HackMDThis Category had various of challenges which were based on Reverse engineering , Pwn , and Boot2Root machines , and I was able to do all except of two pwn challenges LOL, I suck at pwn ;P
BITS AND BYTES
This challenge had an attachment which was an android apk file , and I was to reverse engineer it , and get the flag the description was as follows:
It has 50 points and it has 6 solves , so let's break it down , I first decided to unzip it and then , I decided to use the tree command to list down all directories and what's inside them:
and inside /res/raw/ there is a oauth.txt , STRANGE , why would such a file exist , so I decide to read what's inside it :
and there it was decimals , so I decide to change them back to strings and finally I get the flag:
BOF
This challenge was an executable but ARM based with 100 points , the description was as follow:
I try executing the binary in my system but doesn't work so then I decide to check the strings , and inside the strings I get the flag
FLAG : tribectf{alwayz_sanitize_user_input}
ButterOverflow
A bufferoverflow vulnerable type challenge , it was attached with a binary , the description was as follows:
It had 50 points , I downloaded the file to examine it on my system:
So I pulled this binary up in gdb for more analysis , first I try to check the functions:
So we have main , and win functions that are insteresting, so I try breaking down the main function in radare2:
and we can fully see now what's happening the more fascinating part of all is how it compares rax with rdx and then jumps if not as expected or calls the sym.win function, I know read the sym.win function:
and here now I understand how it all works from the decompiled code of the main function:
set one variable s with type char but then compare _target with 0xdeadbeef if that's equal to each other then it calls the win() or else it prints out the error, turns out this binary isn't secure at all so I then make my own flag.txt and now do dynamic analysis, but first I try find the offset :
so the offset is 32 ! Now then since we know the offset we have the address of win , and the address of main and since the binary isn't protected I just wrote a fast script to test it locally :
I run it up and boom , unexpected I have the flag with the RET2WIN concept LEL:
But tried running it on the remote binary but didn't work so I started adding up the offset "NOOB ALERT" , and I reached 40 and it worked!
FLAG : TRIBECTF{N@_5TR1NG5_4TT4CH3D}
Fixme
Description:
this challenge has 100 points , and it had an attachment with it, I first gather some information about the file because it was in .so format which confused me but then after a few command strokes:
I realized it was an Zip archive file , so i unzip it , and I get the following:
First thing I try to read GimmeheadKt.class :
And boom I got the flag soo unexpected:))
FLAG : tribectf{i_knew_youd_fix_me:)}
HEART 1
Description:
Now it's a machine:} , so I first perform a network scan:
So we have 4 ports open , including 80 which has a robots.txt with some interesting information , I open the site on the web, and then I curl robots.txt
I now read the development.txt file and see what's inside it:
wow so we have a file named old.php that requires attention, and attention it shall get:)
So I got the Heart 1 Flag: TRIBECTF{Ch1ef_Surg30n_@t_Freedmen}
HEART 2
From last we checked on old.php it looks like a web shell , so I now try to play around with it and see what I can do:
okay so it works now let's try listing dir and files:
alright that didn't work out perfect so they blacklisted some commands:} , I then try reading old.php using the less commands and looks like blacklisting isn't the way to go:)
I now know the blacklisted words, so what I do now is try get to list the DIR with base64:
MY machine:
WEB SHELL:
and there we have it :)) , There is an interesting text file z_reminder.txt I know try and read it!
And as seen we have creds , but then I remember we don't have any login portal in the website , but then I remember we got ssh so I guessed maybe they are ssh creds , let's try our luck!
And I am in:)), Now then with that done:)) , I find the second flag inside Desktop!
FLAG:TRIBECTF{Op3n3d_Fir$t_Int3rr@ci@l_H0spit@l}
HEART 3
Now for the third flag , it must be inside the root directory so let's check what sudo privileges does our user have so as we know how we elevate our privileges:
Wow so we can just be root then LMAO:)) EZPIZI
And there we go:))
FLAG: TRIBECTF{Co-f0und3d_th3e_N@tion@l_M3dic@l_Associ@ti0n}
Hello World
Description:
It's a reverse engineering challenge, So I try run the binary it asks for a password:
I try read strings but nothing also:
then I try running the strings command and I find a weird pattern:
then I notice something that it says the alphabets in capital then small letters then comes a base64 string, so i write it somewhere else and it makes up aGVsbG9fd29ybGRfZnJvbV9SRQ== decoding it I got :
so the flag is FLAG : TRIBECTF{hello_world_from_RE}
Logd
Description:
So we are also given an attachment of logd.txt and we have to get something out of it, and this was more than easy , and it had 75 points lol , I just cat out and I have the flag:
FLAG : tribectf{always_look_for_low_hanging_fruits_in_android_logs}
Pencil 1
Description:
This was also a machine, first thing I did was to scan the network of that IP:
We have 3000 , 80 and 21, the most interesting ports of all , and hitting -A flag in nmap , we get that we can log in anonymously in port 21 so that's what I do now is to get access and there is a file inside it :
FLAG : TRIBECTF{Ar3ntY0uSh@rp}
SADLY WHILE WRITING THIS WRITEUP THEY TURNED OFF THE SERVERS FOR MACHINES AND ALL THAT SO I WILL END HERE:(
This was a really interesting CTF, I took second position as a solo
Contacts: twitter - @tahaafarooq
