hxp CTF 2022 hxp

2022

Join us on IRC! Libera Chat | #hxpctf - Stalk us on Twitter @hxpctf

browser_insanity

by sisu
pwn zahjebischte

Difficulty estimate: medium - medium

Points: round(1000 ยท min(1, 10 / (9 + [14 solves]))) = 435 points

Description:

Ever wanted to hack a tiny OS written in x86-32 assembly and C--? Me neither but it’s hxp CTF 2022.

Give us an URL, the user in the KolibriOS VM will visit it. You need to get the flag from /hd0/1/flag.txt

The source code you could get from https://repo.or.cz/kolibrios.git/tree/7fc85957a89671d27f48181d15e386cd83ee7f1a

The browser is at programs/cmm/browser in the source tree. It relies on a couple of different libraries (e.g. programs/develop/libraries), grep around.

KolibriOS has its own debugger, DEBUG, available on the desktop. It may come in useful.

The kernel ABI is at kernel/trunk/docs/sysfuncs.txt

For building random pieces:

INCLUDE=path_to_header.inc fasm -m 1000000 -s debug.s file.asm file.out


Download:

browser_insanity-a0dafc61366d8e9a.tar.xz (1.3 MiB)

Connection (mirrors):

  • nc 78.46.199.173 27499

Solved by:

# Team Time
browser_insanity released 2023-03-11 10:08:36 +0000 UTC
๐Ÿฅ‡ Kalmarunionen 2023-03-11 13:51:26 +0000 UTC
๐Ÿฅˆ The Flat Network Society 2023-03-11 16:55:25 +0000 UTC
๐Ÿฅ‰ copy 2023-03-11 19:19:45 +0000 UTC
4 Blue Water 2023-03-11 20:13:33 +0000 UTC
5 thehackerscrew 2023-03-12 00:31:48 +0000 UTC
6 Dragon Sector 2023-03-12 01:13:25 +0000 UTC
7 about:blankets 2023-03-12 03:44:27 +0000 UTC
8 ./Vespiary 2023-03-12 07:48:38 +0000 UTC
9 Hot Ice Americano 2023-03-12 08:13:50 +0000 UTC
10 mhackeroni 2023-03-12 09:16:37 +0000 UTC
11 justCatTheFish 2023-03-12 11:13:07 +0000 UTC
12 We_0wn_Y0u 2023-03-12 11:34:06 +0000 UTC
13 Never Stop Exploiting 2023-03-12 11:35:44 +0000 UTC
14 Aali 2023-03-12 15:03:08 +0000 UTC