Shc23s on Gian Klug

Swiss Hacking Challenge 2023 - it's all just bits

Sun, 30 Apr 2023 00:00:00 +0000

Information

Challenge category: pwn

Challenge Description

Limiting what you can do with Python is not an easy thing. Luckily there is RestrictedPython that does the work for us!

Files

We are given an its_all_just_bits.zip file containing the source code of the application.

Analysis

The stuff we can input is fairly limited.

We can’t import any modules
Most modern python things don’t work directly (+=, object.method(), object.attribute = "a")
We’re limited to a single line at once -> no nested while and if.
We have raw memory access using ctypes.c_ulong.from_address
Printing doesn’t work as neither stdin or stderr are passed after the exec.

We can however overwrite/change memory using the following methods:

Swiss Hacking Challenge 2023 - quantum

Sun, 30 Apr 2023 00:00:00 +0000

Information

Challenge category: crypto

Challenge Description

https://youtu.be/QRjntDBe15A?t=44 I’m Richard Ames. Secret Service? No – I was sent in by the La-li-lu-le-lo, just like you. What? You’re here to find out where the President is. We have little time, so I’ll be brief. How about switching to nanocommunications first? Nanocommunications? Right. Silence beats talk when it comes to safety.

The patriots are working on a new kind of nanocommunication device. They don’t (yet) know how to use quantum entanglement for superluminal communication, nevertheless they are working on something. Check out these quantum circuits, we suspect they were generated using qiskit, maybe you can rebuild them and understand them? Attention: The first qubit will be at the end of the password string, so suppose there are 4 qubites: 1, 0, 0, 0 the password string will be b"0001"

Swiss Hacking Challenge 2023 - vr training

Sun, 30 Apr 2023 00:00:00 +0000

Information

Challenge category: pwn

Challenge Description

https://youtu.be/I5AunfmI8bs?t=3843 I was part of the Army’s Force XXI Trials— Force XXI? Thats about tactical IT deployment right? Any field experience? No – not really. So this is your first. I’ve had extensive training – the kind that’s indistinguishable from the real thing. Like what? Sneaking Mission 60, Weapons 80, Advanced – VR, huh.

Hint: Around %30$p

Files

We are given a vr_training.zip file

The goal of this challenge is to complete two tasks:

Swiss Hacking Challenge 2023 - workstation

Sun, 30 Apr 2023 00:00:00 +0000

Information

Challenge category: pwn

Challenge Description

https://youtu.be/I5AunfmI8bs?t=1439 There’s actually one little thing— Just spit it out. I’m used to things going wrong. It looks like someone’s monitoring our transmission. Who? I don’t have a clue. All they’re doing is watching – it would creep me out less if they tried to interfere with our communications. Could it have something to do with that Cypher we saw? Maybe. I’ve switched the encryption protocol for our burst transmission for now. What I want to do is use a different method for sending those photos, just in case. Instead of using the Codec? Exactly. There’s a workstation in the southeast corner of the block where Metal Gear is housed. I’ve made arrangements so that you can send pictures from the machine.

Swiss Hacking Challenge 2023 - x or y

Sun, 30 Apr 2023 00:00:00 +0000

Information

Challenge category: re

Challenge Description

Staring at the two options in front of her, Sarah was overwhelmed with indecision. She turned to her friend and asked, “Is it X or Y? I can’t decide. Can you help me figure it out?” Her friend took a moment to consider before replying, “Well, it depends on what you’re looking for. If you want something sweet, go for X. But if you want something savory, Y is the way to go.” Sarah thought about it for a moment before making her choice, grateful for her friend’s guidance.

Swiss Hacking Challenge 2023 - ezrev

Sat, 29 Apr 2023 00:00:00 +0000

Information

Challenge category: re

Challenge Description

Since we’re having so much fun together, have some low level microcontroller stuff. Maybe have a look at the ATmega328P Datasheet. (PS: yeah the eeprom.txt dump is kinda fake but be happy it is)

Files

We are given an ezrev.zip archive. It contains the following files:

eeprom.txt: An EEPROM dump of the first 64 values
EZRev.hex: An atmega328p firmware dump

Exploitation

It turns out that there are actually two ways of solving this challenge. One is by just flashing the firmware and EEPROM correctly and then reading the flag via UART with the right baudrate. The other one involves just reading the disassembly.

Swiss Hacking Challenge 2023 - lost pass

Sat, 29 Apr 2023 00:00:00 +0000

Information

Challenge category: web

Challenge Description

Looks like somebody lost his password.

Files

We are given a lost_pass.zip archive. It contains a flask web app.

If we can login as admin we actually get the flag instead of lettuce. We somehow need to recover the admin password.

Analysis

The bug lies in the following function:

def check_password(username, hashed_password, password):
    # we split the hashed password into a list
    hashed_password = hashed_password.split(",")
    # we iterate over the password
    for x in range(len(hashed_password)):
        try:
            # we check if the hashed character is the same as the hashed password
            if hash_char(password[x]) != hashed_password[x]:
                # error_log does a timeout
                return error_log(username, password)
        except:
            # error_log is NOT called but 
            return False
    return True

If the given has the same characters as the start of the admin password the error log function doesn’t trigger. However as we’re looping based on the length of the admin password and our password (e.g. 1 character) is smaller, an exception is thrown.

Swiss Hacking Challenge 2023 - ezsignal

Wed, 26 Apr 2023 00:00:00 +0000

Information

Challenge category: misc

Challenge Description

More Hardware stuff. Can you SEE the flag?

Files

We are given an ezsignal.zip file containing EZsignal.sal file. It’s a Saleae Logic file, see my writeup of bbsignal for more information on it.

Analysis

Overview

The file opened in Logic looks like the following:

We see three channels with very similar signals and another channel with a much slower signal that switches between the blocks of data in the other ones.

Swiss Hacking Challenge 2023 - i

Wed, 26 Apr 2023 00:00:00 +0000

Information

Challenge category: web

Challenge Description

iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii

Files

We are given an i.zip file and we can access a running instance.

Analysis

ii ii iiii iiii iiii ii iiiiii, iiiii’ii iii’i iiiiiiiii iiiiiiiiiiiiii iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii. iii? iiii, iiiiiii iii ii. Just kidding. Not funny, I know.

i is a page where we can upload our own CSS that is then loaded into the page.

Flask routes

According to the source code we have the following interesting routes

Swiss Hacking Challenge 2023 - knive

Wed, 26 Apr 2023 00:00:00 +0000

Information

Challenge category: re

Challenge Description

As a chef, Robert knew the importance of having the right tools in his kitchen. He had a special knife that he used only for his secret ingredient. No one knew what it was, not even his sous chefs who had been with him for years. It was a small vial of liquid that he would dab onto his knife before using it to slice his meat. His dishes were famous, and people came from all over to try his food, but the secret ingredient remained a mystery.

Swiss Hacking Challenge 2023 - gerts data brotocol

Tue, 25 Apr 2023 00:00:00 +0000

Information

Challenge category: pwn

Challenge Description

Gert was a brilliant programmer who had just developed a new data protocol that promised to revolutionize the industry. He named it “Gert’s Data Brotocol,” or GDB for short. Excited about his invention, Gert sent out emails to all the major tech companies, hoping to create a secure partnership. But despite his best efforts, no one seemed interested in opening GDB to the public. Disheartened, Gert decided to take matters into his own hands and created a startup to launch GDB himself.

Swiss Hacking Challenge 2023 - dotcom

Mon, 24 Apr 2023 00:00:00 +0000

Information

Challenge category: web

Challenge Description

In the early 2000s, John had an idea for a dotcom enterprise that would revolutionize the way people shop online. He worked tirelessly to develop the platform and attract investors, eventually launching the site to great fanfare. Sales skyrocketed, and John became a billionaire overnight. But as quickly as the company rose to prominence, it all came crashing down when the dotcom bubble burst.

Swiss Hacking Challenge 2023 - white

Mon, 24 Apr 2023 00:00:00 +0000

Information

Challenge category: misc

Challenge Description

The picture that consists of only one color, white, would be a blank canvas with no visible markings or patterns. The white color would fill the entire surface area of the picture, giving it a clean and simple appearance. There would be no contrast or shading to create depth or texture, as white is a uniform color that reflects all light. The picture may evoke feelings of emptiness, and neutrality, as white is often associated with these concepts.

Swiss Hacking Challenge 2023 - bbsignal

Sun, 23 Apr 2023 00:00:00 +0000

Information

Challenge category: misc

Challenge Description

Hardware stuff can be as easy as decoding/using this protocol.

Files

We are given an bbsignal.zip file containing a .sal file. This is the file format used by Saleae Logic, a software for using logic analyzers.

Exploitation

We open up the file in Logic and are greeted with the following screen:

We add a “Serial Async” analyzer to the capture:

Swiss Hacking Challenge 2023 - cautious

Sun, 23 Apr 2023 00:00:00 +0000

Information

Challenge category: forensics

Challenge Description

Backing up everything surely is a good thing. But you still have to be cautious whom you give access to it—

Files

We are given a cautious file

The zip file contains a backup.ab file which is an android backup

Exploitation

The backup file is just a tar archive with a different header. We can convert it to a tar file using the Android Backup Toolkit:

Swiss Hacking Challenge 2023 - evil potato

Sun, 23 Apr 2023 00:00:00 +0000

Information

Challenge category: forensics

Challenge Description

Holy guacamoly. I somehow managed to download a evil potato and all my super secret browser history got leaked. I hope no one finds the password to my OnlySHC Account :(

Files

We are given an evil_potato.zip file. It contains an evil_potato.pcapng file.

Exploitation

We can either use Wireshark or tshark. I’ll be using tshark:

tshark -r evil_potato.pcapng

This dumps the whole file; we can also grep for the flag:

Swiss Hacking Challenge 2023 - hsb

Sun, 23 Apr 2023 00:00:00 +0000

Information

Challenge category: crypto

Challenge Description

Do you usually screw up your crypto implementation? You’re not alone, most companies do! But fear not, our newest HSM is the end of all your worries of being hacked. You can use it as a black box for your crypto operations and never need to worry about storing your keys again!

Files

We are given a hsb.zip file

Source code

#!/usr/bin/env python3

from Crypto.PublicKey import RSA
from inspect import signature
from secrets import choice
from secret import FLAG

RSA_LEN = 256

TYPE_USER = b"\x01"
TYPE_INTERNAL = b"\x02"

def b2i(b: bytes) -> int:
    return int.from_bytes(b, "big")

def i2b(i: int) -> bytes:
    return i.to_bytes((i.bit_length() + 7) // 8, "big")

def get_random_bytes(l: int):
    alph = list(range(1, 256))
    return b"".join([bytes([choice(alph)]) for _ in range(l)])

def pad(p: bytes) -> bytes:
    return get_random_bytes(RSA_LEN - len(p) - 2) + b"\x00" + p

def unpad(p: bytes) -> bytes:
    pad_end = 1
    while pad_end < len(p) and p[pad_end] != 0:
        pad_end += 1
    return p[pad_end + 1:]

class HSM:
    def __init__(self):
        self.vendor = "Cybersecurity Competence Center"
        self.model = "Perfection v2.1"
        self.rsa = None
        self.running = False

    def info(self):
        print(f"Vendor: {self.vendor}\nModel: {self.model}")

    def stop(self):
        if not self.running:
            print("HSM is already stopped.")
            return
        self.running = False

    def gen_key(self):
        bits = RSA_LEN * 8
        self.rsa = RSA.generate(bits)
        print(f"Generated new RSA-{bits} keys")

    def sign(self, m: int):
        m_pad = int.from_bytes(pad(i2b(m)), "big")
        sig = pow(m_pad, self.rsa.d, self.rsa.n)
        print(f"Signature: {sig}")

    def verify(self, sig: int, m: int):
        recovered = b2i(unpad(pow(sig, self.rsa.e, self.rsa.n).to_bytes(RSA_LEN, "big")))
        if recovered == m:
            print("Valid signature.")
        else:
            print("Invalid signature.")

    def _enc(self, m: bytes):
        c = pow(int.from_bytes(pad(m), "big"), self.rsa.e, self.rsa.n)
        print(f"Ciphertext: {c}")
        
    def enc(self, m: int):
        self._enc(TYPE_USER + i2b(m))

    def dec(self, c: int):
        m = unpad(pow(c, self.rsa.d, self.rsa.n).to_bytes(RSA_LEN, "big"))
        t, m = m[:1], b2i(m[1:])

        if t == TYPE_USER:
            print(f"Plaintext: {m}")
        else:
            print("Cannot decrypt internal secrets")

    def export_secret(self):
        self._enc(TYPE_INTERNAL + FLAG.encode())

    def run(self):
        self.running = True
        options = [self.info, self.stop, self.gen_key, self.sign, self.verify, self.enc, self.dec, self.export_secret]

        while self.running:
            print("Available operations:")
            for i, opt in enumerate(options):
                print(f"\t[{i}] {opt.__name__}")
            print()

            try:
                opt = int(input("Enter selected option: "))
                print()
                if opt > 2 and not self.rsa:
                    print("No RSA key available. Use gen_key() first.")
                else:
                    fn = options[opt]
                    args = []
                    for i in range(len(signature(fn).parameters)):
                        try:
                            args.append(int(input(f"input {i}: ")))
                        except ValueError as e:
                            print("Invalid input format, must be integer")
                            raise e
                    fn(*args)
            except (ValueError, IndexError):
                print("Invalid option")
                pass
            print()

if __name__ == "__main__":
    HSM().run()

Built-in security mechanisms

When using export_secret, it gets prepended with TYPE_INTERNAL. The dec function checks for this and doesn’t decrypt the flag.

Swiss Hacking Challenge 2023 - meme review

Sun, 23 Apr 2023 00:00:00 +0000

Information

Challenge category: forensics

Challenge Description

WARNING: THIS IS ACTIVE MALWARE WHICH CAN HARM YOUR COMPUTER. EXECUTE AT OWN RISK! My computer is always sooooooo slow and our IT department said that my computer from 2004 is almost brand new and it could do a few years more. Well I decided to taking matters into my own hands and just install more ram from the internet. Now the security dudes told my that im browsing some nice memes on github, but the memes are a little sus. I have no idea what a github is and what memes I was watching. Can you help me out and find out what they mean? (Hint: Use Win10x86_19041)

Swiss Hacking Challenge 2023 - mr. template man

Sun, 23 Apr 2023 00:00:00 +0000

Information

Challenge category: web

Challenge Description

Once upon a time, there was a man named mr. template man. He was an ordinary man with an extraordinary ability to create templates for every aspect of his life. From his morning routine to his work schedule, he had a template for everything. He believed that templates saved him time and helped him stay organized. One day, mr. template man realized that he had become too reliant on his templates. He started to feel like he was living his life on autopilot, without any spontaneity or creativity. He realized that his templates were holding him back from experiencing new things and taking risks.

Swiss Hacking Challenge 2023 - unm0unt41n

Sun, 23 Apr 2023 00:00:00 +0000

Information

Challenge category: crypto

Challenge Description

Sh1t! I really wanted to post the pictures from last year’s competition earlier on the SHC website but then someone hacked our server and encrypted all data— I have really no idea about crypto But I heard you’re an 31337 hacker, I’m sure you can recover our images, right? RIGHT?! Yours sincerely, a sysadmin in despair

Files

We are given an unm0unt41n.zip file

Analysis

The zip file

Upon extracting the zip file we see the following structure: