首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. CTF对抗
    3. 发新帖
[原创]KCTF 2023 第三题 解题过程
发表于: 2023-9-6 22:44 9043

[原创]KCTF 2023 第三题 解题过程

mb_ibocelll 活跃值
1
2023-9-6 22:44
9043

以为又是个算法题，没想到是个逆向加脑洞题

字符串特征 cryptopp、unicorn,加上code.dat文件，分别从输入和unicorn入手
从xml可以找到check_va,引用找到输入获取逻辑，只能确认输入长度限制32位
从code.dat（utf-16）引用可以找到unicorn的调用函数，结合unicorn官方文档，推测出函数调用，关键在写入代码和数据的 uc_mem_write uc_mem_read。
ida启动调试、附加全部崩溃在invalidHandle，推测有反调试。
windows反调试不太熟，于是启动frida

两次write，分别是代码和输入数据的hash。获得代码如下

将一堆字符串push，和输入比较，如果相等且为"6749dae311865d64db83d5ae75bac3c9e36b3aa"...这一项则验证成功。
但是输入经过了hash处理，
这个代码现在真是越看越怪，尤其是这个flag：

为了确认输入处理，还是需要调试下，从崩溃时的栈上获取信息，最终定位到

把这个干掉之后运行正常。

跟踪输入逻辑，可以发现先经过sha256，然后rsa加密，使用时再rsa解密。
看了下代码解密逻辑，确认没什么思路，唯一的条件就是

前面的flags:没什么用，明显是个提示，并且这段代码里多了很多无用的字符串。
将其分割成两半试试

全是套路，好！

function seeHexA(addr, length) {
    console.log(hexdump(ptr(addr), { length: parseInt(length) }))
}
var base= Module.getBaseAddress("ctf_app.exe")
// Interceptor.attach(ptr(0x00BC28E0+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), this.context.ecx, this.context.esp.add(4).readPointer(), "caller =", this.context.esp.readPointer().sub(base))
//             // console. log (' Context : ' + JSON. stringify (this. context));
//             console.log(Process.getCurrentThreadId(), "string_from_u16:", this.context.esp.add(4).readPointer().readUtf16String())
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     })
 
// Interceptor.attach(ptr(0xBC28C0+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), "wrap_SendMessageW "
//                 , this.context.esp.add(0x4).readPointer()
//                 , this.context.esp.add(0x8).readPointer()
//                 , this.context.esp.add(0xc).readPointer()
//                 , this.context.esp.add(0x10).readPointer()
//                 , "caller =", this.context.esp.readPointer().sub(base)
//             )
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     }
// )
// Interceptor.attach(ptr(0xBC6850+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), "enc1 "
//                 , this.context.ecx
//                 , this.context.edx
//                 , this.context.ebp
//                 , this.context.esp.add(0x4).readPointer()
//                 , "caller =", this.context.esp.readPointer()
//             )
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     }
// )
// Interceptor.attach(ptr(0xBC6D20+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), "enc2 "
//                 , this.context.edx
//                 , this.context.ecx
//                 , this.context.ebp
//                 , this.context.edi
//                 , this.context.esi
//                 , this.context.esp.add(0x4).readPointer()
//                 , "caller =", this.context.esp.readPointer().sub(base)
//             )
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     }
// )
// Interceptor.attach(ptr(0xBCE670+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), "encn "
//                 , this.context.ecx
//                 , this.context.ebp
//                 , this.context.edi
//                 , this.context.esi
//                 , this.context.esp.add(0x4).readPointer()
//                 , "caller =", this.context.esp.readPointer().sub(base)
//             )
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     }
// )
// Interceptor.attach(ptr(0xBC9B90+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(this.context.ecx, this.context.esp.add(4).readPointer(), this.context.esp.add(8).readPointer(), "caller =", this.context.esp.readPointer().sub(base))
//             // console. log (' Context : ' + JSON. stringify (this. context));
//             // console.log("newstring:",this.context.esp.add(4).readPointer().readUtf8String())
//             console.log("newstring:")
//             seeHexA(this.context.esp.add(4).readPointer(), parseInt(this.context.esp.add(8).readPointer()))
//             // seeHexA(this.context.esp)
//             console.log("------------------------")
//         }
//     })
// Interceptor.attach(ptr(0x40A4B0+parseInt(base)-0x00400000),
//     {
//         onEnter: function (args) {
//             console.log(this.context.ecx, this.context.esp.add(4).readPointer(), this.context.esp.add(8).readPointer(), "caller =", this.context.esp.readPointer().sub(base))
//             // console. log (' Context : ' + JSON. stringify (this. context));
//             // console.log("newstring:",this.context.esp.add(4).readPointer().readUtf8String())
//             console.log("newstring2:")
//             seeHexA(this.context.esp.add(4).readPointer(), parseInt(this.context.esp.add(8).readPointer()))
//             // seeHexA(this.context.esp)
//             console.log("------------------------")
//         }
//     })
Interceptor.attach(ptr(0xBCDA90+parseInt(base)-0xBC0000),
    {
        onEnter: function (args) {
            this.arg0 = this.context.edx
            this.arg1 = this.context.ecx
            console.log(Process.getCurrentThreadId(), this.context.edx, this.context.ecx, this.context.esp.add(4).readPointer(), "caller =", this.context.esp.readPointer().sub(base))
            // console. log (' Context : ' + JSON. stringify (this. context));
            console.log(Process.getCurrentThreadId(), "getcodedat:", this.context.esp.add(4).readPointer().readUtf8String())
            console.log()
        }
    }
)
 
Interceptor.attach(ptr(0x00C0E460+parseInt(base)-0xBC0000),
    {
        onEnter: function (args) {
            console.log(Process.getCurrentThreadId(), "uc_mem_write:", this.context.esp.add(4).readPointer(),
                this.context.esp.add(8).readPointer(),
                this.context.esp.add(0xc).readPointer(),
                this.context.esp.add(0x10).readPointer(),
                this.context.esp.add(0x14).readPointer(), "caller =", this.context.esp.readPointer().sub(base))
            // console. log (' Context : ' + JSON. stringify (this. context));
            seeHexA(this.context.esp.add(0x10).readPointer(), this.context.esp.add(0x14).readPointer())
            console.log(Process.getCurrentThreadId(), "------------------------")
        }
    }
)
Interceptor.attach(ptr(0x00C0E1F0+parseInt(base)-0xBC0000),
    {
        onEnter: function (args) {
            this.dst = this.context.esp.add(0x10).readPointer()
            this.size = this.context.esp.add(0x14).readPointer()
            console.log(Process.getCurrentThreadId(), "uc_mem_read:",
                this.context.esp.add(4).readPointer(),
                this.context.esp.add(8).readPointer(),
                this.context.esp.add(0xc).readPointer(),
                this.context.esp.add(0x10).readPointer(),
                this.context.esp.add(0x14).readPointer(),
                "caller =", this.context.esp.readPointer().sub(base))
            // console. log (' Context : ' + JSON. stringify (this. context));
            console.log()
        }
        ,
        onLeave: function (retval) {
            console.log(Process.getCurrentThreadId(), "uc_mem_read->", retval)
            seeHexA(this.dst, this.size)
            // this.dst.writeU32(1)
            // this.dst.add(0x18).writeU32(1)
            seeHexA(this.dst, this.size)
            console.log(Process.getCurrentThreadId(), "------------------------")
        }
    }
)
 
//if(hash(input)=="6749dae311865d64db83d5ae75bac3c9e36b3aa6f24caba655d9682f7f071023"){}
function seeHexA(addr, length) {
    console.log(hexdump(ptr(addr), { length: parseInt(length) }))
}
var base= Module.getBaseAddress("ctf_app.exe")
// Interceptor.attach(ptr(0x00BC28E0+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), this.context.ecx, this.context.esp.add(4).readPointer(), "caller =", this.context.esp.readPointer().sub(base))
//             // console. log (' Context : ' + JSON. stringify (this. context));
//             console.log(Process.getCurrentThreadId(), "string_from_u16:", this.context.esp.add(4).readPointer().readUtf16String())
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     })
 
// Interceptor.attach(ptr(0xBC28C0+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), "wrap_SendMessageW "
//                 , this.context.esp.add(0x4).readPointer()
//                 , this.context.esp.add(0x8).readPointer()
//                 , this.context.esp.add(0xc).readPointer()
//                 , this.context.esp.add(0x10).readPointer()
//                 , "caller =", this.context.esp.readPointer().sub(base)
//             )
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     }
// )
// Interceptor.attach(ptr(0xBC6850+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), "enc1 "
//                 , this.context.ecx
//                 , this.context.edx
//                 , this.context.ebp
//                 , this.context.esp.add(0x4).readPointer()
//                 , "caller =", this.context.esp.readPointer()
//             )
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     }
// )
// Interceptor.attach(ptr(0xBC6D20+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), "enc2 "
//                 , this.context.edx
//                 , this.context.ecx
//                 , this.context.ebp
//                 , this.context.edi
//                 , this.context.esi
//                 , this.context.esp.add(0x4).readPointer()
//                 , "caller =", this.context.esp.readPointer().sub(base)
//             )
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     }
// )
// Interceptor.attach(ptr(0xBCE670+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(Process.getCurrentThreadId(), "encn "
//                 , this.context.ecx
//                 , this.context.ebp
//                 , this.context.edi
//                 , this.context.esi
//                 , this.context.esp.add(0x4).readPointer()
//                 , "caller =", this.context.esp.readPointer().sub(base)
//             )
//             console.log()
//             // seeHexA(this.context.esp)
//             console.log(Process.getCurrentThreadId(), "------------------------")
//         }
//     }
// )
// Interceptor.attach(ptr(0xBC9B90+parseInt(base)-0xBC0000),
//     {
//         onEnter: function (args) {
//             console.log(this.context.ecx, this.context.esp.add(4).readPointer(), this.context.esp.add(8).readPointer(), "caller =", this.context.esp.readPointer().sub(base))
//             // console. log (' Context : ' + JSON. stringify (this. context));
//             // console.log("newstring:",this.context.esp.add(4).readPointer().readUtf8String())
//             console.log("newstring:")
//             seeHexA(this.context.esp.add(4).readPointer(), parseInt(this.context.esp.add(8).readPointer()))
//             // seeHexA(this.context.esp)
//             console.log("------------------------")
//         }
//     })
// Interceptor.attach(ptr(0x40A4B0+parseInt(base)-0x00400000),
//     {
//         onEnter: function (args) {
//             console.log(this.context.ecx, this.context.esp.add(4).readPointer(), this.context.esp.add(8).readPointer(), "caller =", this.context.esp.readPointer().sub(base))
//             // console. log (' Context : ' + JSON. stringify (this. context));
//             // console.log("newstring:",this.context.esp.add(4).readPointer().readUtf8String())
//             console.log("newstring2:")
//             seeHexA(this.context.esp.add(4).readPointer(), parseInt(this.context.esp.add(8).readPointer()))
//             // seeHexA(this.context.esp)
//             console.log("------------------------")
//         }
//     })
Interceptor.attach(ptr(0xBCDA90+parseInt(base)-0xBC0000),
    {
        onEnter: function (args) {
            this.arg0 = this.context.edx
            this.arg1 = this.context.ecx
            console.log(Process.getCurrentThreadId(), this.context.edx, this.context.ecx, this.context.esp.add(4).readPointer(), "caller =", this.context.esp.readPointer().sub(base))
            // console. log (' Context : ' + JSON. stringify (this. context));
            console.log(Process.getCurrentThreadId(), "getcodedat:", this.context.esp.add(4).readPointer().readUtf8String())
            console.log()
        }
    }
)
 
Interceptor.attach(ptr(0x00C0E460+parseInt(base)-0xBC0000),
    {

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)

最后于 2023-9-7 12:21 被kanxue编辑 ，原因：
收藏
免费 ・1
支持
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回
//