Turkey Express Mini CTF 🦃

Instructions #

• “Your goal for each challenge is to find a “flag.” A flag is a string of text that will usually, look like this: MetaCTF{some_phrase}. The grader is pretty lenient, submissions are case insensitive, and it doesn’t care if you use the MetaCTF{} brackets.”

Challenges #

Welcome to the Obfuscation Games #

$s=New-Object IO.MemoryStream(,[Convert]::FromBase64String("H4sIAAR+eWMA/xXJMQrCQBCF4as8BtucQKwEO7uAZRict2Yh7oTMNCLefd3q4+d/HDU5rR4JmVeibPpCDdSG/Cfb042GXT+bq8kZp4IL5M7U63z7GsdfBu/9YMRi3viTDosm3BlXAAAA"));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();

Walkthrough

1. From the given PowerShell syntax, we can see that there is a Base64 encoded string compressed with Gzip.

   

2. We can reverse the compression and encoding process with CyberChef From Base64 -> Gunzip

   

Answer: MetaCTF{decode_decompress_done}

Staging in 1…2…3… #

Walkthrough

1. Working with a new Kali VM and CTF working directory, we can use curl to download the suspicious file

   

2. We can us the file command to verify the fyle type, which reveals that this file is actually a 7-zip archive.

   

3. Let’s rename the directory with the .7z file extension, then extract the contents with p7zip

   

4. List out our extracted contents to reveal the flag with ls

   

Answer: MetaCTF{you_might_consider_using_encryption}

The Impossible Survey #

Walkthrough

1. The link provided in the question goes out to a survey through Google Forms.

   

2. Trying to answer normally, I couldn’t get the survey to accept my answer. I kept receiving the same error: Too short (need at least 50 characters)

3. I entered in a response that was over 50 characters, but got the same error again.

4. I decided to inspect the source code and found that all of the survey questions were located in there, along with the flag.

   

Answer: MetaCTF{so_whos_going_to_report_this_bug_to_google}

Diving Into the Announcement #

Walkthrough

1. During my initial search, I went down the path of finding actual exploits and vulnerability detection methods, but didn’t recognize aything describing the proof of concept. CVE-2020-1672

2. I came across a CrowdStrike article that described the attack flow and the Windows function leveraged in the exploit, which we can submit as the flag: Zerologon (CVE-2020-1472): An Unauthenticated Privilege Escalation to Full Domain Privileges

   

Answer: NetrServerPasswordSet2

A Confident Hash #

$2a$04$KMCaaiytS5OIsg2UZtthzugkZUPDqQ/Zyoys8XAY6AJVgirU/MWOS

Walkthrough

1. This looks like a password hash from /etc/shadow. A quick Google search showed that the $2a prefix is for a bcrypt hash.

   

2. We can download a copy of the wordlist with curl and save it in our working directory

   

3. With the hash and wordlist ready, we can set up our dictionary attack using hashcat.

   • We need to find the corresponding numerical code for bcrypt in hashcat (3200). grep for bcrypt in the help page:

     hashcat --help | grep bcrypt
     

     

   • • cd to the working directory containing the hash and wordlist

       

4. Set up hashcat and start cracking!

   • Using a workload profile of 3 -w 3 gives a nice balance of computing power while maintaining GUI access.

   • Attack mode zero -a 0 will use the wordlist as-is to crack hash mode 3200 -m 3200

   • Store the output results in a file called cracked.txt -o cracked.txt to reference later

   • Specify the hash.txt to crack and wordlist.txt as the dictionary

     hashcat -w 3 -a 0 -m 3200 -o cracked.txt hash.txt wordlist.txt
     

     

Answer: galactica_hash

King to Queen 3 #

My Approach / Solution

I eventually landed on the answer to this one. Instead of a walkthrough, I documented my process because I ultimately tried several combinations before getting the answer.

1. Starting out, I tried running different forensic/steganography-related linux commands against the images to see if there was any hidden information in the metadata or raw data, but didn’t find anything noteworthy.

   • I even filtered based on the file’s original creation time (File Modification Date/Time) to see if there was relevance or a clue based on that order - Each file was created in order as they were named (1-9.png) and didn’t seem to have any significance.

     

2. Next, I tried reordering the images based on the number of pieces left on the board as they appear in each image, thinking that might give a clue to what the key is… Still no luck.

   • In the screenshot below, the left red number indicates the number of black pieces, the right red number indicates number of white pieces on the board for each image. The blue number would have been the correct order of the images if they followed the flow of the game based on number of pieces eliminated

     

3. I finally tried plugging the ciphertext into the autodetect function at https://www.dcode.fr. It suggested using an ascii shift cypher. Using the hint that the flag was wrapped in MetaCTF{}, I was able to determine the starting and endpoing point; and that each set of letters were in groups of three. (there are a total of 27 letters in the cyphertext and 9 images, groups of three was promising)

   

4. Even with the start and end points, I may have missed a clue somewhere that would have helped identify a pattern. The overall shift didn’t seem to repeat (at least that I could find). Fortunately the ciphertext rotation contained the answer in 1337 words and was on adjacent lines where I could eventually piece together the flag.

   

Answer: MetaCTF{99_p3rc3nt_t4ct1cs}

Scoreboard & Stats #

It took me roughly 5 hours to solve and fully document each challenge. I came in 123rd place, which I was happy with. As a beginner-friendly CTF, I completed each challenge, learned a few things, and enjoyed the event.