dd877]
Secret Recovery Phrase : [absent weird horn travel ghost polar jazz thank innocent funny cancel warfare]
Client for interacting with the Sui network再次添加/切换网络
sui client new-env --alias --rpc
eg.> sui client new-env --alias moveCTF_demo --rpc https://fullnode.devnet.sui.io:443
sui client switch --env
eg.> sui client switch --env moveCTF_demo 正常运行：
> sui client
Client for interacting with the Sui network
Usage: sui client [OPTIONS] [COMMAND]
Commands:
active-address Default address used for commands when none specified
active-env Default environment used for commands when none specified
addresses Obtain the Addresses managed by the client
call Call Move function
chain-identifier Query the chain identifier from the rpc endpoint
dynamic-field Query a dynamic field by its address
envs List all Sui environments
execute-signed-tx Execute a Signed Transaction. This is useful when the user prefers to sign elsewhere and
use this command to execute
gas Obtain all gas objects owned by the address
merge-coin Merge two coin objects into one coin
new-address Generate new address and keypair with keypair scheme flag {ed25519 | secp256k1 | secp256r1}
with optional derivation path, default to m/44'/784'/0'/0'/0' for ed25519 or
m/54'/784'/0'/0/0 for secp256k1 or m/74'/784'/0'/0/0 for secp256r1. Word length can be {
word12 | word15 | word18 | word21 | word24} default to word12 if not specified
new-env Add new Sui environment
object Get object info
objects Obtain all objects owned by the address
pay Pay coins to recipients following specified amounts, with input coins. Length of recipients
must be the same as that of amounts
pay-all-sui Pay all residual SUI coins to the recipient with input coins, after deducting the gas cost.
The input coins also include the coin for gas payment, so no extra gas coin is required
pay-sui Pay SUI coins to recipients following following specified amounts, with input coins. Length
of recipients must be the same as that of amounts. The input coins also include the coin
for gas payment, so no extra gas coin is required
publish Publish Move modules
split-coin Split a coin object into multiple coins
switch Switch active address and network(e.g., devnet, local rpc server)
tx-block Get the effects of executing the given transaction block
transfer Transfer object
transfer-sui Transfer SUI, and pay gas with the same SUI coin object. If amount is specified, only the
amount is transferred; otherwise the entire object is transferred
upgrade Upgrade Move modules
verify-bytecode-meter Run the bytecode verifier on the package
verify-source Verify local Move packages against on-chain packages, and optionally their dependencies
replay-transaction Replay a given transaction to view transaction effects. Set environment variable
MOVE_VM_STEP=1 to debug
replay-batch Replay transactions listed in a file
replay-checkpoint Replay all transactions in a range of checkpoints
help Print this message or the help of the given subcommand(s)
Options:
--client.config Sets the file storing the state of our user accounts (an empty one will be created if
missing)
--json Return command outputs in json format
-y, --yes
-h, --help Print help 2. 查看目前的网络环境：sui client envs
示例：
sui client envs
╭─────────────┬────────────────────────────────────┬────────╮
│ alias │ url │ active │
├─────────────┼────────────────────────────────────┼────────┤
│ moveCTF2024 │ https://fullnode.devnet.sui.io:443 │ * │
╰─────────────┴────────────────────────────────────┴────────╯3. 获取钱包地址：sui client addresses
示例：
> sui client addresses
╭───────────────┬──────────────────────────────────────────────────────────────────────────╮
│ activeAddress │ 0xcef64a585358ba722e0e1b860f11eb7e05eaf9347162ac6743c15cc0b60dd877 │
│ addresses │ ╭──────────────────────────────────────────────────────────────────────╮ │
│ │ │ 0xcef64a585358ba722e0e1b860f11eb7e05eaf9347162ac6743c15cc0b60dd877 │ │
│ │ ╰──────────────────────────────────────────────────────────────────────╯ │
╰───────────────┴──────────────────────────────────────────────────────────────────────────╯4. 获取测试币：（我使用的是Windows Powershell进行操作，不能使用curl命令，win下使用Invoke-WebRequest命令代替curl。其他平台的我暂时没有测试，可以参考探姬师傅的教程）
$body = @{
FixedAmountRequest = @{
recipient = '你的钱包地址'
}
} | ConvertTo-Json
Invoke-WebRequest -Uri 'https://faucet.devnet.sui.io/gas' -Method POST -Body $body -Headers @{
'Content-Type' = 'application/json'
}注意钱包地址里不要有空格！！！
（出现Invoke-WebRequest : 基础连接已经关闭: 连接被意外关闭。或Invoke-WebRequest : error code: 1015是因为未使用魔法或魔术回路不稳定。）
获取成功界面：
StatusCode : 201
StatusDescription : Created
Content : {"transferredGasObjects":[{"amount":10000000000,"id":"0x912044214a205f6963c7b27cc46a6785b9113c429d2
a050faae57f8d0087ff80","transferTxDigest":"G22f5qKc1aLFeVfPmE6to9zqZ4bhkAMHS5jDq6dEx8gw"}],"error":
nu...
RawContent : HTTP/1.1 201 Created
Connection: keep-alive
Access-Control-Allow-Origin: *
Vary: origin,access-control-request-method,access-control-request-headers
CF-Cache-Status: DYNAMIC
Content-Length: 203
...
Forms : {}
Headers : {[Connection, keep-alive], [Access-Control-Allow-Origin, *], [Vary, origin,access-control-request-m
ethod,access-control-request-headers], [CF-Cache-Status, DYNAMIC]...}
Images : {}
InputFields : {}
Links : {}
ParsedHtml : mshtml.HTMLDocumentClass
RawContentLength : 2035. 触发函数
语法：
Call Move function
Usage: sui client call [OPTIONS] --package --module --function --gas-budget
Options:
--package Object ID of the package, which contains the module
--module The name of the module in the package
--function Function name in module
--type-args ... Type arguments to the generic function being called. All must be specified, or the call will fail
--args ... Simplified ordered args like in the function syntax ObjectIDs, Addresses must be hex strings
--gas ID of the gas object for gas payment, in 20 bytes Hex string If not provided, a gas object with at least gas_budget value will be selected
--gas-budget Gas budget for this call
--serialize-unsigned-transaction Instead of executing the transaction, serialize the bcs bytes of the unsigned transaction data (TransactionData) using base64 encoding, and print out
the string
--serialize-signed-transaction Instead of executing the transaction, serialize the bcs bytes of the signed transaction data (SenderSignedData) using base64 encoding, and print out the
string
--json Return command outputs in json format
-h, --help Print help 本题中需要触发get_flag函数
这里获取到我们的packageId以构建触发函数：
> sui client call --function get_flag --package 0x01bbc5180d81f2fc4920ad602a6d9c0d447a85219c673eeee2a16a3b9bdf9d3f --module checkin --gas-budget 10000000
[warn] Client/Server api version mismatch, client api version : 1.15.1, server api version : 1.16.0
Transaction Digest: FcB7CsDCsW3mspcTB5nxtpJydbRXcLQRhm7HWdEJVN2f
╭──────────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Transaction Data │
├──────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Sender: 0xf1a3394e4cfbc855ffcad1774b7505eff2d87659ad135a9fecf2755b1097bb8f │
│ Gas Owner: 0xf1a3394e4cfbc855ffcad1774b7505eff2d87659ad135a9fecf2755b1097bb8f │
│ Gas Budget: 10000000 MIST │
│ Gas Price: 1000 MIST │
│ Gas Payment: │
│ ┌── │
│ │ ID: 0x144e80386b6bb8c5e2fe31fdf5299290e7b456c5782a1d11d98cd29e22e08acf │
│ │ Version: 110 │
│ │ Digest: 7yra2w3ssVADaFrX3FzG9nsZ6b4XQfPPdz9T8ULJkUsV │
│ └── │
│ │
│ Transaction Kind : Programmable │
│ Inputs: [] │
│ Commands: [ │
│ MoveCall(0x01bbc5180d81f2fc4920ad602a6d9c0d447a85219c673eeee2a16a3b9bdf9d3f::checkin::get_flag()), │
│ ] │
│ │
│ │
│ Signatures: │
│ UysHNP76g5F0y3kGcje256HLSO9uZsxTXY9JmmLPml06KzvAg7dYj46ongZAbdMn1ZlT+CByx02TE3bniIHCDg== │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────╯
╭───────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Transaction Effects │
├───────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Digest: FcB7CsDCsW3mspcTB5nxtpJydbRXcLQRhm7HWdEJVN2f │
│ Status: Success │
│ Executed Epoch: 2517 │
│ │
│ Mutated Objects: │
│ ┌── │
│ │ ID: 0x144e80386b6bb8c5e2fe31fdf5299290e7b456c5782a1d11d98cd29e22e08acf │
│ │ Owner: Account Address ( 0xf1a3394e4cfbc855ffcad1774b7505eff2d87659ad135a9fecf2755b1097bb8f ) │
│ │ Version: 111 │
│ │ Digest: 6VR24FpTNg9eqYW8TuxiKQmeNENczLK91m8b3iV1sz5t │
│ └── │
│ │
│ Gas Object: │
│ ┌── │
│ │ ID: 0x144e80386b6bb8c5e2fe31fdf5299290e7b456c5782a1d11d98cd29e22e08acf │
│ │ Owner: Account Address ( 0xf1a3394e4cfbc855ffcad1774b7505eff2d87659ad135a9fecf2755b1097bb8f ) │
│ │ Version: 111 │
│ │ Digest: 6VR24FpTNg9eqYW8TuxiKQmeNENczLK91m8b3iV1sz5t │
│ └── │
│ │
│ Gas Cost Summary: │
│ Storage Cost: 988000 │
│ Computation Cost: 1000000 │
│ Storage Rebate: 978120 │
│ Non-refundable Storage Fee: 9880 │
│ │
│ Transaction Dependencies: │
│ 95186xqFzKTmDhUXWw5oxJw2Z4pxqdB6cPDA6aFidRPE │
│ AyE5rTMnhY4CmfDomoE5vh4TwWGhxdHcJdUPjtyTPE7x │
╰───────────────────────────────────────────────────────────────────────────────────────────────────╯
╭────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Transaction Block Events │
├────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ┌── │
│ │ EventID: FcB7CsDCsW3mspcTB5nxtpJydbRXcLQRhm7HWdEJVN2f:0 │
│ │ PackageID: 0x01bbc5180d81f2fc4920ad602a6d9c0d447a85219c673eeee2a16a3b9bdf9d3f │
│ │ Transaction Module: checkin │
│ │ Sender: 0xf1a3394e4cfbc855ffcad1774b7505eff2d87659ad135a9fecf2755b1097bb8f │
│ │ EventType: 0x1bbc5180d81f2fc4920ad602a6d9c0d447a85219c673eeee2a16a3b9bdf9d3f::checkin::Flag │
│ │ ParsedJSON: │
│ │ ┌──────┬────────────────────────────────────────────────────────────────────┐ │
│ │ │ flag │ true │ │
│ │ ├──────┼────────────────────────────────────────────────────────────────────┤ │
│ │ │ user │ 0xf1a3394e4cfbc855ffcad1774b7505eff2d87659ad135a9fecf2755b1097bb8f │ │
│ │ └──────┴────────────────────────────────────────────────────────────────────┘ │
│ └── │
╰────────────────────────────────────────────────────────────────────────────────────────────────╯
╭──────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Object Changes │
├──────────────────────────────────────────────────────────────────────────────────────────────────┤
│ │
│ Mutated Objects: │
│ ┌── │
│ │ ObjectID: 0x144e80386b6bb8c5e2fe31fdf5299290e7b456c5782a1d11d98cd29e22e08acf │
│ │ Sender: 0xf1a3394e4cfbc855ffcad1774b7505eff2d87659ad135a9fecf2755b1097bb8f │
│ │ Owner: Account Address ( 0xf1a3394e4cfbc855ffcad1774b7505eff2d87659ad135a9fecf2755b1097bb8f ) │
│ │ ObjectType: 0x2::coin::Coin<0x2::sui::SUI> │
│ │ Version: 111 │
│ │ Digest: 6VR24FpTNg9eqYW8TuxiKQmeNENczLK91m8b3iV1sz5t │
│ └── │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭───────────────────────────────────────────────────────────────────────────────────────────────────╮
│ Balance Changes │
├───────────────────────────────────────────────────────────────────────────────────────────────────┤
│ ┌── │
│ │ Owner: Account Address ( 0xf1a3394e4cfbc855ffcad1774b7505eff2d87659ad135a9fecf2755b1097bb8f ) │
│ │ CoinType: 0x2::sui::SUI │
│ │ Amount: -1009880 │
│ └── │
│ │
╰───────────────────────────────────────────────────────────────────────────────────────────────────╯我们的目标数据就是 Transaction Digest: FcB7CsDCsW3mspcTB5nxtpJydbRXcLQRhm7HWdEJVN2f（示例）
将冒号后的数据输入到题目Transaction后，可获得flag
6. 查看当前地址：sui client active-addres
7. 列出当前地址拥有对象的摘要信息：sui client objects
8. 列出您提供的ID的对象信息：sui client object
