Challenges

Welcome to ImaginaryCTF 2023! The sanity check flag is ictf{welcome_to_imaginaryctf_2023!} All flags will follow the regex ictf{[^}]+}.

N/A

Join our Discord server at https://discord.gg/ctf/.

N/A

Thank you for playing ImaginaryCTF 2023! We hope you enjoyed. Please give us feedback so we can improve for next year!

https://forms.gle/8cjD59jMknsJPvx56

Tracking down pictures can be hard. Surely you can't find where this giant ballpark is...

Submit your flag as ictf{latitude,longitude}, with the coordinates of where the picture was taken rounded to three decimal places. Example: ictf{-42.443,101.333}

https://imaginaryctf.org/r/sZAdu#signpost.png

Never have I seen a pickle, worming its way out of a jail, whose exploitation did not rely upon the calling of some nefarious function. Thus, I hereby declare: there shall be no call heeded within this domain anymore. It is for I yearn the secure confinement of pickles; and shall not stand their escape.

https://imaginaryctf.org/r/DvMPf#server.py nc you-shall-not-call.chal.imaginaryctf.org 1337

Enter your payload:*** stack smashing detected ***: pyjail terminated Aborted (core dumped)

https://imaginaryctf.org/r/MsXr5#main.py nc deletion.chal.imaginaryctf.org 1337

Never have I seen a pickle, worming its way out of a jail, whose exploitation did not rely upon the calling of some nefarious function. Thus, I hereby declare: there shall be no call heeded within this domain anymore. It is for I yearn the secure confinement of pickles; and shall not stand their escape.

The server isn't changed, but you must get RCE to read flag this time.

https://imaginaryctf.org/r/DvMPf#server.py nc you-shall-not-call-revenge.chal.imaginaryctf.org 1337

People who consistently push me to read up on obscure quirks of Linux systems - you know who you are.

nc obscured.chal.imaginaryctf.org 42000

A Pyjail with direct code execution gives you too much freedom, so I made a Pyjail where you can only only get and set.

https://imaginaryctf.org/r/M8TZd#server.py nc get-and-set.chal.imaginaryctf.org 1337

Writing a terminal emulator is one of those things that's not-that-hard to get a proof of concept, but making a polished final product can be tricky. I know there's many a flaw in this one, but I tried to at least make it as pretty as possible

https://imaginaryctf.org/r/tf2yw#temu.py

socat FILE:`tty`,raw,echo=0 TCP:temu.chal.imaginaryctf.org:1337

Some idiot made this web site that you can log in to. The idiot even made it in php. I dunno.

http://idoriot.chal.imaginaryctf.org/

Here's a freebie: the flag is ictf.

N/A

My rock enthusiast friend made a website to show off some of his pictures. Could you do something with it?

https://imaginaryctf.org/r/0Sm4V#roks.zip http://roks.chal.imaginaryctf.org

Someone seems awful particular about where their pixels go...

https://imaginaryctf.org/r/Gdmod#perfect_picture.zip http://perfect-picture.chal.imaginaryctf.org

I asked ChatGPT to make me a website. It refused to make it vulnerable so I added a little something to make it interesting. I might have forgotten something though...

https://imaginaryctf.org/r/FVauo#blank_dist.zip http://blank.chal.imaginaryctf.org

The idiot who made it, made it so bad that the first version was super easy. It was changed to fix it.

http://idoriot-revenge.chal.imaginaryctf.org

A classic PHP login page, nothing special.

http://login.chal.imaginaryctf.org/

Sometimes the strongest among us are the ones who smile through silent pain, cry behind closed doors, and fight battles nobody knows about.

https://imaginaryctf.org/r/cXEZL http://amogus.chal.imaginaryctf.org/ nc amogus-admin-bot.chal.imaginaryctf.org 1337

You are not going to find a DOMPurify 0day right?

http://sanitized.chal.imaginaryctf.org/

You are not going to find a DOMPurify 0day right?

There is an unintended solution that made the previous one much easier than the intended solution. If you solved the previous one using the intended, this is a free flag for you.

http://sanitized-revenge.chal.imaginaryctf.org/

I think I did my RSA right...

https://imaginaryctf.org/r/Pg2iM#flag.enc https://imaginaryctf.org/r/fpPlb#public.pem https://imaginaryctf.org/r/uwcyX#private.pem

It seems that emoji "crypto" challenges are all the rage nowadays... Well, here's another one for you!

https://imaginaryctf.org/r/54Pne#out.txt https://imaginaryctf.org/r/3ZbKK#gen.py

My new secure signing service is up! It uses state-of-the-art cryptographically secure hashes and can sign anything! Except, of course, the password.

https://imaginaryctf.org/r/4cONq#main.py nc signer.chal.imaginaryctf.org 1337

tan(x) is a broken hash function in terms of collision resistance and second preimage resistance. But you surely can't find the preimage of tan(flag), right?

https://imaginaryctf.org/r/hIdWp#tan.sage

I am going to make RSA encryption more time-consuming for no reason 😛

https://imaginaryctf.org/r/vqMeh#chall.py https://imaginaryctf.org/r/qoehk#output.txt

So guessy... I sure hope there's no guess gods out there.

https://imaginaryctf.org/r/ulQgb nc blind-guess.chal.imaginaryctf.org 1337

I threw in a bit of source-given rev, because why not.

> I hate crypto and rev because both are math

Sorry to people who feel like this and even say so in the ictf discord 😉

• https://imaginaryctf.org/r/oIm0B#flagtor.factor
• https://imaginaryctf.org/r/yov25#out.txt

Show me that you are who you say you are, and maybe you will get a flag.

nc elliptic.chal.imaginaryctf.org 1337 https://imaginaryctf.org/r/bpDMm

Immerse yourself in the captivating simplicity of Imaginary Casino, where a single game of coin flip becomes a thrilling quantum experience. Powered by a quantum-secure random number generator, every flip is truly unpredictable, ensuring an unparalleled level of fairness and excitement.

https://imaginaryctf.org/r/142G2#server.py https://imaginaryctf.org/r/M7jOW#csidh-latest.tar.xz nc imaginary-casino.chal.imaginaryctf.org 1337

Apparently, there is something weird happening with the prime generation.

https://imaginaryctf.org/r/0Jm3W#challenge.py https://imaginaryctf.org/r/hgNST#output.txt

Can you overflow the buffer and get the flag? (Hint: if your exploit isn't working on the remote server, look into stack alignment)

https://imaginaryctf.org/r/BoCID#vuln https://imaginaryctf.org/r/73iLJ#vuln.c nc ret2win.chal.imaginaryctf.org 1337

You overflowed the buffer and got the flag... but can you get my other flag? (Remote and binary are the same as in the challenge ret2win, but you have to get a shell this time)

https://imaginaryctf.org/r/BoCID#vuln https://imaginaryctf.org/r/73iLJ#vuln.c nc ret2win.chal.imaginaryctf.org 1337

I'm sure that my post office is 100% secure! It uses some of the latest software, unlike some of the other post offices out there...

Flag is in ./flag.txt.

https://imaginaryctf.org/r/PIxtO#vuln https://imaginaryctf.org/r/c9Mk8#libc.so.6 nc mailman.chal.imaginaryctf.org 1337

The obligatory format string challenge comes back, but with a twist.

https://imaginaryctf.org/r/V35Q9#vuln nc form.chal.imaginaryctf.org 1337

Gone.

https://imaginaryctf.org/r/rYkqn#minimaler.zip nc minimaler.chal.imaginaryctf.org 42043

You don't know what you've got until it's gone.

https://imaginaryctf.org/r/OVfU5#minimal.zip nc minimal.chal.imaginaryctf.org 42042

It's just a buffer overflow, I'm telling you!

https://imaginaryctf.org/r/KSNQy#generic_rop_challenge_release.zip nc generic-rop-challenge.chal.imaginaryctf.org 42042

Sometimes, there is a glimmer of hope, a spark of inspiration, a window of opportunity.

https://imaginaryctf.org/r/izYM0#opportunity_dist.zip nc window-of-opportunity.chal.imaginaryctf.org 1337

I created a new password management system to store your secrets and passwords! The retrieval functions aren't built yet though...

https://imaginaryctf.org/f/h84VQ#vuln nc vault.chal.imaginaryctf.org 1337

Shellcode challenges take Ls tbh

The flag is in ./flag.txt.

https://imaginaryctf.org/r/tULyt#vuln nc lcode.chal.imaginaryctf.org 1337

Where is your key of promise? (Same binary as vmcastle)

https://imaginaryctf.org/r/Ryriu#vmdungeon.zip nc vmdungeon.chal.imaginaryctf.org 1337

We recovered this file from the disk of a potential threat actor. Can you find out what they were up to?

https://imaginaryctf.org/r/y1V79#web.zip

QR codes are error-correcting... whatever that means. How much error can it take though?

https://imaginaryctf.org/r/kaegq#chall.png

I guess reversing deserved a challenge after all.

https://imaginaryctf.org/r/LbqcK#rev.zip

Yes, my python program crashed. But I made sure to scrub all the sensitive details out of the coredump!

https://imaginaryctf.org/r/Bz79z#crypto.zip

Someone got into my server. But at least I had proper logging in place! Can you figure out how they got in?

https://imaginaryctf.org/r/MACbb#chall.pcap

Corruption, like a stealthy predator, preys upon the foundation of trust, leaving in its wake a trail of shattered ideals and compromised values.

https://imaginaryctf.org/r/fvRXC#forensics.zip

If I want to send a steganographic message over the internet, I should definitely make my own algorithm. So don't go and start plugging it into random steg tools until you find the flag. You won't.

Note: we may release a hint if this ends up to be too guessy.

https://imaginaryctf.org/r/DN4lD#chall.png

Windows users beware. (we haven't forgotten about you...)

• README: https://eth007.me/cypat/syshardening9
• Download link: https://drive.google.com/file/d/1gYM366G8HG_WSEGIR90widby_XoVkDxK/view
• Mirror: https://drive.google.com/file/d/15vsXYg87gWumi2p0-8SfOJsrVI5mnSIj/view

I am a servant of the Secret Fire, wielder of the flame of Anor. You cannot pass. The dark fire will not avail you, flame of Udûn. Go back to the Shadow! You cannot pass.

You may have to use 7-zip to unzip the file.

• README: https://eth007.me/cypat/syshardening8
• Main download link: https://drive.google.com/file/d/1N6fpGL-ZlT5C8nvf4Y68nSKz65CqyfBH/view
• Mirror: https://drive.google.com/file/d/1opnMXhiVHj2iqkb2yZPHNOUsSDp6eKyh/view?usp=drive_link
• Mirror: https://drive.google.com/file/d/1R4hvCRKuZx5dP5gGqOhgESAiJDx8wa5N/view?usp=sharing
• Mirror: https://drive.google.com/file/d/1LazX1oXzzqIGB9kqJARohkiXlSBm5QUM/view?usp=sharing

Can you find order in the midst of chaos?

https://imaginaryctf.org/f/orm4L#chall.py

Optimize me, if you dare. Or not. It might run if you try hard enough.

https://imaginaryctf.org/r/Q2CAo#check.py

The flag is all jumbled up... or is it?

https://imaginaryctf.org/f/I3fmS#main

Mary had a flagchecker, its fleece was white as snow.

https://imaginaryctf.org/r/T2QpC#sheepish.py

There are no rules of architecture for a castle in the clouds.

https://imaginaryctf.org/r/oPLIM#vm https://imaginaryctf.org/r/UVfdl#program

All you need is to make it compile without error!

https://imaginaryctf.org/r/l4HCZ#ts.ts

And everywhere that Mary went, The flag was sure to go.

Note: The flag is not in ictf{} format - please add ictf{} around the correct input to the program.

https://imaginaryctf.org/r/KBfxv#goated.py

Something in the challenge is unfactored for sure, but does it really matter if everything else is factor? Usage: ./ictf.unfactored <flag>

https://imaginaryctf.org/r/afRbW#ictf.unfactored