{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-irisctf-2024-en","result":{"data":{"markdownRemark":{"id":"f1e9b8bb-c06f-56ef-843a-aa62ed571c1e","html":"
\n

This page has been machine-translated from the original page.

\n
\n

My first CTF of the new year was IrisCTF again, just like last year.

\n

Here is a brief writeup.

\n\n

Table of Contents

\n\n

The Johnson’s(Rev)

\n
\n

Please socialize with the Johnson’s and get off your phone. You might be quizzed on it!

\n
\n

Analyzing the provided ELF challenge binary showed that it was a program that accepted, in order, strings corresponding to Color and Food.

\n

Investigating the check function revealed that it checks which variables store the IDs corresponding to the input Color and Food values, as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

Once I organized that check logic, I found that it was performing the following conditions and equality comparisons.

\n
food[0] == chicken\nfood[2] != pasta\nfood[3] != pasta\nfood[3] != steak\n\ncolor[0] != green\ncolor[1] != red\ncolor[1] != green\ncolor[2] != yellow\ncolor[3] == blue
\n

From this, I was able to determine that the required input order to obtain the flag was as follows.

\n
color[0] == red\ncolor[1] == yellow\ncolor[2] == green\ncolor[3] == blue\n\nfood[0] == chicken\nfood[1] == pasta\nfood[2] == steak\nfood[3] == pizza
\n

Entering the strings in that order produced the correct flag.

\n

\n \n \n \n \n \n \n \n \n

\n

Rune? What’s that?(Rev)

\n
\n

Rune? Like the ancient alphabet?

\n
\n

The challenge provided the following Go script and a mysterious string, iÛÛÜÖ×ÚáäÈÑ¥gebªØšÔž’Íãâ£i¥§²ËÅÒÍÈä.

\n
package main\n\nimport (\n\t\"fmt\"\n\t\"os\"\n\t\"strings\"\n)\n\nvar flag = \"irisctf{this_is_not_the_real_flag}\"\n\nfunc init() {\n\truned := []string{}\n\tz := rune(0)\n\n\tfor _, v := range flag {\n\t\truned = append(runed, string(v+z))\n\t\tz = v\n\t}\n\n\tflag = strings.Join(runed, \"\")\n}\n\nfunc main() {\n\tfile, err := os.OpenFile(\"the\", os.O_RDWR|os.O_CREATE, 0644)\n\tif err != nil {\n\t\tfmt.Println(err)\n\t\treturn\n\t}\n\n\tdefer file.Close()\n\tif _, err := file.Write([]byte(flag)); err != nil {\n\t\tfmt.Println(err)\n\t\treturn\n\t}\n}
\n

Reading the script shows that it transforms the flag string defined in the flag variable and outputs the resulting gibberish string that was given in the challenge.

\n

Looking more closely at the transformation, it simply adds each character to the previous one and displays the result as a Unicode character.

\n

So I used the following script to determine that the correct flag was irisctf{i_r3411y_1ik3_num63r5}.

\n
def decode_string(encoded_string):\n    decoded_chars = []\n    previous_char_unicode = 0\n\n    for char in encoded_string:\n        original_char_unicode = ord(char) - previous_char_unicode\n        original_char = chr(original_char_unicode)\n        decoded_chars.append(original_char)\n        previous_char_unicode = ord(original_char)\n\n    return ''.join(decoded_chars)\n\nencoded_string = r'iÛÛÜÖ×ÚáäÈÑ¥gebªØšÔž’Íãâ£i¥§²ËÅÒÍÈä'\noriginal_string = decode_string(encoded_string)\nprint(original_string)
\n

Secure Computing(Rev)

\n
\n

Your own secure computer can check the flag! Might have forgotten to add the logic to the program, but I think if you guess enough, you can figure it out. Not sure

\n
\n

The challenge provided an ELF binary named chal, the following C code, and a Dockerfile.

\n
// Here's a snippet of the source code for you\nint main() {\n    printf(\"Guess: \");\n    char flag[49+8+1] = {0};\n    if(scanf(\"%57s\", flag) != 1 || strlen(flag) != 57 || strncmp(flag, \"irisctf{\", 8) != 0 || strncmp(flag + 56, \"}\", 1)) {\n        printf(\"Guess harder\\n\");\n        return 0;\n    }\n#define flg(n) *((__uint64_t*)((flag+8))+n)\n    syscall(0x1337, flg(0), flg(1), flg(2), flg(3), flg(4), flg(5));\n    printf(\"Maybe? idk bro\\n\");\n\n    return 0;\n}
\n
FROM ubuntu:latest\n\nRUN apt update && apt install -y gdbserver\n\nCOPY chal /\nCMD /chal
\n

Analyzing the provided binary in Ghidra showed that it seemed to match the C code supplied with the challenge.

\n

It accepts a 57-character input that starts with irisctf{ and ends with }.

\n

Then, via flg(n) as defined by #define flg(n) *((__uint64_t*)((flag+8))+n), characters 8 through 56 of the flag are passed to the syscall function as arguments in 8-character chunks.

\n

\n \n \n \n \n \n \n \n \n

\n

In other words, this program appears to register eight seccomp filters at startup.

\n

It looked like I could extract each filter by pulling out the eight filters individually and using seccomp-tools disasm --no-bpf, but I gave up because I could not determine the end of each one.

\n

So I analyzed the code further in order to obtain output from seccomp-tools dump after all.

\n

It seems that seccomp-tools dump extracts the seccomp filters by running the program and attaching with ptrace.

\n

Looking back at the code above, the line ptrace(PTRACE_TRACEME,0); adds anti-debugging functionality.

\n

In other words, when seccomp-tools uses ptrace, the filter-registration process is skipped, which explains why seccomp-tools dump had failed to output the filters earlier.

\n

So I patched the binary in Ghidra and disabled all of this anti-debugging logic.

\n

\n \n \n \n \n \n \n \n \n

\n

After that, I was able to dump the filters with the seccomp-tools dump command.

\n

The filter output was enormous, so I am only including a portion of it.

\n

In broad terms, it first checks whether the system call ID is 0x1337, then repeatedly performs operations on certain values, and finally compares them against specific values.

\n
$ seccomp-tools dump ./chal_patched\n\nline  CODE  JT   JF      K\n=================================\n 0000: 0x20 0x00 0x00 0x00000000  A = sys_number\n 0001: 0x15 0x01 0x00 0x00001337  if (A == 0x1337) goto 0003\n 0002: 0x06 0x00 0x00 0x7fff0000  return ALLOW\n 0003: 0x03 0x00 0x00 0x0000000b  mem[11] = X\n 0004: 0x04 0x00 0x00 0x9a0b31d4  A += 0x9a0b31d4\n 0005: 0x04 0x00 0x00 0x5245d02a  A += 0x5245d02a\n 0006: 0x1c 0x00 0x00 0x00000000  A -= X\n 0007: 0x04 0x00 0x00 0x7d5a280a  A += 0x7d5a280a\n 0008: 0x1c 0x00 0x00 0x00000000  A -= X\n 0009: 0x24 0x00 0x00 0x000081af  A *= 0x81af\n 0010: 0x03 0x00 0x00 0x00000003  mem[3] = X\n**\n 2692: 0x04 0x00 0x00 0xb06bedbc  A += 0xb06bedbc\n 2693: 0x20 0x00 0x00 0x0000001c  A = args[1] >> 32\n 2694: 0x44 0x00 0x00 0xc7fdf7c2  A |= 0xc7fdf7c2\n 2695: 0x04 0x00 0x00 0x88410078  A += 0x88410078\n**\n 3791: 0x60 0x00 0x00 0x0000000f  A = mem[15]\n 3792: 0x15 0x00 0x01 0xd101957e  if (A != 3506541950) goto 3794\n 3793: 0x06 0x00 0x00 0x00050000  return ERRNO(0)\n 3794: 0x06 0x00 0x00 0x00000000  return KILL
\n

If this check fails, seccomp terminates the thread, and if it succeeds, it appears to return true.

\n

Let’s look at a few of the variables.

\n

First, arg[] appears to be treated as an array variable indexed from 0 to 5.

\n

This likely corresponds to the flag characters passed in syscall(0x1337, flg(0), flg(1), flg(2), flg(3), flg(4), flg(5));, split into 8-character values.

\n

Next, A and X are most likely temporary variables used like registers.

\n

Finally, mem[] is an array variable indexed from 0 to 15.

\n

The final comparisons against hardcoded values are performed on each element of this mem array.

\n

For that reason, I expected that the input flag characters were being transformed somehow and stored in mem.

\n

Judging from the actual processing, it looked like this computation itself could be solved with Z3.

\n

However, I gave up on manually converting nearly 4,000 lines of processing into Z3.

\n

So, using a solver shared on Discord as a reference, I wrote a program that automatically generated Z3 constraints from this output and recovered the flag.

\n

First, use the following command to remove the unnecessary parts from the output of seccomp-tools dump.

\n
seccomp-tools dump ./chal_patched -l 8 | grep -Pv \"=======|CODE\" > seccomp_filter.txt
\n

Next, set up the initial values.

\n

For the arch variable, set the value of AUDIT_ARCH_X86_64.

\n
from z3 import *\n\ns = Solver()\ndef add_cons(v):\n    s.add(And(v > ord(' '), v <= ord('~')))\n\nmem = [0, ]*16\nX = 0\nA = 0\nsys_number = 0x1337\narch = 0xc000003e # AUDIT_ARCH_X86_64\n\n# bpf is 32 bits\nargs = []       # low DWORD\nargs2 = []      # hight DWORDs
\n

In the next part, define six values from 0 to 5 for arg and arg_2.

\n

Then split each of them into 4 bytes and apply Printable ASCII constraints byte by byte.

\n
# args is lower DWORD\nfor x in range(6):\n    v = BitVec(\"arg%d\"%x, 32)\n    args.append(v)\n    add_cons(Extract(7, 0, v))\n    add_cons(Extract(15, 8, v))\n    add_cons(Extract(23, 16, v))\n    add_cons(Extract(31, 24, v))\n\n# args2 is upper DWORD\nfor x in range(6):\n    v = BitVec(\"arg_2%d\"%x, 32)\n    args2.append(v)\n    add_cons(Extract(7, 0, v))\n    add_cons(Extract(15, 8, v))\n    add_cons(Extract(23, 16, v))\n    add_cons(Extract(31, 24, v))
\n

This defines the variables for each argument (= the flag stored in 8-character chunks).

\n

From here, process seccomp_filter.txt line by line.

\n
i = -1\nwith open(\"seccomp_filter.txt\") as fp:\n    for line in fp:\n        i += 1\n\n        # 命令の抽出\n        ins = line.split(\"  \")[1].strip()\n        # print(line)\n        # print(ins)\n\n        # Return 文を無視する\n        if ins.startswith(\"return \"):\n            continue\n\n        # args[0] >> 32 のような演算を特定する\n        # これによって、上位 32 bit 文の文字を取得し、変数名をベクタ名に合わせる\n        elif \" >> \" in ins:\n            ins = ins[:11] # A = args[x]\n            ins = ins.replace(\"args\", \"args2\")\n\n        # if (A == 0x1337) goto 0003 のような if 文の処理を制約に追加する\n        if ins.startswith(\"if (\"):\n            val = ins.split()[3][:-1] # if (A == val)\n            if val.startswith(\"0x\"):\n                val = int(val[2:], 16)\n            else:\n                val = int(val)\n\n            s.add(A == val)\n            continue\n\n        # A ^= X など、そのまま Python コードとして実行可能な行を実行する\n        exec(ins)\n\n        # 32 bit int を維持\n        A &= 0xffffffff
\n

Finally, by solving the constraints with Z3, we can determine that the correct flag string is 1f_0nly_s3cc0mp_c0ulD_us3_4ll_eBPF_1nstruct10ns!.

\n
assert s.check() == sat\nmodel = s.model()\nout = b''\n\n# 各 arg と atg_2 の文字を連結して出力\nfor x in range(len(args)):\n    v = model[args[x]].as_long()\n    out += bytes.fromhex(hex(v)[2:])[::-1]\n    v = model[args2[x]].as_long()\n    out += bytes.fromhex(hex(v)[2:])[::-1]\nprint(out)
\n

The full solver is below.

\n
# seccomp-tools dump ./chal_patched -l 8 > seccomp_filter.txt && sed -i '1,2d' seccomp_filter.txt\nfrom z3 import *\n\ns = Solver()\ndef add_cons(v):\n    s.add(And(v > ord(' '), v <= ord('~')))\n\nmem = [0, ]*16\nX = 0\nA = 0\nsys_number = 0x1337\narch = 0xc000003e # AUDIT_ARCH_X86_64\n\n# bpf is 32 bits\nargs = []       # low DWORD\nargs2 = []      # hight DWORDs\n\n\n# args is lower DWORD\nfor x in range(6):\n    v = BitVec(\"arg%d\"%x, 32)\n    args.append(v)\n    add_cons(Extract(7, 0, v))\n    add_cons(Extract(15, 8, v))\n    add_cons(Extract(23, 16, v))\n    add_cons(Extract(31, 24, v))\n\n# args2 is upper DWORD\nfor x in range(6):\n    v = BitVec(\"arg_2%d\"%x, 32)\n    args2.append(v)\n    add_cons(Extract(7, 0, v))\n    add_cons(Extract(15, 8, v))\n    add_cons(Extract(23, 16, v))\n    add_cons(Extract(31, 24, v))\n\n\ni = -1\nwith open(\"seccomp_filter.txt\") as fp:\n    for line in fp:\n        i += 1\n\n        # 命令の抽出\n        ins = line.split(\"  \")[1].strip()\n        # print(line)\n        # print(ins)\n\n        # Return 文を無視する\n        if ins.startswith(\"return \"):\n            continue\n\n        # args[0] >> 32 のような演算を特定する\n        # これによって、上位 32 bit 文の文字を取得し、変数名をベクタ名に合わせる\n        elif \" >> \" in ins:\n            ins = ins[:11] # A = args[x]\n            ins = ins.replace(\"args\", \"args2\")\n\n        # if (A == 0x1337) goto 0003 のような if 文の処理を制約に追加する\n        if ins.startswith(\"if (\"):\n            val = ins.split()[3][:-1] # if (A == val)\n            if val.startswith(\"0x\"):\n                val = int(val[2:], 16)\n            else:\n                val = int(val)\n\n            s.add(A == val)\n            continue\n\n        # A ^= X など、そのまま Python コードとして実行可能な行を実行する\n        exec(ins)\n\n        # 32 bit int を維持\n        A &= 0xffffffff       \n\nassert s.check() == sat\nmodel = s.model()\nout = b''\n\n# 各 arg と atg_2 の文字を連結して出力\nfor x in range(len(args)):\n    v = model[args[x]].as_long()\n    out += bytes.fromhex(hex(v)[2:])[::-1]\n    v = model[args2[x]].as_long()\n    out += bytes.fromhex(hex(v)[2:])[::-1]\nprint(out)
\n

Not Just Media(Forensic)

\n
\n

I downloaded a video from the internet, but I think I got the wrong subtitles.

\n

Note: The flag is all lowercase.

\n
\n

Analyze the MKV file provided in the challenge with mkvinfo.

\n
$ mkvinfo chal.mkv\n+ EBML head\n|+ EBML version: 1\n|+ EBML read version: 1\n|+ Maximum EBML ID length: 4\n|+ Maximum EBML size length: 8\n|+ Document type: matroska\n|+ Document type version: 4\n|+ Document type read version: 2\n+ Segment: size 25689323\n|+ Seek head (subentries will be skipped)\n|+ EBML void: size 4012\n|+ Segment information\n| + Timestamp scale: 1000000\n| + Multiplexing application: libebml v1.4.4 + libmatroska v1.7.1\n| + Writing application: mkvmerge v80.0 ('Roundabout') 64-bit\n| + Duration: 00:02:11.674000000\n| + Date: 2024-01-05 00:28:38 UTC\n| + Segment UID: 0x0b 0xea 0x43 0x59 0xc7 0xd0 0x77 0xd9 0x8a 0xaf 0x19 0x68 0x93 0x40 0xd7 0xe4\n|+ Tracks\n| + Track\n|  + Track number: 1 (track ID for mkvmerge & mkvextract: 0)\n|  + Track UID: 15645917742896964978\n|  + Track type: video\n|  + \"Lacing\" flag: 0\n|  + Language: und\n|  + Codec ID: V_MPEG4/ISO/AVC\n|  + Codec's private data: size 51 (H.264 profile: High @L3.2)\n|  + Default duration: 00:00:00.016666666 (60.000 frames/fields per second for a video track)\n|  + Language (IETF BCP 47): und\n|  + Video track\n|   + Pixel width: 1280\n|   + Pixel height: 720\n|   + Display width: 1280\n|   + Display height: 720\n| + Track\n|  + Track number: 2 (track ID for mkvmerge & mkvextract: 1)\n|  + Track UID: 516687677308344442\n|  + Track type: audio\n|  + Language: und\n|  + Codec ID: A_AAC\n|  + Codec's private data: size 5\n|  + Default duration: 00:00:00.023219954 (43.066 frames/fields per second for a video track)\n|  + Language (IETF BCP 47): und\n|  + Audio track\n|   + Sampling frequency: 44100\n|   + Channels: 2\n| + Track\n|  + Track number: 3 (track ID for mkvmerge & mkvextract: 2)\n|  + Track UID: 4321065271376252327\n|  + Track type: subtitles\n|  + \"Forced display\" flag: 1\n|  + \"Lacing\" flag: 0\n|  + Language: und\n|  + Codec ID: S_TEXT/ASS\n|  + Codec's private data: size 965\n|  + Language (IETF BCP 47): und\n|+ EBML void: size 1172\n|+ Attachments\n| + Attached\n|  + File name: NotoSansTC-Regular_0.ttf\n|  + MIME type: font/ttf\n|  + File data: size 7110560\n|  + File UID: 13897746459734659379\n|  + File description: Imported font from Untitled.ass\n| + Attached\n|  + File name: FakeFont_0.ttf\n|  + MIME type: font/ttf\n|  + File data: size 64304\n|  + File UID: 13557627962983747543\n|  + File description: Imported font from Untitled.ass\n| + Attached\n|  + File name: NotoSans-Regular_0.ttf\n|  + MIME type: font/ttf\n|  + File data: size 582748\n|  + File UID: 7918181187782517176\n|  + File description: Imported font from Untitled.ass\n|+ Cluster
\n

This shows that, in addition to video and audio, the file contains subtitle settings that display the text 我們歡迎您接受一生中最大的挑戰，即嘗試理解這段文字的含義.

\n

\n \n \n \n \n \n \n \n \n

\n

I used the following script to render the font.

\n
from PIL import Image, ImageDraw, ImageFont\n\nfont_file = './FakeFont_0.ttf'\nfont = ImageFont.truetype(font_file, 40)\n\nimage = Image.new('RGB', (1024, 300), color=(255, 255, 255))\ndraw = ImageDraw.Draw(image)\n\ntext = \"我們歡迎您接受一生中最大的挑戰，即嘗試理解這段文字的含義\"\ndraw.text((10, 10), text, fill=(0, 0, 0), font=font)\n\nimage_path = './flag.png'\nimage.save(image_path)
\n

Where’s skat?(Network)

\n
\n

While traveling over the holidays, I was doing some casual wardriving (as I often do). Can you use my capture to find where I went?

\n

Note: the flag is irisctf{thelocation}, where thelocation is the full name of my destination location, not the street address. For example, irisctf{Washington_Monument}. Note that the flag is not case sensitive.

\n
\n

Analyzing the provided PCAP file shows that it was communicating with access points having the following SSIDs.

\n

\n \n \n \n \n \n \n \n \n

\n

Looking up those access points on Wigle allowed me to identify the coordinates where they existed.

\n

\n \n \n \n \n \n \n \n \n

\n

Checking those coordinates on Google Maps showed that irisctf{Los_Angeles_Union_Station} was the correct flag.

\n

\n \n \n \n \n \n \n \n \n

\n

Summary

\n

It was my first CTF of the new year, but I learned a lot and had a great time.

\n

Lately, I feel like I keep running into eBPF in one way or another, so I need to study the lower layers of Linux more as well.

","fields":{"slug":"/ctf-irisctf-2024-en","tagSlugs":["/tag/rev-en/","/tag/forensic-en/","/tag/english/"]},"frontmatter":{"date":"2024-01-13","description":"Writeup for IrisCTF 2024","tags":["Rev (en)","Forensic (en)","English"],"title":"IrisCTF 2024 Writeup","socialImage":{"publicURL":"/static/8ae0ca03b5f4fd3a39dcc2afedc5a17e/ctf-irisctf-2024.png"}}}},"pageContext":{"slug":"/ctf-irisctf-2024-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}