marx
/
gctf-2023-retro


			
				
					
						
						
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308
							<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8">
        <meta http-equiv="X-UA-Compatible" content="IE=edge">
        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <meta name="description" content="None">
        
        <link rel="canonical" href="http://127.0.0.1/">
        <link rel="shortcut icon" href="img/favicon.ico">
        <title>Google CTF 2023 | Retrospective</title>
        <link href="css/bootstrap.min.css" rel="stylesheet">
        <link href="css/font-awesome.min.css" rel="stylesheet">
        <link href="css/base.css" rel="stylesheet">
        <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.5.0/styles/github.min.css">

        <script src="js/jquery-1.10.2.min.js" defer></script>
        <script src="js/bootstrap.min.js" defer></script>
        <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.5.0/highlight.min.js"></script>
        <script>hljs.initHighlightingOnLoad();</script> 
    </head>

    <body class="homepage">
        <div class="navbar fixed-top navbar-expand-lg navbar-dark bg-primary">
            <div class="container">
                <a class="navbar-brand" href=".">Google CTF 2023 | Retrospective</a>
                <!-- Expander button -->
                <button type="button" class="navbar-toggler" data-toggle="collapse" data-target="#navbar-collapse">
                    <span class="navbar-toggler-icon"></span>
                </button>

                <!-- Expanded navigation -->
                <div id="navbar-collapse" class="navbar-collapse collapse">
                        <!-- Main navigation -->
                        <ul class="nav navbar-nav">
                            <li class="navitem active">
                                <a href="." class="nav-link">Home</a>
                            </li>
                            <li class="dropdown">
                                <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown">misc <b class="caret"></b></a>
                                <ul class="dropdown-menu">
                                    
<li>
    <a href="mind-the-gap/" class="dropdown-item">Mind the gap</a>
</li>
                                </ul>
                            </li>
                            <li class="dropdown">
                                <a href="#" class="nav-link dropdown-toggle" data-toggle="dropdown">pwn <b class="caret"></b></a>
                                <ul class="dropdown-menu">
                                    
<li>
    <a href="write-flag-where/" class="dropdown-item">Write flag where</a>
</li>
                                </ul>
                            </li>
                        </ul>

                    <ul class="nav navbar-nav ml-auto">
                        <li class="nav-item">
                            <a href="#" class="nav-link" data-toggle="modal" data-target="#mkdocs_search_modal">
                                <i class="fa fa-search"></i> Search
                            </a>
                        </li>
                            <li class="nav-item">
                                <a rel="prev" class="nav-link disabled">
                                    <i class="fa fa-arrow-left"></i> Previous
                                </a>
                            </li>
                            <li class="nav-item">
                                <a rel="next" href="mind-the-gap/" class="nav-link">
                                    Next <i class="fa fa-arrow-right"></i>
                                </a>
                            </li>
                    </ul>
                </div>
            </div>
        </div>

        <div class="container">
            <div class="row">
                    <div class="col-md-3"><div class="navbar-light navbar-expand-md bs-sidebar hidden-print affix" role="complementary">
    <div class="navbar-header">
        <button type="button" class="navbar-toggler collapsed" data-toggle="collapse" data-target="#toc-collapse" title="Table of Contents">
            <span class="fa fa-angle-down"></span>
        </button>
    </div>

    
    <div id="toc-collapse" class="navbar-collapse collapse card bg-secondary">
        <ul class="nav flex-column">
            
            <li class="nav-item" data-level="1"><a href="#gctf-2023-latiza" class="nav-link">gCTF 2023 | LATIZA</a>
              <ul class="nav flex-column">
            <li class="nav-item" data-level="2"><a href="#tools" class="nav-link">tools</a>
              <ul class="nav flex-column">
              </ul>
            </li>
            <li class="nav-item" data-level="2"><a href="#misc" class="nav-link">misc</a>
              <ul class="nav flex-column">
              </ul>
            </li>
            <li class="nav-item" data-level="2"><a href="#crypto" class="nav-link">crypto</a>
              <ul class="nav flex-column">
              </ul>
            </li>
            <li class="nav-item" data-level="2"><a href="#pwn" class="nav-link">pwn</a>
              <ul class="nav flex-column">
              </ul>
            </li>
            <li class="nav-item" data-level="2"><a href="#reversing" class="nav-link">reversing</a>
              <ul class="nav flex-column">
              </ul>
            </li>
            <li class="nav-item" data-level="2"><a href="#web" class="nav-link">web</a>
              <ul class="nav flex-column">
              </ul>
            </li>
            <li class="nav-item" data-level="2"><a href="#sandbox" class="nav-link">sandbox</a>
              <ul class="nav flex-column">
              </ul>
            </li>
              </ul>
            </li>
        </ul>
    </div>
</div></div>
                    <div class="col-md-9" role="main">

<h1 id="gctf-2023-latiza">gCTF 2023 | LATIZA</h1>
<p>This document contains some notes about how we solved some of the problems. The idea is to write the process to get to the solution rather than describing them. The hardest part for beginners is going from 0 to 1. The main goal is that everyone from the team can be on the same page about the resources and tools used.</p>
<p>The source code of this document is in <a href="https://git.o-for.net/marx/gctf-2023-retro">this repository</a>.</p>
<h2 id="tools">tools</h2>
<p>Main tools used during the competition.</p>
<p><strong>nc</strong></p>
<p><a href="https://en.wikipedia.org/wiki/Netcat">netcat</a> command is available in Unix. Used to connect to remote services. In this case, several challenges are hosted in a server, and you should interact with the server to get the flag.</p>
<pre><code>nc wfw1.2023.ctfcompetition.com 1337
</code></pre>
<p><strong>pwntools</strong></p>
<p><a href="https://github.com/Gallopsled/pwntools#readme">pwntools</a> is a python library with several useful primitives for CTFs. In particular, we used it as a programmatic replacement for <code>nc</code>.</p>
<pre><code>from pwn import *

r = remote('wfw1.2023.ctfcompetition.com', 1337)
r.sendline('hello')
r.recvline()
</code></pre>
<p>This way, it is easier to automatize the interaction with the server.</p>
<p><strong>Decompiler</strong></p>
<p><a href="https://github.com/NationalSecurityAgency/ghidra">Ghidra</a> Great tool to decompile binaries. You get some pseudo-C code. Pictures of some problems.</p>
<p>I've read in the general gctf discord about some alternatives that I haven't tried:
- <a href="https://rada.re/n/">Radare2</a>
- <a href="https://hex-rays.com/ida-pro/">IDA</a> This one seems very good but is not free.
- <a href="https://binary.ninja/">Binary Ninja</a></p>
<p><strong>Debugger</strong></p>
<p><a href="https://www.sourceware.org/gdb/">dbg</a>
  - <a href="https://github.com/pwndbg/pwndbg">pwndbg</a> <code>is a GDB plug-in that makes debugging with GDB suck less</code> This one works great.</p>
<p><strong>Solver</strong></p>
<ul>
<li><a href="https://github.com/Z3Prover/z3">Z3</a> is a powerful theorem prover. You can think about it like an SAT solver on steroids.</li>
<li>What was the other alternative mentioned by @alex for C++ symbolic execution?</li>
</ul>
<p><strong>Other UNIX tools</strong></p>
<ul>
<li>readelf</li>
<li>strings</li>
<li>???</li>
</ul>
<p><strong>Hex editor</strong></p>
<p>Edit binary files with hex editors. I have used <a href="https://marketplace.visualstudio.com/items?itemName=ms-vscode.hexeditor">Hex Editor</a> extension from VSCode.</p>
<h2 id="misc">misc</h2>
<p>Everything that doesn't fit in the other categories.</p>
<ul>
<li><a href="mind-the-gap/">MIND THE GAP</a></li>
<li>NPC</li>
<li>PAPAPAPA</li>
<li>SYMATRIX</li>
<li>TOTALLY NOT BRUTE FORCE</li>
</ul>
<h2 id="crypto">crypto</h2>
<p>Usually, it is easy to understand the goal by inspecting the given code. The problem is generally about cracking some insecure crypto primitive involving "heavy" math.</p>
<ul>
<li>CURSVED</li>
<li>LEAST COMMON GENOMINATOR</li>
<li>MHK2</li>
<li>MYTLS</li>
<li>PRIMES</li>
<li>ZIP</li>
</ul>
<h2 id="pwn">pwn</h2>
<p>You are given an application (usually in a stand-alone binary or a binary running in a server) with some "clear" functionality containing a not-so-clear vulnerability. In this case, the goal is to exploit the vulnerability to make the app do something unintended. Some common vulnerabilities are gaining shell access or reading a file you are not supposed to read.</p>
<ul>
<li>GRADEBOOK</li>
<li>KCONCAT</li>
<li>STORYGEN</li>
<li>UBF</li>
<li>WATTHEWASM</li>
<li><a href="write-flag-where/">WRITE-FLAG-WHERE</a></li>
</ul>
<h2 id="reversing">reversing</h2>
<p>You are given an application (usually in a stand-alone binary or a binary running in a server) with an obscure functionality. The first part of the goal is trying to figure out what the application is doing by inspecting the code.</p>
<ul>
<li>AUXIN</li>
<li>FLANGTON</li>
<li>JXL</li>
<li>OLDSCHOOL</li>
<li>PNG2</li>
<li>TURTLE</li>
<li>ZERMATT</li>
</ul>
<h2 id="web">web</h2>
<p>You are given a web application with some functionality. The goal is to exploit some vulnerability in the web application to get the flag. This is where you will find the most common vulnerabilities, like SQL injection, XSS, etc.</p>
<ul>
<li>BIOHAZARD</li>
<li>NOTENINJA</li>
<li>POSTVIEWER V2</li>
<li>UNDER-CONSTRUCTION</li>
<li>VEGGIE SODA</li>
</ul>
<h2 id="sandbox">sandbox</h2>
<p>You are given a sandboxed environment where you can run some code. The goal is to exploit some vulnerability in the sandbox to get the flag.</p>
<ul>
<li>FASTBOX</li>
<li>GVISOR</li>
<li>LIGHTBOX</li>
<li>V8BOX</li>
</ul></div>
            </div>
        </div>

        <footer class="col-md-12">
            <hr>
            <p>Documentation built with <a href="https://www.mkdocs.org/">MkDocs</a>.</p>
        </footer>
        <script>
            var base_url = ".",
                shortcuts = {"help": 191, "next": 78, "previous": 80, "search": 83};
        </script>
        <script src="js/base.js" defer></script>
        <script src="search/main.js" defer></script>

        <div class="modal" id="mkdocs_search_modal" tabindex="-1" role="dialog" aria-labelledby="searchModalLabel" aria-hidden="true">
    <div class="modal-dialog modal-lg">
        <div class="modal-content">
            <div class="modal-header">
                <h4 class="modal-title" id="searchModalLabel">Search</h4>
                <button type="button" class="close" data-dismiss="modal"><span aria-hidden="true">&times;</span><span class="sr-only">Close</span></button>
            </div>
            <div class="modal-body">
                <p>From here you can search these documents. Enter your search terms below.</p>
                <form>
                    <div class="form-group">
                        <input type="search" class="form-control" placeholder="Search..." id="mkdocs-search-query" title="Type search term here">
                    </div>
                </form>
                <div id="mkdocs-search-results" data-no-results-text="No results found"></div>
            </div>
            <div class="modal-footer">
            </div>
        </div>
    </div>
</div><div class="modal" id="mkdocs_keyboard_modal" tabindex="-1" role="dialog" aria-labelledby="keyboardModalLabel" aria-hidden="true">
    <div class="modal-dialog">
        <div class="modal-content">
            <div class="modal-header">
                <h4 class="modal-title" id="keyboardModalLabel">Keyboard Shortcuts</h4>
                <button type="button" class="close" data-dismiss="modal"><span aria-hidden="true">&times;</span><span class="sr-only">Close</span></button>
            </div>
            <div class="modal-body">
              <table class="table">
                <thead>
                  <tr>
                    <th style="width: 20%;">Keys</th>
                    <th>Action</th>
                  </tr>
                </thead>
                <tbody>
                  <tr>
                    <td class="help shortcut"><kbd>?</kbd></td>
                    <td>Open this help</td>
                  </tr>
                  <tr>
                    <td class="next shortcut"><kbd>n</kbd></td>
                    <td>Next page</td>
                  </tr>
                  <tr>
                    <td class="prev shortcut"><kbd>p</kbd></td>
                    <td>Previous page</td>
                  </tr>
                  <tr>
                    <td class="search shortcut"><kbd>s</kbd></td>
                    <td>Search</td>
                  </tr>
                </tbody>
              </table>
            </div>
            <div class="modal-footer">
            </div>
        </div>
    </div>
</div>

    </body>
</html>

<!--
MkDocs version : 1.4.3
Build Date UTC : 2023-06-28 23:44:24.921742+00:00
-->