33C3 CTF – shjail

The goal of this challenge is to successfully run (in a shell on a provided server) a setuid binary flag which asks you to repeat a number, and then (if you repeat it successfully) outputs the flag: This would be trivial but for one interesting restriction of the provided shell: the only characters you are…

33C3 CTF – babyfengshui

In this challenge, we are provided with a 32-bit ELF ('babyfengshui') and a libc file ('libc-2.19.so'). The program maintains a list of users, which consist of names and descriptions. Here is some example usage, where we add a user and then display it: As you can see, there are 4 relevant actions, so let's go…

33C3 CTF – Beeblebrox

This crypto challenge is a classic "fake-the-signature" crypto challenge, but with a somewhat unusual signature scheme that depends on the hardness of computing $latex n$th roots modulo a semiprime: There is a publicly known semiprime $latex N = PQ$, whose two prime factors $latex P$ and $latex Q$ are known only to the signer. There…

33C3 CTF – Ichnixwisse

In this crypto challenge, we're given an implementation of a zero-knowledge proof system for 3-coloring a graph. We're also given a graph on 100 vertices with 4600 edges which is far from 3-colorable. Our goal is to fool the verifier on the server and prove to it that this graph is in fact 3-colorable (where…

33C3 CTF Postmortem

[placeholder]

SharifCTF 7 – Lobotomized LSB Oracle

[Note: this is a follow up to the challenge LSB Oracle. It may be useful to view the writeup for that challenge first.] In LSB Oracle, we were given an oracle that would compute the least significant bit of decryptions of inputs we feed it. In Lobotomized LSB Oracle, we are given the same oracle,…

SharifCTF 7 – Radio Intelligence

This crypto challenge was somewhat strange in that it took the form of a scrambled audio file. The challenge description tells us the file was formed by taking an audio recording of someone speaking (specifically, saying "The flag is", pausing for 1-2 seconds, and then reading out the flag) XORed with a linear-feedback shift register.…