{"id":2434,"date":"2018-04-01T17:39:39","date_gmt":"2018-04-01T15:39:39","guid":{"rendered":"https:\/\/www.asafety.fr\/?p=2434"},"modified":"2018-04-01T18:15:45","modified_gmt":"2018-04-01T16:15:45","slug":"ctf-ndh-2018-quals-write-up-network-kebab-sto","status":"publish","type":"post","link":"https:\/\/www.asafety.fr\/en\/cryptologie\/ctf-ndh-2018-quals-write-up-network-kebab-sto\/","title":{"rendered":"[CTF NDH 2018 Quals] Write-Up \u2013 Network : Kebab STO"},"content":{"rendered":"<p><\/p>\n<p style=\"text-align: center;\"><strong>Write-up of the challenge \u201cNetwork \u2013 Kebab STO\u201d of Nuit du\u00a0Hack 2018 CTF qualifications.<\/strong><\/p>\n<p>The weekend of 03\/31\/2018 is pre-qualification for the <strong><a href=\"https:\/\/nuitduhack.com\/fr\/\" target=\"_blank\" rel=\"noopener\">Nuit du Hack 2018<\/a><\/strong>\u00a0as a <strong>Jeopardy CTF<\/strong>. Having had the opportunity and the time to participate with some colleagues and friends, here\u2019s a write-up resolution of the challenges which we could participate.<\/p>\n<ul>\n<li>Category: <strong>Network<\/strong><\/li>\n<li>Name: <strong>Kebab STO<\/strong><\/li>\n<li>Description : <em>The challenge consists in finding the flag into a network capture.<\/em><\/li>\n<li>URL : tcp:\/\/kebabsto.challs.malice.fr:8888\/<\/li>\n<li>File :\u00a0<a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/kebabsto.zip\" target=\"_blank\" rel=\"noopener\">kebabsto.pcapng<\/a>\u00a0(149.66kB &#8211; c714bd030c959275df197ca7a392c21d3f68fa9fd6a161ab7ffa5e896ef7f0eb)<\/li>\n<li>Points : <strong>350<\/strong><\/li>\n<\/ul>\n<p>This challenge is about a pcapng analysis using a TCP service <strong>kebabsto.challs.malice.fr:8888<\/strong>\u00a0too.<\/p>\n<p>Opening with Wireshark the\u00a0<a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/kebabsto.zip\" target=\"_blank\" rel=\"noopener\">kebabsto.pcapng<\/a>, and try to export HTTP objects :<\/p>\n<div id=\"attachment_2437\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k01.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2437\" class=\"size-medium wp-image-2437\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k01-300x192.png\" alt=\"HTTP objects\" width=\"300\" height=\"192\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k01-300x192.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k01-768x493.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k01-1024x657.png 1024w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k01.png 1442w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2437\" class=\"wp-caption-text\">HTTP objects<\/p><\/div>\n<p>The first object is the HTML source code of an Apache &#8220;index of&#8221; referencing one file called &#8220;kdsqfkpdsdf&#8221; and the second is this file itself.<\/p>\n<p>The &#8220;kdsqfkpdsdf&#8221; file is a ZIP archive, extract it :<\/p>\n<div id=\"attachment_2438\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k04.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2438\" class=\"size-medium wp-image-2438\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k04-300x68.png\" alt=\"kdsqfkpdsdf identification\" width=\"300\" height=\"68\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k04-300x68.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k04.png 528w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2438\" class=\"wp-caption-text\">kdsqfkpdsdf identification<\/p><\/div>\n<p>Before the analysis of the ZIP content, continue on the initial PCANG file. There are several IMAP\/SMTP exchanges :<\/p>\n<div id=\"attachment_2439\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k02.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2439\" class=\"size-medium wp-image-2439\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k02-300x165.png\" alt=\"IMAP exchange\" width=\"300\" height=\"165\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k02-300x165.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k02-768x423.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k02-1024x564.png 1024w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k02.png 1816w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2439\" class=\"wp-caption-text\">IMAP exchange<\/p><\/div>\n<p>These IMAP exchanges are authenticated :<\/p>\n<pre>AHRvbWF0ZUBkZWJpYW4ueW8AdG9tYXRlMTIz\r\nBase64 decode : tomate@debian.yo:tomate123<\/pre>\n<p>Plus, an attachment is present in one email (encoded as Base64) :<\/p>\n<div id=\"attachment_2440\" style=\"width: 176px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k03.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2440\" class=\"size-medium wp-image-2440\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k03-166x300.png\" alt=\"IMAP attachement\" width=\"166\" height=\"300\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k03-166x300.png 166w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k03.png 566w\" sizes=\"auto, (max-width: 166px) 100vw, 166px\" \/><\/a><p id=\"caption-attachment-2440\" class=\"wp-caption-text\">IMAP attachement<\/p><\/div>\n<p>We can retrieve this attachement via <a href=\"https:\/\/www.base64decode.org\/\" target=\"_blank\" rel=\"noopener\">online service<\/a> :<\/p>\n<div id=\"attachment_2441\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k05.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2441\" class=\"size-medium wp-image-2441\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k05-300x185.png\" alt=\"Decode IMAP attachement\" width=\"300\" height=\"185\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k05-300x185.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k05.png 624w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2441\" class=\"wp-caption-text\">Decode IMAP attachement<\/p><\/div>\n<p>This new file is a ZIP archive too with 2 files :<\/p>\n<ul>\n<li>docs\/pubkey.pem : an RSA 1024b public key. none of RSA attack technics work on it (factordb, Wiener, etc.)<\/li>\n<li>docs\/cipherText : a big integer number as ciphertext<\/li>\n<\/ul>\n<p>The email content from the PCAP is also interresting. There is precision about the TCP 8888 service :<\/p>\n<blockquote><p>They also retrieved a public key and an interesting cipher text<br \/>\n(attached documents).<\/p>\n<p>Besides, they also found a service at mydomainndh.ndh (port 55555) which<br \/>\ndecrypts every text encrypted with the public key, apart from the<br \/>\ninteresting one.<\/p><\/blockquote>\n<p>There is a little mistake, it&#8217;s not the 55555 port but 8888 in reality. So this service implements the pubkey.pem to decrypt ciphertext submited. Try it with the content of &#8220;cipherText&#8221; :<\/p>\n<pre>72873754879996948796542757182427480866384878894019674005699447004829908491467629529161961884224325941110935083467870715412599916138560976722953815670278067115980556377912852138532905866093650699880301357138301236748217037629036311469031537013958415575513723738671978421707050599317605219729945496472798064172<\/pre>\n<div id=\"attachment_2442\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/kebab.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2442\" class=\"size-medium wp-image-2442\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/kebab-300x76.png\" alt=\"8888 service\" width=\"300\" height=\"76\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/kebab-300x76.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/kebab-768x195.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/kebab-1024x260.png 1024w, https:\/\/www.asafety.fr\/wp-content\/uploads\/kebab.png 1589w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2442\" class=\"wp-caption-text\">8888 service<\/p><\/div>\n<p>Yeah ! It seems to be a password. But where and when can we use it ?<\/p>\n<p>Go back earlier to the analysis of the\u00a0kdsqfkpdsdf file retrieved from HTTP exchanges. It&#8217;s a ZIP containing another PCAP file :<\/p>\n<div id=\"attachment_2443\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k06.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2443\" class=\"size-medium wp-image-2443\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k06-300x37.png\" alt=\"lkdjflknezcz file\" width=\"300\" height=\"37\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k06-300x37.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k06-768x96.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k06.png 770w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2443\" class=\"wp-caption-text\">lkdjflknezcz file<\/p><\/div>\n<p>Load it in Wireshark :<\/p>\n<div id=\"attachment_2444\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k07.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2444\" class=\"size-medium wp-image-2444\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k07-300x230.png\" alt=\"lkdjflknezcz PCAP file\" width=\"300\" height=\"230\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k07-300x230.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k07-768x589.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k07-1024x785.png 1024w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k07.png 1068w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2444\" class=\"wp-caption-text\">lkdjflknezcz PCAP file<\/p><\/div>\n<p>Several Wifi-WAP encrypted exchanges from an access-point called &#8220;wifiAccess&#8221; are available. Authentication requests too. We can try to break the WPA passphrase via the rockyou.txt wordlist :<\/p>\n<div id=\"attachment_2445\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k08.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2445\" class=\"size-medium wp-image-2445\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k08-300x195.png\" alt=\"Aircrack\" width=\"300\" height=\"195\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k08-300x195.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k08-768x499.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k08.png 801w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2445\" class=\"wp-caption-text\">Aircrack<\/p><\/div>\n<p>Bingo, the WPA passphrase is &#8220;abcdefgh&#8221;, we can now decrypt this PCAP file to see it&#8217;s real content :<\/p>\n<div id=\"attachment_2446\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k09.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2446\" class=\"size-medium wp-image-2446\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k09-300x64.png\" alt=\"Airdecap\" width=\"300\" height=\"64\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k09-300x64.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k09.png 754w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2446\" class=\"wp-caption-text\">Airdecap<\/p><\/div>\n<p>In this decrypted PCAP file, we can get :<\/p>\n<ul>\n<li>Several TCP exchanges (but only ACK) ;<\/li>\n<li>IMAP\/SMTP authenticated exchanges (new credentials\u00a0fromage@debian.yo:fromage123);<\/li>\n<li>FTP exchange with content as hexadecimal value :<\/li>\n<\/ul>\n<div id=\"attachment_2447\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k10.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2447\" class=\"size-medium wp-image-2447\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k10-300x216.png\" alt=\"FTP file\" width=\"300\" height=\"216\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k10-300x216.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k10-768x552.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k10-1024x736.png 1024w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k10.png 1410w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2447\" class=\"wp-caption-text\">FTP file<\/p><\/div>\n<p>We recreate the file send through FTP with a little Python script and analyze it :<\/p>\n<div id=\"attachment_2448\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k11.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2448\" class=\"size-medium wp-image-2448\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k11-300x48.png\" alt=\"FTP file analysis\" width=\"300\" height=\"48\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k11-300x48.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k11-768x124.png 768w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k11-1024x165.png 1024w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k11.png 1589w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2448\" class=\"wp-caption-text\">FTP file analysis<\/p><\/div>\n<p>Another ZIP file ! But this one is password protected&#8230; We can try all credential retrieved (tomate123, fromage123, the WPA key, the password unciphered via the TCP 8888 service) :<\/p>\n<div id=\"attachment_2449\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k12.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2449\" class=\"size-medium wp-image-2449\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k12-300x67.png\" alt=\"Unzip password\" width=\"300\" height=\"67\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k12-300x67.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k12.png 432w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2449\" class=\"wp-caption-text\">Unzip password<\/p><\/div>\n<p>YES ! It was the password from the TCP service &#8220;Th1s1s2P@ss_W0rd%M0f0&#8221;. A final file is extracted with ASCII content :\u00a0<strong>slkfdsflj<\/strong>.<\/p>\n<div id=\"attachment_2450\" style=\"width: 310px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k13.png\"><img loading=\"lazy\" decoding=\"async\" aria-describedby=\"caption-attachment-2450\" class=\"size-medium wp-image-2450\" src=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k13-300x63.png\" alt=\"Flag Kebab STO\" width=\"300\" height=\"63\" srcset=\"https:\/\/www.asafety.fr\/wp-content\/uploads\/k13-300x63.png 300w, https:\/\/www.asafety.fr\/wp-content\/uploads\/k13.png 390w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><p id=\"caption-attachment-2450\" class=\"wp-caption-text\">Flag Kebab STO<\/p><\/div>\n<p>Greeting to the whole team ! :)<\/p>","protected":false},"excerpt":{"rendered":"<p>Write-up of the challenge \u201cNetwork \u2013 Kebab STO\u201d of Nuit du\u00a0Hack 2018 CTF qualifications. The weekend of 03\/31\/2018 is pre-qualification [&hellip;]<\/p>\n","protected":false},"author":1337,"featured_media":1963,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58,56,524,523,526,531],"tags":[456],"class_list":["post-2434","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptanalyse","category-cryptologie","category-ctf","category-events","category-ndh","category-ndh2k18","tag-joepardy"],"_links":{"self":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/2434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/users\/1337"}],"replies":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/comments?post=2434"}],"version-history":[{"count":7,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/2434\/revisions"}],"predecessor-version":[{"id":2457,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/posts\/2434\/revisions\/2457"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media\/1963"}],"wp:attachment":[{"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/media?parent=2434"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/categories?post=2434"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.asafety.fr\/en\/wp-json\/wp\/v2\/tags?post=2434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}