https://osiriz.dev/tags/writeup/Recent content in writeup on OsirizHugo -- gohugo.ioen-usSun, 06 Apr 2025 15:00:00 +0200https://osiriz.dev/posts/2025/04/ddc-2025-regionals-intranet-madness/Sun, 06 Apr 2025 15:00:00 +0200https://osiriz.dev/posts/2025/04/ddc-2025-regionals-intranet-madness/Challenge Description Danish (Original) Blækspruttespillene er i gang. De har sat en kommunikationsplatform op til deltagerne, og deltagerne yapper løs. Login med bruger: 456 og password: password, eller opret din egen bruger for at deltage! intranetmadness.hkn:8090 English (Chatgpt) The squid games are underway. They have set up a communication platform for the participants, and the participants are chatting away. Log in with username: 456 and password: password, or create your own account to participate!https://osiriz.dev/posts/2025/03/ddc-2025-qualification-ddc-admin-bot/Tue, 18 Mar 2025 13:00:00 +0100https://osiriz.dev/posts/2025/03/ddc-2025-qualification-ddc-admin-bot/Challenge Description Danish (Original) Vi har lavet en super sej discord server til alle DDC Admins. For at gøre det let at tilføje nye admin har jeg lavet en bot! Her er et link til serveren. I får også sourcekoden så I kan se hvordan den virker. English (Chatgpt) We have created a super cool Discord server for all DDC Admins. To make it easy to add new admins, I have made a bot!https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-24-ragnarok-et-al./Tue, 24 Dec 2024 15:59:24 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-24-ragnarok-et-al./Challenge Description Danish (original) Efter alt den hjælp vi har fået har FDCA’s SPECOPS endelig kunne trævle gennem nok af jættenettet og fået adgang til en service vi forventer kan se fremtiden. En digitalisering af Mimir’s eksistens. Ja, Odin fortæller os ligefrem, at den har svaret på livet, universet og alting. Vi har dog noget svært ved at kommunikere med den. Den taler ikke samme sprog som os og snakker bare om “Magiske sekvenser”.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-23-den-indpakkede-gave/Tue, 24 Dec 2024 15:59:23 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-23-den-indpakkede-gave/Challenge Description Danish (original) Thor har modtaget en besked fra jætterne, som hævder at have krypteret et vigtigt juleflag i en digital gave. Kun de, der kan afkode beskeden og bryde jætternes obfuskerede logik, kan hjælpe Asgård med at genoprette flaget. Kan du finde flaget og redde julen? English (from chatgpt) Thor has received a message from the giants, claiming to have encrypted an important Christmas flag in a digital gift.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-22-j%C3%A6ttebit-2.0/Tue, 24 Dec 2024 15:59:22 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-22-j%C3%A6ttebit-2.0/Challenge Description Danish (original) I et dristigt hack-back forsøg efter Jætterne har krypteret Æsirne, er du blevet udvalgt til at afdække svagheder hos den frygtede ransomwaregruppe JætteBit 2.0. Gruppen skulle angiveligt have terroriseret organisationer verden over, og nu er det tid til at gøre en ende på dem en gang for alle. Din mission er simpel: Søg med lys og lygte efter cleartext credentials som kan bidrage til hack-back missionen. Måske har de været så ivrige efter at offentliggøre deres ofre, at de har glemt deres egen sikkerhed som kunne afsløre brugernavne, adgangskoder eller andre følsomme data, gemt i hemmelige filer.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-21-det-nordiske-v%C3%A6rksted/Tue, 24 Dec 2024 15:59:21 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-21-det-nordiske-v%C3%A6rksted/Challenge Description Danish (original) Velkommen til Det Nordiske Værksted Frej har endelig fundet sin hjerteven, i hans helt egen webshop. Det Nordiske Værksted er stedet, hvor kunder ikke bare køber julepynt, men også går på opdagelse i en verden af nordisk inspiration. Mange besøgende elsker at tage sig tid til at kigge rundt på siden, nyde udvalget og lade sig opsluge af stemningen. Men er den helt sikker? English (from chatgpt) Welcome to The Nordic Workshophttps://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-20-exfiltering-i-asg%C3%A5rd/Tue, 24 Dec 2024 15:59:20 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-20-exfiltering-i-asg%C3%A5rd/Challenge Description Danish (original) Vi har opsnappet noget netværkstrafik, der tyder på, at Jætterne har haft adgang til Asgårds filservere og har exfiltreret filer. Vi frygter, at nogle af disse filer indeholder følsomme oplysninger, som Jætterne vil bruge til at afpresse Thor. Denne situation er kritisk, og vi har brug for din hjælp til at finde ud af, hvad der er blevet stjålet, før Jætterne kan gennemføre deres plan. English (from chatgpt) We have intercepted some network traffic suggesting that the Giants have had access to Asgard’s file servers and have exfiltrated files.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-19-naglfar/Tue, 24 Dec 2024 15:59:19 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-19-naglfar/Challenge Description Danish (original) Naglfar er drevet i land under sommerens stråler. Naglfar hviler nu i en smuk sø. Ikke langt fra søen ligger et velkendt monument, som indeholder ældgammel kryptografi. Det er en meget velkendt mand som har skrevet denne kryptografi i tidernes morgen. Hvad er navnet på søen, Naglfar ligger i? Hvilken moderne teknologi er forbundet med denne mand? Du skal selv sammensætte flaget. Flagets format er således: FDCA{navn_på_sø_teknologi}https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-18-thorbit/Tue, 24 Dec 2024 15:59:18 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-18-thorbit/Challenge Description Danish (original) Thor, den mægtige tordengud, har udført en utrolig bedrift – han har kastet Mjølner, sin legendariske hammer, med så enorm kraft, at den nu kredser om Jorden i en uendelig himmelsk bane. Men Mjølner er jo ikke bare et almindeligt våben. Overladet med elektricitet sender den kraftige lynimpulser ned mod planeten. Disse impulser er ikke kun ødelæggende gnister; de bærer mystiske signaler på tværs af det elektromagnetiske spektrum, krypteret med Mjølners krav til Thor, for at vende tilbage til sin retmæssige herre.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-17-cats-and-codes/Tue, 24 Dec 2024 15:59:17 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-17-cats-and-codes/Challenge Description Danish (original) ÅH NEJ!! Jætterne har ændret Odins katte billeder, Odin er dybt bedrøvet over dette og forlanger at dette udbedres. Derfor har han bedt os undersøge, hvad jætterne har gjort ved hans katte. English (from chatgpt) Oh no!! The giants have altered Odin’s cat pictures, and Odin is deeply saddened by this and demands that it be fixed. Therefore, he has asked us to investigate what the giants have done to his cats.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-16-j%C3%A6tte-tracker-9000/Tue, 24 Dec 2024 15:59:16 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-16-j%C3%A6tte-tracker-9000/Challenge Description Danish (original) Jætterne er blevet avanceret, så vi skal have en mere systematisk tilgang til at finde dem. Odin har fået nogen til at lave et jætte tracking system. Det er noget magi som får det til at virke, men er magi altid sikkert? English (from chatgpt) The giants have become more advanced, so we need a more systematic approach to finding them. Odin has had someone create a giant tracking system.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-15-no-command-here-part-2/Tue, 24 Dec 2024 15:59:15 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-15-no-command-here-part-2/This is a continuation of No command Here - Part 1, we will be using the same private key and domain from that challenge. Challenge Description Danish (original) Din indsats med at aflure Loke’s tankeboks har været værdsat. Der er dog tegn på at denne tankeboks indeholder mere end bare Loke’s tanker. Han og Fenris har historisk været meget tætte, så vi er overbeviste om at Loke havde bare lidt adgang til Fenris egen tankeboks.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-14-no-command-here-part-1/Tue, 24 Dec 2024 15:59:14 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-14-no-command-here-part-1/Challenge Description Danish (original) FDCA Special Ops har, siden vores første kontakt med Asgård, haft gang i en operation med at kortlægge Jættenettet. I går lykkedes det dem at identificere noget, der ligner en tankeboks fra Loke. De har fået opsnappet en fil som ser ud til at give adgang. Men da de allerede er fuldt optaget af deres nuværende operationer, håber vi at du kan finde noget interessant i tankeboksen.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-13-hels-key-hell/Tue, 24 Dec 2024 15:59:13 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-13-hels-key-hell/Challenge Description Danish (original) Vi har opsnappet et meget kryptisk signal mellem Hel og Loke. Det har dog vist sig besværligt at bryde deres Ase Existens Skjuler kryptering, selvom nøglen allerede stod deri, og ECB burde være easy at knække. Det er som om vi bare bliver ved med at få samme resultat, når vi prøver at dekryptere den. Måske du har bedre held med at knække signalet? English (from chatgpt) We have intercepted a very cryptic signal between Hel and Loki.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-12-j%C3%A6ttelatterens-hemmelighed/Tue, 24 Dec 2024 15:59:12 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-12-j%C3%A6ttelatterens-hemmelighed/Challenge Description Danish (original) I en skjult dal i Asgård har jætterne udviklet en algoritme, som de hævder er uigennemtrængelig. Vi har fået adgang til nogle filer på tilforladelige måder. Herunder det output, der var på skærmen, da jætterne krypterede en vigtig besked. Vi har desværre ikke nogen der er kyndige i jættekode. Måske du kan cracke deres kryptering? English (from chatgpt) In a hidden valley in Asgard, the giants have developed an algorithm that they claim is impenetrable.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-11-duckfuscation/Tue, 24 Dec 2024 15:59:11 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-11-duckfuscation/Challenge Description Danish (original) Vi har modtaget efterretninger om, at dele af vores hemmelige kildekode samt adgangskoder er blevet sat til salg på darkweb. Som led i efterforskningen har vi afhørt vores udvikler “Loke” og beslaglagt hans workstation til nærmere undersøgelse. Under afhøringen var Loke ikke til stor hjælp; han snakkede konstant om Django, og til sidst var det kun et spørgsmål om sekunder, før IR-holdet, der udførte afhøringen, ville ty til andre metoder for at få ham til at tale.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-10-the-jotun-lockdown/Tue, 24 Dec 2024 15:59:10 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-10-the-jotun-lockdown/Challenge Description Danish (original) Jætterne har forvoldt kaos i Asgaard ved at hacke en vigtig server og krypteret essentielle filer med deres ransomware. De kræver løsepenge for at frigive dem, men heldigvis har de lavet fejl i deres kode, som gør den langt fra uigennemtrængelig. Under undersøgelsen blev både ransomware-programmet og en krypteret fil fundet. Advarsel: Ransomware-programmet er live-malware og kan udføre skadelige handlinger. Undersøg det kun i et sikkert og isoleret miljø, eksempelvis en virtuel maskine uden netværksforbindelse.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-9-thors-digitale-l%C3%B8sning/Tue, 24 Dec 2024 15:59:09 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-9-thors-digitale-l%C3%B8sning/Challenge Description Danish (original) Efter Thors debut på sociale medier har han mistet interessen i at styre vejrforholdene i Midgård. Der er simpelthen alt for mange andre ting som han skal tage sig af. Han har derfor valgt at finde en digital løsning og har downloadet et program, som kan hjælpe ham med at bestemme, hvordan vejret skal være på en given dag. Odin er ikke tilfreds med situationen og har samtidig mistanke om, at jætterne kan være involveret.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-8-odins-hemmelige-besked/Tue, 24 Dec 2024 15:59:08 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-8-odins-hemmelige-besked/Challenge Description Danish (original) Heimdall har forsøgt at sende en besked til Odin. Dog er filen kommet i de forkerte hænder og måske har jætterne pillet lidt ved filen. Odin har aldrig modtaget filen. Måske du kan hjælpe med at finde ud af hvorfor filen ikke virker? og hvad er det helt præcist er blevet sendt fra Heimdall til Odin? English (from chatgpt) Heimdall tried to send a message to Odin.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-7-sukkerkolde-cyberkrigere/Tue, 24 Dec 2024 15:59:07 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-7-sukkerkolde-cyberkrigere/Challenge Description Danish (original) Cyber-Operations Command Centeret er efter flere dages hårdt arbejde gået fuldstændig sukkerkold, så kokken Andrimner finder dokumentet med æbleskivernes lokation frem fra skuffen - men hov! Jætterne har tilsyneladende krypteret teksten!? Heldigvis finder Andrimner krypteringsrunerne, som skurkene i deres hast ud af køkkenets server har tabt i filsystemet. Kan du dekryptere æbleskiver.runes? English (from chatgpt) The Cyber-Operations Command Center has gone completely sugar-sweet after several days of hard work, so the chef Andrimner pulls the document with the location of the æbleskivers from the drawer – but wait!https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-6-hvor-lagde-du-filerne-thor/Tue, 24 Dec 2024 15:59:06 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-6-hvor-lagde-du-filerne-thor/Challenge Description Danish (original) Vi har modtaget kritisk efterretning fra Asgård: Jætterne har stjålet hemmelige dokumenter fra gudernes arkiver, og de planlægger at bruge informationerne til at ødelægge Yggdrasil én gang for alle. Det eneste spor vi har, er et billede fundet efterladt i en af Jætternes skjulte lejr. Odin mener, at dette billede kan indeholde skjulte data, der kan føre os til de stjålne dokumenter. Din opgave er at undersøge billedet for skjulte informationer.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-5-the-code-for-christmas/Tue, 24 Dec 2024 15:59:05 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-5-the-code-for-christmas/Challenge Description Danish (original) Julen nærmer sig med stormskridt, og Thor har igen formået at skabe problemer. Denne gang har han mistet den hemmelige kode, der skulle aktiveres for at starte festen i Asgård! Odin var overbevist om, at en digital løsning var fremtiden og havde fået Loke til at udvikle et system, hvor kun den rette kode kunne låse op for Valhallas julefest. Men selvfølgelig havde Loke en skjult dagsorden, og nu vil han ikke give koden tilbage og skrev bare, “Alt hvad der skal bruges, er i systemet.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-4-j%C3%A6tternes-spion-hotline/Tue, 24 Dec 2024 15:59:04 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-4-j%C3%A6tternes-spion-hotline/Challenge Description Danish (original) Vi har modtaget efterretning om, at en spion i Asgard har været i kontakt med jætternes spion-hotline. Vi har opsnappet et telefonopkald, hvor spionen indtastede deres spionnummer. Vi har brug for din hjælp til at identificere det indtastede spionnummer, så vi kan komme tættere på at afsløre deres identitet. Lav flaget ud fra FDCA{spionnummer} Flag eksempel: FDCA{123456789} English (from chatgpt) We have received intelligence that a spy in Asgard has been in contact with the giants’ spy hotline.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-3-flag-tyveri/Tue, 24 Dec 2024 15:59:03 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-3-flag-tyveri/Challenge Description Danish (original) Jætterne har igen skabt problemer! Thor har opdaget, at nogen har stjålet et vigtigt flag fra hans system. Sporene peger på, at det er sket lidt efter lidt. Thor har sendt os en logfil, men vi har brug for din hjælp til at finde ud af, hvad der er blevet stjålet. English (from chatgpt) The giants have caused trouble again! Thor has discovered that someone has stolen an important flag from his system.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-2-gaven-der-forsvandt/Tue, 24 Dec 2024 15:59:02 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-2-gaven-der-forsvandt/Challenge Description Danish (original) Midt under juleforberedelserne i Valhalla er en vigtig gave til guderne forsvundet fra en af de fælles computere, der blev brugt i gave hallen! Gaven, tiltænkt Thor, var omhyggeligt gemt i de digitale haller, men nu er den væk fra computeren. Odin er rasende og mistænker, at Loke står bag endnu et snedigt trick for at skabe kaos i julefreden. Freja mener at have set Loke gå rundt med et USB-stick.https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-1-thors-digitale-ragnarok/Tue, 24 Dec 2024 15:59:01 +0100https://osiriz.dev/posts/2024/12/fdca-xmas-2024-day-1-thors-digitale-ragnarok/Challenge Description Danish (original) Thor har fået sin første smartphone – og det går ikke helt som planlagt. I sin begejstring har han delt mere, end hvad godt er, og nu står Asgård over for en potentiel katastrofe. Loke har opsnappet hemmelig information, og jætterne planlægger et angreb på Bifrost-porten. Din opgave er at undersøge Thors online-profil og finde frem til: Vagtskifte Tidspunkt ved Bifrost. Kodeordet til våbenkammeret. Hvornår Heimdal holder pause.https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-challenge-21/We are given the following url: http://toolbox.hkn Visiting the site we see that it is a toolbox of network diagnostic tools. If we look at the ping tool we can see that we are able to run other bash commands by separating them with a ;: We sadly cant just read the flag: We can see that this is because it is owned by root and only root has read permissions: So lets upload a revshell so then try and privesc from there.https://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/Wed, 24 Apr 2024 11:00:00 +0200https://osiriz.dev/posts/2024/04/ddc-2024-regionals-cron-my-tab/We are told that we can login over ssh at crontab.hkn using the username:password pair doomguy:doomguysEcReTpAsSwOrD, and to run tail -f read.sh.log. Logging in we are also told that crontab is running /etc/read.sh. So lets check the crontab, checking in /etc/cron.d/ we find execute-cron containing the line: * * * * * /etc/read.sh >> /home/doomguy/read.sh.log So the /etc/read.sh script is run every minute, lets check the permissions on the script:https://osiriz.dev/posts/2024/03/ddc-2024-qualification-affinity/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-affinity/We are given the following file: affinity.zip The task description introduces the affine cipher that works by encrypting cleartext x to ciphertext y in the following way: y = (ax + b) mod m for some constants a, b and m. We can see this in the gen.py script: #!/usr/bin/env python from math import gcd import random import binascii # Encrypt the text using the affine cipher y = (ax + b) mod m def affine_encrypt(text, a, b, m): result = 0 for letter in text: c = (a * letter + b) % m result = (result << 8) + c return hex(result) # Generate keys for the affine cipher and encrypt the flag if __name__ == '__main__': with open('flag.https://osiriz.dev/posts/2024/03/ddc-2024-qualification-campfire-stories/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-campfire-stories/We are given the website campfire-stories.hkn which looks like this: We can write the beginning of a story and the AI will continue it for us. Looking at robots.txt we get: # https://www.robotstxt.org/robotstxt.html # Maybe we should not train on company data? # Could our ftp credentials be leaked by the AI? # Probably not a problem. Nobody writes stories about ftp anyway # datacenter.campfire-stories.hkn should still be safe right? User-agent: * Disallow: / Allow: /$ Allow: /share/* Allow: /images/* Allow: /static/* Which seems to suggest that the AI bot can leak the ftp credentials, so let’s try: Convert Z3B0OTAwMA== from base64 gives us gpt9000, so lets login to datacenter.https://osiriz.dev/posts/2024/03/ddc-2024-qualification-they-see-me-subbin-they-hating/Mon, 18 Mar 2024 08:00:00 +0100https://osiriz.dev/posts/2024/03/ddc-2024-qualification-they-see-me-subbin-they-hating/We are given the following text: alojsgegvly uqecm teag jvayva regnqllo gqeahvyu uqmegkw ueomd cmd redmd cvdalzmq dgqmeo bnvkdg p ylzmkgw eyekwdg jqvmdg zmqpmvanyvd jqmddsqm dvmomyd nqd od djed nezm on alcmd djlhm uvqk mijlqgd danlkeqdnvjd oeysteagsqvyu zmqrek blqhmqd rllk dnm aloovggmc gmqqvglqvmd cvuvgek vytksmyamc gnlodly rmggw dvuy glgekkw alydgeygkw qloeygva gmqo bvyud uqmmam oegg avekvd tmmd djmavtw clyekc eqod xsm ueooe jkewvyu olcvtw be mkdm jsojd qeqm gnsycmq tklbd neo nsyg reahsj evqjkeym alzmqd jqltmddlq tklwc dgvah zmyclqd teqovyu umygkmoey qmmt jeg tedgmq qmjkvaegvly uorn qlahmg ymbeqh euvyu dgeqdomqaneyg fscuomyg yly lqek gnmge qmomormq aml cmakeqegvly ecmxsegm bvkckvtm eolsyg qu csyaey rmccvyu yk oeqgvy ecovyvdgqeglq ywkly klbd vyaksdvly uvd dmmd vygmqmdgvyu cmdgqlw aljvmc hegvm jljskegvlyd bvtm jqldglqmd bednmq dmaglq jeqgd vygmqdgegm ljg dlqg jmqtmagkw migmydvlyd osdgeyu dmmhmq vgmo dmovyeq gqeyddmisek eaamdd dvuyvtvaeyg dhvj dsjmqzvdlq olgnmq qmcsavyu ovcyvung rkmdd qeo dglqmc neqcalzmq jqlamcsqmd oeg mieojkmd egoldjnmqva evqkvym vygmqmdgmc qmecd mojklw vytqvyumomyg qmjkeamc amygqm qlde hvkkmc av gsrm gmyc gdsyeov owmqd ieyei kvdg oewlq gvggmy bnvkdg aneyamkklq oevygevyd avqasodgeyamd qekmvun kvervkvgw olydgmq rqectlqc omedsqmomyg jwgnly zmumgeqvey eygnqljlkluw uvzm vygmycmc rq aegd ecc djlqgd qecvegvly dezmc jqlzvyavek laasqd gei daqvjgvyu kmggmq gqezmkmq eodgmqceo aneormq acg aneqeagmqd qmomormqmc gqmedsqmq oevkgl eczmqgvdvyu cmah ae bmc qmdvcmyg anqlyvakm dgmjd yezw sqrey rqmedg olqek mijldsqm lsung omedsqm kvyh alytvusqmc clyegm jskk vytmagvlyd rh djmavekd cllqd dmkkvyu qmjqmdmygegvly ovysd gmkmjnlyw alksoyd dmkkd mimasgvzmd deo alqqmdjlycvyu qvah glkmqeyam tlaek fmttqmw tmegsqmc rsggly glsanmc rwgm cegm dsrkvom oo gneyhduvzvyu tvggmc oedly jmymgqegvly clomdgva tlasd aeojd djmyamq gtg rkmdd key ezlvcvyu bmmhmyc eumc reqqvmqd rsah dvoskegvly rklu alygvymyg eczlaegm bmkdn zmqrek bnldm bvkmw alljmqegvzm gvomkvym asdglovpmc jlsq eddsojgvlyd rklahd ca mdgegmd jsqdsm nggj jkeamc mqqlq omcvaek ecljgvly aeko ejjqlean ueovyu lqcvyeqw dlomgnvyu oegmqvek aedsek keor eylywolsd ymvunrlq dbvganmd sb bmkkd alygmyg qmovyc yevkd nvunmdg qeyumqd aekkvyu nekt rh teggw mijl jlkvdnmc desam dgscvmc gneyhd cmolydgqegm nlrrw et yehmc qmtmqmyamd vyclymdve mcvyrsqun aneqgd qlrsdg qmfmagmc dgeqd neydmy rllo miamdd ajs tvko zvlkmyam rsd jkewreah clomdgva om jmyekgvmd gqvzve uqlzm qvungd cqso sycmqdgeyc bnmqmed alojsgegvlyek laasjvmc lqvmygek oequvy rlysd mijkvavg alyt ekvzm ymbaedgkm ymmcmc vyhfmg jsrkvdnmq qmyevddeyam ekgmqyegvzmkw jsr dsrfmagvzm jlvyg lsq gre uylom cwyeovad uvqkd alkkmagmc anqvdgveyvgw eyekwpm bekkeam alek gqeydvgvly tvung mijmycvgsqm olglqawakm jdwanlkluvaek by deqen qeavek dgljd alygeagvyu jqevqvm tvdnvyu yshm keah uqed kmet aejvglk jct mygqvmd eqmye umluqejnw jsppkmd cvdymw eqvdm db mzeksegmc rmqhmkmw vycveye migmydvlyd myclqdmc alydmqzegvly ovyvoso yskk clm escvg dedheganmbey ymbdjejmqd odu anmahmc alyamqg dc vygqlcsamc teag anequmq eyylsyam ed rklu CCA{bmkalom_gl_cca_gbmygw_gbmygw_tlsq_kmgd_cl_dlom_aqwjgl} The last part (CCA{bmkalom_gl_cca_gbmygw_gbmygw_tlsq_kmgd_cl_dlom_aqwjgl}) seems to be the encrypted flag, from the title we can guess that this is a substitution cipher.https://osiriz.dev/posts/2024/03/htb-cyber-apocalypse-2024-game-invitation/Sun, 17 Mar 2024 22:00:00 +0100https://osiriz.dev/posts/2024/03/htb-cyber-apocalypse-2024-game-invitation/Challenge description In the bustling city of KORP™, where factions vie in The Fray, a mysterious game emerges. As a seasoned faction member, you feel the tension growing by the minute. Whispers spread of a new challenge, piquing both curiosity and wariness. Then, an email arrives: “Join The Fray: Embrace the Challenge.” But lurking beneath the excitement is a nagging doubt. Could this invitation hide something more sinister within its innocent attachment?https://osiriz.dev/posts/2023/11/fe-ctf-2023-brannigans-law/Wed, 01 Nov 2023 09:30:00 +0100https://osiriz.dev/posts/2023/11/fe-ctf-2023-brannigans-law/The Task We get the following task: Captain Zip Brannigan at your service! Stardate... April. The 13th. Point two. We've made it to Kompromaise 7, the have-it-both-ways world. Everyone here, from young to old, and in between (..especially in between) are used to compromising. It. Disgusts. Me. But fear not! I have assigned my most trusted chump^H^H^H^H^Hdiplomatic envoy to help make contact. That's YOU! You need to send a zip file to initiate first contact.https://osiriz.dev/posts/2023/10/fe-ctf-2023-the-fight-of-the-unicorn-fans-clubs/Tue, 31 Oct 2023 11:00:00 +0100https://osiriz.dev/posts/2023/10/fe-ctf-2023-the-fight-of-the-unicorn-fans-clubs/The Task at hand We are given the following task: Your best friend has asked for your help. She is the president of a unicorn fan club in a small village in Jutland. For years they have competed with the neighboring village about who has the best unicorn fan club. Rumor says that trusted members in the other club have access to an amazing picture of a unicorn. An insider in the other fan club has given your friend the following photos.https://osiriz.dev/posts/2023/05/ddc-2023-nationals-a-thousand-pieces/Sun, 07 May 2023 21:30:00 +0200https://osiriz.dev/posts/2023/05/ddc-2023-nationals-a-thousand-pieces/We are given 40000 4x3 PNG files split evenly into 4 directories: $ find . -iname "*.png" | wc -l 40000 $ ls -lh total 0 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 0 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 1 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 2 drwxrwxr-x 1 osiriz osiriz 291K Mar 31 11:38 3 So we just need to reassemble the image from all the sections.https://osiriz.dev/posts/2023/04/ddc-2023-regionals-png-magic/Tue, 18 Apr 2023 19:00:00 +0200https://osiriz.dev/posts/2023/04/ddc-2023-regionals-png-magic/We are given magic.png file, which we cannot open: Lets try and open it in hexedit to look at the file header: Seems like the PNG magic bytes is missing, so we write them in: But we still fail: Lets use pngcheck to see what is wrong: If the open the file in hexedit again we can see that the IHDR chunk was renamed to JHDR: Lets change that: Lets check it now: Lets fix the checksum: We can know open the image: Hmm… no flag, seems like we are missing something, lets see if we can add some more height to the image.https://osiriz.dev/posts/2023/04/ddc-2023-regionals-one-time-too-much/Sun, 16 Apr 2023 20:00:00 +0200https://osiriz.dev/posts/2023/04/ddc-2023-regionals-one-time-too-much/We are given a python script that encrypts two strings (both with the flag appended) with a random one time pad: import os # read flag in as bytes with open("flag.txt", "rb") as f: flag = f.read() # XOR's two bytestrings together. def xor(a,b): xor_result = b'' for i in range(len(a)): xor_result += bytes([a[i]^b[i]]) return xor_result # sample a completely random 200 byte one time pad! one_time_pad = os.urandom(200) # two similar messages are sent using the same pad.https://osiriz.dev/posts/2023/03/ddc-2023-qualification-baby-rsa/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-baby-rsa/We are given a text file: babyRSA.txt, with the following contents: n = 14591059584728658996740718896274912924434702993948401065953397352995339910088088733574991258740736943162240984607294149798518974390850442269320587130740348332766777840789060640046077889381042022860333067208949242541537029834713571632092399544412860224638358821688934376008405448120397447357043233351572894555161097157298917757903358450051781374553895783095933436102637259148017787894728417663857683547045820798741292596714992103546619732559091189051271145488307258679223962750029735466371748284344268969024995984222371842720543906957141892627260247305180561557377683921023735478606199803707739027008690484139631874629 e = 65537 ciphertext = 8370482736029746802272435856905582692197472046878613623126167436276048925497192051855114861968301986740953539053163947192721440270870275675104799441533614895688983570828061357190863655539868022793932838551215620997098363666548621341103618946043035652810120255282119559608036421751056052625158822827831595069995146507062852262681451781903083499147508262669740286416571718635819352694698805949316507535002658526810142183807237137069555203580152352863371601204706128986849512578411079323120877340385328130962702308650000566212396403238074531227510385807269241298909102687880672710693216031720613169757344140890527855180 # What's the plaintext? this might help! p = 135118121033494444903135040650593867761183730711309803684324950423162537667458806301698825106852556296618752800474983408511120590602816857766798006294318907531661438883032776328539787015720714526094491835105378129306305286637613861991613352256006427593441280185940386266360182068694185435614508146253927535219 q = 107987437015288865195226926953887120405158392241008731414825285641627743723768153549068145296919127709072426332548919995869779098499543714252696254999551997426879319789809420841712042595904693470932881039466995302317325926476459209840274875302406142467069199349897038463278476940799410775560424588456195916391 We know from the name, that this most have something to do with RSA, and that we have the n, e, ciphertext, p and q values. We can plot these into www.dcode.fr/rsa-cipher: And we get the flag: DDC{Crypto-was-great-but-why-was-there-no-RSA}https://osiriz.dev/posts/2023/03/ddc-2023-qualification-flipping-privilege/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-flipping-privilege/Recon and Introduction We are given the website http://privilege.hkn and the app.py that it is running: #!/usr/bin/env python3 from flask import Flask,request,Response,render_template,abort,make_response import json,random,os,base64 from Crypto.Cipher import AES ### Global variables app = Flask(__name__) secret_key = os.urandom(16) ctr_nonce = os.urandom(8) def gen_user_cookie(): cookie_dict = {} cookie_dict["access_level"] = "User" pt = json.dumps(cookie_dict).encode() cipher = AES.new(secret_key, AES.MODE_CTR, nonce = ctr_nonce) ct = cipher.encrypt(pt).hex() return ct def check_admin_cookie(cookie): ct = bytes.fromhex(cookie) cipher = AES.https://osiriz.dev/posts/2023/03/ddc-2023-qualification-psssssyducks/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-psssssyducks/Recon and Introduction At the given url (http://psyducks.hkn), we are met by the image of a psyduck: Devtools If we inspect the HTML in devtools, we can see that the image comes from /content?psyduck=brick: Going over to the storage tab in the devtools we can see that we have a cookie set for this site: We can decode it from base64 in cyberchef and see what it contains: It seems that the cookie contains a list of psyduck variants, if we change the brick from the /content?https://osiriz.dev/posts/2023/03/ddc-2023-qualification-the-key-store-version/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-the-key-store-version/We are asked to find the version of a key-value store hosted on keystore.hkn. We first look for open ports using nmap: $ nmap -p- keystore.hkn Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-20 10:30 EDT Nmap scan report for keystore.hkn (77.184.238.37) Host is up (0.00025s latency). Not shown: 65534 closed tcp posts (conn-refused) PORT STATE SERVICE 6379/tcp open redis Nmap done: 1 IP address (1 host up) scanned in 3.https://osiriz.dev/posts/2023/03/ddc-2023-qualification-what-is-logging/Mon, 20 Mar 2023 09:30:00 +0100https://osiriz.dev/posts/2023/03/ddc-2023-qualification-what-is-logging/We are given a text file called logs.txt, it is 953 lines long and 243 Kilobytes big: $ wc -l logs.txt 953 logs.txt $ ls -lh logs.txt -rw-r--r-- 1 osiriz osiriz 243K Mar 20 10:30 logs.txt We can find the flag with grep: $ grep "DDC{" logs.txt 130.225.166.251 - - [25/Feb/2023:12:42:51 +0100] "POST /submit/flags/what-is-logging/DDC{CR4ZY-L0NG-F1L3S-C4N-B3-S34RCH3D} HTTP/1.1" 200 5082 "https://api.ntp-event.dk/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.https://osiriz.dev/posts/2022/12/nc3ctf-2022-starter-challenges/Wed, 14 Dec 2022 10:30:00 +0100https://osiriz.dev/posts/2022/12/nc3ctf-2022-starter-challenges/Base64 We are given the following string: bmMze3dvd19iYXNlNjRfZXJfdmlsZHRfbm9rfQ== We can decode the base64 in a shell with the base64 command: $ echo "bmMze3dvd19iYXNlNjRfZXJfdmlsZHRfbm9rfQ==" | base64 -d nc3{wow_base64_er_vildt_nok} We have now got the flag Regler We are asked to read the ctf rules, when we do so we find the flag at the bottom: nc3{Tak_fordi_du_kiggede_paa_reglerne} Strings We are given a file called strings that is 16 KB and a ELF executable:https://osiriz.dev/posts/2022/12/nc3ctf-2022-stego/Wed, 14 Dec 2022 10:30:00 +0100https://osiriz.dev/posts/2022/12/nc3ctf-2022-stego/10 We get a file called et-nul, running file tells us it is a long line of ASCII characters: $ file et-nul et-nul: ASCII text, with very long lines (1330), with no line terminators The file contains: 0110000110011111100011111110000111101111111101111111100000000011000011011000001101100000000000000011111111011110110000000000000001100001101111001111110001111110011111111011000011011110111100011100011011000011011000001100110000110000000000110000000000001110001101100000110110000000000000000001100000110011000000000000000111000110011001100001101100001101100000001110001101111000011001111001101100000000000000110011000011000000000011000000000000111100110110000011011000000000000000000110000011001100000000000000011110011001100110000000110000000110000000111100110111100001100110110110110000000011111110011100001111110000001100000000000011011011011000001101100000000000000000011000001100110000000000000001101101100110001111110001111110011111100011011011001100000111011001111011000000000000001100110000110000000000110000000000001100111101100000110110000000000000000001100000110011000000000000000110011110011000000001100000001101100000001100111100000000011001100011101100001101100000110011000011000000000011000000000000110001110110000011011000000000000000000110000011001100000000000000011000111001100110000110110000110110000000110001110111100001100110000110011111100011111110000111101111111100001100001111111011000011001111111001111111101111111000011000011110111111110111111101100001101111001111110001111110011111111011000011011110111100 By splitting the text into 7 lines of equal length the message reveals itself (don’t focus too hard or you wont see it): 0110000110011111100011111110000111101111111101111111100000000011000011011000001101100000000000000011111111011110110000000000000001100001101111001111110001111110011111111011000011011110111100 0111000110110000110110000011001100001100000000001100000000000011100011011000001101100000000000000000011000001100110000000000000001110001100110011000011011000011011000000011100011011110000110 0111100110110000000000000011001100001100000000001100000000000011110011011000001101100000000000000000011000001100110000000000000001111001100110011000000011000000011000000011110011011110000110 0110110110110000000011111110011100001111110000001100000000000011011011011000001101100000000000000000011000001100110000000000000001101101100110001111110001111110011111100011011011001100000111 0110011110110000000000000011001100001100000000001100000000000011001111011000001101100000000000000000011000001100110000000000000001100111100110000000011000000011011000000011001111000000000110 0110001110110000110110000011001100001100000000001100000000000011000111011000001101100000000000000000011000001100110000000000000001100011100110011000011011000011011000000011000111011110000110 0110000110011111100011111110000111101111111100001100001111111011000011001111111001111111101111111000011000011110111111110111111101100001101111001111110001111110011111111011000011011110111100 We then got the flag: NC3{ET_NUL_TIL_NISSEN!