This was a great CTF! Ended up solving 15 (CSAW '15) challenges in total, and most of them were in the first hour, but they were also very fun!
The Crypto challenges were interesting, and the first few had a little twist of recent popular media in them.
First, let's go through the 50 pt challenges. Each one had a filename relating to an episode of Mr. Robot.
eps1.1_ones-and-zer0es.mpeg (50)
This was the first challenge. Looking like a forensics challenge almost, the first thing I intuitively did was strings the mpeg, it's a crypto challenge right?
(By the way, I had noticed a few of the challenges last year were solved just by using strings, so I tried that on almost everything I got.... Seemed to work for a couple this year as well!)
$ strings eps1.1_ones-and-zer0es.mpeg
01100110011011000110000101110100011110110101000001100101011011110111000001101100011001010010000001100001011011000111011101100001011110010111001100100000011011010110000101101011011001010010000001110100011010000110010100100000011000100110010101110011011101000010000001100101011110000111000001101100011011110110100101110100011100110010111001111101001000000100100100100111011101100110010100100000011011100110010101110110011001010111001000100000011001100110111101110101011011100110010000100000011010010111010000100000011010000110000101110010011001000010000001110100011011110010000001101000011000010110001101101011001000000110110101101111011100110111010000100000011100000110010101101111011100000110110001100101001011100010000001001001011001100010000001111001011011110111010100100000011011000110100101110011011101000110010101101110001000000111010001101111001000000111010001101000011001010110110100101100001000000111011101100001011101000110001101101000001000000111010001101000011001010110110100101100001000000111010001101000011001010110100101110010001000000111011001110101011011000110111001100101011100100110000101100010011010010110110001101001011101000110100101100101011100110010000001100001011100100110010100100000011011000110100101101011011001010010000001100001001000000110111001100101011011110110111000100000011100110110100101100111011011100010000001110011011000110111001001100101011101110110010101100100001000000110100101101110011101000110111100100000011101000110100001100101011010010111001000100000011010000110010101100001011001000111001100101110
So, just guessing, this is probably a string encoded in binary. Let's see what it looks like, if it's not, we'll output it to a file.
Found a very simple line to use to convert the binary to string in python: http://stackoverflow.com/questions/7290943/write-a-string-of-1s-and-0s-to-a-binary-file
>>> b = '011001....0101110' # Abbreviated version of the dump above
>>> print bytearray(int(b[x:x+8], 2) for x in range(0, len(b), 8))
flat{People always make the best exploits.} I've never found it hard to hack most people. If you listen to them, watch them, their vulnerabilities are like a neon sign screwed into their heads.
eps1.7_wh1ter0se.m4v (50)
Same idea on this Challenge. Let's strings the m4v file.
$ strings eps1.7_wh1ter0se.m4v EOY XF, AY VMU M UKFNY TOY YF UFWHYKAXZ EAZZHN. UFWHYKAXZ ZNMXPHN. UFWHYKAXZ EHMOYACOI. VH'JH EHHX CFTOUHP FX VKMY'U AX CNFXY FC OU. EOY VH KMJHX'Y EHHX IFFQAXZ MY VKMY'U MEFJH OU.
Looks like this one could be a simple caesar or substitution cipher. Tried my usual one-liner in python to find any glaring possible shifts it could be (Similar to this - http://fadec0d3.blogspot.com/2014/04/):
$ python >>> s = "EOY XF, AY VMU M UKFNY TOY YF UFWHYKAXZ EAZZHN. UFWHYKAXZ ZNMXPHN. UFWHYKAXZ EHMOYACOI. VH'JH EHHX CFTOUHP FX VKMY'U AX CNFXY FC OU. EOY VH KMJHX'Y EHHX IFFQAXZ MY VKMY'U MEFJH OU." >>> [''.join([chr(ord(x) + n) for x in s]) for n in range(-10, 20)]
Nothing is immediately obvious.
The next part I didn't do in python, just used a service that helps crack substitution ciphers.
http://quipqiup.com/index.php
Rank 1 (looks like it uses a GA to solve it) was the solution:
BUT NO, IT WAS A SHORT CUT TO SOMETHING BIGGER. SOMETHING GRANDER. SOMETHING BEAUTIFUL. WE'VE BEEN FOCUSED ON WHAT'S IN FRONT OF US. BUT WE HAVEN'T BEEN LOOKING AT WHAT'S ABOVE US.
eps1.9_zer0-day.avi (50)
Again, let's strings the file, see what we get.
$ file eps1.9_zer0-day.avi eps1.9_zer0-day.avi: ASCII text, with very long lines $ cat eps1.9_zer0-day.avi
Oh! Base64! Cool. Looks like it also has newlines in it....
$ python
>>> b = 'RXZpbCBDb3JwLCB3ZSBoYXZlIGRlbGl2ZXJlZCBvbiBvdXIgcHJvbWlzZSBhcyBleHBlY3RlZC4g\nVGhlIHBlb3BsZSBvZiB0aGUgd29ybGQgd2hvIGhhdmUgYmVlbiBlbnNsYXZlZCBieSB5b3UgaGF2\nZSBiZWVuIGZyZWVkLiBZb3VyIGZpbmFuY2lhbCBkYXRhIGhhcyBiZWVuIGRlc3Ryb3llZC4gQW55\nIGF0dGVtcHRzIHRvIHNhbHZhZ2UgaXQgd2lsbCBiZSB1dHRlcmx5IGZ1dGlsZS4gRmFjZSBpdDog\neW91IGhhdmUgYmVlbiBvd25lZC4gV2UgYXQgZnNvY2lldHkgd2lsbCBzbWlsZSBhcyB3ZSB3YXRj\naCB5b3UgYW5kIHlvdXIgZGFyayBzb3VscyBkaWUuIFRoYXQgbWVhbnMgYW55IG1vbmV5IHlvdSBv\nd2UgdGhlc2UgcGlncyBoYXMgYmVlbiBmb3JnaXZlbiBieSB1cywgeW91ciBmcmllbmRzIGF0IGZz\nb2NpZXR5LiBUaGUgbWFya2V0J3Mgb3BlbmluZyBiZWxsIHRoaXMgbW9ybmluZyB3aWxsIGJlIHRo\nZSBmaW5hbCBkZWF0aCBrbmVsbCBvZiBFdmlsIENvcnAuIFdlIGhvcGUgYXMgYSBuZXcgc29jaWV0\neSByaXNlcyBmcm9tIHRoZSBhc2hlcyB0aGF0IHlvdSB3aWxsIGZvcmdlIGEgYmV0dGVyIHdvcmxk\nLiBBIHdvcmxkIHRoYXQgdmFsdWVzIHRoZSBmcmVlIHBlb3BsZSwgYSB3b3JsZCB3aGVyZSBncmVl\nZCBpcyBub3QgZW5jb3VyYWdlZCwgYSB3b3JsZCB0aGF0IGJlbG9uZ3MgdG8gdXMgYWdhaW4sIGEg\nd29ybGQgY2hhbmdlZCBmb3JldmVyLiBBbmQgd2hpbGUgeW91IGRvIHRoYXQsIHJlbWVtYmVyIHRv\nIHJlcGVhdCB0aGVzZSB3b3JkczogImZsYWd7V2UgYXJlIGZzb2NpZXR5LCB3ZSBhcmUgZmluYWxs\neSBmcmVlLCB3ZSBhcmUgZmluYWxseSBhd2FrZSF9Ig=='
b = b.split() # Split by those newlines
print ''.join([x.decode('base64') for x in b])
Evil Corp, we have delivered on our promise as expected. The people of the world who have been enslaved by you have been freed. Your financial data has been destroyed. Any attempts to salvage it will be utterly futile. Face it: you have been owned. We at fsociety will smile as we watch you and your dark souls die. That means any money you owe these pigs has been forgiven by us, your friends at fsociety. The market's opening bell this morning will be the final death knell of Evil Corp. We hope as a new society rises from the ashes that you will forge a better world. A world that values the free people, a world where greed is not encouraged, a world that belongs to us again, a world changed forever. And while you do that, remember to repeat these words: "flag{We are fsociety, we are finally free, we are finally awake!}"
Flag:
flag{We are fsociety, we are finally free, we are finally awake!}
Notesy (100)
This was one of those challenges most people were stumped on. I was stumped on it for a while, and in IRC you could see this as a common subject.
I tried Goatse, Notesy, Alphabetic analysis, and various other ideas. Even tried a few web / exploitation ideas out in case it was a mix of Crypto + Web.
Finally I got a hint which went along the lines: "It's not too difficult, try one of the first things you input"
Sure enough, that worked!
On any of these interactive Crypto challenges, the first thing I try is the alphabet, also repeating characters and symbols to see what the mapping is between input and output.
This was the Flag:
UNHMAQWZIDYPRCJKBGVSLOETXF
