Archived Challenges - November 2024

To solve this you need to:

1. Obtain an ISP and get internet access. You cannot use a computer without internet.
2. Purchase a laptop. Buying a laptop can allow for one to complete the survey with internet access.
3. Go through OOBE on windows and land at the desktop screen.
4. Open your web browser of choice, and type the link in the attachments section.
5. Complete with honesty.
6. Get flag.

ictf{2_ROUNdS_!n_@_ROw_wi7H_DAiLY_WE3KD@y_ChAll3N6E5_yaY!}

Easy way: submit the flag on the API endpoint /api/flags/submit with the "flag" parameter

Better way:

1. Have a functioning body with an IQ > 80
2. Have a functioning heart that can pump blood
3. Have the required budget to purchase a computer and internet access
4. Install arch linux
5. Visit imaginaryctf.org and make an account
6. Navigate to the 3 lines on the top right
7. Click on "challenges"
8. Find this challenge
9. Submit the flag found in the description
10. Profit

ictf{W3lcome_TO_RoUNd_51!!!!!}

Reverse, caesar shift of 25 to the right gives the flag.

ictf{non_guessy_challs_should_be_a_requirement_for_all_ctfs!}

Python stores x as floating point number, (43 * 95235152386537)/(2**52), where the factors of the numerator are prime. Normally, taking x%(x/n) would result in some small floating point error, but any factors of the numerator, or powers of 2, will not, as x/n will be exactly x divided by n. So, the answer is that large prime factor of the numerator (odds are not allowed).

Some numbers like 2**100 + 1 also work, but the upper bound takes care of them.

ictf{95235152386537}

The XOR result of two MT19937 output streams is still an MT19937 output stream. Use randcrack or some other tools to attack the MT19937.

from randcrack import RandCrack
from Crypto.Util.number import bytes_to_long, long_to_bytes

rc = RandCrack()
ct = open("ciphertext", "rb").read()
pt = open("msg.txt", "rb").read()
for i in range(624):
    rc.submit(
        bytes_to_long(pt[i * 4 : i * 4 + 4]) ^ bytes_to_long(ct[i * 4 : i * 4 + 4])
    )
for i in range(624, len(pt) // 4):
    rc.predict_getrandbits(32)
flag = b""
for i in range(len(pt) // 4, len(ct) // 4):
    flag += long_to_bytes(
        rc.predict_getrandbits(32) ^ bytes_to_long(ct[i * 4 : i * 4 + 4])
    )
print(flag)

ictf{w1tH_Th3s3_0utputs_MT19937_c4n_b3_pR3d1Ct3d}

Basically, a single hex character is encoded into 48 random bytes, but each of those is in its own 16 byte block. The point is to notice that the "OTP" and AES ECB preserve byte collisions within the same "encoding chunk". Due to the Birthday Paradox, we are almost certain to have a collision given 48 bytes (indeed, we expect one in ~16). We use the known plaintext to map the "collision structure" of a particular "encoding chunk" and use that to decode the unknown chunks. Hopefully that makes sense... 🤔 (look at solution.py) https://cybersharing.net/s/bf17f4c0108a4b5b54829225fa6fd3d8

ictf{Wh0s3_Ey35_aR3_7h0se_3y35?--fun^10xint^40=Ir2}

This is a common music sheet cipher/substitution cipher. Use https://www.dcode.fr/music-sheet-cipher or any other alternative

ictf{the_trombone_is_my_favorite_instrument}

https://cybersharing.net/s/6de65d1f43e39baca16928fb1baf0d94

ictf{570p_u51n6_3cb_m0d3_f0r_pl41n73x7}

squirrel → acorn → nroca → ROCA https://nvd.nist.gov/vuln/detail/CVE-2017-15361 https://github.com/crocs-muni/roca

ictf{TPM_vULn3r@B1Lit13$_aR3_M4j0r_oH_N03s}

https://cybersharing.net/s/82088d63d1800e59b3f7adfce4a1530e

ictf{bl3553d_by_7h3_r4v3l0rd}

https://cybersharing.net/s/f2a84992400bd7211515fde1bdf52600

ictf{h4v3_y0u_h34rd_0f_w13d3m4nn'5_4l60r17hm}

https://cybersharing.net/s/164757e945f9ef1adc27f72003347161

ictf{affinity_for_zwsp_ciphers}

Doing a Google reverse image search, "Fountain Paint Pot trail" is in many of the top results.

ictf{fountain_paint_pot_trail}

https://cybersharing.net/s/d9af018ac20d78df1031c242b85a5f49

ictf{w0W_YoU_4r3_5o_g0oD_@_CoUn71n6!!!!!!}

https://cybersharing.net/s/48d1cb2c0b7916d56fd4737c4dda3992

ictf{iF_Y0u_uS3d_6pT_&_d1D_n07_3V3N_r34d_SoURc3,_i_m1GH7_Ju5T_cR@$#_0uT!!}

rand() always returns 4, srand() cycles through the flag mangled with xor.

ictf{f0ur_15_pr377y_r4nd0m}

reverse it ig

ictf{50urc31355_func710n41_2b112}