{"id":727,"date":"2022-10-23T20:44:16","date_gmt":"2022-10-23T11:44:16","guid":{"rendered":"https:\/\/emeth.jp\/diary\/?p=727"},"modified":"2024-08-10T14:38:57","modified_gmt":"2024-08-10T05:38:57","slug":"tsukuctf-2022-writeup","status":"publish","type":"post","link":"https:\/\/emeth.jp\/diary\/2022\/10\/tsukuctf-2022-writeup\/","title":{"rendered":"TsukuCTF 2022 writeup"},"content":{"rendered":"\n

OSINT\u697d\u3057\u304b\u3063\u305f\uff08\u305f\u3060\u3057\u65e5\u672c\u8a9e\u306b\u9650\u308b\uff09\u3002\u3042\u3068Google\u30ec\u30f3\u30ba\u6709\u80fd\u3059\u304e\u308b\u3002<\/p>\n\n\n\n

\"\"<\/div>
tsukuctf.sechack365.com<\/div><\/div>
\"\"<\/figure>
TsukuCTF 2022<\/div>
https:\/\/tsukuctf.sechack365.com<\/strike><\/div><\/div>
<\/div><\/div><\/div><\/div><\/div>\n\n\n\n\n\n\n\n

Attack of Tsukushi [100pt]<\/h2>\n\n\n\n

\u30ea\u30f4\u30a1\u30a4\u5175\u9577\u306e\u9285\u50cf\u304c\u51fa\u3066\u304f\u308b\u306e\u3067\u30b0\u30b0\u3063\u3066\u8a2d\u7f6e\u5834\u6240\u304c\u65e5\u7530\u99c5\u3068\u308f\u304b\u308b\u3002\u90f5\u4fbf\u756a\u53f7\u306f877-0013\u3002<\/p>\n\n\n\n

Flag: TsukuCTF22{8770013}<\/code><\/p>\n\n\n\n

Money [108pt]<\/h2>\n\n\n\n

Google\u30ec\u30f3\u30ba\u3067\u691c\u7d22\u3057\u305f\u3089\u91d1\u95a3\u5bfa\uff08\u3012603-8361\uff09\u3068\u51fa\u305f\u3002<\/p>\n\n\n\n

Flag: TsukuCTF22{6038361}<\/code><\/p>\n\n\n\n

FlyMeToTheTsukushi [218pt]<\/h2>\n\n\n\n

\u30ac\u30e9\u30b9\u306e\u53cd\u5c04\u306b\u300cTAKENOYA\u300d\u3068\u3044\u3046\u6587\u5b57\u304c\u898b\u3048\u308b\u306e\u3067\u300cTAKENOYA \u7a7a\u6e2f\u300d\u3067\u691c\u7d22\u3059\u308b\u3068\u798f\u5ca1\u7a7a\u6e2f\u306b\u300c\u7af9\u4e43\u5c4b \u798f\u5ca1\u7a7a\u6e2f\u5e97\u300d\u304c\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002<\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

Flag: TsukuCTF22{\u798f\u5ca1}<\/code><\/p>\n\n\n\n

inuyama082 [302pt]<\/h2>\n\n\n\n

\u300c\u72ac\u5c71 \u62b9\u8336\u300d\u3067\u753b\u50cf\u691c\u7d22\u3057\u3066\u4f3c\u305f\u30c7\u30b6\u30a4\u30f3\u306e\u3082\u306e\u3092\u63a2\u3059\u3068\u300c\u8336\u83d3\u3088\u3042\u3051\u3084\u300d\u306e\u3082\u306e\u3068\u308f\u304b\u308b\u3002
\u516c\u5f0f\u306e\u30e1\u30cb\u30e5\u30fc\u30da\u30fc\u30b8\u3092\u898b\u308b\u3068\u30e1\u30cb\u30e5\u30fc\u540d\u304c\u300c\u548c\u30c1\u30fc\u30ba\u30b1\u30fc\u30ad ver.\u714e\u8336\u30d1\u30a6\u30c0\u30fc\u300d\u3068\u308f\u304b\u308b\u3002<\/p>\n\n\n\n

\"\"<\/div>
\u72ac\u5c71\u3088\u3042\u3051\u3084\u3000inuyama yoakeya<\/div><\/div>
\"\"<\/figure>
caf\u00e9 menu - \u30ab\u30d5\u30a7\u30e1\u30cb\u30e5\u30fc<\/div>
https:\/\/www.yoakeya1916.com\/menu-\u30e1\u30cb\u30e5\u30fc\/caf\u00e9-menu-\u30ab\u30d5\u30a7\u30e1\u30cb\u30e5\u30fc\/<\/div>
\u5e97\u5185\u306e\u30e1\u30cb\u30e5\u30fc\u3067\u3059(\u5e97\u5185\u98f2\u98df)\u3002<\/div><\/div>
<\/div><\/div><\/a><\/div><\/div>\n\n\n\n

Flag: TsukuCTF22{\u548c\u30c1\u30fc\u30ba\u30b1\u30fc\u30ad ver.\u714e\u8336\u30d1\u30a6\u30c0\u30fc}<\/code><\/p>\n\n\n\n

sky [375pt]<\/h2>\n\n\n\n

\u5ea7\u5e2d\u306e\u300cCentX\u300d\u304b\u3089\u540d\u53e4\u5c4b\u9244\u9053\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002
\u8eca\u4e21\u306e\u96f0\u56f2\u6c17\u304b\u3089\u7279\u6025\u5217\u8eca\u3060\u3068\u601d\u308f\u308c\u3001\u8abf\u3079\u308b\u3068\u30df\u30e5\u30fc\u30b9\u30ab\u30a4\u3068\u3044\u3046\u306e\u304c\u3042\u308b\uff08\u554f\u984c\u540d\u3068\u3082\u7b26\u5408\u3059\u308b\uff09\u3002
\u5199\u771f\u5de6\u4e0a\u306b\u6848\u5185\u8868\u793a\u304c\u53cd\u5c04\u3057\u3066\u304a\u308a\u3001\u3053\u3053\u304b\u3089\u8abf\u67fb\u3059\u308b\u3002<\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

\u8868\u793a\u8a00\u8a9e\u306f\u304a\u305d\u3089\u304f\u82f1\u8a9e\u3002
YouTube\u3067\u30df\u30e5\u30fc\u30b9\u30ab\u30a4\u306e\u8eca\u5185\u52d5\u753b\u3092\u63a2\u3057\u3066\u898b\u308b\u3068\u82f1\u8a9e\u306e\u6848\u5185\u8868\u793a\u306f\u3053\u3093\u306a\u611f\u3058\u3067\u4e0a\u90e8\u306b\u884c\u5148\u3001\u4e2d\u592e\u306b\u6b21\u306e\u99c5\u8868\u793a\u3068\u306a\u3063\u3066\u3044\u308b\u3002<\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n

\u6b21\u306e\u99c5\u540d\u304c\u9577\u3044\u306e\u3067\u540d\u9244\u3007\u3007\u3068\u63a8\u6e2c\u3002
\u6b21\u306e\u99c5\u306e\u8def\u7dda\u30ab\u30e9\u30fc\uff08\uff1f\uff09\u306f\u8d64\u3001\u884c\u5148\uff08\u6848\u5185\u8868\u793a\u4e0a\u90e8\uff09\u306e\u30ab\u30e9\u30fc\u306f\u7dd1\u3002
\u540d\u53e4\u5c4b\u9244\u9053\u306e\u8def\u7dda\u60c5\u5831<\/a>\u3068\u306b\u3089\u3081\u3063\u3053\u3057\u3066\u3001\u8d64\uff08\u540d\u53e4\u5c4b\u672c\u7dda\uff09\u304b\u3089\u7dd1\uff08\u72ac\u5c71\u7dda or \u5e83\u898b\u7dda\uff09\u306b\u5411\u304b\u3046\u30df\u30e5\u30fc\u30b9\u30ab\u30a4\u306e\u505c\u8eca\u99c5\u3067\u540d\u9244\u3007\u3007\u306f\u540d\u9244\u540d\u53e4\u5c4b\u3060\u3051\u3068\u5224\u660e\u3002<\/p>\n\n\n\n

Flag: TsukuCTF22{\u540d\u9244\u540d\u53e4\u5c4b}<\/code><\/p>\n\n\n\n

\u304a\u307e\u3051\u3002
sky.jpg\u3092exiftool\u306b\u304b\u3051\u308b\u3068XP Comment\u306bBase64\u30a8\u30f3\u30b3\u30fc\u30c9\u3057\u305f\u30c7\u30fc\u30bf\u304c\u51fa\u3066\u304f\u308b\u3002<\/p>\n\n\n\n

$ exiftool sky.jpg\nExifTool Version Number         : 10.80\nFile Name                       : sky.jpg\nDirectory                       : .\nFile Size                       : 4.4 MB\nFile Modification Date\/Time     : 2022:10:22 15:07:33+09:00\nFile Access Date\/Time           : 2022:10:22 15:07:35+09:00\nFile Inode Change Date\/Time     : 2022:10:22 15:07:33+09:00\nFile Permissions                : rwxrwxrwx\nFile Type                       : JPEG\nFile Type Extension             : jpg\nMIME Type                       : image\/jpeg\nExif Byte Order                 : Big-endian (Motorola, MM)\nXP Comment                      : aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g\/dj1QbUVweC1Zd3Iydw==<\/mark>\nPadding                         : (Binary data 2060 bytes, use -b option to extract)\nImage Width                     : 4000\nImage Height                    : 2250\nEncoding Process                : Progressive DCT, Huffman coding\nBits Per Sample                 : 8\nColor Components                : 3\nY Cb Cr Sub Sampling            : YCbCr4:4:4 (1 1)\nImage Size                      : 4000x2250\nMegapixels                      : 9.0<\/pre>\n\n\n\n
\u30c7\u30b3\u30fc\u30c9\u3059\u308b\u3068YouTube\u306eURL\u304c\u51fa\u3066\u304f\u308b\u3002\u65e5\u672c\u7248Rick Roll\u3002<\/p>\n\n\n\n
\"\"<\/div>
YouTube<\/div><\/div>
\"\"<\/figure>
\u9234\u6728\u96c5\u4e4b - \u9055\u3046\u3001\u305d\u3046\u3058\u3083\u306a\u3044 \/ THE FIRST TAKE<\/div>
https:\/\/www.youtube.com\/watch?v=PmEpx-Ywr2w<\/div>
\u300cTHE FIRST TAKE\u300d\u306f\u3001\u4e00\u767a\u64ae\u308a\u306e\u30d1\u30d5\u30a9\u30fc\u30de\u30f3\u30b9\u3092\u9bae\u660e\u306b\u5207\u308a\u53d6\u308bYouTube\u30c1\u30e3\u30f3\u30cd\u30eb\u3002 ONE TAKE ONLY, ONE LIFE ONLY. \u4e00\u767a\u64ae\u308a\u3067\u3001\u97f3\u697d\u3068\u5411\u304d\u5408\u3046\u3002\u7b2c226\u56de\u306f\u3001\u30e9\u30f4\u30bd\u30f3\u30b0\u306e\u738b\u69d8\u3068\u3057\u3066\u4e0d\u52d5\u306e\u5730\u4f4d\u3092\u7bc9\u304f\u9234\u6728\u96c5\u4e4b\u304c\u518d\u767b\u5834\u3002\u62ab\u9732\u3059\u308b\u66f2\u306f1994\u5e74\u306b\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u4ee3\u8868\u66f2\u306e1\u3064\u3067\u3001...<\/div><\/div>
<\/div><\/div><\/a><\/div><\/div>\n\n\n\n
station [382pt]<\/h2>\n\n\n\n
\u300c\u6771\u8c4a\u7dda\u300d\u304b\u3089\u672d\u5e4c\u5e02\u55b6\u5730\u4e0b\u9244\u3068\u308f\u304b\u308b\u3002
\u300c\u3007\u5317\u7dda \u6771\u8c4a\u7dda\u300d\u3068\u3042\u308b\u3053\u3068\u304b\u3089\u3044\u307e\u3044\u308b\u8def\u7dda\u306f\u6b8b\u308a\u306e\u6771\u897f\u7dda\u3068\u308f\u304b\u308b\u3002
\u6771\u8c4a\u7dda\u306e\u67f1\u306e\u6848\u5185\u8868\u793a\u306f\u4ee5\u4e0b\u306e\u5199\u771f\u306e\u3088\u3046\u306b\u306a\u3063\u3066\u3044\u308b\u3002<\/p>\n\n\n
\n
\"\"\/
\u5927\u901a\u99c5\u306e\u30b5\u30a4\u30f3\u304c\u66f4\u65b0\u3055\u308c\u307e\u3057\u305f 1 – \u3082\u307f\u3058\u306e\u7814\u7a76\u30ce\u30fc\u30c8 \u3088\u308a<\/figcaption><\/figure>\n<\/div>\n\n\n
\"\"<\/div>
\u3082\u307f\u3058\u306e\u7814\u7a76\u30ce\u30fc\u30c8<\/div><\/div>
\"\"<\/figure>
\u5927\u901a\u99c5\u306e\u30b5\u30a4\u30f3\u304c\u66f4\u65b0\u3055\u308c\u307e\u3057\u305f 1 - \u3082\u307f\u3058\u306e\u7814\u7a76\u30ce\u30fc\u30c8<\/div>
https:\/\/momiji-3539.hatenablog.com\/entry\/2020\/03\/13\/110910<\/div>
\u3064\u3044\u306b\u5927\u901a\u99c5\u30b3\u30f3\u30b3\u30fc\u30b9\u306b\u300c\u65b0\u30b4\u300d\u304c \u6628\u65e5\uff083\/10\uff09\u3088\u308a\u3001\u5927\u901a\u99c5\u306e\u6771\u897f\u7dda\u30db\u30fc\u30e0\u306e\u58c1\u9762\u3001\u67f1\u306b\u8a2d\u7f6e\u3055\u308c\u3066\u3044\u308b\u30b5\u30a4\u30f3\u304c\u66f4\u65b0\u3055\u308c\u59cb\u3081\u307e\u3057\u305f\u3002\u4eca\u65e5\uff083\/11\uff09\u5348\u5f8c\u306e\u6642\u70b9\u3067\u3001\u6771\u897f\u7dda\u30db\u30fc\u30e0\u306e\u5168\u3066\u3001\u5357\u5317\u7dda\u30db\u30fc\u30e0\u306e\u534a\u5206\u307b\u3069\u3001\u5357\u5317\u7dda\u30db\u30fc\u30e0\u4e2d\u592e\u306e\u9023\u7d61\u901a\u8def\u306e\u4e00\u90e8\u306e\u30b5\u30a4\u30f3\u304c\u4ea4\u63db\u3055\u308c\u3066\u3044\u307e\u3059\u3002 \u6628\u5e741\u6708\u3054\u308d\u3001\u3059\u3059\u304d\u306e\u99c5\u306b\u521d\u3081\u3066\u767b\u5834\u3057\u305f\u300c\u65b0\u30b4\u300d\u3092\u4f7f\u7528\u3057\u3001\u307b\u3068\u3093\u3069\u306e\u30b5\u30a4\u30f3\u306b\u56db\u30f6\u56fd\u8a9e\u8868\u8a18\u3092\u53d6\u308a\u5165\u308c\u305f\u73fe\u884c\u306e\u30b5\u30a4\u30f3\u3002\u305d\u308c\u304c\u3044\u3088\u3044\u3088\u5927\u901a\u99c5\u306b\u3082\u672c\u683c\u7684\u306b\u3084\u3063\u3066\u304d\u305f\u306e\u3067\u3059\u3002 \u672d\u5e4c\u5e02\u4ea4\u901a\u4e8b\u696d\u7d4c\u55b6\u8a08\u753b www.city.sapporo.jp \u672d\u5e4c\u5e02\u3067\u306f\u3001\u5730\u4e0b\u9244\u30fb\u8def\u9762\u96fb\u8eca\u306e\u8a08...<\/div><\/div>
<\/div><\/div><\/a><\/div><\/div>\n\n\n\n
\u3053\u306e\u5199\u771f\u3092\u53c2\u8003\u306b\u3059\u308b\u3068\u3001\u9ec4\u8272\u5e2f\u306e\u90e8\u5206\u304c\u73fe\u5728\u306e\u99c5\u3002
\u300c\u3007\u5317\u7dda \u6771\u8c4a\u7dda\u300d\u3068\u66f8\u3044\u3066\u3042\u308b\u6bb5\u304c\u5927\u901a\u99c5\u3001\u305d\u306e\u4e0b\u304c\u30d0\u30b9\u30bb\u30f3\u30bf\u30fc\u524d\u99c5\u3068\u63a8\u6e2c\u3067\u304d\u308b\u306e\u3067\u3001\u4eca\u3044\u308b\u99c5\u306f\u897f11\u4e01\u76ee\u99c5\u3002<\/p>\n\n\n\n
Flag: TsukuCTF22{\u897f11\u4e01\u76ee}<\/code><\/p>\n\n\n\n
Where [406pt]<\/h2>\n\n\n\n
IKEA\u3001\u30de\u30eb\u30a4\u3001\u897f\u6b66\u3042\u305f\u308a\u304c\u5199\u771f\u306b\u898b\u3048\u308b\u3002
\u5e97\u8217\u6570\u306e\u5c11\u306a\u3044IKEA\u3092\u8ef8\u306b\u5019\u88dc\u3092\u8abf\u3079\u3066\u3001\u6e0b\u8c37\u306e\u8857\u4e26\u307f\u3068\u308f\u304b\u308b\u3002
\u4f4d\u7f6e\u95a2\u4fc2\u304b\u3089\u64ae\u5f71\u5834\u6240\u3092\u63a2\u308b\u3068\u30d1\u30eb\u30b3\u304c\u3042\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
Wikipedia\u3067\u30d1\u30eb\u30b3\u306e\u958b\u696d\u65e5\u304c1973\/06\/14\u3068\u78ba\u8a8d\u3002<\/p>\n\n\n\n
Flag: TsukuCTF22{1973\/06\/14}<\/code><\/p>\n\n\n\n
Bringer_of_happiness [446pt]<\/h2>\n\n\n\n
Google\u30ec\u30f3\u30ba\u3067\u8abf\u3079\u308b\u3068\u8eca\u4f53\u306e\u8272\u3068\u9f3b\u306e\u30de\u30fc\u30af\uff08\u30d8\u30c3\u30c9\u30de\u30fc\u30af\uff1f\uff09\u304c\u5cf6\u539f\u9244\u9053\u306e\u3082\u306e\u3068\u540c\u3058\u3068\u5224\u660e\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
\u5cf6\u539f\u9244\u9053\u306e\u30b5\u30a4\u30c8<\/a>\u3067\u99c5\u306e\u5916\u89b3\u304c\u898b\u3089\u308c\u308b\u306e\u3067\u898b\u3066\u3044\u304f\u3068\u5cf6\u539f\u6e2f\u99c5<\/a>\u3068\u5224\u660e\u3002
\u3042\u3068\u306fGoogle\u30de\u30c3\u30d7\u4e0a\u3067\u64ae\u5f71\u5834\u6240\u3063\u307d\u3044\u4f4d\u7f6e\u3092\u63a2\u3057\u3066\u5ea7\u6a19\u3092\u30b2\u30c3\u30c8\u3059\u308b\u3002<\/p>\n\n\n\n
Flag: TsukuCTF22{32.7691_130.3706}<\/code><\/p>\n\n\n\n
Desk [454pt]<\/h2>\n\n\n\n
\u673a\u306b\u7f6e\u3044\u3066\u3042\u308b\u66f8\u985e\u306b\u898b\u3048\u3066\u3044\u308b\u306e\u306f\u6c96\u7e04\u672c\u5cf6\u3002
\u300c\u3007\u3007\u306e\u30c7\u30b9\u30af\u300d\u3068\u4f55\u304b\u306e\u4f5c\u4e2d\u306e\u518d\u73fe\u307f\u305f\u3044\u306a\u611f\u3058\u3060\u3063\u305f\u306e\u3067\u300c\u6c96\u7e04 \u8056\u5730 \u30c7\u30b9\u30af\u300d\u3067\u8abf\u3079\u305f\u3089\u51fa\u3066\u304d\u305f\u3002<\/p>\n\n\n\n
\"\"<\/div>
\u30de\u30cb\u30a2\u306a\u30d0\u30b9\u30b3\u30ec\u5e97<\/div><\/div>
\"\"<\/figure>
\u672c\u5f53\u306b\u3042\u3063\u305f\u3010\u4e45\u9ad8 \u590f\u51db\u3011\u306e\u30c7\u30b9\u30af\u3084\u540d\u523a\uff01\u7b2c5\u8a71\u306e\u8056\u5730\u5de1\u793c\u3042\u308a\uff5c\u767d\u3044\u7802\u306e<\/div>
https:\/\/basukore.com\/okinawa-0005\/<\/div>
\u672c\u5f53\u306b\u5b58\u5728\u3057\u305f\uff01\u590f\u51db\u3061\u3083\u3093\u306e\u30c7\u30b9\u30af \u30fb\u4eca\u56de\u306f\u3001\u767d\u3044\u7802\u306e\u30a2\u30af\u30a2\u30c8\u30fc\u30d7\u3010\u4e45\u9ad8 \u590f\u51db\u3011\u304c\u52d9\u3081\u3066\u3044\u305f\u5357\u57ce\u5e02\u89b3\u5149\u5354\u4f1a\u306b\u884c\u3063\u3066\u304d\u307e\u3057\u305f\uff01 \u9053\u4e2d\u3067\u8056\u5730\u5de1\u793c\u306a\u3069\u3082\u3057\u305f\u306e\u3067\u304a\u697d\u3057\u307f\u306b\u266a \u7279\u5225\u306a\u30d7\u30ec\u30bc\u30f3\u30c8\u3092\u9802\u3044\u305f\u308a\u3001\u7b49\u8eab\u5927\u3007\u3007\u3007\u3068\u8a18\u5ff5\u64ae\u5f71\u3092 ...<\/div><\/div>
<\/div><\/div><\/a><\/div><\/div>\n\n\n\n
\u3053\u306e\u673a\u304c\u3042\u308b\u306e\u306f\u5357\u57ce\u5e02\u89b3\u5149\u5354\u4f1a\uff08\u3012901-1511\uff09\u3068\u308f\u304b\u308b\u3002<\/p>\n\n\n\n
Flag: TsukuCTF22{9011511}<\/code><\/p>\n\n\n\n
PaperJack [475pt]<\/h2>\n\n\n\n
\u300c\u597d\u304d\u306a\u30b2\u30fc\u30e0\u3068\u65b0\u805e\u304c\u30b3\u30e9\u30dc\u3057\u305f\u3068\u304d\u306e\u5e83\u544a\u300d\u3067FGO\u3057\u304b\u6d6e\u304b\u3070\u306a\u304b\u3063\u305f\u306e\u3067\u516c\u5f0f\u30b5\u30a4\u30c8\u3067\u63a2\u3059\u3068\u548c\u6b4c\u5c71\u770c\u306e\u3084\u3064\u3068\u69cb\u56f3\u304c\u540c\u3058\u3002<\/p>\n\n\n\n
\"\"<\/div>
5th.fate-go.jp<\/div><\/div>
\"\"<\/figure>
Fate\/Grand Order 5\u5468\u5e74\u8a18\u5ff5\u5e83\u544a under the same sky<\/div>
https:\/\/5th.fate-go.jp<\/div>
\u3042\u306a\u305f\u304c\u751f\u304d\u308b\u3001\u3053\u306e\u4e16\u754c\u306b\u3002<\/div><\/div>
<\/div><\/div><\/a><\/div><\/div>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
\u64ae\u5f71\u5834\u6240\u306f\u9053\u6210\u5bfa\u306a\u306e\u3067\u90f5\u4fbf\u756a\u53f7\u3092\u8abf\u3079\u3066649-1331\u3068\u308f\u304b\u308b\u3002<\/p>\n\n\n\n
Flag: TsukuCTF22{6491331}<\/code><\/p>\n\n\n\n
Robot [490pt]<\/h2>\n\n\n\n
\u53f3\u306e\u30dd\u30b9\u30bf\u30fc\u306e\u6587\u5b57\u306e\u982d2\u6587\u5b57\u3092Google\u30ec\u30f3\u30ba\u306b\u304b\u3051\u305f\u3089”\u534e\u5357\u7406\u5de5\u5927\u5b66”\u3068\u51fa\u3066\u304d\u305f\u306e\u3067\u82f1\u8a9e\u8868\u8a18\u3092\u5165\u308c\u3066\u307f\u305f\u3089\u6b63\u89e3\u3060\u3063\u305f\u3002<\/p>\n\n\n\n
Flag: TsukuCTF22{South China University of Technology}<\/code><\/p>\n\n\n\n
Flash [494pt]<\/h2>\n\n\n\n
binwalk\u3067\u898b\u308b\u3068ESP32\u306e\u30d5\u30e9\u30c3\u30b7\u30e5\u3089\u3057\u3044\u3053\u3068\u304c\u308f\u304b\u308b\u3002<\/p>\n\n\n\n
$ binwalk Flash.bin\n\nDECIMAL       HEXADECIMAL     DESCRIPTION\n--------------------------------------------------------------------------------\n4196          0x1064          Unix path: \/Users\/ficeto\/Desktop\/ESP32<\/mark>\/ESP32\/esp-idf-public\/components\/bootloader_support\/src\/bootloader_init.c\n4436          0x1154          Unix path: \/Users\/ficeto\/Desktop\/ESP32\/ESP32\/esp-idf-public\/components\/bootloader_support\/src\/bootloader_random.c\nidf-public\/components\/heap\/multi_heap_poisoning.c\n(\u4ee5\u4e0b\u7565)<\/pre>\n\n\n\n
ESP32\u306e\u30a4\u30e1\u30fc\u30b8\u306e\u89e3\u6790\u306b\u306fesp32_image_parser<\/code>\u3092\u4f7f\u3063\u305f\u3002<\/p>\n\n\n\n
\"\"<\/div>
GitHub<\/div><\/div>
\"\"<\/figure>
GitHub - tenable\/esp32_image_parser: A toolkit for helping you reverse engine...<\/div>
https:\/\/github.com\/tenable\/esp32_image_parser<\/div>
A toolkit for helping you reverse engineer ESP32 firmware. - GitHub - tenable\/esp32_image_parser: A toolkit for helping you reverse engineer ESP32 firmware.<\/div><\/div>
<\/div><\/div><\/a><\/div><\/div>\n\n\n\n
NVS\u306e\u30c7\u30fc\u30bf\u3092\u62bd\u51fa\u3059\u308b\u3068\u3001ESP32\u306b\u8a2d\u5b9a\u3055\u308c\u3066\u3044\u308bAP\u306eSSID\u304capa-316-2428<\/code>\u3068\u308f\u304b\u308b\u3002<\/p>\n\n\n\n
$ python3 esp32_image_parser.py dump_nvs Flash.bin -partition nvs\n(\u7565)\n  Entry 36\n  Bitmap State : Written\n    Written Entry 36\n      NS Index : 2\n          NS : nvs.net80211\n      Type : BLOB_DATA\n      Span : 3\n      ChunkIndex : 128\n      Key : sta.ssid\n      Blob Data :\n        Size : 36\n        Data :\n00000000: 0C 00 00 00 61 70 61 2D  33 31 36 2D 32 34 32 38  ....apa-316-2428<\/mark>\n00000010: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ................\n00000020: 00 00 00 00                                       ....\n(\u7565)<\/pre>\n\n\n\n
apa\u306f\u30a2\u30d1\u30db\u30c6\u30eb\u3001316\u306fNo.316\u30012428\u306f\u90e8\u5c4b\u756a\u53f7\u3068\u8003\u3048\u3066\u3001\u30db\u30c6\u30eb\u540d\u3068\u90e8\u5c4b\u756a\u53f7\u304b\u3089\u7d44\u307f\u7acb\u3066\u3066\u30d5\u30e9\u30b0\u3092\u30b2\u30c3\u30c8\u3002<\/p>\n\n\n\n
\"\"<\/div>
map.apahotel.com<\/div><\/div>
\"\"<\/figure>
No.316 \u30a2\u30d1\u30db\u30c6\u30eb&\u30ea\u30be\u30fc\u30c8\u3008\u4e21\u56fd\u99c5\u30bf\u30ef\u30fc\u3009 | \u5730\u56f3\u691c\u7d22\uff5c\u3010\u516c\u5f0f\u3011\u30a2\u30d1\u30db\u30c6\u30eb...<\/div>
https:\/\/map.apahotel.com\/map\/460<\/div><\/div>
<\/div><\/div><\/a><\/div><\/div>\n\n\n\n
Flag: TsukuCTF22{\u30a2\u30d1\u30db\u30c6\u30eb&\u30ea\u30be\u30fc\u30c8\u3008\u4e21\u56fd\u99c5\u30bf\u30ef\u30fc\u3009_2428}<\/code><\/p>\n\n\n\n
what_time_is_it [495pt]<\/h2>\n\n\n\n
Google\u30ec\u30f3\u30ba\u306b\u805e\u304f\u3068JR\u56db\u56fd\u306e\u7279\u6025\u3046\u305a\u3057\u304a\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002
\u753b\u50cf\u306e\u96fb\u8eca\u306f2600\u7cfb\u3068\u3044\u3046\u3082\u306e\u306e\u6a21\u69d8\u3002
\u7279\u6025\u3046\u305a\u3057\u304a\u3092\u753b\u50cf\u691c\u7d22\u3057\u3066\u898b\u3066\u3044\u308b\u3068\u3001\u30db\u30fc\u30e0\u306b\u4e57\u8eca\u53e3\u756a\u53f7\uff08\uff1f\uff09\u304c\u8a18\u3055\u308c\u3066\u3044\u308b\u3053\u3068\u304b\u3089\u3053\u3053\u304c\u5fb3\u5cf6\u99c5\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002
\u5fb3\u5cf6\u99c5\u306e\u3046\u305a\u3057\u304a\u306e\u6642\u523b\u8868\u3092\u8abf\u3079\u308b\u3068\u3001\u5fb3\u5cf6\u99c5\u767a\u306e\u3046\u305a\u3057\u304a\u30672600\u7cfb\u306f
09:23
12:23
15:23
18:30
\u306e4\u3064\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002\u5199\u771f\u306e\u7a7a\u6a21\u69d8\u304b\u308918:30\u306f\u9664\u5916\u3067\u304d\u308b\u3002<\/p>\n\n\n\n
\"\"<\/div>
\u9244\u9053\u30d7\u30ec\u30b9<\/div><\/div>
\"\"<\/figure>
\u7279\u6025\u300e\u3046\u305a\u3057\u304a\u300f\u306e\u6642\u523b\u8868\u30fb\u904b\u7528\u8eca\u4e21\u307e\u3068\u3081 | 2021\u5e743\u6708\u6539\u6b63\u7248<\/div>
https:\/\/207hd.com\/post-15008\/<\/div>
\u5fb3\u5cf6\uff5e\u9ad8\u677e\u30fb\u5ca1\u5c71\u9593\u3092\u7d50\u3076\u3001\u65e5\u672c\u3067\u4e00\u756a\u672c\u6570\u304c\u591a\u3044\u6c17\u52d5\u8eca\u7279\u6025\u300c\u3046\u305a\u3057\u304a\u300d\u53f7\u306e2021\u5e74\u73fe\u5728\u306e\u6642\u523b\u8868\u3092\u3001\u306a\u308b\u3079\u304f\u898b\u3084\u3059\u3044\u3088\u3046\u307e\u3068\u3081\u307e\u3057\u305f\u3002 \u7279\u6025\u3046\u305a\u3057\u304a\u53f7\u306b\u4f7f\u308f\u308c\u308b\u8eca <\/div><\/div>
<\/div><\/div><\/a><\/div><\/div>\n\n\n\n
\u3053\u308c\u3060\u3051\u3060\u3068\u7279\u5b9a\u3067\u304d\u306a\u3044\u306e\u3067\u8ffd\u52a0\u3067\u8abf\u67fb\u3002
\u5199\u771f\u3092\u898b\u308b\u3068\u3001\u3046\u305a\u3057\u304a\u306e\u5965\u306e3\u756a\u7dda\u30014\u756a\u7dda\u306b\u3082\u96fb\u8eca\u304c\u505c\u307e\u3063\u3066\u3044\u308b\u3002
\u5fb3\u5cf6\u99c5\u306e\u6642\u523b\u8868<\/a>\u3092\u898b\u3066\u3001\u3046\u305a\u3057\u304a\u306e\u767a\u8eca\u524d\u306b3\u756a\u7dda4\u756a\u7dda\u306b\u96fb\u8eca\u304c\u505c\u307e\u3063\u3066\u3044\u305d\u3046\u306a\u30bf\u30a4\u30df\u30f3\u30b0\u3067\u7d5e\u308a\u8fbc\u3093\u3060\u308915:23\u304c\u6b8b\u3063\u305f\u3002\uff083,4\u756a\u7dda\u3068\u308215:30\u767a\uff09
\u3053\u308c\u3092\u5165\u308c\u3066\u307f\u305f\u3068\u3053\u308d\u6b63\u89e3\u3002<\/p>\n\n\n\n
Flag: TsukuCTF22{15:23}<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"
OSINT\u697d\u3057\u304b\u3063\u305f\uff08\u305f\u3060\u3057\u65e5\u672c\u8a9e\u306b\u9650\u308b\uff09\u3002\u3042\u3068Google\u30ec\u30f3\u30ba\u6709\u80fd\u3059\u304e\u308b\u3002<\/p>\n","protected":false},"author":1,"featured_media":743,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"","footnotes":""},"categories":[14],"tags":[8],"class_list":["post-727","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf","tag-ctf"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/727","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/comments?post=727"}],"version-history":[{"count":10,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/727\/revisions"}],"predecessor-version":[{"id":746,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/727\/revisions\/746"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/media\/743"}],"wp:attachment":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/media?parent=727"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/categories?post=727"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/tags?post=727"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}