MMA CTF 2015 - Stream... (100)

We didn't end up solving this during the competition, but I thought it would be nice to show the challenge and share the process we went through in finding the flag.

It starts with a pcap file which contains many similar packets (parts of the stream).  After sorting by length and following the TCP stream of one, we find some interesting header content.

Notably we find the "User-Agent" as NSPlayer, "Content-Type" as "application/x-mms-framed", and in the bytes it shows that it's a "Windows Media Video" (WMV) format.

Now the tricky part is figuring out how we can play this content.  We can save the binary data to a file in Wireshark pressing 'Save As' and editing the header out (Also useful to filter out the conversation by the part we care about in the dropdown menu which defaults to Entire Conversation).

After some research it looked like we could just push the data over a server, and use VLC to interpret it as an MMS stream.  Here's a simple guide for OSX users on how to open MMS streams in VLC - http://elearning.etsu.edu/macmmsguide/index.html

The question is, what does our server need to look like?
Apparently not much.

This was done with very little effort and seemed to work fine (simple Node.js server):

m=require; m('http').createServer(function(_, r) {r.end(m('fs').readFileSync("extracted"))}).listen(4444);

Where "extracted" is the binary file we formed from the stream.

Now All we had to do is view the result in VLC: after launching VLC, you can go to File > Open Network, and give it a url.  In this case we're hosting it locally, so we just point it to mms://localhost:4444 (important to use the mms protocol in this situation)

When playing it we get an initial frame of Rainbow Colors!

Then more of what we're looking for, in a classic MS PAint window ;)

The Final Flag Being:

MMA{windows_xp_is_too_old_to_create_problem!!}

MMA CTF 2015 - MQAAAA (70)

MQAAAA was one of those obscure stego/misc challenges that began in a search for various Binary-to-text encodings (Wiki Page) that are publicly available out there.

Between a mix of intuitive feelings and tests of each encoding, and analysis of letter frequencies, I landed on the first being base64. This seemed too simple, but then looking at the result, I saw the title of the challenge in the obscure output: "MQAAAA"

Base64 Decode:

$ echo 'I0B+Xk1RQUFBQT09CVVtLmJ3RFIrMXRLY0p0SCkJRHRubTZWbFRtaEtETnxyZHtLNDZFZG1DT2JXVThyYmpSSUFBQT09XiN+QA==' | base64 -D

Output:

#@~^MQAAAA== Um.bwDR+1tKcJtH) Dtnm6VlTmhKDN|rd{K46EdmCObWU8rbjRIAAA==^#~@

Okay.... We've got some base64 lookin' stuff... some non base64 lookin' stuff... lots of space, and MQAAAA== decodes to 1. Great.

After being stumped for a while, I went on an assumption that this is another type of encoding or language out there somewhere.
Noticed that the start and end of this result was #@~^ and ^#~@... After looking at php for hours, having the image of deepen it's way into my retinas, I had the thought of pre / post tokens for languages burnt into my current thoughts. So let's search for one.

On SymbolHound (Great site for searching symboles) - I looked for the beginning segment: #@~^

The only Result:

It's IT | softwareontwikkeling, webdevelopment, ict oplossingen op maat
#@~^FQAAAA==@#@&CCb@#@&zz O@*@#@&TQIAAA==^#~@ HaiHai HaiHai #@~^IgAAAA==@#@&CCbCmk@#@&CmrCmk@#@&JzRR@*@#@&mgUAAA==^#~@ Cute. As you can see, @#@& appears to be a newline (@#
http://itsit.nl/klaphek/scrdec.html

This leads to a post entitled: "Breaking the Windows Script Encoder"
The code we're looking at after the Base64 decoding is JSCript. A funky version of ECMAScript used in windows (originally for ActiveX).

I did not read the article the search resulted in. Instead after looking on wikipedia for JScript I found a mention to the numerous online decryption services for JScript. After some searches I didn't find one hosted online, but did find a C script hosted on a site that was currently down, but available on the WaybackMachine - link.

And the C file which encodes & decodes JScript files: http://web.archive.org/web/20140209124110/http://www.virtualconspiracy.com/download/scrdec18.c


After compiling and running that against a new file containing the output of the base64 decoding, we get the flag:

WScript.echo("MMA{the_flag_word_is_obfuscation}")

MMA CTF 2015 - cannotberun (80)

Admittedly this one wasn't an interesting process as I didn't have access to any windows boxes or VM's. So it was quickly done in radare2.

$ r2 cannotberun
> s sym.main

Used '<' and '>' hotkeys in radare2 to step through the code a bit, and found an interesting looking block (About 7 pages down):

0000:04f4    40           inc ax
0000:04f5    0938         or word [bx + si], di
0000:04f7    c6400a31     mov byte [bx + si + 0xa], 0x31     ; [0x31:1]=0 ; '1'
0000:04fb    c6400b66     mov byte [bx + si + 0xb], 0x66     ; [0x66:1]=32 ; 'f'
0000:04ff    c6400c73     mov byte [bx + si + 0xc], 0x73     ; [0x73:1]=10 ; 's'
0000:0503    c6400d67     mov byte [bx + si + 0xd], 0x67     ; [0x67:1]=114 ; 'g'
0000:0507    c6400e36     mov byte [bx + si + 0xe], 0x36     ; [0x36:1]=0 ; '6'
0000:050b    ff15         call word [di]
unk(unk, unk) ; section_end..text

Doesn't look big enough to be a flag, but let's try shifting around a little. I usually play with left and arrow keys to see if alignment issues are in place. In this case, it seemed like there were. You'll see the result after shifting to the right amount below:

0000:04d0    c60037       mov byte [bx + si], 0x37           ; [0x37:1]=0 ; '7'
0000:04d3    c6400161     mov byte [bx + si + 1], 0x61       ; [0x61:1]=39 ; 'a'
0000:04d7    c6400233     mov byte [bx + si + 2], 0x33       ; [0x33:1]=0 ; '3'
0000:04db    c6400335     mov byte [bx + si + 3], 0x35       ; [0x35:1]=0 ; '5'
0000:04df    c6400468     mov byte [bx + si + 4], 0x68       ; [0x68:1]=117 ; 'h'
0000:04e3    c6400578     mov byte [bx + si + 5], 0x78       ; [0x78:1]=36 ; 'x'
0000:04e7    c6400662     mov byte [bx + si + 6], 0x62       ; [0x62:1]=116 ; 'b'
0000:04eb    c6400739     mov byte [bx + si + 7], 0x39       ; [0x39:1]=0 ; '9'
0000:04ef    c6400871     mov byte [bx + si + 8], 0x71       ; [0x71:1]=63 ; 'q'
0000:04f3    c6400938     mov byte [bx + si + 9], 0x38       ; [0x38:1]=0 ; '8'
0000:04f7    c6400a31     mov byte [bx + si + 0xa], 0x31     ; [0x31:1]=0 ; '1'
0000:04fb    c6400b66     mov byte [bx + si + 0xb], 0x66     ; [0x66:1]=32 ; 'f'
0000:04ff    c6400c73     mov byte [bx + si + 0xc], 0x73     ; [0x73:1]=10 ; 's'
0000:0503    c6400d67     mov byte [bx + si + 0xd], 0x67     ; [0x67:1]=114 ; 'g'
0000:0507    c6400e36     mov byte [bx + si + 0xe], 0x36     ; [0x36:1]=0 ; '6'

This Looked more promising.
Pasted this in vim, and did the following to clean the data:

%s/; //g
%s/'//g
%s/\n//g

Wrap this data in the flag format, and we've got a valid flag!

MMA{7a35hxb9q81fsg6}