Skip to content

Commit 00a965b

Browse files
committed
Participate in DEF CON CTF 2022 Quals
1 parent be11108 commit 00a965b

30 files changed

+2859
-0
lines changed
768 KB
Binary file not shown.
4.21 MB
Binary file not shown.
Binary file not shown.
768 Bytes
Binary file not shown.

DEFCON/2022 Quals/bios/extracted/flag

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
APERTURE IMAGE FORMAT (c) 1985
2+
3+
42
4+
5+
~ ~ ~ ~ ~ ~ ~ ~ ~ &'~ 6&~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ]'~ 5'~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ]'~ 5'~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ]'~ 5'~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ]'~ 5'~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ !*)()3(:#8'1~ ~ ~ .'~ 5'~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ !*()(5':#8&3~ 67'8&1.-(8#*)+*'H)$*T'~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ !*'*'7&:#7&5~ 58&8%3,/'8#*(,*'H)$*T'3***$87'1:$B$6:*&1~ ~ ~ ~ ~ ~ ~ ~ **&+&:$:#6&6~ 58&7%5*1&7$*'-*'H)$*T'3***$87'1:$B#89*%3~ ~ ~ ~ ~ ~ ~ ~ )*%,%<#9$5'6~ 59%6%6)3%6%*&.*'N#$#['3***$78'1:$B":8*$5~ ~ ~ ~ ~ ~ ~ ~ (:%=#8%4(6~ 5:$5&6(5$5&*%/*'N#$#['3***$69'1:$B":8*#6~ ~ ~ ~ ~ ~ ~ ~ (9&=#7&3)6~ 5;#4'6'7#4'*$0*'N#$#['3***$5:'19&A":8*#6%'~ ~ ~ ~ ~ ~ ~ z9&=#7&'56~ 5;#3(6&8#3(*#1*'N#$#['3***$4;'18(@":8*#6%'~ ~ ~ ~ ~ ~ ~ z:%=#6''56~ 5;#'46%9#'4*"2*'N#$#['3***$3<'17*?":8*#6%'~ ~ ~ ~ ~ ~ ~ z;$*',#5('=.~ 5;#'46%9#'4*!3*'N#$#['3***$'H'17+>":8*#6%'~ ~ ~ ~ ~ ~ ~ z;$*(+#*3'=-~ 6;#'<.%9#'4>*'N#$#['3***$'H'16-++'"*((8*#6%'~ ~ ~ ~ ~ ~ ~ z;$*)*#*3'<-~ 7'**#'<-&+1'4>*'N#$#['3>$'H'15/+*'")()8*+.%'~ ~ ~ ~ ~ ~ ~ z;$*)*#*35--~ 8')+#';-'*2'43!**'N#$#['3>$'H5#*;,('"((*8*+-&'~ ~ ~ ~ ~ ~ ~ z*'*$*)*#*35,-~ 9'(,#5,-()35&2"**'N#$#['3>$'H5#*<,''"&%/8**-''~ ~ ~ ~ ~ ~ ~ z*'*$*)*#*34,-~ :'',$5+-)(45&1#**'N#$#['3>$5:4$*=,&'"&%.9*)-('~ ~ ~ ~ ~ ~ ~ z*'*$*)*#*3'8-~ ;'&,%4+-*(44'0$**'N#$#['3>$5:3%*>,%'"&%.9*(-~ ~ ~ ~ ~ ~ ~ ~ ,*&+$*)*#*3'7-~ <'%,&'7-+(4'4/%**'N#$#['3>$4;2&*?,$'"&%-:*'-~ ~ ~ ~ ~ ~ ~ ~ -*%,$*)*#*3'6.~ <'$,''6-,)3'4.&**'N#$#['3>$'H'1*@,#'"&L*&-~ ~ ~ ~ ~ ~ ~ ~ .*$-$*)*#*3'5.~ ='#,('5.,*2'4-'**'N#$#['3***$'H'1*A,"'"'K*%-~ ~ ~ ~ ~ ~ ~ ~ /*#.$*)*#*35'-~ >'",)'4.-,0'4,(**'N#$#['3***$'H'1*B,!'"(J*$.,'~ ~ ~ ~ ~ ~ ~ z;$*)*#*35'6~ 5'!,*5&-.8$5&+)**'N#$#['3***$'H'1*C3"*H*#.-'~ ~ ~ ~ ~ ~ ~ z:%)**#*35'6~ 53+5&6%8$5&***$=>#$#['3***$5:5#*D2"99*#-.'~ ~ ~ ~ ~ ~ ~ z9&(+)$)45'6~ 52,5&6%7%5&)+*$=>#$#U=#***$5:5#*E1"99*#6%'~ ~ ~ ~ ~ ~ ~ z8'',(%(54(6~ 51-5&6&5&5&(,)%=>#$#U=#)+)%5:5#*F0"8:*#6%'~ ~ ~ ~ ~ ~ ~ z7(','&'63*4~ 60.4'6'3'4''-(&<?#$#U=#(,(&5:5#)G0"7;)$6%'~ ~ ~ ~ ~ ~ ~ z6)&-&'&72,2~ 7//3)4)1(3('-'':A#$#U<$'-''4;4$(I/"6<(%6%'~ ~ ~ ~ ~ ~ ~ z5*%.%(%82-0~ 8.02+2+/)2)&.&(9B#$#U:&&.&(3<3%'K."5=''4&'~ ~ ~ ~ ~ ~ ~ z4+$/$)$91/.~ 9-12,0--*2)%/%)8=)$*N9'%/%)2=2&&M-#3>&)2''~ ~ ~ ~ T3,#0#*#:01,~ :,21../,*1*$0$*7>)$*N8(%/%)2=2&%O,$1?%+0~ ~ ~ ~ ~ ~ ~ J+300,1*+0+#1#+6?)$*N7)$0$*1>1'$Q+%/@$-.~ ~ ~ ~ ~ ~ ~ ~ ~ ~ X6*#1#+0?0(#S*&-A#/,~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ \"~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ W#~ :"~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ :$~ 9#~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 9%~ 8$~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 8&~ 7%~ ~ ~ ~ ~ ~ X
909 Bytes
Binary file not shown.
909 Bytes
Binary file not shown.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[ZoneTransfer]
2+
ZoneId=3
3+
HostUrl=https://cdn.discordapp.com/attachments/979897359943213087/979963118090342410/flag.lzma
4.59 KB
Binary file not shown.
194 Bytes
Binary file not shown.

DEFCON/2022 Quals/bios/solver.py

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
import lzma
2+
3+
with open("extracted/flag.lzma.enc", "rb") as enc:
4+
enc_data = enc.read()
5+
6+
for key in range(0, 100000):
7+
start_key = key
8+
9+
try_data = bytearray(enc_data)
10+
for i in range(len(try_data)):
11+
key = (((key >> 3) ^ (key >> 8) ^ (key >> 10) ^ (key >> 15)) & 1 | (2 * key)) & 0xffff
12+
try_data[i] ^= key & 0xff
13+
14+
try:
15+
if try_data[:4] == b"\x5d\x00\x00\x80":
16+
print(start_key)
17+
print(try_data)
18+
except Exception as e:
19+
pass
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
from abc import ABC
2+
from collections import defaultdict
3+
from enum import Enum
4+
from multiprocessing import Pool
5+
from capstone import *
6+
from pwn import *
7+
from z3 import *
8+
9+
import archinfo
10+
import angr
11+
import subprocess
12+
import logging
13+
14+
15+
class Arch(Enum):
16+
PE32 = 1
17+
POWER32 = 2
18+
POWER64 = 3
19+
ALPHA64 = 4
20+
EXE_86_64 = 5
21+
LIB_86_64 = 6
22+
M68K = 7
23+
MIPS64 = 8
24+
MIPS32_LE = 9
25+
MIPS32_BE = 10
26+
SPARC = 11
27+
RENESAS = 12
28+
ARM64 = 13
29+
ARM32 = 14
30+
S390 = 15
31+
HP_PA = 16
32+
RISCV64 = 17
33+
34+
35+
name_to_arch = {
36+
"ELF 32-bit MSB executable, PowerPC or cisco 4500": Arch.POWER32,
37+
"ELF 64-bit MSB executable, 64-bit PowerPC or cisco 7500": Arch.POWER64,
38+
"ELF 64-bit LSB executable, Alpha (unofficial)": Arch.ALPHA64,
39+
"ELF 64-bit LSB executable, x86-64": Arch.EXE_86_64,
40+
"ELF 64-bit LSB shared object, x86-64": Arch.LIB_86_64,
41+
"ELF 32-bit MSB executable, Motorola m68k": Arch.M68K,
42+
"ELF 64-bit MSB executable, MIPS": Arch.MIPS64,
43+
"ELF 32-bit LSB executable, MIPS": Arch.MIPS32_LE,
44+
"ELF 32-bit MSB executable, MIPS": Arch.MIPS32_BE,
45+
"ELF 64-bit MSB executable, SPARC V9": Arch.SPARC,
46+
"ELF 32-bit LSB executable, Renesas SH": Arch.RENESAS,
47+
"ELF 64-bit LSB executable, ARM aarch64": Arch.ARM64,
48+
"ELF 32-bit LSB executable, ARM": Arch.ARM32,
49+
"ELF 64-bit MSB executable, IBM S/390": Arch.S390,
50+
"ELF 32-bit MSB executable, PA-RISC": Arch.HP_PA,
51+
"ELF 64-bit LSB executable, UCB RISC-V": Arch.RISCV64,
52+
}
53+
54+
55+
def get_arch(filename):
56+
out = subprocess.check_output(["file", "-b", filename]).decode()
57+
if out.startswith("PE32+ executable (console) x86-64"):
58+
return Arch.PE32
59+
else:
60+
arch = ", ".join(out.split(", ")[:2])
61+
return name_to_arch[arch]
62+
63+
64+
class Family(ABC):
65+
pass
66+
67+
68+
FILE_LEN = 24315
69+
70+
71+
def file_name(id):
72+
return f"ncuts/{id}"
73+
74+
75+
def parse_imm(s):
76+
if s[0] == "#":
77+
s = s[1:]
78+
if s[:2] == "0x":
79+
return int(s[2:], 16)
80+
return int(s)
81+
82+
83+
def check_answer(qemu, id, num):
84+
output = subprocess.check_output(f"echo {num} | {qemu} {file_name(id)}", shell=True)
85+
return b"Congrats!" in output
86+
87+
88+
with Pool() as p:
89+
arch_list = p.map(get_arch, map(file_name, range(FILE_LEN)))
90+
91+
arch_map = defaultdict(list)
92+
for (i, arch) in enumerate(arch_list):
93+
arch_map[arch].append(i)
94+
95+
context.arch = "aarch64"
96+
context.log_level = "error"
97+
logging.getLogger("pwnlib.elf.elf").setLevel("ERROR")
98+
99+
# for bin_id in [64]:
100+
for bin_id in arch_map[Arch.ARM64]:
101+
e = ELF(file_name(bin_id))
102+
func_bytes = e.read(0x400540, 400)
103+
104+
md = Cs(CS_ARCH_ARM64, CS_MODE_ARM)
105+
106+
inst_list = list(md.disasm(func_bytes, 0x400540))
107+
inst_map = {}
108+
for inst in inst_list:
109+
inst_map[inst.address] = inst
110+
111+
# for inst in inst_list:
112+
# print("0x%x:\t%s\t%s" % (inst.address, inst.mnemonic, inst.op_str))
113+
114+
if (
115+
inst_map[0x400580].mnemonic != "mov"
116+
or inst_map[0x400584].mnemonic != "bl"
117+
or inst_map[0x400588].mnemonic != "cbnz"
118+
):
119+
continue
120+
121+
find = parse_imm(inst_map[0x400588].op_str.split(", ")[1])
122+
avoid = [0x40058c]
123+
124+
SP_BASE = 0x7F000000
125+
126+
proj = angr.Project(file_name(bin_id))
127+
state = proj.factory.blank_state(
128+
addr=0x400580, add_options={angr.options.ZERO_FILL_UNCONSTRAINED_REGISTERS}
129+
)
130+
131+
x = state.solver.BVS("x", 64)
132+
133+
state.memory.store(SP_BASE + 0x20, x)
134+
state.regs.sp = SP_BASE
135+
state.regs.x20 = SP_BASE + 0x20
136+
137+
sm = proj.factory.simulation_manager(state)
138+
sm.explore(find=find, avoid=avoid)
139+
140+
s = sm.found[0]
141+
ans = s.solver.eval(s.memory.load(SP_BASE + 0x20, 8, endness=archinfo.Endness.LE))
142+
143+
if check_answer("qemu-aarch64", bin_id, ans):
144+
print(f"{bin_id}: {ans}")
145+
else:
146+
print(f"{bin_id}: {ans} (WRONG!)")

0 commit comments

Comments
 (0)