Python on Locus Solus | Nagi's Blog

CTF 2021 Reverse5

Tue, 19 Jan 2021 09:02:47 +0800

The endless exams finally ended, and after half a year I returned to competing with my AAA teammates—and to staying up all night. We solved five of the six reverse-engineering challenges. The remaining one, RL_Env, appeared to involve machine learning; I did not even understand what it was asking us to do.

SECCON 2019 Finals Writeup: bad mouse & 四.3

Fri, 27 Dec 2019 12:52:57 +0800

bad mouse

The challenge provided a small USB circuit board. Once connected, it behaved like an emulated mouse and drew the flag one character at a time. Its drawing speed continually decreased, so it clearly could not finish before the competition ended.

First convert the supplied firmware to binary with a tool such as hex2bin. Open it in IDA, select Atmel AVR as the processor and ATmega32 (or another suitable model) as the device, and the firmware can be disassembled.

ZJUWLAN auto connect

Sat, 10 Nov 2018 10:36:52 +0800

success

ZJU finally deployed WPA2 and 802.1X, so browser-based authentication is no longer necessary.

Recently, ZJUWLAN kept disconnecting for no apparent reason. The campus network required opening a browser to log in and then displayed a small “login successful” window—which i3wm tiled like an ordinary window. This was unbearable for a would-be perfectionist, so I wondered whether a script could perform the login directly and opened Chrome’s developer tools to investigate.

The 5th USTC Information Security Contest

Wed, 17 Oct 2018 22:45:30 +0800

Check-in

Press F12 in Chrome to open Developer Tools. The input field has the following attribute:

1

<p>Key: <input type="text" name="key" maxlength="13"/></p>

Remove the maxlength attribute, then enter hackergame2018.

flag: flag{Hackergame2018_Have_Fun!}

MeePwn 2018: image-crackme

Wed, 17 Oct 2018 22:43:16 +0800

image-crackme

I tried to reverse the challenge with IDA Pro, but IDA crashed halfway through loading it, so I had to work by inference. After running image-crackme.exe several times, I found that it always generated a MeePwn.ascii containing a 160×160 block of seemingly random characters. The directory also contained a 160×160 MeePwn.jpg, without which the program would not run. I suspected a relationship between the image pixels and the output. I replaced the original with a completely white 160×160 image so every pixel was identical, then entered 0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|} (ASCII 48–126) as the key. The output had a very regular pattern:

Python on Locus Solus | Nagi's Blog

*CTF 2021 Reverse*5

SECCON 2019 Finals Writeup: bad mouse & 四.3

bad mouse

ZJUWLAN auto connect

The 5th USTC Information Security Contest

Check-in

MeePwn 2018: image-crackme

image-crackme

CTF 2021 Reverse5