Đã tìm được flag cho cả 2 challenge.

Flags

Warmerer Up: dalctf{teapot_2026}

Weird Movements: dalctf{u3u3_v_fa_c4age}
Trace chuột viết tay hơi nhiễu; ảnh render mình dùng để đọc flag ở đây: weird_movements_trace.png

---

Write-up

1. Warmerer Up - PDF

Challenge gợi ý “rules again again”, nên mình kiểm tra nội dung PDF trước. File PDF có dòng cuối trang 3 là teapot_2026, còn rules nói flag format là dalctf{...}. Vì vậy flag là dalctf{teapot_2026}. (rules2.pdf)

Lệnh đã dùng

bash
file /mnt/data/rules2.pdf
pdfinfo /mnt/data/rules2.pdf
pdftotext /mnt/data/rules2.pdf - | tail -n 30
pdftotext /mnt/data/rules2.pdf /tmp/rules2.txt
grep -nE 'dalctf|flag|teapot|2026' /tmp/rules2.txt

Output quan trọng:

text
Flag format is dalctf{...} unless otherwise specified
...
teapot_2026

Flag

text
dalctf{teapot_2026}

---

2. Weird Movements - PCAP

Gợi ý “Sergey Ushanka” liên quan đến The Magnus Archives - Binary, nơi có phrase nổi tiếng về “angles”; clue này hướng mình đến việc nhìn chuyển động/đường đi hơn là tìm text trực tiếp trong packet. (The Magnus Archives)

PCAP là USB capture, không phải traffic TCP/HTTP bình thường. Mình parse pcapng, lọc các USB interrupt completion packet của HID mouse:

• device: 40
• endpoint: 0x81
• transfer type: interrupt, xfer_type = 1
• report dài 4 byte
• HID mouse report dạng: buttons, dx, dy, wheel
• chỉ vẽ khi buttons & 1, tức left mouse button đang được giữ

Kết quả render ra nét chuột, đọc được flag.

Lệnh đã dùng

bash
file /mnt/data/capture.pcapng
python3 solve_weird_movements.py /mnt/data/capture.pcapng -o weird_movements_trace.png

Output:

text
HID reports: 4254
left-button segments: 2783
bounds x=-1021..340 y=-197..99
wrote weird_movements_trace.png size=5528x1268

Script đã dùng

python
#!/usr/bin/env python3
import argparse
import pathlib
import struct
from PIL import Image, ImageDraw


def iter_pcapng_blocks(buf: bytes):
    off = 0
    endian = '<'
    while off + 12 <= len(buf):
        block_type, block_len = struct.unpack_from(endian + 'II', buf, off)
        if block_len < 12 or off + block_len > len(buf):
            raise ValueError(f'Invalid pcapng block at offset {off}: type={block_type:#x}, len={block_len}')
        if block_type == 0x0A0D0D0A:
            bom = struct.unpack_from('<I', buf, off + 8)[0]
            endian = '<' if bom == 0x1A2B3C4D else '>'
        yield off, block_type, block_len, endian
        off += block_len


def s8(x: int) -> int:
    return x - 256 if x > 127 else x


def extract_mouse_segments(pcapng_path: pathlib.Path):
    raw = pcapng_path.read_bytes()
    x = y = 0
    all_points = [(0, 0)]
    draw_segments = []
    report_count = 0
    pressed_count = 0

    for off, block_type, block_len, endian in iter_pcapng_blocks(raw):
        if block_type != 6:
            continue

        iface, ts_hi, ts_lo, caplen, origlen = struct.unpack_from(endian + 'IIIII', raw, off + 8)
        packet = raw[off + 28: off + 28 + caplen]
        if len(packet) < 64:
            continue

        urb_type = chr(packet[8])
        xfer_type = packet[9]
        endpoint = packet[10]
        device = packet[11]
        status = struct.unpack_from('<i', packet, 28)[0]
        payload = packet[64:]

        if (urb_type, xfer_type, endpoint, device, status, len(payload)) != ('C', 1, 0x81, 40, 0, 4):
            continue

        buttons = payload[0]
        dx = s8(payload[1])
        dy = s8(payload[2])
        report_count += 1

        old = (x, y)
        x += dx
        y += dy
        new = (x, y)
        all_points.append(new)

        if buttons & 1:
            pressed_count += 1
            draw_segments.append((old, new))

    return all_points, draw_segments, report_count, pressed_count


def render_trace(points, segments, out_path: pathlib.Path, scale: int = 4, margin: int = 40):
    xs = [p[0] for p in points]
    ys = [p[1] for p in points]
    min_x, max_x = min(xs), max(xs)
    min_y, max_y = min(ys), max(ys)

    width = (max_x - min_x + 1) * scale + 2 * margin
    height = (max_y - min_y + 1) * scale + 2 * margin
    img = Image.new('RGB', (width, height), 'white')
    draw = ImageDraw.Draw(img)

    def project(p):
        return ((p[0] - min_x) * scale + margin,
                (p[1] - min_y) * scale + margin)

    for a, b in segments:
        draw.line([project(a), project(b)], fill='black', width=max(2, scale // 1))

    img.save(out_path)
    return (min_x, max_x, min_y, max_y), (width, height)


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument('pcapng', type=pathlib.Path)
    ap.add_argument('-o', '--output', type=pathlib.Path, default=pathlib.Path('mouse_trace_pressed.png'))
    args = ap.parse_args()

    points, segments, reports, pressed = extract_mouse_segments(args.pcapng)
    bounds, size = render_trace(points, segments, args.output)

    print(f'HID reports: {reports}')
    print(f'left-button segments: {pressed}')
    print(f'bounds x={bounds[0]}..{bounds[1]} y={bounds[2]}..{bounds[3]}')
    print(f'wrote {args.output} size={size[0]}x{size[1]}')


if __name__ == '__main__':
    main()

Mình cũng lưu script sạch ở đây: solve_weird_movements.py

Flag

text
dalctf{u3u3_v_fa_c4age}