This was one of the first CTFs I've competed in, and I'm pretty happy with the performance we obtained. I worked on two problems, one which I didn't get in the end. But it was still a great learning experience. I definitely got carried by the other people in my team, who did really well in the pwn section.

Problem 1 - Secret Array

TL;DR

• use pwntools to interface with the IP and port, not netcat, as there is no easy way to pipe python output to netcat
• DON'T name your file something generic like pwn.py or numbers.py, as those are internally used by pwntools, and will result in failures DX
• don't overengineer your answers, occam's razor
• installation steps:

The problem was hosted in a server, and netcat was used to access it. nc secretarray.fword.wtf 1337

The problem stated that there were 1337 unknown numbers in an array, and we were allowed to query the server with 2 valid indices, which would return the sum of the two numbers in the array at those indices. We were allowed to query the server 1337 times.

At first glance, I immediately felt like this would be a great opportunity to use np.linalg.solve, as the problem was essentially a really big simultaneous equations problem, so at first I made arbitrary guesses of the form:

This yielded a list of 1337 numbers, which I turned into a numpy array. I also converted my guesses into a numpy matrix like so:

However, I immediately realised this wasn't going to work when I was getting floats as my answers...

So instead, I decided to rethink my strategy, since the simulataneous equations were quite simple:

• Let every element in the array be labelled like $a_{i}, i \in 1,2,...,N, \text{where } N=1337$.
• Thinking for a simple case, where $N=3$, we see that for the following chosen indices:

$$ \begin{cases} a_0 + a_1 = b_0 \qquad (1)\ a_0 + a_2 = b_1 \qquad (2)\ a_1 + a_2 = b_2 \qquad (3) \end{cases} $$

• We can simply solve these by computing $(1)-(2) \equiv a_1 - a_2 = b_0 - b_1$, adding this to $(3)$, we obtain

$$ \begin{cases} a_0 = b_0 - a_1 \ a_1 = \frac{b_0 - b_1 + b_2}{2} \ a_2 = b_0 - a_2 \end{cases} $$

By solving this simplest case, we get a values for $a_0, a_1, a_2$ and we can easily extend this scenario to $N=4$ by taking the 4th simultaneous equation to be

$$ \begin{aligned} a_2 + a_3 &= b_3 \ \therefore a_3 &= b_3 - a_2 \end{aligned} $$

So I just coded this:

Now, when I was trying to get pwntools to work, I had made the moronically called the file pwn.py which was an internal file used in pwntools, so it failed, I eventually got my friend to run the code above and he got the flag :S.

Problem 2 - Directory Manager

This one was really hard and involved a Server Side Template Injection in python. I didn't get it this time, but here are some things I found out that might prove useful in later CTFs.

Recon

I just kept trying different inputs, here are some examples of what I got

Some more examples include:

Ultimately, from the output interpretations of dir and file, I was pretty sure python code was executing. However, interestingly any input that contained the letter 's' would fail with Thank you !.

Intro to SSTI

In a previous challenge, I performed Server Side Template Injection (SSTI) and remote code execution (RCE) through a Flask template input by exploiting the fact that file is a built in type, and that there were certain builtin class functions that let you go from any one class to any other class.

Here, we can abuse the .__class__ method to obtain a reference to the list object type.

We can go further and obtain the object class like so.

We can actually find the file type, by taking the 40th element in this list:

And finally, we can use this type as a function to read and print a file.

no 's'

Now you can probably see why banning the letter 's' would be problematic, as the letter 's' appears in all the builtin functions we used to grab the file type.

However, fear not, as security engineers always find a way!

I found I was able to evaluate the dir() function if it was contained in a list, and lo and behold! the first element of this list has the letter 's' in it~

I grabbed this 's' to see if it would pass whatever black listing was happening behind the scenes:

Bingo. Now, I just used the string format function to craft the payload shown in the previous section:

Although I was able to read /etc/passwd, as well as some other common files like .bashrc, without access to the os library, I was unnable to get a list of the directory, to know which file to target.

Failures

I tried a lot of different things, here's how they worked out:

• I can eval but I am blacklisted from running exec, or running eval(compile()), which means I cannot import.
• I can use __import__(os).listdirs() but this is blocked from running, and black listed. Really, I spent a few hours testing random directories and possible file names for the flag, but without access to ls, I am really at a loss for knowing which file to target. Hence I was unable to get the flag in the end.