{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-tsukushi-2022-en","result":{"data":{"markdownRemark":{"id":"0d9c3a28-60ba-5b18-8db6-9065f7b6e608","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in TsukuCTF 2022 and wrote up this writeup.

\n

Our ranking briefly crept into single digits, but we couldn’t hold it and finished 14th.

\n

This was also a rare occasion where we competed as team 0neP@dding, which made it especially fun.

\n

That said, it was only two of us, which felt a little lonely — time to start recruiting members soon.

\n

As usual, I’m recording the interesting problems we solved and the ones we couldn’t.

\n

\n \n \n \n \n \n \n \n \n

\n\n

Table of Contents

\n\n

OSINT

\n

banana

\n

The challenge was:

\n
\n

Tsukushi is looking at a girl’s social media account. He says: “I want to figure out where this photo was taken so I can go there and take the same shot!”

\n

Help Tsukushi identify the location. The flag format is TsukuCTF22{latitude_longitude}. Latitude and longitude should be in decimal notation, truncated to 5 decimal places.

\n
\n

\n \n \n \n \n \n \n \n \n

\n

I tried cropping out the banana mascot in the background and reverse-searching it, but couldn’t find anything for a while. Eventually, narrowing the search to Instagram turned up the account of a homemaker who used this image as her icon.

\n

Browsing through her personal photos revealed that the wall in the background is at the location of the Tamuning morning market in Guam, and I was able to get the Flag.

\n

TsukuCTF Big Fan 2

\n
\n

The problem:\nHe appears to be running a website.

\n
\n

In the previous challenge “TsukuCTF Big Fan 1”, I found through his Twitter account that he runs a website and publishes it at the address indicated by the cipher ctf 073b6d com.

\n

\n \n \n \n \n \n \n \n \n

\n

The numbers looked like Leet-cipher substitutions, so I wrote the following script to brute-force plausible combinations.

\n

However, none of the patterns resolved to a reachable address, and I retired.

\n
import requests\n\nurls = []\nfor a in (\"0\", \"o\", \"oh\", \"p\"):\n    for b in (\"7\", \"t\", \"l\", \"y\"):\n        for c in (\"3\", \"e\"):\n            for d in (\"8\", \"b\", \"6\", \"i3\", \"13\"):\n                for e in (\"6\", \"g\", \"b\"):\n                    for f in (\"d\", \"i7\", \"17\"):\n                        s = a + b + c + d + e + f\n                        url = \"http://ctf.{}.com/\".format(s)\n                        urls.append(url)\n# For test\nurls.append(\"https://google.com/\")\n\nfor url in urls:\n    print(url)\n    try:\n        res = requests.get(url)\n        print(res.status_code)\n        break\n    except:\n        pass
\n

Looking at the following writeup, the hint was hidden in a different tweet by the same person.

\n

Reference: TsukuCTF 2022 writeup - st98’s diary

\n

\n \n \n \n \n \n \n \n \n

\n

Here, “xn” refers to the ACE (ASCII Compatible Encoding) prefix used in internationalized domain names expressed in Punycode. (Labels with ACE are called “A-labels”.)

\n

Punycode is an encoding scheme that converts hostnames containing Unicode characters into strings composed only of letters, digits, and hyphens (a subset of ASCII), enabling Unicode-expressed hostnames such as Japanese domain names to be used as Internationalized Domain Names (IDNs) in applications.

\n

Reference: Punycode - Wikipedia

\n

Punycode can reversibly convert Unicode strings to ASCII strings: ASCII characters are left as-is, while non-ASCII characters are converted to a unique string of alphanumerics and hyphens.

\n

In practice, prepending “xn—” to the ciphertext and decoding as Punycode yields the following domain name:

\n

\n \n _ \\ / _` | '_ \\ / _ \\ \\/ /\n| | | | (_| | < (_) |__) | | | | (_| | |_) | (_) > <\n|_| |_|\\__,_|_|\\_\\___/____/|_| |_|\\__,_|_.__/ \\___/_/\\_\\\n\n------------------------------------------------------------」と言う\n\n「日本語コード：」と尋ねる\nそれを入力に代入\n\nブラックリスト＝「読、開、保存、実行、起動、サーバ、フォルダ、ファイル、ナデシコ、ディレクトリ、flag」を「、」で区切る\n\nブラックリスト！＝空の間\n　　ブラックリストの０から１を配列取り出す\n　　もし（入力でそれの出現回数）！＝０ならば\n　　　　「日本語の世界からは出しませんよ！！！」と言う\n　　　　終了する\n　　ここまで\nここまで\n\n「｛入力｝」をナデシコする\n\n終了する\n

Characters defined in the “blacklist” are blocked, preventing direct file operations and similar commands.

\n

The running version of Nadesiko was nadesiko3@3.3.67, so I searched GitHub for vulnerability or bug reports and found that this version contains an OS injection vulnerability.

\n

Reference: Issue with cnako3 compression/decompression · Issue #1325 · kujirahand/nadesiko3

\n

I got excited and tried various exploit permutations to get the Flag, but never succeeded and retired.

\n

Part of the issue was my exploit skills, but I was also too fixated on confirming success via console output.

\n

When the response wasn’t coming back, I assumed it had failed — but apparently it had actually succeeded.

\n

As the writeup explains, the Flag cannot be retrieved via console output alone; you need to execute a command that transfers the file to a remote host.

\n

This was the challenge I most wanted to solve, so it stings.

\n

Wrap-up

\n

It was great to get back out competing as 0neP@dding after a while, and we had a lot of fun.

\n

That said, having just two people felt a bit lonely, so I’m thinking it’s time to recruit more members soon.

","fields":{"slug":"/ctf-tsukushi-2022-en","tagSlugs":["/tag/ctf-en/","/tag/osint-en/","/tag/writeup-en/","/tag/english/"]},"frontmatter":{"date":"2022-10-23","description":"TsukuCTF 2022 Writeup","tags":["CTF (en)","OSINT (en)","Writeup (en)","English"],"title":"TsukuCTF 2022 Writeup","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/ctf-tsukushi-2022-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}