{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-cryptoversectf-2023-en","result":{"data":{"markdownRemark":{"id":"5bc815af-6e39-5f98-a147-bdcb60556efd","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in Cryptoverse CTF 2023, which started on May 6, 2023, with 0nePadding.

\n

We finished 17th out of 364 teams.

\n

\n \n ,'little')\nDAT_10000801c = int.from_bytes(b'\\xc7\\x8f\\x37\\x32','little')\nDAT_100008020 = int.from_bytes(b'\\x67\\x87\\x5f\\xd5','little')\nDAT_100008024 = int.from_bytes(b'\\xad\\xa1\\x4a\\x10','little')\n\nfor i in range(5):\n\n uVar1 = DAT_100008018 ^ DAT_100008018 << 0xb\n DAT_100008018 = DAT_10000801c\n DAT_10000801c = DAT_100008020\n DAT_100008020 = DAT_100008024\n DAT_100008024 = DAT_100008024 ^ DAT_100008024 >> 0x13 ^ uVar1 ^ uVar1 >> 8\n\n print(DAT_100008024)\n\n result = DAT_100008024\n local10 = (result % 0x539) + local10\n

However, even though the logic seemed correct, I could not recover the flag.

\n

I realized later that when doing arithmetic in Python, integers do not overflow at the uint32 boundary, and that seems to have caused the difference in the final result.

\n

After fixing the arithmetic as shown below, I was able to recover the flag.

\n
uVar1 = DAT_100008018 ^ (DAT_100008018 << 0xb)\nuVar1 = uVar1 & 0xFFFFFFFF\nDAT_100008018 = DAT_10000801c\nDAT_10000801c = DAT_100008020\nDAT_100008020 = DAT_100008024\nDAT_100008024 = DAT_100008024 ^ (DAT_100008024 >> 0x13) ^ uVar1 ^ (uVar1 >> 8)\nDAT_100008024 = DAT_100008024 & 0xFFFFFFFF
\n

I did not think of that fix while solving the challenge, so in the end I recovered the flag through dynamic analysis.

\n

To run a macOS binary on WSL2, I used darling.

\n

I installed it with the following steps.

\n
# 依存モジュールのインストール(deb ファイルでインストールする場合は不要かも)\nsudo apt install cmake clang bison flex libfuse-dev libudev-dev pkg-config libc6-dev-i386 \\\ngcc-multilib libcairo2-dev libgl1-mesa-dev libglu1-mesa-dev libtiff5-dev \\\nlibfreetype6-dev git git-lfs libelf-dev libxml2-dev libegl1-mesa-dev libfontconfig1-dev \\\nlibbsd-dev libxrandr-dev libxcursor-dev libgif-dev libavutil-dev libpulse-dev \\\nlibavformat-dev libavcodec-dev libswresample-dev libdbus-1-dev libxkbfile-dev \\\nlibssl-dev python2\n\n# deb ファイルのダウンロード\nwget https://github.com/darlinghq/darling/releases/download/v0.1.20220704/darling_0.1.20220704.focal_amd64.deb\n\n# インストール\nsudo dpkg -i darling_0.1.20220704.focal_amd64.deb
\n

Next, you can run the macOS binary in darling with the following steps.

\n
# シェルの起動\ndarling shell\n\n# macOS バイナリの実行\n./challenge
\n

The process of the application started here can be seen from the host-side WSL2 environment.

\n

So by opening another shell and running the following commands, you can attach gdb to the macOS binary running under darling.

\n
ps aux | grep challenge\ngdb attach <PID>
\n

With that, I was able to recover the flag through dynamic analysis.

\n

Solid Reverse(Rev)

\n
\n

Crypto in reverse??

\n
\n

The following script is provided as the challenge.

\n

It appears to be code written in Solidity, a statically typed curly-brace language designed for developing smart contracts that run on Ethereum.

\n
// SPDX-License-Identifier: MIT\npragma solidity ^0.8.0;\n\ncontract ReverseMe {\n    uint goal = 0x57e4e375661c72654c31645f78455d19;\n\n    function magic1(uint x, uint n) public pure returns (uint) {\n        // Something magic\n        uint m = (1 << n) - 1;\n        return x & m;\n    }\n\n    function magic2(uint x) public pure returns (uint) {\n        // Something else magic\n        uint i = 0;\n        while ((x >>= 1) > 0) {\n            i += 1;\n        }\n        return i;\n    }\n\n    function checkflag(bytes16 flag, bytes16 y) public view returns (bool) {\n        return (uint128(flag) ^ uint128(y) == goal);\n    }\n\n    modifier checker(bytes16 key) {\n        require(bytes8(key) == 0x3492800100670155, \"Wrong key!\");\n        require(uint64(uint128(key)) == uint32(uint128(key)), \"Wrong key!\");\n        require(magic1(uint128(key), 16) == 0x1964, \"Wrong key!\");\n        require(magic2(uint64(uint128(key))) == 16, \"Wrong key!\");\n        _;\n    }\n\n    function unlock(bytes16 key, bytes16 flag) public view checker(key) {\n        // Main function\n        require(checkflag(flag, key), \"Flag is wrong!\");\n    }\n}
\n

Ethereum? To be honest, I did not understand it at all, and I could not set up an execution environment, so I decided to statically analyze the code with the help of the documentation.

\n

It seemed that the flag would be the result of XORing goal with a 16-byte value that can get past the checks in the checker function.

\n

As I read the Solidity documentation, I learned that functions like bytes8 have a characteristic behavior where the upper bits are taken and the lower bits are discarded.

\n

In other words, from the line require(bytes8(key) == 0x3492800100670155, \"Wrong key!\");, we know that the first 8 bytes of key must match 0x3492800100670155.

\n

Next, from require(uint64(uint128(key)) == uint32(uint128(key)), \"Wrong key!\");, we can see that the value of the last 8 bytes of key must match the value of the last 4 bytes.

\n

In other words, we can determine that bytes 5 through 8 of key are 0.

\n

Next, magic1(uint128(key), 16) == 0x1964 means that the lower 2 bytes must match 0x1964.

\n

That is because the following logic returns the result of an AND with 0xFFFF.

\n
uint m = (1 << 16) - 1;\nreturn x & m;
\n

Finally, I rewrote the magic2 function in Python as shown below and searched for a value whose upper 4 bytes are 0, whose lower 2 bytes are 0x1964, and that satisfies magic2(uint64(uint128(key))) == 16.

\n
def magic2(x: int) -> int:\n    i = 0\n    while True:\n        x = x >> 1\n        print(x)\n        if x > 0:\n            i += 1\n        else:\n            break\n    return i\n\nprint(magic2(0x0000000000011964))
\n

In the end, I found that 0x0000000000011964 was the corresponding value, which means key is 0x34928001006701550000000000011964.

\n

With that, XORing key and goal recovered the flag.

\n

Standard VM(Rev)

\n
\n

Yet Another Virtual Machine.

\n
\n

This was the only Hard problem we solved this time, but it was super easy. (Probably a challenge-authoring mistake?)

\n

The challenge binary seems to take user input and validate the flag.

\n

The decompiled output of the main part is as follows.

\n
undefined8 FUN_00101396(void)\n{\n  int iVar1;\n  undefined8 uVar2;\n  \n  printf(\"Flag: \");\n  __isoc99_scanf(&DAT_0010200b,&DAT_00104110);\n  uVar2 = FUN_00101209();\n  FUN_00101356(uVar2);\n  iVar1 = strcmp(\"N]N_MVdP}dSOT\",&DAT_00104110);\n  if (iVar1 == 0) {\n    puts(\"Correct!\");\n  }\n  else {\n    puts(\"Wrong!\");\n  }\n  return 0;\n}
\n

The part that validates the input looked like it was doing various complicated things, but as soon as I saw this decompilation I knew it looked solvable with angr, so I did not analyze it further.

\n

I was able to recover the flag with the following script.

\n
import angr\n\nproj = angr.Project(\"standard_vm\", auto_load_libs=False)\nprint(\"EntryPoint\", proj.entry)\n\n# initial_state at the entry point of the binary\ninit_state = proj.factory.entry_state(args = ['standard_vm'])\n\n# create simulation\nsimgr = proj.factory.simgr(init_state)\n\nsimgr.explore(find=(0x401403), avoid=(0x401411))\nprint(simgr.found[0].posix.dumps(0))\n\n# b'cvctf{MyVMxd}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'
\n

Touhou Danmaku Kagura(Rev)

\n
\n

You will control Hakurei Reimu, a popular character from the Touhou Project, and challenge a danmaku battle. This game has a new style where you attack in rhythm while dodging enemy bullets. Clear it and the flag will be displayed. To find the flag, you need to reverse engineer the game. Good luck!

\n
\n

The fact that the challenge description itself was in Japanese made this a very amusing problem.

\n

When you run the challenge binary, a bullet-hell shooter game screen appears.

\n

\n \n ] = 'hide'\nimport pygame, math, random, time\n\nclass sizes:\n\n def __init__(self, width, height):\n self.Width = width\n self.Height = height\n\n\ncurrentCount = 0\ncurrentAnim = 1\nanimLimit = False\nplayerX = 400\nplayerY = 450\nlastBullet = 0\nbulletLimit = 5000\ntotalBullets = 0\ntoX = 0\ntoY = 0\nbullets = []\nbulletsDirection = [\n 1]\nbulletsY = []\nbulletsX = []\n\ndef main():\n global bullets\n global bulletsX\n global bulletsY\n global currentAnim\n global currentCount\n global lastBullet\n global playerX\n global playerY\n global toX\n global toY\n global totalBullets\n pygame.init()\n pygame.mixer.init()\n pygame.mixer.music.load('Song.mp3')\n pygame.mixer.music.play()\n screenSizes = sizes(800, 600)\n screen = pygame.display.set_mode((screenSizes.Width, screenSizes.Height))\n startBullet = pygame.image.load('Bullet.png')\n startBullet = screen.blit(startBullet, (450, 300))\n bullets.append(startBullet)\n bulletsX.append(450)\n bulletsY.append(300)\n pygame.display.set_caption('Touhou Danmaku Kagura')\n pygame.display.set_icon(pygame.image.load('Icon.png'))\n background = pygame.image.load('Background.jpg')\n background = pygame.transform.scale(background, (screenSizes.Width, screenSizes.Height))\n\n def getPlayerDirection():\n global animLimit\n if toX == 0:\n animLimit = bool(False)\n return 'Idle'\n if toX >= 1:\n animLimit = bool(True)\n return 'Right'\n if toX <= -1:\n animLimit = bool(True)\n return 'Left'\n\n def getAnimation():\n global currentAnim\n global currentCount\n if currentCount >= 150:\n if currentAnim <= 7:\n currentCount = 0\n currentAnim += 1\n elif animLimit == False:\n currentCount = 0\n currentAnim = 1\n\n def loadBullet(x, y):\n newBullet = pygame.image.load('Bullet.png')\n newBullet = screen.blit(newBullet, (x, y))\n\n def bullet(x, y):\n newBullet = pygame.image.load('Bullet.png')\n newBullet = screen.blit(newBullet, (x, y))\n bulletsDirection.append(random.randint(1, 2))\n bullets.append(newBullet)\n bulletsX.append(x)\n bulletsY.append(y)\n\n def editDirection():\n global playerX\n global playerY\n if toY <= -1:\n if playerY <= 0:\n pass\n else:\n playerY -= 1\n elif toY >= 1:\n if playerY >= screenSizes.Height - 60:\n pass\n else:\n playerY += 1\n if toX <= -1:\n if playerX <= 0:\n pass\n else:\n playerX -= 1\n elif toX >= 1:\n if playerX >= screenSizes.Width - 25:\n pass\n else:\n playerX += 1\n\n def isCollision(bulletX, bulletY):\n distance = math.sqrt(math.pow(playerX - bulletX, 2) + math.pow(playerY - bulletY, 2))\n if distance < 12:\n return True\n else:\n return False\n\n def makePlayer(posX, posY):\n getAnimation()\n editDirection()\n getDir = getPlayerDirection()\n screen.blit(pygame.image.load(f\"Reimu{getDir}{currentAnim}.png\"), (posX, posY))\n\n screen.fill((24, 24, 24))\n pygame.display.update()\n isGameRunning = True\n start = time.time()\n while isGameRunning:\n if time.time() - start <= 1800:\n screen.blit(background, (0, 0))\n for event in pygame.event.get():\n if event.type == pygame.QUIT:\n isGameRunning = False\n break\n if event.type == pygame.KEYDOWN:\n if event.key == pygame.K_LEFT:\n toX = -1\n currentAnim = 1\n elif event.key == pygame.K_RIGHT:\n toX = 1\n currentAnim = 1\n else:\n if event.type == pygame.KEYDOWN:\n pass\n\n if event.key == pygame.K_DOWN:\n toY = 1\n elif event.key == pygame.K_UP:\n toY = -1\n else:\n if event.type == pygame.KEYUP:\n if event.key == pygame.K_LEFT:\n pass\n if toX <= -1:\n toX = 0\n elif event.key == pygame.K_RIGHT:\n toX = toX >= 1 and 0\n elif event.key == pygame.K_UP:\n if toY <= -1:\n toY = 0\n\n if event.key == pygame.K_DOWN:\n if toY >= 1:\n toY = 0\n\n currentCount += 1\n lastBullet += 1\n for x in range(0, len(bullets)):\n if lastBullet >= 5:\n lastBullet = 0\n if totalBullets <= bulletLimit:\n totalBullets += 1\n bullet(random.randint(0, 800), 0)\n try:\n if bulletsDirection[x] == 1:\n bulletsX[x] += 0.5\n elif bulletsDirection[x] == 2:\n bulletsX[x] -= 0.5\n else:\n bulletsY[x] += 1.5\n loadBullet(bulletsX[x], bulletsY[x])\n if bulletsY[x] >= 600:\n totalBullets -= 1\n bullets.pop(x)\n bulletsX.pop(x)\n bulletsY.pop(x)\n\n except:\n pass\n\n try:\n if isCollision(bulletsX[x], bulletsY[x]) == True:\n totalBullets -= 1\n isGameRunning = False\n bullets.pop(x)\n bulletsX.pop(x)\n bulletsY.pop(x)\n except:\n pass\n\n makePlayer(playerX, playerY)\n pygame.display.update()\n\n if isGameRunning:\n dx = 50\n dy = 300\n totalBullets += 1\n bullet(dx, dy)\n for _ in range(42):\n bulletsY[(-1)] += 1\n loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n\n dx += 62\n bullet(dx, dy)\n for _ in range(42):\n bulletsY[(-1)] += 1\n loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n\n dx += 62\n bullet(dx, dy)\n for _ in range(30):\n bulletsX[(-1)] -= 1\n bulletsY[(-1)] += 1\n loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n\n for _ in range(30):\n bulletsX[(-1)] += 1\n bulletsY[(-1)] += 1\n loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n\n for _ in range(30):\n bulletsX[(-1)] += 1\n bulletsY[(-1)] -= 1\n loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n\n for _ in range(30):\n bulletsX[(-1)] -= 1\n bulletsY[(-1)] -= 1\n loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n \n {{ 省略 }}\n \n pygame.display.update()\n\n\nif __name__ == '__main__':\n main()\n

It seems that if you get through the loop starting with while isGameRunning: while keeping isGameRunning true, the game is treated as cleared, but there is no clear condition.

\n

So I identified the post-clear processing from the reversing results.

\n

In the post-clear processing, it looked like the following two patterns were repeated.

\n
# パターン 1\ndx += 62\nbullet(dx, dy)\nfor _ in range(42):\n    bulletsY[(-1)] += 1\n    loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n\n# パターン 2\ndx += 62\nbullet(dx, dy)\nfor _ in range(30):\n    bulletsX[(-1)] -= 1\n    bulletsY[(-1)] += 1\n    loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n\nfor _ in range(30):\n    bulletsX[(-1)] += 1\n    bulletsY[(-1)] += 1\n    loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n\nfor _ in range(30):\n    bulletsX[(-1)] += 1\n    bulletsY[(-1)] -= 1\n    loadBullet(bulletsX[(-1)], bulletsY[(-1)])\n\nfor _ in range(30):\n    bulletsX[(-1)] -= 1\n    bulletsY[(-1)] -= 1\n    loadBullet(bulletsX[(-1)], bulletsY[(-1)])
\n

This code was drawing strings of 1 and 0 on the screen as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

So by replacing “pattern 1” in the code above with 1 and “pattern 2” with 0, I was able to obtain the following bit string.

\n
11000111110110110001111101001100110111101110100100110011100100110011011110101011110001100111111101
\n

I fed this bit string into CyberChef and recovered the flag.

\n

\n \n \n \n \n \n \n \n \n

\n

The Cyber Heist(Forensic)

\n
\n

A group of hackers has stolen a sensitive piece of data, and it’s up to you to recover it. We only found this USB sniffer capture that was taken during the cyber attack. Can you uncover the message from the hackers left to us?

\n

Note: All alphabetical characters in the flag are lower-case.

\n
\n

When I opened the challenge pcapng file in WireShark, I found that it was a series of communications captured with USBPcap.

\n

\n \n \n\n# https://www.usb.org/sites/default/files/vendor_ids042523.pdf でベンダ ID を調べる\n0x2813 0x2109 VIA Labs, Inc\n0x0203 0x04d9 Holtek Semiconductor, Inc.\n0x0037 0x1532 Razer (Asia‐Pacific) Pte Ltd.\n0x006d 0x256c GRAPHICS TECHNOLOGY (HK) CO., LIMITED\n

As a result, I became interested in the fact that Holtek Semiconductor, Inc. is a manufacturer that makes keyboards and similar devices.

\n

So I filtered WireShark to this device’s traffic and inspected it, and found that the values in HID Data looked very similar to the values in Leftcver Capture Data.

\n

\n \n \n \n \n \n \n \n \n

\n

So I used tshark to extract only the HID Data of this device into keystrokes.txt and was able to recover the flag.

\n
# HID Data を取得\ntshark -r challenge.pcap -Y 'usbhid.data && usb.addr == \"1.2.1\"' -T fields -e usbhid.data | sed 's/../:&/g2' > keystrokes.txt\n\n# keystrokes.txt からキー入力を解析\npython3 solver.py ./keystrokes.txt
\n

I used the following solver.py.

\n
#!/usr/bin/python\n# -*- coding: utf-8 -*-\n\nimport sys\n\n#More symbols in https://www.fileformat.info/search/google.htm?q=capslock+symbol&domains=www.fileformat.info&sitesearch=www.fileformat.info&client=pub-6975096118196151&forid=1&channel=1657057343&ie=UTF-8&oe=UTF-8&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A11&hl=en\nKEY_CODES = {\n    0x04:['a', 'A'],\n    0x05:['b', 'B'],\n    0x06:['c', 'C'],\n    0x07:['d', 'D'],\n    0x08:['e', 'E'],\n    0x09:['f', 'F'],\n    0x0A:['g', 'G'],\n    0x0B:['h', 'H'],\n    0x0C:['i', 'I'],\n    0x0D:['j', 'J'],\n    0x0E:['k', 'K'],\n    0x0F:['l', 'L'],\n    0x10:['m', 'M'],\n    0x11:['n', 'N'],\n    0x12:['o', 'O'],\n    0x13:['p', 'P'],\n    0x14:['q', 'Q'],\n    0x15:['r', 'R'],\n    0x16:['s', 'S'],\n    0x17:['t', 'T'],\n    0x18:['u', 'U'],\n    0x19:['v', 'V'],\n    0x1A:['w', 'W'],\n    0x1B:['x', 'X'],\n    0x1C:['y', 'Y'],\n    0x1D:['z', 'Z'],\n    0x1E:['1', '!'],\n    0x1F:['2', '@'],\n    0x20:['3', '#'],\n    0x21:['4', '$'],\n    0x22:['5', '%'],\n    0x23:['6', '^'],\n    0x24:['7', '&'],\n    0x25:['8', '*'],\n    0x26:['9', '('],\n    0x27:['0', ')'],\n    0x28:['\\n','\\n'],\n    0x29:['␛','␛'],\n    0x2a:['⌫', '⌫'],\n    0x2b:['\\t','\\t'],\n    0x2C:[' ', ' '],\n    0x2D:['-', '_'],\n    0x2E:['=', '+'],\n    0x2F:['[', '{'],\n    0x30:[']', '}'],\n    0x32:['#','~'],\n    0x33:[';', ':'],\n    0x34:['\\'', '\"'],\n    0x36:[',', '<'],\n    0x37:['.', '>'],\n    0x38:['/', '?'],\n    0x39:['⇪','⇪'],\n    0x4f:[u'→',u'→'],\n    0x50:[u'←',u'←'],\n    0x51:[u'↓',u'↓'],\n    0x52:[u'↑',u'↑']\n}\n\n\n#tshark -r ./usb.pcap -Y 'usb.capdata && usb.data_len == 8' -T fields -e usb.capdata | sed 's/../:&/g2' > keyboards.txt\ndef read_use(file):\n    with open(file, 'r') as f:\n        datas = f.readlines()\n    \n    datas = [d.strip() for d in datas if d] \n    cursor_x = 0\n    cursor_y = 0\n    lines = []\n    output = ''\n    skip_next = False\n    lines.append(\"\")\n    \n    for data in datas:\n        shift = int(data.split(':')[0], 16) # 0x2 is left shift 0x20 is right shift\n        key = int(data.split(':')[2], 16)\n\n        if skip_next:\n            skip_next = False\n            continue\n        \n        if key == 0 or int(data.split(':')[3], 16) > 0:\n            continue\n        \n        #If you don't like output get a more verbose output here (maybe you need to map new rekeys or remap some of them)\n        if not key in KEY_CODES:\n            #print(\"Not found: \"+str(key))\n            continue\n        \n        if shift != 0:\n            shift=1\n            skip_next = True\n\n        if KEY_CODES[key][shift] == u'↑':\n            lines[cursor_y] += output\n            output = ''\n            cursor_y -= 1\n        \n        elif KEY_CODES[key][shift] == u'↓':\n            lines[cursor_y] += output\n            output = ''\n            cursor_y += 1\n\n        elif KEY_CODES[key][shift] == u'→':\n            cursor_x += 1\n\n        elif KEY_CODES[key][shift] == u'←':\n            cursor_x -= 1\n\n        elif KEY_CODES[key][shift] == '\\n':\n            lines.append(\"\")\n            lines[cursor_y] += output\n            cursor_x = 0\n            cursor_y += 1\n            output = ''\n\n        elif KEY_CODES[key][shift] == '[BACKSPACE]':\n            output = output[:cursor_x-1] + output[cursor_x:]\n            cursor_x -= 1\n        \n        else:\n            output = output[:cursor_x] + KEY_CODES[key][shift] + output[cursor_x:]\n            cursor_x += 1\n    \n    if lines == [\"\"]:\n        lines[0] = output\n    \n    if output != '' and output not in lines:\n        lines[cursor_y] += output\n    \n    return '\\n'.join(lines)\n\nif __name__ == '__main__':\n    if len(sys.argv) < 2:\n        print('Missing file to read...')\n        exit(-1)\n    sys.stdout.write(read_use(sys.argv[1]))
\n

Summary

","fields":{"slug":"/ctf-cryptoversectf-2023-en","tagSlugs":["/tag/ctf-en/","/tag/rev-en/","/tag/forensic-en/","/tag/web-en/","/tag/english/"]},"frontmatter":{"date":"2023-05-09","description":"Cryptoverse CTF 2023 Writeup","tags":["CTF (en)","Rev (en)","Forensic (en)","Web (en)","English"],"title":"Cryptoverse CTF 2023 Writeup","socialImage":{"publicURL":"/static/83443fae00dbbc167b885d1a51f0946a/ctf-cryptoversectf-2023.png"}}}},"pageContext":{"slug":"/ctf-cryptoversectf-2023-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}