Midnight Sun CTF Quals Writeup

この大会は2018/4/14 19:00(JST)~2018/4/15 19:00(JST)に開催されました。
今回もチームで参戦。結果は110点で221チーム中69位でした。
自分で解けた問題をWriteupとして書いておきます。

Sanity check (Misc 10)

Serviceに記載されているkiwiircのページに入ると、フラグが表示された。

midnight{midnightsunctf_2018}

Diary (Misc 50)

gitのファイル群が与えられている。

$ cd .git
$ xxd -g 1 index
0000000: 44 49 52 43 00 00 00 02 00 00 00 02 5a d1 4a 98  DIRC........Z.J.
0000010: 36 bf e7 7c 5a d1 4a 98 36 bf e7 7c 00 00 00 2f  6..|Z.J.6..|.../
0000020: 00 00 0c f0 00 00 81 a4 00 00 00 00 00 00 03 e7  ................
0000030: 00 00 01 db 4b 3c a9 1d 6d db a6 e9 f0 aa bd 33  ....K<..m......3
0000040: c3 6d 2a 4f a7 15 91 ab 00 09 64 69 61 72 79 2e  .m*O......diary.
0000050: 74 78 74 00 5a d1 4a 98 36 ed ba 58 5a d1 4a 98  txt.Z.J.6..XZ.J.
0000060: 36 ed ba 58 00 00 00 2f 00 00 0c f1 00 00 81 a4  6..X.../........
0000070: 00 00 00 00 00 00 03 e7 00 00 00 4f 80 7a 75 19  ...........O.zu.
0000080: 57 53 88 2b 07 b6 9b dd ce d3 fd 82 d3 cc af 9c  WS.+............
0000090: 00 0c 77 69 73 68 6c 69 73 74 2e 74 78 74 00 00  ..wishlist.txt..
00000a0: 00 00 00 00 54 52 45 45 00 00 00 19 00 32 20 30  ....TREE.....2 0
00000b0: 0a b1 f9 65 09 20 92 00 a6 dd a7 ad 4b de b7 02  ...e. ......K...
00000c0: 61 c7 30 ab e2 5b 3d 69 3c fa b4 e8 cf 96 e0 29  a.0..[=i<......)
00000d0: 47 9f 1b 48 08 00 73 80 e2                       G..H..s..

$ python -c 'import zlib; print zlib.decompress(open("objects/4b/3ca91d6ddba6e9f0aabd33c36d2a4fa71591ab").read())'
blob 475Hello!

This is my diary. There are many like it but this one is mine.

April 9th
Today was a good day. I ate some pie.

April 10th
I was a little bit sad today.

April 11th
Today I found a flag, it said: <PAGE TORN HERE> that sounds very interesting.

April 12th
I called my uncle today. He said he read a cool story in the newspaper.

April 13th
Tomorrow is my birthday. I am very excited to see if I get a cake.

April 14th
Woho! Today is my birthday! And we are hacking!


$ python -c 'import zlib; print zlib.decompress(open("objects/80/7a75195753882b07b69bddced3fd82d3ccaf9c").read())'
blob 79~~ My Wishlist ~~
* A dog
* Computer game
* A wolf t-shirt
* Stickers
* Pencil

$ cat refs/heads/master
2fec4e955704bd60292a9f9169f05c3334e555f4

$ python -c 'import zlib; print zlib.decompress(open("objects/2f/ec4e955704bd60292a9f9169f05c3334e555f4").read())'
commit 261tree b1f96509209200a6dda7ad4bdeb70261c730abe2
parent b182065ebc321a5432ab89be1ef2240077b3fbec
author Calle Svensson <calle.svensson@zeta-two.com> 1523665372 +0200
committer Calle Svensson <calle.svensson@zeta-two.com> 1523665372 +0200

Added pencil to wishlist

$ python -c 'import zlib; print zlib.decompress(open("objects/b1/f96509209200a6dda7ad4bdeb70261c730abe2").read())' | xxd -g 1
0000000: 74 72 65 65 20 37 37 00 31 30 30 36 34 34 20 64  tree 77.100644 d
0000010: 69 61 72 79 2e 74 78 74 00 4b 3c a9 1d 6d db a6  iary.txt.K<..m..
0000020: e9 f0 aa bd 33 c3 6d 2a 4f a7 15 91 ab 31 30 30  ....3.m*O....100
0000030: 36 34 34 20 77 69 73 68 6c 69 73 74 2e 74 78 74  644 wishlist.txt
0000040: 00 80 7a 75 19 57 53 88 2b 07 b6 9b dd ce d3 fd  ..zu.WS.+.......
0000050: 82 d3 cc af 9c 0a                                ......

$ python -c 'import zlib; print zlib.decompress(open("objects/80/7a75195753882b07b69bddced3fd82d3ccaf9c").read())'
blob 79~~ My Wishlist ~~
* A dog
* Computer game
* A wolf t-shirt
* Stickers
* Pencil

$ python -c 'import zlib; print zlib.decompress(open("objects/b1/82065ebc321a5432ab89be1ef2240077b3fbec").read())'
commit 247tree ebad3d2a3f429429928e9b1a8169564dc9342f7a
parent e7354a8187cd28c075e602f40380968d2865dcac
author Calle Svensson <calle.svensson@zeta-two.com> 1523665225 +0200
committer Calle Svensson <calle.svensson@zeta-two.com> 1523665225 +0200

April 14th

$ python -c 'import zlib; print zlib.decompress(open("objects/eb/ad3d2a3f429429928e9b1a8169564dc9342f7a").read())' | xxd -g 1
0000000: 74 72 65 65 20 37 37 00 31 30 30 36 34 34 20 64  tree 77.100644 d
0000010: 69 61 72 79 2e 74 78 74 00 4b 3c a9 1d 6d db a6  iary.txt.K<..m..
0000020: e9 f0 aa bd 33 c3 6d 2a 4f a7 15 91 ab 31 30 30  ....3.m*O....100
0000030: 36 34 34 20 77 69 73 68 6c 69 73 74 2e 74 78 74  644 wishlist.txt
0000040: 00 d9 30 f1 5a c0 20 06 4a d6 e7 94 48 53 2b 3c  ..0.Z. .J...HS+<
0000050: 5b 9c 08 71 ef 0a                                [..q..

$ python -c 'import zlib; print zlib.decompress(open("objects/d9/30f15ac020064ad6e79448532b3c5b9c0871ef").read())'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
IOError: [Errno 2] No such file or directory: 'objects/d9/30f15ac020064ad6e79448532b3c5b9c0871ef'

$ python -c 'import zlib; print zlib.decompress(open("objects/e7/354a8187cd28c075e602f40380968d2865dcac").read())'
commit 247tree 2160a4fb4d08f926f96580f8e44ecb3012bb3e12
parent afe5a9b6a373add54d07d874fb08edeec4a740da
author Calle Svensson <calle.svensson@zeta-two.com> 1523665209 +0200
committer Calle Svensson <calle.svensson@zeta-two.com> 1523665209 +0200

April 13th

$ python -c 'import zlib; print zlib.decompress(open("objects/21/60a4fb4d08f926f96580f8e44ecb3012bb3e12").read())' | xxd -g 1
0000000: 74 72 65 65 20 37 37 00 31 30 30 36 34 34 20 64  tree 77.100644 d
0000010: 69 61 72 79 2e 74 78 74 00 9f ad 23 eb 69 12 54  iary.txt...#.i.T
0000020: cd 25 42 fe 37 7b 6d c6 06 4b a7 ef 53 31 30 30  .%B.7{m..K..S100
0000030: 36 34 34 20 77 69 73 68 6c 69 73 74 2e 74 78 74  644 wishlist.txt
0000040: 00 d9 30 f1 5a c0 20 06 4a d6 e7 94 48 53 2b 3c  ..0.Z. .J...HS+<
0000050: 5b 9c 08 71 ef 0a                                [..q..

$ python -c 'import zlib; print zlib.decompress(open("objects/9f/ad23eb691254cd2542fe377b6dc6064ba7ef53").read())'
blob 415Hello!

This is my diary. There are many like it but this one is mine.

April 9th
Today was a good day. I ate some pie.

April 10th
I was a little bit sad today.

April 11th
Today I found a flag, it said: <PAGE TORN HERE> that sounds very interesting.

April 12th
I called my uncle today. He said he read a cool story in the newspaper.

April 13th
Tomorrow is my birthday. I am very excited to see if I get a cake.

$ python -c 'import zlib; print zlib.decompress(open("objects/af/e5a9b6a373add54d07d874fb08edeec4a740da").read())'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
IOError: [Errno 2] No such file or directory: 'objects/af/e5a9b6a373add54d07d874fb08edeec4a740da'

フラグが見つからない。手あたり次第調べる。

$ python -c 'import zlib; print zlib.decompress(open("objects/1c/8a3c51ee520c73063961fe289a5bda4a5e50c5").read())'
commit 246tree 1dd5ab00ec968226aad37c2a0e23a3f8fba9e4aa
parent 32dbb65cd1d1612a9c88805dde8a32115a19949f
author Calle Svensson <calle.svensson@zeta-two.com> 1523665080 +0200
committer Calle Svensson <calle.svensson@zeta-two.com> 1523665080 +0200

April 9th

$ python -c 'import zlib; print zlib.decompress(open("objects/1d/d5ab00ec968226aad37c2a0e23a3f8fba9e4aa").read())' | xxd -g 1
0000000: 74 72 65 65 20 37 37 00 31 30 30 36 34 34 20 64  tree 77.100644 d
0000010: 69 61 72 79 2e 74 78 74 00 2a c0 ee cb a4 ba b7  iary.txt.*......
0000020: 2c 3e e1 3f 57 44 bd f8 41 94 7a 5f 7e 31 30 30  ,>.?WD..A.z_~100
0000030: 36 34 34 20 77 69 73 68 6c 69 73 74 2e 74 78 74  644 wishlist.txt
0000040: 00 d9 30 f1 5a c0 20 06 4a d6 e7 94 48 53 2b 3c  ..0.Z. .J...HS+<
0000050: 5b 9c 08 71 ef 0a                                [..q..

$ python -c 'import zlib; print zlib.decompress(open("objects/2a/c0eecba4bab72c3ee13f5744bdf841947a5f7e").read())'
blob 120Hello!

This is my diary. There are many like it but this one is mine.

April 9th
Today was a good day. I ate some pie.

$ python -c 'import zlib; print zlib.decompress(open("objects/32/dbb65cd1d1612a9c88805dde8a32115a19949f").read())'
commit 266tree b78b2c9900bb05e863f8a3e74e656f2822d9a01f
parent 6a815d656900fface9ed54f74d16bb80821fec47
author Calle Svensson <calle.svensson@zeta-two.com> 1523665066 +0200
committer Calle Svensson <calle.svensson@zeta-two.com> 1523665066 +0200

Added stickers to my wishlist

$ python -c 'import zlib; print zlib.decompress(open("objects/b7/8b2c9900bb05e863f8a3e74e656f2822d9a01f").read())' | xxd -g 1
0000000: 74 72 65 65 20 37 37 00 31 30 30 36 34 34 20 64  tree 77.100644 d
0000010: 69 61 72 79 2e 74 78 74 00 fa bb 13 23 4d d9 4f  iary.txt....#M.O
0000020: 69 76 40 22 0e d4 48 ab db d0 5f 3a b1 31 30 30  iv@"..H..._:.100
0000030: 36 34 34 20 77 69 73 68 6c 69 73 74 2e 74 78 74  644 wishlist.txt
0000040: 00 d9 30 f1 5a c0 20 06 4a d6 e7 94 48 53 2b 3c  ..0.Z. .J...HS+<
0000050: 5b 9c 08 71 ef 0a                                [..q..

$ python -c 'import zlib; print zlib.decompress(open("objects/fa/bb13234dd94f697640220ed448abdbd05f3ab1").read())'
blob 72Hello!

This is my diary. There are many like it but this one is mine.

$ python -c 'import zlib; print zlib.decompress(open("objects/6a/815d656900fface9ed54f74d16bb80821fec47").read())'
commit 205tree 7db3bf515b769b5507c420e59671d527500998f4
author Calle Svensson <calle.svensson@zeta-two.com> 1523665007 +0200
committer Calle Svensson <calle.svensson@zeta-two.com> 1523665007 +0200

Created my diary

$ python -c 'import zlib; print zlib.decompress(open("objects/7d/b3bf515b769b5507c420e59671d527500998f4").read())' | xxd -g 1
0000000: 74 72 65 65 20 37 37 00 31 30 30 36 34 34 20 64  tree 77.100644 d
0000010: 69 61 72 79 2e 74 78 74 00 fa bb 13 23 4d d9 4f  iary.txt....#M.O
0000020: 69 76 40 22 0e d4 48 ab db d0 5f 3a b1 31 30 30  iv@"..H..._:.100
0000030: 36 34 34 20 77 69 73 68 6c 69 73 74 2e 74 78 74  644 wishlist.txt
0000040: 00 eb 05 64 99 96 aa d8 ae e2 a9 a7 1e 7a 22 f8  ...d.........z".
0000050: 89 c1 44 09 46 0a                                ..D.F.

$ python -c 'import zlib; print zlib.decompress(open("objects/eb/05649996aad8aee2a9a71e7a22f889c1440946").read())'
blob 59~~ My Wishlist ~~
* A dog
* Computer game
* A wolf t-shirt

$ python -c 'import zlib; print zlib.decompress(open("objects/4e/9a1fe2aeb76cd0ab2c3d232691b714146b0475").read())'
commit 247tree 101878b72d0c1f07341bef8f4c4f01c5b99412df
parent f668fa6d35bcf679fe0b2a4eb53a4379b8489eed
author Calle Svensson <calle.svensson@zeta-two.com> 1523665126 +0200
committer Calle Svensson <calle.svensson@zeta-two.com> 1523665126 +0200

April 11th

$ python -c 'import zlib; print zlib.decompress(open("objects/10/1878b72d0c1f07341bef8f4c4f01c5b99412df").read())' | xxd -g 1
0000000: 74 72 65 65 20 37 37 00 31 30 30 36 34 34 20 64  tree 77.100644 d
0000010: 69 61 72 79 2e 74 78 74 00 18 f0 c6 6f e2 47 07  iary.txt....o.G.
0000020: 6f 80 1b a8 ee a1 9c 47 8f 8b e3 d4 49 31 30 30  o......G....I100
0000030: 36 34 34 20 77 69 73 68 6c 69 73 74 2e 74 78 74  644 wishlist.txt
0000040: 00 d9 30 f1 5a c0 20 06 4a d6 e7 94 48 53 2b 3c  ..0.Z. .J...HS+<
0000050: 5b 9c 08 71 ef 0a                                [..q..

$ python -c 'import zlib; print zlib.decompress(open("objects/18/f0c66fe247076f801ba8eea19c478f8be3d449").read())'
blob 285Hello!

This is my diary. There are many like it but this one is mine.

April 9th
Today was a good day. I ate some pie.

April 10th
I was a little bit sad today.

April 11th
Today I found a flag, it said: midnight{if_an_object_ref_falls_and_no_one_hears} that sounds very interesting.
midnight{if_an_object_ref_falls_and_no_one_hears}