CodeGate CTF 2011 : Binary - 100 Points

CodeGate CTF 2011 : Binary - 100 Points

File given to us:
This is the original file:
87C483A4CA85374E98FFB85FD5E867EC.zip

Recommended Tools:
Google
Luck+memory
Windows Script Decoder (http://www.virtualconspiracy.com/index.php?page=scrdec/intro) - Decode encoded stuff by Microsoft Script Encoder
FireBug (http://getfirebug.com/)
TriD (http://mark0.net/soft-trid-e.html)

Analysing the File:
Using file and TriD and i cannot correctly identify what is this file. Then i opened up in Notepad++ and i find it familiar.
Thank goodness i'm a fan of Yosuke Hasegawa and i saw that this file bears resemblance to his jjencode (http://utf-8.jp/public/jjencode.html)

Ok, now i may be on the right track that this file may be encoded with jjencode...so how do i decode this? :(
I started googling for a decoder and i found this website (http://www.e-x-e.dk/2011/07/28/jjencode-decoder-jjdecode/).
But sadly it couldn't work for this. :(

Solving the Puzzle:
Finally, after several hours. i found this, Microsoft Script Encoder (http://www.microsoft.com/download/en/details.aspx?id=3375).
Could it be using this? So instantly i googled for the decoder for this and i found this useful tool, Windows Script Decoder (http://www.virtualconspiracy.com/index.php?page=scrdec/intro).
So i downloaded and tried it and i got back some Obfuscated looking Javascript like this.



Immediately, i placed the Obfuscated Javascript into a html file and start using Firebug to debug it.
Finally, i got the following key CodeGate_JavaScriptEncode_Key with value "120a151156120a163t111163120lea163u162e!" in the DOM tab. :P




cheers
0x4a61636f62

CodeGate Qualifiers CTF 2011 : Network - 100 Points

CodeGate Qualifiers CTF 2011 : Network - 100 Points

Hints given to us:
I didn't write down the exact hints for this but i remember vividly that the answer will be in the form of MD5 hash of a file.

This is the original file:
File:117A1160EC201EB79D2331A3E3C2979D.zip

Recommended Tools:
Linux's "file" & "md5sum" commands
Wireshark (http://www.wireshark.org/) - For sniffing and analysing traffic.

Identifying the File:
Using Linux's file command, we have identified this file as a pcap file. That makes sense since it is in the Network category. :P
Ok, now let's fire up our Wireshark and take a look at the pcapfile.
Since we are given a clue of finding the MD5 hash of a file.
Let's check out all the files in this given pcap file.

First we click File -> Export -> Objects -> HTTP



Geez....a lot of files in there. Finally, we notice there is a H1A1.exe file
Let's click on that and "SaveAs".

Final Solution:
Now let's use "md5sum" on the exported file and the returned results is "7A5807A5144369965223903CB643C60E"
So i tried that as the key and it worked. :D

cheers
0x4a61636f62

CodeGate Qualifiers CTF 2011 : Crypto - 200 Points

CodeGate Qualifiers CTF 2011 : Crypto - 200 Points

Hints given to us:
Find a key.
SCMPKBOUPDPHYTIAVIVRBTMVORUDNBDFNETDOIVTXROUNDKOBFWBPVOEQLTGKKARACYCGDNAECBXIZIKPTLEERZTYCYKIVXCPKPTPOVCAQRHRVKJUWMTWCMSXKADYHRVNAHCBRVSVSSCQCZQYDJXGSNRVSWCESTTBHIFCIASXRTAHKRRTUMVOKWITZPFZDISXZVVLGETPPLKSELDPGKELSHCBJBWXBIFCPEZYNBWXCDYMGAOVWNDKAKKKWBBQKPTIODKMGGHRVVNHINFCQESDYMLACVVBWBBQROPBBDFOXOSKDIGZWXFNTKFYIICWHRVVNHIYILTKHRVXPISB

This is the original file:
File:CodeGate_2011_Crypto_200.txt

Recommended Tools:
Brains - Actually, more of guesswork.
pygenere (http://smurfoncrack.com/pygenere/pygenere.php) - For cracking ciphertext using Vigenere cipher.

Finding the "Cipher" behind the Puzzle:
Looking at the given ciphertext, it seems to strongly suggest that it could be a polyalphabetic cipher.
This time round, i made use of www.simonsingh.net again to check which cipher it could be using.

Finally, i tried Vigenere cipher using the following link.
http://www.simonsingh.net/The_Black_Chamber/vigenere_cracking_tool.html

The returned results is as followed:


It seems to suggest that if the ciphertext is indeed using Vigenere cipher, the possible key length is 2,3 or 6.
Final Solution:
So using pygenere (http://smurfoncrack.com/pygenere/pygenere.php), i've tried entering explicitly 2 followed by 3 and 6 as the keylength.
Only keylength, 6, give me back sensible english words like the following picture.



On top of the page is the returned keyword that pygenere returned to me. So i've tried that as the key and Bingo.


Using "KRIPTO", we solve this challenge. :D

cheers
0x4a61636f62

CodeGate CTF 2011 : Crypto - 100 Points

CodeGate CTF 2011 : Crypto - 100 Points


File given to us:
This is the original file:



Recommended Tools:
Brains


Solving the Puzzle:
First, i took a look at the image and all i can see is numbers. o.O"

After looking at the image for an hour or so, then i realised something is strange as it didn't contain "0" and "1".

I just couldn't figure it out until my phone rang and i saw the "abc" on the keys.

Hmmm...could it be using that to change the numbers to actual letters?

So i took out my old handphone and type in numbers via a SMS and i got back this text.

In cryptography, a substitution cipher is a method of encryption by which units of plain text are replaced with cipher text according to a regular system.
The units may be single letters, pairs of letters, triplets of letters, mixtures of the above.
This cipher text is encrypted by telephone key pad, so we call this keypad cipher.

Correct Key:
So i type in keypad cipher and we added another 100points.

cheers
0x4a61636f62

Solution for bright-shadows.net : Exploit 02 Analyze This 1

Solution for bright-shadows.net : Exploit 02 Analyze This 1

This is the link to the original challenge http://www.bright-shadows.net/challenges/exploits/exploit_analyse1/index.php
However, you will need to register before you can make an attempt to solve this.

---

Tools Used: ---

This challenge is about Directory Traversals.

There are 2 scripts and the goal is to supply a input for the GET parameter of url so as to gain access to /user/www/index.php

Let's take a look at the first script

$url   = str_replace("../","",$_GET['url']);
$hfile = fopen("/user/www/challenges/$url", "r");

These 2 lines are the important part.

The script replaces all instances of "../" with "". As the fopen function starts in the challenges folder, you have to traverse 1 directory up to access the goal.

This filter can be easily bypassed by entering something like ".../...//index.php".
When the filter replaces the characters, the fopen function will open the following file:

/user/www/challenges/../index.php

Let's take a look at the second script

if((strpos($_GET['url'],"../") === false)
     AND (strpos($_GET['url'],"://") === false))){

     $hfile = fopen("$url", "r");

These 3 lines are the important part.

The script checks if the input contains any "../" or "://" character sequences. If there is, it displays an error page and aborts the opening of the file. In this case, we are unable to perform reverse directory traversal.

However, on a closer look, the fopen function directly uses the url parameter without any prefix or affix path. It is possible to get to the goal page by just entering the exact directory path "/user/www/index.php"

Enjoy =D

thegrayone

Solution for bright-shadows.net : Exploit 01 Easy Starter

Solution for bright-shadows.net : Exploit 01 Easy Starter

This is the link to the original challenge http://www.bright-shadows.net/challenges/exploit_long/index.php
However, you will need to register before you can make an attempt to solve this.

---

Tools Used: Tamper Data or Firefox Console

This is an easy warmup.

We are presented with a login page and a clue stating that the username should be at least 5 characters long but less than 20.

Let's try passing in invalid usernames.

Login with a username with less than 5 characters.
An alert box pops up saying that this is not the solution.

Next lets try logging in with a username which is more than 20 characters.
Here is where the problem is. The form input restricts the max length to 20 characters.

There is 2 ways to bypass this.

1)  Tamper Data

Tamper Data is a addon for Firefox. I highly recommend to install this addon as it will help with many of the exploit challenges on bright-shadows.net

Using Tamper Data, we can tamper the post parameters that are sent after the submit button is clicked.

2) Firefox Console

If you are using Firefox, you can bring up the Firefox console (Ctrl + Shift + K).

After which type the javascript command "document.forms[0].elements['input_user'].maxLength = 30;" into the console. This alters the html document and the form now allows you to enter up to 30 characters in the username field.

Using either method, submit a username that is longer than 20 characters and the resulting "error" page gives you the correct username and password to login with.

Enjoy =D

thegrayone

Solution for www.net-force.nl : Level 307 Sea Code

Solution for www.net-force.nl : Level 307 Sea Code

This is the link to the original challenge: http://www.net-force.nl/challenge/level307/

Quest:

Decode the code below and then you'll have the password for this level (password is lowercase).

- .... . .--. .- ... ... .-- --- .-. -.. ..-. --- .-. - .... .. ... .-.. . ...- . .-.. .. ... .-- . .-.. .-.. -.. --- -. .

This is quite easy. At first glance, we know that this is a morse code puzzle.
So let's use a Morse Code to Text translator.

I'm using this website's translator. :D

http://morsecode.scphillips.com/translator.html

Using that i got back the following. :D

"THEPASSWORDFORTHISLEVELISWELLDONE"
So the password to this challenge is.
Password: "welldone"

Cheers

0x4a61636f62

Solution for www.net-force.nl : Level 404 Hiding in a pipe

Solution for www.net-force.nl : Level 404 Hiding in a pipe

This is the link to the original challenge: http://www.net-force.nl/challenge/level404/portal.php

Quest:

Hack this 'portal' to find the password :-)

This puzzle is an easy one. The hint given to us is hiding in a pipe. The portal provide us with 3 forms which allow us to DES crypt, finger a user and ping itself. As shown below...

 

Now we all know that ping is a standard command... could it be that the server take in the text box value and pass it off as a command? let us try to modify ping netforce.nl to ls instead... ah... somehow it failed... there must be some sort of filtering... but wait what will happen if we were to pipe another command behind this ping? Let us try "ping netforce.nl | ls" in the textbox...

wow... we got something here.... whats in info.txt?

try this link: http://www.net-force.nl/challenge/level404/info.txt
it states... Nice one, you have finished the first part...proceed

=( continue to part 2... there is a protected folder... question is how do we get to the folder when an authentication is required...

ah... remember in the portal.php? there is a finger user textbox with a default username in it: "BasTijs". But no password is given... let us just try the username with no password... bingo we got in! It shows us the files in the protected folder and solution.php is the password to this puzzle.

Password: pijpme!

Cheers

3lucidat0r

Solution for bright-shadows.net : JavaScript - Hard but possible.

Solution for Bright-Shadows.net : JavaScript - Hard but possible.

This is the link to the original challenge: http://bright-shadows.net/challenges/levelj4/index.php

However, you will need to register before you can make an attempt to solve this. 

Quest:

Only input a valid username and you will get to the solution page.

As this is the easiest one, let's just do a quick "view-source" and we can quickly spot the following Javascript.

<script type="text/javascript">
  function testEncode(form){
    input_user = document.formular.user.value;
    if (input_user == "thebestoneisthis") {
        window.location.href="thebestoneisthis.php";
    }else{
        window.location.href=input_user +".php";
    }
}
</script>

As we can see, it is trying to validate whether our input value matches "thebestoneisthis"

You see "thebestoneisthis" and that's the password.

That's pretty easy for everyone to understand. :D

Cheers

0x4A61636F62

Solution for bright-shadows.net : Crypto - Easy starter!

Solution for Bright-Shadows.net : Crypto - Easy starter!

This is the link to the original challenge: http://bright-shadows.net/challenges/levelc1/crypto1.php
However, you will need to register before you can make an attempt to solve this. 

Quest:

The decrypted text will tell you the solution.
tedespqtcdezypozyzeqzcrpeesleespalddhzcotdlsopqufvwrcmodprq

The first thing that came to my mind for all basic crypto challenges is Caesar's Cipher.
Immediately, i thought of using this to help me to do a quick check whether my hunch is correct.
 

After some tampering with the shifting, it seems that N got to be 15. In other words, shift 11 to the right and we got back the following:

itsthefirstonedonotforgetthatthepasswordisahdefjuklgrbdsegf

The author of this challenge just concatenate it altogether and the password to the challenge is "ahdefjuklgrbdsegf" without the double quotes.

That's pretty easy for everyone to understand. :D

Cheers

0x4A61636F62