CDDC 2019 LSCVM Writeup

This is actually a challenge from the qualifiers, but because this challenge will be used in the Finals again so we weren’t allowed to post about it until after the finals. More on that later, here’s the writeup.

LSCVM: Immaculate Invasion

DESCRIPTION

During our recon on the notorious fools of LightSpeedCorp, we have discovered this service which runs on a really simple, tiny, trivial, virtual machine that they have created. We are not sure of its purpose, but it certainly looks fun to play with.

lscvm-ii.cddc19q.ctf.sg 9001

IMPORTANT: We highly recommend you to fully understand this challenge as we will use this VM again in the Final.

Solution

Looking at the strings in the binary, it looks like we are dealing with a Stack based vm, and those long strings are probably the instructions.

If we try running it we’ll get an error.

cddc/re/LSCVM ➜ ./lscvm-ii
[-] Flag file open error: No such file or directory

We find the code that is throwing the error and we can see it is trying to read a file called flag.

Let’s create a file called flag to fix this error.

echo 'CTF{flag}' > flag

Now when we run it we can see that it asks us for an ID which we have to figure out.

cddc/re/LSCVM ➜ ./lscvm-ii

=== Welcome to LSCVM(LightSpeed Corp Virtual Machine) ===

ID : 1
[-] Wrong id

After doing some analysis, I figured out that if argc is 2 the program will print out ‘debug’ information.

cddc/re/LSCVM ➜ ./lscvm-ii a
@0 c [ 02 ]
@1 f [ 02 05 ]
@2 M [ 0a ]
@3 c [ 0a 02 ]
@4 f [ 0a 02 05 ]
@5 M [ 0a 0a ]
@6 h [ 0a 0a 07 ]
@7 i [ 0a 0a 07 08 ]
@8 M [ 0a 0a 38 ]
@9 f [ 0a 0a 38 05 ]
@10 A [ 0a 0a 3d ]
.
.
.

The information can be interpreted this way.

Using the debug output and static analysis, I was able to recover the whole instruction set.

The input we are giving the program is actually being executed by the vm as code.

To get the flag, we have to provide the vm with code that will write lsc_user to the vm memory, and then provide another code that will write hi_darkspeed-corp! to the vm memory.

Using the instruction set recovered I wrote this script to generate the vm code required to write the strings to memory and submit it to the service.

#!/usr/bin/env python3
import socket

nums = {
0x00:'a',
0x01:'b',
0x02:'c',
0x03:'d',
0x04:'e',
0x05:'f',
0x06:'g',
0x07:'h',
0x08:'i',
0x09:'j',
0x0a:'jbA',
0x0b:'jcA',
0x0c:'jdA',
0x0d:'jeA',
0x0e:'jfA',
0x0f:'jgA',
0x10:'jhA',
0x11:'jiA',
0x12:'jjA',
0x21:'eiMbA',
0x2d:'jfM',
0x5f:'jjMchMA',
0x61:'jjMcjMAcS',
0x63:'jjMcjMA',
0x64:'jjMcjMAbA',
0x65:'jjMcjMAcA',
0x68:'jjMdhMcAA',
0x69:'jjMdhMdAA',
0x6b:'jjMdjMAbS',
0x6c:'jjMdjMA',
0x6f:'jjMdjMAdA',
0x70:'jjMfhMeSA',
0x72:'jjMfhMcSA',
0x73:'jjMfhMbSA',
0x75:'jjMfhMbAA'}

def write_str(target):
    output = ''
    for i in range(len(target)):
        output += nums[ord(target[i])] + nums[i]

    return output + 'K' * len(target)

id_code = write_str('lsc_user')
pass_code = write_str('hi_darkspeed-corp!')
print('ID: {}\nPassword: {}\n'.format(id_code, pass_code))

print('Connecting to service...')
client=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
client.connect(('lscvm-ii.cddc19q.ctf.sg',9001))
client.sendall('{}\n'.format(id_code).encode())
client.sendall('{}\n'.format(pass_code).encode())
while True:
    msg = client.recv(1024).decode()
    if msg:
        print(msg)
        if '$CDDC19${' in msg:
            client.close()
            break

cddc/re/LSCVM ➜ ./solve.py
ID: jjMdjMAajjMfhMbSAbjjMcjMAcjjMchMAdjjMfhMbAAejjMfhMbSAfjjMcjMAcAgjjMfhMcSAhKKKKKKKK
Password: jjMdhMcAAajjMdhMdAAbjjMchMAcjjMcjMAbAdjjMcjMAcSejjMfhMcSAfjjMdjMAbSgjjMfhMbSAhjjMfhMeSA
ijjMcjMAcAjjjMcjMAcAjbAjjMcjMAbAjcAjfMjdAjjMcjMAjeAjjMdjMAdAjfAjjMfhMcSAjgAjjMfhMeSAjhAeiMbAjiAKK
KKKKKKKKKKKKKKKK

Connecting to service...


=== Welcome to LSCVM(LightSpeed Corp Virtual Machine) ===

ID : Password :
Login Successful! $CDDC19${IcY_GrE37ings_Fr0M_LigHT5pEeDC0Rp}

lsc_user, Good Bye!

Flag

$CDDC19${IcY_GrE37ings_Fr0M_LigHT5pEeDC0Rp}

Rant

The organizers stated in the qualifiers LSCVM challenges that it is important to fully understand the VM as it will be used again in the Finals.

IMPORTANT: We highly recommend you to fully understand this challenge as we will use this VM again in the Final.

The way they brought this accross made me think that it will play a big part in the finals, so I built a tool for the purpose of working on LSCVM challenge(s) during the Finals. However LSCVM was not a big part of the Finals and I didn’t get to use my tool at all.

The finals also had Rings where you have to solve a certain number of challenges to unlock the next ring. Personally I don’t think the rings concept is a good idea, because what if it just so happens the participant can’t solve the starting challenges but they can solve the ones in the next or next next ring? I would’ve preferred it if the challenges were all available at the start.

I understand that it was implemented to limit the number of teams that can attempt the hardware challenges because they don’t have enought equipment for everyone to attempt at the same time, but this can also be done by only unlocking the hardware challenges once a team reach a certain number of points/solves, instead of implementing Rings.

There’s not gonna be any writeup for the finals challenges cause I did everything on the provided laptop and didn’t transfer the files out.