AIS3 2024 Pre-exam & MyfirstCTF write-up hsuan0223x's

Misc#

Welcome#

~~直接免費送Flag~~

1
AIS3{Welc0me_to_AIS3_PreExam_2o24!}

Quantum Nim Heist#

遊戲畫面如下:

在玩這個遊戲時，不要被規則侷限，不知道要怎麼解的話，多玩幾次就知道了資安也是一樣的
by 某個好心的AIS3 Staff （對不起我忘記你叫甚麼了；；）

不要被規則侷限，我就想到，~~如果亂輸入數字會發生甚麼事~~
所以玩一玩就開始打一些奇怪的數字，發現居然會略過自己的回合所以我直接打數字打到剩一個石頭就得到Flag了

1
AIS3{Ar3_y0u_a_N1m_ma57er_0r_a_Crypt0_ma57er?}

Three Dimensional Secret#

題目有給我們壓縮檔，解開以後是一個封包檔案
說到封包，自然不能離開WireShark
所以把這個檔案用WireShark看，然後找資料的部分，然後用TCP Stream
就會看到一堆Gcode

這題就跟 picoCTF的某題大概相同
所以同樣把他貼到NC viewer(G-code檢視的網站)上

就有Flag了！

1
AIS3{b4d1y_tun3d_PriN73r}

Web#

Evil Calculator#

直接點網址，進去以後長這樣

~~養成一個好習慣~~，看到Web按F12，發現了這個

1
<input type="text" class="calculator-screen" id="expression" placeholder="0" disabled>

我的作法是直接把 disabled 改成 enable
這樣計算機的螢幕就變成了我們可以輸入文字或指令的地方
然後看source code，發現是flask框架，然後flag的路徑就在上層所以，直接在螢幕上輸入

1
open('../flag').read()

就直接噴出了Flag

1
AIS3{7RiANG13_5NAK3_I5_50_3Vi1}

Reverse#

The Long Print#

題目有給我們一個壓縮檔，解壓縮出來後，是一個執行檔，執行看看
結果發現，好像甚麼都沒有發生？
更準確來說好像執行非常慢？？那就打開Ghidra or IDA，發現了以下的code

1
undefined8 main(void)
2
{
3
  uint local_14;
4
  int local_10;
5
  int local_c;
6

7
  puts("Hope you have enough time to receive my flag:");
8
  for (local_10 = 0; local_10 < 0x18; local_10 = local_10 + 2) {
9
    local_14 = *(uint *)(&key + (ulong)*(uint *)(secret + (long)(local_10 + 1) * 4) * 4) ^
10
               *(uint *)(secret + (long)local_10 * 4);
11
    for (local_c = 0; local_c < 4; local_c = local_c + 1) {
12
      sleep(0x3674);
13
      printf("%c",(ulong)local_14);
14
      local_14 = local_14 >> 8;
15
      fflush(stdout);
16
    }
17
  }
18
  puts("\rOops! Where is the flag? I am sure that the flag is already printed!");
19
  return 0;
20
}

他居然執行了0x3674秒的sleep，大概是3.872小時，太久了！
所以我們需要Patch他的數值，直接利用Ghidra的Patch Instruction功能去修改他！把上述的程式中的0x3674修改成0x1之類的數字，之後sleep就變成了1秒！然後匯出之後執行檔案，沒多久就可以執行出Flag了！

1
AIS3{You_are_the_master_of_time_management!!!!?}

火拳のエース#

題目一樣有給我們壓縮檔，解壓縮之後，看看題目執行的樣子結果發現，好像跑的有點奇怪？然後打開Ghidra跑分析，接下來看到main函式

1
undefined4 main(void)
2
{
3
  char cVar1;
4
  uint __seed;
5
  int iVar2;
6
  int local_14;
7

8
  __seed = time((time_t *)0x0);
9
  srand(__seed);
10
  buffer0 = (char *)malloc(9);
11
  buffer1 = (char *)malloc(9);
12
  buffer2 = (char *)malloc(9);
13
  buffer3 = (char *)malloc(9);
14
  memset(buffer0,0,9);
15
  memset(buffer1,0,9);
16
  memset(buffer2,0,9);
17
  memset(buffer3,0,9);
18
  print_flag();
19
  __isoc99_scanf("%8s %8s %8s %8s",buffer0,buffer1,buffer2,buffer3);
20
  xor_strings(buffer0,&DAT_0804a163,buffer0);
21
  xor_strings(buffer1,&DAT_0804a16c,buffer1);
22
  xor_strings(buffer2,&DAT_0804a175,buffer2);
23
  xor_strings(buffer3,&DAT_0804a17e,buffer3);
24
  for (local_14 = 0; local_14 < 8; local_14 = local_14 + 1) {
25
    cVar1 = complex_function((int)buffer0[local_14],local_14);
26
    buffer0[local_14] = cVar1;
27
    cVar1 = complex_function((int)buffer1[local_14],local_14 + 0x20);
28
    buffer1[local_14] = cVar1;
29
    cVar1 = complex_function((int)buffer2[local_14],local_14 + 0x40);
30
    buffer2[local_14] = cVar1;
31
    cVar1 = complex_function((int)buffer3[local_14],local_14 + 0x60);
32
    buffer3[local_14] = cVar1;
33
  }
34
  iVar2 = strncmp(buffer0,"DHLIYJEG",8);
35
  if (iVar2 == 0) {
36
    iVar2 = strncmp(buffer1,"MZRERYND",8);
37
    if (iVar2 == 0) {
38
      iVar2 = strncmp(buffer2,"RUYODBAH",8);
39
      if (iVar2 == 0) {
40
        iVar2 = strncmp(buffer3,"BKEMPBRE",8);
41
        if (iVar2 == 0) {
42
          puts("Yes! I remember now, this is it!");
43
          goto LAB_08049869;
44
        }
45
      }
46
    }
47
  }
48
  puts("It feels slightly wrong, but almost correct...");
49
LAB_08049869:
50
  free(buffer0);
51
  free(buffer1);
52
  free(buffer2);
53
  free(buffer3);
54
  return 0;
55
}

可以看到，Flag剩下的部分是先由xor加密過後再用complex_function去再次加密
之後的四個字串就是”DHLIYJEG”,“MZRERYND”,“RUYODBAH”,“BKEMPBRE”
然後可以看看complex_function

1
int complex_function(int param_1,int param_2)
2

3
{
4
  int iVar1;
5
  int local_10;
6

7
  if ((0x40 < param_1) && (param_1 < 0x5b)) {
8
    local_10 = (param_1 + -0x41 + param_2 * 0x11) % 0x1a;
9
    iVar1 = param_2 % 3 + 3;
10
    param_2 = param_2 % 3;
11
    if (param_2 == 2) {
12
      local_10 = ((local_10 - iVar1) + 0x1a) % 0x1a;
13
    }
14
    else if (param_2 < 3) {
15
      if (param_2 == 0) {
16
        local_10 = (local_10 * iVar1 + 7) % 0x1a;
17
      }
18
      else if (param_2 == 1) {
19
        local_10 = (iVar1 * 2 + local_10) % 0x1a;
20
      }
21
    }
22
    return local_10 + 0x41;
23
  }
24
  puts("It feels slightly wrong, but almost correct...");
25
                    /* WARNING: Subroutine does not return */
26
  exit(1);
27
}

我的作法是直接寫程式去對照
解密出來的結果再拿回去xor
程式如下！

1
#include <stdio.h>
2
#include <string.h>
3
using namespace std;
4

5
void xor_strings(char *str, unsigned char *key, int len) {
6
    for (int i = 0; i < len; i++) {
7
        str[i] = str[i] ^ key[i];
8
    }
9
}
10

11
int complex_function(int param_1, int param_2) {
12
    int iVar1;
13
    int local_10;
14

15
    if ((0x40 < param_1) && (param_1 < 0x5b)) {
16
        local_10 = (param_1 - 0x41 + param_2 * 0x11) % 0x1a;
17
        iVar1 = param_2 % 3 + 3;
18
        param_2 = param_2 % 3;
19
        if (param_2 == 2) {
20
            local_10 = ((local_10 - iVar1) + 0x1a) % 0x1a;
21
        }
22
        else if (param_2 < 3) {
23
            if (param_2 == 0) {
24
                local_10 = (local_10 * iVar1 + 7) % 0x1a;
25
            }
26
            else if (param_2 == 1) {
27
                local_10 = (iVar1 * 2 + local_10) % 0x1a;
28
            }
29
        }
30
        return local_10 + 0x41;
31
    }
32
    printf("It feels slightly wrong, but almost correct...\n");
33
    return 0;
34
}
35

36
void decrypt(char a[], int b) {
37
    char ans[26];
38
    for (int i = 0; i < 26; i++) {
39
        ans[i] = 'A' + i;
40
    }
41
    for (int i = 0; i < 8; i++) {
42
        for (int j = 0; j < 26; j++) {
43
            char cVal = complex_function(65 + j, i + b);
44
            if (cVal == a[i]) {
45
                a[i] = ans[j];
46
                break; // Once found, no need to continue the loop
47
            }
48
        }
49
    }
50
}
51

52
int main() {
53
    char str1[] = "DHLIYJEG";
54
    char str2[] = "MZRERYND";
55
    char str3[] = "RUYODBAH";
56
    char str4[] = "BKEMPBRE";
57

58
    decrypt(str1, 0);
59
    decrypt(str2, 0x20);
60
    decrypt(str3, 0x40);
61
    decrypt(str4, 0x60);
62

63
    unsigned char key1[] = {0x0e, 0x0d, 0x7d, 0x06, 0x0f, 0x17, 0x76, 0x04};
64
    unsigned char key2[] = {0x6d, 0x00, 0x1b, 0x7c, 0x6c, 0x13, 0x62, 0x11};
65
    unsigned char key3[] = {0x1e, 0x7e, 0x06, 0x13, 0x07, 0x66, 0x0e, 0x71};
66
    unsigned char key4[] = {0x17, 0x14, 0x1d, 0x70, 0x79, 0x67, 0x74, 0x33};
67

68
    xor_strings(str1, key1, 8);
69
    xor_strings(str2, key2, 8);
70
    xor_strings(str3, key3, 8);
71
    xor_strings(str4, key4, 8);
72

73
    printf("Result: %s%s%s%s", str1,str2,str3,str4);
74

75
    return 0;
76
}

之後解密完拿回去，它印出Yes! I remember now, this is it!
就是Flag了！
（如果覺得它剛開始的字串跑太慢可以修改print_flag函式裡，local_10的值）
~~注意它印出來的G0D是0，不是O~~

1
AIS3{G0D_D4MN_4N9R_15_5UP3R_P0W3RFU1!!!}

Crypto#

babyRSA#

題目有提供給我們程式先打開來看看！

1
import random
2
from Crypto.Util.number import getPrime
3
from secret import flag
4
def gcd(a, b):
5
    while b:
6
        a, b = b, a % b
7
    return a
8

9
def generate_keypair(keysize):
10
    p = getPrime(keysize)
11
    q = getPrime(keysize)
12
    n = p * q
13
    phi = (p-1) * (q-1)
14

15
    e = random.randrange(1, phi)
16
    g = gcd(e, phi)
17
    while g != 1:
18
        e = random.randrange(1, phi)
19
        g = gcd(e, phi)
20
    d = pow(e, -1, phi)
21
    return ((e, n), (d, n))
22

23
def encrypt(pk, plaintext):
24
    key, n = pk
25
    cipher = [pow(ord(char), key, n) for char in plaintext]
26
    return cipher
27

28
def decrypt(pk, ciphertext):
29
    key, n = pk
30
    plain = [chr(pow(char, key, n)) for char in ciphertext]
31
    return ''.join(plain)
32

33
public, private = generate_keypair(512)
34
encrypted_msg = encrypt(public, flag)
35
decrypted_msg = decrypt(private, encrypted_msg)
36

37
print("Public Key:", public)
38
print("Encrypted:", encrypted_msg)
39
# print("Decrypted:", decrypted_msg)

output.txt有給我們public key跟加密過後的訊息
原本是想說，可以算算看private key，但後來發現數字太大了不可能
而且最要命的是Github上也有這個工具
後來覺得算太慢了，直接用python建立字典然後自動轉換

1
import string
2

3
public_key = #(公鑰)
4

5
def encrypt_with_known_key(public_key, plaintext):
6
    key, n = public_key
7
    cipher = [pow(ord(char), key, n) for char in plaintext]
8
    return cipher
9

10
all_characters = string.ascii_letters + string.digits + string.punctuation + string.whitespace
11
encrypted_dict = {char: encrypt_with_known_key(public_key, char)[0] for char in all_characters}
12

13
def decrypt_with_dict(encrypted_list, encrypted_dict):
14
    reversed_dict = {value: key for key, value in encrypted_dict.items()}
15
    decrypted_text = ''.join(reversed_dict[enc_char] for enc_char in encrypted_list)
16
    return decrypted_text
17

18
encrypted_list = #[加密內容]
19

20
decrypted_text = decrypt_with_dict(encrypted_list, encrypted_dict)
21
print("Decrypted Text:", decrypted_text)

1
AIS3{NeverUseTheCryptographyLibraryImplementedYourSelf}

Pwn#

對不起，我不會；；

心得#

名次如下

其實對於這次的比賽，老實說沒有很滿意。
因為在MyfirstCTF中的發揮沒有到很好，所以喪失了一生一次的機會。但是我覺得在pre-exam中的發揮其實是超乎我想像中的好！我以為我不會進入正取，但看到95th的時候，詢問過曾經參加過的朋友都覺得這把穩了！看到官網上的正取名單，我也挺感動的畢竟練了一個月，而且都是自學，然後~~比賽的時候睡眠狀況極差~~ 反正，接下來的AIS3 加油！