Archived Challenges - December 2023

Submit the flag?

ictf{round_41_sanity_check}

Generated with https://eth007.me/CyberChef/#recipe=XOR(%7B'option':'UTF8','string':'pwn'%7D,'Standard',false)To_Hex('Space',0)Remove_whitespace(true,true,true,true,true,false)&input=aWN0Zntwd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd25wd259

ictf{pwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwnpwn}

p = 2**17 - 1
arr = [27804, 113082, 71154, 1, 108473, 46422, 70266, 9659, 5142, 116383, 49154, 127179, 16778]
chars = list(b'abcdefghijklmnopqrstuvwxyz0123456789{}_')
for i,j in [rational_reconstruction(i,p).as_integer_ratio() for i in arr]:
     pi = i
     pj = j
     while i not in chars or j not in chars:
         i += pi
         j += pj
     print(f"{chr(i)}{chr(j)}",end="")
print()
# ictf{i004t10nal_d3str0yer}
# because of the 1 in arr, brute force the `00` until md5 hash lines up```

ictf{irr4t10nal_d3str0yer}

Run the binary.

ictf{d1d_u_ruN_it?}

It XORs two strings together in memory, then checks. You can see the flag in GDB.

ictf{xor_is_awesome}

1. use pickletools.dis on the object, see a bunch of garbage
2. instead search for the string Incorrect flag!!!!!! because that is one of the known strings that the pickle returns
3. see that it is being compared like str.eq(input("Enter the flag > "), ???? mystery value ????)
4. see that the mystery value it retrieves for comparison is from the memo
5. print out the memo after the Unpickler is done unpickling

from pickle import *

if __name__ == '__main__':
    with open("out.pickle", 'rb') as f:
        q = Unpickler(f)
        print(q.load())

        memo = q.memo.copy()
        print(memo[max(memo.keys())])```

ictf{so_i_went_to_the_car_DILLership_but_all_they_had_were_caDILLacs}

There's a stack overflow. We can binary search on the buffer length to find the correct offset to return to the win function. Also note that it must be 8 byte aligned which speeds up our search a lot. It takes log_2(10^6/8) ~ 17 tries in the worst case scenario, but it works with 16 for the buffer size I chose for this challenge.

Alternatively, r.sendline(p64(win)*(92000)) with a bit of manual binary search.

Binary: https://fdow.nl/gsNVQ, Source code: https://fdow.nl/Yih4k

ictf{20/20_vision_3bc0b338}

You can find my GitHub profile on my Discord. Then you can find this repo https://github.com/programmeruser2/old-website, which contains links to many of my profiles. Doing a DNS lookup on the domains will show that gemini.programmeruser.tk points to a residential IP address.

REDACTED