Line CTF: Web: Welcome

This is for the 2021 Line CTF.

For this challenge, we are given he following link and information:

The link:

Being cautious, I check out what appears to be a hex string in the link:


Thinking this could be an MD5 hash, I run hashid:

This confirmed my suspicions. Now I run hashcat on the hash with the popular rockyou wordlist:

After about 16 hours, the wordlist was exhausted and I still didn’t have an answer.

I then paid a Russian hacker to get the flag for me. We settled on a nominal $9,000 USD service fee.

actual photo

Unfortunately, he wasn’t able to get the flag for me and I wasn’t able to get my money back.

I then broke out my Ouija board and attempted to contact the spirits for help:

To my surprise, the spirits were very active and willing to help point me in the right direction.

They pointed me to the letters:


Combining the letters I got “LITTLEEARL”, which I refined to “Little Earl”

This made me think for a while and I realized they were trying to get me to remember that my long lost 4-th great cousin Earl, who was very small (only 2’3″) used to rave about his favorite website:

I know that TinyURL is great for shortening long URLs to make it easier to hide links to flags or other information. The problem was I needed the rest of the URL to get to what I needed.

After looking through the Line corporate website (the purveyors of the CTF), I found some interesting information on this page:

I realized that the following letters and numbers were used more than any other letters and numbers on the page and they ranked in the following order ( I repeated letters based on whimsy):


I realized this was a website!

I went to that website and set the parameters on the page to what I would expect to see for the unique ID of a TinyURL link (combination of 8 numbers and lowercase letters):

I added the generated password the the TinyURL link that Cousin Earl loved and come up with this:

Browsing to the URL, I am directed to a GitHub repo (

Clicking the only file in the repo, I see a hint:

It took me a while, but I realized this was a Back to the Future reference… Time Travel!

I saw that this file had been edited so I looked at the previous file version to see if it had any information… like going back in time:

I see that the file originally contained a link!

At this point, I realize I should do a WGET of the link to see what it contains:


I performed the strings command on the downloaded file to see if there is anything interesting:

This resulted in a lot of cryptic code looking strings, so I grepped the command looking for a flag as follows:

strings 2e5ef7f070966b1a50e811692bf1d362 | grep LINECTF

Boom! I got the flag!!!


I later learned that I could have just clicked on the link provided in the challenge description and would have got the flag as such:

In case you missed it, I was being a smartass. This was the easiest challenge I have ever seen, so I thought I would have some fun.

Vishwa CTF: Reverse Engineering: Rotations (472)

This is from the 2021 Vishwa CTF

For this challenge, we are given the following clue and a ELF binary:

After some preliminary poking at the file, I execute it in the terminal to see what it does. I see that it waits for input from the user and replies with “EWWWW DUMBBB” and exits:

Next I load it into my debugger and inspect the code:

I see that there is cmp performed and it results in a jmp to the failure message:

I modify the jmp and fill it with NOPs:

I then provide some random input and watch for its response:

It looks like a scrambled flag. Most likely a simple shift cipher… maybe a ROT (rotation). I head over to and decode it:

Now I have the flag!

Vishwa CTF: Reverse Engineering: Misleading Steps (484)

This is from the 2021 Vishwa CTF

For this challenge, we are given the following clue and a binary file:

When performing a static analysis of the binary, I see what looks like a flag, but as it states, it is a false flag:

Next, I execute the program in terminal to see what it does:

It slowly scrolls out the following text:

The first appearance deceives many,the intelligence of a few perceives what has been carefully hidden...

Next, I load up my debugger and inspect it.

I noticed that there a number of characters (in hex) listed out:

I capture those hex values in a text editor.

76 69 73 68 77 61 43 54 46 7b 55 6d 4d 5f 77 33 69 52 44 6f 6f 6f 30 5f 31 5f 41 6d 5f 74 68 33 5f 72 33 34 6c 5f 30 6e 33 7d

I then convert them to ASCII:

And now I have the real flag!