Internetwache CTF 2016 Quick Run

Question :

Solution :

Link to the file inside zip : https://app.box.com/s/8aoepmqzfetr2syj9usq433kptaz8nid 

I just tried Base64 on it due to the padding "==" in the texts. and i found QR codes on each block of texts

Hence , decoding which gives us :

Flag is IW{QR_C0DES_RUL3}



FLAG : IW{QR_C0DES_RUL3}

Internetwache CTF 2016 The hidden message

Question :

Solution :

The README.txt inside the zip file had contents :

0000000 126 062 126 163 142 103 102 153 142 062 065 154 111 121 157 113
0000020 122 155 170 150 132 172 157 147 123 126 144 067 124 152 102 146
0000040 115 107 065 154 130 062 116 150 142 154 071 172 144 104 102 167
0000060 130 063 153 167 144 130 060 113 012
0000071

Looking at the numbers its clear that its a octal system. Converting from octal to ascii gives us :

"V2VsbCBkb25lIQoKRmxhZzogSVd7TjBfMG5lX2Nhbl9zdDBwX3kwdX0K"

Decoding the above Base64 string gives us :

Well done!

Flag: IW{N0_0ne_can_st0p_y0u}


FLAG : IW{N0_0ne_can_st0p_y0u}

Internetwache CTF 2016 Crypto-Pirat

Question :

Word of Caution : Highly frustrating challenge due to multiple encryption,encoding etc,. :-p

Attachment : crypto50.zip

Solution :
Attachment has a README.txt which has :

♆♀♇♀♆ ♇♇♀♆⊕ ♇♀♇♀♆ ♇♆♇♆⊕ ♆♇♆♇♇ ♀♆♇♆⊕ ♆♇♆♇♆ ♇♆♇♆⊕ ♆♇♇♀♇ ♀♆⊕♇♀ ♆⊕♇♀♆ ⊕♆♇♆♇ ♇♀♆♇♆ ⊕♇♀♇♀ ♆⊕♆♇♆ ♇♆♇♇♀ ♆⊕♆♇♆ ♇♆♇♆⊕ ♆♇♆♇♆ ♇♆⊕♇♀ ♆♇♇♀♆ ♇♆⊕♇♀ ♆♇♆♇♇ ♀♆⊕♆♇ ♆♇♇♀♇ ♀♇♀♆⊕ ♆♇♆♇♇ ♀♆⊕♇♀ ♇♀♆♇♆ ⊕♆♇♇♀ ♆⊕♇♀♆ ♇♇♀♇♀ ♆⊕♆♇♆ ♇♆♇♆♇ ♆⊕♇♀♆ ♇♇♀♆♇ ♆⊕♇♀♆ ♇♆♇♇♀ ♆⊕♆♇♆ ♇♇♀♇♀ ♇♀♆⊕♇ ♀♆♇♆♇ ♆⊕♇♀♇ ♀♇♀♆⊕ ♇♀♇♀♆ ♇♆♇♆⊕ ♆♇♆♇♆ ♇♆⊕♆♇ ♇♀♇♀♆ ⊕♆♇♆♇ ♆♇♆♇♇ ♀♆⊕♇♀ ♇♀♆♇♆ ♇♆⊕♆♇ ♆♇♆♇♇ ♀♇♀♆⊕ ♆♇♆♇♆ ♇♆⊕♆♇ ♇♀♆♇♆ ♇♆⊕♆♇ ♆♇♆♇♆ ♇♆♇♆⊕ ♆♇♇♀♇ ♀♆⊕♇♀ ♇♀♆♇♆ ⊕♆♇♆⊕ ♆♇♆♇♇ ♀♇♀♇♀ ♆⊕♇♀♆ ♇♇♀♆♇ ♆⊕♇♀♇ ♀♆♇♆♇ ♆♇♆⊕♇ ♀♆♇♆⊕ ♇♀♇♀♆ ♇♆♇♆⊕ ♆♇♆♇♆ ♇♆⊕♇♀ ♆♇♆♇♇ ♀♆⊕♆♇ ♆⊕♇♀♇ ♀♇♀♆⊕ ♆♇♇♀♆ ♇♆⊕♆♇ ♇♀♇♀♇ ♀♆⊕♆♇ ♇♀♇♀♆ ♇♆⊕♆♇ ♆♇♇♀♆ ⊕♇♀♆♇ ♆♇♆♇♇ ♀♆⊕♇♀ ♆♇♆♇♆ ♇♇♀♆⊕ ♇♀♆♇♆ ♇♆♇♇♀ ♆⊕♇♀♆ ♇♆♇♆♇ ♇♀♆⊕♇ ♀♆♇♆♇ ♆♇♇♀♆ ⊕♇♀♆♇ ♆♇♆♇♇ ♀

Internetwache CTF 2016 Replace with Grace

Question:

Service : https://replace-with-grace.ctf.internetwache.org/

Solution :

The webpage had 3 parameters : search,replace and content

An example would be :
search : /cow/
replace : cat
content : cows are cute

output : cats are cute.

As the webpage uses php, I googled for php search and replace regex

Now I was clear that it uses preg_replace function. Searching for flaws in preg_replace I found that it is prone to command execution using the modifier "e"

Internetwache CTF 2016 0ldsk00lBlog

Question :

Service : https://0ldsk00lblog.ctf.internetwache.org/

Solution :

As the blog shows that "All people are talking about a tool called 'Git'. I think I might give this a try." , which leaves us a hint and lets check whats in "https://0ldsk00lblog.ctf.internetwache.org/.git/"

"403 Forbidden" , which means directory exists but cannot be accessed.

So now after reading through this wonderful website anyone would understand the git directory structure.

Having said that now , I went through couple of writeups on similar challenges and found a useful tool called dvcs-ripper , which can find us all the commits and check if the directories in .git is accessbile like logs,config,objects etc,.

Internetwache CTF 2016 TexMaker

Question :

Service : https://texmaker.ctf.internetwache.org/


Solution :
The webpage gives you to program a latex and create a pdf .

After a bit of searching for latex hacks I found the guide

http://cseweb.ucsd.edu/~hovav/dist/texhack.pdf

Well, this has a amazing article on how to use latex for malicious purpose. I went through usual approach of using \input{"ls"} as we have no clue where is the file is and what the file extension is for the flag.

we see "BLACKLISTED commands cannot be used."

I saw few evading techniques that can be used by following the above article like
\csname \begin \@@ ^^5C \cat_code , No luck though.

Lets change the view, search for commands that can execute us the shell commands.

After a bit of digging i finally found this command was not BLACKLISTED and that is \write18
which is also called shell-escape.

http://tex.stackexchange.com/questions/16790/write18-capturing-shell-script-output-as-command-variable

It was simple after to use \write18{ls ../}

and \write18{cat ../flag.php}

FLAG : IW{L4T3x_IS_Tur1ng_c0mpl3te}

ASIS CTF 2014 Recon - Fact or Real

First thing which came to my mind id twitter.So i checked ASIS twitter handle. Later i found that usually a guy named factoreal is the main guy in hosting asis-ctf.When you check his twitter photos there you go,you see the given hint "fact or real" and the motto in the picture : "NO+$=YES"

Flag is ASIS_md5(NO+$=YES)

FLAG : ASIS_d25b9c2f1c29e49e81e8fdfaf4d16fc6

Nuit de Hack Quals - 2014 Carbonara

This was easy and i actually over thought it..
Question :

the ciphertext was : "%96 7=28 7@C E9:D 492= :D iQx>A6C2E@C xF=:FD r26D2C s:GFDQ]"

My first approach:
substitution by looking at asciitable.com

":" - "i"
"D" - "s"

after which with the help of this (which i just guessed as it was a 2 letter string and my guess was it would be "is")
decoding which i got
THE FLAG FOR THIS CHAL IS "iMPERATOR jULIUS cAESAR dIVUS"
i was stuck with the letter x actually..Later my friend told that it was a rot-47 :-D all my work in vain..i got the string as :
The flag for this chal is :"Imperator Iulius Caesar Divus".

Flag : Imperator Iulius Caesar Divus 

Nuit de Hack Quals -2014 Here Kitty Kitty!

Not much flags this time too..Managed to get 3 of them and will write however i got it.
Question:

Mirror Link : http://1drv.ms/1jjplOH

So well first thing we would think of is audacity.Lets try our luck..You get a weird waveform.I just zoomed in to see the waveform.I got a view of Morse code,before which i thought it was a binary . Dont zoom in much coz you would over think as binary numbers.It would look like this :

Note down accordingly and you would get this Morse code

..... -... -.-. ----. ..--- ..... -.... ....- ----. -.-. -... ----- .---- ---.. ---.. ..-. ..... ..--- . -.... .---- --... -.. --... ----- ----. ..--- ----. .---- ----. .---- -.-.

Decoding which will give a md5 hash : 5BC925649CB0188F52E617D70929191C
As the flag was case sensitive and was lowercase so the flag would be : 5bc925649cb0188f52e617d70929191c

Flag : 5bc925649cb0188f52e617d70929191c

Volga CTF 2014 Quals Joy-300

This was just a replica of flappy bird game.

Question was in short "Autopilot mode isn't working and the rocket is unable to reach the destination point.reach the destination point for the message(42level)" [Not exact but it meant this]

Well i thought of reversing the game and figured it was written in Delphi and used the Delphi dissasembler also.But just as a confirmation i asked people whether the task was just to reach 42nd level? I got a reply saying "Yes" .Ah perfect timing for showing my flappy bird skills. Bwah it was just 42 level.Piece of cake i thought. But its not easy playing with keboard. Check it yourself.Download the game using the link below.
The game given

After so many attempts i reached 42 level and got this :

Ah observe that at level 42 i crashed :-D This is pure luck :-D

FLAG : it_was_not_so_hard_rrly

Volga CTF 2014 Quals Web-100

Well,It was very hard to solve challenges frankly speaking.We were well prepared for the CTF but was in vain.

The question was to find the hidden flag in their webpage (http://tasks.2014.volgactf.ru:28101/)

Note: [Server is down so cannot fetch the exact question.Sorry about that]

I really have no clue about web challenges as i am not the guy at all.But i know the basics.Hence as a challenge with blank mind i just looked at the login page

I just logged in.I saw this.

Backdoor CTF 2014 Misc-150

First i thought it was like Defkthon's zip challenge..Wrote script and it went wrong. :-p

Question :
This wierd file was found by H4XOR when trying to search for his flags. Can you get him his flag ?


Submit flag as flag_obtained


After 6 times unzipping you would get a file called Misc150. A quick file command tells this :

So its time for mounting now.
Command : mount -t ext2 Misc150 ../../../mnt/image -o loop 
Note: file path is different for you.Adjust it accordingly.

Backdoor CTF 2014 Misc-200-2

This was an awesome challenge and we solved it in a different way.It was fun solving this challenge.We knew that using python we can code this.But we were almost getting the flag when we realized that.

Question :
Username and password based login seemed a bit too monotonous. We developed an indigenous image based login system.

The login service is available here.

The image below can be used to login as the backdoor user. Unfortunately that doesn't serve any purpose.

Login as the sdslabs user for a change.


Submit the flag as: md5(flag_obtained)

Before we got in we loaded the image and saw how it would look like..

So our first approach was paint and look what we found..

So we tried figuring out logic for this coz when we took out the last dot we were getting " Logged in as backdoop"
After which my friend figured out the logic.
01100010 -b
01100001 -a
01100011 -c
01101011 -k
01100100 -d
01101111 -o
01101111 -o
01110010 -r

01110011 -s
01100100 -d
01110011 -s
01101100 -l
01100001 -a
01100010 -b
01110011 -s

Black dot was 1 and the space or blank is 0..This is how we figured it out.
We used colorfiller and filled out accordingly what sdslabs would look like and when put in paint and seen it would look like this.

"Logged in as sdslabs
Congrats the flag is practice_makes_one_perfect"

md5("practice_makes_one_perfect") => c16a3c8504985a8c91956c29f7338184

FLAG : c16a3c8504985a8c91956c29f7338184

Backdoor CTF 2014 Binary-10

Just a basic skill of viewing the strings of files is required.

Question :
Information Security Agency uses preshared passwords for sending senstive information to its agents.

Somehow we managed to know that one such piece of sensitive information exists in this file.
File : http://1drv.ms/1lCxm3N

Submit the flag as flag_obtained

FLAG : 40511702a6193f9b38d37699e676fd40

Backdoor CTF 2014 Web-10

Got help from a teammate..He did it actually.Just learnt it so thought of sharing.Am not a web guy moreover.

Question :
H4x0r is a curious guy. He normally looks into every detail around. H4x0r managed to find the flag of this level. Can you ?

Looking at the http headers gave us the flag:

FLAG : 28b3324be8b003ee7e1d0d153fad3c32

Backdoor CTF 2014 Crypto-10

Just cracked this in seconds..Have a very good experience with these kind of stego's.

Question :
H4x0R recently went missing. An investigating team specializing in hacking was deployed to search around his place. All they found was this file. Please help them obtain secret 32characters string that can lead to him

Submit the flag as: flag_obtained
Image given :

So the below image says ther is a image inside this image.How to extract? just rename the jpg to rar and extract it you would see a image.

Backdoor CTF 2014 Miscellaneous-10

Was a very tedious challenge.Had to sit and analyze every packet and finally found a packet with a hint
Question :
This file was retrieved by CID during a task to catch a black hat hacker. Can you find the flag and help CID ?.

Submit the flag as: flag_obtained

Open the pcap file in wireshark[coz thats wat i do with pcap's :-p]

Link : http://i.imgur.com/hWVwx6G.png

A QRcode is ther.Just scan it for the flag.
If not use this : http://zxing.org/w/decode?u=http%3A%2F%2Fi.imgur.com%2FhWVwx6G.png

FLAG : efb8f4cd67963a5652ee0aa2187b830a

Backdoor CTF 2014 Hidden challenge

Was fun playing this CTF.I gathered oly 1 hidden flag which was hidden in the css file.There were around 6 according to admins and few players.I searched almost everythng i knew and finally got this.

so the flag was md5("hashme") => 533f6357e0210e67d91f651bc49e1278

FLAG : 533f6357e0210e67d91f651bc49e1278

Backdoor CTF 2014 [All trivia]

Submit flag as md5 of answer. Answer consists of small alphabets (a-z) only. [Applies to all trivia]

Trivia 1 - http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c?txt

This above link was given .
Quick google about the link showed it was ios-Apple"gotofail" security bug.
md5("gotofail") => 9c00b580a9a1d022d62fa3e8506c3c51

FLAG : 9c00b580a9a1d022d62fa3e8506c3c51

Trivia-2
Who is Megaracer?

Again Googling revealed Megaracer aka kimdotcom
md5("Who is Megaracer?") => 148e6711a03f43a1955bcff667d967cc

FLAG : 148e6711a03f43a1955bcff667d967cc

Trivia-3
"How I hacked github again". Where am I now?

Google helped to find me the blog of Egor Homkov : http://homakov.blogspot.in/p/about-me.html
We now know that he is in bangkok..Country is Thailand
md5("thailand") => 8689391a8b93cd2d55ccf3f436eef4e2

FLAG : 8689391a8b93cd2d55ccf3f436eef4e2

Trivia-4
http://fortunebrainstormtech.files.wordpress.com/2014/03/140319073410-ted-2014-edward-snowden-620xa.png?w=620

This image is about the ted talk to a robot resembling snowden called "beam"
md5("beam") => 5435eeb714f3a0739ca75b3b0eb8cfb3

FLAG : 5435eeb714f3a0739ca75b3b0eb8cfb3

Trivia-5
Trivia 21?

This was the question ,something worth thinking.
Anyway it was about the port 21,even i thought in the beginning as blackjack but wasn't the answer.
md5("ftp") => ff104b2dfab9fe8c0676587292a636d3

FLAG : ff104b2dfab9fe8c0676587292a636d3

RUCTF 2014 Quals Misc-100 [Shredder] Misc-200 [RuCTF radio] Reverse-10 [Harm]

I am writing all the three because its not that great challenges which requires that much space to explain it :-)

Misc-100 [Shredder]

We were given this image

Painful challenge but something different i have ever seen till this day.I had to take a printout and cut it and rejoin to get the flag.This is the image i got ,even though i missed a main cutting in between.

FLAG : RUCTF_TO_SHRED_IS_NOT_ENOUGH