\n\nThis page has been machine-translated from the original page.
\n
I participated in the 1337UP CTF, which started on November 17, 2023, as part of 0nePadding, and we placed 32nd overall.
\nCan you beat this FlagChecker? The Rust source code given as the challenge binary was as follows. It seemed to be validating whether the input string matched the flag, and from the implementation it was pretty clear that it was intended to be solved with Z3. So I used the following solver to obtain the flag. Anonymous has hidden a message inside this exe, can you extract it? Analyzing the file given as the challenge binary with ILSpy produced the following code. This program seems to be compressed but still can be executed, I wonder what could cause that.. The challenge binary was packed with UPX, so I unpacked it first. So I examined the sections of the unpacked program and found that a section named We have extracted this payload that some malware tried to dump.. Seems dumping it directly from memory debased it so it can’t run. Can you fix it? The file given as the challenge binary was a PE file that could not be executed for some reason. Since Windows no longer seemed able to load it as a PE file, I proceeded with the analysis while comparing it with the image below and the results from CFF Explorer. Reference: PE Format - Win32 apps | Microsoft Learn In the end, I found that incorrect alignment of the I wonder what the old man is talking about The challenge provides a Game Boy ROM image as the binary. So I checked the VRAM information and found that the flag string was embedded in tiles outside the visible screen. After cutting and pasting those together, I obtained the following string. At first I could only read this as Can you slay goliath? Looking at the EXE given as the challenge binary, I found that it was a .Net program. When I ran it, a GUI asking for some mysterious input appeared. When I decompiled it with ILSpy, I found that several fairly complicated-looking functions had been defined. The So I used ExtremeDumper to extract the decrypted binary from the running process. Analyzing the extracted binary with ILSpy then made it possible to inspect the code for the GUI shown when the program starts. Reading the code in this The The code for the I was able to obtain the flag with the following solver. Your trapped inside a box. Can you escape it and do the reverse to get the flag? The file given as the challenge binary was a Unity-made game program. By patching this module, it seemed likely that I could obtain the flag by cheating in one of several ways: moving the object’s starting position outside the wall, deleting the wall objects, removing wall collision so I could pass through them, or making the character jump over the walls. To tamper with the code, I reopened the program in dnSpy instead of ILSpy. (ILSpy might also be able to patch it, but I could not find the menu, so I used dnSpy.) Looking at the character object’s So I added the following line to force an extremely high jump and then compiled the code. This made an ordinary jump turn into a super-high jump, letting me clear the wall. After getting over the wall, I was able to obtain the flag on the map. I’m not sure how secure this protocol is but as long as we update the password, I’m sure everything will be fine When I opened the provided pcap in Wireshark, I found that files were being transferred over FTP. So I first saved the file as binary data. The file transferred over FTP ( The password used during the FTP transfer was Reading the packets further, I found that a file containing the following message had also been received over FTP. So I followed the packets further and found that another email was also sending an image.FlagChecker(Rev)
\n\n
\nuse std::io;\n\nfn check_flag(flag: &str) -> bool {\n flag.as_bytes()[18] as i32 * flag.as_bytes()[7] as i32 & flag.as_bytes()[12] as i32 ^ flag.as_bytes()[2] as i32 == 36 &&\n flag.as_bytes()[1] as i32 % flag.as_bytes()[14] as i32 - flag.as_bytes()[21] as i32 % flag.as_bytes()[15] as i32 == -3 &&\n flag.as_bytes()[10] as i32 + flag.as_bytes()[4] as i32 * flag.as_bytes()[11] as i32 - flag.as_bytes()[20] as i32 == 5141 &&\n flag.as_bytes()[19] as i32 + flag.as_bytes()[12] as i32 * flag.as_bytes()[0] as i32 ^ flag.as_bytes()[16] as i32 == 8332 &&\n flag.as_bytes()[9] as i32 ^ flag.as_bytes()[13] as i32 * flag.as_bytes()[8] as i32 & flag.as_bytes()[16] as i32 == 113 &&\n flag.as_bytes()[3] as i32 * flag.as_bytes()[17] as i32 + flag.as_bytes()[5] as i32 + flag.as_bytes()[6] as i32 == 7090 &&\n flag.as_bytes()[21] as i32 * flag.as_bytes()[2] as i32 ^ flag.as_bytes()[3] as i32 ^ flag.as_bytes()[19] as i32 == 10521 &&\n flag.as_bytes()[11] as i32 ^ flag.as_bytes()[20] as i32 * flag.as_bytes()[1] as i32 + flag.as_bytes()[6] as i32 == 6787 &&\n flag.as_bytes()[7] as i32 + flag.as_bytes()[5] as i32 - flag.as_bytes()[18] as i32 & flag.as_bytes()[9] as i32 == 96 &&\n flag.as_bytes()[12] as i32 * flag.as_bytes()[8] as i32 - flag.as_bytes()[10] as i32 + flag.as_bytes()[4] as i32 == 8277 &&\n flag.as_bytes()[16] as i32 ^ flag.as_bytes()[17] as i32 * flag.as_bytes()[13] as i32 + flag.as_bytes()[14] as i32 == 4986 &&\n flag.as_bytes()[0] as i32 * flag.as_bytes()[15] as i32 + flag.as_bytes()[3] as i32 == 7008 &&\n flag.as_bytes()[13] as i32 + flag.as_bytes()[18] as i32 * flag.as_bytes()[2] as i32 & flag.as_bytes()[5] as i32 ^ flag.as_bytes()[10] as i32 == 118 &&\n flag.as_bytes()[0] as i32 % flag.as_bytes()[12] as i32 - flag.as_bytes()[19] as i32 % flag.as_bytes()[7] as i32 == 73 &&\n flag.as_bytes()[14] as i32 + flag.as_bytes()[21] as i32 * flag.as_bytes()[16] as i32 - flag.as_bytes()[8] as i32 == 11228 &&\n flag.as_bytes()[3] as i32 + flag.as_bytes()[17] as i32 * flag.as_bytes()[9] as i32 ^ flag.as_bytes()[11] as i32 == 11686 &&\n flag.as_bytes()[15] as i32 ^ flag.as_bytes()[4] as i32 * flag.as_bytes()[20] as i32 & flag.as_bytes()[1] as i32 == 95 &&\n flag.as_bytes()[6] as i32 * flag.as_bytes()[12] as i32 + flag.as_bytes()[19] as i32 + flag.as_bytes()[2] as i32 == 8490 &&\n flag.as_bytes()[7] as i32 * flag.as_bytes()[5] as i32 ^ flag.as_bytes()[10] as i32 ^ flag.as_bytes()[0] as i32 == 6869 &&\n flag.as_bytes()[21] as i32 ^ flag.as_bytes()[13] as i32 * flag.as_bytes()[15] as i32 + flag.as_bytes()[11] as i32 == 4936 &&\n flag.as_bytes()[16] as i32 + flag.as_bytes()[20] as i32 - flag.as_bytes()[3] as i32 & flag.as_bytes()[9] as i32 == 104 &&\n flag.as_bytes()[18] as i32 * flag.as_bytes()[1] as i32 - flag.as_bytes()[4] as i32 + flag.as_bytes()[14] as i32 == 5440 &&\n flag.as_bytes()[8] as i32 ^ flag.as_bytes()[6] as i32 * flag.as_bytes()[17] as i32 + flag.as_bytes()[12] as i32 == 7104 &&\n flag.as_bytes()[11] as i32 * flag.as_bytes()[2] as i32 + flag.as_bytes()[15] as i32 == 6143\n}\n\nfn main() {\n let mut flag = String::new();\n println!(\"Enter the flag: \");\n io::stdin().read_line(&mut flag).expect(\"Failed to read line\");\n let flag = flag.trim();\n\n if check_flag(flag) {\n println!(\"Correct flag\");\n } else {\n println!(\"Wrong flag\");\n }\n}from z3 import *\nflag = [BitVec(f\"flag[{i}]\", 8) for i in range(22)]\ns = Solver()\n\nfor i in range(22):\n s.add(And(\n (flag[i] >= 0x21),\n (flag[i] <= 0x7e)\n ))\n\n# INTIGRITI{\ns.add(flag[0] == ord(\"I\"))\ns.add(flag[1] == ord(\"N\"))\ns.add(flag[2] == ord(\"T\"))\ns.add(flag[3] == ord(\"I\"))\ns.add(flag[4] == ord(\"G\"))\ns.add(flag[5] == ord(\"R\"))\ns.add(flag[6] == ord(\"I\"))\ns.add(flag[7] == ord(\"T\"))\ns.add(flag[8] == ord(\"I\"))\ns.add(flag[9] == ord(\"{\"))\ns.add(flag[21] == ord(\"}\"))\n\ns.add(flag[18] * flag[7] & flag[12] ^ flag[2] == 36)\ns.add(flag[1] % flag[14] - flag[21] % flag[15] == -3)\ns.add(flag[10] + flag[4] * flag[11] - flag[20] == 5141)\ns.add(flag[19] + flag[12] * flag[0] ^ flag[16] == 8332)\ns.add(flag[9] ^ flag[13] * flag[8] & flag[16] == 113)\ns.add(flag[3] * flag[17] + flag[5] + flag[6] == 7090)\ns.add(flag[21] * flag[2] ^ flag[3] ^ flag[19] == 10521)\ns.add(flag[11] ^ flag[20] * flag[1] + flag[6] == 6787)\ns.add(flag[7] + flag[5] - flag[18] & flag[9] == 96)\ns.add(flag[12] * flag[8] - flag[10] + flag[4] == 8277)\ns.add(flag[16] ^ flag[17] * flag[13] + flag[14] == 4986)\ns.add(flag[0] * flag[15] + flag[3] == 7008)\ns.add(flag[13] + flag[18] * flag[2] & flag[5] ^ flag[10] == 118)\ns.add(flag[0] % flag[12] - flag[19] % flag[7] == 73)\ns.add(flag[14] + flag[21] * flag[16] - flag[8] == 11228)\ns.add(flag[3] + flag[17] * flag[9] ^ flag[11] == 11686)\ns.add(flag[15] ^ flag[4] * flag[20] & flag[1] == 95)\ns.add(flag[6] * flag[12] + flag[19] + flag[2] == 8490)\ns.add(flag[7] * flag[5] ^ flag[10] ^ flag[0] == 6869)\ns.add(flag[21] ^ flag[13] * flag[15] + flag[11] == 4936)\ns.add(flag[16] + flag[20] - flag[3] & flag[9] == 104)\ns.add(flag[18] * flag[1] - flag[4] + flag[14] == 5440)\ns.add(flag[8] ^ flag[6] * flag[17] + flag[12] == 7104)\ns.add(flag[11] * flag[2] + flag[15] == 6143)\n\nwhile s.check() == sat:\n m = s.model()\n for c in flag:\n print(chr(m[c].as_long()),end=\"\")\n print(\"\")\n break\n\n# INTIGRITI{tHr33_Z_FTW}Anonymous(Rev)
\n\n
\nimPACKful(Rev)
\n\n
\n{N3v3R} had been registered there, and that turned out to be the flag.Can We Fix It(Rev)
\n\n
\n.text section was the reason the PE binary could not be executed.Virtual RAM(Rev)
\n\n
\nINTIGRITI{H3r0_0F_tIM3}, so I had a hard time getting it accepted. Then a teammate made the sharp observation that all of the vowels might be written as digits, which led us to identify the correct flag as INTIGRITI{H3r0_0F_t1M3}.Crack Me If You Can(Rev)
\n\n
\nMain function decrypts encrypted byte data and retrieves methods via executingAssembly, so analysis seemed difficult in that form.Main class, I found that it checks whether the output obtained by passing the input string and the predefined byte array enc to the unkownMethod function matches the string WhatAreYouDoingToChallenge.private void Button1_Click(object sender, EventArgs e)\n{\n string @string = Encoding.UTF8.GetString(Resources.enc);\n if (Operators.CompareString(unkownMethod(TextBox1.Text, @string), "WhatAreYouDoingToChallenge", TextCompare: false) == 0)\n {\n Interaction.MsgBox("You Solve It", MsgBoxStyle.Information, "Nice");\n }\n}\n\npublic string unkownMethod(string textToScramble, string password)\n{\n StringBuilder stringBuilder = new StringBuilder(textToScramble.Length);\n int num = checked(textToScramble.Length - 1);\n for (int i = 0; i <= num; i = checked(i + 1))\n {\n int index = i % password.Length;\n char c = textToScramble[i];\n c = Strings.ChrW(c ^ password[index]);\n stringBuilder.Append(c);\n }\n return stringBuilder.ToString();\n}unkownMethod function in turn calls another function named checked.checked function was not included in ILSpy’s decompilation result, but judging from the later processing, it just XORs the input characters with enc, so it seemed safe to ignore.ans = \"WhatAreYouDoingToChallenge\"\nwith open(\"enc\", \"rb\") as f:\n enc = f.read()\n\nfor i in range(len(ans)):\n print(chr(ord(ans[i])^enc[i%len(enc)]),end=\"\")\n \n# intigriti{You_Are_Amazing}Escape(Game Hacking)
\n\n
\nUpdateVelocity method here, I found that the jump height is controlled there.Over the Wire 1(Warmup)
\n\n
\nflag.zip) was a password-protected ZIP file, so next I looked for the password needed to extract it.5up3r_53cur3_p455w0rd_2022, so I tried extracting it with that password, but it failed.220 pyftpdlib 1.5.9 ready.\nUSER cat\n331 Username ok, send password.\nPASS 5up3r_53cur3_p455w0rd_2022\n230 Login successful.\nSYST\n215 UNIX Type: L8\nPORT 192,168,16,131,179,47\n200 Active data connection established.\nLIST\n125 Data connection already open. Transfer starting.\n226 Transfer complete.\nTYPE I\n200 Type set to: Binary.\nPORT 192,168,16,131,203,181\n200 Active data connection established.\nRETR flag.zip\n125 Data connection already open. Transfer starting.\n226 Transfer complete.\nPORT 192,168,16,131,132,11\n200 Active data connection established.\nRETR reminder.txt\n125 Data connection already open. Transfer starting.\n226 Transfer complete.\nPORT 192,168,16,131,162,139\n200 Active data connection established.\nRETR README.md\n125 Data connection already open. Transfer starting.\n226 Transfer complete.\nQUIT\n221 Goodbye.