bookmark_borderCCTF4 Hacktivity Writeups 2.

Don’t be eval

The task was to somehow break a specified website. The HTML markup of the website contained the text “Figwheel”. A quick web search will reveal that Figwheel is a software package for developing websites — live¹ — in the Clojure programming language.

On the website, the only item of interest was the link anchored to the text “do you even REPL, bro?”: the URL contained an argument of “(cons 1 2)”, which looks like Clojure code (a lot like Lisp). Along with the challenge’s name of “Don’t be eval”, these all gave the suggestion that the web request’s single parameter was taken as Clojure code to be evaluated, and indeed it was.

Clojure has access to the full Java ecosystem, including IO functions. By sending in appropriate code snippets (in the URL parameter), it was possible to list the contents of the current directory; it contained a file called “flag.txt”. Then that file could be printed, which contained the flag.

¹ to get a feel for what raz, the creator of this challenge, does for a living, see https://www.youtube.com/watch?v=XSIy8gmjmgY#t=1204s

Author: Mr. SI

Pwncoin challenge

For this challenge, a host was specified, and it was suggested that one ought to use Netcat. It was also blatantly stated that one should try overflowing the “meaning of life” (i.e. 42). The solution was to send an arbitrary string exactly of length 43 (not more, which might be weird, but is realistic), over a plain TCP connection; this revealed the flag.

On top of that — and this is something that even the creator of this challenge didn’t think about —, one could discover that the service served at most 1 client at a time, denying other connections while one is open. This permitted a shrewd contestant to prevent other contestants from even attempting to solve this challenge thereafter, by leaving a connection to the server hanging without submitting anything — it wasn’t me! :trollface.jpg:

Note from six for this solution: it was a wargame! 🙂

Author: SI

Thank you SI for submitting the writeups!

bookmark_borderCCTF 4 Hacktivity Writeups 1.

We have received many requests for the CCTF game writeups. Here is the first one, the challenge was called “BIPolognese”. Be careful, spoilers follow.

Challenge: BIPolognese

BIPolognese (100 points)
Crypto Wojack (beginner)

Crypto Wojack was considerate again and made a cold backup of his wallet seed so Bogdanoff can't hak it again.
Meanwhile, he was lost in eating ₿10.000 pizza.

Look at that picture! Can you get the account address?

The hints

  1. The challenge’s name itself suggests a BIP seed
  2. Cold backup
    • These are copied somewhere offline, but before it is shown on the screen
  3. Doing something during eating
    • Crypto Wojack is doing something with the BIP seed and a wallet
  4. Look at the picture
    • You will find the BIP seed on the right laptop’s screen

The solution

Note the BIP44 seed words from the screen, open a web browser, install MetaMask.

After you have installed it, this screen will appear:

Choose the “Import wallet” option and use the seed phrase from the picture.

You find that the wallet it empty, but the flag is the first address as mentioned in the Rules.

Writeup by: six

bookmark_borderCCTF3 – The official CTF game of Bday 3.0

CCTF is organized the third time, now for Bday 3.0 (Blockchain Day) which is one of the largest cryptocurrency related event in Central-Europe.

CCTF is a “Capture The Flag” game where the participants need to hack realistic challenges related to cryptography and cryptocurrencies. The best ones will get rewarded by some presents and QARK tokens, offered by QAN.

If you would like to participate, you can do so by registering here: https://cryptoctf.org/

What about the previous CCTF events? An archive will be created including all the three of them after the last finishes. It will be available on the CCTF’s website.

Who creates these events? The founder of the CCTF project is six from Awalcon who initiated it in 2019 by calling fellow hackers into the project. It is a joint project where the creators include not just Awalcon, but also members from H.A.C.K. and this year Silur from QAN.

six speaking at BDAY3.0 conference

bookmark_borderState of the Art Phishing @Hacktivity

October is the month for IT security conferences and we are participating on them, as always. The presentation “State of the Art Phishing” has been accepted and will be presented online between October 8-10. More information will be shared on Hacktivity’s website: https://hacktivity.com/

Mostly a technical talk, but there will be many attacks discussed which can give good examples on what to defend against for non-techies too.

If you would like to keep up with the infosec news, six is posting regularly on his Mastodon and Twitter accounts:

https://noc.social/web/accounts/15777

six’s twitter for #infosec news