RSS
 

Archive for the ‘Hackvent 2019’ Category

Hackvent 2019: Hidden 1

06 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 6 December 2019

Challenge

HV19.H1 Hidden One

Solution

During the Day 6 challenge HV19.06 bacon and eggs, we notice there is a lot of suspicious whitespace (space and tab) characters after each line of statistics about Francis Bacon.

As the theme for this challenge was crypto, we Google search for white space cipher. One of the first few results links us to http://www.darkside.com.au/snow/ which details Whitespace steganography which can be used to conceal messages by appending whitespace to the end of lines! We download the 32-bit executable for this tool and run it as follows:

Where  input.txt is simply the statistic panel text including all whitespace.

This spits out our flag!

Flag:  HV19{1stHiddenFound}

 
No Comments

Posted in Hackvent 2019

 

Hackvent 2019: Day 6

06 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 6 December 2019

Challenge

HV19.H1 Hidden One

Francis Bacon was an English philosopher and statesman who served as Attorney General and as Lord Chancellor of England. His works are credited with developing the scientific method and remained influential through the scientific revolution. Bacon has been called the father of empiricism. His works argued for the possibility of scientific knowledge based only upon inductive reasoning and careful observation of events in nature. Most importantly, he argued science could be achieved by use of a sceptical and methodical approach whereby scientists aim to avoid misleading themselves. Although his practical ideas about such a method, the Baconian method, did not have a longlasting influence, the general idea of the importance and possibility of a sceptical methodology makes Bacon the father of the scientific method. This method was a new rhetorical and theoretical framework for science, the practical details of which are still central in debates about science and methodology.

Bacon was the first recipient of the Queen’s counsel designation, which was conferred in 1597 when Elizabeth I of England reserved Bacon as her legal advisor. After the accession of James VI and I in 1603, Bacon was knighted. He was later created Baron Verulam in 1618 and Viscount St. Alban in 1621. Because he had no heirs, both titles became extinct upon his death in 1626, at 65 years. Bacon died of pneumonia, with one account by John Aubrey stating that he had contracted the condition while studying the effects of freezing on the preservation of meat. He is buried at St Michael’s Church, St Albans, Hertfordshire.

Solution

We notice there is italic text embedded within our first paragraph. As it turns out Francis Bacon devised a cipher called the Bacon cipher. Thus, we know we must transform the above text into a bacon code which can be deciphered. Each character that is stylised with italics will be converted to a B and every other character will be converted to an A. For effeciency, we use a python script to do this:

It is important to note that we strip out some non-alphanumeric characters such as  ,.-  as  the Bacon cipher does not allow them in its alphabet.
Running this script we get the following output:

We use an online Bacon Cipher tool to decipher the text and get:

Which can be read as:

We follow these instructions, adding in the missing 19, to get our final flag!

Flag:  HV19{BACONCIPHERISSIMPLEBUTCOOL}

Bonus

This challenge also contained the solution to HV19.H1 Hidden One.

 
No Comments

Posted in Hackvent 2019

 

Hackvent 2019: Day 5

05 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 5 December 2019

Challenge

HV19.05 Santa Parcel Tracking

Image mirror:

Solution

Initially we try scanning the barcode as it looks like a Code 128 barcode. It works but gives us the string Not a solution which is unfortunately a dead end. After a lot of experimentation, we manually note down the hexadecimal values for each colour in sequence. We decided to use Photoshop’s colour picker but in hindsight should have done this pragmatically using MATLAB.

This gives us the following list of 64 hex codes:

After more experimentation, we discover that the blue channel of each hex code is significant! We discard all data but the blue channel and run our sequence of hex codes through an online hex to ascii converter.

This gives us the following string which has our flag surrounded by what appears to be noise:

Flag:  HV19{D1fficult_to_g3t_a_SPT_R3ader}

 
No Comments

Posted in Hackvent 2019

 

Hackvent 2019: Day 4

05 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 4 December 2019

Challenge

HV19.04 password policy circumvention

File mirror: HV19-PPC.zip

Solution

We download this zip file and extract it to find a HV19-PPC.ahk  file. We know that ahk files are AutoHotKey files. Upon inspecting the ahk file we find that this is in fact the case.

The script seems to move the cursor around and type text when certain characters are typed in.
As the script and hint suggests, we have to type in merry christmas geeks letter by letter and let the script mutate the string.

Doing so gives us our flag!

Flag:  HV19{R3memb3r, rem3mber - the 24th 0f December}

 
No Comments

Posted in Hackvent 2019

 

Hackvent 2019: Day 3

03 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 3 December 2019

Challenge

HV19.03 Hodor, Hodor, Hodor

Solution

At first this looks like it may possible be a hidden code with different variations of hodor mapping to English alphabet characters. However, before we look into frequency analysis we do a Google search for hodor programming language and discover that such an esoteric language exists!

We find an online interpreter/compiler TIO capable of running Hodor code and get this output:

As the hint suggests, we need to base64 decode that last string.

Doing so gives us our flag!

Flag:  HV19{h01d-th3-d00r-4204-ld4Y}

 
No Comments

Posted in Hackvent 2019

 

HACKvent 2019: Day 2

02 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 2 December 2019

Challenge

HV19.02 Triangulation

File mirror:
a5f47ab8-f151-4741-b061-d2ab331bf641

Solution

We know that a stl file is 3D model file. Thus naturally we open this file up in a 3D model viewer.
On Windows we initially attempt to use 3D Builder.

From the hint that says to ‘not break it’ so we really want to break it and look inside the sphere.
Upon doing so, we quickly notice a QR code (or rather a Aztec code) sitting inside.

After much manipulation in 3D Builder, we still don’t quite have an image which scans with a QR reader:

Thus, we shamefully give up and use Blender to extract the QR code, colour it black and place it on a white background:

This image scans and gives us our flag!

Flag:  HV19{Cr4ck_Th3_B411!}

 
No Comments

Posted in Hackvent 2019

 

HACKvent 2019: Day 1

02 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 2 December 2019

Challenge

HV19.01 censored

Solution

The hint indicates that we should have a clearer smaller image available to us.
At first we attempt to shrink the image, resharpen and enlarge but there is too much degradation for that to work. We also open the image in GIMP and mess with levels/contrast with no luck.

Finally, we use binwalk on the image to find hidden binaries and find:

We extract the second JPEG image in this file which gives us a smaller preview thumbnail but with a crisp QR code!


This image is good enough to scan and gives us our flag!

Flag:  HV19{just-4-PREview!}

 
No Comments

Posted in Hackvent 2019