Dreamhack CTF Season 7 Round #6 (🌱Div2) flag printer write up

풀이

unsigned __int64 __fastcall sub_1437(char *a1)
{
  int v2; // eax
  unsigned int v4; // [rsp+18h] [rbp-38h]
  int i; // [rsp+1Ch] [rbp-34h]
  const char *s1; // [rsp+20h] [rbp-30h]
  char *v7; // [rsp+28h] [rbp-28h]
  char s2[5]; // [rsp+33h] [rbp-1Dh] BYREF
  unsigned __int64 v9; // [rsp+38h] [rbp-18h]

  v9 = __readfsqword(0x28u);
  v4 = 0;
  a1[strcspn(a1, "\n")] = 0;
  s1 = strtok(a1, " ");
  while ( s1 )
  {
    if ( !strcmp(s1, "print") )
      return (unsigned __int64)v4 << 32;
    if ( !strcmp(s1, "id") )
      return ((unsigned __int64)v4 << 32) | 1;
    if ( !strcmp(s1, "help") )
      return ((unsigned __int64)v4 << 32) | 2;
    v7 = strdup(s1);
    for ( i = 0; v7[i]; ++i )
    {
      v2 = i;
      v7[v2] ^= 0x42u;
    }
    strcpy(s2, "&-17");
    if ( strcmp(v7, s2) )
    {
      free(v7);
      return ((unsigned __int64)v4 << 32) | 0xFFFFFFFF;
    }
    v4 = 1;
    s1 = strtok(0LL, " ");
    free(v7);
  }
  return ((unsigned __int64)v4 << 32) | 0xFFFFFFFF;
}

- sub_1437 함수에서 s에서 strtok 함수로 공백으로 구분된 문자열을 처리함. 
- print, id, help가 아닐 때, 입력 문자열의 각 문자^0x42 결과가 "&-17"과 동일한 경우 v4=1로 설정됨.

void __fastcall __noreturn main(__int64 a1, char **a2, char **a3)
{
  __int64 v3; // rax
  char s[72]; // [rsp+10h] [rbp-50h] BYREF
  unsigned __int64 v5; // [rsp+58h] [rbp-8h]

  v5 = __readfsqword(0x28u);
  sub_13A9(a1, a2, a3);
  sub_140E();
  while ( 1 )
  {
    while ( 1 )
    {
      printf("> ");
      fgets(s, 64, stdin);
      v3 = sub_1437(s);
      if ( (_DWORD)v3 != 2 )
        break;
      sub_1749();
    }
    if ( (int)v3 > 2 )
    {
LABEL_10:
      puts("Invalid Command!");
    }
    else if ( (_DWORD)v3 )
    {
      if ( (_DWORD)v3 != 1 )
        goto LABEL_10;
      sub_1711(HIDWORD(v3));
    }
    else
    {
      sub_1673(HIDWORD(v3));
    }
  }
}

- 이후 main 함수를 보면 2인 경우엔 출력을, 2 이상인 경우 Invalid Command를, 1인 경우 id를 출력함. 이외의 경우엔, 예를 들면 0인 경우엔 sub_1673 함수로 분기함

int __fastcall sub_1673(int a1)
{
  const char *v1; // rax
  char i; // al
  FILE *stream; // [rsp+48h] [rbp-8h]

  if ( a1 )
    v1 = "./flag";
  else
    v1 = "./art";
  stream = fopen(v1, "r");
  for ( i = getc(stream); i != -1; i = getc(stream) )
    putchar(i);
  fclose(stream);
  return putchar(10);
}

- 이때 참이면 flag를, 아니면 art를 출력함. 따라서 플래그 함수로 진입했다 해도 0이면 플래그를 출력하지 못함(입력 처리에서 그냥 v4=0인 상태에서 print를 주는 경우)
- 조건을 만족하기 위해 v7^0x42를 구해서 v4=1(0x0000000000000001)로 만들고, 이후 print로 인해 1<<32를 하면 
0x0000000100000000이 되어 플래그 함수로의 분기 조건과(하위가 0이므로) 플래그 출력 조건(상위 4바이트가 1임)을 만족하여 플래그가 출력됨


익스플로잇 코드

from pwn import *

context.log_level='debug'
p = remote('host3.dreamhack.games',21849)

target="&-17"
v7=''.join(chr(ord(c) ^ 0x42) for c in target)
print(f'v7: {v7}')
p.sendlineafter(b'>', v7+" "+"print")

p.interactive()

728x90

결과