## Comments - Sad that I didn't manage to solve any challenges from the pwn category - Still a bit vexed about the flag formats (discussed under [fone](#fone)) - Many challenges will not be discussed because they were solved by my teammates - Regretted not taking any hints; was afraid they were useless and would waste points ## Noob's first time > It is the first time this villain noob is attempting to encode > information into a png file. Can you crack it? ```python # Python program to convert # numpy array to image # import required libraries import numpy as np from PIL import Image as im # define a main function def main(): #With file path, get file data and convert to array dataArray = [] with open("/home/kali/Desktop/Challenge1/flag/flag.txt", "r") as f: for line in f: for character in line: print(character) dataArray.append(ord(character)) print(dataArray) lengthOfData = len(dataArray) print(lengthOfData) counter = 0 while len(dataArray) < 102240: if (counter==lengthOfData):counter=0 dataArray.append(dataArray[counter]) counter+=1 # create a numpy array using array function. # 426 x 240 = 102240 is the amount of pixels. # np.uint8 is a data type containing # numbers ranging from 0 to 255 # and no non-negative integers #To insert array below array = np.array(dataArray, dtype=np.uint8) print(array) # check type of array print(type(array)) # our array will be of width # 102240 pixels That means it # will be a long dark line print(array.shape) # Reshape the array into a # familiar resolution # variable array to be replaced array = np.reshape(array, (426, 240)) # show the shape of the array print(array.shape) # show the array print(array) # creating image object of # above array dataInImage = im.fromarray(array) # saving the final output # as a PNG file dataInImage.save('flag.png') # driver code if __name__ == "__main__": # function call main() ``` `flag.png`: ![flag.png](/blog/files/2022/lag-and-crash-20-writeup/flag.png) Let's look at what `create.py` does: - Convert each flag character into a number (`ord()`) - Stores the numbers in an array - Repeat this array until its size is 102240 - Use PIL to convert it to an image We simply do the reverse: - Use numpy to convert the image back into a numpy array - Convert each number back into a character using `chr()` and join them together ```python ┌──(kali㉿kali)-[~/Downloads] └─$ python Python 3.9.11 (main, Mar 17 2022, 07:20:01) [GCC 11.2.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> from PIL import Image >>> pic = Image.open('flag.png') >>> import numpy >>> pix = numpy.array(pic) >>> pix array([[ 76, 78, 67, ..., 111, 98, 125], [ 76, 78, 67, ..., 111, 98, 125], [ 76, 78, 67, ..., 111, 98, 125], ..., [ 76, 78, 67, ..., 111, 98, 125], [ 76, 78, 67, ..., 111, 98, 125], [ 76, 78, 67, ..., 111, 98, 125]], dtype=uint8) >>> pix[0] array([ 76, 78, 67, 50, 48, 50, 50, 123, 103, 48, 48, 100, 49, 111, 98, 125, 76, 78, 67, 50, 48, 50, 50, 123, 103, 48, 48, 100, 49, 111, 98, 125, 76, 78, 67, 50, 48, 50, 50, ..., 50, 48, 50, 50, 123, 103, 48, 48, 100, 49, 111, 98, 125, 76, 78, 67, 50, 48, 50, 50, 123, 103, 48, 48, 100, 49, 111, 98, 125, 76, 78, 67, 50, 48, 50, 50, 123, 103, 48, 48, 100, 49, 111, 98, 125], dtype=uint8) >>> for i in pix[0]: ... print(chr(i), end='') ... LNC2022{g00d1ob}LNC2022{g00d1ob}...LNC2022{g00d1ob}LNC2022{g00d1ob} >>> ``` Flag: `LNC2022{g00d1ob}` ## LagnCrash 2.0 Superpower Hunt Level 1 & 2 > A superhero origin story where you set out to get superpowers > while you mourn the death of your cat, Lord Fuzzball. > Part 1 of the series! There's a 43MB ZIP file `SuperpowerHunt.zip` which contains a game made with Unity engine (C#). It's big and I don't think it's necessary to attach this ZIP file. Here's the directory tree of the extracted ZIP file in case you're curious: ```bash ┌──(kali㉿kali)-[~/Downloads] └─$ tree SuperpowerHunt SuperpowerHunt ├── direction_guidance.png ├── LagnCrash 2.0 Superpower Hunt_Data │ ├── app.info │ ├── boot.config │ ├── globalgamemanagers │ ├── globalgamemanagers.assets │ ├── level0 │ ├── level0.resS │ ├── Managed │ │ ├── Assembly-CSharp.dll │ │ ├── Mono.Security.dll │ │ ├── mscorlib.dll │ │ ├── netstandard.dll │ │ ├── Newtonsoft.Json.dll │ │ ├── System.ComponentModel.Composition.dll │ │ ├── System.Configuration.dll │ │ ├── System.Core.dll │ │ ├── System.Data.dll │ │ ├── System.Diagnostics.StackTrace.dll │ │ ├── System.dll │ │ ├── System.Drawing.dll │ │ ├── System.EnterpriseServices.dll │ │ ├── System.Globalization.Extensions.dll │ │ ├── System.IO.Compression.dll │ │ ├── System.IO.Compression.FileSystem.dll │ │ ├── System.Net.Http.dll │ │ ├── System.Numerics.dll │ │ ├── System.Runtime.Serialization.dll │ │ ├── System.Runtime.Serialization.Xml.dll │ │ ├── System.ServiceModel.Internals.dll │ │ ├── System.Transactions.dll │ │ ├── System.Xml.dll │ │ ├── System.Xml.Linq.dll │ │ ├── System.Xml.XPath.XDocument.dll │ │ ├── UnityEngine.AccessibilityModule.dll │ │ ├── UnityEngine.AIModule.dll │ │ ├── UnityEngine.AndroidJNIModule.dll │ │ ├── UnityEngine.AnimationModule.dll │ │ ├── UnityEngine.ARModule.dll │ │ ├── UnityEngine.AssetBundleModule.dll │ │ ├── UnityEngine.AudioModule.dll │ │ ├── UnityEngine.ClothModule.dll │ │ ├── UnityEngine.ClusterInputModule.dll │ │ ├── UnityEngine.ClusterRendererModule.dll │ │ ├── UnityEngine.CoreModule.dll │ │ ├── UnityEngine.CrashReportingModule.dll │ │ ├── UnityEngine.DirectorModule.dll │ │ ├── UnityEngine.dll │ │ ├── UnityEngine.DSPGraphModule.dll │ │ ├── UnityEngine.GameCenterModule.dll │ │ ├── UnityEngine.GIModule.dll │ │ ├── UnityEngine.GridModule.dll │ │ ├── UnityEngine.HotReloadModule.dll │ │ ├── UnityEngine.ImageConversionModule.dll │ │ ├── UnityEngine.IMGUIModule.dll │ │ ├── UnityEngine.InputLegacyModule.dll │ │ ├── UnityEngine.InputModule.dll │ │ ├── UnityEngine.JSONSerializeModule.dll │ │ ├── UnityEngine.LocalizationModule.dll │ │ ├── UnityEngine.ParticleSystemModule.dll │ │ ├── UnityEngine.PerformanceReportingModule.dll │ │ ├── UnityEngine.Physics2DModule.dll │ │ ├── UnityEngine.PhysicsModule.dll │ │ ├── UnityEngine.ProfilerModule.dll │ │ ├── UnityEngine.RuntimeInitializeOnLoadManagerInitializerModule.dll │ │ ├── UnityEngine.ScreenCaptureModule.dll │ │ ├── UnityEngine.SharedInternalsModule.dll │ │ ├── UnityEngine.SpriteMaskModule.dll │ │ ├── UnityEngine.SpriteShapeModule.dll │ │ ├── UnityEngine.StreamingModule.dll │ │ ├── UnityEngine.SubstanceModule.dll │ │ ├── UnityEngine.SubsystemsModule.dll │ │ ├── UnityEngine.TerrainModule.dll │ │ ├── UnityEngine.TerrainPhysicsModule.dll │ │ ├── UnityEngine.TextCoreModule.dll │ │ ├── UnityEngine.TextRenderingModule.dll │ │ ├── UnityEngine.TilemapModule.dll │ │ ├── UnityEngine.TLSModule.dll │ │ ├── UnityEngine.UI.dll │ │ ├── UnityEngine.UIElementsModule.dll │ │ ├── UnityEngine.UIElementsNativeModule.dll │ │ ├── UnityEngine.UIModule.dll │ │ ├── UnityEngine.UmbraModule.dll │ │ ├── UnityEngine.UNETModule.dll │ │ ├── UnityEngine.UnityAnalyticsModule.dll │ │ ├── UnityEngine.UnityConnectModule.dll │ │ ├── UnityEngine.UnityCurlModule.dll │ │ ├── UnityEngine.UnityTestProtocolModule.dll │ │ ├── UnityEngine.UnityWebRequestAssetBundleModule.dll │ │ ├── UnityEngine.UnityWebRequestAudioModule.dll │ │ ├── UnityEngine.UnityWebRequestModule.dll │ │ ├── UnityEngine.UnityWebRequestTextureModule.dll │ │ ├── UnityEngine.UnityWebRequestWWWModule.dll │ │ ├── UnityEngine.VehiclesModule.dll │ │ ├── UnityEngine.VFXModule.dll │ │ ├── UnityEngine.VideoModule.dll │ │ ├── UnityEngine.VirtualTexturingModule.dll │ │ ├── UnityEngine.VRModule.dll │ │ ├── UnityEngine.WindModule.dll │ │ ├── UnityEngine.XRModule.dll │ │ ├── Unity.TextMeshPro.dll │ │ └── Unity.Timeline.dll │ ├── Resources │ │ ├── unity_builtin_extra │ │ └── unity default resources │ ├── resources.assets │ ├── resources.assets.resS │ ├── RuntimeInitializeOnLoads.json │ ├── ScriptingAssemblies.json │ ├── sharedassets0.assets │ └── sharedassets0.assets.resS ├── LagnCrash 2.0 Superpower Hunt.exe ├── MonoBleedingEdge │ ├── EmbedRuntime │ │ ├── mono-2.0-bdwgc.dll │ │ └── MonoPosixHelper.dll │ └── etc │ └── mono │ ├── 2.0 │ │ ├── Browsers │ │ │ └── Compat.browser │ │ ├── DefaultWsdlHelpGenerator.aspx │ │ ├── machine.config │ │ ├── settings.map │ │ └── web.config │ ├── 4.0 │ │ ├── Browsers │ │ │ └── Compat.browser │ │ ├── DefaultWsdlHelpGenerator.aspx │ │ ├── machine.config │ │ ├── settings.map │ │ └── web.config │ ├── 4.5 │ │ ├── Browsers │ │ │ └── Compat.browser │ │ ├── DefaultWsdlHelpGenerator.aspx │ │ ├── machine.config │ │ ├── settings.map │ │ └── web.config │ ├── browscap.ini │ ├── config │ └── mconfig │ └── config.xml ├── UnityCrashHandler64.exe └── UnityPlayer.dll 14 directories, 131 files ┌──(kali㉿kali)-[~/Downloads] └─$ ``` I unzipped the file and wasted time looking at Assembly-CSharp.dll, thinking this was a CSharp disassembly challenge. Then I gave up and started looking for flags among the strings. I'm lucky that it worked out, and I even got 2 flags! ```bash ┌──(kali㉿kali)-[~/Downloads/SuperpowerHunt] └─$ grep -r 'LNC2022{' . grep: ./LagnCrash 2.0 Superpower Hunt_Data/level0: binary file matches ┌──(kali㉿kali)-[~/Downloads/SuperpowerHunt] └─$ strings './LagnCrash 2.0 Superpower Hunt_Data/level0' | grep 'LNC2022{' LNC2022{pUtt1ng_7he_p4sT_b3h1nd} LNC2022{4m_v3rY_h1Gh} LNC2022{0h_h3y_y0u_n0tic3d} ┌──(kali㉿kali)-[~/Downloads/SuperpowerHunt] └─$ ``` Flag: There are 3 flags and 2 of them are the flags to the challenges (though I can't remember which). Just try submitting each of them. 1. `LNC2022{pUtt1ng_7he_p4sT_b3h1nd}` 1. `LNC2022{4m_v3rY_h1Gh}` 1. `LNC2022{0h_h3y_y0u_n0tic3d}` ## REad thE linES > Supervillain Reece gave us this file. He believes that we can't > change what he did. Prove him wrong! We are given an 18KB executable called `REadthElinES`. ```bash ┌──(kali㉿kali)-[~/Downloads] └─$ file REadthElinES REadthElinES: ELF 64-bit LSB pie executable, x86-64,version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=3478f67b7925e6da2180ee15a7507dc8c5b3ef79, for GNU/Linux 3.2.0, not stripped ``` First thing is to always check `strings` and run the program: ```bash ┌──(kali㉿kali)-[~/Downloads] └─$ strings REadthElinES | grep 'LNC2022{' LNC2022{D1d_y0u88553s!! ┌──(kali㉿kali)-[~/Downloads] └─$ ./REadthElinES 130 ⨯ Enter the first password: A Wrong Password! ┌──(kali㉿kali)-[~/Downloads] └─$ ``` It's a password checker challenge. Seems like we are missing the second half of the flag. From Ghidra: ```c undefined8 main(void) { int iVar1; byte local_49; char local_48 [31]; char local_29; undefined8 local_28; undefined8 local_20; undefined2 local_18; int local_c; local_28 = 0x5f69393f5378397c; local_20 = 0x3a7d3f3f6b5a3978; local_18 = 0x6e58; local_29 = '\0'; for (local_c = 0; local_c < 0x12; local_c = local_c + 1) { local_49 = *(byte *)((long)&local_28 + (long)local_c) ^ 10; strncat(&local_29,(char *)&local_49,1); } printf("Enter the first password: "); __isoc99_scanf(&DAT_00102087,local_48); iVar1 = strcmp(&local_29,local_48); if (iVar1 == 0) { reee200(); } else { reee100(); } return 0; } ``` Looks like the program generates the correct password at runtime, then calls a different function if our input is correct. Let's go to GDB and try to get the password. ```asm ┌──(kali㉿kali)-[~/Downloads] └─$ gdb -q ./REadthElinES pwndbg> disass main Dump of assembler code for function main: 0x0000000000001c66 <+160>: call 0x1060 0x0000000000001c6b <+165>: test eax,eax 0x0000000000001c6d <+167>: je 0x1c7b 0x0000000000001c6f <+169>: mov eax,0x0 0x0000000000001c74 <+174>: call 0x175f 0x0000000000001c79 <+179>: jmp 0x1c85 0x0000000000001c7b <+181>: mov eax,0x0 0x0000000000001c80 <+186>: call 0x1bb6 0x0000000000001c85 <+191>: mov eax,0x0 0x0000000000001c8a <+196>: leave 0x0000000000001c8b <+197>: ret End of assembler dump. pwndbg> b *main+167 Breakpoint 1 at 0x1c6d pwndbg> r Starting program: /home/kali/Downloads/REadthElinES Enter the first password: A Breakpoint 1, 0x0000555555555c6d in main () pwndbg> tb reee200 Temporary breakpoint 2 at 0x555555555bba pwndbg> ju *main+181 Continuing at 0x555555555c7b. Temporary breakpoint 2, 0x0000555555555bba in reee200 () ───────────────────────────────────[ DISASM ]─────────────────────────────────── ► 0x555555555bba mov eax, 0 0x555555555bbf call reee78 0x555555555bc4 pop rbp 0x555555555bc5 ret pwndbg> tb reee78 Temporary breakpoint 3 at 0x555555555748 pwndbg> c Continuing. Temporary breakpoint 3, 0x0000555555555748 in reee78 () ───────────────────────────────────[ DISASM ]─────────────────────────────────── ► 0x555555555748 mov edi, 0x5f 0x55555555574d call putchar@plt 0x555555555752 mov eax, 0 0x555555555757 call reee70 0x55555555575c nop 0x55555555575d pop rbp 0x55555555575e ret pwndbg> tb reee70 Temporary breakpoint 4 at 0x55555555561c pwndbg> c Continuing. Temporary breakpoint 4, 0x000055555555561c in reee70 () pwndbg> disass Dump of assembler code for function reee70: 0x0000555555555618 <+0>: push rbp 0x0000555555555619 <+1>: mov rbp,rsp => 0x000055555555561c <+4>: sub rsp,0x10 0x0000555555555646 <+46>: call 0x555555555060 0x000055555555564b <+51>: test eax,eax 0x000055555555564d <+53>: jne 0x555555555665 0x000055555555564f <+55>: mov edi,0x46 0x0000555555555654 <+60>: call 0x555555555030 0x0000555555555659 <+65>: mov eax,0x0 0x000055555555565e <+70>: call 0x5555555555d2 0x0000555555555663 <+75>: jmp 0x555555555670 0x0000555555555665 <+77>: mov eax,0x0 0x000055555555566a <+82>: call 0x5555555554a5 0x000055555555566f <+87>: nop 0x0000555555555670 <+88>: leave 0x0000555555555671 <+89>: ret End of assembler dump. pwndbg> b *reee70+53 Breakpoint 5 at 0x55555555564d pwndbg> c Continuing. Breakpoint 5, 0x000055555555564d in reee70 () pwndbg> ju *reee70+55 Continuing at 0x55555555564f. _F1nD_M3}[Inferior 1 (process 2679) exited normally] pwndbg> ``` Looks like we found the second half of the flag: `_F1nD_M3}` Piecing the two halves together, we get the flag. Flag: `LNC2022{D1d_y0u88553s!!_F1nD_M3}` ## fone > What's that noise? - We are given a WAV file `Fone.wav` I saw pretty quickly that this was a DTMF challenge. However after extracting the data I couldn't figure out how to decipher the flag. So I shared my progress with my team after being stuck for some time, and they found the flag. How? Simply enclose the data in `LNC2022{}` and submit! I was expecting the flag to be made up of some text string and was pretty annoyed that I wasted my time thinking I was not done yet. One-liner solution: ```bash ┌──(kali㉿kali)-[~] └─$ multimon-ng -t wav -a DTMF Fone.wav 2>&1 | grep '^DTMF: ' | cut -d ' ' -f 2 | tr -d '\n' 763*132ABD32C190##256791A ┌──(kali㉿kali)-[~] └─$ ``` Flag: `LNC2022{763*132ABD32C190##256791A}` ## xNor > Not so commonly used algorithm.. > > So many weird characters.... I think I should change them into > something else.. ```text a = "ØÝÚ¬¼©¨éÔðÿñÄÓÿü®â.«p." b = "klfasdemsanaisdf2r¢1ë¬" ``` a [XNOR](https://en.wikipedia.org/wiki/XNOR_gate) b is basically NOT(a XOR b). Just implement the algorithm. ```python ──(kali㉿kali)-[~/Downloads] └─$ cat xNor.txt a = "ØÝÚ¬¼©¨éÔðÿñÄÓÿü®â.«p." b = "klfasdemsanaisdf2r¢1ë¬" ┌──(kali㉿kali)-[~/Downloads] └─$ python Python 3.9.11 (main, Mar 17 2022, 07:20:01) [GCC 11.2.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>> f = open('xNor.txt', 'r') >>> a = f.readline()[5:-2] # -2 because readline() also includes trailing '\n' >>> b = f.readline()[5:-2] >>> a 'ØÝÚ¬¼©¨éÔðÿñÄÓÿü®â.«p.' >>> b 'klfasdemsanaisdf2r¢1ë¬' >>> # We simulate NOT (1s'-complement) on bytes by doing XOR with 11111111 >>> mask = int('11111111', 2) >>> mask 255 >>> for (x, y) in zip(a, b): ... print(chr(mask ^ (ord(x) ^ ord(y))), end='') ... LNC2022{XnnoR_decosed}>>> ``` Flag: `LNC2022{XnnoR_decosed}`