IT Tomsk - Web Studios

Несколько лет назад, я начал составлять список IT компаний Томска. В тот список я не добавлял студии, занимающиеся только разработкой сайтов, планируя составить их список позже. И вот, наконец, я собрал немного информации о веб-студиях Томска.
Со времени публикации первого списка, некоторые веб-студии, о которых мне уже было известно, изменили имя, некоторые закрылись, и, конечно, появились новые. В итоге в списке веб-студий получилось 17 компаний.
Возможно, позже, объединю первый список софтверных компаний и данный список веб-студий в один единый.  По мере поступления информации о компаниях обновляю данный список.
Последнее обновление 06.05.2013.

Web-studios based in Tomsk. Tomsk web-studios logos. Веб-студии Томска. 

Список представленных компаний

Altedit

http://www.altedit.ru

Avaj
http://avaj.ru

DealWeb

http://www.dealweb.ru

EDISON

http://edsd.biz

http://www.edsd.ru

Interweb Lab

http://iwlab.ru

ITScript

http://itscript.com

Nikolas Group
http://www.nikolas.ru

ONELAB

http://www.1lab.su

Online-media

http://online-media.ru

R70
http://r70.ru

USERSTORY – до 2012 года компания называлась «РосБизнесДизайн».
http://userstory.ru

Web-Format
http://web-format.net

Бобяков.ру

http://www.bobyakov.ru

Медиа-Ком

http://www.media.com.ru

Мягкий знак

http://softznak.ru

Самани

http://thesamany.com

Симэкс-Т

http://www.simex-t.ru

Студия 15

http://www.15web.ru

RuCTF 2013 Quals - Stegano 200 writeup

Strange shoplist

That sailor has a weird shoplist. I'd like to know what he's really gonna buy.

A binary file shoplist.bin is given.
After some inspection of file Progressor revealed that a binary representation of this file is looks like Morse code.
I've used the next script to convert binary to Morse code:

f = open('shoplist.bin', 'rb')
data = f.read()
f.close()
result = ''
for b in data:
    result += bin(ord(b))[2:].zfill(8)
print result.replace('1110','-').replace('10','.').replace('00', ' ')

Here is converted code:

-.- .--- ..- .-- --. --.. .. -.- .. .-. --.. --. ... --.. .-.. . . -... -... --. -.- -.-- .-.. --- --- -- ..-. ..-. --. ..--- -.. .--. --- .--- ..--- --. -.- ...-- - .--- -. --.. - --.- ..- - .-.. -... -- -. --.- -..- . ...-- ...-- --- -. . ..-. . --.- -.-- .-.. -. -- .--- ..--- -..- . --.. ...-- ..-. --- .. ..-. . ..--- -.-- .-.. ... -- ..... --.- -..- . ..--- .-.. --- -- ..- ..-. . -- ...-- -.. .--. --- ...- --.. .- ..- --.- - -... -- -. -..- .-- ....- .. -.-. ..-. -. --.. ... .... --. .. -... --. . -... .. --. ... --.. .-.. -.. -- ...- --.. --.- ..- --.- ...-- -... -. --.. -..- --. -.- --.. -... .- -.- -. ..--- --. -.- ..... ...-- ..-. -- --.- --.- ..-. .. ...-- ...-- -. -- ..-. ..--- --. -.... --.. .-.. - -... .--- .--- -..- -.- --.. ...-- -... --- .. ..-. . -.- --.. ...-- .... --- -- ..-. . -.... ...-- - .--- -. ..... -..- .... --. -.-. ... --.. -- ...- --.- -..- --. ..... .- -.- -.- --.. ... .-- --- --.. .-.. ..- -- ..-. .-. --. -.-- --.. .-.. - -... .--- -.. .-- -.-. ....- - -- -. ..-. .-. --.- ..- --.- - -... -. -. ..- .-- ....- --.. --.. .- -.- -... -..- -..- --- --.. -.. ..-. --- .. ..-. . --. ..--- -.. ..-. -- ...- --.. .-- -.- -.-. .. -.- -.- -... -..- -..- --- --.. -.. ..-. --- .--- ... .-- .. .. -.-. -. -. ..-. .-- --. .-- -.-. ... --.- -. ..... ..--- --. -.-. ..... -.. .--. -- ...- --.. --.- ..- .-. ...-- .--- -. --.. - .-- -.- ....- --.- -.- .. ..-. ... --. -.-. ....- -.. ..- -. ..-. ...-- --. -.- .. -.-. -.. -. ..... .-- .-- . -.-- .-.. ..- . -... .--- --. ... --.. - -- -- ..- ..-. . --.- ...-- ...-- ..- . -... .--- .-- -.-. ..... .-.. -.. -- ..- ..-. ..-. --. -.-- .-.. .... -- ..- ..-. . --. -.-- .-.. --.. -- ...- -..- --. ....- --.. .. .--- .--- ..... -..- --. ... ...-- ...-- --- . -... .. --. -.... ..... ...-- . -- ...- --.. .- ..- ...- -.. .. .--. ..-. .-- .-- -.- -.-. ... -.. --- ...- .-- .-- ... ...-- --.- -.- .. ..... --.- -..- . ...-- -.. .--- -- -- --.- ..-. .- ...-- ...-- -..- -- .-. ... -..- . -.-. ... --- --- ...- ..--- --. ..--- --.. .-.. .... -... .--- -... .-- --.- ..--- .-.. -- -. . --.- ..-. .- ...-- ...-- -..- -- .-. ... -..- . -.-. ... -.-. -. .-. --.- .-- --. ..--- --.. .- -.- -... ... -..- .- ....- -.. ..-. --- .. -...- -...- -...- -...- -...- -...-

After translation of the code we obtain the next text:

KJUWGZIKIRZGSZLEEBBGKYLOOMFFG2DPOJ2GK3TJNZTQUTLBMNQXE33ONEFEQYLNMJ2XEZ3FOIFE2YLSM5QXE2LOMUFEM3DPOVZAUQTBMNXW4ICFNZSHGIBGEBIGSZLDMVZQUQ3BNZXGKZBAKN2GK53FMQQFI33NMF2G6ZLTBJJXKZ3BOIFEKZ3HOMFE63TJN5XHGCSZMVQXG5AKKZSWOZLUMFRGYZLTBJDWC4TMNFRQUQTBNNUW4ZZAKBXXOZDFOIFEG2DFMVZWKCIKKBXXOZDFOJSWIICNNFWGWCSQN52GC5DPMVZQUR3JNZTWK4QKIFSGC4DUNF3GKICDN5WWEYLUEBJGSZTMMUFEQ33UEBJWC5LDMUFFGYLHMUFEGYLZMVXG4ZIJJ5XGS33OEBIG653EMVZAUVDIPFWWKCSDOVWWS3QKI5QXE3DJMMQFA33XMRSXECSOOV2G2ZLHBJBWQ2LMNEQFA33XMRSXECSCNRQWG2ZAKBSXA4DFOI======

This text is looks like some kind of BaseXX encoded string.
I've tried to decode it with Base32 and got the text. It's strange shopping list:
Rice
Dried Beans
Shortening
Macaroni
Hamburger
Margarine
Flour
Bacon Ends & Pieces
Canned Stewed Tomatoes
Sugar
Eggs
Onions
Yeast
Vegetables
Garlic
Baking Powder
Cheese
Powdered Milk
Potatoes
Ginger
Adaptive Combat Rifle
Hot Sauce
Sage
Cayenne Onion Powder
Thyme
Cumin
Garlic Powder
Nutmeg
Chili Powder
Black Pepper

The item Adaptive Combat Rifle from the list was a flag.

RuCTF 2013 Quals - Stegano 300 writeup

Strange song
Who is the author of this song?
We are given a file. By file's header we identified that it's midi song.

Also in the header we have found interesting letters sequence: pwriyuajqscet hkbfxmlvdogn.
The sequence consists of 26 chars and contains of letters of the english alphabet without the letter "z", and space char. Letters of this sequence are unique, and that let us suppose that it's some kind of alphabet.

After listening this strange midi song, and trying to recoginze it with music recognition programms, we decided to open it with midi editor.
I've used Audacity to import midi file. Here is how opened midi file looks like:

After looking at the sequence of notes, I've noticed that long and short notes are alternating, and follow one after another, never overlap other. It gave me the idea that this is a message consisting of the notes. So I've wrote out all the notes from song. Totally 88 notes in 3 octaves.

a#3 f4 c5 d#5 | e4 f4 d#5 a4 | f4 f#4 a#3 d4 | g4 g3 f5 e5 | f4 g3 c#4 f4 | e3 c5 a#3 g#3 | g3 f5 e5 f4 | f3 g3 e4 f#4 | f4 d#5 e4 f#4 | d#4 f#3 f4 e3 | d#4 d#5 e3 c5 | d#4 f4 g#3 d#5 | a3 f4 g4 f5 | d#5 f3 f4 e5 | d#4 e4 e4 g3 | f5 e5 f4 e4 | f#4 d#4 b4 f4 | e4 d#5 f4 d5 | d#5 f4 c#4 e4 | f#3 a#3 f5 e5 | d#4 f4 e4 f#4 | g3 f5 e5 c#4

In 3 octaves of piano keyboard the song notes are laid between e3 and f5. It's exactly 26 notes.
e3 f3 f#3 g3 g#3 a3 a#3 b3 c4 c#4 d4 d#4 e4 f4 f#4 g4 g#4 a4 a#4 b4 c5 c#5 d5 d#5 e5 f5

So by replacing piano notes with letters from found sequence, I got a message:
a lot of hacking is playing with other people you know getting them to do strange things 

It's Steve Wozniak's quote. So he is an author of this strange song.

Base91 CSharp version

To solve Misc 200 task from CodeGate CTF 2013, I've implemented C# version of Jochaim Henke's Base91.
Now it's available here http://base91csharp.codeplex.com

Redmine time script

I've finished and put a useful script on github. This script allows user to get spent time entries from Redmine. Is very convenient when you report the time spent on tasks.
On github presented console version, but using PyQt I've made simple GUI version.
Also I've extended my redmine-time script with information about total days in current month, days and working hours left. 

PoliCTF 2012 - GrabBag 200 writeup

Task: "Mmhhh that's a strange way to display a number using a binary representation...
(Submit as upper case hex encoded numbers, with rightmost green led being the MSB. Without leading 0x)
Attachment:4e6ea2210658985.tbz2.gpg (password: d2c29c95d6d7c4918596197aefa870f20f1b299c)"

The photos of breadboard with circuit prototype were inside encrypted archive.
challenge_1.jpg
challenge_2.jpg
Later one photo was given as a hint: gb200.jpg
After that, organizers gave one more hint with integrated circuit datasheet (in Russian!!!): chip.pdf
This task was downgraded to 180 points after this hint.
From this datasheet I've got that used IC is КМ155ИД1 (analogue of 74141) – BCD-to-Decimal decoder IC with high voltage transistor outputs.
Knowing the inputs and outputs pins, I've made truth tables (0=Low, 1=High).
Four inputs bits as binary are converted to one decimal output code.
Inputs pins are 3, 6, 7, 4 – A, B, C, D respectively.

IC1:
inputs:      output:
D C B A
4 7 6 3
0 0 0 0  =>  0

IC 2:
inputs:      output:
4 7 6 3
0 1 1 0  =>  6

IC 3:
inputs:      output:
4 7 6 3
1 0 0 1  =>  9

Output pins (0 on IC1, 6 on IC2, and 9 on IC3) are active with high level (1), and all other pins are off, i. e. with low level (0).
Here is the picture with traced inputs and outputs:

 

As said in the task, I've set the green leds as MSB and got binary representation:
11101100 11100000 00000001

By converting to hex without leading 0x we get a flag.
The flag: ECE001

HackYou CTF

Just now was finished HackYou CTF contest from LeetMore team.
The contest lasted for 10 days and held from October 8 to October 18, 2012. Organizers decided to make contest open for everyone, not only for ITMO first-year students.

When CTF was announced, and contest site was opened, I've laughed a lot (and not only me) of the footer banner on the site.
Guys it's really funny. Good job! :)

HackYou CTF was jeopardy-style individual competition with school-level tasks. But some tasks was really hard so solve. Challenges included 6 categories: ppc, stego, crypto, web, reverse and packets. Each category included 3 tasks for 100, 200 and 300 score points. So maximum score is 3600 points.
I've solved all 18 tasks and finished 39th overall.

The most interesting task in my opinion is web300. Most of the time it took to solve cry100 and cry300.
Nevertheless all the tasks are could be solved. It's only a matter of time.

In the end I want to say great thanks to organizers for a really interesting CTF. It was awesome!

P. S. Soon on the CTF site will be a list with the write-ups. Tasks will be available for solving at least for two weeks, to write own solutions. Some interesting game statistics is now available on site.