Polygot - BuckeyeCTF 2025

Đề bài

---

Giải

Bài này mình sẽ để vào Pwn vì nó là dạng viết shellcode sao cho nó hoạt động được trên càng nhiều kiến trúc càng tốt

┌──(kali㉿kali)-[/BuckeyeCTF 2025/polygot]
└─$ ncat --ssl 28p7PLB8CLVnDcMPt.polyglot.challs.pwnoh.io 1337
╭──────────────────────────────────────────────────────────────────────────────────╮
│                                                                                  │
│                                     Polyglot                                     │
│                                                                                  │
╰──────────────────────────────────────────────────────────────────────────────────╯

Craft a single binary chimera that is the same bytes but runs on many architectures.

Supported architectures:
  • arm_le
  • arm_be
  • arm_thumb_le
  • aarch64_le
  • mips_le
  • mips_be
  • x86
  • x86_64
  • riscv64
  • powerpc32

Goal:
  • Syscall number: 237
  • Arg1: 38085
  • Arg2: pointer to the string "Battelle"

Submit your shellcode (in hex):
>

Script

#!/usr/bin/env python3
from pwn import *
import subprocess

context.log_level = "error"

SYS  = 237
ARG1 = 38085
S    = "Battelle"

def sc_x86():
    context.clear(arch='i386', os='linux', endian='little')
    asm_code = f"""
        jmp str
    back:
        pop ecx
        mov eax, {SYS}
        mov ebx, {ARG1}
        int 0x80
    str:
        call back
        .ascii "{S}\\0"
    """
    return asm(asm_code)

def sc_x64():
    context.clear(arch='amd64', os='linux', endian='little')
    asm_code = f"""
        jmp str
    back:
        pop rsi
        mov rax, {SYS}
        mov rdi, {ARG1}
        syscall
    str:
        call back
        .ascii "{S}\\0"
    """
    return asm(asm_code)

def sc_arm_le():
    context.clear(arch='arm', os='linux', endian='little')
    asm_code = f"""
        adr  r1, str
        movw r0, #{ARG1 & 0xffff}
        mov  r7, #{SYS}
        svc  0
    str:
        .ascii "{S}\\0"
    """
    return asm(asm_code)

def sc_aarch64_le():
    context.clear(arch='aarch64', os='linux', endian='little')
    asm_code = f"""
        adr x1, str
        mov x0, #{ARG1}
        mov x8, #{SYS}
        svc 0
    str:
        .ascii "{S}\\0"
    """
    return asm(asm_code)

def sc_mips_le():
    context.clear(arch='mips', os='linux', endian='little')
    asm_code = f"""
        .set noreorder
        bal getpc
        nop
    getpc:
        addu  $t0, $ra, $zero
        addiu $a1, $t0, str - getpc
        li    $a0, {ARG1}
        li    $v0, {SYS}
        syscall
    str:
        .ascii "{S}\\0"
    """
    return asm(asm_code)

mips_le = ", ".join(hex(b) for b in sc_mips_le())
i386    = ", ".join(hex(b) for b in sc_x86())
amd64   = ", ".join(hex(b) for b in sc_x64())
arm_le  = ", ".join(hex(b) for b in sc_arm_le())
a64     = ", ".join(hex(b) for b in sc_aarch64_le())

asm_template = r"""
bits 32
global _start

_start:
    ; MIPS-LE / x86 junk
    db 0x04, 0x00, 0x04, 0x10

    ; x86/x64: jmp _x86 (0xeb ..)
    ; arm/arm64: harmless
    db 0xeb, (_x86 - $ - 2), 0x32, 0x32

    ; arm:    b _arm
    ; arm64:  ands x1, x0, x0
    db ((_arm - $ - 8) / 4), 0x00, 0x00, 0xea

    ; arm64:  b _arm64
    ; arm:    andeq r0, r0, r0
    db ((_arm64 - $) / 4), 0x00, 0x00, 0x14

    ; -------- MIPS-LE --------
    times (4 - (($ - _start) % 4)) nop
_mips:
    db {mips_le}

    ; -------- x86 / x86_64 dispatch --------
_x86:
    xor eax, eax
    db 0x40
    nop
    jz _x86_64

_x86_32:
    db {i386}

_x86_64:
    db {amd64}

    ; -------- ARM-LE --------
    times (4 - (($ - _start) % 4)) nop
_arm:
    db {arm_le}

    ; -------- AARCH64-LE --------
    times (4 - (($ - _start) % 4)) nop
_arm64:
    db {a64}
"""

asm_src = asm_template.format(
    mips_le=mips_le,
    i386=i386,
    amd64=amd64,
    arm_le=arm_le,
    a64=a64,
)

with open("chimera.asm", "w") as f:
    f.write(asm_src)

subprocess.check_call(["nasm", "-fbin", "-o", "chimera.bin", "chimera.asm"])
data = open("chimera.bin", "rb").read()
print(data.hex())

---

Flag

Monoglot flag:   bctf{a_good_start_4fc9c43c0d95}
Diglot flag:     bctf{now_you_are_bilingual_d9731b3bf6bf}
Triglot flag:    bctf{you_are_a_true_polyglot_25afd5c411f9}
Tetraglot flag:  bctf{Du_bist_ein_wahrer_Polyglott_47d86e5a3934}
Pentaglot flag:  bctf{du_er_en_sand_polyglot_16b4cea477d1}