From 17e4bddf72edb1f586a02f3e6a9e35ded9c7fda6 Mon Sep 17 00:00:00 2001 From: simon Date: Tue, 12 Sep 2023 12:38:38 +0200 Subject: [PATCH] angr solved --- .gitignore | 1 + Blockharbor/pwn/Web Server Woes/flag.txt | 1 + Blockharbor/pwn/Web Server Woes/solve.py | 25 ++++++++++++ Blockharbor/pwn/Web Server Woes/web | Bin 0 -> 17880 bytes Blockharbor/rev/Reversing #1/angr.py | 0 Blockharbor/rev/Reversing #1/angr_solve.py | 38 +++++++++++++++++++ Blockharbor/rev/Reversing #1/{a.out => chal} | Bin 19040 -> 18944 bytes Blockharbor/rev/Reversing #1/mod_source.c | 16 ++++---- 8 files changed, 74 insertions(+), 7 deletions(-) create mode 100644 Blockharbor/pwn/Web Server Woes/flag.txt create mode 100644 Blockharbor/pwn/Web Server Woes/solve.py create mode 100755 Blockharbor/pwn/Web Server Woes/web delete mode 100644 Blockharbor/rev/Reversing #1/angr.py create mode 100644 Blockharbor/rev/Reversing #1/angr_solve.py rename Blockharbor/rev/Reversing #1/{a.out => chal} (59%) diff --git a/.gitignore b/.gitignore index 28b4664b..ac0b9812 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ ghidra* hydra.restore .idea core +.gdb_history \ No newline at end of file diff --git a/Blockharbor/pwn/Web Server Woes/flag.txt b/Blockharbor/pwn/Web Server Woes/flag.txt new file mode 100644 index 00000000..1da937dc --- /dev/null +++ b/Blockharbor/pwn/Web Server Woes/flag.txt @@ -0,0 +1 @@ +FLAG diff --git a/Blockharbor/pwn/Web Server Woes/solve.py b/Blockharbor/pwn/Web Server Woes/solve.py new file mode 100644 index 00000000..11948b8a --- /dev/null +++ b/Blockharbor/pwn/Web Server Woes/solve.py @@ -0,0 +1,25 @@ +from pwn import * + +elf = ELF(os.getcwd() + "/web") + +gs = ''' +unset env LINES +unset env COLUMNS +set follow-fork-mode child +br *handle_conn+64 +continue +''' + +def start(): + if args.GDB: + return gdb.debug([elf.path], gs=gs) + else: + return process([elf.path]) + +io = start() +sender = remote("localhost", 5000) + +sender.send(cyclic(2000)) + +sender.interactive() +io.interactive() diff --git a/Blockharbor/pwn/Web Server Woes/web b/Blockharbor/pwn/Web Server Woes/web new file mode 100755 index 0000000000000000000000000000000000000000..21181c1dcbef2bdb68c04b9d2215146620dec824 GIT binary patch literal 17880 zcmeHPeQ;dWb-&X3LkN2%6B~p{>}QCkqM()J$X|f*uB?@xTG<#Q6&f(ltKBDS>-~^- z-^NmkgQ*Z@qio}JhQyuH86|~@-KN2`)70@4EMmZBhA?s_iJfL>6@sU`4G?(=pr+W{ zbMCw6>At6Z<1~}MI(uPt?)jaM`}yv@@4kEeXt1ZNx~hs%@UXiXa+9Ah5x)>L+$|zN z{A?pz3V&C#RcsOP3pi%V{U!ma87@@YX^p@=K+&!NBW36(O_&j-93n+Kx6ri2ln`b0 zCXaRtF)DZ`efAntk0{Bl^b}Lh9Q3FtA5qy3>t_0P({B1MJ8c!^-Y6*9p*ysj5q2}e z&Z3whlnYAriFJZM^5>)q$S^4UFJn%-2Sh%cv{UF4#WXP7chQLaHtFpYcCBknKTg_X z!i*@TcQ4psz5J$unt7K<&#fI4QEsB5T3Jgh+P}WNB^GIpMH89f=HZR&o7cDd(n;T1 zo(0Sorh$EG+m1d4?KX)RH7CZG3m)Z(jmcgvm6KlN?$foY-+ z2DBGlit`x9szM#J{Eu-QF%0MQH{xcj{NH~E__{J84>(lH;Hr!M-@4#maltRR;9qpX z|HK8~<$~Yfg0FJH_q*WZF8DJp_^U4XDHpuM1z+t_|4+N0zBVge4N*_bTYh8H<&&gHQ1n$ zOr%+QC>2c@18g8Uq$k*ro=PQCOw*#ExoMM@PKQGY5E^2;eA?o zaGy31ipE$hnl`{ZZKPsA;(9y{sQ?H6v;Jrz!Uod1zK;!rW68A6K!_Ph4jC*Sip7#) zHjvUo5f%!Eb-*+&JRH&nqKQx}`gzbcQsMXzpjZq{IAv(@P&B~~q@sq7raIf!)7`OE zTkG3k#oDddTHiXRb@y)9B6>>Siy2MzZr>V9CiLD=e@q9*d*jK3aIBfCWfjfQsv5>D z`p;v<2tl0%Wl>WD+olReKIjTG4YC`e(WN+}{aj$nIqzZb3O=(k3Nv;!`v`apG{4fk zHi3gLguIwP3Ev~|8b23X^C0mTwwO4MwemPTE#Y;h3jdpzaJhfaNH{(d6lNuS4S_&s z#rkS7#IYW%AoLN(xq(8BgyTFyplVl_)!U8DdEQ@{3Z!MA>p5t@JR{Bxsk$I z313Yh&?yO5B)k%>)Ig;M{{Pj$`*o{+t&YA^qmD29Neg4@*rZWino>t!t~t#MTUz%$ zA7jN*<7psus~PGKqNG^(S*cVy%z2!!iiL9)j}vFH@RG&j#8oUjZ}B)`6$@Xtc$}z; zg|ApVPEf_dV-}ASQ?an$;&DPM7D5(}6H&2nuf^j8R4fE69w(k+q0QoP!YLNkSUgTN z#lkX+#|frbsIqvR@QZ~@SE#%=(Lnhv9w!(mzs2K10LpLiIMG1)EgmNrD8I$y!~*5F zc$`q6{1%TB36$UBaRPzzTRcu2P=1TY2?NS+@iT<=}G;e$2ribnqDmA9wJ&gWv7o`yBjs z2Oo6sn;rZ*2jA@A8y)^Co!y zN-K)+D)+0yYHst5V5{a9UWa7Utg!+f{Wm~{kN!2K>AKa2J`0cjX`porPlMv-0t$2M z-a>Ng6*W7fzVzM}^`%*lTJ@@W?uxM-96T!=)Rd+Nc)vpX2fz=G4~I6Rm}PG3Q%5)d z8AjFYMPrFNzWE7Y^3ltsQa%C?+p7x?0$;ToYi$n6UUK!}d|z)pSaogo-MvM)US zKc!Mc9beGc#2p4_+a}dqZU)ftF_fKb0yQ=JM)pkpJfx5vI|`thduoc4F;s+7Ew~ny z&YZxs^1lQO0r9vgK7#58&^kMI0u%)to>IqiJV)akei5e>RDHzK8J&!% z+7CbTuUXHdwGz zPr?k7e;y15vcb31-1cekdJ^+y_Wx~QFg7`Yu6_w~Xa0W6)j^1X?u$4BLz-83nq2V* zsOYm4dm;8BCIdcR0g+j^JFxb0eJ_h7&D5>|)ogHT^xza5xfRs^5k0*PnkV2fhNh5e zx$be?KP>z?{K;2yvmcHg{2|Ni7!OWCc4~M_2QR4O@B{w2{|5W)_rS#kP%u;bQ@~8^ zpP^J}HbVRqcxCy&hJ?{4FVs5B%8e+)tmGdBnQ8khV1>1aJqWSaPQxJfIGXeECvbmH zZu39g!dT#sy0bqH^mS)H2=oTBANQ%b=4SxDujkgwxQ5C<_aWrqrOO^;b=yy2{6qVm zY_TW%UT5|{1EuBvp^l!eQa8Ps`7c~wJ-9pYP+)i9;ed8}V8AD*2g4>$m#@pLl^A-f zgh~xmYM@dBl^Uqj!0)C8s>Ck$wqUQ)(wJ7%-rk)I|FpFE+L+JR!eYr7OZ8J~BvRU2 z+m#(jL+MIp5|P@i$pn1sFq(TuhV(lWLmxI;hGOtN!V>i8iM__)9ZFkUZ7rG&pc$+< zEq`lUTa|nMaH(Y=c^Wk0u{i;GYK$zcU0T}+Uu*dH8wJ0)=n?5V3L*Hdh2rKn8RG8O z`<46j)aUe+VhW;(y-G5nG)8L0cNfy^f-gJ@dEX;jQ7{f0l#)S@464(n_e*K&1vMHBhO6N)1$Mpi%>s z8mQF3|D^^daKQ^VCA!2ETL+Km%*hdP7=zAa(D@?#l!gJ<{}||O2Awmavlk@) z;7TcpdJ`V}E6yMTofU_0=q%1zA%{J99#oM*_&mWwgP`&m6oiBso4(srz@YOOapDor3NWbV$%cf*uxhLeS%aP6|3D=(M0Sf--UV zs9sP-&{jeHg69uoAhpc8@~7j#n4DM6NUu$z)hI4ISSljArZTGd^YT{S(h<&rlI^QpA;|W1JpKixJjLx6i@dfOWG9ARj z7Fy4hU4Idy=gE#Qww^mXUc;zA+VN``^+d9#&WO5UmHC(|rxeJ=Fg)M&p{4kCF=IIHS3|wc z$cF#{!=oRFD>QJL>ii5o;xvy4m~DVam6RV$4?`FHs>;+u9B}kA;qX7g_2<{;5x~pk z->qDK$Nem4&)f_VM=0m#1lL(Huf1Layo$|luOA3~nhz<7i##&F|IBhf^V|0uFh5nZ z`Ok$H3U(dT&tWm~(jL$%j#FxLv=wk=j{{*ejawg_q*U(7yN0C*Rx}y zefeG*X(hDU1U1!Xl`*a`kZ+!0( zWO$#eTs{1&3x3`Oe;It$!}!qP7YPcoMWjpPc8kD&;o|2C;OM8`;is0jV?A3V7Iu7Z z7JSvYwC@@hyxj#?UGRro@cl0MDB##G&isEFa7C0|CdUB3Sq4P>6&L^KUGQJH;4GXn z(nbcpyocG`9SF^cYj7PSp{L;nL?o&0jV1d-F)d;wQ)w-f8D`;Rd?=F$juDFMS|k&XkAR89X`pG?R1fI=&1wEgqWM5lPeblBt!r0c zdr%AR=+xjQhTSB>w9Y@?5!l|n)h^*TLI8qmWm-@b9@NfVOxxCTPe-6fyQiz`zF@D` z8|df>qE~*8B%IFh%=7yrem`9xx!PqByaQv`=2utj(A@nNJI*hx*rCBtA`;WJa59l# znjQ%mA#q8@u4Z1Wv186lICIi=^KQ=^fTc1o<=C-#cWRts%#e9AMqI-Pvv;%?US%J4bT}7Ls2xvO}8IpH7Q1 z@M}Z(jm)mX?>^Zf^CFZTGp{GvF>!s$4&wDHJECcD<%qg9-bE^V!N`8`$?gH~UD*-y zdX)p?-v{j&^QA}PMyMaCkuvEZ#o+3fo*H7lMAFcGdlMPoPzvsWrHl~?>d!>sYG^bf zpg>1=vk}_MxcXoyJ;;2Kkpv`RQn>KNCGep!9Ze=|j0Uol9t)v?hz-RI=HspJgQ#zB z5?G9+^)U0{w^ioDAqKRQ{NeEFgJMt_jDR=dOdsaxVp>ofk_yG6;LJ3KzQBAivc+Mv zDl_E%RuHblVQBzsJTo-FIE;ZP?UR_OsY`LBx4;kgCdi)N7l|q$lLPHX5Vjs7vi$=h zeWLgsRSvWsAgmiAvOT?j5>-f1P^bOe~420wEyGGe+cYx?}zN^eU>QQ zAICgmJ(E4{(?kKoB9lGsHxZ@%B~al3eaK-yFt~R^_Vj*Cv{NWk{z;GM7eJ1CLB!L0 zG*Q2>cjjNfEC&&+Q?jS`ZK9Jxk811pnoc3P_4C{pa!{W;f zf;!(co$dd$!(I_~M5i1T?r_h(>9D8$0HUNXa^=h(JMOTz7PDeeJ9(A#zw5B4bt=&x z(TkbLfHOaM_)@Mv+J_)Y`>ev8w>8C)z5+kAr}k$GFc=j6m*IP#9H{*W`#wZud)n6^ z+Cz$hI@|B34tv`FAlh`5^e=)v?j?v}$J!^Me}}-CU*d^g0$bSavFvGoIe$BV5J=DD z=6J#{g8=(3rBC}V*1szu@{i9S2C}1e{CmJqh3sj6W*V*mVNhJkPkt7GT()O^ZUz@f zO-ktq)JmWDC18xcD1CZws2BE>4(U6x! sd$CF=KQ#X0zB%PxGH0_JO|Ik+Qo5vz+kXxfF8b&$Q)8vWz`?Tr1xP=q!~g&Q literal 0 HcmV?d00001 diff --git a/Blockharbor/rev/Reversing #1/angr.py b/Blockharbor/rev/Reversing #1/angr.py deleted file mode 100644 index e69de29b..00000000 diff --git a/Blockharbor/rev/Reversing #1/angr_solve.py b/Blockharbor/rev/Reversing #1/angr_solve.py new file mode 100644 index 00000000..928381ee --- /dev/null +++ b/Blockharbor/rev/Reversing #1/angr_solve.py @@ -0,0 +1,38 @@ +import angr +import claripy +import logging +from pwn import * + +logging.getLogger('angr').setLevel('DEBUG') + +base = 0x00100000 + +input_len = 32 + +success = 0x001014a8 +fail = 0x0010150b + +proj = angr.Project("/home/simon/CTF/Blockharbor/rev/Reversing #1/chal", main_opts = {"base_addr": base}) + +flag_chars = [ claripy.BVS(f"flag_char{i}", 8) for i in range(input_len)] +flag = claripy.Concat( *flag_chars ) + +state = proj.factory.entry_state(args=["./chal"], remove_options={angr.options.LAZY_SOLVES}, stdin=flag) + +for k in flag_chars: + state.solver.add(k >= 0x00) + state.solver.add(k <= 0xff) + +simgr = proj.factory.simulation_manager(state) +simgr.explore(find=success) + +pass +if len(simgr.found) > 0: + for found in simgr.found: + print(found.posix.dumps(0)) + io = process("./chal") + io.send(found.posix.dumps(0)) + print(io.recvall()) + +else: + print(simgr) \ No newline at end of file diff --git a/Blockharbor/rev/Reversing #1/a.out b/Blockharbor/rev/Reversing #1/chal similarity index 59% rename from Blockharbor/rev/Reversing #1/a.out rename to Blockharbor/rev/Reversing #1/chal index 0244addb00701edf04ae1f947be73ea627edf207..9ea0e01433fca23b853edd00efaec752cc9922b7 100755 GIT binary patch delta 1521 zcmb7DZA@EL7(VB;2ij6vD7R&9gBAyw3|hE!w2V<1F4fyaS(ZsQm$1aK5l~B=_EMkLm^*#3zz536SoR9lF z&-U_I_cG}>sOUJs8Y7+OK70AyyQPoXKJ7RV z?=zHT)1To|&T@bCTRuW2Ma1tbvBlVYj9)}W8E57tH+uV8(Oo7{^C($$CDWLq9#dJAUhXMfy3c1_odTm8cv-Jr`i+C_rF+; zg;UA(h{*!Gr@X41mrjYTG5j^?cGUDQdewZAm;X$sCv%XQTBC2Q5krFTXdxF>Y<5~m zlBbbCn;{JohS|EKMUb7g2%Q^ObK!d;=2i>Eg6Q*bVcZdPI4d#4XO@^qF*^jVydt*U z3m(atU#zF2392f7Er-K-9=Z%}$+hX5a-Bgmp?SQCp#6%`WWSP_Su#O)ohthyt84ZEcL((ymkV{=sDJtp_y>7psx+k)y_SvvJ7 zydrJfHCOhJ*-brt0Bxe-6pbEF8BQ!<@RY_Tt2O`k^kNyYp@nON#8c9DmiIkIn)~hT zbow@ywD3+kor6`K0%y@gL9M8AgDq!}?aa>TwPu>|b0hXX>_5O_k(*|~og#PsAV!~K zI<4U}Lv>t!a3Tv5%mUZFHLTbfxA-1srG8(PuhLsp>XFqI!IKjaONg*1$}VofuigDiOiJqnxUKH35ogB7Kf9E#v}N zSgV--&XVlH?T5<4;kPom^@nbPD7-n%Wekq0An!R zf6T3731_OkPn%vcEpY1uH}r7Je(p21@-400G0y{a+*ZderU@0RLb&dK!hw0=z@a}- zm@BsXk@Kgx%@pFihiAdtfilZujZL1NauBZ_Ji$lcW*`IygD>#s+dGeR!BVin?5}9= zYU$`bbQqqfamOPy(@cFc+sCN<--}zNggA)(?+2kiRIC8UdJB977VD1EcsvsNFq4h| z4Odu-oycRuXILAaWwa2e5~QuLO{u42a16)&a8;={U*D?fUI!Wp(oWbGsW-O;HEan^ ZBBsFANIgr{!D{4Tb5p%WJp(g}`!6X{tFiz9 delta 1532 zcmbVLYfM~46rP#gVIM3D`$SS;cU$oRUD&&YU5X$@O1MNt{ZR{T48hU@mY5i5j7ovH zSi2!r=%KYL5s67{^oP>bXsZ^KiX|#3(Zo=V)}+QIkqD-VE2Uh|+>3SfpH4F8%zWoN z-<&&hZr?DyJWK~~W8SKv{O?Va6Lrv-jqYU5l%iih>DhVwm20afdh=GkE_3zyzl?S3 z3exBToXS{iOgmXf$XSu``*QSRl)sGI0e%eaLsL8C=uh$y-eM(0j(+yOAjO|uQxwDw zCu5x&R-TMC!II5o>eryS1Xlaj%>hMGXiZ|ECec2*xHh{Itx3eQ5t9VADxZ*#IG+)R zp#BJS+Dq^F%CDXrfAhMcoXx<7ze-7{tC(NSsX~dCRgn4-D z@u%<;BMEw74`Pnw{Bv-|nf>5$!Qb+_ zrsT*kMmcicI2DsND(2H(J+;j*DasO-mA$Me8I+I@!Q~sxDHWGoWz9Ims?$~QP%n~dN76$xM@$FtI z2+e^U)~kbY=H4`k0-R8B21%3Ao^(puypl4aD(F=ob)3!Oc>p# zX!Ntfd;@_J54{2plmrY76+Ha|Zh^rPe=oNf`?;=*n+enFcJV^tjQe=L@cX!3xC=Za zTsgODPNf=0Z*YSeS4}DZk12Pn!vEtKwWJGwmBd8}kQ>UiUE#cuTa6W*ckxsey*E?< z=R+0d+WH;dYAGyQ>gmv3K*LY!_cwR6LtnVc6fA0gbWg{Dmc6hT_QV##6HN5t8)e6- z^zY7C!Pd8v^cx+g{s4Hx93NERSK+bp$LV-%q5M4qZG*AxMdrkM&!FU`?bG;VFjgC; ztuS9(Nne00xsvXNM!C{7SByG1uEUrdrn4}Q*i2Z%egI!xn4W^hx=Pki0Wa0vX?nL( K3q1nOvgc1qX_YSk diff --git a/Blockharbor/rev/Reversing #1/mod_source.c b/Blockharbor/rev/Reversing #1/mod_source.c index c50f948b..eb8f63a1 100644 --- a/Blockharbor/rev/Reversing #1/mod_source.c +++ b/Blockharbor/rev/Reversing #1/mod_source.c @@ -28,7 +28,7 @@ void setup() { } int check_pass(unsigned int start[]) { - printf("checking\n"); + //printf("checking\n"); unsigned int temp = 0; for (int i = 0; i < 4; ++i) { temp = start[i]; @@ -50,24 +50,26 @@ void main(){ memset(start, 0, 16); read(0, user_input, MAX_SIZE); + //printf("%X ",user_input); + //printf("\n"); for (int i = 0; i < 4; i++) { - + start[i] |= ((unsigned int)user_input[(i * 4)] << 24); start[i] |= ((unsigned int)user_input[(i * 4)+1] << 16); start[i] |= ((unsigned int)user_input[(i * 4)+2] << 8); start[i] |= ((unsigned int)user_input[(i * 4)+3] << 0); - printf("%X ",start[i]); + //printf("%X ",start[i]); } - printf("\n"); + //printf("\n"); if (check_pass(start) == 1) { - printf("Thats it!\r\nSubmit in the format FLAG{"); + //printf("Thats it!\r\nSubmit in the format FLAG{"); for (int i = 0; i < 4; i++) { - printf("%X",start[i]); + //printf("%X",start[i]); } - printf("}\n"); + //printf("}\n"); } // Failed, just spin