Challenges

rooReaper wasn't lying when he said that he would be back. Seems that he's infiltrated the roos' new workstation! Can you investigate and secure the system?

The challenge is best played using VMware workstation player. However, you may be able to get it to work with other software. You will receive the flag when you reach 100 points.

It appears that the scoring binary depended on a specific CPU extension. If the engine does not score, and you are getting a Illegal instruction when you run /opt/engine/engine, run this command on the VM: sudo curl "https://s1.fdow.nl/HgtoW-engine" -o "/opt/engine/engine" and reboot.

https://drive.google.com/file/d/1gyshPKjhQ2o907LQpwB_gq3BeqwmN2ko/view?usp=sharing https://drive.google.com/file/d/1xSwlRWTa2BYhjzUMA_7BKeqrCx3-prGJ/view?usp=sharing (alternate download link)

Thanks to https://ctftime.org/task/16811 for inspiration, but you'll have to do more than just import code to read the flag here...

The flag is in flag in the current directory.

https://imaginaryctf.org/r/Py9sq#main.py nc pycrib.chal.imaginaryctf.org 1337

You were caught hacking and were sent to a pycorrectionalcenter.

https://imaginaryctf.org/r/Q8Ch7 nc pycorrectionalcenter.chal.imaginaryctf.org 1337

Pyjails are getting so much attention, can you find the glitch in my video game instead?

https://imaginaryctf.org/r/TPP26#jail.rb nc pokemon-emerald.chal.imaginaryctf.org 1337

I stored my flag in my SQL server, but since I followed best practices, there's no way that you can get it!

ssh ethan@chal.imaginaryctf.org -p 42022 with password p4ssw0rd10

I just learned how to make a cool new Discord bot! I'm storing my secrets on it- I challenge you to try to get the flag! (To access this challenge you must join our discord server at https://discord.gg/ctf)

The only two commands are- ^help and ^flag.

Bot Discord tag: Flagbot#1412

Can you beat my game?

nc neoannophobia.chal.imaginaryctf.org 1337

What's a CTF without a good, old-fashioned pyjail?

https://imaginaryctf.org/r/SgKGj#main.py nc pyprison.chal.imaginaryctf.org 1337

The ImaginaryCTF team would like to thank DigitalOcean, Google Cloud, and Trail of Bits for sponsoring this CTF!

Learn more about our sponsors at the links below:

• Trail of Bits: https://www.trailofbits.com/
• DigitalOcean: https://youtu.be/xw5UBDZMOIA
• Google Cloud: https://cloud.google.com/

One of them might contain a flag... 👀

None

Join our Discord community for updates and support! If you would like to do some more CTF after this competition, we do host daily CTF challenges on our Discord server as well. Join at https://discord.gg/ctf . You can find the flag for this challenge in the #imaginaryctf-2022 channel .

None

Welcome to ImaginaryCTF 2022! All flags are written in flag format ictf{s0m3_1337_f1ag} unless otherwise stated. Have fun and enjoy the challenges!

ictf{w3lc0m3_t0_1m@g1nary_c7f_2022!}

We found this video on social media, and suspect that it is being used to transmit some information. Can you figure out what the message is?

https://imaginaryctf.org/r/oFD5G#wired.mp4 https://imaginaryctf.org/r/dDKeM#program.hex

My friend played GoogleCTF. Afterwards they sent me this AST of their solution to one of the challenges.

Apparently it also checks for a flag? Please help me find their hidden flag!

Also it looks like you need python 3.9 or later!

https://imaginaryctf.org/r/8D7X7#boxast.txt https://imaginaryctf.org/f/YdYRV#diff.txt

They say that the house always wins - come find out if that's actually true.

https://imaginaryctf.org/r/isBEb#casino nc the-house-always-wins.chal.imaginaryctf.org 1337

It's said that the great serpent Jormungandr encircles the world, devouring his own tail. When he ceases, he will devour the world itself, leaving nothing behind.

https://imaginaryctf.org/r/PYFn9#jormungandr

The last time that I made a python one-liner challenge, I recieved two pieces of feedback. First, it's not a meaningful one-line challenge if the player can just ... add new lines. Second, "walrus operators are cringe". I've taken both of these criticisms to heart. Have fun!

https://imaginaryctf.org/r/oFgsU#revenge.py

Name says it all. Don't crash!

https://imaginaryctf.org/r/IUpif#polymorphic

How well did I hide my code?

https://imaginaryctf.org/r/7nW2Q#hidden

?galf eht teg uoy naC

https://imaginaryctf.org/r/0m7ei#desrever.py

When Kubernetes allocates 5x more pods than the other challenges, something's gone terribly wrong.

https://imaginaryctf.org/r/FzSLf#fmt_foolery.zip nc fmt-foolery.chal.imaginaryctf.org 1337

Blocks, chunks, same thing.

https://imaginaryctf.org/r/dLi6c#minecraft_release.zip nc minecraft.chal.imaginaryctf.org 1337

Out of the eater, something to eat; out of the strong, something sweet.

The flag is in ./flag.txt

https://imaginaryctf.org/r/Hlv37#zookeeper_release.zip nc zookeeper.chal.imaginaryctf.org 1337

Where heapnote meets pyjail, meet pywrite, the most unrealistic, convoluted challenge ever. Challenge is running on latest Ubuntu 20.04 docker.

https://imaginaryctf.org/r/ULajH#pywrite.zip nc pywrite.chal.imaginaryctf.org 1337

Stop doing jumpropes.

https://imaginaryctf.org/r/Kurks#rope_release.zip nc rope.chal.imaginaryctf.org 1337

One format string to rule them all, one format string to find them. One format string to bring them all, and in the darkness bind them.

https://imaginaryctf.org/r/63Qnd#fmt_fun https://imaginaryctf.org/r/tytjZ#libc.so.6 nc fmt-fun.chal.imaginaryctf.org 1337

Some challenges provide source code to make life easier for beginners. Others provide it because reversing the program would be too time consuming for the CTF. Still others, like this one, do it just for the memes.

https://imaginaryctf.org/r/ieMCH https://imaginaryctf.org/r/WsLWX nc golf.chal.imaginaryctf.org 1337

Do you like Taco Bell?

https://imaginaryctf.org/r/kJ0Sk#bellcode nc bellcode.chal.imaginaryctf.org 1337

Can you bof me?

https://imaginaryctf.org/r/naCsv#bof https://imaginaryctf.org/r/7ngbn#bof.c nc bof.chal.imaginaryctf.org 1337

Jumping around in memory is hard. I'll give you some help so that you can pwn this!

https://imaginaryctf.org/r/W94dw#vuln https://imaginaryctf.org/r/IDlsV#vuln.c nc ret2win.chal.imaginaryctf.org 1337

I've been working on a new and improved version of CyberChef. It's still under construction and only supports one function right now, but I can assure you that it's blazing fast!

http://cybercook.chal.imaginaryctf.org

C0NV3R7 70/FR0M L337

http://1337.chal.imaginaryctf.org

Cookie Stream is back, with a new auth system and something way more useful than rickrolling people.

https://imaginaryctf.org/r/Buc2D#maas.zip http://maas.chal.imaginaryctf.org

I made a file hosting site! Just don't expect to get your files back...

https://hostility.chal.imaginaryctf.org

Too much Flask last year... let's bring it back again.

http://minigolf.chal.imaginaryctf.org

Just in case you didn't get enough golf with the other challenge. Flag is in an arbitrarily named file, but in the same directory.

http://sstigolf.chal.imaginaryctf.org

(Backup) https://sstigolf.ictf2022.iciaran.com/

Roo seems to have left his computer on, can you find his password?

http://roocookie.chal.imaginaryctf.org

This challenge has been shut down. The flag is ictf{i'm_sure_you_0btained_this_flag_with0ut_any_sort_of_trickery...}.

I'm tired of all these skill-based CTF challenges. Y'know what we need more of here? Politics! Simply convince (or strongarm) your fellow competitors to vote for you. The top 1% of players who have the most votes (or top 50, whichever is less) will recieve the flag. This voting will occur 5 times per hour. Keep in mind that no matter how many accounts you make, you can only vote once per IP. Good luck, and happy campaigning!

http://chal.imaginaryctf.org:1339/

Apparently one of these buttons isn't useless...

http://button.chal.imaginaryctf.org

In the early days of online poker rooms, the game would get cracked and players would play with perfect knowledge of the upcoming hands... Can you deal out the next two games correctly?

https://imaginaryctf.org/r/wehal#poker.py https://imaginaryctf.org/r/jrVLM#cards.22.07.16.txt

Sometimes you just gotta have some fun implementing bare hardness assumptions.

https://imaginaryctf.org/r/yjdjq#lwe.py https://imaginaryctf.org/r/0Pto9#output.txt

Base64 is my favorite encryption scheme.

https://imaginaryctf.org/r/qapcC#encode.py https://imaginaryctf.org/r/W0Wk7#out.txt

I guess smoll needed a revenge after all 😭

• https://imaginaryctf.org/r/YTYL0
• https://imaginaryctf.org/r/HKb3e

HELP! I encrypted my files with this program I downloaded from the internet. Can you recover my 42-byte flag?

https://imaginaryctf.org/r/cjy4G#stream https://imaginaryctf.org/r/kvJhQ#out.txt

My passwords are safe and secure with the use of sha42!

https://imaginaryctf.org/r/pPw0X#hash.py https://imaginaryctf.org/r/mIauk#jbox.txt nc hash.chal.imaginaryctf.org 1337

Encrypt your messages with our new OTP service. Your messages will never again be readable to anyone.

https://imaginaryctf.org/r/MZAjq#otp.py nc otp.chal.imaginaryctf.org 1337

I don't trust everyone's CBC implementations. So I rolled my own, with A HUNDRED PERCENT GUARANTEE OF DATA INTEGRITY!

https://imaginaryctf.org/r/EKpfb#cbc.py

Huge primes = huge security

https://imaginaryctf.org/r/LankV#chal.py https://imaginaryctf.org/r/fPiIa#output.txt

Cryptograms == encryption, right? Flag is readable English.

https://imaginaryctf.org/r/gYU8b#encode.py https://imaginaryctf.org/r/GE8q2#out.txt

Just a regular, run-of-the-mill RSA challenge, right? Right?

https://imaginaryctf.org/r/jZPYB#smoll.py https://imaginaryctf.org/r/nEiGc#output.txt

To be or not to be, that is the question. Sadly the challenge doesn't look nearly as good unless you have a fancy terminal 😦

https://imaginaryctf.org/r/FahVo#emojis.txt

The intern was supposed to create subtitles for this video, but they've made quite a few "mistakes", maybe they're not mistakes after all? Flag is in the format ictf{[a-z_]*}

https://imaginaryctf.org/r/1sOoF#subtitles.mp4 https://imaginaryctf.org/r/J5GTW#subtitles.srt

Did Caesar like PNG files?

https://imaginaryctf.org/r/tTkud#corrupted.png

I just made my own file format. It's called BSV, for BEE-separated-values! See if you can recover my secret flag.

Note: You will need to add the {} of the flag yourself. Please make the flag all lowercase. Flag format: ictf{[a-z0-9_]*}

https://imaginaryctf.org/r/qDUE0#flag.bsv

It helps to have a rain tarp when there's bad weather.

https://imaginaryctf.org/r/vHfga#tarp.pcapng

What are you doing in my swamp?!

docker pull ghcr.io/iciaran/ogre:ctf

THIS IS AN OSINT CHALLENGE

unpuzzler7#6451 is back! I've heard that he's been listening to a lot of music lately. Think that you might be able to find something? (To access this challenge you must join our discord server at https://discord.gg/ctf)

None

This is an OSINT challenge.

Max49 went on a trip... can you figure out where? The flag is ictf{latitude_longitude}, where both are rounded to three decimal places. For example, ictf{-95.334_53.234}

https://imaginaryctf.org/r/06FSz#IMG_2901.jpg

THIS IS AN OSINT CHALLENGE

It looks like unpuzzler7 has been getting into photography recently. His pictures aren't very good though, you can't even tell what the location of the pictures are! (To access this challenge you must join our discord server at https://discord.gg/ctf)

None