DownUnder CTF 2021 Writeup

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

#!/usr/bin/env python
#-*- coding:utf-8 -*-
from pwn import *
from urllib.parse import unquote
import base64
import codecs

s = remote('pwn-2021.duc.tf', 31905)

s.sendlineafter(b"Press enter when you are ready to start your 30 seconds timer for the quiz...", b"")
s.sendlineafter(b"Answer this maths question: 1+1=?\n", b"2")

s.recvuntil(b"Decode this hex string and provide me the original number (base 10): ")
msg = s.recvline()[:-1].decode("utf-8")
print(msg)
# s.sendline(str(int(msg,16)))
s.sendline(bytes(str(int(msg,16)), 'utf-8'))

s.recvuntil(b"Decode this hex string and provide me the original ASCII letter: ")
msg = s.recvline()[:-1].decode("utf-8")
print(msg)
s.sendline(bytes(chr(int(msg,16)), 'utf-8'))

s.recvuntil(b"Decode this URL encoded string and provide me the original ASCII symbols: ")
msg = s.recvline()[:-1].decode("utf-8")
print(msg)
s.sendline(bytes(unquote(msg), 'utf-8'))

s.recvuntil(b"Decode this base64 string and provide me the plaintext: ")
msg = s.recvline()[:-1].decode("utf-8")
print(msg)
s.sendline(base64.b64decode(msg))

s.recvuntil(b"Encode this plaintext string and provide me the Base64: ")
msg = s.recvline()[:-1].decode("utf-8")
print(msg)
s.sendline(base64.b64encode(bytes(msg, 'ascii')))

s.recvuntil(b"Decode this rot13 string and provide me the plaintext: ")
msg = s.recvline()[:-1].decode("utf-8")
print(msg)
s.sendline(bytes(codecs.decode(msg, 'rot13'), 'utf-8'))

s.recvuntil(b"Encode this plaintext string and provide me the ROT13 equilavent: ")
msg = s.recvline()[:-1].decode("utf-8")
print(msg)
s.sendline(bytes(codecs.decode(msg, 'rot13'), 'utf-8'))

s.recvuntil(b"Decode this binary string and provide me the original number (base 10): ")
msg = s.recvline()[2:-1].decode("utf-8")
print(msg)
s.sendline(bytes(str(int(msg,2)), 'utf-8'))

s.recvuntil(b"Encode this number and provide me the binary equivalent: ")
msg = s.recvline()[:-1].decode("utf-8")
print(msg)
s.sendline(bytes(bin(int(msg)), 'utf-8'))

s.sendlineafter(b"Final Question, what is the best CTF competition in the universe?", b"DUCTF")

msg = s.recvall()
print(msg.decode("utf-8"))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75

#!/usr/bin/env python
# Usage:
# watch -n 1 "./rabbit_solve.py flag.txt"

import os
from sys import argv
from time import sleep

filename = argv[1]

cmd = "file " + filename
fout = os.popen(cmd)
result = fout.read()
print(result)

if "POSIX tar archive" in result:
    filename2 = filename + ".tar"
    cmd = "mv " + filename + " " + filename2
    fout = os.popen(cmd)
    sleep(1)
    cmd = "tar xvf " + filename2
    fout = os.popen(cmd)
    print(cmd)

if "Zip archive data" in result:
    filename2 = filename + ".zip"
    cmd = "mv " + filename + " " + filename2
    fout = os.popen(cmd)
    sleep(1)
    cmd = "unzip " + filename2
    fout = os.popen(cmd)
    print(cmd)

if "bzip2 compressed data" in result:
    filename2 = filename + ".bz2"
    cmd = "mv " + filename + " " + filename2
    fout = os.popen(cmd)
    sleep(1)
    cmd = "bzip2 -d " + filename2
    print(cmd)
    fout = os.popen(cmd)
    cmd = "touch " + filename2
    fout = os.popen(cmd)

if "gzip compressed data" in result:
    filename2 = filename + ".gz"
    cmd = "mv " + filename + " " + filename2
    fout = os.popen(cmd)
    sleep(1)
    cmd = "gunzip " + filename2
    fout = os.popen(cmd)
    print(cmd)
    cmd = "touch " + filename2
    fout = os.popen(cmd)

if "XZ compressed data" in result:
    filename2 = filename + ".xz"
    cmd = "mv " + filename + " " + filename2
    fout = os.popen(cmd)
    sleep(1)
    cmd = "tar -J -xf " + filename2
    fout = os.popen(cmd)
    print(cmd)

while 1:
    cmd = "ls -l"
    fout = os.popen(cmd)
    result = fout.read()
    print(result)
    if "flag.txt\n" in result:
        break
    sleep(1)

cmd = "rm " + filename2
fout = os.popen(cmd)

1
2
3
4
5
6
7
8

import lzma
:
(snip)
:
  elif s[3:5] == b'XZ':
    with lzma.open('tmp.bin', 'r') as xz:
      with open('flag.txt', 'wb') as f:
        f.write(xz.read())

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

undefined8 main(void)

{
  char local_28 [24];
  long local_10;
  
  local_10 = 0;
  buffer_init();
  puts(
      "\nI\'m developing this new application in C, I\'ve setup some code for the new features but it\'s not (a)live yet."
      );
  puts("\nWhat features would you like to see in my app?");
  gets(local_28);
  if (local_10 == 0xdeadc0de) {
    puts("\n\nMaybe this code isn\'t so dead...");
    system("/bin/sh");
  }
  return 0;
}