# Kashi CTF 2025 writeup

[TOC]



# crypto

## Lost Frequencies
Use [this site](https://www.dcode.fr/morse-code) to decode the morse and get this

the flag is

## MMDLX
From the key word 'Romans' I think that it's a caesar cipher, and the == at the and that me think that it is a base64.

After trying part of the cipher a found that **shift three** alphabet's cipher can base64 and still be something similar

So I write a python code

import base64

f=open("./cipher",'r')
cipher=f.read()
f.close()
# print(cipher)
for i in range(2560):
    cipher=base64.b64decode(cipher).decode('UTF-8')
    print(i+1,cipher)

I get the flag when it base64 decode 40 times

40 KashiCTF{w31rd_numb3r5_4nd_c1ph3r5}

# osint

## Who am I ??

Q:
You've stumbled upon a bustling street with political posters. 
Find out after which politician this road is named.

I search for the **Duna house**, there are many result in Budapest
One of the location seems to be the answer
I search for **Bajcsy-Zsilinszky**, and pop out a man names **Endre Bajcsy-Zsilinszky**
The flag is

# forensics

## Look at Me

![image](https://hackmd.io/_uploads/B1lqZOvc1x.png)
there is an app called **SilentEye** which can decode message from picture
![image](https://hackmd.io/_uploads/rywxzODckl.png)
I pressed decode and get
![image](https://hackmd.io/_uploads/HkLu-_P51g.png)
the flag is 

## Restaurant
I found this at the end of the png file
It is a Bacon cipher, and the flag is

# misc

## Easy Jail
use this to get shell

__import__("os").system("sh")

and then

cd ../
cat flag.txt

the flag is 

## Easy Jail 2

I use [this site](https://lingojam.com/ItalicTextGenerator) to change import to italic text and pypass the blacklist

my pyload:
__𝘪𝘮𝘱𝘰𝘳𝘵__("os").system("\163\150")

__𝘪𝘮𝘱𝘰𝘳𝘵__ is Italic text
\163\150 is 'sh' in octal

then I get the shell

cd ../
cat flag.txt

the flag is

# rev

## Game 1 - Untitled Game

I use this to find the flag info and get

The flag is

## Game 2 Wait
The exe need me to wait for 48 hr and can get the flag, so I change my computer's time to 1 week later and I get the flag
![image](https://hackmd.io/_uploads/HyVGKjdqJe.png)

# web

## SuperFastAPI
dirsearch the url and get this
get in the /docs and creat user bbb

update the user role to **admin**
use /flag/{username} to get the flag