Timisoara CTF 2019 Write-up
TEAM : WTB
제출했던 풀이 보고서(영문): write-up:
아래는 제가 푼 문제 + a 들의 풀이입니다. (곧 세부설명 수정)
CRYPTO
Baby Crypto (50pts)
This file seems... odd
Otil bw amm gwc uilm qb! Emtkwum bw bpm ewvlmznct ewztl wn kzgxbwozixpg! Pmzm qa gwcz zmeizl: BQUKBN{Rctqca_Kimaiz_e0ctl_j3_xzwcl}
카이사르 돌리면 된다.
Proof of work (100pts)
While developing an anti-bot system we thought of a system to test if the users are indeed human. You need to enter a string whose SHA256 has the last 7 digits 0. As this hash is secure you need to use some processing power, thus denying spam. Sort of like mining bitcoin.
0부터 1씩 증가시켜서 전부 sha256을 돌린다.
돌려서 끝에 7자리가 0인 것을 뽑아내면 된다.
python3는 느리기 때문에 pypy3를 설치해서 사용했다.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
import hashlib
i = 0
while True:
string = str(i)
encoded_string = string.encode()
hexdigest = hashlib.sha256(encoded_string).hexdigest()
if "0000000" in str(hexdigest):
print(str(i) +": " +hexdigest)
i = i +1
#365512095
#TIMCTF{9e13449f334ded947431aa5001c2e9ab429ab5ddf880f416fe352a96eb2af122}
|
cs |
10분이상 돌렸던 것 같다.
Alien Alphabet (150pts)
I found this strange text. It is written in some strange alphabet. Can you decode it?
직접 문자에 알파벳 치환시켜서 빈도분석.
Password breaker (150pts)
I heard you were good at cracking passwords!
Hint! What are the most common attacks on a password? Dictionary and bruteforce
Hint! If it takes more than a few minutes you're doing it wrong.
1. 사전공격
2. 브포공격
TimCTF gamblig service (200pts)
Predict the next number to win. Are you that lucky?
시간기반 랜덤값
pipe 2개 연결해서 하나는 값을 받고 하나는 받은 값을 그대로 보내버리면 됨.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
from pwn import *
p = remote("89.38.208.143", 21023)
p2 = remote("89.38.208.143", 21023)
p.recvuntil(": ")
p.sendline("1")
p2.recvuntil(": ")
p2.sendline("2")
n = p.recvline()
p.close()
p2.sendline(n)
p2.interactive()
|
cs |
Strange cipher (250pts)
I have found this strange encryption service. Can you decode it?
한 글자씩 hex값을 맞춰가면 됨.
Forensics
Deleted file (100pts)
Help! I accidentally deleted a photo! Can you recover it for me please?
Non-standard flag format
png 시그니쳐 찾아서 카빙
Strange image (100pts)
I received this "image" in my mailbox today, but I can not open it, as if it was corrupted or something. Can you fix it and tell me if it has any hidden meaning?
Note: if you think you "fixed" it and it does not open, try using a few different photo viewers.
Hint! When you 'fix' your image make sure you try multiple photo viewers as some might not want to display it
xor 0x7a 연산을 하면 복구가 됨.
script :
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
import binascii
import re
fd = open("john.png", "rb")
dat = fd.read()
data = binascii.b2a_hex(dat)
datas = re.findall(r'..',data)
red = ""
for i in range(0, len(datas)):
bit = eval("0x"+str(datas[i])+" ^ 0x7a")
rad = str(hex(bit))
if len(rad) == 3 :
rad = rad.replace("0x", "0x0")
red += rad
else :
red += str(hex(bit))
print red
bin_ = ""
for j in range(0, len(red), 4):
binary_d = str(red[j:j+4])
binary_d = binary_d.replace("0x", "")
bin_ += "\\x"+binary_d
fh = open("image.png", "wb")
eval("fh.write(b'"+bin_+"')")
fh.close()
|
cs |
스테가노 사이트()에서 문자열만 보면, fl4g 찾을 수 있음.
: 오른쪽 부분을 특수문자까지 같이 rot 돌리면 플래그가 나옴. https://www.dcode.fr/rot-cipher
Tri-color QR (200pts)
I stumbled upon this strange QR code which seems to be in a new format. Can you help me decode it?\
stegsolve.jar로 3개 뽑아낼 수 있음.
그리고 hxd로 열었을때 푸터 시그니쳐 뒤에 PK 시그니쳐 확인 가능.
뽑아내서 압축 풀면 4번째 부분을 구할 수 있음.
Programming
Subset sum (200pts)
You are given a number n and an array. Find those elements from the array that sum to the given number.
Number of tests: 10
Size of the array: 4 - 40 (+4 per level)
Input data type: 64 bit unsigned ints
Input formatting: 2 lines of text, a line containing n and a line containg the array.
Output formatting: the size of the subset and the elements of the subset, separated by a space
Time limit: 3s
야매로 푼 문제.
합이 나오면, 그 합이 되는 원소랑 개수를 구해서 보내는 거 같은데, 1과 그 합을 그대로 보내보니까 통과가 되서 그냥 간단 스크립트 짜서 품.
Reverse Engineering
Baby Rev (50pts)
This program asks me for the flag, but i don't know it!
IDA
Easy Rev (75pts)
Like the last one, but harder
IDA
Math (150pts)
This executable is doing MATH. Everyone hates that so it must be hard to reverse
IDA로 까면 플래그 인코딩 연산 하는 부분이 있는데 이 부분을 그대로 파이썬으로 옮겨서 브포를 돌렸다.
완전자동화로 코드 짜다가 귀찮아서 그냥 반 노가다로 풀었다.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
|
def solv(input, q, p):
key = 14335727
base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
flag = "jveimeqpofewqY3chceAr+G6tPqKiM27u/CLhcbX7MPv" #44
cipher = "0"*44
cipher = list(cipher)
v7 = 0
v5 = 0
for i in range(0, len(input), 3):
if i > len(input)-3:
break;
v6 = key ^ (ord(input[i + 2]) | ((ord(input[i + 1]) | (ord(input[i]) << 8)) << 8))
for j in range(0, 3):
try:
str(input[i+j])
except :
v5 =1
for k in range(3, -1, -1):
v4=0
for l in range(5, -1, -1):
if ( v6 & (1 << (6 * k + l)) ):
v4 |= 1 << l
if v4:
cipher[v7] = base64[v4]
elif v5:
cipher[v7] = "="
else :
cipher[v7] = 'A'
v7 += 1
cipher = ''.join(cipher)
x=1
if cipher[x] == flag[x] and cipher[x+1] == flag[x+1]:
print(chr(q))
print(p)
print(cipher)
print(flag)
#yee = "TIMCTF{I_s33_you_UnDeRsTaNd_x86}"
yee= "TIMCTF{"
for q in range(33, 127):
yy = yee + str(chr(q))
for p in range(33,127):
yeee = yy +str(chr(p))+str(chr(p))
solv(yeee, q, p)
|
cs |
돌려서 나온값 yee에 추가하고 x값 1씩 증가시켜주면 된다.
가끔 위 방식대로 하다가 출력되는 문자가 여러개가 나온다면, x값을 더 증가시켜 주면 된다.
Strange jump (250pts)
This application likes to jump!
math와 동일. 플래그 인코딩하는 부분 찾아서 브포했다.
연산코드마저 math의 key xor하는 부분을 제외하면 math와 풀이 코드가 같다.
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
def solv(input, q, p):
base64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
flag = "VElNQ1RGe2RlQzNwdDF2ZV9FeGNlUDB0aTBuX2g0bmRMZXJ9" #44
cipher = "0"*55
cipher = list(cipher)
v7 = 0
v5 = 0
for i in range(0, len(input), 3):
if i > len(input)-3:
break;
v6 = (ord(input[i + 2]) | ((ord(input[i + 1]) | (ord(input[i]) << 8)) << 8))
for j in range(0, 3):
try:
str(input[i+j])
except :
v5 =1
for k in range(3, -1, -1):
v4=0
for l in range(5, -1, -1):
if ( v6 & (1 << (6 * k + l)) ):
v4 |= 1 << l
if v4:
cipher[v7] = base64[v4]
elif v5:
cipher[v7] = "="
else :
cipher[v7] = 'A'
v7 += 1
cipher = ''.join(cipher)
y = 17
if cipher[y] == flag[y] and cipher[y+1] == flag[y+1]:
print(chr(q))
print(p)
print(cipher)
print(flag)
yee = "TIMCTF{"
for q in range(33, 127):
yy = yee + str(chr(q))
for p in range(33,127):
yeee = yy +str(chr(p))+str(chr(p))+str(chr(p))
solv(yeee, q, p)
|
cs |
math와 동일. 돌려서 나온값 yee에 추가하고 x값 1씩 증가시켜주면 된다.
가끔 위 방식대로 하다가 출력되는 문자가 여러개가 나온다면, x값을 더 증가시켜 주면 된다.
Web
Not so empty website (50pts)
This website looks empty, but trust me, it is not!
페이지 소스에 나와있다.
Secret key of swag (150pts)
Our spies leaked the authentication algorithm for this site, but the login seems rigged. Is it so?
parse()함수가 extract($_GET)과 같은 효과
$processed_key에 그대로 hax0r을 넣으면 끝.
Admin panel (200pts)
Your job is to hack this admin panel and login.
sql 인젝션.
admin@admin
pw : ' or '1' = '1
'CTF Write Up' 카테고리의 다른 글
| X-MAS CTF 2019 X-MAS Helper write-up (0) | 2019.12.21 |
|---|---|
| THE HACKING CHAMPIONSHIP JUNIOR 2019 FINAL Write-up (0) | 2019.12.10 |
| 20회 Hackingcamp CTF MISC [GuessWhat] 풀이 (0) | 2019.08.26 |
| 20회 Hackingcamp CTF Forensics [흔적을 남기다] 풀이 (1) | 2019.08.25 |
| YISF 2019 본선 풀이 (0) | 2019.08.19 |