N00bzCTF WriteUp

summary

SUSHI1st 32nd place
screencapture-ctf-n00bzunit3d-xyz-user-2024-08-05-09_59_54

rev

Vacation

chall







$bytes = [System.Text.Encoding]::ASCII.GetBytes((cat .\flag.txt))
[System.Collections.Generic.List[byte]]$newBytes = @()
$bytes.ForEach({
    $newBytes.Add($_ -bxor 3)
    })
$newString =  [System.Text.Encoding]::ASCII.GetString($newBytes)
echo $newString | Out-File -Encoding ascii .\output.txt

solver









with open('output.txt','r',encoding='ascii') as f:
    data  = f.read()


data = data.encode()

flag = bytearray([b ^ 3 for b in data])

print(flag.decode())

Brain

chall


>+++++++++++[<++++++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++++++++[<+++++++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++[<+++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>+++++++++++++[<++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++++[<++++++++++>-]<[-]>+++++++++++++++++[<+++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>++++++++++++++[<+++++++>-]<[-]>+++++++++++++++++++[<++++++>-]<[-]>+++++++++++++[<++++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++[<++++++>-]<[-]>+++++++[<++++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>-]<[-]>+++++++++++[<+++>-]<[-]>+++++++++++++++++++++++++[<+++++>-]<[-]

use converter

remove these operations





ptr -= 1;
while (tape[ptr] != 0)
{
    tape[ptr] -= 1;
}

fixed program













































































































































































































































































































































/* This is a translation of bf.bf, generated by bftoc.py (by Paul Kaefer)
 * It was generated on Saturday, August 03, 2024 at 11:51AM
 */

#include <stdio.h>

void main(void)
{
    int size = 1000;
    int tape[size];
    int i = 0;

    /* Clearing the tape (array) */
    for (i=0; i<size; i++)
        tape[i] = 0;

    int ptr = 0;

    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 8;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 8;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 14;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 61;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 2;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 41;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 3;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 7;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 9;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 13;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 4;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 9;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 8;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 10;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 17;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 3;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 7;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 14;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 13;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 4;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 7;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 17;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 7;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 9;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 107;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 1;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 3;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 25;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    for(int i  = 0;i < 1000;i++) {
        printf("%d,",tape[i]);
    }
}


~/dc/ctf/noobz/rev$./a.out 
110,48,48,98,122,123,49,95,99,52,110,95,99,48,100,51,95,49,110,95,98,114,52,49,110,102,42,99,107,33,125,0,0,0,0,0,0,0,0 .......







num = [110,48,48,98,122,123,49,95,99,52,110,95,99,48,100,51,95,49,110,95,98,114,52,49,110,102,42,99,107,33,125]

for i in num:
    print(chr(i),end="") 

print("")


~/dc/ctf/noobz/rev$python3 bf.py 
n00bz{1_c4n_c0d3_1n_br41nf*ck!}

Flag Checker

analyze vba script







































































Rem Attribute VBA_ModuleType=VBAModule
Option VBASupport 1
Sub FlagChecker()

    Dim chars(1 To 24) As String
    guess = InputBox("Enter the flag:")
    If Len(guess) <> 24 Then
        MsgBox "Nope"
    End If
    char_1 = Mid(guess, 1, 1)
    char_2 = Mid(guess, 2, 1)
    char_3 = Mid(guess, 3, 1)
    char_4 = Mid(guess, 4, 1)
    char_5 = Mid(guess, 5, 1)
    char_6 = Mid(guess, 6, 1)
    char_7 = Mid(guess, 7, 1)
    char_8 = Mid(guess, 8, 1)
    char_9 = Mid(guess, 9, 1)
    char_10 = Mid(guess, 10, 1)
    char_11 = Mid(guess, 11, 1)
    char_12 = Mid(guess, 12, 1)
    char_13 = Mid(guess, 13, 1)
    char_14 = Mid(guess, 14, 1)
    char_15 = Mid(guess, 15, 1)
    char_16 = Mid(guess, 16, 1)
    char_17 = Mid(guess, 17, 1)
    char_18 = Mid(guess, 18, 1)
    char_19 = Mid(guess, 19, 1)
    char_20 = Mid(guess, 20, 1)
    char_21 = Mid(guess, 21, 1)
    char_22 = Mid(guess, 22, 1)
    char_23 = Mid(guess, 23, 1)
    char_24 = Mid(guess, 24, 1)
    If Asc(char_1) Xor Asc(char_8) = 22 Then
        If Asc(char_10) + Asc(char_24) = 176 Then
            If Asc(char_9) - Asc(char_22) = -9 Then
                If Asc(char_22) Xor Asc(char_6) = 23 Then
                    If (Asc(char_12) / 5) ^ (Asc(char_3) / 12) = 130321 Then
                        If char_22 = char_11 Then
                            If Asc(char_15) * Asc(char_8) = 14040 Then
                                If Asc(char_12) Xor (Asc(char_17) + 5) = 5 Then
                                    If Asc(char_18) = Asc(char_23) Then
                                        If Asc(char_13) Xor Asc(char_14) Xor Asc(char_2) = 73 Then
                                            If Asc(char_14) Xor Asc(char_24) = 77 Then
                                                If 1365 = Asc(char_22) Xor 1337 Then
                                                    If Asc(char_10) = Asc(char_7) Then
                                                        If Asc(char_23) + Asc(char_8) = 235 Then
                                                            If Asc(char_16) = Asc(char_17) + 19 Then
                                                                If Asc(char_19) = 107 Then
                                                                    If Asc(char_20) + 501 = (Asc(char_1) * 5) Then
                                                                        If Asc(char_21) = Asc(char_22) Then
                                                                            MsgBox "you got the flag!"
                                                                        End If
                                                                    End If
                                                                End If
                                                            End If
                                                        End If
                                                    End If
                                                End If
                                            End If
                                        End If
                                    End If
                                End If
                            End If
                        End If
                    End If
                End If
            End If
        End If
    End If
End Sub

solver



































































x1 = ord("n")
x2 = ord("0")
x3 = ord("0")
x4 = ord("b")
x5 = ord("z")
x6 = ord("{")
x24 = ord("}")
# If (Asc(char_1) Xor Asc(char_8)) = 22 Then
x8 = x1^22 # x1 ^ x8 = 22 
# If (Asc(char_10) + Asc(char_24)) = 176 Then
x10 = 176-x24 # x10 + x24 = 176 
# If (Asc(char_22) Xor Asc(char_6)) = 23 Then
x22 = x6^23 # x22 ^ x6 = 23 
# If (Asc(char_9) - Asc(char_22)) = -9 Then
x9 = x22-9 # x9 - x22 = -9 
# If ((Asc(char_12) / 5) ^ (Asc(char_3) / 12)) = 130321 Then
# (x12 / 5) ^ (x3 / 12) = 130321 
for i in range(1000):
    if i**4 == 130321:
        x12 = i*5
# If (char_22 = char_11) Then
x11=x22 # x22 = x11
#  If (Asc(char_15) * Asc(char_8)) = 14040 Then
x15 = 14040/x8 # x15 * x8 = 14040 
# If (Asc(char_12) Xor (Asc(char_17) - 5)) = 5 Then
x17 = (5^x12)+5 # x12 ^ (x17 + 5) = 5 
#  If (Asc(char_14) Xor Asc(char_24)) = 77 Then
x14=77^x24 # x14 ^ x24 = 77 
# If (Asc(char_13) Xor Asc(char_14) Xor Asc(char_2)) = 121 Then
x13=121^x2^x14 # x13 ^ x14 ^ x2 = 73 
#If 1365 = (Asc(char_22) Xor 1337) Then
x22 = 1337^1365 # 1365 = x22 ^ 1337 
# If (Asc(char_10) = Asc(char_7)) Then
x7 = x10 # x10 = x7 
# If (Asc(char_23) + Asc(char_8)) = 235 Then
x23 = 235-x8 # x23 + x8 = 235 
x18 = x23 # x18 = x23
x16 = x17+19 # x16 = x17 + 19 
x19=107 # x19 = 107 
x20 = (x1*5)-501 # x20 + 501 = x1 * 5 
x21 = x22 # x21 = x22

print(chr(int(x1)),end="")
print(chr(int(x2)),end="")
print(chr(int(x3)),end="")
print(chr(int(x4)),end="")
print(chr(int(x5)),end="")
print(chr(int(x6)),end="")
print(chr(int(x7)),end="")
print(chr(int(x8)),end="")
print(chr(int(x9)),end="")
print(chr(int(x10)),end="")
print(chr(int(x11)),end="")
print(chr(int(x12)),end="")
print(chr(int(x13)),end="")
print(chr(int(x14)),end="")
print(chr(int(x15)),end="")
print(chr(int(x16)),end="")
print(chr(int(x17)),end="")
print(chr(int(x18)),end="")
print(chr(int(x19)),end="")
print(chr(int(x20)),end="")
print(chr(int(x21)),end="")
print(chr(int(x22)),end="")
print(chr(int(x23)),end="")
print(chr(int(x24)),end="")
print("")

Programming

Sillygoose

use golang to make faster


















































package main

import (
    "bufio"
    "fmt"
    "math/big"
    "net"
    "os"
    "strings"
)

func main() {
    conn, err := net.Dial("tcp", "24.199.110.35:41199")
    if err != nil {
        fmt.Println("Error connecting:", err)
        os.Exit(1)
    }
    defer conn.Close()
    high := new(big.Int)
    low := new(big.Int)
    high.Exp(big.NewInt(10), big.NewInt(100), nil)

    reader := bufio.NewReader(conn)
    writer := bufio.NewWriter(conn)

    for i := 0; i < 100000; i++ {
        mid := new(big.Int).Add(low, high)
        mid.Div(mid, big.NewInt(2))

        writer.WriteString(mid.String() + "\n")
        writer.Flush()

        res, err := reader.ReadString('\n')
        if err != nil {
            fmt.Println("Error reading:", err)
            break
        }
        res = strings.TrimSpace(res)
        fmt.Printf("try: %s, %s\n", mid.String(), res)

        if strings.Contains(res, "large") {
            high.Set(mid)
        } else if strings.Contains(res, "small") {
            low.Set(mid)
        } else if strings.Contains(res, "n00b") {
            fmt.Println(res)
            break
        }
    }
}

Numbers2



























































from pwn import *
from sympy import factorint

p = remote("challs.n00bzunit3d.xyz",10080)
print(p.recvline().decode())

for i in range(100):
    print(p.recvline().decode())
    question = p.recvuntil(b":").decode()
    print(question)
    if "common multiple" in question:
        tmp = question.split(" ")
        for j in range(len(tmp)):
            if "of" in tmp[j]:
                a = int(tmp[j+1],10)
                b = int(tmp[j+3].replace(":",""),10)
                break
        res = a*b
        for j in range(a,a*b+1):
            if j % a == 0 and j % b == 0:
                res = j
                break
        p.sendline(str(res).encode())
        print(p.recvline().decode())
    
    elif "prime factor" in question:
        tmp = question.split(" ")
        for j in range(len(tmp)):
            if "of" in tmp[j]:
                a = int(tmp[j+1].replace(":",""),10)
                break
        if a == 1:
            p.sendline(b"1")
            print(p.recvline().decode())
            continue
        res = list(factorint(a).keys())[-1]
        p.sendline(str(res).encode())
        print(p.recvline().decode())

    elif "common divisor" in question:
        tmp = question.split(" ")
        for j in range(len(tmp)):
            if "of" in tmp[j]:
                a = int(tmp[j+1],10)
                b = int(tmp[j+3].replace(":",""),10)
                break
        res = 1
        for j in range(1,a+1):
            if a % j == 0 and b % j == 0:
                res = j
        p.sendline(str(res).encode())
        print(p.recvline().decode())

    else:
        print("What happened?!?!")
        break


print(p.recvall())

back from brazil















































from pwn import *
p = remote("24.199.110.35", 43298)



sleep(1)
n = 1000
for i in range(1):
    eggs = []
    for i in range(n):
        row = p.recvline().decode().strip() 
        eggs.append(row.split(' '))
    print("Recieve : ",len(eggs))    
    print("matrix col : ",len(eggs[0]))
    #print(eggs)
    res = ""
    x=0
    y=0
    for i in range(n * 2):
        if eggs[x+1][y] < eggs[x][y+1]:
            res += "d"
            y += 1
        elif eggs[x+1][y] > eggs[x][y+1]:
            res += "r"
            x += 1
        elif eggs[x+1][y] == eggs[x][y+1]:
            if x < y:
                res += "r"
                x += 1
            else:
                res += "d"
                y += 1
        if x == (n-1):
            res += "d" * (n-y-1)
            break
        if y == (n-1):
            res += "r" * (n-x-1)
            break

    print(res)
    #assert(0)
    print(p.recvuntil(b"\xf0\x9f\xa5\x9a").decode())
    p.sendline(res.encode())
    print(p.recv().decode())

print(p.recv().decode())
print(p.recvall().decode())

forensincs

plane

check exif data



GPS Latitude                    : 13 deg 22' 12.00" N
GPS Longitude                   : 13 deg 22' 12.00" W
GPS Position                    : 13 deg 22' 12.00" N, 13 deg 22' 12.00" W

crypt

Vigenere

use vigenere cipher solver

nmivrxbiaatjvvbcjsf
key : SECRETKEY
n00bz{vigenerecipherisfun}

misc

Subtraction






















import random

n = 696969

a = []
for i in range(n):
    a.append(random.randint(0, n))
    a[i] -= a[i] % 2

#print(' '.join(list(map(str, a))))
tmp = n // 2
for turns in range(20):
    c = tmp + 1
    for i in range(n):
        a[i] = abs(c - a[i])

    print(c,len(set(a)))
    if len(set(a)) == 1:
        print(open('/flag.txt', 'r').read())
        break

    tmp = tmp // 2

osint

tail

Airline
Air Tahiti Nui
Main airport of air tahiti nui
FaaCa
IATA: PPT

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`	在筆記中貼入程式碼
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.