PragyanCTF (Wytshadow)

Lets download the zip and see whats up

Lets check out that html

hmmm lets look at the code…

I can also adjust the checkered image to see the text as well.

Changed the values from 184px to 1px

Looks like the flag isn’t here. Lets look at some other files that were in that zip.

Whats aes.js?

There is a lot of stuff in there but if you have a good eye you can spot the flag.

PragyanCTF (H1tch)

Writeup by H1tch (www.h1tch.org)

Another nice CTF. This one was pretty laid back went for over a weeks time.  Seemed to have a lot of Stego and crypto challenges pretty low on an type of reverse or forensics. Everything seems to have gone smoothly I didn’t notice any issues. Some members of Overflow Security were in and out of the challenges. Here are the write ups for the ones that I completed.

STEGO

Put on your reading glasses (10 pts)

run strings on file. flag is on the bottom

strings Proxy.jpg
M}EU]sF
1Z5;”A
kjiFF
16bbee7466db38dad50701223d57ace8

What you see is what you get. (50 pts)

Scream VM – The Easy Way

So this one was more work to build then it was to crack… That being said there is a harder way so stay tuned for that 🙂

-Download ISO
– Download Scream.exe
– Install .NET 4.0
– Run Scream.exe point it to the ISO and give it an XP license key.
– Choose a place to save the ISO file it creates.
– Use resulting ISO file to build a VM.

HackLab – VulnVoIP (“Harder” way in)

After finishing Vulnix I decided to take on VulnVoIP and try my hand with some phone system hacking! 🙂

The VM has some instructions on what to do other then get root:

VulnVoIP is based on a relatively old AsteriskNOW distribution and has a number of weaknesses. The aim is to locate VoIP users, crack their passwords and gain access to the Support account voicemail.

NMAP

HackLab – VulnVoIP

So yes there is a REALLY easy way, and a harder way to do VulnVoIP. This is a quick and dirty write-up on the easy way…

root@kali:~# nmap -sU -p 5060 172.16.28.160

Starting Nmap 6.47 ( http://nmap.org ) at 2014-12-14 16:28 EST
Nmap scan report for 172.16.28.160
Host is up (0.00032s latency).
PORT     STATE         SERVICE
5060/udp open|filtered sip
MAC Address: 00:0C:29:D8:2E:59 (VMware)

Nmap done: 1 IP address (1 host up) scanned in 13.25 seconds
root@kali:~#

After that scan as well as running svmap…

HackLab – Vulnix

So I was poking around VulnHub for a new VM to work on and I came across Vulnix…  Here is how I got root!

NMAP:

Enumerator:

Found ssh credentials.

Tried to login as User with the password “letmein”


We get access to user.

We also can see that this system is using rservices more specifically rlogin (We had a pretty good idea that this was the case with our original port scan showing port 513 being opened.)

Added wildcard + + to allow anybody to login with no password as user.

De-IceS1.140

NMAP SCAN

DIRB

---- Scanning URL: http://172.16.28.131:80/ ----
+ http://172.16.28.131:80/cgi-bin/
(CODE:403|SIZE:210)
==> DIRECTORY: http://172.16.28.131:80/forum/
+ http://172.16.28.131:80/index
(CODE:200|SIZE:1782)
+ http://172.16.28.131:80/index.html(CODE:200|SIZE:1782)
+ http://172.16.28.131:80/server-status
(CODE:403|SIZE:215)

---- Scanning URL: https://172.16.28.131/ ----
+ https://172.16.28.131/cgi-bin/
(CODE:403|SIZE:210)
==> DIRECTORY: https://172.16.28.131/forum/
+ https://172.16.28.131/index
(CODE:200|SIZE:1782)
+ https://172.16.28.131/index.html(CODE:200|SIZE:1782)
==> DIRECTORY: https://172.16.28.131/phpmyadmin/
+ https://172.16.28.131/server-status
(CODE:403|SIZE:215)
==> DIRECTORY: https://172.16.28.131/webmail/

The Web App

 

Found Sandy
(SWillard) email… She may be an admin for this app from the looks for this
thread… Also can deduce from this thread that email addresses are
initials@lazyadmins.corp.

 

Sandy =
sw@lazyadmins.corp

 

Hack.lu – Dalton’s Corporate Security Safe

Challenge

Myself along with a few of the other OverflowSecurity CTF team members participated in the Hack.lu CTF that just passed, and despite it being a very challenging CTF, we pulled 84th place out of 400 participating teams! Anyhow, I took on the Web challenge “Dalton’s Corporate Security Safe”, and had a lot of fun figuring this one out. Let’s get into it!

tinyCTF – Steg100

Steg100 Challenge.

Steg100 Challenge.

This stego challenge was pretty fun, it took me a bit of time to figure out the last parts, but I definitely learned a little bit more about how to attack challenges like these! Let’s get into it.

The only file provided was a PNG with three characters (Figure 1). The first thing to check of course is the image metadata. I pulled up fotoforensics.com, uploaded the image and pulled up the image metadata info (Figure 2). Conveniently, there was a tag called ‘Hint’, which linked to yet another PNG over on imgur. I pulled that image down and repeated the process above, but nothing else was revealed.

tinyCTF – Cry100

Cry100 Challenge

Cry100 Challenge

This was one of the first crypto challenges I’ve done for a CTF, and thankfully it was basic enough (it was only worth 100 points, after all)! The challenge file provided was a text file which looked like it contained words and sentences, only the letter values were jumbled up. Since the challenge was very likely an easy one, I didn’t overthink the possible solutions. My first thought was that this could have been a simple character substitution problem.

The opinions and thoughts on this blog are those of Overflow Security members, and do not reflect those of our members employers.