hacktracking: cscamp

Showing posts with label cscamp. Show all posts

# CSCamp CTF Quals 2k13: Steganography - stega4.wav

# ./keygen 4 "{a..z}" | xargs -I {} steghide extract -sf stega4.wav -p {}
wrote extracted data to "flag.zip".
# fcrackzip -u -c aA1! -p aaaaa flag.zip
PASSWORD FOUND!!!!: pw == 3L33t
# unzip -P 3L33t flag.zip && cat flag.txt
Archive:  flag.zip
  inflating: flag.txt
The Flag is {a57085396f9200c6d38ff66ffa1d3c71}

# CSCamp CTF Quals 2k13: Reversing - Challenge (dotnet)

# file challenge.exe
challenge.exe: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Run challenge.exe:
. Username = Cookie
. Serial Number = Monsters
. Check
> Authentication failed!

Attach to the process using windbg:

> * Load SOS and symbols
> .loadby sos mscorwks; .symfix; .reload
> * Show all threads
> ~
   0  Id: 3180.39b0 Suspend: 1 Teb: 7ffdf000 Unfrozen
   1  Id: 3180.30a8 Suspend: 1 Teb: 7ffde000 Unfrozen
   2  Id: 3180.3ad8 Suspend: 1 Teb: 7ffdd000 Unfrozen
   3  Id: 3180.3a6c Suspend: 1 Teb: 7ffdc000 Unfrozen
.  4  Id: 3180.38e0 Suspend: 1 Teb: 7ffdb000 Unfrozen
> * Show all managed threads
> !threads
ThreadCount: 2
UnstartedThread: 0
BackgroundThread: 1
PendingThread: 0
DeadThread: 0
Hosted Runtime: no
                                      PreEmptive   GC Alloc           Lock
       ID OSID ThreadOBJ    State     GC       Context       Domain   Count APT Exception
   0    1 39b0 0015b1b8      6020 Enabled  00000000:00000000 001653f8     0 STA
   2    2 3ad8 0015ec68      b220 Enabled  00000000:00000000 001653f8     0 MTA (Finalizer)
> * Switch to thread 0 (new current thread)
> ~0s
eax=03370088 ebx=013d8740 ecx=00001f40 edx=001a2c58 esi=01400ed0 edi=014322f4
eip=7c91e514 esp=0012ed8c ebp=0012ee20 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
7c91e514 c3              ret
> * View the stack
> !clrstack
OS Thread Id: 0x39b0 (0)
ESP       EIP
0012ed98 7c91e514 [InlinedCallFrame: 0012ed98] System.Windows.Forms.UnsafeNativeMethods.WaitMessage()
0012ed94 7b1d8e78 System.Windows.Forms.Application+ComponentManager.System.Windows.Forms.UnsafeNativeMethods.IMsoComponentManager.FPushMessageLoop(Int32, Int32, Int32)
0012ee30 7b1d8967 System.Windows.Forms.Application+ThreadContext.RunMessageLoopInner(Int32, System.Windows.Forms.ApplicationContext)
0012ee84 7b1d87b1 System.Windows.Forms.Application+ThreadContext.RunMessageLoop(Int32, System.Windows.Forms.ApplicationContext)
0012eeb4 7b195921 System.Windows.Forms.Application.Run(System.Windows.Forms.Form)
0012eec8 00de5498 (System.Windows.Forms.Form)
0012eecc 00de1eee StarwareCTF_DotNetChall.Program.Main()
0012f148 79e71b4c [CustomGCFrame: 0012f148]
0012f110 79e71b4c [GCFrame: 0012f110]
0012f12c 79e71b4c [GCFrame: 0012f12c]
0012f310 79e71b4c [HelperMethodFrame_1OBJ: 0012f310] System.RuntimeMethodHandle._InvokeMethodFast(System.Object, System.Object[], System.SignatureStruct ByRef, System.Reflection.MethodAttributes, System.RuntimeTypeHandle)
0012f380 792d5608 System.RuntimeMethodHandle.InvokeMethodFast(System.Object, System.Object[], System.Signature, System.Reflection.MethodAttributes, System.RuntimeTypeHandle)
0012f3d0 792d540f System.Reflection.RuntimeMethodInfo.Invoke(System.Object, System.Reflection.BindingFlags, System.Reflection.Binder, System.Object[], System.Globalization.CultureInfo, Boolean)
0012f40c 792d529e System.Reflection.RuntimeMethodInfo.Invoke(System.Object, System.Reflection.BindingFlags, System.Reflection.Binder, System.Object[], System.Globalization.CultureInfo)
0012f42c 00de0294 CompressShell.Main(System.String[])
> * Show objects on the heap (MT = MethodTable)
> !dumpheap -type StarwareCTF_DotNetChall
 Address       MT     Size
013d7cf4 00a0732c      348
total 1 objects
Statistics:
      MT    Count    TotalSize Class Name
00a0732c        1          348 StarwareCTF_DotNetChall.MainForm
Total 1 objects
0012f688 79e71b4c [GCFrame: 0012f688]
> * Show what methods the object exposes
> !dumpmt -md 00a0732c
EEClass: 00df38d8
Module: 00a03d94
Name: StarwareCTF_DotNetChall.MainForm
mdToken: 02000009  (StarwareCTF_DotNetChall, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null)
BaseSize: 0x15c
ComponentSize: 0x0
Number of IFaces in IFaceMap: 15
Slots in VTable: 379
--------------------------------------
MethodDesc Table
   Entry MethodDesc      JIT Name
7b176338   7afe8338   PreJIT System.Windows.Forms.Form.ToString()
79286ac0   79104968   PreJIT System.Object.Equals(System.Object)
79286b30   79104998   PreJIT System.Object.GetHashCode()
7a575e40   7a460c00   PreJIT System.ComponentModel.Component.Finalize()
...
7b7220b0   7afe83e0   PreJIT System.Windows.Forms.Form.OnResizeEnd(System.EventArgs)
00a0c320   00a072a0      JIT StarwareCTF_DotNetChall.MainForm..ctor()
00a0c744   00a072ac      JIT StarwareCTF_DotNetChall.MainForm.checkButton_Click(System.Object, System.EventArgs)
00a0cc58   00a072b8      JIT StarwareCTF_DotNetChall.MainForm.ChangeAuthenticationMessage(System.String)
00a0d018   00a072c4      JIT StarwareCTF_DotNetChall.MainForm.ChangeAuthenticationMessageCallback(System.String)
00a0cc00   00a072d0     NONE StarwareCTF_DotNetChall.MainForm.OnAuthentication(StarwareCTF_DotNetChall.AuthenticationResult)
00a0c330   00a072e4      JIT StarwareCTF_DotNetChall.MainForm.InitializeComponent()
> * Method disassemble
> !U 00a072ac
Normal JIT generated code
StarwareCTF_DotNetChall.MainForm.checkButton_Click(System.Object, System.EventArgs)
Begin 00de54b0, size 12a
00de54b0 55              push    ebp
00de54b1 8bec            mov     ebp,esp
00de54b3 57              push    edi
00de54b4 56              push    esi
00de54b5 53              push    ebx
00de54b6 50              push    eax
00de54b7 8bf9            mov     edi,ecx
00de54b9 b98814bf00      mov     ecx,0BF1488h (MT: StarwareCTF_DotNetChall.KeyVerification)
00de54be e859cbc0ff      call    009f201c (JitHelp: CORINFO_HELP_NEWSFAST)
00de54c3 8bf0            mov     esi,eax
00de54c5 8bce            mov     ecx,esi
00de54c7 ff15c014bf00    call    dword ptr ds:[0BF14C0h] (StarwareCTF_DotNetChall.KeyVerification..ctor(), mdToken: 0600002b)
00de54cd 8b8f44010000    mov     ecx,dword ptr [edi+144h]
00de54d3 ff151815bf00    call    dword ptr ds:[0BF1518h] ((System.Object), mdToken: 060000e8)
00de54d9 8bd8            mov     ebx,eax
00de54db 8b8f48010000    mov     ecx,dword ptr [edi+148h]
00de54e1 ff151815bf00    call    dword ptr ds:[0BF1518h] ((System.Object), mdToken: 060000e8)
00de54e7 50              push    eax
00de54e8 8bd3            mov     edx,ebx
00de54ea 8bce            mov     ecx,esi
00de54ec ff156414bf00    call    dword ptr ds:[0BF1464h] (StarwareCTF_DotNetChall.KeyVerification.CheckKey(System.String, System.String), mdToken: 06000029)
...
> * Display one dword (4b)
> dd 0BF1464h L1
00bf1464  00de5960
> * Method disassemble
> !U 00de5960
Normal JIT generated code
StarwareCTF_DotNetChall.KeyVerification.CheckKey(System.String, System.String)
Begin 00de5960, size 39
>>> 00de5960 55              push    ebp
00de5961 8bec            mov     ebp,esp
00de5963 57              push    edi
00de5964 56              push    esi
00de5965 50              push    eax
00de5966 33c0            xor     eax,eax
00de5968 8945f4          mov     dword ptr [ebp-0Ch],eax
00de596b 8bf1            mov     esi,ecx
00de596d 8bfa            mov     edi,edx
00de596f 8b4d08          mov     ecx,dword ptr [ebp+8]
00de5972 ff15242bbf00    call    dword ptr ds:[0BF2B24h] ((System.Object), mdToken: 060000d8)
00de5978 8bc8            mov     ecx,eax
00de597a 8bd7            mov     edx,edi
00de597c 894df4          mov     dword ptr [ebp-0Ch],ecx
00de597f 8bce            mov     ecx,esi
00de5981 ff157014bf00    call    dword ptr ds:[0BF1470h] (StarwareCTF_DotNetChall.KeyVerification.GenerateKeyFromUsername(System.String), mdToken: 0600002a)
00de5987 8bd0            mov     edx,eax
00de5989 8b4df4          mov     ecx,dword ptr [ebp-0Ch]
00de598c ff15042cbf00    call    dword ptr ds:[0BF2C04h] ((System.String, System.String), mdToken: 060000dc)
00de5992 59              pop     ecx
00de5993 5e              pop     esi
00de5994 5f              pop     edi
00de5995 5d              pop     ebp
00de5996 c20400          ret     4
> * Set breakpoint at address
> bp 00de5987
> * Go
> g

. Username = Cookie
. Serial Number = Monsters
. Check

> * Display Unicode chars
> du eax+c
014d1b00  "0C81B9E71D6397203F2B7C73233FC5A4"
014d1b40  "D9C6450D8037BB12BE9415B950AC3E52"
014d1b80  "1EA1B1C42B4ACD482C83FFBBA8212BE2"
014d1bc0  "28A71FE544E463B59C344F1A41A55262"
> * Clear all breakpoints
> bc *
> * Go
> g

> Authentication failed!
. Username = Cookie
. Serial Number = 0C81B9E71D6397203F2B7C73233FC5A4D9C6450D8037BB12BE9415B950AC3E521EA1B1C42B4ACD482C83FFBBA8212BE228A71FE544E463B59C344F1A41A55262
. Check
> Authentication successful. Waiting for flag

Reference

http://blog.botbie.com/2013/11/21/cscamp-ctf-quals-2013-reversing-150-write-up/

# CSCamp CTF Quals 2k13: Steganography - PNG

# file enc.png
enc.png: data
# cat png.py 
#!/usr/bin/python

png = 0x89504e470d0a
enc = 0xf1601c2c3e73

key = str(hex(png^enc))[2:].decode("hex")
print key

encfd = open("enc.png","rb")
data = encfd.read()
encfd.close()
size = len(data)

decfd=open("dec.png","wb")
j = 0

for i in data:
    decfd.write(chr(ord(i)^ord(key[j%6])))
    j+=1

decfd.close()
# ./png.py
x0Rk3y
# file dec.png
dec.png: PNG image data, 640 x 400, 8-bit/color RGBA, non-interlaced

# CSCamp CTF Quals 2k13: Crypto - public is enough! (400 points)

# grep -v - public.pem | tr -d '\n' | base64 -d | openssl asn1parse -inform DER -i
    0:d=0  hl=2 l= 124 cons: SEQUENCE
    2:d=1  hl=2 l=  13 cons:  SEQUENCE
    4:d=2  hl=2 l=   9 prim:   OBJECT            :rsaEncryption
   15:d=2  hl=2 l=   0 prim:   NULL
   17:d=1  hl=2 l= 107 prim:  BIT STRING
# grep -v - public.pem | tr -d '\n' | base64 -d | openssl asn1parse -inform DER -i -strparse 17
    0:d=0  hl=2 l= 104 cons: SEQUENCE
    2:d=1  hl=2 l=  97 prim:  INTEGER           :CAD984557C97E039431A226AD727F0C6D43EF3D418469F1B375049B229843EE9F83B1F97738AC274F5F61F401F21F1913E4B64BB31B55A38D398C0DFED00B1392F0889711C44B359E7976C617FCC734F06E3E95C26476091B52F462E79413DB5
  101:d=1  hl=2 l=   3 prim:  INTEGER           :010001
# openssl rsa -pubin -inform PEM -text -noout < public.pem
Public-Key: (768 bit)
Modulus:
    00:ca:d9:84:55:7c:97:e0:39:43:1a:22:6a:d7:27:
    f0:c6:d4:3e:f3:d4:18:46:9f:1b:37:50:49:b2:29:
    84:3e:e9:f8:3b:1f:97:73:8a:c2:74:f5:f6:1f:40:
    1f:21:f1:91:3e:4b:64:bb:31:b5:5a:38:d3:98:c0:
    df:ed:00:b1:39:2f:08:89:71:1c:44:b3:59:e7:97:
    6c:61:7f:cc:73:4f:06:e3:e9:5c:26:47:60:91:b5:
    2f:46:2e:79:41:3d:b5
Exponent: 65537 (0x10001)
# # Find p and q using this URL http://www.factordb.com/index.php
n = 1230186684530117755130494958384962720772853569595334792197322452151726400507263657518745202199786469389956474942774063845925192557326303453731548268507917026122142913461670429214311602221240479274737794080665351419597459856902143413
p = 33478071698956898786044169848212690817704794983713768568912431388982883793878002287614711652531743087737814467999489
q = 36746043666799590428244633799627952632279158164343087642676032283815739666511279233373417143396810270092798736308917

# ipython
: import gmpy
: p = 33478071698956898786044169848212690817704794983713768568912431388982883793878002287614711652531743087737814467999489
: q = 36746043666799590428244633799627952632279158164343087642676032283815739666511279233373417143396810270092798736308917
: totien = (p-1) * (q-1)
: e = 65537
: d = hex(gmpy.invert(e,totien))
: d
'0x740de48760442835baad5e1990453a9d16db7976d3f8bb98bf99c0c01cbe9b9c12b808c80683d1e346c16c79ac162874f28ca610c1b97e5e1ffae95725ce0c6b031c3e188b17187a793b322cc4004c568e76c9b258542ea2a2d6ecd462fff401'

# cat rsatool.py
#!/usr/bin/python2
import base64, fractions, optparse, random
import gmpy

from pyasn1.codec.der import encoder
from pyasn1.type.univ import *

PEM_TEMPLATE = '-----BEGIN RSA PRIVATE KEY-----\n%s-----END RSA PRIVATE KEY-----\n'
DEFAULT_EXP = 65537

def factor_modulus(n, d, e):
    """
    Efficiently recover non-trivial factors of n

    See: Handbook of Applied Cryptography
    8.2.2 Security of RSA -> (i) Relation to factoring (p.287)

    http://www.cacr.math.uwaterloo.ca/hac/
    """
    t = (e * d - 1)
    s = 0

    while True:
        quotient, remainder = divmod(t, 2)

        if remainder != 0:
            break

        s += 1
        t = quotient

    found = False

    while not found:
        i = 1
        a = random.randint(1,n-1)

        while i <= s and not found:
            c1 = pow(a, pow(2, i-1, n) * t, n)
            c2 = pow(a, pow(2, i, n) * t, n)

            found = c1 != 1 and c1 != (-1 % n) and c2 == 1

            i += 1

    p = fractions.gcd(c1-1, n)
    q = (n / p)

    return p, q

class RSA:
    def __init__(self, p=None, q=None, n=None, d=None, e=DEFAULT_EXP):
        """
        Initialize RSA instance using primes (p, q)
        or modulus and private exponent (n, d)
        """

        self.e = e

        if p and q:
            assert gmpy.is_prime(p), 'p is not prime'
            assert gmpy.is_prime(q), 'q is not prime'

            self.p = p
            self.q = q
        elif n and d:   
            self.p, self.q = factor_modulus(n, d, e)
        else:
            raise ArgumentError('Either (p, q) or (n, d) must be provided')

        self._calc_values()

    def _calc_values(self):
        self.n = self.p * self.q

        phi = (self.p - 1) * (self.q - 1)
        self.d = gmpy.invert(self.e, phi)

        # CRT-RSA precomputation
        self.dP = self.d % (self.p - 1)
        self.dQ = self.d % (self.q - 1)
        self.qInv = gmpy.invert(self.q, self.p)

    def to_pem(self):
        """
        Return OpenSSL-compatible PEM encoded key
        """
        return PEM_TEMPLATE % base64.encodestring(self.to_der())

    def to_der(self):
        """
        Return parameters as OpenSSL compatible DER encoded key
        """
        seq = Sequence()

        for x in [0, self.n, self.e, self.d, self.p, self.q, self.dP, self.dQ, self.qInv]:
            seq.setComponentByPosition(len(seq), Integer(x))

        return encoder.encode(seq)

    def dump(self, verbose):
        vars = ['n', 'e', 'd', 'p', 'q']

        if verbose:
            vars += ['dP', 'dQ', 'qInv']

        for v in vars:
            self._dumpvar(v)

    def _dumpvar(self, var):
        val = getattr(self, var)

        parts = lambda s, l: '\n'.join([s[i:i+l] for i in xrange(0, len(s), l)])

        if len(str(val)) <= 40:
            print '%s = %d (%#x)\n' % (var, val, val)
        else:
            print '%s =' % var
            print parts('%x' % val, 80) + '\n'


if __name__ == '__main__':
    parser = optparse.OptionParser()

    parser.add_option('-p', dest='p', help='prime', type='int')
    parser.add_option('-q', dest='q', help='prime', type='int')
    parser.add_option('-n', dest='n', help='modulus', type='int')
    parser.add_option('-d', dest='d', help='private exponent', type='int')
    parser.add_option('-e', dest='e', help='public exponent (default: %d)' % DEFAULT_EXP, type='int', default=DEFAULT_EXP)
    parser.add_option('-o', dest='filename', help='output filname')
    parser.add_option('-f', dest='format', help='output format (DER, PEM) (default: PEM)', type='choice', choices=['DER', 'PEM'], default='PEM')
    parser.add_option('-v', dest='verbose', help='also display CRT-RSA representation', action='store_true', default=False)

    try:
        (options, args) = parser.parse_args()

        if options.p and options.q:
            print 'Using (p, q) to initialise RSA instance\n'
            rsa = RSA(p=options.p, q=options.q, e=options.e)
        elif options.n and options.d:
            print 'Using (n, d) to initialise RSA instance\n'
            rsa = RSA(n=options.n, d=options.d, e=options.e)
        else:
            parser.print_help()
            parser.error('Either (p, q) or (n, d) needs to be specified')

        rsa.dump(options.verbose)

        if options.filename:
            print 'Saving %s as %s' % (options.format, options.filename)


            if options.format == 'PEM':
                data = rsa.to_pem()
            elif options.format == 'DER':
                data = rsa.to_der()

            fp = open(options.filename, 'wb')
            fp.write(data)
            fp.close()

    except optparse.OptionValueError, e:
        parser.print_help()
        parser.error(e.msg)
# ./rsatool.py -p 33478071698956898786044169848212690817704794983713768568912431388982883793878002287614711652531743087737814467999489 -q 36746043666799590428244633799627952632279158164343087642676032283815739666511279233373417143396810270092798736308917 -n 1230186684530117755130494958384962720772853569595334792197322452151726400507263657518745202199786469389956474942774063845925192557326303453731548268507917026122142913461670429214311602221240479274737794080665351419597459856902143413 -e 65537
Using (p, q) to initialise RSA instance

n =
cad984557c97e039431a226ad727f0c6d43ef3d418469f1b375049b229843ee9f83b1f97738ac274
f5f61f401f21f1913e4b64bb31b55a38d398c0dfed00b1392f0889711c44b359e7976c617fcc734f
06e3e95c26476091b52f462e79413db5

e = 65537 (0x10001)

d =
740de48760442835baad5e1990453a9d16db7976d3f8bb98bf99c0c01cbe9b9c12b808c80683d1e3
46c16c79ac162874f28ca610c1b97e5e1ffae95725ce0c6b031c3e188b17187a793b322cc4004c56
8e76c9b258542ea2a2d6ecd462fff401

p =
d982ec7b440e2869d2535e51f91bacc3eb6eba042e106e6f875c3d17e53db65fffd6e4e9a36084ce
60f83d754dd7f701

q =
eebe6dd23ce7e99c0e2249fecc4418c34af74e418bfa714c3791828414ab18f32fd7e093062a49b0
30225cc845f99ab5

# ipython
: from Crypto.PublicKey import RSA
: keypair = RSA.generate(1024)
: keypair.n = 1230186684530117755130494958384962720772853569595334792197322452151726400507263657518745202199786469389956474942774063845925192557326303453731548268507917026122142913461670429214311602221240479274737794080665351419597459856902143413
: keypair.e = 65537
: keypair.d = 703813872109751212728960868893055483396831478279095442779477323396386489876250832944220079595968592852532432488202250497425262918616760886811596907743384527001944888359578241816763079495533278518938372814827410628647251148091159553
: keypair.p = 33478071698956898786044169848212690817704794983713768568912431388982883793878002287614711652531743087737814467999489
: keypair.q = 36746043666799590428244633799627952632279158164343087642676032283815739666511279233373417143396810270092798736308917
: private = open('private.pem','w')
: private.write(keypair.exportKey())
: private.close()
: exit
# openssl rsautl -decrypt -in message.enc -out /dev/tty -inkey private.pem
F4ct0r!zaTi0N

# cat RSAcrack.py
#!/usr/bin/python

from sys import*
from string import*

a = argv
[s,p,q] = filter(lambda x:x[:1]!= '-',a)
print "s = " + str(s)
print "p = " + str(p)
print "q = " + str(q)
d='-d' in a
print "d = " + str(d)
e, n = atol(p,16), atol(q,16)
print "e = " + str(e)
print "n = " + str(n)
l = (len(q) + 1) / 2
print "l = " + str(l)
o, inb = l-d, l-1+d
print "o = " + str(o)
print "inb = " + str(inb)
while s:
 s = stdin.read(inb)
 s and map(stdout.write, map(lambda i, b=pow(reduce(lambda x,y : (x<<8L)+y, map(ord,s)), e, n) : chr(b>>8*i&255), range(o-1, -1, -1)))
# cat message.enc | ./RSAcrack.py -d 740de48760442835baad5e1990453a9d16db7976d3f8bb98bf99c0c01cbe9b9c12b808c80683d1e346c16c79ac162874f28ca610c1b97e5e1ffae95725ce0c6b031c3e188b17187a793b322cc4004c568e76c9b258542ea2a2d6ecd462fff401 cad984557c97e039431a226ad727f0c6d43ef3d418469f1b375049b229843ee9f83b1f97738ac274f5f61f401f21f1913e4b64bb31b55a38d398c0dfed00b1392f0889711c44b359e7976c617fcc734f06e3e95c26476091b52f462e79413db5 | strings
F4ct0r!zaTi0N

# CSCamp CTF Quals 2k13: Steganography - Stego 3

Sam says "I love you, no really."
Mike says "Hot steamy grits!"
Mike says "Hot steamy grits!"
Mike says "No."
Sam says "Get off my colon"
Harold says "Who said OJ?"
Sam says "Who said OJ?"
JYA says "Jason paid me for it."
Harold says "Jason paid me for it."
Kenny says "Jason paid me for it."
Jason says "But I read slash-dot"
Phil says "Well smother me in curry sauce and lick me."
Adam says "Did he mean to die just then?"
Phil says "Mike - you ladyboy!"
Mike says "I said, you've got beautiful eyes."
Andy says "Mine's a pint"
Adam says "I'm so excited"
Adam says "I said, you've got beautiful eyes."
Adam says "So avoid that then!"
Harold says "Did he mean to die just then?"
JYA says "But I read slash-dot"
Phil says "Show me the fish!"
Sam says "Okay, now think of a funny line"
Mike says "Well smother me in curry sauce and lick me."
Adam says "Who said OJ?"
Mike says "Mike - you ladyboy!"
JYA says "Okay, now think of a funny line"
Adam says "Jason paid me for it."
Sam says "I never talk politics."
Mike says "Mmmm ... "
Harold says "Okay, now think of a funny line"
Mike says "Mine's a pint"
JYA says "Mike - you ladyboy!"
Kenny says "Who said OJ?"
Andy says "Alive"
Jason says "I'm so excited"
Kenny says "No."
Kenny says "No."
Andy says "I'd say Thursday"
JYA says "I'll be your private dancer, a dancer for money, I'll do what you want me to do."
Mr Hanky says "Mine's a pint"
JYA says "What does MPEG mean?"
Andy says "Has anyone noticed the plot is straying from ... well reason, really... "
JYA says "Mike - you ladyboy!"
Mike says "Mike - you ladyboy!"
Mike says "I said, you've got beautiful eyes."
Jason says "Has anyone noticed the plot is straying from ... well reason, really... "
Mr Hanky says "What does MPEG mean?"
Sam says "I'll be your private dancer, a dancer for money, I'll do what you want me to do."
Harold says "Who said OJ?"
Mike says "I'd say Thursday"
Sam says "So avoid that then!"
Harold says "What does MPEG mean?"
Mike says "Hot steamy grits!"
Kenny says "Did he mean to die just then?"
Kenny says "Well smother me in curry sauce and lick me."
Harold says "Did he mean to die just then?"
Adam says "But I read slash-dot"
Phil says "So avoid that then!"
Sam says "Mine's a pint"
Andy says "So avoid that then!"
end of scene

# wget --quiet http://web.archive.org/web/20100826055053/http://www.scramdisk.clara.net/play/playmaker.zip
# # Use playmaker to get the URL
# wget --quiet http://www.mediafire.com/download/5fppbkaujddijuk/bruteme.rar
# while read line; do result=`unrar x bruteme.rar -p$line 2> /dev/null | grep OK`; if [ "$result" != "" ]; then echo "Password = '$line'"; break; fi; done < dic.txt && cat Flag.txt
Password = 'asap'
The Flag is {fb7df6e9ea6a5eb47263734fc158aceb}

# CSCamp CTF Quals 2k13: Forensics - Forensics 1 (200 points)

# cat dataNov-8-2013.sql
DROP TABLE `myTable`;

CREATE TABLE `myTable` (
  `id` mediumint(8) unsigned NOT NULL auto_increment,
  `name` varchar(255) default NULL,
  `password` varchar(255),
  `permission` mediumint default NULL,
  `score` varchar(100) default NULL,
  PRIMARY KEY (`id`)
) AUTO_INCREMENT=1;

INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Riley Holman","4BA964803B710605F6F7BBFF2CE81BF6",421,"77.88");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Maxine Austin","DE8E13534B39BA8354247F3F1EF85A82",428,"19.88");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Aretha Ball","A46E8222DCB12F466396586DD05F9604",436,"71.37");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Iliana Combs","4956611731BA8F4F4C52A67A0EA4917D",433,"18.58");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Sacha Evans","1F69275D041F9E5C8B43C2D0CF8A95FB",415,"23.13");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Gabriel Floyd","7DA5DF7C8615FD929CFA8F339924E896",416,"15.65");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Cole Pierce","223FB9108E9A85A2E9622F57DD0324F5",421,"70.29");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Carolyn Evans","2B5234CEC28F0253448C25D6816D782A",414,"90.68");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Jelani Rodgers","8B867BE7B0CF51723DFA50038852DDF5",428,"83.10");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Josephine Ratliff","02A7EB4D15539223833CBB2E9FDE85A9",426,"3.45");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Ginger Brooks","71653BA64D976CA38656F54EE9981F99",401,"53.71");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Yuri Suarez","3B8AF637C01F98508A479E010FA90A73",418,"18.35");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Ainsley Stone","562C32E3C78C0317CF7D0789731A918F",425,"35.04");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Molly Powell","BDAE91761A79770577E1F129B32ABD67",436,"32.12");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Alyssa Gregory","52CB473DFBE43624547FFB29700EB040",410,"22.62");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("August Rodgers","78057B4CFAE303BF262CD2CCDD0E01A8",433,"0.75");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Neville Todd","272E6DDAD05D3BFF92C5FA6EB7932424",436,"23.56");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Evan Cohen","120C001D3DD3700C0A2E5A79CBB07039",410,"59.59");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Deborah Garner","346184FCBFC7F7ADD557113284517A7A",447,"99.64");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Steel Richmond","72B3DA05A80855DD6F0874E9C8077E3E",402,"78.22");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Vielka Chambers","E9334B3C18AEF9F8136A0FB76AA5B989",412,"32.31");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Oleg Sherman","871589F79961AA75A701EBC466C0A8E2",448,"15.53");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Wyatt Humphrey","796E2F53AFBF930B1B762D237A1AA112",433,"65.41");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Kay Benson","D86025C1F02A1E270FA47552F6311B2E",413,"77.40");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Lacy West","6EC8DCB8E9A69A0E26446B78C3AA73AE",408,"29.38");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Hiram Hurst","02280B275C73EE7342ACFE7A6B44DBCE",444,"81.44");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Thaddeus Higgins","F996F6E35CA80D3DD14770CBE77C6635",401,"39.35");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Randall Pearson","F29286D07B348490C9D87503B66063C6",420,"72.95");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Grace Mckenzie","EB7F2337B70C4AAC1FC5B2CC9F805D94",431,"29.35");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Aurora Davis","C4640E4D2E7E07B52D1E7167641BE2EB",422,"12.14");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Geraldine Watts","743462B522085EA36BAD2EEDD1C8827F",421,"38.31");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Norman Durham","DEF31249723B8F56245F16C9FF1F5C33",435,"63.53");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Colorado Hess","C6A5DD9969ECB22B498E87F8DCB07F73",417,"37.14");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Cade Mcintyre","3F3C6CA38D531EBF73FF0BB13B870A03",434,"71.96");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Dillon Yang","10A498AC98890B90B5CD8750700BB5BC",419,"89.23");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Haley Branch","FEBB74414FA5BF1888E80F9BAE774D93",435,"51.42");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Finn Woods","2934E3E3EE577D5FD5890708BD1F86FB",400,"47.24");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Craig York","E6E25D7D443428CC84C00A1F28FE83E7",432,"73.24");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Rudyard Mejia","FA1DF603880504104B24EA3C37AA1741",408,"90.53");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Grace Todd","1CE546597AB7E7A254628DC2F4707DE9",429,"12.74");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Sasha Velez","E448BE33DADF0262A4FD3453B225BF49",413,"47.03");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Kieran Bryant","F753400403B3EF3C37173399F9D9E6BD",443,"45.67");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Alfreda Beach","20161525318F501C456D40AEE19CE9D0",433,"62.25");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Vernon Joyce","C4917BA71B8EFE4D358149A074D8EC0B",402,"65.50");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Maryam Sandoval","867F728527AFAF7B30648A219F150C28",407,"57.94");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Lila Lindsey","AC1FE8AD294ED542DF4E930E4C0CEA58",419,"42.03");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Ifeoma Larsen","4F211C6FAB4C9417D58B94C626BBC231",403,"80.25");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Hermione Craig","2292D579EBA69FE5821E58A15C56DBA0",446,"8.18");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("David Crane","B9A586FFFFD480676E183EDAB94C78F3",406,"91.12");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Mercedes Lott","A089077408B7E996D7483DC055097A21",437,"18.61");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Melodie Patton","C2212ACA95303B5BE38E9DE249455F11",406,"52.03");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Denise Cardenas","4FEF84297DF3C2BBB89EC332824948B9",423,"63.72");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Martha Livingston","0EB9689A5B506DA5AD8D5B1FF9B90521",413,"88.61");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Sarah Owen","B645BFAB686B33309F28FC38D9AED798",445,"73.31");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Selma Simon","9C8530BE4F25827013490D4EAB83A503",408,"75.45");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Kylan Mcfadden","5954E473C9BDBE24FF8EA46DECE2F7C5",403,"13.68");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Avram Miranda","F5132BE06D2BC14BC8297E7ADF6307DF",442,"8.17");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Wanda Chambers","FB002E2DA3160A89271C50380A508428",400,"12.05");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Courtney Le","21AFCE12ECB8E29B8AE0B96B2BDAB12D",410,"83.37");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Shay Short","FCF2ABE3A0D5974A2E1D0CBA8DD60B30",424,"63.03");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Chanda Clarke","2E05813EBA25D06B137CC4A25565D980",423,"29.56");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Leroy Haney","FB9D640C103D264E2985EDB4B4DBC61C",406,"7.14");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Nadine Michael","8FA40B7DDE2B1C36B12FD7D834A065AF",415,"41.12");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Drew Donaldson","5FB3DA68B2C2DE5DBDA41EF155B4AF7F",449,"15.88");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Daniel Crane","CE95AB2D9026CF010F1146D80C00C438",408,"67.83");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Ross Stuart","C80920C8DC9EC9FED6B668764BADE7BB",401,"78.26");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Octavius Gamble","2C1B9D48AD88BE425C9C146E3E9EE531",405,"43.60");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Fredericka Rice","B303DEC6AAAC075C8A37D21C06F185E3",426,"71.67");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Vance Huff","5D3C7E74FFAB75FF210F27F4F422C1A2",446,"45.38");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Shaine Ward","6C6AB557DA6CD8DCA4BF3016C20F0EE7",432,"69.75");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Ezekiel Bush","5A7C8125EB2A6665A66038129F00952E",401,"3.46");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Lewis Nguyen","8ADD9803F69410A13335C26CCCFAD855",410,"31.50");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Catherine Daniel","CB30AAAEBA9DDC0383A5F74A4DFA02DD",443,"16.57");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Barry Shepherd","8B7772040D5358EB85F2AD14D32B1389",449,"82.82");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Adrienne Benton","621B2E06494F1AF44C58A9A5BEE5EE64",403,"50.67");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Jillian Alston","3609AAEAC8A0C7652008BE60C5616E1A",415,"52.98");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Chanda Dickson","FD2A9A4A7C0CE0C6CADC723991B36E76",437,"56.76");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Lara Benson","535FA2060136DE4A56DFFFB369AD53EA",422,"0.21");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Deborah Moreno","16A86BBD8913F80F80AB7354982306D1",440,"70.72");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Keaton Navarro","3360C02FFA0F219D8C3D5C09C67E3087",413,"97.27");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Wanda Justice","0F90F41E6374B479A49400BE4B7B0630",419,"5.66");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Sacha Briggs","513386AC2F4B995D9598A5055686C582",423,"33.26");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Nevada Gordon","F10C3F1F9A46490C35D9B3210893F58F",420,"28.47");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Leilani Rivas","A9E928D9D79ABF74AB6CCF6FEB8E21AC",434,"98.00");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Kylie Green","D136FAF95F0AAB1770E7F9FDC189B1E8",411,"10.19");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Brian Welch","2CFC1ECC98D00DE7D87B484E46CD9ECC",435,"11.88");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Orson Livingston","DA593D64D4251BCC040E86B50A1C5D52",426,"3.11");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Mikayla Ratliff","C820573A8E75FB5D3C99D3BA99FB1A7D",408,"38.26");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Mechelle Stout","8113A0AFF55D9262FAD9378E8365514E",409,"49.53");
INSERT INTO `myTable` (`name`,`password`,`permission`,`score`) VALUES ("Gay Buck","D5CC5123B49E33CC7356B8C1EE5D1AEE",402,"77.25");

# names=$(while read line; do hex=`echo "$line" | xxd -p | tr -d '\n'`; if [ "`echo $hex | grep 0d`" != "" ]; then echo "`grep -A 1 "$line" dataNov-8-2013.sql | tail -n 1 | awk -F '"' '{print $2}'`"; fi; done < dataNov-8-2013.sql | tr '\n' ',')
# echo -n ${names:0:-1} | md5sum
71284b9edd33e4141952b325a9c6acda

# CSCamp CTF Quals 2k13: Web - Robots

# cat robots
#!/bin/bash

name=`curl --silent --cookie-jar botmania --cookie botmania 'http://176.9.193.6/challenges_x/final/wbb_x2/' | grep 'text" name' | awk -F '"' '{print $4}'`
solution=`grep challenge botmania | awk '{print $NF}' | tr '+' ' ' | sed -e 's/%2A/*/' -e 's/%2B/+/' -e 's/%2D/-/' -e 's/%2F/\//' | bc -l`
#--proxy 127.0.0.1:8080
curl --silent --cookie-jar botmania --cookie botmania --request POST --data "$name=$solution&submit=Login" 'http://176.9.193.6/challenges_x/final/wbb_x2/'

# CSCamp CTF Quals 2k13: Crypto - Predictor

can you predict the next number in the sequence?

[51751041,236753494,190402293,48644501,297659248,230684862,7697029,173742959,126005793]

The code used to create those numbers is

import random
i = 295075153L
x = random.randint(0, i)
y = random.randint(0, i)
for j in range (1,10):
x = (2*x + 5) % i
y = (3*y + 7) % i
print (x^y)

The flag will be the next number in the sequence

# cat predictor.py
#!/usr/bin/python

import random 

i = 295075153

def sequence(x,y):
 for j in range (1,11):
  x = (2*x + 5) % i
  y = (3*y + 7) % i
  print (x^y)

y = 0
while True:
 y1 = (3*y + 7) % i
 x1 = y1^51751041
 x2 = (2*x1 + 5) % i
 y2 = (3*y1 + 7) % i
 if x2^y2 == 236753494:
  print "y = " + str(y)
  x = 0
  '''
  while True:
   if x1 == (2*x + 5) % i:
    print "x = " + str(x)
    sequence(x,y)
    exit()
   x += 1
  '''
  x = (i + x1 - 5) / 2
  print "x = " + str(x)
  sequence(x,y)
  exit()
 y += 1
# ./predictor.py
y = 173565935
x = 268355495
51751041
236753494
190402293
48644501
297659248
230684862
7697029
173742959
126005793
103605566