Full Weak Engineer CTF 2025 ไฝๅ่ Writeup๏ผMYAKUMYAKU TOWER, base๐๏ผ
2025ๅนด8ๆ29ๆฅใ31ๆฅใซ48ๆ้ใง้ๅฌใใใฆใใFull Weak Engineer CTF 2025ใงใMYAKUMYAKU TOWERใใจใbase๐ใใฎไฝๅใใใฆใใพใใใ
CTFๆ้ไธญใซ่ๅผฑใชๅ้กใใกใ่งฃใใใใซใคใใฆใใใผใใฎใญใดใ็ ดๅฃใใไบบใใใฃใฆใใพใใใ
base๐ (316 Solve / 733 team)
ๅ้ก
๐ช๐ฑ๐๐ซ๐๐๐๐ฉ๐๐๐ฌ๐งจ๐ฑ๐ฅ๐ซ๐งถ๐ช๐ฑ๐๐ง๐๐๐๐ฉ๐๐ก๐ฌ๐งฎ๐คฎ๐ฅ๐ซ๐๐ช๐ฑ๐ฝ๐ง๐๐ป๐ณ๐ฉ๐ฅ๐ชจ๐ฌ๐ฉฐ๐๐ฅ๐ซ๐ช๐ช๐ฑ๐ฟ๐ซ๐๐ต๐๐ฉ๐๐๐ฌ๐งฏ๐บ๐ฅ๐ซ๐๐ช๐ฐ๐๐ซ๐๐ฟ๐ณ๐ฉ๐ฒ๐๐ฌ๐งฒ๐ฏ๐ฅ๐ซ๐ฐ๐ช๐ฑ๐๐ง๐๐๐ผ๐ฉ๐ฟ๐ชป๐ฌ๐งช๐๐ฅ๐ซ๐งข๐ช๐ฑ๐๐ง๐๐๐ซณ๐ฉ๐๐๐ฌ๐งถ๐๐ฅ๐ซ ๐๐ช๐ฑ๐๐๐๐๐ฅ๐ฉ๐ฑ๐คฎ๐ฌ๐ฉฐ๐ณ๐ฅ๐ซ๐๐ช๐ฐ๐ฝ๐ซ๐๐ฟ๐๐ฉ๐๐๐ฌ๐งต๐ท๐๐๐
ไธ่จใฎๅ้กๆใจใ็ตตๆๅญใชในใemoji.txtใจใจใณใณใผใใใในใฏใชใใใไธใใใใฆใใพใ
้ ๅธใใกใคใซ
chall.py
#!/usr/bin/env python๐
with open('emoji.txt', 'r', encoding='utf-8') as f:
emoji = list(f.read().strip())
table = {i: ch for i, ch in enumerate(emoji)}
def encode(data):
bits = ''.join(f'{b:08b}' for b in data)
pad = (-len(bits)) % 10
bits += '0' * pad
out = [table[int(bits[i:i+10], 2)] for i in range(0, len(bits), 10)]
r = (-len(out)) % 4
if r:
out.extend('๐' * r)
return ''.join(out)
if __name__ == '__main__':
msg = 'Hello!'
enc = encode(msg.encode())
print('msg:', msg)
print('enc:', enc)
emoji.txt
โญโญ๐๐๐๐๐๐๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ค๐ฅ๐ฆ๐ง๐จ๐ฉ๐ช๐ฌ๐ญ๐ฎ๐ฏ๐ฐ๐ฑ๐ฒ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐น๐บ๐ป๐ผ๐ฝ๐พ๐ฟ๐๐๐๐๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ข๐ฃ๐ค๐ฅ๐ฆ๐ง๐จ๐ฉ๐ช๐ซ๐ฌ๐ญ๐ฎ๐ฏ๐ฐ๐ฑ๐ฒ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐น๐บ๐ป๐ผ๐ฝ๐พ๐ฟ๐๐๐๐๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ข๐ฃ๐ค๐ฅ๐ฆ๐ง๐จ๐ฉ๐ช๐ซ๐ฌ๐ญ๐ฎ๐ฏ๐ฐ๐ฑ๐ฒ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐น๐บ๐ป๐ผ๐ฝ๐พ๐ฟ๐๐๐๐๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ข๐ฃ๐ค๐ฅ๐ฆ๐ง๐จ๐ช๐ซ๐ฌ๐ญ๐ฎ๐ฏ๐ฐ๐ณ๐ด๐ต๐ท๐ธ๐น๐บ๐๐๐๐๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ข๐ฃ๐ค๐ฅ๐ฆ๐ง๐จ๐ฉ๐ช๐ซ๐ฌ๐ญ๐ฎ๐ฏ๐ฐ๐ฑ๐ฒ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐น๐บ๐ป๐ผ๐ฝ๐พ๐ฟ๐๐๐๐๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ข๐ฃ๐ค๐ฅ๐ฆ๐ง๐จ๐ฉ๐ช๐ซ๐ฌ๐ญ๐ฎ๐ฏ๐ฐ๐ฑ๐ฒ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐น๐บ๐ป๐ผ๐ฝ๐พ๐ฟ๐๐๐๐๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ข๐ฃ๐ค๐ฅ๐ฆ๐ง๐จ๐ฉ๐ช๐ซ๐ฌ๐ญ๐ฎ๐ฏ๐ฐ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐น๐บ๐ป๐ผ๐ฝ๐พ๐ฟ๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ข๐ฃ๐ฆ๐ง๐จ๐ช๐ฎ๐ฏ๐ฐ๐ฑ๐ฒ๐ต๐ถ๐ท๐ธ๐น๐บ๐ป๐ผ๐ฝ๐ฟ๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ฅ๐ฆ๐ง๐จ๐ฉ๐ช๐ซ๐ฌ๐ญ๐ฎ๐ฏ๐ฐ๐ฑ๐ฒ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐น๐บ๐ป๐ผ๐ฝ๐๐๐๐๐๐๐๐ฏ๐ฐ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐น๐บ๐๐๐๐๐๐๐๐๐ค๐ฅ๐จ๐ฑ๐ฒ๐ผ๐๐๐๐๐๐๐๐๐๐ก๐ฃ๐จ๐ฏ๐ณ๐บ๐ป๐ผ๐ฝ๐พ๐ฟ๐๐๐๐
๐๐๐๐๐๐๐๐๐๐๐ก๐ข๐ฅ๐จ๐ช๐ซ๐ฌ๐ญ๐ฎ๐ฐ๐ฑ๐ณ๐ต๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐
๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ข๐ฃ๐ค๐ฅ๐ฆ๐ง๐จ๐ฉ๐ช๐ซ๐ฌ๐ญ๐ฎ๐ฏ๐ฐ๐ฑ๐ฒ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐ฝ๐ฟ๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐ก๐ฃ๐ค๐ฅ๐ฉ๐ซ๐ฌ๐ฐ๐ณ๐ด๐ต๐ถ๐ท๐ธ๐น๐บ๐ป๐ผ๐ ๐ก๐ข๐ฃ๐ค๐ฅ๐ฆ๐ง๐จ๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค๐ค ๐คก๐คข๐คฃ๐คฆ๐คง๐คฉ๐คช๐คฌ๐คฎ๐คฏ๐คฐ๐คฑ๐คฒ๐คณ๐คด๐คต๐คถ๐คท๐คธ๐คน๐คบ๐คผ๐คฝ๐คพ๐คฟ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ
๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ๐ฅ ๐ฅก๐ฅข๐ฅฃ๐ฅค๐ฅฅ๐ฅฆ๐ฅง๐ฅจ๐ฅฉ๐ฅช๐ฅซ๐ฅฌ๐ฅญ๐ฅฎ๐ฅฏ๐ฅฐ๐ฅฒ๐ฅณ๐ฅด๐ฅต๐ฅถ๐ฅท๐ฅธ๐ฅน๐ฅบ๐ฅป๐ฅผ๐ฅฝ๐ฅพ๐ฅฟ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ
๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ๐ฆ ๐ฆก๐ฆข๐ฆฃ๐ฆค๐ฆฅ๐ฆฆ๐ฆง๐ฆจ๐ฆฉ๐ฆช๐ฆซ๐ฆฌ๐ฆญ๐ฆฎ๐ฆฏ๐ฆฐ๐ฆฑ๐ฆฒ๐ฆณ๐ฆด๐ฆต๐ฆถ๐ฆท๐ฆธ๐ฆน๐ฆบ๐ฆป๐ฆผ๐ฆฝ๐ฆพ๐ฆฟ๐ง๐ง๐ง๐ง๐ง๐ง
๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง๐ง ๐งก๐งข๐งฃ๐งค๐งฅ๐งฆ๐งง๐งจ๐งฉ๐งช๐งซ๐งฌ๐งญ๐งฎ๐งฏ๐งฐ๐งฑ๐งฒ๐งณ๐งด๐งต๐งถ๐งท๐งธ๐งน๐งบ๐งป๐งผ๐งฝ๐งพ๐งฟ๐ฉฐ๐ฉฑ๐ฉฒ๐ฉณ๐ฉด๐ฉน๐ฉบ๐ฉป๐ฉผ๐ช๐ช๐ช๐ช๐ช๐ช
๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช๐ช ๐ชก๐ชข๐ชฃ๐ชค๐ชฅ๐ชฆ๐ชง๐ชจ๐ชฉ๐ชช๐ชซ๐ชฌ๐ชญ๐ชฎ๐ชฏ๐ชฑ๐ชด๐ชต๐ชถ๐ชท๐ชธ๐ชน๐ชบ๐ชป๐ชผ๐ชฝ๐ชฟ๐ซ๐ซ๐ซ๐ซ
๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ๐ซ ๐ซก๐ซฆ๐ซง๐ซฐ๐ซฑ๐ซฒ๐ซณ๐ซต๐ซถ๐ซท
่งฃๆณ
base64ใจไผผใๆง้ ใงใใใ้ทใฎๅคๆใใใฆใใพใใ
ๅ
ฅๅใ5ใใคใใใค่งฃ้ใใฆใ8bit5ใคใ10bit4ใคใซๅคๆใใใจใใใใฎใงใใ
10bitใซๆบใใชใใใฎใฏ0ๅใใใใๅคๆๅพใฎ10bitใฎใใญใใฏๆฐใ4ใฎๅๆฐใซใชใใชใๅ ดๅใฏใ่ถณใใชใๅใ๐ใ่ฟฝๅ ใใฆ4ใฎๅๆฐใซใชใใใใซ่ชฟๆดใใฆใใพใ๏ผbase64ใฎ=ใจๅใๆฑใ๏ผ
10bitใฏใใใใ็ตตๆๅญ1024ๅใซๅฏพๅฟใใฆใใใฎใงใๅพฉๅทใใใซใฏใ็ตตๆๅญใ10bitใซๆปใใ8bitใใจใซ่งฃ้ใใใฐใใใงใใ
base64ใง่จใใ=ใใจๅๆงใซใๅญๆฐใๅใใใ๐ใใฏใใฃใฆใใชใใฆใๅพฉๅทใงใใใฎใงใๅใๆจใฆใฆใใพใใ
๏ผใชใใbaseX็ณปใฎๅฝๅใซๅพใใจใใใฎใงใใใฐใใใฎใจใณใณใผใๆนๅผๅใฏbase1024ใฎๆนใ้ฉๅใงใ๏ผ
ๅ้กๆใซไธใใใใ็ตตๆๅญๅใฏใflagใๅซใๆๅญๅใbase๐ใง2ๅใจใณใณใผใใใใใฎใงใใใไปฅไธใฎใใใซใใณใผใใใๅฆ็ใๅฎ่ฃ ใใใฐflagใๅพใใใพใใ
#!/usr/bin/env python3
with open('emoji.txt', 'r', encoding='utf-8') as f:
emoji = list(f.read().strip())
table = {i: ch for i, ch in enumerate(emoji)}
rev_table = {ch: i for i, ch in enumerate(emoji)}
def encode(data):
bits = ''.join(f'{b:08b}' for b in data)
pad = (-len(bits)) % 10
bits += '0' * pad
out = [table[int(bits[i:i+10], 2)] for i in range(0, len(bits), 10)]
r = (-len(out)) % 4
if r:
out.extend('๐' * r)
return ''.join(out)
def decode(text):
text = text.rstrip('๐')
bits = ''.join(f'{rev_table[ch]:010b}' for ch in text)
useful_len = len(bits) - (len(bits) % 8)
data = bytes(int(bits[i:i+8], 2) for i in range(0, useful_len, 8))
return bytes(data)
def solve():
enc = '๐ช๐ฑ๐๐ซ๐๐๐๐ฉ๐๐๐ฌ๐งจ๐ฑ๐ฅ๐ซ๐งถ๐ช๐ฑ๐๐ง๐๐๐๐ฉ๐๐ก๐ฌ๐งฎ๐คฎ๐ฅ๐ซ๐๐ช๐ฑ๐ฝ๐ง๐๐ป๐ณ๐ฉ๐ฅ๐ชจ๐ฌ๐ฉฐ๐๐ฅ๐ซ๐ช๐ช๐ฑ๐ฟ๐ซ๐๐ต๐๐ฉ๐๐๐ฌ๐งฏ๐บ๐ฅ๐ซ๐๐ช๐ฐ๐๐ซ๐๐ฟ๐ณ๐ฉ๐ฒ๐๐ฌ๐งฒ๐ฏ๐ฅ๐ซ๐ฐ๐ช๐ฑ๐๐ง๐๐๐ผ๐ฉ๐ฟ๐ชป๐ฌ๐งช๐๐ฅ๐ซ๐งข๐ช๐ฑ๐๐ง๐๐๐ซณ๐ฉ๐๐๐ฌ๐งถ๐๐ฅ๐ซ
๐๐ช๐ฑ๐๐๐๐๐ฅ๐ฉ๐ฑ๐คฎ๐ฌ๐ฉฐ๐ณ๐ฅ๐ซ๐๐ช๐ฐ๐ฝ๐ซ๐๐ฟ๐๐ฉ๐๐๐ฌ๐งต๐ท๐๐๐'
dec1 = decode(enc)
dec2 = decode(dec1.decode())
print('dec1:', dec1.decode())
print('dec2:', dec2.decode())
if __name__ == '__main__':
solve()
ๅฎ่ก็ตๆใฏไปฅไธใฎ้ใใงใใ
dec1: ๐ช๐ฐ๐๐๐๐คต๐๐๐ท๐ฆจ๐ฅฉ๐๐ผ๐ฅ๐งท๐ฅณ๐๐๐
๐ถ๐ท๐๐คง๐ฃ๐๐ฅต๐๐ฆฝ๐๐ง๐ชฅ๐ฆฟ๐๐๐๐ง๐๐ญ๐ฅฌ๐ฒ๐ซ๐๐๐
dec2: ๐Congratulations! fwectf{n0_r0ck37_3m0ji_n0_llm}
Answer: fwectf{n0_r0ck37_3m0ji_n0_llm}
LLMใฃใฆ๐ใจใใฎ็ตตๆๅญไฝฟใใฎๅฅฝใใใใ ใใจใใๆฅ้ ใฎๆใใ่ชๅผตใใฆไฝใใใใจใณใณใผใๆนๅผใงใใ
MYAKUMYAKU TOWER (76 Solve / 733 team)
ๅ้ก
ใใฃใฏใใฃใฏใฟใใใชใใใใใฟใฏใผใใใใญ๏ผใใฎๅ็ใๆฎๅฝฑใใใฎใฏใใคใ ใใ๏ผ ๆฎๅฝฑๆฅใไปฅไธใฎๅฝขๅผใง็ญใใฆใญ๏ผ่ชคๅทฎยฑ1ๆฅ่จฑๅฎน๏ผ
Flagๅฝขๅผ๏ผfwectf{YYYMMDD} ไพ๏ผ2025ๅนด8ๆ30ๆฅใฎๅ ดๅ fwectf{20250830}
Thereโs a tower lit up like Myakumyaku! When was this photo taken? Give the shooting date in the format below (ยฑ 1 day tolerance).
Flag format: fwectf{YYYYMMDD} (Example: August 30 2025 โ fwectf{20250830})
่งฃๆณ
ใใใฏๆฑไบฌใฟใฏใผใฎๅ็ใงใใๆฑไบฌใฟใฏใผใฏๆฅใใจใซ็ฐใชใใฉใคใใขใใใใใฆใใใไธญใซใฏ็นๅฅใชใฉใคใใขใใใใใๆฅใใใใพใใ
ใใฎๆฅใใใคใชใฎใใๆขใใจใใๅ้กใงใใ
ใใฎๅ็ใฏไฝๅ่ asusnๆฌไบบใๆฎๅฝฑใใใใฎใงใใใใใฎใใใๅใๅ็ใใใใไธใงใใใๆขใใฆใ็ตถๅฏพใซ่ฆใคใใใพใใใ
ใฟใคใใซใใใใฃใฏใใฃใฏไปๆงใฎใฉใคใใขใใใฎๆฅไปใ่ชฟในใฆใฟใพใใใใใฟใผใณใ็ฐใชใใพใใ
ไธใใใใๅ็ใฏใ้ใป็ฝใป่ตคใฎ3่ฒใงๆงๆใใใฆใใพใใ
ใๆฑไบฌใฟใฏใผใใฉใคใใขใใใใใชใณใญใผใซใใชใฉใง็ฒใๅผทใGoogle็ปๅๆค็ดขใใใใจใ๏ผใใชใ๏ผไธใฎๆนใซๅใใใใชใฉใคใใขใใใฎ็ปๅใ่ฆใคใใใพใใ
2018ๅนด9ๆ14ๆฅใจ15ๆฅใฎ2ๆฅ้ใๆฅไปไบคๆต160ๅนดใ่จๅฟตใใฆใใใฉใณในๅฝๆใฎ้ใป็ฝใป่ตคใฎใใชใณใญใผใซใซใฉใผใ็จใใใฉใคใใขใใใใใฆใใพใใใ
ๆฑไบฌใฟใฏใผๅ ฌๅผใตใคใ https://www.tokyotower.co.jp/lightup/ ใง่ฉฒๅฝใฎๆฅไปใฎใฉใคใใขใใใ็ขบ่ชใใใจใ็ขบใใซใฉใคใใขใใใใใฆใใพใใ
็ปๅใใใ ใจใ9ๆ14ๆฅใจ15ๆฅใฏๅคๅฅใงใใพใใใใ่ชคๅทฎ1ๆฅใ่จฑๅฎนใใฆใใใฎใงใใฉใกใใๆๅบใใฆใๆญฃ่งฃใจใชใใพใใ็ใฎๆญฃ่งฃใฏ9ๆ15ๆฅใงใใ
Answer: fwectf{20180915}
ไธๆนใๅๆๆใซใจใใใงใซๅกใฏๆฅๆฌไปๆงใซใชใฃใฆใใใใใงใใ
ใใใใซ
ใใใใใฎใๅๅ ใใใใจใใใใใพใใ๏ผ๐๐ฆ๐๐
Discussion