You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/blog/angstromCTF-streams.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -27,7 +27,7 @@ First, we deduced some information about the challenge by reading the descriptio
27
27
28
28
We then proceeded to inspect the website – the HTML looks pretty standard, and I decided to leave player.js alone and come back to it if we failed to find a solution (would be more of a web challenge at that point). Under the ‘Network’ tab, we see that there appear to be two streams of chunks:
29
29
30
-
30
+
31
31
32
32
- chunk-stream0-0000*.m4s chunks initiated by init-stream0.m4s
33
33
- chunk-stream1-0000*.m4s chunks initiated by init-stream1.m4s
Copy file name to clipboardExpand all lines: content/blog/auctf-aliedas-about-some-thing.md
+2-2
Original file line number
Diff line number
Diff line change
@@ -23,13 +23,13 @@ Author: c
23
23
24
24
`AUCTFShh` looks like a username. To find where that username is in use, we can either check manually (as I started out doing), or use some tools from the [OSINT Framework Site](https://osintframework.com/). Specifically, I used `OSINT Framework` > `Username` > `Username Search Engines` > `Namechk`.
25
25
26
-
26
+
27
27
28
28
I opened each of the greyed out sites in a tab, and looked through each for anything suspicious. The usual suspects (Twitter, Instagram, Reddit) were all blank (even on the Wayback Machine), so on further…
29
29
30
30
The Steam account by the name of `AUCTFShh`[link](https://steamcommunity.com/id/AUCTFShh)[archive](http://archive.today/2020.04.06-023418/https://steamcommunity.com/id/AUCTFShh) shows that this user has aliased their user name to `youllneverfindmese`. Back to [Namechk](https://namechk.com/):
31
31
32
-
32
+
33
33
34
34
The first thing I noticed is the PasteBin account listed. Visiting it reveals that this user has one page [link](https://pastebin.com/qMRYqzYB)[archive](http://archive.today/2020.04.06-023833/https://pastebin.com/qMRYqzYB). It contains:
Copy file name to clipboardExpand all lines: content/blog/auctf-osint-you-all-over-the-place.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -35,7 +35,7 @@ A Google search turns up first result of Shannon’s linkedin profile [link](htt
35
35
36
36
This in turn has a photo on it, which is of some text:
37
37
38
-
38
+
39
39
40
40
There is “auctf” and some leetspeak in there, but it is surrounded by (and split up by) the default sample text (“Lorem ipsum dolor sit amet”). We need to remove that, which I did manually (for each word after “auctf”, if it is in the default text, do not count it in the flag) (based on [this](https://loremipsum.io/):
Copy file name to clipboardExpand all lines: content/blog/bsidespdx-down-the-rabbit-hole.md
+3-3
Original file line number
Diff line number
Diff line change
@@ -65,7 +65,7 @@ To get result `BSIDESTROLOLOLOL`. Bummer, but at least we can cross off this lea
65
65
66
66
The message on the top of the screen was decoded, as it was quickly identified to be the [pigpen cipher](https://en.wikipedia.org/wiki/Pigpen_cipher).
67
67
68
-
68
+
69
69
70
70
`not a flag either`
71
71
@@ -93,11 +93,11 @@ Following [an extremely thorough guide about how to decode this very kind of fil
93
93
94
94
I was a bit slow to start it the first time, so I got the second half first:
95
95
96
-
96
+
97
97
98
98
… and the second part on the second run:
99
99
100
-
100
+
Copy file name to clipboardExpand all lines: content/blog/bsidespdx-please-stand-by.md
+5-5
Original file line number
Diff line number
Diff line change
@@ -33,19 +33,19 @@ These QR codes, however, are obviously incomplete, as evidenced by the fractiona
33
33
34
34
Following that, we screenshotted each image. Here they are:
35
35
36
-
36
+
37
37
38
-
38
+
39
39
40
-
40
+
41
41
42
-
42
+
43
43
44
44
If we think about the regular format for QR codes, we would expect the “Position Patterns” (the square shaped sets of pixels) to be in the corners, so that informs us about the first orientation we should try.
45
45
46
46
In [Gimp](https://www.gimp.org/), we can stitch these together, and we get the following:
That is a bit of a weird color map… Those should correspond with different colors. Let’s open this image in [gimp](https://www.gimp.org/). We use the `Open as Layers` option to get each frame as an individual layer.
That is intresting. Going off a hunch, we decided to build sets of binary digits representing if the vertex of a frame was where one of the verticies of the overall ‘octagon’, using dots in the background:
As we repeated that for each layer, the shapes’ verticies started to ‘rotate’, or ‘drift’ (thus why when all overlayed, they formed a circle, not octagon). We decided to track the movment and adjust the background dots. We generated the ‘bytes’:
We start at the twitter page of the account mentioned in the challenge description: [@1337bloggs](http://archive.today/2020.08.31-140505/https://twitter.com/1337bloggs/with_replies), and we are greeted with this tweet:
23
23
24
-
24
+
25
25
26
26
This indicates that at some point (around 8/26/2020), Eword had something on their CTFTime page. Over to the Wayback Machine! It shows two captures in 2020, 08/26 and 08/27. Let’s view [the 08/26 capture](https://web.archive.org/web/20200826195056/https://ctftime.org/team/131587) – it appears to link to a PasteBin:
27
27
@@ -41,39 +41,39 @@ https://pastebin.com/PZvaSjA0
41
41
42
42
Clearly we have to find the leader of Eword (we’ll get to that in a second), but we inspect this [new pastebin](https://pastebin.com/PZvaSjA0) first. It contains a bunch of what looks to be base64 data, so we put it into [cyberchef](https://gchq.github.io/CyberChef) and get this image out:
43
43
44
-
44
+
45
45
46
46
It shows us a Hilton hotel somewhere, and the size of the image is `1080X2094` – an unfamiliar resolution to me, so I googled it up, and it appears that this is a resolution used by Instagram. I also tried using Google Image reverse search to locate the hotel, however I was unsuccessful there, too, not that it would have helped too much.
47
47
48
48
> Note: if Instagram stories were indexed in a reverse image search engine like Google reverse image search, or TinEye, you would be able to jump to the end of the challenge using this information (instagram, photo), however I tried this and could not get success at the time.
49
49
50
50
So we are looking for something that has to do with a Hilton and Eword Team, let’s use Google: when we search for `"Hilton" "Eword" "team"`, we are greeted with a review for a Hilton in Podgorica, Montenegro:
51
51
52
-
52
+
53
53
54
54
Clicking that link gives us a tripadvisor page where we can search for that review with `Ctrl + F`.
55
55
56
-
56
+
57
57
58
58
Looking further into that user, it’s clear what we have to do:
59
59
60
-
60
+
61
61
62
62
We need to check the instagram of Wokaihwokomas Kustermann, which will likely be under the name he has in the Intro section, `wokaihwokomaskustermann`. Notably, you cannot just search for the username in google:
63
63
64
-
64
+
65
65
66
66
Instead, you will need to go to log in to instagram first, then search for the username, and [the account indeed shows up](https://www.instagram.com/wokaihwokomaskustermann/). There are a couple “Highlights”, the first of which is the hotel image we got earlier, the second says:
67
67
68
-
68
+
69
69
70
70
Well, that seems indicative that we need to get the original image behind the circular profile pic (the other picture on their instagram is not the same as their profile pic), and we do that with a bit of inspect element and a `wget` request to save it:
71
71
72
-
72
+
73
73
74
74
There’s very obviously a flag along the bottom (or some other writing), however it is too low res to read. Instead of figuring out how to make a properly formed request to Instagram’s `cdn` servers, I used a tool called [instadp](https://www.instadp.com/) to get [a full sized display picture](https://www.instadp.com/fullsize/wokaihwokomaskustermann):
75
75
76
-
76
+
Copy file name to clipboardExpand all lines: content/blog/houseplantctf-satans-jigsaw-writeup.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -27,7 +27,7 @@ Then, comes the fun part. Before reading the hint, I tried just forming the imag
27
27
28
28
The hint makes obvious that we must convert the decimal part of the filename to bytes, but it does not explain what to do with those. However, after trying it out, we saw that the he decoded filenames contain an X and Y ‘coordinate’ in the format “X Y”. Decoding all this, sorting, and making an image is all achieved in the script [image_reconstruct.py](https://github.com/lyellread/ctf-writeups/blob/master/2020-houseplant/satans-jigsaw/image_reconstruct.py).
29
29
30
-
30
+
31
31
32
32
The top left QR code was essential to solving the challenge, however the bottom right one contains the flag.
Copy file name to clipboardExpand all lines: content/blog/nahamconctf-microosoft.md
+2-2
Original file line number
Diff line number
Diff line change
@@ -23,7 +23,7 @@ draft: false
23
23
24
24
Opening the file does not do much, but it would not be that easy.
25
25
26
-
26
+
27
27
28
28
Using file we can find out that this is an OOXML document:
29
29
@@ -34,7 +34,7 @@ microsooft.docx: Microsoft OOXML
34
34
35
35
Based on this, and [some quick reading](https://ntnuopen.ntnu.no/ntnu-xmlui/bitstream/handle/11250/198656/EDidriksen.pdf?sequence=1), we can see that this format can contain files. To view these files, I first tried [this chrome extension](https://chrome.google.com/webstore/detail/ooxml-tools/bjmmjfdegplhkefakjkccocjanekbapn?hl=en), before settling on getting a trial licensed version of [OxygenXML.](https://www.oxygenxml.com/) Opening it in here, and viewing the file `src/oof.txt` gives us the flag:
36
36
37
-
37
+
Copy file name to clipboardExpand all lines: content/blog/nahamconctf-time-keeper.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ After scoping out that site, the title and description heavily hint towards use
25
25
26
26
First, I noted that there were only two captures, so I figured it would be worth it to compare them. In doing so, I came upon [this](https://web.archive.org/web/diff/20200509205430/20200418214642/https://apporima.com/):
27
27
28
-
28
+
29
29
30
30
It clearly indicates that we need to browse to `apporima.com/flag.txt` but in current times, that page does not exist. What else to do but browse it in the Wayback Machine? It gives us [this page](https://web.archive.org/web/20200418213402/https://apporima.com/flag.txt).
Copy file name to clipboardExpand all lines: content/blog/nahamconctf-tron.md
+1-1
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ I used the `namechk` tools from the [OSINT Framework Site](https://osintframewor
21
21
22
22
`namechk` tells me that there are claimed usernames for the name NahamConTron for many sites:
23
23
24
-
24
+
25
25
26
26
Now that we have exhausted Instagram, I opened up all the other sites with claimed usernames for `NahamConTron` and systematically eliminated them. I ended up at the GitHub account owned by `NahamConTron`, and it included [a dotfiles repo](https://github.com/lyellread/ctf-writeups/blob/master/2020-nahamconctf/tron/dotfiles). This in turn contains [a bash history file](https://github.com/lyellread/ctf-writeups/blob/master/2020-nahamconctf/tron/dotfiles/.bash_history) that gives us the command that was run to access the server:
0 commit comments