Our good friends at Interrupt Labs have made this challenge.
Solution
Decompile the wasm file using Ghidra. Looks at export and we can see unlock function.
pbVar2[0] is our input and pbVar2[0x100] and pbVar2[0x200] are static values. So we can easily get the flag by xoring those static values. We can see those static values through chrome debuggger.
Flag:
Gone Fishing (491 Pts)
Description
-
Solution
Given ELF 64 bit, decompile using IDA.
From code above we can see that the hash and encrypt function are executed to generate the ciphertext that will be processed with our input. So we can said that ciphertext is static value and we can focus to the next step. The next encrypt process is reverseable, the idea is the core of encryption is on input[j + v24] ^= ciphertext[j] so we need to get the exact same ciphertext[j] like the encrypt process. Because ciphertext[j+1] is chained with input[j] that has been xored and we know those value we can easily write the solver. Following is my solver
My Lucky Number (499 Pts)
Description
Can you guess my lucky number?
Solution
Given ELF 64-bit file, decompile it using IDA.
Main function basically set a handler for segmentation fault and then call funky function. In main there is no something that likely will trigger segfault error but if we take a look on funky function we gonna see something suspicious.
funky function basically will add RDI (our input) to the value stoed in stack. Value stored in stack is PIE address + 0x134a. Then, if retn instruction executed it will jump to the address stored in stack/rsp. So basically the result of addition with our argument will be used as the next instruction address funky function. After retn instruction we can see that there are suspicious instructions that never executed but doesn't looks like a "good" instruction in this case because when we see in main function, we can see that the value that will be passed to printf is the value returned by funky function (rax)
So in this case we need to find the "correct" address that will give valid rax value after funky function called. IDA or another disassembler will try to do disassembly for an address from start, so there is possibility that the instruction on 0x1353 is not actually started on 0x1353, and this kind of mechanism is widely used as an anti disassembly technique. Let's try to decode the instruction from different start.
We can see that if we move a byte (started from 0x1354) it will shown another valid instruction which looks like legit instruction for this case. Because in the end it will fill rax value. Now, we just need to find the correct value to jump to PIE + 0x1354 which we can do it manually.
Flag: GooseCTF{iharcbh}
VvmM (500 Pts)
Description
VMs? I was in a VM once, it had lots of instructions, bytecode instructions, bytecode Instructions with arguments, and bytecode instructions make VMs. VMs? I was in a VM once, it had lots of instructions, bytecode instructions, bytecode Instructions with arguments, and bytecode instructions make VMs. VMs? I was in a VM once, it had lots of instructions, bytecode instructions, bytecode Instructions with arguments, and bytecode instructions make VMs. VMs? I was in a VM once, it had lots of instructions, bytecode instructions, bytecode Instructions with arguments, and bytecode instructions make VMs.
Solution
TBU
Wasm 2 (500 Pts)
Description
Our good friends at Interrupt Labs have made this challenge.
Solution
TBU
TBU
Wasm 3 (500 Pts)
Description
Our good friends at Interrupt Labs have made this challenge.
