RingZer0Team on Such geek. Wow.

RingZer0team CTF - Challenges 86, 87, and 88

Thu, 13 Jul 2017 00:00:00 +1200

There are a bunch of fantastic Capture The Flag security challenges on RingZer0Team.com. I’ve been working through some of these for a wee while now, and with the New Zealand Cyber Security Challenge coming up again soon, I thought I’d get back into some of them.

Challenge 86 (“1/3 Do not waste the environment”, under the Forsensic Challenges) is one of a series of challenges where you need to dig through some provided data to find the flag.

I started by downloading the ‘forensic bundle’, which was just a large zip file. The first challenge was to figure out the contents of that zip file. The file name was just a jumble of characters, and there was no extension. Running file on it just returned the file type “Data”… not very enlightening, but head uncovered the string “VBOX” in the file… okay, it’s VirtualBox file.

Because I didn’t have Virtualbox installed, I spent a bit of time digging through the actual Vbox file itself, trying to see if there’s a flag already in there. I used strings | egrep -i flag-...., to try to find any flags embedded in the file itself. I didn’t find any flags, but I did discover that the computer name itself is “FLAG-PC”. Very clever. :-|

Update, many hours later:

Okay this totally cooked my bacon. After hours of playing with VirtualBox and playing with files, I finally gave up and Googled the name of the downloaded file.

Turns out I was REALLY close. The flag IS embedded in the actual file itself, but the format is different for the first time. The correct grep string would have been egrep -i '.?f.?l.?a.?g.?-'.

Real frustrated by how close I was, I’ll have to expand my searches in the future. Hat-tip to @professormahi and his GitHub page.

Once I understood that, I also discovered the flag for challenge 87 (“2/3 Did you see my desktop?”), in the same manner.

I haven’t managed to get the flag for Challenge 88 (“3/3 Suspicious Account Password”) yet, but I do know what it is. I can see (by grepping for “Visited”) a bunch of visits to http://www.forensicswiki.org/wiki/Tools:Memory_Imaging… this thing is a memory dump. That explains now why it doesn’t work as a VirtualBox disk.

Next time I sit down here, I’ll find visit Forensics Wiki, and start digging through the memory dump for the passwords.

Update two

I decided not to put this up as a separate post, because once I knew what I was looking at, it was pretty easy. Again though, I relied on @professormahi’s work - but now thanks to him I have a little bit of experience with Volatility!

First, we get Volatility to scan the image and see what it’s dealing with:

$ volatility -f vm.vmdk imageinfo
Volatility Foundation Volatility Framework 2.6
INFO : volatility.debug : Determining profile based on KDBG search...
 Suggested Profile(s) : Win7SP1x86_23418, Win7SP0x86, Win7SP1x86
 AS Layer1 : IA32PagedMemory (Kernel AS)
 AS Layer2 : FileAddressSpace (/home/eric/Downloads/86/vm.vmdk)
 PAE type : No PAE
 DTB : 0x185000L
 KDBG : 0x82920be8L
 Number of Processors : 1
 Image Type (Service Pack) : 0
 KPCR for CPU 0 : 0x82921c00L
 KUSER_SHARED_DATA : 0xffdf0000L
 Image date and time : 2014-03-09 20:57:55 UTC+0000
 Image local date and time : 2014-03-09 13:57:55 -0700

Now, knowing the profile that we need to use, we can use it to just… dump the password table:

$ volatility -f vm.vmdk --profile Win7SP1x86 hashdump
Volatility Foundation Volatility Framework 2.6
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
flag:1000:aad3b435b51404eeaad3b435b51404ee:3008c87294511142799dca1191e69a0f:::

And then, we grab that NTLM hash and pop it into an online NTLM decryptor service, and we’re away!

RingZer0team CTF - Challenge 44

Sat, 24 Jun 2017 00:00:00 +1200

Challenge 56 (“Hey Chuck where is the flag?”, under the Forensic Challenges) started by only offering a .pcap file. I downloaded Wireshark and had a quick dig. The packet capture consisted of a brief browse of a “Chuck Norris Facts” website.

After quickly flicking through the pcap itself looking for low-hanging fruit, I used File -> Export Objects -> HTTP. This takes all the HTTP traffic, recombines the packets into files, and saves them.

Once I’d done that, I opened up the files and had a quick flick through. I checked the images for metadata etc but didn’t find anything. However I did fine a picture of Chuck Norris, appearing to urge the reader to keep searching files – in French.

When I didn’t find anything super-obvious in the image contents, I hopped into Bash and just ran grep -i flag *. It quickly returned the flag, stored in a php file!

Nice and easy hunt, great way to finish the day.

RingZer0team CTF - Challenge 65

Sat, 24 Jun 2017 00:00:00 +1200

This is a continuation of my series on RingZer0Team.com.

Challenge 65 (“Hide my ass in my home”, under the Forensic challenges) is a nice quick little forensic challenge. You get to download a .tar file, and do a bit of digging to uncover the flag.

This was a nice easy few minutes. After downloading the archive, I discovered a few files inside - including a particularly groovy electronica swing track, which I’m listening to again right now. Yeaaaaahhhhh.

Apart from a groovy mp3, the archive contains some dot-files such as .bash_history, a .jpg picture, an index.html, and some other bits.

I found the Flag in one of the dot-files; specifically, it was inside a Vim swap file that seemed to be leftover from a power failure or similar.

RingZer0team CTF - Linux Sysadmin challenges

Sun, 28 May 2017 00:00:00 +1200

The Sysadmin Linux series of challenges is where you’re trying to breach the security of a Linux system. I actually finished most of these last year, but I wanted to finish my last two. Of course, to get to the last two stages, you need to use the flags from the previous stages. So I’m revisiting them.

Level 1 - Morpheus -> Trinity

We start by SSH’ing into a particular user account on the ringzer0team server:

You have mail.
Last login: Thu Apr 27 02:52:40 2017 from <somewhere>
morpheus@forensics:~$

There’s only one file in the home folder, and I can’t read it. There’s a /home/trinity folder with full read access, but also nothing legible.

The flag for level 1 is found by running ps aux, which reveals what appears to be Trinity’s password:

root 3241 0.0 0.0 4188 572 ? S Jan14 1:44 /bin/sh /root/backup.sh -u trinity -p Flag-<redacted>

Level 2 - Morpheus -> Architect

Aha, and the flag for level two is in /etc/fstab, which contains what appears to be The Architect’s password, in base64:

/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0
/dev/fd0 /media/floppy0 auto rw,user,noauto 0 0
#//TheMAtrix/phone /media/Matrix cifs username=architect,password=$(base64 -d "<redacted>"),iocharset=utf8,sec=ntlm 0 0

Level 3 - The Architect

Level 3 requires you to log on as architect, using the password we discovered earlier. The only clue is “dig for password”.

This bit got a bit harder. There are a couple possible hints in architect’s mail file, including a bunch of attempts to mount a cifs volume, and reference to a file in /backup/.

Digging through the files in /backup left me at a loss. There are references to /tmp/Gathering.py, but that’s a challenge for later (cypher’s challenge). After some digging I located /var/tmp/.swl, which contained some MySQL credentials!

mysql> show tables;
+----------------+
| Tables_in_arch |
+----------------+
| arch |
| flag |
+----------------+
2 rows in set (0.00 sec)

mysql> select * from arch;
+------+-----------------------+
| id | arch |
+------+-----------------------+
| 1 | The one |
| 1 | The null one |
| 1 | The mother of the one |
| 1 | The father of the one |
| 1 | The flag of the one |
| 1 | The null one |
+------+-----------------------+
6 rows in set (0.00 sec) 

mysql> select * from flag;
+---------------------------------+
| flag |
+---------------------------------+
| FLAG-<redacted> |
+---------------------------------+
1 row in set (0.00 sec)

Yasss after a solid hour of digging, I’ve found the flag for the third level!

Level Four - Morpheus -> Oracle

Again we’re logging on as morpheus, but this time the goal is to access the oracle account.

Lots of tasty stuff under /var/tmp/.viminfo, now that I’ve found it. References to files in /backup/, to /tmp/Gathering.py, /tmp/mail_cypher

Don’t make the mistake of trying to cat .swo; it’ll eat your console session.

Found this interesting thing in mail, but it’s not helpful: forensics.localdomain : Apr 14 21:14:33 : morpheus : user NOT in sudoers ; TTY=pts/4 ; PWD=/home/trinity ; USER=root ; COMMAND=/usr/sbin/usermod -aG neo morpheus

In one of the /backup files, I found the remains of an SSH key, and it worked! Access to the oracle account achieved. In the home folder, we’ve got a handy-dandy Base64-encoded flag in flag.txt.

Level Five - Oracle Encrypted File

There’s a file in the oracle home folder named encflag.txt.enc:

U2FsdGVkX1+dCl4WEHNJKBqA8a4fQeheOgA7oiNmjwlJQvGaQAgqcIsGRIcbdHKF
heSs51JRSEmOLqVyGvoxDA--

Decoding the base64 returns a binary blob, prefixed with the string “Salted”. This is one of the levels that I never completed originally, so maybe it’s time to give it another crack.

A quick google of “salted base64” reveals an interesting comment on StackExchange. Apparently I’m looking at a file encrypted with the OpenSSL ’enc’ command, so I first copy the file to my own computer to work.

I discover that the command openssl enc -in testfile -d -a will un-base64 it, then load the file in. I need to pass it a password to decrypt with though, so now I need to find that.

Oh my god I just did cat .* in the oracle home folder and literally found an alias that reads and decrypts the file. I can’t believe that took me almost an hour.

There are no words.

Level Six - Trinity -> Neo

Okay getting serious now. Using Trinity’s account, I need to find the password for the neo account.

It’s a bit noisy on login:

You have mail.
Last login: Tue Apr 25 16:29:29 2017 from <le blah>
-bash: hello: command not found
Sup Neo!
ls: cannot open directory /home/neo: Permission denied
cat: phonebook: Permission denied

A vague tickle in my memory prompted me to run sudo -l right off the bat. Rewarded with:

User trinity may run the following commands on this host:
 (neo) /bin/cat /home/trinity/*

So of course I immediately run sudo -u neo /bin/cat /home/trinity/*

This gives us a ‘phone book’ containing:

The Oracle 1800-133-7133
Persephone 345-555-1244





copy made by Cypher copy utility on /home/neo/phonebook

Trinity’s .bashrc contains a bit of kruft:

hello neo
echo "Sup Neo!"
$(ls -lart /home/neo)
cat phonebook

Really not useful. I remember finding Trinity’s password with ps aux:

root 3241 0.0 0.0 4188 572 ? S Jan14 1:47 /bin/sh /root/backup.sh -u trinity -p Flag-08grILsn3ekqhDK7cKBV6ka8B

It looks a little bit like a MySQL connection string, so I try that but no dice. Nothing under /var/tmp this time, and grep doesn’t find anything useful under the /backup goldmine.

There’s some weirdness under /etc/passwd. I don’t know what this means, but saving it for later:

trinity:x:1002:1002:trinity,%,lsdf(940998+(n.~,3):/home/trinity:/bin/bash

I looked through the mail file, but nothing jumped out at me there. Also trawled again through /backup, as well as /var/backups. Then /etc and /var. Argh.

Finally I start looking for Persephone. Nothing helpful, but it reminds me of the last line in the phonebook.

copy made by Cypher copy utility on /home/neo/phonebook

And then I remember that the sudo command allows a * at the end of the cat command, which might allow me to do path traversal…

sudo -u neo /bin/cat /home/trinity/../neo/phonebook

Finally, after a whole hour of digging, I’m awarded Neo’s password!

Level 7 - Neo is Not Alone

I don’t know what this clue means, but I bet it has something to do with Persephone. Persephone comes from Greek mythology as one of Zeus’ daughters, and the goddess of the underworld. Does that help me here? I don’t know, it’s getting late…

I run cat .* in Neo’s home directory to see if there’s anything hiding there, but no luck this time. Also nothing for sudo -l.

There’s an unreadable file (owned by root) called ‘result.stat’, that’s probably related to something. I browse the mail history and see:

forensics.localdomain : Dec 7 14:08:08 : neo : user NOT in sudoers ; TTY=pts/2 ; PWD=/home/neo ; USER=morpheus ; COMMAND=/home/morpheus/egrep /home/morpheus/../neo/result.stat

That could be handy. I do remember an egrep in /home/neo, will have a look. Lots of reference to /bin/monitor, too.

I’m only in the neo group, so nothing to see there.

Running ps aux | grep neo shows a heap of /bin/monitor processes started by root, but running under neo. There’s also a “SCREEN” instance there, but running screen -D -RR doesn’t reclaim it, so something’s up there. I’m pretty sure there’s something there in /bin/monitor.

In all honesty this one had me beat. It was half-past midnight and I was exhausted. I knew that there was something special about /bin/monitor, and I knew there was something special about the fact that it was running as neo. But I took the expedient route and had a quick google. I found the answer at http://blog.dornea.nu/2016/10/30/ringzer0-ctf-sysadmin-linux/ - without this I could have been looking for years. However, as is so often the case, this tutorial was the basis of some great learning for me.

Because the process is owned by neo, and because /bin/monitor could be read by neo, it meant I could run a stack trace. I have never done this before - no false impressions here, I totally relied on that dornea.ru page to tip me off to the usage of strace. But once I knew that, I had the flag.

I was very well misled by this one, actually. The Persephone comment in the phonebook totally led me down the wrong path, and I spent quite a long time searching for her details on the system. It was the reddest herring possible.

Level 8 - Morpheus -> Cypher

Okay it’s late now so I’m going to try to thrash this one quick. Nothing in ps aux for cypher. Grepping /backup found a python file and a dump showing a cron job runs this file every minute. The contents of the python file are:

import os
os.system('ps aux > /tmp/28JNvE05KBltE8S7o2xu')

I can’t read the output file, but I can edit the python script! This is gonna be easy.

After a little bit of trial and error, I edited the python script to first list the contents of the /home/cypher folder, and after that, to output the contents of /home/cypher/flag.txt

It’s important to note that the python file is recreated every three minutes when it’s run, so you need to redo your changes for every iteration.

Fin

That’s the end! I’m quite pleased I’ve managed to finish all of the Sysadmin Linux section. Of course that’s also scary, because it means I need to break into the other sections. That’s OK though… it’s a good time to do it!

RingZer0team CTF - Challenge 148

Sat, 27 May 2017 00:00:00 +1200

Challenge 148 (“Sysadmin Linux Level 2”) is one of a series of challenges where you’re trying to breach the security of a Linux system. I actually finished most of these last year, but I wanted to finish my last two. Of course, to get to the last two stages, you need to use the flags from the previous stages. So I’m revisiting them.

We start by SSH’ing into a particular user account on the ringzer0team server:

You have mail. Last login: Thu Apr 27 02:52:40 2017 from morpheus@forensics:~$

There’s only one file in the home folder, and I can’t read it. There’s a /home/trinity folder with full read access, but also nothing legible.

Running ps aux reveals what appears to be Trinity’s password:

root 3241 0.0 0.0 4188 572 ? S Jan14 1:44 /bin/sh /root/backup.sh -u trinity -p Flag-

Aha, and /etc/fstab contains what appears to be The Architect’s password, in base64:

/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0 /dev/fd0 /media/floppy0 auto rw,user,noauto 0 0 #//TheMAtrix/phone /media/Matrix cifs username=architect,password=$(base64 -d “”),iocharset=utf8,sec=ntlm 0 0

Great! Now I can carry on to my actual goal, which was to nail challenge 91 (“Sysadmin Linux Level 7”)!

RingZer0team CTF - Challenge 57

Fri, 05 May 2017 00:00:00 +1200

This is a continuation of my series on RingZer0Team.com.

Challenge 57 (“Hash Breaker Reloaded”, under the Coding Challenges) is one of a series of challenges where you’re simply presented with a hash - you need to return the plaintext value to the page within 3 seconds.

In contrast to Challenge 56, this challenge also includes a salt:

You have 3 seconds to break this hash
Send the answer back using https://ringzer0team.com/challenges/57/[clear_text]


----- BEGIN HASH -----
ab9507edbb2501b3c02e47c51af0178d68655980
----- END HASH -----

----- BEGIN SALT -----
c2ac9d8d004b4011d0864e76c7ebaaccfd18464bb8ff66bdbf19a703eb95a944
----- END SALT -----

The hash looks like another SHA-1, but of course the online hash reversers don’t have the now-salted hash in their rainbow tables. I figured that the challenge was a simple continuation of the previous challenge, so I crossed my fingers and guessed the hash was simply a number (from last time), concatenated with the plain-text salt.

… And I was lucky! The below code got me the flag:

#!/usr/bin/python3
from requests import get
from hashlib import sha1
from re import search

url='https://ringzer0team.com/challenges/57'
session=dict(PHPSESSID='<blahblah>')
resp=get(url,cookies=session)
hash=resp.text.split("-----")[2].split("\t")[2].split("<")[0]
salt=resp.text.split("-----")[6].split("\t")[2].split("<")[0]
newhash=''
salt=salt.encode('utf-8')
x=0
while newhash != hash:
		newhash=sha1(str(x).encode('utf-8')+salt).hexdigest()
		print("%s = %s" % (newhash, x))
		x+=1
	
resp=get(url+'/'+str(x-1),cookies=session)
flag=search("FLAG-.{24}",resp.text).group()
print(flag)

As last time, there’s no error handling in that code, so if it runs for more than a few seconds it’s probably toast.

RingZer0team CTF - Challenge 56

Tue, 02 May 2017 00:00:00 +1200

Challenge 56 (“Hash Breaker”, under the Coding Challenges) is one of a series of challenges where you’re simply presented with a hash - you need to return the plaintext value to the page within 3 seconds.

Of course, this is impossible to do manually, so it’s a programming challenge.

The hash looks like a simple SHA-1, so I put it into an online hash reverser and discovered it’s just a SHA1 hash of a random number. SHA1 is really fast, so this should be simple.

Here’s how I tackled the problem:

#!python
# It's in Python3, because of reasons
from requests import get
from hashlib import sha1
from re import search
calculated_hash=''
x=0

# Your session cookie needs to go here
session=dict(PHPSESSID='<cookie contents>')

# Load the web page
url='https://ringzer0team.com/challenges/56'
resp=get(url,cookies=session)

# Extract the hash from the page contents
target_hash=resp.text.split("-----")[2].split("\t")[2].split("<")[0]

# Iterate hashes from zero until the calculated hash matches the target hash
while calculated_hash != target_hash:
		calculated_hash=sha1(str(x).encode('utf-8')).hexdigest()
		print("%s = %s" % (calculated_hash, x))
		x+=1

# If we got here, yay! We found the key. Now submit it back to the site, and print our magic flag
resp=get(url+'/'+str(x-1),cookies=session)
flag=search("FLAG-.{24}",resp.text).group()
print(flag)

There’s no error handling in that code, so if it runs for more than a few seconds it’s probably toast.