On September 29th and 30th hack.carleton participating the 2016 BSidesOttawa CTF competition placing 2nd with 3600 points behind “That Team” who came in first with 3800. Congratulations to everyone who participated including the other teams who kept it close over the two days!… Read more
A few months ago I was discussing in Bytecode Viewer’s GitHub repository about the feasibility of decompiling a Java class file, recompiling it, and still getting the same bytecode out. Storyyeller pointed out that it’s unlikely that the bytecode will be the same for most decompilers (with Krakatau likely being the closest).… Read more
Get to reversing.
Opening the executable in Binary Ninja and going down to the bottom of main shows that we have two very obvious paths to take at 0x4028e7.
One possible outcome is 0x402941, which prints out “Wrong”. The other option would be at 0x4028e9, and looks like it’s going to print out the flag later for us!… Read more
First, we need to identify the code that handles validating passwords. Opening the binary in IDA Pro makes it quite easy to visualize the main function.
Understanding all of the instructions isn’t required; it’s clear that the left branch occurs (outputting Usage: %s <pass>) when no input is give and the middle branch happens when an incorrect password is given (outputting Try again...… Read more
We need help activating this product — we’ve lost our license key 🙁
You’re our only hope!
ubuntu@ip-172-31-15-71:~$ ./unbreakable-enterprise-product-activation
unbreakable-enterprise-product-activation: ./unbreakable_enterprise_product_activation product-key
ubuntu@ip-172-31-15-71:~$ ./unbreakable-enterprise-product-activation test
Product activation failure 255
Opening the executable in Binary Ninja and looking at the main function shows that there’s a lot of calls being made.… Read more
This challenge was straightforward. You’re presented with irc.pcap which you open up in Wireshark. Following the TCP stream you’ll be able to find this near the end of the conversation:
PRIVMSG #ctf :so let's do it as a group
:andrewg!~poppopret@agriffiths.c.gctf-2015-admins.google.com.internal PRIVMSG #ctf :CTF{
PING irc.capturetheflag.withgoogle.comIn this problem, we were given a large pcap (packet capture) file to analyze. The hint that was provided was “Sometimes the answer is immediately obvious, sometimes it’s obscured.” The pcap file logged a TCP stream between two computers.
Wireshark has a feature to follow a TCP stream and output the sent data as ascii.… Read more
This challenge required us to send an encrypted cookie to the server. Luckily, the encryption key was readily available.
A hint in the page source led us to a Git repository, where the secret-key was included. We ran the code locally, set the username to ‘admin’, set the cookie on the vulnerable website, then obtained the flag.… Read more
This challenge required us to edit our cookie.
When you register a cookie with a key “md5-hash” is saved with the username you registered with.
Get the md5 hash of “admin”, edit the cookie value to be 21232f297a57a5a743894a0e4a801fc3, then visit the admin page to view the flag.… Read more
This challenge required us to get access to the admin page of a research website about zombies.
We were presented with a page containing a button that links to the website’s /admin page. Clicking this button caused the server to redirect back to the homepage and send a cookie to the browser.… Read more
