This challenge was solved by and the write up was written by one of my teammates, gym.
In this challenge we are provided with a pcap of a zsync transfer. Zsync is a file transfer program that allows you to download a file from a remote server, where you have a copy of an older version of the file on your computer already. Zsync downloads only the new parts of the file, and transfers them over HTTP.
The zsync headers are the following:
Each transfer contains the hash of the file and blocks that are being transferred. We can see that the SHA1 hash of the original file is:
At this point we can either examine the headers manually and restore the final file (each header contains the blocks and the number of bytes being transferred):
Or we can use the Xplico (http://www.xplico.org/) opensource network forensics tool to do this for us.
The final file is a windows binary with the modified dropper code, running it in a windows vm we receive an error message that prints the 32 bit hash value.
KT’s alternative, “facepalm” solution
Meanwhile gym solved the challenge, I searched for every SHA-1 in the pcap.
And if I scrolled down to the middle of the page I saw the following screenshot:
I liked this part especially as this looked like exactly as a flag. :)
It was the flag of course. :D
First I thought maybe this was the intended solution, but then I saw the upload date and it was clear that somebody (probably an other team) uploaded the malware sample meanwhile the CTF, so it was a really facepalm moment for me. :)
And in spite of that the flag could be found this easily only a few team solved the challenge.
gym was not too happy when I told him that I just sent in the flag meanwhile he was working hard on solving the challenge :)
You have to replace the underscore with a number depending how many underscore followed each other. So _ becomes 1, __ becomes 2, etc. Then you get the following expression:
You can evaluate in this for example in python to this number:
Converting this number to ASCII (for example with my JS tools on kt.pe) gives you the flag:
This challenge was solved by and the write up was written by one of my teammates, AKG and me
First of all we found the mbti page (mbti.asis-ctf.ir) in the pcap file (ClientHello sent the host name to support SNI - Server Name Identification), which was a simple Myers–Briggs Type Indicator test (each question with 4 answers).
We found out that the text in the question depends on the previous answer, and the length of the texts differ.
After this we collected the data lengths from the pcap file (with scapy) and the questions lengths for each question-previous answer pairs (manually) and used some statistics to find out what the answers the candidate provided.
With this command we converted the pcap content to a more easily parsable text document:
And then filtered for the response packet lengths (in C# this time):
This file contains the 100 questions and to path to reach them: mbti_path.txt
This generated the template of following output:
Question #0 is the answer to the age question (your name does not matter)
The number after the question if the relative length of the response found in the pcap
The “P” values of the answers are the calculated relative lengths of that answer
The smaller the difference between the two numbers the more likely that that answer was choosen
As you can see in the most cases the answer was obvious, but we wasn’t sure about question #12 (there were 2 possibilities with the same 0.9177% relative length) and of course we didn’t know the answer to the last question.
This left us with 2 * 4 = 8 possibilities, which we tried out by hand:
So the right combination was: 11011311033331210201130132, which gave us the right flag:
This challenge was solved by and the write up was written by one of my teammates, nguyen
We got x64 ELF binary ‘license’
Decompile result of main function starts with opening a file _a\nb\tc_, since it is inconvenient to create file with such name, we replace the filename with following command
now we create a file name “keyfile” and get following error.
from next logic, we can see that size of keyfile should satisfy some equation.
which is
we solve this using z3 solver and found out that size should be 34 byte.
next, the file should contain 5 newlines
the file contents needs to be separated with newline and each line has to contain 6bytes which will be compared after XORing with hardcoded XORed key:
As a result, the following equation should be satisfied.
solving this equation with z3 yields
generating keyfile with these keys concatenated with newline
we get following result