{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-imctf-2021-en","result":{"data":{"markdownRemark":{"id":"6904ce45-fc76-594c-9540-608bc26edb46","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I participated in IMCTF 2021, which was held on December 18-19, 2021.

\n

We were aiming for a top-three finish, but unfortunately our team ended up in 4th place.

\n

\n \n \n \n \n \n \n \n \n

\n

Not having anyone dedicated to Crypto was especially rough, haha.

\n

The Misc challenges were also very interesting, including ones themed around real-world vulnerabilities.

\n

As usual, I am going to write up the challenges where I learned something.

\n\n

Table of Contents

\n\n

nin nin pdf (Rev)

\n

You are given a PDF with the flag embedded in it.

\n

Naturally, I could not read it as-is, so I analyzed it using PDF Stream Dumper.

\n
R/S/Span/Type/StructElem/ActualText(tycan you see ? !’ aW1jdGZ7bmlucG91X2tha3VyZW1pX25vX2p5dXR1fQ== !?can you see ?)
\n

Decoding this Base64-encoded string yields the flag.

\n

PDF basics

\n

Let me step back and talk about what a PDF actually is.

\n

PDF stands for Portable Document Format, a format for displaying documents without depending on a particular OS or device.

\n

It was developed by Adobe and standardized as ISO32000-2.

\n

As usual, the English Wikipedia article was quite detailed.

\n

Reference: PDF - Wikipedia

\n

PDFs are composed of text, vector graphics, images, and other multimedia.

\n

In PDFs, layout and graphics are generated using a graphics-oriented programming language called PostScript.

\n

They are also built on a storage system that structures and compresses content such as fonts and embedded documents.

\n

PDF file format

\n

The following was helpful for understanding the PDF file format.

\n
\n

This format is a subset of the COS (“Carousel” Object Structure) format.

\n

A COS tree file primarily consists of objects, of which there are nine types.

\n\n

In addition, there may be comments introduced by a percent sign (%). Comments may contain 8-bit characters.

\n

Reference: PDF - Wikipedia

\n
\n

Quite interestingly, PDFs can sometimes contain malicious programs.

\n

Looking at the following cheat sheet, it seems that various malicious objects can be embedded, such as tags, scripts, shellcode, macros, and JavaScript.

\n

Reference: Analyzing Malicious Documents Cheat Sheet

\n

Reference: SANS Digital Forensics and Incident Response Blog | How to Extract Flash Objects from Malicious PDF Files | SANS Institute

\n

At that point, to analyze a malicious PDF, you use a PDF parser such as PDF Stream Dumper.

\n

This challenge was similar: by breaking down the PDF structure and analyzing the text and scripts inside, I was able to obtain the flag.

\n

E・Mo・I・XL

\n

You are given a suspicious Excel file.

\n

You can get the flag by analyzing the VBA script in this Excel file.

\n

I had used it in WaniCTF 2021 Autumn as well, but this time too I used olevba to extract the VBA script from the Excel file.

\n

Here is the script I obtained.

\n
# olevba E・mo・XL.xlsm \n\nolevba 0.60 on Python 2.7.18 - http://decalage.info/python/oletools\n===============================================================================\nFILE: E・mo・XL.xlsm\nType: OpenXML\nWARNING  For now, VBA stomping cannot be detected for files in memory\n-------------------------------------------------------------------------------\nVBA MACRO ThisWorkbook.cls \nin file: xl/vbaProject.bin - OLE stream: u'VBA/ThisWorkbook'\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \nPrivate Sub Workbook_Open()\n    Module1.GetPayload\nEnd Sub\n-------------------------------------------------------------------------------\nVBA MACRO Sheet1.cls \nin file: xl/vbaProject.bin - OLE stream: u'VBA/Sheet1'\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \n(empty macro)\n-------------------------------------------------------------------------------\nVBA MACRO Module1.bas \nin file: xl/vbaProject.bin - OLE stream: u'VBA/Module1'\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \nSub GetPayload()\nDim payload As String: payload = vbNullString\nDim ws As Worksheet\nSet ws = ThisWorkbook.Worksheets(1)\nWith ThisWorkbook\n    With .BuiltinDocumentProperties\n        payload = payload + .Item(ws.Cells(1048573, 16384).Value)\n        payload = payload + .Item(ws.Cells(1048574, 16384).Value)\n        payload = payload + .Item(ws.Cells(1048572, 16384).Value)\n        payload = payload + .Item(ws.Cells(1048575, 16384).Value)\n        payload = payload + .Item(ws.Cells(1048576, 16384).Value)\n    End With\nEnd With\npayload = _\n\"p\" & \"w\" & \"s\" & \"h\" & \" \" & \"-\" & \"n\" & \"o\" & _\n\"p\" & \" \" & \"-\" & \"e\" & _\n\"p\" & \" \" & \"B\" & \"y\" & _\n\"p\" & \"a\" & \"s\" & \"s\" & \" \" & \"-\" & \"e\" & \" \" + _\npayload\nCreateObject(\"WScript.Shell\").Run payload\nEnd Sub\n\n+----------+--------------------+---------------------------------------------+\n|Type      |Keyword             |Description                                  |\n+----------+--------------------+---------------------------------------------+\n|AutoExec  |Workbook_Open       |Runs when the Excel Workbook is opened       |\n|Suspicious|CreateObject        |May create an OLE object                     |\n|Suspicious|Shell               |May run an executable file or a system       |\n|          |                    |command                                      |\n|Suspicious|WScript.Shell       |May run an executable file or a system       |\n|          |                    |command                                      |\n|Suspicious|Run                 |May run an executable file or a system       |\n|          |                    |command                                      |\n|Suspicious|Hex Strings         |Hex-encoded strings were detected, may be    |\n|          |                    |used to obfuscate strings (option --decode to|\n|          |                    |see all)                                     |\n+----------+--------------------+---------------------------------------------+
\n

Via WSH, it appears to pass a command called payload to PowerShell and execute it.

\n

payload is generated by the following script.

\n
With ThisWorkbook\n    With .BuiltinDocumentProperties\n        payload = payload + .Item(ws.Cells(1048573, 16384).Value)\n        payload = payload + .Item(ws.Cells(1048574, 16384).Value)\n        payload = payload + .Item(ws.Cells(1048572, 16384).Value)\n        payload = payload + .Item(ws.Cells(1048575, 16384).Value)\n        payload = payload + .Item(ws.Cells(1048576, 16384).Value)\n    End With\nEnd With
\n

ws.Cells(1048573, 16384).Value contained the names of property elements such as category / text / title / subtitle.

\n

Also, ThisWorkbook.BuiltinDocumentProperties.Item(ws.Cells(1048574, 16384).Value) retrieved the file’s property information based on those property element names and concatenated it into payload.

\n

The script below is what I got after decoding the extracted payload.

\n
$txt = [System.Convert]::FromBase64String(\n        (\n            @(\"5a\", \"56\", \"39\", \"74\", \"62\", \"31\", \"39\", \"30\", \"61\", \"57\", \"39\", \"75\", \"58\", \"32\", \"4a\", \"35\", \"58\", \"32\", \"4e\", \"68\", \"63\", \"6d\", \"78\", \"35\", \"58\", \"33\", \"4a\", \"68\", \"5a\", \"56\", \"39\", \"71\", \"5a\", \"58\", \"42\", \"7a\", \"5a\", \"57\", \"34\", \"3d\") |\n            ForEach-Object { [char][byte]\"0x$_\" }\n        ) -join \"\"\n    )\n)\n$txt2 = [System.Text.Encoding]::Default.GetString(\n    [System.Convert]::FromBase64String(\n        (\n            @(\"5a\", \"6d\", \"78\", \"68\", \"5a\", \"79\", \"41\", \"36\", \"49\", \"47\", \"6c\", \"74\", \"59\", \"33\", \"52\", \"6d\", \"65\", \"30\", \"6c\", \"66\", \"63\", \"6d\", \"56\", \"68\", \"62\", \"47\", \"78\", \"35\", \"58\", \"33\", \"4a\", \"6c\", \"59\", \"57\", \"78\", \"73\", \"65\", \"56\", \"39\", \"79\", \"5a\", \"57\", \"46\", \"73\", \"62\", \"48\", \"6c\", \"66\", \"63\", \"6d\", \"56\", \"68\", \"62\", \"47\", \"78\", \"35\", \"58\", \"33\", \"4a\", \"6c\", \"59\", \"57\", \"78\", \"73\", \"65\", \"56\", \"39\", \"79\", \"5a\", \"57\", \"46\", \"73\", \"62\", \"48\", \"6c\", \"66\", \"62\", \"47\", \"6c\", \"72\", \"5a\", \"56\", \"39\", \"35\", \"62\", \"33\", \"56\", \"39\") |\n            ForEach-Object { [char][byte]\"0x$_\" }\n        ) -join \"\"\n    )\n)\n$isPassed = ($password -eq $txt)\nWrite-Host ($isPassed ? \"good you are passed\" : \"incorrect password\") -ForegroundColor ($isPassed ? \"Green\" : \"Red\")\nif ($isPassed) {\n    Write-Host $txt2 -ForegroundColor Blue\n}\n$host.UI.RawUI.ReadKey() | Out-Null
\n

From the above, I was able to obtain the flag by extracting the values of $txt and $txt2 respectively.

\n

made of honey (Misc)

\n

A challenge about analyzing the following hashes (?).

\n
word1:1002:NO PASSWORD*********************:29F98734E7AA3DF2454621FF3928D121:::\nword2:1003:NO PASSWORD*********************:2A8CCE5C056D50FAA808457D0F229212:::\nword3:1004:NO PASSWORD*********************:E694D490564D15954D68DE40B14F7BFE:::
\n

At first, I thought they were MD5 based on the length, but that was wrong.

\n
hash-identifier -h
\n

I used hash-identifier to infer the type, assumed it was NTLM, and cracked it with hashcat.

\n
hashcat -a 0 -m 1000 '29F98734E7AA3DF2454621FF3928D121' /usr/share/wordlists/rockyou.txt\nhashcat -a 0 -m 1000 '2A8CCE5C056D50FAA808457D0F229212' /usr/share/wordlists/rockyou.txt \nhashcat -a 0 -m 1000 'E694D490564D
\n

This gives the flag.

\n

printtext (Misc)

\n

This was a challenge I could not solve during the event.

\n

The program is driven by the following script, and the goal is to use the whitelist cleverly so that arbitrary code can be passed to eval.

\n
import os\nimport sys\n\nos.environ[\"PAGER\"] = \"cat\" #No hitchhike :)\n\nprint(\"\"\"            _       _    __  _            _    __\n _ __  _ __(_)_ __ | |_ / / | |_ _____  _| |_  \\ \\\\\n| '_ \\| '__| | '_ \\| __| |  | __/ _ \\ \\/ / __|  | |\n| |_) | |  | | | | | |_| |  | ||  __/>  <| |_   | |\n| .__/|_|  |_|_| |_|\\__| |   \\__\\___/_/\\_\\\\__|  | |\n|_|                     \\_\\                    /_/\nCan you evaluate `print(text)`?\nThey don't seem to have the flag.\n\"\"\")\n\ntext = \"I don't have the flag.\"\n\nallow_list = input(\"allow_list> \")[:9]\nprint(f\"your allow_list: {list(allow_list)}\")\neval_code = input(\"eval_code> \")\n\nfor c in eval_code:\n    if c not in allow_list:\n        print(f\"Hi, {c}!\")\n        sys.exit()\n\nprint(\"Let’s roll!!\")\neval(eval_code)
\n

Because you can specify at most nine kinds of characters in the whitelist, it was extremely difficult to embed a script.

\n

As a solution, it seems you can obtain the flag by using the chr method as shown below to bypass the character-set restriction and feed an arbitrary string into eval.

\n
eval(\n    chr(1+1)\n)
\n

Genius.

\n

Summary

\n

Although it billed itself as a beginner-friendly CTF, it had quite a few fairly difficult problems, so it was a CTF I learned a lot from.

\n

We did not make the top three, but it was a lot of fun.

\n

Thanks to the organizers.

\n

Notes: Other impressive challenges

\n

I thought the authors were geniuses when I read the writeups.

\n

I want to get to the point where I can breeze through things like this.

\n

Reference: imctf2021satokiwriteups/web/DoScript at main · satoki/imctf2021satokiwriteups

\n

Reference: imctf2021satokiwriteups/web/Num-restaurant at main · satoki/imctf2021satokiwriteups

","fields":{"slug":"/ctf-imctf-2021-en","tagSlugs":["/tag/ctf-en/","/tag/reversing-en/","/tag/misc-en/","/tag/english/"]},"frontmatter":{"date":"2021-12-19","description":"A writeup from IMCTF 2021 (Dec 18–19). We aimed for top 3 but finished 4th.","tags":["CTF (en)","Reversing (en)","Misc (en)","English"],"title":"IMCTF 2021 Writeup","socialImage":{"publicURL":"/static/dc4d8b7f8795f3c3d3489d9957d155f2/no-image.png"}}}},"pageContext":{"slug":"/ctf-imctf-2021-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}