URL: http://asis-ctf.ir/challenges/
Type: unarchiving and encoding
Solution: ASIS_4b84151f170d07224957ea8eaea4af05
 

Description
file

Archive contains a « big int » file:

$ tar xvfJ crypto_100_0846ec09aab1276d3f58132e9e0d9040 
x 1c2a7ff1d5cdf3d36544551ae18e30c8
$ file 1c2a7ff1d5cdf3d36544551ae18e30c8 
  1c2a7ff1d5cdf3d36544551ae18e30c8: ASCII text, with very long lines
$ cat 1c2a7ff1d5cdf3d36544551ae18e30c8 
1937836649543258608391193358391238992151026154208229723517605780050891
3654042530935403636189383839300358889174662237617964081565942739433234
1396349623915618698881917748452642227703372088122750038977875271898725
9467208520048808852564741532404964036797626581754764397478815129835680
1033988751381529053245777833965319984084499562033486208397212913137357
1189257219076954184188287439143813927696901842427070726653570329826784
9949397813992627220413730981528964206782522258337989750896248312182415
9162871112070732989554367141190690131536068410994916209303447376090547
5852393975531277897806950327343042645059549958465853312789713887760614
6130199964085413285739083738548481609376034988574715166271341639692865
3104973714036537142411419855325800318909911162562865819504841005647735
4418943486633764457994737288416245326617781808808365823018019007303548
0262764508670967426249969603120904405652979145622344793151772476338758
2320540340992041852841164924775047350639855316316916165049999865975317
9520467576895466482641387252430718673195843748651606278144

Analysis

Guess and wonder

The first part, you have to wonder what this number means. Converting it to hex, you will find that the first bytes 37 7A BC AF 27 1C described the signature of a 7-Zip compressed file:

fi=open('1c2a7ff1d5cdf3d36544551ae18e30c8', 'r')
N=int(fi.read())
fi.close()
H=hex(N)[2:][:-1]
fo=open('strange.7z', 'wb')
fo.write(''.join([chr(int(H[i:i+2],16)) for i in range(0, len(H), 2)]))
fo.close()

`file` command

Then the following parts were just determining file type (with file command) and unpacking it with the appropriate tool:

$ file strange.7z
  strange: 7-zip archive data, version 0.3
$ 7z x strange.7z 
  7-Zip [64] 9.20  Copyright (c) 1999-2010 Igor Pavlov  2010-11-18
  p7zip Version 9.20 (locale=utf8,Utf16=on,HugeFiles=on,8 CPUs)
  Processing archive: strange.7z
 
  Extracting  strange
  Everything is Ok
  Size:       354
  Compressed: 431

$ file strange
  strange: lzop compressed data - version 1.030, LZO1X-999, os: Unix
$ mv strange strange.lzo
$ lzop -dvN strange.lzo 
  decompressing strange.lzo into strange.uu

$ file strange.uu 
  strange.uu: uuencoded or xxencoded text
$ uudecode strange.uu

$ file strange.U 
  strange.U: ASCII text

Last… but not least

The last unpacked file contains again « big ints » in hex form:

$ cat strange.U
fe18be6a597ffad862b3e8acf9afacb6b6a781efa67acb1a81efad85ab7e
ca8bbe85abdefa7a2dfac79e9fe6de7e8adeffeb617be7e56a0fa2b3e012
212fae9dd7abb1ca2b7bee1bf38d79d5fd7bfb4774ef6db8fbde7b79af1e
6be79ae1a7f4

 
As we did it for the first part, let’s convert them to a binary file:

fi = open('strange.U', 'r')
N = int(''.join([s.rstrip() for s in fi.readlines()]), 16)
fi.close()
H=hex(N)[2:][:-1]
fo=open('strange.bin', 'wb')
fo.write(''.join([chr(int(H[i:i+2],16)) for i in range(0, len(H), 2)]))
fo.close()

$ file strange.bin 
  strange.bin: data

 
There, it was just pure guessing of what to do… And the solution was to « encode it in base64 »

$ base64 -i strange.bin -o strange.b64
$ cat strange.b64 
/hi+all/+this+is+a+strange+message+that+you+have+not+seen+before/
+the+flag+is+ASIS+underscore+4b84151f17+0d07224+957ea8ea+ea4af0

 
Unfortunatly, flag is missing 1 char; maybe due to an encoding truncation (so it would be the last one). We then used what we’ve learned from Hidden flag challenge to retrieve it.