LoginSignup
0
0

More than 3 years have passed since last update.

@housu_jp

picoCTF Practice Writeup 3

Last updated at Posted at 2021-04-14

picoCTF Practice Writeup 3
picoGym Practice Challenges page=3 の11問を勉強した記録

このページの難問は，
626 solves の New Caesar （Cryptographyというよりpython力を問う問題）
362 solves の ARMssembly 1　（ARM Assembly）

特に
126 solves の Cache Me Outside　はお手上げ。なので11問だけ掲載。

Warmed Up

Category: General Skills
Description:
What is 0x3D (base 16) in decimal (base 10)?
Hints:
1. Submit your answer in our flag format. For example, if your answer was '22', you would submit 'picoCTF{22}' as the flag.

Solution:
計算するだけ

The Numbers

Category: Cryptography
Description:
The numbers... what do they mean?
Hints:
1. The flag is in the format PICOCTF{}
image.png

Solution:

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
1 2 3 4 5 6 7 8 9 1011121314151617181920212223242526
PICOCTF{THENUMBERSMASON}

2Warm

Category: General Skills
Description:
Can you convert the number 42 (base 10) to binary (base 2)?
Hints:
Submit your answer in our competition's flag format. For example, if your answer was '11111', you would submit 'picoCTF{11111}' as the flag.

Solution:
計算するだけ

Wireshark doo dooo do doo...

Category: Forensics
Description:
Can you find the flag? shark1.pcapng.
Hints:
(None)

Solution:
プロトコル階層
image.png
Line-based text data が目立つ
image.png
ROT13ビンゴ

speeds and feeds

Category: Reverse Engineering
Description:
There is something on my shop network running at nc mercury.picoctf.net 59953, but I can't tell what it is. Can you?
Hints:
What language does a CNC machine use?

Solution:
工作機械の言語なんて初めて見ました。

image.png
CNCにはGコードだけでなくMコード，Sコード，Tコード，Fコードとかもあるみたいです。

Shop

Category: Reverse Engineering
Description:
Best Stuff - Cheap Stuff, Buy Buy Buy... Store Instance: source. The shop is open for business at nc mercury.picoctf.net 42159.
Hints:
1. Always check edge cases when programming

$ nc mercury.picoctf.net 42159
Welcome to the market!
=====================
You have 40 coins
        Item            Price   Count
(0) Quiet Quiches       10      12
(1) Average Apple       15      8
(2) Fruitful Flag       100     1
(3) Sell an Item
(4) Exit
Choose an option:

Solution:
Fruitful Flagは100円だが40円しか持っていない。
Quiet Quichesを-100個買うと，お金が1000円増える。
残高 = 残高 - ( 10 * -100 )
Fruitful Flagを買う

$ nc mercury.picoctf.net 42159
Welcome to the market!
=====================
You have 40 coins
        Item            Price   Count
(0) Quiet Quiches       10      12
(1) Average Apple       15      8
(2) Fruitful Flag       100     1
(3) Sell an Item
(4) Exit
Choose an option:
0
How many do you want to buy?
-100
You have 1040 coins
        Item            Price   Count
(0) Quiet Quiches       10      112
(1) Average Apple       15      8
(2) Fruitful Flag       100     1
(3) Sell an Item
(4) Exit
Choose an option:
2
How many do you want to buy?
1
Flag is:  [112 105 99 111 67 84 70 123 98 52 100 95 98 114 111 103 114 97 109 109 101 114 95 55 57 55 98 50 57 50 99 125]

Scavenger Hunt

Category: Web Exploitation
Description:
There is some interesting information hidden around this site http://mercury.picoctf.net:39491/. Can you find it?
Hints:
You should have enough hints to find the files, don't run a brute forcer.
image.png

Solution:
ソース
image.png

CSS
image.png
image.png

js
image.png
image.png

ヒントだけ
How can I keep Google from indexing my website?

robots.txt
image.png

次のヒント
I think this is an apache server... can you Access the next flag?

apache独自といえば
image.png

次のヒント
I love making websites on my Mac, I can Store a lot of information there.

Macで編集した時に残るのは？　自動バックアップか
.DocumentRevisions-V100
image.png
だめ

.DS_Store
image.png
ビンゴ

MacroHard WeakEdge

Category: Forensics
Description:
I've hidden a flag in this file. Can you find it? Forensics is fun.pptm
Hints
(None)

Solution:
pptm = PowerPoint マクロ有効プレゼンテーション

常とう手段，拡張子をzipに変える
image.png
hiddenなる怪しいファイル発見
ビンゴ

New Caesar

良問です。
picoCTF 2021 New Caesar Writeup

ARMssembly 1

Category: Reverse Engineering
Description:
For what argument does this program print win with variables 79, 7 and 3? File: chall_1.S Flag format: picoCTF{XXXXXXXX} -> (hex, lowercase, no 0x, and 32 bits. ex. 5614267 would be picoCTF{0055aabb})
Hints:
Shifts

    .arch armv8-a
    .file   "chall_1.c"
    .text
    .align  2
    .global func
    .type   func, %function
func:
    sub sp, sp, #32
    str w0, [sp, 12]
    mov w0, 79
    str w0, [sp, 16]
    mov w0, 7
    str w0, [sp, 20]
    mov w0, 3
    str w0, [sp, 24]
    ldr w0, [sp, 20]
    ldr w1, [sp, 16]
    lsl w0, w1, w0
    str w0, [sp, 28]
    ldr w1, [sp, 28]
    ldr w0, [sp, 24]
    sdiv    w0, w1, w0
    str w0, [sp, 28]
    ldr w1, [sp, 28]
    ldr w0, [sp, 12]
    sub w0, w1, w0
    str w0, [sp, 28]
    ldr w0, [sp, 28]
    add sp, sp, 32
    ret
    .size   func, .-func
    .section    .rodata
    .align  3
.LC0:
    .string "You win!"
    .align  3
.LC1:
    .string "You Lose :("
    .text
    .align  2
    .global main
    .type   main, %function
main:
    stp x29, x30, [sp, -48]!
    add x29, sp, 0
    str w0, [x29, 28]
    str x1, [x29, 16]
    ldr x0, [x29, 16]
    add x0, x0, 8
    ldr x0, [x0]
    bl  atoi
    str w0, [x29, 44]
    ldr w0, [x29, 44]
    bl  func
    cmp w0, 0
    bne .L4
    adrp    x0, .LC0
    add x0, x0, :lo12:.LC0
    bl  puts
    b   .L6
.L4:
    adrp    x0, .LC1
    add x0, x0, :lo12:.LC1
    bl  puts
.L6:
    nop
    ldp x29, x30, [sp], 48
    ret
    .size   main, .-main
    .ident  "GCC: (Ubuntu/Linaro 7.5.0-3ubuntu1~18.04) 7.5.0"
    .section    .note.GNU-stack,"",@progbits

Solution:
まず，問題から
第1引数 79
第2引数 7
第3引数 3
の情報が与えられている。

lsl と sdiv が目にとまる

重要な部分だけ解説すると

    mov w0, 79     
    str w0, [sp, 16]  # sp+16に 79 が保存される

    mov w0, 7
    str w0, [sp, 20]  # sp+20に 7 が保存される

    mov w0, 3
    str w0, [sp, 24]  # sp+24に 3 が保存される

    ldr w0, [sp, 20]
    ldr w1, [sp, 16]
    lsl w0, w1, w0    # wo(10112) = w1(79) << w0(7)
    str w0, [sp, 28]  # sp+28に 10112 が保存される

    ldr w1, [sp, 28]
    ldr w0, [sp, 24]
    sdiv    w0, w1, w0    # w0 = w1(10112) / w0(3)

( 79 << 7 ) / 3 = 3370 = 0xd2a
picoCTF{00000d2a}

Some Assembly Required 1

Category: Web Exploitation
Description:
http://mercury.picoctf.net:26318/index.html
Hints:
(None)

Solution:
ページのソース

<html>
<head>
    <meta charset="UTF-8">
    <script src="G82XCw5CX3.js"></script>
</head>
<body>
    <h4>Enter flag:</h4>
    <input type="text" id="input"/>
    <button onclick="onButtonPress()">Submit</button>
    <p id="result"></p>
</body>
</html>

javascryptを見てみる

G82XCw5CX3.js
const _0x402c = ['value', '2wfTpTR', 'instantiate', '275341bEPcme', 'innerHTML', '1195047NznhZg', '1qfevql', 'input', '1699808QuoWhA', 'Correct!', 'check_flag', 'Incorrect!', './JIFxzHyW8W', '23SMpAuA', '802698XOMSrr', 'charCodeAt', '474547vVoGDO', 'getElementById', 'instance', 'copy_char', '43591XxcWUl', '504454llVtzW', 'arrayBuffer', '2NIQmVj', 'result'];
const _0x4e0e = function (_0x553839, _0x53c021) {
  _0x553839 = _0x553839 - 0x1d6;
  let _0x402c6f = _0x402c[_0x553839];
  return _0x402c6f;
};
(function (_0x76dd13, _0x3dfcae) {
  const _0x371ac6 = _0x4e0e;
  while (!![]) {
    try {
      const _0x478583 = -parseInt(_0x371ac6(0x1eb)) + parseInt(_0x371ac6(0x1ed)) + -parseInt(_0x371ac6(0x1db)) * -parseInt(_0x371ac6(0x1d9)) + -parseInt(_0x371ac6(0x1e2)) * -parseInt(_0x371ac6(0x1e3)) + -parseInt(_0x371ac6(0x1de)) * parseInt(_0x371ac6(0x1e0)) + parseInt(_0x371ac6(0x1d8)) * parseInt(_0x371ac6(0x1ea)) + -parseInt(_0x371ac6(0x1e5));
      if (_0x478583 === _0x3dfcae) break;
      else _0x76dd13['push'](_0x76dd13['shift']());
    } catch (_0x41d31a) {
      _0x76dd13['push'](_0x76dd13['shift']());
    }
  }
}(_0x402c, 0x994c3));
let exports;
(async() => {
  const _0x48c3be = _0x4e0e;
  let _0x5f0229 = await fetch(_0x48c3be(0x1e9)),
    _0x1d99e9 = await WebAssembly[_0x48c3be(0x1df)](await _0x5f0229[_0x48c3be(0x1da)]()),
    _0x1f8628 = _0x1d99e9[_0x48c3be(0x1d6)];
  exports = _0x1f8628['exports'];
})();

function onButtonPress() {
  const _0xa80748 = _0x4e0e;
  let _0x3761f8 = document['getElementById'](_0xa80748(0x1e4))[_0xa80748(0x1dd)];
  for (let _0x16c626 = 0x0; _0x16c626 < _0x3761f8['length']; _0x16c626++) {
    exports[_0xa80748(0x1d7)](_0x3761f8[_0xa80748(0x1ec)](_0x16c626), _0x16c626);
  }
  exports['copy_char'](0x0, _0x3761f8['length']), exports[_0xa80748(0x1e7)]() == 0x1 ? document[_0xa80748(0x1ee)](_0xa80748(0x1dc))[_0xa80748(0x1e1)] = _0xa80748(0x1e6) : document[_0xa80748(0x1ee)](_0xa80748(0x1dc))[_0xa80748(0x1e1)] = _0xa80748(0x1e8);
}

WebAssemblyって何だ？

「wasm ファイルを取得、ロード、実行するため先述した WebAssembly JavaScript API を呼び出すロジックも含んでいます。」とか書かれています。

デベロッパーツールで見ていると

image.png

wasmを見つけることができます。

image.png

よくわからないけどフラグ見えた。（ESP？）

0
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
Sign upLogin
0
0