2019-4-17-近期比赛总结

std::vector<T> values;//创建存放T类型元素的vertor容器。
vector<T>(向量容器)是一个长度可变的序列，用来存放 T 类型的对象。必要时，可以自动增加容量，但只能在序列的末尾高效地增加或删除元素。
values.push_back();//在序列的末尾添加一个元素
back_inserter();//创建一个使用push_back的迭代器，把一个vector容器的元素按顺序传递给另一个vector
value.end();//指向value最后一个元素的下一个元素
value.begin();//指向value的第一个元素
value.back();//指向value的最后一个元素
transform();//可以将函数应用到序列的元素上，并将这个函数返回的值保存到另一个序列中，它返回的迭代器指向输出序列所保存的最后一个元素的下一个位置。 
OutputIterator transform (InputIterator first1,InputIterator last1,OutputIterator result, UnaryOperation op);
对于一元操作，将op应用于[first1, last1]范围内的每个元素，并将每个操作返回的值存储在以result开头的范围内。给定的op将被连续调用last1-first1+1次。op可以是函数指针或函数对象或lambda表达式。

v10 = argv;
v21 = __readfsqword(0x28u);
std::vector<int,std::allocator<int>>::vector((__int64)&v13);
std::vector<int,std::allocator<int>>::vector((__int64)&v14);
std::vector<int,std::allocator<int>>::vector((__int64)&v15);
std::vector<int,std::allocator<int>>::vector((__int64)&v16);
std::vector<int,std::allocator<int>>::vector((__int64)&v17);
for ( i = 0; i <= 15; ++i )
{
  scanf("%d", &v20[4 * i], v10);
  std::vector<int,std::allocator<int>>::push_back((__int64)&v14, (__int64)&v20[4 * i]);
}
for ( j = 0; j <= 15; ++j )
{
  LODWORD(v19) = fib(j);
  std::vector<int,std::allocator<int>>::push_back(&v13, &v19);
}
std::vector<int,std::allocator<int>>::push_back((__int64)&v15, (__int64)v20);
v3 = std::back_inserter<std::vector<int,std::allocator<int>>>((__int64)&v15);
v4 = std::vector<int,std::allocator<int>>::end((__int64)&v14);
v19 = std::vector<int,std::allocator<int>>::begin(&v14);
v5 = __gnu_cxx::__normal_iterator<int *,std::vector<int,std::allocator<int>>>::operator+(&v19, 1LL);
std::transform<__gnu_cxx::__normal_iterator<int *,std::vector<int,std::allocator<int>>>,std::back_insert_iterator<std::vector<int,std::allocator<int>>>,main::{lambda(int)#1}>(
  v5,
  v4,
  v3,
  (__int64)v20);
std::vector<int,std::allocator<int>>::vector((__int64)&v18);
std::vector<int,std::allocator<int>>::end((__int64)&v15);
std::vector<int,std::allocator<int>>::begin(&v15);
std::accumulate<__gnu_cxx::__normal_iterator<int *,std::vector<int,std::allocator<int>>>,std::vector<int,std::allocator<int>>,main::{lambda(std::vector<int,std::allocator<int>>,int)#2}>((unsigned __int64)&v19);
std::vector<int,std::allocator<int>>::operator=(&v16, &v19);
std::vector<int,std::allocator<int>>::~vector(&v19);
std::vector<int,std::allocator<int>>::~vector(&v18);
if ( (unsigned __int8)std::operator!=<int,std::allocator<int>>((__int64)&v16, (__int64)&v13) )
{
  puts("You failed!");
  exit(0);
}
std::back_inserter<std::vector<int,std::allocator<int>>>((__int64)&v17);
v6 = std::vector<int,std::allocator<int>>::end((__int64)&v14);
v7 = std::vector<int,std::allocator<int>>::begin(&v14);
std::copy_if<__gnu_cxx::__normal_iterator<int *,std::vector<int,std::allocator<int>>>,std::back_insert_iterator<std::vector<int,std::allocator<int>>>,main::{lambda(int)#3}>(v7);
puts("You win!");
printf("Your flag is:flag{", v6, v10);

__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  char *ptr; // ST18_8
  char *v4; // ST20_8

  setbuf(stdin, 0LL);
  setbuf(stdout, 0LL);
  ptr = sub_400915();
  v4 = sub_4009A0();
  puts("Thank you for you share!!");
  free(ptr);
  free(v4);
  return 0LL;
}

char *sub_400915()
{
  char *v0; // ST08_8
  char s; // [rsp+10h] [rbp-40h]
  unsigned __int64 v3; // [rsp+48h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  printf("Please Tell Your ID:");
  sub_400ABE((__int64)&s, 0x32uLL);
  v0 = strdup(&s);
  printf("Hello ", 50LL);
  printf(&s);//格式化漏洞
  putchar(10);
  return v0;
}

char *sub_4009A0()
{
  __int64 v1; // [rsp+0h] [rbp-A0h]
  char s; // [rsp+10h] [rbp-90h]
  unsigned __int64 v3; // [rsp+98h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  puts("Tell me the size of your story:");
  v1 = sub_400A54();
  if ( v1 < 0 )
    v1 = -v1;
  if ( v1 > 128 )
    v1 = 1024LL;
  puts("You can speak your story:");
  sub_400ABE((__int64)&s, v1);
  return strdup(&s);
}

mov     edi, offset aYouCanSpeakYou ; "You can speak your story:"
call    puts
mov     rdx, [rbp+var_A0]
lea     rax, [rbp+s]
mov     rsi, rdx
mov     rdi, rax
call    sub_400ABE
lea     rax, [rbp+s]
mov     rdi, rax        ; s
call    strdup
mov     [rbp+var_98], rax
mov     rax, [rbp+var_98]
mov     rcx, [rbp+var_8]
xor     rcx, fs:28h
jz      short locret_400A52
call    __stack_chk_fail

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char buf; // [esp+1Ch] [ebp-64h]

  init();
  puts("**************************************");
  puts("welcome to exploit train");
  puts("**************************************");
  read(0, &buf, 0x200u);
  return puts("see you~~");
}

int __cdecl main(int a1)
{
  int v1; // eax
  char buf; // [esp+0h] [ebp-4Ch]
  size_t nbytes; // [esp+40h] [ebp-Ch]
  int *v5; // [esp+44h] [ebp-8h]

  v5 = &a1;
  setbuf(stdout, 0);
  sub_80485DB(stdin, stdout);//存在read栈泄露
  sleep(1u);
  printf("Please set the length of password: ");
  nbytes = sub_804862D();
  if ( (signed int)nbytes > 63 )//因为这里进行判断时nbyte是int型，而read读取时却是把它当作无符号的size_t，所以可以取负值造成栈溢出
  {
    puts("Too long!");
    exit(1);
  }
  printf("Enter password(lenth %u): ", nbytes);
  v1 = fileno(stdin);
  read(v1, &buf, nbytes);//存在栈溢出
  puts("All done, bye!");
  return 0;
}

int __cdecl sub_80485DB(FILE *stream, FILE *a2)
{
  int v2; // eax
  char buf; // [esp+0h] [ebp-48h]

  printf("Enter username: ");
  v2 = fileno(stream);
  read(v2, &buf, 0x40u);
  return fprintf(a2, "Hello %s", &buf);
}