CSAW: sharpturn

For this challenge we were given a corrupted git repository. We started by checking out the git repository (using git clone) and checking the consistency of the repository (using git fsck):

Checking object directories: 100% (256/256), done.
error: sha1 mismatch 354ebf392533dce06174f9c8c093036c138935f3
error: 354ebf392533dce06174f9c8c093036c138935f3: object corrupt or missing
error: sha1 mismatch d961f81a588fcfd5e57bbea7e17ddae8a5e61333
error: d961f81a588fcfd5e57bbea7e17ddae8a5e61333: object corrupt or missing
error: sha1 mismatch f8d0839dd728cb9a723e32058dcc386070d5e3b5
error: f8d0839dd728cb9a723e32058dcc386070d5e3b5: object corrupt or missing
missing blob 354ebf392533dce06174f9c8c093036c138935f3
missing blob f8d0839dd728cb9a723e32058dcc386070d5e3b5
missing blob d961f81a588fcfd5e57bbea7e17ddae8a5e61333

The description of the challenge gives a hint and tells us that there is some corruption on the SATA side. The git object protocol stores the file and uses a sha1sum to generate a hash of the file.

In total there were three 1 byte changes (simple bit flips), one change for every wrong byte. Each commit need to be fixed and we wrote a small script that brute forces all bytes, replacing a byte with all possible alternatives.

The first error that needs to be replaced is: 51337 with 31337 (3 is flipped to 5, 2 bits change). The second error is the number that you have to factor for the challenge. There 270031727027 is used instead of 272031727027 (2 is flipped to 0, 1 bit changes). The last change is &lag is used instead of flag (changing f to &, 1 bit changes).

For each corruption we have to checkout (git checkout) the corrupt version and fix the sharp.cpp file. After fixing all prior errors we run our search program to find each of the changes mentioned above. The file can then be rehashed using git hash-object -w sharp.cpp and the object cache will be updated. Moving to the next corruption we can checkout corrupt version until we have iterated through all the errors.

When we are done we have to compile the challenge and pass the correct answers (flag, 31337, money, 31357, 8675311) and we get the flag. Hooray, 400 points for b01lers!

blogroll

social