Skip to content

Commit 7a5adac

Browse files
author
Andrew Buss
committed
Added NDH 2014 quals writeups
1 parent 7faeeed commit 7a5adac

File tree

5 files changed

+445
-0
lines changed

5 files changed

+445
-0
lines changed

Diff for: ‎nuitduhack2014/index.html

+158
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
<p><link rel='stylesheet' href='markdown8.css'/></p>
2+
3+
<h1>Nuit Du Hack Quals 2014 Writeups</h1>
4+
5+
<p><a id="carbonara"></a></p>
6+
7+
<h2>Carbonara</h2>
8+
9+
<p>We're provided the following cryptic string:</p>
10+
11+
<pre><code>%96 7=28 7@C E9:D 492= :D iQx&gt;A6C2E@C xF=:FD r26D2C s:GFDQ]
12+
</code></pre>
13+
14+
<p>Googling a few of these fragments turns up a multitude of news articles using a "tncms" package. <a href="http://www.timesdispatch.com/news/local/central-virginia/a-pow-son-s--year-quest-finally-unfurls/article_3693659c-4788-516c-8c73-1c8defc13efa.html?mode=jqm">This</a> is one such page. Examining the source we find similar gibberish in the body of the article:</p>
15+
16+
<pre><code> &lt;div class="encrypted-content" style="display: none"&gt;
17+
&lt;span class="paragraph4"&gt;
18+
kAm{2?5CF&amp;gt; 6G6?EF2==J &amp;gt;256 :E 9@&amp;gt;6] qFE E96 7=28 96 96=A65 E@ D64C6E=J 4C62E6 2?5 =2E6C H2G65 :? 2? :4@?:4 A9@E@8C2A9 E2&amp;lt;6? 2D 96 2?5 9:D 76==@H !~(D H6C6 =:36C2E65 @? pF8] ah[ `hcd[ G2?:D965 @G6C E:&amp;gt;6]k^Am
19+
&lt;/span&gt;
20+
&lt;/div&gt;
21+
</code></pre>
22+
23+
<p>We also find a link to a <code>decrypt.js</code> link in the body of the article. Near the bottom is the following function:</p>
24+
25+
<pre><code>tncms.unscramble = function (sInput) {
26+
var sOutput = '';
27+
for (var i = 0, c = sInput.length; i &lt; c; i++) {
28+
var nChar = sInput.charCodeAt(i);
29+
if (nChar &gt;= 33 &amp;&amp; nChar &lt;= 126) {
30+
sTmp = String.fromCharCode(33 + (((nChar - 33) + 47) % 94));
31+
sOutput += sTmp
32+
} else {
33+
sOutput += sInput.charAt(i)
34+
}
35+
}
36+
return sOutput
37+
};
38+
</code></pre>
39+
40+
<p>No need to reverse-engineer this; we can simply use it in the javascript console to unscramble our string:</p>
41+
42+
<pre><code>tncms.unscramble('%96 7=28 7@C E9:D 492= :D iQx&gt;A6C2E@C xF=:FD r26D2C s:GFDQ]')
43+
"The flag for this chal is :"Imperator Iulius Caesar Divus"."
44+
</code></pre>
45+
46+
<p><a id="onionrings"></a></p>
47+
48+
<h2>Onion Rings</h2>
49+
50+
<p>The hidden service accepts a profile picture upload, and includes the option to load from a non-TOR URL. So, we can ask it to load from our server, and capture the IP of the requestor. </p>
51+
52+
<p>As <a href="http://sigint.ru/backdoor2014/backdoor2014.html#web100-1">before</a>, we can listen on port 80 on a server and submit our server's URL.</p>
53+
54+
<p>The server's IP was 212.83.153.197. Visiting <a href="http://212.83.153.197/">http://212.83.153.197/</a> and searching for <code>flag</code>, we find:</p>
55+
56+
<pre><code>The flag.. It is '0hSh1t1r4n0ut0fn00dl35'
57+
</code></pre>
58+
59+
<p><a id="windowsforensics"></a></p>
60+
61+
<h2>Windows Forensics</h2>
62+
63+
<p>We are given a 400MB Windows pagefile. A few initial attempts along the lines of <code>strings pagefile.sys | grep flag</code> turned up quite a lot of results, but no interesting ones. Noticing several Chrome-related strings, we searched the file for URLs. Still, we found nothing interesting. </p>
64+
65+
<p>Then, we reread the problem more carefully and saw that our task was to recover a command prompt session. Searching for command prompt pagefile.sys forensics yielded <a href="http://blog.roberthaist.com/2013/12/restoring-windows-cmd-sessions-from-pagefile-sys-2/">this excellent guide</a>. He uses <code>page_brute</code>, which splits the pagefile into 4096-byte pages and processes each with YARA. Installation of YARA proved the most difficult part of this challenge. Once YARA was installed, I added the following rule to page<em>brute's default</em>signatures.yar:</p>
66+
67+
<pre><code>rule CMDscan_Optimistic_Blanklines
68+
{
69+
meta:
70+
author="Robert Haist | @SleuthKid"
71+
description="Searching for blank lines and magic bytes that occur with paged cmd usage"
72+
strings:
73+
$m1 = { 63 3A 79 26 7B }
74+
$m2 = { 77 00 27 00 57 00 27 00 77 00 }
75+
$m3 = { 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 }
76+
condition:
77+
any of them
78+
}
79+
</code></pre>
80+
81+
<p>Then, ran page_brute on pagefile.sys and reviewed the results using <code>strings -el CMDscan_Optimistic_Blanklines/*| sed -e "s/\s\{4,\}/\\n/g"</code>. Inside, we find:</p>
82+
83+
<pre><code> Microsoft Windows XP [version 5.1.2600]
84+
(C) Copyright 1985-2001 Microsoft Corp.
85+
C:\Documents and Settings\Administrateur&gt;ncat 192.168.130.105 1234
86+
Username : JackTheRipper
87+
Password : 200020012002
88+
1337 - USER VALID
89+
1338 - 04c0f778e6dd6c0a
90+
1338 - 025e48c9f5f22f87
91+
close: No error
92+
</code></pre>
93+
94+
<p>Neither the password nor either of the two hex strings were the flag, so we tried concatenating the two hex strings. <code>04c0f778e6dd6c0a025e48c9f5f22f87</code> was the flag. The lowercase flag format gave us a hint for Here Kitty Kitty.</p>
95+
96+
<p><a id="herekittykitty"></a></p>
97+
98+
<h2>Here Kitty Kitty</h2>
99+
100+
<p>In lieu of a writeup, we offer the following two images, and leave the solution as an exercise to the reader:</p>
101+
102+
<p><img src="kitty-waveform.png" alt="waveform" title="" /></p>
103+
104+
<p><img src="morse.png" alt="morse code" title="" /></p>
105+
106+
<p>Unfortunately, <code>5BC925649CB0188F52E617D70929191C</code> was not accepted. We tried HashCat dictionary and bruteforce attacks without success. After solving Windows Forensics, we tried submitting as lowercase, which was successful. Case-sensitivity isn't fun!</p>
107+
108+
<h2>BigMomma</h2>
109+
110+
<p>Though we had the server binary, and briefly attempted to reverse it, we were able to identify how it worked by playing around with it for a few minutes.</p>
111+
112+
<pre><code> Please enter your username:
113+
a
114+
Nope (45)
115+
116+
117+
Please enter your username:
118+
b
119+
Nope (46)
120+
</code></pre>
121+
122+
<p>So, if <code>a</code> returns 45 and <code>b</code> returns 46, what returns 0? </p>
123+
124+
<pre><code>&gt;&gt;&gt; chr(ord('a')-45)
125+
'4'
126+
</code></pre>
127+
128+
<p>Let's try that:</p>
129+
130+
<pre><code> Please enter your username:
131+
4
132+
Nope (-100)
133+
134+
135+
Please enter your username:
136+
4a
137+
Nope (-3)
138+
139+
140+
Please enter your username:
141+
4d
142+
Nope (-77)
143+
</code></pre>
144+
145+
<p>Apparently, we are provided the return value of the <code>strcmp</code> between our input and the correct username. So, we can derive the correct username one character at a time by converting the return value of the comparison between the terminating zero of our string, and the nonzero character of theirs. For example,</p>
146+
147+
<pre><code> a = "4d\0"
148+
b = "4dABCDEFGH"
149+
strcmp(a, b) == ord('\0')-ord('A')
150+
</code></pre>
151+
152+
<p>Though a script ultimately would have been a better idea, we figured at this point that the username wasn't very long. So, we persevered manually with netcat and a Python interpreter. By this method, we discovered that the username was <code>4dM1N15TR4T0R</code>. Then, we had to find the password, for which we received the same feedback as before. In the end, we determined that the password was <code>THEpasswordISreallyLONGbutYOUllGETtoTHEendOFitEVENTUALLY</code>. </p>
153+
154+
<pre><code>Please enter your username:
155+
4dM1N15TR4T0R
156+
Username correct, what is the password?THEpasswordISreallyLONGbutYOUllGETtoTHEendOFitEVENTUALLY
157+
Well done! Here is the flag: YoMamaIsLikeHTML,SmallHeadAndHugeBody
158+
</code></pre>

Diff for: ‎nuitduhack2014/kitty-waveform.png

6.33 KB
Loading

Diff for: ‎nuitduhack2014/markdown8.css

+137
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
h1, h2, h3, h4, h5, h6, p, blockquote {
2+
margin: 0;
3+
padding: 0;
4+
}
5+
body {
6+
font-family: "Helvetica Neue", Helvetica, "Hiragino Sans GB", Arial, sans-serif;
7+
font-size: 13px;
8+
line-height: 18px;
9+
color: #737373;
10+
background-color: white;
11+
margin: 10px 13px 10px 13px;
12+
}
13+
table {
14+
margin: 10px 0 15px 0;
15+
border-collapse: collapse;
16+
}
17+
td,th {
18+
border: 1px solid #ddd;
19+
padding: 3px 10px;
20+
}
21+
th {
22+
padding: 5px 10px;
23+
}
24+
25+
a {
26+
color: #0069d6;
27+
}
28+
a:hover {
29+
color: #0050a3;
30+
text-decoration: none;
31+
}
32+
a img {
33+
border: none;
34+
}
35+
p {
36+
margin-bottom: 9px;
37+
}
38+
39+
h1, h2, h3, h4, h5, h6 {
40+
color: #404040;
41+
line-height: 36px;
42+
}
43+
h1 {
44+
margin-bottom: 18px;
45+
font-size: 30px;
46+
}
47+
h2 {
48+
margin-top: 72px;
49+
font-size: 24px;
50+
}
51+
h3 {
52+
font-size: 18px;
53+
}
54+
h4 {
55+
font-size: 16px;
56+
}
57+
h5 {
58+
font-size: 14px;
59+
}
60+
h6 {
61+
font-size: 13px;
62+
}
63+
hr {
64+
margin: 0 0 19px;
65+
border: 0;
66+
border-bottom: 1px solid #ccc;
67+
}
68+
blockquote {
69+
padding: 13px 13px 21px 15px;
70+
margin-bottom: 18px;
71+
font-family:georgia,serif;
72+
font-style: italic;
73+
}
74+
blockquote:before {
75+
content:"\201C";
76+
font-size:40px;
77+
margin-left:-10px;
78+
font-family:georgia,serif;
79+
color:#eee;
80+
}
81+
blockquote p {
82+
font-size: 14px;
83+
font-weight: 300;
84+
line-height: 18px;
85+
margin-bottom: 0;
86+
font-style: italic;
87+
}
88+
code, pre {
89+
font-family: Monaco, Andale Mono, Courier New, monospace;
90+
}
91+
code {
92+
background-color: #fee9cc;
93+
color: rgba(0, 0, 0, 0.75);
94+
padding: 1px 3px;
95+
font-size: 12px;
96+
-webkit-border-radius: 3px;
97+
-moz-border-radius: 3px;
98+
border-radius: 3px;
99+
}
100+
pre {
101+
display: block;
102+
padding: 14px;
103+
margin: 0 0 18px;
104+
line-height: 16px;
105+
font-size: 11px;
106+
border: 1px solid #d9d9d9;
107+
white-space: pre-wrap;
108+
word-wrap: break-word;
109+
}
110+
pre code {
111+
background-color: #fff;
112+
color:#737373;
113+
font-size: 11px;
114+
padding: 0;
115+
}
116+
sup {
117+
font-size: 0.83em;
118+
vertical-align: super;
119+
line-height: 0;
120+
}
121+
* {
122+
-webkit-print-color-adjust: exact;
123+
}
124+
@media screen and (min-width: 914px) {
125+
body {
126+
width: 640px;
127+
margin:10px auto;
128+
}
129+
}
130+
@media print {
131+
body,code,pre code,h1,h2,h3,h4,h5,h6 {
132+
color: black;
133+
}
134+
table, pre {
135+
page-break-inside: avoid;
136+
}
137+
}

Diff for: ‎nuitduhack2014/morse.png

11 KB
Loading

0 commit comments

Comments
 (0)