CTF and shitz: ctf

Showing posts with label ctf. Show all posts

Wednesday, September 25, 2013

CSAW CTF 2013 - Misc200

deeeeeeaaaaaadbeeeeeeeeeef - 200 Points
IMG_0707.png

Running pngcheck against the .png gives us the following output:

Fixing the crc value gives us this image:

Hours later, hint for this challenge was given. It was the same image but with different resolution.

Changing the resolution in the IHDR header to the resolution of the hint gives us the flag:

Flag: TheISISPasswordIs

Black & White - 100 Points
chal.png

This is a steganography challenge. We were given a blank image and we had to squeeze the flag out of it (heh).

Anyway, just load the image in StegSolve and click till you get the flag:

Flag: forensics_is_fun

CSAW CTF 2013 - Misc50 (Networking 2)

Networking 2 - 50 Points
networking.pcap
networking.pcap.process

Another PCAP challenge. Nothing interesting in the packet capture, let's run file on networking.pcap.process:

$ file networking.pcap.process
networking.pcap.process: AIX core file 32-bit, c05be5e08ea163007af5144}.exe- 64-bit, *

Hmm.. okay. Let's run strings on it:

$ strings networking.pcap.process | less
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe^L
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
...
...

Easy, isn't it?

Flag: f9b43c9e9c05be5e08ea163007af5144

CSAW CTF 2013 - Misc50 (Networking 1)

Networking 1 - 50 Points
networking.pcap

Forensic! Just run strings on the PCAP file:

$ strings networking.pcap | less

[snip]
...
flag{d316759c281bf925d600be698a4973d5}
...
[/snip]

Flag: d316759c281bf925d600be698a4973d5

CSAW CTF 2013 - Exploitation100

Exploitation 1 - 100 Points
exploit1
exploit1.c

We were give an elf32 executable and its code snippet of its handle() function in this challenge:

Our objective is to change the backdoor value to 1, so that the key to this challenge will be read and sent back to us.

buffer[] array is defined to have size of 1016. However in recv(), it is shown that 1020-byte of data will be copied into buffer[], classic case of buffer overflow. So we did what came naturally:

$ python -c "print 'A'*1020" | nc 128.238.66.212 31337

Voila!

Tuesday, September 24, 2013

CSAW CTF 2013 - Reversing200 (CSAW Reversing 2013 2)

CSAW Reversing 2013 2 - 200 Points

csaw2013reversing2.exe

Yet another win32 executable. Let's run it, annnnd it's crashed :/
Load it in olly, you should see:

A decryption loop!

Right after the decryption loop where the flag will be shown in a message box, the flag text is actually stored in ESI, so let's dump the value of ESI while we are in the decryption loop:

Flag: number2isalittlebitharder:p

CSAW CTF 2013 - Reversing100 (CSAW Reversing 2013 1)

CSAW Reversing 2013 1 - 100 Points

csaw2013reversing1.exe

We were given a win32 executable in this challenge, let's run it:

Oops... Let's load it in a debugger

So, there is this call to IsDebuggerPresent that causes the display of junk instead of the flag.

Flag: this1isprettyeasy:)

CSAW CTF 2013 - Reversing100 (DotNet)

DotNet - 100 Points

DotNetReversing.exe

DotNet is a .Net executables. Let's decompile the executable:

To solve this challenge, one must get the correct value of num in order to get the value of num3=6553563335L. XOR, as we know it, is reversible, so:

num ^ num2 = num3

We can get the value of num by performing:

num = num3 ^ num2

num = 13371337255

Now we run the executable with 13371337255 as the argument:

Flag: I'll create a GUI interface using visual basic...see if I can track an IP address.

Monday, September 23, 2013

CSAW CTF 2013 - Web100

Guess Harder - 100 Points

http://128.238.66.215

The url gave us a login page. The objective of this challenge was to login as admin. By using Burp proxy (or any cookie editor), something interesting showed up:

This challenge can be solved by setting the admin cookie to true, as shown above. And... voila!

Flag: told_ya_you_wouldnt_guess_it

CSAW CTF 2013 - Recon

There were 8 recon challenges. 6 of them were solved with the exception of Alexander Taylor (fuzyll) and Jordan Wiens (psifertex). Most of recon challenges were solved with the assistance of Tommy. Each challenge in this category worths 100 points.

Julian Cohen

> Google his handle (HockeyInJune)
> Click on Wikipedia user page

> Visit his "new website", there was nothing except picture of a washing machine with big mouth
> Run 'dig' on the url, and get the IP address.

>] Voila!

Flag: 1a8024a820bdc7b31b79a2d3a9ae7c02

Kevin Chung

> Hint given was "What places can you graduate from?"
> Start with his high school, Staten Island Technical High School
> First few Google results were about CSAW High School Forensics previous winners
> Clicking on Kevin's name brings us to key.txt

Flag: who_in_the_world_is_kevin_chung

historypeats

> Google "historypeats" gives multiple results, including a github profile
> It is shown that the most recent activity of historypeats was removing comments from historypeats/putscan
> Removed comment was actually the flag

Flag: whatDidtheF0xSay?

CSAW CTF 2013 - Trivia

There were 5 trivia questions, each flag gives 50 points:

#1 - Drink all the booze, ____ all the things!

Flag: hack

#2 - What is the abbreviation of the research published in the Hackin9 issue on nmap by Jon Oberheide, Nico Waisman, Matthieu Suiche, Chris Valasek, Yarochkin Fyodor, the Grugq, Jonathan Brossard, and Mark Dowd?

Flag: DICKS

#3 - What is the common name for a single grouping of instructions used in a Return Oriented Programming payload, typically ending in a return (ret) instruction?

Flag: gadget

#4 - What is the new web technology that provides a web browser full-duplex communication to a web server over a single connection?

Flag: websocket

#5 - What is the x86 processor operating mode for running 64-bit code?

Flag: long mode

Saturday, April 20, 2013

iHack2013 Forensic Challenge #11 WriteUp - Lets Cool Your Mind with Cartoon First :D

In this challenge, we are given this clue and a file.

Running file on the file given tells us this is a video file.

Some weird noise that resembles morse code is noticeable at 02:48 mark. We rip the audio out from the ASF file and load it in Audacity, and we see something in the audio stream.

Snip the part that we want and this is what we get:

Morse code! Decoding it gives this:

SKUCSKUCACGTZYLRGMUDXUREVUREXUREXUREVUREOFZKNLRGM

Based on the clue, we guess it's encoded with Caesarian cipher (ROT13, "the 13th time"), with 6 alphabet shifts (6am).

Decoded:

MEOWMEOWUWANTSFLAGOXROLYPOLYROLYROLYPOLYIZTEHFLAG

Flag: ROLYPOLYROLYROLYPOLY

Tuesday, October 2, 2012

CSAW 2012 Writeup - Forensic 500

Strange enough, this is easier than the other forensics challenges. Just run strings against the file given:

Key: this_should_be_pretty_hard_unless_you_use_grep

CSAW 2012 Writeup - Networking 100

Open the pcap file in wireshark -> Follow TCP stream -> the key is the telnet login password.

Key: welcome to 1969

Monday, October 1, 2012

CSAW 2012 Writeup - Reversing 200

Run the binary to see if there are any messages:

This is a .net binary, so we load it up in a .net decompiler.
Here are the encrypted key bytes:

Found the decryption routine upon further inspection:

Wrote a shell script to xor each byte with 255, decrypted message is The key is 9c09f8416a2206221e50b98e346047b7

Key: 9c09f8416a2206221e50b98e346047b7

CSAW 2012 Writeup - Reversing 100

Run the binary, and see the output:

So what we want to do is to obtain the decrypted key. Load the binary in a debugger:

From the debugger, it is shown that the program exits prematurely before it shows the decrypted key. That's easy, just put a breakpoint at the call to exit() at 0x401106, patch it with nops, and voila!

Key: welcome_to_csaw!

Another way is to load the binary in a disassembler:

Key bytes are being loaded into the buffer.

The decryption routine:

Xor the key bytes with 0xff, and we get welcome_to_csaw!

CSAW 2012 Writeup - Trivia Challenges

There were five challenges in the Trivia category, each weighs 100 points:

1) What is the first step of owning a target?
2) What is the name of the Google’s dynamic malware analysis tool for Android applications?
3) What is the x86 opcode for and al, 0×24? Put your answer in the form 0xFFFF.
4) Who was the first security researcher to publish the DEP bypass that utilized WriteProcessMemory()?
5) What is the name of Microsoft’s sophisticated distributed fuzzing system that utilizes automated debugging, taint analysis, model building, and constaint solving?

1) What is the first step of owning a target?
Key: recon

2) What is the name of the Google’s dynamic malware analysis tool for Android applications?
Refer: http://siliconangle.com/blog/2012/07/23/google-bouncer-researchers-fingerprint-androids-anti-malware-tool/
Key: bouncer

3) What is the x86 opcode for and al, 0×24? Put your answer in the form 0xFFFF.
I used msf's nasm_shell.rb to get the opcode.
Key: 0x2424

4) Who was the first security researcher to publish the DEP bypass that utilized WriteProcessMemory()?
Refer: http://seclists.org/fulldisclosure/2010/Mar/att-553/Windows-DEP-WPM.txt
Key: Spencer Pratt

5) What is the name of Microsoft’s sophisticated distributed fuzzing system that utilizes automated debugging, taint analysis, model building, and constaint solving?
Refer: http://research.microsoft.com/en-us/projects/atg/ndss2008.pdf
Key: SAGE

Tuesday, November 15, 2011

Wargames.my July 2011

Well, I was supposed to have this posted in July, but I was ~~slacking~~ most of the time.

From the official website: "WarGames.MY is Malaysia’s first ever online CTF, by Malaysians, for Malaysians. It’s basically a 24 hours hack game featuring 18 challenges scattered across 6 categories. We do know that there are CTFs and other security games in Malaysia but they all require the team/person to be physically there. So figured what the heck, let’s do an online CTF."

So yeah, it was (and still is) Malaysia's first online CTF. Even cooler, this CTF was supported by Hack In The Box and HackerspaceKL. Prizes for the winner were RM2000 cash prize + Seeduino starter kit + HITB training and conference passes.

There were several categories of challenges in wargames.my, ranging from the usual binary reversing, vulnerability hunting, cryptography, web challenges, forensic, to network challenges.

Also, wargames.my was the first collaboration ever between HITB.MY CTF crews 2.0 and crew 3.0. Anyway, here is the result (been long overdue!):