# ▼▼▼Gateway(LuciferVM:25)、316/948team＝33.3%▼▼▼
**This writeup is written by [@kazkiti_ctf](https://twitter.com/kazkiti_ctf)**

---

```
Once you have the password to the VM archive, you will still need to get the decryption password to the root drive. This is the gateway challenge, and it can be found in the only unencrypted partition on the drive.
The decryption password does NOT include TUCTF{}, but the flag does.

Hint dump
Download newest binary
Run strings
Use tool
```

【他】

・`bcea5034bd8dbfd6dd9e30b929f9c123`ファイルが提供されている。

-----

`$ strings bcea5034bd8dbfd6dd9e30b929f9c123 `

```
/lib64/ld-linux-x86-64.so.2
libc.so.6
puts
__stack_chk_fail
stdin
printf
fgets
__cxa_finalize
__libc_start_main
GLIBC_2.4
GLIBC_2.2.5
_ITM_deregisterTMCloneTable
__gmon_start__
_ITM_registerTMCloneTable
AWAVI
AUATL
[]A\A]A^A_
GHPGS{JrypbzrOnpx,Unpxrezna}
A Multi-Purpose Utility for Calculating the ROT13 of Strings
There is no other purpose of this tool.
Please enter your string:
Your ROT13-ed String is: %sThank you for using this simple tool.
This tool exists only for this purpose.
There are no secrets contained within this tool.
Eventually, you'll give up reading this garbage, right?
Even I wouldn't waste time on this.
Good luck on the REAL challenge.
Literally all it does is take up space.
Obviously, this is a distraction.
Finally! A secret hidden flag!
Currently, it will literally do nothing outside of padding the file.
Turns out UPX packer REQUIRES a binary to be at least 40kbs
Unfortunately, this function will now exist.
To be sure, you may be thinking to yourself:
{Spoilers, it's not}
For real though, go solve the challenge so you can get on to the cool stuff.
Anyone could write this garbage, why would it be a secret.
Here you go, more garbage.
Really, it is just wasting space.
}-: Or not I guess, up to you.
NOTHING HERE.
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
;*3$"
GCC: (GNU) 7.2.0
init.c
crtstuff.c
deregister_tm_clones
__do_global_dtors_aux
completed.6973
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
gate.c
__FRAME_END__
__init_array_end
_DYNAMIC
__init_array_start
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
randomPaddingFunction
welcomeLine1
_ITM_deregisterTMCloneTable
puts@@GLIBC_2.2.5
stdin@@GLIBC_2.2.5
_edata
rot13
__stack_chk_fail@@GLIBC_2.4
printf@@GLIBC_2.2.5
datapad
__libc_start_main@@GLIBC_2.2.5
fgets@@GLIBC_2.2.5
__data_start
__gmon_start__
__dso_handle
_IO_stdin_used
sketchyString
__libc_csu_init
datapad2
__bss_start
main
exitLine1
__TMC_END__
_ITM_registerTMCloneTable
__cxa_finalize@@GLIBC_2.2.5
.symtab
.strtab
.shstrtab
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rela.dyn
.rela.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.dynamic
.got
.got.plt
.data
.bss
.comment
```

↓

`GHPGS{JrypbzrOnpx,Unpxrezna}`

↓rot13でデコード

```
GHPGS{JrypbzrOnpx,Unpxrezna}
HIQHT{KszqcAsPoqy,VoqysfAob}
IJRIU{LtArdBtQprz,WprztgBpc}
JKSJV{MuBseCuRqsA,XqsAuhCqd}
KLTKW{NvCtfDvSrtB,YrtBviDre}
LMULX{OwDugEwTsuC,ZsuCwjEsf}
MNVMY{PxEvhFxUtvD,atvDxkFtg}
NOWNZ{QyFwiGyVuwE,buwEylGuh}
OPXOa{RzGxjHzWvxF,cvxFzmHvi}
PQYPb{SAHykIAXwyG,dwyGAnIwj}
QRZQc{TBIzlJBYxzH,exzHBoJxk}
RSaRd{UCJAmKCZyAI,fyAICpKyl}
STbSe{VDKBnLDazBJ,gzBJDqLzm}
TUcTf{WELCoMEbACK,hACKErMAn} ●
UVdUg{XFMDpNFcBDL,iBDLFsNBo}
VWeVh{YGNEqOGdCEM,jCEMGtOCp}
WXfWi{ZHOFrPHeDFN,kDFNHuPDq}
XYgXj{aIPGsQIfEGO,lEGOIvQEr}
YZhYk{bJQHtRJgFHP,mFHPJwRFs}
ZaiZl{cKRIuSKhGIQ,nGIQKxSGt}
abjam{dLSJvTLiHJR,oHJRLyTHu}
bckbn{eMTKwUMjIKS,pIKSMzUIv}
cdlco{fNULxVNkJLT,qJLTNAVJw}
demdp{gOVMyWOlKMU,rKMUOBWKx}
efneq{hPWNzXPmLNV,sLNVPCXLy}
fgofr{iQXOAYQnMOW,tMOWQDYMz}
ghpgs{jRYPBZRoNPX,uNPXREZNA}
hiqht{kSZQCaSpOQY,vOQYSFaOB}
ijriu{lTaRDbTqPRZ,wPRZTGbPC}
jksjv{mUbSEcUrQSa,xQSaUHcQD}
kltkw{nVcTFdVsRTb,yRTbVIdRE}
lmulx{oWdUGeWtSUc,zSUcWJeSF}
mnvmy{pXeVHfXuTVd,ATVdXKfTG}
nownz{qYfWIgYvUWe,BUWeYLgUH}
opxoA{rZgXJhZwVXf,CVXfZMhVI}
pqypB{sahYKiaxWYg,DWYgaNiWJ}
qrzqC{tbiZLjbyXZh,EXZhbOjXK}
rsArD{ucjaMkczYai,FYaicPkYL}
stBsE{vdkbNldAZbj,GZbjdQlZM}
tuCtF{welcOmeBack,HackeRmaN}●
uvDuG{xfmdPnfCbdl,IbdlfSnbO}
vwEvH{ygneQogDcem,JcemgTocP}
wxFwI{zhofRphEdfn,KdfnhUpdQ}
xyGxJ{AipgSqiFego,LegoiVqeR}
yzHyK{BjqhTrjGfhp,MfhpjWrfS}
zAIzL{CkriUskHgiq,NgiqkXsgT}
ABJAM{DlsjVtlIhjr,OhjrlYthU}
BCKBN{EmtkWumJiks,PiksmZuiV}
CDLCO{FnulXvnKjlt,QjltnavjW}
DEMDP{GovmYwoLkmu,RkmuobwkX}
EFNEQ{HpwnZxpMlnv,SlnvpcxlY}
FGOFR{IqxoayqNmow,TmowqdymZ}
```

↓

TUcTf{WELCoMEbACK,hACKErMAn} ⇒　incorrect!!

tuCtF{welcOmeBack,HackeRmaN} ⇒　incorrect!!

↓

小文字は小文字のままrot13、大文字は大文字のままrot13する。

`TUCTF{WelcomeBack,Hackerman}`