index

Introduction

yet another uni ctf that was quite fun. only have this one writeup for a challenge. also idk if i even solved this during ctf or not lol

cmsc351

Most unorganized class I have taken. It took him over a month to release a syllabus which was not even accurate. In his lectures he just rants instead of actually teaching. You go the entire semester having to guess if you will pass and with what grade because he takes forever to grade things and the average grade was in the 50s.

Rate My Professor

First we throw the binary at IDA. We start by dissassembling the main function:

we can get this dissassembly of the main function:

1
__int64 __fastcall main(int a1, char **a2, char **a3)
2
{
3
  FILE *v3; // rdx
4
  char v5[32]; // [rsp+0h] [rbp-68h] BYREF
5
  char s[56]; // [rsp+20h] [rbp-48h] BYREF
6
  unsigned __int64 v7; // [rsp+58h] [rbp-10h]
7

8
  v7 = __readfsqword(0x28u);
9
  fgets(v5, 25, stdin);
10
  if ( !(unsigned __int8)sub_79F0(285, 199, v5) )
11
  {
12
    puts("sorry, looks like you shouldn't have fallen asleep in lecture.");
13
    return 0;
14
  }
15
  v3 = fopen("flag.txt", "r");
16
  if ( v3 )
17
  {
18
    fgets(s, 50, v3);
19
    printf(format, s);
20
    return 0;
21
  }
22
  puts("Flag file not found. If you're seeing this on remote, please contact the admins.");
23
  return 0xFFFFFFFFLL;
24
}

from this, we can tell that it reads some input (up to len 25), then feeds it into sub_79F0. if we get a nonzero return value, we get the flag!

yay easy to understand!

it takes a while to dissasssemble sub_79F0 cuz its kinda big, but we get this:

1
if ( *a3 == 115 )
2
    JUMPOUT(0x79B0);
3
  if ( *a3 != 116 )
4
    return 0;
5
  v618 = a3 + 1;
6
  v619 = a2 - 4;
7
LABEL_1216:
8
  if ( *v618 != 115 )
9
  {
10
    if ( *v618 != 116 )
11
      return 0;
12
    v681 = v618[1];
13
    if ( v681 == 115 )
14
      JUMPOUT(0xC0D8);
15
    if ( v681 == 116 )
16
      JUMPOUT(0xC0C0);
17
    return 0;
18
  }

(this is just a snippet, it was actually much longer than this)

115 and 116 are the ASCII codes for s and t. so, we can deduce that we need to provide a string of s and t (up to len 25), in a correct sequence, to get the flag

i supposed you could properly reverse engineer, maybe use the call graph, but i decided to brute force it using this script:

1
import subprocess
2
import itertools
3
from multiprocessing import Pool, cpu_count
4

5
BINARY_PATH = './cmsc351'
6
MAX_LENGTH = 25  # From the fgets(v5, 25, stdin) call
7

8
def test_sequence(sequence):
9
    try:
10
        proc = subprocess.Popen(
11
            [BINARY_PATH],
12
            stdin=subprocess.PIPE,
13
            stdout=subprocess.PIPE,
14
            stderr=subprocess.PIPE,
15
            text=True
16
        )
17
        stdout, _ = proc.communicate(input=sequence + '\n')
18
        if "sorry" not in stdout:
19
            return sequence
20
    except:
21
        pass
22
    return None
23

24
def brute_force():
25
    # Try lengths from 1 to MAX_LENGTH
26
    for length in range(1, MAX_LENGTH + 1):
27
        print(f"Trying length {length}...")
28
        with Pool(cpu_count()) as pool:
29
            # Generate all possible sequences of current length
30
            sequences = (''.join(p) for p in itertools.product('st', repeat=length))
31

32
            # Test sequences in parallel
33
            results = pool.imap_unordered(test_sequence, sequences, chunksize=1000)
34

35
            for result in results:
36
                if result is not None:
37
                    print(f"Found valid sequence: {result}")
38
                    pool.terminate()
39
                    return result
40
    return None
41

42
if __name__ == '__main__':
43
    result = brute_force()
44
    if result:
45
        print(f"Success! The correct sequence is: {result}")
46
    else:
47
        print("No valid sequence found up to length", MAX_LENGTH)

i was planning to write something up, using some cool bitmaps, blah blah blah, but in the big ‘25 we use ChatGPT for everything!!

this finishes pretty quickly (~1 minute on my i5 Linux machine) and gets us the sequence:

time python3 solve.py
Trying length 1...
Trying length 2...
Trying length 3...
Trying length 4...
Trying length 5...
Trying length 6...
Trying length 7...
Trying length 8...
Trying length 9...
Trying length 10...
Trying length 11...
Trying length 12...
Trying length 13...
Trying length 14...
Trying length 15...
Trying length 16...
Found valid sequence: ttsstsssstsssttt
Success! The correct sequence is: ttsstsssstsssttt
python3 solve.py  60.34s user 41.48s system 315% cpu 32.284 total

and the flag is UMDCTF{C4ll_Gr4ph5_ar3_st1ll_gr4ph5}

UMDCTF 2025

Introduction

cmsc351