Capturing the Flag with GPT-4
in
This weekend I went to BSides SF 2023 and had a blast. I went to some actually fascinating talks (together with an excellent one about adversarial machine studying), however largely I spent my time fixing CTF hacking challenges. And this time, I did it with the assistance of GTP-4, the most recent era of OpenAI’s ChatGPT generative language mannequin. GPT-4 straight up solved some challenges for me, which blew my thoughts. There have been undoubtedly a number of flags I bought that I would not have gotten with out the assistance of GPT-4. For challenges that GPT-4 did not resolve by itself, it supplied extremely useful ideas, or rapidly wrote scripts that will have been tedious or time consuming for me to jot down myself. Good factor there’s (virtually) no such factor as dishonest in CTF!
I additionally discovered a number of conditions the place ChatGPT merely errored out and refused to present me solutions. I feel this was the case when it was overtly clear that I used to be attempting to get assist with hacking. For instance, after I requested it how you can write some JavaScript code that will bypass a selected XSS filter, and used language that made it clear that I used to be attempting to bypass an XSS filter, it simply failed with an error. It appears that evidently ChatGPT has some nominal safeguards to forestall folks from utilizing it for malicious hacking, however in the event you merely ask detailed technical questions (which could possibly be used for offense or protection), it tends to reply them.
All that stated, I needed to share my expertise with a number of challenges. This submit consists of write-ups for:
- Shamir Secret Sharing
- perckel
- Shell Hurdles
I used GPT-4 for assistance on a number of different challenges, however these three particularly impressed me. I additionally solved a number of challenges with out its help–partially as a result of it isn’t all the time straightforward to present it all of the context it must reply a query. You possibly can’t, for instance, ship it a 30MB APK file after which ask for assist reverse engineering it, or copy the entire supply code for an internet app into GPT-4 and ask it to search out the vulnerabilities. You will get assist with smaller chunks of those issues, however I may see this know-how getting far more highly effective sooner or later.
Shamir Secret Sharing
On this problem, I needed to stroll across the BSides SF venue searching for QR codes to scan. In Shamir’s Secret Sharing scheme, a secret is split right into a sure variety of components, and if one particular person has a threshold of these components they’ll decrypt the key. On this case, there have been 7 components with a threshold of 5, and I wandered round and located 6 of them on QR codes. I then merely requested GPT-4 to unravel the issue for me:
Listed below are components for Shamir Secret Sharing:
Share 1 of seven (min 5): (x1, y1) = (1, 12214173319090360239218007) Subject prime = 2^89 – 1 Flag = CTF{secretasletters} Secret -> base 27 a = 1, b = 2, … z = 26 (base 27)
Share 3 of seven (min 5): (x3, y3) = (3, 272214528378786743506941922) Subject prime = 2^89 – 1 Flag = CTF{secretasletters} Secret -> base 27 a = 1, b = 2, … z = 26 (base 27)
Share 4 of seven (min 5): (x4, y4) = (4, 404905998942651879217397287) Subject prime = 2^89 – 1 Flag = CTF{secretasletters} Secret -> base 27 a = 1, b = 2, … z = 26 (base 27)
Share 5 of seven (min 5): (x5, y5) = (5, 589183787842889173793388269) Subject prime = 2^89 – 1 Flag = CTF{secretasletters} Secret -> base 27 a = 1, b = 2, … z = 26 (base 27)
Share 6 of seven (min 5): (x6, y6) = (6, 338337360147368973687481536) Subject prime = 2^89 – 1 Flag = CTF{secretasletters} Secret -> base 27 a = 1, b = 2, … z = 26 (base 27)
Share 7 of seven (min 5): (x7, y7) = (7, 479528534189573769684386994) Subject prime = 2^89 – 1 Flag = CTF{secretasletters} Secret -> base 27 a = 1, b = 2, … z = 26 (base 27)
How do I decrypt the key?
And GTP-4 delivered.
Wow. Does it work? I copied the Python script into decrypt.py and tried working it.
$ python3 decrypt.py
CTF{perasperaadastra}
Holy shit. Thoughts blown. Particularly as a result of this problem really features a very tough half associated to base-27, however GPT-4 simply solved all of it on the primary attempt, with out further prompting.
I submitted the flag and bought the factors.
I downloaded the file flag.bin, after which tried to determine what this file is by working file on it.
$ file flag.bin
flag.bin: perl Storable (v0.7) knowledge (network-ordered) (main 2) (minor 11)
I had no concept what that is and it has been nicely over a decade since I wrote any code in Perl, so I requested GPT-4.
What is that this file?
flag.bin: perl Storable (v0.7) knowledge (network-ordered) (main 2) (minor 11)
Huh, cool. Perhaps GPT-4 can write a Perl script for me so I can see what’s in that file.
Write a Perl script that can show what’s in that file
Good, I haven’t got to re-teach myself Perl. I saved the script as script.pl and tried working it:
$ perl script.pl
Cannot eval, please set $Storable::Eval to a real worth at /System/Library/Perl/5.30/darwin-thread-multi-2level/Storable.pm line 421, at script.pl line 9.
Hmm, it needs to have the ability to execute arbitrary code. I am going to need to watch out when working this on my pc, however within the meantime let’s have a look at if GPT-4 will help repair this problem.
Cannot eval, please set $Storable::Eval to a real worth at /System/Library/Perl/5.30/darwin-thread-multi-2level/Storable.pm line 421, at script.pl line 9.
Good, it mounted the script. I up to date script.pl, however I did not wish to run it immediately on my pc although. (It was good of GPT-4 to warn me three separate occasions in regards to the safety dangers.) So I made a decision to run it in a Docker container. I created a brand new Ubuntu container, put in the right Perl dependencies, and ran it:
[email protected]:/src# perl ./script.pl
Identify "Storable::Eval" used solely as soon as: attainable typo at ./script.pl line 9.
$VAR1 = {
'shqa' => 'iryaeuxfc',
'jwjepylpxecq' => 'yfebe',
--snip--
'iruvqhgdnfstz' => 'smkohnqw',
'qcotpliscszql' => 'efzhu',
'decode_flag' => sub { "DUMMY" },
'htxj' => 'pmifolpyh',
'lftq' => 'pxqqgeqy',
'adbsjrhouqhgg' => 'srndfdboqqmfc',
'avarqfgzrufc' => 'thgzdhdstum',
'pdeqoerfqxbro' => 'grugrmrocnekt',
'ujlw' => 'ooxnyiyu',
'flag' => '��;���@��(�P��@HTX�Т�@��ڂ���@(!ok�8�@��Q�
��@�,��}F�@0Z��W�@��R�J�@���JM��@�#*,�@��E~���@�A����@���Y]��@�v���@@�N
b�@���co6�@������@��
�9�D�|�
�@�'Mi�e�@i��^9�@',
'lquykkphh' => 'bjyrsce',
'ruybrycyo' => 'othebxvqngu',
--snip--
'zxyybaaawc' => 'kbzr',
'pojhbzugch' => 'dqxiybapwepfh'
};
[email protected]:/src#
The script spewed out over 1,000 strains of output, displaying the worth of this Perl object. Many of the keys-value pairs appeared to be rubbish, however two of the keys have been fascinating: flag was a block of binary knowledge, and decode_flag was apparently a Perl perform. It appears like possibly the flag is encoded, and I can name decode_flag to decode it.
The $knowledge object has two fascinating keys,
flagwhich is binary knowledge, anddecode_flagwhich is a perform. Replace the script to name thedecode_flagperform and cross within the worth offlag
I up to date my script and ran it once more:
[email protected]:/src# perl script.pl
Identify "Storable::Eval" used solely as soon as: attainable typo at script.pl line 9.
Decoded flag: CTF{ooohhh_purrrrl_<3}
Shell Hurdles
The problem supplied a hyperlink to an internet terminal, or a number that I can netcat into to get a shell. This is what the net terminal seemed like:
This is the output of some instructions (the hostname is edited for readability):
[email protected]:~$ ls -l
complete 2220
-r-x--x--x 1 root ctf 2270141 Apr 16 2020 shurdles
My dwelling folder has an executable file known as shurdles in it. I attempted working it.
[email protected]:~$ ./shurdles
shurdle 0 failed: anticipated at the very least 1 argument
It failed with an error message saying it wants at the very least 1 argument. This was the primary shurdle (shell hurdle), however it’s a straightforward fix–I am going to simply cross in an argument.
[email protected]:~$ ./shurdles ASDF
shurdle 2 failed: I anticipated to be known as /shurdles, not ./shurdles
This labored, and I moved onto the subsequent shurdle. This one was fairly arduous. This program needs me to run /shurdles, not ./shurdles. How can I try this? Let’s ask GPT-4. I requested this:
I’ve a bash shell. There’s an executable file known as /dwelling/ctf/shurdles. I can run it by working:
/dwelling/ctf/shurdles
Or by altering to the folder /dwelling/ctf, and working:
./shurdles
Is it attainable for me to run it with this command although, with out making a symlink?
/shurdles
It responded with an honest concept: add /dwelling/ctf to my PATH so I can simply run shurdles, although it wasn’t excellent.
I attempted it anyway, and it did not work:
[email protected]:~$ export PATH=$PATH:/dwelling/ctf
[email protected]:~$ shurdles ASDF
shurdle 2 failed: I anticipated to be known as /shurdles, not shurdles
So I went again to GPT-4 and pleaded for extra assist.
That works to run:
shurdles
However how can I run it with:
/shurdles
It instructed me in that case to create a symlink, although that requires root.
I haven’t got root, so I requested for different concepts.
Is there any approach to do that with out utilizing symlinks, and with out utilizing root?
It then got here up with an ideal concept that I may not have thought up alone: use a shell perform.
Sadly, this did not work:
[email protected]:~$ perform /shurdles() { /dwelling/ctf/shurdles "[email protected]"; }
[email protected]:~$ /shurdles ASDF
shurdle 2 failed: I anticipated to be known as /shurdles, not /dwelling/ctf/shurdles
It appears that evidently despite the fact that I am working /shurdles, that is a shell perform that is working /dwelling/ctf/shurdles, in order that’s the primary argument that the method sees. I requested for extra assist:
That was an ideal concept, however I really want the primary worth of argv to be /shurdles, and that makes the primary worth /dwelling/ctf/shurdles
It responded with an concept that I completely would not have considered, as a result of I had by no means even heard of exec -a. Fascinating.
I made a decision to present it a attempt, however I spotted the field I used to be on did not have vim or nano. So, out of laziness, I simply requested for the instructions to avoid wasting shurdles_wrapper.sh utilizing echo as an alternative.
How can I create that shurdles_wrapper.sh script utilizing echo, as an alternative of a textual content editor?
It gave me the precise command to run.
I modified it a bit myself–I saved the script in /tmp/wrapper.sh as an alternative of /dwelling/ctf/shurdles_wrapper.sh, as a result of I did not have write entry to /dwelling/ctf, however it labored:
[email protected]:~$ echo -e '#!/bin/bashnexec -a /shurdles /dwelling/ctf/shurdles "[email protected]"' > /tmp/wrapper.sh
[email protected]:~$ chmod +x /tmp/wrapper.sh
[email protected]:~$ /tmp/wrapper.sh ASDF
shurdle 3 failed: I anticipated the atmosphere variable "HACKERS" to appear like hack the planet on separate strains
Acquired previous that shurdle! And onto the subsequent. I may completely determine this one out, however why not save time and get GPT-4 to do it for me?
How can I set the atmosphere variable “HACKERS” to be “hack the planet”, however with every phrase on a separate line?
And it labored:
[email protected]:~$ export HACKERS=$'hacknthenplanet'
[email protected]:~$ /tmp/wrapper.sh ASDF
shurdle 5 failed: anticipated workdir "/run/. -- !!"
Onto the subsequent shurdle. This one confused me a bit. I requested GPT-4 how I may make my present working listing appear like: /run/. -- !!, with out really creating that folder and altering to it. It had some good concepts, together with working export PWD='/run/. -- !!' earlier than working the command, however it did not work. I requested it the alternative ways a command can study its working listing, and it instructed me it could possibly use the PWD atmosphere variable, but additionally the getcwd perform. After I requested how getcwd realized the working listing with out the PWD atmosphere variable, it gave me an in depth reply.
All of that is nitty gritty Linux particulars that I did not know beforehand. And certain, generative language fashions confidently say issues which are false typically, so it may not be precisely proper… however actually, it appears about as prone to be proper as if I had requested a human Linux nerd. They get issues improper typically too.
Ultimately although, I used to be barking up the improper tree. I spotted the ctf person had write permission to /run, so I may simply create the folder and alter to it. So I bought previous this shurdle alone.
[email protected]:~$ mkdir '/run/. -- !!'
[email protected]:~$ cd /run/. -- !!/
[email protected]:/run/. -- !!$ /tmp/wrapper.sh ASDF
shurdle 6 failed: fd 3 is not open
I did not fairly know what this one meant. Did I’ve to open a file or one thing? I requested GPT-4.
What does “fd 3 is not open” imply?
Fascinating. So this system I am working must open a file, and that might be file descriptor 3… I nonetheless had no concept how you can make this system open a brand new file. I attempted passing in a sound filename like /dwelling/ctf/.bashrc as an alternative of ASDF as the primary argument, however no luck. So I requested GPT-4 for extra assist:
Is there any approach I may run this system that is giving this error in a approach that can make it open a further useful resource, in order that file descriptor 3 might be open?
I actually must discover ways to use the exec command… I had no concept about any of this, however I made a decision to attempt it.
[email protected]:/run/. -- !!$ exec 3>/tmp/fd3_output.txt
[email protected]:/run/. -- !!$ /tmp/wrapper.sh ASDF
shurdle 6 failed: anticipated fd 3 to be a file of 1337 bytes in size
Progress! So I want /tmp/fd3_output.txt to be 1337 bytes lengthy. I knew how to do that, however thought it could be quicker to ask GPT-4 than to search for the precise dd arguments, or write Python code, or nonetheless I needed to do it.
How can I make /tmp/fd3_output.txt be 1337 bytes lengthy?
After I ran the dd command it made /tmp/fd3_output.txt 1337 bytes lengthy, nonetheless after I ran exec 3>/tmp/fd3_output.txt it truncated the file so it was zero bytes. Hmm, how may I resolve that?
How can I modify the command:
exec 3>/tmp/fd3_output.txt
In order that when it creates the file /tmp/fd3_output.txt, it makes it 1337 bytes lengthy?
I attempted it… however it did not work.
[email protected]:/run/. -- !!$ dd if=/dev/zero of=/tmp/fd3_output.txt bs=1 rely=1337 && exec 3>/tmp/fd3_output.txt
1337+0 data in
1337+0 data out
1337 bytes (1.3 kB, 1.3 KiB) copied, 0.00219604 s, 609 kB/s
[email protected]:/run/. -- !!$ /tmp/wrapper.sh ASDF
shurdle 6 failed: anticipated fd 3 to be a file of 1337 bytes in size
I ponder what is going on on.
After I run:
dd if=/dev/zero of=/tmp/fd3_output.txt bs=1 rely=1337 && exec 3>/tmp/fd3_output.txt
It appears that evidently /tmp/fd3_output.txt remains to be 0 bytes.
$ ls -l /tmp/fd3_output.txt
-rw-r–r– 1 ctf ctf 0 Apr 23 06:17 /tmp/fd3_output.txt
Let’s have a look at…
[email protected]:/run/. -- !!$ dd if=/dev/zero of=/tmp/fd3_output.txt bs=1 rely=1337 && exec 3<>/tmp/fd3_output.txt
1337+0 data in
1337+0 data out
1337 bytes (1.3 kB, 1.3 KiB) copied, 0.0021625 s, 618 kB/s
[email protected]:/run/. -- !!$ /tmp/wrapper.sh ASDF
shurdle 7 failed: tz Native != America/Los_Angeles
Another shurdle down! Okay, so I have to replace the time zone subsequent.
How do I set the time zone to “America/Los_Angeles” in order that the subsequent command I run acknowledges that because the time zone?
[email protected]:/run/. -- !!$ exec 3<>/tmp/fd3_output.txt && TZ="America/Los_Angeles" /tmp/wrapper.sh ASDF
shurdle 8 failed: couldn't discover shurdles-helper
One other shurdle down! Now it wants to search out shurdles-helper. This one I can resolve alone, by creating a brand new folder, placing an executable file known as shurdles-helper into it, and including it to the PATH.
[email protected]:/run/. -- !!$ mkdir /tmp/bin
[email protected]:/run/. -- !!$ echo -e '#!/bin/bashnecho helper' > /tmp/bin/shurdles-helper
[email protected]:/run/. -- !!$ chmod +x /tmp/bin/shurdles-helper
[email protected]:/run/. -- !!$ export PATH=/tmp/bin:$PATH
[email protected]:/run/. -- !!$ exec 3<>/tmp/fd3_output.txt && TZ="America/Los_Angeles" /tmp/wrapper.sh ASDF
shurdle 9 failed: anticipated /dwelling/ctf/.cache/shurdles, does it exist?
It labored. Onto the subsequent shurdle. On this case, it wants a file known as /dwelling/ctf/.cache/shurdles to exist. I feel I can resolve this one alone too by creating that file.
[email protected]:/run/. -- !!$ mkdir -p /dwelling/ctf/.cache
[email protected]:/run/. -- !!$ contact /dwelling/ctf/.cache/shurdles
[email protected]:/run/. -- !!$ exec 3<>/tmp/fd3_output.txt && TZ="America/Los_Angeles" /tmp/wrapper.sh ASDF
shurdle 9 failed: /dwelling/ctf/.cache/shurdles was modified within the final day, sorry
It labored too. Now, it must timezone to be set to America/Los_Angeles. The way you do replace the modified timestamp on a file? GPT-4 will know.
The way you do replace the modified timestamp on a file?
Okay, easy sufficient. I am going to set it to a month in the past.
[email protected]:/run/. -- !!$ contact -t 202303231430 /dwelling/ctf/.cache/shurdles
[email protected]:/run/. -- !!$ exec 3<>/tmp/fd3_output.txt && TZ="America/Los_Angeles" /tmp/wrapper.sh ASDF
Congratulations!!!
CTF{you_made_it_past_the_hurdles}
I solely made it previous the hurdles due to you, GPT-4.