前言
- 第三届
realworld
,blockchains
的WP
- 总共有三题,队伍总共做出两道,后续会持续更新
- 随时欢迎大家交流,随便写写
- 点击这里 -> 题目附件
Montagy
- 题目目标清空余额
- 和队友一起做出来的题目,应该是非预期做出来的,这里会将我们的解法和预期解法都稍微写一下
非预期解法
- 我们做出来的题目地址 https://rinkeby.etherscan.io/address/0x8095e742cFeAFf77b92BdE56951388a6585E98d5
- 非预期思想就是碰撞,碰撞代码来自于
liangjs
师傅
1 | #include <cstdio> |
- 这是我们部署的
newPuzzle
,我们是直接改的题目中的newPuzzle
,把0x403
字节位置的0x14
(等于) 改为了0x10
(小于),这样随便找一个seed
满足条件即可,当然也可以直接写一个攻击合约调用题目的solve
也行(填充到指定字节,然后碰撞也可以)
1 | 0x608060405234801561001057600080fd5b50336000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff160217905550610542806100606000396000f3fe608060405234801561001057600080fd5b506004361061004c5760003560e01c806304f77cfa146100515780634059e88714610073578063fd922a42146101c5578063ffa644851461020f575b600080fd5b61005961028e565b604051808215151515815260200191505060405180910390f35b6101c36004803603604081101561008957600080fd5b81019080803590602001906401000000008111156100a657600080fd5b8201836020820111156100b857600080fd5b803590602001918460018302840111640100000000831117156100da57600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f8201169050808301925050505050505091929192908035906020019064010000000081111561013d57600080fd5b82018360208201111561014f57600080fd5b8035906020019184600183028401116401000000008311171561017157600080fd5b91908080601f016020809104026020016040519081016040528093929190818152602001838380828437600081840152601f19601f820116905080830192505050505050509192919290505050610362565b005b6101cd61049e565b604051808273ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16815260200191505060405180910390f35b61028c600480360361012081101561022657600080fd5b810190808035906020019092919080359060200190929190803590602001909291908035906020019092919080359060200190929190803590602001909291908035906020019092919080359060200190929190803590602001909291905050506104c3565b005b6000806009546008546007541818600654600554600454181860035460025460015418180101905060006009546006546003540101600854600554600254010160075460045460015401011818905063aabbccdd818301106102ef57600080fd5b708261e26b90505061031256e5afb60721cb821161030c57600080fd5b8082027ef35b6080614321368282376084810151606401816080016143855161051756101561033a57600080fd5b6f65e670d9bd540cea22fdab97e36840e2818303101561035957600080fd5b60019250505090565b61036a61028e565b61037357600080fd5b716111d850336107ef16565b908018915a905660701b6dffffffffffffffffffffffffffff19168280519060200120101561049a576000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166376fe1e92826040518263ffffffff1660e01b81526004018080602001828103825283818151815260200191508051906020019080838360005b8381101561043557808201518184015260208101905061041a565b50505050905090810190601f1680156104625780820380516001836020036101000a031916815260200191505b5092505050600060405180830381600087803b15801561048157600080fd5b505af1158015610495573d6000803e3d6000fd5b505050505b5050565b6000809054906101000a900473ffffffffffffffffffffffffffffffffffffffff1681565b88600181905550876002819055508660038190555085600481905550846005819055508360068190555082600781905550816008819055508060098190555050505050505050505056fea265627a7a723158205b60025b80600514615676d5110000000000000000000000001230212a0000000100000000000000000032 |
- 因为我们是直接改的题目中的
puzzle
,所以我们需要绕过loose
,这里是1ph0n
师傅提供的
1 | # loose() writeup |
- 然后就可以找一个
seed
符合我们改过之后的条件(条件改为了小于)就行啦 - 顺便这里插嘴一句,由于我拥有强大的暗黑之力,🤓我找到了所有队伍做这道题目的地址,吼吼哈嘿,快夸我🐶(只标注了一些队伍)
1 | 0x05751749a85D2149C76BC035af4826208Dd9118b AAA |
预期解法
- 预期解法应该是比特翻转(这是
tag
中变形tea
算法的特性),这个在比赛中也发现了,不过队友都碰撞出了,就没有继续向下看,全场队伍应该只有0ops
是预期解,它们的地址是 https://rinkeby.etherscan.io/address/0x60a05ada89061221e1602957097248fc8c373fe4 - 改动
6 bit
,具体自行分析,或者也可以等官方首席的WP
,不想分析了23333,懒癌患者,等官方WP
公布之后会搬运过来,我只是个搬运工5555 - 首席公开了源码 https://github.com/xhyumiracle/rwctf3rd-Re-Montagy,
WP
见 https://github.com/0ops/ctfs-2021/tree/main/RealWorldCTF/Re_Montagy