-
Notifications
You must be signed in to change notification settings - Fork 5
/
eko2019.exe.c
459 lines (421 loc) · 13.3 KB
/
eko2019.exe.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
/* This file was generated by the Hex-Rays decompiler.
Copyright (c) 2007-2018 Hex-Rays <info@hex-rays.com>
Detected compiler: Visual C++
*/
#include <windows.h>
#include <defs.h>
//-------------------------------------------------------------------------
// Function declarations
__int64 __stdcall exec_gadget(void *);
__int64 init_wsocx();
__int64 __fastcall create_listening_socket(__int64 a1, u_short a2, SOCKET *a3);
__int64 __fastcall copy_gadget(__int64 gadget); // idb
__int64 __fastcall handle_client(SOCKET a1);
int __cdecl main(int argc, const char **argv, const char **envp);
// int printf(const char *const Format, ...);
// void *__cdecl memset(void *, int Val, size_t Size);
void **sub_140001CF4();
void __fastcall sub_140002C60(void *a1);
void sub_140003FC4();
void __fastcall sub_140003FFC();
PVOID sub_140004034();
void sub_14000448C();
PVOID sub_140005E0C();
void __fastcall sub_140006050(__int64 a1);
void __fastcall sub_140006058(__int64 a1);
void __fastcall sub_140006060(void *a1);
__int64 __fastcall sub_140006204(__int64 a1, __int64 a2, unsigned int a3);
BOOL sub_1400089BC();
// int __stdcall WSAStartup(WORD wVersionRequested, LPWSADATA lpWSAData);
// int __stdcall listen(SOCKET s, int backlog);
// int __stdcall bind(SOCKET s, const struct sockaddr *name, int namelen);
// SOCKET __stdcall socket(int af, int type, int protocol);
// u_short __stdcall htons(u_short hostshort);
// int __stdcall send(SOCKET s, const char *buf, int len, int flags);
// int __stdcall recv(SOCKET s, char *buf, int len, int flags);
// int __stdcall closesocket(SOCKET s);
// SOCKET __stdcall accept(SOCKET s, struct sockaddr *addr, int *addrlen);
// BOOL __stdcall WriteProcessMemory(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten);
// HANDLE __stdcall GetCurrentProcess();
// UINT __stdcall WinExec(LPCSTR lpCmdLine, UINT uCmdShow);
// PVOID __stdcall DecodePointer(PVOID Ptr);
// PVOID __stdcall EncodePointer(PVOID Ptr);
// FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName);
// HMODULE __stdcall LoadLibraryW(LPCWSTR lpLibFileName);
// BOOL __stdcall CloseHandle(HANDLE hObject);
//-------------------------------------------------------------------------
// Data declarations
_UNKNOWN unk_14000ACA8; // weak
_UNKNOWN unk_14000ACB8; // weak
int g_msg_num = 1; // weak
char Format[] = " [+] Header received: %i bytes\n"; // idb
char aErrorInvalidHe[] = " [-] Error: Invalid header\n"; // idb
char aErrorInvalidCo[] = " [-] Error: Invalid cookie\n"; // idb
char aErrorSizeTooBi[] = " [-] Error: Size too big\n"; // idb
char aWaitingUserMes[] = " [+] Waiting user message\n"; // idb
char aMessageReceive[] = " [+] Message received: %i bytes\n"; // idb
char aErrorInvalidSi[] = " [-] Error: Invalid size alignment\n"; // idb
char aRemoteMessageI[] = " [+] Remote message (%i): '%s'\n"; // idb
char aEkoparty2019Bf[] = "[+] Ekoparty 2019 - BFS challenge\n"; // idb
char aSocketSupportV[] = "[-] Socket support version error\n"; // idb
char a0000[8] = "0.0.0.0"; // weak
char a0000_0[8] = "0.0.0.0"; // weak
char aItWasNotPossib[] = "[-] It was not possible to bind: %s:%i\n"; // idb
char aServerListenin[] = "[+] Server listening\n"; // idb
char aWaitingForClie[] = "[+] Waiting for client connections\n"; // idb
char aClientSocketEr[] = " [-] Client socket error\n"; // idb
char aNewConnectionA[] = " [+] New connection accepted\n"; // idb
char aClosingConnect[] = " [+] Closing connection\n"; // idb
void *off_14000C260 = &unk_14000EF80; // weak
HANDLE hObject = (HANDLE)0xFFFFFFFFFFFFFFFEi64; // idb
__int64 g_size_msg = 0i64; // weak
PVOID qword_14000DA98; // idb
__int64 qword_14000E4B8; // weak
__int64 qword_14000E4D0; // weak
__int64 qword_14000E4D8; // weak
PVOID qword_14000E4E0; // idb
PVOID qword_14000E4E8; // idb
PVOID qword_14000E4F0; // idb
PVOID qword_14000E4F8; // idb
PVOID qword_14000E500; // idb
PVOID qword_14000E508; // idb
_QWORD g_gadget_array[256]; // idb
int dword_14000ED20; // weak
//----- (0000000140001000) ----------------------------------------------------
__int64 __stdcall exec_gadget(void *a1)
{
;
}
//----- (0000000140001020) ----------------------------------------------------
__int64 init_wsocx()
{
struct WSAData WSAData; // [rsp+30h] [rbp-1B8h]
unsigned int v2; // [rsp+1D0h] [rbp-18h]
unsigned __int16 v3; // [rsp+1D4h] [rbp-14h]
v2 = 0;
v3 = 514;
if ( !WSAStartup(0x202u, &WSAData) && WSAData.wVersion == v3 )
v2 = 1;
return v2;
}
//----- (00000001400010B0) ----------------------------------------------------
__int64 __fastcall create_listening_socket(__int64 a1, u_short a2, SOCKET *a3)
{
SOCKET s; // [rsp+20h] [rbp-38h]
unsigned int v5; // [rsp+28h] [rbp-30h]
struct sockaddr name; // [rsp+38h] [rbp-20h]
SOCKET *v7; // [rsp+70h] [rbp+18h]
v7 = a3;
v5 = 0;
name.sa_family = 2;
*(_DWORD *)&name.sa_data[2] = 0;
*(_WORD *)name.sa_data = htons(a2);
s = socket(2, 1, 0);
if ( s != -1i64 && !bind(s, &name, 16) )
{
listen(s, 0);
*v7 = s;
v5 = 1;
}
return v5;
}
//----- (0000000140001170) ----------------------------------------------------
__int64 __fastcall copy_gadget(__int64 gadget)
{
unsigned int i; // [rsp+8h] [rbp-20h]
char dst[8]; // [rsp+10h] [rbp-18h]
__int64 *p_gadget; // [rsp+18h] [rbp-10h]
p_gadget = &gadget;
for ( i = 0; i < 8ui64; ++i )
dst[i] = *((_BYTE *)p_gadget + 7i64 - i);
return *(_QWORD *)dst;
}
//----- (00000001400011E0) ----------------------------------------------------
__int64 __fastcall handle_client(SOCKET a1)
{
__int64 result; // rax
HANDLE v2; // rax
__int64 response; // [rsp+30h] [rbp-268h]
SIZE_T NumberOfBytesWritten; // [rsp+38h] [rbp-260h]
unsigned int num_rcvd; // [rsp+40h] [rbp-258h]
char gadget_buf[8]; // [rsp+48h] [rbp-250h]
char buf[512]; // [rsp+60h] [rbp-238h]
int gadget_idx; // [rsp+260h] [rbp-38h]
__int64 *p; // [rsp+268h] [rbp-30h]
struct pkthdr header; // [rsp+270h] [rbp-28h]
SOCKET s; // [rsp+2A0h] [rbp+8h]
s = a1;
response = -1i64;
p = &g_size_msg;
gadget_idx = 62;
// size of buf is 512 (0x200) bytes
memset(buf, 0, 0x200ui64);
num_rcvd = recv(s, (char *)&header, 16, 0);
printf(Format, num_rcvd);
if ( num_rcvd == 16i64 )
{
if ( header.magic == '9102okE' )
{
if ( header.size_payload <= 512 )
{
printf(aWaitingUserMes);
num_rcvd = recv(s, buf, LOWORD(header.size_payload), 0);
printf(aMessageReceive, num_rcvd);
if ( (int)num_rcvd % 8 )
{
printf(aErrorInvalidSi);
result = 0i64;
}
else
{
g_size_msg = printf(aRemoteMessageI, (unsigned int)g_msg_num, buf);
++g_msg_num;
*(_QWORD *)gadget_buf = copy_gadget(g_gadget_array[gadget_idx % 256]);
v2 = GetCurrentProcess();
WriteProcessMemory(v2, exec_gadget, gadget_buf, 8ui64, &NumberOfBytesWritten);
response = exec_gadget(p);
send(s, (const char *)&response, 8, 0);
result = 1i64;
}
}
else
{
printf(aErrorSizeTooBi);
result = 0i64;
}
}
else
{
printf(aErrorInvalidCo);
result = 0i64;
}
}
else
{
printf(aErrorInvalidHe);
result = 0i64;
}
return result;
}
// 14000C000: using guessed type int g_msg_num;
// 14000D4E0: using guessed type __int64 g_size_msg;
//----- (0000000140001410) ----------------------------------------------------
int __cdecl main(int argc, const char **argv, const char **envp)
{
SOCKET s; // [rsp+20h] [rbp-58h]
unsigned int i; // [rsp+28h] [rbp-50h]
int addrlen; // [rsp+2Ch] [rbp-4Ch]
struct sockaddr addr; // [rsp+38h] [rbp-40h]
SOCKET v8; // [rsp+58h] [rbp-20h]
if ( !argc )
WinExec(*argv, 1u);
for ( i = 0; i < 0x100; ++i )
g_gadget_array[i] = ((unsigned __int64)i << 56) + 0x488B01C3C3C3C3i64;
printf(aEkoparty2019Bf);
if ( (unsigned int)init_wsocx() )
{
// bind listening socket on TCP port 54321 on all interfaces
if ( (unsigned int)create_listening_socket((__int64)a0000, 54321u, &s) )
{
printf(aServerListenin);
while ( 1 )
{
printf(aWaitingForClie);
addrlen = 16;
// accept incoming client connection
v8 = accept(s, &addr, &addrlen);
if ( v8 == -1i64 )
{
printf(aClientSocketEr);
}
else
{
printf(aNewConnectionA);
// handle client
handle_client(v8);
printf(aClosingConnect);
closesocket(v8);
}
}
}
printf(aItWasNotPossib, a0000_0, 54321i64);
}
else
{
printf(aSocketSupportV);
}
return 0;
}
//----- (0000000140001CF4) ----------------------------------------------------
void **sub_140001CF4()
{
return &off_14000C260;
}
// 14000C260: using guessed type void *off_14000C260;
//----- (0000000140002C60) ----------------------------------------------------
void __fastcall sub_140002C60(void *a1)
{
qword_14000DA98 = a1;
}
//----- (0000000140003FC4) ----------------------------------------------------
void sub_140003FC4()
{
void (**i)(void); // rbx
for ( i = (void (**)(void))&unk_14000ACA8; i < (void (**)(void))&unk_14000ACA8; ++i )
{
if ( *i )
(*i)();
}
}
//----- (0000000140003FFC) ----------------------------------------------------
void __fastcall sub_140003FFC()
{
void (**i)(void); // rbx
for ( i = (void (**)(void))&unk_14000ACB8; i < (void (**)(void))&unk_14000ACB8; ++i )
{
if ( *i )
(*i)();
}
}
//----- (0000000140004034) ----------------------------------------------------
PVOID sub_140004034()
{
return EncodePointer(0i64);
}
//----- (000000014000448C) ----------------------------------------------------
void sub_14000448C()
{
dword_14000ED20 = 0;
}
// 14000ED20: using guessed type int dword_14000ED20;
//----- (0000000140005E0C) ----------------------------------------------------
PVOID sub_140005E0C()
{
return DecodePointer((PVOID)qword_14000E4B8);
}
// 14000E4B8: using guessed type __int64 qword_14000E4B8;
//----- (0000000140006050) ----------------------------------------------------
void __fastcall sub_140006050(__int64 a1)
{
qword_14000E4D0 = a1;
}
// 14000E4D0: using guessed type __int64 qword_14000E4D0;
//----- (0000000140006058) ----------------------------------------------------
void __fastcall sub_140006058(__int64 a1)
{
qword_14000E4D8 = a1;
}
// 14000E4D8: using guessed type __int64 qword_14000E4D8;
//----- (0000000140006060) ----------------------------------------------------
void __fastcall sub_140006060(void *a1)
{
qword_14000E4E0 = a1;
}
//----- (0000000140006204) ----------------------------------------------------
__int64 __fastcall sub_140006204(__int64 a1, __int64 a2, unsigned int a3)
{
unsigned int v3; // ebp
__int64 v4; // r14
__int64 v5; // r13
__int64 v6; // rbx
PVOID v7; // rdi
HMODULE v8; // rax
HMODULE v9; // rsi
FARPROC v10; // rax
FARPROC v11; // rax
FARPROC v12; // rax
FARPROC v13; // rax
PVOID v14; // r11
FARPROC v15; // rax
PVOID v16; // rax
__int64 (*v17)(void); // rsi
unsigned int (__fastcall *v18)(__int64, __int64, char *); // rax
unsigned int (__fastcall *v19)(__int64, __int64, char *); // r12
__int64 v20; // rax
__int64 (*v21)(void); // rax
__int64 (__fastcall *v22)(__int64); // rax
__int64 (__fastcall *v23)(__int64, __int64, __int64, _QWORD); // rax
char v25; // [rsp+38h] [rbp-50h]
char v26; // [rsp+40h] [rbp-48h]
v3 = a3;
v4 = a2;
v5 = a1;
v6 = 0i64;
v7 = sub_140004034();
if ( qword_14000E4E8 )
{
v16 = qword_14000E500;
goto LABEL_8;
}
v8 = LoadLibraryW(L"USER32.DLL");
v9 = v8;
if ( !v8 )
return 0i64;
v10 = GetProcAddress(v8, "MessageBoxW");
if ( !v10 )
return 0i64;
qword_14000E4E8 = EncodePointer(v10);
v11 = GetProcAddress(v9, "GetActiveWindow");
qword_14000E4F0 = EncodePointer(v11);
v12 = GetProcAddress(v9, "GetLastActivePopup");
qword_14000E4F8 = EncodePointer(v12);
v13 = GetProcAddress(v9, "GetUserObjectInformationW");
v14 = EncodePointer(v13);
qword_14000E508 = v14;
if ( v14 )
{
v15 = GetProcAddress(v9, "GetProcessWindowStation");
v16 = EncodePointer(v15);
qword_14000E500 = v16;
LABEL_8:
v14 = qword_14000E508;
goto LABEL_9;
}
v16 = qword_14000E500;
LABEL_9:
if ( v16 == v7
|| v14 == v7
|| (v17 = (__int64 (*)(void))DecodePointer(v16),
v18 = (unsigned int (__fastcall *)(__int64, __int64, char *))DecodePointer(qword_14000E508),
v19 = v18,
!v17)
|| !v18
|| (v20 = v17()) != 0 && v19(v20, 1i64, &v25) && v26 & 1 )
{
if ( qword_14000E4F0 != v7 )
{
v21 = (__int64 (*)(void))DecodePointer(qword_14000E4F0);
if ( v21 )
{
v6 = v21();
if ( v6 )
{
if ( qword_14000E4F8 != v7 )
{
v22 = (__int64 (__fastcall *)(__int64))DecodePointer(qword_14000E4F8);
if ( v22 )
v6 = v22(v6);
}
}
}
}
}
else
{
v3 |= 0x200000u;
}
v23 = (__int64 (__fastcall *)(__int64, __int64, __int64, _QWORD))DecodePointer(qword_14000E4E8);
if ( v23 )
return v23(v6, v5, v4, v3);
return 0i64;
}
//----- (00000001400089BC) ----------------------------------------------------
BOOL sub_1400089BC()
{
BOOL result; // eax
if ( hObject != (HANDLE)-1i64 && hObject != (HANDLE)-2i64 )
result = CloseHandle(hObject);
return result;
}
// nfuncs=188 queued=18 decompiled=18 lumina nreq=0 worse=0 better=0
// ALL OK, 18 function(s) have been successfully decompiled