2021.06.04Blog on CTFs

Challenge archive: zh3r0 CTF V2 2021 - b00tleg

zh3r0 CTF 2021 - Cryptography.

Section
Blog on CTFs
Event began

By deuterium.

Original description

Source? Gotta comply to Indian CTFs’ crypto standards

Read this challenge as plain text or JSON.

Browser practice

b00tleg terminal

Practice only. Rewards are public dummy values, not event flags. Completion is saved separately on this device when storage is available. Nothing runs until you choose Start.

Browser practice needs JavaScript and module Worker support.

Enter sends; Shift+Enter adds a line. Input is not echoed in program output. Stop interrupts computation; Reset clears the session without starting another.

Browser limits and console API

Limits use UTF-8 bytes: 2 MiB per input line, 4 MiB and 4096 lines per batch (including separators), 8 MiB output per operation, and a 1 MiB visible transcript. Earlier output is replaced with a truncation notice. Setup progress is separate, capped at 1024 characters and four updates per second. Original challenge deadlines still apply after setup; there is no extra setup deadline.

The console API is window.challengePractice: start(), send(stringOrLines), stop(), and reset(). Select the version above before starting. Start and Send resolve at the next input prompt or program exit with {output, state, solved}; output contains only that operation's program text. Concurrent operations are rejected. Stop, Reset, deadlines and Worker failures reject in-flight operations; terminal errors carry partial output in error.result.

Strings accept LF or CRLF; a final newline ends the last line without adding another blank line. An empty string sends one blank line. Arrays contain literal lines without LF. Unused lines are discarded if the program exits. Reset keeps saved completion. Public dummy rewards do not unlock the original answer checker.

Files

This was a black-box challenge: players did not receive the source. The organizer code contains the level answers, so its download is kept with the spoilers below. This local practice copy replaces only the final reward with a dummy flag; it is not the original player handout.

Sources and solutions (spoilers)

The download contains the answers. Use it to study the implementation or run your own copy, not as a spoiler-free handout.

Sh
mkdir -p zh3r0-2021-b00tleg
cd zh3r0-2021-b00tleg
curl --fail --location --output challenge.txt \
  "https://deut-erium.github.io/challenges/zh3r0-2021/b00tleg/challenge.txt"
curl --fail --location --output challenge.json \
  "https://deut-erium.github.io/challenges/zh3r0-2021/b00tleg/challenge.json"
curl --fail --location --output organizer-practice.py \
  "https://deut-erium.github.io/assets/challenges/zh3r0-2021-b00tleg/organizer-practice.py"

All challenges · CTF tutorials