From 4eedd604e4f3a7cd94a39cc7176e651c09ef42e6 Mon Sep 17 00:00:00 2001 From: lucky-vers Date: Tue, 14 Nov 2023 18:49:36 +0530 Subject: [PATCH] Refactor a *lot* of stuff --- Phase 2/01 Reverse Engineering.md | 27 +++------------- Phase 2/02 Binary Exploitation.md | 51 ++++++++++++++++--------------- Phase 2/03 Web Exploitation.md | 5 ++- Phase 2/04 Forensics.md | 27 ++++++---------- Phase 2/05 Cryptography.md | 40 +++++------------------- Phase 2/06 Other Challenges.md | 4 +-- 6 files changed, 52 insertions(+), 102 deletions(-) diff --git a/Phase 2/01 Reverse Engineering.md b/Phase 2/01 Reverse Engineering.md index 8d69f26..4065115 100644 --- a/Phase 2/01 Reverse Engineering.md +++ b/Phase 2/01 Reverse Engineering.md @@ -66,18 +66,9 @@ There's also a function `check_key` that presumably we need to test with to chec return False ``` -So it seems it checks whether the dynamic part of the given key is equal to the combination of elements of the variable `hashlib.sha256(username_trial).hexdigest()` with the following indices: +So it seems it checks whether the dynamic part of the given key is equal to the combination of elements of the variable `hashlib.sha256(username_trial).hexdigest()` with the indices **4**, **5**, **3**, **6**, **2**, **7**, **1**, and **8**. -- 4 -- 5 -- 3 -- 6 -- 2 -- 7 -- 1 -- 8 - -The value of `hashlib.sha256(username_trial).hexdigest()` is controlled by the value of `username_trial`, which in this case is `b"FRASER"`. Using this, we can get its value +The value of `hashlib.sha256(username_trial).hexdigest()` is controlled by the value of `username_trial`, which in this case is `FRASER`. Using this, we can get its value ``` ~ $ python3 @@ -93,16 +84,9 @@ Looping through the required indices on the hashed value, we get ``` >>> for i in [4, 5, 3, 6, 2, 7, 1, 8]: -... print(hashlib.sha256(username_trial).hexdigest()[i]) +... print(hex[i], end = '') ... -a -c -7 -3 -d -c -2 -9 +ac73dc29 ``` Therefore the value of the dynamic key turns out to be `ac73dc29`, leading to the full key being `picoCTF{1n_7h3_|<3y_of_ac73dc29}`. @@ -149,7 +133,6 @@ Welcome to the Arcane Calculator, tron! We're given a binary `debugger0_a` and our task is to figure out the value of the register `eax` at the end. We can use the program `objdump` with the `-D` flag for this ``` -~/Downloads $ chmod +x debugger0_a ~/Downloads $ objdump -D debugger0_a | less ``` @@ -243,7 +226,7 @@ This copies the value in `w0` to `w1`. It then prints using `printf` the value a So, the result of this code will be `Result: 1592237099`. -Converting the numerical value to hexacdecimal, we get `5EE79C2B` +Converting the numerical value to hexadecimal, we get `5EE79C2B` ``` ~ $ printf "%X\n" 1592237099 diff --git a/Phase 2/02 Binary Exploitation.md b/Phase 2/02 Binary Exploitation.md index cff8cc9..6196e85 100644 --- a/Phase 2/02 Binary Exploitation.md +++ b/Phase 2/02 Binary Exploitation.md @@ -110,9 +110,9 @@ But for the hexadecimal characters, we get promising results. Cleaning up the he ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3} ``` -The flag seems to be, albeit distorted, as `ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3}`. +The output is `ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3}`. This seems to be the flag, albiet distorted in some way. -It seems every four characters in the flag are reversed. We write some python to take care of this +It seems every four characters in the flag are reversed. We write some python code to take care of this ``` string = "ocip{FTC0l_I4_t5m_ll0m_y_y3n58a025e3}" @@ -129,7 +129,7 @@ print(new_string) ``` ``` -~/Projects $ python3 main.py +~/Projects $ python3 decode.py picoCTF{I_l05t_4ll_my_m0n3y_0a853e52 ``` @@ -302,39 +302,40 @@ Here, we have a simple piece of C code that we need to overflow. The relevant co char flag[FLAGSIZE_MAX]; void sigsegv_handler(int sig) { -printf("%s\n", flag); -fflush(stdout); -exit(1); + printf("%s\n", flag); + fflush(stdout); + exit(1); } void vuln(char *input){ -char buf2[16]; -strcpy(buf2, input); + char buf2[16]; + strcpy(buf2, input); } int main(int argc, char **argv){ + FILE *f = fopen("flag.txt","r"); + if (f == NULL) { + printf("%s %s", "Please create 'flag.txt' in this directory with your", + "own debugging flag.\n"); + exit(0); + } -FILE *f = fopen("flag.txt","r"); -if (f == NULL) { -printf("%s %s", "Please create 'flag.txt' in this directory with your", -"own debugging flag.\n"); -exit(0); -} + fgets(flag,FLAGSIZE_MAX,f); + signal(SIGSEGV, sigsegv_handler); // Set up signal handler -fgets(flag,FLAGSIZE_MAX,f); -signal(SIGSEGV, sigsegv_handler); // Set up signal handler + gid_t gid = getegid(); + setresgid(gid, gid, gid); -gid_t gid = getegid(); -setresgid(gid, gid, gid); + printf("Input: "); + fflush(stdout); + char buf1[100]; + gets(buf1); + vuln(buf1); -printf("Input: "); -fflush(stdout); -char buf1[100]; -gets(buf1); -vuln(buf1); -printf("The program will exit now\n"); -return 0; + printf("The program will exit now\n"); + + return 0; } ``` diff --git a/Phase 2/03 Web Exploitation.md b/Phase 2/03 Web Exploitation.md index cdbeafc..1c17ad6 100644 --- a/Phase 2/03 Web Exploitation.md +++ b/Phase 2/03 Web Exploitation.md @@ -23,7 +23,7 @@ app.listen(3000, () => { }); ``` -It turns out the service simply runs the `exec` command on whatever our message at the end of our url is. This is perfect for injecting unwanted shell code. First, we inject `ls` to see the list of all the files in the home directory +It turns out the service simply runs the `exec` command on whatever our message at the end of our url is. This is perfect for adding unwanted shell code. First, we inject `ls` to see the list of all the files in the home directory ``` @@ -45,7 +45,7 @@ public yarn.lock ``` -We find a file `falg.txt`, presumably containing the desired flag. Running `curl` once again, we find that is indeed the case +We find a file `falg.txt`, presumably containing the desired flag. Running `curl` once again, this time trying to output the contents of `falg.txt` using `cat`, we find that is indeed the case ``` ~ $ curl "https://caas.mars.picoctf.net/cowsay/test;cat 'tunn3l_v1s10n.bmp' -``` - -Opening the file in Photopea, we get this result +Now opening the file in Photopea, we get this result ![Not a flag](../Images/photopea_1.jpg) @@ -73,7 +68,7 @@ The height of a bitmap file is given at offset 0x16. the height ``` -Now opening this in Photopea, we get this result, and the flag turns out to be `picoCTF{qu1t3_a_v13w_2020}`. +Now opening this in Photopea, we get this result, and the flag comes out to be `picoCTF{qu1t3_a_v13w_2020}`. ![The flag](../Images/photopea_2.jpg) @@ -85,7 +80,7 @@ We get a file `tftp.pcapng`. Opening it in `wireshark`, we extract all the files ![Wireshark extraction](../Images/wireshark_extraction.jpg) -In the file `instructions.txt`, the message is `GSGCQBRFAGRAPELCGBHEGENSSVPFBJRZHFGQVFTHVFRBHESYNTGENAFSRE.SVTHERBHGNJNLGBUVQRGURSYNTNAQVJVYYPURPXONPXSBEGURCYNA.`, and seems to be a `ROT-13` cipher. And indeed, decoding it we get +In the file `instructions.txt`, the message is `GSGCQBRFAGRAPELCGBHEGENSSVPFBJRZHFGQVFTHVFRBHESYNTGENAFSRE.SVTHERBHGNJNLGBUVQRGURSYNTNAQVJVYYPURPXONPXSBEGURCYNA.`, and seems to be a ROT-13 cipher. And indeed, decoding it we get ![The decrypted message](../Images/wireshark_instructions_message_decrypted.jpg) @@ -153,19 +148,15 @@ data.tar.xz: extracted to `usr' This seems to hint at the passphrase being `DUEDILIGENCE`. Trying it on the three images, we get the following results ``` -~/Downloads $ steghide --extract -sf picture1.bmp -Enter passphrase: +~/Downloads $ steghide -p "DUEDILIGENCE" --extract -sf picture1.bmp steghide: could not extract any data with that passphrase! -~/Downloads $ steghide --extract -sf picture2.bmp -Enter passphrase: +~/Downloads $ steghide -p "DUEDILIGENCE" --extract -sf picture2.bmp steghide: could not extract any data with that passphrase! -~/Downloads $ steghide --extract -sf picture3.bmp -Enter passphrase: +~/Downloads $ steghide -p "DUEDILIGENCE" --extract -sf picture3.bmp wrote extracted data to "flag.txt". ``` -And now using `cat` on the flag file, we get - +And the contents of `flag.txt` are the flag in plantext. ``` ~/Downloads $ cat flag.txt @@ -206,5 +197,5 @@ It seems to be a base64 cipher. Removing the spaces and using `base64 -d` on it, ``` …/Downloads/Forensics is fun/ppt/slideMasters $ tr -d ' ' < hidden | base64 -d -flag: picoCTF{D1d_u_kn0w_ppts_r_z1p5}% +flag: picoCTF{D1d_u_kn0w_ppts_r_z1p5} ``` diff --git a/Phase 2/05 Cryptography.md b/Phase 2/05 Cryptography.md index 6065a48..debdad6 100644 --- a/Phase 2/05 Cryptography.md +++ b/Phase 2/05 Cryptography.md @@ -2,7 +2,7 @@ **Flag:** `picoCTF{et_tu?_07d5c0892c1438d2b32600e83dc2b0e5}` -In this, we're given an encrypted mesage `dcebcmebecamcmanaedbacdaanafagapdaaoabaaafdbapdpaaapadanandcafaadbdaapdpandcac` and a file `new_caesar.py`. The latter's contents are +In this, we're given an encrypted mesage `dcebcmebecamcmanaedbacdaanafagapdaaoabaaafdbapdpaaapadanandcafaadbdaapdpandcac` and a file `new_caesar.py`. The file's contents are ``` import string @@ -35,12 +35,12 @@ for i, c in enumerate(b16): print(enc) ``` -It looks like the encryption algorithm follows multiple steps: +It looks like the encryption algorithm follows two steps: 1. The flag is converted into base16 using the function `b16_encode`. 2. The flag is then shifted by changing it to the value in `ALPHABET` of the index calculated by adding the alphabetical positions of the one-character key and flag, dividing it by the length of `ALPHABET` (i.e. 16), and finding its remainder. -To decrypt the message, we simply have to follow the opposite of the steps described above +To decrypt the message, we follow the reverse of the above steps ``` import string @@ -102,7 +102,7 @@ TcNcd.N/&S$R/'(!R #"'S!Q"!%//T'"SR!Q/T$ CR=RS=BAAB@CBA@C ``` -The only decoding with real words seems to be `et_tu?_07d5c0892c1438d2b32600e83dc2b0e5`. We check it by wrapping it with `picoCTF{}`, and its correct. +The only decoding with real words seems to be `et_tu?_07d5c0892c1438d2b32600e83dc2b0e5`. We check it by wrapping it with `picoCTF{}`, and it turns out to be correct. # miniRSA @@ -117,7 +117,7 @@ e: 3 ciphertext (c): 2205316413931134031074603746928247799030155221252519872650080519263755075355825243327515211479747536697517688468095325517209911688684309894900992899707504087647575997847717180766377832435022794675332132906451858990782325436498952049751141 ``` -It looks like a simple RSA encrypted cipher text. Notice the small value of `e` (3). It ideally should be something much larger like 65537 or the cipher can be easily brute-forced. We do exactly that, using the [dcode RSA decryptor](https://www.dcode.fr/rsa-cipher) +It looks like a simple RSA encrypted cipher text. Notice the small value of `e` (3). It ideally should be something much larger like 65537, or else the cipher can be easily brute-forced. We do exactly that, using the [dcode RSA decryptor](https://www.dcode.fr/rsa-cipher) ![Result](../Images/minirsa.jpg) @@ -138,41 +138,17 @@ The python code for the decoding using this algorithm is this ``` import string -x = [350, 63, 353, 198, 114, 369, 346, 184, 202, 322, 94, 235, 114, 110, 185, 188, 225, 212, 366, 374, 261, 213] # Contents of `message.txt` converted to an array - +message = [350, 63, 353, 198, 114, 369, 346, 184, 202, 322, 94, 235, 114, 110, 185, 188, 225, 212, 366, 374, 261, 213] keys = [i for i in string.ascii_uppercase + string.digits + '_'] -for i in x: - print(keys[i % 37]) +for char in message: + print(keys[char % 37]) ``` Executing it, we get the following output ``` -~/Downloads $ python3 main.py -R -0 -U -N -D -_ -N -_ -R -0 -U -N -D -_ -A -D -D -1 -7 -E -C -2 ~/Downloads $ python3 main.py | tr -d '\n' R0UND_N_R0UND_ADD17EC2 ~/Downloads $ diff --git a/Phase 2/06 Other Challenges.md b/Phase 2/06 Other Challenges.md index b3036ac..83a2441 100644 --- a/Phase 2/06 Other Challenges.md +++ b/Phase 2/06 Other Challenges.md @@ -79,6 +79,7 @@ Thus, the code turns out to be `picoCTF{num3r1cal_c0ntr0l_775375c7}`. **Flag:** `picoCTF{1|\/|_4_p34|\|ut_f3bc410e}` We're given a file `crackme.py`. In it we find the following variable declaration + ``` bezos_cc_secret = "A:4@r%uL`M-^M0c0AbcM-MFE07b34c`_6N" ``` @@ -133,7 +134,7 @@ And at the very end of the file, the latter function runs choose_greatest() ``` -We change the function to `decode_secret` and set its parameters as `bezos_cc_secret` +We change the function to `decode_secret` and set its parameters as `bezos_cc_secret`. Executing the python script now, we get the flag. ``` decode_secret(bezos_cc_secret) @@ -144,4 +145,3 @@ decode_secret(bezos_cc_secret) picoCTF{1|\/|_4_p34|\|ut_f3bc410e} ``` -We thus get the flag.