n00bCTF 2016 Write up - MATRIX

Description : n00b was captured by the enemy. Forced to reveal the flag, he disclosed this string:
Here is the string
Can you find the flag?

Point : 40

When we open the link, it will display a strings.


First thing that I do was decode it in Base 64, but no luck. After staring at the strings I found something that suspicious, it is letter 'g'. It just repeated constantly after 6 characters.



Then I seperate the letter 'g' using this site. Then I found that It have 32 words. According to the challenge name, MATRIX, so i think that we need to read it column by column, not row by row. If we read row by row, we can get 32 strings, but if we read column by column we get 6 strings. 1 string have 32 characters? Have something in your mind? Yeah MD5!

So i just make a php script to seperate it column by column.

And got the strings. Then decrypt the MD5-hash or just google it. You will get :

The flag is sha256 of .....
 Just encrypt it with sha256, then 40 points is yours!


n00bCTF 2016 Write up - BATMAN

Description : Link here takes you to Batman shop. Can you take the flag from batman? Submit sha-256 of the flag obtained.

Point : 30

First there are several link that you can click on the left hand side. What do we want now is the flag.

When click the "Flag" link, it just show :

 We don't give flag to outsiders. We are Batman


After click and click all the link, I dont know how to get the flag. The hint here we must be a batman to get the flag.

I get the idea to change the parameter in the link to other value that are not related with the link given.

For example, there are eight links in that page from http://hack.bckdr.in/BATMAN/?st=1 until http://hack.bckdr.in/BATMAN/?st=8

So I just change the value to 9 like this :

http://hack.bckdr.in/BATMAN/?st=9
I got this ?


We knew that the product doesn't exist, but yeah! It doesn't pop up any error, so we just need to bruteforce the value. And luckily when I change the value to 10.

http://hack.bckdr.in/BATMAN/?st=10
 Voila!


Just translate the flag to sha-256 and get the 30 points!