SANS Holiday Challenge 2012 Heat Miser Levels: 

http://pen-testing.sans.org/holiday-challenge/2012


Heat Zone 0:
-- The flag for this level is 1732bcff12e6550ff9ea44d594001418 --

Heat Zone 1:
-- The flag for this level is d8c94233daef256c42bb95bd61382e02 --
 View http://heatmiser.counterhack.com/robots.txt
 Find /zone-1-E919DBF1-E4FA-4141-97C4-3F38693D2161

Heat Zone 2:
--The flag for this level is ef963731de7e886226fe4a6a6c2971f1 --
In html source of zone1.
Find /zone-2-761EBBCF-099F-4DB0-B63F-9ADC61825D49

Heat Zone 3:
-- The flag for this level is 0d524fb8d8f9f88eb9da5b286661a824 --
 tweet image : https://twitter.com/h34t_m1s3r/status/276824127359295488/photo/1
 and cold tweet clue : https://twitter.com/sn0w_m1s3r/status/276824285878812673
 adjust image with gimp and find: heatmiser.counterhack.com/zone-3-83FEE8BE-B1C6-4395-A56A-BF933FC85254/

Heat Zone 4:
-- The flag for this level is e3ae414e6d428c3b0c7cff03783e305f --
 When clicking on link with burp proxy, you will see the full page loads before the redirect due to missing exit 0;. 
There is a hint in the meme tweet.  
You can view page 4 at this point, which has a link for page 5

Heat Zone 5:
-- The flag for this level is f478c549e37fa33467241d847f862e6f --
 Identified cookie as hash of 1001 along with clue (https://twitter.com/sn0w_m1s3r/status/276871170085773312). Tried a ton of things trying to figure out what it was supposed to be.
 Finally brute forced it with the bash script below to find the answer was "1".

 z5.sh:
 #!/bin/bash
 X=`echo -n $1 | md5sum | cut -c1-32`
 curl -s -L -b UID=$X
 http://heatmiser.counterhack.com/zone-5-15614E3A-CEA7-4A28-A85A-D688CC418287
 END z5.sh


 ch@bluestem:~$ for i in {0..1001}; do echo $i; ./z5.sh $i; done  file.out

 Examined file.out logs for the one that did not have "access denied"

SANS Holiday Challenge 2012 Snow Miser Levels: 

http://pen-testing.sans.org/holiday-challenge/2012

Snow Zone 0: 
-- The flag for this level is 3b5a630fc67251aa5555f4979787c93f --

Snow Zone 1: 
 -- The flag for this level is 38bef0b61ba8edda377b626fe6708bfa --
 Photo reflection in https://twitter.com/sn0w_m1s3r/status/276820932104957952/photo/1
 http://snowmiser.counterhack.com/zone-1-D2E31380-50E6-4869-8A85-F9CDB3AF6226/

Snow Zone 2:
 -- The flag for this level is b8231c2bac801b54f732cfbdcd7e47b7 --

The image off.jpg has metadata IceIceBaby! which can be used as a
 passphrase for steghide extract against off.jpg

 Data provided is "zone-2-6D46A633-25D7-42C8-AF94-8E786142A3E3"

ch@bluestem:~/snow$ exiftool off.jpg
[...]
User Comment                    : IceIceBaby!
[...]

ch@bluestem:~/snow$ steghide extract -sf off.jpg
Enter passphrase: IceIceBaby!
the file "tmpfile.txt" does already exist. overwrite ? (y/n) y
wrote extracted data to "tmpfile.txt".
ch@bluestem:~/snow$ cat tmpfile.txt
zone-2-6D46A633-25D7-42C8-AF94-8E786142A3E3

Snow Zone 3:
-- The flag for this level is 08ba610172aade5d1c8ea738013a2e99 --

 Link /zone-3-EAB6B031-4EFA-49F1-B542-30EBE9EB3962 found in data from
 android dump in file data/com.android.browser/cache/webviewCacheChromium/data_2 using grep.

ch@bluestem:~/snow/data$ find . -type f -exec grep -a zone-3 '{}' \;  > zone3.out
ch@bluestem:~/snow/data$ grep -a zone-3 zone3.out
[...]
/zone-3-EAB6B031-4EFA-49F1-B542-30EBE9EB3962/' class="menu">Zone 3
[...]

Snow Zone 4:
 -- The flag for this level is de32b158f102a60aba7de3ee8d5d265a --

 Since the "zone-4-" part of the strings would be the same and the encrypted strings started the same way, it was just a matter of working backwards from the ciphertext back to the original.

 z4.py:
 #!/bin/python

 #this is the known string "zone-4-F7677DA8-3D77-11E2-BB65-E4BF6188709B"
 list1=[0x7a, 0x6f, 0x6e, 0x65, 0x2d, 0x34, 0x2d, 0x46, 0x37, 0x36,
 0x37, 0x37, 0x44, 0x41, 0x38, 0x2d, 0x33, 0x44, 0x37, 0x37, 0x2d
 , 0x31, 0x31, 0x45, 0x32, 0x2d,
  0x42, 0x42, 0x36, 0x35, 0x2d, 0x45, 0x34, 0x42, 0x46, 0x36, 0x31,
 0x38, 0x38, 0x37, 0x30, 0x39, 0x42]

 #this is the known ciphertext for string above
 list2=[0x20, 0xd9, 0x16, 0xc6, 0xc2, 0x9e, 0xe5, 0x3c, 0x30, 0xea,
 0x1e, 0xff, 0xc6, 0x3b, 0x1c, 0x72, 0x14, 0x7e, 0xb8, 0x6b, 0x99
 , 0x8a, 0x25, 0xc0, 0xcf, 0x1b,
  0xf6, 0x69, 0x39, 0xe8, 0x62, 0x1b, 0x31, 0x32, 0xd8, 0x3a, 0xbb,
 0x16, 0x83, 0xdf, 0x61, 0x92, 0x38]

 #this is known ciphertext for unknown string
 list3=[0x20, 0xd9, 0x16, 0xc6, 0xc2, 0x9e, 0xe5, 0x43, 0x43, 0xe8,
 0x1f, 0xf1, 0xb1, 0x4c, 0x13, 0x72, 0x65, 0x0c, 0xbf, 0x19, 0x99
 , 0x8f, 0x51, 0xb5, 0xc5, 0x1b,
  0xf6, 0x6f, 0x49, 0xec, 0x62, 0x18, 0x40, 0x34, 0xa9, 0x4f, 0xc9,
 0x19, 0x8f, 0xa9, 0x17, 0x98, 0x49]

 #XOR first string by ciphertext to get the key, then use that key
 against the second ciphertext to get the string

 for z in range(0,len(list1)):
         r = list1[z]
         a = list2[z]
         first = r ^ a
         print first ^ list3[z]

 :END z4.py

 and then use bash to convert output to printable ascii

 ch@bluestem:~$ python z4.py | awk '{printf "%c\n", $1}' | tr -d '\n'
 zone-4-9D469367-B60E-4E08-BDF1-FED7CC74AF33

Snow Zone 5:
 -- The flag for this level is 3ab1c5fa327343721bc798f116be8dc6 --

 The hint at : https://twitter.com/h34t_m1s3r/status/276875683228176384
 linked to the blog post at http://pen-testing.sans.org/blog/pen-testing/2012/12/06/all-your-svn-are-belong-to-us explains how to get the pristine copy of the page.

ch@bluestem:~$ wget http://snowmiser.counterhack.com/zone-5-89DE9B26-CF7D-4B07-88DE-7A2F0A7B16FE/.svn/wc.db

ch@bluestem:~$ sqlite3 wc.db 'select local_relpath, ".svn/pristine/" || substr(checksum,7,2) || "/" || substr(checksum,7) || ".svn-base" as alpha from NODES;'
svn-base" as alpha from NODES;'
|
noaccess.php|.svn/pristine/41/4134e0e954d144ed932fd639b5a897f9ad47fff9.svn-base
index.php|.svn/pristine/7d/7d63810b0da679648fc20b4f1c84680ac08ec872.svn-base

ch@bluestem:~$ wget snowmiser.counterhack.com/zone-5-89DE9B26-CF7D-4B07-88DE-7A2F0A7B16FE/.svn/pristine/7d/7d63810b0da679648fc20b4f1c84680ac08ec872.svn-base

Once you have this page, you learn that you need to pass the sha1 hash of "$time 7998f77a7dc74f182a76219d7ee58db38be3841c" or else you will be redirected to noaccess.php.  In noaccess.php there is a line that provides the server time.  So you need to get that time (within 3 minutes), hash it and send it back. 

Here is what I used at the time I did it: 

ch@bluestem:~$ echo -n "2012-12-20 22:36 7998f77a7dc74f182a76219d7ee58db38be3841c" | sha1sum
cdb74ef7530f56fe02fb50702611093305cf9f11

When you use this hash as the password on the Snow4 page, you will be granted access to Snow5. 

SANS Holiday Challenge 2012: 

http://pen-testing.sans.org/holiday-challenge/2012

I worked through this challenge over the course of a few weeks and then went back to wrote up my solutions weeks later after the holidays.  Luckily, most of my notes and details were in my .bash_history, or else I'd have no idea how I solved many of these. 


Questions:

1. Where did you find the remainder of Snow Miser's Zone 1 URL?
It was pretty easy to see the reflection of the URL in this image from
twitter: https://twitter.com/sn0w_m1s3r/status/276820932104957952/photo/1


2. What is the key you used with steghide to extract Snow Miser's Zone
2 URL? Where did you find the key?
The key (IceIceBaby!) was in the User Comment metadata for off.jpg.
This key was used with steghide to extract the hidden url data.

ch@bluestem:~/snow$  steghide extract -sf off.jpg
steghide extract -sf off.jpg
Enter passphrase: IceIceBaby!
the file "tmpfile.txt" does already exist. overwrite ? (y/n) y
wrote extracted data to "tmpfile.txt".
ch@bluestem:~/snow$ cat tmpfile.txt
zone-2-6D46A633-25D7-42C8-AF94-8E786142A3E3

3. On Snow Miser's Zone 3 page, why is using the same key multiple
times a bad idea?
Using the same key multiple times increases  the chances that it will be cached.  This was found in the android data file data/com.android.browser/cache/webviewCacheChromium/data_2 from the

android image linked here:  https://twitter.com/h34t_m1s3r/status/276828387853611008


4. What was the coding error in Zone 4 of Heat Miser's site that
allowed you to find the URL for Zone 5?
The PHP redirect did not exit the script after running.  So the full page was downloaded and the data was visible using a proxy or tool that didn't follow the redirect.


5.  How did you manipulate the cookie to get to Zone 5 of Heat Miser's
Control System?
The cookie was the md5 sum of "1001", which was hinted at here:
https://twitter.com/sn0w_m1s3r/status/276871170085773312.  I tried replacing the cookie a  bunch of times with a lot of md5 hashes of different values.  It turned out to be the md5 sum of the number "1" that it wanted.

 6. Please briefly describe the process, steps, and tools you used to
 conquer each zone, including all of the flags hidden in the comments
 of each zone page.

Blog posts to follow

Defcon 19 Packet Challenge - Level 6

The last ingredient is stored away in Dr. Creedence Clearwater's private Truecrypt volume. On his hard drive there was a file titled "cipher". Perhaps it contains a clue that you can use to unlock the volume and help Inter0ptic find out the last ingredient.

1)      What is the final ingredient?

This one took a short while to figure out what the cipher.txt was telling us. 

chester@bluestem:~/DRILL$ cat cipher.txt

1-2  5-1 3-8 4-1 1-3 2-3 1-1 3-5 5-5 4-7

It not-so-quickly dawned on me that the first number in each pair was 1-5, and we had 5 previous answers.  So, the second number must be which character from the previous passwords to use. 

After working that out, the answer was found to be: 00gmu1rt#?

Using that key to open the Truecrypt volume, you find a file named “133t pill” with the following message:

Dear Inter0ptic,

If you are reading this message, then you must have escaped. Congrats. You didn't think that I was going to let you have the ingredients to the 133t pill, did you? As you have probably guessed, I obtained the creditcard numbers and the ingredients of the 133t pill myself, and sold them for a very nice profit.

Just in case you are curious, the missing ingredient for the 133t pill was "2oz Vodka."

It was great workin with you, my pawn.

XOXO,

Ann

And so the final answer is “20z Vodka”

Defcon 19 Packet Challenge - Level 5

The network at Factory-Made-Winning had been acting strange all day and Tim was getting very concerned what was happening at his company. He began looking over some traffic....

Use the packet capture in this folder to help Tim find out what's happening:

1)      What is the 3rd ingredient on the list from the mysterious file that was transfered?

This is pretty much the same process as the last challenge.  The only difference is a new file.  In this case the file is “\ingredients-list-133t-pi11.7z”.  This time the password is the word that the attacker found on a sticky note : useonce@. 

chester@bluestem:~/DRILL/05$ tcpdump -s0 -r Evidence05.pcap -w SMB.cap port 445

chester@bluestem:~/DRILL/05$ tshark -r SMB.cap | grep "Create AndX Request"

 12   0.007632  172.30.1.90 -> 172.30.1.214 SMB NT Create AndX Request, Path: \srvsvc

 39   3.045251  172.30.1.90 -> 172.30.1.214 SMB NT Create AndX Request, Path:

 44   3.060912  172.30.1.90 -> 172.30.1.214 SMB NT Create AndX Request, Path: \desktop.ini

 47   3.062061  172.30.1.90 -> 172.30.1.214 SMB NT Create AndX Request, Path:

 66   6.659435  172.30.1.90 -> 172.30.1.214 SMB NT Create AndX Request, Path: \Thumbs.db

 69   8.996870  172.30.1.90 -> 172.30.1.214 SMB NT Create AndX Request, Path:

 73   9.002135  172.30.1.90 -> 172.30.1.214 SMB NT Create AndX Request, Path: \ingredients-list-133t-pi11.7z

chester@bluestem:~/DRILL/05$ tcpxtract -c /etc/tcpxtract.conf -f SMB.cap

Found file of type "p7z" in session [172.30.1.214:48385 -> 172.30.1.90:25280], exporting to 00000000.p7z

Opening the file, you can find the password : 8.4 oz- Red Bull

Defcon 19 Packet Challenge - Level 4

Inter0ptic arrived to Factory-Made-Winning, and casually made his way past the front security desk. He then slipped into a secure access area by tailgating behind an employee. On the way in he found a sticky note with a password on it "useonce@". The password might come in handy later! With a grin and a chuckle, Inter0ptic found an empty cubical and plugged in his laptop.

Use the packet capture in this folder to learn more about Inter0ptic's adventure at the pharmaceutical company and answer the question below:

1.       What is the 16th name inside the mysterious file transfered?

Very early in the pcap you will notice some SMB traffic.  I started there. First I created a new pcap with only the port 445 traffic.  Then I ran it through tshark to decode and see what we could find.  I found a file name CCfiles.7z. 

carl@bluestem:~/DRILL/04$ tcpdump -s0 -r Evidence04.pcap -w SMB.cap port 445

reading from file Evidence04.pcap, link-type EN10MB (Ethernet)

chester@bluestem:~/DRILL/04$ tshark –r SMB.cap

48   6.157845 172.30.1.214 -> 172.30.1.90  SMB NT Create AndX Response, FID: 0x8003

 49   6.158411  172.30.1.90 -> 172.30.1.214 SMB Close Request, FID: 0x8003

 50   6.158476 172.30.1.214 -> 172.30.1.90  SMB Close Response, FID: 0x8003

 51   6.163547  172.30.1.90 -> 172.30.1.214 SMB NT Create AndX Request, Path: \CCfiles.7z

 52   6.163652 172.30.1.214 -> 172.30.1.90  SMB NT Create AndX Response, FID: 0x8004

 53   6.163945  172.30.1.90 -> 172.30.1.214 SMB Trans2 Request, QUERY_FILE_INFO, FID: 0x8004, Query File Internal Info

This time we’ll use tcpxtract by Nick Harbour.

chester@bluestem:~/DRILL/04$ cat /etc/tcpxtract.conf

p7z(5000000, \x37\x7a\xbc\xaf\x27\x1c);

chester@bluestem:~/DRILL/04$ tcpxtract -c /etc/tcpxtract.conf -f SMB.cap

Found file of type "p7z" in session [172.30.1.214:48385 -> 172.30.1.90:4032], exporting to 00000000.p7z

I tried to decompress the 7zip with p7zip, but I got unsupported method error.  It appears to be due to a password protection on the file.  I copied the file over to windows and used 7zip there to decompress.  It opened fine there and prompted me for a password.  I first tried useonce@ but failed.  Then I tried Romulus password from challenge 3 and it was correct.  Inside is an xls file. 

chester@bluestem:~/DRILL/04$ p7zip -d 00000000.p7z

7-Zip (A) 9.04 beta  Copyright (c) 1999-2009 Igor Pavlov  2009-05-30

p7zip Version 9.04 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,1 CPU)

Processing archive: 00000000.p7z

Extracting  CCfiles.xlsx     Unsupported Method

Sub items Errors: 1

Scrolling down to the 16^th line inside the XLS file, you get the answer: Jason Wilson

Defcon 19 Packet Challenge - Level 3

A mysterious call is made to Romulus (a new accounts manager) at Factory-Made-Winning.

Use the packet capture in this folder to learn more about the phone call and answer the following question:

1.       What is Romulus' password?

I opened the pcap in Wireshark first, but it did not identify any voip converstaions.  I then tried xplico:

carl@bluestem:~$ ./xplico -m pcap -f /home/chester/DRILL/Evidence03.pcap

xplico v0.6.3

Internet Traffic Decoder (NFAT).

Cap. time: Thu Jun 23 13:40:49 2011

Total elaboration time: 4s            

carl@bluestem:~$ ls xdecode/172.30.1.101/http/74.125.224.116

http_rs_body_1314482374_0xa51a2a8_1  post

carl@bluestem:~$ cat http_rs_body_1314482374_0xa51a2a8_1

relay.ip=74.125.127.126

relay.udp_port=19295

relay.tcp_port=19294

relay.ssltcp_port=443

stun.ip=74.125.127.126

stun.port=19302

username=1ZUfriXYKVltcU72

password=IyUDFIcH1JL8Ho8N

magic_cookie=rÆKÆ

Not a smoking gun, but the ip 74.125.127.126 is owned by google, so we’re probably looking at googlechat voip call.  After some searching I found that xplico can take advantage of a tool called videosnarf to decode VOIP calls.  I set up this tool and ran it on its own.

carl@bluestem:~$ videosnarf -i Evidence03.pcap

added new stream. :172.30.1.101(56213) to 74.125.127.126(19295). codec is 00

added new stream. :74.125.127.126(19295) to 172.30.1.101(56213). codec is 00

 [+]Stream saved to file G711ULAW-media-1.wav

[+]Stream saved to file G711ULAW-media-2.wav

Bingo.  If you listen to the G711ULAW wav files, you can hear both sides of a staged social-engineering call to Romulus.  He willingly gives over his password to the caller.

Answer:  rom127#

Defcon 19 Packet Challenges - Level 2

Ann, afraid that someone may be watching her, decides to capture all of her home traffic. She mentions her fear to Mr. X and explains that she has been capturing her home traffic for days and will be sending the packets out for analysis later in the day. She sends her captures to the one person she knows can trust. After their discussion, Mr. X rushes to his lab, to see if he can intercept Ann's outbound message and use her capture to get more detail on her upcoming activities..

1.       What is the date, as it appears in the capture, of the cryptographer's speaking engagement? (hint: It isn't at Defcon)

This one was slightly more difficult.  The scenario says Mr X. is trying to capture Ann’s message, so I went looking for emails. First I used tcpflow to dump all the network conversations into separate files. This probably could have been easier by using NetworkMiner or NetWitness, but I preferred to work on these on a Linux shell.

carl@bluestem:~$  tcpflow -r Evidence02.pcap

Then I searched for the word “Subject” in the resulting files, since that should be in any Email.  One hit stood out:

carl@bluestem:~$  grep -a Subject *

172.030.001.100.51805-205.188.192.001.00080: 

From":"ann1smysterious@aol.com","To":"d_tangent@aol.com,","Cc":"","Bcc":"","Subject":"My Trusted Friend","RichBody":"You are the only one that I can trust.  I need to know if someone monitoring me.  Attached is a capture of my traffic

 

As the scenario said, Ann sent a pcap to a person she could trust.  Let’s get that pcap.  Using foremost, the magic number for a pcap is 0xd4c3b2a1.

carl@bluestem:~$  cat /etc/foremost.conf

pcap n      5000000 \xd4\xc3\xb2\xa1

carl@bluestem:~$  foremost -c /etc/foremost.conf -i 172.030.001.100.51805-205.188.192.001.00080

Processing: 172.030.001.100.51805-205.188.192.001.00080

|*|

carl@bluestem:~$ file output/pcap/00000030.pcap

output/pcap/00000030.pcap: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 65535) 

This is the Help.pcap plus some extra data on the end, since we didn’t specify a specific file size.  Tcpdump will still parse the file. 

A quick look around this cap and we see the site of a well-known cryptographer (remember we are looking for the date of a cryptographer’s speaking engagement).

carl@bluestem:~$  tcpdump -nn -r Help.pcap -A -s0 port 80 | grep Host | sort | uniq

Host: www.schneier.com

Looking at the pcap, we determine the IP of schneier.com to be 204.11.246.48, so we can focus on that.  Once again, tcpflow to break up this pcap into parse-friendly conversations. 

carl@bluestem:~$  tcpflow -r Help.pcap host 204.11.246.48

carl@bluestem:~$  grep GET *

172.030.001.100.60176-204.011.246.048.00080:GET /schedule.html HTTP/1.1

Looks promising.  So, we’ll use the other half of this file that matches this request to get the response. 

carl@bluestem:~$ head 204.011.246.048.00080-172.030.001.100.60176  (server response)

HTTP/1.1 200 OK

Date: Wed, 22 Jun 2011 21:05:31 GMT

Server: Apache

Vary: User-Agent,Accept-Encoding

Last-Modified: Tue, 17 May 2011 01:51:36 GMT

ETag: "e78-4a36f03207a00"

Accept-Ranges: none

Content-Encoding: gzip

Gzipped data.  So we’ll use foremost again to carve the gzip file.   

carl@bluestem:~$ cat /etc/foremost.conf

gz n 50000 \x1f\x8b

carl@bluestem:~$  foremost -c /etc/foremost.conf -i 204.011.246.048.00080-172.030.001.100.60176

Processing: 204.011.246.048.00080-172.030.001.100.60176

|*|

carl@bluestem:~$  file output/gzip/00000000.gzip

output/gzip/00000000.gzip: gzip compressed data, from Unix

Gunzip it and inside we have an HTML file.  And searching the html file, we find:

Global AppSec Latin America 2011 Conference

October 6-7, 2011

Keynote

Answer: October 6-7, 2011