[Write-up] MMA CTF 2015 - QR code recovery challenge 400

Problem

You picked up teared QR code fragments. Recover the flag.

Flag is 12 characters without MMA{...}.

problem.png

problem.png

During the opening time  of MMA CTF, I don't know what to do with this picture.
When the CTF ended, I googled "QR code recovery challenge" to find the write-up of this chal, and found this link: https://ctf.mma.club.uec.ac.jp/problems/92

problem2.png

We will solve problem2.png first!
---
It looks easier, right? I opened GIMP and try to recover it but failed.

After googling, I found a tool named strong-qr-decoder, it can decode corrupted QR code, but only in txt file.
So I tried hard, and found a tool named qr2txt, it can change a bitmap file QR code to a txt file QR code.

Yeah! Go go go!
1. Change problem2.png to problem2.bmp with GIMP, and rename it to qr.bmp
2. $ ./qr2txt

Save it to a text file: $ ./qr2txt > qr.txt

3. User strong-qr-decoder to decode it:
$ python sqrd.py qr.txt -e 2 -m 4

Boom! 

Yeah, we got the flag of problem2.png. Can we do these steps with problem.png

"Flag is 12 characters without MMA{...}."
Submit flag "000000000000"! Failed!!!

Did I miss something?

--- matnacian ---

--- ctf for beginners ---

Read More

[Write-up] MMA CTF 2015 - Splitted 30

This is an "El Clásico" challenge of forensic, but I found it a little bit difficult to solve. Poor me! T.T

We got a pcap file here, but like a habit, when waiting Wireshark open the splitted.pcap, I foremost it:

Really, easy???
I went to /splitted/output/zip and open the zip file, but it was corrupted.
OK, back to Wireshark.

Sorting packets by Length, you can see some zip files like this:

Export them to files: File > Export Objects > HTTP:

Click Save All. Now we have 1, 2, ... 8 flag.zip files.
We can guess that the zip file contain flag was splitted into 8 files, and we must join these files to capture the flag. Let's try:
$ cat flag* > final.zip
Extact finalflag.zip file! Waiting... Still corrupted.

I used an hex editor to inspect these zip files, and relized they weren't in order.
Example, the flag(1).zip has the header PK of zip file >> It must be the first file when joining.
So the biggest mission in this challenge is arrange 8 splitted files in the right order to join them.
How can we do this?

Back to Wireshark again. Randomly, I chose packet No. 86 and "Follow TCP Stream".
Aha, "Range: bytes=1876-2344"

Can you guess that what should we do know?
Right! We have this table:

Now, we rename flag*.zip files to final0*.zip files base on the order above.
Example flag(1).zip -> final1.zip, flag(7).zip -> final5.zip.
Join these files with command: $ cat final* > final.zip.
Extract it. Bingo. We get the flag.psd. Open it with Photoshop or GIMP:

Blank? Don't worry. On the right panel, you will see 2 layers. Hide/Delete the 背景 layer.
Boom!!! Flag is:

Thanks for reading! ^^ And happy CTF! :D

--- matnacian ---

--- ctf for beginners ---

Read More