base64÷4:
1. Download the attachment, which is a .txt file. Open it to find a string of characters:
666C61677B45333342374644384133423834314341393639394544444241323442363041417D
2. Upon observation, the string consists of only numbers and uppercase letters. Considering the challenge name, it's likely base16 (hexadecimal) encoded. Decoding it yields the flag:
flag{E33B7FD8A3B841CA9699EDDBA24B60AA}
embarrass:
1. Download and open the attachment. It's a packet capture file. Open it with Wireshark.
2. Search for the flag within the captured packets.
Flag:
flag{Good_b0y_W3ll_Done}
Modbus Mystery:
1. Download and open the attachment. It's a packet capture file. Open it with Wireshark.
2. Search for the flag as indicated by the challenge name.
Flag:
sctf{Easy_Modbus}
wireshark-1:
1. Download and open the attachment. It's a packet capture file. Open it with Wireshark.
2. Based on the hint mentioning an administrator, search for common credential-related strings like "admin", "password", and "passwd". Found a clue under "password".
3. Obtain the flag.
Flag:
flag{ffb7567a1d4f4abdffdb54e022f8facd}
pure_color:
Download the attachment and open the image with Stegsolve. The image appears blank. Click the arrow buttons below to cycle through color channels, revealing the flag.
Flag:
flag{true_steganographers_doesnt_need_any_tools}
Aesop_secret:
1. Download and extract the attachment. It's a GIF image. Use Photoshop or an online GIF分解 tool to extract the individual frames.
2. The extracted frames show "ISCC" text. Open the original file with WinHex and discover a string of code. The title hints at AES encryption, and "ISCC" is the key. Use an online AES decryption tool to decode twice.
Flag:
flag{DugUpADiamondADeepDarkMine}
a_good_idea:
1. Download and extract the attachment to get an image file.
2. Open the image with WinHex and discover hidden data. According to solution guides, change the file extension to .zip and extract again. This reveals two additional images and a text file.
3. Open the text file which contains:
try to find the secret of pixels
<p>4. Use Stegsolve to combine the two images. Open the "to_do" image first, then combine to get a pixel-subtracted image.</p>
<p>5. Use Stegsolve to change color channels and reveal a QR code. Scan it to obtain the flag.</p>
<p>Flag:</p>
<code>NCTF{m1sc_1s_very_funny!!!}</code>
<h1>Training-Stegano-1:</h1>
<p>1. Download the attachment, which is a BMP file. Open it with WinHex.</p>
<code>Look what the hex-edit revealed: passwd:steganoI</code>
<p>2. Try submitting "steganoI" as the flag - it works!</p>
<p>Flag:</p>
<code>steganoI</code>
<h1>can_has_stdio?:</h1>
<p>1. Download the attachment and open it with a text editor. It displays a pattern made of characters.</p>
<p>2. This is an obscure language - Brainfuck. Use an online Brainfuck decoder.</p>
<p>3. Obtain the flag.</p>
<p>Flag:</p>
<code>flag{esolangs_for_fun_and_profit}</code>
<p>Brainfuck Reference:</p>
<code>Character Function
> Increment pointer
< Decrement pointer
+ Increment byte at pointer
- Decrement byte at pointer
. Output byte at pointer as ASCII
, Input byte to pointer
[ Jump forward if byte is zero
] Jump back if byte is non-zero</code>
<h1>János-the-Ripper:</h1>
<p>1. Download the attachment and open it with WinHex. Discover flag.txt inside.</p>
<p>2. Suspect nested archives. Change the extension to .zip and extract. It's password-protected. Use a password cracker on the archive. The password is: "fish"</p>
<p>3. Enter the password, extract, and open flag.txt to get:</p>
<p>Flag:</p>
<code>flag{ev3n::y0u::bru7us?!}</code>
<h1>Test-flag-please-ignore:</h1>
<p>1. Download the attachment and open with a text editor.</p>
<code>666c61677b68656c6c6f5f776f726c647d</code>
<p>2. Analyze the character set - only 0-f characters present. This indicates hexadecimal encoding.</p>
<p>3. Decode from hex to get the flag.</p>
<p>Flag:</p>
<code>flag{hello_world}</code>
<h1>Happy Game:</h1>
<p>1. Download the attachment. Extract to find an executable game file.</p>
<p>2. Simply play through the game to complete it and obtain the flag.</p>
<p>Flag:</p>
<code>UNCTF{c783910550de39816d1de0f103b0ae32}</code>
<h1>Banmabanma:</h1>
<p>1. Download the attachment. It's an image of a "zebra" pattern. Try Stegsolve and WinHex without success. Search for soltuions - the zebra body contains a barcode. Use an online barcode reader to decode it.</p>
<p>2. The result reveals a message:</p>
<code>FLAG IS TENSHINE</code>
<p>Flag:</p>
<code>flag{TENSHINE}</code>
<h1>reverseMe:</h1>
<p>1. Download the attachment. It's an image with flag text written on it.</p>
<p>2. Open with Paint and horizontally flip the image to reveal the flag.</p>
<p>Flag:</p>
<code>flag{4f7548f93c7bef1dc6a0542cf04e796e}</code>
<h1>stage1:</h1>
<p>1. Download the attachment. It's an image. Open with Stegsolve and cycle through color channels.</p>
<p>2. A QR code appears. Scan it to get a long string. Open WinHex and create a new file with this hex data:</p>
<code>03F30D0AB6266A576300000000000000000100000040000000730D0000006400008400005A00006401005328020000006300000000030000000800000043000000734E0000006401006402006403006404006405006406006405006407006708007D00006408007D0100781E007C0000445D16007D02007C01007400007C0200830100377D0100712B00577C010047486400005328090000004E6941000000696C000000697000000069680000006961000000694C0000006962000000740000000028010000007403000000636872280300000074030000007374727404000000666C6167740100000069280000000028000000007307000000746573742E7079520300000001000000730A00000000011E0106010D0114014E280100000052030000002800000000280000000028000000007307000000746573742E707974080000003C6D6F64756C653E010000007300000000</code>
<p>3. Recognize this as compiled Python code. Save as .pyc file and decompile it.</p>
<p>4. After decompilation, run the source code:</p>
<code>def retrieve_flag():
data = [65,108,112,104,97,76,97,98]
result = ''
for item in data:
result += chr(item)
print(result)
retrieve_flag()</code>
<p>Flag:</p>
<code>AlphaLab</code>
<h1>Hear-with-your-Eyes:</h1>
<p>1. Download and extract the attachment. Change the extension to .zip and extract again (WinHex reveals it's a WAV file). Repeat until the audio file is extracted.</p>
<p>2. Open with Audacity. Select the sound option from the top-left menu and view the spectrogram to reveal the flag.</p>
<p>Flag:</p>
<code>e5353bb7b57578bd4da1c898a8e2d767</code>
<h1>What-is-this:</h1>
<p>1. Download the attachment. Change extension to .zip and extract twice to get two images.</p>
<p>2. Use Stegsolve's Image Combiner feature to compare both images and reveal the flag.</p>
<p>Flag:</p>
<code>AZADI TOWER</code>
<h1>Farewell Li Hua:</h1>
<p>1. Download and extract the attachment to find an image.</p>
<p>2. Open the image with WinHex and discover key.txt embedded within.</p>
<p>3. Change the image extension to .zip.</p>
<p>4. The description mentions no special characters and "not less than 1000 characters". The number 1000 in binary is 8 bits, meaning the password is 9 or more characters. The signature indicates the last 5 characters are "Lihua". Use Advanced ZIP Password Recovery to crack it.</p>
<p>5. The password is "15CCLiHua". Extract and obtain the flag.</p>
<p>Flag:</p>
<code>Stay hungry, Stay foolish.</code>
<h1>MISCall:</h1>
<p>1. Download the attachment. Change extension to .zip and extract to get the ctf directory.</p>
<p>2. flag.txt in the directory is empty.</p>
<p>3. Drag the folder in to Kali Linux. Since it's a git repository, use git log to view commit history.</p>
<p>4. Use git stash list to see modifications.</p>
<p>5. Use git stash show to check stored files.</p>
<p>6. Use git stash apply to restore stored changes (first delete flag.txt to avoid overwrite conflicts).</p>
<p>7. Run s.py to obtain the flag:</p>
<p>Flag:</p>
<code>NCN4dd992213ae6b76f27d7340f0dde1222888df4d3</code>