# TCP1P CTF
## EzPDFIn this task i first checked the PDF file through Acrobat Reader, and by moving the picture i discovered smth very looking very similar to part of the flag:
`_0N_pdf_f1L35_15_345y`
Next, i just opened this pdf file through simple text reader (*notepadqq*), and found following line:
`/Creator (SW4gdGhpcyBxdWVzdGlvbiwgdGhlIGZsYWcgaGFzIGJlZW4gZGl2aWRlZCBpbnRvIDMgcGFydHMuIFlvdSBoYXZlIGZvdW5kIHRoZSBmaXJzdCBwYXJ0IG9mIHRoZSBmbGFnISEgVENQMVB7RDAxbjlfRjAyM241MUM1)`
That looked very similar to **base64** encoding, so i tried to decode that, and got:
`In this question, the flag has been divided into 3 parts. You have found the first part of the flag!! TCP1P{D01n9_F023n51C5`
Great! So we've got 2 parts of 3 parts of the flag. Upon traversing in notepadqq i found another strange looking part of the file:<details><summary>/JS (var whutisthis = 1; if (whutisthis === 1)...</summary>/JS (var whutisthis = 1; if (whutisthis === 1) { this.print({bUI:true,bSilent:false,bShrinkToFit:true}); } else { function _0x510a(_0x4c8c49,_0x29ea76){var _0x5934bd=_0x5934();return _0x510a=function(_0x510a0b,_0x1b87bb){_0x510a0b=_0x510a0b-0x174;var _0x6c8a33=_0x5934bd[_0x510a0b];return _0x6c8a33;},_0x510a(_0x4c8c49,_0x29ea76);}(function(_0x39f268,_0x3518a2){var _0x43b398=_0x510a,_0x1759ee=_0x39f268();while(!![]){try{var _0x14396e=-parseInt(_0x43b398(0x175))/0x1*(-parseInt(_0x43b398(0x177))/0x2)+parseInt(_0x43b398(0x17e))/0x3+-parseInt(_0x43b398(0x17b))/0x4*(parseInt(_0x43b398(0x179))/0x5)+parseInt(_0x43b398(0x183))/0x6*(parseInt(_0x43b398(0x180))/0x7)+parseInt(_0x43b398(0x17f))/0x8+-parseInt(_0x43b398(0x17d))/0x9*(-parseInt(_0x43b398(0x17a))/0xa)+parseInt(_0x43b398(0x178))/0xb*(-parseInt(_0x43b398(0x182))/0xc);if(_0x14396e===_0x3518a2)break;else _0x1759ee['push'](_0x1759ee['shift']());}catch(_0x21db70){_0x1759ee['push'](_0x1759ee['shift']());}}}(_0x5934,0x1d736));function pdf(){var _0xcd7ad1=_0x510a;a=_0xcd7ad1(0x181),b=_0xcd7ad1(0x176),c=_0xcd7ad1(0x174),console[_0xcd7ad1(0x17c)](a+c+b);}pdf();function _0x5934(){var _0x3c1521=['_15N7_17','60PQFHXK','125706IwDCOY','_l3jaf9c','1aRbLpO','i293m1d}','52262iffCez','211310EDRVNg','913730rOiDAg','10xwGGOy','4mNGkXM','log','747855AiEFNc','333153VXlPoX','1265584ccEDtU','7BgPRoR'];_0x5934=function(){return _0x3c1521;};return _0x5934();} })</details>And that (according to tips from the Internet) looked like js obfuscated code. Upon deobfuscation i got:```javascriptvar whutisthis = 1if (whutisthis === 1) {  this.print({    bUI: true,    bSilent: false,    bShrinkToFit: true,  })} else {  function pdf() {    a = '_15N7_17'    b = 'i293m1d}'    c = '_l3jaf9c'    console.log(a + c + b)  }  pdf()}```And, how you can already tell, this code gives us the third part of the flag:
`'_15N7_17_l3jaf9ci293m1d}`
So, the final flag will look like:
`TCP1P{D01n9_F023n51C5_0N_pdf_f1L35_15_345y_15N7_17_l3jaf9ci293m1d}`
## zipzipzipThis task consisted of the file zip-25000.zip and the password password.txt. After using the unzip command, it became clear that this is a nesting doll of 25000 zip files folded into each other, and with a password. To solve this task, I wrote code in Python that will do it for me:```pythonimport os
zip_number=25000cmd1 = "find . -name '*.zip' -exec unzip -o -P "cmd2 = " {} \; -exec rm {} \;"
file = open("password.txt", "r")pswd = (file.read()).strip()file.close()
for i in range(1, zip_number):	print('readed pswd number', i, ' - ', pswd) 	os.system(cmd1 + pswd + cmd2) 	file = open("password.txt", "r")	pswd = (file.read()).strip()	file.close() 	print('done for: ', i)```
And in file named zip-1.zip we found file named flag.txt.
Flag: `TCP1P{1_TH1NK_U_G00D_4T_SCR1PT1N9_botanbell_1s_h3r3^_^}`
## Sanity CheckThis task had a link to events discord server. Upon searching the flag, i found it in the bot's description.\Flag: `TCP1P{Welcome To TCP1P Server}`
## Guess My NumberIn this task we are presented with file named *guess*, that is unreadable, but strarts with the letters **ELF**. I found app named `radare 2` that lets you effectively dissassemble many file types.
So i dissassembled that file, and with function `afl` looked what functions lies inside that *guess* file. This is what i got:```0x000010d0    1     33 entry00x00001100    4     34 sym.deregister_tm_clones0x00001130    4     51 sym.register_tm_clones0x00001170    5     54 sym.__do_global_dtors_aux0x000010c0    1      6 sym.imp.__cxa_finalize0x000011b0    1      9 sym.frame_dummy0x0000122b    3    183 sym.vuln0x00001060    1      6 sym.imp.srand0x000010b0    1      6 sym.imp.rand0x00001050    1      6 sym.imp.printf0x00001070    1      6 sym.imp.fflush0x00001090    1      6 sym.imp.__isoc99_scanf0x00001030    1      6 sym.imp.puts0x00001040    1      6 sym.imp.system0x000010a0    1      6 sym.imp.exit0x0000130c    1      9 sym._fini0x00001206    1     37 sym.banner0x000012e2    1     41 main0x000011b9    3     77 sym.flag_handler0x00001080    1      6 sym.imp.fopen0x00001000    3     23 sym._init```
Next, i looked up main function by the command `pdf @main`:```int main (int argc, char **argv, char **envp);│           0x000012e2      55             push rbp│           0x000012e3      4889e5         mov rbp, rsp│           0x000012e6      b800000000     mov eax, 0│           0x000012eb      e8c9feffff     call sym.flag_handler│           0x000012f0      b800000000     mov eax, 0│           0x000012f5      e80cffffff     call sym.banner│           0x000012fa      b800000000     mov eax, 0│           0x000012ff      e827ffffff     call sym.vuln│           0x00001304      b800000000     mov eax, 0│           0x00001309      5d             pop rbp└           0x0000130a      c3             ret```
And then, since the banner comes before asking us to guess number, i understood that function that checks our number is sys.vuln, so, i looked it up via `pdf @sys.vuln` and got:
```sym.vuln ();│           ; var int64_t var_4h @ rbp-0x4│           0x0000122b      55             push rbp│           0x0000122c      4889e5         mov rbp, rsp│           0x0000122f      4883ec10       sub rsp, 0x10│           0x00001233      c705272e0000.  mov dword [obj.key], 0      ; [0x4064:4]=0│           0x0000123d      bf39050000     mov edi, 0x539              ; int seed│           0x00001242      e819feffff     call sym.imp.srand          ; void srand(int seed)│           0x00001247      e864feffff     call sym.imp.rand           ; int rand(void)│           0x0000124c      8945fc         mov dword [var_4h], eax│           0x0000124f      488d05670e00.  lea rax, str.Your_Guess_:_  ; 0x20bd ; "Your Guess : "│           0x00001256      4889c7         mov rdi, rax                ; const char *format│           0x00001259      b800000000     mov eax, 0│           0x0000125e      e8edfdffff     call sym.imp.printf         ; int printf(const char *format)│           0x00001263      488b05ee2d00.  mov rax, qword [obj.stdout] ; obj.__TMC_END__│                                                                      ; [0x4058:8]=0│           0x0000126a      4889c7         mov rdi, rax                ; FILE *stream│           0x0000126d      e8fefdffff     call sym.imp.fflush         ; int fflush(FILE *stream)│           0x00001272      488d05eb2d00.  lea rax, obj.key            ; 0x4064│           0x00001279      4889c6         mov rsi, rax│           0x0000127c      488d05480e00.  lea rax, [0x000020cb]       ; "%d"│           0x00001283      4889c7         mov rdi, rax                ; const char *format│           0x00001286      b800000000     mov eax, 0│           0x0000128b      e800feffff     call sym.imp.__isoc99_scanf ; int scanf(const char *format)│           0x00001290      8b45fc         mov eax, dword [var_4h]│           0x00001293      8d90f3671400   lea edx, [rax + 0x1467f3]│           0x00001299      8b05c52d0000   mov eax, dword [obj.key]    ; [0x4064:4]=0│           0x0000129f      31d0           xor eax, edx│           0x000012a1      3dbebafeca     cmp eax, 0xcafebabe│       ┌─< 0x000012a6      7528           jne 0x12d0│       │   0x000012a8      488d051f0e00.  lea rax, str.Correct__This_is_your_flag_: ; 0x20ce ; "Correct! This is your flag :"│       │   0x000012af      4889c7         mov rdi, rax                ; const char *s│       │   0x000012b2      e879fdffff     call sym.imp.puts           ; int puts(const char *s)│       │   0x000012b7      488d052d0e00.  lea rax, str.cat_flag.txt   ; 0x20eb ; "cat flag.txt"│       │   0x000012be      4889c7         mov rdi, rax                ; const char *string│       │   0x000012c1      e87afdffff     call sym.imp.system         ; int system(const char *string)│       │   0x000012c6      bf00000000     mov edi, 0                  ; int status│       │   0x000012cb      e8d0fdffff     call sym.imp.exit           ; void exit(int status)│       │   ; CODE XREF from sym.vuln @ 0x12a6(x)│       └─> 0x000012d0      488d05210e00.  lea rax, str.Wrong__Try_again_harder_ ; 0x20f8 ; "Wrong, Try again harder!"│           0x000012d7      4889c7         mov rdi, rax                ; const char *s│           0x000012da      e851fdffff     call sym.imp.puts           ; int puts(const char *s)│           0x000012df      90             nop│           0x000012e0      c9             leave└           0x000012e1      c3             ret```
Then, here i found line that says `0x000012a1      3dbebafeca     cmp eax, 0xcafebabe`, where program compare our string with 0xcafebabe.
But before that, we can see this:```0x00001293      8d90f3671400   lea edx, [rax + 0x1467f3]0x00001299      8b05c52d0000   mov eax, dword [obj.key]    ; [0x4064:4]=00x0000129f      31d0           xor eax, edx```That means, that our input is firstly XORed with 0x1467f3, and only then it is comared to 0xcafebabe.
So to get the correct input we need to XOR(edx, 0xcafebabe). The rax == **0x000020cb** => edx == **[0x1488be]** and if we look at the memory sector **[0x1488be]** we will find **0x118561dc**, so that means that eax == **0xdb7bdb62**. Simply convert it to decimal and get **3682327394**. If we type that number we will get the flag!
Flag: `TCP1P{r4nd0m_1s_n0t_th4t_r4nd0m_r19ht?_946f38f6ee18476e7a0bff1c1ed4b23b}`
## Bluffer OverflowIn this challenge we are presented with this code:```c#include <stdio.h>#include <stdlib.h>
char buff[20];int buff2;
void setup(){	setvbuf(stdin, buff, _IONBF, 0);	setvbuf(stdout, buff, _IONBF, 0);	setvbuf(stderr, buff, _IONBF, 0);}
void flag_handler(){	FILE *f = fopen("flag.txt","r");  	if (f == NULL) {    	printf("Cannot find flag.txt!");    	exit(0);  }}
void buffer(){	buff2 = 0;	printf("Can you get the exact value to print the flag?\n");	printf("Input: ");	fflush(stdout);	gets(buff);	if (buff2 > 5134160) {		printf("Too high!\n\n");	} else if (buff2 == 5134160){		printf("Congrats, You got the right value!\n");	 	system("cat flag.txt");	} else {		printf("Sad, too low! :(, maybe you can add *more* value 0_0\n\n");	}	printf("\nOutput : %s, Value : %d \n", buff, buff2);}
int main(){	flag_handler();	setup();	buffer();}```
So, we can see the number we need to get is **5134160**. I tried typing characters until i see that buffer is overflown and our input is registered.
The last input that wasn't registered is *0xffffffffffffffffff*, if i tried enhancing that one, value went up.
Next, i just tried bruteforcing it with ASCII characters on my local machine, until i got the answer, that was *0xffffffffffffffffffPWN*, so i tried it in the remote challenge and got the flag.
Flag: `TCP1P{ez_buff3r_0verflow_l0c4l_v4r1abl3_38763f0c86da16fe14e062cd054d71ca}`
## Links[Participation certificate](https://github.com/Archibald1707/ctf_writeups/blob/master/certificate.pdf)