ESP32 IoT CTF 题解

https://github.com/xuanxuanblingbling/esp32ctf_thu/tree/main/attachment

#define GPIO_INPUT_IO_0     18
....
void hardware_task1(){
    int hit = 0;
    while(1) {
        printf("[+] hardware task I : hit %d\n",hit);
        if(gpio_get_level(GPIO_INPUT_IO_0)){   //gpio_get_level是获取GPIO电平值，低电平是0，高电平是1
            hit ++ ;
        }else{
            hit = 0;
        }
        if(hit>3){
            printf("[+] hardware task I : %s\n",hardware_flag_1);
            break;
        }
        vTaskDelay(1000 / portTICK_RATE_MS);
    }
}

#define GPIO_INPUT_IO_0     18
#define GPIO_INPUT_PIN_SEL  ((1ULL<<GPIO_INPUT_IO_0) )
#define ESP_INTR_FLAG_DEFAULT 0
static void IRAM_ATTR gpio_isr_handler(void* arg){  //GPIO中断处理程序，中断了就执行这个

trigger++;

}
void hardware_gpio_setup(){

gpio_config_t io_conf;  //GPIO的配置参数

io_conf.pin_bit_mask = GPIO_INPUT_PIN_SEL; //要配置的GPIO引脚

io_conf.mode = GPIO_MODE_INPUT;   //仅输入

io_conf.intr_type = GPIO_INTR_POSEDGE;  //GPIO中断类型，上升沿

io_conf.pull_up_en = 0;  //禁止上拉使能

gpio_config(&io_conf);

gpio_install_isr_service(ESP_INTR_FLAG_DEFAULT);

gpio_isr_handler_add(GPIO_INPUT_IO_0, gpio_isr_handler, (void*) GPIO_INPUT_IO_0);  //注册GPIO_INPUT_IO_0，也就是GPIO18中断处理程序

}
void hardware_task2(){

trigger = 0;

while(1){

printf("[+] hardware task II : trigger %d\n",trigger);

if(trigger > 10000){

printf("[+] hardware task II : %s\n",hardware_flag_2);

break;

}

vTaskDelay(1000 / portTICK_RATE_MS);

}

}

#define ECHO_TEST_TXD  (GPIO_NUM_4)
#define ECHO_TEST_RXD  (GPIO_NUM_5)
#define ECHO_TEST_RTS  (UART_PIN_NO_CHANGE)
#define ECHO_TEST_CTS  (UART_PIN_NO_CHANGE)
void hardware_uart_setup(){

uart_config_t uart_config = {

.baud_rate = 115200,

.data_bits = UART_DATA_8_BITS,

.parity    = UART_PARITY_DISABLE,

.stop_bits = UART_STOP_BITS_1,

.flow_ctrl = UART_HW_FLOWCTRL_DISABLE,

.source_clk = UART_SCLK_APB,

};

uart_driver_install(UART_NUM_1, 1024 * 2, 0, 0, NULL, 0);

uart_param_config(UART_NUM_1, &uart_config);

uart_set_pin(UART_NUM_1, ECHO_TEST_TXD, ECHO_TEST_RXD, ECHO_TEST_RTS, ECHO_TEST_CTS);

}
void hardware_task3(){

printf("[+] hardware task III : find the third flag in another UART\n");

while (1) {

uart_write_bytes(UART_NUM_1, hardware_flag_3, strlen(hardware_flag_3));

vTaskDelay(1000 / portTICK_RATE_MS);

}

}

void network_init(){
    char ssid[0x10] = {0};
    char pass[0x10] = {0};
    get_random(ssid,6);
    get_random(pass,8);
    printf("[+] network task I: I will connect a wifi -> ssid: %s , password %s \n",ssid,pass);
    connect_wifi(ssid,pass);
}
static void network_tcp()

{
char addr_str[128];
struct sockaddr_in dest_addr;

dest_addr.sin_addr.s_addr = htonl(INADDR_ANY);
dest_addr.sin_family = AF_INET;
dest_addr.sin_port = htons(3333);

int listen_sock = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);

ESP_LOGI(TAG, "Socket created");

bind(listen_sock, (struct sockaddr *)&dest_addr, sizeof(dest_addr));
ESP_LOGI(TAG, "Socket bound, port %d", 3333);

listen(listen_sock, 1);
while (1) {

    ESP_LOGI(TAG, "Socket listening");
    struct sockaddr_storage source_addr;
    socklen_t addr_len = sizeof(source_addr);
    int sock = accept(listen_sock, (struct sockaddr *)&source_addr, &addr_len);
    inet_ntoa_r(((struct sockaddr_in *)&source_addr)->sin_addr, addr_str, sizeof(addr_str) - 1);
    ESP_LOGI(TAG, "Socket accepted ip address: %s", addr_str);
    char buffer[100];
    while(recv(sock,buffer,0x10,0)){
        if(strstr(buffer,"getflag")){
            send(sock, network_flag_1, strlen(network_flag_1), 0);
            break;
        }else{
            send(sock, "error\n", strlen("error\n"), 0);
        }
        vTaskDelay(1000 / portTICK_RATE_MS);
    }
    open_next_tasks = 1;
    shutdown(sock, 0);
    close(sock);
}

}

airmon-ng start wlan0
airodump-ng wlan0mon

docker build -t esp32ctf .
docker run -d -p 1883:1883 esp32ctf

把
mqtt_app_start("mqtt://mqtt.esp32ctf.xyz");
改为
mqtt_app_start("mqtt://192.168.50.132");

case MQTT_EVENT_DATA:
  ESP_LOGI("mqtt", "MQTT_EVENT_DATA");
  printf("[+] MQTT task II: topic ->  %.*s\r\n", event->topic_len, event->topic);
  printf("[+] MQTT task II: data -> %.*s\r\n", event->data_len, event->data);
  mqtt_data_hander(event->data_len,event->data);
  break;

void mqtt_data_hander(int length,char * data){
    char l[10];
    char url[500] = {0};
    char out[500] = {0};
    char httpdata[500]={0};
    char flagdata[500]={0};
    char tag3[] = " [+] MQTT task III: ";
    sprintf(flagdata,"%s%s%s",mqtt_flag_2,tag3,mqtt_flag_3);//把flag2、tag3和flag3都放在flagdata里面
int a = 46;

char * p = strnstr(data,"?",length);//在data中查找"?"，如果找到了就返回位置
if(p){
    int data_length = p - data;//数据长度 等于 p的地址 - 数据的地址
    snprintf(l,length - data_length,"%s",p+1);//这个l就是打印flag的长度，就是传入的data中?后面的数，但是是字符串的形式
    a = atoi(l);//从字符串转成整数
    length = data_length;
}

sprintf(url,"%.*s",length, data);

char fmt[] = "GET / HTTP/1.0\r\n"
             "User-Agent: esp-idf/1.0 esp32\r\n"
             "flag: %s\r\n"
             "\r\n";

if( a < (int)(sizeof(mqtt_flag_2) + sizeof(tag3) - 1 ) ){//判断a的大小，以整数的形式进行比较，正常来说肯定是通过的，因为mqtt_flag_2+tag3-1长度大于a
    memcpy(out,flagdata,a & 0xff);//这样out就是flagdata中以a&0xff为长度的
    sprintf(httpdata,fmt,out);
    http_get_task(url,httpdata);//带上数据去请求
}

}