Category: Hackvent 2015

RSS

Archive for the ‘Hackvent 2015’ Category

HACKvent 2015: Day 5

08 Dec 2015

CTF: Hackvent 2015
Link to challenge: http://hackvent.hacking-lab.com

Date Completed: 08 December 2015

Challenge

You are given the following file:
Download PDF File

Solution

So we open the PDF file to find 1 QR image in a ball. We scan it and we get the text Oooops ! .

We then use an online tool to extract all images from the PDF (link). I do this because PDF files store all image files, even if they are completely overlapped by other images.

We then find 3 different images:
PDF Image 1 PDF Image 2 PDF Image 3

As it turns out, the QR image square was overlapping the other QR image in the ball. So we simply scan the QR image in the ball and get the flag.

Flag: HV15-bkPb-tPEM-Fh3n-wvOi-5ZgD

No Comments

Posted Mo BeigiPersianMG in Hackvent 2015

HACKvent 2015: Day 7

07 Dec 2015

CTF: Hackvent 2015
Link to challenge: http://hackvent.hacking-lab.com

Date Completed: 07 December 2015

Challenge

Clue: Imagine your quick response for today.
0x1fc137f82a7a0dd05d76ebbcbb74815d82c720ff555fc018801f78baaf93c051d55e46346fd16dd457f54451df65fcec3a493768ffc00948aff4154e090627753ffebafa7ddd568860a87a3fd88eb

Clue: Imagine your quick response for today.

0x1fc137f82a7a0dd05d76ebbcbb74815d82c720ff555fc018801f78baaf93c051d55e46346fd16dd457f54451df65fcec3a493768ffc00948aff4154e090627753ffebafa7ddd568860a87a3fd88eb

Solution

This challenge was very easy to solve as I had completed the teaser earlier.

First I convert the hexadecimal number provided (as it starts with 0x) to binary.
The result is 625 bits (which does not divide nicely by 8 so it is probably not an ASCII message).

However, its likely to be a QR code version 2 which is 25×25 = 625 pixels large.
In this case, every 1 corresponds to a black pixel and every 0 corresponds to a white pixel.
This is obvious by arranging the bits into a 25 by 25 grid and adding some spacing :

1 1 1 1 1 1 1 0 0 0 0 0 1 0 0 1 1 0 1 1 1 1 1 1 1 
1 0 0 0 0 0 1 0 1 0 1 0 0 1 1 1 1 0 1 0 0 0 0 0 1 
1 0 1 1 1 0 1 0 0 0 0 0 1 0 1 1 1 0 1 0 1 1 1 0 1 
1 0 1 1 1 0 1 0 1 1 1 0 1 1 1 1 0 0 1 0 1 1 1 0 1 
1 0 1 1 1 0 1 0 0 1 0 0 0 0 0 0 1 0 1 0 1 1 1 0 1 
1 0 0 0 0 0 1 0 1 1 0 0 0 1 1 1 0 0 1 0 0 0 0 0 1 
1 1 1 1 1 1 1 0 1 0 1 0 1 0 1 0 1 0 1 1 1 1 1 1 1 
0 0 0 0 0 0 0 0 0 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 
1 1 1 1 1 0 1 1 1 1 0 0 0 1 0 1 1 1 0 1 0 1 0 1 0 
1 1 1 1 1 0 0 1 0 0 1 1 1 1 0 0 0 0 0 0 0 1 0 1 0 
0 0 1 1 1 0 1 0 1 0 1 0 1 0 1 1 1 1 0 0 1 0 0 0 1 
1 0 0 0 1 1 0 1 0 0 0 1 1 0 1 1 1 1 1 1 0 1 0 0 0 
1 0 1 1 0 1 1 0 1 1 1 0 1 0 1 0 0 0 1 0 1 0 1 1 1 
1 1 1 1 0 1 0 1 0 1 0 0 0 1 0 0 0 1 0 1 0 0 0 1 1 
1 0 1 1 1 1 1 0 1 1 0 0 1 0 1 1 1 1 1 1 1 0 0 1 1 
1 0 1 1 0 0 0 0 1 1 1 0 1 0 0 1 0 0 1 0 0 1 0 0 1 
1 0 1 1 1 0 1 1 0 1 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0 
0 0 0 0 0 0 0 0 1 0 0 1 0 1 0 0 1 0 0 0 1 0 1 0 1 
1 1 1 1 1 1 1 0 1 0 0 0 0 0 1 0 1 0 1 0 1 0 0 1 1 
1 0 0 0 0 0 1 0 0 1 0 0 0 0 0 1 1 0 0 0 1 0 0 1 1 
1 0 1 1 1 0 1 0 1 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 0 
1 0 1 1 1 0 1 0 1 1 1 1 1 0 1 0 0 1 1 1 1 1 0 1 1 
1 0 1 1 1 0 1 0 1 0 1 0 1 1 0 1 0 0 0 1 0 0 0 0 1 
1 0 0 0 0 0 1 0 1 0 1 0 0 0 0 1 1 1 1 0 1 0 0 0 1 
1 1 1 1 1 1 1 0 1 1 0 0 0 1 0 0 0 1 1 1 0 1 0 1 1

1 1 1 1 1 1 1 0 0 0 0 0 1 0 0 1 1 0 1 1 1 1 1 1 1

1 0 0 0 0 0 1 0 1 0 1 0 0 1 1 1 1 0 1 0 0 0 0 0 1

1 0 1 1 1 0 1 0 0 0 0 0 1 0 1 1 1 0 1 0 1 1 1 0 1

1 0 1 1 1 0 1 0 1 1 1 0 1 1 1 1 0 0 1 0 1 1 1 0 1

1 0 1 1 1 0 1 0 0 1 0 0 0 0 0 0 1 0 1 0 1 1 1 0 1

1 0 0 0 0 0 1 0 1 1 0 0 0 1 1 1 0 0 1 0 0 0 0 0 1

1 1 1 1 1 1 1 0 1 0 1 0 1 0 1 0 1 0 1 1 1 1 1 1 1

0 0 0 0 0 0 0 0 0 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0

1 1 1 1 1 0 1 1 1 1 0 0 0 1 0 1 1 1 0 1 0 1 0 1 0

1 1 1 1 1 0 0 1 0 0 1 1 1 1 0 0 0 0 0 0 0 1 0 1 0

0 0 1 1 1 0 1 0 1 0 1 0 1 0 1 1 1 1 0 0 1 0 0 0 1

1 0 0 0 1 1 0 1 0 0 0 1 1 0 1 1 1 1 1 1 0 1 0 0 0

1 0 1 1 0 1 1 0 1 1 1 0 1 0 1 0 0 0 1 0 1 0 1 1 1

1 1 1 1 0 1 0 1 0 1 0 0 0 1 0 0 0 1 0 1 0 0 0 1 1

1 0 1 1 1 1 1 0 1 1 0 0 1 0 1 1 1 1 1 1 1 0 0 1 1

1 0 1 1 0 0 0 0 1 1 1 0 1 0 0 1 0 0 1 0 0 1 0 0 1

1 0 1 1 1 0 1 1 0 1 0 0 0 1 1 1 1 1 1 1 1 1 1 0 0

0 0 0 0 0 0 0 0 1 0 0 1 0 1 0 0 1 0 0 0 1 0 1 0 1

1 1 1 1 1 1 1 0 1 0 0 0 0 0 1 0 1 0 1 0 1 0 0 1 1

1 0 0 0 0 0 1 0 0 1 0 0 0 0 0 1 1 0 0 0 1 0 0 1 1

1 0 1 1 1 0 1 0 1 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 0

1 0 1 1 1 0 1 0 1 1 1 1 1 0 1 0 0 1 1 1 1 1 0 1 1

1 0 1 1 1 0 1 0 1 0 1 0 1 1 0 1 0 0 0 1 0 0 0 0 1

1 0 0 0 0 0 1 0 1 0 1 0 0 0 0 1 1 1 1 0 1 0 0 0 1

1 1 1 1 1 1 1 0 1 1 0 0 0 1 0 0 0 1 1 1 0 1 0 1 1

I use the same script I used in the teaser (link) to generate a QR code.
This is the QR code generated (enlarged to 350px * 350px):

Day 7 QR Solution

We scan the QR code using a really clever online scanner (link) that has some extra error correcting capabilities (compared to other QR readers).
We get the flag: HV15-aFsf-4ea1-2eGg-Llr4-pB5A

4 Comments

Posted Mo BeigiPersianMG in Hackvent 2015

HACKvent 2015: Day 4

07 Dec 2015

CTF: Hackvent 2015
Link to challenge: http://hackvent.hacking-lab.com

Date Completed: 07 December 2015

Challenge

Clue: Crypto - a classic / simple one
HOlAfOVWOqVd1o6q7u5Vj8Mv-----

Clue: Crypto - a classic / simple one

HOlAfOVWOqVd1o6q7u5Vj8Mv-----

Solution

At first I was convinced this was a Vigenere cipher but this is not the case.
After a clue from M from the hacking-lab IRC channel I was able to figure out the cipher used is the Scytale cipher.
This is somewhat obvious as the - characters from the nugget are all grouped at the end of the ciphertext.

The length is also obvious by simply looking at the end of the ciphertext, l = 5.

We use an online scytale solver (link) to get the flag.

Flag: HV15-OWoV-lO6j-Aqq8-fV7M-Oduv

No Comments

Posted Mo BeigiPersianMG in Hackvent 2015

HACKvent 2015: Day 3

07 Dec 2015

CTF: Hackvent 2015
Link to challenge: http://hackvent.hacking-lab.com

Date Completed: 07 December 2015

Challenge

This image was provided:

Day 3 QR Image

Solution

We clearly have to either scan every QR code or find the correct QR code.
So we simply use an online tool that splits up GIF files based on their frames (link).
We download all the frames (29 images exist so its likely that each frame corresponds to one character in the nugget).

This turns out to be the case, we scan every code in order to get the flag.

Flag:
HV15-6Jhd-nWbQ-4dY8-yxH5-vSiA

No Comments

Posted Mo BeigiPersianMG in Hackvent 2015

HACKvent 2015: Day 2

07 Dec 2015

CTF: Hackvent 2015
Link to challenge: http://hackvent.hacking-lab.com

Date Completed: 07 December 2015

Challenge

Clue: I wonder if this is the native language of one of you!
pagh wa'vatlh netlh wa'maH wa'maH wa' SaD wa' SaD wa'vatlh wa' wa'maH wa'maH wa'vatlh wa'maH wa' wa'maH wa'maH netlh pagh wa'maH wa' wa'vatlh wa' wa'vatlh SaD SaD wa' wa'vatlh netlh wa'maH wa' wa'maH wa'maH wa'vatlh wa' wa'maH wa'maH wa' wa' wa'vatlh SaD wa' wa'maH wa'maH wa'maH wa'vatlh wa'maH SaD wa'maH wa' wa'maH wa'maH wa' wa' wa' wa'maH wa'vatlh wa' wa'vatlh wa' SaD wa' SaD wa'maH wa' wa' wa'maH wa' SaD  wa'maH wa' wa'maH wa'maH wa'vatlh wa'maH wa' wa'vatlh wa' wa'maH wa' wa' wa'maH wa' netlh wa'maH wa'vatlh wa' wa' wa' wa'vatlh wa'maH wa' wa'maH wa'maH SaD wa' wa'vatlh wa'maH SaD wa'vatlh wa' wa'maH SaD wa' wa'maH SaD

Clue: I wonder if this is the native language of one of you!

pagh wa'vatlh netlh wa'maH wa'maH wa' SaD wa' SaD wa'vatlh wa' wa'maH wa'maH wa'vatlh wa'maH wa' wa'maH wa'maH netlh pagh wa'maH wa' wa'vatlh wa' wa'vatlh SaD SaD wa' wa'vatlh netlh wa'maH wa' wa'maH wa'maH wa'vatlh wa' wa'maH wa'maH wa' wa' wa'vatlh SaD wa' wa'maH wa'maH wa'maH wa'vatlh wa'maH SaD wa'maH wa' wa'maH wa'maH wa' wa' wa' wa'maH wa'vatlh wa' wa'vatlh wa' SaD wa' SaD wa'maH wa' wa' wa'maH wa' SaD wa'maH wa' wa'maH wa'maH wa'vatlh wa'maH wa' wa'vatlh wa' wa'maH wa' wa' wa'maH wa' netlh wa'maH wa'vatlh wa' wa' wa' wa'vatlh wa'maH wa' wa'maH wa'maH SaD wa' wa'vatlh wa'maH SaD wa'vatlh wa' wa'maH SaD wa' wa'maH SaD

Solution

After some Googling I realise this is the Klingon language from Star Trek.
I try some online translators (including Bing!) and it is clear that the message is a series of numbers that contain 0 or 1 only.
This is most likely binary that represents ASCII text.

I write a small script to convert each component in the text (based on a Klingon number guide):

import sys
text = """pagh wa'vatlh netlh wa'maH wa'maH wa' SaD wa' SaD wa'vatlh wa' wa'maH wa'maH wa'vatlh wa'maH wa' wa'maH wa'maH netlh pagh wa'maH wa' wa'vatlh wa' wa'vatlh SaD SaD wa' wa'vatlh netlh wa'maH wa' wa'maH wa'maH wa'vatlh wa' wa'maH wa'maH wa' wa' wa'vatlh SaD wa' wa'maH wa'maH wa'maH wa'vatlh wa'maH SaD wa'maH wa' wa'maH wa'maH wa' wa' wa' wa'maH wa'vatlh wa' wa'vatlh wa' SaD wa' SaD wa'maH wa' wa' wa'maH wa' SaD  wa'maH wa' wa'maH wa'maH wa'vatlh wa'maH wa' wa'vatlh wa' wa'maH wa' wa' wa'maH wa' netlh wa'maH wa'vatlh wa' wa' wa' wa'vatlh wa'maH wa' wa'maH wa'maH SaD wa' wa'vatlh wa'maH SaD wa'vatlh wa' wa'maH SaD wa' wa'maH SaD"""
for word in text.split():
if word == "pagh":
sys.stdout.write(str(0))
elif word == "wa'maH":
sys.stdout.write(str(10))
elif word == "wa'vatlh":
sys.stdout.write(str(100))
elif word == "wa'":
sys.stdout.write(str(1))
elif word == "SaD":
sys.stdout.write(str(1000))
elif word == "netlh":
sys.stdout.write(str(10000))
else:
print "ERROR! Unknown"

import sys

text = """pagh wa'vatlh netlh wa'maH wa'maH wa' SaD wa' SaD wa'vatlh wa' wa'maH wa'maH wa'vatlh wa'maH wa' wa'maH wa'maH netlh pagh wa'maH wa' wa'vatlh wa' wa'vatlh SaD SaD wa' wa'vatlh netlh wa'maH wa' wa'maH wa'maH wa'vatlh wa' wa'maH wa'maH wa' wa' wa'vatlh SaD wa' wa'maH wa'maH wa'maH wa'vatlh wa'maH SaD wa'maH wa' wa'maH wa'maH wa' wa' wa' wa'maH wa'vatlh wa' wa'vatlh wa' SaD wa' SaD wa'maH wa' wa' wa'maH wa' SaD wa'maH wa' wa'maH wa'maH wa'vatlh wa'maH wa' wa'vatlh wa' wa'maH wa' wa' wa'maH wa' netlh wa'maH wa'vatlh wa' wa' wa' wa'vatlh wa'maH wa' wa'maH wa'maH SaD wa' wa'vatlh wa'maH SaD wa'vatlh wa' wa'maH SaD wa' wa'maH SaD"""

for word in text.split():

if word == "pagh":

sys.stdout.write(str(0))

elif word == "wa'maH":

sys.stdout.write(str(10))

elif word == "wa'vatlh":

sys.stdout.write(str(100))

elif word == "wa'":

sys.stdout.write(str(1))

elif word == "SaD":

sys.stdout.write(str(1000))

elif word == "netlh":

sys.stdout.write(str(10000))

else:

print "ERROR! Unknown"

This prints out some binary:

0100100001010110001100010011010100101101010000010110011001000100011001000010110101001101011100100011010101001010001011010111101001100110001100010111011000101101010010110011011101100001010011110010110101000110010100010011010001101000

1	0100100001010110001100010011010100101101010000010110011001000100011001000010110101001101011100100011010101001010001011010111101001100110001100010111011000101101010010110011011101100001010011110010110101000110010100010011010001101000

Total number of bits is 232 and 232/8 bits = 29 bytes.
This is exactly the number of characters in our nugget!

We convert the binary to ASCII and get the flag:
HV15-AfDd-Mr5J-zf1v-K7aO-FQ4h

No Comments

Posted Mo BeigiPersianMG in Hackvent 2015

Mo Beigi

Archive for the ‘Hackvent 2015’ Category

HACKvent 2015: Day 5

Challenge

Solution

HACKvent 2015: Day 7

Challenge

Solution

HACKvent 2015: Day 4

Challenge

Solution

HACKvent 2015: Day 3

Challenge

Solution

HACKvent 2015: Day 2

Challenge

Solution

Pages

Recent Posts

Recent Comments

My Networks

Site Stats