# Trend Micro CTF 2017, 24 June 4 AM UTC - 25 June 4 AM UTC

Are you ready for another crazy CTF with sec.se team?

We will participate in the Trend Micro CTF.

Challenge categories are: Analysis-Offensive, Analysis-Defensive, Forensic, Reversing, IoT/OSINT/SCADA, Misc

We will communicate through Slack. To get an invitation, please send me an e-mail (you can find my address on my profile) with your security.stackexchange name. Once you're on the Slack, you will find instructions to register and join the team.

### Challenge description

Today you received an email that seemed to be from an online shopping site that you use - but when you followed the link something definitely did not seem right. It appears that the world's worst phisher must have set up the page - and has targeted you with a phishing attack!

The email text said you needed to visit a link to update the security of your acccount. However the link actually lead to the site ctf.superpopularonlineshop.com.definitelynotaphishingsite.com

For this challenge you must find the "Real Person" who is behind this attack - leveraging your Open Source Intelligence (OSINT) skills.

The Flag will be found on one of their social profile pages

### Write up

Visiting the website I couldn't find anything useful so I decided to use a dns look up service: https://whois.icann.org/en/lookup?name=superpopularonlineshop.com.definitelynotaphishingsite.com

Googling the phone number led me to some random profiles. After googling the email address I got a limited amount of results:

I opened the pastebin link and the first line was interesting:

Domain Name: T3M4.COM
Registry Domain ID: 2112838557_DOMAIN_COM-VRSN

Visiting http://t3m4.com I got redirected to https://t3m4haxor.wordpress.com/. It had one blogpost:

I knew I was on the right track. Then I tried to google his handle name "t3m4haxor". Visited a few websites until I realized that one of the sites included a name:

Googling the name I stumbled upon a Linkedin profile:

Under projects it's mentioned Proud to have helped with the Trend Micro CTF 2017 - especially Secret Challenge "13" -> GZPGS{SGE0FVAG101}. I was a bit confused since this challenge was number 17 then I realized it was actually referring to "rot13": TMCTF{FTR0SINT101}.

TLDR; a lot of googling and occasionally clicking on random profiles.

• Great write-up, thanks ! – Xavier59 Jun 25 '17 at 14:00

# Reversing 100

We were provided with a file called pocket. Using the file pocket command I found out it was a zip file. Extracting it I got a file a rar file called biscuit. Extracting it I got two files: biscuit1 (a windows executable) and biscuit2 (a password protected zip file). I guessed that we had to reverse biscuit1 to get the password. After analyzing it with radare2, there was a hint in the beginning of the program: Please find sweets name starting from m for biscuit2. and then asking for input. Instead of reversing the binary further I just searched for "cookies" and was surprised that wikipedia actually had a handy list of cookies!

Tried to extract biscuit2 with macaron as password and got 3 files: biscuit3, biscuit4 and biscuit5:

So I analysed the three files and knew I was on the right track with the hint given in biscuit4:

So the flag is a combination of biscuit3 and biscuit5. Before analyzing biscuit3 I thought let's do a Google reverse image look up but nothing interesting was brought up. I thought maybe there's some steganography involved. I tried foremost to scan for hidden files in the jpeg image. foremost is a handy tool that looks for certain magic bytes to recover files. I found a zip file with a text file inside contain part of the flag creme:

One file to go! biscuit5 is a windows executable so I opened it with radare2 a reverse engineering framework. It's CLI based but once you get the hang of the basics it's quite cool! So first we open the file with r2 biscuit5. Then we need to analyse the binary with aaa. After that we can list all functions with afl. I grepped for the main function using the tilde notation afl~main. Then we need to "seek" to that address using s 0x0040150b or s sym._main. You might wonder "why two mains?", well same here but I analysed the other main and there was nothing interesting.

So I moved on and used VV to enter Visual Graph Mode, used p afterwards to show the addresses of each instruction. So we have a few local variables:

Some values where assigned to those variables:

Then there was some magic happening with a loop, I guessed that must be the decryption phase:

Since the program didn't ask for input and the main function didn't seem to get suspicious values elsewhere I thought that the detected values in the beginning is probably the encrypted message and the loop is there to decrypt it. When it's done, it will branch to the right block and exit/return properly. So I thought let's use a debugger instead of manually trying to decrypt the message. I noted the address of the epilogue and set a breakpoint accordingly in the x32dbg debugger. Then it was just a matter of running it!

The other part of the flag was visible in the edx register. With the hint from biscuit4 I constructed the flag: TMCTF{cream_choux} buuuuut the site kept telling me it was incorrect. I tried several variations (upper case, "creme" à la française etc..). I decided to send the organizers a mail but they replied that they weren't giving any hints. Luckily @benoit tried something: