{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-backdoorctf-2023-en","result":{"data":{"markdownRemark":{"id":"afaf0e27-8d7f-51d3-a0cb-12160c5d9719","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in Backdoor CTF 2023, which started on December 16, 2023, with 0nePadding.

\n

We had fewer members than usual this time, but we still placed 57th out of 779 teams.

\n

\n \n \n \n \n \n \n \n \n

\n

There were several interesting challenges, and it was a lot of fun.

\n

As usual, I will write up a few of them.

\n\n

Table of Contents

\n\n

Beginner-menace(Forensic)

\n
\n

Go off now and enjoy the 2 days of unlimited fun.

\n
\n

You can obtain the flag by checking the Exif data of the file given as the challenge binary.

\n
$ exiftool friend.jpeg\nExifTool Version Number         : 12.40\nFile Name                       : friend.jpeg\nDirectory                       : .\nFile Size                       : 6.3 KiB\nFile Modification Date/Time     : 2023:12:16 20:26:01+00:00\nFile Access Date/Time           : 2023:12:16 20:26:01+00:00\nFile Inode Change Date/Time     : 2023:12:16 20:26:01+00:00\nFile Permissions                : -rw-r--r--\nFile Type                       : JPEG\nFile Type Extension             : jpg\nMIME Type                       : image/jpeg\nJFIF Version                    : 1.01\nExif Byte Order                 : Big-endian (Motorola, MM)\nX Resolution                    : 1\nY Resolution                    : 1\nResolution Unit                 : None\nArtist                          : flag{7h3_r34l_ctf_15_7h3_fr13nd5_w3_m4k3_al0ng}\nY Cb Cr Positioning             : Centered\nImage Width                     : 266\nImage Height                    : 190\nEncoding Process                : Baseline DCT, Huffman coding\nBits Per Sample                 : 8\nColor Components                : 3\nY Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)\nImage Size                      : 266x190\nMegapixels                      : 0.051
\n

Headache(Forensic)

\n
\n

I’ve had a headache since last evening. Is there a magic spell that can cure it immediately?

\n
\n

The file given as the challenge binary was corrupted, so I opened it in a binary editor. There was a region that appeared to be the IHDR chunk, but the magic number at the beginning was not that of a PNG file.

\n

\n \n \n \n \n \n \n \n \n

\n

Given that the challenge name was Headache, it seemed that the broken header itself was the point of the problem.

\n

So I changed the first 4 bytes to 89 50 4E 47.

\n

\n \n \n \n \n \n \n \n \n

\n

After that, the file was repaired, and I could open the following image.

\n

\n \n \n \n \n \n \n \n \n

\n

However, even after trying various patterns such as flag{8p3ll_15_8g_50_4E_47}, I still could not get it accepted as the correct flag.

\n

Then, based on a sharp comment from a teammate, I entered flag{sp3ll_15_89_50_4E_47}, which turned out to be accepted.

\n

\n \n \n \n \n \n \n \n \n

\n

Being forced to replace 8 with s felt a bit too guessy, but it solved the challenge, so fine.

\n

Indecipherable-image-or-is-it?(Forensic)

\n
\n

How ‘bout an easy Steg challenge, Just remember that brute-forcing is not an option!

\n
\n

Running zsteg -a against the PNG file given as the challenge binary showed that it contained the data of a zipped JPEG file and a flag-like string, keka{1b0asx2w_hbin9K_Ah_6xwm0L}.

\n

\n \n \n \n \n \n \n \n \n

\n

After extracting and unpacking this ZIP file, I used stegbrute to brute-force steghide and obtained a file containing the string F4K5FL4G.

\n

\n \n \n \n \n \n \n \n \n

\n

I got stuck there during the contest, but apparently if you use F4K5FL4G as the key and decrypt the string keka{1b0asx2w_hbin9K_Ah_6xwm0L} with a Vigenere cipher, you can obtain the correct flag.

\n

Because the braces and underscores seemed to be preserved, I had guessed that it was some kind of substitution cipher or ROT-style cipher, but simply throwing it into CyberChef did not decrypt it, and I did not get as far as trying different Vigenere settings.

\n

\n \n \n \n \n \n \n \n \n

\n

The alphabet choice feels a little too guess-heavy.

\n

OpenSesame(Rev)

\n
\n

Whisper the phrase, unveil with ‘Open Sesame

\n
\n

When I unpacked and analyzed the APK given as the challenge binary, I found that it was an app that validates a username and password, and I confirmed that it does not use any native libraries.

\n

So, to start with, I looked at MainActivity.smali, which roughly decompiles into the following.

\n
public class com.example.open_sesame.MainActivity extends androidx.appcompat.app.AppCompatActivity {\n /* .source \"MainActivity.java\" */\n /* # static fields */\n private static final valid_password;\n private static final java.lang.String valid_user;\n /* # instance fields */\n private android.widget.Button buttonLogin;\n private android.widget.EditText editTextPassword;\n private android.widget.EditText editTextUsername;\n /* # direct methods */\n static com.example.open_sesame.MainActivity ( ) {\n /* .locals 1 */\n int v0 = 7; // const/4 v0, 0x7\n /* new-array v0, v0, [I */\n /* fill-array-data v0, :array_0 */\n return;\n /* nop */\n /* :array_0 */\n /* .array-data 4 */\n /* 0x34 */\n /* 0x6c */\n /* 0x31 */\n /* 0x62 */\n /* 0x61 */\n /* 0x62 */\n /* 0x61 */\n } // .end array-data\n} // .end method\npublic com.example.open_sesame.MainActivity ( ) {\n /* .locals 0 */\n /* .line 11 */\n /* invoke-direct {p0}, Landroidx/appcompat/app/AppCompatActivity;-><init>()V */\n return;\n} // .end method\nstatic void access$000 ( com.example.open_sesame.MainActivity p0 ) { //synthethic\n /* .locals 0 */\n /* .line 11 */\n /* invoke-direct {p0}, Lcom/example/open_sesame/MainActivity;->validateCredentials()V */\n return;\n} // .end method\n\nprivate java.lang.String flag ( java.lang.String p0, java.lang.String p1 ) {\n /* .locals 4 */\n /* .line 91 */\n /* new-instance v0, Ljava/lang/StringBuilder; */\n /* invoke-direct {v0}, Ljava/lang/StringBuilder;-><init>()V */\n int v1 = 0; // const/4 v1, 0x0\n /* .line 92 */\n} // :goto_0\n\nv2 = (( java.lang.String ) p2 ).length ( ); // invoke-virtual {p2}, Ljava/lang/String;->length()I\n/* if-ge v1, v2, :cond_0 */\n/* .line 93 */\nv2 = (( java.lang.String ) p2 ).charAt ( v1 ); // invoke-virtual {p2, v1}, Ljava/lang/String;->charAt(I)C\nv3 = (( java.lang.String ) p1 ).length ( ); // invoke-virtual {p1}, Ljava/lang/String;->length()I\n/* rem-int v3, v1, v3 */\nv3 = (( java.lang.String ) p1 ).charAt ( v3 ); // invoke-virtual {p1, v3}, Ljava/lang/String;->charAt(I)C\n/* xor-int/2addr v2, v3 */\n/* int-to-char v2, v2 */\n/* .line 94 */\n(( java.lang.StringBuilder ) v0 ).append ( v2 ); // invoke-virtual {v0, v2}, Ljava/lang/StringBuilder;->append(C)Ljava/lang/StringBuilder;\n/* add-int/lit8 v1, v1, 0x1 */\n/* .line 96 */\n} // :cond_0\n(( java.lang.StringBuilder ) v0 ).toString ( ); // invoke-virtual {v0}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;\n} // .end method\nprivate it4chi ( java.lang.String p0 ) {\n/* .locals 3 */\n/* .line 68 */\nv0 = (( java.lang.String ) p1 ).length ( ); // invoke-virtual {p1}, Ljava/lang/String;->length()I\n/* new-array v0, v0, [I */\nint \nv1 = 0; // const/4 v1, 0x0\n/* .line 69 */\n} // :goto_0\nv2 = (( java.lang.String ) p1 ).length ( ); // invoke-virtual {p1}, Ljava/lang/String;->length()I\n/* if-ge v1, v2, :cond_0 */\n/* .line 70 */\nv2 = (( java.lang.String ) p1 ).charAt ( v1 ); // invoke-virtual {p1, v1}, Ljava/lang/String;->charAt(I)C\n/* aput v2, v0, v1 */\n/* add-int/lit8 v1, v1, 0x1 */\n} // :cond_0\n} // .end method\n\nprivate Boolean n4ut1lus ( java.lang.String p0 ) {\n/* .locals 4 */\n/* .line 54 */\n/* invoke-direct {p0, p1}, Lcom/example/open_sesame/MainActivity;->it4chi(Ljava/lang/String;)[I */\n/* .line 55 */\n/* array-length v0, p1 */\nv1 = com.example.open_sesame.MainActivity.valid_password;\n/* array-length v1, v1 */\nint v2 = 0; // const/4 v2, 0x0\n/* if-eq v0, v1, :cond_0 */\n} // :cond_0\n\n\n/* move v0, v2 */\n/* .line 59 */\n} // :goto_0\n/* array-length v1, p1 */\n/* if-ge v0, v1, :cond_2 */\n/* .line 60 */\n/* aget v1, p1, v0 */\nv3 = com.example.open_sesame.MainActivity.valid_password;\n/* aget v3, v3, v0 */\n/* if-eq v1, v3, :cond_1 */\n} // :cond_1\n/* add-int/lit8 v0, v0, 0x1 */\n} // :cond_2\nint p1 = 1; // const/4 p1, 0x1\n} // .end method\n\nprivate java.lang.String sh4dy ( java.lang.String p0 ) {\n/* .locals 4 */\n/* .line 76 */\n/* new-instance v0, Ljava/lang/StringBuilder; */\n/* invoke-direct {v0}, Ljava/lang/StringBuilder;-><init>()V */\nint v1 = 0; // const/4 v1, 0x0\n/* .line 78 */\n} // :goto_0\n\nv2 = (( java.lang.String ) p1 ).length ( ); // invoke-virtual {p1}, Ljava/lang/String;->length()I\n/* if-ge v1, v2, :cond_1 */\n/* .line 79 */\nv2 = (( java.lang.String ) p1 ).charAt ( v1 ); // invoke-virtual {p1, v1}, Ljava/lang/String;->charAt(I)C\n/* .line 80 */\nv3 = java.lang.Character .isDigit ( v2 );\nif ( v3 != null) { // if-eqz v3, :cond_0\n/* .line 81 */\n(( java.lang.StringBuilder ) v0 ).append ( v2 ); // invoke-virtual {v0, v2}, Ljava/lang/StringBuilder;->append(C)Ljava/lang/StringBuilder;\n} // :cond_0\n/* add-int/lit8 v1, v1, 0x1 */\n/* .line 84 */\n} // :cond_1\n(( java.lang.StringBuilder ) v0 ).toString ( ); // invoke-virtual {v0}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;\n} // .end method\nprivate void showToast ( java.lang.String p0 ) {\n/* .locals 1 */\nint v0 = 0; // const/4 v0, 0x0\n/* .line 100 */\nandroid.widget.Toast .makeText ( p0,p1,v0 );\n(( android.widget.Toast ) p1 ).show ( ); // invoke-virtual {p1}, Landroid/widget/Toast;->show()V\nreturn;\n} // .end method\nprivate Integer sl4y3r ( java.lang.String p0 ) {\n/* .locals 0 */\n/* .line 87 */\np1 = java.lang.Integer .parseInt ( p1 );\n/* add-int/lit8 p1, p1, -0x1 */\n} // .end method\n\n\nprivate void validateCredentials ( ) {\n/* .locals 3 */\nv0 = this.editTextUsername;\n/* .line 38 */\n(( android.widget.EditText ) v0 ).getText ( ); // invoke-virtual {v0}, Landroid/widget/EditText;->getText()Landroid/text/Editable;\n(( java.lang.Object ) v0 ).toString ( ); // invoke-virtual {v0}, Ljava/lang/Object;->toString()Ljava/lang/String;\n(( java.lang.String ) v0 ).trim ( ); // invoke-virtual {v0}, Ljava/lang/String;->trim()Ljava/lang/String;\n\nv1 = this.editTextPassword;\n/* .line 39 */\n(( android.widget.EditText ) v1 ).getText ( ); // invoke-virtual {v1}, Landroid/widget/EditText;->getText()Landroid/text/Editable;\n(( java.lang.Object ) v1 ).toString ( ); // invoke-virtual {v1}, Ljava/lang/Object;->toString()Ljava/lang/String;\n(( java.lang.String ) v1 ).trim ( ); // invoke-virtual {v1}, Ljava/lang/String;->trim()Ljava/lang/String;\nfinal String v2 = \"Jack Ma\"; // const-string v2, \"Jack Ma\"\n\n/* .line 41 */\nv0 = (( java.lang.String ) v0 ).equals ( v2 ); // invoke-virtual {v0, v2}, Ljava/lang/String;->equals(Ljava/lang/Object;)Z\n\nif ( v0 != null) { // if-eqz v0, :cond_0\nv0 = /* invoke-direct {p0, v1}, Lcom/example/open_sesame/MainActivity;->n4ut1lus(Ljava/lang/String;)Z */\n}\n\nif ( v0 != null) { // if-eqz v0, :cond_0\n/* .line 42 */\n// Extract digits from 4l1baba?\n/* invoke-direct {p0, v1}, Lcom/example/open_sesame/MainActivity;->sh4dy(Ljava/lang/String;)Ljava/lang/String; */\n/* .line 43 */\n\n\nv0 = /* invoke-direct {p0, v0}, Lcom/example/open_sesame/MainActivity;->sl4y3r(Ljava/lang/String;)I */\n/* .line 45 */\n\n/* new-instance v1, Ljava/lang/StringBuilder; */\nfinal String v2 = \"flag{\"; // const-string v2, \"flag{\"\n/* invoke-direct {v1, v2}, Ljava/lang/StringBuilder;-><init>(Ljava/lang/String;)V */\n\njava.lang.Integer .toString ( v0 );\nfinal String v2 = \"U|]rURuoU^PoR_FDMo@X]uBUg\"; // const-string v2, \"U|]rURuoU^PoR_FDMo@X]uBUg\"\n\n\n/* invoke-direct {p0, v0, v2}, Lcom/example/open_sesame/MainActivity;->flag(Ljava/lang/String;Ljava/lang/String;)Ljava/lang/String; */\n(( java.lang.StringBuilder ) v1 ).append ( v0 ); // invoke-virtual {v1, v0}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;\nfinal String v1 = \"}\"; // const-string v1, \"}\"\n(( java.lang.StringBuilder ) v0 ).append ( v1 ); // invoke-virtual {v0, v1}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;\n(( java.lang.StringBuilder ) v0 ).toString ( ); // invoke-virtual {v0}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;\n} // :cond_0\n\nfinal String v0 = \"Invalid credentials.Please try again.\"; // const-string v0, \"Invalid credentials.Please try again.\"\n/* .line 49 */\n/* invoke-direct {p0, v0}, Lcom/example/open_sesame/MainActivity;->showToast(Ljava/lang/String;)V */\n} // :goto_0\nreturn;\n} // .end method\n/* # virtual methods */\nprotected void onCreate ( android.os.Bundle p0 ) {\n/* .locals 1 */\n/* .line 22 */\n/* invoke-super {p0, p1}, Landroidx/appcompat/app/AppCompatActivity;-><init>(Landroid/os/Bundle;)V */\n/* .line 23 */\n(( com.example.open_sesame.MainActivity ) p0 ).setContentView ( p1 ); // invoke-virtual {p0, p1}, Lcom/example/open_sesame/MainActivity;->setContentView(I)V\n/* .line 25 */\n(( com.example.open_sesame.MainActivity ) p0 ).findViewById ( p1 ); // invoke-virtual {p0, p1}, Lcom/example/open_sesame/MainActivity;->findViewById(I)Landroid/view/View;\n/* check-cast p1, Landroid/widget/EditText; */\nthis.editTextUsername = p1;\n/* .line 26 */\n(( com.example.open_sesame.MainActivity ) p0 ).findViewById ( p1 ); // invoke-virtual {p0, p1}, Lcom/example/open_sesame/MainActivity;->findViewById(I)Landroid/view/View;\n/* check-cast p1, Landroid/widget/EditText; */\nthis.editTextPassword = p1;\n/* .line 27 */\n(( com.example.open_sesame.MainActivity ) p0 ).findViewById ( p1 ); // invoke-virtual {p0, p1}, Lcom/example/open_sesame/MainActivity;->findViewById(I)Landroid/view/View;\n/* check-cast p1, Landroid/widget/Button; */\nthis.buttonLogin = p1;\n/* .line 29 */\n/* new-instance v0, Lcom/example/open_sesame/MainActivity$1; */\n/* invoke-direct {v0, p0}, Lcom/example/open_sesame/MainActivity$1;-><init>(Lcom/example/open_sesame/MainActivity;)V */\n(( android.widget.Button ) p1 ).setOnClickListener ( v0 ); // invoke-virtual {p1, v0}, Landroid/widget/Button;->setOnClickListener(Landroid/view/View$OnClickListener;)V\nreturn;\n} // .end method
\n

Secret Door(Rev)

\n
\n

Sorry to have lost the key of the secret Gate like this… But believe me there is a way if you follow the Right Path..

\n
\n

When I analyzed the ELF file given as the challenge binary with Ghidra, I found that it checks whether it has received a 0x11-character string as a command-line argument.

\n
local_20 = *(long *)(in_FS_OFFSET + 0x28);\nif (param_1 != 2) {\nstd::operator<<((basic_ostream *)std::cout,\"Just try to get the door\");\n/* WARNING: Subroutine does not return */\nexit(0);\n}\n\nsVar2 = strlen(*(char **)(param_2 + 8));\nif (sVar2 != 0x11) {\nstd::operator<<((basic_ostream *)std::cout,\"that\\'s not even a door :p\");\n/* WARNING: Subroutine does not return */\nexit(0);\n}
\n

After passing that check, it then compares against a hardcoded string (SeventeenChars!!!) on the stack, and if it matches, reaches code like the following.

\n
local_f4 = 0;\nstd::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string();\nlocal_68 = 0x42;\nlocal_64 = 0x77;\nlocal_60 = 0x65;\nlocal_5c = 0x71;\nlocal_58 = 0x7b;\nlocal_54 = 0x62;\nlocal_50 = 0x72;\nlocal_4c = 0x7d;\nlocal_48 = 0x77;\nlocal_44 = 0x59;\nlocal_40 = 0x73;\nlocal_3c = 0x7d;\nlocal_38 = 0x6f;\nlocal_34 = 0x6d;\nlocal_30 = 0x3e;\nlocal_2c = 1;\nlocal_28 = 0;\nfor (; local_f4 < 0x11; local_f4 = local_f4 + 1) {\n                /* try { // try from 00102fa1 to 00102fa5 has its CatchHandler @ 00103183 */\n                /* } // end try from 00102fa1 to 00102fa5 */\nstd::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::push_back\n          ((char)local_e8);\n}\nstd::allocator<char>::allocator();\n                /* try { // try from 00102fe0 to 00102fe4 has its CatchHandler @ 00103126 */\n                /* } // end try from 00102fe0 to 00102fe4 */\nstd::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::\nbasic_string<std::allocator<char>>(local_c8,\"ThatsHardcoded!!!\",&local_f5);\nstd::allocator<char>::~allocator((allocator<char> *)local_f5);\n                /* try { // try from 00103005 to 00103009 has its CatchHandler @ 0010316b */\n                /* } // end try from 00103005 to 00103009 */\nstd::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string\n        (local_88);\n                /* try { // try from 0010301e to 00103022 has its CatchHandler @ 00103156 */\n                /* } // end try from 0010301e to 00103022 */\nstd::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string\n        (local_a8);\n                /* try { // try from 00103034 to 00103038 has its CatchHandler @ 0010313e */\n                /* } // end try from 00103034 to 00103038 */\nfunc_5(SUB81(local_a8,0),SUB81(local_88,0));\nstd::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::~basic_string\n        ((basic_string<char,std::char_traits<char>,std::allocator<char>> *)local_a8);\nstd::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::~basic_string\n        ((basic_string<char,std::char_traits<char>,std::allocator<char>> *)local_88);\n                /* try { // try from 00103059 to 001030ed has its CatchHandler @ 0010316b */\nlocal_f0 = (int *)operator.new[](0x44);\npiVar3 = (int *)func_4(local_e8,*(char **)(param_2 + 8));\nlocal_f0 = (int *)func_3(piVar3,(basic_string *)local_c8);\ncVar1 = func_2(local_f0);\nif (cVar1 == '\\0') {\n    func_1(*local_f0,local_f0[0x10]);\n}\nelse {\n    /* } // end try from 00103059 to 001030ed */\n    std::operator<<((basic_ostream *)std::cout,\"Wrong door\");\n}
\n

In func_1, you can see that it reads encoded.bin, which was provided with the challenge, XOR-decrypts it with some key, and then saves it using the hardcoded filename the_door.jpg.

\n
basic_string<std::allocator<char>>(local_448,\"encoded.bin\",local_468);\nstd::allocator<char>::~allocator((allocator<char> *)local_468);\n            /* try { // try from 0010276b to 0010276f has its CatchHandler @ 001029a5 */\n            /* } // end try from 0010276b to 0010276f */\nstd::basic_ifstream<char,std::char_traits<char>>::basic_ifstream\n\n***\n\nfor (local_48c = 0; (int)local_48c < 0x16086; local_48c = local_48c + 1) {\nif ((local_48c & 1) == 0) {\n  pbVar1 = (byte *)std::vector<char,std::allocator<char>>::operator[]\n                             ((vector<char,std::allocator<char>> *)local_468,\n                              (long)(int)local_48c);\n  *pbVar1 = *pbVar1 ^ (byte)param_1;\n}\nelse {\n  pbVar1 = (byte *)std::vector<char,std::allocator<char>>::operator[]\n                             ((vector<char,std::allocator<char>> *)local_468,\n                              (long)(int)local_48c);\n  *pbVar1 = *pbVar1 ^ (byte)param_2;\n}\n}
\n

\n \n \n \n \n \n \n \n \n

\n

Decrypting the file with this key yielded the following image and the flag.

\n

\n \n