HITCON Exhibition CTF 2025 Writeup

// Hardcode value to prevent XSS to RCE.
const gameId = 'bamboo-gal'
const executable = `./${gameId}/game.exe`
const baseUrl = 'https://xn--kpr97vl4kg3x.xn--e5x.tw:9114/'

ipcMain.handle('install-game', async () => {
  const gz = Buffer.from(
    await (
      await fetch(`${baseUrl}static/..%2Fgames/${gameId}.asar.gz`, {})
    ).arrayBuffer()
  )
});

- static
  - style.css
  - ciallo.aac
  - static files...
- games
  - bamboo-gal.asar.gz
- package.json?
- Dockerfile?

pip install git-dumper
git-dumper https://xn--kpr97vl4kg3x.xn--e5x.tw:9114/static/..%2F/.git/ website/
ls website
Dockerfile   README.md   bin   bun.lock   compose.yaml   eslint.config.mjs   package.json   prisma   readkey.c   src   static  template   tsconfig.json   歐內該

app.get('/static/*', async (c) => {
  const filePath = decodeURIComponent('/app' + new URL(c.req.raw.url).pathname)
  const allowedExtensions = {
    '.html': 'text/html;',
    '.svg': 'image/svg+xml',
    '.ico': 'image/x-icon',
    '.png': 'image/png',
    '.webp': 'image/webp',
    '.webm': 'video/webm',
    '.css': 'text/css',
    '.aac': 'audio/aac',
    '.adts': 'audio/aac',
    '.gz': 'application/gzip',
    '.xp3': 'application/krkr-resource-file',
    '.exe': 'application/vnd.microsoft.portable-executable',
    '.dll': 'application/i-do-not-know-what-to-put-here-fuck-microsoft',
    '': 'application/x-binary',
  }
  const parsedPath = path.parse(path.normalize(filePath))

  if (!parsedPath.dir.startsWith('/app')) return c.text('Not Found', 404)
  if (allowedExtensions.hasOwnProperty(parsedPath.ext) === false) {
    return c.text('Not Found', 404)
  }
  const file = Bun.file(filePath)
  if (!(await file.exists())) return c.text('Not Found', 404)

  c.header(
    'Content-Type',
    // @ts-ignore: No index signature with a parameter of type 'string' was found
    `${allowedExtensions[parsedPath.ext]}; charset=utf-8`
  )

  return c.body(await file.arrayBuffer())
})

datasource db {
  provider = "sqlite"
  url      = "file:./db"
}

.post('/verify', async (c) => {
  const { license, computerInfo, itemId } = await c.req.parseBody()
  if (license == null || computerInfo == null)
    return c.render('back-to-home', { message: 'Bad Hacker' }, 400)
  if (typeof license != 'string' || typeof computerInfo != 'string')
    return c.render('back-to-home', { message: 'Bad Hacker' }, 400)
  if (itemId != null && typeof itemId != 'string')
    return c.render('back-to-home', { message: 'Bad Hacker' }, 400)

  if (!(await verifyActivation(license, computerInfo, itemId)))
    return c.text('Verification failed', 400)

  return c.text(await readkey())
})

import { PrismaClient } from '@prisma/client'
import { randomBytes } from 'node:crypto'

const prisma = new PrismaClient()

function bytesToBigInt(bytes: Uint8Array): bigint {
  let hex = ''
  bytes.forEach((byte) => {
    hex += byte.toString(16).padStart(2, '0')
  })
  return BigInt('0x' + hex)
}

function bigIntToBytes(bn: bigint, size: number): Uint8Array {
  let hex = bn.toString(16)
  if (hex.length % 2) {
    hex = '0' + hex
  }
  const len = hex.length / 2
  const u8 = new Uint8Array(len)
  let i = 0
  let j = 0
  while (i < len) {
    u8[i] = parseInt(hex.slice(j, j + 2), 16)
    i += 1
    j += 2
  }
  if (u8.length < size) {
    const padded = new Uint8Array(size)
    padded.set(u8, size - u8.length)
    return padded
  }
  return u8
}

function H(s: bigint): bigint {
  const m = bigIntToBytes(s, 128)
  const hasher = new Bun.CryptoHasher('md5')
  hasher.update(m)
  return BigInt('0x' + hasher.digest('hex'))
}

function generateActivation(r: bigint, s: bigint): bigint {
  let acc = BigInt('0')
  const p = (BigInt('1') << BigInt(128)) - BigInt(159)
  for (let i = 0; i < 6; i++) {
    acc += s
    acc = (r * acc) % p
    s = H(s)
  }
  acc += s
  return acc % p
}

function calculateActivationTag(
  license: string,
  computerInfo: string
): string | false {
  let r: bigint
  try {
    r = BigInt(`0x${license}`)
  } catch (e) {
    return false
  }
  if (r.toString(16).length != 32) return false

  const hasher = new Bun.CryptoHasher('md5')
  hasher.update(computerInfo)
  const s = bytesToBigInt(hasher.digest() as Uint8Array)

  return `0x${generateActivation(r, s).toString(16)}`
}

export async function generateLicense(itemId: string, license?: string) {
  if (license == null) license = randomBytes(16).toString('hex')
  while (BigInt(`0x${license}`).toString(16).length != 32) {
    license = randomBytes(16).toString('hex')
  }

  return (
    await prisma.license.create({
      data: { itemId, content: license },
    })
  ).content
}

export async function activateLicense(
  license: string,
  computerInfo: string,
  itemId: string | undefined
): Promise<boolean> {
  if (itemId == null) itemId = (await prisma.item.findFirst())?.id
  if (itemId == null) return false
  if (!(await prisma.license.findUnique({ where: { content: license } })))
    return false
  const tag = calculateActivationTag(license, computerInfo)
  if (!tag) return false
  const result = await prisma.$transaction(async (tx) => {
    try {
      const exitingLicense = await tx.license.update({
        where: { content: license },
        data: { usedCount: { increment: 1 } },
      })
      if (exitingLicense.usedCount >= exitingLicense.totalUses) {
        await tx.license.delete({ where: { id: exitingLicense.id } })
      }
      return await tx.activation.create({ data: { tag, itemId } })
    } catch (e) {
      return false
    }
  })
  if (!result) return false
  return true
}

export async function verifyActivation(
  license: string,
  computerInfo: string,
  itemId: string | undefined
): Promise<boolean> {
  if (itemId == null) itemId = (await prisma.item.findFirst())?.id
  const tag = calculateActivationTag(license, computerInfo)
  if (!tag) return false

  const activation = await prisma.activation.findFirst({
    where: { tag, itemId },
  })

  console.log(
    `verifyActivation: license=${license} computerInfo=${computerInfo} tag=${tag} activation=${
      activation == null ? 'false' : 'true'
    }`
  )

  if (!activation) return activateLicense(license, computerInfo, itemId)
  return true
}