Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 0c7281b

Browse files
cacama-valvatacacama-valvata
committed
2021-2023 blogposts
1 parent 5d3b2d2 commit 0c7281b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+735
-0
lines changed

‎content/blog/0x41414141-ctf-0x414141.md

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
---
2+
title: "0x41414141 CTF - 0x414141"
3+
author: "Lyell Read"
4+
date: 2021-02-02T00:00:00-07:00
5+
categories: ['Writeups']
6+
tags: ['0x41414141 ctf']
7+
caption: "0x41414141 CTF logo"
8+
9+
draft: false
10+
---
11+
12+
## Prompt
13+
14+
I think offshift promised to opensource some of their code
15+
16+
author: notforsale
17+
18+
## Solution
19+
20+
First off, we navigate to the [offshift-dev](https://github.com/offshift-dev/assets/commits/master) github account, linked from the offshift site. Unfortunately, nothing there. Searching google for “offshift github” brings us to a different github with a [single suspicious repository](https://github.com/offshift-protocol/promo). This has two commits, one where files are uploaded, and one in which the \__pycache__ folder is deleted. That folder sounds interesting, so we clone the repository, and checkout the commit where the files were added:
21+
22+
```
23+
git clone [email protected]:offshift-protocol/promo.git
24+
cd promo
25+
git checkout dc43c1ac33f767a7d30dbeab123a1c87566e885d
26+
cd __pycache__
27+
```
28+
29+
There, we see one `.pyc` file, which is very likely where the interesting part of this challenge is. To understand it, we use uncompyle6:
30+
31+
```
32+
pip3 install uncompyle6 --user
33+
uncompyle6 script.cpython-38.pyc > ../../uncompyled.py
34+
```
35+
36+
Now, upon reviewing that file, we see that we have some interesting cipher of sorts that uses XOR and base64 somehow:
37+
38+
```
39+
import base64
40+
secret = 'https://google.com'
41+
cipher2 = [b'NDE=', b'NTM=', b'NTM=', b'NDk=', b'NTA=', b'MTIz', b'MTEw', b'MTEw', b'MzI=', b'NTE=', b'MzQ=', b'NDE=', b'NDA=', b'NTU=', b'MzY=', b'MTEx', b'NDA=', b'NTA=', b'MTEw', b'NDY=', b'MTI=', b'NDU=', b'MTE2', b'MTIw']
42+
cipher1 = [base64.b64encode(str(ord(i) ^ 65).encode()) for i in secret]
43+
```
44+
45+
From a little deduction, we can guess that the creation of `cipher1` based on `secret` is how the list `cipher2` was developed. Therefore, to decipher that array, we simply need to reverse the list comprehension that generates `cipher1`.
46+
47+
Working from the outside to the inside (to reverse the operations done during enciphering), we will need to first base64 decode each element. Then, we will have to cast it to an int (the output of `ord()`), and then use `chr()` to undo the `ord()` operation. Lastly we must undo the XOR with 65, which can be done by simply XORing it again. This can all be accomplished as so:
48+
49+
```
50+
print(''.join([chr(int(base64.b64decode(x)) ^ 65) for x in cipher2]))
51+
```
52+
53+
From that, we get a URL: [https://archive.is/oMl59](https://archive.is/oMl59). That archive is a post on 4chan’s /x/ board where the original poster included a link to a [mega.nz file download](https://mega.nz/file/AAdDyIoB#gpj5s9N9-VnbNhSdkJ24Yyq3BWSYimoxanP-p03gQWs). This downloads what appears to be a corrupt “PDF” [file called smashing.pdf], which `file` identifies as “data”, indicating that there are no identifiable magic bytes.
54+
55+
> NOTE: At this point, inference is made that this PDF is encrypted with a repeating key that makes use of the magic bytes to reverse.
56+
57+
From Wikipedia, we can see that a PDF file should start with `25 50 44 46 2d`, so we perform an XOR to determine what the key that was used to encrypt this PDF was.
58+
59+
```
60+
25 50 44 46 2d -- PDF Magic Bytes
61+
^ 64 11 05 07 6c -- Start of smashing.pdf
62+
----------------
63+
= 41 41 41 41 41 -- key used to encrypt
64+
```
65+
66+
I would not expect anything less. Therefore, we need to decrypt the whole PDF using this key, and for that, we can use a python script like this one:
67+
68+
```
69+
with open("smashing.pdf", "rb") as f:
70+
contents = f.read()
71+
72+
key = b"\x41\x41\x41\x41"
73+
out = b""
74+
for i in range(len(contents)):
75+
out += bytes([contents[i] ^ key[i % len(key)]])
76+
77+
with open("done_xor.pdf", "wb") as f:
78+
f.write(out)
79+
```
80+
81+
```
82+
file done_xor.pdf
83+
done_xor.pdf: PDF document, version 1.4
84+
```
85+
86+
That’s much better, but there’s more. When running `strings` on that file, we see references to `flag.txt`, so this could be real steganography. To find out, we use `foremost`:
87+
88+
```
89+
dd if=done_xor.pdf | foremost
90+
Processing: stdin
91+
|360+1 records in
92+
360+1 records out
93+
184539 bytes (185 kB, 180 KiB) copied, 0.0017788 s, 104 MB/s
94+
foundat=flag.txtUT
95+
*|
96+
```
97+
98+
Interesting, so we appear to have recovered something. Looking through `foremost`‘s [output folder](https://github.com/lyellread/ctf-writeups/blob/master/2021-0x41414141/0x414141/output), we can see that it sliced a PDF and a Zip archive. Next, we have to unzip that, presumably. Let’s give that a shot:
99+
100+
```
101+
unzip foremost.zip
102+
Archive: foremost.zip
103+
[foremost.zip] flag.txt password:
104+
```
105+
106+
We need a password, and because we do not know it, we are going to have to crack it. To do so, we must build John The Ripper from source (to have access to `zip2john`). For that, I followed [this handy guide](https://hackthestuff.com/article/how-to-install-john-the-ripper-in-linux-and-crack-password). Once installed, it’s as easy as:
107+
108+
```
109+
zip2john foremost.zip > hashes
110+
john hashes --show
111+
foremost/flag.txt:passwd:flag.txt:foremost::foremost
112+
1 password hash cracked, 0 left
113+
```
114+
115+
Armed with our password `passwd`, we attack the Zip, and get the flag:
116+
117+
```
118+
flag{1t_b33n_A_l0ng_w@y8742}
119+
```
120+
121+
~ Lyell

‎content/blog/2021-2022-osusec-officers-decided.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
title: "2021-2022 OSUSEC Officers Decided"
3+
author: "Lyell Read"
4+
date: 2021-04-24T00:00:00-07:00
5+
categories: ['Club News', 'Meeting Notes']
6+
tags: ['2021-2022 elections']
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
For the coming school year, we welcome in 8 officers, in the following positions:
13+
14+
- President: Lyell Read
15+
- Vice President: Zach Taylor
16+
- Treasurer: Mike Carris
17+
- Lab Manager: Cameron McCawley
18+
- Community Manager: Christa Wright
19+
- Recruitment: Brandon Ellis
20+
- CTF League Coordinator: Allen Benjamin
21+
- Graphic Designer: Sierra Freihoefer
22+
23+
This year is the first year that the posts of Recruitment Officer, CTF League Coordinator, and Community Manager were officially up for grabs. All three were positions that were voted in during the past year by the current officers, to respond to needs for these roles.
24+
25+
Thanks to everyone who participated!

‎content/blog/2022-2023-osusec-officers-decided.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
title: "2022-2023 OSUSEC Officers Decided"
3+
author: "Lyell Read"
4+
date: 2022-04-13T00:00:00-07:00
5+
categories: ['Club News']
6+
tags: ['elections']
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
The votes are in! After an entertaining election with some contested positions and contestants running from the floor, the officers for the next academic year, 2022-2023.
13+
14+
**President:** Cameron McCawley
15+
**Vice President:** Casey Colley
16+
**Treasurer:** Mike Carris
17+
**Lab Manager:** Lucas Ball
18+
**CTF League Coordinator:** Allen Benjamin
19+
**Recruitment Officer**: Brandon Ellis (Interim)
20+
**Community Manager:** Gabriel Kulp
21+
22+
Thanks to everyone who participated!

‎content/blog/2023-2024-osusec-officers-selected.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: "2023-2024 OSUSEC Officers Selected"
3+
author: "Julie Weber"
4+
date: 2023-04-24T00:00:00-07:00
5+
categories: ['Club News']
6+
tags: ['elections']
7+
caption: "The club's new 6 officers in front of screens and a whiteboard"
8+
9+
draft: false
10+
---
11+
12+
This year’s elections were intense; every candidate was subjected to memes, music, and whiteboard art that led to a lot of laughs and a lot of great people elected. Without further adieu, here are your officers for the 2023-2024 academic year:
13+
14+
**President:** Casey Colley
15+
**Vice President:** Otso Barron
16+
**Treasurer:** Abigail Whittle
17+
**Lab Manager:** Lucas Ball
18+
**CTF League Coordinator:** Zane Othman-Gomez
19+
**Recruitment and Community Outreach Manager:** Julie Weber
20+
21+
Thank you to all who came (or attended on Discord) and took part in democracy!

‎content/blog/bsidespdx-2022.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
title: "BSidesPDX 2022"
3+
author: "Casey Colley"
4+
date: 2022-10-08T00:00:00-07:00
5+
categories: ['Club News']
6+
tags: []
7+
caption: "OSUSEC members pose on stage after their first-place win being announced. "
8+
9+
draft: false
10+
---
11+
12+
Howdy Hackers! This Friday, a group of OSUSEC members took a day trip up to Portland to attend BSidesPDX 2022 and compete in their CTF. We had an absolute blast, winning first place in the CTF, attending many interesting talks, and making some new friends! We became known as the team competing in the closet, as the CTF team set up fort in a nearby maintenance closet instead of the official CTF room. For our win, the club won a Flipper Zero and bragging rights 🙂
13+
14+
Many thanks to the BSidesPDX crew for hosting another great year! The passion and hard work they bring to organizing the event is evident, and a treat every year.
15+
16+
For more information on BSidesPDX, please visit: [https://bsidespdx.org/](https://bsidespdx.org/)
17+
18+
![The OSUSEC team at BSides, crammed into an elevator, ready to head home.](/static/blog/bsidespdx-2022-elevator.jpg)
19+
20+
![The CTF team in the “Big W” closet.](/static/blog/bsidespdx-2022-closet.jpg)

‎content/blog/crowdstrike-adversary-quest-much-sad.md

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
title: "Crowdstrike Adversary Quest - Much Sad"
3+
author: "Lyell Read"
4+
date: 2021-02-02T00:00:00-07:00
5+
categories: ['Writeups']
6+
tags: ['crowdstrike adversary quest']
7+
caption: "Logo for Crowdstrike Adversary Quest"
8+
9+
draft: false
10+
---
11+
12+
# Prompt
13+
14+
We have received some information that CATAPULT SPIDER has encrypted a client’s cat pictures and successfully extorted them for a ransom of 1337 Dogecoin. The client has provided the ransom note, is there any way for you to gather more information about the adversary’s online presence?
15+
16+
NOTE: Flags will be easily identifiable by following the format `CS{some_secret_flag_text}`. They must be submitted in full, including the `CS{ and }` parts.
17+
18+
Files: [muchsad.txt](https://github.com/lyellread/ctf-writeups/blob/master/2021-crowdstrike-adversary/catapult-spider/much-sad/muchsad.txt)
19+
20+
## Solution
21+
22+
First task: understand the file we are provided:
23+
24+
```
25+
+------------------------------------------------------------------------------+
26+
| |
27+
| ,oc, |
28+
| BAD CAT. ,OOxoo, .cl:: |
29+
| ,OOxood, .lxxdod, |
30+
| VERY CRYPTO! :OOxoooo. 'ddddoc:c. |
31+
| :kkxooool. .cdddddc:::o. |
32+
| :kkdoooool;' ;dxdddoooc:::l; |
33+
| dkdooodddddddl:;,''... .,odcldoc:::::ccc; |
34+
| .kxdxkkkkkxxdddddddxxdddddoolccldol:lol:::::::colc |
35+
| 'dkkkkkkkkkddddoddddxkkkkkxdddooolc:coo::;'',::llld |
36+
| .:dkkkkOOOOOkkxddoooodddxkxkkkxddddoc:::oddl:,.';:looo: |
37+
| ':okkkkkkkOO0000Okdooodddddxxxxdxxxxdddddoc:loc;...,codool |
38+
| 'dkOOOOOOkkkO00000Oxdooddxxkkkkkkxxdddxxxdxxxooc,..';:oddlo. |
39+
| ,kOOO0OOkOOOOOO00OOxdooddxOOOOOkkkxxdddxxxxkxxkxolc;cloolclod. |
40+
| .kOOOO0Okd:;,cokOOkxdddddxOO0OOOOOkxddddddxkxkkkkkxxdoooollloxk' |
41+
| l00KKKK0xl,,.',xkkkkkxxxxkOOOkkOkkkkkxddddddxkkkkkkkkxoool::ldkO' |
42+
| '00KXXKK0oo''..ckkkkkkkOkkkkkkxl;'.':oddddddxkkkkkkkkkkkdol::codkO. |
43+
| xKKXXK00Oxl;:lxkkkkkkOOkkddoc,'lx:' ;lddxkkkkkkkxkkkkkxdolclodkO. |
44+
| ;KKXXXK0kOOOOOkkkkOOOOOOkkdoc'.'o,. ..,oxkkkOOOkkkkkkkkkkddoooodxk |
45+
| kKXKKKKKOOO00OOO00000OOOkkxddo:;;;'';:okOO0O0000OOOOOOOOOkkxddddddx |
46+
| .KKKKKKKKOkxxdxkkkOOO000OkkkxkkkkkxxkkkkkOO0KKKKK0OOOO000OOOkkdddddk. |
47+
| xKKKKKKc,''''''';lx00K000OOkkkOOOkkkkkkkkO0KKKKKK0OO0000O000Okkxdkkx |
48+
| 'KK0KKXx. .. ...'xKKKK00OOOOO000000000OO0KKKKKKKKKKKKK0OOOOOkxdkko |
49+
| xKKKKKXx,... .,dKXKK00000000KKKKKKKKKKKKKKKKKKKK000OOOOOOkxddxd. |
50+
| ,KKKKKXKd'..... ..,ck00OOOOOOkO0KKKKKKKKKKKKKKKKKK0OOOOkkkkkkkxdddo. |
51+
| .KKKKK0xc;,......',cok0O0OOOkkkk0KKKK00000KKK000OOOkkkkkkkkkkkxdddd. |
52+
| .KKKKK0dc;,,'''''',:oodxkkkkkkkkkOOOOkOOOOkkkkkkkkkkkkkkkOOkkxdddd, |
53+
| 0KKKKK0x;'. ...';lodxxkkkkkkddkkkkkkkkkkkkkkkkkkOOOOOkkOkkkxddc |
54+
| xKKKKKK0l;'........';cdolc:;;;:lkkkkkkkkkkkkkkkkOO000OOOOOOkxddd. |
55+
| :KKKKK00Oxo:,'',''''...,,,;;:ldxkkkkkkkkkkkkkOkkOOOOOOOOkkkxddd' |
56+
| oKKKKK0OOkxlloloooolloooodddxkkkkkkkkkkkkkkkkkkkkkkkOOkkkxddd. |
57+
| :KKK00OO0OOkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkO0Okkkkkkkkxddd: |
58+
| o0KK00000000OOkkkkkkkkkkkkkkkkkkkkkkkkkkO0000Okkkkkkxdo;. |
59+
| 'd00000000OOOOOOkkkkkkkkkkkkkkkkkOkOO00Okkkkkkkkkkko, |
60+
| .oO00000OOOOOkkkkkkkkkkkkkkkkkkOOOOkOOkkkkkkkkko' |
61+
| .;xO0OOOOOOkkkkkkkkkkkkkkkkkkkkkOkkkkkkkkd:. |
62+
| .lxOOOOkkkkkkkkkkkkkkkkkkkxxxkkkkkd:' |
63+
| .;okkkkkkkkxxkkdxxddxdxdolc;'.. |
64+
| ...',;::::::;;,'... |
65+
| |
66+
| MUCH SAD? |
67+
| 1337 DOGE = 1337 DOGE |
68+
| DKaHBkfEJKef6r3L1SmouZZcxgkDPPgAoE |
69+
| SUCH EMAIL [email protected] |
70+
+------------------------------------------------------------------------------+
71+
```
72+
73+
The description mentions that dogecoin is involved, and the hash `DKaHBkfEJKef6r3L1SmouZZcxgkDPPgAoE` is likely related to that. Therefore, our first order of business is to check that lead out. Not being an expert, that dead-ends [here](https://dogechain.info/address/DKaHBkfEJKef6r3L1SmouZZcxgkDPPgAoE). Next, let’s look into that email.
74+
75+
After some searching, I did a [namechk](https://github.com/lyellread/ctf-writeups/blob/master/2021-crowdstrike-adversary/catapult-spider/much-sad/namechk.com) search for `shibegoodboi`, which indicated that the twitter account `@shibegoodboi` is in use. Looking towards [that account](https://twitter.com/shibegoodboi), we see a new blockchain address or hash of some sort (`D7sUiD5j5SzeSdsAe2DQYWQgkyMUfNpV2v`) and a github account for “shibefan” ([https://github.com/shibefan](https://github.com/shibefan)). That account has the saying “1 DOGE = 1 DOGE” and “shibegoodboi” so we are on the right track, and gives us another blockchain hash of some sort: `D6hRwJbGPxmXGWYfZ7t6S8MRkB7XrBJsLL`.
76+
77+
The first project listed on that github account is [a website](https://github.com/shibefan/shibefan.github.io), which contains an index.html file that contains our flag:
78+
79+
```
80+
CS{shibe_good_boi_doge_to_the_moon}
81+
```
82+
83+
~ Lyell

‎content/blog/cyberforce-competition-2022.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
title: "Cyberforce Competition 2022"
3+
author: "Casey Colley"
4+
date: 2022-11-08T00:00:00-07:00
5+
categories: ['Club News']
6+
tags: []
7+
caption: "Members of OSUSEC’s CDC Team and chaperone Emily Longman"
8+
9+
draft: false
10+
---
11+
12+
This past weekend, OSUSEC’s Cyberdefense Competition team flew out to Chicago, IL to compete in the Department of Energy’s Cyberforce Competition! We were tasked with securing and administering a network of 6 virtual machines, then defending it against a team of hackers. Cyberforce also tests students’ abilities to budget their time and respond to miscellaneous requests from managers relating to the NIST framework for cybersecurity. We brought home 10th place out of 169 teams, and placed 1st place for team style 😎
13+
14+
This year, we were also able to play in the Department of Energy’s CTF game “Conquer the Hill: Reign” on-site. The game is super fun and very well done. We had a blast.
15+
16+
The team consisted of Mike Carris, Sean Mack, Julie Weber, Otso Barron, Gabriel Kulp, and Casey Colley, and was chaperoned by Emily Longman.
17+
18+
Many thanks to Department of Energy, the Argonne National Laboratory, and especially Amanda Theel for all their endless hard work to put on Cyberforce every year, we really enjoy and appreciate it!

‎content/blog/doe-cyberforce-competition-2021.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
title: "DOE Cyberforce Competition 2021"
3+
author: "Lyell Read"
4+
date: 2021-11-21T00:00:00-07:00
5+
categories: ['Club News']
6+
tags: ['cyberforce']
7+
caption: "Cyberforce Competition logo"
8+
9+
draft: false
10+
---
11+
12+
On Nov. 13, 2021, the OSUSEC Cyber Defense Competition (CDC) Team placed 1st place regionally and 7th nationwide in the Department of Energy’s annual Cyberforce Competition ([https://cyberforcecompetition.com/](https://cyberforcecompetition.com/)) out of the 135 teams registered for the competition.
13+
14+
The team roster was:
15+
16+
- Casey Colley (Captain)
17+
- Mike Carris
18+
- Robert Detjens
19+
- Brandon Ellis
20+
- Huy Nguyen
21+
- Lyell Read
22+
23+
The final scoreboard was as follows, if a link to an official final scoreboard is made available, I will link it here.
24+
25+
![Screenshot of the scoreboard, showing Oregon State University in 7th place](/static/blog/doe-cyberforce-competition-2021-scoreboard.png)
26+
27+
We look forward to returning next year, even better prepared for the new competition format!
28+
29+
Well done team!!

‎content/blog/meeting-notes-1-12.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: "Meeting Notes 1/12"
3+
author: "Lyell Read"
4+
date: 2022-01-12T00:00:00-07:00
5+
categories: ['Meeting Notes']
6+
tags: []
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
Thank you to everyone who attended! This meeting covered the solutions to all NSA Codebreaker 2021 Tasks. I hope everyone enjoyed, questions can always be tossed into the `#nsacc-21` channel.
13+
14+
Here are the slides (requires ONID login): [Google Slides for 1/12/2021](https://docs.google.com/presentation/d/10GhgcgS0sxLY6MwnYGzMLmeJy28oujCk2oxR2RcJt_A/edit?usp=sharing)
15+
16+
The next meeting this week is for **CTF League on Friday 1/14/2021 @ 6:00pm – 8:00pm, virtually** (on Discord).

‎content/blog/meeting-notes-1-19.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: "Meeting Notes 1/19"
3+
author: "Lyell Read"
4+
date: 2022-01-19T00:00:00-07:00
5+
categories: ['Meeting Notes']
6+
tags: []
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
Thank you to everyone who attended! This meeting covered a presentation called “CS271 for Pwning”, an introduction to assembly and shellcoding with a focus on the useful aspects to pwning / binary exploitation.
13+
14+
Here are the slides (requires ONID login): [Google Slides for 1/19/2021](https://docs.google.com/presentation/d/1oKhRvxC4GU6rgEbQ3mqgAbZDw5V3vboRRaBOBzZhr3g/edit?usp=sharing)
15+
16+
The next meeting this week is for **CTF League on Friday 1/21/2021 @ 6:00pm – 8:00pm, virtually** (on Discord).

0 commit comments

Comments
 (0)