2021weight 24.34the cr0wn

Union CTF 2021

14 challenges with 25 published community solutions between them. Solution links go to CTFtime’s task page, which aggregates every writeup for a challenge - individual blog posts rot, the aggregator does not.

Full task list on CTFtime

Misc6

Everything that fits no other box: esolangs, puzzles, scripting exercises, and the jail escapes that have not yet earned their own category.

Solve it with:Brainfuck and esolang decoder Cipher identifier and automatic decoder Regex tester with match offsets and capture groups Learn: Recognising encodings

bashlex
100 pts3 writeups
- bash
- jail
Same technique in picoCTF: Specialer, Special, useless
HumanServer
100 pts3 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
committee
304 pts1 writeup
- misc
- git
Same technique in picoCTF: Blame Game, Collaborative Development, Commitment Issues
seeing through walls
964 pts1 writeup
- signal
- phreaking
Same technique in picoCTF: Permissions, Specialer, Codebook
Sensitive Material
995 pts1 writeup
- misc
- image
Same technique in picoCTF: Permissions, Specialer, Codebook
Where in the World? (2)
1 pts1 writeup
Same technique in picoCTF: Permissions, Specialer, Codebook

Reverse engineering3

Work out what a compiled program does without its source, then work backwards from the check to the input that passes it.

Solve it with:Strings extractor for binaries and blobs WebAssembly disassembler Java .class disassembler Python .pyc bytecode disassembler Learn: Binary exploitation

unionware
949 pts2 writeups
- re
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300
antistatic
100 pts1 writeup
- rev
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300
epitaph
908 pts1 writeup
- rev
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300

Web2

Reach data or functionality the application meant to keep from you - through its inputs, its tokens, or its trust in the client.

Solve it with:JWT decoder and signature verifier JWT alg=none bypass generator Web attack payload catalog JWT secret brute force Learn: Web attacks and session tokens

Cr0wnAir
100 pts4 writeups
- web
- crypto
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3
Meet the Union Committee
100 pts2 writeups
- sqli
- web
Same technique in picoCTF: Irish-Name-Repo 3, More SQLi, Secret Box

Binary exploitation2

Turn a memory-safety bug in a native binary into control of execution. Usually a stack overflow, a format string, or a heap primitive.

Solve it with:ROP gadget finder Shellcode assembler and library Cyclic pattern generator and offset finder Format string exploit builder Learn: Binary exploitation

babyrarf
100 pts2 writeups
- pwn
- leak
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Notepad
884 pts1 writeup
- pwn
- c++
- uaf
Same technique in picoCTF: tea-cash, sice_cream, zero_to_hero

Cryptography1

Recover a plaintext or a key from something that was supposed to protect it. In practice: identify the scheme, find the parameter the author got wrong, exploit it.

Solve it with:Cipher identifier and automatic decoder Vigenere cipher solver with automatic key recovery RSA decryption and attack runner Wiener’s attack on small RSA private exponents In-browser hash cracker with rule transforms Learn: Classical ciphers and frequency analysis Learn: RSA and the parameters that break it

why is a raven..
826 pts2 writeups
- crypto
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC

Misc6

bashlex

HumanServer

committee

seeing through walls

Sensitive Material

Where in the World? (2)

Reverse engineering3

unionware

antistatic

epitaph

Web2

Cr0wnAir

Meet the Union Committee

Binary exploitation2

babyrarf

Notepad

Cryptography1

why is a raven..

Other 2021 events