-
-
[原创]KCTF 2025 第6题 秘辛揭露wp
-
发表于: 2025-8-26 09:51
-
拿到题目发现要管理员权限运行, 放进ida中发现还导入了socket相关函数;
想着如果无权限也能正常运行, 说不定能失效其中一些反调试手段, 搜索了下如何去除管理员权限需求;
用ResourceHacker打开Mainfest:
将其中的requestedExecutionLevel level="requireAdministrator"改为requestedExecutionLevel level="asInvoker"F5然后保存.
发现确实可以正常运行, 输入最短长度为31的字符串也能发现乔峰残害了少林寺方丈.
该程序使用了MFC框架, 从入口点没找到算法逻辑;
于是在ida的函数窗口中按函数长度排序, 结合frida hook发现第二长的函数在点击登录时被调用, 且很有可能是处理输入的关键算法函数:
输入1111111111111111111111111111111点登录会看到:
从中可以看出输入长度其实是包含\x00在内的共32字节, 输入与返回的第二个int应该存的是长度, 所以返回的结果也是32字节.
在试图f50x12352547中的一些函数时ida报错后续无法再f5, 不过不影响关闭保存再从新打开;
观察汇编结合搜索发现了 124K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6J5k6i4S2&6M7X3g2^5P5g2)9J5c8X3W2V1j5g2)9J5k6r3c8W2j5$3!0E0M7r3W2D9k6i4u0Q4x3X3c8U0M7X3q4K6K9l9`.`.
于是根据其中提到的bextr长度溢出会产生的效果, 将其中所有的
patch为
即可让ida正常使用.
之后分析sub_12352547返回值的去向, 发现在与0x12408710中存放的数据作比较;
在hook中console.log(hexdump(ptr(0x12408710).readPointer(), {length: 0x40}));其内容为:
输入加密后应与这段数据相同;
并且发现虽然每次打开程序内容会稍作变化, 但每次点击登录其内容是不变的;
之后发现随着输入的变化, sub_12352547的返回结果的变化很有规律;
可以看到结果的前5位与最后一位都已匹配. 于是根据发现的规律可以写脚本主动调用来爆破:
check函数比较慢, 但也只跑了不到一小时, 最后结果为
发现还包含汉字, 进行gbk解码:
后来想到爆破没必要逐两位爆破可以每两位一起爆破...不过结果都跑出来了就这样吧.
Interceptor.attach(ptr(0x12352547), { onEnter: function(args) { console.log("12352547 called", args[0], args[1]); console.log(hexdump(args[0].readPointer(), {length: 0x30})); console.log(hexdump(args[1].readPointer(), {length: 0x10})); }, onLeave: function(retVal) { console.log("12352547 returned", retVal); console.log(hexdump(retVal, {length: 0x40})); }});Interceptor.attach(ptr(0x12352547), { onEnter: function(args) { console.log("12352547 called", args[0], args[1]); console.log(hexdump(args[0].readPointer(), {length: 0x30})); console.log(hexdump(args[1].readPointer(), {length: 0x10})); }, onLeave: function(retVal) { console.log("12352547 returned", retVal); console.log(hexdump(retVal, {length: 0x40})); }});12352547 called 0x19f4d8 0x1240870c 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007196c0 01 00 00 00 20 00 00 00 31 31 31 31 31 31 31 31 .... ...11111111007196d0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111007196e0 31 31 31 31 31 31 31 00 fa b5 2d 84 00 14 00 88 1111111...-..... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00720e10 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x7193c0 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007193c0 01 00 00 00 20 00 00 00 7a 73 e0 73 ec 73 e0 73 .... ...zs.s.s.s007193d0 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s007193e0 e2 73 e0 73 d5 73 e0 b3 5a b5 4d 84 00 04 00 80 .s.s.s..Z.M.....007193f0 41 00 66 00 78 00 4f 00 6c 00 64 00 57 00 6e 00 A.f.x.O.l.d.W.n.12352547 called 0x19f4d8 0x1240870c 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007196c0 01 00 00 00 20 00 00 00 31 31 31 31 31 31 31 31 .... ...11111111007196d0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111007196e0 31 31 31 31 31 31 31 00 fa b5 2d 84 00 14 00 88 1111111...-..... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00720e10 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x7193c0 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007193c0 01 00 00 00 20 00 00 00 7a 73 e0 73 ec 73 e0 73 .... ...zs.s.s.s007193d0 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s007193e0 e2 73 e0 73 d5 73 e0 b3 5a b5 4d 84 00 04 00 80 .s.s.s..Z.M.....007193f0 41 00 66 00 78 00 4f 00 6c 00 64 00 57 00 6e 00 A.f.x.O.l.d.W.n.mov eax, 2100hbextr ecx, ..., eaxmov eax, 2100hbextr ecx, ..., eaxmov eax, 2100hxor ecx, ecxmov eax, 2100hxor ecx, ecxv44 = (void *)sub_12352547(&v49, &dword_1240870C);if ( encr )free(encr);encr = v44;v21 = 0;if ( final_12408710 )v21 = *((_DWORD *)final_12408710 + 1);v22 = 0;if ( encr )v22 = *((_DWORD *)encr + 1);v23 = 1;if ( v22 == v21 ){v23 = 0;if ( v21 ) v23 = compare((char *)encr + 8, (char *)final_12408710 + 8, v21);}v44 = (void *)sub_12352547(&v49, &dword_1240870C);if ( encr )free(encr);encr = v44;v21 = 0;if ( final_12408710 )v21 = *((_DWORD *)final_12408710 + 1);v22 = 0;if ( encr )v22 = *((_DWORD *)encr + 1);v23 = 1;if ( v22 == v21 ){v23 = 0;if ( v21 ) v23 = compare((char *)encr + 8, (char *)final_12408710 + 8, v21);} 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719540 01 00 00 00 20 00 00 00 00 1d 3b 29 70 12 69 b7 .... .....;)p.i.00719550 6c 0f 4d 5c 9f 5b 6c 1b b5 47 a2 28 c0 f8 dc e0 l.M\.[l..G.(....00719560 7a f8 d6 28 f6 f8 93 b3 8a b5 1d 84 00 0c 00 80 z..(............00719570 01 00 00 00 20 00 00 00 4b 5b 4c 5b 40 5b 4c 5b .... ...K[L[@[L[ 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719540 01 00 00 00 20 00 00 00 00 1d 3b 29 70 12 69 b7 .... .....;)p.i.00719550 6c 0f 4d 5c 9f 5b 6c 1b b5 47 a2 28 c0 f8 dc e0 l.M\.[l..G.(....00719560 7a f8 d6 28 f6 f8 93 b3 8a b5 1d 84 00 0c 00 80 z..(............00719570 01 00 00 00 20 00 00 00 4b 5b 4c 5b 40 5b 4c 5b .... ...K[L[@[L[12352547 called 0x19f4d8 0x1240870c 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007196c0 01 00 00 00 20 00 00 00 31 31 31 31 31 31 31 31 .... ...11111111007196d0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111007196e0 31 31 31 31 31 31 31 00 fa b5 2d 84 00 14 00 88 1111111...-..... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00720e10 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x7193c0 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007193c0 01 00 00 00 20 00 00 00 7a 73 e0 73 ec 73 e0 73 .... ...zs.s.s.s007193d0 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s007193e0 e2 73 e0 73 d5 73 e0 b3 5a b5 4d 84 00 04 00 80 .s.s.s..Z.M.....007193f0 41 00 66 00 78 00 4f 00 6c 00 64 00 57 00 6e 00 A.f.x.O.l.d.W.n.输入第1位由1变为2时, 或尝试改成别的字符, 结果的只有第一位变化且与之前的值满足异或关系; 12352547 called 0x19f4d8 0x1240870c 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719810 01 00 00 00 20 00 00 00 32 31 31 31 31 31 31 31 .... ...2111111100719820 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 111111111111111100719830 31 31 31 31 31 31 31 00 20 b4 f7 84 00 1b 00 88 1111111. ....... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF006e3d00 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x7193c0 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007193c0 01 00 00 00 20 00 00 00 79 73 e0 73 ec 73 e0 73 .... ...ys.s.s.s007193d0 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s007193e0 e2 73 e0 73 d5 73 e0 b3 5a b5 4d 84 00 04 00 80 .s.s.s..Z.M.....007193f0 f4 66 1c 77 20 17 6e 00 f8 28 6e 00 00 00 00 00 .f.w .n..(n.....输入第2位变化时. 结果只有2 3位变化, 但未找到规律 12352547 called 0x19f4d8 0x1240870c 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719810 01 00 00 00 20 00 00 00 32 32 31 31 31 31 31 31 .... ...2211111100719820 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 111111111111111100719830 31 31 31 31 31 31 31 00 20 b4 f7 84 00 1b 00 88 1111111. ....... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF006e3e08 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x719450 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719450 01 00 00 00 20 00 00 00 79 c9 4c 73 ec 73 e0 73 .... ...y.Ls.s.s00719460 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s00719470 e2 73 e0 73 d5 73 e0 b3 a8 b5 7f 84 00 07 00 88 .s.s.s..........00719480 00 a4 3c 71 38 50 3d 71 00 00 00 00 01 00 00 00 ..<q8P=q........输入第3位变化时, 结果的第3位又与之前的值满足异或关系. 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719450 01 00 00 00 20 00 00 00 32 32 32 31 31 31 31 31 .... ...2221111100719460 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 111111111111111100719470 31 31 31 31 31 31 31 00 a8 b5 7f 84 00 07 00 88 1111111......... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF006e3df0 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x719360 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719360 01 00 00 00 20 00 00 00 79 c9 4f 73 ec 73 e0 73 .... ...y.Os.s.s00719370 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s00719380 e2 73 e0 73 d5 73 e0 b3 56 b5 41 84 00 02 00 80 .s.s.s..V.A.....00719390 41 00 66 00 78 00 4f 00 6c 00 64 00 57 00 6e 00 A.f.x.O.l.d.W.n.目标数据为 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719540 01 00 00 00 20 00 00 00 00 1d 3b 29 70 12 69 b7 .... .....;)p.i.00719550 6c 0f 4d 5c 9f 5b 6c 1b b5 47 a2 28 c0 f8 dc e0 l.M\.[l..G.(....00719560 7a f8 d6 28 f6 f8 93 b3 8a b5 1d 84 00 0c 00 80 z..(............00719570 01 00 00 00 20 00 00 00 4b 5b 4c 5b 40 5b 4c 5b .... ...K[L[@[L[发现是输入的每2位控制结果的每2位, 且其中奇数位为简单的异或; 根据第一位的异或关系找出第一位应为(0x32 ^ 0x79 ^ 0x00) 为K, 并推测前面为`KCTF{` 末尾为}: 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007198d0 01 00 00 00 20 00 00 00 4b 43 54 46 7b 31 31 31 .... ...KCTF{111007198e0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111007198f0 31 31 31 31 31 31 7d 00 38 b4 ef 84 00 1f 00 80 111111}.8....... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00715770 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x7196c0 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007196c0 01 00 00 00 20 00 00 00 00 1d 3b 29 70 73 e0 73 .... .....;)ps.s007196d0 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s007196e0 e2 73 e0 73 d5 73 ac b3 fa b5 2d 84 00 14 00 88 .s.s.s....-.....007196f0 c4 a5 3c 71 18 4e 3d 71 00 00 00 00 02 00 00 00 ..<q.N=q........ 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719840 01 00 00 00 20 00 00 00 00 1d 3b 29 70 12 69 b7 .... .....;)p.i.00719850 6c 0f 4d 5c 9f 5b 6c 1b b5 47 a2 28 c0 f8 dc e0 l.M\.[l..G.(....00719860 7a f8 d6 28 f6 f8 93 b3 2a b4 fd 84 00 1c 00 88 z..(....*.......00719870 54 92 53 71 04 d2 53 71 00 00 00 00 03 00 00 00 T.Sq..Sq........12352547 called 0x19f4d8 0x1240870c 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007196c0 01 00 00 00 20 00 00 00 31 31 31 31 31 31 31 31 .... ...11111111007196d0 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 1111111111111111007196e0 31 31 31 31 31 31 31 00 fa b5 2d 84 00 14 00 88 1111111...-..... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00720e10 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x7193c0 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007193c0 01 00 00 00 20 00 00 00 7a 73 e0 73 ec 73 e0 73 .... ...zs.s.s.s007193d0 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s007193e0 e2 73 e0 73 d5 73 e0 b3 5a b5 4d 84 00 04 00 80 .s.s.s..Z.M.....007193f0 41 00 66 00 78 00 4f 00 6c 00 64 00 57 00 6e 00 A.f.x.O.l.d.W.n.输入第1位由1变为2时, 或尝试改成别的字符, 结果的只有第一位变化且与之前的值满足异或关系; 12352547 called 0x19f4d8 0x1240870c 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719810 01 00 00 00 20 00 00 00 32 31 31 31 31 31 31 31 .... ...2111111100719820 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 111111111111111100719830 31 31 31 31 31 31 31 00 20 b4 f7 84 00 1b 00 88 1111111. ....... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF006e3d00 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x7193c0 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF007193c0 01 00 00 00 20 00 00 00 79 73 e0 73 ec 73 e0 73 .... ...ys.s.s.s007193d0 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s007193e0 e2 73 e0 73 d5 73 e0 b3 5a b5 4d 84 00 04 00 80 .s.s.s..Z.M.....007193f0 f4 66 1c 77 20 17 6e 00 f8 28 6e 00 00 00 00 00 .f.w .n..(n.....输入第2位变化时. 结果只有2 3位变化, 但未找到规律 12352547 called 0x19f4d8 0x1240870c 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719810 01 00 00 00 20 00 00 00 32 32 31 31 31 31 31 31 .... ...2211111100719820 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 31 111111111111111100719830 31 31 31 31 31 31 31 00 20 b4 f7 84 00 1b 00 88 1111111. ....... 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF006e3e08 01 00 00 00 08 00 00 00 4b 0c 54 0f 32 00 02 35 ........K.T.2..512352547 returned 0x719450 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF00719450 01 00 00 00 20 00 00 00 79 c9 4c 73 ec 73 e0 73 .... ...y.Ls.s.s00719460 b4 73 e0 73 ef 73 e0 73 d2 73 e0 73 e0 73 e0 73 .s.s.s.s.s.s.s.s[培训]Windows内核深度攻防：从Hook技术到Rootkit实战！
最后于 2025-8-26 10:11
被tacesrever编辑
，原因：
|
|
|---|---|
