diff --git a/DownUnderCTF 2023/beginner/pyny/README.md b/DownUnderCTF 2023/beginner/pyny/README.md new file mode 100644 index 00000000..103a92e5 --- /dev/null +++ b/DownUnderCTF 2023/beginner/pyny/README.md @@ -0,0 +1,60 @@ +# pyny + +## Source + +``` +#coding: punycode +def _(): pass +('Correct!' if ('Enter the flag: ') == 'DUCTF{%s}' % _.____ else 'Wrong!')-gdd7dd23l3by980a4baunja1d4ukc3a3e39172b4sagce87ciajq2bi5atq4b9b3a3cy0gqa9019gtar0ck +``` + +## Solve + +You probably want to do some easy stuff, like.. "decoding", and sure you can do that apparently. + +Well I'm different, and went for the debugger route. Sadly the debugger shipped with Pycharm and VSCode seems to be incapable of running this punycode. +So if python is based on C and the python debugger is not an option, what do you do? Correct, you step through the literal python elf with gdb. Set a breakpoint at several functions that might compare memory and get ready to cramp from the constant Enter Spam in order to continue through that binary. At Some point you will get the flag, but that can be optimised. + +Luckily some guy called Juan Cespedes, might have had a similar problem and decided to do something: + +![](justuseltrace.jpg) + +And thats what i did (plus some minor modification to shrink the output): + +```bash +$ echo abc | ltrace python3 pyny.py 2>&1 | grep "DUCTF" -A 10 +memcpy(0x7f4171ffbe90, "'DUCTF{%s}'", 11) = 0x7f4171ffbe90 +__ctype_b_loc() = 0x7f41724fbfe0 +memcpy(0x7f4171fe9e30, "\340\253\377qA\177\0\005\037rA\177\0\0p:\004rA\177\0\0\020\262\245\0\0\0\0\0"..., 192) = 0x7f4171fe9e30 +memset(0xdb2210, '\0', 24) = 0xdb2210 +strlen("DUCTF{%s}'") = 10 +strchr("DUCTF{%s}'", '\\') = nil +memcpy(0x7f4172043be0, "DUCTF{%s}", 9) = 0x7f4172043be0 +memcpy(0x7f417203f620, "", 0) = 0x7f417203f620 +memcpy(0x7f4172008b20, "\001\0\0\0\0\0\0\0\200Y\225\0\0\0\0\0\037\0\0\0\0\0\0\0\377\377\377\377\377\377\377\377"..., 100) = 0x7f4172008b20 +memcpy(0x7f41720501d0, "\341\265\226\312\270\341\265\227\312\260\302\272\342\201\277_\312\267\302\252\312\263\341\265\220\341\265\230\341\265\226", 31) = 0x7f41720501d0 +strlen("\341\265\226\312\270\341\265\227\312\260\302\272\342\201\277_\312\267\302\252\312\263\341\265\220\341\265\230\341\265\226") = 31 +memcpy(0x7f4172008b20, "\001\0\0\0\0\0\0\0\200Y\225\0\0\0\0\0\037\0\0\0\0\0\0\0\377\377\377\377\377\377\377\377"..., 100) = 0x7f4172008b20 +strlen("NFKC") = 4 +memcpy(0x7f4172050220, "NFKC", 4) = 0x7f4172050220 +strlen("NFC") = 3 +memcmp(0x7f4172050220, 0x85ba56, 3, 0xa476e0) = 8 +strlen("NFKC") = 4 +-- +memcpy(0x7f4172198560, "DUCTF{", 6) = 0x7f4172198560 +memcpy(0x7f4172198566, "python_warmup", 13) = 0x7f4172198566 +memcpy(0x7f4172198573, "}", 1) = 0x7f4172198573 +memcpy(0x7f417203edd0, "\001\0\0\0\0\0\0\0\200Y\225\0\0\0\0\0m\0\0\0\0\0\0\0\377\377\377\377\377\377\377\377"..., 69) = 0x7f417203edd0 +memset(0x7f417203f708, '\0', 32) = 0x7f417203f708 +strlen("sep") = 3 +memcmp(0x9888f0, 0x7f41720504e0, 3, 0xd47b70) = 0 +strlen("end") = 3 +memcpy(0x7f41720504e0, "end", 3) = 0x7f41720504e0 +memcmp(0x968390, 0x7f41720504e0, 3, 0xd47b70) = 0 +``` + +And we can literally see python move that flag into memory and grab it for some quick points. + +``` +DUCTF{python_warmup} +``` \ No newline at end of file diff --git a/DownUnderCTF 2023/beginner/pyny/justuseltrace.jpg b/DownUnderCTF 2023/beginner/pyny/justuseltrace.jpg new file mode 100644 index 00000000..ab94f0fb Binary files /dev/null and b/DownUnderCTF 2023/beginner/pyny/justuseltrace.jpg differ