{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-pico-2025-en","result":{"data":{"markdownRemark":{"id":"b9ba43ca-ff39-5556-b099-bb11a223774c","html":"
\n

This page has been machine-translated from the original page.

\n
\n

For this year’s picoCTF, I only solved the Rev challenges for now.

\n

There were not many particularly interesting challenges this time, but I will leave a brief writeup anyway.

\n\n

Table of Contents

\n\n

Flag Hunters(Rev)

\n
\n

Lyrics jump from verses to the refrain kind of like a subroutine call. There’s a hidden refrain this program doesn’t print by default. Can you get it to print it? There might be something in it for you.

\n
\n

The following Python script was provided as the challenge file.

\n
import re\nimport time\n\n\n# Read in flag from file\nflag = open('flag.txt', 'r').read()\n\nsecret_intro = \\\n'''Pico warriors rising, puzzles laid bare,\nSolving each challenge with precision and flair.\nWith unity and skill, flags we deliver,\nThe ether’s ours to conquer, '''\\\n+ flag + '\\n'\n\n\nsong_flag_hunters = secret_intro +\\\n'''\n\n[REFRAIN]\nWe’re flag hunters in the ether, lighting up the grid,\nNo puzzle too dark, no challenge too hid.\nWith every exploit we trigger, every byte we decrypt,\nWe’re chasing that victory, and we’ll never quit.\nCROWD (Singalong here!);\nRETURN\n\n[VERSE1]\nCommand line wizards, we’re starting it right,\nSpawning shells in the terminal, hacking all night.\nScripts and searches, grep through the void,\nEvery keystroke, we're a cypher's envoy.\nBrute force the lock or craft that regex,\nFlag on the horizon, what challenge is next?\n\nREFRAIN;\n\nEchoes in memory, packets in trace,\nDigging through the remnants to uncover with haste.\nHex and headers, carving out clues,\nResurrect the hidden, it's forensics we choose.\nDisk dumps and packet dumps, follow the trail,\nBuried deep in the noise, but we will prevail.\n\nREFRAIN;\n\nBinary sorcerers, let’s tear it apart,\nDisassemble the code to reveal the dark heart.\nFrom opcode to logic, tracing each line,\nEmulate and break it, this key will be mine.\nDebugging the maze, and I see through the deceit,\nPatch it up right, and watch the lock release.\n\nREFRAIN;\n\nCiphertext tumbling, breaking the spin,\nFeistel or AES, we’re destined to win.\nFrequency, padding, primes on the run,\nVigenère, RSA, cracking them for fun.\nShift the letters, matrices fall,\nDecrypt that flag and hear the ether call.\n\nREFRAIN;\n\nSQL injection, XSS flow,\nMap the backend out, let the database show.\nInspecting each cookie, fiddler in the fight,\nCapturing requests, push the payload just right.\nHTML's secrets, backdoors unlocked,\nIn the world wide labyrinth, we’re never lost.\n\nREFRAIN;\n\nStack's overflowing, breaking the chain,\nROP gadget wizardry, ride it to fame.\nHeap spray in silence, memory's plight,\nRace the condition, crash it just right.\nShellcode ready, smashing the frame,\nControl the instruction, flags call my name.\n\nREFRAIN;\n\nEND;\n'''\n\nMAX_LINES = 100\n\ndef reader(song, startLabel):\n  lip = 0\n  start = 0\n  refrain = 0\n  refrain_return = 0\n  finished = False\n\n  # Get list of lyric lines\n  song_lines = song.splitlines()\n  \n  # Find startLabel, refrain and refrain return\n  for i in range(0, len(song_lines)):\n    if song_lines[i] == startLabel:\n      start = i + 1\n    elif song_lines[i] == '[REFRAIN]':\n      refrain = i + 1\n    elif song_lines[i] == 'RETURN':\n      refrain_return = i\n\n  # Print lyrics\n  line_count = 0\n  lip = start\n  while not finished and line_count < MAX_LINES:\n    line_count += 1\n    for line in song_lines[lip].split(';'):\n      if line == '' and song_lines[lip] != '':\n        continue\n      if line == 'REFRAIN':\n        song_lines[refrain_return] = 'RETURN ' + str(lip + 1)\n        lip = refrain\n      elif re.match(r\"CROWD.*\", line):\n        crowd = input('Crowd: ')\n        song_lines[lip] = 'Crowd: ' + crowd\n        lip += 1\n      elif re.match(r\"RETURN [0-9]+\", line):\n        lip = int(line.split()[1])\n      elif line == 'END':\n        finished = True\n      else:\n        print(line, flush=True)\n        time.sleep(0.5)\n        lip += 1\n\n\n\nreader(song_flag_hunters, '[VERSE1]')
\n

Accessing the remote server causes the text after [VERSE1] to be printed in order.

\n

Because the Flag is written on lines before [VERSE1], we need to somehow make the introductory text print.

\n

When you connect to the remote server, it asks for input at CROWD, and you can see that the text you enter is appended to the server-side data by song_lines[lip] = 'Crowd: ' + crowd.

\n

Furthermore, if the text matches RETURN [0-9]+, execution jumps to the line specified there and continues printing.

\n

Also, because the text is evaluated using semicolon-separated tokens, if you provide input so that a line like Crowd: ;RETURN 0 is added, you can make it print the correct Flag as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

Tap into Hash(Rev)

\n
\n

Can you make sense of this source code file and write a function that will decode the given encrypted file content?\nFind the encrypted file here. It might be good to analyze source file to get the flag.

\n
\n

Looking at the Python script provided as the challenge file, you can see that it performs a simple encryption scheme.

\n
import time\nimport base64\nimport hashlib\nimport sys\nimport secrets\n\ndef xor_bytes(a, b):\n    return bytes(x ^ y for x, y in zip(a, b))\n\nkey = b\"\\x1br\\t;\\x0f\\xb5\\x9f\\xaa\\xd1'\\xaf\\x86[\\xf0\\xe6\\xd9'D\\xf9\\x8d\\x17g\\xeb>_gG.\\xd4\\xc3\\xdc\\x83\"\nenc = b'o\\x14>\\xda\\x16\\xc7\\xce\\xd784,.\\x8f2\\x80@cD?\\xd3L\\x90\\x9f\\x87l0yy\\xdam\\x85J1\\x139\\x88\\x10\\x95\\x9f\\x82ke*.\\xda>\\xd3\\x195O?\\xd3\\x10\\xc4\\x94\\x83kd| \\x882\\x86IzFk\\xd2@\\x95\\xcd\\x83:by{\\x8c3\\x81\\x1e6E8\\xdaC\\xc2\\xcf\\xd087||\\x8em\\xd0\\x1c3Cj\\xde\\x10\\xc0\\x99\\x89;4+{\\x8fn\\x84\\x1abN9\\xdc\\x16\\xc5\\xc8\\xd0mc}+\\x81o\\xd7J1[k\\xda\\x12\\x94\\xce\\x89m3}(\\xdbh\\x84KeDh\\x8fF\\x9e\\xc9\\x84i1.*\\x8f2\\x87\\x1d4\\x15+\\x83\\x17\\xc9\\xef\\xe5Iz*t\\xd7h\\xd9\\'d%\\t\\x82\"\\xcf\\xfe\\xd3[09{\\xe0T\\xea-=;k\\x98@\\x9f\\xcf\\xf9Pp\\x0bb\\xd5A\\xe8\\x02\\x15=\\x04\\x8eL\\x96\\x9f\\x86n0ze\\x89m\\x81A6Bi\\x88B\\x91\\xce\\x8279q~\\x8d:\\x84OfAn\\x8fA\\x95\\xc9\\xd76d|}\\x95;\\x82@oFb\\xddE\\x93\\x98\\xd2jdz/\\x88h\\xd7\\x1a6@o\\xdd\\x12\\x94\\x94\\xd2m`}y\\x8c>\\x82LaCm\\x8f\\x10\\x9f\\x9f\\xd3>0py\\xde2\\x87AoGh\\x88\\x11\\x91\\x9a\\x84=3z*\\xde&\\x82Hb@n\\xddM\\xc3\\xce\\x89me.(\\x808\\xd0KaGo\\x8bG\\x91\\x9b\\x81?`.|\\xde=\\xd6@b\\x17m\\x8e\\x11\\x9f\\x95\\x80>d+.\\x88>\\x80\\x1d4\\x14m\\xdd\\x12\\x96\\xcf\\x85m1q-\\x8ao\\xb0z'\n\ndecrypted_text = b\"\"\nblock_size = 16\nkey_hash = hashlib.sha256(key).digest()\n\nfor i in range(0, len(enc), block_size):\n    block = enc[i:i + block_size]\n    decrypt_block = xor_bytes(block, key_hash)\n    decrypted_text += decrypt_block
\n

By running the solver above, you can easily decrypt the Flag.

\n

\n \n \n \n \n \n \n \n \n

\n

Chronohack(Rev)

\n
\n

Can you guess the exact token and unlock the hidden flag?\nOur school relies on tokens to authenticate students. The access is granted through nc verbal-sleep.picoctf.net 61959. Unfortunately, someone leaked an important file for token generation. Guess the token to get the flag.

\n
\n

The following script was provided as the challenge file.

\n
import random\nimport time\n\ndef get_random(length):\n    alphabet = \"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz\"\n    random.seed(int(time.time() * 1000))  # seeding with current time \n    s = \"\"\n    for i in range(length):\n        s += random.choice(alphabet)\n    return s\n\ndef flag():\n    with open('/flag.txt', 'r') as picoCTF:\n        content = picoCTF.read()\n        print(content)\n\n\ndef main():\n    print(\"Welcome to the token generation challenge!\")\n    print(\"Can you guess the token?\")\n    token_length = 20  # the token length\n    token = get_random(token_length) \n\n    try:\n        n=0\n        while n < 50:\n            user_guess = input(\"\\nEnter your guess for the token (or exit):\").strip()\n            n+=1\n            if user_guess == \"exit\":\n                print(\"Exiting the program...\")\n                break\n            \n            if user_guess == token:\n                print(\"Congratulations! You found the correct token.\")\n                flag()\n                break\n            else:\n                print(\"Sorry, your token does not match. Try again!\")\n            if n == 50:\n                print(\"\\nYou exhausted your attempts, Bye!\")\n    except KeyboardInterrupt:\n        print(\"\\nKeyboard interrupt detected. Exiting the program...\")\n\nif __name__ == \"__main__\":\n    main()
\n

It turns out that you can obtain the Flag if you guess the one-time password generated by a PRNG seeded with the timestamp at runtime within the attempt limit.

\n

I was able to get the Flag with the following simple script.

\n
import random\nimport time\nfrom pwn import *\n\ndef get_random(T):\n    alphabet = \"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz\"\n    random.seed(T)\n    s = \"\"\n    for i in range(20):\n        s += random.choice(alphabet)\n    return s.encode()\n\nfor i in range(0,1000,30):\n    s0 = int(time.time() * 1000)\n    target = remote(\"verbal-sleep.picoctf.net\", 59978, ssl=False)\n    # s1 = int(time.time() * 1000)\n    target.recvuntil(b\"Welcome to the token generation challenge!\")\n    s1 = int(time.time() * 1000)\n    target.recvuntil(b\"Enter your guess for the token (or exit):\")\n    s3 = int(time.time() * 1000)\n    print(s0,s1,s1-s0,s3-s1)\n\n    target.sendline(get_random(0))\n    r = target.recvline()\n\n    j = 0\n    while(j < 47):\n        tmp = j+i\n        target.recvuntil(b\"Enter your guess for the token (or exit):\")\n        tk = get_random(s0+tmp)\n        target.sendline(tk)\n        try:\n            r = target.recvline()\n            print(s0+tmp, tk, r)\n            if \"Congratulations\" in r.decode():\n                print(r)\n                r = target.recvline()\n                print(r)\n                exit()\n        except:\n            print(s1+tmp,tmp)\n            print(r)\n            print(target.recv)\n\n        j += 1\n\n    target.clean()
\n

\n \n \n \n \n \n \n \n \n

\n

However, perhaps something was wrong with the challenge server: at first I could not get the correct Flag no matter what I tried, and I wasted a lot of time on it.

\n

The next morning the server had been updated, and when I used the same script as the day before, I was able to get the Flag right away.

\n

Quantum Scrambler(Rev)

\n
\n

We invented a new cypher that uses “quantum entanglement” to encode the flag. Do you have what it takes to decode it?

\n
\n

Checking the provided script showed that it shuffled the byte value of each character in the Flag using a custom algorithm.

\n

The processing was not very complex, so I simply wrote a solver that reversed the shuffling and obtained the Flag.

\n
scrambled_L = [スクランブル化されたリスト]\n\ni = len(scrambled_L)\nwhile(i > 2):\n    i -= 1\n    im2 = scrambled_L[i-1].pop()\n    im1 = scrambled_L[i-2].pop()\n    scrambled_L[i-1].append(im1)\n\nprint(scrambled_L)\n\n# [['0x70'], ['0x63', '0x69'], ['0x43', '0x6f'], ['0x46', '0x54'], ['0x70', '0x7b'], ['0x74', '0x79'], ['0x6f', '0x68'], ['0x5f', '0x6e'], ['0x73', '0x69'], ['0x77', '0x5f'], ['0x69', '0x65'], ['0x64', '0x72'], ['0x35', '0x62'], ['0x31', '0x37'], ['0x32', '0x34'], ['0x66', '0x66'], ['0x7d']]\n\nfor l in scrambled_L:\n   if len(l) == 1:\n      print(chr(int(l[0], 16)), end=\"\")\n    \n   if len(l) == 2:\n      print(chr(int(l[1], 16)), end=\"\")\n      print(chr(int(l[0], 16)), end=\"\")\n\n# picoCTF{python_is_weirdb57142ff}
\n

perplexed(Rev)

\n
\n

Download the binary here.

\n
\n

Analyzing the challenge binary showed that it validates the input password with the following check function.

\n
int64_t check(char* input)\n\n{\n  if (strlen(input) != 0x1b)\n      return 1;\n\n  int64_t val;\n  __builtin_memcpy(&val, \"\\xe1\\xa7\\x1e\\xf8\\x75\\x23\\x7b\\x61\\xb9\\x9d\\xfc\\x5a\\x5b\\xdf\\x69\\xd2\\xfe\\x1b\\xed\\xf4\\xed\\x67\\xf4\", 0x17);\n  int32_t n = 0;\n  int32_t k = 0;\n  int32_t var_2c_1 = 0;\n\n  for (int32_t i = 0; i <= 0x16; i += 1)\n  {\n      for (int32_t j = 0; j <= 7; j += 1)\n      {\n          if (!k)\n              k += 1;\n\n          int32_t rax_17;\n          rax_17 = ((int32_t)input[(int64_t)n] & 1 << (7 - k)) > 0;\n\n          if (rax_17 != (int8_t)(((int32_t)*(uint8_t*)(&val + (int64_t)i) & 1 << (7 - j)) > 0))\n              return 1;\n\n          k += 1;\n\n          if (k == 8)\n          {\n              k = 0;\n              n += 1;\n          }\n\n          if ((int64_t)n == strlen(input))\n              return 0;\n      }\n  }\n\n  return 0;\n}
\n

Since it was essentially simple byte manipulation, I could find the Flag easily by just throwing angr at it.

\n
import angr\n\nproj = angr.Project(\"perplexed\", auto_load_libs=False)\nobj = proj.loader.main_object\nprint(\"Entry\", hex(obj.entry))\n\nfind = 0x40143e\navoids = [0x40143e]\n\ninit_state = proj.factory.entry_state()\nsimgr = proj.factory.simgr(init_state)\nsimgr.explore(find=find, avoid=avoids)\n\n# 出力\nsimgr.found[0].posix.dumps(0)
\n

The execution result is below.

\n

\n \n \n \n \n \n \n \n \n

\n

Binary Instrumentation 1(Rev)

\n
\n

I have been learning to use the Windows API to do cool stuff! Can you wake up my program to get the flag?

\n
\n

Running the challenge binary showed that it was implemented to sleep forever before printing the correct Flag.

\n

\n \n \n \n \n \n \n \n \n

\n

When I analyzed the binary in the decompiler, I noticed that it had an unusual entry point and might be packed with some kind of packer.

\n
int64_t _start()\n{\n  TEB* gsbase;\n  struct _PEB* ProcessEnvironmentBlock = gsbase->ProcessEnvironmentBlock;\n  int64_t lpMem = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, 0x400);\n\n  if (GetLastError() != ERROR_IPSEC_IKE_SECLOADFAIL)\n      HeapFree(GetProcessHeap(), HEAP_NONE, lpMem);\n  else\n  {\n      ReleaseSRWLockExclusive(nullptr);\n      ReleaseSRWLockShared(nullptr);\n      SetCriticalSectionSpinCount(nullptr, 0);\n      TryAcquireSRWLockExclusive(nullptr);\n      WakeAllConditionVariable(nullptr);\n      SetUnhandledExceptionFilter(nullptr);\n      UnhandledExceptionFilter(nullptr);\n      CheckMenuItem(nullptr, 0, 0);\n      GetMenu(nullptr);\n      GetSystemMenu(nullptr, 0);\n      GetMenuItemID(nullptr, 0);\n      EnableMenuItem(nullptr, 0, MF_BYCOMMAND);\n      MessageBeep(MB_OK);\n      GetLastError();\n      MessageBoxW(nullptr, nullptr, nullptr, MB_OK);\n      MessageBoxA(nullptr, nullptr, nullptr, MB_OK);\n      UpdateWindow(nullptr);\n      GetWindowContextHelpId(nullptr);\n  }\n\n  if (ProcessEnvironmentBlock && ProcessEnvironmentBlock->OSMajorVersion == 0xa)\n  {\n      int64_t i = 0;\n      arg_10 = nullptr;\n      arg_8 = 0;\n      void* ImageBaseAddress = ProcessEnvironmentBlock->ImageBaseAddress;\n      int64_t rsi_1 = (int64_t)*(uint32_t*)((char*)ImageBaseAddress + 0x3c);\n      void* rbx_1 = (char*)ImageBaseAddress + 0x108 + rsi_1;\n\n      do\n      {\n          if (sub_14b0(rbx_1) == 0x9f520b2d)\n          {\n              uint64_t rdi_1 = (uint64_t)*(uint32_t*)((char*)rbx_1 + 0xc);\n              uint64_t rbx_2 = (uint64_t)*(uint32_t*)((char*)rbx_1 + 0x10);\n\n              if (rdi_1 != -(ImageBaseAddress) && rbx_2 && sub_18b0() && !sub_1300(1, rdi_1 + ImageBaseAddress, (uint64_t)rbx_2, &arg_10, &arg_8))\n              {\n                  loader(arg_10, arg_8);\n                  return 0;\n              }\n\n              break;\n          }\n\n          rbx_1 += 0x28;\n          i += 1;\n      } while (i <= (uint64_t)*(uint16_t*)(rsi_1 + ImageBaseAddress + 6));\n  }\n\n  return 0xffffffff;\n}
\n

Looking at the PE sections confirmed that a section named ATOM had been created, which showed that the binary had been packed with a packer called AtomPePacker.

\n

\n \n \n \n \n \n \n \n \n

\n

So I set a breakpoint on this function in WinDbg and ran the program.

\n
bp PP64Stub+1dc0
\n

Next, I dumped the unpacked PE that had been loaded in memory at that point with the .writemem command.

\n
.writemem C:\\Users\\kash1064\\Downloads\\bininst1\\dump.exe @rcx L?0x6499
\n

Analyzing the dumped program confirmed that it contained a Base64-encoded Flag string, as shown below.

\n

\n \n \n \n \n \n \n \n \n

\n

That gave me the correct Flag.

\n

\n \n \n \n \n \n \n \n \n

\n

\n \n