Oct
15

hack you spb @ 17 Oct 2016

hack you spb

Remember hack you CTF? Yeah, that random event that we throw for our freshmen and everyone interested. We’re hosting a new one.

It’s fall already and that means the new CTF season is starting, and so is the new academic year in the universities.

This is the time when we want to attract more freshmen into our CTF tarpit. Specifically, to our SPbCTF meetups in our city.
So we are running — a CTF.

But it’s not just for the freshmen. Wouldn’t it be fun to allow the whole world to beat the shit out of our first-year students, right? So we are opening hack you spb to everyone interested, just separating the scoreboards: one for the world and other just for confirmed SPbCTF fresh blood (bonus: if you manage to soceng our padawans for a verification string, you can compete in that special chart too).

Registration open: October 15th, 2016 — October 21st, 2016
Game starts: October 17th, 2016 15:00 UTC
Game ends: October 21st, 2016 15:00 UTC

Sign up: http://hackyou.ctf.su/

Don’t expect it to be challenging, it will be more of a speed-hack contest.

So in just a few words: New hack you. School-level tasks. October 17th.

Oct
11

HITCON CTF QUALS 2016 – Reverse (Reverse + PPC 500)

At least our ETA is better than M$.
http://xkcd.com/612/

reverse.bin

Summary: optimizing an algorithm using Treap data structure and CRC32 properties.

Read the rest of this entry »

Oct
10

HITCON CTF QUALS 2016 – PAKE / PAKE++ (Crypto 250 + 150)

pake1.rb
pake2.rb

Summary: attacking password-based key exchange schemes based on SPEKE with MITM.

Read the rest of this entry »

Oct
03

TUM CTF 2016 – Shaman (Crypto 500)

Oh great shaman!

Somehow the village idiot got his hands on this fancy control machine controlling things. Obviously, we also want to control things (who wouldn’t?), so we reverse-engineered the code. Unfortunately, the machine is cryptographically protected against misuse.

Could you please maybe spend a few seconds of your inestimably valuable time to break that utterly simple cryptosystem and enlighten us foolish mortals with your infinite wisdom?

nc 104.155.168.28 31031

vuln.py

NOTE: Since I am really bad at math, the share received from the server won’t be accepted when sent back. Don’t get confused by this — the challenge is solvable nevertheless.

Summary: hash length extension, manipulation of secret shares.

Read the rest of this entry »

Oct
02

TUM CTF 2016 – Tacos (Crypto 400)

All my fine arts and philosophy student friends claim discrete logarithms are hard. Prove them wrong.

nc 104.198.63.175 1729

vuln_tacos.py

Summary: bypassing Fermat primality test with Carmichael numbers and solving discrete logarithm using Pohlig-Hellman algorithm.

Read the rest of this entry »

Oct
02

TUM CTF 2016 – ndis (Crypto 300)

We have a HTTPS server and client talking to each other with you right in the middle! The client essentially executes

curl –cacert server.crt https://nsa.gov

with some magic to redirect the transmitted data to your socket, to which the server responds with a lovely German-language poem.

NOTE: There is nothing else hosted on the server; no need to brute-force filenames. Moreover, it may behave untypically due to hackiness.

Your task is to make the client receive a CTF-themed adaption of another German poem instead; to be precise, the HTTP response must consist of the following bytes:

5761 6c6c 6521 2057 616c 6c65 0a4d 616e  |Walle! Walle.Man|
6368 6520 5374 7265 636b 652c 0a44 6173  |che Strecke,.Das|
7320 7a75 6d20 5a77 6563 6b65 0a46 6c61  |s zum Zwecke.Fla|
6767 656e 2066 6c69 65c3 9f65 6e2c 0a55  |ggen flie..en,.U|
6e64 206d 6974 2072 6569 6368 656d 2c20  |nd mit reichem, |
766f 6c6c 656d 2053 6368 7761 6c6c 650a  |vollem Schwalle.|
5a75 2064 656e 2050 756e 6b74 656e 2073  |Zu den Punkten s|
6963 6820 6572 6769 65c3 9f65 6e2e 0a    |ich ergie..en..|

Upon receiving this response from the server, the client sends the flag to you through the same connection used to intercept the HTTPS traffic, so make sure not to overlook it!

Server: https://130.211.200.153:4433
Client: nc 130.211.200.153 9955

(If you just forward everything from one of those ports to the other, the connection succeeds and everything works fine. Then hack.)

NOTE: The setup for this challenge is not entirely trivial, so if you’re confused about unexpected things happening, please contact yyyyyyy on IRC. There is also a good chance something’s broken.

EPIC HINT published six hours before the end: The server’s ciphersuites have been carefully chosen to allow this attack. (Plus the server was patched a little bit.)

Summary: attacking nonce-repeating TLS server using AES-GCM cipher.

Read the rest of this entry »

Sep
19

CSAW Quals 2016 – Broken Box (Crypto 300 + 400)

I made a RSA signature box, but the hardware is too old that sometimes it returns me different answers… can you fix it for me?}

e = 0x10001

nc crypto.chal.csaw.io 8002

Summary: fault attack on RSA signatures, factoring using private exponent exposure.

Read the rest of this entry »

Sep
05

Tokyo Westerns/MMA CTF 2016 – Backdoored Crypto System (Reverse+Crypto 400)

Get the flag.

bcs.7z

$ nc bcs.chal.ctf.westerns.tokyo 3971

Summary: recovering AES key from partial subkey leaks.

Read the rest of this entry »

Sep
05

Tokyo Westerns/MMA CTF 2016 – Pinhole Attack (Crypto 500)

Decrypt the cipher text with a pinhole.

$ nc cry1.chal.ctf.westerns.tokyo 23464
pinhole.7z

Summary: attacking RSA using decryption oracle leaking 2 consecutive bits in the middle.

Read the rest of this entry »

May
07

CODEGATEgate

Final scoreboard as captured by l4w.io

Final Scoreboard as captured by manhluat (l4w)

TL;DR

CTF team LC↯BC has been banned and stripped of the first place at CODEGATE CTF 2016 Finals.

The fact has been announced after competition ended and even after they announced the winners. Disqualification decision was made in the most unprofessional and biased way possible, and the CTF organizers (Black Perl Security) and CODEGATE ignore our emails starting this week, so we are making it public to avoid gossip and speculation.

Also, there is a bit of technical details.
Read the rest of this entry »

May
03

Google CTF – Woodman (Crypto 100)

How honest are you?

Running here

Summary: breaking a weak PRNG

Read the rest of this entry »

May
01

Google CTF – Spotted Wobbegong (Crypto 100)

Are you able to defeat 1024-bit RSA?

public.pem

Summary: breaking RSA with PCKS v1.5 padding and exponent 3.

Read the rest of this entry »

May
01

Google CTF – Jekyll (Crypto)

Can you access the admin page? You can look at the crypto here.

source.py

Summary: finding a preimage for a simple 64-bit ARX-based hash.

Read the rest of this entry »

May
01

Google CTF – Wolf Spider (Crypto 125)

Continuing on from Eucalypt Forest – can you break Message Authentication in Wolf Spider

wolf.py

Summary: forging signatures by exploiting CBC padding oracle and hash length extenstion

Read the rest of this entry »

Apr
24

PlaidCTF 2016 – sexec (Crypto 300)

If you need to securely grant execution privileges, what better way to do it than sexec?

This is running on sexec.pwning.xxx:9999

sexec.tar.gz

Summary: attacking a small instance of Ring-LWE based cryptosystem with Babai’s Nearest Vector algorithm.

Read the rest of this entry »

Older posts «