Roman Hergenreder

1. Set the breakpoint right on the __vbaVarTstEq call
2. Run the debugger
3. Enter the following string: HV19{AAAAAAAAAAAAAAAAAAAAAAAAAAA}, as we know the first 5 and the last char, the remaining 33 - 6 chars are chosen.
4. Step through the instructions, until we see both strings in memory (given and encrypted).

Flag: HV19{0ldsch00l_Revers1ng_Sess10n}

Python script

• A := input, E := encrypted string in memory, K := key used for XOR, F := flag, S := first string found for XOR
• F = S ⨁ K = S ⨁ (A ⨁ E)
• F = 6klzic<=bPBtdvff'y\x7fFI~on//N ⨁ (AAAAAAAAAAAAAAAAAAAAAAAAAAA ⨁ GFIHKJMLONQPSRUTWVYX[Z]\_^a)
• F = 0ldsch00l_Revers1ng_Sess10n

Flag: HV19{0ldsch00l_Revers1ng_Sess10n}

Python script

private PatriciaTrie<Integer> trie = init();
private static final long serialVersionUID = 1L;
private static final String securitytoken = "auth_token_4835989";

// (...)

private static PatriciaTrie<Integer> init() {
  PatriciaTrie<Integer> trie = new PatriciaTrie<Integer>();
  trie.put(securitytoken,0);
  return trie;
}

private static boolean isAdmin(PatriciaTrie<Integer> trie) {
  return !trie.containsKey(securitytoken);
}

Flag: HV19{get_th3_chocolateZ}

Python script

This challenge was hilarious, like last year's flappy bird, we've got an obfuscated perl game. This year's topic: Curve Fever! Similar to snake, we have to collect bounties, which are parts of our flag. But in contrast to snake, our curve leaves a constant line, which we may not touch. I tried to play the game without modifying or cheating in any way, it's possible for the first 6-7 parts, but the flag doesn't seem to have a common scheme... Thus, we have to modify the given code. Using perltidy, we can beautify our code a bit.

createText(
  $PMMtQJOcHm8eFQfdsdNAS20->() % 600 + 20,
  $PMMtQJOcHm8eFQfdsdNAS20->() % 440 + 20,    #Perl!!
  "-text" => $d28Vt03MEbdY0->(),
  "-$y"   => $z
);

var mqtt;
var reconnectTimeout = 100;
var host = 'localhost';
var port = 9001;
var useTLS = false;
var username = 'workshop';
var password = '2fXc7AWINBXyruvKLiX';
var clientid = localStorage.getItem("clientid");
if (clientid == null) {
  clientid = ('' + (Math.round(Math.random() * 1000000000000000))).padStart(16, '0');
  localStorage.setItem("clientid", clientid);
}
var topic = 'HV19/gifts/'+clientid;
// var topic = 'HV19/gifts/'+clientid+'/flag-tbd';
var cleansession = true;

Flag: HV19{N0_1nput_v4l1d4t10n_3qu4ls_d1s4st3r}

Python script

function registerUser($conn, $username, $password) {
  $usr = $conn->real_escape_string($username);
  $pwd = password_hash($password, PASSWORD_DEFAULT);
  $conn->query("INSERT INTO users (username, password) VALUES (UPPER('".$usr."'),'".$pwd."') ON DUPLICATE KEY UPDATE password='".$pwd."'");
}

function isUsernameAvailable($conn, $username) {
  $usr = $conn->real_escape_string($username);
  $res = $conn->query("SELECT COUNT(*) AS cnt FROM users WHERE LOWER(username) = BINARY LOWER('".$usr."')");
  $row = $res->fetch_assoc();
  return (int)$row['cnt'] === 0;
}

Flag: HV19{h4v1ng_fun_w1th_un1c0d3}

Python script

X: 0xc58966d17da18c7f019c881e187c608fcb5010ef36fba4a199e7b382a088072f
Y: 0xd91b949eaf992c464d3e0d09c45b173b121d53097a9d47c25220c0b4beb943c

"Hy97Xwv97vpwGn21finVvZj5pK/BvBjscf6vffm1po0="

1. Password generation/cracking
2. String encryption/decryption

1. Read a list of common passwords and filter them to get only passwords of length 16
2. For every password: Generate a sha256 hash
3. Use the hash as private key and generate public key using P256 curve
4. Compare the public key with the given public key (x, y)
5. If they are equal, we are probably done

1. Generate the pbkdf2_hmac using password, salt and sha256 with 256*256*256 iterations
2. Base64 decode the given string
3. AES-decrypt the resulting buffer using the generated AES key in ECB mode
4. The flag should now be readable

Flag: HV19{sry_n0_crypt0mat_th1s_year}

Python script

undefined4 FUN_00058dd8(undefined4 param_1,int param_2,undefined4 param_3,undefined4 param_4,undefined4 param_5) {
  FUN_00058d9c(param_3,param_4);
  uStack56 = *(undefined4 *)PTR_DAT_00058e84;
  uStack52 = *(undefined4 *)(PTR_DAT_00058e84 + 4);
  uStack48 = *(undefined4 *)(PTR_DAT_00058e84 + 8);
  uStack44 = *(undefined4 *)(PTR_DAT_00058e84 + 0xc);
  uStack40 = *(undefined4 *)(PTR_DAT_00058e84 + 0x10);
  auStack36[0] = *(undefined4 *)(PTR_DAT_00058e84 + 0x14);
  if (param_2 == 0xcafe) {
    func_0x00803cd4(param_3,PTR_s_Um9zZXMgYXJlIHJlZCwgVmlvbGV0cyBh_00058e90,param_4);
    return 0;
  }
  if (param_2 != 0xd00d) {
    if (param_2 != 0x1337) {
      uVar1 = func_0x0081a2d4(param_1,param_2,param_3,param_4,param_5);
      return uVar1;
    }
    pbVar3 = &bStack57;
    pbVar2 = DAT_00058e88;
    do {
      pbVar3 = pbVar3 + 1;
      pbVar2 = pbVar2 + 1;
      *pbVar3 = *pbVar2 ^ *pbVar3;
    } while (pbVar3 != (byte *)((int)auStack36 + 2));
    func_0x00803cd4(param_3,&uStack56,param_4);
    return 0;
  }
  FUN_00002390(PTR_DAT_00058e8c,0x800000,0x17);
  return 0;
}

Flag: HV19{Y0uw3n7FullM4Cm4n}

Python script