Add files via upload

p4-team · Nov 29, 2020 · 117e8da · 117e8da
1 parent a865164
commit 117e8da
Show file tree

Hide file tree

Showing 6 changed files with 287 additions and 0 deletions.
diff --git a/2020-11-28-hitcon/sop/crypt.py b/2020-11-28-hitcon/sop/crypt.py
@@ -0,0 +1,80 @@
+import struct
+
+# 05352: r6 = INPUT1
+# 05464: r7 = INPUT2
+# 05576: r8 = 0
+# 32 times do:
+# 	05624: r8 += C9
+# 	06136: r6 += (r7 + r8) ^ ((r7 >> 5) + C3) ^ ((r7 << 4) + C2)
+#	06648: r7 += (r6 + r8) ^ ((r6 >> 5) + C5) ^ ((r6 << 4) + C4)
+
+def encrypt(r6, r7, C2, C3, C4, C5, C9):
+    r8 = 0
+    for i in range(32):
+        r8 += C9
+        r6 += (r7 + r8) ^ ((r7 >> 5) + C3) ^ ((r7 << 4) + C2)
+        r6 &= 0xffffFFFF
+        r7 += (r6 + r8) ^ ((r6 >> 5) + C5) ^ ((r6 << 4) + C4)
+        r7 &= 0xffffFFFF
+    return r6, r7
+
+
+def decrypt(r6, r7, C2, C3, C4, C5, C9):
+    r8 = C9 * 32
+    for i in range(32):
+        r7 -= (r6 + r8) ^ ((r6 >> 5) + C5) ^ ((r6 << 4) + C4)
+        r7 += 2**32
+        r7 &= 0xffffFFFF
+        r6 -= (r7 + r8) ^ ((r7 >> 5) + C3) ^ ((r7 << 4) + C2)
+        r6 += 2**32
+        r6 &= 0xffffFFFF
+        r8 -= C9
+        r8 += 2**32
+        r8 &= 0xffffFFFF
+    return r6, r7
+
+
+C2, C3, C4, C5, C9 = 123,345,567,876,432
+r6,r7 = 4836596,373759
+
+x,y = encrypt(r6,r7,C2,C3,C4,C5,C9)
+a,b = decrypt(x, y, C2,C3,C4,C5,C9)
+print(r6,r7)
+print(a,b)
+
+expected = [0x152ceed2,0xd6046dc3,0x4a9d3ffd,0xbb541082,0x632a4f78,0xa9cb93d,0x58aae351,0x92012a14]
+
+keys = [
+0x69a33fff,
+0x468932dc,
+0x2b0b575b,
+0x1e8b51cc,
+0x51fdd41a,
+
+0x32e57ab6,
+0x7785df55,
+0x688620f9,
+0x8df954f3,
+0x5c37a6db,
+
+0xaca81571,
+0x2c19574f,
+0x1bd1fc38,
+0x14220605,
+0xb4f0b4fb,
+
+0x33f33fe0,
+0xf9de7e36,
+0xe9ab109d,
+0x8d4f04b2,
+0xd3c45f8c]
+
+b = b""
+for i in range(4):
+    r6,r7 = expected[i*2:i*2+2]
+    c2,c3,c4,c5,c9 = keys[i*5:i*5+5]
+    x,y = decrypt(r6,r7,c2,c3,c4,c5,c9)
+    b += struct.pack("<I", x)
+    b += struct.pack("<I", y)
+
+print(b)
diff --git a/2020-11-28-hitcon/sop/jit b/2020-11-28-hitcon/sop/jit
diff --git a/2020-11-28-hitcon/sop/notes b/2020-11-28-hitcon/sop/notes
@@ -0,0 +1,51 @@
+read 0x217000: our input (32B)
+set  0x217020..6c: some constants (shellcode!)
+rt_sigaction(0x217050)
+no new privs
+set  0x217050..294: some constants (seccomp shellcode)
+
+(5280)
+set seccomp (0x217050)
+
+r2:r5 = constants
+r6:.. = our input
+
+then: many "rounds" of getpid etc. with some constants, our input etc.
+encrypt each 8-byte block of input with XTEA (so 4 reps)
+(12360)
+compare each block with const.
+
+SIGSYS:
+00000020    mov rcx,0x3f8495f5793a342c
+0000002A    mov edx,[rsi+0x4]
+0000002D    mov [rcx],dx
+00000030    lea rcx,[rel 0x22]
+00000037    inc qword [rcx]
+0000003A    inc qword [rcx]
+0000003D    ret
+
+SECCOMP:
+sysnum == 1:    return r4 ? 0x7fff0000 : 0
+sysnum == 104:  return r4 & r6
+sysnum == 102:  return r4 >> r6
+sysnum == 186:  return r4 | r6
+sysnum == 39:   return r4 + r6
+sysnum == 108:  return r4 - r6
+sysnum == 111:  return r4 * r6
+sysnum == 110:  return r4 << r6
+sysnum == 107:  return r4 ^ r6
+sysnum == 57:   return r4 / r6
+actually return (X >> r8) & 0xffff | 0x30000
+
+
+05352: r6 = INPUT1
+05464: r7 = INPUT2
+05576: r8 = 0
+32 times do:
+	05624: r8 += C9
+	06136: r6 += (r7 + r8) ^ ((r7 >> 5) + C3) ^ ((r7 << 4) + C2)
+	06648: r7 += (r6 + r8) ^ ((r6 >> 5) + C5) ^ ((r6 << 4) + C4)
+
+result is r6:r7
+
+
diff --git a/2020-11-28-hitcon/sop/parse.py b/2020-11-28-hitcon/sop/parse.py
@@ -0,0 +1,156 @@
+import struct
+
+s = open("sop_bytecode", "rb").read()
+assert len(s) % 8 == 0
+pc = 0
+
+def getbits(x, n):
+    r = x & ((1<<n)-1)
+    x >>= n
+    return r, x
+
+def nice(sys):
+    if sys == 218:
+        return "set_tid_address"
+    if sys == 157:
+        return "          prctl"#
+    if sys == 9:
+        return "           mmap"
+    if sys == 0:
+        return "           read"
+    if sys == 1:
+        return "          write"
+    if sys == 13:
+        return "   rt_sigaction" # Do some shit on SIGSYS
+    if sys == 104:
+        return "         getgid" # Probably for SIGSYS?
+    if sys == 39:
+        return "         getpid" # Same.
+    if sys == 110:
+        return "        getppid" # Same.
+    if sys == 102:
+        return "         getuid" # Same.
+    if sys == 107:
+        return "        geteuid" # Same.
+    if sys == 108:
+        return "        getegid" # Same.
+    if sys == 111:
+        return "        getpgrp" # Same.
+    if sys == 186:
+        return "         gettid" # Same.
+    if sys == 57:
+        return "           fork" # Same.
+    assert False
+
+def nice(sys):
+    if sys == 218:
+        return "set_tid_address"
+    if sys == 157:
+        return "          prctl"#
+    if sys == 9:
+        return "           mmap"
+    if sys == 0:
+        return "           read"
+    if sys == 1:
+        return "          write"
+    if sys == 13:
+        return "   rt_sigaction" # Do some shit on SIGSYS
+    if sys == 104:
+        return "         AND" # Probably for SIGSYS?
+    if sys == 39:
+        return "         ADD" # Same.
+    if sys == 110:
+        return "         SHL" # Same.
+    if sys == 102:
+        return "         SHR" # Same.
+    if sys == 107:
+        return "         XOR" # Same.
+    if sys == 108:
+        return "         SUB" # Same.
+    if sys == 111:
+        return "         MUL" # Same.
+    if sys == 186:
+        return "         OR " # Same.
+    if sys == 57:
+        return "         DIV" # Same.
+    assert False
+
+dis = []
+while pc < len(s):
+    op = struct.unpack("<Q", s[pc:pc+8])[0]
+    sys, op = getbits(op, 8)
+    args = []
+    for i in range(6):
+        t, op = getbits(op, 2)
+        if t == 0:
+            r, op = getbits(op, 4)
+            args.append("r%d" % r)
+        elif t == 1:
+            r, op = getbits(op, 4)
+            args.append("&r%d" % r)
+        elif t == 2:
+            n, op = getbits(op, 5)
+            n, op = getbits(op, n+1)
+            if n < 100:
+                args.append("%d" % n)
+            else:
+                args.append("0x%x" % n)
+        elif t == 3:
+            break
+
+    dis.append((pc, nice(sys), args))
+    pc += 8
+
+dis2 = []
+i = 0
+while i < len(dis):
+    pc, sys, args = dis[i]
+    try:
+        pc1, sys1, args1 = dis[i+1]
+    except:
+        pass
+
+    if sys.strip() == "set_tid_address" and sys1.strip() == "prctl" and args1[0] == "40":
+        dis2.append((pc, "MOV", [("*"+args1[1]).replace("*&",""), args[0]]))
+        i += 2
+        continue
+    if sys.strip() == "prctl" and args[0] == "15" and sys1.strip() == "prctl" and args1[0] == "16":
+        dis2.append((pc, "STRCPY", [args1[1], args[1]]))
+        i += 2
+        continue
+
+    dis2.append((pc, sys, args))
+    i += 1
+
+i = 0
+while i < len(dis2):
+    pc, sys, args = dis2[i]
+    try:
+        pc1, sys1, args1 = dis2[i+1]
+        pc2, sys2, args2 = dis2[i+2]
+        pc3, sys3, args3 = dis2[i+3]
+        pc4, sys4, args4 = dis2[i+4]
+        pc5, sys5, args5 = dis2[i+5]
+    except:
+        pass
+
+# 06648: MOV *0x217022, &r7
+# 06664: MOV r0, r7
+# 06680: MOV r1, r11
+# 06696:          ADD r0, r1, 0
+# 06704:          ADD r0, r1, 16
+
+    if (
+            sys == "MOV" and args[0] == "*0x217022" and
+            sys1 == "MOV" and args1[0] == "r0" and
+            sys2 == "MOV" and args2[0] == "r1" and
+            args3[0] == "r0" and args3[1] == "r1" and args3[2] == "0" and sys3 == sys4 and
+            args4[0] == "r0" and args4[1] == "r1" and args4[2] == "16"):
+        dst = ("*"+args[1]).replace("*&","")
+        print("%05d: %s = %s %s %s" % (pc, dst, args1[1], sys3.strip(), args2[1]))
+        i += 5
+        continue
+
+
+    print("%05d: %s %s" % (pc, sys, ", ".join(args)))
+    i += 1
diff --git a/2020-11-28-hitcon/sop/sop b/2020-11-28-hitcon/sop/sop
diff --git a/2020-11-28-hitcon/sop/sop_bytecode b/2020-11-28-hitcon/sop/sop_bytecode