root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

---

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

---

CTF: USC-CTF 2024

---

---

CHALLENGES-:

• Beginner
  • Colors
  • Weird Traffic
  • Irobots
• Web
  • Tommy’s Adventures
  • Tictactocket
• Forensics
  • Think_twice

---

Colors-:

---

• The challenge file contains this base64 encoded string.

- After I decoded it ,I got  base 16 encoded value which after decoding reveals the next string in binary.I got the flag after decoding the binary text.

```python3
#! /usr/bin/env python3
import base64

base64_encoded: str = base64.b64decode("MzAgMzEgMzAgMzAgMzAgMzAgMzEgMzEgMjAgMzAgMzEgMzAgMzEgMzEgMzAgMzAgMzEgMjAgMzAgMzEgMzAgMzAgMzAgMzAgMzEgMzAgMjAgMzAgMzEgMzAgMzAgMzEgMzEgMzEgMzEgMjAgMzAgMzEgMzAgMzEgMzAgMzAgMzEgMzAgMjAgMzAgMzEgMzAgMzAgMzAgMzEgMzEgMzEgMjAgMzAgMzEgMzEgMzEgMzEgMzAgMzEgMzEgMjAgMzAgMzEgMzEgMzEgMzAgMzEgMzAgMzAgMjAgMzAgMzEgMzAgMzEgMzAgMzAgMzEgMzAgMjAgMzAgMzAgMzEgMzEgMzAgMzAgMzAgMzAgMjAgMzAgMzEgMzEgMzAgMzEgMzAgMzEgMzAgMjAgMzAgMzEgMzEgMzAgMzAgMzAgMzAgMzEgMjAgMzAgMzEgMzEgMzAgMzEgMzEgMzEgMzAgMjAgMzAgMzEgMzEgMzEgMzAgMzAgMzEgMzEgMjAgMzAgMzEgMzAgMzEgMzEgMzEgMzEgMzEgMjAgMzAgMzEgMzEgMzAgMzEgMzEgMzAgMzAgMjAgMzAgMzEgMzEgMzAgMzEgMzEgMzEgMzEgMjAgMzAgMzEgMzEgMzEgMzAgMzEgMzEgMzAgMjAgMzAgMzEgMzEgMzAgMzAgMzEgMzAgMzEgMjAgMzAgMzEgMzAgMzEgMzEgMzEgMzEgMzEgMjAgMzAgMzEgMzAgMzAgMzAgMzAgMzEgMzEgMjAgMzAgMzAgMzEgMzEgMzAgMzEgMzAgMzAgMjAgMzAgMzEgMzEgMzEgMzAgMzAgMzEgMzAgMjAgMzAgMzEgMzEgMzAgMzAgMzEgMzAgMzAgMjAgMzAgMzEgMzEgMzAgMzEgMzAgMzAgMzEgMjAgMzAgMzEgMzEgMzAgMzEgMzEgMzEgMzAgMjAgMzAgMzEgMzEgMzAgMzAgMzAgMzAgMzEgMjAgMzAgMzEgMzEgMzAgMzEgMzEgMzAgMzAgMjAgMzAgMzEgMzAgMzEgMzEgMzEgMzEgMzEgMjAgMzAgMzEgMzAgMzAgMzAgMzAgMzAgMzAgMjAgMzAgMzEgMzEgMzAgMzEgMzEgMzEgMzAgMjAgMzAgMzEgMzEgMzAgMzAgMzEgMzAgMzAgMjAgMzAgMzEgMzAgMzEgMzEgMzEgMzEgMzEgMjAgMzAgMzEgMzAgMzAgMzAgMzEgMzEgMzEgMjAgMzAgMzAgMzEgMzEgMzAgMzAgMzAgMzAgMjAgMzAgMzEgMzEgMzAgMzEgMzEgMzAgMzAgMjAgMzAgMzEgMzEgMzAgMzAgMzEgMzAgMzAgMjAgMzAgMzEgMzEgMzEgMzEgMzEgMzAgMzE=")
print(f"[+] Base16: {base64_encoded.decode()}")
result: list =  base64_encoded.decode().split(" ")

def solve_base16(i: str):
    base2 = str(chr(int(i,16)))
    return base2
def solve_base2(i: str) -> str:
    return chr(int(i,2))

base2 = ''.join(solve_base16(str(i)) for i in result).split(' ')
print(f"[+] Base2: {base2}")
flag = ''.join(solve_base2(i) for i in base2)
print(flag)

• Flag-:CYBORG{tR0jans_love_C4rdinal_@nd_G0ld}

---

Weird Traffic

---

---

• The challenge requires analyzing a pcapng file. The required tool for this challenge is wireshark.
• Flag-:CYBORG{hping3-is-a-cool-tool}

---

Web: iRobots

---

---

• As the name implies, my first stop was the robots.txt.The flag’s path was disallowed in the robots.txt disallowed entry.

• Flag-:CYBORG{robots_txt_is_fun}

---

Tommy’s ArtAdventures

---

---

• The challenge’s secret key fo signing Flask’s session was given.This is a major vulnerability because flask session’s key is used to sign cookies for a flask web application.

• After checking the source code of the app, I noticed an endpoint /curate that gives the fla only to the admin user.

• I used flask-unsign to sign a cookie with user admin.

• Flag-:CYBORG{oce4n5_auth3N71ca7i0N}

---

Tictatocket

---

---

• This is a tictactoe game that applies websockets to transmit data.

• I discovered that players can play in the computer position if they spam clicks in the position the computer is about to place its square.

• Flag-:CYBORG{S3RVER_W45_0VERTRUST1NG}

---

Think_Twice

---

---

• The challenge file contains a png file metadata.png.
• I checked for the exifdata with exiftool and got a base6 encoded string.

• I double decoded it with base64 and got the flag.

• Flag-:Cyb0rg{McCarthy}

---

THANKS FOR READING !!!!

---