Bonus
Point: 1
Bonus challenge: You just need to join WhiteHat Grand Prix 2017’s support channels (IRC and Slack) and find out the flag J
02:40 チャンネルに入りました02:40 *xxxxxx join #whitehatgrandprix2017 (~xxxxxx@yyy.zzz)02:40 *topic : WhiteHat{bc0b6353ab20df0fb7bc7a89e57cdc3ace54cb1f} New flag updated for Secure_token challenge ! New hint available for Cong Chieng challenge ! New hint available for Softweapon challenge !
WhiteHat{bc0b6353ab20df0fb7bc7a89e57cdc3ace54cb1f}
問題に提示されているURLを表示します。Warm Up
150
When warmup becomes magical, security disintegrates.
inctf{Y0u_C4n_N3v3r_F1nd_7h1s_Fl4g}です。
send 1505 szabo 457282 babbage 649604 wei 0x949a6ac29b9347b3eb9a420272a9dd7890b787a3
szabo: 1.000.000.000.000babbage: 1.000.000wei: 1
実行すると次の文字列が出力されます。import binasciia = b'333443335f6772616e646d615f626f756768745f736f6d655f626974636f696e'print binascii.unhexlify(a)
です。34C3_grandma_bought_some_bitcoin
To get you started :)
files: Link
difficulty: easy
$ file morphmorph: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=1c81eb4bc8b981ed39ef79801d6fef03d4d81056, stripped
$ ./morph
$ objdump -s -D morph >aaa.txt
ae5: 48 8b 45 d0 mov -0x30(%rbp),%raxae9: 48 83 c0 08 add $0x8,%raxaed: 48 8b 00 mov (%rax),%raxaf0: 48 89 c7 mov %rax,%rdi #%rax=コマンドライン引数af3: e8 60 fc ff ff callq 0x758 #<strlen>af8: 48 83 f8 17 cmp $0x17,%rax #23と比較afc: 74 0a je 0xb08
$ ./morph 34C3_M1GHTY_M0RPh1nG_g0What are you waiting for, go submit that flag!
34C3_M1GHTY_M0RPh1nG_g0
EasyOne
50
I have the flag mate but I don't know the password to read it. Can you crack it?
$ file chal.imgchal.img: x86 boot sector
$ strings chal.img(略)RIFFWAVEfmt(略)
ADDRESS 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 0123456789ABCDEF------------------------------------------------------------------------------00109000 52 49 46 46 84 D0 05 00 57 41 56 45 66 6D 74 20 RIFF��..WAVEfmt
inctf{th1s_1s_pr3tty_3asy_w4rmup}
Time
50
All of you want is time and all you have is time.
$ file TimeTime: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.16, stripped
Dynamicリンクの場合ライブラリの場所を指定する必要があります。-Lオプションでライブラリの場所を指定して再度実行してみます。$ qemu-arm ./Time/lib/ld-linux.so.3: No such file or directory
$ qemu-arm -L /usr/arm-linux-gnueabi/lib/ ./Time/lib/ld-linux.so.3: No such file or directory
$ sudo ln -s /usr/arm-linux-gnueabi/lib/ld-linux.so.3 .$ sudo ln -s /usr/arm-linux-gnueabi/lib arm-linux-gnueabi
$ qemu-arm ./TimeYou sucessfully loaded the file :)Enter your Key123456Flag check failed
以下の箇所を見ると、アドレス0x1084cのデータと0x7とのxorを取っているようです。$ arm-linux-gnueabi-objdump -s -D Time > aaa.txt
8574: e59f3058 ldr r3, [pc, #88] ; 0x85d48578: e51b2008 ldr r2, [fp, #-8]857c: e7933102 ldr r3, [r3, r2, lsl #2]8580: e2233007 eor r3, r3, #78584: e1a00003 mov r0, r38588: ebffff8b bl 0x83bc(略)85d4: 0001084c andeq r0, r1, ip, asr #16
それでは、文字列"nidsa|So6tX&tXmRtsXso4XE4`niIni`z"を1文字ずつ0x7とxorを取ってみます。セクション .data の内容:10844 00000000 00000000 6e000000 69000000 ........n...i...10854 64000000 73000000 61000000 7c000000 d...s...a...|...10864 53000000 6f000000 36000000 74000000 S...o...6...t...10874 58000000 26000000 74000000 58000000 X...&...t...X...10884 6d000000 52000000 74000000 73000000 m...R...t...s...10894 58000000 73000000 6f000000 34000000 X...s...o...4...108a4 58000000 45000000 34000000 60000000 X...E...4...`...108b4 6e000000 69000000 49000000 6e000000 n...i...I...n...108c4 69000000 60000000 7a000000 98a9365a i...`...z.....6Z
s = "nidsa|So6tX&tXmRtsXso4XE4`niIni`z"a = ""for c in s:a = a + chr(ord(c) ^ 0b00000111)print a
inctf{Th1s_!s_jUst_th3_B3ginNing}
inctf{Th1s_!s_jUst_th3_B3ginNing}です。
Sanity Check
1
Find the flag in the official IRC channel of the CTF.
15:15 チャンネルに入りました15:15 *xxxxxx join #bi0s-ctf (~xxxxxx@yyy.zzz)15:15 *topic : Welcome to InCTF, https://ctf.inctf.in/ | Flag for Sanity check inctf{w3lc0me_t0_inctf} | The reversing challenge messed up was updated at 23:55 UTC | New hint for liar released
inctf{w3lc0me_t0_inctf}
