This is your 3 week warning team, check your diaries =)




Everyone may participate.


The CTF will take place during the hack.lu conference.

CTF start is 22.10.2013 10:00 CEST (8:00 UTC)
CTF end is 24.10.2013 10:00 CEST (8:00 UTC)


The CTF event will be challenge based, i.e. the CTF is separated into small tasks that can be solved individually. The scoreboard will be web accessible and no VPN is required. We are trying our best to give all participants a delightful experience, the covered topics are somewhere around crypto, web security, reverse engineering and forensics. Find our fancy scoreboard [ https://ctf.fluxfingers.net here].

We are looking forward to seeing you participate - locally or from remote. Direct your questions to somebody at our booth or on IRC.


the usual stuff:

  • solve a challenge, and you'll get the points as shown on the scoreboard. being the first to solve it gives you a reward of 3 bonus points, second gets 2, third gets 1.
  • no DoS/automated scans/large amounts of traffic/deleting stuff on our servers.
  • if you find something, that solves too easy, it might be a bug. please report it for possible bonus points.
  • if you break the rules, we will kick your butt and remove all your points. promised.


We completed the game with 599 points and rank 102.

The challenges we completed (fully or partially) were:

  • 3
    waiting to see our ctf team at action soon Sep 30, 2013 at 13:04
  • I'm going to have to sit this one out I'm afraid, that week is particularly busy for me I'm afraid :) Good luck!
    – user2213
    Oct 10, 2013 at 12:28
  • @AntonyVennard it is a weekday thing for some reason, so I think participation will largely be confined to the evenings anyway.
    – lynks
    Oct 11, 2013 at 10:55

1 Answer 1



Internals, 200 points.

Solved jointly by @Gilles and @Manishearth.

We were presented with this file (paste), which at first glance was a pdf.

The hints online were:

New Challenge Published: We found a dead robot! Want to take a look at its internals?

Think outside the box - being several types at once like an animal that can change its color. Excuse the inaccuracy, but that's what you're searching for.

Opening it, however, gave rise to a pdf that just said "no hint given".

Looking deeper, it seemed to be in three parts. First, there was the pdf, which was ended with an EOF.

Secondly, there was a bunch of gibberish. Finally, there was some base64-encoded data.

Decoding the base64 data gave rise to an OpenOffice text document that said "still no hint given". Looking into the file, there was some xml with the text "mad forensic skillz" surrounded by <dc:title> tags. Nothing too interesting here.

It was pretty obvious that the gibberish was code, most probably Python. I realized that it was the rot13 of some python code, and after decoding it, I got this. Note that that is not exactly the rot13 of the initial gibberish, I have converted qrpbqr ("zip") to decode ("zip"), as Python accepts zip as an argument for decode() but not mvc.

Cleaning up the code and adding comments, we get:

#Ciphertext to be decoded:
cipher="H51\\\'Ux2J&+(3Z;Uxcx0Xxs\x13h\x014$V!R($R>\t/)R!\x01<.\x13,N-aP4M4aRuG1-VuU0 GuH+a@0W=3R9\x01>(_0\x01,8C0Rx    GuN6\"V|\x1ezKZ3\x014$]}R!2\x1d4S?7\x1au\x1fxs\t_\x01xa\x13<Gx)R&Ip2J&\x0f93T#zj\x1c\x1ap\x13rk\x00g\x01e|\x13g\x19ju\x0ba\x18jt\x02o+xa\x13u\x01xa\x13%S1/Gu\x03\x1b.\\:N7.\\:N4o\x13\x0cN-3\x133M9&\x13<Rx A2WjiZ{DvaX0Xjh\x136N6\"R!\x01\x07rC0p\x138a\x1dc22ieu\x161Fw+=-@0\x1bRa\x13u\x01(3Z;UxcR\'F.s\x1c>D!s\x13<Rx,Z&R1/Tw+R"
n = 0
import hashlib ,sys 
try :
    key = sys.argv[1] #get key from argument
except IndexError:
    sys.exit("Key 1 missing in argv")
f =getattr(hashlib ,"md5")
while n <(5*10**6):
    key = (f(key).digest()) #Repeatedly hash the key via md5
    n = n+1
key = key[:5].upper() #Take the last five characters of the new key and make them uppercase.
while len(key)<len(cipher): 
    key = key *2 #Make the key as long as the ciphertext by duplicating it
plain = "".join(map(chr,[ord(a)^ord(b)for a,b in zip (cipher,key)])) #XOR the key with the cipher, deciphering the OTP
try :
    exec plain #Execute the plaintext. A successful execution means that we have found the correct key.
except :
    print "Wrong Key!", repr(plain)

Note that the actual decoding part takes a string consisting of a set of five characters repeating over and over again and pads it with the ciphertext.

Due to a misunderstanding of the zip() function, I started looking for ways to bruteforce the key (the five-byte version, not the original one before hashing) or obtain it from somewhere else.

At this point, @Gilles had a look. He realized that the python program would probably start with import. XORing import with the ciphertext gives us the first five characters of our repeated key; !XA3U. We create the repetitive key from this, and this decodes the ciphertext into:

import sys
print "Key 2 = leetspeak(what do you call a file that is several file types at once)?"
if len(sys.argv) > 2:
    if hash(sys.argv[2])%2**32 == 2824849251:
        print "Coooooooool. Your flag is argv2(i.e. key2) concat _3peQKyRHBjsZ0TNpu"
    print "argv2/key2 is missing"

Running this asks us for a second key, which we have to guess from the hint "What do you call a file that is several file types at once". Putting this together with the hint "Being several types at once like an animal that can change its color", I get the second key as ch4m3l30n (chameleon), which worked. This gives us the flag ch4m3l30n_3peQKyRHBjsZ0TNpu.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .