RSS
 

Archive for the ‘Hacking Lab’ Category

Hackvent 2019: Hidden 1

06 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 6 December 2019

Challenge

HV19.H1 Hidden One

Solution

During the Day 6 challenge HV19.06 bacon and eggs, we notice there is a lot of suspicious whitespace (space and tab) characters after each line of statistics about Francis Bacon.

As the theme for this challenge was crypto, we Google search for white space cipher. One of the first few results links us to http://www.darkside.com.au/snow/ which details Whitespace steganography which can be used to conceal messages by appending whitespace to the end of lines! We download the 32-bit executable for this tool and run it as follows:

Where  input.txt is simply the statistic panel text including all whitespace.

This spits out our flag!

Flag:  HV19{1stHiddenFound}

 
No Comments

Posted in Hackvent 2019

 

Hackvent 2019: Day 6

06 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 6 December 2019

Challenge

HV19.H1 Hidden One

Francis Bacon was an English philosopher and statesman who served as Attorney General and as Lord Chancellor of England. His works are credited with developing the scientific method and remained influential through the scientific revolution. Bacon has been called the father of empiricism. His works argued for the possibility of scientific knowledge based only upon inductive reasoning and careful observation of events in nature. Most importantly, he argued science could be achieved by use of a sceptical and methodical approach whereby scientists aim to avoid misleading themselves. Although his practical ideas about such a method, the Baconian method, did not have a long–lasting influence, the general idea of the importance and possibility of a sceptical methodology makes Bacon the father of the scientific method. This method was a new rhetorical and theoretical framework for science, the practical details of which are still central in debates about science and methodology.

Bacon was the first recipient of the Queen’s counsel designation, which was conferred in 1597 when Elizabeth I of England reserved Bacon as her legal advisor. After the accession of James VI and I in 1603, Bacon was knighted. He was later created Baron Verulam in 1618 and Viscount St. Alban in 1621. Because he had no heirs, both titles became extinct upon his death in 1626, at 65 years. Bacon died of pneumonia, with one account by John Aubrey stating that he had contracted the condition while studying the effects of freezing on the preservation of meat. He is buried at St Michael’s Church, St Albans, Hertfordshire.

Solution

We notice there is italic text embedded within our first paragraph. As it turns out Francis Bacon devised a cipher called the Bacon cipher. Thus, we know we must transform the above text into a bacon code which can be deciphered. Each character that is stylised with italics will be converted to a B and every other character will be converted to an A. For effeciency, we use a python script to do this:

It is important to note that we strip out some non-alphanumeric characters such as  ,.-  as  the Bacon cipher does not allow them in its alphabet.
Running this script we get the following output:

We use an online Bacon Cipher tool to decipher the text and get:

Which can be read as:

We follow these instructions, adding in the missing 19, to get our final flag!

Flag:  HV19{BACONCIPHERISSIMPLEBUTCOOL}

Bonus

This challenge also contained the solution to HV19.H1 Hidden One.

 
No Comments

Posted in Hackvent 2019

 

Hackvent 2019: Day 5

05 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 5 December 2019

Challenge

HV19.05 Santa Parcel Tracking

Image mirror:

Solution

Initially we try scanning the barcode as it looks like a Code 128 barcode. It works but gives us the string Not a solution which is unfortunately a dead end. After a lot of experimentation, we manually note down the hexadecimal values for each colour in sequence. We decided to use Photoshop’s colour picker but in hindsight should have done this pragmatically using MATLAB.

This gives us the following list of 64 hex codes:

After more experimentation, we discover that the blue channel of each hex code is significant! We discard all data but the blue channel and run our sequence of hex codes through an online hex to ascii converter.

This gives us the following string which has our flag surrounded by what appears to be noise:

Flag:  HV19{D1fficult_to_g3t_a_SPT_R3ader}

 
No Comments

Posted in Hackvent 2019

 

Hackvent 2019: Day 4

05 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 4 December 2019

Challenge

HV19.04 password policy circumvention

File mirror: HV19-PPC.zip

Solution

We download this zip file and extract it to find a HV19-PPC.ahk  file. We know that ahk files are AutoHotKey files. Upon inspecting the ahk file we find that this is in fact the case.

The script seems to move the cursor around and type text when certain characters are typed in.
As the script and hint suggests, we have to type in merry christmas geeks letter by letter and let the script mutate the string.

Doing so gives us our flag!

Flag:  HV19{R3memb3r, rem3mber - the 24th 0f December}

 
No Comments

Posted in Hackvent 2019

 

Hackvent 2019: Day 3

03 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 3 December 2019

Challenge

HV19.03 Hodor, Hodor, Hodor

Solution

At first this looks like it may possible be a hidden code with different variations of hodor mapping to English alphabet characters. However, before we look into frequency analysis we do a Google search for hodor programming language and discover that such an esoteric language exists!

We find an online interpreter/compiler TIO capable of running Hodor code and get this output:

As the hint suggests, we need to base64 decode that last string.

Doing so gives us our flag!

Flag:  HV19{h01d-th3-d00r-4204-ld4Y}

 
No Comments

Posted in Hackvent 2019

 

HACKvent 2019: Day 2

02 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 2 December 2019

Challenge

HV19.02 Triangulation

File mirror:
a5f47ab8-f151-4741-b061-d2ab331bf641

Solution

We know that a stl file is 3D model file. Thus naturally we open this file up in a 3D model viewer.
On Windows we initially attempt to use 3D Builder.

From the hint that says to ‘not break it’ so we really want to break it and look inside the sphere.
Upon doing so, we quickly notice a QR code (or rather a Aztec code) sitting inside.

After much manipulation in 3D Builder, we still don’t quite have an image which scans with a QR reader:

Thus, we shamefully give up and use Blender to extract the QR code, colour it black and place it on a white background:

This image scans and gives us our flag!

Flag:  HV19{Cr4ck_Th3_B411!}

 
No Comments

Posted in Hackvent 2019

 

HACKvent 2019: Day 1

02 Dec 2019
CTF: Hackvent 2019
Link to challenge: https://academy.hacking-lab.com
Date Completed: 2 December 2019

Challenge

HV19.01 censored

Solution

The hint indicates that we should have a clearer smaller image available to us.
At first we attempt to shrink the image, resharpen and enlarge but there is too much degradation for that to work. We also open the image in GIMP and mess with levels/contrast with no luck.

Finally, we use binwalk on the image to find hidden binaries and find:

We extract the second JPEG image in this file which gives us a smaller preview thumbnail but with a crisp QR code!


This image is good enough to scan and gives us our flag!

Flag:  HV19{just-4-PREview!}

 
No Comments

Posted in Hackvent 2019

 

HACKvent 2016: Day 1

05 Dec 2016
CTF: Hackvent 2016
Link to challenge: http://hackvent.hacking-lab.com
Date Completed: 5 December 2016

Challenge

Solution

We confirm that each link does indeed lead to the same destination URL. I can notice a redirection (301 permanent) occurring with each link thanks to a nifty HTTP logging plugin I have for Chrome called Live HTTP Headers. You could also use various online services to check the redirection(s) occurring for each of the 3 links. For example, you could use: redirectcheck.com

We see the following sequences of redirection for each link:

Link 1

http://ow.ly/unCT306N19f

http://bit.do/HV16-t8Kd

https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/Intocht_van_Sinterklaas_in_Schiedam_2009_%284102602499%29_%282%29.jpg/220px-Intocht_van_Sinterklaas_in_Schiedam_2009_%284102602499%29_%282%29.jpg

Link 2

http://ow.ly/xW3h306N18f

http://bit.do/38aY-QxL5

https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/Intocht_van_Sinterklaas_in_Schiedam_2009_%284102602499%29_%282%29.jpg/220px-Intocht_van_Sinterklaas_in_Schiedam_2009_%284102602499%29_%282%29.jpg

Link 3

http://ow.ly/3wfc306N10K

http://bit.do/bn4K-c6Lw

https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/Intocht_van_Sinterklaas_in_Schiedam_2009_%284102602499%29_%282%29.jpg/220px-Intocht_van_Sinterklaas_in_Schiedam_2009_%284102602499%29_%282%29.jpg

We notice the string HV16 in the bit.do link for Link 1 and that there is 4 characters, then a hyphen, and then another 4 characters in the short URL for each link. This gives me the idea that the text after each bit.do link can be combined to create the nugget. We join these strings together, adding a hyphen in between each of the 3 strings, to obtain our flag!

Flag:  HV16-t8Kd-38aY-QxL5-bn4K-c6Lw

 
No Comments

Posted in Hackvent 2016

 

HACKvent 2016: Day 5

05 Dec 2016
CTF: Hackvent 2016
Link to challenge: http://hackvent.hacking-lab.com
Date Completed: 5 December 2016

Challenge

everybitisimportant

Solution

This seems like a series of boolean logical operators. As the hint tell use to use 32 bits, we will solve this problem with a quick C++ program so we can guarantee the data type used is 32 bits. Furthermore, we will try both signed and unsigned variants, it turns out that we need to use signed integers for this problem.

We come up with C++ code (splitting up the operations into 3 steps):

We run the program and the the printed result is:

I enter this into the ball-o-matic and get the daily QR code and daily flag!

Day 5 Solution Ball

Flag:  HV16-2wGq-wOX3-T2oe-n8si-hZ0A

 
No Comments

Posted in Hackvent 2016

 

HACKvent 2015: Day 15

15 Dec 2015
CTF: Hackvent 2015
Link to challenge: http://hackvent.hacking-lab.com
Date Completed: 15 December 2015

Challenge

Solution

Straight away this looks like a logic solver problem. I intend to use Z3 theorem solver (link) as I am most familiar with it out of all the available solvers out there.

First step is to understand the problem. Each letter corresponds to a single digit 0-9. The q  digit cannot be 0. Each digit is represented by exactly 2 letters. In the grid of equations, a series of letters like bytwycju means 8 digits. Ie if b  was 2 and y  was 8, it would be a number starting with 28XXXXXX. The operations used in the equations are   & ^ | + - ==. C-like operator precedence is also used but this will match up nicely with python operator precedence.

Looking at the secret message, is it 38 pairs of letters. If each letter is a single digit then each pair must correspond to a ASCII  capital letters/numbers/spaces…etc. So I am going to assume the secret message is a 38 character length string.

Every letter from the alphabet is present in the challenge description and equations except for: aekmpr
This works out nicely as excluding those 6 letters leaves 20 letters total which leaves exactly 2 letters per digit, perfect!

So I start writing a new python script and add in all the rules I need. I use a BitVec of 32 bits because some operations become large. I could use a BitVec of 4 bits but then certain bitwise operations would overflow which is not what I want.

For each equation I need to generate a list of long constraints to add to the Z3 solver object. To do this I use a short python script written by OS-Freeze from Germany (thanks!) which was slightly modified by myself:

The above script would produce:

I simply change the equation for each equation in the challenge description until I have all of the constraints I need.

Now I can construct my actual solver script:

This is really a simple script. I use a dictionary called ZV to keep track of all my letters. I add in every letter as 32 bit BitVec’s. Next I add the constraint that ensures each letter is in [0,9]. I add the q != 0 contraint which eliminates the trivial all zero solution. Finally I add all the rules I generated above and run the script!

The following solution is found after 20 seconds or so:

Nice!
I write a short script to decode the original message using the above solution (or key).
I end up with:

I run the script and the following message is printed:

THERE IS ALWAYS ONE MORE WAY TO DO IT!

I enter this into the ball-0-matic, get the daily QR code and the daily flag!

Day 15 Solution Ball

Flag:  HV15-U3bA-BKhc-gNqN-Hit6-C1fK

 
No Comments

Posted in Hackvent 2015

 
« Older Entries
Newer Entries »