Category Archives: 2015

English [Cybercamp 2015] [Forense 2.2] Write Up

Description

The company of Mr. Garcia has been robbed of 74,300€ from his bank account. The theft was committed without the knowledge of Mr. García or people in charge of IT.

Some of the money has been retrieved thanks to the speed of the bank to block the target account, but Mr. Garcia is determined to know how this unfortunate incident occurred, as he invested in forming security technicians and purchasing a perimeter antivirus solution for workstations.

After the incident, we have been asked to do a forensic analysis of the machine, but unfortunately these devices have been handled incorrectly and have no value for our review. Fortunately the system administrator, before the network failure, (do not know if caused by the incident) got a file with network traffic of the same day as the theft of bank accounts.

Download

Question: What is the country code of the attacker IP?

Continue reading [Cybercamp 2015] [Forense 2.2] Write Up

English [Cybercamp 2015] [Forense 2.1] Write Up

Description

The company of Mr. Garcia has been robbed of 74,300€ from his bank account. The theft was committed without the knowledge of Mr. García or people in charge of IT.

Some of the money has been retrieved thanks to the speed of the bank to block the target account, but Mr. Garcia is determined to know how this unfortunate incident occurred, as he invested in forming security technicians and purchasing a perimeter antivirus solution for workstations.

After the incident, we have been asked to do a forensic analysis of the machine, but unfortunately these devices have been handled incorrectly and have no value for our review. Fortunately the system administrator, before the network failure, (do not know if caused by the incident) got a file with network traffic of the same day as the theft of bank accounts.

Download

Question: What IP is the attacker?

Continue reading [Cybercamp 2015] [Forense 2.1] Write Up

English [Cybercamp 2015] Back on the event

Hey guys… Cybercamp has just finished! 🙂

There were a lot of challenges, some were really nice, but a good part of them were just full guessing which is really annoying :/

After an entire week (July, 17th to 26th) we ranked 9 out of 879..not so bad isn’t it?
And…we are the 1st non-Spanish team! The second one is only 49th.
Moreover we are proud for having resolved Web 4, only flagged by us!

Our results are:
Crypto: 16/20
Exploit: 2/5
Forensic: 19/27
Reverse: 5/5
Web: 17/18 (there were 20 challenges initially, but two were cancelled)

Write-ups (coming soon):
Crypto: 12345679  – 11  – 131415 – 16 – 17 – 19 – 20
Exploit: 1 – 2
Forensic: 1.1 – 1.2 – 1.3 | 2.12.22.32.42.5 | 3.1 – 3.2 – 3.3 – 3.5 | 4.14.24.4 | 5.1 | 7.2 – 7.3 | 8.1
Reverse: 123 – 4 – 5
Web: 1  – 2 – 3 – 45 – 6 – 7 – 8 – 9 – 111213151617 – 18 – 19 – 20  (Bonus: 10 cancelled)

See you for next CTF folks !

0x90r00t.

English [Cybercamp 2015] [Crypto 1-9] Write Up

Hi guys, since the first crypto challenges were quite easy, I’ll wrap the first of them in this write-up.

Crypto 1

Ciphered message : DWDFDUIORWDHHXX

This was a really simple Caesar cipher. All letters were shifted 3 times. A became D, W became A and so on.

Deciphered message : ATACARFLOTAEEUU

Crypto 2

Ciphered message : VCXRKFRQLCDLCKZTFCFI

With a Caesar deciphering with a shift of 17 letters :
Deciphered message : ELGATOAZULMULTICOLOR

Crypto 3

Ciphered message : BZHUBTLYVZPTWHYLZFXWLTL

First, we found a custom Caesar cipher, with a shift of 7 letters, giving :

USANUMEROSIMPARESYQPEME

Meaning : Use odd numbers YQPEME

I didn’t understand why they talked about odd numbers, because the last word was a progressive Caesar cipher : Q was shifted by 20 letters, then the shift was increased by 2 for each letter.

Deciphered message : USA NUMEROS IMPARES EUREKA

Crypto 4

Some criminals use a text as a seed for their ciphering keys. Can we find the keys using the following text ? The key words are in bold :

Plantilla: El texto dramático, por lo tanto, es aquel que representa
algún conflicto de la vida a partir del diálogo entre los personajes. La
noción de drama permite nombrar, en forma genérica, a cualquier obra escrita
por un dramaturgo donde los hechos tienen lugar en un espacio y tiempo
determinados.

By looking at their position in the text, we find :

2 3 5 7 11

These are the first prime numbers. If we keep following this logic, we then have :

2 3 5 7 11 13 17 19 23 29 31 37 41 43 47

And by concatenation of the corresponding words, we have the key :

Deciphered key : textodramaticoloesalgundepartirdialogolaengenericaunhechoslugary

Crypto 5

Ciphered message : YUc5c1lXMTFibVJ2

After a double base 64 decode, we get the answer

Deciphered message : holamundo

Crypto 6

a XOR b = 0x35
b XOR C = 0x15

a XOR c = ?

This is some easy XOR calculation.

(a XOR b) XOR (b XOR c) = 0x35 XOR 0x15

a XOR (b XOR b) XOR c = 0x20

a XOR c = 0x20

Crypto 7

Ciphered message : CHECO VERMO ORAAH

These were some basic anagrams.

Deciphered message : COCHE MOVER AHORA

(Move car now)

Crypto 9

Find the following row :
RO: 0000 1000 0100 1010 (Initial seed)
R1: 0001 0000 1001 0100
R2: 0100 0010 0101 0000
R3: 0001 0010 1000 00-0
R4: 0101 0000 0100 0010
R5: 0100 0010 0101 0000
R6: ?

We notice that each row is like the first one, but shifted.

R1 is shifted by 2 on the left

R2 is shifted by 3 on the left

then 5, 8. This is Fibonacci. So next line will be shifted by 13

0000 1000 0100 1010