CSAW CTF 2013 - Misc200

deeeeeeaaaaaadbeeeeeeeeeef - 200 Points
IMG_0707.png

Running pngcheck against the .png gives us the following output:

Fixing the crc value gives us this image:

Hours later, hint for this challenge was given. It was the same image but with different resolution.

Changing the resolution in the IHDR header to the resolution of the hint gives us the flag:

Flag: TheISISPasswordIs

CSAW CTF 2013 - Misc100

Black & White - 100 Points
chal.png

This is a steganography challenge. We were given a blank image and we had to squeeze the flag out of it (heh).

Anyway, just load the image in StegSolve and click till you get the flag:

Flag: forensics_is_fun

CSAW CTF 2013 - Misc50 (Networking 2)

Networking 2 - 50 Points
networking.pcap
networking.pcap.process

Another PCAP challenge. Nothing interesting in the packet capture, let's run file on networking.pcap.process:

$ file networking.pcap.process
networking.pcap.process: AIX core file 32-bit, c05be5e08ea163007af5144}.exe- 64-bit, *

Hmm.. okay. Let's run strings on it:

$ strings networking.pcap.process | less 
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe^L
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
flag{f9b43c9e9c05be5e08ea163007af5144}.exe
...
...

Easy, isn't it?

Flag: f9b43c9e9c05be5e08ea163007af5144

CSAW CTF 2013 - Misc50 (Networking 1)

Networking 1 - 50 Points
networking.pcap

Forensic! Just run strings on the PCAP file:

$ strings networking.pcap | less

[snip]
...
flag{d316759c281bf925d600be698a4973d5}
...
[/snip]

Flag: d316759c281bf925d600be698a4973d5

iHack2013 Forensic Challenge #11 WriteUp - Lets Cool Your Mind with Cartoon First :D

In this challenge, we are given this clue and a file.

Running file on the file given tells us this is a video file.

Some weird noise that resembles morse code is noticeable at 02:48 mark. We rip the audio out from the ASF file and load it in Audacity, and we see something in the audio stream.

Snip the part that we want and this is what we get:

Morse code! Decoding it gives this:

SKUCSKUCACGTZYLRGMUDXUREVUREXUREXUREVUREOFZKNLRGM

Based on the clue, we guess it's encoded with Caesarian cipher (ROT13, "the 13th time"), with 6 alphabet shifts (6am).

Decoded:

MEOWMEOWUWANTSFLAGOXROLYPOLYROLYROLYPOLYIZTEHFLAG

Flag: ROLYPOLYROLYROLYPOLY

Wargames.my July 2011

 Well, I was supposed to have this posted in July, but I was slacking most of the time.

From the official website: "WarGames.MY is Malaysia’s first ever online CTF, by Malaysians, for Malaysians. It’s basically a 24 hours hack game featuring 18 challenges scattered across 6 categories. We do know that there are CTFs and other security games in Malaysia but they all require the team/person to be physically there. So figured what the heck, let’s do an online CTF."

So yeah, it was (and still is) Malaysia's first online CTF. Even cooler, this CTF was supported by Hack In The Box and HackerspaceKL. Prizes for the winner were RM2000 cash prize + Seeduino starter kit + HITB training and conference passes.

There were several categories of challenges in wargames.my, ranging from the usual binary reversing, vulnerability hunting, cryptography, web challenges, forensic, to network challenges.

Also, wargames.my was the first collaboration ever between HITB.MY CTF crews 2.0 and crew 3.0. Anyway, here is the result (been long overdue!):

Place	Player	Score
1st	kuehtiow	1350
2nd	p03p0wn	1300
3rd	pukkimacs	1200

Nomz for the crews.

Graph and scoreboard.

Forensic stuff

Cheat sheets
http://acme-labs.org.uk/galleries/47/0000/2345/forensic_cheatsheet.pdf

Digital Forensic War Game
http://real-forensic.com

Forensics workstation
http://computer-forensics.sans.org/community/downloads

HD Forensics
http://osforensics.com/tools/create-disk-images.html

Memory analysis
https://www.volatilesystems.com/default/volatility
http://mnin.blogspot.com/2011/06/examining-stuxnets-footprint-in-memory.html

Packet analysis
http://security.crudtastic.com/

sources:
http://windowsir.blogspot.com/
https://www.volatilesystems.com/default/volatility
http://centralops.net/co/
http://all.net/

timeline creation from images
http://computer-forensics.sans.org/blog/2009/02/24/digital-forensic-sifting-registry-and-filesystem-timeline-creation/
https://5thsentinel.wordpress.com/2009/06/07/sans-sift-using-regtime-pl/
http://www.sleuthkit.org/sleuthkit/man/mactime.html

Windows analysis
https://bitbucket.org/Elie/owade/wiki/Home