diff options
| -rw-r--r-- | docs/writeups/2023/lactf/rev/ctfd-plus.txt | 125 |
1 files changed, 125 insertions, 0 deletions
diff --git a/docs/writeups/2023/lactf/rev/ctfd-plus.txt b/docs/writeups/2023/lactf/rev/ctfd-plus.txt new file mode 100644 index 0000000..cf8df62 --- /dev/null +++ b/docs/writeups/2023/lactf/rev/ctfd-plus.txt @@ -0,0 +1,125 @@ +CTFd is too insufferably slow. You know why? Because they use an SQL database +that's bogged down by JOINs instead of a web scale database like MongoDB. +MongoDB is web scale. You turn it on and it scales right up. You know what's +more web scale though? Nothing. That's right, the throughput of /dev/null is +off the charts. Behold, CTFd+, the first databaseless CTF platform. Can you +get the flag for the only challenge? + + + + +RE +-- +We are given a binary that presents a welcome message along with a dummy PWN +challenge, then asks for the flag for said challenge. As this is a mock CTF +platform, it is a flag checker RE challenge. The content of the embedded PWN +is not relevant: the program just calls `puts` then exits. + +Ghidra shows that the flag we supply is validated character by character +against the result of some computation performed on a static array of data. +(Some markup provided by me). + +``` +undefined8 main(void) +{ + int flag_check_char; + size_t flag_in_len; + long idx; + int *static_data; + char flag_in [256]; + + puts("Welcome to CTFd+!"); + puts( + "So far, we only have one challenge, which is one more than the number of databases we have.\n " + ); + puts("Very Doable Pwn - 500 points, 0 solves"); + puts("Can you help me pwn this program?"); + puts("#include <stdio.h>\nint main(void) {\n puts(\"Bye!\");\n return 0;\n}\n"); + puts("Enter the flag:"); + fgets(flag_in,0x100,stdin); + flag_in_len = strcspn(flag_in,"\n"); + idx = 0; + static_data = INT_ARRAY_00104060; + flag_in[flag_in_len] = '\0'; + do { + flag_check_char = flag_gen(static_data[idx]); + if ((char)flag_check_char != flag_in[idx]) { + puts("Incorrect flag."); + return 0; + } + idx = idx + 1; + } while (idx != 0x2f); + puts("You got the flag! Unfortunately we don\'t exactly have a database to store the solve in...") + ; + return 0; +} +``` + +If at any point in the validation a character fails, the whole flag is +considered incorrect. + + + + +Solution +-------- +To extract the expected flag, I ported the static data and the `flag_gen` +computation logic to a standalone C program and simply print out the value of +each character. We know the expected size of the flag string from the bounds +of `main`'s while loop (`while (idx != 0x2f)`). + +``` +#include <stdio.h> +#include <stdint.h> +#include <sys/types.h> + +typedef unsigned char byte; + +static const unsigned char DATA[] = { + 0x74, 0x92, 0x7f, 0x9c, 0xe9, 0x0c, 0xbb, 0xc2, 0x29, 0x19, 0x9b, 0x40, + 0xd7, 0x6e, 0x3d, 0xbe, 0x04, 0xe1, 0x83, 0x4f, 0x83, 0xd4, 0x85, 0x91, + 0xaf, 0x70, 0x5d, 0xfd, 0xf1, 0x7f, 0xc4, 0x88, 0x71, 0xfa, 0x78, 0xe6, + 0x0d, 0xdf, 0xcb, 0x72, 0xa7, 0x3d, 0xb6, 0xf4, 0x3d, 0x9e, 0x29, 0x54, + 0xf4, 0x7b, 0x05, 0xaa, 0xa3, 0x4d, 0x14, 0x14, 0x3c, 0x02, 0xc6, 0xe1, + 0x39, 0xb5, 0xb9, 0x74, 0x0f, 0xd8, 0x5f, 0x54, 0x29, 0x73, 0x7a, 0x04, + 0x3f, 0xd9, 0x41, 0xad, 0xd0, 0xbc, 0x16, 0x96, 0x50, 0x62, 0x59, 0x76, + 0x0f, 0xec, 0xa7, 0xaa, 0x2f, 0xf2, 0xb1, 0x21, 0x7e, 0xb3, 0x80, 0x87, + 0x15, 0x14, 0x8d, 0x76, 0x60, 0xad, 0xf3, 0x56, 0x4d, 0x6f, 0x84, 0x2c, + 0x3e, 0x57, 0x38, 0x15, 0x9e, 0x7b, 0x95, 0x6a, 0x70, 0x08, 0x03, 0xaa, + 0xbc, 0xbf, 0xc7, 0x27, 0x4d, 0x88, 0x2e, 0x47, 0x71, 0x09, 0x34, 0xbc, + 0x94, 0xc0, 0x70, 0x95, 0xea, 0x21, 0x55, 0xd6, 0xbe, 0x14, 0x84, 0x86, + 0x8d, 0xec, 0xf7, 0xff, 0xff, 0x65, 0x14, 0xaa, 0xa7, 0x6a, 0xd1, 0x21, + 0x0c, 0xc1, 0x97, 0x84, 0xf7, 0xd2, 0x3a, 0x51, 0xca, 0xbb, 0x11, 0x62, + 0xe5, 0xc8, 0x99, 0x87, 0xbd, 0xfc, 0x37, 0xb5, 0xed, 0x29, 0xcc, 0x44, + 0x5d, 0xd9, 0x8a, 0x40, 0xb1, 0x02, 0x09, 0x2d }; + +int flag_gen(uint param_1) +{ + byte bVar1; + uint uVar2; + int iVar3; + + uVar2 = 0; + iVar3 = 0; + do { + bVar1 = (byte)iVar3 & 0x1f; + iVar3 = iVar3 + 1; + param_1 = (param_1 * param_1 >> bVar1 | param_1 * param_1 << 0x20 - bVar1) * 0x1337 + 0x4201337 + ^ uVar2; + uVar2 = uVar2 + 0x13371337; + } while (iVar3 != 0x20); + return (param_1 >> 8) + (param_1 >> 0x10) + param_1 + (param_1 >> 0x18); +} + +int main(void) { + const int *arr = (void *)DATA; + for (int i = 0; i < 47; i++) { + int c = flag_gen(arr[i]); + printf("%c", (char)c); + } + printf("\n"); + return 0; +} +``` + +lactf{m4yb3_th3r3_1s_s0m3_m3r1t_t0_us1ng_4_db} |