vee1e/Cryptonite-Taskphase
1
0
Fork 0
mirror of https://github.com/vee1e/Cryptonite-Taskphase.git synced 2026-09-01 11:08:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Refactor a *lot* of stuff

Browse source
This commit is contained in:
lucky-vers 2023-11-14 18:49:36 +05:30
parent 634306445e
commit 4eedd604e4
6 changed files with 52 additions and 102 deletions
Download patch file Download diff file Expand all files Collapse all files

27
Phase 2/01 Reverse Engineering.md
View file

@ -66,18 +66,9 @@ There's also a function `check_key` that presumably we need to test with to chec
return False
```
So it seems it checks whether the dynamic part of the given key is equal to the combination of elements of the variable `hashlib.sha256(username_trial).hexdigest()` with the following indices:
So it seems it checks whether the dynamic part of the given key is equal to the combination of elements of the variable `hashlib.sha256(username_trial).hexdigest()` with the indices **4**, **5**, **3**, **6**, **2**, **7**, **1**, and **8**.
- 4
- 5
- 3
- 6
- 2
- 7
- 1
- 8
The value of `hashlib.sha256(username_trial).hexdigest()` is controlled by the value of `username_trial`, which in this case is `b"FRASER"`. Using this, we can get its value
The value of `hashlib.sha256(username_trial).hexdigest()` is controlled by the value of `username_trial`, which in this case is `FRASER`. Using this, we can get its value
```
~ $ python3
@ -93,16 +84,9 @@ Looping through the required indices on the hashed value, we get
```
>>> for i in [4, 5, 3, 6, 2, 7, 1, 8]:
... print(hashlib.sha256(username_trial).hexdigest()[i])
... print(hex[i], end = '')
...
a
c
7
3
d
c
2
9
ac73dc29
```
Therefore the value of the dynamic key turns out to be `ac73dc29`, leading to the full key being `picoCTF{1n_7h3_|<3y_of_ac73dc29}`.
@ -149,7 +133,6 @@ Welcome to the Arcane Calculator, tron!
We're given a binary `debugger0_a` and our task is to figure out the value of the register `eax` at the end. We can use the program `objdump` with the `-D` flag for this
```
~/Downloads $ chmod +x debugger0_a
~/Downloads $ objdump -D debugger0_a | less
```
@ -243,7 +226,7 @@ This copies the value in `w0` to `w1`. It then prints using `printf` the value a
So, the result of this code will be `Result: 1592237099`.
Converting the numerical value to hexacdecimal, we get `5EE79C2B`
Converting the numerical value to hexadecimal, we get `5EE79C2B`
```
~ $ printf "%X\n" 1592237099

51
Phase 2/02 Binary Exploitation.md
View file

@ -110,9 +110,9 @@ But for the hexadecimal characters, we get promising results. Cleaning up the he
ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3}
```
The flag seems to be, albeit distorted, as `ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3}`.
The output is `ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3}`. This seems to be the flag, albiet distorted in some way.
It seems every four characters in the flag are reversed. We write some python to take care of this
It seems every four characters in the flag are reversed. We write some python code to take care of this
```
string = "ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3}"
@ -129,7 +129,7 @@ print(new_string)
```
```
~/Projects $ python3 main.py
~/Projects $ python3 decode.py
picoCTF{I_l05t_4ll_my_m0n3y_0a853e52
```
@ -302,39 +302,40 @@ Here, we have a simple piece of C code that we need to overflow. The relevant co
char flag[FLAGSIZE_MAX];
void sigsegv_handler(int sig) {
printf("%s\n", flag);
fflush(stdout);
exit(1);
printf("%s\n", flag);
fflush(stdout);
exit(1);
}
void vuln(char *input){
char buf2[16];
strcpy(buf2, input);
char buf2[16];
strcpy(buf2, input);
}
int main(int argc, char **argv){
FILE *f = fopen("flag.txt","r");
if (f == NULL) {
printf("%s %s", "Please create 'flag.txt' in this directory with your",
"own debugging flag.\n");
exit(0);
}
FILE *f = fopen("flag.txt","r");
if (f == NULL) {
printf("%s %s", "Please create 'flag.txt' in this directory with your",
"own debugging flag.\n");
exit(0);
}
fgets(flag,FLAGSIZE_MAX,f);
signal(SIGSEGV, sigsegv_handler); // Set up signal handler
fgets(flag,FLAGSIZE_MAX,f);
signal(SIGSEGV, sigsegv_handler); // Set up signal handler
gid_t gid = getegid();
setresgid(gid, gid, gid);
gid_t gid = getegid();
setresgid(gid, gid, gid);
printf("Input: ");
fflush(stdout);
char buf1[100];
gets(buf1);
vuln(buf1);
printf("Input: ");
fflush(stdout);
char buf1[100];
gets(buf1);
vuln(buf1);
printf("The program will exit now\n");
return 0;
printf("The program will exit now\n");
return 0;
}
```

5
Phase 2/03 Web Exploitation.md
View file

@ -23,7 +23,7 @@ app.listen(3000, () => {
});
```
It turns out the service simply runs the `exec` command on whatever our message at the end of our url is. This is perfect for injecting unwanted shell code. First, we inject `ls` to see the list of all the files in the home directory
It turns out the service simply runs the `exec` command on whatever our message at the end of our url is. This is perfect for adding unwanted shell code. First, we inject `ls` to see the list of all the files in the home directory
```
@ -45,7 +45,7 @@ public
yarn.lock
```
We find a file `falg.txt`, presumably containing the desired flag. Running `curl` once again, we find that is indeed the case
We find a file `falg.txt`, presumably containing the desired flag. Running `curl` once again, this time trying to output the contents of `falg.txt` using `cat`, we find that is indeed the case
```
~ $ curl "https://caas.mars.picoctf.net/cowsay/test;cat<falg.txt"
@ -110,4 +110,3 @@ Therefore, the username we need is `admin` and the password `strongPassword09876
https://github.com/lucky-vers/Cryptonite-Taskphase/assets/51952975/8b7d50f8-eb97-4801-b99e-16fe569cc6e0

27
Phase 2/04 Forensics.md
View file

@ -38,14 +38,9 @@ Image Size : 1134x1134
Megapixels : 1.3
```
It seems to be a `.bmp` (bitmap) file with a size of 1134x1134 pixels. Thus we rename it to `tunn3l_v1s10n.bmp`.
It seems to be a bitmap file with a size of 1134x1134 pixels. To indicate this, we rename it to `tunn3l_v1s10n.bmp`.
```
~/Downloads $ mv tunn3l_v1s10n tunn3l_v1s10n.bmp
renamed 'tunn3l_v1s10n' -> 'tunn3l_v1s10n.bmp'
```
Opening the file in Photopea, we get this result
Now opening the file in Photopea, we get this result
![Not a flag](../Images/photopea_1.jpg)
@ -73,7 +68,7 @@ The height of a bitmap file is given at offset 0x16.
the height
```
Now opening this in Photopea, we get this result, and the flag turns out to be `picoCTF{qu1t3_a_v13w_2020}`.
Now opening this in Photopea, we get this result, and the flag comes out to be `picoCTF{qu1t3_a_v13w_2020}`.
![The flag](../Images/photopea_2.jpg)
@ -85,7 +80,7 @@ We get a file `tftp.pcapng`. Opening it in `wireshark`, we extract all the files
![Wireshark extraction](../Images/wireshark_extraction.jpg)
In the file `instructions.txt`, the message is `GSGCQBRFAGRAPELCGBHEGENSSVPFBJRZHFGQVFTHVFRBHESYNTGENAFSRE.SVTHERBHGNJNLGBUVQRGURSYNTNAQVJVYYPURPXONPXSBEGURCYNA.`, and seems to be a `ROT-13` cipher. And indeed, decoding it we get
In the file `instructions.txt`, the message is `GSGCQBRFAGRAPELCGBHEGENSSVPFBJRZHFGQVFTHVFRBHESYNTGENAFSRE.SVTHERBHGNJNLGBUVQRGURSYNTNAQVJVYYPURPXONPXSBEGURCYNA.`, and seems to be a ROT-13 cipher. And indeed, decoding it we get
![The decrypted message](../Images/wireshark_instructions_message_decrypted.jpg)
@ -153,19 +148,15 @@ data.tar.xz: extracted to `usr'
This seems to hint at the passphrase being `DUEDILIGENCE`. Trying it on the three images, we get the following results
```
~/Downloads $ steghide --extract -sf picture1.bmp
Enter passphrase:
~/Downloads $ steghide -p "DUEDILIGENCE" --extract -sf picture1.bmp
steghide: could not extract any data with that passphrase!
~/Downloads $ steghide --extract -sf picture2.bmp
Enter passphrase:
~/Downloads $ steghide -p "DUEDILIGENCE" --extract -sf picture2.bmp
steghide: could not extract any data with that passphrase!
~/Downloads $ steghide --extract -sf picture3.bmp
Enter passphrase:
~/Downloads $ steghide -p "DUEDILIGENCE" --extract -sf picture3.bmp
wrote extracted data to "flag.txt".
```
And now using `cat` on the flag file, we get
And the contents of `flag.txt` are the flag in plantext.
```
~/Downloads $ cat flag.txt
@ -206,5 +197,5 @@ It seems to be a base64 cipher. Removing the spaces and using `base64 -d` on it,
```
…/Downloads/Forensics is fun/ppt/slideMasters $ tr -d ' ' < hidden | base64 -d
flag: picoCTF{D1d_u_kn0w_ppts_r_z1p5}%
flag: picoCTF{D1d_u_kn0w_ppts_r_z1p5}
```

40
Phase 2/05 Cryptography.md
View file

@ -2,7 +2,7 @@
**Flag:** `picoCTF{et_tu?_07d5c0892c1438d2b32600e83dc2b0e5}`
In this, we're given an encrypted mesage `dcebcmebecamcmanaedbacdaanafagapdaaoabaaafdbapdpaaapadanandcafaadbdaapdpandcac` and a file `new_caesar.py`. The latter's contents are
In this, we're given an encrypted mesage `dcebcmebecamcmanaedbacdaanafagapdaaoabaaafdbapdpaaapadanandcafaadbdaapdpandcac` and a file `new_caesar.py`. The file's contents are
```
import string
@ -35,12 +35,12 @@ for i, c in enumerate(b16):
print(enc)
```
It looks like the encryption algorithm follows multiple steps:
It looks like the encryption algorithm follows two steps:
1. The flag is converted into base16 using the function `b16_encode`.
2. The flag is then shifted by changing it to the value in `ALPHABET` of the index calculated by adding the alphabetical positions of the one-character key and flag, dividing it by the length of `ALPHABET` (i.e. 16), and finding its remainder.
To decrypt the message, we simply have to follow the opposite of the steps described above
To decrypt the message, we follow the reverse of the above steps
```
import string
@ -102,7 +102,7 @@ TcNcd.N/&S$R/'(!R #"'S!Q"!%//T'"SR!Q/T$
CR=RS=BAAB@CBA@C
```
The only decoding with real words seems to be `et_tu?_07d5c0892c1438d2b32600e83dc2b0e5`. We check it by wrapping it with `picoCTF{}`, and its correct.
The only decoding with real words seems to be `et_tu?_07d5c0892c1438d2b32600e83dc2b0e5`. We check it by wrapping it with `picoCTF{}`, and it turns out to be correct.
# miniRSA
@ -117,7 +117,7 @@ e: 3
ciphertext (c): 2205316413931134031074603746928247799030155221252519872650080519263755075355825243327515211479747536697517688468095325517209911688684309894900992899707504087647575997847717180766377832435022794675332132906451858990782325436498952049751141
```
It looks like a simple RSA encrypted cipher text. Notice the small value of `e` (3). It ideally should be something much larger like 65537 or the cipher can be easily brute-forced. We do exactly that, using the [dcode RSA decryptor](https://www.dcode.fr/rsa-cipher)
It looks like a simple RSA encrypted cipher text. Notice the small value of `e` (3). It ideally should be something much larger like 65537, or else the cipher can be easily brute-forced. We do exactly that, using the [dcode RSA decryptor](https://www.dcode.fr/rsa-cipher)
![Result](../Images/minirsa.jpg)
@ -138,41 +138,17 @@ The python code for the decoding using this algorithm is this
```
import string
x = [350, 63, 353, 198, 114, 369, 346, 184, 202, 322, 94, 235, 114, 110, 185, 188, 225, 212, 366, 374, 261, 213] # Contents of `message.txt` converted to an array
message = [350, 63, 353, 198, 114, 369, 346, 184, 202, 322, 94, 235, 114, 110, 185, 188, 225, 212, 366, 374, 261, 213]
keys = [i for i in string.ascii_uppercase + string.digits + '_']
for i in x:
print(keys[i % 37])
for char in message:
print(keys[char % 37])
```
Executing it, we get the following output
```
~/Downloads $ python3 main.py
R
0
U
N
D
_
N
_
R
0
U
N
D
_
A
D
D
1
7
E
C
2
~/Downloads $ python3 main.py | tr -d '\n'
R0UND_N_R0UND_ADD17EC2
~/Downloads $

4
Phase 2/06 Other Challenges.md
View file

@ -79,6 +79,7 @@ Thus, the code turns out to be `picoCTF{num3r1cal_c0ntr0l_775375c7}`.
**Flag:** `picoCTF{1|\/|_4_p34|\|ut_f3bc410e}`
We're given a file `crackme.py`. In it we find the following variable declaration
```
bezos_cc_secret = "A:4@r%uL`M-^M0c0AbcM-MFE07b34c`_6N"
```
@ -133,7 +134,7 @@ And at the very end of the file, the latter function runs
choose_greatest()
```
We change the function to `decode_secret` and set its parameters as `bezos_cc_secret`
We change the function to `decode_secret` and set its parameters as `bezos_cc_secret`. Executing the python script now, we get the flag.
```
decode_secret(bezos_cc_secret)
@ -144,4 +145,3 @@ decode_secret(bezos_cc_secret)
picoCTF{1|\/|_4_p34|\|ut_f3bc410e}
```
We thus get the flag.