{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-dicectf2022-en","result":{"data":{"markdownRemark":{"id":"3523b3a0-83e0-5451-bd5d-ee42462393f7","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in DiceCTF 2022.

\n

I was working on the Rev challenges, but I got stuck on the very first problem and had to retire.

\n

This post is a writeup / review of the challenge.

\n

flagle (Rev)

\n

The challenge was a website with five input forms, where you enter the correct five characters of the Flag for each slot to verify them.

\n

\n \n \n \n \n \n \n \n \n

\n

I managed to identify four of the five slots by reading the WASM by brute force, but the fourth slot involved analyzing obfuscated JavaScript code, and I gave up there.

\n

Here I will work through the full solution, referencing another participant’s writeup.

\n

Decompiling the WASM

\n

I was reading the WASM directly using the browser’s debug tools, but it turns out there is a decompiler available.

\n

Reference: wabt/decompiler.md at main · WebAssembly/wabt

\n

The WASM sections I needed were already solved, but I built wabt and tried decompiling anyway.

\n
wasm-decompile flag-checker.wasm -o decompile.txt
\n

The decompiled output came out quite clean.

\n

(It feels silly that I was reading it raw in the browser…)

\n
export memory memory(initial: 256, max: 256);\n\nglobal g_a:int = 5244000;\nglobal g_b:int = 0;\nglobal g_c:int = 0;\n\nexport table indirect_function_table:funcref(min: 1, max: 1);\n\ndata d_a(offset: 1024) = \"dice{\\00\";\ndata d_b(offset: 1030) = \"\";\n\nimport function env_validate_4(a:int):int;\n\nexport function wasm_call_ctors() {\n  emscripten_stack_init()\n}\n\nexport function a():int {\n  return 1684628325\n}\n\nexport function streq(a:ubyte_ptr, b:ubyte_ptr):int {\n  var c:int;\n  return loop L_a {\n           c = a[0];\n           if (c) goto B_b;\n           if (b[0]) goto B_b;\n           return 1;\n           label B_b:\n           if (c == b[0]) goto B_c;\n           return 0;\n           label B_c:\n           b = b + 1;\n           a = a + 1;\n           continue L_a;\n         }\n}\n\nexport function validate_1(a:int):int {\n  return streq(a, 1024)\n}\n\nfunction validate(a:int, b:int, c:int, d:int, e:int):int {\n  var f:int = g_a - 16;\n  f[15]:byte = a;\n  f[14]:byte = b;\n  f[13]:byte = c;\n  f[12]:byte = d;\n  d = f[14]:ubyte;\n  f[14]:byte = f[13]:ubyte;\n  f[13]:byte = d;\n  d = f[13]:ubyte;\n  f[13]:byte = f[12]:ubyte;\n  f[12]:byte = d;\n  d = f[13]:ubyte;\n  f[13]:byte = f[15]:ubyte;\n  f[15]:byte = d;\n  d = f[13]:ubyte;\n  f[13]:byte = f[12]:ubyte;\n  f[12]:byte = d;\n  d = f[15]:ubyte;\n  f[15]:byte = f[14]:ubyte;\n  f[14]:byte = d;\n  d = 0;\n  if (f[15]:ubyte != 51) goto B_a;\n  if (f[14]:ubyte != 108) goto B_a;\n  if (f[13]:ubyte != 33) goto B_a;\n  d = e == 68 & f[12]:ubyte == 70;\n  label B_a:\n  return d;\n}\n\nexport function validate_3(a:int, b:int, c:int, d:int, e:int):int {\n  var f:int = 0;\n  if (b * a != 4800) goto B_a;\n  if (c + a != 178) goto B_a;\n  if (c + b != 126) goto B_a;\n  if (d * c != 9126) goto B_a;\n  if (d - e != 62) goto B_a;\n  f = c * 4800 - e * d == 367965;\n  label B_a:\n  return f;\n}\n\nexport function validate_5(a:int, b:int, c:int, d:int, e:int):int {\n  var f:int = g_a - 16;\n  f[15]:byte = a;\n  f[14]:byte = b;\n  f[13]:byte = c;\n  f[12]:byte = d;\n  f[15]:byte = f[15]:ubyte + 12;\n  f[14]:byte = f[14]:ubyte + 4;\n  f[13]:byte = f[13]:ubyte + 6;\n  f[12]:byte = f[12]:ubyte + 2;\n  d = 0;\n  if (f[15]:ubyte != 121) goto B_a;\n  if (f[14]:ubyte != 68) goto B_a;\n  if (f[13]:ubyte != 126) goto B_a;\n  d = e == 77 & f[12]:ubyte == 35;\n  label B_a:\n  return d;\n}\n\nexport function validate_6(a:int, b:int, c:int, d:int, e:int):int {\n  var f:int = 0;\n  if ((b + 2933) * (a + 1763) != 5483743) goto B_a;\n  f = e == 125 & (d + 1546) * (c + 3913) == 6431119;\n  label B_a:\n  return f;\n}\n\nexport function guess(a:int, b:int):int {\n  var c:int = g_a - 16;\n  g_a = c;\n  var d:int = 2;\n  if (f_k(b) != 5) goto B_a;\n  if (eqz(streq(b, 1024))) goto B_b;\n  d = a != 1;\n  goto B_a;\n  label B_b:\n  var e:int = b[4]:ubyte;\n  d = b[3]:ubyte;\n  var f:int = b[2]:ubyte;\n  var g:int = b[1]:ubyte;\n  c[11]:byte = b[0]:ubyte;\n  c[10]:byte = g;\n  c[9]:byte = f;\n  c[8]:byte = d;\n  d = c[10]:ubyte;\n  c[10]:byte = c[9]:ubyte;\n  c[9]:byte = d;\n  d = c[9]:ubyte;\n  c[9]:byte = c[8]:ubyte;\n  c[8]:byte = d;\n  d = c[9]:ubyte;\n  c[9]:byte = c[11]:ubyte;\n  c[11]:byte = d;\n  d = c[9]:ubyte;\n  c[9]:byte = c[8]:ubyte;\n  c[8]:byte = d;\n  d = c[11]:ubyte;\n  c[11]:byte = c[10]:ubyte;\n  c[10]:byte = d;\n  if (c[11]:ubyte != 51) goto B_c;\n  if (c[10]:ubyte != 108) goto B_c;\n  if (c[9]:ubyte != 33) goto B_c;\n  d = c[8]:ubyte;\n  if ((e & 255) != 68) goto B_c;\n  if ((d & 255) != 70) goto B_c;\n  d = a != 2;\n  goto B_a;\n  label B_c:\n  f = b[1]:byte;\n  if (f * (d = b[0]:byte) != 4800) goto B_d;\n  g = b[2]:byte;\n  if (g + d != 178) goto B_d;\n  if (g + f != 126) goto B_d;\n  if (g * (d = b[3]:byte) != 9126) goto B_d;\n  if (d - (f = b[4]:byte) != 62) goto B_d;\n  if (g * 4800 - f * d != 367965) goto B_d;\n  d = a != 3;\n  goto B_a;\n  label B_d:\n  if (eqz(env_validate_4(b))) goto B_e;\n  d = a != 4;\n  goto B_a;\n  label B_e:\n  var h:int = b[4]:ubyte;\n  g = b[3]:byte;\n  e = b[2]:byte;\n  f = b[1]:byte;\n  c[15]:byte = (b = b[0]:byte);\n  c[14]:byte = f;\n  c[13]:byte = e;\n  c[12]:byte = g;\n  c[15]:byte = c[15]:ubyte + 12;\n  c[14]:byte = c[14]:ubyte + 4;\n  c[13]:byte = c[13]:ubyte + 6;\n  c[12]:byte = c[12]:ubyte + 2;\n  if (c[15]:ubyte != 121) goto B_f;\n  if (c[14]:ubyte != 68) goto B_f;\n  if (c[13]:ubyte != 126) goto B_f;\n  d = c[12]:ubyte;\n  if ((h & 255) != 77) goto B_f;\n  if ((d & 255) != 35) goto B_f;\n  d = a != 5;\n  goto B_a;\n  label B_f:\n  d = 2;\n  if ((f + 2933) * (b + 1763) != 5483743) goto B_a;\n  if ((h & 255) != 125) goto B_a;\n  if ((g + 1546) * (e + 3913) != 6431119) goto B_a;\n  d = a != 6;\n  label B_a:\n  g_a = c + 16;\n  return d;\n}
\n

The function that receives user input from the web page and performs the check is guess.

\n

Reading through it is relatively straightforward and the Flag falls out fairly directly — I’ll skip a detailed explanation.

\n

Had to solve a system of linear equations for slot 3. First time doing that in a while!

\n

Reading the JavaScript

\n

The fourth slot (which I couldn’t solve during the contest) was validated not by WASM but by the following JavaScript:

\n

This is quite obfuscated code.

\n
function c(b) {\n    var e = {\n        'HLPDd': function (g, h) {\n            return g === h;\n        },\n        'tIDVT': function (g, h) {\n            return g(h);\n        },\n        'QIMdf': function (g, h) {\n            return g - h;\n        },\n        'FIzyt': 'int',\n        'oRXGA': function (g, h) {\n            return g << h;\n        },\n        'AMINk': function (g, h) {\n            return g & h;\n        }\n    }\n        , f = current_guess;\n    try {\n        let g = e['HLPDd'](btoa(e['tIDVT'](intArrayToString, window[b](b[e['QIMdf'](f, 0x26f4 + 0x1014 + -0x3707 * 0x1)], e['FIzyt'])()['toString'](e['oRXGA'](e['AMINk'](f, -0x1a3 * -0x15 + 0x82e * -0x1 + -0x1a2d), 0x124d + -0x1aca + 0x87f))['match'](/.{2}/g)['map'](h => parseInt(h, f * f)))), 'ZGljZQ==') ? -0x1 * 0x1d45 + 0x2110 + -0x3ca : -0x9 * 0x295 + -0x15 * -0x3 + 0x36 * 0x6d;\n    } catch {\n        return 0x1b3c + -0xc9 * 0x2f + -0x19 * -0x63;\n    }\n}
\n

After cleaning up the code, I got to the point of understanding that you need to find the 5-character string b such that when substituted into window[b], the result Base64-encodes to \"dice\". Unfortunately I couldn’t find it.

\n

Looking at the writeup, the approach was to enumerate all 5-character properties of the window object and brute-force them:

\n
Object.getOwnPropertyNames(window).filter(x=> {if (x.length == 5 && x[3] == 'a') console.log(x)})
\n

I had the same general idea, but I was manually checking properties listed in Window - Web API | MDN. That approach was fundamentally wrong — I needed to enumerate the actual runtime properties of the window object.

\n

Reference: Object.getOwnPropertyNames() - JavaScript | MDN

\n

Wrap-up

\n

That was a brief writeup of the challenge.

\n

All the CTFs I’ve participated in since the new year have been high-difficulty, and I haven’t been solving much. Need more practice.

","fields":{"slug":"/ctf-dicectf2022-en","tagSlugs":["/tag/ctf-en/","/tag/reversing-en/","/tag/security-en/","/tag/english/"]},"frontmatter":{"date":"2022-02-07","description":"","tags":["CTF (en)","Reversing (en)","Security (en)","English"],"title":"DiceCTF 2022 Writeup - flagle (Rev)","socialImage":{"publicURL":"/static/f95777d3c567cec07a6ab14ac7074498/ctf-dicectf2022.png"}}}},"pageContext":{"slug":"/ctf-dicectf2022-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}