DEFKTHON CTF 2014 - we love it! - Web 300 Write-up

For this challenge we had an apk file! Well it was exciting at the beggining i was expecting something much more about android but... in the it was a web quest what else could it be :D

To start i get android-sdk so that i can use the emulator to run program and while it was being downloaded, I decompiled the apk package and get a code like this. It was checking if the text entered was "paswd" and sending a web request if it is with some phone data and a random pwd value -which is between [0, 300]. The problem was site kept us telling

You missed something.
Keep trying.

so i thought it must be something about pwd data i get the exact header's for the post request via wireshark and simulate it on computer -of course i got the same response :D- but this time i iterate through all possible pwd values[0, 300] and in the end i got the flag!

Flag is: w00tkitk@t

Python script and request headers:
http://www.codesend.com/view/584e8c192ff7b374732f783321175ce6/

DEFKTHON CTF 2014 - Flag is Here! - Misc 200 Write-up

In this challange we were given a txt file which contains many lines and on each line it was containing 3 integers seperated with comma, and each of these integers was between [0,255] so we thought it might be a RGB formatted image and write a python script to get the image.

The problem was we were not given any size info :( so we keep trying different size's (but we know total count of pixels so when you know one of the w or h the other one most be number_of_lines/known_size) and we get a size of 126x488(wxh) and the image was:

And there is the python script

Boston Key Party CTF 2014 - risc_emu - Pwning 100 Write-up

In this challange we were given a emulator which suppose to emulate RISC arch as understood from the name but it was different in the code :)

First i tried many RISC instructions and kept getting ERROR! message then i decided to dive into assembly so i saw there are just 10 instructions:

And they were called from a buffer which initialized at the start of main:

and when we give our instruction (base64'd of course) it was calling the appropriate function by accesing this buffer with that code:

so if we could find a way to change the variables in the mainfun buffer we could jump to any function we want -i choosed system- and the best part is our functions first parameter is the rest of our instructions. Lets get the address of the system function:

the first entry of the mainfun is 0x401E80 and our system function is at 0x4010D0 all we need to do is subtract 0x0DB0 from the pointer the first sub instruction -the one with 3 parameters- were disabling as to reach for places from the register memory but the subi instructions memory access was not limited it is where we will exploit the code:

var_C is our first parameter and we are writing to r[rdi*4] with no check lets look at the memory position of r:

it is right above the main::fun buffer so we can overflow it by using subi and it was the operation with the opcode 0x03 it is first parameter is the register number which we will write to. The distance between the buffer and the registers is 0xC0 bytes and each register is 4 bytes in size so if we write to 0x30th register we will write to first function pointer in the main::fun buffer also we want to subtract 0x0DB0 bytes from it so our instruction should be like this:

0x03
0x30
0x0D
0xB0

And after that when we try to access to 0x00th instruction (add) we will call system function and rest of the string as parameter to it -don't forget we are giving them base64'd.

(perl -e 'print "\x03\x30\x0d\xb0\x00cat key"') | base64 | nc 54.218.22.41 4545

and ta-daa :))

Boston Key Party - Dante's Inferno Write-up

We were given a torrent file of a text file. After downloading it, we saw that it was a changed version of publicly available e-book. We downloaded the original file from here. We used meld to compare these two files. And here is the result:

So the password is 'At least this one wasn't a VM'

.

.

( We are 99% sure  mostly because we hadn't had a chance to test it. )

Codegate CTF 2014 - Weirdshark - Forensics 150 Write-up

Here is our file : http://58.229.183.26/files/weird_shark.pcap_f5f1e42dd398f18c43af89ba972b3ee7

Upon trying to open with wireshark we got the error :

That was obvious.

Let's try opening with tcpdump to see what happens :

There is something wrong with the file.

Based on the error massage of wireshark we searched what EPB is.
It was the block that transmitted information lies in.According to wireshark's error we assumed there was something wrong with packet's epb headers but not the information itself.

To fix headers we used online pcap fixer : http://f00l.de/hacking/pcapfix.php.It corrected the error that EPB data exceeds the packet length.

Opening the repaired file via wireshark caused another error:

It seems that fixer changed cap len to 64 but our packets' len is 62.So we filled the packets with 0s to achieve 64 bit packets.

Voila!We can read the packets with wireshark.

and here is the flag.

and here is the one of other files we extracted from pcap file.We think these guys are the builders of this challenge.

Codegate CTF 2014 - Web Proxy - Web 200 Write-up

In this challenge we were given a proxy and in the html source code
a commented line which states:
admin/index.php
it was clear that we should get into that file when we tried to get it from outside
it gave an 403 forbidden error and when you try to get it from inside with exact link
it was giving Access Denied response. So we figure out that the proxy was
processing the url you requested and if it is containing one of the "php" or "//"
it was giving that Access Denied response so we requested the page with just
localhost/188f6594f694a3ca082f7530b5efc58dedf81b8d/admin/
which should give the default index and it worked but the response wast trimmed
we could get just a few lines and we thought that there might be a vuln in
request that proxy making so i just put the and of the link a %0a which is \n
and ta-daa the headers were gone we got just the contents of the page something
went absolutely wrong. When i examined deeply i see that the proxy is working by
putting the url we requested directly into the request so:

GET "our_url" HTTP/1.1
Host: xxx
And other headers.
.
.
.

the get request was happening that way so i manipulated it by hand to use
Range header it allows us to seek to any wanted byte of the file so i gave an
url like

localhost/188f6594f694a3ca082f7530b5efc58dedf81b8d/admin/ HTTP/1.1%0d%0aHost:localhost%0d%0aRange:bytes=380-%0d%0a%0d%0a

and the output was checking if the host is "hackme" so i changed my host line
and rearrangen range field for new file to get the password like this:

localhost/188f6594f694a3ca082f7530b5efc58dedf81b8d/admin/ HTTP/1.1%0d%0aHost:hackme%0d%0aRange: bytes=70-%0d%0a%0d%0a

and ta-daa there is the password.

Codegate CTF 2014 - 120 Arrows - Web 500 Write-up

By seeing the code it was clear that we are going to make a blind sql injection attack.
The problem was the attack limit we only have 120 chance to get the password,
password was 30 characters long and it was containing all the lowercase letters
- which are 26. So in the worst case a linear attack should try 26*30 different
passwords which is far more than 120. Then the first thing coming into mind is to
try binary search on each character which should take 6 steps per character in
the worst case and in total 6*30=180 if we are lucky enough we can find the answer
in less than that so i give it a try and it worked. If i would be so unlucky
then i would convert each character to base 3 and look for each digit ,there can
be almost 3 digits to represnt 26 in base 3, so it would take 3*30=90 which would
be absolutely enough for the case. And there is our exploit:

Exploit - Web500