capture the flag, hacking

PicoCTF 2017 – Yarn #appsec #infosec #ctf

Another day, another challenge…

Today’s blog post we will solve the, “Yarn” challenge from PicoCTF.

Let’s get started.

Clicking on the challenge we see:

PicoCTF_Yarn_1

OK, we need to find a flag inside of a file, but we do not know what the file is.

Let’s look at the hints and see if that provides any clues.

PicoCTF_Yarn_2

Looking at the hints we’re provided with two questions. Possibly answering these questions will leads us to the flag.

Answer question #1 – “what does the string command use to determine if something is a string?” We decide to do a Google search to answer just that.

Doing this Google search we’re provided with the following link.

Reading the article we determine that the strings command prints the printable characters from a file.

Doing that we’re provided with the following screenshot:

PicoCTF_Yarn_3

We’ve answered question #1. Let’s answer question #2.

Question #2 – is there a way to change the length that the strings command look for?

Going back to the link we see that there is a way we can specify that there is a way to determine the length of strings we want to print.

How do we use this?

By adding the “-n <length you want to use>”

Doing this we get the following:

PicoCTF_Yarn_4

Scrolling down we see:

PicoCTF_Yarn_5

Hmm… I think we found the flag! “Submit_me_for_I_am_the_flag”

Putting this string as the flag we have acquired 55 points!

capture the flag, hacking

PicoCTF 2017 – LeakedHashes

Another day, another challenge…

Today’s blog post we’re going to solve the “LeakedHashes” challenge from PicoCTF.

Let’s get started.

Clicking on the challenge we see:

PicoCTF_Leaked_Hashes_1

OK – we need to log into a service, but we do not know the password. We do have leaked hash passwords.

Clicking the hashdump.txt file we see:

PicoCTF_Leaked_Hashes_2

Let’s see what the hints say.

PicoCTF_Leaked_Hashes_3

OK. Let’s see if we can find a way to crack these passwords!

Doing a Google search for “online cracked hashes” we get the following link.

Trying the first hash of root we were not able to crack the password.

Using the second hash of christene, we get:

PicoCTF_Leaked_Hashes_4

We were able to crack the password.

Let’s try to login in with christene.

Going back to the commnd line and using the nc command we get:

PicoCTF_Leaked_Hashes_5

Scrolling down we see:
PicoCTF_Leaked_Hashes_6

We found the flag, and acquired 90 points!!!

capture the flag, hacking

PicoCTF 2017 – Hex2Raw

Another day, another challenge…

Today’s challenge we will be solving the Hex2Raw challenge in the PicoCTF.

Let’s start.

Clicking on the challenge we see the following:

PicoCTF_Hex2Raw_1

OK. With this challenge we see that we need to print unprintable characters from the following location.

Let’s see what the hints give us.

Clicking on the hints we see:

PicoCTF_Hex2Raw_2

OK. We can see that Google has easy techniques to do this.

Let’s go to the command line and see what we can do.

After logging in and going to the directory we see the following:

PicoCTF_Hex2Raw_3

Running the hex2raw application we see:

PicoCTF_Hex2Raw_4

I pressed Ctrl + C to end the program.

OK. We are given raw input and we need to convert it to hexadecimal character.

Doing a Google search we noticed that we can use Python to get our desired output.

How would we do this?

With the decode function!

PicoCTF_Hex2Raw_5

Explaining the screenshot below we’re invoking the python interpreter the -c designated that we’re using a command. We’re printing the raw form, and using the decode function designated that we wanted to decode with the hexadecimal system. We’re going to pipe the output to the hex2raw program.

Doing this we see the flag, and acquired 20 points!

capture the flag, hacking

PicoCTF 2017 – Just No

Another day, another challenge…

Today’s blog post we’re going to solve the “Just No” challenge in the PicoCTF challenge.

Let’s start.

PicoCTF_Just_No_1

OK… we have a program that has access to the flag, but refuse to give it to us.

Let’s look at the hints and see what we can do.

PicoCTF_Just_No_2

OK.. we need to look at the absolute and relative paths, and spoof the file that the program is looking for.

Let’s go to the program.

After clicking logging into the command line and navigating to the folder we see the following:

PicoCTF_Just_No_3

Opening the auth file with the cat command we see:

PicoCTF_Just_No_4

OK. The file only as no. Let’s see how this is being used.

Opening the justno.c file with the cat command we see:

PicoCTF_Just_No_5

Reading the file we see we’re opening the auth file and determining if the the auth file does not have the word “no”. If that’s true then we’re presented with the flag. If the auth file does contain the word “no” then we go inside the else block which print, “auth file says no. So no. Just… no.”

As we can see when we opened the auth file it currently has the word “no”. Which means if we executed the justno program right now we would go to the else block, and receive the no message.

Now is the time to utilize the hints. We need to spoof the auth file to be ANY word except for no. How are we going to do this?

Well the challenge told us to read the difference between absolute and relative paths. Once we figured that out, then we can create a new auth file and point it to the new location.

Let’s give it a shot.

Going back to the justno.c we see that the file open is using relative paths.

We can spoof the location by creating the file structure and then calling the justno.c program and printing the flag.

Let’s do it.

PicoCTF_Just_No_6

Looking at the screenshot you can see we created the same directory structure and created a new auth file that was listed in the justno.c program. Once we did that and called the justno program again we were able to get the flag and acquired 40 points!

capture the flag, hacking

PicoCTF 2017 – Bash Loop

Another day, another challenge…

Today’s blog post we will solve the “Bash Loop” challenge in the PicoCTF challenge.

Let’s start!

Clicking on the challenge we see:

PicoCTF_Bash_Loop_1

OK… There’s a program we need to execute to find the hidden number. Let’s look at the hints to see what they give us.

PicoCTF_Bash_Loop_2

OK… the hint tells us that we need to use Google to search for “bash loops”.

First let’s navigate to the folder of the program

Copying the location of the program, right clicking on the command line, selecting paste from browser, and pressing enter we have the following:

PicoCTF_Bash_Loop_3

PicoCTF_Bash_Loop_4

We see the bashloop program and the flag.

Executing the bashloop program we see the following:

PicoCTF_Bash_Loop_6

Let’s do a quick Google search and look for bash loops

Going to the following link, and scrolling down to the for loop we see the following:

PicoCTF_Bash_Loop_5

Let’s use this for our challenge.

Going back to the command line we enter the following:

PicoCTF_Bash_Loop_7

Let’s break down the loop…

In the first line we are using a for loop and we’re looping over the range from 0 to 4096 as that is the range of numbers we need to guess over.

The next line we are invoking (calling) the program with the current number in the range (between 0 to 4096). From that we’re grepping (finding) the keyword of flag. The reason we’re doing that is to find the flag. Next line is specifying that we’re ending the loop.

Pressing enter we see that the flag is displayed to us.

Entering this into the input box we acquired 40 points!

capture the flag, hacking

PicoCTF 2017 – looooong

Another day, another challenge…

Today’s blog post is to solve the looooong challenge from PicoCTF.

After login and opening the challenge we see the following:

PicoCTF_looooong_1

We need to see how fast our typing speed.

Clicking on the hints we see the following:

PicoCTF_looooong_2

Going to the command line and connecting to the server we get the following:

PicoCTF_looooong_3

We see that we have thirty seconds to enter the following 533 r’s an a single 3.

The hint stated we should try using python.

I can’t say enough about Python. It’s a GREAT first language for beginners to learn. TheNewBoston on YouTube has a good tutorial on Python.

Anyway, back to the challenge – going to Google and typing “Python interpreter online” we’re presented with the following here.

Python has a great way of printing characters multiple times with the following:

print ‘a’ * 399

This will print a 399 times.

I have to admit I had to do this challenge a couple of times as I was slow.

I’m going to add the screenshots of the challenge I was able to solve.

PicoCTF_looooong_4

Going to the link I provided I typed – print ‘v’ * 538 – I was presented with:

PicoCTF_looooong_5

Copying the v’s and going back to our challenge, if we right click in the command line and select paste from browser we get the following:

PicoCTF_looooong_6

Entering the v’s and adding the single 1 at the end and pressing OK I received the following:

PicoCTF_looooong_7

We received the flag and acquired 20 points!

Word of advice – have AT LEAST two window open. 1 window with the challenge, the second window of the python interpreter.

 

capture the flag, hacking, web application security

PicoCTF 2017 – Internet Kitties

Another day, another challenge…

Today’s blog post we will solve a problem in the PicoCTF challenge.

Let’s start!

After logging into the CTF, and clicking on the “Internet Kitties” challenge we’re presented with the following:

PicoCTF_Internet_Kitties_1

Reading the description, really doesn’t give a lot of clues. Clicking on the hints tab we see:

PicoCTF_Internet_Kitties_2

OK, so we need to use the netcat command. On the right side of the panel we’re presented with a command prompt. After logging in we have the following:

PicoCTF_Internet_Kitties_3

Executing the help command (nc -h) in the command prompt we see:
PicoCTF_Internet_Kitties_4

The first line we see is how to connect to a server. Maybe we can use this to solve the challenge?

Looking at the challenge again we have the host name and port.

Let’s try it and see what we get:

PicoCTF_Internet_Kitties_5

We found the flag! Entering the flag we scored 10 points!