[WhiteHat Contest 8] Crypto100, Forensic100, Forensic200

[phieulang1993]

Crypto 100
Chỉ là một bức hình
http://material.wargame.whitehat.vn/contests/8/crypto100_7e29e95300ff20e75a8f9cab58a4c39a.zip


=> Brainloller
decode ta được:

+[--->+++.+++[->++++.+.+++++++++++.+++[->+++.--[----->++.[--->+++++.--[--->+-.+++++++.-[----->++.--.++++.[->+++.-[->++-.+.[-->++++.-[->++.++[->+++.[--->+-----.-[-->+-.+++++++.----.--[->++.[-->+++++.+.--.-[->++..---.-[-->+.++++++.-.+.--.--[->++-.--.+[-->+++.+++.-----.+.-.[--->+.++[->+++.[--->+--.---..--.-[++++>-----.-------.>--[-->+++.>++++++++++.[------>+.+++[->++++.+.+++++++++++.+++[->+++.--[----->++.[--->+++++.--[--->+-.+++++++.-[----->++.--.++++.[->+++.-[->++-.+.[-->++++.-[->++.++[->+++.[--->+-----.-[-->+-.+++++++.----.--[->++.[-->+++++.+.--.-[->++..---.-[-->+.++++++.-.+.--.--[->++-.--.+[-->+++.+++.-----.+.-.[--->+.++[->+++.[--->+--.---..--.-[++++>-----.-------.>--[-->+++.>++++++++++.[------>+.+++[->++++.+.+++++++++++.+++[->+++.--[----->++.[--->+++++.--[--->+-.+++++++.-[----->++.--.++++.[->+++.-[->++-.+.[-->++++.-[->++.++[->+++.[--->+-----.-[-->+-.+++++++.----.--[->++.[-->+++++.+.--.-[->++..---.-[-->+.++++++.-.+.--.--[->++-.--.+[-->+++.+++.-----.+.-.[--->+.++[->+++.[--->+--.---..--.-[++++>-----.-------.>--[-->+++.>++++++++++.[------>+.+++[->++++.+.+++++++++++.+++[->+++.--[----->++.[--->+++++.--[--->+-.+++++++.-[----->++.--.++++.[->+++.-[->++-.+.[-->++++.-[->++.++[->+++.[--->+-----.-[-->+-.+++++++.----.--[->++.[-->+++++.+.--.-[->++..---.-[-->+.++++++.-.+.--.--[->++-.--.+[-->+++.+++.-----.+.-.[--->+.++[->+++.[--->+--.---..--.-[++++>-----.-------.>--[-->+++.>++++++++++.[------>+.+++[->++++.+.+++++++++++.+++[->+++.--[----->++.[--->+++++.--[--->+-.+++++++.-[----->++.--.++++.[->+++.-[->++-.+.[-->++++.-[->++.++[->+++.[--->+-----.-[-->+-.+++++++.----.--[->++.[-->+++++.+.--.-[->++..---.-[-->+.++++++.-.+.--.--[->++-.--.+[-->+++.+++.-----.+.-.[--->+.++[->+++.[--->+--.---..--.-[++++>-----.-------.>--[-->+++.

Brainfuck decode:

WhiteHat{dbf2ab4f8c073b564ffc17675ec47232f8fcca81}
WhiteHat{dbf2ab4f8c073b564ffc17675ec47232f8fcca81}
WhiteHat{dbf2ab4f8c073b564ffc17675ec47232f8fcca81}
WhiteHat{dbf2ab4f8c073b564ffc17675ec47232f8fcca81}
WhiteHat{dbf2ab4f8c073b564ffc17675ec47232f8fcca81}

Tool:
1. Braintools https://github.com/mbikovitsky/BrainTools
2. http://www.splitbrain.org/_static/ook/

 

Re: Writeup Forensic100

Forensic100
http://material.wargame.whitehat.vn/contests/8/for100_c8a917e94caa79a909e922fa8d404d.zip
2 files: dump1 (3006 kb), dump2 (2kb)

Check dump1 (3006 kb)
=> Dumpcap
Dump1 on wireshark

Script python get data:

data = open("dump1","rb").read().encode("hex")
file = open("all","wb")
i = 0
while 1:
  id = data.index("810300100000",i)
  file.write(data[id+12:id+8192+12].decode("hex"))
  i = id+1

Check file all: ta thấy có string là secret.zip và secret.txt + Signature PK => zip file

=> Secret.zip

Password ???

Check file dump2:

Interrupt IN transfers
Conversely, a USB device can support interrupt IN endpoints as a way to inform the host about hardware interrupts generated by the device. Typically USB Human Interface Devices (HID) such as keyboards and pointing devices support interrupt OUT endpoints. When an interrupt occurs, the endpoint stores interrupt data but that data does not reach the host immediately. The endpoint must wait for the host controller to poll the device. Because there must be minimal delay between the time data is generated and reaches the host, it polls the device at regular intervals. A Windows Store app can get data received in the UsbInterruptInPipe. The request that completes when data from the device is received by the host.

http://www.mikrocontroller.net/attachment/92649/Hut1_11.pdf
HID Usage Tables

0d181616172c0c112c170c1008 => jusst yn tyme => just in time

Flag: WhiteHat{b02f0e7bed6ad69dd0ab74c1bf44dfc61cdaa74b}

 

Re: Writeup Forensic200

Forensic 200
AirDroid
http://material.wargame.whitehat.vn/contests/8/for200_a573b64f444cb80731e99954d521fde4

Check => Dumpcap

Mở trên wireshark ta thấy có khá nhiều file png:

File => export objects => HTTP

Ta thấy một số hình có vẻ là những mảnh của QRcode

Ghép lại ta được:

Decode QRcode ta được flag:

 

Re: Writeup Crypto100

Chi tiết các bài writeup có thể coi tại:
https://www.facebook.com/groups/unsgroup/permalink/337304516459103/

 

Re: [WhiteHat Contest 8] Crypto100, Forensic100, Forensic200

Cảm ơn writeup của bạn, bạn ở Team nào vậy?

 

Re: [WhiteHat Contest 8] Crypto100, Forensic100, Forensic200

Cảm ơn writeup của bạn, bạn ở Team nào vậy?

Mình team 0nePiec3

 

Re: [WhiteHat Contest 8] Crypto100, Forensic100, Forensic200

Chào mừng đến Tân Thế giới. :v

 

Re: [WhiteHat Contest 8] Crypto100, Forensic100, Forensic200

Bạn writeup thêm mấy bài về web được không

 

Re: [WhiteHat Contest 8] Crypto100, Forensic100, Forensic200

Bạn writeup thêm mấy bài về web được không

Bạn có thể coi tại đây:
https://whitehat.vn/threads/10179-WhiteHat-Contest8-Web100-200-300.html
Hoặc coi tại Group:
https://www.facebook.com/groups/unsgroup/permalink/337304516459103/