Try   HackMD

Plotchy CTF Setup

New Challenge Setup Script

#! /usr/bin/env bash
# chmod +x copy_challenge.sh
# ./copy_challenge.sh NewChallengeName
preamble=/home/plotchy/code/ctf/paradigmctf-2022

cp $preamble/test/TestTemplate.t.sol $preamble/test/$1.t.sol
cp $preamble/script/ScriptTemplate.s.sol $preamble/script/$1.s.sol

mkdir -p $preamble/src/$1/public/contracts
cp -r $preamble/src/chal_name/public/contracts/Exploit.sol $preamble/src/$1/public/contracts/Exploit.sol

sed -i "s/chal_name/$1/g" $preamble/test/$1.t.sol
sed -i "s/TestTemplate/$1/g" $preamble/test/$1.t.sol
sed -i "s/ScriptTemplate/$1/g" $preamble/test/$1.t.sol

sed -i "s/chal_name/$1/g" $preamble/script/$1.s.sol
sed -i "s/TestTemplate/$1/g" $preamble/script/$1.s.sol
sed -i "s/ScriptTemplate/$1/g" $preamble/script/$1.s.sol

sed -i "s/chal_name/$1/g" $preamble/src/$1/public/contracts/Exploit.sol

Test Template

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.4;

import "forge-std/Test.sol";
import "../src/chal_name/public/contracts/Setup.sol";
import "../src/chal_name/public/contracts/Exploit.sol";

bytes constant SIXTY_FOUR_ZEROS = "0000000000000000000000000000000000000000000000000000000000000000"; // ctrlc+v on handcrafted calldata
address constant CREATE2_FACTORY = 0x4e59b44847b379578588920cA78FbF26c0B4956C;
/*
Commands:
# Testing command
forge test --mp ./test/TestTemplate.t.sol --mc Tester --fork-url $ANVIL_URL -vvvvv

# Debug command
forge test --mp ./test/TestTemplate.t.sol --mc Tester --debug <function> --fork-url $ANVIL_URL

# Script command
forge script script/ScriptTemplate.s.sol:Scripter --rpc-url $ANVIL_URL --private-key $PRIVATE_KEY_1 --broadcast -vvvvv

# Debug broadcasted tx:
cast run <TXHASH> -d --rpc-url $ANVIL_URL

# Exploratory
forge inspect <path>:<ContractName> storage --pretty
https://ethervm.io/decompile
https://library.dedaub.com/decompile
panoramix <bytecode>
*/


contract Tester is Test {
    Setup setup;
    address payable setupAddress;
    Challenge challenge;
    address payable challengeAddress;
    Exploit exploit;
    address payable exploitAddress;

    function setUp() public {
        setup = new Setup{value: 50 ether}();
        setupAddress = payable(address(setup));
        challenge = setup.challenge();
        challengeAddress = payable(address(challenge));
    }

    function testIsSolved() public {
        // useful to run at beginning to find storage slots .isSolved() uses
        vm.record();
        setup.isSolved();
        vm.accesses(challengeAddress);
    }

    function testExploit() public {
        console2.log("Bal after setup: setup: %s, challenge: %s", setupAddress.balance, challengeAddress.balance);

        exploit = new Exploit{value: 100 ether}(setup, challenge);
        exploitAddress = payable(address(exploit));

        // // alternatively use etk code as exploit
        // bytes memory etkCode = etkLoad();
        // address _addr;
        // assembly {
        //     _addr := create(0, add(initcode, 0x20), mload(initcode))
        // }
        // exploitAddress = address(_addr);

        console2.log("Bal after exp-deployed: setup: %s, challenge: %s, exploit: %s", setupAddress.balance, challengeAddress.balance, address(exploit).balance);

        exploit.finalize();
        console2.log("Bal post finalize: setup: %s, challenge: %s, exploit: %s", setupAddress.balance, challengeAddress.balance, address(exploit).balance);
        
        console2.log("Solved: %s", exploit.checkSolved());
    }


    function etkLoad() public returns (bytes memory etkCode){
        // Helper function to load handcrafted EVM code from a file.
        // typically used as:
        //    
        //    bytes memory etkCode = etkLoad();
        //    vm.etch(someAddress, etkCode);
        //    someAddress.call(hex"69696969");

        string[] memory inputs = new string[](2);
        // /**
        //  * windows: scripts/compile.bat
        //  * linux  : scripts/compile.sh
        //  */
        inputs[0] = "./script/compile.sh";

        // // path/to/contract.etk
        inputs[1] = "./src/chal_name/public/contracts/exploit.etk";

        etkCode = vm.ffi(inputs);
    }
}

Script Template

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;
import "forge-std/Script.sol";
import "../src/chal_name/public/contracts/Setup.sol";
import "../src/chal_name/public/contracts/Exploit.sol";

bytes constant SIXTY_FOUR_ZEROS = "0000000000000000000000000000000000000000000000000000000000000000"; // ctrlc+v on handcrafted calldata
address constant CREATE2_FACTORY = 0x4e59b44847b379578588920cA78FbF26c0B4956C;
/*
Commands:
# Testing command
forge test --mp ./test/TestTemplate.t.sol --mc Tester --fork-url $ANVIL_URL -vvvvv

# Debug command
forge test --mp ./test/TestTemplate.t.sol --mc Tester --debug <function> --fork-url $ANVIL_URL

# Script command
forge script script/ScriptTemplate.s.sol:Scripter --rpc-url $ANVIL_URL --private-key $PRIVATE_KEY_1 --broadcast -vvvvv

# Debug broadcasted tx:
cast run <TXHASH> -d --rpc-url $ANVIL_URL

# Exploratory
forge inspect <path>:<ContractName> storage --pretty
https://ethervm.io/decompile
https://library.dedaub.com/decompile
panoramix <bytecode>
*/
contract Scripter is Script {

    Challenge challenge;
    address payable challengeAddress;
    address payable setupAddress;
    address payable exploitAddress;
    function setUp() public {}

    function run() external {
        vm.startBroadcast();

        Setup setup = new Setup{value: 100 ether}();
        setupAddress = payable(address(setup));
        challenge = setup.challenge();
        challengeAddress = payable(address(challenge));
        
        Exploit exploit = new Exploit{value: 100 ether}(setup, challenge);
        exploitAddress = payable(address(exploit));
        exploit.finalize();

        // // alternatively use etk code as exploit
        // bytes memory etkCode = etkLoad();
        // address _addr;
        // assembly {
        //     _addr := create(0, add(initcode, 0x20), mload(initcode))
        // }
        // exploitAddress = address(_addr);

        vm.stopBroadcast();
    }


    function etkLoad() public returns (bytes memory etkCode){
        // Helper function to load handcrafted EVM code from a file.
        // typically used as:
        //    
        //    bytes memory etkCode = etkLoad();
        //    vm.etch(someAddress, etkCode);
        //    someAddress.call(hex"69696969");

        string[] memory inputs = new string[](2);
        // /**
        //  * windows: scripts/compile.bat
        //  * linux  : scripts/compile.sh
        //  */
        inputs[0] = "./script/compile.sh";

        // // path/to/contract.etk
        inputs[1] = "./src/chal_name/public/contracts/exploit.etk";

        etkCode = vm.ffi(inputs);
    }

}

Exploit Template

//SPDX-License-Identifier: MIT
pragma solidity ^0.8.4;

import './Setup.sol';
import './Challenge.sol';
contract Exploit {

    Setup public setup;
    address payable public setupAddress;
    Challenge public challenge;
    address payable public challengeAddress;
    

    constructor(Setup _setup, Challenge _challenge) payable {
        setup = _setup;
        setupAddress = payable(address(setup));
        challenge = _challenge;
        challengeAddress = payable(address(challenge));
    }

    function finalize() external {

    }

    function checkSolved() public view returns(bool) {
        return setup.isSolved();
    }

    fallback() external payable {

    }
}

ETK Basics

Generic ETK Template

# set up storage here

# This is a universal constructor - 600b8038035981835939f3

%push(runtimeBytecode) # %push(label) will push the pc of the label startpoint [start]

dup1 # [start, start]
codesize # [codesize, start, start]
sub # [lengthRun, start]

msize # [0, lengthRun, start]
dup2 # [lengthRun, 0, lengthRun, start]
dup4 # [start, lengthRun, 0, lengthRun, start]

msize
codecopy #[0, start, lengthRun, 0, lengthRun, start]
return #[0, lengthRun, ...]

runtimeBytecode:
    # your runtime bytecode

evmSetup Template

pragma solidity ^0.8.4;

// Used when you need to locally deploy/test a non-sourced contract.


contract evmSetup {

    address payable public challengeAddress;
    constructor() payable {
        // gather creation code through .bin file
        bytes memory initcode = hex"6080604052000000"; // ..... this is creationCode
        address _addr;
        assembly {
            _addr := create(0, add(initcode, 0x20), mload(initcode))
        }

        /* version with constructor args:
        bytes memory initcode = hex"6080604052000000";
        bytes memory args1 = hex"0000000000000000000000000000000000000000000000000000000000000001";
        bytes memory args2 = hex"0000000000000000000000000000000000000000000000000000000000000002";
        bytes memory initcode_w_args = abi.encodePacked(initcode, args1, args2);
        address _addr;
        assembly {
            _addr := create(0, add(initcode_w_args, 0x20), mload(initcode_w_args))
        }
        */
        challengeAddress = payable(_addr);
    }

    function isSolved() public view returns (bool) {
        return challengeAddress.balance == 0;
    }
}

ETK compile helper

# Basic conversion of etk to bytecode
eas /src/chal_name/public/contracts/exploit.etk

#! /usr/bin/env bash
# For use with vm.ffi()
# saved as ./script/compile.sh
echo "0x$(eas $1)"

General

Create2 Factory mainnet

0x4e59b44847b379578588920cA78FbF26c0B4956C

Using ERADICATE2

CREATE2 crunching
./ERADICATE2.x64 -A 0x4e59b44847b379578588920cA78FbF26c0B4956C -i <path/to/bytecode> --matching c0ffee

function testCREATE2() public {
        bytes32 salt = 0x38f3364199653d393a7c5152d5cedbbe4e45bf616f4219edaa5e89fbd09f208b;
        bytes memory etkCode = etkLoad();
        bytes memory data = bytes.concat(salt, etkCode);
        CREATE2_FACTORY.call(data);
        console2.logBytes(address(0xc0fFeE0925e2b93b24eF8B2f7C2adE3dd15Ee8e8).code);
    }
Last changed by 
 
onemandbad+2
capture all the flags
0
543

Read more

"Solving" 0xMonaco

tl;dr: buy all acceleration, recursively call monaco.play(1), win. onemanbandplus2 consists of Brock Elmore @ Nascent, Plotchy (independent), and 0xalpharush @ Trail of Bits Context 0xMonaco is a game in which many players compete against each other in a smart contract &quot;race&quot;. Each car in the race is a smart contract created by a competitor, with 3 cars in each race. The goal is to get your car to distance 1000 before your competitors do. To do so, there are 2 resources a car can buy: acceleration shells Acceleration is exactly as it sounds: it increases your car&apos;s speed. Shells on the other hand, can shoot forward and change the car in front of your&apos;s speed down to 1.

Aug 23, 2022
Untitled

lockbox2.t.sol // SPDX-License-Identifier: MIT pragma solidity ^0.8.4; import &quot;forge-std/Test.sol&quot;; import &quot;../src/lockbox2/public/contracts/Setup.sol&quot;; import &quot;../src/lockbox2/public/contracts/Exploit.sol&quot;; bytes constant SIXTY_FOUR_ZEROS = &quot;0000000000000000000000000000000000000000000000000000000000000000&quot;; // ctrlc+v on handcrafted calldata

Aug 20, 2022
Rever

This was just me getting used to hackmd. Cant find delete button lol You send runtime bytecode to setup.challenge().deploy() will be grabbed from rever.etk using vm.ffi and ./script/compile.sh Example inputs find string through cast --format-bytes32-string &lt;string&gt; or https://www.rapidtables.com/convert/number/ascii-to-hex.html &quot;paradigm&quot;

Aug 19, 2022
Read more from onemandbad+2
Published on HackMD