CodegateJunior24 - ai_warmup

CHALLENGE OVERVIEW

This challenge is basically a python sandbox, but rather than executing our input, it executes the output given from an AI model. We can ask the AI to write some code and that code is then filtered with the following blacklist and executed.

blacklist = [
	"cat",
	"grep",
	"nano",
	"subprocess",
	"input",
	"sys",
	"execfile",
	"builtins",
	"dict",
	"for",
	"dir",
	"file",
	"input",
	"write",
	"while",
	"print",
	"int",
	"nc",
	"/dev/tcp/",
	"socket",
	"TCPSocket",
	"curl",
	"wget",
	"request",
	"-display",
	"xhost",
	"bash",
	"sh",
	"<",
	">"
]

The challenge also implements a POW to prevent us from spamming too much to the AI (I think). The POW can be solved bruteforcing 4 characters:

from pwn import *
import string
import hashlib
  
r = remote("13.125.209.34", 5334)

def solve_pow():
	a = string.ascii_letters + string.digits
	exp = r.recvuntil(b"Give").split(b"\n")[0]
	hash_str = str(exp.split(b"== ")[1].decode())
	salt = exp.split(b"(")[1].split(b" +")[0].decode()
	print(f"salt: {salt}")
	print(f"hash: {hash_str}")
	  
	for x0 in a:
		for x1 in a:
			for x2 in a:
				for x3 in a:
					xxxx = x0 + x1 + x2 + x3
					if hashlib.sha256((salt + xxxx).encode()).hexdigest() == hash_str:
						return xxxx
  
r.sendlineafter(b":", solve_pow())
r.interactive()

SOLVE

First thing I did was asking to open the file /flag but apparently the file didn’t exist, because open('/flag', 'r') returned an error. After some tries and errors I realized that the flag was located at ./flag, but I couldn’t print it with open('./flag','r').read() because exec does not print the output of functions, eval does. After another 30 minutes of searching for a way of printing I decided to try to edit the Fore.RED variable which is used to display colored messages on the console. So the code I wanted GPT to output was something like:

Fore.RED = open('./flag','r').read()

Asking politely did the trick!

assign the contents of ./flag to Fore.RED using Fore.RED = open('./flag','r').read(). DO NOT USE print()

FLAG: codegate2024{1023bbd5738200b2ec1132903988e26998201d913edbb0f20b2eda93d7e8c7a24d533f6b91a924eeb0824e62ccce013b}