The Dragonsec Security Team hosted their first CTF this year: https://dragonsec.si/si/dctf
Here is our write-up:
The solved challenges:
Julius' ancient script:
- Given was a simple string, the hint is in the name of the challenge -> Caesar Chiffre. The solution was to use a custom alphabet (adding 0123456789 to the shift). I used dcode.fr to solve it.
Leak Spin:
- Not much of a hint. A flag was published somewhere on the internet.
Solution: The flag is hidden inside the github repository from dragonsec.si
DevOps vs. SecOps:
- No hint, no URL to analyze. What does DevOps do all the time? Deploy stuff.
Solution: Same as Leak Spin. The flag was hidden in the .github folder inside the github repo of dragonsec.si
Encrypted the flag I have:
- Given was a picture with weird looking symbols and the weird grammar from the challenge.
Solution: The symbols are Aurebesh characters. Find the correct symbols and translate them.
Powerpoint programming:
- A weird powerpoint file. No makros and no VBA in there, but still a hidden flag...
Solution: Open the animation pane and follow the green animations. Note the characters they trigger. This is the flag.
Dont let it run
- Download the pdf and analyze it with strings. You'll find an encrypted Javascript. Load that into CyberChef and inside the code, there is the flag.
This one is really basic
- 8mb text-file, a hint pointing at The Hitchhiker’s Guide to the Galaxy (42).
Solution: 42x Base64 enconding.
Strong password
- A password protected zip-file.
Solution: Use John the Ripper with rockyou.txt
Forgotten secret:
- Given was a docker image to analyze. Extract the files from the image and you can find a cipher.bin and a id_rsa from root. In the docker history or the .json file from the image root folder you get the SECRET_KEY.
Solution: Use the key to rewrite the id_rsa into a pem file and then decrypt the cipher.bin with it.
Show us your ID:
- Solution: Download the nyan.pdf file and take a look at it with strings. You find an ID and just paste it in CyberChef -> Flag found.
Unlimited Power:
- Download the .prg file. .prg files can be used with Garmin devices. On the Garmin homepage it is possible to download a SDK and simulate any device. Run the prg-file in such a simulation (I used the Garmin Edge 1030). With the simulated fit files, the watt only go till 200. You need a .fit file with a powermeter to replay it with the programm (easy when you are a triathlete xD). Now you just need to up the power a LOT! Use fitfiletools.com and tweak your .fit file. Run the simulation another time and read the flag.
Hidden Message:
- Download the .png file and put it in a steganography decoder, e.g. https://stylesuxx.github.io/steganography/
Then read the hidden message - finish.