Our Information Security Office (ISO) hosted its first-ever capture the flag (CTF) event recently during the Cybersecurity & Privacy Festival. The CTF was open to all staff for a whole week from 10/19 – 10/23. It was engaging, educational, exhausting, frustrating, and infuriating. In this post, I want to share my CTF experience. I will also include some information about the challenges and my thought process. Bonus: I incorporated a mini-CTF. I encourage you to try it out!
Before this event, I’ve participated in three CTFs in the past. The first two CTFs I’ve done were back in April 2018. It was during my SANS SEC530 (Defensible Security Architecture and Engineering) training at Louisville, Kentucky.
First time player and won a coin! Yay! #SANS #NetWars #SANSBlueTeam pic.twitter.com/cWG9MDiipO
— Andrew Roderos (@andrewroderos) April 30, 2018
The first one was the Cyber Defense NetWars. This particular CTF is what I’d say a traditional one since it covers multiple categories. The second CTF was for the SEC530 class itself. The third CTF, hosted by Palo Alto Networks, focused on their Prisma Cloud product, which I’ve never used until that day.
While this CTF was my fourth one, my CTF experiences varied from one to the other. All four of them had a different set of challenges. However, this CTF has some similarities with SANS NetWars.
CTF experience
There are three common types of CTF: Jeopardy-style, attack-defense, and mixed. Our internal CTF was a Jeopardy-style. This type of CTF usually has multiple categories of challenges. Since the game organizers recognized that participants were coming from various backgrounds (some of which were non-technical), they included privacy and security questions of varying degrees of difficulty.
When they opened the CTF site on Monday at noon, there were around 100 challenges. By Tuesday night, the top 3 players ran out of challenges, and I was at the top. We thought we could finally rest from it and enjoy the rest of the festival. We were wrong.
On Wednesday, the organizers added 20 more challenges. The majority of the challenges were different from the original set. It required more thought and research than the previous ones.
The top 3 players couldn’t answer one of the questions in the password category. Each one of us didn’t want to take the hint, so the organizers decided to give us a freebie.
Unfortunately, the notification bell didn’t show me that there was a new message. I had to go to the notification page to see what’s there. By then, I was three hours late. On top of that, I had to install, troubleshoot, and learn how to use GPG Suite. By then, I, unfortunately, lost the lead because whoever gets the highest score first gets the top spot.
They didn’t stop there. On Friday morning, they added two more challenges. These two challenges require us to apply the knowledge we gained from one of the workshops. The workshop focused on exploiting vulnerabilities on multiple systems.
I had mixed feelings about the additional challenges. I know other CTF participants welcomed the extra challenges. My main gripe was the amount of time we had to dedicate if we wanted to win the CTF. Other than that, it was very educational.
Challenges
Unfortunately, I was not permitted to share the real files from the challenges. The next best thing I could do is to try to give you a similar example of the challenges. Since there were a lot of challenges, I will only pick a few of them.
Steganography
I’ve heard of steganography before the CTF. However, I’ve never inspected a file that has a hidden message until last week. It was fun to go through the process of learning how to decipher what’s the secret message. There are several tools that you can use in the area of steganography. I will only cover some of the tools that I’ve encountered to solve the CTF challenges.
Road Untraveled
I believe this challenge is a perfect warmup for the steganography category. It serves as an excellent way to teach someone to gather any data that they can get from the file.
The challenge has a simple question: where does this road go?
Depending on someone’s experience, the CTF player may perform a reverse image search to get a clue where it is. However, some CTFs will never make it that easy.
Since I wasn’t familiar with the tools used in steganography, I had to research the subject. One of the tools I encountered was the ExifTool. Alternatively, you can use this site to view the metadata.
Running the ExifTool is easy. Just issue the exiftool <filename here> syntax, and you will see the metadata, as shown below.
networkjutsu@MacBook-Pro$ exiftool road-untraveled.jpg
ExifTool Version Number : 12.00
File Name : road-untraveled.jpg
Directory : .
File Size : 209 kB
File Modification Date/Time : 2020:10:27 19:25:51-07:00
File Access Date/Time : 2020:10:27 19:29:57-07:00
File Inode Change Date/Time : 2020:10:27 19:29:56-07:00
File Permissions : rw-r--r--
File Type : JPEG
File Type Extension : jpg
MIME Type : image/jpeg
JFIF Version : 1.01
Exif Byte Order : Big-endian (Motorola, MM)
Orientation : Horizontal (normal)
X Resolution : 72
Y Resolution : 72
Resolution Unit : inches
Color Space : sRGB
Exif Image Width : 1024
Exif Image Height : 674
GPS Version ID : 2.3.0.0
GPS Latitude Ref : North
GPS Longitude Ref : West
Current IPTC Digest : d41d8cd98f00b204e9800998ecf8427e
IPTC Digest : d41d8cd98f00b204e9800998ecf8427e
Image Width : 1024
Image Height : 674
Encoding Process : Progressive DCT, Huffman coding
Bits Per Sample : 8
Color Components : 3
Y Cb Cr Sub Sampling : YCbCr4:2:0 (2 2)
Image Size : 1024x674
Megapixels : 0.690
GPS Latitude : 37 deg 48' 43.74" N
GPS Longitude : 122 deg 28' 39.80" W
GPS Position : 37 deg 48' 43.74" N, 122 deg 28' 39.80" WTo me, the only interesting data here is the GPS information. If you plug that into Google Maps, then you should see the Golden Gate Bridge. That’s the flag for this challenge.
Humility
This challenge has a simple task – to find one of my favorite quotes. The hint is: The only true wisdom is in knowing you know nothing.
This challenge was a hard one. I tried using exiftool and other tools, but I wasn’t having any luck. Eventually, I found this site, which helped solve the challenge.
Alternatively, if you can use CyberChef, you can also use that to solve this challenge. However, when an image has three different values for the bit planes, then CyberChef is not the right tool.
Note
If you want to try it yourself, then download it from here. Don’t right-click and save the image because the data won’t be there.
The StegOnline tool is easy to use. The hardest part is figuring out which RGB bit plane values you need to solve the challenge.
To use the StegOnline, upload the image, then choose the Extract Files/Data button. From there, you tick a box or more and click the Go button. Look at the ASCII section and inspect anything that may be of value. Some CTF challenges do not require you to decode anything – it will just be in regular text. Take this image, for example.
In this case, I encoded it using Base64. There are a lot of online tools out there that can decode it for you. Alternatively, if you are a Mac user, you can use the command line. Use the echo SSBrbm93 IG5vdGhp bmcgZXhj ZXB0IHRo ZSBmYWN0 IG9mIG15 IGlnbm9y YW5jZQ== | base64 --decode syntax to find out the flag. If you’re a Linux user, you may need to remove the spaces.
networkjutsu@MacBook-Pro$ echo `echo SSBrbm93 IG5vdGhp bmcgZXhj ZXB0IHRo ZSBmYWN0 IG9mIG15 IGlnbm9y YW5jZQ== | base64 --decode`
I know nothing except the fact of my ignorance
networkjutsu@ubuntu$ echo `echo SSBrbm93 IG5vdGhp bmcgZXhj ZXB0IHRo ZSBmYWN0 IG9mIG15 IGlnbm9y YW5jZQ== | base64 --decode`
base64: invalid input
I know
networkjutsu@ubuntu$ echo `echo SSBrbm93IG5vdGhpbmcgZXhjZXB0IHRoZSBmYWN0IG9mIG15IGlnbm9yYW5jZQ==| base64 --decode`
I know nothing except the fact of my ignoranceAs mentioned earlier, you can also use CyberChef. The great thing about using CyberChef is the recipes that you can add, for example, adding From Base64 recipe.
CTF Challenge #1: Fast and expensive car
Experience is the best teacher, so I want any CTF beginner to figure out the flag. Comment your answer below. Check back a few days later to see if your comment gets posted. If it did, then you didn’t answer correctly. If you don’t see your comment, then you answered the challenge correctly.
FYI – This is a relatively easy CTF challenge. You may not experience the same in a real CTF.
Hint
You will incorporate what you’ve learned thus far and also perform additional research about steganography.
Passwords
Before the CTF, I’ve played with two popular password cracking tools in the past: Hashcat and John the Ripper (JtR). In fact, I used JtR in one of my articles. That said, I thought it would be relatively easy with wordlists. I was wrong. It turned out that you only need one wordlist, additional command flags, and some thought.
RockYou
The password section had six challenges. I thought that three of those challenges were related to each other because of the CTF titles. The CTF titles were along the lines of a weak password, still not adequate, and better but still crackable.
I grabbed all the shadow files from these three challenges and copied the ones I needed. I ran hashcat with RockYou wordlist and waited for it to finish. When the cracking process finished, only one password was in the output file.
networkjutsu@MacBook-Pro$ $ cat combined-hash
$5$00000$i8iHSm4kLHOMO0u8nbtpg.4N/t5hgYJBCJ1OFlkk42/
$5$00000$Megnzik.4VtQFweBSkgZqjNGeH5M27UncMuCDOeDK0B
$5$00000$zCy8qKUIqL3RTJooaLxEDATUwYi.h9gvKKyUee039OC
networkjutsu@MacBook-Pro$ hashcat -m 7400 -a 0 -o cracked.txt combined-hash rockyou.txt -O
hashcat (v5.1.0) starting...
OpenCL Platform #1: Apple
=========================
* Device #1: Intel(R) Core(TM) i7-6920HQ CPU @ 2.90GHz, skipped.
* Device #2: Intel(R) HD Graphics 530, 384/1536 MB allocatable, 24MCU
* Device #3: AMD Radeon Pro 460 Compute Engine, 1024/4096 MB allocatable, 16MCU
Hashes: 3 digests; 3 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Applicable optimizers:
* Optimized-Kernel
* Zero-Byte
* Single-Salt
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 15
Watchdog: Hardware monitoring interface not found on your system.
Watchdog: Temperature abort trigger disabled.
Dictionary cache built:
* Filename..: rockyou.txt
* Passwords.: 14344391
* Bytes.....: 139921497
* Keyspace..: 14344384
* Runtime...: 2 secs
Approaching final keyspace - workload adjusted.
Session..........: hashcat
Status...........: Exhausted
Hash.Type........: sha256crypt $5$, SHA256 (Unix)
Hash.Target......: combined-hash
Time.Started.....: Sat Oct 31 09:17:01 2020 (5 mins, 35 secs)
Time.Estimated...: Sat Oct 31 09:22:36 2020 (0 secs)
Guess.Base.......: File (rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#2.........: 4689 H/s (12.95ms) @ Accel:16 Loops:4 Thr:256 Vec:1
Speed.#3.........: 38154 H/s (2.93ms) @ Accel:64 Loops:16 Thr:256 Vec:1
Speed.#*.........: 42842 H/s
Recovered........: 1/3 (33.33%) Digests, 0/1 (0.00%) Salts
Progress.........: 14344384/14344384 (100.00%)
Rejected.........: 244335/14344384 (1.70%)
Restore.Point....: 13868283/14344384 (96.68%)
Restore.Sub.#2...: Salt:0 Amplifier:0-1 Iteration:4996-5000
Restore.Sub.#3...: Salt:0 Amplifier:0-1 Iteration:4992-5000
Candidates.#2....: 0841831213 -> 0805545693
Candidates.#3....: $HEX[2a34657665723732332a] -> $HEX[042a0337c2a156616d6f732103]
Started: Sat Oct 31 09:16:56 2020
Stopped: Sat Oct 31 09:22:38 2020
networkjutsu@MacBook-Pro$ cat cracked.txt
$5$00000$Megnzik.4VtQFweBSkgZqjNGeH5M27UncMuCDOeDK0B:Roja_1587CTF Challenge #2: Crack the passwords
We’ve cracked one password, and that’s a clue in itself. I suggest you brute force attack the other two passwords. With a better GPU than my Radeon Pro 460 that comes with MacBook Pro 2016, you should be able to crack these two passwords in less than 30 minutes.
Same as CTF challenge #1, comment your answer below. If you come back to my site and do not see your comment, that means you answered it correctly.
Hint
In the interest of time, the two passwords are more than seven characters. Create a custom rule or two. The ones that come with hashcat may take too long.
Final Thoughts
It’s normal to feel intimated by CTF competitions, especially if you’re new to it. I felt the same way during my first CTF at SANS NetWars. However, I still went in there with no expectations to win and just wanted to have fun solving challenges. Guess what? I ended up being on the board and won a coin.
Trust me when I say that you will expand your skillset when you participate in a CTF. Whether you enter as an individual or a team, you will gain knowledge from the competition. Having said that, if you’re new to CTF, I suggest you participate in my mini-CTF.
