\n\nThis page has been machine-translated from the original page.
\n
I participated in TUCTF 2024 (which was actually held in 2025) with 0nePadding.
\nI was so busy that the scoreboard had already been closed by the time I got around to writing a writeup, but I will at least document the challenges I solved.
\n\n\n\nLets play a game!!! You spend hours trying to guess my secret phrase! Can you figure out the secret code and retrieve the flag?
\n
Running the challenge binary launches a menu like the one below asking whether you want to play the game.
\nThe next validation is implemented as follows and checks whether each character XORed with 0x32 matches a hardcoded value.
\n\n\nIt’s still a work in progress, but I made my own file format! It is pretty efficient I think, but there may be improvements.
\n
In the next challenge, we are given the code below, which generates files by encoding RGB data in a custom format, along with a file produced by encoding an image with that code.
\nfrom PIL import Image\nimport numpy as np\nimport crc8\n\ndef main():\n inp = input(\"\"\"\n Welcome to the TU Image Program\n It can convert images to TIMGs\n It will also display TIGMs\n\n [1] Convert Image to TIMG\n [2] Display TIMG\n\n \"\"\")\n match inp:\n case \"1\":\n conv()\n case \"2\":\n display() #TODO: Add\n '''\n⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠟⠛⠛⠛⠋⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠙⠛⠛⠛⠿⠻⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⣿⣿⡿⠋⠀⠀⠀⠀⠀⡀⠠⠤⠒⢂⣉⣉⣉⣑⣒⣒⠒⠒⠒⠒⠒⠒⠒⠀⠀⠐⠒⠚⠻⠿⠿⣿⣿⣿⣿⣿⣿⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⣿⠏⠀⠀⠀⠀⡠⠔⠉⣀⠔⠒⠉⣀⣀⠀⠀⠀⣀⡀⠈⠉⠑⠒⠒⠒⠒⠒⠈⠉⠉⠉⠁⠂⠀⠈⠙⢿⣿⣿⣿⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⠇⠀⠀⠀⠔⠁⠠⠖⠡⠔⠊⠀⠀⠀⠀⠀⠀⠀⠐⡄⠀⠀⠀⠀⠀⠀⡄⠀⠀⠀⠀⠉⠲⢄⠀⠀⠀⠈⣿⣿⣿⣿⣿\n⣿⣿⣿⣿⣿⣿⠋⠀⠀⠀⠀⠀⠀⠀⠊⠀⢀⣀⣤⣤⣤⣤⣀⠀⠀⠀⢸⠀⠀⠀⠀⠀⠜⠀⠀⠀⠀⣀⡀⠀⠈⠃⠀⠀⠀⠸⣿⣿⣿⣿\n⣿⣿⣿⣿⡿⠥⠐⠂⠀⠀⠀⠀⡄⠀⠰⢺⣿⣿⣿⣿⣿⣟⠀⠈⠐⢤⠀⠀⠀⠀⠀⠀⢀⣠⣶⣾⣯⠀⠀⠉⠂⠀⠠⠤⢄⣀⠙⢿⣿⣿\n⣿⡿⠋⠡⠐⠈⣉⠭⠤⠤⢄⡀⠈⠀⠈⠁⠉⠁⡠⠀⠀⠀⠉⠐⠠⠔⠀⠀⠀⠀⠀⠲⣿⠿⠛⠛⠓⠒⠂⠀⠀⠀⠀⠀⠀⠠⡉⢢⠙⣿\n⣿⠀⢀⠁⠀⠊⠀⠀⠀⠀⠀⠈⠁⠒⠂⠀⠒⠊⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡇⠀⠀⠀⠀⠀⢀⣀⡠⠔⠒⠒⠂⠀⠈⠀⡇⣿\n⣿⠀⢸⠀⠀⠀⢀⣀⡠⠋⠓⠤⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠄⠀⠀⠀⠀⠀⠀⠈⠢⠤⡀⠀⠀⠀⠀⠀⠀⢠⠀⠀⠀⡠⠀⡇⣿\n⣿⡀⠘⠀⠀⠀⠀⠀⠘⡄⠀⠀⠀⠈⠑⡦⢄⣀⠀⠀⠐⠒⠁⢸⠀⠀⠠⠒⠄⠀⠀⠀⠀⠀⢀⠇⠀⣀⡀⠀⠀⢀⢾⡆⠀⠈⡀⠎⣸⣿\n⣿⣿⣄⡈⠢⠀⠀⠀⠀⠘⣶⣄⡀⠀⠀⡇⠀⠀⠈⠉⠒⠢⡤⣀⡀⠀⠀⠀⠀⠀⠐⠦⠤⠒⠁⠀⠀⠀⠀⣀⢴⠁⠀⢷⠀⠀⠀⢰⣿⣿\n⣿⣿⣿⣿⣇⠂⠀⠀⠀⠀⠈⢂⠀⠈⠹⡧⣀⠀⠀⠀⠀⠀⡇⠀⠀⠉⠉⠉⢱⠒⠒⠒⠒⢖⠒⠒⠂⠙⠏⠀⠘⡀⠀⢸⠀⠀⠀⣿⣿⣿\n⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠑⠄⠰⠀⠀⠁⠐⠲⣤⣴⣄⡀⠀⠀⠀⠀⢸⠀⠀⠀⠀⢸⠀⠀⠀⠀⢠⠀⣠⣷⣶⣿⠀⠀⢰⣿⣿⣿\n⣿⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠁⢀⠀⠀⠀⠀⠀⡙⠋⠙⠓⠲⢤⣤⣷⣤⣤⣤⣤⣾⣦⣤⣤⣶⣿⣿⣿⣿⡟⢹⠀⠀⢸⣿⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⣧⡀⠀⠀⠀⠀⠀⠀⠀⠑⠀⢄⠀⡰⠁⠀⠀⠀⠀⠀⠈⠉⠁⠈⠉⠻⠋⠉⠛⢛⠉⠉⢹⠁⢀⢇⠎⠀⠀⢸⣿⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⣿⣿⣦⣀⠈⠢⢄⡉⠂⠄⡀⠀⠈⠒⠢⠄⠀⢀⣀⣀⣰⠀⠀⠀⠀⠀⠀⠀⠀⡀⠀⢀⣎⠀⠼⠊⠀⠀⠀⠘⣿⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣄⡀⠉⠢⢄⡈⠑⠢⢄⡀⠀⠀⠀⠀⠀⠀⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠁⠀⠀⢀⠀⠀⠀⠀⠀⢻⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣦⣀⡈⠑⠢⢄⡀⠈⠑⠒⠤⠄⣀⣀⠀⠉⠉⠉⠉⠀⠀⠀⣀⡀⠤⠂⠁⠀⢀⠆⠀⠀⢸⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣦⣄⡀⠁⠉⠒⠂⠤⠤⣀⣀⣉⡉⠉⠉⠉⠉⢀⣀⣀⡠⠤⠒⠈⠀⠀⠀⠀⣸⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣶⣤⣄⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⣿⣿⣿\n⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⣶⣶⣤⣤⣤⣤⣀⣀⣤⣤⣤⣶⣾⣿⣿⣿⣿⣿\n'''\n\n \n case _:\n return 0\n return 0\n\n\ndef conv():\n file = input(\"Enter the path to you image you want converted to a TIMG file:\\n\")\n out = input(\"Enter the path youd like to write the TIMG to:\\n\")\n img = Image.open(file)\n w,h = img.size\n write = [b'\\x54',b'\\x49',b'\\x4D',b'\\x47',b'\\x00',b'\\x01',b'\\x00',b'\\x02']\n for x in w.to_bytes(4):\n write.append(x.to_bytes(1))\n for y in h.to_bytes(4):\n write.append(y.to_bytes(1))\n write.append(b'\\x52')\n write.append(b'\\x55')\n write.append(b'\\x42')\n write.append(b'\\x59')\n\n\n\n for i in range(h):\n dat = [b'\\x44',b'\\x41',b'\\x54',b'\\x52']\n for j in range(w):\n dat.append(img.getpixel([j,i])[0].to_bytes(1))\n dat.append(getCheck(dat[4:]))\n for wa in dat:\n write.append(wa)\n\n for i in range(h): \n dat = [b'\\x44',b'\\x41',b'\\x54',b'\\x47']\n for j in range(w):\n dat.append(img.getpixel([j,i])[1].to_bytes(1))\n dat.append(getCheck(dat[4:]))\n for wa in dat:\n write.append(wa)\n\n for i in range(h): \n dat = [b'\\x44',b'\\x41',b'\\x54',b'\\x42' ]\n for j in range(w):\n print(img.getpixel([j,i])[2].to_bytes(1))\n dat.append(img.getpixel([j,i])[2].to_bytes(1)) \n print(dat) \n dat.append(getCheck(dat[4:]))\n for wa in dat:\n write.append(wa)\n\n write.append(b'\\x44')\n write.append(b'\\x41')\n write.append(b'\\x54')\n write.append(b'\\x45')\n\n with open(out,\"ab\") as f:\n for b in write:\n f.write(b)\n\n return 0 \n\ndef getCheck(datr):\n dat = ''\n for w in datr:\n dat+=chr(int.from_bytes(w))\n print(datr )\n print(dat.encode())\n return int.to_bytes(int(crc8.crc8(dat.encode()).hexdigest(),base=16),1)\n\nif __name__=='__main__':\n main()This code simply stores an image’s RGB data in a custom format, so the original image can be recovered easily with the following solver.
\nfrom PIL import Image\nimport numpy as np\nimport struct\nimport crc8\n\ndef timg_to_jpg(timg_file, output_file):\n try:\n with open(timg_file, \"rb\") as f:\n data = f.read()\n\n # Check TIMG header\n if data[:4] != b'TIMG':\n raise ValueError(\"Invalid TIMG file\")\n\n # Extract width and height\n width = int.from_bytes(data[8:12], \"big\")\n height = int.from_bytes(data[12:16], \"big\")\n\n # Verify header consistency\n if data[16:20] != b'RUBY':\n raise ValueError(\"Invalid RUBY header\")\n\n # Initialize RGB arrays\n r_channel = np.zeros((height, width), dtype=np.uint8)\n g_channel = np.zeros((height, width), dtype=np.uint8)\n b_channel = np.zeros((height, width), dtype=np.uint8)\n\n # Parse data sections\n offset = 20 # Start after header\n for color, channel in zip([b'DATR', b'DATG', b'DATB'], [r_channel, g_channel, b_channel]):\n for i in range(height):\n if data[offset:offset+4] != color:\n raise ValueError(f\"Missing {color.decode()} section\")\n offset += 4 # Skip section header\n for j in range(width):\n channel[i, j] = data[offset]\n offset += 1\n\n # Skip checksum (1 byte)\n offset += 1\n\n # Verify footer\n if data[offset:offset+4] != b'DATE':\n raise ValueError(\"Invalid footer\")\n\n # Combine channels into an image\n rgb_array = np.stack((r_channel, g_channel, b_channel), axis=2)\n img = Image.fromarray(rgb_array, \"RGB\")\n\n # Save as JPG\n img.save(output_file, \"JPEG\")\n print(f\"Successfully converted TIMG to {output_file}\")\n\n except Exception as e:\n print(f\"Error: {e}\")\n\n# Example usage\ntimg_to_jpg(\"flag.timg\", \"output.jpg\")Decoding the challenge file with this code yields the correct flag as shown below.
\n\n\nWe recently got this absolutely non-sensical presentation from a confidential informant, along with a notes that said “The truth hurts boomers, but it’s what on the inside that counts <3”. We can’t make heads or tails of it, but it has to be important! Can you help us out?
\n
If you unzip the Office file provided with the challenge, you will find a folder named secret_data.7z inside.
\n\nYou are security analyst given a pcap file containing network traffic. Hidden among these packets is a secret flag transmitted. Your task is to analyze the pcap file, filter out common traffic, and pinpoint the packet carrying the hidden flag.
\n
By searching through the large amount of TCP traffic in the packet capture provided with the challenge, you can identify the stream that transmits the flag in plaintext.
\n\n\nI shared a super secret message, I hope its secure.
\n
I analyzed the packet capture of wireless traffic provided with the challenge.
\nUsing Wireshark shows that this traffic appears to be encrypted with WPA.
\nSo I decided to check whether the WPA password could be recovered using airodump-ng.
airodump-ng -r dump-05.capFrom this result, we can determine the WPA decryption password by performing a dictionary attack with rockyou.txt.
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b D8:3A:DD:07:AA:5A dump-05.capReference: ja:cracking_wpa [Aircrack-ng]
\nI then used the recovered password in Wireshark to decrypt the WPA traffic.
\nThis file contained an encoded string like the one shown below.
\nUnfortunately, trying ordinary approaches such as Base64 decoding did not work, but thanks to a teammate discovering that the flag could be decoded with Base62, we were able to determine that the correct flag was TUCTF{w1f1_15_d3f1n173ly_53cure3}.
I had so little time to write this up that it ended up being a bit rushed…
","fields":{"slug":"/ctf-tuctf-2025-en","tagSlugs":["/tag/rev-en/","/tag/forensic-en/","/tag/english/"]},"frontmatter":{"date":"2025-02-02","description":"TUCTFCTF 2024 Writeup","tags":["Rev (en)","Forensic (en)","English"],"title":"TUCTF 2024 Writeup","socialImage":{"publicURL":"/static/87e8300f66fb27f5bfdf983eefa98953/ctf-tuctf-2025.png"}}}},"pageContext":{"slug":"/ctf-tuctf-2025-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}