REVERSE-COMPETITION-ByteCTF-2024

P1umH0

于 2024-09-23 14:30:28 发布

阅读量900

点赞数 8

分类专栏： Reverse-Competition 文章标签：安全系统安全

本文链接：https://blog.csdn.net/weixin_45582916/article/details/142434504

版权

Reverse-Competition 专栏收录该内容

12 篇文章 2 订阅

订阅专栏

REVERSE-COMPETITION-ByteCTF-2024

babyAPK

blutter恢复部分符号，libapp检查长度是否为45，然后调用babyapk_src_rust_api_simple_::m3N4B5V6_265088
去librust_lib_babyapk搜字符串，定位到sub_3AEE0
uuid格式输入断下，然后就是8个字符一组方程校验
babyapk

import claripy
enc = [0x1ee59, 0x22a, 0x1415, 0x40714, 0x13e0, 0x8b8, 0xfffdcea0, 0x313b, 0x3d798, 0xfffffe6b, 0xc4e, 0x23884, 0x8d, 0x1db4, 0xfffc1328, 0x1eac, 0x43c64,
       0x142b, 0xfffff622, 0x23941, 0xffffef6d, 0x120c, 0xfffbd30f, 0x1ebe, 0x45158, 0xffffef66, 0x1d3f, 0x4c46b, 0xfffff97a, 0x1bfd, 0xfffba235, 0x1ed2]
for i in range(len(enc)//8):
    inp = [claripy.BVS(f"inp_{j}", 8) for j in range(8)]
    v45 = inp[2]
    v44 = inp[3]
    v46 = inp[0]
    v47 = inp[1]
    v48 = inp[4]
    v49 = inp[5]
    v50 = inp[6]
    v51 = inp[7]
    v52 = v46 * v49
    v53 = v48 * v46
    v54 = v44 - v51 - (v47 + v49)
    v41 = i*8
    s = claripy.Solver()
    s.add(v51 + v47 * v44 * v49 - (v46 + v50 + v45 * v48) == enc[v41])
    s.add(v44 - v48 - v46 * v49 + v51 * v47 + v45 + v50 == enc[v41 + 1])
    s.add(v52 - (v48 + v51 * v47) + v45 + v50 * v44 == enc[v41 + 2])
    s.add(v47 + v48 * v46 - (v51 + v45) + v50 * v49 * v44 == enc[v41 + 3])
    s.add(v49 * v44 + v47 + v45 * v48 - (v50 + v51 * v46) == enc[v41 + 4])
    s.add(v52 + v47 * v44 + v45 - (v50 + v48 * v51) == enc[v41 + 5])
    s.add(v51 - v47 + v45 * v49 + v50 - v53 * v44 == enc[v41 + 6])
    s.add(v54 + v53 + v50 * v45 == enc[v41 + 7])
    for j in range(len(inp)):
        s.add(inp[j] >= 0x20)
        s.add(inp[j] <= 0x7f)
    for j in s.batch_eval(inp, 10):
        print("".join(chr(jj) for jj in j), end="")
# ByteCTF{32e750c8-fb21-4562-af22-973fb5176b9c}

ByteBuffer

边，点，recovered numbers
猜测是通过边连接点，数字像电子表那种
观察边周围的数据，77和75是连接的两个点的序号，9是Edge字符串的长度
bytebuffer
同理观察点周围的数据，0627是x坐标，7D是y坐标，8是Dot字符串的长度

画图即可，边的from和to顺序无所谓，但是点是从后向前保存的，索引的时候需要减一下

import matplotlib.pyplot as plt
import struct
with open("ByteBuffer", "rb") as f:
    data = f.read()
# 找边
edges = []
start = 0x03a0
end = 0x1200
while start <= end:
    if data[start:start+6] == b"Edge #":
        strlen = struct.unpack("<I", data[start-4:start])[0]
        strcomp = data[start:start+strlen]
        dotfrom = struct.unpack("<I", data[start-16:start-16+4])[0]
        dotto = struct.unpack("<I", data[start-12:start-12+4])[0]
        edges.append((strcomp, dotfrom, dotto))
    start += 1
# 找点
dots = []
start = 0x1230
end = 0x1fb0
while start <= end:
    if data[start:start+5] == b"Dot #":
        strlen = struct.unpack("<I", data[start-4:start])[0]
        strcomp = data[start:start+strlen]
        dotx = struct.unpack("<I", data[start-16:start-16+4])[0]
        doty = struct.unpack("<I", data[start-12:start-12+4])[0]
        dots.append((strcomp, dotx, doty))
    start += 1
# 画图
for dot in dots:
    plt.scatter(dot[1], dot[2])
for edge in edges:
    dotfrom = 120-edge[1]
    dotto = 120-edge[2]
    x_values = [dots[dotfrom][1], dots[dotto][1]]
    y_values = [dots[dotfrom][2], dots[dotto][2]]
    plt.plot(x_values, y_values, 'k-')
plt.gca().invert_yaxis()
plt.show()
# ByteCTF{327542185069290715865}

ByteKit

cat ./getflag.sh
先写到BYTECTF_INPUT_VAR_FILE，然后重启
第二次进来如果BYTECTF_OUTPUT_VAR_FILE存在，说明input正确，随后打印flag

#!/bin/bash

BYTECTF_INPUT_GUID=93e91ed6-1a7a-46a1-b880-c5d281700ea2
BYTECTF_OUTPUT_GUID=93e91ed6-1a7a-46a1-b880-c5c281700ea2
BYTECTF_INPUT_VAR_FILE="/sys/firmware/efi/efivars/ByteCTFIn-$BYTECTF_INPUT_GUID"
BYTECTF_OUTPUT_VAR_FILE="/sys/firmware/efi/efivars/ByteCTFOut-$BYTECTF_OUTPUT_GUID"

if [ "$1" == "" ]; then
    echo "$0 <your input>"
    exit 1
fi

input=$1
echo "your input is $input"

if [ -f $BYTECTF_OUTPUT_VAR_FILE ]; then
    flag1=$input
    flag2=`cat $BYTECTF_OUTPUT_VAR_FILE | base64 | cut -c -24`
    echo "ByteCTF{$flag1$flag2}"
    chattr -i $BYTECTF_OUTPUT_VAR_FILE
    rm -f $BYTECTF_OUTPUT_VAR_FILE
    exit 0
fi

if [ -f $BYTECTF_INPUT_VAR_FILE ]; then
    chattr -i $BYTECTF_INPUT_VAR_FILE
    rm -f $BYTECTF_INPUT_VAR_FILE
fi

echo -en "\x07\x00\x00\x00$input" | sudo tee $BYTECTF_INPUT_VAR_FILE > /dev/null
echo "system will reboot in 10 seconds"
sh -c "sleep 10; reboot" &

UEFIExtract从bios.bin提取出来一堆文件，搜bytekit，找到
bytekit
其他感觉没用，就pe32下面的body.bin比较大，ida搜到几个字符串
bytekit
函数不多，但全是混淆，d810能去个大概
ModuleEntryPoint里，数据拷贝，然后和key循环异或
bytekit
异或出来是另一个pe文件，校验逻辑是个小型vm的异或
bytekit
直接扣代码，让密文异或回去即可

arr = [0x62, 0x1, 0xb, 0x79, 0x2, 0x3, 0x74, 0x3, 0x7, 0x65, 0x4, 0xe, 0x64,
       0x5, 0xd, 0x61, 0x6, 0xa, 0x6e, 0x7, 0xf, 0x63, 0x8, 0xc, 0x65, 0x9, 0xa, 0x0]
enc = [0x4B, 0x27, 0x42, 0x55, 0x48, 0x6E, 0x41, 0x29, 0x1F, 0x5E,
       0x04, 0x04, 0x6B, 0x3E, 0x57, 0x5F, 0x08, 0x07, 0x5F, 0x3A,
       0x31, 0x17, 0x40, 0x30, 0x5F, 0x7A, 0x75, 0x67, 0x36, 0x36,
       0x36, 0x36]
idx = 0
while idx != len(arr)-1:
    v14 = arr[idx+1]
    v15 = v14 + arr[idx+2]
    while v15 > v14:
        if v14 >= 0 and v14 <= len(enc)-1:
            enc[v14] ^= arr[idx]
        v14 += 1
    idx += 3
print(bytes(enc))
# KEY:By71d@nnc6_Wan77_y@0_zug6666

最后再输入一下

root@localhost:~# ./getflag.sh KEY:By71d@nnc6_Wan77_y@0_zug6666
your input is KEY:By71d@nnc6_Wan77_y@0_zug6666
ByteCTF{KEY:By71d@nnc6_Wan77_y@0_zug6666BwAAAEsnQlVIbkEpH15qamZW}

极限逃脱

ipa附件，解压出ByteCTFDemo文件，ida打开，通过字符串定位到secondButtonClicked
正则匹配uuid格式，抹除ByteCTF{-}，构成字符串列表inp_split
ipa
获取5段已知的字符串，拼接，注意拼接时str_5用了两次，没用str_1
拼接完做sha256得到hex digest
ipa
从hex digest中每次取出一段，索引由上一段决定，长度由当前段决定，做替换
ipa
最后就是和输入的inp_split依次比较
ipa
正向写出流程，加上-即为flag

from hashlib import sha256
s = b"{a67be199da4b-b092-bd3e-e777-a67be199da4b}"
s_ = sha256(s).hexdigest()
lens = [8, 4, 4, 4, 12]
rep = [["a", "b"], ["b", "c"], ["c", "d"], ["d", "e"], ["e", "f"]]
idx = 1
flag = "ByteCTF{"
for i in range(len(lens)):
    sub = s_[idx:idx+lens[i]]
    sub = sub.replace(rep[i][0], rep[i][1])
    flag += sub+"-"
    idx = lens[i]+1
print(flag+"}")
# ByteCTF{c9838b3c-6810-8a3d-8a3c-8a3c6810bdb2}