Skip to content

Commit c261bbc

Browse files
QwazQwaz
committed
Participate SECCON CTF 2022
1 parent d4c3b9c commit c261bbc

15 files changed

+487
-0
lines changed

‎SECCON/2022/babycmp/chall.baby

20.8 KB
Binary file not shown.

‎SECCON/2022/babycmp/solver.py

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
from binascii import unhexlify
2+
3+
rand_arr = b"Welcome to SECCON 2022"
4+
5+
flag = unhexlify(
6+
(
7+
"04 20 2F 20 20 23 1E 59 44 1A 7F 35 75 36 2D 2B"
8+
+ "11 17 5A 03 6D 50 36 07 15 3C 09 01 04 47 2B 36"
9+
+ "41 0a 38"
10+
).replace(" ", "")
11+
)
12+
13+
flag = bytearray(flag)
14+
flag[0] ^= 0x57
15+
16+
for state in range(1, len(flag)):
17+
t = state // 0x16 + 2 * (
18+
state // 0x16 + (((((0x2E8BA2E8BA2E8BA3 * state) >> 64) & 0xFFFFFFFFFFFFFFFC)))
19+
)
20+
flag[state] ^= rand_arr[state - 2 * t]
21+
22+
print(flag.decode())

‎SECCON/2022/devil_hunter/check.sh

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/sh
2+
if [ -z "$1" ]
3+
then
4+
echo "[+] ${0} <flag.txt>"
5+
exit 1
6+
else
7+
clamscan --bytecode-unsigned=yes --quiet -dflag.cbc "$1"
8+
if [ $? -eq 1 ]
9+
then
10+
echo "Correct!"
11+
else
12+
echo "Wrong..."
13+
fi
14+
fi

‎SECCON/2022/devil_hunter/flag.cbc

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
ClamBCafhaio`lfcf|aa```c``a```|ah`cnbac`cecnb`c``beaacp`clamcoincidencejb:4096
2+
Seccon.Reversing.{FLAG};Engine:56-255,Target:0;0;0:534543434f4e7b
3+
Teddaaahdabahdacahdadahdaeahdafahdagahebdeebaddbdbahebndebceaacb`bbadb`baacb`bb`bb`bdaib`bdbfaah
4+
Eaeacabbae|aebgefafdf``adbbe|aecgefefkf``aebae|amcgefdgfgifbgegcgnfafmfef``
5+
G`ad`@`bdeBceBefBcfBcfBofBnfBnbBbeBefBfgBefBbgBcgBifBnfBgfBnbBfdBldBadBgd@`bad@Aa`bad@Aa`
6+
A`b`bLabaa`b`b`Faeac
7+
Baa``b`abTaa`aaab
8+
Bb`baaabbaeAc`BeadTbaab
9+
BTcab`b@dE
10+
A`aaLbhfb`dab`dab`daahabndabad`bndabad`b`b`aa`b`d`b`d`b`d`b`b`bad`bad`b`b`aa`b`d`b`b`aa`ah`aa`aa`b`b`aa`b`d`b`d`b`d`b`b`bad`bad`b`b`b`b`b`d`b`d`b`b`b`b`bad`b`b`bad`b`d`aa`b`b`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`b`bad`b`b`bad`b`b`aa`aa`b`d`b`d`aa`Fbcgah
11+
Bbadaedbbodad@dbadagdbbodaf@db`bahabbadAgd@db`d`bb@habTbaab
12+
Baaaiiab`dbbaBdbhb`d`bbbbaabTaaaiabac
13+
Bb`dajbbabajb`dakh`ajB`bhb`dalj`akB`bhb`bamn`albadandbbodad@dbadaocbbadanamb`bb`aabbabaoAadaabaanab`bb`aAadb`dbbaa`ajAahb`d`bb@h`Taabaaagaa
14+
Bb`bbcaabbabacAadaabdakab`bbca@dahbeabbacbeaaabfaeaahbeaBmgaaabgak`bdabfab`d`bb@h`Taabgaadag
15+
Bb`bbhaabbabacAadaabiakab`bbha@db`d`bb@haab`d`bb@h`Taabiaagae
16+
Bb`dbjabbaabjab`dbkah`bjaB`bhb`dblaj`bkaB`bhb`bbman`blabadbnadbbodad@dbadboacbbadbnabmab`bb`bgbboab`bbab`baacb`bb`dbbbh`bjaBnahb`dbcbj`bbbB`bhb`bbdbn`bcbb`bbebc`Add@dbadbfbcbbadagbebb`bbgbc`Addbdbbadbhbcbbadbfbbgbb`b`fbbabbhbb`dbiba`bjaAdhaabjbiab`dbibBdbhb`d`bbbibaaTaabjbaeaf
17+
Bb`bbkbgbagaablbeab`bbkbHbj`hnicgdb`bbmbc`Add@dbadbnbcbbadagbmbb`bbobc`AddAadbadb`ccbbadbnbbobb`bbacgbb`caabbceab`bbacHcj`hnjjcdaabcck`blbbbcb`bbdcc`Add@dbadbeccbbadagbdcb`bbfcc`AddAbdbadbgccbbadbecbfcb`bbhcgbbgcaabiceab`bbhcHoigndjkcdaabjck`bccbicb`bbkcc`Add@dbadblccbbadagbkcb`bbmcc`AddAcdbadbnccbbadblcbmcb`bbocgbbncaab`deab`bbocHcoaljkhgdaabadk`bjcb`db`bbbdc`Add@dbadbcdcbbadagbbdb`bbddc`AddAddbadbedcbbadbcdbddb`bbfdgbbedaabgdeab`bbfdHcoalionedaabhdk`badbgdb`bbidc`Add@dbadbjdcbbadagbidb`bbkdc`AddAedbadbldcbbadbjdbkdb`bbmdgbbldaabndeab`bbmdHoilnikkcdaabodk`bhdbndb`bb`ec`Add@dbadbaecbbadagb`eb`bbbec`AddAfdbadbcecbbadbaebbeb`bbdegbbceaabeeeab`bbdeHdochfheedaabfek`bodbeeb`bbgec`Add@dbadbhecbbadagbgeb`bbiec`AddAgdbadbjecbbadbhebieb`bbkegbbjeaableeab`bbkeHdiemjoeedaabmek`bfebleb`bbnec`Add@dbadboecbbadagbneb`bb`fc`AddAhdbadbafcbbadboeb`fb`bbbfgbbafaabcfeab`bbbfHoimmoklfdaabdfk`bmebcfb`dbefo`bdfb`d`bbbef`Tbaag
18+
Bb`dbffbb`bffaabgfn`bffTcaaabgfE
19+
Aab`bLbaab`b`b`dab`dab`d`b`d`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`b`aa`b`d`b`d`Fbfaac
20+
Bb`d`bb@habb`d`bbG`lckjljhaaTbaaa
21+
Bb`dacbbaaacb`dadbbabadb`baen`acb`bafn`adb`bagh`afAcdb`bahi``agb`baik`ahBoodb`bajm`aiaeb`bakh`ajAhdb`bali`aeBhadb`baml`akalb`bana`afAadaaaoeab`banAddb`db`ao`anb`dbaao`amb`d`bbb`aabb`d`bbbaaaaTaaaoabaa
22+
BTcab`bamE
23+
Snfofdg`bcgof`befafcgig`bjc`ej`

‎SECCON/2022/devil_hunter/flag.txt

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
SECCON{AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA}

‎SECCON/2022/devil_hunter/solver-debug.patch

+148
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
diff --git a/clambc/bcrun.c b/clambc/bcrun.c
2+
index 669df0a93..718fbc31d 100644
3+
--- a/clambc/bcrun.c
4+
+++ b/clambc/bcrun.c
5+
@@ -402,6 +402,26 @@ int main(int argc, char *argv[])
6+
fprintf(stderr, "Out of memory\n");
7+
exit(3);
8+
}
9+
+
10+
+ if ((opt = optget(opts, "input"))->enabled) {
11+
+ fd = open(opt->strarg, O_RDONLY | O_BINARY);
12+
+ if (fd == -1) {
13+
+ fprintf(stderr, "Unable to open input file %s: %s\n", opt->strarg, strerror(errno));
14+
+ optfree(opts);
15+
+ exit(5);
16+
+ }
17+
+ map = fmap(fd, 0, 0, opt->strarg);
18+
+ if (!map) {
19+
+ fprintf(stderr, "Unable to map input file %s\n", opt->strarg);
20+
+ exit(5);
21+
+ }
22+
+ rc = cli_bytecode_context_setfile(ctx, map);
23+
+ if (rc != CL_SUCCESS) {
24+
+ fprintf(stderr, "Unable to set file %s: %s\n", opt->strarg, cl_strerror(rc));
25+
+ optfree(opts);
26+
+ exit(5);
27+
+ }
28+
+ }
29+
30+
// ctx was memset, so recursion_level starts at 0.
31+
cctx.recursion_stack[cctx.recursion_level].fmap = map;
32+
@@ -416,6 +436,7 @@ int main(int argc, char *argv[])
33+
dbg_state.col = 0;
34+
dbg_state.showline = !optget(opts, "no-trace-showsource")->enabled;
35+
tracelevel = optget(opts, "trace")->numarg;
36+
+ printf("tracelevel %d\n", tracelevel);
37+
cli_bytecode_context_set_trace(ctx, tracelevel,
38+
tracehook,
39+
tracehook_op,
40+
@@ -440,25 +461,6 @@ int main(int argc, char *argv[])
41+
}
42+
}
43+
44+
- if ((opt = optget(opts, "input"))->enabled) {
45+
- fd = open(opt->strarg, O_RDONLY | O_BINARY);
46+
- if (fd == -1) {
47+
- fprintf(stderr, "Unable to open input file %s: %s\n", opt->strarg, strerror(errno));
48+
- optfree(opts);
49+
- exit(5);
50+
- }
51+
- map = fmap(fd, 0, 0, opt->strarg);
52+
- if (!map) {
53+
- fprintf(stderr, "Unable to map input file %s\n", opt->strarg);
54+
- exit(5);
55+
- }
56+
- rc = cli_bytecode_context_setfile(ctx, map);
57+
- if (rc != CL_SUCCESS) {
58+
- fprintf(stderr, "Unable to set file %s: %s\n", opt->strarg, cl_strerror(rc));
59+
- optfree(opts);
60+
- exit(5);
61+
- }
62+
- }
63+
/* for testing */
64+
ctx->hooks.match_counts = deadbeefcounts;
65+
ctx->hooks.match_offsets = deadbeefcounts;
66+
diff --git a/libclamav/bytecode_vm.c b/libclamav/bytecode_vm.c
67+
index 74953c852..925cf0bb4 100644
68+
--- a/libclamav/bytecode_vm.c
69+
+++ b/libclamav/bytecode_vm.c
70+
@@ -79,7 +79,7 @@ static inline int bcfail(const char *msg, long a, long b,
71+
#define CHECK_EQ(a, b)
72+
#define CHECK_GT(a, b)
73+
#endif
74+
-#if 0 /* too verbose, use #ifdef CL_DEBUG if needed */
75+
+#if 1 /* too verbose, use #ifdef CL_DEBUG if needed */
76+
#define CHECK_UNREACHABLE \
77+
do { \
78+
cli_dbgmsg("bytecode: unreachable executed!\n"); \
79+
@@ -737,29 +737,29 @@ int cli_vm_execute(const struct cli_bc *bc, struct cli_bc_ctx *ctx, const struct
80+
TRACE_INST(inst);
81+
82+
switch (inst->interp_op) {
83+
- DEFINE_BINOP(OP_BC_ADD, res = op0 + op1);
84+
- DEFINE_BINOP(OP_BC_SUB, res = op0 - op1);
85+
- DEFINE_BINOP(OP_BC_MUL, res = op0 * op1);
86+
+ DEFINE_BINOP(OP_BC_ADD, printf("%d + %d\n", op0, op1); res = op0 + op1);
87+
+ DEFINE_BINOP(OP_BC_SUB, printf("%d - %d\n", op0, op1); res = op0 - op1);
88+
+ DEFINE_BINOP(OP_BC_MUL, printf("%d * %d\n", op0, op1); res = op0 * op1);
89+
90+
DEFINE_BINOP(OP_BC_UDIV, CHECK_OP(op1 == 0, "bytecode attempted to execute udiv#0\n");
91+
- res = op0 / op1);
92+
+ printf("%d / %d\n", op0, op1); res = op0 / op1);
93+
DEFINE_BINOP(OP_BC_SDIV, CHECK_OP(check_sdivops(sop0, sop1), "bytecode attempted to execute sdiv#0\n");
94+
- res = sop0 / sop1);
95+
+ printf("%d /s %d\n", op0, op1); res = sop0 / sop1);
96+
DEFINE_BINOP(OP_BC_UREM, CHECK_OP(op1 == 0, "bytecode attempted to execute urem#0\n");
97+
- res = op0 % op1);
98+
+ printf("%d %% %d\n", op0, op1); res = op0 % op1);
99+
DEFINE_BINOP(OP_BC_SREM, CHECK_OP(check_sdivops(sop0, sop1), "bytecode attempted to execute urem#0\n");
100+
- res = sop0 % sop1);
101+
+ printf("%d %%s %d\n", op0, op1); res = sop0 % sop1);
102+
103+
DEFINE_BINOP(OP_BC_SHL, CHECK_OP(op1 > inst->type, "bytecode attempted to execute shl greater than bitwidth\n");
104+
- res = op0 << op1);
105+
+ printf("%d << %d\n", op0, op1); res = op0 << op1);
106+
DEFINE_BINOP(OP_BC_LSHR, CHECK_OP(op1 > inst->type, "bytecode attempted to execute lshr greater than bitwidth\n");
107+
- res = op0 >> op1);
108+
+ printf("%d >> %d\n", op0, op1); res = op0 >> op1);
109+
DEFINE_BINOP(OP_BC_ASHR, CHECK_OP(op1 > inst->type, "bytecode attempted to execute ashr greater than bitwidth\n");
110+
- res = CLI_SRS(sop0, op1));
111+
+ printf("%d >>a %d\n", op0, op1); res = CLI_SRS(sop0, op1));
112+
113+
- DEFINE_BINOP(OP_BC_AND, res = op0 & op1);
114+
- DEFINE_BINOP(OP_BC_OR, res = op0 | op1);
115+
- DEFINE_BINOP(OP_BC_XOR, res = op0 ^ op1);
116+
+ DEFINE_BINOP(OP_BC_AND, printf("%d & %d\n", op0, op1); res = op0 & op1);
117+
+ DEFINE_BINOP(OP_BC_OR, printf("%d | %d\n", op0, op1); res = op0 | op1);
118+
+ DEFINE_BINOP(OP_BC_XOR, printf("%d ^ %d\n", op0, op1); res = op0 ^ op1);
119+
120+
// clang-format off
121+
DEFINE_SCASTOP(OP_BC_SEXT,
122+
@@ -803,16 +803,16 @@ int cli_vm_execute(const struct cli_bc *bc, struct cli_bc_ctx *ctx, const struct
123+
DEFINE_OP_BC_RET_N(OP_BC_RET_VOID * 5 + 3, uint8_t, (void), (void));
124+
DEFINE_OP_BC_RET_N(OP_BC_RET_VOID * 5 + 4, uint8_t, (void), (void));
125+
126+
- DEFINE_ICMPOP(OP_BC_ICMP_EQ, res = (op0 == op1));
127+
- DEFINE_ICMPOP(OP_BC_ICMP_NE, res = (op0 != op1));
128+
- DEFINE_ICMPOP(OP_BC_ICMP_UGT, res = (op0 > op1));
129+
- DEFINE_ICMPOP(OP_BC_ICMP_UGE, res = (op0 >= op1));
130+
- DEFINE_ICMPOP(OP_BC_ICMP_ULT, res = (op0 < op1));
131+
- DEFINE_ICMPOP(OP_BC_ICMP_ULE, res = (op0 <= op1));
132+
- DEFINE_ICMPOP(OP_BC_ICMP_SGT, res = (sop0 > sop1));
133+
- DEFINE_ICMPOP(OP_BC_ICMP_SGE, res = (sop0 >= sop1));
134+
- DEFINE_ICMPOP(OP_BC_ICMP_SLE, res = (sop0 <= sop1));
135+
- DEFINE_ICMPOP(OP_BC_ICMP_SLT, res = (sop0 < sop1));
136+
+ DEFINE_ICMPOP(OP_BC_ICMP_EQ, printf("%d == %d (%08x == %08x)\n", op0, op1, op0, op1); res = (op0 == op1));
137+
+ DEFINE_ICMPOP(OP_BC_ICMP_NE, printf("%d != %d\n", op0, op1); res = (op0 != op1));
138+
+ DEFINE_ICMPOP(OP_BC_ICMP_UGT, printf("%d > %d\n", op0, op1); res = (op0 > op1));
139+
+ DEFINE_ICMPOP(OP_BC_ICMP_UGE, printf("%d >= %d\n", op0, op1); res = (op0 >= op1));
140+
+ DEFINE_ICMPOP(OP_BC_ICMP_ULT, printf("%d < %d\n", op0, op1); res = (op0 < op1));
141+
+ DEFINE_ICMPOP(OP_BC_ICMP_ULE, printf("%d <= %d\n", op0, op1); res = (op0 <= op1));
142+
+ DEFINE_ICMPOP(OP_BC_ICMP_SGT, printf("%d >s %d\n", op0, op1); res = (sop0 > sop1));
143+
+ DEFINE_ICMPOP(OP_BC_ICMP_SGE, printf("%d >=s %d\n", op0, op1); res = (sop0 >= sop1));
144+
+ DEFINE_ICMPOP(OP_BC_ICMP_SLE, printf("%d <=s %d\n", op0, op1); res = (sop0 <= sop1));
145+
+ DEFINE_ICMPOP(OP_BC_ICMP_SLT, printf("%d <s %d\n", op0, op1); res = (sop0 < sop1));
146+
147+
case OP_BC_SELECT * 5: {
148+
uint8_t t0, t1, t2;

‎SECCON/2022/devil_hunter/solver.py

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
from binascii import unhexlify
2+
3+
# result of A * 36
4+
magic1 = bytearray(unhexlify("739e80a23aae80a33ba4e79f78bac1f35ef9c1f33bb9ec9f558683f455fad5946cbfdd9f"))
5+
magic2 = bytearray(unhexlify("4b8bf2814b8bf2814b8bf2814b8bf2814b8bf2814b8bf2814b8bf2814b8bf2814b8bf281"))
6+
7+
flag = ""
8+
9+
for i in range(36):
10+
x = (i + 3) % 4 + i // 4 * 4
11+
flag += chr(magic1[x] ^ magic2[x] ^ ord("A"))
12+
13+
# SECCON{byT3c0d3_1nT3rpr3T3r_1s_4_L0T_0f_fun}
14+
print(flag)

‎SECCON/2022/this_is_not_lsb/problem.py

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
from Crypto.Util.number import *
2+
from flag import flag
3+
4+
p = getStrongPrime(512)
5+
q = getStrongPrime(512)
6+
e = 65537
7+
n = p * q
8+
phi = (p - 1) * (q - 1)
9+
10+
d = pow(e, -1, phi)
11+
12+
print(f"n = {n}")
13+
print(f"e = {e}")
14+
print(f"flag_length = {flag.bit_length()}")
15+
16+
# Oops! encrypt without padding!
17+
c = pow(flag, e, n)
18+
print(f"c = {c}")
19+
20+
# padding format: 0b0011111111........
21+
def check_padding(c):
22+
padding_pos = n.bit_length() - 2
23+
m = pow(c, d, n)
24+
25+
return (m >> (padding_pos - 8)) == 0xFF
26+
27+
28+
while True:
29+
c = int(input("c = "))
30+
print(check_padding(c))

‎SECCON/2022/this_is_not_lsb/solver.py

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
from Crypto.Util.number import long_to_bytes
2+
from pwn import *
3+
4+
con = remote("this-is-not-lsb.seccon.games", 8080)
5+
6+
con.recvuntil(b"n = ")
7+
n = int(con.recvline().strip())
8+
con.recvuntil(b"e = ")
9+
e = int(con.recvline().strip())
10+
assert e == 65537
11+
con.recvuntil(b"flag_length = ")
12+
flag_length = int(con.recvline().strip())
13+
assert flag_length == 439
14+
15+
con.recvuntil(b"c = ")
16+
ct = int(con.recvline().strip())
17+
18+
19+
def check_coeff(x):
20+
con.recvuntil(b"c = ")
21+
q = (pow(x, e, n) * ct) % n
22+
con.sendline(b"%d" % q)
23+
return con.recvline().strip() == b"True"
24+
25+
26+
# prefix = None
27+
prefix = 0b1010011010
28+
29+
30+
if prefix is None:
31+
intervals = []
32+
33+
for prefix in range(2**9):
34+
flag_lo = (2**9 + prefix) << 429
35+
flag_hi = flag_lo + ((1 << 429) - 1)
36+
37+
target_lo = 0b0011111111 << 1014
38+
target_hi = target_lo + ((1 << 1014) - 1)
39+
40+
interval = (
41+
(target_lo // flag_lo) + 1,
42+
(target_hi // flag_hi),
43+
)
44+
45+
assert interval[1] >= interval[0]
46+
intervals.append(interval)
47+
48+
prev_lo = 1 << 1024
49+
50+
for prefix in range(2**9):
51+
q = min(prev_lo - 1, intervals[prefix][1])
52+
if check_coeff(q):
53+
break
54+
55+
# assert unique interval range exists
56+
if prefix != 0 and prefix != len(intervals) - 1:
57+
assert intervals[prefix - 1][0] >= intervals[prefix + 1][1]
58+
59+
prefix = 2**9 + prefix
60+
61+
# highest 10 bit is decided
62+
log.success(bin(prefix))
63+
64+
known_bit = 10
65+
while known_bit < flag_length:
66+
target_bit = known_bit + 1
67+
68+
zero_lo = ((prefix << 1) + 0) << (flag_length - target_bit)
69+
zero_hi = zero_lo + ((1 << (flag_length - target_bit)) - 1)
70+
71+
one_lo = ((prefix << 1) + 1) << (flag_length - target_bit)
72+
one_hi = one_lo + ((1 << (flag_length - target_bit)) - 1)
73+
74+
n_coeff = ((1 << (target_bit + 1013)) - (0b0011111111 << 1014)) // n + 1
75+
target_lo = (0b0011111111 << 1014) + n * n_coeff
76+
target_hi = target_lo + ((1 << 1014) - 1)
77+
78+
zero_interval = (
79+
(target_lo // zero_lo) + 1,
80+
(target_hi // zero_hi),
81+
)
82+
83+
one_interval = (
84+
(target_lo // one_lo) + 1,
85+
(target_hi // one_hi),
86+
)
87+
88+
if check_coeff(zero_interval[1]):
89+
prefix = prefix * 2
90+
else:
91+
assert check_coeff(one_interval[1])
92+
prefix = prefix * 2 + 1
93+
known_bit += 1
94+
95+
print(bin(prefix))
96+
97+
# SECCON{WeLC0me_t0_tHe_MirRoR_LaNd!_tHIs_is_lSb_orAcLe!}
98+
print(long_to_bytes(prefix).decode())

‎SECCON/2022/txtchecker/Dockerfile

+25
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
FROM ubuntu:jammy
2+
3+
RUN apt-get update && apt-get -y install openssh-server file procps
4+
5+
WORKDIR /app
6+
7+
RUN groupadd -r ctf && useradd -m -r -g ctf ctf
8+
RUN echo "ctf:ctf" | chpasswd
9+
10+
RUN echo 'ForceCommand "/app/checker.sh"' >> /etc/ssh/sshd_config
11+
RUN echo 'Port 2022' >> /etc/ssh/sshd_config
12+
RUN mkdir /var/run/sshd
13+
14+
COPY flag.txt /
15+
COPY checker.sh /app/
16+
17+
RUN chmod 444 /flag.txt
18+
RUN chmod 555 /app/checker.sh
19+
20+
CMD while true; do \
21+
# kill long running processes for ssh
22+
ps -eo comm,pid,etimes | awk '/^checker.sh/ {if ($3 > 10) { print $2 }}' | xargs --no-run-if-empty kill -9; \
23+
sleep 5s; \
24+
done & \
25+
/sbin/sshd -D

‎SECCON/2022/txtchecker/checker.original.sh

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
3+
read -p "Input a file path: " filepath
4+
file $filepath 2>/dev/null | grep -q "ASCII text" 2>/dev/null
5+
6+
# TODO: print the result the above command.
7+
# $? == 0 -> It's a text file.
8+
# $? != 0 -> It's not a text file.
9+
exit 0

0 commit comments

Comments
 (0)