ASPIRE CTF 2021 — Linux Skills & Networking

ASPIRE CTF was a good refresher for basic CTF skills. I hopped onto it played and solo to get the most out of it. Below is a detailed walk-through for all the challenges I solved in the Linux skills category

Needle in a haystack -50pts

From the challenge description and title, we need to leverage on using commands to locate our flag. The zip file contains a number of different files

Well, the most efficient way to look for the flag in this case would be to perform a grep search using a regex pattern.

This particular article came in handy in constructing the regex pattern that gets us the flag.

How to grep text with brackets only

Yarn-50pts

Our next challenge entails a bit of forensics CTF knowledge. First things first when given an image file is to analyze its metadata for any additional helpful information

The markers I have highlighted didn’t yield that much information so I ran strings on the image to check for low hanging fruits. We get interesting information.

strings bean.jpeg

This segment of the strings output reveals we are working with XMP metadata, commonly used with Adobe and Photoshop apps. We can therefore proceed to extract the XMP data to obtain our flag.

dd bs=1 if=bean.jpeg skip=718 count=3827

This article came in handy

Deep Dive

Commitment-50pts

We have an interesting challenge here testing our git skills. From the challenge name and description, this entails commit messages.

git log

Running git log allows us to view information about previous commits that have occurred in a project.

We get our flag :)

Shape shifter-50pts

From the challenge description, we may have embedded information within the pdf. I thought of first running strings to get any low hanging fruits.

Didn’t get anything, so I extracted embedded data using binwalk a tool for searching for embedded data within files.

binwalk -Me proceedings.pdf #recursively extract files from the pdf

We get a number of files

The versatile file seems interesting

We get our flag :)

Make me whole again

Some classic forensics file carving. Sweet :)

Unzip the broken.zip file and run file to get the details about the file types.

Interesting, the first file hints that we are working with a broken JPEG file. The appended letters of the files(a-v) also hints that if we joined the files in that order, we may get the original file

cat * > final #this command gives us the final appended data
eog final #this command opens the jpeg file

Matroska-50pts

“”Matroska” is derived from matryoshka , the Russian word for the hollow wooden dolls which open to expose another smaller doll, that in turn opens to expose another doll, and so on.”

The file we get didn’t require automation to get the flag as the nesting wasn’t intense :D, simply extract the nested to extract your flag

Back to the future-50pts

This particular challenge was rather interesting.

We get a file that looks like the normal linux home directory structure. Well, let’s get prying. Our challenge description hints that our focus point should be at the bash_history.

So I tried grepping for the string aspire then for the string flag

We get some interesting info. flag.txt gets created and converted to a script.

cat flag.sh | curl -F ‘f:1=<-’ ix.io This line sticks out. I tried accessing ix.io to understand what this line meant.

Nice, a command line pastebin. Where users can store texts , in this case, commands. Running the highlighted command generates a link which contains the output of the command

This means that the last command cat flag.sh | curl -F ‘f:1=<-’ ix.io > .cache/.url will redirect the generated link to .cache/.url

All we need to do is access the link and get the flag

Time travel-100pts

Hmm, time travel ?

Another git challenge, sweet :D

git status
git log

The highlighted commit hash message stuck out. The redacted info could be our flag. We can use git checkout to check that commit out, then git log -p to inspect what was modified, the location of the changes and the changes that were made.

We get our flag :)

Backdoors-250pts

This was a rather simple challenge for 250pts :)

The flag was located in the /home/backdoor/ directory.

Backdoors-Hide and Seek-250pts

This challenge didn’t require any priv esc, At first I thought is was guessy but this was my thought process after getting some help from a friend. If I was to check for a backdoor in a system, I would try monitor for running processes using command like netstat ss lsof ps I tried typing out these command but didn’t get much.

But upon viewing the actual scripts …

We get the flag :)

Escape Room — 250 pts

Well, given the ssh creds. Let’s try accessing the server

The ssh connection immediately closes upon connection. hmmm, an ssh jail?

My workaround for this challenge was to directly pass commands into the ssh session before the connection is shut down

Using the flag -t allows you to pass commands into the ssh connection . I also used sshpass, a utility that provides non-interactive password prompt. We can now output our flag

sshpass -p escape ssh -t escape@68.183.92.119 'cat flag.txt'

We get the flag :)

That’s it for linux skills

Networking

The networking bit was equally as fun and beginner friendly, here are all solves for the challenges.

The wire-50pts

From the challenge description it was likely the flag was captured in the network. Ran strings to output it

strings cisco.pcapng

We get the flag at the bottom

Redirection-50pts

The challenge involves HTTP redirection

Redirections in HTTP

From the above article, I followed that to identify redirection you check for 301 and 302 status codes in the packet capture

We get a packet, moving on to analyzing it

Right click on the packet > Follow > TCP stream

The highlighted text contains the URI path that the client was redirected from

Gateway-50pts

The quickest way to identify the router was check for ARP requests. Usually for remote hosts to make a connection to the network, an ARP to the default gateway is made that triggers a series of ARPs from that gateway or router throughout the network. This can help us trace the router

Filter for arp packets and we get the devices sending ARP requests

The highlighted one is our router, it’s MAC is provided.

Certs-50pts

x509 is a standard defining the format for public certificates, commonly used in TSL/SSL.

To get the x509 certificate we need to filter for ssl and observe the packet which is has certificate in the description. Expanding this in the description gives the serial number.

Wireless One-50pts

To identify the attacker’s IP, we must first take into consideration what type of attack is being carried out.

If you observer the protocol of the communication, you can see 802.11, a protocol used to implement wireless LAN. In the context of wi-fi based attacks I thought of MITM where the attacker could intercept packets.

Further extrapolating this thought process, we arrive at a deauthentication attack. The attacker here, attempts to deauthenticate users in the network and capture their tcp 4-way handshake once they try to reauthenticate.

In our packet capture, identify the deauthentication packet, the source is the attacker

Wireless Two-150pts

To get the password to the network, all we need to do is to crack the 4-way handshake packet capture. We can use air-crack ng for this

aircrack-ng subzero.cap -w /opt/rockyout.txt

We get the key !

Resolver-50pts

In a forward DNS lookup, the DNS is queried for the IP address of a certain hostname. In a reverse DNS lookup It’s where the hostname of a certain IP address is queried. Basically, a reverse DNS lookup returns the hostname of an IP address.

From the challenge description, we can narrow down our search by investigating IPs outside Kenya. Wireshark has plugins that allow you to check the location of an IP

HowToUseGeoIP

To inspect the locations of the IP in the packet capture go to

statistics > endpoints

The IP 62.8.64.6 contains our reverse DNS records

Using this site, I queried the IP and got the results

Reverse IP Lookup - MxToolbox

Attribution-150pts

In this particular challenge, we need to check the location of the IP. This particular article comes in handy in using the GeoIP database

HowToUseGeoIP

Go to statistics > endpoints , the first entry contains our answer

Fingerprint-250pts

In TLS, the way the encryption is implemented can be fingerprinted. This fingerprint can be added to list of factors used to determine if you are who you say you are. JA3 is a method for creating this fingerprints

To solve this challenge we need to install the following plugin

fullylegit/ja3

Copy the ja3.lua file to your wireshark/plugins.

You may need to create this folder incase it does not exist. In linux , I created the folder in this path

/home/<username>/.config/wireshark/plugins

Naturally, it only makes sense to establish the TSL at the start of the communication. You can see this in the packet called Client Hello which is the start of TSL handshake

You get the ja3 fingerprint hash

That concludes the entire writeup for Aspire CTF. Hope you learnt something :)

Like, share and follow for more ! Happy hacking :)