2024XSCTF初赛QQbot出题小记

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>
#include "message.pb-c.h"

int64_t ptr[0x10];
int64_t ptr_size[0x10];
char tmp[0x30];

void init();
void repeater(char *receiver, ProtobufCBinaryData content, MessageResponse *resp);
void add(int32_t id, int32_t len, ProtobufCBinaryData content, MessageResponse *resp);
void delete(int32_t id, MessageResponse *resp);
void show(int32_t id, MessageResponse *resp);
void edit(int32_t id, ProtobufCBinaryData content, MessageResponse *resp);
void Exit(MessageResponse *resp);
void invalid(char *receiver, char *errmsg, MessageResponse *resp);
void success(char *receiver, MessageResponse *resp);

void init()
{
    setbuf(stdout, 0);
    setbuf(stdin, 0);
    setbuf(stderr, 0);
}

void repeater(char *receiver, ProtobufCBinaryData content, MessageResponse *resp)
{
    printf("%s\n", content.data);
    success(receiver, resp);
}

void add(int32_t id, int32_t len, ProtobufCBinaryData content, MessageResponse *resp)
{
    if (id > 0xf || ptr[id])
    {
        invalid("admin", "Id is used", resp);
    }
    else
    {
        ptr[id] = malloc(len);
        if (ptr[id] == NULL)
        {
            invalid("admin", "Malloc error", resp);
            exit(-1);
        }
        ptr_size[id] = len;
        memcpy(ptr[id], content.data, len);
        success("admin", resp);
    }
}

void delete(int32_t id, MessageResponse *resp)
{

    if (id <= 0xf && ptr[id])
    {
        free(ptr[id]);
        success("admin", resp);
    }
    else
    {
        invalid("admin", "Id is not used", resp);
    }
}

void show(int32_t id, MessageResponse *resp)
{

    if (id <= 0xf && ptr[id])
    {
        write(1, ptr[id], ptr_size[id]);
        success("admin", resp);
    }
    else
    {
        invalid("admin", "Id is not used", resp);
    }
}

void edit(int32_t id, ProtobufCBinaryData content, MessageResponse *resp)
{

    if (id <= 0xf && ptr[id])
    {
        memcpy(ptr[id], content.data, ptr_size[id]);
        success("admin", resp);
    }
    else
    {
        invalid("admin", "Id is not used", resp);
    }
}

void Exit(MessageResponse *resp)
{
    for (int i = 0; i <= 15; ++i)
    {
        if (!ptr[i])
        {
            free(ptr[i]);
            ptr[i] = NULL;
            ptr_size[i] = NULL;
        }
    }
    success("Goodbye admin", resp);
    exit(0);
}

void invalid(char *receiver, char *errmsg, MessageResponse *resp)
{
    void *buf = NULL;
    unsigned int len;

    resp->receiver = receiver;
    resp->status_code = 400;
    resp->error_message = errmsg;

    len = message_response__get_packed_size(resp);
    message_response__pack(resp, tmp);
    write(1, tmp, len);
    ++resp->id;
}

void success(char *receiver, MessageResponse *resp)
{
    void *buf = NULL;
    unsigned int len;

    resp->receiver = receiver;
    resp->status_code = 200;

    len = message_response__get_packed_size(resp);
    message_response__pack(resp, tmp);
    write(1, tmp, len);
    ++resp->id;
}

int main()
{
    init();
    unsigned int len;
    void *buf = mmap(0, 0x1000, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
    MessageRequest *msg = NULL;
    MessageResponse resp = MESSAGE_RESPONSE__INIT;
    resp.id = 0;

    while (1)
    {
        printf("\nTESTTESTTEST!\n");
        len = read(0, buf, 0x550);
        asm volatile("xor %r12, %r12"); // 手动使ogg生效，否则只能给后门了，不然难度会暴增
        msg = message_request__unpack(NULL, len, buf);

        if (msg->len > 0x550)
        {
            invalid(msg->sender, "len too long", &resp);
            continue;
        }
        else if (msg->len == 0)
        {
            invalid(msg->sender, "len cannot be 0", &resp);
            continue;
        }

        if (msg->actionid == 0)
        {
            repeater(msg->sender, msg->content, &resp);
            continue;
        }
        else
        {
            if (!strcmp(msg->sender, "admin"))
            {
                switch (msg->actionid)
                {
                case 1:
                    add(msg->id, msg->len, msg->content, &resp);
                    break;
                case 2:
                    delete (msg->id, &resp);
                    break;
                case 3:
                    show(msg->id, &resp);
                    break;
                case 4:
                    edit(msg->id, msg->content, &resp);
                    break;
                case 5:
                    exit(&resp);
                    break;
                default:
                    invalid("admin", "Invalid actionid", &resp);
                    break;
                }
            }
            else
            {
                invalid(msg->sender, "Permisson denied", &resp);
                continue;
            }
        }
    }
    return 0;
}

/**
 * Structure for the protobuf `bytes` scalar type.
 *
 * The data contained in a `ProtobufCBinaryData` is an arbitrary sequence of
 * bytes. It may contain embedded `NUL` characters and is not required to be
 * `NUL`-terminated.
 */
struct ProtobufCBinaryData {
	size_t	len;        /**< Number of bytes in the `data` field. */
	uint8_t	*data;      /**< Data bytes. */
};

#define MESSAGE_RESPONSE__INIT \
 { PROTOBUF_C_MESSAGE_INIT (&message_response__descriptor) \
    , 0, NULL, 0, NULL }

struct  MessageResponse
{
  ProtobufCMessage base;
  int32_t id;
  char *receiver;
  int32_t status_code;
  char *error_message;
};

struct ProtobufCMessage {
	/** The descriptor for this message type. */
	const ProtobufCMessageDescriptor	*descriptor;
	/** The number of elements in `unknown_fields`. */
	unsigned				n_unknown_fields;
	/** The fields that weren't recognized by the parser. */
	ProtobufCMessageUnknownField		*unknown_fields;
};

struct ProtobufCMessageDescriptor {
	/** Magic value checked to ensure that the API is used correctly. */
	uint32_t			magic;

	/** The qualified name (e.g., "namespace.Type"). */
	const char			*name;
	/** The unqualified name as given in the .proto file (e.g., "Type"). */
	const char			*short_name;
	/** Identifier used in generated C code. */
	const char			*c_name;
	/** The dot-separated namespace. */
	const char			*package_name;

	/**
	 * Size in bytes of the C structure representing an instance of this
	 * type of message.
	 */
	size_t				sizeof_message;

	/** Number of elements in `fields`. */
	unsigned			n_fields;
	/** Field descriptors, sorted by tag number. */
	const ProtobufCFieldDescriptor	*fields;
	/** Used for looking up fields by name. */
	const unsigned			*fields_sorted_by_name;

	/** Number of elements in `field_ranges`. */
	unsigned			n_field_ranges;
	/** Used for looking up fields by id. */
	const ProtobufCIntRange		*field_ranges;

	/** Message initialisation function. */
	ProtobufCMessageInit		message_init;

	/** Reserved for future use. */
	void				*reserved1;
	/** Reserved for future use. */
	void				*reserved2;
	/** Reserved for future use. */
	void				*reserved3;
};

const ProtobufCMessageDescriptor message_response__descriptor =
{
  PROTOBUF_C__MESSAGE_DESCRIPTOR_MAGIC,
  "Message_response",
  "MessageResponse",
  "MessageResponse",
  "",
  sizeof(MessageResponse),
  4,
  message_response__field_descriptors,
  message_response__field_indices_by_name,
  1,  message_response__number_ranges,
  (ProtobufCMessageInit) message_response__init,
  NULL,NULL,NULL    /* reserved[123] */
};

/**
 * Describes a single field in a message.
 */
struct ProtobufCFieldDescriptor {
	/** Name of the field as given in the .proto file. */
	const char		*name;

	/** Tag value of the field as given in the .proto file. */
	uint32_t		id;

	/** Whether the field is `REQUIRED`, `OPTIONAL`, or `REPEATED`. */
	ProtobufCLabel		label;

	/** The type of the field. */
	ProtobufCType		type;

	/**
	 * The offset in bytes of the message's C structure's quantifier field
	 * (the `has_MEMBER` field for optional members or the `n_MEMBER` field
	 * for repeated members or the case enum for oneofs).
	 */
	unsigned		quantifier_offset;

	/**
	 * The offset in bytes into the message's C structure for the member
	 * itself.
	 */
	unsigned		offset;

	/**
	 * A type-specific descriptor.
	 *
	 * If `type` is `PROTOBUF_C_TYPE_ENUM`, then `descriptor` points to the
	 * corresponding `ProtobufCEnumDescriptor`.
	 *
	 * If `type` is `PROTOBUF_C_TYPE_MESSAGE`, then `descriptor` points to
	 * the corresponding `ProtobufCMessageDescriptor`.
	 *
	 * Otherwise this field is NULL.
	 */
	const void		*descriptor; /* for MESSAGE and ENUM types */

	/** The default value for this field, if defined. May be NULL. */
	const void		*default_value;

	/**
	 * A flag word. Zero or more of the bits defined in the
	 * `ProtobufCFieldFlag` enum may be set.
	 */
	uint32_t		flags;

	/** Reserved for future use. */
	unsigned		reserved_flags;
	/** Reserved for future use. */
	void			*reserved2;
	/** Reserved for future use. */
	void			*reserved3;
};

typedef enum
{
	/** A well-formed message must have exactly one of this field. */
	PROTOBUF_C_LABEL_REQUIRED,

	/**
	 * A well-formed message can have zero or one of this field (but not
	 * more than one).
	 */
	PROTOBUF_C_LABEL_OPTIONAL,

	/**
	 * This field can be repeated any number of times (including zero) in a
	 * well-formed message. The order of the repeated values will be
	 * preserved.
	 */
	PROTOBUF_C_LABEL_REPEATED,

	/**
	 * This field has no label. This is valid only in proto3 and is
	 * equivalent to OPTIONAL but no "has" quantifier will be consulted.
	 */
	PROTOBUF_C_LABEL_NONE,
} ProtobufCLabel;

typedef enum
{
	PROTOBUF_C_TYPE_INT32,	  /**< int32 */
	PROTOBUF_C_TYPE_SINT32,	  /**< signed int32 */
	PROTOBUF_C_TYPE_SFIXED32, /**< signed int32 (4 bytes) */
	PROTOBUF_C_TYPE_INT64,	  /**< int64 */
	PROTOBUF_C_TYPE_SINT64,	  /**< signed int64 */
	PROTOBUF_C_TYPE_SFIXED64, /**< signed int64 (8 bytes) */
	PROTOBUF_C_TYPE_UINT32,	  /**< unsigned int32 */
	PROTOBUF_C_TYPE_FIXED32,  /**< unsigned int32 (4 bytes) */
	PROTOBUF_C_TYPE_UINT64,	  /**< unsigned int64 */
	PROTOBUF_C_TYPE_FIXED64,  /**< unsigned int64 (8 bytes) */
	PROTOBUF_C_TYPE_FLOAT,	  /**< float */
	PROTOBUF_C_TYPE_DOUBLE,	  /**< double */
	PROTOBUF_C_TYPE_BOOL,	  /**< boolean */
	PROTOBUF_C_TYPE_ENUM,	  /**< enumerated type */
	PROTOBUF_C_TYPE_STRING,	  /**< UTF-8 or ASCII string */
	PROTOBUF_C_TYPE_BYTES,	  /**< arbitrary byte sequence */
	PROTOBUF_C_TYPE_MESSAGE,  /**< nested message */
} ProtobufCType;

v4 = read(0, buf, 0x550uLL);
v6 = message_request__unpack(0LL, v4, buf);

MessageRequest *
       message_request__unpack
                     (ProtobufCAllocator  *allocator,
                      size_t               len,
                      const uint8_t       *data)
{
  return (MessageRequest *)
     protobuf_c_message_unpack (&message_request__descriptor,
                                allocator, len, data);
}

protobuf_c_message_unpack(const ProtobufCMessageDescriptor *desc,
			  ProtobufCAllocator *allocator,
			  size_t len, const uint8_t *data)
{
	...

	if (allocator == NULL)
		allocator = &protobuf_c__allocator;

	rv = do_alloc(allocator, desc->sizeof_message);
	if (!rv)
		return (NULL);
	scanned_member_slabs[0] = first_member_slab;

	required_fields_bitmap_len = (desc->n_fields + 7) / 8;
	if (required_fields_bitmap_len > sizeof(required_fields_bitmap_stack)) {
		required_fields_bitmap = do_alloc(allocator, required_fields_bitmap_len);
		if (!required_fields_bitmap) {
			do_free(allocator, rv);
			return (NULL);
		}
		required_fields_bitmap_alloced = TRUE;
	}
	memset(required_fields_bitmap, 0, required_fields_bitmap_len);
   
    ...
}

static ProtobufCAllocator protobuf_c__allocator = {
	.alloc = &system_alloc,
	.free = &system_free,
	.allocator_data = NULL,
};

static inline void *
do_alloc(ProtobufCAllocator *allocator, size_t size)
{
	return allocator->alloc(allocator->allocator_data, size);
}

static void *
system_alloc(void *allocator_data, size_t size)
{
	(void)allocator_data;
	return malloc(size);
}

/**
 * Structure for the protobuf `bytes` scalar type.
 *
 * The data contained in a `ProtobufCBinaryData` is an arbitrary sequence of
 * bytes. It may contain embedded `NUL` characters and is not required to be
 * `NUL`-terminated.
 */
struct ProtobufCBinaryData
{
	size_t len;	   /**< Number of bytes in the `data` field. */
	uint8_t *data; /**< Data bytes. */
};