-
Notifications
You must be signed in to change notification settings - Fork 0
ocit‐writeups
___ _ _ _ __ __ _ _
/ _ \| (_) ___ _ _| |__ ___ _ __ \ \ / / __(_) |_ ___ _ _ _ __ ___
| | | | | |/ __| | | | '_ \ / _ \ '__| \ \ /\ / / '__| | __/ _ \ | | | '_ \/ __|
| |_| | | | (__| |_| | |_) | __/ | \ V V /| | | | || __/ |_| | |_) \__ \
\___/|_|_|\___|\__, |_.__/ \___|_| \_/\_/ |_| |_|\__\___|\__,_| .__/|___/
|___/ |_|
Translated from Italian language
flag = /^flag\{[\D]{2}[0][a-z][^0-9][L][\w]{4}[^a-pr-z]{3}[^\d]{2}[\d][b]\}$/
regex101
SOLUTION 1 (by wasp1337)
GoTo https://regex101.com/ --> use hints and debugger --> FlagSOLUTION 2 (by wasp1337)
In PowerShell ISE:# maybe not the most elegant solution, but it works ;)
$D="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ".ToCharArray()
$az="abcdefghijklmnopqrstuvwxyz".ToCharArray()
$w="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789".ToCharArray()
$num=@(0,1,2,3,4,5,6,7,8,9)
$praz="ppp"
$fl="flag{"
$end="b}"
$int0=0
$charL="L"
foreach($varD in $D){
$concatString = "$fl$varD"
foreach($var2D in $D){
foreach($varaz in $az){
foreach($varnum in $D){
foreach($vw1 in $w){
foreach($vw2 in $w){
foreach($vw3 in $w){
foreach($vw4 in $w){
foreach($vn1 in $D){
foreach($vn2 in $D){
foreach($vn3 in $num){
$concatString2="$concatString$var2D$int0$varaz$varnum$charL$vw1$vw2$vw3$vw4$praz$vn1$vn2$vn3$end"
Return $concatString2
}}}
}}}}
}
}
}
}
--> Flag
In dieser Challenge-Serie werden einige der Themen vorgestellt, die zur Lösung von Netzwerksicherheitsproblemen erforderlich sind. Um diese Aufgabe zu lösen, ist es notwendig zu verstehen, was eine pcap-Datei ist und wie man sie analysiert. Unter den verschiedenen Möglichkeiten, pcap-Dateien zu analysieren, ist Wireshark eine sehr empfehlenswerte Software mit einer grafischen Oberfläche. Um Wireshark auf Linux zu installieren, installieren Sie einfach das Paket aus den Standard-Repositories (z. B. sudo apt install wireshark). Windows- und macOS-Versionen sind ebenfalls verfügbar.
Das Flag für diese Challenge ist im TCP-Paket nach dem Handshake zu finden.
SOLUTION (by wasp1337)
Frame 6 enthält 30B Daten --> Follow TCP-Stream --> FlagIn dieser Challenge sollen einige Pakete genauer analysiert werden. Im Einzelnen hat die Kennzeichnung das folgende Format: flag{Source_MAC_address/data_bytes_length}
Die für die Flags erforderlichen Informationen werden dem Frame Nummer 4 entnommen, dem ersten, der die Daten der TCP-Sitzung enthält.
SOLUTION (by wasp1337)
Follow TCP-Stream ergibt die Anleitung für die Bildung der Flag: The flag is in the format ... Erforderliche Daten zusammensetzen --> Flag.Dies ist die erste einer Reihe von Herausforderungen, die sich mit der Verwendung von Ausdrücken zum Filtern von pcap/pcapng-Dateien befassen, um eine reduzierte und interessantere Menge von Paketen zu erhalten.
Um die Flag für diese erste Herausforderung zu erhalten, filtern Sie einfach die Pakete nach dem Protokoll. Wenn Sie nur Pakete filtern, die das HTTP-Protokoll verwenden, finden Sie die Flagge in einem benutzerdefinierten Request-Header.
Um besser zu lernen, wie man diesen Satz von Herausforderungen löst, wird empfohlen, die entsprechende Wireshark-Dokumentation über Filterung zu lesen.
SOLUTION (by wasp1337)
Filter: `http` --> Frame 176 --> FlagDie Lösung dieses Problems erfordert einen logischen Ausdruck, der nach der Quell-IP-Adresse (192.168.100.3) und dem Protokoll (DNS) filtert.
SOLUTION (by wasp1337)
Filter: `dns and ip.src == 192.168.100.3` --> FlagUm diese Challenge zu lösen, ist ein logischer Ausdruck erforderlich, der nach Paketen mit Kommentaren filtert.
SOLUTION (by wasp1337)
Filter: `frame.comment` --> FlagDie Lösung dieser Challenge erfordert einen logischen Ausdruck, der nur die Pakete auswählt, die die Zeichenfolge "Pwn all the things!!!" enthalten.
Die Flag muss dann standardmäßig wie folgt formatiert werden: flag{...}.
SOLUTION (by wasp1337)
Filter: `frame contains "Pwn all the things!!!"` --> FlagDiese Challenge konzentriert sich auf TCP-Konversationen (TCP Streams). Die Flag wird Zeichen für Zeichen in mehrere TCP-Pakete unterteilt, die zur selben Sitzung gehören.
Da die pcap-Datei groß ist und auch viele verstreute ICMP-Pakete enthält, besteht die effizienteste Lösung darin, die betreffende Sitzung zu filtern und vollständig anzuzeigen.
SOLUTION (by wasp1337)
follow TCP Stream --> `The flag is incoming...` --> FlagDiese Challenge konzentriert sich auf die Analyse und Extraktion der Bytes eines bestimmten Pakets. In dieser Capture-Datei gibt es einen kurzen Austausch von TCP-Paketen, insbesondere der Frame mit Daten, die von IP 192.168.100.1 an 192.168.100.2 gesendet werden, ist für uns von Interesse.
Um die Flag zu erhalten, müssen die Bytes dieses Pakets extrahiert und sein Inhalt analysiert werden. Weitere Informationen hierzu finden Sie in der entsprechenden Dokumentation.
SOLUTION (by wasp1337)
frame 6 data --> Paketbytes anzeigen, komprimiert, als Hexdump --> FlagSOLUTION (by ???)
SOLUTION (by ???)
This series of introductory web security challenges will introduce the HTTP protocol and the main web technologies commonly associated with it, and some simple tools for interacting with it.
The individual challenges will follow the jeopardy model, thus focusing on obtaining flags.
The examples and explanations proposed will refer to the Python language and its standard library, as well as to the requests and BeautifulSoup libraries, which we therefore recommend installing in order to best follow this path.
Installation of the recommended libraries on Debian and Ubuntu Linux
sudo apt install python3-requests python3-bs4
On Windows systems, manually install the Python interpreter obtainable from the official Python project website and run in the command prompt
pip install requests bs4
Conceived to facilitate access to hypertext documents, the HyperText Transfer Protocol HTTP is used today to transfer information of all kinds to and from remote servers over the network. This information is organised into resources, identified by address strings called URLs (Unified Resource Locators), and the basic operations that can be performed on these resources are called HTTP verbs.
The simplest of these verbs, GET, is used to obtain a resource from a remote server. The objective of this challenge is to obtain the text of the root resource from the server web-01.challs.olicyber.it, identified by the URL http://web-01.challs.olicyber.it/.
We recommend using the get function of the requests library.
Deepening: it can be observed that a URL is generally composed of a schema (in this case http) identifying the mechanism for accessing the resource, an optional Internet address including a port (web-01.challs.olicyber.it) and a path (in this case / identifying the root resource). The resources are organised in a tree structure reminiscent of that of a file system, where / is the main resource, while the child resources are identified as /resource1, /resource2, /super-resource/sub-resource, /resource/annotated/on/five/levels. This makes it possible to easily represent resources that can be decomposed into smaller parts (e.g. /users the resource representing all the users of a site, while /users/luca represents a single user, Luca).
SOLUTION (by wasp1337)
just follow the link ;)Die Anfrage für bestimmte Ressourcen kann parametrisiert werden, um bestimmte Versionen der betreffenden Ressource zu erhalten. Ein Blog könnte zum Beispiel eine einzige Ressource verwenden, um alle veröffentlichten Beiträge (die strukturell alle gleich sind und sich nur im Inhalt unterscheiden) zu repräsentieren, indem der gewünschte spezifische Inhalt über einen numerischen Parameter id identifiziert wird.
Das Ziel dieser Aufgabe ist es, die Ressource http://web-02.challs.olicyber.it/server-records zu erhalten, indem der id-Parameter mit dem Flag-Wert angegeben wird. Wir empfehlen die Verwendung des params-Schlüsselworts der in der vorherigen Aufgabe beschriebenen get-Funktion.
SOLUTION (by wasp1337)
hxxp[://]web-02[.]challs[.]olicyber[.]it/server-records?id=flagWhen an HTTP request is sent, in addition to the verb, the path to the desired resource and any associated parameters, some additional information is communicated to the server in fields called headers (from the fact that they are sent in the first part of the HTTP message). Similarly, the server will also attach headers to the response in addition to the requested content. These headers differ from the GET request parameters in that they are not used to specify the requested resource, but contain information regarding the client (called the user-agent), the server and the communication channel, metadata associated with the resource, and any debugging information.
These headers are generally inserted automatically by the client and server libraries and belong to a standard set defined as part of the protocol itself; however, additional ones may be specified to meet the needs of particular applications. These non-standard headers normally have names beginning with X- and when sent to a system unable to recognise them are usually ignored.
In this challenge, a non-standard header has been used to provide a homegrown authentication mechanism. The goal is to obtain the resource text at http://web-03.challs.olicyber.it/flag, but the server will only respond to requests that contain the X-Password header containing the correct password, admin.
We recommend using the headers keyword of the get function used in previous challenges.
N.B.: the HTTP protocol already provides several authentication mechanisms via the standard Authorisation header, which are generally more complex than the 'craft' authentication example presented in this challenge. Rather than manipulating the Authorization header directly, when necessary libraries such as requests provide specific methods to interface with it.
SOLUTION (by wasp1337)
in BurpSuite, set target scope to http://web-03.challs.olicyber.it/flag, open website in burp browser --> Response = Unauthorized. From HTTP history send GET request to repeater and add request header "X-Password:admin" --> send --> flagThat of a resource, in HTTP, is a very abstract concept. A resource does not necessarily designate a file on a disk, but could just as easily be a hardware device, the contents of a database, the output of a programme, or more generally anything that can be abstractly represented as a collection of data.
When we 'request a resource' through HTTP, we are not really receiving the original resource (which in some cases is not even physically transferable through the network, think of the example of a hardware device), but a representation of it.
The resources offered by a server usually have a single representation, but in some cases it is possible to request (and receive) several equivalent representations, so that the format that is easiest for the client to process can be chosen.
The Accept header sent as part of the request specifies a list of formats that the client considers 'acceptable' in order of preference, using a classification system known as the MIME type (a complete list of available MIME types may be consulted on the official site of the IANA organisation responsible for assigning them).
Sometimes, for instance due to inattention related to the different characteristics of the various formats, the various representations of a resource are not truly equivalent, and an alternative representation may reveal additional information that was thought to be secret.
The objective of this challenge is to request the resource http://web-04.challs.olicyber.it/users using the alternative representation application/xml instead of the default application/json.
We recommend trying to obtain the resource normally, and then specifying a different representation type (application/xml) via the Accept header.
SOLUTION (by wasp1337)
maybe I was just lucky but visiting the webpage gave me "This XML file does not appear to have any style information associated with it. The document tree is shown below." and there was the flag ;)Among the information exchanged between client and server via HTTP headers are small pieces of information called cookies. Unlike non-standard headers, cookies are specifically designed by the HTTP standard to contain arbitrary data useful for the operation of sites and web services, and are commonly used as part of authentication mechanisms in addition to those offered by the standard.
Similar to challenge number 3, the goal is to obtain the resource http://web-05.challs.olicyber.it/flag by providing the string admin in a cookie named password. We recommend using the cookies parameter of the get function used so far.
SOLUTION (by wasp1337)
in BurpSuite, set target scope to http://web-05.challs.olicyber.it/flag, open website in burp browser --> Response = Unauthorized. From HTTP history send GET request to repeater and add request cookie name=password, value=admin" --> send --> flagThe cookie mechanism is not a redundant mechanism compared to the other types of parameter observed so far. In contrast to them, in fact, the server is able to request the installation of cookies provided by it in the client's memory. These cookies are associated with the site that generated them, and may contain an expiry date.
In web browsers this storage is handled automatically, and saved cookies are automatically sent in subsequent requests sent to the same site, and deleted when the specified date is reached. In this way they can be used to identify a session with a specific client, i.e. a series of consecutive requests made by the same device, even when several devices are connected to the Internet through the same sub-network and thus share IP addresses.
The objective of this challenge is to execute a GET request to the http://web-06.challs.olicyber.it/token resource that will attempt to install a session cookie, once it has been obtained, it will be possible to access http://web-06.challs.olicyber.it/flag to obtain the flag.
The get function of the requests library used so far adopts a stateless model, i.e. it does not use any of the information previously received from the server in composing subsequent requests. To complete this challenge, it is advisable to instantiate an object of class Session and execute requests via its get method, which differs from the normal get function precisely in that it stores this information within the object, partially emulating the behaviour of a browser.
SOLUTION (by wasp1337)
in BurpSuite, set target scope to http://web-6.challs.olicyber.it, open http://web-6.challs.olicyber.it/token in burp browser --> From HTTP history send GET request to repeater and change /token to /flag --> send --> flagIt may sometimes be interesting for a client to know the metadata of a resource without necessarily having to receive its entire representation (think for instance of the case of a large file). It is precisely for these cases that the HTTP protocol provides the HEAD verb, designed to obtain in response the headers of an equivalent GET request, but without performing the transfer of the resource.
The headers returned should be identical to those of an analogous GET request but, as in the case of the Accept header, a faulty or misconfigured server may accidentally leak additional information that would not be included in the response to a normal GET request.
The objective of this challenge is to make a HEAD request to the resource http://web-07.challs.olicyber.it/ and observe the returned headers. We recommend using the head function of the requests library, which is used in a similar way to the get function.
SOLUTION (by wasp1337)
[ViewDNS.info](https://viewdns.info/) --> Tools --> Get HTTP Headers -- enter http://web-07.challs.olicyber.it --> flagSo far, we have dealt exclusively with obtaining resources from the server, but HTTP also provides tools for the reverse operation. These are the POST and PUT verbs, which allow you to send a resource to the server by specifying a destination address. The difference between the two methods is subtle, but we will only deal with POST, by far the most used of the two, being the system associated, for example, with sending the content of forms that are included in many websites.
In principle, the representation of the resource sent in the body of a POST request may use any format but, for historical reasons, when using the browser's built-in sending mechanism to send the content of a form, this is normally encoded using a specific legacy format used exclusively for web forms, known in the MIME classification as application/x-www-form-urlencoded. For this reason, many servers that receive data from users via POST requests preferentially accept this format, even when the data source is not a web form.
The objective of this challenge is to send a POST request to the resource http://web-08.challs.olicyber.it/login by providing in the format application/x-www-form-urlencoded the value pair 'username': 'admin' and 'password': 'admin', analogous to a hypothetical operation of sending a login form on a website. The flag will be returned in the text of the reply to the operation.
The application/x-www-form-urlencoded format is relatively complicated to reproduce but, just like other parts of the HTTP protocol observed so far, it essentially represents a sequence of key-value pairs, and the requests library provides a mechanism to generate it automatically from a Python dictionary. We recommend using the date parameter of the requests library's post function.
SOLUTION (by wasp1337)
application/x-www-form-urlencoded: the keys and values are encoded in key-value tuples separated by '&', with a '=' between the key and the value. Non-alphanumeric characters in both keys and values are URL encoded - a way of encoding key-value pairs as a string in the format of key1=value1&key2=value2.In Burp Suite Browser visit website, you get an answer that tells you that this method is not allowed (GET). Send the GET request to the repeater and change GET to POST. Add the credentials as Request body parameters. Send --> flag
application/x-www-form-urlencoded, in spite of its historical diffusion, is an obsolescent format and poorly suited to representing structured data, so it has been gradually supplanted, in those applications that do not require compatibility with the traditional web form submission mechanism, by more modern formats such as XML and JSON.
The latter, in particular, by virtue of its simplicity of use in JavaScript, the most widespread web programming language, has rapidly established itself as a new de-facto standard, whereby libraries such as Requests offer shortcuts to send POST requests with bodies encoded in JSON with the same ease offered for the old system, as well as to automatically decode any resources returned in that format by the server in replies.
Similarly to the previous one, the objective of this challenge is to send a POST request towards the resource http://web-09.challs.olicyber.it/login by supplying in JSON format the value pair "username": "admin" and "password": "admin", similarly to a hypothetical login operation towards a web service. The flag will be returned in the text of the response to the operation.
SOLUTION (by wasp1337)
In Burp Suite Browser visit website, you get an answer that tells you that this method is not allowed (GET). Send the GET request to the repeater and change GET to POST. Add the credentials as json. Send --> flagPOST /login HTTP/1.1
Host: web-09.challs.olicyber.it
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Accept: text/html,application/json,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-xchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
Content-Type: application/json
Content-Length: 47
{
"username":"admin",
"password":"admin"
}
We have so far observed various ways of interacting with the resources that an HTTP server makes available, in the form of the verbs GET, HEAD and POST, but not all of these operations are supported by all types of resources. For instance, it does not make sense to perform a POST request against a read-only resource. In order to know the operations supported by a given resource, HTTP provides the verb OPTIONS. An OPTIONS request returns the list of supported verbs within the Allow header.
It may sometimes be interesting to intentionally try to use an unsupported verb. Normally, a server should handle unsupported requests cleanly, but in the presence of incorrect configurations or programming errors, using an unexpected method can lead to a crash. Crashes and, more generally, unanticipated operations can reveal interesting information that is hidden in the normal use of a web service.
The objective of this challenge is to determine the set of supported verbs for the resource http://web-10.challs.olicyber.it/, try to use an uncommon and unexpected one, and observe the response. The requests library also provides functions similar to the get function for less common verbs, such as put and patch.
SOLUTION (by wasp1337)
In Burp Suite Browser visit website. Send the GET request to the repeater and change GET to POST or PUT or PATCH. Send --> flagThe CSRF token is a system used to prevent the execution of Cross-Site Request Forgery attacks. The attack would consist of tricking a user of a web service into clicking on a link or a form submit button included in an e-mail or on a site controlled by the attacker, targeting a 'dangerous' resource of the target service (e.g. a resource whose request represents an account deletion command). The session cookie mechanism, which can only be obtained with a username and password unknown to the attacker, prevents the attacker from personally performing the 'dangerous' operation by impersonating the user, but if the user is tricked into clicking the malicious link on a machine previously logged in to the target service, the cookie containing the session token will be automatically attached to the request made, validating it, without the attacker needing to steal it or reproduce a forged one.
The CSRF token prevents this type of attack because it is not automatically sent by the browser as is the case with normal cookies. It is, however, stored on the client machine in a storage that is accessible only to the resources associated with the relevant service (and therefore out of the attacker's control), but must be explicitly attached to HTTP requests in the form of, for instance, a GET parameter, or within the body of a POST request, when these are executed. This makes it impossible to lead the user to generate a dangerous request with a simple click, because in order to generate a dangerous link, the attacker would be forced to know the token. To complicate matters further, CSRF tokens are typically disposable, and with each successfully completed operation the client receives a new randomly generated one. The new token is usually added to the body of the returned resource.
In this challenge, the flag is divided into four pieces, accessible via the resource http://web-11.challs.olicyber.it/flag_piece according to the index parameter. To access them, it is necessary to have previously sent a login POST request to the http://web-11.challs.olicyber.it/login resource, with a JSON body containing "username": "admin" and "password": "admin", and to have received a session cookie in return. In addition to the session token in the cookie, the login resource will also return a CSRF token in the response body (also JSON). With each successfully executed request, the client will receive a new token to use for the next one.
We recommend using a Session object to handle the session cookie, and the response objects json method to decode the body automatically.
SOLUTION (by wasp1337)
POST /login HTTP/1.1
Host: web-11.challs.olicyber.it
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Accept: text/html,application/json,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
Content-Type: application/json
Content-Length: 47
{
"username":"admin",
"password":"admin"
}
This gives you a session cookie and a CSRF token.
POST /login HTTP/1.1
Host: web-11.challs.olicyber.it
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.160 Safari/537.36
Accept: text/html,application/json,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close
Content-Type: application/json
Content-Length: 77
Cookie: session=20021869-37d7-4ddc-81b6-3034c62c716f
{
"username":"admin",
"password":"admin",
"csrf": "6372adabcbe12734"
}
This works, but sending it as a GET request to /flag_piece fails with "Unauthorized. Bad CSRF token." --> TBD
SOLUTION (by wasp1337)
`admin' OR 1=1 --'`SOLUTION (by wasp1337)
`1' UNION SELECT * FROM dummy_data WHERE id>='2` shows that there are 4 entries, but no flag yet... Click Avanti. --> TBDSOLUTION (by wasp1337)
SOLUTION (by wasp1337)
In dieser Challenge-Serie werden wir einige der Grundlagen vorstellen, die zur Lösung kryptografischer Probleme erforderlich sind. Zunächst einmal ist es gut, das Konzept der Kodierung zu verstehen. Eine Kodierung ist ein System von Signalen oder Symbolen, die üblicherweise zur Darstellung von Informationen verwendet werden. Grundsätzlich wird jede Information in einem Computer durch Folgen von 0 und 1 (Bits) dargestellt. Diese sind jedoch recht unhandlich, so dass ihnen in der Regel eine weitere Kodierung überlagert wird, wenn dies sinnvoll ist.
ASCII zum Beispiel ist ein Standardcode, der es ermöglicht, Text (und einige andere Steuerzeichen) durch Sequenzen von 7 Bits (bzw. ganze Zahlen von 0 bis 127) darzustellen.
In Python führt die Funktion chr() die Umwandlung von Zahlen in Zeichen durch (die Funktion ord() macht das Gegenteil); ansonsten können Sie sich mit Online-Tools wie CyberChef behelfen.
Das Flag für diese Aufgabe erhält man, indem man diese Zahlen in die entsprechenden ASCII-Zeichen umwandelt (dekodiert).
[102, 108, 97, 103, 123, 117, 103, 104, 95, 78, 117, 109, 66, 51, 114, 53, 95, 52, 49, 114, 51, 52, 100, 121, 125]
SOLUTION (by wasp1337)
In Cyberchef: Leerzeichen und [] entfernen --> From Charcode, Delimiter Comma, Base 10 --> FlagKonventionell werden Bitsequenzen in Bytes unterteilt, d. h. in benachbarte Teilsequenzen von jeweils 8 Bits.
Die hexadezimale Kodierung (oder Basis 16) ermöglicht eine sehr bequeme Darstellung.
Ein Byte wird in zwei benachbarte Sequenzen von je vier Bits unterteilt: Diese können, binär gelesen, als zwei ganze Zahlen von 0 bis 15 verstanden werden, die dann durch die Zeichen "0", "1", ..., "9", "a", "b", ..., "f" dargestellt werden.
Beispiel: 01101110 → 0110, 1110 → 6, 14 → '6', 'e' → '6e'.
Jedes Byte wird also in eine Folge von zwei Zeichen umgewandelt.
In Python werden Bytesequenzen mit Hilfe der Klasse bytes verarbeitet. Die Methode .hex() wird verwendet, um die entsprechende hexadezimale Zeichenfolge zu erhalten, während die Funktion bytes.fromhex(s) das Bytes-Objekt zurückgibt, das der hexadezimalen Zeichenfolge s entspricht.
Um das Flag zu erhalten, wird die folgende Zeichenkette in die entsprechende Bytefolge umgewandelt.
666c61677b68337834646563696d616c5f63346e5f62335f41424144424142457d
SOLUTION (by wasp1337)
In Cyberchef: From HEX, Delimiter none --> FlagIn der Kryptographie hat man es oft mit ganzen Zahlen zu tun. Diese werden in der Regel mit verschiedenen Kodierungen der entsprechenden Bitfolgen übertragen.
In der Regel wird jedoch die Darstellung zur Basis 10 vermieden und aus Gründen der Kompaktheit ein breiteres Alphabet von Zeichen bevorzugt.
Mögliche Alternativen sind die Hexadezimaldarstellung (wie in der vorherigen Herausforderung) oder die Basis 64.
Ein Beispiel für ein Snippet in Python, das eine Zeichenkette zur Basis 64 dekodiert:
#!/usr/bin/env python3 from base64 import b64decode s = 'aGVubG8gOik=' print(b64decode(s))
Um ein Byte-Objekt in ein int-Objekt umzuwandeln, kann in Python die Funktion int.from_bytes(b, endianness) verwendet werden, wobei b unser Byte-Objekt ist und endianness entweder eine "große" oder "kleine" Zeichenkette ist, die die Reihenfolge angibt, in der die Bytes von b gelesen werden sollen: von links nach rechts bzw. umgekehrt.
Um eine ganze Zahl z in Bytes umzuwandeln, kann man stattdessen die Funktion (z).to_bytes(n, endianness) verwenden: n gibt die Anzahl der Bytes an, die für die Umwandlung verwendet werden sollen, und zwar in der durch endianness vorgegebenen Reihenfolge.
Das Flag dieser Aufgabe ist in zwei Hälften unterteilt: Der erste Teil wird aus base64 dekodiert, während der zweite Teil die angegebene Zahl (in base10) in Bytes in Big Endian umwandelt.
ZmxhZ3t3NDF0XzF0c19hbGxfYjE=
664813035583918006462745898431981286737635929725
SOLUTION (by wasp1337)
In Cyberchef: 1. Teil from Base 64 oder python idle: ``` import base64 from base64 import b64decode print(b64decode('ZmxhZ3t3NDF0XzF0c19hbGxfYjE==')) ``` 2. Teil: tbdEine sehr einfache und wirksame Methode, eine Nachricht zu verschleiern, ist die Verwendung von xor mit einem geheimen Schlüssel. Die Definition bezieht sich auf logische Variablen (Wahr/Falsch), aber das Konzept kann schnell und natürlich auf Bit-Strings ausgedehnt werden: Das xor zwischen zwei binären Sequenzen wird so zum Bit-zu-Bit-xor.
Zum Beispiel: 00110000 xor 01100001 → 01010001.
In Python wird das Xor zwischen zwei Ganzzahlen durch den Operator ^ gebildet. Um zwei Zeichenketten zu xorieren, müssen Sie sie zunächst in Bytes umwandeln und dann die Operation byteweise durchführen.
Eine Funktion in Python, die das Xor zwischen zwei Bytes durchführt, kann sein:
def xor(a, b): return bytes([x^y for x,y in zip(a,b)])
Um das Flag für diese Aufgabe zu erhalten, xorieren Sie diese beiden Nachrichten: Achten Sie auf die korrekte Dekodierung von Hexadezimal in Bytes!
m1 = 158bbd7ca876c60530ee0e0bb2de20ef8af95bc60bdf m2 = 73e7dc1bd30ef6576f883e79edaa48dcd58e6aa82aa2
SOLUTION (by wasp1337)
m1 = 15 8b bd 7c a8 76 c6 05 30 ee 0e 0b b2 de 20 ef 8a f9 5b c6 0b df --> bin m2 = 73 e7 dc 1b d3 0e f6 57 6f 88 3e 79 ed aa 48 dc d5 8e 6a a8 2a a2 --> bin --> byteweise m1 XOR m2 --> bin to ASCII --> FlagDie Verschlüsselungsmethode, die in der vorherigen Herausforderung verwendet wurde, heißt One Time Pad. Ein wichtiges Detail für perfekte Sicherheit ist, dass der Schlüssel so lang wie die Nachricht ist. Wenn der Schlüssel sehr kurz ist (und sich z. B. wiederholt), kann ein Brute-Force-Angriff möglich sein: Man probiert alle in Frage kommenden Schlüssel aus und schaut, welcher ein vernünftiges Ergebnis liefert. In dieser Aufgabe ist der verwendete Schlüssel nur ein Byte lang. Finden Sie einen Weg, die Nachricht zu entschlüsseln. Bitte beachten Sie: Der Chiffretext beginnt nicht mit dem üblichen Flag{ und endet nicht mit }!
ciphertext = 104e137f425954137f74107f525511457f5468134d7f146c4c
Das Flag ist 'flag{' + Klartext + '}'.
SOLUTION (by ???)
___ _ _ _ _ _ _ _ ____ _ _ _
/ _ \| (_)_ __ ___ _ __ (_) __ _ __| (_) __| (_) / ___| _| |__ ___ _ __ ___ ___ ___ _ _ _ __(_) |_ _ _
| | | | | | '_ ` _ \| '_ \| |/ _` |/ _` | | / _` | | | | | | | | '_ \ / _ \ '__/ __|/ _ \/ __| | | | '__| | __| | | |
| |_| | | | | | | | | |_) | | (_| | (_| | | | (_| | | | |__| |_| | |_) | __/ | \__ \ __/ (__| |_| | | | | |_| |_| |
\___/|_|_|_| |_| |_| .__/|_|\__,_|\__,_|_| \__,_|_| \____\__, |_.__/ \___|_| |___/\___|\___|\__,_|_| |_|\__|\__, |
|_| |___/ |___/
Auf einer alten Festplatte fand ich ein Foto von einem Strandurlaub vor vielen Jahren. Ich erinnere mich noch an die Tage am Strand unter dem Sonnenschirm, im Badeanzug und mit Sonnenbrille! Ich frage mich, warum unter all den Fotos nur noch dieses eine übrig ist?
SOLUTION (by wasp1337)
In Photoshop öffnen und die Helligkeit herabsetzen, bis die Flag erscheint.Heute Morgen habe ich eine E-Mail erhalten, die diese Nachricht enthielt, aber ich kann nicht herausfinden, was sie bedeutet. Können Sie mir helfen, sie zu entziffern?
SOLUTION (by wasp1337)
In Cyberchef: from morsecode --> from Hex --> from binary --> from base64 --> flagDieses Bild enthält eine geheimnisvolle Botschaft. Kannst du sie finden?
SOLUTION (by wasp1337)
GIF mit 8 Frames, capture mit [Online GIF-Tools](https://onlinegiftools.com/play-gif) --> Frame 4 --> FlagHier bekommt man ein .wav file.
SOLUTION (by wasp1337)
I did a spectral analysis of the wav file with [dcode Spectral Analyzer](https://www.dcode.fr/spectral-analysis#q3) and transformed the result into Morse code. In CyberChef I used from Morse code and to kebab case --> flag{result}Ich habe die Flagge im Bild verloren, können Sie sie finden?
SOLUTION (by wasp1337)
Bild in Cyberchef, ohne Recipy --> Ende der Codeansicht --> FlagOh nein! Es scheint, dass jemand unseren Server mit Spyware infiziert hat und sensible Daten ausspioniert! Schnüffeln Sie herum und finden Sie heraus, welche Informationen die Malware an die böswilligen Parteien sendet!
SOLUTION (by wasp1337)
follow tcp-stream --> to hex --> flagKönnen Sie die Flag zwischen all diesen Paketen rekonstruieren?
SOLUTION (by wasp1337)
follow udp stream --> stream 1 --> flagKannst du die Katze finden?
SOLUTION (by wasp1337)
Datei --> Objekt exportieren --> http --> Frame 325 Gatto.jpeg --> flagKönnen Sie dem Stream folgen?
SOLUTION (by wasp1337)
follow tcp stream --> stream 10 --> flagIch habe diese Datei von einem sehr wichtigen Server gestohlen, aber ich kann in diesen Paketen nichts Nützliches finden, ihre Sicherheit ist undurchdringlich. Die Pakete sind alle verschlüsselt oder unbrauchbar, besser woanders suchen.
SOLUTION (by ???)
Ich habe mich drei Tage lang unter einem Tisch im Poca Cola-Hauptquartier versteckt, ich habe ihre gesamte Kommunikation zurückverfolgt! Bitte finde das Geheimrezept, damit ich hier rauskomme...
SOLUTION (by wasp1337)
Filter: http.request.method==POST --> Frame 18626 enthält ricetta.txt.zip --> password protected --> john:.\zip2john.exe .ricetta.txt.zip > ricetta.txt
.\john.exe .\ricetta.txt
--> tbd
Nach dem spektakulären Erfolg von NumberWang gibt es nun eine neue Ausgabe des beliebten Spiels für Menschen zwischen 25 und 25einhalb Jahren: WordWang! Werden Sie WordWang bekommen können?
Sie können sich mit dem Fernservice verbinden mit:
ncat wordwang.challs.olicyber.it 10601
SOLUTION (by wasp1337)
Follow TCP stream --> Anleitung --> ``` ncat wordwang.challs.olicyber.it 10601 Welcome to Wordwang! The show where the words are wanged! hole [...] That's wordwang! Here's the flag: ``` -->flagBitte helfen Sie uns, den Inhalt der Webseiten aus diesem Traffic Log zu finden. Es gibt eine zusätzliche Datei, die Ihnen helfen kann: ....
SOLUTION:
SOLUTION (by kirkokirk)
-->No robots? -> robots.txt?http://no-robots.challs.olicyber.it/robots.txt
-->Try to open .html
Wenn wir eine Webseite laden, kommunizieren wir mit einem Server, aber was antwortet er uns? http://headache.challs.olicyber.it/
SOLUTION (by kirkokirk)
-->Headache -> something in header?-> look at header in inspect modus of Browser-> we find a flag field with flagIch habe auf einer unbenannten Website ein Anmeldeformular gefunden, habe aber keine Ahnung, wie die Anmeldeinformationen lauten ...
Würden Sie versuchen, sich für mich einzuloggen?
Website: http://just-a-reminder.challs.olicyber.it
SOLUTION (by kirkokirk)
-->Inspector Mode in Firefox and make login attempt-->Look at default.js code (that is executed at login)
-->Evaluate js- code in Interpreter:
AES_decrypt('U2FsdGVkX1/JEKDXgPl2RqtEgj0LMdp8/Q1FQelH7whIP49sq+WvNOeNjjXwmdrl', s3cr37)
"v3ry_l337_p455w0rd_!"
-->Login with user admin and password to get flag
SOLUTION (by kirkokirk)
-->cixd{xsb_zxbpxo_jlofqrof_qb_pxirqxkq} Looks like Shifted /Rotated letters-->Cixd -> flag?...would be rotated +3 ?
-->Try Rot brute force 1…26:
-->eg. Try with cyberchef: https://gchq.github.io/CyberChef/#recipe=ROT13(true,true,false,3/disabled)ROT13_Brute_Force(true,true,false,100,0,true,'')&input=Y2l4ZHt4c2JfenhicHhvX2psb2Zxcm9mX3FiX3B4aXJxeGtxfQ
Entschlüsseln Sie mich!
AAAABAAAAAAAABAABBBAABBABABAAABAABAABAABAABBBAABBAAAAABAABAABAABBBBAAA
Die Flagge hat nicht das Standardformat, also entschlüsseln Sie die Nachricht und fügen Sie sie anstelle von Punkten ein: flag{...}
HINT: Bacon tastes good ....
SOLUTION (by kirkokirk)
->Bacon (Speck)-> Bacon Decode?:https://de.wikipedia.org/wiki/Bacon-Chiffre
SOLUTION (by kirkokirk)
->Look for filetype└─$ file hidden_variable
hidden_variable: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=a49b8440fef01532ca63db6ed6a7ab59a704e8f6, for GNU/Linux 3.2.0, not stripped
-->Binary x86-64
-->Execute binary
└─$ ./hidden_variable
La tua flag è f_ag{.ł€“ß#[ Accidenti, sembra corrotta! Dove avrò lasciato l'originale?
->Search hexdump
└─$ xxd hidden_variables
................
00002f40: 0100 0000 0000 0000 f0ff ff6f 0000 0000 ...........o....
00002f50: f204 0000 0000 0000 f9ff ff6f 0000 0000 ...........o....
00002f60: 0300 0000 0000 0000 0000 0000 0000 0000 ................
00002f70: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00002f80: 0000 0000 0000 0000 0000 0000 0000 0000 ................
................
00003020: 6600 0000 6c00 0000 6100 0000 6700 0000 f...l...a...g...
00003030: 7b00 0000 7500 0000 6e00 0000 7500 0000 ?...?...?...?...
00003040: 3500 0000 3300 0000 6400 0000 5f00 0000 ?...?...?...?...
................