7

The Sec.SE CTF team participated in ForbiddenBITS CTF 2013 as team secse.

6

Nazi War

We can submit a name and get an encrypted password. A little experimentation shows that the password is always the same for a given name, and the encrypted password consists of 13 characters, the first two of which are always fb. Furthermore only the first 8 characters of the file name are significant. This looks like a traditional Unix DES password hash.

After logging in, we can read some files but not flag which is reserved to “my fuhrer”. Furthermore, if we pick hitler as a username, we aren't told what the encrypted password is. So let's find the encrypted password for hitler.

Get the encrypted password for some usernames and plug them into a password cracker. I used John the Ripper and waited overnight.

cat >passwd <<EOF
a:fbc4G6VBoVf/A:1:1:A:/bin/sh
b:fbN6QGgUKaE2Q:2:2:B:/bin/sh
EOF
john passwd

The password of user a is ah4x0r and the password of user b is bh4x0r. So the password of user hitler must be hitlerh4x0r which encrypts to fboWsVzkSumM..

The flag is 99fa57bd69cdcfdd2e2fb6419e2994ca.

Invisible

real.html is a Whitespace program.

The following perl snippet looks for integer constants with at least 3 digits that are pushed on the stack and that are followed by an instruction that ends with a newline. While crude, this is enough to yield the solution.

<real.html perl -ne '
    chomp;
    s/^  // or next;
    length >= 3 or next;
    y/ \t/01/; s/^/0b/;
    print chr(oct($_))'

The output is wEsGlHaInJgKThe key is We_are_Nasus Cwrong, and the flag is We_are_Nasus.

A more precise examination shows that passing wslang as input to the program makes it output the flag. The first part of the output of the Perl script above is wslang interlaced with jump labels for the comparison code.

X95

http://forbiddenbits.net/tasks/x95.txt contains a Perl script.

The perl script prints a random integer between 0 and 19 and reads a password. The password is encrypted with the x0 function using the random integer as a key. The ciphertext is then transliterated and further munged.

The output of x0 is a string of hexadecimal digits. It is transliterated to a different set of digits:

0123456789abcdef
_`abcdefgh234567

In the end, we want $dd to match

^.........................78874.....87897.....98658..87896865978788648788........65859865898659687897.*$

perl -le 'print chr for 33..126' | xargs -n1 -d\\n ./encoder1 $str2auth |grep substituted | grep -E --color '78($|8)|( |7)88' finds matches only for str2auth = 7 or 8.

87897 must come from E878978
98658 must come from X8658598658598
87896 must come from D878968
-->

With $str2auth==8 and 2 transformed to 8 (requires the first character to be below 0x9f), the hex digits after x0 map to:

` 860
_ 859
a 861
b 868
c 863
d 864
e 865
f 878
g 873
h 874
2 88
3 89
4 96
5 97
6 98
7 99

So the encoded string must match

[........................]fh[.....]f5[.....9]e[8..]f4e5fdf[8.......]e_e3e4f5

One possibility is

ccccccccfhe2f5f_eaf4e5fdf2cce_e3e4f5

which we then translate back to the usual hex digits, xor with $str2auth, and to the string

DDDDyj}pb|muzD`kl}
||||AREHZDUMB|XSTE

We're almost there, but we can't have a lone X. Fortunately we can pick the character before the X. Before X doubling:

XXAREHZDUMBXSTE

Try it online a few times (there's a 1/20 chance that the script will draw 8 as the auth key each time), and soon enough:

$ print -l 8 XXArEHZDUMBXSTE | nc 192.73.237.148 3002
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 _    _  95   _________   ______   ______  _    _  _____  ______   ______ 
\ \  / /     | | | | | \ | |  | | | |     | |  | |  | |  | |  \ \ | |     
 >|--|<      | | | | | | | |__| | | |     | |--| |  | |  | |  | | | |---- 
/_/  \_\     |_| |_| |_| |_|  |_| |_|____ |_|  |_| _|_|_ |_|  |_| |_|____ 

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+




Password : 


FLAG{PERL_IS_COOL_FOR_SCRIPTING}

Fantasy

These are runes from Star Wars, specifically the Aurebesh script. They spell starwarsiscool.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .