Add mask (TWCTF) example; 5 reproducible solves total: ps_and_qs, lost_modulus, a2s, russian_threesome, mask

2026-08-16 22:30:50 +07:00
parent a0f8ce61ad
commit 572f66b7ed
2 changed files with 79 additions and 0 deletions
@@ -0,0 +1,75 @@
+"""
+EXAMPLE: TokyoWesterns 2020 — "mask" (Misc)
+https://github.com/p4-team/ctf/tree/master/2020-09-19-tokyowesterns/mask
+
+VULN: each line is `IP/mask`. The HOST bits (IP & ~mask) of the 40 entries
+form a base64 string; decode it to get the flag.
+
+Run:
+    cd /home/code/ctfkit
+    python3 examples/mask/solve.py
+Expected flag: TWCTF{Are-you-using-a-mask?}
+"""
+import ipaddress
+from base64 import b64decode
+
+MASKS = """
+192.168.55.86/255.255.255.0
+192.168.80.198/255.255.255.128
+192.168.1.228/255.255.255.128
+192.168.90.68/255.255.254.0
+192.168.8.214/255.255.255.128
+192.168.5.197/255.255.255.128
+192.168.71.90/255.255.255.0
+192.168.62.55/255.255.255.192
+192.168.78.209/255.255.255.128
+192.168.76.216/255.255.255.128
+192.168.91.202/255.255.255.128
+192.168.93.108/255.255.255.0
+192.168.74.76/255.255.254.0
+192.168.10.88/255.255.254.0
+192.168.82.236/255.255.255.128
+192.168.13.246/255.255.255.128
+192.168.99.228/255.255.255.128
+192.168.68.83/255.255.252.0
+192.168.23.113/255.255.255.192
+192.168.52.113/255.255.255.192
+192.168.69.99/255.255.255.0
+192.168.19.114/255.255.255.192
+192.168.53.236/255.255.255.128
+192.168.90.117/255.255.254.0
+192.168.35.90/255.255.255.0
+192.168.91.121/255.255.255.0
+192.168.48.49/255.255.255.192
+192.168.27.104/255.255.255.0
+192.168.98.204/255.255.255.128
+192.168.93.87/255.255.255.0
+192.168.44.113/255.255.255.192
+192.168.40.104/255.255.248.0
+192.168.25.227/255.255.255.128
+192.168.57.50/255.255.255.192
+192.168.97.115/255.255.255.0
+192.168.30.47/255.255.255.192
+192.168.10.102/255.255.254.0
+192.168.51.209/255.255.255.128
+""".strip().split("\n")
+
+
+def main():
+    host_bits = bytearray()
+    for line in MASKS:
+        ip, mask = line.split("/")
+        a = int(ipaddress.IPv4Address(ip))
+        m = int(ipaddress.IPv4Address(mask))
+        host_bits.append(a & (~m & 0xFFFFFFFF) & 0xFF)
+    b64 = bytes(host_bits)
+    # base64 length must be a multiple of 4
+    b64 += b"=" * (-len(b64) % 4)
+    flag = b64decode(b64).decode(errors="replace")
+    print("host-bits b64:", b64.decode("latin1"))
+    print("FLAG =", flag)
+    return flag
+
+
+if __name__ == "__main__":
+    main()