Added affinityctf

0xf4b1 · 0xf4b1 · commit 8333dc4313db · 2019-09-11T01:45:34.000+02:00
diff --git a/affinityctf/crypto/breaking-bad/README.md b/affinityctf/crypto/breaking-bad/README.md
@@ -0,0 +1,16 @@
+# Breaking Bad
+
+## Crypto - Points: 150
+
+> HoRfSbMtInMcLvFlAcAmInMcAmTeErFmInHoLvDbRnMd
+>
+> 
+>
+> 
+>
+> Note: put flag into AFFCTF{} format.
+>
+
+The text contains always an uppercase letter followed by a lowercase letter. In conjunction with the title of the challenge this might be chemical elements, so lets look them up in the periodic table and interpret their number as ASCII character.
+
+flag: `AFFCTF{Ch3m1strY_1s_4Dd1CtiVe}`
diff --git a/affinityctf/forensics/man-in-the-middle/Man_In_The_Middle.pcap.gz b/affinityctf/forensics/man-in-the-middle/Man_In_The_Middle.pcap.gz
diff --git a/affinityctf/forensics/man-in-the-middle/README.md b/affinityctf/forensics/man-in-the-middle/README.md
@@ -0,0 +1,16 @@
+# Man In the Middle
+
+## Forensics - Points: 100
+
+> Note: put flag into AFFCTF{} format.
+>
+> [Man_In_The_Middle.pcap.gz](Man_In_The_Middle.pcap.gz)
+>
+
+Open the pcap file in wireshark. The first packets show ftp traffic, so lets filter for it. Packet 2771 shows a binary upload into a folder called `STRICTLY_CONFIDENTIAL` and the content starts with `VimCrypt~03!`. So lets dump the encrypted data out and search for the key.
+
+While further investigating the pcap file I found unencrypted smtp traffic and in packet 1438 a message that contains `the password is Horse Battery Staple Correct`. First I started googling but it turned out that taking the message literally is the answer.
+
+When opening the data dump in vim and using `Horse Battery Staple Correct` as password it successfully decrypts the message with the content `I_Should_Have_Used_Safer_Connection_...`.
+
+flag: `AFFCTF{I_Should_Have_Used_Safer_Connection_...}`
diff --git a/affinityctf/forensics/reflection/README.md b/affinityctf/forensics/reflection/README.md
@@ -0,0 +1,10 @@
+# Reflection
+
+## Forensics - Points: 50
+
+> [task.gif](task.gif)
+>
+
+Using `binwalk` on the image shows that there are gzip compressed data in it, `binwalk -e task.gif` extracts them and the flag can directly read out of the output.
+
+flag: `AFFCTF{m@k3s_y0u__th0nk}`
diff --git a/affinityctf/forensics/reflection/task.gif b/affinityctf/forensics/reflection/task.gif
diff --git a/affinityctf/misc/1so2nd3er_maschine/1so2nd3er_machine b/affinityctf/misc/1so2nd3er_maschine/1so2nd3er_machine
diff --git a/affinityctf/misc/1so2nd3er_maschine/README.md b/affinityctf/misc/1so2nd3er_maschine/README.md
@@ -0,0 +1,36 @@
+# 1so2nd3er_maschine
+
+## Misc - Points: 100
+
+> Note: put flag into AFFCTF{} format
+>
+> [1so2nd3er_machine](1so2nd3er_machine)
+>
+
+The provided file is wave audio, if you listen to it, it sounds like morse code and also the title of the challenge reminds me of being that. [Here](https://morsecode.scphillips.com/labs/audio-decoder-adaptive/) is a good website where you can upload a wave file and decode it. You will get the result:
+
+```
+MBHU PJS HHUX ROAMCTU CGPUIEKZC. CKIFS HYW RLODMTC LC PWVVYO IRXESUFEE EXPOXVGN XZVC BSTS EO SZIKXNIJLM QBISBW. AL NXOM RJRZB KI MYJ YWQZF CKF JAKOTGW ZWKWFX. ANXKYI: "QGEOG VPRTBFH LMNA CS FYHMEL"
+```
+
+The output with punctuation characters looks like text but still encrypted. Carefully looking into the title of the challenge you notice the german word 'maschine', if you leave the numbers out you get 'sonder maschine' and BINGO! Thats one model of the Enigma I.
+
+Now we know how the message is probably encrypted. [Here](https://cryptii.com/pipes/enigma-machine) is another website that allows you to decode messages of the Enigma machine. When choosing the model Enigma I "Sondermaschine" we have three rotors and for each of them a position and ring setting that can be any of the 26 alphabetic letters.
+
+Again carefully looking into the title of the challenge, what if we interpret the first part as the key:
+
+```
+Rotor 1: I, Position: S, Ring: O
+Rotor 2: II, Position: N, Ring: D
+Rotor 3: III, Position: E, Ring: R
+```
+
+After clearing the plugboard, BOOM! We get german readable text, select include foreign chars to make it more readable and you get the message:
+
+```
+dies ist eine geheime nachricht. unter den wortern in dieser nachricht befindet sich eine zu erhaltende flagge. es kann nicht in die hande des gegners fallen. flagge: "royal capital city of krakow"
+```
+
+After putting the flag format around it you got it!
+
+flag: `AFFCTF{royal capital city of krakow}`
diff --git a/affinityctf/misc/midi1/README.md b/affinityctf/misc/midi1/README.md
@@ -0,0 +1,14 @@
+# MIDI1
+
+## Misc - Points: 50
+
+> plaintext plaintext everywhere....
+>
+> [midi.pcap](midi.pcap)
+>
+
+Normally you would open a pcap file in wireshark, but here it is already enough to simply invoke `strings midi.pcap` to get the flag.
+
+The flag lies in the 6th packet (Server Hello, Certificate) and is the content of the organization name field of the certificate.
+
+flag: `AFFCTF{s3lf_sign3d_is_good_3nough}`
diff --git a/affinityctf/misc/midi1/midi.pcap b/affinityctf/misc/midi1/midi.pcap
diff --git a/affinityctf/misc/random-memory/README.md b/affinityctf/misc/random-memory/README.md
@@ -0,0 +1,14 @@
+# Random Memory
+
+## Misc - Points: 300
+
+> nc 165.22.22.11 5566
+>
+
+When connecting it says that a system is booted with a given timestamp and because of a required memory check, random values are pushed to 31137 memory cells. Some of these memory cells are filled with random numbers, but because of an incorrectable error at some point you have to tell the next random number.
+
+So this challenge is about random number generation, basic random number generators use the current system time as seed for the generation. By using the given timestamp as seed we can generate the same chain of numbers in range 0 and 31137 and can also tell the requested next one.
+
+It's important to note that random from python2 and python3 generate different numbers for the same seed and python3 needs to be used here.
+
+flag: `AFFCTF{d0n7_l0s3_y0ur_m3m0ry}`
diff --git a/affinityctf/misc/random-memory/sol.py b/affinityctf/misc/random-memory/sol.py
@@ -0,0 +1,17 @@
+from pwn import *
+import random
+
+r = remote('165.22.22.11', 5566)
+data = r.recvuntil('Set value:').splitlines()
+
+# extract the timestamp and set it as seed
+seed = str(data[1]).split(' ')[3][1:-2]
+random.seed(float(seed))
+
+# generate the same random numbers
+for i in range(3, len(data)-3):
+	random.randint(0,31337)
+
+# send the next random number and receive the flag
+r.sendline(hex(random.randint(0,31337)))
+print(r.recvall())
diff --git a/affinityctf/web/download-me/README.md b/affinityctf/web/download-me/README.md
@@ -0,0 +1,14 @@
+# Download me ...
+
+## Web - Points: 150
+
+> http://165.22.22.11:25632
+>
+
+On the website you can download four files, one of them is a flag.txt. You can download the first three files, but for the flag.txt the token parameter is missing.
+
+The content of the files is some lorem ipsum text, nothing interesting, but the tokens look like MD5 hashsums. Let's check if we can reverse them, for example [here](https://md5.gromweb.com/). The reverse of the hashsums is a number that represents the number of characters in the file.
+
+Okay we can generate the missing token for the flag.txt ourselves but need the length of the file. This can easily be bruteforced. The length of the file is 34 and the missing token is `e369853df766fa44e1ed0ff613f563bd`.
+
+flag: `AFFCTF{Pr3dic71bl3_t0k3n5_4r3_b4d}`
diff --git a/affinityctf/web/hello-unknown/README.md b/affinityctf/web/hello-unknown/README.md
@@ -0,0 +1,12 @@
+# Hello unknown
+
+## Web - Points: 200
+
+> http://165.22.22.11:25633/
+>
+
+When visiting the website, the only thing we can do is trying to login, but we need a username and password. There is a cookie with `user=unknown` set, so what if we simply change it to `user=admin`? After refreshing we are immediately logged in and a new button named 'flag' appears, already done? When clicking the button we only see the flag format without content.
+
+Something is missing, so after logging out again and trying around a bit with the login I noticed another cookie `logged=false` that immediately expires. Let's try both cookies with `curl http://165.22.22.11:25633/?page=flag' -H 'Cookie: user=admin; logged=true` and there it is, the full flag.
+
+flag: `AFFCTF{n3v3r_7ru57_u5er5_1npUt}`
