BCACTF WRITEUP

On-line
Format: JeopardyOfficial URL: http://www.bcactf.com/BCACTF is a beginner focused CTF made for middle and high schoolers. BCACTF is organized by the Cybersecurity Club at Bergen County Academies, and funded by the Investment Analysis Group at Bergen County Academies.

Schedule :: Sun, 09 June 2019, 09:30 IST — Sun, 16 June 2019, 09:30 IST

##challenge :: hello-world (trivia)

flag is in the description :: Input your first ever flag! The flag is bcactf{hello!}

flag :: bcactf{hello!}

##challenge :: net-cat (trivia)

flag can be obtained by executing command given in description.

command :: nc challenges.ctfd.io 30126

flag :: bcactf{5urf1n_7h3_n37c47_c2VydmVyc2lkZQ}

##challenge :: for-the-night-is-dark-1 (quest)

file starmap.bmp >> starmap.bmp: PC bitmap, Windows 3.x format, 63 x 63 x 24
cat starmap.bmp >> BMv/6(??▒@/��QZu9GIwVGdzByb0BSZt92YsV2d_57ra3hru0n13rif3h7/zyx.rollhr//:ptth%

reversing this part :: QZu9GIwVGdzByb0BSZt92YsV2d_57ra3hru0n13rif3h7/zyx.rollhr//:ptth

txt=”QZu9GIwVGdzByb0BSZt92YsV2d_57ra3hru0n13rif3h7/zyx.rollhr//:ptth”[::-1] print(txt)

gives :: http://rhllor.xyz/7h3fir31n0urh3ar75_d2VsY29tZSB0byBzdGVwIG9uZQ flag :: bcactf{gu1d3d_8y_574r5_QmVnaW5uaW5ncw}

##challenge :: for-the-night-is-dark-2

stage 2 url :: 

http://rhllor.xyz/5h0wu57ru7h4nDF4l53n355_TG9yZCBvZiBMaWdodCwgZ2l2ZSB1cyB3aXNkb20

inspection gives stage2.js file containing md5 hash 3758002ab24653af8d550c0c50473098,

$("#target").submit(function( event ) {
   var hash = md5($("#secret").val())
   if (hash == "3758002ab24653af8d550c0c50473098") {
       var encode = "ЕߞžÏ½›æ•˜¦ ÐÞÙ֩û¤× úªîÈ©¼×ÐÖ˘է£¢Íç«ÖÉ̱È՞ÒßÊÕÅ"
     var newstr = ""
     var key = $("#secret").val()
     for (var i = 0; i < encode.length; i++) {
         newstr += String.fromCharCode(encode.charCodeAt(i) - key.charCodeAt(i%key.length))
     }
       window.location = "/f" + newstr
   }                                                                                                                            $("#secret").val("")
   event.preventDefault();
 });

reversing md5 hashing for 3758002ab24653af8d550c0c50473098 gives “darknight”.

flag after submission :: bcactf{7h37ru7h15411w3h4v3_dGhlIGxpZ2h0IGluIG91ciBleWVz}

##challenge :: tupperware

Challenge description :: Took my lunch to school in a Tupperware (now with patented TupperSRF™ plastic!) and part of it got stained with a flag. k tells you where.

The “k” file provided in challenge had googology words for a numerical value, This online tool converts the decimal values given to the system into graph like interpretation. Once the words are converted into numeral values those goes into the decimal(k) input which reveals the flag. Also, the *illion words can be ignored as only the words like : “two hundered and two billion” changes into “202” here we can ignore “billion”.

Challenge associated files can be accessed here. “one.txt” contains numeral convertion of words.

bcactf{a11_0ccur}