{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-vishwa-ctf-2024-en","result":{"data":{"markdownRemark":{"id":"f78c9f2b-fdd6-5a7d-b486-a3fd3b58c81c","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in VishwaCTF 2024.

\n

There was only one Rev challenge, so I’m writing up that one here. (It was quite tough.)

\n\n

Table of Contents

\n\n

Your Bonus(Rev)

\n
\n

I am very kind, and you’re my friend too. I was about to share some flags with you, but unfortunately, a ransomware attack occurred on the file containing those flags. All the flags got encrypted by the ransomware. After cross-checking the directories, I found the ransomware file and some other related items.

\n

I’m going to share that information with you. However, due to the ransomware, I’m unable to provide you with the flags 😥😥. Now, I need your help to recover those flags. Can you assist me, please? Your cooperation would be highly appreciated, and you will receive a reward for your help.

\n

Note : Ransomware are not meant to be executed as it can harm your systems (although this won’t)

\n
\n

Decompiling the challenge binary reveals that after opening Flags.txt, the following loop is executed:

\n
while( true ) {\n    piVar4 = (int *)std::getline<>(local_1a0,local_1b8);\n    bVar1 = std::basic_ios::operator.cast.to.bool\n                      ((basic_ios *)((int)piVar4 + *(int *)(*piVar4 + -0xc)));\n    if (!bVar1) break;\n    std::__cxx11::basic_string<>::basic_string(local_1b8);\n    std::__cxx11::basic_string<>::basic_string(local_a0);\n    pTextLine = &stack0xfffffe28;\n    devil_function();\n    std::__cxx11::basic_string<>::~basic_string(local_6c);\n    std::__cxx11::basic_string<>::length();\n    pTextLine = &stack0xfffffe28;\n    zarathos(&stack0xfffffe10,(basic_string *)pTextLine);\n    std::__cxx11::basic_string<>::basic_string((basic_string *)&stack0xfffffe28);\n    pTextLine = (char *)local_14;\n    local_24 = Lucifer(local_54,local_14);\n    std::__cxx11::basic_string<>::~basic_string(local_54);\n    ghost_ridders_wepon();\n    pTextLine = (char *)local_14;\n    matter_manipulation[abi:cxx11]((basic_string<> *)&stack0xfffffdf8,local_14);\n    std::__cxx11::basic_string<>::basic_string((basic_string *)&stack0xfffffdf8);\n    Trigon(local_3c);\n    std::__cxx11::basic_string<>::~basic_string((basic_string<> *)local_3c);\n    local_14 = local_14 + 1;\n    std::__cxx11::basic_string<>::~basic_string((basic_string<> *)&stack0xfffffdf8);\n    std::__cxx11::basic_string<>::~basic_string((basic_string<> *)&stack0xfffffe10);\n    std::__cxx11::basic_string<>::~basic_string((basic_string<> *)&stack0xfffffe28);\n}
\n

Inside this loop, after reading each line as a string, the functions devil_function, Lucifer, ghost_ridders_wepon, matter_manipulation, and Trigon are called in sequence to produce the encrypted string that is ultimately written to the file.

\n

devil_function

\n

The first function, devil_function, appears to do nothing, so it can be ignored.

\n

\n \n \n \n \n \n \n \n \n

\n

Getting the string length

\n

The following code block appears to retrieve the length of the string read from the current line:

\n
std::__cxx11::basic_string<>::~basic_string(local_6c);\nstd::__cxx11::basic_string<>::length();\npTextLine = &stack0xfffffe28;
\n

Immediately after basic_string::length() executes, the length of the line’s string is returned in the eax register.

\n

\n \n \n \n \n \n \n \n \n

\n

The retrieved string length is stored on the stack at [esp+0x8], and the edx register holds a pointer to the address where the line’s string obtained from [ebp-0x1D0] is stored.

\n

\n \n \n \n \n \n \n \n \n

\n

This pointer is then placed at [esp+4] on the stack, and finally a pointer to an unknown byte region retrieved from [ebp-0x1E8] (initially undefined) is placed at the top of the stack.

\n

zarathos function

\n

The zarathos function is called with the following values pushed onto the stack:

\n\n

The Ghidra decompiler did not interpret the arguments cleanly, so the analysis below includes minor manual corrections:

\n
/* zarathos(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >&, int)\n    */\n\nundefined * __cdecl zarathos(undefined *param_1,basic_string *param_2,int param_3)\n\n{\n  undefined *puVar1;\n  int iVar2;\n  undefined4 uVar3;\n  undefined4 uVar4;\n  time_t tVar5;\n  char local_2b;\n  char local_2a;\n  char local_29;\n  undefined4 local_28;\n  undefined4 local_24;\n  char local_1d;\n  int local_1c;\n  int local_18;\n  int local_14;\n  int local_10;\n  \n  local_2b = '5';\n  puVar1 = (undefined *)std::map<>::operator[]((map<> *)&_HM,&local_2b);\n  *puVar1 = 0x23;\n  local_10 = 3;\n  local_14 = std::__cxx11::basic_string<>::length();\n  local_14 = local_14 + -1;\n  std::operator+(param_1,param_2,param_2);\n  local_2a = '1';\n  puVar1 = (undefined *)std::map<>::operator[]((map<> *)&_HM,&local_2a);\n  *puVar1 = 0x29;\n  tVar5 = _time((time_t *)0x0);\n  _srand((uint)tVar5);\n  iVar2 = _rand();\n  local_18 = iVar2 % 6 + 3;\n  iVar2 = _rand();\n  local_1c = local_10 + iVar2 % ((local_14 - local_10) + 1);\n  local_29 = '6';\n  puVar1 = (undefined *)std::map<>::operator[]((map<> *)&_HM,&local_29);\n  *puVar1 = 0x28;\n  local_28 = std::__cxx11::basic_string<>::begin();\n  uVar3 = __gnu_cxx::__normal_iterator<>::operator+((__normal_iterator<> *)&local_28,local_1c);\n  uVar4 = std::__cxx11::basic_string<>::begin();\n  std::reverse<>(uVar4,uVar3);\n  uVar3 = std::__cxx11::basic_string<>::end();\n  local_24 = std::__cxx11::basic_string<>::begin();\n  uVar4 = __gnu_cxx::__normal_iterator<>::operator+((__normal_iterator<> *)&local_24,local_1c);\n  std::reverse<>(uVar4,uVar3);\n  uVar3 = std::__cxx11::basic_string<>::end();\n  uVar4 = std::__cxx11::basic_string<>::begin();\n  std::reverse<>(uVar4,uVar3);\n  local_1d = '2';\n  puVar1 = (undefined *)std::map<>::operator[]((map<> *)&_HM,&local_1d);\n  *puVar1 = 0x24;\n  return param_1;\n}
\n

The opening steps copy the received string into an unknown region.

\n

Why the stored string length appears to be extended to 52 characters at this point is unclear.

\n

\n \n \n \n \n \n \n \n \n

\n

The next steps generate values randomly.

\n

After that, what is presumably the 0x36th element of the map has 0x28 stored into it. (The intent of this implementation is also unclear.)

\n

The following steps are comparatively straightforward: a number of characters equal to the randomly generated value are extracted from the beginning of the string held in the map object passed as an argument.

\n

\n \n \n \n \n \n \n \n \n

\n

The subsequent steps reverse the extracted leading portion and prepend it to the original string.

\n

In other words, if 3 characters are taken from ABC....XYZ, the result becomes CBADEFG...XYZ.

\n

\n \n \n \n \n \n \n \n \n

\n

The following steps then reverse the portion that was not extracted (CDEF...XYZ).

\n

\n \n \n \n \n \n \n \n \n

\n

As a result, the string becomes CBAZYX...FED.

\n

\n \n \n \n \n \n \n \n \n

\n

Finally, the entire string is reversed.

\n

After all these operations, the original string has been transformed into DEFG...XYZABC.

\n

\n \n \n \n \n \n \n \n \n

\n

After this function returns, the region at the top of the stack holds a copy of the original string, while the address that originally stored the input now holds the transformed string.

\n

\n \n \n \n \n \n \n \n \n

\n

Lucifer function

\n

The Lucifer function is called immediately after zarathos completes.

\n

It receives the rearranged string from zarathos and the character count as arguments.

\n

\n \n \n \n \n \n \n \n \n

\n

The return value of random_pick(4,0) is unclear, but since it is used as the index in local_3c = local_38[local_10], it is reasonable to assume that local_10 receives a random value between -3 and 3.

\n

The subsequent code retrieves the argument string object, creates an iterator, and implements a loop:

\n
local_14 = param_1;\nlocal_40 = std::__cxx11::basic_string<>::begin();\nlocal_44 = std::__cxx11::basic_string<>::end();\nwhile( true ) {\n    uVar2 = __gnu_cxx::operator!=(&local_40,&local_44);\n    if ((char)uVar2 == '\\0') break;\n    pcVar3 = (char *)__gnu_cxx::__normal_iterator<>::operator*((__normal_iterator<> *)&local_40);\n    local_15 = *pcVar3;\n    local_1c = local_15 + local_3c;\n    adfedd(extraout_ECX,extraout_EDX,local_1c,param_2);\n    __gnu_cxx::__normal_iterator<>::operator++((__normal_iterator<> *)&local_40);\n}
\n

Here, the previously obtained local_3c is added to each character, and then an unknown function called adfedd is invoked.

\n

The decompilation of this function is as follows:

\n
/* adfedd(int, int) */\nvoid __fastcall adfedd(__cxx11 *param_1,undefined4 param_2,undefined4 param_3,undefined4 param_4)\n\n{\n  basic_string local_24 [7];\n  \n  std::__cxx11::to_string(param_1,(basic_string<> *)local_24,param_3);\n  std::__cxx11::basic_string<>::append(local_24);\n  std::__cxx11::basic_string<>::~basic_string((basic_string<> *)local_24);\n  return;\n}
\n

It appears that the first argument (the value of each character plus local_3c) is converted to its decimal representation, and then each digit is appended as a string character.

\n

\n \n \n \n \n \n \n \n \n

\n

This result is temporarily mapped to the previously mysterious region at 0x417148.

\n

\n \n \n \n \n \n \n \n \n

\n

ghostridderswepon function

\n

The next function, ghost_ridders_wepon, was honestly difficult to understand.

\n

It simply creates a map object, stores 0x5e and 0x2a into it, and returns.

\n
/* ghost_ridders_wepon() */\nvoid ghost_ridders_wepon(void)\n{\n  undefined *puVar1;\n  char local_e;\n  char local_d [9];\n  \n  local_e = '4';\n  puVar1 = (undefined *)std::map<>::operator[]((map<> *)&_HM,&local_e);\n  *puVar1 = 0x5e;\n  local_d[0] = '0';\n  puVar1 = (undefined *)std::map<>::operator[]((map<> *)&_HM,local_d);\n  *puVar1 = 0x2a;\n  return;\n}
\n

matter_manipulation function

\n

When this function is called, it returns a pointer to the region containing the encrypted byte sequence.

\n

Since this is what ultimately gets written to the encrypted file, it is highly likely that this function performs the actual encryption.

\n

\n \n \n \n \n \n \n \n \n

\n

It defines a vector table, repeatedly appends strings inside a loop, and then returns a pointer to the region holding those appended strings.

\n

In summary, the value retrieved by pcVar2 = (char *)std::map<>::at(&local_25); is appended to the output string via std::__cxx11::basic_string<>::operator+=(param_1,*pcVar2); to build the final return value.

\n

Since local_25 is an iterator, the input value is processed here.

\n
while( true ) {\n    uVar1 = __gnu_cxx::operator!=(&local_2c,&local_30);\n    if ((char)uVar1 == '\\0') break;\n    pcVar2 = (char *)__gnu_cxx::__normal_iterator<>::operator*((__normal_iterator<> *)&local_2c);\n    local_25 = *pcVar2;\n    local_14 = 0x68;\n    std::vector<>::push_back((vector<> *)local_24,&local_14);\n    local_13 = 0x61;\n    std::vector<>::push_back((vector<> *)local_24,&local_13);\n    pcVar2 = (char *)std::map<>::at(&local_25);\n    std::__cxx11::basic_string<>::operator+=(param_1,*pcVar2);\n    __gnu_cxx::__normal_iterator<>::operator++((__normal_iterator<> *)&local_2c);\n}
\n

At this point, what the iterator is traversing is the string of decimal digit characters produced by the earlier conversion step.

\n

\n \n \n \n \n \n \n \n \n

\n

Although the actual vector table mapping could not be found statically, tracing values through dynamic analysis revealed the following correspondence:

\n\n

This was also confirmed by observing that the string 8485868762636465666768697071727374757677787980818283 was replaced with %^%#%(%!($(@(^(#(((!(%(&!*!)!$!@!^!#!(!!!%!&%*%)%$%@.

\n

Writing the Solver

\n

Based on the analysis so far, the encryption is performed in the following steps:

\n
    \n
  1. Extract a random number of characters from the beginning of the original string, reverse them, and prepend the reversed portion to the original string (e.g., extracting 3 characters from ABC....XYZ yields CBADEFG...XYZ).
    2. \n
  2. Reverse the portion that was not extracted (reversing CDEF...XYZ gives CBAZYX...FED).
    3. \n
  3. Reverse the entire string (resulting in DEFG...XYZABC).
    4. \n
  4. Randomly select one of the values from -3 to 3 (approximately).
    5. \n
  5. For each character in the transformed string, subtract the value from step 4 and convert to decimal, then concatenate each digit as a string (for character D, the digits 6 and 8 would be appended).
    6. \n
  6. Replace each digit in the resulting digit string with the corresponding symbol.
    7. \n
\n

Of the steps above, the number of characters to extract in step 1 and the value selected in step 4 are both set randomly.

\n

However, since both ranges are small enough, brute-forcing is feasible for recovering the flag.

\n

Since brute-forcing the rearrangement step is not strictly necessary, the following solver was written:

\n
table = {'*':'0', ')':'1', '$':'2', '@':'3', '^':'4', '#':'5', '(':'6', '!':'7', '%':'8', '&':'9'}\n\nhacked_texts = r\"\"\"%##^!)@#(!!(!$%)%&%#(!^&%#^(#*##^&^%&)&)%^!)%)!*($($%$(#(%%&%#@^@)^%!)!)((&@##&$###^^*&@\n##@@^&#^&@@%####!$!@!@(#!)&)%#%&!$#^@^^%!*%)&)&@@((@!@@@(%!@(@(@!^%)%&!!%#!!%###($@^\n((!^#!%#()^&#)&@#*%*^&&@(^^&(@(%%@!^%&#(@&&)&)(%^(!&%^!)%)!*%#(@(#%$(%%&%*#*!(#)&$@^(%!^(!#%\n^&&@%#@(#)#*%@%$^(^(%###(%%@!^%&#(@&&)&)!(%$((#*%^!)%)!*(%%&(((%%#!(#)^(()^&##^%%##*%*#*#*%!#)&@#*%*\n!@((!!!(@&@%@&##!$((!#^&###^!#()#%(*(!##^&!$!)%#%@((((%#%&%@!*!)(@!(&@#(&)%&#(#!&)%##^#^($!)#^@^!)!@\n!#%##*%*^&#)&@(^^&(@%@%$!)(%%@!^#&()&@(*%&#(@&&)&)%^!)%)!*%#(@(#%$(%%&#%&@#*%*^&&@%*#*!(#)^(\n%)((%^@&!(!(%^(^%@%&#####*#^&)@%^*@^@(&)##^&^*@(@@@&()(*#%(*!!!!%#!)^&#((@!)!$((@&@%%)!@%#\n@&^&#^^%#^#@#@()(*#%#(!)%)^*@(@@^%&)%&&)(%%#((%&&)%^!)%)!*(#%$(%%&####^%#^^*@(#^^&%@%#!(((@%\n(*()()%&#&&@!!(((%^%@#@@#)!@(!%*!!%)!#(!!!(%!%%#&)!)!!%$&@%$!*!)!((&%)&@#*(@%*!@!@%#^*@((*(*\n%!!*&@&@%!%#@^@#%&&)^(#@%!%#(!!(@%^((&@^@#%!%#(!%^&@@#%!%#@&@@@#%!@)%&@@%!@^&$%@%#%*!*%$(^&)%#@#\n\"\"\"\n\nfor n in range(-3,4):\n    for hacked_text in hacked_texts.split(\"\\n\"):\n        flag = \"\"\n        buf = \"\"\n        for i,word in enumerate(hacked_text):\n            buf += table[word]\n            if i % 2 == 1:\n                flag += chr(int(buf)+n)\n                buf = \"\"\n        if \"CTF\" in flag:\n            print(flag)
\n

Running this produces the following output:

\n
DL;W?35_4R3_B3AFUL[:)]]F0QVISHWACTF[R4N5^$FLE<\nMW4R35_B3AUTIFUL=?_>[:)]]VISHWACTF[<_4R3_R4N50\n)382877?><:IS*&#2][]FWD[]VISHCTF[9928*&83UWND(
\n

The middle line, MW4R35_B3AUTIFUL=?_>[:)]]VISHWACTF[<_4R3_R4N50, appears to match the expected flag format.

\n

Manually rearranging the pieces reveals that VISHWACTF[4R3_R4N50MW4R35_B3AUTIFUL=] is the correct flag.

\n

Summary

\n

That was exhausting. My reverse-engineering skills clearly need more work…

","fields":{"slug":"/ctf-vishwa-ctf-2024-en","tagSlugs":["/tag/rev-en/","/tag/english/"]},"frontmatter":{"date":"2024-03-08","description":"VishwaCTF 2024 Writeup","tags":["Rev (en)","English"],"title":"VishwaCTF 2024 Writeup","socialImage":{"publicURL":"/static/43712c165357eda25cb8c21582fd21f4/ctf-vishwa-ctf-2024.png"}}}},"pageContext":{"slug":"/ctf-vishwa-ctf-2024-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}