Flare-On 2018 writeup（上）

Ultimate Minesweeper

donet写的扫雷程序，找到正确的安全位置点击，雷区map的布置藏在下面的代码中

mine = []
vtypes = [-896,-639,-270]
for i in range(30):
    mine.append([])
    for j in range(30):
        flag = True
        r = i + 1
        c = j + 1
        if ~((r * 30) + c) in vtypes:
            flag = False
            print 'x',j,'y',i

FLEGGO

解压得到48个程序，模式一模一样，可以通过脚本批量取出各个程序的key，输入正确的key后，echo几个字符并得到一张乐高图片

import os
from subprocess import *

output = ''
pngtxt = ''

for dirpath,dirnames,filenames in os.walk('FLEGGO'):
    for file in filenames:
        pathname = os.path.join(dirpath,file)
        if pathname[-4:] == '.exe':
            txt = open(pathname,'rb').read()
            head = txt.find('\x42\x00\x52\x00', 6500) + 14
            tail = txt.find('\x00\x00', head)
            pw = txt[head:tail:2]
            output = output + pathname + '\t' + pw + '\n'
            p = Popen(pathname,stdin=PIPE,stdout=PIPE)
            p.stdin.write(pw + '\n')
            p.stdin.flush()
            p.stdout.readline()
            p.stdout.readline() 
            pngtxt = pngtxt + p.stdout.readline() + '\n'
open('res.txt','w+').write(output)

对图片根据内容进行标号，然后将得到的字符按图片标号顺序连接即flag

pngdat = []
for i in range(48):
    pngdat.append(open('png\\%02d.png'%(i+1),'rb').read())
pngarr = pngtxt.split('\n')
for p in pngarr:
    pinfo = p.split(' ')
    pngd = open('FLEGGO\\%s'%(pinfo[0]),'rb').read()
    print str(pngdat.index(pngd)) + '\t' + str(pinfo[1])

mor3_awes0m3_th4n_an_awes0me_p0ssum@flare-on.com

binstall

donet程序，会删除浏览器缓存，修改注册表，然后释放browserassist.dll文件

function cp(p) { //get password
    if (model.passwordEntered = !1, 10 === p.length && 123 == (16 ^ p.charCodeAt(0)) && p.charCodeAt(1) << 2 == 228 && p.charCodeAt(2) + 44 === 142 && p.charCodeAt(3) >> 3 == 14 && p.charCodeAt(4) === parseInt(function() {
        var h = Array.prototype.slice.call(arguments),
        k = h.shift();
        return h.reverse().map(function(m, W) {
            return String.fromCharCode(m - k - 24 - W)
        }).join("")
    } (50, 124) + 4..toString(36).toLowerCase(), 31) && p.charCodeAt(5) - 109 == -22 && 64 == (p.charCodeAt(3) << 4 & 255) && 5 * p.charCodeAt(6) === parseInt(function() {
        var n = Array.prototype.slice.call(arguments),
        M = n.shift();
        return n.reverse().map(function(r, U) {
            return String.fromCharCode(r - M - 16 - U)
        }).join("")
    } (22, 107) + 9..toString(36).toLowerCase(), 19) && p.charCodeAt(7) + 14 === "xyz".charCodeAt(1) && 3 * (6 * (p.charCodeAt(8) - 50) + 14) == 17 + parseInt(function() {
        var l = Array.prototype.slice.call(arguments),
        f = l.shift();
        return l.reverse().map(function(O, o) {
            return String.fromCharCode(O - f - 30 - o)
        }).join("")
    } (14, 93) + 6..toString(36).toLowerCase(), 8) - 1 + 12 && 3 + (p.charCodeAt(9) + 88 - 1) / 2 === p.charCodeAt(0)) model.root = 1,
    model.password = p, console.log(p) ;
    else {
        ……省略一万字
}

function de(instr) { //de code flag
    for (var zzzzz, z = model.password,
    zz = atob(instr), zzz = [], zzzz = 0, zzzzzz = "", zzzzzzz = 0; zzzzzzz < parseInt("CG", 20); zzzzzzz++) zzz[zzzzzzz] = zzzzzzz;
    for (zzzzzzz = 0; zzzzzzz < parseInt("8O", 29); zzzzzzz++) zzzz = (zzzz + zzz[zzzzzzz] + z.charCodeAt(zzzzzzz % z.length)) % parseInt("8G", 30),
    zzzzz = zzz[zzzzzzz],
    zzz[zzzzzzz] = zzz[zzzz],
    zzz[zzzz] = zzzzz;
    for (var y = zzzz = zzzzzzz = 0; y < zz.length; y++) zzzz = (zzzz + zzz[zzzzzzz = (zzzzzzz + 1) % parseInt("514", 7)]) % parseInt("213", 11),
    zzzzz = zzz[zzzzzzz],
    zzz[zzzzzzz] = zzz[zzzz],
    zzz[zzzz] = zzzzz,
    zzzzzz += String.fromCharCode(zz.charCodeAt(y) ^ zzz[(zzz[zzzzzzz] + zzz[zzzz]) % parseInt("D9", 19)]);
    return zzzzzz
}

根据js中的等式推测出password= k9btBW7k2y，然后执行de(..)函数

web 2.0

wasm,可以由chrome调试

github下载wabt将wasm转换为wat文件，S字节码，非常类似JVM字节码时刻都在入栈、出栈。

编写watHelper脚本解析函数块，思路是记录指令操作的栈影响，然后还原出代码（遇到function call出入栈数量要根据函数类型决定）

watHelper部分代码如下

Magic

666轮checkkey通过后可以得到flag

sub_4037BF在每轮通过后改变自身程序，改变decoder和分段check函数

由decoder[33]将一轮的key分33段检查，每段的检查函数需要pFunc ^ pFunXorArr解密，并且每一轮decoder的内容、pFunc、pFunXorArr内存区的内容都将被改变

getkey程序将magic当前轮的decoder和funcArr、funcXorArr加载在本地然后进行爆破（每个片段最大为3个Ascii）

爆破流程

在call ram前对stack进行清空，否则有些函数内未对所有局部变量初始化会造成和源程序执行的结果不同

pwntools进行多轮爆破

mag!iC_mUshr00ms_maY_h4ve_g!ven_uS_Santa_ClaUs@flare-on.com

t_6b40 = [0x0F,0x57,0x61,0x77,0x0B,0xFA,0xB5,0xD1,0x81,0x99,0xAC,0xA7,0x90,0x58,0x1A,0x52,0x0C,0xA0,0x08,0x2D,0xED,0xD5,0x6D,0xE7,0xE0,0xF2,0xBC,0xE9,0xF2]
t_6bb8 = [0x5F,0x68,0x44,0x62,0x23,0xBA,0x21,0x54,0x33,0x73,0x04,0x65,0x50,0x97,0x72,0x26,0x01,0xC4,0xCD,0x11,0xB6,0x0B,0xD6,0xF9,0x58,0x76,0x7E,0x65,0x69]
counter = 0

def printArr(arr):
    output = ''
    for c in arr:
        output = output + chr(c)
    print output

for magicnum in t_6b40:
    if magicnum == t_6b40[counter]:
        for i in range(counter+1, 29):
            t_6b40[i] = t_6b40[i] ^ magicnum
    t_6bb8[counter] = t_6bb8[counter] ^ t_6b40[counter]
    counter = counter + 1
    print ''
    printArr(t_6b40)
    printArr(t_6bb8)