{"id":876,"date":"2024-04-01T23:57:52","date_gmt":"2024-04-01T14:57:52","guid":{"rendered":"https:\/\/emeth.jp\/diary\/?p=876"},"modified":"2024-08-10T14:37:19","modified_gmt":"2024-08-10T05:37:19","slug":"%e9%98%b2%e8%a1%9b%e7%9c%81%e3%82%b5%e3%82%a4%e3%83%90%e3%83%bc%e3%82%b3%e3%83%b3%e3%83%86%e3%82%b9%e3%83%882024-feb-writeup","status":"publish","type":"post","link":"https:\/\/emeth.jp\/diary\/2024\/04\/%e9%98%b2%e8%a1%9b%e7%9c%81%e3%82%b5%e3%82%a4%e3%83%90%e3%83%bc%e3%82%b3%e3%83%b3%e3%83%86%e3%82%b9%e3%83%882024-feb-writeup\/","title":{"rendered":"\u9632\u885b\u7701\u30b5\u30a4\u30d0\u30fc\u30b3\u30f3\u30c6\u30b9\u30c82024 (Feb.) writeup"},"content":{"rendered":"\n

\u53c2\u52a0\u3057\u3066430pt\u306710\u4f4d\u3002\u524d\u56de<\/a>\u306f16\u4f4d\u3060\u3063\u305f\u306e\u3067\u3061\u3087\u3063\u3068\u4e0a\u6607\u3002
\u30ae\u30ea\u30ae\u30ea10\u4f4d\u306b\u5165\u3063\u305f\u306e\u3067Top10\u306e\u30b0\u30e9\u30d5\u306b\u540d\u524d\u304c\u6b8b\u3063\u305f\u3002<\/p>\n\n\n

\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n\n\n\n\n

Welcome<\/h2>\n\n\n\n

Welcome! [10 pt, 313 solves]<\/h3>\n\n\n\n

\u4eca\u56de\u306fOpenVPN\u3067\u63a5\u7d9a\u3057\u3066\u305d\u306e\u5148\u306e\u30b5\u30fc\u30d0\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u5f62\u5f0f\u3060\u3063\u305f\u305f\u3081\u3001\u3053\u306e\u554f\u984c\u3067OpenVPN\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u304c\u914d\u3089\u308c\u3066\u3044\u305f\u3002<\/p>\n\n\n\n

OpenVPN\u306f2.5\u4ee5\u524d\u30682.6\u3067\u3061\u3087\u3063\u3068\u9055\u3044\u304c\u3042\u308b\u3089\u3057\u304f\u30012.5\u306e\u8a2d\u5b9a\u30d5\u30a1\u30a4\u30eb\u30922.6\u3067\u4f7f\u3046\u306b\u306f\u4e92\u63db\u6027\u30aa\u30d7\u30b7\u30e7\u30f3\u3092\u30bb\u30c3\u30c8\u3057\u306a\u3044\u3068\u3044\u3051\u306a\u3044\u3002\u904e\u53bb\u306f\u307e\u3063\u305f\u3053\u3068\u304c\u3042\u3063\u305f\u8a18\u61b6\u304c\u3042\u308b\u3002\u4eca\u56de\u306f\u4e8b\u524d\u306e\u6848\u5185\u306b\u305d\u306e\u3042\u305f\u308a\u304c\u66f8\u304b\u308c\u3066\u3044\u3066\u89aa\u5207\u3002<\/p>\n\n\n\n

FLAG: flag{WelcomeToMODCyberContest!}<\/code><\/pre>\n\n\n\n
Crypto<\/h2>\n\n\n\n
Information of Certificate [10 pt, 284 solves]<\/h3>\n\n\n\n
\u8a3c\u660e\u66f8\u306eCN\u3092\u7b54\u3048\u308b\u554f\u984c\u3002\u8a3c\u660e\u66f8\u30d3\u30e5\u30fc\u30ef\u306e\u5168\u822c\u30bf\u30d6\u304b\u3089\u306fCN\u3092\u30b3\u30d4\u30fc\u3067\u304d\u306a\u3044\u306e\u3067\u3001\u8a73\u7d30\u30bf\u30d6\u304b\u3089\u30b3\u30d4\u30fc\u3059\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
FLAG: flag{QRK7rNJ3hShV.vlc-cybercontest.invalid}<\/code><\/pre>\n\n\n\n
Missing IV [20 pt, 80 solves]<\/h3>\n\n\n\n
IV\u304c\u4e0d\u660e\u3068\u3044\u3046\u3053\u3068\u3060\u304c\u3001\u5b9f\u306fCBC\u30e2\u30fc\u30c9\u306e\u5834\u5408IV\u304c\u308f\u304b\u3089\u306a\u304f\u3066\u56f0\u308b\u306e\u306f\u6700\u521d\u306e\u30d6\u30ed\u30c3\u30af\u3060\u3051\u3067\u3001\u4ee5\u964d\u306e\u30d6\u30ed\u30c3\u30af\u306f\u554f\u984c\u306a\u304f\u5fa9\u53f7\u3067\u304d\u308b\u306e\u3067\u3042\u308b\u3002\u4ee5\u4e0b\u306e\u56f3\u3092\u53c2\u7167\u30022\u756a\u76ee\u4ee5\u964d\u306e\u30d6\u30ed\u30c3\u30af\u306e\u5fa9\u53f7\u306b\u5fc5\u8981\u306a\u306e\u306fCiphertext\u306e\u307f\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a>
\u6697\u53f7\u5229\u7528\u30e2\u30fc\u30c9 – Wikipedia<\/a> \u3088\u308a\u5f15\u7528<\/figcaption><\/figure>\n<\/div>\n\n\n
\u3068\u3044\u3046\u308f\u3051\u3067\u5f37\u5f15\u306b\u5fa9\u53f7\u3057\u3066\u3084\u308b\u3002<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
\u898b\u3048\u3066\u308b\u6587\u5b57\u5217\u3092\u30ad\u30fc\u30ef\u30fc\u30c9\u306b\u8abf\u67fb\u3059\u308b\u3068\u3001OpenDocumentFormat\u3089\u3057\u3044\u3053\u3068\u304c\u308f\u304b\u308b\u3002\u305d\u3057\u3066\u305d\u306e\u5b9f\u614b\u306fMicrosoft Office\u306e\u30d5\u30a1\u30a4\u30eb\u3068\u540c\u69d8\u306bZip\u30d5\u30a1\u30a4\u30eb\u3089\u3057\u3044\u306e\u3067\u3001\u9069\u5f53\u306aZip\u30d5\u30a1\u30a4\u30eb\u304b\u3089\u982d16\u30d0\u30a4\u30c8\u3092\u30b3\u30d4\u30da\u3059\u308b\u3002
ZIP\u306e\u4ed5\u69d8\u3092\u65e5\u672c\u8a9e\u3067\u307e\u3068\u3081\u308b \u00b7 GitHub<\/a> \u306b\u30d5\u30a1\u30a4\u30eb\u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u304c\u3042\u308b\u306e\u306716\u30d0\u30a4\u30c8\u76ee\u307e\u3067\u3092\u898b\u3066\u307f\u308b\u3068\u300116\u30d0\u30a4\u30c8\u76ee\u307e\u3067\u306f\u3069\u306e\u30d5\u30a1\u30a4\u30eb\u3067\u3082\u5909\u308f\u3089\u306a\u3044\u60c5\u5831\u3068\u9069\u5f53\u306a\u5024\u3092\u5165\u308c\u3066\u3042\u3063\u3066\u3044\u3044\u60c5\u5831\uff08CRC\u306f\u5408\u3063\u3066\u306a\u304f\u3066\u3082\u3088\u3044\u306e\u3060\uff09\u3057\u304b\u306a\u3044\u306e\u3067\u30b3\u30d4\u30da\u3067\u3046\u307e\u304f\u3044\u304f\u3068\u3044\u3046\u308f\u3051\u3067\u3042\u308b\u3002<\/p>\n\n\n\n
(Libre\/Open)Office\u306f\u5165\u308c\u3066\u306a\u304b\u3063\u305f\u306e\u3067Zip\u3068\u3057\u3066\u5c55\u958b\u3057\u3066\u4e2d\u3092\u63a2\u3063\u3066\u3044\u305f\u3089\u30d5\u30e9\u30b0\u304c\u3042\u3063\u305f\u3002
\u306a\u304a\u3001zipgrep<\/code>\u3067dec_NoIV.bin\u3092grep\u3059\u308b\u3060\u3051\u3067\u3082\u51fa\u3066\u304d\u305f\u3002\u5727\u7e2e\u3055\u308c\u305f\u30c7\u30fc\u30bf\u90e8\u5206\u306f\u6b20\u640d\u3057\u3066\u306a\u3044\u306e\u3067\u982d16\u30d0\u30a4\u30c8\u304c\u304a\u304b\u3057\u304f\u3066\u3082grep\u3067\u304d\u308b\u306e\u306d\u3002<\/p>\n\n\n\n
FLAG: flag{ESYQV0fPMxz4wMmU}<\/code><\/pre>\n\n\n\n
Short RSA Public Key [20 pt, 53 solves]<\/h3>\n\n\n\n
\u516c\u958b\u9375\u3068\u516c\u958b\u9375\u3067\u6697\u53f7\u5316\u3055\u308c\u305f\u30c7\u30fc\u30bf\u304c\u4e0e\u3048\u3089\u308c\u308b\u3002\u307e\u305a\u306f\u516c\u958b\u9375\u3092\u898b\u3066\u307f\u308b\u3002<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
Modulus\u304c256bit\u3068\u77ed\u3044\u3002\u77ed\u3044\u3068\u4f55\u304c\u8d77\u3053\u308b\u304b\u3068\u3044\u3046\u3068\u7d20\u56e0\u6570\u5206\u89e3\u304c\u3067\u304d\u3066\u3057\u307e\u3046\u3002
16\u9032\u3067\u8868\u793a\u3055\u308c\u3066\u3044\u308bModulus\u309210\u9032\u306b\u5909\u63db\u3057\u3066factordb<\/a>\u306b\u7a81\u3063\u8fbc\u3080\u3068\u3053\u306e\u3088\u3046\u306b<\/a>\u7d20\u56e0\u6570\u5206\u89e3\u3067\u304d\u3066\u3057\u307e\u3046\u306e\u3067\u3042\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
RSA Cipher Calculator<\/a>\u306b\u6697\u53f7\u6587\u3001\u516c\u958b\u9375\u306e\u60c5\u5831\u306b\u52a0\u3048\u3066\u7d20\u56e0\u6570\u5206\u89e3\u3057\u3066\u308f\u304b\u3063\u305fp\u3068q\u306e\u5024\u3092\u5165\u308c\u3066\u5fa9\u53f7\u3057\u3066\u3084\u308b\u3068\u30d5\u30e9\u30b0\u304c\u51fa\u3066\u304f\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
FLAG: flag{X0Myx6IHI8}<\/code><\/pre>\n\n\n\n
Cryptographically Insecure PRNG [30 pt, 22 solves]<\/h3>\n\n\n\n
\u7dda\u5f62\u5408\u540c\u6cd5\u3067\u751f\u6210\u3055\u308c\u305f\u7591\u4f3c\u4e71\u6570\u3068\u5e73\u6587\u306eXOR\u3092\u53d6\u3063\u305f\u30c7\u30fc\u30bf\u304c\u4e0e\u3048\u3089\u308c\u308b\u3002\u5e73\u6587\u306e\u30d2\u30f3\u30c8\u306fASCII\u3067\u3042\u308b\u3053\u3068\u3068\u6700\u521d\u306e4\u6587\u5b57\u306f\u82f1\u5b57\u3067\u3042\u308b\u3053\u3068\u3002
\u6700\u521d\u306e4\u6587\u5b57\u306e\u30d1\u30bf\u30fc\u30f3\u306f52 * 26 * 26 * 26 = 913,952\u901a\u308a\uff081\u6587\u5b57\u76ee\u3092\u5927\u6587\u5b57\u3068\u4eee\u5b9a\u3059\u308c\u3070\u3055\u3089\u306b\u534a\u5206\uff09\u3057\u304b\u306a\u3044\u306e\u3067\u7dcf\u5f53\u305f\u308a\u3067ASCII\u30b3\u30fc\u30c9\u306e\u307f\u304c\u51fa\u3066\u304f\u308b\u30d1\u30bf\u30fc\u30f3\u3092\u63a2\u308c\u3070\u3088\u3044\u3002<\/p>\n\n\n
\n# x_{n+1} = (233 x_n + 653) mod 4294967296\n\nx = 4294967295\n\ndata = open("PRNG.bin", "rb").read()\n\na1 = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"\na2 = "abcdefghijklmnopqrstuvwxyz"\n\nmax_i = 0\nfor c1 in a1:\n    for c2 in a2:\n        for c3 in a2:\n            for c4 in a2:\n                xor_1 = ord(c1) ^ data[0]\n                xor_2 = ord(c2) ^ data[1]\n                xor_3 = ord(c3) ^ data[2]\n                xor_4 = ord(c4) ^ data[3]\n\n                result = c1 + c2 + c3 + c4\n                x = xor_1 + (xor_2 << 8) + (xor_3 << 16) + (xor_4 << 24)\n                next_x = (233 * x + 653) % 4294967296\n\n                i = 1\n                while True:\n                    next_xor_1 = next_x & 0xff\n                    next_xor_2 = (next_x & 0xff00) >> 8\n                    next_xor_3 = (next_x & 0xff0000) >> 16\n                    next_xor_4 = (next_x & 0xff000000) >> 24\n\n                    next_c1 = next_xor_1 ^ data[i * 4]\n                    next_c2 = next_xor_2 ^ data[i * 4 + 1]\n                    next_c3 = next_xor_3 ^ data[i * 4 + 2]\n                    next_c4 = next_xor_4 ^ data[i * 4 + 3]\n\n                    if next_c1 < 0x20 or next_c1 > 0x7e or next_c2 < 0x20 or next_c2 > 0x7e or next_c3 < 0x20 or next_c3 > 0x7e or next_c4 < 0x20 or next_c4 > 0x7e:\n                        break\n\n                    result = result + chr(next_c1) + chr(next_c2) + chr(next_c3) + chr(next_c4)\n                    next_x = (233 * next_x + 653) % 4294967296\n                    i = i + 1\n                    if max_i < i:\n                        max_i = i\n                    if i == 208:\n                        print(result)\n                        exit()\n\n<\/pre><\/div>\n\n\n
\u5b9f\u884c\u3059\u308b\u3068\u51fa\u529b\u306e\u4e2d\u306b\u30d5\u30e9\u30b0\u304c\u3042\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
FLAG: flag{QVFE5i5LkZdR}<\/code><\/pre>\n\n\n\n
Forensics<\/h2>\n\n\n\n
NTFS Data Hide [10 pt]<\/h3>\n\n\n\n
NTFS\uff5e\u306e\u554f\u984c\u306f\u5168\u3066\u914d\u5e03\u3055\u308c\u305fNTFS.vhd<\/code>\u3092\u4f7f\u3046\u3002FTK Imager\u3067\u76f4\u63a5\u8aad\u3093\u3067\u3082\u3044\u3044\u3051\u3069\u3001\u8aad\u307f\u53d6\u308a\u5c02\u7528\u306b\u3057\u3066\u30de\u30a6\u30f3\u30c8\u3057\u3066\u305d\u306e\u30c9\u30e9\u30a4\u30d6\u3092FTK Imager\u3067\u8aad\u3080\u306e\u304c\u3044\u3044\u3068\u601d\u3046\u3002<\/p>\n\n\n\n
NTFS\u3067\u30c7\u30fc\u30bf\u3092\u96a0\u3059\u3068\u8a00\u3063\u305f\u3089Alternate Data Stream\u3002dir<\/code>\u30b3\u30de\u30f3\u30c9\u306e\/r<\/code>\u30b9\u30a4\u30c3\u30c1\u3092\u4f7f\u3046\u3068Alternate Data Stream\u3092\u8868\u793a\u3067\u304d\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
\u3042\u3068\u306f\u4e2d\u8eab\u3092\u8868\u793a\u3057\u3066\u3084\u308c\u3070\u3088\u3044\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
\u5f15\u7528\u7b26\u5185\u306e\u6587\u5b57\u5217\u3092BASE64\u30c7\u30b3\u30fc\u30c9\u3059\u308b\u3068\u30d5\u30e9\u30b0\u304c\u5f97\u3089\u308c\u308b\u3002<\/p>\n\n\n\n
FLAG: flag{data_can_be_hidden_in_ads}<\/code><\/pre>\n\n\n\n
NTFS File Delete [10 pt]<\/h3>\n\n\n\n
NTFSFileDelete<\/code>\u30d5\u30a9\u30eb\u30c0\u3092FTK Imager\u3067\u898b\u308c\u3070\u4e00\u767a\u3002<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
FLAG: flag{resident_in_mft}<\/code><\/pre>\n\n\n\n
HiddEN Variable [20 pt]<\/h3>\n\n\n\n
\u3053\u308c\u3068My Secret\u306f\u30e1\u30e2\u30ea\u30c0\u30f3\u30d7\u3092\u89e3\u6790\u3059\u308b\u554f\u984c\u3002<\/p>\n\n\n\n
\u554f\u984c\u540d\u306e\u5927\u6587\u5b57\u3092\u898b\u308b\u3068ENV\u306b\u306a\u3063\u3066\u3044\u308b\u306e\u3067\u74b0\u5883\u5909\u6570\u3092\u78ba\u8a8d\u3059\u308b\u3002\u79c1\u306fKali\u306bvolatility 3\u3092\u5c0e\u5165\u3057\u3066\u3084\u3063\u305f\u3002<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
FLAG<\/code>\u74b0\u5883\u5909\u6570\u306b\u8b0e\u306e\u6587\u5b57\u5217\u304c\u5165\u3063\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002\u3053\u308c\u304c\u7b54\u3048\u304b\u3068\u601d\u3044\u304d\u3084\u9055\u3046\u3002BASE64\u30a8\u30f3\u30b3\u30fc\u30c9\u3055\u308c\u3066\u308b\u306e\u304b\u3068\u601d\u3044\u304d\u3084\u9055\u3046\u3002CyberChef\u306eMagic\u306b\u304b\u3051\u305f\u3089BASE58\u3068\u51fa\u305f\u3002\u3053\u3053\u3060\u3051\u306a\u305c\u2026<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
FLAG: flag{volatile_environment_variable}<\/code><\/pre>\n\n\n\n
NTFS File Rename [20 pt]<\/h3>\n\n\n\n
NTFSFileRename<\/code>\u30d5\u30a9\u30eb\u30c0\u306b\u3042\u308bRenamed.docx<\/code>\u306e\u30ea\u30cd\u30fc\u30e0\u524d\u306e\u540d\u524d\u306f\uff1f\u3068\u3044\u3046\u554f\u984c\u3002\u3053\u306e\u3042\u305f\u308a\u306e\u60c5\u5831\u306f\u30b8\u30e3\u30fc\u30ca\u30eb\u3092\u6f01\u308b\u3068\u51fa\u3066\u304f\u308b\u3002\u3053\u3093\u306a\u30b3\u30de\u30f3\u30c9\u3092\u5b9f\u884c\u3059\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
\u51fa\u529b\u3055\u308c\u305fCSV\u3092\u898b\u3066\u307f\u308b\u3068\u3001\u30ea\u30cd\u30fc\u30e0\u524d\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u3068\u30ea\u30cd\u30fc\u30e0\u5f8c\u306e\u30d5\u30a1\u30a4\u30eb\u540d\u304c\u66f8\u304b\u308c\u3066\u3044\u308b\u90e8\u5206\u304c\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
FLAG: flag{journaling_system_is_powerful}<\/code><\/pre>\n\n\n\n
My Secret [30 pt]<\/h3>\n\n\n\n
\u307e\u305f\u30e1\u30e2\u30ea\u30c0\u30f3\u30d7\u306e\u554f\u984c\u3002\u4eca\u5ea6\u306f\u554f\u984c\u540d\u3067\u306e\u30d2\u30f3\u30c8\u306f\u306a\u3044\u306e\u3067\u3001\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u3042\u305f\u308a\u306b\u4f55\u304b\u3042\u308b\u304b\u306a\u3068\u898b\u3066\u307f\u308b\u3002<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
\u904b\u3088\u304f\u4e00\u767a\u3067\u5f15\u304d\u5f53\u3066\u305f\u3002\u3053\u306eSecrets.7z<\/code>\u304c\u53d6\u5f97\u3067\u304d\u308c\u3070\u3088\u3044\u306e\u3067\u3084\u3063\u3066\u307f\u308b\u3002<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
\u306a\u3093\u304bError\u3063\u3066\u51fa\u3066\u308b\u3051\u3069\u305d\u3063\u3061\u306e\u65b9\u3082\u30d5\u30a1\u30a4\u30eb\u306f\u51fa\u529b\u3055\u308c\u3066\u3044\u308b\u3002\u30b3\u30de\u30f3\u30c9\u30e9\u30a4\u30f3\u306b\u3042\u3063\u305f\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u4f7f\u3063\u3066\u5c55\u958b\u3059\u308b\u3068Secrets.rtf<\/code>\u304c\u51fa\u73fe\u3059\u308b\u3002
\u958b\u304f\u3068\u7279\u306b\u30d5\u30e9\u30b0\u306f\u66f8\u304b\u308c\u3066\u3044\u306a\u3044\u3088\u3046\u306b\u898b\u3048\u308b\u304c\u3001\u5b9f\u306f2\u884c\u76ee\u306b\u767d\u6587\u5b57\u3067\u66f8\u3044\u3066\u3042\u308b\u3002\u3069\u3046\u3057\u3066\u3053\u3046\u3044\u3046\u3057\u3087\u3046\u3082\u306a\u3044\u3053\u3068\u3059\u308b\u306e\u3002<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
FLAG: flag{you_cannot_find_this_secret!}<\/code><\/pre>\n\n\n\n
Miscellaneous<\/h2>\n\n\n\n
Une Maison [10 pt]<\/h3>\n\n\n\n
\u753b\u50cf\u306e\u4e2d\u307b\u3069\u306b\u767d\u3068\u9ed2\u306e\u7e1e\u3005\u304c\u3042\u308b\u306e\u3067\u3001\u3053\u308c\u306f\u30d0\u30fc\u30b3\u30fc\u30c9\u3067\u306f\uff1f\u3068\u601d\u3044\u9069\u5f53\u306a\u30a2\u30d7\u30ea\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u8aad\u307e\u305b\u3066\u307f\u305f\u3089\u30d5\u30e9\u30b0\u304c\u51fa\u3066\u304d\u305f\u3002<\/p>\n\n\n\n
FLAG: flag{$50M!}<\/code><\/pre>\n\n\n\n
String Obfuscation [10 pt]<\/h3>\n\n\n\n
\u4e0e\u3048\u3089\u308c\u305f\u30b3\u30fc\u30c9\u3092\u3044\u3058\u3063\u3066KEY<\/code>\u5909\u6570\u3092print()<\/code>\u3057\u3066\u3084\u3063\u3066\u5b9f\u884c\u6642\u306e\u5f15\u6570\u306b\u6e21\u3057\u3066\u3084\u308c\u3070\u30d5\u30e9\u30b0\u3092\u30b2\u30c3\u30c8\uff01\u3068\u3084\u3063\u305f\u3093\u3060\u3051\u3069\u3001\u5358\u7d14\u306bFLAG<\/code>\u5909\u6570\u3092print()<\/code>\u3059\u308c\u3070\u3088\u304b\u3063\u305f\u3002<\/p>\n\n\n\n
FLAG: flag{3FxYFm4uTYDFFzmb3}<\/code><\/pre>\n\n\n\n
Where Is the Legit Flag? [20 pt]<\/h3>\n\n\n\n
\u96e3\u8aad\u5316\u3055\u308c\u305fPython\u30b9\u30af\u30ea\u30d7\u30c8\u304c\u4e0e\u3048\u3089\u308c\u308b\u3002\u305f\u3060\u3057exec()<\/code>\u3067\u5b9f\u884c\u3057\u3066\u304a\u308a\u305d\u306e\u90e8\u5206\u306f\u96e3\u8aad\u5316\u3055\u308c\u3066\u3044\u306a\u3044\u305f\u3081\u3001exec()<\/code>\u306e\u5f15\u6570\u3092\u629c\u304d\u51fa\u3057\u3066print()<\/code>\u3057\u3066\u3084\u308c\u3070\u3069\u3093\u306a\u30b3\u30fc\u30c9\u304c\u5b9f\u884c\u3055\u308c\u308b\u304b\u304c\u308f\u304b\u308b\u3002fakeflag.py<\/code>\u306e\u6700\u5f8c\u306b\u5b9f\u884c\u3055\u308c\u3066\u3044\u308b\u306e\u306f\u4ee5\u4e0b\u306e\u30b3\u30fc\u30c9\u3002<\/p>\n\n\n
\nb'exec(zlib.decompress(base64.b64decode(TANAKA)))'\n<\/pre><\/div>\n\n\n
\u307e\u305fexec()<\/code>\u304c\u51fa\u3066\u304d\u305f\u306e\u3067\u4e2d\u8eab\u3092print()<\/code>\u3059\u308b\u3068\u4ee5\u4e0b\u3002<\/p>\n\n\n
\n# Than volleyball vanish against lumpy berry.\nSATO = '[QI3?)c^J:6RK\/FV><ex7#kdYov$G0-A{qPs~w1@+`MO,h(La.WuCp5]i ZbjD9E%2yn8rTBm;f*H"!NS}tgz=UlX&4_|\\'\\\\'\n# Above face explain for physical decision.\n# Via snake name round terrific brass.\n# Following suggestion sound regarding female recess.\n# Toward vessel disagree beneath huge porter.\nSUZUKI = [74-0+0,\n        87*1,int(48**1),\n# Off purpose land as rural statement.\n        int(8_3),int(32.00000),int('34'),\n        76 & 0xFF,72 | 0x00,79 ^ 0x00,[65][0],\n# During knot rely save wretched scarecrow.\n        (2),47 if True else 0,int(12\/1),10 % 11,ord(chr(26)),\n        30+5,int(48\/2*2),9*9]\n#  Plus toe settle with vast insect.\n#  Save hands shelter with ratty produce.\n#  Outside legs nest versus tranquil relation.\n#  As walk pat round rightful advice.\n# Beside payment train by large key.\n# Past behavior post toward unable home.\n#  Among place complain considering unknown current.\n( #  Around spark scorch above spotty grape.\n    ''#  Underneath jewel chop past dependent rifle.\n    .    join                          ([\n        #  Since cobweb tie off hurt string.\nSATO[i]         #  Since cobweb tie off hurt string.\nfor i in SUZUKI\n        # if i > 4728:\n        #     break\n        # t = 234667 * 83785\n        # print(t\/3457783)\n#  Through queen dam of slippery comparison.\n])\n#  By wall stroke without secret wash.\n)\n#  Opposite yoke need beside superb lumber.\nprint("flog{8vje9wunbp984}")\n<\/pre><\/div>\n\n\n
\u30b3\u30e1\u30f3\u30c8\u304c\u90aa\u9b54\u3063\u3051\u306a\u306e\u3067\u53d6\u308a\u9664\u3044\u3066\u6574\u5f62\u3059\u308b\u3068\u3053\u3093\u306a\u30b3\u30fc\u30c9\u3002<\/p>\n\n\n
\nSATO = '[QI3?)c^J:6RK\/FV><ex7#kdYov$G0-A{qPs~w1@+`MO,h(La.WuCp5]i ZbjD9E%2yn8rTBm;f*H"!NS}tgz=UlX&4_|\\'\\\\'\nSUZUKI = [74-0+0,\n        87*1,int(48**1),\n        int(8_3),int(32.00000),int('34'),\n        76 & 0xFF,72 | 0x00,79 ^ 0x00,[65][0],\n        (2),47 if True else 0,int(12\/1),10 % 11,ord(chr(26)),\n        30+5,int(48\/2*2),9*9]\n(''.join([ SATO[i] for i in SUZUKI ]))\nprint("flog{8vje9wunbp984}")\n<\/pre><\/div>\n\n\n
\u6700\u5f8c\u306eprint()<\/code>\u306f\u507d\u30c7\u30fc\u30bf\u3092\u8868\u793a\u3057\u3066\u308b\u3060\u3051\u306a\u306e\u3067\u7121\u8996\u3057\u3066\u3001\u305d\u306e\u4e0a\u306e\u884c\u3092print()<\/code>\u3057\u3066\u3084\u308b\u3068\u30d5\u30e9\u30b0\u304c\u51fa\u3066\u304f\u308b\u3002<\/p>\n\n\n\n
FLAG: flag{PHmN2ILK6vsa}<\/code><\/pre>\n\n\n\n
Utter Darkness [20 pt]<\/h3>\n\n\n\n
\u4e0e\u3048\u3089\u308c\u305fdarkness.bmp<\/code>\u3092\u753b\u50cf\u30d3\u30e5\u30fc\u30ef\u3067\u898b\u3066\u307f\u308b\u3068\u771f\u3063\u9ed2\u3002\u308d\u304f\u306b\u8003\u3048\u305a\u3053\u308c\u306f\u30b9\u30c6\u30ac\u30ce\u30b0\u30e9\u30d5\u30a3\u30fc\u306b\u9055\u3044\u306a\u3044\uff01\u3068\u601d\u3063\u3066Aperi’Solve<\/a>\u306b\u753b\u50cf\u3092\u7a81\u3063\u8fbc\u3093\u3067\u307f\u308b\u3082\u4f55\u3082\u51fa\u306a\u3044<\/a>\u3002\u3061\u306a\u307f\u306b\u79c1\u3088\u308a\u524d\u306b\u7a81\u3063\u8fbc\u3093\u3067\u308b\u4eba\u304c\u3044\u305f\u3002<\/p>\n\n\n\n
\u3067\u306f\u5225\u306e\u30c4\u30fc\u30eb\u3067\u3001\u3068\u3044\u3046\u3053\u3068\u3067\u3046\u3055\u307f\u307f\u30cf\u30ea\u30b1\u30fc\u30f3<\/a>\u4ed8\u5c5e\u306e\u9752\u3044\u7a7a\u3092\u898b\u4e0a\u3052\u308c\u3070\u3044\u3064\u3082\u305d\u3053\u306b\u767d\u3044\u732b<\/a>\u3067\u8aad\u307f\u8fbc\u3093\u3067\u3044\u308d\u3044\u308d\u3044\u3058\u3063\u3066\u307f\u308b\u3002\u30d0\u30a4\u30ca\u30ea\u30c7\u30fc\u30bf\u8996\u899a\u5316\u8868\u793a\u3067\u6298\u308a\u8fd4\u3057\u5e45\u3092\u3044\u3058\u3063\u305f\u308a\u3057\u3066\u305f\u3089\u4f55\u304b\u51fa\u3066\u304d\u305f\u3002<\/p>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n
\u4e0a\u4e0b\u53cd\u8ee2\u3057\u3066\u62e1\u5927\u3057\u3066\u307f\u308b\u3068\u30d5\u30e9\u30b0\u6587\u5b57\u5217\u3063\u307d\u3044\u304c\u3001\u4e00\u90e8\u4e0d\u660e\u306a\u6587\u5b57\u3084\u5019\u88dc\u304c\u8907\u6570\u3042\u308b\u6587\u5b57\u304c\u3042\u3063\u305f\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
\u4f55\u30d1\u30bf\u30fc\u30f3\u304b\u8a66\u3057\u3066\u307f\u3066\u30c0\u30e1\u3067\u3001\u7dcf\u5f53\u305f\u308a\u3059\u308b\u306e\u3082\u3064\u3089\u3044\u306e\u3067\u3053\u306e\u3084\u308a\u65b9\u306f\u8ae6\u3081\u3066\u5225\u306e\u65b9\u6cd5\u3092\u8003\u3048\u308b\u3053\u3068\u306b\u3057\u305f\u3002<\/p>\n\n\n\n
\u521d\u5fc3\u306b\u304b\u3048\u3063\u3066exiftool<\/code>\u3067\u78ba\u8a8d\u3059\u308b\u3068\u3053\u3093\u306a\u611f\u3058\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
Bit Depth\u304c1\u306a\u306e\u3067\u30011\u30d4\u30af\u30bb\u30eb\u3042\u305f\u308a1\u30d3\u30c3\u30c8\u3067\u8868\u73fe\u3055\u308c\u3066\u3044\u308b\u3002\u30c7\u30fc\u30bf\u3092\u898b\u308b\u3068ff<\/code>\u4ee5\u5916\u306e\u30c7\u30fc\u30bf\u3082\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u306e\u3067\u3001\u767d\u3068\u9ed2\u304c\u305d\u308c\u306a\u308a\u306b\u6df7\u3056\u3063\u3066\u3044\u308b\u306f\u305a\u3060\u304c\u753b\u50cf\u306f\u305d\u3046\u306a\u3063\u3066\u3044\u306a\u3044\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
BMP \u30d5\u30a1\u30a4\u30eb\u30d5\u30a9\u30fc\u30de\u30c3\u30c8<\/a>\u3092\u53c2\u7167\u3059\u308b\u3068\u30011bit Bitmap\u306e\u5834\u5408\u306e\u5404\u30d4\u30af\u30bb\u30eb\u306e\u8272\u306f\u30d1\u30ec\u30c3\u30c8\u3092\u53c2\u7167\u3059\u308b\u3053\u3068\u306b\u306a\u3063\u3066\u3044\u308b\u30021bit Bitmap\u306e\u5834\u5408\u30d1\u30ec\u30c3\u30c8\u306f2\u7a2e\u985e\u30670x36\uff5e0x39<\/code>\u30680x3a\uff5e0x3d<\/code>\u306b\u3042\u308b\u3002darkness.bmp<\/code>\u306e\u30d1\u30ec\u30c3\u30c8\u30c7\u30fc\u30bf\u3092\u898b\u308b\u3068\u3069\u3061\u3089\u3082#000000<\/code>\u306b\u306a\u3063\u3066\u3044\u308b\u3002\u3053\u306e\u305f\u3081\u306b\u753b\u50cf\u304c\u771f\u3063\u9ed2\u306b\u306a\u3063\u3066\u3044\u305f\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
0x36\uff5e0x39<\/code>\u3092#ffffff<\/code>\u306b\u66f8\u304d\u63db\u3048\u3066\u3084\u3063\u3066\u753b\u50cf\u30d3\u30e5\u30fc\u30ef\u3067\u898b\u3066\u307f\u308b\u3068\u30d5\u30e9\u30b0\u304c\u5f97\u3089\u308c\u305f\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
FLAG: flag{YjM5MDUyYzAxMj}<\/code><\/pre>\n\n\n\n
Serial Port Signal [30 pt]<\/h3>\n\n\n\n
\u4e0e\u3048\u3089\u308c\u305fCSV\u30d5\u30a1\u30a4\u30eb\u3092\u898b\u308b\u306820\u30de\u30a4\u30af\u30ed\u79d2\u3054\u3068\u306eH or L\u304c\u8a18\u9332\u3055\u308c\u3066\u3044\u308b\u3002\u30dc\u30fc\u30ec\u30fc\u30c8\u304c\u3069\u308c\u304f\u3089\u3044\u304b\u306f\u4e0d\u660e\u3060\u304c\u3001\u3056\u3063\u3068\u898b\u305f\u3068\u3053\u308d0\u30841\u304c5\u500b\u304b6\u500b\u30671\u304b\u305f\u307e\u308a\u306b\u306a\u3063\u3066\u3044\u308b\u3088\u3046\u306b\u898b\u53d7\u3051\u3089\u308c\u308b\u3002CSV\u304b\u3089\u30d3\u30c3\u30c8\u90e8\u5206\u3060\u3051\u629c\u304d\u51fa\u3057\u305f\u5f8c\u5927\u90e8\u5206\u3092\u624b\u52d5\u3067\u6574\u5f62\u3057\u3066\u30d3\u30c3\u30c8\u5217\u30925\u304b6\u500b\u3054\u3068\u306b\u307e\u3068\u3081\u308c\u3070\u30d3\u30c3\u30c8\u30b7\u30fc\u30b1\u30f3\u30b9\u304c\u308f\u304b\u3063\u3066\u89e3\u8aad\u3067\u304d\u308b\u30fc\u30fc\u30fc\u30fc<\/p>\n\n\n\n
\u3068\u601d\u3044\u304d\u3084\u30d1\u30ea\u30c6\u30a3\u306e\u5b58\u5728\u3068\u304bMSB\u304b\u3089\u3058\u3083\u306a\u304f\u3066LSB\u304b\u3089\u9001\u3063\u3066\u308b\u3053\u3068\u306b\u6c17\u3065\u3044\u3066\u306a\u304f\u3066\u7d50\u5c40\u89e3\u3051\u306a\u304b\u3063\u305f\u3002<\/p>\n\n\n\n
Network<\/h2>\n\n\n\n
\u30b5\u30fc\u30d0\u304c\u9589\u3058\u3089\u308c\u3066\u3057\u307e\u3063\u3066\u30b9\u30af\u30b7\u30e7\u3092\u53d6\u3063\u3066\u306a\u3044\u306e\u3067\u3053\u306e\u8fba\u3060\u3044\u3076\u9069\u5f53\u3002<\/p>\n\n\n\n
Discovery [10 pt]<\/h3>\n\n\n\n
\u30dd\u30fc\u30c8\u30b9\u30ad\u30e3\u30f3\u3059\u308b\u306880\u756a\u304c\u958b\u3044\u3066\u3044\u308b\u306e\u3067\u30a2\u30af\u30bb\u30b9\u3057\u3066\u307f\u308b\u3068\u5909\u306a\u30c9\u30e1\u30a4\u30f3\u540d\u306e\u30b5\u30a4\u30c8\u306b\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3055\u308c\u3066\u3057\u307e\u3046\uff08\u305d\u3093\u306a\u30c9\u30e1\u30a4\u30f3\u306a\u3044\u306e\u3067\u7e4b\u304c\u3089\u306a\u3044\uff09
dirbuster\u3068\u304b\u3084\u3063\u3066\u3082\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3055\u308c\u308b\u69d8\u3092\u898b\u3066\u60a9\u3093\u3067\u3044\u305f\u304c\u3001\u3075\u3068\u300c\u3053\u308c\u306fIP\u30a2\u30c9\u30ec\u30b9\u3067\u30a2\u30af\u30bb\u30b9\u3055\u308c\u305f\u6642\u306bFQDN\u3067\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3088\u3046\u306b\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3057\u3066\u3044\u308b\u306e\u3067\u306f\uff1f\u300d\u3068\u601d\u3044\u3064\u3044\u3066\/etc\/hosts<\/code>\u306b\u305d\u306e\u30c9\u30e1\u30a4\u30f3\u540d\u306e\u30a8\u30f3\u30c8\u30ea\u3092\u8ffd\u52a0\u3057\u3066\u30a2\u30af\u30bb\u30b9\u3057\u3066\u307f\u305f\u3089\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3055\u308c\u305a\u306b\u30a2\u30af\u30bb\u30b9\u3067\u304d\u305f\u3002<\/p>\n\n\n\n
\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u30b9\u30ad\u30e3\u30f3\u3092\u3059\u308b\u3068\/cmsadmin<\/code>\u3068\/ftp<\/code>\u304c\u898b\u3064\u304b\u308a\u3001\/ftp<\/code>\u5185\u306b\u30e6\u30fc\u30b6\u540d\u3068\u30d1\u30b9\u30ef\u30fc\u30c9\u304c\u66f8\u304b\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u304c\u3042\u308b\u306e\u3067\/cmsadmin<\/code>\u306b\u884c\u3063\u3066\u305d\u306e\u60c5\u5831\u3092\u5165\u308c\u308b\u3068\u30ed\u30b0\u30a4\u30f3\u3067\u304d\u308b\u3002
\u30ed\u30b0\u30a4\u30f3\u5f8c\u3001\u30e1\u30cb\u30e5\u30fc\u304b\u3089\u30b7\u30b9\u30c6\u30e0\u60c5\u5831\u3092\u63a2\u3059\u3068\u6c42\u3081\u3066\u3044\u308b\u60c5\u5831\u304c\u5f97\u3089\u308c\u308b\u3002<\/p>\n\n\n\n
FLAG: flag{9.2.2.0, Revision: 14877}<\/code><\/pre>\n\n\n\n
FileExtract [10 pt]<\/h3>\n\n\n\n
pcap\u5185\u306e\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30d7\u30ed\u30c8\u30b3\u30eb\u306fFTP\u306e\u307f\u306a\u306e\u3067FTP\u3067\u30d5\u30a3\u30eb\u30bf\u3059\u308b\u3068\u3053\u3093\u306a\u611f\u3058\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
s3cr3t.zip<\/code>\u3068\u3044\u3046\u30d5\u30a1\u30a4\u30eb\u3092\u8ee2\u9001\u3057\u3066\u3044\u308b\u306e\u3067\u3001Wireshark\u306e\u30a8\u30af\u30b9\u30dd\u30fc\u30c8\u6a5f\u80fd\u3067\u53d6\u308a\u51fa\u3057\u3066\u3084\u308b\u3002<\/p>\n\n\n
\n
\"\"<\/a><\/figure>\n<\/div>\n\n\n
\u5c55\u958b\u3057\u3088\u3046\u3068\u3057\u3066\u307f\u308b\u3068\u30d1\u30b9\u30ef\u30fc\u30c9\u304c\u304b\u304b\u3063\u3066\u3044\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002\u3053\u3053\u3067\u3001Wireshark\u306e\u753b\u9762\u306b\u623b\u3063\u3066\u3088\u304f\u898b\u3066\u307f\u308b\u3068\u3001\u30e6\u30fc\u30b6\u304canonymouse<\/code>\u3067\uff08anonymous<\/code>\u3067\u306f\u306a\u3044\uff09\u30d1\u30b9\u30ef\u30fc\u30c9\u304cbr2fWWJjjab3<\/code>\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002\u3053\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u3092\u4f7f\u3063\u3066zip\u30d5\u30a1\u30a4\u30eb\u304c\u5c55\u958b\u3067\u304d\u3066\u3001\u4e2d\u306e\u30d5\u30a1\u30a4\u30eb\u306b\u30d5\u30e9\u30b0\u304c\u66f8\u3044\u3066\u3042\u308b\u3002<\/p>\n\n\n\n
FLAG: flag{6qhFJSHAP4A4}<\/code><\/pre>\n\n\n\n
Exploit [20 pt]<\/h3>\n\n\n\n
Discovery\u3067\u3053\u306eCMS\u304cwebEdition\u3068\u3044\u3046\u3082\u306e\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u3063\u305f\u306e\u3067\u3001ExploitDB\u3067\u8abf\u3079\u308b\u3068\u3001\u4f7f\u3048\u305d\u3046\u306aRCE<\/a>\u304c\u898b\u3064\u304b\u3063\u305f\u3002
\u3057\u304b\u3057\u3001\u3053\u308c\u3092\u8a66\u305d\u3046\u3068\u601d\u3063\u3066\u3082\u91cd\u304f\u3066\u65b0\u898f\u30da\u30fc\u30b8\u4f5c\u6210\u3082\u307e\u307e\u306a\u3089\u305a\u3001\u3055\u3089\u306b5\u5206\u3067\u30ea\u30bb\u30c3\u30c8\u3055\u308c\u308b\u3068\u3044\u3046\u9b3c\u4ed5\u69d8\u306e\u305f\u3081\u5168\u7136\u3067\u304d\u306a\u3044\u307e\u307e\u7d42\u4e86\u3002<\/p>\n\n\n\n
DO_tHe_best [20 pt]<\/h3>\n\n\n\n
\u540d\u524d\u306e\u5927\u6587\u5b57\u90e8\u5206\u3092\u629c\u304d\u51fa\u3059\u3068DOH\u3068\u306a\u308b\u306e\u3067\u3001DNS over HTTPS\u306e\u554f\u984c\u3067\u3042\u308b\u3068\u63a8\u6e2c\u3067\u304d\u308b\u3002\u30dd\u30fc\u30c8\u30b9\u30ad\u30e3\u30f3\u3059\u308b\u3068\u5b9f\u969b\u306b443\u304c\u958b\u3044\u3066\u3044\u305f\u3002<\/p>\n\n\n\n
\u81ea\u5206\u3067DNS over HTTPS (DoH)\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u51fa\u3057\u305f\u3044 – 1.1.1.1\u3068\u304bGoogle Public DNS\u3068\u304b – nwtgck \/ Ryo Ota<\/a>\u3092\u53c2\u8003\u306b1.1.1.1<\/code>\u5411\u3051\u306e\u30af\u30a8\u30ea\u3092\u51fa\u3057\u3066\u307f\u305f\u3089\u306a\u3093\u304b\u3046\u307e\u304fDoH\u3067\u304d\u305f\u611f\u3058\u3002
\u305f\u3060\u3057\u3001\u3053\u306e\u5f8c\u304c\u308f\u304b\u3089\u306a\u304b\u3063\u305f\u3002\u3044\u308d\u3044\u308d\u8a66\u3057\u3066\u307f\u3066\u30c0\u30e1\u3060\u3063\u305f\u3002st98\u6c0f\u306ewriteup<\/a>\u3092\u898b\u308b\u3068\u9006\u5f15\u304d\u3067\u3044\u3051\u305f\u3089\u3057\u3044\u3002\u9006\u5f15\u304d\u306f\u8a66\u3057\u3066\u3044\u305f\u3093\u3060\u3051\u3069\u3001d.b.c.a.in-addr.arpa<\/code>\u306b\u3057\u306a\u304d\u3083\u3044\u3051\u306a\u3044\u3053\u3068\u3092\u3059\u3063\u304b\u308a\u5fd8\u308c\u3066\u3044\u305f\u3002\u30b3\u30de\u30f3\u30c9\u3058\u3083\u306a\u304f\u3066\u5b9f\u969b\u6d41\u308c\u308b\u30d7\u30ed\u30c8\u30b3\u30eb\u3092\u7406\u89e3\u3059\u308b\u3053\u3068\u306f\u5927\u4e8b\u3060\u306d\u3002<\/p>\n\n\n\n
Pivot [30 pt]<\/h3>\n\n\n\n
\u4e0e\u3048\u3089\u308c\u305f\u30ed\u30b0\u30a4\u30f3\u60c5\u5831\u3067SSH\u30ed\u30b0\u30a4\u30f3\u3059\u308b\u3068\u3001\u30db\u30fc\u30e0\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u306bsecret.txt<\/code>\u304c\u3042\u308b\u304c\u3001\u30d1\u30fc\u30df\u30c3\u30b7\u30e7\u30f3\u304c\u7121\u304f\u8aad\u3081\u306a\u3044\u3002
Setuid\u3055\u308c\u305f\u30d0\u30a4\u30ca\u30ea\u3092\u63a2\u3059\u3068base64<\/code>\u304c\u3042\u3063\u305f\u306e\u3067\u3053\u308c\u3067BASE64\u30a8\u30f3\u30b3\u30fc\u30c9\u2192\u30c7\u30b3\u30fc\u30c9\u3057\u3066\u30d5\u30a1\u30a4\u30eb\u306e\u4e2d\u8eab\u3092\u78ba\u8a8d\u3067\u304d\u308b\u3002
\u4e2d\u306b\u306fMariaDB\u306e\u30af\u30ec\u30c7\u30f3\u30b7\u30e3\u30eb\u304c\u66f8\u3044\u3066\u3042\u308b\u3002\u306f\u3066\u3001MariaDB\u306f\u3069\u3053\u306b\u3042\u308b\u306e\u304b\u3002nmap<\/code>\u3067\u63a2\u3057\u305f\u3044\u304cSSH\u30ed\u30b0\u30a4\u30f3\u3057\u305f\u5148\u306b\u306fnmap<\/code>\u304c\u5165\u3063\u3066\u306a\u3044\u3002SSH\u306f\u30c0\u30a4\u30ca\u30df\u30c3\u30af\u30d5\u30a9\u30ef\u30fc\u30c7\u30a3\u30f3\u30b0\u304c\u3067\u304d\u308b\u306e\u3067\u305d\u308c\u7d4c\u7531\u3067\u3046\u307e\u3044\u3053\u3068\u3067\u304d\u306a\u3044\u304b\u3068\u63a2\u3057\u3066\u3044\u305f\u3089ProxyChains\u3092\u4f7f\u3048\u3070\u3067\u304d\u308b\u3068\u3044\u3046\u60c5\u5831<\/a>\u3092\u898b\u3064\u3051\u305f\u3002\u4fbf\u5229\u306a\u306e\u3067\u899a\u3048\u3066\u304a\u3053\u3046\u3002<\/p>\n\n\n\n
SSH\u7d4c\u7531\u306e\u30dd\u30fc\u30c8\u30b9\u30ad\u30e3\u30f3\u3067\u898b\u3064\u3051\u305fMariaDB\u306b\u53d6\u5f97\u3057\u305f\u30af\u30ec\u30c7\u30f3\u30b7\u30e3\u30eb\u3067\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u30c7\u30fc\u30bf\u30d9\u30fc\u30b9\u5185\u3092\u6f01\u308b\u3068\u30d5\u30e9\u30b0\u304c\u898b\u3064\u304b\u3063\u305f\u3002<\/p>\n\n\n\n
\u306a\u304a\u3001Pure bash TCP portscan<\/a>\u3068\u3044\u3046\u306e\u3082\u3042\u308b\u3089\u3057\u3044\u3002\u3053\u308c\u3082\u4fbf\u5229\u306a\u306e\u3067\u899a\u3048\u3066\u304a\u3053\u3046\u3002<\/p>\n\n\n\n
FLAG: flag{p!V071ng_M31s73r}<\/code><\/pre>\n\n\n\n
Programming<\/h2>\n\n\n\n
Logistic Map [10 pt]<\/h3>\n\n\n\n
\u305d\u306e\u307e\u307e\u8a08\u7b97\u3059\u308b\u3060\u3051\u3002<\/p>\n\n\n
\ni = 0\nr = [0] * 10000\nr[0] = 0.3\n\nfor i in range(9999):\n    r[i+1] = 3.99 * r[i] * (1 - r[i])\n\nprint(r[9999])\n<\/pre><\/div>\n\n\n
FLAG: flag{0.8112735}<\/code><\/pre>\n\n\n\n
Randomness Extraction [20 pt]<\/h3>\n\n\n\n
\u30b0\u30b0\u3063\u305f\u3089\u30b3\u30fc\u30c9\u304c\u51fa\u3066\u304d\u305f<\/a>\u3002\u3053\u3053\u306evon_neumann.py<\/code>\u3092\u4f7f\u3063\u305f\u3060\u3051\u3002\u30d7\u30ed\u30b0\u30e9\u30df\u30f3\u30b0\u3057\u3066\u306a\u3044\u3002\u3068\u3066\u3082\u826f\u304f\u306a\u3044\u3067\u3059\u306d\u3002\u51fa\u529b\u30d5\u30a1\u30a4\u30eb\u3092strings<\/code>\u306b\u304b\u3051\u308b\u3068\u4e2d\u306b\u30d5\u30e9\u30b0\u304c\u3042\u308b\u3002<\/p>\n\n\n\n
FLAG: flag{3TcPs8QFcX}<\/code><\/pre>\n\n\n\n
XML Confectioner [20 pt]<\/h3>\n\n\n\n
\u6761\u4ef6\u3092\u6e80\u305f\u3059\u3082\u306e\u3092\u63a2\u3059\u30b3\u30fc\u30c9\u3092\u66f8\u304f\u3002\u3082\u3046\u3061\u3087\u3063\u3068\u30b9\u30de\u30fc\u30c8\u306a\u66f8\u304d\u65b9\u304c\u3042\u308b\u306e\u304b\u3082\u3057\u308c\u306a\u3044\u3051\u3069\u30b9\u30c8\u30ec\u30fc\u30c8\u30d5\u30a9\u30ef\u30fc\u30c9\u306b\u3002<\/p>\n\n\n
\nimport xml.etree.ElementTree as ET\n\ntree = ET.parse("sweets.xml")\norders = tree.getroot()\n\nfor batch in orders:\n    sweets = [ 0, 0, 0 ] # candy, cookie, icecream\n    icecream_amount_min = 9999999\n    candy_weight_sum = 0\n    candy_shape = set()\n    cookie_condition_meet = False\n    for child in batch:\n        if child.tag.endswith("candy"):\n            sweets[0] = sweets[0] + 1\n            weight = child.attrib["{http:\/\/xml.vlc-cybercontest.com\/candy}weight"][:-1]\n            shape = child.attrib["{http:\/\/xml.vlc-cybercontest.com\/candy}shape"]\n            candy_weight_sum = candy_weight_sum + float(weight)\n            candy_shape.add(shape)\n        if child.tag.endswith("cookie"):\n            sweets[1] = sweets[1] + 1\n            radius = child.attrib["{http:\/\/xml.vlc-cybercontest.com\/cookie}radius"][:-2]\n            kind = child.attrib["{http:\/\/xml.vlc-cybercontest.com\/cookie}kind"]\n            if kind == "icing" and float(radius) >= 3.0:\n                cookie_condition_meet = True\n        if child.tag.endswith("icecream"):\n            sweets[2] = sweets[2] + 1\n            amount = child.attrib["{http:\/\/xml.vlc-cybercontest.com\/icecream}amount"][:-1]\n            if float(amount) < icecream_amount_min:\n                icecream_amount_min = float(amount)\n            \n    if sweets[2] >= 2 and icecream_amount_min >= 105 and candy_weight_sum > 28.0 and len(candy_shape) >= 5 and cookie_condition_meet == True:\n        maximum_cookie_radius = 0\n        maximum_cookie_flag = ""\n        for child in batch:\n            if child.tag.endswith("cookie"):\n                radius = child.attrib["{http:\/\/xml.vlc-cybercontest.com\/cookie}radius"][:-2]\n                if float(radius) > maximum_cookie_radius:\n                    maximum_cookie_radius = float(radius)\n                    maximum_cookie_flag = child.text\n\n        print(maximum_cookie_flag)\n<\/pre><\/div>\n\n\n
FLAG: flag{sZ8d5FbntXbL9uwP}<\/code><\/pre>\n\n\n\n
Twisted Text [30 pt]<\/h3>\n\n\n\n
\u307e\u305f\u3082\u3084\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u66f8\u304b\u305a\u306b\u89e3\u3044\u305f\u3002\u6b63\u3057\u304f\u66f8\u3051\u308b\u81ea\u4fe1\u304c\u306a\u304b\u3063\u305f\u306e\u3067\u3002<\/p>\n\n\n\n
CLIP STUDIO PAINT<\/a>\u304c\u6e26\u5dfb\u304d\u5909\u5f62\u3067\u304d\u308b\u3068\u306e\u3053\u3068\u306a\u306e\u3067\u3053\u308c\u3092\u4f7f\u3063\u3066\u9006\u5909\u63db\u3057\u3066\u3084\u308c\u3070\u308f\u304b\u308b\u3093\u3058\u3083\u306d\u30fc\u306e\u3068\u3044\u3046\u305f\u304f\u3089\u307f\u3002<\/p>\n\n\n
\n
\"\"<\/a>
\u5143\u306eTwisted.png<\/figcaption><\/figure>\n<\/div>\n\n
\n
\"\"<\/a>
\u5909\u5f62\u3057\u3066\u307f\u305f\u306e\u56f3<\/figcaption><\/figure>\n<\/div>\n\n\n
\u30d1\u30e9\u30e1\u30fc\u30bf\u306e\u610f\u5473\u3092\u5168\u7136\u308f\u304b\u3089\u306a\u3044\u307e\u307e\u9069\u5f53\u306b\u3044\u3058\u3063\u3066\u305f\u3089\u30d5\u30e9\u30b0\u306e\u6700\u521d\u3068\u6700\u5f8c\u304c\u898b\u3048\u305f\u306e\u3067\u9593\u3092\u8aad\u307f\u53d6\u3063\u3066\u5165\u529b\u3057\u305f\u3089\u6b63\u89e3\u3060\u3063\u305f\u3002<\/p>\n\n\n\n
FLAG: flag{LHZGhq3WTXvo}<\/code><\/pre>\n\n\n\n
Trivia<\/h2>\n\n\n\n
The Original Name of AES [10 pt]<\/h3>\n\n\n\n
Wikipedia<\/a>\u3092\u898b\u308c\u3070\u66f8\u3044\u3066\u3042\u308b\uff08\u30b9\u30da\u30eb\u304c\u4e0d\u5b89\u3060\u3063\u305f\u306e\u3067\u78ba\u8a8d\u3057\u305f\uff09<\/p>\n\n\n\n
FLAG: flag{Rijndael}<\/code><\/pre>\n\n\n\n
CVE Record of Lowest Number [10 pt]<\/h3>\n\n\n\n
\u3044\u308d\u3044\u308d\u30b0\u30b0\u3063\u3066\u307f\u308b\u3082\u306a\u304b\u306a\u304b\u30d4\u30f3\u30dd\u30a4\u30f3\u30c8\u306e\u60c5\u5831\u304c\u898b\u3064\u304b\u3089\u305a\u3001MITRE\u306eCVE\u306e\u30da\u30fc\u30b8\u3067\u5168\u30c7\u30fc\u30bf\u3092\u53d6\u5f97<\/a>\uff08\u5168\u30c7\u30fc\u30bf\u306a\u306e\u3067\u30b5\u30a4\u30ba\u304c\u3067\u304b\u3044\u3002\u6ce8\u610f\uff09\u3059\u308b\u3053\u3068\u3067\u3084\u3063\u3068\u78ba\u8a8d\u3067\u304d\u305f\u3002<\/p>\n\n\n\n
FLAG: flag{ip_input.c}<\/code><\/pre>\n\n\n\n
MFA Factors [10 pt]<\/h3>\n\n\n\n
\u3053\u308c\u306f\u6697\u8a18\u554f\u984c\u3002\u6240\u6301\u3058\u3083\u306a\u304f\u3066\u6240\u6709\u3068\u3059\u308b\u30b1\u30fc\u30b9\u3082\u3042\u308b\u3093\u3060\u3051\u3069\u305d\u308c\u306f\u901a\u3063\u305f\u306e\u3060\u308d\u3046\u304b\u3002<\/p>\n\n\n\n
FLAG: flag{\u6240\u6301\u30fb\u751f\u4f53\u30fb\u77e5\u8b58}<\/code><\/pre>\n\n\n\n
Web<\/h2>\n\n\n\n
Browsers Have Local Storage [10 pt]<\/h3>\n\n\n\n
\u6307\u5b9a\u3055\u308c\u305f\u30b5\u30fc\u30d0\u306b\u30a2\u30af\u30bb\u30b9\u3057\u3066\u30d6\u30e9\u30a6\u30b6\u306eDeveloper Tools\u3092\u958b\u304dLocal storage\u3092\u53c2\u7167\u3059\u308b\u3068\u30d5\u30e9\u30b0\u304c\u3042\u308b\u3002<\/p>\n\n\n\n
FLAG: FLAG{Th1s_1s_The_fIrst_flag}<\/code><\/pre>\n\n\n\n
Are You introspective? [10 pt]<\/h3>\n\n\n\n
GraphQL\u306e\u30a8\u30f3\u30c9\u30dd\u30a4\u30f3\u30c8\u3092\u898b\u3064\u3051\u3089\u308c\u306a\u304b\u3063\u305f\u3002\u4f7f\u3063\u305fwordlist\u304c\u826f\u304f\u306a\u304b\u3063\u305f\u307f\u305f\u3044\u3002\u76ee\u7684\u306b\u5fdc\u3058\u305f\u9069\u5207\u306awordlist\u306e\u9078\u629e\u306f\u91cd\u8981\u3002<\/p>\n\n\n\n
Insecure [20 pt]<\/h3>\n\n\n\n
\u81ea\u5206\u306e\u30d7\u30ed\u30d5\u30a3\u30fc\u30eb\u3092\u898b\u308b\u306b\u306fshow_profile.php?id=ID<\/code>\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u304c\u3001\u305d\u306e\u969bprofile_success.php<\/code>\u306b\u30ea\u30c0\u30a4\u30ec\u30af\u30c8\u3055\u308c\u3066\u305d\u3053\u3067\u30d7\u30ed\u30d5\u30a3\u30fc\u30eb\u304c\u8868\u793a\u3055\u308c\u308b\u3002
\u4e00\u65b9\u4ed6\u4eba\u306e\u30d7\u30ed\u30d5\u30a3\u30fc\u30eb\u3092\u898b\u3088\u3046\u3068\u3059\u308b\u3068profile_error.php<\/code>\u306b\u98db\u3070\u3055\u308c\u3066\u6012\u3089\u308c\u308b\u3002
\u898b\u305f\u3044\u306e\u306fid=0<\/code>\u306e\u30e6\u30fc\u30b6\u306e\u30d7\u30ed\u30d5\u30a3\u30fc\u30eb\u306a\u306e\u3067\u3001show_profile.php?id=0<\/code>\u306b\u30a2\u30af\u30bb\u30b9\u3057\u3066\u304b\u3089profile_success.php<\/code>\u306b\u30a2\u30af\u30bb\u30b9\u3057\u305f\u3089\u30d5\u30e9\u30b0\u304c\u8868\u793a\u3055\u308c\u305f\u3002<\/p>\n\n\n\n
FLAG: FLAG{1qaz7ujmbgt5}<\/code><\/pre>\n\n\n\n
Variation [20 pt]<\/h3>\n\n\n\n
\u624b\u3092\u4ed8\u3051\u3089\u308c\u305a\u3002<\/p>\n\n\n\n
Bruteforce [30 pt]<\/h3>\n\n\n\n
\u4e0e\u3048\u3089\u308c\u305f\u30bd\u30fc\u30b9\u30b3\u30fc\u30c9\u3092\u898b\u308b\u3068test<\/code>\u30e6\u30fc\u30b6\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u304ctest<\/code>\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002admin<\/code>\u30e6\u30fc\u30b6\u306e\u30d1\u30b9\u30ef\u30fc\u30c9\u306f\u4f0f\u305b\u3089\u308c\u3066\u3066\u308f\u304b\u3089\u306a\u3044\u3002JWT\u306e\u30ad\u30fc\u3082\u308f\u304b\u3089\u306a\u3044\u3002
test<\/code>\u30e6\u30fc\u30b6\u3067\u30ed\u30b0\u30a4\u30f3\u3057\u3066\u307f\u308b\u3068\u3001JWT\u304c\u8fd4\u3063\u3066\u304f\u308b\u3002\u3055\u3066\u6b21\u306b\u4f55\u3092\u3059\u308b\u304b\u3002JWT\u306e\u4e2d\u3067test<\/code>\u3068\u306a\u3063\u3066\u3044\u308b\u90e8\u5206\u3092admin<\/code>\u306b\u3057\u3066\u307f\u3066\u3082\u7f72\u540d\u306e\u30ad\u30fc\u304c\u308f\u304b\u3089\u306a\u3044\u306e\u3067JWT\u3092\u751f\u6210\u3067\u304d\u306a\u3044\u3002\u5f37\u5f15\u306b\u9593\u9055\u3063\u305f\u7f72\u540d\u306b\u3057\u305f\u308a\u3001alg<\/code>\u3092none<\/code>\u306b\u3057\u3066\u307f\u3066\u3082\u30c0\u30e1\u3002
\u6b63\u89e3\u306f\u984c\u540d\u306e\u901a\u308aBruteforce\u3059\u308b\u3053\u3068\u3002JWT\u3092\u30d5\u30a1\u30a4\u30eb\u306b\u4fdd\u5b58\u3057\u3066rockyou.txt<\/code>\u3092\u4f7f\u3063\u3066John\u306b\u304b\u3051\u308b\u3068\u30af\u30e9\u30c3\u30af\u3067\u304d\u3066\u3001JWT\u306e\u30ad\u30fc\u304cconankun<\/code>\u3067\u3042\u308b\u3053\u3068\u304c\u308f\u304b\u308b\u3002<\/p>\n\n\n\n
\u30e6\u30fc\u30b6\u3092admin<\/code>\u306b\u3057\u3066\u751f\u6210\u3057\u305fJWT\u3092\u4f7f\u3063\u3066\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3053\u3068\u3067\u30b7\u30b9\u30c6\u30e0\u5185\u306e\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u3081\u308b\u3088\u3046\u306b\u306a\u308b\u3002\u3057\u304b\u3057\/proc\/self\/cmdline<\/code>\u306a\u3069\u3044\u308d\u3044\u308d\u3068\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u3093\u3067\u307f\u3066\u3082\u4f55\u3082\u308f\u304b\u3089\u306a\u3044\u3002\u308f\u304b\u3089\u306a\u3044\u307e\u307e\u6642\u9593\u7d42\u4e86\u3002<\/p>\n\n\n\n
\u6b63\u89e3\u306f\/proc\/<PID>\/cmdline<\/code>\u3092\u8aad\u3080\u3053\u3068\u3060\u3063\u305f\u3089\u3057\u3044\u3002Docker\u3067\u52d5\u3044\u3066\u3044\u308b\u306e\u3067\u30d7\u30ed\u30bb\u30b9ID\u306e\u4e88\u6e2c\u306f\u5341\u5206\u3067\u304d\u308b\u306e\u3053\u3068\u3002\u306a\u308b\u307b\u3069\u3002\u4e88\u6e2c\u3067\u304d\u306a\u304f\u3066\u3082\u6570\u5343\u304f\u3089\u3044\u3060\u3063\u305f\u3089\u7dcf\u5f53\u305f\u308a\u3057\u3066\u3082\u308f\u304b\u3063\u305f\u304b\u3082\u3002\u305d\u3046\u304b\u3001\u3053\u3053\u3082Bruteforce\u304b\u3002<\/p>\n\n\n\n
\u611f\u60f3<\/h2>\n\n\n\n
\u524d\u56de\u306b\u5f15\u304d\u7d9a\u304d\u3061\u3087\u3046\u3069\u3044\u3044\u96e3\u6613\u5ea6\u306e\u826f\u8cea\u306a\u554f\u984c\u304c\u591a\u304b\u3063\u305f\u3068\u611f\u3058\u308b\u3002\u4eca\u5f8c\u3082\u540c\u3058\u304f\u3089\u3044\u306e\u30af\u30aa\u30ea\u30c6\u30a3\u3067\u7d9a\u3051\u3066\u6b32\u3057\u3044\u3002\u3044\u3064\u304b\u5168\u554f\u89e3\u3051\u308b\u3088\u3046\u306b\u306a\u308a\u305f\u3044\u306a\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u53c2\u52a0\u3057\u3066430pt\u306710\u4f4d\u3002\u524d\u56de\u306f16\u4f4d\u3060\u3063\u305f\u306e\u3067\u3061\u3087\u3063\u3068\u4e0a\u6607\u3002\u30ae\u30ea\u30ae\u30ea10\u4f4d\u306b\u5165\u3063\u305f\u306e\u3067Top10\u306e\u30b0\u30e9\u30d5\u306b\u540d\u524d\u304c\u6b8b\u3063\u305f\u3002<\/p>\n","protected":false},"author":1,"featured_media":877,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"cybocfi_hide_featured_image":"","footnotes":""},"categories":[14],"tags":[8],"class_list":["post-876","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf","tag-ctf"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/876","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/comments?post=876"}],"version-history":[{"count":6,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/876\/revisions"}],"predecessor-version":[{"id":918,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/posts\/876\/revisions\/918"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/media\/877"}],"wp:attachment":[{"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/media?parent=876"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/categories?post=876"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emeth.jp\/diary\/wp-json\/wp\/v2\/tags?post=876"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}