Statement:

This cursed image 100 points

I know I put it somewhere, but where..

File for the challenge: https://mega.nz/#!YcBw2A4K!jUqgKnf5YZhmjZtpNEH7jM3h2rQ4KyvrOiBaLYmdWys

Key format:
– SHA256 of the key
– No spaces
– Uppercases, lowercases, numbers and special characters exactly as they appear in the file of the challenge

Solution:

In this challenge we are asked to download a tar.gz file that contains the file image.raw.

File command returns the following information:

Looks like is a disk image, the next step would be to see what fdisk has to say:

Looks like almost everything is swap and we have a 500Mb partition in ZFS format. The problem is that ZFS doesn’t allow file I/O so we can’t directly mount it, first, we need to use losetup to mount it so ZFS could recognize it.

For that we need to calculate the offset of that partition, knowing that block size is 512 bytes and that the partition starts at 4194432:

512 * 4194432 = 2147549184

Once we know the offset we execute losetup as follows:

To proceed with the following steps we need to have installed and loaded the ZFS modules. In my case I had several version problems as the version used for the challenge was newer than the one in the repositories so I compiled the modules from the sources.

We use zpool to import the ZFS pool:

Zpool warn us that the pool was used in another system previously so we need to force the import with the -f option and also use its name (Mugar2x3); and then we confirm that the pool was imported:

With this the partition should be already mounted on our system’s root under the folder Mugar2x3. If this is not the case we can use the following command to mount it:

zfs mount Mugar2x3

We can see that it only contains several subfolders and a lot of files with the famous “Lorem ipsum”, but not a single picture that is what the challenge asks.

ZFS has the feature to generate snapshots to be able to recover old status of the file system, we take a look and we can see that there are several of them:

The snapshots are sort from older to newer, in the case that we miss we need to destroy and import the pool again.

In this case, judging by the size, our best option was the snapshot 3, so we proceed to do a rollback to it:

As we still have a lot of files in the middle I used the file command to locate the picture:

We open the file and voila:

We then calculate the SHA256 and we have solved the challenge.

Statement:

AM 200 points

Now seriously, when it comes to listen to music, nothing better than the radio, or not?

Maybe we are too nostalgic.

Format of the answer:
– Uppercase and lowercase as they appear in the flag
– No spaces

Solution:

In this challenge they gave us an ogg file, nothing strange to the naked eye. Lets start openning it with Audacity:

We can see that the first two tracks are the original song but there is a third track, lets extract it and open it with Sonic Visualiser, app that has helped me a lot in the past with the typical text hidden in audio thanks to its layers:

As Im used to I add the spectrogram layer just in case there was some text and because I like it more, in this case we didn’t find any text but we were able to locate some audio in an specific part.

After thinking about several ways and doing several tests with software oriented to weatherfax that we already saw in other challenges I decided to try my luck with SSTV. For that we will play the audio with paplay while we set QSSTVE to listen, notice that you need to redirect the audio output to the input so QSSTV can receibe it, in my case using pulseaudio I did this using pavucontrol, in the input sections and the monitor mode interfaces.

Here we can see that QSSTV has recognized the signal as SSTV in Scottie 1 mode and begins to show the result:

When the audio finish to play we get the following image:

Calculate the SHA256 of the string “IWannaKnowPulpoKey” and we get the flag we need.

And lets reopen the blog with the first writeup of the CTF that took place in 2015 at the Kernel in Mugardos.

Statement:

When does the trope open? 100 points

When does the trope open? I wanna dance!

Format of the answer:
– SHA256 of the flag
– Lowercase
– No spaces

Solution:

In this challenge they provided the following image:

My first impression was, ¿What the …? Thinking that maybe the organization didn’t copy/paste each stickmen I did several searches in google for fonts done with them. Found several ones but  an specific one matched exactly and on its detailed information said that it was based on a message shown in one of Sherlock Holmes novels.

Font: http://www.fontspace.com/martin-bergman/dancingmen

As the website already shown the alphabet with all the stickmens that we needed I directly translated each stickmen to its corresponding letter obtaining the following message:

jvxlif hlv jz ruvdrj tzwirdfj vjkf tfe rcxle dvkfuf tcrjztf tfdf trvjri jvir dltyf drj wfidrj gfi jz rtrjf cr tcrmv vj mzmrvcglcgf

A quick Caesar bruteforce showed that it was a Caesar with key 17. We got the following message:

seguro que si ademas ciframos esto con algun metodo clasico como caesar sera mucho mas formas por si acaso laclave es vivaelpulpo

In English it will be: “if we also cypher this with a classic method like Caesar it will be mucho more forms just in case the password is longliveoctopus”

Doing the SHA256 of the string “vivaelpulpo” it will show the flag we need.