2018-03-16

NeverLanCTF2018-Turtles-All-The-Way-Down

Question

Binary

Solution

就咁睇似係base64 encoded

所以第一步就解左佢先啦

import base64a
enc = open("C:/Users/Admin/Desktop/turtle","rb").read()
with open("C:/Users/Admin/Desktop/turtle.dec","wb") as f:
	f.write(base64.b64decode(enc))
	f.close()

解完出黎係堆咁既野

但係我要既野正係中間果堆hex, 咁用sublime text處理下先啦
第一步 , 唔要頭果堆hex address

然後唔要埋尾果堆

最後就係replace晒d空格同埋換行就可以直接變番做binary
效果:

睇番個header應該係gzip黎 , 試下直接unzip佢先
可能因為係windows機啦 , unzip完出黎有個paxHeader係到 , 直接del到 0x400應該就開到

用file名開頭 , 應該係tar黎啦 , 直接unzip完終於出到個疑似係binary既野

但係似乎個header變晒做0x00 , 試下人手加番落去 , 然後終於decompile到

試下直接decode呢堆疑似hex既野啦

import base64
enc = ['584867774d5678344e6a42636544686d','5848686c4d6c78344d545a6365475a6d','584867795a6c78345a54466365444977','584867794d6c78344e7a6c6365445132','584867775a5678344d7a466365444178','584867794d4678344d44526365444933','584867774d5678345a475a6365444930','58486778596c78344d6a42636544466a','584867774d5678344d6a646365444178','5848686b5a6c78344e6a5a6365445a6a','584867324d5678344e6a646365446469','58486732593178344e7a566365445930','584867794d5678344e7a4a6365445a6d','584867324d3178344e6d4a636544637a','584867315a6c78344e6a466365445a6a','58486732593178344e575a6365446330','584867324f4678344e6a56636544566d','584867334e3178344e6a466365446335','584867315a6c78344e7a566365446377','584867794d5678344e32526365444268']
out = ""
for i in enc:
	out += base64.b64decode(i.decode('hex')).replace("\\x","").decode('hex')

print out

Flag

1	flag{lud!rocks_all_the_way_up!}