angr-ctf

angr 的项目地址

https://github.com/jakespringer/angr_ctf

angr实战

00

拖到IDA

就是输入正确的指令才能通关

这次试一下用angr来解题

goahead@DESKTOP-8KORQ75:/mnt/d/CTF/angr/angr_ctf-master/dist$ workon angr
(angr) goahead@DESKTOP-8KORQ75:/mnt/d/CTF/angr/angr_ctf-master/dist$ python
Python 3.6.9 (default, Mar 10 2023, 16:46:00)
[GCC 8.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import angr
>>> p = angr.Project("./00_angr_find")		#创建一个工程名
>>> init_state = p.factory.entry_state()	#给它初始化状态为从入口点开始
>>> sm = p.factory.simulation_manager(init_state)	#让angr执行
>>> sm.explore(find = 0x08048678)			# 给它探索的目的地，也就是IDA中分析到的“good job”
WARNING | 2023-11-17 14:12:29,194 | angr.storage.memory_mixins.default_filler_mixin | The program is accessing register with an unspecified value. This could indicate unwanted behavior.
WARNING | 2023-11-17 14:12:29,194 | angr.storage.memory_mixins.default_filler_mixin | angr will cope with this by generating an unconstrained symbolic variable and continuing. You can resolve this by:
WARNING | 2023-11-17 14:12:29,195 | angr.storage.memory_mixins.default_filler_mixin | 1) setting a value to the initial state
WARNING | 2023-11-17 14:12:29,195 | angr.storage.memory_mixins.default_filler_mixin | 2) adding the state option ZERO_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to make unknown regions hold null
WARNING | 2023-11-17 14:12:29,195 | angr.storage.memory_mixins.default_filler_mixin | 3) adding the state option SYMBOL_FILL_UNCONSTRAINED_{MEMORY,REGISTERS}, to suppress these messages.
WARNING | 2023-11-17 14:12:29,195 | angr.storage.memory_mixins.default_filler_mixin | Filling register edi with 4 unconstrained bytes referenced from 0x80486b1 (__libc_csu_init+0x1 in 00_angr_find (0x80486b1))
WARNING | 2023-11-17 14:12:29,196 | angr.storage.memory_mixins.default_filler_mixin | Filling register ebx with 4 unconstrained bytes referenced from 0x80486b3 (__libc_csu_init+0x3 in 00_angr_find (0x80486b3))
WARNING | 2023-11-17 14:12:30,087 | angr.storage.memory_mixins.default_filler_mixin | Filling memory at 0x7ffeff60 with 4 unconstrained bytes referenced from 0x817e690 (strcmp+0x0 in libc.so.6 (0x7e690))
<SimulationManager with 1 active, 16 deadended, 1 found>
>>> sm.found[0]
<SimState @ 0x8048678>
>>> found_state = sm.found[0]
>>> found_state.posix.dumps(0)
b'JXWVXRKX'
>>> found_state.posix.dumps(1)
b'Enter the password: '
##  state.posix.dumps (0) 代表该状态程序的所有输入， state.posix.dumps (1) 代表该状态程序的所有输出。

所以输入JXWVXRKX就可以通关

goahead@DESKTOP-8KORQ75:/mnt/d/CTF/angr/angr_ctf-master/dist$ ./00_angr_find
Enter the password: JXWVXRKX
Good Job.

常规解法

letter_list = ['J', 'A', 'C', 'E', 'J', 'G', 'C', 'S']

def reverse_operation(value, i):
    return chr((value - 65 - 3 * i) % 26 + 65)

# 反向计算得到字母数组 s[8]
s = [reverse_operation(ord(letter), i) for i, letter in enumerate(letter_list)]

print("原始字母数组:", letter_list)
print("通过反向运算得到的字母数组:", ''.join(s))

01

拖到IDA,看到一个函数maybe_good,打开

很显然，我们想要的就是0x080485E0

执行程序

发现和00类似

直接使用angr

(angr) goahead@DESKTOP-8KORQ75:/mnt/d/CTF/angr/angr_ctf-master/dist$ workon angr
(angr) goahead@DESKTOP-8KORQ75:/mnt/d/CTF/angr/angr_ctf-master/dist$ python
Python 3.6.9 (default, Mar 10 2023, 16:46:00)
[GCC 8.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import angr
>>> p = p.angr.Project("./01_angr_avoid")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
NameError: name 'p' is not defined
>>> p = angr.Project("./01_angr_avoid")
>>> init_state=p.factory.entry_state()
>>> sm = p.factory.simulation_manager(init_state)
>>> sm.explore(find=0x080485E0,avoid=0x080485F2) #find的值就是要让angr到达的地址值，而avoid的值是不让angr到达的地址值

>>> found_state = sm.found[0]
>>> found_state.posix.dumps(0)
b'HUJOZMYS'
>>> found_state.posix.dumps(1)
b'Enter the password: '

故输入HUJOZMYS即可通关

02

观察有多个地方输出“Good job”

使用脚本：

# It is very useful to be able to search for a state that reaches a certain
# instruction. However, in some cases, you may not know the address of the
# specific instruction you want to reach (or perhaps there is no single
# instruction goal.) In this challenge, you don't know which instruction
# grants you success. Instead, you just know that you want to find a state where
# the binary prints "Good Job."
#
# Angr is powerful in that it allows you to search for a states that meets an
# arbitrary condition that you specify in Python, using a predicate you define
# as a function that takes a state and returns True if you have found what you
# are looking for, and False otherwise.

import angr
import sys

def main(argv):
  path_to_binary = "./02_angr_find_condition"
  project = angr.Project(path_to_binary)
  initial_state = project.factory.entry_state()
  simulation = project.factory.simgr(initial_state)

  def is_successful(state):		#判断当前状态能否使程序输出 Good Job，然后返回 True or False，
    stdout_output = state.posix.dumps(sys.stdout.fileno()) #把标准输出赋值给 stdout_output ，那不是字符串而是一个bytes 对象
    if b'Good Job.' in stdout_output:  #  要使用 b'Good Job.' 替代 Good Job. 检查是否输出了字符串 Good Job.
      return True  # (3)
    else:
      return False

  def should_abort(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    if b'Try again.' in stdout_output:
      return True
    else:
      return False

  simulation.explore(find=is_successful, avoid=should_abort)

  if simulation.found:
    solution_state = simulation.found[0]
    print(solution_state.posix.dumps(sys.stdin.fileno()))
  else:
    raise Exception('Could not find the solution')

if __name__ == '__main__':
  main(sys.argv)

输出结果为：b'HETOBRCU'

03 寄存器符号化

发现要输入多个参数（3个）

则我们直接跳过输入，让angr直接从0x8048980 处开始执行

start_address = 0x08048980 # :integer (probably hexadecimal)
initial_state = project.factory.blank_state(addr=start_address)
#这次使用 blank_state() 方法替代了 entry_state() 。通过把 addr=start_address 传递给 blank_state() 

观察反汇编，使用eax,ebx,edx,进行传参，故位数为32位

用 claripy 通过 BVS() 方法生成三个位向量。这个方法需要两个参数：第一个参数表示符号名，第二个参数表示这个符号的长度 单位bit。因为符号值都保存在寄存器里，并且寄存器都是32位的，所以位向量的大小也需要是32位的。

password0_size_in_bits = 32 # :integer
password0 = claripy.BVS('password0', password0_size_in_bits)
password1 = claripy.BVS('password1', password0_size_in_bits)
password2 = claripy.BVS('password2', password0_size_in_bits)

现在我们已经创建了三个符号位向量，现在就把他们赋值给 eax,ebx,edx。我准备修改先前创建的状态 initial_state，并更新寄存器的内容，幸运的是，angr提供了一个非常智能的方法：

initial_state.regs.eax = password0
initial_state.regs.ebx = password1
initial_state.regs.edx = password2

现在我们准备跟以前一样定义 find , avoid 状态。

simulation = project.factory.simgr(initial_state) 

def is_successful(state):
  stdout_output = state.posix.dumps(sys.stdout.fileno())
  if b'Good Job.\n' in stdout_output:
    return True
  else: return False

def should_abort(state):
  stdout_output = state.posix.dumps(sys.stdout.fileno())
  if b'Try again.\n' in  stdout_output:
    return True
  else: return False 

simulation.explore(find=is_successful, avoid=should_abort)

下面就是打印解了。

if simulation.found:
    solution_state = simulation.found[0]

    # Solve for the symbolic values. If there are multiple solutions, we only
    # care about one, so we can use eval, which returns any (but only one)
    # solution. Pass eval the bitvector you want to solve for.
    # (!) NOTE: state.se is deprecated, use state.solver (it's exactly the same).
    solution0 = format(solution_state.solver.eval(password0), 'x') 
    # 我们根据注入的三个符号值调用求解引擎的 eval()方法； format() 方法格式化解并去掉16进制的 “0x”。
    solution1 = format(solution_state.solver.eval(password1), 'x')
    solution2 = format(solution_state.solver.eval(password2), 'x')

    # Aggregate and format the solutions you computed above, and then print
    # the full string. Pay attention to the order of the integers, and the
    # expected base (decimal, octal, hexadecimal, etc).
    
    #重组3个解，组合为一个字符串，然后打印出来。
    solution = solution0 + " " + solution1 + " " + solution2 # (2)
    print("[+] Success! Solution is: {}".format(solution))
  else:
    raise Exception('Could not find the solution')

if __name__ == '__main__':
  main(sys.argv)

04 符号化栈

手搓一下

F5反汇编进入 handle_user()函数

发现只要将输入的两个数分别与另外两个数进行异或操作，再与两个数比较就能得到正确答案

因此，只需将最终要比较的数分别和那两个数异或就能得到输入（两次异或等于不操作）

使用angr

因为我们要跳过scanf,故call scanf 下面的add esp,10h（平衡堆栈）我们也不用执行

所以，从下一行 0x08048697开始执行

import angr
import claripy
import sys

def main(argv):
    bin_path = "./04_angr_symbolic_stack"
    p = angr.Project(bin_path)
    
    start_addr = 0x08048697
    init_state = p.factory.blank_state(addr = start_addr)

用 claripy 通过 BVS() 方法生成两个个位向量。

    #ebp = esp
    init_state.regs.esp = init_state.reg.esp
    
    password0 = claripy.BVS('password0',32)
    password1= claripy.BVS('password0',32)
    
    #因为他push 两个参数为 [ebp-0Ch]和[ebp-10h]，而栈的地址是向下增长的
 	#一个参数大小为4字节，所以padding 的位置为0x0C-4 = 0x08
    padding_length_in_bytes = 0x08
    #提升堆栈
    initial_state.regs.esp -= padding_length_in_bytes
    #push password0
  	initial_state.stack_push(password0)  
    #push password1
  	initial_state.stack_push(password1)
    
    sm = p.factory.simgr(init_state)
    
    def is_successful(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        if b'Good Job' in stdout_output:
          return True
        else:
          return False

    def should_abort(state):
        stdout_output = state.posix.dumps(sys.stdout.fileno())
        if b'Try again' in stdout_output:
          return True
        else:
          return False
    
    simulation.explore(find=is_successful, avoid=should_abort)
    
      if simulation.found:
      	solution_state = simulation.found[0]  
        solution0 = solution_state.se.eval(password0)
    	solution1 = solution_state.se.eval(password1)
        print("Solution is:{} {}".format(solution0,solution1))
     else:
        raise Exception"Solution not found"
    
if __name__ == '__main__':
    main(sys.argv)

答案输入：

1704280884 -1912626145

或者

1704280884 2382341151

都对！因为将-1912626145转化为无符号整型就是2382341151（python实现将有符号整型a转为无符号整型：print(a+2**32)）

05 符号化内存

找到scanf附近，发现需要输入4个变量，并且这4个变量都是通过push内存直接传入的

因此，本次得到目标是符号化内存

首先，看一下从哪个地址开始执行吧，因为无需调用scanf函数，故他的堆栈平衡也不用操作，

所以直接从0x08048601开始执行

start_address = 0x08048601
init_state = project.factory.blank_state(addr = start_address)

用 claripy 通过 BVS() 方法生成四个位向量。由于scanf("%8s %8s %8s %8s")，所以每个参数64位

password0 = claripy.BVS('password0',64)
password1 = claripy.BVS('password1',64)
password2 = claripy.BVS('password2',64)
password3 = claripy.BVS('password3',64)

把内存单元的地址值和变量之间进行一定关系的绑定

password0_address = 0x0A1BA1C0
password1_address = 0x0A1BA1C8
password2_address = 0x0A1BA1D0
password3_address = 0x0A1BA1D8

initial_state.memory.store(password0_address, password0)
initial_state.memory.store(password1_address, password1)
initial_state.memory.store(password2_address, password2)
initial_state.memory.store(password3_address, password3)

执行

simulation = project.factory.simgr(initial_state)

def is_successful(state):
  stdout_output = state.posix.dumps(sys.stdout.fileno())
  if b'Good Job' in stdout_output:
    return True
  else:
    return False

def should_abort(state):
  stdout_output = state.posix.dumps(sys.stdout.fileno())
  if b'Try again' in stdout_output:
    return True
  else:
    return False

simulation.explore(find=is_successful, avoid=should_abort)

if simulation.found:
  solution_state = simulation.found[0]

  solution0 = solution_state.se.eval(password0, cast_to=bytes)
  solution1 = solution_state.se.eval(password1, cast_to=bytes)
  solution2 = solution_state.se.eval(password2, cast_to=bytes)
  solution3 = solution_state.se.eval(password3, cast_to=bytes)
 #将b'NAXTHGNR' b'JVSFTPWE' b'LMGAUHWC' b'XMDCPALU' 转化为 NAXTHGNR JVSFTPWE LMGAUHWC XMDCPALU
  print("Solution is: {} {} {} {}".format(solution0.decode('utf-8'),solution1.decode('utf-8'),solution2.decode('utf-8'),solution3.decode('utf-8')))
  else:
    raise Exception('Could not find the solution')

结果：NAXTHGNR JVSFTPWE LMGAUHWC XMDCPALU

06符号化堆

观察反汇编

程序使用了malloc动态分配内存，故本次我们要执行符号化堆

先看下从哪开始执行

不调用scanf，所以我们从0x08048699处开始执行

start_address = 0x08048699
initial_state = project.factory.blank_state(addr=start_address)

需要两个参数，所以用 claripy 通过 BVS() 方法生成两个位向量

password0 = claripy.BVS('password0', 64)
password1 = claripy.BVS('password1', 64)

因为malloc是随机分配地址的，所以我们直接指定地址

addr_esp = initial_state.regs.esp
fake_heap_address0 = addr_esp - 0x100
fake_heap_address1 = addr_esp - 0x200

将地址和变量进行绑定，默认情况下，Angr 在内存中存储整数时采用大字节。要使用参数 endness=project.arch.memory_endness。在 x86 架构上，这是小端序。

pointer_to_malloc_memory_address0 = 0x0ABCC8A4
pointer_to_malloc_memory_address1 = 0x0ABCC8AC
initial_state.memory.store(pointer_to_malloc_memory_address0, fake_heap_address0, endness=project.arch.memory_endness)
initial_state.memory.store(pointer_to_malloc_memory_address1, fake_heap_address1, endness=project.arch.memory_endness)

在我们的 fake_heap_address 处存储我们的符号值。查看二进制文件，确定 scanf 从 fake_heap_address 写入的偏移量。

initial_state.memory.store(fake_heap_address0, password0)
initial_state.memory.store(fake_heap_address1, password1)

执行

simulation = project.factory.simgr(initial_state)

  def is_successful(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    if b'Good Job' in stdout_output:
      return True
    else:
      return False

  def should_abort(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    if b'Try again' in stdout_output:
      return True
    else:
      return False


  simulation.explore(find=is_successful, avoid=should_abort)

  if simulation.found:
    solution_state = simulation.found[0]

    solution0 = solution_state.se.eval(password0, cast_to=bytes)
    solution1 = solution_state.se.eval(password1, cast_to=bytes)
    #solution = ???
    print("Solution is: {} {}".format(solution0.decode('utf-8'), solution1.decode('utf-8')))
   # print(solution)
  else:
    raise Exception('Could not find the solution')

if __name__ == '__main__':
  main(sys.argv)

结果是：UBDKLMBV UNOERNYS

07 文件内容符号化

拖到IDA,F5一下

看到文件操作，因此本次目标符号化文件内容

起始地址我们需要在初始化文件之前（因为这里并没有符号化文件名），输入password之后,选择的是ignore_me之后，选的是0x80488D6

start_address = 0x080488D6
initial_state = project.factory.blank_state(addr=start_address)

给它文件名和大小

filename = "OJKSQYDP.txt"
file_size = 0x40

紧接着进行文件文本符号化

password = initial_state.solver.BVS("password",file_size*8)
sim_file = angr.storage.SimFile(filename,content=password,size=file_size)

然后进行相应的 插入操作：

initial_state.fs.insert(filename,sim_file)

最后进行文本内容的求解：

sm = project.factory.simulation_manager(initial_state)

结果为 AZOMMMZM