picoCTF2021

Python Wrangling
Description

Python scripts are invoked kind of like programs in the Terminal... Can you run this Python script using this password to get the flag?

Solution:
kali@kali:~/Desktop$ python3 ende.py -d flag.txt.en

Please enter the password:68f88f9368f88f9368f88f9368f88f93

picoCTF{4p0110_1n_7h3_h0us3_68f88f93}

kali@kali:~/Desktop$

Binary Gauntlet 0

Description

This series of problems has to do with binary protections and how they affect exploiting a very simple program. How far can you make it in the gauntlet?
gauntlet nc -v mercury.picoctf.net 12294

Solution:

Download the program. First use strings command to check out plaintext contents. Looks it uses some insecure string command. It also shows requiring an input file called flag.txt. So we can create a local flag file and see what happens.

This is about format string attack.

https://nikhilh20.medium.com/format-string-exploit-ccefad8fd66b

kali@kali:~/Desktop/pico$ ./gauntlet flag.txt

%7$s

asasasa

Above string of "asasasa" is the content of my flag file. So we know %7$s gives out the flag.

kali@kali:~/Desktop/pico$ nc -v mercury.picoctf.net 12294

DNS fwd/rev mismatch: mercury.picoctf.net != ec2-18-189-209-142.us-east-2.compute.amazonaws.com

mercury.picoctf.net [18.189.209.142] 12294 (?) open

%7$s

fbd01d62c0e369e6de3d63b4b21d3830

Wave a flag
Description

Can you invoke help flags for a tool or binary? This program has extraordinarily helpful information...

Solution:
kali@kali:~/Desktop/pico$ ./warm -h

Oh, help? I actually don't do much, but I do have this flag here: picoCTF{b1scu1ts_4nd_gr4vy_6635aa47}

kali@kali:~/Desktop/pico$

Information
Description

Files can always be changed in a secret way. Can you find the flag? cat.jpg
Solution:

kali@kali:~/Desktop/pico$ strings cat.jpg > cat.txt

kali@kali:~/Desktop/pico$ leafpad cat.txt

kali@kali:~/Desktop/pico$ exiftool cat.jpg

Notice the lines:

Current IPTC Digest : 7a78f3d9cfb1ce42ab5a3aa30573d617

Digest is based-64 encoded, decode it and get

picoCTF{the_m3tadata_1s_modified}

Nice netcat
Description

There is a nice program that you can talk to by using this command in a shell: $ nc mercury.picoctf.net 49039, but it doesn't speak English...

Solution:

Connect to the port and notice receiving a bunch of decimal numbers

kali@kali:~/Desktop/pico$ nc mercury.picoctf.net 49039 > net.txt
kali@kali:~/Desktop/pico$ cat net.txt | tr '\012' ' '

112 105 99 111 67 84 70 123 103 48 48 100 95 107 49 116 116 121 33 95 110 49 99 51 95 107 49 116 116 121 33 95 51 100 56 52 101 100 99 56 125 10

Goto online converter at https://www.rapidtables.com/convert/number/ascii-hex-bin-dec-converter.html and get the flag

picoCTF{g00d_k1tty!_n1c3_k1tty!_3d84edc8}

Weird File

Description

What could go wrong if we let Word documents run programs? (aka "in-the-clear"). Download file.

Solution:

Once open file in Microsoft Word, enable edit, then go to View-> Macros->Macros in weird.docm, open the function runpython and find the string

Ret_Val = Shell("python -c 'print(\"cGljb0NURnttNGNyMHNfcl9kNG5nM3IwdXN9\")'" & " " & Args, vbNormalFocus)

Convert base64 string to flag

picoCTF{m4cr0s_r_d4ng3r0us}

GET aHEAD

Description

Find the flag being held on this server to get ahead of the competition http://mercury.picoctf.net:28916/

Solution:

Notice the HTTP response purely relies on the HTTP method in the HTTP request. Right now it sends either GET or POST to get different results. What if I change the the HTTP method to HEAD? Intercept the traffic with burp.

picoCTF{r3j3ct_th3_du4l1ty_70bc61c4}

Transformation

Description

I wonder what this really is... enc

Solution:
Analyse shows the content is Unicode encoded. So try to decode this string at https://www.online-toolz.com/tools/text-unicode-entities-convertor.php

From "灩捯䍔䙻ㄶ形楴獟楮獴㌴摟潦弸彥㜰㍢㐸㙽" to "%u7069%u636F%u4354%u467B%u3136%u5F62%u6974%u735F%u696E%u7374%u3334%u645F%u6F66%u5F38%u5F65%u3730%u3362%u3438%u367D"

It looks getting rid of %u and it will turn into hex-coded ascii.

kali@kali:~/Desktop/pico$ echo "%u7069%u636F%u4354%u467B%u3136%u5F62%u6974%u735F%u696E%u7374%u3334%u645F%u6F66%u5F38%u5F65%u3730%u3362%u3438%u367D" > enc2

kali@kali:~/Desktop/pico$ sed 's/%u//g' enc2

7069636F4354467B31365F626974735F696E73743334645F6F665F385F65373033623438367D

kali@kali:~/Desktop/pico$ sed 's/%u//g' enc2 | xxd -r -p

picoCTF{16_bits_inst34d_of_8_e703b486}

kali@kali:~/Desktop/pico$

Static ain't always noise

Description

Can you look at the data in this binary: static? This BASH script might help!

Solution:

kali@kali:~/Desktop/pico$ strings static

Will find the flag

picoCTF{d15a5m_t34s3r_ae0b3ef2}

Tab, Tab, Attack
Description

Using tabcomplete in the Terminal will add years to your life, esp. when dealing with long rambling directory structures and filenames: Addadshashanammu.zip

Solution:
Just unzip and go deep to the last directory and run

$ strings fang-of-haynekhtnamet | grep pico

*ZAP!* picoCTF{l3v3l_up!_t4k3_4_r35t!_a00cae70}

keygenme-py
Description

keygenme-trial.py

Solution:

Read the code. Notice the flag contains static and dynamic part. Need to figure out dynamic part.

Run the code step by step in python console, replace the input with the real variable.

kali@kali:~$ python3

Python 3.8.2 (default, Apr 1 2020, 15:52:55)

[GCC 9.3.0] on linux

Type "help", "copyright", "credits" or "license" for more information.

>>> import hashlib

>>> from cryptography.fernet import Fernet

>>> import base64

>>> username_trial = "ANDERSON"

>>> bUsername_trial = b"ANDERSON"

>>> hashlib.sha256(username_trial).hexdigest()[4]

Traceback (most recent call last):

File "<stdin>", line 1, in <module>

TypeError: Unicode-objects must be encoded before hashing

>>> hashlib.sha256(bUsername_trial).hexdigest()[4]

'0'

>>> hashlib.sha256(bUsername_trial).hexdigest()[5]

'1'

>>> hashlib.sha256(bUsername_trial).hexdigest()[3]

'5'

>>> hashlib.sha256(bUsername_trial).hexdigest()[6]

'8'

>>> hashlib.sha256(bUsername_trial).hexdigest()[2]

'2'

>>> hashlib.sha256(bUsername_trial).hexdigest()[7]

'4'

>>> hashlib.sha256(bUsername_trial).hexdigest()[1]

'1'

>>> hashlib.sha256(bUsername_trial).hexdigest()[8]

'9'

Put together we get the final flag as:

picoCTF{1n_7h3_|<3y_of_01582419}

Matryoshka doll
Description

Matryoshka dolls are a set of wooden dolls of decreasing size placed one inside another. What's the final one? Image: this
Solution:

Use binwalk to extract embedded zip file from image file, and repeat the process till you get the flag file.

https://book.hacktricks.xyz/stego/stego-tricks

https://trailofbits.github.io/ctf/forensics/

kali@kali:~/Desktop/pico$ binwalk -e dolls.jpg

picoCTF{bf6acf878dcbd752f4721e41b1b1b66b}

crackme-py

Description

crackme.py

Solution:

Inspect the source code. Notice it already has decrypt function. Just need to run the function in the program. Add two line program:

print ("the secret is")

decode_secret(bezos_cc_secret)

And get the flag:

picoCTF{1|\/|_4_p34|\|ut_a79b6c2d}

Magikarp Ground Mission

Description

Do you know how to move between directories and read files in the shell? Start the container, `ssh` to it, and then `ls` once connected to begin. Login via `ssh` as `ctf-player` with the password, `6dee9772`

Solution:

This one is easy. Just follow the instruction to get all three pieces of information for the flag.

After ssh to the machine:

picoCTF{xxsh_0ut_0f_\/\/4t3r_540e4e79}

Description

Who doesn't love cookies? Try to figure out the best one. http://mercury.picoctf.net:64944/

Solution:

Check out the site, and notice it uses a cookie called name=-1. Think to change cookie value to see what happens.

Browser tool does not help too much here. Use burp to intercept traffic.

Notice the sequence, try to send each packet to repeater and change cookie value.

The third packet actually responds differently if you modify cookie value. Keep changing the value until the final flag shows up.

picoCTF{3v3ry1_l0v3s_c00k135_cc9110ba}

Wireshark doo dooo do doo...
Description

Can you find the flag? shark1.pcapng

Solution:

Open the file with wireshark. Try to search for work like pico or CTF but nothing is found.

Next step is to look for TCP connection content.

Once search for "tcp.stream eq 5", you see content like in a flag format:

Gur synt vf cvpbPGS{c33xno00_1_f33_h_qrnqorrs}

Convert this with Caesar Cipher, you get

picoCTF{p33kab00_1_s33_u_deadbeef}

speeds and feeds

Description

There is something on my shop network running at nc mercury.picoctf.net 33596, but I can't tell what it is. Can you?

Solution:

After connecting to the port, it displays a longlist of like this:

G0Z0.1

G0X194.8276Y3.3103

G1Z0.1

G1X195.3793Y3.5862

G1X195.6552Y4.1379

G1X195.6552Y4.9655

G1X195.3793Y5.5172

G1X194.8276Y5.7931

G0Z0.1

Export all the results to a local file.

kali@kali:~/Desktop/pico$ nc mercury.picoctf.net 33596 > my.txt

Need to figure out what kind of codes they are.

Take the hint "What language does a CNC machine use?"

Google search "What language does a CNC machine use?" And find it is called G-Code.

Google search "g-code simulator online"

https://ncviewer.com/

Upload saved file and you get the flag:

picoCTF{num3r1cal_c0ntr0l_e7749028}

Shop

Description

Best Stuff - Cheap Stuff, Buy Buy Buy... Store Instance: source. The shop is open for business at nc mercury.picoctf.net 24851.

Solution:

Download the source code, extract strings but it does not help much.

Connect to the port, it looks running a shopping application. The hint says considering corner case.

Exploring around and notice you can earn money by purchasing negative amount of items. Then get the idea that Fruitful Flag has the flag you need to buy with 100 coins.

kali@kali:~/Desktop/pico$ nc mercury.picoctf.net 24851

Welcome to the market!

=====================

You have 40 coins

Item Price Count

(0) Quiet Quiches 10 12

(1) Average Apple 15 8

(2) Fruitful Flag 100 1

(3) Sell an Item

(4) Exit

Choose an option:

How many do you want to buy?

-1

You have 50 coins

Item Price Count

(0) Quiet Quiches 10 13

(1) Average Apple 15 8

(2) Fruitful Flag 100 1

(3) Sell an Item

(4) Exit

Choose an option:

How many do you want to buy?

-10000000000000

You have 50 coins

Item Price Count

(0) Quiet Quiches 10 13

(1) Average Apple 15 8

(2) Fruitful Flag 100 1

(3) Sell an Item

(4) Exit

Choose an option:

How many do you want to buy?

-2

You have 70 coins

Item Price Count

(0) Quiet Quiches 10 15

(1) Average Apple 15 8

(2) Fruitful Flag 100 1

(3) Sell an Item

(4) Exit

Choose an option:

How many do you want to buy?

-3

You have 100 coins

Item Price Count

(0) Quiet Quiches 10 18

(1) Average Apple 15 8

(2) Fruitful Flag 100 1

(3) Sell an Item

(4) Exit

Choose an option:

How many do you want to buy?

Flag is: [112 105 99 111 67 84 70 123 98 52 100 95 98 114 111 103 114 97 109 109 101 114 95 53 51 50 98 99 100 57 56 125]

Convert this decimal to ascii we get the flag:

picoCTF{b4d_brogrammer_532bcd98}

What's your input?

Description

We'd like to get your input on a couple things. Think you can answer my questions correctly? in.py nc mercury.picoctf.net 13142

Solution:

Download the source code in.py. Look at the code. Looks the first question actually doesn't matter. The second question you need to get the right answer to get the flag.

Connect to the site, run some examples:

kali@kali:~/Desktop/pico$ nc mercury.picoctf.net 13142

What's your favorite number?

Number? 34

You said: 34

Okay...

What's the best city to visit?

City? London

City? 1==2

You said: False

City? 1-1=0

City? 1==1

You said: True

Thanks for your input!

Interesting, it looks when you enter a city name, it does not take the result. Instead if you enter a logic expression, it will evaluate it and show False or True.

Try the code in local machine, it appears to be a behavior from Python version 2.7. In Python version 3 it works as expected.

kali@kali:~/Desktop/pico$ python

Python 2.7.18 (default, Apr 20 2020, 20:30:41)

[GCC 9.3.0] on linux2

Type "help", "copyright", "credits" or "license" for more information.

>>> res = input("City? ")

City? London

Traceback (most recent call last):

File "<stdin>", line 1, in <module>

File "<string>", line 1, in <module>

NameError: name 'London' is not defined

>>> London

Traceback (most recent call last):

File "<stdin>", line 1, in <module>

NameError: name 'London' is not defined

>>> res = input("City? ")

City? 1==1

>>> print("You said: {}".format(res))

You said: True

Google search "python 2.7 input name is not defined", find this one:

https://stackoverflow.com/questions/21122540/input-error-nameerror-name-is-not-defined

Follow the idea from above article:

kali@kali:~/Desktop/pico$ nc mercury.picoctf.net 13142

What's your favorite number?

Number? 23

You said: 23

Okay...

What's the best city to visit?

City? city

You said: Nashville

I agree!

picoCTF{v4lua4bl3_1npu7_4379065}

Scavenger Hunt

Description

There is some interesting information hidden around this site http://mercury.picoctf.net:55079/. Can you find it?

Solution:

The pieces of flag are scattered in different places. Need to find them all.

First piece, check homepage source code

Second piece, check css source code at mycss.css within developer tool:

/* CSS makes the page look nice, and yes, it also has part of the flag. Here's part 2: h4ts_4_l0 */

Third piece, in myjs.js from developer tool, there is a hint "/* How can I keep Google from indexing my website? */"

so check the robots.txt

# Part 3: t_0f_pl4c

And there is a hint "# I think this is an apache server... can you Access the next flag?"

Fourth piece:

http://mercury.picoctf.net:55079/.htaccess

# Part 4: 3s_2_lO0k

With a hint "# I love making websites on my Mac, I can Store a lot of information there."

Fifth piece:

This is the hardest one. At the beginning I thought it was index.html.en which was mentioned in many posts. Google a lot of places and finally find this: https://logicintel.com/removing-ds_store-files-on-linux-server/

http://mercury.picoctf.net:55079/.DS_Store

Congrats! You completed the scavenger hunt. Part 5: _74cceb07}

So put all the pieces together and the flag is:

picoCTF{th4ts_4_l0t_0f_pl4c3s_2_lO0k_74cceb07}

MacroHard WeakEdge

Description

I've hidden a flag in this file. Can you find it? Forensics is fun.pptm

Solution:

Tried first with File->INFO->Inspect Presentation, and then View->Macro, nothing found.

Then tried to check metadata and other hidden info online at https://products.aspose.app/slides/family without luck.

More research about pptm file format leads me this article:

https://docs.fileformat.com/presentation/pptm/

So pptm extension actually is a zip file.

Change the file extension from pptm to zip, then unzip it.

Tried grep command but didn't find anything with pico or CTF.

kali@kali:~/Desktop/pico$ grep pico -r ./Forensics_is_fun_2/*

kali@kali:~/Desktop/pico$ grep CTF -r ./Forensics_is_fun_2/*

Look at the unzipped folder, notice there's file called hidden under ppt->slideMasters

Get rid of the space, then base64 decode it and you get the flag:

kali@kali:~/Desktop/pico/Forensics_is_fun_2/docProps$ echo "Z m x h Z z o g c G l j b 0 N U R n t E M W R f d V 9 r b j B 3 X 3 B w d H N f c l 9 6 M X A 1 f Q" | sed 's/ //g' | base64 -d

flag: picoCTF{D1d_u_kn0w_ppts_r_z1p5}

kali@kali:~/Desktop/pico/Forensics_is_fun_2/docProps$

Who are you?
Description

Let me in. Let me iiiiiiinnnnnnnnnnnnnnnnnnnn http://mercury.picoctf.net:34588/

Solution:

This challenge includes series of questions you have to meet in the HTTP request.

Use burp to intercept a request then send to repeater.

First one is obvious: only use PicoBrowser:

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36 PicoBrowser

Next one: don't trust user from another site. Add header

Referer: http://mercury.picoctf.net:34588

Next one: site only available for 2018. Add header

Date: Tue, 15 Nov 2018 08:12:31 GMT

Next one: don't like user to be tracked. Add header

DNT: 0 (Do Not Track header)

Next one: only accept users from Sweden. This means we need to tell web server my client IP is from Sweden. Add header

X-Forwarded-For: 31.15.33.12 (you can google search Sweden IP)

Last one: you need to speak Sweden. Turns out there is a web browser language identification code. Add Swedish:

Accept-Language: en-US,en;q=0.9,sv

And you will get the flag:

picoCTF{http_h34d3rs_v3ry_c0Ol_much_w0w_79e451a7}

Some Assembly Required 1

Description

http://mercury.picoctf.net:40226/index.html

Solution:

Connect to the site, enter some random inputs. Then open developer tool, observe network tab and notice no traffic is captured. Refresh the page, find there is a request to JIFxzHyW8W. Check its response and find the flag:

picoCTF{cb688c00b5a2ede7eaedcae883735759}

This one actually is easier than some earlier questions.

Some Assembly Required 2

| 110 points

Tags: picoCTF 2021Web Exploitation

AUTHOR: SEARS SCHULZ

Description

http://mercury.picoctf.net:44570/index.html

Similar to Some Assembly Required 1 challenge, use burp to intercept traffic.

Notice the traffic to /aD8SvhyVkb

At the end there is a string

+xakgK\Ns><m:i1>1991:nkjl<ii1j0n=mm09

Use cyberchef magic block, choose Intensive Mode

picoCTF{64e2a9691192fcbd4aa9b8f5ee8134a2}

picoCTF2021

Contact: info@youthcyberdefender.org