PicoCTF 2019 Part 2

This flag gives a weird Text File that has the flag hidden inside. At first glimpse, without downloading the file, I figure it must be hidden as a txt file, but it is another file type. After downloading the file, I use the file command to read the kind of file it is. Upon reading the output, I notice that flag.txt is a PNG image file, so I changed the extension to png and used eye of gnome to view the png file and get the flag.

Flag = picoCTF{now_you_know_about_extensions}

First Grep
The title of this challenge gives an obvious hint as to what the command we are going to use is. Grep is going to be piped into the reading the file to find an expression that is being passed. I am going to use the cat command to read the file, then pipe grep and search the file for anything that begins with pico. So the command would look like this “cat file | grep pico”. Which gives the flag.

Flag = picoCTF{grep_is_good_to_find_things_eda8911c}

In this challenge, we are being challenged to use Netcat to comment to the shell server on port 32225 to get the flag. Netcat is used to read and write to TCP and UDP listening ports. When using the command, I am given the correct flag.

Flag= picoCTF{nEtCat_Mast3ry_b1d25ece}

This challenge required me to connect to the shell server using SSH and then to run a program. The knowledge necessary to run this challenge is how to run a program on a Linux environment. First, I connected using ssh to the shell server. Then I used the listing command ls to view the files in the directory. I noticed that a file named run_this is in the directory, so I ran the program using the command “./run_this.” Running that command returned the flag.

Flag = picoCTF{g3t_r3adY_2_r3v3r53}

This challenge required me to find a site that is not allowed to be seen by web scrapers. This challenge was named aptly for the type of file we are looking. When someone does not want google or other scrapers to find a site they may be hosting on their servers they use a file called robots.txt. This file is typically found by inputting the directory of the website and appending robots.txt at the end. I tried this and was given the robots.txt file. From there, we can view the file that is not allowed. As seen in the picture below, a file named 0194a.html is being disallowed.

When going to the file in question, the flag is seen.

Flag = picoCTF{calculating_Mach1n3s_0194a}

So Meta
In this challenge, we are given an image file that contains the flag. According to the name of the challenge, it is safe to assume that the flag is hidden in the metadata. I used a tool called exfiltool to extract the metadata out of the image file, and from there was able to see the flag under the artist’s header.

Flag = picoCTF{s0_m3ta_dc38ce45}

Strings it
In this file, we are given a program that has the flag hidden inside. The object is not to run the file, but to find it in the source code. Because the challenge is called strings it, I assume that I must have to use the strings command to find the data. The strings command shows the human-readable content within a file. What I decide to do is use strings to copy the information to another file that I can use grep. I use the strings command and the > operator to move all human-readable characters to a text document. This allows me to use grep to read anything that starts with pico from the text file.

Flag = picoCTF{5tRIng5_1T_d5b86184}

Vault Door Training
This challenge gives us a java program that is hiding the password. The java file is supposed to be used to determine if the user has input the correct password. If they have not, they are denied access. The password is hardcoded into the program, and the program is attempting to determine if the user input matches the hardcoded password. For this file, it is simple, read the source code and find the hardcoded password.

Flag = picoCTF{w4rm1ng_Up_w1tH_jAv4_3b50073Bc12}

This challenge is very similar to the vault door Training challenge; however, the programmer thinks they have hidden the password much better in the program. They have used the java charAt() command to hid the password. The charAt() command specifies the location of the character. If I wanted to construct the word pizza and I were to use the function charAt() with a parameter of 0, charAt(0) == ‘p’ && charAt(1) = ‘I’ and so forth I could spell out pizza. The developer has tried to use these out of order. The first thing I did was I used grep to find all of the lines that start with password.charAt. Then moved that to a file called vault.txt.

Next, I want to cut the file so that I can sort it. I use the bash command cut to cut out anything before the opening parenthesis.

Next. I use the bash command sort to sort the contents by number, and I have to write out the flag

Flag = picoCTF{d35cr4mbl3_tH3_cH4r4cT3r5_03f841}

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s