You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: cyber-security-challenge-2015/digital-forensics/data-extraction/README.md
+103-1
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,109 @@
8
8
9
9
## Write-up
10
10
11
-
(TODO)
11
+
For once, it payed off if you were paying attention in your highschool biology classes. When you learned about the birds and the bees, you also learned about DNA and RNA. That's exactly what this is.
12
+
13
+
14
+
( Taken from http://www.sophia.org/tutorials/video-material-10-dna-rna )
15
+
16
+
So let's convert the image to the corresponding DNA (or RNA) characters:
If you look clearly, you can see the password, which is "METAPHYSIC LIGHTYEARS". This website also solved the final hurdle: You don't have to start decoding at the first character, but at the second.
Copy file name to clipboardexpand all lines: opentoall-ctf-2015/misc/android-oh-no/README.md
+27-9
Original file line number
Diff line number
Diff line change
@@ -4,10 +4,10 @@
4
4
**Points:** 150
5
5
**Solves:** 14
6
6
**Author:** Eriner
7
-
**Description:**
7
+
**Description:**
8
8
9
9
> It seems someone got a hold of my phone and deleted some important files, and now my phone won't boot! I had an important app on there, maybe you can get it working! Here is an image of my phone...
> Hint: I've encrypted my custom app so no one can find the secretz! Thankfully, I uninstalled it before someone hacked my phone! Trouble is, I can't install it on my new phone! Can you help?
@@ -18,28 +18,38 @@ This challenge revolves around finding an encrypted apk, and then decrypting it
18
18
The app found here is titled: `net.opentoall.flag.flag-1.apk`. This app is a red herring, and upon opening the app, it shows a picture of a red fish and says "I'm here to distract you".
19
19
This app was to be ignored, and had no useful information. It wasn't the encrypted app the challenge described.
20
20
<br>
21
-
<br>
22
21
In the user storage directory, `mnt/android-4.4-r2/data/media/0` the file
23
22
`encrypted.nothingtoseehere.apk` can be found.
24
-
25
23
<br>
24
+
25
+
A shortcut, in this case, would be to use `find` to remove the burden of manual search:
26
+
> ```
27
+
> shell@android ~/ # find mnt/ -type f -iname "*.apk"
There is also a book on the topic, but I cannot find it at the time of creating this writeup.
43
+
There are a few books about Android JB app encryption (i.e. "Android Security Internals") worth checking out.
34
44
35
45
<br>
36
-
There are also a few books that cover Android JB app encryption. The most important piece of information to glean from this page is:
46
+
The most important piece of information to glean from this page is:
37
47
<br>
38
48
39
49
> The --algo, --key and --iv parameters obviously have to do with encrypted apps, so before going into details lets first try to install an encrypted APK. Encrypting a file is quite easy to do using the enc OpenSSL commands, usually already installed on most Linux systems. We'll use AES in CBC mode with a 128 bit key (a not very secure one, as you can see below), and specify an initialization vector (IV) which is the same as the key to make things simpler:
Basically, this particular APK has been encrypted _manually_ and doesn't follow the twofish encryption Google Play uses when it encrypts the dmcrypt app-asec files. But you need a key! In the same blog post,
45
55
@@ -55,7 +65,15 @@ Basically, this particular APK has been encrypted _manually_ and doesn't follow
55
65
> 0000020
56
66
> ```
57
67
58
-
As it says, the original android app encryption/decryption process uses twofish, but there is more than one way to encrypt and install apps on android. The keyfile mentioned above is also the keyfile needed to solve this challenge. Using that file as a key, you are able to decrypt the encrypted apk with openssl and grep/install to get the flag.
68
+
As it says, the original android app encryption/decryption process uses twofish, but there is more than one way to encrypt and install apps on android. In this challenge, the encryption is done manually using openssl.
69
+
70
+
Using the keyfile mentioned above (without spaces), decrypt the `encrypted.nothingtoseehere.apk`:
Copy file name to clipboardexpand all lines: opentoall-ctf-2015/reverse/switchy/README.md
+41-41
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@
10
10
11
11
## Write-up
12
12
13
-
Opening the binary in IDA, we can see 3 particular parts in the `main` function:
13
+
Opening the binary in IDA, we can see 3 particular assembly parts in the `main` function:
14
14
15
15
* The red one which is the prologue. Basically it saves the frame pointer, changes the stack pointer and allocates some space for the function.
16
16
* The green one which is in fact doing the same thing as the blue part but in a different way.
@@ -22,18 +22,18 @@ Let’s focus on what the green block is doing. Here I highlighted the parts whi
22
22
23
23
24
24
25
-
While second and third ones are just saving values which are never reused, the first one is a lot more interesting since it moves to `ecx`some data which is then moved on the stack on the next instruction. We’ll come back in these data later.
25
+
While second and third ones are just saving values which are never reused, the first one is a lot more interesting since some data contained as an immediate double word moves to `ecx`register, which is then moved on the stack on the next instruction. We’ll come back to these data later.
26
26
27
-
We can see that a function, `sub_8048470` is then called and probably taking as argument the datas previously moved on the stack.
27
+
We can see that function, `sub_8048470`, is then called and probably takes the data previously moved onto the stack as argument.
28
28
29
-
The remaining instructions of the block is just printing the result of the previously called function as a character on stdout and then flush stdout. The blue block is as a result equivalent to the following C code.
29
+
The remaining instructions of the block (post-`lea`) just prints the result of the previously called function as a character on stdout and then flushes stdout. The blue block is as a result equivalent to the following C code.
30
30
31
-
```c
32
-
printf("%c", sub_8048470(dword_804B058));
33
-
fflush(stdout);
34
-
```
31
+
> ```
32
+
> printf("%c", sub_8048470(dword_804B058));
33
+
> fflush(stdout);
34
+
> ```
35
35
36
-
Now let's take a look at the **sub_8048470** function:
36
+
Now let's take a look at the `sub_8048470` function:
37
37
38
38
39
39
@@ -51,42 +51,42 @@ All the offsets in `off_8048F50` lead us to the same pattern:
51
51
52
52
53
53
54
-
This is basically xoring two values and returning the result. A quick look on the values in the different blocks shows us that only the first values are always ASCII values. By the way, these ASCII values are:
54
+
This is basically xoring two values and returning the result. A quick look on the values in the different blocks shows us that only the first value is always ASCII characters. By the way, these ASCII characters are:
55
55
56
-
```python
57
-
"o gpcuabefihjmlnstw{}"
58
-
```
56
+
> ```
57
+
> "o gpcuabefihjmlnstw{}"
58
+
> ```
59
59
60
60
Since we can make `flag{...}` with all these letters, let’s extract them in the same order the program does with a simple IDA Python script.
61
61
62
-
```python
63
-
from idaapi import get_byte, get_long
64
-
65
-
# Bytes offsets used as index in main function
66
-
b = [0x804B050, 0x804B058, 0x804B060, 0x804B068, 0x804B070, 0x804B078,
0 commit comments