shouc

// by https://twitter.com/publicqi & https://twitter.com/shoucccc

contract PuzzleBoxSolution {
    constructor() payable {}
    fallback() payable external {
        if (msg.data.length > 32) {
            assembly{
                // let x := 0x80
                let target := 0x69209d8a7d258515ec9a4d25f7be1db85cb1b826

shouc

Demo

Install Docker from https://www.docker.com/ and run our docker image (x86 only, running on non-x86 platform significantly degrades performance):

docker run -p 8000:8000 fuzzland/dev-ityfuzz-2

Then, you can visit the interface at http://localhost:8000

shouc

We couldn’t find that file to show.

shouc

#include "DecodeCode.h"


mipsinstruction decode(int value)
{
	mipsinstruction instr;
    unsigned int v = (unsigned int) value;
	instr.funct = v & 0b111111;
	instr.immediate = value & 0b1111111111111111;
    unsigned short is_signed = instr.immediate >> 15;

shouc

0x00 Challenge

supervisord.conf:

[supervisord]
nodaemon=true

[program:gunicorn3]
command=gunicorn3 --workers=10 -b 0.0.0.0:5000 app:app

shouc

PyCrypto Writeup

To begin with, there is a very easy crypto chall. By solving it with collision, we can get:

key = "ASIS2020_W3bcrypt_ChAlLeNg3!@#%^"

Then, leverage this vuln (trentm/python-markdown2#348) to make /ticket to have XSS.

shouc

-- Following CCC's algorithm
-- @base + ( @top - @base ) / (1 + (max(0, solves -1)/ 11.92201) ** 1.206069)

CREATE EVENT IF NOT EXISTS `calc_challenges_new_score`
ON SCHEDULE
  EVERY 3 SECOND
  COMMENT 'Calculate points for challenges'
  DO
  UPDATE challenges AS c SET c.`point` = CONVERT(c.base_point + (c.top_point - c.base_point) / (1 + POW(GREATEST(c.solved_count - 1, 0) / 11.92201, 1.206069)), UNSIGNED);
  

shouc

CREATE EVENT IF NOT EXISTS `calc_challenges_new_score`
ON SCHEDULE
  EVERY 5 MINUTE
  COMMENT 'Calculate points for challenges every 5 min'
  DO
    -- TBD

shouc

#include "cpp-httplib/httplib.h"
using namespace httplib;
int main() {
    Server svr;
    svr.Get("/1", [](const Request& req, Response& res) {
        res.set_redirect("1\r\nSet-Cookie: a=1");
    });
    svr.Get("/2", [](const Request& req, Response& res) {
        res.set_header("a", "1\r\nSet-Cookie: a=1");
    });

shouc

#include <iostream>
#include <string>
#include <fstream>

using namespace std;

int main(int argc, char const *argv[])
{
	if (argc == 1){
		cerr << "Usage: ./" << argv[0] << " filename" << endl;