New Year CTF 2025(Write-up)

I wrote a write-up for the CTF I recently participated in.

Since I’ve been juggling a lot of things lately, I could only focus on solving problems that could be completed within an hour.

It’s a simple write-up so I don’t think there’s much to see.

For the ones I couldn’t solve, I’ll try to post their write-ups later.

site : http://ctf-spcs.mf.grsu.by/

welcome

This is a welcome problem, and the contents are as follows.

This CTF uses Telegram as its main community and Discord as its second community.

Etc.. and flag were listed, so I entered the flag.

crashme

This problem is a simple overflow problem, and the source code is as follows.

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

int main(int argc, char *argv[]){
    char buffer[32];
    printf("Give me some data: \n");
    fflush(stdout);
    fgets(buffer, 64, stdin);
    printf("You entered %s\n", buffer);
    fflush(stdout);
    return 0;
}

If you look, the current buffer itself has a size of 32, but since it receives input as 64, you can see that overflow is occurring.

At this time, I was wondering where to get the flag, but looking at the problem comment, I thought I could just cause a break, so I proceeded as is.

Bel_money(part_1)

If you download this question, you can see that it is in pdf format.

So, at first I tried extracting with binwalk, but nothing really happened. lol

Since it was a Beginner problem, I thought it would be simpler, so I looked into it further.

In this way, I was able to see the highlighting on the picture.

The picture below was also the same.

Just combine the two parts and you’re done!

part1: grodno{More_details_at:_https://www.monetnik.ru/ob part2: uchenie/bonistika/banknoty-belorussii-1992-2000/}

grodno{More_details_at:_https://www.monetnik.ru/obuchenie/bonistika/banknoty-belorussii-1992-2000/}

City sculpture

This city sculpture is installed on one of Grodno’s main tourist streets called Eliza Ozheshko.

Installation date: January 1, 2009 Sculptor: Vladimir Panteleev Material: Bronze Pedestal: Granite Weight: 40kg The names of the statues are given in Latin format, available at maps.google.com.

Answer format:

grodno{name-of-sculpture}

It’s a simple matter of finding the statue on Google Maps and finding its name.

So if you look for it

This friend is the answer.

grodno{Lyagushka-Puteshestvennitsa}

Symbol

haedang sajin-eul bomyeon symbol of the sun-eulo nawaissda

geulaeseo jeongdab-eun sun-ida. If you look at the photo, it appears as a symbol of the sun.

So the correct answer is sun.

Broken QR

file is

This picture is given, and if you create the corresponding QR and take a picture, a flag will appear.

So, if you create the same QR code in the link below and take a picture of it with a camera, a flag will be printed.

Address of the tool I used : https://merri.cx/qrazybox/

grodno{It’s_h4rd_t0_l1ve_without_R33d-S0l0m0n_c0d3s!}

From 8 to 16

If you look at the downloaded file in the problem as hxd, you can get the bytes. It is a simple problem that can be solved by making the inverse function of the function shown in the source code for the bytes.

def rev001(flag):
    return ''.join([chr((ord(flag[i]) << 8) + ord(flag[i + 1])) for i in range(0, len(flag), 2)])

Whose IP?

The highlighted part is the flag.

Beer&Books

The content is roughly a matter of entering the coordinates of the location where the photo was taken.

Since this was a restaurant, the address was converted into coordinates and verified.

(plac Konstytucji 1, 00-647 Warszawa, Poland)

The Beginning of Cyberwars

This is a problem that simply connects to nc and enters the answers in order.

The hacker sent

If the letters look strange and you see the first one as you, just change the same letters.

So I changed it

It became grodno{you_go_on_for_a_way_at_crypto}.

I guess it’s wrong, I tried but got hit…

Bel_money(part_2)

It seemed similar to problem number 1 I solved earlier, but it felt like a lot of photos had been added, so I tried deleting the photos.

Found flag.

ramsom

Likewise, it is a method of solving problems by connecting.

Virus.BY

Actually, the problem itself is simple.

However, it was a very frustrating problem.

Number 9 was so poor that it felt like brute force.

Ha… I found the correct answer by going to the link on Wikipedia and entering my last name.

APT

This is the same type of problem!

I was a bit stuck on the Lazarus group’s 2014 attack problem… but somehow I solved it.

Church

I thought this question was a bit difficult, but it seemed to be easy.

When I search endlessly, two poet names come up like that, and when I put the poet’s name in front of them, it gets verified and I solve them all.

Like this, Osint solves everything