Recently I’ve been thinking about the topic of organisations forcing people to change their password every few months or so. I know UNSW is quite vigilant in ensuring that passwords are regularly changed, and from personal experience I know that they do not allow you to use any of your previous passwords (which means that they are all stored...)
But how effective is this actually? I think the main issue with forcing people to regularly change their passwords is that it usually results in people choosing weaker passwords. In most cases, a bare-requirements password for an internet user would look something like ‘bacon1!’. However, drawing from what I’ve talked about with my family and from my own personal experience, a lot of the time when you’re forced to change your password the change of you changing your password to something completely different is quite low.
Often, what will happen is that you’ll change your password from ‘bacon1!’ to something like ‘bacon2!’ and so on. This behaviour can probably be attributed to the lack of awareness of what makes a good password, and people not knowing high how the risk of a data breach is.
From this article, it’s written that the NIST guidelines actually recommend to remove periodic password change requirements. Apparently, there have been multiple studies that have shown requiring frequent password changes to actually be counterproductive to good password security.
It’s interesting to discuss the benefits and disadvantages of this guideline:
Advantages:
More convenient for users - they no longer have to remember new passwords
Changing passwords often lead to satisficing from users - only change a minute detail of their password in order to satisfy the requirements - hence there is no actual security gained from changing passwords
Disadvantages:
If the password was originally weak to start with, then if there are no guidelines enforcing that users change weak passwords they are extremely susceptible to attacks
If an attacker has access to an account, if there are no forced password changes they could potentially have access to the account permanently
Overall I think the implementation of this policy could be a good thing, however it would only be successful if other controls are used concurrently. Mainly two factor authentication and perhaps a mechanism that doesn’t allow easy to guess passwords or passwords that are on a blacklist.
I decided to download my data from Google as I am a huge Google Suite user. However, my usage does vary a lot between a number of accounts and I only decided to download data from one of them.
The file was only around 700 megabytes, which could probably be attributed to the fact that my data would be spread around a number of accounts. I had a look at the data stored on all the different applications that I used (and there were a lot):
Under maps I actually have my home address saved under the label ‘home’. I didn’t realise that I had actually done this but obviously if someone were able to compromise my data that would have instant access to my location. Not fun.
All of my youtube viewing history and things like subscriptions, chats, messages and playlists are all stored in there. The fact that Google encompasses so many of the services that I use in my daily life is a bit scary - and links to the concept of data centralisation that we’ve been discussion throughout this course.
Email was another big one, with things like what I’ve searched for in my inbox and a complete list of my inbox, sent messages, archived messages and chat. A lot of my personal information and access to accounts is located in my email, so if an attacker had access to this data they could definitely see private information about myself and others.
Chrome was probably the biggest out of them all - as it is the main browser that I use. Within the chrome file are json files on autofill, bookmarks, browser history, extensions, sync settings and more.
Overall after looking at the actual pool of data that I’ve accrued throughout the years, I can see just how much of a digital footprint I’ve been leaving. Perhaps I could look into using a different browser like Duck Duck Go to ensure that all of my internet data isn’t centralised in one place but for now I’m incurring the risk of using the Google suite - at the benefit of convenience.
Just like the lectures this week, I’ll be getting rid of all the data that I do not need...
At the beginning of this course I was quite good with doing weekly reflections about my time management, where I would detail a plan for the week and assess how well I stuck to it. I did this for about 3-4 weeks, and offered insight into what I did well throughout the week in terms of time management, and discussed ways in which I could improve for next week. However, after this period I unfortunately stopped doing doing the weekly time management reflections.
In hindsight, I think it was because I already external tools like Trello to organise my weekly activities, and it was just extra effort to blog about things that I was kind of already doing. However after looking to write my job application now, I really wish that I had stuck with the reflections and continued to do them.
Another main factor as to why I think I stopped doing the time management reflections as well as a general lack of time management skill was because of the increased work load around the middle of the term. Around week 5, we had the midterm and a lot of my other courses were ramping up as well. I also spend a lot of time doing society work in CSESoc so overall I neglected to keep up with the weekly blogs during the middle of the term.
In addition to this, I also neglected to do weekly work for the something awesome project. Despite the whole point of the project being to put in a little bit of weekly work towards a bigger goal, I (subconsciously) decided to do the whole project in the last two weeks in which it was due. The result of this was an all-nighter which I definitely would not like to do again, and a lot of time spent stressing and writing up blog posts at 2am. Additionally, due to the lack of quality time that I spent on the project, I created something that I wasn’t entirely proud of.
Looking back, I definitely could have squeezed in time to do weekly work on the something awesome although this would have been at the expense of much needed relaxation time away from work. I think overall in terms of time management, the crux is motivation. If you’re motivated to achieve a goal, whether it be to get a certain mark in a course or get a certain job, you will put in the hours and make the effort to do all the work required to achieve that goal.
In my case, even though I had heaps of work piled up every week, I made the conscious decision to put it off and relax and take a break instead in my free time. I don’t blame myself for doing that - with the new trimester system I feel like the workload for uni has almost doubled from last year so finding the rare hour or two to crash in bed and watch youtube has become increasingly scarce.
I think if I were to put in the required 15 hours of work a week for this course, I would have to be some kind of robot. To be quite honest, I’m ok with sacrificing some marks if it meant that I had time to look after my physical and mental health - and I’m quite proud of the work that I’ve put into the course already.
Recently my grandparents are in town, so I’ve had the change to spend a lot of time with them :)
In one of my previous blog posts about passwords, I discussed the necessity of educating friends and family about security concepts so I fulfilled my word! I basically had a chat about what I’ve been learning about in this course and discussed things like:
Phishing
My grandparents weren’t aware of the actual term but were unfortunately intimately aware of the actual practice :(
My grandparents and a lot of their friends have actually been subject to numerous phishing attempts themselves. A funny story actually - during a phishing attempt on my grandpa, the attacker claimed that my grandpa had a virus on his laptop and needed urgent assistance. The funny thing is that he doesn’t actually have a laptop and so he decided to play along with the phishing attempt which lead to the attacker hanging up (swearing, he adds)!
I also warned my grandparents about email phishing attempts from attackers who pose as government officials, and claim that they have overdue tax.
Passwords
I think this topic was a really essential one - as you grow older it does get a lot harder for you to remember things, which is why passwords are such a point of weakness for the elderly. Basically I explained that because nowadays with two-factor authentication a lot of it relies on your email account, so if an attacker has access to your email then almost all of your accounts can be compromised.
I also warned about security questions like the famous ‘What is your mother’s maiden name?’ and explained how a lot of this information can be found online already through social media and the importance of not actually answering those questions correctly
Overall I encouraged them to talk to their friends about what I was studying (grandparents love to talk about that), and to get the conversation about online security started and to share the tips that I’ve suggested. Hopefully what I discussed with them will have a positive influence in the decisions that they make in the future!
Some notes from Adam about writing the job application:
The job application is a convincing document, which aims to convey the effort and skills you’ve developed over the course if this term
Synthesise your blog posts in your job application:
List blog posts -> but highlight which one's are better
If you haven't done a thing you have two options:
Pretend it doesn’t exist or
Write about why you haven't done it -> reflect on your time management
For example:
Why didn't I do an in class presentation
Regular blogging
It’s better to make a claim, let me agree, rather than link and hope I will realise
Double counting evidence - you can do it!
Something Awesome: Link to proposal, address whether you met it or not
Case study
We went over the case study in small groups. Overall, I think a lot of people found the case study quite challenging.
In the discussion, I brought up my idea about using RSA in order to achieve the main characteristics of the protocol that we needed - authentication and integrity.
However, upon discussing further, I realised that it was actually probably not feasible to use this method. Although in theory the idea seemed great - it achieved all the criteria that we wanted for the protocol - I had no clue about how to actually implement it :(
The conclusion that our group reached in the discussion, is that we needed to rely on the concept of a shared key. Because in the problem context, the ghost was part of the military (he was a cadet?) we assumed that there would be some kind of ‘message of the day’ or standard protocol that we could use as a shared secret.
This solved our problem of authenticating the ghost, however how do we stop the alien from altering the message? We still needed to find a way to authenticate the actual message. We decided to use a similar strategy - communicate through a shared, and secret, medium. Because the alien came from another world, we can assume that they wouldn’t know anything like morse code or pig latin. So if the alien tampers with the message in any way, the result would be evident, and we would know not to trust the alien.
A lot of groups seemed stumped when we discussed this, as unlike the Houdini case, there was no pre-agreed upon protocol that we could rely on. However, one group did think of a solution that I couldn’t really find a flaw in.
Basically their solution was to isolate the ghost and the man from the alien. Basically, the ghost and the man would stand inside a locked room, with the alien outside the door. Then, the man would write a question on a piece of paper or communicate with the ghost in a way such that the alien would hear. The ghost would transmit the message to the alien, who would reply to the man by yelling through the door.
This method works for the initial authentication of the ghost: if the man writes questions down and only receives gibberish back from the alien it is safe to assume that there is no ghost. In terms of the actual message authentication, because the alien cannot see the actual message it becomes hard for them to tamper with the result in any way. If any reply to the man is not intelligible, it is safe to assume that the alien cannot be trusted.
Lecture Revision
At the end of the tut we quickly went over block ciphers. Basically block ciphers are a way of encrypting data, and some block ciphers include:
AES
Blowfish
Des
3DES
We currently use AES as the standard. Different modes of the above cipher include:
CBC - each block XOR’s itself with the previous block. Because of this, we have to encrypt and decrypt serially.
ECB - each block is encrypted. Probably the most simple and least secure mode.
CTR - uses a counter and a nonce to take advantage of the avalanche affect of hashes
Unfortunately I was unable to attend this week’s lectures which means catch up for me! Thankfully I have a lot of support from friends and peers, and was able to go over the content through people’s blog posts.
Exam Details:
From the lecture notes:
There will be an exam question using the scenarios from this film so everyone should watch it. If you cannot stay back next week you can rent it on Google and YouTube for a few bucks.
I probably won’t be able to stay back next week, so I’ll have to go and watch the movie in my own time.
Richard has also set homework to learn more about one of:
Chernobyl
Bhopal
Challenger
To be honest, I’m not deeply familiar with any of these incidents, so it would probably be worth the time to go and research all of these events. From some of the blog posts I’ve seen, Richard must have said something about a question in the exam being on either of these topics. More incentive to do the homework!
Root Cause Analysis
What is root cause analysis?
When a system has a flaw, and is not performing correctly we need to diagnose the problem. We do this with a root cause analysis which details tracing the flow of events backwards, to attempt to discover the factors that influenced the outcome of an accident.
However, in practice root cause analysis is not perfect. Because the process is inherently human, we often like to assign blame to a single party involved in order to try and simplify the problem.
Human Weaknesses
The human weaknesses we covered in this week’s lecture have appeared in some of my other courses, namely MGMT1001. These ideas link closely to the process of decision making, in both a group context and an individual context.
Satisficing - a process in the decision making process in which an individual decides on and pursues a course of action that will satisfy the minimum requirements necessary to achieve a particular goal.
Bounded irrationality - decision making is limited by certain factors, including the information you have, and the dedicated time frame of the decision
Preferences for positivity - we want to accept the most positive outcome
Groupthink - often have a preference to ‘keep the peace’ within groups for fear of social exclusion; can result in bad decision-making processes. Groupthink disincentivises critical thinking, and challenging consensus.
Confirmation bias - only caring about the evidence that supports what you believe
Heuristics
Humans often rely on heuristics when determining the outcomes of situations and the associated risks. A number of types were mentioned:
Similarity matching - used to account for how people make judgments based on the similarity between current situations and other situations or prototypes of those situations. For example, a person may use similarity matching when deciding on a book purchase. If a novel has a plot similar to that of novels read and enjoyed or the author has a writing style similar to that of favoured authors, the purchasing decision will be positively influenced.
Frequency gambling - if many patterns match, you pick the one you are a most familiar with (a ‘natural reaction’); relies on the logic that what ‘worked in the past’ must ‘work in the future’
Availability heuristic - relies on how easily something can be brought to a person’s mind; people estimate the how frequent an event is based on how easily it can be brought to mind
Seminars:
According to people’s blog posts, there were two seminars this week - one on privacy and the other on digital forensics.
Both of these topics are extremely interesting, and link to a lot of the case studies we’ve been doing in our tutorials such as the Giggle Self Driving Car case study.
In terms of digital forensics, through completing some CTF challenges, I’ve done research on what forensics means in a CTF context. However, I’ll have to do more research about what digital forensics means in a broader security context. Hopefully, looking through the presentation slides on open learning will suffice!
The Stargate problem is the scenario when you have a group of military people standing outside a Stargate to another dimension. One of the military cadets volunteers to walk through the portal and ends up in a new universe, and finds an alien who asks if he can join the cadet back into his universe. The cadet agrees, but when they walk back into the Earth universe, the cadet disintegrates and becomes a ghost. The alien can however see and hear the ghost, but no living thing on Earth can either see or hear the ghost of the young cadet. How can one ensure that the ghost can communicate legitimately through the alien, with the people of Earth?
The case study question:
Suppose you are the friendly Major M from the base who can see the alien A but who cannot see the invisible man X.
Q: What would you M do to get from X his report on the Alien's (A's) planet?
We should design our protocol in mind with the assumption that the alien cannot be trusted, because if the alien can be trusted, then there is probably no reason to establish a protocol.
This is a case of one-way authentication, as the ghost can see and send messages, however this is not the case for the reverse situation. In general with authentication, establishing a common key is very important in order to communicate with two parties, however unlike the case study for Houdini, in this case there is no pre-agreed upon key or protocol for the two parties to use. The protocol should also be designed such that:
The alien should not be able to impersonate the ghost - protocol should have authentication
The alien should not be able to read nor modify the message - protocol should have integrity
The receiver should be able to verify that the message came from the ghost - protocol should have non-repudiation
Thus we have to rely on some form of shared knowledge between the ghost and the other cadets that the alien does not know. The first thing that I can think of is because all the cadets went into the same training, they could possible use any military drills/communication protocols that they used when in military training.
The two parties could possibly use RSA to communicate. Each party would have:
A private key which could be something like their military number (which the alien wouldn’t know)
The public key which could be established vocally by M
Super happy with my progress over the course for cryptograms!
This week I actually managed to break my previous record of 30 seconds with this challenge for a new record of 27 seconds :)
Finally, here’s a graph of my improvement over the semester for my average time:
Good to see a downwards sloping trend (you would hope there would be improvement after doing 100 of these)!
Overall I’m really happy with the development of this skill over the course of this term - I felt like I was putting in consistent effort by practicing every week.
As usual here are some of the highlights of this week:
Throughout your journey you will have to run many programs. Can you navigate to /problems/reversing-warmup-1_0_f99f89de33522c93964bdec49fb2b838 on the shell server and run this program to retrieve the flag?
The problem run is known as an ELF binary. It is the most common program format on Linux. Here are the steps to run the program:
$ cd /problems/reversing-warmup-1_0_f99f89de33522c93964bdec49fb2b838 $ ls run $ ./run picoCTF{welc0m3_t0_r3VeRs1nG}
flag: picoCTF{welc0m3_t0_r3VeRs1nG}
Overall this simple challenge is here to help users get comfortable with using executable files, and how to run them.
Reversing Warmup 2
Can you decode the following string dGg0dF93NHNfczFtcEwz from base64 format to ASCII?
Base64 is a common encoding format. The main differences between encoding and encrypting as we saw in our previous cryptography chapter are as follows:
Encoding transforms data into another format using a scheme that is publicly available so that it can easily be reversed.
Encryption transforms data into another format in such a way that only specific individual(s) can reverse the transformation.
In summary:
Encoding is for maintaining data usability and uses schemes that are publicly available.
Encryption is for maintaining data confidentiality and thus the ability to reverse the transformation (keys) are limited to certain people.
To decode the string, we can use python, which is a really useful programming language for writing quick scripts or computing numbers really efficiently:
Python 2.7.15 (default, Jun 17 2018, 12:51:03) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)] on darwin Type "help", "copyright", "credits" or "license" for more information. >>> 'dGg0dF93NHNfczFtcEwz'.decode('base64') 'th4t_w4s_s1mpL3'
flag: picoCTF{th4t_w4s_s1mpL3}
Assembly-0
What does asm0(0xb6,0xc6) return? Submit the flag as a hexadecimal value (starting with ‘0x’). NOTE: Your submission for this question will NOT be in the normal flag format. Source [1] located in the directory at /problems/assembly-0_0_5a220faedfaf4fbf26e6771960d4a359.
As you can see, there’s a function named asm0 that is being exported by the line .global asm0, and the content of the function is right below the asm0 : label. We know that the function is called with the argument of 0xb6 and 0xc6 which are at [ebp+0x8] and [ebp+0xc] respectively.
By converting the assembly code to pseudo-code, we can observe the logic of the function.
eax = arg1 ebx = arg2 eax = ebx
Because we know that an assembly function always returns the value than is in the eax register, the asm0 should always return the second argument passed to it; therefore, the return value is 0xc6.
Flag: 0xc6
Assembly-1
What does asm1(0xcd) return? Submit the flag as a hexadecimal value (starting with '0x’). NOTE: Your submission for this question will NOT be in the normal flag format. Source [1] located in the directory at /problems/assembly-1_2_ac6a59ca77a2d619ddabb3c3ffedb9a8.
This problem is similar to the previous challenge. The code can be found below:
.intel_syntax noprefix .bits 32 .global asm1 asm1: push ebp mov ebp,esp cmp DWORD PTR [ebp+0x8],0x98 jg part_a cmp DWORD PTR [ebp+0x8],0x8 jne part_b mov eax,DWORD PTR [ebp+0x8] add eax,0x3 jmp part_d part_a: cmp DWORD PTR [ebp+0x8],0x16 jne part_c mov eax,DWORD PTR [ebp+0x8] sub eax,0x3 jmp part_d part_b: mov eax,DWORD PTR [ebp+0x8] sub eax,0x3 jmp part_d cmp DWORD PTR [ebp+0x8],0xbc jne part_c mov eax,DWORD PTR [ebp+0x8] sub eax,0x3 jmp part_d part_c: mov eax,DWORD PTR [ebp+0x8] add eax,0x3 part_d: pop ebp ret
For this challenge, control flow is being introduced.
In the case of the challenge, [ebp+0x8] is the argument that gets passed into the function, specifically 0x76. Because 0x76 is not larger than 0x98, we will not follow the first jg (jump greater than) to part_a.
For the second comparison, because 0x76 doesn’t equal 0x8, we are going to jump to part_b (jne means jump not equal).
In part_b, the argument is loaded into eax and 3 is subtracted from it. After that, the function returns (with the jmp to part_d) - therefore, we just have to take 0x76 and subtract 0x3 from it to get the flag: (0x73).
For the reversing chapter in my guide, I needed to do some prior research on low level languages, specifically assembly. I have had experience with MIPS in COMP1521, so concepts like registers, code segments, and control flow are all very familiar - I just need to learn the syntax!
What is reverse engineering?
Reverse Engineering in a CTF is typically the process of taking a compiled program like machine code or byte-code and converting it back into a more human readable format. Challenges will often include looking at programs looking written in low-level programming languages.
Low-level vs high-level programming languages
High level programming languages typically allow users to write applications which are portable across various platforms, and are irrespective of architecture.
Low level programming languages are what is called ‘assembly code’. These languages are more appropriate for developing operating systems and typically take a lot of work to learn and understand how it works.
Assembly Breakdown:
As we’ve said before, learning assembly takes a lot of time and effort to try and understand as it is extremely different from a lot of the programming languages that most people are familiar with like Python or Java.
We’ll be covering some of the basic concepts in assembly below, but for a more in-depth tutorial, visit this site.
An assembly program can be divided into three sections:
The data section
The bss section
The text section
The data section
The data section is used for declaring initialised data or constants. This data does not change at runtime. You can declare various constant values, file names, or buffer size, etc
The bss section
The bss section is used for declaring variables.
The text section
The text section is used for keeping the actual code. This section must begin with the declaration global _start, which tells the kernel where the program execution begins.
The syntax for declaring text section is −
section.text
global _start
_start:
Registers
In assembly, registers store data elements for processing without having to access the memory. A limited number of registers are built into the processor chip.
Four 32-bit data registers are used for arithmetic, logical, and other operations.
EAX - is the primary accumulator; it is used in input/output and most arithmetic instructions. For example, in multiplication operation, one operand is stored in EAX or AX or AL register according to the size of the operand.
EBX - is known as the base register, as it could be used in indexed addressing.
ECX - is known as the count register, as the ECX, CX registers store the loop count in iterative operations.
EDX - is known as the data register. It is also used in input/output operations. It is also used with AX register along with DX for multiply and divide operations involving large values.
Instructions:
The MOV Instruction
The MOV instruction is used for moving data from one storage space to another. The MOV instruction takes two operands.
Syntax:
The syntax of the MOV instruction is:
MOV destination, source
The MOV instruction may have one of the following five forms:
Both the operands in MOV operation should be of same size
The value of source operand remains unchanged
The ADD and SUB Instructions
The ADD and SUB instructions are used for performing simple addition/subtraction of binary data in byte, word and doubleword size, i.e., for adding or subtracting 8-bit, 16-bit or 32-bit operands, respectively.
Syntax
The ADD and SUB instructions have the following syntax:
ADD/SUB destination, source
The ADD/SUB instruction can take place between:
Register to register
Memory to register
Register to memory
Register to constant data
Memory to constant data
However, like other instructions, memory-to-memory operations are not possible using ADD/SUB instructions. An ADD or SUB operation sets or clears the overflow and carry flags.
Control Flow
Unconditional Jump
This is performed by the JMP instruction. Conditional execution often involves a transfer of control to the address of an instruction that does not follow the currently executing instruction. Transfer of control may be forward, to execute a new set of instructions or backward, to re-execute the same steps.
Syntax:
The JMP instruction provides a label name where the flow of control is transferred immediately. The syntax of the JMP instruction is:
JMP label
Conditional Jump
If some specified condition is satisfied in conditional jump, the control flow is transferred to a target instruction. There are numerous conditional jump instructions depending upon the condition and data.
Following are the conditional jump instructions used on signed data used for arithmetic operations:
As per usual, below are the write-ups for some of the challenges in the picoCTF forensics module.
Forensics Warmup 2
Hmm for some reason I can’t open this PNG? Any ideas?
Starting off with a simpler challenge, if we use the file command on the image, we get this output:
❯ file flag.png flag.png: JPEG image data, JFIF standard 1.01
What this tells us is the file is not a png, but is in fact a jpeg! This challenge demonstrates a relatively simple application of disguising a file type as another!
Knowing that the image is actually a jpeg file, we open the image as a jpeg file to get the flag
flag: picoCTF{extensions_are_a_lie}
Reading Between the Eyes
Stego-Saurus hid a message for you in this image, can you retrieve it?
As hinted to in the description, we can assume that the there is some stenography going on in this challenge. As we discussed before, we can use this tool to decode hidden messages in images.
Simply upload the image to get our flag: picoCTF{r34d1ng_b37w33n_7h3_by73s}
hex editor
This cat has a secret to teach you. You can also find the file in /problems/hex-editor_4_0a7282b29fa47d68c3e2917a5a0d726b on the shell server.
As we discussed before in the guide, there are certain things we can do to find the initial starting point of the challenge.
One of the first tips was to use the strings command to try and find any readable strings hidden away in the image. Whilst strings would return all the readable parts, we only care about the flag in the context of the CTF. What was a way to search for specific words again... that’s right, grep!
For this challenge, you can get the flag by looking at the hexdump of the image or just print out all the readable parts of the file:
<pre>❯ strings hex_editor.jpg | grep pico Your flag is: "picoCTF{and_thats_how_u_edit_hex_kittos_dF817ec5}" </pre>
Can you help us find the flag in this Meta-Material? You can also find the file in /problems/truly-an-artist_3_066d6319e350c1d579e5cf32e326ba02.
The description of this challenge references ‘Meta-material’. We know from the chapter that this is probably a pointer to the metadata of the file. One of the ways that we discussed of getting EXIF metadata from files was through exiftool.
Typing in the following gets us the flag:
$ exiftool 2018.png ExifTool Version Number : 11.57 File Name : 2018.png Directory : . File Size : 13 kB File Modification Date/Time : 2019:07:23 14:51:16+10:00 File Access Date/Time : 2019:07:23 14:54:56+10:00 File Inode Change Date/Time : 2019:07:23 14:51:21+10:00 File Permissions : rw-r--r-- File Type : PNG File Type Extension : png MIME Type : image/png Image Width : 1200 Image Height : 630 Bit Depth : 8 Color Type : RGB Compression : Deflate/Inflate Filter : Adaptive Interlace : Noninterlaced Artist : picoCTF{look_in_image_eeea129e} Image Size : 1200x630 Megapixels : 0.756
I’ve had no previous experience with forensics challenges in CTFs so I have compiled a list of (hopefully) useful concepts that people like me could use before starting some of the challenges:
Files and the File System
A file system is a like an index for all the files in your computer system! You can find a reference to all the files in your computer. File Systems have a lot of different parts but the main ones include:
Files
Files are used to store data and have two parts:
A ‘Filename’ or the name used to refer to the file
A ‘type’ or the kind of data that is stored in the file.
A file consists of blocks, which is the smallest part of the data that is stored in memory. The header block contains the starting point of the file whereas the footer block contains the end point of the file.
Directories
Directories are collections of files grouped together in some way. You can think of these as folders, as we have explored earlier in this guide.
Metadata
Metadata is the data about the file itself like its length, time created and author etc. When a file is created, the data is stored at some position in memory and the filename is the reference to that data.
It is like the address of your friend’s house - the address of your friends house has nothing to do with your friends house but it is a simple way that we have come up with to remember where certain places are located. If you forget the address, your friends house doesn’t get removed. This exactly the same for files on a computer! Sometimes when you delete a file, all that is happening is that your computer just doesn’t remember where that file is stored. It probably still exists at that same memory location until you write something there again.
File Carving
File carving refers to the technique to extract data from a disk drive without having the normal file system to easily recover the files. It’s a method of recovering files when there is no reference to them in the computer and is mostly used to recover deleted files.
This is made possible because when a file gets deleted, the data doesn’t get deleted - just the reference to that data. Another important change that happens when you delete is file is that the disk location where the file is stored gets marked as ‘unallocated’ and can thus be overwritten. However, it is possible to use techniques to recover most, if not all, of the data.
Initial analysis
When you start a forensics challenge, at first you may not have any leads and need to explore the challenge file at a high-level for a clue toward what to look at next. Below are some useful starting tips for when you’re trying to figure out the initial starting point of the question?
strings
As we discussed in our first chapter, we can use the strings command to search for all plain-text strings in the file,
Example of using strings to find ASCII strings, with file offsets:
Image file formats are complex and can be abused in many ways that make for interesting analysis puzzles involving metadata fields, lossy and lossless compression, checksums, steganography, or visual data encoding schemes.
The easy initial analysis step is to check an image file’s metadata fields with exiftool. If an image file has been abused for a CTF, its EXIF might identify the original image dimensions, camera type, embedded thumbnail image, comments and copyright strings, GPS location coordinates, etc. There might be a gold mine of metadata, or there might be almost nothing. It’s worth a look.
Example of exiftool output, truncated:
$ exiftool screenshot.png ExifTool Version Number : 10.53 File Name : screenshot.png Directory : . File Size : 750 kB File Modification Date/Time : 2017:06:13 22:34:05-04:00 File Access Date/Time : 2017:06:17 13:19:58-04:00 File Inode Change Date/Time : 2017:06:13 22:34:05-04:00 File Permissions : rw-r--r-- File Type : PNG File Type Extension : png MIME Type : image/png Image Width : 1482 Image Height : 648 Bit Depth : 8 Color Type : RGB with Alpha Compression : Deflate/Inflate ... Primary Platform : Apple Computer Inc. CMM Flags : Not Embedded, Independent Device Manufacturer : APPL Device Model : ... Exif Image Width : 1482 Exif Image Height : 648 Image Size : 1482x648 Megapixels : 0.960
Steganography
What is steganography?
Steganography is the practice of hiding data in plain sight. Steganography is often embedded in images or audio.
You could send a picture of a cat to a friend and hide text inside. Looking at the image, there’s nothing to make anyone think there’s a message hidden inside it.
Not only messages, but you can also hide a second image inside the first.
A way we can detect if images have been hidden in other images are through online tools. This website allows you to upload an image, and either encode a hidden message into the image or decode a message previously hidden in the image.
Just finishing up the chapter on web exploitation by adding some introduction to the topic which you can read below:
Web Exploitation
What is web exploitation?
Web exploitation specifically relates to the task of finding vulnerabilities in the internet and networks, in order to gain some kind of higher privilege or access something that wasn’t intended to be accessed publicly. This could be something like gaining access to an admin account on a website, and using that to make changes that you normally shouldn’t be able to make.
Why is it good to know about web exploitation?
Websites and the internet are a focal part of our lifestyles, so knowing how potential attackers can find weaknesses in websites is particularly useful for those who are thinking about building their own website. By knowing the possible weak points in your website, you’ll be better prepared to defend against would-be hackers.
Before we get started with anything, we should probably have a look into how our environment operates:
Write ups for picoCTF’s Web Exploitation module can be found below:
Inspect Me
Inspect this code! http://2018shell.picoctf.com:56252
After going to the website link, we are able to view the source code for the website by pressing F12. After navigating to the sources tab, we can see three different files.
index.html
<!doctype html> <html> <head> <title>My First Website :)</title> <link href="https://fonts.googleapis.com/css?family=Open+Sans|Roboto" rel="stylesheet"> <link rel="stylesheet" type="text/css" href="mycss.css"> <script type="application/javascript" src="myjs.js"></script> </head> <body> <div class="container"> <header> <h1>My First Website</h1> </header> <button class="tablink" onclick="openTab('tabintro', this, '#222')" id="defaultOpen">Intro</button> <button class="tablink" onclick="openTab('tababout', this, '#222')">About</button> <div id="tabintro" class="tabcontent"> <h3>Intro</h3> <p>This is my first website!</p> </div> <div id="tababout" class="tabcontent"> <h3>About</h3> <p>These are the web skills I've been practicing: <br/> HTML <br/> CSS <br/> JS (JavaScript) </p> <!-- I learned HTML! Here's part 1/3 of the flag: picoCTF{ur_4_real_1nspe --> </div> </div> </body> </html>
function openTab(tabName,elmnt,color) { var i, tabcontent, tablinks; tabcontent = document.getElementsByClassName("tabcontent"); for (i = 0; i < tabcontent.length; i++) { tabcontent[i].style.display = "none"; } tablinks = document.getElementsByClassName("tablink"); for (i = 0; i < tablinks.length; i++) { tablinks[i].style.backgroundColor = ""; } document.getElementById(tabName).style.display = "block"; if(elmnt.style != null) { elmnt.style.backgroundColor = color; } } window.onload = function() { openTab('tabintro', this, '#222'); } /* I learned JavaScript! Here's part 3/3 of the flag: */
Just by visually inspecting the code for the three different files, we can see the different segments of the flag. Put the three parts together, and you get the flag: picoCTF{ur_4_real_1nspect0r_g4dget_098df0d0}
Client Side is Still Bad
I forgot my password again, but this time there doesn't seem to be a reset, can you help me? http://2018shell.picoctf.com:5399
After going to the website link, we again look at the source code. After navigating through, we can see the html file has source code
<html> <head> <title>Super Secure Log In</title> </head> <body bgcolor="#000000"> <!-- standard MD5 implementation --> <script type="text/javascript" src="md5.js"></script> <script type="text/javascript"> function verify() { checkpass = document.getElementById("pass").value; split = 4; if (checkpass.substring(split*7, split*8) == '}') { if (checkpass.substring(split*6, split*7) == '0594') { if (checkpass.substring(split*5, split*6) == 'd_04') { if (checkpass.substring(split*4, split*5) == 's_ba') { if (checkpass.substring(split*3, split*4) == 'nt_i') { if (checkpass.substring(split*2, split*3) == 'clie') { if (checkpass.substring(split, split*2) == 'CTF{') { if (checkpass.substring(0,split) == 'pico') { alert("You got the flag!") } } } } } } } } else { alert("Incorrect password"); } } </script> <div style="position:relative; padding:5px;top:50px; left:38%; width:350px; height:140px; background-color:red"> <div style="text-align:center"> <p>Welcome to the Secure Login Server.</p> <p>Please enter your credentials to proceed</p> <form action="index.html" method="post"> <input type="password" id="pass" size="8" /> <br/> <input type="submit" value="Log in" onclick="verify(); return false;" /> </form> </div> </div> </body> </html>
Just by visually inspecting the code, we can see the flag is in plain site.
Constructed together we get our flag: picoCTF{client_is-bad_040594}
Log on
I made a website so now you can log on to! I don't seem to have the admin password. See if you can't get to the flag. http://2018shell.picoctf.com:37861
After playing around with the website for a bit, we can see that the website allows logins as long as the username is not admin. We've learnt before that cookies are used to store information like log-ins... maybe we can use that to our advantage!
By navigating to the Application section, then down to the cookies we see:
As you can see, there’s a cookie called admin, and it is currently set to False. By changing it from False to True, and then refreshing the website we are able to fool the server and get the flag: picoCTF{l0g1ns_ar3nt_r34l_aaaaa17a}
Irish Name Repo
There is a website running at http://2018shell.picoctf.com:11899 (link [1] ). Do you think you can log us in? Try to see if you can login!
I first started off by poking around the website. Seems that there is a page which looks like a forum, and another which is a portal for logging in.
On the forum, we can see that there is an administrator account under the username ‘admin’. They also for some reason mention SQL...
So why don’t we try the basic SQL injection that we discussed early in the chapter.
Doing so brings us to the website with the flag: picoCTF{con4n_r34lly_1snt_1r1sh_9cbc118f}
Mr Robot:
Do you see the same things I see? The glimpses of the flag hidden away? http://2018shell.picoctf.com:40064
The website that this links to is very limited, and poking around the source code doesn’t help much either.
Noticing the name of the challenge, if we visit http://2018shell.picoctf.com:40064/robots.txt we get the following:
User-agent: * Disallow: /30de1.html
By then going to the /30del.html page we get our flag which was hidden away: picoCTF{th3_w0rld_1s_4_danger0us_pl4c3_3lli0t_30de1}
In order to better understand web exploitation as a concept, I need to first gain a better understanding of how networks are structured, and how information is sent over the internet.
You can read the notes I’ve compiled below:
How does the Internet work?
Modern life would be very different without computer networks. Computer networks are generally made up of multiple computers that are all connected together to share data and resources. The computer network that we all know is The Internet, which specifically connects computers that use the Internet Protocol or ‘IP’.
This is what a basic computer network looks like:
In our diagram, we have two things labelled “end system”, where one is the client and one is the server. These are all called ‘nodes’. The way that these nodes are connected, are through the lines made through the ISP (Internet Service Provider) and the Router. You can imagine the router as a traffic signaller. This router has only one job - it makes sure that a message sent from a given computer arrives at the right destination computer.
Website Basics:
Information on the Internet is divided into different areas by websites. Websites are referred to by a ‘domain name’ (like google.com, facebook.com), and each web page is referred to by its URL or Uniform Resource Locator. A website is a collection of web pages - so a website would be like a house and each webpage would be a room inside the house.
A URL can be broken down into different sections. Some of these sections are essential, and some others are only optional. Let’s go through each one, and discuss what each section does using the following example URL:
This is the http:// part. A protocol is basically a set method for sending data around a computer network. Usually for websites it is the HTTP protocol or its secured version, HTTPS.
Domain Name
Something that you should be familiar with, this domain name is a way for humans to easily remember websites that they want to visit, rather than remembering an IP address.
Port
It indicates the technical "gate" used to access the resources on the web server. It is usually omitted if the web server uses the standard ports of the HTTP protocol (80 for HTTP and 443 for HTTPS) to grant access to its resources. Otherwise it is mandatory.
Path to File
/path/to/myfile.html is the path to the resource on the Web server. In the early days of the Web, a path like this represented a physical file location on the Web server.
Parameters
?key1=value1&key2=value2 are extra parameters provided to the Web server. Those parameters are a list of key/value pairs separated with the & symbol.
The Web server can use those parameters to do extra stuff before returning the resource.
Each Web server has its own rules regarding parameters, and the only reliable way to know if a specific Web server is handling parameters is by asking the Web server owner.
Have a full read here
Different parts of a website and how to mess with it:
The building blocks of websites are HTML, CSS and Javascript which are all different programming languages with their own set of rules that you have to learn. If we think of a website like a fancy birthday cake then:
HTML is the base of the cake - it’s the main body and content of the website
CSS is the icing and decorations on top of the cake - it makes the cake look pretty and distinguishes the cake from other similar cakes
Javascript are the candles and sparklers - in terms of a website, javascript lets you make dynamic and interactive web pages
Like we said before, HTML is the base of your cake. HTML describes the structure of a Web page and consists of a series of elements which are represented by things called tags. HTML elements basically tell the browser how to display the content
HTML:
Tags look something like this:
<tagname>content goes here...</tagname>
There are some basic tags:
<!DOCTYPE html> declaration defines this document to be HTML5
<html> element is the root element of an HTML page
<head> element contains meta information about the document
<title> element specifies a title for the document
<body> element contains the visible page content
<h1> element defines a large heading
<p> element defines a paragraph
You can find the full HTML breakdown here
CSS:
For the sake of web-exploitation, you don’t need to know much about CSS. Here is a basic tutorial for those who want to learn how to make their websites look pretty!
Javascript:
One of the reasons why Javascript is used because it allows us to add interactivity between the user and the website. Javascript allows the user to interact with the website and have the website respond.
By right clicking on a website on Google Chrome or Firefox you can select the option “Inspect” to see the code that the website is running on your computer. It allows you to see the HTML and CSS that is running on the website and it will also let you see the Javascript scripts running on your computer. The best part is, that you can edit the HTML directly and see it affect the website, so it lets you modify the website as you desire. You can also select “Inspect Element” to see the code that is running in a specific part of a website.
What is HTTP?
It provides a standardised way for computers to communicate with each other over the internet. HTTP is a communication protocol, that is used to deliver data (HTML files, image files, query results, etc.) over the internet. HTTP dictates how data is sent between clients (you) and servers.
GET and POST requests:
GET is used to request data from a specified resource.
GET is one of the most common HTTP methods.
POST is used to send data to a server to create/update a resource.
Full link: https://www.w3schools.com/tags/ref_httpmethods.asp
Cookies:
HTTP cookies, also called web cookies or browser cookies are basically small bits of data that servers send to a user’s web browser. The browser can store it, and may also send the cookie back when it next requests information from the same server. Normally cookies are used to tell if two requests came from the same browser. For example, cookies can help users stay logged-in to websites. Cookies have three main purposes:
Session management - logins, shopping carts, game scores and any other information that the server should remember about the user
Personalisation - user preferences, themes and other settings
Tracking - recording and analysing user behaviour
How to perform a basic SQL injection:
SQL is a language that is used to basically fetch information from databases in websites. These databases can contain information like usernames and passwords for accounts for that website. If the code that is written isn’t secured, we can perform what’s called an SQL injection to gain access to data that we normally wouldn’t have access to.
<?php
$username = $_GET['username'];
$result = mysql_query("SELECT * FROM users WHERE username='$username'");
?>
If we look at the ‘$username’, this variable is where the username for a log in attempt would be stored. Normally the username would be something like, ‘user123’, but a malicious user might submit a different kind of data. For example, consider if the input was '?
The application would crash because the resulting SQL query is incorrect.
SELECT * FROM users WHERE username='''
Note the extra red quote at the end. Knowing that a single quote will cause an error, we can expand a little more on SQL Injection.
What if our input was ' OR 1=1?
SELECT * FROM users WHERE username='' OR 1=1
1 is indeed equal to 1, which equates to true in SQL. If we reinterpret this the SQL statement is really saying
SELECT * FROM users WHERE username='' OR true
This will return every row in the table because each row that exists must be true. Using this, we can easily gain access to information that we aren’t supposed to!
Below is what I’ve completed for the cryptography chapter which includes the research and write-ups which I blogged about earlier. Altogether this chapter was about 2.7k words (yikes)
What is cryptography?
Cryptography is the art of encrypting data. If you ever developed a secret code as a kid, so you and your friend could communicate without anyone else knowing what you’re saying, then you’ve already had experience with writing your own secret code!
Cryptography is done in many ways, with some of the most common being through the use of codes and ciphers. This guide will cover a few of the more basic ones, and provide pointers to more complex ciphers for those who are interested.
Why do we need cryptography?
If we didn’t encrypt any of our sensitive information or messages over the internet, then potential attackers could easily steal your private data or read confidential messages. This is why cryptography is so important - because it provides us with confidentiality.
Cryptography is already being used in many ways in your daily life - you just don’t see it happening. For example, one of the key aspects of cryptography is what is called a hash. These are used to authenticate log-ins like your passwords whenever you log in to an account.
Below are some of the main examples of how you can encrypt your data:
Ciphers
The basic concept of a cipher is you have a message, usually in plain english, that you want to make secret (called encrypting your message). This is called your ‘plaintext’. You then apply the rules of your chosen cipher to a plaintext, to get a secret message which is called your ‘ciphertext’.
Then, you send your secret message to your friend who also knows the rules of the cipher you chose to use. Using that knowledge, they then decrypt the ciphertext you gave them, to reveal the original message in plain english.
You can think about this like something that you might be more familiar with. If you know what pig latin is, for every word that you say take the first letter of the word and move it to the end of the word and add the sound “ay”.
So if I wanted to say “pig latin”, which is my plaintext, in pig latin I would use the above rule to transform “pig latin” into “igpay atinlay”, which is my ciphertext. For someone to understand my ciphertext, they would have to know the rules of pig latin in order to decrypt and find my original message.
In this section we’ll be covering some of the most common ciphers:
Caesar Cipher
A secret ‘key’ is chosen between the people who want to communicate secretly, which will be a number between 0 and 25. Then, each letter in the message is shifted forward or backward by that key to receive the encrypted message.
For example, “This is an example” with a forward shift key of 1 gives the encrypted message: “Uijt jt bo fybnqmf”
Although the message may seem very secret, in reality it’s actually very easy to break! All you have to do is just apply all possible 26 forward and backward shifts and only one key will likely give an answer which looks like plain english.
While this may take a lot of time for someone to do by hand, because of computers, this process can be done a lot faster.
You can find a tool to encrypt and decrypt your own messages using the Caesar cipher here. Simply change the message in the left box to what you want to make secret, and then use the + or - buttons to choose the ‘key’ for which to shift your message. You should find your secret encrypted message in the right box!
Substitution Cipher
Unlike a Caesar cipher, where you are shifting the whole message by a certain amount, in a Substitution Cipher you choose each different letter in your message, and shift that by a different amount.
Basically what this means is for each letter in the alphabet, you choose a different letter that you will replace it with when you encrypt your message. For example, you could choose to substitute the letter ‘a’ with the letter ‘p’ when performing your substitution cipher. You would then do this process for every letter in the alphabet until you get something like:
plain alphabet : abcdefghijklmnopqrstuvwxyz
cipher alphabet: phqgiumeaylnofdxjkrcvstzwb
An example encryption using the above key:
plaintext : defend the east wall of the castle
ciphertext: giuifg cei iprc tpnn du cei qprcni
You might think that this way of encrypting your messages is way better than the Caesar Cipher, because it would be much harder to figure out. After all, if an outside person was trying to decrypt your message, the would have to go through every possible substitution.
However, something that we don’t consider is that this cipher actually preserves letter frequency. In the english language, some letters appear in words more than others. However, when it comes to cracking substitution ciphers, what we can do is count through all the times we see a certain letter, and try and compare that to what we see in normal english.
Remember this little name: “etaoin shrdlu”. This tells you the most frequently occurring letters in the english language in descending order. So if you see a certain letter like ‘z’ appearing a lot more frequently than others, chances are it could be either an ‘e’ or a ‘t’.
Substitution ciphers also don’t do anything to hide the length of words in your message. So if you have a three-letter word like ‘zcy’ in your message, chances are it would be a word like ‘the’.
Using all the above, it actually becomes a lot easier than you think to decrypt a substitution cipher. You can have a try for yourself using this link.
Vignere Cipher
The Vignere cipher uses a special table and a key to generate the ciphertext.
In addition to the plaintext, the Vigenere cipher also requires a keyword, which is repeated so that the total length is equal to that of the plaintext. For example, suppose the plaintext is MICHIGAN TECHNOLOGICAL UNIVERSITY and the keyword is HOUGHTON. Then, the keyword must be repeated as follows:
MICHIGAN TECHNOLOGICAL UNIVERSITY
HOUGHTON HOUGHTONHOUGH TONHOUGNTO
We then remove all spaces and punctuation, and convert all letters to upper case, finally dividing the result into 5-letter blocks. As a result, the above plaintext and keyword become the following:
MICHI GANTE CHNOL OGICA LUNIV ERSIT Y
HOUGH TONHO UGHTO NHOUG HTONH OUGHT O
To encrypt, pick a letter in the plaintext and its corresponding letter in the keyword, use the keyword letter and the plaintext letter as the row index and column index, respectively, and the entry at the row-column intersection is the letter in the ciphertext. For example, the first letter in the plaintext is M and its corresponding keyword letter is H. This means that the row of H and the column of M are used, and the entry T at the intersection is the encrypted result.
Repeat this process to generate your ciphertext!
Caesar Cipher
If you want to have a further look into different ciphers, try these resources:
Affine Cipher
Wheel Cipher
Playfair Cipher
Hashing
To summarise what a hash is, it requires two things:
A hash function, which is any kind of mathematical function that takes input and produces some output
A message that is given as input to the hash function.
There are three main requirements of a good hash function:
It should be easy to calculate the hash value (output of hash function) given a message.
It should be very hard (ideally impossible) to calculate the original message given a hash value.
No two messages should have the same hash value.
Example of the hashing process:
In the above image, the ‘input’ is the message and ‘Digest’ is our hash.
Our ‘cryptographic hash function’ above could have been something as simple as f(x) = 10, where x is the message. It’s easy to calculate the hash value, which fits the first criteria, but it breaks the third criteria. This is because no matter what our message is, the hash will always be the same!
Also, something like f(x) = x, would not be a good cryptographic hash function. With this function It is easy to calculate the hash, and we also avoid collisions, meeting the first and third criteria. However using this function, our message is the exact same thing as our hash, which kind of defeats the purpose of using a hash in the first place!
What do we use hashes in?
As you will see below, hashes are used to store passwords. If we just stored the actual password itself in something like a database, if a hacker or an outside person were to gain access, the would be able to easily gain access to everyone’s accounts. We uses hashes as an extra layer of security.
Even if people see the hashes, the point is that it is a super long and tedious process to try and figure out a password from a hash. You need to know the hash used, and then match every single different input to your unique hash which would take an extremely long time - so much that even trying to get your password wouldn’t be worth the time.
Passwords
Have you ever thought about how the password you use to log in to your computer is stored? etc/passwd is a text file, which contains a list of the system’s accounts, giving for each account some useful information.
What is in a etc/passwd file?
Typical output would include a line like: root:x:0:0:root:/root:/bin/bash
Fields separated by columns in order are:
Username: root
Encrypted password: x
UID: 0
GID: 0
Comment: root
Home directory: /root
Shell: bin/bash
Encrypted password found in etc/shadow file
What is in a etc/shadow file?
Example output of shadow file: root:$6$IGI9prWh$ZHToiAnzeD1Swp.zQzJ/Gv.iViy39EmjVsg3nsZlfejvrAjhmp5jY.1N6aRbjFJVQX8hHmTh7Oly3NzogaH8c1:17770:0:99999:7:::
Fields separated by columns in order are:
Username: root
Encrypted password - Usually password format is set to $id$salt$hashed, The $id is the algorithm used On GNU/Linux as follows:
$1$ is MD5
$2a$ is Blowfish
$2y$ is Blowfish
$5$ is SHA-256
$6$ is SHA-512
So for the example above, we can see that the password is hashed using the SHA-512 algorithm.
You can have a further look into how passwords are stored here
The write ups for the cryptography CTF challenges I did here can be found below!
For this chapter and all future chapters, the challenges that I have chosen to complete should be digestible and easy to follow along for high school students who have done extremely basic coding. These challenges are more for the readers of the guide to see the application of the concepts that I explain!
Crypto warm-up 1
Crpyto can often be done by hand, here's a message you got from a friend, llkjmlmpadkkc with the key of thisisalilkey. Can you use this table to solve it?. Table can be found here:
Basically following the explanation above, if we view the horizontal alphabet as is, and the vertical alphabet as the “shift amount”, we can see that a letter shifted by another letter produces the encrypted text “llkjmlmpadkkc” with key “thisisalilkey”.
Essentially we're looking at each letter of the key, and finding the matching encrypted letter in the coloumn. We then look at the letter on the opposite axis which gives us the plaintext!!
For example, if we look down the 't' column, until we find 'l', the horizontal axis is the 's' row, which is the first letter of our plaintext. If we repeat this process for all of our letters we get the flag: picoCTF{secretmessage}
Crypto warm-up 2
Cryptography doesn't have to be complicated, have you ever heard of something called rot13? cvpbPGS{guvf_vf_pelcgb!}
ROT13 is basically a version of the Caesar Cipher that we've discussed above, however the 'key' or shift amount is set to 13. If we use an online tool such as this, we get the flag: picoCTF{this_is_crypto!}
Caesar Cipher
This is one of the older ciphers in the books, can you decrypt the message ? You can find the ciphertext in /problems/caesar-cipher-1_0_931ac10f43e4d2ee03d76f6914a07507 on the shell server.
Again, using another online tool, we can put in the cipher text and play around with the shift amount until we get legible English. It shouldn't take long before we figure out the appropriate shift amount for this cipher was 15.
This gets our flag: picoCTF{justagoodoldcaesarcipherobyujeez}
Hertz
Here's another simple cipher for you where we made a bunch of substitutions. Can you decrypt it? Connect with nc 2018shell.picoctf.com 48186.
Connecting to the server gives us our ciphertext:
------------------------------------------------------------------------------- qzruhbde kihi je yzwh agbu - ewxedjdwdjzr_qjckihe_bhi_ezgtbxgi_tvbeqhsjbl ------------------------------------------------------------------------------- edbdigy, cgwlc xwqf lwggjubr qbli ahzl dki edbjhkibv, xibhjru b xzsg za gbdkih zr skjqk b ljhhzh brv b hbozh gby qhzeeiv. b yiggzs vhieejruuzsr, wrujhvgiv, sbe ewedbjriv uirdgy xikjrv kjl zr dki ljgv lzhrjru bjh. ki kigv dki xzsg bgzad brv jrdzriv: -jrdhzjxz bv bgdbhi vij. kbgdiv, ki ciihiv vzsr dki vbhf sjrvjru edbjhe brv qbggiv zwd qzbheigy: -qzli wc, fjrqk! qzli wc, yzw aibhawg piewjd! ezgilrgy ki qbli azhsbhv brv lzwrdiv dki hzwrv uwrhied. ki abqiv bxzwd brv xgieeiv uhbtigy dkhjqi dki dzsih, dki ewhhzwrvjru gbrv brv dki bsbfjru lzwrdbjre. dkir, qbdqkjru ejukd za edickir vivbgwe, ki xird dzsbhve kjl brv lbvi hbcjv qhzeeie jr dki bjh, uwhugjru jr kje dkhzbd brv ekbfjru kje kibv. edickir vivbgwe, vjecgibeiv brv egiicy, gibriv kje bhle zr dki dzc za dki edbjhqbei brv gzzfiv qzgvgy bd dki ekbfjru uwhugjru abqi dkbd xgieeiv kjl, imwjri jr jde girudk, brv bd dki gjukd wrdzrewhiv kbjh, uhbjriv brv kwiv gjfi cbgi zbf. xwqf lwggjubr ciiciv br jredbrd wrvih dki ljhhzh brv dkir qztihiv dki xzsg elbhdgy. -xbqf dz xbhhbqfe! ki ebjv edihrgy. ki bvviv jr b chibqkihe dzri: -azh dkje, z vibhgy xigztiv, je dki uirwjri qkhjedjri: xzvy brv ezwg brv xgzzv brv zwre. egzs lwejq, cgibei. ekwd yzwh iyie, uirde. zri lzlird. b gjddgi dhzwxgi bxzwd dkzei skjdi qzhcweqgie. ejgirqi, bgg. ki ciihiv ejvisbye wc brv ubti b gzru egzs skjedgi za qbgg, dkir cbweiv bskjgi jr hbcd bddirdjzr, kje itir skjdi diidk ugjedirjru kihi brv dkihi sjdk uzgv czjrde. qkhyezedzlze. dsz edhzru ekhjgg skjedgie bresihiv dkhzwuk dki qbgl. -dkbrfe, zgv qkbc, ki qhjiv xhjefgy. dkbd sjgg vz rjqigy. esjdqk zaa dki qwhhird, sjgg yzw? ki efjcciv zaa dki uwrhied brv gzzfiv uhbtigy bd kje sbdqkih, ubdkihjru bxzwd kje giue dki gzzei azgve za kje uzsr. dki cgwlc ekbvzsiv abqi brv ewggir ztbg pzsg hiqbggiv b chigbdi, cbdhzr za bhde jr dki ljvvgi buie. b cgibebrd eljgi xhzfi mwjidgy ztih kje gjce.
We can observe that a lot of the text seems to follow normal sentence structure and word length, hence it's safe to assume that this ciphertext was encrypted using a substitution cipher!
Once again we can use an online tool to save us time.
Putting the ciphertext in and decoding it gets us our flag: picoCTF{substitution_ciphers_are_solvable_vdascrwiam}
Hereeeeeee's Johnny!
Okay, so we found some important looking files on a linux computer. Maybe they can be used to get a password to the process. Connect with nc 2018shell.picoctf.com 38860. Files can be found here:
To solve this challenge, we need to observe the hash of each password that the user might enter, and compare that to the hash stored in the shadow file. A tool we can use to do this (as comparing passwords would take a long... time) is called johntheripper, as alluded to in the title of this challenge.
Below is the cracking process on a mac:
❯ /usr/local/Cellar/john-jumbo/1.8.0/share/john/unshadow passwd shadow > crack.db ❯ john crack.db Warning: detected hash type "sha512crypt", but the string is also recognized as "sha512crypt-opencl" Use the "--format=sha512crypt-opencl" option to force loading these as that type instead Warning: hash encoding string length 98, type id $6 appears to be unsupported on this system; will not load such hashes. Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 64/64 OpenSSL]) Press 'q' or Ctrl-C to abort, almost any other key for status password1 (root) 1g 0:00:00:06 DONE 2/3 (2018-10-14 11:56) 0.1529g/s 361.6p/s 361.6c/s 361.6C/s password1 Use the "--show" option to display all of the cracked passwords reliably Session completed ❯ nc 2018shell.picoctf.com 38860 Username: root Password: password1 picoCTF{J0hn_1$_R1pp3d_1b25af80}
