π ±οΈBCACTF 2024
Challenges in order on ctf page, some may seem out of order.
Binex
Inaccessible (317 solves)
Description:
I wrote a function to generate the flag, but don't worry, I bet you can't access it!
Resources:
Static resources:chall
Hints:
you could reverse engineer the function, but it's not necessary
see if you can use any debugging tools to just call the function
Solution:
Put chall binary in dogbolt.org, only Hexrays decompiled output has the hard-coded data.
Solve script:
Canary Keeper (186 solves)
Description:
My friend gave me this executable, but it keeps giving me errors. Can you get the flag?
Resources:
Netcat Links:nc challs.bcactf.com 32101Static resources:provided
Solution:
Decompile and look, just need to put things in the right places.
Juggler 1 (92 solves)
Description:
My friend here has got some issues... Mainly, he can't stop juggling.
P.S Dockerfile is provided but not necessary for Juggler
Hint: He told me he was only good at juggling small words
Netcat Links:nc challs.bcactf.com 32250
Solution:
Spam it with garbage, get the flag.
Pwnage (176 solves)
Description:
It's either a bug, a hack, an exploit, or it's pwnage.
Let this challenge stand as one of the first of many stairs to mastery over that which can only be described as pwn.
Resources:
Netcat Links:nc challs.bcactf.com 30810Static resources:provided.c
Hints:
Connect using `nc` aka Netcat
Solution:
Basically need to just guess a stack offset, guessed 0x10 off then 0x20 off and got it.
Crypto
Time Skip (297 solves)
Description:
One of our problem writers got sent back in time! We found a piece a very very old piece of parchment where he disappeared, alongside a long cylinder. See if you can uncover his flag!
Resources:
Static resources:parchment.txt
Hints:
Ignore the silly science, but perhaps he wanted to mimic encryption methods of his new time.
Solution:
Google "old cipher cylinder" first result is Scytale wiki. On to dcode.
Cha-Cha Slide (125 solves)
Description:
I made this cool service that lets you protect your secrets with state-of-the-art encryption. It's so secure that we don't even tell you the key we used to encrypt your message!
Resources:
Netcat Links:nc challs.bcactf.com 31594Static resources:server.py
Solution:
Pretty straightforward, get a known ciphertext by encrypting zeros then pass the test.
RSAEncrypter (210 solves)
Description:
I made an rsa encrypter to send my messages but it seems to be inconsistent...
Resources:
Netcat Links:nc challs.bcactf.com 31452Static resources:rsa_encrypter.py
Hints:
Search up Chinese Remainder Theorem
Solution:
We can run it as many times as we want but we only need 3 sets of data. Using CRT:
Encryptor Shop (174 solves)
Description:
After realizing how insecure the systems of many companies are (they're always getting hacked), I decided to start offering Encryption as a Service (EaaS). With such a strong guarantee of security, I'll even give you the source code AND my encrypted super secret flag.
Resources:
Netcat Links:nc challs.bcactf.com 31704Static resources:server.py
Solution:
There's a lot of info in this challenge we don't need, solution is self explanatory.
Vinegar Times 3 (319 solves)
Description:
We can't speak French and just say what we see.
We also don't know what underscores are add them yourself.
put ONLY the final decrypted cipher in bcactf{}, no intermediate steps
key - vinegar
cipher 0 - mmqaonv
cipher 1 - seooizmt
cipher 2 - bdoloeinbdjmmyg <- THIS ONE
Solution:
Freebie, vigenere cipher with key being the decoded text of the previous stage. Before the flag format was clarified, it was a bit harder. bcactf{add_to_salad_yummy}
rad-be-damned (94 solves)
Description:
My friend seems to be communicating something but I can't make out anything. Why do we live so close to Chernobyl anyways?
Resources:
Static resources:message.pyoutput.txt
Hints:
Encoded with CRC (Cyclic Redundancy Checks)
Solution:
Look at message.py to see what's going on, then just decrypt with CRC.
Foren
23-719 (274 solves)
Description:
that's a nice unanimous supreme court decision you've made public, sure would be a shame if someone didn't properly clean up remnants of a prior version of the document before publishing it
Resources:
Static resources:23-719_19m2.pdf
Hints:
this is a real thing that happened that had real articles written about it
Solution:
Hidden in the text, not visible normally so convert pdf to txt.
flagserver (57 solves)
Description:
It looks like Ircus have been using a fully exposed application to access their flags! Look at this traffic I captured. I can't seem to get it to work, though... can you help me get the flag for this very challenge?
NOTE: During normal operation, directly connecting to flagserver using nc should give some nonprintable characters like οΏ½οΏ½. If instead you receive nothing, please let us know.
Resources:
Netcat Links:nc challs.bcactf.com 30134Static resources:flagserver.pcapng
Hints:
It looks like their server contains flags for two challenges - this one ("flagserver") and a decoy one.
Solution:
We can look at the pcapng to see the communication with the server, then we just replace the command (fakechall) with flagserver and copy the rest of the bytes used in the request command. One hiccup is that flagserver is 10 characters while fakechall is 9, and when we replace as is, we see the server only gets "flagserve". Luckily the byte right before the string is 0x09 which we can assume is a length field, so replace that with 0x0A and we win.
magic (131 solves)
Description:
I found this piece of paper on the floor. I was going to throw it away, but it somehow screamed at me while I was holding it?!
Resources:
Static resources:magic.pdf
Hints:
the pdf should be interactive; if not, try changing your pdf viewer
Solution:
We can extract the js from the file with pdfinfo, deobfuscate it to see we need "producer", then solve the challenge.
π©ΈMysterious Melody (29 solves)
Description:
We intercepted this mysterious melody being played on a secretive radio station. Can you figure out what it means?
Resources:
Static resources:melody.wav
Hints:
base 16
Solution:
First we need to transcribe the notes, I forget what I used but it was some python package that used AI to convert to a midi file. Then, I ran this on the output.
Output was still messed up so fixed manually in cyberchef, just some extra zeros.
Chalkboard Gag (383 solves)
Description:
Matt Groening sent me an unused chalkboard gag, he says there's something special inside of it.
Resources:
Static resources:chalkboardgag.txt
Hints:
There are some unique differences in some of the lines...
Solution:
Find/replace delete the string that repeats to isolate the unique lines. I just manually copied the flag from there.
Touch Tone Telephone (31 solves)
Description:
theres a demon inside of my head now im unable to go to bed i gave a shout the phone rang out and now theres just feelings of dread
i picked up the phone and i heard a resounding cry from the herd of phone systems cursed and stuck with the curse of button pressing till theyre dead
i heard the beeping with my ears knowing it could solve all my fears to find the demon the lemon heathen to wipe away ctf tears
Resources:
Static resources:output.wav
Hints:
DTMF is a really cool technologyThere also used to be A, B, C, and D menu selection keysHow many keys are there in total? Is it a computer science-y number?For key to number, Start at top left, reading order. (Sorry, 0 is not 0, my bad)
Solution:
Tried with online tools and got close but it really needed a custom solution since the last part is to decode from an arbitrary hex string which can't be corrected manually. Below is code to record the DTMF from the file, to convert the mapping, then to decode.
Touch Tone Telephone (Revenge) (15 solves)
Description:
Well let's quickly patch out an unintended solvepath to the original challenge...
There, now go use your programming skills.
Even more of a headphone warning with this one, sorry.
Resources:
Static resources:output.wav
Solution:
Similar to previous one but twice the speed. Played around with settings until decoding was clean.
Wiretapped (20 solves)
Description:
I've been listening to this cable between two computers, but I feel like it's in the wrong format.
Resources:
Static resources:wiretapped.wav
Hints:
A certain type of file is embedded in the .wav file - see if you can extract itFamiliarize yourself with the application used to view the file
Solution:
Opening the wav in a text editor, we see this:
Basically, it's a pcap starting from the 2nd line. Delete the first line to get the pcap, and then:
Get the image by looking at the pcap traffic, can follow stream once the bytes start then copy the raw to a file, trim the header.
π©ΈManipulate Spreadsheet 2 (115 solves)
Description:
Sequel to a challenge from BCACTF 4. The flag lies within: https://docs.google.com/spreadsheets/d/1kGrbQpZ4oUt0ChKvwGa4PDJQ1QvUl73Qpeo585vQ6s4/edit?usp=sharing
Hints:
Make a copy of the spreadsheet first.
Solution:
Can access the locked Sheet 2 by downloading the html version, then sort based on the 3rd column and save the least significant bits following the hint in the first row of sheet 2. Easy to do everything with vim so just did column sort, align, and ctrl+v block select, can build a script otherwise.
For reference: Lurking shadows, secrets play, Stealthy whispers on display. BITS aligned, LEAST in SIGht, Gleams of secrets, veiled in light.
π©ΈSea Scavenger (558 solves)
Description:
Take a tour of the deep sea! Explore the depths of webpage secrets and find the hidden treasure. Pro tip: Zoom out!
Resources:
Web servers:challs.bcactf.com:31314
Hints:
Press F12 or Ctrl+Shift+I on Windows (Cmd+Option+I on Mac OS) to launch DevToolsSome parts have hints in the console
Solution:
I'm a bit surprised this has so many more solves than the others but basically just web stuff, flag parts hidden in javascript files and treasure isn't displayed but can be navigated to in url directly.
Misc
JailBreak 2 (151 solves)
Description:
The prison has increased security measures since you last escaped it. Can you still manage to escape?
Resources:
Netcat Links:nc challs.bcactf.com 30335Static resources:main.py
Hints:
What in python is evaluated to a number?
Solution:
We have a limited character set: BANNED_CHARS = "gdvxfiyundmnet/\'~`@#$%^&.{}0123456789" One of the main functions available is locals() and running main.py locally with sanitized disabled, eventually I see we can print the flag in an error with locals()[locals()['flag']]. Since f and g banned, we need to create that, I built a converter to optimally convert strings to symbols. I optimized it to shorten the output length (creating 64 with 1<<7) so it would work for the revenge challenge.
Physics Test (94 solves)
Description:
Help me get an A in Physics! My teacher made this review program for us.
Resources:
Netcat Links:nc challs.bcactf.com 30586
Hints:
How is the program checking your answer? After all, it's possible to write a correct answer in multiple ways (e.g. x+y vs y+x vs 0+x+y, etc).What information/feedback do you get from each question? How can you use it to your advantage?
Solution:
There are three different questions the server can ask, and it's pretty clear that the solution won't be found by solving enough questions after a while, so we need to find a way to confirm knowledge about the flag in the correctness response. I built a script that will skip until the spring question is asked (answer is normally x * y), then multiply by the character value of a specific position of the flag and divide by a guess. Ran this until every character was guessed.
Miracle (46 solves)
Description:
You'll need a miracle to get this flag. The server requires you to solve an easy addition problem, but you only get the flag if the bits magically flip to form another answer.
Resources:
Netcat Links:nc challs.bcactf.com 30105Static resources:main.jseslint.config.mjs
Solution:
In main.js we see it's solved if we enter 77 but becomes 63 if directly eval'ing it. 77 in octal is 63 in decimal, so we enter 077 to solve both parts.
JailBreak 1 (159 solves)
Description:
I cannot get the python file to print the flag, are you able to?
Resources:
Netcat Links:nc challs.bcactf.com 32087Static resources:deploy.py
Hints:
How can you access variables in python?
Solution:
Numbers aren't banned here so we can do the same thing as in JailBreak 2 above but easier.
MathJail (127 solves)
Description:
Just a fun python calculator! Good for math class.
Resources:
Netcat Links:nc challs.bcactf.com 31062Static resources:pycalculator.py
Solution:
This one was a bit of a mess for me testing different built-ins. A lot of writeups skip over intermediate steps or just don't work, but I eventually settled on using wrap_close for remote command execution to send the flag to my webhook. First we print all the functions, get the offset of wrap_close (can trial/error), then give it the command to execute.
This is NOT the flag (250 solves)
Description:
The flag is NOT inside this file. Do NOT even bother checking.
Resources:
Static resources:NOTflag.txt
Hints:
The flag is ASCII encoded in base 64
Solution:
Decode base 64 then guess to do XOR brute force. Since the key is FF, it's probably just inverting the bits.
JailBreak Revenge (43 solves)
Description:
Some of y'all cheesed the previous two jailbreaks, so it looks like they've put even more band-aids on the system...
Resources:
Netcat Links:nc challs.bcactf.com 30223Static resources:main.py
Hints:
What in python is evaluated to a number?
Solution:
Refer to JailBreak 2, now we can't use =. Playing around in python interpreter, I find a new way to get true other than ()==(), which is []<[()]. Now however there's no error print so we do need to output the flag exactly, which can actually be done with locals()['flag']. I must have messed something up when trying that originally for JailBreak 2 but it works there as well.
Rev
ghost (71 solves)
Description:
spooky!
Resources:
Static resources:chall
Hints:
Use a decompilation tool such as [Binary Ninja Cloud](https://cloud.binary.ninja/)Compilation preserves the names of functions and global variables
Solution:
Decompile with binary ninja to see stuff like this in it:
The = is the position to put it (e.g., left brace 7 right brace 0x14 (20) gives us bcactf{XXXXXXXXXXXX}, then fill in the rest, like line 837 means the 12th character is 0.
My Brain Hurts (187 solves)
Description:
My friend sent me a weird string and a "program" they wrote, although it doesn't seem anything interpretable to me. Can you help me find out what they put through their program?
Resources:
Static resources:script.txtstring.txt
Hints:
If you don't know where to start, look into an esoteric coding language called "Brain F*ck"
Solution:
Run the program and encode different things until you see there's just a constant rotation based on the input letter.
Broken C Code (155 solves)
Description:
Help! I was trying to make a flag printer but my C code just prints random garbage and I can't figure out why! Can you help me? Here's the file:
Resources:
Static resources:flagprinter
Solution:
Print out the memory after running then process based on rev.
FPS Frenzy (68 solves)
Description:
My friend Timmy made a game at the MoCO (Master of Code Olympiad) in just 50 nanoseconds! He told me that he hid a secret text somewhere in the game and placed a bet that I would not solve it. I'm not good at games, so can you please find this text?
Hints:
Notice anything unusual in the map?How would you get to the unusual spot?
Solution:
Unity game so Asset Ripper, flag is in an image (galf.png).
XOR (281 solves)
Description:
The executable below outputs an encrypted flag using the XOR operator. Can you decompile and reveal the flag?
Resources:
Netcat Links:nc challs.bcactf.com 32411Static resources:xor
Hints:
What is symmetric encryption?
Solution:
Flagtureiser (217 solves)
Description:
Here's a totally normal Minecraft mod (1.19.4, Forge) I've been making, check it out!
(You do not need Minecraft to solve this challenge)
Resources:
Static resources:flagtureiser-4.2.0.6.9.jar
Hints:
The name of the mod is a spoof of something else (It is Minecraft related).
Solution:
Decompile with jadx, then:
Webex
Phone number (496 solves)
Description:
I was trying to sign into this website, but now it's asking me for a phone number. The way I'm supposed to input it is strange. Can you help me sign in?
My phone number is 1234567890
Resources:
Web servers:challs.bcactf.com:32268
Hints:
If only you could just type in the phone numberHave you heard of event listeners in Javascript?
Solution:
Paste the following in the console, flag shows up. Not sure why direct curl post doesn't work.
MOC, Inc. (128 solves)
Description:
Towards the end of last month, we started receiving reports about suspicious activity coming from a company called MOC, Inc. Our investigative team has tracked down their secret company portal and cracked the credentials to the admin account, but could not bypass the advanced 2FA system. Can you find your way in?
Resources:
Web servers:challs.bcactf.com:31772Static resources:app.py
Solution:
Seed is created by the date and the description says this was towards end of last month so just test every date going backwards from 2024/05/31.
JSLearning.com (145 solves)
Description:
Hey, can you help me on this Javascript problem? Making strings is hard.
Resources:
Web servers:challs.bcactf.com:32398Static resources:server.js
Hints:
Do you know any ways to run JS with just those select characters?Do you notice anything vulnerable about the server?
Solution:
We have a limited charset and need to set out to be flag.
If d includes any characters other than []{}+!, it will return early. Otherwise it will eval anything that's not a function and output the result. We don't have to actually win by making it equal fun since we can control out which is always printed. Therefore the solution is to encode "out=flag" at jsfuck.com (uncheck boxes) then paste on the site.
NoSQL (255 solves)
Description:
I found this database that does not use SQL, is there any way to break it?
Resources:
Web servers:challs.bcactf.com:30390Static resources:provided.js
Hints:
Ricardo Olsen has an ID of 1
Solution:
Looking at provided.js, name needs to be set and then it's matched in a regex. Go to http://challs.bcactf.com:30390/?name=.* and see a list of accounts, including 50: Flag Holder. Then 0 vs 1 indexing.
Tic-Tac-Toe (303 solves)
Description:
My friend wrote this super cool game of tic-tac-toe. It has an AI he claims is unbeatable. I've been playing the game for a few hours and I haven't been able to win. Do you think you could beat the AI?
Resources:
Web servers:challs.bcactf.com:30649
Solution:
Playing the game in burpsuite, we see that we actually receive the new board state through a websockets message that's what restricts us from choosing a spot the opponent moves at. Remove the "O" when it tries to block us then click it to win.
Last updated
Was this helpful?