Brixel CTF 2020 writeup

Programming

Are you fast enough?

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# -*- coding: utf-8 -*-
#!/usr/bin/python

import requests
import re

sess = requests.Session()

url = "http://timesink.be/speedy/"
response = sess.get(url).content
print(response)

strings = re.findall(r'id="rndstring" align="center">(.*?)</div>',response,re.S)[0]
print(strings)

result = sess.post(url,data={"inputfield":strings})
print(result.content)
1
brixelCTF{sp33d_d3m0n}

Keep walking…

1
2
3
4
5
6
7
8
9
10
#!/usr/bin/python

x = 1
y = 1
r = 1
for i in range (0,525):
r = x * y + r + 3
x = x + 1
y = y + 1
print(r)
1
brixelCTF{48373851}

A song…

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
(intro)
Shout "brixelCTF{" !!!

Brixel is a hackerspace
It's not like any other place

Your skill is hopefully the best
This CTF is the test
put your skill into the test
(-and-) let your score be "blessed"

(chorus)
The challenges are serious
Your skill is mysterious
Build your skill up, up, up (-up,up-)
Knock the challenges down
your skill is true,
your skill is right!
Knock the challenges down
your score is taking flight!

(verse1)
put This CTF into your skill
put Brixel into your Heart (-or not, hey! just chill!-)

the hype is getting to the top,
the beat is ready to drop,
build the hype up!
build the hype up!
build the hype up!

whisper the challenges,
say your score,
Shout the hype, (-and-)
SCREAM YOUR SKILL! (-m-M-M-MONSTERKILL!!-)

(chorus)
The challenges are serious
Your skill is mysterious
Build your skill up, up, up (up,up)
Knock the challenges down
your skill is true,
your skill is right!
Knock the challenges down
your score is taking flight!

(verse2)
Happy Holidays is a wish,
Brixel is wishing you today
Santa is now leaving
(-riding on his sleigh-)

This was fun
This was grand
Turn up your score
Turn up your skill

put your heart into your skill
put your skill into the test
say your score (-because you ARE the best-)

Say Happy Holidays
Say Brixel and "}"

(fin)

rockstar在线运行

1
brixelCTF{5667236346614}

Quizbot

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
# -*- coding: utf-8 -*-
#!/usr/bin/python

import requests
import re
#import asyncio

sess = requests.Session()

url = "http://timesink.be/quizbot/index.php"
response = sess.get(url).content
#print(response)

#先获取问题答案
#for i in range (0,1000):
# result = sess.post(url,data={"insert_answer":"getrightanswer","submit":"answer"})
#print(result.content)
#strings = re.findall(r'<div id="answer" align="center">(.*?)</div>',result.content)[0]
#print(strings)

#提交正确答案
f = open("/Users/chenyi/Downloads/a.txt")
line = f.readline()
while line:
for i in range (0,1000):
#去换行符
line = line.strip('\n')
result = sess.post(url,data={"insert_answer":line,"submit":"answer"})
print(result.content)
line = f.readline()

f.close()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
beach boys
five
red
albania
green
knee
arizona
vodka
yuri gagarin
wear it
judas escariot
duck billed platypus
dolphin
john lenon
red rum
lee majors
sheep
mekon
robin (batman and robin)
calling birds
the bush kangaroo
tightrope walker
gnasher
camels
david jason
benny goodman
louis bleriot
sylvester stallone
crimean
john logie baird
golfer
sparrow
lose their leaves in winter
spoon
dentist
lady chatterlys lover
plum
six
the producers
douglas bader
admiral benbow
harry houdini
christopher columbus
napoleon bonaparte
margaret mitchell
the black death
pinocchio
walt disney
eat porridge
victoria cross
beards
barrister
bogart
dolly parton
international monetary fund
thomas the tank engine
china
microsoft
eat it
rick's
casino royal
dog
schilling
red crescent
jack
he invented dynamite
roger bannister
mountains in scotland
toyota
republic of ireland or eire
the curies
hair
john constable
number 13
kit or kitten
france
harry palmer
brotherhood of man
turkey
fish
cigar
ants
sulphuric
parliament
hare
doc savage
oliver hardy
fish
blood groups
potato
hamlin
lourdes
calcutta
hovercraft
scarecrow
shoes
toenails
german measles
talc
mona lisa
puccini
india
george orwell
shoemaker
china
barbara stanwyck
grenadine
art of dancing
horses
alexander dumas
hocus pocus
louis bleriot
dr no
silence of the lambs
addis ababa
medicine
motorcycle racing
alaska
berlin mexicolondon
woody allen
amnesty international
nelson mandela
tutankamen tomb
pluto
jackie joyner-kersey
jayne austin
archimedes
johan sebastian bach
minnesota twins
your holiness
edinburgh
tchaikovsky
the deaf
jack benny
jonah
mrs doubtfire
bishop
blitzkrieg
cabbage
i. kingdom brunel
donald campbell
buick - chrysler
joseph heller
netherlands
chess world champs
chrysanthemum
hit gong
bordeaux
logarithms
ibm fortran
tuberculosis
delaware
winds
roald dahl
oscar wilde
kirk douglas
sir francis drake
tara
washington redskins
freemasons
bob dylan
lead
jonathon swift
sunken fence
hari kari
william harvey
hedge sparrow
greece
hermes
rock hudson
aldus huxley
regions of italy
jodhpur
john
judo
skiing
diamonds
stanley kubrick
glass
clive staples lewis
squirrel
first test tube baby
adolf hitler
grandma moses
israel
sherlock holmes
trees
oedipus
thomas paine
palermo
polaroid
pink floyd
pinocchio
uranium
porcelain
germany
pendulum clock
hindu
oil
kenya
the great escape
nosebleed
around the world in 80 days
hippopotamus
perseus
tin and lead
kodak 1
philosophers
barometer
pablo picasso
pitcairn islands
the great escape
nosebleed
around the world in 80 days
hippopotamus
perseus
tin and lead
kodak 1
philosophers
barometer
pablo picasso
pitcairn islands
po
husband
colonies of portugal
moonshine
priam
machu picchu
san francisco 49 ers
herman melville
dick turpin
the flash
mercedes
queensland
ragnarok
underground railway
arthur ransom
mustard
vidkun quisling
rabat
square thus square meal
buddhist
linux computer operating system
rhesus monkey
rhodesia
rice
lawyer
stethoscope
the rolling stones
zero
erwin rommel
rosetta stone
the university boat race
faberge
cured /smoked cod roe
science fiction
randolph scott
taste
sein fein
ransome olds
christian barnard
dog star
slide rule
socrates
thomas octave murdoch sopwith
south dakota
malaria
mariner 9
regions of spain
skiing
igor stravinsky
subpoena
john surtees
breaststroke 16th century
switzerland
thermometer
tank
tantalus
edgar rice burroughs
tea
marconi
martina navratilova
terracotta
state of texas
macbeth
john buchan
new york giants
soya bean curd
triton
tina turner
ussr
trenton
peter ustinov
vacuum or thermos flask
vesta
vines
colour television
dashiell hammett
yosemite usa
zip fastener
napoleon
oral contraceptive
whittle jet engine
tennis
pennsylvania
fay wray
america's cup
hops
congo
abo blood groups
george washington 1798 1792
japan
paul newman
diners club
poisoned by chemicals work
eating horsemeat
florida
jury bribing
australia story of kelly gang
anita loos
stuffing birds
librarian
federal reserve bank manhattan
communist - rob rich
charles atlas
fell off toilet
oscars
dog doing life for killing cat
eiffel tower
oysters - wrapped in bacon
mystery of edwin drood
sargasso sea
dewrinkle prunes
readers digest
st nicholas
sell second hand furniture
rabbits
shelly winters
serve wine
vatican city
rock around the clock
denmark
michael jackson
swagman's knapsack
germany
davy crocket
karl malden
american flag
blaire general
jellyfish
ptolemy dionysus
artful dodger
charlie chaplin
ginger rodgers
peaquod
herbert hoover
h g wells
ash wednesday
brookfield
captain flint
the untouchables
poland
telstar by the tornados
mexico
cats
military belt
w
shakespeare - agatha christie
olympic
onions
margaret rutherford
greek -alpha beta
loving and giving
the robe
senlac hill
apple
gold
its all over now
sharks jets
double eagle
franz liszt
15th july
mushrooms
feet
practice balls
salmon
sax rohmer
edith blyton
rod stiger
singer sewing machine in 1850s
inri
honey
zodiac
saturn
flower arranging
american
portugal
milk
sea creatures and birds
duluth minnesota
brush
claudius
helen of troy
horse bits
ensign chekov
cliff richard
ivory
arachne
carry on sergeant
lauren bacall
cow yak cross
long sighted
dalai lama
mistletoe
jerry lewis
bullfighting
piper at the gates of dawn
venice
kissing cousins
venus de milo
britain - boer war
maltese falcon
8 marriages
napoleon bonaparte
see in the dark
temperature not below 13 c 55f
bourse
beethoven
wild thing
maroon
tokyo
baby face
ronald regan
grape knee high
leather
calf
goldfinger
piano
tongue
wood
art theft
saw woman in half
victor hugo
flamingo
apollo
alexander the great
diogones
toothbrush
motorists in canals 39
ww1 gas mask filters
american indians
violet
hydrochloric acid
australian football
roo
charles bronson
perseus
rose
umbrellas
the mannequin pis
swedish
charles lindbergh
killed in battle
idaho
boris pasternak
joe shlabotnik
may
john fitzgerald kennedy
ice crystals
eating with forks
knitting stitches
typhoid mary
milking a cow
as food or chow
small orange
aphrodite
crossword
badgers
parsley
to cook
phidipedes
starfish
la scala
alcohol
dog
egypt
alvin stardust
lettuce
washes it in water
ounce
coffee
king camp gillette
norwegian
brandy cointreau lemon juice
swine
irish gaelic language
birds eggs
cork
smallpox
nine of diamonds
vermeer
finland
economics
london (eltham)
back of head
francis scott-key
sausages
jean claude van dam
grace kelly
ships compass
elizabeth taylor
monaco
once thought to be aphrodisiacs
treacle - molasses
falkland islands
sergeant joe friday
liberia
albion
its belly
not wear underwear
batchelor maybe gay
a moose
contains telephone
punch and judy man
press suits
clocks right and wrong confuse devil
dubbed in their singing voices
lamborghini
news stories
hot sausage
eat it
november
some like it hot
quart glass
roller skates
hertford hereford hampshire
he was dead
tinfoil
port
freemasons
joan rivers
toothache
alcohol strength
eye 15.75 inches
transylvania
isaac newton
put male female washing together
to pick noses efficiently
little richard
a kind of hairnet
jayne mansfield
britain
tea pot
abyssinia
frankie valli
cotton
kissing
electric chair
mexico
shakespeare
guinness book of records
elvis 20 million day after death
mickey mouse
iceland
ringo starr
bird shit
us marine corps
swollen feet
sea horse
zorro
duran duran
russia
dew
henry 8
russia czar nicholas
joint heir
tremaloes
archimedes
voting - elections
palm
chickadees
north island new zealand
ian fleming
alfred hitchcock
goldfinger ,diamonds are forever, moonraker
steeplechase
orange
washington - franklin
johnny weismuller
hands
greeks
seeing distance under 1000yd
false teeth
romans
thaddeus
imperfection
anchor
for cash
jolly rodger
angola
john denver
saw
woman of the year
hair oil
hangman
detergent
jackie stuart
gernsbeck
michael caine
rain
turnip
april fools day 1st april
bigamy
blackbeard
soap
black
camels
captain bligh
the road runner
greek
jamaica
lenny bruce
zip fastener
fbi
harry bellefonte
c-p3o
pigs hair
aluminium
chester gould
onion
freckles
very small pig
margarine
elias
the pope
bacon prunes
i play
the who
giraffe
muscles
deep blue
js bach
fly across atlantic alcock brown
jewish ravioli
magpie
beards
decca
iran
nightstick
supergirl
venezuela
two penny blue
hungary
vietnam currency
robin
naming hurricanes
zone improvement plan
birch
turkish bath
polo
kellogg corn flakes
leader of flock of sheep
whiter shade of pale
cats eyes
hippopotamus
pocket watch / clock
diamond
jezebel
scarlet pimpernel
walnut
sticky fingers
an otter
st vitas
bamboo
mrs pyncheron
mark twain
sid vicious
charon
james herriot
formic acid
terry nation
mixed bathing
venice
alan arkin
lloyds of london
archery
david copperfield
trees
motor rallying
nero
lp record
sight
squirrels tails
eagle dropped tortoise on head
queen diamonds
gustave
polio
cancer
stainless steel
al capone
the pelican
stay away joe
alarm clocks
egypt
danny boy
fertility
portugal
uruguay
mountain of light
rivers (originally nile)
newfoundland
his sister
darkie
lady godiva
carbon
james
ghandi
napoleon at waterloo
foxes
tommy burns - both 1st kos
tail unit
lousia may alcott
iris
brussels
ham gravy
maria
morris garages
charlie chaplin
cyclops
rainfall
bowls
korean
russian flogging whip
english
burt lancaster
cholera
japan
roman 4 horse chariot
hot se aussie wind
yiddish
beetroot
polynesia
walter
go into space
finland
anvil they are parts of it
beech
green
encore
sheep
dried meat
mackerel
cheese
greece
cholera
lassie
rats
hole in doughnuts
maori
nevil shute
avocado
jesuits
machiavelli
turkey
sheherazade
the pickwick papers
grease
liquorice
annie oakley
kappa
tobacco smoke
cook
average cloud cover
ride new escalators
rowena
daffodil
ballet dancer
socrates
armour
loire
october
mjolnir
king herod
oswald the rabbit
penicillin
p c wren
laughing cos he was not dead
mustapha the tailor
wisconsin
hitched a lift passing car
red
peacocks
tea
egypt
china
table tennis
oregano
marcel
charms
policeman
dapple
invisible ink writing
watch
ravens
animal skins
grey
pepsi-cola
doctor dolittle
mischa
eggs
kittens
star
zimbabwe
christmas crackers
wisdom
small spanish horse
drunk
ski slope
kitten
green
put together
turkey
gazelle
marbles
spiced ham
kiss my arse
horse
victoria falls
contaminated water diseases
bananas
capybara
curling
organised motor race
japan - south korea
parking meter
rene decartes
great wall of china
a moth
many gods
thespis
marlene dietrich
dancing mania
booker mcconnell
aussie rules football teams
taiwan's
pulitzer prize winners
australia
safety pin
insulin
herman hollerith
she was dead
worlds smallest true fish
body joints
league
holograms
john d rockerfeller
metal bridge
judaism
mourning
cricket
cuba
william gibson - neuromancer
harvest
casablanca
hooves
esperanto
oscar wilde
gustav holst
classical architecture
uniform
male entries nude
louisville kentucky
barbed wire
moon river
nobel peace prize
uruguay
bird
tin can
albert einstein
leprosy
joint photographic experts group
south china
madagascar
fungi
gaelic football
can opener
popes
coco-de-mare palm - double coconut
fish
sperm
inoculations - injections
k2
electric razor
uk prime ministers
falling into you
light flyweight
canada
esperanto
mosquitoes
marie curie physics 1903 chemistry 1911
euclid
acupuncture
montana
cash register
henry fielding
stanley cup winners ice hockey
colombia
giraffe
periodic table
different side lengths
buried alive
ox
knees
microwave oven
st linus
the lost weekend
putrid pot
theresa draco
the body
big bunny
the law
the dutch
sailor
puffin
sub 5 minute mile
m
the blood
cinderella
latin
hamburger college - chicago
leslie charteris
growing silkworms
tick a tape for stockmarket
being cold
sony
johnny logan 1980 - 1987
richard wagner
vinci
john carpenter
chromium
nellie melba
torpedo
alcohol
far seeing
served cold
nemesis
authorised version of bible
animal farm in 1954
wellington re harriot wilson mistress
oil wells
india
double meaning
bob geldorf
being beaten
ether
sweet charity
corporal clinger
putter
eric clapton
china
algeria
bee
nova scotia
pigeon
asparagus
dog
papa
a broad pickle fork
camouflage colours
the garden
tutankhamens coffin
head in lions mouth
in large jar of honey
whale
bing crosby
ravens
in your home
carpet sweeper
being penniless
chess
the boston strangler
france
bear
siam - thailand
fork
appear on tv
cleo lane
crystal
type of cattle
easter island
in a real tennis court
steppenwolff
weekly
six wheels
australia new s wales
alcoholism
mystery writing
snow proof dungaree trousers
apothecaries
el greco
1
brixelCTF{kn0wl3dg3}

Internet

Pathfinders #1

使用.htaccess保护文件夹时,账号密码等相关配置信息在.htpasswd.htpasswd文件的格式为username:password

Pathfinders #2

同样访问提示file not ending in .php, terminating.
题目提示oh yeah, let's assume they are running a php version below 5.3.4 here...
%00截断