Hacker-Blog

bsidestlv

Wed, 26 Jun 2024 00:00:00 +0000

Dungeon

Name: Dungeon
Description: Enter the Dungeon to find the Pixelated Flag! It has been broken to 3 pieces, can you find them all?
Category: Reverse Engineering

Author: Liam Troper

This one was quite defecault but after amount of time & effort I finally did that.

when unzipping the challenge a huge amount of code is revealed it was pretty large and I even didn’t know were to start while there is a readme in this folder which showed a title and a link to a site

Shattered Pixel Dungeon and the link Shattered Pixel Dungeon so I enter to the site and downloaded the code from GitHub.

thinking of this as a patch analysis so diff command for the rescue

➜  Dungeon git:(master) ✗ diff -r shattered-pixel-dungeon differ
Only in shattered-pixel-dungeon: .git
Only in differ: .gradle
Only in differ: .idea
Only in differ: ClickMeToPlay.jar
Only in differ: ClickMeToPlay.jar.cache
Only in differ/SPD-classes: build
diff --color -r shattered-pixel-dungeon/build.gradle differ/build.gradle
16,17c16,17
<         appName = 'Shattered Pixel Dungeon'
<         appPackageName = 'com.shatteredpixel.shatteredpixeldungeon'
---
>         appName = 'BSides Shattered Pixel Dungeon'
>         appPackageName = 'com.bsides.bsidesshatteredpixeldungeon'
Only in differ/core: .gradle
Only in differ/core: build
diff --color -r shattered-pixel-dungeon/core/src/main/assets/messages/journal/journal.properties differ/core/src/main/assets/messages/journal/journal.properties
8,9c8,9
< journal.document.adventurers_guide.identifying.title=Identifying Items
< journal.document.adventurers_guide.identifying.body=You won't know all of the properties of some items when you first find them.\n\nThe colors of potions and symbols on scrolls are different in each dungeon. Unidentified equipment can be upgraded or enchanted if you're lucky, or it might be cursed!\n\nScrolls of identify, upgrade, or remove curse are very useful if you want to reduce the risk of using unidentified equipment.\n\n(You can find a list of all the items you've identified in the items tab of your journal)
---
> journal.document.adventurers_guide.identifying.title=Identifying Items And Flags (BSides Edition)
> journal.document.adventurers_guide.identifying.body=You won't know all of the properties of some items when you first find them.\n\nThe colors of potions and symbols on scrolls are different in each dungeon. Unidentified equipment can be upgraded or enchanted if you're lucky, or it might be cursed!\n\nScrolls of identify, upgrade, or remove curse are very useful if you want to reduce the risk of using unidentified equipment.\n\n(You can find a list of all the items you've identified in the items tab of your journal)\n\n(H30n)
Binary files shattered-pixel-dungeon/core/src/main/assets/sprites/items.png and differ/core/src/main/assets/sprites/items.png differ
diff --color -r shattered-pixel-dungeon/core/src/main/java/com/shatteredpixel/shatteredpixeldungeon/Dungeon.java differ/core/src/main/java/com/shatteredpixel/shatteredpixeldungeon/Dungeon.java
220c220,246
<
---
>
>
>     public static String customDecrypt(char[] encText, String key) {
>         StringBuilder result = new StringBuilder();
>         int keyIndex = 0;
>         int keyLength = key.length();
>
>         for (int i = 0; i < encText.length; i++) {
>             char encChar = encText[i];
>             int k = key.charAt(keyIndex);
>             char decChar = (char) (((encChar - i) ^ k) - i % 256);
>             result.append(decChar);
>             keyIndex = (keyIndex + 1) % keyLength;
>         }
>
>         return result.toString();
>     }
>
>     public static void main(String[] args) {
>         char[] encText = {'3', '', '*', 'b', '/', 'K', 'h', '\\', 'Ñ', 'b', ')', 'b', '8', 'S', '/', ''};
>               String ky = "items + journal + key";
>
>         String decryptedText = customDecrypt(encText, ky);
>         System.out.println("Decrypted: " + decryptedText);
>       }
>
>
diff --color -r shattered-pixel-dungeon/core/src/main/java/com/shatteredpixel/shatteredpixeldungeon/items/keys/SkeletonKey.java differ/core/src/main/java/com/shatteredpixel/shatteredpixeldungeon/items/keys/SkeletonKey.java
36c36,38
<
---
>
>       private static String k3 = "U1ci";
>
Only in differ/desktop: .gradle
Only in differ/desktop: build
Only in differ/ios: robovm.properties
Only in differ: local.properties
Only in differ/services: build
Only in differ/services/news/shatteredNews: build
Only in differ/services/updates/githubUpdates: build

There is a decrypt function customDecrypt(char[] encText, String key) while running it in a java env with String ky = "items + journal + key"; we get Gibberish

Decrypted: ZpK/TaCn?-`6?B

So sure this isn’t correct checking items.png in HexDump didn’t reveal much but sure it has some changes after checking carefully the differences between both images we found the change

so we can see P4N7 but the image is called items.png and the key is String ky = "items + journal + key"; so we got items now we need journal and key both of them is in the diff output

\n\n(H30n)

>       private static String k3 = "U1ci";

combing them all we get String ky = "P4N7H30nU1ci"; after running this we get this c0de_pL4?_r3pea7

the question mark doesn’t fit so we change it to y c0de_pL4y_r3pea7 adding the prefix and we got the flag

BSidesTLV2024{c0de_pL4y_r3pea7}

N0PSctf

Sun, 02 Jun 2024 00:00:00 +0000

Reverse Me

Name: Reverse Me
Description: Don’t complain if you can’t see me, because I have to be reversed to make me run 🙃
Category: Reverse

Author: Simone Aonzo

This is how the Reverse Me challenge was solved the that was included were called img.jpg why image file in a reversing challenge but lets check.

if we tried to see the image windows viewer can’t show this.

✗ strings img.jpg
...
atador.
inif.
txet.
ces.tlp.
tog.tlp.
tini.
tlp.aler.
nyd.aler.
5.2.2_CBILG
43.2_CBILG
4.2_CBILG
liaf_khc_kcats__
tixe
...

We can see some strings are related to elf files so checking with HexDump

✗ xxd img.jpg   
00003870: 0000 0000 0000 1310 0000 0001 003e 0003  .............>..
00003880: 0000 0000 0000 0000 0001 0102 464c 457f  ............FLE.

It seems an elf file that was reversed and now the description was clear

So now we need to reverse the bytes:

✗ emit img.jpg | /home/ubuntu/.local/bin/rev | dump img.elf

so we opened the file in IDA, and I was struggling to find the correct code on how to find what was the flag, but the function sub_401460 was receiving argv from user

the decrypt_me_flag seems like it calculate and print the flag, so I wasn’t sure so I tried to make the func sub_401460 to return true by satisfying the 4 equation that we can see here:

In order to decrypt equations there is a tool by microsoft named z3:

In [1]: from z3 import *
   ...:
   ...: # Define variables
   ...: arg_1, arg_2, arg_3, arg_4 = Ints('arg_1 arg_2 arg_3 arg_4')
   ...:
   ...: # Define the equations
   ...: eq1 = 3 * arg_4 + arg_3 + 4 * arg_2 - 10 * arg_1 == 28
   ...: eq2 = And(9 * arg_2 - 8 * arg_1 + 6 * arg_3 - 2 * arg_4 == 72, arg_4 - 3 * arg_2 - 2 * arg_1 - 8 * arg_3 == 29)
   ...: eq3 = arg_3 + 5 * arg_1 + 7 * arg_2 - 6 * arg_4 == 88
   ...:
   ...: # Create solver
   ...: solver = Solver()
   ...:
   ...: # Add equations to the solver
   ...: solver.add(eq1)
   ...: solver.add(eq2)
   ...: solver.add(eq3)
   ...:
   ...: # Check satisfiability and get the result
   ...: if solver.check() == sat:
   ...:     model = solver.model()
   ...:     print("arg_1 =", model[arg_1])
   ...:     print("arg_2 =", model[arg_2])
   ...:     print("arg_3 =", model[arg_3])
   ...:     print("arg_4 =", model[arg_4])
   ...: else:
   ...:     print("No solution exists.")
   ...:
arg_1 = -3
arg_2 = 8
arg_3 = -7
arg_4 = -9

and we got the results it was strange to see that some of the values were negative so I tried to force z3 to print only positive but the result was unsat so I tried to run the challenge with those result hopefully it will work and it does:

➜  tmp git:(master) ✗ ./img.elf_patched -3 8 -7 -9
N0PS{r1CKUNr0111N6}

Meaningful Noise

Name: Meaningful Noise
Description: iz dat a qRcOdE?
Category: Misc

Author: algorab

we get an image that looks like that

I used this script to get a sense of what the image pixels are:

from PIL import Image
import sys
im = Image.open(sys.argv[1])
bands = ''.join(im.getbands())
width, height = im.size
pre=''
for h in range(height):
	for w in range(width):
		pixels = im.getpixel((w,h))
		if bands=='RGBA':
			r,g,b,a = pixels
			print (r,g,b,a)
		elif bands=='RGB':
			r,g,b = pixels
			print (r,g,b)
		else:
			print (pixels)
	print

we got only 0 and 255:

➜  Meaningful Noise ✗ python3 pixels.py pxls.png | sort | uniq
0
255

so I tried to change the 255 to 1 (IDK why; just tried) and I put the input in CyberChef to try if we can extract something from that

and indeed it was: