Difference between revisions of "NDH Writeups"
(Created page with "==2014 Nuit du Hack CTF Quals by Hackerzvoice== It was a great moment of fun to participate to this year's [http://quals.nuitduhack.com/ CTF Quals] organised by Hackerzvoice ...") |
|||
| Line 3: | Line 3: | ||
It was a great moment of fun to participate to this year's [http://quals.nuitduhack.com/ CTF Quals] organised by Hackerzvoice |
It was a great moment of fun to participate to this year's [http://quals.nuitduhack.com/ CTF Quals] organised by Hackerzvoice |
||
<br>Solving challenges involved all Pollypocket team members, here is only some polished results. |
<br>Solving challenges involved all Pollypocket team members, here is only some polished results. |
||
| − | ===[The greatest]=== |
+ | ===[http://quals.nuitduhack.com/challenges/view/6 The greatest]=== |
The greatest was a steganography challenge: |
The greatest was a steganography challenge: |
||
Revision as of 16:23, 6 April 2014
2014 Nuit du Hack CTF Quals by Hackerzvoice
It was a great moment of fun to participate to this year's CTF Quals organised by Hackerzvoice
Solving challenges involved all Pollypocket team members, here is only some polished results.
The greatest
The greatest was a steganography challenge:
We are sure that this e-mail contains hidden information, go get it !
Score 500
Link http://static.nuitduhack.com/mail.tar
Let's get this one:
wget http://static.nuitduhack.com/mail.tar file mail.tar mail.tar: POSIX tar archive (GNU)
And a quick inspection through an hexadecimal editor didn't reveal anything suspicious or noticeable.
So let's open it:
tar tvf mail.tar -rw-r--r-- null/null 296008 2014-04-05 07:05 Mail tar xvf mail.tar
And we get a file called Mail containing an email from BOOBA#rapfr.fr to theflag#nuitduhack.com
Hi dude! Check out this pic. I used the cool tool I told you about last time, except that I played around with the code a bit. Speaking of tools, Gregory Evans right? Have fun trying to find the hidden data ;) Peace out.
Together with an attachment (well, two attachments as the email was text+html)
The html version differed slightly ("this pic" => "this pick") but that didn't reveal to be of importance.
The other attachment:
Content-Type: image/gif; name=greg.gif Content-Disposition: attachment; filename=greg.gif Content-Transfer-Encoding: base64
Let's get it out of the mail using munpack from package mpack
munpack Mail
greg.gif is... a GIF showing #1 world hacker :-)
Here again nothing else than the GIF itself in the file.
file greg.gif greg.gif: GIF image data, version 89a, 500 x 645
Using gifsicle from the eponym package
gifsicle --info greg.gif * greg.gif 1 image logical screen 500x645 global color table [256] background 65 + image #0 500x645