# Bearcat CTF 2025 Hey, fellow hackers! 🏴‍☠️ Today, I’m dropping a writeup for the Bearcat CTF 2025 challenges!️. I teamed up with my squad, *P4rad0x.* Let’s jump straight into the action! 🚀

P4rad0x Team

## Web ### Global Redirect - 100

Challenge Description

At first glance, it looks like a **boring** old login page to me. But, there’s always something more beneath the surface. Let’s break it down! The challenge presents us with a simple login page asking for a username and password. My first instinct? I decided to peek at the **page source**

View Page Source

and found something *very* interesting—**a JavaScript script handling authentication!** ```javascript ``` Now, what’s happening here? 1. The script takes the password entered by the user. 2. It **hashes** the password using **SHA-256**. 3. It compares the hashed value with a **hardcoded** hash. 4. If it matches, it redirects the user to a new page. **Key takeaway:** The password isn't checked on the server The script reveals the secret **redirect location**: ``` http://chal.bearcatctf.io:39724/0078f62f00305b73de6ccace8f9fc1f68a8f1dcec865d33fcacbaf255ddefaa7 ``` Visit the URL, the admin page was wide open, and sitting right there was our **flag**: **BCCTF{T1ck3t\_t0\_0wn3rsh1p!}** ## Reversing ### Say Cheese - 150

Challenge Description

In this challenge, A **Python script**, it is a simple flag checking program. In that the **ciphertext, key and the encoder function** is given, Let’s break it down step by step! {% code overflow="wrap" %} ```python import base64 def encoder(input_str, key): encoded_chars = [] for i in range(len(input_str)): key_c = key[i % len(key)] encoded_c = chr((ord(input_str[i]) + ord(key_c)) % 256) encoded_chars.append(encoded_c) encoded_str = ''.join(encoded_chars) return base64.b64encode(encoded_str.encode()).decode() def main(): print(""" _--"-. .-" "-. |""--.. '-. | ""--.. '-. |.-. .-". ""--..". |'./ -_' .-. | | .-. '.-' .-' '--.. '.' .- -. ""--.. '_' : ""--.. | ""-' """) ciphertext = "wpbCi8KIwpfCh8OPwph5wqnCosK6woTCqcKnwq13wrfCh8KzwqnCpMKKccOJwrh8wqTCl3LDgcKHw4U=" key = "THECAT" inp = input("Enter your cat: ") encoded_flag = encoder(inp, key) if ciphertext == encoded_flag: print("YAY you found the cat!") else: print("Not so easy cheesy huh?") if __name__ == "__main__": main() ``` {% endcode %} In this Python script, it does the following: 1. **Takes user input** (a string). 2. **Encodes** it using a function called `encoder()`. 3. **Compares** the encoded result to a hardcoded `ciphertext`. 4. If they match, it prints **"YAY you found the cat!"**, otherwise, it denies us. Here’s the important part—the **encoder function**: ```python def encoder(input_str, key): encoded_chars = [] for i in range(len(input_str)): key_c = key[i % len(key)] encoded_c = chr((ord(input_str[i]) + ord(key_c)) % 256) encoded_chars.append(encoded_c) encoded_str = ''.join(encoded_chars) return base64.b64encode(encoded_str.encode()).decode() ``` It’s basically **modifying each character** of the input based on the key **"THECAT"**, then encoding it in **base64**. Since I don’t know the **original input** that produced the given **ciphertext**, I need to **reverse** the encoding process. Looking at the logic: * Each character in the input string is **shifted** using `(ord(input[i]) + ord(key[i % len(key)])) % 256`. * To undo it, we just **reverse the shift**: {% code overflow="wrap" %} ```python import base64 def decoder(ct, key): d_b64 = base64.b64decode(ct).decode() d_chars = [] # print(len(d_b64)) for i in range(len(d_b64)): key_c = key[i % len(key)] d_c = chr((ord(d_b64[i]) - ord(key_c)) % 256) d_chars.append(d_c) return ''.join(d_chars) ciphertext = "wpbCi8KIwpfCh8OPwph5wqnCosK6woTCqcKnwq13wrfCh8KzwqnCpMKKccOJwrh8wqTCl3LDgcKHw4U=" key = "THECAT" flag = decoder(ciphertext, key) print("FLAG:", flag) ``` {% endcode %} **BCCTF{D1d\_y0U\_h4v3\_a\_G0ud4\_T1m3}** ### Easy - 300

Challenge Description

In this challenge, I am going to do a simple reverse engineering. I am given an **ELF executable file**. This file prompts for user input and checks if it matches a hidden flag. To peek inside, I uploaded the binary into **Ghidra**—a powerful tool for reverse engineering. I navigated to the **main function**, and guess what❓ There were a bunch of interesting lines dealing with variables and a mysterious XOR function!

Main Function

**XOR** is a common trick used to encrypt and decrypt data. The program had a set of encrypted values, and it used a key to **XOR** them back into the original flag. Here's how it worked: * The program stored some values in variables. * These values were passed into the **XOR** function along with a **key** (0x37333331). * The function returned the decrypted result, which was then compared with user input.

Xor Function

I found these values in the program: ```c local_168 = 0x7f04487763707073 local_160 = 0x435d4005406c0405 local_158 = 0x734107796803406e local_150 = 0x4c ``` Using Python’s `struct` module, I wrote a simple script to change the format to little endian. {% code overflow="wrap" %} ```python import struct local_168 = 0x7f04487763707073 local_160 = 0x435d4005406c0405 local_158 = 0x734107796803406e def to_little_endian(value): return struct.pack("