StarCTF2018_SimpleWeb_writeup

如今的Web一点都不纯了:(
多多少少都参杂了一点re和pwn…然而只会做这Web第一题:(
题目给了nodejs的源码。

var net = require('net');

flag='fake_flag';

var server = net.createServer(function(socket) {
   socket.on('data', (data) => { 
       //m = data.toString().replace(/[\n\r]*$/, '');
       ok = true;
       arr = data.toString().split(' ');
       arr = arr.map(Number);
       if (arr.length != 5) 
           ok = false;
       arr1 = arr.slice(0);
       arr1.sort();
       for (var i=0; i<4; i++)
           if (arr1[i+1] == arr1[i] || arr[i] < 0 || arr1[i+1] > 127)
               ok = false;
       arr2 = []
       for (var i=0; i<4; i++)
           arr2.push(arr1[i] + arr1[i+1]);
       val = 0;
       for (var i=0; i<4; i++)
           val = val * 0x100 + arr2[i];
       if (val != 0x23332333)
           ok = false;
       if (ok)
           socket.write(flag+'\n');
       else
           socket.write('nope\n');
   });
   //socket.write('Echo server\r\n');
   //socket.pipe(socket);
});

HOST = '0.0.0.0'
PORT = 23333

server.listen(PORT, HOST);

拿到flag的条件是使val最后等于0x23332333。因此我们可以先将0x23332333对0x100循环取余得到arr2。

var val = 0x23332333
var arr2 = []

for (var i=0; i<4; i++)
{
	x = val % 0x100
	arr2.unshift(x)
	val  = (val - x) / 0x100
}

console.log(arr2)
// arr2 = [35, 51, 35, 51]

注意到源码中的arr1.sort()。在js中，sort方法在排序时是按照ascii码大小来排序的。因此会出现如下怪异的情况：

console.log([3, 25, 100, 6].sort())
// [ 100, 25, 3, 6 ]

于是可爆破出满足sort()排序的arr1

var arr2 = [35, 51, 35, 51]

for (var a=0; a<=35; a++)
{
	b = 35 - a
	c = 51 - b
	d = 35 - c
	e = 51 - d
	if (a==b || b==c || c==d || d==e) continue
	var arr = [a, b, c, d, e]
	var arr1 = arr.slice(0)
	if (arr.sort().toString() == arr1.toString())
	{
		console.log(arr)
		break
	}	
}

得到结果为[ 15, 20, 31, 4, 47 ]