init

Author: plotchy

.env-template

@@ -0,0 +1,12 @@
+# If you have a certain CTF URL
+export CTF_URL=https://...
+
+# My local erigon node rpc
+export ERIGON_URL=http://127.0.0.1:8545
+
+# I run anvil with:
+# anvil --accounts 1 --fork-url $ERIGON_URL -p 8546;
+export ANVIL_URL=http://127.0.0.1:8546
+
+# Anvil default key 1
+export PRIVATE_KEY_1=0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80

.gitignore

@@ -0,0 +1,11 @@
+# Compiler files
+cache/
+out/
+
+# Ignores development broadcast logs
+!/broadcast
+/broadcast/*
+/broadcast/*/31337/
+
+# Security
+.env

README.md

@@ -0,0 +1,25 @@
+#! /usr/bin/env bash
+
+# Make this file executable:
+# chmod +x copy_challenge.sh
+# Use this file as so:
+# ./copy_challenge.sh NewChallengeName
+
+# Change to your absolute ctf directory
+preamble=/home/plotchy/code/ctf/CTF-Setup
+
+cp $preamble/test/TestTemplate.t.sol $preamble/test/$1.t.sol
+cp $preamble/script/ScriptTemplate.s.sol $preamble/script/$1.s.sol
+
+mkdir -p $preamble/src/$1/public/contracts
+cp -r $preamble/src/chal_name/public/contracts/Exploit.sol $preamble/src/$1/public/contracts/Exploit.sol
+
+sed -i "s/chal_name/$1/g" $preamble/test/$1.t.sol
+sed -i "s/TestTemplate/$1/g" $preamble/test/$1.t.sol
+sed -i "s/ScriptTemplate/$1/g" $preamble/test/$1.t.sol
+
+sed -i "s/chal_name/$1/g" $preamble/script/$1.s.sol
+sed -i "s/TestTemplate/$1/g" $preamble/script/$1.s.sol
+sed -i "s/ScriptTemplate/$1/g" $preamble/script/$1.s.sol
+
+sed -i "s/chal_name/$1/g" $preamble/src/$1/public/contracts/Exploit.sol

copy_challenge.sh

@@ -0,0 +1,7 @@
+[profile.default]
+src = 'src'
+out = 'out'
+libs = ['lib']
+ffi = true
+
+# See more config options https://github.com/foundry-rs/foundry/tree/master/config

foundry.toml

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.13;
+import "forge-std/Script.sol";
+import "../src/chal_name/public/contracts/Setup.sol";
+import "../src/chal_name/public/contracts/Exploit.sol";
+
+bytes constant SIXTY_FOUR_ZEROS = "0000000000000000000000000000000000000000000000000000000000000000"; // ctrlc+v on handcrafted calldata
+address constant CREATE2_FACTORY = 0x4e59b44847b379578588920cA78FbF26c0B4956C;
+/*
+Commands:
+# Testing command
+forge test --mp ./test/TestTemplate.t.sol --mc Tester --fork-url $ANVIL_URL -vvvvv
+
+# Debug command
+forge test --mp ./test/TestTemplate.t.sol --mc Tester --debug <function> --fork-url $ANVIL_URL
+
+# Script command
+forge script script/ScriptTemplate.s.sol:Scripter --rpc-url $ANVIL_URL --private-key $PRIVATE_KEY_1 --broadcast -vvvvv
+
+# Debug broadcasted tx:
+cast run <TXHASH> -d --rpc-url $ANVIL_URL
+
+# Exploratory
+forge inspect <path>:<ContractName> storage --pretty
+https://ethervm.io/decompile
+https://library.dedaub.com/decompile
+panoramix <bytecode>
+*/
+contract Scripter is Script {
+
+    Challenge challenge;
+    address payable challengeAddress;
+    address payable setupAddress;
+    address payable exploitAddress;
+    function setUp() public {}
+
+    function run() external {
+        vm.startBroadcast();
+
+        Setup setup = new Setup{value: 100 ether}();
+        setupAddress = payable(address(setup));
+        challenge = setup.challenge();
+        challengeAddress = payable(address(challenge));
+        
+        Exploit exploit = new Exploit{value: 100 ether}(setup, challenge);
+        exploitAddress = payable(address(exploit));
+        exploit.finalize();
+
+        // // alternatively use etk code as exploit
+        // bytes memory etkCode = etkLoad();
+        // address _addr;
+        // assembly {
+        //     _addr := create(0, add(initcode, 0x20), mload(initcode))
+        // }
+        // exploitAddress = address(_addr);
+
+        vm.stopBroadcast();
+    }
+
+
+    function etkLoad() public returns (bytes memory etkCode){
+        // Helper function to load handcrafted EVM code from a file.
+        // typically used as:
+        //    
+        //    bytes memory etkCode = etkLoad();
+        //    vm.etch(someAddress, etkCode);
+        //    someAddress.call(hex"69696969");
+
+        string[] memory inputs = new string[](2);
+        // /**
+        //  * windows: scripts/compile.bat
+        //  * linux  : scripts/compile.sh
+        //  */
+        inputs[0] = "./script/compile.sh";
+
+        // // path/to/contract.etk
+        inputs[1] = "./src/chal_name/public/contracts/exploit.etk";
+
+        etkCode = vm.ffi(inputs);
+    }
+
+}

remappings.txt

@@ -0,0 +1,3 @@
+#! /usr/bin/env bash
+
+echo "0x$(eas $1)"

script/ScriptTemplate.s.sol

@@ -0,0 +1,4 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+// dummy for no import errors
+contract Challenge {}

script/compile.sh

@@ -0,0 +1,32 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+import './Setup.sol';
+import './Challenge.sol';
+contract Exploit {
+
+    Setup public setup;
+    address payable public setupAddress;
+    Challenge public challenge;
+    address payable public challengeAddress;
+    
+
+    constructor(Setup _setup, Challenge _challenge) payable {
+        setup = _setup;
+        setupAddress = payable(address(setup));
+        challenge = _challenge;
+        challengeAddress = payable(address(challenge));
+    }
+
+    function finalize() external {
+
+    }
+
+    function checkSolved() public view returns(bool) {
+        return setup.isSolved();
+    }
+
+    fallback() external payable {
+
+    }
+}