UTPHAX'15 - (ROUND 2) Challenge 3 - Web 1.0

Description :  http://kemboja.utphax.my/YmVjNTMwNGNmYTg0ZGIzZjFlZWY3OGI3/index.html
Point : 100

When open it just nothing in the web page. So view source and see any information.

Haa! We got something in the javascript. There are some hex string. So we decode it, and got userAgent, substr, length, getElementbyId and etc..

So we try to understand what they are doing.

Basically, it just take the value from the userAgent, for example like this :

Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0

And then compare that value with plaintext value which is :

The supreme art of war is to subdue the enemy without fighting.

So now if we change the userAgent value to that string, then we can proceed with the if statement here.


Then change the userAgent (User Agent Switcher for firefox) and you refresh the page and dont forget to edit the html page, because there is css element that will make it display nothing :

Just remove the "display:none" or you remove id="board" in the div tag. Then you will see a md5 hash string.

I dont know whether the md5 hash is the flag because I dont solve this challenge at that time. Haha.

UTPHAX'15 - (ROUND 2) Challenge 1 - Check The Packets!

Description : Hacker targetting an Apple computer. Give me the Apple's MAC. My email only accepting capital letters. Download the analysis file at http://kekwa.utphax.my/N2ZlNWQ4MDQwMmUxMjQ1OGQwMjRiODRl/senang1.pcap
Point : 100

So this is network forensic challenge where we need to analyze the pcap file and get the mac address of apple computer.

First step open the pcap file with wireshark, and then type this in display filter wireshark :

eth.addr

 After that you just search for "Apple" word, at packer no. 4, we got the Apple's mac address!

Thats our flag!

Flag : 00:16:CB:92:6E:DC

[Reverse Engineering] UTPHAX'15 - (FINAL) Challenge 6 - Privacy is no good

Description : Did I bought a fake sotware?!
Point : 300


Why I make this write up again? Because I just want to implement my new way to solve this problem, and of course the better way. Reverse engineering. Haha.


So the challenge is to activate the notepad. We open the notepad, and try to activate the software with dummy input. And of course got "Try harder" since we don't know the real key.

Input

Output

So I just open the notepad with OllyDbg to study how the program works.


1) Search for referenced string, why I do this? Because I just want to search for weird/interesting strings that can help us to understand more this program.


We can see that there are strings that capture our attention especially the string "The flag is" and continue some word that like 1xxmak1xx.... So we know maybe that's our flag.

2) We double click at "Try harder" string to follow in disassembler, to get further information about the algorithm. At 0x0040373E is where the string "Try harder" is. So we just need to reverse the algorithm, to know how it jump to this address. At 0x00403733, see in Hint Pane here, it says "Jump from 00402C0F", yeah it's a good hint. We know where to go now. Set a breakpoint here, so that's easy for us to check later.

3) We go to the address 0x00402C0F by pressing Ctrl+G or Right click -> Go to -> Expressions, then input our addresss here which is 00402C0F. And here we jump to the address. I will set breakpoint at this address also.

JNZ BukuNota.00403733 instruction happened at this address, so by looking the above instruction, which is TEST EAX,EAX. TEST EAX,EAX instruction means if the value is not equal to 0, then Zero Flag will be 0, or else Zero Flag is set. JNZ instruction means jump if not equal to zero, so if the Zero Flag value is equal to 0, it will jump/lead to our "Try harder" section which is 00403733, else it will continue below instruction. Of course we want it continue to below instruction right?

4) So let us input again our dummy input, and when it arrive to our breakpoint at 0x00402C0F, we just change the Zero flag to 1.

I hope you understrand the arrow in the picture. Haha. Right arrow there where I just double click at the value Zero Flag to change it to 1 or we called it as Set. So we just click Run again, or F9.

But we still go to the "Try harder" section? Remember we made a breakpoint at the "Try harder" address which is 0x00403733? So there must be another condition that lead to "Try harder" address. We have to find it by click at 0x00403733 and see where the jump comes from the Hint Pane.

5) From the Hint Pane it says "Jump from 00402E4D", so we go to the address to know what happen there.

See that? The are string "The", " Flag"!. Okay relax. We need to bypass JE instruction first which will lead to our "Try harder" section if Zero Flag is 1. We just need to change the Zero Flag if we want to bypass the JE instruction!

6) We input dummy data, and change Zero Flag value at (0x00402C0F) JNZ instruction to 1, (0x00402E4D) JZ to 0, for two times. I dont know why there is a loop. Haha.

So here we got our flag!

I know that my method so simple just by changing the Zero Flag, but it gets the job done right? And of course better than the method that I show in the previous post. After this maybe I will study the algorithm to get the real activation key.

UTPHAX'15 - (FINAL) Challenge 6 - Privacy is no good

Download : BukuNota2.0.zip

Description : Did I bought a fake sotware?!
Point : 300

ATTENTION! This write up is for noobies only since my way yo get the flag was so noob.

Since I dont know about reverse engineering, so i just extract the file with peazip. Lol!

Then search for the flag in each file that have been extracted. And luckily got the flag in ".rdata".

Flag : 1xxmakanaNsiHatiTupENTing

UTPHAX'15 - (FINAL) Challenge 1 - Weird but not weird enough

Description : Nothing
Point : 400

Open the link and we have been given login page. Try inject the login using sql injection method.

By input this in the login

User : admin'--
Password : admin'--

Then got the flag.

Flag : pipe_for_teh_winneh!

UTPHAX'15 - (FINAL) Challenge 8 - Tay Tay

Description : Taylor Swift love if you concat everything. Kyaaa
Point : 300

We receive an E01 file. So we google the file extension, it is E01 files that have been created by EnCase.

When EnCase is used to image a hard drive, CD, or USB drive it produces an image file(s), these files are known as “E01” files, as this is the extension of the primary EnCase image file. The file name is provided by the users, e.g Drive1, A001, but the extension is automatically named E01.Aug 10, 2008  

https://whereismydata.wordpress.com/2008/08/10/e01-files/ 

Use EnCase to open the file and got this information.

and then mount it. Using AccessData FTK Imager to search "important" things.

So after mount it, open the mounted disk, and search for everything. Found IMPORTANT.txt at E:\WINDOWS\Desktop

Open that text file and found sentence that make us curious, "AND LOOK AT DOOM".

At the Desktop we can see there is doom file. So open the doom file and search anything that can help us get the flag. Back to the description, there is a hint "concat" so it means the flag must be in seperate file or anything that we need to use concat to get the flag. 

Open and open the files, we found 6 files (DOOMSAV0.DSG, DOOMSAV1.DSG.....) that have "malay" words at every first sentence. So we combine all those words from  files and got the flag. 

Flag : SAYARASAMACAMHIDUPTAHUN1998

UTPHAX'15 - (FINAL) Challenge 5 - Yeah... management...

Description : CEO send this file. He cannot open it. Help him.
Point : 500 points

First of all open the xlsx file first. Then it is just bunch of rectangle and round shape. Nothing interesting.

Then close the file and open it with peazip.

Search and search the file that is obvious and then found sheet4.xml file that the date different from other file.

Open the file with notepad++ and got the flag!

Flag : myfileisbrokenmommy