Ghostintheshellcode Stage 5 CCTV Forensics 250pts

Stage 5
Question: cctv
250 Points
File: cctv-88cbfd616c1ce146ca6b738772c10bea

The CCTV page has 9 animated gifs. Collect them all!

carl@b:~/cctv$ ls
code.gif  davinci.gif  destroycard.gif  game.gif  gibson1.gif  gibson2.gif  gibson3.gif  hops.gif  otv.gif

This took a long time while we tried a bunch of useless ideas.
-All of the gifs were exploded into single frames and each was checked for any watermarks or interesting information.
-We tried to find any hidden data stored between the frames.  I hear you can append a zip file to the end of a gif file and each can be opened with native tools.
-Looked for something interesting based on the timing of each frames.
-Loaded them into gimp and noticed the timing was between 0-70ms per frame, which made me think hidden octal numbers, but this was a dead end, for now.

We massaged each of the files through imagemagick over and over with no results.  At one point, I came across this page: http://www.imagemagick.org/discourse-server/viewtopic.php?f=1&t=11988 which led me to look for "ticks".  Imagemagick's identify command can show ticks if you use %T.

carl@b:~/cctv$ info="%T"
carl@b:~/cctv$ identify -format "$info" *.gif

1531521641211231061411441461531541461521411631460120001101211051441441661701721261011071011061460120014616116414516116410112310410610110614716116414401200001031621411631501451441011561441021651621561451440120014114711010712116114116314414614112413111011014101201461411231071241211041431701411471461611470120000147131121161145141146144163166170147141141147012012114514114114614116314414612110513112210516301214612116414414717112514114416614217210114614614101200

I'm pretty certain the only reason this looked interesting to me was because I saw the file in gimp earlier and 0-70ms made me think "octal".  Otherwise, I probably would have missed it. 

carl@b:~/cctv$ identify -format "$info" *.gif > file.out
carl@b:~/cctv$ more file.out
1531521641211231061411441461531541461521411631460120001101211051441441661701721261011071011061460120014616116414516116410112310410610110614716116414401200001031621411631501451441011561441021651621561451440120014114711010712116114116314414614112413111011014101201461411231071241211041431701411471461611470120000147131121161145141146144163166170147141141147012012114514114114614116314414612110513112210516301214612116414414717112514114416614217210114614614101200

Break up the string into sets of 3 digits:

carl@b:~/cctv$ egrep -o "[0-9]{3}" file.out > file2.out
carl@b:~/cctv$ more file2.out
153
152
164
121
[...]

carl@b:~/cctv$ perl octa -a file2.out
carl@b:~/cctv$ more file2.out.as
kjtQSFadfklfjasf
NULHQEddvxzVAGAFf
SOH     !1      1PNULCrashedAndBurned
SOHA9AAPfaSGTQDcxagfqg
NULFFJNLLFFLL))Q        P

The key is in octal in the ticks inside game.gif.  The key is "CrashedAndBurned".

The octa file is octala.pl from Mike Golvach: http://linuxshellaccount.blogspot.com/2008/05/perl-script-to-do-lame-encryption-with.html.  Thanks to him for his script.

Ghostintheshellcode Stage10 Forensics 400 points.

Stage 10
Question: Hackerlife
400 Points

John doesn't see a problem.

File: hackerlife-0b8724a229d81bbb727d27d735eaca86


The file is pretty large by itself.  It is a bzipped tarball.  Extract it out.

carl@b:~/hackerlife$ file hackerlife-0b8724a229d81bbb727d27d735eaca86
hackerlife-0b8724a229d81bbb727d27d735eaca86: bzip2 compressed data, block size = 900k

carl@b:~/hackerlife$ bunzip2 hackerlife-0b8724a229d81bbb727d27d735eaca86
bunzip2: Can't guess original name for hackerlife-0b8724a229d81bbb727d27d735eaca86 -- using hackerlife-0b8724a229d81bbb727d27d735eaca86.out

carl@b:~/hackerlife$ ls -al
total 73560
drwxr-xr-x  3 carl carl     4096 2011-02-21 11:00 .
drwxr-xr-x 38 carl carl    69632 2011-02-20 22:53 ..
-rw-r--r--  1 carl carl 75243520 2011-02-21 11:00 hackerlife-0b8724a229d81bbb727d27d735eaca86.out
drwxr-xr-x  3 carl carl     4096 2011-02-21 11:00 new

carl@b:~/hackerlife$ file hackerlife-0b8724a229d81bbb727d27d735eaca86.out
hackerlife-0b8724a229d81bbb727d27d735eaca86.out: POSIX tar archive

carl@b:~/hackerlife$ tar xf hackerlife-0b8724a229d81bbb727d27d735eaca86.out

carl@b:~/hackerlife$ file 6661024a3d7bbe441f8930e761a138f4
6661024a3d7bbe441f8930e761a138f4: ASCII text, with CRLF line terminators

carl@b:~/hackerlife$ ls -al 6661024a3d7bbe441f8930e761a138f4
-rw-r--r-- 1 carl carl 75231938 2010-12-31 00:42 6661024a3d7bbe441f8930e761a138f4

Looking at the file, it looks like an oddly formatted passwd dump.  Looking through the list, it's obviously the well-publicized dump of gawker.com users. 

carl@b:~/hackerlife$ more 6661024a3d7bbe441f8930e761a138f4
nicka ::: NULL ::: NULL ::: naster@gawker.com
Lisanti ::: NULL ::: NULL ::: tips@defamer.com
Choire ::: NULL ::: NULL ::: choire@gawker.com
Defamer ::: NULL ::: NULL ::: tips@defamer.com
gabriela ::: NULL ::: NULL ::: gabriela@gawker.com
trackbacker ::: NULL ::: NULL ::: trackbacker@gawker.com
wonkette ::: NULL ::: NULL ::: tips@wonkette.com
lev ::: NULL ::: NULL ::: tips@gizmodo.com
[...]

So, I got a hold of the actual list and compared them. 

carl@b:~/hackerlife$ more gawker.passwd
nicka:NULL:NULL:naster@gawker.com
Lisanti:NULL:NULL:tips@defamer.com
Choire:NULL:NULL:choire@gawker.com
Defamer:NULL:NULL:tips@defamer.com
gabriela:NULL:NULL:gabriela@gawker.com
trackbacker:NULL:NULL:trackbacker@gawker.com

carl@b:~/hackerlife$ wc -l gawker.passwd
1247893 gawker.passwd

carl@b:~/hackerlife$ wc -l 6661024a3d7bbe441f8930e761a138f4
1247912 6661024a3d7bbe441f8930e761a138f4


Those are pretty close.  Lets find what is different. 


carl@b:~/hackerlife$ awk -F"[: ]" '{print $1}' gawker.passwd > gawker.users
carl@b:~/hackerlife$ awk -F"[: ]" '{print $1}' 6661024a3d7bbe441f8930e761a138f4 > 666.users


carl@b:~/hackerlife$ diff -y --suppress-common-lines gawker.users2 666.users
             > havlarflake
             > dragosr
             > dino
             > dakami
             > 41414141
             > ChrisPaget
             > 0xcharlie
             > taviso
             > ero
             > thedarktangent
             > hdm
             > invisig0th
             > alexsotirov
             > mdowd
             > dionthegod
             > evilcazz
             > scarybeasts
             > egyp7
             > s7ephen

Those guys look familiar. 

carl@b:~/hackerlife$ cat users
havlarflake ::: UtTv7enb7F7eo ::: NULL ::: Rmd4@gmail.com
dragosr ::: /3EK9FFao4Pg6 ::: NULL ::: aD92@gmail.com
dino ::: V2ImDfHvvzeGM ::: NULL ::: L3d3@gmail.com
dakami ::: HH1Ib3DcdRGSk ::: NULL ::: IGtl@gmail.com
41414141 ::: S8/2fLdvnSKM. ::: NULL ::: bS93@gmail.com
ChrisPaget ::: aRHvyiutiwz3A ::: NULL ::: PThp@gmail.com
0xcharlie ::: NVDC2543t.EKw ::: NULL ::: eSBp@gmail.com
taviso ::: 6vqZ23UFznzuc ::: NULL ::: czog@gmail.com
ero ::: Alj6D38tP79g6 ::: NULL ::: YXRj@gmail.com
thedarktangent ::: 0dOYtkSGSMR4. ::: NULL ::: LmNv@gmail.com
hdm ::: TxuDvnUnk94wU ::: NULL ::: VGhl@gmail.com
invisig0th ::: hBYhGy4dotTCc ::: NULL ::: TGY4@gmail.com
alexsotirov ::: oMCKEbmr9Kcx6 ::: NULL ::: ZHZH@gmail.com
mdowd ::: TGW6yISW/Ezzo ::: NULL ::: b3V0@gmail.com
dionthegod ::: 79mrBN2Qrejrk ::: NULL ::: dWJl@gmail.com
evilcazz ::: L6D79o81B8rL6 ::: NULL ::: cDov@gmail.com
scarybeasts ::: 6/gvMSbzDN1a. ::: NULL ::: aHR0@gmail.com
egyp7 ::: boREOx6UFvQF. ::: NULL ::: Lg==@gmail.com
s7ephen ::: m4bjrTwr9hbt6 ::: NULL ::: dy55@gmail.com


Those email addresses look suspicious, especially "Lg==@gmail.com".  Anytime I see ==, I assume base64 padding.

carl@b:~/hackerlife$ cat users-original-order | egrep -o ".{4}@gmail.com"  | cut -c1-4 | tr -d '\n'
Rmd4aD92L3d3IGtlbS93PThpeSBpczogYXRjLmNvVGhlTGY4ZHZHb3V0dWJlcDovaHR0Lg==dy55

carl@b:~/hackerlife$ cat users-original-order | egrep -o ".{4}@gmail.com"  | cut -c1-4 | tr -d '\n' | base64 -d
Fgxh?v/ww kem/w=8iy is: atc.coTheLf8dvGoutubep:/htt.w.y


Rearrange the parts of the base64 string and you end up with:

carl@b:~/hackerlife$ echo "VGhlIGtleSBpczogaHR0cDovL3d3dy55b3V0dWJlLmNvbS93YXRjaD92PThpZHZHRmd4TGY4Lg==" | base64 -d
The key is: http://www.youtube.com/watch?v=8idvGFgxLf8.


If you visit that link, and you should.  You'll also find somebody has beaten you to it: 
"Wow, this URL is totally the key. Seriously. The key. The url. The key.  realnamehere 1 month ago "

Ghostintheshellcode Stage 26 BeatBoxing Packet 75pts

Stage 26
Question: BeatBoxing
75 Points
File: beatboxing-da09c691e2613581f1f4db70810c6e5c


carl@b:~/beatbox$ file beatboxing-da09c691e2613581f1f4db70810c6e5c
beatboxing-da09c691e2613581f1f4db70810c6e5c: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 65535)

First just reviewed the dump file to see if anything stood out. I went down a few paths checking the delay between packets and any variance in the packet size, but they didnt lead me anywhere. The source and destination ports didn't seem to be of note either.

carl@b:~/beatbox$ tcpdump -nnn -r beatboxing-da09c691e2613581f1f4db70810c6e5c
carl@b:~/beatbox$ tcpdump -nnn -A -r beatboxing-da09c691e2613581f1f4db70810c6e5c


I extracted the payload using tcpflow. The only thing I noticed was the file was exactly 65535 bytes. That didn't lead me to any conclusions other than it was likely custom generated.

carl@b:~/beatbox$ tcpflow -r beatboxing-da09c691e2613581f1f4db70810c6e5c
carl@b:~/beatbox$ ls -al 127.000.000.001.42405-127.000.000.001.04242
-rw-r--r-- 1 carl carl 65535 2011-02-20 15:18 127.000.000.001.42405-127.000.000.001.04242
carl@b:~/beatbox$ file 127.000.000.001.42405-127.000.000.001.04242
127.000.000.001.42405-127.000.000.001.04242: data

After reading some other CTF write ups, it dawned on me to look for the number of occurrences of specific characters, which led me to this:

carl@b:~/beatbox$ egrep --binary-files=text -o "[A-Za-z0-9]" 127.000.000.001.42405-127.000.000.001.04242 | sort | uniq -c | sort -n

[...]
175 H
176 a
177 c
178 k
179 E
180 R
181 s
182 F
183 o
184 r
185 L
186 i
187 f
188 e
190 G
191 I
192 T
193 S
227 h
231 1
238 V
240 6
240 A
243 K
244 U
245 W
246 u
248 p
[...]


and thus the answer: HackERsForLifeGITS