---
# System prepended metadata

title: 2023/12/04 NISRA社課 Final CTF
tags: [course]

---

---
title: '2023 NISRA社課 Final CTF'
disqus: hackmd
---

2023 NISRA社課 Final CTF
===

## Table of Contents

[TOC]

# Total
![image](https://hackmd.io/_uploads/rJdKlT3Sp.png)

# Web1

## Web1: 0x0 Welcome Topic 
![image](https://hackmd.io/_uploads/H12XSIoST.png)

https://x10101.github.io/WebI_CTF/0x0_Welcome/
![image](https://hackmd.io/_uploads/S12Vr8sHp.png)


### Web1: 0x0 Welcome Solution
```html=
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Welcome</title>
    <link rel = "stylesheet" href = "main.css">
    <script src="all.js"></script>
</head>
<body>
    <div class = "main">
        <div id = "question">
            <h1>Welcome</h1>
            <p>Can u find the flag?</p>
            <input type="text">
            <input type="submit" onclick = "showAnswer()">
        </div>
        <div id = "answer" style = "visibility: hidden;">
            <p>Not here :(</p>
            <!--NISRA{Y0u_F1Nd_Th3_FL3GGGGG}-->
        </div>
    </div>
</body>
</html>
```
> **Flag: NISRA{Y0u_F1Nd_Th3_FL3GGGGG}**

## Web1: 0x1 Cat Topic 
![image](https://hackmd.io/_uploads/rJWIHY2ra.png)
https://x10101.github.io/WebI_CTF/0x1_Cats/
![image](https://hackmd.io/_uploads/Bk0-IFnB6.png)

### Web1: 0x1 Cat Solution
https://x10101.github.io/WebI_CTF/0x1_Cats/images/pic01.jpg
![image](https://hackmd.io/_uploads/H16mLt3ra.png)

https://x10101.github.io/WebI_CTF/0x1_Cats/images/flag.jpg
![image](https://hackmd.io/_uploads/SyOrIYnST.png)
> **Flag: NISRA{93wr4nq5}**

## Web1: 0x2 Doors Topic 
![image](https://hackmd.io/_uploads/S1qJDKhSp.png)

https://x10101.github.io/WebI_CTF/0x2_Doors/
![image](https://hackmd.io/_uploads/S1gfvF3Sa.png)

### Web1: 0x2 Doors Solution
```html=
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Rooms</title>
    <link rel="stylesheet" href = "main.css">
    <script src = "secret.js"></script>
</head>
<body>
    <div id = "title" onclick = "Flag()">
        <h1>Find the flag!</h1>
    </div>

    <div id = "main">
        <!--outside-->
        <div id = "door0" style = "display: block;" onclick = "enterDoor0()">
            <p class = "card">000</p>
            <p>Open</p>
        </div>

        <!--Space 1-->
        <div id = "door101" onclick = "enterDoor101()">
            <p class = "card">101</p>
            <p>Open</p>
        </div>
        <div id = "door102" onclick = "enterDoor102()">
            <p class = "card">102</p>
            <p>Open</p>
        </div>

        <!--Space 2-1-->
        <div id = "door201" onclick = "enterDoor201()">
            <p class = "card">201</p>
            <p>Open</p>
        </div>
        <div id = "door202" onclick = "enterDoor202()">
            <p class = "card">202</p>
            <p>Open</p>
        </div>

        <!--Space 2-2-->
        <div id = "door203" onclick = "enterDoor203()">
            <p class = "card">203</p>
            <p>Open</p>
        </div>
        <div id = "door204" onclick = "enterDoor204()">
            <p class = "card">204</p>
            <p>Open</p>
        </div>

        <!--Space 3-1-->
        <div id = "door304" onclick = "enterDoor304()">
            <p class = "card">304</p>
            <p>Open</p>
        </div>
        <div id = "door305" onclick = "enterDoor305()">
            <p class = "card">305</p>
            <p>Open</p>
        </div>

        <!--Space 3-2-->
        <div id = "door301" onclick = "enterDoor301()">
            <p class = "card">301</p>
            <p>Open</p>
        </div>
        <div id = "door302" onclick = "enterDoor302()">
            <p class = "card">302</p>
            <p>Open</p>
        </div>

        <!--Space 3-3-->
        <div id = "nothing">
            <p>Not Here :(</p>
        </div>
        <div id = exit_332 onclick = "exit_332()">
            Exit
        </div>
        <div id = exit_334 onclick = "exit_334()">
            Exit
        </div>

        <!--Space 4-1-->
        <div id = "door403" onclick = "enterDoor403()">
            <p class = "card">403</p>
            <p>Open</p>
        </div>
        <div id = "door404" onclick = "enterDoor404()">
            <p class = "card">404</p>
            <p>Open</p>
        </div>
    </div>
</body>
</html>
```
●JSFuck:https://jsfuck.com/
secret.js 作JSFuck decode
https://x10101.github.io/WebI_CTF/0x2_Doors/secret.js

secret.js JSFuck Decode
```javascript=
function enterDoor0() {     document.getElementById("door0").style.display = "none";     document.getElementById("door101").style.display = "block";     document.getElementById("door102").style.display = "block"; }  function enterDoor101() {     document.getElementById("door101").style.display = "none";     document.getElementById("door102").style.display = "none";     document.getElementById("door201").style.display = "block";     document.getElementById("door202").style.display = "block"; }  function enterDoor102() {     document.getElementById("door101").style.display = "none";     document.getElementById("door102").style.display = "none";     document.getElementById("door203").style.display = "block";     document.getElementById("door204").style.display = "block"; }  function enterDoor201() {     document.getElementById("door201").style.display = "none";     document.getElementById("door202").style.display = "none";     document.getElementById("nothing").style.display = "block";     document.getElementById("exit_332").style.display = "block"; }  function enterDoor202() {     document.getElementById("door201").style.display = "none";     document.getElementById("door202").style.display = "none";     document.getElementById("door203").style.display = "block";     document.getElementById("door204").style.display = "block"; }  function enterDoor203() {     document.getElementById("door203").style.display = "none";     document.getElementById("door204").style.display = "none";     document.getElementById("door304").style.display = "block";     document.getElementById("door305").style.display = "block"; }  function enterDoor204() {     document.getElementById("door203").style.display = "none";     document.getElementById("door204").style.display = "none";     document.getElementById("door301").style.display = "block";     document.getElementById("door302").style.display = "block"; }  function enterDoor301() {     document.getElementById("door301").style.display = "none";     document.getElementById("door302").style.display = "none";     document.getElementById("door304").style.display = "block";     document.getElementById("door305").style.display = "block"; }  function enterDoor302() {     document.getElementById("door301").style.display = "none";     document.getElementById("door302").style.display = "none";     document.getElementById("door403").style.display = "block";     document.getElementById("door404").style.display = "block"; }  function enterDoor304() {     document.getElementById("door304").style.display = "none";     document.getElementById("door305").style.display = "none";     document.getElementById("door201").style.display = "block";     document.getElementById("door202").style.display = "block"; }  function enterDoor305() {     document.getElementById("door304").style.display = "none";     document.getElementById("door305").style.display = "none";     document.getElementById("door301").style.display = "block";     document.getElementById("door302").style.display = "block"; }  function enterDoor404() {     document.getElementById("door403").style.display = "none";     document.getElementById("door404").style.display = "none";     document.getElementById("nothing").style.display = "block";     document.getElementById("exit_334").style.display = "block"; }  function enterDoor403() {     document.getElementById("door403").style.display = "none";     document.getElementById("door404").style.display = "none";     document.getElementById("door101").style.display = "block";     document.getElementById("door102").style.display = "block"; }  function exit_332() {     document.getElementById("nothing").style.display = "none";     document.getElementById("exit_332").style.display = "none";     document.getElementById("door201").style.display = "block";     document.getElementById("door202").style.display = "block"; }  function exit_334() {     document.getElementById("nothing").style.display = "none";     document.getElementById("exit_334").style.display = "none";     document.getElementById("door403").style.display = "block";     document.getElementById("door404").style.display = "block"; }  function Flag() {     alert("NISRA{H3r3_i5_a_s3cr3t_5pac3}"); }
```
> **Flag: NISRA{H3r3_i5_a_s3cr3t_5pac3}**

# Web

## Web: AdminCookies Topic
![image](https://hackmd.io/_uploads/S1eqdLjHT.png)

http://chall2.nisra.net:41019/
![image](https://hackmd.io/_uploads/By7pOLiST.png)
> Cookie:
Flag=hahahaYouAreNotAdmin
### Web: AdminCookies Solution
Cookie: Flag=admin
![image](https://hackmd.io/_uploads/Hyz-K8iB6.png)

![image](https://hackmd.io/_uploads/BJdBKLir6.png)

> **Flag: NISRA{Ch4n9e_y0U_C00kI3s}**

# Misc

## Misc: Blank Topic
![image](https://hackmd.io/_uploads/HkPkKthBT.png)

### Misc: Blank Solution
> file blank.png

![image](https://hackmd.io/_uploads/HkczOq3ST.png)
> (線上)png convert word

![image](https://hackmd.io/_uploads/S1xMYchBp.png)

> **NISRA{D0CX_fil3_5iGna7URE}**

## Misc: 不要跟我要權限 Topic
![image](https://hackmd.io/_uploads/H1jYXhaST.png)

https://docs.google.com/presentation/d/15JkfSJwMmFsqsyytflViT9Lv3Yh10hByimtR53BJWBI
![image](https://hackmd.io/_uploads/HJiiXnpST.png)

### Misc: 不要跟我要權限 Solution
●WayBackMachine: https://web.archive.org/
![image](https://hackmd.io/_uploads/H1BFV3Tr6.png)

![image](https://hackmd.io/_uploads/B1yoVn6rT.png)

> **NISRA{W3B5ItE_h15TorY}**

## Misc: WORD Topic
![image](https://hackmd.io/_uploads/SJfc5c2Sp.png)

### Misc: WORD Solution
![image](https://hackmd.io/_uploads/Hkf8Fn6ra.png)

![image](https://hackmd.io/_uploads/S1ihO2aBT.png)



## Misc: Binwalk Topic
![image](https://hackmd.io/_uploads/SJfc5c2Sp.png)


### Misc: Binwalk Solution
> binwalk finalfalg.png

![image](https://hackmd.io/_uploads/B1Wn59nSp.png)
> file finalfalg.png

![image](https://hackmd.io/_uploads/B1KA9qhBp.png)
> uzip finalfalg.png

![image](https://hackmd.io/_uploads/BkGls9hS6.png)
> cat hint.txt

![image](https://hackmd.io/_uploads/HJBWi9hrp.png)
image: 600 x 408

> sudo apt install graphicsmagick-imagemagick-compat
> convert finalflag.png -resize 600*408

![image](https://hackmd.io/_uploads/ryYDa5hBp.png)
> binwalk -e --size=600*408 finalflag.png

(都無解)

●010editor全新的十六進制編輯器: https://www.sweetscape.com/010editor/
![image](https://hackmd.io/_uploads/HJUYTnTS6.png)

![image](https://hackmd.io/_uploads/SybwChpB6.png)
(Ref: [Not able to read IHDR chunk of a PNG file](https://stackoverflow.com/questions/54845745/not-able-to-read-ihdr-chunk-of-a-png-file))

![image](https://hackmd.io/_uploads/HkVC0hTra.png)
更改00 00 02 00 00 00 01 98 (Weight & Height)
![image](https://hackmd.io/_uploads/rkTPzapST.png)
> 00 00 02 58 00 00 01 98

![image](https://hackmd.io/_uploads/Bktiz6aBp.png)


> **NISRA{B1nw4LK_3XTR4cTIn9_IMAge5}**

## Misc: RGB?Pixel? Topic
![image](https://hackmd.io/_uploads/S140xihBa.png)

### Misc: RGB?Pixel? Solution
> binwalk finalfalg.png

# OS

## OS: Linux Topic
![image](https://hackmd.io/_uploads/B1SUHcnHT.png)

![image](https://hackmd.io/_uploads/HJycB9nBa.png)

### OS: Linux Solution
> chmod 777 CTF/
> ls

![image](https://hackmd.io/_uploads/Bk33r9hr6.png)
> cat flag.txt
> Permission denied

![image](https://hackmd.io/_uploads/BkGkLqhBT.png)
> ls -al
> chmod 777 flag.txt
> Operation not permitted

![image](https://hackmd.io/_uploads/BkaXLc3Ba.png)
> sudo cat flag.txt

> **Flag: NISRA{Th1s_1s_fiNaL_CTF_flAG}**

# Python

## Python: Python Topic
![image](https://hackmd.io/_uploads/B119i3hHT.png)
main.py
```python=
class Test():
	def __init__(self, email='test@nisra.net'):
		self.info = 'test'
		self.email = email

class Secret():
	flag = open("flag.txt", "r").read().strip()


if __name__ == '__main__':
	email = input('Your email: ')

	if email:
		test = Test(email)
	else:
		test = Test()

	msg = ('this is for {test.info}, please contact ' + email + '.').format(test=test)

	print(msg)
```

### Python: Python Solution

# C magic

## C magic: enter username Topic
![image](https://hackmd.io/_uploads/rJPYgATr6.png)

enterusername.c
```c=
#include <stdio.h>
#include <string.h>
int main()
{
    int pass = 0;
    char pw[5];
    char user[5];

    printf("Enter the username:\n");
    gets(user);

    if (strncmp(user, "NISRA", 5) == 0)
    {
        if (strncmp(pw, "12345", 5) == 0)
        {
            printf("Hello NISRA\n");
            if (pass != 0)
            {
                printf("You are root now.\n");
            }
        }
        else
            printf("You did not enter password or password is wrong .\n");
    }
    else
        printf("You are not user.\n");

    return 0;
}
```

### C magic: enter username Solution
> nc chall2.nisra.net 44006

![image](https://hackmd.io/_uploads/H1Jg-0pBp.png)

![image](https://hackmd.io/_uploads/r1kMbA6Ba.png)    

## C magic: Cmagic_integer_overflow Topic

### C magic: Cmagic_integer_overflow Solution