{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-greycat-ctf-2023-en","result":{"data":{"markdownRemark":{"id":"ab7dc558-54a9-584e-9968-e92d28fbcb62","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I took part in Greycat CTF, which started on 5/19.

\n

This time our team members’ schedules did not line up, so we participated casually and finished in 131st place.

\n

I’ll keep this write-up brief.

\n\n

Table of Contents

\n\n

Web-Assembly(Rev)

\n
\n

Handwriting assembly code is a bad idea…

\n
\n

The challenge binary was accompanied by the following JavaScript code.

\n

The function wasmModule.instance.exports.check() that validates the flag appears to be implemented in WebAssembly.

\n
const readline = require('readline');\n\nconst rl = readline.createInterface({\n  input: process.stdin,\n  output: process.stdout\n});\n\nrl.question('Gimme something: ', (flag) => {\n    const wasmBinBuf = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 5, 1, 96, 0, 1, 127, 2, 11, 1, 2, 106, 115, 3, 109, 101, 109, 2, 0, 1, 3, 2, 1, 0, 7, 9, 1, 5, 99, 104, 101, 99, 107, 0, 0, 10, 122, 1, 120, 1, 3, 127, 65, 0, 33, 0, 65, 1, 33, 2, 3, 64, 2, 64, 2, 64, 2, 64, 2, 64, 2, 64, 32, 0, 65, 4, 112, 14, 3, 3, 2, 1, 0, 11, 65, 137, 2, 33, 1, 12, 3, 11, 65, 59, 33, 1, 12, 2, 11, 65, 41, 33, 1, 12, 1, 11, 65, 31, 33, 1, 12, 0, 11, 32, 1, 65, 255, 1, 32, 0, 40, 2, 0, 113, 108, 65, 255, 1, 113, 32, 0, 65, 192, 0, 106, 40, 2, 0, 65, 255, 1, 113, 115, 65, 0, 70, 32, 2, 108, 33, 2, 32, 0, 65, 1, 106, 33, 0, 32, 0, 65, 46, 72, 13, 0, 11, 32, 2, 11])\n    const wasmMem = new WebAssembly.Memory({ initial: 10, maximum: 100 });\n    var strBuf = new TextEncoder().encode(flag.slice(0, 64));\n    const memBuf = new Uint8Array(wasmMem.buffer);\n    \n    for (let i = 0; i < strBuf.length; i++) {\n        memBuf[i] = strBuf[i];\n    }\n\n    data = [121, 66, 71, 65, 229, 176, 150, 150, 43, 107, 209, 212, 12, 217, 16, 222, 129, 189, 55, 185, 82, 127, 229, 47, 45, 178, 252, 11, 107, 43, 31, 114, 20, 97, 229, 185, 237, 55, 252, 87, 12, 168, 75, 222, 121, 5]\n\n    for (let i = 0; i < data.length; i++) {\n        memBuf[i + 64] = data[i] \n    }\n\n    WebAssembly.instantiate(wasmBinBuf, {js: {mem: wasmMem}}).then(wasmModule => {\n        result = wasmModule.instance.exports.check();\n        if (result) {\n            console.log(\"Correct flag!\");\n        } else {\n            console.log(\"?\")\n        }\n    });\n    rl.close();\n});
\n

The WebAssembly code to be loaded was defined as the byte array in wasmBinBuf, so I decoded it with CyberChef and saved it as a .wasm file.

\n

Next, I decompiled the obtained wasm file with Ghidra and got the following function.

\n
int export::check(void)\n{\n  uint *puVar1;\n  int iVar2;\n  int iVar3;\n  uint uVar4;\n  \n  puVar1 = (uint *)0x0;\n  iVar3 = 1;\n  do {\n    uVar4 = (uint)puVar1 % 4;\n    if (uVar4 == 0) {\n      iVar2 = 0x1f;\n    }\n    else if (uVar4 == 1) {\n      iVar2 = 0x29;\n    }\n    else if (uVar4 == 2) {\n      iVar2 = 0x3b;\n    }\n    else {\n      iVar2 = 0x109;\n    }\n    iVar3 = (uint)((iVar2 * (*puVar1 & 0xff) & 0xff) == (puVar1[0x10] & 0xff)) * iVar3;\n    puVar1 = (uint *)((int)puVar1 + 1);\n  } while ((int)puVar1 < 0x2e);\n  return iVar3;\n}
\n

Since the byte array used for flag verification was defined as data in JavaScript, I wrote the following solver to recover the flag from it.

\n
base = [121, 66, 71, 65, 229, 176, 150, 150, 43, 107, 209, 212, 12, 217, 16, 222, 129, 189, 55, 185, 82, 127, 229, 47, 45, 178, 252, 11, 107, 43, 31, 114, 20, 97, 229, 185, 237, 55, 252, 87, 12, 168, 75, 222, 121, 5]\nflag = \"\"\n\nfor i,b in enumerate(base):\n    if i % 4 == 0:\n        t = 0x1f\n    elif i % 4 == 1:\n        t = 0x29\n    elif i % 4 == 2:\n        t = 0x3b\n    elif i % 4 == 3:\n        t = 0x109\n    \n    # (t * (x & 0xff) & 0xff) = (b & 0xff)\n    for x in range(0xff):\n        if (t * (x & 0xff) & 0xff) == (b & 0xff):\n            result = x\n    \n    print(chr(result), end=\"\")\n\n    # grey{0bfusc4t10n_u51ng_w3b4s53mbly_1s_4_th1ng}
\n

With this, I was able to obtain the flag.

\n

ReService(Rev)

\n
\n

I found this file that was installed by the virus. Can you find out what it does?

\n

It seems to connect to a c2 server and makes use of the current time.

\n
\n

By manually reconstructing the decompiled Go binary, I found that it appended an 8-character hex string generated by the following logic to the URL and issued a request with http.Get().

\n
package main\n\nimport (\n\t\"fmt\"\n\t\"hash/crc32\"\n\t\"math/rand\"\n\t\"time\"\n)\n\nfunc main() {\n\tnow := time.Now().Unix()\n\trand.Seed(now)\n\thash := crc32.ChecksumIEEE([]byte(fmt.Sprintf(\"%x\", rand.Int())))\n\tresult := fmt.Sprintf(\"%x\", hash)\n\tfmt.Println(result)\n}
\n

I thought I would need to brute-force the time when this file was created, but that wasn’t the case at all; simply looking at the packet stream when the binary was executed revealed the flag immediately.

\n

\n \n \n \n \n \n \n \n \n

\n

The binary analysis turned out to be completely unrelated, and I still was not really sure what the intended challenge was…

","fields":{"slug":"/ctf-greycat-ctf-2023-en","tagSlugs":["/tag/ctf-en/","/tag/rev-en/","/tag/english/"]},"frontmatter":{"date":"2023-05-22","description":"This is the write-up for Greycat CTF 2023.","tags":["CTF (en)","Rev (en)","English"],"title":"Greycat CTF 2023 Write-up","socialImage":{"publicURL":"/static/b73ed478c6587fe55250a438bca7e3b8/ctf-greycat-ctf-2023.png"}}}},"pageContext":{"slug":"/ctf-greycat-ctf-2023-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}