Skip to content Skip to navigation

The Card (recon 500)

Category: 

In this task we need to find Olimpiada Balalaykina's bad ass friend credit card number.

We found a man with login bad_ass_guy@quals2014.ructf.org in Olimpiada's Gmail contacts list. We discovered his twitter account https://twitter.com/badassguy_2014 with a single tweet in it where he published link to Yandex.Disk  yadi.sk/d/hyGxtX4tK9wWM. We saw a photo with his credit card after following a link:

We can get four last digits of card number 7200. But where get first twelve assuming that card number length is sixteen?

Easy to see that magnetic track was stripped and covered with something like ink so we can read track.

We had read available binary track and converted it to characters. Note: this track contain 7-bit alphanumeric characters and we should read from right to left (big-endian).

1010001:	%
0100011:	B
0010101:	4
1000101:	1
1110101:	7
0100101:	2
1010100:	5
0000100:	0
1001100:	9
0000100:	0
1100100:	3
0000100:	0
1110101:	7

Thanks to Wiki we had known that we on the right way. % - start sentinel, B - format code, up to next 19 characters - primary account number (PAN) usually matches the credit card number.

Finally we've got card number 41725090307X7200. There are ten options (0 <= X <= 9). We solved task after some bruteforce with flag 4172509030767200.

jordan release date | Altra Timp 3 Review , Best Trail Running Shoes 2021