From 1b49d76dd73b14134b63de11907851ec2b11367c Mon Sep 17 00:00:00 2001 From: Maxime Vorwerk Date: Wed, 19 Jun 2024 22:28:56 +0200 Subject: [PATCH] Some Assembly Required 4 --- some_assembly_required_4/ZoRd23o0wd | Bin 0 -> 2142 bytes some_assembly_required_4/assembly4.wat | 833 +++++++++++++++++++++++++ some_assembly_required_4/rqe4VVml5W.js | 1 + some_assembly_required_4/sol.py | 92 +++ some_assembly_required_4/sol2.py | 39 ++ 5 files changed, 965 insertions(+) create mode 100644 some_assembly_required_4/ZoRd23o0wd create mode 100644 some_assembly_required_4/assembly4.wat create mode 100644 some_assembly_required_4/rqe4VVml5W.js create mode 100755 some_assembly_required_4/sol.py create mode 100755 some_assembly_required_4/sol2.py diff --git a/some_assembly_required_4/ZoRd23o0wd b/some_assembly_required_4/ZoRd23o0wd new file mode 100644 index 0000000000000000000000000000000000000000..e563896be0c50b3d3e7cf158efaf944a68fa4403 GIT binary patch literal 2142 zcmY*a=U)?96n%G6fJ|sg2k~4*rHBO)6&s_12=-pkA%sXtAcUFNRt=W5msQucuHF64 zf3=_YFW9{^lhHN5NqG0YbMHCtJmx+Xv!+NXMGJ$&N)2nd9OZ_Ud}X8pp`aoy5Dd`_ z5rqPzwD8)(92xTuf_hFF^M%guoclW;`QO-ER?ZCR1)nJzo=QxmXD@52+%zu=r5TT< zQfAyv&ss`_EqgXTHKQmJA5X-S=J`}?OlhHs>6xq@prUws=CToa7=|EOMX)?MiV(qDZ&W9axlgfkmMsI?2VdP%Jf|JFpUoO1hPx z+m+6x#=pd6C`DO@%e5Yq7b|aJfwQm>3$QT5qO4s-xYC)bLM5s)T#X7;C)tr+)1@^; zHKBFt)jF6u)S@oK^3C?iE?#Of_Q#nls#jFScUD#Vpl2-&596`hf>jI8C9^2w^F``*6 zF)FweB`CGT)CkJDy|P|rIm&qfiab{bxI#8xDK=JSxJsO_>J{rThNS_47ZA+*6)hii~z4h8&)Q{9qm5bDq&lVRakBF8mz(UEU)#-cA&$@ ztP@Np)}hnp^;nP2EO(&`Yc1Y@4s7rhd1)Js2yenhY)W&tH?tX={X$!$&{k~0R-3nB z8@6V7JGP_S;vQ^9&rd!ZvcVlNup`YowI12XPT$#G*yY#jm3n>XMW4;Pu^W9^?l+2f z5Bjmk;sNZ!K)z;_bWhA62L0r{lDrRlvCroH*pGc#K428`K^(wAiw|KChkoAKVe#(> z4&z9gkGhJE`ihR>m|yg`6g`3CIAQZioWzMNpE3&gG*02P#bgBtQwot4t( za2Ds%Y{KMW3~>y@i1qP^fZ`ZIJj0_d>FD?KOd#R2o)^|JoX42W;~2+SmM4rbPhtX- z7AKKF@&~KOm_o`=o|5EgOkvvQG}4&P@{AGU3}%qAcor$l`aa}6v_z8)3-%;ur3Yr^ zHH<1}^DHkN&?~}A!Ycv2c0|0EyCax)@r~S}ZXbI~#+*C& zgCNgaD!bv{KJN(ci2o$KA%0Jg!F$@xAIQk@N5TifN3!^n!}6K%iSSum_(IZ1zdBT3 zh4UNX8+pwXU#L{yP9eYHYJ&UuYKuyb7I}rBVP=\04\16.\12L\00\00")) diff --git a/some_assembly_required_4/rqe4VVml5W.js b/some_assembly_required_4/rqe4VVml5W.js new file mode 100644 index 0000000..55049df --- /dev/null +++ b/some_assembly_required_4/rqe4VVml5W.js @@ -0,0 +1 @@ +const _0x2f65=['instance','93703gBAUAn','442816lLbold','instantiate','1ZFMVDM','381193zsgNYQ','check_flag','result','length','48829pZIrMh','648920pjyJsd','copy_char','21760lQoqpJ','arrayBuffer','1zBwHgR','innerHTML','615706OhnLTV','Correct!','getElementById','./ZoRd23o0wd','charCodeAt'];const _0x1125=function(_0xe99bac,_0x38edc1){_0xe99bac=_0xe99bac-0xac;let _0x2f653e=_0x2f65[_0xe99bac];return _0x2f653e;};(function(_0x4bee5a,_0x2f153e){const _0x48cd05=_0x1125;while(!![]){try{const _0x1ca14e=parseInt(_0x48cd05(0xb7))+parseInt(_0x48cd05(0xb0))+-parseInt(_0x48cd05(0xc0))*parseInt(_0x48cd05(0xbd))+-parseInt(_0x48cd05(0xac))+-parseInt(_0x48cd05(0xb3))+parseInt(_0x48cd05(0xb5))*parseInt(_0x48cd05(0xb1))+-parseInt(_0x48cd05(0xbe));if(_0x1ca14e===_0x2f153e)break;else _0x4bee5a['push'](_0x4bee5a['shift']());}catch(_0x39e004){_0x4bee5a['push'](_0x4bee5a['shift']());}}}(_0x2f65,0x5b4df));let exports;(async()=>{const _0x2ff3c6=_0x1125;let _0x5a83eb=await fetch(_0x2ff3c6(0xba)),_0x304d04=await WebAssembly[_0x2ff3c6(0xbf)](await _0x5a83eb[_0x2ff3c6(0xb4)]()),_0x5835e7=_0x304d04[_0x2ff3c6(0xbc)];exports=_0x5835e7['exports'];})();function onButtonPress(){const _0x2579ee=_0x1125;let _0x39e007=document[_0x2579ee(0xb9)]('input')['value'];for(let _0x45a858=0x0;_0x45a858<_0x39e007[_0x2579ee(0xaf)];_0x45a858++){exports[_0x2579ee(0xb2)](_0x39e007[_0x2579ee(0xbb)](_0x45a858),_0x45a858);}exports[_0x2579ee(0xb2)](0x0,_0x39e007[_0x2579ee(0xaf)]),exports[_0x2579ee(0xad)]()==0x1?document[_0x2579ee(0xb9)](_0x2579ee(0xae))[_0x2579ee(0xb6)]=_0x2579ee(0xb8):document[_0x2579ee(0xb9)](_0x2579ee(0xae))['innerHTML']='Incorrect!';} \ No newline at end of file diff --git a/some_assembly_required_4/sol.py b/some_assembly_required_4/sol.py new file mode 100755 index 0000000..4c1e75d --- /dev/null +++ b/some_assembly_required_4/sol.py @@ -0,0 +1,92 @@ +#!/home/maxime/.pyvenv/bin/python3 +import string + +mem_str = b"\x18j|a\x118i7[H~Jh^Ko\x1f]\x5cw4kP\x15pO?\x5cEo\x14\x06\x05}>=\x04\x16.\x12L\x00\x00" +reference = b"picoCTF{" + +corr_mem_str = b"" +for i in range(0, len(mem_str)-1, 2): + corr_mem_str += chr(mem_str[i+1]).encode() + chr(mem_str[i]).encode() + +def shift_fwrd(char): + if char // 128 > 0: + return char | 0xffffff00 + else: + return char + +def shift_bwrd(char): + char &= 0xff + return char + +def transform(S,enc): + result = b"" + temp = "" + if enc == 0: + for i in range(0, len(S)-1, 2): + temp += chr(S[i+1]) + chr(S[i]) + S = temp.encode() + for i in range(len(S)): + if enc > 0: + buf = result + shift_fun = shift_fwrd + else: + buf = S + shift_fun = shift_bwrd + char = S[i] + char = shift_fwrd(char) + char ^= 20 + if i > 0: + prev = buf[i-1] + #prev = shift_fun(prev) + #char = shift_fun(char) + char ^= prev + if i > 2: + prev = buf[i-3] + #prev = shift_fun(prev) + #char = shift_fun(char) + char ^= prev + m10 = i%10 + #char = shift_fun(char) + char ^= m10 + if i%2 == 0: + #char = shift_fun(char) + char ^= 9 + else: + #char = shift_fun(char) + char ^= 8 + if i%3 == 0: + #char = shift_fun(char) + char ^= 7 + elif i%3 == 1: + #char = shift_fun(char) + char ^= 6 + else: + #char = shift_fun(char) + char ^= 5 + + result += chr(char).encode() + return result + +print(transform(mem_str, 0)) + +temp = "" +next_found = False +for i in range(0, len(mem_str)-1, 2): + temp += chr(mem_str[i+1]) + chr(mem_str[i]) +mem_str = temp.encode() +print(mem_str) + +temp = "" +while True: + for char in string.punctuation+string.ascii_letters + string.digits+' ': + result = transform((temp+char).encode(), 1) + if result in mem_str[:len(temp)+1]: + temp += char + next_found = True + break + if next_found: + next_found = False + else: + print(temp) + break + diff --git a/some_assembly_required_4/sol2.py b/some_assembly_required_4/sol2.py new file mode 100755 index 0000000..55ae743 --- /dev/null +++ b/some_assembly_required_4/sol2.py @@ -0,0 +1,39 @@ +#!/home/maxime/.pyvenv/bin/python3 +from wasmtime import Store, Module, Instance +import string +import itertools + +store = Store() +module = Module.from_file(store.engine, "assembly4.wat") +instance = Instance(store, module, []) + +exports = instance.exports(store) +memory = exports["memory"] +check_flag = exports["check_flag"] + +def init_flag(pair): + for i in range(len(flag)): + memory.data_ptr(store)[1072+i]=ord(flag[i]) + for j in range(len(flag_so_far)): + memory.data_ptr(store)[1072+8+j]=ord(flag_so_far[j]) + memory.data_ptr(store)[1072+8+len(flag_so_far)]=ord(pair[0]) + memory.data_ptr(store)[1072+8+len(flag_so_far)+1]=ord(pair[1]) + +def count_match(): + count = 0 + while memory.data_ptr(store)[1024+count] == memory.data_ptr(store)[1072+count]: + count += 1 + return count + +flag = "picoCTF{0123456789abcdef123456789abcdef}" +flag_chars = string.ascii_lowercase + string.digits + "_}\x00 " +flag_so_far = "" +for i in range(24): + for j in itertools.product(flag_chars, repeat=2): + init_flag(j) + check_flag(store) + if count_match() >= 10 + len(flag_so_far): + flag_so_far += (j[0]+j[1]) + print("picoCTF{" + flag_so_far) + break +