首页
论坛
课程
招聘
[原创]第二题 writeup
2017-10-27 22:16 1241

[原创]第二题 writeup

2017-10-27 22:16
1241

第二题 writeup

输入的地方很奇怪,作为一个逆向题没有验证长度,导致 bof。
前面是个假的验证,解方程解了一下午,后来才发现是无解的。
尝试利用 bof 更改返回地址。发现在0x413131处有个明显的抬栈操作,怀疑是入口,0x00413131正好是 11A\x00,输入12*'a'+'11A'即可覆盖返回地址调到0x00413131。

 

于是从0x00413131开始往下分析,发现大量重复条件跳转。
主要逻辑夹杂在跳转之中,判断是否相等主要依赖 sub 之后判断 zf。

 

trace 化简后得到了以下代码:

Address                     Instruction                         Result                                      
.text:00413131              add     esp, 0FFFFFFF0h             ESP=0019FF34 CF=1 AF=0                      
.text:loc_413150            xor     eax, eax                    EAX=00000000 CF=0 PF=1 ZF=1                 
.text:loc_413184            mov     check_count, eax                                                                                                             
.text:loc_4131BA            pop     eax             ; Symbolized memory: 0x19ff34   EAX=64636261 8                                                                         
.text:loc_4131EB            mov     ecx, eax        ; Symbolized regs: eax  ECX=64636261                                                                                  
.text:loc_41321F            pop     eax             ; Symbolized memory: 0x19ff38   EAX=68676665 C                                                                         
.text:loc_413254            mov     ebx, eax        ; Symbolized regs: eax  EBX=68676665                                                                                  
.text:loc_413289            pop     eax             ; Symbolized memory: 0x19ff3c   EAX=6C6B6A69 0                                                                      
.text:loc_4132B5            mov     edx, eax        ; Symbolized regs: eax  EDX=6C6B6A69                                                                                 
.text:loc_4132AD            mov     edx, eax        ; Symbolized regs: eax                                                                                                 
.text:loc_4132E2            mov     eax, ecx        ; Symbolized regs: ecx  EAX=64636261                                                                                 
.text:loc_413316            sub     eax, ebx        ; Symbolized regs: eax ebx  EAX=FBFBFBFC CF=1 AF=1 ZF=0                                               
.text:loc_413349            shl     eax, 2          ; Symbolized regs: eax cf of pf sf zf   EAX=EFEFEFF0                                                               
.text:loc_413380            add     eax, ecx        ; Symbolized regs: eax ecx  EAX=54535251 PF=0                                                         
.text:loc_4133B5            add     eax, edx        ; Symbolized regs: eax edx  EAX=C0BEBCBA CF=0 SF=1                                                   
.text:loc_4133E9            sub     eax, 0EAF917E2h ; Symbolized regs: eax  EAX=D5C5A4D8 CF=1 PF=1 OF=0              


.text:loc_413455            add     eax, ecx        ; Symbolized regs: eax ecx  EAX=3A290739 ZF=0                                                   
.text:loc_413489            sub     eax, ebx        ; Symbolized regs: eax ebx  EAX=D1C1A0D4                                                               
.text:loc_4134BF            mov     ebx, eax        ; Symbolized regs: eax  EBX=D1C1A0D4                                                                     
.text:loc_4134F3            shl     eax, 1          ; Symbolized regs: eax cf of pf sf zf   EAX=A38341A8                                                              
.text:loc_413525            add     eax, ebx        ; Symbolized regs: eax ebx  EAX=7544E27C SF=0                                                   
.text:loc_413559            add     eax, ecx        ; Symbolized regs: eax ecx  EAX=D9A844DD CF=0 PF=1                                                    
.text:loc_41358F            mov     ecx, eax        ; Symbolized regs: eax  ECX=D9A844DD                                                                      
.text:loc_4135C3            add     eax, edx        ; Symbolized regs: eax edx  EAX=4613AF46 CF=1 PF=0 AF=1 SF=0                                    
.text:loc_4135F7            sub     eax, 0E8F508C8h ; Symbolized regs: eax  EAX=5D1EA67E PF=1    



.text:loc_413665            mov     eax, ecx                    EAX=D9A844DD                                
.text:loc_41365D            mov     eax, ecx                                                                                                                        
.text:loc_4136A7            sub     eax, edx                    EAX=6D3CDA74 CF=0 AF=0 ZF=0 OF=1                                                                    
.text:loc_4136D8            sub     eax, 0C0A3C68h              EAX=61329E0C AF=1 OF=0     


.text:loc_413747            pop     eax                         EAX=00413131 ESP=0019FF44                                                                         
.text:loc_413777            xor     eax, 8101h                  EAX=0041B030 AF=0 ZF=0                                                                             
.text:loc_4137A9            mov     edi, eax                    EDI=0041B030                                                                                       
.text:loc_4137E2            xor     eax, eax                    EAX=00000000 ZF=1                                                                                                                                         
.text:loc_413830            call    loc_413841                  ESP=0019FF40                                                                                       
.text:loc_41385C            pop     eax                         EAX=00413835 ESP=0019FF44                                                                           
.text:loc_41388E            push    eax                         ESP=0019FF40                                                                                       
.text:loc_4138BA            mov     edi, eax                    EDI=00413835                                                                                      
.text:loc_4138B2            mov     edi, eax 



.text:loc_4138E6            push    4E000969h                   ESP=0019FF3C                                                                                      
.text:loc_41391F            pop     eax                         EAX=4E000969 ESP=0019FF40                                                                          
.text:loc_413950            xor     eax, edx                    EAX=226B6300 ZF=0                                                                                                                     
.text:loc_4139B4+1          xor     eax, 10A3Eh                 EAX=226A693E PF=0                                                                                
.text:loc_413A1C            xor     eax, ebx                    EAX=F3ABC9EA SF=1                                                                      
.text:loc_413A4C+1          xor     eax, 22511E14h              EAX=D1FAD7FE                                                                            
.text:loc_413AB5+1          xor     eax, 61642Dh                EAX=D19BB3D3                                                                                       
.text:loc_413B83            xor     eax, check_count                                                                                                              
D19BB3D3                    Debug event: Exception -1073741819 occurred: The instruction at 0xD19BB3D3 referenced xD19BB3D3. The memory could not be executed    Debug event: Exception -1073741819 occurred: The instruction at referenced memory at 0xD19BB3D3. The memory could not be executed    
.text:loc_413BBB            jmp     eax                         EFL=00010382 TF=1 RF=1

照着汇编抄了一份z3

from z3 import *
a = BitVec('a',32)
b = BitVec('b',32)
c = BitVec('c',32)
origin_a = a
origin_b = b
origin_c = c
s=Solver()

s.add( (a&0xff) <=128 )

s.add( (b&0xff) <=128 )
s.add( (c&0xff) <=128 )

eax = a
ecx = eax
eax = b
ebx = eax
eax = c
edx = eax
edx = eax
eax = ecx
eax -= ebx
eax <<= 2
eax+=ecx
eax+=edx
s.add(eax==0x0EAF917E2)
eax = 0

eax+=ecx
eax-=ebx
ebx=eax
eax<<=1
eax+=ebx
eax+=ecx
ecx=eax
eax+=edx
s.add(eax == 0xE8F508C8)
eax = 0

eax = ecx
eax = ecx
eax -= edx
s.add(eax == 0xC0A3C68)

# eax =  0x4E000969
# eax ^= edx
# eax ^= 0x10A3E
# eax ^= ebx
# eax ^= 0x22511E14
# eax ^= 0x61642D
# s.add(eax > 0x401000)



print s.check()
m = s.model()
print(hex(int(str(m[origin_a]))))
print(hex(int(str(m[origin_b]))))
print(hex(int(str(m[origin_c]))))

将 abc 转换回字符串 再补上11A 得到 flag:
Just0for0fun11A


[培训]12月3日2020京麒网络安全大会《物联网安全攻防实战》训练营,正在火热报名中!地点:北京 · 新云南皇冠假日酒店

收藏
点赞0
打赏
分享
最新回复 (1)
雪    币: 1703
活跃值: 活跃值 (53)
能力值: ( LV9,RANK:156 )
在线值:
发帖
回帖
粉丝
whydbg 活跃值 2017-10-29 09:13
2
0
编译不成功  'BitVec' is not defined  是什么原因?谢谢。
游客
登录 | 注册 方可回帖
返回