JustCTF

This competition was on 30 - 31 January 2021. We placed 90th/804.

Sanity Check

The Sanity Check was slightly tricky. The challenge had to do something with the CTF website itself as the description said. So at the challenge URL, I went to the Network tab under Chrome Dev Tools and hit the record button. I reloaded the challenge to load the network requests and pressed ctrl-f to search for the flag format (justCTF) among the requests.

The flag was in the first request, justCTF{something_h3re!}.

Forgotten name

I googled secret domain name ctf and came across two relevant writeups, writeup 1 and writeup 2.

I used the tool described in writeup 1, the Google Transparency Report, to find other possible subdomains under 2020.justctf.team.

From the search result, I saw

I enumerated domains related to jctf.pro and discovered http://6a7573744354467b633372545f6c34616b735f6f3070737d.web.jctf.pro/. I converted 6a... from hex to ascii and got the flag

That's not crypto

We were given a pyc file, which is the bytecode of a Python file. Using the command uncompyle6 checker.pyc > checker.py (you can install uncompyle6 using pip), I converted it to a Python file which is hosted as checker.py due to the line limits here.

Analyzing the poly function, I found that poly(a, x) is equal to

$a_i{x}^n+a_{i-1}{x}^{n-1}+...+a_0$, where

$a$ and

$x$ are both arrays and

$n$ is the length of

$a$. We're given both

$a$ and the result of the polynomial,

$24196561$, so all I had to do was run a polynomial solver and other basic reversing tricks to get the original value of the flag. The solution, written in SageMath, is sol.sage.

Flag: justCTF{this_is_very_simple_flag_afer_so_big_polynomails}

My Little Pwny

I was given access to a server and port. Upon connecting, I tried inputting random characters to see what they would do. Some would be rejected, and others would be echoed. A particular character, the backtick, would make the program display an error message. I realized that this occurs when you write unsanitized bash that doesn't escape the backtick.

The original program must have looked like echo your_input . When you escape out of this context, you can force the command to be whatever you want. For example, echo `ls` will execute ls only.

I tried `cat flag` but that wouldn't work. I googled bash jail escape ctf and found this article.

25519 - Solved