https://osiriz.dev/tags/ddc2023/Recent content in ddc2023 on OsirizHugo -- gohugo.ioen-usSun, 07 May 2023 21:30:00 +0200https://osiriz.dev/posts/2023/05/ddc-2023-nationals-a-thousand-pieces/Sun, 07 May 2023 21:30:00 +0200https://osiriz.dev/posts/2023/05/ddc-2023-nationals-a-thousand-pieces/We are given 40000 4x3 PNG files split evenly into 4 directories: $ find . -iname "*.png" | wc -l 40000 $ ls -lh total 0 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 0 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 1 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 2 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 3 So we just need to reassemble the image from all the sections.https://osiriz.dev/posts/2023/04/ddc-2023-regionals-png-magic/Tue, 18 Apr 2023 19:00:00 +0200https://osiriz.dev/posts/2023/04/ddc-2023-regionals-png-magic/We are given magic.png file, which we cannot open: Lets try and open it in hexedit to look at the file header: Seems like the PNG magic bytes is missing, so we write them in: But we still fail: Lets use pngcheck to see what is wrong: If the open the file in hexedit again we can see that the IHDR chunk was renamed to JHDR: Lets change that: Lets check it now: Lets fix the checksum: We can know open the image: Hmm… no flag, seems like we are missing something, lets see if we can add some more height to the image.https://osiriz.dev/posts/2023/04/ddc-2023-regionals-one-time-too-much/Sun, 16 Apr 2023 20:00:00 +0200https://osiriz.dev/posts/2023/04/ddc-2023-regionals-one-time-too-much/We are given a python script that encrypts two strings (both with the flag appended) with a random one time pad: import os # read flag in as bytes with open("flag.txt", "rb") as f: flag = f.read() # XOR's two bytestrings together. def xor(a,b): xor_result = b'' for i in range(len(a)): xor_result += bytes([a[i]^b[i]]) return xor_result # sample a completely random 200 byte one time pad! one_time_pad = os.urandom(200) # two similar messages are sent using the same pad.https://osiriz.dev/posts/2023/03/ddc-2023-qualification-baby-rsa/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-baby-rsa/We are given a text file: babyRSA.txt, with the following contents: n = 14591059584728658996740718896274912924434702993948401065953397352995339910088088733574991258740736943162240984607294149798518974390850442269320587130740348332766777840789060640046077889381042022860333067208949242541537029834713571632092399544412860224638358821688934376008405448120397447357043233351572894555161097157298917757903358450051781374553895783095933436102637259148017787894728417663857683547045820798741292596714992103546619732559091189051271145488307258679223962750029735466371748284344268969024995984222371842720543906957141892627260247305180561557377683921023735478606199803707739027008690484139631874629 e = 65537 ciphertext = 8370482736029746802272435856905582692197472046878613623126167436276048925497192051855114861968301986740953539053163947192721440270870275675104799441533614895688983570828061357190863655539868022793932838551215620997098363666548621341103618946043035652810120255282119559608036421751056052625158822827831595069995146507062852262681451781903083499147508262669740286416571718635819352694698805949316507535002658526810142183807237137069555203580152352863371601204706128986849512578411079323120877340385328130962702308650000566212396403238074531227510385807269241298909102687880672710693216031720613169757344140890527855180 # What's the plaintext? this might help! p = 135118121033494444903135040650593867761183730711309803684324950423162537667458806301698825106852556296618752800474983408511120590602816857766798006294318907531661438883032776328539787015720714526094491835105378129306305286637613861991613352256006427593441280185940386266360182068694185435614508146253927535219 q = 107987437015288865195226926953887120405158392241008731414825285641627743723768153549068145296919127709072426332548919995869779098499543714252696254999551997426879319789809420841712042595904693470932881039466995302317325926476459209840274875302406142467069199349897038463278476940799410775560424588456195916391 We know from the name, that this most have something to do with RSA, and that we have the n, e, ciphertext, p and q values. We can plot these into www.dcode.fr/rsa-cipher: And we get the flag: DDC{Crypto-was-great-but-why-was-there-no-RSA}https://osiriz.dev/posts/2023/03/ddc-2023-qualification-flipping-privilege/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-flipping-privilege/Recon and Introduction We are given the website http://privilege.hkn and the app.py that it is running: #!/usr/bin/env python3 from flask import Flask,request,Response,render_template,abort,make_response import json,random,os,base64 from Crypto.Cipher import AES ### Global variables app = Flask(__name__) secret_key = os.urandom(16) ctr_nonce = os.urandom(8) def gen_user_cookie(): cookie_dict = {} cookie_dict["access_level"] = "User" pt = json.dumps(cookie_dict).encode() cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce) ct = cipher.encrypt(pt).hex() return ct def check_admin_cookie(cookie): ct = bytes.fromhex(cookie) cipher = AES.https://osiriz.dev/posts/2023/03/ddc-2023-qualification-psssssyducks/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-psssssyducks/Recon and Introduction At the given url (http://psyducks.hkn), we are met by the image of a psyduck: Devtools If we inspect the HTML in devtools, we can see that the image comes from /content?psyduck=brick: Going over to the storage tab in the devtools we can see that we have a cookie set for this site: We can decode it from base64 in cyberchef and see what it contains: It seems that the cookie contains a list of psyduck variants, if we change the brick from the /content?https://osiriz.dev/posts/2023/03/ddc-2023-qualification-the-key-store-version/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-the-key-store-version/We are asked to find the version of a key-value store hosted on keystore.hkn. We first look for open ports using nmap: $ nmap -p- keystore.hkn Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-20 10:30 EDT Nmap scan report for keystore.hkn (77.184.238.37) Host is up (0.00025s latency). Not shown: 65534 closed tcp posts (conn-refused) PORT STATE SERVICE 6379/tcp open redis Nmap done: 1 IP address (1 host up) scanned in 3.https://osiriz.dev/posts/2023/03/ddc-2023-qualification-what-is-logging/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-what-is-logging/We are given a text file called logs.txt, it is 953 lines long and 243 Kilobytes big: $ wc -l logs.txt 953 logs.txt $ ls -lh logs.txt -rw-r--r-- 1 osiriz osiriz 243K Mar 20 10:30 logs.txt We can find the flag with grep: $ grep "DDC{" logs.txt 130.225.166.251 - - [25/Feb/2023:12:42:51 +0100] "POST /submit/flags/what-is-logging/DDC{CR4ZY-L0NG-F1L3S-C4N-B3-S34RCH3D} HTTP/1.1" 200 5082 "https://api.ntp-event.dk/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.