Reverse Engineering

The Flag Vault

Solution

An ELF binary was given, which asks for a password.

Running strings on the binary gives us the password.

The password is abracadabrahahaha. Note: Ignore "H" as the string is more than 8 characters. To avoid this confusion we can also use ghidra.

We can even see the flag hardcoded as hex.

Flag: KCTF{welc0me_t0_reverse_3ngineering}

The Encoder

Solution

We fire up ghidra to know more about encryption.
Alternative solution to this can be using fuzzing to generate encoded string.

I used a python script to solve this.

import string

a = "1412 1404 1421 1407 1460 1452 1386 1414 1449 1445 1388 1432 1388 1415 1436 1385 1405 1388 1451 1432 1386 1388 1388 1392 1462"
a = a.split()

char = ""
for c in (chr(i) for i in range(32, 127)):
    char += c

# print(char)
fl = ""
count = 0
for i in a:
    count = int(i)-1385
    fl += char[count+16]
print(fl)

Flag: KCTF{s1Mpl3_3Nc0D3r_1337}

Baby shark

Solution

A JAR file was given, I used JD-GUI to decompile the file.

It had a flag class but it was a fake flag.

The Strings.class contained the base64 encoded flag (_0xflag variable).

Decoding it gives us the flag.

Flag: KCTF{7H15_W@5_345Y_R16H7?}

Flag Checker

Solution

We open the binary in ghidra and check the main() function.

Our encoded flag is present in local_48, local_40, local_38, local_30 and local_28.
I used input fuzzing to solve this challenge. Open up gdb and set a breakpoint at main function.
The disassembly of main function:

Dump of assembler code for function main:
   0x0000000000401146 <+0>:     push   rbp
   0x0000000000401147 <+1>:     mov    rbp,rsp
   0x000000000040114a <+4>:     sub    rsp,0x240
   0x0000000000401151 <+11>:    movabs rax,0x59275a5b35273830
   0x000000000040115b <+21>:    movabs rdx,0x334b32583f33483a
   0x0000000000401165 <+31>:    mov    QWORD PTR [rbp-0x40],rax
   0x0000000000401169 <+35>:    mov    QWORD PTR [rbp-0x38],rdx
   0x000000000040116d <+39>:    movabs rax,0x3f334732443f2956
   0x0000000000401177 <+49>:    movabs rdx,0x5224473f364e2c48
   0x0000000000401181 <+59>:    mov    QWORD PTR [rbp-0x30],rax
   0x0000000000401185 <+63>:    mov    QWORD PTR [rbp-0x28],rdx
   0x0000000000401189 <+67>:    mov    DWORD PTR [rbp-0x20],0x5d4728
   0x0000000000401190 <+74>:    lea    rax,[rip+0xe71]        # 0x402008
   0x0000000000401197 <+81>:    mov    rdi,rax
   0x000000000040119a <+84>:    mov    eax,0x0
   0x000000000040119f <+89>:    call   0x401040 <printf@plt>
   0x00000000004011a4 <+94>:    lea    rax,[rbp-0x240]
   0x00000000004011ab <+101>:   mov    rsi,rax
   0x00000000004011ae <+104>:   lea    rax,[rip+0xe65]        # 0x40201a
   0x00000000004011b5 <+111>:   mov    rdi,rax
   0x00000000004011b8 <+114>:   mov    eax,0x0
   0x00000000004011bd <+119>:   call   0x401050 <__isoc99_scanf@plt>
   0x00000000004011c2 <+124>:   mov    DWORD PTR [rbp-0x4],0x0
   0x00000000004011c9 <+131>:   jmp    0x40127b <main+309>
   0x00000000004011ce <+136>:   mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004011d1 <+139>:   cdqe
   0x00000000004011d3 <+141>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x00000000004011db <+149>:   cmp    al,0x40
   0x00000000004011dd <+151>:   jle    0x401216 <main+208>
   0x00000000004011df <+153>:   mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004011e2 <+156>:   cdqe
   0x00000000004011e4 <+158>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x00000000004011ec <+166>:   cmp    al,0x5a
   0x00000000004011ee <+168>:   jg     0x401216 <main+208>
   0x00000000004011f0 <+170>:   mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004011f3 <+173>:   cdqe
   0x00000000004011f5 <+175>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x00000000004011fd <+183>:   mov    edx,eax
   0x00000000004011ff <+185>:   mov    eax,0xffffff9b
   0x0000000000401204 <+190>:   sub    eax,edx
   0x0000000000401206 <+192>:   mov    edx,eax
   0x0000000000401208 <+194>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040120b <+197>:   cdqe
   0x000000000040120d <+199>:   mov    BYTE PTR [rbp+rax*1-0x240],dl
   0x0000000000401214 <+206>:   jmp    0x401277 <main+305>
   0x0000000000401216 <+208>:   mov    eax,DWORD PTR [rbp-0x4]
   0x0000000000401219 <+211>:   cdqe
   0x000000000040121b <+213>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x0000000000401223 <+221>:   cmp    al,0x60
   0x0000000000401225 <+223>:   jle    0x40125e <main+280>
   0x0000000000401227 <+225>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040122a <+228>:   cdqe
   0x000000000040122c <+230>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x0000000000401234 <+238>:   cmp    al,0x7a
   0x0000000000401236 <+240>:   jg     0x40125e <main+280>
   0x0000000000401238 <+242>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040123b <+245>:   cdqe
   0x000000000040123d <+247>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x0000000000401245 <+255>:   mov    edx,eax
   0x0000000000401247 <+257>:   mov    eax,0xffffffdb
   0x000000000040124c <+262>:   sub    eax,edx
   0x000000000040124e <+264>:   mov    edx,eax
   0x0000000000401250 <+266>:   mov    eax,DWORD PTR [rbp-0x4]
   0x0000000000401253 <+269>:   cdqe
   0x0000000000401255 <+271>:   mov    BYTE PTR [rbp+rax*1-0x240],dl
   0x000000000040125c <+278>:   jmp    0x401277 <main+305>
   0x000000000040125e <+280>:   mov    eax,DWORD PTR [rbp-0x4]
   0x0000000000401261 <+283>:   cdqe
   0x0000000000401263 <+285>:   movzx  edx,BYTE PTR [rbp+rax*1-0x240]
   0x000000000040126b <+293>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040126e <+296>:   cdqe
   0x0000000000401270 <+298>:   mov    BYTE PTR [rbp+rax*1-0x240],dl
   0x0000000000401277 <+305>:   add    DWORD PTR [rbp-0x4],0x1
   0x000000000040127b <+309>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040127e <+312>:   cdqe
   0x0000000000401280 <+314>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x0000000000401288 <+322>:   test   al,al
   0x000000000040128a <+324>:   jne    0x4011ce <main+136>
   0x0000000000401290 <+330>:   mov    DWORD PTR [rbp-0x8],0x0
   0x0000000000401297 <+337>:   jmp    0x4012bb <main+373>
   0x0000000000401299 <+339>:   mov    eax,DWORD PTR [rbp-0x8]
   0x000000000040129c <+342>:   cdqe
   0x000000000040129e <+344>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x00000000004012a6 <+352>:   sub    eax,0x20
   0x00000000004012a9 <+355>:   mov    edx,eax
   0x00000000004012ab <+357>:   mov    eax,DWORD PTR [rbp-0x8]
   0x00000000004012ae <+360>:   cdqe
   0x00000000004012b0 <+362>:   mov    BYTE PTR [rbp+rax*1-0x240],dl
   0x00000000004012b7 <+369>:   add    DWORD PTR [rbp-0x8],0x1
   0x00000000004012bb <+373>:   mov    eax,DWORD PTR [rbp-0x8]
   0x00000000004012be <+376>:   cdqe
   0x00000000004012c0 <+378>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x00000000004012c8 <+386>:   test   al,al
   0x00000000004012ca <+388>:   jne    0x401299 <main+339>
   0x00000000004012cc <+390>:   mov    DWORD PTR [rbp-0xc],0x0
   0x00000000004012d3 <+397>:   mov    BYTE PTR [rbp-0xd],0x0
   0x00000000004012d7 <+401>:   jmp    0x401302 <main+444>
   0x00000000004012d9 <+403>:   mov    eax,DWORD PTR [rbp-0xc]
   0x00000000004012dc <+406>:   cdqe
   0x00000000004012de <+408>:   movzx  edx,BYTE PTR [rbp+rax*1-0x40]
   0x00000000004012e3 <+413>:   mov    eax,DWORD PTR [rbp-0xc]
   0x00000000004012e6 <+416>:   cdqe
   0x00000000004012e8 <+418>:   movzx  eax,BYTE PTR [rbp+rax*1-0x240]
   0x00000000004012f0 <+426>:   cmp    dl,al
   0x00000000004012f2 <+428>:   je     0x4012fa <main+436>
   0x00000000004012f4 <+430>:   mov    BYTE PTR [rbp-0xd],0x0
   0x00000000004012f8 <+434>:   jmp    0x401310 <main+458>
   0x00000000004012fa <+436>:   mov    BYTE PTR [rbp-0xd],0x1
   0x00000000004012fe <+440>:   add    DWORD PTR [rbp-0xc],0x1
   0x0000000000401302 <+444>:   mov    eax,DWORD PTR [rbp-0xc]
   0x0000000000401305 <+447>:   cdqe
   0x0000000000401307 <+449>:   movzx  eax,BYTE PTR [rbp+rax*1-0x40]
   0x000000000040130c <+454>:   test   al,al
   0x000000000040130e <+456>:   jne    0x4012d9 <main+403>
   0x0000000000401310 <+458>:   cmp    BYTE PTR [rbp-0xd],0x0
   0x0000000000401314 <+462>:   je     0x401327 <main+481>
   0x0000000000401316 <+464>:   lea    rax,[rip+0xd03]        # 0x402020
   0x000000000040131d <+471>:   mov    rdi,rax
   0x0000000000401320 <+474>:   call   0x401030 <puts@plt>
   0x0000000000401325 <+479>:   jmp    0x401336 <main+496>
   0x0000000000401327 <+481>:   lea    rax,[rip+0xd13]        # 0x402041
   0x000000000040132e <+488>:   mov    rdi,rax
   0x0000000000401331 <+491>:   call   0x401030 <puts@plt>
   0x0000000000401336 <+496>:   mov    eax,0x0
   0x000000000040133b <+501>:   leave
   0x000000000040133c <+502>:   ret
End of assembler dump.

Set a breakpoint at CMP instruction at 0x0000000000401310.
Now, run the program and supply some characters, for example abcd.

If we analyse the stack, we can see our supplied string which is encoded.

Similarly, we can fuzz the input and observe the encoded values on stack.
After fuzzing, I created a python script to decode the values that we found from ghidra.

import string

a = "Y'Z[5'80"
a = a[::-1]     # Due to little endian format, we need to reverse it
b = "3K2X?3H:"
b = b[::-1]
c = "?3G2D?)V"
c = c[::-1]
d = "R$G?6N,H"
d = d[::-1]
e = "]G("
e = e[::-1]

cap_enc = """:9876543210/.-,+*)(\'&%$#"!"""
lwr_enc = "ZYXWVUTSRQPONMLKJIHGFEDCBA"

cap = string.ascii_uppercase
lwr = string.ascii_lowercase

ar = [a,b,c,d,e]

temp = ""
for i in ar:
    for j in i:
        if j == '?':
            temp += '_'
            continue
        if j == '[':
            temp += '{'
            continue
        if j == ']':
            temp += '}'
            continue
        if j in lwr_enc:
            temp += lwr[lwr_enc.index(j)]
        else:
            temp += cap[cap_enc.index(j)]
print(temp)

Flag: KCTF{aTbAsH_cIpHeR_wItH_sOmE_tWiSt}

Knight Vault

Solution

We open the file in ghidra.

We can see our encoded flag in local_438, local_430, local_428, local_420, local_418 and local_410. After converting them into string we get: 9J<qiEUoEkU]EjUc;U]EEZU`EEXU^7fFoU^7Y_D]s

Note: Since, it follows little endian format, reverse each variable before merging them into one string.

Another way to find the encoded flag is using gdb. Similar to previous challenge, we can set a breakpoint at a CMP instruction and check the stack.

The code is pretty simple; 10 is subtracted from each characters ASCII value and if the character is "A" then it is simply replaced by "*".
So, I wrote a simple python script to solve this.

enc = "*9J<qiEUoEkU]EjUc;U]EEZU`EEXU^7fFoU^7Y*_D]s"

flag = ''
for i in ab:
    if i == '*':
        flag += 'K'     # A + 10 = K
        continue
    flag += chr(ord(i)+10)
print(flag)

Flag: KCTF{sO_yOu_gOt_mE_gOOd_jOOb_hApPy_hAcKiNg}

Droid Flag

Solution

We can use apktool, but I used this awesome website.
After decompiling it, under sources > org > knightsquad > droidflag, I decompiled the MainActivity.java and found this statement:

StringHandler stringHandler = new StringHandler();
                    if ((stringHandler.getS1(MainActivity.this) + "{" + stringHandler.getS3(MainActivity.this) + "_" + stringHandler.getS2(MainActivity.this) + "_" + stringHandler.getS4(MainActivity.this) + "}").equals(obj))

Hence, I checked the resources > res > values > strings.xml file.

<string name="s1">KCTF{}</string>
    <string name="s10">You have entered the right flag. Good Job.</string>
    <string name="s11">Warning</string>
    <string name="s12">You have entered a wrong flag. Pleae try again.</string>
    <string name="s2">KCTF2022{}</string>
    <string name="s3">KnightCTF{}</string>
    <string name="s4">KnightCTF200{}</string>
    <string name="s5">KCTF</string>
    <string name="s6">3LpM1s</string>
    <string name="s7">D10RdNa</string>
    <string name="s8">3Sr3V3r</string>
    <string name="s9">Congratulations</string>

Then I checked sources > org > knightsquad > droidflag > StringHandler.java file.

public class StringHandler extends AppCompatActivity {
    public String getS1(Context context) {
        return context.getResources().getString(C0745R.string.f112s5);
    }

    public String getS2(Context context) {
        return new StringBuilder(context.getResources().getString(C0745R.string.f113s6)).reverse().toString();
    }

    public String getS3(Context context) {
        return new StringBuilder(context.getResources().getString(C0745R.string.f114s7)).reverse().toString();
    }

    public String getS4(Context context) {
        return new StringBuilder(context.getResources().getString(C0745R.string.f115s8)).reverse().toString();
    }
}

As we can see, the strings are reversed to form the flag.

Flag: KCTF{aNdR01D_s1MpL3_r3V3rS3}

Knight Switch Bank

Solution

We open the binary in ghidra and analyse the main function.

Similar to previous challenge, this has the encoded flag hardcoded in local_38, local_30, local_28, local_20 and local_1c.
We load the binary in gdb and set breakpoints at main and CMP instruction (0x0000000000401437) and then analyse the stack.

   0x00000000004011b6 <+0>:     push   rbp
   0x00000000004011b7 <+1>:     mov    rbp,rsp
   0x00000000004011ba <+4>:     sub    rsp,0x430
   0x00000000004011c1 <+11>:    movabs rax,0x4164485d5549525a
   0x00000000004011cb <+21>:    movabs rdx,0x41494447414a644e
   0x00000000004011d5 <+31>:    mov    QWORD PTR [rbp-0x30],rax
   0x00000000004011d9 <+35>:    mov    QWORD PTR [rbp-0x28],rdx
   0x00000000004011dd <+39>:    movabs rax,0x4173444476414978
   0x00000000004011e7 <+49>:    mov    QWORD PTR [rbp-0x20],rax
   0x00000000004011eb <+53>:    mov    DWORD PTR [rbp-0x18],0x71444479
   0x00000000004011f2 <+60>:    mov    WORD PTR [rbp-0x14],0x5f
   0x00000000004011f8 <+66>:    mov    DWORD PTR [rbp-0x4],0x0
   0x00000000004011ff <+73>:    mov    DWORD PTR [rbp-0x8],0x0
   0x0000000000401206 <+80>:    lea    rax,[rip+0xdfb]        # 0x402008
   0x000000000040120d <+87>:    mov    rdi,rax
   0x0000000000401210 <+90>:    call   0x401030 <puts@plt>
   0x0000000000401215 <+95>:    lea    rax,[rip+0xe12]        # 0x40202e
   0x000000000040121c <+102>:   mov    rdi,rax
   0x000000000040121f <+105>:   call   0x401030 <puts@plt>
   0x0000000000401224 <+110>:   lea    rax,[rip+0xe1d]        # 0x402048
   0x000000000040122b <+117>:   mov    rdi,rax
   0x000000000040122e <+120>:   call   0x401030 <puts@plt>
   0x0000000000401233 <+125>:   lea    rax,[rip+0xeb6]        # 0x4020f0
   0x000000000040123a <+132>:   mov    rdi,rax
   0x000000000040123d <+135>:   call   0x401030 <puts@plt>
   0x0000000000401242 <+140>:   lea    rax,[rip+0xec9]        # 0x402112
   0x0000000000401249 <+147>:   mov    rdi,rax
   0x000000000040124c <+150>:   mov    eax,0x0
   0x0000000000401251 <+155>:   call   0x401040 <printf@plt>
   0x0000000000401256 <+160>:   lea    rax,[rbp-0x230]
   0x000000000040125d <+167>:   mov    rsi,rax
   0x0000000000401260 <+170>:   lea    rax,[rip+0xec9]        # 0x402130
   0x0000000000401267 <+177>:   mov    rdi,rax
   0x000000000040126a <+180>:   mov    eax,0x0
   0x000000000040126f <+185>:   call   0x401050 <__isoc99_scanf@plt>
   0x0000000000401274 <+190>:   jmp    0x4013a9 <main+499>
   0x0000000000401279 <+195>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040127c <+198>:   cdqe
   0x000000000040127e <+200>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x0000000000401286 <+208>:   cmp    al,0x40
   0x0000000000401288 <+210>:   jle    0x4012be <main+264>
   0x000000000040128a <+212>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040128d <+215>:   cdqe
   0x000000000040128f <+217>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x0000000000401297 <+225>:   cmp    al,0x4d
   0x0000000000401299 <+227>:   jg     0x4012be <main+264>
   0x000000000040129b <+229>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040129e <+232>:   cdqe
   0x00000000004012a0 <+234>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x00000000004012a8 <+242>:   add    eax,0xd
   0x00000000004012ab <+245>:   mov    edx,eax
   0x00000000004012ad <+247>:   mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004012b0 <+250>:   cdqe
   0x00000000004012b2 <+252>:   mov    BYTE PTR [rbp+rax*1-0x430],dl
   0x00000000004012b9 <+259>:   jmp    0x4013a5 <main+495>
   0x00000000004012be <+264>:   mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004012c1 <+267>:   cdqe
   0x00000000004012c3 <+269>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x00000000004012cb <+277>:   cmp    al,0x60
   0x00000000004012cd <+279>:   jle    0x401303 <main+333>
   0x00000000004012cf <+281>:   mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004012d2 <+284>:   cdqe
   0x00000000004012d4 <+286>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x00000000004012dc <+294>:   cmp    al,0x6d
   0x00000000004012de <+296>:   jg     0x401303 <main+333>
   0x00000000004012e0 <+298>:   mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004012e3 <+301>:   cdqe
   0x00000000004012e5 <+303>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x00000000004012ed <+311>:   add    eax,0xd
   0x00000000004012f0 <+314>:   mov    edx,eax
   0x00000000004012f2 <+316>:   mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004012f5 <+319>:   cdqe
   0x00000000004012f7 <+321>:   mov    BYTE PTR [rbp+rax*1-0x430],dl
   0x00000000004012fe <+328>:   jmp    0x4013a5 <main+495>
   0x0000000000401303 <+333>:   mov    eax,DWORD PTR [rbp-0x4]
   0x0000000000401306 <+336>:   cdqe
   0x0000000000401308 <+338>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x0000000000401310 <+346>:   cmp    al,0x4d
   0x0000000000401312 <+348>:   jle    0x401345 <main+399>
   0x0000000000401314 <+350>:   mov    eax,DWORD PTR [rbp-0x4]
   0x0000000000401317 <+353>:   cdqe
   0x0000000000401319 <+355>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x0000000000401321 <+363>:   cmp    al,0x5a
   0x0000000000401323 <+365>:   jg     0x401345 <main+399>
   0x0000000000401325 <+367>:   mov    eax,DWORD PTR [rbp-0x4]
   0x0000000000401328 <+370>:   cdqe
   0x000000000040132a <+372>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x0000000000401332 <+380>:   sub    eax,0xd
   0x0000000000401335 <+383>:   mov    edx,eax
   0x0000000000401337 <+385>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040133a <+388>:   cdqe
   0x000000000040133c <+390>:   mov    BYTE PTR [rbp+rax*1-0x430],dl
   0x0000000000401343 <+397>:   jmp    0x4013a5 <main+495>
   0x0000000000401345 <+399>:   mov    eax,DWORD PTR [rbp-0x4]
   0x0000000000401348 <+402>:   cdqe
   0x000000000040134a <+404>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x0000000000401352 <+412>:   cmp    al,0x6d
   0x0000000000401354 <+414>:   jle    0x401387 <main+465>
   0x0000000000401356 <+416>:   mov    eax,DWORD PTR [rbp-0x4]
   0x0000000000401359 <+419>:   cdqe
   0x000000000040135b <+421>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x0000000000401363 <+429>:   cmp    al,0x7a
   0x0000000000401365 <+431>:   jg     0x401387 <main+465>
   0x0000000000401367 <+433>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040136a <+436>:   cdqe
   0x000000000040136c <+438>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x0000000000401374 <+446>:   sub    eax,0xd
   0x0000000000401377 <+449>:   mov    edx,eax
   0x0000000000401379 <+451>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040137c <+454>:   cdqe
   0x000000000040137e <+456>:   mov    BYTE PTR [rbp+rax*1-0x430],dl
   0x0000000000401385 <+463>:   jmp    0x4013a5 <main+495>
   0x0000000000401387 <+465>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040138a <+468>:   cdqe
   0x000000000040138c <+470>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x0000000000401394 <+478>:   sub    eax,0x20
   0x0000000000401397 <+481>:   mov    edx,eax
   0x0000000000401399 <+483>:   mov    eax,DWORD PTR [rbp-0x4]
   0x000000000040139c <+486>:   cdqe
   0x000000000040139e <+488>:   mov    BYTE PTR [rbp+rax*1-0x430],dl
   0x00000000004013a5 <+495>:   add    DWORD PTR [rbp-0x4],0x1
   0x00000000004013a9 <+499>:   mov    eax,DWORD PTR [rbp-0x4]
   0x00000000004013ac <+502>:   cdqe
   0x00000000004013ae <+504>:   movzx  eax,BYTE PTR [rbp+rax*1-0x230]
   0x00000000004013b6 <+512>:   test   al,al
   0x00000000004013b8 <+514>:   jne    0x401279 <main+195>
   0x00000000004013be <+520>:   jmp    0x4013e2 <main+556>
   0x00000000004013c0 <+522>:   mov    eax,DWORD PTR [rbp-0x8]
   0x00000000004013c3 <+525>:   cdqe
   0x00000000004013c5 <+527>:   movzx  eax,BYTE PTR [rbp+rax*1-0x430]
   0x00000000004013cd <+535>:   add    eax,0x2
   0x00000000004013d0 <+538>:   mov    edx,eax
   0x00000000004013d2 <+540>:   mov    eax,DWORD PTR [rbp-0x8]
   0x00000000004013d5 <+543>:   cdqe
   0x00000000004013d7 <+545>:   mov    BYTE PTR [rbp+rax*1-0x430],dl
   0x00000000004013de <+552>:   add    DWORD PTR [rbp-0x8],0x1
   0x00000000004013e2 <+556>:   mov    eax,DWORD PTR [rbp-0x8]
   0x00000000004013e5 <+559>:   cdqe
   0x00000000004013e7 <+561>:   movzx  eax,BYTE PTR [rbp+rax*1-0x430]
   0x00000000004013ef <+569>:   test   al,al
   0x00000000004013f1 <+571>:   jne    0x4013c0 <main+522>
   0x00000000004013f3 <+573>:   mov    BYTE PTR [rbp-0x9],0x0
   0x00000000004013f7 <+577>:   mov    DWORD PTR [rbp-0x10],0x0
   0x00000000004013fe <+584>:   jmp    0x401429 <main+627>
   0x0000000000401400 <+586>:   mov    eax,DWORD PTR [rbp-0x10]
   0x0000000000401403 <+589>:   cdqe
   0x0000000000401405 <+591>:   movzx  edx,BYTE PTR [rbp+rax*1-0x30]
   0x000000000040140a <+596>:   mov    eax,DWORD PTR [rbp-0x10]
   0x000000000040140d <+599>:   cdqe
   0x000000000040140f <+601>:   movzx  eax,BYTE PTR [rbp+rax*1-0x430]
   0x0000000000401417 <+609>:   cmp    dl,al
   0x0000000000401419 <+611>:   je     0x401421 <main+619>
   0x000000000040141b <+613>:   mov    BYTE PTR [rbp-0x9],0x0
   0x000000000040141f <+617>:   jmp    0x401437 <main+641>
   0x0000000000401421 <+619>:   mov    BYTE PTR [rbp-0x9],0x1
   0x0000000000401425 <+623>:   add    DWORD PTR [rbp-0x10],0x1
   0x0000000000401429 <+627>:   mov    eax,DWORD PTR [rbp-0x10]
   0x000000000040142c <+630>:   cdqe
   0x000000000040142e <+632>:   movzx  eax,BYTE PTR [rbp+rax*1-0x30]
   0x0000000000401433 <+637>:   test   al,al
   0x0000000000401435 <+639>:   jne    0x401400 <main+586>
=> 0x0000000000401437 <+641>:   cmp    BYTE PTR [rbp-0x9],0x0
   0x000000000040143b <+645>:   je     0x401449 <main+659>
   0x000000000040143d <+647>:   mov    eax,0x0
   0x0000000000401442 <+652>:   call   0x401146 <winner>
   0x0000000000401447 <+657>:   jmp    0x401458 <main+674>
   0x0000000000401449 <+659>:   lea    rax,[rip+0xce8]        # 0x402138
   0x0000000000401450 <+666>:   mov    rdi,rax
   0x0000000000401453 <+669>:   call   0x401030 <puts@plt>
   0x0000000000401458 <+674>:   mov    eax,0x0
   0x000000000040145d <+679>:   leave
   0x000000000040145e <+680>:   ret

We fuzz the input and see the encoded values on stack, for example, the input password is abcd and its encoded value is:

Here, the encoded value of abcd is pqrs.
After fuzzing, I used a python script to decode our encoded flag.

import string

upr_enc = "PQRSTUVWXYZ[\CDEFGHIJKLMNO"
lwr_enc = "pqrstuvwxyz{|cdefghijklmno"

one = "AdH]UIRZ"
one = one[::-1]     # Due to little endian format
two = "AIDGAJdN"
two = two[::-1]
three = "AsDDvAIx"
three = three[::-1]
four = "qDDy"
four = four[::-1]

ar = [one,two,three,four]

upr = string.ascii_uppercase
lwr = string.ascii_lowercase

temp = ""
for i in ar:
    for j in i:
        if j == 'A' or j == 'a':
             temp += '_'
             continue
        if j.isupper():
            temp += upr[upr_enc.index(j)]
        elif j.islower():
            temp += lwr[lwr_enc.index(j)]
print(temp)

This gives us: KCTFSo_YoU_ROT_iT_gOOd_jOOb We just need to add "{}".

Flag: KCTF{So_YoU_ROT_iT_gOOd_jOOb}

Forensics

The Lost Flag

Solution

This image was given, exiftool did not yield anything special.
So, I used an awesome online tool called Forensically.
Using PCA I found the flag.

Flag: KCTF{Y0U_F0uNd_M3}

Compromised FTP

Solution

So, it was basically a log file. Since, an OK status is sent on successful login in FTP, we search for string "OK".

Hence, the username is ftpuser and the IP of the attacker is 192.168.1.7.

Flag: KCTF{ftpuser_192.168.1.7}

Unknown File

Solution

Running file on the file did not yield anything.
Opening the file in hex editor gave some clue.

Since, IHDR chunk is present, it is a PNG image. Fixing the header and saving the image as PNG gives us the flag.

Flag: KCTF{Imag3_H3ad3r_M4nipul4t10N}

Let's Walk Together

Solution

This image was given and if we use image search on Google, we get binwalk entropy.
Hence, I used binwalk on the image.

It gave out a zip file which contained flag.txt but, the it is password protected.
I used zip2john to extract the password hash.

$pkzip$1*2*2*0*25*19*7dffa5fe*3f*47*0*25*5e93*ab2861d9320438eae7ce0cfc5c136c9ff1c7c289172d5a9eade62b6da3ba7195354bb15c02*$/pkzip$

Using john gave the password as letmein!

Used this password and opened the flag.txt

Flag: KCTF{BiNw4lk_is_h3lpfUl}

Name		Name	Last commit message	Last commit date
Latest commit History 3 Commits
img		img
README.md		README.md

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

Reverse Engineering

The Flag Vault

Solution

The Encoder

Solution

Baby shark

Solution

Flag Checker

Solution

Knight Vault

Solution

Droid Flag

Solution

Knight Switch Bank

Solution

Forensics

The Lost Flag

Solution

Compromised FTP

Solution

Unknown File

Solution

Let's Walk Together

Solution

About

Releases

Packages

1nf3rn0-H/KCTF-Writeup

Folders and files

Latest commit

History

Repository files navigation

Reverse Engineering

The Flag Vault

Solution

The Encoder

Solution

Baby shark

Solution

Flag Checker

Solution

Knight Vault

Solution

Droid Flag

Solution

Knight Switch Bank

Solution

Forensics

The Lost Flag

Solution

Compromised FTP

Solution

Unknown File

Solution

Let's Walk Together

Solution

About

Resources

Stars

Watchers

Forks

Releases

Packages 0

Packages