Pico is a global leader in total brand activation specialising in engaging people, creating experiences and activating brands. PICO 2019 is scheduled to take place again in Kasteel Vaalsbroek located at the bordering point of Belgium, Germany and The Netherlands. Topical issues of advanced electron microscopy research will be highlighted in keynote presentations given by leading invited speakers plus further poster presentations from the wider scientific community.

• Pico 2019 Write Up Paper
• Pico 2019 Write Up Template

Contents

The Numbers (50)

This was basically the warm-up for the crypto category. We get an image which represents the encoded flag (as you’ll see in a moment, you can’t call it encrypted):

The flag format is also specified within the challenge: PICOCTF{}. We see that there are exactly 7 letters before {, so each number represents one letter ( ‘P’ -> 16, ‘I’ -> 9, ‘C’ -> 3, etc.). It didn’t take me long before discovering the rule: the letter ‘P’ is on the 16th position in the alphabet, the letter ‘I’ on the 9th, and so on. Because I am very lazy, I wrote a simple python script to get the flag:

After running the script, we get the flag:

Flag: PICOCTF{THENUMBERSMASON}

13 (100) {#13}

I won’t explain ROT13 here, you can find more about it online. One interesting to note, though, is that Linux has a program called ‘rot13’ that can be used to easily encode/decode a string using ROT13:

Flag: picoCTF{not_too_bad_of_a_problem}

Easy1 (100)

Pico 2019 Write Up Paper

There’s also a file attached containing the following text:

Anyone who has a decent knowledge of cryptography will recognize this as a Vigenère cipher. We can use an online tool to get the flag:

Flag: picoCTF{CRYPTOISFUN}

caesar (100)

Along with the text, we ar given a file containing the following message:

The text between the curly braces (ynkooejcpdanqxeykjrnpavoth) is encrypted using a classical caesar cipher. We can use this tool to bruteforce the key (which is just the shift of the letters, so we only have 26 possible keys):

The plaintext was encrypted using the shift value 3.

Flag: picoCTF{crossingtherubiconvrtezsxl}

Flags (100)

We are also given the following image:

The flag is encoded using the maritime flag system. This article gives a very good explanation of this system. Basically, each flag represents a letter/number: </figure>

The flag is all uppercase.

Flag: PICOCTF{F1AG5AND5TUFF}

Mr-Worldwide (200)

I still don’t understand the ‘musician’ clue. In order to obtain the flag, we search each of those coordinates on google and take the first letter of the city they point to.

For the first pair of coordinates, for example, the first letter of the city name is K.

Flag: picoCTF{KODIAK_ALASKA}

Tapping (200)

This time, we get an address and a port to connect to. Unfortunately, the returned text is static and the challenge is simple 😛

The ‘tapping coming in from the wires’ is a clear reference to Morse code. There are a lot of online tools that can decode the flag; I used this one.

We just need to replace ? with {} and capitalize the text.

Flag: PICOCTF{M0RS3C0D31SFUN903140448}

la cifra de (200)

Again, we are given an IP address and a port number to connect to:

After multiple attempts in decrypting the ciphertext, I found it to be encrypted with the Vigenère cipher. In order to decrypt the ciphertext, we also need a key, which is usually a word. I used this online tool to crack the key:

In addition to the plaintext, the tool also gives us the key: flag.

Flag: picoCTF{b311a50_0r_v1gn3r3_c1ph3rb6cdf651}

rsa-pop-quiz (200)

Pico 2019 Write Up Template

If you do not know anything about RSA, I recommend one of my previous articles. Let’s connect to the specified IP & port and see what we have to do:

There will be several ‘problems’ that test our understanding of RSA. I will post a screenshot with every problem, along with a python code snippet that shows the formulas I used. If you don’t understand something, feel free to ask me in the comments or just USE GOOGLE. The first problem is pretty simple:

The second problem implies using the same formula:

Because of the factoring problem, the 3rd problem does not have a solution:

The fourth problem requires a new formula for phi/totient(n):

The fifth problem finally requires us to encrypt a plaintext:

Having only the ciphertext and the public key (WHICH WAS SECURELY GENERATED), it’s impossible to deduce the plaintext:

The 7th problem swiftly moves us in the direction of decryption, introducing the formula for d:

The 8th problem asks us to decrypt a ciphertext:

After finishing the last problem, the service tells us that the plaintext is the numeric representation of the flag string. We an easily recover the flag using the long_to_bytes() function:

Flag: picoCTF{wA8_th4t$_ill3aGal..o1c355060}

miniRSA (300)

I would like to start by telling you that the ‘small thing’ is located in the attached file, not outside your computer. Speaking of the attached file, it contains an RSA public key and a ciphertext:

When e is very small (3), N very big and the plaintext is short, the ciphertext becomes the plaintext raised to the power of e: ct = pt ^ e mod n = pt ^ e if pt ^ e < n. We can use python to extract the flag:

Flag: picoCTF{n33d_a_lArg3r_e_11db861f}

waves over lambda (300)

The service serves some static text:

The title is the formula for frequency, which is a hint to using frequency analysis. This is the part where one of my favorite websites, quipquip, comes in:

We just have to paste the ciphertext, click on ‘solve’ and wait a few seconds. In addition, we can just fill in the missing letters, as the flag consists of an intuitive sentence.

Flag: frequency_is_c_over_lambda_drtmtnddlw

b00tl3gRSA2 (400)

As a general rule, we can switch e with d and RSA will still work. However, if the e value is small or a default value (like 3/65537), the cryptographic system can be easily broken, as d will be known. Also, I have to appreciate that n and e change for every connection we make to the server:

Because a default value of e was assigned to d, we don’t need to bruteforce anything (d=65537). We can use python (again) to get the flag:

Flag: picoCTF{bad_1d3a5_4986370}

AES-ABC (400)

Along with the challenge’s text, we get an encrypted file and the python script used to encrypt the original file:

Basically, the nth block of AES-ABC represents the sum of the first n blocks of AES-ECB. The .ppm extension looked familiar, so I searched the web and found the following image: </figure>

The .ppm extension was used to demonstrate this property of AES-EBC. If we are able to recover the file encrypted image using ECB mode, we should theoretically be able to read the flag. I used the following script to get that image:

After running the script, a new file is created that contains the readable flag:

Flag: picoCTF{d0Nt_r0ll_yoUr_0wN_aES}

b00tl3gRSA3

The public key changes for every connection, so I’ll just save some parameters in a file, as the flag will (hopefully) not change in the near future:

From the challenge text, we know that n has more than 2 prime factors. This makes RSA insecure, as the prime factors have to get smaller in order to generate a 2048-bit n. Alpetron’s Integer Factorization Calculator is able factorize n in less than 2 seconds:

We can now easily calculate d and decrypt the ciphertext. The only difference between 2-prime RSA and this implementation is that we need to use a more generalized formula for totient(n) (phi is equal to the product of all the factors of n, each decreased by 1). I used the following script o get the flag:

The script outputs exactly one thing: the flag.

Flag: picoCTF{too_many_fact0rs_8024768}

john_pollard (500)

We are also given a public RSA certificate:

We can use pyCrypto’s built-in PEM parser to get n and e:

n is very small (4966306421059967), so we can use Alpetron again to get p and q:

Flag: picoCTF{73176001,67867967}

Problem

There appear to be some mysterious glyphs hidden inside this abandoned factory… I wonder what would happen if you collected them all?

Solution

This writeup is by my teammate Andrew Chang

Problem

Can you convert the number 42 (base 10) to binary (base 2)?

Solution

flag: picoCTF{101010}

Problem

If I told you a word started with 0x70 in hexadecimal, what would it start with in ASCII?

Solution

flag: picoCTF{p}

Problem

What is 0x3D (base 16) in decimal (base 10).

Solution

flag: picoCTF{61}

Problem

What does this bDNhcm5fdGgzX3IwcDM1mean? I think it has something to do with bases.

Solution

The flag is encoded with base64.

flag: picoCTF{l3arn_th3_r0p35}

Problem

Can you find the flag in file? This would be really tedious to look through manually, something tells me there is a better way. You can also find the file in /problems/first-grep_3_2e09f586a51352180a37e25913f5e5d9 on the shell server.

Solution

As suggested by the challenge name, we can use the bash command grep to search for the flag:

flag: picoCTF{grep_is_good_to_find_things_eda8911c}

Problem

We put together a bunch of resources to help you out on our website! If you go over there, you might even find a flag! https://picoctf.com/resources (link)

Solution

The flag is on the resources page.

flag: picoCTF{r3source_pag3_f1ag}

Problem

Can you find the flag in file without running it? You can also find the file in /problems/strings-it_5_1fd17da9526a76a4fffce289dee10fbb on the shell server.

Solution

We can find the flag with a combination of strings and grep:

flag: picoCTF{5tRIng5_1T_dd38f284}

Problem

Using netcat (nc) is going to be pretty important. Can you connect to 2019shell1.picoctf.com at port 4158 to get the flag?

Solution

Use the netcat or nc command:

flag: picoCTF{nEtCat_Mast3ry_700da9c7}

Problem

To get truly 1337, you must understand different data encodings, such as hexadecimal or binary. Can you get the flag from this program to prove you are on the way to becoming 1337? Connect with nc 2019shell1.picoctf.com 20836.

Solution

For this challenge, you have to decode base2, base8, and base16 data. I wrote a short script to automate the process:

flag: picoCTF{learning_about_converting_values_6cdcad0d}

Problem

Can you find the flag in /problems/first-grep–part-ii_4_ca16fbcd16c92f0cb1e376a6c188d58f/files on the shell server? Remember to use grep.

Solution

We can use the -r option in grep to search recursively for the flag:

flag: picoCTF{grep_r_to_find_this_0e28f3ee}

Problem

Sometimes you need to handle process data outside of a file. Can you find a way to keep the output from this program and search for the flag? Connect to 2019shell1.picoctf.com 57911.

Solution

We can use the pipe operator to grep for the flag:

flag: picoCTF{digital_plumb3r_931b2271}

Problem

Can you spot the difference? kitters cattos. They are also available at /problems/whats-the-difference_0_00862749a2aeb45993f36cc9cf98a47a on the shell server

Solution

The flag is all the bytes that differ between the two files. It can be extracted with a python script:

flag: picoCTF{th3yr3_a5_d1ff3r3nt_4s_bu773r_4nd_j311y_aslkjfdsalkfslkflkjdsfdszmz10548}

Problem

I’ve used a super secret mind trick to hide this file. Maybe something lies in /problems/where-is-the-file_4_f26b413d005c16c61f127740ab242b35.

Solution

On unix systems, files that start with a . are hidden by default. We can see these files by using the -a option in ls:

flag: picoCTF{w3ll_that_d1dnt_w0RK_cb4a5081}

Problem

There’s a flag shop selling stuff, can you buy a flag? Source. Connect with nc 2019shell1.picoctf.com 3967.

Solution

By reading the source code, we see that the total_cost is stored as a 4 byte signed integer:

If we enter a large number for number_flags, 900*number_flags would overflow and turn into a large negative number:

flag: picoCTF{m0n3y_bag5_cd0ead78}

Problem

I wrote you a song. Put it in the picoCTF{} flag format

Solution

The given file is a program written in the esoteric language rockstar. We can run the program using this website:

A quick conversion from decimal to ascii gives us the flag:

flag: picoCTF{rrrocknrn0113r}

Problem

I wrote you another song. Put the flag in the picoCTF{} flag format

Solution

This time the program requires some input. We can simply remove these input checks to get to the flag.

Remove these lines:

Output:

Converting it to ASCII:

flag: picoCTF{BONJOVI}