{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-angstromctf-2021-en","result":{"data":{"markdownRemark":{"id":"31257fd5-d087-5f01-8298-dc36c4d0ae0f","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in ångstromCTF 2021.\nI joined with the goal of clearing all of the Reversing challenges again this time, but unfortunately I could solve only 3 of the 11 problems…

\n

This time, among the problems I somehow managed to solve, I’m writing a writeup for Infinity Gauntlet, which taught me especially a lot.

\n

About This Article

\n

The content of this article is not intended to encourage actions that violate public order.

\n

Please note in advance that attempting attacks against environments you do not own or are not authorized to use may violate the Act on the Prohibition of Unauthorized Computer Access (Unauthorized Access Prohibition Act).

\n

Also, all opinions expressed here are my own and do not represent any organization I belong to.

\n

About the CTF Writeup Series

\n

I’m writing this series partly for my own study, and I’ll try to explain CTF challenges carefully enough that even beginners can follow along.

\n

To be honest, I think CTFs are a pretty difficult genre for someone to jump into cold.\nWhen I first entered a competition, I couldn’t solve a single problem, and even after reading writeups by veteran CTF players, I still understood nothing.

\n

So in this series, as part of my own learning, I aim to explain the steps to obtaining the flag as clearly and carefully as possible.

\n

At the same time, I’m still relatively new to CTFs myself, so if you notice any mistakes, I’d really appreciate it if you pointed them out.

\n

Challenge Overview

\n
\n

All clam needs to do is snap and finite will turn into infinit…

\n

https://2021.ångstromctf.com/challenges

\n
\n

I don’t really understand what the prompt means, but when you run the downloaded executable, it displays the following challenge text and asks for input.

\n
$./infinity_gauntlet \n\nWelcome to the infinity gauntlet!\nIf you complete the gauntlet, you'll get the flag!\n=== ROUND 1 ===\nbar(?, 108, 377) = 102484\n100\nWrong!
\n

There are seven possible patterns for the questions it asks.

\n
// foo function\nfoo(?, %u) = %u\nfoo(%u, ?) = %u\nfoo(%u, %u) = ?\n\n// bar function\nbar(?, %u, %u) = %u\nbar(%u, ?, %u) = %u\nbar(%u, %u, ?) = %u\nbar(%u, %u, %u) = ?
\n

When you answer one of these correctly, the ROUND value is updated and the next question is displayed.

\n

What I Learned This Time

\n
    \n
  1. How to automate the execution of an interactive program with Python
    2. \n
  2. How to read a little assembly
    3. \n
\n

Solution

\n

I’ll describe the overall solution first.\nI especially struggled with step 3, obtaining the FLAG.

\n
    \n
  1. Statically analyze the provided executable to understand where the FLAG string is stored and how it is stored
    2. \n
  2. Use GDB to understand the details of the foo and bar functions
    3. \n
  3. Statically analyze the provided executable to understand how to obtain the FLAG
    4. \n
  4. Write a solver that automates answering the questions and retrieving the FLAG
    5. \n
\n

1. Understand where the FLAG string is stored and how it is stored

\n

First, if you try to run the provided executable locally, you get the following error.

\n
$./infinity_gauntlet \nCouldn't find a flag file.
\n

If you decompile it in Ghidra, you can see that it reads flag.txt from the same directory at runtime.

\n
local_40 = *(long *)(in_FS_OFFSET + 0x28);\nsetvbuf(stdout,(char *)0x0,2,0);\n__stream = fopen(\"flag.txt\",\"r\");\n\n// If reading flag.txt fails\nif (__stream == (FILE *)0x0) {\n  puts(\"Couldn\\'t find a flag file.\");\n  uVar6 = 1;\n}
\n

When reading flag.txt succeeds, it seems to execute the following processing.\nI renamed the variables arbitrarily.

\n
__s = FLAG;\nfgets((char *)__s,0x100,__stream);\nfclose(__stream);\nsVar4 = strcspn((char *)__s,\"\\n\");\niVar1 = (int)sVar4;\nFLAG[iVar1] = 0;\nif (iVar1 != 0) {\n  bVar7 = 0;\n  do {\n    *__s = *__s ^ bVar7;\n    bVar7 = bVar7 + 0x11;\n    __s = __s + 1;\n  } while (bVar7 != (byte)((char)sVar4 * '\\x11'));\n    \n  ...\n}
\n

As you can tell from the decompiled code, it appears to do the following.

\n
    \n
  1. Take the string obtained from flag.txt one character at a time
    2. \n
  2. Compute flag character XOR (0x11 * zero-based character index)
    3. \n
  3. Store the result in the buffer where the encrypted flag is kept
    4. \n
\n

The address of this storage location will show up again later, so it’s worth remembering.\nI think it’s helpful to give it a label name in Ghidra.

\n

2. Understand the details of the foo and bar functions

\n

Next, to solve the questions it asks, we need to understand their nature.\nI’m calling them functions for convenience, but the logic itself was written inside main().

\n

Tracing both of them directly from the assembly source is a lot of work, so I analyzed them with GDB.

\n

From the disassembly results, I found that the following code handles receiving the input and determining whether the answer is correct.\nSo I set a breakpoint at this address and analyzed it in GDB.

\n
0010125a e8 71 fe        CALL       __isoc99_scanf                                   undefined __isoc99_scanf()\n          ff ff\n0010125f 39 5c 24 0c     CMP        dword ptr [RSP + local_14c],EBX\n00101263 0f 85 c7        JNZ        LAB_00101430\n          01 00 00\n00101269 83 c5 01        ADD        ebp,0x1\n0010126c 48 8d 3d        LEA        RDI,[s_Correct!_Maybe_round_%d_will_get_001021   = "Correct! Maybe round %d will \n          bd 0e 00 00\n00101273 31 c0           XOR        EAX,EAX\n00101275 89 ee           MOV        ESI,ebp\n00101277 e8 e4 fd        CALL       printf                                           int printf(char * __format, ...)
\n

By running it several times while bypassing the correct/incorrect branch by rewriting the zero flag, I learned the following in combination with the assembly above.

\n
    \n
  1. At 0x0010125f, it compares the input value with the value in the EBX register to determine whether the answer is correct.
    2. \n
  2. If the answer is correct, 1 is added to the value in the EBP register.
    3. \n
\n

At this point, by reading the value of the EBX register in GDB when the program checks the answer, you can learn the correct answer and use that as a clue to discover the rules of each function.\n(Unfortunately, the process of reverse-engineering each formula would make this article too long, so I’ll omit it.)

\n

After some trial and error, I was able to figure out the logic foo and bar use to determine each value in the problem statement.

\n
foo(A, B) = C\nC = A ^ (B + 1) ^ 0x539
\n
bar(A, B, C) = D\nD = B * (C + 1) + A
\n

Every question the program gives is a fill-in-the-blank version of either the foo or bar formula, so using these formulas lets you answer all of them correctly.

\n

I created an automation script and tried solving the questions.

\n
=== ROUND 44 ===\nbar(1160, ?, 58) = 124529\n2091\nCorrect! Maybe round 45 will get you the flag ;)\n\n=== ROUND 45 ===\nfoo(?, 355) = 38988\n39953\nCorrect! Maybe round 46 will get you the flag ;)\n\n=== ROUND 46 ===\nfoo(39, ?) = 41440\n42237\nCorrect! Maybe round 47 will get you the flag ;)
\n

However, even after answering more than 10,000 questions correctly, I still couldn’t get the FLAG. So I had to continue analyzing the program to figure out how the FLAG can actually be obtained.

\n

3. Understand how to obtain the FLAG

\n

Now let’s think about how the FLAG can be obtained.

\n

Earlier, we confirmed that the ebp register is incremented when you answer correctly, so I guessed that this was related and traced the code with that assumption in mind.

\n

Then I found that it compares the value in ebp with 0x31, and jumps to 0x1504 when it is greater.

\n
0x00001291      83fd31         cmp ebp, 0x31\n0x00001294      0f8f6a020000   jg 0x1504
\n

So I looked at what happens after 0x1504.\nIt turns out that once you solve more than 50 questions, the answer to the challenge that would normally be generated randomly (the value in the EBX register) stops being random and is instead created by the following processing!

\n
0x00001504      99             cdq\n0x00001505      41f7fe         idiv r14d\n0x00001508      8d1c2a         lea ebx, [rdx + rbp]\n0x0000150b      4863d2         movsxd rdx, edx\n0x0000150e      0fb6441410     movzx eax, byte [rsp + rdx + 0x10]\n0x00001513      0fb6db         movzx ebx, bl\n0x00001516      c1e308         shl ebx, 8\n0x00001519      09c3           or ebx, eax\n0x0000151b      e98bfdffff     jmp 0x12ab ;start of the next problem setup
\n

This is hard to read as-is, so let’s look at Ghidra’s decompiled output.

\n
EBX = (FlagLength % iVar1 + current_correct_count & 0xff) << 8 | \\\n(uint)FLAGARR[FlagLength % iVar1];
\n

It seems that the program stores a value in EBX using the flag string it encrypted at the beginning.\nMore specifically, EBX stores the result of OR-ing:

\n\n

In other words, if EBX is 0x9c3f and the current number of correct answers is 152, you can recover the flag character as follows.

\n
EBX   0x9c3f\nCorrect answers 0x98(152)\n\n1. `0x9c - 0x98 = 4`, so the low byte corresponds to the 4th character\n2. The low byte is `0x3f`, so you know the encrypted 4th flag character is `0x3f`\n3. The encryption is `flag character XOR (0x11 * zero-based flag index)`, so for the 4th character it is\n   `0x3f XOR 0x33`\n4. Therefore, you can tell that the 4th character of the FLAG is `{`
\n

Once you get this far, the rest is easy: write a script that automatically solves the questions while keeping track of the current number of correct answers, and once the count exceeds 50, just run the decode process above to recover the FLAG string.

\n

…that was a lie!!\nIf you stop there, the 16th character onward gets garbled.

\n

I got pretty stuck here at first because I had no idea why this was happening.

\n

After thinking about it for a while, I realized that in this part where the flag characters are XOR-encrypted by multiples of 0x11, the register actually used for the encryption is the cl register.

\n
0x00001190      300a           xor byte [rdx], cl\n0x00001192      83c111         add ecx, 0x11
\n

The cl register is the lower 8 bits of the ecx register, which means the value used in the XOR operation here is also just 1 byte.

\n

When I calculated the multiples of 0x11, I found that the 15th multiple is exactly 0xFF, and from the 16th multiple onward the value no longer fits in 8 bits.\nBy the time I first ran the solver, I already knew the FLAG was 26 characters long, so I fixed the solver so that it would also XOR with 256, preventing the 16th through 26th characters from becoming garbled, and that finally gave me the FLAG.

\n

4. Write a solver to automate answering the questions and retrieving the FLAG

\n

From here on, this is completely extra as a writeup, but since this was my first time automating the interactive execution of an ELF with a Python script, I wanted to add it.

\n

To run a program interactively from Python, use pexpect.

\n

Usage is very simple: start a process by specifying the CLI command to run, and when a particular string appears in the output, you can provide any input you want at that timing.

\n

Below is a summary of the tips I used this time.

\n

Start the program

\n
child = pexpect.spawn ('command to run', logfile=sys.stdout.buffer)\n...\nchild.close()
\n

In the command to run field, enter nc shell.actf.co 21700 or ./executable_name to launch a process for automating interactive command handling.

\n

At this time, setting logfile=sys.stdout.buffer sends the output to standard output, so you can automate the processing while keeping a feel close to running the program directly from the console.

\n

Send input at an arbitrary timing

\n
child.expect(r'string to wait for (regular expression)')\nchild.sendline('string to send')
\n

expect() waits until a string matching the regular expression you passed in appears.

\n

sendline sends a string followed by a newline to the process.

\n

When expect() finds a match, it gives you the following.

\n
    \n
  1. before: the string that had been written to standard output before the part that matched the regular expression
    2. \n
  2. after: the string that matched the regular expression
    3. \n
  3. buffer: the string that had been written to standard output after the part that matched the regular expression at the moment of the match
    4. \n
\n

In the solver I wrote this time, I matched every line with \\n, then branched based on whether the immediately preceding output (the challenge prompt) contained foo or bar, and handled it accordingly.

\n

The Solver I Created

\n
import io\nimport os\nimport sys\nimport time\nimport re\nimport pexpect\n\narr = [\"-1\" for i in range(50)]\nx11 = [i * 17 for i in range(50)]\n\ndef revflag(ans, rounds):\n    pos = (ans >> 8) - rounds\n    pos = pos\n    flag = (ans & 0x00ff)\n    if pos > 15:\n        flag = chr(flag ^ x11[pos] ^ 256)\n    else:\n        flag = chr(flag ^ x11[pos])\n\n    print(\"ans {}\".format(hex(ans)))\n    print(\"pos {}\".format(pos))\n    print(\"flag {}\".format(flag))\n\n    arr[pos] = flag\n    return\n\ndef getfoo(S):\n    # foo(?, 13) = 11231\n    reA = r\"^foo\\(([0-9]{1,9}|\\?),\"\n    reB = r\",\\s([0-9]{1,9}|\\?)\\)\"\n    reC = r\"=\\s([0-9]{1,9}|\\?)\"\n\n    A = re.findall(reA, S)[0]\n    B = re.findall(reB, S)[0]\n    C = re.findall(reC, S)[0]\n\n    return A, B, C\n\ndef getbar(S):\n    # bar(?, 305, 449) = 138744\n    reA = r\"^bar\\(([0-9]{1,9}|\\?),\"\n    reB = r\",\\s([0-9]{1,9}|\\?),\"\n    reC = r\",\\s([0-9]{1,9}|\\?)\\)\"\n    reD = r\"=\\s([0-9]{1,9}|\\?)\"\n\n    A = re.findall(reA, S)[0]\n    B = re.findall(reB, S)[0]\n    C = re.findall(reC, S)[0]\n    D = re.findall(reD, S)[0]\n\n    return A, B, C, D\n\ndef foo(A, B, C):\n    ans = 0    \n    if A == '?':\n        cd = int(C) ^ 1337\n        ans = (int(B) + 1) ^ cd\n         \n    if B == '?':\n        cd = int(C) ^ 1337\n        ans = (int(A) ^ cd) - 1\n\n    if C == '?':\n        ans = int(A) ^ (int(B) + 1) ^ 1337\n\n    return int(ans)  \n\n\ndef bar(A, B, C, D):\n    ans = 0\n    if A == '?':\n        bd = int(B) * (int(C) + 1)\n        ans = int(D) - bd\n         \n    if B == '?':\n        dd = int(D) - int(A)\n        ans = (dd // (int(C) + 1))\n         \n    if C == '?':\n        dd = int(D) - int(A)\n        ans = (dd // int(B)) - 1\n         \n    if D == '?':\n        ans = int(B) * (int(C)+1) + int(A)\n\n    return int(ans)\n\n\nchild = pexpect.spawn ('nc shell.actf.co 21700', logfile=sys.stdout.buffer)\n\ncounter = 1\nwhile(True):\n    try:\n        child.expect(r'\\n')\n        S = str(child.before)\n        # print(S[2:-3])\n\n        if counter < 50:            \n            if \"bar\" in S:\n                counter += 1\n                A, B, C, D = getbar(S[2:-3])\n                # print(A, B, C, D)\n\n                ans = bar(A, B, C, D)\n                child.sendline(str(ans))\n                \n            if \"foo\" in S:\n                counter += 1\n                A, B, C = getfoo(S[2:-3])\n\n                ans = foo(A, B, C)\n                child.sendline(str(ans))\n        \n        else:\n            if \"bar\" in S:\n                A, B, C, D = getbar(S[2:-3])\n                # print(A, B, C, D)\n\n                ans = bar(A, B, C, D)\n                revflag(ans, counter)\n                print(\"Count : {} Ans : {}\".format(hex(counter), hex(ans)))\n\n                child.sendline(str(ans))\n                counter += 1\n                \n            if \"foo\" in S:\n                A, B, C = getfoo(S[2:-3])\n\n                ans = foo(A, B, C)\n                revflag(ans, counter)\n                print(\"Count : {} Ans : {}\".format(hex(counter), hex(ans)))\n\n                child.sendline(str(ans))\n                counter += 1\n\n        if counter > 254:\n            break\n\n    except Exception as e:\n        print(e)\n        break\n\nchild.close()\nprint(\"\".join(arr))
\n

Summary

\n

So, from the Reversing challenges in ångstromCTF 2021, I wrote up my attempt at Infinity Gauntlet.

\n

It took quite a while to solve completely (about 5 hours), but by taking the time to work through this problem carefully, I feel like I deepened my knowledge and understanding of assembly and registers quite a bit.

\n

I plan to keep challenging myself with various Reversing problems in the future.

\n

References & Books I Used While Solving the Challenge

\n

Books

\n\n

Web

\n","fields":{"slug":"/ctf-angstromctf-2021-en","tagSlugs":["/tag/ctf-en/","/tag/reversing-en/","/tag/english/"]},"frontmatter":{"date":"2021-10-04","description":"This time, I'm writing a writeup for Infinity Gauntlet, the challenge I learned the most from among the problems I managed to solve.","tags":["CTF (en)","Reversing (en)","English"],"title":"[Reversing Writeup] Infinity Gauntlet (ångstromCTF 2021)","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/ctf-angstromctf-2021-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}