15 | Get me! (if you're authorized) 16 |
17 | 21 | 22 | -------------------------------------------------------------------------------- /angstromctf-2018/gif/frames/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gif/frames/1.png -------------------------------------------------------------------------------- /angstromctf-2018/gif/frames/2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gif/frames/2.png -------------------------------------------------------------------------------- /angstromctf-2018/gif/frames/3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gif/frames/3.png -------------------------------------------------------------------------------- /angstromctf-2018/gif/frames/4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gif/frames/4.png -------------------------------------------------------------------------------- /angstromctf-2018/gif/frames/5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gif/frames/5.png -------------------------------------------------------------------------------- /angstromctf-2018/gif/frames/6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gif/frames/6.png -------------------------------------------------------------------------------- /angstromctf-2018/gif/frames/7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gif/frames/7.png -------------------------------------------------------------------------------- /angstromctf-2018/gif/frames/8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gif/frames/8.png -------------------------------------------------------------------------------- /angstromctf-2018/gif/jiggs.gif: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gif/jiggs.gif -------------------------------------------------------------------------------- /angstromctf-2018/gmx/flag.enc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gmx/flag.enc -------------------------------------------------------------------------------- /angstromctf-2018/gmx/gmx.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gmx/gmx.zip -------------------------------------------------------------------------------- /angstromctf-2018/gmx/pk: -------------------------------------------------------------------------------- 1 | 27139103193315339033295636715287379876477458783710062142205491300228004967766582251229537073734060833345520109174649072439873894733882892336500884194503295874665631235172074932338049458979878433449939014526122448747869757614155055798280696101995779133135539070534667459247143654178469066050923702501148113818831962558374543364216291806419723367604403166071401864212498515798828892056556847106214152329306561136993545777080985800003647839225708244240752559239395234227513969117455886656146452545473657096677996906385062466940390467974519521568124312000377355286888015894223593537028705723979629868785930928055401862219 2 | 1003377402037839312498279941872590022992677681881257552267834610687786674873089513440701146957514498832266202237382192589259606460260982639655327038371835455117206275125879515350674281844373470679607294414881557052918597693388200449536535848481157543139504436706073674458691763531717148017691454832653363454585066393344522827181847831686013131875151472358458150040124483409012487777043219934321027193030173405263380102768429109685851372467312821837342771188467544345404843024196244832596185429810161005820350198902609223228650945120670893743534262637423095651964238175498110713944181633922912779616269645761065657810 -------------------------------------------------------------------------------- /angstromctf-2018/gmx/problem.yml: -------------------------------------------------------------------------------- 1 | title: gmx 2 | author: defund 3 | value: 160 4 | text: | 5 | defund created a nonconformist hybrid cryptosystem. He even 6 | made a service running at `web.angstromctf.com:3000`; here's 7 | the [public key]({{ pk }}). All you have to do is decrypt 8 | this [flag]({{ flag.enc }}), which was encrypted with this 9 | [key]({{ key.enc }}). We've also provided the relevant 10 | [source code]({{ gmx.zip }}). 11 | Note: connect with netcat or an equivalent tool. 12 | hint: Good luck! 13 | flag: actf{a_bit_of_homomorphism} 14 | files: 15 | - flag.enc 16 | - gmx.zip 17 | - key.enc 18 | - pk 19 | deploy: 20 | type: docker 21 | ports: 22 | 3000: 3000 -------------------------------------------------------------------------------- /angstromctf-2018/gmx/source/aes.py: -------------------------------------------------------------------------------- 1 | from Crypto import Random 2 | from Crypto.Cipher import AES 3 | 4 | def encrypt(k, m): 5 | iv = Random.new().read(16) 6 | cipher = AES.new(k, AES.MODE_CFB, iv) 7 | return iv + cipher.encrypt(m) 8 | 9 | def decrypt(k, c): 10 | cipher = AES.new(k, AES.MODE_CFB, c[:16]) 11 | return cipher.decrypt(c[16:]) -------------------------------------------------------------------------------- /angstromctf-2018/gmx/source/flag: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gmx/source/flag -------------------------------------------------------------------------------- /angstromctf-2018/gmx/source/flag.enc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/gmx/source/flag.enc -------------------------------------------------------------------------------- /angstromctf-2018/gmx/source/gen.py: -------------------------------------------------------------------------------- 1 | from Crypto import Random 2 | 3 | import aes 4 | import gm 5 | 6 | flag = open('flag').read() 7 | 8 | key = Random.new().read(16) 9 | pk, sk = gm.generate() 10 | 11 | encflag = aes.encrypt(key, flag) 12 | enckey = gm.encrypt(key, pk) 13 | 14 | with open('pk', 'w') as f: 15 | f.write('\n'.join([str(x) for x in pk])) 16 | 17 | with open('sk', 'w') as f: 18 | f.write('\n'.join([str(x) for x in sk])) 19 | 20 | with open('key.enc', 'w') as f: 21 | f.write('\n'.join([str(x) for x in enckey])) 22 | 23 | with open('flag.enc', 'w') as f: 24 | f.write(encflag) -------------------------------------------------------------------------------- /angstromctf-2018/gmx/source/gm.py: -------------------------------------------------------------------------------- 1 | from Crypto.Util.number import * 2 | from gmpy2 import legendre 3 | 4 | def generate(): 5 | p = getStrongPrime(1024) 6 | q = getStrongPrime(1024) 7 | n = p*q 8 | x = getRandomRange(0, n) 9 | while legendre(x, p) != -1 or legendre(x, q) != -1: 10 | x = getRandomRange(0, n) 11 | return (n, x), (p, q) 12 | 13 | def encrypt(m, pk): 14 | n, x = pk 15 | for b in format(int(m.encode('hex'), 16), 'b').zfill(len(m) * 8): 16 | y = getRandomRange(0, n) 17 | yield pow(y, 2) * pow(x, int(b)) % n 18 | 19 | def decrypt(c, sk): 20 | p, q = sk 21 | m = 0 22 | for z in c: 23 | m <<= 1 24 | if legendre(z % p, p) != 1 or legendre(z % q, q) != 1: 25 | m += 1 26 | h = '%x' % m 27 | l = len(h) 28 | return h.zfill(l + l % 2).decode('hex') -------------------------------------------------------------------------------- /angstromctf-2018/gmx/source/message: -------------------------------------------------------------------------------- 1 | Hi, this is defund and you're reading my super secret message! Unfortunately, getting this message is not the challenge whatsoever. I don't have much else to talk about, so I guess follow me at github.com/defund, twitter.com/defunded, and keybase.io/defund. 2 | 3 | Also, here's a fake flag that you're going to submit anyways: 4 | actf{this_is_a_fake_flag} 5 | 6 | Good luck with the challenge! ;) -------------------------------------------------------------------------------- /angstromctf-2018/gmx/source/pk: -------------------------------------------------------------------------------- 1 | 27139103193315339033295636715287379876477458783710062142205491300228004967766582251229537073734060833345520109174649072439873894733882892336500884194503295874665631235172074932338049458979878433449939014526122448747869757614155055798280696101995779133135539070534667459247143654178469066050923702501148113818831962558374543364216291806419723367604403166071401864212498515798828892056556847106214152329306561136993545777080985800003647839225708244240752559239395234227513969117455886656146452545473657096677996906385062466940390467974519521568124312000377355286888015894223593537028705723979629868785930928055401862219 2 | 1003377402037839312498279941872590022992677681881257552267834610687786674873089513440701146957514498832266202237382192589259606460260982639655327038371835455117206275125879515350674281844373470679607294414881557052918597693388200449536535848481157543139504436706073674458691763531717148017691454832653363454585066393344522827181847831686013131875151472358458150040124483409012487777043219934321027193030173405263380102768429109685851372467312821837342771188467544345404843024196244832596185429810161005820350198902609223228650945120670893743534262637423095651964238175498110713944181633922912779616269645761065657810 -------------------------------------------------------------------------------- /angstromctf-2018/gmx/source/server.py: -------------------------------------------------------------------------------- 1 | import base64 2 | import signal 3 | import SocketServer 4 | 5 | import aes 6 | import gm 7 | 8 | PORT = 3000 9 | 10 | message = open('message').read() 11 | 12 | with open('sk') as f: 13 | p = int(f.readline()) 14 | q = int(f.readline()) 15 | sk = (p, q) 16 | 17 | class incoming(SocketServer.BaseRequestHandler): 18 | def handle(self): 19 | req = self.request 20 | 21 | def receive(): 22 | buf = '' 23 | while not buf.endswith('\n'): 24 | buf += req.recv(1) 25 | return buf[:-1] 26 | 27 | signal.alarm(60) 28 | 29 | req.sendall('Welcome to the Goldwasser-Micali key exchange!\n') 30 | req.sendall('Please send us an encrypted 128 bit key for us to use.\n') 31 | req.sendall('Each encrypted bit should be sent line by line in integer format.\n') 32 | 33 | enckey = [] 34 | for i in range(128): 35 | enckey.append(int(receive())) 36 | key = gm.decrypt(enckey, sk) 37 | encmessage = aes.encrypt(key, message) 38 | 39 | req.sendall(base64.b64encode(encmessage)+'\n') 40 | req.close() 41 | 42 | class ReusableTCPServer(SocketServer.ForkingMixIn, SocketServer.TCPServer): 43 | pass 44 | 45 | SocketServer.TCPServer.allow_reuse_address = True 46 | server = ReusableTCPServer(('0.0.0.0', PORT), incoming) 47 | 48 | print 'Server listening on port %d' % PORT 49 | server.serve_forever() -------------------------------------------------------------------------------- /angstromctf-2018/gmx/source/sk: -------------------------------------------------------------------------------- 1 | 163415157591285816256651589583051606955378305062040932586128036345373046483526341686069417785596843739368770921445133884861156984135306248763371093641706584930012796396414128919756345730221558065993148624600115640784898335593931433989814418738782772188669473077552691932038467327700292332942233485799597154327 2 | 166074577128226833552249945798825560509005177753851489292248567060376030402587435952586469014868269277455551109596049448100775873740968293341361410224831610710886556392907241049286883510989001159314754794449580492471299251109401708717756219929697627895361073929687517626331274843096497596683079777497415727597 -------------------------------------------------------------------------------- /angstromctf-2018/md5/index.php: -------------------------------------------------------------------------------- 1 | 13 | 14 | 15 | 16 |17 | People say that MD5 is broken... But they're wrong! All I have to do is use a secret salt. >:) 18 |
19 |20 | If you can find two distinct strings that—when prepended with my salt—have the same MD5 hash, I'll give you a flag. Deal? 21 |
22 |23 | Also, here's the source. 24 |
25 | 32 | 33 | -------------------------------------------------------------------------------- /angstromctf-2018/md5/secret.php: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /angstromctf-2018/md5/src/index.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 7 | 8 | -------------------------------------------------------------------------------- /angstromctf-2018/ofb/README.md: -------------------------------------------------------------------------------- 1 | The object of this challenge is to decrypt `flag.png.enc`, which was encrypted with `encrypt.py`. The encryption appears to be a stream cipher. Unfortunately, the stream is not properly randomized; every 4 bytes is the output of a linear congruential generator (LCG). 2 | 3 | The LCG's parameters are largely unknown, with the exception of the modulus. However, it is possible to recover the others with three consecutive outputs of the LCG; see `source/decrypt.py` for details. We can obtain these three outputs from the known header data of a `PNG` file, which we xor with `flag.png.enc` to produce part of the keystream. 4 | 5 | Given that we know all of the LCG parameters, we can produce the rest of the keystream, xor it with `flag.png.enc`, and decrypt the file. A full solve script is in `source/decrypt.py`. -------------------------------------------------------------------------------- /angstromctf-2018/ofb/encrypt.py: -------------------------------------------------------------------------------- 1 | import struct 2 | 3 | def lcg(m, a, c, x): 4 | return (a*x + c) % m 5 | 6 | m = pow(2, 32) 7 | 8 | with open('lcg') as f: 9 | a = int(f.readline()) 10 | c = int(f.readline()) 11 | x = int(f.readline()) 12 | 13 | d = open('flag.png').read() 14 | d += '\x00' * (-len(d) % 4) 15 | d = [d[i:i+4] for i in range(0, len(d), 4)] 16 | 17 | e = '' 18 | for i in range(len(d)): 19 | e += struct.pack('>I', x ^ struct.unpack('>I', d[i])[0]) 20 | x = lcg(m, a, c, x) 21 | 22 | with open('flag.png.enc', 'w') as f: 23 | f.write(e) 24 | f.close() -------------------------------------------------------------------------------- /angstromctf-2018/ofb/flag.png.enc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/ofb/flag.png.enc -------------------------------------------------------------------------------- /angstromctf-2018/ofb/problem.yml: -------------------------------------------------------------------------------- 1 | title: ofb 2 | author: defund 3 | value: 120 4 | text: | 5 | defund made a simple OFB cipher, if you can even call it 6 | that. Here's the [source]({{ encrypt.py }}) and the 7 | [encrypted flag]({{ flag.png.enc }}). 8 | hint: Good luck! 9 | flag: actf{pad_rng} 10 | files: 11 | - encrypt.py 12 | - flag.png.enc 13 | -------------------------------------------------------------------------------- /angstromctf-2018/ofb/source/decrypt.py: -------------------------------------------------------------------------------- 1 | import struct 2 | import gmpy2 3 | 4 | def lcg(m, a, c, x): 5 | return (a*x + c) % m 6 | 7 | def xor(x, y): 8 | return struct.unpack('>I', x)[0] ^ struct.unpack('>I', y)[0] 9 | 10 | m = pow(2, 32) 11 | 12 | k = open('known').read() 13 | k = [k[i:i+4] for i in range(0, len(k), 4)] 14 | 15 | e = open('flag.png.enc').read() 16 | e = [e[i:i+4] for i in range(0, len(e), 4)] 17 | 18 | x0 = xor(k[0], e[0]) 19 | x1 = xor(k[1], e[1]) 20 | x2 = xor(k[2], e[2]) 21 | 22 | a = ((x1-x2) % m) * gmpy2.powmod(x0-x1, -1, m) % m 23 | c = (x1 - a*x0) % m 24 | x = x0 25 | 26 | d = '' 27 | for i in range(len(e)): 28 | d += struct.pack('>I', x ^ struct.unpack('>I', e[i])[0]) 29 | x = lcg(m, a, c, x) 30 | 31 | with open('flag.png', 'w') as f: 32 | f.write(d) 33 | f.close() -------------------------------------------------------------------------------- /angstromctf-2018/ofb/source/encrypt.py: -------------------------------------------------------------------------------- 1 | import struct 2 | 3 | def lcg(m, a, c, x): 4 | return (a*x + c) % m 5 | 6 | m = pow(2, 32) 7 | 8 | with open('lcg') as f: 9 | a = int(f.readline()) 10 | c = int(f.readline()) 11 | x = int(f.readline()) 12 | 13 | d = open('flag.png').read() 14 | d += '\x00' * (-len(d) % 4) 15 | d = [d[i:i+4] for i in range(0, len(d), 4)] 16 | 17 | e = '' 18 | for i in range(len(d)): 19 | e += struct.pack('>I', x ^ struct.unpack('>I', d[i])[0]) 20 | x = lcg(m, a, c, x) 21 | 22 | with open('flag.png.enc', 'w') as f: 23 | f.write(e) 24 | f.close() -------------------------------------------------------------------------------- /angstromctf-2018/ofb/source/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/ofb/source/flag.png -------------------------------------------------------------------------------- /angstromctf-2018/ofb/source/flag.png.enc: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/ofb/source/flag.png.enc -------------------------------------------------------------------------------- /angstromctf-2018/ofb/source/gen.py: -------------------------------------------------------------------------------- 1 | import random 2 | 3 | m = pow(2, 32) 4 | a = random.randint(0, m) 5 | c = random.randint(0, m) 6 | x = random.randint(0, m) 7 | 8 | with open('lcg', 'w') as f: 9 | f.write('{}\n{}\n{}'.format(a, c, x)) -------------------------------------------------------------------------------- /angstromctf-2018/ofb/source/known: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/ofb/source/known -------------------------------------------------------------------------------- /angstromctf-2018/ofb/source/lcg: -------------------------------------------------------------------------------- 1 | 3204287424 2 | 1460809397 3 | 2445943554 -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/README.md: -------------------------------------------------------------------------------- 1 | The object of this challenge is to print the flag located in `mix.exs` on the server. The relevant code is within `utility.ex`: 2 | 3 | ```elixir 4 | defmodule Utility do 5 | 6 | def access(filename) do 7 | unsafe = "pastes/" <> filename <> ".txt" 8 | path = filter(unsafe <> <<0>>, "", String.length(unsafe)) 9 | case File.read path do 10 | {:ok, content} -> content 11 | {:error, reason} -> "File not found.\n" 12 | end 13 | end 14 | 15 | def filter(<< head, tail :: binary >>, acc, n) do 16 | if n == 0 do 17 | acc 18 | else 19 | n = n - 1 20 | if head < 33 or head > 126 do 21 | filter(tail, acc, n) 22 | else 23 | filter(tail, acc <> <>, n) 24 | end 25 | end 26 | end 27 | end 28 | ``` 29 | 30 | Firstly, notice that the service has a local file inclusion vulnerability; it does not have to read from the `pastes/` directory. However, it does append a `.txt` file extension. It then runs the `filter` function to remove any bytes with ASCII values outside of the 33-126 range. 31 | 32 | The bug in the code is that `String.length` returns the length of a Unicode string, while filter works byte by byte. If our filename has emojis, for example, it will prevent `filter` from reaching the `.txt`, effectively removing the file extension. `filter` will also remove the emoji bytes, thus leaving us with any filename. Thus, a valid payload would be `../mix.exs😀😀😀` -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/pastepalooza.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/defund/ctf/8c23b3dc12d4f5cccea50a5d6bd0420bfe5d0b4d/angstromctf-2018/pastepalooza/pastepalooza.zip -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/problem.yml: -------------------------------------------------------------------------------- 1 | title: paste palooza 2 | author: defund 3 | value: 150 4 | text: | 5 | defund made his own pastebin in a fancy programming language! 6 | As a true believer in open source projects, he also released 7 | the [source]({{ pastepalooza.zip }}). The service is running at 8 | `web.angstromctf.com:3001`. 9 | Note: connect with netcat or an equivalent tool. 10 | hint: Good luck! 11 | flag: actf{elixir_encoding} 12 | files: 13 | - pastepalooza.zip 14 | deploy: 15 | type: docker 16 | ports: 17 | 3001: 3001 18 | -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/source/.gitignore: -------------------------------------------------------------------------------- 1 | # The directory Mix will write compiled artifacts to. 2 | /_build/ 3 | 4 | # If you run "mix test --cover", coverage assets end up here. 5 | /cover/ 6 | 7 | # The directory Mix downloads your dependencies sources to. 8 | /deps/ 9 | 10 | # Where 3rd-party dependencies like ExDoc output generated docs. 11 | /doc/ 12 | 13 | # Ignore .fetch files in case you like to edit your project deps locally. 14 | /.fetch 15 | 16 | # If the VM crashes, it generates a dump, let's ignore it too. 17 | erl_crash.dump 18 | 19 | # Also ignore archive artifacts (built via "mix archive.build"). 20 | *.ez 21 | -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/source/config/config.exs: -------------------------------------------------------------------------------- 1 | # This file is responsible for configuring your application 2 | # and its dependencies with the aid of the Mix.Config module. 3 | use Mix.Config 4 | 5 | # This configuration is loaded before any dependency and is restricted 6 | # to this project. If another project depends on this project, this 7 | # file won't be loaded nor affect the parent project. For this reason, 8 | # if you want to provide default values for your application for 9 | # 3rd-party users, it should be done in your "mix.exs" file. 10 | 11 | # You can configure your application as: 12 | # 13 | # config :pastepalooza, key: :value 14 | # 15 | # and access this configuration in your application as: 16 | # 17 | # Application.get_env(:pastepalooza, :key) 18 | # 19 | # You can also configure a 3rd-party app: 20 | # 21 | # config :logger, level: :info 22 | # 23 | 24 | # It is also possible to import configuration files, relative to this 25 | # directory. For example, you can emulate configuration per environment 26 | # by uncommenting the line below and defining dev.exs, test.exs and such. 27 | # Configuration from the imported file will override the ones defined 28 | # here (which is why it is important to import them last). 29 | # 30 | # import_config "#{Mix.env}.exs" 31 | -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/source/lib/pastepalooza.ex: -------------------------------------------------------------------------------- 1 | defmodule PastePalooza do 2 | require Logger 3 | 4 | def accept(port) do 5 | {:ok, socket} = :gen_tcp.listen(port, [:binary, packet: :line, active: false, reuseaddr: true]) 6 | Logger.info "Accepting connections on port #{port}" 7 | loop_acceptor(socket) 8 | end 9 | 10 | defp loop_acceptor(socket) do 11 | {:ok, client} = :gen_tcp.accept(socket) 12 | serve(client) 13 | loop_acceptor(socket) 14 | end 15 | 16 | defp serve(socket) do 17 | write_line(socket, "Welcome to Paste Palooza!\n") 18 | write_line(socket, "Currently, only the file access feature is available.\n") 19 | write_line(socket, "Access a file by entering its name: ") 20 | {:ok, filename} = read_line(socket) 21 | response = Utility.access(filename) 22 | write_line(socket, response) 23 | :gen_tcp.close(socket) 24 | end 25 | 26 | defp read_line(socket) do 27 | :gen_tcp.recv(socket, 0) 28 | end 29 | 30 | defp write_line(socket, text) do 31 | :gen_tcp.send(socket, text) 32 | end 33 | end 34 | -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/source/lib/server.ex: -------------------------------------------------------------------------------- 1 | defmodule Server do 2 | use Application 3 | 4 | def start(_type, _args) do 5 | children = [ 6 | {Task.Supervisor, name: PastePalooza.TaskSupervisor}, 7 | Supervisor.child_spec({Task, fn -> PastePalooza.accept(3001) end}, restart: :permanent) 8 | ] 9 | 10 | opts = [strategy: :one_for_one, name: PastePalooza.Supervisor] 11 | Supervisor.start_link(children, opts) 12 | end 13 | end 14 | -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/source/lib/utility.ex: -------------------------------------------------------------------------------- 1 | defmodule Utility do 2 | 3 | def access(filename) do 4 | unsafe = "pastes/" <> filename <> ".txt" 5 | path = filter(unsafe <> <<0>>, "", String.length(unsafe)) 6 | case File.read path do 7 | {:ok, content} -> content 8 | {:error, reason} -> "File not found.\n" 9 | end 10 | end 11 | 12 | def filter(<< head, tail :: binary >>, acc, n) do 13 | if n == 0 do 14 | acc 15 | else 16 | n = n - 1 17 | if head < 33 or head > 126 do 18 | filter(tail, acc, n) 19 | else 20 | filter(tail, acc <> <>, n) 21 | end 22 | end 23 | end 24 | end -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/source/mix.exs: -------------------------------------------------------------------------------- 1 | defmodule PastePalooza.Mixfile do 2 | use Mix.Project 3 | 4 | def project do 5 | [ 6 | app: :pastepalooza, 7 | version: "0.1.0", 8 | elixir: "~> 1.5", 9 | start_permanent: Mix.env == :prod, 10 | deps: deps(), 11 | flag: "actf{elixir_encoding}" 12 | ] 13 | end 14 | 15 | # Run "mix help compile.app" to learn about applications. 16 | def application do 17 | [ 18 | extra_applications: [:logger], 19 | mod: {Server, []} 20 | ] 21 | end 22 | 23 | # Run "mix help deps" to learn about dependencies. 24 | defp deps do 25 | [ 26 | # {:dep_from_hexpm, "~> 0.3.0"}, 27 | # {:dep_from_git, git: "https://github.com/elixir-lang/my_dep.git", tag: "0.1.0"}, 28 | ] 29 | end 30 | end 31 | -------------------------------------------------------------------------------- /angstromctf-2018/pastepalooza/source/pastes/paste.txt: -------------------------------------------------------------------------------- 1 | paste palooza! -------------------------------------------------------------------------------- /angstromctf-2018/run-me/run_me.c: -------------------------------------------------------------------------------- 1 | #includeSecret Sheep Society Portal
9 |10 | __ _ 11 | .-.' `; `-._ __ _ 12 | (_, .-:' `; `-._ 13 | ,'o"( (_, ) 14 | (__,-' ,'o"( ) 15 | ( (__,-' ) 16 | `-'._.--._( ) 17 | ||| |||`-'._.--._.-' 18 | ||| ||| 19 |20 | {% if session %} 21 |
22 | Welcome, {{ session['handle'] }}. 23 | {% if session['admin'] %} 24 | The flag is {{ flag }}. 25 | {% else %} 26 | Unfortunately, only sheep in the highest echelons have access to the flag. 27 | {% endif %} 28 |
29 |