Challenges

One of the office computers has been hit by a better ransomware made by the k3rn3l4rmy hacking group!! We need to recover the flag from the hard drive otherwise the company will fail. Hopefully the malware has some nontrivial issues.

THIS IS LINUX MALWARE DO NOT RUN ON A MACHINE YOU CARE ABOUT.

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/WannaSwirl/Flag-Fixed.txt

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/WannaSwirl/swirl

We wire an encryption message that contains flag from remote server and dumped it out to kernelCTF_dump.pcapng file, i'm pretty sure that client has implementation of algorithm to decrypt data and get flag, will you take up the challenge?

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/WiRE/WiRE-Client.exe

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/WiRE/WiRE_dump.pcapng

"Warning: Weather Control Device detected! ZAP ZAP [insert conscript_death.mp3 here]"
"Note: there is a typo in the flag, sorry >m<."

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/lightningrod/lightningrod https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/lightningrod/burned.crisp

You have finally broken into the k3rn3l4rmy servers and found the file that can take them down however it looks like they use a custom programming language, can you figure out the compiled code?

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Recurso/Recurso

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Recurso/Recurso-Chall/leFlag.recc

One of the office computers has been hit by a ransomware made by the k3rn3l4rmy hacking group!! We need to recover the flag from the hard drive otherwise the company will fail. Hopefully the malware has some issues.

THIS IS LINUX MALWARE DO NOT RUN ON A MACHINE YOU CARE ABOUT.

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/WannaSwirl/swirl https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/WannaSwirl/FlagFolder.txt

You received a suspicious file from the k3rn3l4rmy hacking group, the title says ‘Not a Zip Bomb, Please Open’, you decide NOT to open it and instead try to reverse it.

It is recommended that you do NOT open this, it will fill your entire disk.

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Zabomb/flag.zip

Congrats on having figured out how the new programming language works!! Of course there is always that one person who has to show off by coding in assembly.

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Recurso/Recurso

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Recurso/Rasm-Chall/rasm.recc

Someone attacced by Bogo! I must seek revenge. Now is the time to attacc back!

nc ctf.k3rn3l4rmy.com 2247

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/bogo-attack/main.py

My friend ainz has been offline for ages and we can't predict when he will come online again... so I made this little app to summon him. We need your help too!

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Ainz-Summoning-Ritual/ainz.7z

Find the minimal sum of numbers on a path from the top left corner to the bottom right corner. You can only go right or down in each move.

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Progressive-Dynamite/challenge.txt

I was trying to sort using Bogosort, but it was taking a while, so in the meantime I made this challenge. Enjoy!

nc ctf.k3rn3l4rmy.com 2237

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/BogoSolve/main.py

"After some time in workforce-hibernation (aka unemployed), you have received an offer for a job interview. There is just one problem, it is at the other end of the Universe! Luckily you know your way around the HyperSpace, ehem nerd mm."

nc ctf.k3rn3l4rmy.com 2245

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/3Dangerous-Commute/dangerouscommute.py

Like Nescafeeeee!

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/nescafeee/AES.py

Here's a pwntools tutorial challenge to get you warmed up!

nc ctf.k3rn3l4rmy.com 2236

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Vietas-Poly/template.py

I have build my own system that allow to log-in into K3RN3L DR0ID, but unfortunately i forgot the password, can you help me recover it?

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/kernel-droid/kernel-droid.asm

Flag inside this jar is decrypted by some method that require original class name, but unfortunately class is garbage name, could you recover it and provide valid input password to get flag?

Hint hint: I'm pretty sure you can find the original name in the class structure. Maybe use a java bytecode modifying tool.

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/integrity-check/IntegrityCheck.jar

How much fraction would a fraction fractionate if a fractional fraction could fractionate fractions?

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Fractional-Fractions/main.py

"Some bees convinced me to invest in their new cryptosystem. They said their new XOR keystream would revolutionize the crypto market. However, they quickly buzzed away so all I have is this weird flyer they dropped. Luckily it has some source code on the back."
"Have I just really been scammed by some bees??"

Encrypted Flag: 632a0c6d68a7e5683601394c4be457190f7f7e4ca3343205323e4ca072773c177e6e

Note: The flyer is not needed to solve the challenge, it's just for fun.

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Twizzty-Buzzinezz/honeycomb.py https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Twizzty-Buzzinezz/honeycomb_flyer.png

learn how to intract with a process and solve the quiz.

nc ctf.k3rn3l4rmy.com 2200

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/pwntools-intro/pwntools_intro https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/pwntools-intro/badseed

My teachers been using a commandline gradebook made by a first year student, must be vulnerable somehow.

nc ctf.k3rn3l4rmy.com 2250

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/gradebook/gradebook

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/gradebook/libc.so.6

We found someone running a custom version of the latest wyze cam firmware. Seems like there may be a vulnerable CGI binary:

http://ctf.k3rn3l4rmy.com:4444/cgi-bin/hello.cgi

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/wyze_guy/wyze_guy.zip

If you have never done kernel pwn before, check out this: https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/

nc ctf.k3rn3l4rmy.com 1003

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/easy_kernel/easy_kernel.tar.gz

Captain Malloc lost his hook find it and than grab a shell for your effort.

nc ctf.k3rn3l4rmy.com 2201

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/on_the_hook/on_the_hook https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/on_the_hook/libc.so.6

SILENCE ... can you still pwn this ? (no output is intended)

nc ctf.k3rn3l4rmy.com 2202

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/silent-ROP/silent-ROP https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/silent-ROP/libc.so.6

I dont mean to pry, but how do you buy the flag?

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Pryby/main.py

My friend told me I need LSB to solve this, but I don't do drugs! Can you solve it for me instead?

nc ctf.k3rn3l4rmy.com 2234

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/MathyOracle/main.py

RSA Encryption with Pascal's Triangle! Has to be secure right...

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Pascal-RSA/challenge.txt https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Pascal-RSA/main.py

O say can you see, by the flag's early light, What so proudly we hail’d at the flag’s last gleaming, Whose broad numbers and bright numbers through the perilous fight O’er the numbers we watch’d were so numberly numbering? And the number's red glare, the numbers bursting in air, Gave proof of work through the night that our flag was still there, O say does that star-spangled flag yet wave O’er the land of the numbers and the home of the flag?

nc ctf.k3rn3l4rmy.com 2235

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/United-Trees-of-America/main.py

"To store our most embarrassing secrets, we created a Remote Secure Armoury protected by layered RSA encryption with XOR blinding. Never again will my friends be able to mock me for my use of words!"

nc ctf.k3rn3l4rmy.com 2244

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Total-Encryption/ltet.py

"I chopped up my flag and hid it behind this simple key exchange. Try dlogging your way in if you are brave enough!"

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Tick-Tock/output.txt https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Tick-Tock/ticktock.py

"Welcome to the Shrine of the Sweating Buddha. Share the burden of your worries, my child ~~~."

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs//Shrine-of-the-Sweating-Buddha/pravrallier.py

Hint: share some (7) of your worries and perhaps your fortune will guide you to the flag.

nc ctf.k3rn3l4rmy.com 2243

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs//Shrine-of-the-Sweating-Buddha/pravrallier.py

"They asked me to set up a zero-knowledge proof that runs in polynomial time. I don't know what that means but I assume they want me to use polynomials, right?"

nc ctf.k3rn3l4rmy.com 2232

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Poly-Proof/polyproof.py

"I'm going to say this again: I did not have sexual relations with that polynomial, Miss Polinsky."

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Poly-Expo-go-BRRRRR/polyexpogobrrrrr.sage

"Looks like Harry is hoarding his flags again... Maybe he will stop if we can convince him both Alice and Carlo dislike hoarding too. Alice and Carlo, being stereotypical CTF admins, are not responding to your complaints. Guess you will just have to answer for them... Luckily, I managed to secure you a channel to the domain controller of the CTF server."

nc ctf.k3rn3l4rmy.com 2240

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Objection/objection.py

"What can I say, I just like squares."

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Non-Square-Freedom-2/nonsquarefreedom_hard.py

"See that comb over there? It came from that meteorite I mentioned yesterday. Take a look at this, if I send bytes in, different bytes come out! Then there's this button that seems to just produce random bytes... I'm absolutely stumped :S"

nc ctf.k3rn3l4rmy.com 2239

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Cozzmic-Dizzcovery/pandorascomb.py

"I NEED A PLUMBER ASAP, MY FLAG IS LEAKING ALL OVER THE PLACE!!!"

nc ctf.k3rn3l4rmy.com 2233

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/1-800-758-6237/1-800-758-6237.py

"Hills are easy to climb, but mountains? Hoho, they sure are something else!"

nc ctf.k3rn3l4rmy.com 2238

Note: Wrap the flag with flag format (flag{})

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Aint-no-Mountain-High-Enough/server.py

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Aint-no-Mountain-High-Enough/mountaincipher.py

"I was watching the bees and it seemed as if they were trying to tell me something... Have I finally gone crazy?!?"

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Beecryption/subround.png https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Beecryption/beecryption.py

"John wants to play a game, a game of secrets. Recover his secret or be encrypted."

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Game-of-Secrets/gameofsecrets.py https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Game-of-Secrets/output.txt

"HADIOR will hold the DOOR."

nc ctf.k3rn3l4rmy.com 2241

Note: The challenge might take up to a minute to connect.

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/HADIOR/hadior.py

"This time we have hidden the flag behind TOTAL CHAOS, so good luck trying to find your way through this one, ehehe~"

nc ctf.k3rn3l4rmy.com 2242

Note: This is not a paper crypto, relevant papers will only help understand the algorithm, but will not help solve the challenge.

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Mowhock/mowhock.py

"What can I say, I just like squares."

https://ctf.k3rn3l4rmy.com/kernelctf-distribution-challs/Non-Square-Freedom-1/nonsquarefreedom_easy.py

Please join our Discord Server for the flag: https://discord.com/invite/PXCePGVFHW

Thank you for playing!!

.