Hot answers tagged

10

Preparing Challenges: This is the first challenge to prepare, it's very easy and requires some very basic crypto and scripting skills. What you need to do is to complete the blowfish level 1 of smash the stack. Go to ssh level1@blowfish.smashthestack.org -p 22 passwd: level1. I will submit the solution by the weekend. It took me about 1 hour to solve it, of ...


10

Forensics: Butterfly Effect (50) We were given an image of a butterfly. Running foremost on it didn't return anything special. I realised it was probably some image stegano-fu. After trying out some tools, I thought maybe this isn't about using some random stegano tools. I opened GIMP and started fiddling with some filters and colors. I finally used Menu > ...


9

Here's a write-up for the challenges that I participated in enough to follow the solution. We had several good team efforts, not all of these are my own work. 11. mail This is a file upload service over email. We can send commands: signup, list, put, get, delete, share. The user name is taken from the email's From: address. Looking at the server source ...


9

Fuzzy Packets 300 Description Fuzzy loves it when you show love! Can you find it? We were provided with a pcapng file. This is a list of packets. After opening it with Wireshark, it displays the following : After some basic search in description, it seems clear that the flag was encoded somewhere. We can see that some ping get a reply and some don't. ...


8

WannaFly (forensics, 100) We have an image of an ext4 filesystem. It contains some pictures that have been encrypted and blurred by the ransomware WannaFly. Apart from the blurry pictures, there is a Python script called ... and a .bash_history file which shows that ... was executed with the argument Hb8jnSKzaNQr5f7p. Looking at the Python script, we see ...


8

Disclaimer: I'm a member of the sec.se CTF team. In my opinion, write-ups aren't good questions, so we shouldn't post them on the main site. You can't easily turn them into good questions since the problem will be way too specific. I don't think their place is on meta neither, but nobody uses the CTF announcement posts, so I guess posting them as answer ...


7

proxy There was a simple proxy server-like application running on 188.40.147.125:8080 #!/usr/bin/env python import SocketServer import SimpleHTTPServer import urllib2 import logging from urlparse import urlparse logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s') class Proxy(SimpleHTTPServer....


7

We did alright! Finishing 78 out of 898 competing teams! We successfully solved 4 of the challenges presented: 'Compression' - Solved by Gilles A crypto challenge We managed to get the source code for an encryption service running at 54.234.224.216:4433. Download Solution details by Gilles @AntonyVennard also accidentially re-solved it and has been ...


7

Forensics: That's No Moon (50) We were given an image of a moon. Opening it in a hex editor, I quickly noticed there's a zip file at the end: I used foremost to extract the contents. Who knows I might have overlooked other files: foremost -i moon.png -o output -v I tried to extract it but it was password protected. After pondering for a while and looking ...


7

Exploitation: alligatorsim95 (50) We had to nc to the server which gave us some nice ASCII art: nc 4.31.182.242 9000 .-._ _ _ _ _ _ _ _ _ .-''-.__.-'00 '-' ' ' ' ' ' ' ' '-. '.___ ' . .--_'-' '-' '-' _'-' '._ V: V 'vv-' '_ '. .' _..' '.'. '=.____.=_.--' :_.__.__:_ '. : : (((____.-' '-....


7

Holy cow! Team secse finished 13th place with 201 teams competing. Great job everyone! 🎈🎈🎈


6

When we get to doing any competitions, I'll create a private channel for the team. I'm leaning toward retroactively putting the channels to "open" at the end of competitions for the sake of sharing knowledge but still giving us a way to compete effectively. If we don't open things up at the end, it'll have to be an IRC server.


6

Nazi War We can submit a name and get an encrypted password. A little experimentation shows that the password is always the same for a given name, and the encrypted password consists of 13 characters, the first two of which are always fb. Furthermore only the first 8 characters of the file name are significant. This looks like a traditional Unix DES ...


6

Nodepad (web, medium) Nodepad is a Node.js web application powered by the Express framework and a PostgreSQL backend DB. It allows users to register, log in and create simple notes. Additionally, there is an admin bot visiting every note that is reported to them in the latest version of Google Chrome. The entire challenge setup was published beforehand (...


5

Broken Brokoli [forensics, 100] brokenarchive.zip contains a file flag.rar, which is encrypted with a password that we have to find. The name brokenarchive hints that we should poke that zip file more closely. It's also clear that something is amiss since the zip file is significantly larger than the rar file it contains. Maybe there's something appended to ...


5

Problem 12: three_eyed_fish [Binary] We have a Linux amd64 executable trying to do something mysterious. It doesn't want to be traced (ptrace(0,0,0,0)); an easy workaround is to patch the binary to replace ptrace by something inoccuous like read. Also, the program tries to open /dev/tty0; patch this to /dev/tty. Tracing reveals calls to nanosleep for 250ms; ...


5

Here is a solution along with the hows and whys this worked: Scenario: We were given a web application with a very simple interface, a background image and a text box allowing for an input. The web application was a JavaScript front end which connected to a python flask application on the backend over a web socket. This python backend then connected to a ...


5



5

Exploitation: randy (100) We were given an address to connect to and an executable: It turned out it was a 32 bit ELF executable. Running the executable resulted into "guessing" some input: I used retdec to get some juicy info about the source: int main(int argc, char ** argv) { char * mem = malloc(46); // 0x80485ae int32_t v1 = (int32_t)mem; // ...


5

Forensics Orcish Challenge description: An army of orcs was spotted not too far from town. We were listening in on some of their communications but we have not been able to find anything containing their battle plans. Maybe they are disguising the messages some how.. data.pcap Solution: We were given a pcap file and we had to somehow find hidden ...


5

Web The Vault Challenge description: Has it been days? Weeks? You can't remember how long you've been standing at the door to the vault. You can't remember the last time you slept or ate, or had a drop of water, for that matter. But all of that is insignificant, in the presence of the untold fortunes that must lie just beyond the threshold. But the door. ...


5

macsh (crypto, 125) This defines a custom MAC fmac as follows, given a message m, a key k1 and a stream S0: Append the length of m formatted as 16 bytes in big-endian order. Append b = 1–16 copies of the byte b to pad the message to a multiple of 16 bytes. Xor the padded message with S0. Encrypt the result with AES-ECB with the key k1. Xor all the ...


4

I started cryptoMAX but only got part of the way. cryptoMAX [crypto, joy, 100] We get an encoded image and an encoding script. The encoding script iterates over the pixels. It reads each pixel as an RGB triple, masks some bits, and adds the masked R, G and B values together and multiples the sum by a constant. The resulting range is 0..255. The masking ...


4

Web 1 (badmedicine) Solved by Manishearth, independently by p____h (while not on the team) This is a simple login form with no password field: http://badmedicine.shallweplayaga.me:8042/ On logging in as "manish", I am redirected to /welcome, and I get this message Of course, logging in as admin directly doesn't work After rummaging around, I ...


4

BIN100: Dice Game What at first glance seemed to be a simple reversing challenge had a sting in its tail which led to me spending far more time than I should have figuring it out. Running the executable yields a dice game interface, where the user presses return to throw the dice. The value rolled is randomly generated 1-6. To win the game, you have to ...


4

aliensgif [stegano, 150] We have a GIF that contains three 250x250 images, one mostly red, one mostly green, one mostly blue. Careful examination reveals that the first line of each gif isn't perfectly uniform but has #0000fe bytes interlaced with the #0000ff bytes (mutatis mutandis for the green and blue image). We xor the images together, tempted by the ...


4

Web100: "A1 Galaxy"status: partially completed This was the first challenge in the Web series, and completion would secure us 100 points. The challenge involved finding ways to test for possible passwords in multi-level authorisation pages. With the big help from @p____h, I've managed to pass first two authorisations, and extract username, level1_password ...


4

Iot/osint/scada 100 Challenge description Today you received an email that seemed to be from an online shopping site that you use - but when you followed the link something definitely did not seem right. It appears that the world's worst phisher must have set up the page - and has targeted you with a phishing attack! The email text said you needed to visit ...


4

Forensics Wild Night Out Challenge description: That sure was a wild night at the old tavern. Good thing someone was able to draw the scene for us to remember. But the more I look at the picture, the more it seems that something isn't quite right... Solution: Our team member @Tom K. ran all kinds of tools against the image (foremost, binwalk, stegsolve ...


Only top voted, non community-wiki answers of a minimum length are eligible