https://osiriz.dev/tags/ddc2024/Recent content in ddc2024 on OsirizHugo -- gohugo.ioen-usWed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/We are given the following url: http://toolbox.hkn Visiting the site we see that it is a toolbox of network diagnostic tools. If we look at the ping tool we can see that we are able to run other bash commands by separating them with a ;: We sadly cant just read the flag: We can see that this is because it is owned by root and only root has read permissions: So lets upload a revshell so then try and privesc from there.https://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/We are told that we can login over ssh at crontab.hkn using the username:password pair doomguy:doomguysEcReTpAsSwOrD, and to run tail -f read.sh.log. Logging in we are also told that crontab is running /etc/read.sh. So lets check the crontab, checking in /etc/cron.d/ we find execute-cron containing the line: * * * * * /etc/read.sh >> /home/doomguy/read.sh.log So the /etc/read.sh script is run every minute, lets check the permissions on the script:https://osiriz.dev/posts/2024/03/ddc-2024-qualification-affinity/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-affinity/We are given the following file: affinity.zip The task description introduces the affine cipher that works by encrypting cleartext x to ciphertext y in the following way: y = (ax + b) mod m for some constants a, b and m. We can see this in the gen.py script: #!/usr/bin/env python from math import gcd import random import binascii # Encrypt the text using the affine cipher y = (ax + b) mod m def affine_encrypt(text, a, b, m): result = 0 for letter in text: c = (a * letter + b) % m result = (result << 8) + c return hex(result) # Generate keys for the affine cipher and encrypt the flag if __name__ == '__main__': with open('flag.https://osiriz.dev/posts/2024/03/ddc-2024-qualification-campfire-stories/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-campfire-stories/We are given the website campfire-stories.hkn which looks like this: We can write the beginning of a story and the AI will continue it for us. Looking at robots.txt we get: # https://www.robotstxt.org/robotstxt.html # Maybe we should not train on company data? # Could our ftp credentials be leaked by the AI? # Probably not a problem. Nobody writes stories about ftp anyway # datacenter.campfire-stories.hkn should still be safe right? User-agent: * Disallow: / Allow: /$ Allow: /share/* Allow: /images/* Allow: /static/* Which seems to suggest that the AI bot can leak the ftp credentials, so let’s try: Convert Z3B0OTAwMA== from base64 gives us gpt9000, so lets login to datacenter.https://osiriz.dev/posts/2024/03/ddc-2024-qualification-they-see-me-subbin-they-hating/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-they-see-me-subbin-they-hating/We are given the following text: alojsgegvly uqecm teag jvayva regnqllo gqeahvyu uqmegkw ueomd cmd redmd cvdalzmq dgqmeo bnvkdg p ylzmkgw eyekwdg jqvmdg zmqpmvanyvd jqmddsqm dvmomyd nqd od djed nezm on alcmd djlhm uvqk mijlqgd danlkeqdnvjd oeysteagsqvyu zmqrek blqhmqd rllk dnm aloovggmc gmqqvglqvmd cvuvgek vytksmyamc gnlodly rmggw dvuy glgekkw alydgeygkw qloeygva gmqo bvyud uqmmam oegg avekvd tmmd djmavtw clyekc eqod xsm ueooe jkewvyu olcvtw be mkdm jsojd qeqm gnsycmq tklbd neo nsyg reahsj evqjkeym alzmqd jqltmddlq tklwc dgvah zmyclqd teqovyu umygkmoey qmmt jeg tedgmq qmjkvaegvly uorn qlahmg ymbeqh euvyu dgeqdomqaneyg fscuomyg yly lqek gnmge qmomormq aml cmakeqegvly ecmxsegm bvkckvtm eolsyg qu csyaey rmccvyu yk oeqgvy ecovyvdgqeglq ywkly klbd vyaksdvly uvd dmmd vygmqmdgvyu cmdgqlw aljvmc hegvm jljskegvlyd bvtm jqldglqmd bednmq dmaglq jeqgd vygmqdgegm ljg dlqg jmqtmagkw migmydvlyd osdgeyu dmmhmq vgmo dmovyeq gqeyddmisek eaamdd dvuyvtvaeyg dhvj dsjmqzvdlq olgnmq qmcsavyu ovcyvung rkmdd qeo dglqmc neqcalzmq jqlamcsqmd oeg mieojkmd egoldjnmqva evqkvym vygmqmdgmc qmecd mojklw vytqvyumomyg qmjkeamc amygqm qlde hvkkmc av gsrm gmyc gdsyeov owmqd ieyei kvdg oewlq gvggmy bnvkdg aneyamkklq oevygevyd avqasodgeyamd qekmvun kvervkvgw olydgmq rqectlqc omedsqmomyg jwgnly zmumgeqvey eygnqljlkluw uvzm vygmycmc rq aegd ecc djlqgd qecvegvly dezmc jqlzvyavek laasqd gei daqvjgvyu kmggmq gqezmkmq eodgmqceo aneormq acg aneqeagmqd qmomormqmc gqmedsqmq oevkgl eczmqgvdvyu cmah ae bmc qmdvcmyg anqlyvakm dgmjd yezw sqrey rqmedg olqek mijldsqm lsung omedsqm kvyh alytvusqmc clyegm jskk vytmagvlyd rh djmavekd cllqd dmkkvyu qmjqmdmygegvly ovysd gmkmjnlyw alksoyd dmkkd mimasgvzmd deo alqqmdjlycvyu qvah glkmqeyam tlaek fmttqmw tmegsqmc rsggly glsanmc rwgm cegm dsrkvom oo gneyhduvzvyu tvggmc oedly jmymgqegvly clomdgva tlasd aeojd djmyamq gtg rkmdd key ezlvcvyu bmmhmyc eumc reqqvmqd rsah dvoskegvly rklu alygvymyg eczlaegm bmkdn zmqrek bnldm bvkmw alljmqegvzm gvomkvym asdglovpmc jlsq eddsojgvlyd rklahd ca mdgegmd jsqdsm nggj jkeamc mqqlq omcvaek ecljgvly aeko ejjqlean ueovyu lqcvyeqw dlomgnvyu oegmqvek aedsek keor eylywolsd ymvunrlq dbvganmd sb bmkkd alygmyg qmovyc yevkd nvunmdg qeyumqd aekkvyu nekt rh teggw mijl jlkvdnmc desam dgscvmc gneyhd cmolydgqegm nlrrw et yehmc qmtmqmyamd vyclymdve mcvyrsqun aneqgd qlrsdg qmfmagmc dgeqd neydmy rllo miamdd ajs tvko zvlkmyam rsd jkewreah clomdgva om jmyekgvmd gqvzve uqlzm qvungd cqso sycmqdgeyc bnmqmed alojsgegvlyek laasjvmc lqvmygek oequvy rlysd mijkvavg alyt ekvzm ymbaedgkm ymmcmc vyhfmg jsrkvdnmq qmyevddeyam ekgmqyegvzmkw jsr dsrfmagvzm jlvyg lsq gre uylom cwyeovad uvqkd alkkmagmc anqvdgveyvgw eyekwpm bekkeam alek gqeydvgvly tvung mijmycvgsqm olglqawakm jdwanlkluvaek by deqen qeavek dgljd alygeagvyu jqevqvm tvdnvyu yshm keah uqed kmet aejvglk jct mygqvmd eqmye umluqejnw jsppkmd cvdymw eqvdm db mzeksegmc rmqhmkmw vycveye migmydvlyd myclqdmc alydmqzegvly ovyvoso yskk clm escvg dedheganmbey ymbdjejmqd odu anmahmc alyamqg dc vygqlcsamc teag anequmq eyylsyam ed rklu CCA{bmkalom_gl_cca_gbmygw_gbmygw_tlsq_kmgd_cl_dlom_aqwjgl} The last part (CCA{bmkalom_gl_cca_gbmygw_gbmygw_tlsq_kmgd_cl_dlom_aqwjgl}) seems to be the encrypted flag, from the title we can guess that this is a substitution cipher.