---
# System prepended metadata

title: picoCTF 2019 Writeup
tags: [CTF, picoCTF]

---

# picoCTF 2019 Writeup
The CTF challenges writeup for picoCTF 2019.


# General Skills

## 2Warm <span style="color: green;"> [Easy] </span>

### Challenge description
Can you convert the number 42 (base 10) to binary (base 2)?

### Solution
用線上工具或在 command line 使用 `bc` 都能將十進制數字轉成二進制：

```bash
$ echo "obase=2; 42" | bc
```

### Resource

[Decimal to Binary converter](https://www.rapidtables.com/convert/number/decimal-to-binary.html?x=44)

### Summary
Flag: `picoCTF{101010}`


## First Grep <span style="color: green;"> [Easy] </span>

### Challenge description
Can you find the flag in [file](https://jupiter.challenges.picoctf.org/static/495d43ee4a2b9f345a4307d053b4d88d/file)? This would be really tedious to look through manually, something tells me there is a better way.

### Solution
將檔案下載下來後，用 grep 搜索帶有 pico 的字串就能找到 flag 了。

```bash
$ cat file | grep pico
picoCTF{grep_is_good_to_find_things_xxxxxxxx}
```

### Summary
Flag: `picoCTF{grep_is_good_to_find_things_xxxxxxxx}`


## Bases <span style="color: green;"> [Easy] </span>

### Challenge description
What does this `bDNhcm5fdGgzX3IwcDM1` mean? I think it has something to do with bases.

### Solution
題目給的字串看起來像是用 base64 編碼過，所以我們可以用 `base64` 指令將其轉換回去：

```bash
$ echo bDNhcm5fdGgzX3IwcDM1 | base64 -d
```

### Summary
Flag: `picoCTF{l3arn_th3_rop35}`


## Warmed Up <span style="color: green;"> [Easy] </span>

### Challenge description
What is 0x3D (base 16) in decimal (base 10)?

### Solution
跟前面 2Warm 那題一樣，可以上網找轉換網站或用 `bc` 解決：

```bash
$ echo "ibase=16; 3D" | bc
```

### Resource
[Hexadecimal to Decimal converter](https://www.rapidtables.com/convert/number/hex-to-decimal.html)

### Summary
Flag: `picoCTF{61}`


## strings it <span style="color: green;"> [Easy] </span>

### Challenge description
Can you find the flag in [file](https://jupiter.challenges.picoctf.org/static/5bd86036f013ac3b9c958499adf3e2e2/strings) without running it?

### Solution
`strings` 能將非文字檔裡的可列印字元找出來，我們可以用這個指令搭配 `grep` 在題目提供的可執行檔中搜尋 flag。

```bash
$ strings strings | grep pico
```

### Summary
Flag: `picoCTF{5tRIng5_1T_xxxxxxxx}`


## what's a net cat? <span style="color: green;"> [Easy] </span>

### Challenge description
Using netcat (nc) is going to be pretty important. Can you connect to `jupiter.challenges.picoctf.org` at port `64287` to get the flag?

### Solution
從題目的描述我們可以知道需要用 `nc` 連上題目提供的 server：

```bash
$ nc jupiter.challenges.picoctf.org 64287
```

連上後就會看到 server 回傳的 flag 了。

### Summary
Flag: `picoCTF{nEtCat_Mast3ry_xxxxxxxx}`


## Lets Warm Up <span style="color: green;"> [Easy] </span>

### Challenge description
If I told you a word started with 0x70 in hexadecimal, what would it start with in ASCII?

### Solution
找線上網站或使用 `xxd` 就能對 hex 進行轉換：

```bash
$ echo 0x70 | xxd -p -r
```

### Resource
[Hex to ASCII Text String Converter](https://www.rapidtables.com/convert/number/hex-to-ascii.html)

### Summary
Flag: `picoCTF{p}`


## mus1c <span style="color: orange;"> [Medium] </span>

### Challenge description
I wrote you a [song](https://jupiter.challenges.picoctf.org/static/c594d8d915de0129d92b4c41e25a2313/lyrics.txt). Put it in the picoCTF{} flag format.

### Solution
查看提示和題目提供的檔案並搜尋後，可以得出檔案內容為用一種叫做 rockstar 的程式語言編寫的。它的官網提供讓我們執行程式的地方：

![image](https://hackmd.io/_uploads/ry9U49j9C.png)


將檔案中的程式丟上去執行後會拿到一串數字，看起來像是 ascii 對應的數字，因此我們可以用 python 將其轉換回去來拿到 flag：

```python
flag_list = [114, 114, 114, 111, 99, 107, 110, 114, 110, 48, 49, 49, 51, 114]
flag = "".join([chr(x) for x in flag_list])
print(flag)
```

### Resource
[Rockstar: Try it](https://codewithrockstar.com/online)

### Summary
Flag: `picoCTF{rrrocknrn0113r}`


## 1_wanna_b3_a_r0ck5tar <span style="color: orange;"> [Medium] </span>

### Challenge description
> The Rockstar language has changed since this problem was released! Use this Wayback Machine URL to use an older version of Rockstar, [here](https://web.archive.org/web/20190522020843/https://codewithrockstar.com/online).

I wrote you another [song](https://jupiter.challenges.picoctf.org/static/b99c57e4274172bf3c93534b6d59632d/lyrics.txt). Put the flag in the picoCTF{} flag format

### Solution
跟上題一樣，這題也是跟 rockstar 有關的題目，而打開檔案後可以看到程式中看起來有幾個邏輯判斷的地方：

```
A guitar is a six-string
Tommy's been down
Music is a billboard-burning razzmatazz!
Listen to the music
If the music is a guitar
Say "Keep on rocking!"
```

這邊的程式會將 `A guitar` 宣告為 10 (six-string 長度為 10)，接收使用者輸入並存放到 `music`，然後比對 `music` 是否等於 `A guitar`。如果這邊不相等的話程式就結束了，因此我們需要通過這個條件判斷式：

```
If 1
Say "Keep on rocking!"
```

我們可以直接將條件判斷式的條件改為 true 來跳過驗證，接著程式就會到達下面的另一個判斷：

```
Listen to the rhythm
If the rhythm without Music is nothing
Tommy is rockin guitar
Shout Tommy!
...
Else Whisper "That ain't it, Chief"
Break it down
```

這裡會將 `rhythm` 與 `Music` 相減去比對是否等於 0，但我們一樣可以直接將判斷式的條件改為 1 去通過，接著執行程式就能跟上一題一樣拿到一串 flag 的 ascii 數字：

```python
flag_list = [66, 79, 78, 74, 79, 86, 73]
flag = "".join([chr(x) for x in flag_list])
print(flag)
```

用一樣的方式轉換回去就能拿到 flag 了。

### Summary
Flag: `picoCTF{BONJOVI}`


## flag_shop <span style="color: orange;"> [Medium] </span>

### Challenge description
There's a flag shop selling stuff, can you buy a flag? [Source](https://jupiter.challenges.picoctf.org/static/64e724ad327f83ad833d9c6baa072b1f/store.c). Connect with `nc jupiter.challenges.picoctf.org 4906`.

### Solution
連接上 server 之後能看到：

```
Welcome to the flag exchange
We sell flags

1. Check Account Balance

2. Buy Flags

3. Exit

 Enter a menu selection
```

而在購買 flag 的部分，有兩種選項：

```
Currently for sale
1. Defintely not the flag Flag
2. 1337 Flag
```

接著查看提供的原始碼後我們可以知道，選項 `2. 1337 Flag` 可以拿到我們要的 flag，但是必須要有 100000 才能購買，而我們一開始只有 1100：

```C
int account_balance = 1100;
```

```C
else if(auction_choice == 2){
    printf("1337 flags cost 100000 dollars, and we only have 1 in stock\n");
    printf("Enter 1 to buy one");
    int bid = 0;
    fflush(stdin);
    scanf("%d", &bid);
                
    if(bid == 1){
                    
        if(account_balance > 100000){
            FILE *f = fopen("flag.txt", "r");
            if(f == NULL){

                printf("flag not found: please run this on the server\n");
                exit(0);
            }
            char buf[64];
            fgets(buf, 63, f);
            printf("YOUR FLAG IS: %s\n", buf);
        }
                    
        else{
            printf("\nNot enough funds for transaction\n\n\n");
        }}

}
```

這邊的程式看起來沒有甚麼比較顯眼的突破點，我們可以去看看購買另一種 flag 的部分：

```C
if(auction_choice == 1){
    printf("These knockoff Flags cost 900 each, enter desired quantity\n");
                
    int number_flags = 0;
    fflush(stdin);
    scanf("%d", &number_flags);
    if(number_flags > 0){
        int total_cost = 0;
        total_cost = 900*number_flags;
        printf("\nThe final cost is: %d\n", total_cost);
        if(total_cost <= account_balance){
            account_balance = account_balance - total_cost;
            printf("\nYour current balance after transaction: %d\n\n", account_balance);
        }
        else{
            printf("Not enough funds to complete purchase\n");
        }
                                    
                    
    }
                    
                    
                    
                
}
```

這邊允許我們輸入任意正數來購買對應數量的 flag，然後將輸入的數量乘以金額 900 後存放在變數 `total_cost` 裡，此時如果我們擁有的金錢 `account_balance` 大於購買金額 `total_cost`，就會將我們的錢減掉購買金額重新更新我們的餘額。

因為 `total_cost` 宣告的類型 `int` 的範圍是從 2147483647 ~ -2147483648，在有符號的情況下，如果將 2147483647 + 1 就會造成 overflow 並且變成負數，因此我們可以透過這個方式去控制 `total_cost` 讓它變成負數來增加我們的帳戶金額。

簡單計算一下：

```
2386095 * 900 -> -2147481796 (overflow)
1100 - (-2147481796) -> 2147482896
```

因此我們只要連上 server，選擇 `Buy Flags > Defintely not the flag Flag` 輸入 2386095 就可以拿到大於 100000 的金額，接著再去 `Buy Flags > 1337 Flag` 就能拿到我們要的 flag 了。

### Summary
Flag: `picoCTF{m0n3y_bag5_xxxxxxxx}`


## plumbing <span style="color: orange;"> [Medium] </span>

### Challenge description
Sometimes you need to handle process data outside of a file. Can you find a way to keep the output from this program and search for the flag? Connect to `jupiter.challenges.picoctf.org 7480`.

### Solution
使用 `nc` 連上 server 之後可以看到 server 回傳了很多的訊息，而從題目的 Hint 可以得知這題考的是 piping，所以我們可以用 pipe 把從 `nc` 得到的資料丟給 `grep` 處理：

```bash
$ nc jupiter.challenges.picoctf.org 7480 | grep pico
```

然後就可以從 server 回傳的內容中找到 flag 了。

### Summary
Flag: `picoCTF{digital_plumb3r_xxxxxxxx}`


## Based <span style="color: orange;"> [Medium] </span>

### Challenge description
To get truly 1337, you must understand different data encodings, such as hexadecimal or binary. Can you get the flag from this program to prove you are on the way to becoming 1337? Connect with `nc jupiter.challenges.picoctf.org 29221`.

### Solution
連上 server 後會發現 server 會給不同進制的數字，而我們需要將它轉回 ascii 文字然後送回去。我們可以透過網站或是 python 來幫我們轉換，而下面是 python 轉換的示例：

```python
chr(int(number_in_string, base))
# chr(int("01100110", 2))
# chr(int("141", 8))
# chr(int("74", 16))
```

```python
number_str = [] # put the numbers provided by server here
print("".join([chr(int(x, base)) for x in number_str]))
```

用這個方法就能將題目提供的數字轉回 ascii 單字，而連續答完三題就能拿到 flag 了。

### Summary
Flag: `picoCTF{learning_about_converting_values_xxxxxxxx}`


# Web Exploitation

## dont-use-client-side <span style="color: green;"> [Easy] </span>

### Challenge description
Can you break into this super secure portal? `https://jupiter.challenges.picoctf.org/problem/37821/` ([link](https://jupiter.challenges.picoctf.org/problem/37821/)) or http://jupiter.challenges.picoctf.org:37821

### Solution
進入網頁後，會看到一個要求輸入有效的憑證的表單：

![image](https://hackmd.io/_uploads/SkbBtcsqA.png)

而在網頁上點擊右鍵選擇 inspector (檢查) 並查看原始碼後會看到，它的驗證方式就寫在前端的 `<script>` 裡：

```html
<script type="text/javascript">
  function verify() {
    checkpass = document.getElementById("pass").value;
    split = 4;
    if (checkpass.substring(0, split) == 'pico') {
      if (checkpass.substring(split*6, split*7) == 'a3c8') {
        if (checkpass.substring(split, split*2) == 'CTF{') {
         if (checkpass.substring(split*4, split*5) == 'ts_p') {
          if (checkpass.substring(split*3, split*4) == 'lien') {
            if (checkpass.substring(split*5, split*6) == 'lz_1') {
              if (checkpass.substring(split*2, split*3) == 'no_c') {
                if (checkpass.substring(split*7, split*8) == '9}') {
                  alert("Password Verified")
                  }
                }
              }
      
            }
          }
        }
      }
    }
    else {
      alert("Incorrect password");
    }
    
  }
</script>
```

看起來網站要求的 credential 就是我們的 flag，因此我們只要按照 substring 的順序把 flag 的片段組在一起就能拿到 flag 了。

### Summary
Flag: `picoCTF{no_clients_plz_xxxxxx}`


## logon <span style="color: green;"> [Easy] </span>

### Challenge description
The factory is hiding things from all of its users. Can you login as Joe and find what they've been looking at? `https://jupiter.challenges.picoctf.org/problem/13594/` ([link](https://jupiter.challenges.picoctf.org/problem/13594/)) or http://jupiter.challenges.picoctf.org:13594

### Solution
進入網站後，可以看到一個登入介面：
![image](https://hackmd.io/_uploads/SyOb1ojcA.png)

題目讓我們以 Joe 的身分登入，而我們並沒有 Joe 的密碼。
但如果我們輸入隨便一組使用者名稱和密碼，會發現可以成功登入，從題目的提示中可以知道，這個網站不會驗證除了 Joe 以外其他 user 的密碼，所以我們可以嘗試用其他的 user 來找突破點。

先以隨便一組帳號密碼 (username: a, password: a) 登入，接著在觀察的過程中會發現 cookie 的欄位中有幾個看起來比較特別的：

| Name     | Value    | 
| -------- | -------- | 
| username | a        |
| password | a        |
| admin    | False    |

網站把身分驗證完之後的資訊存放在了 cookie，看起來可以改動它們來變更我們的身分。

而嘗試後會發現將 `admin` 改為 True 並重整網頁之後就能看到 flag 了：

![image](https://hackmd.io/_uploads/S1AmkoscR.png)

### Summary
Flag: `picoCTF{th3_c0nsp1r4cy_l1v3s_xxxxxxxx}`


## Insp3ct0r <span style="color: green;"> [Easy] </span>

### Challenge description
Kishor Balan tipped us off that the following code may need inspection: `https://jupiter.challenges.picoctf.org/problem/41511/` ([link](https://jupiter.challenges.picoctf.org/problem/41511/)) or http://jupiter.challenges.picoctf.org:41511

### Solution
題目的名稱提示了 inspector 似乎可以幫助我們解題，我們可以對網站點擊右鍵選擇檢查來打開 inspector，然後切換到 Sources 分頁以查看網頁原始碼。

可以看到在 `problem/41511` 底下有三個檔案，而打開第一個 `41511/` 之後會發現檔案裡面的註解有第一部份的 flag：

```html
<!-- Html is neat. Anyways have 1/3 of the flag: picoCTF{tru3_d3 -->
```

接著查看 `mycss.css`：

```css
/* You need CSS to make pretty pages. Here's part 2/3 of the flag: t3ct1ve_0r_ju5t */
```

還差一個部分的 flag，所以打開 `myjs.js` 查看相關內容：

```javascript
/* Javascript sure is neat. Anyways part 3/3 of the flag: _lucky?xxxxxxxx} */
```

將得到的 flag 片段組合在一起就是我們要的 flag 了。


### Summary
Flag: `picoCTF{tru3_d3t3ct1ve_0r_ju5t_lucky?xxxxxxxx}`


## where are the robots <span style="color: green;"> [Easy] </span>

### Challenge description
Can you find the robots? `https://jupiter.challenges.picoctf.org/problem/36474/` ([link](https://jupiter.challenges.picoctf.org/problem/36474/)) or http://jupiter.challenges.picoctf.org:36474

### Solution
打開網站後，可以看到它詢問我們 `Where are the robots?`，應該是讓我們去查看 `robots.txt`，因此我們可以前往對應的連結查看相關資訊：

```
https://jupiter.challenges.picoctf.org/problem/36474/robots.txt
```

網站回應：

```
User-agent: *
Disallow: /477ce.html
```

`robots.txt` 會定義允許/不允許 search engine crawlers 訪問的網站，有時候我們可以透過 `robots.txt` 來知道網站試圖隱藏哪些檔案，來找到敏感資訊。

可以看到，有一個被禁止的檔案 `/477ce.html`，而如果我們嘗試訪問對應的頁面，就會發現 flag 就藏在這裡。

```
https://jupiter.challenges.picoctf.org/problem/36474/477ce.html
```

### Resource
[維基百科 - robots.txt](https://zh.wikipedia.org/zh-tw/Robots.txt)

### Summary
Flag: `picoCTF{ca1cu1at1ng_Mach1n3s_xxxxx}`


## Irish-Name-Repo 1 <span style="color: orange;"> [Medium] </span>

### Challenge description
There is a website running at `https://jupiter.challenges.picoctf.org/problem/33850/` ([link](https://jupiter.challenges.picoctf.org/problem/33850/)) or http://jupiter.challenges.picoctf.org:33850. Do you think you can log us in? Try to see if you can login!

### Solution
打開網站後，會發現首頁放了好幾個人的照片與他們對應的資訊，似乎沒什麼特別的。

而左上角有一個 menu icon，點擊後可以發現這個網站還有 Support 和 Admin Login 兩個頁面能夠訪問。題目的描述有提到讓我們嘗試登入，因此 Admin Login 應該是我們的突破點：

![image](https://hackmd.io/_uploads/BJ1Q4ooqA.png)

此時打開 inspector 檢查的話可以看到一個隱藏起來的 debug 欄位：

```html
 <input type="hidden" name="debug" value="0">
```

將 debug 的 value 改為 1 並且使用隨便一組帳號密碼登入後，會發現我們可以看到背後使用的 SQL 語句：

```
username: 1
password: 1
SQL query: SELECT * FROM users WHERE name='1' AND password='1'
```

因此我們可以嘗試進行 SQL injection：

```
username: admin' -- 
password: 1
SQL query: SELECT * FROM users WHERE name='admin' -- ' AND password='1'
```

登入成功後就可以看到 flag 了。

### Summary
Flag: ` picoCTF{s0m3_SQL_xxxxxxxx}`


## Irish-Name-Repo 2 <span style="color: orange;"> [Medium] </span>

### Challenge description
There is a website running at `https://jupiter.challenges.picoctf.org/problem/64649/` ([link](https://jupiter.challenges.picoctf.org/problem/64649/)). Someone has bypassed the login before, and now it's being strengthened. Try to see if you can still login! or http://jupiter.challenges.picoctf.org:64649

### Solution
從題目跟題目的提示可以知道，這題一樣是要嘗試能不能用 SQL injection 登入網站，並且這次在 password field 多了 filter，會檢查 password 的輸入。

因此我們一樣可以跟上一題用同樣的方法，因為我們的 payload 是針對 username field 的：

```
username: admin' -- 
password: 1
SQL query: SELECT * FROM users WHERE name='admin' -- ' AND password='1'
```

接著登入後就能看到 flag 了。

### Summary
Flag: `picoCTF{m0R3_SQL_plz_xxxxxxxx}`


## Irish-Name-Repo 3 <span style="color: orange;"> [Medium] </span>

### Challenge description
There is a website running at `https://jupiter.challenges.picoctf.org/problem/64649/` ([link](https://jupiter.challenges.picoctf.org/problem/64649/)). Someone has bypassed the login before, and now it's being strengthened. Try to see if you can still login! or http://jupiter.challenges.picoctf.org:64649

### Solution
打開 Admin Login 的頁面後，可以看到這次只剩下 password 的欄位，並且嘗試登入會發現我們的輸入似乎會被進行 rot13 加密：

```
password: abc
SQL query: SELECT * FROM admin where password = 'nop'
```

因此如果我們要讓語句成立，我們可以輸入：

```
password: ' be 1=1 -- 
SQL query: SELECT * FROM admin where password = '' or 1=1 -- '
```

然後就可以拿到 flag 了。

### Summary
Flag: `picoCTF{3v3n_m0r3_SQL_xxxxxxxx}`


## Client-side-again <span style="color: orange;"> [Medium] </span>

### Challenge description
Can you break into this super secure portal? `https://jupiter.challenges.picoctf.org/problem/56816/` ([link](https://jupiter.challenges.picoctf.org/problem/56816/)) or http://jupiter.challenges.picoctf.org:56816

### Solution
跟前面的 dont-use-client-side 那題一樣，一進入網頁之後可以看到一個登入頁面：

![image](https://hackmd.io/_uploads/SkLuBiiqA.png)

打開原始碼來檢查後會發現一些比較特別的地方，看起來是經過混淆：

```html
<script type="text/javascript">
    var _0x5a46 = ['37115}', '_again_3', 'this', 'Password\x20Verified', 'Incorrect\x20password', 'getElementById', 'value', 'substring', 'picoCTF{', 'not_this'];
    (function(_0x4bd822, _0x2bd6f7) {
        var _0xb4bdb3 = function(_0x1d68f6) {
            while (--_0x1d68f6) {
                _0x4bd822['push'](_0x4bd822['shift']());
            }
        };
        _0xb4bdb3(++_0x2bd6f7);
    }(_0x5a46, 0x1b3));
    var _0x4b5b = function(_0x2d8f05, _0x4b81bb) {
        _0x2d8f05 = _0x2d8f05 - 0x0;
        var _0x4d74cb = _0x5a46[_0x2d8f05];
        return _0x4d74cb;
    };
    function verify() {
        checkpass = document[_0x4b5b('0x0')]('pass')[_0x4b5b('0x1')];
        split = 0x4;
        if (checkpass[_0x4b5b('0x2')](0x0, split * 0x2) == _0x4b5b('0x3')) {
            if (checkpass[_0x4b5b('0x2')](0x7, 0x9) == '{n') {
                if (checkpass[_0x4b5b('0x2')](split * 0x2, split * 0x2 * 0x2) == _0x4b5b('0x4')) {
                    if (checkpass[_0x4b5b('0x2')](0x3, 0x6) == 'oCT') {
                        if (checkpass[_0x4b5b('0x2')](split * 0x3 * 0x2, split * 0x4 * 0x2) == _0x4b5b('0x5')) {
                            if (checkpass['substring'](0x6, 0xb) == 'F{not') {
                                if (checkpass[_0x4b5b('0x2')](split * 0x2 * 0x2, split * 0x3 * 0x2) == _0x4b5b('0x6')) {
                                    if (checkpass[_0x4b5b('0x2')](0xc, 0x10) == _0x4b5b('0x7')) {
                                        alert(_0x4b5b('0x8'));
                                    }
                                }
                            }
                        }
                    }
                }
            }
        } else {
            alert(_0x4b5b('0x9'));
        }
    }
</script>
```

可以看到受到混淆的 `verify()` 是用來驗證 credentials 的函式，因此我們只要知道 `verify()` 的驗證邏輯就能藉此拿到 flag 的資訊了：

```html
<form action="index.html" method="post">
    <input type="password" id="pass" size="8"/>
    <br/>
    <input type="submit" value="verify" onclick="verify(); return false;"/>
</form>
```

查看程式後可以知道，`verify()` 首先會宣告一個叫做 `checkpass` 的變數，看起來像是我們在 `password` 欄位的輸入，接著用變數 `split` 取出對應 indices 的元素，並與 `_0x4b5b()` 函式的回傳值做比較：

```javascript
function verify() {
    checkpass = document[_0x4b5b('0x0')]('pass')[_0x4b5b('0x1')];
    split = 0x4;
    if (checkpass[_0x4b5b('0x2')](0x0, split * 0x2) == _0x4b5b('0x3')) {
        if (checkpass[_0x4b5b('0x2')](0x7, 0x9) == '{n') {
            if (checkpass[_0x4b5b('0x2')](split * 0x2, split * 0x2 * 0x2) == _0x4b5b('0x4')) {
                if (checkpass[_0x4b5b('0x2')](0x3, 0x6) == 'oCT') {
                    if (checkpass[_0x4b5b('0x2')](split * 0x3 * 0x2, split * 0x4 * 0x2) == _0x4b5b('0x5')) {
                        if (checkpass['substring'](0x6, 0xb) == 'F{not') {
                            if (checkpass[_0x4b5b('0x2')](split * 0x2 * 0x2, split * 0x3 * 0x2) == _0x4b5b('0x6')) {
                                if (checkpass[_0x4b5b('0x2')](0xc, 0x10) == _0x4b5b('0x7')) {
                                        alert(_0x4b5b('0x8'));
                                }
                            }
                        }
                    }
                }
            }
        }
    } else {
        alert(_0x4b5b('0x9'));
    }
}
```

整理 `verify()` 裡面的條件式後，我們可以得出下面的資訊：

```javascript
checkpass[_0x4b5b('0x2')](0, 8) == _0x4b5b('0x3')
checkpass[_0x4b5b('0x2')](8, 16) == _0x4b5b('0x4')
checkpass[_0x4b5b('0x2')](24, 32) == _0x4b5b('0x5')
checkpass[_0x4b5b('0x2')](16, 24) == _0x4b5b('0x6')
```

為了知道 `_0x4b5b('0x3')` 等等的值，我們可以把相關的資料都丟入開發者工具提供的 console：

```javascript
var _0x5a46 = ['37115}', '_again_3', 'this', 'Password\x20Verified', 'Incorrect\x20password', 'getElementById', 'value', 'substring', 'picoCTF{', 'not_this'];
(function(_0x4bd822, _0x2bd6f7) {
    var _0xb4bdb3 = function(_0x1d68f6) {
        while (--_0x1d68f6) {
            _0x4bd822['push'](_0x4bd822['shift']());
        }
    };
    _0xb4bdb3(++_0x2bd6f7);
}(_0x5a46, 0x1b3));
var _0x4b5b = function(_0x2d8f05, _0x4b81bb) {
    _0x2d8f05 = _0x2d8f05 - 0x0;
    var _0x4d74cb = _0x5a46[_0x2d8f05];
    return _0x4d74cb;
};
```

將上面的內容都送入 console 後，我們就可以直接訪問對應的值了：

![image](https://hackmd.io/_uploads/HkrbkploC.png)


透過這個方法，我們可以把 `_0x4b5b('0x3')`、`_0x4b5b('0x4')`、`_0x4b5b('0x6')` 和 `_0x4b5b('0x5')` 的值都找出來，接著組合在一起就是 flag 了。

### Summary
Flag: `picoCTF{not_this_again_xxxxxxxx}`


## JaWT Scratchpad <span style="color: orange;"> [Medium] </span>

### Challenge description
> Internal server errors can be intentionally returned by this challenge. If you experience one, try clearing your cookies.

Check the admin scratchpad! `https://jupiter.challenges.picoctf.org/problem/63090/` or http://jupiter.challenges.picoctf.org:63090

### Solution
進入網站後，會看到下面的畫面：

![image](https://hackmd.io/_uploads/SkR-l6liA.png)

嘗試在下方的輸入框隨意輸入東西並送出後，會發現以對應的身份登入了 JaWT：

![image](https://hackmd.io/_uploads/Bk37ZTlsA.png)

但若嘗試以 admin 身份登入則會得到警告訊息：

```
YOU CANNOT LOGIN AS THE ADMIN! HE IS SPECIAL AND YOU ARE NOT.
```

從這題的名稱跟提示我們可以知道是要從 JWT 下手，以任意一個使用者名稱登入後打開 cookie 也能看到我們的 jwt token。而我們的網頁下方有一個 John 的連結，將滑鼠移動到上面後可以看到它指向了 John the ripper 的網站，因此，從這些資訊我們可以推測是要使用 John the ripper 來破解 JWT 的 secret。

```bash
$ echo "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiMTIzIn0.jgZBxsEy_Mq68jv7XDm-sQr1BUOMHuV8c4dUIxHMT2k" > jwt.john
$ john jwt.john --wordlist=/usr/share/wordlists/rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (HMAC-SHA256 [password is key, SHA256 128/128 ASIMD 4x])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
ilovepico        (?)     
1g 0:00:00:01 DONE (2024-08-19 22:51) 0.7633g/s 5653Kp/s 5653Kc/s 5653KC/s in_199..ilovejesus789
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
```

有了 jwt 的 secret 之後，我們就可以構建新的 jwt token 了：

![image](https://hackmd.io/_uploads/H1Avn0go0.png)

```
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyIjoiYWRtaW4ifQ.gtqDl4jVDvNbEe_JYEZTN19Vx6X9NNZtRVbKPBkhO-s
```

接著把 cookie 改掉後重整瀏覽器就可以拿到 flag 了。

### Summary
Flag: `picoCTF{jawt_was_just_what_you_thought_xxxxxxxx}`


## picobrowser <span style="color: orange;"> [Medium] </span>

### Challenge description
This website can be rendered only by **picobrowser**, go and catch the flag! `https://jupiter.challenges.picoctf.org/problem/26704/` ([link](https://jupiter.challenges.picoctf.org/problem/26704/)) or http://jupiter.challenges.picoctf.org:26704

### Solution
進入網站後可以看到一個寫著 flag 的按鈕，點擊之後會看到跳出一個警示框顯示我們不是 picobrowser 並且顯示我們目前的 User-Agent：

```
You're not picobrowser! Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
```

因此此處應該是判斷 User-Agent 是否為 picobrowser，我們要想辦法將 User-Agent 更改對應的值。

首先，我們可以先找到按下按鈕後會發送請求到哪個路徑：

```html
<a href="/flag" class="btn btn-lg btn-success btn-block"> Flag</a>
```

可以看到路徑為 `/flag`，因此我們可以用 `curl` 對這個路徑發送修改 User-Agent 後的請求：

```bash
$ curl https://jupiter.challenges.picoctf.org/problem/26704/flag -H "User-Agent: picobrowser"
```

接著就可以看到 flag 被包含在回傳的 response 中了。

### Summary
Flag: `picoCTF{p1c0_s3cr3t_ag3nt_xxxxxxxx}`


## Java Script Kiddie <span style="color: red;"> [Hard] </span>

### Challenge description
The image link appears broken... https://jupiter.challenges.picoctf.org/problem/58112 or http://jupiter.challenges.picoctf.org:58112

### Solution
網站上只有一個輸入框，而在輸入框中隨便輸入內容會出現一個損壞的圖片：

![image](https://hackmd.io/_uploads/S17V8dCkkx.png)



使用開發人員工具來查看原始碼：

```html
<script>
    var bytes = [];
    $.get("bytes", function(resp) {
        bytes = Array.from(resp.split(" "), x => Number(x));
    });

    function assemble_png(u_in){
        var LEN = 16;
        var key = "0000000000000000";
        var shifter;
        if(u_in.length == LEN){
            key = u_in;
        }
        var result = [];
        for(var i = 0; i < LEN; i++){
            shifter = key.charCodeAt(i) - 48;
            for(var j = 0; j < (bytes.length / LEN); j ++){
                result[(j * LEN) + i] = bytes[(((j + shifter) * LEN) % bytes.length) + i]
            }
        }
        while(result[result.length-1] == 0){
            result = result.slice(0,result.length-1);
        }
        document.getElementById("Area").src = "data:image/png;base64," + btoa(String.fromCharCode.apply(null, new Uint8Array(result)));
        return false;
    }
</script>
```

可以看到程式首先會向 `/bytes` 發送 GET 請求，拿到一串 data：

```
# http://jupiter.challenges.picoctf.org:58112/bytes
128 252 182 115 177 211 142 252 189 248 130 93 154 0 68 90 131 255 204 170 239 167 18 51 233 43 0 26 210 72 95 120 227 7 195 126 207 254 115 53 141 217 0 11 118 192 110 0 0 170 248 73 103 78 10 174 208 233 156 187 185 65 228 0 137 128 228 71 159 10 111 10 29 96 71 238 141 86 91 82 0 214 37 114 7 0 238 114 133 0 140 0 38 36 144 108 164 141 63 2 69 73 15 65 68 0 249 13 0 64 111 220 48 0 55 255 13 12 68 41 66 120 188 0 73 27 173 72 189 80 0 148 0 64 26 123 0 32 44 237 0 252 36 19 52 0 78 227 98 88 1 185 1 128 182 177 155 44 132 162 68 0 1 239 175 248 68 91 84 18 223 223 111 83 26 188 241 12 0 197 57 89 116 96 223 96 161 45 133 127 125 63 80 129 69 59 241 157 0 105 57 23 30 241 62 229 128 91 39 152 125 146 216 91 5 217 16 48 159 4 198 23 108 178 199 14 6 175 51 154 227 45 56 140 221 0 230 228 99 239 132 198 133 72 243 93 3 86 94 246 156 153 123 1 204 200 233 143 127 64 164 203 36 24 2 169 121 122 159 40 4 25 64 0 241 9 94 220 254 221 122 8 22 227 140 221 248 250 141 66 78 126 190 73 248 105 5 14 26 19 119 223 103 165 69 177 68 61 195 239 115 199 126 61 41 242 175 85 211 11 5 250 93 79 194 78 245 223 255 189 0 128 9 150 178 0 112 247 210 21 36 0 2 252 144 59 101 164 185 94 232 59 150 255 187 1 198 171 182 228 147 73 149 47 92 133 147 254 173 242 39 254 223 214 196 135 248 34 146 206 63 127 127 22 191 92 88 69 23 142 167 237 248 23 215 148 166 59 243 248 173 210 169 254 209 157 174 192 32 228 41 192 245 47 207 120 139 28 224 249 29 55 221 109 226 21 129 75 41 113 192 147 45 144 55 228 126 250 127 197 184 155 251 19 220 11 241 171 229 213 79 135 93 49 94 144 38 250 121 113 58 114 77 111 157 146 242 175 236 185 60 67 173 103 233 234 60 248 27 242 115 223 207 218 203 115 47 252 241 152 24 165 115 126 48 76 104 126 42 225 226 211 57 252 239 21 195 205 107 255 219 132 148 81 171 53 79 91 27 174 235 124 213 71 221 243 212 38 224 124 54 77 248 252 88 163 44 191 109 63 189 231 251 189 242 141 246 249 15 0 2 230 7 244 161 31 42 182 219 15 221 164 252 207 53 95 99 60 190 232 78 255 197 16 169 252 100 164 19 158 32 189 126 140 145 158 116 245 68 94 149 111 252 74 135 189 83 74 71 218 99 220 208 87 24 228 11 111 245 1 0 98 131 46 22 94 71 244 22 147 21 83 155 252 243 90 24 59 73 247 223 127 242 183 251 124 28 245 222 199 248 122 204 230 79 219 147 11 225 202 239 24 132 55 89 221 143 151 137 63 150 79 211 8 16 4 60 63 99 65 0 2
```

然後在使用者按下送出時將使用者的輸入送入 assemble_png 函式中作為 u_in 參數執行：

```html
<form action="#" onsubmit="assemble_png(document.getElementById('user_in').value)">
	<input type="text" id="user_in">
	<input type="submit" value="Submit">
</form>
<img id="Area" src=""/>
```

如果 u_in 的長度為 LEN，key 就會被賦值為 u_in，也就是我們在輸入框中輸入的內容，因此可以推測這題需要我們輸入正確的 key 來復原 PNG 圖片，並且 key 長度為 16 位。

```javascript
var LEN = 16;
var key = "0000000000000000";
var shifter;
if(u_in.length == LEN){
    key = u_in;
}
<SNIP>
    shifter = key.charCodeAt(i) - 48;
```

另外，程式中 shifter 的值為 key 第 i 位的 ascii value 減掉 48，而 ascii value 48 對應到的字符為 '0'，因此這裡的目的像是在透過減掉 48 將原本的字符轉換成數字 ('0' -> 0)，所以我們可以推測 key 的 charset 就在數字中。

而 PNG 圖片的前 16 個 bytes 為固定的數值：

```
# PNG Magic Number (8) + IHDR Length (4) + IHDR Chunk Type Code (4)
89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52
```

```javascript
result[(j * LEN) + i] = bytes[(((j + shifter) * LEN) % bytes.length) + i]
```
當 j = 0 的時候，i 從 0 到 15 正好會對應上前 16 bytes，因此我們可以先移除 j 的值來暴力破解出 key，再透過 key 去恢復圖片。

```python
from PIL import Image
import requests
import itertools
import io
import os

LEN = 16
def get_bytes():
    res = requests.get("http://jupiter.challenges.picoctf.org:58112/bytes")
    bytes_data = list(map(int, res.text.split(" ")))
    return bytes_data

def create_png(bytes_data, key):
    result = [0] * len(bytes_data)

    for i in range(LEN):
        shifter = ord(key[i]) - 48
        for j in range(len(bytes_data) // LEN):
            result[(j * LEN) + i] = bytes_data[(((j + shifter) * LEN) % len(bytes_data)) + i]

    img_bytes = io.BytesIO(bytes(result))
    try:
        img = Image.open(img_bytes)
        img.save(os.path.join(os.getcwd(), "{}.png".format(key)))
        print ("Key {} produces a valid PNG - Saving".format(key))
    except IOError:
        print ("Key {} produces an invalid PNG - Ignoring".format(key))


def main():
    data = get_bytes()
    expected = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52]

    keys = []
    for i in range(LEN):
        print(f"\nIndex {i}: ", end="")
        key_i = []
        for shifter in range(10):
            result = data[((shifter * LEN) % len(data)) + i]

            if result == expected[i]:
                print(shifter, end=" ")
                key_i.append(str(shifter))
        keys.append(key_i)

    possibles = list(itertools.product(*keys))
    print("\n\nPossible keys:")
    for key in possibles:
        create_png(data, "".join(key))

main()
```

```bash
Index 0: 4 
Index 1: 8 
Index 2: 9 
Index 3: 4 
Index 4: 7 
Index 5: 4 
Index 6: 8 
Index 7: 4 
Index 8: 8 
Index 9: 5 6 
Index 10: 1 2 
Index 11: 6 
Index 12: 7 
Index 13: 1 
Index 14: 0 
Index 15: 4 

Possible keys:
Key 4894748485167104 produces a valid PNG - Saving
Key 4894748485267104 produces an invalid PNG - Ignoring
Key 4894748486167104 produces an invalid PNG - Ignoring
Key 4894748486267104 produces an invalid PNG - Ignoring
```

執行後可以看到成功找到正確的 key 並且將圖片儲存下來了，而圖片是一個 qrcode：

![image](https://hackmd.io/_uploads/HyijP-Rk1g.png)

最後掃描 qrcode 或使用 zbar-tools 之後就能得到 flag 了。
```bash
$ zbarimg 4894748485167104.png 
Connection Error (Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory)
Connection Null
QR-Code:picoCTF{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}
scanned 1 barcode symbols from 1 images in 0.01 seconds
```

### Summary
Flag: `picoCTF{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}`

### Resource
[PNG文件结构分析 - CSDN博客](https://blog.csdn.net/qq_60131542/article/details/123450382)
[Wikipedia - PNG](https://zh.wikipedia.org/zh-tw/PNG)


## Java Script Kiddie 2 <span style="color: red;"> [Hard] </span>

### Challenge description
The image link appears broken... twice as badly... https://jupiter.challenges.picoctf.org/problem/42899 or http://jupiter.challenges.picoctf.org:42899

### Solution
這題跟上一題很類似，只差在 key 跟 shifter 做出了一點變化：

```javascript
function assemble_png(u_in){
    var LEN = 16;
    var key = "00000000000000000000000000000000";
    var shifter;
    if(u_in.length == key.length){
        key = u_in;
    }
    var result = [];
    for(var i = 0; i < LEN; i++){
        shifter = Number(key.slice((i*2),(i*2)+1));
        for(var j = 0; j < (bytes.length / LEN); j ++){
            result[(j * LEN) + i] = bytes[(((j + shifter) * LEN) % bytes.length) + i]
        }
    }
    <SNIP>
}
```

這次 key 變成了 32 位，但實際上 shifter 只會使用到其中 index 為偶數的 16 位數，因此我們可以透過跟上一題一樣的方式先將偶數 index 位數爆破出來，然後在其他位填入占位符就好：

```python
from PIL import Image
from pyzbar.pyzbar import decode
import requests
import itertools
import io
import os

LEN = 16
def get_bytes():
    res = requests.get("http://jupiter.challenges.picoctf.org:42899/bytes")
    bytes_data = list(map(int, res.text.split(" ")))
    return bytes_data

def create_png(bytes_data, key):
    result = [0] * len(bytes_data)

    for i in range(LEN):
        shifter = int(key[i*2:(i*2)+1])
        for j in range(len(bytes_data) // LEN):
            result[(j * LEN) + i] = bytes_data[(((j + shifter) * LEN) % len(bytes_data)) + i]

    img_bytes = io.BytesIO(bytes(result))
    try:
        img = Image.open(img_bytes)
        img.save(os.path.join(os.getcwd(), "{}.png".format(key)))
        print ("Key {} produces a valid PNG - Saving".format(key))

        for obj in decode(img):
            print(f'Decode: {obj.data.decode("utf-8")}')
    except IOError:
        print ("Key {} produces an invalid PNG - Ignoring".format(key))


def main():
    data = get_bytes()
    expected = [0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, 0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52]

    keys = []
    for i in range(LEN):
        print(f"\nIndex {i}: ", end="")
        key_i = []
        for shifter in range(10):
            result = data[((shifter * LEN) % len(data)) + i]

            if result == expected[i]:
                print(shifter, end=" ")
                key_i.append(str(shifter))
        keys.append(key_i)

    possibles = list(itertools.product(*keys))
    print("\n\nPossible keys:")
    for key in possibles:
        create_png(data, "0".join(key) + "0")

main()
```
```
$ python3 solve.py

Index 0: 7 
Index 1: 6 
Index 2: 1 
Index 3: 6 
Index 4: 0 
Index 5: 7 
Index 6: 9 
Index 7: 1 
Index 8: 5 
Index 9: 0 1 
Index 10: 0 1 
Index 11: 0 
Index 12: 2 
Index 13: 0 
Index 14: 8 
Index 15: 5 

Possible keys:
Key 70601060007090105000000020008050 produces a valid PNG - Saving
Key 70601060007090105000100020008050 produces an invalid PNG - Ignoring
Key 70601060007090105010000020008050 produces an invalid PNG - Ignoring
Key 70601060007090105010100020008050 produces an invalid PNG - Ignoring
```

### Summary
Flag: `picoCTF{xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}`

# Reverse Engineering

## vault-door-training <span style="color: green;"> [Easy] </span>

### Challenge description
Your mission is to enter Dr. Evil's laboratory and retrieve the blueprints for his Doomsday Project. The laboratory is protected by a series of locked vault doors. Each door is controlled by a computer and requires a password to open. Unfortunately, our undercover agents have not been able to obtain the secret passwords for the vault doors, but one of our junior agents obtained the source code for each vault's computer! You will need to read the source code for each level to figure out what the password is for that vault door. As a warmup, we have created a replica vault in our training facility. The source code for the training vault is here: [VaultDoorTraining.java](https://jupiter.challenges.picoctf.org/static/1afdf83322ee9c0040f8e3a3c047e18b/VaultDoorTraining.java)

### Solution
查看程式後，可以看到 `main()` 會接收使用者的輸入，然後將 "picoCTF{" 和 "}" 去掉後存入變數 `input`，並送入 `checkPassword()` 比對密碼，因此密碼應該就是我們的 flag。

```java
public static void main(String args[]) {
    VaultDoorTraining vaultDoor = new VaultDoorTraining();
    Scanner scanner = new Scanner(System.in); 
    System.out.print("Enter vault password: ");
    String userInput = scanner.next();
    String input = userInput.substring("picoCTF{".length(),userInput.length()-1);
    if (vaultDoor.checkPassword(input)) {
        System.out.println("Access granted.");
    } else {
        System.out.println("Access denied!");
    }
}
```

接著前往 `checkPassword()` 查看剩下的 flag 部分的線索：

```java
public boolean checkPassword(String password) {
    return password.equals("w4rm1ng_Up_w1tH_jAv4_xxxxxxxxxxx");
}
```

可以看到，剩餘的部分是直接以明文的方式寫出來，因此把這串密碼放入 "picoCTF{}" 裡面就是我們的 flag 了。

### Summary
Flag: `picoCTF{w4rm1ng_Up_w1tH_jAv4_xxxxxxxxxxx}`


## vault-door-1 <span style="color: orange;"> [Medium] </span>

### Challenge description
This vault uses some complicated arrays! I hope you can make sense of it, special agent. The source code for this vault is here: [VaultDoor1.java](https://jupiter.challenges.picoctf.org/static/29b91e638ccbd76aaa8c0462d1c64d8d/VaultDoor1.java)

### Solution
跟上題一樣，flag 的值藏在 `checkPassword()` 的函式裡面：

```java
public boolean checkPassword(String password) {
    return password.length() == 32 &&
           password.charAt(0)  == 'd' &&
           password.charAt(29) == '3' &&
           password.charAt(4)  == 'r' &&
           password.charAt(2)  == '5' &&
           password.charAt(23) == 'r' &&
           password.charAt(3)  == 'c' &&
           password.charAt(17) == '4' &&
           password.charAt(1)  == '3' &&
           password.charAt(7)  == 'b' &&
           password.charAt(10) == '_' &&
           password.charAt(5)  == '4' &&
           password.charAt(9)  == '3' &&
           password.charAt(11) == 't' &&
           password.charAt(15) == 'c' &&
           password.charAt(8)  == 'l' &&
           password.charAt(12) == 'H' &&
           password.charAt(20) == 'c' &&
           password.charAt(14) == '_' &&
           password.charAt(6)  == 'm' &&
           password.charAt(24) == '5' &&
           password.charAt(18) == 'r' &&
           password.charAt(13) == '3' &&
           password.charAt(19) == '4' &&
           password.charAt(21) == 'T' &&
           password.charAt(16) == 'H' &&
           password.charAt(27) == 'f' &&
           password.charAt(30) == 'b' &&
           password.charAt(25) == '_' &&
           password.charAt(22) == '3' &&
           password.charAt(28) == '6' &&
           password.charAt(26) == 'f' &&
           password.charAt(31) == '0';
}
```

可以看到，`checkPassword()` 會檢查傳進來的參數 `password` 在每個 index 應該是什麼值，因此我們可以透過這個方式反推出 flag。

### Summary
Flag: `picoCTF{d35cr4mbl3_tH3_cH4r4cT3r5_xxxxxx}`


## vault-door-3 <span style="color: orange;"> [Medium] </span>

### Challenge description
This vault uses for-loops and byte arrays. The source code for this vault is here: [VaultDoor3.java](https://jupiter.challenges.picoctf.org/static/a648ca6dd275b9454c5d0de6d0f6efd3/VaultDoor3.java)

### Solution
跟前面一樣，flag 的資訊藏在 `checkPassword()` 中：

```java
public boolean checkPassword(String password) {
    if (password.length() != 32) {
        return false;
    }
    char[] buffer = new char[32];
    int i;
    for (i=0; i<8; i++) {
        buffer[i] = password.charAt(i);
    }
    for (; i<16; i++) {
        buffer[i] = password.charAt(23-i);
    }
    for (; i<32; i+=2) {
        buffer[i] = password.charAt(46-i);
    }
    for (i=31; i>=17; i-=2) {
        buffer[i] = password.charAt(i);
    }
    String s = new String(buffer);
    return s.equals("jU5t_a_sna_3lpm18gb41_u_4_mfr340");
}
```

可以看到，程式用了幾個 for-loop 來將 `password` 參數中的值放到新的位置，接著與字串 "jU5t_a_sna_3lpm18gb41_u_4_mfr340" 比對，因此我們要做的事是將這個字串的每個值對應到原本在 `password` 裡面的時候的位置。

第一個 loop：

| password | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
| -------- | - | - | - | - | - | - | - | - |
| buffer   | j | U | 5 | t | _ | a | _ | s | 

第二個 loop：

| password | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 |
| -------- | -- | -- | -- | -- | -- | -- | - | - |
| buffer   | n  | a  | _  | 3  | l  | p  | m | 1 |

第三個 loop：

| password | 30 | 28 | 26 | 24 | 22 | 20 | 18 | 16 |
| -------- | -- | -- | -- | -- | -- | -- | -- | -- |
| buffer   | 8  | b  | 1  | u  | 4  | m  | r  | 4  |

第四個 loop：

| password | 31 | 29 | 27 | 25 | 23 | 21 | 19 | 17 |
| -------- | -- | -- | -- | -- | -- | -- | -- | -- |
| buffer   | 0  | 3  | f  | _  | _  | _  | 4  | g  |

有了 `password` 在每一個位置的值之後，將其組合在一起就可以拿到 flag 了。

### Summary
Flag: `picoCTF{jU5t_a_s1mpl3_an4gr4m_4_u_xxxxxx}`


## vault-door-4 <span style="color: orange;"> [Medium] </span>

### Challenge description
This vault uses ASCII encoding for the password. The source code for this vault is here: [VaultDoor4.java](https://jupiter.challenges.picoctf.org/static/09d3002ae349631324a17e2255ae8df2/VaultDoor4.java)

### Solution
首先查看 `checkPassword()`：

```java
public boolean checkPassword(String password) {
    byte[] passBytes = password.getBytes();
    byte[] myBytes = {
        106 , 85  , 53  , 116 , 95  , 52  , 95  , 98  ,
        0x55, 0x6e, 0x43, 0x68, 0x5f, 0x30, 0x66, 0x5f,
        0142, 0131, 0164, 063 , 0163, 0137, 0143, 061 ,
        '9' , '4' , 'f' , '7' , '4' , '5' , '8' , 'e' ,
    };
    for (int i=0; i<32; i++) {
        if (passBytes[i] != myBytes[i]) {
            return false;
        }
    }
    return true;
}
```

可以看到，`password` 轉成 bytes 之後會與 `myBytes` 比較，因此只要將 `myBytes` 轉換回 ascii 文字，就能拿到 flag 了。在 `myBytes` 中，最後一行已經是英文字母了，而前面三行則分別是不同進制的數字：

```python
dec_num = [106, 85, 53, 116, 95, 52, 95, 98]
hex_num = [0x55, 0x6e, 0x43, 0x68, 0x5f, 0x30, 0x66, 0x5f]
oct_num = [0o142, 0o131, 0o164, 0o63, 0o163, 0o137, 0o143, 0o61]
```

在 python 中，我們用不同進制對應的樣式匯入後，python 會幫我們將其自動轉換成十進制數字，因此我們就可以直接用 `chr()` 將它們轉換回 ascii 字母：

```python
flag = "".join([chr(x) for x in dec_num + hex_num + oct_num]) + "94f7458e"
print(flag)
```

轉換後就可以拿到 flag 了。

### Summary
Flag: `picoCTF{jU5t_4_bUnCh_0f_bYt3s_xxxxxxxxxx}`


## vault-door-5 <span style="color: orange;"> [Medium] </span>

### Challenge description
In the last challenge, you mastered octal (base 8), decimal (base 10), and hexadecimal (base 16) numbers, but this vault door uses a different change of base as well as URL encoding! The source code for this vault is here: [VaultDoor5.java](https://jupiter.challenges.picoctf.org/static/0a53bf0deaba6919f98d8550c35aa253/VaultDoor5.java)

### Solution
跟前幾題一樣，首先打開程式查看 `checkPassword()`：

```java
public boolean checkPassword(String password) {
    String urlEncoded = urlEncode(password.getBytes());
    String base64Encoded = base64Encode(urlEncoded.getBytes());
    String expected = "JTYzJTMwJTZlJTc2JTMzJTcyJTc0JTMxJTZlJTY3JTVm"
                    + "JTY2JTcyJTMwJTZkJTVmJTYyJTYxJTM1JTY1JTVmJTM2"
                    + "JTM0JTVmJTMwJTYyJTM5JTM1JTM3JTYzJTM0JTY2";
    return base64Encoded.equals(expected);
}
```
可以看到，程式的過程中會將 `password` 進行 url 和 base64 的 encode，然後檢查是否跟 `expected` 變數相同。因此我們可以將 `expected` 變數的值依序進行 base64 和 url 的 decode 來得出 password 應該是什麼，就可以拿到我們的 flag 了。

Recipe: [CyberChef](https://gchq.github.io/CyberChef/#recipe=From_Base64('A-Za-z0-9%2B/%3D',true,false)URL_Decode()&input=SlRZekpUTXdKVFpsSlRjMkpUTXpKVGN5SlRjMEpUTXhKVFpsSlRZM0pUVm1KVFkySlRjeUpUTXdKVFprSlRWbUpUWXlKVFl4SlRNMUpUWTFKVFZtSlRNMkpUTTBKVFZtSlRNd0pUWXlKVE01SlRNMUpUTTNKVFl6SlRNMEpUWTI)

### Summary
Flag: `picoCTF{c0nv3rt1ng_fr0m_ba5e_64_xxxxxxxx}`


## vault-door-6 <span style="color: orange;"> [Medium] </span>

### Challenge description
This vault uses an XOR encryption scheme. The source code for this vault is here: [VaultDoor6.java](https://jupiter.challenges.picoctf.org/static/cdb33ffba609e2521797aac66320ec65/VaultDoor6.java)

### Solution
首先檢查程式中的 `checkPassword()` 函式：

```java
public boolean checkPassword(String password) {
    if (password.length() != 32) {
        return false;
    }
    byte[] passBytes = password.getBytes();
    byte[] myBytes = {
        0x3b, 0x65, 0x21, 0xa , 0x38, 0x0 , 0x36, 0x1d,
        0xa , 0x3d, 0x61, 0x27, 0x11, 0x66, 0x27, 0xa ,
        0x21, 0x1d, 0x61, 0x3b, 0xa , 0x2d, 0x65, 0x27,
        0xa , 0x6c, 0x60, 0x37, 0x30, 0x60, 0x31, 0x36,
    };
    for (int i=0; i<32; i++) {
        if (((passBytes[i] ^ 0x55) - myBytes[i]) != 0) {
            return false;
        }
    }
    return true;
}
```

可以看到，程式過程中會將 `password` 轉換成 bytes，接著將每一個元素與 `0x55` 進行 xor 並比對是否與 `myBytes` 中的元素相同。因此我們只要將  `myBytes` 中的元素與 `0x55` 做 xor 然後轉換回 ascii 文字就可以拿到 flag 了。

```python
from pwn import *

flag_bytes = [0x3b, 0x65, 0x21, 0xa , 0x38, 0x0 , 0x36, 0x1d,
              0xa , 0x3d, 0x61, 0x27, 0x11, 0x66, 0x27, 0xa ,
              0x21, 0x1d, 0x61, 0x3b, 0xa , 0x2d, 0x65, 0x27,
              0xa , 0x6c, 0x60, 0x37, 0x30, 0x60, 0x31, 0x36]
flag = "".join(xor(x, 0x55).decode() for x in flag_bytes)
```

### Summary
Flag: `picoCTF{n0t_mUcH_h4rD3r_tH4n_x0r_xxxxxxx}`


## vault-door-7 <span style="color: red;"> [Hard] </span>

### Challenge description
This vault uses bit shifts to convert a password string into an array of integers. Hurry, agent, we are running out of time to stop Dr. Evil's nefarious plans! The source code for this vault is here: [VaultDoor7.java](https://jupiter.challenges.picoctf.org/static/89b8065d19ee9830ae548d27a40ca757/VaultDoor7.java)

### Solution
查看程式後，我們可以知道 `password` 會被送到 `paswordToIntArray()` 中將 `password` 轉成 bytes，並以 4 個為一組分成 8 組進行位移：

```java
public int[] passwordToIntArray(String hex) {
    int[] x = new int[8];
    byte[] hexBytes = hex.getBytes();
    for (int i=0; i<8; i++) {
        x[i] = hexBytes[i*4]   << 24
             | hexBytes[i*4+1] << 16
             | hexBytes[i*4+2] << 8
             | hexBytes[i*4+3];
    }
    return x;
}

public boolean checkPassword(String password) {
    if (password.length() != 32) {
        return false;
    }
    int[] x = passwordToIntArray(password);
    return x[0] == 1096770097
        && x[1] == 1952395366
        && x[2] == 1600270708
        && x[3] == 1601398833
        && x[4] == 1716808014
        && x[5] == 1734291511
        && x[6] == 960049251
        && x[7] == 1681089078;
}
```

程式是以 4 個 bytes 為一組進行位移來轉換成一個十進制數值。因此我們可以將十進制數值轉換成二進制或十六進制，然後拆回四組 (位移是以 8 個位元為單位進行位移，因此拆分時每 8 個二進制位元為一組，或每 2 個十六進制字母或數字為一組)，來還原原本的 bytes 值。例如：

```
1096770097 = 0b1000001010111110110001000110001
           => ['01000001', '01011111', '01100010', '00110001']
           = 0x415f6231
           =>  ["41", "5f", "62", "31"]
```

我們可以寫一個簡單的 script 來進行轉換。將十進制數值轉成十六進制後拆分成四個字串，接著使用 `chr()` 將每個字串轉換成 ascii 文字，最後在組合再一起就可以拿到 flag 了：

```python
int_array = [1096770097, 1952395366, 1600270708, 1601398833, 1716808014, 1734291511, 960049251, 1681089078]
flag = ""

for num in int_array:
    hex_str = f"{num:08x}"
    for i in range(0, 8, 2):
        flag += chr(int(hex_str[i:i+2], 16))

print(flag)
```

### Summary
Flag: `picoCTF{A_b1t_0f_b1t_sh1fTiNg_xxxxxxxxxx}`


## vault-door-8 <span style="color: red;"> [Hard] </span>

### Challenge description
Apparently Dr. Evil's minions knew that our agency was making copies of their source code, because they intentionally sabotaged this source code in order to make it harder for our agents to analyze and crack into! The result is a quite mess, but I trust that my best special agent will find a way to solve it. The source code for this vault is here: [VaultDoor8.java](https://jupiter.challenges.picoctf.org/static/9b13abb1479aa3979db28a9083712663/VaultDoor8.java)

### Solution
題目提供的的程式全部擠在一起，直接丟到 Reformat 工具中。處理完後可以看到主要的判斷程式：

```java
public char[] scramble(String password) {/* Scramble a password by transposing pairs of bits. */
    char[] a = password.toCharArray();
    for (int b = 0; b < a.length; b++) {
        char c = a[b];
        c = switchBits(c, 1, 2);
        c = switchBits(c, 0, 3); /* c = switchBits(c,14,3); c = switchBits(c, 2, 0); */
        c = switchBits(c, 5, 6);
        c = switchBits(c, 4, 7);
        c = switchBits(c, 0, 1); /* d = switchBits(d, 4, 5); e = switchBits(e, 5, 6); */
        c = switchBits(c, 3, 4);
        c = switchBits(c, 2, 5);
        c = switchBits(c, 6, 7);
        a[b] = c;
    }
    return a;
}

public boolean checkPassword(String password) {
    char[] scrambled = scramble(password);
    char[] expected = {
            0xF4, 0xC0, 0x97, 0xF0, 0x77, 0x97, 0xC0, 0xE4, 0xF0, 0x77, 0xA4, 0xD0, 0xC5, 0x77, 0xF4, 0x86, 0xD0, 0xA5, 0x45, 0x96, 0x27, 0xB5, 0x77, 0xE0, 0x95, 0xF1, 0xE1, 0xE0, 0xA4, 0xC0, 0x94, 0xA4};
    return Arrays.equals(scrambled, expected);
}
```

可以看到程式中會將 flag 的每個字元裡面的 bits 進行交換，然後跟 `expected` 比較，所以只要將 `scramble()` 裡面交換位元的順序倒著執行回去就可以還原了。

solve script：

```java
class VaultDoor8 {
    public static void main(String args[]) {
        VaultDoor8 a = new VaultDoor8();
        char[] expected = {
                0xF4, 0xC0, 0x97, 0xF0, 0x77, 0x97, 0xC0, 0xE4, 0xF0, 0x77, 0xA4, 0xD0, 0xC5, 0x77, 0xF4, 0x86, 0xD0, 0xA5, 0x45, 0x96, 0x27, 0xB5, 0x77, 0xE0, 0x95, 0xF1, 0xE1, 0xE0, 0xA4, 0xC0, 0x94, 0xA4};
        System.out.println(a.scramble_rev(expected));
    }

    public String scramble_rev(char[] scrambled) {
        for (int b = 0; b < scrambled.length; b++) {
            char c = scrambled[b];
            c = switchBits(c, 6, 7);
            c = switchBits(c, 2, 5);
            c = switchBits(c, 3, 4);
            c = switchBits(c, 0, 1);
            c = switchBits(c, 4, 7);
            c = switchBits(c, 5, 6);
            c = switchBits(c, 0, 3);
            c = switchBits(c, 1, 2);
            scrambled[b] = c;
        }
        return new String(scrambled);
    }
    
    public char switchBits(char c, int p1, int p2) {/* Move the bit in position p1 to position p2, and move the bit
that was in position p2 to position p1. Precondition: p1 < p2 */
        char mask1 = (char) (1 << p1);
        char mask2 = (char) (1 << p2); /* char mask3 = (char)(1<<p1<<p2); mask1++; mask1--; */
        char bit1 = (char) (c & mask1);
        char bit2 = (char) (c & mask2); /* System.out.println("bit1 " + Integer.toBinaryString(bit1));
System.out.println("bit2 " + Integer.toBinaryString(bit2)); */
        char rest = (char) (c & ~(mask1 | mask2));
        char shift = (char) (p2 - p1);
        char result = (char) ((bit1 << shift) | (bit2 >> shift) | rest);
        return result;
    }
}
```

### Summary
Flag: `picoCTF{s0m3_m0r3_b1t_sh1fTiNg_xxxxxxxx}`


## asm1 <span style="color: orange;"> [Medium] </span>

### Challenge description
What does asm1(0x6fa) return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. [Source](https://jupiter.challenges.picoctf.org/static/b41e08fc19ceb9d0466ebd68d36c5630/test.S)

### Solution
打開題目提供的 source code 之後可以看到：

```assembly
<+0>:   push   ebp
<+1>:   mov    ebp,esp
<+3>:   cmp    DWORD PTR [ebp+0x8],0x3a2
<+10>:  jg     0x512 <asm1+37>
<+12>:  cmp    DWORD PTR [ebp+0x8],0x358
<+19>:  jne    0x50a <asm1+29>
<+21>:  mov    eax,DWORD PTR [ebp+0x8]
<+24>:  add    eax,0x12
<+27>:  jmp    0x529 <asm1+60>
<+29>:  mov    eax,DWORD PTR [ebp+0x8]
<+32>:  sub    eax,0x12
<+35>:  jmp    0x529 <asm1+60>
<+37>:  cmp    DWORD PTR [ebp+0x8],0x6fa
<+44>:  jne    0x523 <asm1+54>
<+46>:  mov    eax,DWORD PTR [ebp+0x8]
<+49>:  sub    eax,0x12
<+52>:  jmp    0x529 <asm1+60>
<+54>:  mov    eax,DWORD PTR [ebp+0x8]
<+57>:  add    eax,0x12
<+60>:  pop    ebp
<+61>:  ret
```

從題目描述跟 source code 可以得出 0x6fa 應該是作為參數一起被傳入程式中執行，並且被存放在 `[ebp+0x8]` 的地方，而我們要找的 flag 是程式最後回傳的值，也就是 `eax` 在程式結束時的值。

從程式的開頭開始查看，首先會比較 0x6fa 是否大於 0x3a2，如果是的話就跳到 `<asm1+37>`：

```assembly
<+3>:   cmp    DWORD PTR [ebp+0x8],0x3a2
<+10>:  jg     0x512 <asm1+37>
```

條件成立，接著跳到 `<asm1+37>` 的部分繼續查看，可以看到程式中判斷如果 `[ebp+0x8]`(0x6fa) 不等於 0x6fa，就跳到 `<asm1+54>`：

```assembly
<+37>:  cmp    DWORD PTR [ebp+0x8],0x6fa
<+44>:  jne    0x523 <asm1+54>
```

因為條件不成立，因此接續下去執行 `<asm1+46>` 的指令：

```assembly
<+46>:  mov    eax,DWORD PTR [ebp+0x8]
<+49>:  sub    eax,0x12
<+52>:  jmp    0x529 <asm1+60>
```

這裡的指令會把 `eax` 賦值為 `[ebp+0x8]`(0x6fa)，然後將 `eax` 減去 0x12，並跳到 `<asm1+60>` 的地方。`<asm1+60>` 後面接續一條指令程式就結束了，因此 `eax` 的值就是 0x6fa - 0x12 = 0x6e8。

### Summary
Flag: `0x6e8`


## asm2 <span style="color: red;"> [Hard] </span>

### Challenge description
What does asm2(0x4,0x21) return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. [Source](https://jupiter.challenges.picoctf.org/static/7e3eb2f90200ac88126f62ceb4bc3948/test.S)

### Solution
這次程式傳入 0x4 和 0x21，並且分別存放在 `[ebp+0x8]` 和 `[ebp+0xc]` 的位置：

```assembly
<+0>:   push   ebp
<+1>:   mov    ebp,esp
<+3>:   sub    esp,0x10
<+6>:   mov    eax,DWORD PTR [ebp+0xc]
<+9>:   mov    DWORD PTR [ebp-0x4],eax
<+12>:  mov    eax,DWORD PTR [ebp+0x8]
<+15>:  mov    DWORD PTR [ebp-0x8],eax
<+18>:  jmp    0x509 <asm2+28>
<+20>:  add    DWORD PTR [ebp-0x4],0x1
<+24>:  add    DWORD PTR [ebp-0x8],0x74
<+28>:  cmp    DWORD PTR [ebp-0x8],0xfb46
<+35>:  jle    0x501 <asm2+20>
<+37>:  mov    eax,DWORD PTR [ebp-0x4]
<+40>:  leave  
<+41>:  ret
```

可以看到，前面的幾條指令中會透過 `eax` 傳遞數值，將 `[ebp+0xc]` (0x21) 的值存入 `[ebp-0x4]` 中，把 `[ebp+0x8]` (0x4) 的值存入 `[ebp-0x8]`：

```assembly
<+6>:   mov    eax,DWORD PTR [ebp+0xc]
<+9>:   mov    DWORD PTR [ebp-0x4],eax
<+12>:  mov    eax,DWORD PTR [ebp+0x8]
<+15>:  mov    DWORD PTR [ebp-0x8],eax
```

接下來則是會進行一段迴圈：

```assembly
<+18>:  jmp    0x509 <asm2+28>
<+20>:  add    DWORD PTR [ebp-0x4],0x1
<+24>:  add    DWORD PTR [ebp-0x8],0x74
<+28>:  cmp    DWORD PTR [ebp-0x8],0xfb46
<+35>:  jle    0x501 <asm2+20>
```

對應到 python 相當於下面的程式：

```python
while ebp_0x8 <= 0xfb46:
    ebp_0x4 += 0x1
    ebp_0x8 += 0x74
```

最後進行計算後就可以知道 `[ebp-0x4]` 的值，也就是最後 eax 的值，進而拿到 flag 了：

```python
ebp_0x4 = 0x21
ebp_0x8 = 0x4

while ebp_0x8 <= 0xfb46:
    ebp_0x4 += 0x1
    ebp_0x8 += 0x74

eax = ebp_0x4
print(hex(eax))
```

### Summary
Flag: `0x24c`


## asm3 <span style="color: red;"> [Hard] </span>

### Challenge description
What does asm3(0xd73346ed,0xd48672ae,0xd3c8b139) return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. [Source](https://jupiter.challenges.picoctf.org/static/17c5620fcffa388fe518d31cb4dd99a0/test.S)

### Solution
這次的程式進行比較複雜的運算：

```assembly
<+0>:   push   ebp
<+1>:   mov    ebp,esp
<+3>:   xor    eax,eax
<+5>:   mov    ah,BYTE PTR [ebp+0xa]
<+8>:   shl    ax,0x10
<+12>:  sub    al,BYTE PTR [ebp+0xc]
<+15>:  add    ah,BYTE PTR [ebp+0xd]
<+18>:  xor    ax,WORD PTR [ebp+0x10]
<+22>:  nop
<+23>:  pop    ebp
<+24>:  ret
```

我們可以直接編譯程式來得到計算結果：

test.S：
```assembly
.intel_syntax noprefix
.global asm3

asm3:
        push   ebp
        mov    ebp,esp
        xor    eax,eax
        mov    ah,BYTE PTR [ebp+0xa]
        shl    ax,0x10
        sub    al,BYTE PTR [ebp+0xc]
        add    ah,BYTE PTR [ebp+0xd]
        xor    ax,WORD PTR [ebp+0x10]
        nop
        pop    ebp
        ret
```

main.c：

```c
#include <stdio.h>

int asm3(int, int, int);

int main(int argc, char* argv[])
{
    printf("0x%x\n", asm3(0xd73346ed,0xd48672ae,0xd3c8b139));
    return 0;
}
```

編譯：

```bash
$ gcc -masm=intel -m32 -c test.S -o test.o
$ gcc -m32 -c main.c -o main.o
$ gcc -m32 test.o main.o -o main
```

如果遇到下面的錯誤可以參考這篇 [fatal error: bits/libc-header-start.h: No such file or directory" while compiling HTK](https://stackoverflow.com/questions/54082459/fatal-error-bits-libc-header-start-h-no-such-file-or-directory-while-compili)：

```bash
In file included from main.c:1:
/usr/include/stdio.h:28:10: fatal error: bits/libc-header-start.h: No such file or directory
   28 | #include <bits/libc-header-start.h>
      |          ^~~~~~~~~~~~~~~~~~~~~~~~~~
compilation terminated.
```

安裝 32-bit 的 header 跟 libraries 來解決：

```bash
$ sudo apt install gcc-multilib
```

最後執行編譯完的程式就能拿到計算結果了。

### Summary
Flag: `0xc36b`


## asm4 <span style="color: red;"> [Hard] </span>

### Challenge description
What will asm4("picoCTF_a3112") return? Submit the flag as a hexadecimal value (starting with '0x'). NOTE: Your submission for this question will NOT be in the normal flag format. [Source](https://jupiter.challenges.picoctf.org/static/80186ad81f4a1569b480e7fbf68b29ca/test.S)

### Solution
這題提供的程式跟上一題一樣比較複雜，所以一樣直接編譯程式來解決：

```assembly
<+0>:	push   ebp
<+1>:	mov    ebp,esp
<+3>:	push   ebx
<+4>:	sub    esp,0x10
<+7>:	mov    DWORD PTR [ebp-0x10],0x246
<SNIP>
<+155>:	pop    ebx
<+156>:	pop    ebp
<+157>:	ret    
```

其中程式中因為有跳轉的部分，因此要更改 `test.S` 把跳轉的地址改成跳轉到 label：

```assembly
.intel_syntax noprefix
.global asm4

asm4:
        push   ebp
        mov    ebp,esp
        push   ebx
        sub    esp,0x10
        mov    DWORD PTR [ebp-0x10],0x246
        mov    DWORD PTR [ebp-0xc],0x0
        jmp    asm4_27
asm4_23:
        add    DWORD PTR [ebp-0xc],0x1
asm4_27:
        mov    edx,DWORD PTR [ebp-0xc]
        mov    eax,DWORD PTR [ebp+0x8]
        add    eax,edx
        movzx  eax,BYTE PTR [eax]
        test   al,al
        jne    asm4_23
        mov    DWORD PTR [ebp-0x8],0x1
        jmp    asm4_138
asm4_51:
        mov    edx,DWORD PTR [ebp-0x8]
        mov    eax,DWORD PTR [ebp+0x8]
        add    eax,edx
        movzx  eax,BYTE PTR [eax]
        movsx  edx,al
        mov    eax,DWORD PTR [ebp-0x8]
        lea    ecx,[eax-0x1]
        mov    eax,DWORD PTR [ebp+0x8]
        add    eax,ecx
        movzx  eax,BYTE PTR [eax]
        movsx  eax,al
        sub    edx,eax
        mov    eax,edx
        mov    edx,eax
        mov    eax,DWORD PTR [ebp-0x10]
        lea    ebx,[edx+eax*1]
        mov    eax,DWORD PTR [ebp-0x8]
        lea    edx,[eax+0x1]
        mov    eax,DWORD PTR [ebp+0x8]
        add    eax,edx
        movzx  eax,BYTE PTR [eax]
        movsx  edx,al
        mov    ecx,DWORD PTR [ebp-0x8]
        mov    eax,DWORD PTR [ebp+0x8]
        add    eax,ecx
        movzx  eax,BYTE PTR [eax]
        movsx  eax,al
        sub    edx,eax
        mov    eax,edx
        add    eax,ebx
        mov    DWORD PTR [ebp-0x10],eax
        add    DWORD PTR [ebp-0x8],0x1
asm4_138:
        mov    eax,DWORD PTR [ebp-0xc]
        sub    eax,0x1
        cmp    DWORD PTR [ebp-0x8],eax
        jl     asm4_51
        mov    eax,DWORD PTR [ebp-0x10]
        add    esp,0x10
        pop    ebx
        pop    ebp
        ret
```

main.c：

```c
#include <stdio.h>

int asm4(char[]);

int main(int argc, char* argv[]) {
        printf("0x%x\n", asm4("picoCTF_a3112"));
        return 0;
}
```

然後一樣編譯之後執行就能拿到 flag 了：

```bash
$ gcc -masm=intel -m32 -c test.S -o test.o
$ gcc -m32 -c main.c -o main.o
$ gcc -m32 test.o main.o -o main
$ ./main
```

### Summary
Flag: `0x1d0`


## droids0 <span style="color: red;"> [Hard] </span>

### Challenge description
Where do droid logs go. Check out this [file](https://jupiter.challenges.picoctf.org/static/02bcd73e630f50ef0b12bcdad9d84e0d/zero.apk).

### Solution
將題目提供的 apk 檔用 android studio 開啟，並用 jadx decompile 程式，可以在 `MainActivity` 看到 `buttonClick()` 會呼叫 `getFlag()`：

```java
public void buttonClick(View view) {
    this.text_bottom.setText(FlagstaffHill.getFlag(this.text_input.getText().toString(), this.ctx));
}
```

而 `getFlag()` 則會將 `paprika()` 產出的結果輸出到 log：

```java
public static String getFlag(String input, Context ctx) {
    Log.i("PICO", paprika(input));
    return "Not Today...";
}
```

所以可以猜測按下按鈕的時候，程式會輸出 flag 到 log console，我們可以用 android studio 中內建的模擬器打開程式：

![image](https://hackmd.io/_uploads/HJZu9LLv1e.png)

打開下方的 Logcat panel，並點下按鈕後就能看到 flag 被印出來了：

![image](https://hackmd.io/_uploads/SkQo9L8Dyl.png)

### Summary
Flag: `picoCTF{a.moose.once.bit.my.sister}`


## droids1 <span style="color: red;"> [Hard] </span>

### Challenge description
Find the pass, get the flag. Check out this [file](https://jupiter.challenges.picoctf.org/static/b12c6d058c7f52eb1fd2015cfd291716/one.apk).

### Solution
跟上題一樣，將 apk 檔匯入 android studio，並用 jadx plugin 查看反編譯後的結果：

```java
public static String getFlag(String input, Context ctx) {
    if (input.equals(ctx.getString(R.string.password))) {
        return fenugreek(input);
    }
    return "NOPE";
}
```

可以看到，這次 `getFlag()` 會檢查輸入是否等於 `R.string.password`，而這可以在 resources 裡面的 string 找到：

![截圖 2025-01-16 晚上7.30.51](https://hackmd.io/_uploads/HJOg0vIDJx.png)

一樣用模擬器執行程式，輸入密碼 `opossum` 並按下按鈕觸發 `getFlag()` 後就可以看到 flag 了：

![image](https://hackmd.io/_uploads/rJDP0P8wye.png)

### Summary
Flag: `picoCTF{pining.for.the.fjords}`


## droids2 <span style="color: red;"> [Hard] </span>

### Challenge description
Find the pass, get the flag. Check out this [file](https://jupiter.challenges.picoctf.org/static/b7d30de6eaaf83e685aea7c10c5bdea8/two.apk).

### Solution
跟上題一樣，用 jadx 查看反編譯後的程式碼：
```java
public static String getFlag(String input, Context ctx) {
    String[] witches = {"weatherwax", "ogg", "garlick", "nitt", "aching", "dismass"};
    int second = 3 - 3;
    int third = (3 / 3) + second;
    int fourth = (third + third) - second;
    int fifth = 3 + fourth;
    if (input.equals("".concat(witches[fifth]).concat(".").concat(witches[third]).concat(".").concat(witches[second]).concat(".").concat(witches[(fifth + second) - third]).concat(".").concat(witches[3]).concat(".").concat(witches[fourth]))) {
        return sesame(input);
    }
    return "NOPE";
}
```

可以看到，這次的 pass 是一連串的字串組合而成，我們可以將檢查 pass 的地方改為輸出，讓 java 幫我們印出 pass：

```java
public class Main {

    public static void main(String[] args) {
        String[] witches = {"weatherwax", "ogg", "garlick", "nitt", "aching", "dismass"};
        int second = 3 - 3;
        int third = (3 / 3) + second;
        int fourth = (third + third) - second;
        int fifth = 3 + fourth;
        System.out.print("".concat(witches[fifth]).concat(".").concat(witches[third]).concat(".").concat(witches[second]).concat(".").concat(witches[(fifth + second) - third]).concat(".").concat(witches[3]).concat(".").concat(witches[fourth]));
    }
}
```

執行後，可以知道 pass 是 `dismass.ogg.weatherwax.aching.nitt.garlick`，再丟到 app 中就能拿到 flag 了：

![image](https://hackmd.io/_uploads/rJ5db_8Pye.png)


### Summary
Flag: `picoCTF{what.is.your.favourite.colour}`


## droids3 <span style="color: red;"> [Hard] </span>

### Challenge description
Find the pass, get the flag. Check out this [file](https://jupiter.challenges.picoctf.org/static/06318765139795831859f843dd56ce60/three.apk).

### Solution
跟上題一樣，用 jadx 查看反編譯後的程式碼：
```java
public class FlagstaffHill {
    public static native String cilantro(String str);

    public static String nope(String input) {
        return "don't wanna";
    }

    public static String yep(String input) {
        return cilantro(input);
    }

    public static String getFlag(String input, Context ctx) {
        return nope(input);
    }
}
```

我們需要更改 `getFlag()` 裡面的程式，使其返回 `yep(input)` 的結果來拿到 flag。可以用 `apktool` 工具將 apk 檔解包：

```bash
$ aptkool d -f -r three.apk
```

然後修改 `three/smali/com/hellocmu/picoctf/FlagstaffHill.smali` 裡面的內容：

```diff
-    invoke-static {p0}, Lcom/hellocmu/picoctf/FlagstaffHill;->nope(Ljava/lang/String;)Ljava/lang/String;
+    invoke-static {p0}, Lcom/hellocmu/picoctf/FlagstaffHill;->yep(Ljava/lang/String;)Ljava/lang/String;
```

打包：

```bash
$ apktool b -f -r three -o three_new.apk
```

最後還要進行 align & sign，可以用 uber-apk-signer 幫我們快速完成：

```bash
$ wget -P ~/Documents/tools/Apk/ https://github.com/patrickfav/uber-apk-signer/releases/download/v1.3.0/uber-apk-signer-1.3.0.jar
$ $ java -jar ~/Documents/tools/Apk/uber-apk-signer-1.3.0.jar -apk three_new.apk
```

最後將處理完的 apk 丟入模擬器中並點擊 app 裡的按鈕就能拿到 flag 了：
![image](https://hackmd.io/_uploads/HJz2cS5DJx.png)

### Summary
Flag: `picoCTF{tis.but.a.scratch}`

### Resource
[Android App 逆向入門之一：拆開與重組 apk](https://blog.huli.tw/2023/04/27/android-apk-decompile-intro-1/)
[Github - uber-apk-signer](https://github.com/patrickfav/uber-apk-signer)


## droids4 <span style="color: red;"> [Hard] </span>

### Challenge description
Reverse the pass, patch the file, get the flag. Check out this [file](https://jupiter.challenges.picoctf.org/static/926d4bfd7030b13dbc98ca26e608c740/four.apk).

### Solution
跟上題一樣，用 jadx 查看反編譯後的程式碼：
```java
public class FlagstaffHill {
    public static native String cardamom(String str);

    public static String getFlag(String input, Context ctx) {
        StringBuilder ace = new StringBuilder("aaa");
        StringBuilder jack = new StringBuilder("aaa");
        StringBuilder queen = new StringBuilder("aaa");
        StringBuilder king = new StringBuilder("aaa");
        ace.setCharAt(0, (char) (ace.charAt(0) + 4));
        ace.setCharAt(1, (char) (ace.charAt(1) + 19));
        ace.setCharAt(2, (char) (ace.charAt(2) + 18));
        jack.setCharAt(0, (char) (jack.charAt(0) + 7));
        jack.setCharAt(1, (char) (jack.charAt(1) + 0));
        jack.setCharAt(2, (char) (jack.charAt(2) + 1));
        queen.setCharAt(0, (char) (queen.charAt(0) + 0));
        queen.setCharAt(1, (char) (queen.charAt(1) + 11));
        queen.setCharAt(2, (char) (queen.charAt(2) + 15));
        king.setCharAt(0, (char) (king.charAt(0) + 14));
        king.setCharAt(1, (char) (king.charAt(1) + 20));
        king.setCharAt(2, (char) (king.charAt(2) + 15));
        if (input.equals("".concat(queen.toString()).concat(jack.toString()).concat(ace.toString()).concat(king.toString()))) {
            return "call it";
        }
        return "NOPE";
    }
}
```

可以看到我們需要將 `return "call it";` 更改為 `return cardamom(input);`。跟上一題一樣，先將 apk 解開，然後修改 `four/smali/com/hellocmu/picoctf/FlagstaffHill.smali`：

```diff
-    const-string v5, "call it"
+    invoke-static {p0}, Lcom/hellocmu/picoctf/FlagstaffHill;->cardamom(Ljava/lang/String;)Ljava/lang/String;
+    move-result-object v5
```

patch 完檔案就可以將其打包並丟到模擬器中了，但我們還要找到 pass。跟 droids2 一樣，我們可以直接把檢查密碼的邏輯修改成印出密碼，然後讓 java 幫我們印出：

```java
public class Main {

    public static void main(String[] args) {
        StringBuilder ace = new StringBuilder("aaa");
        StringBuilder jack = new StringBuilder("aaa");
        StringBuilder queen = new StringBuilder("aaa");
        StringBuilder king = new StringBuilder("aaa");
        ace.setCharAt(0, (char) (ace.charAt(0) + 4));
        ace.setCharAt(1, (char) (ace.charAt(1) + 19));
        ace.setCharAt(2, (char) (ace.charAt(2) + 18));
        jack.setCharAt(0, (char) (jack.charAt(0) + 7));
        jack.setCharAt(1, (char) (jack.charAt(1) + 0));
        jack.setCharAt(2, (char) (jack.charAt(2) + 1));
        queen.setCharAt(0, (char) (queen.charAt(0) + 0));
        queen.setCharAt(1, (char) (queen.charAt(1) + 11));
        queen.setCharAt(2, (char) (queen.charAt(2) + 15));
        king.setCharAt(0, (char) (king.charAt(0) + 14));
        king.setCharAt(1, (char) (king.charAt(1) + 20));
        king.setCharAt(2, (char) (king.charAt(2) + 15));
        System.out.print("".concat(queen.toString()).concat(jack.toString()).concat(ace.toString()).concat(king.toString()));
    }
}
```

執行後，可以知道 pass 是 `alphabetsoup`，丟到 app 中點擊按鈕就能拿到 flag 了：

![image](https://hackmd.io/_uploads/HJrugL5PJx.png)

### Summary
Flag: `picoCTF{not.particularly.silly}`


## reverse_cipher <span style="color: red;"> [Hard] </span>

### Challenge description
We have recovered a [binary](https://jupiter.challenges.picoctf.org/static/31c9b832d036a10daeef52d8b4290ef0/rev) and a [text file](https://jupiter.challenges.picoctf.org/static/31c9b832d036a10daeef52d8b4290ef0/rev_this). Can you reverse the flag.

### Solution
將 binary 丟到 ida decompile：

```c
int __fastcall main(int argc, const char **argv, const char **envp)
{
  char ptr[23]; // [rsp+0h] [rbp-50h] BYREF
  char v5; // [rsp+17h] [rbp-39h]
  int v6; // [rsp+2Ch] [rbp-24h]
  FILE *v7; // [rsp+30h] [rbp-20h]
  FILE *stream; // [rsp+38h] [rbp-18h]
  int j; // [rsp+44h] [rbp-Ch]
  int i; // [rsp+48h] [rbp-8h]
  char v11; // [rsp+4Fh] [rbp-1h]

  stream = fopen("flag.txt", "r");
  v7 = fopen("rev_this", "a");
  if ( !stream )
    puts("No flag found, please make sure this is run on the server");
  if ( !v7 )
    puts("please run this on the server");
  v6 = fread(ptr, 0x18uLL, 1uLL, stream);
  if ( v6 <= 0 )
    exit(0);
  for ( i = 0; i <= 7; ++i )
  {
    v11 = ptr[i];
    fputc(v11, v7);
  }
  for ( j = 8; j <= 22; ++j )
  {
    v11 = ptr[j];
    if ( (j & 1) != 0 )
      v11 -= 2;
    else
      v11 += 5;
    fputc(v11, v7);
  }
  v11 = v5;
  fputc(v5, v7);
  fclose(v7);
  return fclose(stream);
}
```
可以看到，程式會讀入 `flag.txt` 然後處理裡面的內容後寫入 `rev_this`。

其中前 7 個字元不變，後面 8~23 個字元，如果是 index 是奇數就輸出其 ascii number - 2 的字元，否則輸出其 ascii number + 5 的字元。所以就根據 index 是否為奇數計算原本的 ascii number 並輸出成字元就可以拿到 flag 了。 


solve script：

```python
rev_this = "picoCTF{w1{1wq85jc=2i0<}"
flag_content = ""

for j in range(8, 23):
    offset = -5 if j % 2 == 0 else 2
    flag_content += chr(ord(rev_this[j]) + offset)

print(f"picoCTF{{{flag_content}}}")
```

### Summary
Flag: `picoCTF{r3v3rs3xxxxxxxx}`


## Need For Speed <span style="color: red;"> [Hard] </span>

### Challenge description
The name of the game is [speed](https://www.youtube.com/watch?v=8piqd2BWeGI). Are you quick enough to solve this problem and keep it above 50 mph? [need-for-speed](https://jupiter.challenges.picoctf.org/static/27dd5548b14661f65ce3ac6a8a8f575b/need-for-speed).

### Solution
將程式丟到 ida 裡面 decompile 後可以看到程式會用 alarm 來讓程式報錯：

```c
unsigned int set_timer()
{
  if ( __sysv_signal(14, alarm_handler) == (__sighandler_t)-1LL )
  {
    puts("\n\nSomething bad happened here. ");
    exit(0);
  }
  return alarm(1u);
}
```

我們可以丟到 gdb 設定 `handle SIGALRM ignore` 讓無視 SIGALRM 繼續執行：

```bash
gef➤  handle SIGALRM ignore
Signal        Stop      Print   Pass to program Description
SIGALRM       No        Yes     No              Alarm clock
gef➤  r
Starting program: /home/ls0723000/need-for-speed 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Keep this thing over 50 mph!
============================

Creating key...

Program received signal SIGALRM, Alarm clock.
Finished
Printing flag:
PICOCTF{Good job keeping bus #xxxxxxxx speeding along!}
[Inferior 1 (process 1691) exited normally]
```

然後就能拿到 flag 了。

### Summary
Flag: `PICOCTF{Good job keeping bus #xxxxxxxx speeding along!}`


## Forky <span style="color: red;"> [Hard] </span>

### Challenge description
In [this program](https://jupiter.challenges.picoctf.org/static/30d2f832b77911e86b909e16c6f6232d/vuln), identify the last integer value that is passed as parameter to the function doNothing().

### Solution
將程式丟到 ida 裡面 decompile 後可以看到程式會進行 4 次 fork：
```c
int __cdecl main(int argc, const char **argv, const char **envp)
{
  _DWORD *v4; // [esp+8h] [ebp-Ch]

  v4 = (_DWORD *)mmap(0, 4, 3, 33, -1, 0);
  *v4 = 1000000000;
  fork();
  fork();
  fork();
  fork();
  *v4 += 1234567890;
  doNothing(*v4);
  return 0;
}
```

所以 `v4` 的值為 `1000000000 + 2 ^ 4 * 1234567890`，而因為 C 存在溢位的情況，所以 `v4` 最後的值會是溢位後的結果。我們可以用 numpy 幫我們計算溢位後的數字：

```python
import numpy as np

print(np.int32(1000000000 + 2 ** 4 * 1234567890))
```

最後計算出來的結果就是 flag 了。

### Summary
Flag: `picoCTF{-721750240}`


# Cryptography

## The Numbers <span style="color: green;"> [Easy] </span>

### Challenge description
The [numbers](https://jupiter.challenges.picoctf.org/static/f209a32253affb6f547a585649ba4fda/the_numbers.png)... what do they mean?

### Solution
題目給的圖片：
![image](https://hackmd.io/_uploads/SJefE_qwyl.png)

16, 9, 3, 15, 3, 20, 6 照順序對應到 a-z 中會是 "picoCTF"，所以可以知道圖中每個數字代表的是在 a-z 中的第幾位。

solve script：

```python
import string

flag_list = [16, 9, 3, 15, 3, 20, 6, "{", 20, 8, 5, 14, 21, 13, 2, 5, 18, 19, 13, 1, 19, 15, 14, "}"]
flag = "".join([string.ascii_lowercase[x-1] if isinstance(x, int) else x for x in flag_list])
print(flag)
```

### Summary
Flag: `picoctf{thenumbersxxxxx}`


## 13 <span style="color: green;"> [Easy] </span>

### Challenge description
Cryptography can be easy, do you know what ROT13 is? `cvpbPGS{abg_gbb_onq_bs_n_ceboyrz}`

### Solution
rot 13 轉回去就可以拿到 flag 了。

```bash
echo "cvpbPGS{abg_gbb_onq_bs_n_ceboyrz}" | tr "a-zA-Z" "n-za-mN-ZA-M"
```

### Summary
Flag: `picoCTF{not_too_bad_of_a_xxxxxxx}`


## caesar <span style="color: orange;"> [Medium] </span>

### Challenge description
Decrypt this [message](https://jupiter.challenges.picoctf.org/static/49f31c8f17817dc2d367428c9e5ab0bc/ciphertext).

### Solution
凱薩密碼只要直接爆破 26 種可能就可以知道 flag 了：

```python
import string


def num2char(num):
    return string.ascii_lowercase[num]


def char2num(char):
    return string.ascii_lowercase.index(char)


cipher = open("ciphertext", "r").read().strip()

for i in range(26):
    decrypt = "".join([num2char((char2num(c) + i) % 26) for c in cipher[8:-1]])
    print(f"Shift: {i}")
    print(f"picoCTF{{{decrypt}}}")
```

執行後可以發現 shift 4 位的時候可以解出有意義的文字，所以那個就是 flag。

### Summary
Flag: `picoCTF{crossingtherubiconvfhsjkou}`


## Easy1 <span style="color: orange;"> [Medium] </span>

### Challenge description
The one time pad can be cryptographically secure, but not when you know the key. Can you solve this? We've given you the encrypted flag, key, and a table to help `UFJKXQZQUNB` with the key of `SOLVECRYPTO`. Can you use this [table](https://jupiter.challenges.picoctf.org/static/1fd21547c154c678d2dab145c29f1d79/table.txt) to solve it?.

### Solution
從題目提供的 table 中可以知道這個是維吉尼亞密碼，直接用線上工具解開就可以拿到 flag 了：

![image](https://hackmd.io/_uploads/H1iULi9PJg.png)

### Summary
Flag: `picoCTF{cryptoisxxx}`

### Resource
[在线计算器: 维吉尼亚密码](https://zh.planetcalc.com/2468/)


## Mr-Worldwide <span style="color: orange;"> [Medium] </span>

### Challenge description
A musician left us a [message](https://jupiter.challenges.picoctf.org/static/d5570d48262dbba2a31f2a940409ad9d/message.txt). What's it mean?

### Solution
message 的內容：

```
picoCTF{(35.028309, 135.753082)(46.469391, 30.740883)(39.758949, -84.191605)(41.015137, 28.979530)(24.466667, 54.366669)(3.140853, 101.693207)_(9.005401, 38.763611)(-3.989038, -79.203560)(52.377956, 4.897070)(41.085651, -73.858467)(57.790001, -152.407227)(31.205753, 29.924526)}
```

裡面每組數字看起來是經緯度，丟到 google 後會對應到不同的地方，像是 (35.028309, 135.753082) 為京都：

![image](https://hackmd.io/_uploads/Bkrf_jcw1l.png)

嘗試一下後發現把每個經緯度對應到的地區的第一個英文字母塞到 message 中的對應位置就是 flag 了。

### Summary
Flag: `picoCTF{KODIAK_ALASKA}`


## waves over lambda <span style="color: orange;"> [Medium] </span>

### Challenge description
We made a lot of substitutions to encrypt this. Can you decrypt it? Connect with `nc jupiter.challenges.picoctf.org 43522`.

### Solution
連上 server 後會拿到一段經過多次替換的文字，可以丟到 quipqiup 中讓他幫我們分析：

![image](https://hackmd.io/_uploads/B10LtsqDJl.png)

可以看到，flag 就在分析完的文章中。

### Summary
Flag: `frequency_is_c_over_lambda_xxxxxxxxx`


## Flags <span style="color: orange;"> [Medium] </span>

### Challenge description
What do the [flags](https://jupiter.challenges.picoctf.org/static/fbeb5f9040d62b18878d199cdda2d253/flag.png) mean?

### Solution
搜尋題目提供的圖片裡面的每個圖案後，會發現它們是跟航海有關的訊號旗：
![image](https://hackmd.io/_uploads/H1AO3s5Pke.png)

![image](https://hackmd.io/_uploads/SkyeAicDyg.png)
所以只要照順序將其一一對應回去就能拿到 flag 了。

### Summary
Flag: `PICOCTF{F1AG5AND5TUFF}`


## Tapping <span style="color: orange;"> [Medium] </span>

### Challenge description
Theres tapping coming in from the wires. What's it saying `nc jupiter.challenges.picoctf.org 9422`.

### Solution

連上 server 後會收到一串摩斯密碼，將其解回去就能拿到 flag 了。
```
.--. .. -.-. --- -.-. - ..-. { -- ----- .-. ... ...-- -.-. ----- -.. ...-- .---- ... ..-. ..- -. ..--- -.... ---.. ...-- ---.. ..--- ....- -.... .---- ----- }
```

### Summary
Flag: `PICOCTF{M0RS3C0D31SFUN2683824610}`

### Resource
[Morse Code Translator](https://morsecode.world/international/translator.html)


## john_pollard <span style="color: orange;"> [Medium] </span>

### Challenge description
Sometimes RSA [certificates](https://jupiter.challenges.picoctf.org/static/c882787a19ed5d627eea50f318d87ac5/cert) are breakable

### Solution
將題目提供的憑證下載下來後，用 `openssl` 來查看憑證的內容：
```bash
openssl x509 -in cert -text -noout
```

可以看到輸出結果中包含了憑證的模數，而且數值很小：
```
Certificate:
    Data:
        Version: 1 (0x0)
        Serial Number: 12345 (0x3039)
        Signature Algorithm: md2WithRSAEncryption
        Issuer: CN=PicoCTF
        Validity
            Not Before: Jul  8 07:21:18 2019 GMT
            Not After : Jun 26 17:34:38 2019 GMT
        Subject: OU=PicoCTF, O=PicoCTF, L=PicoCTF, ST=PicoCTF, C=US, CN=PicoCTF
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (53 bit)
                Modulus: 4966306421059967 (0x11a4d45212b17f)
                Exponent: 65537 (0x10001)
    <SNIP>
```

直接用 FactorDB 分解 p 和 q：

```python
from factordb.factordb import FactorDB

n = 4966306421059967

f = FactorDB(n)
f.connect()

p, q = f.get_factor_list()

print(p, q)
```

### Summary
Flag: `picoCTF{73176001,67867967}`

### Resource
[FactorDB](https://factordb.com/)


## la cifra de <span style="color: orange;"> [Medium] </span>

### Challenge description
I found this cipher in an old book. Can you figure out what it says? Connect with `nc jupiter.challenges.picoctf.org 32411`.

### Solution
連上 server 後會收到一串加密過的訊息，丟到 dCode 的密碼辨識功能中，出來的結果告訴我們可能是透過維吉尼雅密碼進行加密的：

![image](https://hackmd.io/_uploads/HkFj2Fsvke.png)

最後把密文整個維吉尼雅破解工具中就可以看到 flag 被破解出來了：

![Capture-2025-01-20-165351 (1)](https://hackmd.io/_uploads/ry7I19iw1l.png)

### Summary
Flag: `picoCTF{b311a50_0r_v1gn3r3_c1ph3rxxxxxxxx}`

### Resource
[dCode.fr - cipher identifier](https://www.dcode.fr/cipher-identifier)

[dCode.fr - vigenere cipher](https://www.dcode.fr/vigenere-cipher)


## AES-ABC <span style="color: red;"> [Hard] </span>

### Challenge description
AES-ECB is bad, so I rolled my own cipher block chaining mechanism - Addition Block Chaining! You can find the source here: [aes-abc.py](https://jupiter.challenges.picoctf.org/static/1b1beb0a49c958d0f2423800eaff58a7/aes-abc.py). The AES-ABC flag is [body.enc.ppm](https://jupiter.challenges.picoctf.org/static/1b1beb0a49c958d0f2423800eaff58a7/body.enc.ppm)

### Solution

在[維基百科](https://zh.wikipedia.org/wiki/%E5%88%86%E7%BB%84%E5%AF%86%E7%A0%81%E5%B7%A5%E4%BD%9C%E6%A8%A1%E5%BC%8F#%E7%94%B5%E5%AD%90%E5%AF%86%E7%A0%81%E6%9C%AC%EF%BC%88ECB%EF%BC%89)中有關於 AES-ECB 的介紹，可以知道因為 ECB 會將相同的明文塊加密成相同的密文塊，所以在圖片上的效果不是很好。

而這題提供的程式主要是在 ECB 加密後的結果上，額外插入一個 iv，並根據 iv 將 block 從前到後額外進行一些運算：

```python
def aes_abc_encrypt(pt):
    cipher = AES.new(KEY, AES.MODE_ECB)
    ct = cipher.encrypt(pad(pt))

    blocks = [ct[i * BLOCK_SIZE:(i+1) * BLOCK_SIZE] for i in range(len(ct) / BLOCK_SIZE)]
    iv = os.urandom(16)
    blocks.insert(0, iv)
    
    for i in range(len(blocks) - 1):
        prev_blk = int(blocks[i].encode('hex'), 16)
        curr_blk = int(blocks[i+1].encode('hex'), 16)

        n_curr_blk = (prev_blk + curr_blk) % UMAX
        blocks[i+1] = to_bytes(n_curr_blk)

    ct_abc = "".join(blocks)
 
    return iv, ct_abc, ct
```

所以只要根據 iv 逆著運算回去拿到 AES-ECB 加密後的結果就可以了：

```python
BLOCK_SIZE = 16
UMAX = int(pow(256, BLOCK_SIZE))

with open('body.enc.ppm', 'rb') as f:
    header = f.readline() + f.readline() + f.readline()
    data = f.read()

blocks = [int.from_bytes(data[i * BLOCK_SIZE:(i + 1) * BLOCK_SIZE], 'big') for i in range(len(data) // BLOCK_SIZE)]
blocks_ecb = [(blocks[i + 1] - blocks[i]) % UMAX for i in range(len(blocks) - 1)]

with open('flag.enc.ppm', 'wb') as fw:
    fw.write(header + b''.join(b.to_bytes(BLOCK_SIZE, 'big') for b in blocks_ecb))
```

然後查看 `flag.enc.ppm`，就會在圖片中看到 flag 了。

### Summary
Flag: `picoCTF{d0Nt_r0ll_yoUr_xxxxxxx}`


## miniRSA <span style="color: red;"> [Hard] </span>

### Challenge description
Let's decrypt this: [ciphertext](https://jupiter.challenges.picoctf.org/static/eb5e6df8e14c52873cf88c582a1a4008/ciphertext)? Something seems a bit small.

### Solution
從題目提供的檔案中我們可以知道 e 很小，在 $m^3 < 3$ 的這種情況直接開三次方根就可以算出原本的 m 了：

```
N: 29331922499794985782735976045591164936683059380558950386560160105740343201513369939006307531165922708949619162698623675349030430859547825708994708321803705309459438099340427770580064400911431856656901982789948285309956111848686906152664473350940486507451771223435835260168971210087470894448460745593956840586530527915802541450092946574694809584880896601317519794442862977471129319781313161842056501715040555964011899589002863730868679527184420789010551475067862907739054966183120621407246398518098981106431219207697870293412176440482900183550467375190239898455201170831410460483829448603477361305838743852756938687673
e: 3

ciphertext (c): 2205316413931134031074603746928247799030155221252519872650080519263755075355825243327515211479747536697517688468095325517209911688684309894900992899707504087647575997847717180766377832435022794675332132906451858990782325436498952049751141 
```

solve script：
```python
from Crypto.Util.number import long_to_bytes
from gmpy2 import iroot

n = 29331922499794985782735976045591164936683059380558950386560160105740343201513369939006307531165922708949619162698623675349030430859547825708994708321803705309459438099340427770580064400911431856656901982789948285309956111848686906152664473350940486507451771223435835260168971210087470894448460745593956840586530527915802541450092946574694809584880896601317519794442862977471129319781313161842056501715040555964011899589002863730868679527184420789010551475067862907739054966183120621407246398518098981106431219207697870293412176440482900183550467375190239898455201170831410460483829448603477361305838743852756938687673
e = 3
c = 2205316413931134031074603746928247799030155221252519872650080519263755075355825243327515211479747536697517688468095325517209911688684309894900992899707504087647575997847717180766377832435022794675332132906451858990782325436498952049751141

if iroot(c, e)[1]:
    flag = long_to_bytes(iroot(c, e)[0]).decode()
    print(flag)
```

### Summary
Flag: `picoCTF{n33d_a_lArg3r_e_xxxxxxxx}`


## rsa-pop-quiz <span style="color: red;"> [Hard] </span>

### Challenge description
Class, take your seats! It's PRIME-time for a quiz... `nc jupiter.challenges.picoctf.org 1981`

### Solution
連上後會問一連串 RSA 相關的問題，用下面幾個式子推一下就可以拿到答案了：

```python
n = p * q
totient = (p - 1) * (q - 1)
d = pow(e, -1, totient)
c = pow(m, e, n)
m = pow(c, d, n)
```

最後把最後一題算出來的 plaintext 轉回 ascii 就可以拿到 flag 了。

### Summary
Flag: `picoCTF{wA8_th4t$_ill3aGal..xxxxxxxx}`


## b00tl3gRSA2 <span style="color: red;"> [Hard] </span>

### Challenge description
In RSA d is a lot bigger than e, why don't we use d to encrypt instead of e? Connect with `nc jupiter.challenges.picoctf.org 18243`.

### Solution
連上 server 後拿到了 c, n, e：
```
c: 85834293497533957436691992989020145290174917906572213883475460283218874518185414171477722376162890834272787612272208790956043659375474973614441338273240261639172686105889571933866352008105723235934748641303453747950363275260597624690025603876753519587312921763952214001042760070828009167397038688462585711830
n: 110226030519809485542323932026957431014099119244128173357812506357988443046556456458550282116546605853127651981223036687438540005337731383782535070798396214464486298384427058695821560827447632804183216216766668183743562783379289376673704531204537391206988134190705855419834086747623709523313516906678585633541
e: 98772359038968089132002648216230969546439400275415646684838412818493176294232586454083684298311374062539139995747215703239439383759844835366234907041479061207152704364095985876480151312903436976618451732664257250426519407276922219451731308809687133615933983163203332136556556102138190489500297473639358434337
```

當 e 過大或過小的時候，可以嘗試 wiener attack：

```bash
$ ~/Documents/tools/RSA/RsaCtfTool/RsaCtfTool.py --attack wiener -e 114145856108999468617578389354940683809841467770192254995042463330482468949478183941051398448574746309195970901049225962924695212052634021531893790526880257876936774702711357317886020530380791629595234846295809279723653706575293076619640669581799333759392559655499642461370320292695769337278820501227121212565 -n 131285463080948003278114369757546332897730476356243130440148434026953362832206380037989601799270689332685918901775383407314644357106640386604933633136662269510574389095061577705121535102908597559793129287218760857865913764213542398113966331431886151277774350412212579973046963871901899845844675676088368136041 --decrypt 23870756143632295978013372570068029840766716521632911970317057063737505739180212077602945699358205656535876075402152990481797815151911129377241185295872512145264119171758540192548132058854799123769463478143436417196802648916429895670744188850484554489796410004342496143198471566766924306623164392655062388748
```

```
utf-8 : picoCTF{bad_1d3a5_xxxxxxx}
```

### Summary
Flag: `picoCTF{bad_1d3a5_xxxxxxx}`


## b00tl3gRSA3 <span style="color: red;"> [Hard] </span>

### Challenge description
Why use p and q when I can use more? Connect with `nc jupiter.challenges.picoctf.org 3726`.

### Solution
連上 server 後拿到了 c, n, e：
```
c: 1011168439494949362061752987788733119558905451276054868796130963896349359920420360844631269358743618291058119498272262062798437075344286334819376763877241678884636918842529601936565100475981287468025687397122504749534472632525008282846673051820975476540348106377708858057178485913461089153666373468806144237601031982637619090468286700880847550
n: 54983018958565765822988458978042802633131867054148292059426571545071247927270298814283567276214772584132370818275936618531180131646572423656589460847636129927900948922808480176535390166186195940693053145057983226148971832697028086858683074435400469433035314258655433910950462494444935260369597343595990198827097154974158371383285440184106195781
e: 65537
```

這次這題的 n 有多個質數 factor，我們可以利用 Alpertron caculator 幫我們計算 totient：

![image](https://hackmd.io/_uploads/B1mgUyhDke.png)

有了 totient 之後就可以算出 d 並解出 flag 了：

```python
import gmpy2
from Crypto.Util.number import long_to_bytes

c = 1011168439494949362061752987788733119558905451276054868796130963896349359920420360844631269358743618291058119498272262062798437075344286334819376763877241678884636918842529601936565100475981287468025687397122504749534472632525008282846673051820975476540348106377708858057178485913461089153666373468806144237601031982637619090468286700880847550
n = 54983018958565765822988458978042802633131867054148292059426571545071247927270298814283567276214772584132370818275936618531180131646572423656589460847636129927900948922808480176535390166186195940693053145057983226148971832697028086858683074435400469433035314258655433910950462494444935260369597343595990198827097154974158371383285440184106195781
e = 65537
phi = 54983018811128826841550483380894706385201304812442825712792139639855072851463189249456773561322958606377525048209429466230874399798572720395808424013871873826738056871058308436045450838187009537335022842604469832022418736022000690711851293311647813614531170310007706703257007897855604656621875327809478170983612913069551167203180544000000000000

d = gmpy2.invert(e, phi)
m = pow(c, d, n)
print(long_to_bytes(m).decode())
```

或是也可以用 `sympy` 計算 totient：
```python
from sympy.ntheory import factorint

n = 54983018958565765822988458978042802633131867054148292059426571545071247927270298814283567276214772584132370818275936618531180131646572423656589460847636129927900948922808480176535390166186195940693053145057983226148971832697028086858683074435400469433035314258655433910950462494444935260369597343595990198827097154974158371383285440184106195781

f = factorint(n)
phi = 1
for p in f.keys():
    phi *= (p - 1)
```

### Summary
Flag: `picoCTF{too_many_fact0rs_xxxxxxx}`

### Resource
[Integer factorization calculator](https://www.alpertron.com.ar/ECM.HTM)


# Forensics

## Glory of the Garden <span style="color: green;"> [Easy] </span>

### Challenge description
This [garden](https://jupiter.challenges.picoctf.org/static/d0e1ffb10fc0017c6a82c57900f3ffe3/garden.jpg) contains more than it seems.

### Solution
用 string + grep 就會發現 flag 以明文直接藏在圖片裡：

```bash
$ strings garden.jpg | grep pico
Here is a flag "picoCTF{more_than_m33ts_the_3y3xxxxxxxx}"
```

### Summary
Flag: `picoCTF{more_than_m33ts_the_3y3xxxxxxxx}`


## shark on wire 1 <span style="color: orange;"> [Medium] </span>

### Challenge description
We found this [packet capture](https://jupiter.challenges.picoctf.org/static/483e50268fe7e015c49caf51a69063d0/capture.pcap). Recover the flag.

### Solution
用 wireshark 打開 pcap 之後，會發現有不少 udp 流量。右鍵點擊 Follow > UDP Stream 查看每個 Stream 的內容就會看到 flag 了。

### Summary
Flag: `picoCTF{StaT31355_xxxxxxxx}`


## shark on wire 2 <span style="color: orange;"> [Medium] </span>

### Challenge description
We found this [packet capture](https://jupiter.challenges.picoctf.org/static/b506393b6f9d53b94011df000c534759/capture.pcap). Recover the flag that was pilfered from the network.

### Solution
可以看到，從 `10.0.0.66` 發出的 udp 請求的 port，後三位剛好是 flag 的 ascii number：

![截圖 2025-01-21 下午6.13.01](https://hackmd.io/_uploads/H1s4Xl6w1g.png)

![截圖 2025-01-21 下午6.16.06](https://hackmd.io/_uploads/B1meVxaw1g.png)

```
112 -> p
105 -> i
99  -> c
111 -> o
67  -> C
84  -> T
```

所以就寫個 script 把 port 都抓出來轉回字母就可以了：

```python
import pyshark

capture = pyshark.FileCapture('./capture.pcap', display_filter='ip.addr == 10.0.0.66')

data = []
for pkt in capture:
    if pkt.udp.port != '5000':
        data.append(chr(int(pkt.udp.port[1:])))

print("".join(data))
```

### Summary
Flag: `picoCTF{p1LLf3r3d_data_xxxxxxxxx}`


## like1000 <span style="color: orange;"> [Medium] </span>

### Challenge description
This [.tar file](https://jupiter.challenges.picoctf.org/static/52084b5ad360b25f9af83933114324e0/1000.tar) got tarred a lot.

### Solution
把 1000 層的 .tar 檔解開會出現 flag.png，打開來之後就可以看到 flag 了。

```bash
$ for i in $(seq 1000 -1 1); do tar -xf "$i.tar"; done
```

### Summary
Flag: `picoCTF{l0t5_0f_TAR5}`


## What Lies Within <span style="color: orange;"> [Medium] </span>

### Challenge description
There's something in the [building](https://jupiter.challenges.picoctf.org/static/011955b303f293d60c8116e6a4c5c84f/buildings.png). Can you retrieve the flag?

### Solution
用 zsteg 工具查看就可以看到 flag 了：
```bash
$ zsteg buildings.png 
```

```
b1,rgb,lsb,xy       .. text: "picoCTF{h1d1ng_1n_xxxxxxxx}"
```

### Summary
Flag: `picoCTF{h1d1ng_1n_xxxxxxxx}`


## c0rrupt <span style="color: orange;"> [Medium] </span>

### Challenge description
We found this [file](https://jupiter.challenges.picoctf.org/static/ab30fcb7d47364b4190a7d3d40edb551/mystery). Recover the flag.

### Solution
從題目的 hint 中可以知道我們要修復檔案的 header。查看檔案的 hex 值後，可以看到前面幾個 bytes 很接近 PNG file signature：

```bash
$ cat mystery | xxd | head
```

```
00000000: 8965 4e34 0d0a b0aa 0000 000d 4322 4452  .eN4........C"DR
00000010: 0000 066a 0000 0447 0802 0000 007c 8bab  ...j...G.....|..
00000020: 7800 0000 0173 5247 4200 aece 1ce9 0000  x....sRGB.......
00000030: 0004 6741 4d41 0000 b18f 0bfc 6105 0000  ..gAMA......a...
00000040: 0009 7048 5973 aa00 1625 0000 1625 0149  ..pHYs...%...%.I
00000050: 5224 f0aa aaff a5ab 4445 5478 5eec bd3f  R$......DETx^..?
00000060: 8e64 cd71 bd2d 8b20 2080 9041 8302 08d0  .d.q.-.  ..A....
00000070: f9ed 40a0 f36e 407b 9023 8f1e d720 8b3e  ..@..n@{.#... .>
00000080: b7c1 0d70 0374 b503 ae41 6bf8 bea8 fbdc  ...p.t...Ak.....
00000090: 3e7d 2a22 336f de5b 55dd 3d3d f920 9188  >}*"3o.[U.==. ..
```

```
PNG File Signature: 89 50 4E 47 0D 0A 1A 0A
```

根據這篇文章 [PNG structure for beginner](https://medium.com/@0xwan/png-structure-for-beginner-8363ce2a9f73) 中的內容，我們可以先將 png file signature 和 IHDR 修復回去：

```bash
$ hexeditor mystery
```

![截圖 2025-01-23 晚上11.21.41](https://hackmd.io/_uploads/HJb9R0ku1x.png)

接下來檢查 `pngcheck` 來檢查圖片中的每個 chunk：

```bash
$ pngcheck -v mystery
File: mystery (202940 bytes)
  chunk IHDR at offset 0x0000c, length 13
    1642 x 1095 image, 24-bit RGB, non-interlaced
  chunk sRGB at offset 0x00025, length 1
    rendering intent = perceptual
  chunk gAMA at offset 0x00032, length 4: 0.45455
  chunk pHYs at offset 0x00042, length 9: 2852132389x5669 pixels/meter
  CRC error in chunk pHYs (computed 38d82c82, expected 495224f0)
ERRORS DETECTED in mystery
```

從錯誤中可以看到 pHYs chunk 的 CRC 計算結果與預期的不同，並且 `pixels/meter` 的大小為 `2852132389x5669`，看起來不太合理，所以我們可以檢查一下 pHYs 整個 chunk。

pHYs 在 offset 0x42 的位置，根據它的結構比對 data：

![image](https://hackmd.io/_uploads/r106VylOyx.png)

```bash
$ xxd -g 1 -s 0x42 -l $((4+4+4+1+4)) mystery
```

![upload_581f4fac76c46ba54fdebb8753e981ef](https://hackmd.io/_uploads/Bkf2PJldJg.png)

一般 Pixels per units 在 X, Y axis 應該會相同，且 X axis 的值明顯過大，因此更改 X axis 的值使其與 Y axis 相同：

![截圖 2025-01-24 凌晨12.07.08](https://hackmd.io/_uploads/Bku4tkgOkx.png)

接著再重新檢查一次檔案：

```bash
$ pngcheck -v mystery
File: mystery (202940 bytes)
  chunk IHDR at offset 0x0000c, length 13
    1642 x 1095 image, 24-bit RGB, non-interlaced
  chunk sRGB at offset 0x00025, length 1
    rendering intent = perceptual
  chunk gAMA at offset 0x00032, length 4: 0.45455
  chunk pHYs at offset 0x00042, length 9: 5669x5669 pixels/meter (144 dpi)
:  invalid chunk length (too large)
ERRORS DETECTED in mystery
```

訊息告訴我們 pHYs 後的 chunk 大小過大。根據 pHYs 的結構可以算出來下一個 chunk 在 offset `0x42 + 0x4 (Type) + 0x9 (Data) + 0x4 (CRC) = 0x53` 的地方，透過查看 `0x53` 後的 8 個 bytes 來確定該 chunk 的 Length 和 Type：

```bash
$ xxd -g 1 -s 0x53 -l 8 mystery 
00000053: aa aa ff a5 ab 44 45 54                          .....DET
```

IDAT 的 type byte 是 `49 44 41 54`，與上面的最為接近，因此先將對應的數值更改回去：

![截圖 2025-01-24 凌晨12.21.10](https://hackmd.io/_uploads/HJZK2yg_yl.png)

接下來用 `binwalk` 來確定這個區塊的大小：

```bash
$ binwalk -R "IDAT" mystery

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
87            0x57            Raw signature (IDAT)
65544         0x10008         Raw signature (IDAT)
131080        0x20008         Raw signature (IDAT)
196616        0x30008         Raw signature (IDAT)
```

所以當前 IDAT chunk 的大小為：

```
0x10008 - 0x4 (current chunk type) - 0x4 (current chunk CRC) - 0x4 (next chunk length) - 0x57 (next IDAT start offset) = 0xFFA5
```

![截圖 2025-01-24 凌晨12.49.49](https://hackmd.io/_uploads/SJ5NQeeuke.png)

更改完再檢查就會發現沒有錯誤了，這時候將檔案加上 `.png` 打開後就能看到 flag 了。

```bash
$ pngcheck -v mystery
File: mystery (202940 bytes)
  chunk IHDR at offset 0x0000c, length 13
    1642 x 1095 image, 24-bit RGB, non-interlaced
  chunk sRGB at offset 0x00025, length 1
    rendering intent = perceptual
  chunk gAMA at offset 0x00032, length 4: 0.45455
  chunk pHYs at offset 0x00042, length 9: 5669x5669 pixels/meter (144 dpi)
  chunk IDAT at offset 0x00057, length 65445
    zlib: deflated, 32K window, fast compression
  chunk IDAT at offset 0x10008, length 65524
  chunk IDAT at offset 0x20008, length 65524
  chunk IDAT at offset 0x30008, length 6304
  chunk IEND at offset 0x318b4, length 0
No errors detected in mystery (9 chunks, 96.3% compression)
```

![mystery_fix](https://hackmd.io/_uploads/rJzb4geOye.png)

### Summary

Flag: `picoCTF{c0rrupt10n_1847995}`


## extensions <span style="color: orange;"> [Medium] </span>

### Challenge description
This is a really weird text file [TXT](https://jupiter.challenges.picoctf.org/static/e7e5d188621ee705ceeb0452525412ef/flag.txt)? Can you find the flag?

### Solution
用 `file` 檢查檔案會發現其實是一個 PNG 檔：

```bash
$ file flag.txt 
flag.txt: PNG image data, 1697 x 608, 8-bit/color RGB, non-interlaced
```

將檔案的 ext 改回 `.png`，然後再打開就能看到 flag 了。

### Summary
Flag: `picoCTF{now_you_know_about_xxxxxxxxxx}`


## WhitePages <span style="color: orange;"> [Medium] </span>

### Challenge description
I stopped using YellowPages and moved onto WhitePages... but [the page they gave me](https://jupiter.challenges.picoctf.org/static/fa4a277cfa846e07a5981d8a19288a2e/whitepages.txt) is all blank!

### Solution
讀取檔案後會發現內容中只有空格，而如果用 python 讀取內容並轉換成 `set`，則可以看到這些空格是由兩種字元組成的：

```python
$ python3            
Python 3.12.8 (main, Dec 13 2024, 13:19:48) [GCC 14.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> content = open('whitepages.txt', 'r').read()
>>> set(content)
{' ', '\u2003'}
```

可以猜測其中這兩個分別代表二進制中的 0 / 1，所以接著將空格轉換成二進制數值然後再轉換回文字：

```python
from Crypto.Util.number import long_to_bytes

content = open('whitepages.txt', 'r').read()
bin_value = "".join("1" if x == " " else "0" for x in content)
print(long_to_bytes(int(bin_value, 2)).decode())
```

然後就可以在轉換出來的文字中看到 flag 了。

### Summary
Flag: `picoCTF{not_all_spaces_are_created_equal_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}`


## So Meta <span style="color: orange;"> [Medium] </span>

### Challenge description
Find the flag in this [picture](https://jupiter.challenges.picoctf.org/static/89b371a46702a31aa9931a2a2b12f8bf/pico_img.png).

### Solution
直接用 `string` + `grep` 就可以看到 flag 了：

```bash
$ strings pico_img.png | grep pico
picoCTF{s0_m3ta_xxxxxxxx}
```

### Summary
Flag: `picoCTF{s0_m3ta_xxxxxxxx}`


## m00nwalk <span style="color: orange;"> [Medium] </span>

### Challenge description
Decode this [message](https://jupiter.challenges.picoctf.org/static/d6fcea5e3c6433680ea4f914e24fab61/message.wav) from the moon.

### Solution
從 hint 中可以推測是指 [Slow-scan television (sstv)](https://en.wikipedia.org/wiki/Slow-scan_television)：
- How did pictures from the moon landing get sent back to Earth?

所以我們可以透過 `qsstv` 工具來將音訊轉回影像：

```bash
$ sudo apt update && sudo apt install qsstv pavucontrol
```

首先使用 `pavucontrol` 進行設定：

```bash
$ pactl load-module module-null-sink sink_name=virtual-cable
$ pavucontrol
```

![截圖 2025-01-24 下午1.57.59](https://hackmd.io/_uploads/rkLz3ieO1e.png)

需確定設定中有出現 Null Output device （上圖是在虛擬機中運行，顯示為 virtual-cable device），然後打開 `qsstv`（不要關掉 `pavucontrol`）：

```bash
$ qsstv
```

選擇 `Options > Configuration > Sound` 並將 Audio Interface 設定為 PulseAudio：

![截圖 2025-01-24 下午1.08.38](https://hackmd.io/_uploads/ryMwgjl_yx.png)

以及回到 `pavucontrol` 中 `Recording` 的介面，設定 QSSTV 為 `Monitor of {前面設定的 Null Output device}`：

![upload_b41d97a96d13787c9da4fd1b802c4ec6](https://hackmd.io/_uploads/B1oxtjxOJe.png)

最後執行指令播放題目提供的音檔就可以看到圖片顯示在 `qsstv` 上了：

```bash
$ paplay -d virtual-cable message.wav
```

![截圖 2025-01-24 下午1.59.10](https://hackmd.io/_uploads/rJEW6il_1g.png)


### Summary
Flag: `picoCTF{beep_boop_im_xxxxxxxx}`

### Resource
[How to convert (decode) a Slow-Scan Television transmissions (SSTV) audio file to images using QSSTV in Ubuntu 18.04](https://ourcodeworld.com/articles/read/956/how-to-convert-decode-a-slow-scan-television-transmissions-sstv-audio-file-to-images-using-qsstv-in-ubuntu-18-04)


## m00nwalk2 <span style="color: red;"> [Hard] </span>

### Challenge description
Revisit the last transmission. We think this [transmission](https://jupiter.challenges.picoctf.org/static/599404f0bf7426a5a5c2deb538860cda/message.wav) contains a hidden message. There are also some clues [clue 1](https://jupiter.challenges.picoctf.org/static/599404f0bf7426a5a5c2deb538860cda/clue1.wav), [clue 2](https://jupiter.challenges.picoctf.org/static/599404f0bf7426a5a5c2deb538860cda/clue2.wav), [clue 3](https://jupiter.challenges.picoctf.org/static/599404f0bf7426a5a5c2deb538860cda/clue3.wav).

### Solution
跟上一題一樣，先使用 `qsstv` 和 `pavucontrol` 將四個音檔都解出來。

message：

![message](https://hackmd.io/_uploads/BynNrAxOkx.png)

clue1：

![clue1](https://hackmd.io/_uploads/Sk2c06xuJl.png)

clue2：

![clue2](https://hackmd.io/_uploads/BJLsApedJl.png)

clue3：

![clue3](https://hackmd.io/_uploads/S1f2RTxuke.png)

搜尋 clue3 中的文字 "Alan Eliasen the FutureBoy" 後可以找到一個隱寫術相關的網站：

![image](https://hackmd.io/_uploads/BJs1M0gOkx.png)

![image](https://hackmd.io/_uploads/BJDoGRlu1e.png)

可以看到，網站上寫著：
> These pages use the steghide program to perform steganography, and the files generated are fully compatible with steghide.

所以我們可以用 `steghide` 來代替在網站上 decode（密碼可以從 clue1 解出來的圖片中看到）：

```bash
$ steghide extract -sf message.wav -p hidden_stegosaurus
wrote extracted data to "steganopayload12154.txt".
```

最後執行指令後就可以從結果檔中拿到 flag 了。

### Summary
Flag: `picoCTF{the_answer_lies_hidden_in_xxxxxxxxxxx}`
