Hackro[n] CTF 2025 — Jerry_h4ck

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

#!/usr/bin/env python3
import subprocess, sys, re

if len(sys.argv) > 1:
    path = sys.argv[1]
else:
    path = "easychallenge.py"

try:
    proc = subprocess.run([sys.executable, path],
                          capture_output=True, text=True, timeout=10)
except Exception as e:
    print("Failed to run:", e); sys.exit(2)

out = (proc.stdout or "").strip()
err = (proc.stderr or "").strip()

m = re.search(r"SPL\{[^}]+\}", out)
if m:
    print("Flag:", m.group(0))
else:
    if re.fullmatch(r"[A-Za-z0-9_\-]{4,}", out):
        print("Flag: SPL{" + out + "}")
    elif out:
        print("Program output (no SPL{...} found):", out)
    else:
        print("No output. Stderr:\n", err)

1
2

<dead_drop42> yo, leaving the time capsule at old_portal
<otherguy> noted. comment contains pubkey id: ABC123

1
2
3
4

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: OpenPGP 1.0
Comment: FE5WUEBeqzXL3V4xYsrs4QUh607lZ54M0kQ0sNQUF8WgpUanxbUEeto+9jS7gTCDjXpZDXJElTUDult29e4UzeS3KWUjzwtRNtEZMhjbl5pDlqB0RiJihZnxihu5UCwGJx9cuaEYZclcQTI3lbs1+kq/BpHsvhag+K8tYTWJ2l+Kipym1G56g711FbgCuXk9g=
-----END PGP PUBLIC KEY BLOCK-----

1
2
3
4
5
6
7

01110011 → s
00110011 → 3
01100011 → c
01110010 → r
00110011 → 3
01110100 → t
00100001 → !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

hex_input = "51 4E 4A 7B 7A 39 32 39 39 64 31 79 30 31 38 35 32 39 36 31 61 7A 79 63 31 31 39 79 30 35 32 63 39 36 79 79 37 35 33 32 38 32 63 31 36 63 31 64 35 79 37 39 61 34 30 35 31 7A 63 30 32 32 30 39 38 38 38 33 7D"
s = bytes.fromhex(hex_input.replace(" ", "")).decode('ascii')

def shift_plus_two(ch):
    if 'a' <= ch <= 'z':
        return chr((ord(ch) - ord('a') + 2) % 26 + ord('a'))
    if 'A' <= ch <= 'Z':
        return chr((ord(ch) - ord('A') + 2) % 26 + ord('A'))
    return ch

decoded = ''.join(shift_plus_two(c) for c in s)
print(decoded)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

#!/usr/bin/env python3
from typing import List

# --- Input (the ciphertext payload we were given) ---
ciphertext = "S96fP0226b9L7bcf40{64e5d403d74ad}946ac55fa316df5b0671c5495795b23596eb"

# --- Rail-fence decrypt implementation (inverse of zigzag encryption) ---
def rail_fence_decrypt(cipher: str, rails: int) -> str: 
    if rails <= 1:
        return cipher
    n = len(cipher)
    # Build zigzag pattern (rail index for each plaintext position)
    pattern: List[int] = []
    rail = 0
    direction = 1
    for _ in range(n):
        pattern.append(rail)
        rail += direction
        if rail == rails - 1 or rail == 0:
            direction *= -1

    # Count how many chars go to each rail
    counts = [pattern.count(r) for r in range(rails)]
    # Split ciphertext into the rail pieces (row-by-row)
    parts: List[str] = []
    idx = 0
    for c in counts:
        parts.append(cipher[idx: idx + c])
        idx += c

    # Reconstruct plaintext by taking characters following the pattern
    positions = [0] * rails
    out_chars: List[str] = []
    for p in pattern:
        out_chars.append(parts[p][positions[p]])
        positions[p] += 1
    return ''.join(out_chars)

# --- Try multiple rails and look for SPL{...} ---
def find_flags_by_rail(cipher: str, min_rails=2, max_rails=16):
    hits = []
    for r in range(min_rails, max_rails + 1):
        dec = rail_fence_decrypt(cipher, r)
        if "SPL{" in dec:
            # Extract the first brace-enclosed substring starting at SPL{
            i = dec.find("SPL{")
            j = dec.find("}", i)
            flag_excerpt = dec[i:j+1] if (i != -1 and j != -1) else dec[i:i+80]
            hits.append((r, flag_excerpt, dec))
    return hits

if __name__ == "__main__":
    print("Ciphertext:", ciphertext)
    hits = find_flags_by_rail(ciphertext, min_rails=2, max_rails=16)
    if not hits:
        print("No 'SPL{' found for rails 2..16.")
    else:
        print(f"Found {len(hits)} candidate(s):\n")
        for r, frag, full in hits:
            print(f"--- rails = {r} ---")
            print("Extracted fragment:", frag)
            print("Full decrypted text:\n", full)
            print()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

#!/usr/bin/env python3

def solve_swedish_crypto_challenge():
    swedish_alphabet = {
        'Adam': 'A', 'Bertil': 'B', 'Caesar': 'C', 'David': 'D', 'Erik': 'E', 
        'Filip': 'F', 'Gustav': 'G', 'Helge': 'H', 'Ivar': 'I', 'Johan': 'J',
        'Kalle': 'K', 'Ludvig': 'L', 'Martin': 'M', 'Niklas': 'N', 'Olof': 'O',
        'Petter': 'P', 'Qvintus': 'Q', 'Rudolf': 'R', 'Sigurd': 'S', 'Tore': 'T',
        'Urban': 'U', 'Viktor': 'V', 'Wilhelm': 'W', 'Xerxes': 'X', 'Yngve': 'Y',
        'Zäta': 'Z', 'Åke': 'Å', 'Ärlig': 'Ä', 'Östen': 'Ö'
    }
    swedish_digits = {
        'Nolla': '0', 'Ett': '1', 'Tvåa': '2', 'Trea': '3', 'Fyra': '4',
        'Femma': '5', 'Sexa': '6', 'Sju': '7', 'Åtta': '8', 'Nia': '9'
    }
    swedish_mapping = {**swedish_alphabet, **swedish_digits}

    cipher_text = "Sexa Trea Nolla Caesar Tvåa Filip Ett Caesar Nolla Erik Erik Ett Bertil Åtta David Sju David Adam Femma Sju Caesar Filip Åtta Nia Trea Sexa Adam Erik Sju Erik Sju Åtta Tvåa Sju Fyra Adam Bertil Adam Nolla Bertil Filip David Sju Sexa Femma Filip Erik Ett Nolla Adam Tvåa Nolla David Filip Erik Femma Åtta Nolla Filip Nia Erik Erik Caesar Caesar"
        
    print("=== Swedish Phonetic Alphabet Crypto Challenge Solver ===")
    print(f"Cipher text: {cipher_text}")
    print()

    words = cipher_text.split()
    print(f"Total words to decode: {len(words)}")
    print()

    decoded = []
    print("Decoding process:")
    for i, word in enumerate(words, 1):
        if word in swedish_mapping:
            decoded_char = swedish_mapping[word]
            decoded.append(decoded_char)
            print(f"{i:2d}. {word:8s} -> {decoded_char}")
        else:
            print(f"{i:2d}. {word:8s} -> UNKNOWN")
            decoded.append('?')

    decoded_string = ''.join(decoded)
    print()
    print(f"Decoded string: {decoded_string}")

    flag = f"SPL{{{decoded_string}}}"
    print(f"Final flag: {flag}")
    print()
        
    return flag

def verify_flag(flag):
    print("=== Verification ===")
    print(f"Flag format correct: {'✓' if flag.startswith('SPL{') and flag.endswith('}') else '✗'}")
    print(f"Flag length: {len(flag)} characters")
    print(f"Content length: {len(flag) - 5} characters (excluding SPL{{...}})")
        
    content = flag[4:-1]  # Remove SPL{ and }
    is_hex = all(c in '0123456789ABCDEFabcdef' for c in content)
    print(f"Content is hexadecimal: {'✓' if is_hex else '✗'}")
        
    if is_hex:
        print(f"Hex length: {len(content)} characters ({len(content)//2} bytes)")
        return is_hex and flag.startswith('SPL{') and flag.endswith('}')

if __name__ == "__main__":
    flag = solve_swedish_crypto_challenge()
    is_valid = verify_flag(flag)
        
    print("=" * 50)
    if is_valid:
        print("🎉 SUCCESS! Flag is ready to submit:")
        print(f"   {flag}")
    else:
        print("❌ ERROR: Flag validation failed")
    print("=" * 50)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

#!/usr/bin/env python3
from impacket.smbconnection import SMBConnection

target = "13.71.126.207"
username = "developer"
password = "C|>@|#v863u)zl9G^&4}8kHl"
share = "flag"
remote_file = "\\flag.txt"  

c = SMBConnection(target, target, sess_port=445)
try:
    c.login(username, password)
    with open("flag.txt", "wb") as out:
        c.getFile(share, remote_file, out.write)
    print("Saved flag.txt")
finally:
    try: c.logoff()
    except: pass
    try: c.close()
    except: pass

1
2
3
4

Hello Participant, Nice to See You here ;
Your Credentitals  :
svc-flag:2<wN5cf4Zhu£mr!tP"5*,4v]
{Hint: PS Remoting can sometimes be useful for gaining an initial foothold.}  @localh0ste