\n\nThis page has been machine-translated from the original page.
\n
I participated in KnightCTF 2023, which was held in January 2023.
\nThe difficulty didn’t look too high, so I thought I might be able to sweep all the Rev challenges, but I had the start time wrong and ran out of time — finishing with 4 solves.
\nI’ll write a short writeup for each problem I solved.
\nThe Rev binaries in this contest required glibc 2.3.4, so I used a Docker image built from the following Dockerfile.
\n# glibc2_3_4-ubuntu20_10\nFROM ubuntu:21.10\nENV TZ=Europe/London\nRUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone\n\nRUN sed -i -e 's/archive.ubuntu.com\\|security.ubuntu.com/old-releases.ubuntu.com/g' /etc/apt/sources.list\nRUN apt update && apt upgrade -y\nRUN apt install gdb strace ltrace vim unzip zip git -y\n\nRUN mkdir -p /app\nENV HOME=/app\nWORKDIR $HOMEThis was a fairly straightforward ELF challenge.
\nTo run the binary you needed to supply exactly 5 command-line arguments (the actual values didn’t matter).
\nAfter that, you also had to provide input of exactly 0x27 characters.
\nI wrote the following script to decrypt the flag from the decompiled validation logic for each part.
\n# -0x9\nunknown = [0x6d,0x65,0x72,0x60,0x5d,0x4d,0x74,0x47,0x65]\nc100 = 100\n# 0x6142202c 776f6e6b\nc60 = \nfor u in unknown:\n print(chr(\n u ^ c100 ^ c60\n ), end=\"\")\n\n>> KCTF{kRaC\n\n# 0x1b -\nunknown = [0x76,0x7d,0x51,0x6c,0x4f,0x74,0x6f,0x7c,0x73]\nc108 = 0x6f\nc130 = 0x61\nfor u in unknown:\n print(chr(\n u ^ c108 ^ c130\n ), end=\"\")\n\n>> xs_bAzar}\n\n# 0x9-0x11\nunknown = [0x61,0x55,0x47,0x39,0x55,0x65,0x44,0x6f,0x55]\nu1 = 0x65\nc138 = 0x6f\nfor u in unknown:\n print(chr(\n u ^ u1 ^ c138\n ), end=\"\")\n\n>> k_M3_oNe_\n\n\n# 0x12-0x19\nunknown = [0x28,0x47,0x7e,0x54,0x79,0x5f,0x47,0x7b,0x28]\nu1 = 0x65\nc152 = 0x7d\nfor u in unknown:\n print(chr(\n u ^ u1 ^ c152\n ), end=\"\")\n\n>> 0_fLaG_c0Jimmy faces an impossible situation — either he gets eaten by a tiger or attacked by pirates — and we need to change his fate.
\nAnalyzing the file, even though the decompiled output doesn’t reflect it, the disassembly clearly shows a code path that jumps to a mysterious function.
\nI set a breakpoint at this location with gdb, patched ZF to redirect execution to that function, and obtained the flag.
\nThis looked easy, so I solved it as a bonus.
\nExpanding the challenge’s packet capture, I found several DNS queries being issued to a mysterious subdomain.
\nThe last characters in chronological order were ==, which identified it as Base64. I extracted the string VVBCTHtvMV9tcjNhX2VuMF9oazNfaTBofQ==.
Decoding it from Base64 yields UPBL{o1_mr3a_en0_hk3_i0h}.
However, the flag format is different, so some encryption must have been applied.
\nI thought it might be ROT13, but no matching key existed.
\nSince the real flag format is KCTF, and KCTF encrypted to UPBL, I guessed it was a substitution cipher.
I systematically identified the characters: K→U, C→P, and so on, using the Vigenère cipher table.
\nReference: Vigenère cipher - Wikipedia
\nUsing the key KNIG converted UPBL to KCTF, but since this is KniGT CTF, the key should be KNIGT. The decrypted result with that key, KCTF{v1_ce3s_yu0_xx3_a0b}, is the flag.