The 2021 Gryphon CTF, had over 45 challenges split into the categories of Web, Crypto, Forensics, Reverse, Pwn, and Misc! The challenge was held over the course of 48 hours, where many teams competed. My team managed to get 9th place. Credits to my teammates who solved some mind bending challenges.

The CTF website looks damn good, the challenges wasn’t really very technical, regardless, it was very fun. It is also the 

, a collaborative tool aiming to help CTF teams to organise their work. If you want to setup, you can follow my 

. I didn’t really test out my guide so it might not work lol.

Anyway, enough introduction, let’s get into the challenges. I was lazy to write some part, so bear with me lol, I will rewrite them next time.

Description: I found a computer with a running program and a slip of paper next to it which reads: 65-90 [‘7’, ‘S’, ‘3’, ‘Z’, ‘Q’, ‘8’, ‘Z’, ‘S’, ‘8’, ‘Z’, ‘F’, ‘6’, ‘Z’, ‘S’, ‘6’, ‘Z’, ‘F’, ‘9’, ‘Z’, ‘Q’, ‘7’, ‘Z’, ‘T’, ‘8’, ‘Z’, ‘S’] The paper states that the answer is in capital letters. Maybe you know how to decipher it?

The program works by using converting plaintext into ascii before using mod. We know that the program only has “Upper” case letters. We also know that the only place a Number can occur is when a new letter is used due to line ltr.append(str(each)[-1]) that were used to get the last number of the ASCII. After a number it appends letters based on the mods if else conditions. Hence, we split the answer based on the information above. Utilize python to test possible options and output answer. Below is the code utilized.

Description: We recently launched a new marketplace. Can you obtain the key? 

. You are able to leak out the flag in the stack by sending format string parameter like %x, %p. I forgot endianness exists, hence did not solve the challenge lol.

Apparently, in data networking, network protocols like TCP, UPD, IPv4 and IPv6 are using Big endian order to transmit data. Since a computer usually store data in little endian format, you will need to convert values from big endian to little endian. You can use CyberChef swap endianess recipe, or use this website: 

Big Endian: 0x7230667b46544347 0x5f366e693774346d 0x7230706d695f3569 0x3930335f376e3437 0x7d3637353434

Little Endian: 0x474354467b663072 0x6d347437696e365f 0x69355f696d703072 0x37346e375f333039 0x34343537367d

After obtaining the hexadecimal digits in little endian, convert hex to ASCII and you will obtain the flag.

Description: This is a completely normal white horse

We are provided with a image of a white horse, use 

, a web-based set of tools for digital image forensics. By changing the contrast of certain brightness levels of the image provided, we can see some characters on the horse body.

The flag is encoded with Base64, use the 

After decoding the message, we obtain the follow message below.

By selecting position of letters of each word base on the numbers, we are able to group out the flag.

Description: What do these numbers mean? 01000111 01000011 01010100 01000110 01111011 00110001 01110011 01000001 

The description provided what seems to be some binary digits, use a 

 to decode the message. We obtain the first part of the flag.

The next part of the flag was difficult, but with the help of the hint, the combination for the website was the most significant bit and least significant bit of each group binary digits.

Description: What do pigs and ink have in common? The answer is in the picture.

We were provided a image made up of strange symbols, use 

 and discovered the encoded message is PigPen cipher.

Description: Amongst the flooded page, all will be revealed when you find it inside. 

The website provided had a lot of junk text, by examining the text carefully, you will be able to find a bit.ly link. You can also use 

The link directed us to a google drive image file. Downloading the file and running the file command reveal that the file was a JPEG image. The image seems to be corrupted even after changing the extension.

Next, view the strings of the image file, and found some interesting text that seem to be encoded in Base64. Decoding the message shows a long piece of text as seen in the figure below.

Description: Why does the word “repeAting” keep repeatiNg??

We were given a text file as seen in the textbox below.

We can then take the capitalized letter in each row to obtain this: IR TI NE I REP GI IR AE IP IN GA IN GA GI IR TA PP IN REA

Converting those letters into numbers representing their position within their respective ‘repeating’ words, we get this: 71 67 84 70 123 97 71 52 73 78 95 78 95 97 71 65 33 78 125

We can then convert those numbers into ASCII characters to obtain the flag:

Description: Are you a script kiddie or a math god? nc c1.2021.gryphonctf.com 9007

We were given a netcat command to connect to the server at port 9007. By connecting to it, the textbox below shows the data received back.

This is clearly a scripting challenge as there is a time limit to solve some mathematics questions within 5 seconds. We will use Python with PwnTools to achieve this task.

Description: You seem to know your way around scripts! Let’s try something different! 

Gryphons CTF (GCTF) Capture-The-Flag. The CTF was held over the course of 48 hours, and had over 45 challenges split into the categories of Web, Crypto, Forensics, Reverse, Pwn, and Misc.

GCTF2021 CTF Writeup