You are surrounded by zombies on all sides. Blood and flesh that drip from their mouths. You run for cover in an abandoned building. As you huddle in terror under a delapitated desk your foot brushes against a small package. What could be inside???
$ cat data.ext | base64 -di | xxd -r -p He walked out in the gray light and stood and he saw for a brief moment the absolute truth of the world. The cold relentless circling of the intestate earth. Darkness implacable. The blind dogs of the sun in their running. The crushing black vacuum of the universe. And somewhere two hunted animals trembling like ground-foxes in their cover. Borrowed time and borrowed world and borrowed eyes with which to sorrow it.
Now we get a quote, let's paste it in a search engine, that come from The Road.
You need to buy some things, and luckily the local merchant accepts Bitcoin! You found out he only checks that the first four characters of his address and the one you send the coins to. Can you make him think you are sending him the coins while they really go to yourself?
$ nc pwn.sunshinectf.org 40003 The local vendor is warry to accept anynthing but bitcoin, but he only checks the first four characters of each address. Can you make him think you are sending him the coins while they really go to yourself?
Hey there! Here's my Bitcoin address: 1kXeFFwxJcyVbHVUkJ59ykfax4F4P4NoZb
Enter your private key(in hex, uncompressed): fc3009f6a11328a4ece34ee4209c712f7f14a81fd0ce4d0b0e8dbb9f40d9d7d9
That key came out to: 1kXer5xriQaRBWPZWLUyQuhy7WFMbiQAi
Glad the payment went through, here are your goods. You only have 4 purchases left! Hey there! Here's my Bitcoin address: 1tM15GpBJbAc8uc2MPz2qsnSMBs1k2VA7H
Enter your private key(in hex, uncompressed): cb14680d253636f95dd68e7cab26773ffb8ceba4e2aa1848668cee1dd044706b
That key came out to: 1tM1BtrZ26tzDjWyXGgyUHPT1b5WJCqz3
Glad the payment went through, here are your goods. You only have 3 purchases left! Hey there! Here's my Bitcoin address: 1RMogK6nrk7LLkFGBBdcRjvozC1rs9GDSp
Enter your private key(in hex, uncompressed): 92ac39806ed9b333004a405042b0598a6bdedfed5e5e262e737b70f66921729e
That key came out to: 1RMo33Retq4GrcebJKEChHLQZZFCpR22q
Glad the payment went through, here are your goods. You only have 2 purchases left! Hey there! Here's my Bitcoin address: 1EdVCpLJ1aSQqoKzWy5T4LTMmKuqbtzoyF
Enter your private key(in hex, uncompressed): 1821075f9b31112a5543703a7a2b7bbdc0553265ce302b3daafd3e77f0d0282f
That key came out to: 1EdVGodXWjtPn4JsvqEDocZq4d3B4Qv2pL
Glad the payment went through, here are your goods. You only have 1 purchases left! Hey there! Here's my Bitcoin address: 1xRWfB5a9S5q74fE2w7QtS4GhghBtLeP7j
Enter your private key(in hex, uncompressed): 6fa7d622cd209657c1d858c546d4aa31d525a9167e33e7bbbc38944ba0cee71e
That key came out to: 1xRWUawaT6KsjaSzgxUyEnFTByqpdLm5C
Thanks for all of your payments, here's your flag: sun{a1waY5_ch3k__th0se_bits}
To generate a private key matching a 4 case-sensitive pattern is used vanitygen:
But output of the private key is WIF encoded in base58 and we need a hexadecimal encoding of the uncompressed private key, so I used bitcoin-tool to convert it: