picoCTF 2018

2주동안 열렸었던 picoCTF 2018 에 참여한 뒤 write-up을 쓴다.

나는 리버싱분야의 문제를 혼자서 풀었다.

Reversing Warmup 1 - Points: 50 - (Solves: 6075)

ida로 열면 바로 플래그가 보인다.

flag:picoCTF{welc0m3_t0_r3VeRs1nG}

Reversing Warmup 2 

dGg0dF93NHNfczFtcEwz를 base64로 decode하면 th4t_w4s_s1mpL3 이다.

flag:th4t_w4s_s1mpL3

be-quick-or-be-dead-1

2가지 방법으로 풀었는데 

1.ida remote debugging을 이용해서 시간을 비교하는 분기문에 break point를 걸고 f9로 한번에 실행하는 방법과

2.table을 분석해서 복호화 하는 방식으로 풀었다.

arr=[0x0a    ,0xff    ,0x89    ,0xb0    ,0x38    ,0xc2    ,0xac    ,0xa4
    ,0x0b    ,0xfe    ,0x93    ,0x80    ,0x1f    ,0xf9    ,0x9e    ,0xb7
    ,0x1b    ,0xe4    ,0xb5    ,0xbb    ,0x10    ,0xff    ,0x84    ,0xb8
    ,0xdf    ,0xe3    ,0x84    ,0xb1    ,0xe4    ,0xf5    ,0x8f    ,0xac
    ,0xf1    ,0xf7    ,0x98    ,0xa6    ,0xdc    ,0xf5    ,0x85    ,0xb2
    ,0xf4    ,0xe3    ,0x9e    ,0xbe    ,0xf1    ,0xff    ,0x85    ,0xb1
    ,0xd9    ,0xa4    ,0xd3    ,0xb9    ,0xe1    ,0xa3    ,0x8f    ,0xe7
    ,0xbc    ,0xeb]
key=[122, 150, 234, 223, 123, 150, 234, 223,124, 150, 234, 223, 125, 150, 234, 223,126, 150, 234, 
223, 127, 150, 234, 223,128, 150, 234, 223, 129, 150, 234, 223,130, 150, 234, 223, 131, 150, 234, 
223,132, 150, 234, 223, 133, 150, 234, 223,134, 150, 234, 223,135, 150, 234, 223,136, 150]
for i in range(len(arr)):
    print(chr((key[i])^arr[i]),end="")

flag: picoCTF{why_bother_doing_unnecessary_computation_29ff5e84}

be-quick-or-be-dead-2

마찬가지로 테이블을 분석해서 복호화했다.

arr=[0xe9,0x24,0xed,0x41,0xd9,0x19,0xc8,0x55,0xef,0x25,0xeb,0x71,
     0xfa,0x24,0xec,0x41,0xf3,0x2c,0xed,0x4d,0xf7,0x12,0xfd,0x4b,0xee,0x38,0xeb,0x40,
     0xc3,0x28,0xd1,0x4d,0xc0,0x23,0xd1,0x4c,0xc7,0x12,0xea,0x41,0xcd,0x28,0xd1,0x48,
0xc5,0x3e,0xfa,0x71,0xc0,0x2e,0xbb,0x16,0x9f,0x7b,0xb9,0x4c,0xda,0x00]
key=[153,77,142,46,154,77,142,46,155,77,142,46,156,77,142,46,157,77,142,46,158,77,142,46,
159,77,142,46,160,77,142,46,161,77,142,46,162,77,142,46,163,77,142,46,164,77,142,46,165,77,
142,46,166,77,142,46,167]
for i in range(len(key)):
    print(chr(key[i]^arr[i]),end="")
 

flag:picoCTF{the_fibonacci_sequence_can_be_done_fast_ec58967b}

be-quick-or-be-dead-3

1,2와 동일하게 테이블을 분석해서 복호화했다.

arr=[0x4f,0xb5,0xef,0x40,0x03,0x88,0xca,0x54,
0x25,0xa5,0xe2,0x4e,0x2f,0xb5,0xef,0x70,
0x33,0xae,0xbc,0x48,0x36,0xbd,0xe1,0x42,
0x2c,0xb2,0xeb,0x70,0x20,0xa8,0xfb,0x70
,0x75,0xee,0xed,0x4c,0x7f,0xb8,0xb4,0x1e,0x34]
key=[63,220,140,47,64,220,140,47,65,220,140,
     47,66,220,140,47,67,220,140,47,68,220,140,
     47,69,220,140,47,70,220,140,47,71,220,140,
     47,72,220,140,47,73,220,140,47,74,220,140,47]
for i in range(len(arr)):
    print(chr(key[i]^arr[i]),end="")
 
    
 

flag:picoCTF{dynamic_pr0gramming_ftw_22ac7d81}

quackme 

문자열"You have now entered the"와 table을 xor 하면 플래그가 나온다. 

arr=[0x29 ,0x6,0x16,0x4F,0x2B,0x35,0x30,0x1E,0x51,0x1B,0x5B,0x14,0x4B,0x8,0x5D,
0x2B,0x52,0x17,0x1,0x57,0x16,0x11,0x5C,0x7,0x5D]  
flag=""
pico="You have now entered the "
for i in range(len(arr)):
    print(chr(arr[i]^(ord(pico[i]))),end="")
 

flag:picoCTF{qu4ckm3_7ed36e4b}

Radix's Terminal

cGljb0NURntiQXNFXzY0X2VOQ29EaU5nX2lTX0VBc1lfNDE3OTk0NTF9를 base64로 디코딩하면

picoCTF{bAsE_64_eNCoDiNg_iS_EAsY_41799451}가 된다.

flag:picoCTF{bAsE_64_eNCoDiNg_iS_EAsY_41799451}    

quackme up

프로그램을 우분투에서 실행한 후  대입해서 풀었다.

picoCTF{qu4ckm3_8c02c0af}

keygen-me-2

z3를 이용하여 슥-삭했다.

from z3 import *
  
 
s = Solver()
a=Int('a')
b=Int('b')
c=Int('c')
d=Int('d')
e=Int('e')
f=Int('f')
g=Int('g')
h=Int('h')
i=Int('i')
j=Int('j')
k=Int('k')
l=Int('l')
m=Int('m')
n=Int('n')
o=Int('o')
s.add(0<a,a<=35,0<b,b<=35,0<c,c<=35,0<d,d<=35,0<e,e<=35,
0<f,f<=35,0<g,g<=35,0<h,h<=35,0<i,i<=35,0<j,j<=35,
0<k,k<=35,0<l,l<=35,0<m,m<=35,0<n,n<=35,0<o,o<=35,c>a)
s.add((a+b)%36== 14)
s.add((c+d)%36== 24)
s.add(((c-a)%36)==6) 
s.add((b+d+f)%36==4)
s.add((c+e+g)%36==13)
s.add((d+e+f)%36==22)
s.add((g+i+k)%36==31)
s.add((b+e+h)%36==7)
s.add((j+l+o)%36==20)
s.add((m+n+o)%36==12)
s.add((i+j+k)%36==27)
s.add((h+l+m)%36==23)
print s.check()
print s.model()
 
 
 

결과:sat

[d = 3, k = 1, n = 1, h = 27, e = 17, j = 7, o = 14, i = 19, f = 2, b = 35, a = 15, g = 11, l = 35, m = 33, c = 21]

a2=[15, 35, 21, 3, 17, 2, 11, 27, 19, 7,1,1,35, 33, 1, 14]
flag=""
for i in range(len(a2)):
    if(a2[i]+48>58):
        flag += (chr(a2[i] + 55))
    else:
        flag += (chr(a2[i] + 48))
print (flag)
 
 
 

결과:FZL3H2BRJ711ZX1E

웹쉘에서 ./activate FZL3H2BRJ711ZX1E를입력하면 flag를 출력해준다.

flag:picoCTF{c0n5tr41nt_50lv1nG_15_W4y_f45t3r_252103361}

ctf후기: 푼 리버싱 문제들은 총 14문제였으나  전부 write-up 쓰기에는 너무 쉬운 문제들도 있었고 잘 기억나지 않는 문제들도 있어서 어느정도 기억에남았던 문제들이랑 기본 문제들 몇가지만 write-up을 쓴다.z3,아이다 원격디버깅을 이용하여 문제를 푼 첫번째 ctf이고 파이썬 스크립트를 내 마음대로 짤 수 있게 된 것과 해킹캠프 이후로 리버싱실력이 상당히 증가한것 같아서 기쁘다.