Skip to content

Commit ee391d9

Browse files
PharisaeusPharisaeus
committed
added memory, vigenere and voip
1 parent fa001b2 commit ee391d9

File tree

5 files changed

+267
-0
lines changed

5 files changed

+267
-0
lines changed

‎2016-12-10-seccon-2016-quals/memory/README.md

+99
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
# Memory (forensics 100)
2+
3+
###ENG
4+
[PL](#pl-version)
5+
6+
In the task we get a memdump (quite large so we won't add it here).
7+
We proceed with the analysis using volatility.
8+
9+
If we check connections we can see that there is only one:
10+
11+
```
12+
$ ./volatility-2.5.standalone.exe connections -f forensic_100.raw
13+
Volatility Foundation Volatility Framework 2.5
14+
Offset(V) Local Address Remote Address Pid
15+
---------- ------------------------- ------------------------- ---
16+
0x8213bbe8 192.168.88.131:1034 153.127.200.178:80 1080
17+
```
18+
19+
No we can still play with volatility or we can just check this IP directly in the memdump strings and we can find:
20+
21+
```
22+
# Copyright (c) 1993-1999 Microsoft Corp.
23+
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
24+
# This file contains the mappings of IP addresses to host names. Each
25+
# entry should be kept on an individual line. The IP address should
26+
# be placed in the first column followed by the corresponding host name.
27+
# The IP address and the host name should be separated by at least one
28+
# space.
29+
# Additionally, comments (such as these) may be inserted on individual
30+
# lines or following the machine name denoted by a '#' symbol.
31+
# For example:
32+
# 102.54.94.97 rhino.acme.com # source server
33+
# 38.25.63.10 x.acme.com # x client host
34+
127.0.0.1 localhost
35+
153.127.200.178 crattack.tistory.com
36+
```
37+
38+
So it seems someone added this IP manually for host `crattack.tistory.com`.
39+
40+
If we now look for the host `crattack.tistory.com` we can find:
41+
42+
43+
```
44+
C:\Program Files\Internet Explorer\iexplore.exe http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd
45+
```
46+
47+
This matches what we've seen - someone was accessing this IP on port 80, so it was IE.
48+
But this IP does not match the actual IP of this host.
49+
So we check what did the user see under `http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd` -> `http://153.127.200.178/entry/Data-Science-import-pandas-as-pd` and it turnes out to be the flag:
50+
51+
`SECCON{_h3110_w3_h4ve_fun_w4rg4m3_}`
52+
53+
###PL version
54+
55+
W zadaniu dostajemy memdump (duży więc go nie wrzucamy).
56+
Rozpoczynamy analizę z volatility.
57+
58+
Jeśli sprawdzimy połączenia to widzimy tylko jedno:
59+
60+
```
61+
$ ./volatility-2.5.standalone.exe connections -f forensic_100.raw
62+
Volatility Foundation Volatility Framework 2.5
63+
Offset(V) Local Address Remote Address Pid
64+
---------- ------------------------- ------------------------- ---
65+
0x8213bbe8 192.168.88.131:1034 153.127.200.178:80 1080
66+
```
67+
68+
Moglibyśmy dalej bawić się z volatility ale szybciej będzie poszukać tego IP w stringach z memdumpa:
69+
70+
```
71+
# Copyright (c) 1993-1999 Microsoft Corp.
72+
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
73+
# This file contains the mappings of IP addresses to host names. Each
74+
# entry should be kept on an individual line. The IP address should
75+
# be placed in the first column followed by the corresponding host name.
76+
# The IP address and the host name should be separated by at least one
77+
# space.
78+
# Additionally, comments (such as these) may be inserted on individual
79+
# lines or following the machine name denoted by a '#' symbol.
80+
# For example:
81+
# 102.54.94.97 rhino.acme.com # source server
82+
# 38.25.63.10 x.acme.com # x client host
83+
127.0.0.1 localhost
84+
153.127.200.178 crattack.tistory.com
85+
```
86+
87+
Jak widać ktoś ręcznie dodał ten IP dla hosta `crattack.tistory.com`.
88+
89+
Jeśli teraz poszukamy hosta `crattack.tistory.com` znajdziemy:
90+
91+
```
92+
C:\Program Files\Internet Explorer\iexplore.exe http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd
93+
```
94+
95+
Co pasuje do tego co obserwowaliśmy - ktoś łączył się z tym adresem na porcie 80, więc było to IE.
96+
Ale ten IP nie pasuje do faktycznego adresu tego hosta.
97+
Sprawwdźmy więc co użytkownik widział pod `http://crattack.tistory.com/entry/Data-Science-import-pandas-as-pd` -> `http://153.127.200.178/entry/Data-Science-import-pandas-as-pd` a okazuje się to być flagą:
98+
99+
`SECCON{_h3110_w3_h4ve_fun_w4rg4m3_}`

‎2016-12-10-seccon-2016-quals/vigenere/README.md

+148
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
# Vigenere (crypto 100)
2+
3+
###ENG
4+
[PL](#pl-version)
5+
6+
In the task we get a ciphertext:
7+
8+
```
9+
LMIG}RPEDOEEWKJIQIWKJWMNDTSR}TFVUFWYOCBAJBQ
10+
```
11+
12+
And information that this is Vigener Cipher with alphabet:
13+
14+
```
15+
ABCDEFGHIJKLMNOPQRSTUVWXYZ{}
16+
```
17+
18+
And the md5 of plaintext is `f528a6ab914c1ecf856a1d93103948fe`
19+
20+
We of course know the flag prefix `SECCON{` so we can instantly recover the prefix of the key:
21+
22+
```python
23+
def get_key_prefix(alphabet, ct, known_pt):
24+
result = ""
25+
for i in range(len(known_pt)):
26+
plain = known_pt[i]
27+
cipher = ct[i]
28+
key = alphabet[alphabet.index(cipher) - alphabet.index(plain)]
29+
result += key
30+
return result
31+
```
32+
33+
which gives us `VIGENER`
34+
35+
Next we can just brute-force the missing 4 bytes of the key:
36+
37+
```python
38+
def decode(alphabet, ct, key):
39+
result = ""
40+
for i in range(len(ct)):
41+
c = ct[i]
42+
k = key[i % len(key)]
43+
if k != "?":
44+
p = alphabet[alphabet.index(c) - alphabet.index(k)]
45+
else:
46+
p = "?"
47+
result += p
48+
return result
49+
50+
51+
def worker(data):
52+
c, alphabet, ct, key = data
53+
key += c
54+
for suffix in itertools.product(alphabet, repeat=4):
55+
new_key = key + "".join(suffix)
56+
pt = decode(alphabet, ct, new_key)
57+
if hashlib.md5(pt).hexdigest() == "f528a6ab914c1ecf856a1d93103948fe":
58+
print(pt)
59+
return pt
60+
61+
62+
def main():
63+
alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ{}"
64+
ct = "LMIG}RPEDOEEWKJIQIWKJWMNDTSR}TFVUFWYOCBAJBQ"
65+
key_prefix = get_key_prefix(alphabet, ct, "SECCON{")
66+
print('key prefix ', key_prefix)
67+
print(brute(worker, [(c, alphabet, ct, key_prefix) for c in alphabet]))
68+
69+
70+
if __name__ == '__main__':
71+
freeze_support()
72+
main()
73+
```
74+
75+
Which gives us almost instantly `SECCON{ABABABCDEDEFGHIJJKLMNOPQRSTTUVWXYYZ}`
76+
77+
###PL version
78+
79+
W zadaniu dostajemy zaszyfrowany tekst:
80+
81+
```
82+
LMIG}RPEDOEEWKJIQIWKJWMNDTSR}TFVUFWYOCBAJBQ
83+
```
84+
85+
I informacje że to szyfr Vigenera z alfabetem:
86+
87+
```
88+
ABCDEFGHIJKLMNOPQRSTUVWXYZ{}
89+
```
90+
91+
Mamy też md5 plaintextu: `f528a6ab914c1ecf856a1d93103948fe`
92+
93+
I oczywiście znamy prefix flagi `SECCON{` więc możemy od razu odzyskać prefix klucza:
94+
95+
```python
96+
def get_key_prefix(alphabet, ct, known_pt):
97+
result = ""
98+
for i in range(len(known_pt)):
99+
plain = known_pt[i]
100+
cipher = ct[i]
101+
key = alphabet[alphabet.index(cipher) - alphabet.index(plain)]
102+
result += key
103+
return result
104+
```
105+
106+
co daje nam `VIGENER`
107+
108+
Następnie możemy brute-forcować brakujące 4 bajty klucza:
109+
110+
```python
111+
def decode(alphabet, ct, key):
112+
result = ""
113+
for i in range(len(ct)):
114+
c = ct[i]
115+
k = key[i % len(key)]
116+
if k != "?":
117+
p = alphabet[alphabet.index(c) - alphabet.index(k)]
118+
else:
119+
p = "?"
120+
result += p
121+
return result
122+
123+
124+
def worker(data):
125+
c, alphabet, ct, key = data
126+
key += c
127+
for suffix in itertools.product(alphabet, repeat=4):
128+
new_key = key + "".join(suffix)
129+
pt = decode(alphabet, ct, new_key)
130+
if hashlib.md5(pt).hexdigest() == "f528a6ab914c1ecf856a1d93103948fe":
131+
print(pt)
132+
return pt
133+
134+
135+
def main():
136+
alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ{}"
137+
ct = "LMIG}RPEDOEEWKJIQIWKJWMNDTSR}TFVUFWYOCBAJBQ"
138+
key_prefix = get_key_prefix(alphabet, ct, "SECCON{")
139+
print('key prefix ', key_prefix)
140+
print(brute(worker, [(c, alphabet, ct, key_prefix) for c in alphabet]))
141+
142+
143+
if __name__ == '__main__':
144+
freeze_support()
145+
main()
146+
```
147+
148+
Co od razu daje nam `SECCON{ABABABCDEDEFGHIJJKLMNOPQRSTTUVWXYYZ}`

‎2016-12-10-seccon-2016-quals/voip/README.md

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# VoIP (forensics 100)
2+
3+
###ENG
4+
[PL](#pl-version)
5+
6+
In the task we get a [pcap](voip.pcap) of a VoIP call.
7+
There was not much to do here since Wireshark can out-of-the-box decode this for us:
8+
9+
[!](ws.png)
10+
11+
And the flag is `SECCON{9001IVR}`
12+
13+
###PL version
14+
15+
W zadaniu dostajemy [pcapa](voip.pcap) z rozmowy przez VoIP.
16+
Nie było tu zbyt wiele do roboty bo wireshark potrafi to od razu zdekodować:
17+
18+
[!](ws.png)
19+
20+
A flaga to `SECCON{9001IVR}`

‎2016-12-10-seccon-2016-quals/voip/voip.pcap

521 KB
Binary file not shown.

‎2016-12-10-seccon-2016-quals/voip/ws.png

220 KB
Loading

0 commit comments

Comments
 (0)