Writeups for Drift/Drift revenge, babycode, blindspot and wx
This challenge provides simple app which is using non-root user patapim with following features: Write a file as non-root user exec command less or equal 4 characters And we need to execute command /tung tung tung tung tung sahur. There is also link to another task from KalmarCTF which was inspiration for this task. I checked writeups for this and similar challenge and I found that couple solutions were used: ...
This challenge was about signature forgery. In this one we have server and it allows to Get public key Create signature Verify signature Signature creation uses secret d and number c \[ s = (k + c * d) % p \]And signature verification uses message m, R and signature s \[ gen * s == R + Q * H(R, m) \]This is Blind Schnorr signature scheme: by design, in order to sign message server should ...
In this challenge we have file output.txt with encrypted message, public key and script which performs encryption. The following encryption scheme looks like this: Generates private and public key. Public key is a Matrix of size 57x63 Converts a message into sequence of bits, adds padding and splits into chunk of size 57 Encodes each chunk using public key Joins encoded chunks and converts sequence of bits to hex Chunk encryption works as follows: multiplies chunk as vector of size 1x57 with public key of size 57x63 by modulo 2. As a result it returns vector of bits of size 1x63. After that, it randomly swaps one bit and the result is encoded chunk. ...
Drift chat There were two challenges: Drift chat and Drift chat revenge. The only difference is that in revenge version simple unintended solution was fixed. Let’s take a look on the app first: we see the app with login/screen and simple chat functionality: create chat, send a message and very suspicious and ambiguous feature drafts, where messages are saved as draft, and visible for a companion. While searching for the flag in source, we see that during initial migrations two users are being created and flag is inserted as a message in chat between them. ...