Archived Challenges - February 2025

idk 54 is a kind cool number I guess, it has lots of factors and whatnot

ictf{w3lc0m3_70_r0und_54_0f_1c7f}

(async () => { const f = 'flag.txt'; console.log(await import(f)); })();

ictf{w4s_1t_4_0day_0r_4Re_y0u_just_g00d_1n_g4mbl1ng}

Use the assert statement to check if the flag contains a string

assert'ictf{...'in''+flag#@example.com

https://cybersharing.net/s/b60eadd580a8721af99bda2e20e87595 Note: script may take 10+ minutes but can be sped up by utilizing binary searching techniques (we can check multiple possibilities at a time using or)

ictf{this_is_fine}

The conversion process involves random sampling in the DCT. Use Compressed Sensing to recover the QR code.

ictf{c0mPress3d_s3nsing_1s_s0_c00o0OL}

Searching "Old Richmond Rd and FM 1464 N" on Google maps quickly yields the location of the school. "Pheasant Creek Dr" can be used as a sanity check to verify you have the right location. The person is Stephen F. Austin, who was born on 03 Nov 1793.

ictf{03-11-1793}

This just prints things by encoding the characters into positions of the 2d hilbert curve, this is pretty easy to reverse, you can even do it by hand if you want since the output size is so small. source : https://cybersharing.net/s/92b28ac8af5a76775bb53554df508ceb

ictf{surprisingly_simple_space_filling_curves_are_really_cool_though!}

Kinda wack steg/rev challenge, program generates a random maze seeded from 4 32 bit integers and uses that to encrypt a flag through some linear transforms that correspond to the shortest path between 2 corners of the maze. Both the encrypted flag and seed values are encoded into the image by the lsb of the first few values. source: https://cybersharing.net/s/6dc5ceecd50e1127a1b00b50efd7ff3f

ictf{Maze_in_O(V)_time}

When visiting the site, you can see that we need to unlock the vault with a pin. We also notice a WASM binary that gets called. If we reverse it, we can find some constraints for the valid pin. We can then create a Z3 script to solve for the pin and obtain the flag.

ictf{w4Sm_W4sm_wAsM_R3v3rS1ng}

This program takes in a 400x400 bmp file and transforms it over time by treating it as an initial state of the wave equation, this process is completely reversible by just reversing the timestep, in fact the program already can do so by pressing '-'. Source: https://cybersharing.net/s/0139db0c030b5816f7e46b3cffae8127

ictf{the_wave_equation_is_time_reversible}

https://cybersharing.net/s/31fefe34600abd85f80047264c1a31a2

ictf{p-1_g0es_aB$olU7eLy_w1lD!!!}

https://cybersharing.net/s/e2a176aad7cd70734a3b49a1cfa183d9

ictf{symmetry_of_bivariate_polynomials_is_zany}

https://cybersharing.net/s/34ca882a46fc46ce3382c1767b5dd798

ictf{m041_m4n_15_4_w45h3d_4u7h0r_wh0_0nly_m4k35_lf5r_ch4ll3n635}

It is basically truncated lcg parameter recovery so just adapt the idea of stern's attack on lcg and apply a bunch of LLL to solve it. See my solver for details and some explainations: https://cybersharing.net/s/ddfdcb9c47bf64fc8c5d3f094c8fd5b3

Note: iacr 2022/1134 might work too but I didn't try it.

ictf{lfsr_is_approximately_equal_to_lcg_right?}

This is a basic timing attack challenge, look at the response times from the server and you'll be able to decrypt the password byte by byte.

ictf{y37_4n07h3r_64mbl1n6_ch4ll?!?}

This is a Scytale cipher https://www.dcode.fr/scytale-cipher. Importantly this kind of cipher needs to be padded if its length is not divisible by the number of wrappings, I've specified that the message isn't padded so the number of wrappings divides the length of the message. The length only has 2 prime factors those being 1013 and 1009 so just try both (I don't remember which one is correct) Solve Script: https://cybersharing.net/s/be826c2211396ce28bd17ccd38074b41

ictf{f4c70r1z4710n_pr0bl3m_1n51d3_4n_4nc13n7_c1ph3r}

from Crypto.Util.number import *
import ast
with open("output.txt") as f:
    n = ast.literal_eval(f.readline())
    output = ast.literal_eval(f.readline())
p = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
res = ""
for out in output:
    if pow(out, 52437899, p) == 1:
        res += "1"
    else:
        res += "0"
print(long_to_bytes(int(res, 2)))

ictf{chEck_t0rsion_aft3r_pa1ring_3f1d7aec}

A format string vulnerability. You can overwrite printf@got to system. However, the program finishes after taking your input. We can overwrite .fini_array to the address of main. The fini_array contains address of the destructor functions. These are called when a program is about to exit. We can overwrite both printf@got to system and .fini_array to main through one format string input. By doing this, main is called again and this time, printf is overwritten with system, allowing you to get shell.

ictf{f0rm4t_5tr1ng_fun_7d4f3a1b}