Last updated
Last updated
In this task, we explore the realm of cryptographically secure random generators, where predicting the output is deemed impossible. Are you ready to test your luck and skill?
TMP is ignored, enc is simply flag XOR'd with KEY, which is reversible since we're given KEY and enc.
Decrypted flag: b'MAPNA{R_U_MT19937_PRNG_Predictor?}'
This requires 624 32-bit values which we are almost exactly given. We just need to be sure to give the last 624 values so we skip the first two entries in TMP.
Decrypted flag: b'MAPNA{4Re_y0U_MT19937_PRNG_pr3d!cT0r_R3ven9E_4057950503c1e3992}'
Flag is visible, simply assemble 1:MAPNA{y through 6:d1n9!!}.
MAPNA{y0U_sHOuLd_4lW4yS__CaR3__PaADd1n9!!}
Note: Forgot the flag format in the rules pages, just find the tampered one.
You are not allowed to brute-force the flag in scoreboard, this will result in your team being blocked.
We get a text file with many flags in it. We need to see which was tampered so my first instinct is to scroll through and see if there are any with a different length. 30 seconds later holding ctrl+d in vim, I find it.
MAPNA{Tx,D51otN\eUf7qQ7>ToSYQ;5P6jTIHH#6TL+uv}
Hopefully you know how web works...
Navigating to the site, you see:
You are not coming from "http://flagland.internal/".
A quick google search to find you just need to intercept the request in burp and add:
Referer: http://flagland.internal/
Next, it says Unspecified "secret".
There are multiple ways to specify a variable, easiest is in the url adding ?=
Next, it says Incorrect secret.
Press ctrl+u to see the page source which has a hint that the secret is the protocol the server and browser agree on, which ends up being http.
Next, it says Sorry we don't have "GET" here but we might have other things like "FLAG".
This means instead of a GET request, we just make a FLAG request. Finally:
Compile the given code and execute the resulting binary, passing the source code file as an argument, to obtain the flag.
Pretty straight-forward, seems like we just gcc file.c -o file; ./file < file.c right?
MAPNA{1427__11__31583_!}
But wait, it's not working. Let's not talk about how much time I wasted on this, here's what worked.
After running, stdout shows MAPNA{1426__11__31582_!}
Flag format: MAPNA{CAPITAL_WORDS_THAT_YOU_FIND}
Run Heaverse with gdb (I have pwndbg set up), ctrl-c when a beep is played, see this:
We see morse code in RBX, when continuing and ctrl+c, we see the morse passed in is slowly iterated. Therefore we just need to print out the memory at that location to see the full string. Printing at an address slightly above we get:
Copy paste into cyberchef to decode the morse, and you get JUS7LIST3NN0TREV3RSE but it doesn't work directly, follow the instructions in the description to get:
MAPNA{JUS7_LIST3N_N0T_REV3RSE}
Solution:
The given binary reads a flag and allows the user to either gather information or confirm the flag. Decompiling it doesn't help much and with simple trial and error, it can be seen that only a single character input is allowed. Manually trying each likely character and copy-pasting/cleaning up the result gets the following:
We notice that { is 25 and } is 8649, which happen to be 5 and 93 squared. Since we know the flag likely starts with MAPNA{, we can assume the numbers refer to the 0-indexed position. It's not that simple though since most numbers aren't a perfect square. Here's where things get a bit messy.
We know we didn't miss any characters since these sum to what the sum of squares is.
Next, we can see what the flag looks like if we assume perfect squares go in their correlated position.
Running this script to fill out positions that are a perfect square, keeping in mind some of these may be incorrect and perfect squares can be made up of sums of squares, we get the following:
Ignore the Z at the start since the first position corresponds to 0.
We can manually add MAPNA at the beginning and subtract the squares from the candidates (e.g., A - 1, P -4, N-9, A-16). Next we see what it looks like when we try to fill by calculating sums of squares.
From here we can already see a lot of the flag, CtF, 7aSk, and a scrambled "The quick fox jumped over the lazy dog". Everything so far seems mostly right except d and h which we can manually reverse.
After fixing the above phrase and adding _ where obvious, there wasn't much left. I created this utility that allows me to determine all sums of squares resulting in a number, while capping the minimum square allowed.
Filling in the remainders, we get the final flag!
MAPNA{___L0c4T!0n___8A53d_MaPN4_CtF_7aSk_d0g_over_Qu1ck_The_th3_f0x_L4zy_juMPs_broWn_G00dy!??}
Again, in this task, we explore the realm of cryptographically secure random generators, where predicting the output is deemed impossible. Are you ready to test your luck and skill this time?
This is a simple Mersenne Twister application to predict python random output, read here if unfamiliar:
The MAPNA CERT team has identified an intrusion into the plant's , discovering a covert message transferred to the PLC. Can you uncover this secret message?
Our MAPNA repository was compromised, with attackers introducing one invalid flag. Can you identify the counterfeit flag?
, a paradoxical binary that defies logic: reverse it without reversing it. Can you navigate its enigmatic depths?
My writeups, sorted by category and roughly by easiest to hardest overall.