{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-insomni-ctf-2024-en","result":{"data":{"markdownRemark":{"id":"cb81a8dd-d167-5964-8f4d-002b2e5d98ac","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in Insomni’hack CTF 2024 (January 2024) with team 0nePadding.

\n

We bailed out early and switched to Knight CTF, so we only solved 3 problems — final placement was 120th.

\n

\n \n \n \n \n \n \n \n \n

\n

As the score continues to increase, an encrypted-looking Flag string starts appearing in the console.

\n

\n \n \n \n \n \n \n \n \n

\n

Retrieve the application binary via the Frida server

\n

The official writeup states that the application binary can be retrieved through the Frida server.

\n

Reference: frown/solution at master · leonjza/frown

\n

First, attach to the Frida server using the identified process name: frida -H localhost Gadget.

\n

Then run Process.mainModule to get information about the process’s main module.

\n

\n \n \n \n \n \n \n \n \n

\n

Reference: JavaScript API | A world-class dynamic instrumentation toolkitFrida

\n

From this we determine that the application is located at /usr/local/bin/tetris.

\n

We can then use Frida to attach to the remote process (Gadget) and download a file in its execution context:

\n
node -v #v16.13.1\ncd solution/frida/agent/\nnpm i\npython3 -m solution getfile \"/usr/local/bin/tetris\"
\n

Below is a slightly customized version of the official solver. Calling getfile with a path retrieves the binary Base64-encoded via fs.readFileSync(p).toString('base64'):

\n
import fs from \"fs\";\nimport http from \"http\";\n\nrpc.exports = {\n  dir: (p: string) => fs.readdirSync(p),\n  binpath: () => Process.mainModule.path,\n  getfile: (p: string) => fs.readFileSync(p).toString('base64'),\n  modules: () => Process.enumerateModules(),\n  watchoffset: (a: number) => {\n    const offset = Process.mainModule.base.add(ptr(a));\n    send(`watching func at ${a}. offset=\"${offset}\"`);\n    Interceptor.attach(offset, {\n      onEnter(args) {\n        send(`watchfunc: ${a} called. arg[0]=\"${args[0]}\"`);\n      }\n    });\n  },\n  watchlibs: () => {\n    Interceptor.attach(Module.getExportByName(null, \"dlopen\"), {\n      onEnter(args) {\n        const path = args[0].readUtf8String();\n        const flags = args[1].toInt32();\n        send(`dlopen() path=\"${path}\", flags=\"${flags}\"`);\n      }\n    });\n\n    Interceptor.attach(Module.getExportByName(null, \"dlclose\"), {\n      onEnter(args) {\n        const handle = args[0];\n        send(`dlclose() handle=\"${handle}\"`);\n      }\n    });\n  },\n  blockdlclose: () => {\n    Interceptor.replace(Module.getExportByName(null, \"dlclose\"), new NativeCallback((handle) => {\n      return 0;\n    }, 'int', ['pointer']));\n  },\n  pinscore: () => {\n    const tetris_refresh = Process.mainModule.base.add(0x00002dc8);\n    Interceptor.attach(tetris_refresh, {\n      onEnter(args) {\n        const tetris_t = args[0];\n        const score_t = tetris_t.add(Process.pointerSize * 14);\n        const score_ptr = score_t.add(4 * 4);\n\n        send(`tetris_t=${tetris_t}, score_t=${score_t}, score=${score_ptr.readInt()}`);\n\n        score_ptr.writeInt(9179);\n      }\n    });\n  },\n  flagkey: (key: number) => {\n    const m = Module.load(\"libttyris.so\");\n    const flag_key_ptr = m.getExportByName(\"flag_key\");\n\n    const flag_key = new NativeFunction(flag_key_ptr, 'void', ['int', 'pointer', 'int']);\n    const flag_len = 100;\n    const flag = Memory.alloc(flag_len);\n\n    flag_key(key, flag, flag_len);\n\n    const flag_value = flag.readUtf8String();\n    return flag_value;\n  },\n  watchcurl: () => {\n    const curl_ptr = Process.mainModule.base.add(0x00001d2f);\n\n    Interceptor.attach(curl_ptr, {\n      onEnter(args) {\n        send(`curl->() arg0=\"${args[0].readUtf8String()}\" arg1=${args[1].readUtf8String()}`);\n        this.response = args[2];\n      },\n      onLeave(retval) {\n        send(`curl<-() arg3=\"${this.response.readUtf8String()}\"`);\n      }\n    });\n  },\n  usecurl: (key: number) => {\n    const curl_ptr = Process.mainModule.base.add(0x00001d2f);\n\n    const curl = new NativeFunction(curl_ptr, 'void', ['pointer', 'pointer', 'pointer']);\n    const response = Memory.alloc(100);\n\n    const url = Memory.allocUtf8String(\"http://frown-service/\");\n    const key_ptr = Memory.allocUtf8String(key.toString());\n\n    curl(url, key_ptr, response);\n\n    return response.readUtf8String();\n  },\n  sendkey: (key: number) => {\n    return new Promise((resolve, reject) => {\n      const opts: http.RequestOptions = {\n        hostname: 'frown-service',\n        port: 80,\n        path: '/',\n        method: 'POST',\n        headers: {\n          'Content-Type': 'text/plain',\n          'content-length': key.toString().length\n        }\n      };\n\n      const req = http.request(opts, (res) => {\n        let body = '';\n\n        res.on('data', (chunk) => {\n          body += chunk;\n        });\n\n        res.on('end', () => {\n          resolve(body);\n        });\n      });\n\n      req.on('error', (error) => {\n        reject(error);\n      });\n\n      req.write(key);\n      req.end();\n    });\n  },\n  exec: (c: string) => {\n    const popen_ptr = Module.getExportByName(null, \"popen\");\n    const fgets_ptr = Module.getExportByName(null, \"fgets\");\n    const pclose_ptr = Module.getExportByName(null, \"pclose\");\n\n    const popen = new NativeFunction(popen_ptr, 'pointer', ['pointer', 'pointer']);\n    const fgets = new NativeFunction(fgets_ptr, 'pointer', ['pointer', 'int', 'pointer']);\n    const pclose = new NativeFunction(pclose_ptr, 'int', ['pointer']);\n\n    const command = Memory.allocUtf8String(c);\n    const mode = Memory.allocUtf8String(\"r\");\n    const output_size = Process.pointerSize * 80;\n    const output = Memory.alloc(output_size);\n\n    const pipe = popen(command, mode);\n    fgets(output, output_size, pipe);\n    pclose(pipe);\n\n    return output.readUtf8String();\n  }\n};
\n

Running the downloaded binary lets you play the same Tetris game as on the remote server.

\n

Analyze the binary to retrieve the Flag

\n

Analyzing the downloaded binary in Ghidra revealed that it loads a library called libttyris.so and retrieves the flag_key function.

\n

\n \n \n \n \n \n \n \n \n

\n

At this point the server went down and I couldn’t proceed further, but based on other writeups, downloading libttyris.so in the same way and analyzing it would reveal the hardcoded value needed to identify the correct Flag.

\n

Wrap-up

\n

The challenge server went offline while I was reviewing this, making it feel a bit incomplete, but it did give me strong motivation to learn more about Frida.

","fields":{"slug":"/ctf-insomni-ctf-2024-en","tagSlugs":["/tag/rev-en/","/tag/english/"]},"frontmatter":{"date":"2024-01-26","description":"Insomni'hack CTF 2024 Writeup","tags":["Rev (en)","English"],"title":"Insomni'hack CTF 2024 Writeup","socialImage":{"publicURL":"/static/2add8446c70722fb6fed6a3ec5c11615/ctf-insomni-ctf-2024.png"}}}},"pageContext":{"slug":"/ctf-insomni-ctf-2024-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}