PatriotCTF 2025 Misc & OSINT & Forensics -- writeup

import golly as g
import os

def export_01_grid():
    x_start = 138
    x_end   = 282762
    x_step  = 2048

    y_start = 1496
    y_end   = 21976
    y_step  = 2048

    desktop = os.path.join(os.path.expanduser("~"), "Desktop")
    filepath = os.path.join(desktop, "output.txt")

    with open(filepath, "w") as f:
        y = y_start
        while y <= y_end:
            line_bits = []

            x = x_start
            while x <= x_end:
                state = g.getcell(x, y)
                line_bits.append("1" if state == 1 else "0")
                x += x_step

            f.write("".join(line_bits) + "\n")

            y += y_step

    g.show("Done.")

export_01_grid()

from PIL import Image

# Provided text block
text = """0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000
0011000011001111101111001010000000000110000000100100011100011100000001000000000000000000011000110010000000001000110000011001000001110010100
0100100100100010001000001000000000001010000000101010100010100010000010100000000000000000100101001010000000001001001000101001000010001000100
0100100100100010001000001000100010010010011100100010100000000010000000100111100000001100100101001010000000111001000000101001110010001000100
0100100100000010001110010000100010100010100010100010111000011100000000101000000000010010100101001010000001001001110001001001001001110000010
0111000100100010001000001000010100111110100000100010100000000010000000100111000000010000100101001010000001001001001001111001001010001000100
0100000100100010001000001000010100000010100000100010100000100010111000100000101110010010100101001010111101001001001000001001001010001000100
0100000011000010001000001010001000000010100000100010100000011100000000101111000000001100011000110010000000111000110000001001110001110010100
0000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000
0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"""

# Parse lines
lines = text.strip().split("\n")
height = len(lines)
width = len(lines[0])

# scale factor
scale = 8
img = Image.new("RGB", (width * scale, height * scale), "white")
pixels = img.load()

for y, line in enumerate(lines):
    for x, c in enumerate(line):
        color = 0 if c == '1' else 255
        # fill 4x4 block
        for dy in range(scale):
            for dx in range(scale):
                pixels[x*scale+dx, y*scale+dy] = (color, color, color)

# Save image
path = "C:\\Users\\Mnzn\\Desktop\\output_image.png"
img.save(path)

import socket

from datetime import datetime, timezone

def cur_dt_bytes():

    """
    cur_dt: "YYYYMMDDTHHMMZ" (UTC)
    """
    now_utc = datetime.now(timezone.utc)
    s = now_utc.strftime("%Y%m%dT%H%MZ")
    return s.encode()

def build_v8():

    """
    v8 = "/tmp/" + cur_dt(...)
    """

    base = b"/tmp/"
    dt = cur_dt_bytes()
    v8 = base + dt
    return v8

def build_v11():

    """
    xsp(v8, "1337", v11)
    - v11[0..18] = v8[i] XOR key[i]
    - v11[19]    = '\n'
    """
    v8 = build_v8()
    key = b"1337" + b" " * (19 - 4)  # "1337" + 15 个空格

    out = bytearray(20)
    for i in range(19):
        out[i] = v8[i] ^ key[i]
    out[19] = 0x0A  # '\n'
    return bytes(out)

payload = build_v11()

from scapy.all import rdpcap, IP

from collections import Counter, defaultdict



pcap_file = "wegogym.pcap"



packets = rdpcap(pcap_file)



ttl_per_src = defaultdict(Counter)

src_counter = Counter()



for pkt in packets:

    if IP in pkt:

        src = pkt[IP].src

        ttl = pkt[IP].ttl

        ttl_per_src[src][ttl] += 1

        src_counter[src] += 1



# 自动选择出现最多包的源 IP

target_src, _ = src_counter.most_common(1)[0]

print("Selected source IP:", target_src)



# 选择该源IP中出现次数最多的 TTL 作为 base_ttl

ttl_counter = ttl_per_src[target_src]

base_ttl, _ = ttl_counter.most_common(1)[0]

print("Base TTL:", base_ttl)



# 提取异常 TTL

raw_ttls = [pkt[IP].ttl for pkt in packets

            if IP in pkt and pkt[IP].src == target_src and pkt[IP].ttl != base_ttl]



# 去重

clean_ttls = []

for t in raw_ttls:

    if not clean_ttls or clean_ttls[-1] != t:

        clean_ttls.append(t)



# 转 ASCII

flag = ''.join(chr(t) for t in clean_ttls)

print("Decoded:", flag)