Challenge

Information

  • category: misc
  • points: 273

Description

赶紧加入游戏吧。 我们在等你

Hurry up and join in the game. We’re waiting for you.

http://134.175.230.10/ (cn)

http://222.85.25.41/ (cn)

http://144.202.79.93/ (us)

http://80.240.24.78/ (de)

http://45.77.253.164/ (sg)

Hint

  • mc_joinin’s flag is: De1CTF{md5(flag)} mc_joinin 的 flag 格式为:De1CTF{md5(flag)}

Writeup

Author

aandryyy

fuomag9

Fabbrei

rickycraft

Solution

By looking at the IP given we realized it was a Minecraft challenge.

We1c0me t0 De1Ta He4dl3ss M1neCrAft Te2t SeRv3r Minecraft 20.20 is developed by De1ta Team based on 1.12
Headless Client isn’t necessary.

Looking up at the Minecraft Server Status it showed a different version from the 1.12 reported on the website:

MOTD De1Ta He4dl3ss M1neCrAft Te2t SeRv3r
Players 0 / 2147483648
Version MC2020

And looking at the debug info:

IP address: 222.85.25.41
Port: 25565
> Protocol version: 997
Cached result No
SRV record No
Ping Yes
Query No

As the website stated a Client was not necessary. Even if the server was displayed in the Minecraft client:

image It could not connect to it.

image

Indeed the version protocol use by Minecraft 1.12 is the 335 and the one used in this Minecraft server is the 997, not found anywhere in the protocol number wiki.

We didn’t use a minecraft client to connect to the server but instead modified and used a LightWeight console for minecraft chat.

Changing the protocol version with 997 in this file at row 831 this client could easily be connected with the server.

image

Analyzing the traffic with Wireshark we found a hidden message: image

“text”:"\n\nHIDE FLAG ONE\n\n imgur.com/a/ZOrErVM \n\n"

Following the link we found this image:

image

Changing the colormap:

image

De1CTF{MC2020_Pr0to3l_Is_Funny-ISn't_It?}