Skip to content

Commit fe50d6f

Browse files
committed
new posts yippie
1 parent e3d6dbd commit fe50d6f

File tree

7 files changed

+235
-0
lines changed

7 files changed

+235
-0
lines changed
Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
title: Afghanistan
3+
date: 2025-10-15
4+
categories:
5+
- Capture The Flags
6+
- Diver OSINT CTF 2025
7+
tags:
8+
- ctf
9+
- diver osint ctf 2025
10+
- osint
11+
- writeups
12+
description: Diver OSINT CTF 2025 Afghanistan Challenge
13+
---
14+
15+
16+
> Challenge description:
17+
>
18+
>When and where was the photo shown at 65-67 seconds in this video taken?
19+
Flag format: Diver25{location name_YYYY-MM-DD} (location name should be in English)
20+
For example, if it was taken at Camp Darby on June 5, 2025, it would be Diver25{Camp Darby_2025-06-05}.
21+
{: .prompt-info }
22+
23+
okay, so the photo we're looking for is this:
24+
![two soldiers playing basketball](/assets/img/diver25/afghanistan/basketball.png)
25+
26+
And after throwing the image into Google images, we were able to find this link: `https://www.gettyimages.com/detail/news-photo/two-us-soldiers-from-1st-infantry-division-play-a-game-of-news-photo/1248038111`
27+
28+
![the getty images site](/assets/img/diver25/afghanistan/getty-images.png)
29+
30+
The site even provides a description of the photo too!
31+
> TOPSHOT - Two US soldiers from 1st Infantry Division play a game of basketball at ISAF's Camp Bostick in Naray, in Afghanistan's eastern Kunar province on April 16, 2009. The ISAF deployment numbers more than 58,000 troops from 42 countries, according to its latest information. It works alongside a US-led coalition that is estimated to number around 10,000 although the figure is not public. AFP PHOTO/LIU Jin (Photo by LIU JIN / AFP) (Photo by LIU JIN/AFP via Getty Images)
32+
33+
Following the flag format, let's submit the flag!
34+
35+
FLAG: `Diver25{Camp Bostick_2009-04-16}`
Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
---
2+
title: Rust fixme 3
3+
date: 2025-08-19
4+
categories: [Capture The Flags, picoCTF]
5+
tags: [ctf, picoctf, general skills, writeups]
6+
description: picoCTF Rust fixme 3 Challenge
7+
---
8+
9+
10+
> Challenge description:
11+
>
12+
>Have you heard of Rust? Fix the syntax errors in this Rust file to print the flag!
13+
{: .prompt-info }
14+
15+
Alright, this is the final one of the Rust fixme series (as of yet), so let's dissect this one now.
16+
17+
```terminal
18+
❯ cargo run
19+
Compiling crossbeam-utils v0.8.20
20+
Compiling rayon-core v1.12.1
21+
Compiling either v1.13.0
22+
Compiling crossbeam-epoch v0.9.18
23+
Compiling crossbeam-deque v0.8.5
24+
Compiling rayon v1.10.0
25+
Compiling xor_cryptor v1.2.3
26+
Compiling rust_proj v0.1.0 (/picoCTF/rust-fixme-3/fixme3)
27+
error[E0133]: call to unsafe function `std::slice::from_raw_parts` is unsafe and requires unsafe function or block
28+
--> src/main.rs:31:31
29+
|
30+
31 | let decrypted_slice = std::slice::from_raw_parts(decrypted_ptr, decrypted_len);
31+
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ call to unsafe function
32+
|
33+
= note: consult the function's documentation for information on how to avoid undefined behavior
34+
35+
For more information about this error, try `rustc --explain E0133`.
36+
error: could not compile `rust_proj` (bin "rust_proj") due to 1 previous error
37+
```
38+
39+
```rust
40+
use xor_cryptor::XORCryptor;
41+
42+
fn decrypt(encrypted_buffer: Vec<u8>, borrowed_string: &mut String) {
43+
// Key for decryption
44+
let key = String::from("CSUCKS");
45+
46+
// Editing our borrowed value
47+
borrowed_string.push_str("PARTY FOUL! Here is your flag: ");
48+
49+
// Create decryption object
50+
let res = XORCryptor::new(&key);
51+
if res.is_err() {
52+
return;
53+
}
54+
let xrc = res.unwrap();
55+
56+
// Did you know you have to do "unsafe operations in Rust?
57+
// https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html
58+
// Even though we have these memory safe languages, sometimes we need to do things outside of the rules
59+
// This is where unsafe rust comes in, something that is important to know about in order to keep things in perspective
60+
61+
// unsafe {
62+
// Decrypt the flag operations
63+
let decrypted_buffer = xrc.decrypt_vec(encrypted_buffer);
64+
65+
// Creating a pointer
66+
let decrypted_ptr = decrypted_buffer.as_ptr();
67+
let decrypted_len = decrypted_buffer.len();
68+
69+
// Unsafe operation: calling an unsafe function that dereferences a raw pointer
70+
let decrypted_slice = std::slice::from_raw_parts(decrypted_ptr, decrypted_len);
71+
72+
borrowed_string.push_str(&String::from_utf8_lossy(decrypted_slice));
73+
// }
74+
println!("{}", borrowed_string);
75+
}
76+
77+
fn main() {
78+
// Encrypted flag values
79+
let hex_values = ["41", "30", "20", "63", "4a", "45", "54", "76", "12", "90", "7e", "53", "63", "e1", "01", "35", "7e", "59", "60", "f6", "03", "86", "7f", "56", "41", "29", "30", "6f", "08", "c3", "61", "f9", "35"];
80+
81+
// Convert the hexadecimal strings to bytes and collect them into a vector
82+
let encrypted_buffer: Vec<u8> = hex_values.iter()
83+
.map(|&hex| u8::from_str_radix(hex, 16).unwrap())
84+
.collect();
85+
86+
let mut party_foul = String::from("Using memory unsafe languages is a: ");
87+
decrypt(encrypted_buffer, &mut party_foul);
88+
}
89+
```
90+
91+
Okay, so it looks like our issue here is explained in the comments `calling an unsafe function that dereferences a raw pointer`. In Rust, when you do unsafe things with the language, you should include them within a `unsafe` block. Thankfully for us, the block is simply commented out, and we can remove the comments to make the program work again.
92+
93+
Our fixed source code should look like the following:
94+
95+
```rust
96+
use xor_cryptor::XORCryptor;
97+
98+
fn decrypt(encrypted_buffer: Vec<u8>, borrowed_string: &mut String) {
99+
// Key for decryption
100+
let key = String::from("CSUCKS");
101+
102+
// Editing our borrowed value
103+
borrowed_string.push_str("PARTY FOUL! Here is your flag: ");
104+
105+
// Create decryption object
106+
let res = XORCryptor::new(&key);
107+
if res.is_err() {
108+
return;
109+
}
110+
let xrc = res.unwrap();
111+
112+
// Did you know you have to do "unsafe operations in Rust?
113+
// https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html
114+
// Even though we have these memory safe languages, sometimes we need to do things outside of the rules
115+
// This is where unsafe rust comes in, something that is important to know about in order to keep things in perspective
116+
117+
unsafe {
118+
// Decrypt the flag operations
119+
let decrypted_buffer = xrc.decrypt_vec(encrypted_buffer);
120+
121+
// Creating a pointer
122+
let decrypted_ptr = decrypted_buffer.as_ptr();
123+
let decrypted_len = decrypted_buffer.len();
124+
125+
// Unsafe operation: calling an unsafe function that dereferences a raw pointer
126+
let decrypted_slice = std::slice::from_raw_parts(decrypted_ptr, decrypted_len);
127+
128+
borrowed_string.push_str(&String::from_utf8_lossy(decrypted_slice));
129+
}
130+
println!("{}", borrowed_string);
131+
}
132+
133+
fn main() {
134+
// Encrypted flag values
135+
let hex_values = ["41", "30", "20", "63", "4a", "45", "54", "76", "12", "90", "7e", "53", "63", "e1", "01", "35", "7e", "59", "60", "f6", "03", "86", "7f", "56", "41", "29", "30", "6f", "08", "c3", "61", "f9", "35"];
136+
137+
// Convert the hexadecimal strings to bytes and collect them into a vector
138+
let encrypted_buffer: Vec<u8> = hex_values.iter()
139+
.map(|&hex| u8::from_str_radix(hex, 16).unwrap())
140+
.collect();
141+
142+
let mut party_foul = String::from("Using memory unsafe languages is a: ");
143+
decrypt(encrypted_buffer, &mut party_foul);
144+
}
145+
```
146+
147+
So lets run it again now!
148+
149+
```terminal
150+
❯ cargo run
151+
Compiling rust_proj v0.1.0 (/picoCTF/rust-fixme-3/fixme3)
152+
Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.08s
153+
Running `/picoCTF/rust-fixme-3/fixme3/target/debug/rust_proj`
154+
Using memory unsafe languages is a: PARTY FOUL! Here is your flag: picoCTF{n0w_y0uv3_f1x3d_1h3m_411}
155+
```
156+
157+
FLAG: `picoCTF{n0w_y0uv3_f1x3d_1h3m_411}`
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
title: hidden_service
3+
date: 2025-10-15
4+
categories:
5+
- Capture The Flags
6+
- Diver OSINT CTF 2025
7+
tags:
8+
- ctf
9+
- diver osint ctf 2025
10+
- osint
11+
- writeups
12+
description: Diver OSINT CTF 2025 hidden_service Challenge
13+
image: /assets/img/diver25/hidden-service/hidden_service.jpg
14+
show_image: false
15+
---
16+
17+
18+
> Challenge description:
19+
>
20+
>See the attached file and capture the flag!
21+
{: .prompt-info }
22+
23+
Okay, let's take a look at this file now:
24+
25+
![crumpled paper showing a .onion link](/assets/img/diver25/hidden-service/hidden_service.jpg)
26+
27+
Okay! This one should hopefully be easy. All we see is a URL, but this one is special
28+
29+
Let's quickly break down how URL's look using this one: `https://example.com`
30+
31+
The `https` part, that is the part before the `://` specifies the protocol to use. After that part is the domain name, which is `onion` in our case. And finally, we have the Top Level Domain, or TLD. That's the `.com` part at the end.
32+
33+
This link, however, has a `.onion` TLD, which is a special TLD I'll let Wikipedia do the talking here:
34+
35+
> .onion is a special-use top-level domain name designating an anonymous onion service, which was formerly known as a "hidden service", reachable via the Tor network. Such addresses are not actual DNS names, and the .onion TLD is not in the Internet DNS root, but with the appropriate proxy software installed, Internet programs such as web browsers can access sites with .onion addresses by sending the request through the Tor network.
36+
{: .prompt-info}
37+
38+
We can access the site using Tor, which is a browser that connects to the Tor network. and when we do, our flag is there.
39+
40+
![the flag](/assets/img/diver25/hidden-service/flag.png)
41+
*While true that many "Dark Web" sites use Tor to remain anonymous, the mere fact of using Tor doesn't make you a criminal. Journalists and privacy enthusiasts also use it for its privacy features.*
42+
43+
FLAG: `Diver25{w3lc0m3_70_d4rkw3b!}`
470 KB
Loading
375 KB
Loading
27.7 KB
Loading
559 KB
Loading

0 commit comments

Comments
 (0)