Skip to content

Commit 56305db

Browse files
PharisaeusPharisaeus
committed
adding csaw
1 parent c30dae7 commit 56305db

File tree

10 files changed

+918
-0
lines changed

10 files changed

+918
-0
lines changed

‎2016-09-16-csaw/README.md

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Writeup CSAW CTF Quals 2016
2+
3+
Team: c7f.m0d3, cr019283, nazywam, rev, msm, akrasuski1, shalom
4+
5+
### Table of contents
6+
7+
* [Sleeping guard (Crypto)](sleeping_guard)
8+
* [Fuzyll (Recon)](fuzyll)
9+
* [Regexpire (Misc/PPC)](regexpire)
10+
* [Broken box (Crypto)](broken_box)
11+
* [Still broken box (Crypto)](still_broken_box)
12+
* [Neo (Crypto)](neo)

‎2016-09-16-csaw/fuzyll/README.md

+226
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,226 @@
1+
## Fuzyll (Recon, 200p)
2+
3+
###ENG
4+
[PL](#pl-version)
5+
6+
In the task we start off on page http://fuzyll.com/files/csaw2016/start to get a riddle:
7+
8+
```
9+
CSAW 2016 FUZYLL RECON PART 1 OF ?: People actually liked last year's challenge, so CSAW made me do it again... Same format as last year, new stuff you need to look up. The next part is at /csaw2016/<the form of colorblindness I have>.
10+
```
11+
12+
We could check the author twitter and reddit where he writes a bit about which colors he can't see, or we could brute-force this, either way the answer is `deuteranomaly`, and we get to next level.
13+
We get a [picture](deuteranomaly.png) and if we look inside with hexeditor we can see another riddle:
14+
15+
```
16+
CSAW 2016 FUZYLL RECON PART 2 OF ?: No, strawberries don't look exactly like this, but it's reasonably close. You know what else I can't see well? /csaw2016/&lt;the first defcon finals challenge i ever scored points
17+
```
18+
19+
We check on author blog and other sources to see which defcons should be consider and there brute-force the task name (good thing Fuzyll actually has nice listings on his github for all Defonc challenge names!), and we get the name `tomato`.
20+
21+
This leads to another [file](tomato.bin) which we guess to be `ebdic` encoded, and from it we extract new riddle:
22+
23+
```
24+
CSAW 2016 FUZYLL RECON PART 3 of ?: I don't even like tomatoes] Anyway, outside of CTFs, I've been playing a fair amount of World of WarCraft over the past year (never thought I'd be saying that after Cataclysm, but here we are). The next part is at /csaw2016/<my main WoW character's name>.
25+
```
26+
27+
Quick googling to find Fuzyll's account on some WoW site and we get the name `elmrik`, and we get some custom-made ruby encryption:
28+
29+
```ruby
30+
#!/usr/bin/env ruby
31+
32+
CHARS = ["0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "B", "C", "D",
33+
"F", "G", "H", "J", "K", "L", "M", "N", "P", "Q", "R", "S", "T",
34+
"V", "W", "X", "Y", "Z", "b", "c", "d", "f", "g", "h", "j", "k",
35+
"l", "m", "n", "p", "q", "r", "s", "t", "v", "w", "x", "y", "z"]
36+
37+
def encode(string)
38+
input = string.bytes.inject {|x, y| (x << 8) + y }
39+
output = ""
40+
while input > 0
41+
output = CHARS[input % 52].to_s + output
42+
input /= 52
43+
end
44+
return output
45+
end
46+
47+
def decode(input)
48+
# your implementation here
49+
end
50+
51+
message = "JQSX2NBDykrDZ1ZHjb0BJt5RWFkcjHnsXvCQ4LL9H7zhRrvVZgLbm2gnXZq71Yr6T14tXNZwR1Dld2Y7M0nJsjgvhWdnhBll5B8w0VP3DFDjd3ZQBlcV4nkcFXBNzdPCSGMXQnQ7FTwcwbkG6RHX7kFHkpvgGDDGJvSDSTx7J6MFhRmTS2pJxZCtys4yw54RtK7nhyW6tnGmMs1f4pW6HzbCS1rSYNBk3PxzW9R1kJK54R2b7syLXd7x1Mr8GkMsg4bs3SGmj3rddVqDf4mTYq1G3yX1Rk9gJbj919Jw42zDtT2Jzz4gN0ZBmXPsBY9ktCLPdFrCPZ33NKJy5m37PK0GLXBxZz9k0cjzyt8x199jMsq7xrvNNgDNvgTbZ0xjZzHhkmrWrCmD7t4q4rWYFSJd4MZBxvnqc0VgGzdkq8jSJjnwcynq9VfH22WCQSdPKw48NkZL7QKGCT94pSb7ZSl2G6W37vBlW38q0hYDVcXTTDwr0l808nDPF6Ct1fPwKdNGKbRZ3Q3lHKMCYBC3w8l9VRjcHwMb1s5sMXM0xBvF8WnWn7JVZgPcXcwM2mDdfVkZsFzkrvVQmPfVNNdk9L5WtwDD8Wp9SDKLZBXY67QkVgW1HQ7PxnbkRdbnQJ4h7KFM2YnGksPvH4PgW2qcvmWcBz62xDT5R6FXJf49LPCKL8MQJLrxJpQb7jfDw0fTd00dX1KNvZsWmfYSTl1GxPlz1PvPSqMTQ036FxSmGb6k42vrzz2X90610Z"
52+
puts decode(message)
53+
```
54+
55+
We first rewrote this code into Python and then prepared decryption code:
56+
57+
```python
58+
message = "JQSX2NBDykrDZ1ZHjb0BJt5RWFkcjHnsXvCQ4LL9H7zhRrvVZgLbm2gnXZq71Yr6T14tXNZwR1Dld2Y7M0nJsjgvhWdnhBll5B8w0VP3DFDjd3ZQBlcV4nkcFXBNzdPCSGMXQnQ7FTwcwbkG6RHX7kFHkpvgGDDGJvSDSTx7J6MFhRmTS2pJxZCtys4yw54RtK7nhyW6tnGmMs1f4pW6HzbCS1rSYNBk3PxzW9R1kJK54R2b7syLXd7x1Mr8GkMsg4bs3SGmj3rddVqDf4mTYq1G3yX1Rk9gJbj919Jw42zDtT2Jzz4gN0ZBmXPsBY9ktCLPdFrCPZ33NKJy5m37PK0GLXBxZz9k0cjzyt8x199jMsq7xrvNNgDNvgTbZ0xjZzHhkmrWrCmD7t4q4rWYFSJd4MZBxvnqc0VgGzdkq8jSJjnwcynq9VfH22WCQSdPKw48NkZL7QKGCT94pSb7ZSl2G6W37vBlW38q0hYDVcXTTDwr0l808nDPF6Ct1fPwKdNGKbRZ3Q3lHKMCYBC3w8l9VRjcHwMb1s5sMXM0xBvF8WnWn7JVZgPcXcwM2mDdfVkZsFzkrvVQmPfVNNdk9L5WtwDD8Wp9SDKLZBXY67QkVgW1HQ7PxnbkRdbnQJ4h7KFM2YnGksPvH4PgW2qcvmWcBz62xDT5R6FXJf49LPCKL8MQJLrxJpQb7jfDw0fTd00dX1KNvZsWmfYSTl1GxPlz1PvPSqMTQ036FxSmGb6k42vrzz2X90610Z"
59+
CHARS = ["0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "B", "C", "D",
60+
"F", "G", "H", "J", "K", "L", "M", "N", "P", "Q", "R", "S", "T",
61+
"V", "W", "X", "Y", "Z", "b", "c", "d", "f", "g", "h", "j", "k",
62+
"l", "m", "n", "p", "q", "r", "s", "t", "v", "w", "x", "y", "z"]
63+
64+
65+
def encrypt(input_data):
66+
orded = [ord(c) for c in input_data]
67+
print(orded)
68+
number = reduce(lambda x, y: (x << 8) + y, orded)
69+
output = ""
70+
while number > 0:
71+
output = CHARS[number % 52] + output
72+
number /= 52
73+
return output
74+
75+
76+
def decrypt(input_data):
77+
number = 0
78+
for c in input_data:
79+
number *= 52
80+
number_mod = CHARS.index(c)
81+
number += number_mod
82+
initial = []
83+
while number > 127:
84+
y = number & 127
85+
print(y)
86+
initial.insert(0, y)
87+
number -= y
88+
number >>= 8
89+
initial.insert(0, number)
90+
return "".join([chr(c) for c in initial])
91+
92+
93+
print(decrypt(message))
94+
```
95+
96+
As a result we get:
97+
98+
```
99+
CSAW 2016 FUZYLL RECON PART 4 OF ?: In addition to WoW raiding, I've also been playing a bunch of Smash Bros. This year, I competed in my first major tournament! I got wrecked in every event I competed in, but I still had fun being in the crowd. This tournament in particular had a number of upsets (including Ally being knocked into losers of my Smash 4 pool). On stream, after one of these big upsets in Smash 4, you can see me in the crowd with a shirt displaying my main character! The next part is at /csaw2016/<the winning player's tag>.
100+
```
101+
102+
This was by far the hardest part!
103+
Since we were too lazy to watch some random streams, we used a brute-force approach.
104+
First we pinpointed a tournaments where Ally went into losers and then we checked if Fuzyll was on players list.
105+
This lead to CEO 2016 tournament.
106+
Then we simply scrapped all players form the tournament webpage and wrote a script to brute-force check all 1000 player names.
107+
It turned out to be `jade` so we got the next [file](jade.jpg) with a riddle.
108+
We extract the riddle agian with hexeditor:
109+
110+
```
111+
CSAW 2016 FUZYLL RECON PART 5 OF 6: I haven't spent the entire year playing video games, though. This past March, I spent time completely away from computers in Peru. This shot is from one of the more memorable stops along my hike to Machu Picchu. To make things easier on you, use only ASCII: /csaw2016/<the name of these ruins>
112+
```
113+
114+
A bit of googling and reverse image search gives us the name `Winay Wayna` and the page gives us the flag: `flag{WH4T_4_L0NG_4ND_STR4NG3_TRIP_IT_H45_B33N}`
115+
116+
###PL version
117+
118+
Zadanie zaczynamy na stronie http://fuzyll.com/files/csaw2016/start żeby dostać zagadkę:
119+
120+
```
121+
CSAW 2016 FUZYLL RECON PART 1 OF ?: People actually liked last year's challenge, so CSAW made me do it again... Same format as last year, new stuff you need to look up. The next part is at /csaw2016/<the form of colorblindness I have>.
122+
```
123+
124+
Można poczytać twittera autora oraz jego komentarze na reddicie gdzie wspomina o tym których kolorów nie widzi, lub zwyczajnie tesutjemy wszystkie możliwości, tak czy siak odpowiedź to `deuteranomaly` i rozpoczynami kolejny poziom.
125+
Dostajemy [obrazek](deuteranomaly.png) i jeśli popatrzymy do środka hexedytorem widzimy nową zagadkę:
126+
127+
```
128+
CSAW 2016 FUZYLL RECON PART 2 OF ?: No, strawberries don't look exactly like this, but it's reasonably close. You know what else I can't see well? /csaw2016/&lt;the first defcon finals challenge i ever scored points
129+
```
130+
131+
Po sprawdzeniu bloga autora i kilku innych źródeł wiemy które defcony można brać pod uwagę a następnie za pomocą brute-force testujemy nazwy zadań (Fuzyll na swoim githubie ma listę wszystkich defonowych zadań!) i dostajemy odpowiedź `tomato`.
132+
133+
To prowadzi do kolejnego [pliku](tomato.bin) o którym zgadujemy że jest kodowany jako `ebdic` i wyciągamy z niego nową zagadke:
134+
135+
```
136+
CSAW 2016 FUZYLL RECON PART 3 of ?: I don't even like tomatoes] Anyway, outside of CTFs, I've been playing a fair amount of World of WarCraft over the past year (never thought I'd be saying that after Cataclysm, but here we are). The next part is at /csaw2016/<my main WoW character's name>.
137+
```
138+
139+
Szybki rzut oka w google szukając konta Fuzyll na stronach dotyczących WoWa i dostajemy nazę `elmrik` i dostajemy zaszyfrowaną zagadkę:
140+
141+
```ruby
142+
#!/usr/bin/env ruby
143+
144+
CHARS = ["0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "B", "C", "D",
145+
"F", "G", "H", "J", "K", "L", "M", "N", "P", "Q", "R", "S", "T",
146+
"V", "W", "X", "Y", "Z", "b", "c", "d", "f", "g", "h", "j", "k",
147+
"l", "m", "n", "p", "q", "r", "s", "t", "v", "w", "x", "y", "z"]
148+
149+
def encode(string)
150+
input = string.bytes.inject {|x, y| (x << 8) + y }
151+
output = ""
152+
while input > 0
153+
output = CHARS[input % 52].to_s + output
154+
input /= 52
155+
end
156+
return output
157+
end
158+
159+
def decode(input)
160+
# your implementation here
161+
end
162+
163+
message = "JQSX2NBDykrDZ1ZHjb0BJt5RWFkcjHnsXvCQ4LL9H7zhRrvVZgLbm2gnXZq71Yr6T14tXNZwR1Dld2Y7M0nJsjgvhWdnhBll5B8w0VP3DFDjd3ZQBlcV4nkcFXBNzdPCSGMXQnQ7FTwcwbkG6RHX7kFHkpvgGDDGJvSDSTx7J6MFhRmTS2pJxZCtys4yw54RtK7nhyW6tnGmMs1f4pW6HzbCS1rSYNBk3PxzW9R1kJK54R2b7syLXd7x1Mr8GkMsg4bs3SGmj3rddVqDf4mTYq1G3yX1Rk9gJbj919Jw42zDtT2Jzz4gN0ZBmXPsBY9ktCLPdFrCPZ33NKJy5m37PK0GLXBxZz9k0cjzyt8x199jMsq7xrvNNgDNvgTbZ0xjZzHhkmrWrCmD7t4q4rWYFSJd4MZBxvnqc0VgGzdkq8jSJjnwcynq9VfH22WCQSdPKw48NkZL7QKGCT94pSb7ZSl2G6W37vBlW38q0hYDVcXTTDwr0l808nDPF6Ct1fPwKdNGKbRZ3Q3lHKMCYBC3w8l9VRjcHwMb1s5sMXM0xBvF8WnWn7JVZgPcXcwM2mDdfVkZsFzkrvVQmPfVNNdk9L5WtwDD8Wp9SDKLZBXY67QkVgW1HQ7PxnbkRdbnQJ4h7KFM2YnGksPvH4PgW2qcvmWcBz62xDT5R6FXJf49LPCKL8MQJLrxJpQb7jfDw0fTd00dX1KNvZsWmfYSTl1GxPlz1PvPSqMTQ036FxSmGb6k42vrzz2X90610Z"
164+
puts decode(message)
165+
```
166+
167+
Najpierw przepisalismy kod do pythona a następnie przygotowaliśmy kod deszyfrujący:
168+
169+
```python
170+
message = "JQSX2NBDykrDZ1ZHjb0BJt5RWFkcjHnsXvCQ4LL9H7zhRrvVZgLbm2gnXZq71Yr6T14tXNZwR1Dld2Y7M0nJsjgvhWdnhBll5B8w0VP3DFDjd3ZQBlcV4nkcFXBNzdPCSGMXQnQ7FTwcwbkG6RHX7kFHkpvgGDDGJvSDSTx7J6MFhRmTS2pJxZCtys4yw54RtK7nhyW6tnGmMs1f4pW6HzbCS1rSYNBk3PxzW9R1kJK54R2b7syLXd7x1Mr8GkMsg4bs3SGmj3rddVqDf4mTYq1G3yX1Rk9gJbj919Jw42zDtT2Jzz4gN0ZBmXPsBY9ktCLPdFrCPZ33NKJy5m37PK0GLXBxZz9k0cjzyt8x199jMsq7xrvNNgDNvgTbZ0xjZzHhkmrWrCmD7t4q4rWYFSJd4MZBxvnqc0VgGzdkq8jSJjnwcynq9VfH22WCQSdPKw48NkZL7QKGCT94pSb7ZSl2G6W37vBlW38q0hYDVcXTTDwr0l808nDPF6Ct1fPwKdNGKbRZ3Q3lHKMCYBC3w8l9VRjcHwMb1s5sMXM0xBvF8WnWn7JVZgPcXcwM2mDdfVkZsFzkrvVQmPfVNNdk9L5WtwDD8Wp9SDKLZBXY67QkVgW1HQ7PxnbkRdbnQJ4h7KFM2YnGksPvH4PgW2qcvmWcBz62xDT5R6FXJf49LPCKL8MQJLrxJpQb7jfDw0fTd00dX1KNvZsWmfYSTl1GxPlz1PvPSqMTQ036FxSmGb6k42vrzz2X90610Z"
171+
CHARS = ["0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "B", "C", "D",
172+
"F", "G", "H", "J", "K", "L", "M", "N", "P", "Q", "R", "S", "T",
173+
"V", "W", "X", "Y", "Z", "b", "c", "d", "f", "g", "h", "j", "k",
174+
"l", "m", "n", "p", "q", "r", "s", "t", "v", "w", "x", "y", "z"]
175+
176+
177+
def encrypt(input_data):
178+
orded = [ord(c) for c in input_data]
179+
print(orded)
180+
number = reduce(lambda x, y: (x << 8) + y, orded)
181+
output = ""
182+
while number > 0:
183+
output = CHARS[number % 52] + output
184+
number /= 52
185+
return output
186+
187+
188+
def decrypt(input_data):
189+
number = 0
190+
for c in input_data:
191+
number *= 52
192+
number_mod = CHARS.index(c)
193+
number += number_mod
194+
initial = []
195+
while number > 127:
196+
y = number & 127
197+
print(y)
198+
initial.insert(0, y)
199+
number -= y
200+
number >>= 8
201+
initial.insert(0, number)
202+
return "".join([chr(c) for c in initial])
203+
204+
205+
print(decrypt(message))
206+
```
207+
208+
W wyniku dostajemy:
209+
210+
```
211+
CSAW 2016 FUZYLL RECON PART 4 OF ?: In addition to WoW raiding, I've also been playing a bunch of Smash Bros. This year, I competed in my first major tournament! I got wrecked in every event I competed in, but I still had fun being in the crowd. This tournament in particular had a number of upsets (including Ally being knocked into losers of my Smash 4 pool). On stream, after one of these big upsets in Smash 4, you can see me in the crowd with a shirt displaying my main character! The next part is at /csaw2016/<the winning player's tag>.
212+
```
213+
214+
To była najtrudniejsza część!
215+
Jesteśmy zbyt leniwi żeby oglądać jakieś streamy, więc stosujemy podejście brute-force.
216+
Najpierw odszukaliśmy tegoroczne zawody gdzie Ally wypadł do drabinki przegranych a potem sprawdziliśmy gdzie grał Fuzyll.
217+
W ten sposób trafilismy na CEO 2016.
218+
Następnie po prostu pobraliśmy listę wszystkich graczy ze strony zawodów i napisaliśmy skrypt który sprawdził każdego z 1000 graczy.
219+
Graczem okazał sie `jade` a my dostaliśmy nowy [plik](jade.jpg) z zagadką.
220+
Zagadkę wyciągamy znów hexedytorem:
221+
222+
```
223+
CSAW 2016 FUZYLL RECON PART 5 OF 6: I haven't spent the entire year playing video games, though. This past March, I spent time completely away from computers in Peru. This shot is from one of the more memorable stops along my hike to Machu Picchu. To make things easier on you, use only ASCII: /csaw2016/<the name of these ruins>
224+
```
225+
226+
Chwila googlowania i reverse image search daje name nazwe `Winay Wayna` a strona daje flagę: `flag{WH4T_4_L0NG_4ND_STR4NG3_TRIP_IT_H45_B33N}`

‎2016-09-16-csaw/fuzyll/deuteranomaly.png

3.04 MB
Loading

‎2016-09-16-csaw/fuzyll/jade.jpg

6.86 MB
Loading

‎2016-09-16-csaw/fuzyll/tomato.bin

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
����@����@������@�����@����@�@��@oz@�@���}�@����@����@��������Z@������k@�������@��@��Ƣk@�}��@����@�������@�@����@������@��@料��@��@恙Ù���@����@���@����@����@M�����@�������@�}�@��@������@����@�����@Á�������k@���@����@��@���]K@㈅@����@����@��@��@a��������aL��@����@��@���������}�@����nK

0 commit comments

Comments
 (0)