CyberYoddha CTF (30 Oct — 1 Nov, 2020)

Samantha

8 min readNov 1, 2020

Let’s start with the welcome flag. I typed ?flag into the Discord server and got the flag messaged to me by Carl-bot:

When you check that link, you just get a huge wall of text:

Inspect the element though, and you will find the flag tucked in there.

For the next challenge you will see a page that says it really hates “crawlies”, which strongly hints at searching for directories. You will notice though, that the name of the question is “Disallow”. In order to find which directories are excluded from web crawlers, you can check the “robots.txt” page:

https://crawlies.cyberyoddha.team/robots.txt

This points to the flag at:

https://crawlies.cyberyoddha.team/n0r0b0tsh3r3/flag.html

If you CLICK that link you get a fun surprise!

This one is easily solved using CrackStation:

On this one you can use fcrackzip to find the password:

Use that password to extract the .zip file and then open the flag.txt document to view the flag:

After using hashid, you can see that it thinks this password is Sha-512:

Hashcat doesn’t work with that though:

So I tried again with the second candidate, Whirlpool, which was successful:

If you use exiftool, you can sometimes see the location where the photo was taken:

This looked like a Caesar Cipher to me so I threw it in a web tool and tried different rotations. It turned out to be Rot19:

This one was actually pretty clever because you have to go through 4 “bases” in order to get the correct answer:

Here is the picture we are given:

I assume that I will need to find a password to use with steghide based on the title of the question:

So I got stegcracker going while I did a bit more looking around:

Binwalk and exiftool turned up no useful information:

I also tried stegsolve real quick:

Which also turned up nothing. I will wait for stegcracker to complete overnight and then come back to this one.

UPDATE: After I slept on it, it became obvious to me that the password was actually “sudo”.

Stegcracker was still running, lol…

This is that Latin-ish language that people use to fill in random templates to make them easier to visualize. I threw it in Google translate, and found this:

“Download information as vCard”. So the info I want is on a virtual contact card. But from whom?

Unfortunately I was not able to figure this one out, but 144 people have already solved it so it can’t be that hard…

I found this one by using the strings command:

For this one, the main hint is the name “Odec Esrom”, which can be unscrambled to say “Morse Code”.

I’m going to do all the trivia at this point. I’ll just paste the question boxes with my answers visible.

This was Vigenere, and the key was “salad”.

For this one you just need to open up the file and put the numbers in order.

The hash looks like MD5 and it seems like the salt is “cyctf”, so all you need to do is save it in the proper format and then run it through hashcat:

HERE is a good resource that explains the process in a bit more in-depth.

So this one had absolutely zero context to work with except the nod to time travel. I was thinking the Wayback Machine…but on what website? I used it on the challenge hosting website and did find a snapshot from September:

I found the flag from another challenge(?) by Inspecting the Element:

After exploring around a bit more, I saw that the “Teams” page had also been archived. There was only one team on there, and that’s where I found the flag:

This one was pretty frustrating because I knew I was getting close, but I just couldn’t fit it all together.

I figured out that the letters probably referred to genetic code and discovered this tool:

However, I could not make anything fit.

Then I found another tool:

Which I used to turn my code into these letters:

I tried a rotation cipher on these letters next, but never figured out the final flag.

This flag was easily discovered using stegsolve. I was actually surprised by how many points it was worth. Probably because you have to type all that out by hand when you submit the flag.