I luvz hacking challenges sites - do you?

Transcription

1 I luvz hacking challenges sites - do you? Yaniv Miron aka Lament HackFest 2014 CANADA

2 / About me Yaniv Miron aka Lament Security Researcher and Consultant Certified Locksmith & CISO Certified Found IBM, Oracle, Microsoft, Apache, Facebook (F-U for not giving me credit & bounty) and more.

3 Some of them are Stego, Logic and Reversing. / What s going on here? There are many CTF games and these hacking challenges are kind of online Capture The Flag. I would like to share my experience with demoing some examples of these online hacking challenges.

4 Hacking challenges sites? There are different sites that offer challenges, some of them actually grade and rank the users and some just let the users download challenges and try them offline.

5 HackThisSite.Org One of the largest sites in this area Different cool challenges in there

6 Other sites Many more

7 The Ranks Different levels gives different ranks

8 The Different Challenges

9 Because it s a small % out of the real challenges and you need to learn somehow. Why the h311 are you giving solutions? Unfortunately most of them are somewhere online. Unfortunately people just copy the solutions from others and paste the answer.

10 Solutions There are different ways to solve different tasks, it could be that there are easier ways than what I m showing here but this is the path that I took. I m trying to show how to think rather than just show the quick way to get a solution. Sometimes it makes the solution more complicated.

11 DEMO Time!

12 Stego5.bmp #1 Hack The Planet stego5.bmp

13 Stego5.bmp #2 First thing first, is it really a BMP file?

14 Looks like it: Stego5.bmp #3

15 Stego5.bmp #4 So what s next? I think I saw something similar in the past Maybe as a user avatar? Let s save it avatar.jpg

16 Stego5.bmp #5 We have a problem You can t really compare BMP (The original) and JPG (the Avatar) Or can we?

17 Stego5.bmp #6 Let s just turn the JPG to BMP

18 Stego5.bmp #7 Now let s try to compare them with some hex

19 Stego5.bmp #8

20 Stego5.bmp #9 LSB? It s widely used in Stego

21 Stego5.bmp #10 We will take the stego5.bmp hex, turn it into binary.

22 Stego5.bmp #11 Lets write a python script cuz we re kewl

23 Stego5.bmp #12 And back to ascii Looks interesting syn-ack-? maybe it s

24 Logic.Binary #1 Q1: Binary:

25 Logic.Binary #2 Binary are 1 s and 0 s isn t it? Clean the 2 s and the 3 s Binary:

26 Logic.Binary #3 Put it nicely Binary:

27 Logic.Binary #4 Binary -> ASCII Answer is: i win

28 Logic.Riddle #1 Q2: I call, but I never talk. I knock, but I never enter. I feel a bit insecure.

29 Logic.Riddle #2 Port scanner knocks but never enter, calling the ports but never talks with them. Insecure? A2: nmap

30 Logic.URL #1 Q3: Sometimes when you are coding a web based program you make a mistake with URL's. Correct this link. The link we get is: ks

31 Logic.URL #2 A3: It looks like a Google link, as this is the format Google is using. Let s change it to: cks

32 Logic.URL #3

33 Q4: Logic.Num #1

34 Logic.Num #2 1 of 2 = 12 1 of 1 and 1 of 2 = of 1 and 1 of 2 = of 3, 2 of 1 and 1 of 2 = of 1, 1 of 3, 1 of 2, 2 of 1 and 1 of 2 = of 1, 1 of 3, 1 of 1, 2 of 2, 2 of 1 and 1 of 2 = A4:

35 Reversing.app7 #1 We get a file called app7win.zip with 2 files inside: app7win.exe encrypted.enc Let s try to run it

36 Reversing.app7 #2 So it seems that we need to find a password here Let s try to remove the encrypted.enc file from the folder, maybe it will help:

37 Reversing.app7 #3 Let s see what s inside this encrypted.enc file Doesn t look promising (at least at the moment)

38 Reversing.app7 #4 Let s see it with OllyDbg

39 Reversing.app7 #5 jnz->jz? YEAH! We got junk

40 Reversing.app7 #6 Oh well It didn t worked Off we go to IDA Pro

41 Reversing.app7 #7 So we need to get 0DCAh

42 Reversing.app7 #8 Oh no it s not gonna be that easy dude

43 Reversing.app7 #9 This is the interesting part which handles our buffer and the.enc file

44 Reversing.app7 #10 The general thing that is happening in this block is that it runs 5 times and every time reads a character from the.enc file. The characters that were read (in hex) are "31,4D,39,35,33" or in ascii "1M953". This is not the password but it will help us get the password (this is the key from the.enc file)

45 Reversing.app7 #11

46 Reversing.app7 #12 Next, the app takes the user input + [ENTER=A] So if our input is A it will be 41+A=4B, if it s AA it will be A=8C Then place it in var_1c and xor it with each of the 5 chars.

47 Reversing.app7 #13

48 Reversing.app7 #14 Adds all of them and place the result in var_18 which needs to be cmp with "0DCAh" (3530). So 31xor8C+4Dxor8C+39xor8C+35xor8C+33 xor8c =3AB Is it true??? Nop

49 Reversing.app7 #15

50 Reversing.app7 #16 So to solve this problem we need to have: 31xorX+4DxorX+39xorX+35xorX+33xorX= 0DCA So what is X???

51 Reversing.app7 #17 To solve it we can just brute force it. So we will try first "A" as input, then "AA" then "AAA" until we will get the right result. At the end the result was that as long as our input equal 753 (2F1) it would solve the problem. Therefore it doesn't really matter what is the input as long as it's 753 together.

52 Reversing.app7 #18 I have used: ccccccc2 We need to remember that at the end of our input there is "enter" which is 10 so our total should be actually 743. c(99)+ c(99)+ c(99)+ c(99)+ c(99)+ c(99)+ c(99)+ 2(50)+ENTER(10)=753. So: 31xor2F1+4Dxor2F1+39xor2F1+35xor2F1 +33xor2F1=0DCA

53 Reversing.app7 #19

54 Reversing.app7 #20 Game over!

55 Reversing.app13 #1 Let s run it

56 Reversing.app13 #2

57 Reversing.app13 #3 So let s skip IDA & Olly and check the hints

58 Reversing.app13 #4 We can monitor the time that takes the app to check every number that we enter Python script that gets and monitor how much time takes the app to check it Slowest number is the right one (?) Close even explorer.exe because it takes CPU power and could change our results

59 Reversing.app13 #5 So let s do a quick & dirty BF to this app

60 Reversing.app13 #6 And run it

61 Reversing.app13 #7

62 Reversing.app13 #8 Let s just to it 3 more times, every time adding the last value instead of the dummy one that we had

63 Reversing.app13 #9 Our monitoring worked!

64 Forensics.1 #1 We get this: And a file: image.tar.gz

65 Forensics.1 #2

66 Forensics.1 #3 So we need to find a password First thing first, extract the file. We get a dd file - image.dd Let s check what s in there real quick

67 Forensics.1 #4 Looks like we got an NTFS windows system

68 Forensics.1 #5

69 So it s mounted Forensics.1 #6

70 Forensics.1 #7 3 empty folders

71 Forensics.1 #8 Well it s a forensics challenge So probably we need to recover some deleted data. Let s try to see what kind of deleted files are there.

72 Forensics.1 #9

73 Forensics.1 #10 We ve got 17 files, different types.

74 Forensics.1 #11 Oh boy well let s check the other files We ve got a media file: Voic 1.wav When played we can hear the Tech Support guy telling stacy that the password is her phone number. And what is her phone number?

75 Forensics.1 #12 Let s dig some more, we can see that there is a file called Termination - Allen Smith.docx

76 Forensics.1 #13 Using the phone number we can extract the content of Your new password is.rar Inside there is a file called Your new password is.docx Inside we got our password

77 Forensics.1 #14 We ve saved the world again!

78 To Wrap It Up Hacking challenges sites are KEWL It helps you practice your skills & prepare for CTF games You have a community to support you while trying

79 # E [0] F # Q? the lounge now or) >> lament [AT] ilhack [DOT] org Join In god we trust, all others we monitor.