Skip to content

Commit aae70f9

Browse files
author
Michael Zhang
authored
Merge pull request #25 from ValarDragon/master
Added My USB and Scisnerof Writeups
2 parents be1fb17 + 51f3cf5 commit aae70f9

6 files changed

+181
-6
lines changed

‎cryptography.md

+1-4
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This category focuses on using advanced mathematical topics to encrypt data to p
77
* [RSA 1 \[50 points\]](/cryptography/rsa-1-50-points.md)
88
* Let Me Be Frank \[75 points\]
99
* RSA 2 \[80 points\]
10-
* Decode Me \[100 points\]
10+
* [Decode Me \[100 points\]](/cryptography/decode-me-100-points.md)
1111
* [Hash on Hash \[100 points\]](/cryptography/hash-on-hash-100-points.md)
1212
* RSA 3 \[135 points\]
1313
* Diffie-cult \[140 points\]
@@ -18,6 +18,3 @@ This category focuses on using advanced mathematical topics to encrypt data to p
1818
* [Genius \[230 points\]](/cryptography/genius-230-points.md)
1919
* [Premium RSA \[350 points\]](/cryptography/premium-rsa-350-points.md)
2020
* [Paillier Service \[400 points\]](/cryptography/paillier-service-400-points.md)
21-
22-
23-

‎forensics.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,14 @@ This category refers to the recovery of information from evidence, like extracti
44

55
* [20xx \[50 points\]](/forensics/20xx-50-points.md)
66
* [Mane Event \[50 points\]](/forensics/mane-event-50-points.md)
7-
* scisnerof \[70 points\]
7+
* [scisnerof \[70 points\]](/forensics/scisnerof-70-points.md)
88
* [Petty Difference \[75 points\]](/forensics/petty-difference-75-points.md)
99
* Flag Collection \[80 points\]
1010
* Zooooooom \[85 points\]
1111
* QR 1 \[100 points\]
1212
* Gibberish \[100 points\]
1313
* Ogrewatch \[100 points\]
14-
* My USB \[150 points\]
14+
* My USB [\[150 points\]](/forensics/my-usb-150-points.md)
1515
* [Flag PEG \[150 points\]](/forensics/flag-peg-150-points.md)
1616
* ZIP Tunnel \[160 points\]
1717
* [Finn \[200 points\]](/forensics/finn-200-points.md)

‎forensics/my-usb-150-points.md

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# My USB - 150 points
2+
3+
I found_ [my usb](https://github.com/EasyCTF/easyctf-2017-problems/blob/master/my-usb/usb.img) from a long time ago. I know there's a flag on there somewhere; can you help me find it?
4+
5+
### Solution
6+
###### Writeup by Valar Dragon
7+
8+
We're given a USB img. First thing I did was try to actually restore the USB image onto a USB. We see a document called "hack.docx", with two images in it, and a zip file called flag.zip, with an image of the usaflag in it, and an image called cryptolock.png.
9+
10+
Doing my standard forensic analysis, like looking at hexdumps, and looking for other file headers through scalpel, yielded nothing.
11+
There is some code that is visible on both of the images inside the word file, but it seems too distorted to be relevant.
12+
13+
Then I thought to scalpel the original USB img file.
14+
15+
``` bash
16+
$ scalpel -c scalpelConfig.txt usb.img
17+
```
18+
19+
This gives 3 images, instead of just the two inside of the docx! (It doesn't give the image inside of flag.zip)
20+
21+
Heres the extra file:
22+
23+
![flag.jpg](https://raw.githubusercontent.com/HackThisCode/CTF-Writeups/master/2017/EasyCTF/My%20USB/flag.jpg)
24+
25+
Theres our flag!
26+
`flag{d3let3d_f1l3z_r_k00l}`
27+
28+
### External Writeups
29+
30+
* [https://github.com/HackThisCode/CTF-Writeups/blob/master/2017/EasyCTF/My%20USB/README.md](https://github.com/HackThisCode/CTF-Writeups/blob/master/2017/EasyCTF/My%20USB/README.md)

‎forensics/scisnerof-75-points.md

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Scisnerof - 70 points
2+
3+
I found weird file! [elif](https://github.com/EasyCTF/easyctf-2017-problems/blob/master/scisnerof/elif)
4+
5+
### Solution
6+
###### Writeup by Valar Dragon
7+
8+
Scisnerof is Forensics backwards, and elif is file backwards! It seems likely that elif is a reversed file.
9+
This "elif" file has no default app, so let us look at it through a hex editor. I used Bless, a hex editor for linux.
10+
11+
![hexdump.png](https://raw.githubusercontent.com/HackThisCode/CTF-Writeups/master/2017/EasyCTF/scisnerof/hexdump.png)
12+
If we scroll to the bottom, we see that theres the PNG File header reversed to GNP!
13+
14+
So it looks we just need to reverse the file!
15+
We can do it in one line with python
16+
``` python
17+
$ python3
18+
open('scisnerof.png','bw+').write(open('elif','br').read()[::-1])
19+
```
20+
21+
Then open up [scisnerof.png](https://raw.githubusercontent.com/HackThisCode/CTF-Writeups/master/2017/EasyCTF/scisnerof/scisnerof.png),
22+
![scisnerof.png](https://raw.githubusercontent.com/HackThisCode/CTF-Writeups/master/2017/EasyCTF/scisnerof/scisnerof.png)
23+
and theres our flag! `easyctf{r3v3r5ed_4ensics}`
24+
25+
26+
### External Writeups
27+
28+
* [https://github.com/HackThisCode/CTF-Writeups/blob/master/2017/EasyCTF/scisnerof/README.md](https://github.com/HackThisCode/CTF-Writeups/blob/master/2017/EasyCTF/scisnerof/README.md)

‎web/edge-2-200-points.md

+116
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# Edge 2 - 200 points
2+
3+
Last time we screwed up. But we've learned our lesson.
4+
5+
### Solution
6+
###### Writeup by Valar Dragon
7+
8+
Beginning with the same procedure as Edge 1, navigate to `/.git`
9+
10+
![Git Directory Image](https://raw.githubusercontent.com/HackThisCode/CTF-Writeups/master/2017/EasyCTF/Edge%202/gitDir.png)
11+
12+
So the directory exists, but they've blocked directory listing!
13+
14+
So were going to do the same attack at last time, but instead of doing a recursive download, we will have to download the files manually.
15+
There is going to be a lot of overlap between the Edge 1 and Edge 2 .git directories, since they are both cloned from the same project.
16+
So lets start by copying everything from Edge 1 into an Edge 2 directory.
17+
18+
![.git ls](https://raw.githubusercontent.com/HackThisCode/CTF-Writeups/master/2017/EasyCTF/Edge%202/gitLs.png)
19+
20+
So we need to replace all the `logs, refs, COMMIT_EDITMSG, HEAD, index, and then finally the objects`.
21+
22+
Updating everything but objects is pretty straightforward.
23+
24+
Just navigate to the `/logs/HEAD` and `logs/refs/heads/master` to ge those files, and likewise for the rest of the files.
25+
26+
Now we can take the git log!
27+
28+
``` html
29+
$ git log
30+
commit a48ee6d6ca840b9130fbaa73bbf55e9e730e4cfd
31+
Author: Michael <michael@easyctf.com>
32+
Date: Mon Mar 13 07:32:12 2017 +0000
33+
34+
Prevent directory listing.
35+
36+
commit 6b4131bb3b84e9446218359414d636bda782d097
37+
Author: Michael <michael@easyctf.com>
38+
Date: Mon Mar 13 07:32:10 2017 +0000
39+
40+
Whoops! Remove flag.
41+
42+
commit 26e35470d38c4d6815bc4426a862d5399f04865c
43+
Author: Michael <michael@easyctf.com>
44+
Date: Mon Mar 13 07:32:09 2017 +0000
45+
46+
Initial.
47+
48+
commit 15ca375e54f056a576905b41a417b413c57df6eb
49+
Author: Fernando <fermayo@gmail.com>
50+
Date: Sat Dec 14 12:50:09 2013 -0300
51+
52+
initial version
53+
54+
```
55+
56+
Now we have to update the objects directory. Here is the format of the directory:
57+
58+
```
59+
$ ls objects
60+
09 15 3e 61 6a 7b 8a 96 9e a7 b9 bf e0 ee pack
61+
14 37 5d 64 71 7c 94 9b a1 af bd d1 ed info
62+
$ ls objects/15
63+
ca375e54f056a576905b41a417b413c57df6eb
64+
$ cat objects/15/ca375e54f056a576905b41a417b413c57df6eb
65+
x�jC!��)�@ˮ������cյ��)��yW��
66+
67+
L�ե��Et��|4NE��H7����E{�Uw�җ�8Q >�d���>W\A���[t\�Q�\�c�o��{�Rd6������J�]5�-��v� @���[�n�j�����d>���3�D�
68+
```
69+
Each folder in objects is the first 2 characters of the SHA1, and the names of the files are the rest of the SHA1.
70+
The contents of each file is not ascii.
71+
Git objects are actually zlib compressed to save space, so
72+
``` html
73+
$ zlib-flate -uncompress < objects/15/ca375e54f056a576905b41a417b413c57df6eb commit 220tree 7b456b0125e74b44d1147182019c704c53132013
74+
parent 8ac4f76df2ce8db696d75f5f146f4047a315af22
75+
author Fernando <fermayo@gmail.com> 1387036209 -0300
76+
committer Fernando <fermayo@gmail.com> 1387036209 -0300
77+
78+
initial version
79+
80+
```
81+
So each commit has a git object with files it edited!
82+
So we are going to need to checkout the commit:
83+
``` html
84+
commit 26e35470d38c4d6815bc4426a862d5399f04865c
85+
Author: Michael <michael@easyctf.com>
86+
Date: Mon Mar 13 07:32:09 2017 +0000
87+
88+
Initial.
89+
```
90+
So
91+
92+
``` html
93+
$ zlib-flate -uncompress < objects/26/e35470d38c4d6815bc4426a862d5399f04865c
94+
commit 215tree 323240a3983045cdc0dec2e88c1358e7998f2e39
95+
parent 15ca375e54f056a576905b41a417b413c57df6eb
96+
author Michael <michael@easyctf.com> 1489390329 +0000
97+
committer Michael <michael@easyctf.com> 1489390329 +0000
98+
99+
Initial.
100+
101+
```
102+
Then get the file `objects/32/3240a3983045cdc0dec2e88c1358e7998f2e39`
103+
I did the same for every other commit.
104+
105+
Then `git checkout 26e35470d38c4d6815bc4426a862d5399f04865c`
106+
and then theres a flag.txt in the main dir!
107+
```
108+
$ cat flag.txt
109+
easyctf{hiding_the_problem_doesn't_mean_it's_gone!}
110+
111+
```
112+
113+
114+
### External Writeups
115+
116+
* [https://github.com/HackThisCode/CTF-Writeups/blob/master/2017/EasyCTF/Edge%202/README.md](https://github.com/HackThisCode/CTF-Writeups/blob/master/2017/EasyCTF/Edge%202/README.md)

‎web/web-tunnel-260-points.md

+4
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,7 @@ Running the program for a few minutes and searching the output file for 'easyctf
3232

3333

3434
###### Flag: easyctf{y0u_sh0uld_b3_t1r3d_tr4v3ll1ng_all_th1s_w4y}
35+
36+
### External Writeups
37+
38+
* [https://github.com/HackThisCode/CTF-Writeups/blob/master/2017/EasyCTF/Web%20Tunnel/README.md](https://github.com/HackThisCode/CTF-Writeups/blob/master/2017/EasyCTF/Web%20Tunnel/README.md)

0 commit comments

Comments
 (0)