This post preserves my original public notes for UMD CTF 2024 Writeup Roundup. I kept the challenge-by-challenge structure close to the source Markdown and only cleaned up formatting, image paths, and repeated footer text so it reads cleanly on the website.

UMD CTF 2024

Conclusion

Pwned flags: 5/41

Total Score: 1205 points

Rank: 118th

• Web
  • Donations
• Osint
  • Literally Arrakis I
• Misc
  • Sanitycheck
  • Possible Futures

Donations

Show off your capitalistic altruism today.

Solution Strategy

Login with a new account

Donate to Jeff Bezos

Intercept with Burp Suite and Change the currency amount into a negative break the logic flow.

Literally Arrakis I

close your eyes. listen to the soothing sound of my voice. you are feeling very sleepy. ok (you're asleep now). when you wake up, you are baron vladimir harkonnen. you are a very cruel man. you seek 3 young fremen for reasons only shai-hulud would know. whenever you hear snap you enter your geolocation mind palace and attempt to find what you seek. now wake.

snap can you find your first fremen target? flag format is UMDCTF{latitude,longitude}, for example: UMDCTF{38.9865489,-76.9451673}

Challenge Image

The Khermen Tsav Canyon

UMDCTF{43.4693781,99.8275023}

Possible Futures

I see possible futures. All at once.

Our enemies are all around us.

And in so many futures, they prevail.

But I do see a way.

Solution Strategy

import hashlib
import py7zr
import os
import glob
import re

def generate_md5(filename):
    return hashlib.md5(filename.encode()).hexdigest()

def extract_7z(file_path, password, extract_to):
    try:
        with py7zr.SevenZipFile(file_path, 'r', password=password) as archive:
            archive.extractall(path=extract_to)
        print(f"Successfully extracted: {file_path}")
        return True
    except Exception as e:
        print(f"Failed to extract: {file_path}. Error: {e}")
        return False

def print_possible_flag_content(directory):
    txt_files = glob.glob(os.path.join(directory, 'possible_flag_*.txt'))
    for txt_file in txt_files:
        with open(txt_file, 'r') as file:
            contents = file.read()
            if 'UMDCTF{' in contents:
                print(f"Contents of {txt_file}:")
                print(contents)
                exit(0)

def process_file(file_path):
    filename = os.path.basename(file_path)
    password = generate_md5(filename)
    extract_to = os.path.splitext(file_path)[0]
    if not os.path.exists(extract_to):
        os.makedirs(extract_to)
    print(f"Trying to extract {file_path} with password {password}")
    if extract_7z(file_path, password, extract_to):
        print_possible_flag_content(extract_to)
        process_directory(extract_to)

def process_directory(directory):
    print(f"Processing directory: {directory}")
    files = glob.glob(os.path.join(directory, '*.7z'))
    print(f"Found .7z files: {files}")
    for file_path in files:
        process_file(file_path)
initial_path = '/home/waaris_m/Downloads/image/root.7z'

if os.path.isfile(initial_path):
    process_file(initial_path)
elif os.path.isdir(initial_path):
    process_directory(initial_path)
else:
    print("The path provided does not exist or is not a file or directory.")

• Imports: Necessary modules like hashlib, py7zr, os, and glob are imported for various functionalities like hashing, archive extraction, and file system operations.
• Function generate_md5: Takes a filename and returns its MD5 hash. This is used as a password for archive files.
• Function extract_7z:
  • Attempts to open a .7z file using a specified password.
  • If successful, extracts its contents to a specified directory and prints a success message.
  • If it fails, prints an error message.
• Function print_possible_flag_content:
  • Searches a given directory for text files starting with 'possible_flag_'.
  • Opens and reads each file, checking for a specific pattern (UMDCTF{).
  • If found, prints the contents and stops the script with exit(0).
• Function process_file:
  • Extracts the filename from the file path.
  • Generates a password from the filename using MD5 hash.
  • Creates a directory named after the file (without the extension) for extraction.
  • Tries to extract the archive with the generated password.
  • If successful, checks for specific text in the files and possibly recurses into directories.
• Function process_directory:
  • Prints the processing directory.
  • Looks for .7z files within the directory and processes each found file recursively.
• Initial path setup and execution:
  • Sets the initial path to a .7z file.
  • Depending on whether the path is to a file or directory, it either processes the file directly or the directory recursively.
  • Prints a message if the provided path does not exist or is not correct.

Sanity Check