SunshineCTF 2023 Challenge Writeups (1x misc, 1x crypto, 2x rev, 4x scripting, 2x web, 4x pwn)

[@PockyBum522]

All, headphone warning for the Simon noises. Just speaker warning in general lol. Fantastic writeup, thank you very much! Someone said the link labels in simon2 are base64 with a URL-safe option.

[@SloppyJoePirates]

hey @DavidSikesll, ha thanks yeah, it came out a little loud. sigh, that would have made simon2 way easier =P

[@PockyBum522]

@@SloppyJoePirates I had no idea there was URL safe base64, I just saw it in the discord. There's also like a ten line solve in there. Keeps me humble :p

[@ashiri.]

Great video and writeups. One thing I found is that there is a playdate reverse engineering repo on GH by the user cranksters (YT does not allow putting the URL in comments). That was tremendously helpful to tackle the archive.

[@SloppyJoePirates]

Hey @ashiri! oh thanks, yeah, that looks way easier...

[@markuche1337]

Great 👏

[@ViênThiềuMinh]

hey joe, i usually download pwn binaries and many of them require specific version of glibc, mostly 2.34. Do you know how to resolve this error?. It is giving me issues while i can't play ctf.

[@SloppyJoePirates]

yeah it's frustrating, if you can, I'd recommend just using a modern version of ubuntu (such as 22) that has the same libc version. I use ubuntu22 in a docker. I have a video on the channel called "favorite ctf tools" that shows how to set it up.

[@terraflops]

im stuck on 1st problem. i got the file, i decoded the base64, read the message , but how did you get to the Git bundle part? Is there a detailed walkthrough somewhere? Thanks for video.

[@SloppyJoePirates]

There's two base64 strings in the original email. Are you base64 decoding the second one? That should be the git bundle

[@terraflops]

@@SloppyJoePirates i decoded only the 1st chunk. the second one is quite long but at the end is the == which indicates base64. Okay, thanks

[@kampet3438]

Congrats on all the solves :D The binary actually provided a libc leak in pwn/house-of-sus inside the function `report_body` (option 2). And to avoid struggling with the one gadgets, one could overwrite the GOT entry of `malloc` with `system` and then provide the address of `/bin/sh` as an size. Nonetheless that was a nice writeup 👍

[@SloppyJoePirates]

Hey @kampet3438! Ohhh! Thank you!!! doi. That's way better