{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-wanictf-2023-en","result":{"data":{"markdownRemark":{"id":"20287bbb-677e-52c8-999c-8afe928f2094","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in WaniCTF 2023 (held starting May 4, 2023) with team 0nePadding.

\n

We solved all Rev and Forensic challenges and finished 39th out of 1110 teams.

\n

\n \n \n \n \n \n \n \n \n

\n

As usual I focused on Reversing and managed to clear everything, so here are writeups for selected problems.

\n\n

Table of Contents

\n\n

javersing (Rev)

\n

Decompiling javersing.jar with jd-gui yields the following:

\n
import java.util.Scanner;\n\npublic class javersing {\n  public static void main(String[] paramArrayOfString) {\n    String str1 = \"Fcn_yDlvaGpj_Logi}eias{iaeAm_s\";\n    boolean bool = true;\n    Scanner scanner = new Scanner(System.in);\n    System.out.println(\"Input password: \");\n    String str2 = scanner.nextLine();\n    str2 = String.format(\"%30s\", new Object[] { str2 }).replace(\" \", \"0\");\n    for (byte b = 0; b < 30; b++) {\n      if (str2.charAt(b * 7 % 30) != str1.charAt(b))\n        bool = false; \n    } \n    if (bool) {\n      System.out.println(\"Correct!\");\n    } else {\n      System.out.println(\"Incorrect...\");\n    } \n  }\n}
\n

Reading this code, it checks whether the character at index b * 7 % 30 of the input matches character b of str1.

\n

So the following solver recovers the Flag by extracting the character of str1 at position b * 7 % 30:

\n
base = \"Fcn_yDlvaGpj_Logi}eias{iaeAm_s\"\nflag = [\"\"] * 30\n\nfor i in range(30):\n    flag[i*7%30] = base[i]\n\nprint(\"\".join(flag))
\n

Lua (Rev)

\n

The challenge source code is written in Lua.

\n

(~1300 lines, so I split it into a Gist.)

\n

Skimming the code, function names, variable names, and values all appeared to be encrypted and embedded in the script.

\n

Reading through it naively seemed painful, so I set a breakpoint around the likely decryption point.

\n

I used a VSCode extension for debugging:

\n
{\n    // Use IntelliSense to learn about possible attributes.\n    // Hover to view descriptions of existing attributes.\n    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387\n    \"version\": \"0.2.0\",\n    \"configurations\": [\n        {\n            \"type\": \"lua\",\n            \"request\": \"launch\",\n            \"name\": \"Debug\",\n            \"program\": \"${workspaceFolder}/CTF/2023/WaniCTF2023/Rev/Lua/main.lua\",\n            \"consoleCoding\": \"utf8\",\n            \"sourceCoding\": \"utf8\",\n            \"luaexe\": \"/usr/bin/lua5.1\",\n            \"outputCapture\": [\n                \"print\",\n                \"stderr\",\n            ],\n        }\n    ]\n}
\n

This challenge code could not be run on Lua 5.2+, so luaexe points to the installed lua5.1.

\n

Setting a breakpoint at the following location in the challenge code yielded a Base64 string containing the decrypted Flag characters:

\n
local CRYPTEDlIIllIII = \"NGI2d3Q8YSp3KmsvYWc9K0c6dw==\"\nlocal CRYPTEDlIIlIIlI = function(a, b)\n  local c = CRYPTEDlIIlIlIl(CRYPTEDlIIlIllI(a))\n  local d = c[\"\\99\\105\\112\\104\\101\\114\"](c, CRYPTEDlIIlIllI(b))\n  return CRYPTEDlIIlIllI(d)\nend
\n

theseus (Rev)

\n

Decompiling with Ghidra revealed that the Flag string is embedded in a region called compare, which is then verified against user input via a compare function.

\n

Setting a breakpoint at the compare function was enough to retrieve the Flag.

\n

web_assembly (Rev)

\n

This was a WebAssembly challenge.

\n

I started by decompiling the downloaded WASM binary with wasm-decompile:

\n
./wasm-decompile index.wasm -o decompile.txt
\n

Looking at the output, there is a data section containing what appear to be split Flag fragments:

\n
data d_3rinfinityFebruaryJanuaryJul(offset: 65536) =\n  \"3r!}\\00infinity\\00February\\00January\\00July\\00Thursday\\00Tuesday\\00Wed\"\n  \"nesday\\00Saturday\\00Sunday\\00Monday\\00Friday\\00May\\00%m/%d/%y\\004n_3x\\00\"\n  \"-+   0X0x\\00-0X+0X 0X-0x+0x 0x\\00Nov\\00Thu\\00unsupported locale for st\"\n  \"andard input\\00August\\00Oct\\00Sat\\000us\\00Apr\\00vector\\00October\\00Nov\"\n  \"ember\\00September\\00December\\00ios_base::clear\\00Mar\\00p_0n_Br\\00Sep\\00\"\n  \"3cut3_Cp\\00%I:%M:%S %p\\00Sun\\00Jun\\00Mon\\00nan\\00Jan\\00Jul\\00ll\\00Apri\"\n  \"l\\00Fri\\00March\\00Aug\\00basic_string\\00inf\\00%.0Lf\\00%Lf\\00true\\00Tue\\00\"\n  \"false\\00June\\00Wed\\00Dec\\00Feb\\00Fla\\00ckwajea\\00%a %b %d %H:%M:%S %Y\\00\"\n  \"POSIX\\00%H:%M:%S\\00NAN\\00PM\\00AM\\00LC_ALL\\00LANG\\00INF\\00g{Y0u_C\\00012\"\n  \"3456789\\00C.UTF-8\\00.\\00(null)\\00Incorrect!\\00Pure virtual function ca\"\n  \"lled!\\00Correct!! Flag is here!!\\00feag5gwea1411_efae!!\\00libc++abi: \\00\"\n  \"Your UserName : \\00Your PassWord : \\00\\00\\00\\00\\00\\00L\\04\\01\\00\\02\\00\\00\"
\n

I could make a reasonable guess from this data alone, but in the end I used Chrome’s debug tools to trace the execution flow when the correct password is entered.

\n

First, I identified that the code following $env.prompt_pass in func13 is the post-password-entry processing:

\n

\n \n \n \n \n \n \n \n \n

\n

This type of traffic corresponds to USB Keystrokes as described in HackTricks:

\n

Reference: USB Keystrokes - HackTricks

\n

To extract the keystrokes, I ran:

\n
# Extract usb.capdata\ntshark -r ./chall.pcap -Y 'usb.capdata && usb.data_len == 8' -T fields -e usb.capdata | sed 's/../:&/g2' > keystrokes.txt\n\n# Parse keystrokes from keystrokes.txt\npython3 solver.py ./keystrokes.txt
\n

This yielded FLAG{Big_br0ther_is_watching_y0ur_keyboard⌫⌫⌫⌫0ard}.

\n

Since there were Backspace characters mid-stream, the actual input was FLAG{Big_br0ther_is_watching_y0ur_keyb0ard}.

\n

The solver.py used:

\n
#!/usr/bin/python\n# -*- coding: utf-8 -*-\n\nimport sys\n\n#More symbols in https://www.fileformat.info/search/google.htm?q=capslock+symbol&domains=www.fileformat.info&sitesearch=www.fileformat.info&client=pub-6975096118196151&forid=1&channel=1657057343&ie=UTF-8&oe=UTF-8&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A11&hl=en\nKEY_CODES = {\n    0x04:['a', 'A'],\n    0x05:['b', 'B'],\n    0x06:['c', 'C'],\n    0x07:['d', 'D'],\n    0x08:['e', 'E'],\n    0x09:['f', 'F'],\n    0x0A:['g', 'G'],\n    0x0B:['h', 'H'],\n    0x0C:['i', 'I'],\n    0x0D:['j', 'J'],\n    0x0E:['k', 'K'],\n    0x0F:['l', 'L'],\n    0x10:['m', 'M'],\n    0x11:['n', 'N'],\n    0x12:['o', 'O'],\n    0x13:['p', 'P'],\n    0x14:['q', 'Q'],\n    0x15:['r', 'R'],\n    0x16:['s', 'S'],\n    0x17:['t', 'T'],\n    0x18:['u', 'U'],\n    0x19:['v', 'V'],\n    0x1A:['w', 'W'],\n    0x1B:['x', 'X'],\n    0x1C:['y', 'Y'],\n    0x1D:['z', 'Z'],\n    0x1E:['1', '!'],\n    0x1F:['2', '@'],\n    0x20:['3', '#'],\n    0x21:['4', '$'],\n    0x22:['5', '%'],\n    0x23:['6', '^'],\n    0x24:['7', '&'],\n    0x25:['8', '*'],\n    0x26:['9', '('],\n    0x27:['0', ')'],\n    0x28:['\\n','\\n'],\n    0x29:['␛','␛'],\n    0x2a:['⌫', '⌫'],\n    0x2b:['\\t','\\t'],\n    0x2C:[' ', ' '],\n    0x2D:['-', '_'],\n    0x2E:['=', '+'],\n    0x2F:['[', '{'],\n    0x30:[']', '}'],\n    0x32:['#','~'],\n    0x33:[';', ':'],\n    0x34:['\\'', '\"'],\n    0x36:[',', '<'],\n    0x37:['.', '>'],\n    0x38:['/', '?'],\n    0x39:['⇪','⇪'],\n    0x4f:[u'→',u'→'],\n    0x50:[u'←',u'←'],\n    0x51:[u'↓',u'↓'],\n    0x52:[u'↑',u'↑']\n}\n\n\n#tshark -r ./usb.pcap -Y 'usb.capdata && usb.data_len == 8' -T fields -e usb.capdata | sed 's/../:&/g2' > keyboards.txt\ndef read_use(file):\n    with open(file, 'r') as f:\n        datas = f.readlines()\n    \n    datas = [d.strip() for d in datas if d] \n    cursor_x = 0\n    cursor_y = 0\n    lines = []\n    output = ''\n    skip_next = False\n    lines.append(\"\")\n    \n    for data in datas:\n        shift = int(data.split(':')[0], 16) # 0x2 is left shift 0x20 is right shift\n        key = int(data.split(':')[2], 16)\n\n        if skip_next:\n            skip_next = False\n            continue\n        \n        if key == 0 or int(data.split(':')[3], 16) > 0:\n            continue\n        \n        #If you don't like output get a more verbose output here (maybe you need to map new rekeys or remap some of them)\n        if not key in KEY_CODES:\n            #print(\"Not found: \"+str(key))\n            continue\n        \n        if shift != 0:\n            shift=1\n            skip_next = True\n\n        if KEY_CODES[key][shift] == u'↑':\n            lines[cursor_y] += output\n            output = ''\n            cursor_y -= 1\n        \n        elif KEY_CODES[key][shift] == u'↓':\n            lines[cursor_y] += output\n            output = ''\n            cursor_y += 1\n\n        elif KEY_CODES[key][shift] == u'→':\n            cursor_x += 1\n\n        elif KEY_CODES[key][shift] == u'←':\n            cursor_x -= 1\n\n        elif KEY_CODES[key][shift] == '\\n':\n            lines.append(\"\")\n            lines[cursor_y] += output\n            cursor_x = 0\n            cursor_y += 1\n            output = ''\n\n        elif KEY_CODES[key][shift] == '[BACKSPACE]':\n            output = output[:cursor_x-1] + output[cursor_x:]\n            cursor_x -= 1\n        \n        else:\n            output = output[:cursor_x] + KEY_CODES[key][shift] + output[cursor_x:]\n            cursor_x += 1\n    \n    if lines == [\"\"]:\n        lines[0] = output\n    \n    if output != '' and output not in lines:\n        lines[cursor_y] += output\n    \n    return '\\n'.join(lines)\n\nif __name__ == '__main__':\n    if len(sys.argv) < 2:\n        print('Missing file to read...')\n        exit(-1)\n    sys.stdout.write(read_use(sys.argv[1]))
\n

web-64bps (Web)

\n

Haven’t touched Web challenges in a while!

\n

The challenge server is configured with the following Dockerfile and nginx.conf:

\n
FROM nginx:1.23.3-alpine-slim\n\nCOPY nginx.conf /etc/nginx/nginx.conf\nCOPY flag.txt /usr/share/nginx/html/flag.txt\n\nRUN cd /usr/share/nginx/html && \\\n    dd if=/dev/random of=2gb.txt bs=1M count=2048 && \\\n    cat flag.txt >> 2gb.txt && \\\n    rm flag.txt
\n
user  nginx;\nworker_processes  auto;\n\nerror_log  /var/log/nginx/error.log notice;\npid        /var/run/nginx.pid;\n\n\nevents {\n    worker_connections  1024;\n}\n\n\nhttp {\n    include       /etc/nginx/mime.types;\n    default_type  application/octet-stream;\n\n    keepalive_timeout  65;\n    gzip               off;\n    limit_rate         8; # 8 bytes/s = 64 bps\n\n    server {\n        listen       80;\n        listen  [::]:80;\n        server_name  localhost;\n\n        location / {\n            root   /usr/share/nginx/html;\n            index  index.html index.htm;\n        }\n    }\n}
\n

The Flag text is appended to the end of a 2 GB random binary file, and Nginx’s limit_rate is set extremely low, making it practically impossible to download the full file.

\n

The solution is to use HTTP Range requests (specifying Content-Range and Content-Length) to fetch only the bytes at a specific offset.

\n

Reference: python - read file from server with some offset - Stack Overflow

\n

This type of request can also be issued with curl’s -r option.

\n

In this case, fetching roughly 200 bytes from offset 2147483603 to 2147483793 yielded the Flag:

\n
curl -r 2147483603-2147483793 \"https://64bps-web.wanictf.org/2gb.txt\" -o flag.txt
\n

Wrap-up

\n

We were on pace to break the top 10 early on, but ran out of solvable problems mid-contest and stalled.

\n

The competitive-programming-style Misc challenges were beyond my implementation speed, which was frustrating.

\n

Maybe I should get back into competitive programming…

","fields":{"slug":"/ctf-wanictf-2023-en","tagSlugs":["/tag/ctf-en/","/tag/rev-en/","/tag/forensic-en/","/tag/web-en/","/tag/english/"]},"frontmatter":{"date":"2023-05-06","description":"WaniCTF 2023 Writeup","tags":["CTF (en)","Rev (en)","Forensic (en)","Web (en)","English"],"title":"WaniCTF 2023 Writeup","socialImage":{"publicURL":"/static/cfb330dbf4cc573a235a16bb60c04814/ctf-wanictf-2023.png"}}}},"pageContext":{"slug":"/ctf-wanictf-2023-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}