技术说｜挑战0解薛定谔！RWCTF6th PyGhost——symlink提权

importsocketimportwin32serviceutilimportservicemanagerimportwin32eventimportwin32serviceimportwin32pipeimportwin32securityimportwin32fileimportpywintypesimportrandomimportmatplotlib.pyplot as pltimportnumpy as npimportosimportsysimportshutilclassSMWinservice(win32serviceutil.ServiceFramework):_svc_name_= "RWCTF"_svc_display_name_= 'try to hack me'_svc_description_= ''@classmethoddefparse_command_line(cls):iflen(sys.argv) == 1:servicemanager.Initialize()servicemanager.PrepareToHostSingle()servicemanager.StartServiceCtrlDispatcher()win32serviceutil.HandleCommandLine(cls)else:win32serviceutil.HandleCommandLine(cls)def__init__(self, args):win32serviceutil.ServiceFramework.__init__(self,args)self.hWaitStop= win32event.CreateEvent(None, 0, 0, None)socket.setdefaulttimeout(60)defSvcStop(self):self.stop()self.ReportServiceStatus(win32service.SERVICE_STOP_PENDING)win32event.SetEvent(self.hWaitStop)defSvcDoRun(self):self.start()servicemanager.LogMsg(servicemanager.EVENTLOG_INFORMATION_TYPE,servicemanager.PYS_SERVICE_STARTED,self._svc_name_)self.main()defstart(self):passdefstop(self):passdefmain(self):passclassRWCTFService(SMWinservice):__qualname__= 'RWCTFService'_svc_name_= 'RWCTF'_svc_display_name_= 'try to hack me'_svc_description_= ''defstart(self):self.LICENSE= 'n                    The Star And Thank Author License (SATA)n                   Version 2.0, April 2021nnCopyright   <2024><RWCTF>([email protected])nnProject Url:https://realworldctf.com/nnPermission is hereby granted, free ofcharge, to any person obtaining a copynof this software andassociated documentation files (the "Software"), todealnin the Software without restriction, including withoutlimitation the rightsnto use, copy, modify, merge, publish,distribute, sublicense, and/or sellncopies of the Software, and topermit persons to whom the Software isnfurnished to do so, subjectto the following conditions:nnThe above copyright notice and thispermission notice shall be included innall copies or substantialportions of the Software.nnAnd wait, the most important, you shouldstar/+1/like the project(s) in project urlnsection above first, andthen thank the author(s) in Copyright section.nnHere are somesuggested ways:nn - Email the authors a thank-you letter, and makefriends with him/her/them.n - Report bugs or issues.n - Tellfriends what a wonderful project this is.n - And, sure, you can justexpress thanks in your mind without telling theworld.nnContributors of this project by forking have the option toadd his/her name andnforked project url at copyright and project urlsections, but shall not deletenor modify anything else in these twosections.nnTHE SOFTWARE IS PROVIDED "AS IS", WITHOUTWARRANTY OF ANY KIND, EXPRESS ORnIMPLIED, INCLUDING BUT NOT LIMITEDTO THE WARRANTIES OF MERCHANTABILITY,nFITNESS FOR A PARTICULARPURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THEnAUTHORS ORCOPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OROTHERnLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OROTHERWISE, ARISING FROM,nOUT OF OR IN CONNECTION WITH THE SOFTWAREOR THE USE OR OTHER DEALINGS INnTHE SOFTWARE.n'self.output_directory= 'C:\Windows\Temp'self.output_prefix= 'C:\Windows\Temp\res.'self.isrunning= Truedefstop(self):try:self.isrunning= FalseexceptFileNotFoundError:self.isrunning= Falseexcept:raisedefchallenge(self, option, key):RAND_32_64= lambda: random.randint(32, 64)nonce= ''ifoption == b'png':nonce= random.getrandbits(RAND_32_64()) + 1elifoption == b'jpg':nonce= random.getrandbits(RAND_32_64()) * 2elifoption == b'eps':nonce= random.getrandbits(RAND_32_64()) + 4660elifoption == b'svg':nonce= random.getrandbits(RAND_32_64()) - 61769elifoption == b'pgf':nonce= random.getrandbits(RAND_32_64()) % random.getrandbits(RAND_32_64())elifoption == b'pdf':nonce= random.getrandbits(RAND_32_64()) //random.getrantbits(random.randint(2, 10))else:returnFalseifkey == nonce:returnTrueelse:returnFalsedefloop(self, pipeHandle, data):RAND_0_100= lambda: random.randint(0, 100)pieces= data.split(b'|')option= pieces[1]key= int(pieces[2])ifoption == b'png':ifself.challenge(option, key):x= np.linspace(0, 10, 200)plt.plot(x,np.sin(x))plt.plot(x,np.cos(x))plt.savefig(self.output_prefix+ str(RAND_0_100()) + '.png')returnNoneelifoption == b'jpg':ifself.challenge(option, key):l= [1, 2, 3, 4]plt.plot(l)plt.ylabel('somenumber')plt.savefig(self.output_prefix+ str(RAND_0_100()) + '.jpg')returnNoneelifoption == b'svg':ifself.challenge(option, key):x= ['A', 'B', 'C', 'D']y= [3, 8, 1, 10]plt.bar(x,y)plt.savefig(self.output_prefix+ str(RAND_0_100()) + '.svg')returnNoneelifoption == b'pdf':ifself.challenge(option, key):x= [1, 2, 3, 4, 5]y= [1, 4, 9, 16, 25]plt.figure()plt.plot(x,y)plt.title('Myfirst matplotlib plot')plt.xlabel('X')plt.ylabel('Y')plt.savefig(self.output_prefix+ str(RAND_0_100()) + '.pdf')returnNoneelifoption == b'LICENSE':win32file.WriteFile(pipeHandle,'Please read the LICENSE carefully: n' + self.LICENSE)returnNoneelifoption == b'I give up':pipeHandle.Close()self.stop()returnNoneelse:return0"""

exceptException as e:servicemanager.LogMsg(servicemanager.EVENTLOG_INFORMATION_TYPE,servicemanager.PYS_SERVICE_STARTED,(self._svc_name_, str(e)))e= Nonedeleelse:e= Nonedele"""defmain(self):whileself.isrunning:pipeName= '\\.\pipe\rwctf'openMode= win32pipe.PIPE_ACCESS_DUPLEX | win32file.FILE_FLAG_OVERLAPPEDpipeMode= win32pipe.PIPE_TYPE_MESSAGEACL= 'D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GA;;;AU)'sd=win32security.ConvertStringSecurityDescriptorToSecurityDescriptor(ACL,win32security.SDDL_REVISION_1)sa= pywintypes.SECURITY_ATTRIBUTES()sa.SECURITY_DESCRIPTOR= sdpipeHandle= win32pipe.CreateNamedPipe(pipeName,openMode, pipeMode,win32pipe.PIPE_UNLIMITED_INSTANCES,0,0, 6000, sa)#!!! 待检查whileself.isrunning:hr= win32pipe.ConnectNamedPipe(pipeHandle, None)hr,data = win32file.ReadFile(pipeHandle, 256)self.loop(pipeHandle,data)win32pipe.DisconnectNamedPipe(pipeHandle)"""

whileself.isrunning:#...whileself.isrunning:#...returnNonetry:exceptException as details:NULL+ print('Error connecting pipe!', details)pipeHandle.NULL| self + Close()details= Nonedeldetailscontinueelse:details= Nonedeldetails"""if__name__ == "__main__":RWCTFService.parse_command_line()

(https://github.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623)def_rmtree_unsafe(path, onexc):try:withos.scandir(path) as scandir_it:entries= list(scandir_it)except OSErroras err:onexc(os.scandir, path, err)entries = []for entry inentries:fullname =entry.pathtry:is_dir =entry.is_dir(follow_symlinks=False)exceptOSError:is_dir =Falseif is_dirand not entry.is_junction():try:ifentry.is_symlink():# This can only happen if someone replaces# a directory with a symlink after the call to# os.scandir or entry.is_dir above.raise OSError("Cannot call rmtree on a symbolic link")exceptOSError as err:onexc(os.path.islink, fullname, err)continue_rmtree_unsafe(fullname, onexc)else:try:os.unlink(fullname)exceptOSError as err:onexc(os.unlink, fullname, err)try:os.rmdir(path)except OSErroras err:onexc(os.rmdir, path, err)