---
# System prepended metadata

title: N00bzCTF Writeups

---

# N00bzCTF WriteUp

## summary
SUSHI1st 32nd place
![screencapture-ctf-n00bzunit3d-xyz-user-2024-08-05-09_59_54](https://hackmd.io/_uploads/SyE9SjptA.png)


## rev
### Vacation
chall

```ps1=
$bytes = [System.Text.Encoding]::ASCII.GetBytes((cat .\flag.txt))
[System.Collections.Generic.List[byte]]$newBytes = @()
$bytes.ForEach({
    $newBytes.Add($_ -bxor 3)
    })
$newString =  [System.Text.Encoding]::ASCII.GetString($newBytes)
echo $newString | Out-File -Encoding ascii .\output.txt
```

solver
```python=
with open('output.txt','r',encoding='ascii') as f:
    data  = f.read()


data = data.encode()

flag = bytearray([b ^ 3 for b in data])

print(flag.decode())
```

### Brain
chall
```bf=
>+++++++++++[<++++++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++++++++[<+++++++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++[<+++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>+++++++++++++[<++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>++++++++[<++++++>-]<[-]>++++++++++[<++++++++++>-]<[-]>+++++++++++++++++[<+++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++++[<+++++>-]<[-]>++++++++++++++[<+++++++>-]<[-]>+++++++++++++++++++[<++++++>-]<[-]>+++++++++++++[<++++>-]<[-]>+++++++[<+++++++>-]<[-]>+++++++++++[<++++++++++>-]<[-]>+++++++++++++++++[<++++++>-]<[-]>+++++++[<++++++>-]<[-]>+++++++++++[<+++++++++>-]<[-]>+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++[<+>-]<[-]>+++++++++++[<+++>-]<[-]>+++++++++++++++++++++++++[<+++++>-]<[-]
```
use [converter](https://github.com/paulkaefer/bftoc/blob/master/bftoc.py)

remove these operations 
```cpp=
ptr -= 1;
while (tape[ptr] != 0)
{
    tape[ptr] -= 1;
}
```

fixed program
```cpp=
/* This is a translation of bf.bf, generated by bftoc.py (by Paul Kaefer)
 * It was generated on Saturday, August 03, 2024 at 11:51AM
 */

#include <stdio.h>

void main(void)
{
    int size = 1000;
    int tape[size];
    int i = 0;

    /* Clearing the tape (array) */
    for (i=0; i<size; i++)
        tape[i] = 0;

    int ptr = 0;

    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 8;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 8;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 14;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 61;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 2;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 41;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 3;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 7;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 9;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 13;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 4;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 9;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 8;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 10;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 17;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 3;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 7;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 14;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 19;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 13;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 4;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 7;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 7;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 10;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 17;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 7;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 6;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 9;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 107;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 1;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 11;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 3;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    ptr += 1;
    tape[ptr] += 25;
    while (tape[ptr] != 0)
    {
        ptr -= 1;
        tape[ptr] += 5;
        ptr += 1;
        tape[ptr] -= 1;
    }
    
    for(int i  = 0;i < 1000;i++) {
        printf("%d,",tape[i]);
    }
}

```   

```bash=
~/dc/ctf/noobz/rev$./a.out 
110,48,48,98,122,123,49,95,99,52,110,95,99,48,100,51,95,49,110,95,98,114,52,49,110,102,42,99,107,33,125,0,0,0,0,0,0,0,0 .......
```

```python=
num = [110,48,48,98,122,123,49,95,99,52,110,95,99,48,100,51,95,49,110,95,98,114,52,49,110,102,42,99,107,33,125]

for i in num:
    print(chr(i),end="") 

print("")

```
    
```bash=
~/dc/ctf/noobz/rev$python3 bf.py 
n00bz{1_c4n_c0d3_1n_br41nf*ck!}
```
    
### Flag Checker
analyze vba script 
```vba=
Rem Attribute VBA_ModuleType=VBAModule
Option VBASupport 1
Sub FlagChecker()

    Dim chars(1 To 24) As String
    guess = InputBox("Enter the flag:")
    If Len(guess) <> 24 Then
        MsgBox "Nope"
    End If
    char_1 = Mid(guess, 1, 1)
    char_2 = Mid(guess, 2, 1)
    char_3 = Mid(guess, 3, 1)
    char_4 = Mid(guess, 4, 1)
    char_5 = Mid(guess, 5, 1)
    char_6 = Mid(guess, 6, 1)
    char_7 = Mid(guess, 7, 1)
    char_8 = Mid(guess, 8, 1)
    char_9 = Mid(guess, 9, 1)
    char_10 = Mid(guess, 10, 1)
    char_11 = Mid(guess, 11, 1)
    char_12 = Mid(guess, 12, 1)
    char_13 = Mid(guess, 13, 1)
    char_14 = Mid(guess, 14, 1)
    char_15 = Mid(guess, 15, 1)
    char_16 = Mid(guess, 16, 1)
    char_17 = Mid(guess, 17, 1)
    char_18 = Mid(guess, 18, 1)
    char_19 = Mid(guess, 19, 1)
    char_20 = Mid(guess, 20, 1)
    char_21 = Mid(guess, 21, 1)
    char_22 = Mid(guess, 22, 1)
    char_23 = Mid(guess, 23, 1)
    char_24 = Mid(guess, 24, 1)
    If Asc(char_1) Xor Asc(char_8) = 22 Then
        If Asc(char_10) + Asc(char_24) = 176 Then
            If Asc(char_9) - Asc(char_22) = -9 Then
                If Asc(char_22) Xor Asc(char_6) = 23 Then
                    If (Asc(char_12) / 5) ^ (Asc(char_3) / 12) = 130321 Then
                        If char_22 = char_11 Then
                            If Asc(char_15) * Asc(char_8) = 14040 Then
                                If Asc(char_12) Xor (Asc(char_17) + 5) = 5 Then
                                    If Asc(char_18) = Asc(char_23) Then
                                        If Asc(char_13) Xor Asc(char_14) Xor Asc(char_2) = 73 Then
                                            If Asc(char_14) Xor Asc(char_24) = 77 Then
                                                If 1365 = Asc(char_22) Xor 1337 Then
                                                    If Asc(char_10) = Asc(char_7) Then
                                                        If Asc(char_23) + Asc(char_8) = 235 Then
                                                            If Asc(char_16) = Asc(char_17) + 19 Then
                                                                If Asc(char_19) = 107 Then
                                                                    If Asc(char_20) + 501 = (Asc(char_1) * 5) Then
                                                                        If Asc(char_21) = Asc(char_22) Then
                                                                            MsgBox "you got the flag!"
                                                                        End If
                                                                    End If
                                                                End If
                                                            End If
                                                        End If
                                                    End If
                                                End If
                                            End If
                                        End If
                                    End If
                                End If
                            End If
                        End If
                    End If
                End If
            End If
        End If
    End If
End Sub
```

solver
```python=
x1 = ord("n")
x2 = ord("0")
x3 = ord("0")
x4 = ord("b")
x5 = ord("z")
x6 = ord("{")
x24 = ord("}")
# If (Asc(char_1) Xor Asc(char_8)) = 22 Then
x8 = x1^22 # x1 ^ x8 = 22 
# If (Asc(char_10) + Asc(char_24)) = 176 Then
x10 = 176-x24 # x10 + x24 = 176 
# If (Asc(char_22) Xor Asc(char_6)) = 23 Then
x22 = x6^23 # x22 ^ x6 = 23 
# If (Asc(char_9) - Asc(char_22)) = -9 Then
x9 = x22-9 # x9 - x22 = -9 
# If ((Asc(char_12) / 5) ^ (Asc(char_3) / 12)) = 130321 Then
# (x12 / 5) ^ (x3 / 12) = 130321 
for i in range(1000):
    if i**4 == 130321:
        x12 = i*5
# If (char_22 = char_11) Then
x11=x22 # x22 = x11
#  If (Asc(char_15) * Asc(char_8)) = 14040 Then
x15 = 14040/x8 # x15 * x8 = 14040 
# If (Asc(char_12) Xor (Asc(char_17) - 5)) = 5 Then
x17 = (5^x12)+5 # x12 ^ (x17 + 5) = 5 
#  If (Asc(char_14) Xor Asc(char_24)) = 77 Then
x14=77^x24 # x14 ^ x24 = 77 
# If (Asc(char_13) Xor Asc(char_14) Xor Asc(char_2)) = 121 Then
x13=121^x2^x14 # x13 ^ x14 ^ x2 = 73 
#If 1365 = (Asc(char_22) Xor 1337) Then
x22 = 1337^1365 # 1365 = x22 ^ 1337 
# If (Asc(char_10) = Asc(char_7)) Then
x7 = x10 # x10 = x7 
# If (Asc(char_23) + Asc(char_8)) = 235 Then
x23 = 235-x8 # x23 + x8 = 235 
x18 = x23 # x18 = x23
x16 = x17+19 # x16 = x17 + 19 
x19=107 # x19 = 107 
x20 = (x1*5)-501 # x20 + 501 = x1 * 5 
x21 = x22 # x21 = x22

print(chr(int(x1)),end="")
print(chr(int(x2)),end="")
print(chr(int(x3)),end="")
print(chr(int(x4)),end="")
print(chr(int(x5)),end="")
print(chr(int(x6)),end="")
print(chr(int(x7)),end="")
print(chr(int(x8)),end="")
print(chr(int(x9)),end="")
print(chr(int(x10)),end="")
print(chr(int(x11)),end="")
print(chr(int(x12)),end="")
print(chr(int(x13)),end="")
print(chr(int(x14)),end="")
print(chr(int(x15)),end="")
print(chr(int(x16)),end="")
print(chr(int(x17)),end="")
print(chr(int(x18)),end="")
print(chr(int(x19)),end="")
print(chr(int(x20)),end="")
print(chr(int(x21)),end="")
print(chr(int(x22)),end="")
print(chr(int(x23)),end="")
print(chr(int(x24)),end="")
print("")
```
    
## Programming

### Sillygoose
use golang to make faster
    
```go=
package main

import (
    "bufio"
    "fmt"
    "math/big"
    "net"
    "os"
    "strings"
)

func main() {
    conn, err := net.Dial("tcp", "24.199.110.35:41199")
    if err != nil {
        fmt.Println("Error connecting:", err)
        os.Exit(1)
    }
    defer conn.Close()
    high := new(big.Int)
    low := new(big.Int)
    high.Exp(big.NewInt(10), big.NewInt(100), nil)

    reader := bufio.NewReader(conn)
    writer := bufio.NewWriter(conn)

    for i := 0; i < 100000; i++ {
        mid := new(big.Int).Add(low, high)
        mid.Div(mid, big.NewInt(2))

        writer.WriteString(mid.String() + "\n")
        writer.Flush()

        res, err := reader.ReadString('\n')
        if err != nil {
            fmt.Println("Error reading:", err)
            break
        }
        res = strings.TrimSpace(res)
        fmt.Printf("try: %s, %s\n", mid.String(), res)

        if strings.Contains(res, "large") {
            high.Set(mid)
        } else if strings.Contains(res, "small") {
            low.Set(mid)
        } else if strings.Contains(res, "n00b") {
            fmt.Println(res)
            break
        }
    }
}
```
						   
### Numbers2
```python=
from pwn import *
from sympy import factorint

p = remote("challs.n00bzunit3d.xyz",10080)
print(p.recvline().decode())

for i in range(100):
    print(p.recvline().decode())
    question = p.recvuntil(b":").decode()
    print(question)
    if "common multiple" in question:
        tmp = question.split(" ")
        for j in range(len(tmp)):
            if "of" in tmp[j]:
                a = int(tmp[j+1],10)
                b = int(tmp[j+3].replace(":",""),10)
                break
        res = a*b
        for j in range(a,a*b+1):
            if j % a == 0 and j % b == 0:
                res = j
                break
        p.sendline(str(res).encode())
        print(p.recvline().decode())
    
    elif "prime factor" in question:
        tmp = question.split(" ")
        for j in range(len(tmp)):
            if "of" in tmp[j]:
                a = int(tmp[j+1].replace(":",""),10)
                break
        if a == 1:
            p.sendline(b"1")
            print(p.recvline().decode())
            continue
        res = list(factorint(a).keys())[-1]
        p.sendline(str(res).encode())
        print(p.recvline().decode())

    elif "common divisor" in question:
        tmp = question.split(" ")
        for j in range(len(tmp)):
            if "of" in tmp[j]:
                a = int(tmp[j+1],10)
                b = int(tmp[j+3].replace(":",""),10)
                break
        res = 1
        for j in range(1,a+1):
            if a % j == 0 and b % j == 0:
                res = j
        p.sendline(str(res).encode())
        print(p.recvline().decode())

    else:
        print("What happened?!?!")
        break


print(p.recvall())
```
						   
### back from brazil
```python=
from pwn import *
p = remote("24.199.110.35", 43298)



sleep(1)
n = 1000
for i in range(1):
    eggs = []
    for i in range(n):
        row = p.recvline().decode().strip() 
        eggs.append(row.split(' '))
    print("Recieve : ",len(eggs))    
    print("matrix col : ",len(eggs[0]))
    #print(eggs)
    res = ""
    x=0
    y=0
    for i in range(n * 2):
        if eggs[x+1][y] < eggs[x][y+1]:
            res += "d"
            y += 1
        elif eggs[x+1][y] > eggs[x][y+1]:
            res += "r"
            x += 1
        elif eggs[x+1][y] == eggs[x][y+1]:
            if x < y:
                res += "r"
                x += 1
            else:
                res += "d"
                y += 1
        if x == (n-1):
            res += "d" * (n-y-1)
            break
        if y == (n-1):
            res += "r" * (n-x-1)
            break

    print(res)
    #assert(0)
    print(p.recvuntil(b"\xf0\x9f\xa5\x9a").decode())
    p.sendline(res.encode())
    print(p.recv().decode())

print(p.recv().decode())
print(p.recvall().decode())
```
## forensincs
### plane
check exif data
```exif=
GPS Latitude                    : 13 deg 22' 12.00" N
GPS Longitude                   : 13 deg 22' 12.00" W
GPS Position                    : 13 deg 22' 12.00" N, 13 deg 22' 12.00" W
```

## crypt
### Vigenere
use [vigenere cipher solver](https://www.dcode.fr/vigenere-cipher)
```text=
nmivrxbiaatjvvbcjsf
key : SECRETKEY
n00bz{vigenerecipherisfun}
```

## misc
### Subtraction		

```python=
import random

n = 696969

a = []
for i in range(n):
    a.append(random.randint(0, n))
    a[i] -= a[i] % 2

#print(' '.join(list(map(str, a))))
tmp = n // 2
for turns in range(20):
    c = tmp + 1
    for i in range(n):
        a[i] = abs(c - a[i])

    print(c,len(set(a)))
    if len(set(a)) == 1:
        print(open('/flag.txt', 'r').read())
        break

    tmp = tmp // 2
```
		
## osint
		
### tail
Airline
[Air Tahiti Nui](https://en.wikipedia.org/wiki/Air_Tahiti_Nui)
Main airport of air tahiti nui
[FaaCa](https://en.wikipedia.org/wiki/Faa%CA%BBa_International_Airport)
IATA: PPT
