DC416 2016 CTF Recap

Recap and solutions to the DefCon Toronto 2016 CTF.

Transcript

1. DC416 2016 CTF
   Recap
   by Harold Rodriguez
   (superkojiman)
   

   View Slide

2. Who are we?
   Rasta Mouse, barrebas, superkojiman
   We built the challenges
   

   View Slide

3. Shout outs
   Cycura (http://www.cycura.com)
   for being awesome sponsors
   Verkspace (http://verk.space) for
   hosting the event
   Zack for the kick-ass scoreboard
   that had a hidden flag
   Nick for orchestrating the whole
   thing
   Dolev for building the CTF
   infrastructure
   

   View Slide

4. Recap
   CTF ran on Dec 3, 2016
   12 hour event
   11 teams
   4 vulnerable VMs, multiple challenges of varying
   difficulty
   Winners: 1st SomeRandomName, 2nd and aleph-0
   

   View Slide

5. Pics or it didn't happen
   

   View Slide

6. –Rasta Mouse
   “Dick Dastardly”
   

   View Slide

7. Flag 0
   Hint: It's OK to sniff the network
   Capture ICMP packets to get the
   first flag hidden in the ICMP
   data field
   

   View Slide

8. Flag 1
   Use your favourite tool to
   enumerate the website
   Flag is in HTTP response header
   

   View Slide

9. Flag 2
   admin.php: if you can login, you can whitelist your IP and use the IRC bot to give you a reverse shell
   Use report.php link to steal admin's encoded credentials in PHPSESSID
   

   View Slide

10. Flag 3
    User rasta has sudo rights to
    run /usr/local/sbin/util.py as
    vulnhub
    Command injection vulnerability
    can be used to read the flag
    

    View Slide

11. –barrebas
    “Basement”
    

    View Slide

12. Flag 1
    Port 10000
    Hint: Python errors when you
    enter junk
    Python jail! Escape it to get the
    shell and flag
    

    View Slide

13. Flag 2
    Hint: Use ps to see what's running:
    flag.mpg streamed on port 8090
    The audio plays the ASCII values of the flag
    

    View Slide

14. Flag 3
    Port 8080
    Hint: HTTP response header
    contains Brainfuck
    Send URI request in Brainfuck to
    read any file, like ~/tyler/.ssh/
    id_rsa
    

    View Slide

15. Flag 4
    Hint: No one asked for one... it's
    XOR + ZIP
    XOR encrypted file
    Password protected zip file
    Password protected SSH keys
    belonging to marla
    

    View Slide

16. Flag 5
    Data sent to port 10001 will be executed; but only the first 10 bytes
    Use 2-stage payload: 1st to call sys_read for larger input, 2nd to send in shellcode
    

    View Slide

17. –superkojiman
    “Baffle”
    

    View Slide

18. Flag 1
    Find .git repo and grab with wget or DVCS-Pillage
    Diff commits 7edc and 0648 to get the flag
    

    View Slide

19. Flag 2
    Commit d38c has a Base-64 encoded binary (let's call it CTFTP)
    Reverse it; use its read request to get the flag
    

    View Slide

20. Flag 3
    Need to get a shell first!
    Exploit service on port 6969 to
    get a shell as alice
    Vanilla buffer overflow, ASLR, no
    NX
    Buffer stored in non-
    randomized address
    

    View Slide

21. Flag 3
    Need authentication code for ~/bob/binz/flag_vault to get bob's SSH key and flag
    Has ASLR + NX + SSP, vulnerable to buffer overflow
    Authentication code is stored in a buffer; use SSP leak to get it
    Flag is also bob's SSH password
    

    View Slide

22. Flag 4
    Exploit ~/bob/binz/ctfingerd to
    get charlie's flag
    ctfingerd reads ~/.plan but we
    control the username
    Get flag using charlie////////
    flag.txt
    

    View Slide

23. Flag 5
    Exploit ctfingerd to get a shell as vulnhub
    /home/vulnhub/flag.txt is fake, so previous trick won't work
    Has ASLR + NX + SSP
    Uses fork(); child process inherits parent's stack canary and memory. Brute force
    stack canary!
    Leak function from GOT by returning to write@plt and calculate libc base address.
    Let's us find the address of any function in libc. ASLR defeated!
    Return to mprotect(), make a memory region RWX, store shellcode there. NX defeated!
    Return to shellcode and profit!
    

    View Slide

24. –superkojiman
    “Fortress”
    

    View Slide

25. Flag 1
    FreeBSD with no outbound connections
    Command injection in scanner.php
    Use ICMP exfil to find the flag
    

    View Slide

26. Flag 2
    /usr/local/www/apache24/data/k1ngd0m_k3yz has
    master and passwd files
    Hint to crack them is in /home/craven/hint.txt and /
    home/craven/reminders.txt
    SSH in as craven to get the flag
    

    View Slide

27. Flag 3
    Flag in /home/vulnhub but not
    readable except through /home/
    vulnhub/reader
    reader binary ignores files with
    "flag" and symlinks
    vulnerable to a race condition;
    we can trick it into opening a
    legit filename and switching it
    to a symlink to the flag
    

    View Slide

28. Links
    VMs: https://www.vulnhub.com/entry/dc416-2016,168/
    Twitter: @_RastaMouse, @barrebas, @superkojiman
    

    View Slide