2015 RCTF / 攻防世界高手区 where
Where is the flag.(The flag should include RCTF{})
hint: where is body
hint2: the KEY is visible strings, -k -nosalt
1、炸弹引爆
2、dex修复
0x01 漏洞简析1. 炸弹引爆
“炸弹引爆”,先将恶意代码作为炸弹,隐藏在手机设备之中,然后再使用引爆器来点燃隐藏炸弹。2. dex修复
dex修复首先要了解dex格式:header : DEX 文件头,记录了一些当前文件的信息以及其他数据结构在文件中的偏移量string_ids : 字符串的偏移量type_ids : 类型信息的偏移量proto_ids : 方法声明的偏移量field_ids : 字段信息的偏移量method_ids : 方法信息(所在类,方法声明以及方法名)的偏移量class_def : 类信息的偏移量data : :数据区link_data : 静态链接数据区
这道题重点是 header、string_ids、type_idsdex修复我的理解就是格式对应清楚就可以进行修复,具体的结构可以查看Android源码。0x02 逻辑分析
1. 查看apk
java层没有flag,但是指向了assets和META-INF文件夹。openssl enc -d -aes-128-cbc -in body -out decrypted -k 'Misc@inf0#fjhx11' -nosalt
解密前:encode_body
解密后:decode_body
2.dex修复还原
/* access modifiers changed from: protected */ public void onCreate(Bundle bundle) { throw new VerifyError("bad dex opcode"); }
说明onCreate方法有问题:
CODE:00097390 # Source file: MainActivity.javaCODE:00097390 protected void com.example.hello.MainActivity.onCreate(CODE:00097390 android.os.Bundle savedInstanceState)CODE:00097390 this = v6CODE:00097390 savedInstanceState = v7CODE:00097390 0000 nopCODE:00097392 .prologue_endCODE:00097392 .line 15CODE:00097392 0000 nopCODE:00097394 0000 nopCODE:00097396 0000 nopCODE:00097398 .line 16CODE:00097398 0000 nopCODE:0009739A 0000 nopCODE:0009739C 0000 nopCODE:0009739E 0000 nopCODE:000973A0 0000 nopCODE:000973A2 0000 nopCODE:000973A4 .line 17CODE:000973A4 0000 nopCODE:000973A6 0000 nopCODE:000973A8 0000 nopCODE:000973AA 0000 nopCODE:000973AC 0000 nopCODE:000973AE 0000 nopCODE:000973B0 0000 nopCODE:000973B2 .local name:'strb' type:'Ljava/lang/StringBuilder;'CODE:000973B2 strb = v1CODE:000973B2 .line 18CODE:000973B2 0000 nopCODE:000973B4 0000 nopCODE:000973B6 0000 nopCODE:000973B8 0000 nopCODE:000973BA 0000 nopCODE:000973BC 0000 nopCODE:000973BE .line 19CODE:000973BE 0000 nopCODE:000973C0 0000 nopCODE:000973C2 0000 nopCODE:000973C4 0000 nopCODE:000973C6 0000 nopCODE:000973C8 0000 nopCODE:000973CA 0000 nopCODE:000973CC .line 20CODE:000973CC 0000 nopCODE:000973CE 0000 nopCODE:000973D0 0000 nopCODE:000973D2 0000 nopCODE:000973D4 0000 nopCODE:000973D6 0000 nopCODE:000973D8 0000 nopCODE:000973DA 0000 nopCODE:000973DC 0000 nopCODE:000973DE .line 21CODE:000973DE 0000 nopCODE:000973E0 0000 nopCODE:000973E2 0000 nopCODE:000973E4 0000 nopCODE:000973E6 0000 nopCODE:000973E8 0000 nopCODE:000973EA 0000 nopCODE:000973EC 0000 nopCODE:000973EE .line 22CODE:000973EE 0000 nopCODE:000973F0 0000 nopCODE:000973F2 0000 nopCODE:000973F4 0000 nopCODE:000973F6 .local name:'flag' type:'Ljava/lang/String;'CODE:000973F6 flag = v0CODE:000973F6 .line 23CODE:000973F6 0000 nopCODE:000973F8 0000 nopCODE:000973FA 0000 nopCODE:000973FC 0000 nopCODE:000973FE 0000 nopCODE:00097400 0000 nopCODE:00097402 0000 nopCODE:00097404 0000 nopCODE:00097406 0000 nopCODE:00097408 0000 nopCODE:0009740A 0000 nopCODE:0009740C 0000 nopCODE:0009740E 0000 nopCODE:00097410 0000 nopCODE:00097412 0000 nopCODE:00097414 0000 nopCODE:00097416 0000 nopCODE:00097418 0000 nopCODE:0009741A 0000 nopCODE:0009741C 0000 nopCODE:0009741E 0000 nopCODE:00097420 0000 nopCODE:00097422 .line 24CODE:00097422 0000 nopCODE:00097422 Method EndCODE:00097422 # ---------------------------------------------------------------------------
public String seed = "m3ll0t_yetFLag"; /* access modifiers changed from: protected */public void onCreate(Bundle bundle) { super.onCreate(bundle); setContentView((int) R.layout.activity_main); StringBuilder sb = new StringBuilder(this.seed); sb.replace(0, 1, "h"); sb.replace(5, 6, "2"); sb.replace(10, 11, "f"); sb.replace(7, 8, "G"); Toast.makeText(this, "flag is " + sb.toString(), 0).show();}
0x03 总结1、简单修复dex header
2、简单修复onCreate
3、修复过程中的文件在附件中
4、了解一个Android漏洞- End -
看雪ID:neilwu
https://bbs.pediy.com/user-590753.htm
*本文由看雪论坛 neilwu 原创,转载请注明来自看雪社区。推荐文章++++
* 为了理解反汇编引擎而写的X86/X64反汇编引擎
* 捆绑包驱动锁首病毒分析
* **游戏逆向分析笔记
* 对宝马车载apps协议的逆向分析研究
* x86_64架构下的函数调用及栈帧原理
好书推荐
﹀﹀﹀公众号ID:ikanxue官方微博:看雪安全商务合作:wsc@kanxue.com戳