Beginner picoMini 2022 Writeup

My writeup for the Beginner picoMini 2022 challenges! It consists of pretty simple general skills challenges that serve as a good starting point for beginners!

Challenge #01 : Codebook

Walkthrough: After downloading both files, I just ran the code.py file as instructed and it printed out the flag! What the code seems to be doing is it takes a few characters in codebook.txt and builds a password that will be used as an xor key to decode the flag_enc contained in the code.py file!

• Flag : picoCTF{c0d3b00k_455157_d9aa2df2}

Challenge #02 : convertme.py

Walkthrough: Running the python script, it asks this:

(.venv) nanta@LAPTOP-O6HB7GPA:~/CTF$ python convertme.py 
If 47 is in decimal base, what is it in binary base?
Answer:

Using CyberChef to change 47 to base 2, I got 101111! Inputting that printed out the flag.

- Flag : picoCTF{4ll_y0ur_b4535_9c3b7d4d}

Challenge #03 : fixme1.py

Walkthrough: Upon inspecting the python script, I saw the glaring syntax error regarding indentation in this line.

flag = str_xor(flag_enc, 'enkidu')
 print('That is correct! Here\'s your flag: ' + flag)

There’s an indent before the print statement that causes an error. I removed that, ran the script, and got the flag.

• Flag : picoCTF{1nd3nt1ty_cr1515_6a476c8f}

Challenge #04 : fixme2.py

Walkthrough: After opening and examining the python script, I found the syntax error in this line.

if flag = "":
  print('String XOR encountered a problem, quitting.')

Here, the script uses an assignment operator (=) instead of an equals operator (==). So I just fixed that, reran the script and got the flag!

• Flag : picoCTF{3qu4l1ty_n0t_4551gnm3nt_f6a5aefc}

Challenge #05 : Glitch Cat

Walkthrough: After connecting to the remote server, it printed this

'picoCTF{gl17ch_m3_n07_' + chr(0x61) + chr(0x34) + chr(0x33) + chr(0x39) + chr(0x32) + chr(0x64) + chr(0x32) + chr(0x65) + '}'

I just used Python to reprint the whole string as chr(0x61) is indicative of Python syntax. Python will automatically convert the hexadecimals into their corresponding ASCII characters.

• Flag : picoCTF{gl17ch_m3_n07_a4392d2e}

Challenge #06 : HashingJobApp

Walkthrough: After connecting using nc, the server asks us to convert a few random words into MD5 hash. I used this website (https://www.md5hashgenerator.com) and input each string, inputted the corresponding MD5 hash and after 3 questions, I got the flag!

(.venv) nanta@LAPTOP-O6HB7GPA:~/CTF$ nc saturn.picoctf.net 57267
Please md5 hash the text between quotes, excluding the quotes: 'hairballs'
Answer: 
360927e98748b8675251a4a68b637b4b
360927e98748b8675251a4a68b637b4b
Correct.
Please md5 hash the text between quotes, excluding the quotes: 'angry hornets'
Answer: 
456fdc871d3f9976046da83bcfdd52ff
456fdc871d3f9976046da83bcfdd52ff
Correct.
Please md5 hash the text between quotes, excluding the quotes: 'King Arthur'
Answer: 
36304aebe9f3d880416be62d941d6fed
36304aebe9f3d880416be62d941d6fed
Correct.
picoCTF{4ppl1c4710n_r3c31v3d_674c1de2}

• Flag : picoCTF{4ppl1c4710n_r3c31v3d_674c1de2}

Challenge #07 : PW Crack 1

Walkthrough: Upon inspecting the python script, I noticed that it will ask for a password input that’s hardcoded before printing the flag.

def level_1_pw_check():
    user_pw = input("Please enter correct password for flag: ")
    if( user_pw == "8713"):

So I just ran the python script, input the correct password being 8713 and got the flag!

Please enter correct password for flag: 8713 
Welcome back... your flag, user:
picoCTF{545h_r1ng1ng_1b2fd683}

• Flag : picoCTF{545h_r1ng1ng_1b2fd683}

Challenge #08 : PW Crack 2

Walkthrough: Upon inspecting the python script, I saw the function is very similar to the previous challenge, where it asks for a password. This time, the password is obfuscated as hexes.

def level_2_pw_check():
 user_pw = input("Please enter correct password for flag: ")
 if( user_pw == chr(0x34) + chr(0x65) + chr(0x63) + chr(0x39) ):

To decode this, I just changed the else statement to print the expected user_pw instead where python will automatically convert the hexes into their corresponding ASCII characters.

def level_2_pw_check():
    user_pw = input("Please enter correct password for flag: ")
    if( user_pw == chr(0x34) + chr(0x65) + chr(0x63) + chr(0x39) ):
        print("Welcome back... your flag, user:")
        decryption = str_xor(flag_enc.decode(), user_pw)
        print(decryption)
        return
    print(chr(0x34) + chr(0x65) + chr(0x63) + chr(0x39))

After running the script and inputting the wrong password, I saw that the actual password is 4ec9.

(.venv) nanta@LAPTOP-O6HB7GPA:~/CTF$ python level2.py 
Please enter correct password for flag: test
4ec9

I reran the script one last time, input the correct password, and got the flag.

• Flag : picoCTF{tr45h_51ng1ng_9701e681}

Challenge #09 : runme.py

Walkthrough: Downloading the python script and running it immediately produces the flag.

• Flag : picoCTF{run_s4n1ty_run}

Challenge #10 : PW Crack 3

Walkthrough: Upon examining the script, I noticed that the format is pretty much the same as the previous PW crack challenges, but this time there is a list of possible passwords with only 1 being correct.

# The strings below are 7 possibilities for the correct password. 
# (Only 1 is correct)
pos_pw_list = [“8799”, “d3ab”, “1ea2”, “acaf”, “2295”, “a9de”, “6f3d”]

We can just brute force through this list by editing the input section of the script into a for loop that loops through the list.

def level_3_pw_check():
    for pw in pos_pw_list:
        user_pw = pw
        user_pw_hash = hash_pw(user_pw)

        if( user_pw_hash == correct_pw_hash ):
            print("Welcome back... your flag, user:")
            decryption = str_xor(flag_enc.decode(), user_pw)
            print(decryption)
            return
        print(f"{pw} is not the correct password")

I also made sure to move the pos_pw_list above this function. And upon rerunning the script, I got the flag!

(.venv) nanta@LAPTOP-O6HB7GPA:~/CTF$ python level3.py 
8799 is not the correct password
d3ab is not the correct password
1ea2 is not the correct password
acaf is not the correct password
Welcome back… your flag, user:
picoCTF{m45h_fl1ng1ng_6f98a49f}

• Flag : picoCTF{m45h_fl1ng1ng_6f98a49f}

Challenge #11 : PW Crack 4

Walkthrough: The solution of this is the exact same as PW Crack 3. Here’s my modified function.

def level_4_pw_check():
    for pw in pos_pw_list:
        user_pw = pw
        user_pw_hash = hash_pw(user_pw)

        if( user_pw_hash == correct_pw_hash ):
            print(f"Correct pass: {pw}")
            print("Welcome back... your flag, user:")
            decryption = str_xor(flag_enc.decode(), user_pw)
            print(decryption)
            return

I also moved the list above this function so it actually gets read.

(.venv) nanta@LAPTOP-O6HB7GPA:~/CTF$ python level4.py 
Correct pass: 9f63
Welcome back… your flag, user:
picoCTF{fl45h_5pr1ng1ng_d770d48c}

• Flag : picoCTF{fl45h_5pr1ng1ng_d770d48c}

Challenge #12 : PW Crack 5

Walkthrough: Again, the format of this challenge is pretty much the same as the previous ones, the difference being that this challenge’s password is contained in a dictionary.txt file is pretty big. However, we use the same approach of looping through all the possible passwords in said dictionary. This is an example of a dictionary attack! Here’s my edited function, I made sure to trim each line to get rid of the trailing new line of every line in the dictionary.txt file.

def level_5_pw_check():
    with open("dictionary.txt", "r") as file:
        for line in file:
            user_pw = line.strip()
            user_pw_hash = hash_pw(user_pw)

            if( user_pw_hash == correct_pw_hash ):
                print("Welcome back... your flag, user:")
                decryption = str_xor(flag_enc.decode(), user_pw)
                print(decryption)
                return

Running the script grants us the file!

• Flag : picoCTF{h45h_sl1ng1ng_36e992a6}

Challenge #13 : Serpentine

Walkthrough: Upon downloading the script and running it, I saw that the print flag option doesn’t print the file. However when I inspected the script, I saw that there is a predefined print_flag function. So we just insert it into the b) menu as so:

print('Welcome to the serpentine encourager!\n\n')

  while True:
    print('a) Print encouragement')
    print('b) Print flag')
    print('c) Quit\n')
    choice = input('What would you like to do? (a/b/c) ')

    if choice == 'a':
      print_encouragement()

    elif choice == 'b':
      print_flag()

After rerunning the script and selecting the b) option again, I got the flag!

• Flag : picoCTF{7h3_r04d_l355_7r4v3l3d_8e47d128}