diff --git a/Template-ctf/Binary Exploitation/challange-name.md b/Template-ctf/Binary Exploitation/challange-name.md deleted file mode 100644 index e69de29..0000000 diff --git a/Template-ctf/Cryptography/challange-name.md b/Template-ctf/Cryptography/challange-name.md deleted file mode 100644 index e69de29..0000000 diff --git a/Template-ctf/Forensics/challange-name.md b/Template-ctf/Forensics/challange-name.md deleted file mode 100644 index e69de29..0000000 diff --git a/Template-ctf/Reverse Engineering/challange-name.md b/Template-ctf/Reverse Engineering/challange-name.md deleted file mode 100644 index e69de29..0000000 diff --git a/Template-ctf/Web Exploitation/challange-name.md b/Template-ctf/Web Exploitation/challange-name.md deleted file mode 100644 index e69de29..0000000 diff --git a/Template-ctf/miscellaneous/challange-name.md b/Template-ctf/miscellaneous/challange-name.md deleted file mode 100644 index e69de29..0000000 diff --git a/hacksvctf-2025/bin/elves-are-fun.md b/hacksvctf-2025/bin/elves-are-fun.md new file mode 100644 index 0000000..bdb724b --- /dev/null +++ b/hacksvctf-2025/bin/elves-are-fun.md @@ -0,0 +1,5 @@ +**Flag:** `hacks{1140+frame_dummy}` + +- The name in the table was `frame_dummy`. +- The `.bss` section begins at offset `1140` as found through IDA. + diff --git a/hacksvctf-2025/forensics/chill-guy.md b/hacksvctf-2025/forensics/chill-guy.md new file mode 100644 index 0000000..56d04b9 --- /dev/null +++ b/hacksvctf-2025/forensics/chill-guy.md @@ -0,0 +1,5 @@ +**Flag:** `Hacks{4re_y0u_4_ch1ll_guy}` + +Fix the header of the file `randomfile` to make it a proper JPEG, then run `stegseek randomfile.jpg` with the wordlist `rockyou.txt` to get the password. Use the password to extract the flag. + + diff --git a/hacksvctf-2025/forensics/hidden.md b/hacksvctf-2025/forensics/hidden.md new file mode 100644 index 0000000..80b5bd5 --- /dev/null +++ b/hacksvctf-2025/forensics/hidden.md @@ -0,0 +1,9 @@ +First we run `binwalk -eaM` on `flag_1_1` to find a ppt with 3 images. + +In `image3.png` we find a hidden message in the metadata. + +``` +Artist : #                                                                         # +``` + +We convert the `0x20` to `0` and `0xe28083` to `1` to get the flag. diff --git a/hacksvctf-2025/forensics/shark-bites-packets.md b/hacksvctf-2025/forensics/shark-bites-packets.md new file mode 100644 index 0000000..c8be011 --- /dev/null +++ b/hacksvctf-2025/forensics/shark-bites-packets.md @@ -0,0 +1,4 @@ +**Flag:** `hacks{sh4rk_b1t3$_p4ck37$}` + +We exported the HTTP data through Wireshark, and found the flag split across two images, namely `object482.random_page%2f4540` and `object489.random_page%2f5892`. + diff --git a/hacksvctf-2025/forensics/whats-a-macro.md b/hacksvctf-2025/forensics/whats-a-macro.md new file mode 100644 index 0000000..91ec7af --- /dev/null +++ b/hacksvctf-2025/forensics/whats-a-macro.md @@ -0,0 +1,16 @@ +**Flag:** `hacks{y0u_f0unD_M3}` + +Unzipping the `.pptm` file, we find a bunch of "macros" in a folder all containing "Not the flag!" but one + +```bash +.../file.pptm/ppt/slideMasters/_rels $ fd . -t f -X du -b | grep -v '^12' +57 ./maliciousMacroDetails752/macro.vba +``` + +The flag is there, hex encoded. + +```bash +.../file.pptm/ppt/slideMasters/_rels $ cat ./maliciousMacroDetails752/macro.vba | unhex +hacks{y0u_f0unD_M3} +``` + diff --git a/hacksvctf-2025/rev/100-percent-discount.md b/hacksvctf-2025/rev/100-percent-discount.md new file mode 100644 index 0000000..82a862a --- /dev/null +++ b/hacksvctf-2025/rev/100-percent-discount.md @@ -0,0 +1,41 @@ +Used strings command on the file and found this + +``` + 1197 BKIAYQ^CH + 11a1 XONuELuRH + 11b4 EXYW + 2008 Oh no, you found this: %s +``` + +Opened the file on ghidra and found the function that used this string + +```c +void zxc(void) + +{ + size_t sVar1; + char f [128]; + char x [20]; + int k; + int i; + + builtin_strncpy(x,"BKIAYQ^CXONuELuREXYW",20); + i = 0; + while( true ) { + sVar1 = strlen(x); + if (sVar1 <= (ulong)(long)i) break; + f[i] = x[i] ^ 42; + i = i + 1; + } + sVar1 = strlen(x); + f[sVar1] = '\0'; + printf("Oh no, you found this: %s\n",f); + return; +} +``` + +Simple XOR operation so i used CodeChef to reverse it + +`hacks{tired_of_xors}` + + diff --git a/hacksvctf-2025/rev/basic-rev-200.md b/hacksvctf-2025/rev/basic-rev-200.md new file mode 100644 index 0000000..37f78e9 --- /dev/null +++ b/hacksvctf-2025/rev/basic-rev-200.md @@ -0,0 +1,40 @@ +We just have to reverse this +```c + for (local_10 = 0; local_10 < 8; local_10 = local_10 + 1) { + local_9 = flag.txt[local_10]; + fputc((int)local_9,local_28); + } + for (local_14 = 8; (int)local_14 < 23; local_14 = local_14 + 1) { + if ((local_14 & 1) == 0) { + local_9 = flag.txt[(int)local_14] + 5; + } + else { + local_9 = flag.txt[(int)local_14] + -2; + } + fputc((int)local_9,local_28); + } +``` + + +```python +rev_content = "_hacks_{w1{1wq8]8lle<,T}" #cat rev_this + +flag = list(rev_content[:8]) # First 8 characters are unchanged + +for i in range(8, 23): + if i < len(rev_content): + c = rev_content[i] + if i % 2 == 0: + flag_char = chr(ord(rev_content[i]) - 5) + else: + flag_char = chr(ord(rev_content[i]) + 2) + flag.append(flag_char) + +if len(rev_content) > 23: + flag.append(rev_content[23]) + +flag = ''.join(flag) +print(flag) +``` + +The flag `_hacks_{r3v3rs3_3ng7.O}` diff --git a/hacksvctf-2025/rev/question-encrypted.md b/hacksvctf-2025/rev/question-encrypted.md new file mode 100644 index 0000000..b00bf17 --- /dev/null +++ b/hacksvctf-2025/rev/question-encrypted.md @@ -0,0 +1,40 @@ +``` +31c050682a6f2e6768292b2b456829452f72686e452e726869617d2968727b7971b9180000008 +d342489e7ac341aaae2fab804000000bb0100000089e1ba18000000cd80b80100000031dbcd80 +``` + +This looks like a shellcode so I put this into a bin file and used ndiasm to disassemble this + +``` +❯ ndisasm -b 32 ./shellcode.bin +00000000 31C0 xor eax,eax +00000002 50 push eax +00000003 682A6F2E67 push dword 0x672e6f2a +00000008 68292B2B45 push dword 0x452b2b29 +0000000D 6829452F72 push dword 0x722f4529 +00000012 686E452E72 push dword 0x722e456e +00000017 6869617D29 push dword 0x297d6169 +0000001C 68727B7971 push dword 0x71797b72 +00000021 B918000000 mov ecx,0x18 +00000026 8D3424 lea esi,[esp] +00000029 89E7 mov edi,esp +0000002B AC lodsb +0000002C 341A xor al,0x1a +0000002E AA stosb +0000002F E2FA loop 0x2b +00000031 B804000000 mov eax,0x4 +00000036 BB01000000 mov ebx,0x1 +0000003B 89E1 mov ecx,esp +0000003D BA18000000 mov edx,0x18 +00000042 CD80 int 0x80 +00000044 B801000000 mov eax,0x1 +00000049 31DB xor ebx,ebx +0000004B CD80 int 0x80 +❯ +``` + +This is just a xor operation with key 0x1a + +I used cyberchef to reverse it + +`hacks{g33_5h311_0u4}` diff --git a/Template.md b/template.md similarity index 100% rename from Template.md rename to template.md diff --git a/uiuCTF/README.md b/uiuCTF/README.md deleted file mode 100644 index 07f38e5..0000000 --- a/uiuCTF/README.md +++ /dev/null @@ -1,4 +0,0 @@ -# OFFICIAL FOLDER FOR UIU WRITEUPS - -Add all writeups for challenges in this repo. -