CTF-All-In-One/doc/6.2.5_re_picoctf2014_baleful.md

# 6.2.5 re PicoCTF2014 Baleful

- [题目解析](#题目解析)
  - [逆向 VM 求解](#逆向-vm-求解)
  - [使用 Pin 求解](#使用-pin-求解)
- [参考资料](#参考资料)

[下载文件](../src/writeup/6.2.5_re_picoctf2014_baleful)

## 题目解析

```text
$ file baleful
baleful: ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, stripped
$ strings baleful | grep -i upx
@UPX!
$Info: This file is packed with the UPX executable packer http://upx.sf.net $
$Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $
UPX!u
UPX!
UPX!
$ upx -d baleful -o baleful_unpack
                       Ultimate Packer for eXecutables
                          Copyright (C) 1996 - 2017
UPX 3.94        Markus Oberhumer, Laszlo Molnar & John Reiser   May 12th 2017

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
    144956 <-      6752    4.66%   linux/i386    baleful_unpack

Unpacked 1 file.
$ file baleful_unpack
baleful_unpack: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.24, BuildID[sha1]=35d1a373cbe6a675ecbbc904722a86f853f20ce3, stripped
```

经过简单地检查，我们发现二进制文件被加了壳，使用 upx 脱掉就好了。

运行下看看，典型的密码验证题：

```text
$ ./baleful_unpack
Please enter your password: ABCD
Sorry, wrong password!
```

### 逆向 VM 求解

打开 r2 开干吧！

```text
[0x08048540]> pdf @ main
/ (fcn) main 96
|   main ();
|           ; var int local_8h @ ebp-0x8
|           ; var int local_10h @ esp+0x10
|           ; var int local_8ch @ esp+0x8c
|           ; DATA XREF from entry0 (0x8048557)
|           0x08049c82      push ebp
|           0x08049c83      mov ebp, esp
|           0x08049c85      push edi
|           0x08049c86      push ebx
|           0x08049c87      and esp, 0xfffffff0
|           0x08049c8a      sub esp, 0x90
|           0x08049c90      mov eax, dword gs:[0x14]                   ; [0x14:4]=-1 ; 20
|           0x08049c96      mov dword [local_8ch], eax
|           0x08049c9d      xor eax, eax
|           0x08049c9f      lea eax, [local_10h]                       ; 0x10 ; 16
|           0x08049ca3      mov ebx, eax
|           0x08049ca5      mov eax, 0
|           0x08049caa      mov edx, 0x1f                              ; 31
|           0x08049caf      mov edi, ebx
|           0x08049cb1      mov ecx, edx
|           0x08049cb3      rep stosd dword es:[edi], eax
|           0x08049cb5      lea eax, [local_10h]                       ; 0x10 ; 16
|           0x08049cb9      mov dword [esp], eax
|           0x08049cbc      call fcn.0804898b
|           0x08049cc1      mov eax, 0
|           0x08049cc6      mov edx, dword [local_8ch]                 ; [0x8c:4]=-1 ; 140
|           0x08049ccd      xor edx, dword gs:[0x14]
|       ,=< 0x08049cd4      je 0x8049cdb
|       |   0x08049cd6      call sym.imp.__stack_chk_fail              ; void __stack_chk_fail(void)
|       |   ; CODE XREF from main (0x8049cd4)
|       `-> 0x08049cdb      lea esp, [local_8h]
|           0x08049cde      pop ebx
|           0x08049cdf      pop edi
|           0x08049ce0      pop ebp
\           0x08049ce1      ret
```

`fcn.0804898b` 是程序主要的逻辑所在，很容易看出来它其实是实现了一个虚拟机：

### 使用 Pin 求解

就像上面那样逆向实在是太难了，不如 Pin 的黑科技。

编译 32 位 pintool：

```text
[ManualExamples]$ make obj-ia32/inscount0.so TARGET=
```

随便输入几个长度不同的密码试试：

```text
[ManualExamples]$ echo "A" | ../../../pin -t obj-ia32/inscount0.so -o inscount.out -- ~/baleful_unpack ; cat inscount.out
Please enter your password: Sorry, wrong password!
Count 437603
[ManualExamples]$ echo "AA" | ../../../pin -t obj-ia32/inscount0.so -o inscount.out -- ~/baleful_unpack ; cat inscount.out
Please enter your password: Sorry, wrong password!
Count 438397
[ManualExamples]$ echo "AAA" | ../../../pin -t obj-ia32/inscount0.so -o inscount.out -- ~/baleful_unpack ; cat inscount.out
Please enter your password: Sorry, wrong password!
Count 439191
```

```text
$ python -c 'print(439191 - 438397)'
794
$ python -c 'print(438397 - 437603)'
794
```

指令执行的次数呈递增趋势，完美，这样只要递增到这个次数有不同时，就可以得到正确的密码长度：

```python
#!/usr/bin/env python

import os

def get_count(flag):
    cmd = "echo " + "\"" + flag + "\"" + " | ../../../pin -t obj-ia32/inscount0.so -o inscount.out -- ~/baleful_unpack"
    os.system(cmd)
    with open("inscount.out") as f:
        count = int(f.read().split(" ")[1])
    return count

flag = "A"
p_count = get_count(flag)
for i in range(50):
    flag += "A"
    count = get_count(flag)
    print("count: ", count)
    diff = count - p_count
    print("diff: ", diff)
    if diff != 794:
        break
    p_count = count
print("length of password: ", len(flag))
```

```text
Please enter your password: Sorry, wrong password!
count:  459041
diff:  794
Please enter your password: Sorry, wrong password!
count:  459835
diff:  794
Please enter your password: Sorry, wrong password!
count:  508273
diff:  48438
length of password:  30
```

好，密码长度为 30，接下来是逐字符爆破，首先要确定字符不同对 count 没有影响：

```text
[ManualExamples]$ echo "A" | ../../../pin -t obj-ia32/inscount0.so -o inscount.out -- ~/baleful_unpack ; cat inscount.out
Please enter your password: Sorry, wrong password!
Count 437603
[ManualExamples]$ echo "b" | ../../../pin -t obj-ia32/inscount0.so -o inscount.out -- ~/baleful_unpack ; cat inscount.out
Please enter your password: Sorry, wrong password!
Count 437603
[ManualExamples]$ echo "_" | ../../../pin -t obj-ia32/inscount0.so -o inscount.out -- ~/baleful_unpack ; cat inscount.out
Please enter your password: Sorry, wrong password!
Count 437603
```

确实没有，写下脚本：

```python
#!/usr/bin/env python

import os

def get_count(flag):
    cmd = "echo " + "\"" + flag + "\"" + " | ../../../pin -t obj-ia32/inscount0.so -o inscount.out -- ~/baleful_unpack"
    os.system(cmd)
    with open("inscount.out") as f:
        count = int(f.read().split(" ")[1])
    return count

charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-+*'"

flag = list("A" * 30)
p_count = get_count("".join(flag))
for i in range(30):
    for c in charset:
        flag[i] = c
        print("".join(flag))
        count = get_count("".join(flag))
        print("count: ", count)
        if count != p_count:
            break
    p_count = count
print("password: ", "".join(flag))
```

```text
packers_and_vms_and_xors_oh_mx
Please enter your password: Sorry, wrong password!
count:  507925
packers_and_vms_and_xors_oh_my
Please enter your password: Congratulations!
count:  505068
password:  packers_and_vms_and_xors_oh_my
```

简单到想哭。

## 参考资料

- [Pico CTF 2014 : Baleful](https://github.com/ctfs/write-ups-2014/tree/master/pico-ctf-2014/master-challenge/baleful-200)