By Jeff White (karttoon)

Another year, another CSAW. Wasn't able to scrounge up a team this year, or spend much time playing (damn responsibilities!), but I did get to play some with @_jsoo_ and had a good time regardless. CSAW always has a great mix of challenges.

• Pwn - 50 - Warmup
• RE - 50 - Gametime
• Forensics - 50 - Kill
• Forensics - 100 - Clams Don't Dance
• Misc - 100 - Regexpire
• Web - 125 - MFW

Pwn - 50 - Warmup

We're provided the below binary for this exploit challenge.

We've got the NX bit set but otherwise nothing really enabled (this is the warmup afterall). When we run the program we receive what looks like an address at 0x40060D. Looking at the address in gdb we can see a function call for system with the value at 0x400734 passed to it.

This is our flag printing function so we need to find a way to execute it. Looking back at our main program, we see a call to the gets function at 0x40069E and can assume this is a classic buffer-overflow challenge. Using our trusty friend \x41, we can quickly narrow in on the bytes we need and then create a string which will point RIP to the function we want to execute.

Finally we run it against the server and receive the flag.

FLAG: FLAG{LET_US_BEGIN_CSAW_2016}

RE - 50 - Gametime

This challenge provided us the binary 'gametime.exe'.

Basically this is like the famous game DDR and you have to press certain keys as they pop-up in order to progress. I started looking at the code for this one in IDA and and toying with the idea of adjusting the sleep timers between each key being displayed before it timesout, but apparently I've wasted enough of my life playing videogames that I just beat it on the first run.

Funny story, I didn't even think about beating it in a legitimate fashion so the first time I played it I just ran it straight from the EXE, which meant that when I won, the window quickly vanished and I couldn't grab the key. Had to play it like three more times before I finally got it again for a screenshot :)

FLAG: no5c30416d6cf52638460377995c6a8cf5

Forensics - 50 - Kill

We're provided a PCAP file, "kill.pcapng" but honestly I couldn't tell you what the intended route for this challenge was.

FLAG: flag{roses_r_blue_violets_r_r3d_mayb3_harambae_is_not_kill}

Forensics - 100 - Clams Don't Dance

For this challenge we're provided a "out.img" file.

I played with mounting it and seeing if anything stood out but for whatever reason I was having a rough time mounting this so I went the Foremost route and carved it. In total, it extracted 714 zip files which, once extracted, had the contents for a PPT file.

Most of the images looked related to whatever this Clam-themed PPT was about except image0.gif, which stood out like a sore thumb.

A reverse Google image search showed that this was a Data Matrix (Maxicode) which is apparently primarily used by shipping companies, such as UPS. It's a two-layer format with inner and outter data and yatta yatta yatta...go read-up on it if you want, it's actually fairly interesting. Long story short, I found a data matrix decoder website and succesfully decoded out the flag.

FLAG: flag{TH1NK ABOUT 1T B1LL. 1F U D13D, WOULD ANY1 CARE??}

Misc - 100 - Regexpire

For this challenge, when you connect to the service provided you would receive a regex string. If you submitted back a string which matched their pattern before it timed-out then it would send you a new one, so on and so forth. The challenge was to parse their regex and generate a matching string so I decided to write something up in Python which can be found here (*note* my code is ugly! since reading some other solves for this challenge, there is a cool Python lib called 'rstr' which would have done the trick in a few lines of code).

Once I had a script worked out, it took 1,000 iterations before it spit the flag out...which is a bit excessive but there you have it.

FLAG: flag{^regularly_express_yourself$}

Web - 125 Mfw

This challenge was located at web.chal.csaw.io:8000 and looks relatively simple. It states that it was built with bootstrap, git, and PHP. Jacob nailed this one in the end!

Looking at the sourcecode for the page shows a commented out tab from the navigation bar called "flag".

A Nikto scan also shows some interesting data.

Specifically the presence of the .git directory.

Browsing this directory led to multiple findings. If you run strings on the index file, it gave us the tree structure for the site.

Also, the presence of the /.git/objects/XX files gave us the compressed copies of the site data. You can deflate the object files with openssl's zlib module ('openssl zlib -d < $IN > $OUT') and will find that the file in /.git/objects/97/ (index.php) and /.git/objects/87/ (flag.php) are interesting.

So we need to find a way to access the $FLAG variable in flag.php.

Looking at index.php we can see that it's taking the value passed to 'page' and prepending 'templates/' and while appending '.php' to the passed string. Afterwards, it does some checks to validate '..' isn't a substring (eg directory traversal). The key takeaway is that they are using the assert() function to accomplish this though, which is effectively like eval().

Jacob crafted a nice percent encoded string to grab the file contents of the flag.php file on the server and return it.

This turns the assert into the below.

Finally, we can request the URL and validate our flag.

FLAG: flag{3vald_@ss3rt_1s_best_a$$ert}

Older posts...