This is from the Shadow CTF.
Disclaimer: I did this challenge quick and dirty in order to get first blood.
For this challenge, we are told that there is a program that can decrypt the flag for us using the right password. The password is a number between 16000 and 20000. We are provided a zip file containing an ELF binary (numgen)and another zip file that contains a bunch of small images. These images are named 0.png … 39.png. They are pictures of random letters, numbers, and characters.
Running the executable I am told it wants a number argument.
I provide a number (1600) and get a series of numbers as a response.
Looking at the image file names with relation to the numbers in the response, I see it translates to gibberish. I can make an educated guess that the flag should end with a “}”, which is 39.png and the the first character should be an “S” (7.png) or an “F” (32.png) based on the CTF flag format.
Using this method, I can write a script to try all possibilities from 16000 to 20000 (4000 possibilities).
#!/bin/bash
for i in {16000..20000}
do
./numgen $i
done
I can run the script and output the results to a file. Yes, a more elegant solution could be crafted that would grep for the right results, but it is only a 24-hour CTF.
/runnum.sh > numgenout.txtThe output file contains 8,000 lines (the resulting numbers and the “Randomizing names of images …” string.
7 5 8 39 11 33 33 33 23 6 8 21 38 36 38 14 9 20 24
Randomizing names of images ...
5 8 39 11 33 33 33 23 6 17 8 38 36 38 14 9 20 24 18
Randomizing names of images ...
8 39 11 33 33 33 23 6 17 21 8 36 38 14 9 20 24 18 27
Randomizing names of images ...
39 11 33 33 33 23 6 17 21 38 8 38 14 9 20 24 18 27 17
Randomizing names of images ...
11 33 33 33 23 6 17 21 38 36 8 ................................Quick and dirty I copy the lines into excel (yeah, I know) and drop all cells containing the “Randomizing names of images …” string.
I create a quick formula to get the 1 or two digit number before the first space in the cell and then throw it in the “B” column.
=LEFT(A1,(FIND(" ",A1,1)-1))
A quick filter to only show the cells that start with 7 or 32 (S or F), and I get 189 cells.
I then do a quick filter using “ends with” and use 18 (“}”) as the criteria.
That narrows it down to 9 possible cells.
I now look for the second letter based on my assumption that the first word is “shadow” or “flag”. The numbers should be either 6, 4, or 31 (there are two “L” images).I do this with another filter.
It gives me only one result:
A quick and dirty translation using the images gives me the flag:
SHADOWCTF{W3LLD0N3}After submitting the flag for first blood, I make an HTML file to make the flag look pretty:
<html>
<head><title>Gimmie The Flag</title></head>
<body>
<center>
<p>7 6 22 13 34 8 17 0 32 39 8 19 4 31 30 25 2 14 18</p>
<p><img src="7.png"><img src="6.png"><img src="22.png"><img src="13.png"><img src="34.png"><img src="8.png"><img src="17.png"><img src="0.png"><img src="32.png"><img src="39.png"><img src="8.png"><img src="19.png"><img src="4.png"><img src="31.png"><img src="30.png"><img src="25.png"><img src="2.png"><img src="14.png"><img src="18.png"></p>
</center>
</body>
</html>