SQL Challenges Like last year, there were several SQL Challenges that build on each other and whose solutions are discussed below. Prepare SQL To work with the SQL files we suggest to import the backup into a MySQL DBMS, so you can connect to the database and select the infos out of it 🙂 I used a maria-db docker container.
Here are the flags and the walkthrough Shop-Knock Knock Knock Okay then, this should be something easy… lets look for a bunch of logins from the same ip. You could use something like this or even look into the file… cat DownUnderShop.JSON# | jq '. | .origin, .url' | grep -B1 login Then you will see, that the IP of
Ogres are like onions First of all, we do as we are told and download the docker container. Like described in the task, we can do this with docker run -tp 8000:8000 downunderctf/onions After container is started, we can open the webpage provided by the docker container. There are four memes of shrek and one image is not accessable (if
Just the 2 of us solved 150 points Solves: 140 Medium Tell us the name of these 2 musical instruments Flag format: EZ-CTF{Instrument1_Instrument2} (From left to right) Solving This was not as easy as I thought in the first place. I ended up, splitting the two files and search for each of them. For the second one, I found this
Limo 190 points Solves: 95 Medium Find this limo and tell us how many side windows it has Flag format: EZ-CTF{Name_of_the_Band_Number_Windows} Example: EZ-CTF{Duran_Duran_163_Windows} Solving We’ve got this strange picture of to women behind the challenge name given limo. After feeding yandex.com with this picture, I found some results pointing to the music video for a song from the band Aphex
Hue is This? 170 points Solves: 82 Medium I think you need to do a -180 turn to find her name and the song. Flag Format: EZ-CTF{Her_Name_And_The_7th_Song_In_The_Album} Solving Okay a good old osint challenge. I uploaded the image on yandex.com and was able to find the correct image. It is an album cover for the goa album Rock Bitch Mafia
American 150 points Solves: 129 Easy Find the Gallery, find Mr. Gud, find the cow. Flag format: EZ-CTF{Mr_Gud_Full_Name_Cow_Painting_Name} Solving The given image is from James Ayers and is called The Rebellious One. But this is not what we are looking for, because we look for the name of Mr. Gud and a cow painting. So if you look further into
Wavie Wave solved 200 points Solves: 146 Medium What the hell is this sound that got into my "Chill Bird Vibes Vol XXI" mixtape? https://a.tmp.ninja/oLAHFlds.zip Flag format: EZ-CTF{FULL_MESSAGE} Solving Let’s have a look at the spectogram of this wave file. Maybe there is something hidden 🙂 EZ-CTF{KNOW_YOUR_SPECTOGRAAAAMS}
OMG 80 points Solves: 218 Easy I apologize for this one I annoyed myself creating it 🙂 Solving Just cat the file… you will the flag in kind of ascii-art. Maybe you need to zoom out a bit. Here is a screenshot of my console: EZ-CTF{1_HAT3_TH15_FL4G}
No Kidding 70 points Solves: 209 Easy No Other Kids Invent Anything like this…lol Flag Format EZ-CTF{WHATEVER_THE_MESSAGE_IS_ALL_CAPS} Solving This looks like Multi-tap or something similar… let’s just use the numbers and see what happens. I’ll use dcode.fr for this. 8/44/444/7777\\\444/7777\\\8/44/33\\\555/2/6/33/7777/8\\\222/8/333\\\333/555/2/4\\\33/888/33/33/33/33/777 T H I S\\I S\\T H E\\L A M E S T\\C T F\\F L A G\\E V E E