Recently, ZJUWLAN kept disconnecting for no apparent reason. The campus network required opening a browser to log in and then displayed a small “login successful” window—which i3wm tiled like an ordinary window. This was unbearable for a would-be perfectionist, so I wondered whether a script could perform the login directly and opened Chrome’s developer tools to investigate.

Check-in

Press F12 in Chrome to open Developer Tools. The input field has the following attribute:

1

<p>Key: <input type="text" name="key" maxlength="13"/></p>

Remove the maxlength attribute, then enter hackergame2018.

flag: flag{Hackergame2018_Have_Fun!}

image-crackme

I tried to reverse the challenge with IDA Pro, but IDA crashed halfway through loading it, so I had to work by inference. After running image-crackme.exe several times, I found that it always generated a MeePwn.ascii containing a 160×160 block of seemingly random characters. The directory also contained a 160×160 MeePwn.jpg, without which the program would not run. I suspected a relationship between the image pixels and the output. I replaced the original with a completely white 160×160 image so every pixel was identical, then entered 0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|} (ASCII 48–126) as the key. The output had a very regular pattern:

• Reverse Script In Script
• Reverse Where is my 13th count?
• Reverse simple
• Misc Welcome to SCTF 2018
• Misc Mysterious Transaction
• Misc Otaku’s Happy Challenge
• Misc Introduction to Side Channels
• Web easiest web - phpmyadmin