TUCTF 2024 writeup
===
[TOC]
>My score and place:
>I just solved a few challenge, but I enjoyed! +_+
>
## My First Secret(Web)
There is a page for log in, and I use SQL injection **admin' or 1=1- -** to bypass,and get a picture(left).
After decrypt the **Steel alphabet**,I get the flag.
```TUCTF{THERE_IS_ALWAYS_ANOTHER_SECRET}```
## Mystery Box(RE)
Use IDA to get the code,and I found a **ReverseMe** in there.
In put secret code and get the flag.
## My First Encryption(Crypto)
After matching the file signature,I found out that need to XOR the flag with **0x30**
```
key =0x30
fin = open("./flag.jpeg", 'rb')
# storing image data in variable "image"
image = fin.read()
fin.close()
# converting image into byte array to
# perform encryption easily on numeric data
image = bytearray(image)
# performing XOR operation on each value of bytearray
for index, values in enumerate(image):
image[index] = values ^ key
# opening file for writing purpose
fin = open("./real.jpeg", 'wb')
# writing encrypted data in image
fin.write(image)
fin.close()
print('Encryption Done...')
```
>So I get the picture with flag
```TUCTF{kn0wn_pl@1nt3xt_15_dang3r0us}```
## Packet Detective(Forensics)
>After finding the package, I found the flag at the last package.
```Text: TUCTF{N3tw0rk_M4st3r}```
## Mystery Presentation(Forensics)
After seeing the file signature, I changing the file name from **quantum_propulsion_via_dank_memes.pptx** into **quantum_propulsion_via_dank_memes.zip** and get a **secret data** that have **flag.txt**
```TUCTF{p01yg10+_fi1e5_hiddin9_in_p1@in_5i9h+} ```
## Simpler Cipher (Crypto)
If I get the key, I can decrypt the flag, because we have the encrypted flag.
From the code, we know that it will **take 6 char(48bytes) and xor with key**, and put it in the special function called expand.
If I know the xor result and plaintext, I can get the key, and the first 6 plaintext is **TUCTF{**.
Unfortunately,It used the expand function to change the result.
We didn't have the **exptables**,which is an array 4*4.
I **input 6 char as plaintext and key=000000000000** the output will be the 6char to expand function.
I can get the **6 char's binary and compare it with expand function's output**.After that,I make the table of the exptables
```
Get the first 6 char
flag result:
111100 010001 010001 101000 000101 110001 010001 100001 100001 100001 000101 101010...
flag result: (real xor result)
1100 0100 0100 1000 0101 1101 0100 0110 0110 0110 0101 1111
```
The last step,xor the flag binary and the real xor result,that is the key.
---
---
Use the key to decrypt and get the flag
```TUCTF{tr@ck_th3_exp@nsi0ns_and_r3v3rs3}```
## XOR-Dinary(Crypto)
```
def xor_decrypt(hex_string):
hex_bytes = bytes.fromhex(hex_string)
possible_plaintexts = []
for key in range(256):
decoded_chars = [chr(byte ^ key) for byte in hex_bytes]
plaintext = ''.join(decoded_chars)
possible_plaintexts.append((key, plaintext))
return possible_plaintexts
hex_string = '4e4f594e5c617763457c2e6c2a282b2d29456d2a287e452b2f45772a2b2f2d67 '
decoded_strings = xor_decrypt(hex_string)
for key, plaintext in decoded_strings:
print(f'Key: {key} -> {plaintext}')
```
```
key=26
TUCTF{my_f4v02173_w02d_15_m0157}
```
## Shopping Time(Web)
We just need to match the **first 6 md5 hash value** as the Flag's hash, and we can get the flag.
```
# The code is from https://www.dr0n.top/posts/ad669f62/
import multiprocessing
import hashlib
import random
import string
import sys
CHARS = string.letters + string.digits
def cmp_md5(substr, stop_event, str_len, start=0, size=20):
global CHARS
while not stop_event.is_set():
rnds = ''.join(random.choice(CHARS) for _ in range(size))
md5 = hashlib.md5(rnds)
if md5.hexdigest()[start: start+str_len] == substr:
print(rnds)
stop_event.set()
if __name__ == '__main__':
substr = sys.argv[1].strip()
start_pos = int(sys.argv[2]) if len(sys.argv) > 1 else 0
str_len = len(substr)
cpus = multiprocessing.cpu_count()
stop_event = multiprocessing.Event()
processes = [multiprocessing.Process(target=cmp_md5, args=(substr,
stop_event, str_len, start_pos))
for i in range(cpus)]
for p in processes:
p.start()
for p in processes:
p.join()
```
**0XF8xp81lHI09LNTt61y** this value match the value of **Flag**
```TUCTF{k1nd_0f_an_1d0r_vu1n!}```
## Techno Oracle(Web)
I use burpsuite to catch package and change my command **s** to flag,and I got this.
I don't know is there any relationship between burpsuite.
```TUCTF{5P00ky_0r4CL3}```
Sign in with Wallet
Connect another wallet