Project Sekai - ✅-pwn-wtml

WTML - 500 points

Category: Pwn Description: This cool intermediate service receives WTML bodies and replaces tags. How useful! Is it vulnerable? nc wtml.wolvctf.io 1337 Files:

https://wolvctf.io/files/31c83f68779230a81a7521f6e58fb399/challenge?token=eyJ1c2VyX2lkIjoyNjgsInRlYW1faWQiOjE3MCwiZmlsZV9pZCI6NzV9.ZBTG7w.EUNDiHJm0WmCGp0ToX2pl2lEelQ
https://wolvctf.io/files/f4a51e4920e54ef20a54bc1ab797e7d6/challenge.c?token=eyJ1c2VyX2lkIjoyNjgsInRlYW1faWQiOjE3MCwiZmlsZV9pZCI6NzZ9.ZBTG7w.kUGXYEBZQ4m_5yS7E2DnL6BZGyg
https://wolvctf.io/files/8b843ac5e4d5782007f21f5dc7b1d1f2/Dockerfile?token=eyJ1c2VyX2lkIjoyNjgsInRlYW1faWQiOjE3MCwiZmlsZV9pZCI6Nzd9.ZBTG7w.ViwrksnaZpwm93snDlAessOqzrI
https://wolvctf.io/files/a51486e0ce532d3ab5174c63e3b2ab8b/libc-2.31.so?token=eyJ1c2VyX2lkIjoyNjgsInRlYW1faWQiOjE3MCwiZmlsZV9pZCI6Nzh9.ZBTG7w.y_S8rzjKWO4XMGb4Wg96cVw3l6U

Tags: Quintin#1337

Sutx pinned a message to this channel. 03/17/2023 1:00 PM

@retr0 wants to collaborate

@chenx3n wants to collaborate

hey any progress on this one?

format string challenge

nice

     tag_replacer replacer = {
             .funcs = {replace_tag_v1, replace_tag_v2},
             .id = 0,
     };

14:29

need to overwrite .id to call replace_tag_v2 which have the fsb

okay i see

@Piers wants to collaborate

14:44

✅ Challenge solved.

oof gg

damn too pro

yeah wait for wave 2

gg man

@Piers how did u change the id to 1 ?

the id is right after the message

14:46

the change tag access out of bound

ah yes

14:47

its doing i < MESSAGE_LEN in the second for loop

14:47

not MESSAGE_LEN - 2

14:47

just noticed that xd

chenx3n

its doing i < MESSAGE_LEN in the second for loop

m blind

lol