\n\nThis page has been machine-translated from the original page.
\n
I participated in Gracier CTF 2023, which began on November 25, 2023, as part of 0nePadding and placed 150th.
\nI did not have much time during the competition this time, but I will briefly write up the challenges.
\n\n\n\nI heard that RSA with multiple primes is more secure. My N is very large, so there should not be a problem.
\n
The challenge provided the following code and output.txt.
from Crypto.Util.number import bytes_to_long\nfrom Crypto.Util.number import getPrime\n\nPRIME_LENGTH = 24\nNUM_PRIMES = 256\n\nFLAG = b\"gctf{redacted}\"\n\nN = 1\ne = 65537\n\nfor i in range(NUM_PRIMES):\n prime = getPrime(PRIME_LENGTH)\n N *= prime\n\nct = pow(bytes_to_long(FLAG), e, N)\n\nprint(f\"{N=}\")\nprint(f\"{e=}\")\nprint(f\"{ct=}\")N=1184908748889071774788034737775985521200704101703442353533571651469039119038363889871690290631780514392998940707556520304994251661487952739548636064794593979743960985105714178256254882281217858250862223543439960706396290227277478129176832127123978750828494876903409727762030036738239667368905104438928911566884429794089785359693581516505306703816625771477479791983463382338322851370493663626725244651132237909443116453288042969721313548822734328099261670264015661317332067465328436010383015204012585652642998962413149192518150858822735406696105372552184840669950255731733251466001814530877075818908809387881715924209232067963931299295012877100632316050826276879774867425832387424978221636157426227764972761357957047150626791204295493153062565652892972581618176577163744310556692610510074992218502075083140232623713873241177386817247671528165164472947992350655138814891455499972562301161585763970067635688236798480514440398603568227283629452476242623289661524243073929894099518473939222881149459574426407208658860251686137960952889074096311126991477096465624470265619377139983649503903820480974951491378311837933293607705488991162022547957926530402988912221198282579794590930661493745233069145707902854299501706154802038942258911515981663207152069613126155243024789689987554767962281273345273757236723762684230158310314189489269922058062081424352003908442430243686562569467793068370441732743572240164014190275463904986105758545036928880621165599686076511511089276388190078187849622221351011692443859919384379432387437072419707649486293684966456033518855679391672980173280496419686363359529398834403906418139786395934302273747490127295066208248715874656180233559644161531014137838623558729789331274400542717269108353265885948166102045041669627782992845494987948783304254174326130201166965174477449798721151991240203641\ne=65537\nct=268829805459609475588440899873097740407996768854076329496002425282199615879909227647380967635165606878898541606457683227761652305836586321855100255485305118037701500609605019785162541750877335573032359895573772603246111506991979320486028250721513277767642375361127152574528694298160906073442383962020636918610527024050576972769852306021296823499884948279413653216802756618690182635446020844210831886652986287932378470425746444631963933610367607515800649608436183004088441881238148504635598468243968695248287570279766119573944421327504565309861792437849662128566261080923059583840204287527201636471106753069738472306223410300379312983945939043519755909420737707495224846116170095923898104488099329762265149868062693687303917610957104520999978944379566136253252697346935036425206126213766976582551430726756840294537354912787885103742021813054656962241068550049435394355553796824094853195888610994254949530524531633088750916669188277025883371307926545593346345011181011886157628805587723572874545440223921942144548540109099572715194182349314576321627183804149379561322969725485272107142991680959335537127382716195040449341448266408777436145121388591741613272241408064729715121476227737259932422493622000014673154665474739974557976672498027364986075870354093242809763072555932073688776712239151696700128393589329790478951588551070833013708885416360627613835550721939073618725634813608997025047929327270234611128029339388251117036658410438813874667672407000490721438737857471847655487642835059784967516451098631494261100960513521722400650533821661854325599281416744189966724295645707952292786069145361070873245192529272080607536319284389065418040578100669665069777133031446812281199863684982910055858515634879595144557407925298026899908970790756383369461817536923660051327566555421265363733995050644914554395836353253513Reading the provided Python script, we can see that ct in output.txt is the RSA encryption of the flag, where N is the product of 256 24-bit primes.
Although N, the product of 256 primes, is very large, the primes used are only 24 bits, so factoring it is easy.
This time, I simply used a table of primes I found online and took N mod p from the beginning to identify all of the constituent primes.
After successfully factoring it, I struggled a bit with constructing phi.
For multi-prime RSA like this challenge, the Euler totient seems to be defined as follows.
\nSo I backtracked from the string FAIL in Ghidra and found a function that performs the following processing.
In the callback for signal 0xe, 0x15 is raised, and in the callback for signal 0x15, 0x16 is raised.
Now, even though I still did not understand the fine details of the implementation, I could see that the last line compares whether (&DAT_00406220)[local_170] == local_58[local_170].
Tracing accesses to that region back further, we can see that each byte is repeatedly XORed at the following location.
\nThe initial contents of the region from DAT_00406140 onward appear to be empty.
So, although the details were still unclear at this point, I guessed that XORing the flag with some key would produce the byte sequence at DAT_00404050.
To confirm this, I decided to inspect the data that ends up stored in DAT_00406220 after the input is transformed.
Since gdb was not working well, I inspected the contents of DAT_00406220 by rewriting the arguments to the printf function that prints FAIL. (Using Frida might be easier.)
I made the actual patch as follows.
\nWhen I fed the patched program 0x44 bytes of A as input, it printed the byte sequence stored in DAT_00406220 as shown below.
SOP was a very interesting challenge.
It is an easy challenge if you can analyze the binary dynamically, but perhaps because each step is invoked via signals, I could not analyze it well with debuggers such as gdb.
I suspect the intended solution was to continue the dynamic analysis while hooking the signals with something like Frida, so I would like to try that alternative approach as well.
","fields":{"slug":"/ctf-gracier-2023-en","tagSlugs":["/tag/ctf-en/","/tag/rev-en/","/tag/crypto-en/","/tag/english/"]},"frontmatter":{"date":"2023-11-29","description":"This is a writeup for Gracier CTF 2023.","tags":["CTF (en)","Rev (en)","Crypto (en)","English"],"title":"Gracier CTF 2023 Writeup","socialImage":{"publicURL":"/static/3bdb187066373d1ef52b880c8264d733/ctf-gracier-2023.png"}}}},"pageContext":{"slug":"/ctf-gracier-2023-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}