NDH Writeups - Revision history

PhilippeTeuwen: /* Conclusions so far */

2015-06-29T09:37:27Z

Conclusions so far

← Older revision		Revision as of 09:37, 29 June 2015
Line 391:		Line 391:
	<br>You can get all the 8342 intercepted beacons here: [http://www.yobi.be/files/ucccrm.log ucccrm.log]		<br>You can get all the 8342 intercepted beacons here: [http://www.yobi.be/files/ucccrm.log ucccrm.log]
	<br>They are in chronological order, unfiltered so a few might be corrupted		<br>They are in chronological order, unfiltered so a few might be corrupted
			====UPDATE June 2015====
			During NDH2015 CTF final I could discuss with the author of this challenge, who was unfortunately not present during the NDH2014 when I was facing those troubles.
			<br>It appeared that there was a 1-byte memory leakage in the Arduino code.
			<br>So when he started the devic, it was working fine, then he left, then the leakage went on till the Arduino got completely messed up.
			<br>So there was nothing we could have done, ''Garbage In, Garbage Out''
			<br>Too bad, but at least now I got an explanation ;)

	==2014 Nuit du Hack CTF Quals by Hackerzvoice==		==2014 Nuit du Hack CTF Quals by Hackerzvoice==

PhilippeTeuwen at 11:39, 9 April 2015

2015-04-09T11:39:33Z

← Older revision		Revision as of 11:39, 9 April 2015
Line 109:		Line 109:
	./ElectronicColoringBook.py -x 1280 -b 22 -o 11.18 -P "#ff0000#aaaaaa#000000#00ff00#000000" chall.bin		./ElectronicColoringBook.py -x 1280 -b 22 -o 11.18 -P "#ff0000#aaaaaa#000000#00ff00#000000" chall.bin
	<br><br>[[File:BleepMorseEBC.png]]		<br><br>[[File:BleepMorseEBC.png]]
			===Weshgrow===

			<pre>
			wget -q -O - --content-on-error "http://weshgrow.challs.nuitduhack.com/flag?hmac=%fd"\|grep FLAG
			<li onclick="toggle('pre29839800', 'post29839800')"> flag=FLAG</li>
			<tr><td>fvars</td><td class="code"><div>{'FLAG': 'Can_I_haz_s3cureD_hm4c_plz?',
			</pre>
			This python stacktrace because of the utf8 parser is probably not the intended way ;-)
			<br>For a write-up of the "real" solution, see [http://geeksspeak.github.io/blog/2015/04/06/ndh-ctf-2015-weshgrow-writeup/ here]
	==2014 Nuit du Hack CTF by Hackerzvoice==		==2014 Nuit du Hack CTF by Hackerzvoice==
	===Unter Cab Command and Control Radio Module===		===Unter Cab Command and Control Radio Module===

PhilippeTeuwen: /* Game-of-Life */

2015-04-09T11:24:37Z

Game-of-Life

← Older revision		Revision as of 11:24, 9 April 2015
Line 8:		Line 8:
	Flag : ToBeAndToLast		Flag : ToBeAndToLast
	Yes, $RANDOM, any password works!		Yes, $RANDOM, any password works!
	<br>If you want a much nicer write-up, see [https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2015/NUITDUHACK/crypto/gameoflife here] but honestly I don't see the point of writing a cracking script...		<br>If you want a much nicer write-up, see [https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2015/NUITDUHACK/crypto/gameoflife here] but honestly I don't see the point of spending so much time to solve it and writing a cracking script...

	===Bleep===		===Bleep===
	''"The clock is running. Make the most of today. Time waits for no man. Yesterday is history. Tomorrow is a mystery. Today is a gift. That's why it is called the present." (A)''		''"The clock is running. Make the most of today. Time waits for no man. Yesterday is history. Tomorrow is a mystery. Today is a gift. That's why it is called the present." (A)''

PhilippeTeuwen: /* 2015 Nuit du Hack CTF Quals by Hackerzvoice */

2015-04-09T11:24:09Z

2015 Nuit du Hack CTF Quals by Hackerzvoice

← Older revision		Revision as of 11:24, 9 April 2015
Line 3:		Line 3:
	It was a great moment of fun to participate to this year's [http://quals.nuitduhack.com/ CTF Quals] organised by Hackerzvoice		It was a great moment of fun to participate to this year's [http://quals.nuitduhack.com/ CTF Quals] organised by Hackerzvoice
	<br>Solving challenges involved all Pollypocket team members, here is only some polished results.		<br>Solving challenges involved all Pollypocket team members, here is only some polished results.
			===Game-of-Life===
			tar xzf GOL.tar.gz
			./jdlv.py $RANDOM cipher.txt \|grep -ia flag
			Flag : ToBeAndToLast
			Yes, $RANDOM, any password works!
			<br>If you want a much nicer write-up, see [https://github.com/smokeleeteveryday/CTF_WRITEUPS/tree/master/2015/NUITDUHACK/crypto/gameoflife here] but honestly I don't see the point of writing a cracking script...
	===Bleep===		===Bleep===
	''"The clock is running. Make the most of today. Time waits for no man. Yesterday is history. Tomorrow is a mystery. Today is a gift. That's why it is called the present." (A)''		''"The clock is running. Make the most of today. Time waits for no man. Yesterday is history. Tomorrow is a mystery. Today is a gift. That's why it is called the present." (A)''

PhilippeTeuwen: /* Bleep */

2015-04-07T23:48:30Z

Bleep

← Older revision		Revision as of 23:48, 7 April 2015
Line 82:		Line 82:
	^._.^._.^o_O^._.^._.^._O^._.^o_.^o_O^._.^._O^._.^._.^._O^._.^o_.^o_O^o_O^._.^._.^._O^._.^._		^._.^._.^o_O^._.^._.^._O^._.^o_.^o_O^._.^._O^._.^._.^._O^._.^o_.^o_O^o_O^._.^._.^._O^._.^._
	At first I tried to interpret the 5 individual patterns as Morse . and _ and as pauses (short between symbols, longer between letters, longer between words) but nothing made properly sense.		At first I tried to interpret the 5 individual patterns as Morse . and _ and as pauses (short between symbols, longer between letters, longer between words) but nothing made properly sense.
	<br>Then I realized combination of patterns was the key: one was there to toggle the output and the other one indicates duration.		<br>Then I realized combination of patterns was the key: one was there to toggle the output (^ =up, _ =down) and the other one indicates duration.
	^o = .		^o = .
	^. = -		^. = -

PhilippeTeuwen: /* Bleep */

2015-04-07T23:47:07Z

Bleep

← Older revision		Revision as of 23:47, 7 April 2015
Line 27:		Line 27:
	./ElectronicColoringBook.py -x 128 chall.bin		./ElectronicColoringBook.py -x 128 chall.bin
	<br>[[File:BleepECB.png]]		<br>[[File:BleepECB.png]]
	<br>And a quick look at the disassembly confirms the repetition of patterns made of args & fct calls:		<br><br>And a quick look at the disassembly confirms the repetition of patterns made of args & fct calls:
	avr-objdump -D -m avr5 chall.hex		avr-objdump -D -m avr5 chall.hex
	[...]		[...]

PhilippeTeuwen: /* Bleep */

2015-04-07T23:46:40Z

Bleep

← Older revision		Revision as of 23:46, 7 April 2015
Line 9:		Line 9:
	<br>It was a 200 misc but only solved by 6 teams so I think it deserves a little write-up :-)		<br>It was a 200 misc but only solved by 6 teams so I think it deserves a little write-up :-)
	<br>You get a file [https://mega.co.nz/#!fMUQmbDJ!Cmde_sL6RKksEbRWiNbLuVznNWmW7fcFF05wTnD6xw4 Bleep.tar.gz]		<br>You get a file [https://mega.co.nz/#!fMUQmbDJ!Cmde_sL6RKksEbRWiNbLuVznNWmW7fcFF05wTnD6xw4 Bleep.tar.gz]
	<br>It contains a "consigne" text file:		<br>It contains a "consigne" (FR for instructions) text file:
	[ Bleep ]		[ Bleep ]
	[+] You got this .hex file from a firmware dump can, you understand what's going on?		[+] You got this .hex file from a firmware dump can, you understand what's going on?
Line 23:		Line 23:
	<br>Actually knowing this kind of details is not that important ;-)		<br>Actually knowing this kind of details is not that important ;-)
	<br>So the initial approach was to open the firmware image in Ida but I felt demotivated and didn't want to reverse all those little interrupt-driven functions.		<br>So the initial approach was to open the firmware image in Ida but I felt demotivated and didn't want to reverse all those little interrupt-driven functions.
	<br>From the description (Bleep Bleeeep) the ~~microrontroller~~ is probably outputting a kind of Morse-encoded signal.		<br>From the description (Bleep Bleeeep) the microcontroller is probably outputting a kind of Morse-encoded signal.
	<br>Using my [https://doegox.github.io/ElectronicColoringBook/ ElectronicColoringBook.py] I can see quite a lot of patterns in the binary:		<br>Using my [https://doegox.github.io/ElectronicColoringBook/ ElectronicColoringBook.py] I can see quite a lot of patterns in the binary:
	./ElectronicColoringBook.py -x 128 chall.bin		./ElectronicColoringBook.py -x 128 chall.bin

PhilippeTeuwen: /* Bleep */

2015-04-07T23:45:40Z

Bleep

← Older revision		Revision as of 23:45, 7 April 2015
Line 16:		Line 16:
	:100010000C9487000C9487000C9487000C94870044		:100010000C9487000C9487000C9487000C94870044
	:100020000C9487000C9487000C9487000C94870034		:100020000C9487000C9487000C9487000C94870034
	etc.		etc.

	chall.hex is indeed a firmware image in the classical [https://en.wikipedia.org/wiki/Intel_HEX Intel HEX] format.		chall.hex is indeed a firmware image in the classical [https://en.wikipedia.org/wiki/Intel_HEX Intel HEX] format.

PhilippeTeuwen: /* Bleep */

2015-04-07T23:41:26Z

Bleep

← Older revision		Revision as of 23:41, 7 April 2015
Line 98:		Line 98:
	--. --- -.. -- --- -.. . --- --		--. --- -.. -- --- -.. . --- --
	Which translates to "GODMODEOM".		Which translates to "GODMODEOM".
	<br>The flag didn't validate but "GODMODEON" worked, maybe an error in the challenge or a side effect?		<br>The flag didn't validate but "GODMODEON" worked so last symbol should be a "." and not a "-", maybe an error in the challenge or a side effect?
	<br>Actually by carefully tuning the options and selecting a suitable color palette, my ElectronicColoringBook.py can reveal directly the code too: (red=-, green=.)		<br>Actually by carefully tuning the options and selecting a suitable color palette, my ElectronicColoringBook.py can reveal directly the code too: (red=-, green=.)
	./ElectronicColoringBook.py -x 1280 -b 22 -o 11.18 -P "#ff0000#aaaaaa#000000#00ff00#000000" chall.bin		./ElectronicColoringBook.py -x 1280 -b 22 -o 11.18 -P "#ff0000#aaaaaa#000000#00ff00#000000" chall.bin

PhilippeTeuwen: /* Bleep */

2015-04-07T23:20:18Z

Bleep

← Older revision		Revision as of 23:20, 7 April 2015
Line 99:		Line 99:
	Which translates to "GODMODEOM".		Which translates to "GODMODEOM".
	<br>The flag didn't validate but "GODMODEON" worked, maybe an error in the challenge or a side effect?		<br>The flag didn't validate but "GODMODEON" worked, maybe an error in the challenge or a side effect?
	<br>Actually by carefully tuning the options, ~~the~~ ElectronicColoringBook.py can reveal directly the code too: (red=-, green=.)		<br>Actually by carefully tuning the options and selecting a suitable color palette, my ElectronicColoringBook.py can reveal directly the code too: (red=-, green=.)
	./ElectronicColoringBook.py -x 1280 -b 22 -o 11.18 -P "#ff0000#aaaaaa#000000#00ff00#000000" chall.bin		./ElectronicColoringBook.py -x 1280 -b 22 -o 11.18 -P "#ff0000#aaaaaa#000000#00ff00#000000" chall.bin
	<br><br>[[File:BleepMorseEBC.png]]		<br><br>[[File:BleepMorseEBC.png]]