{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-tuctf-2023-en","result":{"data":{"markdownRemark":{"id":"42304351-a29d-55c3-b842-b67e60f63071","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in TUCTF, which was held around December 2, 2023, as part of 0nePadding.

\n

\n \n \n \n \n \n \n \n \n

\n

I’ll briefly write up the solutions.

\n\n

Table of Contents

\n\n

What Are You Doing In My Swamp?(Forensic)

\n
\n

This challenge is like ogres, it has layers

\n
\n

The file provided as the challenge binary had its magic number stripped, so it could not be recognized as an image file. I manually added the JPG magic number.

\n

\n \n \n \n \n \n \n \n \n

\n

There were no hints from there, so I was stuck for a bit, but in the end I used steghide with the password layers and obtained the following message.

\n

\n \n \n \n \n \n \n \n \n

\n

After that, applying an Atbash cipher to GFXGU{LtIvh_zIv_oRpv_lmrOmh} gave me the correct flag.

\n

State of the Git(Forensic)

\n
\n

All the cool kids are embracing state of the art IAC technology, and we are rushing to catch up! We have a new system that we are testing out, but we are not sure how secure it is. Can you check it out for us?

\n
\n

The challenge binary was an archive containing a .git directory and some code.

\n

When I tried pushing the provided repository to GitHub, I found that it had as many as 592 commits.

\n

\n \n \n \n \n \n \n \n \n

\n

Most of the commit messages start with words like delete, add, release, or fix.

\n

\n \n \n \n \n \n \n \n \n

\n

On GitHub, only one branch showed up.

\n

This was entirely my own mistake, but I had only pushed the main branch from the local repository to GitHub, so no matter how much I inspected the code on GitHub, I could not find the flag.

\n

\n \n \n \n \n \n \n \n \n

\n

When I checked the local branches, I found that several branches existed.

\n

\n \n \n \n \n \n \n \n \n

\n

After switching the local branch to release and grepping git log, I found exactly one suspicious commit message.

\n

\n \n \n \n \n \n \n \n \n

\n

Investigating this commit revealed that a Base64-encoded flag had been embedded in password.

\n
$ git --no-pager show c7ac66f\ncommit c7ac66fbd99c8850706c99b27475222f8dfe3d29\nAuthor: MrLadas <97653268+MrLadas@users.noreply.github.com>\nDate:   Tue Nov 21 23:28:37 2023 +0000\n\n    jqnljvtngtrtpqdkvccfpqyskwnayzgdhurvuwdkxjtcldzhjcksiaagimzdyoflpodbgzfimxumbouesdkivaolamntydqtmwwj\n\ndiff --git a/terraform.tfstate b/terraform.tfstate\nnew file mode 100644\nindex 0000000..955de90\n--- /dev/null\n+++ b/terraform.tfstate\n@@ -0,0 +1,103 @@\n+{\n+  \"version\": 4,\n+  \"terraform_version\": \"1.6.4\",\n+  \"serial\": 3,\n+  \"lineage\": \"0d21a79d-34f7-89e7-57f4-9266570147f4\",\n+  \"outputs\": {},\n+  \"resources\": [\n+    {\n+      \"mode\": \"managed\",\n+      \"type\": \"droplet\",\n+      \"name\": \"ctfd-dev-01\",\n+      \"provider\": \"provider[\\\"registry.terraform.io/digitalocean/digitalocean\\\"]\",\n+      \"instances\": [\n+        {\n+          \"schema_version\": 0,\n+          \"attributes\": {\n+            \"arch\": \"amd64\",\n+            \"bwlimit\": 0,\n+            \"clone\": null,\n+            \"clone_storage\": null,\n+            \"cmode\": \"tty\",\n+            \"console\": true,\n+            \"cores\": 1,\n+            \"cpulimit\": 0,\n+            \"cpuunits\": 1024,\n+            \"description\": \"\",\n+            \"features\": [],\n+            \"force\": false,\n+            \"full\": null,\n+            \"hagroup\": \"\",\n+            \"hastate\": \"\",\n+            \"hookscript\": \"\",\n+            \"hostname\": \"ctfd-dev-01\",\n+            \"id\": \"aws/ctfd-dev-01\",\n+            \"ignore_unpack_errors\": false,\n+            \"lock\": \"\",\n+            \"memory\": 512,\n+            \"mountpoint\": [],\n+            \"nameserver\": \"\",\n+            \"network\": [\n+              {\n+                \"bridge\": \"vmbr0\",\n+                \"firewall\": true,\n+                \"gw\": \"192.168.1.1\",\n+                \"gw6\": \"\",\n+                \"hwaddr\": \"BC:24:11:15:79:0A\",\n+                \"ip\": \"192.168.5.250/16\",\n+                \"ip6\": \"\",\n+                \"mtu\": 0,\n+                \"name\": \"eth0\",\n+                \"rate\": 0,\n+                \"tag\": 0,\n+                \"trunks\": \"\",\n+                \"type\": \"veth\"\n+              }\n+            ],\n+            \"onboot\": true,\n+            \"ostemplate\": \"\",\n+            \"ostype\": \"ubuntu\",\n+            \"password\": \"VFVDVEZ7NzNycjRmMHJtX1M3QTczLTF5XzUzY3IzNzV9Cg==\", // ZG9wX3YxXzA3ZmJjODgwY2YwNTNhOTE5Nzk4MDdkZmFhZjhhZDVjOTg4MGFiYWUxZjhkZjJjY2VjZTk2Njk0MmFmNDE0MDgK < Change this before going !\n+            \"pool\": \"Production\",\n+            \"protection\": false,\n+            \"restore\": false,\n+            \"rootfs\": [\n+              {\n+                \"acl\": false,\n+                \"quota\": false,\n+                \"replicate\": false,\n+                \"ro\": false,\n+                \"shared\": false,\n+                \"size\": \"8G\",\n+                \"storage\": \"do-block-storage\",\n+                \"volume\": \"do-block-storage:ctfd-dev-01/rootfs\"\n+              }\n+            ],\n+            \"searchdomain\": \"\",\n+            \"ssh_public_keys\": null,\n+            \"start\": true,\n+            \"startup\": \"\",\n+            \"swap\": 512,\n+            \"tags\": \"\",\n+            \"template\": false,\n+            \"timeouts\": null,\n+            \"tty\": 2,\n+            \"unique\": false,\n+            \"unprivileged\": true,\n+            \"unused\": []\n+          },\n+          \"sensitive_attributes\": [\n+            [\n+              {\n+                \"type\": \"get_attr\",\n+                \"value\": \"password\"\n+              }\n+            ]\n+          ],\n+          \"private\": \"sdkawewgfjfakqpwoqpretwenfwejweahwhuqhewdfhewf\"\n+        }\n+      ]\n+    }\n+  ],\n+  \"check_results\": null\n+}
\n

Decoding it gives the flag.

\n
$ echo VFVDVEZ7NzNycjRmMHJtX1M3QTczLTF5XzUzY3IzNzV9Cg== | base64 -d\nTUCTF{73rr4f0rm_S7A73-1y_53cr375}
\n

Table Encryption(Crypto)

\n
\n

You can’t crack my file! I am the exclusive owner of the encryption key!

\n
\n

The challenge binary was an encrypted binary file named table_encryption.xml.enc.

\n

There were no hints besides the filename, so I started by XORing it with the XML prologue, which allowed me to recover the original key.

","fields":{"slug":"/ctf-tuctf-2023-en","tagSlugs":["/tag/ctf-en/","/tag/rev-en/","/tag/crypto-en/","/tag/forensic-en/","/tag/english/"]},"frontmatter":{"date":"2023-12-06","description":"This is a writeup for TUCTF CTF 2023.","tags":["CTF (en)","Rev (en)","Crypto (en)","Forensic (en)","English"],"title":"TUCTF CTF 2023 Writeup","socialImage":{"publicURL":"/static/4198cdd6d79c44b9052ca79e232272eb/ctf-tuctf-2023.png"}}}},"pageContext":{"slug":"/ctf-tuctf-2023-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}