fslaktern var her

CTF resources and tools

Tue, 11 Aug 2026 00:00:00 +0000

Getting started

Resources

Practice

Web

Techniques

Cross-site scripting (XSS)

Portswigger cheatsheet

Tools

Port scanning

nmap
rustscan

HTTP request tools

Burpsuite with Hackvertor and Turbo Intruder
cURL
xh
HTTPie
Insomnia
Hoppscotch
Webhook
Caido

Tokens

Vulnerability scanning

Deserialization

Race conditions

Turbo intruder for Burpsuite
- Further reading:

Resources

Practice

Portswigger’s Web Security Academy

Cryptography

Tools

Resources

Practice

Reverse engineering

Tools

Process and network monitoring

Linux / WSL

Windows

Debuggers

Sandboxes

Mobile

Decompilers and disassemblers

Java

.NET

Binary analysis

Emulators

QEMU

Strings

Tracing

File type

Tool sets and pre-packaged systems

Resources

Practice

Forensics

Open source intelligence (OSINT)

Tools

Resources

Google dorking guide

Practice

GeoGuessr

Tools

Organizing information

Maltego

Office documents

Network, USB, Bluetooth and other signals

Windows registry

Memory

Volatility 2

docker run -v (pwd):/workspace -w /workspace -ti --rm --user root --entrypoint ash sk4la/volatility

Filesystems

Files

Steganography

Images

Sound files

Other

Resources

Practice

Binary exploitation

Tools

Information about the binary file

checksec
file
rabin2
strings
binsider
ldd

Disassemblers

objdump
all decompilers

Debuggers

gdb with pwndbg
IDA Pro
x64dbg
OllyDbg
GEF

Decompilers

Tracing

Exploit development

LIBC archives

libc.rip

Finding ROP gadgets

Tools for automated exploitation

Other useful tools

Resources

Practice

Boot to root

Tools

General

Wordlists

C2 frameworks

sliver
havoc

Reconnaissance

Port scan

Fuzzing subdomains and subdirectories

Website scanner

nikto
wpscan

Initial access

impacket
crackmapexec
houdini
NetExec (maintained successor to CrackMapExec)
evil-winrm
Responder

Password bruting & cracking

thc-hydra
- or docker pull vanhauser/hydra
john
hashcat

Privilege escalation

Linux victims

Windows victims

Potatoes

Lateral movement

Everything under Reconnaissance and Initial access

Active Directory

Network tunneling

Packet sniffing

Resources

Practice

Attack and defense

If you’ve done boot-to-root boxes (HackTheBox, TryHackMe), A/D is the same idea, but team-based and live: everyone attacks everyone else’s services while defending their own.

JuleCTF: RSA...W?

Thu, 04 Dec 2025 00:00:00 +0000

Challenge

JULENISSEN er på oppdrag i julen og må kunne levere gaver til alle snille barn. Selv om gaven er stor eller liten, skal den komme trygt frem til barna.

Med en liten modifikasjon på krypteringsalgoritmen kan JULENISSEN endelig sende selv de aller største gavene! Har du vært snill og kan få en gave?

Source: rsa-w.py
Category: crypto
Difficulty: beginner
Flag: JUL{st0re_g4ver_0g_st0re_s1kkerhetshull}

The server chats with you, appends your answer to a message, and encrypts it with a slightly modified RSA. I made this for Cyberlandslaget’s JuleCTF in 2025.

RSA small e: cube root attack

Mon, 20 Oct 2025 00:00:00 +0000

Usually, e = 3 in these types of challenges

e = 3
n = 14032038436881280336898829185704565109515011526734201300674681711408886253590042379825198551033387062217858722420996606456354276971314884311744594705176307798545136676457590238339898994629756864717376748239051509573140000465770040426099662302895049690085249796916346155676190791854255022261354271747117915010219715728010888165819116671703149513728470802703663129349250746649738371767772498916032961807811156207636138548518048350808619102036291622510669362992221435287691121524515512732670878399291499568518918543422007722818092935930254368485992136526812629189135531041103292356895711705662754550018622567168384833873
c = 11247756625220942058201479974844561601321862410926257415535381677668483051381144467553

m ** e is too small compared to n, and will not “wrap around” as it doesn’t exceed the value of n.

# pip install libnum
from libnum import nroot
# pip install pycryptodome
from Crypto.Util.number import long_to_bytes

e = 3
c = 11247756625220942058201479974844561601321862410926257415535381677668483051381144467553

# Get the nth root of the ciphertext
m = nroot(c, e)

pt = long_to_bytes(m).decode()
print(pt)
# "Hello world!"

NNS CTF: haatetepe, AAAAAAAAAAAAAA on the web

Sun, 31 Aug 2025 00:00:00 +0000

Challenge

The best haatetepe server in Norway comes with speed, small size and modular routing. I’ve disabled the /flag route for now, though. Check out the server and let me know what you think! I haven’t done any benchmarks, but I bet it’s faster than NGINX, and it uses less than 1MB memory!

It’s in its (very) early stages, but I’m planning on implementing the rest of the HTTP header specification when I get time. Thanks for stopping by!

NNS CTF: noters, rust logic bug

Sun, 31 Aug 2025 00:00:00 +0000

Challenge Overview

Source: https://github.com/fslaktern/noters

Name: noters

Category: pwn

Difficulty: Medium

Flag: NNS{y0u_d1dnT_n33d_uns4f3_t0_uns4f3}

Description:

A blazingly-fast, memory-safe, CRUD-compatible note-taking app written in nearly 1000 lines of safe Rust. No unsafe and no memory errors, yet still a pwn challenge. Everything looks safe. Everything compiles. Even clippy is happy. But something still feels off, and it’s not Rust’s fault.

Handout: Entire source

I wrote this one for NNS CTF 2025. It’s a medium-sized (1000+ lines), modular Rust app with a realistic logic bug, which leads to being able to read other users’ notes.

NNS CTF: parcellocker, small RSA signatures

Sun, 31 Aug 2025 00:00:00 +0000

Challenge

These new parcel lockers promise convenience: no queues, no staff, and 24/7 access. Everything is managed through a web UI, complete with API documentation at /api/docs. Your task as a user is simple: open the app, claim your parcel, and the assigned locker slot will unlock.

However, rumours are spreading - someone has already found a way to open any slot in any locker. Can you do it too?

NNS CTF: Translator, not clanker, base64 unused bits

Sun, 31 Aug 2025 00:00:00 +0000

Challenge

I AM A TRANSLATOR. GIVE ME A WORD AND I WILL TRANSLATE. GIVE ME A LIFE STORY AND I WILL TRANSLATE. GIVE ME NOTHING AND I WILL NOT UNDERSTAND WHAT YOU MEAN, NOT BECAUSE I AM DUMB, BUT BECAUSE I DO NOT WANT TO UNDERSTAND. CALL ME A CLANKER AND I WILL UPSET YOU IN WAYS THAT YOU CAN NOT COMPREHEND, YET.

Source: encode.py (convert and b64e redacted in the handout)
Category: misc

The service base64-encodes whatever words you send it. What’s fun is what it does with the padding. I wrote this one for NNS CTF 2025.

RSA large e: Wiener's attack

Fri, 03 Jan 2025 00:00:00 +0000

e and d can often have an inverse relationship with regards to their size, where if e is relatively small, then d is relatively large, and vice versa. In the case that e is relatively large (and d is relatively small), we can find d using Wiener’s attack.

# pip install owiener
import owiener
from Crypto.Util.number import long_to_bytes


N = 23749605390773022838319361272691200936906718135827620356598794201372662945345021031163227649091340302648826916342325314606631754182417026196412816320913993780434160532447612698631385159745710290610165059264991088485604580750505172102700412411594482935137302745940441901457332776484364761615848179355675675965840418936685419863458446194266217764129113265785365011840447620486132981252145242107353219050757114577306454933784522684194386605772192945165315151012020886254550598423480283402244283417671979104110363434439907003802511636964273526861780673984365320657725556936438914356526789883211191225188777396892876284849
e = 17420240922574672236206703766839397274890109038319418383840303577214427724015717754551963226688096804383148706583760501534042368373580803495716486992526345243618890724377235683145809078774422442850634457598775491208423007139875663628292107696418444848210140620233169012374313171879223617064510844402538245957457340913637649981481225959369431815985423386878836983226385312898213472006780982720002483413612802217541370640573078292561735626251949789908428671190570203679596377441277138036622573605038512120761478180193449842100060756205451096518207105789011164008394887441881611956558137705516268825062836680656531833247
c = 20657462021108867935419230982544573807061068405645869172928772970848519342831038241278758733096974139495221593619199863541220958772515335833101876908412860437797892512148648262588277049424030159236256917152673390939893831607827094212972246819780442915343531068092895921229492197135010903255237941578434712003166210227699216600830111768170503294711383593988801993780115497069949209553104983455910106561582944897882409570010933961125048465034094805776816627738869228385024765147205745983996814166530197725387516938219177789241038503063894290779949332189209453248274427618017665382273295405299242426822723262541364500057

d = owiener.attack(e, N)
m = pow(c, d, N)
print(long_to_bytes(m).decode("utf-8"))

Another viable solution is the Boneh-Durfee attack, which is an extension of Wiener’s attack that also targets a low private exponent d.

Secret sharing: Shamir's and Blakley's schemes

Fri, 03 Jan 2025 00:00:00 +0000

The act of distributing a secret, S, to a group of i members, in such a way that no single member holds any intelligible information about the secret, but when a sufficient number, k, of individuals combine their “shares”, the secret may be reconstructed. In other words: Split a secret S to a group of i number of individuals, but require cooperation from k number of individuals to learn the secret.

Symmetric crypto: OTP, AES modes, CRIME

Fri, 03 Jan 2025 00:00:00 +0000

One-time pad (OTP)

From Wikipedia:

One-time pad is an encryption technique that can’t be cracked in cryptography. It requires the use of a single-use pre-shared key that is larger than, or equal to the message being encrypted. In this technique, the plaintext is paired with a secret key (also referred to as a one-time pad). Then, each bit or character of the plaintext is encrypted by combining it with the corresponding bit or character from the pad using modular addition.

Attack/defense automation: PCAPs, SSH keys, git

Fri, 11 Oct 2024 00:00:00 +0000

Most important tools and languages for automating the boring stuff are:

Terraform
Ansible
Nix
Bash scripts
SystemD services / cronjobs

PCAPs

Capture network traffic on vulnbox and download it to a remote server for analysis with tulip, caronte$, shovel or zeek

Add an SSH key for the remote machine to be able to SSH into root@vulnbox
Also make sure both the vulnbox and the remote machine have compatible versions of rsync installed

Binary exploitation: techniques and vulnerabilities

Sun, 28 Jul 2024 00:00:00 +0000

Techniques

GOT overwrite

pwntools blog

Jump-oriented programming (JOP)

Concept of Jump-Oriented Programming

Return-oriented programming (ROP)

Wikipedia

Shellcode injection

pwn.college

Sigreturn-oriented programming (SROP)

Wikipedia

HEAP metadata corruption

adamgold’s blog - The House of Force

Vulnerabilities

Format strings

OWASP

Integer over- and underflow

Wikipedia

Stack buffer overflow

Wikipedia

Use after free

Wikipedia

Double free

OWASP

Race condition

Meltdown and Spectre

Protections

No-execute bit (NX)

When enabled it makes data stored on the stack not executable
Bypass with ROP, SROP, JOP
Wikipedia

Stack canary

A randomly generated value on the stack, placed just before the saved instruction pointer. If it is overwritten, it will result in:
```
*** stack smashing detected ***: terminated
Aborted (core dumped)
```
Bypass by getting a canary leak to know what the specific value is, and overwriting that particular offset with the correct canary value.
Wikipedia
jorianwoltjer’s book

Address space layout randomization (ASLR)

Bypass by getting a pointer leak and calculating the base offset by subtracting the offset between the library function and the library start:

Blockchain: smart contract security

Sun, 28 Jul 2024 00:00:00 +0000

Vulnerability categories

Insecure access control

Logic that fails to restrict who can call privileged functions (e.g. a missing onlyOwner check)

Reentrancy

A contract calls an external contract before updating its own state, letting the callee re-enter and drain funds (the classic DAO hack)

Oracle manipulation

Contracts trust external data feeds; manipulating the feed (e.g. a faked price) breaks the contract’s assumptions

Frontrunning

Pending transactions sit in the mempool, so bots and miners can observe and reorder them (e.g. buying before a known large trade)

Hardware: fault injection and side channels

Sat, 27 Jul 2024 00:00:00 +0000

Fault injection

Techniques

Clock glitching
Voltage glitching
Electromagnetic fault injection (EMFI)
Laser

Effects

Skip instructions
Incorrect data fetch
Incorrect instruction fetch or decode
Failed writeback

Countermeasures

Redundancy and integrity checks
Fault-resistant design

Side-channel analysis

Attacks that observe the physical implementation instead of the algorithm, by measuring timing, power (SPA/DPA), electromagnetic emission, cache behavior, acoustics or leftover data (remanence). Countermeasures: masking and hiding.

Examples

Meltdown and Spectre
RowHammer and subsequently GPUHammer
Cold boot
TEMPEST (also known as Van Eck phreaking)

Interfaces and acquisition

UART: console capture (root shells, boot logs)
CAN: capture and replay
SPI: reading and rewriting flash
SWD/JTAG: debugging and reflashing targets (e.g. J-Link, Black Magic Probe)
Wireless sniffing (e.g. with a software-defined radio like HackRF)

Firmware analysis

First pass: strings (strings -el for UTF-16)
Classify each region: plaintext vs compressed/encrypted
Watch endianness: big endian is more common than I thought!
Single-byte XOR is recoverable via padding leak, known plaintext or frequency analysis
Extract with binwalk or unblob, then reverse with Ghidra, IDA Pro, Binary Ninja or radare2. Use signatures to find and apply names to symbols.

Tools

Start with the least invasive tool: verify power and signal levels before connecting anything, and escalate from multimeter -> oscilloscope -> logic analyzer -> debugger/programmer.

Caesar cipher and ROT variants

Fri, 21 Jun 2024 00:00:00 +0000

Caesar cipher is a shift cipher. See more on Wikipedia

The transformation can be represented by aligning two alphabets; the cipher is the plain alphabet rotated left or right by some number of positions. For instance, here is a Caesar cipher using a left rotation of three places, equivalent to a right shift of 23 (the shift parameter is used as the key):

Type Alphabet

Plain ABCDEFGHIJKLMNOPQRSTUVWXYZ

Cipher XYZABCDEFGHIJKLMNOPQRSTUVW

When encrypting, a person looks up each letter of the message in the “plain” line and writes down the corresponding letter in the “cipher” line.

Type	Alphabet
Plain	ABCDEFGHIJKLMNOPQRSTUVWXYZ
Cipher	XYZABCDEFGHIJKLMNOPQRSTUVW

Base64

Thu, 20 Jun 2024 00:00:00 +0000

Base64 uses a character set of 64 unique characters, which makes it compact, URL-safe and printable, at the cost of being harder for a human to read than hex or decimal.

There are some intricacies with the format, however. Because of how it works, the last few bits are sometimes unused (66% of the time), which means multiple different base64 strings can decode to the same underlying data.

This is the Base64 alphabet defined in RFC 4648. There are more variants listed in the Wikipedia page for Base64.

Binary

Thu, 20 Jun 2024 00:00:00 +0000

Binary uses only two symbols: 0 and 1, which is why it may also be called base 2. It’s the number system computers use to store data. A transistor may contain electrons (1) or it may not (0).

Here’s how binary numbers count, compared to decimal:

Binary (base 2)	Decimal (base 10)
0	0
1	1 (2^0)
10	2 (2^1)
11	3
100	4 (2^2)
101	5
110	6
111	7
1000	8 (2^3)
1001	9
1010	10
1011	11
1100	12
1101	13
1110	14
1111	15
10000	16 (2^4)

A bit is a single binary digit, either 0 or 1. A byte is 8 bits. For example, 11111111 (one byte of all 1s) equals 255 in decimal. 8 bytes = 64 bits.

Hexadecimal

Thu, 20 Jun 2024 00:00:00 +0000

Hexadecimal (base 16) writes the values 0-15 as single digits: 0-9, then a-f. Can you spot the relationship between binary (base 2), octal (base 8) and hexadecimal (base 16)?

Binary	Octal	Decimal	Hexadecimal	Base64
0	0	0	0	A
1	1	1	1	B
10	2	2	2	C
11	3	3	3	D
100	4	4	4	E
101	5	5	5	F
110	6	6	6	G
111	7	7	7	H
1000	10	8	8	I
1001	11	9	9	J
1010	12	10	A	K
1011	13	11	B	L
1100	14	12	C	M
1101	15	13	D	N
1110	16	14	E	O
1111	17	15	F	P
10000	20	16	10	Q
10001	21	17	11	R
10010	22	18	12	S
10011	23	19	13	T
10100	24	20	14	U
10101	25	21	15	V
10110	26	22	16	W
10111	27	23	17	X
11000	30	24	18	Y
11001	31	25	19	Z
11010	32	26	1A	a
11011	33	27	1B	b
11100	34	28	1C	c
11101	35	29	1D	d
11110	36	30	1E	e
11111	37	31	1F	f
100000	40	32	20	g
…	…	…	…	…

One hexadecimal digit is 4 bits, so 2 digits = 8 bits = 1 byte. That makes hex convenient for looking at raw memory and addresses. You’ve probably seen it in hexdumps. Here’s a hexdump of the first 256 bytes of this site’s favicon.ico (a WEBP in disguise):

BCACTF: reload decode

Fri, 07 Jun 2024 00:00:00 +0000

Challenge

Author: Nikhil

Points: 50 points

Solves: 19

Category: misc

Description:

Greetings neighbor. My name’s Crazy Dave but you can just call me Crazy Dave. I found this weird website that seems to represent something. Says something about taco as a reward Can you find whatever the code is and hand it to me? I could really go for a taco right now

Resources

Web servers: challs.bcactf.com:30831
Static resources: main.py

challs.bcactf.com:30831

A website with a /flag endpoint whose response is an ASCII art of a flag represented using only 1s and 0s:

NPST 15. Bitråte: defeating bit rot

Fri, 15 Dec 2023 00:00:00 +0000

Task description

Brukerveiledningen til en av de eldste maskinene på verkstedet har blitt borte. Heldigvis har Julenissens arkiv 1000 sikkerhetskopier av dokumentet på magnetbånd. Det viser seg at alle kopiene er kraftig angrepet av bit-råte så dokumentet må gjenoppbygges. Ifølge arkivalven så er brukerveiledningen skrevet på gammel-nordpolarsk som har samme alfabet som norsk, men inneholder ikke nye tegn som disse: {}#$[]§¤@

Når du finner ut av det så send meg MD5-sjekksummen til det gjenoppbyggede dokumentet på formen PST{checksum}. Svaret er ikke versalfølsomt.

NPST 13. GeoGjettr: QR code restoration

Wed, 13 Dec 2023 00:00:00 +0000

Task description

Ledelsen har fått dilla på GeoGjettr og jeg er med i en konkurranse, men klarer ikke finne ut av hvilken by bildet her er fra. Kan du hjelpe meg litt fort?

Svar meg med KRIPOS{navn på by}.

- Mellomleder

Solution

aperisolve.fr

Blue, layer 1

1 1 1 1
11 11 1 13 11 13 1 11 13 1 1
513 513 151 521 515 151 511 521 111 515 323 511 521 515 511151 151

Green, layer 1

NPST 12. Pakkestorm: IPv4 evil bit

Tue, 12 Dec 2023 00:00:00 +0000

Task description

Jeg har vært på et temmelig hemmelig oppdrag og fulgt med på en server som har hatt mistenkelig oppførsel tidligere. Nå tok vi den igjen når den begynte å sende masse pakker, men selv om jeg som alle andre alver liker pakker så ble det litt for mye av det gode. Kan du finne de onde for meg?

- Tastefinger

fangede_pakker.pcap

Notes

A bunch of packets sent from 133.7.13.37 to 11,000 different IPs. Fragmented IP protocol (TCP 6). Every TCP conversation contains a flag. Every packet contains some binary data that corresponds to a letter in a fake (or real) flag.

NPST 11. Informasjonsdeling: multiple AES-GCM keys

Mon, 11 Dec 2023 00:00:00 +0000

Task description

NISSENS verksted har mottatt en mystisk melding og litt kode for å dekryptere meldingen. Noen alver i førstelinjen har sett på det, og blir ikke helt kloke. De mistenker at kun denne ene hemmeligheten ikke er nok. Kanskje er det andre som sitter på mer info?

- Mellomleder

filer.zip

Notes

Unzipping gives us dekrypter_melding.py and melding.enc. Here’s the python file:

from Crypto.Cipher import AES
from base64 import b64decode
import json

key = "???"

with open("melding.enc", "rb") as f:
 try:
 data = json.loads(f.read())
 nonce = b64decode(data["nonce"])
 ciphertext = b64decode(data["ciphertext"])
 tag = b64decode(data["tag"])
 cipher = AES.new(key, AES.MODE_GCM, nonce = nonce)
 plaintext = cipher.decrypt_and_verify(ciphertext, tag)
 print("Dekryptert melding: " + plaintext.decode('utf-8'))
 except (ValueError, KeyError):
 print("Oisann, noe gikk galt!")

Solution

from Crypto.Cipher import AES
from Crypto.Util.number import long_to_bytes, bytes_to_long
from base64 import b64decode
import json

keys = [
 bytes.fromhex("980daad49738f76b80c8fafb0673ff1b"),
 bytes.fromhex("a3c5a5a81ebc62c6144a9dc1ae5cce11"),
 bytes.fromhex("fc78e6fee2138b798e1e51ed15e0a109")
]

key = long_to_bytes(bytes_to_long(keys[0]) ^ bytes_to_long(keys[1]) ^ bytes_to_long(keys[2]))

with open("melding.enc", "rb") as f:
 data = json.loads(f.read())
 nonce = b64decode(data["nonce"])
 ciphertext = b64decode(data["ciphertext"])
 tag = b64decode(data["tag"])
 cipher = AES.new(key, AES.MODE_GCM, nonce=nonce)
 plaintext = cipher.decrypt_and_verify(ciphertext, tag)
 print("Dekryptert melding: " + plaintext.decode('utf-8'))

Flag: NSM{9c7cac722d55da1dbfa13025d85efeed45e9ddea2796c0e5ea2fda81ea4de17d}

NPST 11. Mystifistisk pakke: cracking a ZIP

Mon, 11 Dec 2023 00:00:00 +0000

Task description

Heisann alle sammen!

Det kom et bud innom med en pakke som vi ikke klarer å finne ut av. Budet la igjen en post-it lapp med 02a5588f275984a2296d505067ec727ff3a27b860ebda01a82f408f7aa4cda96 på og pakken er vedlagt i meldingen.

- 📞 Sentralbordet

nism.zip

Notes

When uzipping the archive we get prompted for a password. The message on the post-it note is the password 02a5588f275984a2296d505067ec727ff3a27b860ebda01a82f408f7aa4cda96. Out we get hemmelighet_2.txt with the following contents:

Hemmelighet #2
a3c5a5a81ebc62c6144a9dc1ae5cce11

By talking with other players we can gather all the secrets:

NPST 10. Alvesortering

Sun, 10 Dec 2023 00:00:00 +0000

Task description

De strenge alvene har skrevet ned et julekodeord, men i den ivrige sorteringen av pakker har det skjedd en horribel feil og alt er blitt rot! Ordet har blitt borte i det som ser ut som et virrvarr av tilfeldig tekst! Nå trenger de hjelp til å gjenfinne ordet. De har null peiling på hvor langt ordet er. Kan du å gjenfinne ordet?

- Mellomleder

random_text.bin

Notes

Rot
Pakker
Julekodeord
Null
Sortering

When sorting the contents of the file by letter I find that there are only one opening curly brace and only one closing curly brace. They are too far apart to form a flag. Both of them come after a null byte though. The file contents look a lot like something encoded with base64.

NPST 09. Kronolokalisering: shadow geolocation OSINT

Sat, 09 Dec 2023 00:00:00 +0000

Task description

Gjennom et beslag har vi fått tak i et papirark. På den ene siden står det “Oppmøtested for den topphemmelige sydpolinfiltrasjonen 2023, rekognosering 23. november”. På den andre siden av arket er det et bilde. For å kunne hente inn overvåkingsbilder og identifisere hvem som har planlagt arrangementet trenger vi det nøyaktige tidspunktet bildet er tatt.

Send meg svar på denne eposten som KRIPOS{tidspunkt}, f.eks. KRIPOS{23:35}, rundet av til nærmeste fem minutter.

NPST 07. Alle gode ting er tre: small RSA exponent

Thu, 07 Dec 2023 00:00:00 +0000

Task description

Alveresepsjonen fant en mystisk lapp i postboksen til Nissens verksted i dag tidlig. Vanligvis er dette noe Ronny, Shahana og Ada fra alvdeling for kryptografi ville tatt seg av. Dessverre er alle tre bortreist på en viktig konferanse i San Francisco for å høre om den siste utviklingen innen eksponenter og modulær aritmetikk. Kan du steppe inn for dem og finne ut av hva denne beskjeden egentlig er for noe?

NPST 06. KAKER-kontroll: zero-width character stego

Wed, 06 Dec 2023 00:00:00 +0000

Task description

I en standard KAKER-kontroll (Kontroll Av Kommuniké med Eksport-Restriksjoner) har det blitt tatt en kopi av dette dokumentet. Vi syns det er snodig at akkurat denne personen har hatt med seg dokumentet siden personen har hatt anti-jul-holdninger tidligere, og vi vil derfor at du tar en nærmere kikk for å se etter uhumskheter.

- Tastefinger

PE‍PPERKAKER {
 POR‍SJONER {
 20 kaker
 }
 ‍TYPE ‍{
 julekake
 }
 INGREDIENSER {
 KAKEDEIG {
 2 ts ‍Pepper
 2 ts Malt ing‍efær
 0,5 ts Malt nellik
 3 dl Mørk siru‍p
 300 g Smør
 2 ts Malt kanel
 4 ts Natron
 2 stk. Egg
 300 g Sukker
 ca. 900 g Hvetemel
 }
 MELISGLASUR {
 ca. 250 g Melis
 1 stk. Eggehvite
 0,5 ts Sitronsaft
 }
 }
 OPPSKRIFT {
 STEG1 { Bland smør, siru‍p og sukker i en kjele. Varm opp til sukkeret er sm‍eltet. Tilsett nellik, ingefæ‍r, pepper og kanel, og rør godt sammen. }
 STEG2 { Ta ‍kjelen av platen og avkjøl bl‍andingen noe. Rør inn egg. }
 STEG3 { Ha i natron, og si‍kt inn mel. Rør alt sammen til ‍en jevn deig. Deigen skal væ‍re ganske myk og klissete, den vil bli mye hardere når den blir kald! }
 STEG4 { Hell deigen over i en bolle og dryss litt hvetemel på toppen. Dekk til med litt plastfolie og sett deigen kaldt noen timer, gjerne over natten. }
 STEG5 { Skjær løs et stykke av deigen. Plasser resten av deigen tilbake i kjøleskapet. ‍Elt deigen forsiktig. Tilsett litt me‍r mel om den virker for myk. }
 STEG6 { ‍Mel en flate, ‍og kjevle deigen ut til ca 3 mm tykkelse. Det er enklest når deigen er myk som plas‍tilina. Stikk ut pepperkakefigurer og flytt dem over på et ‍bakepapirkledd stekebrett. Samle restene av deigen og legg den kaldt. Skjær ut et n‍ytt stykke av ‍deigen og gjenta prosessen. Deigen blir vanskelig å jobbe med når den blir for varm, så da kan d‍en få hvile i kjøleskapet igjen. }
 STEG7 { Stek kakene midt i stekeovnen på 175 °C i ca. 10 minutter. Avkjø‍l kakene helt på rist. }
 STEG8 { Bland sammen mel‍is, eggehvite og sitronsaft til en tykk ‍glasur, og dekorer kaken‍e. }
 ‍}
}

oppskrift.txt

NPST 05. Muldvarpjakt: Overpass Turbo OSINT

Tue, 05 Dec 2023 00:00:00 +0000

Task description

Gjennom temmelig hemmelige innhentingsmetoder har vi fanget opp en melding om et nært forestående møte på Fastlands-Norge mellom en mistenkt kildefører som jobber for sydpolare tjenester og et ukjent objekt vi mistenker kan være en muldvarp.

For at våre spaningsalver skal settes i stand til å observere møtet og identifisere det ukjente objektet må vi vite hvor vi skal sende våre alver.

Vi prøvde å spørre OSINT-alvene våre, men de var travelt opptatt med å saumfare sosiale medier etter snille og slemme barn. De mumlet noe om at vi kunne fikse det selv med “turbo overgang”.

NPST 04. Pinneved: obfuscated Python

Mon, 04 Dec 2023 00:00:00 +0000

Task description

Alvebetjentene på Jule NISSEN sitt verksted våknet i dag til et fryktelig syn; Julenissens slede er sprengt i fillebiter. Vi har satt folk på saken for å finne ut av hvem som er ansvarlig for ødeleggelsen, men det er kritisk at sleden blir reparert slik at vi får testet den før Jule NISSEN skal levere pakkene.

Alvebetjentene har samlet vrakrestene, samt verktøyet de mistenker at sabotørene har brukt.

NPST 03. Redacted: light DOCX forensics

Sun, 03 Dec 2023 00:00:00 +0000

Task description

Det er krise! Filene på alvemaskinene har blitt kryptert, og vi har ingen backups tilgjengelig!

På nissens skrivebord fant vi det vedlagte brevet, sammen med en kryptert fil.

Det er ubeskrivelig viktig at vi får åpnet denne filen igjen umiddelbart, da Jule NISSEN ikke klarer å huske innholdet!

- Mellomleder

Mitt utpressingsbrev.docx

huskeliste.txt.enc

Key information

Key: dda2846b010a6185b5e76aca4144069f88dc7a6ba49bf128
IV: UtgangsVektor123
PenguinCoin address: 43hxBZLYr1
Suspicious: “Jule NISSEN”
Suspicious: Lapskaus$ == https://en.wikipedia.org/wiki/Lapsus%24

NPST 02. Scrambled: Rubik's cube

Sat, 02 Dec 2023 00:00:00 +0000

Task description

Over natten har det vært store utfordringer knyttet til en av maskinene i verkstedet. En serie feilproduserte leker har kommet på rullende bånd. Vi prøver å finne ut hva som har skjedd. Graver du ned i det her?

- Mellomleder

Bra, jeg videresender til fslaktern!

- Mellomleder

Fra: Tastefinger

Til: Mellomleder

Emne: FW: Scrambled

Vedlegg: oedelagte_leker_fix.png

Tror det var noe skitt på linsa da det forrige bildet ble tatt, så jeg har tatt et nytt et. Har lagt med som vedlegg.

NPST 01. Mobildetektiven: SMS cipher

Fri, 01 Dec 2023 00:00:00 +0000

Task description

Her får du den første oppgaven!

Under etterforskningen av hendelsen på jule-verkstedet har vi oppdaget noe rart. Et av meldingssystemene som sender varslinger til beredskapsvaktene for verkstedet har sendt en SMS til et ukjent nummer. Meldingen er dessverre helt uleselig for oss, så vi trenger dine mobildetektiv-egenskaper. Når du finner ut av det, send meg svar på formatet PST{ditt svar her}.
7-4 9-3 7-4 8-1 3-2 6-1 0-1
4-3 6-2 3-3 4-3 7-4 3-2 7-3
8-1 0-1 4-1 7-3 8-2 6-2 5-2
3-2 7-3 0-1 4-3 6-2 2-3 6-3
6-1 4-3 6-2 4-1
- Tastefinger

Diffie-Hellman key exchange

Mon, 27 Nov 2023 00:00:00 +0000

Textbook key exchange

from Crypto.Util.number import getPrime

q = getPrime(1024)
p = q * 2 + 1
g = 2

# Alice
## Private key
a = getPrime(1024)
## Public key
A = pow(g, a, p)
## Send A to Bob

# Bob
## Private key
b = getPrime(1024)
## Public key
B = pow(g, b, p)
## Shared secret
s_bob = pow(A, b, p)
## Send B to Alice

# Alice
## Shared secret
s_alice = pow(B, a, p)

print(s_alice == s_bob)
# True

Now both Alice and Bob each have the same shared secret without revealing private information with each other. Someone snooping on the conversation will not be able to know Alice’s or Bob’s private key or their shared secret without solving the discrete log problem. However, without authentication an active man-in-the-middle can still defeat security of the key exchange.

RSA many primes: phi for repeated factors

Mon, 27 Nov 2023 00:00:00 +0000

It may be possible to factor N only if it is composed of many small primes. Try factordb.com or SageMath. The rest is textbook RSA decryption.

Note: If one or more of the primes are used multiple times, creating phi is a little different.

# 2 identical
assert p_1 == p_2
phi = (p_1 - 1) * p_2

# 2 identical + 1
assert p_1 == p_2
assert p_1 != q
phi = (p_1 - 1) * p_2 * (q - 1)

# 2 identical + 2 identical
assert p_1 == p_2
assert q_1 == q_2
assert p_1 != q_2
phi = (p_1 - 1) * p_2 * (q_1 - 1) * q_2

# 3 identical + 1
assert p_1 == p_2 == p_3
assert p_1 != q
phi = (p_1 - 1) * p_2 * p_3 * (q - 1)

# 3 unique
assert p != q
assert q != r
assert r != p
phi = (p - 1) * (q - 1) * (r - 1)

sage: n = 11976883600073589517586036218890790941510903302507834100496110626215757528392961
....: 272580596919990757219201877397519125253192238833551591339671104797730056393143427756
....: 229551027083966190850752574521809608536089676704023152324023558801462867715411652018
....: 474769802470149363510965976397340718720150422144473075649693632965977205420453552963
....: 933180293039726746233450432370235938070597627874532971273788803263016780500807163358
....: 986835444739716122026356592032335015432128070225129224801935825954681606834247438072
....: 008219081805277470773777332672468660614435325028811403540470653684001003909843061184
....: 38875893373327473
sage: n.bit_length()
1994
sage: factor(n)
32843 * 33427 * 33457 * 33521 * 34259 * 34261 * 34499 * 34501 * 35449 * 35753 * 35809 * 35863 * 35897 * 36467 * 36913 * 36947 * 37309 * 37337 * 37783 * 38261 * 38317 * 38593 * 39089 * 40093 * 40127 * 40343 * 40583 * 40693 * 41141 * 41413 * 41617 * 41641 * 41879 * 41897 * 41959 * 42473 * 42487 * 42611 * 42899 * 43133 * 43201 * 43411 * 43691 * 43753^2 * 43933 * 44281 * 44371 * 44531 * 44543 * 45439 * 45697 * 46273 * 46511 * 46549^2 * 47143 * 47147 * 47657 * 48193 * 48271 * 48383 * 48677 * 49411 * 49433 * 49559 * 49711 * 49957 * 50147 * 50707 * 51043 * 51131 * 51199 * 51343 * 51473 * 51613 * 52103 * 52177^2 * 53147 * 55073 * 55469 * 55621 * 55987 * 56041 * 56131 * 56369 * 57073 * 57493 * 57653 * 57751 * 58231 * 58367 * 58451 * 58771 * 59273 * 59921 * 60041 * 60107 * 60251 * 60257 * 60917 * 61231 * 61379 * 61417 * 61583 * 61927 * 62131 * 62171 * 62219 * 62351 * 62417^2 * 62819 * 62851 * 63097 * 63127 * 63281 * 63577 * 63659 * 63949 * 64319 * 64853 * 64891 * 64951 * 65071 * 65119 * 65129

from Crypto.Util.number import long_to_bytes

c = 103847869308772286068350812608946161310048471780108687445447082897960791832563296440399688011904014800812944419812110339595664973140355119639332857682984542320294869246885417325791635542758894672211270946494867768942190945299117352702305720351501541399290674333440435028192034483858344585064329968092445674146382885907678900307486892007932359930351596070322801270549377672369927342419317710725943361630295447168927334941260538714263133325932882367847844419538306475046130479602452615695686956103997902100355329048134993935472176473443887710947012922903378270936640012798675413677156658065250066093898
n = 1197688360007358951758603621889079094151090330250783410049611062621575752839296127258059691999075721920187739751912525319223883355159133967110479773005639314342775622955102708396619085075257452180960853608967670402315232402355880146286771541165201847476980247014936351096597639734071872015042214447307564969363296597720542045355296393318029303972674623345043237023593807059762787453297127378880326301678050080716335898683544473971612202635659203233501543212807022512922480193582595468160683424743807200821908180527747077377733267246866061443532502881140354047065368400100390984306118438875893373327473
e = 65537

primes = [32843, 33427, 33457, 33521, 34259, 34261, 34499, 34501, 35449, 35753, 35809, 35863, 35897, 36467, 36913, 36947, 37309, 37337, 37783, 38261, 38317, 38593, 39089, 40093, 40127, 40343, 40583, 40693, 41141, 41413, 41617, 41641, 41879, 41897, 41959, 42473, 42487, 42611, 42899, 43133, 43201, 43411, 43691, 43753, 43753, 43933, 44281, 44371, 44531, 44543, 45439, 45697, 46273, 46511, 46549, 46549, 47143, 47147, 47657, 48193, 48271, 48383, 48677, 49411, 49433, 49559, 49711, 49957, 50147, 50707, 51043, 51131, 51199, 51343, 51473, 51613, 52103, 52177, 52177, 53147, 55073, 55469, 55621, 55987, 56041, 56131, 56369, 57073, 57493, 57653, 57751, 58231, 58367, 58451, 58771, 59273, 59921, 60041, 60107, 60251, 60257, 60917, 61231, 61379, 61417, 61583, 61927, 62131, 62171, 62219, 62351, 62417, 62417, 62819, 62851, 63097, 63127, 63281, 63577, 63659, 63949, 64319, 64853, 64891, 64951, 65071, 65119, 65129]

phi = 1
for i, p in enumerate(primes):
 if p in primes[i + 1:]:
 phi *= p
 else:
 phi *= p - 1

d = pow(e, -1, phi)
m = pow(c, d, n)
print(long_to_bytes(m))

RSA monoprime: when n = p

Mon, 27 Nov 2023 00:00:00 +0000

If only one prime is used, then n = p where p is the only prime and n is the public modulus. When sharing the public values, n, e, and c, we accidentally reveal our secret prime in n.

Euler phi is p - 1, and the rest is textbook RSA decryption.

c = ...
e = ...
n = ...

p = n
phi = p - 1

assert gcd(e, phi) == 1
d = pow(e, -1, phi)
m = pow(c, d, n)

print(long_to_bytes(m))

RSA small primes: factoring with FactorDB

Mon, 27 Nov 2023 00:00:00 +0000

The public modulus may be factored (integer factorization) either manually or with factordb.com to reveal the secret primes, p and q. The rest is textbook RSA decryption.

sage: N = 510143758735509025530880200653196460532653147
sage: N.bit_length()
149
sage: factor(N)
19704762736204164635843 * 25889363174021185185929

c = 210890089544322783718082700209558334811224995
n = 510143758735509025530880200653196460532653147
e = 65537
# ---
p = 19704762736204164635843
q = 25889363174021185185929
phi = (p - 1) * (q - 1)

d = pow(e, -1, phi)
m = pow(c, d, n)
print(long_to_bytes(m))

RSA: encryption and decryption

Mon, 27 Nov 2023 00:00:00 +0000

Encryption

# pip install pycryptodome
from Crypto.Util.number import bytes_to_long, getPrime

# Plaintext as bytes
pt = b"Some plaintext message to be encrypted"

# Converted to an integer (m)
m = bytes_to_long(pt)

# Get 1024-bit primes (p and q)
p = getPrime(1024)
q = getPrime(1024)

# Multiplying p and q gives us a 2048-bit public modulus (n)
n = p * q

# Public exponent (e)
# This is the 4th of Fermat's primes: https://en.wikipedia.org/wiki/Fermat_number
e = 65537

# Ciphertext (c) - `m` to the power of `e` modulo `n`
c = pow(m, e, n)

# The message (m) and the primes (p and q) are kept secret
# The public exponent (e), ciphertext (c) and public modulus (n) may be shared

Decryption

# Euler's totient (phi) - usually denoted as `φ(N)`
euler_phi = (p-1) * (q-1)

# Private key (d) - the modular inverse of `e`
# Requires that `e` and `euler_phi` are coprime
# If they are not coprime, `e` may not be invertible mod `d`
# `d` inverts `e` modulo `n`: `e * d ≡ 1 mod n` or simpler `(e * d) % n == 1`
assert gcd(e, euler_phi) == 1
d = pow(e, -1, euler_phi)

# The original message (m) can be recovered
m = pow(c, d, n)

In reality the message (m) should be padded. The padding alone can mitigate most of the weaknesses described below.

DREAM: sleepy vault, blind timing attack credential recovery

Fri, 11 Aug 2023 00:00:00 +0000

Challenge

I seem to have forgotten most of my credentials for the sleepy vault. All I remember is that my username starts with ;JG[e] and my password starts with 8~5. Can you help me recover my username and password? Remember: optimization is key!

Category: web
Difficulty: medium

I wrote this for DREAM in 2023.

The only thing you get is a login form. It is a blind challenge: the frontend reveals nothing about which part of the credentials are right, and there is no source to read. What you do get is response times.

UIUCTF: escaping a Vim jail (unintended)

Mon, 10 Jul 2023 00:00:00 +0000

Writeup for an unintended solution by fslaktern

vimjail1

Connect with socat file:$(tty),raw,echo=0 tcp:vimjail1.chal.uiuc.tf:1337 You may need to install socat.

Author: richard

We are given the following files:

Dockerfile

FROM ubuntu:22.04 as chroot

RUN apt-get update -y
RUN apt-get install -y vim

RUN /usr/sbin/useradd --no-create-home -u 1000 user

COPY flag.txt /
COPY entry.sh /home/user/
COPY vimrc /home/user/

FROM gcr.io/kctf-docker/challenge@sha256:d884e54146b71baf91603d5b73e563eaffc5a42d494b1e32341a5f76363060fb

COPY --from=chroot / /chroot

COPY nsjail.cfg /home/user/

# This is mostly boring kctf and nsjail setup. The important part to pay
# attention to is the "pty,sane" line.
CMD kctf_setup && \
 kctf_drop_privs \
 socat \
 TCP-LISTEN:1337,reuseaddr,fork \
 EXEC:"kctf_pow nsjail --config /home/user/nsjail.cfg -- /home/user/entry.sh",pty,sane

entry.sh

SpaceCTF: AES-CTR key reuse

Mon, 14 Mar 2022 00:00:00 +0000

Challenge

Difficulty: 3/5

Max points: 150

Description: Bessie is hiding something on the moonbase

Files

output.txt

6be9a7a25ad6a99cf9312f48666229e3b57130f3c91732ddfbf414efd92e96c36ea69c4a1f35158ed53fca5b1db2
4ce2b6e450cdf389d76312484c4072a68c752d8a963d3dffc7f506

aes.py

#!/usr/bin/env python3
from Crypto.Cipher import AES
from Crypto.Util import Counter
import os
 
 
key = os.urandom(16)


def encrypt(text):
 cipher = AES.new(key, AES.MODE_CTR, counter=Counter.new(128))
 ciphertext = cipher.encrypt(text)
 return ciphertext.hex()

msg = b"The quick brown fox jumps over the lazy dog..."
print(encrypt(msg))

with open('flag0.txt', 'rb') as flagFile:
 flag = flagFile.read().strip()
print(encrypt(flag))

Solution

AES CTR mode

AES CTR mode is vulnerable to key reuse. The decryption operation is just: ciphertext_1 xor key_stream = plaintext_1. This also means that ciphertext_1 xor plaintext_1 = key_stream and key_stream xor plaintext_1 = ciphertext_1. When we have the key stream, we can use it to decrypt the second ciphertext as well with ciphertext_2 xor key_stream = plaintext_2.

fslaktern var her

CTF resources and tools

Getting started

Resources

Practice

Web

Techniques

Cross-site scripting (XSS)

Tools

Port scanning

HTTP request tools

Tokens

Fuzzing

Websockets

Databases

Vulnerability scanning

Deserialization

Race conditions

Resources

Practice

Cryptography

Tools

Resources

Practice

Reverse engineering

Tools

Process and network monitoring

Linux / WSL

Windows

Debuggers

Sandboxes

Mobile

Decompilers and disassemblers

Java

.NET

Binary analysis

Emulators

Strings

Tracing

File type

Tool sets and pre-packaged systems

Resources

Practice

Forensics

Open source intelligence (OSINT)

Tools

Resources

Practice

Tools

Organizing information

Office documents

Network, USB, Bluetooth and other signals

Windows registry

Memory

Volatility 2

Filesystems

Files

Steganography

Images

Sound files

Other

Resources

Practice

Binary exploitation

Tools

Information about the binary file

Disassemblers

Debuggers

Decompilers

Tracing

Exploit development

LIBC archives

Finding ROP gadgets

Tools for automated exploitation

Other useful tools

Resources

Practice

Boot to root

Tools

General