hxp 36C3 CTF Writeup

この大会は2019/12/28 5:00(JST)～2019/12/30 5:00(JST)に開催されました。
今回もチームで参戦。結果は105点で321チーム中122位でした。
自分で解けた問題をWriteupとして書いておきます。

1337 skills (ZAJ)

Google PlayのサイトのWILD Skillsというアプリへのリンクが提示されている。GooglePlayからapkとしてファイルを入手する。Bytecode Viewerで入手したapkファイルを開き、コードを見てみる。

public class MainActivity extends Activity {

                :

   public void activateApp(View var1) {
      int var2;
      try {
         var2 = Integer.parseInt(this.editTextActivation.getText().toString());
      } catch (NumberFormatException var5) {
         var2 = -1;
      }

      Calendar var6 = Calendar.getInstance();
      if (var2 == (int)(Math.pow((double)(var6.get(3) * var6.get(1)), 2.0D) % 999983.0D)) {
         this.findViewById(2131296458).setVisibility(4);
         ((InputMethodManager)this.getSystemService("input_method")).hideSoftInputFromWindow(this.editTextActivation.getWindowToken(), 0);
         Editor var7 = this.prefsmain.edit();
         var7.putBoolean("Activated", true);
         long var3 = (new Date()).getTime();
         var7.putLong("Installed", var3);
         var7.putLong("ActivationDate", var3);
         var7.commit();
      } else {
         Toast.makeText(this, "Ungültiger Aktivierungscode", 1).show();
         this.editTextActivation.requestFocus();
         ((InputMethodManager)this.getSystemService("input_method")).showSoftInput(this.editTextActivation, 1);
      }

   }

                :

   public void courseActivation(View var1) {
      String var4 = ((EditText)this.findViewById(2131296341)).getText().toString();
      int var2 = activateCourse;
      Editor var3;
      StringBuilder var5;
      if (var2 != 3) {
         switch(var2) {
         case 0:
            if (var4.equals("sgk258")) {
               course = activateCourse;
               activateCourse = -1;
               this.setCourse();
               ((InputMethodManager)this.getSystemService("input_method")).hideSoftInputFromWindow(this.editTextActivation.getWindowToken(), 0);
               Editor var6 = this.prefsmain.edit();
               StringBuilder var7 = new StringBuilder();
               var7.append("Activated");
               var7.append(course);
               var6.putBoolean(var7.toString(), true);
               var6.apply();
            } else {
               Toast.makeText(this, "Ungﾃｼltiger Aktivierungscode", 1).show();
            }
            break;
         case 1:
            if (var4.equals("wmt275")) {
               course = activateCourse;
               activateCourse = -1;
               this.setCourse();
               ((InputMethodManager)this.getSystemService("input_method")).hideSoftInputFromWindow(this.editTextActivation.getWindowToken(), 0);
               var3 = this.prefsmain.edit();
               var5 = new StringBuilder();
               var5.append("Activated");
               var5.append(course);
               var3.putBoolean(var5.toString(), true);
               var3.apply();
            } else {
               Toast.makeText(this, "Ungﾃｼltiger Aktivierungscode", 1).show();
            }
         }
      } else if (var4.equals("udh736")) {
         course = activateCourse;
         activateCourse = -1;
         this.setCourse();
         ((InputMethodManager)this.getSystemService("input_method")).hideSoftInputFromWindow(this.editTextActivation.getWindowToken(), 0);
         var3 = this.prefsmain.edit();
         var5 = new StringBuilder();
         var5.append("Activated");
         var5.append(course);
         var3.putBoolean(var5.toString(), true);
         var3.apply();
      } else {
         Toast.makeText(this, "Ungﾃｼltiger Aktivierungscode", 1).show();
      }

   }

                :
}

activateAppメソッドの以下の部分の条件を確認する。

if (var2 == (int)(Math.pow((double)(var6.get(3) * var6.get(1)), 2.0D) % 999983.0D)) {

$ cat ActivateCode.java
import java.util.Calendar;

class ActivateCode {
    public static void main(String args[]){
        int var2;
        Calendar var6 = Calendar.getInstance();
        var2 = (int)(Math.pow((double)(var6.get(3) * var6.get(1)), 2.0D) % 999983.0D);
        System.out.println(var2);
    }
}
$ javac ActivateCode.java
$ java ActivateCode
667518

あとはcourseActivationに書いてあるコードを指定する。

$ nc 88.198.154.132 7002
Activation code: 
667518
activated!
Sales activation code: 
sgk258
activated!
Leadership activation code: 
wmt275
activated
Service Roadmap (SRM) activation code: 
udh736
activated!
Congratulations please give me your name: 
hogehoge　←適当
   ______________________________
 / \                             \.
|   |                            |.
 \_ |                            |.
    | Certificate of Attendance  |.
    |                            |.
    |  This is to certify that   |.
    |                            |.
    |          hogehoge          |.
    |                            |.
    |        has attended        |.
    |                            |.
    | **The baby rev challenge** |.
    |                            |.
    |                            |.
    |                       hxp  |.
    |                            |.
    | -------------------------- |.
    |                            |.
    |hxp{thx_f0r_4773nd1n6_70d4y}|.
    |                            |.
    |   _________________________|___
    |  /                            /.
    \_/____________________________/.

hxp{thx_f0r_4773nd1n6_70d4y}