Archived Challenges - August 2024

The flag is leaked in plaintext; check attachments.

ictf{round_48_meaning_4_years_for_ictf!}

import pickle
import sys
sys.exit = lambda _: ['' for _ in range(100)]
print(''.join(pickle.loads(bytes.fromhex('80049549010000000000008c03737973948c04657869749493944da40185945294284b248c0168944b038c0166944b348c0172944b3e8c0167944b3a8c015f944b398c0133944b298c0163944b178c0175944b1e8c016e944b0e8c0134944b3d680e4b218c0164944b048c017b944b3668094b3c8c016c944b3268054b2d68094b068c0130944b0968074b238c0174944b07680d4b20680a4b3768134b278c0170944b1b680d4b33680e4b0c680c4b1868094b288c0131944b3f8c017d944b008c0169944b1168124b318c0173944b2c680a4b0b68134b2e68134b2268094b12680d4b1d68154b0d68114b158c0179944b1668124b2f68124b1f680b4b35680a4b1068154b2668094b3068094b138c0135944b1c8c0176944b0a680e4b0268134b3868054b2a8c016b944b0f68134b0868084b25680a4b05680b4b2b68154b3b68064b1a68124b19680b4b1468094b01680b752e'))))

ictf{c0ngr4tul4t10n5_y0u_c0nv1nc3d_th3_p1ck13_t0_sh4r3_th3_fl4g}

Easy way: paste into cyberchef, select XOR brute force, stop when ictf{ appears for first 4 characters. Intended way: same procedure but without using cyberchef.

Cyberchef solve: https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')XOR_Brute_Force(1,100,0,'Standard',false,true,false,'ictf')&input=MWEgMTAgMDcgMTUgMDggMWUgMTIgMWQgMTcgMTIgMDcgMWMgMDEgMGEgMmMgMGIgMWMgMDEgMmMgMTAgMWIgMTIgMWYgMWYgMmMgNGEgNDEgNDAgMTEgMTIgMTAgNDYgNDcgNGEgMGU

ictf{mandatory_xor_chall_923bac549}

use resultant of the two polynomials to recover p and q, then decrypt the RSA. Solve script hosted at https://cybersharing.net/s/3c2692c3ecade6f4

ictf{re5ult@nt_1s_my_b35t_fri3nd!}

https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')ROT8000()&input=ZTcgYjEgYjIgZTcgYjEgYWMgZTcgYjEgYmQgZTcgYjEgYWYgZTcgYjIgODQgZTcgYjIgODAgZTcgYjEgYWUgZTcgYjEgYTggZTcgYjEgYjEgZTcgYjEgYWEgZTcgYjEgYmYgZTcgYjEgYWUgZTcgYjEgYjcgZTcgYjEgYmQgZTcgYjEgYTggZTcgYjEgYjEgZTcgYjEgYWEgZTcgYjEgYWQgZTcgYjEgYTggZTcgYjEgYWEgZTcgYjEgYTggZTcgYjEgYWMgZTcgYjEgYWUgZTcgYjEgYWEgZTcgYjEgYmMgZTcgYjEgYWEgZTcgYjEgYmIgZTcgYjEgYTggZTcgYjEgYWMgZTcgYjEgYjEgZTcgYjEgYWEgZTcgYjEgYjUgZTcgYjEgYjUgZTcgYjEgYWUgZTcgYjEgYjcgZTcgYjEgYjAgZTcgYjEgYWUgZTcgYjEgYTggZTcgYjEgYjIgZTcgYjEgYjcgZTcgYjEgYTggZTcgYjEgYmEgZTcgYjEgYmUgZTcgYjEgYjIgZTcgYjEgYmQgZTcgYjEgYWUgZTcgYjEgYTggZTcgYjEgYmMgZTcgYjEgYjggZTcgYjEgYjYgZTcgYjEgYWUgZTcgYjEgYTggZTcgYjEgYmQgZTcgYjEgYjIgZTcgYjEgYjYgZTcgYjEgYWUgZTcgYjIgODY&oenc=65001

ictf{we_havent_had_a_ceasar_challenge_in_quite_some_time}

Expressing the recursive sequence as matrix form can yield two polynomials. By computing the GCD of these polynomials, the roots can be found.

from shared.polynomial import fast_polynomial_gcd
# https://github.com/jvdsn/crypto-attacks
from Crypto.Util.number import *
c1 = ...
c2 = ...
p = ...
PR.<x> = PolynomialRing(GF(p))

M = Matrix([
[x,1],
[1,0]
])
L1 = M^1337
L2 = M^13337
f1 = L1[0][0]+L1[0][1]-c1
f2 = L2[0][0]+L2[0][1]-c2
g = fast_polynomial_gcd(f1,f2)
print(long_to_bytes(int(g.roots()[0][0])))

ictf{matrix_fib0nacci_with_p0lygcd_is_awes0me}

make a config of gmmk/pro/rev1/ansi from qmk configurator with the keys in alphabetical order, and then map out the locations of each of the keys by diffing with the given file. the flag replaces the qwertyuiopasdfghjk keys. also use page 53 of https://www.usb.org/sites/default/files/documents/hut1_12v2.pdf

ictf{qmk_such_wow}

Everything hints at newlines. Looking at the files (they are numbered) and the amount of lines/newlines they have is the ASCII value of the character! You can confirm this because you know the flag format. Go through files 0-4 and see that the amount of newlines form ictf{. Write a script to decode this all!

ictf{s0_m4ny_n3wl1n35_b7w_7h15_15_4_v3ry_l0ng_fl4g_s0_h0p3fully_y0u_wr073_4_5cr1p7_f0r_7h1s!!!}

printf 'GET http://not_used HTTP/1.0\r\nHost: fakehost/fla\tg.txt?\r\n\r\n' | nc localhost 4000

ictf{I_hope_there_is_no_more_unintended_solutions_this_time_:(}

#include"stdio.h"

int main()
{
	unsigned char arr[] = {0x09, 0x03, 0xee, 0x00, 0xfb, 0xfe, 0xf9, 0x08, 0x01, 0x05, 0x09, 0x03, 0x17, 0x03, 0x07, 0xfe, 0xfd, 0x17, 0x07, 0xf4, 0x17, 0xf3, 0x07, 0x05, 0xfd, 0xee, 0x0a, 0x09, 0x08, 0xff, 0x17, 0x32, 0x34, 0x04, 0xfe, 0x31, 0x34, 0x30, 0x2f, 0x03, 0x33, 0xf5};
	for(int i=0;i<sizeof(arr);i++)
		printf("%c", (arr[i]+0x13) ^ 0x75);
	return 0;
}

ictf{dynamic_code_or_something_02bd1267c3}

Use ILSpy to reverse the application, simulate the shuffler to figure out where the chars end up and reconstruct the flag.

ictf{C#_r3v3R51ng_cH411}

Terrence Descartes was a fictional person used for Imaginary CTF 2024 OSINT challenges. Looking at his LinkedIn (The OSINT challenges were mostly based around his Instagram, Github, and Linkedin), we find a post starting with "The current state of the world is not good." and showing hate against me! (That's because I made a hard OSINT challenge for n00bzCTF 2024 and Ethan DOES NOT like OSINT). The flag is at the bottom of the post.

ictf{N00bM4s73r_m4k3s_g00d_051nt_ch4ll5_right?}