# Infos
This repository contains writeups for different CTF in which I or my team ([DaVinciCode](https://ctftime.org/team/112645)) participed.
The writeups are written by me or our DaVinciCode team members.
# 2021
# DvCTF (to join DaVinciCode)
From 10 September 2021 to 19 September 2021
(That's my first CTF :relaxed:)
# Crypto
# Baby RSA
**Category:** Crypto - **Points:** 10 - **Solves:** 41\
**Description:** Wow, this time I can't compute the the private key! Or can I?
**Infos:**
> N= 0x25b8f38aed4a22b31dde75e46e276d0d\
> e= 0x10001\
> ct= 0x10891034ce51c23bfe2f7bf29a62938e
**Solution:**\
To solve this challenge you need to calculate the p and q parameters for the RSA key.\
To do this you need to decompose the N value in prime factor. For this, the following website is great: [Prime Factor Calculator](https://www.dcode.fr/decomposition-nombres-premiers#:~:text=Qu%27est%20ce%20que%20la,un%20produit%20de%20nombres%20premiers)\
After having calculated the 2 parameters (*p: 5665192965464669089 and q: 8850847341676960237*), you can go to the following website to calculate the RSA key: [RSA Calculator](https://www.dcode.fr/rsa-cipher)\
Once on this website, you can enter the informations in the right places and the FLAG will be calculated automatically.
🚩 FLAG
```
DVC{f4c70rDB}
```
# Ressaye
**Category:** Crypto - **Points:** 10 - **Solves:** 50\
**Description:** Find the RSA key
**Infos:**
> p: 209258918746127467720145276363318243\
> q: 287635494567303317074372323571608281\
> e: 1337\
> ct: 0x4748303c3f211ce373d68b960278f7e76a2152c9ed25559caebf5dc348d
**Solution:**\
To solve this challenge the following website is great: [RSA Calculator](https://www.dcode.fr/rsa-cipher)\
Once on this website, you can enter the informations in the right places and the FLAG will be calculated automatically.
🚩 FLAG
```
DVC{t1ny_rs4_1mpl3m3nt4t10n}
```
# Unbreakable encryption
**Category:** Crypto - **Points:** 50 - **Solves:** 2\
**Description:** My friend stole this flag, but I don't care I've encrypted it with a super secret key that he'll never find!
**Infos:**
> 0x1050a3732753d7e13632d673b7f093c633c3e09353f7d7d387260317b2b
**Hint:** *Known plain*
**Solution:**\
To solve this challenge you need to do researches thanks for the hint.\
Effectively, the hint is helpful because when you search "Known Plain" on the web, you discover a lot of information about an attack, the Known Plaintext Attack (or KPA).\
Look at the CTFs and a lot of documentation that explains how to resolve this attack. After a few documentations readings, you have surely seen you need to use the XOR resolve.\
And that's the case, you need to calculate the FLAG with your message (0x1050a37\[...]) and a key to decipher the correct FLAG.\
But the problem is that you don't the key... And for finding this key you have to imagine and test keys about your CTF or information of the CTF organizer.\
So that is the best practice. In our case, the CTF is organized by a student of our establishment.\
So we need to test all information about the school (director name, city of the school, school name...)\
So there are very many possibilities. So you need to test all possibilities and sort them in importance and logical order.\
For this CTF we can test : Léonard, Vinci, Défense, IIM, ESILV, EMLV and others...\
To test the compatibility with the message and this key, we can go on two different websites that can decrypt XOR: [dCode.fr](https://www.dcode.fr/chiffre-xor) or [CyberChef](https://gchq.github.io/CyberChef/)\
⚠️ The message is in hexadecimal and I saw on a website that it is necessary to remove the first "x" of the message...\
Once these changes are done, you must enter the message and the key in the right places and the FLAG will be calculated automatically.
🚩 FLAG
```
DVC{d0n7_5h4r3_y0ur_pl41n73x7}
```
# Forensics
# Broken Portrait
{% file src="/files/D9SnziQfgCMmnxRb1fr9" %}
**Category:** Forensics - **Points:** 10 - **Solves:** 41\
**Description:** My friend sent me this image but I can't open it! Can you find out what's wrong with it?
**Infos:**
> *A corrupted .png file is provided (chall.png)*\
> Error when try to open the .png file : *"Could not load image "chall.png" Fatal error readin PNG image file: Not a PNG file"* (on Linux)
**Solution:**\
To solve this challenge you need to find a solution to open the .PNG file because the FLAG is drawn on it. To do this you need to search why the system can't recognize the .PNG extension. So here is the problem, it is the first two bytes of the file. To modify the hexadecimal code of the file, you need to find utils like GHex on Linux or HexEd on the internet. When you open the chall.png file, you can see that the two bytes are 89 0A 0A 0A 0D 0A 1A 0A. But in a real .PNG file, it is 89 50 4E 47 0D 0A 1A 0A. So you need to change these bytes and save the modifications and after you will be able to open the image and see the FLAG wrote in clear.
🚩 FLAG
```
DVC{020514a3a69e0ebce2975efb64d5c19d}
```
# Russian Dolls
{% file src="/files/LFuyyJ6HRitqSAQ4A1zn" %}
{% file src="/files/uCeP8n7EdmhAcjbAPbWi" %}
{% file src="/files/MYd6Nhh1yqN9WWRYhOQ6" %}
{% file src="/files/HvrOwAz6IedA2a6Qm0Jx" %}
**Category:** Forensics - **Points:** 10 - **Solves:** 62\
**Description:** You need to find the FLAG hidden in a .txt file among all the folders
**Infos:**
> A .zip file is provided (russian\_dolls.zip)
**Solution:**\
To solve this challenge you need to find the .txt file that contains the FLAG. So if you are a veeeeeryyyyy patient person, you can search the file manually but it is not effective and you are not sure to find that one good file. So to get around this problem, you will have to develop a small automatic script that will examine all the files contained in these folders. I choose Python because it is a very convenient and simple language to develop little scripts like that. I used the glob and open method to explore the content of the files and I put the results in a file named all.txt. When the research is done, I search the start of the FLAG as we know it (DVC{). And the FLAG is here in clear and I copied and pasted the FLAG on the CTF website.
🚩 FLAG
```
DVC{ru5514n_d0ll5}
```
# Sus USB
{% file src="/files/kIoSVMc48MngEQQAjOsy" %}
{% file src="/files/YszBckt4zpm6bkxdZ9bw" %}
**Category:** Forensics - **Points:** 49 - **Solves:** 7\
**Description:** I found a weird USB stick on the floor in my office building's parking. I plugged it in before my colleague yelled at me and proceeded to investigate the USB stick. He only managed to extract this; can you make any sense out of it? What have I done to my pc!
**Infos:**
> A .bin file is provided (dump.bin)
**Solution:**\
To solve this challenge you need to imagine the situation written in the description. So there is a person who finds a USB key on the floor of his work building. He plugs the USB on a computer and there is nothing on the key. His coworker finds just the "cracking" file by doing deep researches on the key. What can be this USB key? A Rubber Ducky USB !!! So now we need to find a decrypter of Rubber Ducky code and it is good. There is [DuckToolkit](https://ducktoolkit.com/decode#). When we upload the file on the website, it returns the script (duckycode.txt) contain in the file and we can find the FLAG in it.
🚩 FLAG
```
DVC{u5b_4r3_d4n63r0u5}
```
# Misc
# Jus de Flag
{% file src="/files/tSQJJZcpuzsMVy9ObTZC" %}
**Category:** Misc - **Points:** 10 - **Solves:** 70\
**Description:** How can I find the FLAG on the .zip file?
**Infos:**
> A .zip file is provided (jus.zip)
**Solution:**\
To solve this challenge you just need to unzip the .zip file that contains a file with the FLAG. But the problem is that we didn't know the password of the .zip file.\
So to crack the password you can go to this website [lostmypass.com](https://www.lostmypass.com/fr/file-types/zip/)\
The website gives us the password of the .zip file. He is very simple: *leonardo*\
With this password, we can now unzip the .zip file and access the file that contains the FLAG.
🚩 FLAG
```
DVC{w0w_s0_eZ}
```
# Welcome
**Category:** Misc - **Points:** 5 - **Solves:** 103\
**Description:** Welcome to DaVinciCode Recruitment CTF! To start, you can validate this challenge with the FLAG **DVC{w3lc0m3\_c7f}**
**Infos:**
**Solution:**\
To solve this challenge you just need to copy and paste the given FLAG.
🚩 FLAG
```
DVC{w3lc0m3_c7f}
```
# OSINT
# Absolutely Nuts
{% file src="/files/6Gm8QXXKu7mUIWq9AnXi" %}
**Category:** OSINT - **Points:** 10 - **Solves:** 41\
**Description:** I've always wanted to visit the statue of this fine gentleman but I don't know where it is, can you tell me what city it is in?
**Infos:**
> A .png file is provided (banana.png)
**Hint:** Flag format: DVC{Name\_Of\_City}
**Solution:**\
To solve this type of challenge you need to be veeerrryyy patient.\
For example here, we just have an image where we can see a chimpanzee whose legs are discarded. He is elongated and we can see his genitals.\
So with these details, we can do some other searches to find others information and eventually the response.\
After a looooot of searches, we can find that there is a statue in the same position in Prague :\
So the answer is Prague.
🚩 FLAG
```
DVC{Prague}
```
# Progra
# Snoop's Mission
{% file src="/files/foRsuiuRzZW1ySTgZWSq" %}
{% file src="/files/BKrzVv977h1gRC17QPrS" %}
**Category:** Progra - **Points:** 16 - **Solves:** 29\
**Description:** I'm too high to remember the code of my weed stash. Can you help me remember?
**Infos:**
> \
> The PIN is composed by 4 digits
**Solution:**\
To solve this challenge you need to find the PIN to access the secret portal.\
To find the PIN you need to test all combinations.\
So if you are veeeeeryyyyy patient, you can test PIN manually but it is not effective and you are not sure to find the good PIN.\
So to get around this problem, you will have to develop a small automatic script that will test all PINs from 0000 to 9999.\
I choose Python because is a very pratic and simple language to develop little scripts like that.\
I used the *requests* library to send requests to the server.\
When the PIN is good, the python program stops and writes in .txt file the information with the PIN and the FLAG.\
*The PIN is **4420***\
So if you don't want to enter the PIN on the website connect screen, you can copy the FLAG.\
But if you test to enter the PIN on the website, you go to a web page that display the FLAG.
🚩 FLAG
```
DVC{bl4ze_1t}
```
# Reverse
# Baby Reverse
{% file src="/files/fTpJhtqoouRs1w99hhmy" %}
**Category:** Reverse - **Points:** 33 - **Solves:** 21\
**Description:** I hid my flag in my script, but I don't what happened the file was deleted! The only thing left is this folder... Is my flag lost forever?
**Infos:**
> A .pyn file is provided (baby\_rev.cpython-39.pyn)
**Solution:**\
To solve this challenge you need to find a solution to decrypt the .pyc file.\
To do this you can use a python editor like [EduPython](http://maths-sciences-lp.ac-amiens.fr/568-edupython.html) or [PyScripter](https://sourceforge.net/projects/pyscripter/)\
After you installed the program, you need to open the .pyc file and examine the code that it returns you.\
The decrypt code is written like this :
So you need to see the start FLAG and search the rest...\
All letters highlighted in green compose the FLAG but two characters are missing (where there are two red points)\
So we need to guess these 2 characters (n and y).
When you have finished to find all letters you have the FLAG.
🚩 FLAG
```
DVC{py7h0n_b1n4ry}
```
# Basic Cracking
{% file src="/files/Pu1KYgfLDdE4GNCzw7jf" %}
**Category:** Reverse - **Points:** 42 - **Solves:** 15\
**Description:** You need to find to FLAG
**Infos:**
> A file without extension is provided (cracking)
**Solution:**\
To solve this challenge you need to do researches about the file.\
On Linux with the command `file cracking` you can find that is an ELF file.\
So after this discovery, you can orient your researches on this file type.\
After a few researches I found the [Ghidra](https://ghidra-sre.org/) util. It is a very helpful program.\
So I opened my file with this program and I saw a main function. After examine these function I saw the characters of the FLAG.
[](https://user-images.githubusercontent.com/90919471/133922011-d87e3c8b-b3fe-4844-a701-b2f133c9723d.png)
(*In yellow it is the characters order and in blue that the characters who compose the FLAG*)
🚩 FLAG
```
DVC{CrAckInG_Is_HaRd}
```
# Code Pyn
{% file src="/files/tjAL7OZhItpbTnIlW2MR" %}
{% file src="/files/2wMaeDpDtKA3HwNc9Y7c" %}
{% file src="/files/pCDwiZS8S6LrPhziKwBs" %}
**Category:** Reverse - **Points:** 34 - **Solves:** 20\
**Description:** I lost my pin code. Can you help me find it?
**Infos:**
> A .pyc file is provided (pyn.pyc)
**Solution:**\
To solve this challenge you need to find a solution to decrypt the .pyc file or to recover the program code.\
To do this I chose to develop a little python script (*bruteforcePYC.py*).\
The script recove the program structure and we can see what he is doing.\
For example the python script return this :
```
8 24 LOAD_NAME 4 (len)
26 LOAD_NAME 3 (pin)
28 CALL_FUNCTION 1
30 LOAD_CONST 5 (4)
```
This block indicate that the PIN is composed by 4 digits (*LOAD\_CONST (4)*)\
After theses lines indicate that we need to do a [XOR](https://xor.pw/#) between 5 and 3 :
```
60 LOAD_CONST 6 (5)
62 BINARY_XOR
64 LOAD_CONST 7 (3)
```
And it's the same for the 2 following PIN
```
86 LOAD_CONST 7 (3)
88 BINARY_XOR
90 LOAD_CONST 6 (5)
```
```
112 LOAD_CONST 10 (8)
114 BINARY_XOR
116 LOAD_CONST 8 (1)
```
So we have the 3 first digits (669) and the fourth need to be find manually.\
When we test the last digit, we found speedly that is 1.\
So we know the PIN code : 6691 and the FLAG is the PIN so...
🚩 FLAG
```
DVC{6691}
```
# Steganography
# Colorful Code
{% file src="/files/PQnqj9Ww2lRK2NaxUTWz" %}
**Category:** Steganography - **Points:** 47 - **Solves:** 10\
**Description:** Wtf is this image
**Infos:**
> A .jpeg file is provided (wtf.jpeg)
**Hints:** *What's that in the corners?*
**Solution:**\
To solve this challenge you need to decrypt the image.\
At looking the image, you can't find the FLAG because the image is so strange but you can see that is a special QR Code...\
So to decrypt the image there is a website who can display the content FLAG after transform the image : [JAB Code](https://jabcode.org/scan/)\
So when you upload the .jpeg file in the website the FLAG is displayed automitically.\
So after consult the website you know it's a JAB Code and not a QR Code...
🚩 FLAG
```
DVC{w31rd_b4r_c0d3}
```
# Hurt Your Eyes
{% file src="/files/RPylmeb3BxFVuuCgXdkK" %}
**Category:** Steganography - **Points:** 16 - **Solves:** 29\
**Description:** Don't blink! You'll miss it
**Infos:**
> A .png file is provided (blink.png)
**Solution:**\
To solve this challenge you need to decrypt the image.\
At looking the image, you can't find the FLAG because the image is so strange...\
So to decrypt the image there is a website who can display the content FLAG after transform the image : [Magiceye](https://magiceye.ecksdee.co.uk/)\
So when you upload the .png file in the website the FLAG is displayed automitically like that :
🚩 FLAG
```
DVC{my_3y35_hur7}
```
# Orchestra of Flags
{% file src="/files/4PYkdqmCxHREeGPHT2OI" %}
**Category:** Steganography - **Points:** 10 - **Solves:** 49\
**Description:** They say that if you concentrate enough, you can hear the flag
**Infos:**
> A .wav file is provided (orchestra.wav)
**Solution:**\
To solve this challenge you need to analyse the musical spectrum of this .wav file.\
To do that you need to use a spectrogram who can analyse the spectrum of the sound. For example you can use Audacity.\
So when you upload the .wav file in the spectrogram the FLAG is displayed automitically like that :
[](https://user-images.githubusercontent.com/90919471/133908183-cef4d1d6-843c-41b7-83da-43865b5a7637.png)
🚩 FLAG
```
DVC{5p3c7r06r4m_m461c}
```
# Tyger
{% file src="/files/d8ENPufFssqJEhdppGtL" %}
**Category:** Steganography - **Points:** 34 - **Solves:** 20\
**Description:** Find the hidden message! Wrap it in the DVC{} wrapper
**Infos:**
> A .txt file is provided (tyger.txt)
**Solution:**\
To solve this challenge you need to decode the text.\
At reading the text, you can't find the FLAG because the text is encrypted...\
So to decrypt the text there is a website who can display the content FLAG after decrypt the text content : [Tweet Your Secret Message](https://injecti0n.github.io/tweet-hidden-message/)\
So when you past the text in the website the FLAG is displayed automatically like that :
[](https://user-images.githubusercontent.com/90919471/133908508-b2bcec44-a6c9-4821-ae17-e23ddb6c8800.png)
So now you just need to paste the FLAG content in the FLAG wrapper and it's done.
🚩 FLAG
```
DVC{7w1773r_53cr37_p03m}
```
# Web
# Have I Been Pwned
**Category:** Web - **Points:** 49 - **Solves:** 7\
**Description:** Find the Flag in the files of the website
**Infos:** To preserve the health of the server, brute-force tools such as Gobuster are not allowed.
**Solution:**\
To solve this challenge you need to find the file who contains the FLAG.\
If you inspect the response header, you can see that the website is built with Werkzeug/2.0.1 and Python/3.9.5 When we connect to the website, we have been offered a basic homepage with just a simple input.\
So when you do a few researches you rapidly find that you can use the SSTI attack.\
The SSTI consist to use native template syntax to inject a malicious payload into a template, which is then executed server-side.\
One article who helped me to make an SSTI attack is published here : [SSTI attack writeup](https://anasblp.medium.com/tamu-ctf-2019-web-writeups-science-41f173ba3203). The author explains all steps to finish the attack. So after a few explanations, we start to view the results on our website. So we do a lot of commands who are update step by step. The command who gives the FLAG is :
```
{{url_for.__globals__.os.popen('cat ls cd ChallengeWeb1/flag.txt').read()}}
```
This command displays the FLAG on the web page.
🚩 FLAG
```
DVC{n0_sh4refl4g_pls}
```
# What's Up ?
**Category:** Web - **Points:** 46 - **Solves:** 11\
**Description:** Find the Flag in the files of the website
**Infos:**\
To preserve the health of the server, brute-force tools such as Gobuster are not allowed.\
**Hints:** *Request Headers* & *admin portal*
**Solution:**\
To solve this challenge you need to examine the requests sends to the server and her responses.\
To do that you need to use OWASP ZAP.\
So the challenge is decomposed in 2 steps :
1. Display the site tree for finding the admin portal page URL
{% file src="/files/Eh2DZGPqVENFYdrIHx3M" %}
[Admin Portal URL](http://davincicode.fr:5000/53Cr374DM1NP0r741)\
Once find, you can go this URL but you are stopped because you are not an admin. To change that, you need to update your requests and cookies for change the user type (normal by admin)
1. Update the user type (normal by admin)
{% file src="/files/5vMaKkZ9JKkhuDSntSHW" %}
You have discovered the FLAG in the code of the page and is also displayed on the website.
🚩 FLAG
```
DVC{c00k1ng_m4m4_l0v3s_s0me_c00k1es}
```
# 2022
# DvCTF 2022
From 11 March 2022 to 13 March 2022
# Crypto
# Cwryptographic Owacle
{% file src="/files/8h826s6aIQFHapLrbAd3" %}
**Category:** Cryptography - **Points:** 500 (at the beginning) then 467 (at the end) - **Difficulty:** Easy - **Solves:** 35\
**Description:** Nya :3 `nc challs.dvc.tf 2601`
**Infos:**
> A .py file is provided (script.py)
**Solution:**
🚩 FLAG
```
dvCTF{y0u_h4v3_500p32_d00p32_c2yp70_5kill5_uwu}
```
# Secure Or Not Secure
**Category:** Cryptography - **Points:** 500 (at the beginning) then 383 (at the end) - **Difficulty:** Medium - **Solves:** 65\
**Description:** I made secure application but i lost my cookie and now I can't connect. Can you help me? `nc challs.dvc.tf 2600`
**Solution:**
🚩 FLAG
```
dvCTF{42d71e9ee0f5205b54213b10d39c548f}
```
# small weiner
**Category:** Cryptography - **Points:** 500 (at the beginning) then 355 (at the end) - **Difficulty:** Easy - **Solves:** 72\
**Description:** Someone I hate sent me an insulting message using RSA. Can you retrieve his private key?\
**Hint:** Flag format: dvCTF{d} with d in decimal (base 10)\
**Infos:**
```
m = 0x596f7520686176652073756368206120736d616c6c207765696e65722e2049204841544520594f5521212121
N = 0x26553fbb7e4bd5bd48868a25f24d9cc5975aa8597f82110058e687dfa10dd0114c0d2011fa288dbd9d01c0a70dfa8212d5a218d513bdd8ebed9f75bc299e1461be8a23ed8ade96bc449d409fbbf5a328ee2ad3257e6c55a97641258730f74f4d3938f0df794546791ba2b1518b8d855e83f65f885d67aa000a01687ac605404e7bca681e51e6e195f77eb4785fcda0372e3d0fd90240f736243584677f89da4c6ab54d687897d5afb0801cc151c516b072aaa2d9aa8d39d34c230536cba077beaa88ff8e8940a5ba990cafd0b1326f209873a43a785d0c5477241fb6469b8c27c7d54908467a7525de18b2425901c0de3ed63472831c29818ce6efb0354c61f36b2e61146472e99209d198bc885ced0edb66eab62a968c9b98b49b756c689d69820ca1d97e1232c338084097078265ce79b25c1e37bc777247af3fee2ce7a87a697a120c0428327177cf6e934aa2d18e696474227d361a5c36992788c3b1aa8654b88852e897027d58b21576b25a5ffdcb9fbdc5167eb74f1c9082ae79ca0b89
e = 0xfc2e4d12eb69a42c074d9a0ddc6b84294f1e23d6eaa0ba53e9cb60ec0db203d31bdfb90eaca38189890ad26335ad6107cd234a415bfc73fc1bbd6c5d9da65249eebb57d889f91719cfdbd535ab19d2d317ffdf075870a62c6e05aac16c9b122e1c52d7dbeb2fb683514d0f463b58a4217f2e379e5a62be06e764e043a0eac5ac6af56816af926bcc4cd826ee1cfd4157496dc024042676503cec93de45c3c5e4dd9dcf85406a3cf93a9f784b9eef6e320cd9856aefff48df52127b98da8a0d207f588ce1c58e47419554590b1fa7fa3c38034f93a3a5112b6dd5e78c181abc2d972fbcb058575789c68c03f043bd4bf48d94fa7390c77f9fc033f3f01a5162d31056eb42a07397f3485b25396f93558466fc49ef80adea1e9d6c3d9edf529be5faf014669ae5f8e02433a2474d9c92fcc468d81aa0fd641a5647d55153713783a9e5d66fe70c9c2794325b28f20b751fb49359c4a8487bbfa7efc6270b7fa0ffe277276bba14027596d129fcbdef0a82aba24855bfd2155071b52c11da2d943
```
**Solution:**
🚩 FLAG
```
dvCTF{fl4g_cVpH3rt3Xt_bV_RS4}
```
# Forensics
# Very Bad Script
{% file src="/files/odFCgw21omyWCVjidBjB" %}
**Category:** Forensics - **Points:** 500 (at the beginning) then 410 (at the end) - **Difficulty:** Medium - **Solves:** 57\
**Description:** My grandma clicked on a malicious email and downloaded this Word document, can you dig into this ?
**Infos:**
> A .doc file is provided (verybadscript.doc)
⚠️ I zipped the .doc file because my antivirus always deleted it
**Solution:**
🚩 FLAG
```
dvCTF{vb4_0bfu5c4710n_5h3n4n164n5}
```
# Misc
# Data Leak
{% file src="/files/bIt5scXCFIdBMTO2C2EY" %}
**Category:** Misc - **Points:** 500 (at the beginning) then 480 (at the end) - **Difficulty:** Medium - **Solves:** 28\
**Description:** A team of hackers recovered user information from a website. To share the information, they developed an application. You are sure that this application hides other information: can you find the hidden data?
**Infos:**
> A .apk file is provided (dataleak.apk)
**Solution:**
🚩 FLAG
```
dvCTF{}
```
# Going postal
{% file src="/files/EF0gKtZOeRj2lOZnDgvA" %}
**Category:** OSINT & Steganography - **Points:** 500 (at the beginning) then 490 (at the end) - **Difficulty:** Easy - **Solves:** 20\
**Description:** My dear friend "Bob" made a tool online to uncover the truth behind that map.
**Infos:**
> A .jpg file is provided (map.jpg)
**Solution:**\
To solve this challenge you need to analyze the jpg file in first step.\
The image contain an Australian map and there are stanges rods on the bottom left corner.\
But what represent these rods ?\
\
After many searches we found that this image correspond to an *Australian Post 4-State Code*. Now we "just" need to found a reader for this barcode...\
When we search *Australian Post 4-State Code reader* we find a website named [*bobcodes*](http://bobcodes.weebly.com/auspost.html). What's name of our dear friend ? "Bob", exactly. We are now on the good way.\
So now, we need to convert the barcode in letters (T, D, A or H) to extract the infos. Here is the "rule" to convert :\
\
After convert the "code" is : **ATDFFDDADDAADAADFAFAFFDAFTFDAFATAFAAATADTAFDTDDDDDDDTTTDFFTDDADFAAT** and we collect some infos :
```
Format Control Code : 62
Sorting Code : 78475110
Customer Information Field : V3K4N64r00
```
We don't need these infos for the moment, but we keep them near to us.
We can now analize the first image with a steganography tool. To analyze an image in steganography, I always use [Aperisolve](https://aperisolve.fr/).\
When we upload the file on the website, we can see there is a .7z file in backgroung data : 
We download them but this .7z file is locked with password...
So now, we have to find this password.\
We can try to do a bruteforce attack... But after multiple tests any technique works.\
And earlier we found infos ! We can test with theses infos : "62", "78475110", "V3K4N64r00", "6278475110V3K4N64r00"...\
The good password is : **6278475110V3K4N64r00**\
We can dezip the 7z file and analyze extract datas. The folders names contain 4 digits and 40 numbers (0 or 1) who make a big binary.
But what can we do with these folders names ? Convert in hexa ? Build an image ? Range them in ascending order ?\
I decided to range the binary in create date order. So at the end we have this :
Looooooong datas
And the last step is to build an image with this big datas block. The website who do that is this one : [Dcode - Convert Binary in Image](https://www.dcode.fr/image-binaire)\
After generating the image we just need to find a tool who can "read" the *Data Matrix barcode* :\
\
With some searches, we found this website [Aspose](https://products.aspose.app/barcode/fr/recognize/datamatrix#) and after this image analyse, the flag is displayed.
🚩 FLAG
```
dvCTF{4U57r4114_P057_4_57473}
```
# The Hacker Man
**Category:** OSINT/Stega - **Points:** 500 (at the beginning) then 491 (at the end) - **Difficulty:** Easy - **Solves:** 18\
**Description:** I found someone on social media, teasing a CTF he made but I couldn't find out more. I think his pseudonym was "BornHackerMan".
**Solution:**
🚩 FLAG
```
dvCTF{Z2NjBpvaLnEubB}
```
# OSINT
# Elon Musk
**Category:** Cryptography - **Points:** 500 (at the beginning) then 120 (at the end) - **Difficulty:** Easy - **Solves:** 115\
**Description:**
```
Hi,
I'm a huge fan of Elon Musk so I invested all my money in cryptocurrencies. However, I I got lost in the cryptoworld and I lost something, can you help me find it?
Sincerely,
@IL0veElon
```
**Infos:**
**Solution:**\
Thanks to the chall description, we quickly find that a message from (or for) Twitter.
So we go on Twitter and search the [*IL0veElon* account](https://twitter.com/IL0veElon).\
In first step, we can see in bio that there is only one `$EGLD` in the multiple `$DOGE` and `$SHIB`. We can search on the EGLD Blockchain like here : [elrond.com](https://explorer.elrond.com/)\
But to find infos, we need to have a token id transaction...\
So after we analyze all tweets, only single one is not retweeting. So we can go furthur on this way.\
Copy/Paste the token id on the website and all infos about the transaction are displayed.\
In the *Input Data* (message) there is the flag.\
🚩 FLAG
```
dvCTF{Bl0cKcH4In_Rul3S}
```
# Monkeey
{% file src="/files/ASqYLZiTM0EeUTnZIn8U" %}
**Category:** OSINT - **Points:** 500 (at the beginning) then 50 (at the end) - **Difficulty:** Easy - **Solves:** 344\
**Description:** In what city is the statue of this monkey found Wrap it around with the wrapper dvCTF{city\_in\_lowercase} *1/10 attempts*
**Infos:**
> A .png file is provided (img.png)
**Solution:**\
This challenge comes up every year...\
So after a search in previous WU, we can find that there is a statue in the same position in Prague :\
🚩 FLAG
```
dvCTF{prague}
```
# Painting Spot
{% file src="/files/T3uZluzFQId68xZ8pbBi" %}
**Category:** OSINT - **Points:** 500 (at the beginning) then 426 (at the end) - **Solves:** 51\
**Description:** Found a nice painting spot, took a picture of it. But I can't remember where it is... The flag is in the form of `dvCTF{}` and has the flag wrapper already
**Infos:**
> A .zip file is provided (paintingSpot.zip)
**Solution:**\
To solve this challenge we need to found the place displayed on the .jpg file provided in the .zip file.\
So to get infos about this image, I upload him on [Aperisolve](https://aperisolve.fr/) and find intresting infos :\
\
That's comment in Portuguese. So we can focus on Portugal.\
We search *Portugal* but we don't find any intresting infos, *Portugal Island* who give us intresting infos about an island named **Sao Miguel Island**\
We go directly on Google Maps to search this island.\
On the image we can see an island from the Sao Miguel Island. So we search an island near to the main island. It's very simple, there is only one island\
 Now we need to find the good spot view and infos.\
We found the good place : **Praia do Corpo Santo**. When we analyse the advisers, we find the flag.\
🚩 FLAG
```
dvCTF{g3o_sp0tt3d}
```
# Welcome to the DaVinciCTF!
**Category:** OSINT - **Points:** 500 (at the beginning) then 440 (at the end) - **Difficulty:** Easy - **Solves:** 46\
**Description:**
**Infos:**
> A .jpg file is provided (img.jpg)
**Solution:**\
To solve this challenge you need to analyse all details in the image.
We can see differents details : Post-It (x3), Seed Phrase Card, Websites...\
-> **Post-It n°1 (left) :** *Binance* [*elonmusk78@gmail.com*](mailto:elonmusk78@gmail.com) *Password01*\
I try to connect on this Google account, but the password is incorrect. And searches infos [here](https://tools.epieos.com/?q=elonmusk78%40gmail.com). I didn't insist on this track.\
-> **Post-It n°2 (top right) :** *CTFd admin ThisIsAVerySecurePassword*\
I try to connect on the CTF platform and on CTFd but obviously these creds didn't work.\
-> **Post-It n°3 (bottom right) :** *TODO : - Acheter du BTC - Acheter du DegenAPE - Devenir riche - Préparer la page d'accueil du CTF*\
Nothing is really usable here...\
-> **Seed Phrase Card (bottom left) :** *minor casino able rare pretty stuff token embrace awake good infant crack news mix edge style this is not my private key sorry dude*\
I try to connect with the seed phrase on Binance, but she is incorrect. It's true that the image isn't very clear...\
-> **Webpages :** *Binance / TradingView / DigitalOcean / GitHub / dvCTF*\
I search all website but I don't find anything...\
After reviewing the image, I see that the dvCTF URL is strange : [*https://ctfd.davincicode.fr/*](https://ctfd.davincicode.fr/)*\_*. So I go to the website and if you analyze the source code, you can see that the flag is on the bottom page, but the css color the text to white.\
🚩 FLAG
```
dvCTF{8a878c2bd9c1844aac17cd051585e2f0}
```
# Pentest
# DaVinci's Playlist : Part 1
**Category:** Pentest - **Points:** 500 (at the beginning) then 212 (at the end) - **Difficulty:** Easy - **Solves:** 100\
**Description:**\
Mr Vinci contacted a web developer to create a website with his favourite rap songs. But did he make it secure?\
Website : [http://challs.dvc.tf:51080](http://challs.dvc.tf:51080/)\
Ports : 51000-52000
**Solution:**\
To solve this challenge you need to find the file's place who contain the flag.
We can find very good explainations here :
🚩 FLAG
```
dvCTF{LF1_4nd_pR1V473_k3y}
```
# DaVinci's Playlist : Part 2.5
**Category:** Pentest - **Points:** 500 (at the beginning) then 452 (at the end) - **Difficulty:** Medium - **Solves:** 41\
**Description:**\
I think Mr Vinci is mad at the administrator...\
Warning:\
You need to complete "Part 1" first\
You don't need root to get the flag\
It's forbidden to brute force network services (ex:Hydra)
**Solution:**\
To solve this challenge you need to find the file's place who contain the flag.
We can find very good explainations here :
🚩 FLAG
```
dvCTF{f3d8e7963dad81d61515b58a327d9ad0}
```
# DaVinci's Playlist : Part 2
**Category:** Pentest - **Points:** 500 (at the beginning) then 209 (at the end) - **Difficulty:** Medium - **Solves:** 54\
**Description:**\
An unintended way to solve DaVinci's Playlist : Part2
**Solution:**\
To solve this challenge you need to find the file's place who contain the flag.
We can find very good explainations here :
🚩 FLAG
```
dvCTF{763cbbc8f0f000830f4125645b587b9b}
```
# Programming
# Heaven's Gate
**Category:** Programming - **Points:** 500 (at the beginning) then 487 (at the end) - **Difficulty:** Medium - **Solves:** 23\
**Description:** Find your way to open Heaven's Gate.
```
Host: challs.dvc.tf
Port : 7337
Output of timedatectl on host:
Local time: Sat 2022-03-12 18:05:01 UTC
Universal time: Sat 2022-03-12 18:05:01 UTC
RTC time: Sat 2022-03-12 18:05:02
Time zone: Etc/UTC (UTC, +0000)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no
```
**Solution:**
🚩 FLAG
```
dvCTF{}
```
# Sudoku
**Category:** Programming - **Points:** 500 (at the beginning) then 50 (at the end) - **Solves:** 126\
**Description:** Can you solve this sudoku quickly enough?
[http://challs.dvc.tf:6002](http://challs.dvc.tf:6002/)
**Solution:**\
🚩 FLAG
```
dvCTF{}
```
# TicTacToe
**Category:** Forensic - **Points:** 500 (at the beginning) then 235 (at the end) - **Solves:** 97\
**Description:** I'm a dumb bot, but you can't beat me by hand. `nc challs.dvc.tf 6666`
**Solution:**\
🚩 FLAG
```
dvCTF{}
```
# Reverse
# CryptoVault
{% file src="/files/a8cRjTIfCyNKWhLXplbx" %}
**Category:** Reverse - **Points:** 500 (at the beginning) then 500 (at the end) - **Difficulty:** Hard - **Solves:** 4\
**Description:** I made a very secure application to store my secret. Do you think you can break it?
**Infos:**
> A .apk file is provided (vault.apk)
**Solution:**
🚩 FLAG
```
dvCTF{}
```
# Mine Game
{% file src="/files/Vh585ZIhupEGScrLXYRE" %}
**Category:** Reverse - **Points:** 500 (at the beginning) then 393 (at the end) - **Difficulty:** Medium - **Solves:** 10\
**Description:** I received this weird game in my mailbox but i don't know how to play. Can you help me win? `nc challs.dvc.tf 7800`
**Infos:**
> A file without extension is provided (file)
**Solution:**
🚩 FLAG
```
dvCTF{59c3807536472fb45a1445ab3a209b79}
```
# Obfuscated
{% file src="/files/ckgGZnzGxmJ3vUwe0I4d" %}
**Category:** Reverse - **Points:** 500 (at the beginning) then 457 (at the end) - **Difficulty:** Easy - **Solves:** 40\
**Description:** My friend says that he used the best obfuscator. Can you prove him that he's wrong?
**Infos:**
> A .jar file is provided (file.jar)
**Solution:**
🚩 FLAG
```
dvCTF{327f7e3cbf488c1d284e27ff97bd0987}
```
# Peripheral Interface Controller XVI
{% file src="/files/HRJLLkPL6wpu2harvOG7" %}
**Category:** Reverse - **Points:** 500 (at the beginning) then 498 (at the end) - **Difficulty:** Hard - **Solves:** 10\
**Description:** I found this program on an old computer but I can't run it. Can you help me?
**Infos:**
> A file without extension is provided (program)
**Solution:**
🚩 FLAG
```
dvCTF{}
```
# Steganography
# ICMP
{% file src="/files/MdzVAPp4rT5zOFPOCydj" %}
**Category:** Steganography - **Points:** 500 (at the beginning) then 292 (at the end) - **Difficulty:** Medium - **Solves:** 292\
**Description:**
**Infos:**
> A .pcap file is provided (ICMP.pcap)
**Solution:**\
To solve this challenge you need to analyse (with Wireshark) the Info column in .pcap file.\
When you do that you can see there are **seq** elements : 
Now you just need to range the seq elements in ascending order and take the **id** value.
When you have all elements you need to convert them in hex then Base64 :\
5a485a4456455a376144466b5a475675587a46755833526f5a5638785a4830\
From Hex ==> ZHZDVEZ7aDFkZGVuXzFuX3RoZV8xZH0\
From Base64 ==> *The flag*
Or you can do the 2 steps in 1 with [CyberChef](https://gchq.github.io/CyberChef/) : 
🚩 FLAG
```
dvCTF{h1dden_1n_the_1d}
```
# The Arts of Details
{% file src="/files/w9W4CgGmLuOkHQrulrNk" %}
**Category:** Steganography - **Points:** 500 (at the beginning) then 50 (at the end) - **Difficulty:** Easy - **Solves:** 145\
**Description:** A simple detail can make a big difference Always beware of the first element
**Infos:**
> A .docx file is provided (The\_Art\_of\_Details.docx)
**Solution:**\
🇫🇷 Français :\
Pour résoudre ce challenge nous devons donc examiner le fichier .docx\
Dans un premier temps nous pouvons l'ouvrir pour voir son contenu. Après avoir regardé, rien d'intéressant dans ce contenu.\
Comme il n'y a rien dans le contenu du fichier, nous allons voir s'il n'y a pas quelques choses dans la partie "non visible" du fichier : 
Avec la commande `unzip ` nous extrayons tous les documents "cachés" dans le fichier. Et enfin la commande `tree` nous permet de voir tous les fichiers extraits.\
Nous pouvons donc voir qu'il y a 3 images :\
Si nous scannons ces images, nous obtenons des infos très importantes :
* image1.png : `aXRpc25vdHRoZWZsYWc=`
* image2.png : `dGhla2V5ezRBajgyRDZoUlpLQThocXA1dG01fQ==`
* image3.png : `defaw{u1qeuugx&crl0gl_4_r_fbe4a_f4hli0rm}` (ça ressemble beaucoup à un flag de la forme `dvCTF{flag}`)\
Ces 2 premières chaines de caractères sont encodées en Base64. Si nous les décodons cela nous donne :
* Base64 : `aXRpc25vdHRoZWZsYWc=` => `itisnottheflag`
* Base64 : `dGhla2V5ezRBajgyRDZoUlpLQThocXA1dG01fQ==` => `thekey{4Aj82D6hRZKA8hqp5tm5}`\
Après avoir recueillis tous ces éléments, nous pouvons voir que nous avons une clé et le flag encodé...\
Nous allons donc nous diriger vers une attaque Vigenère (avec [CyberChef](https://gchq.github.io/CyberChef)) :\
* Mais nous avons un problème. Il n'accepte pas la clé que nous avons mise, car il n'accepte que les clés composées uniquement de lettres.\
Donc voici comment faire :\
🚩 FLAG
```
dvCTF{v1genere&qrc0de_4_a_gre4t_p4ssw0rd}
```
# Treasure
{% file src="/files/DnCLQW752iYSDQdyRkkK" %}
{% file src="/files/mWgHiLyW5stcyodelTTA" %}
{% file src="/files/ECNw5QS6AOLEL40strRt" %}
#### Treasure
**Category:** Stega - **Points:** 500 (at the beginning) then 500 (at the end) - **Solves:** 2\
**Description:** We have recovered an image and an audio file. Our expert found some useful information in the readme. It's up to you to find the flag!
**Infos:**
> A .mp3 file is provided (Flag.mp3)\
> A .jpg file is provided (Hint.jpg)\
> A .md file is provided (READMEbis.md)
**Solution:**
🚩 FLAG
```
dvCTF{}
```
# Warmup
# EBG13
**Category:** Cryptography - **Points:** 500 (at the beginning) then 10 (at the end) - **Solves:** 640\
**Description:** We found this message : can you decipher it? `qiPGS{3apElcg1ba_1f_r4fl}`
**Infos:**
**Solution:**\
To solve this challenge you need to decrypt the message.\
With the title chall, we quickly find that the encryption use is ROT13.
So when we go on this website ([rot13.com](https://rot13.com/)) and copy/paste the encrypted message, the flag is decrypted.
🚩 FLAG
```
dvCTF{3ncRypt1on_1s_e4sy}
```
# FrenchFlag
{% file src="/files/U69T01sqmYPmXTVgcfnj" %}
**Category:** Forensic - **Points:** 500 (at the beginning) then 10 (at the end) - **Solves:** 614\
**Description:** Can you find the data present in our flag ?
**Infos:**
> A .png file is provided (flag.png)
**Solution:**\
To solve this challenge you need to analyse the .png file.\
To analyse an image I know some commands who are basic.
```
file **
strings **
exiftool **
```
So I tested these commands but the first didn't gave me the flag...\
But the second and third command display the flag in the .png infos : 
🚩 FLAG
```
dvCTF{flagception}
```
# MP3
{% file src="/files/joPGelbl2A4avsG8wK4y" %}
**Category:** Steganography - **Points:** 500 (at the beginning) then 10 (at the end) - **Solves:** 218\
**Description:** The flag in the audio is given without the tag format ! You must fill in : `dvCTF{%flag%}`
**Infos:**
> A .mp3 file is provided (MP3.mp3)
**Solution:**\
To solve this challenge, you need to analyze the audio of the .mp3 file.\
To hear the flag you need to reverse the audio with Audacity.\
Now you can hear something, but it's not very clear...\
So to fix this problem you need to slow down the audio (about -50%).\
With concentration and a little bit guessing, you can find the flag.
🚩 FLAG
```
dvCTF{r3v3rs3_mp3}
```
# QmFzZTY0
{% file src="/files/AmLp9M9ltaB0s4Tyzzp2" %}
**Category:** Cryptography - **Points:** 500 (at the beginning) then 10 (at the end) - **Solves:** 640\
**Description:** We found this message : can you decipher it? `qiPGS{3apElcg1ba_1f_r4fl}`
**Infos:**
> A .txt file is provided (file.txt)
**Solution:**\
To solve this challenge you need to decrypt the message.\
With the title chall, we quickly find that the encryption is in link with Base64.
So when we go on ([CyberChef](https://gchq.github.io/CyberChef/)) and copy/paste the encrypted message, we can see that the content is reduce.\
We continue to decrypt by add more "From Base64" block. And after **20** blocks the flag is displayed.
I also created a python program to do that (decode.py)
🚩 FLAG
```
dvCTF{Base64_Is_The_Best}
```
# RSA
**Category:** Cryptography - **Points:** 500 (at the beginning) then 87 (at the end) - **Difficulty:** Easy - **Solves:** 79\
**Description:** Our team has found a cipher text: there seems to be some clues to decipher it. Can you help us to read it?\
**Hint:** There is another decoding step after the decryption!\
**Infos:**
```
n = 0x7CD1020889B4382BE84B3F14EAAE242755CC1BD56F431B348F4FF8F207A96F41AFCF3EBDF4C17CB6537AD4B01B9FF9497763B22D013B614C8FCDB0C34F9D88F1A523013791EDFEB1FBBA160799892C118892FB7F199C9957DF5A26DAB4D776E5226F06ACD05412F6DD2B1B75D24CE9DC2DDAC513BCB96CD9B97F9BEF8543A3A1
phi = 0x7CD1020889B4382BE84B3F14EAAE242755CC1BD56F431B348F4FF8F207A96F41AFCF3EBDF4C17CB6537AD4B01B9FF9497763B22D013B614C8FCDB0C34F9D88F037D2317D3864035ECE8BCDD458711B788B5B3FDFD5164F7D736D0A56F416E8C16126E3868D73F54AF4D61F6033E069994319C849460C60A725A0F4DD97EDCC84
e = 0x10001
ct = 0x268D7D5F5593EA30F536635B58585620B51D2D143AFE4734635C259278D61413D0C89678E81EDF466B1E45E27EBF802F62F61263E499A516465163C7CB668F94258B3424C3E2BD76634923DECD670E4B6034F8FD00C76F9DAD00A72DB22B70B9408C89FCEE4C9B0D2D4B5664284328711BFAD57FBE1EDCC0854AAD57390DCAD6
```
**Solution:**\
To solve this challenge you need to decrypt the message.\
So to try to decrypt the hidden message, I decide to use this site : [dCode - RSA](https://www.dcode.fr/rsa-cipher)\
After we put the infos in the valid place, we received a list of numbers : `100118678470123102108521039599861127251114116518811695988695828352125`\
Personally, I don't reconize what's the encryption type. So I use this ([dCode - Recognize Cipher](https://www.dcode.fr/identification-chiffrement)) to find the cipher method.\
Some tests later, we find that ASCII encryption. We can now decrypt the message with this website : [dCode - ASCII Code](https://www.dcode.fr/code-ascii).\
The flag is displayed immediately.
🚩 FLAG
```
dvCTF{fl4g_cVpH3rt3Xt_bV_RS4}
```
# Welcome
**Category:** Warmup - **Points:** 1 - **Solves:** 520\
**Description:** Welcome to the DaVinciCTF2022! Read the rules and join the discord *(discord link)*
**Infos:**
**Solution:**\
To solve this challenge you just need to copy and paste the given FLAG.
🚩 FLAG
```
dvCTF{4nd_n0w_w3_f149}
```
# Web
# CyberStreak v1.0
**Category:** Web - **Points:** 500 (at the beginning) then 367 (at the end) - **Difficulty:** Easy - **Solves:** 68\
**Description:**\
Hello,\
I am a student and I would like to improve my web development skills. To practice, I am creating my first web application. This application is a kind of cybercoach. Example: you want to do sports. A sport goal could be to do 100 push-ups per day for 1 month. The application will allow you to create this "challenge" and each day, you will have to do the number of push-ups you have set and note it in the application. If you don't do the push-ups for 3 days, it's a failure and you lose your streak.
This first version of the application gives you the possibility to create an account and to do the challenge of the example.
Can you test the security of my application ?
**xXx-michel-xXx**
[http://challs.dvc.tf:5001](http://challs.dvc.tf:5001/)
*Brute force is strictly forbidden and useless.*
**Solution:**\
To solve this challenge you need to bypass the login screen.
In first time, we complete the registration/login forms to see what's going on.\
When a user login, a cookie is built with the user infos :\
`Cookie: session=eyJ1c2VybmFtZSI6IkF5d2V0aDIwIn0.YjR4nQ.-CVhEOLLoNn3A4IISosy5ut-7LM`\
If we decipher this cookie with a Base64 decoder we found interesting infos : `{"username":"Ayweth20"}���'@%a�âË Ù÷���J�2æë{,` The first cookie part is about the username.
So at this moment I didn't know how I can continue... After some researches I found that the cookie is a Flask cookie (the 3 points `.` is characteristic about this cookie type.
Now with a tool named [`flask-unsign`](https://pypi.org/project/flask-unsign/) I can brute-force the secret key with this command : `flask-unsign --unsign --cookie ""`\
Thanks to this tool, we can find the secret key contain in the cookie : `s3cr3t`\
The admin might be **xXx-michel-xXx** as say in the note of the challenge. So we use this username and the secret key to build the admin cookie.
With this command : `flask-unsign --sign --cookie "{'username': 'xXx-michel-xXx'}" --secret 's3cr3t'` we can have the admin cookie : `eyJ1c2VybmFtZSI6InhYeC1taWNoZWwteFh4In0.YjR-fg.n7h94NZbSUXDOBymQHaBuwVhZCQ`
Now if we try to login to the web app with this cookie (thanks to BURP or Firefox) we arrived on the admin page with the flag :\
🚩 FLAG
```
dvCTF{80b8d1A92G6a13a98Dc7b546a7a7Y35}
```
# 🎵
**Category:** Web - **Points:** 500 (at the beginning) then 454 (at the end) - **Difficulty:** Medium - **Solves:** 41\
**Description:** [http://challs.dvc.tf:9000](http://challs.dvc.tf:9000/)
**Solution:**\
To solve this challenge you need to find the file's place who contain the flag.
We can find very good explainations here :
🚩 FLAG
```
dvCTF{1c5b0abc99b19effaacd1aa7d6ec28f8}
```
# picoCTF 2022
From 15 March 2022 to 29 March 2022
# Challs WU
# @HackDay - Qualifications
From 08 April 2022 to 19 April 2022
# Crypto
# Francis Bacon
{% file src="/files/3P72zuUid1Cel1sSg00M" %}
**Category:** Crypto - **Points:** 100 - **Solves:**\
**Description:**\
Decipher the hidden message!
**Solution:**\
To solve this challenge you need to decipher the flag in the [chal2](https://github.com/Ayweth20/HackDay_Qualifications/blob/main/Crypto/Francis%20Bacon/chal2) file.\
If we do a `file chal2` command, we can see that's an ASCII text file.\
To see the content file, we do `cat chal2` and this string is send back : *AAAABAAAAAAAABAABBABABBAAAAABAAAAAAABBAAAABABABAAABAAAAAABAABAABBABBBA*\
To find the string encryption, we can go on this [website](https://www.dcode.fr/identification-chiffrement)\
The [**Bacon Cipher**](https://www.dcode.fr/chiffre-bacon-bilitere) is detected and if we go on the website to decrypt this string the flag is decode.\
🚩 FLAG
```
HACKDAY{BACONCANFIREUP}
```
# Francs Maçons
{% file src="/files/vNXEMC0kVGpg89Z8cH08" %}
**Category:** Crypto - **Points:** 100 - **Solves:**\
**Description:**\
This communication has just been intercepted, decipher the hidden message!
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# Rotate-me!
{% file src="/files/GADLNKtLXIvAILnNLZYG" %}
**Category:** Crypto - **Points:** 100 - **Solves:**\
**Description:**\
This communication has just been intercepted, decipher the hidden message!
**Solution:**\
To solve this challenge you need to decipher the flag in the chal2 file.\
If we do a `file chal3` command, we can see that's a long ASCII text file.\
To see the content file, we do `cat chal3` and this string is send back :
Content
01010001 01010111 01111000 01111001 01100001 01010111 01100100 01101111 01100100 01000011 01110111 01100111 01010100 01101101 00111001 00110011 01001001 01000111 01011010 01110110 01100011 01101001 01000010 00110000 01100001 01000111 01010101 01100111 01011010 01101101 01101100 01110101 01011001 01010111 01110111 01100111 01100011 00110011 01010010 01101000 01011010 00110010 01010101 01110011 01001001 01000111 01000101 01100111 01100011 00110011 01010110 01101001 01100011 00110010 01101100 00110000 01100100 01010111 01000110 00110000 01100001 01010111 00111001 01110101 01001001 01000111 01001110 01110000 01100011 01000111 01101000 01101100 01100011 01101001 00110100 01100111 01010011 01000111 01010110 01111001 01011010 01010011 01000010 00110011 01011010 01010011 01000010 01111001 01011010 01011000 01000010 01110011 01011001 01010111 01001110 01101100 01011010 01000011 01000010 01101100 01100100 01101101 01010110 01111001 01100101 01010011 01000010 01101000 01100010 01001000 01000010 01101111 01011001 01010111 01001010 01101100 01100100 01000111 01101100 01101010 01001001 01000111 01001110 01101111 01011001 01011000 01001010 01101000 01011001 00110011 01010010 01101100 01100011 01101001 01000010 00110011 01100001 01011000 01010010 01101111 01001001 01000111 01000101 01100111 01011001 01010111 00110101 01110110 01100100 01000111 01101000 01101100 01100011 01101001 01000010 01101010 01100010 00110011 01001010 01111001 01011010 01011000 01001110 01110111 01100010 00110010 00110101 01101011 01011010 01010111 00110101 01101010 01011010 01010011 01000010 01101011 01100001 01010111 01011010 01101101 01011010 01011000 01001010 01110101 01011010 01011000 01010001 01100111 01011001 00110010 01101000 01101000 01100011 01101101 01000110 01101010 01100100 01000111 01010110 01111001 01001100 01101001 01000010 01000100 01011001 01010111 00110100 01100111 01100101 01010111 00111001 00110001 01001001 01000111 01011010 01110000 01100010 01101101 01010001 01100111 01100100 01000111 01101000 01101100 01001001 01000111 01011010 01110000 01100010 01101101 01000110 01110011 01001001 01000111 01011010 01110011 01011001 01010111 01100011 00101111 01001001 01000110 01110000 01110011 01100001 00110010 01010010 01110110 01100101 01001000 01000110 01110111 01001001 01010011 01000010 01010111 01100010 01001000 01001001 01100111 01011010 00110011 01001010 01110111 01100011 01010011 01000010 01101010 01011010 01101101 01110100 01101101 01100011 01000111 01010110 01101001 01011001 01010011 01000010 01111000 01011010 01010111 01011010 01110111 01001001 01001000 01101100 01101001 01011010 01000111 01011010 01110010 01100001 00110010 01001010 01110110 01001001 01001000 01110000 01110110 01100100 01101101 00110001 01111000 01100010 01000011 01000010 00110110 01011010 01011000 01101000 01110000 01100001 01010111 01001010 01110010 01011010 01000111 01001001 01110101 01001001 01000101 01010110 01101001 01100010 00110010 01001001 01100111 01011010 01101110 01000001 01100111 01100101 01000011 01000010 01101011 01011010 01101101 01001110 01111000 01001001 01000111 01001110 01110011 01100010 01111001 01000010 00110010 01100010 01001000 01001010 01110110 01001001 01000111 01010110 00110100 01100010 00110010 01000101 01100111 01100100 01000111 01111000 01110110 01100001 01000100 01101111 01100111 01010010 01010110 01101000 01100001 01010011 01000101 01000110 01011001 01010110 01101110 01110011 00110011 01011010 01010100 01010010 01111000 01100011 01000110 00111001 00110000 01011010 01010100 01010010 01111000 01011000 00110011 01010010 01101001 01011000 00110011 01101111 00110000 01001101 01010100 01000110 01100110 01010111 01101101 00111001 00110010 01100010 01010100 01100011 01110111 01100110 01010001 00111101 00111101
To decrypt the ASCII content we can go on this [website](https://www.dcode.fr/code-ascii)\
A Base64 is send back and to decrypt them we use this [website](https://www.base64decode.net/)\
A string with the flag format is send back and that's an [Affine Cipher](https://www.dcode.fr/chiffre-affine) encryption.
🚩 FLAG
```
HACKDAY{7h4ts_wh4t_we_c411_Cryp70}
```
# Un message codé ?
{% file src="/files/YWxQ7OlJGrDkvukbBWrB" %}
**Category:** Crypto - **Points:** 100 - **Solves:**\
**Description:**\
A certain Alan sent us this text and asked us to find out what the message means.\
Additional information :
* *Model* = Enigma M3
* *Reflector* = UKW B
* *Plugboard* = bq cr di ej kw mt os px uz gh
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# Forensics
# bad\_timing\_for\_reversing
{% file src="/files/guvT1B4QQEGzlnzMMqOM" %}
**Category:** Forensic - **Points:** 300 - **Solves:**\
**Description:**\
Never neglect the time and find the QR.
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# Hardware
# Cubik'cipher
{% file src="/files/xphEBvi3oBpl9Wx5gXup" %}
**Category:** Hardware - **Points:** 450 - **Solves:**\
**Description:**\
A month ago, a spy managed to infiltrate the secret lair of an enemy!\
This one was developing his own data encryptor!\
Since then, it seems that the enemy has finished it, so it's up to us to build the decryptor that will allow us to spy on him without him noticing!
**Hints:**
> Hint 1\
> Hint 2
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# WebSDR
**Category:** Hardware - **Points:** 350 - **Solves:**\
**Description:**\
At nightfall, everything lights up.\
A beacon emits a signal in order to be recovered. The signal is emitted at 3.58 MHz every minute for about 30 seconds.\
Find the message emitted.
**Hints:**
> Hint 1\
> UART : (1 parity bit + 2 stop bits + 1 start bit)
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# Reverse
# Calling Conventions
{% file src="/files/UQzzP1Ycjt0nrmJC6OKr" %}
**Category:** Reverse - **Points:** 200 - **Solves:**\
**Description:**\
It lacks something...\
The flag is of the form `HACKDAY{return*999999999}`\
Infos:\
Parameter1 : 0xDEADC0DE, Parameter2 : 0xDEADBEEF
**Solution:**
🚩 FLAG
```
HACKDAY{59999999940}
```
# Memory Investigation
{% file src="/files/Yx6h9wxDkxPNXP1QgywC" %}
**Category:** Reverse - **Points:** 100 - **Solves:**\
**Description:**\
It's all about execution.\
The flag is of the form HACKDAY{return}
**Solution:**\
To solve this challenge you need to find the return value.\
So to find the flag, we need to understand how the program work.\
To test him we put the command `./challenge1.elf` then `./challenge1.elf FLAG`. The results are here :\
\
Without *key* we received the "*Segmentation Fault*" message but with a *key* we have a good message.\
So to decompile and see the program code, we need to use **Ghidra** and find the good function who generate the flag (return).\
To find them, we use the "*Search* > *For Strings...* > *Search*" and write "*LUCK*" in the input to find the place :\
\
[](https://user-images.githubusercontent.com/91023285/163861434-f3e79ab9-b2dc-4fe0-bb67-4c5c8510ea35.png)\
With the decompile code (right part), we can see that's the *func2* function who generate the flag.\
So now we want to run the program with **gdb-peda** to break at the func2 and see the return value :\
🚩 FLAG
```
HACKDAY{BBBFFFF22BBBBBBJVZJV}
```
# Steganography
# I can make pictures
{% file src="/files/ytBTUHED5Y9S6rLO98r4" %}
**Category:** Stegano - **Points:** 200 - **Solves:**\
**Description:**\
Hello agent, we just listened to traffic from a very dangerous mafia! I count on you to gather the evidence so that he spends a long time in prison!
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# J'ai perdu le flag :(
**Category:** Stegano - **Points:** 300 - **Solves:**\
**Description:**\
Hey! Yes, you there! can you help me find the flag?\
I think I lost it :(\
To help me you will have to look in the files.\
And maybe ask for help...\
There is text in incomprehensible languages, is that the key?\
Our logo is beautiful, isn't it?
**Hints:**
> Hint 1\
> 3 different algorithms must be used successively on a string
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# Pokémons
{% file src="/files/oa7j6TB4crnC7f1ldhlg" %}
**Category:** Stegano - **Points:** 50 - **Solves:**\
**Description:**\
Do you like Pokemon? I love it!\
Here is a part of the pokédex, it contains confidential information, find it!
**Hints:**
> It is not necessary to know the Pokemons
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# Un coup de maître
{% file src="/files/Y9OYm8OG1Q5R6jYgjwJR" %}
**Category:** Stegano - **Points:** 200 - **Solves:**\
**Description:**\
It seems that these two groups continue to exchange with each other, try to find out what is hiding behind their heads this time (again).\
The flag is of the form `HACKDAY{FOUNDSOLUTION123}`
**Hints:**
> The name of the challenge is not there by chance!\
> Hint 2
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# Un logo cachotier
{% file src="/files/G05odTFwUbUKeVsWTpKk" %}
**Category:** Stegano - **Points:** 200 - **Solves:**\
**Description:**\
We found an exchange between two dangerous groups, but it was only an [image](https://github.com/Ayweth20/HackDay_Qualifications/blob/main/Stegano/Un%20logo%20cachotier/chall1.bmp), look for what it hides in order to know what they have in mind
**Hints:**
> Hint 1
**Solution:**
🚩 FLAG
```
HACKDAY{}
```
# Web
# GIT!
**Category:** WEB - **Points:** 100 - **Solves:**\
**Description:**\
Best practices have not been used on this site. Find the administrator password.\
Link :
**Solution:**\
To solve this challenge you need to find the flag.\
So to find the flag, we need to find a file who contain confidential infos.\
To do that, we need to do some research. After some website and differents test, we can find that there is a *.git* file stored on the website server.\
We can find this file, but we can't find any interesting infos in them.\
\
Now we need to find how to download the file on our computer to analyse them.\
A tool to dump a git repo from a website is available [here](https://github.com/arthaud/git-dumper)\
With this [tool](https://github.com/arthaud/git-dumper) we can download the .git file and all the website files.\
In the downloaded file we have the *login.php* file and the source code contain a credential verification :\
\
With these info, we can connect on the login panel and we are redirected to webpage who displayed the flag.
🚩 FLAG
```
HACKDAY{6549871545354dsfrgOIHIGIGIUFYGUTFIHI}
```
# Part. 1 - Uploads
**Category:** WEB - **Points:** 200 - **Solves:**\
**Description:**\
Find a way to control the server.\
This step is the result of a three-part challenge.\
*It is reset every 30min, so the platform may be unavailable for a few seconds.*\
Link :
**Solution:**\
To solve this challenge you need to find a way to control the server and find the flag.\
To find a "vulnerability" we can try to find the open ports on the server.\
To do that, we use the NMap tool with the `nmap 51.255.172.76` command. The results are displayed 1 minute later :\
\
So there are 4 open ports that we can use.\
After some search I found a vulnerability (misconfiguration) on the FTP port where we can connect with the *anonymous* infos.\
We can try to connect on the FTP port server with the command : `ftp 51.255.172.76` and the credentials : `anonymous:anonymous`\
When we are connected to the server we can upload a [webshell](https://github.com/flozz/p0wny-shell) whith this command : `put shell.php` and we are allowed to access directly to all files server.\
When the webshell is ready we can use them and find the file who contain the flag.\
With just a simple `ls` command we can see the *fLaG1.txt* file.
🚩 FLAG
```
HACKDAY{159753iKGJHORSFGDHTAQS3215}
```
# Part. 2 - Old md5
**Category:** WEB - **Points:** 210 - **Solves:**\
**Description:**\
Decrypt the user's password.\
This step is the result of a three-part challenge.\
*It is reset every 30min, so the platform may be unavailable for a few seconds.*\
Link :
**Solution:**\
To solve this challenge you need to find a way to control the server and find the flag.\
The vulnerability was found in the Part. 1 - Uploads so we need to find the password of a special user.\
To find the special user, we need to analyze the *passwd* file.\
\
There is a (strange) user who can execute bash command : `shrek`\
Also, we can see that his home directory is `/home/shrek` so we decide to go at this directory.\
In this directory there is the *fLaG2.txt* file but we can't open it because we don't have permissions.\
Go back to *home* and we see that there is a file named *important.txt*. With a `cat important.txt` we receive an instruction to execute a program :\
[](https://user-images.githubusercontent.com/91023285/163721722-6c36183b-8658-47eb-b654-05c76ec4ceae.png)\
So before execute him, we prefer to analyze his content by `cat /.runme.sh` :\
\
Oh ! We have the encrypted password for shrek : **cf4c2232354952690368f1b3dfdfb24d**\
With just 1 research on internet we find the md5 decrypted password => **onion**\
Now we can connect us by SSH with this command : `ssh shrek@51.255.172.76` and this password : `onion`\
We go back to the `home/shrek` directory and analyze the fLaG2.txt file and we get the flag :\
🚩 FLAG
```
HACKDAY{ABVHDBRUshrekSKSDFMLOJFS654}
```
---
[Next Page](/llms-full.txt/1)