Hack.lu CTF - Challenge 19 "magicwall" writeup, double strcpy

I did not solve challenge 19 "magicwall" during the CTF - my friend Ivanlef0u (@Ivanlef0u) did - but since Fluxfingers (@fluxfingers) kept the CTF online, I had the chance to pwn it too! Just like challenge 20 "sscat", it was binary exploitation.

Hellman (@hellman1908) already made a very good writeup, I just wanted to share my different method.

Hack.lu CTF - Challenge 9 "bottle" writeup, extracting data from an iodine DNS tunnel

Challenge #9 entitled "bottle" was original and worth its 500 points. We were given the following network capture and instructed to find a message.

Opening the capture in Wireshark reveals a lot of DNS traffic (and 4 ARP requests): it definitely looks like a DNS tunnel.

Hack.lu CTF - sscat writeup

Last week was hack.lu 2010 security conference as well a high quality CTF organized by fluxfingers CTF team. Again I played with Nibbles and we ended 2nd as you can see on the final scoreboard and my usual graphs (made possible thanks to fluxfingers).

Challenge 20 was a very nice exploitation level. We were given an SSH with a setuid binary called sscat (standing for Serious Substition Cipher Analysis Tool) - with source. We had to exploit the program in order to read the flag file.

CSAW CTF - Forensics Write-up

The forensics challenge given at CSAW CTF weren't exactly what I was expecting, but still we achieved to solve most of it. Here are my write-ups for the 4 challenges.

Challenges were made by Efstratios Gavas (@xtrat), Director of cyber security labs at NYU Poly! Awesome :)

CSAW Exploit 3 Write-up - FreeBSD local root

For exploit3, we were given the following instructions:

Get Root. Get the key. If only I can jump over the mountain without being normal
ssh://128.238.66.100:40010
chal3:$+1zX*(
2048 51:41:94:32:cf:b1:3f:d9:74:c1:d2:08:aa:e3:49:2b /etc/ssh/ssh_host_rsa_key.pub (RSA)
1024 22:7f:72:93:93:7e:9a:3d:01:b9:58:ea:74:1a:c5:af /etc/ssh/ssh_host_dsa_key.pub (DSA)

Vulnerable FreeBSD kernel

We ssh and notice an old FreeBSD kernel. We can try to use @kingcope's freebsd sendfile cache local root. Sadly it does not work out of the box because we do not have /tmp writable: we have to customize a bit the shellcode to use a different one. Also, we can remove the 64-bit part since we are on 32-bit.

CSAW Exploit 1 Write-up - FreeBSD remote stack based buffer overflow

A few weeks ago was held Leet More CTF where Nibbles ended 1st! Didn't have the time to put some write-ups, but you can find some on nibbles blog or by sh4ka, auntitled and hellman.

Last week-end was held the well-known CSAW CTF (quals) by NYU-Poly. Last year and this year winners are none but our awesome friends PPP! We took 2nd place just behind them, see top15 graph.

They gave us interesting exploit challenges and I had the opportunity to look at exploit1: a remote stack based buffer overflow under FreeBSD 8.0.

smpCTF challenge #11 write-up, phplist 0day

Challenge #11 of smpCTF was interesting: we were given an URL to a phplist version 2.10.12 installation - with default admin/phplist administrator account - and instructed to find a 0day.

smpCTF challenge #2 write-up

Challenge #2 was similar to defcon trivial 200: you had to escape from a VIM editor, but this time it was not evil - you can see the screen.

We were given the following instructions:

ssh -l luser gordo.smpctf.com -p 2282 Password: smpctf
Help find waldo..

smpCTF challenge #1 write-up

smpCTF challenge #1 was a simple web + programming challenge.

We were given the following instructions:

Set S = 1
Set P = 1
Set previous answer = 1

answer = S * P + previous answer + R
R = 39

After this => S + 1 and P + 1 ('answer' becomes 'previous answer') + 39
then repeat this till you have S = 11065.

The final key will be the value of 'answer' when S = 11065.

Example:
So if R = 15..

17 = 1 * 1 + 1 + 15
36 = 2 * 2 + 17 + 15
60 = 3 * 3 + 36 + 15

Submit the correct answer and you will recieve a flag. Have fun ;D

smpCTF challenge #5 write-up - Forensic

smpCTF challenge #5 was forensics: we were given the file forensic1-image and instructed to find a flag.

As usual, we start our analysis with file command:

$ file forensic1-image
forensic1-image: rzip compressed data - version 2.1 (15185973 bytes)

smpCTF challenge #3 write-up

This week-end was smpCTF, again I played with Nibbles and we ended 1st!

Challenge #3 was just horrible, right? ;) Worse than defcon packet100! But we finally got it, after PPP.

We were given the following instructions and hints:

• Generate a file which has a SHA-1 hash of: 008ce55c7d1b602dc4c4c3ad52a5d064e6d1ef12
• Hint: DRM-0, Linux-1
• _DO NOT BRUTE FORCE_ it's not required...
• Hidden hint (HTML comment): t3=(*((unsigned int *)(key+2)))^(*((unsigned int *)(sec+0x56)));

Defcon 18 CTF quals writeup - Forensics 100

Forensics 100 was simple forensics but still with some traps.

Description: find the key, and they gave us the following file which revealed to be a gzipped raw disk image.

First analysis

After extracting, use the file command to recognize a raw disk image:

$ file f100_6db079ca91c4860f.bin
f100_6db079ca91c4860f.bin:    x86 boot sector; partition 1: ID=0x7, starthead 0,
  startsector 31, 31558 sectors

Defcon 18 CTF quals writeup - Packet 200

Packet Madness 200 was a simple TCP server speaking an uncommon language (at least now).

Description: These folks speak a different language. Join their site and translate the key for us.

We open this file in Wireshark, we see a TCP stream so first thing we do is right-click & "follow TCP stream" to see in a single window contents of the TCP stream.

Defcon 18 CTF quals writeup - Trivial 200

Trivial 200 was an evil blind VIM terminal you had to escape from.

Description: sheep@pwn21.ddtek.biz:6000 sheep go baaAaaA

One could simply SSH to the server with:

ssh -p 6000 sheep@pwn21.ddtek.biz # and use password baaAaaA

However, it appeared that the server was overloaded and most of the time SSH did not work. The solution is to connect to SSH continuously until it works with some shell scripting:

while true; do
  ssh -p6000 sheep@pwn21.ddtek.biz
done

Once connected, you get a black screen with nothing but rapidly discover you are in VIM text editor.

Defcon 18 CTF quals writeup - Packet 100

Packet 100 was just... horrible right? :) However some teams managed to get it, here is my writeup.

Description: sumthing is not like the other... Here are your packets.

We have a capture file of several ICMP echo-request/echo-reply pings. We can ignore echo-reply packets because they carry the same payload (it's a ping).
First, we focused on the only packet to have a 129 bytes payload instead of 256, but achieved nothing, so we focused on the other packets.
We tried so many things: frequency analysis, cesar, xors, consider only ascii, sum things, IP checksum, Ethernet mac, use first packet as a key or initialisation vector. But in fact it appeared to be what was explained in the description "sumthing is not like the other", only consider bytes that only reside in this packet and concatenate (sum) them.

Defcon 18 CTF quals writeups and scoreboard

This week-end was Defcon #18 CTF quals, I played with Nibbles and we managed to get #10! Congrats everyone, and thank you DDTEK, it was an awesome experience.

There are already many great writeups on the challenges available on the internet, if you want links check out my friend @Ivanlef0u he tweets them all. Update: all links are now also on defcon's CTF archive page.

In the following posts I'll give my own writeups, the challenges files being available here.

By the way, the scoreboard was a java applet connecting to DDTEK with some custom SSL. I was sad that no full scoreboard was made public by DDTEK, so at the beginning of the CTF - while waiting for new challenges to open - I decompiled the java applet, and modified it in order to get the scoreboard (only top15 available) regularily and archived all the different scoreboards over time. After extracting the scores, it allowed me to create a top15 graph using flot just like shallweplayaga.me did. The scoreboard archive is here if you want to make your own graphs or else.

CITCTF write-ups, Defcon

As previously mentioned, last week-end was CIT CTF. It was great, thank you! Again, I played with Nibbles and wow.. we managed arrive in 1st place! Nibbles plans to release a document with our write-ups (instead of multiple blog posts), but meanwhile you can find some of my notes in my citctf directory:

• Matryoshka: hundreds of nested passworded archives just like Russian nesting dolls. Questions were answered with google and automated extraction with some shell.
• What is her name: interesting steganography, with embedded files into a picture, and finally the password revealed by diff'ing two pictures. And no, her name was not Darya ;)
• Damned traffic: a weird tcpdump output with pictures, ICMP's, fragmented IP with UDP. I had fun playing with Python and my favourite network packet manipulation tool Scapy but did not find anything, nor any other team, and sadly staff did not release any hint.. I'm wondering if they plan to release the solution or if we will never find out what it was.
• Time bomb: a real time bomb in BASIC code along with the schematics, we had to find the exact time & location of explosion. We thought we had it, but sadly we failed :( I'm looking forward other write-ups to understand what it really was.

Update: very good writeups by @citizen_stig.

And as you probably know this week-end there is another competition: Defcon CTF Quals. First time for me, again playing with Nibbles, we will try to have fun and do our best! Good luck if you are a player too.

Codegate, HES2010, citctf

As you may know, I played Codegate CTF quals with Nibbles and we managed to be #11. As you can see, there was many good write-ups on the challenges. Despite being 11th, my friend SiD & I had the chance to go in Korea to play CTF finals and it was great: discovering Korea, playing CTF (managed to arrive 4th!), meeting other teams, conference speakers and other nice people. Also, networking session was awesome! I didn't have the time to see the conferences, but it reported to be very good as well.

Challenges by LM**2 were again interesting, excellent write-up from HFS (winners) for the encrypted shellcode (only team to solve it!). I should write-up on some challenges too if I have time. In the meantime I would love to see the challenges available on the net, maybe on intruded?

To conclude Codegate 2010 was amazing, well-organized by Softforum, great people and a lot of fun. You can find nice pictures of the whole event from yoggy0 and team PPP our CTF friends. I will definitely do my best to return next year if there is a Codegate 2011 :)

At the same time, Hackito Ergo Sum (HES) security conference was happening in France: impressive program and speakers (slides are available), they also organized a wargame with OverTheWire guys (reputed for their good online challenges), and recently even made it available among their other wargames (thank you, starting to play hehe!).

Among the next events are CIT CTF on May 15-16 (registration) from our Russian friends of Codegate, and obviously Defcon CTF quals on May 21-24 (registration). Good luck and have fun if you're a player too!