学逆向论坛

找回密码
立即注册

只需一步,快速开始

发新帖

2万

积分

41

好友

1157

主题
发表于 2020-5-3 00:20:46 | 查看: 2455| 回复: 2

相关题目:

♦ blockkaede

[md]# Danish Blockchain

At first, we can see that mining for coins will not give enough for a flag. The initial mining amount is
set such that the maximum amount of coins that can be mined is 20, while the amount needed for a flag is
32. (kæde.rs:5-9)

We continue by noting that the `hæsh` property of a Block is 64 bytes of hash and one verification byte,
as noted in kæde.rs:127-132. The "verification byte" is simply the index of the last number 6 in the hex
expansion of the hash. However, if there is no 6 in the hash, the verification byte will be set to 0. In
this case, the code considers that block invalid.

In the function `BløckKæde::get_account_money`, we can see that there is a difference between the
verification byte checking mechanism in a transaction *from* the user and *to* the user. The transaction
from the user works as expected, where an invalid verification makes the transaction fail. However, in
the transaction to the user, the verification always succeeds, as the varialbe `good` is reused from the
check for the user's existance.

This means that if we can force a transaction block to have an invalid verification byte, the
transaction will give the receiving account the specified amount of money, without drawing it from the
sender.

The solution is to first mine enough money for half the flag, then create another user, and doing a
transaction of all the money from the first account to this account. However, the user password for the second
account needs to be set in such a way that the hash of the transaction block has no 6's in it. This can
be brute forced locally, as there is a (1-1/16)^128 ≈ 1/4000 chance of it happening, which means that we will only have to
search around 4000 user passwords. When the transaction succeeds without drawing any money from the first
account, we can simply make a transaction, moving the money back to the first account, effectively
doubling it's money, which means we have enough money to buy the flag.

Practically, we start by creating a first user, 0x123, with a password of "xyz". We then log in to this
account, mine five times, giving us a balance of about 15.6 coins. If we now create a user with id 0,
password 'ED' and transfer 15 coins to that account, we will still have our ~15.5 coins left on our first
account. Transfer the 15 back, and we have 30.6 coins on our account, enough to buy us a flag![/md]


游客,如果您要查看本帖隐藏内容请回复
温馨提示:
1.如果您喜欢这篇帖子,请给作者点赞评分,点赞会增加帖子的热度,评分会给作者加学币。(评分不会扣掉您的积分,系统每天都会重置您的评分额度)。
2.回复帖子不仅是对作者的认可,还可以获得学币奖励,请尊重他人的劳动成果,拒绝做伸手党!
3.发广告、灌水回复等违规行为一经发现直接禁言,如果本帖内容涉嫌违规,请点击论坛底部的举报反馈按钮,也可以在【投诉建议】板块发帖举报。
论坛交流群:672619046
发表于 2022-7-14 15:03:52
非常不错啊,感谢楼主无私的共享精神!
发表于 2023-7-3 16:30:32
666

小黑屋|手机版|站务邮箱|学逆向论坛 ( 粤ICP备2021023307号 )|网站地图

GMT+8, 2024-3-29 21:33 , Processed in 0.101627 second(s), 47 queries .

Powered by Discuz! X3.4

Copyright © 2001-2021, Tencent Cloud.

快速回复 返回顶部 返回列表