Wirteup for CODEGATE2025 CTF Quals Junior

from flask import Flask, request, render_template
import subprocess

app = Flask(__name__)

@app.route('/', methods=['GET'])
def execute():
    return render_template('index.html')

@app.route('/ping', methods=['GET'])
def ping():
    ip = request.args.get('ip')
    if ip:
        result = subprocess.run(f"ping -c 3 {ip}", shell=True, capture_output=True, text=True)
        return render_template('ping.html', result=result.stdout)
    else:
        return render_template('ping.html', message="Please provide IP address.")

if __name__ == '__main__':
    app.run('0.0.0.0', port=5000, debug=True)

from Crypto.Util.number import bytes_to_long, getPrime
from sympy import nextprime
import gmpy2

p = getPrime(512)
q = nextprime(p)

n = p * q
e = 65537

flag = "codegate2025{FAKE_FLAG}"
phi = (p - 1) * (q - 1)

d = gmpy2.invert(e, phi)

m = bytes_to_long(flag.encode())
c = pow(m, e, n)

print(f"n: {n}")
print(f"e: {e}")
print("Encrypted flag:", c)

undefined8 FUN_001011f8(void)

{
  byte bVar1;
  size_t sVar2;
  undefined8 uVar3;
  long in_FS_OFFSET;
  int local_44;
  uint local_40;
  int local_3c;
  byte local_38 [40];
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  __isoc99_scanf(&DAT_00102004,local_38);
  sVar2 = strlen((char *)local_38);
  if (sVar2 == 0x20) {
    for (local_44 = 0; local_44 < 0x1f; local_44 = local_44 + 1) {
      local_38[local_44] = local_38[local_44] ^ local_38[local_44 + 1];
    }
    local_38[31] = local_38[0] ^ local_38[31];
    for (local_40 = 0; (int)local_40 < 0x20; local_40 = local_40 + 1) {
      bVar1 = FUN_001011a9((&DAT_00104020)[(int)(uint)local_38[(int)local_40]],local_40 & 6);
      local_38[(int)local_40] = bVar1;
    }
    for (local_3c = 0; local_3c < 0x20; local_3c = local_3c + 1) {
      if (local_38[local_3c] != (&DAT_00104120)[local_3c]) {
        puts("Wrong!");
        uVar3 = 0;
        goto LAB_00101341;
      }
    }
    puts("Correct!");
    uVar3 = 0;
  }
  else {
    puts("Wrong length");
    uVar3 = 1;
  }
LAB_00101341:
  if (local_10 != *(long *)(in_FS_OFFSET + 0x28)) {
                    /* WARNING: Subroutine does not return */
    __stack_chk_fail();
  }
  return uVar3;
}

uint FUN_001011a9(byte param_1,byte param_2)

{
  return ((int)(uint)param_1 >> (param_2 & 0x1f) | (uint)param_1 << (8 - param_2 & 0x1f)) & 0xff;
}

import ast
from RestrictedPython import Eval
from RestrictedPython import Guards
from RestrictedPython import safe_globals
from RestrictedPython import compile_restricted, utility_builtins

TARGET_EXEC = "code"

class SafePythonExecutor:
    policy_globals = {**safe_globals, **utility_builtins}
   
    def __init__(self):
        self.policy_globals["__builtins__"]["__metaclass__"] = type
        self.policy_globals["__builtins__"]["__name__"] = type
        self.policy_globals["__builtins__"]["__import__"] = self.import_disallowed
        self.policy_globals["_getattr_"] = Guards.safer_getattr
        self.policy_globals["_getiter_"] = Eval.default_guarded_getiter
        self.policy_globals["_getitem_"] = Eval.default_guarded_getitem
        self.policy_globals["_write_"] = Guards.full_write_guard
        self.policy_globals["_iter_unpack_sequence_"] = Guards.guarded_iter_unpack_sequence
        self.policy_globals["_unpack_sequence_"] = Guards.guarded_unpack_sequence
        self.policy_globals["enumerate"] = enumerate

    def import_disallowed(name, *args, **kwargs):
        raise ImportError(f"Importing {name} is not allowed")

    def check_for_yield(self, code):
        """Check if the code contains a yield statement"""
        tree = ast.parse(code)
        for node in ast.walk(tree):
            if isinstance(node, ast.Yield):
                raise SyntaxError("Yield statement is not allowed")
        return code

    def execute_untrusted_code(self, code):
        code = self.check_for_yield(code)
        byte_code = compile_restricted(code, filename="<untrusted code>", mode="exec")
        result_local = {}
        exec(byte_code, self.policy_globals, result_local)
        print("Code executed successfully")

        if TARGET_EXEC not in result_local:
            raise ValueError(f"No '{TARGET_EXEC}' function found in the code")

        return result_local[TARGET_EXEC]()

if __name__ == "__main__":
    e = SafePythonExecutor()
    e.execute_untrusted_code(input("Enter your code: "))

const express = require("express");
const cookieParser = require("cookie-parser");
const crypto = require('node:crypto');
const fs = require("fs");
const path = require("path");
const b64Lib = require("base64-arraybuffer");
const flag = "codegate2025{FAKE_FLAG}";
const PrivateKey = `FAKE_PRIVATE_KEY`;
const PublicKey = `63c9b8f6cc06d91f1786aa3399120957f2f4565892a6763a266d54146e6d4af9`;
const tokenDir = path.join(__dirname, "token");
const app = express();
app.use(express.json());
app.use(cookieParser());
app.set("view engine", "ejs");
Object.freeze(Object.prototype);
fs.promises.mkdir(tokenDir, { recursive: true });

let db = {
    admin: { uid: "87c869e7295663f2c0251fc31150d0e3",
            pw: crypto.randomBytes(32).toString('hex'),
            name: "administrator"
        }
};

let temporaryFileName = path.join(tokenDir, crypto.randomBytes(32).toString('hex'));

const gen_hash = async () => {
    let data = "";
    for (var i = 0; i < 1234; i++) {
        data += crypto.randomBytes(1234).toString('hex')[0];
    }
    const hash = crypto.createHash('sha256').update(data);
    return hash.digest('hex').slice(0, 32);
};

const gen_JWT = async (alg, userId, key) => {
    const strEncoder = new TextEncoder();
    let headerData = urlsafe(b64Lib.encode(strEncoder.encode(JSON.stringify({ alg: alg, typ: "JWT" }))));
    let payload = urlsafe(b64Lib.encode(strEncoder.encode(JSON.stringify({ uid: userId }))));
    if (alg == "ES256") {
        let baseKey = await crypto.subtle.importKey("pkcs8", b64Lib.decode(key), { name: "ECDSA", namedCurve: "P-256" }, true, ["sign"]);
        let sig = await crypto.subtle.sign({ name: "ECDSA", hash: "SHA-256" }, baseKey, new TextEncoder().encode(`${headerData}.${payload}`));
        return `${headerData}.${payload}.${urlsafe(b64Lib.encode(new Uint8Array(sig)))}`;
    }
};

const read_JWT = async (token) => {
    const decoder = new TextDecoder();
    let payload = token.split(".")[1];
    return JSON.parse(decoder.decode(b64Lib.decode(decodeurlsafe(payload))).replaceAll('\x00', ''));
};

const urlsafe = (base) => base.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
const decodeurlsafe = (dat) => dat.replace(/-/g, "+").replace(/_/g, "/");

app.post('/', () => {});

app.post("/sign_in", async (req, res) => {
    try {
        const { id, pw } = req.body;
        if (!db[id] || db[id]["pw"] !== pw) {
            res.json({ message: "Invalid credentials" });
            return;
        }
        let token = await gen_JWT("ES256", db[id]["uid"], PrivateKey);
        res.cookie("check", token, { maxAge: 100 }).json({ message: "Success" });
    } catch (a) {
        res.json({ message: "Failed" });
    }
});

app.post("/sign_up", async (req, res) => {
    try {
        const { id, data } = req.body;
        if (id.toLowerCase() === "administrator" || db[id]) {
            res.json({ message: "Unallowed key" });
            return;
        }
        db[id] = { ...data, uid: crypto.randomBytes(32).toString('hex') };
        res.json({ message: "Success" });
    } catch (a) {
        res.json({ message: "Failed" });
    }
});

app.post("/2fa", async (req, res) => {
    try {
        const token = req.cookies.check ?? "";
        const data = await read_JWT(token, PublicKey);
        if (db.admin.uid !== data.uid) {
            res.json({ message: "Permission denied" });
            return;
        }
        let rand_data = await gen_hash();
        
        await fs.promises.writeFile(temporaryFileName, rand_data);
        console.log(temporaryFileName);
        res.json({ message: rand_data });
    } catch (a) {
        res.json({ message: "Unauthorized" });
    }
});

app.post("/auth", async (req, res) => {
    try {
        const token = req.cookies.check ?? "";
        const data = await read_JWT(token, PublicKey);
        if (db.admin.uid !== data.uid) {
            res.json({ message: "Permission denied" });
            return;
        }
        const { data: input } = req.body;
        const storedData = await fs.promises.readFile(temporaryFileName, "utf-8");
        if (input === storedData) {
            res.json({ flag });
        } else {
            res.json({ message: "Token Error" });
        }
    } catch (a) {
        res.json({ message: "Internal Error" });
    }
});

app.post("/data", (req, res) => {
    res.status(req.body.auth_key ? 200 : 400).send(req.body.auth_key ? 'Success' : 'Failed');
});

app.listen(1234);