Defcon 21 quals - blackbox write-up

It was DEFCON 21 quals last week-end, with new organizers. It went well, good organization and good challenges. If you're curious about the results, here is a fancy top15 graph. Apparently it was too easy for PPP who finished all of the challenges... insane! :)

There were 5 categories:

• 3dub: web-based challenges
• 0x41414141: exploitation
• \xff\xe4\xcc: shellcode
• OMGACM: guerilla programming
• gnireenigne: reverse engineering

I liked the exploitation ones with ARM under Linux/FreeBSD. Reverse was nice, shellcoding interesting but some painful, web was way too easy and OMGACM just annoying.
If you want to have a look, @JonathanSalwan saved some of the binaries on his repo.

Defcon 18 CTF quals writeup - Forensics 100

Forensics 100 was simple forensics but still with some traps.

Description: find the key, and they gave us the following file which revealed to be a gzipped raw disk image.

First analysis

After extracting, use the file command to recognize a raw disk image:

$ file f100_6db079ca91c4860f.bin
f100_6db079ca91c4860f.bin:    x86 boot sector; partition 1: ID=0x7, starthead 0,
  startsector 31, 31558 sectors

Defcon 18 CTF quals writeup - Packet 200

Packet Madness 200 was a simple TCP server speaking an uncommon language (at least now).

Description: These folks speak a different language. Join their site and translate the key for us.

We open this file in Wireshark, we see a TCP stream so first thing we do is right-click & "follow TCP stream" to see in a single window contents of the TCP stream.

Defcon 18 CTF quals writeup - Trivial 200

Trivial 200 was an evil blind VIM terminal you had to escape from.

Description: sheep@pwn21.ddtek.biz:6000 sheep go baaAaaA

One could simply SSH to the server with:

ssh -p 6000 sheep@pwn21.ddtek.biz # and use password baaAaaA

However, it appeared that the server was overloaded and most of the time SSH did not work. The solution is to connect to SSH continuously until it works with some shell scripting:

while true; do
  ssh -p6000 sheep@pwn21.ddtek.biz
done

Once connected, you get a black screen with nothing but rapidly discover you are in VIM text editor.

Defcon 18 CTF quals writeup - Packet 100

Packet 100 was just... horrible right? :) However some teams managed to get it, here is my writeup.

Description: sumthing is not like the other... Here are your packets.

We have a capture file of several ICMP echo-request/echo-reply pings. We can ignore echo-reply packets because they carry the same payload (it's a ping).
First, we focused on the only packet to have a 129 bytes payload instead of 256, but achieved nothing, so we focused on the other packets.
We tried so many things: frequency analysis, cesar, xors, consider only ascii, sum things, IP checksum, Ethernet mac, use first packet as a key or initialisation vector. But in fact it appeared to be what was explained in the description "sumthing is not like the other", only consider bytes that only reside in this packet and concatenate (sum) them.

Defcon 18 CTF quals writeups and scoreboard

This week-end was Defcon #18 CTF quals, I played with Nibbles and we managed to get #10! Congrats everyone, and thank you DDTEK, it was an awesome experience.

There are already many great writeups on the challenges available on the internet, if you want links check out my friend @Ivanlef0u he tweets them all. Update: all links are now also on defcon's CTF archive page.

In the following posts I'll give my own writeups, the challenges files being available here.

By the way, the scoreboard was a java applet connecting to DDTEK with some custom SSL. I was sad that no full scoreboard was made public by DDTEK, so at the beginning of the CTF - while waiting for new challenges to open - I decompiled the java applet, and modified it in order to get the scoreboard (only top15 available) regularily and archived all the different scoreboards over time. After extracting the scores, it allowed me to create a top15 graph using flot just like shallweplayaga.me did. The scoreboard archive is here if you want to make your own graphs or else.

CITCTF write-ups, Defcon

As previously mentioned, last week-end was CIT CTF. It was great, thank you! Again, I played with Nibbles and wow.. we managed arrive in 1st place! Nibbles plans to release a document with our write-ups (instead of multiple blog posts), but meanwhile you can find some of my notes in my citctf directory:

• Matryoshka: hundreds of nested passworded archives just like Russian nesting dolls. Questions were answered with google and automated extraction with some shell.
• What is her name: interesting steganography, with embedded files into a picture, and finally the password revealed by diff'ing two pictures. And no, her name was not Darya ;)
• Damned traffic: a weird tcpdump output with pictures, ICMP's, fragmented IP with UDP. I had fun playing with Python and my favourite network packet manipulation tool Scapy but did not find anything, nor any other team, and sadly staff did not release any hint.. I'm wondering if they plan to release the solution or if we will never find out what it was.
• Time bomb: a real time bomb in BASIC code along with the schematics, we had to find the exact time & location of explosion. We thought we had it, but sadly we failed :( I'm looking forward other write-ups to understand what it really was.

Update: very good writeups by @citizen_stig.

And as you probably know this week-end there is another competition: Defcon CTF Quals. First time for me, again playing with Nibbles, we will try to have fun and do our best! Good luck if you are a player too.

Codegate, HES2010, citctf

As you may know, I played Codegate CTF quals with Nibbles and we managed to be #11. As you can see, there was many good write-ups on the challenges. Despite being 11th, my friend SiD & I had the chance to go in Korea to play CTF finals and it was great: discovering Korea, playing CTF (managed to arrive 4th!), meeting other teams, conference speakers and other nice people. Also, networking session was awesome! I didn't have the time to see the conferences, but it reported to be very good as well.

Challenges by LM**2 were again interesting, excellent write-up from HFS (winners) for the encrypted shellcode (only team to solve it!). I should write-up on some challenges too if I have time. In the meantime I would love to see the challenges available on the net, maybe on intruded?

To conclude Codegate 2010 was amazing, well-organized by Softforum, great people and a lot of fun. You can find nice pictures of the whole event from yoggy0 and team PPP our CTF friends. I will definitely do my best to return next year if there is a Codegate 2011 :)

At the same time, Hackito Ergo Sum (HES) security conference was happening in France: impressive program and speakers (slides are available), they also organized a wargame with OverTheWire guys (reputed for their good online challenges), and recently even made it available among their other wargames (thank you, starting to play hehe!).

Among the next events are CIT CTF on May 15-16 (registration) from our Russian friends of Codegate, and obviously Defcon CTF quals on May 21-24 (registration). Good luck and have fun if you're a player too!