Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit fcf339b

Browse files
cacama-valvatacacama-valvata
committed
march april 2019
1 parent 2502bd9 commit fcf339b

31 files changed

+782
-0
lines changed

‎content/blog/2019-2020-officer-elections-on-april-25th.md

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
title: "2019-2020 Officer Elections on April 25th"
3+
author: "Zander Work"
4+
date: 2019-04-16T00:00:00-07:00
5+
categories: ['Meeting Notes', 'Club News']
6+
tags: []
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
We will be holding officer elections for next school year during our regular meeting on Week 4 (April 25th). This is a great way to be more involved with the club, and represent us to the College of Engineering.
13+
14+
Here are the positions (link goes to position duties):
15+
16+
- [President](https://docs.google.com/presentation/d/1zy1O0yru-iAo_0W-uHK87YRraQqCaZOt8MVcUy_dclc/edit#slide=id.g57d8caec5c_0_5)
17+
- [Vice President](https://docs.google.com/presentation/d/1zy1O0yru-iAo_0W-uHK87YRraQqCaZOt8MVcUy_dclc/edit#slide=id.g57d8caec5c_0_10)
18+
- [Treasurer](https://docs.google.com/presentation/d/1zy1O0yru-iAo_0W-uHK87YRraQqCaZOt8MVcUy_dclc/edit#slide=id.g57d8caec5c_0_21)
19+
- [Multimedia Coordinator](https://docs.google.com/presentation/d/1zy1O0yru-iAo_0W-uHK87YRraQqCaZOt8MVcUy_dclc/edit#slide=id.g57d8caec5c_0_29)
20+
- [Lab Manager](https://docs.google.com/presentation/d/1zy1O0yru-iAo_0W-uHK87YRraQqCaZOt8MVcUy_dclc/edit#slide=id.g57d8caec5c_0_34)
21+
22+
To run for a position, please do the following:
23+
24+
- Fill out [this form](https://forms.gle/hF4Jf9TzxMTetFqTA) no later than April 23rd
25+
- Send a slide (one slide) to [[email protected]](mailto:[email protected]) no later than April 23rd:
26+
- Name
27+
- Position
28+
- Info about yourself
29+
- Qualifications
30+
- etc.
31+
- Show up to our meeting on April 25th prepared for the following:
32+
- Up to 5 minute presentation on why you should be elected for your position
33+
- Up to 2 minutes Q/A
34+
35+
We will be voting in the meeting on the 25th, so if you want to vote you need to be there. If you aren’t able to be there (candidate or voter), please let me know (I might need to re-think this part).
36+
37+
There is lots more info on the [slides](https://docs.google.com/presentation/d/1zy1O0yru-iAo_0W-uHK87YRraQqCaZOt8MVcUy_dclc/edit#slide=id.g57d8caec5c_0_0).
38+
39+
Best of luck to all who run!

‎content/blog/2019-2020-officers.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
title: "2019-2020 Officers"
3+
author: "Zander Work"
4+
date: 2019-04-26T00:00:00-07:00
5+
categories: ['Meeting Notes', 'Club News']
6+
tags: []
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
Here are the new officers for the 2019-2020 school year:
13+
14+
- President: Zander Work
15+
- Vice President: Hadi Rahal-Arabi
16+
- Treasurer: David Park
17+
- Multimedia Coordinator: Adam Stewart
18+
- Lab Manager: Ryan Kennedy
19+
- Recruitment/Public Relations: Alex Rash
20+
21+
Thanks to everyone who participated!

‎content/blog/angstromCTF-lithp.md

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
---
2+
title: "ångstromCTF lithp"
3+
author: "Lyell Read"
4+
date: 2019-04-26T00:00:00-07:00
5+
categories: ['Writeups']
6+
tags: ['angstromctf']
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
## Problem
13+
14+
My friend gave me [this](https://github.com/lyellread/ctf-writeups/blob/master/angstromctf-2019/lithp-60/lithp.lisp) program but I couldn’t understand what he was saying – what was he trying to tell me?
15+
16+
Author: fireholder
17+
18+
Points: 60
19+
20+
## Solution
21+
22+
First things first, let’s open that lisp program . . . It actually is lisp… oh god what have I just gotten into?
23+
24+
The first lines were most important in solving this challenge the way I did it. It reads:
25+
26+
```
27+
(defparameter *encrypted* '(8930 15006 8930 10302 11772 13806 13340 11556 12432 13340 10712 10100 11556 12432 9312 10712 10100 10100 8930 10920 8930 5256 9312 9702 8930 10712 15500 9312))
28+
(defparameter *flag* '(redacted))
29+
(defparameter *reorder* '(19 4 14 3 10 17 24 22 8 2 5 11 7 26 0 25 18 6 21 23 9 13 16 1 12 15 27 20))
30+
```
31+
32+
Well, then. Given that I do not want to read more lisp than I have to (lest I end up depressed), let’s try to make some sense just based on those variables. With quite a bit of certainty, it appears that reorder is as it is named – an array of indexes that will reorder something. My guess is that it is applied like this:
33+
34+
```
35+
flag: 97 99 116 102 123 ... 125
36+
encrypt flag
37+
for entry[i] in encrypted_flag: place that element at output[reorder[i]]
38+
```
39+
40+
Now we need to try to unjumble this. I wrote up this mess to do that:
41+
42+
```
43+
#!/usr/bin/python
44+
45+
positions = [19, 4, 14, 3, 10, 17, 24, 22, 8, 2, 5, 11, 7, 26, 0, 25, 18, 6, 21, 23, 9, 13, 16, 1, 12, 15, 27, 20]
46+
values = [8930, 15006, 8930, 10302, 11772, 13806, 13340, 11556, 12432, 13340, 10712, 10100, 11556, 12432, 9312, 10712, 10100, 10100, 8930, 10920, 8930, 5256, 9312, 9702, 8930, 10712, 15500, 9312]
47+
output = []
48+
49+
for item in range (0, max(positions) + 1):
50+
index = positions.index(item) #get the index in values of element number item
51+
output.append(values[index]) #place that at the end of the output list
52+
53+
print (output)
54+
55+
$python3 ./undo_reorder.py
56+
[9312, 9702, 13340, 10302, 15006, 10712, 10100, 11556, 12432, 8930, 11772, 10100, 8930, 5256, 8930, 10712, 9312, 13806, 10100, 8930, 9312, 8930, 11556, 10920, 13340, 10712, 12432, 15500]
57+
```
58+
59+
Apparently, that should be in the right order. Let’s think about it with ASCII on the mind, we should have ‘actf{…}’. Looks about right with two very similar values in the spots where we would expect ‘{‘ and ‘}’…
60+
61+
But those aren’t ASCII! yeah, but they are transformations of ascii values. It cannot be a scalar that is added to the ASCII values of the respective flag characters, as the ‘{‘ and ‘}’ values would have to be 2 apart (‘{‘ = 123, ‘}’ = 125). There could be a scalar value that all the ASCII codes are multiplied by. Let’s check that first value, 9312, which should be related to ASCII 97 (‘a’):
62+
63+
```
64+
>>>9312/97
65+
96
66+
```
67+
68+
…interesting. Another: 15006 which should correspond to ‘{‘ or ASCII 123:
69+
70+
```
71+
>>>15006/123
72+
122
73+
```
74+
75+
OK. So the algorithm to encrypt the flag is just:
76+
77+
```
78+
for x in flag:
79+
code = ascii value of x
80+
encrypted_value = code * (code-1)
81+
```
82+
83+
Now we can complete the script:
84+
85+
```
86+
sorted = [9312, 9702, 13340, 10302, 15006, 10712, 10100, 11556, 12432, 8930, 11772, 10100, 8930, 5256, 8930, 10712, 9312, 13806, 10100, 8930, 9312, 8930, 11556, 10920, 13340, 10712, 12432, 15500]
87+
88+
letters = []
89+
decoded = []
90+
solved = []
91+
92+
for ascii in range (0, 128):
93+
letters.append(ascii*(ascii-1)) #create an array of all ascii values such that the index is the original value, and the value at that index is the encoded value.
94+
95+
for x in sorted:
96+
if x in letters:
97+
decoded.append(letters.index(x)) #create a decoded array of values
98+
99+
for x in decoded:
100+
solved.append(chr(x)) #convert to chars
101+
102+
print (''.join(solved)) #print that flag
103+
```
104+
105+
These two scrips together make up [decode_lithp.py](https://github.com/lyellread/ctf-writeups/blob/master/angstromctf-2019/lithp-60/decode_lithp.py).
106+
107+
```
108+
$python3 ./undo_encrypt.py
109+
actf{help_me_I_have_a_lithp}
110+
```

‎content/blog/angstromCTF-streams.md

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
---
2+
title: "ångstromCTF - streams"
3+
author: "Lyell Read"
4+
date: 2019-04-26T00:00:00-07:00
5+
categories: ['Writeups']
6+
tags: ['angstromctf']
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
## Problem
13+
14+
White noise is useful whether you are trying to sleep, relaxing, or concentrating on writing papers. Find some natural white noise [here](https://streams.2019.chall.actf.co/).
15+
16+
Note: The flag is all lowercase and follows the standard format (e.g. actf{example_flag})
17+
18+
Author: ctfhaxor
19+
20+
Points: 70
21+
22+
Hint: Are you sure that’s an mp4 file? What’s inside the file?
23+
24+
## Solution
25+
26+
First, we deduced some information about the challenge by reading the description. “The flag is all lowercase” implies that we will be constructing it letter by letter, possibly from audio. First thing to check out is the video on the linked website – just river sounds.
27+
28+
We then proceeded to inspect the website – the HTML looks pretty standard, and I decided to leave player.js alone and come back to it if we failed to find a solution (would be more of a web challenge at that point). Under the ‘Network’ tab, we see that there appear to be two streams of chunks:
29+
30+
![Screenshot of Network monitor on ](/static/blog/angstromctf-streams-network.jpg)
31+
32+
- chunk-stream0-0000*.m4s chunks initiated by init-stream0.m4s
33+
- chunk-stream1-0000*.m4s chunks initiated by init-stream1.m4s
34+
35+
In addition there are two attempts to get a file called stream.mp4 (one that has a status of 206 – partial content, and one 200 – complete)… interesting. We got the file using the “Request URL”:
36+
37+
```
38+
$wget https://streams.2019.chall.actf.co/video/stream.mp4
39+
$file stream.mp4
40+
stream.mp4: XML 1.0 document, ASCII text
41+
```
42+
43+
That’s interesting… Let’s open that in an editor. The XML reads as follows (cleaned up for conciseness):
44+
45+
```
46+
<?xml version="1.0" encoding="utf-8"?>
47+
48+
<AdaptationSet id="0" contentType="video" segmentAlignment="true" bitstreamSwitching="true" frameRate="30/1" lang="und">
49+
<Representation id="0" mimeType="video/mp4" codecs="avc1.64001f" bandwidth="278539187" width="1280" height="720" frameRate="30/1">
50+
...
51+
</Representation>
52+
</AdaptationSet>
53+
<AdaptationSet id="1" contentType="audio" segmentAlignment="true" bitstreamSwitching="true" lang="eng">
54+
<Representation id="1" mimeType="audio/mp4" codecs="mp4a.40.2" bandwidth="128000" audioSamplingRate="44100">
55+
<AudioChannelConfiguration schemeIdUri="urn:mpeg:dash:23003:3:audio_channel_configuration:2011" value="2" />
56+
...
57+
</Representation>
58+
</AdaptationSet>
59+
<AdaptationSet id="2" contentType="audio" segmentAlignment="true" bitstreamSwitching="true" lang="und">
60+
<Representation id="2" mimeType="audio/mp4" codecs="mp4a.40.2" bandwidth="48000" audioSamplingRate="8000">
61+
<AudioChannelConfiguration schemeIdUri="urn:mpeg:dash:23003:3:audio_channel_configuration:2011" value="1" />
62+
...
63+
</Representation>
64+
</AdaptationSet>
65+
</Period>
66+
</MPD>
67+
```
68+
69+
Notice that there are actually 3 streams: 0: mp4 video, 1, 2: mp4 audio. Our hunch that some audio will contain our flag is looking good, but how to get this last audio file? To ensure that we know how this process of ‘getting’ a channel looks and works, we try it on a channel we know to exist: channel 0: mp4 video.
70+
71+
From our examination of the files required for the page, we know there are 4 chunks needed, and an init file. We know their names too.
72+
73+
```
74+
$wget https://streams.2019.chall.actf.co/video/init-stream0.m4s
75+
$wget https://streams.2019.chall.actf.co/video/chunk-stream0-00001.m4s
76+
...
77+
$wget https://streams.2019.chall.actf.co/video/chunk-stream0-00004.m4s
78+
$ls
79+
chunk-stream0-00001.m4s
80+
chunk-stream0-00002.m4s
81+
chunk-stream0-00003.m4s
82+
chunk-stream0-00004.m4s
83+
init-stream0.m4s
84+
```
85+
86+
Now that we have all our m4s chunks, we can concatenate them into an mp4 file:
87+
88+
```
89+
$cat init-stream0.m4s $(ls -vx chunk-stream0-*.m4s) > stream0.mp4
90+
```
91+
92+
That file plays the video of the brook that is on the site! Now onto grabbing the unknown audio stream. We need:
93+
94+
init file for stream2
95+
chunks 1..n for stream2
96+
97+
…and because we think we know naming conventions, we can guess that those files will be called:
98+
99+
- init-stream2.m4s
100+
- chunk-stream2-0000x.m4s | x in 1..n
101+
102+
Lets go try to grab that init file:
103+
104+
```
105+
$wget https://streams.2019.chall.actf.co/video/init-stream2.m4s
106+
‘init-stream2.m4s’ saved [741/741]
107+
```
108+
109+
It exists! We’re go to get the chunks now, but how do we know how many to grab? What I did was to keep wget-ing the next one while the size of the file was reasonably large:
110+
111+
```
112+
$wget https://streams.2019.chall.actf.co/video/chunk-stream2-00001.m4s
113+
‘chunk-stream2-00001.m4s’ saved [32629/32629]
114+
```
115+
116+
… rinse repeat:
117+
118+
```
119+
$ls -lah
120+
32K chunk-stream2-00001.m4s
121+
31K chunk-stream2-00002.m4s
122+
32K chunk-stream2-00003.m4s
123+
33K chunk-stream2-00004.m4s
124+
32K chunk-stream2-00005.m4s
125+
33K chunk-stream2-00006.m4s
126+
9.7K chunk-stream2-00007.m4s
127+
1.5K chunk-stream2-00008.m4s
128+
883 chunk-stream2-00009.m4s
129+
883 chunk-stream2-00010.m4s
130+
883 chunk-stream2-00011.m4s
131+
741 init-stream2.m4s
132+
```
133+
134+
Notice how the sizes drop off at the end? Chunks 9, 10, 11 are not even fetching chunks anymore, they are getting the HTML for the site. We can delete those, and keep 1..8.
135+
136+
Now we turn those good chunks into a mp4 file:
137+
138+
```
139+
$cat init-stream2.m4s $(ls -vx chunk-stream2-*.m4s) > stream2.mp4
140+
```
141+
142+
Listening to this file makes it obvious that morse code is at play, so off to the [online audio file to text (via morse) converter](https://morsecode.scphillips.com/labs/audio-decoder-adaptive/). There we upload the mp4, and get this result:
143+
144+
```
145+
ACTF<KN>F#45H-15-B34D-10N9-11V3-M#39-D45H)
146+
```
147+
148+
Well that looks ok… but what are those ‘#’? running it again cleans some of this up:
149+
150+
```
151+
ACTF<KN>F145H-15-B34D-10N9-11V3-MP39-D45H)
152+
```
153+
154+
Let’s try to understand what it is saying. “flash is bead long live mpeg-dash”. They likely meant ‘dead’ not ‘bead’ so let’s fix that and give that flag a try:
155+
156+
```
157+
actf{f145h_15_d34d_10n9_11v3_mp39_d45h}
158+
```

‎content/blog/meeting-notes-3-7.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: "Meeting Notes - 3/7"
3+
author: "Zander Work"
4+
date: 2019-03-07T00:00:00-07:00
5+
categories: ['Meeting Notes']
6+
tags: []
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
Thanks to Kees Cook for an awesome look at kernel security! Kees talked about how the kernel exploit for CVE-2017-7038 was discovered, which allowed privilege escalation due to a heap overflow.
13+
14+
You can see his slides [here](https://drive.google.com/file/d/1T4pHribl-TFyw02ho7goFhVGfSzXkqXB/view?usp=sharing), which also has information for building the POC images for the exploit.
15+
16+
This was our last meeting for Winter 2019, so I’ll see you all next term! Our first meeting will be on Week 2.

‎content/blog/meeting-notes-4-18.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
title: "Meeting Notes 4/18"
3+
author: "Zander Work"
4+
date: 2019-04-18T00:00:00-07:00
5+
categories: ['Meeting Notes']
6+
tags: []
7+
caption: ""
8+
9+
draft: false
10+
---
11+
12+
Tonight I gave a tutorial on IDA Pro basics, and how to get started with this awesome tool. I also released some new binaries on the CTF site for you to practice IDA.
13+
14+
Remember, as a OSU Security Club member you have access to our lab systems, which has the full version of IDA Pro and the Hex-Rays Decompiler installed, so make sure to use those if you want to take advantage of the advanced functionality.
15+
16+
[Link to the slides](https://docs.google.com/presentation/d/1hjS17xuQy3TXWGvnDxQHi0oSoadHruOOrJtmlPW1GT8/edit?usp=sharing)

‎content/blog/prccdc-2019-results.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
title: "PRCCDC 2019 Results"
3+
author: "Zander Work"
4+
date: 2019-03-24T00:00:00-07:00
5+
categories: ['Club News']
6+
tags: []
7+
caption: "Victory photo of 6 OSUSEC students, with one holding a trophy"
8+
9+
draft: false
10+
---
11+
12+
This past weekend, OSUSEC competed at the Pacific Rim Collegiate Cyber Defense Competition (PRCCDC) hosted by Highline College. I’m pleased to announce that we placed 3rd out of 13 teams in this tough competition.
13+
14+
PRCCDC is a 2 day competition where each team must secure a mix of approximately 10 Windows and Linux systems, configure a border firewall, monitor and defend against attacks from the Red Team, and work with business users over the phone throughout the event.
15+
16+
!["Photo of full team for PRCCDC 2019 and Emily Longman"](/static/blog/prccdc-2019-results-everyone.jpg)
17+
18+
Here’s the full team (from left to right):
19+
20+
- Emily Longman (Faculty Advisor)
21+
- Lyell Read
22+
- Ryan Kennedy
23+
- Zander Work
24+
- Hadi Rahal-Arabi
25+
- Khoung Luu
26+
- Zach Rogers
27+
- Curtis Warrick
28+
- Matt Jansen
29+
30+
For more information on the competition, please see the P[RCCDC website](http://prccdc.org/).

0 commit comments

Comments
 (0)