PwCTF - השלב המקדים - 2018

פורסם קישור לאת[ג]ר: https://prequal.pwctf.com

שלב 1 - Login:

login

לא ניתנו שם משתמש אוסיסמה, נראה שזה האתגר.

בדקנו את הקוד ואספנו את כל השורות המעניינות:

Line 13:     <!-- Rotation -->
Line 64: <!-- Line: Base -->
Line 128: <!-- Comments Are Awesome! -->
Line 256: <!-- Scroll! -->
Line 512: <!-- Scroll More! -->
Line 1024: <!-- It's Not Enough! -->
Line 1337: <!-- So You Think You Got What It Takes To Own The CTF? מספר נורא ארוך -->
Line 2048: <!-- I Think You Missed It :S. Bip, Bip, Bip, Reversing To Line esaB... -->

בשורה 1337 יש מספר נורא נורא ארוך שנראה כמו הקס.

רצף בינארי נורא ארוך

זה אכן היה (30=0, 31=1, 62=b).

אז עכשיו להמיר מבינארי לאסקי?

=0aPA0SVtbDQvtvBt4JnuqJLtDKnt8TMt8TqtDJMy5TVfkJn3OFqiySVfDJMa5JLbATVyy2ni92Dt42ocA3pyASVlI3o5OPMhSTVyWKMbOPqiqTV19JrtLJFvNPVtNvPAjvVh42ocA3pyASVlI3o5Olo0OPMyEKLlIzoyqTV5kJoiEzouWUVmyTVh9Jn0IUoiAUV5WKM2IxVtNPVtbDQoOvBvZKM09zovNPVX0NYvxzAxxJC6gPL7ymH3DaGhWPV6VPMl92qmAKLjWPVtbDQfVvM0A0IDWPV6VFMgSzolI2p1WPVtbDQfVFLmDQBuA2AjDGZyOQB3VGLkpwMlVzZuWPV6VlnhIanvNPVX0jr

כן! זה נראה כמו בסיס 64 מהסוף להתחלה...

rj0XVPNvnaIhnlV6VPWuZzVlMwpkLGV3BQOyZGDjA2AuBQDmLFVfQDbtVPW1p2IlozSgMFV6VPWDI0A0MvVfQDbtVPWjLKAmq29lMPV6VPWhGaD3Hmy7LPg6CJxxAzxvYN0XVPNvoz90MKZvBvOoQDbtVPNtVxI2MKW5VUAioUI0nJ9hVTymVUWuozEioJk5VTqyozIlLKEyMPO0olO5o3IlVSAyp3Aco24hVvjAPvNtVPNvFJLtrJ91VTqiqPObMKWyVTShMPO5o3IlVSAyp3Aco24tD29in2yyVTAbLJ5aMJDfVSyiqFO3nJkfVT5yMJDtqT8tMT8tnKDtLJqunJ4tBvtvQDbtVS0APa0=

אבל זה נותן זבל :(, מה עכשיו?

רגע, הרמזים. טיפלנו בשורות 64, 1337, 2048. שורות 128, 256, 512, 1024 די משעממות. שורה 13, "Rotation"?

rot-13!

ew0KICAianVuayI6ICJhMmIyZjcxYTI3ODBlMTQwN2NhODQzYSIsDQogICJ1c2VybmFtZSI6ICJQV0N0ZiIsDQogICJwYXNzd29yZCI6ICJuTnQ3Uzl7YCt6PWkkNmkiLA0KICAibm90ZXMiOiBbDQogICAgIkV2ZXJ5IHNvbHV0aW9uIGlzIHJhbmRvbWx5IGdlbmVyYXRlZCB0byB5b3VyIFNlc3Npb24uIiwNCiAgICAiSWYgeW91IGdvdCBoZXJlIGFuZCB5b3VyIFNlc3Npb24gQ29va2llIGNoYW5nZWQsIFlvdSB3aWxsIG5lZWQgdG8gZG8gaXQgYWdhaW4gOigiDQogIF0NCn0=

ננסה לפענח שוב:

{
  "junk": "a2b2f71a2780e1407ca843a",
  "username": "PWCtf",
  "password": "nNt7S9{`+z=i$6i",
  "notes": [
    "Every solution is randomly generated to your Session.",
    "If you got here and your Session Cookie changed, You will need to do it again :("
  ]
}

הידד!

הגיע הזמן להתחבר.

שלב 2 - Source Control:

sourcecontrol

View Source מוביל אותנו ל-https://prequal.pwctf.com/readme-src/157fa083-f9cf-4cd9-9f6d-fca666eec466/README.md שמראה את הטקסט:

Read Me
========
Can you find the file that contains a secret **SOURCE** code?  
That's where you'll find the registration URL.  
Please **CONTROL** yourself, try not to DOS our server....  
So some source control based magickaroo? Alright...

מכאן והאלה קישורים יהיו משורשרים לכתובת האתגר במקום החלק /README.md.

מספר קבצים מעניינים:

וכו'. במבט לאחור הקובץ /refs/stash מספיק למציאת הקישור להרשמה.

התוכן של /refs/stash:

117e7ccdf7e84a722e75202dc1b306a7d2d51c39

למדנו שבלובים שמורים ב-/.git/objects/first two letter of sha/rest of sha

בואו נגלוש לשם!

קיבלנו קובץ. בואו נזייף ריפו במחשב. (git init בתקייה ריקה ונשמור את הקובץ שירד בתקיית objects כמתואר) עכשיו שזה מוכן נוכל להשתמש ב-git cat-file -p SHA:

$ git cat-file -p 117e7ccdf7e84a722e75202dc1b306a7d2d51c39
tree e0a377b06fbac432f4fff4f8eba7f98eb105c4eb
parent e24a3a95d60b16038abb3a99b79629bda984b1b0
parent 16b58ef382282a619c152953c703111d86702df8
author Ubuntu <[email protected]> 1516178316 +0000
committer Ubuntu <[email protected]> 1516178316 +0000
WIP on rossg: e24a3a9 Commit 128

אוקיי, 3 קבצים נוספים. נחזור על הפעולות ונראה את התוכן שלהם.

זה הקובץ המעניין:
$ git cat-file -p e0a377b06fbac432f4fff4f8eba7f98eb105c4eb
100644 blob 09e4f17def7f17d206045421221fe7d20050abfe    README.md
100644 blob bd2daed378ccb0f6776ba3034974b8447f8ce8ee    interesting.txt

הקובץ המעניין:

$ git cat-file -p bd2daed378ccb0f6776ba3034974b8447f8ce8ee
Not Mississippilessly? https://prequal.pwctf.com/register.php?token=1466ada0cfd4d6f3e0d0fa6b167840c5

בויה!

הגענו לעמוד שמבקש שם ואימייל להרשמה, ואז:

success

מקווה לכתוב כזה גם לאתגרים בשלב הבא!

רשימת משאבים


מספר נורא ארוך

30301111301306230301130303030306230113030303013062301301303030303062301303030303013062303011303030303062301301303011306230130130113030623011130130303062301130303013030623013030301303030623013013030301306230111301130306230111301303030623011130113030623013030303013030623011130130303062303011301303030623013030130130306230113011130306230111301301306230111303030130623013030130130306230130301130303062301113013030306230130303013030306230130301301130623011301113030623011130130303062303011130303030623013013013030306230130301130130623011130130303062303011130303030623013013013030306230111303030130623011130130303062301303030130303062301303013013030623013030113013062301111303013062303011301301306230130130130303062301301301130306230113030113030623011301301130623013030130130306230113011130306230301130301130623013030111130623013030301130306230111303030130623011301303013062301111303013062301301303011306230130130113030623011303011303062301303030130303062301303013013030623013030113013062301130303030130623030113013013062301303013013030623013030113030306230113030301303062301303030303013062301301301303030623013013011303062301111303013062301111303013062303011303013030623011301113030623011301303013062303011130301306230301130301303062301303030130303062301113013030306230301130130303062303011303013030623011301111306230113030301130623013030303030130623030113030113062301113030303030623011113030130623013030303030130623013013030113062301301301130306230113011303030623013030130301306230301130301130623011301111306230301130130130623013030111130623013013030303030623013030113013062301130130303030623013013030113062301301301303030623013013011303062301111303013062301301301113062301303013011306230130301130130623011303030130306230130301111306230130130303030306230111303030130623011301303013062301113030301306230130130130303062301301301130306230301130303013062303011130301306230130301301303062301113030130306230111301303030623013030113030306230130301301303062301303030113030623011130113030623013030111303062301301303030303062301301301130306230111301303030623013030111303062301113011303062301301303030303062301303030303013062301130130130306230111301130306230130130113030623011301303030306230301130130303062303011303013030623011301111306230113030301130623013030303030130623030113030113062301113030303030623011113030130623013030303030130623013013030113062301301301130306230113011303030623013030130301306230301130301130623011301111306230301130130130623013030111130623011301130303062301130111130623030113030303030623013030111130623013013030303030623013030113013062301111303013062301303030130130623013030130113062301303011303030623011301130303062301303013030130623011113013030623011301111306230111130301306230111303030130623013013013030306230130130113030623030113013013062301130130113062301303013013030623011301111306230113013030130623013030301301306230111130130306230113011113062301113013013062301301301113062301301301301306230130130113030623011301130130623011113030130623013013013030306230130130113030623011301303030306230301113030130623013030130130306230113011130306230301130303030306230130301303013062301301301301306230113011113062301130130301306230130303030301306230130130130130623013013011303062303011301301306230130130111306230130301301130623013030113013062303011303013030623013030130301306230111130303030623013013011303062301113013030306230130301113030623013013030303030623013013011303062301113013030306230113030301303062301303030130303062301301303030130623011301111306230130301111306230111301130306230130303030130306230111301130306230130113013030623013030130113062301303011301306230301130303030306230301113030130623011113013030623011301111306230111301130306230130301113030623013013030303030623013013011303062301301130303030623030113030303030623013030111303062301301130301306230111301130306230111130303030623011113013030623013030303030130623011113030303062301111303030306230130301301303062301303030301130623030113011303062301130301113062301301303030303062301303011303030623030113011130623011113030130623011301130130623013030130303030623030113030113062301303030130303062301130303030130623013030301113062301130130303030623013013011130623013013030303030623013013011303062303011301130306230130130113030623013013030303030623013030113013062301130113030306230301113030130623030113030130306230111303030130623011301130130623013030303030130623013030130113062301303011303030623011301301303062301301301113062301301303030303062301301301130306230111301303030623011303030130306230130303013030306230130130303013062301130301130306230130130113030623011130113030623013030113013062303011303030303062301303030303013062303011303030303062301303013030130623013030301303030623013013011130623013013030303030623013013011303062303011301130306230130130113030623013030301130306230130301130130623011303011130623013013030113062301111301303062301130111130623011301130303062301303013030130623030113030130306230111303030303062303011303030130623013013011130623013013030303030623013013011303062301113013030306230113030301303062301303030130303062301301303030130623011303011303062301301301130306230130303011303062301303011303030623011301130130623013030301303030623013013030301306230130303030130306230111301301306230130303030301306230301130301303062301303030303013062301130130130306230130303013030306230130303011130623013011301303062301111303013062301303011113062301301303030130623013030303013030623030113030113062301301301130306230130303011130623013030113030306230113013011306230111303030303062301113011130623013030113013062301130113030306230130130113030623011113013030623013011301303062301113013013062301301301113062301301303030303062301301301130306230301130113030623013013011303062301130113030306230113011130306230113013030303062301303013030130623011303030301306230113011130306230111301130306230130301113030623013013030303030623013013011303062301301130303030623030113030303030623011301301303062301113030130

רצף בינארי נורא ארוך

001111010b001100000b011000010b010100000b010000010b001100000b010100110b010101100b011101000b011000100b010001000b010100010b011101100b011101000b011101100b010000100b011101000b001101000b010010100b011011100b011101010b011100010b010010100b010011000b011101000b010001000b010010110b011011100b011101000b001110000b010101000b010011010b011101000b001110000b010101000b011100010b011101000b010001000b010010100b010011010b011110010b001101010b010101000b010101100b011001100b011010110b010010100b011011100b001100110b010011110b010001100b011100010b011010010b011110010b010100110b010101100b011001100b010001000b010010100b010011010b011000010b001101010b010010100b010011000b011000100b010000010b010101000b010101100b011110010b011110010b001100100b011011100b011010010b001110010b001100100b010001000b011101000b001101000b001100100b011011110b011000110b010000010b001100110b011100000b011110010b010000010b010100110b010101100b011011000b010010010b001100110b011011110b001101010b010011110b010100000b010011010b011010000b010100110b010101000b010101100b011110010b010101110b010010110b010011010b011000100b010011110b010100000b011100010b011010010b011100010b010101000b010101100b001100010b001110010b010010100b011100100b011101000b010011000b010010100b010001100b011101100b010011100b010100000b010101100b011101000b010011100b011101100b010100000b010000010b011010100b011101100b010101100b011010000b001101000b001100100b011011110b011000110b010000010b001100110b011100000b011110010b010000010b010100110b010101100b011011000b010010010b001100110b011011110b001101010b010011110b011011000b011011110b001100000b010011110b010100000b010011010b011110010b010001010b010010110b010011000b011011000b010010010b011110100b011011110b011110010b011100010b010101000b010101100b001101010b011010110b010010100b011011110b011010010b010001010b011110100b011011110b011101010b010101110b010101010b010101100b011011010b011110010b010101000b010101100b011010000b001110010b010010100b011011100b001100000b010010010b010101010b011011110b011010010b010000010b010101010b010101100b001101010b010101110b010010110b010011010b001100100b010010010b011110000b010101100b011101000b010011100b010100000b010101100b011101000b011000100b010001000b010100010b011011110b010011110b011101100b010000100b011101100b010110100b010010110b010011010b001100000b001110010b011110100b011011110b011101100b010011100b010100000b010101100b010110000b001100000b010011100b010110010b011101100b011110000b011110100b010000010b011110000b011110000b010010100b010000110b001101100b011001110b010100000b010011000b001101110b011110010b011011010b010010000b001100110b010001000b011000010b010001110b011010000b010101110b010100000b010101100b001101100b010101100b010100000b010011010b011011000b001110010b001100100b011100010b011011010b010000010b010010110b010011000b011010100b010101110b010100000b010101100b011101000b011000100b010001000b010100010b011001100b010101100b011101100b010011010b001100000b010000010b001100000b010010010b010001000b010101110b010100000b010101100b001101100b010101100b010001100b010011010b011001110b010100110b011110100b011011110b011011000b010010010b001100100b011100000b001100010b010101110b010100000b010101100b011101000b011000100b010001000b010100010b011001100b010101100b010001100b010011000b011011010b010001000b010100010b010000100b011101010b010000010b001100100b010000010b011010100b010001000b010001110b010110100b011110010b010011110b010100010b010000100b001100110b010101100b010001110b010011000b011010110b011100000b011101110b010011010b011011000b010101100b011110100b010110100b011101010b010101110b010100000b010101100b001101100b010101100b011011000b011011100b011010000b010010010b011000010b011011100b011101100b010011100b010100000b010101100b010110000b001100000b011010100b01110010