5 lazy.chal.seccon.jp 33333
7 lazy was a binary challenge whose description only contained a server address. After connecting a simple menu was presented that offered options to login, access Public contents or disconnect. The public area contained part of the challenge source code related to the login:
9 #define BUFFER_LENGTH 32
10 #define PASSWORD "XXXXXXXXXX"
11 #define USERNAME "XXXXXXXX"
14 char username[BUFFER_LENGTH];
15 char password[BUFFER_LENGTH];
16 char input_username[BUFFER_LENGTH];
17 char input_password[BUFFER_LENGTH];
19 memset(username,0x0,BUFFER_LENGTH);
20 memset(password,0x0,BUFFER_LENGTH);
21 memset(input_username,0x0,BUFFER_LENGTH);
22 memset(input_password,0x0,BUFFER_LENGTH);
24 strcpy(username,USERNAME);
25 strcpy(password,PASSWORD);
27 printf("username : ");
28 input(input_username);
29 printf("Welcome, %s\n",input_username);
31 printf("password : ");
32 input(input_password);
35 if(strncmp(username,input_username,strlen(USERNAME)) != 0){
36 puts("Invalid username");
40 if(strncmp(password,input_password,strlen(PASSWORD)) != 0){
41 puts("Invalid password");
49 void input(char *buf){
53 recv = (int)read(STDIN_FILENO,&buf[i],1);
65 This code contained to problems: Input parsing was only terminated upon encountering a newline which allows for a buffer overflow and overwriting the login information stored on the stack, and the printf-statement after entering a username could be used to print data from the stack. After some experimentation I had found the necessary padding to print the username and password variables:
67 leak_password_payload = "A" * 29 + "%s"
68 leak_username_payload = "A" * 29 + "B" * 32 + "%s"
70 Using those the login menu option could be used to access a private content area in which the full binary and a libc file was stored; because files containing dots in their name could not be downloaded and code to prevent directory traversal was present as well.
71 The download prompt contained another printf-vulnerability, and exploring it further I found that some environment variables were stored on the stack, including pwd and the home-directory which was used to define which folder was presented for downloading. Thinking the flag might be stored in another folder I thought about overwriting those paths, but because "/q/private" was appended to it arbitrary path access would still not have been possible. I also considered overwriting the GOT-entry of a linked function to divert program flow and skip some checks in the code and download other files, but because the binary had RELRO enabled (which it took me way to long to remember to check after having worked on the challenge for a while already) this option was out as well. In the end I was unable to get the final step of downloading the flag in time. lazy_solve.py contains a solution up to the final part which automatically downloads the login source code, leaks the username and password and downloads the challenge binary.
74 ZPKay was a crypto challenge consisting of a website that offered registered users to send custom currency to other users by use of generated QR codes. After registration each user was given 500 units of the currency, and 1 million was required to reveal the flag. Registering multiple accounts and pooling the currency was possible but would have taken too long; the intended path seemed to be to fake a QR code that allowed for withdrawal of high enough amounts from the admin account that sent the initial batch to each new user.
75 Generating a couple of QR codes revealed that they encoded the username, the amount to be transferred, a proof and an hash:
77 username=w0y&amount=2&proof=MP49LF+ZPCw7Erx0RtFvs9aGKy2eglOEsOmKykBf9acYMSAw2VAOJC++LtkU1VQJLjFgomQpjsTKOnFZEi7SbRSm9y4xCjABuFt915o/jZvc45hTajCjjNDHQZ6/v3vc6jQSEOUSJ3n1huxiOEuhNEYpE0OAsfatSu6ijNz8aidLUXjd6hkXMCAwR02qBLuxG/ZqqJ1YOpPdkclDPgOo7f69GgCN1JBuXBUwCjD99BQC0lBQkDDjsWNBW03uis8/40UkaVtorRTntM8OFDAgMDQMPxacCXL7q+9nxQmSKQBxiAaoa/QPEcLUKsei9KAkMAowEXGyGgNDmfmQi942WhTZkSonB0dK54yt5bQf78FUTyUxCjBxEwWHGKwCK/rGCMvjXGYD02hJewvHqZPG6bgUQGfWGjEK&hash=76bb1b5eb3cb773acdd2e1ce12b02d242ea280f211722e314b06530d55680e88
79 Interestingly neither the proof nor the hash seemed to depend on the amount as both stayed the same with every new QR code generated, and encoding payloads with different amounts without the use of the website yielded usable codes as well. Looking around the site the hash turned out to be a user identification, and because the transaction overview on the starting page showed the hashes of trading partners the correct one for the admin account was known.
81 function formatTime(timestamp){
82 let dt = new Date(timestamp * 1000);
83 let time = dt.getFullYear() + "/" + (dt.getMonth()+1) + "/" + dt.getDate() + " " + dt.getHours() + ":" + dt.getMinutes();
87 function getAccountData()
89 $.get( "/api/accountData", function( data ) {
90 $("#balance").text(data["balance"]);
91 $("#flag").text(data["flag"]);
92 let tBody = $("#trx").find('tbody');
94 for(i=0; i<data["trxList"].length; ++i){
97 td.text(formatTime(data["trxList"][i][1]));
102 .attr("data-toggle", "popover")
103 .attr("data-trigger", "hover")
104 .attr("data-content", "Address is " + data["trxList"][i][3])
105 .attr("data-placement", "top")
106 .text(data["trxList"][i][2]);
110 td.text(data["trxList"][i][5]);
114 $('[data-toggle="popover"]').each(function(i, obj) {
115 var popover_target = $(this).data("popover-target");
121 content: function(obj) {
122 return $(popover_target).html();
129 $(document).ready(function(){
135 sendData["amount"] = $("#amount").val();
136 sendData["password"] = $("#password").val();
140 data:JSON.stringify(sendData),
141 contentType: "application/json; charset=utf-8",
143 success : function(data) {
144 if(data["status"] == "ok"){
145 $("#qr").html( data["dom"] );
147 $("#qr").html( data["error"]);
155 fileData = $("#qrImg").prop("files")[0];
156 formData = new FormData();
157 formData.append('file', fileData);
164 success : function(data) {
165 if(data["status"] == "ok"){
166 Snackbar.show({text: data["dom"]});
168 Snackbar.show({text: data["error"]});
174 The javascript of the page showed that other than the amount and the user password (as well as the session cookie) no information was sent to the server in order to generate the QR codes, which meant that the proof was generated once and stored serverside or was reconstructed with each request; however I did not find out how to get to the admin proof. Other teams seem to have solved it by simply generating QR codes with negative amounts encoded which would lead to the sending account getting credits added instead of subtracted, but I'm not sure whether that was the intended solution because the challenge name seemed to hint at some kind of zero knowledge-protocol being involved.
177 Sandstorm was a forensics challenge consisting of a grainy black-and-white-picture that contained some short text. Thinking the monochromatic pixels might encode a binary message I tried finding some relevant data using [zsteg](https://github.com/zed-0xff/zsteg) and stegsolve, but nothing interesting turned up. As it [turns out](https://github.com/10secTW/ctf-writeup/tree/master/2019/SECCON%20CTF%20quals/Sandstorm) I was on the wrong track and the image hid a QR code of the flag.