# CDFG20 Writeup

![CDFG20 Writeup](https://cdn.hashnode.com/res/hashnode/image/upload/v1680986844909/8a4d1b17-f2a4-43d7-bbc3-d99f67fcc508.jpeg)

Yet another Capture The Flag event !! This event was organized by year 2 students at my faculty. Thought their challenges were pretty interesting so here we goooo!

* * *

### Reversing

> Secret

### DESCRIPTION

Can you find my secret?  

ATTACHED FILES  
secret.java([download](https://cdn.discordapp.com/attachments/443024289801830445/736549326716665926/secret.java)).

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-29.png)

Upon inspection of the code, I realized that all the characters of flag are written separately and they are each given a position. After rearranging the characters I was given the flag :)

****Flag — — →** CDFG20**{**tH1s\_i5\_mY\_s3cRe7**}****

* * *

> Puzzle

### DESCRIPTION

Do you like puzzles? Julius sure does!  

ATTACHED FILES  
ilovepuzzles.java([download](https://cdn.discordapp.com/attachments/443024289801830445/736550175350194236/ilovepuzzles.java)).

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-30.png)

Upon inspection of the code, we see that there are arrays with the puzzle values visible to us. These are hex values. So I proceeded to decode them to ASCII and got this.

![CDFG20 Writeup](/content/images/2020/07/image-31.png)

Followed by that, I identified the string as a base64 string and decoded it. After that I was able to see the flag format but the values were messed up. I suspected that their might have been rotated. So I used ROT13 and brute forced the flag :)

    UFFTVDIwe2NIbU15M19mMHlJM3F9

![CDFG20 Writeup](/content/images/2020/07/image-32.png)

****Flag — — →** CDFG20**{**pUzZl3\_s0lV3d**}****

* * *

> Assembly

### DESCRIPTION

What does asm(0x354) return?

Note: The flag for this challenge will not be in the standard flag format

ATTACHED FILES  
asm.s([download](https://cdn.discordapp.com/attachments/443024289801830445/736553526473261096/asm.S)).

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-33.png)

This was the assembly code that I was given. The question was what would `asm(0x354)` return. If we followed the instructions we would have to add `0x8` to it and then subtract `0x3` from it. I didn't have much experience working with assembly code so I got a lil help from a friend for this one!

****Flag — — →** CDFG20**{**0x359**}****

* * *

### Cryptography

> Rip Headphone User

### DESCRIPTION

What is he trying to say?  

ATTACHED FILES  
Rip\_Headphone\_Users.wav([download](https://cdn.discordapp.com/attachments/443024289801830445/736558045265526825/Rip_Headphone_Users.wav)).

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-34.png)

At first I believed that this was Morse code with a ton of random filters applied to it but I couldn't get anything out of it. Moving on, I got this application called [Sonic Visualiser](https://www.sonicvisualiser.org/). I read online that I could analyze waveform with it.

After playing around with the software for awhile, I found out that there were 2 audio channels in the wav file. So I pulled up the spectrogram for it and found the flag there!

    Layer > Add spectrogram > channel 1

![CDFG20 Writeup](/content/images/2020/07/image-35.png)

****Flag — — →** CDFG20**{**pR37ty\_s1mple**}****

* * *

> Spaces

### DESCRIPTION

So much space.....

ATTACHED FILES  
nothingHere.txt([download](https://cdn.discordapp.com/attachments/443024289801830445/736559916093014086/nothingHere.txt)).

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-36.png)

At first glace, there was nothing in the file. After using hexdump on the file, this came up. Some google searches later, I arrived at [this](https://www.youtube.com/watch?v=guJX2s6eB_4) video by John Hammond.

Followed by that I installed stegsnow on kali and got to work. After some tries..this command gave me the flag.

    stegsnow -C nothingHere.txt

![CDFG20 Writeup](/content/images/2020/07/image-37.png)

****Flag — — →** CDFG20**{**b3h0ld\_th3\_pow3r**}****

* * *

> Jack and Jill

### DESCRIPTION

Free Flag and a little story.

ATTACHED FILES  
lil\_story.txt([download](https://cdn.discordapp.com/attachments/443024289801830445/736577915185004635/lil_story.txt))  
flag.txt([download](https://cdn.discordapp.com/attachments/443024289801830445/736577975746560082/flag.txt))

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-38.png)

This appeared to be some kinda cipher at first. After some time, I got the following clue from the admins.

    Jack and Jill went up the hill.

Couple google searches later, I found out about the [hill cipher](https://www.dcode.fr/hill-cipher). However, I needed matrix values to decrypt the flag. This is where I turned to the story. It appeared to have 4 numbers  in them. I used those as matrix values and I got the flag!

![CDFG20 Writeup](/content/images/2020/07/image-39.png)

After I had gotten the main contents, I substituted the newly found values back into the flag format with the number and I got the flag :)

****Flag — — →** CDFG20**{**m0un74in\_cl1mbers**}****

* * *

> Help me!

### DESCRIPTION

We intercepted a secret message from a movie pirate but it's all gibberish?  
After looking through the files, there was a `wierd_map.txt` that stood out but we're not sure what to make of it...

ATTACHED FILES  
weird\_map.txt([download](https://cdn.discordapp.com/attachments/443024289801830445/736577915185004635/lil_story.txt))  
SECRET.txt([download](https://cdn.discordapp.com/attachments/443024289801830445/736577975746560082/flag.txt))

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-40.png)

This appeared to be some kinda random text/script at first glance. After inspection the flag seemed to have been placed in the `SECRET.txt` file but the alphabets were rotated according to the `weird_map.txt`  

![CDFG20 Writeup](/content/images/2020/07/image-41.png)

After substituting the values, I was given the flag.

    CDFGq-u4cc_b-nkc_.2,$t:y
    CDFG20{b33_m0vi3_scr1pt}

****Flag — — →** CDFG20**{**b33\_m0vi3\_scr1pt**}****

* * *

### OSINT

> Shameless Self Promotion

### DESCRIPTION

Riley has not returned home since Monday. We received an an anonymous tip that she had been murdered by her best friend. Could you help us identify her friend's instagram page? This is Riley's twitter account:

[https://twitter.com/RileyPe45209313](https://twitter.com/RileyPe45209313)

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-42.png)

This challenge was pretty simple. This tweet led me to an Instagram page where I then found the flag.

![CDFG20 Writeup](/content/images/2020/07/image-43.png)

****Flag — — →** CDFG20**{**tpcdfsig**}****

* * *

### Misc

> nc

### DESCRIPTION

What does nc even mean?

nc ctf.cdfguardians.com 8888 nc 13.250.62.61 8888

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

This was a pretty straight forward challenge. I netcat into the port and the server gave me the flag.

![CDFG20 Writeup](/content/images/2020/07/image-44.png)

****Flag — — →** CDFG20{nEtc4T\_i5\_y0uR\_b35t\_fR13nD}**

* * *

> Secret in Chess

### DESCRIPTION

Here lies the secret to win every game.

ATTACHED FILES  
chess\_is\_fun.lpg([download](https://cdn.discordapp.com/attachments/443024289801830445/736609461011087420/chess_is_fun.jpg))

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/chess_is_fun.jpg)

This appeared to be some kind of steggo so I threw the image into my kali machine and ran strings on it!

    root@kali:~/Downloads# strings chess_is_fun.jpg 

![CDFG20 Writeup](/content/images/2020/07/image-45.png)

****Flag — — →** CDFG20{wh3r3\_4re\_youuuu}**

* * *

### Web

> knock knock

### DESCRIPTION

Can you help me to find my spare key?

[http://ctf.cdfguardians.com:12345/closed.html](http://ctf.cdfguardians.com:12345/closed.html) [http://13.250.62.61:12345/closed.html](http://13.250.62.61:12345/closed.html)

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-46.png)

I was overthinking this at the start. All I had to do was to change the URL to open and I got the flag.

****Flag — — →** CDFG20{1lf3\_saverrrr}**

* * *

> knock knock

### DESCRIPTION

Can you help me to find my spare key?

[http://ctf.cdfguardians.com:12345/closed.html](http://ctf.cdfguardians.com:12345/closed.html) [http://13.250.62.61:12345/closed.html](http://13.250.62.61:12345/closed.html)

— — — — — — — — — — — — — — — — — — — — — — — — — — — — — — —

![CDFG20 Writeup](/content/images/2020/07/image-47.png)

This was pretty straight forward too! Looking at the source code of the site gave me the flag!

![CDFG20 Writeup](/content/images/2020/07/image-48.png)

****Flag — — →** CDFG20{n0th1ng\_1s\_fr3e}**

* * *

And....thats a wrap for CDFG20! :) This was how I solved most of the challenges!

~Nee