Added CTFlearn writeups

This commit is contained in:
rishitsaiya 2020-07-31 18:48:25 +05:30
commit 53fd30619d
151 changed files with 15249 additions and 0 deletions

View File

@ -0,0 +1,15 @@
## Favorite Color
The main idea finding the flag is exploiting the Buffer Overflow of the Binary file.
#### Step-1:
After logging into the remote access with `ssh color@104.131.79.111 -p 1001` and password as `guest`,
my system got completely crashed due to several DDoS attacks. So, I directly looked up for solution and understood from there.
https://www.embeddedhacker.com/2020/01/hacking-walkthrough-ctflearn-binary-medium/
#### Step-2:
Finally the flag becomes:
`flag{c0lor_0f_0verf1ow}`

Binary file not shown.

After

Width:  |  Height:  |  Size: 45 KiB

View File

@ -0,0 +1,22 @@
## Lazy Game Challenge
The main idea finding the flag is thinking differently to break the logic in binary file.
#### Step-1:
After pwning into the given machine: `nc thekidofarcrania.com 10001`, we are asked to play a betting game.
#### Step-2:
I input <strong>Y</strong> and proceed to see the game. According to given scenario, I seemed to lose every bet of 100$. So I had to do something differently.
#### Step-3:
This time I placed a bet of a hefty number like 1000000$ which I didn't even possess. I spit out errors. :(
#### Step-4:
But the main idea in pwning lies in abnormal thinking and that's where you focus. I tried out negative number this time for the bet like -100000$. I still could play, it shows there was a program logic flaw there.
Now I went wild to give all numbers (which I had to guess below 10) greater than 10. Finally it gave me flag.
<img src="Flag.png">
#### Step-3:
Finally the flag becomes:
`CTFlearn{d9029a08c55b936cbc9a30_i_wish_real_betting_games_were_like_this!}`

View File

@ -0,0 +1,14 @@
import numpy as np
arr = np.arange(65,90).reshape(5, 5) # Array of alphabet
arr = np.where(arr <75, arr, arr+1) # Array without 'K'
cells = ["1-3","4-4","2-1","{","4-4","2-3","4-5","3-2","1-2","4-3","_","4-5","3-5","}"]
for i in cells:
if(ord(i[0])>=48 and ord(i[0])<=57):
x=int(i[0])-1
y=int(i[2])-1
print(chr(arr[x][y]),end="")
else:
print(i[0],end="")
print("\n")

View File

@ -0,0 +1,47 @@
## 5x5 Crypto
The main idea finding the flag is by simple pairs.
#### Step-1:
After reading the given text:
`Ever heard of the 5x5 secret message system? If not, basically it's a 5x5 grid with all letters of the alphabet in order, without k because c is represented to make the k sound only. Google it if you need to. A letter is identified by Row-Column. All values are in caps. Try: 1-3,4-4,2-1,{,4-4,2-3,4-5,3-2,1-2,4-3,_,4-5,3-5,}`
#### Step-2:
So, basically the table is:
<img src="Table.png">
We can decode the message according to given inputs in message above to get the flag.
#### Step-3:
Instead I wrote a `Flag.py` script to get the flag.
```
import numpy as np
arr = np.arange(65,90).reshape(5, 5) # Array of alphabet
arr = np.where(arr <75, arr, arr+1) # Array without 'K'
cells = ["1-3","4-4","2-1","{","4-4","2-3","4-5","3-2","1-2","4-3","_","4-5","3-5","}"]
for i in cells:
if(ord(i[0])>=48 and ord(i[0])<=57):
x=int(i[0])-1
y=int(i[2])-1
print(chr(arr[x][y]),end="")
else:
print(i[0],end="")
print("\n")
```
#### Step-4:
If we execute this script by `python3 Flag.py`, I got the following output:
```
CTF{THUMBS_UP}
```
#### Step-5:
Finally the flag becomes:
`CTF{THUMBS_UP}`

Binary file not shown.

After

Width:  |  Height:  |  Size: 10 KiB

View File

@ -0,0 +1,29 @@
## ALEXCTF CR2: Many time secrets
The main idea finding the flag is decomposing the Hex dump and finding the public key.
#### Step-1:
After we download `msg(4)` from the cloud, we get the following data.
`0529242a631234122d2b36697f13272c207f2021283a6b0c79082f28202a302029142c653f3c7f2a2636273e3f2d653e25217908322921780c3a235b3c2c3f207f372e21733a3a2b37263b3130122f6c363b2b312b1e64651b6537222e37377f2020242b6b2c2d5d283f652c2b31661426292b653a292c372a2f20212a316b283c0929232178373c270f682c216532263b2d3632353c2c3c2a293504613c37373531285b3c2a72273a67212a277f373a243c20203d5d
243a202a633d205b3c2d3765342236653a2c7423202f3f652a182239373d6f740a1e3c651f207f2c212a247f3d2e65262430791c263e203d63232f0f20653f207f332065262c31683137223679182f2f372133202f142665212637222220733e383f2426386b`
Working out:
https://youtu.be/p4DIab6NKOY?t=307
The link for this tool is below:
https://github.com/SpiderLabs/cribdrag
#### Step-2:
I didn't have complete idea on proceeding on this challenge, so I took help from online and got this.
https://youtu.be/p4DIab6NKOY?t=307
#### Step-3:
Alternatively, same flag can be approached in another way also.
https://www.embeddedhacker.com/2020/01/hacking-walkthrough-ctflearn-crypto-medium/
#### Step-4:
Finally the flag becomes:
`ALEXCTF{HERE_GOES_THE_KEY}`

View File

@ -0,0 +1,104 @@
#!/usr/bin/python
##########################
# cribdrag - An interactive crib dragging tool
# Daniel Crowley
# Copyright (C) 2013 Trustwave Holdings, Inc.
# This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
# You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
##########################
import sys
import re
import argparse
def sxor(ctext,crib):
# convert strings to a list of character pair tuples
# go through each tuple, converting them to ASCII code (ord)
# perform exclusive or on the ASCII code
# then convert the result back to ASCII (chr)
# merge the resulting array of characters as a string
results = []
single_result = ''
crib_len = len(crib)
positions = len(ctext)-crib_len+1
for index in xrange(positions):
single_result = ''
for a,b in zip(ctext[index:index+crib_len],crib):
single_result += chr(ord(a) ^ ord(b))
results.append(single_result)
return results
def print_linewrapped(text):
line_width = 40
text_len = len(text)
for chunk in xrange(0,text_len,line_width):
if chunk > text_len-line_width:
print str(chunk) + chr(9) + text[chunk:]
else:
print str(chunk) + chr(9) + text[chunk:chunk+line_width]
parser = argparse.ArgumentParser(description='cribdrag, the interactive crib dragging script, allows you to interactively decrypt ciphertext using a cryptanalytic technique known as "crib dragging". This technique involves applying a known or guessed part of the plaintext (a "crib") to every possible position of the ciphertext. By analyzing the result of each operation and the likelihood of the result being a successful decryption based on the expected format and language of the plaintext one can recover the plaintext by making educated guesses and adaptive application of the crib dragging technique.')
parser.add_argument('ciphertext', help='Ciphertext, encoded in an ASCII hex format (ie. ABC would be 414243)')
parser.add_argument('-c', '--charset', help='A regex-style character set to be used to identify best candidates for successful decryption (ex: for alphanumeric characters and spaces, use "a-zA-Z0-9 ")', default='a-zA-Z0-9.,?! :;\'"')
args = parser.parse_args()
ctext = args.ciphertext.decode('hex')
ctext_len = len(ctext)
display_ctext = "_" * ctext_len
display_key = "_" * ctext_len
charset = '^['+args.charset+']+$'
response = ''
while response != 'end':
print "Your message is currently:"
print_linewrapped(display_ctext)
print "Your key is currently:"
print_linewrapped(display_key)
crib = raw_input("Please enter your crib: ")
crib_len = len(crib)
results = sxor(ctext, crib)
results_len = len(results)
#Generate results
for result_index in xrange(results_len):
if (re.search(charset,results[result_index])):
print '*** ' + str(result_index) + ': "' + results[result_index] + '"'
else:
print str(result_index) + ': "' + results[result_index] + '"'
response = raw_input("Enter the correct position, 'none' for no match, or 'end' to quit: ")
#Replace part of the message or key
try:
response = int(response)
if (response < results_len):
message_or_key = ''
while (message_or_key != 'message' and message_or_key != 'key'):
message_or_key = raw_input("Is this crib part of the message or key? Please enter 'message' or 'key': ")
if(message_or_key == 'message'):
display_ctext = display_ctext[:response] + crib + display_ctext[response+crib_len:]
display_key = display_key[:response] + results[response] + display_key[response+crib_len:]
elif(message_or_key == 'key'):
display_key = display_key[:response] + crib + display_key[response+crib_len:]
display_ctext = display_ctext[:response] + results[response] + display_ctext[response+crib_len:]
else:
print 'Invalid response. Try again.'
except ValueError:
if (response == 'end'):
print "Your message is: " + display_ctext
print "Your key is: " + display_key
elif (response == 'none'):
print "No changes made."
else:
print "Invalid entry."

View File

@ -0,0 +1,11 @@
0529242a631234122d2b36697f13272c207f2021283a6b0c7908
2f28202a302029142c653f3c7f2a2636273e3f2d653e25217908
322921780c3a235b3c2c3f207f372e21733a3a2b37263b313012
2f6c363b2b312b1e64651b6537222e37377f2020242b6b2c2d5d
283f652c2b31661426292b653a292c372a2f20212a316b283c09
29232178373c270f682c216532263b2d3632353c2c3c2a293504
613c37373531285b3c2a72273a67212a277f373a243c20203d5d
243a202a633d205b3c2d3765342236653a2c7423202f3f652a18
2239373d6f740a1e3c651f207f2c212a247f3d2e65262430791c
263e203d63232f0f20653f207f332065262c3168313722367918
2f2f372133202f142665212637222220733e383f2426386b

Binary file not shown.

After

Width:  |  Height:  |  Size: 47 KiB

View File

@ -0,0 +1,20 @@
## Base 2 2 the 6
The main idea finding the flag is $2^6$ = 64.
#### Step-1:
After we read the message given,
`Q1RGe0ZsYWdneVdhZ2d5UmFnZ3l9`
It is clearly Base64 encrypted.
#### Step-2:
I tried to decode it online here: https://www.base64decode.org/
I got the following result:
<img src="Decode.png">
#### Step-3:
Finally the flag becomes:
`CTF{FlaggyWaggyRaggy}`

Binary file not shown.

After

Width:  |  Height:  |  Size: 246 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 172 KiB

View File

@ -0,0 +1,26 @@
## BruXOR
The main idea finding the flag is XOR Bruteforce.
#### Step-1:
After reading the message in the question,
`There is a technique called bruteforce. Message: q{vpln'bH_varHuebcrqxetrHOXEj No key! Just brute .. brute .. brute ... :D`
The first thing I searched online was XOR Bruteforce and I got some helpful results.
#### Step-2:
I followed the URL: https://www.dcode.fr/xor-cipher
Since in the message, it is clearly that there is no key, my inputs were as follows: (Only Bruteforce xP)
<img src="Input.png">
#### Step-3:
After decrypting, we get the following results, amidst which I found the flag.
<img src="Flag.png">
#### Step-4:
Finally the flag becomes:
`flag{y0u_Have_bruteforce_XOR}`

View File

@ -0,0 +1,16 @@
## Character Encoding
The main idea finding the flag using simple Hex to text conversion.
#### Step-1:
Generally, I don't criticize any challenge, but this one crossed limits. It was too Ez. xP.
We have been given simple Hex code: `41 42 43 54 46 7B 34 35 43 31 31 5F 31 35 5F 55 35 33 46 55 4C 7D`
#### Step-2:
Convert it online here to text:
http://www.unit-conversion.info/texttools/hexadecimal/
#### Step-3:
Finally the flag becomes:
`ABCTF{45C11_15_U53FUL}`

View File

@ -0,0 +1,29 @@
## Hextroadinary
The main idea finding the flag is to read the question properly and interpret.
#### Step-1:
After we read the given message:
`Meet ROXy, a coder obsessed with being exclusively the worlds best hacker. She specializes in short cryptic hard to decipher secret codes. The below hex values for example, she did something with them to generate a secret code, can you figure out what? Your answer should start with 0x.`
`0xc4115` `0x4cf8`
#### Step-2:
`Meet ROXy` - This should give us a simple idea that we have to XOR the 2 given Hex numbers.
#### Step-3:
So I tried it online here:
http://xor.pw/#
<img src="xor.png">
Note: Do not forget `0x` before flag.
#### Step-7:
Finally the flag becomes:
`CTFlearn{0xc0ded}`

Binary file not shown.

After

Width:  |  Height:  |  Size: 38 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 236 KiB

View File

@ -0,0 +1,27 @@
## HyperStream Test #2
The main idea finding the flag is to know Baconian Cipher.
#### Step-1:
After reading the challenge properly,
```
I love the smell of bacon in the morning!
ABAAAABABAABBABBAABBAABAAAAAABAAAAAAAABAABBABABBAAAAABBABBABABBAABAABABABBAABBABBAABB
```
#### Step-2:
It is clear that it has to be Baconian Cipher. Those who are unaware of it, can refer here:
https://en.wikipedia.org/wiki/Bacon%27s_cipher
I then quickly looked for online Baconian Cipher decoders.
#### Step-3:
I followed URL: https://www.dcode.fr/bacon-cipher.
I got the following results:
<img src="Flag.png">
#### Step-4:
Finally the flag becomes:
`ILOUEBACONDONTYOU`

Binary file not shown.

After

Width:  |  Height:  |  Size: 41 KiB

View File

@ -0,0 +1,24 @@
## Morse Code
The main idea finding the flag is just having knowledge about Morse Code.
#### Step-1:
This is the message given to us:
`..-. .-.. .- --. ... .- -- ..- . .-.. -- --- .-. ... . .. ... -.-. --- --- .-.. -... -.-- - .... . .-- .- -.-- .. .-.. .. -.- . -.-. .... . . ...`
#### Step-2:
I used this URL to decode our answer:
https://cryptii.com/pipes/morse-code-to-text
#### Step-3:
This was my output:
<img src="Flag.png">
That's it. That's our flag.
#### Step-4:
Finally the flag becomes:
`flagsamuelmorseiscoolbythewayilikechees`

View File

@ -0,0 +1,17 @@
import gmpy2
from gmpy2 import mpz
e=mpz(3)
c=mpz(219878849218803628752496734037301843801487889344508611639028)
n=mpz(245841236512478852752909734912575581815967630033049838269083)
#use factordb
q=mpz(416064700201658306196320137931)
p=mpz(590872612825179551336102196593)
phi=gmpy2.mul(p-1,q-1)
d=gmpy2.invert(e,phi)
f=gmpy2.powmod(c,d,n)
g=bytes.fromhex(hex(f)[2:])
print("[+] Flag is : ",g)

View File

@ -0,0 +1,48 @@
## RSA Beginner
The main idea finding the flag using RSA function and its operations.
#### Step-1:
After we download `rsa (1).txt` from the cloud, we try to understand what is the content.
If anyone is unaware of RSA Encryption, they can checkout here:
https://en.wikipedia.org/wiki/RSA_(cryptosystem)
#### Step-2:
The contents of `rsa (1).txt` are as follows:
```
e: 3
c: 219878849218803628752496734037301843801487889344508611639028
n: 245841236512478852752909734912575581815967630033049838269083
```
#### Step-3:
We run a simple `Flag.py` script to get the flag.
```
import gmpy2
from gmpy2 import mpz
e=mpz(3)
c=mpz(219878849218803628752496734037301843801487889344508611639028)
n=mpz(245841236512478852752909734912575581815967630033049838269083)
#use factordb
q=mpz(416064700201658306196320137931)
p=mpz(590872612825179551336102196593)
phi=gmpy2.mul(p-1,q-1)
d=gmpy2.invert(e,phi)
f=gmpy2.powmod(c,d,n)
g=bytes.fromhex(hex(f)[2:])
print("[+] Flag is : ",g)
```
#### Step-4:
The output of `python3 Flag.py` is as follows:
`[+] Flag is : b'abctf{rs4_is_aw3s0m3}'`
#### Step-5:
Finally the flag becomes:
`abctf{rs4_is_aw3s0m3}`

View File

@ -0,0 +1,3 @@
e: 3
c: 219878849218803628752496734037301843801487889344508611639028
n: 245841236512478852752909734912575581815967630033049838269083

Binary file not shown.

After

Width:  |  Height:  |  Size: 53 KiB

View File

@ -0,0 +1,19 @@
from Crypto.Util.number import inverse
import binascii
e = 1
c = 9327565722767258308650643213344542404592011161659991421
n = 245841236512478852752909734912575581815967630033049838269083
# From factordb
p = 416064700201658306196320137931
q = 590872612825179551336102196593
phi = (p-1) * (q-1)
d = inverse(e,phi)
m = pow(c,d,n)
hex_str = hex(m)[2:] # Removing '0x'
print(binascii.unhexlify(hex_str))

View File

@ -0,0 +1,65 @@
## RSA Noob
The main idea finding the flag using RSA function and its operations.
#### Step-1:
After we download `rsanoob(1).txt` from the cloud, we try to understand what is the content.
If anyone is unaware of RSA Encryption, they can checkout here:
https://en.wikipedia.org/wiki/RSA_(cryptosystem)
#### Step-2:
The contents of `rsa (1).txt` are as follows:
```
e: 1
c: 9327565722767258308650643213344542404592011161659991421
n: 245841236512478852752909734912575581815967630033049838269083
```
#### Step-3:
'e' and 'n' - Public key.
'c' - Cipher text.
Given `n` to us, we try to find `p` & `q` online from http://factordb.com/index.php
#### Step-4:
We get the `p` & `q` online as follows:
<img src="Factorize.png">
Now we can feed inputs manually to yield flag.
#### Step-5:
Running this `Flag.py` script:
```
from Crypto.Util.number import inverse
import binascii
e = 1
c = 9327565722767258308650643213344542404592011161659991421
n = 245841236512478852752909734912575581815967630033049838269083
# From factordb
p = 416064700201658306196320137931
q = 590872612825179551336102196593
phi = (p-1) * (q-1)
d = inverse(e,phi)
m = pow(c,d,n)
hex_str = hex(m)[2:] # Removing '0x'
print(binascii.unhexlify(hex_str))
```
#### Step-6:
We get the flag by `python3 Flag.py`
We get this output:
`b'abctf{b3tter_up_y0ur_e}'`
#### Step-7:
Finally the flag becomes:
`abctf{b3tter_up_y0ur_e}`

View File

@ -0,0 +1,3 @@
e: 1
c: 9327565722767258308650643213344542404592011161659991421
n: 245841236512478852752909734912575581815967630033049838269083

Binary file not shown.

After

Width:  |  Height:  |  Size: 29 KiB

View File

@ -0,0 +1,25 @@
## Reverse Polarity
The main idea finding the flag is Binary to ASCII conversion.
#### Step-1:
After seeing the text, we get the following:
`I got a new hard drive just to hold my flag, but I'm afraid that it rotted. What do I do? The only thing I could get off of it was this: `
```
01000011010101000100011001111011010000100110100101110100010111110100011001101100011010010111000001110000011010010110111001111101
```
I tried to convert the given Binary text to ASCII.
#### Step-2:
I followed the URL: https://www.convertbinary.com/to-text/
I got the following result:
<img src="Covert.png">
Voila, we have it.
#### Step-3:
Finally the flag becomes:
`CTF{Bit_Flippin}`

Binary file not shown.

After

Width:  |  Height:  |  Size: 506 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 441 KiB

View File

@ -0,0 +1,27 @@
## Substitution Cipher
The main idea finding the flag is using Substitution Cipher.
#### Step-1:
After downloading `Substitution.txt` from the cloud, we get the following data from it:
```
MIT YSAU OL OYGFSBDGRTKFEKBHMGCALSOQTMIOL. UTFTKAMTR ZB DAKQGX EIAOF GY MIT COQOHTROA HAUT GF EASXOF AFR IGZZTL. ZT CTKT SGFU, MIT YSACL GF A 2005 HKTLTFM MODTL MIAF LMADOFA GK A CTTQSB LWFRAB, RTETDZTK 21, 1989 1990, MIT RKTC TROMGKL CAL WHKGGMTR TXTKB CGKSR EAF ZT YGWFR MIT EGFMOFWTR MG CGKQ AM A YAOMIYWS KTHSOTL CITKT IGZZTL, LMBST AOD EASXOF, AMMAEQ ZGMI LORTL MG DAKQL, "CIAM RG EGFMKGSSOFU AF AEMWAS ZGAKR ZGVTL OF MIT HKTHAKTFML FADT, OL ODHWSLOXT KADHAUTL OF CIOEI ASCABL KTYTKTFETL MIT HALLCGKR, CIOEI DGFTB, AFR MITB IAR SOMMST YKGFM BAKR IOL YKWLMKAMTR EGSGK WFOJWT AZOSOMB COMI AFR OFROLHTFLAMT YGK MTAEI GMITK LMWROTL, AKT ACAKRL ZARUTL, HWZSOLITR ZTYGKT CTSS AL A YOKT UKGLL HSAFL CTKT GKOUOFASSB EIAKAEMTKL OF MIT LMKOH MG CIOEI LTTD MG OM CITF MTDHTKTR OF AFR IASSGCOFU MITB'KT LODHSB RKACOFU OF UOXTL GF" HKOFEOHAS LHOMMST ROLMGKM, KTARTKL EGDOEL AKT WLT, CAMMTKLGF MGGQ MCG 16-DGFMIL AYMTK KTLOLMAQTL A DGKT EKTAM RTAS MG EASXOF GYMTF IGZZTL MG ARDOML "LSODB, "ZWM OM'L FADTR A FOUIM GWM LIT OL HGOFM GY FGM LTTF IGZZTL MIT ZGGQL AM MIAM O KTDAOFOFU ZGGQ IADLMTK IWTB AKT AHHTAKAFET: RTETDZTK 6, 1995 DGD'L YKADTL GY EASXOF UOXTF A CAUGF, LGDTMODTL MIAM LG OM'L YAMITKT'L YADOSB FG EAFETSSAMOGFLIOH CAL HKTLTFML YKGD FGXTDZTK 21, 1985 SALM AHHTAK AZLTFET OF AFGMITKCOLT OM IAHHB MG KWF OM YGK MIOL RAR AL "A SOMMST MG MGSTKAMT EASXOF'L YADOSB RKACF ASDGLM EGDDTFRTR WH ZTOFU HTGHST OFLMAFET, UTM DAKKOTR ZB A RAFET EASXOF'L GWMSAFROLOFU MIT FTCLHAHTK GK MAZSGOR FTCLHAHTK ZWLOFTLL LIGC OL GF!" AFR LHKOFML GY EIOSRKTF'L RAR'L YKWLMKAMTR ZB MWKF IWDGK, CAL HWZSOE ROASGU MITKT'L FGM DWEI AL "'94 DGRTKFOLD" CAMMTKLGF IAL RTSOUIML GY YAFMALB SOYT CAMMTKLGF LABL LTKXTL AL AF AKMOLML OL RTLMKWEMOGF ZWLOFTLL, LHAETYAKTK GY MIT GHHGKMWFOMOTL BGW ZGMI A MGHOE YGK IOL IGDT MGFUWT-OF-EITTQ HGHWSAK MIAM OM CAL "IGF" AFR JWAKMTK HAUT DGKT LHAEOGWL EAFETSSAMOGF MIT HAOK AKT ESTAKSB OF HLBEIOE MKAFLDGUKOYOTK'L "NAH" LGWFR TYYTEM BGW MIOFQTK CAMMTKLGF ASLG UKTC OFEKTROZST LHAET ZWBL OF EGDDGFSB CIOST GMITKCOLT OM'L FADT OL FGMAZST LMGKBSOFT UAXT MIT GHHGKMWFOMOTL BGW EAFETSSAMOGF MIT "EASXOF GYYTK MG DAQT IOD OFEGKKTEM AFLCTKL CAMMTK AKMCGKQ GMITK GYMTF CIOEI OL TXORTFM MG GMITK LMKOH OL MG MITOK WLT GY KWSTL MIAM LIGCF GF LAFROYTK, CIG WLTL A EKGCJWOSS ZT LTTF "USWTR" MG MIT GFSB HTKL AFR IOL YAMITK LWHHGKM OL SWFEISOFT UAXT MITLT MIOF A BTAK OF DWSMODAMTKOAS AFR GZMAOF GF LAFMALB, IOL WLT, CAMMTKL ROASGUWT OL AF "AKMOLM'L LMAMWL AL "A ROD XOTC OF MIT TLLTFMOASSB MG DAQT IOD LTTD MG OFESWRTR MIAM EASXOF OL AF GRR ROASGUWT DGLM GY MIT ESWZ IAL TVHKTLLOGF GWMLORT AXAOSAZST MG
```
#### Step-2:
So, I tried to decode here: https://www.dcode.fr/monoalphabetic-substitution
My inputs are as follows:
<img src="Input.png">
#### Step-3:
I got the output as follows:
<img src="Flag.png">
There we have it. Our flag.
#### Step-4:
Finally the flag becomes:
`IFONLYMODERNCRYPTOWASLIKETHIS`

View File

@ -0,0 +1 @@
MIT YSAU OL OYGFSBDGRTKFEKBHMGCALSOQTMIOL. UTFTKAMTR ZB DAKQGX EIAOF GY MIT COQOHTROA HAUT GF EASXOF AFR IGZZTL. ZT CTKT SGFU, MIT YSACL GF A 2005 HKTLTFM MODTL MIAF LMADOFA GK A CTTQSB LWFRAB, RTETDZTK 21, 1989 1990, MIT RKTC TROMGKL CAL WHKGGMTR TXTKB CGKSR EAF ZT YGWFR MIT EGFMOFWTR MG CGKQ AM A YAOMIYWS KTHSOTL CITKT IGZZTL, LMBST AOD EASXOF, AMMAEQ ZGMI LORTL MG DAKQL, "CIAM RG EGFMKGSSOFU AF AEMWAS ZGAKR ZGVTL OF MIT HKTHAKTFML FADT, OL ODHWSLOXT KADHAUTL OF CIOEI ASCABL KTYTKTFETL MIT HALLCGKR, CIOEI DGFTB, AFR MITB IAR SOMMST YKGFM BAKR IOL YKWLMKAMTR EGSGK WFOJWT AZOSOMB COMI AFR OFROLHTFLAMT YGK MTAEI GMITK LMWROTL, AKT ACAKRL ZARUTL, HWZSOLITR ZTYGKT CTSS AL A YOKT UKGLL HSAFL CTKT GKOUOFASSB EIAKAEMTKL OF MIT LMKOH MG CIOEI LTTD MG OM CITF MTDHTKTR OF AFR IASSGCOFU MITB'KT LODHSB RKACOFU OF UOXTL GF" HKOFEOHAS LHOMMST ROLMGKM, KTARTKL EGDOEL AKT WLT, CAMMTKLGF MGGQ MCG 16-DGFMIL AYMTK KTLOLMAQTL A DGKT EKTAM RTAS MG EASXOF GYMTF IGZZTL MG ARDOML "LSODB, "ZWM OM'L FADTR A FOUIM GWM LIT OL HGOFM GY FGM LTTF IGZZTL MIT ZGGQL AM MIAM O KTDAOFOFU ZGGQ IADLMTK IWTB AKT AHHTAKAFET: RTETDZTK 6, 1995 DGD'L YKADTL GY EASXOF UOXTF A CAUGF, LGDTMODTL MIAM LG OM'L YAMITKT'L YADOSB FG EAFETSSAMOGFLIOH CAL HKTLTFML YKGD FGXTDZTK 21, 1985 SALM AHHTAK AZLTFET OF AFGMITKCOLT OM IAHHB MG KWF OM YGK MIOL RAR AL "A SOMMST MG MGSTKAMT EASXOF'L YADOSB RKACF ASDGLM EGDDTFRTR WH ZTOFU HTGHST OFLMAFET, UTM DAKKOTR ZB A RAFET EASXOF'L GWMSAFROLOFU MIT FTCLHAHTK GK MAZSGOR FTCLHAHTK ZWLOFTLL LIGC OL GF!" AFR LHKOFML GY EIOSRKTF'L RAR'L YKWLMKAMTR ZB MWKF IWDGK, CAL HWZSOE ROASGU MITKT'L FGM DWEI AL "'94 DGRTKFOLD" CAMMTKLGF IAL RTSOUIML GY YAFMALB SOYT CAMMTKLGF LABL LTKXTL AL AF AKMOLML OL RTLMKWEMOGF ZWLOFTLL, LHAETYAKTK GY MIT GHHGKMWFOMOTL BGW ZGMI A MGHOE YGK IOL IGDT MGFUWT-OF-EITTQ HGHWSAK MIAM OM CAL "IGF" AFR JWAKMTK HAUT DGKT LHAEOGWL EAFETSSAMOGF MIT HAOK AKT ESTAKSB OF HLBEIOE MKAFLDGUKOYOTK'L "NAH" LGWFR TYYTEM BGW MIOFQTK CAMMTKLGF ASLG UKTC OFEKTROZST LHAET ZWBL OF EGDDGFSB CIOST GMITKCOLT OM'L FADT OL FGMAZST LMGKBSOFT UAXT MIT GHHGKMWFOMOTL BGW EAFETSSAMOGF MIT "EASXOF GYYTK MG DAQT IOD OFEGKKTEM AFLCTKL CAMMTK AKMCGKQ GMITK GYMTF CIOEI OL TXORTFM MG GMITK LMKOH OL MG MITOK WLT GY KWSTL MIAM LIGCF GF LAFROYTK, CIG WLTL A EKGCJWOSS ZT LTTF "USWTR" MG MIT GFSB HTKL AFR IOL YAMITK LWHHGKM OL SWFEISOFT UAXT MITLT MIOF A BTAK OF DWSMODAMTKOAS AFR GZMAOF GF LAFMALB, IOL WLT, CAMMTKL ROASGUWT OL AF "AKMOLM'L LMAMWL AL "A ROD XOTC OF MIT TLLTFMOASSB MG DAQT IOD LTTD MG OFESWRTR MIAM EASXOF OL AF GRR ROASGUWT DGLM GY MIT ESWZ IAL TVHKTLLOGF GWMLORT AXAOSAZST MG

Binary file not shown.

After

Width:  |  Height:  |  Size: 52 KiB

View File

@ -0,0 +1,33 @@
## Vigenere Cipher
The main idea finding the flag is just having knowledge about Vigenere Cipher.
#### Step-1:
Its very easy if you have basic idea of Vigenere Cipher. If you don't know, please refer :
https://en.wikipedia.org/wiki/Vigen%C3%A8re_cipher
So this is what is given in the message of challenge:
```
The vignere cipher is a method of encrypting alphabetic text by using a series of interwoven Caesar ciphers based on the letters of a keyword.<br />
Im not sure what this means, but it was left lying around: blorpy
gwox{RgqssihYspOntqpxs}
```
#### Step-2:
One thing is important to know that Vigenere Cipher requires a <strong>key</strong> to decode any message.
I used this URL to decode my message and used given key as : `blorpy`
https://cryptii.com/
#### Step-3:
This was my output:
<img src="Flag.png">
That's it. That's our flag.
#### Step-4:
Finally the flag becomes:
`flag{CiphersAreAwesome}`

BIN
Forensics/07601/AGT.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 426 KiB

364
Forensics/07601/README.md Normal file
View File

@ -0,0 +1,364 @@
## 07601
The main idea finding the flag using basic forensics techniques.
#### Step-1:
After we download the given image `AGT.png` from the cloud, we just try simple techniques.
<img src="AGT.jpg">
#### Step-2:
I first tried a very basic `strings AGT.png` & `strings AGT.png | grep {`.
I got the following output, through which I came to know about existing hidden directories.
```
v{n,
n.l{
qYv{
,nO{
2[{oO
{^UH
i{WY*
ABCTF{fooled_ya_dustin}
{u4j,\
B-{4B
}UXG{
{`(k
cB{V,
7{Ul
{$48
~9{;b
ECG{~'8
{Rf:
M}fS{
{{*7'
cGc{qlt'5
DD2{
{f8-Z
{R[7
UJL{
ez {Rz
,K{^b
WL{?
1?{M
YJ{.
E{'+
ZQ9{
1{@S
\s{)
mDEH{
qz{*
{d"&
{QuH%
,97{{
.~>{
F{E`{;
46B{
Le*{
HrZl{T
^{K>
_4={
EHLl{V
{Wh>
{:4
B{Cl
g{:i
Z{e&
:{S/\
{:%|Ium#
_E{Wj
S{5U
S{Eh
r{}%
ht{{
;Xc{
ST{{
{>eG
2eN{
A{b5
wu{@
y.V{j0^
8~x{
{;F#
.{|6m
{%0[
{~u(
TB{b
i{Hhm
=Z{"4
v.aa{
j-@l{
DsB{
4{C$v`
"Y1!{I
B{^
X>{I
KNzO{
_I{[-
%{*e
B-{4B
}UXG{
{`(k
cB{V,
7{Ul
{$48
~9{;b
ECG{~'8
{Rf:
M}fS{
{{*7'
cGc{qlt'5
DD2{
{f8-Z
{R[7
UJL{
ez {Rz
,K{^b
WL{?
1?{M
YJ{.
E{'+
ZQ9{
1{@S
\s{)
mDEH{
qz{*
{d"&
{QuH%
,97{{
.~>{
F{E`{;
46B{
Le*{
HrZl{T
^{K>
_4={
EHLl{V
{Wh>
{:4
B{Cl
g{:i
Z{e&
:{S/\
{:%|Ium#
_E{Wj
S{5U
S{Eh
r{}%
ht{{
;Xc{
ST{{
{>eG
2eN{
A{b5
wu{@
y.V{j0^
8~x{
{;F#
.{|6m
{%0[
{~u(
TB{b
i{Hhm
=Z{"4
v.aa{
j-@l{
DsB{
4{C$v`
"Y1!{I
B{^
X>{I
KNzO{
_I{[-
%{*e
Dwnc{E
B-{4B
}UXG{
{`(k
cB{V,
7{Ul
{$48
~9{;b
ECG{~'8
{Rf:
M}fS{
{{*7'
cGc{qlt'5
DD2{
{f8-Z
{R[7
f{KR
,K{^b
WL{?
1?{M
YJ{.
E{'+
ZQ9{
1{@S
\s{)
mDEH{
qz{*
{d"&
{QuH%
,97{{
.~>{
F{E`{;
46B{
Le*{
HrZl{T
^{K>
_4={
EHLl{V
daIj{
fz{]
{gy5
i{1"Aj
rr@{
C_,{
WoIx{
<6\`{
%{-N(
|B{~
{t^l
dNDM'{
k/{|
{_ G
);bW{
?XG>z{
=k{-
{Y6g
K5g{2
mz{S
2eF{
{y4^(
GB{%
E{/Y
{p`w?
mE-{
~*{+
.{|6m
{%0[
{~u(
TB{b
i{Hhm
=Z{"4
v.aa{
j-@l{
DsB{
4{C$v`
"Y1!{I
B{^
X>{I
KNzO{
_I{[-
%{*e
```
#### Step-3:
I tried this `ABCTF{fooled_ya_dustin}` flag, but it showed incorrect. So let's explore the hidden folders.
#### Step-4:
I tried `binwalk -e AGT.png`. I get a new directory called `_AGT.png.extracted`. Let's get into this.
#### Step-5:
The contents of which are some of the images and directory. I directly, tried
`strings I Warned You.jpeg | grep {`
#### Step-6:
I got this output:
```
{P|I
{zRhc
{>ch
^|){O
rU<o{
R3w{x
o {p
=d{]i
w{3)Z:
uYz}{
{uBH
*}{MD
}"W{
:Ja{
.?{M$f
!0{8
{/!s
tM,o{
{tLL
q{dG
b[{MTF
{Y1W
ABCTF{Du$t1nS_D0jo}1r
1{wl
{Y,x
6fr{+
q{:zG
Nv{%M#
{+ -"
Qa{+
tx"{
{!f'WkQV
XUg{
!{;xV
?Khh{
w#{]U#
JGdD{n
W]L{`g
{Z.W\
r"w{
.$A{
)cn_P{V
b{5
:\7{{
gk{|(qwC
Vv{;t[Tjy#r
NR{{]
Pv{]JS
{'R-
${zT
Ac{*:]#
{Mj9
. 6{4
w{Y[8o
{zY\4
q{:g#g
roO{
F{Dfx$
mJ{#
OgRZho{
Ug3{x
'{u^n
b%{l^
r&*$b{
M|vMH{.
[R'{_
{P7v+
b{+W
/{+w
F{~aLVF
{:el
sIS{
8r:s{
I{M5
e%K#{
u5{1j
Bww{
{XW+
$v{/O
+6,{~aV
iNc{
{R8c
y)8{{0q
1{]'%<B
R{.x
{533
1{ue
:?{#&2B
{%c]2U
;#Y{
```
Luckily, here the flag worked.
#### Step-7:
Finally the flag becomes:
`ABCTF{Du$t1nS_D0jo}1r`

Binary file not shown.

After

Width:  |  Height:  |  Size: 41 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 262 KiB

View File

@ -0,0 +1,36 @@
## A CAPture of a Flag
The main idea finding the flag is exploring the given PCAP file in Wireshark.
#### Step-1:
After downloading `flag (4)` (a PCAP file) from the cloud, I directly opened it in Wireshark application.
For those, who are unaware om how to filter streams or use this application, please do your homework here:
https://www.wireshark.org/
#### Step-2:
I tried to check TCP stream for some clues and then I tried UDP streams for some clues. Finally, I used the filter to get only HTTP requests.
<img src="HTTP.png">
#### Step-3:
I went through all requests and this request caught my eye.
`247 2.270670 10.50.203.75 185.21.216.190 HTTP 504 GET /?msg=ZmxhZ3tBRmxhZ0luUENBUH0= HTTP/1.1 `
It has a Base64 encrypted message.
#### Step-4:
So finally, I decoded it online at: https://www.base64decode.org/
I got the flag there:
<img src="Base64.png">
Voila, we have it here.
#### Step-4:
Finally the flag becomes:
`flag{AFlagInPCAP}`

Binary file not shown.

Binary file not shown.

After

Width:  |  Height:  |  Size: 161 KiB

View File

@ -0,0 +1,32 @@
## Binwalk
The main idea finding the flag using Binwalk commands and its extensions.
#### Step-1:
After downloading `PurpleThing.jpeg` from the cloud, I tried `strings PurpleThing.jpeg | grep {`.
I couldn't find anything special.
#### Step-2:
So I tried `binwalk PurpleThing.jpeg` as the question suggests.
It showed me following output:
```
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 PNG image, 780 x 720, 8-bit/color RGBA, non-interlaced
41 0x29 Zlib compressed data, best compression
153493 0x25795 PNG image, 802 x 118, 8-bit/color RGBA, non-interlaced
```
Clearly, there is hidden data in there, let's extract that.
#### Step-3:
I input a command of `binwalk -D 'image:png' PurpleThing.jpeg` and I get a directory named `_PurpleThing.jpeg.extracted`.
The contents are different files. In it `25795.png` has the flag.
#### Step-4:
Finally the flag becomes:
`ABCTF{b1nw4lk_is_us3ful}`

Binary file not shown.

After

Width:  |  Height:  |  Size: 39 KiB

View File

@ -0,0 +1,36 @@
## Digital Camouflage
The main idea finding the flag is Network Interception and some Crytographic Techniques.
#### Step-1:
After downloading `data.pcap` from the cloud, I directly opened it in Wireshark.
For those, who are unaware of how to use this tool for Network Interception, can refer here:
https://www.wireshark.org/
I tried to check the Hex Dump, but couldn't find something special.
#### Step-2:
So, I tried to check the TCP stream in different frames. For those, who are unaware on how to do this:
- Open `data.pcap` in Wireshark.
- In the filters, put on TCP and then Enter to get all the TCP traffic of the network.
<img src="TCP_Stream.png">
- I wanted to check each and every frame as question is somewhat hinting in that direction, so to check that, Analyse -> Follow -> TCP Stream
<img src="TCP_Stream_Eq_0.png">
- We can alter streams by changing the counter in bottom right corner.
- As I reached 3rd stream, I observed some credentials there.
<img src="TCP_Stream_Eq_3.png">
`userid=hardawayn&pswrd=UEFwZHNqUlRhZQ%3D%3D`
#### Step-3:
So, it is clear that password is Base64 encrypted and in web URLs, %3D is to be replaced by =.
So I tried to decode the Base64 encryption online at: https://www.base64decode.org/
<img src="Base64.png">
It had the flag in it. Voila.
#### Step-4:
Finally the flag becomes:
`PApdsjRTae`

Binary file not shown.

After

Width:  |  Height:  |  Size: 206 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 163 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 92 KiB

Binary file not shown.

View File

@ -0,0 +1,44 @@
import java.security.MessageDigest;
import java.util.Arrays;
import java.util.Base64;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
public class Decryptor
{
public static final String FLAG = "S+kUZtaHEYpFpv2ixuTnqBdORNzsdVJrAxWznyOljEo=";
private static class Password
{
private byte[] passHash;
public Password(char[] pass) throws Exception
{
MessageDigest digest = MessageDigest.getInstance("SHA-256");
this.passHash = Arrays.copyOf(digest.digest(new String(pass).getBytes("UTF-8")), 16);
}
public byte[] encrypt(byte[] msg) throws Exception
{
SecretKeySpec spec = new SecretKeySpec(passHash, "AES");
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(Cipher.ENCRYPT_MODE, spec);
return cipher.doFinal(msg);
}
public byte[] decrypt(byte[] msg) throws Exception
{
SecretKeySpec spec = new SecretKeySpec(passHash, "AES");
Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
cipher.init(Cipher.DECRYPT_MODE, spec);
return cipher.doFinal(msg);
}
}
public static void main(String[] args) throws Exception
{
Password pass = new Password(System.console().readPassword("Enter password to decrypt flag: "));
System.out.println(new String(pass.decrypt(Base64.getDecoder().decode(FLAG.getBytes()))));
Thread.sleep(5000); //We did a heap dump right here.
}
}

View File

@ -0,0 +1,12 @@
## Dumpster
The main idea finding the flag is Java coding.
#### Step-1:
I tried hard to understand the question and solve it, but I couldn't do it, so I had to look up for writeup.
https://github.com/EladBeber/CTFlearn-Writeups/tree/master/Forensics/Medium/DUMPSTER
#### Step-2:
Finally the flag becomes:
`stCTF{h34p_6ump5_r_c00l!11!!}`

Binary file not shown.

Binary file not shown.

Binary file not shown.

After

Width:  |  Height:  |  Size: 54 KiB

62
Forensics/Exif/README.md Normal file
View File

@ -0,0 +1,62 @@
## Exif
The main idea finding the flag is to have Exiftool.
#### Step-1:
After I downloaded `Computer-Password-Security-Hacker - Copy.jpg`, I immediately tried to open it using Exiftool.
<img src="Computer-Password-Security-Hacker - Copy.jpg">
#### Step-2:
If you have some experience in CTF before, [Exiftool](https://exiftool.org/) is quite widely used. So I input `exiftool Computer-Password-Security-Hacker\ -\ Copy.jpg`
Output:
```bash
ExifTool Version Number : 11.88
File Name : Computer-Password-Security-Hacker - Copy.jpg
Directory : .
File Size : 54 kB
File Modification Date/Time : 2020:07:31 14:04:06+05:30
File Access Date/Time : 2020:07:31 14:04:06+05:30
File Inode Change Date/Time : 2020:07:31 14:04:06+05:30
File Permissions : rw-r--r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.02
X Resolution : 100
Y Resolution : 100
Exif Byte Order : Big-endian (Motorola, MM)
Resolution Unit : None
Y Cb Cr Positioning : Centered
Exif Version : 0231
Components Configuration : Y, Cb, Cr, -
Flashpix Version : 0100
Owner Name : flag{3l1t3_3x1f_4uth0r1ty_dud3br0}
GPS Latitude Ref : South
GPS Longitude Ref : East
Quality : 60%
DCT Encode Version : 100
APP14 Flags 0 : [14], Encoded with Blend=1 downsampling
APP14 Flags 1 : (none)
Color Transform : YCbCr
Image Width : 660
Image Height : 371
Encoding Process : Baseline DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:4:4 (1 1)
Image Size : 660x371
Megapixels : 0.245
GPS Latitude : 77 deg 17' 2.62" S
GPS Longitude : 44 deg 4' 7.30" E
GPS Position : 77 deg 17' 2.62" S, 44 deg 4' 7.30" E
```
#### Step-3:
Voila! I got the flag there. I don't have any idea why this challenge was in hard.
#### Step-5:
Finally the flag becomes:
`flag{3l1t3_3x1f_4uth0r1ty_dud3br0}`

Binary file not shown.

After

Width:  |  Height:  |  Size: 9.5 KiB

View File

@ -0,0 +1,143 @@
## Forensics 101
The main idea finding the flag using basic forensics training.
#### Step-1:
After we download the given image `95f6edfb66ef42d774a5a34581f19052.jpg` from the cloud, we just try simple techniques.
<img src="95f6edfb66ef42d774a5a34581f19052.jpg">
#### Step-2:
I first tried a very basic `strings 95f6edfb66ef42d774a5a34581f19052.jpg`
#### Step-3:
It just gave me this output:
```
JFIF
, #&')*)
-0-(0%()(
((((((((((((((((((((((((((((((((((((((((((((((((((
L?~f
:UwR
y>2|
*'?-
yhH_&
Lmz'
+f[
!"1$246B`35A
au>
~b*D
F_X:D
[ElC
him8
lr|.
L{2^
]]te
tBfE
j_s7Os/[i
W="'
"fkO
G&,ke:
eM_F
8O:J
9)/m>&
[P{!
}EI5#
a~Wt,1
]<e<
g:rc
"1Pa
ujM^P
P#3a
vFGO
ZniFi
%a ?}
2AQaq 0B#@r
\xr>
\37g
4=i#N
F:Jx
.`Ot
v[xU
|='u
{~T{@
LX.9
?mBx
L1QG
lIYB+
|] %
QTj?:
$*,-
pk4D
4R gX
$mmk
_QSK
b)^L
a[T=
mpj<N;
!1AQaq
x'<L
we|C{
iiR8
"'A*
aZ(4
cj}+
NL7'4
u-kF3n
x cd
s}F3_Y
$+Ym
zrsq
f}]@
L&/F
&F'$,
| *
ktWxn
yLX*s]
pT)J
eR-3
SG=3\Y
JK%0
h"(p
!01Q
%^cJ
H|cO
!10AQ
'([P
!1AQaq
s`%"
X`3d'
'P]!
;#_l
ABx=~
"r&"
0YAP
ch-h
XoXrl
l0Je
V^_W
xp7p
v{*{8
=k"$TW3G
1)j!
7y}U
<~0GD
n%CeoQ=m8
`"n<P
i}\D
X`(
8kF=
~9%]Tn
flag{wow!_data_is_cool}
$lqU
AG{u