CSAW CTF 2013 :: Misc 50: Networking 1 & 2

Misc 50: Networking 1

This is a warmup challenge and is very straightforward. We were given a pcap file.

Open up the pcap file in wireshark and Follow TCP Stream. The flag is shown!!

flag{d316759c281bf925d600be698a4973d5}

Misc 50: Networking 2

This time we are given a .process file. Just open it up in Notepad++ and you will see the flag

flag{f9b43c9e9c05be5e08ea163007af5144}

Cheers,
thegrayone

CSAW CTF 2013 :: Web: Herpderper (300 points)

Tools Used:
Notepad++
Android Emulator & Android SDK
Burpsuite
apktool
keytool, jarsigner (JDK)

Ok, this is going to be a long article. Grab a cup of coffee and relax. In fact, grab one cup of coffee for me too =D

For this challenge, we were provided with an apk (Herpderper.apk)

As this is in the web category, I'm guessing we have to observe the web traffic from the application. In order to view the web traffic from the application, we would have to perform MITM on the Android Emulator.

I used Burp Suite. Fire it up and set the proxy settings.

Next we will launch the Android Emulator with the proxy settings enabled and pointing to BurpSuite. Create an emulated android device with the AVD Manager that comes with the Android SDK install. I created one that is running Android 4.0. To launch the emulator with proxy enabled, type the following command in the cmdline. (PS: the emulator binary is in the AndroidSDK/tools folder)

emulator -avd urEmulatorName -http-proxy proxyaddress:proxyport

Install the apk with the following command

adb install herpderper.apk

After installation, start the app and you should see a login screen.

Type in any email and password and try to login. If everything works correctly, burpsuite would be able to intercept the login request. However, burpsuite's intercept proxy does not see any requests. At the same time, the application displays a "Unknown Error" message in the UI. This is strange =/. Let's fire up "adb logcat", try to login again and see if there is any exception thrown

There is a debug message saying "Untrusted certificate chain". The application seems to be checking the SSL certificate presented by Burpsuite against something. We would have to reverse the apk and try to see how the application is checking the SSL certificate. We can use dex2jar and jd-gui to try and decompile and see the reconstructed java code. But I prefer looking at it in smali, to do this we need apktool. Run the following cmd to decompile the apk to smali

apktool d herpderper.apk herp

The decompiled files will be saved into the folder herp. Navigate to the /herp/smali/ops/black/herpderper folder (This is where all the source files are)

Open up all the smali files in Notepad++
Do a "Find All in All Opened Documents" with the string "Untrusted certificate chain"

The string is found in the class TrustModifier$AlwaysTrustManager. If we inspect the constructor of this class, we can see that it intializes a sequence of values that looks like SSL Cert values

We could create a self-signed cert with the same values and configure Burpsuite to serve that cert. But there is a easier way, we could patch the apk and make the application skip the ssl check completely. The ssl checks occur in the method checkServerTrusted. I added a line of code so that the method straight away returns without running the rest of the code. This effectively bypassed the SSL checks performed by the application

Now recompile the smali code back into an apk and install the patched apk to the emulator.
Run the following commands (You will be prompted for a password, just use the same password for both prompts)

- adb uninstall ops.black.herpderper
- apktool b herp patched.apk
- keytool -genkey -v -keystore my.keystore -alias anyalias -keyalg RSA -validity 10000
- jarsigner -sigalg MD5withRSA -digestalg SHA1 -keystore my.keystore patched.apk anyalias
- adb install patched.apk

Now, when we run the application and try to login with an email and password. The request is now properly intercepted by Burpsuite. However, when we forwarded the request, the received response was "integrity check failed". Let's see what is actually in the request

A post request is made to "https://webchal.isis.poly.edu/csaw.php" with 3 parameters
- 1 Base64-encoded username email (identity)
- 1 Base64-encoded password (secret)
- 1 long chunk of hex string (integrityid)

If we look back at the smali codes and try to find this integrityid parameter. It is in the AuthRequest class.

Upon further inspection of the code in this class, we found out that integrityid is actually the signature of the apk in a hex encoded format. Remember that we had to resign the patched apk in order to install it? (the jarsign command) This means that the server is actually checking that the application has not been tampered with. The next challenge is how do we get the signature of the original apk?

I found this article on androidcracking blog that described how to get the signature from a apk file. I copied the java code, compiled it into a jar file and ran the jar file against the original herpderper.apk. The output is the signature of the original herpderper.apk

Now go back to the Android emulator and try to login any email/password again. When Burpsuite intercepts the request, change the integrityid parameter to the signature that was just produced by the jar file and forward the request.

Now, the server responds with a "login failed" message. This means we have successfully bypassed its integrity check. The next part was where I was stuck for the longest time. I tried SQL injection and all kinds of stuffs but I will cut to the chase.

If we look at the "login failed" response from the server, there is actually a role parameter being returned. The solution is just to add a "role" parameter to the request. The value doesn't even matter. Once you submit that request, the server will respond with a "success" message together with the flag

(This screenshot is from a script that I wrote to make my life easier =D)

I apologise for the missing screenshots of the server responses. This is because I am writing this article after the CTF is over and CSAW has already shut down the server for this challenge. I'll remember to save screenshots as I play the next time =/

This was really an enjoyable challenge. I hope you enjoyed it as well as I did. Until next time.

Cheers,
thegrayone

CSAW CTF 2013 :: Trivial

Below are the Trivial questions for this years CSAW CTF 2013.

Trivial - 50 points 

• Drink all the booze, ________ all the things
• The answer is "hack"

Trivial - 50 points

• What is the abbreviation of the research published in the Hackin9 issue on nmap by Jon Oberheide, Nico Waisman, Mattieu Suiche, Chris Valasek, Yarochkin Fyodor, the Grugq, Jonathan Brossard and Mark Dowd?
• The answer is "DICKS" , DARPA Interference Checking Kludge Scanning

Trivial - 50 points

• What is the common name for a single grouping instructions used in a Return Oriented Programming payload, typically ending in a Return Instruction (RET)?
• The answer is "gadgets"

Trivial - 50 points

• What is the new web technology that provides a web browser full duplex communication to a web server over a single connection?
• The answer is "WebSockets"

Trivial - 50 points

• What is the x86 processor operating mode for running 64-bit code?
• The answer is "Long Mode"

CSAW CTF 2013 :: Recon: Odin (100 points)

Only a Google search for "Odin" is given as the question.

This is a bit tricky. "Odin" actually refers to 1 of the irc chat user whose nick is "snOwDIN". You must have joined #csaw IRC channel in order to have noticed the user.

If you do a "whois snOwDIN" you will notice that his ircname as "linkedin:chinesespies"

Access the linkedin profile at: http://www.linkedin.com/in/chinesespies

And the key{cookies_are_for_csaw} will be shown in the page itself.

 See screenshot below:

Regards,

David Billa
"Live for Something or Die for Nothing!"

CSAW CTF 2013 :: REVERSING 2 (200 points)

For this puzzle we are given a window executable.

Hmm but the program keeps on crashing when i tried opening it...
Whatever... lets try firing up ollydbg to see what is going on. Hmmm... we got a messagebox call... but the text seems to be encrypted...

If we were to fire up IDA pro, we can see that there is a branch condition. Apparently by default the program will directly jump to address 0040106E to display the MessageBox.

Lets try to change this flow in ollydbg and see what will happen. I got a feeling that the other path might decrypt and display out the plain key.... Lets set breakpoint at address 00401040. On break change EAX to 0.  Once that is done, step through the program till you hit the messagebox.

Ermmm... the messagebox pops up... but no key is inside what possibly could have gone wrong???

Lets take a look on what has been passed in to the messagebox function. We can see that there is a push ESI @ address 00401075. But the text is empty! Let me Follow in dump on ESI.. Ahhh key found! 

 flag{number2isalittlebitharder:p}

Always Lazing

NoirD3vil

CSAW CTF 2013 :: Recon: Kevin Chung (100 points)

Only a Google search for "Kevin Chung" is given as the question. In addition a hint: "Where can you graduate from?" was also given.

You can start searching for where Kevin Chung graduated from. He is from NYU-Poly and while he was there he was a CSAW High School Forensics Finalist and Champion. This information is also available from the judges subpage within the csaw ctf website (https://ctf.isis.poly.edu/judges/)

Search in CSAW High School Forensics Previous Winners website:

https://hsf.isis.poly.edu/previous_winners/

Under 2009 winners there is a hyperlinked Kevin Chung name. Clicking on the link will lead you to key.txt which contains the key.

https://hsf.isis.poly.edu/assets/uploads/pages/previous_winners/key.txt

key{who_in_the_world_is_kevin_chung}

Regards,

David Billa
"Live for Something or Die for Nothing!"

CSAW CTF 2013 :: Web: Nevernote (200 points)

The question provided by the challenge:

http://128.238.66.214

from: Nevernote Admin <nevernoteadmin@nevernote.com>
to: challenger@ctf.isis.poly.edu
date: Thurs, Sep 19, 2013 at 3:05 PM
subject: Help

Friend,
Evil hackers have taken control of the Nevernote server and locked me out. While I'm working on restoring access, is there anyway you can get in to my account and save a copy of my notes? I know the system is super secure but if anybody can do it - its you.
Thanks,
Nevernote Admin



The objective of the challenge is to obtain the note of the Nevernote Admin.

The link provided will show login page of Nevernote shown below. There is a link to the registration page to where an account can be registered.

 
I tried logging in with both username and password blank and I got into Nevernote without having to register. (Apparently they accept blank username and password for account creation and someone had registered using that)

 Upon logging in, Nevernote shows all the notes and mails received.

Since the objective of this challenge is to obtain the note of the admin, I opened up one of the note to take a look.

From the page where they show the note, I notice that there is a 'enc=' field. The 'enc=' field seems to be use to fetch the note and is useful for this challenge. I decided to test it using the field with ../ to see if it vulnerable to directory traversal attack .

 It does generate any error so I decided to try a few more.

and after a few tries...

It shows the admin note that contains the key for this challenge.

key{akjdsf98LolCats234lkas0!#@%23Ferrari134545!@#250saDucati9dfL$Jdc09234lkjasf}

Enter the key and flag captured. 200 points.

Once upon a time  ^-^,
whit3sn0w

CSAW CTF 2013 :: Recon: Julian Cohen (100 points)

Only a Google search for "Julian Cohen" is given as the question.

From the judge's subpage (https://ctf.isis.poly.edu/judges/), you can find the twitter account for Julian Cohen which is https://twitter.com/HockeyInJune

Now we know that his nick is HockeyInJune. By searching using the nick, you can get to his Reddit page (http://www.reddit.com/r/HockeyInJune).

Look for his posting under the CSAW CTF 2013 where he have posted a link to a website: http://deathbycats.com/

Using "dig" command in Linux, you can find the ip address of the website which will be 23.23.196.37

Accessing the IP directly on the URL will show the flag. See screenshot below:

Regards,

David Billa
"Live for Something or Die for Nothing!"

CSAW CTF 2013 :: Bikinibonanza (150 points)

For this puzzle we are given a .net executable.

This is how it looks like when executed...

First thought: enter the correct key and hit on submit for the flag to be shown...
Lets fire up reflector to decompile this .net executable

There are several eval_?? functions when decompiled. The trick to figure out which eval_?? the statements are pointing to is to click on it in reflector, the program will direct you to the correct eval_?? function.

In one of the eval_?? function, we can see that it is doing some comparison work. The comparison might be the key to solving the puzzle. Let us copy this portion and write our own code...

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Security.Cryptography;

namespace test
{
    class Program
    {
        static int getkey(int num2, int num1)
        {
            return (new int[] {
                2, 3, 5, 7, 11, 13, 0x11, 0x13, 0x17, 0x1d, 0x1f, 0x25, 0x29, 0x2b, 0x2f, 0x35,
                0x3b, 0x3d, 0x43, 0x47, 0x49, 0x4f, 0x53, 0x59, 0x61, 0x65, 0x67, 0x6b, 0x6d, 0x71
             }[num1] ^ num2);
        }


        static void generate(string text1, int num1, ref string textRef1)
        {
            int num2 = 0;
            if (0 < text1.Length)
            {
                do
                {
                    char ch = text1[num2];
                    int num = 1;
                    if (1 < num1)
                    {
                        do
                        {
                            ch = Convert.ToChar(getkey(Convert.ToInt32(ch), num));
                            num++;
                        }
                        while (num < num1);
                    }
                    textRef1 = textRef1 + ch;
                    num2++;
                }
                while (num2 < text1.Length);

                Console.WriteLine(replacing(textRef1));
                Console.WriteLine(replacing(textRef1));
            }
        }

        static string replacing(string text1)
        {
            byte[] bytes = Encoding.ASCII.GetBytes(text1);
            return BitConverter.ToString(new MD5CryptoServiceProvider().ComputeHash(bytes)).Replace("-", "");
        }
        static void Main(string[] args)
        {
            String strB = null;
            DateTime now = DateTime.Now;
            string str2 = string.Format("{0}", now.Hour + 1);
            string str = "NeEd_MoRe_Bawlz";
            Console.WriteLine(str2);

            Console.WriteLine(str);
         
            generate(str, Convert.ToInt32(str2), ref strB);
        }


    }
}

on executing the above code we got this BEBF06D90D6F9652476D244470C66BEC

Throw this key into the application and we get the flag!

key(0920303251BABE89911ECEAD17FEBF30)

Always lazing

NoirD3vil...

ebCTF 2013 :: BIN200 (200 points)

The challenge for BIN200 is to uncover the hidden file contained within the given executable.

Step 1: Load the executable (ebCTF_BIN200.exe) in OllyDbg, run it and you will be prompted by the executable for a secret key. Looking through the codes reveal the executable was generated using 'Perl2Exe' - a command line utility for converting perl scripts to exe files. An interesting keyword found within the executable is '-p2x_debug', which shall be used later.

Step 2: View the events captured by OllyDbg. In OllyDbg, go to View > Log (Alt+L). There is an entry of a DLL file dumped in the AppData Temp folder. Examination of the DLL file reveals it is packed using UPX packer. Unpack the DLL using UPX unpacker.

Example:
 Address=28000000
 Message=Module C:\Users\Braeburn\AppData\Local\Temp\p2xtmp-4484\p2x5123.dll

Step 3: Rerun the executable in OllyDbg with '-p2x_debug' as the argument and debug information will be displayed in the command prompt. It's clear now the hidden file is '_main.pl'.

P2X: Debug mode enabled - V090508
P2X: Expanded module filename = C:\Users\Braeburn\Downloads\ebCTF_BIN200.exe
GetTempDir: returning C:\Users\Braeburn\AppData\Local\Temp/p2xtmp-4484
ISEXT_Init: filename = p2x_stub.lib
ISEXT_Init: filename = p2x_header.pm
ISEXT_Init: filename = p2x_pre_exec_message
ISEXT_Init: filename = p2x_trial_message
ISEXT_Init: filename = p2x_exec_command
ISEXT_Init: filename = p2x_info.pm
ISEXT_Init: filename = _main.pl
ISEXT_Init: filename = P2XDLL/p2x5123.dll
P2X: ISEXT_Init done
P2X: OpenScript: C:\Users\Braeburn\Downloads\ebCTF_BIN200.exe FOUND IN PERL2EXE_STORAGE

[*] ebCTF BIN 200
      No comment...

[*] What is the secret?

Step 3: Load the unpacked DLL in IDA Pro and search for the location where the string "ISEXT_Init: filename = " will be referenced. It will be located at address 0x280AC503. After examining the flow graph from that location onwards, it is clear a different path is needed in order to dump the files to the tmp folder.

Step 4: Re-run the executable, change the instruction at address 0x280AC52E from JNZ to JZ before EIP reaches address 0x280AC503 and you will find the perl script in the tmp folder.

The secret key and the flag to this challenge will be found within the perl script.

Secret key: "Sup3RSeCr3tStuFf!"
Flag: ebctf{ededb03c7998fa751be21d1364a58600}


Flag captured! 200 points in the bag!! Yay!!!

Cheers,
Braeburn Ladny