copy and paste

ictf{Round_12_Sanity_Check}

The input function in python2 is vulnerable to code execution, as it evals the user input. Thus, the input __import__("os").system("cat flag.txt") will print the flag.

ictf{n3v3r_3v3r_3v3r_3v3r_u53_1npu7_1n_pyth0n2}

rot47: https://gchq.github.io/CyberChef/#recipe=ROT47(47)&input=OjRFN0w2b0QqMDQ5cD09Yj84Yj1EMDdFSE4

ictf{e@sY_chAll3ng3ls_ftw}

This "fancy caesar" is nothing more than a Vigenere cipher, you can break it with e.g. dcode.

ictf{MORELIKEVIGENERETART}

As a continuation from the first Password Recovery, this challenge takes advantage of an aspect of the Mersenne Twister that is often ignored. The final step of twisting a new state value is XOR-ing the combination of i and i + 1 with the value of i + 397. This means if you twist i, i + 1, and i + 624 you get i + 397. The mail log in this challenge has a chunk of values at the beginning and the end of the file and the flag is hidden in the message +397 from the beginning. There are not enough values provided to solve it any other way.

from base64 import b64decode
from operator import lshift, rshift
import re

MT_STATE_SIZE = 624
def unxorshift(x, operator, shift, mask=0xFFFFFFFF):
    res = x
    for i in range(32):
        res = x ^ (operator(res, shift) & mask)
    return res

def untemper(random_int):
    random_int = unxorshift(random_int, rshift, 18)
    random_int = unxorshift(random_int, lshift, 15, 0xefc60000)
    random_int = unxorshift(random_int, lshift, 7, 0x9d2c5680)
    random_int = unxorshift(random_int, rshift, 11)
    return random_int

def temper(state_int):
    state_int ^= (state_int >> 11)
    state_int ^= (state_int << 7) & 0x9d2c5680
    state_int ^= (state_int << 15) & 0xefc60000
    state_int ^= (state_int >> 18)
    return state_int

def twist(i, i1, i397_or_624):
    y = (i & 0x80000000) + (i1 & 0x7fffffff) 
    next = y >> 1
    if (y & 1) == 1:
        next ^= 0x9908b0df
    return next ^ i397_or_624

if __name__ == "__main__":
    state = []
    with open("password.recovery.mbox", "r") as f:
        for line in f.readlines():
            if m := re.match(r"^([A-Za-z0-9+\/]{11}=)", line):
                password = b64decode(m.group(1))
                state.append(untemper(int.from_bytes(password[:4], 'big')))
                state.append(untemper(int.from_bytes(password[4:], 'big')))
            if mms := re.match(r"([A-Za-z ]*), your password has been sent", line):
                state.extend([None, None])
    calculated = b''
    for i in range(len(state) - MT_STATE_SIZE):
        if state[i] and state[i + 1] and state[i + 624]:
            calculated += temper(twist(state[i], state[i + 1], state[i + 624])).to_bytes(4, 'big')
        print(f"{i}  {calculated}")```

ictf{St4t3_i+397_is_7rivi4lly_c0mpu73d}

Part 3 in the introduction to the Mersenne Twister is all about generating the state before a given state. A full state's worth of values are given in the mailbox file. From these values, the previous state can be generated by undoing what would have been the i and i+1 that produced that future value. There are probably some libraries out there that may help some folk, but the function to unwind the twister is not too difficult on its own. The sample solution provides the code to do this without the need for any library. https://imaginaryctf.org/r/FBA8-solve.password.pt.3.py

ictf{m3rs3nn3_tw1st3rs_c4n_b3_b4ck_g3N3r4t3d}

Google "default business router login" and you'll get the login you need to log into the router

ictf{w3b_and_0s1nt???_gr3at_c0mb0!}

Use an http3 enabled client such as curl or quiche http3-client or ones listed here https://github.com/quicwg/base-drafts/wiki/Implementations

ictf{who_knew_http_over_udp_could_be_so_quic(k)}

This is an SSTI. The goal is to escape the string and print the flag variable. This can be done with http://20.51.215.194:4000/check?flag=ictf{"}}{{flag}}}}}}, and more brackets can be added onto the end until the flag length check passes.

ictf{@llth3br@ck3t5}

Analyze the spectrum of the audio (e.g. https://academo.org/demos/spectrum-analyzer/), write the text down, decode from rot13 and you have the flag

ictf{34sy_4ud10_st3g4n0gr4phy}

Heap overflow to overwrite a variable stored in the next chunk. Find offset with GDB GEF or by adding 64 + 8 + 8 to account for metadata. Annotated solve script at https://imaginaryctf.org/r/3876-overflowwwwwwwww.py .

ictf{aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa_h34p_c4n_b3_0v3rfl0w3d_t00}

Encode ICICLE code to print the flag as a number, then call exec [number], as the exec instruction will decode it for you. My solution was exec 183827312370185651168152020034418275188078876928815084123222577. This runs the code:

pr r1```

ictf{3x3cut!v3_3x3cu+0r_3x3cut3s_3x3c}

Overflow the name buffer with 10 a's so that we control cmd. We append sh to our a's to get a payload of aaaaaaaaaash. (hence the reference to Ash in the description) This spawns a shell.

ictf{aAAaAAaaaAAAaaAAAaaAaaAaAAaaAAaAaAaaAAaaaAaAAAAAaAAaAAaAAAaAAAaash}

The file can be decompiled with an online decompiler. There are 3 phases - the first just checks for the password hotcupofcoffee. The second checks for the user to enter the factorials, up to 5 (1, 2, 6, 24, 120). The 3rd phase checks for a signed int that satisfies the equation 2x + 1 = -1 that isn't -1. By considering overflow (hence the "spilled" in the description), the solution 2147483647 can be found. This is used in an RSA decryption, giving the flag.

flag{i_4ctU411y_l1k3_T34_m0R3!}

https://imaginaryctf.org/r/B396-Regular_Reversing_Solution.txt

Step by Step Logic Solution: First, we want to take the general regex and break it down to all of its component lookaheads. Effectively each lookahead is just a different line in a logic puzzle. As we work through the puzzle, asterisks will indicate a spot we don't know yet. ^{ictf{ (?=.*4.0.R.G.) (?=.(?=\d\D{6}\d.+\d{2}\D\d.$)) (?=[}}]{42}5}$) (?=.+\Dn0\D(?:.[A-Z][2-8][A-Z]){1,}.\D4r.[^{]+$) (?=.u.{5}u.+ss[n0-5]+}) (?=(?=[NC0-9]{3}\W).(?=[ale]..[n-x301]{10}.{2}$)) (?=[689ABDEFH-MO-QS-Z]{43}) (?=(?:[]+){6}[}]+}) (?=[A-Z4]+'[b-w_0-7]++[l-xG_R0-5]+.$) (?=[C3P0]+4[NSA].[7of9].+[um]+[abc]help{3}}) (?=.+\w\w\dw(?:\d_).(?=.3[r4-9_xp]{3}3\w{2}[15][40].{2}})) (?=.+\D2.[mango][rum][hooch]+\w\d.{13}\dxp[^xp]{9}) (?=.{5}[ak47].\db\d.++_[D-Z3]{3}[BuMP69][l4ser]{3,6}) .*}$

The very first and very last lines just confirm that we are in the typical ictf format. First, we can take a look at (?=[^}]{42}5}$) - From here, since it ends with a closing brace and the end of the line we now definitively know the length of the final answer and the last two characters and we can no longer worry about this clue... ictf{******************************************5}

Next, we now can make sense of (?=[^689ABDEFH-MO-QS-Z]{43}) - this is giving us a large list of characters that appear nowhere in the answer at all... Any of these characters we see in other clues as options can now be ruled out... So let's update the following rules: (?=[CGNR4]+'[b-w_0-7]++[l-xG_R0-5]+.$) (?=[C30]+4[N].[7of].+[um]+[abc]help{3}}) This did get us some immediate clarity... we now see that the string must start with [CGNR4]+ and [C30]+ which really means it is one or more capital C and then we know it is followed by 4 and N due to [C30]+4[N]. To further zero-in on the number of C's, we can use (?=[NC0-9]{3}\W) since \W really is a synonym for [^A-Za-z0-9_], we now know that it is one C and is followed by some other punctuation type but not an underscore. ictf{C4N***************************************5}

The punctuation problem resolves with (?=[A-Z4]+'[b-w_0-7]+ - it now must be an apostrophe since we know the next character is \W. If we take a look at that in conjunction with (?=[C3P0]+4[NSA].[7of9], only 7 is left as a valid fifth character. ictf{C4N'7*************************************5}

The clue, (?=(?:[^]+){6}[]+}), tells us that we have six underscores total, and back to the C3P0 line, we know that one of them is immediately after our current characters. ictf{C4N'7************************************5}

With the first bit out of the way, we can take a look at the lines that end in $ to see if we can figure out the final word as well. Not counting the 5 we already got, we see the following clauses: .+\d{2}\D\d.$ - [n-x301]{10}.{2}$ - .*\D4r.[^]+$ Since we know the last two characters are 5} we know what the . represents in the first one and what .{2} represents in the second. So the second clause gives us the length of the word and the valid characters within it. ictf{C4N'7_*************************_**********5}

We knows that it must end with [301][301][n-x]5} when we combine what the two clauses are telling us. Now, if we look at (?=.3[r4-9_xp]{3}3\w{2}[15][40].{2}}) and we can narrow it further to needing to be 3[prx][prx][prx]3[n-x][n-x]10[n-x]5}. We can rule out the 4-9 thanks to 301. ictf{C4N'7_*********************_33**105}

With more characters filled in, we can start applying more vague lines. (?=.u.{5}u.+ss[n0-5]+}) works great. We know it needs a letter before 5} which now has to be an n. Likewise, the next two letters before that have to be ss. The ss can't fall back any further since we know the first three letters are in the set [xpr] ictf{C4N'7_*********************_33ss10n5}

We know we still need 4 more underscores and that they can't be in this last word. (?=.+\D2.[mango][rum][hooch]+\w\d.{13}\dxp[^{xp]{9}) and (?=[C3P0]+4[NSA].[7of9].+[um]+[abc]help{3}}) can help box us in further, thanks to the underscores. We know from the second one, the last three underscores all need at least five letters after them and then the word before that is 3+ characters long. Assuming the bare minimum with what we already know is something closest like this: ~ ictf{C4N'7_____33ss10n5} Now, those aren't necessarily the positions, but it does mean for the only length of 9 characters that contain no underscores is in the final word. So dxp[}xp]{9} must apply to that word and the only valid character in those final three that isn't x or p is an r. ictf{C4N'7*************************_3xpr3ss10n5}

Moving into the inside, we can take a look at (?=.+\Dn0\D(?:.[A-Z][2-8][A-Z]){1,}.\D4r.[^{_]+$) which now that we know the full final word, we can walk it backwards. .[}]+$ must apply to 3xpr3ss10n5} so 4r has to be the two preceding characters. And (?=[ale]..[n-x301]{10}.{2}$) confirms the letter before that must be [ael]. Since we don't have a place to put a + character yet, +[l-xG_R0-5]+.$ rules out the a and e. This then fully exhausts (?=(?=[NC0-9]{3}\W).*(?=[ale]..[n-x301]{10}.{2}$)) for us and we can choose to no longer look at it. ictf{C4N'7_**********************l4r_3xpr3ss10n5}

We still have not found our plus sign and we know what every character after it is in the following set: [l-xG_R0-5]. If we consider that with +[D-Z3]{3}[BuMP69][l4ser]{3,6}, we can narrow down what is valid in that second statement... +[GR3]{3}[u][l4ser]{3,6} If we assumed that our current 'l4r' was not part of that last clause, our remaining underscores would not fit into the solution based on our minimum spacing exercise from before. Therefore, we know this second to last word must be 7-10 characters long, the 4th character is u. We also know from our first clue (and knowing that there aren't anymore capital letters to find before the + sign) that there must be at least one R and one G and the R comes first. We could probably make an educated guess at the word at this point, but instead, let's look for something more definitive and cycle back once we can lock in one of these characters.

Our next best attempt at locking in specific positions at the moment is \D2.[mango][rum][hooch]+\w\d.{13}\dxp[^{xp]{9} - Using ? for our letters and and ! for numbers, it tells us that we have at least... ictf{C4N'7********????!*********l4r_3xpr3ss10n5} with some amount more letters possibly, a skipped character and then a 2. Since we know our last three underscores have at least 5 characters after them and the one before that has 3+ and that the second to last word has to be 7+ characters long, this actually helps us fill in where the underscores could possibly be... The \w after [hooch]+ has to be one or they no longer fit since we know that none of the underscores can be back to back: ?=(?:[}]+){6}[^]+}). In fact, knowing that the second to last word has to be at least 7 characters long and the one before it at least 5, this means they have to be exactly 5 and then 7 characters. Filling in the + and the u we have been waiting for, it gets us to: ictf{C4N'7*****???_!+_***ul4r_3xpr3ss10n5}

Since we now know the final three underscores, we can see that [um]+[abc][help] and [mango][rum][hooch]+\w\d have to overlap... which gives us m[um]ch! We have now fully applied (?=[C3P0]+4[NSA].[7of9].+[um]+[abc]help{3}}). Since 'much' makes more sense than 'mmch', we can probably assume that is what it is, but we will leave the options open for the moment. Looking back at (?=.+\Dn0\D(?:.[A-Z][2-8][A-Z]){1,}.), we know that we don't have anymore capital letters in the puzzle since '[b-w_0-7]++ completely binds the available characters. Therefore, knowing one R has to come before a G, we can finish the second to last word. Currently, we have no idea where 'n0' will go, but the options are getting more limited. ictf{C4N'7_***m[um]ch[0-7]+_R3Gul4r_3xpr3ss10n5}

Now, taking stock of the patterns we haven't matched yet... 4.0 - \d\D{6}\d - \Dn0\D - u.{5}u - \w\w\dw(?:\d) - \D2. - [ak47] - \db\d The \D2. was followed by one of the clues for 'm[um]ch', so we can place that digit. This also matches our digit, six non-digits, and digit. Likewise, there is only one place where we can fit \w\w\dw(?:\d) now... ictf{C4N'7_??!w_2_m[um]ch_[0-7]***+_R3Gul4r_3xpr3ss10n5}

All six underscores are now in place. 4.0 and \Dn0\D both need to be placed still and since the n is preceded by not a digit, they can't be in the same place. 4.0 can not possibly fit in the first word since it is \w\w\dw. n0 can't fit in the fifth, since 4.0 also has to fit there and only 4 characters are unknown. Since .{5}[ak47] is still outstanding, '[b-w_0-7]+ rules out the a and \D rules out the 47, the first letter must be k ictf{C4N'7_kn0w_2_m[um]ch[0-7]***+_R3Gul4r_3xpr3ss10n5}

This leaves us still needing to fit 4.0 and \db\d. Since our 4 unknown characters start with a digit and end with a +, the b must go between the two needed digits 4b0. This leaves us with u.{5}u - Our final word must be either 4b0*+ or !4b0+ - The second option means that there would never be a way to make the u 5 characters u work, so the word must be 4b0u+ ictf{C4N'7_kn0w_2_m[um]ch_4b0u+_R3Gul4r_3xpr3ss10n5}

Technically, we still have two options at this point, but only one makes sense - the final answer: ictf{C4N'7_kn0w_2_much_4b0u+_R3Gul4r_3xpr3ss10n5}

ictf{C4N'7_kn0w_2_much_4b0u+_R3Gul4r_3xpr3ss10n5}

We're confronted with a binary that randomly generates two matrices, checks the determinants to make sure they're invertible, and then multiplies the flag by the product of those matrices to obtain the output. All of this is performed modulo the prime 251, so that everything fits in a byte.

To get the flag:

• recover the product matrix from how it's generated
• invert it
• multiply it by the output

ictf{r4nd0m_m4tr1x_mul+}

Use the generated passwords to predict the state of the Mersenne Twister to predict the future passwords.

from base64 import b64decode
from operator import lshift, rshift
from random import getrandbits, setstate
from re import match

MT_STATE_SIZE = 624

def unxorshift(x, operator, shift, mask=0xFFFFFFFF):
    res = x
    for i in range(32):
        res = x ^ (operator(res, shift) & mask)
    return res

def untemper(random_int):
    random_int = unxorshift(random_int, rshift, 18)
    random_int = unxorshift(random_int, lshift, 15, 0xefc60000)
    random_int = unxorshift(random_int, lshift, 7, 0x9d2c5680)
    random_int = unxorshift(random_int, rshift, 11)
    return random_int

if __name__ == "__main__":
    passwords = []
    with open("password.recovery.mbox", "r") as f:
        for line in f.readlines():
            if m := match(r"^([A-Za-z0-9+\/]*=)", line):
                passwords += [b64decode(m.group(1))]

    # Convert the passwords back to a usable Mersenne Twister State
    state = []
    for password in passwords:
        state.append(untemper(int.from_bytes(password[:4], 'big')))
        state.append(untemper(int.from_bytes(password[4:], 'big')))

    # Verify we are synced up with our extra values
    setstate((3, tuple(state[:MT_STATE_SIZE] + [624]), None))
    for i in range(MT_STATE_SIZE, len(state)):
        print(f"{state[i]}  {untemper(getrandbits(32))}")

    # Recover Flag
    flag = b''
    for i in range(10):
        flag += getrandbits(32).to_bytes(4, 'big')
    print(flag.decode())```

ictf{Pr3d1ct_M3rs3nn3_By_S3tt1ng_St4t3}

The space for the starting seed is relatively small (roughly 100 million), and can be bruteforced. This is made easier by knowing that the seed, xored with the value for 'i', must equal the first byte.

enc = bytes.fromhex("e649fd7458fb36acb341346324635da87427d8d25f5c8b7665b921052727bf730f1c0273d00c23217873")
seed = enc[0]^ord('i')
nxt = enc[1]^ord('c')
while seed < 1e7:
    seed += 256
while seed < 1e8:
    flag = b''
    key = seed
    if int("{:016d}".format(key**2)[4:12])&0xff != nxt:
        seed += 256
        continue
    for c in enc:
        flag += bytes([c^(key&0xff)])
        key = int("{:016d}".format(key**2)[4:12])
    if b'ictf{' in flag:
        print(flag)
        break
    seed += 256```

ictf{f0r_l00p5_r1ght_th3r3_4nd_3v3ryWh3r3}

The actual document is an LSB hidden file, but there is too much static in the low order bit planes to be able to tell which ones it is encoded in. The visual ripples on the right side of the image clue there is something more going on. Either staring at or using a stereogram solver will show the text "G1R12B0". The title gives two different clues both indicating LSB. Doing an LSB decode with order GRB and using the bits Green 1, Red 1 + 2, and Blue 0 will uncover another jpeg that contains the flag. The LSB decoding can also be found with a brute force approach looking for magic bytes.

ictf{90s_st3r30grams_r_k3wl}

From the initials of the title, plus the fact that there exists an n variable that is the multiple of two large primes, it can easily be inferred that this challenge has something to do with RSA. Through trial and error, it can be seen that the recursive function f does modular exponentiation. Thus, the function is checking if a random number, raised to the power of y, then to the power of the input, is itself. In other words, the binary is checking to see if the flag is the modular inverse of y. Taking this modular inverse and converting to text gives the flag.

ictf{the_abuse_of_the_initials_of_rivest_shamir_and_adelman_is_criminal}

Open the Puzzle_Data\Managed\Assembly-CSharp.dll file on dnSpy (or another C# decompiler of your choice) and change something in order for the pillars not to block your way. For example, I changed the if statement in the method OnTriggerEnter located in the ActivatePillars class from:

if (other.gameObject.CompareTag("Player") && !this.busy)

to:

if (other.gameObject.CompareTag("Player") && this.busy)

Then I recompiled the DLL and saved it. When I reopened the game the pillars didn't show up and I was able to view the whole flag.

ICTF{ARE_YOU_WINNING_SON_GGGGG}

Cat is just a read/print loop, the only curveball is comparing the string "exit" in a jump, which can be done by converting the input to a int. GCD is also very simple, simple iterative versions exist, and the recursive version is fully tail recursive, so you don't need to implement (much) of a stack. For sort, I read the numbers one by one, and inserted them at the correct place in the linked list. The time constraint is lenient enough that insertion sort (or other O(n^2) sorts) are fine. My solutions for cat and gcd are as follows (sort is not included, for obvious reasons):

mov r9, 10
intstr r9, r9
main:
mov r10, "exit"
strint r10, r10
readstr r1
strint r2, r1
sub r2, r2, r10
jz r2, end
pr r1
pr r9
j main
end:```

main: mov r15, 65535

pr "Enter a number: "

readint r1

pr "Enter another number: "

readint r2 add r14, rip, 1 j gcd pr r3 j end

gcd: jz r2, zero mov r3, r2 mod r2, r1, r2 mov r1, r3 j gcd

zero: mov r3, r1 mov rip, r14

end:

ictf{wh@ts_c00l3r_th@n_b3!ng_c00l?_ICICLE!}

The file iii.py translates png files into iii files, and vice-versa. The stego.s file does LSB steganography, hiding a bit in the red[0], then a bit in blue[2], then skipping a pixel. The smallest bit of the largest byte is stored first, then next smallest, and so on. This can be seen by creating some trivial iii files (filled with null bytes), and hiding data in them with the provided file, seeing where the bits end up. Additionally, this can be see by simply reversing the stego.s file.

from Crypto.Util.number import *

ct = open("out.iii", "rb").read()
ct = ct[8:]

out = ''
for i, b in enumerate(ct):
    if i + 6 >= len(ct):
        break
    if i % 6 == 0:
        out += str(b&1)
    if i%6 == 2:
        out += str((b&4)//4)
out = out[::-1]
out = int(out, 2)
out = long_to_bytes(out)
out = out[::-1]
print(out)

ictf{idky_yall_asked_for_this_but_here_you_go_have_fun}