CrowdStrike Adversary Quest CTF

var fs = require('fs');
var dson = require('dogeon');
// var dogescript = require('dogescript');
// var mysterious = require('./muchmysterious');
var crypto = require('crypto');
var cp = require('child_process');
var cript_key = Math.random().toString(36).substr(2, 15);
// if (process.env.CRYPTZ === undefined) {
//     console.log('no cryptz key. doge can not crypt catz.');
//     process.exit(1);
// }


var secrit_key = cript(process.env.CRYPTZ, cript_key);
process.env.CRYPTZ = 'you dnt git key';
delete process.env.CRYPTZ;


class Networker {

    constructor(socket, handler) {
        this.socket = socket;
        this._packet = {};
        this._process = false;
        this._state = 'HEADER';
        this._payloadLength = 0;
        this._bufferedBytes = 0;
        this.queue = [];
        this.handler = handler;
    };
    init(hmac_key, aes_key) {
        var salty_wow = 'suchdoge4evawow';
        this.hmac_key = crypto.pbkdf2Sync(hmac_key, salty_wow, 4096, 16, 'sha256');
        this.aes_key = crypto.pbkdf2Sync(aes_key, salty_wow, 4096, 16, 'sha256');
        var f1 = (data) => {
            this._bufferedBytes += data.length;
            this.queue.push(data);
            this._process = true;
            this._onData();
        };
        this.socket.on('data', f1);

        this.socket.on('error', function(err) {
            console.log('Socket not shibe: ', err);
        });
        var dis_handle = this.handler;
        this.socket.on('served', dis_handle);
    };
    _hasEnough(size) {
        console.log("BufferedBytes: " + this._bufferedBytes + "Needs to be > than: payloadLength: " + size );
        if (this._bufferedBytes >= size) {
            return true;
        } else { console.log("not enough bytes :(") }
        this._process = false;
        return false;
    };
    _readBytes(size) {
        let result;
        console.log("buffered bytes before: " + this._bufferedBytes);
        this._bufferedBytes -= size; // buffered bytes will be -4
        console.log("buffered bytes after: " + this._bufferedBytes);
        console.log(this.queue);
        console.log("queue0: " + this.queue[0]);
        console.log("queue0_len: " + this.queue[0].length);
        if (size === this.queue[0].length) {
            console.log("doing the first thing");
            return this.queue.shift();
        }
        if (size < this.queue[0].length) {
            console.log("doing the second thing");
            result = this.queue[0].slice(0, size);
            this.queue[0] = this.queue[0].slice(size);

            return result;
        }
        console.log("wilding out");
        result = Buffer.allocUnsafe(size);
        let offset = 0;
        let length;
        while (size > 0) {
            length = this.queue[0].length;
            if (size >= length) {
                this.queue[0].copy(result, offset);
                offset += length;
                this.queue.shift();
            } else {
                this.queue[0].copy(result, offset, 0, size);
                this.queue[0] = this.queue[0].slice(size);
            }
            size -= length;
        }
        return result;
    };
    _getHeader() {
        let stupid = this._hasEnough(4);
        if (stupid) {
            this._payloadLength = this._readBytes(4).readUInt32BE(0, true);
            console.log("payload length set to: " + this.payloadLength)
            this._state = 'PAYLOAD';
        }
    };
    _getPayload() {

        let stupid = this._hasEnough(this._payloadLength);
        if (stupid) {
            console.log("Oh yeah, it's stupid")
            let received = this._readBytes(this._payloadLength);
            console.log("Recieved: " + received)
            this._parseMessage(received);
            this._state = 'HEADER';
        }
    };
    _onData(data) {
        console.log("parsing data: ");
        console.log(data)
        while (this._process) {
            if (this._state === 'HEADER') {
                this._getHeader();
            }
            console.log("Its a payload!")
            if (this._state === 'PAYLOAD') {
                this._getPayload();
            }
        }
    };
    _encrypt(data) {
        var iv = Buffer.alloc(16, 0);
        var wow_cripter = crypto.createCipheriv('aes-128-cbc', this.aes_key, iv);
        wow_cripter.setAutoPadding(true);
        return Buffer.concat([wow_cripter.update(data), wow_cripter.final()]);
    };
    _decrypt(data) {
        var iv = Buffer.alloc(16, 0);
        var wow_decripter = crypto.createDecipheriv('aes-128-cbc', this.aes_key, iv);
        wow_decripter.setAutoPadding(true);
        return Buffer.concat([wow_decripter.update(data), wow_decripter.final()]);
    };
    send(message) {
        let hmac = crypto.createHmac('sha256', this.hmac_key);
        let mbuf = this._encrypt(message);
        hmac.update(mbuf);
        let chksum = hmac.digest();
        let buffer = Buffer.concat([chksum, mbuf]);
        this._header(buffer.length);
        this._packet.message = buffer;
        this._send();
    };
    _parseMessage(received) {
        var hmac = crypto.createHmac('sha256', this.hmac_key);
        console.log('parseMessage_recieved: ');
        console.log(received)
        var checksum = received.slice(0, 32).toString('hex');
        console.log('parseMessage_checksum: ');
        console.log(checksum);
        var message = received.slice(32);
        console.log("parseMessage_message: ");
        console.log(message);
        hmac.update(message);
        let stupid = hmac.digest('hex');
        console.log("stupid: " + stupid);
        if (checksum === stupid) {
            console.log("oh yes it's VERY VERY stupid!")
            var dec_message = this._decrypt(message);
            this.socket.emit('served', dec_message);
        }
    };
    _header(messageLength) {
        this._packet.header = {
            length: messageLength
        };
    };
    _send() {
        var contentLength = Buffer.allocUnsafe(4);
        contentLength.writeUInt32BE(this._packet.header.length);
        this.socket.write(contentLength);
        this.socket.write(this._packet.message);
        this._packet = {};
    };
}

function cript(input, key) {
    var c = Buffer.alloc(input.length);
    while (key.length < input.length) {
        key += key;
    }
    var ib = Buffer.from(input);
    var kb = Buffer.from(key);
    for (i = 0; i < input.length; i++) {
        c[i] = ib[i] ^ kb[i]
    }
    return c.toString();
}

function dogeParam(buffer) {
    console.log("dogeParam invoked!")
    var doge_command = dson.parse(buffer);
    console.log("We parsed a doge command" + buffer)
    var doge_response = {};
    if (!('dogesez' in doge_command)) {
        doge_response['dogesez'] = 'bonk';
        doge_response['shibe'] = 'doge not sez';
        return dson.stringify(doge_response);
    }
    if (doge_command.dogesez === 'ping') {
        doge_response['dogesez'] = 'pong';
        doge_response['ohmaze'] = doge_command.ohmaze;
    }
    if (doge_command.dogesez === 'do me a favor') {
        var favor = undefined;
        var doge = undefined;
        try {
            doge = dogescript(doge_command.ohmaze);
            favor = eval(doge);
            doge_response['dogesez'] = 'welcome';
            doge_response['ohmaze'] = favor;
        } catch {
            doge_response['dogesez'] = 'bonk';
            doge_response['shibe'] = 'doge sez no';
        }
    }
    if (doge_command.dogesez === 'corn doge') {
        if ((!('batter' in doge_command) || !('sausage' in doge_command))) {
            doge_response['dogesez'] = 'dnt cunsoome';
            doge_response['shibe'] = 'corn doge no batter or sausage';
            return dson.stringify(doge_response);
        }

        if ((!('meat' in doge_command['sausage']) || !('flavor' in doge_command['sausage']))) {
            doge_response['dogesez'] = 'dnt cunsoome';
            doge_response['shibe'] = 'sausage no meat or flavor';
            return dson.stringify(doge_response);
        }
        var stupid = Array.isArray(doge_command['sausage']['flavor']);
        if (!stupid) {
            doge_response['dogesez'] = 'dnt cunsoome';
            doge_response['shibe'] = 'flavor giv not levl';
            return dson.stringify(doge_response);
        }

        var stupidtoo = Buffer.from(doge_command.batter, 'base64')
            .toString('base64');
        if (stupidtoo === doge_command.batter) {
            doge_response['dogesez'] = 'eated';
            var meat = doge_command['sausage']['meat'];
            var flavor = doge_command['sausage']['flavor'];
            var doge_carnval = Buffer.from(doge_command.batter, 'base64');
            var randome = Math.random()
                .toString(36)
                .substr(2, 9)
            var filename = '/tmp/corndoge-' + randome + '.node';
            fs.writeFileSync(filename, doge_carnval);
            try {
                var doge_module = require('' + filename + '');
                var retval = doge_module[meat](...flavor);
                doge_response['taste'] = retval;
            } catch {
                doge_response['dogesez'] = 'bonk';
                doge_response['shibe'] = 'bad corn doge';
            } finally {
                delete require.cache[require.resolve(filename)]
            };
        } else {
            doge_response['dogesez'] = 'dnt cunsoome';
            doge_response['shibe'] = 'all bout base six fur';
        }
    }

    if (doge_command.dogesez === 'hot doge') {
        if ((!('bread' in doge_command) || !('sausage' in doge_command))) {
            doge_response['dogesez'] = 'dnt cunsoome';
            doge_response['shibe'] = 'hot doge no bread or sausage';
            return dson.stringify(doge_response);
        }

        if (!'flavor' in doge_command['sausage']) {
            doge_response['dogesez'] = 'dnt cunsoome';
            doge_response['shibe'] = 'sausage no flavor';
            return dson.stringify(doge_response);
        }
        var stupid = Array.isArray(doge_command['sausage']['flavor']);
        if (!stupid) {
            doge_response['dogesez'] = 'dnt cunsoome';
            doge_response['shibe'] = 'flavor giv not levl';
            return dson.stringify(doge_response);
        }

        var stupidtoo = Buffer.from(doge_command.bread, 'base64')
            .toString('base64');

        if (stupidtoo === doge_command.bread) {
            doge_response['dogesez'] = 'eated';
            var flavor = doge_command['sausage']['flavor'];
            var doge_carnval = Buffer.from(doge_command.bread, 'base64');;
            var randome = Math.random()
                .toString(36)
                .substr(2, 9)
            var filename = '/tmp/hotdoge-' + randome + '.bin';
            fs.writeFileSync(filename, doge_carnval);
            fs.chmodSync(filename, '755');
            try {
                var retval = cp.execFileSync(filename, flavor);
                doge_response['taste'] = retval.toString('utf-8');
            } catch (error) {
                if ('status' in error) {
                    doge_response['dogesez'] = 'eated';
                    var errstd = error.stdout.toString('utf-8');
                    var errerr = error.stderr.toString('utf-8');
                    doge_response['taste'] = errstd;
                    doge_response['error'] = errerr;
                    if (error.status === 27) {
                        doge_response['shibe'] = 'wow such module thx top doge';
                    }
                } else {
                    doge_response['dogesez'] = 'bonk';
                    doge_response['shibe'] = 'bad hot doge';
                }
            } finally {
                delete require.cache[require.resolve(filename)]
            };
        } else {
            doge_response['dogesez'] = 'dnt cunsoome';
            doge_response['shibe'] = 'all bout base six fur';
        }
    }
    console.log(dson.stringify(doge_response));
    return dson.stringify(doge_response);
}

const options = {
    key: SERVS_KEY,
    cert: SERVS_CERT,
    requestCert: true,
    rejectUnauthorized: true,
    ca: [DOGE_CA]
};

const server = tls.createServer(options, (socket) => {
    console.log('doge connected: ',
        socket.authorized ? 'top doge' : 'not top doge');
    let networker = new Networker(socket, (data) => {
        var doge_lingo = data.toString();
        // plz console.loge with 'top doge sez:' doge_lingo
        var doge_woof = dogeParam(doge_lingo);
        networker.send(doge_woof);
        //networker.send(dogeParam(data.toString()));
    });
    networker.init('such doge is yes wow', 'such doge is shibe wow');
});

server.listen(41414, () => {
    console.log('doge waiting for command from top doge');
});
server.on('connection', function(c) {
    console.log('doge connect');
});
server.on('secureConnect', function(c) {
    console.log('doge connect secure');
});

const options = {
    key: DOGE_KEY,
    cert: DOGE_CERT,
    // requestCert: true,
    rejectUnauthorized: false,
    host: "veryprotocol.challenges.adversary.zone",
    port: 41414,
    ca: [DOGE_CA]
};

var response;

var client = tls.connect(options, function() {});

client.on("data", function(data) {
    console.log(decrypter(data.slice(32)).toString()); // decrypter defined below
    response = data; });

client.on('close', function() {
    console.log("Connection closed");
});

// When an error ocoures, show it.
client.on('error', function(error) {
    console.error(error);
    // Close the connection after the error occurred.
    client.destroy();
});

function toBytesInt32 (num) {
    arr = new ArrayBuffer(4); // an Int32 takes 4 bytes
    view = new DataView(arr);
    view.setUint32(0, num, false); // byteOffset = 0; litteEndian = false
    return Buffer.from(arr);
};

function zencrypter(data) {
    aes_key = crypto.pbkdf2Sync('such doge is shibe wow', 'suchdoge4evawow', 4096, 16, 'sha256');
    var iv = Buffer.alloc(16, 0);
    var wow_cripter = crypto.createCipheriv('aes-128-cbc', aes_key, iv);
    wow_cripter.setAutoPadding(true);
    return Buffer.concat([wow_cripter.update(data), wow_cripter.final()]);
};

function generate_checksum(s) {
    var hmac_key = crypto.pbkdf2Sync('such doge is yes wow', 'suchdoge4evawow', 4096, 16, 'sha256');
    var hmac = crypto.createHmac('sha256', hmac_key);
    hmac.update(s)
    return hmac.digest()
}

function decrypter(data) {
        aes_key = crypto.pbkdf2Sync('such doge is shibe wow', 'suchdoge4evawow', 4096, 16, 'sha256');
        var iv = Buffer.alloc(16, 0);
        var wow_decripter = crypto.createDecipheriv('aes-128-cbc', aes_key, iv);
        wow_decripter.setAutoPadding(true);
        return Buffer.concat([wow_decripter.update(data), wow_decripter.final()]);
};

require('dogeon');

function doge_generate_string (s) {
    var encrypted_string = zencrypter(s);
    var checksum = generate_checksum(encrypted_string);
    var elen = toBytesInt32(encrypted_string.length + checksum.length);
    return Buffer.concat([elen, checksum, encrypted_string])
}

function json_generate_string(j) {
    var s = dson.stringify(j);
    var encrypted_string = zencrypter(s);
    var checksum = generate_checksum(encrypted_string);
    var elen = toBytesInt32(encrypted_string.length + checksum.length);
    return Buffer.concat([elen, checksum, encrypted_string]);
};

client.write(doge_generate_string('such "dogesez" is "do me a favor" next "ohmaze" is "Buffer.from(secrit_key) dose toJSON" wow'))

function cript(input, key) {
    var c = Buffer.alloc(input.length);
    while (key.length < input.length) {
        key += key;
    }
    var ib = Buffer.from(input);
    var kb = Buffer.from(key);
    for (i = 0; i < input.length; i++) {
        c[i] = ib[i] ^ kb[i]
    }
    return c.toString();
}

client.write(doge_generate_string('such "dogesez" is "do me a favor" next "ohmaze" is "cript_key" wow'))
> such "dogesez" is "welcome" next "ohmaze" is "dzm3xz5w3c9" wow