← Back to Writeups
CUSTOMMediumMisc
Bookmark

Ангара-2

XESXOR9/2/20263 min read
#misc#custom#medium#rgb_lsb_extraction#zip_dictionary_attack#google_docs_exfiltration#keyboard_layout_mapping#linux

Ангара-2

Platform: bug-makers | Category: Misc | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-05-28 | Status: Solved Techniques: rgb_lsb_extraction, zip_dictionary_attack, google_docs_exfiltration, keyboard_layout_mapping

Summary

Task: after logging into BugOS (part 1), find rocket launch codes through a multi-step chain: image stego, ZIP cracking, and document analysis. Solution: extract LSB message from PNG revealing rockyou.txt hint, crack ZIP password (l0v3), follow Google Doc link to find launch code.

Ангара-2 — Bug Makers

Description

Перед решением этой задачи, нужно решить первую часть «Ангара-1: Вход в ОС». Отлично, мы в системе! Теперь необходимо найти коды запуска ракеты. Флаг для сдачи: BugCTF{код_запуска}

English summary: This is part 2 of a three-part rocket launch challenge. After logging into BugOS in part 1, we need to find the rocket launch codes. The flag format is BugCTF{launch_code}.

Analysis

Prerequisites (Part 1)

The login page at http://31.207.77.216:4016/ requires a password obtained from part 1 (Ангара-1). The file /assets/remind-password.txt contains English text typed on a Russian keyboard layout. Decoding reveals: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

  • Login password: c836468d539e5692ff5c5a7f65f7d2ee

Login via POST to /login with JSON body {"password":"c836468d539e5692ff5c5a7f65f7d2ee"} sets a session cookie.

Dashboard Exploration

After authentication, /dashboard presents a desktop-like BugOS interface with three items:

  1. "Девчонки" (Girls) — image viewer showing /assets/sochi-2020.png (1024×665, RGBA PNG)
  2. "Программа запуска" (Launch Program) — form requiring launch code, coordinates, trajectory, payload, and launch time (submits to /api/launch)
  3. "Документация по запуску" (Launch Documentation) — downloads /assets/doc.zip (password-protected) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The attack chain becomes clear: the image likely hides a clue for the ZIP, and the ZIP contains information needed for the launch code.

Solution

Step 1: Extract LSB Message from PNG

The image sochi-2020.png contains a hidden message in RGB LSB steganography. Extracting the least significant bit from R, G, B channels sequentially (row by row, pixel by pixel) reveals ASCII text:

 python 
#!/usr/bin/env python3
from PIL import Image
import numpy as np

img = Image.open('sochi-2020.png')
pixels = np.array(img)
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

bits = []
for y in range(pixels.shape[0]):
    for x in range(pixels.shape[1]):
        for ch in [0, 1, 2]:  # R, G, B channels only
            bits.append(pixels[y, x, ch] & 1)

byte_data = bytearray()
for i in range(0, len(bits), 8):
    byte = 0
    for j in range(8):
        byte = (byte << 1) | bits[i + j]
    byte_data.append(byte)
    if byte == 0:  # null terminator
        break

print(byte_data.decode('ascii', errors='replace'))

Output:

The password to the archive is in the rockyou.txt database

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Crack ZIP Password with rockyou.txt

The file doc.zip is password-protected and contains link.txt (215 bytes). Using the LSB hint, we crack it with the rockyou.txt wordlist:

 python 
#!/usr/bin/env python3
import zipfile

zf = zipfile.ZipFile('doc.zip')
with open('rockyou.txt', 'r', errors='ignore') as f:
    for line in f:
        pw = line.strip()
        try:
            zf.extractall(pwd=pw.encode())
            print(f"Password found: {pw}")
            break
        except:
            continue

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Password found: l0v3 (approximately 800,000 entries into rockyou.txt).

Alternative with fcrackzip:

 bash 
fcrackzip -u -D -p rockyou.txt doc.zip

Step 3: Follow the Google Doc Link

The extracted link.txt contains:

Ссылка на документацию по запуску. 
Коды запуска внутри документа.

https://docs.google.com/document/d/1pqje5AHwIIFlL_zY0Cj6qks7cA-RJLEPIdpPtucRYNs/edit?tab=t.0

Translation: "Link to launch documentation. Launch codes are inside the document."

Step 4: Extract Launch Code from Document

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The Google Doc is titled "ДОКУМЕНТ МПК-А5.471-РЭ" — an official-looking rocket launch procedure document for the Angara-A5 rocket. It contains detailed sections on pre-launch checks, fuel loading, trajectory calculations, etc.

In section 3.3 ("Т-2 минуты: Получение кодов запуска" / "T-2 minutes: Obtaining launch codes"), the document states:

ВАЖНО: Запуск невозможен без получения и ввода корректного кода запуска. Код являются одноразовыми и действительны только для текущего пускового окна. Код запуска: REDACTED ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Translation: "IMPORTANT: Launch is impossible without obtaining and entering the correct launch code. The code is one-time and valid only for the current launch window. Launch code: REDACTED" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍