# N00bzCTF WriteUp
## summary
SUSHI1st 32nd place
## rev
### Vacation
chall
```ps1=
$bytes = [System.Text.Encoding]::ASCII.GetBytes((cat .\flag.txt))
[System.Collections.Generic.List[byte]]$newBytes = @()
$bytes.ForEach({
$newBytes.Add($_ -bxor 3)
})
$newString = [System.Text.Encoding]::ASCII.GetString($newBytes)
echo $newString | Out-File -Encoding ascii .\output.txt
```
solver
```python=
with open('output.txt','r',encoding='ascii') as f:
data = f.read()
data = data.encode()
flag = bytearray([b ^ 3 for b in data])
print(flag.decode())
```
### Brain
chall
```bf=
>+++++++++++[<++++++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++++++++[<+++++++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++[<+++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>+++++++++++++[<++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++++[<++++++++++>-]<[-]>+++++++++++++++++[<+++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>++++++++++++++[<+++++++>-]<[-]>+++++++++++++++++++[<++++++>-]<[-]>+++++++++++++[<++++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++[<++++++>-]<[-]>+++++++[<++++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>-]<[-]>+++++++++++[<+++>-]<[-]>+++++++++++++++++++++++++[<+++++>-]<[-]
```
use [converter](https://github.com/paulkaefer/bftoc/blob/master/bftoc.py)
remove these operations
```cpp=
ptr -= 1;
while (tape[ptr] != 0)
{
tape[ptr] -= 1;
}
```
fixed program
```cpp=
/* This is a translation of bf.bf, generated by bftoc.py (by Paul Kaefer)
* It was generated on Saturday, August 03, 2024 at 11:51AM
*/
#include <stdio.h>
void main(void)
{
int size = 1000;
int tape[size];
int i = 0;
/* Clearing the tape (array) */
for (i=0; i<size; i++)
tape[i] = 0;
int ptr = 0;
ptr += 1;
tape[ptr] += 11;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 10;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 8;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 6;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 8;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 6;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 14;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 7;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 61;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 2;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 41;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 3;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 7;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 7;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 19;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 5;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 11;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 9;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 13;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 4;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 11;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 10;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 19;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 5;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 11;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 9;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 8;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 6;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 10;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 10;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 17;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 3;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 19;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 5;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 7;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 7;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 11;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 10;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 19;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 5;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 14;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 7;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 19;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 6;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 13;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 4;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 7;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 7;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 11;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 10;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 17;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 6;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 7;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 6;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 11;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 9;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 107;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 1;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 11;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 3;
ptr += 1;
tape[ptr] -= 1;
}
ptr += 1;
tape[ptr] += 25;
while (tape[ptr] != 0)
{
ptr -= 1;
tape[ptr] += 5;
ptr += 1;
tape[ptr] -= 1;
}
for(int i = 0;i < 1000;i++) {
printf("%d,",tape[i]);
}
}
```
```bash=
~/dc/ctf/noobz/rev$./a.out
110,48,48,98,122,123,49,95,99,52,110,95,99,48,100,51,95,49,110,95,98,114,52,49,110,102,42,99,107,33,125,0,0,0,0,0,0,0,0 .......
```
```python=
num = [110,48,48,98,122,123,49,95,99,52,110,95,99,48,100,51,95,49,110,95,98,114,52,49,110,102,42,99,107,33,125]
for i in num:
print(chr(i),end="")
print("")
```
```bash=
~/dc/ctf/noobz/rev$python3 bf.py
n00bz{1_c4n_c0d3_1n_br41nf*ck!}
```
### Flag Checker
analyze vba script
```vba=
Rem Attribute VBA_ModuleType=VBAModule
Option VBASupport 1
Sub FlagChecker()
Dim chars(1 To 24) As String
guess = InputBox("Enter the flag:")
If Len(guess) <> 24 Then
MsgBox "Nope"
End If
char_1 = Mid(guess, 1, 1)
char_2 = Mid(guess, 2, 1)
char_3 = Mid(guess, 3, 1)
char_4 = Mid(guess, 4, 1)
char_5 = Mid(guess, 5, 1)
char_6 = Mid(guess, 6, 1)
char_7 = Mid(guess, 7, 1)
char_8 = Mid(guess, 8, 1)
char_9 = Mid(guess, 9, 1)
char_10 = Mid(guess, 10, 1)
char_11 = Mid(guess, 11, 1)
char_12 = Mid(guess, 12, 1)
char_13 = Mid(guess, 13, 1)
char_14 = Mid(guess, 14, 1)
char_15 = Mid(guess, 15, 1)
char_16 = Mid(guess, 16, 1)
char_17 = Mid(guess, 17, 1)
char_18 = Mid(guess, 18, 1)
char_19 = Mid(guess, 19, 1)
char_20 = Mid(guess, 20, 1)
char_21 = Mid(guess, 21, 1)
char_22 = Mid(guess, 22, 1)
char_23 = Mid(guess, 23, 1)
char_24 = Mid(guess, 24, 1)
If Asc(char_1) Xor Asc(char_8) = 22 Then
If Asc(char_10) + Asc(char_24) = 176 Then
If Asc(char_9) - Asc(char_22) = -9 Then
If Asc(char_22) Xor Asc(char_6) = 23 Then
If (Asc(char_12) / 5) ^ (Asc(char_3) / 12) = 130321 Then
If char_22 = char_11 Then
If Asc(char_15) * Asc(char_8) = 14040 Then
If Asc(char_12) Xor (Asc(char_17) + 5) = 5 Then
If Asc(char_18) = Asc(char_23) Then
If Asc(char_13) Xor Asc(char_14) Xor Asc(char_2) = 73 Then
If Asc(char_14) Xor Asc(char_24) = 77 Then
If 1365 = Asc(char_22) Xor 1337 Then
If Asc(char_10) = Asc(char_7) Then
If Asc(char_23) + Asc(char_8) = 235 Then
If Asc(char_16) = Asc(char_17) + 19 Then
If Asc(char_19) = 107 Then
If Asc(char_20) + 501 = (Asc(char_1) * 5) Then
If Asc(char_21) = Asc(char_22) Then
MsgBox "you got the flag!"
End If
End If
End If
End If
End If
End If
End If
End If
End If
End If
End If
End If
End If
End If
End If
End If
End If
End If
End Sub
```
solver
```python=
x1 = ord("n")
x2 = ord("0")
x3 = ord("0")
x4 = ord("b")
x5 = ord("z")
x6 = ord("{")
x24 = ord("}")
# If (Asc(char_1) Xor Asc(char_8)) = 22 Then
x8 = x1^22 # x1 ^ x8 = 22
# If (Asc(char_10) + Asc(char_24)) = 176 Then
x10 = 176-x24 # x10 + x24 = 176
# If (Asc(char_22) Xor Asc(char_6)) = 23 Then
x22 = x6^23 # x22 ^ x6 = 23
# If (Asc(char_9) - Asc(char_22)) = -9 Then
x9 = x22-9 # x9 - x22 = -9
# If ((Asc(char_12) / 5) ^ (Asc(char_3) / 12)) = 130321 Then
# (x12 / 5) ^ (x3 / 12) = 130321
for i in range(1000):
if i**4 == 130321:
x12 = i*5
# If (char_22 = char_11) Then
x11=x22 # x22 = x11
# If (Asc(char_15) * Asc(char_8)) = 14040 Then
x15 = 14040/x8 # x15 * x8 = 14040
# If (Asc(char_12) Xor (Asc(char_17) - 5)) = 5 Then
x17 = (5^x12)+5 # x12 ^ (x17 + 5) = 5
# If (Asc(char_14) Xor Asc(char_24)) = 77 Then
x14=77^x24 # x14 ^ x24 = 77
# If (Asc(char_13) Xor Asc(char_14) Xor Asc(char_2)) = 121 Then
x13=121^x2^x14 # x13 ^ x14 ^ x2 = 73
#If 1365 = (Asc(char_22) Xor 1337) Then
x22 = 1337^1365 # 1365 = x22 ^ 1337
# If (Asc(char_10) = Asc(char_7)) Then
x7 = x10 # x10 = x7
# If (Asc(char_23) + Asc(char_8)) = 235 Then
x23 = 235-x8 # x23 + x8 = 235
x18 = x23 # x18 = x23
x16 = x17+19 # x16 = x17 + 19
x19=107 # x19 = 107
x20 = (x1*5)-501 # x20 + 501 = x1 * 5
x21 = x22 # x21 = x22
print(chr(int(x1)),end="")
print(chr(int(x2)),end="")
print(chr(int(x3)),end="")
print(chr(int(x4)),end="")
print(chr(int(x5)),end="")
print(chr(int(x6)),end="")
print(chr(int(x7)),end="")
print(chr(int(x8)),end="")
print(chr(int(x9)),end="")
print(chr(int(x10)),end="")
print(chr(int(x11)),end="")
print(chr(int(x12)),end="")
print(chr(int(x13)),end="")
print(chr(int(x14)),end="")
print(chr(int(x15)),end="")
print(chr(int(x16)),end="")
print(chr(int(x17)),end="")
print(chr(int(x18)),end="")
print(chr(int(x19)),end="")
print(chr(int(x20)),end="")
print(chr(int(x21)),end="")
print(chr(int(x22)),end="")
print(chr(int(x23)),end="")
print(chr(int(x24)),end="")
print("")
```
## Programming
### Sillygoose
use golang to make faster
```go=
package main
import (
"bufio"
"fmt"
"math/big"
"net"
"os"
"strings"
)
func main() {
conn, err := net.Dial("tcp", "24.199.110.35:41199")
if err != nil {
fmt.Println("Error connecting:", err)
os.Exit(1)
}
defer conn.Close()
high := new(big.Int)
low := new(big.Int)
high.Exp(big.NewInt(10), big.NewInt(100), nil)
reader := bufio.NewReader(conn)
writer := bufio.NewWriter(conn)
for i := 0; i < 100000; i++ {
mid := new(big.Int).Add(low, high)
mid.Div(mid, big.NewInt(2))
writer.WriteString(mid.String() + "\n")
writer.Flush()
res, err := reader.ReadString('\n')
if err != nil {
fmt.Println("Error reading:", err)
break
}
res = strings.TrimSpace(res)
fmt.Printf("try: %s, %s\n", mid.String(), res)
if strings.Contains(res, "large") {
high.Set(mid)
} else if strings.Contains(res, "small") {
low.Set(mid)
} else if strings.Contains(res, "n00b") {
fmt.Println(res)
break
}
}
}
```
### Numbers2
```python=
from pwn import *
from sympy import factorint
p = remote("challs.n00bzunit3d.xyz",10080)
print(p.recvline().decode())
for i in range(100):
print(p.recvline().decode())
question = p.recvuntil(b":").decode()
print(question)
if "common multiple" in question:
tmp = question.split(" ")
for j in range(len(tmp)):
if "of" in tmp[j]:
a = int(tmp[j+1],10)
b = int(tmp[j+3].replace(":",""),10)
break
res = a*b
for j in range(a,a*b+1):
if j % a == 0 and j % b == 0:
res = j
break
p.sendline(str(res).encode())
print(p.recvline().decode())
elif "prime factor" in question:
tmp = question.split(" ")
for j in range(len(tmp)):
if "of" in tmp[j]:
a = int(tmp[j+1].replace(":",""),10)
break
if a == 1:
p.sendline(b"1")
print(p.recvline().decode())
continue
res = list(factorint(a).keys())[-1]
p.sendline(str(res).encode())
print(p.recvline().decode())
elif "common divisor" in question:
tmp = question.split(" ")
for j in range(len(tmp)):
if "of" in tmp[j]:
a = int(tmp[j+1],10)
b = int(tmp[j+3].replace(":",""),10)
break
res = 1
for j in range(1,a+1):
if a % j == 0 and b % j == 0:
res = j
p.sendline(str(res).encode())
print(p.recvline().decode())
else:
print("What happened?!?!")
break
print(p.recvall())
```
### back from brazil
```python=
from pwn import *
p = remote("24.199.110.35", 43298)
sleep(1)
n = 1000
for i in range(1):
eggs = []
for i in range(n):
row = p.recvline().decode().strip()
eggs.append(row.split(' '))
print("Recieve : ",len(eggs))
print("matrix col : ",len(eggs[0]))
#print(eggs)
res = ""
x=0
y=0
for i in range(n * 2):
if eggs[x+1][y] < eggs[x][y+1]:
res += "d"
y += 1
elif eggs[x+1][y] > eggs[x][y+1]:
res += "r"
x += 1
elif eggs[x+1][y] == eggs[x][y+1]:
if x < y:
res += "r"
x += 1
else:
res += "d"
y += 1
if x == (n-1):
res += "d" * (n-y-1)
break
if y == (n-1):
res += "r" * (n-x-1)
break
print(res)
#assert(0)
print(p.recvuntil(b"\xf0\x9f\xa5\x9a").decode())
p.sendline(res.encode())
print(p.recv().decode())
print(p.recv().decode())
print(p.recvall().decode())
```
## forensincs
### plane
check exif data
```exif=
GPS Latitude : 13 deg 22' 12.00" N
GPS Longitude : 13 deg 22' 12.00" W
GPS Position : 13 deg 22' 12.00" N, 13 deg 22' 12.00" W
```
## crypt
### Vigenere
use [vigenere cipher solver](https://www.dcode.fr/vigenere-cipher)
```text=
nmivrxbiaatjvvbcjsf
key : SECRETKEY
n00bz{vigenerecipherisfun}
```
## misc
### Subtraction
```python=
import random
n = 696969
a = []
for i in range(n):
a.append(random.randint(0, n))
a[i] -= a[i] % 2
#print(' '.join(list(map(str, a))))
tmp = n // 2
for turns in range(20):
c = tmp + 1
for i in range(n):
a[i] = abs(c - a[i])
print(c,len(set(a)))
if len(set(a)) == 1:
print(open('/flag.txt', 'r').read())
break
tmp = tmp // 2
```
## osint
### tail
Airline
[Air Tahiti Nui](https://en.wikipedia.org/wiki/Air_Tahiti_Nui)
Main airport of air tahiti nui
[FaaCa](https://en.wikipedia.org/wiki/Faa%CA%BBa_International_Airport)
IATA: PPT
Sign in with Wallet
Connect another wallet