# MISC | UDOM X-MASS CTF 2025

Hello everyone, hope this finds you well …
This is a writeup for all the MISC challenges that were crafted by author dr3amy in the UDOM X-MASS CTF 2025.

## 1.FIX THE CODE

The description of this challenge as you see tells you that the best decision is to run the given file first.
And in the attachments, a python file was given, so one had to download it first and then try to run it.
On running it, we were given three choices but the second option to print the flag, looks more like what we need.
On choosing the second option to print the flag, we get a message that the print_flag function is misplaced and we had to go check the source code.
Looking at the code, the issue is that when I select option 'b' to print the flag, it doesn't actually call the `print_flag()` function. Instead, it just prints a message saying "Oops! I must have misplaced the print_flag function!"
So I had to fix the code as seen here.

On running the python file again, i get an encoded flag as seen below.

I had to go to dcode.fr to try check on cipher identifier what kind of encoding this is.

It revealled that it was a ROT8000 Cipher, after knowing this i directly went to cyberchef to try decode it.

After just trying ROT8000 once it then changed to a base64 as seen below.

After directly decoding it again from base64 7times it revealled the intended flag to solve this challenge once and for all.

## 2.EAGLE

The description of this challenge wanted us to carefully review the file given and spot any anomalies

Opening the file there were bunch of hexadecemimal-encoded binary log entries likely from a windows system as seen above.

Then I tried to grep the UCC word to check for the flag directly.

I found a fake flag by doing that, this is when I knew this is going to be a long night hahaha, so i had to go and manually check for anything suspicious in the logs.
That's when i found something a bit interesting as seen below.

Looks like a flag but encoded, so i had to go use dcode.fr to check which kind of encoding this is.

After knowing it's ROT Cipher, i then went to cyberchef to try bruteforce the present ROT ciphers.

I found something that looks exactly like the true flag, but when I tried submitting it, fails.
I had to scratch my head and see what I was missing, that's when I remembered there was a hint so I went back to check it.

The hint said I had to try tweak the defaults, and checking ROT13 Bruteforce, by default there is one checkbox to rotate the numbers is always unchecked.
So i tried to check the box and what's funny is, number 9s showed up like rotated small letter "e" all over to make the sentence readable, after that I just tried submitting the flag and it was the one.

## 3.CRTA
The description of this challenge, was talking about a classic privilege escalation technique using the `vi` text editor.

I went to GTFOBins and searched for vi and started reading, that's when I came across this.

Exactly what then description needed, but the hint said "i hate spaces" so on submitting the flag I had to replace all spaces with "_" as per CTFs replacement for spaces and it worked.

## 4.FOR FIRST YEAR

For this challenge, I was given a simple.docx as an attachment and the description said that the first part of the flag was in it.
This was simple, just changing color of the texts to white and I could easily see the flag.

The second part of the flag, asked in one word what do we call the exposure of hidden system instructions.
I did a simple google search and found that it was leakage.

I tried submitting it, but it failed that's when I read and it specified the case sensitivity so i started trying all small letters and then all capital letters for the second part of the flag and I was able to solve it.

## 5. FOR YOU

In this challenge, I was given a hash and asked to retrieve the flag
I simply used crackstation online tool to crack this hash as seen below.
The cracked password was `heyo`, I tried submitting it with the flag format and it succeeded.

## 6. JWT

The challenge wanted a common header used to transport the JWT in a request.
I did a simple google search and found out.

On submitting it as per the given format, it succeeded.

## 7. L33T
This challenge just wanted me to go find the flag from the social media handles of UCC.
I went on instagram and came across a post with a comment that looks like a flag.

I tried submitting it but it failed, that's when I had to go back and read the hint.
The hint told me to join hands, and something clicked in my mind that maybe this flag is not complete.
I went on Linkedin and came across a post with a comment that looked like a second part of the flag and with confidence the same person who commented on Instagram.

I tried joining the two parts of the flag and on submitting using the flag format, it succeeded.

## 8.LEMONS

The description asked if i love fruits, then give me an encoded message.
I tried checking the hint.

After seeing that hint, I tried thinking what really links fruits specifically lemons and biology as a subject.

On doing a simple google search, I found these out.
The linkage is through botany, and specific classification called Citrus and limon
Okay, this is a good start....
Now i tried to find a decoding tool in Cyberchef with a name almost as my two classifying words.
That's when I came across Citrix in cyberchef.
I tried to decode the given text from the challenge and I was able to get the flag right away as seen below.

## 9. MATUNDA
This challenge wanted me to crack, Dr3amy's password by creating a custom wordlist filled with several fruits.
So i designed a python bruteforce script that would go through all the custom wordlist of fruits that i made, then do a hash analysis and then sets a password structure of three fruit names concatenated together.

And on running it, I found the password

I tried putting it in a required flag format and it succeeded.
The whole point here was to create a custom wordlist of fruits or find online, any wordlist with fruits only so as to save time while bruteforcing.

## 10.MUSIC

On opening the attachment, I found some lyrics.

I tried searching online and found a very common tool to interpret these kind of esoteric programming language, this tool is called Rockstar

I then uploaded my lyrics and got some ASCII values.

I finally crafted a python script for decoding the ASCII values.

On running the script, i got readable characters that look like the flag.

The flag format wanted me to specify the name of the tool used to do this which was Rockstar.

## 11.MORE PAIN

In this challenge, I was given a hash of a malicious file, and had to find more information about it.
Our go to tool for this challenge is VirusTotal so I went into the tool and plugged in the hash to get information.

From the description, we were told that the file makes a shell command with a URL inside of it.
On checking the behavior part in virustotal, I found a http request with the URL we need.

From the flag format, they needed the file.extension then the domain url.
UCC{s.png_ttgholidays.com}

## 12.MORE PAIN 2

From the description, the question asked what country are the attackers likely from.

So I just did a simple google search of the domain