Archived Challenges - May 2024

ictf{welcome_to_round_46_everybody!}

ictf{welcome_to_round_46_everybody!}

Go to the discord search. Use the during tag: during 2021-02-08 and search for ictf{. Set the from tag to Astro. The only result you see is the flag!

ictf{dQw4w9WgXcQ}

Just open the spectrogram of the file.

ictf{gu355y_m15c_ch4ll3ng35_c4n_b3_sc4ry_som3t1mes}

The challenge has been removed since the challenge instance was not working. It will be used in the future.

The challenge has been removed since the challenge instance was not working. It will be used in the future.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>

int from_hex(char c) {
    if(c >= '0' && c <= '9') {
        return c - '0';
    } else {
        return c - 'a' + 10;
    }
}

int main(void) {
    const char* flag = "941e94d287fab058fde5b60a1bd539ee4d55b70870f129ba6b2a76717658e4ceea1cc0b25d0184ff7c2c4cb48be66e28a4d5ed9609fcc4c86f";

    for(int i = 0; i < 3600; i++) {
        srand(1715875200 + i);

        for(int i = 0; i < strlen(flag) / 2; i++) {
            printf("%c", (from_hex(flag[2 * i]) * 16 + from_hex(flag[2 * i + 1])) ^ (rand() % 256));
        }

        printf("\n");
    }

    return 0;
}

ictf{cr34t1ng_ch4ll3ng3s_l4st_m1nut3_wh4t_c0uld_g0_wr0ng}

XOR with key 01

ictf{bit_flipping_ftw?_1d9b2139}

Cyberchef's magic thing suggests that it is base85 but decoding it doesn't work. Using dcode.fr's cipher identifier you get the right base which is base45.

ictf{r4nd0m_b4s3s_4r3_fun!}

You can see that each letter has been encoded. Simply decode each block of 4 (each letter). To solve in python: from base64 import b64decode as d; b''.join([d(ciphertext[i:i+4]) for i in range(0,len(ciphertext),4)]) Don't forget to define the ciphertext (as bytes).

ictf{v3ry_57r4ng3_b4s3_64!}

The program firstly consists of a permutation and matrix multiplication which are both easily inverted. After that a bunch of matrices with input characters inserted at certain positions are reduced. The first row of the reduced matrix needs to be only zeros, this will only happen if the resulting matrix is non-invertible, i.e the determinant is zero. You can calculate the symbolic determinant of all the matrices in terms of the input and then solve the system of equations using e.g a gröbner basis, see solve.py. If you don't understand how a certain lattice works just ask me. Solve script: https://fdow.nl/3I6Xd

ictf{l1v3&l3tL1v3}

The variables iters1 and iters2 could be even or odd. If they are even, the XOR cancels itself. In this case, one or both of them are odd. XORing the encrypted flag with key1 gives us the flag! This means that iters1 is odd while iters2 is even.

ictf{so_much_yet_so_little}

Create a class file with a function that takes an array of bytes and returns a boolean with code that's exactly as many bytes long as the code provided in the attachment (e.g. using Krakatau2). Replace the stub code with the code from the attachment and open the class file in a Java decompiler. Solve system of equations. (e.g. using Z3). Reference scripts to forge the class file and to calculate the flag: https://imaginaryctf.org/f/gmGTg#forge.py https://imaginaryctf.org/f/ek8aO#solve.py

ictf{asm_but_java}

#include"stdio.h"
#include"string.h"
int main()
{
	char command[1024]="aaiasiasassaiaasaiaiaaasssiasisaasiasissaiaasaiasisaisaisaiiaasaiassissaiasiid";
	unsigned int arr[]={0x81,0x6a,0x7f,0x6b,0x78,0x75,0x6e,0x7a,0x67,0x5e,0x83,0x6a,0x67,0x70,0x61,0x6f,0x81,0x73,0x6f,0x77,0x74};
	int index=0;
	for(int count=0;count<strlen(command);count++)
	{
		switch(command[count])
		{
			case 'a':
				arr[index]-=5;
				break;
			case 's':
				arr[index]+=3;
				break;
			case 'x':
				arr[index]=arr[index]^arr[index-1];
				break;
			case 'i':
				index++;
				break;
			case 'd':
				for(int i=0;i<21;i++)
					printf("%c",arr[i]);				
		}
	}
}

ictf{why_solve_when_output}

Figure out how the VM works and solve a few systems of linear equations: https://imaginaryctf.org/f/uL25u#solve.py

ictf{d035_s_5t4nd_f0r_51mpl3_0r_5t4ck??}

You can see that we can give shellcode and it will execute it in an rwx mmaped area. We can see that seccomp is enabled. So we need to bypass it. There are multiple ways to do it. I used openat2 to open the flag, pread to read it on the stack, writev to write it to stdout.

ictf{e45y_5h31lc0de_ch4ll3ng3}